sneakoscope 6.2.0 → 6.4.0

package/dist/scripts/release-macos-menubar-proof.js

@@ -0,0 +1,167 @@
+#!/usr/bin/env node
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { MACOS_MENUBAR_PROOF_SCHEMA, validateMacosInstallReportOutcome, writeMacosMenubarProof } from '../core/release/macos-menubar-proof.js';
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+const installReportFile = path.resolve(root, required('--install-report'));
+const installReportBytes = fs.readFileSync(installReportFile);
+const installReport = JSON.parse(installReportBytes.toString('utf8'));
+const appPath = String(installReport?.result?.app_path || installReport?.app_path || '');
+const resources = path.join(appPath, 'Contents', 'Resources');
+const plist = path.join(appPath, 'Contents', 'Info.plist');
+const executable = String(installReport?.result?.executable_path || '');
+const installChecks = booleanRecord(installReport?.checks);
+const buildStamp = installReport?.result?.build_stamp || installReport?.build_stamp || {};
+const sourceRoot = firstExisting([
+    path.join(path.dirname(appPath), 'Sources'),
+    path.join(root, 'dist', 'native', 'sks-menubar', 'Sources'),
+    path.join(root, 'native', 'sks-menubar', 'Sources')
+]);
+const swiftFiles = sourceRoot ? fs.readdirSync(sourceRoot).filter((name) => name.endsWith('.swift')).map((name) => path.join(sourceRoot, name)) : [];
+const swiftParse = process.platform === 'darwin' && swiftFiles.length > 0
+    ? run('swiftc', ['-parse', ...swiftFiles]).status === 0
+    : false;
+const resourceNames = [
+    'AppIcon.icns',
+    'SKSStatusTemplate.pdf',
+    'SKSStatusUpdateTemplate.pdf',
+    'SKSStatusWarningTemplate.pdf',
+    'SKSStatusAttentionTemplate.pdf',
+    'Localizable.strings'
+];
+const installedResourceNames = fs.existsSync(resources) ? fs.readdirSync(resources).sort() : [];
+const resourcesOk = Boolean(appPath)
+    && JSON.stringify(installedResourceNames) === JSON.stringify([...resourceNames].sort());
+const plistIcon = process.platform === 'darwin' && fs.existsSync(plist)
+    ? String(run('/usr/libexec/PlistBuddy', ['-c', 'Print :CFBundleIconFile', plist]).stdout || '').trim() === 'AppIcon'
+    : false;
+const codesign = process.platform === 'darwin' && Boolean(appPath)
+    ? run('codesign', ['--verify', '--deep', '--strict', appPath]).status === 0
+    : false;
+const codesignDetail = process.platform === 'darwin' && Boolean(appPath) ? run('codesign', ['-dv', '--verbose=4', appPath]) : null;
+const codesignText = `${codesignDetail?.stdout || ''}\n${codesignDetail?.stderr || ''}`;
+const codesignIdentifier = codesignDetail?.status === 0 && /\bIdentifier=com\.sneakoscope\.sks-menubar\b/.test(codesignText);
+const resourceHashes = hashFiles(resources, resourceNames);
+const sourceNames = Object.keys(installReport?.source_files_sha256 || {}).sort();
+const sourceHashes = hashFiles(sourceRoot, sourceNames);
+const resourceAggregate = aggregateFileHashes(resourceHashes);
+const sourceAggregate = aggregateFileHashes(sourceHashes);
+const resourceHash = resourceNames.length > 0
+    && recordsEqual(resourceHashes, installReport?.resource_files_sha256)
+    && recordsEqual(resourceHashes, buildStamp?.resource_files_sha256)
+    && resourceAggregate === installReport?.resources_sha256
+    && resourceAggregate === buildStamp?.resources_sha256;
+const sourceHash = sourceNames.length === 17
+    && recordsEqual(sourceHashes, installReport?.source_files_sha256)
+    && recordsEqual(sourceHashes, buildStamp?.source_files_sha256)
+    && sourceAggregate === installReport?.source_sha256
+    && sourceAggregate === buildStamp?.source_sha256;
+const iconLoad = process.platform === 'darwin' && fs.existsSync(path.join(resources, 'AppIcon.icns'))
+    ? run('sips', ['-g', 'pixelWidth', '-g', 'pixelHeight', path.join(resources, 'AppIcon.icns')]).status === 0
+    : false;
+const checks = {
