sneakoscope 7.1.0 → 7.3.0

package/dist/core/db-safety.js

@@ -346,25 +346,6 @@ function hasTableRemovalRisk(cls = {}) {
     ]);
     return ['drop_table', 'truncate'].some((reason) => reasons.has(reason));
 }
-async function madSksOverrideState(root, state = {}) {
-    if (!isMadSksRouteState(state) || !state.mission_id || state.mad_sks_active === false)
-        return { active: false };
-    const gateFile = state.mad_sks_gate_file || state.stop_gate || MAD_SKS_GATE_FILE;
-    const gate = await readJson(path.join(missionDir(root, state.mission_id), gateFile), null);
-    const owner = gate?.gate_owner?.mission_id || gate?.mission_id || state.gate_owner_mission_id;
-    if (owner && String(owner) !== String(state.mission_id)) {
-        return { active: false, reason: 'mad_sks_gate_owner_mismatch', gate_file: gateFile, gate_owner_mission_id: owner };
-    }
-    if (gate?.passed === true || gate?.permissions_deactivated === true)
-        return { active: false, reason: 'mad_sks_gate_already_closed', gate_file: gateFile };
-    const confirmedUntil = Date.parse(state.mad_sks_table_delete_confirmed_until || '');
-    return {
-        active: true,
-        gateFile,
-        tableDeleteConfirmed: Number.isFinite(confirmedUntil) && confirmedUntil > Date.now(),
-        tableDeleteConfirmedUntil: Number.isFinite(confirmedUntil) ? new Date(confirmedUntil).toISOString() : null
-    };
-}
 export function evaluateDbSafety({ classification, policy = DEFAULT_DB_SAFETY_POLICY, contract = null, duringNoQuestion = false, madSks = null } = {}) {
     const cls = classification || { level: 'none', reasons: [] };
     const noQuestion = Boolean(duringNoQuestion);
@@ -427,6 +408,7 @@ export function evaluateDbSafety({ classification, policy = DEFAULT_DB_SAFETY_PO
             reasons.push('database_write_target_not_local_or_branch');
         if (policy.block_direct_execute_sql_writes && cls.toolReasons?.includes?.('database_tool'))
             reasons.push('direct_mcp_execute_sql_writes_blocked');
+        reasons.push('database_mutation_requires_manual_sql_or_active_mad_sks_sql_plane');
     }
     if (effective.destructive)
         reasons.push('contract_attempted_to_allow_destructive_but_policy_denies');
@@ -575,8 +557,15 @@ export async function checkDbOperation(root, state, payload, { duringNoQuestion
         await appendJsonlBounded(path.join(missionDir(root, madSksSqlPlaneMissionId), 'db-safety.jsonl'), { ts: nowIso(), decision });
         return decision;
     }
-    const madSks = await madSksOverrideState(root, state);
-    const decision = evaluateDbSafety({ classification, policy, contract, duringNoQuestion, madSks });
+    const decision = evaluateDbSafety({ classification, policy, contract, duringNoQuestion, madSks: null });
+    if (isMadSksRouteState(state) && ['write', 'destructive'].includes(classification.level)) {
+        decision.reasons = [...new Set([
+                ...(decision.reasons || []),
+                'mad_sks_sql_plane_capability_v2_required'
+            ])];
+        decision.allowed = false;
+        decision.action = 'block';
+    }
     if (decision.action === 'confirm')
         await writeMadSksTableDeletePending(root, state, decision);
     if (decision.action !== 'allow' && state?.mission_id) {
@@ -610,7 +599,8 @@ export function dbBlockReason(decision) {
     return [
         'Sneakoscope Codex Database Safety Gate blocked this operation.',
         `Reasons: ${(decision.reasons || []).join(', ') || 'unknown'}.`,
-        'Default DB mode is read-only. Destructive SQL-plane operations require an explicit active MAD-SKS SQL-plane capability opened by $MAD-SKS or sks mad-sks sql|apply-migration.',
+        'Default DB mode is read-only. If a migration is required outside MAD-SKS, create one mission-local manual-migration.sql with forward SQL and an inactive rollback section, then ask the user to apply it manually.',
+        'All live database mutations require an explicit active MAD-SKS SQL-plane capability v2 opened by $MAD-SKS or sks mad-sks sql|apply-migration.',
         'Use read-only/project-scoped Supabase MCP URLs outside MAD-SKS SQL-plane. Supabase project/account/billing/credential control-plane operations remain denied even there.'
     ].join(' ');
 }
@@ -699,7 +689,11 @@ async function scanMissionMigrationFiles(root, opts = {}) {
         for (const e of entries) {
             const p = path.join(dir, e.name);
             const rp = rel(root, p);
-            if (rp.startsWith('.git/') || rp.startsWith('node_modules/') || rp.startsWith('.sneakoscope/'))
+            if (e.name.startsWith('.')
+                || ['node_modules', 'dist', 'build', 'coverage', 'vendor', 'archive'].includes(e.name)
+                || rp.startsWith('.git/')
+                || rp.startsWith('node_modules/')
+                || rp.startsWith('.sneakoscope/'))
                 continue;
             if (e.isDirectory())
                 await walk(p, depth + 1);

