sneakoscope 7.3.0 → 7.6.0

package/dist/core/codex-lb/probes/voice-realtime-probe.js

@@ -0,0 +1,44 @@
+import { probeEvidence } from './probe-evidence.js';
+export function runVoiceRealtimeProbe(input) {
+    const attempted = input.attempted === true
+        || input.createRouteVerified !== undefined
+        || input.websocketUpgraded !== undefined;
+    const transportComplete = input.createRouteVerified === true
+        && input.locationReceived === true
+        && input.locationRewritten === true
+        && input.websocketUpgraded === true
+        && input.serverEventSeen === true
+        && input.cleanClose === true
+        && input.ownerBindingVerified === true;
+    const blockers = [
+        ...(input.blockers || []),
+        ...(attempted && input.createRouteVerified !== true ? ['realtime_create_unauthorized'] : []),
+        ...(attempted && input.locationReceived !== true ? ['realtime_location_missing'] : []),
+        ...(attempted && input.locationReceived === true && input.locationRewritten !== true ? ['realtime_location_not_rewritten'] : []),
+        ...(attempted && input.websocketUpgraded !== true ? ['realtime_websocket_upgrade_failed'] : []),
+        ...(attempted && input.websocketUpgraded === true && input.serverEventSeen !== true ? ['realtime_sideband_event_missing'] : []),
+        ...(attempted && input.ownerBindingVerified !== true ? ['realtime_call_owner_binding_failed'] : [])
+    ];
+    return probeEvidence({
+        advertised: input.routeAdvertised === true,
+        attempted,
+        verified: input.level === 'deep' && transportComplete,
+        fixture: input.fixture,
+        source: input.level === 'deep' ? 'deep_probe' : attempted ? 'transport' : 'manifest',
+        unsupported: input.routeAdvertised === false && !attempted,
+        blockers,
+        warnings: transportComplete && input.level !== 'deep'
+            ? ['realtime_transport_verified_without_real_voice_session']
+            : [],
+        evidence: {
+            create_route_verified: input.createRouteVerified === true,
+            location_received: input.locationReceived === true,
+            location_rewritten: input.locationRewritten === true,
+            websocket_upgraded: input.websocketUpgraded === true,
+            server_event_seen: input.serverEventSeen === true,
+            clean_close: input.cleanClose === true,
+            owner_binding_verified: input.ownerBindingVerified === true,
+            fixture: input.fixture === true
+        }
+    }, input.checkedAt);
+}

package/dist/core/codex-lb/trusted-deep-evidence.js

@@ -0,0 +1,403 @@
+import { sha256 } from '../fsx.js';
+import { uniqueValues as unique } from '../text/strings.js';
+export const CODEX_LB_TRUSTED_DEEP_EVIDENCE_SCHEMA = 'sks.codex-lb-trusted-deep-evidence.v1';
+export const CODEX_LB_DEEP_EVIDENCE_TRUST_ANCHOR_SCHEMA = 'sks.codex-lb-deep-evidence-trust-anchor.v1';
+export const CODEX_LB_DEEP_EVIDENCE_TRUST_ANCHOR_SET_SCHEMA = 'sks.codex-lb-deep-evidence-trust-anchor-set.v1';
+export const CODEX_LB_DEEP_EVIDENCE_VALIDATION_SCHEMA = 'sks.codex-lb-deep-evidence-validation.v1';
+export const DEFAULT_CODEX_LB_DEEP_EVIDENCE_MAX_AGE_MS = 15 * 60 * 1000;
+const DEFAULT_FUTURE_SKEW_MS = 60 * 1000;
+const SHA256_PATTERN = /^[a-f0-9]{64}$/i;
+const ID_PATTERN = /^[a-z0-9][a-z0-9._:/-]{2,127}$/i;
+const PAYLOAD_KEYS = new Set([
+    'fixture',
+    'provider_identity_verified',
+    'picker_control_visible',
+    'picker_selected_model',
+    'configured_service_tier',
+    'request_service_tier',
+    'response_actual_service_tier',
+    'bridge_websocket_round_trip',
+    'image_route',
+    'image_request_tools_present',
+    'image_events',
+    'image_artifact_materialized',
+    'computer_events',
+    'computer_executor_completed',
+    'computer_output_submitted',
+    'computer_follow_up_completed',
+    'computer_session_affinity_preserved',
+    'browser_use_verified',
+    'voice_create_verified',
+    'voice_location_received',
+    'voice_location_rewritten',
+    'voice_websocket_upgraded',
+    'voice_server_event_seen',
+    'voice_clean_close',
+    'voice_owner_binding_verified',
