sneakoscope 8.1.2 → 8.2.0

package/dist/core/release/publish-preflight.js

@@ -2,7 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { normalizeReleaseOrigin, RELEASE_ORIGIN_IDENTITY } from './release-origin.js';
-import { inspectPhysicalReleaseGates } from './physical-release-gates.js';
+import { validatePhysicalReleaseGateInspection } from './physical-release-gates.js';
 export function inspectPublishPreflight(options) {
     const root = path.resolve(options.root);
     const run = options.run || runCommand;
@@ -54,10 +54,10 @@ export function inspectPublishPreflight(options) {
             blockers.push(`remote_release_tag_not_head:${releaseTag}`);
     }
     const physicalReleaseGates = requirePhysicalReleaseGates
-        ? inspectPhysicalReleaseGates({
+        ? validatePhysicalReleaseGateInspection({
             root,
             version,
-            sourceCommit: validSha(head) ? head : null,
+            sourceCommit: validSha(head) ? head : '',
         })
         : null;
     if (physicalReleaseGates && !physicalReleaseGates.ok) {

package/dist/core/release/release-gate-batch-runner.js

@@ -5,6 +5,7 @@ import { cleanupReleaseGateHermeticEnv, createReleaseGateHermeticEnv } from './r
 import { writeReleaseGateJson } from './release-gate-report.js';
 import { guardedProcessKill, guardContextForRoute } from '../safety/mutation-guard.js';
 import { createRequestedScopeContract } from '../safety/requested-scope-contract.js';
+import { normalizeReleaseGateOutput } from './release-gate-output-contract.js';
 const DISALLOWED_BATCH_RESOURCES = new Set(['git-worktree', 'local-llm-real', 'remote-model-real', 'publish', 'global-config', 'timing-sensitive']);
 export function isReleaseGateBatchable(gate) {
     if (gate.side_effect !== 'hermetic')
@@ -21,7 +22,7 @@ export async function runReleaseGateBatch(root, gates, input = {}) {
     const nonBatchable = gates.filter((gate) => !isReleaseGateBatchable(gate));
     if (nonBatchable.length) {
         return {
-            schema: 'sks.release-gate-batch-result.v1',
+            schema: 'sks.release-gate-batch-result.v2',
             ok: false,
             batch_size: gates.length,
             completed: 0,
@@ -45,7 +46,7 @@ export async function runReleaseGateBatch(root, gates, input = {}) {
     await Promise.all(workers);
     const failed = results.filter((row) => !row.ok).length;
     return {
-        schema: 'sks.release-gate-batch-result.v1',
+        schema: 'sks.release-gate-batch-result.v2',
         ok: failed === 0,
         batch_size: gates.length,
         completed: results.length - failed,
@@ -57,7 +58,8 @@ function runOne(root, runId, reportRoot, gate) {
     const started = performance.now();
     const hermetic = createReleaseGateHermeticEnv({ root, runId, gate, reportRoot });
     return new Promise((resolve) => {
-        const child = spawn(gate.command, { cwd: root, shell: true, env: hermetic.env, stdio: ['ignore', 'ignore', 'ignore'], detached: process.platform !== 'win32' });
+        const child = spawn(gate.command, { cwd: root, shell: true, env: hermetic.env, stdio: ['ignore', 'pipe', 'pipe'], detached: process.platform !== 'win32' });
+        let stdoutTail = '';
         let timedOut = false;
         let timeoutCleanup = null;
         const timer = setTimeout(() => {
@@ -65,20 +67,27 @@ function runOne(root, runId, reportRoot, gate) {
             timeoutCleanup = cleanupTimedOutGateProcessTree(root, child);
         }, gate.timeout_ms);
         timer.unref?.();
+        child.stdout.on('data', (chunk) => {
+            stdoutTail = appendTail(stdoutTail, String(chunk));
+        });
+        child.stderr.resume();
         child.on('close', (code, signal) => {
             void (async () => {
                 clearTimeout(timer);
                 if (timeoutCleanup)
                     await timeoutCleanup;
                 const exitCode = timedOut ? 124 : code;
+                const normalized = normalizeReleaseGateOutput({ gateId: gate.id, status: exitCode, signal, timedOut, stdout: stdoutTail });
                 const result = {
                     id: gate.id,
-                    ok: exitCode === 0,
+                    ok: normalized.evaluation.ok,
                     exit_code: exitCode,
                     signal,
                     timed_out: timedOut,
                     duration_ms: Math.max(1, Math.round(performance.now() - started)),
-                    report_dir: hermetic.report_dir
+                    report_dir: hermetic.report_dir,
+                    output_contract: gate.output_contract,
+                    gate_result: normalized.gate_result
                 };
                 cleanupReleaseGateHermeticEnv(hermetic);
                 resolve(result);
@@ -86,6 +95,10 @@ function runOne(root, runId, reportRoot, gate) {
         });
     });
 }
+function appendTail(previous, next, limit = 64 * 1024) {
+    const combined = `${previous}${next}`;
+    return combined.length > limit ? combined.slice(-limit) : combined;
+}
 async function cleanupTimedOutGateProcessTree(root, child) {
     await killGateProcessTree(root, child, 'SIGTERM');
     await sleep(1500);
@@ -118,7 +131,7 @@ function sleep(ms) {
 function writeChildResult(reportRoot, result) {
     const dir = result.report_dir || path.join(reportRoot, result.id.replace(/[^A-Za-z0-9_.:-]/g, '_'));
     writeReleaseGateJson(path.join(dir, 'result.json'), {
-        schema: 'sks.release-gate-batch-child-result.v1',
+        schema: 'sks.release-gate-batch-child-result.v2',
         ...result
     });
 }

