sneakoscope 7.3.0 → 7.6.0

package/dist/scripts/ux-review-imagegen-blackbox-check.js

@@ -8,7 +8,7 @@ const repoRoot = process.cwd();
 const runRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-ux-review-imagegen-blackbox-'));
 const sksBin = path.join(repoRoot, 'dist', 'bin', 'sks.js');
 const sourceImage = osTempPngFixtureArg('ux-review-imagegen-blackbox-source.png');
-const run = spawnSync(process.execPath, [sksBin, 'ux-review', 'run', '--image', sourceImage, '--generate-callouts', '--mock', '--json'], {
+const run = spawnSync(process.execPath, [sksBin, 'ux-review', 'run', '--image', sourceImage, '--mock', '--json'], {
     cwd: runRoot,
     env: { ...process.env, SKS_TEST_FAKE_IMAGEGEN: '1', SKS_TEST_FAKE_EXTRACTOR: '1', SKS_MOCK: '1', NODE_ENV: 'test', SKS_UPDATE_MIGRATION_GATE_DISABLED: '1', SKS_SKIP_NPM_FRESHNESS_CHECK: '1' },
     encoding: 'utf8',
@@ -20,19 +20,41 @@ const request = missionDir ? readJson(path.join(missionDir, 'image-ux-gpt-image-
 const response = missionDir ? readJson(path.join(missionDir, 'image-ux-gpt-image-2-response.json')) : null;
 const issues = missionDir ? readJson(path.join(missionDir, 'image-ux-issue-ledger.json')) : null;
 const generated = missionDir ? readJson(path.join(missionDir, 'image-ux-generated-review-ledger.json')) : null;
+const extraction = missionDir ? readJson(path.join(missionDir, 'image-ux-callout-extraction-report.json')) : null;
+const uxReport = missionDir ? readJson(path.join(missionDir, 'image-ux-iteration-report.json')) : null;
 const proof = missionDir ? readJson(path.join(missionDir, 'completion-proof.json')) : null;
 const ok = Boolean(parsed?.mission_id)
     && [0, 1].includes(run.status)
     && ['blocked', 'verified_partial_reference'].includes(parsed?.status)
     && request?.validation?.ok === true
+    && /senior Toss UI\/UX product designer/.test(request?.prompt || '')
+    && /P0\/P1\/P2\/P3/.test(request?.prompt || '')
+    && /visual hierarchy/.test(request?.prompt || '')
+    && /contrast/.test(request?.prompt || '')
+    && /density/.test(request?.prompt || '')
+    && /affordance/.test(request?.prompt || '')
+    && /eye-flow arrows/.test(request?.prompt || '')
+    && /corrected mini-comp/.test(request?.prompt || '')
     && response?.evidence_class === 'mock_fixture'
     && generated?.generated_count === 1
     && generated?.real_generated_count === 0
     && generated?.non_real_generated_count === 1
     && generated?.generated_review_images?.[0]?.mock === true
+    && generated?.generated_review_images?.[0]?.callout_extraction_status === 'succeeded'
     && Array.isArray(issues?.issues)
     && issues.issues.length > 0
     && issues.issues.every((issue) => issue.source === 'mock_fixture')
+    && issues.issues.every((issue) => issue.generated_review_image_id === generated.generated_review_images[0].id)
+    && issues.issues.every((issue) => issue.generated_image_sha256 === generated.generated_review_images[0].sha256)
+    && extraction?.analysis_input === 'generated_annotated_review_image'
+    && extraction?.source_screenshot_used_for_extraction === false
+    && extraction?.generated_image_id === generated.generated_review_images[0].id
+    && extraction?.generated_image_sha256 === generated.generated_review_images[0].sha256
+    && response?.generated_review_image_id === generated.generated_review_images[0].id
+    && uxReport?.report_type === 'ux_ui_change_report'
+    && uxReport?.analysis_basis?.primary_evidence === 'generated_annotated_review_image'
+    && uxReport?.analysis_basis?.based_on_generated_image === true
+    && uxReport?.recommendations?.length === issues.issues.length
     && ['mock_only', 'verified_partial'].includes(proof?.status)
     && proof?.evidence?.image_ux_review?.reference_only === true
     && proof?.evidence?.image_ux_review?.generated_gpt_image_2_callout_images_count === 0;
@@ -48,6 +70,8 @@ console.log(JSON.stringify({
     source_image: sourceImage,
     request,
     response,
+    extraction,
+    ux_report: uxReport,
     issue_count: issues?.issues?.length || 0
 }, null, 2));
 if (!ok)

package/dist/scripts/ux-review-run-wires-imagegen-check.js

@@ -1,14 +1,22 @@
 #!/usr/bin/env node
 import { emitGate, requireContains } from './real-execution-check-lib.js';
 requireContains('ux-review:run-wires-imagegen', 'src/core/commands/image-ux-review-command.ts', [
-    'const shouldGenerateCallouts = flag(args, \'--generate-callouts\') || flag(args, \'--fix\')',
+    'const shouldGenerateCallouts = !generatedImage',
     'requireCodexImagegen',
+    'buildCalloutPrompt',
     'generateGptImage2CalloutReview',
     'evidence_class',
     'output_sha256',
     'imagegenEvidenceClassBlockers',
     'isFullImagegenOutputSource',
     'extractRealCallouts',
+    'extractAndWriteGeneratedReview',
+    'imageUxReviewCommandOutcome',
+    "allowReviewOnlyCompletion: !flag(args, '--fix')",
+    'allowReviewOnlyCompletion: false',
+    'generated_review_image_id',
+    'callout_extraction_status',
+    'captured_screenshot_path_required',
     'buildImageUxCalloutExtractionReport'
 ]);
 requireContains('ux-review:run-wires-imagegen', 'src/core/imagegen/imagegen-evidence.ts', [

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "7.3.0",
+  "version": "7.6.0",
   "description": "Proof-first Codex CLI and ChatGPT Desktop orchestration for AI coding agents, release verification, and macOS menu bar control.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -33,11 +33,15 @@
     "!dist/**/*.tsbuildinfo",
     "!dist/**/__tests__",
     "!dist/**/*.test.js",
+    "!dist/cli/install-helpers-codex-lb-selftest.js",
+    "!dist/cli/install-helpers-codex-lb-selftest-chain.js",
     "!dist/core/telegram/mini-app.js",
