sneakoscope 7.3.0 → 7.6.0

package/dist/scripts/codex-lb-gpt56-fast-profile-check.js

@@ -2,7 +2,7 @@
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { codexFastModeDesktopStatus, codexLbConfigPath, configureCodexLb, ensureGlobalCodexFastModeDuringInstall, releaseCodexLbAuthHold, repairCodexLbAuth } from '../cli/install-helpers.js';
+import { codexFastModeDesktopStatus, codexLbConfigPath, configureCodexLb, configureCodexLbDesktopRouting, ensureGlobalCodexFastModeDuringInstall, repairCodexLbAuth } from '../cli/install-helpers.js';
 import { repairCodexConfigStructure, splitCodexProjectConfigPolicy } from '../core/codex/codex-project-config-policy.js';
 import { parseCodexConfigToml, validateCodexConfigRoundTrip } from '../core/codex/codex-config-toml.js';
 import { CODEX_LB_TOOL_OUTPUT_RECOVERY_MIN_VERSION } from '../core/codex-lb/codex-lb-tool-output-recovery.js';
@@ -14,30 +14,70 @@ const codexHome = path.join(home, '.codex');
 const configPath = codexLbConfigPath(home);
 const envPath = path.join(codexHome, 'sks-codex-lb.env');
 const authPath = path.join(codexHome, 'auth.json');
-const oauthBackupPath = path.join(codexHome, 'auth.chatgpt-backup.json');
 const projectConfig = path.join(root, '.codex', 'config.toml');
+const remoteBaseUrl = 'https://lb.example.test/backend-api/codex';
+const bridgeBaseUrl = 'http://127.0.0.1:54321/backend-api/codex';
 await fs.mkdir(path.dirname(projectConfig), { recursive: true });
 await fs.mkdir(codexHome, { recursive: true });
-await fs.writeFile(authPath, `${JSON.stringify({ auth_mode: 'chatgpt', tokens: { access_token: 'oauth-access' } }, null, 2)}\n`);
+const oauth = `${JSON.stringify({
+    auth_mode: 'chatgpt',
+    account_id: 'acct-fast-profile',
+    tokens: {
+        access_token: 'oauth-access',
+        refresh_token: 'oauth-refresh'
+    }
+}, null, 2)}\n`;
+await fs.writeFile(authPath, oauth);
 const setup = await configureCodexLb({
     home,
     configPath,
     envPath,
-    host: 'https://lb.example.test/backend-api/codex',
+    host: remoteBaseUrl,
     apiKey: 'fixture-codex-lb-fast-key',
     writeEnvFile: true,
-    useDefaultProvider: true,
-    forceFastMode: true,
-    forceCodexLbApiKeyAuth: true,
-    authMode: 'codex-lb',
     shellProfile: 'skip',
+    gatewayAuthTransport: 'x-codex-lb-api-key',
     toolOutputRecoveryFetch
 });
-const fastOn = await ensureGlobalCodexFastModeDuringInstall({ home, configPath, forceFastMode: true });
-const first = assertFastProfile(await fs.readFile(configPath, 'utf8'), 'setup_fast_on');
-const release = await releaseCodexLbAuthHold({ home, configPath, authPath, backupPath: oauthBackupPath });
-const afterOauth = assertFastProfile(await fs.readFile(configPath, 'utf8'), 'use_oauth_roundtrip');
-const repair = await repairCodexLbAuth({ home, configPath, envPath, forceCodexLbApiKeyAuth: true, forceFastMode: true, authMode: 'codex-lb', toolOutputRecoveryFetch });
+const native = await configureCodexLbDesktopRouting({
+    mode: 'desktop-native-bridge',
+    home,
+    configPath,
+    authPath,
+    bridgeBaseUrl,
+    remoteBaseUrl,
+    gatewayAuthTransport: 'x-codex-lb-api-key'
+});
+const fastOn = await ensureGlobalCodexFastModeDuringInstall({
+    home,
+    configPath,
+    forceFastMode: true
+});
+const first = assertFastProfile(await fs.readFile(configPath, 'utf8'), 'native_fast_on');
+const disabled = await configureCodexLbDesktopRouting({
+    mode: 'disabled',
+    home,
+    configPath,
+    authPath
+});
+const afterDisable = assertFastProfile(await fs.readFile(configPath, 'utf8'), 'routing_disabled', false);
+const reenabled = await configureCodexLbDesktopRouting({
+    mode: 'desktop-native-bridge',
+    home,
+    configPath,
+    authPath,
+    bridgeBaseUrl,
+    remoteBaseUrl,
+    gatewayAuthTransport: 'x-codex-lb-api-key'
+});
+const repair = await repairCodexLbAuth({
+    home,
+    configPath,
+    envPath,
+    forceCodexLbApiKeyAuth: true,
+    forceFastMode: true,
+    authMode: 'codex-lb'
+});
 await fs.writeFile(projectConfig, [
     '# SKS managed fixture',
     'default_profile = "sks-fast-high"',
@@ -52,37 +92,53 @@ await fs.writeFile(projectConfig, [
     'service_tier = "fast"',
     ''
 ].join('\n'));
-const split = await splitCodexProjectConfigPolicy(root, { apply: true, codexHome, configPath: projectConfig, writeReport: false });
+const split = await splitCodexProjectConfigPolicy(root, {
+    apply: true,
+    codexHome,
+    configPath: projectConfig,
+    writeReport: false
+});
 const structure = await repairCodexConfigStructure(configPath, { apply: true });
 const final = assertFastProfile(await fs.readFile(configPath, 'utf8'), 'after_rewriters');
 const toolCatalog = assertGpt56ToolCatalogContract();
-const ok = setup.ok !== false
+const authPreserved = await fs.readFile(authPath, 'utf8') === oauth;
+const ok = setup.ok === true
+    && native.ok === true
+    && disabled.ok === true
+    && reenabled.ok === true
     && !['failed', 'skipped_unsafe_rewrite', 'unparseable_config_preserved'].includes(String(fastOn.status))
-    && release.status !== 'failed'
-    && repair.ok !== false
+    && repair.ok === true
     && split.ok === true
     && structure.ok === true
+    && authPreserved
     && first.ok
-    && afterOauth.ok
+    && afterDisable.ok
     && final.ok
     && toolCatalog.ok;
 const report = {
-    schema: 'sks.codex-lb-gpt56-fast-profile-check.v1',
+    schema: 'sks.codex-lb-gpt56-fast-profile-check.v2',
     ok,
     setup_status: setup.status,
+    native_status: native.status,
     fast_on_status: fastOn.status,
-    release_status: release.status,
+    disable_status: disabled.status,
+    reenable_status: reenabled.status,
     repair_status: repair.status,
     split_status: split.status || null,
     structure_status: structure.status,
-    assertions: [first, afterOauth, final],
