sneakoscope 6.2.0 → 6.4.0

package/dist/scripts/harness-benchmark-check.js

@@ -22,9 +22,9 @@ metrics.push(await measure('stop_hook_light_budget', 25, async () => {
     await assertFile('dist/scripts/hook-latency-budget-check.js');
     return { mode: 'script_presence_budget_proxy', measured_ms: performance.now() - started };
 }));
-metrics.push(await measure('swarm_14_worker_fixture', 20000, async () => {
+metrics.push(await measure('naruto_14_worker_fixture', 20000, async () => {
     const graph = buildNarutoWorkGraph({
-        requestedClones: 14,
+        requestedWorkers: 14,
         totalWorkItems: 14,
         honorExplicitTotalWorkItems: true,
         readonly: true,
@@ -32,7 +32,7 @@ metrics.push(await measure('swarm_14_worker_fixture', 20000, async () => {
         maxActiveWorkers: 14
     });
     const governor = decideNarutoConcurrency({
-        requestedClones: 14,
+        requestedWorkers: 14,
         totalWorkItems: 14,
         pendingWorkQueueSize: 14,
         backend: 'fake',
@@ -40,7 +40,7 @@ metrics.push(await measure('swarm_14_worker_fixture', 20000, async () => {
     });
     const report = simulateNarutoActivePool({ graph, governor: { ...governor, safe_active_workers: 14 } });
     return {
-        command: 'simulateNarutoActivePool --fake --clones 14',
+        command: 'simulateNarutoActivePool --fake --agents 14',
         ok: report.ok === true && report.completed_count >= 14 && report.max_observed_active_workers >= 7,
         completed_count: report.completed_count,
         max_observed_active_workers: report.max_observed_active_workers,
@@ -101,4 +101,3 @@ async function makeReviewFixture() {
     }
     return dir;
 }
-//# sourceMappingURL=harness-benchmark-check.js.map

package/dist/scripts/high-risk-contracts-check.js

@@ -182,4 +182,3 @@ function doctorConfigCompare(before, after) {
 function sha(value) {
     return crypto.createHash('sha256').update(value).digest('hex').slice(0, 16);
 }
-//# sourceMappingURL=high-risk-contracts-check.js.map

package/dist/scripts/hook-latency-budget-check.js

@@ -42,4 +42,3 @@ finally {
     fsp.readFile = originalReadFile;
     fs.rmSync(root, { recursive: true, force: true });
 }
-//# sourceMappingURL=hook-latency-budget-check.js.map

package/dist/scripts/hook-latency-quantum-check.js

@@ -8,7 +8,7 @@ import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
 const { runProcess } = await importDist('core/fsx.js');
 const scenarios = [
     { name: 'no-state', prompt: 'hello', budget_p95_ms: 230 },
-    { name: 'active-route', prompt: 'continue current route', budget_p95_ms: 230, state: { mission_id: 'M-active', mode: 'TEAM', route: 'Team', route_command: '$Team', phase: 'EXECUTE', implementation_allowed: true } },
+    { name: 'active-route', prompt: 'continue current route', budget_p95_ms: 230, state: { mission_id: 'M-active', mode: 'NARUTO', route: 'Naruto', route_command: '$Naruto', phase: 'EXECUTE', implementation_allowed: true } },
     { name: 'stale-code-pack-note', prompt: 'status?', budget_p95_ms: 230, files: { '.sneakoscope/wiki/code-pack.json': JSON.stringify({ generated_at: '2000-01-01T00:00:00.000Z' }) } },
     { name: 'no-question-queue', prompt: 'can I interrupt?', budget_p95_ms: 230, state: { mission_id: 'M-noq', mode: 'RESEARCH', phase: 'RESEARCH_RUNNING_NO_QUESTIONS' } },
     { name: 'clarification-awaiting', prompt: 'here is the answer', budget_p95_ms: 230, state: { mission_id: 'M-clarify', mode: 'TEAM', phase: 'CLARIFICATION_AWAITING_ANSWERS', stop_gate: 'clarification-gate', ambiguity_gate_required: true, clarification_required: true, implementation_allowed: false } },
@@ -119,4 +119,3 @@ function percentile(values, pct) {
     const index = Math.min(values.length - 1, Math.max(0, Math.ceil(values.length * pct) - 1));
     return values[index] || 0;
 }
-//# sourceMappingURL=hook-latency-quantum-check.js.map

package/dist/scripts/image-artifact-path-contract-check.js

@@ -11,4 +11,3 @@ await fs.writeFile(png, Buffer.from('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcS
 const result = await mod.writeImageArtifactPathContract(root, { missionId: 'M-image', images: [{ id: 'fixture', kind: 'generated_image', filePath: png }] });
 assertGate(result.contract.images[0].exists === true && result.contract.images[0].model_visible_path === png && result.contract.blockers.length === 0, 'image artifact path contract must expose real saved model-visible paths', result.contract);
 emitGate('image:artifact-path-contract', { image_count: result.contract.images.length });
-//# sourceMappingURL=image-artifact-path-contract-check.js.map

package/dist/scripts/imagegen-real-smoke-check.js

@@ -152,4 +152,3 @@ writeReport(report);
 console.log(JSON.stringify(report, null, 2));
 if (!report.ok)
     process.exitCode = 1;
-//# sourceMappingURL=imagegen-real-smoke-check.js.map

