sneakoscope 8.1.2 → 8.2.0

package/dist/scripts/release-gate-dag-runner.js

@@ -6,6 +6,7 @@ import { runReleaseGateDag } from '../core/release/release-gate-dag.js';
 import { releaseAuthorizationSnapshot } from '../core/release/release-authorization-snapshot.js';
 import { ensureDistFresh } from './lib/ensure-dist-fresh.js';
 import { ensureCurrentMigrationBeforeCommand } from '../core/update/update-migration-state.js';
+import { GATE_RESULT_CONTRACT, GATE_RESULT_CONTRACT_MODE } from '../core/commands/gate-result-contract.js';
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 process.env.SKS_RELEASE_GATE_CACHE_MEMOIZE ||= '1';
 const freshness = ensureDistFresh({ rebuild: false });
@@ -78,7 +79,8 @@ console.log(`SKS Release DAG
   certificate: ${result.completion_certificate.confidence} sla=${(result.completion_certificate.sla_ms / 1000).toFixed(0)}s met=${result.completion_certificate.sla_met}
   report: ${result.report_dir}`);
 const gateResult = {
-    schema: 'sks.gate-result.v1',
+    schema: GATE_RESULT_CONTRACT,
+    contract_mode: GATE_RESULT_CONTRACT_MODE,
     ok: result.ok === true,
     blockers: result.ok ? [] : result.failures.map((failure) => `release_gate_failed:${failure.id}`),
     summary: {
@@ -99,7 +101,7 @@ if (!result.ok) {
 }
 function failRunner(blocker) {
     console.error(`SKS Release DAG blocked: ${blocker}`);
-    console.log(JSON.stringify({ schema: 'sks.gate-result.v1', ok: false, blockers: [blocker] }));
+    console.log(JSON.stringify({ schema: GATE_RESULT_CONTRACT, contract_mode: GATE_RESULT_CONTRACT_MODE, ok: false, blockers: [blocker] }));
     process.exit(1);
 }
 function parseDurationMs(value) {

package/dist/scripts/release-metadata-check.js

@@ -118,6 +118,9 @@ for (const script of requiredPackageScripts)
 const fullReleaseScript = String(pkg.scripts?.['release:check:full'] || '');
 assertGate((fullReleaseScript.match(/build:clean/g) || []).length === 1, 'release:check:full must perform exactly one clean build', { script: fullReleaseScript });
 assertGate((fullReleaseScript.match(/npm run test:release --silent/g) || []).length === 1, 'release:check:full must run the release test corpus exactly once', { script: fullReleaseScript });
+assertGate((fullReleaseScript.match(/release-pack-receipt\.js create/g) || []).length === 1, 'release:check:full must create the current clean-HEAD pack receipt exactly once', { script: fullReleaseScript });
+const fullReleaseOrder = ['release-gate-dag-runner.js --preset release --full', 'release-pack-receipt.js create', 'release-real-check.js --skip-release-check', 'release-check-stamp.js write'].map((needle) => fullReleaseScript.indexOf(needle));
+assertGate(fullReleaseOrder.every((index) => index >= 0) && fullReleaseOrder.every((index, position) => position === 0 || index > fullReleaseOrder[position - 1]), 'release:check:full must create pack proof after the DAG and before real-check/stamp', { script: fullReleaseScript });
 assertGate(pkg.scripts?.test === 'node ./dist/scripts/canonical-test-runner.js --all' && pkg.scripts?.['test:all'] === pkg.scripts?.test, 'npm test and test:all must preserve the exhaustive developer corpus');
 assertGate(pkg.scripts?.['test:release'] === 'node ./dist/scripts/canonical-test-runner.js', 'test:release must use the proof-producing release corpus selector');
 for (const id of requiredReleaseGates)
@@ -175,17 +178,22 @@ assertGate(!/npm\s+stage\s+(?:list|view|download|approve|reject)\b/.test(stageWo
 assertGate(/environment: npm-production/.test(stageWorkflow), 'stage workflow must use the npm-production environment');
 assertGate(!/id-token:/.test(workflowPermissions), 'workflow-global permissions must not grant OIDC identity');
 assertGate((stageWorkflow.match(/id-token: write/g) || []).length === 1 && /permissions:\n      contents: read\n      id-token: write/.test(stageJob), 'OIDC identity must be scoped only to stage-publish');
-for (const artifact of ['linux-release-proof', 'macos-menubar-proof', 'stage-input', 'npm-stage-receipt']) {
+for (const artifact of ['linux-release-proof', 'macos-menubar-proof']) {
     assertGate(new RegExp(`name: ${artifact}-\\$\\{\\{ github\\.sha \\}\\}`).test(stageWorkflow), `stage workflow artifact name mismatch: ${artifact}`);
 }
-for (const receiptField of ['tarball_sha256', 'tarball_sha512', 'tarball_integrity', 'packed_bytes', 'unpacked_bytes', 'file_count', 'workflow_run_id', 'local_pack_receipt_sha256', 'stage_command_digest', 'stage_output_digest', 'stage_id', 'review_verifier_schema', 'human_2fa_pending']) {
+for (const artifact of ['stage-input', 'npm-stage-receipt']) {
+    assertGate(new RegExp(`name: ${artifact}-\\$\\{\\{ github\\.sha \\}\\}-\\$\\{\\{ inputs\\.dispatch_nonce \\}\\}`).test(stageWorkflow), `stage workflow artifact name mismatch: ${artifact}`);
+}