+    oauth_preserved: authPreserved,
+    assertions: [first, afterDisable, final],
     tool_catalog: toolCatalog,
-    blockers: [...[first, afterOauth, final].flatMap((item) => item.blockers), ...toolCatalog.blockers]
+    blockers: [
+        ...(authPreserved ? [] : ['chatgpt_oauth_changed']),
+        ...[first, afterDisable, final].flatMap((item) => item.blockers),
+        ...toolCatalog.blockers
+    ]
 };
 console.log(JSON.stringify(report, null, 2));
 if (!report.ok)
     process.exitCode = 1;
-function assertFastProfile(text, label) {
+function assertFastProfile(text, label, expectBridge = true) {
     const validation = validateCodexConfigRoundTrip(text);
     const parsed = validation.ok ? parseCodexConfigToml(text) : {};
     const provider = parsed.model_providers?.['codex-lb'] || {};
@@ -93,8 +149,14 @@ function assertFastProfile(text, label) {
         ...(parsed.user?.fast_mode === undefined ? [] : ['user_fast_mode_legacy_table_present']),
         ...(parsed.profiles?.['sks-fast-high'] === undefined ? [] : ['sks_fast_high_legacy_profile_present']),
         ...(parsed.model === undefined ? [] : ['codex_app_model_was_injected']),
-        ...(provider.requires_openai_auth === true ? [] : ['codex_lb_requires_openai_auth_not_true']),
+        ...(parsed.model_provider === undefined ? [] : ['desktop_model_provider_was_selected']),
+        ...(provider.name === 'codex-lb' ? [] : ['codex_lb_cli_provider_name_mismatch']),
+        ...(provider.requires_openai_auth === false ? [] : ['codex_lb_cli_requires_openai_auth_not_false']),
+        ...(provider.env_key === 'CODEX_LB_API_KEY' ? [] : ['codex_lb_cli_env_key_missing']),
         ...(provider.wire_api === 'responses' ? [] : ['codex_lb_wire_api_not_responses']),
+        ...(expectBridge && parsed.openai_base_url === bridgeBaseUrl ? [] : expectBridge ? ['native_bridge_base_url_missing'] : []),
+        ...(!expectBridge && parsed.openai_base_url !== undefined ? ['disabled_routing_still_has_openai_base_url'] : []),
+        ...(parsed.model_catalog_json === undefined ? [] : ['native_local_catalog_must_not_be_bound']),
         ...(desktop.on ? [] : ['desktop_fast_status_off'])
     ];
     return {
@@ -102,8 +164,11 @@ function assertFastProfile(text, label) {
         ok: blockers.length === 0,
         default_profile: parsed.default_profile || null,
         model: parsed.model || null,
+        model_provider: parsed.model_provider || null,
+        openai_base_url: parsed.openai_base_url || null,
         legacy_keys: validation.legacy_keys,
         service_tier: parsed.service_tier || null,
+        provider_name: provider.name || null,
         provider_wire_api: provider.wire_api || null,
         provider_requires_openai_auth: provider.requires_openai_auth ?? null,
         blockers
@@ -111,36 +176,32 @@ function assertFastProfile(text, label) {
 }
 function assertGpt56ToolCatalogContract() {
     const normalized = normalizeCodexLbToolCatalog({
-        models: ['gpt-5.6-sol', 'gpt-5.6-terra', 'gpt-5.6-luna'].map(codex0144Model)
+        models: ['gpt-5.6-sol', 'gpt-5.6-terra', 'gpt-5.6-luna'].map(codexModel)
     });
     const models = normalized.catalog.models.filter((model) => String(model.slug).startsWith('gpt-5.6-'));
     const blockers = [
         ...normalized.blockers,
         ...(normalized.schema === 'sks.codex-lb-tool-catalog.v1' ? [] : ['codex_lb_gpt56_catalog_schema_mismatch']),
+        ...(normalized.contract === 'codex-model-catalog-pass-through.v2' ? [] : ['codex_lb_catalog_contract_not_v2']),
         ...(normalized.tools_transport === 'full_responses' ? [] : ['codex_lb_gpt56_native_tool_transport_not_full_responses']),
         ...(normalized.patched_models.join(',') === 'gpt-5.6-luna,gpt-5.6-sol,gpt-5.6-terra' ? [] : ['codex_lb_gpt56_catalog_patch_set_incomplete']),
         ...(models.length === 3 ? [] : ['codex_lb_gpt56_catalog_model_set_incomplete']),
         ...(models.every((model) => model.use_responses_lite === false) ? [] : ['codex_lb_gpt56_responses_lite_not_disabled']),
-        ...(models.every((model) => model.tool_mode === 'code_mode_only') ? [] : ['codex_lb_gpt56_native_tool_mode_not_preserved']),
-        ...(models.every((model) => model.supports_parallel_tool_calls === true) ? [] : ['codex_lb_gpt56_parallel_tool_calls_not_preserved']),
-        ...(models.every((model) => model.minimal_client_version === '0.144.5') ? [] : ['codex_lb_gpt56_codex_0144_contract_missing'])
+        ...(models.every((model) => model.future_unknown_field === 'preserved') ? [] : ['codex_lb_unknown_catalog_field_lost'])
     ];
     return {
-        schema: normalized.schema,
         ok: blockers.length === 0,
-        codex_cli_contract: '0.144.5',
-        models: normalized.gpt56_models,
-        patched_models: normalized.patched_models,
+        contract: normalized.contract,
         tools_transport: normalized.tools_transport,
-        native_tool_mode: 'code_mode_only',
+        patched_models: normalized.patched_models,
         blockers
     };
 }
-function codex0144Model(slug) {
+function codexModel(slug) {
     return {
         slug,
-        display_name: slug.replace('gpt-', 'GPT-').replaceAll('-', ' '),
-        supported_reasoning_levels: [{ effort: 'max', description: 'Maximum' }],
+        display_name: slug,
+        supported_reasoning_levels: [{ effort: 'medium', description: 'Balanced' }],
         shell_type: 'shell_command',
         visibility: 'list',
         supported_in_api: true,
@@ -153,7 +214,8 @@ function codex0144Model(slug) {
         experimental_supported_tools: [],
         tool_mode: 'code_mode_only',
         use_responses_lite: true,
-        minimal_client_version: '0.144.5'
+        minimal_client_version: 'runtime',
+        future_unknown_field: 'preserved'
     };
 }
 async function toolOutputRecoveryFetch() {