+    'plugins_verified',
+    'auxiliary_routes_observed',
+    'auxiliary_events',
+    'auxiliary_output_events',
+    'auxiliary_request_body_hash_preserved',
+    'auxiliary_owner_affinity_verified',
+    'desktop_adoption_verified',
+    'desktop_adoption_source',
+    'oauth_bytes_unchanged_before_restart',
+    'oauth_semantic_identity_verified_after_restart',
+    'built_in_openai_provider_retained',
+    'fast_selector_visible',
+    'fast_effective_verified',
+    'text_response_verified',
+    'code_mcp_search_verified',
+    'files_transcribe_verified',
+    'memory_thread_goal_routes_verified',
+    'existing_thread_resumed',
+    'new_thread_created',
+    'disable_routing_verified',
+    'rollback_byte_exact_verified',
+    'app_restart_recovery_verified',
+    'mac_reboot_recovery_verified',
+    'remote_other_mac_runtime_verified',
+    'auth_mode_independence_verified',
+    'source_surface',
+    'desktop_build',
+    'codex_core_version',
+    'protocol_fixture_schema_hash',
+    'app_origin_observed'
+]);
+const BOOLEAN_PAYLOAD_KEYS = new Set([
+    'fixture',
+    'provider_identity_verified',
+    'picker_control_visible',
+    'bridge_websocket_round_trip',
+    'image_request_tools_present',
+    'image_artifact_materialized',
+    'computer_executor_completed',
+    'computer_output_submitted',
+    'computer_follow_up_completed',
+    'computer_session_affinity_preserved',
+    'browser_use_verified',
+    'voice_create_verified',
+    'voice_location_received',
+    'voice_location_rewritten',
+    'voice_websocket_upgraded',
+    'voice_server_event_seen',
+    'voice_clean_close',
+    'voice_owner_binding_verified',
+    'plugins_verified',
+    'auxiliary_request_body_hash_preserved',
+    'auxiliary_owner_affinity_verified',
+    'desktop_adoption_verified',
+    'oauth_bytes_unchanged_before_restart',
+    'oauth_semantic_identity_verified_after_restart',
+    'built_in_openai_provider_retained',
+    'fast_selector_visible',
+    'fast_effective_verified',
+    'text_response_verified',
+    'code_mcp_search_verified',
+    'files_transcribe_verified',
+    'memory_thread_goal_routes_verified',
+    'existing_thread_resumed',
+    'new_thread_created',
+    'disable_routing_verified',
+    'rollback_byte_exact_verified',
+    'app_restart_recovery_verified',
+    'mac_reboot_recovery_verified',
+    'remote_other_mac_runtime_verified',
+    'auth_mode_independence_verified'
+]);
+const NULLABLE_STRING_PAYLOAD_KEYS = new Set([
+    'picker_selected_model',
+    'configured_service_tier',
+    'request_service_tier',
+    'response_actual_service_tier',
+    'desktop_adoption_source',
+    'source_surface',
+    'desktop_build',
+    'codex_core_version',
+    'protocol_fixture_schema_hash',
+    'app_origin_observed'
+]);
+const ARRAY_PAYLOAD_KEYS = new Set([
+    'image_events',
+    'computer_events',
+    'auxiliary_routes_observed',
+    'auxiliary_events',
+    'auxiliary_output_events'
+]);
+export function validateCodexLbDesktopDeepEvidence(value, options) {
+    if (value == null)
+        return validation('available_unverified', ['codex_lb_deep_evidence_missing']);
+    const blockers = [];
+    if (!isRecord(value) || !hasExactKeys(value, ['schema', 'producer', 'created_at', 'target', 'payload', 'integrity'])) {
+        return validation('blocked', ['codex_lb_deep_evidence_schema_invalid']);
+    }
+    if (value.schema !== CODEX_LB_TRUSTED_DEEP_EVIDENCE_SCHEMA)
+        blockers.push('codex_lb_deep_evidence_schema_invalid');
+    const producer = parseProducer(value.producer, blockers, 'evidence');
+    const target = parseTarget(value.target, blockers, 'evidence');
+    const integrity = parseIntegrity(value.integrity, blockers);
+    const payload = parsePayload(value.payload, blockers);
+    const createdAt = typeof value.created_at === 'string' ? value.created_at : '';
+    const createdAtMs = Date.parse(createdAt);
+    if (!createdAt || !Number.isFinite(createdAtMs))
+        blockers.push('codex_lb_deep_evidence_created_at_invalid');
+    const expectedEndpoint = normalizeEndpoint(options.expectedEndpoint);
+    const evidenceEndpoint = target ? normalizeEndpoint(target.endpoint) : null;