package/dist/core/release/release-gate-dag.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
+import { finished } from 'node:stream/promises';
 import { cleanupReleaseGateHermeticEnv, cleanupReleaseGateRunTemp, createReleaseGateHermeticEnv } from './release-gate-hermetic-env.js';
 import { appendReleaseGateJsonl, writeReleaseGateJson } from './release-gate-report.js';
 import { findReadyReleaseGateNodes, findReleaseGatesBlockedByFailedDeps, pickReadyLaunchableReleaseGates } from './release-gate-scheduler.js';
@@ -15,6 +16,7 @@ import { guardedProcessKill, guardContextForRoute } from '../safety/mutation-gua
 import { createRequestedScopeContract } from '../safety/requested-scope-contract.js';
 import { rmrf } from '../fsx.js';
 import { sweepSksTempDirs } from '../retention.js';
+import { normalizeReleaseGateOutput } from './release-gate-output-contract.js';
 export function loadReleaseGateManifest(root, file = 'release-gates.v2.json') {
     const manifestPath = path.join(root, file);
     const parsed = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
@@ -398,6 +400,7 @@ function runGate(root, runId, reportRoot, gate) {
     const err = fs.createWriteStream(stderrFile);
     return new Promise((resolve) => {
         const child = spawn(gate.command, { cwd: root, shell: true, env: hermetic.env, stdio: ['ignore', 'pipe', 'pipe'], detached: process.platform !== 'win32' });
+        let stdoutTail = '';
         let timedOut = false;
         let timeoutCleanup = null;
         const timer = setTimeout(() => {
@@ -405,29 +408,53 @@ function runGate(root, runId, reportRoot, gate) {
             timeoutCleanup = cleanupTimedOutGateProcessTree(root, child);
         }, gate.timeout_ms);
         timer.unref?.();
-        child.stdout.pipe(out);
-        child.stderr.pipe(err);
+        child.stdout.on('data', (chunk) => {
+            stdoutTail = appendTail(stdoutTail, String(chunk));
+        });
+        child.stdout.pipe(out, { end: false });
+        child.stderr.pipe(err, { end: false });
         child.on('close', (code, signal) => {
             void (async () => {
                 clearTimeout(timer);
                 if (timeoutCleanup)
                     await timeoutCleanup;
+                const exitCode = timedOut ? 124 : code;
+                const normalized = normalizeReleaseGateOutput({
+                    gateId: gate.id,
+                    status: exitCode,
+                    signal,
+                    timedOut,
+                    stdout: stdoutTail
+                });
+                out.write(`${stdoutTail.endsWith('\n') || stdoutTail.length === 0 ? '' : '\n'}${normalized.line}\n`);
                 out.end();
                 err.end();
+                await Promise.allSettled([finished(out), finished(err)]);
                 const durationMs = Date.now() - started;
                 const stderrText = fs.existsSync(stderrFile) ? fs.readFileSync(stderrFile, 'utf8') : '';
                 const timeoutTail = timedOut ? `release_gate_timeout:${gate.id}:${gate.timeout_ms}ms` : '';
                 const signalTail = !timedOut && signal ? `release_gate_signal:${gate.id}:${signal}` : '';
-                const stderrTail = tail([stderrText, timeoutTail, signalTail].filter(Boolean).join('\n'));
-                const exitCode = timedOut ? 124 : code;
-                const result = { id: gate.id, ok: exitCode === 0, exit_code: exitCode, signal, timed_out: timedOut, duration_ms: durationMs, cached: false, stderr_tail: stderrTail };
-                writeReleaseGateJson(path.join(hermetic.report_dir, 'result.json'), { schema: 'sks.release-gate-result.v1', ...result, stdout_log: stdoutFile, stderr_log: stderrFile });
+                const contractTail = normalized.evaluation.ok ? '' : normalized.gate_result.blockers.map(String).join('\n');
+                const stderrTail = tail([stderrText, timeoutTail, signalTail, contractTail].filter(Boolean).join('\n'));
+                const result = { id: gate.id, ok: normalized.evaluation.ok, exit_code: exitCode, signal, timed_out: timedOut, duration_ms: durationMs, cached: false, stderr_tail: stderrTail };
+                writeReleaseGateJson(path.join(hermetic.report_dir, 'result.json'), {
+                    schema: 'sks.release-gate-result.v2',
+                    ...result,
+                    output_contract: gate.output_contract,
+                    gate_result: normalized.gate_result,
+                    stdout_log: stdoutFile,
+                    stderr_log: stderrFile
+                });
                 cleanupReleaseGateHermeticEnv(hermetic);
                 resolve(result);
             })();
         });
     });
 }
+function appendTail(previous, next, limit = 64 * 1024) {
+    const combined = `${previous}${next}`;
+    return combined.length > limit ? combined.slice(-limit) : combined;
+}
 async function cleanupTimedOutGateProcessTree(root, child) {
     await killGateProcessTree(root, child, 'SIGTERM');
     await sleep(1500);