     "!dist/scripts/**",
-    "dist/scripts/{agent-guidance-dedup-check.js,agent-message-bus-reader-check.js,all-feature-deep-completion-check.js,appshots-thread-attachment-discovery-check.js,architecture-guard-check.js,certificate-sla-check.js,check-runtime-schemas.js,cli-output-consistency-check.js,codex-0-134-runner-truth-check.js,codex-0-137-compat-check.js,codex-0138-capability-artifact-check.js,codex-0138-capability-check.js,codex-0138-doctor-check.js,codex-0138-feature-probes-check.js,codex-0144-app-server-v2-check.js,codex-0144-binary-identity-check.js,codex-0144-capability-check.js,codex-0144-core-real-probes-check.js,codex-0144-manifest-check.js,codex-0144-policy-check.js,codex-0144-thread-store-check.js,codex-agent-role-rich-content-check.js,codex-agent-role-sync-check.js,codex-agent-type-routing-check.js,codex-app-execution-profile-check.js,codex-app-fast-ui-preservation-check.js,codex-app-handoff-check.js,codex-app-handoff-launch-check.js,codex-config-load-probe.js,codex-control-all-pipelines-check.js,codex-control-event-stream-ledger-check.js,codex-control-tool-output-continuity-audit-check.js,codex-lb-fast-mode-truth-check.js,codex-lb-fast-ui-preservation-check.js,codex-lb-gpt56-fast-profile-check.js,codex-native-agent-role-content-check.js,codex-native-feature-broker-blackbox.js,codex-native-feature-broker-check.js,codex-native-harness-compat-check.js,codex-native-hook-lifecycle-proof-check.js,codex-native-runtime-e2e-fixture.js,codex-plugin-app-template-policy-check.js,codex-sdk-all-pipelines-check.js,codex-sdk-backend-router-check.js,codex-sdk-capability-check.js,codex-sdk-event-stream-ledger-check.js,codex-sdk-real-smoke-check.js,concurrent-session-collision-check.js,context7-evidence-dedupe-check.js,core-skill-card-schema-check.js,core-skill-deployment-snapshot-check.js,core-skill-heldout-validation-check.js,core-skill-no-inference-optimizer-check.js,core-skill-patch-check.js,core-skill-route-runtime-integration-check.js,current-command-surface-check.js,current-surface-update-e2e-check.js,current-upgrade-matrix-check.js,dfix-fixture-check.js,dfix-patch-handoff-check.js,dfix-verification-check.js,dfix-verification-recommendation-check.js,docs-truthfulness-check.js,doctor-codex-app-harness-check.js,doctor-fix-proves-codex-read-check.js,doctor-fixes-codex-app-fast-ui-check.js,evidence-flagship-coverage-check.js,fast-codex-service-tier-proof-check.js,fixtures/fake-codex-config-loader.js,gate-policy-audit-check.js,geo-claim-evidence-check.js,geo-cli-blackbox-check.js,geo-crawler-policy-check.js,git-worktree-checkpoint-check.js,git-worktree-cross-rebase-check.js,git-worktree-diff-envelope-check.js,git-worktree-dirty-lock-check.js,git-worktree-dirty-main-detection-check.js,git-worktree-integration-primary-check.js,git-worktree-manifest-append-check.js,git-worktree-untracked-diff-check.js,goal-artifact-compat-check.js,harness-benchmark-check.js,helper-dedup-check.js,hook-latency-budget-check.js,image-artifact-path-contract-check.js,imagegen-real-smoke-check.js,init-deep-backup-retention-check.js,installed-package-smoke-check.js,legacy-gate-inventory-check.js,legacy-gate-purge-check.js,legacy-strong-inventory-check.js,lib/codex-sdk-gate-lib.js,lib/ensure-dist-fresh.js,lib/git-worktree-fixture.js,lib/valid-png-fixture.js,local-collab-all-pipelines-final-gpt-check.js,loop-directive-check-lib.js,loop-integration-finalizer-check.js,loop-worker-fixture-child.js,mad-preflight-blocks-unreadable-config-check.js,mad-sks-app-ui-no-mutation-check.js}",
-    "dist/scripts/{mad-sks-launch-sql-plane-boundary-check.js,mad-sks-sql-plane-capability-check.js,mad-sks-sql-plane-lifecycle-hook-decision-check.js,mad-sks-sql-plane-result-lifecycle-check.js,managed-config-merge-check.js,mcp-plugin-inventory-check.js,model-call-concurrency-check.js,mutation-callsite-coverage-check.js,naruto-ssot-gate-aliases-check.js,naruto-ssot-pipeline-default-check.js,naruto-ssot-route-normalization-check.js,naruto-ssot-routing-check.js,naruto-worktree-coding-blackbox.js,native-capability-repair-matrix-check.js,native-image-generation-repair-check.js,official-subagent-workflow-check.js,package-published-contract-check.js,packlist-performance-check.js,pipeline-codex-native-doctor-mad-routing-check.js,pipeline-codex-native-doctor-mad-routing-real-blackbox.js,pipeline-codex-native-image-routing-check.js,pipeline-codex-native-image-routing-real-blackbox.js,pipeline-codex-native-loop-routing-check.js,pipeline-codex-native-loop-routing-real-blackbox.js,pipeline-codex-native-qa-routing-check.js,pipeline-codex-native-qa-routing-real-blackbox.js,pipeline-codex-native-research-routing-check.js,pipeline-codex-native-research-routing-real-blackbox.js,ppt-full-e2e-blackbox-check.js,ppt-real-export-adapter-check.js,ppt-real-imagegen-smoke-check.js,ppt-real-imagegen-wiring-check.js,ppt-reexport-rereview-check.js,prepublish-fast-check.js,prepublish-release-check-or-fast.js,probe-memoization-check.js,product-design-plugin-routing-check.js,prompt-placeholder-guard-check.js,proof-root-cause-policy-check.js,provider-badge-context-check.js,python-codex-sdk-all-pipelines-check.js,qa-loop-app-handoff-capability-check.js,qa-loop-app-handoff-check.js,qa-loop-app-handoff-cli-check.js,qa-loop-app-handoff-confirmation-check.js,qa-loop-app-handoff-gate-lifecycle-check.js,qa-loop-app-handoff-launch-check.js,qa-loop-app-handoff-status-lifecycle-check.js,qa-loop-budget-policy-check.js,qa-loop-effort-escalation-check.js,qa-loop-execution-profile-routing-check.js,qa-loop-image-path-exposure-check.js,qa-loop-image-path-prompt-injection-check.js,release-affected-selector-check.js,release-aggressive-resource-governor-check.js,release-cache-glob-hashing-check.js,release-cache-input