sneakoscope 7.3.0 → 7.6.0

package/dist/core/commands/triwiki-graph-command.js

@@ -0,0 +1,160 @@
+import { flag, readOption } from '../../cli/args.js';
+import { CONTEXT_GRAPH_REPAIR_COMMAND } from '../triwiki/context-graph/contracts.js';
+import { contextGraphFreshnessPreflight } from '../hooks-runtime/context-graph-freshness-preflight.js';
+import { contextGraphExtractors } from '../triwiki/context-graph/extractors/index.js';
+import { runContextGraphLint } from '../triwiki/context-graph/lint/index.js';
+import { contextGraphQueryProfile } from '../triwiki/context-graph/profiles.js';
+import { queryContextGraph } from '../triwiki/context-graph/query/index.js';
+import { contextGraphStatus } from '../triwiki/context-graph/store/graph-status.js';
+import { readContextGraphMeta, readContextGraphSnapshot } from '../triwiki/context-graph/store/snapshot-store.js';
+export const TRIWIKI_GRAPH_SUBCOMMANDS = ['graph-status', 'graph-lint', 'graph-query'];
+export function isTriWikiGraphSubcommand(value) {
+    return typeof value === 'string' && TRIWIKI_GRAPH_SUBCOMMANDS.includes(value);
+}
+function issueLine(issue) {
+    const where = issue.nodeId ?? issue.edgeId ?? issue.path ?? '';
+    return `${issue.severity}: ${issue.code}${where ? ` ${where}` : ''} — ${issue.message}`;
+}
+async function graphStatusFast(root) {
+    const preflight = await contextGraphFreshnessPreflight(root);
+    return {
+        result: { ...preflight, mode: 'fast', ok: preflight.usable },
+        ok: preflight.usable,
+        lines: [
+            `Context graph: ${preflight.status} (${preflight.node_count} nodes, ${preflight.edge_count} edges, ${preflight.coverage})`,
+            ...(preflight.reasons.length ? [`Stale reasons: ${preflight.reasons.join(', ')}`] : []),
+            ...(preflight.unverified_reasons.length ? [`Not evaluated: ${preflight.unverified_reasons.join(', ')}`] : []),
+            ...(preflight.usable ? [] : [`Repair: ${preflight.repair_command}`])
+        ]
+    };
+}
+async function graphStatus(root) {
+    const status = await contextGraphStatus(root, { extractors: contextGraphExtractors() });
+    const meta = await readContextGraphMeta(root);
+    const result = {
+        schema: 'sks.triwiki-graph-status.v1',
+        ok: status.status === 'fresh',
+        status: status.status,
+        snapshot_hash: status.snapshotHash,
+        generated_at: status.generatedAt,
+        stale_reasons: status.reasons,
+        error_code: status.errorCode,
+        node_count: status.nodeCount,
+        edge_count: status.edgeCount,
+        lint: meta.status === 'ok' && meta.meta ? meta.meta.lint : null,
+        repair_command: status.repairCommand
+    };
+    const lines = [
+        `Context graph: ${status.status} (${status.nodeCount} nodes, ${status.edgeCount} edges)`,
+        ...(status.snapshotHash ? [`Snapshot: ${status.snapshotHash.slice(0, 16)}`] : []),
+        ...(status.reasons.length ? [`Stale reasons: ${status.reasons.join(', ')}`] : []),
+        ...(status.status === 'fresh' ? [] : [`Repair: ${status.repairCommand}`])
+    ];
+    return { result, ok: result.ok, lines };
+}
+async function graphLint(root) {
+    const snapshotLoad = await readContextGraphSnapshot(root);
+    if (snapshotLoad.status !== 'ok' || !snapshotLoad.snapshot) {
+        const errorCode = snapshotLoad.status === 'missing' ? 'context_graph_missing' : 'context_graph_corrupt';
+        return {
+            result: {
+                schema: 'sks.triwiki-graph-lint.v1',
+                ok: false,
+                error_code: errorCode,
+                errors: [],
+                warnings: [],
+                repair_command: CONTEXT_GRAPH_REPAIR_COMMAND
+            },
+            ok: false,
+            lines: [`Context graph lint: ${errorCode}`, `Repair: ${CONTEXT_GRAPH_REPAIR_COMMAND}`]