+    if (!expectedEndpoint)
+        blockers.push('codex_lb_deep_evidence_expected_endpoint_invalid');
+    if (target && target.mode !== options.expectedMode)
+        blockers.push('codex_lb_deep_evidence_target_mode_mismatch');
+    if (target && (!evidenceEndpoint || evidenceEndpoint !== expectedEndpoint))
+        blockers.push('codex_lb_deep_evidence_target_endpoint_mismatch');
+    const nowMs = normalizeNow(options.now);
+    const maxAgeMs = positiveFinite(options.maxAgeMs, DEFAULT_CODEX_LB_DEEP_EVIDENCE_MAX_AGE_MS);
+    const futureSkewMs = positiveFinite(options.maxFutureSkewMs, DEFAULT_FUTURE_SKEW_MS);
+    if (Number.isFinite(createdAtMs) && createdAtMs < nowMs - maxAgeMs)
+        blockers.push('codex_lb_deep_evidence_stale');
+    if (Number.isFinite(createdAtMs) && createdAtMs > nowMs + futureSkewMs)
+        blockers.push('codex_lb_deep_evidence_created_at_in_future');
+    let contentSha256 = null;
+    if (producer && target && payload && createdAt && integrity) {
+        contentSha256 = codexLbDeepEvidenceContentSha256({
+            schema: CODEX_LB_TRUSTED_DEEP_EVIDENCE_SCHEMA,
+            producer,
+            created_at: createdAt,
+            target,
+            payload
+        });
+        if (integrity.content_sha256 !== contentSha256)
+            blockers.push('codex_lb_deep_evidence_content_sha256_mismatch');
+    }
+    const anchor = integrity
+        ? (options.trustAnchors || []).find((candidate) => candidate.anchor_id === integrity.trust_anchor_id)
+        : null;
+    if (!anchor) {
+        blockers.push('codex_lb_deep_evidence_trust_anchor_missing');
+    }
+    else {
+        validateAnchor(anchor, producer, target, contentSha256, blockers);
+    }
+    if (payload?.fixture === true) {
+        return {
+            ...validation('available_unverified', unique([...blockers, 'codex_lb_deep_evidence_fixture_unverified'])),
+            producer_id: producer?.id || null,
+            created_at: createdAt || null,
+            content_sha256: contentSha256,
+            trust_anchor_id: integrity?.trust_anchor_id || null
+        };
+    }
+    if (blockers.length || !payload) {
+        return {
+            ...validation('blocked', unique(blockers.length ? blockers : ['codex_lb_deep_evidence_invalid'])),
+            producer_id: producer?.id || null,
+            created_at: createdAt || null,
+            content_sha256: contentSha256,
+            trust_anchor_id: integrity?.trust_anchor_id || null
+        };
+    }
+    return {
+        schema: CODEX_LB_DEEP_EVIDENCE_VALIDATION_SCHEMA,
+        state: 'verified',
+        trusted: true,
+        evidence: payload,
+        producer_id: producer.id,
+        created_at: createdAt,
+        content_sha256: contentSha256,
+        trust_anchor_id: integrity.trust_anchor_id,
+        blockers: [],
+        warnings: []
+    };
+}
+export function codexLbDeepEvidenceContentSha256(content) {
+    return sha256(canonicalJson(content));
+}
+export function parseCodexLbDeepEvidenceTrustAnchorSet(value) {
+    if (!isRecord(value) || !hasExactKeys(value, ['schema', 'anchors'])) {
+        return {
+            schema: CODEX_LB_DEEP_EVIDENCE_TRUST_ANCHOR_SET_SCHEMA,
+            ok: false,
+            anchors: [],
+            blockers: ['codex_lb_deep_evidence_trust_anchor_set_invalid']
+        };
+    }
+    if (value.schema !== CODEX_LB_DEEP_EVIDENCE_TRUST_ANCHOR_SET_SCHEMA
+        || !Array.isArray(value.anchors)
+        || value.anchors.length === 0) {
+        return {
+            schema: CODEX_LB_DEEP_EVIDENCE_TRUST_ANCHOR_SET_SCHEMA,
+            ok: false,
+            anchors: [],
+            blockers: ['codex_lb_deep_evidence_trust_anchor_set_invalid']
+        };
+    }
+    const blockers = [];
+    const anchors = [];
+    const seen = new Set();
+    for (const [index, candidate] of value.anchors.entries()) {
+        const candidateBlockers = [];
+        validateAnchor(candidate, null, null, null, candidateBlockers);
+        const anchorId = isRecord(candidate) && typeof candidate.anchor_id === 'string'
+            ? candidate.anchor_id
+            : '';
