sneakoscope 6.2.0 → 6.4.0

package/dist/scripts/prepublish-release-check-or-fast.js

@@ -1,14 +1,14 @@
 #!/usr/bin/env node
 // @ts-nocheck
-// Publish-time release stamp verifier.
+// Publish-time release stamp verifier and prepack build bridge.
 //
-// The final registry operation is deliberately not a release-check runner.
-// It accepts only an authoritative full-release stamp that is already current
-// and fails closed when the stamp is missing or stale. Operators refresh proof
-// separately with `npm run release:check:full` so publish latency stays bounded
-// and a registry command cannot silently launch the entire canonical test DAG.
+// `npm publish` verifies the authoritative release stamp before prepack, rebuilds
+// dist through the normal prepack lifecycle, then verifies the same stamp again
+// before npm creates the publish tarball. Ordinary `npm pack` keeps build-only
+// behavior and does not require release authorization.
 import { spawnSync } from 'node:child_process';
 import process from 'node:process';
+const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';
 function runFastCheck() {
     const result = spawnSync(process.execPath, ['./dist/scripts/prepublish-fast-check.js'], {
         cwd: process.cwd(),
@@ -33,20 +33,19 @@ function runStampVerify() {
         process.stderr.write(result.stderr);
     return result;
 }
+function runBuild() {
+    return spawnSync(npmCmd, ['run', 'build'], {
+        cwd: process.cwd(),
+        env: process.env,
+        stdio: 'inherit'
+    });
+}
 function failClosed(status = 1) {
     console.error('Prepublish requires a current authoritative full-release stamp.');
     console.error('Run `npm run release:check:full` separately, then rerun the publish command.');
     process.exit(status || 1);
 }
-function blockLifecyclePublish() {
-    console.error('Lifecycle-enabled npm publish is unsupported because prepack would rebuild after authorization.');
-    console.error('Run `npm run publish:prep-ignore-scripts`, then use `npm publish --ignore-scripts` only if you are the repository maintainer performing the separate publish handoff.');
-    process.exit(2);
-}
-function main() {
-    if (process.argv.includes('--block-lifecycle-publish') || process.env.npm_lifecycle_event === 'prepublishOnly') {
-        blockLifecyclePublish();
-    }
+function verifyReleaseStamp() {
     const fast = runFastCheck();
     if (fast.status !== 0)
         failClosed(fast.status);
@@ -54,5 +53,15 @@ function main() {
     if (stamp.status !== 0)
         failClosed(stamp.status);
 }
+function main() {
+    if (process.argv.includes('--prepack-build')) {
+        const build = runBuild();
+        if (build.status !== 0)
+            process.exit(build.status || 1);
+        if (String(process.env.npm_command || '').toLowerCase() === 'publish')
+            verifyReleaseStamp();
+        return;
+    }
+    verifyReleaseStamp();
+}
 main();
-//# sourceMappingURL=prepublish-release-check-or-fast.js.map

package/dist/scripts/probe-memoization-check.js

@@ -8,4 +8,3 @@ const first = mod.memoizeProbe({ root: tmp, probeId: 'fixture', ttlMs: 60000, ve
 const second = mod.memoizeProbe({ root: tmp, probeId: 'fixture', ttlMs: 60000, version: 'v1', run: () => ({ calls: ++calls }) });
 assertGate(first.reused === false && second.reused === true && second.value.calls === 1, 'probe memoization must reuse TTL record', { first, second, calls });
 emitGate('probes:memoization', { reused: second.reused });
-//# sourceMappingURL=probe-memoization-check.js.map

package/dist/scripts/product-design-plugin-routing-check.js

@@ -103,4 +103,3 @@ emitGate('codex:product-design-plugin-routing', {
     stages: PRODUCT_DESIGN_PIPELINE_STAGES.length,
     local_list_hidden_requires_remote_lookup: hiddenFromLocalList.requires_remote_vertical_lookup
 });
-//# sourceMappingURL=product-design-plugin-routing-check.js.map

