sneakoscope 7.1.0 → 7.3.0

package/dist/scripts/release-gate-dag-runner-check.js

@@ -2,7 +2,7 @@
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { assertGate, emitGate, importDist, readJson, readText } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist, readJson, readText } from './gate-lib.js';
 const pkg = readJson('package.json');
 const manifest = readJson('release-gates.v2.json');
 const runner = readText('src/core/release/release-gate-dag.ts');

package/dist/scripts/release-latency-slo-check.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { assertGate, emitGate, importDist, readJson, root } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist, readJson, root } from './gate-lib.js';
 const config = readJson('config/perf-budgets.v1.json');
 const budgets = Array.isArray(config.release_latency_slos) ? config.release_latency_slos : [];
 assertGate(config.schema === 'sks.perf-budgets.v1' && budgets.length === 6, 'release_latency_slo_config_invalid', {

package/dist/scripts/release-metadata-check.js

@@ -1,3 +1,257 @@
 #!/usr/bin/env node
-await import('./release-metadata-1-19-check.js');
-export {};
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, emitGate, root } from './sks-cli-gate-lib.js';
+const pkg = readJson('package.json');
+const lock = readJson('package-lock.json');
+const releaseManifest = readJson('release-gates.v2.json');
+const harnessManifest = readJson('infra-harness-gates.json');
+const RELEASE_VERSION = String(pkg.version || '');
+const distManifest = readJsonIfExists('dist/build-manifest.json');
+const releaseGates = Array.isArray(releaseManifest?.gates)
+    ? releaseManifest.gates.filter((gate) => Array.isArray(gate.preset) && gate.preset.includes('release'))
+    : [];
+const harnessGates = Array.isArray(harnessManifest?.gates)
+    ? harnessManifest.gates.filter((gate) => Array.isArray(gate.preset) && gate.preset.includes('harness'))
+    : [];
+const releaseGateIds = new Set(releaseGates.map((gate) => gate.id));
+const harnessGateIds = new Set(harnessGates.map((gate) => gate.id));
+const allManifestGates = [...releaseGates, ...harnessGates];
+const requiredDocs = [
+    'README.md',
+    'CHANGELOG.md',
+    'docs/release-readiness.md',
+    'docs/release-proof-truth.md',
+    'docs/naruto.md',
+    'docs/zellij-ui.md',
+    'docs/AGENT-BRIDGE.md',
+    'docs/runtime-truth-matrix.md',
+    'docs/feature-fixtures.md',
+    'docs/orchestration-layers.md'
+];
+const versionedDocs = new Set([
+    'README.md',
+    'CHANGELOG.md',
+    'docs/release-readiness.md',
+    'docs/release-proof-truth.md'
+]);
+const requiredPackageScripts = [
+    'build',
+    'build:incremental',
+    'release:ensure-build',
+    'typecheck',
+    'release:check',
+    'release:metadata',
+    'release:check:affected',
+    'release:check:fast',
+    'release:check:confidence',
+    'release:check:full',
+    'prepublishOnly',
+    'release:file-ownership',
+    'release:macos-menubar-proof',
+    'release:main-push-guard',
+    'release:main-push-receipt',
+    'release:pack-receipt',
+    'runtime:installed-smoke',
+    'gates:run',
+    'policy:gate-audit',
+    'naruto:e2e-hermetic',
+    'naruto:e2e-hermetic-write'
+];
+const requiredReleaseGates = [
+    'commands:current-surface-only',
+    'naruto:ssot-routing',
+    'naruto:ssot-route-normalization',
+    'naruto:ssot-gate-aliases',
+    'naruto:ssot-pipeline-default',
+    'naruto:canonical-stop-gate',
+    'codex:app-handoff-comprehensive',
+    'qa-loop:comprehensive-verification',
+    'loop-integration-finalizer-check',
+    'codex-control:event-stream-ledger',
+    'runtime:proof-summary',
+    'runtime:installed-smoke',
+    'release:metadata-current',
+    'docs:truthfulness',
+    'publish:packlist-performance',
+    'publish:runtime-script-closure',
+    'package:published-contract',
+    'release:dag-runner',
