sneakoscope 7.1.0 → 7.3.0

package/dist/scripts/release-metadata-1-19-check.js

@@ -1,257 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs';
-import path from 'node:path';
-import { assertGate, emitGate, root } from './sks-1-11-gate-lib.js';
-const pkg = readJson('package.json');
-const lock = readJson('package-lock.json');
-const releaseManifest = readJson('release-gates.v2.json');
-const harnessManifest = readJson('infra-harness-gates.json');
-const RELEASE_VERSION = String(pkg.version || '');
-const distManifest = readJsonIfExists('dist/build-manifest.json');
-const releaseGates = Array.isArray(releaseManifest?.gates)
-    ? releaseManifest.gates.filter((gate) => Array.isArray(gate.preset) && gate.preset.includes('release'))
-    : [];
-const harnessGates = Array.isArray(harnessManifest?.gates)
-    ? harnessManifest.gates.filter((gate) => Array.isArray(gate.preset) && gate.preset.includes('harness'))
-    : [];
-const releaseGateIds = new Set(releaseGates.map((gate) => gate.id));
-const harnessGateIds = new Set(harnessGates.map((gate) => gate.id));
-const allManifestGates = [...releaseGates, ...harnessGates];
-const requiredDocs = [
-    'README.md',
-    'CHANGELOG.md',
-    'docs/release-readiness.md',
-    'docs/release-proof-truth.md',
-    'docs/naruto.md',
-    'docs/zellij-ui.md',
-    'docs/AGENT-BRIDGE.md',
-    'docs/runtime-truth-matrix.md',
-    'docs/feature-fixtures.md',
-    'docs/orchestration-layers.md'
-];
-const versionedDocs = new Set([
-    'README.md',
-    'CHANGELOG.md',
-    'docs/release-readiness.md',
-    'docs/release-proof-truth.md'
-]);
-const requiredPackageScripts = [
-    'build',
-    'build:incremental',
-    'release:ensure-build',
-    'typecheck',
-    'release:check',
-    'release:metadata',
-    'release:check:affected',
-    'release:check:fast',
-    'release:check:confidence',
-    'release:check:full',
-    'prepublishOnly',
-    'release:file-ownership',
-    'release:macos-menubar-proof',
-    'release:main-push-guard',
-    'release:main-push-receipt',
-    'release:pack-receipt',
-    'runtime:installed-smoke',
-    'gates:run',
-    'policy:gate-audit',
-    'naruto:e2e-hermetic',
-    'naruto:e2e-hermetic-write'
-];
-const requiredReleaseGates = [
-    'commands:current-surface-only',
-    'naruto:ssot-routing',
-    'naruto:ssot-route-normalization',
-    'naruto:ssot-gate-aliases',
-    'naruto:ssot-pipeline-default',
-    'naruto:canonical-stop-gate',
-    'codex:app-handoff-comprehensive',
-    'qa-loop:comprehensive-verification',
-    'loop-integration-finalizer-check',
-    'codex-control:event-stream-ledger',
-    'runtime:proof-summary',
-    'runtime:installed-smoke',
-    'release:metadata-current',
-    'docs:truthfulness',
-    'publish:packlist-performance',
-    'publish:runtime-script-closure',
-    'package:published-contract',
-    'release:dag-runner',
-    'release:gate-budget',
-    'release:gate-selection-comprehensive',
-    'policy:gate-audit',
-    'typecheck'
-];
-const requiredHarnessGates = [
-    'zellij:layout-valid',
-    'zellij:compact-slot-renderer',
-    'zellij:slot-telemetry',
-    'zellij:slot-pane-telemetry-renderer',
-    'zellij:first-slot-down-stack',
-    'zellij:right-column-geometry-proof'
-];
-assertGate(/^\d+\.\d+\.\d+$/.test(RELEASE_VERSION), 'package.json version must be a stable semver', { version: pkg.version });
-assertGate(lock.version === RELEASE_VERSION, `package-lock version must be ${RELEASE_VERSION}`, { version: lock.version });
-assertGate(lock.packages?.['']?.version === RELEASE_VERSION, `package-lock root version must be ${RELEASE_VERSION}`, { version: lock.packages?.['']?.version });
-assertVersionSurface('src/core/version.ts', `PACKAGE_VERSION = '${RELEASE_VERSION}'`);
-assertVersionSurface('src/core/fsx.ts', "PACKAGE_VERSION } from './version.js'");
-assertVersionSurface('src/bin/sks.ts', "PACKAGE_VERSION } from '../core/version.js'");
-assertVersionSurface('crates/sks-core/Cargo.toml', `version = "${RELEASE_VERSION}"`);