package/dist/scripts/import-graph-budget-check.js

@@ -8,4 +8,3 @@ emitGate('runtime:import-budget', {
     checked_files: report.checked_files.length,
     report_path: '.sneakoscope/reports/import-graph-budget.json'
 });
-//# sourceMappingURL=import-graph-budget-check.js.map

package/dist/scripts/init-deep-backup-retention-check.js

@@ -34,4 +34,3 @@ function assertGate(condition, message, detail = {}) {
 function emitGate(gate) {
     console.log(JSON.stringify({ schema: 'sks.release-gate.v1', ok: true, gate }, null, 2));
 }
-//# sourceMappingURL=init-deep-backup-retention-check.js.map

package/dist/scripts/installed-package-smoke-check.js

@@ -2,11 +2,22 @@
 // @ts-nocheck
 import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
 const { runInstalledPackageSmoke } = await importDist('core/install/installed-package-smoke.js');
-const report = await runInstalledPackageSmoke(root);
+const report = await runInstalledPackageSmoke(root, {
+    ...(option('--tarball') ? { tarball: option('--tarball') } : {}),
+    ...(option('--receipt') ? { receipt: option('--receipt') } : {}),
+    ...(option('--expected-sha256') ? { expectedSha256: option('--expected-sha256') } : {}),
+    keepTemp: process.argv.includes('--keep')
+});
 assertGate(report.ok, 'installed_package_smoke_failed', report);
 emitGate('runtime:installed-smoke', {
     installed_version: report.installed_version,
     commands: report.commands.length,
-    tarball: report.tarball
+    tarball: report.tarball,
+    tarball_sha256: report.tarball_sha256,
+    exact_match: report.tarball_binding.exact_match,
+    install_prefix: report.install_prefix
 });
-//# sourceMappingURL=installed-package-smoke-check.js.map
+function option(name) {
+    const index = process.argv.indexOf(name);
+    return index >= 0 ? String(process.argv[index + 1] || '').trim() : '';
+}

package/dist/scripts/legacy-gate-inventory-check.js

@@ -48,4 +48,3 @@ function compareVersion(a, b) {
     }
     return 0;
 }
-//# sourceMappingURL=legacy-gate-inventory-check.js.map

package/dist/scripts/legacy-gate-purge-check.js

@@ -1,7 +1,38 @@
 // @ts-nocheck
-import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+import fs from 'node:fs';
+import { assertGate, emitGate, readText, root } from './sks-1-18-gate-lib.js';
 const registry = readText('src/cli/command-registry.ts');
-assertGate(!registry.includes("auth: '") && !registry.includes("dollars: '"), 'legacy compatibility aliases must be purged from command registry');
-assertGate(registry.includes('tmux') && registry.includes('removed-runtime migration notice'), 'tmux command must be explicit removed-runtime notice only');
-emitGate('legacy:gate-purge');
-//# sourceMappingURL=legacy-gate-purge-check.js.map
+const routes = readText('src/core/routes.ts');
+const skills = readText('src/core/init/skills.ts');
+const removedCommands = ['team', 'mad-db', 'tmux', 'xai', 'swarm', 'agent', 'ralph'];
+const removedDollarCommands = ['$Agent', '$Team', '$MAD-DB', '$Swarm', '$ShadowClone', '$Kagebunshin', '$Ralph'];
+const removedHandlers = [
+    'src/commands/team.ts',
+    'src/core/commands/team-command.ts',
+    'src/core/commands/team-legacy-observe-command.ts',
+    'src/commands/mad-db.ts',
+    'src/core/commands/mad-db-command.ts',
+    'src/commands/tmux.ts',
+    'src/cli/xai-command.ts',
+    'src/core/commands/agent-command.ts',
+    'src/core/agents/agent-command-surface.ts'
+];
+assertGate(!registry.includes("auth: '") && !registry.includes("dollars: '"), 'obsolete compatibility aliases must be purged from command registry');
+for (const command of removedCommands) {
+    const escaped = command.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    assertGate(!new RegExp(`(?:^|\\n)\\s*(?:['\"]${escaped}['\"]|${escaped})\\s*:`).test(registry), `retired command must not have a registry entry: ${command}`);
+}
+for (const command of removedDollarCommands) {
+    assertGate(!routes.includes(`command: '${command}'`), `retired dollar command must not have a route entry: ${command}`);
+}
+for (const skill of ['team', 'mad-db', 'swarm', 'shadow-clone', 'kage-bunshin', 'ralph']) {
+    assertGate(!skills.includes(`'${skill}': \``), `retired skill template must not be generated: ${skill}`);
+}
+for (const file of removedHandlers) {
+    assertGate(!fs.existsSync(`${root}/${file}`), `retired command handler must be physically absent: ${file}`);
+}
+emitGate('legacy:gate-purge', {
+    removed_command_count: removedCommands.length,
+    removed_dollar_command_count: removedDollarCommands.length,
+    removed_handler_count: removedHandlers.length
+});

package/dist/scripts/legacy-strong-inventory-check.js

@@ -42,4 +42,3 @@ function compareVersion(a, b) {
     }
     return 0;
 }
-//# sourceMappingURL=legacy-strong-inventory-check.js.map