package/dist/scripts/context-graph-check.js

@@ -0,0 +1,191 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { assertGate, emitGate, importDist, root } from './gate-lib.js';
+const modeIndex = process.argv.indexOf('--mode');
+const mode = modeIndex >= 0 ? String(process.argv[modeIndex + 1] || '') : '';
+const MODES = new Set(['contract', 'quality', 'performance', 'legacy-closure']);
+assertGate(MODES.has(mode), 'context_graph_check_unknown_mode', { mode, modes: [...MODES] });
+const GATE_ID = `context-graph:${mode}`;
+function gitGrep(pattern, pathspecs) {
+    const result = spawnSync('git', ['grep', '-n', '-I', '-E', pattern, '--', ...pathspecs], {
+        cwd: root,
+        encoding: 'utf8'
+    });
+    if (result.status !== 0 && result.status !== 1) {
+        assertGate(false, 'context_graph_git_grep_failed', { pattern, stderr: (result.stderr || '').slice(0, 400) });
+    }
+    return String(result.stdout || '').split('\n').filter(Boolean);
+}
+async function runContract() {
+    const contracts = await importDist('core/triwiki/context-graph/contracts.js');
+    const ids = await importDist('core/triwiki/context-graph/ids.js');
+    const paths = await importDist('core/triwiki/context-graph/paths.js');
+    const profiles = await importDist('core/triwiki/context-graph/profiles.js');
+    const extractors = await importDist('core/triwiki/context-graph/extractors/index.js');
+    const schemaPath = path.join(root, 'schemas', 'triwiki', 'context-graph.schema.json');
+    assertGate(fs.existsSync(schemaPath), 'context_graph_schema_missing', { schemaPath: 'schemas/triwiki/context-graph.schema.json' });
+    const schema = JSON.parse(fs.readFileSync(schemaPath, 'utf8'));
+    assertGate(schema.title === contracts.CONTEXT_GRAPH_SCHEMA, 'context_graph_schema_title_mismatch', { title: schema.title });
+    const schemaKinds = schema.definitions.node.properties.kind.enum;
+    const schemaEdges = schema.definitions.edge.properties.type.enum;
+    assertGate(JSON.stringify(schemaKinds) === JSON.stringify([...contracts.CONTEXT_GRAPH_NODE_KINDS]), 'context_graph_node_kind_drift', { schema: schemaKinds, code: [...contracts.CONTEXT_GRAPH_NODE_KINDS] });
+    assertGate(JSON.stringify(schemaEdges) === JSON.stringify([...contracts.CONTEXT_GRAPH_EDGE_TYPES]), 'context_graph_edge_type_drift', { schema: schemaEdges, code: [...contracts.CONTEXT_GRAPH_EDGE_TYPES] });
+    const first = ids.contextGraphNodeId({ kind: 'symbol', path: 'src/a.ts', symbolKind: 'function', name: 'run', startOffset: 7 });
+    const second = ids.contextGraphNodeId({ kind: 'symbol', path: 'src/a.ts', symbolKind: 'function', name: 'run', startOffset: 7 });
+    assertGate(first === second && first === 'symbol:src/a.ts#function:run@7', 'context_graph_unstable_node_id', { first, second });
+    const edgeA = ids.contextGraphEdgeId({ from: 'file:a.ts', to: 'file:b.ts', type: 'imports' });
+    const edgeB = ids.contextGraphEdgeId({ from: 'file:a.ts', to: 'file:b.ts', type: 'imports' });
+    assertGate(edgeA === edgeB, 'context_graph_unstable_edge_id', { edgeA, edgeB });
+    const comparatorSources = gitGrep('\\.localeCompare\\(', [
+        'src/core/triwiki/context-graph/contracts.ts',
+        'src/core/triwiki/context-graph/ids.ts',
+        'src/core/triwiki/context-graph/compiler/serialize.ts'
+    ]);
+    assertGate(comparatorSources.length === 0, 'context_graph_locale_sensitive_ordering', { hits: comparatorSources });
+    for (const bad of ['/etc/passwd', '../outside.ts', '']) {
+        let threw = false;
+        try {
+            paths.normalizeGraphPath(root, bad);
+        }
+        catch {
+            threw = true;
+        }
+        assertGate(threw, 'context_graph_path_escape_accepted', { candidate: bad });
+    }
+    assertGate(paths.normalizeGraphPath(root, path.join(root, 'package.json')) === 'package.json', 'context_graph_path_normalization_broken');
+    const edgeTypes = new Set(contracts.CONTEXT_GRAPH_EDGE_TYPES);
+    const reachable = new Set();
+    for (const name of profiles.CONTEXT_GRAPH_QUERY_PROFILE_NAMES) {
+        const profile = profiles.contextGraphQueryProfile(name);
+        assertGate(profile.edges.length > 0, 'context_graph_empty_profile', { profile: name });
+        for (const edge of profile.edges) {
+            assertGate(edgeTypes.has(edge), 'context_graph_profile_unknown_edge', { profile: name, edge });
+            reachable.add(edge);
+        }
+        assertGate(profile.maxDepthHighRisk >= profile.maxDepth, 'context_graph_profile_depth_inverted', { profile: name });
+    }
+    const strayWeights = gitGrep('(exact_seed_bonus|edge_profile_weight|trust_bonus|stale_penalty|redundancy_penalty|token_cost_penalty)\\s*[:=]\\s*[0-9]', [
+        'src/core/triwiki/context-graph',
+        ':!src/core/triwiki/context-graph/query/ranking-config.ts',
+        ':!src/core/triwiki/context-graph/**/__tests__/**'
+    ]);
+    assertGate(strayWeights.length === 0, 'context_graph_ranking_constants_duplicated', { hits: strayWeights.slice(0, 10) });
+    const registered = extractors.contextGraphExtractors();
+    assertGate(registered.length >= 3, 'context_graph_extractor_registry_incomplete', { count: registered.length });
+    const registeredIds = registered.map((extractor) => extractor.id).sort();
+    assertGate(new Set(registeredIds).size === registeredIds.length, 'context_graph_extractor_id_collision', { registeredIds });
+    emitGate(GATE_ID, {
+        mode,
+        node_kinds: schemaKinds.length,
+        edge_types: schemaEdges.length,
+        profiles: profiles.CONTEXT_GRAPH_QUERY_PROFILE_NAMES.length,
+        traversable_edge_types: reachable.size,
+        extractors: registeredIds
+    });
+}
+async function runBenchmark() {
+    const benchmark = await importDist('core/triwiki/context-graph/benchmark/index.js');
+    const baseline = await importDist('core/triwiki/context-graph/benchmark/adapters/baseline-lexical.js');
