sneakoscope 6.2.0 → 6.4.0

package/dist/scripts/{legacy-upgrade-matrix-check.js → current-upgrade-matrix-check.js}

@@ -1,9 +1,5 @@
 #!/usr/bin/env node
 // @ts-nocheck
-// Gate: migration:upgrade-safety
-// Proves a 1.18.x -> 1.19 upgrade never breaks user Codex config across legacy
-// states. Operates entirely on temp dirs (os.tmpdir + fs.mkdtemp); never touches
-// the real ~/.codex. Always restores process.env.CODEX_HOME / HOME in finally.
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -23,7 +19,6 @@ function rmTmp(dir) {
         fs.rmSync(dir, { recursive: true, force: true });
     }
     catch {
-        // best-effort cleanup; never fail the gate on teardown
     }
 }
 const tmpDirs = [];
@@ -31,12 +26,6 @@ const savedCodexHome = process.env.CODEX_HOME;
 const savedHome = process.env.HOME;
 const summary = { states: {}, generated_at: new Date().toISOString() };
 try {
-    // ---------------------------------------------------------------------------
-    // State 6 — corrupted config (machine-local key absorbed into a TOML table).
-    // The pre-fix mover appended top-level machine-local keys after the last
-    // [table], so TOML absorbed them into that table. repairCodexConfigStructure
-    // hoists them back above the first table header.
-    // ---------------------------------------------------------------------------
     {
         const dir = mkTmp('sks-legacy-corrupt-');
         tmpDirs.push(dir);
@@ -46,12 +35,9 @@ try {
         const result = await policy.repairCodexConfigStructure(configPath, { apply: true });
         const okStatuses = ['structure_repaired', 'structure_repair_available', 'structure_ok'];
         assertGate(okStatuses.includes(result.status), 'corrupted_config: repair status not recognized', { status: result.status, expected: okStatuses });
-        // If it hoisted, a backup must exist on disk.
         if (result.status === 'structure_repaired') {
             assertGate(Boolean(result.backup_path) && fs.existsSync(result.backup_path), 'corrupted_config: repaired but no backup file on disk', { backup_path: result.backup_path });
         }
-        // Tolerant structural check: either the keys were hoisted ABOVE the first
-        // table header, or the structure was already ok.
         const repaired = fs.readFileSync(configPath, 'utf8');
         const firstTableIdx = repaired.indexOf('\n[');
         const headRegion = firstTableIdx === -1 ? repaired : repaired.slice(0, firstTableIdx);
@@ -63,12 +49,6 @@ try {
             backup_present: Boolean(result.backup_path)
         };
     }
-    // ---------------------------------------------------------------------------
-    // States 1-4 — user global config preserved + user-disabled flags not
-    // re-enabled. ensureGlobalCodexFastModeDuringInstall reads the Codex home
-    // config (HOME/.codex/config.toml; honors opts.home). It is set-if-absent and
-    // backs up the prior good config before any mutation.
-    // ---------------------------------------------------------------------------
     {
         const tmpHome = mkTmp('sks-legacy-home-');
         tmpDirs.push(tmpHome);
@@ -84,10 +64,7 @@ try {
         assertGate(after.includes('model = "o3"'), 'user_config_preserved: user model was overwritten', { status: result.status });
         assertGate(after.includes('service_tier = "flex"'), 'user_config_preserved: user service_tier was overwritten', { status: result.status });
         assertGate(after.includes('model_reasoning_effort = "high"'), 'user_config_preserved: user model_reasoning_effort was overwritten', { status: result.status });
-        // User-disabled feature must NOT be re-enabled (set-if-absent only).
         assertGate(after.includes('browser_use = false'), 'flags_not_reenabled: user-disabled browser_use was re-enabled', { status: result.status });
-        // When the managed defaults were applied, the prior good config must be
-        // backed up to a sibling config.toml.*bak file.
         if (result.status === 'updated') {
             const siblings = fs.readdirSync(codexDir);
             const backup = siblings.find((name) => /config\.toml\..*bak/.test(name));
@@ -98,7 +75,6 @@ try {
             summary.states.user_config_preserved = { status: result.status };
         }
         summary.states.flags_not_reenabled = { browser_use_preserved: true };
-        // Restore env immediately after this state to avoid leaking into spawns.
         if (savedCodexHome === undefined)
             delete process.env.CODEX_HOME;
         else
@@ -108,10 +84,6 @@ try {
         else
             process.env.HOME = savedHome;
     }
-    // ---------------------------------------------------------------------------
-    // State 6b — splitter preserves project keys. The project config keeps its
-    // own [profiles.*] table; only machine-local top-level keys are moved out.
-    // ---------------------------------------------------------------------------
     {
         const projectRoot = mkTmp('sks-legacy-project-');
         const tmpHome2 = mkTmp('sks-legacy-home2-');
@@ -119,8 +91,6 @@ try {
         const projectCodexDir = path.join(projectRoot, '.codex');
         fs.mkdirSync(projectCodexDir, { recursive: true });
         const projectConfigPath = path.join(projectCodexDir, 'config.toml');
-        // Machine-local keys/tables (model_provider, [profiles.*]) move out to CODEX_HOME;
-        // project-scoped settings (sandbox_mode, [features]) must be PRESERVED in place.
         fs.writeFileSync(projectConfigPath, '# Sneakoscope managed fixture\nmodel_provider = "codex-lb"\nsandbox_mode = "workspace-write"\n\n[features]\nhooks = true\n', 'utf8');
         const result = await policy.splitCodexProjectConfigPolicy(projectRoot, {
             apply: true,
@@ -137,32 +107,31 @@ try {
             moved_tables: result.moved_tables || []
         };
     }
-    // ---------------------------------------------------------------------------
-    // State 7/10 — tmux is a removed runtime; zellij status is informational.
-    // Spawn the built CLI from the repo root.
-    // ---------------------------------------------------------------------------
     {
-        const tmux = spawnSync(process.execPath, ['dist/bin/sks.js', 'tmux', '--json'], {
+        const removedCommand = spawnSync(process.execPath, ['dist/bin/sks.js', 'tmux', '--json'], {
             cwd: root,
             encoding: 'utf8'
         });
-        let tmuxJson;
+        let removedCommandJson;
         try {
-            tmuxJson = JSON.parse(tmux.stdout);
