sneakoscope 8.1.2 → 8.2.0

package/dist/scripts/desktop-bridge-unification-check.js

@@ -0,0 +1,276 @@
+#!/usr/bin/env node
+import assert from 'node:assert/strict';
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { COMMAND_ALIASES_LITE, COMMAND_MANIFEST_BY_NAME } from '../cli/command-manifest-lite.js';
+import { normalizeCommand } from '../cli/router.js';
+import { inspectHistoricalDesktopBridgeIntent, migrateDesktopBridgeConfig } from '../core/codex-lb/desktop-bridge-migration.js';
+import { rollbackDesktopBridgeUnificationReceipt } from '../core/codex-lb/migration-receipt.js';
+import { configureProviderCredential, resolveAllProviderCredentials } from '../core/codex-lb/provider-credentials.js';
+import { buildStoredBridgeProviderRegistry, resolveBridgeProviderRegistry, serializeStoredBridgeProviderRegistry } from '../core/codex-lb/provider-registry.js';
+import { buildBridgeRoutingPolicy, readBridgeRoutingPolicy } from '../core/codex-lb/provider-route-policy.js';
+import { buildBridgeRouteIndex } from '../core/codex-lb/route-index.js';
+import { openRouterSecretPaths } from '../core/providers/openrouter/openrouter-secret-store.js';
+import { emitGate } from './gate-lib.js';
+const clientCapability = 'A'.repeat(43);
+const bridgeBaseUrl = `http://127.0.0.1:47821/__sks/client/${clientCapability}/backend-api/codex`;
+const codexLbEndpoint = 'https://lb.example.test/backend-api/codex';
+const initialCodexLbKey = 'fixture-codex-lb-key-initial-123456789';
+const initialOpenRouterKey = 'fixture-openrouter-key-initial-987654321';
+const rotatedCodexLbKey = 'fixture-codex-lb-key-rotated-234567891';
+const rotatedOpenRouterKey = 'fixture-openrouter-key-rotated-876543219';
+const initialOauthAccess = 'fixture-oauth-access-initial';
+const initialOauthRefresh = 'fixture-oauth-refresh-initial';
+const rotatedOauthAccess = 'fixture-oauth-access-rotated';
+const rotatedOauthRefresh = 'fixture-oauth-refresh-rotated';
+const allFixtureSecrets = [
+    initialCodexLbKey,
+    initialOpenRouterKey,
+    rotatedCodexLbKey,
+    rotatedOpenRouterKey,
+    initialOauthAccess,
+    initialOauthRefresh,
+    rotatedOauthAccess,
+    rotatedOauthRefresh
+];
+const temporaryRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-desktop-bridge-unification-gate-'));
+let failed = null;
+try {
+    const home = path.join(temporaryRoot, 'home');
+    const codexHome = path.join(home, '.codex');
+    const configPath = path.join(codexHome, 'config.toml');
+    const authPath = path.join(codexHome, 'auth.json');
+    const codexLbEnvPath = path.join(codexHome, 'sks-codex-lb.env');
+    const openRouterPaths = openRouterSecretPaths({ HOME: home });
+    const routePolicyPath = path.join(codexHome, 'sks', 'sks-bridge-route-policy.json');
+    const providerRegistryPath = path.join(codexHome, 'sks', 'sks-bridge-provider-registry.json');
+    const combinedCatalogPath = path.join(codexHome, 'sks', 'sks-bridge-catalog.json');
+    const historicalConfig = [
+        '# sks-codex-lb-managed-provider-selection',
+        'model_provider = "codex-lb"',
+        '',
+        '[model_providers.codex-lb]',
+        'name = "codex-lb"',
+        `base_url = "${codexLbEndpoint}"`,
+        'env_key = "CODEX_LB_API_KEY"',
+        'requires_openai_auth = false',
+        '',
+        '[model_providers.openrouter]',
+        'name = "OpenRouter"',
+        'base_url = "https://openrouter.ai/api/v1"',
+        'requires_openai_auth = false',
+        ''
+    ].join('\n');
+    const initialAuth = authJson(initialOauthAccess, initialOauthRefresh);
+    await fs.mkdir(codexHome, { recursive: true, mode: 0o700 });
+    await fs.writeFile(configPath, historicalConfig, { mode: 0o600 });
+    await fs.writeFile(authPath, initialAuth, { mode: 0o600 });
+    await configureProviderCredential({
+        provider_id: 'codex-lb',
+        api_key: initialCodexLbKey,
+        host: codexLbEndpoint,
+        home,
+        processEnv: {}
+    });
+    await configureProviderCredential({
+        provider_id: 'openrouter',
+        api_key: initialOpenRouterKey,
+        home,
+        processEnv: { HOME: home },
+        openRouterPaths
+    });
+    const initialCredentials = await resolveAllProviderCredentials({
+        codexLb: {
+            home,
+            processEnv: {},
+            validation: { state: 'ready', checked_at: '2026-08-06T00:00:00.000Z' }
+        },
+        openrouter: {
+            processEnv: { HOME: home },
+            openRouterPaths,
+            validation: { state: 'ready', checked_at: '2026-08-06T00:00:00.000Z' }
+        }
+    });
+    assert.equal(initialCredentials['codex-lb'].secret, initialCodexLbKey);
+    assert.equal(initialCredentials.openrouter.secret, initialOpenRouterKey);
+    assert.equal(initialCredentials['codex-lb'].state, 'ready');
+    assert.equal(initialCredentials.openrouter.state, 'ready');
+    const intent = inspectHistoricalDesktopBridgeIntent(historicalConfig);
+    assert.deepEqual(intent.blockers, []);
+    assert.equal(intent.default_provider_id, 'codex-lb');
+    assert.equal(intent.providers['codex-lb'].enabled, true);
+    assert.equal(intent.providers.openrouter.enabled, true);
+    const storedRegistry = buildStoredBridgeProviderRegistry({
+        credentials: initialCredentials,
+        overrides: intent.providers
+    });
+    const registryText = serializeStoredBridgeProviderRegistry(storedRegistry);
+    const registry = await resolveBridgeProviderRegistry({
+        home,
+        registryPath: providerRegistryPath,
+        credentials: initialCredentials,
+        storedRegistry
+    });
+    assert.equal(registry.profiles['codex-lb'].state, 'ready');
+    assert.equal(registry.profiles.openrouter.state, 'ready');
+    assertSecretFree(JSON.stringify({ credentials: initialCredentials, registry }), allFixtureSecrets);
+    assertSecretFree(registryText, allFixtureSecrets);
+    const routeIndex = buildBridgeRouteIndex({
+        models: [],
+        providers: {
+            'codex-lb': {
+                catalog_generation: 'fixture-codex-lb-catalog',
+                credential_fingerprint: initialCredentials['codex-lb'].fingerprint,
+                state: initialCredentials['codex-lb'].state
+            },
+            openrouter: {
+                catalog_generation: 'fixture-openrouter-catalog',
+                credential_fingerprint: initialCredentials.openrouter.fingerprint,
+                state: initialCredentials.openrouter.state
+            }
+        },
+        created_at: '2026-08-06T00:00:00.000Z'