package/dist/scripts/lib/codex-sdk-gate-lib.js

@@ -22,7 +22,7 @@ export async function runFakeCodexSdkTaskFixture(label = 'fixture', extra = {})
     process.env.SKS_CODEX_LB_AUTOBYPASS = '1';
     try {
         const result = await mod.runCodexTask({
-            route: extra.route || '$Agent',
+            route: extra.route || '$Naruto',
             missionId: extra.missionId || `M-${label}`,
             workItemId: extra.workItemId || `${label}-work-item`,
             slotId: extra.slotId || 'slot-001',
@@ -37,7 +37,7 @@ export async function runFakeCodexSdkTaskFixture(label = 'fixture', extra = {})
             sandboxPolicy: extra.sandboxPolicy || 'read-only',
             requestedScopeContract: {
                 id: `${label}-scope`,
-                route: extra.route || '$Agent',
+                route: extra.route || '$Naruto',
                 read_only: extra.sandboxPolicy !== 'workspace-write',
                 allowed_paths: extra.allowedPaths || [],
                 write_paths: extra.allowedPaths || [],
@@ -93,4 +93,3 @@ function restoreEnv(old) {
             process.env[key] = value;
     }
 }
-//# sourceMappingURL=codex-sdk-gate-lib.js.map

package/dist/scripts/lib/ensure-dist-fresh.js

@@ -139,4 +139,3 @@ function readJson(file) {
 function tail(value) {
     return String(value || '').slice(-1200).replace(/\s+/g, ' ').trim();
 }
-//# sourceMappingURL=ensure-dist-fresh.js.map

package/dist/scripts/lib/git-worktree-fixture.js

@@ -30,4 +30,3 @@ export function run(command, args, cwd, input) {
     }
     return result.stdout || '';
 }
-//# sourceMappingURL=git-worktree-fixture.js.map

package/dist/scripts/lib/valid-png-fixture.js

@@ -22,4 +22,3 @@ export function osTempPngFixtureArg(name) {
     const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-png-fixture-'));
     return writeValidPngFixture(path.join(dir, name));
 }
-//# sourceMappingURL=valid-png-fixture.js.map

package/dist/scripts/local-collab-all-pipelines-final-gpt-check.js

@@ -3,7 +3,7 @@
 import { assertGate, emitGate, importDist } from './lib/codex-sdk-gate-lib.js';
 const finalizer = await importDist('core/pipeline/finalize-pipeline-result.js');
 const blocked = await finalizer.finalizePipelineResult({
-    route: '$Team',
+    route: '$Naruto',
     missionId: 'M-local-final-gpt',
     localParticipated: true,
     candidateResults: [{ backend: 'local-llm', summary: 'draft' }],
@@ -18,4 +18,3 @@ const blocked = await finalizer.finalizePipelineResult({
 assertGate(blocked.ok === false, 'local participation without GPT final must block finalization');
 assertGate(blocked.blockers.includes('gpt_final_arbiter_required_not_passed'), 'missing GPT final blocker required');
 emitGate('local-collab:all-pipelines-final-gpt', { final_status: blocked.final_status, blockers: blocked.blockers.length });
-//# sourceMappingURL=local-collab-all-pipelines-final-gpt-check.js.map

package/dist/scripts/loop-directive-check-lib.js

@@ -463,4 +463,3 @@ try {
         maxOutputBytes: 8192
     });
 }
-//# sourceMappingURL=loop-directive-check-lib.js.map

package/dist/scripts/loop-integration-finalizer-check.js

@@ -0,0 +1,2 @@
+import { runLoopDirectiveCheck } from './loop-directive-check-lib.js';
+await runLoopDirectiveCheck('loop:integration-finalizer');

package/dist/scripts/loop-worker-fixture-child.js

@@ -51,4 +51,3 @@ await fs.writeFile(intake.result_path, `${JSON.stringify({
     session_ids: sessionIds,
     codex_native_invocation_plan: intake.codex_native_invocation_plan || null
 }, null, 2)}\n`);
-//# sourceMappingURL=loop-worker-fixture-child.js.map

package/dist/scripts/mad-preflight-blocks-unreadable-config-check.js

@@ -63,4 +63,3 @@ function fail(blocker, detail) {
     console.log(JSON.stringify({ schema: 'sks.mad-preflight-blocks-unreadable-config-check.v2', ok: false, blocker, detail }, null, 2));
     process.exit(1);
 }
-//# sourceMappingURL=mad-preflight-blocks-unreadable-config-check.js.map

package/dist/scripts/mad-sks-app-ui-no-mutation-check.js

@@ -14,7 +14,6 @@ const original = {
     noAttach: process.env.SKS_NO_ZELLIJ_ATTACH,
     requireZellij: process.env.SKS_REQUIRE_ZELLIJ,
     zellijSocketDir: process.env.ZELLIJ_SOCKET_DIR,
-    madSwarm: process.env.SKS_MAD_NATIVE_SWARM,
     skipNpm: process.env.SKS_SKIP_NPM_FRESHNESS_CHECK
 };
 const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-ui-no-mutation-'));
@@ -45,10 +44,9 @@ try {
     process.env.SKS_NO_ZELLIJ_ATTACH = '1';
     process.env.SKS_REQUIRE_ZELLIJ = '0';
     process.env.ZELLIJ_SOCKET_DIR = socketDir;
-    process.env.SKS_MAD_NATIVE_SWARM = '0';
     process.env.SKS_SKIP_NPM_FRESHNESS_CHECK = '1';
     process.exitCode = 0;
-    const launch = await madHighCommand(['--no-attach', '--no-swarm', '--session', sessionName], {
+    const launch = await madHighCommand(['--no-attach', '--session', sessionName], {
         maybePromptSksUpdateForLaunch: async () => ({ status: 'skipped' }),
         maybePromptCodexUpdateForLaunch: async () => ({ status: 'skipped' }),
         ensureMadLaunchDependencies: async () => ({ ready: true, actions: [] }),
@@ -93,7 +91,6 @@ finally {
     restoreEnv('SKS_NO_ZELLIJ_ATTACH', original.noAttach);
     restoreEnv('SKS_REQUIRE_ZELLIJ', original.requireZellij);
     restoreEnv('ZELLIJ_SOCKET_DIR', original.zellijSocketDir);
-    restoreEnv('SKS_MAD_NATIVE_SWARM', original.madSwarm);
     restoreEnv('SKS_SKIP_NPM_FRESHNESS_CHECK', original.skipNpm);
     if (cleanup.ok) {
         fixtureRemoval = await removeFixtureRootAfterQuiescence(tmp);
@@ -248,4 +245,3 @@ function delay(ms) {
 async function exists(value) {
     return fs.access(value).then(() => true).catch(() => false);
 }
-//# sourceMappingURL=mad-sks-app-ui-no-mutation-check.js.map