package/dist/core/release/release-gate-node.js

@@ -47,10 +47,8 @@ export function validateReleaseGateManifest(input) {
             errors.push(`gate_side_effect_invalid:${gate?.id || 'unknown'}`);
         if (!Number.isFinite(Number(gate?.timeout_ms)) || Number(gate.timeout_ms) <= 0)
             errors.push(`gate_timeout_missing:${gate?.id || 'unknown'}`);
-        if (gate?.output_contract !== undefined && gate.output_contract !== 'sks.gate-result.v1')
+        if (gate?.output_contract !== 'sks.gate-result.v2')
             errors.push(`gate_output_contract_invalid:${gate?.id || 'unknown'}`);
-        if (gate?.contract_note !== undefined && typeof gate.contract_note !== 'string')
-            errors.push(`gate_contract_note_invalid:${gate?.id || 'unknown'}`);
         if (!gate?.cache || typeof gate.cache.enabled !== 'boolean' || !Array.isArray(gate.cache.inputs))
             errors.push(`gate_cache_missing:${gate?.id || 'unknown'}`);
         if (!gate?.isolation || gate.isolation.report_dir !== 'per-gate')

package/dist/core/release/release-gate-output-contract.js

@@ -0,0 +1,55 @@
+import { GATE_RESULT_CONTRACT, GATE_RESULT_CONTRACT_MODE, evaluateGateProcessOutput, parseGateResultFromStdout } from '../commands/gate-result-contract.js';
+export function normalizeReleaseGateOutput(input) {
+    const childResult = parseGateResultFromStdout(input.stdout);
+    const processBlockers = [
+        ...(input.timedOut ? [`release_gate_timeout:${input.gateId}`] : []),
+        ...(!input.timedOut && input.signal ? [`release_gate_signal:${input.gateId}:${input.signal}`] : []),
+        ...(!input.timedOut && !input.signal && input.status !== 0 ? [`release_gate_exit:${input.gateId}:${String(input.status)}`] : [])
+    ];
+    const processOk = !input.timedOut && !input.signal && input.status === 0;
+    const gateResult = {
+        ...(childResult || {}),
+        schema: GATE_RESULT_CONTRACT,
+        contract_mode: GATE_RESULT_CONTRACT_MODE,
+        ok: processOk && (childResult?.ok ?? true),
+        blockers: dedupe([
+            ...(childResult?.blockers || []),
+            ...processBlockers
+        ]),
+        producer: 'release-gate-command-adapter',
+        execution: {
+            gate_id: input.gateId,
+            child_contract: childResult?.schema || null,
+            child_exit_code: input.status,
+            child_signal: input.signal,
+            timed_out: input.timedOut
+        }
+    };
+    const line = JSON.stringify(gateResult);
+    return {
+        gate_result: gateResult,
+        evaluation: evaluateGateProcessOutput({ status: input.status, stdout: line }),
+        line
+    };
+}
+function dedupe(values) {
+    const seen = new Set();
+    const result = [];
+    for (const value of values) {
+        const key = typeof value === 'string' ? `string:${value}` : `json:${safeJson(value)}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        result.push(value);
+    }
+    return result;
+}
+function safeJson(value) {
+    try {
+        const encoded = JSON.stringify(value);
+        return encoded === undefined ? String(value) : encoded;
+    }
+    catch {
+        return String(value);
+    }
+}

package/dist/core/release/release-pack-contract.js

@@ -1,2 +1,2 @@
-export const RELEASE_PACK_RECEIPT_SCHEMA = 'sks.release-pack-receipt.v1';
+export const RELEASE_PACK_RECEIPT_SCHEMA = 'sks.release-pack-receipt.v2';
 export const RELEASE_PACK_COMPARE_SCHEMA = 'sks.release-pack-compare.v1';

