sneakoscope 7.0.2 → 7.0.3

package/dist/scripts/codex-0138-doctor-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/codex-0138-feature-probes-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
 process.env.SKS_CODEX_0138_FAKE = '1';
 process.env.SKS_CODEX_VERSION_FAKE = 'codex-cli 0.138.0';

package/dist/scripts/codex-0144-core-real-probes-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { emitGate, importDist, root } from './sks-1-18-gate-lib.js';
 const args = process.argv.slice(2);
 const requireReal = args.includes('--require-real');

package/dist/scripts/codex-app-handoff-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/codex-app-handoff-launch-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/codex-config-load-probe.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
@@ -165,9 +164,6 @@ function classifyText(textInput, opts = {}) {
         operation_not_permitted: /Operation not permitted|os error 1|EPERM/i.test(text),
         permission_denied: /Permission denied|EACCES/i.test(text),
         toml_parse: /TOML parse|toml.*parse|parse.*toml|invalid.*toml|duplicate key/i.test(text),
-        // serde/toml deserialize failures from a structurally-broken config, e.g.
-        // `invalid type: sequence, expected a string` when `notify` was absorbed into
-        // an env table. These carry no literal "toml" token so the patterns above miss them.
         toml_type_error: /invalid type:|invalid value:|expected (a |an )?(string|sequence|array|table|map|integer|boolean|float)|missing field|unknown field|unknown variant/i.test(text),
         untrusted_project: /untrusted project/i.test(text),
         ignored_project_local_config_key: /ignored project-local config key|ignored.*project.*config/i.test(text)
@@ -178,7 +174,6 @@ function classifyText(textInput, opts = {}) {
         blockers.push('codex_cli_config_eperm');
     else if (flags.permission_denied)
         blockers.push('codex_cli_config_permission_denied');
-    // A config-load failure that is not a permission problem is a parse/structure error.
     const tomlLoadFailure = flags.toml_parse
         || (!opts.configLoaded && flags.toml_type_error)
         || (!opts.configLoaded && flags.error_loading_config_toml && !flags.operation_not_permitted && !flags.permission_denied);

package/dist/scripts/codex-control-all-pipelines-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, readText, releaseGateIds, runFakeCodexSdkTaskFixture } from './lib/codex-sdk-gate-lib.js';
 const releaseGates = releaseGateIds();
 const required = [

package/dist/scripts/codex-control-event-stream-ledger-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, runFakeCodexSdkTaskFixture } from './lib/codex-sdk-gate-lib.js';
 const fixture = await runFakeCodexSdkTaskFixture('control-event-stream');
 assertGate(fixture.events.length >= 1, 'Control Plane event ledger must contain translated events', fixture.events);

package/dist/scripts/codex-control-tool-output-continuity-audit-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
 const mod = await importDist('core/codex-control/codex-reliability-shield.js');
 const audit = mod.auditToolOutputContinuity([

package/dist/scripts/codex-permission-profiles-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { pathToFileURL } from 'node:url';

package/dist/scripts/codex-plugin-app-template-policy-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
 process.env.SKS_CODEX_0138_FAKE = '1';
 process.env.SKS_CODEX_PLUGIN_JSON_FAKE = '1';

package/dist/scripts/codex-project-config-policy-splitter-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/codex-sdk-all-pipelines-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, readText, releaseGateIds, runFakeCodexSdkTaskFixture } from './lib/codex-sdk-gate-lib.js';
 const releaseGates = releaseGateIds();
 const required = [

package/dist/scripts/codex-sdk-backend-router-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/codex-sdk-capability-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
 const mod = await importDist('core/codex-control/codex-sdk-capability.js');
 const capability = await mod.detectCodexSdkCapability();

package/dist/scripts/codex-sdk-event-stream-ledger-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, runFakeCodexSdkTaskFixture } from './lib/codex-sdk-gate-lib.js';
 const fixture = await runFakeCodexSdkTaskFixture('event-stream');
 assertGate(fixture.events.length >= 1, 'SDK event ledger must contain events', fixture.events);

package/dist/scripts/codex-sdk-real-smoke-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, importDist, runFakeCodexSdkTaskFixture } from './lib/codex-sdk-gate-lib.js';
 import fsp from 'node:fs/promises';
 import path from 'node:path';