+            removedCommandJson = JSON.parse(removedCommand.stdout);
         }
         catch (err) {
-            assertGate(false, 'tmux_removed_runtime: stdout is not valid JSON', {
-                stdout: tmux.stdout,
-                stderr: tmux.stderr,
+            assertGate(false, 'removed_command_unknown: stdout is not valid JSON', {
+                stdout: removedCommand.stdout,
+                stderr: removedCommand.stderr,
                 error: String(err)
             });
         }
-        assertGate(tmuxJson.status === 'removed_runtime' && tmuxJson.replacement === 'zellij', 'tmux_removed_runtime: tmux did not report removed_runtime -> zellij', { json: tmuxJson });
-        assertGate(tmux.status === 2, 'tmux_removed_runtime: tmux exit code must be 2', { exit: tmux.status });
-        summary.states.tmux_removed_runtime = {
-            status: tmuxJson.status,
-            replacement: tmuxJson.replacement,
-            exit: tmux.status
+        assertGate(removedCommandJson.status === 'blocked'
+            && removedCommandJson.reason === 'unknown_command'
+            && (removedCommandJson.replacement ?? null) === null, 'removed_command_unknown: removed input must be unknown without redirect metadata', { json: removedCommandJson });
+        assertGate(removedCommand.status === 1, 'removed_command_unknown: removed input exit code must be 1', { exit: removedCommand.status });
+        summary.states.current_surface_unknown_command = {
+            status: removedCommandJson.status,
+            reason: removedCommandJson.reason,
+            replacement_present: Object.hasOwn(removedCommandJson, 'replacement') && removedCommandJson.replacement != null,
+            exit: removedCommand.status
         };
         const zj = spawnSync(process.execPath, ['dist/bin/sks.js', 'zellij', 'status', '--json'], {
             cwd: root,
@@ -180,13 +149,9 @@ try {
             });
         }
         assertGate(Object.prototype.hasOwnProperty.call(zjJson, 'status'), 'zellij_status_informational: missing status field', { json: zjJson });
-        // Informational status must not hard-fail when zellij is missing.
         assertGate(zjJson.ok === true, 'zellij_status_informational: informational status hard-failed (ok !== true)', { json: zjJson });
         summary.states.zellij_status_informational = { status: zjJson.status, ok: zjJson.ok };
     }
-    // ---------------------------------------------------------------------------
-    // Migration journal contract — before/after hash, change + rollback flags.
-    // ---------------------------------------------------------------------------
     {
         const ev = journal.buildMigrationEvent({
             step: 't',
@@ -205,11 +170,6 @@ try {
         assertGate(ev2.changed === false && ev2.rollback_available === false, 'migration_journal: no-op event contract failed', { event: ev2 });
         summary.states.migration_journal = { mutated: true, noop: true };
     }
-    // ---------------------------------------------------------------------------
-    // State 1.19.x_zellij_project_noop — a clean 1.19.x config (no machine-local
-    // issues) is a no-op for the upgrade. repairCodexConfigStructure returns
-    // 'structure_ok' and the file is byte-identical afterwards.
-    // ---------------------------------------------------------------------------
     {
         const dir = mkTmp('sks-legacy-noop-');
         tmpDirs.push(dir);
@@ -228,12 +188,6 @@ try {
             byte_identical: true
         };
     }
-    // ---------------------------------------------------------------------------
-    // State existing_skill_cards_preserved — an upgrade never clobbers existing
-    // deployed skill cards. Deploy an accepted card, then read it back twice and
-    // assert the deployed snapshot's body_hash is byte-preserved across the
-    // simulated "upgrade read".
-    // ---------------------------------------------------------------------------
     {
         const skillRootDir = mkTmp('sks-legacy-skill-');
         tmpDirs.push(skillRootDir);
@@ -254,7 +208,6 @@ try {
         assertGate(promote.ok === true && promote.snapshot, 'existing_skill_cards_preserved: accepted card failed to promote to a deployed snapshot', { blockers: promote.blockers });
         const deployed = await skillCard.loadDeployedSnapshot(skillRootDir, 'DFix', 'legacy-skill');
         assertGate(Boolean(deployed) && deployed.status === 'deployed' && deployed.deployment_snapshot === true, 'existing_skill_cards_preserved: deployed snapshot did not load back', { deployed });
-        // Simulate an "upgrade read": loading the snapshot again must not clobber it.
         const reread = await skillCard.loadDeployedSnapshot(skillRootDir, 'DFix', 'legacy-skill');
         assertGate(Boolean(reread) && reread.body_hash === deployed.body_hash, 'existing_skill_cards_preserved: skill card body_hash changed across an upgrade read', { before_hash: deployed.body_hash, after_hash: reread && reread.body_hash });
         summary.states.existing_skill_cards_preserved = {
@@ -263,13 +216,10 @@ try {
             byte_preserved: true
         };
     }
-    // ---------------------------------------------------------------------------
-    // Write the report and emit the gate.
-    // ---------------------------------------------------------------------------
     const reportDir = path.join(root, '.sneakoscope', 'reports');
     fs.mkdirSync(reportDir, { recursive: true });
-    const reportPath = path.join(reportDir, 'legacy-upgrade-matrix.json');
-    fs.writeFileSync(reportPath, `${JSON.stringify({ schema: 'sks.legacy-upgrade-matrix.v1', ok: true, ...summary }, null, 2)}\n`, 'utf8');
+    const reportPath = path.join(reportDir, 'current-upgrade-matrix.json');
+    fs.writeFileSync(reportPath, `${JSON.stringify({ schema: 'sks.current-upgrade-matrix.v1', ok: true, ...summary }, null, 2)}\n`, 'utf8');
     emitGate('migration:upgrade-safety', {
         report_path: reportPath,
         states_checked: [
@@ -277,7 +227,7 @@ try {
             'user_config_preserved',
             'flags_not_reenabled',
             'splitter_preserves_project',
-            'tmux_removed_runtime',
+            'current_surface_unknown_command',
             'zellij_status_informational',
             'migration_journal',
             '1.19.x_zellij_project_noop',
@@ -297,4 +247,3 @@ finally {
     else
         process.env.HOME = savedHome;
 }
-//# sourceMappingURL=legacy-upgrade-matrix-check.js.map