+        };
+    }
+    const meta = await readContextGraphMeta(root);
+    const lint = runContextGraphLint({
+        root,
+        snapshot: snapshotLoad.snapshot,
+        meta: meta.status === 'ok' ? meta.meta : null
+    });
+    const result = {
+        schema: 'sks.triwiki-graph-lint.v1',
+        ok: lint.ok,
+        snapshot_hash: snapshotLoad.snapshot.snapshotHash,
+        error_count: lint.errorCount,
+        warning_count: lint.warningCount,
+        errors: lint.errors.map(issueLine),
+        warnings: lint.warnings.slice(0, 40).map(issueLine),
+        repair_command: CONTEXT_GRAPH_REPAIR_COMMAND
+    };
+    return {
+        result,
+        ok: lint.ok,
+        lines: [
+            `Context graph lint: ${lint.ok ? 'ok' : 'blocked'} (${lint.errorCount} errors, ${lint.warningCount} warnings)`,
+            ...lint.errors.slice(0, 20).map((issue) => `- ${issueLine(issue)}`)
+        ]
+    };
+}
+async function graphQuery(root, args) {
+    const query = args.find((arg) => !arg.startsWith('-')) ?? '';
+    const profile = contextGraphQueryProfile(readOption(args, '--profile', 'implementation')).name;
+    const budgetRaw = readOption(args, '--token-budget', '');
+    const parsedBudget = budgetRaw ? Number.parseInt(String(budgetRaw), 10) : Number.NaN;
+    if (!query) {
+        return {
+            result: { schema: 'sks.triwiki-graph-query.v1', ok: false, errors: ['missing_query'] },
+            ok: false,
+            lines: ['Usage: sks triwiki graph-query "<query>" [--profile implementation|review|planning|answer] [--json]']
+        };
+    }
+    const answer = await queryContextGraph({
+        root,
+        query,
+        profile,
+        ...(Number.isFinite(parsedBudget) ? { tokenBudget: parsedBudget } : {})
+    });
+    const result = {
+        schema: 'sks.triwiki-graph-query.v1',
+        ok: answer.ok,
+        profile: answer.profile,
+        snapshot_hash: answer.snapshotHash,
+        snapshot_freshness: answer.snapshotFreshness,
+        seed_count: answer.seedCount,
+        visited_nodes: answer.visitedNodes,
+        selected: answer.selected.map((node) => ({
+            id: node.nodeId,
+            kind: node.kind,
+            path: node.path ?? null,
+            score: node.score,
+            trust: node.trust,
+            freshness: node.freshness,
+            token_cost: node.tokenCost,
+            reason_path: node.reasonPath,
+            provenance: node.provenance
+        })),
+        provenance_coverage: answer.provenanceCoverage,
+        stale_excluded: answer.staleExcluded,
+        invalidated_excluded: answer.invalidatedExcluded,
+        token_cost: answer.tokenCost,
+        token_budget: answer.tokenBudget,
+        truncated: answer.truncated,
+        timeout: answer.timeout,
+        omission_reasons: answer.omissionReasons,
+        warnings: answer.warnings,
+        errors: answer.errors,
+        repair_command: CONTEXT_GRAPH_REPAIR_COMMAND
+    };
+    const lines = answer.ok
+        ? [
+            `Context graph query (${answer.profile}): ${answer.selected.length} nodes, ${answer.tokenCost}/${answer.tokenBudget} tokens`,
+            ...answer.selected.slice(0, 12).map((node) => `- ${node.nodeId}  [${node.reasonPath.join(' ')}]`)
+        ]
+        : [`Context graph query blocked: ${answer.errors.join(', ')}`, `Repair: ${CONTEXT_GRAPH_REPAIR_COMMAND}`];
+    return { result, ok: answer.ok, lines };
+}
+export async function triwikiGraphCommand(root, sub, args) {
+    if (sub === 'graph-status')
+        return flag(args, '--fast') ? graphStatusFast(root) : graphStatus(root);
+    if (sub === 'graph-lint')
+        return graphLint(root);
+    return graphQuery(root, args.filter((arg) => arg !== 'graph-query' && !flag([arg], '--json')));
+}