+        if (anchorId && seen.has(anchorId))
+            candidateBlockers.push('codex_lb_deep_evidence_trust_anchor_duplicate');
+        if (anchorId)
+            seen.add(anchorId);
+        if (candidateBlockers.length) {
+            blockers.push(...candidateBlockers.map((blocker) => `${blocker}:${index}`));
+            continue;
+        }
+        anchors.push(candidate);
+    }
+    return {
+        schema: CODEX_LB_DEEP_EVIDENCE_TRUST_ANCHOR_SET_SCHEMA,
+        ok: blockers.length === 0 && anchors.length === value.anchors.length,
+        anchors: blockers.length === 0 ? anchors : [],
+        blockers: unique(blockers)
+    };
+}
+function validateAnchor(anchor, producer, target, contentSha256, blockers) {
+    if (!isRecord(anchor) || !hasExactKeys(anchor, ['schema', 'anchor_id', 'producer', 'target', 'content_sha256'])) {
+        blockers.push('codex_lb_deep_evidence_trust_anchor_invalid');
+        return;
+    }
+    if (anchor.schema !== CODEX_LB_DEEP_EVIDENCE_TRUST_ANCHOR_SCHEMA)
+        blockers.push('codex_lb_deep_evidence_trust_anchor_invalid');
+    if (typeof anchor.anchor_id !== 'string' || !ID_PATTERN.test(anchor.anchor_id))
+        blockers.push('codex_lb_deep_evidence_trust_anchor_invalid');
+    const anchorProducer = parseProducer(anchor.producer, blockers, 'anchor');
+    const anchorTarget = parseTarget(anchor.target, blockers, 'anchor');
+    if (!SHA256_PATTERN.test(anchor.content_sha256))
+        blockers.push('codex_lb_deep_evidence_trust_anchor_hash_invalid');
+    if (contentSha256 && anchor.content_sha256 !== contentSha256)
+        blockers.push('codex_lb_deep_evidence_trust_anchor_hash_mismatch');
+    if (producer && anchorProducer && canonicalJson(producer) !== canonicalJson(anchorProducer))
+        blockers.push('codex_lb_deep_evidence_trust_anchor_producer_mismatch');
+    if (target && anchorTarget && (target.mode !== anchorTarget.mode
+        || normalizeEndpoint(target.endpoint) !== normalizeEndpoint(anchorTarget.endpoint)))
+        blockers.push('codex_lb_deep_evidence_trust_anchor_target_mismatch');
+}
+function parseProducer(value, blockers, scope) {
+    if (!isRecord(value) || !hasExactKeys(value, ['id', 'version', 'run_id'])) {
+        blockers.push(`codex_lb_deep_evidence_${scope}_producer_invalid`);
+        return null;
+    }
+    for (const key of ['id', 'version', 'run_id']) {
+        if (typeof value[key] !== 'string' || !ID_PATTERN.test(value[key])) {
+            blockers.push(`codex_lb_deep_evidence_${scope}_producer_invalid`);
+            return null;
+        }
+    }
+    return value;
+}
+function parseTarget(value, blockers, scope) {
+    if (!isRecord(value) || !hasExactKeys(value, ['mode', 'endpoint'])) {
+        blockers.push(`codex_lb_deep_evidence_${scope}_target_invalid`);
+        return null;
+    }
+    if (!['desktop-native-bridge', 'desktop-dual-auth-compat', 'cli-provider', 'disabled'].includes(String(value.mode))) {
+        blockers.push(`codex_lb_deep_evidence_${scope}_target_invalid`);
+        return null;
+    }
+    if (typeof value.endpoint !== 'string' || !normalizeEndpoint(value.endpoint)) {
+        blockers.push(`codex_lb_deep_evidence_${scope}_target_invalid`);
+        return null;
+    }
+    return value;
+}
+function parseIntegrity(value, blockers) {
+    if (!isRecord(value) || !hasExactKeys(value, ['algorithm', 'content_sha256', 'trust_anchor_id'])) {
+        blockers.push('codex_lb_deep_evidence_integrity_invalid');
+        return null;
+    }
+    if (value.algorithm !== 'sha256'
+        || typeof value.content_sha256 !== 'string'
+        || !SHA256_PATTERN.test(value.content_sha256)
+        || typeof value.trust_anchor_id !== 'string'
+        || !ID_PATTERN.test(value.trust_anchor_id)) {
+        blockers.push('codex_lb_deep_evidence_integrity_invalid');
+        return null;
+    }
+    return value;
+}
+function parsePayload(value, blockers) {
+    if (!isRecord(value)) {
+        blockers.push('codex_lb_deep_evidence_payload_invalid');
+        return null;
+    }
+    const unknown = Object.keys(value).filter((key) => !PAYLOAD_KEYS.has(key));
+    if (unknown.length)
