sneakoscope 8.2.0 → 8.2.1

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-This README documents package **SKS 8.2.0** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
+This README documents package **SKS 8.2.1** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
 
 Use the official latest stable SKS and Codex CLI releases. The Codex compatibility SSOT is always the **current latest stable** host; capability probes measure what that host can actually do. Product docs do not crown a fixed `0.x.y` string as SSOT (release pins and schema directories are measured artifacts for the current package, not a permanent product version claim). Menu Bar / Center induce updates to the latest stable build. Run `sks update-check` for what is installed and read the capability report for what is supported. Install SSOT is npm `sneakoscope@latest`; PATH `sks` and Menu Bar stamped generation must match that version or gates fail. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it (Codex official multi-agent wrap-only; SKS does not reimplement a parallel runtime). Local code search is mode-separated (`sks search files|text|structure|symbol|context`); `context` is answered by the compiled TriWiki Context Graph (`context-graph.json` is exhaustive authority; `context-pack.json` and managed `AGENTS.md` are bounded projections) — see [docs/architecture/context-graph.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/architecture/context-graph.md) and [docs/PRODUCT-CONTRACT.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/PRODUCT-CONTRACT.md). See [CHANGELOG.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/CHANGELOG.md).
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "8.2.0"
+version = "8.2.1"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "8.2.0"
+version = "8.2.1"
 edition = "2021"
 
 [dependencies]

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "8.2.0",
+  "package_version": "8.2.1",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/codex-app/menubar/constants.js

@@ -25,6 +25,7 @@ export const NATIVE_SOURCE_FILES = [
     'ProvidersOpenRouter.swift',
     'ProvidersBridgeCatalog.swift',
     'RemoteCodingViewController.swift',
+    'RemoteCodingSettingsControls.swift',
     'DiagnosticsViewController.swift',
     'SettingsViewController.swift',
     'OperationModels.swift',

package/dist/core/release/canonical-test-proof.js

@@ -9,7 +9,6 @@ const CURRENT_COMPILED_TESTS = new Set([
     'dist/core/__tests__/codex-release-manifest-current.test.js',
     'dist/core/__tests__/release-gate-hermetic-env.test.js',
     'dist/core/__tests__/update-menubar-package-local.test.js',
-    'dist/core/__tests__/update-simulated-upgrade.test.js',
     'dist/core/__tests__/version-manager-current-docs.test.js',
     'dist/core/install/__tests__/installed-package-smoke.test.js',
     'dist/core/perf/__tests__/release-latency-slo.test.js'

package/dist/core/release/gate-manifest.js

@@ -11,6 +11,8 @@ export const FORBIDDEN_RECURSIVE_GATES = new Set([
 ]);
 export const ALWAYS_ON_GATES = new Set([
     'release:metadata-current',
+    'release:version-truth',
+    'install-surface:ssot',
     'architecture:guard',
     'safety:mutation-callsite-coverage',
     'side-effect:runtime-report',
@@ -25,6 +27,8 @@ export const ALWAYS_ON_GATES = new Set([
 ]);
 export const REQUIRED_FOR_PUBLISH = new Set([
     'release:metadata-current',
+    'release:version-truth',
+    'install-surface:ssot',
     'architecture:guard',
     'safety:mutation-callsite-coverage',
     'side-effect:runtime-report',

package/dist/core/release/release-gate-affected-selector.js

@@ -1,6 +1,8 @@
 import { spawnSync } from 'node:child_process';
 const ALWAYS_KEEP = new Set([
     'release:proof-truth',
+    'release:version-truth',
+    'install-surface:ssot',
     'typecheck',
     'schema:check'
 ]);

package/dist/core/release/release-gate-contract.js

@@ -11,6 +11,7 @@ export const RELEASE_GATE_CONTRACT_IDS = Object.freeze([
     'commands:current-surface-only',
     'config:managed-merge',
     'docs:truthfulness',
+    'install-surface:ssot',
     'latest-version:guidance',
     'migration:current-surface-e2e',
     'migration:upgrade-safety',
@@ -24,6 +25,7 @@ export const RELEASE_GATE_CONTRACT_IDS = Object.freeze([
     'release:metadata-current',
     'release:proof-truth',
     'release:provenance',
+    'release:version-truth',
     'runtime:installed-smoke',
     'safety:mutation-callsite-coverage',
     'schema:check',

