sneakoscope 7.6.0 → 8.0.0

package/dist/core/align/align-route.js

@@ -1,89 +1,325 @@
+import fs from 'node:fs';
 import path from 'node:path';
-import { nowIso, readJson, writeJsonAtomic } from '../fsx.js';
+import { commandManifestNames } from '../../cli/command-manifest-lite.js';
+import { nowIso, readJson, sha256, writeJsonAtomic } from '../fsx.js';
+import { MANAGED_ROUTE_SKILL_NAMES } from '../routes.js';
 export const ALIGN_PLAN_ARTIFACT = 'align-plan.json';
 export const ALIGN_LEDGER_ARTIFACT = 'align-ledger.json';
 export const ALIGN_GATE_ARTIFACT = 'align-gate.json';
-export const ALIGN_OFFICIAL_GUIDES = Object.freeze([
-    'https://developers.openai.com/api/docs/guides/latest-model',
-    'https://developers.openai.com/api/docs/guides/tools-programmatic-tool-calling',
-    'https://developers.openai.com/api/docs/guides/agents',
-    'https://github.com/openai/skills'
+export const ALIGN_OFFICIAL_SOURCES = Object.freeze([
+    Object.freeze({
+        source_id: 'gpt_5_6_migration_prompting',
+        url: 'https://developers.openai.com/api/docs/guides/latest-model'
+    }),
+    Object.freeze({
+        source_id: 'programmatic_tool_calling',
+        url: 'https://developers.openai.com/api/docs/guides/tools-programmatic-tool-calling'
+    }),
+    Object.freeze({
+        source_id: 'agents_guide',
+        url: 'https://developers.openai.com/api/docs/guides/agents'
+    }),
+    Object.freeze({
+        source_id: 'codex_skills',
+        url: 'https://developers.openai.com/codex/skills'
+    }),
+    Object.freeze({
+        source_id: 'codex_plugins',
+        url: 'https://developers.openai.com/codex/plugins'
+    }),
+    Object.freeze({
+        source_id: 'openai_plugins_repository',
+        url: 'https://github.com/openai/plugins'
+    })
+]);
+export const ALIGN_DEPRECATED_MIGRATION_SOURCES = Object.freeze([
+    Object.freeze({
+        source_id: 'openai_skills_repository',
+        url: 'https://github.com/openai/skills',
+        disposition: 'deprecated_migration_evidence'
+    })
 ]);
 export const ALIGN_WORKSTREAMS = Object.freeze([
     'latest_model_prompt_grammar',
     'programmatic_tool_calling',
     'agents_guidance',
-    'openai_skills_and_plugins',
+    'plugins_guidance_and_skills_migration',
     'latest_only_cleanup',
     'deduplicate_prompt_config'
 ]);
+export const ALIGN_REQUIRED_VERIFICATIONS = Object.freeze([
+    'typecheck',
+    'build',
+    'focused_tests',
+    'skill_surface_audit',
+    'release_affected'
+]);
+export const ALIGN_PROMPT_EVALUATION_MIN_CASES = 12;
 export function buildAlignPlan(missionId, task) {
+    const surfaceInventory = buildAlignSurfaceInventory();
     return {
-        schema: 'sks.align-plan.v1',
-        schema_version: 1,
+        schema: 'sks.align-plan.v2',
+        schema_version: 2,
         generated_at: nowIso(),
         mission_id: missionId,
         task: String(task || '').trim() || 'Align SKS prompts, settings, and skills to the latest GPT-5.6 official guides',
-        official_guides: ALIGN_OFFICIAL_GUIDES,
+        official_sources: ALIGN_OFFICIAL_SOURCES,
+        deprecated_migration_sources: ALIGN_DEPRECATED_MIGRATION_SOURCES,
         workstreams: ALIGN_WORKSTREAMS,
+        required_verifications: ALIGN_REQUIRED_VERIFICATIONS,
+        prompt_evaluation_min_cases: ALIGN_PROMPT_EVALUATION_MIN_CASES,
+        surface_inventory: surfaceInventory,
         policy: {
             latest_only: true,
             no_legacy_compat: true,
             deduplicate: true,
-            immutable_core_skills_protected: true
+            immutable_core_skills_protected: true,
+            exhaustive_command_skill_audit: true,
+            evidence_required: true
         },
         next_actions: [
-            'Fetch and apply the latest GPT-5.6 prompting / programmatic tool calling / agents guides',
-            'Deep-analyze openai/skills and current Plugins guidance, then improve every SKS command/skill surface',
-            'Keep latest-version only: delete unnecessary legacy settings and compatibility knobs',
-            'Deduplicate redundant prompt and config content',