+for (const receiptField of ['tarball_sha256', 'tarball_sha512', 'tarball_integrity', 'packed_bytes', 'unpacked_bytes', 'file_count', 'dispatch_nonce', 'physical_evidence_run_id', 'workflow_run_id', 'local_pack_receipt_sha256', 'stage_command_digest', 'stage_output_digest', 'stage_id', 'review_verifier_schema', 'human_2fa_pending']) {
     assertGate(new RegExp(`${receiptField}:`).test(stageJob), `stage receipt missing field: ${receiptField}`);
 }
 assertGate(/stage_id_uuid_invalid/.test(stageJob), 'stage workflow must fail closed on non-UUID stage IDs');
 assertGate(/sha512Integrity !== receipt\.sha512_integrity/.test(stageJob), 'stage workflow must recompute and verify tarball SHA-512 integrity');
 assertGate(/tarball_integrity: sha512Integrity/.test(stageJob), 'stage receipt must serialize recomputed tarball integrity');
 assertGate(/stage-receipt\/stage-output\.json/.test(stageJob) && /path: stage-receipt/.test(stageJob), 'stage receipt artifact must preserve digest-bound raw stage output');
-assertGate(/review_verifier_schema: 'sks\.npm-stage-review-receipt\.v1'/.test(stageJob), 'stage receipt must declare the maintainer verifier schema');
+assertGate(/schema: 'sks\.npm-stage-receipt\.v2'/.test(stageJob), 'stage receipt must use the nonce-bound v2 contract');
+assertGate(/review_verifier_schema: 'sks\.npm-stage-review-receipt\.v2'/.test(stageJob), 'stage receipt must declare the maintainer verifier schema');
+assertGate(/^run-name: npm-stage-\$\{\{ inputs\.version \}\}-\$\{\{ inputs\.dispatch_nonce \}\}-physical-\$\{\{ inputs\.physical_evidence_run_id \}\}$/m.test(stageWorkflow), 'stage workflow run name must bind version, dispatch nonce, and physical evidence run');
 assertGate(/localPackReceiptSha256 = crypto\.createHash\('sha256'\)\.update\(localPackReceiptBytes\)/.test(stageJob), 'stage receipt must bind immutable local pack receipt bytes');
 assertGate(/smoke\.postinstall_default\?\.scripts_enabled !== true/.test(stageJob), 'stage job must require scripts-enabled default postinstall proof');
 assertGate(/smoke\.postinstall_default\?\.external_snapshot_match !== true/.test(stageJob), 'stage job must require zero external postinstall mutation');
@@ -195,6 +203,8 @@ assertGate(!/\bnpm[ \t]+(?:ci|pack|run|publish|login|logout|whoami)\b/.test(stag
 assertGate(!/NODE_AUTH_TOKEN|NPM_TOKEN|_authToken/.test(stageWorkflow), 'stage workflow must not inject npm tokens');
 assertGate(/from '\.\/npm-stage-contract\.js'/.test(stageVerifierSupport), 'maintainer stage verifier support must use the shared npm stage contract');
 assertGate(/exactNpmStageCliInvocation\(\)/.test(stageVerifierSource), 'maintainer stage verifier must resolve the exact pinned npm CLI');
+assertGate(/dispatch_nonce_mismatch/.test(stageVerifierSupport) && /physical_evidence_run_id_mismatch/.test(stageVerifierSupport) && /workflow_run_id_mismatch/.test(stageVerifierSupport), 'maintainer stage verifier must validate exact workflow association');
+assertGate(/--dispatch-nonce/.test(stageVerifierCli) && /--physical-evidence-run-id/.test(stageVerifierCli) && /--workflow-run-id/.test(stageVerifierCli), 'maintainer stage verifier CLI must require workflow association inputs');
 assertGate(/\['stage', 'view', stageId, '--json'/.test(stageVerifierSource), 'maintainer stage verifier must inspect the exact stage ID read-only');
 assertGate(/\['stage', 'download', stageId, '--json'/.test(stageVerifierSource), 'maintainer stage verifier must download the exact stage ID read-only');
 assertGate(/exact_bytes_match/.test(stageVerifierSource) && /sha256_match/.test(stageVerifierSource) && /sha512_match/.test(stageVerifierSource) && /integrity_match/.test(stageVerifierSource), 'maintainer stage verifier must compare bytes and digests');
@@ -202,12 +212,15 @@ assertGate(/oidc_environment_not_allowed/.test(stageContract), 'maintainer stage
 assertGate(/local_review_verifier/.test(stagePublishSource), 'confirmed stage preflight must require the local review verifier');
 assertGate(/localNpmStageReviewEnvironmentBlocker/.test(stagePublishSource), 'confirmed stage preflight must reject CI and OIDC review environments');
 assertGate(/exactNpmStageCliInvocation\(\)/.test(stagePublishSource), 'confirmed stage preflight must resolve the pinned npm CLI before mutation');
+assertGate(/crypto\.randomBytes\(16\)\.toString\('hex'\)/.test(stagePublishSource), 'stage dispatch must use a cryptographic 128-bit nonce');
+assertGate(/displayTitle/.test(stagePublishSource) && /expectedDisplayTitle/.test(stagePublishSource), 'stage workflow selection must bind the exact nonce-scoped run title');
 assertGate(/if \(!preflight\.ok\) return finish\(\)/.test(stagePublishSource), 'stage preflight failures must stop before push or dispatch');
 assertGate(!/\['stage',\s*'(?:publish|approve|reject)'/.test(`${stageVerifierSource}\n${stageVerifierSupport}\n${stageVerifierCli}`), 'maintainer stage verifier must not contain mutating stage argv');
 assertGate(/npx --yes npm@11\.15\.0/.test(releaseReadinessDoc), 'release readiness must document pinned local npm stage resolution');