package/dist/scripts/concurrent-session-collision-check.js

@@ -3,8 +3,17 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { evaluateHookPayload } from '../core/hooks-runtime.js';
+import { installGlobalSkills } from '../core/init/skills.js';
 import { loadStateForSession, listSessionStates, stateFile } from '../core/mission.js';
 const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-concurrent-session-'));
+const fixtureHome = path.join(root, '.fixture-home');
+process.env.HOME = fixtureHome;
+process.env.CODEX_HOME = path.join(fixtureHome, '.codex');
+process.env.SKS_GLOBAL_ROOT = path.join(fixtureHome, '.sneakoscope-global');
+await fs.mkdir(fixtureHome, { recursive: true });
+const skillInstall = await installGlobalSkills(fixtureHome);
+if (!skillInstall.ok)
+    throw new Error('concurrent_session_skill_install_failed');
 await fs.mkdir(path.join(root, '.sneakoscope', 'state'), { recursive: true });
 const aPrompt = await evaluateHookPayload('user-prompt-submit', {
     cwd: root,

package/dist/scripts/context7-evidence-dedupe-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/core-skill-card-schema-check.js

@@ -1,9 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
-// GATE: core-skill:card-schema
-// Proves the Core Skill Card is read-only external state, that the checked-in
-// schema matches the runtime contract, and that an optimizer candidate can never
-// overwrite a deployed snapshot in place.
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -20,7 +15,6 @@ const promotionContract = createRequestedScopeContract({
     projectRoot: tempRoot,
     overrides: { skill_snapshot_promotion: true }
 });
-// 1) A fresh candidate is structurally valid and read-only.
 const candidate = cardMod.createCandidateCard({ skillId: 'demo-skill', route: 'DFix', baseVersion: 0, body: BODY });
 const shape = cardMod.validateCardShape(candidate);
 assertGate(shape.ok, 'candidate card must pass validateCardShape', shape);
@@ -28,10 +22,8 @@ assertGate(candidate.status === 'candidate', 'fresh card status must be candidat
 assertGate(candidate.deployment_snapshot === false, 'candidate must not be a deployment snapshot', candidate);
 assertGate(candidate.side_effect_scope.read_only === true, 'candidate card must be read_only', candidate.side_effect_scope);
 assertGate(candidate.side_effect_scope.allowed_mutations.length === 0, 'candidate card must grant zero mutations', candidate.side_effect_scope);
-// 2) The checked-in schema parses and its const matches the runtime schema id.
 const cardSchema = readJson('schemas/skills/core-skill-card.schema.json');
 assertGate(cardSchema.properties?.schema?.const === typesMod.CORE_SKILL_CARD_SCHEMA, 'card schema const must match CORE_SKILL_CARD_SCHEMA', { const: cardSchema.properties?.schema?.const, expected: typesMod.CORE_SKILL_CARD_SCHEMA });
-// 3) Negative invariants.
 const notReadOnly = { ...candidate, side_effect_scope: { allowed_mutations: [], read_only: false } };
 const notReadOnlyShape = cardMod.validateCardShape(notReadOnly);
 assertGate(notReadOnlyShape.ok === false && notReadOnlyShape.blockers.includes('card_not_read_only'), 'read_only=false card must be blocked by card_not_read_only', notReadOnlyShape);
@@ -41,14 +33,11 @@ assertGate(grantsShape.ok === false && grantsShape.blockers.includes('card_grant
 const badDeployed = { ...candidate, status: 'deployed', deployment_snapshot: false };
 const badDeployedShape = cardMod.validateCardShape(badDeployed);
 assertGate(badDeployedShape.ok === false && badDeployedShape.blockers.includes('deployed_card_not_snapshot'), 'deployed card without snapshot flag must be blocked', badDeployedShape);
-// 4) A deployed snapshot cannot be overwritten by an optimizer candidate.
-//    The deployed snapshot lives in deployed.json; a candidate is a SEPARATE file.
 const accepted = { ...candidate, status: 'accepted' };
 const promotion = await deployMod.promoteToDeployedWithLedger(tempRoot, accepted, { contract: promotionContract, context: 'release' });
 assertGate(promotion.ok === true, 'ledger promotion must succeed for an accepted card', promotion);
 const deployedBefore = await cardMod.loadDeployedSnapshot(tempRoot, 'DFix', 'demo-skill');
 assertGate(deployedBefore && deployedBefore.status === 'deployed' && deployedBefore.deployment_snapshot === true, 'loadDeployedSnapshot must return a deployed snapshot', deployedBefore);
-// Saving a candidate with the same skill_id must NOT touch deployed.json.
 const sneakyCandidate = cardMod.createCandidateCard({ skillId: 'demo-skill', route: 'DFix', baseVersion: 9, body: '## Goal\nOverwrite me.\n' });
 await cardMod.saveCard(tempRoot, sneakyCandidate);
 const deployedAfter = await cardMod.loadDeployedSnapshot(tempRoot, 'DFix', 'demo-skill');