package/dist/core/commands/wiki-command.js

@@ -20,8 +20,15 @@ import { wrongnessContextForRoute } from '../triwiki-wrongness/wrongness-retriev
 import { readCombinedWrongnessRecords } from '../triwiki-wrongness/wrongness-ledger.js';
 import { recordImageWrongnessFromValidation } from '../triwiki-wrongness/image-wrongness.js';
 import { publishSharedMemory, rebuildSharedIndexes, sharedMemorySummary, validateSharedMemory } from '../git-hygiene/shared-memory-publish.js';
-import { scanCodebaseIndex } from '../triwiki/code-index-scanner.js';
-import { buildCodePack, validateCodePack, writeCodePackAtomic } from '../triwiki/code-pack.js';
+import { codePackPath, isCodePackProjectionBoundToSnapshot, validateCodePack, writeCodePackAtomic } from '../triwiki/code-pack.js';
+import { repairTriWikiProofIndex } from '../triwiki/triwiki-proof-bank-index.js';
+import { runContextGraphLint } from '../triwiki/context-graph/lint/index.js';
+import { contextGraphStatus } from '../triwiki/context-graph/store/graph-status.js';
+import { readContextGraphMeta, readContextGraphSnapshot } from '../triwiki/context-graph/store/snapshot-store.js';
+import { compileContextGraph } from '../triwiki/context-graph/compiler/index.js';
+import { contextGraphExtractors } from '../triwiki/context-graph/extractors/index.js';
+import { buildWorkspaceCodePack } from '../triwiki/context-graph/projections/code-pack-workspace.js';
+import { CONTEXT_GRAPH_REPAIR_COMMAND } from '../triwiki/context-graph/contracts.js';
 import { inspectCodePackHeadFreshness } from '../triwiki/code-pack-head-freshness.js';
 import { sealTriWikiContextPack, validateTriWikiContextPackProvenance } from '../triwiki-provenance.js';
 import { flag, positionalArgs, readFlagValue, readOption, resolveMissionId } from './command-utils.js';
@@ -205,46 +212,119 @@ export async function wikiCommand(sub, args = []) {
         const pack = await readJson(path.resolve(target));
         const { result, trustAnchors } = wikiValidationResult(pack, root);
         const codePack = await codePackFreshness(root);
-        process.exitCode = result.ok ? 0 : 2;
-        if (flag(args, '--json'))
-            return console.log(JSON.stringify({ ...result, code_pack: codePack }, null, 2));
+        const graph = await wikiValidateContextGraph(root);
+        const ok = result.ok && graph.ok;
+        process.exitCode = ok ? 0 : 2;
+        if (flag(args, '--json')) {
+            return console.log(JSON.stringify({ ...result, ok, code_pack: codePack, context_graph: graph }, null, 2));
+        }
         console.log(`Wiki coordinate index: ${result.ok ? 'ok' : 'failed'}`);
         console.log(`Anchors checked: ${result.checked}`);
         console.log(`Trust anchors: ${trustAnchors}/${result.checked}`);
         for (const issue of result.issues)
             console.log(`- ${issue.severity}: ${issue.id}${issue.anchor ? ` ${issue.anchor}` : ''}`);
-        console.log(`Code pack: ${codePack.status}${codePack.status === 'stale' ? ' — run `sks wiki refresh --code`' : ''}`);
+        console.log(`Code pack: ${codePack.status}${codePack.status === 'stale' ? ` — run \`${CONTEXT_GRAPH_REPAIR_COMMAND}\`` : ''}`);
+        console.log(`Context graph: ${graph.status}${graph.ok ? '' : ` — run \`${CONTEXT_GRAPH_REPAIR_COMMAND}\``}`);
+        for (const issue of graph.issues)
+            console.log(`- ${issue}`);
         return;
     }
     console.error('Usage: sks wiki coords|pack|refresh|publish|rebuild-index|rebuild-summary|validate|validate-shared|wrongness|image-ingest|anchor-add|relation-add|image-validate|image-summary');
     process.exitCode = 1;
 }
+async function wikiValidateContextGraph(root) {
+    const status = await contextGraphStatus(root, { extractors: contextGraphExtractors() });
+    if (status.status !== 'fresh') {
+        return {
+            ok: false,
+            status: status.status,
+            snapshot_hash: status.snapshotHash,
+            issues: [status.errorCode ?? 'context_graph_not_fresh', ...status.reasons]
+        };
+    }
+    const snapshotLoad = await readContextGraphSnapshot(root);
+    const metaLoad = await readContextGraphMeta(root);
+    if (snapshotLoad.status !== 'ok' || !snapshotLoad.snapshot || metaLoad.status !== 'ok' || !metaLoad.meta) {
+        return { ok: false, status: 'corrupt', snapshot_hash: status.snapshotHash, issues: ['context_graph_snapshot_meta_unreadable'] };
+    }
+    const lint = runContextGraphLint({ root, snapshot: snapshotLoad.snapshot, meta: metaLoad.meta });
+    const issues = lint.errors.slice(0, 20).map((issue) => `${issue.code}: ${issue.message}`);
+    const pack = await readJson(codePackPath(root), null).catch(() => null);
+    const digest = typeof pack?.index_digest === 'string' ? pack.index_digest : '';
+    const boundToSnapshot = Boolean(pack
+        && Array.isArray(pack.entries)
+        && isCodePackProjectionBoundToSnapshot(snapshotLoad.snapshot.snapshotHash, pack));
+    if (digest && !boundToSnapshot)
+        issues.push('code_pack_not_bound_to_current_snapshot');