-classifier-check.js,release-cache-neutralization-report-check.js,release-cache-version-neutral-fixture-check.js,release-check-stamp.js,release-dynamic-presets-check.js,release-full-parallelism-blackbox.js,release-gate-batch-runner-check.js,release-gate-budget-check.js,release-gate-dag-runner-check.js,release-gate-dag-runner.js,release-latency-slo-check.js,release-metadata-check.js,release-pack-receipt.js,release-parallel-speed-budget-check.js,release-proof-truth-check.js,release-provenance-check.js,release-real-check.js,release-runtime-truth-matrix-check.js,release-speed-summary.js,research-blueprint-densifier-check.js,research-claim-builder-check.js,research-complete-package-fixture-check.js,research-execution-profile-routing-check.js,research-final-reviewer-blackbox.js,responses-retry-policy-centralized-check.js,runtime-proof-summary-check.js,runtime-script-pack-closure-check.js,scheduler-batch-dispatch-check.js,scheduler-parallel-proof-consistency-check.js,scheduler-utilization-integral-check.js,search-visibility-gate-lib.js,secret-preservation-check.js,seo-audit-fixture-check.js,seo-cli-blackbox-check.js,seo-geo-geo-disambiguation-check.js,seo-geo-route-identity-check.js,seo-geo-skill-rich-content-check.js,seo-no-mutation-by-default-check.js,shared-memory-fixture-check.js,side-effect-runtime-report-check.js,skill-name-canonicalizer-check.js,skills-manifest-continuity-check.js,sks-cli-gate-lib.js}",
+    "dist/scripts/{agent-guidance-dedup-check.js,agent-message-bus-reader-check.js,all-feature-deep-completion-check.js,appshots-thread-attachment-discovery-check.js,architecture-guard-check.js,certificate-sla-check.js,check-runtime-schemas.js,cli-output-consistency-check.js,codex-0-134-runner-truth-check.js,codex-0-137-compat-check.js,codex-0138-capability-artifact-check.js,codex-0138-capability-check.js,codex-0138-doctor-check.js,codex-0138-feature-probes-check.js,codex-0144-app-server-v2-check.js,codex-0144-binary-identity-check.js,codex-0144-capability-check.js,codex-0144-core-real-probes-check.js,codex-0144-manifest-check.js,codex-0144-policy-check.js,codex-0144-thread-store-check.js,codex-agent-role-rich-content-check.js,codex-agent-role-sync-check.js,codex-agent-type-routing-check.js,codex-app-execution-profile-check.js,codex-app-fast-ui-preservation-check.js,codex-app-handoff-check.js,codex-app-handoff-launch-check.js,codex-config-load-probe.js,context-graph-check.js,codex-control-all-pipelines-check.js,codex-control-event-stream-ledger-check.js,codex-control-tool-output-continuity-audit-check.js,codex-lb-catalog-passthrough-check.js,codex-lb-desktop-auth-invariant-check.js,codex-lb-desktop-bridge-check.js,codex-lb-desktop-bridge-latency-check.js,codex-lb-desktop-capabilities-check.js,codex-lb-desktop-real-evidence-check.js,codex-lb-fast-mode-truth-check.js,codex-lb-fast-ui-preservation-check.js,codex-lb-gpt56-fast-profile-check.js,codex-native-agent-role-content-check.js,codex-native-feature-broker-blackbox.js,codex-native-feature-broker-check.js,codex-native-harness-compat-check.js,codex-native-hook-lifecycle-proof-check.js,codex-native-runtime-e2e-fixture.js,codex-plugin-app-template-policy-check.js,codex-sdk-all-pipelines-check.js,codex-sdk-backend-router-check.js,codex-sdk-capability-check.js,codex-sdk-event-stream-ledger-check.js,codex-sdk-real-smoke-check.js,concurrent-session-collision-check.js,context7-evidence-dedupe-check.js,core-skill-card-schema-check.js,core-skill-deployment-snapshot-check.js,core-skill-heldout-validation-check.js,core-skill-no-inference-optimizer-check.js,core-skill-patch-check.js,core-skill-route-runtime-integration-check.js,current-command-surface-check.js,current-surface-update-e2e-check.js,current-upgrade-matrix-check.js,dfix-fixture-check.js,dfix-patch-handoff-check.js,dfix-verification-check.js,dfix-verification-recommendation-check.js,docs-truthfulness-check.js,doctor-codex-app-harness-check.js,doctor-fix-proves-codex-read-check.js,doctor-fixes-codex-app-fast-ui-check.js,evidence-flagship-coverage-check.js,fast-codex-service-tier-proof-check.js,fixtures/fake-codex-config-loader.js,gate-policy-audit-check.js,geo-claim-evidence-check.js,geo-cli-blackbox-check.js,geo-crawler-policy-check.js,git-worktree-checkpoint-check.js,git-worktree-cross-rebase-check.js,git-worktree-diff-envelope-check.js,git-worktree-dirty-lock-check.js,git-worktree-dirty-main-detection-check.js,git-worktree-integration-primary-check.js,git-worktree-manifest-append-check.js,git-worktree-untracked-diff-check.js,goal-artifact-compat-check.js,harness-benchmark-check.js,helper-dedup-check.js,hook-latency-budget-check.js,image-artifact-path-contract-check.js,imagegen-real-smoke-check.js,init-deep-backup-retention-check.js,installed-package-smoke-check.js,legacy-gate-inventory-check.js,legacy-gate-purge-check.js,legacy-strong-inventory-check.js,lib/codex-sdk-gate-lib.js,lib/ensure-dist-fresh.js,lib/git-worktree-fixture.js,lib/valid-png-fixture.js,local-collab-all-pipelines-final-gpt-check.js,loop-directive-check-lib.js,loop-integration-finalizer-check.js,loop-worker-fixture-child.js,mad-preflight-blocks-unreadable-config-check.js,mad-sks-app-ui-no-mutation-check.js}",