package/dist/scripts/{mad-db-mad-command-check.js → mad-sks-launch-sql-plane-boundary-check.js}

@@ -3,7 +3,7 @@ import assert from 'node:assert/strict';
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { madHighCommand, resolveMadLaunchMadDbGrant } from '../core/commands/mad-sks-command.js';
+import { madHighCommand } from '../core/commands/mad-sks-command.js';
 import { checkDbOperation } from '../core/db-safety.js';
 import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
 const original = {
@@ -12,13 +12,12 @@ const original = {
     codexHome: process.env.CODEX_HOME,
     noAttach: process.env.SKS_NO_ZELLIJ_ATTACH,
     requireZellij: process.env.SKS_REQUIRE_ZELLIJ,
-    madSwarm: process.env.SKS_MAD_NATIVE_SWARM,
     skipNpm: process.env.SKS_SKIP_NPM_FRESHNESS_CHECK,
     updateNotice: process.env.SKS_DISABLE_UPDATE_NOTICE,
     madHeadless: process.env.SKS_MAD_ALLOW_HEADLESS,
     exitCode: process.exitCode
 };
-const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-db-mad-command-'));
+const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-sks-sql-plane-boundary-'));
 const home = path.join(tmp, 'home');
 const codexHome = path.join(home, '.codex');
 const projectCodexDir = path.join(tmp, '.codex');
@@ -39,12 +38,11 @@ try {
     process.env.CODEX_HOME = codexHome;
     process.env.SKS_NO_ZELLIJ_ATTACH = '1';
     process.env.SKS_REQUIRE_ZELLIJ = '0';
-    process.env.SKS_MAD_NATIVE_SWARM = '0';
     process.env.SKS_SKIP_NPM_FRESHNESS_CHECK = '1';
     process.env.SKS_DISABLE_UPDATE_NOTICE = '1';
     process.env.SKS_MAD_ALLOW_HEADLESS = '1';
     process.exitCode = 0;
-    const launch = await madHighCommand(['--headless', '--skip-zellij-repair', '--no-attach', '--no-swarm'], {
+    const launch = await madHighCommand(['--headless', '--skip-zellij-repair', '--no-attach'], {
         maybePromptSksUpdateForLaunch: async () => ({ status: 'skipped' }),
         maybePromptCodexUpdateForLaunch: async () => ({ status: 'skipped' }),
         ensureMadLaunchDependencies: async () => ({ ready: true, actions: [] }),
@@ -53,29 +51,21 @@ try {
     assertGate(launch?.ok === true && launch.status === 'headless-fallback', 'sks --mad fixture launch must complete headless', launch);
     const state = await readJson(path.join(tmp, '.sneakoscope', 'state', 'current.json'));
     assert.equal(state.mad_sks_active, true);
-    assert.notEqual(state.mad_db_active, true);
-    assert.notEqual(state.mad_db_grant_source, 'sks_mad_default');
-    assert.notEqual(state.mad_db_priority_override_active, true);
+    assert.notEqual(state.mad_sks_sql_plane_active, true);
+    assert.equal(state.mad_sks_sql_plane_capability_mission_id, undefined);
     const missionDir = path.join(tmp, '.sneakoscope', 'missions', state.mission_id);
-    await assertMissing(path.join(missionDir, 'mad-db-capability.json'), 'bare sks --mad must not create a MadDB capability');
-    await assertMissing(path.join(missionDir, 'mad-sks-launch-grants.json'), 'bare sks --mad must not create MadDB grant artifacts');
+    await assertMissing(path.join(missionDir, 'mad-sks', 'sql-plane', 'capability.json'), 'bare sks --mad must not create a SQL-plane capability');
+    await assertMissing(path.join(missionDir, 'mad-sks-launch-grants.json'), 'bare sks --mad must not create SQL-plane grant artifacts');
     const decision = await checkDbOperation(tmp, state, {
         tool_name: 'supabase.execute_sql',
-        tool_call_id: 'mad-sks-default-does-not-open-maddb',
-        sql: 'truncate sks_mad_db_probe;'
+        tool_call_id: 'mad-sks-default-does-not-open-sql-plane',
+        sql: 'truncate sks_mad_sks_sql_plane_probe;'
     });
-    assertGate(decision.allowed === false && decision.mad_db?.active !== true, 'sks --mad default must not satisfy MadDB mutation policy locally', decision);
-    const defaultGrant = resolveMadLaunchMadDbGrant([]);
-    const explicitGrant = resolveMadLaunchMadDbGrant(['--mad-db']);
-    assert.equal(defaultGrant.enabled, false);
-    assert.equal(defaultGrant.requested, false);
-    assert.equal(explicitGrant.enabled, false);
-    assert.equal(explicitGrant.requested, true);
-    assert.equal(explicitGrant.source, 'mad_db_first_class_route_required');
-    emitGate('mad-db:mad-command', {
+    assertGate(decision.allowed === false && decision.mad_sks_sql_plane?.active !== true, 'sks --mad default must not satisfy the SQL-plane mutation policy locally', decision);
+    emitGate('mad-sks:launch-sql-plane-boundary', {
         mission_id: state.mission_id,
-        default_mad_db_active: state.mad_db_active === true,
-        explicit_flag_source: explicitGrant.source
+        default_sql_plane_active: state.mad_sks_sql_plane_active === true,
+        standalone_launch_did_not_create_sql_plane_capability: true
     });
 }
 finally {
@@ -84,7 +74,6 @@ finally {
     restoreEnv('CODEX_HOME', original.codexHome);
     restoreEnv('SKS_NO_ZELLIJ_ATTACH', original.noAttach);
     restoreEnv('SKS_REQUIRE_ZELLIJ', original.requireZellij);
-    restoreEnv('SKS_MAD_NATIVE_SWARM', original.madSwarm);
     restoreEnv('SKS_SKIP_NPM_FRESHNESS_CHECK', original.skipNpm);
     restoreEnv('SKS_DISABLE_UPDATE_NOTICE', original.updateNotice);
     restoreEnv('SKS_MAD_ALLOW_HEADLESS', original.madHeadless);
@@ -110,4 +99,3 @@ function restoreEnv(key, value) {
     else
         process.env[key] = value;
 }
-//# sourceMappingURL=mad-db-mad-command-check.js.map