 assertGate(/npm-stage-tarball-verifier\.js/.test(releaseReadinessDoc) && /--local-receipt/.test(releaseReadinessDoc) && /--local-tarball/.test(releaseReadinessDoc) && /--stage-receipt/.test(releaseReadinessDoc), 'release readiness must document the maintainer-local read-only verifier inputs');
 assertGate(/release-physical-gates-check\.js/.test(stageWorkflow), 'stage workflow must verify tracked source-bound physical release receipts before staging');
 assertGate(/release-physical-gates-check\.js/.test(stagePublishSource), 'local stage preflight must verify physical release receipts before mutation');
+assertGate(/requireReleaseTag:\s*false/.test(text('src/scripts/publish-preflight.ts')), 'direct npm publish preflight must allow the Git release tag to be created after publication');
 assertGate(/requirePhysicalReleaseGates:\s*false/.test(text('src/scripts/publish-preflight.ts')), 'direct npm publish preflight must not require physical receipts (stage/CI owns that gate)');
 assertGate(/PHYSICAL_RELEASE_GATE_IDS/.test(physicalReleaseGateSource) && /artifact_sha256/.test(physicalReleaseGateSource), 'physical release gate contract must bind all required gates to evidence artifact hashes');
 assertGate(pkg.scripts?.prepublishOnly === 'node ./dist/scripts/prepublish-release-check-or-fast.js', 'prepublishOnly must verify release proof during official npm publish');

package/dist/scripts/release-pack-receipt.js

@@ -5,7 +5,7 @@ import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
-import { compareReleasePacks, inspectReleaseTarball, releaseProofDir, validateLocalReleasePackBinding, writeReleaseJson } from '../core/release/release-pack-receipt.js';
+import { compareReleasePacks, inspectLocalReleaseSourceState, inspectReleaseTarball, releaseProofDir, validateLocalReleasePackBinding, writeReleaseJson } from '../core/release/release-pack-receipt.js';
 import { normalizeNpmPackInfo, readCurrentNpmPackGateArtifacts } from '../core/release/npm-pack-proof.js';
 const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
 const action = process.argv[2] || 'create';
@@ -13,6 +13,8 @@ const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'))
 const proofDir = releaseProofDir(root, String(pkg.version || 'unknown'));
 if (action === 'create')
     createLocalReceipt();
+else if (action === 'verify')
+    verifyLocalReceipt();
 else if (action === 'inspect')
     inspectDownloadedReceipt();
 else if (action === 'compare')
@@ -20,6 +22,9 @@ else if (action === 'compare')
 else
     fail(`unknown action: ${action}`);
 function createLocalReceipt() {
+    const sourceBeforePack = inspectLocalReleaseSourceState(root);
+    if (!sourceBeforePack.ok)
+        fail('source tree is not clean and fully tracked for npm pack', sourceBeforePack.blockers.join('\n'));
     const outputDir = path.resolve(root, option('--output-dir') || path.join(proofDir, 'artifacts'));
     fs.mkdirSync(outputDir, { recursive: true });
     const result = spawnSync('npm', ['pack', '--ignore-scripts', '--json', '--pack-destination', outputDir], {
@@ -43,7 +48,7 @@ function createLocalReceipt() {
     const receipt = inspectReleaseTarball({
         tarball,
         kind: 'local',
-        sourceCommit: gitHead(),
+        sourceCommit: sourceBeforePack.head,
         root,
         ...(gate.ok && gate.proof ? {
             npmPackProof: {
@@ -74,6 +79,13 @@ function createLocalReceipt() {
         receipt.blockers.push('pack_metadata_file_count_mismatch');
     if (String(info?.integrity || '') !== receipt.sha512_integrity)
         receipt.blockers.push('pack_metadata_integrity_mismatch');
+    const sourceAfterPack = inspectLocalReleaseSourceState(root);
+    if (!sourceAfterPack.ok)
+        receipt.blockers.push(...sourceAfterPack.blockers.map((blocker) => `post_pack_source:${blocker}`));
+    if (sourceAfterPack.head !== sourceBeforePack.head)
+        receipt.blockers.push('post_pack_source_commit_changed');
+    if (sourceAfterPack.source_tree_sha256 !== sourceBeforePack.source_tree_sha256)
+        receipt.blockers.push('post_pack_source_tree_digest_changed');
     receipt.ok = receipt.blockers.length === 0;
     const binding = validateLocalReleasePackBinding(root, receipt);
     if (!binding.ok)
@@ -84,6 +96,21 @@ function createLocalReceipt() {
     writeReleaseJson(file, receipt);
     emit(receipt, file);
 }
+function verifyLocalReceipt() {
+    const file = path.join(proofDir, 'pack-receipt.json');
+    const receipt = readReceipt(file);
+    const validation = validateLocalReleasePackBinding(root, receipt);
+    const blockers = [
+        ...(Array.isArray(receipt.blockers) ? receipt.blockers : ['pack_receipt_blockers_invalid']),
+        ...validation.blockers.map((blocker) => `local_binding:${blocker}`)
+    ];
+    if (receipt.package_name !== pkg.name)
+        blockers.push('pack_metadata_name_mismatch');
+    if (receipt.package_version !== pkg.version)
