sneakoscope 8.1.2 → 8.2.0

package/dist/core/commands/mad-sks-command.js

@@ -22,7 +22,6 @@ import { writeCodexCurrentCoreCapabilityArtifacts } from '../codex-control/codex
 import { resolveCodexNativeInvocationPlan } from '../codex-native/codex-native-invocation-router.js';
 import { assertNonGlmMadRoute } from '../routes/model-mode-router.js';
 import { evaluateGate } from '../stop-gate/gate-evaluator.js';
-import { CODEX_LB_TOOL_OUTPUT_RECOVERY_OVERRIDE_FLAG, codexLbToolOutputRecoveryOverrideAcknowledged } from '../codex-lb/codex-lb-tool-output-recovery.js';
 import { writeMadNativeSession } from './mad-sks-headless.js';
 const MAD_SKS_DEFAULT_TTL_MS = 10 * 60 * 1000;
 const UNSUPPORTED_MAD_ARGUMENT_NAMES = new Set([
@@ -92,7 +91,7 @@ export async function madHighCommand(args = [], deps = {}) {
             ok: false,
             status: 'blocked',
             blockers: retiredGlmFlagBlockers,
-            hint: 'GLM MAD CLI was removed. Use SKS Center Providers or sks codex-app use-openrouter --model <id>.'
+            hint: 'GLM MAD CLI was removed. Use sks bridge provider configure|validate|enable, sks bridge catalog sync, and sks bridge route set-default.'
         };
         if (rawArgs.includes('--json'))
             console.log(JSON.stringify(result, null, 2));
@@ -142,15 +141,13 @@ export async function madHighCommand(args = [], deps = {}) {
     const strictUiSnapshot = process.env.SKS_MAD_STRICT_UI_SNAPSHOT === '1';
     const beforeUi = strictUiSnapshot ? await writeCodexAppUiSnapshot(launchRoot, `mad-before-${uiSnapshotId}`).catch(() => null) : null;
     const allowMadRepair = rawArgs.includes('--repair-config') || rawArgs.includes('--fix') || rawArgs.includes('--yes-repair');
-    const allowUnverifiedToolOutputRecovery = codexLbToolOutputRecoveryOverrideAcknowledged({ args: rawArgs });
     const launchPreflightOpts = {
         fix: allowMadRepair,
         launchFast: process.env.SKS_LAUNCH_FULL_CODEX_PROBE !== '1',
         profile: profile.profile_name,
         sandbox: 'danger-full-access',
         serviceTier: 'fast',
-        skipCodexLbToolOutputRecovery: false,
-        allowUnverifiedToolOutputRecovery
+        skipDesktopBridgeStatus: false
     };
     let launchPreflight = await runCodexLaunchPreflight(launchRoot, launchPreflightOpts);
     if (!launchPreflight.ok && !fs.existsSync(path.join(launchRoot, '.codex', 'config.toml'))) {
@@ -375,7 +372,6 @@ function baseMadLaunchOnlyFlags() {
         '--dry-run',
         '--plan-only',
         '--ack',
-        CODEX_LB_TOOL_OUTPUT_RECOVERY_OVERRIDE_FLAG
     ]);
 }
 function retiredGlmMadFlags() {

package/dist/core/commands/release-command.js

@@ -23,6 +23,10 @@ export function usage() {
         '                       stage workflow, wait, download and verify the tarball.',
         '                       Without it, stage only reports what it would do.',
         '  --version <semver>   Version to stage (defaults to package.json).',
+        '  --physical-evidence-run-id <id>',
+        '                       Successful trusted physical capture workflow run.',
+        '  --physical-evidence-archive <path>',
+        '                       Optional local copy of the attested capture archive.',
         '',
         'stage never runs `npm stage approve`; that approval is a human 2FA step.'
     ].join('\n');
@@ -92,7 +96,13 @@ async function runStageSubcommand(root, args, json) {
         root,
         confirm: flag(args, '--confirm'),
         run: spawnRunner(root),
-        ...(readOption(args, '--version') ? { version: readOption(args, '--version') } : {})
+        ...(readOption(args, '--version') ? { version: readOption(args, '--version') } : {}),
+        ...(readOption(args, '--physical-evidence-run-id')
+            ? { physicalEvidenceRunId: readOption(args, '--physical-evidence-run-id') }
+            : {}),
+        ...(readOption(args, '--physical-evidence-archive')
+            ? { physicalEvidenceArchive: readOption(args, '--physical-evidence-archive') }
+            : {})
     });
     await writeJsonAtomic(path.join(root, '.sneakoscope', 'reports', 'release-stage-publish.json'), report).catch(() => { });
     if (!report.ok)