package/dist/core/telegram/doctor.js

@@ -23,6 +23,7 @@ export async function probeTelegram(input) {
         blockers.push(`telegram_token_load_failed:${redactTelegramError(error)}`);
     }
     let identityValid = false;
+    let botId = null;
     let getMeCheckedAt = null;
     let getMeLatencyMs = null;
     if (!tokenConfigured)
@@ -30,7 +31,9 @@ export async function probeTelegram(input) {
     else {
         const started = Date.now();
         try {
-            identityValid = (await input.client.getMe()).is_bot === true;
+            const identity = await input.client.getMe();
+            identityValid = identity.is_bot === true && Number.isSafeInteger(identity.id) && identity.id > 0;
+            botId = identityValid ? identity.id : null;
             if (!identityValid)
                 blockers.push('telegram_getme_not_bot');
         }
@@ -72,6 +75,7 @@ export async function probeTelegram(input) {
         status: !tokenConfigured ? 'not_configured' : blockers.length ? 'degraded' : 'ready',
         token_configured: tokenConfigured,
         token_source: tokenConfigured ? (receiptProbe?.token_source ?? 'unknown') : 'none',
+        bot_id: botId,
         bot_identity_valid: identityValid,
         getme_checked_at: getMeCheckedAt,
         getme_latency_ms: getMeLatencyMs,
@@ -89,7 +93,7 @@ async function probeTelegramReceipt(receiptPath, now) {
     if (!liveness.ok) {
         return {
             schema: 'sks.telegram-doctor-probe.v1', ok: false, status: 'not_configured',
-            token_configured: false, bot_identity_valid: false, paired_chat_count: 0,
+            token_configured: false, bot_id: null, bot_identity_valid: false, paired_chat_count: 0,
             token_source: 'none',
             audit_healthy: false, audit_last_error: null,
             getme_checked_at: null, getme_latency_ms: null,
@@ -122,6 +126,7 @@ async function probeTelegramReceipt(receiptPath, now) {
         status: !receipt.token_configured ? 'not_configured' : blockers.length ? 'degraded' : 'ready',
         token_configured: receipt.token_configured,
         token_source: receipt.token_source ?? (receipt.token_configured ? 'unknown' : 'none'),
+        bot_id: receipt.bot_id ?? null,
         bot_identity_valid: receipt.bot_identity_valid,
         getme_checked_at: receipt.getme_checked_at ?? null,
         getme_latency_ms: receipt.getme_latency_ms ?? null,

package/dist/core/version-manager.js

@@ -323,6 +323,10 @@ async function syncSourcePackageVersion(root, version) {
             rel: 'src/core/version.ts',
             replace: (text) => text.replace(/export const PACKAGE_VERSION = ['"][^'"]+['"];/, `export const PACKAGE_VERSION = '${version}';`)
         },
+        {
+            rel: 'plugins/sks/.codex-plugin/plugin.json',
+            replace: (text) => text.replace(/("version"\s*:\s*")[^"]+("(?=\s*[,}]))/, `$1${version}$2`)
+        },
         {
             rel: 'crates/sks-core/Cargo.toml',
             replace: (text) => text.replace(/^version\s*=\s*"[^"]+"/m, `version = "${version}"`)

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '8.2.0';
+export const PACKAGE_VERSION = '8.2.1';