+    return {
+        ok: lint.ok && (!digest || boundToSnapshot),
+        status: 'fresh',
+        snapshot_hash: snapshotLoad.snapshot.snapshotHash,
+        issues
+    };
+}
 async function wikiRefreshCode(args = []) {
     const root = await sksRoot();
-    const index = await scanCodebaseIndex(root);
     const tokenBudgetRaw = readFlagValue(args, '--token-budget', null);
-    const tokenBudget = tokenBudgetRaw ? Number.parseInt(String(tokenBudgetRaw), 10) : undefined;
-    const pack = tokenBudget && Number.isFinite(tokenBudget) ? buildCodePack(root, index, tokenBudget) : buildCodePack(root, index);
-    const validation = await validateCodePack(pack, root);
-    const written = validation.ok ? await writeCodePackAtomic(root, pack) : null;
+    const parsedBudget = tokenBudgetRaw ? Number.parseInt(String(tokenBudgetRaw), 10) : Number.NaN;
+    const tokenBudget = Number.isFinite(parsedBudget) ? parsedBudget : undefined;
+    const proofIndex = repairTriWikiProofIndex(root);
+    const compiled = await compileContextGraph({
+        root,
+        extractors: contextGraphExtractors(),
+        useFragmentCache: false
+    });
+    const lintErrors = compiled.issues.filter((issue) => issue.severity === 'error');
+    if (!compiled.ok || !compiled.snapshot) {
+        const blocked = {
+            schema: 'sks.wiki-refresh-code.v1',
+            ok: false,
+            reason: compiled.reason ?? 'context_graph_compile_failed',
+            blockers: compiled.blockers ?? [],
+            issues: lintErrors.slice(0, 20).map((issue) => `${issue.code}: ${issue.message}`),
+            repair_command: CONTEXT_GRAPH_REPAIR_COMMAND,
+            written: null
+        };
+        process.exitCode = 2;
+        process.stderr.write(`wiki-refresh-code: root=${root} graph=blocked reason=${blocked.reason} blockers=${JSON.stringify(blocked.blockers)}\n`);
+        if (flag(args, '--json'))
+            return console.log(JSON.stringify(blocked, null, 2));
+        console.log('Sneakoscope TriWiki Context Graph Refresh');
+        console.log(`Context graph: blocked (${blocked.reason})`);
+        for (const issue of blocked.issues)
+            console.log(`- ${issue}`);
+        return;
+    }
+    const projected = await buildWorkspaceCodePack(root, {
+        ...(tokenBudget === undefined ? {} : { tokenBudget }),
+        status: { status: 'fresh', snapshotHash: compiled.snapshotHash }
+    });
+    const pack = projected.pack;
+    const validation = pack ? await validateCodePack(pack, root) : { ok: false, issues: projected.errors };
+    const written = pack && validation.ok ? await writeCodePackAtomic(root, pack) : null;
     const result = {
         schema: 'sks.wiki-refresh-code.v1',
         ok: validation.ok,
         issues: validation.issues,
-        modules: index.modules.length,
-        truncated: index.truncated,
-        scanned_file_count: index.scanned_file_count,
-        entries: pack.entries.length,
-        token_cost: pack.total_token_cost,
-        token_budget: pack.token_budget,
+        snapshot_hash: compiled.snapshotHash,
+        nodes: compiled.snapshot.nodeCount,
+        edges: compiled.snapshot.edgeCount,
+        graph_warnings: compiled.issues.filter((issue) => issue.severity === 'warning').length,
+        incremental: Boolean(compiled.incremental),
+        proof_index: { ok: proofIndex.ok, indexed: proofIndex.indexed_count, previous_status: proofIndex.previous_status },
+        compile_ms: compiled.durationMs,
+        entries: pack ? pack.entries.length : 0,
+        token_cost: pack ? pack.total_token_cost : 0,
+        token_budget: pack ? pack.token_budget : 0,
         written: written ? written.path : null
     };
     process.exitCode = validation.ok ? 0 : 2;
-    process.stderr.write(`wiki-refresh-code: root=${root} modules=${index.modules.length} entries=${pack.entries.length} token_cost=${pack.total_token_cost}/${pack.token_budget} issues=${JSON.stringify(validation.issues)}\n`);
+    process.stderr.write(`wiki-refresh-code: root=${root} nodes=${result.nodes} edges=${result.edges} entries=${result.entries} token_cost=${result.token_cost}/${result.token_budget} issues=${JSON.stringify(validation.issues)}\n`);
     if (flag(args, '--json'))
         return console.log(JSON.stringify(result, null, 2));
-    console.log('Sneakoscope TriWiki Code Pack Refresh');
-    console.log(`Code pack refresh: ${validation.ok ? 'ok' : 'blocked'} (${pack.entries.length} entries from ${index.modules.length} modules${index.truncated ? ', truncated' : ''})`);
+    console.log('Sneakoscope TriWiki Context Graph Refresh');
+    console.log(`Context graph: ok (${result.nodes} nodes, ${result.edges} edges, snapshot ${String(result.snapshot_hash).slice(0, 12)})`);
+    console.log(`Code pack projection: ${validation.ok ? 'ok' : 'blocked'} (${result.entries} entries, ${result.token_cost}/${result.token_budget} tokens)`);
     for (const issue of validation.issues)
         console.log(`- ${issue}`);
 }