-            'Protect immutable core skills (mutable_by_doctor/update/setup=false)',
-            'Record align-ledger.json and pass align-gate.json, then finish with Honest Mode'
+            'Retrieve every exact official source and record a receipt with evidence',
+            'Apply GPT-5.6 prompting, programmatic tool calling, Agents, Codex Skills, and Codex Plugins guidance',
+            'Treat openai/skills only as deprecated migration evidence; use openai/plugins as the active repository',
+            'Audit the plan-sealed command and skill inventories with exact exhaustive receipts and zero missing surfaces',
+            'Record evidence-backed Programmatic Tool Calling and Agents SDK adoption decisions',
+            `Run at least ${ALIGN_PROMPT_EVALUATION_MIN_CASES} prompt evaluation cases, immutable core integrity, and verification checks`,
+            'Record changed paths; keep latest-version only, delete legacy settings, and record deduplication results or an evidenced none-required review',
+            'Pass align-gate.json with mission-consistent evidence and no blockers, then finish with Honest Mode'
         ]
     };
 }
 export function buildAlignLedgerSeed(missionId) {
+    const surfaceInventory = buildAlignSurfaceInventory();
+    const emptyCoverage = (inventory) => ({
+        receipt_kind: 'exhaustive_inventory_audit',
+        inventory_sha256: inventory.sha256,
+        expected_count: inventory.count,
+        audited_count: 0,
+        audited_surfaces: [],
+        missing_surfaces: [...inventory.surfaces],
+        evidence: []
+    });
+    const pendingDecision = () => ({
+        decision: 'pending',
+        reason: '',
+        evidence: []
+    });
     return {
-        schema: 'sks.align-ledger.v1',
-        schema_version: 1,
+        schema: 'sks.align-ledger.v2',
+        schema_version: 2,
         generated_at: nowIso(),
         mission_id: missionId,
-        completed_workstreams: [],
+        workstream_receipts: ALIGN_WORKSTREAMS.map((workstream) => ({
+            workstream,
+            status: 'pending',
+            evidence: []
+        })),
+        official_source_receipts: [],
+        deprecated_source_receipts: [],
+        surface_coverage: {
+            commands: emptyCoverage(surfaceInventory.commands),
+            skills: emptyCoverage(surfaceInventory.skills)
+        },
+        decisions: {
+            programmatic_tool_calling: pendingDecision(),
+            agents_sdk: pendingDecision()
+        },
+        prompt_evaluation: {
+            status: 'pending',
+            cases_expected: 0,
+            cases_passed: 0,
+            failures: [],
+            evidence: []
+        },
+        immutable_core_integrity: {
+            status: 'pending',
+            evidence: []
+        },
+        verification_receipts: [],
         changed_paths: [],
+        change_review: {
+            outcome: 'pending',
+            evidence: []
+        },
         deleted_legacy_settings: [],
         deduplicated_surfaces: [],
+        deduplication_review: {
+            outcome: 'pending',
+            reviewed_surfaces: [],
+            evidence: []
+        },
         blockers: [],
         notes: []
     };
 }
-export function evaluateAlignGate(plan, ledger, missionId) {
+export function evaluateAlignGate(plan, ledger, missionId, options = {}) {
     const blockers = [];
-    const planPresent = Boolean(plan && plan.schema === 'sks.align-plan.v1');
-    const ledgerPresent = Boolean(ledger && ledger.schema === 'sks.align-ledger.v1');
+    const officialSourceReceipts = arrayOrEmpty(ledger?.official_source_receipts);
+    const deprecatedSourceReceipts = arrayOrEmpty(ledger?.deprecated_source_receipts);
+    const workstreamReceipts = arrayOrEmpty(ledger?.workstream_receipts);
+    const verificationReceipts = arrayOrEmpty(ledger?.verification_receipts);
+    const currentSurfaceInventory = buildAlignSurfaceInventory();
+    const planPresent = Boolean(plan && plan.schema === 'sks.align-plan.v2' && plan.schema_version === 2);