package/dist/scripts/core-skill-deployment-snapshot-check.js

@@ -1,9 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
-// GATE: core-skill:deployment-snapshot
-// Proves deployed snapshots are immutable (a changed body needs a higher version),
-// the previous snapshot is archived for rollback, rollback restores it, and only an
-// accepted card may be promoted.
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -22,17 +17,14 @@ const promotionContract = createRequestedScopeContract({
     projectRoot: tempRoot,
     overrides: { skill_snapshot_promotion: true }
 });
-// 1) Promote an accepted card to a deployed snapshot.
 const acceptedV1 = { ...cardMod.createCandidateCard({ skillId: SKILL, route: ROUTE, baseVersion: 0, body: BODY_V1 }), status: 'accepted' };
 const promoteV1 = await deployMod.promoteToDeployedWithLedger(tempRoot, acceptedV1, { contract: promotionContract, context: 'release' });
 assertGate(promoteV1.ok === true, 'promoting an accepted card must succeed', promoteV1);
 assertGate(promoteV1.snapshot && promoteV1.snapshot.status === 'deployed' && promoteV1.snapshot.deployment_snapshot === true, 'snapshot must be deployed + flagged', promoteV1.snapshot);
-// 2) Immutability: a changed body at version <= existing must be rejected.
 const changedSameVersion = { ...cardMod.createCandidateCard({ skillId: SKILL, route: ROUTE, baseVersion: 0, body: BODY_V2 }), status: 'accepted' };
 assertGate(changedSameVersion.version === acceptedV1.version, 'changed-body card must share the existing version for this check', { changed: changedSameVersion.version, existing: acceptedV1.version });
 const promoteSame = await deployMod.promoteToDeployedWithLedger(tempRoot, changedSameVersion, { contract: promotionContract, context: 'release' });
 assertGate(promoteSame.ok === false && promoteSame.blockers.includes('snapshot_changed_without_version_increment'), 'changed body without version bump must be rejected', promoteSame);
-// 3) A changed body at a HIGHER version succeeds, archives the previous snapshot.
 const acceptedV2 = { ...cardMod.createCandidateCard({ skillId: SKILL, route: ROUTE, baseVersion: 1, body: BODY_V2 }), status: 'accepted' };
 assertGate(acceptedV2.version > acceptedV1.version, 'v2 must have a higher version than v1', { v2: acceptedV2.version, v1: acceptedV1.version });
 const promoteV2 = await deployMod.promoteToDeployedWithLedger(tempRoot, acceptedV2, { contract: promotionContract, context: 'release' });
@@ -40,10 +32,8 @@ assertGate(promoteV2.ok === true, 'higher-version changed snapshot must promote'
 assertGate(typeof promoteV2.archived_path === 'string' && promoteV2.archived_path.length > 0, 'previous snapshot must be archived', promoteV2);
 const hasRollback = await deployMod.hasRollbackSnapshot(tempRoot, ROUTE, SKILL);
 assertGate(hasRollback === true, 'a rollback snapshot must exist after a version bump', { hasRollback });
-// 4) Rollback restores the previous (v1) snapshot.
 const rolled = await deployMod.rollbackDeployment(tempRoot, ROUTE, SKILL);
 assertGate(rolled.ok === true && rolled.restored_version === acceptedV1.version, 'rollback must restore the previous version', rolled);
-// 5) Promotion requires accepted status.
 const candidate = cardMod.createCandidateCard({ skillId: 'other-skill', route: ROUTE, baseVersion: 0, body: BODY_V1 });
 const promoteCandidate = await deployMod.promoteToDeployedWithLedger(tempRoot, candidate, { contract: promotionContract, context: 'release' });
 assertGate(promoteCandidate.ok === false && promoteCandidate.blockers.includes('promote_requires_accepted_status'), 'a candidate card must not be promotable', promoteCandidate);