package/dist/core/doctor/skill-legacy-surface.js

@@ -6,6 +6,7 @@ import { legacyCoreSkillNames } from '../codex-native/core-skill-manifest.js';
 import { prefixKnownSksDollarReferences } from '../routes/dollar-prefix.js';
 import { inspectConfinedPath, moveConfinedPath, uniqueConfinedPath } from '../managed-path-safety.js';
 import { writeTextAtomic } from '../fsx.js';
+import { messageOf as errorMessage } from '../errors/message.js';
 import { collectNestedProjectRoots } from './current-project-guidance-nested.js';
 import { containsRetiredPublicSurface } from './current-project-guidance.js';
 export const SKILL_LEGACY_SURFACE_SCHEMA = 'sks.skill-legacy-surface.v1';
@@ -346,6 +347,3 @@ async function pathExists(ownerRoot, target) {
         return false;
     }
 }
-function errorMessage(error) {
-    return error instanceof Error ? error.message : String(error);
-}

package/dist/core/errors/message.js

@@ -1,3 +1,6 @@
 export function messageOf(error) {
     return error instanceof Error ? error.message : String(error);
 }
+export function errorCodeOf(error) {
+    return error && typeof error === 'object' && 'code' in error ? String(error.code) : '';
+}

package/dist/core/evidence/evidence-freshness.js

@@ -27,6 +27,8 @@ export async function lastJsonlEventTime(file) {
     for (const line of text.split(/\n/).filter(Boolean)) {
         try {
             const parsed = JSON.parse(line);
+            if (!eventInvalidatesProof(parsed))
+                continue;
             const ts = Date.parse(parsed.ts || parsed.time || parsed.created_at || '');
             if (Number.isFinite(ts) && (latest == null || ts > latest))
                 latest = ts;
@@ -35,3 +37,15 @@ export async function lastJsonlEventTime(file) {
     }
     return latest;
 }
+export function eventInvalidatesProof(event = {}) {
+    if (event?.proof_invalidating === false)
+        return false;
+    const type = String(event?.type || '').trim();
+    if (/^triwiki\.agents_md_project(?:ed|_failed)$/.test(type))
+        return false;
+    if (/^pipeline\.compliance_loop_guard(?:\..+)?$/.test(type))
+        return false;
+    if (/^pipeline\.honest_mode\.loopback(?:_resolved)?$/.test(type))
+        return false;
+    return true;
+}

package/dist/core/feature-fixtures.js

@@ -58,6 +58,9 @@ const FIXTURES = Object.freeze({
     'cli-git': fixture('execute', 'sks git policy --json', [], 'pass'),
     'cli-uninstall': fixture('execute', 'sks uninstall --dry-run --json', [], 'pass'),
     'cli-goal': fixture('execute', 'sks goal create "Fixture smoke: create a minimal Node.js CLI health-check script" --json', [], 'pass', { reason: 'The compatibility command is stateless: it prints a detailed Codex native /goal request and writes no SKS mission, artifact, loop, or fallback state.' }),
+    'cli-align': fixture('execute_and_validate_artifacts', 'sks align prepare "fixture modernization contract" --json', ['align-plan.json', 'align-ledger.json', 'align-gate.json'], 'pass', {
+        reason: 'The CLI fixture exercises the real hermetic preparation path. It intentionally leaves align-gate.json blocked because no external modernization work is fabricated.'
+    }),
     'cli-seo-geo-optimizer': fixture('execute_and_validate_artifacts', 'sks seo-geo-optimizer fixture --mode seo --json', ['search-visibility/site-inventory.json', 'search-visibility/seo-findings.json', 'search-visibility/verification-report.json', 'seo-gate.json', 'completion-proof.json'], 'pass'),
     'cli-research': fixture('execute_and_validate_artifacts', 'sks research run latest --mock --json', ['research-gate.json', 'completion-proof.json'], 'blocked', { timeout_ms: 180000, reason: '"run" (not "status") is the command that actually writes research-gate.json/completion-proof.json, but research is a two-step prepare-then-run workflow gated by an active-route-not-closed check between steps that a single fixture command cannot express; on a hermetic run "latest" will not be a properly prepared+closed research mission.' }),
     'cli-qa-loop': fixture('execute_and_validate_artifacts', 'sks qa-loop run latest --mock --json', ['qa-gate.json', 'completion-proof.json'], 'pass', { timeout_ms: 180000 }),
@@ -126,7 +129,9 @@ const FIXTURES = Object.freeze({
     'skill-seo-geo-optimizer': fixture('execute_and_validate_artifacts', 'sks seo-geo-optimizer fixture --mode geo --json', ['search-visibility/site-inventory.json', 'search-visibility/geo-findings.json', 'geo-gate.json', 'completion-proof.json'], 'pass'),
     'cli-proof': fixture('execute_and_validate_artifacts', 'sks proof smoke --json', ['.sneakoscope/proof/latest.json'], 'pass'),
     'cli-trust': fixture('execute_and_validate_artifacts', 'sks trust report latest --json', ['trust-report.json'], 'pass'),
-    'cli-wrongness': fixture('execute_and_validate_artifacts', 'sks wrongness add --kind missing_evidence --claim "fixture wrongness" --json', ['.sneakoscope/wiki/wrongness-ledger.json'], 'pass'),
+    'cli-wrongness': fixture('execute', 'sks wrongness validate project --json', [], 'pass', {
+        reason: 'Release fixtures must not add synthetic project-wide wrongness records. The read-only validator exercises the CLI and ledger schema without contaminating trust state for later route proofs.'
+    }),
     'route-naruto': fixture('execute_and_validate_artifacts', 'sks naruto run "fixture" --agents 4 --max-threads 4 --json', ['subagent-plan.json', 'subagent-events.jsonl', 'subagent-evidence.json', 'naruto-summary.json', 'naruto-gate.json', 'work-order-ledger.json'], 'pass', preparationFixtureContract({ timeout_ms: 90000 })),
     'route-work': fixture('static', '$Work compatibility alias for the Naruto Codex official subagent workflow', [], 'pass', { quality: 'wiring_only', reason: 'Pure alias of $Naruto; official workflow execution is covered by route-naruto.' }),
     'route-plan': fixture('execute', 'sks plan "fixture" --json', [], 'pass'),
@@ -148,6 +153,9 @@ const FIXTURES = Object.freeze({
         quality: 'wiring_only',
         reason: 'Goal lifecycle is owned entirely by Codex native /goal. The SKS surface only builds a detailed native objective and command; it creates no mission, proof artifact, compatibility loop, or fallback goal state.'
     }),
+    'route-align': fixture('execute_and_validate_artifacts', 'sks align fixture --json', ['align-plan.json', 'align-ledger.json', 'align-gate.json', 'completion-proof.json'], 'blocked', {
+        reason: 'The Align route fixture creates a real hermetic mission and canonical Completion Proof, then exits blocked because the six modernization workstreams were not actually executed. This verifies route wiring and proof closure without inventing official-doc work.'
+    }),
     'route-super-search': fixture('execute', 'sks run "$Super-Search doctor" --execute --json', [], 'pass'),
     'route-seo-geo-optimizer': fixture('execute_and_validate_artifacts', 'sks seo-geo-optimizer fixture --mode geo --json', ['search-visibility/site-inventory.json', 'search-visibility/geo-findings.json', 'search-visibility/verification-report.json', 'geo-gate.json', 'completion-proof.json'], 'pass'),
     'route-autoresearch': fixture('mock', '$AutoResearch fixture route', ['research-gate.json', 'completion-proof.json'], 'pass', {