+    const ledgerPresent = Boolean(ledger && ledger.schema === 'sks.align-ledger.v2' && ledger.schema_version === 2);
     if (!planPresent)
-        blockers.push('align_plan_missing');
+        blockers.push('align_plan_v2_missing');
     if (!ledgerPresent)
-        blockers.push('align_ledger_missing');
-    const completed = new Set(ledger?.completed_workstreams || []);
-    const workstreamsComplete = ALIGN_WORKSTREAMS.every((item) => completed.has(item));
-    if (ledgerPresent && !workstreamsComplete)
-        blockers.push('align_workstreams_incomplete');
+        blockers.push('align_ledger_v2_missing');
+    const missionIdConsistent = Boolean(planPresent
+        && ledgerPresent
+        && missionId
+        && plan?.mission_id === missionId
+        && ledger?.mission_id === missionId);
+    if (planPresent && ledgerPresent && !missionIdConsistent)
+        blockers.push('align_mission_id_mismatch');
+    const artifactMetadataValid = Boolean(planPresent
+        && ledgerPresent
+        && isIsoTimestamp(plan?.generated_at)
+        && isIsoTimestamp(ledger?.generated_at)
+        && isNonEmptyString(plan?.task));
+    if (!artifactMetadataValid)
+        blockers.push('align_artifact_metadata_invalid');
+    const officialSourcePlanComplete = hasExactSourceSet(plan?.official_sources, ALIGN_OFFICIAL_SOURCES);
+    if (!officialSourcePlanComplete)
+        blockers.push('align_official_source_plan_incomplete');
+    const deprecatedSourcePlanComplete = hasExactDeprecatedSourceSet(plan?.deprecated_migration_sources, ALIGN_DEPRECATED_MIGRATION_SOURCES);
+    if (!deprecatedSourcePlanComplete)
+        blockers.push('align_deprecated_source_plan_incomplete');
+    const workstreamPlanComplete = exactStringSet(plan?.workstreams, ALIGN_WORKSTREAMS);
+    if (!workstreamPlanComplete)
+        blockers.push('align_workstream_plan_incomplete');
+    const surfaceInventoryPlanComplete = inventoryMatches(plan?.surface_inventory?.commands, currentSurfaceInventory.commands) && inventoryMatches(plan?.surface_inventory?.skills, currentSurfaceInventory.skills);
+    if (!surfaceInventoryPlanComplete)
+        blockers.push('align_surface_inventory_plan_stale_or_incomplete');
+    const verificationPlanComplete = exactStringSet(plan?.required_verifications, ALIGN_REQUIRED_VERIFICATIONS);
+    if (!verificationPlanComplete)
+        blockers.push('align_required_verification_plan_incomplete');
+    const promptEvaluationPlanComplete = (plan?.prompt_evaluation_min_cases === ALIGN_PROMPT_EVALUATION_MIN_CASES);
+    if (!promptEvaluationPlanComplete)
+        blockers.push('align_prompt_evaluation_plan_incomplete');
+    const policyContractComplete = Boolean(plan?.policy?.latest_only === true
+        && plan?.policy?.no_legacy_compat === true
+        && plan?.policy?.deduplicate === true
+        && plan?.policy?.immutable_core_skills_protected === true
+        && plan?.policy?.exhaustive_command_skill_audit === true
+        && plan?.policy?.evidence_required === true);
+    if (!policyContractComplete)
+        blockers.push('align_policy_contract_incomplete');
+    const deprecatedUrl = ALIGN_DEPRECATED_MIGRATION_SOURCES[0].url;
+    const deprecatedSourceNotActive = !containsUrl(plan?.official_sources, deprecatedUrl)
+        && !containsUrl(officialSourceReceipts, deprecatedUrl);
+    if (!deprecatedSourceNotActive)
+        blockers.push('deprecated_openai_skills_source_active');
+    const officialSourceReceiptsComplete = ALIGN_OFFICIAL_SOURCES.every((required) => {
+        const matches = officialSourceReceipts.filter((receipt) => (receipt?.source_id === required.source_id && receipt?.url === required.url));
+        return matches.length === 1
+            && matches[0]?.status === 'verified'
+            && isIsoTimestamp(matches[0]?.retrieved_at)
+            && evidenceComplete(matches[0]?.evidence, options);
+    }) && officialSourceReceipts.length === ALIGN_OFFICIAL_SOURCES.length;
+    if (!officialSourceReceiptsComplete)
+        blockers.push('align_official_source_receipts_incomplete');
+    const deprecatedSourceMigrationRecorded = ALIGN_DEPRECATED_MIGRATION_SOURCES.every((required) => {