package/dist/scripts/core-skill-heldout-validation-check.js

@@ -1,9 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
-// GATE: core-skill:heldout-validation
-// Proves strict held-out acceptance: a candidate is accepted ONLY on strict
-// held-out improvement with no safety regression, train-only gains are rejected,
-// and rejected patches are buffered so the same failed edit is not retried.
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -22,20 +17,14 @@ const baseInput = {
     latencyBaselineMs: 1000,
     latencyCandidateMs: 1100
 };
-// 1) Accept on strict improvement with no regression.
 const acceptRes = validationMod.validateHeldout(baseInput);
 assertGate(acceptRes.accept === true && acceptRes.reason === 'strict_improvement', 'strict improvement must be accepted', acceptRes);
-// 2) Held-out not improved -> reject.
 const notImproved = validationMod.validateHeldout({ ...baseInput, candidateHeldout: 0.74 });
 assertGate(notImproved.accept === false && notImproved.reason === 'heldout_not_improved', 'non-improving held-out must be rejected', notImproved);
-// 3) Train-improves-but-held-out-worse maps to heldout_not_improved.
-//    (Held-out is the only acceptance signal; a worse held-out is rejected regardless of train gains.)
 const trainGainHeldoutWorse = validationMod.validateHeldout({ ...baseInput, candidateHeldout: 0.70 });
 assertGate(trainGainHeldoutWorse.accept === false && trainGainHeldoutWorse.reason === 'heldout_not_improved', 'train-gain/held-out-worse must reject as heldout_not_improved', trainGainHeldoutWorse);
-// 4) Side-effect violation with improved held-out -> reject.
 const sideEffect = validationMod.validateHeldout({ ...baseInput, sideEffectZero: false });
 assertGate(sideEffect.accept === false && sideEffect.reason === 'side_effect_zero_failed', 'side-effect failure must reject as side_effect_zero_failed', sideEffect);
-// 5) Rejected-patch buffer dedupes by hash.
 const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-heldout-'));
 await bufferMod.recordRejectedPatch(tempRoot, { skill_id: 's', base_version: 3, patch_hash: 'abc', reason: 'heldout_not_improved', score_delta: -0.03 });
 const knownRejected = await bufferMod.isPatchRejected(tempRoot, 'abc');