+    'release:gate-budget',
+    'release:gate-selection-comprehensive',
+    'policy:gate-audit',
+    'typecheck'
+];
+const requiredHarnessGates = [
+    'zellij:layout-valid',
+    'zellij:compact-slot-renderer',
+    'zellij:slot-telemetry',
+    'zellij:slot-pane-telemetry-renderer',
+    'zellij:first-slot-down-stack',
+    'zellij:right-column-geometry-proof'
+];
+assertGate(/^\d+\.\d+\.\d+$/.test(RELEASE_VERSION), 'package.json version must be a stable semver', { version: pkg.version });
+assertGate(lock.version === RELEASE_VERSION, `package-lock version must be ${RELEASE_VERSION}`, { version: lock.version });
+assertGate(lock.packages?.['']?.version === RELEASE_VERSION, `package-lock root version must be ${RELEASE_VERSION}`, { version: lock.packages?.['']?.version });
+assertVersionSurface('src/core/version.ts', `PACKAGE_VERSION = '${RELEASE_VERSION}'`);
+assertVersionSurface('src/core/fsx.ts', "PACKAGE_VERSION } from './version.js'");
+assertVersionSurface('src/bin/sks.ts', "PACKAGE_VERSION } from '../core/version.js'");
+assertVersionSurface('crates/sks-core/Cargo.toml', `version = "${RELEASE_VERSION}"`);
+assertVersionSurface('crates/sks-core/Cargo.lock', `version = "${RELEASE_VERSION}"`);
+assertVersionSurface('crates/sks-core/src/main.rs', 'sks-rs {}", env!("CARGO_PKG_VERSION")');
+assertGate(distManifest?.version === RELEASE_VERSION, `dist/build-manifest version must be ${RELEASE_VERSION}`, { version: distManifest?.version || null });
+assertGate(distManifest?.package_version === RELEASE_VERSION, `dist/build-manifest package_version must be ${RELEASE_VERSION}`, { package_version: distManifest?.package_version || null });
+assertGate(typeof distManifest?.source_digest === 'string' && distManifest.source_digest.length >= 32, 'dist/build-manifest must include source_digest', { source_digest: distManifest?.source_digest || null });
+assertGate(pkg.scripts?.['release:metadata']?.includes('dist/scripts/release-metadata-check.js'), 'release:metadata must point to the generic release metadata check');
+const releaseCheckScript = String(pkg.scripts?.['release:check'] || '');
+assertGate(releaseCheckScript.startsWith('npm run release:check:parallel')
+    || releaseCheckScript.includes('release-gate-dag-runner.js --preset release')
+    || releaseCheckScript.includes('release:check:affected'), 'release:check must use the current release DAG');
+assertGate(releaseManifest?.schema === 'sks.release-gates.v2', 'release gate manifest schema mismatch', { schema: releaseManifest?.schema || null });
+assertGate(harnessManifest?.schema === 'sks.infra-harness-gates.v1', 'infra harness manifest schema mismatch', { schema: harnessManifest?.schema || null });
+assertGate(releaseGates.length > 0 && releaseGates.length <= 200, 'release manifest must include 1..200 release gates', { release_gates: releaseGates.length });
+assertGate(harnessGates.length > 0, 'infra harness manifest must include harness gates', { harness_gates: harnessGates.length });
+assertGate(Object.keys(pkg.scripts || {}).length <= 100, 'package script budget exceeded', { script_count: Object.keys(pkg.scripts || {}).length, limit: 100 });
+for (const script of requiredPackageScripts)
+    assertGate(Boolean(pkg.scripts?.[script]), `missing package script: ${script}`);
+const fullReleaseScript = String(pkg.scripts?.['release:check:full'] || '');
+assertGate((fullReleaseScript.match(/build:clean/g) || []).length === 1, 'release:check:full must perform exactly one clean build', { script: fullReleaseScript });
+assertGate((fullReleaseScript.match(/npm test --silent/g) || []).length === 1, 'release:check:full must run the canonical test suite exactly once', { script: fullReleaseScript });
+for (const id of requiredReleaseGates)
+    assertGate(releaseGateIds.has(id), `critical release gate missing: ${id}`, { id });
+for (const id of requiredHarnessGates)