package/dist/scripts/db-route-materialization-check.js

@@ -30,4 +30,3 @@ try {
 finally {
     await fsp.rm(root, { recursive: true, force: true });
 }
-//# sourceMappingURL=db-route-materialization-check.js.map

package/dist/scripts/dfix-fixture-check.js

@@ -3,4 +3,3 @@
 import { emitGate, runDfixFixture } from './sks-1-11-gate-lib.js';
 const result = runDfixFixture();
 emitGate('dfix:fixture', { mission_id: result.mission_id, fixture_root: result.fixture_root });
-//# sourceMappingURL=dfix-fixture-check.js.map

package/dist/scripts/dfix-patch-handoff-check.js

@@ -10,4 +10,3 @@ requireContains('dfix:patch-handoff', 'src/core/dfix.ts', [
     'explicit_apply_opt_in'
 ]);
 emitGate('dfix:patch-handoff', { patch_mode: 'exact-find-replace-or-codex-handoff', diff_capture: true });
-//# sourceMappingURL=dfix-patch-handoff-check.js.map

package/dist/scripts/dfix-verification-check.js

@@ -6,4 +6,3 @@ const verification = readMissionJson(result.mission_id, 'dfix-verification.json'
 const proof = readMissionJson(result.mission_id, 'completion-proof.json');
 assertGate(verification.status === 'passed' && proof.evidence?.dfix?.verification_status === 'passed', 'dfix verification evidence missing from proof', { verification, dfix: proof.evidence?.dfix });
 emitGate('dfix:verification', { mission_id: result.mission_id });
-//# sourceMappingURL=dfix-verification-check.js.map

package/dist/scripts/dfix-verification-recommendation-check.js

@@ -12,4 +12,3 @@ requireContains('dfix:verification-recommendation', 'src/core/commands/dfix-comm
     '--verify-auto'
 ]);
 emitGate('dfix:verification-recommendation', { artifact: 'dfix-verification-suggestion.json' });
-//# sourceMappingURL=dfix-verification-recommendation-check.js.map

