sneakoscope 7.1.0 → 7.3.0

package/dist/core/release/main-push-guard.js

@@ -1,12 +1,41 @@
 import path from 'node:path';
 import { readMacosMenubarProof, validateMacosMenubarProofArtifacts } from './macos-menubar-proof.js';
-import { inspectReleaseClosure as inspectReleaseClosureContract, RELEASE_630_MISSION_ID as DEFAULT_RELEASE_MISSION_ID } from './release-closure.js';
-import { fileSha256, gitOk, gitText, readJson, unique } from './release-closure-helpers.js';
+import { fileSha256, gitOk, gitText, readJson, relative, unique } from './release-proof-io.js';
 import { releaseOriginIdentity } from './release-origin.js';
 import { releaseProofDir, validateLocalReleasePackBinding } from './release-pack-receipt.js';
 import { validateFullReleaseStamp } from './release-stamp-proof.js';
-export { buildReleaseClosureManifest, inspectReleaseClosure, releaseClosureManifestPath, RELEASE_630_MISSION_ID, RELEASE_CLOSURE_MANIFEST_SCHEMA, RELEASE_CLOSURE_SCHEMA, writeReleaseClosureManifest } from './release-closure.js';
+import { RELEASE_UPGRADE_BASELINE_SHA256, RELEASE_UPGRADE_BASELINE_VERSION, releaseUpgradeExpectedVersion, releaseUpgradeProofFilename } from './release-upgrade-baseline.js';
 export const MAIN_PUSH_GUARD_SCHEMA = 'sks.release-main-push-guard.v1';
+const RELEASE_UPGRADE_SMOKE_SCHEMA = 'sks.release-upgrade-smoke.v2';
+const RELEASE_UPGRADE_COMMAND_STAGES = Object.freeze([
+    'baseline_fetch',
+    'baseline_install',
+    'baseline_version',
+    'baseline_bootstrap',
+    'baseline_doctor',
+    'baseline_menubar_install',
+    'baseline_menubar_status',
+    'target_install',
+    'target_version',
+    'target_doctor',
+    'target_menubar_install',
+    'target_menubar_status',
+    'target_menubar_rollback',
+    'target_menubar_reinstall_install',
+    'target_menubar_reinstall_status',
+    'package_rollback_install',
+    'package_rollback_version',
+    'package_rollback_doctor'
+]);
+const RELEASE_UPGRADE_STATE_STAGES = Object.freeze({
+    baseline_package: ['baseline_install', 'baseline_version', 'baseline_bootstrap', 'baseline_doctor'],
+    baseline_menubar: ['baseline_menubar_install', 'baseline_menubar_status'],
+    target_package: ['target_install', 'target_version', 'target_doctor'],
+    target_menubar: ['target_menubar_install', 'target_menubar_status'],
+    menubar_rollback: ['target_menubar_rollback'],
+    target_menubar_reinstall: ['target_menubar_reinstall_install', 'target_menubar_reinstall_status'],
+    package_rollback: ['package_rollback_install', 'package_rollback_version', 'package_rollback_doctor']
+});
 export function inspectMainPushGuard(input) {
     const blockers = [];
     const pkg = readJson(path.join(input.root, 'package.json')) || {};
@@ -25,15 +54,6 @@ export function inspectMainPushGuard(input) {
         blockers.push('origin_main_not_ancestor_of_head');
     if (input.requireCleanTree && gitText(input.root, ['status', '--porcelain=v1']))
         blockers.push('worktree_not_clean');
-    const closure = inspectReleaseClosureContract({
-        root: input.root,
-        version: input.expectedVersion,
-        expectedHead: head,
-        expectedBaseline: input.expectedOriginMain,
-        expectedMissionId: input.expectedReleaseMissionId || DEFAULT_RELEASE_MISSION_ID,
-        ...(input.expectedWorkOrderSha256 === undefined ? {} : { expectedWorkOrderSha256: input.expectedWorkOrderSha256 })
-    });
-    blockers.push(...closure.blockers.map((blocker) => `release_closure:${blocker}`));
     const proofDir = releaseProofDir(input.root, input.expectedVersion);
     if (input.requireReleaseStamp !== true)
         blockers.push('release_stamp_requirement_missing');
@@ -67,7 +87,10 @@ export function inspectMainPushGuard(input) {