+    }).route_index;
+    const routePolicy = buildBridgeRoutingPolicy({
+        route_index: routeIndex,
+        catalog_generation: 'fixture-combined-catalog',
+        default_provider_id: intent.default_provider_id,
+        changed_at: '2026-08-06T00:00:00.000Z'
+    });
+    const routePolicyText = `${JSON.stringify(routePolicy, null, 2)}\n`;
+    assert.equal(routePolicy.fallback, 'none');
+    assert.deepEqual(routePolicy.model_routes, {});
+    const initialCodexLbBytes = await fs.readFile(codexLbEnvPath);
+    const initialOpenRouterBytes = await fs.readFile(openRouterPaths.keyPath);
+    const first = await migrateDesktopBridgeConfig({
+        home,
+        bridgeBaseUrl,
+        combinedCatalogPath,
+        metadataUpdates: [
+            { kind: 'provider_registry', path: providerRegistryPath, text: registryText },
+            { kind: 'route_policy', path: routePolicyPath, text: routePolicyText }
+        ],
+        now: new Date('2026-08-06T00:01:00.000Z')
+    });
+    assert.equal(first.ok, true);
+    assert.equal(first.status, 'migrated');
+    assert.ok(first.receipt_path);
+    assert.deepEqual(await fs.readFile(authPath), Buffer.from(initialAuth));
+    assert.deepEqual(await fs.readFile(codexLbEnvPath), initialCodexLbBytes);
+    assert.deepEqual(await fs.readFile(openRouterPaths.keyPath), initialOpenRouterBytes);
+    const loadedPolicy = await readBridgeRoutingPolicy(routePolicyPath);
+    assert.deepEqual(loadedPolicy.blockers, []);
+    assert.equal(loadedPolicy.policy?.default_provider_id, 'codex-lb');
+    assert.equal(loadedPolicy.policy?.fallback, 'none');
+    assert.deepEqual(loadedPolicy.policy?.model_routes, {});
+    const migratedConfig = await fs.readFile(configPath, 'utf8');
+    const receiptText = await fs.readFile(first.receipt_path, 'utf8');
+    const receiptEntries = (await fs.readdir(path.dirname(first.receipt_path))).sort();
+    assertSecretFree(migratedConfig, allFixtureSecrets);
+    assertSecretFree(await fs.readFile(routePolicyPath, 'utf8'), allFixtureSecrets);
+    assertSecretFree(await fs.readFile(providerRegistryPath, 'utf8'), allFixtureSecrets);
+    assertSecretFree(receiptText, allFixtureSecrets);
+    assert.equal(receiptText.includes(clientCapability), false);
+    const second = await migrateDesktopBridgeConfig({
+        home,
+        bridgeBaseUrl,
+        combinedCatalogPath,
+        metadataUpdates: [
+            { kind: 'provider_registry', path: providerRegistryPath, text: registryText },
+            { kind: 'route_policy', path: routePolicyPath, text: routePolicyText }
+        ],
+        now: new Date('2026-08-06T00:02:00.000Z')
+    });
+    assert.equal(second.ok, true);
+    assert.equal(second.status, 'already_migrated');
+    assert.equal(second.receipt_path, null);
+    assert.equal(await fs.readFile(configPath, 'utf8'), migratedConfig);
+    assert.deepEqual((await fs.readdir(path.dirname(first.receipt_path))).sort(), receiptEntries);
+    const rotatedAuth = authJson(rotatedOauthAccess, rotatedOauthRefresh);
+    await fs.writeFile(authPath, rotatedAuth, { mode: 0o600 });
+    await configureProviderCredential({
+        provider_id: 'codex-lb',
+        api_key: rotatedCodexLbKey,
+        host: codexLbEndpoint,
+        home,
+        processEnv: {}
+    });
+    await configureProviderCredential({
+        provider_id: 'openrouter',
+        api_key: rotatedOpenRouterKey,
+        home,
+        processEnv: { HOME: home },
+        openRouterPaths
+    });
+    const rollback = await rollbackDesktopBridgeUnificationReceipt({ receiptPath: first.receipt_path });
+    assert.equal(rollback.ok, true);
+    assert.equal(rollback.status, 'rolled_back');
+    assert.equal(rollback.credentials_overwritten, false);
+    assert.equal(rollback.auth_overwritten, false);
+    assert.equal(await fs.readFile(configPath, 'utf8'), historicalConfig);
+    await assert.rejects(fs.access(routePolicyPath));
+    await assert.rejects(fs.access(providerRegistryPath));
+    assert.equal(await fs.readFile(authPath, 'utf8'), rotatedAuth);
+    const rotatedCredentials = await resolveAllProviderCredentials({
+        codexLb: { home, processEnv: {} },
+        openrouter: { processEnv: { HOME: home }, openRouterPaths }
+    });
+    assert.equal(rotatedCredentials['codex-lb'].secret, rotatedCodexLbKey);
+    assert.equal(rotatedCredentials.openrouter.secret, rotatedOpenRouterKey);
+    assertSecretFree(await fs.readFile(first.receipt_path, 'utf8'), allFixtureSecrets);
+    const retiredCommand = normalizeCommand(['codex-lb', 'status']);
+    assert.equal(retiredCommand.command, null);
+    assert.equal(retiredCommand.aliasTarget, null);
+    assert.equal(Object.hasOwn(COMMAND_ALIASES_LITE, 'codex-lb'), false);
+    assert.equal(Object.hasOwn(COMMAND_MANIFEST_BY_NAME, 'codex-lb'), false);
+    emitGate('desktop-bridge:unification', {
+        evidence_kind: 'hermetic_fixture',
+        fixture: true,
+        real_execution: false,
+        real_evidence_claimed: false,
+        checks: {
+            dual_credentials_coexist: true,
+            serialized_metadata_secret_free: true,
+            historical_config_migration_idempotent: true,
+            rollback_preserves_rotated_credentials_and_oauth: true,
+            retired_codex_lb_command_unknown_without_alias: true,
+            fallback_route_absent: true
+        },
+        limitations: [
+            'Temporary-home fixture evidence only; this does not prove a live Codex Desktop or provider execution.'
+        ]
+    });
+}
+catch (error) {
+    failed = error;
+}
+finally {
+    await fs.rm(temporaryRoot, { recursive: true, force: true });
+}
+if (failed) {
+    const message = failed instanceof Error ? failed.message : String(failed);
+    console.error(JSON.stringify({
+        schema: 'sks.release-gate.v1',
+        ok: false,
+        gate: 'desktop-bridge:unification',
+        evidence_kind: 'hermetic_fixture',
+        fixture: true,
+        real_execution: false,
+        real_evidence_claimed: false,
+        blocker: message
+    }, null, 2));
+    process.exitCode = 1;
+}
+function authJson(accessToken, refreshToken) {
+    return `${JSON.stringify({
+        auth_mode: 'chatgpt',
+        account_id: 'fixture-desktop-account',
+        tokens: { access_token: accessToken, refresh_token: refreshToken }
+    }, null, 2)}\n`;
+}
+function assertSecretFree(text, secrets) {
+    assert.equal(text.includes('"secret"'), false);
+    for (const secret of secrets)
+        assert.equal(text.includes(secret), false);
+}