+        const matches = deprecatedSourceReceipts.filter((receipt) => (receipt?.source_id === required.source_id && receipt?.url === required.url));
+        return matches.length === 1
+            && matches[0]?.disposition === required.disposition
+            && evidenceComplete(matches[0]?.evidence, options);
+    }) && deprecatedSourceReceipts.length === ALIGN_DEPRECATED_MIGRATION_SOURCES.length;
+    if (!deprecatedSourceMigrationRecorded)
+        blockers.push('deprecated_openai_skills_migration_evidence_missing');
+    const workstreamsComplete = ALIGN_WORKSTREAMS.every((required) => {
+        const matches = workstreamReceipts.filter((receipt) => receipt?.workstream === required);
+        return matches.length === 1
+            && matches[0]?.status === 'complete'
+            && evidenceComplete(matches[0]?.evidence, options);
+    }) && workstreamReceipts.length === ALIGN_WORKSTREAMS.length;
+    if (!workstreamsComplete)
+        blockers.push('align_workstream_evidence_incomplete');
+    const commandCoverageComplete = coverageComplete(ledger?.surface_coverage?.commands, plan?.surface_inventory?.commands, currentSurfaceInventory.commands, options);
+    const skillCoverageComplete = coverageComplete(ledger?.surface_coverage?.skills, plan?.surface_inventory?.skills, currentSurfaceInventory.skills, options);
+    if (!commandCoverageComplete)
+        blockers.push('align_command_surface_coverage_incomplete');
+    if (!skillCoverageComplete)
+        blockers.push('align_skill_surface_coverage_incomplete');
+    const programmaticToolCallingDecisionRecorded = decisionComplete(ledger?.decisions?.programmatic_tool_calling, options);
+    const agentsSdkDecisionRecorded = decisionComplete(ledger?.decisions?.agents_sdk, options);
+    if (!programmaticToolCallingDecisionRecorded)
+        blockers.push('align_programmatic_tool_calling_decision_missing');
+    if (!agentsSdkDecisionRecorded)
+        blockers.push('align_agents_sdk_decision_missing');
+    const promptEvaluationPassed = Boolean(promptEvaluationPlanComplete
+        && ledger?.prompt_evaluation?.status === 'pass'
+        && Number.isInteger(ledger.prompt_evaluation.cases_expected)
+        && ledger.prompt_evaluation.cases_expected >= ALIGN_PROMPT_EVALUATION_MIN_CASES
+        && ledger.prompt_evaluation.cases_passed === ledger.prompt_evaluation.cases_expected
+        && Array.isArray(ledger.prompt_evaluation.failures)
+        && ledger.prompt_evaluation.failures.length === 0
+        && evidenceComplete(ledger.prompt_evaluation.evidence, options));
+    if (!promptEvaluationPassed)
+        blockers.push('align_prompt_evaluation_not_passed');
+    const immutableCoreIntegrityPassed = Boolean(ledger?.immutable_core_integrity?.status === 'pass'
+        && evidenceComplete(ledger.immutable_core_integrity.evidence, options));
+    if (!immutableCoreIntegrityPassed)
+        blockers.push('align_immutable_core_integrity_not_passed');
+    const verificationReceiptsPassed = verificationPlanComplete
+        && ALIGN_REQUIRED_VERIFICATIONS.every((kind) => {
+            const matches = verificationReceipts.filter((receipt) => receipt?.kind === kind);
+            return matches.length === 1
+                && matches[0]?.status === 'pass'
+                && matches[0]?.exit_code === 0
+                && verificationCommandMatchesKind(kind, matches[0]?.command)
+                && evidenceComplete(matches[0]?.evidence, options);
+        })
+        && verificationReceipts.length === ALIGN_REQUIRED_VERIFICATIONS.length;
+    if (!verificationReceiptsPassed)
+        blockers.push('align_verification_receipts_not_passed');
     const latestOnly = plan?.policy?.latest_only === true;
     const noLegacyCompat = plan?.policy?.no_legacy_compat === true;
     if (!latestOnly)
         blockers.push('latest_only_policy_missing');
     if (!noLegacyCompat)
         blockers.push('no_legacy_compat_policy_missing');
-    const dedupeRecorded = Boolean(ledgerPresent && Array.isArray(ledger?.deduplicated_surfaces));
-    if (ledgerPresent && !dedupeRecorded)