package/dist/scripts/docs-truthfulness-check.js

@@ -30,7 +30,22 @@ const required = {
     'docs/official-docs-compat.md': ['official-docs-compat-report.js', 'rust-v0.144.1', 'gpt-image-2', 'input_fidelity', 'additionalProperties:false'],
     'docs/hooks-pat.md': ['SubagentStop', 'strict subset', 'zero-warning'],
     'docs/known-gaps.md': ['No P0', 'P1'],
-    'docs/release-readiness.md': ['sks.release-readiness.v1', 'release:readiness', 'official-docs:compat']
+    'docs/release-readiness.md': [
+        'SKS 6.4.0 Release Readiness',
+        '$sks-naruto',
+        '$sks-work',
+        'sks doctor --fix',
+        'sks.update-status.v3',
+        'generation parent commit',
+        'metadata-only code-pack commit',
+        'official Remote transport remains host-owned',
+        'SKS does not implement',
+        'proxy, or reverse engineer',
+        'proof-aware fleet control',
+        'npm stage publish',
+        'npm stage approve <stage-id>',
+        '6.3.0 to 6.4.0 upgrade smoke'
+    ]
 };
 const forbidden = [
     /Computer Use is always available/i,
@@ -39,6 +54,31 @@ const forbidden = [
     /process-only setup is durable/i,
     /screenshots are published to shared TriWiki automatically/i
 ];
+const currentDollarSurfaceFiles = [
+    'README.md',
+    'AGENTS.md',
+    '.codex/SNEAKOSCOPE.md',
+    'docs/GLM_MAD_MODE.md',
+    'docs/STOP_GATE_CONTRACT.md',
+    'docs/codex-app.md',
+    'docs/completion-proof.md',
+    'docs/computer-use-evidence.md',
+    'docs/fast-mode-default.md',
+    'docs/feature-inventory.md',
+    'docs/naruto-worktree-parallelism.md',
+    'docs/naruto.md',
+    'docs/native-agent-kernel.md',
+    'docs/native-agent-orchestration.md',
+    'docs/no-subagent-scaling.md',
+    'docs/orchestration-layers.md',
+    'docs/release-readiness.md',
+    'docs/research-implementation-handoff.md',
+    'docs/research-pipeline.md',
+    'docs/route-finalization.md',
+    'docs/triwiki-wrongness-memory.md',
+    'docs/ux-review-real-loop.md'
+];
+const legacyDollarCommandPattern = /\$(?:Naruto|Work|DFix|Answer|Plan|Review|Fast-Mode|Fast-On|Fast-Off|Release-Review|QA-LOOP|PPT|Image-UX-Review|UX-Review|Visual-Review|UI-UX-Review|Computer-Use|CU|Goal|Commit|Commit-And-Push|Research|Super-Search|SEO-GEO-OPTIMIZER|AutoResearch|DB|MAD-SKS|GX|Wiki|Help|From-Chat-IMG)\b/g;
 const results = [];
 for (const file of files) {
     const full = path.join(root, file);
@@ -52,6 +92,17 @@ for (const file of files) {
         forbidden: forbiddenMatches
     });
 }
+for (const file of currentDollarSurfaceFiles) {
+    const full = path.join(root, file);
+    const text = fs.existsSync(full) ? fs.readFileSync(full, 'utf8') : '';
+    const legacyDollarCommands = [...new Set(text.match(legacyDollarCommandPattern) || [])];
+    results.push({
+        file: `${file}#dollar-surface`,
+        ok: Boolean(text) && legacyDollarCommands.length === 0,
+        missing: text ? [] : ['file'],
+        forbidden: legacyDollarCommands
+    });
+}
 const ok = results.every((row) => row.ok);
 console.log(JSON.stringify({
     schema: 'sks.docs-truthfulness-check.v1',
@@ -60,4 +111,3 @@ console.log(JSON.stringify({
 }, null, 2));
 if (!ok)
     process.exitCode = 1;
-//# sourceMappingURL=docs-truthfulness-check.js.map

package/dist/scripts/doctor-codex-app-harness-check.js

@@ -1,4 +1,3 @@
 #!/usr/bin/env node
 import { runDirective314Gate } from './sks-3-1-4-directive-check-lib.js';
 await runDirective314Gate('doctor:codex-app-harness');
-//# sourceMappingURL=doctor-codex-app-harness-check.js.map

package/dist/scripts/doctor-context7-mcp-repair-blackbox.js

@@ -13,4 +13,3 @@ await writeText(configPath, '[mcp_servers.context7]\ndisabled = true\ncommand =
 const disabled = await repairContext7Mcp({ root, apply: true });
 assertGate(disabled.after_transport === 'disabled' && disabled.repaired === false && disabled.disabled_preserved === true, 'Context7 blackbox must preserve explicitly disabled server', disabled);
 emitGate('doctor:context7-mcp-repair-blackbox');
-//# sourceMappingURL=doctor-context7-mcp-repair-blackbox.js.map

package/dist/scripts/doctor-fastpath-check.js

@@ -24,4 +24,3 @@ assertGate(parsed.repair?.setup === null, 'doctor --json no-fix must not run set
 assertGate(parsed.repair?.sks_temp_sweep?.skipped === true, 'doctor --json no-fix must not sweep runtime state', parsed.repair?.sks_temp_sweep);
 assertGate(elapsedMs <= 1200, 'doctor --json fast path must stay under 1200ms p95 target in this gate', { elapsed_ms: elapsedMs });
 emitGate('doctor:fastpath', { elapsed_ms: elapsedMs });
-//# sourceMappingURL=doctor-fastpath-check.js.map