package/dist/core/release/release-pack-receipt.js

@@ -1,7 +1,9 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { tmpdir } from '../fsx.js';
 import { DEFAULT_MAX_PACK_BYTES, DEFAULT_MAX_UNPACKED_BYTES } from './package-size-budget.js';
 import { readCurrentNpmPackGateArtifacts } from './npm-pack-proof.js';
 import { scanTarballTextContents } from './release-pack-content-scanner.js';
@@ -42,6 +44,11 @@ export function inspectReleaseTarball(input) {
         blockers.push('tarball_unpacked_size_unavailable');
     const sha256 = bytes.length ? hash(bytes, 'sha256', 'hex') : '';
     const sha512Base64 = bytes.length ? hash(bytes, 'sha512', 'base64') : '';
+    const sourceBinding = input.kind === 'local' && input.root && input.sourceCommit && bytes.length && inventory.blockers.length === 0
+        ? inspectSourcePackageBinding(input.root, input.sourceCommit, tarball, files, sha256)
+        : null;
+    if (sourceBinding)
+        blockers.push(...sourceBinding.blockers);
     const budgetBlockers = [
         ...(bytes.length > DEFAULT_MAX_PACK_BYTES ? ['packed_bytes_over_limit'] : []),
         ...(unpackedBytes > DEFAULT_MAX_UNPACKED_BYTES ? ['unpacked_bytes_over_limit'] : []),
@@ -55,6 +62,9 @@ export function inspectReleaseTarball(input) {
         package_name: String(packageJson?.name || ''),
         package_version: String(packageJson?.version || ''),
         source_commit: input.sourceCommit || null,
+        source_tree_sha256: sourceBinding?.source_tree_sha256 || null,
+        source_package_sha256: sourceBinding?.source_package_sha256 || null,
+        source_package_binding_sha256: sourceBinding?.source_package_binding_sha256 || null,
         tarball_name: path.basename(tarball),
         tarball_path: input.root ? normalizePath(path.relative(input.root, tarball)) : normalizePath(tarball),
         bytes: bytes.length,
@@ -115,7 +125,10 @@ export function compareReleasePacks(local, staged) {
 export function validateReleasePackReceipt(value, expectedKind, options = {}) {
     const receipt = value;
     const blockers = [];
-    if (!receipt || receipt.schema !== RELEASE_PACK_RECEIPT_SCHEMA)
+    if (receipt?.schema === 'sks.release-pack-receipt.v1') {
+        blockers.push('receipt_schema_v1_outdated_regenerate_with_npm_run_release:pack-receipt');
+    }
+    else if (!receipt || receipt.schema !== RELEASE_PACK_RECEIPT_SCHEMA)
         blockers.push('schema_invalid');
     if (receipt?.ok !== true)
         blockers.push('not_ok');
@@ -192,8 +205,19 @@ export function validateReleasePackReceipt(value, expectedKind, options = {}) {
         if (!/^[a-f0-9]{64}$/i.test(String(receipt?.npm_pack_proof?.file_list_sha256 || '')))
             blockers.push('npm_pack_file_list_sha256_invalid');
     }
-    if (receipt?.kind === 'local' && !/^[a-f0-9]{40}$/i.test(String(receipt?.source_commit || '')))
-        blockers.push('source_commit_invalid');
+    if (receipt?.kind === 'local') {
+        if (!/^[a-f0-9]{40}$/i.test(String(receipt?.source_commit || '')))
+            blockers.push('source_commit_invalid');
+        if (!/^[a-f0-9]{64}$/i.test(String(receipt?.source_tree_sha256 || '')))
+            blockers.push('source_tree_sha256_invalid');
+        if (!/^[a-f0-9]{64}$/i.test(String(receipt?.source_package_sha256 || '')))
+            blockers.push('source_package_sha256_invalid');
+        if (!/^[a-f0-9]{64}$/i.test(String(receipt?.source_package_binding_sha256 || '')))
+            blockers.push('source_package_binding_sha256_invalid');