+    assertGate(harnessGateIds.has(id), `critical harness gate missing: ${id}`, { id });
+const duplicateAcrossManifests = [...releaseGateIds].filter((id) => harnessGateIds.has(id));
+assertGate(duplicateAcrossManifests.length === 0, 'gate appears in both release and harness manifests', { duplicate_count: duplicateAcrossManifests.length });
+assertGate([...releaseGateIds].every((id) => !id.startsWith('zellij:')), 'Zellij gates must remain in the harness preset');
+assertGate([...harnessGateIds].every((id) => id.startsWith('zellij:')), 'harness manifest must contain only Zellij gates');
+assertGate(allManifestGates.every((gate) => !/\bnpm\s+run\b/.test(String(gate.command))), 'gate manifest commands must not use npm run indirection');
+const retiredPublicSurfaceGateCount = allManifestGates.filter((gate) => /(?:^|[^a-z0-9])(?:team|mad-db|tmux|xai|swarm|ralph)(?:[^a-z0-9]|$)/i.test(`${String(gate.id || '')}\n${String(gate.command || '')}`)).length;
+assertGate(retiredPublicSurfaceGateCount === 0, 'release and harness manifests must use only the current public surface', { violation_count: retiredPublicSurfaceGateCount });
+for (const gate of allManifestGates)
+    assertDistScriptTargetsExist(gate);
+assertGate(pkg.bin?.sks === 'dist/bin/sks.js', 'package runtime must use dist/bin/sks.js');
+assertGate(pkg.bin?.sneakoscope === 'dist/bin/sks.js', 'sneakoscope runtime must use dist/bin/sks.js');
+assertGate(!pkg.files?.includes('src'), 'package files must not include source runtime shadows');
+for (const removed of ['publish:dry', 'publish:verify-ignore-scripts', 'publish:prep-ignore-scripts', 'publish:ignore-scripts']) {
+    assertGate(!pkg.scripts?.[removed], `direct publish package script must be removed: ${removed}`);
+}
+assertGate(!/\bnpm\s+publish\b/.test(Object.values(pkg.scripts || {}).join('\n')), 'package scripts must not contain direct npm publish');
+const currentCommandManifest = text('src/cli/command-manifest-lite.ts');
+const currentDollarManifest = text('src/core/routes/dollar-manifest-lite.ts');
+for (const token of ["{ name: 'team',", "{ name: 'mad-db',", "{ name: 'tmux',", "{ name: 'xai',", "{ name: 'swarm',", "{ name: 'agent',", "{ name: 'ralph',"]) {
+    assertGate(!currentCommandManifest.includes(token), 'current command manifest contains a retired public command');
+}
+for (const token of ["command: '$Agent'", "command: '$Team'", "command: '$MAD-DB'", "command: '$Swarm'", "command: '$ShadowClone'", "command: '$Kagebunshin'", "command: '$Ralph'"]) {
+    assertGate(!currentDollarManifest.includes(token), 'current dollar manifest contains a retired route identity');
+}
+assertGate(currentDollarManifest.includes("{ command: '$Naruto'") && currentDollarManifest.includes("{ command: '$Work'"), 'current dollar manifest must expose the canonical workflow and intended alias');
+const stageWorkflow = text('.github/workflows/publish-npm.yml');
+const stageJob = stageWorkflow.match(/^  stage-publish:\n[\s\S]*$/m)?.[0] || '';
+const workflowPermissions = stageWorkflow.match(/^permissions:\n(?:  [^\n]+\n)+/m)?.[0] || '';
+const stageVerifierSource = text('src/core/release/npm-stage-tarball-verifier.ts');
+const stageVerifierSupport = text('src/core/release/npm-stage-tarball-verifier-support.ts');
+const stageVerifierCli = text('src/scripts/npm-stage-tarball-verifier.ts');
+const releaseReadinessDoc = text('docs/release-readiness.md');
+for (const job of ['linux-release-proof', 'macos-menubar-proof', 'pack-and-compare', 'stage-publish']) {
+    assertGate(new RegExp(`^  ${job}:`, 'm').test(stageWorkflow), `stage workflow missing job: ${job}`);
+}
+assertGate(/npm install --global npm@\$\{NPM_STAGE_CLI_VERSION\}/.test(stageWorkflow), 'stage workflow must install the exact pinned npm CLI');
+assertGate(/NPM_STAGE_CLI_VERSION: 11\.15\.0/.test(stageWorkflow), 'stage workflow must pin npm 11.15.0');