package/dist/scripts/doctor-fix-production-blackbox.js

@@ -33,4 +33,3 @@ assertGate(tx.schema === 'sks.doctor-fix-transaction.v2' && tx.raw_secret_values
 assertGate(tx.phases.every((phase) => typeof phase.duration_ms === 'number' && phase.started_at && phase.completed_at), 'doctor transaction phases must include runtime evidence', tx);
 assertGate(postcheck.ok === true, 'doctor repair postcheck must pass when only manual-required optional phases remain', postcheck);
 emitGate('doctor:fix-production-blackbox', { phases: tx.phases.length });
-//# sourceMappingURL=doctor-fix-production-blackbox.js.map

package/dist/scripts/doctor-fix-proves-codex-read-check.js

@@ -99,4 +99,3 @@ function parseLastJson(text) {
     }
     return {};
 }
-//# sourceMappingURL=doctor-fix-proves-codex-read-check.js.map

package/dist/scripts/doctor-fixes-codex-app-fast-ui-check.js

@@ -76,4 +76,3 @@ function cleanupTempRoots() {
         catch { }
     }
 }
-//# sourceMappingURL=doctor-fixes-codex-app-fast-ui-check.js.map

package/dist/scripts/doctor-idempotence-check.js

@@ -5,4 +5,3 @@ const { runDoctorIdempotence } = await importDist('core/doctor/doctor-idempotenc
 const report = await runDoctorIdempotence(root);
 assertGate(report.ok, 'doctor_idempotence_failed', report);
 emitGate('doctor:idempotence', { rollback_manifest_exists: report.rollback_manifest_exists });
-//# sourceMappingURL=doctor-idempotence-check.js.map

package/dist/scripts/doctor-ops-semantics-check.js

@@ -82,4 +82,3 @@ function parseJson(value) {
         return null;
     }
 }
-//# sourceMappingURL=doctor-ops-semantics-check.js.map

package/dist/scripts/doctor-startup-config-repair-blackbox.js

@@ -16,4 +16,3 @@ assertGate(agents.max_threads === 12 && agents.max_depth === 1 && agents.job_max
 assertGate(files.join(',') === 'expert.toml,worker.toml', 'startup config blackbox must create only official worker/expert TOMLs', files);
 assertGate(text.includes('config_file = ".codex/agents/stale.toml"') && text.includes('message_role_prefix = "legacy"'), 'startup config blackbox must preserve legacy compatibility tables', { text });
 emitGate('doctor:startup-config-repair-blackbox');
-//# sourceMappingURL=doctor-startup-config-repair-blackbox.js.map

package/dist/scripts/doctor-supabase-mcp-repair-blackbox.js

@@ -11,4 +11,3 @@ await writeText(path.join(root, '.codex', 'config.toml'), '[mcp_servers.supabase
 const optional = await repairSupabaseMcp({ root, apply: true });
 assertGate(optional.ok === true && optional.disabled === true && optional.disabled_preserved === true, 'optional disabled Supabase config must be preserved', optional);
 emitGate('doctor:supabase-mcp-repair-blackbox');
-//# sourceMappingURL=doctor-supabase-mcp-repair-blackbox.js.map

package/dist/scripts/ensure-bin-executable.js

@@ -15,4 +15,3 @@ for (const bin of bins) {
     });
     console.log(`bin executable: ${path.relative(root, bin)}`);
 }
-//# sourceMappingURL=ensure-bin-executable.js.map

package/dist/scripts/evidence-flagship-coverage-check.js

@@ -52,4 +52,3 @@ const out = path.join(root, '.sneakoscope', 'reports', 'evidence-flagship-covera
 fs.mkdirSync(path.dirname(out), { recursive: true });
 fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
 emitGate('evidence:flagship-coverage', report);
-//# sourceMappingURL=evidence-flagship-coverage-check.js.map

package/dist/scripts/fast-codex-service-tier-proof-check.js

@@ -39,4 +39,3 @@ function fail(blocker, detail) {
     console.log(JSON.stringify({ schema: 'sks.fast-codex-service-tier-proof-check.v1', ok: false, blocker, detail }, null, 2));
     process.exit(1);
 }
-//# sourceMappingURL=fast-codex-service-tier-proof-check.js.map

package/dist/scripts/fixtures/fake-codex-config-loader.js

@@ -48,4 +48,3 @@ function readOption(name, fallback) {
     const index = args.indexOf(name);
     return index >= 0 && args[index + 1] ? args[index + 1] : fallback;
 }
-//# sourceMappingURL=fake-codex-config-loader.js.map

package/dist/scripts/fsx-hotpath-check.js

@@ -8,4 +8,3 @@ emitGate('fsx:hotpath', {
     checked_files: report.checked_files.length,
     report_path: '.sneakoscope/reports/fsx-hotpath.json'
 });
-//# sourceMappingURL=fsx-hotpath-check.js.map