package/dist/native/sks-menubar/Sources/RemoteCodingSettingsControls.swift

@@ -0,0 +1,160 @@
+import Cocoa
+
+final class RemoteCodingSettingsControls {
+    private static let tokenPattern = #"^\d{5,20}:[A-Za-z0-9_-]{20,128}$"#
+
+    let selectedBotDetail = NativeView.detail("No bot is configured.")
+    let pairingCommandField = NativeView.detail("Generate a code to create the /start pairing command.")
+    let botTokenField: NSSecureTextField
+    let setupButton: NSButton
+    let copyPairingButton: NSButton
+
+    private var pairingCommand: String?
+    private var selectedBotID: Int64?
+    private var selectedBotUsername: String?
+
+    init(target: AnyObject, submitTokenAction: Selector, copyPairingAction: Selector) {
+        let tokenField = NSSecureTextField(frame: NSRect(x: 0, y: 0, width: 360, height: 24))
+        tokenField.placeholderString = "Paste the complete BotFather HTTP API token"
+        tokenField.setContentHuggingPriority(.defaultLow, for: .horizontal)
+        tokenField.setContentCompressionResistancePriority(.defaultLow, for: .horizontal)
+        tokenField.setAccessibilityLabel("BotFather HTTP API token")
+        tokenField.setAccessibilityHelp("Required. Paste the complete token for any Telegram bot you own. SKS clears this field before verification and never displays the token again.")
+        tokenField.setAccessibilityIdentifier("sks-center-telegram-bot-token")
+        tokenField.target = target
+        tokenField.action = submitTokenAction
+        botTokenField = tokenField
+
+        setupButton = NativeView.button("Verify, Save & Apply", target: target, action: submitTokenAction)
+        setupButton.setAccessibilityIdentifier("sks-center-telegram-verify-save-apply")
+        setupButton.setAccessibilityHelp("Verify the entered bot token with Telegram, save it to the private SKS user secret file, and apply it to the resident poller.")
+
+        copyPairingButton = NativeView.button("Copy Pairing Command", target: target, action: copyPairingAction)
+        copyPairingButton.setAccessibilityHelp("Copy only the generated /start pairing command. The bot token is never copied or displayed.")
+
+        pairingCommandField.isSelectable = true
+        pairingCommandField.font = NSFont.monospacedSystemFont(ofSize: 12, weight: .regular)
+        pairingCommandField.setAccessibilityLabel("Telegram pairing command")
+        pairingCommandField.setAccessibilityIdentifier("sks-center-telegram-pairing-command")
+        selectedBotDetail.isSelectable = true
+        selectedBotDetail.setAccessibilityLabel("Selected Telegram bot")
+        selectedBotDetail.setAccessibilityIdentifier("sks-center-telegram-selected-bot")
+    }
+
+    func configure(delegate: NSTextFieldDelegate) {
+        botTokenField.delegate = delegate
+    }
+
+    func consumeTokenInput() -> String {
+        let value = botTokenField.stringValue.trimmingCharacters(in: .whitespacesAndNewlines)
+        botTokenField.stringValue = ""
+        return value
+    }
+
+    func updateActionControls(operationInFlight: Bool, tokenConfigured: Bool, environmentOverride: Bool) {
+        let hasTokenInput = !botTokenField.stringValue.trimmingCharacters(in: .whitespacesAndNewlines).isEmpty
+        botTokenField.isEnabled = !operationInFlight && !environmentOverride
+        setupButton.title = tokenConfigured ? "Verify, Replace & Apply" : "Verify, Save & Apply"
+        setupButton.setAccessibilityLabel(setupButton.title)
+        setupButton.isEnabled = !operationInFlight && !environmentOverride && hasTokenInput
+        copyPairingButton.isEnabled = !operationInFlight && pairingCommand != nil
+    }
+
+    func renderSelectedBot(
+        botID: Int64?,
+        username: String? = nil,
+        configured: Bool,
+        identityValid: Bool
+    ) {
+        guard configured else {
+            selectedBotID = nil
+            selectedBotUsername = nil
+            selectedBotDetail.stringValue = "No bot is configured."
+            selectedBotDetail.setAccessibilityValue(selectedBotDetail.stringValue)
+            resetPairingCommand("Generate a code after connecting a bot.")
+            return
+        }
+        let retainedUsername = username ?? (botID == selectedBotID ? selectedBotUsername : nil)
+        selectedBotID = botID
+        selectedBotUsername = retainedUsername
+        if let botID, let retainedUsername, identityValid {
+            selectedBotDetail.stringValue = "@\(retainedUsername) · Bot ID \(botID)"
+        } else if let botID, identityValid {
+            selectedBotDetail.stringValue = "Bot ID \(botID) · verified by Telegram"
+        } else if let botID {
+            selectedBotDetail.stringValue = "Bot ID \(botID) · identity needs verification"
+        } else {
+            selectedBotDetail.stringValue = "Configured bot · identity details unavailable"
+        }
+        selectedBotDetail.setAccessibilityValue(selectedBotDetail.stringValue)
+    }
+
+    func setPairingCode(_ code: String) {
+        pairingCommand = "/start \(code)"
+        pairingCommandField.stringValue = pairingCommand ?? ""
+        pairingCommandField.setAccessibilityValue(pairingCommandField.stringValue)
+    }
+
+    func resetPairingCommand(_ detail: String) {
+        pairingCommand = nil
+        pairingCommandField.stringValue = detail
+        pairingCommandField.setAccessibilityValue(detail)
+    }
+
+    @discardableResult
+    func copyPairingCommand() -> Bool {
+        guard let pairingCommand else { return false }
+        let pasteboard = NSPasteboard.general
+        pasteboard.clearContents()
+        return pasteboard.setString(pairingCommand, forType: .string)
+    }
+
+    static func validTokenShape(_ value: String) -> Bool {
+        value.utf8.count <= 1024
+            && value.range(of: tokenPattern, options: .regularExpression) != nil
+    }
+
+    static func publicFailure(_ output: String, fallback: String) -> String {
+        guard let data = output.data(using: .utf8),
+              let row = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
+              let error = row["error"] as? String else { return fallback }
+        switch error {
+        case "telegram_token_invalid", "telegram_token_stdin_empty":
+            return "That value is not a complete BotFather HTTP API token."
+        case "telegram_token_rejected":
+            return "Telegram rejected this token. In @BotFather, select the bot you want SKS to use and copy that bot's current complete token."
+        case "telegram_identity_verification_timeout":
+            return "Telegram identity verification timed out. Check the network connection and try the selected bot token again."
+        case "telegram_identity_verification_network_failed":
+            return "Telegram identity verification could not reach the Bot API. Check the network connection and try again."
+        case "telegram_identity_verification_failed":
+            return "Telegram returned an invalid bot identity response. Try the selected bot's current token again."
+        case let value where value.contains("401") || value.contains("Unauthorized"):
+            return "Telegram rejected this token. Copy the current token from @BotFather and try again."
+        case let value where value.contains("timeout") || value.contains("network"):
+            return "Telegram identity verification could not complete. Check the network connection and try again."
+        default:
+            return fallback
+        }
+    }
+
+    static func partialSetupRecovery(_ response: TelegramCenterSetupResponse?) -> String {
+        var parts: [String] = []
+        if response?.webhook_removed == true { parts.append("The existing webhook was removed without dropping pending updates.") }
+        if response?.bot_state_reset == true { parts.append("Bot-scoped pairing and poll state were reset safely.") }
+        if response?.token_stored == false { parts.append("The token was not stored; rerun secure setup to finish.") }
+        if let note = response?.recovery?.note, !note.isEmpty { parts.append(note) }
+        return parts.isEmpty
+            ? "Review the secret-free recovery status, then rerun secure setup."
+            : parts.joined(separator: " ")
+    }
+
+    static func tokenSourceDescription(_ source: String) -> String {
+        switch source {
+        case "env": return "operator environment token"
+        case "user_secret_file": return "private token file"
+        case "none": return "no token source"
+        default: return "token source unknown"
+        }
+    }
+}