     if (input.requireMacosProof)
         blockers.push(...validateMacosMenubarProofArtifacts(input.root, macos, {
             version: input.expectedVersion,
-            ...(head ? { sourceCommit: head } : {})
+            ...(head ? { sourceCommit: head } : {}),
+            upgradeReportPath: upgrade.path,
+            upgradeReportSha256: upgrade.sha256,
+            targetTarballSha256: pack?.sha256
         }).blockers);
     if (input.requireCleanTree !== true)
         blockers.push('clean_tree_requirement_missing');
@@ -85,47 +108,73 @@ export function inspectMainPushGuard(input) {
         pack_proof: input.requirePackProof ? path.relative(input.root, path.join(proofDir, 'pack-receipt.json')) : null,
         upgrade_proof: upgrade,
         macos_proof: input.requireMacosProof ? path.relative(input.root, path.join(proofDir, 'macos-menubar-proof.json')) : null,
-        release_closure: closure,
         force_push_allowed: false,
         blockers: unique(blockers),
         checked_at: new Date().toISOString()
     };
 }
 export function validateReleaseUpgradeProof(root, version, sourceCommit, pack) {
-    const file = path.join(releaseProofDir(root, version), `upgrade-6.2-to-${version}.json`);
+    const file = path.join(releaseProofDir(root, version), releaseUpgradeProofFilename(version));
     const report = readJson(file);
     const blockers = [];
     const targetReceipt = path.join(releaseProofDir(root, version), 'pack-receipt.json');
     const targetTarball = pack?.tarball_path ? path.resolve(root, pack.tarball_path) : '';
-    const baselineSha = 'dd0bfc022348c11dc737055845708f6272beaf2a8f9c16d068acf3c8c612f9bc';
-    if (report?.schema !== 'sks.release-upgrade-smoke.v1')
+    const expectedReceiptPath = relative(root, targetReceipt);
+    const expectedTarballPath = targetTarball ? relative(root, targetTarball) : '';
+    const targetReceiptSha256 = fileSha256(targetReceipt);
+    if (report?.schema !== RELEASE_UPGRADE_SMOKE_SCHEMA)
         blockers.push('missing_or_invalid');
     if (report?.ok !== true || !Array.isArray(report?.blockers) || report.blockers.length)
         blockers.push('not_ok');
-    if (report?.platform !== 'darwin' || report?.baseline_version !== '6.2.0' || report?.target_version !== version)
+    if (report?.platform !== 'darwin' || report?.baseline_version !== RELEASE_UPGRADE_BASELINE_VERSION || report?.target_version !== version)
         blockers.push('version_or_platform_mismatch');
-    if (report?.baseline?.pinned_sha256 !== baselineSha || report?.baseline?.tarball_sha256 !== baselineSha)
+    if (!validTimestamp(report?.started_at) || !validTimestamp(report?.generated_at)
+        || Date.parse(report.generated_at) < Date.parse(report.started_at))
+        blockers.push('timestamp_invalid');
+    if (report?.baseline?.source !== 'registry'
+        || report?.baseline?.spec !== `sneakoscope@${RELEASE_UPGRADE_BASELINE_VERSION}`
+        || report?.baseline?.pinned_sha256 !== RELEASE_UPGRADE_BASELINE_SHA256
+        || report?.baseline?.tarball_sha256 !== RELEASE_UPGRADE_BASELINE_SHA256
+        || !validSha512(report?.baseline?.sha512_integrity)
+        || !/^[a-f0-9]{40}$/i.test(String(report?.baseline?.registry_shasum || ''))
+        || !Array.isArray(report?.baseline?.inspection_warnings))
         blockers.push('baseline_binding_mismatch');
     if (report?.source_tree?.ok !== true || report?.source_tree?.head !== sourceCommit
         || !Array.isArray(report?.source_tree?.dirty_entries) || report.source_tree.dirty_entries.length
         || !Array.isArray(report?.source_tree?.blockers) || report.source_tree.blockers.length)
         blockers.push('source_commit_mismatch');
-    if (report?.target?.binding_ok !== true || report?.target?.receipt_source_commit !== sourceCommit)