+    const candidate = await importDist('core/triwiki/context-graph/benchmark/adapters/candidate-graph.js');
+    return benchmark.runContextGraphBenchmark([baseline.createBaselineLexicalAdapter(), candidate.createCandidateGraphAdapter()], { root, writeReport: true });
+}
+function summaryOf(report, kind) {
+    return report.summaries.find((entry) => entry.adapterKind === kind) || null;
+}
+function failedFloors(report) {
+    return report.floors.results.filter((floor) => !floor.passed).map((floor) => ({
+        id: floor.id,
+        adapter: floor.adapterId,
+        observed: floor.observed,
+        limit: floor.limit,
+        detail: floor.detail.slice(0, 6)
+    }));
+}
+async function runQuality() {
+    const report = await runBenchmark();
+    assertGate(report.integrity.ok, 'context_graph_benchmark_corpus_tampered', { integrity: report.integrity });
+    assertGate(report.floors.ok, 'context_graph_hard_safety_floor_failed', { failed: failedFloors(report) });
+    const candidate = summaryOf(report, 'candidate');
+    assertGate(Boolean(candidate), 'context_graph_benchmark_missing_candidate');
+    assertGate(candidate.provenanceCoverage >= 1, 'context_graph_provenance_coverage_below_floor', { observed: candidate.provenanceCoverage });
+    assertGate(candidate.protectedGateRecall >= 1, 'context_graph_protected_gate_recall_below_floor', { observed: candidate.protectedGateRecall });
+    assertGate(candidate.conflictRecall >= 1, 'context_graph_conflict_recall_below_floor', { observed: candidate.conflictRecall });
+    assertGate(candidate.recallAtK >= 0.9, 'context_graph_recall_below_floor', { observed: candidate.recallAtK });
+    assertGate(candidate.precisionAtK >= 0.5, 'context_graph_precision_below_floor', { observed: candidate.precisionAtK });
+    assertGate(report.score !== null && report.score.passed, 'context_graph_composite_below_threshold', { score: report.score });
+    emitGate(GATE_ID, {
+        mode,
+        recall_at_k: candidate.recallAtK,
+        precision_at_k: candidate.precisionAtK,
+        protected_gate_recall: candidate.protectedGateRecall,
+        conflict_recall: candidate.conflictRecall,
+        provenance_coverage: candidate.provenanceCoverage,
+        composite_improvement: report.score.improvement,
+        floors_evaluated: report.floors.evaluated
+    });
+}
+async function runPerformance() {
+    const report = await runBenchmark();
+    assertGate(report.integrity.ok, 'context_graph_benchmark_corpus_tampered', { integrity: report.integrity });
+    assertGate(report.floors.ok, 'context_graph_hard_safety_floor_failed', { failed: failedFloors(report) });
+    const candidate = summaryOf(report, 'candidate');
+    const baseline = summaryOf(report, 'baseline');
+    assertGate(Boolean(candidate) && Boolean(baseline), 'context_graph_benchmark_missing_adapter');
+    const warmP95 = candidate.warmLatency.p95;
+    const baselineWarmP95 = baseline.warmLatency.p95;
+    const latencyOk = warmP95 <= 75 || (baselineWarmP95 > 0 && warmP95 <= baselineWarmP95 * 0.7);
+    assertGate(latencyOk, 'context_graph_warm_latency_regression', { warmP95, baselineWarmP95 });
+    const tokenOk = baseline.meanTokenCost === 0 || candidate.meanTokenCost <= baseline.meanTokenCost * 0.7;
+    assertGate(tokenOk, 'context_graph_token_cost_regression', { candidate: candidate.meanTokenCost, baseline: baseline.meanTokenCost });
+    assertGate(candidate.warmCacheHitRate >= 0.9, 'context_graph_cache_hit_below_floor', { observed: candidate.warmCacheHitRate });
+    emitGate(GATE_ID, {
+        mode,
+        warm_p95_ms: warmP95,
+        baseline_warm_p95_ms: baselineWarmP95,
+        mean_token_cost: candidate.meanTokenCost,
+        baseline_mean_token_cost: baseline.meanTokenCost,
+        warm_cache_hit_rate: candidate.warmCacheHitRate
+    });
+}
+function runLegacyClosure() {
+    const excluded = [':!CHANGELOG.md', ':!docs/work-orders', ':!.sneakoscope', ':!src/scripts/context-graph-check.ts'];
+    const checks = [
+        { id: 'triwiki_codepack_local', pattern: 'triwiki_codepack_local', pathspecs: ['.', ...excluded] },
+        { id: 'simple_counts_comment', pattern: 'simple counts avoid needing a real dependency graph', pathspecs: ['.', ...excluded] },
+        { id: 'scanCodebaseIndex', pattern: '\\bscanCodebaseIndex\\b', pathspecs: ['.', ...excluded] },
+        { id: 'code_index_scanner_module', pattern: 'code-index-scanner', pathspecs: ['src', 'package.json', 'release-gates.v2.json', 'infra-harness-gates.json', 'runtime-required-scripts.json', ':!src/scripts/context-graph-check.ts'] },
+        {
+            id: 'attentionRelevance',
+            pattern: '\\battentionRelevance\\b',
+            pathspecs: ['.', ...excluded, ':!src/core/subagents/__tests__']
+        },
+        {
+            id: 'lexical_fallback_in_context_mode',
+            pattern: '\\b(searchFilesJs|searchTextJs)\\b',
+            pathspecs: ['src/core/search/context.ts']
+        }
+    ];
+    const violations = [];
+    for (const check of checks) {
+        const hits = gitGrep(check.pattern, check.pathspecs);
+        if (hits.length)
+            violations.push({ id: check.id, hits: hits.slice(0, 6) });
+    }
+    assertGate(violations.length === 0, 'context_graph_legacy_path_survives', { violations });
+    for (const retired of ['src/core/triwiki/code-index-scanner.ts']) {
+        assertGate(!fs.existsSync(path.join(root, retired)), 'context_graph_retired_file_present', { path: retired });
+    }
+    const parked = gitGrep('code-index-scanner', ['src', ':!src/core/triwiki/context-graph', ':!src/scripts/context-graph-check.ts']);
+    assertGate(parked.length === 0, 'context_graph_retired_file_parked', { hits: parked.slice(0, 6) });
+    emitGate(GATE_ID, { mode, checks: checks.length, retired_modules: 1 });
+}
+if (mode === 'contract')
+    await runContract();
+else if (mode === 'quality')
+    await runQuality();
+else if (mode === 'performance')
+    await runPerformance();
+else
+    runLegacyClosure();