package/dist/core/feature-registry.js

@@ -506,7 +506,7 @@ const SAFE_EXECUTABLE_FIXTURE_ARGS = Object.freeze({
     'cli-proof-field': ['proof-field', 'scan', '--json', '--intent', 'fixture'],
     'cli-proof': ['proof', 'smoke', '--json'],
     'cli-trust': { setup: [['run', 'fixture', '--mock', '--json']], command: ['trust', 'report', 'latest', '--json'] },
-    'cli-wrongness': ['wrongness', 'add', '--kind', 'missing_evidence', '--claim', 'fixture wrongness', '--json'],
+    'cli-wrongness': ['wrongness', 'validate', 'project', '--json'],
     'cli-wiki': ['wiki', 'image-ingest', 'test/fixtures/images/one-by-one.png', '--json'],
     'cli-codex': ['codex', 'compatibility', '--json'],
     'cli-codex-lb': ['codex-lb', 'metrics', '--json'],
@@ -527,6 +527,7 @@ const SAFE_EXECUTABLE_FIXTURE_ARGS = Object.freeze({
     'cli-dfix': ['dfix', 'fixture', '--json'],
     'cli-all-features': ['all-features', 'complete', '--json'],
     'cli-naruto': ['naruto', 'run', 'fixture', '--agents', '4', '--max-threads', '4', '--json'],
+    'cli-align': ['align', 'prepare', 'fixture modernization contract', '--json'],
     'route-naruto': ['naruto', 'run', 'fixture', '--agents', '4', '--max-threads', '4', '--json'],
     'route-qa-loop': { setup: [['qa-loop', 'prepare', 'fixture API QA', '--json']], command: ['qa-loop', 'run', 'latest', '--mock', '--json'] },
     'route-research': { setup: [['research', 'prepare', 'fixture research topic', '--json']], command: ['research', 'run', 'latest', '--mock', '--json'] },
@@ -534,6 +535,7 @@ const SAFE_EXECUTABLE_FIXTURE_ARGS = Object.freeze({
     'route-image-ux-review': ['image-ux-review', 'fixture', '--mock', '--json'],
     'route-computer-use': ['computer-use', 'import-fixture', '--mock', '--json'],
     'route-dfix': ['dfix', 'fixture', '--json'],
+    'route-align': ['align', 'fixture', '--json'],
     'route-seo-geo-optimizer': ['seo-geo-optimizer', 'fixture', '--mode', 'geo', '--json'],
     'route-fast-mode': ['fast-mode', 'status', '--json'],
     'route-wiki': ['wiki', 'image-ingest', 'test/fixtures/images/one-by-one.png', '--json'],
@@ -735,8 +737,8 @@ function imagegenWiringFeatures() {
                 cli_command_names: ['image-ux-review'],
                 handler_keys: ['image-ux-review', 'ux-review'],
                 dollar_commands: ['$Image-UX-Review', '$UX-Review'],
-                app_skill_aliases: ['$image-ux-review', '$ux-review'],
-                skills: ['image-ux-review', 'ux-review', 'imagegen']
+                app_skill_aliases: ['$image-ux-review'],
+                skills: ['image-ux-review', 'imagegen']
             }
         }),
         baseFeature({