package/dist/scripts/project-skill-dedupe-blackbox.js

@@ -33,4 +33,3 @@ assertGate(scenarioC.blockers.some((blocker) => blocker.includes('user_duplicate
 assertGate(scenarioD.active_unique_by_canonical_name === true, 'scenario D must quarantine confirmed user-authored duplicate', scenarioD);
 assertGate(concurrentLedger.active_unique_by_canonical_name === true, 'scenario F must keep exactly one active canonical name after concurrent sync', concurrentLedger);
 emitGate('skill:dedupe-blackbox');
-//# sourceMappingURL=project-skill-dedupe-blackbox.js.map

package/dist/scripts/prompt-placeholder-guard-check.js

@@ -30,4 +30,3 @@ emitGate('prompt:placeholder-guard', {
     empty_target_blockers: emptyTarget.blockers,
     readonly_warnings: readonlyWarn.warnings
 });
-//# sourceMappingURL=prompt-placeholder-guard-check.js.map

package/dist/scripts/proof-root-cause-policy-check.js

@@ -69,4 +69,3 @@ console.log(JSON.stringify({
     contract_status: contractValidation.status,
     finalizer_gate_status: finalizerGate.status
 }));
-//# sourceMappingURL=proof-root-cause-policy-check.js.map

package/dist/scripts/provider-badge-context-check.js

@@ -8,9 +8,9 @@ const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-provider-context-'));
 const codexHome = path.join(root, '.codex-home');
 await fs.mkdir(codexHome, { recursive: true });
 await fs.writeFile(path.join(codexHome, 'auth.json'), '{"account_id":"acct_fixture"}\n');
-const openai = await resolveProviderContext({ root, codexHome, env: { OPENAI_API_KEY: 'sk-fixture', HOME: root }, route: '$Agent', serviceTier: 'fast' });
+const openai = await resolveProviderContext({ root, codexHome, env: { OPENAI_API_KEY: 'sk-fixture', HOME: root }, route: '$Naruto', serviceTier: 'fast' });
 const lb = await resolveProviderContext({ root, codexHome, env: { CODEX_LB_API_KEY: 'lb-fixture', SKS_PROVIDER: 'codex-lb', HOME: root }, route: '$Naruto', serviceTier: 'fast' });
-const app = await resolveProviderContext({ root, codexHome, env: { HOME: root }, route: '$Agent', serviceTier: 'standard' });
+const app = await resolveProviderContext({ root, codexHome, env: { HOME: root }, route: '$Naruto', serviceTier: 'standard' });
 const conflict = await resolveProviderContext({ root, codexHome, env: { OPENAI_API_KEY: 'sk-fixture', CODEX_LB_API_KEY: 'lb-fixture', HOME: root } });
 const ok = openai.provider === 'openai'
     && lb.provider === 'codex-lb'
@@ -23,4 +23,3 @@ function emit(report) {
     if (!report.ok)
         process.exitCode = 1;
 }
-//# sourceMappingURL=provider-badge-context-check.js.map

package/dist/scripts/python-codex-sdk-all-pipelines-check.js

@@ -20,7 +20,7 @@ process.env.SKS_PYTHON_CODEX_SDK_FAKE = '1';
 process.env.SKS_CODEX_LB_AUTOBYPASS = '1';
 try {
     const result = await mod.runCodexTask({
-        route: '$Agent',
+        route: '$Naruto',
         missionId: 'M-python-sdk-all-pipelines',
         workItemId: 'python-sdk-fixture',
         slotId: 'slot-python-fixture',
@@ -52,4 +52,3 @@ finally {
     else
         process.env.SKS_CODEX_LB_AUTOBYPASS = oldCodexLbAutobypass;
 }
-//# sourceMappingURL=python-codex-sdk-all-pipelines-check.js.map