package/dist/scripts/doctor-fixes-codex-app-fast-ui-check.js

@@ -30,23 +30,27 @@ const unsafePlan = await repairCodexAppFastUi(unsafeRoot, { codexHome: unsafeCod
 const unsafeAfter = await fs.readFile(path.join(unsafeCodexHome, 'config.toml'), 'utf8');
 const ok = plan.fast_selector === 'manual_action_required'
     && plan.provider_selector === 'manual_action_required'
-    && plan.selected_provider_blockers.includes('codex_lb_api_key_missing')
-    && plan.selected_provider_blockers.includes('codex_lb_base_url_missing')
-    && plan.provider_actions.includes('sks codex-app set-openrouter-key --api-key-stdin')
-    && plan.provider_actions.includes('sks codex-lb setup --host <domain> --api-key-stdin --yes')
+    && plan.selected_provider_blockers.includes('bridge_active_route_not_selected')
+    && plan.selected_provider_blockers.includes('combined_catalog_active_generation_missing')
+    && plan.selected_provider_blockers.includes('bridge_route_policy_missing')
+    && plan.provider_actions.includes('sks bridge provider configure')
+    && plan.provider_actions.includes('sks bridge provider validate')
+    && plan.provider_actions.includes('sks bridge provider enable')
+    && plan.provider_actions.includes('sks bridge catalog sync')
+    && plan.provider_actions.includes('sks bridge route set-default')
     && plan.safe_auto_apply === true
     && repaired.fast_selector === 'repaired'
     && repaired.provider_selector === 'manual_action_required'
-    && repaired.selected_provider_blockers.includes('codex_lb_api_key_missing')
-    && repaired.selected_provider_blockers.includes('codex_lb_base_url_missing')
-    && repaired.selected_provider_blockers.includes('codex_lb_model_catalog_json_unselected')
+    && repaired.selected_provider_blockers.includes('bridge_active_route_not_selected')
+    && repaired.selected_provider_blockers.includes('combined_catalog_active_generation_missing')
+    && repaired.selected_provider_blockers.includes('bridge_route_policy_missing')
     && repaired.safe_auto_apply === true
     && backups.length >= 1
     && /^model\s*=\s*"future-codex-model"$/m.test(projectAfter.split(/\n\s*\[/)[0] || '')
     && /^model_reasoning_effort\s*=\s*"medium"$/m.test(projectAfter.split(/\n\s*\[/)[0] || '')
     && !/^model\s*=/m.test(homeTopLevel)
     && !/^model_reasoning_effort\s*=/m.test(homeTopLevel)
-    && /^model_provider\s*=\s*"codex-lb"$/m.test(homeTopLevel)
+    && !/^model_provider\s*=/m.test(homeTopLevel)
     && /model_provider\s*=\s*"codex-lb"/.test(projectAfter)
     && /^service_tier\s*=\s*"fast"$/m.test(homeTopLevel)
     && /fast_mode = false/.test(homeAfter)

package/dist/scripts/gate-policy-audit-check.js

@@ -18,8 +18,6 @@ const splitReviewFiles = [
     'src/core/recallpulse.ts'
 ];
 const policyCallsiteAllowlist = new Map([
-    ['codex_config_write|src/cli/install-helpers-codex-lb-selftest-chain.ts|runCodexLbLaunchChainSelftest|writeTextAtomic', 'isolated launch-chain selftest config'],
-    ['codex_config_write|src/cli/install-helpers-codex-lb-selftest.ts|selftestCodexLb|writeTextAtomic', 'isolated Codex LB selftest config'],
     ['mkdtemp|src/core/codex-control/codex-sdk-env-policy.ts|prepareNativeCodexAuthBridge|mkdtemp', 'identity-checked 0700 OAuth bridge root with explicit cleanup proof'],
     ['mkdtemp|src/core/mcp-config/codex-cli-adapter.ts|CodexMcpCliAdapter|mkdtemp', 'isolated official CLI transform HOME'],
     ['mkdtemp|src/core/perf/release-latency-slo.ts|runReleaseLatencySlo|mkdtemp', 'run-local latency fixture root'],
@@ -39,6 +37,7 @@ const directCodexConfigWrites = scanDirectCodexConfigWrites();
 const commandGateContract = scanCommandGateContract();
 const directMkdtempCalls = scanDirectMkdtempCalls();
 const rustTempdirCalls = scanRustTempdirCalls();
+const releaseEvidenceArchitecture = scanReleaseEvidenceArchitecture();
 const unusedPolicyCallsiteAllowlist = [...policyCallsiteAllowlist.keys()].filter((key) => !policyCallsiteAllowlistHits.has(key));
 if (releaseGates.length > 200)
     blockers.push(`release_preset_gate_budget_exceeded:${releaseGates.length}`);
@@ -61,6 +60,8 @@ if (directMkdtempCalls.length)
     blockers.push(`direct_mkdtemp_callsite:${directMkdtempCalls[0].file}:${directMkdtempCalls[0].line}`);