-        blockers.push('dedupe_surface_missing');
+    const changedPaths = ledger?.changed_paths;
+    const changeReview = ledger?.change_review;
+    const changedPathsRecorded = Boolean(evidenceComplete(changeReview?.evidence, options)
+        && (changeReview?.outcome === 'changed'
+            ? hasUniqueStringList(changedPaths)
+            : changeReview?.outcome === 'none_required'
+                && hasUniqueStringList(changedPaths, { allowEmpty: true })
+                && changedPaths.length === 0));
+    if (!changedPathsRecorded)
+        blockers.push('align_changed_paths_missing');
+    const latestOnlyCleanupReviewComplete = Boolean(workstreamReceiptComplete(ledger, 'latest_only_cleanup', options)
+        && hasUniqueStringList(ledger?.deleted_legacy_settings, { allowEmpty: true }));
+    if (!latestOnlyCleanupReviewComplete)
+        blockers.push('align_latest_only_cleanup_review_incomplete');
+    const deduplicatedSurfaces = ledger?.deduplicated_surfaces;
+    const deduplicationReview = ledger?.deduplication_review;
+    const reviewedSurfaces = deduplicationReview?.reviewed_surfaces;
+    const deduplicationReviewComplete = Boolean(workstreamReceiptComplete(ledger, 'deduplicate_prompt_config', options)
+        && hasUniqueStringList(reviewedSurfaces)
+        && evidenceComplete(deduplicationReview?.evidence, options)
+        && (deduplicationReview?.outcome === 'deduplicated'
+            ? hasUniqueStringList(deduplicatedSurfaces)
+                && deduplicatedSurfaces.every((surface) => reviewedSurfaces?.includes(surface))
+            : deduplicationReview?.outcome === 'none_required'
+                && hasUniqueStringList(deduplicatedSurfaces, { allowEmpty: true })
+                && deduplicatedSurfaces.length === 0));
+    if (!deduplicationReviewComplete)
+        blockers.push('dedupe_evidence_missing');
+    const ledgerBlockersClear = Boolean(ledgerPresent
+        && Array.isArray(ledger?.blockers)
+        && ledger.blockers.length === 0);
+    if (ledgerPresent && !Array.isArray(ledger?.blockers))
+        blockers.push('align_blocker_ledger_missing');
     if (Array.isArray(ledger?.blockers) && ledger.blockers.length > 0) {
         blockers.push(...ledger.blockers.map((item) => `ledger:${item}`));
     }
     const passed = blockers.length === 0;
     return {
-        schema: 'sks.align-gate.v1',
-        schema_version: 1,
+        schema: 'sks.align-gate.v2',
+        schema_version: 2,
         generated_at: nowIso(),
         mission_id: missionId,
         passed,
@@ -91,17 +327,41 @@ export function evaluateAlignGate(plan, ledger, missionId) {
         status: passed ? 'pass' : 'blocked',
         plan_present: planPresent,
         ledger_present: ledgerPresent,
+        mission_id_consistent: missionIdConsistent,
+        artifact_metadata_valid: artifactMetadataValid,
+        official_source_plan_complete: officialSourcePlanComplete,
+        deprecated_source_plan_complete: deprecatedSourcePlanComplete,
+        workstream_plan_complete: workstreamPlanComplete,
+        surface_inventory_plan_complete: surfaceInventoryPlanComplete,
+        official_source_receipts_complete: officialSourceReceiptsComplete,
+        deprecated_source_migration_recorded: deprecatedSourceMigrationRecorded,
+        deprecated_source_not_active: deprecatedSourceNotActive,
         workstreams_complete: workstreamsComplete,
+        command_coverage_complete: commandCoverageComplete,
+        skill_coverage_complete: skillCoverageComplete,
+        verification_plan_complete: verificationPlanComplete,
+        prompt_evaluation_plan_complete: promptEvaluationPlanComplete,
+        policy_contract_complete: policyContractComplete,
+        programmatic_tool_calling_decision_recorded: programmaticToolCallingDecisionRecorded,
+        agents_sdk_decision_recorded: agentsSdkDecisionRecorded,
+        prompt_evaluation_passed: promptEvaluationPassed,
+        immutable_core_integrity_passed: immutableCoreIntegrityPassed,
+        verification_receipts_passed: verificationReceiptsPassed,