+    swift_parse: swiftParse && installChecks.swift_parse === true,
+    swift_compile: installChecks.swift_compile === true,
+    appkit_link: installChecks.swift_compile === true && fs.existsSync(executable),
+    source_inventory: installChecks.source_inventory === true && sourceNames.length === 17,
+    resources: resourcesOk && installChecks.resources_inventory === true && installChecks.expected_resources_present === true,
+    plist_icon: plistIcon && installChecks.info_plist_icon_verified === true,
+    app_icon_load: iconLoad && installChecks.app_icon_load_smoke === true,
+    codesign: codesign && installChecks.codesign_strict_verified === true,
+    codesign_identifier: codesignIdentifier && installChecks.codesign_identifier_verified === true,
+    install_idempotence: installReport?.is_idempotent === true && installChecks.is_idempotent === true,
+    previous_app_rollback: installReport?.previous_app_rollback_verified === true && installChecks.previous_app_rollback_verified === true,
+    resource_hash: resourceHash,
+    source_hash: sourceHash,
+    build_stamp_binding: installChecks.build_stamp_version_source_binding === true
+        && buildStamp?.schema === 'sks.sks-menubar-build-stamp.v2'
+        && buildStamp?.package_version === String(pkg.version || ''),
+    notification_actions: installChecks.notification_action_test === true,
+    accessibility: installChecks.accessibility_smoke === true,
+    reduced_motion: installChecks.reduced_motion_smoke === true,
+    action_script: installChecks.action_script_executable === true,
+    launch_agent: installChecks.launch_agent_safe === true
+};
+const blockers = [
+    ...(process.platform === 'darwin' ? [] : ['not_macos']),
+    ...validateMacosInstallReportOutcome(installReport).blockers.map((blocker) => `menubar_install_report_${blocker}`),
+    ...Object.entries(checks).filter(([, ok]) => !ok).map(([name]) => `macos_check_failed:${name}`)
+];
+const proof = {
+    schema: MACOS_MENUBAR_PROOF_SCHEMA,
+    ok: blockers.length === 0,
+    version: String(pkg.version || ''),
+    source_commit: gitHead(),
+    runner_os: 'macOS',
+    swift_version: String(run('swiftc', ['--version']).stdout || '').trim(),
+    xcode_version: String(run('xcodebuild', ['-version']).stdout || '').trim(),
+    app_path: appPath,
+    install_report_path: path.relative(root, installReportFile).split(path.sep).join('/'),
+    install_report_sha256: crypto.createHash('sha256').update(installReportBytes).digest('hex'),
+    install_report: {
+        schema: String(installReport?.schema || ''),
+        checks: installChecks,
+        failed_checks: Array.isArray(installReport?.failed_checks) ? installReport.failed_checks.map(String) : [],
+        resources_sha256: String(installReport?.resources_sha256 || ''),
+        source_sha256: String(installReport?.source_sha256 || ''),
+        build_stamp_schema: String(buildStamp?.schema || ''),
+        build_stamp_package_version: String(buildStamp?.package_version || ''),
+        build_stamp_resources_sha256: String(buildStamp?.resources_sha256 || ''),
+        build_stamp_source_sha256: String(buildStamp?.source_sha256 || '')
+    },
+    checks,
+    generated_at: new Date().toISOString(),
+    blockers
+};
+const file = writeMacosMenubarProof(root, proof);
+console.log(JSON.stringify({ ...proof, proof_path: path.relative(root, file).split(path.sep).join('/') }, null, 2));
+if (!proof.ok)
+    process.exitCode = 1;
+function run(command, args) {
+    return spawnSync(command, args, { cwd: root, encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
+}
+function firstExisting(candidates) {
+    return candidates.find((candidate) => fs.existsSync(candidate)) || '';
+}
+function booleanRecord(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return {};
+    return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, item === true]));
+}