package/dist/core/doctor/browser-use-repair.js

@@ -4,6 +4,7 @@ import { ensureCodexPlugins } from '../codex-plugins/codex-plugin-repair.js';
 import { runDoctorCodexStartupRepair } from './doctor-codex-startup-repair.js';
 import { ensureDir, nowIso, runProcess, which, writeJsonAtomic } from '../fsx.js';
 import { redactString } from '../secret-redaction.js';
+import { messageOf } from '../errors/message.js';
 export const DOCTOR_BROWSER_USE_REPAIR_SCHEMA = 'sks.doctor-browser-use-repair.v1';
 export async function repairBrowserUse(input) {
     const root = path.resolve(input.root || process.cwd());
@@ -182,6 +183,3 @@ function tail(value, max = 2000) {
     const text = redactString(String(value || ''));
     return text.length > max ? text.slice(-max) : text;
 }
-function messageOf(err) {
-    return err instanceof Error ? err.message : String(err);
-}

package/dist/core/doctor/codex-startup-config-repair.js

@@ -3,6 +3,7 @@ import { nowIso, writeJsonAtomic } from '../fsx.js';
 import { repairAgentRoleConfigs } from '../agents/agent-role-config.js';
 import { repairAgentConfigFileReferences } from '../codex/agent-config-file-repair.js';
 import { postcheckCodexStartupConfig } from '../codex/codex-startup-config-postcheck.js';
+import { messageOf } from '../errors/message.js';
 export async function repairCodexStartupConfig(input) {
     const root = path.resolve(input.root);
     const roleRepair = await repairAgentRoleConfigs({
@@ -52,6 +53,3 @@ export async function repairCodexStartupConfig(input) {
     }
     return report;
 }
-function messageOf(err) {
-    return err instanceof Error ? err.message : String(err);
-}

package/dist/core/doctor/computer-use-repair.js

@@ -4,6 +4,7 @@ import { ensureCodexPlugins } from '../codex-plugins/codex-plugin-repair.js';
 import { computerUseStatusReport } from '../computer-use-status.js';
 import { ensureDir, nowIso, runProcess, which, writeJsonAtomic } from '../fsx.js';
 import { redactString } from '../secret-redaction.js';
+import { messageOf } from '../errors/message.js';
 export const DOCTOR_COMPUTER_USE_REPAIR_SCHEMA = 'sks.doctor-computer-use-repair.v1';
 export async function repairComputerUse(input) {
     const root = path.resolve(input.root || process.cwd());
@@ -149,6 +150,3 @@ function tail(value, max = 2000) {
     const text = redactString(String(value || ''));
     return text.length > max ? text.slice(-max) : text;
 }
-function messageOf(err) {
-    return err instanceof Error ? err.message : String(err);
-}

package/dist/core/doctor/context7-mcp-repair.js

@@ -4,6 +4,7 @@ import { isUnmanagedProjectCodexConfig, writeCodexConfigGuarded } from '../codex
 import { CONTEXT7_REMOTE_MCP_URL, mcpServerBlock, mcpServerExplicitlyDisabled, readProjectCodexConfig, replaceOrAppendMcpServerBlock } from '../mcp/mcp-config-preservation.js';
 import { guardedWriteFile, guardContextForRoute } from '../safety/mutation-guard.js';
 import { createRequestedScopeContract } from '../safety/requested-scope-contract.js';
+import { messageOf } from '../errors/message.js';
 export async function repairContext7Mcp(input) {
     const root = path.resolve(input.root);
     const config = await readProjectCodexConfig(root);
@@ -105,9 +106,6 @@ export async function repairContext7Mcp(input) {
     }
     return report;
 }
-function messageOf(err) {
-    return err instanceof Error ? err.message : String(err);
-}
 async function probeRemoteContext7() {
     try {
         const response = await fetch(CONTEXT7_REMOTE_MCP_URL, { method: 'HEAD' });