package/dist/native/sks-menubar/Sources/RemoteCodingViewController.swift

@@ -1,8 +1,7 @@
 import Cocoa
 
-final class RemoteCodingViewController: NSViewController, ControlCenterPage {
+final class RemoteCodingViewController: NSViewController, ControlCenterPage, NSTextFieldDelegate {
     private static let botFatherURL = URL(string: "https://t.me/BotFather")!
-    private static let tokenPattern = #"^\d{5,20}:[A-Za-z0-9_-]{20,128}$"#
 
     private let processClient: ProcessClient
     private let telegramService: TelegramMenuBarService
@@ -10,7 +9,11 @@ final class RemoteCodingViewController: NSViewController, ControlCenterPage {
     private let serviceDetail = NativeView.detail("Reading secret-free Telegram liveness status…")
     private let pairingDetail = NativeView.detail("No pairing code has been issued in this session.")
     private let serviceSpinner = NativeView.spinner(label: "Telegram operation in progress")
-    private lazy var setupButton = NativeView.button("Enter Bot Token…", target: self, action: #selector(enterToken))
+    private lazy var settingsControls = RemoteCodingSettingsControls(
+        target: self,
+        submitTokenAction: #selector(enterToken),
+        copyPairingAction: #selector(copyPairingCommand)
+    )
     private lazy var pairButton = NativeView.button("Generate Pairing Code", target: self, action: #selector(generatePairingCode))
     private lazy var startButton = NativeView.button("Start", target: self, action: #selector(startService))
     private lazy var stopButton = NativeView.button("Stop", target: self, action: #selector(stopService))
@@ -31,7 +34,7 @@ final class RemoteCodingViewController: NSViewController, ControlCenterPage {
     override func loadView() {
         let botFatherButton = NativeView.button("Open @BotFather", target: self, action: #selector(openBotFather))
         botFatherButton.setAccessibilityHelp("Open the official Telegram BotFather chat in your default handler.")
-        setupButton.setAccessibilityHelp("Enter a BotFather token securely. The token is verified live and stored in the private SKS user secret file.")
+        settingsControls.configure(delegate: self)
         pairButton.setAccessibilityHelp("With Telegram polling running, issue a short-lived, single-use code for pairing one intended private chat.")
         startButton.setAccessibilityHelp("Start Telegram polling for the current SKS companion session after a bot token is configured.")
         stopButton.setAccessibilityHelp("Stop polling for the current companion session without deleting the token or paired chats. A companion relaunch starts it again.")
@@ -47,12 +50,14 @@ final class RemoteCodingViewController: NSViewController, ControlCenterPage {
             views: [
                 NativeView.detail(
                     "1. Create or select any bot you own in @BotFather.  2. Copy that bot's complete HTTP API token.  " +
-                    "3. Choose Enter Bot Token below. SKS binds the identity returned by Telegram getMe; it never assumes a bot name or username."
+                    "3. Paste it below and choose Verify, Save & Apply. The token is the only value you enter: SKS derives the bot ID from Telegram getMe, and learns chat and user IDs through private-chat pairing."
                 ),
                 NativeView.detail(
                     "The token is sent only through process stdin to the canonical SKS setup command, verified with Telegram getMe, and stored in the private user secret file. It is never shown again or written to the SKS action log. Revoke it in BotFather if you suspect exposure."
                 ),
-                NativeView.row([botFatherButton, setupButton])
+                ControlKit.keyValueRow("Active Bot", settingsControls.selectedBotDetail),
+                ControlKit.keyValueRow("Bot Token", settingsControls.botTokenField),
+                NativeView.row([botFatherButton, settingsControls.setupButton])
             ]
         )
 
@@ -61,10 +66,11 @@ final class RemoteCodingViewController: NSViewController, ControlCenterPage {
             subtitle: "Authorize only the intended Telegram account and private chat.",
             views: [
                 NativeView.detail(
-                    "With Telegram polling running, generate a short-lived code, open your new bot from the intended private chat, and send /start followed by that code. Codes are single-use; group chats are rejected. After pairing, try /sks status {}."
+                    "With Telegram polling running, generate a short-lived command, open the selected bot from the intended private chat, and send that command. SKS derives the chat and user IDs from Telegram; they are never typed into this screen. Codes are single-use and group chats are rejected. After pairing, try /sks status {}."
                 ),
+                ControlKit.keyValueRow("Pair Command", settingsControls.pairingCommandField),
                 pairingDetail,
-                pairButton
+                NativeView.row([pairButton, settingsControls.copyPairingButton])
             ]
         )
 
@@ -97,6 +103,7 @@ final class RemoteCodingViewController: NSViewController, ControlCenterPage {
     }
 