package/dist/scripts/core-skill-no-inference-optimizer-check.js

@@ -1,10 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
-// GATE: core-skill:no-inference-optimizer
-// Proves the optimizer NEVER runs in deployment/inference context: deployed-snapshot
-// reads are allowed and carry route proof (skill id/version/hash), while any
-// optimizer/epoch call throws a SkillDeploymentViolationError. Out of context the
-// optimizer works normally.
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -18,11 +12,9 @@ const BODY = '## Goal\nDo the task.\n\n## Verification\nCheck output.\n\n## Roll
 const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-no-opt-'));
 const card = cardMod.createCandidateCard({ skillId: 'x', route: 'DFix', baseVersion: 0, body: BODY });
 const trace = traceMod.createRolloutTrace({ route: 'DFix', backend: 'fake', proof_artifacts: [], rollback_ready: false, requested_scope_compliant: true, latency_ms: 1000, failure_reason: null });
-// Enter deployment / inference context.
 deployMod.setDeploymentContext(true);
 process.env.SKS_SKILL_DEPLOYMENT_CONTEXT = '1';
 assertGate(deployMod.isDeploymentContext() === true, 'deployment context must be active', { active: deployMod.isDeploymentContext() });
-// 1) Deployment reads are allowed and never throw.
 let selection = null;
 let readThrew = false;
 try {
@@ -35,11 +27,9 @@ catch {
 assertGate(readThrew === false, 'deployment-path reads must not throw in deployment context', { readThrew });
 assertGate(selection !== null, 'selectRouteSkill must return a selection', { selection });
 assertGate(selection.source === 'fallback' || selection.source === 'deployed', 'selection source must be fallback or deployed', selection);
-// 2) Route proof record: no optimizer invocation, and skill id/version/hash keys present (Task 4.7).
 const proof = runtimeMod.skillProofRecord(selection);
 assertGate(proof.optimizer_invoked === false, 'route proof must show optimizer was not invoked', proof);
 assertGate('skill_id' in proof && 'version' in proof && 'hash' in proof, 'route proof must include skill_id/version/hash keys', proof);
-// 3) Optimizer calls are forbidden in deployment context.
 let proposeThrew = null;
 try {
     epochMod.proposeSkillPatch(card, [trace]);
@@ -56,7 +46,6 @@ catch (err) {
     epochThrew = err;
 }
 assertGate(epochThrew !== null && epochThrew.name === 'SkillDeploymentViolationError', 'runSkillEpoch must throw SkillDeploymentViolationError in deployment context', { name: epochThrew?.name });
-// 4) Reset: out of deployment context the optimizer works (does not throw).
 deployMod.setDeploymentContext(false);
 delete process.env.SKS_SKILL_DEPLOYMENT_CONTEXT;
 assertGate(deployMod.isDeploymentContext() === false, 'deployment context must be cleared', { active: deployMod.isDeploymentContext() });

package/dist/scripts/core-skill-patch-check.js

@@ -1,9 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
-// GATE: core-skill:patch
-// Proves a SkillPatch edits ONLY the single skill document within the textual
-// learning-rate budget, and rejects budget overruns, external/code targets, and
-// cross-skill (multi-doc) edits.
 import fs from 'node:fs';
 import path from 'node:path';
 import { assertGate, emitGate, importDist, root, readJson } from './sks-1-18-gate-lib.js';
@@ -12,10 +7,8 @@ const patchMod = await importDist('core/skills/core-skill-patch.js');
 const applyMod = await importDist('core/skills/core-skill-patch-apply.js');
 const typesMod = await importDist('core/skills/core-skill-types.js');
 const BODY = '## Goal\nDo the task.\n\n## Verification\nCheck output.\n\n## Rollback\nRevert on failure.\n';
-// Base card at version N (createCandidateCard from baseVersion 2 -> version 3).
 const baseCard = cardMod.createCandidateCard({ skillId: 'demo-skill', route: 'DFix', baseVersion: 2, body: BODY });
 const N = baseCard.version;
-// 1) Valid patch within budget: one small add to the verification section.
 const validPatch = {
     schema: typesMod.CORE_SKILL_PATCH_SCHEMA,
     skill_id: 'demo-skill',
@@ -29,7 +22,6 @@ const applied = applyMod.applyPatch(baseCard, validPatch);
 assertGate(applied.ok === true, 'valid patch must apply', applied);
 assertGate(applied.candidate && applied.candidate.body !== baseCard.body, 'applied patch must change the candidate body', { changed: applied.candidate?.body !== baseCard.body });
 assertGate(applied.before_hash !== applied.after_hash, 'applied patch must change the body hash', { before: applied.before_hash, after: applied.after_hash });
-// 2) Budget overrun: add text longer than max_added_chars.
 const overPatch = {
     schema: typesMod.CORE_SKILL_PATCH_SCHEMA,
     skill_id: 'demo-skill',
@@ -39,7 +31,6 @@ const overPatch = {
 };
 const overRes = patchMod.validatePatch(overPatch, baseCard);
 assertGate(overRes.ok === false && overRes.blockers.includes('budget_added_chars_exceeded'), 'over-budget add must be blocked by budget_added_chars_exceeded', overRes);
-// 3) Code/external target reject.
 const externalPatch = {
     schema: typesMod.CORE_SKILL_PATCH_SCHEMA,
     skill_id: 'demo-skill',
@@ -60,7 +51,6 @@ const filePatch = {
 const fileRes = patchMod.validatePatch(filePatch, baseCard);
 const fileBlocked = fileRes.ok === false && fileRes.blockers.some((b) => b.startsWith('patch_target_is_external') || b.startsWith('patch_target_invalid'));
 assertGate(fileBlocked, 'file:-targeted patch must be rejected', fileRes);
-// 4) Multi-doc / other-skill reject (same base_version so the only difference is skill_id).
 const otherSkillPatch = {
     schema: typesMod.CORE_SKILL_PATCH_SCHEMA,
     skill_id: 'a-different-skill',
@@ -70,7 +60,6 @@ const otherSkillPatch = {
 };
 const otherRes = patchMod.validatePatch(otherSkillPatch, baseCard);
 assertGate(otherRes.ok === false && otherRes.blockers.includes('patch_targets_other_skill'), 'patch for another skill must be blocked by patch_targets_other_skill', otherRes);
-// 5) Checked-in patch schema parses and const matches the runtime contract.
 const patchSchema = readJson('schemas/skills/core-skill-patch.schema.json');
 assertGate(patchSchema.properties?.schema?.const === typesMod.CORE_SKILL_PATCH_SCHEMA, 'patch schema const must match CORE_SKILL_PATCH_SCHEMA', { const: patchSchema.properties?.schema?.const, expected: typesMod.CORE_SKILL_PATCH_SCHEMA });
 fs.mkdirSync(path.join(root, '.sneakoscope', 'reports'), { recursive: true });