package/dist/core/commands/telegram-command.js

@@ -6,7 +6,7 @@ import { TELEGRAM_TOKEN_ENV_NAMES, bindTelegramBotIdentity, issueTelegramPairing
 import { spawn } from 'node:child_process';
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { TelegramClient } from '../telegram/client.js';
+import { TelegramApiError, TelegramClient } from '../telegram/client.js';
 import { redactTelegramError } from '../telegram/redaction.js';
 import { projectRoot } from '../fsx.js';
 import { projectRootRealpath } from '../session/project-namespace.js';
@@ -63,7 +63,7 @@ export function usage() {
         '  doctor               Evaluate getMe, pairing, poller, and liveness evidence.',
         '  pair                 Issue a short-lived code for the intended private Telegram chat.',
         '  setup --token-stdin [--remove-webhook]',
-        '                       Verify and store an @BotFather token; an existing webhook requires explicit removal consent.',
+        '                       Verify and store the token for any @BotFather bot you own; an existing webhook requires explicit removal consent.',
         '  prepare --stdin-json  Validate an authorized native request through the typed contract.',
         '  execute --stdin-json  Execute a prepared request; destructive requests also need --confirmed.',
         '',
@@ -108,16 +108,22 @@ export async function telegramCommand(args = [], dependencies = {}) {
         }
         if (action === 'setup') {
             if (!args.includes('--token-stdin'))
-                return fail('telegram_token_stdin_required', json);
+                return telegramSetupFailure('telegram_token_stdin_required', json);
             if (args.includes('--drop-pending-updates'))
-                return fail('telegram_drop_pending_updates_unsupported', json);
+                return telegramSetupFailure('telegram_drop_pending_updates_unsupported', json);
             const environment = dependencies.environment ?? process.env;
             const envOverrideActive = args.includes('--operator-env-override-active')
                 || TELEGRAM_TOKEN_ENV_NAMES.some((name) => String(environment[name] ?? '').trim().length > 0);
             if (envOverrideActive)
                 return telegramSetupEnvOverrideBlocked(json);
             const token = await (dependencies.readTokenStdin ?? readBoundedTokenStdin)();
-            const identity = await (dependencies.verifyToken ?? verifyTelegramToken)(token);
+            let identity;
+            try {
+                identity = await (dependencies.verifyToken ?? verifyTelegramToken)(token);
+            }
+            catch (error) {
+                return telegramSetupFailure(telegramIdentityFailure(error), json, 'getme');
+            }
             const removeWebhook = args.includes('--remove-webhook');
             let webhook;
             try {
@@ -182,6 +188,7 @@ export async function telegramCommand(args = [], dependencies = {}) {
                 webhook_configured_before: webhookConfigured,
                 webhook_removed: webhookRemoved, pending_updates_dropped: false,
                 bot_id: identity?.id ?? null,
+                bot_username: publicBotUsername(identity?.username),
                 bot_rotated: binding?.rotated ?? false,
                 bot_state_reset: binding?.state_reset ?? false,
                 restart_required: true
@@ -214,7 +221,10 @@ export async function telegramCommand(args = [], dependencies = {}) {
         return fail('telegram_unknown_action', json, ['status', 'doctor', 'pair', 'setup', 'prepare', 'execute']);
     }
     catch (error) {
-        return fail(error instanceof Error ? error.message : String(error), json);
+        const message = error instanceof Error ? error.message : String(error);
+        return action === 'setup'
+            ? telegramSetupFailure(redactTelegramError(error), json)
+            : fail(message, json);
     }
 }
 async function verifyTelegramToken(token) {
@@ -362,6 +372,36 @@ function fail(error, json, supported) {
         ...(supported ? { supported } : {})
     }, json);
 }
+function telegramSetupFailure(error, json, failureStage) {
+    process.exitCode = 1;
+    return emit({
+        schema: 'sks.telegram-setup-command.v1',
+        ok: false,
+        error,
+        token_stored: false,
+        ...(failureStage ? { failure_stage: failureStage } : {})
+    }, json);
+}
+function telegramIdentityFailure(error) {
+    const message = redactTelegramError(error);
+    const code = error instanceof TelegramApiError ? error.code : null;
+    if (code === 401 || code === 404 || /\b(?:401|404|Unauthorized|Not Found)\b/i.test(message)) {
+        return 'telegram_token_rejected';
+    }
+    if (/telegram_(?:request_)?timeout|timed?\s*out/i.test(message)) {
+        return 'telegram_identity_verification_timeout';
+    }
+    if (/fetch failed|network|ENOTFOUND|ECONN|EAI_AGAIN|offline/i.test(message)) {
+        return 'telegram_identity_verification_network_failed';
+    }
+    if (message === 'telegram_token_invalid')
+        return message;
+    return 'telegram_identity_verification_failed';
+}
+function publicBotUsername(value) {
+    const normalized = String(value ?? '').trim();
+    return /^[A-Za-z0-9_]{5,64}$/.test(normalized) ? normalized : null;
+}
 function telegramSetupPartialFailure(input, json) {
     process.exitCode = 1;
     return emit({