+        const expectedBinding = sourcePackageBindingSha256(String(receipt?.source_commit || ''), String(receipt?.source_tree_sha256 || ''), String(receipt?.source_package_sha256 || ''), String(receipt?.sha256 || ''));
+        if (receipt?.source_package_binding_sha256 !== expectedBinding)
+            blockers.push('source_package_binding_sha256_mismatch');
+    }
     return { ok: blockers.length === 0, receipt: receipt || null, blockers: unique(blockers) };
 }
 export function validateLocalReleasePackBinding(root, value) {
@@ -224,9 +248,12 @@ export function validateLocalReleasePackBinding(root, value) {
         if (receipt?.sha512_integrity !== info.integrity)
             blockers.push('npm_pack_integrity_mismatch');
     }
-    const head = gitHead(root);
-    if (!head || receipt?.source_commit !== head)
+    const sourceState = inspectLocalReleaseSourceState(root);
+    if (!sourceState.head || receipt?.source_commit !== sourceState.head)
         blockers.push('npm_pack_source_commit_mismatch');
+    if (!sourceState.source_tree_sha256 || receipt?.source_tree_sha256 !== sourceState.source_tree_sha256)
+        blockers.push('npm_pack_source_tree_sha256_mismatch');
+    blockers.push(...sourceState.blockers);
     const tarball = receipt?.tarball_path ? path.resolve(root, receipt.tarball_path) : '';
     const managedRoot = path.resolve(root, '.sneakoscope', 'reports', 'release', String(receipt?.package_version || ''), 'artifacts');
     const relative = tarball ? path.relative(managedRoot, tarball) : '..';
@@ -234,7 +261,7 @@ export function validateLocalReleasePackBinding(root, value) {
         blockers.push('local_tarball_artifact_missing_or_unsafe');
     else {
         const actual = inspectReleaseTarball({ tarball, kind: 'local', sourceCommit: receipt?.source_commit || null, root });
-        for (const key of ['package_name', 'package_version', 'tarball_name', 'tarball_path', 'bytes', 'unpacked_bytes', 'sha256', 'sha512_integrity', 'file_count', 'file_list_sha256']) {
+        for (const key of ['package_name', 'package_version', 'source_tree_sha256', 'source_package_sha256', 'source_package_binding_sha256', 'tarball_name', 'tarball_path', 'bytes', 'unpacked_bytes', 'sha256', 'sha512_integrity', 'file_count', 'file_list_sha256']) {
             if (actual[key] !== receipt?.[key])
                 blockers.push(`local_tarball_artifact_mismatch:${key}`);
         }
@@ -245,7 +272,72 @@ export function validateLocalReleasePackBinding(root, value) {
         if (!actual.ok)
             blockers.push(...actual.blockers.map((blocker) => `local_tarball_artifact:${blocker}`));
     }
-    return { ok: blockers.length === 0, receipt, gate, blockers: unique(blockers) };
+    return { ok: blockers.length === 0, receipt, gate, sourceState, blockers: unique(blockers) };
+}
+export function inspectLocalReleaseSourceState(root) {
+    const blockers = [];
+    const head = gitHead(root);
+    if (!head)
+        blockers.push('npm_pack_source_commit_unavailable');
+    const sourceTreeSha256 = head ? gitTreeSha256(root, head) : '';
+    if (!sourceTreeSha256)
+        blockers.push('npm_pack_source_tree_digest_unavailable');
+    const trackedStatus = spawnSync('git', ['status', '--porcelain=v1', '--untracked-files=no'], { cwd: root, encoding: 'utf8' });
+    const trackedChanges = trackedStatus.status === 0 && Boolean(String(trackedStatus.stdout || '').trim());
+    if (trackedStatus.status !== 0)
+        blockers.push('npm_pack_tracked_status_unavailable');
+    else if (trackedChanges)
+        blockers.push('npm_pack_tracked_changes_present');
+    const fullStatus = spawnSync('git', ['status', '--porcelain=v1', '--untracked-files=all'], {