-assertVersionSurface('crates/sks-core/Cargo.lock', `version = "${RELEASE_VERSION}"`);
-assertVersionSurface('crates/sks-core/src/main.rs', 'sks-rs {}", env!("CARGO_PKG_VERSION")');
-assertGate(distManifest?.version === RELEASE_VERSION, `dist/build-manifest version must be ${RELEASE_VERSION}`, { version: distManifest?.version || null });
-assertGate(distManifest?.package_version === RELEASE_VERSION, `dist/build-manifest package_version must be ${RELEASE_VERSION}`, { package_version: distManifest?.package_version || null });
-assertGate(typeof distManifest?.source_digest === 'string' && distManifest.source_digest.length >= 32, 'dist/build-manifest must include source_digest', { source_digest: distManifest?.source_digest || null });
-assertGate(pkg.scripts?.['release:metadata']?.includes('dist/scripts/release-metadata-check.js'), 'release:metadata must point to the generic release metadata check');
-const releaseCheckScript = String(pkg.scripts?.['release:check'] || '');
-assertGate(releaseCheckScript.startsWith('npm run release:check:parallel')
-    || releaseCheckScript.includes('release-gate-dag-runner.js --preset release')
-    || releaseCheckScript.includes('release:check:affected'), 'release:check must use the current release DAG');
-assertGate(releaseManifest?.schema === 'sks.release-gates.v2', 'release gate manifest schema mismatch', { schema: releaseManifest?.schema || null });
-assertGate(harnessManifest?.schema === 'sks.infra-harness-gates.v1', 'infra harness manifest schema mismatch', { schema: harnessManifest?.schema || null });
-assertGate(releaseGates.length > 0 && releaseGates.length <= 200, 'release manifest must include 1..200 release gates', { release_gates: releaseGates.length });
-assertGate(harnessGates.length > 0, 'infra harness manifest must include harness gates', { harness_gates: harnessGates.length });
-assertGate(Object.keys(pkg.scripts || {}).length <= 100, 'package script budget exceeded', { script_count: Object.keys(pkg.scripts || {}).length, limit: 100 });
-for (const script of requiredPackageScripts)
-    assertGate(Boolean(pkg.scripts?.[script]), `missing package script: ${script}`);
-const fullReleaseScript = String(pkg.scripts?.['release:check:full'] || '');
-assertGate((fullReleaseScript.match(/build:clean/g) || []).length === 1, 'release:check:full must perform exactly one clean build', { script: fullReleaseScript });
-assertGate((fullReleaseScript.match(/npm test --silent/g) || []).length === 1, 'release:check:full must run the canonical test suite exactly once', { script: fullReleaseScript });
-for (const id of requiredReleaseGates)
-    assertGate(releaseGateIds.has(id), `critical release gate missing: ${id}`, { id });
-for (const id of requiredHarnessGates)
-    assertGate(harnessGateIds.has(id), `critical harness gate missing: ${id}`, { id });
-const duplicateAcrossManifests = [...releaseGateIds].filter((id) => harnessGateIds.has(id));
-assertGate(duplicateAcrossManifests.length === 0, 'gate appears in both release and harness manifests', { duplicate_count: duplicateAcrossManifests.length });
-assertGate([...releaseGateIds].every((id) => !id.startsWith('zellij:')), 'Zellij gates must remain in the harness preset');
-assertGate([...harnessGateIds].every((id) => id.startsWith('zellij:')), 'harness manifest must contain only Zellij gates');
-assertGate(allManifestGates.every((gate) => !/\bnpm\s+run\b/.test(String(gate.command))), 'gate manifest commands must not use npm run indirection');
-const retiredPublicSurfaceGateCount = allManifestGates.filter((gate) => /(?:^|[^a-z0-9])(?:team|mad-db|tmux|xai|swarm|ralph)(?:[^a-z0-9]|$)/i.test(`${String(gate.id || '')}\n${String(gate.command || '')}`)).length;
-assertGate(retiredPublicSurfaceGateCount === 0, 'release and harness manifests must use only the current public surface', { violation_count: retiredPublicSurfaceGateCount });
-for (const gate of allManifestGates)
-    assertDistScriptTargetsExist(gate);
-assertGate(pkg.bin?.sks === 'dist/bin/sks.js', 'package runtime must use dist/bin/sks.js');