package/dist/core/doctor/doctor-readiness-matrix.js

@@ -84,14 +84,16 @@ export function buildDoctorReadinessMatrix(input = {}) {
     if (codexAppHarness?.ok === false)
         for (const blocker of normalizeList(codexAppHarness.blockers))
             warnings.add(`codex_app_harness:${blocker}`);
-    if (input.codex_lb?.ok === false)
-        warnings.add(`codex_lb_${input.codex_lb?.circuit?.state || 'blocked'}`);
-    if (input.codex_lb?.provider_status?.selected === true && input.codex_lb?.routing_ok !== true) {
-        const routingBlockers = normalizeList(input.codex_lb?.routing_truth?.blockers);
-        for (const blocker of routingBlockers)
+    const desktopBridge = input.desktop_bridge_status || input.desktop_bridge || null;
+    if (desktopBridge?.management?.managed === true && desktopBridge?.readiness?.ready !== true) {
+        const bridgeBlockers = normalizeList(desktopBridge?.readiness?.blockers);
+        for (const blocker of bridgeBlockers)
             blockers.add(blocker);
-        if (!routingBlockers.length)
-            blockers.add('codex_lb_routing_truth_unverified');
+        if (!bridgeBlockers.length)
+            blockers.add('desktop_bridge_not_ready');
+    }
+    if (desktopBridge?.management?.managed === true && desktopBridge?.service?.running !== true) {
+        warnings.add('desktop_bridge_service_not_running');
     }
     const localModel = input.local_model || {};
     const localStatus = String(localModel.status || (localModel.enabled ? 'enabled_unverified' : 'disabled'));