+        blockers.push('pack_metadata_version_mismatch');
+    const report = { ...receipt, ok: blockers.length === 0, blockers: [...new Set(blockers)] };
+    emit(report, file);
+}
 function inspectDownloadedReceipt() {
     const tarball = required('--tarball');
     const kind = String(option('--kind') || 'staged');
@@ -115,10 +142,6 @@ function readReceipt(file) {
         fail(`unable to read receipt ${file}`, error?.message || String(error));
     }
 }
-function gitHead() {
-    const result = spawnSync('git', ['rev-parse', 'HEAD'], { cwd: root, encoding: 'utf8' });
-    return result.status === 0 ? String(result.stdout || '').trim() || null : null;
-}
 function sha256Json(value) {
     return crypto.createHash('sha256').update(JSON.stringify(value)).digest('hex');
 }

package/dist/scripts/release-physical-gates-check.js

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+import path from 'node:path';
+import fs from 'node:fs';
+import { fileURLToPath } from 'node:url';
+import { inspectPhysicalReleaseGates, physicalReleaseEvidenceArchivePath, physicalReleaseGateInspectionPath } from '../core/release/physical-release-gates.js';
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '..', '..');
+const pkg = JSON.parse(fs.readFileSync(path.join(root, 'package.json'), 'utf8'));
+const version = String(pkg.version || '');
+const args = process.argv.slice(2);
+const value = (flag) => {
+    const index = args.indexOf(flag);
+    return index >= 0 && index + 1 < args.length ? args[index + 1] || null : null;
+};
+const requestedArchive = value('--archive');
+const archive = physicalReleaseEvidenceArchivePath(root, version);
+if (requestedArchive) {
+    const source = path.resolve(requestedArchive);
+    const stat = fs.lstatSync(source);
+    if (!stat.isFile() || stat.isSymbolicLink())
+        throw new Error('physical evidence archive must be a regular file');
+    fs.mkdirSync(path.dirname(archive), { recursive: true });
+    if (source !== archive)
+        fs.copyFileSync(source, archive);
+}
+const report = inspectPhysicalReleaseGates({
+    root,
+    version,
+    evidenceArchive: archive,
+    evidenceRunId: value('--evidence-run-id'),
+    repository: value('--repository')
+});
+const output = physicalReleaseGateInspectionPath(root, version);
+fs.mkdirSync(path.dirname(output), { recursive: true });
+const temporary = `${output}.${process.pid}.tmp`;
+fs.writeFileSync(temporary, `${JSON.stringify(report, null, 2)}\n`, { mode: 0o600 });
+fs.renameSync(temporary, output);
+console.log(JSON.stringify(report, null, 2));
+if (!report.ok)
+    process.exitCode = 1;

package/dist/scripts/release-real-check.js

@@ -10,6 +10,8 @@ import { releaseAuthorizationSnapshot, sameReleaseAuthorizationSnapshot } from '
 import { readCurrentCanonicalTestProof } from '../core/release/canonical-test-proof.js';
 const args = process.argv.slice(2);
 const skipReleaseCheck = args.includes('--skip-release-check') || process.env.SKS_RELEASE_REAL_CHECK_SKIP_RELEASE_CHECK === '1';
+const physicalEvidenceRunId = String(process.env.SKS_PHYSICAL_EVIDENCE_RUN_ID || '');
+const physicalEvidenceRepository = String(process.env.SKS_PHYSICAL_EVIDENCE_REPOSITORY || '');
 const root = process.cwd();
 const concurrency = Math.max(1, Math.min(4, Math.floor(Number(process.env.SKS_RELEASE_REAL_CHECK_CONCURRENCY || 2))));
 const releaseScratchDir = tmpdir('rr-');
@@ -75,15 +77,15 @@ const tasks = [
     task('codex:current:app-server-v2:real', 'direct', { command: nodeScript('codex-current-app-server-v2-check.js'), group: 'environment_required', phase: 'parallel_processing', args: ['--require-real'], policy: requiredPolicy(['sks.release-gate.v1']) }),
     task('codex:current:capability:real', 'direct', { command: nodeScript('codex-current-capability-check.js'), group: 'environment_required', phase: 'parallel_verification', args: ['--require-real'], deps: ['codex:current:app-server-v2:real'], policy: requiredPolicy(['sks.release-gate.v1']) }),
     task('doctor:actual', 'direct', { command: [process.execPath, './dist/bin/sks.js', 'doctor', '--json'], group: 'environment_required', phase: 'parallel_processing', policy: requiredPolicy(['sks.doctor-status.v3'], { statusRequired: true, passStatuses: ['fast_readonly_ok', 'ok'] }) }),
-    task('release:pack-receipt', 'release:pack-receipt', { group: 'environment_required', phase: 'parallel_processing', policy: requiredPolicy(['sks.release-pack-receipt.v1']) }),
+    task('release:pack-receipt', 'release:pack-receipt', { command: nodeScript('release-pack-receipt.js', 'verify'), group: 'environment_required', phase: 'parallel_processing', policy: requiredPolicy(['sks.release-pack-receipt.v2']) }),
     task('naruto:worktree-coding:blackbox', 'direct', { command: nodeScript('naruto-worktree-coding-blackbox.js'), group: 'real_smoke', phase: 'parallel_processing', args: ['--require-real'], env: { SKS_REQUIRE_GIT_WORKTREE: '1' }, policy: requiredPolicy(['sks.release-gate.v1']) }),