+assertGate(/npm stage publish "\$TARBALL"/.test(stageWorkflow), 'stage workflow must stage the exact tarball path');
+assertGate((stageWorkflow.match(/npm stage publish "\$TARBALL"/g) || []).length === 1, 'stage workflow must contain exactly one registry mutation');
+assertGate(!/\bnpm\s+publish\b/.test(stageWorkflow), 'stage workflow must not call direct npm publish');
+assertGate(!/npm\s+stage\s+(?:list|view|download|approve|reject)\b/.test(stageWorkflow), 'OIDC stage job must not use maintainer-only stage subcommands');
+assertGate(/environment: npm-production/.test(stageWorkflow), 'stage workflow must use the npm-production environment');
+assertGate(!/id-token:/.test(workflowPermissions), 'workflow-global permissions must not grant OIDC identity');
+assertGate((stageWorkflow.match(/id-token: write/g) || []).length === 1 && /permissions:\n      contents: read\n      id-token: write/.test(stageJob), 'OIDC identity must be scoped only to stage-publish');
+for (const artifact of ['linux-release-proof', 'macos-menubar-proof', 'stage-input', 'npm-stage-receipt']) {
+    assertGate(new RegExp(`name: ${artifact}-\\$\\{\\{ github\\.sha \\}\\}`).test(stageWorkflow), `stage workflow artifact name mismatch: ${artifact}`);
+}
+for (const receiptField of ['tarball_sha256', 'tarball_sha512', 'tarball_integrity', 'packed_bytes', 'unpacked_bytes', 'file_count', 'workflow_run_id', 'local_pack_receipt_sha256', 'stage_command_digest', 'stage_output_digest', 'stage_id', 'review_verifier_schema', 'human_2fa_pending']) {
+    assertGate(new RegExp(`${receiptField}:`).test(stageJob), `stage receipt missing field: ${receiptField}`);
+}
+assertGate(/stage_id_uuid_invalid/.test(stageJob), 'stage workflow must fail closed on non-UUID stage IDs');
+assertGate(/sha512Integrity !== receipt\.sha512_integrity/.test(stageJob), 'stage workflow must recompute and verify tarball SHA-512 integrity');
+assertGate(/tarball_integrity: sha512Integrity/.test(stageJob), 'stage receipt must serialize recomputed tarball integrity');
+assertGate(/stage-receipt\/stage-output\.json/.test(stageJob) && /path: stage-receipt/.test(stageJob), 'stage receipt artifact must preserve digest-bound raw stage output');
+assertGate(/review_verifier_schema: 'sks\.npm-stage-review-receipt\.v1'/.test(stageJob), 'stage receipt must declare the maintainer verifier schema');
+assertGate(/localPackReceiptSha256 = crypto\.createHash\('sha256'\)\.update\(localPackReceiptBytes\)/.test(stageJob), 'stage receipt must bind immutable local pack receipt bytes');
+assertGate(!/approve_command/.test(stageWorkflow), 'stage workflow must not serialize an approval command');
+assertGate(!/\bnpm[ \t]+(?:ci|pack|run|publish|login|logout|whoami)\b/.test(stageJob), 'stage job must not install dependencies, repack, run lifecycle scripts, or use session credentials');
+assertGate(!/NODE_AUTH_TOKEN|NPM_TOKEN|_authToken/.test(stageWorkflow), 'stage workflow must not inject npm tokens');
+assertGate(/REQUIRED_NPM_STAGE_CLI_VERSION = '11\.15\.0'/.test(stageVerifierSupport), 'maintainer stage verifier must require exact npm 11.15.0');
+assertGate(/\['stage', 'view', stageId, '--json'/.test(stageVerifierSource), 'maintainer stage verifier must inspect the exact stage ID read-only');
+assertGate(/\['stage', 'download', stageId, '--json'/.test(stageVerifierSource), 'maintainer stage verifier must download the exact stage ID read-only');
+assertGate(/exact_bytes_match/.test(stageVerifierSource) && /sha256_match/.test(stageVerifierSource) && /sha512_match/.test(stageVerifierSource) && /integrity_match/.test(stageVerifierSource), 'maintainer stage verifier must compare bytes and digests');
+assertGate(/oidc_environment_not_allowed/.test(stageVerifierSupport), 'maintainer stage verifier must reject OIDC and GitHub Actions environments');