+function hashFiles(directory, names) {
+    if (!directory || !fs.existsSync(directory))
+        return {};
+    const output = {};
+    for (const name of names) {
+        const file = path.join(directory, name);
+        if (!fs.existsSync(file) || !fs.statSync(file).isFile())
+            continue;
+        output[name] = crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+    }
+    return output;
+}
+function aggregateFileHashes(hashes) {
+    const value = Object.entries(hashes).sort(([left], [right]) => left.localeCompare(right)).map(([name, digest]) => `${name}:${digest}`).join('\n');
+    return crypto.createHash('sha256').update(value).digest('hex');
+}
+function recordsEqual(left, right) {
+    if (!right || typeof right !== 'object' || Array.isArray(right))
+        return false;
+    return JSON.stringify(Object.entries(left).sort()) === JSON.stringify(Object.entries(right).sort());
+}
+function gitHead() {
+    return String(run('git', ['rev-parse', 'HEAD']).stdout || '').trim();
+}
+function required(name) {
+    const index = process.argv.indexOf(name);
+    const value = index >= 0 ? String(process.argv[index + 1] || '').trim() : '';
+    if (!value) {
+        console.error(`Release macOS proof failed: ${name} is required`);
+        process.exit(2);
+    }
+    return value;
+}

package/dist/scripts/release-main-push-guard.js

@@ -0,0 +1,37 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { inspectMainPushGuard, RELEASE_630_MISSION_ID } from '../core/release/main-push-guard.js';
+import { releaseProofDir, writeReleaseJson } from '../core/release/release-pack-receipt.js';
+import { RELEASE_ORIGIN_IDENTITY } from '../core/release/release-origin.js';
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const expectedVersion = required('--expected-version');
+const expectedOriginMain = required('--expected-origin-main');
+const report = inspectMainPushGuard({
+    root,
+    expectedVersion,
+    expectedOriginMain,
+    expectedOriginIdentity: RELEASE_ORIGIN_IDENTITY,
+    requireReleaseStamp: process.argv.includes('--require-release-stamp'),
+    requirePackProof: process.argv.includes('--require-pack-proof'),
+    requireMacosProof: process.argv.includes('--require-macos-proof'),
+    requireCleanTree: process.argv.includes('--require-clean-tree'),
+    expectedReleaseMissionId: value('--release-mission') || RELEASE_630_MISSION_ID
+});
+const output = path.join(releaseProofDir(root, expectedVersion), 'main-push-guard.json');
+writeReleaseJson(output, report);
+console.log(JSON.stringify({ ...report, report_path: path.relative(root, output).split(path.sep).join('/') }, null, 2));
+if (!report.ok)
+    process.exitCode = 1;
+function required(name) {
+    const result = value(name);
+    if (!result) {
+        console.error(`Release main push guard failed: ${name} is required`);
+        process.exit(2);
+    }
+    return result;
+}
+function value(name) {
+    const index = process.argv.indexOf(name);
+    return index >= 0 ? String(process.argv[index + 1] || '').trim() : '';
+}

package/dist/scripts/release-main-push-receipt.js

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { inspectMainPushReceipt } from '../core/release/main-push-receipt.js';
+import { RELEASE_630_MISSION_ID } from '../core/release/main-push-guard.js';
+import { releaseProofDir, writeReleaseJson } from '../core/release/release-pack-receipt.js';
+import { RELEASE_ORIGIN_IDENTITY } from '../core/release/release-origin.js';
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const version = required('--version');
+const baseline = required('--baseline');
+const method = required('--method');
+const expectedReleaseMissionId = value('--release-mission') || RELEASE_630_MISSION_ID;
+const expectedWorkOrderSha256 = value('--work-order-sha256');
+if (method !== 'fast-forward' && method !== 'protected-pr-merge') {