     task('codex-sdk:real-smoke', 'direct', { command: nodeScript('codex-sdk-real-smoke-check.js'), group: 'real_smoke', phase: 'parallel_processing', args: ['--require-real'], policy: requiredPolicy(['sks.release-gate.v1'], { statusRequired: true, passStatuses: ['proven'] }) }),
-    task('codex-lb:desktop-real-evidence', 'direct', {
-        command: nodeScript('codex-lb-desktop-real-evidence-check.js'),
+    task('desktop-bridge:real-evidence', 'direct', {
+        command: nodeScript('release-physical-gates-check.js', '--evidence-run-id', physicalEvidenceRunId, '--repository', physicalEvidenceRepository),
         group: 'real_ui',
         phase: 'parallel_verification',
         deps: ['codex:actual-config-load-probe'],
-        policy: liveOptionalPolicy(['sks.codex-lb-desktop-real-evidence-check.v1'], ['passed'])
+        policy: liveOptionalPolicy(['sks.release-physical-gates-inspection.v2'], ['passed'])
     }),
     task('imagegen:real-smoke', 'direct', { command: nodeScript('imagegen-real-smoke-check.js'), group: 'real_smoke', phase: 'parallel_processing', policy: liveOptionalPolicy(['sks.imagegen-real-smoke.v1'], ['passed']) }),
     task('ux-review:real-imagegen-smoke', 'direct', { command: nodeScript('ux-review-real-imagegen-smoke-check.js'), group: 'real_smoke', phase: 'parallel_processing', deps: ['imagegen:real-smoke'], policy: liveOptionalPolicy(['sks.ux-real-imagegen-smoke.v1'], ['passed']) }),
@@ -120,7 +122,7 @@ async function main() {
         return await finish(false);
     }
     if (!skipReleaseCheck) {
-        report.release_check = await runNpm(task('release:check', 'release:check', { group: 'design', phase: 'design', policy: requiredPolicy(['sks.gate-result.v1']) }));
+        report.release_check = await runNpm(task('release:check', 'release:check', { group: 'design', phase: 'design', policy: requiredPolicy(['sks.gate-result.v2']) }));
         if (terminating)
             return;
         collect(report.release_check);

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "8.1.2",
+  "version": "8.2.0",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -37,12 +37,11 @@
     "!dist/native/**/Tests",
     "!dist/native/**/UITests",
     "!dist/native/**/QAFixtures",
-    "!dist/cli/install-helpers-codex-lb-selftest.js",
-    "!dist/cli/install-helpers-codex-lb-selftest-chain.js",
     "!dist/scripts/**",
     "dist/scripts/canonical-test-runner.js",
-    "dist/scripts/{agent-guidance-dedup-check.js,agent-message-bus-reader-check.js,all-feature-deep-completion-check.js,appshots-thread-attachment-discovery-check.js,architecture-guard-check.js,certificate-sla-check.js,check-runtime-schemas.js,cli-output-consistency-check.js,codex-current-app-server-v2-check.js,codex-current-binary-identity-check.js,codex-current-capability-check.js,codex-current-core-real-probes-check.js,codex-current-manifest-check.js,codex-current-policy-check.js,codex-current-thread-store-check.js,codex-agent-role-rich-content-check.js,codex-agent-role-sync-check.js,codex-agent-type-routing-check.js,codex-app-execution-profile-check.js,codex-app-fast-ui-preservation-check.js,codex-app-handoff-check.js,codex-app-handoff-launch-check.js,codex-config-load-probe.js,context-graph-check.js,codex-control-all-pipelines-check.js,codex-control-event-stream-ledger-check.js,codex-control-tool-output-continuity-audit-check.js,codex-lb-catalog-passthrough-check.js,codex-lb-desktop-auth-invariant-check.js,codex-lb-desktop-bridge-check.js,codex-lb-desktop-bridge-latency-check.js,codex-lb-desktop-capabilities-check.js,codex-lb-desktop-real-evidence-check.js,codex-lb-fast-mode-truth-check.js,codex-lb-fast-ui-preservation-check.js,codex-lb-gpt56-fast-profile-check.js,codex-native-agent-role-content-check.js,codex-native-feature-broker-blackbox.js,codex-native-feature-broker-check.js,codex-native-harness-compat-check.js,codex-native-hook-lifecycle-proof-check.js,codex-native-runtime-e2e-fixture.js,codex-plugin-app-template-policy-check.js,codex-sdk-all-pipelines-check.js,codex-sdk-backend-router-check.js,codex-sdk-capability-check.js,codex-sdk-event-stream-ledger-check.js,codex-sdk-real-smoke-check.js,concurrent-session-collision-check.js,context7-evidence-dedupe-check.js,core-skill-card-schema-check.js,core-skill-deployment-snapshot-check.js,core-skill-heldout-validation-check.js,core-skill-no-inference-optimizer-check.js,core-skill-patch-check.js,core-skill-route-runtime-integration-check.js,current-command-surface-check.js,current-surface-update-e2e-check.js,current-upgrade-matrix-check.js,dfix-fixture-check.js,dfix-patch-handoff-check.js,dfix-verification-check.js,dfix-verification-recommendation-check.js,docs-truthfulness-check.js,doctor-codex-app-harness-check.js,doctor-fix-proves-codex-read-check.js,doctor-fixes-codex-app-fast-ui-check.js,evidence-flagship-coverage-check.js,fast-codex-service-tier-proof-check.js,fixtures/fake-codex-config