package/dist/scripts/qa-loop-app-handoff-capability-check.js

@@ -6,4 +6,3 @@ const handoff = readText('src/core/codex-app/codex-app-handoff.ts');
 assertGate(command.includes('writeCodex0138CapabilityArtifacts'), 'QA-LOOP must snapshot Codex 0.138 capability before handoff');
 assertGate(handoff.includes('supports_app_handoff') && handoff.includes('capability_required') && handoff.includes('codex-0.138'), 'handoff must be gated by Codex 0.138 capability');
 emitGate('qa-loop:app-handoff-capability');
-//# sourceMappingURL=qa-loop-app-handoff-capability-check.js.map

package/dist/scripts/qa-loop-app-handoff-check.js

@@ -6,4 +6,3 @@ const core = readText('src/core/qa-loop.ts');
 assertGate(command.includes('runCodexAppHandoff') && command.includes('--app-handoff-required'), 'QA-LOOP command must wire Codex App /app handoff flags');
 assertGate(core.includes('desktop_app_handoff_required') && core.includes('desktop_app_handoff_misused_as_web_evidence'), 'QA gate must track desktop handoff without web evidence substitution');
 emitGate('qa-loop:app-handoff');
-//# sourceMappingURL=qa-loop-app-handoff-check.js.map

package/dist/scripts/qa-loop-app-handoff-cli-check.js

@@ -5,4 +5,3 @@ const command = readText('src/core/commands/qa-loop-command.ts');
 assertGate(command.includes('[--app-handoff] [--app-handoff-required]') && command.includes('status <mission-id|latest> [--desktop]'), 'QA-LOOP help must expose app handoff run/status flags');
 assertGate(command.includes('blocked_for_desktop_review') && command.includes('desktop_app_handoff'), 'QA-LOOP CLI must emit desktop handoff status');
 emitGate('qa-loop:app-handoff-cli');
-//# sourceMappingURL=qa-loop-app-handoff-cli-check.js.map

package/dist/scripts/qa-loop-app-handoff-confirmation-check.js

@@ -21,4 +21,3 @@ await fs.writeFile(path.join(missionDir, 'qa-loop', 'app-handoff.json'), JSON.st
 const result = await mod.confirmQaLoopAppHandoff(root, { missionId: 'M-fixture', verdict: 'pass', notes: 'Desktop reviewed' });
 assertGate(result.confirmation.verdict === 'pass' && result.gate.desktop_app_handoff_confirmed === true && result.gate.desktop_app_handoff_status === 'completed', 'app-confirm must write confirmation artifact and update qa-gate');
 emitGate('qa-loop:app-handoff-confirmation');
-//# sourceMappingURL=qa-loop-app-handoff-confirmation-check.js.map

package/dist/scripts/qa-loop-app-handoff-gate-lifecycle-check.js

@@ -41,4 +41,3 @@ await confirm.confirmQaLoopAppHandoff(root, { missionId: 'M-fixture', verdict: '
 const after = await qa.evaluateQaGate(missionDir);
 assertGate(before.passed === false && before.reasons.includes('desktop_app_handoff_confirmation_missing') && after.passed === true, 'required Desktop handoff gate must wait for pass confirmation', { before, after });
 emitGate('qa-loop:app-handoff-gate-lifecycle');
-//# sourceMappingURL=qa-loop-app-handoff-gate-lifecycle-check.js.map

package/dist/scripts/qa-loop-app-handoff-launch-check.js

@@ -4,4 +4,3 @@ import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
 const command = readText('src/core/commands/qa-loop-command.ts');
 assertGate(command.includes('--app-handoff-launch') && command.includes('--app-handoff-artifact-only') && command.includes('launch_mode'), 'QA-LOOP must expose launch/artifact-only handoff flags and pass launch_mode');
 emitGate('qa-loop:app-handoff-launch');
-//# sourceMappingURL=qa-loop-app-handoff-launch-check.js.map

package/dist/scripts/qa-loop-app-handoff-status-lifecycle-check.js

@@ -4,4 +4,3 @@ import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
 const command = readText('src/core/commands/qa-loop-command.ts');
 assertGate(command.includes('desktop_app_confirmation') && command.includes('desktop_review_complete') && command.includes('launch:'), 'QA status --desktop must include handoff launch, confirmation, and complete lifecycle');
 emitGate('qa-loop:app-handoff-status-lifecycle');
-//# sourceMappingURL=qa-loop-app-handoff-status-lifecycle-check.js.map