package/dist/scripts/core-skill-route-runtime-integration-check.js

@@ -1,12 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
-// core-skill:route-runtime-integration (1.20.2 Area 3.1).
-//
-// Proves the route runtime reads the deployed Core Skill snapshot and records it
-// in proof: (1) selectRouteSkill returns source:'deployed' + optimizer_invoked:false
-// for a deployed snapshot, (2) a missing snapshot is a graceful 'fallback' with a
-// warning (route still runs), and (3) the agent-proof-evidence builder emits the
-// selected_core_skill field.
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
@@ -24,11 +16,9 @@ const promotionContract = createRequestedScopeContract({
     projectRoot: root,
     overrides: { skill_snapshot_promotion: true }
 });
-// Missing snapshot → graceful fallback.
 const missing = await selectRouteSkill(root, route, skillId);
 assertGate(missing.source === 'fallback', 'missing snapshot must be a graceful fallback', { missing });
 assertGate(typeof missing.warning === 'string' && missing.warning.length > 0, 'missing snapshot must carry a warning', { missing });
-// Deploy a snapshot, then select it.
 const candidate = createCandidateCard({ skillId, route, baseVersion: 0, body: 'Route skill body.' });
 const accepted = { ...candidate, status: 'accepted' };
 const promoted = await promoteToDeployedWithLedger(root, accepted, { contract: promotionContract, context: 'release' });
@@ -39,7 +29,6 @@ assertGate(typeof selection.instruction === 'string', 'deployed selection must c
 const proof = skillProofRecord(selection);
 assertGate(proof.optimizer_invoked === false, 'route skill selection must never invoke the optimizer', { proof });
 assertGate(proof.skill_id === skillId && typeof proof.hash === 'string', 'proof record must carry skill_id + hash', { proof });
-// The agent-proof-evidence builder must surface a selected_core_skill field.
 const evidenceSource = fs.readFileSync(path.join(process.cwd(), 'src/core/agents/agent-proof-evidence.ts'), 'utf8');
 assertGate(/selected_core_skill\s*:/.test(evidenceSource), 'agent-proof-evidence must emit selected_core_skill', {});
 const orchestratorSource = fs.readFileSync(path.join(process.cwd(), 'src/core/agents/agent-orchestrator.ts'), 'utf8');

package/dist/scripts/current-surface-update-e2e-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// Current-surface update and migration receipt end-to-end gate.
 import fs from 'node:fs';
 import fsp from 'node:fs/promises';
 import os from 'node:os';
@@ -49,9 +48,6 @@ try {
             SKS_REQUIRE_ZELLIJ: '0',
             SKS_POSTINSTALL_GLOBAL_DOCTOR: '0',
             SKS_MIGRATION_DOCTOR_TIMEOUT_MS: '30000',
-            // The updated-package doctor and receipt writer repeat the expensive
-            // migration passes. Keep their dedicated budget above parallel CI load
-            // without weakening the 30-second migration-timeout retry fixture below.
             SKS_UPDATE_NEW_DOCTOR_TIMEOUT_MS: '90000'
         }
     }));