package/dist/scripts/gate-policy-audit-check.js

@@ -18,6 +18,16 @@ const splitReviewFiles = [
     'src/core/hooks-runtime.ts',
     'src/core/recallpulse.ts'
 ];
+const policyCallsiteAllowlist = new Map([
+    ['codex_config_write|src/cli/install-helpers-codex-lb-selftest-chain.ts|runCodexLbLaunchChainSelftest|writeTextAtomic', 'isolated launch-chain selftest config'],
+    ['codex_config_write|src/cli/install-helpers-codex-lb-selftest.ts|selftestCodexLb|writeTextAtomic', 'isolated Codex LB selftest config'],
+    ['mkdtemp|src/core/mcp-config/codex-cli-adapter.ts|CodexMcpCliAdapter|mkdtemp', 'isolated official CLI transform HOME'],
+    ['mkdtemp|src/core/perf/release-latency-slo.ts|runReleaseLatencySlo|mkdtemp', 'run-local latency fixture root'],
+    ['mkdtemp|src/core/release/npm-stage-tarball-verifier.ts|verifyNpmStageTarball|mkdtempSync', 'private stage-review transaction root'],
+    ['mkdtemp|src/core/release/release-pack-content-scanner.ts|scanTarballTextContents|mkdtempSync', 'finally-cleaned tar scan root'],
+    ['mkdtemp|src/core/release/release-pack-tarball.ts|tarUnpackedBytes|mkdtempSync', 'finally-cleaned tar inventory root']
+]);
+const policyCallsiteAllowlistHits = new Set();
 const splitReviewLineCounts = splitReviewFiles.map((file) => ({
     file,
     lines: lineCount(path.join(root, file))
@@ -26,6 +36,7 @@ const directCodexConfigWrites = scanDirectCodexConfigWrites();
 const commandGateContract = scanCommandGateContract();
 const directMkdtempCalls = scanDirectMkdtempCalls();
 const rustTempdirCalls = scanRustTempdirCalls();
+const unusedPolicyCallsiteAllowlist = [...policyCallsiteAllowlist.keys()].filter((key) => !policyCallsiteAllowlistHits.has(key));
 if (releaseGates.length > 200)
     blockers.push(`release_preset_gate_budget_exceeded:${releaseGates.length}`);
 if (gates.length > 200)
@@ -46,6 +57,8 @@ if (directMkdtempCalls.length)
     blockers.push(`direct_mkdtemp_callsite:${directMkdtempCalls[0].file}:${directMkdtempCalls[0].line}`);
 if (rustTempdirCalls.length)
     blockers.push(`rust_tempdir_without_raii:${rustTempdirCalls[0].file}:${rustTempdirCalls[0].line}`);
+if (unusedPolicyCallsiteAllowlist.length)
+    blockers.push(`unused_policy_callsite_allowlist:${unusedPolicyCallsiteAllowlist[0]}`);
 for (const row of splitReviewLineCounts) {
     if (row.lines > splitReviewBudget)
         blockers.push(`split_review_budget_exceeded:${row.file}:${row.lines}`);
@@ -63,6 +76,7 @@ const result = {
     command_gate_contract: commandGateContract,
     direct_mkdtemp_callsite_count: directMkdtempCalls.length,
     direct_mkdtemp_callsites: directMkdtempCalls.slice(0, 20),
+    policy_callsite_allowlist: { used: policyCallsiteAllowlistHits.size, unused: unusedPolicyCallsiteAllowlist },
     rust_tempdir_raii: { ok: rustTempdirCalls.length === 0, direct_tempdir_callsites: rustTempdirCalls.slice(0, 20) },
     blockers
 };
@@ -97,7 +111,7 @@ function scanCommandGateContract() {
         if (!entry?.skipMigrationGate)
             issues.push(`${required}:missing_skipMigrationGate`);
     }
-    for (const routeStarter of ['naruto', 'goal', 'dfix', 'team', 'agent', 'loop', 'qa-loop', 'research', 'autoresearch', 'mad-sks', 'mad-db', 'ppt', 'image-ux-review', 'computer-use']) {
+    for (const routeStarter of ['naruto', 'goal', 'dfix', 'loop', 'qa-loop', 'research', 'autoresearch', 'mad-sks', 'ppt', 'image-ux-review', 'computer-use']) {
         const entry = COMMANDS[routeStarter];
         if (entry?.mutatesRouteState !== true)
             issues.push(`${routeStarter}:missing_route_state_mutator_contract`);
@@ -124,9 +138,12 @@ function scanDirectMkdtempCalls() {
         if (/(?:__tests__|fixture|fixtures|bench|blackbox|check|probe|smoke|selftest|feature-commands|feature-probes)/i.test(rel))
             continue;
         const lines = fs.readFileSync(file, 'utf8').split(/\r?\n/);
+        let currentSymbol = 'module';
         for (let index = 0; index < lines.length; index += 1) {
             const line = lines[index] || '';
-            if (/\bmkdtemp(?:Sync)?\s*\(/.test(line))
+            currentSymbol = policySymbolFromLine(line) || currentSymbol;
+            const match = line.match(/\b(mkdtemp(?:Sync)?)\s*\(/);
+            if (match && !allowPolicyCallsite('mkdtemp', rel, currentSymbol, match[1]))
                 out.push({ file: rel, line: index + 1, text: line.trim().slice(0, 220) });
         }
     }
@@ -168,22 +185,33 @@ function scanDirectCodexConfigWrites() {
         if (rel === 'src/core/codex/codex-config-guard.ts')
             continue;
         const lines = fs.readFileSync(file, 'utf8').split(/\r?\n/);
-        let inInstallHelperSelftest = false;
+        let currentSymbol = 'module';
         for (let index = 0; index < lines.length; index += 1) {
             const line = lines[index] || '';
-            if (rel === 'src/cli/install-helpers.ts' && /export\s+async\s+function\s+selftest/.test(line))
-                inInstallHelperSelftest = true;
-            if (inInstallHelperSelftest)
-                continue;
+            currentSymbol = policySymbolFromLine(line) || currentSymbol;
             if (!/\bwriteTextAtomic\s*\(/.test(line))
                 continue;
             if (!/(?:config\.toml|configPath|candidate\.path|config\.path|userConfigPath|codexHomeConfigPath)/.test(line))
                 continue;
+            if (allowPolicyCallsite('codex_config_write', rel, currentSymbol, 'writeTextAtomic'))
+                continue;
             out.push({ file: rel, line: index + 1, text: line.trim().slice(0, 220) });
         }
     }
     return out;
 }
+function allowPolicyCallsite(kind, file, symbol, token) {
+    const key = `${kind}|${file}|${symbol}|${token}`;
+    if (!policyCallsiteAllowlist.has(key))
+        return false;
+    policyCallsiteAllowlistHits.add(key);
+    return true;
+}
+function policySymbolFromLine(line) {
+    return line.match(/(?:export\s+)?(?:async\s+)?function\s+([A-Za-z0-9_$]+)/)?.[1]
+        || line.match(/class\s+([A-Za-z0-9_$]+)/)?.[1]
+        || null;
+}
 function walk(dir) {
     if (!fs.existsSync(dir))
         return [];
@@ -197,4 +225,3 @@ function walk(dir) {
     }
     return out;
 }
-//# sourceMappingURL=gate-policy-audit-check.js.map