package/dist/scripts/qa-loop-budget-policy-check.js

@@ -5,4 +5,3 @@ const mod = await importDist('core/qa-loop/qa-loop-budget-policy.js');
 const policy = mod.buildQaLoopBudgetPolicy({ usage: { source: 'fake', token_usage: { total_tokens: 95 }, usage_limit_tokens: 100 } });
 assertGate(policy.near_limit === true && policy.local_llm_draft_preferred === true && policy.final_reviewer_gpt_backed === true, 'QA budget policy must reduce remote concurrency near account limit while keeping GPT final reviewer', policy);
 emitGate('qa-loop:budget-policy');
-//# sourceMappingURL=qa-loop-budget-policy-check.js.map

package/dist/scripts/qa-loop-effort-escalation-check.js

@@ -6,4 +6,3 @@ const one = mod.selectQaLoopEscalatedEffort({ failureCount: 1, currentEffort: 'm
 const two = mod.selectQaLoopEscalatedEffort({ failureCount: 2, currentEffort: 'medium' });
 assertGate(one.next_effort === 'medium' && two.next_effort === 'high' && two.escalated === true, 'QA-LOOP effort escalation must raise effort after repeated failures', { one, two });
 emitGate('qa-loop:effort-escalation');
-//# sourceMappingURL=qa-loop-effort-escalation-check.js.map

package/dist/scripts/qa-loop-execution-profile-routing-check.js

@@ -1,4 +1,3 @@
 #!/usr/bin/env node
 import { runDirective315Gate } from './sks-3-1-5-directive-check-lib.js';
 await runDirective315Gate('qa-loop:execution-profile-routing');
-//# sourceMappingURL=qa-loop-execution-profile-routing-check.js.map

package/dist/scripts/qa-loop-image-path-exposure-check.js

@@ -6,4 +6,3 @@ const core = readText('src/core/qa-loop.ts');
 assertGate(command.includes('discoverImageArtifactsInDir') && command.includes('image-artifact-path-contract.json'), 'QA-LOOP must discover image artifacts and write image path contract');
 assertGate(core.includes('model_visible_path') && core.includes('Use model_visible_path values for follow-up image edits'), 'QA prompt must expose model-visible saved image paths');
 emitGate('qa-loop:image-path-exposure');
-//# sourceMappingURL=qa-loop-image-path-exposure-check.js.map

package/dist/scripts/qa-loop-image-path-prompt-injection-check.js

@@ -5,4 +5,3 @@ const qa = await importDist('core/qa-loop.js');
 const prompt = qa.buildQaLoopPrompt({ id: 'M', mission: { prompt: 'fixture' }, contract: {}, cycle: 1, previous: '', reportFile: '2026-06-09-v2.0.19-qa-report.md', imagePathContract: { images: [{ id: 'img', model_visible_path: '/tmp/a.png', mime_type: 'image/png', width: 1, height: 1, followup_edit_hint: 'use /tmp/a.png' }], blockers: [] } });
 assertGate(prompt.includes('/tmp/a.png') && prompt.includes('mime_type') && prompt.includes('width') && prompt.includes('Use model_visible_path values'), 'QA prompt must inject image id, model-visible path, dimensions/mime, and follow-up edit hint');
 emitGate('qa-loop:image-path-prompt-injection');
-//# sourceMappingURL=qa-loop-image-path-prompt-injection-check.js.map