+    "dist/scripts/{latest-version-guidance-check.js,mad-sks-launch-sql-plane-boundary-check.js,mad-sks-sql-plane-capability-check.js,mad-sks-sql-plane-lifecycle-hook-decision-check.js,mad-sks-sql-plane-result-lifecycle-check.js,managed-config-merge-check.js,mcp-plugin-inventory-check.js,model-call-concurrency-check.js,mutation-callsite-coverage-check.js,naruto-ssot-gate-aliases-check.js,naruto-ssot-pipeline-default-check.js,naruto-ssot-route-normalization-check.js,naruto-ssot-routing-check.js,naruto-worktree-coding-blackbox.js,native-capability-repair-matrix-check.js,native-image-generation-repair-check.js,official-subagent-workflow-check.js,package-published-contract-check.js,packlist-performance-check.js,pipeline-codex-native-doctor-mad-routing-check.js,pipeline-codex-native-doctor-mad-routing-real-blackbox.js,pipeline-codex-native-image-routing-check.js,pipeline-codex-native-image-routing-real-blackbox.js,pipeline-codex-native-loop-routing-check.js,pipeline-codex-native-loop-routing-real-blackbox.js,pipeline-codex-native-qa-routing-check.js,pipeline-codex-native-qa-routing-real-blackbox.js,pipeline-codex-native-research-routing-check.js,pipeline-codex-native-research-routing-real-blackbox.js,ppt-full-e2e-blackbox-check.js,ppt-real-export-adapter-check.js,ppt-real-imagegen-smoke-check.js,ppt-real-imagegen-wiring-check.js,ppt-reexport-rereview-check.js,prepublish-fast-check.js,prepublish-release-check-or-fast.js,probe-memoization-check.js,product-design-plugin-routing-check.js,prompt-placeholder-guard-check.js,proof-root-cause-policy-check.js,provider-badge-context-check.js,python-codex-sdk-all-pipelines-check.js,qa-loop-app-handoff-capability-check.js,qa-loop-app-handoff-check.js,qa-loop-app-handoff-cli-check.js,qa-loop-app-handoff-confirmation-check.js,qa-loop-app-handoff-gate-lifecycle-check.js,qa-loop-app-handoff-launch-check.js,qa-loop-app-handoff-status-lifecycle-check.js,qa-loop-budget-policy-check.js,qa-loop-effort-escalation-check.js,qa-loop-execution-profile-routing-check.js,qa-loop-image-path-exposure-check.js,qa-loop-image-path-prompt-injection-check.js,release-affected-selector-check.js,release-aggressive-resource-governor-check.js,release-cache-glob-hashing-check.js,release-cache-input-classifier-check.js,release-cache-neutralization-report-check.js,release-cache-version-neutral-fixture-check.js,release-check-stamp.js,release-dynamic-presets-check.js,release-full-parallelism-blackbox.js,release-gate-batch-runner-check.js,release-gate-budget-check.js,release-gate-dag-runner-check.js,release-gate-dag-runner.js,release-latency-slo-check.js,release-metadata-check.js,release-pack-receipt.js,release-parallel-speed-budget-check.js,release-proof-truth-check.js,release-provenance-check.js,release-real-check.js,release-runtime-truth-matrix-check.js,release-speed-summary.js,research-blueprint-densifier-check.js,research-claim-builder-check.js,research-complete-package-fixture-check.js,research-execution-profile-routing-check.js,research-final-reviewer-blackbox.js,responses-retry-policy-centralized-check.js,runtime-proof-summary-check.js,runtime-script-pack-closure-check.js,scheduler-batch-dispatch-check.js,scheduler-parallel-proof-consistency-check.js,scheduler-utilization-integral-check.js,search-visibility-gate-lib.js,secret-preservation-check.js,seo-audit-fixture-check.js,seo-cli-blackbox-check.js,seo-geo-geo-disambiguation-check.js,seo-geo-route-identity-check.js,seo-geo-skill-rich-content-check.js,seo-no-mutation-by-default-check.js,shared-memory-fixture-check.js,side-effect-runtime-report-check.js,skill-name-canonicalizer-check.js,skills-manifest-continuity-check.js,sks-cli-gate-lib.js}",
     "dist/scripts/{real-execution-check-lib.js,gate-lib.js,runtime-domain-gate-lib.js,typed-routing-gate-lib.js,codex-native-gate-lib.js,skill-fixture-check-lib.js,sks-uninstall-regression-check.js,sksd-daemon-check.js,super-search-provider-interface-check.js,triwiki-cache-key-check.js,triwiki-proof-bank-blackbox.js,triwiki-proof-bank-check.js,triwiki-proof-card-check.js,trust-fixture-check.js,type-surface-codex-app-check.js,ultra-router-auto-router-check.js,uninstall-inventory-check.js,ux-review-extract-wires-real-extractor-check.js,ux-review-imagegen-blackbox-check.js,ux-review-patch-diff-recheck-check.js,ux-review-real-imagegen-smoke-check.js,ux-review-run-wires-imagegen-check.js,wrongness-fixture-check.js,zellij-pane-proof-check.js,zellij-real-session-cleanup-check.js,zellij-real-session-launch-check.js,zellij-screen-proof-check.js}",
+    "!dist/core/triwiki/context-graph/benchmark",
+    "!dist/core/triwiki/context-graph/optimizer",
     "!dist/core/evidence/flagship-proof-graph-validator.js",
     "!dist/core/agents/agent-ledger-schemas.js",
     "!dist/core/agents/agent-cleanup-executor.js",
@@ -129,6 +133,7 @@
     "skill:dedupe-blackbox": "node ./dist/scripts/project-skill-dedupe-blackbox.js",
     "release:check:affected": "npm run release:ensure-build --silent && node ./dist/scripts/release-gate-dag-runner.js --preset affected --changed-since auto --sla 5m",
     "release:real-check": "node ./dist/scripts/release-real-check.js",
+    "codex-lb:desktop-real-evidence": "node ./dist/scripts/codex-lb-desktop-real-evidence-check.js",
     "release:check:fast": "npm run release:ensure-build --silent && node ./dist/scripts/release-gate-dag-runner.js --preset fast --changed-since auto --sla 5m",
     "release:check:confidence": "npm run release:ensure-build --silent && node ./dist/scripts/release-gate-dag-runner.js --preset confidence --changed-since auto --sla 5m",
     "release:check:full": "npm run build:clean --silent && npm test --silent && node ./dist/scripts/release-gate-dag-runner.js --preset release --full && node ./dist/scripts/release-real-check.js --skip-release-check && npm run release:dist-freshness --silent && node ./dist/scripts/release-check-stamp.js write --preset release --full",

package/release-gates.v2.json

@@ -3816,7 +3816,7 @@
     },
     {
       "id": "codex-lb:comprehensive",
-      "command": "node ./dist/scripts/codex-lb-fast-ui-preservation-check.js && node ./dist/scripts/codex-lb-fast-mode-truth-check.js && node --test --test-concurrency=1 dist/core/__tests__/codex-lb-tool-catalog.test.js dist/core/__tests__/codex-lb-transport-security.test.js && node ./dist/scripts/codex-lb-gpt56-fast-profile-check.js",