-loader.js,gate-policy-audit-check.js,geo-claim-evidence-check.js,geo-cli-blackbox-check.js,geo-crawler-policy-check.js,git-worktree-checkpoint-check.js,git-worktree-cross-rebase-check.js,git-worktree-diff-envelope-check.js,git-worktree-dirty-lock-check.js,git-worktree-dirty-main-detection-check.js,git-worktree-integration-primary-check.js,git-worktree-manifest-append-check.js,git-worktree-untracked-diff-check.js,goal-artifact-compat-check.js,harness-benchmark-check.js,helper-dedup-check.js,hook-latency-budget-check.js,image-artifact-path-contract-check.js,imagegen-real-smoke-check.js,init-deep-backup-retention-check.js,installed-package-smoke-check.js,lib/codex-sdk-gate-lib.js,lib/ensure-dist-fresh.js,lib/git-worktree-fixture.js,lib/valid-png-fixture.js,local-collab-all-pipelines-final-gpt-check.js,loop-directive-check-lib.js,loop-integration-finalizer-check.js,loop-worker-fixture-child.js,mad-preflight-blocks-unreadable-config-check.js,mad-sks-app-ui-no-mutation-check.js}",
-    "dist/scripts/{latest-version-guidance-check.js,mad-sks-launch-sql-plane-boundary-check.js,mad-sks-sql-plane-capability-check.js,mad-sks-sql-plane-lifecycle-hook-decision-check.js,mad-sks-sql-plane-result-lifecycle-check.js,managed-config-merge-check.js,mcp-plugin-inventory-check.js,model-call-concurrency-check.js,mutation-callsite-analysis.js,mutation-callsite-coverage-check.js,naruto-ssot-gate-aliases-check.js,naruto-ssot-pipeline-default-check.js,naruto-ssot-route-normalization-check.js,naruto-ssot-routing-check.js,naruto-worktree-coding-blackbox.js,native-capability-repair-matrix-check.js,native-image-generation-repair-check.js,official-subagent-workflow-check.js,package-published-contract-check.js,packlist-performance-check.js,pipeline-codex-native-doctor-mad-routing-check.js,pipeline-codex-native-doctor-mad-routing-real-blackbox.js,pipeline-codex-native-image-routing-check.js,pipeline-codex-native-image-routing-real-blackbox.js,pipeline-codex-native-loop-routing-check.js,pipeline-codex-native-loop-routing-real-blackbox.js,pipeline-codex-native-qa-routing-check.js,pipeline-codex-native-qa-routing-real-blackbox.js,pipeline-codex-native-research-routing-check.js,pipeline-codex-native-research-routing-real-blackbox.js,ppt-full-e2e-blackbox-check.js,ppt-real-export-adapter-check.js,ppt-real-imagegen-smoke-check.js,ppt-real-imagegen-wiring-check.js,ppt-reexport-rereview-check.js,prepublish-fast-check.js,publish-preflight.js,prepublish-release-check-or-fast.js,probe-memoization-check.js,product-design-plugin-routing-check.js,prompt-placeholder-guard-check.js,proof-root-cause-policy-check.js,provider-badge-context-check.js,python-codex-sdk-all-pipelines-check.js,qa-loop-app-handoff-capability-check.js,qa-loop-app-handoff-check.js,qa-loop-app-handoff-cli-check.js,qa-loop-app-handoff-confirmation-check.js,qa-loop-app-handoff-gate-lifecycle-check.js,qa-loop-app-handoff-launch-check.js,qa-loop-app-handoff-status-lifecycle-check.js,qa-loop-budget-policy-check.js,qa-loop-effort-escalation-check.js,qa-loop-execution-profile-routing-check.js,qa-loop-image-path-exposure-check.js,qa-loop-image-path-prompt-injection-check.js,release-affected-selector-check.js,release-aggressive-resource-governor-check.js,release-cache-glob-hashing-check.js,release-cache-input-classifier-check.js,release-cache-neutralization-report-check.js,release-cache-version-neutral-fixture-check.js,release-check-stamp.js,release-dynamic-presets-check.js,release-full-parallelism-blackbox.js,release-gate-batch-runner-check.js,release-gate-budget-check.js,release-gate-dag-runner-check.js,release-gate-dag-runner.js,release-latency-slo-check.js,release-metadata-check.js,release-pack-receipt.js,release-parallel-speed-budget-check.js,release-proof-truth-check.js,release-provenance-check.js,release-real-check.js,release-runtime-truth-matrix-check.js,release-speed-summary.js,research-blueprint-densifier-check.js,research-claim-builder-check.js,research-complete-package-fixture-check.js,research-execution-profile-routing-check.js,research-final-reviewer-blackbox.js,responses-retry-policy-centralized-check.js,runtime-proof-summary-check.js,runtime-script-pack-closure-check.js,scheduler-batch-dispatch-check.js,scheduler-parallel-proof-consistency-check.js,scheduler-utilization-integral-check.js,search-visibility-gate-lib.js,secret-preservation-check.js,seo-audit-fixture-check.js,seo-cli-blackbox-check.js,seo-geo-geo-disambiguation-check.js,seo-geo-route-identity-check.js,seo-geo-skill-rich-content-check.js,seo-no-mutation-by-default-check.js,shared-memory-fixture-check.js,side-effect-runtime-report-check.js,skill-name-canonicalizer-check.js,skill-surface-modernization-check.js,skills-manifest-continuity-check.js,sks-cli-gate-lib.js}",
+    "dist/scripts/desktop-bridge-transport-client.js",