package/dist/core/doctor/current-project-guidance.js

@@ -8,6 +8,7 @@ import { isSksGeneratedRetiredProfileText, reconcileRetiredSksConfigText, RETIRE
 import { validateCodexConfigRoundTrip } from '../codex/codex-config-toml.js';
 import { inspectConfinedPath, moveConfinedPath, removeManagedPathVerified, uniqueConfinedPath } from '../managed-path-safety.js';
 import { collectNestedProjectRoots } from './current-project-guidance-nested.js';
+import { escapeRegExp } from '../text/regex.js';
 export const CURRENT_PROJECT_GUIDANCE_SCHEMA = 'sks.current-project-guidance.v1';
 const AGENTS_MARKER = 'BEGIN Sneakoscope Codex GX MANAGED BLOCK';
 const RETIRED_COMMAND_NAMES = ['team', 'mad-db', 'tmux', 'xai', 'swarm', 'agent', 'ralph', 'db', 'ui', 'glm'];
@@ -341,6 +342,3 @@ function uniqueScopes(scopes) {
     }
     return [...unique.values()];
 }
-function escapeRegExp(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}

package/dist/core/doctor/doctor-codex-startup-repair.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import os from 'node:os';
 import { exists, nowIso, readText, writeJsonAtomic } from '../fsx.js';
 import { isUnmanagedProjectCodexConfig, writeCodexConfigGuarded } from '../codex/codex-config-guard.js';
+import { escapeRegExp } from '../text/regex.js';
 export const DOCTOR_CODEX_STARTUP_REPAIR_SCHEMA = 'sks.doctor-codex-startup-repair.v1';
 export async function runDoctorCodexStartupRepair(input) {
     const root = path.resolve(input.root || process.cwd());
@@ -370,6 +371,3 @@ function stringValues(text, key) {
 function escapeToml(value) {
     return value.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
 }
-function escapeRegExp(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}

package/dist/core/doctor/doctor-dirty-planner.js

@@ -4,7 +4,7 @@ import { spawnSync } from 'node:child_process';
 import { MANAGED_ASSET_VERSION } from '../managed-assets/managed-assets-manifest.js';
 import { PACKAGE_VERSION, packageRoot, sha256 } from '../fsx.js';
 import { hashJson } from '../triwiki/triwiki-cache-key.js';
-import { SKS_MENUBAR_LABEL, sksMenuBarPaths } from '../codex-app/sks-menubar.js';
+import { SKS_MENUBAR_LABEL, sksMenuBarPaths } from '../codex-app/menubar/index.js';
 export const DOCTOR_DIRTY_PLAN_SCHEMA = 'sks.doctor-dirty-plan.v2';
 export function planDoctorDirtyRepair(root, phaseIds) {
     const phases = phaseIds.map((id) => {
@@ -116,7 +116,7 @@ function phaseInputFiles(id) {
     if (id.includes('supabase'))
         return ['src/core/doctor/supabase-mcp-repair.ts', '.codex/config.toml'];
     if (id.includes('menubar'))
-        return ['src/core/codex-app/sks-menubar.ts', 'src/commands/doctor.ts', 'package.json'];
+        return ['src/core/codex-app/menubar/index.ts', 'src/commands/doctor.ts', 'package.json'];
     if (id.includes('skill'))
         return ['.agents/skills', 'src/scripts/skill-registry-ledger-check.ts'];
     if (id.includes('native'))

package/dist/core/doctor/doctor-native-capability-repair.js

@@ -8,6 +8,7 @@ import { withSecretPreservationGuard } from '../config/config-migration-journal.
 import { ensureProductDesignPluginInstalled } from '../product-design-app-server.js';
 import { cleanupLegacyGlobalSksHooks } from './legacy-global-hook-cleanup.js';
 import { redactSecrets } from '../secret-redaction.js';
+import { messageOf } from '../errors/message.js';
 export async function runDoctorNativeCapabilityRepair(input) {
     const root = path.resolve(input.root);
     const fixRequested = input.fix || (input.flags || []).includes('--fix');
@@ -135,9 +136,6 @@ export async function cleanupNativeCapabilityProbeArtifacts(root, opts = { apply
         preserved_non_probe_files: preserved
     };
 }
-function messageOf(err) {
-    return err instanceof Error ? err.message : String(err);
-}
 function skippedNativeCapabilityDiagnostics(root) {
     return {
         schema: 'sks.native-capability-repair-matrix.v1',