+assertGate(!/\['stage',\s*'(?:publish|approve|reject)'/.test(`${stageVerifierSource}\n${stageVerifierSupport}\n${stageVerifierCli}`), 'maintainer stage verifier must not contain mutating stage argv');
+assertGate(/npm-stage-tarball-verifier\.js/.test(releaseReadinessDoc) && /--local-receipt/.test(releaseReadinessDoc) && /--local-tarball/.test(releaseReadinessDoc) && /--stage-receipt/.test(releaseReadinessDoc), 'release readiness must document the maintainer-local read-only verifier inputs');
+assertGate(pkg.scripts?.prepublishOnly === 'node ./dist/scripts/prepublish-release-check-or-fast.js', 'prepublishOnly must verify release proof during official npm publish');
+assertGate(pkg.scripts?.prepack === 'node ./dist/scripts/prepublish-release-check-or-fast.js --prepack-build', 'prepack must rebuild and reverify official npm publish output');
+for (const file of requiredDocs) {
+    const absolute = path.join(root, file);
+    assertGate(fs.existsSync(absolute), `missing release doc: ${file}`);
+    if (versionedDocs.has(file)) {
+        assertGate(fs.readFileSync(absolute, 'utf8').includes(RELEASE_VERSION), `release doc does not mention ${RELEASE_VERSION}: ${file}`);
+    }
+}
+const retiredPublicDocReferenceCount = requiredDocs
+    .filter((file) => file !== 'CHANGELOG.md')
+    .reduce((count, file) => {
+    const source = text(file);
+    const commandHit = /\bsks\s+(?:agent(?=\s|$)|--agent(?=\s|$)|team(?=\s|$)|mad-db(?=\s|$)|tmux(?=\s|$)|xai(?=\s|$)|swarm(?=\s|$)|ralph(?=\s|$))/i.test(source);
+    const routeHit = /\$(?:Team|MAD-DB|Swarm|ShadowClone|Kagebunshin|Ralph)\b/.test(source);
+    return count + Number(commandHit || routeHit);
+}, 0);
+assertGate(retiredPublicDocReferenceCount === 0, 'current release documentation must not republish retired command or route identities', { violation_count: retiredPublicDocReferenceCount });
+const report = {
+    schema: 'sks.version-metadata-current.v1',
+    version: RELEASE_VERSION,
+    package_version: pkg.version,
+    current_public_surface: true,
+    official_subagent_workflow: true,
+    version_surface_count: 9,
+    package_script_count: requiredPackageScripts.length,
+    release_gate_count: releaseGates.length,
+    harness_gate_count: harnessGates.length,
+    required_doc_count: requiredDocs.length,
+    dist_source_digest: distManifest?.source_digest || null,
+    generated_at: new Date().toISOString(),
+    ok: true
+};
+const out = path.join(root, '.sneakoscope', 'reports', `version-metadata-${RELEASE_VERSION}.json`);
+fs.mkdirSync(path.dirname(out), { recursive: true });
+fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+emitGate('release:metadata', {
+    version: pkg.version,
+    package_scripts: requiredPackageScripts.length,
+    release_gates: releaseGates.length,
+    harness_gates: harnessGates.length,
+    docs: requiredDocs.length,
+    current_public_surface: true
+});
+function text(relFile) {
+    return fs.readFileSync(path.join(root, relFile), 'utf8');
+}
+function readJson(relFile) {
+    return JSON.parse(text(relFile));
+}
+function readJsonIfExists(relFile) {
+    const absolute = path.join(root, relFile);
+    return fs.existsSync(absolute) ? JSON.parse(fs.readFileSync(absolute, 'utf8')) : null;
+}
+function assertVersionSurface(relFile, needle) {
+    const absolute = path.join(root, relFile);
+    assertGate(fs.existsSync(absolute), `missing version surface: ${relFile}`);
+    const source = fs.readFileSync(absolute, 'utf8');
+    assertGate(source.includes(needle), `${relFile} must contain ${needle}`, { file: relFile, needle });
+}
+function assertDistScriptTargetsExist(gate) {
+    for (const match of String(gate.command || '').matchAll(/node\s+(\.\/dist\/scripts\/[^ &|;]+\.js)/g)) {
+        assertGate(fs.existsSync(path.join(root, match[1])), `gate command target missing: ${gate.id}`, {
+            id: gate.id,
+            target: match[1]
+        });
+    }
+}