+        cwd: root,
+        encoding: 'utf8',
+        maxBuffer: 32 * 1024 * 1024
+    });
+    if (fullStatus.status !== 0)
+        blockers.push('npm_pack_untracked_status_unavailable');
+    else if (String(fullStatus.stdout || '').split(/\r?\n/).some((line) => line.startsWith('?? '))) {
+        blockers.push('npm_pack_untracked_files_present');
+    }
+    const trackedFilesResult = spawnSync('git', ['ls-files', '-z'], { cwd: root, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024 });
+    const trackedFiles = trackedFilesResult.status === 0
+        ? new Set(String(trackedFilesResult.stdout || '').split('\0').filter(Boolean).map(normalizePath))
+        : null;
+    if (!trackedFiles)
+        blockers.push('npm_pack_tracked_file_inventory_unavailable');
+    const dryRun = spawnSync('npm', ['pack', '--dry-run', '--ignore-scripts', '--json'], {
+        cwd: root,
+        encoding: 'utf8',
+        maxBuffer: 32 * 1024 * 1024,
+        env: { ...process.env, npm_config_cache: process.env.SKS_RELEASE_NPM_CACHE || path.join(os.tmpdir(), 'sneakoscope-npm-cache') }
+    });
+    let packedFiles = null;
+    if (dryRun.status === 0) {
+        try {
+            const parsed = JSON.parse(String(dryRun.stdout || '[]'));
+            const info = Array.isArray(parsed) ? parsed[0] : parsed;
+            packedFiles = Array.isArray(info?.files)
+                ? info.files.map((file) => normalizePath(String(file?.path || ''))).filter(Boolean)
+                : null;
+        }
+        catch {
+            packedFiles = null;
+        }
+    }
+    if (!packedFiles)
+        blockers.push('npm_pack_dry_run_file_inventory_unavailable');
+    const packEligibleUntracked = trackedFiles && packedFiles
+        ? unique(packedFiles.filter((relative) => !trackedFiles.has(relative) && !isGeneratedDistPackagePath(relative))).sort()
+        : [];
+    if (packEligibleUntracked.length > 0)
+        blockers.push('npm_pack_eligible_untracked_files_present');
+    return {
+        ok: blockers.length === 0,
+        head,
+        source_tree_sha256: sourceTreeSha256,
+        tracked_changes: trackedChanges,
+        pack_eligible_untracked: packEligibleUntracked,
+        blockers: unique(blockers)
+    };
 }
 export function writeReleaseJson(file, value) {
     fs.mkdirSync(path.dirname(file), { recursive: true });
@@ -284,6 +376,7 @@ const SECRET_PATTERNS = [
     { kind: 'npm_token', regex: /\bnpm_[A-Za-z0-9]{30,}\b/g },
     { kind: 'slack_token', regex: /\bxox[baprs]-[A-Za-z0-9-]{20,}\b/g },
     { kind: 'openai_token', regex: /\bsk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{20,}\b/g },
+    { kind: 'supabase_secret_key', regex: /\bsb_secret_[A-Za-z0-9_-]{20,}\b/g },
     { kind: 'google_api_key', regex: /\bAIza[0-9A-Za-z_-]{30,}\b/g },
     { kind: 'aws_access_key', regex: /\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g },
     { kind: 'jwt', regex: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/g },
@@ -323,7 +416,7 @@ const RETIRED_SURFACE_ALLOWLIST = [
     { path: /^dist\/core\/doctor\/skill-legacy-surface\.js$/, kinds: new Set(RETIRED_SURFACE_PATTERNS.map((pattern) => pattern.kind)) },
     { path: /^dist\/core\/doctor\/retired-managed-projection-residue\.js$/, kinds: new Set(['retired_team_runtime_identity']) },
     { path: /^dist\/core\/doctor\/retired-managed-residue(?:-artifact-helpers|-artifacts|-missions|-private|-runtime|-state)?\.js$/, kinds: new Set(['retired_cli_command', 'retired_dollar_command', 'retired_ralph_identity', 'retired_team_current_wording', 'retired_team_profile', 'retired_team_runtime_identity', 'retired_team_workdir']) },