package/dist/scripts/doctor-fixes-codex-app-fast-ui-check.js

@@ -12,7 +12,7 @@ const codexHome = path.join(root, 'home', '.codex');
 await fs.mkdir(path.join(root, '.codex'), { recursive: true });
 await fs.mkdir(codexHome, { recursive: true });
 await fs.writeFile(path.join(root, '.codex', 'config.toml'), 'model = "future-codex-model"\nmodel_reasoning_effort = "medium"\nmodel_provider = "codex-lb"\n');
-await fs.writeFile(path.join(codexHome, 'config.toml'), '# SKS forced fast UI during legacy install\nmodel = "legacy-sks-model"\nmodel_reasoning_effort = "xhigh"\nmodel_provider = "codex-lb"\nservice_tier = "fast"\n[features]\nfast_mode = false # user disabled, must remain untouched\n\n[profiles.sks-fast-high]\nmodel = "legacy-profile-model"\nservice_tier = "fast"\n\n[model_providers.codex-lb]\nname = "openai"\nbase_url = "https://lb.example.test/backend-api/codex"\nwire_api = "responses"\nenv_key = "CODEX_LB_API_KEY"\nsupports_websockets = true\nrequires_openai_auth = true\n');
+await fs.writeFile(path.join(codexHome, 'config.toml'), '# SKS forced fast UI during legacy install\nmodel = "legacy-sks-model"\nmodel_reasoning_effort = "xhigh"\nmodel_provider = "codex-lb"\nservice_tier = "fast"\n[features]\nfast_mode = false # user disabled, must remain untouched\n\n[profiles.sks-fast-high]\nmodel = "legacy-profile-model"\nservice_tier = "fast"\n\n[model_providers.codex-lb]\nname = "codex-lb"\nbase_url = "https://lb.example.test/backend-api/codex"\nwire_api = "responses"\nenv_key = "CODEX_LB_API_KEY"\nsupports_websockets = true\nrequires_openai_auth = false\n');
 const fixtureEnv = {};
 const plan = await repairCodexAppFastUi(root, { codexHome, apply: false, env: fixtureEnv });
 const repaired = await repairCodexAppFastUi(root, { codexHome, apply: true, env: fixtureEnv });