package/dist/scripts/geo-claim-evidence-check.js

@@ -15,4 +15,3 @@ assertGate(claims.claims.some((claim) => claim.safe_to_publish === false && /cit
 assertGate(findings.findings.some((finding) => finding.category === 'claim-evidence' && finding.severity === 'critical'), 'unsafe claim must become critical claim-evidence finding', findings);
 assertGate(audit.ok === false || findings.findings.some((finding) => finding.blocking), 'critical unsafe claims must block the gate', { audit, findings });
 emitGate('geo:claim-evidence', { mission_id: audit.mission_id, claims: claims.claims.length });
-//# sourceMappingURL=geo-claim-evidence-check.js.map

package/dist/scripts/geo-cli-blackbox-check.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, runSks, runSksJson } from './search-visibility-gate-lib.js';
+const commands = runSksJson(['commands', '--json']).json;
+assertGate(commands.commands.some((row) => row.name === 'seo-geo-optimizer' && /unified SEO\/GEO optimizer/i.test(row.description)), 'commands --json must expose seo-geo-optimizer');
+assertGate(!commands.commands.some((row) => row.name === 'seo' || row.name === 'geo'), 'commands --json must not expose split seo/geo command surfaces');
+const optimizerUsage = runSks(['usage', 'seo-geo-optimizer']);
+assertGate(/sks seo-geo-optimizer \[seo\|geo\] doctor\|audit\|plan\|apply\|verify\|status\|rollback\|fixture/.test(optimizerUsage.stdout), 'usage seo-geo-optimizer must expose unified lifecycle');
+const doctor = runSksJson(['seo-geo-optimizer', 'doctor', '--mode', 'geo', '--json']).json;
+assertGate(doctor.route === '$SEO-GEO-OPTIMIZER' && doctor.schema === 'sks.search-visibility.doctor-command.v1', 'optimizer geo doctor must preserve unified route identity', doctor);
+const invalid = runSks(['seo-geo-optimizer', 'nonsense-subcommand', '--mode', 'geo'], { allowFailure: true });
+assertGate(invalid.status === 2 && /Usage: sks seo-geo-optimizer/.test(invalid.stderr), 'invalid optimizer subcommand must exit 2 with usage', {
+    status: invalid.status,
+    stdout: invalid.stdout,
+    stderr: invalid.stderr,
+});
+emitGate('geo:cli-blackbox', { adapter: doctor.adapter, confidence: doctor.confidence });

package/dist/scripts/geo-crawler-policy-check.js

@@ -13,4 +13,3 @@ for (const agent of ['OAI-SearchBot', 'GPTBot', 'ChatGPT-User', 'Claude-SearchBo
     assertGate(agents.has(agent), `crawler user agent missing: ${agent}`, policy);
 assertGate(policy.entries.every((entry) => entry.officialSource && entry.observedAt && entry.expiresAt), 'crawler registry entries must carry dated official sources', policy);
 emitGate('geo:crawler-purpose-policy', { mission_id: audit.mission_id, entries: policy.entries.length });
-//# sourceMappingURL=geo-crawler-policy-check.js.map

package/dist/scripts/git-worktree-checkpoint-check.js

@@ -17,4 +17,3 @@ fs.writeFileSync(path.join(root, 'b.txt'), 'b\n');
 const report = await checkpointWorkerWorktree({ worktreePath: root, repoRoot: root, workerId: 'W1', taskId: 'T1', mode: 'auto' });
 assertGate(report.ok && report.mode_applied === 'checkpoint-commit' && Boolean(report.commit_hash), 'Git worktree checkpoint must create checkpoint commits for multi-file changes', report);
 emitGate('git:worktree-checkpoint', report);
-//# sourceMappingURL=git-worktree-checkpoint-check.js.map