package/dist/scripts/mad-sks-sql-plane-capability-check.js

@@ -0,0 +1,25 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+const missionMod = await importDist('core/mission.js');
+const capMod = await importDist('core/mad-sks/sql-plane/capability.js');
+const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-mad-sks-sql-plane-cap-'));
+const mission = await missionMod.createMission(root, { mode: 'mad-sks', prompt: 'fixture' });
+const cap = await capMod.createMadSksSqlPlaneCapability(root, {
+    missionId: mission.id,
+    ack: capMod.MAD_SKS_SQL_PLANE_ACK,
+    cwd: root,
+    projectRef: 'fixture-project-ref',
+    runtimeSessionId: 'fixture-session',
+    profilePath: '.sneakoscope/missions/M/mad-sks/sql-plane/runtime/codex-mad-sks-sql-plane.config.toml',
+    profileSha256: 'fixture-profile-sha',
+    status: 'active'
+});
+assertGate(cap.schema === capMod.MAD_SKS_SQL_PLANE_CAPABILITY_SCHEMA, 'MAD-SKS SQL-plane capability schema mismatch', cap);
+assertGate(cap.revision === 1 && cap.status === 'active', 'MAD-SKS SQL-plane capability must start as one current active capability revision', cap);
+assertGate(cap.project_ref === 'fixture-project-ref' && cap.runtime_session_id === 'fixture-session' && cap.transport.profile_sha256 === 'fixture-profile-sha', 'MAD-SKS SQL-plane capability v2 must bind project/session/profile', cap);
+assertGate(cap.scope.sql_plane === 'all_mutations' && cap.scope.control_plane === 'deny' && cap.scope.operations.includes('truncate'), 'MAD-SKS SQL-plane capability v2 must authorize SQL-plane operation classes only', cap);
+assertGate(capMod.isMadSksSqlPlaneCapabilityActive(cap) === true, 'MAD-SKS SQL-plane capability must be active before consumption', cap);
+emitGate('mad-sks:sql-plane-capability', { mission_id: mission.id, cycle_id: cap.cycle_id });

package/dist/scripts/mad-sks-sql-plane-lifecycle-hook-decision-check.js

@@ -0,0 +1,17 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { checkDbOperation, madSksSqlPlaneLifecycleHookFromDecision } from '../core/db-safety.js';
+import { createMadSksSqlPlaneCapability, MAD_SKS_SQL_PLANE_ACK } from '../core/mad-sks/sql-plane/capability.js';
+import { createMission } from '../core/mission.js';
+import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-sks-sql-plane-hook-decision-'));
+const mission = await createMission(root, { mode: 'mad-sks', prompt: 'hook fixture' });
+await createMadSksSqlPlaneCapability(root, { missionId: mission.id, ack: MAD_SKS_SQL_PLANE_ACK, ttlMs: 60000, projectRef: 'fixture-project-ref', status: 'active' });
+const decision = await checkDbOperation(root, { mission_id: mission.id }, { tool_name: 'supabase.execute_sql', tool_call_id: 'hook-decision-call-1', sql: 'insert into audit_log(id) values (1)' });
+const hook = madSksSqlPlaneLifecycleHookFromDecision(decision);
+assertGate(decision.allowed === true && decision.mad_sks_sql_plane?.lifecycle_result_pending === true, 'MAD-SKS SQL-plane decision must mark pending lifecycle result', decision);
+assertGate(Boolean(hook?.mission_id === mission.id && hook?.operation_id && hook?.tool_call_id === 'hook-decision-call-1' && hook?.cycle_id && hook?.tool_name), 'MAD-SKS SQL-plane decision must expose canonical tool_call_id ledger result hook', { decision, hook });
+emitGate('mad-sks:sql-plane-lifecycle-hook-decision', { operation_id: hook.operation_id, cycle_id: hook.cycle_id });

package/dist/scripts/{mad-db-mcp-result-lifecycle-check.js → mad-sks-sql-plane-result-lifecycle-check.js}