package/dist/scripts/release-affected-selector-check.js

@@ -80,7 +80,7 @@ for (const changedFile of [
     'src/core/subagents/naruto-help-contract.ts',
     'src/core/commands/naruto-command.ts',
     'src/bin/fast-inline.ts',
-    'test/blackbox/naruto-shadow-clone-swarm-packed.test.mjs'
+    'test/blackbox/official-subagent-workflow-packed.test.mjs'
 ]) {
     const selectedForPolicy = selectorMod.selectAffectedReleaseGates(root, manifest, gates, {
         changedFiles: [changedFile],
@@ -111,4 +111,3 @@ emitGate('release:affected-selector', {
     scheduler_script_selected: schedulerScriptIds.size,
     official_subagent_selected: officialSubagentIds.size
 });
-//# sourceMappingURL=release-affected-selector-check.js.map

package/dist/scripts/release-aggressive-resource-governor-check.js

@@ -22,4 +22,3 @@ assertGate(timingAfterOther.length === 1 && timingAfterOther[0].id === 'a', 'tim
 const blockedByTiming = governor.pickLaunchableReleaseGates({ ready: [gate('a')], running: [timingGate('timing')], budget });
 assertGate(blockedByTiming.length === 0, 'running timing-sensitive gate must block co-scheduled release gates', { picked: blockedByTiming.map((row) => row.id) });
 emitGate('release:aggressive-resource-governor', { cpu_light: budget['cpu-light'], total: picked.length });
-//# sourceMappingURL=release-aggressive-resource-governor-check.js.map

package/dist/scripts/release-cache-glob-hashing-check.js

@@ -40,4 +40,3 @@ const report = {
 };
 assertGate(report.ok, 'release cache key must hash recursive glob file paths and contents', report);
 emitGate('release:cache-glob-hashing', report);
-//# sourceMappingURL=release-cache-glob-hashing-check.js.map

package/dist/scripts/release-cache-input-classifier-check.js

@@ -10,4 +10,3 @@ const scriptChange = classifyReleaseCacheInputChange({ file: 'package.json', bef
 assertGate(versionOnly.neutralizable === true && versionOnly.behavior_affecting === false, 'package version-only change must be neutralizable', versionOnly);
 assertGate(scriptChange.neutralizable === false && scriptChange.behavior_affecting === true && scriptChange.reason.includes('scripts'), 'package script change must invalidate', scriptChange);
 emitGate('release:cache-input-classifier', { versionOnly, scriptChange });
-//# sourceMappingURL=release-cache-input-classifier-check.js.map

package/dist/scripts/release-cache-neutralization-report-check.js

@@ -10,4 +10,3 @@ assertGate(Array.isArray(summary.version_neutralized_inputs), 'release speed sum
 assertGate(Array.isArray(summary.behavior_affecting_inputs), 'release speed summary missing behavior-affecting inputs', summary);
 assertGate(String(summary.cache_message || '').includes('Version correctness gates still ran uncached'), 'release speed summary missing neutralization operator message', summary);
 emitGate('release:cache-neutralization-report', summary);
-//# sourceMappingURL=release-cache-neutralization-report-check.js.map

package/dist/scripts/release-cache-version-neutral-fixture-check.js

@@ -62,4 +62,3 @@ async function writeFixture(mutate) {
     await fs.writeFile(path.join(root, 'dist/build-manifest.json'), JSON.stringify(f.manifest, null, 2));
     return root;
 }
-//# sourceMappingURL=release-cache-version-neutral-fixture-check.js.map

package/dist/scripts/release-check-stamp.js

@@ -36,7 +36,7 @@ function releaseManifestContract() {
         totalGateCount: allGates.length,
         releaseGateIds,
         releaseGateIdsSorted: [...new Set(releaseGateIds)].sort(),
-        expectedReleaseGateIds: contract.ids,
+        expectedReleaseGateIds: [...contract.ids].sort(),
         missingExpectedGateIds: contract.ids.filter((id) => !releaseGateIds.includes(id)),
         unexpectedReleaseGateIds: [...new Set(releaseGateIds)].filter((id) => !contract.ids.includes(id)).sort(),
         contract
@@ -445,4 +445,3 @@ else if (command === 'ensure')
     ensureStamp();
 else
     fail(`unknown command ${command}`, 'Usage: node ./dist/scripts/release-check-stamp.js <write --preset release --full [--summary path]|verify|ensure>');
-//# sourceMappingURL=release-check-stamp.js.map