+        blockers.push('codex_lb_deep_evidence_payload_unknown_fields');
+    for (const [key, entry] of Object.entries(value)) {
+        if (BOOLEAN_PAYLOAD_KEYS.has(key) && typeof entry !== 'boolean')
+            blockers.push(`codex_lb_deep_evidence_payload_type_invalid:${key}`);
+        if (NULLABLE_STRING_PAYLOAD_KEYS.has(key) && entry !== null && typeof entry !== 'string')
+            blockers.push(`codex_lb_deep_evidence_payload_type_invalid:${key}`);
+        if (ARRAY_PAYLOAD_KEYS.has(key) && !Array.isArray(entry))
+            blockers.push(`codex_lb_deep_evidence_payload_type_invalid:${key}`);
+        if (key === 'image_route' && entry !== null && !['responses_tool', 'images_api'].includes(String(entry))) {
+            blockers.push('codex_lb_deep_evidence_payload_type_invalid:image_route');
+        }
+        if (key === 'auxiliary_routes_observed' && Array.isArray(entry) && entry.some((item) => typeof item !== 'string')) {
+            blockers.push('codex_lb_deep_evidence_payload_type_invalid:auxiliary_routes_observed');
+        }
+    }
+    return blockers.some((blocker) => blocker.startsWith('codex_lb_deep_evidence_payload_')) ? null : value;
+}
+function normalizeEndpoint(value) {
+    try {
+        const url = new URL(value);
+        if (!['http:', 'https:'].includes(url.protocol) || url.username || url.password || url.search || url.hash)
+            return null;
+        const pathname = url.pathname.replace(/\/+$/, '') || '/';
+        return `${url.protocol}//${url.host}${pathname}`;
+    }
+    catch {
+        return null;
+    }
+}
+function canonicalJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(canonicalJson).join(',')}]`;
+    if (isRecord(value)) {
+        return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalJson(value[key])}`).join(',')}}`;
+    }
+    return JSON.stringify(value) ?? 'null';
+}
+function normalizeNow(value) {
+    if (value instanceof Date)
+        return value.getTime();
+    if (typeof value === 'number' && Number.isFinite(value))
+        return value;
+    if (typeof value === 'string') {
+        const parsed = Date.parse(value);
+        if (Number.isFinite(parsed))
+            return parsed;
+    }
+    return Date.now();
+}
+function positiveFinite(value, fallback) {
+    return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : fallback;
+}
+function hasExactKeys(value, expected) {
+    const actual = Object.keys(value).sort();
+    return actual.length === expected.length && actual.every((key, index) => key === [...expected].sort()[index]);
+}
+function isRecord(value) {
+    return Boolean(value && typeof value === 'object' && !Array.isArray(value));
+}
+function validation(state, blockers) {
+    return {
+        schema: CODEX_LB_DEEP_EVIDENCE_VALIDATION_SCHEMA,
+        state,
+        trusted: false,
+        evidence: null,
+        producer_id: null,
+        created_at: null,
+        content_sha256: null,
+        trust_anchor_id: null,
+        blockers,
+        warnings: []
+    };
+}

package/dist/core/codex-native/core-skill-manifest.js

@@ -23,9 +23,9 @@ const CORE_SKILL_DEFINITIONS = [
         route: '$Naruto',
         purpose: 'run a Codex official subagent workflow with official agent threads while parent integration remains owner.',
         when: 'Use when the user explicitly invokes $Naruto or the selected route requires bounded parallel delegation.',
-        workflow: 'Run sks naruto run "<task>" [--agents N] [--max-threads N] [--json] with Codex official subagent threads only. The parent owns decomposition, per-wave capacity, later root-owned waves, integration, and final verification. Automatic targets begin at 4/6/8 by task size and may expand to 12 when independent useful slices and healthy host capacity remain positive; max_threads is a cap, never a target, and max_depth=1 blocks nested delegation. Route each slice to the narrowest matching Codex role and wait for every planned thread before final.',