+    "dist/scripts/{agent-guidance-dedup-check.js,agent-message-bus-reader-check.js,all-feature-deep-completion-check.js,appshots-thread-attachment-discovery-check.js,architecture-guard-check.js,certificate-sla-check.js,check-runtime-schemas.js,cli-output-consistency-check.js,codex-current-app-server-v2-check.js,codex-current-binary-identity-check.js,codex-current-capability-check.js,codex-current-core-real-probes-check.js,codex-current-manifest-check.js,codex-current-policy-check.js,codex-current-thread-store-check.js,codex-agent-role-rich-content-check.js,codex-agent-role-sync-check.js,codex-agent-type-routing-check.js,codex-app-execution-profile-check.js,codex-app-fast-ui-preservation-check.js,codex-app-handoff-check.js,codex-app-handoff-launch-check.js,codex-config-load-probe.js,context-graph-check.js,codex-control-all-pipelines-check.js,codex-control-event-stream-ledger-check.js,codex-control-tool-output-continuity-audit-check.js,desktop-bridge-transport-check.js,desktop-bridge-latency-check.js,desktop-bridge-capabilities-check.js,desktop-bridge-real-evidence-check.js,codex-native-agent-role-content-check.js,codex-native-feature-broker-blackbox.js,codex-native-feature-broker-check.js,codex-native-harness-compat-check.js,codex-native-hook-lifecycle-proof-check.js,codex-native-runtime-e2e-fixture.js,codex-plugin-app-template-policy-check.js,codex-sdk-all-pipelines-check.js,codex-sdk-backend-router-check.js,codex-sdk-capability-check.js,codex-sdk-event-stream-ledger-check.js,codex-sdk-real-smoke-check.js,concurrent-session-collision-check.js,context7-evidence-dedupe-check.js,core-skill-card-schema-check.js,core-skill-deployment-snapshot-check.js,core-skill-heldout-validation-check.js,core-skill-no-inference-optimizer-check.js,core-skill-patch-check.js,core-skill-route-runtime-integration-check.js,current-command-surface-check.js,current-surface-update-e2e-check.js,current-upgrade-matrix-check.js,desktop-bridge-unification-check.js,dfix-fixture-check.js,dfix-patch-handoff-check.js,dfix-verification-check.js,dfix-verification-recommendation-check.js,docs-truthfulness-check.js,doctor-codex-app-harness-check.js,doctor-fix-proves-codex-read-check.js,doctor-fixes-codex-app-fast-ui-check.js,evidence-flagship-coverage-check.js,fast-codex-service-tier-proof-check.js,fixtures/fake-codex-config-loader.js,gate-policy-audit-check.js,geo-claim-evidence-check.js,geo-cli-blackbox-check.js,geo-crawler-policy-check.js,git-worktree-checkpoint-check.js,git-worktree-cross-rebase-check.js,git-worktree-diff-envelope-check.js,git-worktree-dirty-lock-check.js,git-worktree-dirty-main-detection-check.js,git-worktree-integration-primary-check.js,git-worktree-manifest-append-check.js,git-worktree-untracked-diff-check.js,goal-artifact-compat-check.js,harness-benchmark-check.js,helper-dedup-check.js,hook-latency-budget-check.js,image-artifact-path-contract-check.js,imagegen-real-smoke-check.js,init-deep-backup-retention-check.js,installed-package-smoke-check.js,lib/codex-sdk-gate-lib.js,lib/ensure-dist-fresh.js,lib/git-worktree-fixture.js,lib/valid-png-fixture.js,local-collab-all-pipelines-final-gpt-check.js,loop-directive-check-lib.js,loop-integration-finalizer-check.js,loop-worker-fixture-child.js,mad-preflight-blocks-unreadable-config-check.js,mad-sks-app-ui-no-mutation-check.js}",
+    "dist/scripts/{latest-version-guidance-check.js,mad-sks-launch-sql-plane-boundary-check.js,mad-sks-sql-plane-capability-check.js,mad-sks-sql-plane-lifecycle-hook-decision-check.js,mad-sks-sql-plane-result-lifecycle-check.js,managed-config-merge-check.js,mcp-plugin-inventory-check.js,model-call-concurrency-check.js,mutation-callsite-analysis.js,mutation-callsite-coverage-check.js,naruto-ssot-gate-aliases-check.js,naruto-ssot-pipeline-default-check.js,naruto-ssot-route-normalization-check.js,naruto-ssot-routing-check.js,naruto-worktree-coding-blackbox.js,native-capability-repair-matrix-check.js,native-image-generation-repair-check.js,official-subagent-workflow-check.js,package-published-contract-check.js,packlist-performance-check.js,pipeline-codex-native-doctor-mad-routing-check.js,pipeline-codex-native-doctor-mad-routing-real-blackbox.js,pipeline-codex-native-image-routing-check.js,pipeline-codex-native-image-routing-real-blackbox.js,pipeline-codex-native-loop-routing-check.js,pipeline-codex-native-loop-routing-real-blackbox.js,pipeline-codex-native-qa-routing-check.js,pipeline-codex-native-qa-routing-real-blackbox.js,pipeline-codex-native-research-routing-check.js,pipeline-codex-native-research-routing-real-blackbox.js,ppt-full-e2e-blackbox-check.js,ppt-real-export-adapter-check.js,ppt-real-imagegen-smoke-check.js,ppt-real-imagegen-wiring-check.js,ppt-reexport-rereview-check.js,prepublish-fast-check.js,publish-preflight.js,prepublish-release-check-or-fast.js,probe-memoization-check.js,product-design-plugin-routing-check.js,prompt-placeholder-guard-check.js,proof-root-cause-policy-check.js,provider-badge-context-check.js,python-codex-sdk-all-pipelines-check.js,qa-loop-app-handoff-capability-check.js,qa-loop-app-handoff-check.js,