+      "command": "node ./dist/scripts/codex-lb-desktop-auth-invariant-check.js && node ./dist/scripts/codex-lb-desktop-bridge-check.js && node ./dist/scripts/codex-lb-desktop-bridge-latency-check.js && node ./dist/scripts/codex-lb-catalog-passthrough-check.js && node ./dist/scripts/codex-lb-desktop-capabilities-check.js && node ./dist/scripts/codex-lb-fast-ui-preservation-check.js && node ./dist/scripts/codex-lb-fast-mode-truth-check.js && node --test --test-concurrency=1 dist/core/__tests__/codex-lb-tool-catalog.test.js dist/core/__tests__/codex-lb-transport-security.test.js && node ./dist/scripts/codex-lb-gpt56-fast-profile-check.js",
       "deps": [
         "codex-app:fast-ui-preservation"
       ],
@@ -3831,6 +3831,7 @@
         "inputs": [
           "package.json",
           "release-gates.v2.json",
+          "runtime-required-scripts.json",
           "src/**",
           "schemas/**"
         ]
@@ -4662,6 +4663,180 @@
         "release"
       ],
       "output_contract": "sks.gate-result.v1"
+    },
+    {
+      "id": "context-graph:contract",
+      "command": "node ./dist/scripts/context-graph-check.js --mode contract",
+      "deps": [],
+      "resource": [
+        "cpu-light",
+        "fs-read"
+      ],
+      "side_effect": "hermetic",
+      "timeout_ms": 120000,
+      "cache": {
+        "enabled": true,
+        "inputs": [
+          "package.json",
+          "release-gates.v2.json",
+          "schemas/triwiki/context-graph.schema.json",
+          "src/core/triwiki/context-graph/contracts.ts",
+          "src/core/triwiki/context-graph/ids.ts",
+          "src/core/triwiki/context-graph/paths.ts",
+          "src/core/triwiki/context-graph/profiles.ts",
+          "src/core/triwiki/context-graph/query-types.ts",
+          "src/core/triwiki/context-graph/graph-index.ts",
+          "src/core/triwiki/context-graph/extractors/index.ts",
+          "src/core/triwiki/context-graph/query/ranking-config.ts",
+          "src/scripts/context-graph-check.ts"
+        ]
+      },
+      "isolation": {
+        "home": "temp",
+        "codex_home": "temp",
+        "report_dir": "per-gate"
+      },
+      "preset": [
+        "release"
+      ],
+      "output_contract": "sks.gate-result.v1"
+    },
+    {
+      "id": "context-graph:quality",
+      "command": "node ./dist/scripts/context-graph-check.js --mode quality",
+      "deps": [
+        "context-graph:contract"
+      ],
+      "resource": [
+        "cpu-light",
+        "fs-read"
+      ],
+      "side_effect": "hermetic",
+      "timeout_ms": 300000,
+      "cache": {
+        "enabled": true,
+        "inputs": [
+          "package.json",
+          "release-gates.v2.json",
+          "config/context-graph-benchmark.json",
+          "src/core/triwiki/context-graph/**",
+          "src/core/naruto/context-graph-advisor.ts",
+          "src/core/naruto/context-graph-advisor-scope.ts",
+          "src/core/search/files.ts",
+          "src/core/search/text.ts",
+          "src/scripts/context-graph-check.ts"
+        ]
+      },
+      "isolation": {
+        "home": "temp",
+        "codex_home": "temp",
+        "report_dir": "per-gate"
+      },
+      "preset": [
+        "release"
+      ],
+      "output_contract": "sks.gate-result.v1"
+    },
+    {
+      "id": "context-graph:performance",
+      "command": "node ./dist/scripts/context-graph-check.js --mode performance",
+      "deps": [
+        "context-graph:contract"
+      ],
+      "resource": [
+        "cpu-light",
+        "fs-read"
+      ],
+      "side_effect": "hermetic",
+      "timeout_ms": 300000,
+      "cache": {
+        "enabled": true,
+        "inputs": [
+          "package.json",
+          "release-gates.v2.json",
+          "config/context-graph-benchmark.json",
+          "src/core/triwiki/context-graph/**",
+          "src/core/naruto/context-graph-advisor.ts",
+          "src/core/naruto/context-graph-advisor-scope.ts",
+          "src/core/search/files.ts",
+          "src/core/search/text.ts",
+          "src/scripts/context-graph-check.ts"
+        ]
+      },
+      "isolation": {
+        "home": "temp",
+        "codex_home": "temp",
+        "report_dir": "per-gate"
+      },
+      "preset": [
+        "release"
+      ],
+      "output_contract": "sks.gate-result.v1"
+    },
+    {
+      "id": "context-graph:legacy-closure",
+      "command": "node ./dist/scripts/context-graph-check.js --mode legacy-closure",
+      "deps": [],
+      "resource": [
+        "cpu-light",
+        "fs-read"
+      ],
+      "side_effect": "hermetic",
+      "timeout_ms": 120000,
+      "cache": {
+        "enabled": true,
+        "inputs": [
+          "package.json",
+          "release-gates.v2.json",
+          "src/core/search/context.ts",
+          "src/core/search/context-graph-seeds.ts",
+          "src/core/subagents/triwiki-attention.ts",
+          "src/core/triwiki/code-pack.ts",
+          "src/core/commands/wiki-command.ts",
+          "src/scripts/context-graph-check.ts"
+        ]
+      },
+      "isolation": {
+        "home": "temp",
+        "codex_home": "temp",
+        "report_dir": "per-gate"
+      },
+      "preset": [
+        "release"
+      ],
+      "output_contract": "sks.gate-result.v1"
+    },
+    {
+      "id": "latest-version:guidance",
+      "command": "node ./dist/scripts/latest-version-guidance-check.js",
+      "deps": [],
+      "resource": [
+        "cpu-light",
+        "fs-read"
+      ],
+      "side_effect": "hermetic",
+      "timeout_ms": 120000,
+      "cache": {
+        "enabled": true,
+        "inputs": [