+    if (report?.target?.binding_ok !== true
+        || report?.target?.source_commit !== sourceCommit
+        || report?.target?.receipt_source_commit !== sourceCommit)
         blockers.push('target_source_commit_mismatch');
-    if (path.resolve(String(report?.target?.receipt_path || '')) !== targetReceipt)
+    if (report?.target?.package_version !== version)
+        blockers.push('target_package_version_mismatch');
+    if (portableProofPath(report?.root, report?.target?.receipt_path) !== expectedReceiptPath)
         blockers.push('target_receipt_path_mismatch');
-    if (!targetTarball || path.resolve(String(report?.target?.tarball_path || '')) !== targetTarball)
+    if (!targetTarball || portableProofPath(report?.root, report?.target?.tarball_path) !== expectedTarballPath)
         blockers.push('target_tarball_path_mismatch');
+    if (!targetReceiptSha256 || report?.target?.receipt_sha256 !== targetReceiptSha256)
+        blockers.push('target_receipt_sha256_mismatch');
     if (report?.target?.tarball_sha256 !== pack?.sha256)
         blockers.push('target_tarball_sha256_mismatch');
-    const stateNames = ['baseline_package', 'baseline_menubar', 'target_package', 'target_menubar', 'menubar_rollback', 'target_menubar_reinstall', 'package_rollback'];
+    if (report?.target?.tarball_sha512_integrity !== pack?.sha512_integrity)
+        blockers.push('target_tarball_integrity_mismatch');
+    if (report?.target?.npm_pack_proof?.proof_id !== pack?.npm_pack_proof?.proof_id
+        || report?.target?.npm_pack_proof?.info_sha256 !== pack?.npm_pack_proof?.info_sha256
+        || report?.target?.npm_pack_proof?.file_list_sha256 !== pack?.npm_pack_proof?.file_list_sha256) {
+        blockers.push('target_npm_pack_proof_mismatch');
+    }
+    const stateNames = Object.keys(RELEASE_UPGRADE_STATE_STAGES);
     if (Object.keys(report?.states || {}).length !== stateNames.length || stateNames.some((name) => {
         const state = report?.states?.[name];
-        const expected = name.startsWith('target_') ? version : '6.2.0';
+        const expected = releaseUpgradeExpectedVersion(name, version);
         return state?.status !== 'passed' || state?.expected_version !== expected || state?.observed_version !== expected
+            || !Array.isArray(state?.command_stages)
+            || !sameStringArray(state.command_stages, RELEASE_UPGRADE_STATE_STAGES[name])
             || !Array.isArray(state?.blockers) || state.blockers.length;
     }))
         blockers.push('lifecycle_incomplete');
+    validateReleaseUpgradeIsolationAndCommands(report, blockers);
     return {
         ok: blockers.length === 0,
         path: path.relative(root, file),
@@ -133,3 +182,218 @@ export function validateReleaseUpgradeProof(root, version, sourceCommit, pack) {
         blockers: unique(blockers)
     };
 }
+function validateReleaseUpgradeIsolationAndCommands(report, blockers) {
+    const isolation = report?.isolation || {};
+    const sandbox = String(isolation.sandbox || '');
+    const isolationPaths = {
+        home: isolation.home,
+        codex_home: isolation.codex_home,
+        npm_cache: isolation.npm_cache,
+        npm_prefix: isolation.npm_prefix,
+        npm_userconfig: isolation.npm_userconfig,
+        workspace: isolation.workspace,
+        baseline_pack_dir: isolation.baseline_pack_dir,
+        command_reports_dir: isolation.command_reports_dir,
+        sealed_inputs_dir: isolation.sealed_inputs_dir
+    };
+    if (!path.isAbsolute(sandbox))
+        blockers.push('isolation_sandbox_invalid');
+    for (const [name, value] of Object.entries(isolationPaths)) {
+        if (!path.isAbsolute(String(value || '')) || !lexicalSubpath(String(value || ''), sandbox)) {