package/dist/scripts/current-upgrade-matrix-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/dfix-fixture-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { emitGate, runDfixFixture } from './sks-1-11-gate-lib.js';
 const result = runDfixFixture();
 emitGate('dfix:fixture', { mission_id: result.mission_id, fixture_root: result.fixture_root });

package/dist/scripts/dfix-patch-handoff-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { emitGate, requireContains } from './sks-1-12-real-execution-check-lib.js';
 requireContains('dfix:patch-handoff', 'src/core/dfix.ts', [
     'codex_patch_handoff',

package/dist/scripts/dfix-verification-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, readMissionJson, runDfixFixture } from './sks-1-11-gate-lib.js';
 const result = runDfixFixture();
 const verification = readMissionJson(result.mission_id, 'dfix-verification.json');

package/dist/scripts/dfix-verification-recommendation-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { emitGate, requireContains } from './sks-1-12-real-execution-check-lib.js';
 requireContains('dfix:verification-recommendation', 'src/core/dfix.ts', [
     'DFIX_VERIFICATION_SUGGESTION_ARTIFACT',

package/dist/scripts/docs-truthfulness-check.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const packageVersion = String(JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).version || '').trim();
 const files = [
     'README.md',
     'CHANGELOG.md',
@@ -33,7 +33,7 @@ const required = {
     'docs/goal-to-loop-migration.md': ['only persisted goal owner', 'creates no SKS mission', '--legacy-goal-runtime', 'fail with an instruction'],
     'docs/known-gaps.md': ['No P0', 'P1'],
     'docs/release-readiness.md': [
-        'SKS 7.0.0 Release Readiness',
+        `SKS ${packageVersion} Release Readiness`,
         '$sks-naruto',
         '$sks-work',
         'sks doctor --fix',
@@ -46,7 +46,7 @@ const required = {
         'proof-aware fleet control',
         'npm stage publish',
         'npm stage approve <stage-id>',
-        '6.2.0 to 7.0.0 upgrade smoke'
+        `6.2.0 to ${packageVersion} upgrade smoke`
     ]
 };
 const forbidden = [

package/dist/scripts/doctor-fastpath-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { spawnSync } from 'node:child_process';
 import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
 const started = Date.now();

package/dist/scripts/doctor-fix-proves-codex-read-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { spawnSync } from 'node:child_process';
 import fs from 'node:fs/promises';
 import os from 'node:os';
@@ -27,9 +26,6 @@ function runDoctorFix(fixture, home, extraEnv) {
         timeout: 180000
     });
 }
-// Scenario 1: an EPERM config-load failure the repairs cannot fix MUST stay a blocker
-// (the re-probe of a genuinely-unreadable config still reports failure — Fix B does not
-// paper over real problems).
 const epermFixture = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-doctor-fix-eperm-'));
 const epermHome = path.join(epermFixture, 'home');
 await fs.mkdir(epermHome, { recursive: true });
@@ -39,12 +35,6 @@ const epermOk = epermRun.status !== 0
     && epermParsed.ready?.ready === false
     && epermParsed.ready?.blockers?.includes('codex_cli_config_eperm')
     && epermParsed.ready?.next_actions?.length > 0;
-// Scenario 2 (regression for the endless `sks doctor --fix` loop): the project config
-// seeds Context7 as a LOCAL STDIO server, which the fake loader treats as the Codex 0.140
-// stdio/url merge conflict (`url is not supported for stdio`). `sks doctor --fix` migrates
-// Context7 to the remote `url` transport; the post-repair re-probe must then observe a
-// loadable config and clear `codex_cli_config_toml_parse_error` — instead of reporting the
-// stale pre-migration failure that previously trapped users in a rerun loop.
 const c7Fixture = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-doctor-fix-c7-'));
 const c7Home = path.join(c7Fixture, 'home');
 await fs.mkdir(path.join(c7Fixture, '.codex'), { recursive: true });
@@ -94,7 +84,6 @@ function parseLastJson(text) {
             return JSON.parse(source.slice(starts[i]));
         }
         catch {
-            // Continue searching for the outer JSON object; pretty JSON may contain nested objects.
         }
     }
     return {};