+    console.error('Release main push receipt failed: --method must be fast-forward or protected-pr-merge');
+    process.exit(2);
+}
+const receipt = inspectMainPushReceipt({
+    root,
+    version,
+    baseline,
+    method,
+    expectedOriginIdentity: RELEASE_ORIGIN_IDENTITY,
+    expectedReleaseMissionId,
+    ...(expectedWorkOrderSha256 ? { expectedWorkOrderSha256 } : {})
+});
+const output = path.join(releaseProofDir(root, version), 'main-push-receipt.json');
+writeReleaseJson(output, receipt);
+console.log(JSON.stringify({ ...receipt, receipt_path: path.relative(root, output).split(path.sep).join('/') }, null, 2));
+if (!receipt.ok)
+    process.exitCode = 1;
+function required(name) {
+    const result = value(name);
+    if (!result) {
+        console.error(`Release main push receipt failed: ${name} is required`);
+        process.exit(2);
+    }
+    return result;
+}
+function value(name) {
+    const index = process.argv.indexOf(name);
+    return index >= 0 ? String(process.argv[index + 1] || '').trim() : '';
+}

package/dist/scripts/release-metadata-1-19-check.js

@@ -0,0 +1,255 @@
+#!/usr/bin/env node
+// @ts-nocheck
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, emitGate, root } from './sks-1-11-gate-lib.js';
+const pkg = readJson('package.json');
+const lock = readJson('package-lock.json');
+const releaseManifest = readJson('release-gates.v2.json');
+const harnessManifest = readJson('infra-harness-gates.json');
+const RELEASE_VERSION = String(pkg.version || '');
+const distManifest = readJsonIfExists('dist/build-manifest.json');
+const releaseGates = Array.isArray(releaseManifest?.gates)
+    ? releaseManifest.gates.filter((gate) => Array.isArray(gate.preset) && gate.preset.includes('release'))
+    : [];
+const harnessGates = Array.isArray(harnessManifest?.gates)
+    ? harnessManifest.gates.filter((gate) => Array.isArray(gate.preset) && gate.preset.includes('harness'))
+    : [];
+const releaseGateIds = new Set(releaseGates.map((gate) => gate.id));
+const harnessGateIds = new Set(harnessGates.map((gate) => gate.id));
+const allManifestGates = [...releaseGates, ...harnessGates];
+const requiredDocs = [
+    'README.md',
+    'CHANGELOG.md',
+    'docs/release-readiness.md',
+    'docs/release-proof-truth.md',
+    'docs/naruto.md',
+    'docs/zellij-ui.md',
+    'docs/AGENT-BRIDGE.md',
+    'docs/runtime-truth-matrix.md',
+    'docs/feature-fixtures.md',
+    'docs/orchestration-layers.md'
+];
+const versionedDocs = new Set([
+    'README.md',
+    'CHANGELOG.md',
+    'docs/release-readiness.md',
+    'docs/release-proof-truth.md'
+]);
+const requiredPackageScripts = [
+    'build',
+    'build:incremental',
+    'release:ensure-build',
+    'typecheck',
+    'release:check',
+    'release:metadata',
+    'release:check:affected',
+    'release:check:fast',
+    'release:check:confidence',
+    'release:check:full',
+    'prepublishOnly',
+    'release:file-ownership',
+    'release:macos-menubar-proof',
+    'release:main-push-guard',
+    'release:main-push-receipt',
+    'release:pack-receipt',
+    'runtime:installed-smoke',
+    'gates:run',
+    'policy:gate-audit',
+    'naruto:e2e-hermetic',
+    'naruto:e2e-hermetic-write'
+];
+const requiredReleaseGates = [
+    'commands:current-surface-only',
+    'naruto:canonical-stop-gate',
+    'test:official-subagent-policy',
+    'codex:app-handoff-comprehensive',
+    'qa-loop:comprehensive-verification',
+    'loop-integration-finalizer-check',
+    'codex-control:event-stream-ledger',
+    'runtime:proof-summary',
+    'runtime:installed-smoke',
+    'release:metadata-current',
+    'docs:truthfulness',
+    'publish:packlist-performance',
+    'publish:runtime-script-closure',
+    'package:published-contract',
+    'release:dag-runner',
+    'release:gate-budget',
+    'release:gate-selection-comprehensive',
+    'policy:gate-audit',
+    'typecheck'
+];
+const requiredHarnessGates = [