     @objc private func enterToken() {
+        guard !operationInFlight else { return }
         if TelegramPrivateFileStore.operatorEnvironmentOverrideActive() {
             showAttention(
                 "Environment-managed token is active",
@@ -104,31 +111,38 @@ final class RemoteCodingViewController: NSViewController, ControlCenterPage {
             )
             return
         }
-        promptForToken(removeWebhook: false)
+        let normalizedToken = settingsControls.consumeTokenInput()
+        updateControls()
+        guard RemoteCodingSettingsControls.validTokenShape(normalizedToken) else {
+            showAttention(
+                "Token not saved",
+                detail: "That value does not match the BotFather token format. Copy the complete HTTP API token and try again."
+            )
+            return
+        }
+        saveToken(normalizedToken, removeWebhook: false)
     }
 
-    private func promptForToken(removeWebhook: Bool) {
+    private func promptForWebhookRemovalToken() {
         guard !operationInFlight, let window = view.window else { return }
         AlertFactory.textSheet(
             window: window,
-            title: "Enter Telegram Bot Token",
-            message: removeWebhook
-                ? "Paste this selected bot's BotFather token again. With your consent, SKS will remove that bot's existing webhook without dropping pending updates, verify its live identity, and store the token privately."
-                : "Paste the complete HTTP API token for any bot you own in @BotFather. SKS will accept the identity returned by Telegram getMe without assuming a bot name, then store the token privately.",
+            title: "Authorize Telegram Webhook Removal",
+            message: "Paste this selected bot's BotFather token again. With your consent, SKS will remove that bot's existing webhook without dropping pending updates, verify its live identity, and store the token privately.",
             secure: true,
             placeholder: "123456789:BotFatherToken",
-            actionTitle: removeWebhook ? "Remove Webhook & Save" : "Verify & Save"
+            actionTitle: "Remove Webhook & Save"
         ) { [weak self] token in
             guard let self, let token else { return }
             let normalizedToken = token.trimmingCharacters(in: .whitespacesAndNewlines)
-            guard self.validTokenShape(normalizedToken) else {
+            guard RemoteCodingSettingsControls.validTokenShape(normalizedToken) else {
                 self.showAttention(
                     "Token not saved",
                     detail: "That value does not match the BotFather token format. Copy the complete HTTP API token and try again."
                 )
                 return
             }
-            self.saveToken(normalizedToken, removeWebhook: removeWebhook)
+            self.saveToken(normalizedToken, removeWebhook: true)
         }
     }
 
@@ -150,7 +164,10 @@ final class RemoteCodingViewController: NSViewController, ControlCenterPage {
                   code.range(of: #"^\d{6}-[A-F0-9]{4}$"#, options: .regularExpression) != nil else {
                 self.showAttention(
                     "Pairing code unavailable",
-                    detail: self.publicFailure(result.output, fallback: "SKS could not create a pairing code. Refresh status and try again.")
+                    detail: RemoteCodingSettingsControls.publicFailure(
+                        result.output,
+                        fallback: "SKS could not create a pairing code. Refresh status and try again."
+                    )
                 )
                 return
             }
@@ -160,6 +177,7 @@ final class RemoteCodingViewController: NSViewController, ControlCenterPage {
             let postPair = response.post_pair_command ?? "/sks status {}"
             let confirmation = response.confirmation_grammar ?? "/confirm <nonce>"
             let statusGuidance = instruction.contains(postPair) ? "" : " Then try \(postPair)."
+            self.settingsControls.setPairingCode(code)
             self.pairingDetail.stringValue = "\(instruction)\(expiration)\(statusGuidance) Confirm prompted actions with \(confirmation)."
             self.pairingDetail.setAccessibilityValue(self.pairingDetail.stringValue)
             self.showProgress("Pairing code ready", detail: "Use the displayed code once in the intended private chat.")
@@ -167,6 +185,11 @@ final class RemoteCodingViewController: NSViewController, ControlCenterPage {
         }
     }
 
+    @objc private func copyPairingCommand() {
+        guard settingsControls.copyPairingCommand() else { return }
+        showProgress("Pairing command copied", detail: "Paste it once into the intended private chat with the selected bot.")
+    }
+
     @objc private func startService() { runLifecycle(.start) }
     @objc private func stopService() { runLifecycle(.stop) }
     @objc private func restartService() { runLifecycle(.restart) }
@@ -217,7 +240,7 @@ final class RemoteCodingViewController: NSViewController, ControlCenterPage {
 
     private func saveToken(_ token: String, removeWebhook: Bool) {
         let normalizedToken = token.trimmingCharacters(in: .whitespacesAndNewlines)
-        guard validTokenShape(normalizedToken) else {
+        guard RemoteCodingSettingsControls.validTokenShape(normalizedToken) else {
             showAttention(
                 "Token not saved",
                 detail: "That value does not match the BotFather token format. Copy the complete token and try again."
@@ -261,13 +284,13 @@ final class RemoteCodingViewController: NSViewController, ControlCenterPage {
                 if response?.partial_success == true {
                     self.showAttention(
                         "Telegram setup partially completed",
-                        detail: self.partialSetupRecovery(response)
+                        detail: RemoteCodingSettingsControls.partialSetupRecovery(response)
                     )
                     return
                 }
                 self.showAttention(
                     "Token not saved",
-                    detail: self.publicFailure(
+                    detail: RemoteCodingSettingsControls.publicFailure(
                         result.output,
                         fallback: "Telegram setup could not complete. Check the connection and SKS diagnostics, then try again."
                     )
@@ -280,6 +303,15 @@ final class RemoteCodingViewController: NSViewController, ControlCenterPage {
                     let receipt = try await restart.value
                     self?.endOperation()
                     self?.render(receipt)
+                    self?.settingsControls.renderSelectedBot(
+                        botID: response.bot_id ?? receipt.bot_id,
+                        username: response.bot_username,
+                        configured: true,
+                        identityValid: true
+                    )
+                    if response.bot_state_reset == true {
+                        self?.settingsControls.resetPairingCommand("Generate a new code because the selected bot changed.")
+                    }
                     let selectedBot = response.bot_username.map { "@\($0)" } ?? "The selected bot"
                     self?.showProgress(
                         "Bot verified and connected",
@@ -309,7 +341,7 @@ final class RemoteCodingViewController: NSViewController, ControlCenterPage {
             actionTitle: "Continue"
         ) { [weak self] confirmed in
             guard confirmed else { return }
-            self?.promptForToken(removeWebhook: true)
+            self?.promptForWebhookRemovalToken()
         }
     }
 