+          "package.json",
+          "release-gates.v2.json",
+          "README.md",
+          "docs/**",
+          "src/**",
+          "native/**",
+          "src/scripts/latest-version-guidance-check.ts"
+        ]
+      },
+      "isolation": {
+        "home": "temp",
+        "codex_home": "temp",
+        "report_dir": "per-gate"
+      },
+      "preset": [
+        "release"
+      ],
+      "output_contract": "sks.gate-result.v1"
     }
   ]
 }

package/runtime-required-scripts.json

@@ -7,6 +7,36 @@
       "category": "installed_repair",
       "reason": "installed doctor and repair paths probe whether Codex can load the managed project config"
     },
+    {
+      "path": "dist/scripts/codex-lb-catalog-passthrough-check.js",
+      "category": "installed_runtime",
+      "reason": "the installed public release gate DAG verifies catalog v2 pass-through against the packaged runtime"
+    },
+    {
+      "path": "dist/scripts/codex-lb-desktop-auth-invariant-check.js",
+      "category": "installed_runtime",
+      "reason": "the installed public release gate DAG verifies Desktop OAuth byte preservation and guarded rollback behavior"
+    },
+    {
+      "path": "dist/scripts/codex-lb-desktop-bridge-check.js",
+      "category": "installed_runtime",
+      "reason": "the installed public release gate DAG verifies the packaged localhost Desktop bridge transports and redaction"
+    },
+    {
+      "path": "dist/scripts/codex-lb-desktop-bridge-latency-check.js",
+      "category": "installed_runtime",
+      "reason": "the installed public release gate DAG enforces localhost-only Desktop bridge HTTP and SSE latency budgets"
+    },
+    {
+      "path": "dist/scripts/codex-lb-desktop-capabilities-check.js",
+      "category": "installed_runtime",
+      "reason": "the installed public release gate DAG verifies capability evidence state boundaries in the packaged runtime"
+    },
+    {
+      "path": "dist/scripts/codex-lb-desktop-real-evidence-check.js",
+      "category": "installed_runtime",
+      "reason": "the installed full release proof fails closed unless trusted real Codex Desktop evidence covers native features, lifecycle recovery, and the remote other-Mac runtime"
+    },
     {
       "path": "dist/scripts/lib/ensure-dist-fresh.js",
       "category": "installed_repair",

package/schemas/triwiki/context-graph.schema.json

@@ -0,0 +1,119 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://sneakoscope.dev/schemas/triwiki/context-graph.schema.json",
+  "title": "sks.context-graph.v1",
+  "description": "Compiled TriWiki Context Graph snapshot. This is a generated cache: every edge carries provenance back to repository truth. The v1 suffix is a machine schema revision, not a product version recommendation.",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schema", "schemaRevision", "snapshotHash", "nodes", "edges", "cycles", "extractors", "nodeCount", "edgeCount"],
+  "properties": {
+    "schema": { "const": "sks.context-graph.v1" },
+    "schemaRevision": { "type": "string", "minLength": 1 },
+    "snapshotHash": { "type": "string", "pattern": "^[a-f0-9]{64}$" },
+    "nodeCount": { "type": "integer", "minimum": 0 },
+    "edgeCount": { "type": "integer", "minimum": 0 },
+    "nodes": { "type": "array", "items": { "$ref": "#/definitions/node" } },
+    "edges": { "type": "array", "items": { "$ref": "#/definitions/edge" } },
+    "cycles": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "nodes"],
+        "properties": {
+          "id": { "type": "string", "minLength": 1 },
+          "nodes": { "type": "array", "minItems": 2, "items": { "type": "string", "minLength": 1 } }
+        }
+      }
+    },
+    "extractors": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "revision", "nodeCount", "edgeCount", "issueCount", "skippedCount"],
+        "properties": {
+          "id": { "type": "string", "minLength": 1 },
+          "revision": { "type": "string", "minLength": 1 },
+          "nodeCount": { "type": "integer", "minimum": 0 },
+          "edgeCount": { "type": "integer", "minimum": 0 },
+          "issueCount": { "type": "integer", "minimum": 0 },
+          "skippedCount": { "type": "integer", "minimum": 0 }
+        }
+      }
+    }
+  },
+  "definitions": {
+    "relativePosixPath": {
+      "type": "string",
+      "minLength": 1,
+      "not": { "pattern": "^(?:/|~|[A-Za-z]:/)|(?:^|/)\\.\\.(?:/|$)|\\\\" }
+    },
+    "node": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "kind", "label", "trust", "freshness", "risk", "tokenCost", "metadata"],
+      "properties": {
+        "id": { "type": "string", "minLength": 1 },
+        "kind": {
+          "enum": ["file", "symbol", "module", "command", "route", "pipeline", "test", "gate", "schema", "config", "wiki_claim", "source", "proof", "risk_domain"]
+        },
+        "label": { "type": "string", "minLength": 1 },
+        "path": { "$ref": "#/definitions/relativePosixPath" },
+        "locator": {
+          "type": "object",
+          "additionalProperties": false,
+          "properties": {
+            "line": { "type": "integer", "minimum": 1 },
+            "column": { "type": "integer", "minimum": 1 },
+            "endLine": { "type": "integer", "minimum": 1 },
+            "endColumn": { "type": "integer", "minimum": 1 }
+          }
+        },
+        "contentHash": { "type": "string", "pattern": "^[a-f0-9]{8,64}$" },
+        "trust": { "type": "number", "minimum": 0, "maximum": 1 },
+        "freshness": { "enum": ["fresh", "stale", "unknown"] },
+        "risk": { "enum": ["low", "medium", "high", "protected"] },
+        "tokenCost": { "type": "integer", "minimum": 0 },
+        "metadata": {