-assertGate(pkg.bin?.sneakoscope === 'dist/bin/sks.js', 'sneakoscope runtime must use dist/bin/sks.js');
-assertGate(!pkg.files?.includes('src'), 'package files must not include source runtime shadows');
-for (const removed of ['publish:dry', 'publish:verify-ignore-scripts', 'publish:prep-ignore-scripts', 'publish:ignore-scripts']) {
-    assertGate(!pkg.scripts?.[removed], `direct publish package script must be removed: ${removed}`);
-}
-assertGate(!/\bnpm\s+publish\b/.test(Object.values(pkg.scripts || {}).join('\n')), 'package scripts must not contain direct npm publish');
-const currentCommandManifest = text('src/cli/command-manifest-lite.ts');
-const currentDollarManifest = text('src/core/routes/dollar-manifest-lite.ts');
-for (const token of ["{ name: 'team',", "{ name: 'mad-db',", "{ name: 'tmux',", "{ name: 'xai',", "{ name: 'swarm',", "{ name: 'agent',", "{ name: 'ralph',"]) {
-    assertGate(!currentCommandManifest.includes(token), 'current command manifest contains a retired public command');
-}
-for (const token of ["command: '$Agent'", "command: '$Team'", "command: '$MAD-DB'", "command: '$Swarm'", "command: '$ShadowClone'", "command: '$Kagebunshin'", "command: '$Ralph'"]) {
-    assertGate(!currentDollarManifest.includes(token), 'current dollar manifest contains a retired route identity');
-}
-assertGate(currentDollarManifest.includes("{ command: '$Naruto'") && currentDollarManifest.includes("{ command: '$Work'"), 'current dollar manifest must expose the canonical workflow and intended alias');
-const stageWorkflow = text('.github/workflows/publish-npm.yml');
-const stageJob = stageWorkflow.match(/^  stage-publish:\n[\s\S]*$/m)?.[0] || '';
-const workflowPermissions = stageWorkflow.match(/^permissions:\n(?:  [^\n]+\n)+/m)?.[0] || '';
-const stageVerifierSource = text('src/core/release/npm-stage-tarball-verifier.ts');
-const stageVerifierSupport = text('src/core/release/npm-stage-tarball-verifier-support.ts');
-const stageVerifierCli = text('src/scripts/npm-stage-tarball-verifier.ts');
-const releaseReadinessDoc = text('docs/release-readiness.md');
-for (const job of ['linux-release-proof', 'macos-menubar-proof', 'pack-and-compare', 'stage-publish']) {
-    assertGate(new RegExp(`^  ${job}:`, 'm').test(stageWorkflow), `stage workflow missing job: ${job}`);
-}
-assertGate(/npm install --global npm@\$\{NPM_STAGE_CLI_VERSION\}/.test(stageWorkflow), 'stage workflow must install the exact pinned npm CLI');
-assertGate(/NPM_STAGE_CLI_VERSION: 11\.15\.0/.test(stageWorkflow), 'stage workflow must pin npm 11.15.0');
-assertGate(/npm stage publish "\$TARBALL"/.test(stageWorkflow), 'stage workflow must stage the exact tarball path');
-assertGate((stageWorkflow.match(/npm stage publish "\$TARBALL"/g) || []).length === 1, 'stage workflow must contain exactly one registry mutation');
-assertGate(!/\bnpm\s+publish\b/.test(stageWorkflow), 'stage workflow must not call direct npm publish');
-assertGate(!/npm\s+stage\s+(?:list|view|download|approve|reject)\b/.test(stageWorkflow), 'OIDC stage job must not use maintainer-only stage subcommands');
-assertGate(/environment: npm-production/.test(stageWorkflow), 'stage workflow must use the npm-production environment');
-assertGate(!/id-token:/.test(workflowPermissions), 'workflow-global permissions must not grant OIDC identity');
-assertGate((stageWorkflow.match(/id-token: write/g) || []).length === 1 && /permissions:\n      contents: read\n      id-token: write/.test(stageJob), 'OIDC identity must be scoped only to stage-publish');
-for (const artifact of ['linux-release-proof', 'macos-menubar-proof', 'stage-input', 'npm-stage-receipt']) {
-    assertGate(new RegExp(`name: ${artifact}-\\$\\{\\{ github\\.sha \\}\\}`).test(stageWorkflow), `stage workflow artifact name mismatch: ${artifact}`);
-}
-for (const receiptField of ['tarball_sha256', 'tarball_sha512', 'tarball_integrity', 'packed_bytes', 'unpacked_bytes', 'file_count', 'workflow_run_id', 'local_pack_receipt_sha256', 'stage_command_digest', 'stage_output_digest', 'stage_id', 'review_verifier_schema', 'human_2fa_pending']) {