@@ -349,8 +381,13 @@ final class RemoteCodingViewController: NSViewController, ControlCenterPage {
     private func render(_ response: TelegramCenterDoctorResponse) {
         tokenConfigured = response.token_configured
         pollerRunning = response.poller.running
+        settingsControls.renderSelectedBot(
+            botID: response.bot_id,
+            configured: response.token_configured,
+            identityValid: response.bot_identity_valid
+        )
         let paired = response.paired_chat_count == 1 ? "1 paired chat" : "\(response.paired_chat_count) paired chats"
-        let source = tokenSourceDescription(response.token_source)
+        let source = RemoteCodingSettingsControls.tokenSourceDescription(response.token_source)
         if response.ok {
             NativeView.setBadge(serviceBadge, text: "Ready", color: .systemGreen)
             serviceDetail.stringValue = "Bot identity verified · \(source) · \(paired) · poller running · audit healthy."
@@ -384,8 +421,13 @@ final class RemoteCodingViewController: NSViewController, ControlCenterPage {
     private func render(_ receipt: TelegramLivenessReceipt) {
         tokenConfigured = receipt.token_configured
         pollerRunning = receipt.running && receipt.poller.running
+        settingsControls.renderSelectedBot(
+            botID: receipt.bot_id,
+            configured: receipt.token_configured,
+            identityValid: receipt.bot_identity_valid
+        )
         let paired = receipt.paired_chat_count == 1 ? "1 paired chat" : "\(receipt.paired_chat_count) paired chats"
-        let source = tokenSourceDescription(receipt.token_source.rawValue)
+        let source = RemoteCodingSettingsControls.tokenSourceDescription(receipt.token_source.rawValue)
         NativeView.setBadge(
             serviceBadge,
             text: pollerRunning ? "Running" : "Stopped",
@@ -424,7 +466,12 @@ final class RemoteCodingViewController: NSViewController, ControlCenterPage {
     }
 
     private func updateControls() {
-        setupButton.isEnabled = !operationInFlight
+        let environmentOverride = TelegramPrivateFileStore.operatorEnvironmentOverrideActive()
+        settingsControls.updateActionControls(
+            operationInFlight: operationInFlight,
+            tokenConfigured: tokenConfigured,
+            environmentOverride: environmentOverride
+        )
         pairButton.isEnabled = !operationInFlight && tokenConfigured && pollerRunning
         startButton.isEnabled = !operationInFlight && tokenConfigured && !pollerRunning
         stopButton.isEnabled = !operationInFlight && pollerRunning
@@ -432,9 +479,10 @@ final class RemoteCodingViewController: NSViewController, ControlCenterPage {
         refreshButton.isEnabled = !operationInFlight
     }
 
-    private func validTokenShape(_ value: String) -> Bool {
-        value.utf8.count <= 1024
-            && value.range(of: Self.tokenPattern, options: .regularExpression) != nil
+    func controlTextDidChange(_ notification: Notification) {
+        guard let field = notification.object as? NSTextField,
+              field === settingsControls.botTokenField else { return }
+        updateControls()
     }
 
     private func decode<T: Decodable>(_ type: T.Type, _ output: String) -> T? {
@@ -442,53 +490,4 @@ final class RemoteCodingViewController: NSViewController, ControlCenterPage {
         return try? JSONDecoder().decode(type, from: data)
     }
 