qa-loop-app-handoff-cli-check.js,qa-loop-app-handoff-confirmation-check.js,qa-loop-app-handoff-gate-lifecycle-check.js,qa-loop-app-handoff-launch-check.js,qa-loop-app-handoff-status-lifecycle-check.js,qa-loop-budget-policy-check.js,qa-loop-effort-escalation-check.js,qa-loop-execution-profile-routing-check.js,qa-loop-image-path-exposure-check.js,qa-loop-image-path-prompt-injection-check.js,release-affected-selector-check.js,release-aggressive-resource-governor-check.js,release-cache-glob-hashing-check.js,release-cache-input-classifier-check.js,release-cache-neutralization-report-check.js,release-cache-version-neutral-fixture-check.js,release-check-stamp.js,release-dynamic-presets-check.js,release-full-parallelism-blackbox.js,release-gate-batch-runner-check.js,release-gate-budget-check.js,release-gate-dag-runner-check.js,release-gate-dag-runner.js,release-latency-slo-check.js,release-metadata-check.js,release-pack-receipt.js,release-parallel-speed-budget-check.js,release-physical-gates-check.js,release-proof-truth-check.js,release-provenance-check.js,release-real-check.js,release-runtime-truth-matrix-check.js,release-speed-summary.js,research-blueprint-densifier-check.js,research-claim-builder-check.js,research-complete-package-fixture-check.js,research-execution-profile-routing-check.js,research-final-reviewer-blackbox.js,responses-retry-policy-centralized-check.js,runtime-proof-summary-check.js,runtime-script-pack-closure-check.js,scheduler-batch-dispatch-check.js,scheduler-parallel-proof-consistency-check.js,scheduler-utilization-integral-check.js,search-visibility-gate-lib.js,secret-preservation-check.js,seo-audit-fixture-check.js,seo-cli-blackbox-check.js,seo-geo-geo-disambiguation-check.js,seo-geo-route-identity-check.js,seo-geo-skill-rich-content-check.js,seo-no-mutation-by-default-check.js,shared-memory-fixture-check.js,side-effect-runtime-report-check.js,skill-name-canonicalizer-check.js,skill-surface-modernization-check.js,skills-manifest-continuity-check.js,sks-cli-gate-lib.js}",
     "dist/scripts/{real-execution-check-lib.js,gate-lib.js,runtime-domain-gate-lib.js,typed-routing-gate-lib.js,codex-native-gate-lib.js,skill-fixture-check-lib.js,sks-uninstall-regression-check.js,sksd-daemon-check.js,super-search-provider-interface-check.js,triwiki-cache-key-check.js,triwiki-proof-bank-blackbox.js,triwiki-proof-bank-check.js,triwiki-proof-card-check.js,trust-fixture-check.js,type-surface-codex-app-check.js,ultra-router-auto-router-check.js,uninstall-inventory-check.js,install-surface-ssot-check.js,ux-review-extract-wires-real-extractor-check.js,ux-review-imagegen-blackbox-check.js,ux-review-patch-diff-recheck-check.js,ux-review-real-imagegen-smoke-check.js,ux-review-run-wires-imagegen-check.js,wrongness-fixture-check.js}",
     "dist/scripts/check-publish-tag.js",
     "!dist/core/triwiki/context-graph/benchmark",
@@ -141,10 +140,10 @@
     "skill:dedupe-blackbox": "node ./dist/scripts/project-skill-dedupe-blackbox.js",
     "release:check:affected": "npm run release:ensure-build --silent && node ./dist/scripts/release-gate-dag-runner.js --preset affected --changed-since auto --sla 5m",
     "release:real-check": "node ./dist/scripts/release-real-check.js",
-    "codex-lb:desktop-real-evidence": "node ./dist/scripts/codex-lb-desktop-real-evidence-check.js",
+    "desktop-bridge:real-evidence": "node ./dist/scripts/desktop-bridge-real-evidence-check.js",
     "release:check:fast": "npm run release:ensure-build --silent && node ./dist/scripts/release-gate-dag-runner.js --preset fast --changed-since auto --sla 5m",
     "release:check:confidence": "npm run release:ensure-build --silent && node ./dist/scripts/release-gate-dag-runner.js --preset confidence --changed-since auto --sla 5m",
-    "release:check:full": "npm run build:clean --silent && npm run test:release --silent && node ./dist/scripts/release-gate-dag-runner.js --preset release --full && node ./dist/scripts/release-real-check.js --skip-release-check && npm run release:dist-freshness --silent && node ./dist/scripts/release-check-stamp.js write --preset release --full",
+    "release:check:full": "npm run build:clean --silent && npm run test:release --silent && node ./dist/scripts/release-gate-dag-runner.js --preset release --full && node ./dist/scripts/release-pack-receipt.js create && node ./dist/scripts/release-real-check.js --skip-release-check && npm run release:dist-freshness --silent && node ./dist/scripts/release-check-stamp.js write --preset release --full",
     "publish:packlist-performance": "node ./dist/scripts/packlist-performance-check.js",
     "gates:run": "node ./dist/scripts/release-gate-dag-runner.js",
     "policy:gate-audit": "node ./dist/scripts/gate-policy-audit-check.js",
@@ -204,7 +203,6 @@
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
     "@openai/codex-sdk": "0.146.0",
-    "figlet": "^1.11.0",
     "smol-toml": "^1.7.0",
     "typescript": "^5.9.3"
   },