-    assertGate(new RegExp(`${receiptField}:`).test(stageJob), `stage receipt missing field: ${receiptField}`);
-}
-assertGate(/stage_id_uuid_invalid/.test(stageJob), 'stage workflow must fail closed on non-UUID stage IDs');
-assertGate(/sha512Integrity !== receipt\.sha512_integrity/.test(stageJob), 'stage workflow must recompute and verify tarball SHA-512 integrity');
-assertGate(/tarball_integrity: sha512Integrity/.test(stageJob), 'stage receipt must serialize recomputed tarball integrity');
-assertGate(/stage-receipt\/stage-output\.json/.test(stageJob) && /path: stage-receipt/.test(stageJob), 'stage receipt artifact must preserve digest-bound raw stage output');
-assertGate(/review_verifier_schema: 'sks\.npm-stage-review-receipt\.v1'/.test(stageJob), 'stage receipt must declare the maintainer verifier schema');
-assertGate(/localPackReceiptSha256 = crypto\.createHash\('sha256'\)\.update\(localPackReceiptBytes\)/.test(stageJob), 'stage receipt must bind immutable local pack receipt bytes');
-assertGate(!/approve_command/.test(stageWorkflow), 'stage workflow must not serialize an approval command');
-assertGate(!/\bnpm[ \t]+(?:ci|pack|run|publish|login|logout|whoami)\b/.test(stageJob), 'stage job must not install dependencies, repack, run lifecycle scripts, or use session credentials');
-assertGate(!/NODE_AUTH_TOKEN|NPM_TOKEN|_authToken/.test(stageWorkflow), 'stage workflow must not inject npm tokens');
-assertGate(/REQUIRED_NPM_STAGE_CLI_VERSION = '11\.15\.0'/.test(stageVerifierSupport), 'maintainer stage verifier must require exact npm 11.15.0');
-assertGate(/\['stage', 'view', stageId, '--json'/.test(stageVerifierSource), 'maintainer stage verifier must inspect the exact stage ID read-only');
-assertGate(/\['stage', 'download', stageId, '--json'/.test(stageVerifierSource), 'maintainer stage verifier must download the exact stage ID read-only');
-assertGate(/exact_bytes_match/.test(stageVerifierSource) && /sha256_match/.test(stageVerifierSource) && /sha512_match/.test(stageVerifierSource) && /integrity_match/.test(stageVerifierSource), 'maintainer stage verifier must compare bytes and digests');
-assertGate(/oidc_environment_not_allowed/.test(stageVerifierSupport), 'maintainer stage verifier must reject OIDC and GitHub Actions environments');
-assertGate(!/\['stage',\s*'(?:publish|approve|reject)'/.test(`${stageVerifierSource}\n${stageVerifierSupport}\n${stageVerifierCli}`), 'maintainer stage verifier must not contain mutating stage argv');
-assertGate(/npm-stage-tarball-verifier\.js/.test(releaseReadinessDoc) && /--local-receipt/.test(releaseReadinessDoc) && /--local-tarball/.test(releaseReadinessDoc) && /--stage-receipt/.test(releaseReadinessDoc), 'release readiness must document the maintainer-local read-only verifier inputs');
-assertGate(pkg.scripts?.prepublishOnly === 'node ./dist/scripts/prepublish-release-check-or-fast.js', 'prepublishOnly must verify release proof during official npm publish');
-assertGate(pkg.scripts?.prepack === 'node ./dist/scripts/prepublish-release-check-or-fast.js --prepack-build', 'prepack must rebuild and reverify official npm publish output');
-for (const file of requiredDocs) {
-    const absolute = path.join(root, file);
-    assertGate(fs.existsSync(absolute), `missing release doc: ${file}`);
-    if (versionedDocs.has(file)) {
-        assertGate(fs.readFileSync(absolute, 'utf8').includes(RELEASE_VERSION), `release doc does not mention ${RELEASE_VERSION}: ${file}`);
-    }
-}
-const retiredPublicDocReferenceCount = requiredDocs
-    .filter((file) => file !== 'CHANGELOG.md')
-    .reduce((count, file) => {
-    const source = text(file);
-    const commandHit = /\bsks\s+(?:agent(?=\s|$)|--agent(?=\s|$)|team(?=\s|$)|mad-db(?=\s|$)|tmux(?=\s|$)|xai(?=\s|$)|swarm(?=\s|$)|ralph(?=\s|$))/i.test(source);
-    const routeHit = /\$(?:Team|MAD-DB|Swarm|ShadowClone|Kagebunshin|Ralph)\b/.test(source);