-    private func publicFailure(_ output: String, fallback: String) -> String {
-        guard let data = output.data(using: .utf8),
-              let row = try? JSONSerialization.jsonObject(with: data) as? [String: Any],
-              let error = row["error"] as? String else { return fallback }
-        switch error {
-        case "telegram_token_invalid", "telegram_token_stdin_empty":
-            return "That value is not a complete BotFather HTTP API token."
-        case "telegram_token_rejected":
-            return "Telegram rejected this token. In @BotFather, select the bot you want SKS to use and copy that bot's current complete token."
-        case "telegram_identity_verification_timeout":
-            return "Telegram identity verification timed out. Check the network connection and try the selected bot token again."
-        case "telegram_identity_verification_network_failed":
-            return "Telegram identity verification could not reach the Bot API. Check the network connection and try again."
-        case "telegram_identity_verification_failed":
-            return "Telegram returned an invalid bot identity response. Try the selected bot's current token again."
-        case let value where value.contains("401") || value.contains("Unauthorized"):
-            return "Telegram rejected this token. Copy the current token from @BotFather and try again."
-        case let value where value.contains("timeout") || value.contains("network"):
-            return "Telegram identity verification could not complete. Check the network connection and try again."
-        default:
-            return fallback
-        }
-    }
-
-    private func partialSetupRecovery(_ response: TelegramCenterSetupResponse?) -> String {
-        var parts: [String] = []
-        if response?.webhook_removed == true {
-            parts.append("The existing webhook was removed without dropping pending updates.")
-        }
-        if response?.bot_state_reset == true {
-            parts.append("Bot-scoped pairing and poll state were reset safely.")
-        }
-        if response?.token_stored == false {
-            parts.append("The token was not stored; rerun secure setup to finish.")
-        }
-        if let note = response?.recovery?.note, !note.isEmpty { parts.append(note) }
-        return parts.isEmpty
-            ? "Review the secret-free recovery status, then rerun secure setup."
-            : parts.joined(separator: " ")
-    }
-
-    private func tokenSourceDescription(_ source: String) -> String {
-        switch source {
-        case "env": return "operator environment token"
-        case "user_secret_file": return "private token file"
-        case "none": return "no token source"
-        default: return "token source unknown"
-        }
-    }
 }

package/dist/native/sks-menubar/Sources/TelegramSupport.swift

@@ -179,6 +179,7 @@ struct TelegramCenterDoctorResponse: Decodable {
     let status: String
     let token_configured: Bool
     let token_source: String
+    let bot_id: Int64?
     let bot_identity_valid: Bool
     let paired_chat_count: Int
     let audit_healthy: Bool

package/dist/scripts/install-surface-ssot-check.js

@@ -24,7 +24,7 @@ if (pluginVersion && packageVersion && pluginVersion !== packageVersion) {
     blockers.push(`marketplace_plugin_version_mismatch:${pluginVersion}!=${packageVersion}`);
 }
 else if (!pluginVersion) {
-    notes.push('marketplace_plugin_version_absent');
+    blockers.push('marketplace_plugin_version_absent');
 }
 else {
     notes.push(`marketplace_plugin_version_matches:${pluginVersion}`);
@@ -78,7 +78,7 @@ else {
 const report = {
     schema: 'sks.install-surface-ssot-check.v1',
     ok: blockers.length === 0,
-    install_ssot: 'npm:sneakoscope@latest',
+    install_ssot: 'package.json#version',
     package_version: packageVersion || null,
     plugin_version: pluginVersion || null,
     path_sks_version: pathVersion || null,

package/dist/scripts/release-metadata-check.js

@@ -43,6 +43,7 @@ const requiredPackageScripts = [
     'typecheck',
     'release:check',
     'release:metadata',
+    'release:version-truth',
     'release:check:affected',
     'release:check:fast',
     'release:check:confidence',
@@ -70,6 +71,7 @@ const requiredReleaseGates = [
     'commands:current-surface-only',
     'config:managed-merge',
     'docs:truthfulness',
+    'install-surface:ssot',
     'latest-version:guidance',
     'migration:current-surface-e2e',
     'migration:upgrade-safety',
@@ -83,6 +85,7 @@ const requiredReleaseGates = [
     'release:latency-slo',
     'release:proof-truth',
     'release:provenance',
+    'release:version-truth',
     'policy:gate-audit',
     'safety:mutation-callsite-coverage',
     'schema:check',