+            blockers.push(`isolation_path_invalid:${name}`);
+        }
+    }
+    if (isolation.host_home_reused !== false
+        || isolation.host_codex_home_reused !== false
+        || isolation.host_npm_prefix_reused !== false)
+        blockers.push('host_isolation_reused');
+    if (isolation.retained !== false
+        || isolation.removed_after_success !== true
+        || isolation.cleanup_status !== 'removed'
+        || isolation.cleanup_error !== null)
+        blockers.push('sandbox_cleanup_incomplete');
+    const launchPolicy = report?.menubar_launch_policy;
+    if (launchPolicy?.applicable !== true
+        || launchPolicy?.launch_skipped !== true
+        || launchPolicy?.proof_scope !== 'bundle_install_status_rollback_only'
+        || launchPolicy?.separate_real_launch_proof_required !== true)
+        blockers.push('menubar_launch_policy_invalid');
+    const safety = report?.install_safety_policy;
+    if (safety?.host_process_mutation_allowed !== false
+        || safety?.host_session_mutation_allowed !== false
+        || safety?.postinstall_network_allowed !== false
+        || safety?.real_launchctl_allowed !== false
+        || !Array.isArray(safety?.postinstall_skip_env)
+        || safety.postinstall_skip_env.length === 0
+        || !path.isAbsolute(String(safety?.launchctl_stub_path || ''))
+        || !lexicalSubpath(String(safety?.launchctl_stub_path || ''), sandbox)
+        || !validSha256(safety?.launchctl_stub_sha256)
+        || !path.isAbsolute(String(safety?.launchctl_log_path || ''))
+        || !lexicalSubpath(String(safety?.launchctl_log_path || ''), sandbox)
+        || !Array.isArray(safety?.launchctl_calls)
+        || safety.launchctl_calls.some((call) => !/^(?:unsetenv (?:CODEX_LB_API_KEY|OPENROUTER_API_KEY)|print)$/.test(String(call)))
+        || !Array.isArray(safety?.launchctl_unexpected_calls)
+        || safety.launchctl_unexpected_calls.length > 0)
+        blockers.push('install_safety_policy_invalid');
+    if (!path.isAbsolute(String(report?.target?.sealed_tarball_path || ''))
+        || !lexicalSubpath(String(report?.target?.sealed_tarball_path || ''), String(isolation.sealed_inputs_dir || ''))) {
+        blockers.push('target_sealed_tarball_path_invalid');
+    }
+    if (!path.isAbsolute(String(report?.baseline?.sealed_tarball_path || ''))
+        || !lexicalSubpath(String(report?.baseline?.sealed_tarball_path || ''), String(isolation.sealed_inputs_dir || ''))) {
+        blockers.push('baseline_sealed_tarball_path_invalid');
+    }
+    const commands = Array.isArray(report?.commands) ? report.commands : [];
+    const stages = commands.map((command) => String(command?.stage || ''));
+    if (!sameStringArray(stages, RELEASE_UPGRADE_COMMAND_STAGES))
+        blockers.push('command_inventory_incomplete');
+    for (const command of commands)
+        validateReleaseUpgradeCommand(report, command, blockers);
+}
+function validateReleaseUpgradeCommand(report, command, blockers) {
+    const stage = String(command?.stage || '');
+    const isolation = report?.isolation || {};
+    const argv = Array.isArray(command?.argv) ? command.argv.map(String) : [];
+    const statusMayBeNotRunning = stage.endsWith('_menubar_status') || stage === 'target_menubar_reinstall_status';
+    if (!argv.length
+        || command?.cwd !== isolation.workspace
+        || command?.isolated_home !== isolation.home
+        || command?.isolated_codex_home !== isolation.codex_home
+        || command?.isolated_npm_cache !== isolation.npm_cache
+        || command?.isolated_npm_prefix !== isolation.npm_prefix
+        || command?.timed_out !== false
+        || (statusMayBeNotRunning ? ![0, 1].includes(command?.exit_code) : command?.exit_code !== 0)