 if (rustTempdirCalls.length)
     blockers.push(`rust_tempdir_without_raii:${rustTempdirCalls[0].file}:${rustTempdirCalls[0].line}`);
+if (!releaseEvidenceArchitecture.ok)
+    blockers.push(`release_evidence_architecture:${releaseEvidenceArchitecture.issues[0]}`);
 if (unusedPolicyCallsiteAllowlist.length)
     blockers.push(`unused_policy_callsite_allowlist:${unusedPolicyCallsiteAllowlist[0]}`);
 for (const row of splitReviewLineCounts) {
@@ -82,8 +83,57 @@ const result = {
     direct_mkdtemp_callsites: directMkdtempCalls.slice(0, 20),
     policy_callsite_allowlist: { used: policyCallsiteAllowlistHits.size, unused: unusedPolicyCallsiteAllowlist },
     rust_tempdir_raii: { ok: rustTempdirCalls.length === 0, direct_tempdir_callsites: rustTempdirCalls.slice(0, 20) },
+    release_evidence_architecture: releaseEvidenceArchitecture,
     blockers
 };
+function scanReleaseEvidenceArchitecture() {
+    const issues = [];
+    const recovery = gates.find((gate) => gate.id === 'test:codex-runtime-recovery');
+    const recoveryInputs = Array.isArray(recovery?.cache?.inputs) ? recovery.cache.inputs.map(String) : [];
+    if (!recoveryInputs.includes('src/commands/bridge.ts'))
+        issues.push('recovery_cache_missing_active_bridge_command');
+    if (recoveryInputs.includes('src/commands/codex-lb.ts'))
+        issues.push('recovery_cache_references_retired_bridge_command');
+    const runtime = fs.readFileSync(path.join(root, 'runtime-required-scripts.json'), 'utf8');
+    const packageJson = fs.readFileSync(path.join(root, 'package.json'), 'utf8');
+    const manifest = fs.readFileSync(path.join(root, 'release-gates.v2.json'), 'utf8');
+    const retiredCatalogScript = 'codex-lb-catalog-passthrough-check.js';
+    if ([runtime, packageJson, manifest].some((text) => text.includes(retiredCatalogScript)))
+        issues.push('retired_catalog_passthrough_reference_present');
+    if (!runtime.includes('dist/scripts/release-physical-gates-check.js'))
+        issues.push('physical_gate_validator_missing_from_runtime_closure');
+    if (!packageJson.includes('release-physical-gates-check.js'))
+        issues.push('physical_gate_validator_missing_from_package_files');
+    const realCheck = fs.readFileSync(path.join(root, 'src', 'scripts', 'release-real-check.ts'), 'utf8');
+    if (!/nodeScript\(\s*['"]release-physical-gates-check\.js['"]/.test(realCheck)
+        || !realCheck.includes("'sks.release-physical-gates-inspection.v2'"))
+        issues.push('release_real_check_not_bound_to_physical_inspection');
+    const workflow = fs.readFileSync(path.join(root, '.github', 'workflows', 'publish-npm.yml'), 'utf8');
+    const linux = workflow.slice(workflow.indexOf('  linux-release-proof:'), workflow.indexOf('  macos-menubar-proof:'));
+    const macos = workflow.slice(workflow.indexOf('  macos-menubar-proof:'), workflow.indexOf('  pack-and-compare:'));
+    if (linux.includes('release-physical-gates-check.js') || linux.includes('release:check:full'))
+        issues.push('linux_claims_macos_release_evidence');
+    const macosProofSequence = [
+        'npm run build:clean --silent',
+        'npm run test:release --silent',
+        'release-gate-dag-runner.js --preset release --full',
+        'release-physical-gates-check.js',
+        'release-real-check.js --skip-release-check',
+        'release-check-stamp.js write'
+    ];
+    const macosProofPositions = macosProofSequence.map((required) => macos.indexOf(required));
+    for (const required of macosProofSequence) {
+        if (!macos.includes(required))
+            issues.push(`macos_release_evidence_step_missing:${required}`);
+    }
+    if (macosProofPositions.every((position) => position >= 0)
+        && macosProofPositions.some((position, index) => index > 0 && position <= macosProofPositions[index - 1])) {
+        issues.push('macos_release_evidence_sequence_invalid');
+    }
+    if (!workflow.includes('--require-physical-proof'))
+        issues.push('main_push_guard_does_not_require_physical_proof');
+    return { ok: issues.length === 0, issues, recovery_cache_inputs: recoveryInputs };
+}
 console.log(JSON.stringify(result, null, 2));
 if (!result.ok)
     process.exit(1);