+    'zellij:layout-valid',
+    'zellij:compact-slot-renderer',
+    'zellij:slot-telemetry',
+    'zellij:slot-pane-telemetry-renderer',
+    'zellij:first-slot-down-stack',
+    'zellij:right-column-geometry-proof'
+];
+assertGate(/^\d+\.\d+\.\d+$/.test(RELEASE_VERSION), 'package.json version must be a stable semver', { version: pkg.version });
+assertGate(lock.version === RELEASE_VERSION, `package-lock version must be ${RELEASE_VERSION}`, { version: lock.version });
+assertGate(lock.packages?.['']?.version === RELEASE_VERSION, `package-lock root version must be ${RELEASE_VERSION}`, { version: lock.packages?.['']?.version });
+assertVersionSurface('src/core/version.ts', `PACKAGE_VERSION = '${RELEASE_VERSION}'`);
+assertVersionSurface('src/core/fsx.ts', "PACKAGE_VERSION } from './version.js'");
+assertVersionSurface('src/bin/sks.ts', "PACKAGE_VERSION } from '../core/version.js'");
+assertVersionSurface('crates/sks-core/Cargo.toml', `version = "${RELEASE_VERSION}"`);
+assertVersionSurface('crates/sks-core/Cargo.lock', `version = "${RELEASE_VERSION}"`);
+assertVersionSurface('crates/sks-core/src/main.rs', 'sks-rs {}", env!("CARGO_PKG_VERSION")');
+assertGate(distManifest?.version === RELEASE_VERSION, `dist/build-manifest version must be ${RELEASE_VERSION}`, { version: distManifest?.version || null });
+assertGate(distManifest?.package_version === RELEASE_VERSION, `dist/build-manifest package_version must be ${RELEASE_VERSION}`, { package_version: distManifest?.package_version || null });
+assertGate(typeof distManifest?.source_digest === 'string' && distManifest.source_digest.length >= 32, 'dist/build-manifest must include source_digest', { source_digest: distManifest?.source_digest || null });
+assertGate(pkg.scripts?.['release:metadata']?.includes('dist/scripts/release-metadata-check.js'), 'release:metadata must point to the generic release metadata check');
+const releaseCheckScript = String(pkg.scripts?.['release:check'] || '');
+assertGate(releaseCheckScript.startsWith('npm run release:check:parallel')
+    || releaseCheckScript.includes('release-gate-dag-runner.js --preset release')
+    || releaseCheckScript.includes('release:check:affected'), 'release:check must use the current release DAG');
+assertGate(releaseManifest?.schema === 'sks.release-gates.v2', 'release gate manifest schema mismatch', { schema: releaseManifest?.schema || null });
+assertGate(harnessManifest?.schema === 'sks.infra-harness-gates.v1', 'infra harness manifest schema mismatch', { schema: harnessManifest?.schema || null });
+assertGate(releaseGates.length > 0 && releaseGates.length <= 200, 'release manifest must include 1..200 release gates', { release_gates: releaseGates.length });
+assertGate(harnessGates.length > 0, 'infra harness manifest must include harness gates', { harness_gates: harnessGates.length });
+assertGate(Object.keys(pkg.scripts || {}).length <= 100, 'package script budget exceeded', { script_count: Object.keys(pkg.scripts || {}).length, limit: 100 });
+for (const script of requiredPackageScripts)
+    assertGate(Boolean(pkg.scripts?.[script]), `missing package script: ${script}`);
+const fullReleaseScript = String(pkg.scripts?.['release:check:full'] || '');
+assertGate((fullReleaseScript.match(/build:clean/g) || []).length === 1, 'release:check:full must perform exactly one clean build', { script: fullReleaseScript });
+assertGate((fullReleaseScript.match(/npm test --silent/g) || []).length === 1, 'release:check:full must run the canonical test suite exactly once', { script: fullReleaseScript });
+for (const id of requiredReleaseGates)
+    assertGate(releaseGateIds.has(id), `critical release gate missing: ${id}`, { id });
+for (const id of requiredHarnessGates)
+    assertGate(harnessGateIds.has(id), `critical harness gate missing: ${id}`, { id });
+const duplicateAcrossManifests = [...releaseGateIds].filter((id) => harnessGateIds.has(id));