+        || !Number.isFinite(command?.duration_ms)
+        || command.duration_ms < 0
+        || !validSha256(command?.stdout_sha256)
+        || !validSha256(command?.stderr_sha256)) {
+        blockers.push(`command_receipt_invalid:${stage || 'missing'}`);
+        return;
+    }
+    const npmPrefix = String(isolation.npm_prefix || '');
+    const sksBinary = path.join(npmPrefix, 'bin', 'sks');
+    const packageRoot = path.join(npmPrefix, 'lib', 'node_modules', 'sneakoscope');
+    const args = argv.slice(1);
+    const exact = (expected) => sameStringArray(args, expected);
+    let commandOk = true;
+    if (stage === 'baseline_fetch') {
+        commandOk = /^(?:npm|npm\.cmd)$/.test(path.basename(argv[0] || '')) && exact([
+            'pack',
+            `sneakoscope@${RELEASE_UPGRADE_BASELINE_VERSION}`,
+            '--ignore-scripts',
+            '--json',
+            '--pack-destination',
+            String(isolation.baseline_pack_dir || '')
+        ]);
+    }
+    else if (['baseline_install', 'target_install', 'package_rollback_install'].includes(stage)) {
+        const tarball = stage === 'target_install'
+            ? String(report?.target?.sealed_tarball_path || '')
+            : String(report?.baseline?.sealed_tarball_path || '');
+        commandOk = /^(?:npm|npm\.cmd)$/.test(path.basename(argv[0] || '')) && exact([
+            'install',
+            '--global',
+            '--prefix',
+            npmPrefix,
+            '--no-audit',
+            '--no-fund',
+            '--loglevel=error',
+            tarball
+        ]);
+    }
+    else if (stage.endsWith('_version')) {
+        commandOk = argv[0] === sksBinary && exact(['--version']);
+    }
+    else if (stage === 'baseline_bootstrap') {
+        commandOk = argv[0] === sksBinary && exact(['bootstrap', '--json']);
+    }
+    else if (stage.endsWith('_doctor')) {
+        const reportFile = path.join(String(isolation.command_reports_dir || ''), `${stage}.json`);
+        commandOk = argv[0] === sksBinary && exact(['doctor', '--json', '--report-file', reportFile]);
+        validateDoctorCommandReceipt(command, stage, reportFile, isolation, String(report?.target_version || ''), blockers);
+    }
+    else if (stage.endsWith('_menubar_install') || stage === 'target_menubar_reinstall_install') {
+        commandOk = argv[0] === sksBinary && exact([
+            'menubar', 'install', '--no-launch', '--json', '--home', String(isolation.home || ''), '--root', packageRoot
+        ]);
+    }
+    else if (stage.endsWith('_menubar_status') || stage === 'target_menubar_reinstall_status') {
+        commandOk = argv[0] === sksBinary && exact([
+            'menubar', 'status', '--json', '--home', String(isolation.home || ''), '--root', packageRoot
+        ]);
+    }
+    else if (stage === 'target_menubar_rollback') {
+        commandOk = argv[0] === sksBinary && exact([
+            'menubar', 'rollback', '--no-launch', '--json', '--home', String(isolation.home || ''), '--root', packageRoot
+        ]);
+    }
+    else {
+        commandOk = false;
+    }
+    if (!commandOk)
+        blockers.push(`command_argv_invalid:${stage || 'missing'}`);
+}
+function validateDoctorCommandReceipt(command, stage, reportFile, isolation, targetVersion, blockers) {
+    const binding = command?.report_file;
+    const requiredVersion = stage === 'target_doctor' ? targetVersion : RELEASE_UPGRADE_BASELINE_VERSION;
+    if (!binding
+        || binding.path !== reportFile
+        || binding.expected_package_version !== requiredVersion
+        || command?.json_schema !== 'sks.doctor-status.v3'
+        || command?.json_ok !== true) {
+        blockers.push(`doctor_command_receipt_invalid:${stage}`);
+        return;
+    }