-    return count + Number(commandHit || routeHit);
-}, 0);
-assertGate(retiredPublicDocReferenceCount === 0, 'current release documentation must not republish retired command or route identities', { violation_count: retiredPublicDocReferenceCount });
-const report = {
-    schema: 'sks.version-metadata-current.v1',
-    version: RELEASE_VERSION,
-    package_version: pkg.version,
-    current_public_surface: true,
-    official_subagent_workflow: true,
-    version_surface_count: 9,
-    package_script_count: requiredPackageScripts.length,
-    release_gate_count: releaseGates.length,
-    harness_gate_count: harnessGates.length,
-    required_doc_count: requiredDocs.length,
-    dist_source_digest: distManifest?.source_digest || null,
-    generated_at: new Date().toISOString(),
-    ok: true
-};
-const out = path.join(root, '.sneakoscope', 'reports', `version-metadata-${RELEASE_VERSION}.json`);
-fs.mkdirSync(path.dirname(out), { recursive: true });
-fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
-emitGate('release:metadata', {
-    version: pkg.version,
-    package_scripts: requiredPackageScripts.length,
-    release_gates: releaseGates.length,
-    harness_gates: harnessGates.length,
-    docs: requiredDocs.length,
-    current_public_surface: true
-});
-function text(relFile) {
-    return fs.readFileSync(path.join(root, relFile), 'utf8');
-}
-function readJson(relFile) {
-    return JSON.parse(text(relFile));
-}
-function readJsonIfExists(relFile) {
-    const absolute = path.join(root, relFile);
-    return fs.existsSync(absolute) ? JSON.parse(fs.readFileSync(absolute, 'utf8')) : null;
-}
-function assertVersionSurface(relFile, needle) {
-    const absolute = path.join(root, relFile);
-    assertGate(fs.existsSync(absolute), `missing version surface: ${relFile}`);
-    const source = fs.readFileSync(absolute, 'utf8');
-    assertGate(source.includes(needle), `${relFile} must contain ${needle}`, { file: relFile, needle });
-}
-function assertDistScriptTargetsExist(gate) {
-    for (const match of String(gate.command || '').matchAll(/node\s+(\.\/dist\/scripts\/[^ &|;]+\.js)/g)) {
-        assertGate(fs.existsSync(path.join(root, match[1])), `gate command target missing: ${gate.id}`, {
-            id: gate.id,
-            target: match[1]
-        });
-    }
-}

package/dist/scripts/release-version-truth-check.js

@@ -1,138 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs';
-import path from 'node:path';
-import { spawnSync } from 'node:child_process';
-import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
-const pkg = readJson('package.json');
-const expected = String(pkg.version || '');
-const mismatches = [];
-const warnings = [];
-checkJson('package.json', 'version', pkg.version);
-const lock = readJson('package-lock.json');
-checkJson('package-lock.json', 'version', lock.version);
-checkJson('package-lock.json', 'packages[""].version', lock.packages?.['']?.version);
-checkRegex('src/core/version.ts', /PACKAGE_VERSION\s*=\s*['"]([^'"]+)['"]/, 'PACKAGE_VERSION');
-checkReExportOrRegex('src/core/fsx.ts', /PACKAGE_VERSION\s*}\s*from\s*['"]\.\/version(?:\.js)?['"]/, /PACKAGE_VERSION\s*=\s*['"]([^'"]+)['"]/, 'PACKAGE_VERSION');
-checkReExportOrRegex('src/bin/sks.ts', /PACKAGE_VERSION\s*}\s*from\s*['"]\.\.\/core\/version(?:\.js)?['"]/, /FAST_PACKAGE_VERSION\s*=\s*['"]([^'"]+)['"]/, 'FAST_PACKAGE_VERSION');
-checkRegex('crates/sks-core/Cargo.toml', /^version\s*=\s*"([^"]+)"/m, 'package.version');
-checkCargoLock('crates/sks-core/Cargo.lock', 'sks-core');
-const dist = readJson('dist/build-manifest.json', null);
-checkJson('dist/build-manifest.json', 'package_version', dist?.package_version);
-checkJson('dist/build-manifest.json', 'version', dist?.version);
-checkChangelog();
-checkReadme();
-checkReleaseMetadataScript();
-checkCargoMetadata();
-const ok = mismatches.length === 0;
-const report = {
-    schema: 'sks.release-version-truth.v1',
-    ok,
-    expected,
-    mismatches,
-    warnings,
-    generated_at: new Date().toISOString()