package/dist/core/doctor/skill-legacy-surface.js

@@ -25,7 +25,7 @@ const REWRITE_RULES = [
     {
         id: 'cli-glm-profile',
         pattern: new RegExp(`${LEFT}sks\\s+codex-app\\s+glm-profile(?:\\s+[A-Za-z0-9_-]+)?${RIGHT}`, 'gi'),
-        replace: '$1sks codex-app use-openrouter'
+        replace: '$1sks bridge provider configure openrouter --api-key-stdin'
     },
     { id: 'cli-mad-db', pattern: new RegExp(`${LEFT}sks\\s+mad-db${RIGHT}`, 'gi'), replace: '$1sks mad-sks' },
     { id: 'cli-team', pattern: new RegExp(`${LEFT}sks\\s+team${RIGHT}`, 'gi'), replace: '$1sks naruto' },
@@ -33,8 +33,8 @@ const REWRITE_RULES = [
     { id: 'cli-swarm', pattern: new RegExp(`${LEFT}sks\\s+swarm${RIGHT}`, 'gi'), replace: '$1sks naruto' },
     { id: 'cli-ralph', pattern: new RegExp(`${LEFT}sks\\s+ralph${RIGHT}`, 'gi'), replace: '$1sks loop' },
     { id: 'cli-tmux', pattern: new RegExp(`${LEFT}sks\\s+tmux${RIGHT}`, 'gi'), replace: '$1sks --mad' },
-    { id: 'cli-xai', pattern: new RegExp(`${LEFT}sks\\s+xai${RIGHT}`, 'gi'), replace: '$1sks codex-app use-openrouter' },
-    { id: 'cli-glm', pattern: new RegExp(`${LEFT}sks\\s+glm${RIGHT}`, 'gi'), replace: '$1sks codex-app use-openrouter' },
+    { id: 'cli-xai', pattern: new RegExp(`${LEFT}sks\\s+xai${RIGHT}`, 'gi'), replace: '$1sks bridge provider configure openrouter --api-key-stdin' },
+    { id: 'cli-glm', pattern: new RegExp(`${LEFT}sks\\s+glm${RIGHT}`, 'gi'), replace: '$1sks bridge provider configure openrouter --api-key-stdin' },
     { id: 'cli-ui', pattern: new RegExp(`${LEFT}sks\\s+ui${RIGHT}`, 'gi'), replace: '$1sks image-ux-review' },
     { id: 'cli-db', pattern: new RegExp(`${LEFT}sks\\s+db${RIGHT}`, 'gi'), replace: '$1sks mad-sks' },
     {
@@ -50,7 +50,7 @@ const REWRITE_RULES = [
     {
         id: 'cli-opt-glm',
         pattern: new RegExp(`${LEFT}sks\\s+--glm${RIGHT}`, 'gi'),
-        replace: '$1sks codex-app use-openrouter'
+        replace: '$1sks bridge provider configure openrouter --api-key-stdin'
     },
     {
         id: 'cli-opt-naruto',
@@ -75,7 +75,7 @@ const REWRITE_RULES = [
     {
         id: 'opt-glm',
         pattern: new RegExp(`${LEFT}--glm${RIGHT}`, 'gi'),
-        replace: '$1sks codex-app use-openrouter'
+        replace: '$1sks bridge provider configure openrouter --api-key-stdin'
     },
     {
         id: 'opt-naruto',