package/dist/scripts/provider-badge-context-check.js

@@ -2,22 +2,65 @@
 import fs from 'node:fs/promises';
 import os from 'node:os';
 import path from 'node:path';
-import { providerBadgeText } from '../core/provider/provider-badge.js';
+import { providerBadgeText, providerPaneLabel } from '../core/provider/provider-badge.js';
 import { resolveProviderContext } from '../core/provider/provider-context.js';
-const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-provider-context-'));
+const root = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-provider-badge-'));
 const codexHome = path.join(root, '.codex-home');
 await fs.mkdir(codexHome, { recursive: true });
 await fs.writeFile(path.join(codexHome, 'auth.json'), '{"account_id":"acct_fixture"}\n');
-const openai = await resolveProviderContext({ root, codexHome, env: { OPENAI_API_KEY: 'sk-fixture', HOME: root }, route: '$Naruto', serviceTier: 'fast' });
-const lb = await resolveProviderContext({ root, codexHome, env: { CODEX_LB_API_KEY: 'lb-fixture', SKS_PROVIDER: 'codex-lb', HOME: root }, route: '$Naruto', serviceTier: 'fast' });
-const app = await resolveProviderContext({ root, codexHome, env: { HOME: root }, route: '$Naruto', serviceTier: 'standard' });
-const conflict = await resolveProviderContext({ root, codexHome, env: { OPENAI_API_KEY: 'sk-fixture', CODEX_LB_API_KEY: 'lb-fixture', HOME: root } });
-const ok = openai.provider === 'openai'
-    && lb.provider === 'codex-lb'
-    && app.provider === 'codex-app'
-    && conflict.conflict
-    && providerBadgeText(lb) === 'Provider: codex-lb · Fast';
-emit({ schema: 'sks.provider-badge-context-check.v1', ok, openai, lb, app, conflict, blockers: ok ? [] : ['provider_badge_context_check_failed'] });
+const bridge = await resolveProviderContext({
+    root,
+    codexHome,
+    env: { HOME: root, CODEX_LB_API_KEY: 'lb-fixture' },
+    route: '$Naruto',
+    serviceTier: 'fast',
+    desktopBridgeStatus: bridgeStatus('codex-lb')
+});
+const openai = await resolveProviderContext({
+    root,
+    codexHome,
+    env: { OPENAI_API_KEY: 'sk-fixture', HOME: root },
+    serviceTier: 'fast',
+    desktopBridgeStatus: unmanagedStatus()
+});
+const app = await resolveProviderContext({
+    root,
+    codexHome,
+    env: { HOME: root },
+    serviceTier: 'standard',
+    desktopBridgeStatus: unmanagedStatus()
+});
+const checks = {
+    bridge_badge: providerBadgeText(bridge) === 'Provider: Desktop Bridge → codex-lb · Fast',
+    bridge_pane: providerPaneLabel(bridge) === 'fast · desktop-bridge/codex-lb',
+    openai_badge: providerBadgeText(openai) === 'Provider: OpenAI API · Fast',
+    oauth_badge: providerBadgeText(app) === 'Provider: Codex App OAuth · Standard'
+};
+const ok = Object.values(checks).every(Boolean);
+emit({ schema: 'sks.provider-badge-context-check.v2', ok, checks, bridge, openai, app, blockers: ok ? [] : ['provider_badge_context_check_failed'] });
+function bridgeStatus(provider) {
+    return {
+        schema: 'sks.desktop-bridge-status.v3',
+        management: { managed: true, runtime: 'desktop-bridge', state: 'ready', reason: null },
+        native_identity: { configured: true },
+        providers: {
+            'codex-lb': { credential: { state: provider === 'codex-lb' ? 'ready' : 'not_configured' } },
+            openrouter: { credential: { state: provider === 'openrouter' ? 'ready' : 'not_configured' } }
+        },
+        routing: { policy: { default_provider_id: provider }, selected_route: null, session_pin: null, blockers: [] },
+        readiness: { ready: true, blockers: [] }
+    };
+}
+function unmanagedStatus() {
+    return {
+        schema: 'sks.desktop-bridge-status.v3',
+        management: { managed: false, runtime: null, state: 'not_installed', reason: 'never_configured' },
+        native_identity: { configured: true },
+        providers: {},
+        routing: { policy: null, selected_route: null, session_pin: null, blockers: [] },
+        readiness: { ready: false, blockers: [] }
+    };
+}
 function emit(report) {
     console.log(JSON.stringify(report, null, 2));
     if (!report.ok)