+assertGate(duplicateAcrossManifests.length === 0, 'gate appears in both release and harness manifests', { duplicate_count: duplicateAcrossManifests.length });
+assertGate([...releaseGateIds].every((id) => !id.startsWith('zellij:')), 'Zellij gates must remain in the harness preset');
+assertGate([...harnessGateIds].every((id) => id.startsWith('zellij:')), 'harness manifest must contain only Zellij gates');
+assertGate(allManifestGates.every((gate) => !/\bnpm\s+run\b/.test(String(gate.command))), 'gate manifest commands must not use npm run indirection');
+const retiredPublicSurfaceGateCount = allManifestGates.filter((gate) => /(?:^|[^a-z0-9])(?:team|mad-db|tmux|xai|swarm|ralph)(?:[^a-z0-9]|$)/i.test(`${String(gate.id || '')}\n${String(gate.command || '')}`)).length;
+assertGate(retiredPublicSurfaceGateCount === 0, 'release and harness manifests must use only the current public surface', { violation_count: retiredPublicSurfaceGateCount });
+for (const gate of allManifestGates)
+    assertDistScriptTargetsExist(gate);
+assertGate(pkg.bin?.sks === 'dist/bin/sks.js', 'package runtime must use dist/bin/sks.js');
+assertGate(pkg.bin?.sneakoscope === 'dist/bin/sks.js', 'sneakoscope runtime must use dist/bin/sks.js');
+assertGate(!pkg.files?.includes('src'), 'package files must not include source runtime shadows');
+for (const removed of ['publish:dry', 'publish:verify-ignore-scripts', 'publish:prep-ignore-scripts', 'publish:ignore-scripts']) {
+    assertGate(!pkg.scripts?.[removed], `direct publish package script must be removed: ${removed}`);
+}
+assertGate(!/\bnpm\s+publish\b/.test(Object.values(pkg.scripts || {}).join('\n')), 'package scripts must not contain direct npm publish');
+const currentCommandManifest = text('src/cli/command-manifest-lite.ts');
+const currentDollarManifest = text('src/core/routes/dollar-manifest-lite.ts');
+for (const token of ["{ name: 'team',", "{ name: 'mad-db',", "{ name: 'tmux',", "{ name: 'xai',", "{ name: 'swarm',", "{ name: 'agent',", "{ name: 'ralph',"]) {
+    assertGate(!currentCommandManifest.includes(token), 'current command manifest contains a retired public command');
+}
+for (const token of ["command: '$Agent'", "command: '$Team'", "command: '$MAD-DB'", "command: '$Swarm'", "command: '$ShadowClone'", "command: '$Kagebunshin'", "command: '$Ralph'"]) {
+    assertGate(!currentDollarManifest.includes(token), 'current dollar manifest contains a retired route identity');
+}
+assertGate(currentDollarManifest.includes("{ command: '$Naruto'") && currentDollarManifest.includes("{ command: '$Work'"), 'current dollar manifest must expose the canonical workflow and intended alias');
+const stageWorkflow = text('.github/workflows/publish-npm.yml');
+const stageJob = stageWorkflow.match(/^  stage-publish:\n[\s\S]*$/m)?.[0] || '';
+const workflowPermissions = stageWorkflow.match(/^permissions:\n(?:  [^\n]+\n)+/m)?.[0] || '';
+const stageVerifierSource = text('src/core/release/npm-stage-tarball-verifier.ts');
+const stageVerifierSupport = text('src/core/release/npm-stage-tarball-verifier-support.ts');
+const stageVerifierCli = text('src/scripts/npm-stage-tarball-verifier.ts');
+const releaseReadinessDoc = text('docs/release-readiness.md');
+for (const job of ['linux-release-proof', 'macos-menubar-proof', 'pack-and-compare', 'stage-publish']) {
+    assertGate(new RegExp(`^  ${job}:`, 'm').test(stageWorkflow), `stage workflow missing job: ${job}`);
+}
+assertGate(/npm install --global npm@\$\{NPM_STAGE_CLI_VERSION\}/.test(stageWorkflow), 'stage workflow must install the exact pinned npm CLI');
+assertGate(/NPM_STAGE_CLI_VERSION: 11\.15\.0/.test(stageWorkflow), 'stage workflow must pin npm 11.15.0');
+assertGate(/npm stage publish "\$TARBALL"/.test(stageWorkflow), 'stage workflow must stage the exact tarball path');
+assertGate((stageWorkflow.match(/npm stage publish "\$TARBALL"/g) || []).length === 1, 'stage workflow must contain exactly one registry mutation');