package/dist/core/evidence/v2/evidence-key.js

@@ -31,6 +31,7 @@ export function buildEvidenceKeyV2(input) {
     const projectId = validateProjectId(input.project_id);
     const directTargets = normalizeHashes(input.direct_target_hashes, 'evidence_target_hash_invalid');
     const directDependencies = normalizeHashes(input.direct_dependency_hashes, 'evidence_dependency_hash_invalid');
+    const routeContext = normalizeRouteContext(input.provider_route_context);
     const base = {
         schema: 'sks.evidence-key.v2',
         project_id: projectId,
@@ -38,23 +39,32 @@ export function buildEvidenceKeyV2(input) {
         check: safeId(input.check, 'evidence_check_invalid'),
         direct_target_hashes: directTargets,
         direct_dependency_merkle: merkle(directDependencies),
-        auth_mode: input.auth_mode,
+        provider_route_context: routeContext,
         model_policy_hash: hashValue(input.model_policy_hash, 'evidence_model_policy_hash_invalid'),
         validator_rule: safeId(input.validator_rule, 'evidence_validator_rule_invalid'),
         validator_version: safeId(input.validator_version, 'evidence_validator_version_invalid'),
         environment_hash: hashValue(input.environment_hash, 'evidence_environment_hash_invalid'),
         toolchain_hash: hashValue(input.toolchain_hash, 'evidence_toolchain_hash_invalid')
     };
-    return Object.freeze({ ...base, direct_target_hashes: Object.freeze(base.direct_target_hashes), key: sha256(canonicalJson(base)) });
+    return Object.freeze({
+        ...base,
+        direct_target_hashes: Object.freeze(base.direct_target_hashes),
+        provider_route_context: Object.freeze(base.provider_route_context),
+        key: sha256(canonicalJson(base))
+    });
 }
 export function selectAffectedReceipts(receipts, change) {
     const changedTargets = new Set(change.target_hashes || []);
     const changedDependencies = new Set(change.dependency_hashes || []);
+    const changedRouteContext = change.provider_route_context === undefined
+        ? undefined
+        : canonicalJson(normalizeRouteContext(change.provider_route_context));
     return receipts.filter((receipt) => {
         const evidence = receipt.evidence;
         return evidence.direct_target_hashes.some((value) => changedTargets.has(value))
             || receipt.direct_dependency_hashes.some((value) => changedDependencies.has(value))
-            || (change.auth_mode !== undefined && change.auth_mode !== evidence.auth_mode)
+            || (changedRouteContext !== undefined
+                && changedRouteContext !== canonicalJson(evidence.provider_route_context))
             || (change.model_policy_hash !== undefined && change.model_policy_hash !== evidence.model_policy_hash)
             || (change.validator_rule !== undefined && change.validator_rule !== evidence.validator_rule)
             || (change.validator_version !== undefined && change.validator_version !== evidence.validator_version)
@@ -76,6 +86,18 @@ function normalizeHashes(values, code) {
         throw new Error(code);
     return normalized;
 }
+function normalizeRouteContext(value) {
+    if (!value || !['codex-lb', 'openrouter'].includes(value.provider_id)) {
+        throw new Error('evidence_route_provider_invalid');
+    }
+    return {
+        provider_id: value.provider_id,
+        public_model: safeModelId(value.public_model, 'evidence_route_public_model_invalid'),
+        upstream_model: safeModelId(value.upstream_model, 'evidence_route_upstream_model_invalid'),
+        catalog_generation: safeId(value.catalog_generation, 'evidence_route_catalog_generation_invalid'),
+        route_policy_generation: safeId(value.route_policy_generation, 'evidence_route_policy_generation_invalid')
+    };
+}
 function merkle(values) {
     let layer = values.map((value) => sha256(`leaf:${value}`));
     while (layer.length > 1) {
@@ -98,6 +120,11 @@ function safeId(value, code) {
         throw new Error(code);
     return value;
 }
+function safeModelId(value, code) {
+    if (!/^[A-Za-z0-9][A-Za-z0-9._:/-]{0,199}$/.test(String(value || '')))
+        throw new Error(code);
+    return value;
+}
 function hashValue(value, code) {
     if (!/^[a-f0-9]{64}$/.test(String(value || '')))
         throw new Error(code);

package/dist/core/feature-fixtures.js

@@ -28,7 +28,14 @@ const FIXTURES = Object.freeze({
     'cli-setup': fixture('real_optional', 'sks setup --json --local-only', [], 'pass'),
     'cli-codex': fixture('execute', 'sks codex compatibility --json', [], 'pass'),
     'cli-codex-app': fixture('real_optional', 'sks codex-app check --json', [], 'pass'),
-    'cli-codex-lb': fixture('execute_and_validate_artifacts', 'sks codex-lb metrics --json', [], 'pass'),
+    'cli-bridge': fixture('execute', 'sks bridge status --json', [], 'pass', {
+        expected_stdout_fields: {
+            schema: 'sks.desktop-bridge-status.v3',
+            execution_ok: true,
+            'routing.fallback': 'none'
+        },
+        reason: 'The read-only status command proves the installed Desktop Bridge JSON facade and fail-closed no-fallback routing contract without configuring a provider, starting a service, or reading a plaintext credential.'
+    }),
     'cli-telegram': fixture('execute', 'sks telegram --help', [], 'pass', {
         quality: 'wiring_only',
         reason: 'The non-mutating help path proves the installed Telegram command is wired without requiring a bot token, private-file state, resident poller, or network access; transport behavior is covered by focused Telegram tests.'