package/dist/core/fsx.js

@@ -227,18 +227,22 @@ export async function writeReceiptRotated(p, data, opts = {}) {
         .slice(keep);
     await Promise.all(removable.map((row) => fsp.rm(row.file, { force: true }).catch(() => undefined)));
 }
-export async function writeBinaryAtomic(p, data) {
+export async function writeBinaryAtomic(p, data, options = {}) {
     await ensureDir(path.dirname(p));
     try {
-        if ((await fsp.readFile(p)).equals(data))
+        if (options.mode === undefined && (await fsp.readFile(p)).equals(data))
             return;
     }
     catch { }
     const tmp = `${p}.${process.pid}.${randomId(6)}.tmp`;
     try {
-        const handle = await fsp.open(tmp, 'w');
+        const handle = options.mode === undefined
+            ? await fsp.open(tmp, 'w')
+            : await fsp.open(tmp, 'w', options.mode);
         try {
             await handle.writeFile(data);
+            if (options.mode !== undefined)
+                await handle.chmod(options.mode);
             await handle.sync().catch(() => { });
         }
         finally {

package/dist/core/hooks-runtime/codex-commit-hooks-selftest.js

@@ -0,0 +1,82 @@
+import path from 'node:path';
+import { packageRoot, runProcess, tmpdir } from '../fsx.js';
+export async function selftestCodexCommitHooks() {
+    const root = tmpdir();
+    const hookBin = path.join(packageRoot(), 'dist', 'bin', 'sks.js');
+    const env = { SKS_DISABLE_UPDATE_CHECK: '1' };
+    const setup = await runProcess(process.execPath, [hookBin, 'setup', '--install-scope', 'project'], { cwd: root, env, timeoutMs: 15000, maxOutputBytes: 128 * 1024 });
+    if (setup.code !== 0)
+        throw new Error(`selftest failed: commit setup ${setup.code}: ${setup.stderr}`);
+    const runHook = (name, payload) => runProcess(process.execPath, [hookBin, 'hook', name], { cwd: root, input: JSON.stringify({ cwd: root, ...payload }), env, timeoutMs: 15000, maxOutputBytes: 128 * 1024 });
+    const id = 'commit-selftest';
+    const hook = await runHook('user-prompt-submit', { conversation_id: id, action: 'codex_git_commit', prompt: 'Generate a git commit message for the staged diff.' });
+    if (hook.code !== 0)
+        throw new Error(`selftest failed: commit hook ${hook.code}: ${hook.stderr}`);
+    const hookJson = JSON.parse(hook.stdout);
+    if (hookJson.decision === 'block' || hookJson.hookSpecificOutput?.additionalContext || !String(hookJson.systemMessage || '').includes('git action'))
+        throw new Error('selftest failed: commit route bypass');
+    const stop = await runHook('stop', { conversation_id: id, last_assistant_message: 'Fix Codex App commit message hook bypass' });
+    if (stop.code !== 0)
+        throw new Error(`selftest failed: commit stop ${stop.code}: ${stop.stderr}`);
+    const stopJson = JSON.parse(stop.stdout);
+    if (stopJson.decision === 'block' || !String(stopJson.systemMessage || '').includes('accepted without route finalization'))
+        throw new Error('selftest failed: commit stop bypass');
+    const commitPushId = 'commit-push-selftest';
+    const appCommitPushHook = await runHook('user-prompt-submit', { conversation_id: commitPushId, action: 'Codex App Git Actions Commit and Push', prompt: 'Commit and push changes.' });
+    if (appCommitPushHook.code !== 0)
+        throw new Error(`selftest failed: app commit-push hook ${appCommitPushHook.code}: ${appCommitPushHook.stderr}`);
+    const appCommitPushJson = JSON.parse(appCommitPushHook.stdout);
+    if (appCommitPushJson.decision === 'block' || appCommitPushJson.hookSpecificOutput?.additionalContext || !String(appCommitPushJson.systemMessage || '').includes('git action'))
+        throw new Error('selftest failed: app commit-push route bypass');
+    const appCommitPushStop = await runHook('stop', { conversation_id: commitPushId, last_assistant_message: 'Commit and push complete.' });
+    if (appCommitPushStop.code !== 0)
+        throw new Error(`selftest failed: app commit-push stop ${appCommitPushStop.code}: ${appCommitPushStop.stderr}`);
+    if (JSON.parse(appCommitPushStop.stdout).decision === 'block')
+        throw new Error('selftest failed: app commit-push stop bypass');
+    const appPushId = 'app-push-selftest';