+assertGate(!/\bnpm\s+publish\b/.test(stageWorkflow), 'stage workflow must not call direct npm publish');
+assertGate(!/npm\s+stage\s+(?:list|view|download|approve|reject)\b/.test(stageWorkflow), 'OIDC stage job must not use maintainer-only stage subcommands');
+assertGate(/environment: npm-production/.test(stageWorkflow), 'stage workflow must use the npm-production environment');
+assertGate(!/id-token:/.test(workflowPermissions), 'workflow-global permissions must not grant OIDC identity');
+assertGate((stageWorkflow.match(/id-token: write/g) || []).length === 1 && /permissions:\n      contents: read\n      id-token: write/.test(stageJob), 'OIDC identity must be scoped only to stage-publish');
+for (const artifact of ['linux-release-proof', 'macos-menubar-proof', 'stage-input', 'npm-stage-receipt']) {
+    assertGate(new RegExp(`name: ${artifact}-\\$\\{\\{ github\\.sha \\}\\}`).test(stageWorkflow), `stage workflow artifact name mismatch: ${artifact}`);
+}
+for (const receiptField of ['tarball_sha256', 'tarball_sha512', 'tarball_integrity', 'packed_bytes', 'unpacked_bytes', 'file_count', 'workflow_run_id', 'local_pack_receipt_sha256', 'stage_command_digest', 'stage_output_digest', 'stage_id', 'review_verifier_schema', 'human_2fa_pending']) {
+    assertGate(new RegExp(`${receiptField}:`).test(stageJob), `stage receipt missing field: ${receiptField}`);
+}
+assertGate(/stage_id_uuid_invalid/.test(stageJob), 'stage workflow must fail closed on non-UUID stage IDs');
+assertGate(/sha512Integrity !== receipt\.sha512_integrity/.test(stageJob), 'stage workflow must recompute and verify tarball SHA-512 integrity');
+assertGate(/tarball_integrity: sha512Integrity/.test(stageJob), 'stage receipt must serialize recomputed tarball integrity');
+assertGate(/stage-receipt\/stage-output\.json/.test(stageJob) && /path: stage-receipt/.test(stageJob), 'stage receipt artifact must preserve digest-bound raw stage output');
+assertGate(/review_verifier_schema: 'sks\.npm-stage-review-receipt\.v1'/.test(stageJob), 'stage receipt must declare the maintainer verifier schema');
+assertGate(/localPackReceiptSha256 = crypto\.createHash\('sha256'\)\.update\(localPackReceiptBytes\)/.test(stageJob), 'stage receipt must bind immutable local pack receipt bytes');
+assertGate(!/approve_command/.test(stageWorkflow), 'stage workflow must not serialize an approval command');
+assertGate(!/\bnpm[ \t]+(?:ci|pack|run|publish|login|logout|whoami)\b/.test(stageJob), 'stage job must not install dependencies, repack, run lifecycle scripts, or use session credentials');
+assertGate(!/NODE_AUTH_TOKEN|NPM_TOKEN|_authToken/.test(stageWorkflow), 'stage workflow must not inject npm tokens');
+assertGate(/REQUIRED_NPM_STAGE_CLI_VERSION = '11\.15\.0'/.test(stageVerifierSupport), 'maintainer stage verifier must require exact npm 11.15.0');
+assertGate(/\['stage', 'view', stageId, '--json'/.test(stageVerifierSource), 'maintainer stage verifier must inspect the exact stage ID read-only');
+assertGate(/\['stage', 'download', stageId, '--json'/.test(stageVerifierSource), 'maintainer stage verifier must download the exact stage ID read-only');
+assertGate(/exact_bytes_match/.test(stageVerifierSource) && /sha256_match/.test(stageVerifierSource) && /sha512_match/.test(stageVerifierSource) && /integrity_match/.test(stageVerifierSource), 'maintainer stage verifier must compare bytes and digests');
+assertGate(/oidc_environment_not_allowed/.test(stageVerifierSupport), 'maintainer stage verifier must reject OIDC and GitHub Actions environments');
+assertGate(!/\['stage',\s*'(?:publish|approve|reject)'/.test(`${stageVerifierSource}\n${stageVerifierSupport}\n${stageVerifierCli}`), 'maintainer stage verifier must not contain mutating stage argv');