package/dist/scripts/release-dag-full-coverage-check.js

@@ -96,4 +96,3 @@ function normalizeStringList(value) {
 function isRecord(value) {
     return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
 }
-//# sourceMappingURL=release-dag-full-coverage-check.js.map

package/dist/scripts/release-dist-freshness-check.js

@@ -5,4 +5,3 @@ const report = ensureDistFresh({ rebuild: process.env.SKS_RELEASE_DIST_FRESHNESS
 console.log(JSON.stringify(report, null, 2));
 if (!report.ok)
     process.exitCode = 1;
-//# sourceMappingURL=release-dist-freshness-check.js.map

package/dist/scripts/release-dynamic-presets-check.js

@@ -26,4 +26,3 @@ catch (error) {
 assertGate(unknownPresetBlocked, 'unknown or empty release presets must fail closed');
 assertGate(runner.includes('--changed-since') && runner.includes('--full') && runner.includes('--sla'), 'release DAG runner must parse changed-since/full/sla');
 emitGate('release:dynamic-presets', { presets: 4 });
-//# sourceMappingURL=release-dynamic-presets-check.js.map

package/dist/scripts/release-file-ownership-check.js

@@ -0,0 +1,35 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { inspectReleaseFileOwnership, readReleaseFileOwnershipManifest } from '../core/release/file-ownership.js';
+import { writeReleaseJson } from '../core/release/release-pack-receipt.js';
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const manifestFile = path.resolve(root, required('--manifest'));
+const base = required('--base');
+const head = required('--head');
+const manifest = readReleaseFileOwnershipManifest(manifestFile);
+const report = inspectReleaseFileOwnership({
+    root,
+    manifest,
+    base,
+    head,
+    ...(option('--workstream') ? { workstream: option('--workstream') } : {})
+});
+const owner = report.workstream || 'unresolved';
+const output = path.resolve(root, option('--output') || `.sneakoscope/release/6.3.0/ownership-reports/${owner}.json`);
+writeReleaseJson(output, report);
+console.log(JSON.stringify({ ...report, report_path: path.relative(root, output).split(path.sep).join('/') }, null, 2));
+if (!report.ok)
+    process.exitCode = 1;
+function required(name) {
+    const value = option(name);
+    if (!value) {
+        console.error(`Release file ownership check failed: ${name} is required`);
+        process.exit(2);
+    }
+    return value;
+}
+function option(name) {
+    const index = process.argv.indexOf(name);
+    return index >= 0 ? String(process.argv[index + 1] || '').trim() : '';
+}

package/dist/scripts/release-full-parallelism-blackbox.js

@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { runReleaseGateBatch } from '../core/release/release-gate-batch-runner.js';
+import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+const reportRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-release-full-'));
+const gates = Array.from({ length: 80 }, (_, i) => ({ id: `synthetic:${i + 1}`, command: `${process.execPath} -e \"setTimeout(()=>process.exit(0),1000)\"`, deps: [], resource: ['cpu-light', 'fs-read'], side_effect: 'hermetic', timeout_ms: 15000, cache: { enabled: false, inputs: [] }, isolation: { home: 'temp', codex_home: 'temp', report_dir: 'per-gate' }, preset: ['release'] }));
+const started = Date.now();
+const result = await runReleaseGateBatch(root, gates, { concurrency: 40, reportRoot });
+const wallMs = Date.now() - started;
+const completedDurations = result.results
+    .map((row) => Number(row.duration_ms || 0))
+    .filter((duration) => Number.isFinite(duration) && duration > 0);
+const observedSequentialMs = completedDurations.reduce((total, duration) => total + duration, 0);
+const slowestGateMs = Math.max(1, ...completedDurations);
+const safeConcurrency = 4;
+const expectedWaves = Math.ceil(gates.length / safeConcurrency);
+const dynamicWallBudgetMs = Math.max(20_000, Math.ceil((slowestGateMs * expectedWaves) + 12_000));
+const gain = Number((observedSequentialMs / Math.max(1, wallMs)).toFixed(2));
+assertGate(result.ok === true, 'synthetic release gates failed', result);
+assertGate(result.batch_size === 80 && result.completed === 80, 'synthetic gate count mismatch', result);
+assertGate(completedDurations.length === 80, 'synthetic gate duration evidence missing', { durations: completedDurations.length, result });
+assertGate(wallMs <= dynamicWallBudgetMs, 'release full parallelism wall time too slow', {
+    wallMs,
+    dynamicWallBudgetMs,
+    slowestGateMs,
+    expectedWaves,
+    result
+});
+assertGate(gain >= 3, 'release bounded parallelism gain below 3x', { gain, wallMs, observedSequentialMs });
+emitGate('release:full-parallelism-blackbox', {
+    wall_ms: wallMs,
+    parallelism_gain: gain,
+    observed_sequential_ms: observedSequentialMs,
+    dynamic_wall_budget_ms: dynamicWallBudgetMs,
+    slowest_gate_ms: slowestGateMs,
+    max_running: safeConcurrency,
+    slowest_gates: result.results.sort((a, b) => b.duration_ms - a.duration_ms).slice(0, 5)
+});