package/dist/scripts/publish-preflight.js

@@ -3,10 +3,9 @@ import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { inspectPublishPreflight } from '../core/release/publish-preflight.js';
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
-const dryRun = ['1', 'true'].includes(String(process.env.npm_config_dry_run || process.env.NPM_CONFIG_DRY_RUN || '').toLowerCase());
 const report = inspectPublishPreflight({
     root,
-    requireReleaseTag: !dryRun,
+    requireReleaseTag: false,
     requirePhysicalReleaseGates: false,
 });
 console.log(JSON.stringify(report, null, 2));

package/dist/scripts/release-affected-selector-check.js

@@ -46,12 +46,11 @@ const officialSubagentOnly = selectorMod.selectAffectedReleaseGates(root, manife
 const officialSubagentIds = new Set(officialSubagentOnly.selection.selected_gate_ids.map(String));
 assertGate(officialSubagentIds.has('naruto:canonical-stop-gate'), 'official subagent source changes must select the canonical Naruto stop gate', officialSubagentOnly.selection);
 for (const changedFile of [
-    'src/core/codex-lb/codex-lb-tool-output-recovery.ts',
+    'src/core/codex-control/desktop-bridge-launch-guard.ts',
     'src/core/codex/codex-cli-update.ts',
     'src/core/codex-control/codex-reliability-shield.ts',
     'src/core/hooks-runtime.ts',
     'src/commands/codex.ts',
-    'src/commands/codex-lb.ts',
     'src/commands/doctor.ts',
     'src/core/preflight/parallel-preflight-engine.ts'
 ]) {

package/dist/scripts/release-aggressive-resource-governor-check.js

@@ -6,7 +6,7 @@ const governor = await importDist('core/release/release-gate-resource-governor.j
 const budget = governor.defaultReleaseGateBudget();
 assertGate(budget['cpu-light'] >= 1 && budget['cpu-light'] <= 4, 'resource governor env requests must not raise the desktop-safe cpu-light cap', budget);
 assertGate(governor.defaultReleaseGateMaxTotal() >= 1 && governor.defaultReleaseGateMaxTotal() <= 4, 'resource governor default total cap must stay desktop-safe', { max_total: governor.defaultReleaseGateMaxTotal() });
-const gate = (id) => ({ id, resource: ['cpu-light'], deps: [], command: 'true', side_effect: 'hermetic', timeout_ms: 1000, cache: { enabled: false, inputs: [] }, isolation: { report_dir: 'per-gate' }, preset: ['release'] });
+const gate = (id) => ({ id, resource: ['cpu-light'], deps: [], command: 'true', side_effect: 'hermetic', timeout_ms: 1000, output_contract: 'sks.gate-result.v2', cache: { enabled: false, inputs: [] }, isolation: { report_dir: 'per-gate' }, preset: ['release'] });
 const fsGate = (id) => ({ ...gate(id), resource: ['fs-read'] });
 const timingGate = (id) => ({ ...gate(id), resource: ['timing-sensitive'] });
 const picked = governor.pickLaunchableReleaseGates({ ready: [gate('a'), gate('b'), gate('c')], running: [], budget });