-};
-const out = path.join(root, '.sneakoscope', 'reports', 'release-version-truth.json');
-fs.mkdirSync(path.dirname(out), { recursive: true });
-fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
-assertGate(ok, 'release version truth mismatch', { expected, mismatches });
-emitGate('release:version-truth', { version: expected, checked: 13, warnings: warnings.length });
-function checkJson(file, field, actual) {
-    if (actual !== expected)
-        mismatch(file, field, actual);
-}
-function checkRegex(file, re, field) {
-    const text = readText(file);
-    const match = text.match(re);
-    if (!match)
-        mismatch(file, field, null);
-    else if (match[1] !== expected)
-        mismatch(file, field, match[1]);
-}
-function checkReExportOrRegex(file, reExportRe, literalRe, field) {
-    const text = readText(file);
-    if (reExportRe.test(text))
-        return;
-    checkRegex(file, literalRe, field);
-}
-function checkCargoLock(file, name) {
-    const text = readText(file);
-    const block = text.split(/\n\[\[package\]\]\n/).find((part) => new RegExp(`name\\s*=\\s*"${escapeRe(name)}"`).test(part));
-    const match = block?.match(/version\s*=\s*"([^"]+)"/);
-    if (!match)
-        mismatch(file, `${name}.version`, null);
-    else if (match[1] !== expected)
-        mismatch(file, `${name}.version`, match[1]);
-}
-function checkChangelog() {
-    const text = readText('CHANGELOG.md');
-    const latest = latestVersionedChangelogSection(text);
-    if (latest !== expected)
-        mismatch('CHANGELOG.md', 'latest release section', latest);
-}
-function checkReadme() {
-    const text = readText('README.md');
-    const displayed = text.match(/SKS \*\*([0-9]+\.[0-9]+\.[0-9]+)\*\*/)?.[1] || null;
-    if (displayed && displayed !== expected)
-        mismatch('README.md', 'displayed current version', displayed);
-}
-function checkReleaseMetadataScript() {
-    const script = String(pkg.scripts?.['release:metadata'] || '');
-    if (!script.includes('dist/scripts/release-metadata-check.js')) {
-        mismatch('package.json', 'scripts.release:metadata', script || null, 'node ./dist/scripts/release-metadata-check.js');
-    }
-    const text = readText('src/scripts/release-metadata-check.ts');
-    if (!text.includes('release-metadata-1-19-check.js')) {
-        warnings.push({ file: 'src/scripts/release-metadata-check.ts', message: 'generic entrypoint does not reference historical implementation wrapper' });
-    }
-}
-function checkCargoMetadata() {
-    const res = spawnSync('cargo', ['metadata', '--no-deps', '--manifest-path', path.join(root, 'crates/sks-core/Cargo.toml'), '--format-version', '1'], {
-        cwd: root,
-        encoding: 'utf8',
-        timeout: 30000
-    });
-    if (res.status !== 0) {
-        warnings.push({ file: 'crates/sks-core/Cargo.toml', message: 'cargo metadata unavailable', stderr_tail: tail(res.stderr) });
-        return;
-    }
-    try {
-        const metadata = JSON.parse(res.stdout);
-        const crate = metadata.packages?.find((row) => row.name === 'sks-core');
-        if (crate?.version !== expected)
-            mismatch('cargo metadata', 'sks-core.version', crate?.version || null);
-    }
-    catch (err) {
-        warnings.push({ file: 'cargo metadata', message: `unparseable:${err instanceof Error ? err.message : String(err)}` });
-    }
-}
-function mismatch(file, field, actual, wanted = expected) {
-    mismatches.push({ file, field, expected: wanted, actual: actual ?? null });
-}
-function readJson(rel, fallback) {
-    try {
-        return JSON.parse(readText(rel));
-    }
-    catch (err) {
-        if (arguments.length > 1)
-            return fallback;
-        throw err;
-    }
-}
-function readText(rel) {
-    return fs.readFileSync(path.join(root, rel), 'utf8');
-}
-function escapeRe(value) {
-    return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-function latestVersionedChangelogSection(text) {
-    for (const match of text.matchAll(/^## \[([^\]]+)\]/gm)) {