package/dist/core/doctor/doctor-transaction.js

@@ -2,6 +2,7 @@ import path from 'node:path';
 import { nowIso, writeJsonAtomic } from '../fsx.js';
 import { isDoctorPhaseClean, markDoctorPhaseClean } from './doctor-dirty-planner.js';
 import { ui as cliUi } from '../../cli/cli-theme.js';
+import { messageOf } from '../errors/message.js';
 export async function runDoctorFixTransaction(input) {
     const startedAt = nowIso();
     const phases = [];
@@ -172,6 +173,3 @@ function mergePhase(phase, update) {
         warnings: [...(phase.warnings || []), ...(update.warnings || [])]
     };
 }
-function messageOf(err) {
-    return err instanceof Error ? err.message : String(err);
-}

package/dist/core/doctor/imagegen-repair.js

@@ -3,6 +3,7 @@ import { CODEX_APP_IMAGE_GENERATION_DOC_URL } from '../routes.js';
 import { detectImagegenCapability } from '../imagegen/imagegen-capability.js';
 import { ensureDir, nowIso, runProcess, which, writeJsonAtomic } from '../fsx.js';
 import { redactString } from '../secret-redaction.js';
+import { messageOf } from '../errors/message.js';
 export const DOCTOR_IMAGEGEN_REPAIR_SCHEMA = 'sks.doctor-imagegen-repair.v1';
 export async function repairCodexImagegen(input) {
     const root = path.resolve(input.root || process.cwd());
@@ -197,6 +198,3 @@ function tail(value, max = 2000) {
     const text = redactString(String(value || ''));
     return text.length > max ? text.slice(-max) : text;
 }
-function messageOf(err) {
-    return err instanceof Error ? err.message : String(err);
-}

package/dist/core/doctor/legacy-global-hook-cleanup.js

@@ -2,6 +2,7 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { ensureDir, nowIso, readText, writeJsonAtomic } from '../fsx.js';
+import { messageOf } from '../errors/message.js';
 export const LEGACY_GLOBAL_HOOK_CLEANUP_SCHEMA = 'sks.legacy-global-hook-cleanup.v1';
 export async function cleanupLegacyGlobalSksHooks(input) {
     const root = path.resolve(input.root);
@@ -173,6 +174,3 @@ async function pruneOldBackups(globalPath, keepPath) {
         if (row.file !== keepPath)
             await fs.rm(row.file, { force: true }).catch(() => undefined);
 }
-function messageOf(err) {
-    return err instanceof Error ? err.message : String(err);
-}

package/dist/core/doctor/mcp-transport-collision-repair.js

@@ -4,6 +4,7 @@ import fs from 'node:fs/promises';
 import { nowIso, writeJsonAtomic } from '../fsx.js';
 import { isUnmanagedProjectCodexConfig, writeCodexConfigGuarded } from '../codex/codex-config-guard.js';
 import { mcpServerBlock, mcpServerExplicitlyDisabled, readProjectCodexConfig, tomlTableRange } from '../mcp/mcp-config-preservation.js';
+import { messageOf } from '../errors/message.js';
 export async function detectAndRepairMcpTransportCollisions(input) {
     const root = path.resolve(input.root);
     const apply = input.apply === true;
@@ -134,6 +135,3 @@ function commentOutMcpServerBlock(block, server, projectTransport, globalTranspo
         .join('\n');
     return `${note}${commented}\n`;
 }
-function messageOf(err) {
-    return err instanceof Error ? err.message : String(err);
-}

package/dist/core/doctor/retired-managed-residue-private.js

@@ -1,5 +1,6 @@
 import path from 'node:path';
 import { inspectConfinedPath, moveConfinedPath, removeEmptyTreeVerified, uniqueConfinedPath, walkConfinedEntries } from '../managed-path-safety.js';
+import { escapeRegExp } from '../text/regex.js';
 export const REMOVED_PUBLIC_COMMANDS = ['team', 'mad-db', 'tmux', 'xai', 'swarm', 'agent', 'ralph', 'ui', 'glm'];
 const RETIRED_COMMAND_TOMBSTONES = new Set(REMOVED_PUBLIC_COMMANDS);
 const RETIRED_MISSION_MODES = new Set([
@@ -69,6 +70,3 @@ export async function walkEntries(boundary, root) {
 export async function removeEmptyTree(boundary, root) {
     return removeEmptyTreeVerified(boundary, root);
 }
-function escapeRegExp(value) {
-    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}