package/dist/scripts/release-parallel-speed-budget-check.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import fs from 'node:fs';
 import path from 'node:path';
-import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, root } from './gate-lib.js';
 const currentRunDir = process.env.SKS_REPORT_DIR ? path.dirname(process.env.SKS_REPORT_DIR) : null;
 const latest = currentRunDir ? currentDagSummary(currentRunDir) : latestDagSummary();
 assertGate(Boolean(latest), 'release speed budget requires an actual DAG summary', {

package/dist/scripts/release-proof-truth-check.js

@@ -2,7 +2,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { writeReleaseProofTruth } from '../core/release/release-proof-truth.js';
-import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, root } from './gate-lib.js';
 const truth = await writeReleaseProofTruth(root);
 assertGate(truth.schema === 'sks.release-proof-truth.v1', 'release proof truth schema mismatch', truth);
 assertGate(truth.package_version === JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8')).version, 'release proof truth version mismatch', truth);

package/dist/scripts/release-provenance-check.js

@@ -2,7 +2,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
-import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, root } from './gate-lib.js';
 const args = process.argv.slice(2);
 const publish = args.includes('--publish');
 const pkg = readJson('package.json');
@@ -20,7 +20,9 @@ const latestChangelog = latestVersionedChangelogSection(readText('CHANGELOG.md')
 const tag = tagStatus(version, currentCommit);
 const candidate = candidateVersion();
 const originMain = originMainVersion();
-const npm = npmVersion();
+const npm = publish
+    ? npmVersion()
+    : { version: null, status: 'not_checked_in_dev_review' };
 const warnings = [];
 const blockers = [];
 if (candidate.version && candidate.version !== version)

package/dist/scripts/release-runtime-truth-matrix-check.js

@@ -2,7 +2,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { buildRuntimeTruthMatrix, writeRuntimeTruthMatrix } from '../core/proof/runtime-truth-matrix.js';
-import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, root } from './gate-lib.js';
 const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
 const matrix = await buildRuntimeTruthMatrix({
     root,

package/dist/scripts/research-blueprint-densifier-check.js

@@ -2,7 +2,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist } from './gate-lib.js';
 const research = await importDist('core/research.js');
 const workGraph = await importDist('core/research/research-work-graph.js');
 const cycleRunner = await importDist('core/research/research-cycle-runner.js');

package/dist/scripts/research-claim-builder-check.js

@@ -2,7 +2,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist } from './gate-lib.js';
 const research = await importDist('core/research.js');
 const workGraph = await importDist('core/research/research-work-graph.js');
 const cycleRunner = await importDist('core/research/research-cycle-runner.js');

package/dist/scripts/research-complete-package-fixture-check.js

@@ -2,7 +2,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist } from './gate-lib.js';
 const research = await importDist('core/research.js');
 const quality = await importDist('core/research/research-report-quality.js');
 const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-research-complete-package-'));

package/dist/scripts/research-execution-profile-routing-check.js

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import { runDirective315Gate } from './sks-3-1-5-directive-check-lib.js';
-await runDirective315Gate('research:execution-profile-routing');
+import { runTypedRoutingGate } from './typed-routing-gate-lib.js';
+await runTypedRoutingGate('research:execution-profile-routing');

package/dist/scripts/research-final-reviewer-blackbox.js

@@ -2,7 +2,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist } from './gate-lib.js';
 const research = await importDist('core/research.js');
 const reviewer = await importDist('core/research/research-final-reviewer.js');
 const fsx = await importDist('core/fsx.js');

package/dist/scripts/{sks-3-1-4-directive-check-lib.js → runtime-domain-gate-lib.js}

@@ -3,8 +3,8 @@ import fs from 'node:fs';
 import fsp from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-export async function runDirective314Gate(id) {
+import { assertGate, emitGate, importDist, root } from './gate-lib.js';
+export async function runRuntimeDomainGate(id) {
     if (id.startsWith('zellij:'))
         return zellijGate(id);
     if (id.startsWith('doctor:zellij'))

package/dist/scripts/runtime-proof-summary-check.js

@@ -3,7 +3,7 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { buildRuntimeProofSummary } from '../core/agents/runtime-proof-summary.js';
-import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate } from './gate-lib.js';
 const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-runtime-summary-'));
 const missionId = 'M-runtime-summary';
 const dir = path.join(root, '.sneakoscope', 'missions', missionId);

package/dist/scripts/runtime-script-pack-closure-check.js

@@ -5,11 +5,14 @@ import os from 'node:os';
 import path from 'node:path';
 import { DEFAULT_MAX_PACK_BYTES, DEFAULT_MAX_UNPACKED_BYTES } from '../core/release/package-size-budget.js';
 import { analyzeRuntimeScriptPackClosure } from '../core/release/runtime-script-pack-closure.js';
-import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, root } from './gate-lib.js';
 const MAX_FILES = Number(process.env.SKS_MAX_PACK_FILES || 2100);
 const MAX_PACKED = Number(process.env.SKS_MAX_PACK_BYTES || DEFAULT_MAX_PACK_BYTES);
 const MAX_UNPACKED = Number(process.env.SKS_MAX_UNPACKED_BYTES || DEFAULT_MAX_UNPACKED_BYTES);
 const analysis = analyzeRuntimeScriptPackClosure(root);
+assertGate(analysis.root_mode === 'manifest_ssot', 'runtime_script_manifest_ssot_disabled', {
+    root_mode: analysis.root_mode
+});
 assertGate(analysis.declaration_issues.length === 0, 'runtime_script_allowlist_declaration_invalid', {
     issues: analysis.declaration_issues
 });
@@ -28,6 +31,9 @@ assertGate(analysis.missing_from_allowlist.length === 0, 'runtime_script_allowli
 assertGate(analysis.stale_allowlist_entries.length === 0, 'runtime_script_allowlist_stale_entries', {
     stale: analysis.stale_allowlist_entries
 });
+assertGate(analysis.unclassified_reference_roots.length === 0, 'runtime_script_reference_source_unclassified', {
+    unclassified: analysis.unclassified_reference_roots
+});
 const npmCache = process.env.SKS_RELEASE_NPM_CACHE || path.join(os.tmpdir(), 'sneakoscope-npm-cache');
 fs.mkdirSync(npmCache, { recursive: true });
 const npmCli = process.env.npm_execpath;