-    { path: /^dist\/core\/init\/skills\.js$/, kinds: new Set(['retired_ralph_identity']) },
+    { path: /^dist\/core\/init\/(?:skills\.js|skills\/inventory\.js)$/, kinds: new Set(['retired_ralph_identity']) },
     { path: /^dist\/core\/install\/installed-package-smoke\.js$/, kinds: new Set(['retired_agent_option', 'retired_clones_option', 'retired_dollar_command', 'retired_menubar_mcp_identity', 'retired_naruto_option', 'retired_naruto_workers_command', 'retired_ralph_identity']) },
     { path: /^dist\/core\/ops\/upgrade-migration-fixtures\.js$/, kinds: new Set(['retired_dollar_command']) },
     { path: /^dist\/core\/release\/release-pack-receipt\.js$/, kinds: new Set(RETIRED_SURFACE_PATTERNS.map((pattern) => pattern.kind)) },
@@ -339,6 +432,103 @@ function retiredSurfaceFindingAllowed(finding) {
 function hash(value, algorithm, encoding) {
     return crypto.createHash(algorithm).update(value).digest(encoding);
 }
+function inspectSourcePackageBinding(root, sourceCommit, tarball, files, tarballSha256) {
+    const blockers = [];
+    const sourceTreeSha256 = gitTreeSha256(root, sourceCommit);
+    if (!sourceTreeSha256)
+        blockers.push('source_tree_digest_unavailable');
+    const temp = tmpdir('release-source-package-binding-');
+    const sourceRoot = path.join(temp, 'source');
+    const packageRoot = path.join(temp, 'packed');
+    const archive = path.join(temp, 'source.tar');
+    const packageHash = crypto.createHash('sha256');
+    try {
+        fs.mkdirSync(sourceRoot);
+        fs.mkdirSync(packageRoot);
+        const archived = spawnSync('git', ['archive', '--format=tar', `--output=${archive}`, sourceCommit], {
+            cwd: root,
+            encoding: 'utf8',
+            maxBuffer: 32 * 1024 * 1024
+        });
+        if (archived.status !== 0)
+            blockers.push('source_commit_archive_unavailable');
+        const extractedSource = archived.status === 0
+            ? spawnSync('tar', ['-xf', archive, '-C', sourceRoot], { encoding: 'utf8', maxBuffer: 32 * 1024 * 1024 })
+            : null;
+        if (!extractedSource || extractedSource.status !== 0)
+            blockers.push('source_commit_extract_unavailable');
+        const extractedPackage = spawnSync('tar', ['-xzf', tarball, '-C', packageRoot], { encoding: 'utf8', maxBuffer: 32 * 1024 * 1024 });
+        if (extractedPackage.status !== 0)
+            blockers.push('tarball_source_binding_extract_unavailable');
+        if (extractedSource?.status === 0 && extractedPackage.status === 0) {
+            for (const entry of [...files].sort()) {
+                const relative = normalizePath(entry).replace(/^package\//, '');
+                const packedFile = path.join(packageRoot, 'package', relative);
+                const sourceFile = path.join(sourceRoot, relative);
+                if (!fs.existsSync(packedFile) || !fs.statSync(packedFile).isFile()) {
+                    blockers.push(`packed_file_unavailable_for_source_binding:${relative}`);
+                    continue;
+                }
+                const packedBytes = fs.readFileSync(packedFile);
+                const packedSha256 = hash(packedBytes, 'sha256', 'hex');
+                packageHash.update(relative);
+                packageHash.update('\0');
+                packageHash.update(String(packedBytes.length));
+                packageHash.update('\0');
+                packageHash.update(packedSha256);
+                packageHash.update('\0');
+                if (!fs.existsSync(sourceFile) || !fs.statSync(sourceFile).isFile()) {