@@ -3,29 +3,28 @@
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { checkDbOperation, madDbLifecycleHookFromDecision } from '../core/db-safety.js';
+import { checkDbOperation, madSksSqlPlaneLifecycleHookFromDecision } from '../core/db-safety.js';
 import { evaluateHookPayload } from '../core/hooks-runtime.js';
-import { createMadDbCapability, MAD_DB_ACK } from '../core/mad-db/mad-db-capability.js';
+import { createMadSksSqlPlaneCapability, MAD_SKS_SQL_PLANE_ACK } from '../core/mad-sks/sql-plane/capability.js';
 import { createMission, missionDir } from '../core/mission.js';
 import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
-const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-db-mcp-result-'));
-const mission = await createMission(root, { mode: 'mad-db', prompt: 'mcp result fixture' });
-await createMadDbCapability(root, { missionId: mission.id, ack: MAD_DB_ACK, ttlMs: 60000, projectRef: 'fixture-project-ref', status: 'active' });
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-mad-sks-sql-plane-mcp-result-'));
+const mission = await createMission(root, { mode: 'mad-sks', prompt: 'mcp result fixture' });
+await createMadSksSqlPlaneCapability(root, { missionId: mission.id, ack: MAD_SKS_SQL_PLANE_ACK, ttlMs: 60000, projectRef: 'fixture-project-ref', status: 'active' });
 const successPayload = { tool_name: 'supabase.execute_sql', tool_call_id: 'mcp-success-call', sql: 'insert into audit_log(id) values (1)' };
 const successDecision = await checkDbOperation(root, { mission_id: mission.id }, successPayload);
-const successHook = madDbLifecycleHookFromDecision(successDecision);
-assertGate(Boolean(successHook), 'Mad-DB lifecycle hook missing before post-tool success result', successDecision);
+const successHook = madSksSqlPlaneLifecycleHookFromDecision(successDecision);
+assertGate(Boolean(successHook), 'MAD-SKS SQL-plane lifecycle hook missing before post-tool success result', successDecision);
 await evaluateHookPayload('post-tool', { tool_name: successPayload.tool_name, tool_call_id: successHook.tool_call_id, success: true, row_count: 1 }, { root, state: { mission_id: mission.id } });
 const failurePayload = { tool_name: 'supabase.execute_sql', tool_call_id: 'mcp-failure-call', sql: 'update audit_log set id = 2 where id = 1' };
 const failureDecision = await checkDbOperation(root, { mission_id: mission.id }, failurePayload);
-const failureHook = madDbLifecycleHookFromDecision(failureDecision);
-assertGate(Boolean(failureHook), 'Mad-DB lifecycle hook missing before post-tool MCP isError result', failureDecision);
+const failureHook = madSksSqlPlaneLifecycleHookFromDecision(failureDecision);
+assertGate(Boolean(failureHook), 'MAD-SKS SQL-plane lifecycle hook missing before post-tool MCP isError result', failureDecision);
 await evaluateHookPayload('post-tool', {
     tool_name: failurePayload.tool_name,
     tool_call_id: failureHook.tool_call_id,
     result: { isError: true, content: [{ type: 'text', text: 'fixture MCP error' }] }
 }, { root, state: { mission_id: mission.id } });
-const ledger = await fs.readFile(path.join(missionDir(root, mission.id), 'mad-db-ledger.jsonl'), 'utf8');
+const ledger = await fs.readFile(path.join(missionDir(root, mission.id), 'mad-sks', 'sql-plane', 'ledger.jsonl'), 'utf8');
 assertGate(ledger.includes('db_operation.succeeded') && ledger.includes('db_operation.failed') && ledger.includes('fixture MCP error'), 'PostToolUse must append succeeded and MCP isError failed lifecycle events', { ledger });
-emitGate('mad-db:mcp-result-lifecycle', { success_operation_id: successHook.operation_id, failure_operation_id: failureHook.operation_id, status: 'succeeded_and_failed_checked' });
-//# sourceMappingURL=mad-db-mcp-result-lifecycle-check.js.map
+emitGate('mad-sks:sql-plane-result-lifecycle', { success_operation_id: successHook.operation_id, failure_operation_id: failureHook.operation_id, status: 'succeeded_and_failed_checked' });

package/dist/scripts/managed-config-merge-check.js

@@ -21,4 +21,3 @@ assertGate(jsonText.includes('keep-json') && jsonText.includes('keep-service') &
 assertGate(toml.preserved_secret_lines_sha256.length > 0 && tomlAgain.changed === false, 'toml merge must report secret line hashes and be idempotent', { toml, tomlAgain });
 assertGate(toml.ok && json.ok, 'managed config merge results must be ok', { toml, json });
 emitGate('config:managed-merge');
-//# sourceMappingURL=managed-config-merge-check.js.map