package/dist/scripts/release-gate-batch-runner-check.js

@@ -40,4 +40,3 @@ const timeoutResult = await batch.runReleaseGateBatch(root, [timeoutGate], { con
 assertGate(timeoutResult.results.some((row) => row.id === 'batch:timeout' && row.ok === false && row.exit_code === 124 && row.timed_out === true), 'batch runner must report timed-out child process trees explicitly', timeoutResult);
 assertGate(timeoutResult.results.some((row) => row.id === 'batch:timeout' && row.duration_ms >= 1400), 'batch runner must wait for timed-out process tree hard-kill cleanup before resolving', timeoutResult);
 emitGate('release:gate-batch-runner', { batch_size: result.batch_size, failed_child: 'batch:fail' });
-//# sourceMappingURL=release-gate-batch-runner-check.js.map

package/dist/scripts/release-gate-budget-check.js

@@ -33,4 +33,3 @@ fs.writeFileSync(path.join(reportDir, 'release-gate-budget.json'), `${JSON.strin
 // Only a gate over the HARD ceiling fails the gate; soft-budget gates are warnings.
 assertGate(overCeiling.length === 0, 'a gate exceeded the hard time ceiling', { overCeiling, hard_ceiling_ms: HARD_CEILING_MS });
 emitGate('release:gate-budget', { slowest: slowest.length, over_budget: overBudget.length, timing_data: records.length > 0 });
-//# sourceMappingURL=release-gate-budget-check.js.map

package/dist/scripts/release-gate-dag-runner-check.js

@@ -37,7 +37,9 @@ assertGate(runner.includes('detached: process.platform') && runner.includes('kil
 assertGate(runner.includes('pruneOldReleaseGateRunDirs') && runner.includes('SKS_RELEASE_GATE_RUN_RETENTION'), 'DAG runner must prune stale release-gate run reports before they exhaust local disk');
 assertGate(runnerCli.includes('ensureCurrentMigrationBeforeCommand') && runnerCli.includes('release-gate-runner-preflight'), 'DAG runner CLI must self-heal project migration before hermetic gates run');
 assertGate(hermeticEnv.includes('SKS_UPDATE_MIGRATION_GATE_DISABLED'), 'hermetic release gates must not rewrite project migration receipts from temporary HOME roots');
-assertGate(hermeticEnv.includes("input.gate.id === 'legacy:update-e2e'") && hermeticEnv.includes('delete gateEnv.SKS_UPDATE_MIGRATION_GATE_DISABLED'), 'legacy:update-e2e must explicitly remove an inherited disable flag while testing migration retry/repair behavior');
+assertGate(hermeticEnv.includes("input.gate.id === 'migration:current-surface-e2e'") && hermeticEnv.includes('delete gateEnv.SKS_UPDATE_MIGRATION_GATE_DISABLED'), 'migration:current-surface-e2e must explicitly remove an inherited disable flag while testing migration retry/repair behavior');
+const currentSurfaceMigration = manifest.gates.find((row) => row.id === 'migration:current-surface-e2e');
+assertGate(currentSurfaceMigration?.cache?.inputs?.includes('src/core/**'), 'migration:current-surface-e2e cache must cover every directly or transitively executed core source');
 const dag = await importDist('core/release/release-gate-dag.js');
 const fsx = await importDist('core/fsx.js');
 const fixtureRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-release-dag-timeout-'));
@@ -115,4 +117,3 @@ async function exists(file) {
         return false;
     }
 }
-//# sourceMappingURL=release-gate-dag-runner-check.js.map