package/dist/scripts/gate-policy-audit-check.js

@@ -44,7 +44,7 @@ if (releaseGates.length > 200)
     blockers.push(`release_preset_gate_budget_exceeded:${releaseGates.length}`);
 if (gates.length > 200)
     blockers.push(`release_manifest_gate_budget_exceeded:${gates.length}`);
-if (Object.keys(pkg.scripts || {}).length > 100)
+if (Object.keys(pkg.scripts || {}).length > 101)
     blockers.push(`package_script_budget_exceeded:${Object.keys(pkg.scripts || {}).length}`);
 if (releaseGates.some((gate) => String(gate.id || '').startsWith('zellij:')))
     blockers.push('zellij_gate_in_release_preset');

package/dist/scripts/helper-dedup-check.js

@@ -9,9 +9,7 @@ const BASELINE = {
     emitGate: 10,
     sleep: 9,
     delay: 8,
-    unique: 7,
     readJson: 6,
-    errorCode: 5,
     restoreEnv: 5,
     asList: 4,
     escapeRegex: 4,

package/dist/scripts/installed-package-smoke-check.js

@@ -14,7 +14,10 @@ emitGate('runtime:installed-smoke', {
     tarball: report.tarball,
     tarball_sha256: report.tarball_sha256,
     exact_match: report.tarball_binding.exact_match,
-    install_prefix: report.install_prefix
+    install_prefix: report.install_prefix,
+    postinstall_external_snapshot_match: report.postinstall_default.external_snapshot_match,
+    postinstall_launchctl_calls: report.postinstall_default.launchctl_calls.length,
+    postinstall_package_local_stamp_present: report.postinstall_default.package_local_stamp_present
 });
 function option(name) {
     const index = process.argv.indexOf(name);

package/dist/scripts/latest-version-guidance-check.js

@@ -0,0 +1,74 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { assertGate, emitGate, importDist, root } from './gate-lib.js';
+const { scanLatestVersionGuidance, latestVersionGuidanceReport } = await importDist('core/policy/latest-version-guidance.js');
+const DOC_EXEMPT_RE = /(?:^|\/)(?:CHANGELOG|RECALLPULSE_[^/]*|known-gaps|release-proof-truth)\.md$|compat|codex-0|migration|legacy-upgrade|sks-4-migration|-tasks\.md$/i;
+const SOURCE_EXEMPT = new Set([
+    'src/core/codex-compat/codex-release-manifest.ts',
+    'src/core/release/npm-stage-tarball-verifier-support.ts'
+]);
+const SOURCE_EXEMPT_DIR_RE = /^src\/(?:scripts|vendor|generated)\//;
+function walk(dir, accept, out = []) {
+    let entries = [];
+    try {
+        entries = fs.readdirSync(path.join(root, dir), { withFileTypes: true });
+    }
+    catch {
+        return out;
+    }
+    for (const entry of entries.sort((a, b) => a.name.localeCompare(b.name))) {
+        const rel = `${dir}/${entry.name}`;
+        if (entry.isDirectory()) {
+            if (['node_modules', 'dist', '.git', '__tests__', 'fixtures'].includes(entry.name))
+                continue;
+            walk(rel, accept, out);
+        }
+        else if (accept(rel)) {
+            out.push(rel);
+        }
+    }
+    return out;
+}
+const exemptions = [];
+const findings = [];
+let scannedFiles = 0;
+function scan(rel, options) {
+    const absolute = path.join(root, rel);
+    if (!fs.existsSync(absolute))
+        return;
+    scannedFiles += 1;
+    findings.push(...scanLatestVersionGuidance(rel, fs.readFileSync(absolute, 'utf8'), options));
+}
+scan('README.md', {});
+for (const rel of walk('docs', (candidate) => candidate.endsWith('.md') && path.dirname(candidate) === 'docs')) {
+    if (DOC_EXEMPT_RE.test(rel)) {
+        exemptions.push(rel);
+        continue;
+    }
+    scan(rel, {});
+}
+for (const rel of walk('src', (candidate) => candidate.endsWith('.ts'))) {
+    if (SOURCE_EXEMPT.has(rel) || SOURCE_EXEMPT_DIR_RE.test(rel)) {
+        exemptions.push(rel);
+        continue;
+    }
+    scan(rel, { stringLiteralsOnly: true });
+}
+for (const rel of walk('native', (candidate) => candidate.endsWith('.swift'))) {
+    scan(rel, { stringLiteralsOnly: true });
+}
+const report = latestVersionGuidanceReport(findings, scannedFiles, exemptions);
+const outDir = path.join(root, '.sneakoscope', 'reports');
+fs.mkdirSync(outDir, { recursive: true });
+fs.writeFileSync(path.join(outDir, 'latest-version-guidance.json'), `${JSON.stringify(report, null, 2)}\n`);
+assertGate(report.ok, 'user_facing_pinned_version_guidance', {
+    findings: report.findings.slice(0, 40),
+    total: report.findings.length,
+    policy: 'Recommend the official latest stable release and let capability probes decide support. See docs/architecture/latest-version-guidance-policy.md.'
+});
+emitGate('latest-version:guidance', {
+    scanned_files: report.scannedFiles,
+    exempt_files: report.exemptions.length,
+    findings: 0
+});