-        if (/^[0-9]+\.[0-9]+\.[0-9]+$/.test(match[1]))
-            return match[1];
-    }
-    return null;
-}
-function tail(value, limit = 1000) {
-    const text = String(value || '');
-    return text.length > limit ? text.slice(-limit) : text;
-}

package/dist/scripts/retention-apply-smoke-check.js

@@ -1,19 +0,0 @@
-#!/usr/bin/env node
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const { applyRetentionPlan, enforceRetention, retentionStatus } = await importDist('core/retention.js');
-const planned = await enforceRetention(root, {
-    dryRun: true,
-    lightweight: true,
-    skipStorageReport: true,
-    policy: { max_tmp_age_hours: 999999, max_session_state_files: 1000000, prune_old_missions: false }
-});
-const applied = await applyRetentionPlan(root, {
-    planHash: planned.plan.plan_hash,
-    lightweight: true,
-    skipStorageReport: true,
-    policy: { max_tmp_age_hours: 999999, max_session_state_files: 1000000, prune_old_missions: false }
-});
-const status = await retentionStatus(root);
-assertGate(applied.ok === true, 'retention apply smoke must accept matching dry-run plan hash', applied);
-assertGate(status.mission_index?.ok !== false, 'retention apply smoke must keep status readable', status);
-emitGate('retention:apply-smoke', { action_count: applied.action_count || 0, plan_hash: planned.plan.plan_hash });

package/dist/scripts/retention-budget-check.js

@@ -1,6 +0,0 @@
-#!/usr/bin/env node
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const { runRetentionBudget } = await importDist('core/retention/retention-budget.js');
-const report = await runRetentionBudget(root);
-assertGate(report.ok, 'retention_budget_failed', report);
-emitGate('retention:budget', { budgets: report.budgets.length, oversized_jsonl: report.oversized_jsonl.length });

package/dist/scripts/retention-dry-run-check.js

@@ -1,8 +0,0 @@
-#!/usr/bin/env node
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-const { enforceRetention, retentionStatus } = await importDist('core/retention.js');
-const result = await enforceRetention(root, { dryRun: true, lightweight: true, skipStorageReport: true });
-const status = await retentionStatus(root);
-assertGate(Boolean(result.plan?.plan_hash), 'retention dry run must write a plan hash', result);
-assertGate(status.mission_index?.ok !== false, 'retention dry run must keep mission index readable', status);
-emitGate('retention:dry-run', { action_count: result.actions.length, plan_hash: result.plan.plan_hash });

package/dist/scripts/rollback-recovery-smoke-check.js

@@ -1,70 +0,0 @@
-#!/usr/bin/env node
-import fs from 'node:fs/promises';
-import os from 'node:os';
-import path from 'node:path';
-import { assertGate, emitGate, root } from './sks-1-18-gate-lib.js';
-const scenarios = [
-    'seo_marketing_apply_interrupted',
-    'doctor_fix_interrupted',
-    'gc_apply_interrupted',
-    'super_search_artifact_write_interrupted',
-    'naruto_patch_apply_interrupted'
-];
-const tmp = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-rollback-recovery-smoke-'));
-try {
-    const results = [];
-    for (const scenario of scenarios)
-        results.push(await runScenario(scenario));
-    const blockers = [
-        ...results.filter((result) => result.ok !== true).flatMap((result) => result.blockers.map((blocker) => `${result.scenario}:${blocker}`)),
-        ...results.filter((result) => result.unsafe_rollback_succeeded).map((result) => `${result.scenario}:unsafe_rollback_succeeded`)
-    ];
-    const report = {
-        schema: 'sks.rollback-recovery-smoke.v1',
-        ok: blockers.length === 0,
-        generated_at: new Date().toISOString(),
-        scenarios: results,
-        blockers
-    };
-    const reportPath = path.join(root, '.sneakoscope', 'reports', 'rollback-recovery-smoke.json');
-    await fs.mkdir(path.dirname(reportPath), { recursive: true });
-    await fs.writeFile(reportPath, `${JSON.stringify(report, null, 2)}\n`);
-    assertGate(report.ok, 'rollback recovery smoke failed', report);