+    const appPushHook = await runHook('user-prompt-submit', { conversation_id: appPushId, metadata: { source: 'codex_app', action: 'Git Actions Push' }, prompt: 'Push changes.' });
+    if (appPushHook.code !== 0)
+        throw new Error(`selftest failed: app push hook ${appPushHook.code}: ${appPushHook.stderr}`);
+    const appPushJson = JSON.parse(appPushHook.stdout);
+    if (appPushJson.decision === 'block' || appPushJson.hookSpecificOutput?.additionalContext || !String(appPushJson.systemMessage || '').includes('git action'))
+        throw new Error('selftest failed: app push metadata route bypass');
+    const appPushStop = await runHook('stop', { conversation_id: appPushId, metadata: { source: 'codex_app', action: 'Git Actions Push' }, last_assistant_message: 'Done.' });
+    if (appPushStop.code !== 0)
+        throw new Error(`selftest failed: app push stop ${appPushStop.code}: ${appPushStop.stderr}`);
+    if (JSON.parse(appPushStop.stdout).decision === 'block')
+        throw new Error('selftest failed: app push metadata stop bypass');
+    const metadataLightId = 'metadata-light-commit-push-selftest';
+    const metadataLightHook = await runHook('user-prompt-submit', { conversation_id: metadataLightId, prompt: 'Commit and push changes.' });
+    if (metadataLightHook.code !== 0)
+        throw new Error(`selftest failed: metadata-light commit-push hook ${metadataLightHook.code}: ${metadataLightHook.stderr}`);
+    const metadataLightJson = JSON.parse(metadataLightHook.stdout);
+    if (metadataLightJson.decision === 'block' || metadataLightJson.hookSpecificOutput?.additionalContext || !String(metadataLightJson.systemMessage || '').includes('git action'))
+        throw new Error('selftest failed: metadata-light app commit-push route bypass');
+    const metadataLightStop = await runHook('stop', { conversation_id: metadataLightId, last_assistant_message: 'Commit and push complete.' });
+    if (metadataLightStop.code !== 0)
+        throw new Error(`selftest failed: metadata-light commit-push stop ${metadataLightStop.code}: ${metadataLightStop.stderr}`);
+    if (JSON.parse(metadataLightStop.stdout).decision === 'block')
+        throw new Error('selftest failed: metadata-light commit-push stop bypass');
+    const settingsHook = await runHook('user-prompt-submit', { model: 'future-codex-catalog-model', metadata: { source: 'codex_app_settings', feature: 'speed profile' } });
+    if (settingsHook.code !== 0)
+        throw new Error(`selftest failed: settings hook ${settingsHook.code}: ${settingsHook.stderr}`);
+    const settingsJson = JSON.parse(settingsHook.stdout);
+    if (settingsJson.decision === 'block' || settingsJson.hookSpecificOutput?.additionalContext || !String(settingsJson.systemMessage || '').includes('settings/profile event ignored'))
+        throw new Error('selftest failed: settings/profile event should not route or block');
+    const userHook = await runHook('user-prompt-submit', { prompt: '[커밋 메시지를 생성하지 못했습니다.] 코덱스 앱에서 이 버그 수정해줘' });
+    if (userHook.code !== 0)
+        throw new Error(`selftest failed: user commit hook ${userHook.code}: ${userHook.stderr}`);
+    if (!JSON.parse(userHook.stdout).hookSpecificOutput?.additionalContext?.includes('$Naruto route prepared'))
+        throw new Error('selftest failed: user prompt route');
+    const userCommitPushHook = await runHook('user-prompt-submit', { prompt: '배포하게 커밋하고 푸쉬해줘' });
+    if (userCommitPushHook.code !== 0)
+        throw new Error(`selftest failed: user commit-push hook ${userCommitPushHook.code}: ${userCommitPushHook.stderr}`);
+    const userCommitPushJson = JSON.parse(userCommitPushHook.stdout);
+    if (userCommitPushJson.decision === 'block' || userCommitPushJson.hookSpecificOutput?.additionalContext || !String(userCommitPushJson.systemMessage || '').includes('git action'))
+        throw new Error('selftest failed: user commit-push prompt should bypass route');
+    const userCommitPushStop = await runHook('stop', { last_assistant_message: 'Commit and push complete.' });
+    if (userCommitPushStop.code !== 0)
+        throw new Error(`selftest failed: user commit-push stop ${userCommitPushStop.code}: ${userCommitPushStop.stderr}`);
+    if (JSON.parse(userCommitPushStop.stdout).decision === 'block')
+        throw new Error('selftest failed: user commit-push stop bypass');
+}