package/dist/scripts/scheduler-batch-dispatch-check.js

@@ -3,7 +3,7 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { runAgentScheduler } from '../core/agents/agent-scheduler.js';
-import { assertGate, emitGate, readText } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, readText } from './gate-lib.js';
 assertGate(readText('src/core/agents/agent-scheduler.ts').includes('collectLaunchBatch') && readText('src/core/agents/agent-scheduler.ts').includes('batch_work_items_dispatched'), 'batch scheduler source wiring missing');
 const missionId = 'M-scheduler-batch';
 const ledgerRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-scheduler-batch-'));

package/dist/scripts/scheduler-parallel-proof-consistency-check.js

@@ -4,7 +4,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { runAgentScheduler } from '../core/agents/agent-scheduler.js';
 import { appendParallelRuntimeEvent, writeParallelRuntimeProof } from '../core/agents/parallel-runtime-proof.js';
-import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate } from './gate-lib.js';
 const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-scheduler-proof-consistency-'));
 const missionId = 'M-scheduler-proof-consistency';
 const workers = 4;

package/dist/scripts/scheduler-utilization-integral-check.js

@@ -3,7 +3,7 @@ import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
 import { runAgentScheduler } from '../core/agents/agent-scheduler.js';
-import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate } from './gate-lib.js';
 const sleepMs = 2000;
 async function runFixture(targetActiveSlots) {
     const root = await fs.mkdtemp(path.join(os.tmpdir(), `sks-scheduler-util-${targetActiveSlots}-`));

package/dist/scripts/search-visibility-gate-lib.js

@@ -3,7 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { tmpdir } from '../core/fsx.js';
-import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, root } from './gate-lib.js';
 export { assertGate, emitGate, root };
 export function makeSearchVisibilityFixture(name = 'search-visibility', options = {}) {
     const dir = tmpdir(`sks-${name}-`);

package/dist/scripts/secret-preservation-check.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import path from 'node:path';
-import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { assertGate, emitGate, makeTempRoot, writeText } from './skill-fixture-check-lib.js';
 import { captureSecretPreservationSnapshot } from '../core/config/secret-preservation.js';
 const root = await makeTempRoot('sks-secret-snapshot-');
 await writeText(path.join(root, '.env.local'), 'NEXT_PUBLIC_SUPABASE_URL=https://example.supabase.co\nNEXT_PUBLIC_SUPABASE_ANON_KEY=secret-value-123\n');

package/dist/scripts/seo-geo-geo-disambiguation-check.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist } from './gate-lib.js';
 const routes = await importDist('core/routes.js');
 const commandFor = (prompt) => routes.routePrompt(prompt)?.command;
 assertGate(commandFor('$SEO-GEO-OPTIMIZER improve AI answer visibility') === '$SEO-GEO-OPTIMIZER', 'explicit optimizer should route to unified route');

package/dist/scripts/seo-geo-skill-rich-content-check.js

@@ -2,7 +2,7 @@
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist } from './gate-lib.js';
 const root = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-seo-geo-skills-'));
 const init = await importDist('core/init.js');
 await init.installSkills(root);

package/dist/scripts/side-effect-runtime-report-check.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import fs from 'node:fs';
 import path from 'node:path';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist, root } from './gate-lib.js';
 const { buildSideEffectRuntimeReport } = await importDist('core/safety/side-effect-runtime-report.js');
 const report = await buildSideEffectRuntimeReport(root);
 const out = path.join(root, '.sneakoscope', 'reports', 'side-effect-runtime-report.json');

package/dist/scripts/{sks-3-1-8-check-lib.js → skill-fixture-check-lib.js}

@@ -1,7 +1,7 @@
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { assertGate, emitGate } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate } from './gate-lib.js';
 import { renderCoreSkillTemplate } from '../core/codex-native/core-skill-manifest.js';
 export { assertGate, emitGate };
 export async function makeTempRoot(prefix) {