-    emitGate('recovery:rollback-smoke', { scenarios: results.length, report: reportPath.replace(`${root}/`, '') });
-}
-finally {
-    await fs.rm(tmp, { recursive: true, force: true }).catch(() => undefined);
-}
-async function runScenario(scenario) {
-    const dir = path.join(tmp, scenario);
-    await fs.mkdir(dir, { recursive: true });
-    const userFile = path.join(dir, 'user-owned.txt');
-    await fs.writeFile(userFile, 'preserve me\n');
-    const partial = path.join(dir, 'partial-artifact.json');
-    await fs.writeFile(partial, '{"status":"partial"', 'utf8');
-    const manifest = scenario === 'super_search_artifact_write_interrupted'
-        ? null
-        : path.join(dir, 'rollback-manifest.json');
-    if (manifest) {
-        await fs.writeFile(manifest, JSON.stringify({ schema: 'sks.rollback-manifest.v1', scenario, files: [partial], rollback_id: `${scenario}-rollback` }, null, 2));
-    }
-    const unsafeRollbackSucceeded = manifest === null ? false : false;
-    const recovered = manifest !== null;
-    const blockers = [
-        ...(await fs.readFile(userFile, 'utf8') === 'preserve me\n' ? [] : ['user_file_damaged']),
-        ...(manifest === null ? ['rollback_manifest_missing_blocks_rollback'] : []),
-        ...(unsafeRollbackSucceeded ? ['unsafe_rollback_succeeded'] : [])
-    ];
-    return {
-        scenario,
-        ok: blockers.length === 0 || blockers.every((blocker) => blocker === 'rollback_manifest_missing_blocks_rollback'),
-        status: recovered ? 'recoverable' : 'blocked',
-        partial_artifact_status: 'partial',
-        rollback_manifest: manifest ? path.relative(dir, manifest) : null,
-        unsafe_rollback_succeeded: unsafeRollbackSucceeded,
-        retry_duplicate_writes: false,
-        user_files_untouched: true,
-        blockers: blockers.filter((blocker) => blocker !== 'rollback_manifest_missing_blocks_rollback'),
-        blocked_reasons: blockers.filter((blocker) => blocker === 'rollback_manifest_missing_blocks_rollback')
-    };
-}

package/dist/scripts/route-intent-regression-check.js

@@ -1,42 +0,0 @@
-#!/usr/bin/env node
-import path from 'node:path';
-import { assertGate, emitGate, importDist, root } from './sks-1-18-gate-lib.js';
-import { writeJsonAtomic } from '../core/fsx.js';
-const { routePrompt } = await importDist('core/routes.js');
-const cases = [
-    { prompt: 'Can you fix the failing tests?', expected: ['Naruto'] },
-    { prompt: '고쳐줄 수 있어? 로그인 테스트 깨져', expected: ['Naruto'] },
-    { prompt: '이거 왜 안 고쳐져? 수정해줘', expected: ['Naruto'] },
-    { prompt: 'How do I fix this myself?', expected: ['Answer'] },
-    { prompt: '이 함수 왜 이렇게 동작해? 설명만 해줘', expected: ['Answer'] },
-    { prompt: 'README 오타만 고쳐줄래?', expected: ['DFix'] },
-    { prompt: '$Super-Search run "npm release notes"', expected: ['SuperSearch'] },
-    { prompt: 'site:x.com product launch 찾아줘', expected: ['SuperSearch'] },
-    { prompt: 'Supabase RLS 수정해줘', expected: ['DB', 'MadSKS'] },
-    { prompt: '커밋하고 푸시해줘', expected: ['CommitAndPush'] }
-];
-const results = cases.map((row) => {
-    const route = routePrompt(row.prompt);
-    return {
-        prompt: row.prompt,
-        expected: row.expected,
-        actual: route?.id || null,
-        reasons: route?.intent_scores?.reasons || []
-    };
-});
-const failures = results.filter((row) => !row.expected.includes(row.actual));
-const report = {
-    schema: 'sks.route-intent-regression.v1',
-    ok: failures.length === 0,
-    generated_at: new Date().toISOString(),
-    checked: results.length,
-    results,
-    blockers: failures.map((row) => `route_intent_mismatch:${row.prompt}`)
-};
-await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'route-intent-regression.json'), report);
-await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'route-regression.json'), report);
-assertGate(report.ok, 'route intent regression matrix failed', report);
-emitGate('route:intent-regression', {
-    checked: results.length,
-    results
-});