+    if (binding.validation_mode === 'strict_report_file') {
+        if (binding.inside_sandbox !== true
+            || binding.regular_file !== true
+            || binding.symlink_refused !== false
+            || !validSha256(binding.sha256)
+            || !validSha256(binding.json_sha256)
+            || !validSha256(binding.stdout_json_sha256)
+            || binding.matches_stdout !== true
+            || binding.schema !== 'sks.doctor-status.v3'
+            || binding.ok !== true
+            || binding.root !== isolation.workspace)
+            blockers.push(`doctor_report_binding_invalid:${stage}`);
+    }
+    else if (stage !== 'target_doctor' && binding.validation_mode === 'pinned_baseline_stdout_only') {
+        if (binding.regular_file !== false
+            || binding.symlink_refused !== false
+            || binding.matches_stdout !== false
+            || !validSha256(binding.stdout_json_sha256))
+            blockers.push(`doctor_report_binding_invalid:${stage}`);
+    }
+    else {
+        blockers.push(`doctor_report_binding_invalid:${stage}`);
+    }
+}
+function portableProofPath(reportRootValue, fileValue) {
+    const reportRoot = String(reportRootValue || '');
+    const file = String(fileValue || '');
+    if (!path.isAbsolute(reportRoot) || !file)
+        return null;
+    const absolute = path.isAbsolute(file) ? path.resolve(file) : path.resolve(reportRoot, file);
+    const normalized = path.relative(path.resolve(reportRoot), absolute).split(path.sep).join('/');
+    if (!normalized || normalized.startsWith('../') || path.isAbsolute(normalized))
+        return null;
+    return normalized;
+}
+function lexicalSubpath(candidateValue, rootValue) {
+    if (!path.isAbsolute(candidateValue) || !path.isAbsolute(rootValue))
+        return false;
+    const relativePath = path.relative(path.resolve(rootValue), path.resolve(candidateValue));
+    return relativePath === '' || (!relativePath.startsWith('..') && !path.isAbsolute(relativePath));
+}
+function validSha256(value) {
+    return /^[a-f0-9]{64}$/i.test(String(value || ''));
+}
+function validSha512(value) {
+    return /^sha512-[A-Za-z0-9+/]+={0,2}$/.test(String(value || ''));
+}
+function validTimestamp(value) {
+    return typeof value === 'string' && !Number.isNaN(Date.parse(value));
+}
+function sameStringArray(left, right) {
+    return left.length === right.length && left.every((value, index) => String(value) === String(right[index]));
+}

package/dist/core/release/main-push-receipt.js

@@ -1,8 +1,8 @@
-import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
-import { inspectReleaseClosure, MAIN_PUSH_GUARD_SCHEMA, RELEASE_630_MISSION_ID, validateReleaseUpgradeProof } from './main-push-guard.js';
+import { MAIN_PUSH_GUARD_SCHEMA, validateReleaseUpgradeProof } from './main-push-guard.js';
 import { readMacosMenubarProof, validateMacosMenubarProofArtifacts } from './macos-menubar-proof.js';
+import { gitOk, gitText, readJson } from './release-proof-io.js';
 import { releaseProofDir, validateLocalReleasePackBinding } from './release-pack-receipt.js';
 import { validateFullReleaseStamp } from './release-stamp-proof.js';
 import { releaseOriginIdentity } from './release-origin.js';
@@ -16,7 +16,6 @@ export function inspectMainPushReceipt(input) {
     const origin = releaseOriginIdentity(input.root);
     const proofDir = releaseProofDir(input.root, input.version);
     const guard = readJson(path.join(proofDir, 'main-push-guard.json'));
-    const expectedMissionId = input.expectedReleaseMissionId || RELEASE_630_MISSION_ID;
     const releaseStamp = path.join('.sneakoscope', 'reports', 'release-check-stamp.json');
     const packProof = path.relative(input.root, path.join(proofDir, 'pack-receipt.json'));