+        changed_paths_recorded: changedPathsRecorded,
+        latest_only_cleanup_review_complete: latestOnlyCleanupReviewComplete,
+        deduplication_review_complete: deduplicationReviewComplete,
+        ledger_blockers_clear: ledgerBlockersClear,
+        no_blockers: passed,
         latest_only: latestOnly,
         no_legacy_compat: noLegacyCompat,
-        dedupe_recorded: dedupeRecorded,
+        dedupe_recorded: deduplicationReviewComplete,
         blockers
     };
 }
 export async function writeAlignRouteArtifacts(dir, missionId, task) {
     const plan = buildAlignPlan(missionId, task);
     const ledger = buildAlignLedgerSeed(missionId);
-    const gate = evaluateAlignGate(plan, ledger, missionId);
+    const gate = evaluateAlignGate(plan, ledger, missionId, { missionDir: dir });
     await writeJsonAtomic(path.join(dir, ALIGN_PLAN_ARTIFACT), plan);
     await writeJsonAtomic(path.join(dir, ALIGN_LEDGER_ARTIFACT), ledger);
     await writeJsonAtomic(path.join(dir, ALIGN_GATE_ARTIFACT), gate);
@@ -113,15 +373,186 @@ export async function readAlignGate(dir) {
 export async function refreshAlignGate(dir, missionId) {
     const plan = await readJson(path.join(dir, ALIGN_PLAN_ARTIFACT), null);
     const ledger = await readJson(path.join(dir, ALIGN_LEDGER_ARTIFACT), null);
-    const gate = evaluateAlignGate(plan, ledger, missionId);
+    const gate = evaluateAlignGate(plan, ledger, missionId, { missionDir: dir });
     await writeJsonAtomic(path.join(dir, ALIGN_GATE_ARTIFACT), gate);
     return { plan, ledger, gate };
 }
 export function alignNextActionText(missionId) {
     return [
         `Execute the $sks-align modernization mission ${missionId}.`,
-        'Read align-plan.json, fetch the official GPT-5.6 / programmatic tool calling / agents / openai/skills guides,',
-        'update SKS prompts/settings/skills to latest-only grammar, delete legacy compat knobs, deduplicate redundant config,',
-        'protect immutable core skills, update align-ledger.json, pass align-gate.json, then finish with Honest Mode.'
+        'Read align-plan.json and retrieve every exact active GPT-5.6, Programmatic Tool Calling, Agents, Codex Skills, Codex Plugins, and openai/plugins source.',
+        'Treat openai/skills only as deprecated migration evidence. Audit every command and skill surface, record PTC and Agents SDK decisions,',
+        'run prompt evaluation, immutable-core integrity, and verification checks, then pass the mission-consistent align-gate.json with no blockers.'
     ].join(' ');
 }
+function coverageComplete(coverage, planInventory, currentInventory, options) {
+    return Boolean(coverage
+        && coverage.receipt_kind === 'exhaustive_inventory_audit'
+        && inventoryMatches(planInventory, currentInventory)
+        && coverage.inventory_sha256 === currentInventory.sha256
+        && coverage.expected_count === currentInventory.count
+        && coverage.audited_count === coverage.expected_count
+        && exactStringSet(coverage.audited_surfaces, currentInventory.surfaces)
+        && Array.isArray(coverage.missing_surfaces)
+        && coverage.missing_surfaces.length === 0
+        && evidenceComplete(coverage.evidence, options));
+}
+function decisionComplete(record, options) {
+    return Boolean(record
+        && record.decision !== 'pending'
+        && ['adopt', 'do_not_adopt', 'not_applicable'].includes(record.decision)
+        && isNonEmptyString(record.reason)
+        && evidenceComplete(record.evidence, options));
+}
+function workstreamReceiptComplete(ledger, workstream, options) {
+    const matches = arrayOrEmpty(ledger?.workstream_receipts)
+        .filter((receipt) => receipt?.workstream === workstream);
+    return matches.length === 1
+        && matches[0]?.status === 'complete'
+        && evidenceComplete(matches[0]?.evidence, options);
+}
+function hasExactSourceSet(actual, expected) {
+    if (!Array.isArray(actual) || actual.length !== expected.length)
+        return false;
+    return expected.every((required) => (actual.filter((source) => (source?.source_id === required.source_id && source?.url === required.url)).length === 1));