package/dist/core/doctor/supabase-mcp-repair.js

@@ -4,6 +4,7 @@ import fs from 'node:fs/promises';
 import { nowIso, writeJsonAtomic } from '../fsx.js';
 import { isUnmanagedProjectCodexConfig, writeCodexConfigGuarded } from '../codex/codex-config-guard.js';
 import { mcpServerBlock, mcpServerExplicitlyDisabled, readProjectCodexConfig, replaceOrAppendMcpServerBlock, tomlTableRange } from '../mcp/mcp-config-preservation.js';
+import { messageOf } from '../errors/message.js';
 export async function repairSupabaseMcp(input) {
     const root = path.resolve(input.root);
     const config = await readProjectCodexConfig(root);
@@ -136,9 +137,6 @@ export async function repairSupabaseMcp(input) {
     }
     return report;
 }
-function messageOf(err) {
-    return err instanceof Error ? err.message : String(err);
-}
 function setReadOnly(block) {
     const lines = String(block || '').replace(/\s*$/, '').split(/\r?\n/);
     const index = lines.findIndex((line) => /^\s*read[_-]?only\s*=/.test(line));

package/dist/core/engineering-sanity-review.js

@@ -0,0 +1,186 @@
+import path from 'node:path';
+import { scanCodeStructure } from './code-structure.js';
+import { readJson, readText, sha256 } from './fsx.js';
+import { missionDir } from './mission.js';
+export const ENGINEERING_SANITY_REVIEW_ARTIFACT = 'engineering-sanity-review.json';
+export const ENGINEERING_SANITY_REVIEW_SCHEMA = 'sks.engineering-sanity-review.v1';
+export const ENGINEERING_SANITY_CODE_STRUCTURE_REPORT = 'code-structure-report.json';
+export const ENGINEERING_SANITY_CHECK_IDS = Object.freeze([
+    'solid_boundaries',
+    'n_plus_one_and_repeated_io',
+    'bounded_render_recursion_event_retry_polling',
+    'verification_bypass_absent'
+]);
+const FINAL_CHECK_STATUSES = new Set(['passed', 'not_applicable']);
+export function createEngineeringSanityReviewSeed(route = null, report = null, reportText = '') {
+    const candidates = engineeringCandidates(report);
+    return {
+        schema: ENGINEERING_SANITY_REVIEW_SCHEMA,
+        passed: false,
+        route: route || null,
+        changed_files: sortedUniqueStrings(report?.changed_scope?.source_files),
+        added_hunks_reviewed: false,
+        real_callers_traced: false,
+        static_scan_role: 'candidate_detection_only_not_completion_proof',
+        code_structure_report: ENGINEERING_SANITY_CODE_STRUCTURE_REPORT,
+        code_structure_report_sha256: reportText ? `sha256:${sha256(reportText)}` : null,
+        changed_scope_sha256: report ? engineeringScopeHash(report) : null,
+        reviewed_candidate_ids: [],
+        candidate_dispositions: [],
+        checks: Object.fromEntries(ENGINEERING_SANITY_CHECK_IDS.map((id) => [id, {
+                status: 'pending',
+                reason: null,
+                evidence: []
+            }])),
+        candidate_findings: candidates,
+        resolved_findings: [],
+        unresolved_findings: [],
+        blockers: [],
+        notes: []
+    };
+}
+export function validateEngineeringSanityReview(review = {}) {
+    const blockers = [];
+    if (review?.schema !== ENGINEERING_SANITY_REVIEW_SCHEMA)
+        blockers.push('schema');
+    if (review?.passed !== true)
+        blockers.push('passed');
+    if (review?.added_hunks_reviewed !== true)
+        blockers.push('added_hunks_reviewed');
+    if (review?.real_callers_traced !== true)
+        blockers.push('real_callers_traced');
+    if (review?.static_scan_role !== 'candidate_detection_only_not_completion_proof')
+        blockers.push('static_scan_role');
+    if (!Array.isArray(review?.changed_files))
+        blockers.push('changed_files_invalid');
+    if (!Array.isArray(review?.candidate_findings))
+        blockers.push('candidate_findings_invalid');
+    if (!Array.isArray(review?.reviewed_candidate_ids))
+        blockers.push('reviewed_candidate_ids_invalid');
+    if (!Array.isArray(review?.candidate_dispositions))
+        blockers.push('candidate_dispositions_invalid');
+    if (!Array.isArray(review?.resolved_findings))
+        blockers.push('resolved_findings_invalid');
+    if (!Array.isArray(review?.unresolved_findings))
+        blockers.push('unresolved_findings_invalid');
+    else if (review.unresolved_findings.length > 0)
+        blockers.push('unresolved_findings');
+    if (!Array.isArray(review?.blockers))
+        blockers.push('blockers_invalid');
+    else if (review.blockers.length > 0)
+        blockers.push('blockers');
+    for (const id of ENGINEERING_SANITY_CHECK_IDS) {
+        const check = review?.checks?.[id];
+        const status = String(check?.status || '');
+        if (!FINAL_CHECK_STATUSES.has(status)) {
+            blockers.push(`checks:${id}:status`);
+            continue;
+        }
+        if (!Array.isArray(check?.evidence) || check.evidence.length === 0 || check.evidence.some((item) => typeof item !== 'string' || !item.trim())) {
+            blockers.push(`checks:${id}:evidence`);
+        }
+        if (status === 'not_applicable' && (typeof check?.reason !== 'string' || !check.reason.trim())) {
+            blockers.push(`checks:${id}:reason`);
+        }
+    }
+    return { ok: blockers.length === 0, blockers: [...new Set(blockers)] };
+}
+export async function validateEngineeringSanityReviewArtifact(root, missionId, review = {}, opts = {}) {
+    const basic = validateEngineeringSanityReview(review);
+    const blockers = [...basic.blockers];
+    if (review?.code_structure_report !== ENGINEERING_SANITY_CODE_STRUCTURE_REPORT)
+        blockers.push('code_structure_report');
+    const reportFile = path.join(missionDir(root, missionId), ENGINEERING_SANITY_CODE_STRUCTURE_REPORT);
+    const persistedText = await readText(reportFile, '');
+    const persisted = persistedText ? await readJson(reportFile, null) : null;