+          "type": "object",
+          "additionalProperties": {
+            "anyOf": [
+              { "type": "string" },
+              { "type": "number" },
+              { "type": "boolean" },
+              { "type": "null" },
+              { "type": "array", "items": { "type": "string" } }
+            ]
+          }
+        }
+      }
+    },
+    "edge": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "from", "to", "type", "confidence", "provenance", "observedAt"],
+      "properties": {
+        "id": { "type": "string", "minLength": 1 },
+        "from": { "type": "string", "minLength": 1 },
+        "to": { "type": "string", "minLength": 1 },
+        "type": {
+          "enum": ["contains", "defines", "imports", "reexports", "references", "calls", "depends_on", "routes_to", "owns", "tests", "verified_by", "gated_by", "affected_by", "cites", "derived_from", "supports", "contradicts", "supersedes", "invalidates", "cochanged_with", "conflicts_with"]
+        },
+        "confidence": { "enum": ["exact", "syntactic", "manifest", "observed", "derived"] },
+        "observedAt": { "type": "string", "minLength": 1 },
+        "provenance": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["path", "hash", "extractor"],
+          "properties": {
+            "path": { "$ref": "#/definitions/relativePosixPath" },
+            "line": { "type": "integer", "minimum": 1 },
+            "hash": { "type": "string", "pattern": "^[a-f0-9]{8,64}$" },
+            "extractor": { "type": "string", "minLength": 1 }
+          }
+        }
+      }
+    }
+  }
+}

package/dist/cli/install-helpers-codex-lb-selftest-chain.js

@@ -1,112 +0,0 @@
-import path from 'node:path';
-import { packageRoot, writeTextAtomic } from '../core/fsx.js';
-import { hasCodexUnstableFeatureWarningSuppression, hasDeprecatedCodexHooksFeatureFlag, hasTopLevelCodexModeLock } from './install-tool-helpers.js';
-import { maybePromptCodexLbSetupForLaunch } from './install-helpers.js';
-import { checkCodexLbResponseChain } from './install-helpers-codex-lb-chain.js';
-import { hasTopLevelCodexLbSelected } from './install-helpers-codex-lb-shared.js';
-async function safeReadText(file, fallback = '') {
-    try {
-        return await import('node:fs/promises').then((fsp) => fsp.readFile(file, 'utf8'));
-    }
-    catch {
-        return fallback;
-    }
-}
-export async function runCodexLbLaunchChainSelftest(input) {
-    const { tmp, codexLbHome, codexLbFakeBin, codexLbConfig } = input;
-    process.env.SKS_CODEX_LB_AUTOBYPASS = '1';
-    let autobypassLaunch;
-    try {
-        autobypassLaunch = (await maybePromptCodexLbSetupForLaunch([], {
-            home: codexLbHome,
-            apiKey: 'sk-test',
-            codexBin: path.join(codexLbFakeBin, 'codex'),
-            syncLaunchEnv: false,
-            timeoutMs: 1000,
-            fetch: async (_url, init) => {
-                const body = JSON.parse(init.body);
-                if (!body.previous_response_id)
-                    return new Response(JSON.stringify({ id: 'resp_autobypass_first' }), { status: 200, headers: { 'content-type': 'application/json' } });
-                return new Response(JSON.stringify({ error: { type: 'server_error', code: 'internal_error', message: 'simulated upstream failure' } }), { status: 500, headers: { 'content-type': 'application/json' } });
-            }
-        }));
-    }
-    finally {
-        delete process.env.SKS_CODEX_LB_AUTOBYPASS;
-    }
-    if (autobypassLaunch.status !== 'chain_unhealthy' || autobypassLaunch.bypass_codex_lb !== true || autobypassLaunch.chain_health?.status !== 'second_request_failed')
-        throw new Error('selftest: SKS_CODEX_LB_AUTOBYPASS=1 should bypass codex-lb on hard chain failure');
-    await writeTextAtomic(path.join(codexLbHome, '.codex', 'config.toml'), 'service_tier = "fast"\n');
-    await writeTextAtomic(path.join(codexLbHome, '.codex', 'sks-codex-lb.env'), "export CODEX_LB_BASE_URL='https://lb.example.test/backend-api/codex'\nexport CODEX_LB_API_KEY='sk-test'\n");
-    const missingProviderLaunchCalls = [];
-    const missingProviderLaunch = await maybePromptCodexLbSetupForLaunch([], {
-        home: codexLbHome,
-        apiKey: 'sk-test',
-        codexBin: path.join(codexLbFakeBin, 'codex'),
-        syncLaunchEnv: false,
-        timeoutMs: 1000,
-        fetch: async (url, init) => {
-            missingProviderLaunchCalls.push({ url, body: JSON.parse(init.body) });
-            return new Response(JSON.stringify({ id: missingProviderLaunchCalls.length === 1 ? 'resp_missing_provider_1' : 'resp_missing_provider_2' }), { status: 200, headers: { 'content-type': 'application/json' } });
-        }
-    });
-    const missingProviderRepairedConfig = await safeReadText(path.join(codexLbHome, '.codex', 'config.toml'));
-    if (!missingProviderLaunch.ok || missingProviderLaunch.status !== 'present' || missingProviderLaunch.chain_health?.status !== 'chain_ok' || missingProviderLaunchCalls.length !== 2 || !hasTopLevelCodexLbSelected(missingProviderRepairedConfig) || !missingProviderRepairedConfig.includes('[model_providers.codex-lb]') || !missingProviderRepairedConfig.includes('env_key = "CODEX_LB_API_KEY"') || !missingProviderRepairedConfig.includes('supports_websockets = true') || !missingProviderRepairedConfig.includes('requires_openai_auth = true') || !missingProviderRepairedConfig.includes('name = "openai"'))
-        throw new Error('selftest: bare sks launch did not restore codex-lb provider block to current App contract');
-    const chainCalls = [];
-    const okChain = await checkCodexLbResponseChain({ base_url: 'https://lb.example.test/backend-api/codex', env_path: path.join(codexLbHome, '.codex', 'sks-codex-lb.env') }, {