package/dist/scripts/release-cache-glob-hashing-check.js

@@ -17,6 +17,7 @@ const gate = {
     resource: ['cpu-light'],
     side_effect: 'hermetic',
     timeout_ms: 1000,
+    output_contract: 'sks.gate-result.v2',
     cache: { enabled: true, inputs: ['src/core/release/**'] },
     isolation: { home: 'temp', codex_home: 'temp', report_dir: 'per-gate' },
     preset: ['release']

package/dist/scripts/release-cache-version-neutral-fixture-check.js

@@ -11,6 +11,7 @@ const gate = {
     resource: ['cpu-light'],
     side_effect: 'hermetic',
     timeout_ms: 1000,
+    output_contract: 'sks.gate-result.v2',
     cache: { enabled: true, inputs: ['package.json', 'package-lock.json', 'src/**', 'dist/build-manifest.json'] },
     isolation: { home: 'temp', codex_home: 'temp', report_dir: 'per-gate' },
     preset: ['release']

package/dist/scripts/release-full-parallelism-blackbox.js

@@ -6,7 +6,7 @@ import { performance } from 'node:perf_hooks';
 import { runReleaseGateBatch } from '../core/release/release-gate-batch-runner.js';
 import { assertGate, emitGate, root } from './gate-lib.js';
 const reportRoot = await fs.mkdtemp(path.join(os.tmpdir(), 'sks-release-full-'));
-const gates = Array.from({ length: 80 }, (_, i) => ({ id: `synthetic:${i + 1}`, command: `${process.execPath} -e \"setTimeout(()=>process.exit(0),1000)\"`, deps: [], resource: ['cpu-light', 'fs-read'], side_effect: 'hermetic', timeout_ms: 15000, cache: { enabled: false, inputs: [] }, isolation: { home: 'temp', codex_home: 'temp', report_dir: 'per-gate' }, preset: ['release'] }));
+const gates = Array.from({ length: 80 }, (_, i) => ({ id: `synthetic:${i + 1}`, command: `${process.execPath} -e \"setTimeout(()=>process.exit(0),1000)\"`, deps: [], resource: ['cpu-light', 'fs-read'], side_effect: 'hermetic', timeout_ms: 15000, output_contract: 'sks.gate-result.v2', cache: { enabled: false, inputs: [] }, isolation: { home: 'temp', codex_home: 'temp', report_dir: 'per-gate' }, preset: ['release'] }));
 const started = performance.now();
 const result = await runReleaseGateBatch(root, gates, { concurrency: 40, reportRoot });
 const wallMs = Math.max(1, Math.round(performance.now() - started));

package/dist/scripts/release-gate-batch-runner-check.js

@@ -13,6 +13,7 @@ const base = {
     resource: ['cpu-light', 'fs-read'],
     side_effect: 'hermetic',
     timeout_ms: 30000,
+    output_contract: 'sks.gate-result.v2',
     cache: { enabled: false, inputs: [] },
     isolation: { home: 'temp', codex_home: 'temp', report_dir: 'per-gate' },
     preset: ['release']
@@ -27,6 +28,11 @@ const envProofScript = [
 ].join(';');
 const passGate = { ...base, id: 'batch:pass', command: `${process.execPath} -e ${JSON.stringify(envProofScript)}` };
 const failGate = { ...base, id: 'batch:fail', command: `${process.execPath} -e "process.exit(7)"` };
+const contractFailGate = {
+    ...base,
+    id: 'batch:contract-fail',
+    command: `${process.execPath} -e ${JSON.stringify("console.log(JSON.stringify({schema:'sks.gate-result.v2',contract_mode:'strict',ok:false,blockers:['batch_child_blocker']}))")}`
+};
 const timeoutGate = { ...base, id: 'batch:timeout', timeout_ms: 50, command: `${process.execPath} -e "process.on('SIGTERM', () => {}); setInterval(() => {}, 1000)"` };
 const browserGate = { ...base, id: 'batch:browser-real', resource: ['browser-real'], side_effect: 'real-env', command: `${process.execPath} -e "process.exit(0)"` };
 assertGate(batch.isReleaseGateBatchable(passGate) === true, 'hermetic cpu-light fs-read gate must be batchable');
@@ -36,6 +42,9 @@ assertGate(result.ok === false && result.failed === 1, 'one failed child gate mu
 assertGate(result.results.some((row) => row.id === 'batch:fail' && row.ok === false && row.exit_code === 7), 'batch result must report exact failed child id', result);
 assertGate(fs.existsSync(path.join(reportRoot, 'batch-pass', 'result.json')) && fs.existsSync(path.join(reportRoot, 'batch-fail', 'result.json')), 'batch runner must preserve individual result JSON files');
 assertGate(result.results.some((row) => row.id === 'batch:pass' && row.ok === true), 'batch runner must execute children with hermetic release-gate environment', result);
+assertGate(result.results.every((row) => row.output_contract === 'sks.gate-result.v2' && row.gate_result?.contract_mode === 'strict'), 'batch children must publish the strict current gate-result contract', result);
+const contractFailResult = await batch.runReleaseGateBatch(root, [contractFailGate], { concurrency: 1, reportRoot });
+assertGate(contractFailResult.ok === false && contractFailResult.results[0]?.gate_result?.blockers?.includes('batch_child_blocker'), 'strict child ok:false must fail the batch even with exit zero', contractFailResult);
 const timeoutResult = await batch.runReleaseGateBatch(root, [timeoutGate], { concurrency: 1, reportRoot });
 assertGate(timeoutResult.results.some((row) => row.id === 'batch:timeout' && row.ok === false && row.exit_code === 124 && row.timed_out === true), 'batch runner must report timed-out child process trees explicitly', timeoutResult);
 assertGate(timeoutResult.results.some((row) => row.id === 'batch:timeout' && row.duration_ms >= 1400), 'batch runner must wait for timed-out process tree hard-kill cleanup before resolving', timeoutResult);