+    if (persisted?.schema_version !== 1)
+        blockers.push(`${ENGINEERING_SANITY_CODE_STRUCTURE_REPORT}:schema_version`);
+    if (String(review?.code_structure_report_sha256 || '') !== `sha256:${sha256(persistedText)}`)
+        blockers.push('code_structure_report_sha256');
+    const declaredBase = scopeBase(opts.base);
+    const persistedBase = scopeBase(persisted?.changed_scope?.base);
+    if (declaredBase && persistedBase && declaredBase !== persistedBase) {
+        blockers.push(`${ENGINEERING_SANITY_CODE_STRUCTURE_REPORT}:changed_scope_base`);
+    }
+    const base = declaredBase || persistedBase || 'HEAD';
+    const fresh = await scanCodeStructure(root, { changedSince: base, includeOk: true });
+    const freshScopeHash = engineeringScopeHash(fresh);
+    if (review?.changed_scope_sha256 !== freshScopeHash)
+        blockers.push('changed_scope_sha256');
+    if (engineeringScopeHash(persisted) !== freshScopeHash)
+        blockers.push(`${ENGINEERING_SANITY_CODE_STRUCTURE_REPORT}:stale_changed_scope`);
+    const freshChangedFiles = sortedUniqueStrings(fresh?.changed_scope?.source_files);
+    if (JSON.stringify(sortedUniqueStrings(review?.changed_files)) !== JSON.stringify(freshChangedFiles))
+        blockers.push('changed_files');
+    const freshCandidates = engineeringCandidates(fresh);
+    const freshCandidateIds = freshCandidates.map((candidate) => candidate.id).sort();
+    const persistedCandidateIds = engineeringCandidates(persisted).map((candidate) => candidate.id).sort();
+    if (JSON.stringify(persistedCandidateIds) !== JSON.stringify(freshCandidateIds))
+        blockers.push(`${ENGINEERING_SANITY_CODE_STRUCTURE_REPORT}:stale_candidates`);
+    if (JSON.stringify(sortedUniqueStrings(review?.reviewed_candidate_ids)) !== JSON.stringify(freshCandidateIds))
+        blockers.push('reviewed_candidate_ids');
+    if (JSON.stringify(candidateFindingIds(review?.candidate_findings)) !== JSON.stringify(freshCandidateIds))
+        blockers.push('candidate_findings');
+    const dispositions = Array.isArray(review?.candidate_dispositions) ? review.candidate_dispositions : [];
+    const dispositionIds = sortedUniqueStrings(dispositions.map((row) => row?.candidate_id));
+    if (JSON.stringify(dispositionIds) !== JSON.stringify(freshCandidateIds))
+        blockers.push('candidate_dispositions');
+    const freshCandidatesById = new Map(freshCandidates.map((candidate) => [candidate.id, candidate]));
+    for (const row of dispositions) {
+        if (!['resolved', 'false_positive'].includes(String(row?.status || '')))
+            blockers.push('candidate_dispositions:status');
+        if (typeof row?.reason !== 'string' || !row.reason.trim())
+            blockers.push('candidate_dispositions:reason');
+        if (!Array.isArray(row?.evidence) || row.evidence.length === 0 || row.evidence.some((item) => typeof item !== 'string' || !item.trim()))
+            blockers.push('candidate_dispositions:evidence');
+        const candidate = freshCandidatesById.get(String(row?.candidate_id || ''));
+        if (!candidate || String(row?.source_scope || '') !== String(candidate?.source_scope || ''))
+            blockers.push('candidate_dispositions:source_scope');
+        if (JSON.stringify(normalizeLineRanges(row?.added_hunk_line_ranges)) !== JSON.stringify(normalizeLineRanges(candidate?.added_hunk_line_ranges))) {
+            blockers.push('candidate_dispositions:added_hunk_line_ranges');
+        }
+    }
+    return { ok: blockers.length === 0, blockers: [...new Set(blockers)], report: fresh };
+}
+export function engineeringScopeHash(report = {}) {
+    const scope = report?.changed_scope || {};
+    return `sha256:${sha256(JSON.stringify({
+        mode: scope.mode || null,
+        base: scope.base || null,
+        changed_files: sortedUniqueStrings(scope.changed_files),
+        source_files: sortedUniqueStrings(scope.source_files),
+        entries: Array.isArray(scope.entries)
+            ? scope.entries
+                .map((entry) => ({
+                path: String(entry?.path || ''),
+                status: String(entry?.status || ''),
+                lines_added: Number(entry?.lines_added || 0),
+                lines_deleted: Number(entry?.lines_deleted || 0),
+                source_sha256: typeof entry?.source_sha256 === 'string' ? entry.source_sha256 : null
+            }))
+                .sort((left, right) => left.path.localeCompare(right.path))
+            : []
+    }))}`;
+}
+function scopeBase(value) {
+    const text = String(value ?? '').trim();
+    return text || '';
+}
+function engineeringCandidates(report = {}) {
+    const tags = new Set(['solid', 'n-plus-one', 'unbounded-loop', 'verification-bypass', 'db-pool', 'transaction']);
+    return (Array.isArray(report?.semantic_review?.findings) ? report.semantic_review.findings : [])
+        .filter((finding) => tags.has(String(finding?.tag || '')) && typeof finding?.id === 'string' && finding.id)
+        .sort((left, right) => left.id.localeCompare(right.id));
+}
+function candidateFindingIds(value) {
+    return sortedUniqueStrings(Array.isArray(value) ? value.map((row) => row?.id || row?.candidate_id) : []);
+}
+function sortedUniqueStrings(value) {
+    return [...new Set(Array.isArray(value) ? value.map((item) => String(item || '').trim()).filter(Boolean) : [])].sort();
+}
+function normalizeLineRanges(value) {
+    return (Array.isArray(value) ? value : [])
+        .map((row) => ({ start: Number(row?.start || 0), end: Number(row?.end || 0) }))
+        .filter((row) => Number.isInteger(row.start) && Number.isInteger(row.end) && row.start > 0 && row.end >= row.start)
+        .sort((left, right) => left.start - right.start || left.end - right.end);
+}