package/dist/scripts/mcp-plugin-inventory-check.js

@@ -9,4 +9,3 @@ const inventory = await pluginMod.buildCodexPluginInventory();
 const candidates = mcpMod.buildMcpPluginServerCandidates(inventory);
 assertGate(candidates.candidate_only === true && candidates.candidates.every((candidate) => candidate.auto_enable === false && candidate.destructive_tools_auto_enabled === false), 'remote MCP plugin inventory must be candidate-only and non-destructive by default', candidates);
 emitGate('mcp:plugin-inventory', { candidates: candidates.candidates.length });
-//# sourceMappingURL=mcp-plugin-inventory-check.js.map

package/dist/scripts/mcp-tool-naming-parity-check.js

@@ -13,4 +13,3 @@ emit({ schema: 'sks.mcp-tool-naming-parity-check.v1', ok, report });
 function emit(report) { console.log(JSON.stringify(report, null, 2)); if (!report.ok)
     process.exitCode = 1; }
 function fail(blocker, detail) { emit({ schema: 'sks.mcp-tool-naming-parity-check.v1', ok: false, blockers: [blocker], detail }); process.exit(1); }
-//# sourceMappingURL=mcp-tool-naming-parity-check.js.map

package/dist/scripts/model-call-concurrency-check.js

@@ -12,4 +12,3 @@ await Promise.all(Array.from({ length: 8 }, (_, i) => withModelCallSlot({ root:
 const proof = await writeParallelRuntimeProof(ledgerRoot, missionId, { requestedWorkers: 1, targetActiveSlots: 1, minActiveWorkers: 0, minSpeedupRatio: 0 });
 assertGate(proof.max_observed_model_calls <= 3 && proof.unique_model_call_ids === 8, 'model-call semaphore did not enforce/record concurrency', proof);
 emitGate('model-call:concurrency', proof);
-//# sourceMappingURL=model-call-concurrency-check.js.map

package/dist/scripts/mutation-callsite-coverage-check.js

@@ -173,4 +173,3 @@ function snippet(line) {
 function rel(file) {
     return path.relative(root, file).split(path.sep).join('/');
 }
-//# sourceMappingURL=mutation-callsite-coverage-check.js.map

package/dist/scripts/naruto-codex-e2e-check.js

@@ -104,4 +104,3 @@ function parseJsonObjectFromStdout(stdout) {
     }
     return null;
 }
-//# sourceMappingURL=naruto-codex-e2e-check.js.map

package/dist/scripts/naruto-worktree-coding-blackbox.js

@@ -0,0 +1,28 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+import { makeGitFixture, run } from './lib/git-worktree-fixture.js';
+const managerMod = await importDist('core/git/git-worktree-manager.js');
+const diffMod = await importDist('core/git/git-worktree-diff.js');
+const mergeMod = await importDist('core/git/git-worktree-merge-queue.js');
+const repo = makeGitFixture('naruto-worktree-blackbox');
+process.env.SKS_WORKTREE_ROOT = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-naruto-blackbox-'));
+const allocations = [];
+for (const file of ['a.txt', 'b.txt']) {
+    const allocation = await managerMod.allocateWorkerWorktree({ repoRoot: repo, missionId: 'M-naruto-blackbox', workerId: file.replace('.txt', ''), slotId: file.replace('.txt', '') });
+    fs.writeFileSync(path.join(allocation.worktree_path, file), `${file}\nworker-change\n`);
+    allocations.push(allocation);
+}
+assertGate(run('git', ['status', '--porcelain=v1'], repo).trim() === '', 'main worktree must remain unchanged before integration');
+const diffs = [];
+for (const allocation of allocations) {
+    diffs.push(await diffMod.exportGitWorktreeDiff({ mainRepoRoot: repo, worktreePath: allocation.worktree_path, missionId: 'M-naruto-blackbox', workerId: allocation.worker_id }));
+}
+const integration = await managerMod.allocateWorkerWorktree({ repoRoot: repo, missionId: 'M-naruto-blackbox', workerId: 'integration', slotId: 'integration' });
+const report = await mergeMod.applyGitWorktreeMergeQueue({ integrationWorktreePath: integration.worktree_path, diffs });
+assertGate(report.ok === true && report.applied_count === 2, 'integration worktree merge report must apply worker diffs', report);
+assertGate(run('git', ['status', '--porcelain=v1'], repo).trim() === '', 'main worktree must remain unchanged after integration queue');
+emitGate('naruto:worktree-coding:blackbox', { allocations: allocations.length, applied_count: report.applied_count });

package/dist/scripts/naruto-write-e2e-check.js

@@ -29,4 +29,3 @@ function readMode(args) {
     }, null, 2));
     process.exit(1);
 }
-//# sourceMappingURL=naruto-write-e2e-check.js.map

package/dist/scripts/native-capability-postcheck-check.js

@@ -14,4 +14,3 @@ assertGate(postcheck.ok === true && postcheck.blockers.length === 0 && Array.isA
 assertGate(imagePath?.after === 'degraded', 'saved artifact path fallback must be degraded, not verified native image path exposure', repairedManual);
 assertGate(postcheck.capabilities.every((state) => state.after !== null), 'postcheck must set after state for each capability', postcheck);
 emitGate('native-capability:postcheck');
-//# sourceMappingURL=native-capability-postcheck-check.js.map