+}
+function hasExactDeprecatedSourceSet(actual, expected) {
+    if (!Array.isArray(actual) || actual.length !== expected.length)
+        return false;
+    return expected.every((required) => (actual.filter((source) => (source?.source_id === required.source_id
+        && source?.url === required.url
+        && source?.disposition === required.disposition)).length === 1));
+}
+function containsUrl(actual, url) {
+    return Array.isArray(actual) && actual.some((source) => source?.url === url);
+}
+function hasStringList(value) {
+    return Array.isArray(value) && value.length > 0 && value.every(isNonEmptyString);
+}
+function hasUniqueStringList(value, options = {}) {
+    if (!Array.isArray(value))
+        return false;
+    if (!options.allowEmpty && value.length === 0)
+        return false;
+    if (!value.every(isNonEmptyString))
+        return false;
+    if (!value.every((item) => item === item.trim()))
+        return false;
+    const normalized = value.map((item) => item.trim());
+    return new Set(normalized).size === normalized.length;
+}
+function evidenceComplete(value, options) {
+    if (!hasStringList(value))
+        return false;
+    const references = value;
+    if (!references.every(isSafeMissionEvidenceReference))
+        return false;
+    if (new Set(references).size !== references.length)
+        return false;
+    if (!options.missionDir)
+        return true;
+    const missionDir = path.resolve(options.missionDir);
+    let realMissionDir;
+    try {
+        realMissionDir = fs.realpathSync(missionDir);
+    }
+    catch {
+        return false;
+    }
+    return references.every((reference) => {
+        const target = path.resolve(missionDir, reference);
+        if (!isPathInside(missionDir, target))
+            return false;
+        try {
+            const realTarget = fs.realpathSync(target);
+            if (!isPathInside(realMissionDir, realTarget))
+                return false;
+            const stat = fs.lstatSync(target);
+            return stat.isFile() && !stat.isSymbolicLink() && stat.size > 0;
+        }
+        catch {
+            return false;
+        }
+    });
+}
+function isSafeMissionEvidenceReference(value) {
+    if (!value.startsWith('evidence/') || value.includes('\\') || value.includes('\0'))
+        return false;
+    if (path.isAbsolute(value))
+        return false;
+    const segments = value.split('/');
+    return segments.length > 1
+        && segments.every((segment) => (segment.length > 0
+            && segment !== '.'
+            && segment !== '..'
+            && /^[a-zA-Z0-9._-]+$/.test(segment)));
+}
+function isPathInside(root, target) {
+    const relative = path.relative(root, target);
+    return relative.length > 0
+        && relative !== '..'
+        && !relative.startsWith(`..${path.sep}`)
+        && !path.isAbsolute(relative);
+}
+function isNonEmptyString(value) {
+    return typeof value === 'string' && value.trim().length > 0;
+}
+function isIsoTimestamp(value) {
+    if (!isNonEmptyString(value))
+        return false;
+    const parsed = Date.parse(value);
+    return Number.isFinite(parsed) && new Date(parsed).toISOString() === value;
+}
+function verificationCommandMatchesKind(kind, value) {
+    if (!isNonEmptyString(value))
+        return false;
+    const command = value.trim().replace(/\s+/g, ' ');
+    if (/[;&|`$<>]/u.test(command))
+        return false;
+    switch (kind) {
+        case 'typecheck':
+            return /^npm run typecheck(?: --silent)?$/.test(command);
+        case 'build':
+            return /^npm run build(?::(?:clean|incremental))?(?: --silent)?$/.test(command);
+        case 'focused_tests':
+            return /^(?:bun test(?: .+)?|npm test(?: -- .+)?)$/.test(command);
+        case 'skill_surface_audit':
+            return command === 'node ./dist/scripts/skill-surface-modernization-check.js';
+        case 'release_affected':
+            return /^npm run release:check:affected(?: --silent)?$/.test(command);
+    }
+}
+function arrayOrEmpty(value) {