package/dist/core/errors/message.js

@@ -0,0 +1,3 @@
+export function messageOf(error) {
+    return error instanceof Error ? error.message : String(error);
+}

package/dist/core/evidence/evidence-schema.js

@@ -1,4 +1,5 @@
 import { nowIso, randomId } from '../fsx.js';
+import { asRecordOrEmpty as asRecord } from '../json/records.js';
 export const EVIDENCE_SCHEMA = 'sks.evidence.v1';
 export const EVIDENCE_INDEX_SCHEMA = 'sks.evidence-index.v1';
 export const PROJECT_EVIDENCE_INDEX_SCHEMA = 'sks.project-evidence-index.v1';
@@ -46,9 +47,6 @@ export const EVIDENCE_TRUST = Object.freeze([
     'low',
     'blocked'
 ]);
-function asRecord(value) {
-    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
-}
 function stringOrNull(value) {
     return typeof value === 'string' ? value : null;
 }

package/dist/core/feature-fixtures.js

@@ -100,6 +100,7 @@ const FIXTURES = Object.freeze({
     }),
     'cli-context7': fixture('real_optional', 'sks context7 check --json', [], 'pass'),
     'cli-super-search': fixture('execute', 'sks super-search doctor --json', [], 'pass'),
+    'cli-search': fixture('execute', 'sks search status --json', [], 'pass'),
     'cli-task': fixture('execute', 'sks task instant --plan --json', [], 'pass'),
     'cli-release': fixture('execute', 'sks release affected --json', [], 'blocked', { reason: '18차: the phantom requiredSections schema mismatch (five_lane_review/integration_evidence/session_cleanup, from commit d4526f84 with no producer ever wired up) has been fixed -- missing_sections is now honestly empty. The release-gate DAG still legitimately fails/blocks on other real gates (e.g. release:readiness) independent of this fix, so the command still exits non-zero and this fixture stays honestly blocked rather than claiming full green.' }),
     'cli-triwiki': fixture('execute', 'sks triwiki index --json', [], 'pass'),