+assertGate(/npm-stage-tarball-verifier\.js/.test(releaseReadinessDoc) && /--local-receipt/.test(releaseReadinessDoc) && /--local-tarball/.test(releaseReadinessDoc) && /--stage-receipt/.test(releaseReadinessDoc), 'release readiness must document the maintainer-local read-only verifier inputs');
+assertGate(pkg.scripts?.prepublishOnly === 'node ./dist/scripts/prepublish-release-check-or-fast.js', 'prepublishOnly must verify release proof during official npm publish');
+assertGate(pkg.scripts?.prepack === 'node ./dist/scripts/prepublish-release-check-or-fast.js --prepack-build', 'prepack must rebuild and reverify official npm publish output');
+for (const file of requiredDocs) {
+    const absolute = path.join(root, file);
+    assertGate(fs.existsSync(absolute), `missing release doc: ${file}`);
+    if (versionedDocs.has(file)) {
+        assertGate(fs.readFileSync(absolute, 'utf8').includes(RELEASE_VERSION), `release doc does not mention ${RELEASE_VERSION}: ${file}`);
+    }
+}
+const retiredPublicDocReferenceCount = requiredDocs
+    .filter((file) => file !== 'CHANGELOG.md')
+    .reduce((count, file) => {
+    const source = text(file);
+    const commandHit = /\bsks\s+(?:agent(?=\s|$)|--agent(?=\s|$)|team(?=\s|$)|mad-db(?=\s|$)|tmux(?=\s|$)|xai(?=\s|$)|swarm(?=\s|$)|ralph(?=\s|$))/i.test(source);
+    const routeHit = /\$(?:Team|MAD-DB|Swarm|ShadowClone|Kagebunshin|Ralph)\b/.test(source);
+    return count + Number(commandHit || routeHit);
+}, 0);
+assertGate(retiredPublicDocReferenceCount === 0, 'current release documentation must not republish retired command or route identities', { violation_count: retiredPublicDocReferenceCount });
+const report = {
+    schema: 'sks.version-metadata-current.v1',
+    version: RELEASE_VERSION,
+    package_version: pkg.version,
+    current_public_surface: true,
+    official_subagent_workflow: true,
+    version_surface_count: 9,
+    package_script_count: requiredPackageScripts.length,
+    release_gate_count: releaseGates.length,
+    harness_gate_count: harnessGates.length,
+    required_doc_count: requiredDocs.length,
+    dist_source_digest: distManifest?.source_digest || null,
+    generated_at: new Date().toISOString(),
+    ok: true
+};
+const out = path.join(root, '.sneakoscope', 'reports', `version-metadata-${RELEASE_VERSION}.json`);
+fs.mkdirSync(path.dirname(out), { recursive: true });
+fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+emitGate('release:metadata', {
+    version: pkg.version,
+    package_scripts: requiredPackageScripts.length,
+    release_gates: releaseGates.length,
+    harness_gates: harnessGates.length,
+    docs: requiredDocs.length,
+    current_public_surface: true
+});
+function text(relFile) {
+    return fs.readFileSync(path.join(root, relFile), 'utf8');
+}
+function readJson(relFile) {
+    return JSON.parse(text(relFile));
+}
+function readJsonIfExists(relFile) {
+    const absolute = path.join(root, relFile);
+    return fs.existsSync(absolute) ? JSON.parse(fs.readFileSync(absolute, 'utf8')) : null;
+}
+function assertVersionSurface(relFile, needle) {
+    const absolute = path.join(root, relFile);
+    assertGate(fs.existsSync(absolute), `missing version surface: ${relFile}`);
+    const source = fs.readFileSync(absolute, 'utf8');
+    assertGate(source.includes(needle), `${relFile} must contain ${needle}`, { file: relFile, needle });
+}
+function assertDistScriptTargetsExist(gate) {
+    for (const match of String(gate.command || '').matchAll(/node\s+(\.\/dist\/scripts\/[^ &|;]+\.js)/g)) {
+        assertGate(fs.existsSync(path.join(root, match[1])), `gate command target missing: ${gate.id}`, {
+            id: gate.id,
+            target: match[1]
+        });
+    }
+}

package/dist/scripts/release-metadata-check.js

@@ -4,4 +4,3 @@
 // historical 1-19 gate file until that larger release surface is split.
 await import('./release-metadata-1-19-check.js');
 export {};
-//# sourceMappingURL=release-metadata-check.js.map