-        apiKey: 'sk-test',
-        timeoutMs: 1000,
-        fetch: async (url, init) => {
-            chainCalls.push({ url, body: JSON.parse(init.body) });
-            return new Response(JSON.stringify({ id: chainCalls.length === 1 ? 'resp_selftest_1' : 'resp_selftest_2' }), { status: 200, headers: { 'content-type': 'application/json' } });
-        }
-    });
-    if (!okChain.ok || okChain.status !== 'chain_ok' || chainCalls.length !== 2 || !String(chainCalls[0].url).endsWith('/backend-api/codex/responses') || chainCalls[1].body.previous_response_id !== 'resp_selftest_1')
-        throw new Error('selftest: codex-lb response chain health check did not verify previous_response_id continuity');
-    const previousGlobalFetch = globalThis.fetch;
-    const cacheCalls = [];
-    const cachePath = path.join(codexLbHome, '.codex', 'chain-cache-selftest.json');
-    try {
-        globalThis.fetch = async (url, init) => {
-            cacheCalls.push({ url, body: JSON.parse(init.body) });
-            return new Response(JSON.stringify({ id: cacheCalls.length === 1 ? 'resp_cache_1' : 'resp_cache_2' }), { status: 200, headers: { 'content-type': 'application/json' } });
-        };
-        const cacheStatus = { base_url: 'https://cache.example.test/backend-api/codex', env_path: path.join(codexLbHome, '.codex', 'sks-codex-lb.env') };
-        const firstCache = await checkCodexLbResponseChain(cacheStatus, { home: codexLbHome, apiKey: 'sk-test', timeoutMs: 1000, cachePath, now: () => 1000 });
-        const secondCache = await checkCodexLbResponseChain(cacheStatus, { home: codexLbHome, apiKey: 'sk-test', timeoutMs: 1000, cachePath, now: () => 2000 });
-        if (!firstCache.ok || firstCache.status !== 'chain_ok' || secondCache.cached !== true || secondCache.status !== 'chain_ok' || cacheCalls.length !== 2)
-            throw new Error('selftest: codex-lb response chain cache did not avoid repeated launch preflight calls');
-    }
-    finally {
-        globalThis.fetch = previousGlobalFetch;
-    }
-    const brokenChain = await checkCodexLbResponseChain({ base_url: 'https://lb.example.test/backend-api/codex', env_path: path.join(codexLbHome, '.codex', 'sks-codex-lb.env') }, {
-        apiKey: 'sk-test',
-        timeoutMs: 1000,
-        fetch: async (_url, init) => {
-            const body = JSON.parse(init.body);
-            if (!body.previous_response_id)
-                return new Response(JSON.stringify({ id: 'resp_missing_selftest' }), { status: 200, headers: { 'content-type': 'application/json' } });
-            return new Response(JSON.stringify({ error: { type: 'invalid_request_error', code: 'previous_response_not_found', message: 'Previous response not found.', param: 'previous_response_id' } }), { status: 400, headers: { 'content-type': 'application/json' } });
-        }
-    });
-    if (brokenChain.ok || brokenChain.status !== 'previous_response_not_found' || brokenChain.chain_unhealthy !== true)
-        throw new Error('selftest: codex-lb response chain health check did not detect previous_response_not_found');
-    const legacyStamps = ['remote_control = true', 'fast_mode_ui = true', 'codex_git_commit = true', '[user.fast_mode]', '[profiles.sks-fast-high]', 'fast_default_opt_out = true'];
-    const survivingLegacy = legacyStamps.filter((stamp) => codexLbConfig.includes(stamp));
-    const stableCapabilityStamps = ['computer_use = true', 'browser_use = true', 'browser_use_external = true', 'image_generation = true', 'in_app_browser = true', 'guardian_approval = true', 'tool_suggest = true', 'plugins = true'];
-    const missingStableCapabilities = stableCapabilityStamps.filter((stamp) => !codexLbConfig.includes(stamp));
-    if (!codexLbConfig.includes('hooks = true') || hasDeprecatedCodexHooksFeatureFlag(codexLbConfig) || /(?:^|\n)\s*multi_agent\s*=/.test(codexLbConfig) || !codexLbConfig.includes('fast_mode = true') || !codexLbConfig.includes('apps = true') || survivingLegacy.length || missingStableCapabilities.length || !/\[profiles\.custom\][\s\S]*?model_reasoning_effort = "low"/.test(codexLbConfig) || hasTopLevelCodexModeLock(codexLbConfig))
-        throw new Error(`selftest: codex-lb setup did not enforce the current feature-flag contract${survivingLegacy.length ? ` — surviving legacy stamps: ${survivingLegacy.join(', ')}` : ''}${missingStableCapabilities.length ? ` — missing stable capabilities: ${missingStableCapabilities.join(', ')}` : ''}`);
-    if (!hasCodexUnstableFeatureWarningSuppression(codexLbConfig))
-        throw new Error('selftest: codex-lb setup did not suppress Codex unstable feature warning');
-    const codexLbLaunch = `source ${path.join(tmp, '.codex', 'sks-codex-lb.env')} && codex`;
-    if (!codexLbLaunch.includes('sks-codex-lb.env'))
-        throw new Error('selftest: Zellij launch command does not source codex-lb env file');
-    if (codexLbLaunch.includes('--model'))
-        throw new Error('selftest: Zellij launch command without an explicit model must inherit the Codex selection');
-    const madLaunchSource = await safeReadText(path.join(packageRoot(), 'src', 'core', 'commands', 'mad-sks-command.js'));
-    if (!madLaunchSource.includes('const lb = await deps.maybePromptCodexLbSetupForLaunch(args)') || !madLaunchSource.includes("const launchLb = lb.status === 'present'") || !madLaunchSource.includes('codexLbImmediateLaunchOpts(cleanArgs, launchLb') || !madLaunchSource.includes('bypass_codex_lb') || !madLaunchSource.includes('model_provider="openai"') || !madLaunchSource.includes('codexLbFreshSession: true'))
-        throw new Error('selftest: MAD launch does not sync codex-lb auth and fresh-session launch options');
-}