package/dist/scripts/skill-name-canonicalizer-check.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { assertGate, emitGate } from './sks-3-1-8-check-lib.js';
+import { assertGate, emitGate } from './skill-fixture-check-lib.js';
 import { canonicalSkillName } from '../core/codex-native/skill-name-canonicalizer.js';
 for (const value of ['$Loop', 'loop', 'Loop', 'LOOP', 'loop ', 'loop.md', 'loop/SKILL.md']) {
     assertGate(canonicalSkillName(value) === 'loop', 'canonical skill name example failed', { value, got: canonicalSkillName(value) });

package/dist/scripts/skills-manifest-continuity-check.js

@@ -2,7 +2,7 @@
 import fs from 'node:fs';
 import fsp from 'node:fs/promises';
 import path from 'node:path';
-import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { assertGate, emitGate, makeTempRoot, writeText } from './skill-fixture-check-lib.js';
 import { installGlobalSkills } from '../core/init/skills.js';
 const root = process.cwd();
 const manifestPath = path.join(root, 'dist', 'config', 'skills-manifest.json');

package/dist/scripts/sks-uninstall-regression-check.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { assertGate, emitGate, makeTempRoot, writeText } from './sks-3-1-8-check-lib.js';
+import { assertGate, emitGate, makeTempRoot, writeText } from './skill-fixture-check-lib.js';
 import { uninstallCommand } from '../core/commands/uninstall-command.js';
 const home = await makeTempRoot('sks-uninstall-home-');
 const project = await makeTempRoot('sks-uninstall-project-');

package/dist/scripts/sksd-daemon-check.js

@@ -1,7 +1,7 @@
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist } from './gate-lib.js';
 const mod = await importDist('core/daemon/sksd-client.js');
 const fixtureRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-sksd-daemon-check-'));
 try {

package/dist/scripts/super-search-provider-interface-check.js

@@ -2,7 +2,7 @@
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist } from './gate-lib.js';
 const mod = await importDist('core/super-search/index.js');
 const missionDir = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-super-search-'));
 const originalFetch = globalThis.fetch;

package/dist/scripts/triwiki-cache-key-check.js

@@ -1,4 +1,4 @@
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist, root } from './gate-lib.js';
 const mod = await importDist('core/triwiki/triwiki-cache-key.js');
 const a = mod.computeTriWikiCacheKey({ root, id: 'triwiki:cache-key', inputs: ['package.json'], implementationFiles: ['src/core/triwiki/triwiki-cache-key.ts'], envAllowlist: ['CI'], fixtureVersion: 'sks-4.0.0' });
 const b = mod.computeTriWikiCacheKey({ root, id: 'triwiki:cache-key', inputs: ['package.json'], implementationFiles: ['src/core/triwiki/triwiki-cache-key.ts'], envAllowlist: ['CI'], fixtureVersion: 'sks-4.0.0' });

package/dist/scripts/triwiki-proof-bank-blackbox.js

@@ -1,7 +1,7 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { assertGate, emitGate, makeTempRoot } from './sks-3-1-8-check-lib.js';
-import { importDist } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, makeTempRoot } from './skill-fixture-check-lib.js';
+import { importDist } from './gate-lib.js';
 const tmp = await makeTempRoot('sks-triwiki-proof-bank-');
 await fs.writeFile(path.join(tmp, 'package.json'), JSON.stringify({ version: '4.0.0' }));
 await fs.writeFile(path.join(tmp, 'package-lock.json'), JSON.stringify({ lockfileVersion: 3 }));

package/dist/scripts/triwiki-proof-bank-check.js

@@ -1,4 +1,4 @@
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist, root } from './gate-lib.js';
 const bank = await importDist('core/triwiki/triwiki-proof-bank.js');
 const status = bank.summarizeTriWikiProofBank(root);
 assertGate(status.schema === 'sks.triwiki-proof-bank.v1' && status.ok === true, 'proof bank status must pass', status);

package/dist/scripts/triwiki-proof-card-check.js

@@ -1,4 +1,4 @@
-import { assertGate, emitGate, importDist } from './sks-1-18-gate-lib.js';
+import { assertGate, emitGate, importDist } from './gate-lib.js';
 const mod = await importDist('core/triwiki/triwiki-proof-card.js');
 const card = mod.createTriWikiProofCard({
     subject_type: 'gate',

package/dist/scripts/type-surface-codex-app-check.js

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import { runDirective315Gate } from './sks-3-1-5-directive-check-lib.js';
-await runDirective315Gate('type-surface:codex-app');
+import { runTypedRoutingGate } from './typed-routing-gate-lib.js';
+await runTypedRoutingGate('type-surface:codex-app');