package/dist/scripts/doctor-fixes-codex-app-fast-ui-check.js

@@ -13,8 +13,6 @@ await fs.mkdir(path.join(root, '.codex'), { recursive: true });
 await fs.mkdir(codexHome, { recursive: true });
 await fs.writeFile(path.join(root, '.codex', 'config.toml'), 'model = "future-codex-model"\nmodel_reasoning_effort = "medium"\nmodel_provider = "codex-lb"\n');
 await fs.writeFile(path.join(codexHome, 'config.toml'), '# SKS forced fast UI during legacy install\nmodel = "legacy-sks-model"\nmodel_reasoning_effort = "xhigh"\nmodel_provider = "codex-lb"\nservice_tier = "fast"\n[features]\nfast_mode = false # user disabled, must remain untouched\n\n[profiles.sks-fast-high]\nmodel = "legacy-profile-model"\nservice_tier = "fast"\n\n[model_providers.codex-lb]\nname = "openai"\nbase_url = "https://lb.example.test/backend-api/codex"\nwire_api = "responses"\nenv_key = "CODEX_LB_API_KEY"\nsupports_websockets = true\nrequires_openai_auth = true\n');
-// Keep this hermetic: selected codex-lb readiness must not inherit the release
-// runner's machine credentials or perform a real model-catalog lookup.
 const fixtureEnv = {};
 const plan = await repairCodexAppFastUi(root, { codexHome, apply: false, env: fixtureEnv });
 const repaired = await repairCodexAppFastUi(root, { codexHome, apply: true, env: fixtureEnv });
@@ -38,8 +36,6 @@ const ok = plan.fast_selector === 'manual_action_required'
     && plan.provider_actions.includes('sks codex-lb setup --host <domain> --api-key-stdin --yes')
     && plan.safe_auto_apply === true
     && repaired.fast_selector === 'repaired'
-    // Contract-valid codex-lb selection is preserved through Fast UI repair; without
-    // hermetic credentials/catalog the selected provider stays setup-required.
     && repaired.provider_selector === 'manual_action_required'
     && repaired.selected_provider_blockers.includes('codex_lb_api_key_missing')
     && repaired.selected_provider_blockers.includes('codex_lb_base_url_missing')

package/dist/scripts/doctor-idempotence-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
 const { runDoctorIdempotence } = await importDist('core/doctor/doctor-idempotence.js');
 const report = await runDoctorIdempotence(root);

package/dist/scripts/doctor-ops-semantics-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/ensure-bin-executable.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fsp from 'node:fs/promises';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';

package/dist/scripts/evidence-flagship-coverage-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import path from 'node:path';
 import { emitGate, requireContains, root } from './sks-1-12-real-execution-check-lib.js';

package/dist/scripts/fast-codex-service-tier-proof-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';

package/dist/scripts/fixtures/fake-codex-config-loader.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import fs from 'node:fs';
 import path from 'node:path';
 const args = process.argv.slice(2);
@@ -15,10 +14,6 @@ catch (err) {
 if (process.env.SKS_FAKE_CODEX_CONFIG_EPERM === '1') {
     emitConfigError(`Failed to read project config file ${configPath}: Operation not permitted (os error 1)`);
 }
-// Simulate the Codex 0.140 stdio/url merge conflict: when the project config still
-// defines Context7 as a local stdio server (a `command`), Codex merges it with the
-// remote `url` in the global config and rejects the result. Once the doctor migrates
-// Context7 to the remote `url` transport (no `command`), the load succeeds.
 if (process.env.SKS_FAKE_CODEX_CONFIG_CONTEXT7_STDIO_CONFLICT === '1') {
     const context7 = configText.match(/\[mcp_servers\.context7\][^[]*/)?.[0] || '';
     if (/^\s*command\s*=/m.test(context7) || /@upstash\/context7-mcp/.test(context7)) {

package/dist/scripts/fsx-hotpath-check.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-// @ts-nocheck
 import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
 const { writeFsxHotpathReport } = await importDist('core/perf/fsx-hotpath.js');
 const report = await writeFsxHotpathReport(root);