package/dist/scripts/release-gate-dag-runner-check.js

@@ -10,6 +10,7 @@ const runnerCli = readText('src/scripts/release-gate-dag-runner.ts');
 const hermeticEnv = readText('src/core/release/release-gate-hermetic-env.ts');
 const scheduler = readText('src/core/release/release-gate-scheduler.ts');
 const cache = readText('src/core/release/release-gate-cache-v2.ts');
+const retiredContractNoteField = ['contract', 'note'].join('_');
 const releaseCheck = String(pkg.scripts['release:check'] || '');
 const delegatedReleaseCheck = releaseCheck.match(/^npm run ([^\s&]+)(?:\s+--silent)?$/)?.[1];
 const effectiveReleaseCheck = delegatedReleaseCheck ? String(pkg.scripts[delegatedReleaseCheck] || '') : releaseCheck;
@@ -19,6 +20,7 @@ assertGate(!/&&\s*npm run\s+\w/.test(effectiveReleaseCheck.replace('npm run buil
 assertGate(!pkg.scripts['release:check:legacy'], 'retired release:check:legacy alias must stay removed');
 assertGate(pkg.scripts['release:real-check'] === 'node ./dist/scripts/release-real-check.js', 'release:real-check must expose the canonical environment-dependent proof runner');
 assertGate(manifest.schema === 'sks.release-gates.v2' && manifest.gates.length >= 10, 'release-gates.v2 manifest must exist with nodes', manifest);
+assertGate(manifest.gates.every((row) => row.output_contract === 'sks.gate-result.v2' && !Object.hasOwn(row, retiredContractNoteField)), 'every release gate must declare only the strict current output contract', manifest.gates.filter((row) => row.output_contract !== 'sks.gate-result.v2' || Object.hasOwn(row, retiredContractNoteField)).map((row) => row.id));
 for (const gateId of [
     'scheduler:comprehensive',
     'doctor:fix-proves-codex-read',
@@ -33,6 +35,8 @@ assertGate(runner.includes('readReleaseGateCacheRecord') && cache.includes('dura
 assertGate(runner.includes('cpu_time_saved_ms') && runner.includes('peak_running') && runner.includes('budget_snapshot'), 'DAG summary must include CPU time saved, peak running gates, and resource budget proof');
 assertGate(runner.includes('sks.five-minute-completion-certificate.v1') && runner.includes('sks.affected-gate-graph.v1') && cache.includes('releaseGateProofBankFile'), 'DAG runner must emit completion certificates, affected graph, and proof-bank cache path');
 assertGate(runner.includes('detached: process.platform') && runner.includes('killGateProcessTree') && runner.includes('timed_out'), 'DAG runner must kill timed-out gate process trees and record timeout evidence');
+assertGate(runner.includes('normalizeReleaseGateOutput') && runner.includes('gate_result: normalized.gate_result'), 'DAG runner must normalize and verify every child through the strict gate-result contract');
+assertGate(runnerCli.includes('GATE_RESULT_CONTRACT_MODE') && runnerCli.includes('contract_mode: GATE_RESULT_CONTRACT_MODE'), 'DAG CLI must emit the strict current gate-result contract');
 assertGate(runner.includes('pruneOldReleaseGateRunDirs') && runner.includes('SKS_RELEASE_GATE_RUN_RETENTION'), 'DAG runner must prune stale release-gate run reports before they exhaust local disk');
 assertGate(runnerCli.includes('ensureCurrentMigrationBeforeCommand') && runnerCli.includes('release-gate-runner-preflight'), 'DAG runner CLI must self-heal project migration before hermetic gates run');
 assertGate(hermeticEnv.includes('SKS_UPDATE_MIGRATION_GATE_DISABLED'), 'hermetic release gates must not rewrite project migration receipts from temporary HOME roots');
@@ -51,6 +55,7 @@ await fsx.writeJsonAtomic(path.join(fixtureRoot, 'release-gates.v2.json'), {
             resource: ['cpu-light', 'fs-read'],
             side_effect: 'hermetic',
             timeout_ms: 50,
+            output_contract: 'sks.gate-result.v2',
             cache: { enabled: false, inputs: [] },
             isolation: { home: 'temp', codex_home: 'temp', report_dir: 'per-gate' },
             preset: ['release']
@@ -74,6 +79,7 @@ await fsx.writeJsonAtomic(path.join(cacheRoot, 'release-gates.v2.json'), {
             resource: ['cpu-light', 'fs-read'],
             side_effect: 'hermetic',
             timeout_ms: 5000,
+            output_contract: 'sks.gate-result.v2',
             cache: { enabled: true, inputs: [] },
             isolation: { home: 'temp', codex_home: 'temp', report_dir: 'per-gate' },
             preset: ['release']