package/dist/scripts/release-gate-dag-runner.js

@@ -116,4 +116,3 @@ function parseDurationMs(value) {
         return Math.floor(amount * 1000);
     return Math.floor(amount);
 }
-//# sourceMappingURL=release-gate-dag-runner.js.map

package/dist/scripts/release-gate-script-parity-check.js

@@ -73,8 +73,12 @@ export function buildReleaseGateScriptParityReport() {
         'release:check:confidence',
         'release:check:full',
         'prepublishOnly',
-        'publish:prep-ignore-scripts',
-        'publish:ignore-scripts',
+        'release:file-ownership',
+        'release:macos-menubar-proof',
+        'release:main-push-guard',
+        'release:main-push-receipt',
+        'release:pack-receipt',
+        'runtime:installed-smoke',
         'gates:run',
         'policy:gate-audit'
     ];
@@ -122,8 +126,8 @@ function directManifestCommandIssue(command) {
     const segments = text.split(/\s+(?:&&|\|\|)\s+/).map((part) => part.trim()).filter(Boolean);
     const invalid = segments.find((part) => !(/^node\s+\.\/dist\/scripts\/[^\s]+\.js\b/.test(part)
         || /^node\s+\.\/dist\/bin\/sks\.js\b/.test(part)
-        || /^node\s+--test\b/.test(part)
-        || /^tsc\s+-p\s+tsconfig\.json\s+--noEmit$/.test(part)));
+        || /^node\s+\.\/node_modules\/typescript\/bin\/tsc\s+-p\s+tsconfig\.json\s+--noEmit$/.test(part)
+        || /^node\s+--test\b/.test(part)));
     if (invalid) {
         return 'gate_command_must_execute_dist_script_or_typecheck_directly';
     }
@@ -142,4 +146,3 @@ function sourceTargetForScript(script) {
 function isMain() {
     return path.resolve(process.argv[1] || '') === fileURLToPath(import.meta.url);
 }
-//# sourceMappingURL=release-gate-script-parity-check.js.map

package/dist/scripts/release-latency-slo-check.js

@@ -0,0 +1,23 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import { assertGate, emitGate, importDist, readJson, root } from './sks-1-18-gate-lib.js';
+const config = readJson('config/perf-budgets.v1.json');
+const budgets = Array.isArray(config.release_latency_slos) ? config.release_latency_slos : [];
+assertGate(config.schema === 'sks.perf-budgets.v1' && budgets.length === 6, 'release_latency_slo_config_invalid', {
+    schema: config.schema,
+    count: budgets.length
+});
+const { runReleaseLatencySlo } = await importDist('core/perf/release-latency-slo.js');
+const report = await runReleaseLatencySlo(root, budgets);
+assertGate(report.ok, 'release_latency_slo_failed', report);
+emitGate('release:latency-slo', {
+    report: '.sneakoscope/reports/release-latency-slo.json',
+    platform: report.platform,
+    complete: report.complete,
+    measured: report.measurements
+        .filter((row) => row.status === 'measured')
+        .map((row) => ({ id: row.id, p95_ms: row.p95_ms, budget_p95_ms: row.budget_p95_ms })),
+    not_measured: report.measurements
+        .filter((row) => row.status === 'not_measured_platform')
+        .map((row) => row.id)
+});