+        workflow: 'Run sks naruto run "<task>" [--agents N] [--max-threads N] [--json] with Codex official subagent threads only. The parent owns decomposition, per-wave capacity, later root-owned waves, integration, and final verification. Automatic targets begin at 4/6/8 by task size and may expand to 12 when independent useful slices and healthy host capacity remain positive; max_threads is a cap, never a target, and max_depth=1 blocks nested delegation. Route each slice to the narrowest matching Codex role and wait for every planned thread before final. In an active Codex App Naruto mission, commit the strict parent evidence with sks naruto parent-summary --mission <id> --stdin, then return localized Markdown without exposing the JSON.',
         safety: 'Preserve user-authored content, inherit the parent permission mode, do not spawn nested subagents, do not inject the full pack or the full TriWiki context into every child, and do not fall back to another model, process runtime, custom scheduler, or worker pool. The historical Naruto process runtime is removed; stop with explicit blocker evidence when the official path is unavailable.',
-        cli: 'sks naruto run "<task>" [--agents N] [--max-threads N] [--json]; sks naruto status|subagents|proof [--mission <id>] [--json]',
+        cli: 'sks naruto run "<task>" [--agents N] [--max-threads N] [--json]; sks naruto status|subagents|proof [--mission <id>] [--json]; sks naruto parent-summary --mission <id> --stdin [--json]',
         evidence: 'subagent-plan.json, subagent-events.jsonl, subagent-parent-summary.json, subagent-evidence.json, naruto-summary.json, and naruto-gate.json.',
         fallback: 'Return explicit official-subagent availability blockers and continue parent-owned only when the sealed task still has meaningful in-scope work; never fabricate process, PID, or subagent evidence.'
     },
@@ -67,10 +67,13 @@ const CORE_SKILL_DEFINITIONS = [
         canonical_name: 'image-ux-review',
         display_name: 'image-ux-review',
         route: '$Image-UX-Review',
-        purpose: 'produce generated annotated UI review images and extract issue ledgers.',
-        when: 'Use for screenshot/UI UX review requests that require generated raster evidence.',
-        evidence: 'source inventory, generated annotation image ledger, issue ledger, iteration report.',
-        fallback: 'Block full verification if generated annotated images cannot be produced.'
+        purpose: 'run one screenshot-to-generated-annotation-to-UX-report pipeline without duplicate picker skills.',
+        when: 'Use for $Image-UX-Review, $UX-Review, $Visual-Review, or $UI-UX-Review requests; all aliases resolve to this one canonical skill.',
+        workflow: 'Capture or attach the real source screenshot first; web/browser/webapp capture must pass the Codex Chrome Extension readiness gate first, while Computer Use is reserved for native Mac/non-web surfaces. Send the source image as the I2I reference to the selected Codex imagegen provider with gpt-image-2 and a senior Toss UI/UX designer prompt that visibly adds numbered P0/P1/P2/P3 callouts, hierarchy, contrast, alignment, density, affordance, eye-flow arrows, and a corrected mini-comp. Then analyze the generated annotated image pixels with vision/OCR, not the source screenshot, and write the issue ledger, extraction report, and UX/UI change report with the generated image path and sha256.',
+        safety: 'Do not substitute text-only critique, a source-screenshot-only report, placeholders, partial image frames, mock evidence, or an unrelated API provider for the selected real imagegen path. Apply fixes only when requested and recheck changed screens.',
+        cli: 'sks ux-review run --image <path> [--fix] --json; legacy $sks-ux-review, $sks-visual-review, and $sks-ui-ux-review inputs route here internally.',
+        evidence: 'image-ux-screen-inventory.json, image-ux-gpt-image-2-request.json, image-ux-gpt-image-2-response.json, image-ux-generated-review-ledger.json, image-ux-issue-ledger.json, image-ux-callout-extraction-report.json, image-ux-iteration-report.json, and image-ux-review-gate.json.',
+        fallback: 'Block full verification if the real source screenshot, completed generated annotated image, generated-image callout extraction, or generated-image-based UX/UI report is unavailable.'