package/dist/scripts/release-metadata-check.js

@@ -111,7 +111,7 @@ assertGate(releaseManifest?.schema === 'sks.release-gates.v2', 'release gate man
 assertGate(harnessManifest?.schema === 'sks.infra-harness-gates.v1', 'infra harness manifest schema mismatch', { schema: harnessManifest?.schema || null });
 assertGate(releaseGates.length > 0 && releaseGates.length <= 200, 'release manifest must include 1..200 release gates', { release_gates: releaseGates.length });
 assertGate(harnessGates.length > 0, 'infra harness manifest must include harness gates', { harness_gates: harnessGates.length });
-assertGate(Object.keys(pkg.scripts || {}).length <= 100, 'package script budget exceeded', { script_count: Object.keys(pkg.scripts || {}).length, limit: 100 });
+assertGate(Object.keys(pkg.scripts || {}).length <= 101, 'package script budget exceeded', { script_count: Object.keys(pkg.scripts || {}).length, limit: 101 });
 for (const script of requiredPackageScripts)
     assertGate(Boolean(pkg.scripts?.[script]), `missing package script: ${script}`);
 const fullReleaseScript = String(pkg.scripts?.['release:check:full'] || '');
@@ -149,15 +149,23 @@ assertGate(currentDollarManifest.includes("{ command: '$Naruto'") && currentDoll
 const stageWorkflow = text('.github/workflows/publish-npm.yml');
 const stageJob = stageWorkflow.match(/^  stage-publish:\n[\s\S]*$/m)?.[0] || '';
 const workflowPermissions = stageWorkflow.match(/^permissions:\n(?:  [^\n]+\n)+/m)?.[0] || '';
+const stageContract = text('src/core/release/npm-stage-contract.ts');
+const stagePublishSource = text('src/core/release/stage-publish.ts');
 const stageVerifierSource = text('src/core/release/npm-stage-tarball-verifier.ts');
 const stageVerifierSupport = text('src/core/release/npm-stage-tarball-verifier-support.ts');
 const stageVerifierCli = text('src/scripts/npm-stage-tarball-verifier.ts');
 const releaseReadinessDoc = text('docs/release-readiness.md');
+const workflowNpmStageVersion = stageWorkflow.match(/NPM_STAGE_CLI_VERSION:\s*([0-9]+\.[0-9]+\.[0-9]+)/)?.[1] || '';
+const localNpmStageVersion = stageContract.match(/REQUIRED_NPM_STAGE_CLI_VERSION = '([0-9]+\.[0-9]+\.[0-9]+)'/)?.[1] || '';
 for (const job of ['linux-release-proof', 'macos-menubar-proof', 'pack-and-compare', 'stage-publish']) {
     assertGate(new RegExp(`^  ${job}:`, 'm').test(stageWorkflow), `stage workflow missing job: ${job}`);
 }
 assertGate(/npm install --global npm@\$\{NPM_STAGE_CLI_VERSION\}/.test(stageWorkflow), 'stage workflow must install the exact pinned npm CLI');
-assertGate(/NPM_STAGE_CLI_VERSION: 11\.15\.0/.test(stageWorkflow), 'stage workflow must pin npm 11.15.0');
+assertGate(workflowNpmStageVersion === '11.15.0', 'stage workflow must pin npm 11.15.0', { version: workflowNpmStageVersion || null });
+assertGate(localNpmStageVersion === workflowNpmStageVersion, 'local and workflow npm stage CLI versions must match', {
+    local_version: localNpmStageVersion || null,
+    workflow_version: workflowNpmStageVersion || null
+});
 assertGate(/npm stage publish "\$TARBALL"/.test(stageWorkflow), 'stage workflow must stage the exact tarball path');
 assertGate((stageWorkflow.match(/npm stage publish "\$TARBALL"/g) || []).length === 1, 'stage workflow must contain exactly one registry mutation');
 assertGate(!/\bnpm\s+publish\b/.test(stageWorkflow), 'stage workflow must not call direct npm publish');
@@ -177,15 +185,24 @@ assertGate(/tarball_integrity: sha512Integrity/.test(stageJob), 'stage receipt m
 assertGate(/stage-receipt\/stage-output\.json/.test(stageJob) && /path: stage-receipt/.test(stageJob), 'stage receipt artifact must preserve digest-bound raw stage output');
 assertGate(/review_verifier_schema: 'sks\.npm-stage-review-receipt\.v1'/.test(stageJob), 'stage receipt must declare the maintainer verifier schema');
 assertGate(/localPackReceiptSha256 = crypto\.createHash\('sha256'\)\.update\(localPackReceiptBytes\)/.test(stageJob), 'stage receipt must bind immutable local pack receipt bytes');
+assertGate(/smoke\.postinstall_default\?\.scripts_enabled !== true/.test(stageJob), 'stage job must require scripts-enabled default postinstall proof');
+assertGate(/smoke\.postinstall_default\?\.external_snapshot_match !== true/.test(stageJob), 'stage job must require zero external postinstall mutation');
+assertGate(/smoke\.postinstall_default\.launchctl_calls\.length !== 0/.test(stageJob), 'stage job must require zero default postinstall launchctl calls');
 assertGate(!/approve_command/.test(stageWorkflow), 'stage workflow must not serialize an approval command');
 assertGate(!/\bnpm[ \t]+(?:ci|pack|run|publish|login|logout|whoami)\b/.test(stageJob), 'stage job must not install dependencies, repack, run lifecycle scripts, or use session credentials');
 assertGate(!/NODE_AUTH_TOKEN|NPM_TOKEN|_authToken/.test(stageWorkflow), 'stage workflow must not inject npm tokens');
-assertGate(/REQUIRED_NPM_STAGE_CLI_VERSION = '11\.15\.0'/.test(stageVerifierSupport), 'maintainer stage verifier must require exact npm 11.15.0');
+assertGate(/from '\.\/npm-stage-contract\.js'/.test(stageVerifierSupport), 'maintainer stage verifier support must use the shared npm stage contract');
+assertGate(/exactNpmStageCliInvocation\(\)/.test(stageVerifierSource), 'maintainer stage verifier must resolve the exact pinned npm CLI');
 assertGate(/\['stage', 'view', stageId, '--json'/.test(stageVerifierSource), 'maintainer stage verifier must inspect the exact stage ID read-only');
 assertGate(/\['stage', 'download', stageId, '--json'/.test(stageVerifierSource), 'maintainer stage verifier must download the exact stage ID read-only');
 assertGate(/exact_bytes_match/.test(stageVerifierSource) && /sha256_match/.test(stageVerifierSource) && /sha512_match/.test(stageVerifierSource) && /integrity_match/.test(stageVerifierSource), 'maintainer stage verifier must compare bytes and digests');
-assertGate(/oidc_environment_not_allowed/.test(stageVerifierSupport), 'maintainer stage verifier must reject OIDC and GitHub Actions environments');
+assertGate(/oidc_environment_not_allowed/.test(stageContract), 'maintainer stage verifier must reject OIDC and GitHub Actions environments');
+assertGate(/local_review_verifier/.test(stagePublishSource), 'confirmed stage preflight must require the local review verifier');
+assertGate(/localNpmStageReviewEnvironmentBlocker/.test(stagePublishSource), 'confirmed stage preflight must reject CI and OIDC review environments');
+assertGate(/exactNpmStageCliInvocation\(\)/.test(stagePublishSource), 'confirmed stage preflight must resolve the pinned npm CLI before mutation');
+assertGate(/if \(!preflight\.ok\) return finish\(\)/.test(stagePublishSource), 'stage preflight failures must stop before push or dispatch');
 assertGate(!/\['stage',\s*'(?:publish|approve|reject)'/.test(`${stageVerifierSource}\n${stageVerifierSupport}\n${stageVerifierCli}`), 'maintainer stage verifier must not contain mutating stage argv');
+assertGate(/npx --yes npm@11\.15\.0/.test(releaseReadinessDoc), 'release readiness must document pinned local npm stage resolution');
 assertGate(/npm-stage-tarball-verifier\.js/.test(releaseReadinessDoc) && /--local-receipt/.test(releaseReadinessDoc) && /--local-tarball/.test(releaseReadinessDoc) && /--stage-receipt/.test(releaseReadinessDoc), 'release readiness must document the maintainer-local read-only verifier inputs');
 assertGate(pkg.scripts?.prepublishOnly === 'node ./dist/scripts/prepublish-release-check-or-fast.js', 'prepublishOnly must verify release proof during official npm publish');
 assertGate(pkg.scripts?.prepack === 'node ./dist/scripts/prepublish-release-check-or-fast.js --prepack-build', 'prepack must rebuild and reverify official npm publish output');