     const macosProof = path.relative(input.root, path.join(proofDir, 'macos-menubar-proof.json'));
@@ -46,31 +45,6 @@ export function inspectMainPushReceipt(input) {
         blockers.push('pre_push_guard_origin_identity_mismatch');
     if (!Array.isArray(guard?.blockers) || guard.blockers.length > 0)
         blockers.push('pre_push_guard_blockers_present');
-    const closure = inspectReleaseClosure({
-        root: input.root,
-        version: input.version,
-        expectedHead: head,
-        expectedBaseline: input.baseline,
-        expectedMissionId,
-        ...(input.expectedWorkOrderSha256 === undefined ? {} : { expectedWorkOrderSha256: input.expectedWorkOrderSha256 })
-    });
-    if (!closure.ok)
-        blockers.push(...closure.blockers.map((blocker) => `release_closure:${blocker}`));
-    const guardedClosure = guard?.release_closure;
-    if (guardedClosure?.schema !== closure.schema || guardedClosure?.ok !== true
-        || !Array.isArray(guardedClosure?.blockers) || guardedClosure.blockers.length > 0) {
-        blockers.push('pre_push_guard_release_closure_missing_or_invalid');
-    }
-    if (guardedClosure?.head !== closure.head || guardedClosure?.source_commit !== closure.source_commit) {
-        blockers.push('pre_push_guard_release_closure_commit_mismatch');
-    }
-    if (guardedClosure?.mission_id !== expectedMissionId || guardedClosure?.mission_id !== closure.mission_id) {
-        blockers.push('pre_push_guard_release_closure_mission_mismatch');
-    }
-    if (guardedClosure?.manifest_path !== closure.manifest_path
-        || guardedClosure?.manifest_sha256 !== closure.manifest_sha256) {
-        blockers.push('pre_push_guard_release_closure_manifest_mismatch');
-    }
     const stampValidation = validateFullReleaseStamp({
         root: input.root,
         stampFile: path.join(input.root, releaseStamp),
@@ -94,7 +68,13 @@ export function inspectMainPushReceipt(input) {
         || guard?.upgrade_proof?.sha256 !== upgrade.sha256)
         blockers.push('pre_push_guard_upgrade_proof_mismatch');
     const macos = readMacosMenubarProof(input.root, input.version);
-    const macosValidation = validateMacosMenubarProofArtifacts(input.root, macos, { version: input.version, sourceCommit: head });
+    const macosValidation = validateMacosMenubarProofArtifacts(input.root, macos, {
+        version: input.version,
+        sourceCommit: head,
+        upgradeReportPath: upgrade.path,
+        upgradeReportSha256: upgrade.sha256,
+        targetTarballSha256: pack?.sha256
+    });
     if (!macosValidation.ok)
         blockers.push(...macosValidation.blockers);
     return {
@@ -112,8 +92,8 @@ export function inspectMainPushReceipt(input) {
         method: input.method,
         release_stamp: releaseStamp,
         pack_proof: packProof,
+        upgrade_proof: upgrade,
         macos_proof: macosProof,
-        release_closure: closure,
         blockers: [...new Set(blockers)]
     };
 }
@@ -130,18 +110,3 @@ function gitRemoteMain(root) {
     const value = String(result.stdout || '').trim().split(/\s+/, 1)[0] || '';
     return /^[a-f0-9]{40}$/i.test(value) ? value : '';
 }
-function readJson(file) {
-    try {
-        return JSON.parse(fs.readFileSync(file, 'utf8'));
-    }
-    catch {
-        return null;
-    }
-}
-function gitText(root, args) {
-    const result = spawnSync('git', args, { cwd: root, encoding: 'utf8' });
-    return result.status === 0 ? String(result.stdout || '').trim() : '';
-}
-function gitOk(root, args) {
-    return spawnSync('git', args, { cwd: root, stdio: 'ignore' }).status === 0;
-}

package/dist/core/release/package-size-budget.js

@@ -1,2 +1,2 @@
 export const DEFAULT_MAX_PACK_BYTES = 2510 * 1024;
-export const DEFAULT_MAX_UNPACKED_BYTES = 11_260_000;