package/dist/core/feature-registry.js

@@ -15,7 +15,6 @@ export const FEATURE_INVENTORY_SCHEMA = 'sks.feature-inventory.v1';
 export const ALL_FEATURES_SELFTEST_SCHEMA = 'sks.all-features-selftest.v1';
 export const ALL_FEATURE_COMPLETION_SCHEMA = 'sks.all-feature-completion.v1';
 const HANDLER_ALIAS_TO_COMMAND = Object.freeze({
-    auth: 'codex-lb',
     hook: 'hooks',
     memory: 'gc',
     postinstall: 'postinstall',
@@ -536,7 +535,7 @@ const SAFE_EXECUTABLE_FIXTURE_ARGS = Object.freeze({
     'cli-wrongness': ['wrongness', 'validate', 'project', '--json'],
     'cli-wiki': ['wiki', 'image-ingest', 'test/fixtures/images/one-by-one.png', '--json'],
     'cli-codex': ['codex', 'compatibility', '--json'],
-    'cli-codex-lb': ['codex-lb', 'metrics', '--json'],
+    'cli-bridge': ['bridge', 'status', '--json'],
     'cli-hooks': ['hooks', 'trust-report', '--json'],
     'cli-perf': ['perf', 'cold-start', '--json', '--iterations', '1'],
     'cli-bench': ['bench', 'core', '--tier', 'npx-one-shot', '--json', '--iterations', '1'],
@@ -937,6 +936,8 @@ function isExternalPromptCommandMention(mention) {
         '$CODEX_HOME',
         '$HOME',
         '$CODEX_LB_API_KEY',
+        '$CODEX_LB_KEY',
+        '$OPENROUTER_KEY',
         '$SKS_CODEX_APP_IMAGEGEN_OUTPUT',
         '$SKS_CODEX_APP_IMAGEGEN_OUTPUT_ID',
         '$SKS_CODEX_APP_IMAGEGEN_CREATED_AT',

package/dist/core/hooks-runtime/stop-finalization.js

@@ -97,6 +97,8 @@ function honestGapHeadingResolved(line, nextLine) {
     return /^(?:없음|없습니다|없다|none|no(?:ne)?|0|0개)[.!。]?$/i.test(String(nextLine || '').trim());
 }
 function honestGapLineResolved(line) {
+    if (honestIssueLineCompleted(line))
+        return true;
     if (/(?:unverified|미검증)\s*:\s*\[\s*\]/i.test(line) && /blockers?\s*:\s*\[\s*\]/i.test(line))
         return true;
     if (/(?:^|[\s*-])(?:unverified|미검증|blockers?)\s*:\s*\[\s*\](?:\s*(?:[,.;]|$).*)?$/i.test(line))
@@ -111,7 +113,7 @@ function honestGapLineResolved(line) {
         return true;
     if (/no\s+active\s+blocking\s+route\s+gate\s+detected/i.test(line))
         return true;
-    if (/(?:blockers?|차단(?:\s*(?:항목|요소|건))?)\s*(?:[:=]\s*)?0(?:건|개)?\b/i.test(line))
+    if (/(?:blockers?(?:은|는|이|가)?|차단(?:\s*(?:항목|요소|건))?)\s*(?:[:=]\s*)?0(?:건|개)?\b/i.test(line))
         return true;
     if (/(non[-\s]?blocker|non[-\s]?blocking|not\s+(?:a\s+)?blocker|no\s+blocker|does\s+not\s+block|not\s+blocking|비\s*차단|blocker\s*(?:는|가)?\s*(?:아님|아닙니다|없음)|차단(?:하지|하진|하지는)\s*않|막(?:지|지는)\s*않)/i.test(line))
         return true;
@@ -123,6 +125,14 @@ function honestGapLineResolved(line) {
         return false;
     return /(없음|없습니다|없다|해당 없음|none|no unresolved|no remaining|no gaps|zero|0개|n\/a|not applicable)\.?\s*$/i.test(line);
 }
+function honestIssueLineCompleted(line) {
+    const text = String(line || '').trim();
+    const unresolved = /(?:미해결|미완료|해결|수정|보완)\s*(?:필요|예정|대기|중)|(?:not|isn't|wasn't)\s+(?:fixed|resolved|addressed|implemented|completed)|(?:still|remains?|pending)\b/i;
+    if (unresolved.test(text))
+        return false;
+    return /(?:해결|수정|보완|정상화|완료)(?:했(?:습니다|다|음)?|됐(?:습니다|다)?|됨|함)?[.!。`*_)]*$/i.test(text)
+        || /(?:fixed|resolved|addressed|implemented|completed)[.!。`*_)]*$/i.test(text);
+}
 export function shouldLoopBackAfterHonestMode(state = {}) {
     if (!state?.mission_id || state.implementation_allowed === false)
         return false;