package/dist/scripts/git-worktree-cross-rebase-check.js

@@ -38,4 +38,3 @@ assertGate(report.skipped_count === 2, 'Dirty and running worktrees must be skip
 assertGate(report.records.some((row) => row.worker_id === 'W-dirty' && row.status === 'skipped' && row.reason === 'dirty_worktree_skipped'), 'Dirty worktree must skip cross-rebase', report);
 assertGate(report.records.some((row) => row.worker_id === 'W-running' && row.status === 'skipped' && row.reason === 'worker_not_idle'), 'Running worktree must skip cross-rebase', report);
 emitGate('git:worktree-cross-rebase', report);
-//# sourceMappingURL=git-worktree-cross-rebase-check.js.map

package/dist/scripts/git-worktree-diff-envelope-check.js

@@ -14,4 +14,3 @@ const validation = schemaMod.validateAgentPatchEnvelope(schemaMod.normalizeAgent
 assertGate(envelope.operations.length === 1 && envelope.operations[0].op === 'git_apply_patch', 'git worktree envelope must use one git_apply_patch operation', envelope);
 assertGate(validation.ok === true, 'git_apply_patch envelope must validate', validation);
 emitGate('git:worktree-diff-envelope', { operations: envelope.operations.length, op: envelope.operations[0].op });
-//# sourceMappingURL=git-worktree-diff-envelope-check.js.map

package/dist/scripts/git-worktree-dirty-lock-check.js

@@ -14,4 +14,3 @@ fs.writeFileSync(path.join(allocation.worktree_path, 'a.txt'), 'dirty\n');
 const cleanup = await cleanupMod.cleanupGitWorktree({ repoRoot: repo, worktreePath: allocation.worktree_path, branch: allocation.branch });
 assertGate(cleanup.action === 'retained_dirty' && cleanup.git_locked === true, 'dirty retained worktree must be git locked', cleanup);
 emitGate('git:worktree-dirty-lock', { git_locked: cleanup.git_locked, unlock_command: cleanup.unlock_command });
-//# sourceMappingURL=git-worktree-dirty-lock-check.js.map

package/dist/scripts/git-worktree-dirty-main-detection-check.js

@@ -11,4 +11,3 @@ const detection = await detectionMod.detectGitRepo(repo);
 assertGate(detection.main_worktree_dirty === true, 'dirty main worktree must be detected', detection);
 assertGate(String(detection.status_porcelain).includes('dirty.txt'), 'status_porcelain must include dirty file', detection);
 emitGate('git:worktree-dirty-main-detection', { dirty: detection.main_worktree_dirty });
-//# sourceMappingURL=git-worktree-dirty-main-detection-check.js.map

package/dist/scripts/git-worktree-integration-primary-check.js

@@ -21,4 +21,3 @@ const mainReport = await mergeMod.applyGitWorktreeMergeQueue({ integrationWorktr
 const mainContent = fs.readFileSync(path.join(repo, 'a.txt'), 'utf8');
 assertGate(report.ok === true && report.applied_count === 1 && mainReport.ok === true && mainReport.applied_count === 1 && mainContent.includes('integrated'), 'git-worktree-diff must prevalidate in integration worktree and apply to main repo', { report, mainReport, mainContent });
 emitGate('git:worktree-integration-primary', { applied_count: report.applied_count, main_applied_count: mainReport.applied_count });
-//# sourceMappingURL=git-worktree-integration-primary-check.js.map

package/dist/scripts/git-worktree-manifest-append-check.js

@@ -15,4 +15,3 @@ for (let index = 0; index < 4; index += 1) {
 const manifest = JSON.parse(fs.readFileSync(allocations[0].manifest_path, 'utf8'));
 assertGate(manifest.allocations.length >= allocations.length, 'manifest append must preserve allocations', manifest);
 emitGate('git:worktree-manifest-append', { allocations: manifest.allocations.length });
-//# sourceMappingURL=git-worktree-manifest-append-check.js.map

package/dist/scripts/git-worktree-untracked-diff-check.js

@@ -15,4 +15,3 @@ const diff = await diffMod.exportGitWorktreeDiff({ mainRepoRoot: repo, worktreeP
 assertGate(diff.changed_files.includes('new-file.txt'), 'changed files must include untracked file', diff);
 assertGate(diff.diff.includes('new file mode') && diff.diff.includes('+new content'), 'git diff must include untracked file content', { diff: diff.diff });
 emitGate('git:worktree-untracked-diff', { changed_files: diff.changed_files });
-//# sourceMappingURL=git-worktree-untracked-diff-check.js.map

package/dist/scripts/goal-artifact-compat-check.js

@@ -1,3 +1,2 @@
 import { runLoopDirectiveCheck } from './loop-directive-check-lib.js';
 await runLoopDirectiveCheck('goal:artifact-compat');
-//# sourceMappingURL=goal-artifact-compat-check.js.map