package/dist/core/feature-registry.js

@@ -8,6 +8,7 @@ import { COMMAND_CATALOG, DOLLAR_COMMAND_ALIASES, DOLLAR_COMMANDS, LEGACY_DOLLAR
 import { FEATURE_QUALITY_LEVELS, fixtureForFeature, fixtureSummary, validateFeatureFixtures } from './feature-fixtures.js';
 import { runFeatureFixture, writeFeatureFixtureReports } from './feature-fixture-runner.js';
 import { PACKAGE_VERSION, exists, nowIso, packageRoot, readJson, readText, runProcess, writeJsonAtomic, writeTextAtomic } from './fsx.js';
+import { uniqueStrings } from './text/strings.js';
 export const FEATURE_REGISTRY_SCHEMA = 'sks.feature-registry.v1';
 export const FEATURE_INVENTORY_SCHEMA = 'sks.feature-inventory.v1';
 export const ALL_FEATURES_SELFTEST_SCHEMA = 'sks.all-features-selftest.v1';
@@ -815,9 +816,6 @@ function dedupeFeatureCommandSurface(feature) {
         source_refs: sourceRefs
     };
 }
-function uniqueStrings(values) {
-    return [...new Set(values.map((value) => String(value || '').trim()).filter(Boolean))];
-}
 function namespaceFeatureDollarReferences(value) {
     if (typeof value === 'string')
         return prefixKnownSksDollarReferences(value, FEATURE_DOLLAR_REFERENCE_NAMES);

package/dist/core/fsx.js

@@ -85,7 +85,20 @@ export async function readText(p, fallback) {
         throw err;
     }
 }
+export function assertTestHomeWriteAllowed(p) {
+    if (process.env.SKS_TEST_FORBID_REAL_HOME !== '1')
+        return;
+    const realHome = process.env.SKS_TEST_REAL_HOME;
+    if (!realHome)
+        return;
+    const forbidden = path.join(path.resolve(realHome), '.codex');
+    const target = path.resolve(p);
+    if (target === forbidden || target.startsWith(`${forbidden}${path.sep}`)) {
+        throw new Error(`sks_test_forbid_real_home_write: refusing to write ${target} while SKS_TEST_FORBID_REAL_HOME=1`);
+    }
+}
 export async function writeTextAtomic(p, text, opts = {}) {
+    assertTestHomeWriteAllowed(p);
     await ensureDir(path.dirname(p));
     try {
         if ((await fsp.readFile(p, 'utf8')) === text) {

package/dist/core/git-hygiene/shared-memory-publish.js

@@ -8,6 +8,7 @@ import { listSharedFiles } from './git-status.js';
 import { ensureGitPolicy, ensureSharedMemoryDirs, readGitPolicy } from './git-policy.js';
 import { isMockPositiveSharedClaim, redactSharedRecord, sharedRecordHasSecret } from './shared-memory-security.js';
 import { validateGitPolicy, validateSharedMemoryManifest, validateSharedRecordFile } from './validators.js';
+import { asRecordOrEmpty as asRecord } from '../json/records.js';
 export async function publishSharedMemory(root, opts = {}) {
     const target = opts.target || 'all';
     const policy = await ensureGitPolicy(root, { write: true });
@@ -365,6 +366,3 @@ async function latestMissionId(root) {
     }
     return entries.filter((name) => name.startsWith('M-')).sort().at(-1) || null;
 }
-function asRecord(value) {
-    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
-}

package/dist/core/git-hygiene/validators.js

@@ -1,6 +1,7 @@
 import fsp from 'node:fs/promises';
 import { GIT_POLICY_SCHEMA, SHARED_MEMORY_MANIFEST_SCHEMA } from './git-policy.js';
 import { isMockPositiveSharedClaim, sharedRecordHasSecret } from './shared-memory-security.js';
+import { asRecordOrEmpty as asRecord } from '../json/records.js';
 export function validateGitPolicy(policy) {
     const issues = [];
     const row = asRecord(policy);
@@ -56,6 +57,3 @@ export async function validateSharedRecordFile(file, policy) {
         return { ok: false, checked: 1, issues: [`invalid_json:${err instanceof Error ? err.message : String(err)}`] };
     }
 }
-function asRecord(value) {
-    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
-}