     },
     {
         id: 'sks-core-computer-use',
@@ -117,6 +120,19 @@ const CORE_SKILL_DEFINITIONS = [
         cli: 'sks seo-geo-optimizer doctor|audit|plan|apply|verify|status|rollback|fixture --mode seo|geo',
         evidence: 'SEO intent map, canonical URL map, metadata summary, JSON-LD summary, sitemap coverage summary, internal link plan, unsupported claims ledger, Search Console/analytics follow-up plan, site inventory, route graph, seo-findings.json or geo-findings.json, claim-evidence-ledger.json, ai-crawler-policy.json, llms-txt-plan.json, verification report, route gate, and Completion Proof.',
         fallback: 'Do not auto-allow training crawlers or fabricate AI answer visibility; mark missing live outcomes unverified and keep recovery on the unified optimizer route.'
+    },
+    {
+        id: 'sks-core-align',
+        canonical_name: 'align',
+        display_name: 'align',
+        route: '$Align',
+        purpose: 'run a one-shot modernization that aligns SKS prompts, settings, and skill/command surfaces to the latest GPT-5.6 official grammar and guides.',
+        when: 'Use when the user invokes $Align or asks to modernize SKS prompts, settings, skills, or command surfaces against current OpenAI latest-model, programmatic tool calling, agents, and openai/skills guidance.',
+        workflow: 'Run sks align prepare|run to create the skill-first mission, then execute the sealed workstreams: (1) align prompts/settings/skills to latest GPT-5.6 official prompting grammar from https://developers.openai.com/api/docs/guides/latest-model, (2) apply programmatic tool calling guidance from https://developers.openai.com/api/docs/guides/tools-programmatic-tool-calling, (3) apply agents guidance from https://developers.openai.com/api/docs/guides/agents, (4) deeply analyze https://github.com/openai/skills and current Plugins guidance and improve every SKS command/skill accordingly, (5) keep latest-version only with no legacy version compatibility and delete unnecessary old settings, (6) deduplicate redundant prompt/config content. Prefer Naruto for independent modernization slices. Update align-ledger.json continuously and pass align-gate.json before final.',
+        safety: 'Protect immutable core skills (mutable_by_doctor/update/setup=false). Do not invent fallbacks when official docs are unavailable. Do not keep legacy model-prompt compatibility knobs. Do not rewrite this align skill body via doctor/update/setup.',
+        cli: 'sks align prepare|run|status|proof ["scope"] [--json]',
+        evidence: 'align-plan.json, align-ledger.json, align-gate.json, completion-proof.json, changed-path inventory, deleted-legacy-settings list, deduplicated-surfaces list, and Honest Mode.',
+        fallback: 'If official GPT-5.6 / openai/skills guidance cannot be fetched, record blockers in align-ledger.json and keep align-gate.json unpassed; never fabricate modernization evidence.'
     }
 ];
 const LEGACY_CORE_DOLLAR_NAMES = Array.from(new Set(CORE_SKILL_DEFINITIONS.flatMap((skill) => [

package/dist/core/codex-runtime/codex-desktop-config-policy.js

@@ -247,7 +247,8 @@ export async function safeWriteCodexConfigToml(configPath, current, next, tag =
 }
 export function codexFastModeDesktopStatus(text = '') {
     const validation = validateCodexConfigRoundTrip(String(text || ''));
-    const globalOn = validation.ok && validation.service_tier === 'fast';
+    const normalizedServiceTier = String(validation.service_tier || '').toLowerCase();
+    const globalOn = validation.ok && (normalizedServiceTier === 'fast' || normalizedServiceTier === 'priority');
     return {
         schema: 'sks.codex-fast-mode-desktop-status.v2',
         ok: validation.ok,