+                    if (isGeneratedDistPackagePath(relative)) {
+                        const builtFile = path.join(root, relative);
+                        let builtStat = null;
+                        try {
+                            builtStat = fs.lstatSync(builtFile);
+                        }
+                        catch {
+                            builtStat = null;
+                        }
+                        if (!builtStat?.isFile() || builtStat.isSymbolicLink()) {
+                            blockers.push(`packed_generated_dist_missing_from_current_build:${relative}`);
+                        }
+                        else if (!fs.readFileSync(builtFile).equals(packedBytes)) {
+                            blockers.push(`packed_generated_dist_differs_from_current_build:${relative}`);
+                        }
+                    }
+                    else {
+                        blockers.push(`packed_file_missing_from_source_commit:${relative}`);
+                    }
+                    continue;
+                }
+                const sourceBytes = fs.readFileSync(sourceFile);
+                if (!sourceBytes.equals(packedBytes))
+                    blockers.push(`packed_file_differs_from_source_commit:${relative}`);
+            }
+        }
+    }
+    finally {
+        fs.rmSync(temp, { recursive: true, force: true });
+    }
+    const sourcePackageSha256 = packageHash.digest('hex');
+    return {
+        source_tree_sha256: sourceTreeSha256,
+        source_package_sha256: sourcePackageSha256,
+        source_package_binding_sha256: sourcePackageBindingSha256(sourceCommit, sourceTreeSha256, sourcePackageSha256, tarballSha256),
+        blockers: unique(blockers)
+    };
+}
+function sourcePackageBindingSha256(sourceCommit, sourceTreeSha256, sourcePackageSha256, tarballSha256) {
+    return hash(Buffer.from([
+        RELEASE_PACK_RECEIPT_SCHEMA,
+        sourceCommit,
+        sourceTreeSha256,
+        sourcePackageSha256,
+        tarballSha256
+    ].join('\n')), 'sha256', 'hex');
+}
+function isGeneratedDistPackagePath(relative) {
+    const normalized = normalizePath(relative);
+    return normalized.startsWith('dist/') && !normalized.includes('/../');
+}
 function unique(values) {
     return [...new Set(values.filter(Boolean))];
 }
@@ -346,6 +536,17 @@ function gitHead(root) {
     const result = spawnSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' });
     return result.status === 0 ? String(result.stdout || '').trim() : '';
 }
+function gitTreeSha256(root, commit) {
+    if (!/^[a-f0-9]{40}$/i.test(commit))
+        return '';
+    const verified = spawnSync('git', ['rev-parse', '--verify', `${commit}^{commit}`], { cwd: root, encoding: 'utf8' });
+    if (verified.status !== 0 || String(verified.stdout || '').trim().toLowerCase() !== commit.toLowerCase())
+        return '';
+    const tree = spawnSync('git', ['ls-tree', '-r', '-z', '--full-tree', commit], { cwd: root, maxBuffer: 32 * 1024 * 1024 });
+    if (tree.status !== 0 || !Buffer.isBuffer(tree.stdout))
+        return '';
+    return hash(tree.stdout, 'sha256', 'hex');
+}
 function normalizePath(value) {
     return value.split(path.sep).join('/');
 }

package/dist/core/release/release-real-contract.js

@@ -15,7 +15,7 @@ export const RELEASE_REAL_REQUIRED_CHECK_IDS = Object.freeze([
     'codex-sdk:real-smoke'
 ]);
 export const RELEASE_REAL_OPTIONAL_CHECK_IDS = Object.freeze([
-    'codex-lb:desktop-real-evidence',
+    'desktop-bridge:real-evidence',
     'imagegen:real-smoke',
     'ux-review:real-imagegen-smoke',
     'ppt:real-imagegen-smoke'