package/dist/scripts/release-real-check.js

@@ -102,6 +102,13 @@ const tasks = [
     task('zellij:real-session-cleanup', 'direct', { command: nodeScript('zellij-real-session-cleanup-check.js'), group: 'real_ui', phase: 'aggregation', args: ['--mission', zellijMissionId, '--session', zellijSessionName, '--owned-socket-dir', zellijSocketDir], env: zellijOwnedEnv, deps: ['zellij:pane-proof', 'zellij:screen-proof'], alwaysRun: true, policy: requiredPolicy(['sks.zellij-real-session-cleanup-check.v1']) }),
     task('naruto:worktree-coding:blackbox', 'direct', { command: nodeScript('naruto-worktree-coding-blackbox.js'), group: 'real_smoke', phase: 'parallel_processing', args: ['--require-real'], env: { SKS_REQUIRE_GIT_WORKTREE: '1' }, policy: requiredPolicy(['sks.release-gate.v1']) }),
     task('codex-sdk:real-smoke', 'direct', { command: nodeScript('codex-sdk-real-smoke-check.js'), group: 'real_smoke', phase: 'parallel_processing', args: ['--require-real'], policy: requiredPolicy(['sks.release-gate.v1'], { statusRequired: true, passStatuses: ['proven'] }) }),
+    task('codex-lb:desktop-real-evidence', 'direct', {
+        command: nodeScript('codex-lb-desktop-real-evidence-check.js'),
+        group: 'real_ui',
+        phase: 'parallel_verification',
+        deps: ['codex:actual-config-load-probe'],
+        policy: liveOptionalPolicy(['sks.codex-lb-desktop-real-evidence-check.v1'], ['passed'])
+    }),
     task('imagegen:real-smoke', 'direct', { command: nodeScript('imagegen-real-smoke-check.js'), group: 'real_smoke', phase: 'parallel_processing', policy: liveOptionalPolicy(['sks.imagegen-real-smoke.v1'], ['passed']) }),
     task('ux-review:real-imagegen-smoke', 'direct', { command: nodeScript('ux-review-real-imagegen-smoke-check.js'), group: 'real_smoke', phase: 'parallel_processing', deps: ['imagegen:real-smoke'], policy: liveOptionalPolicy(['sks.ux-real-imagegen-smoke.v1'], ['passed']) }),
     task('ppt:real-imagegen-smoke', 'direct', { command: nodeScript('ppt-real-imagegen-smoke-check.js'), group: 'real_smoke', phase: 'parallel_processing', deps: ['imagegen:real-smoke'], policy: liveOptionalPolicy(['sks.ppt-real-imagegen-smoke.v1'], ['passed']) })