+export const DEFAULT_MAX_UNPACKED_BYTES = 11_425_000;

package/dist/core/release/release-gate-contract.js

@@ -1,6 +1,7 @@
 import crypto from 'node:crypto';
 export const RELEASE_GATE_CONTRACT_SCHEMA = 'sks.release-gate-contract.v1';
 export const RELEASE_GATE_CONTRACT_IDS = Object.freeze([
+    'agent-guidance:dedup',
     'agent:message-bus-reader',
     'all-features:deep-completion',
     'appshots:thread-attachment-discovery',
@@ -99,6 +100,7 @@ export const RELEASE_GATE_CONTRACT_IDS = Object.freeze([
     'publish:runtime-script-closure',
     'python-sdk:all-pipelines',
     'qa-loop:comprehensive-verification',
+    'quality:helper-dedup',
     'release:aggressive-resource-governor',
     'release:batch-runner-comprehensive',
     'release:cache-key-comprehensive',

package/dist/core/release/release-pack-receipt.js

@@ -332,7 +332,7 @@ const RETIRED_SURFACE_ALLOWLIST = [
     { path: /^dist\/scripts\/docs-truthfulness-check\.js$/, kinds: new Set(['retired_ralph_identity']) },
     { path: /^dist\/scripts\/naruto-ssot-(?:routing|route-normalization|gate-aliases|pipeline-default)-check\.js$/, kinds: new Set(['retired_cli_command', 'retired_dollar_command', 'retired_team_runtime_identity']) },
     { path: /^dist\/scripts\/upgrade-migration-matrix-check\.js$/, kinds: new Set(['retired_team_workdir']) },
-    { path: /^dist\/scripts\/(?:current-command-surface-check|current-surface-update-e2e-check|current-upgrade-matrix-check|legacy-gate-inventory-check|legacy-gate-purge-check|legacy-strong-inventory-check|release-metadata-1-19-check|runtime-current-terminal-check)\.js$/, kinds: new Set(RETIRED_SURFACE_PATTERNS.map((pattern) => pattern.kind)) }
+    { path: /^dist\/scripts\/(?:current-command-surface-check|current-surface-update-e2e-check|current-upgrade-matrix-check|legacy-gate-inventory-check|legacy-gate-purge-check|legacy-strong-inventory-check|release-metadata-check|runtime-current-terminal-check)\.js$/, kinds: new Set(RETIRED_SURFACE_PATTERNS.map((pattern) => pattern.kind)) }
 ];
 function retiredSurfaceFindingAllowed(finding) {
     return RETIRED_SURFACE_ALLOWLIST.some((rule) => rule.path.test(finding.file) && rule.kinds.has(finding.kind));

package/dist/core/release/release-proof-io.js

@@ -0,0 +1,33 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+export function unique(values) {
+    return [...new Set(values)];
+}
+export function relative(root, file) {
+    return path.relative(root, file).split(path.sep).join('/');
+}
+export function fileSha256(file) {
+    try {
+        return crypto.createHash('sha256').update(fs.readFileSync(file)).digest('hex');
+    }
+    catch {
+        return null;
+    }
+}
+export function readJson(file) {
+    try {
+        return JSON.parse(fs.readFileSync(file, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+export function gitText(root, args) {
+    const result = spawnSync('git', args, { cwd: root, encoding: 'utf8' });
+    return result.status === 0 ? String(result.stdout || '').trim() : '';
+}
+export function gitOk(root, args) {
+    return spawnSync('git', args, { cwd: root, stdio: 'ignore' }).status === 0;
+}

package/dist/core/release/release-upgrade-baseline.js

@@ -0,0 +1,9 @@
+export const RELEASE_UPGRADE_BASELINE_VERSION = '6.2.0';
+export const RELEASE_UPGRADE_BASELINE_LABEL = '6.2';
+export const RELEASE_UPGRADE_BASELINE_SHA256 = 'dd0bfc022348c11dc737055845708f6272beaf2a8f9c16d068acf3c8c612f9bc';
+export function releaseUpgradeProofFilename(targetVersion) {
+    return `upgrade-${RELEASE_UPGRADE_BASELINE_LABEL}-to-${targetVersion}.json`;
+}
+export function releaseUpgradeExpectedVersion(stateName, targetVersion) {
+    return stateName.startsWith('target_') ? targetVersion : RELEASE_UPGRADE_BASELINE_VERSION;
+}