+    return Array.isArray(value) ? [...value] : [];
+}
+function buildAlignSurfaceInventory() {
+    const commands = uniqueSorted(commandManifestNames());
+    const skills = uniqueSorted(MANAGED_ROUTE_SKILL_NAMES);
+    return {
+        commands: sealedInventory(commands),
+        skills: sealedInventory(skills)
+    };
+}
+function sealedInventory(surfaces) {
+    return {
+        count: surfaces.length,
+        sha256: sha256(JSON.stringify(surfaces)),
+        surfaces
+    };
+}
+function inventoryMatches(actual, expected) {
+    return Boolean(actual
+        && actual.count === expected.count
+        && actual.sha256 === expected.sha256
+        && exactStringSet(actual.surfaces, expected.surfaces));
+}
+function exactStringSet(actual, expected) {
+    const expectedSorted = [...expected].sort();
+    return Array.isArray(actual)
+        && actual.length === expected.length
+        && actual.every(isNonEmptyString)
+        && [...actual].sort().every((item, index) => item === expectedSorted[index]);
+}
+function uniqueSorted(values) {
+    return [...new Set(values.filter(isNonEmptyString))].sort();
+}

package/dist/core/codex-app/menubar/constants.js

@@ -25,10 +25,7 @@ export const NATIVE_SOURCE_FILES = [
     'ProvidersOpenRouter.swift',
     'ProvidersRoleModels.swift',
     'ProvidersMultiProvider.swift',
-    'TelegramHubSupervisor.swift',
-    'RemoteTelegramViewController.swift',
-    'RemoteTelegramCenterState.swift',
-    'RemoteTelegramRendering.swift',
+    'RemoteCodingViewController.swift',
     'DiagnosticsViewController.swift',
     'SettingsViewController.swift',
     'OperationCoordinator.swift',

package/dist/core/codex-app/menubar/installer.js

@@ -9,7 +9,7 @@ import { MENU_ITEMS, SKS_MENUBAR_LABEL } from './constants.js';
 import { resolveCodexBundleId, writeDefaultMenuBarConfig } from './config.js';
 import { applyMenuBarGenerationTransaction, commitMenuBarGenerationTransaction, installGenerationPairs, MenuBarGenerationTransactionError, recoverMenuBarGenerationTransaction, rollbackGenerationPairs } from './generation-transaction.js';
 import { launchAgentSource, launchMenuBar, seedMenuBarPreferredPosition } from './launch-agent.js';
-import { cleanupMacLaunchSecretEnvironment } from './migration.js';
+import { cleanupMacLaunchSecretEnvironment, cleanupRetiredRemoteBridgeLaunchAgent, quarantineRetiredRemoteBridgeBindings } from './migration.js';
 import { sksMenuBarPaths } from './paths.js';
 import { infoPlistSource, inspectInstalledResources, loadNativeMenuBarSources, nativeResourceHashes } from './resources.js';
 import { inspectMenuBarArtifactSet, normalizeLegacyMenuBarBuildStamp, rollbackSksMenuBar } from './rollback.js';
@@ -70,6 +70,25 @@ export async function installSksMenuBar(opts = {}) {
         if (recovery.status === 'completed_commit')
             actions.push(`completed committed Menu Bar ${pending.purpose} transaction cleanup`);
     }
+    const retiredRemoteBridge = await cleanupRetiredRemoteBridgeLaunchAgent({
+        home: paths.home,
+        env
+    });
+    warnings.push(...retiredRemoteBridge.warnings);
+    if (!retiredRemoteBridge.ok) {
+        return blocked(retiredRemoteBridge.blockers[0] || 'retired_remote_bridge_cleanup_failed', 'The retired SKS remote bridge LaunchAgent could not be stopped safely.');
+    }
+    if (retiredRemoteBridge.removed) {
+        actions.push('stopped and removed the retired SKS remote bridge LaunchAgent');
+    }
+    const retiredBindings = await quarantineRetiredRemoteBridgeBindings(paths.root);
+    warnings.push(...retiredBindings.warnings);
+    if (!retiredBindings.ok) {
+        return blocked(retiredBindings.blockers[0] || 'retired_remote_bridge_binding_cleanup_failed', 'Retired remote bridge bindings could not be quarantined safely.');
+    }
+    if (retiredBindings.status === 'quarantined') {
+        actions.push(`quarantined ${retiredBindings.retired_binding_count} retired remote bridge binding(s)`);
+    }
     cleanup = await cleanupMacLaunchSecretEnvironment({ env });
     if (!cleanup.ok)
         warnings.push('launch_secret_env_cleanup_incomplete');