package/dist/core/hooks-runtime/subagent-context.js

@@ -45,7 +45,7 @@ function extractSubagentAgentName(payload = {}) {
     return '';
 }
 export function subagentRouteContext(state = {}) {
-    if (!state?.route && !state?.mode)
+    if (state?.route_closed === true || (!state?.route && !state?.mode))
         return '';
     const route = state.route_command || state.route || state.mode;
     const mission = state.mission_id ? ` for mission ${state.mission_id}` : '';
@@ -57,3 +57,17 @@ export function subagentRouteContext(state = {}) {
         : '';
     return `You are a child thread on ${route}${mission}. Execute only the slice assigned by the parent.${artifacts} Do not spawn or delegate other agents, wait for sibling threads, integrate sibling results, close the parent route, or author the sks.subagent-parent-summary.v1 parent result. Return a concise slice result to the parent.${databaseBoundary}`;
 }
+export function officialSubagentSkillGuardBinding(state = {}, options = {}) {
+    const missionId = String(state?.mission_id || '').trim();
+    const workflowRunId = String(state?.official_subagent_run_id || '').trim();
+    const routeIdentity = String(state?.mode || state?.route || state?.route_command || '').replace(/^\$/, '').toUpperCase();
+    const activeNaruto = routeIdentity === 'NARUTO' || routeIdentity === 'SKS-NARUTO';
+    if (state?.route_closed === true) {
+        return options.allowClosedOfficialChild && activeNaruto && missionId && workflowRunId
+            ? { missionId, workflowRunId }
+            : null;
+    }
+    if (!activeNaruto && (!missionId || !workflowRunId))
+        return null;
+    return { missionId, workflowRunId };
+}

package/dist/core/hooks-runtime/subagent-skill-availability-contract.js

@@ -9,7 +9,7 @@ export const MAX_GUARD_DIRECTORY_ENTRIES = (HARD_NARUTO_MAX_THREADS * 2) + 16;
 export const MAX_LIFECYCLE_GUARD_BYTES = 64 * 1024;
 export const MAX_SUBAGENT_PLAN_BYTES = 256 * 1024;
 export const ADMISSION_SCHEMA = 'sks.subagent-skill-availability-admission.v1';
-export const SUBAGENT_ADMISSION_BLOCKER_RE = /^(?:authoritative_sks_skill_resolution_failed|authoritative_sks_skill_candidate_rejected|authoritative_sks_skill_unavailable:sks(?:-[a-z0-9]+)*|subagent_skill_availability_(?:artifact_dir_unsafe|blocker_artifact_write_failed|guard_persistence_failed))$/;
+export const SUBAGENT_ADMISSION_BLOCKER_RE = /^(?:authoritative_sks_skill_resolution_failed|authoritative_sks_skill_candidate_rejected|authoritative_sks_skill_unavailable:sks(?:-[a-z0-9]+)*|subagent_skill_availability_(?:artifact_dir_unsafe|blocker_artifact_write_failed|guard_invalid|guard_persistence_failed))$/;
 export class SubagentSkillAvailabilityGuardError extends Error {
     childEvidence;
     constructor(childEvidence) {

package/dist/core/hooks-runtime/tool-output-quarantine.js

@@ -87,6 +87,6 @@ export function interruptedToolOutputRecoveryBlockReason(input = {}) {
         `SKS blocked same-thread continuation because custom tool call ${callId} has no correlated output (active mission: ${missionId}).`,
         'The current Codex conversation state may be structurally invalid, so additional context cannot repair the pending Responses request.',
         'Treat the call result as unknown and do not replay a possibly mutating action.',
-        'Upgrade the selected codex-lb to the official latest stable release (`sks codex-lb status --json` reports whether the deployment satisfies tool-heavy continuation), or explicitly disable only codex-lb routing with `sks codex-lb disable`, then open a fresh Codex thread and continue the persisted mission after inspecting side effects. ChatGPT OAuth is not replaced by either action.'
+        'Inspect the current provider with `sks bridge status --json` and verify it with `sks bridge verify --level deep --strict`; if codex-lb remains unavailable, disable only that provider with `sks bridge provider disable codex-lb`, then open a fresh Codex thread and continue the persisted mission after inspecting side effects. These actions do not replace ChatGPT OAuth or delete provider credentials.'
     ].join(' ');
 }