package/dist/scripts/native-capability-repair-matrix-check.js

@@ -9,4 +9,3 @@ assertGate(matrix.capabilities.some((state) => state.id === 'chrome_web_review'
 assertGate(matrix.ok === true && matrix.core_blockers.length === 0 && matrix.blockers.length === 0, 'optional native capability warnings must not be core blockers', matrix);
 assertGate(Array.isArray(matrix.route_blockers['route-chrome-web-review']) && Array.isArray(matrix.route_blockers['route-computer-use']), 'Computer Use and Chrome must expose route blockers only', matrix);
 emitGate('native-capability:repair-matrix', { capabilities: matrix.capabilities.length });
-//# sourceMappingURL=native-capability-repair-matrix-check.js.map

package/dist/scripts/native-image-generation-repair-check.js

@@ -6,4 +6,3 @@ const report = await repairNativeCapabilities({ root, fix: true, yes: true, capa
 assertGate(report.capabilities.some((state) => state.id === 'image_generation' && state.after === 'verified'), 'image generation fixture should verify after repair', report);
 assertGate(report.capabilities.some((state) => state.id === 'saved_artifact_path_contract' && state.after === 'verified'), 'saved artifact path contract should verify after repair', report);
 emitGate('native:image-generation-repair');
-//# sourceMappingURL=native-image-generation-repair-check.js.map

package/dist/scripts/official-subagent-workflow-check.js

@@ -16,7 +16,7 @@ assertGate(implicitCount.requestedSubagents === 2, 'implicit Naruto must default
 assertGate(counts[0]?.requestedSubagents === 4, 'requested 4 must remain 4', counts);
 assertGate(counts[1]?.requestedSubagents === 8, 'requested 8 must remain 8', counts);
 assertGate(counts[2]?.requestedSubagents === 12, 'requested 12 must remain 12', counts);
-assertGate(counts[3]?.requestedSubagents === 20 && counts[3]?.firstWave === 12 && counts[3]?.waveCount === 2, 'requested 20/maxThreads 12 must plan two waves without a 4/5 cap', counts);
+assertGate(counts[3]?.requestedSubagents === 20 && counts[3]?.firstWave === 10 && counts[3]?.waveCount === 2, 'requested 20/maxThreads 12 must reserve parent/reviewer capacity and plan two waves', counts);
 assertGate(counts[4]?.requestedSubagents === 32, 'requested 100 must use the official hard safety cap 32', counts);
 const prompt = buildOfficialSubagentPrompt({
     goal: 'Review independent packages and report one parent summary.',
@@ -28,6 +28,7 @@ const prompt = buildOfficialSubagentPrompt({
 assertGate(/worker/i.test(prompt) && /expert/i.test(prompt), 'official delegation prompt must include worker and expert policy', { prompt });
 assertGate(/wait|await/i.test(prompt) && /all/i.test(prompt), 'official delegation prompt must require waiting for every requested subagent', { prompt });
 assertGate(/max.depth|max_depth|depth\s*1/i.test(prompt), 'official delegation prompt must keep max depth at 1', { prompt });
+assertGate(/cap, never a utilization target/i.test(prompt) && /C_t = min/i.test(prompt), 'official delegation prompt must carry the dynamic capacity contract', { prompt });
 const fixture = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-official-subagent-gate-'));
 try {
     const events = [
@@ -124,7 +125,7 @@ try {
     const facade = fs.readFileSync(path.join(root, 'src', 'core', 'commands', 'naruto-command.ts'), 'utf8');
     const preparationOwner = fs.readFileSync(path.join(root, 'src', 'core', 'subagents', 'official-subagent-preparation.ts'), 'utf8');
     assertGate(!facade.includes('naruto-command-legacy') && !fs.existsSync(path.join(root, 'src', 'core', 'commands', 'naruto-command-legacy.ts')), 'legacy Naruto process swarm command must be removed and unreachable');
-    assertGate(!facade.includes("from '../agents/agent-orchestrator.js'") && !facade.includes("from '../agents/native-cli-session-swarm.js'"), 'default Naruto facade must not eager-import the process orchestrator');
+    assertGate(!facade.includes("from '../agents/agent-orchestrator.js'") && !facade.includes("from '../agents/native-cli-worker-runtime.js'"), 'default Naruto facade must not eager-import the process orchestrator');
     assertGate(facade.includes('prepareOfficialSubagentMission'), 'Naruto facade must delegate preparation to the shared official-subagent owner');
     assertGate(preparationOwner.includes('delegation_prompt: delegationPrompt'), 'canonical subagent plan must persist the official delegation prompt required by the stop gate');
     emitGate('naruto:official-subagent-workflow', {
@@ -142,4 +143,3 @@ try {
 finally {
     fs.rmSync(fixture, { recursive: true, force: true });
 }
-//# sourceMappingURL=official-subagent-workflow-check.js.map

package/dist/scripts/ops-diagnostics-bundle-check.js

@@ -10,4 +10,3 @@ assertGate(Array.isArray(report.redacted_env_keys), 'ops diagnostics bundle must
 assertGate(typeof report.node_version === 'string' && report.node_version.startsWith('v'), 'ops diagnostics bundle must include node version', report.node_version);
 assertGate(typeof report.platform === 'string' && report.platform.length > 0, 'ops diagnostics bundle must include platform', report.platform);
 emitGate('ops:diagnostics-bundle', { report: reportPath.replace(`${root}/`, '') });
-//# sourceMappingURL=ops-diagnostics-bundle-check.js.map

package/dist/scripts/package-published-contract-check.js

@@ -36,4 +36,3 @@ function scriptTargets(command) {
     }
     return targets;
 }
-//# sourceMappingURL=package-published-contract-check.js.map