package/dist/scripts/release-version-truth-check.js

@@ -0,0 +1,149 @@
+#!/usr/bin/env node
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { assertGate, emitGate, root } from './gate-lib.js';
+const pkg = readJson('package.json');
+const expected = String(pkg.version || '');
+const mismatches = [];
+const warnings = [];
+let checked = 0;
+checkJson('package.json', 'version', pkg.version);
+const lock = readJson('package-lock.json');
+checkJson('package-lock.json', 'version', lock.version);
+checkJson('package-lock.json', 'packages[""].version', lock.packages?.['']?.version);
+const plugin = readJson('plugins/sks/.codex-plugin/plugin.json');
+checkJson('plugins/sks/.codex-plugin/plugin.json', 'version', plugin.version);
+checkRegex('src/core/version.ts', /PACKAGE_VERSION\s*=\s*['"]([^'"]+)['"]/, 'PACKAGE_VERSION');
+checkReExportOrRegex('src/core/fsx.ts', /PACKAGE_VERSION\s*}\s*from\s*['"]\.\/version(?:\.js)?['"]/, /PACKAGE_VERSION\s*=\s*['"]([^'"]+)['"]/, 'PACKAGE_VERSION');
+checkReExportOrRegex('src/bin/sks.ts', /PACKAGE_VERSION\s*}\s*from\s*['"]\.\.\/core\/version(?:\.js)?['"]/, /FAST_PACKAGE_VERSION\s*=\s*['"]([^'"]+)['"]/, 'FAST_PACKAGE_VERSION');
+checkRegex('crates/sks-core/Cargo.toml', /^version\s*=\s*"([^"]+)"/m, 'package.version');
+checkCargoLock('crates/sks-core/Cargo.lock', 'sks-core');
+const dist = readJson('dist/build-manifest.json', null);
+checkJson('dist/build-manifest.json', 'package_version', dist?.package_version);
+checkJson('dist/build-manifest.json', 'version', dist?.version);
+checkChangelog();
+checkReadme();
+checkReleaseMetadataScript();
+checkCargoMetadata();
+const ok = mismatches.length === 0;
+const report = {
+    schema: 'sks.release-version-truth.v1',
+    ok,
+    expected,
+    checked,
+    mismatches,
+    warnings,
+    generated_at: new Date().toISOString()
+};
+const out = path.join(root, '.sneakoscope', 'reports', 'release-version-truth.json');
+fs.mkdirSync(path.dirname(out), { recursive: true });
+fs.writeFileSync(out, `${JSON.stringify(report, null, 2)}\n`);
+assertGate(ok, 'release version truth mismatch', { expected, mismatches });
+emitGate('release:version-truth', { version: expected, checked, warnings: warnings.length });
+function checkJson(file, field, actual) {
+    checked += 1;
+    if (actual !== expected)
+        mismatch(file, field, actual);
+}
+function checkRegex(file, re, field) {
+    checked += 1;
+    const text = readText(file);
+    const match = text.match(re);
+    if (!match)
+        mismatch(file, field, null);
+    else if (match[1] !== expected)
+        mismatch(file, field, match[1]);
+}
+function checkReExportOrRegex(file, reExportRe, literalRe, field) {
+    const text = readText(file);
+    if (reExportRe.test(text)) {
+        checked += 1;
+        return;
+    }
+    checkRegex(file, literalRe, field);
+}
+function checkCargoLock(file, name) {
+    checked += 1;
+    const text = readText(file);
+    const block = text.split(/\n\[\[package\]\]\n/).find((part) => new RegExp(`name\\s*=\\s*"${escapeRe(name)}"`).test(part));
+    const match = block?.match(/version\s*=\s*"([^"]+)"/);
+    if (!match)
+        mismatch(file, `${name}.version`, null);
+    else if (match[1] !== expected)
+        mismatch(file, `${name}.version`, match[1]);
+}
+function checkChangelog() {
+    checked += 1;
+    const text = readText('CHANGELOG.md');
+    const latest = latestVersionedChangelogSection(text);
+    if (latest !== expected)
+        mismatch('CHANGELOG.md', 'latest release section', latest);
+}
+function checkReadme() {
+    checked += 1;
+    const text = readText('README.md');
+    const displayed = text.match(/\*\*SKS ([0-9]+\.[0-9]+\.[0-9]+)\*\*/)?.[1] || null;
+    if (!displayed)
+        mismatch('README.md', 'displayed current version', null);
+    else if (displayed !== expected)
+        mismatch('README.md', 'displayed current version', displayed);
+}
+function checkReleaseMetadataScript() {
+    checked += 1;
+    const script = String(pkg.scripts?.['release:metadata'] || '');
+    if (!script.includes('dist/scripts/release-metadata-check.js')) {
+        mismatch('package.json', 'scripts.release:metadata', script || null, 'node ./dist/scripts/release-metadata-check.js');
+    }
+}
+function checkCargoMetadata() {
+    checked += 1;
+    const res = spawnSync('cargo', ['metadata', '--no-deps', '--manifest-path', path.join(root, 'crates/sks-core/Cargo.toml'), '--format-version', '1'], {
+        cwd: root,
+        encoding: 'utf8',
+        timeout: 30000
+    });
+    if (res.status !== 0) {
+        warnings.push({ file: 'crates/sks-core/Cargo.toml', message: 'cargo metadata unavailable', stderr_tail: tail(res.stderr) });
+        return;
+    }
+    try {
+        const metadata = JSON.parse(res.stdout);
+        const crate = metadata.packages?.find((row) => row.name === 'sks-core');
+        if (crate?.version !== expected)
+            mismatch('cargo metadata', 'sks-core.version', crate?.version || null);
+    }
+    catch (err) {
+        warnings.push({ file: 'cargo metadata', message: `unparseable:${err instanceof Error ? err.message : String(err)}` });
+    }
+}
+function mismatch(file, field, actual, wanted = expected) {
+    mismatches.push({ file, field, expected: wanted, actual: actual ?? null });
+}
+function readJson(rel, fallback) {
+    try {
+        return JSON.parse(readText(rel));
+    }
+    catch (err) {
+        if (arguments.length > 1)
+            return fallback;
+        throw err;
+    }
+}
+function readText(rel) {
+    return fs.readFileSync(path.join(root, rel), 'utf8');
+}
+function escapeRe(value) {
+    return String(value).replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+function latestVersionedChangelogSection(text) {
+    for (const match of text.matchAll(/^## \[([^\]]+)\]/gm)) {
+        if (/^[0-9]+\.[0-9]+\.[0-9]+$/.test(match[1]))
+            return match[1];
+    }
+    return null;
+}
+function tail(value, limit = 1000) {
+    const text = String(value || '');
+    return text.length > limit ? text.slice(-limit) : text;
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "8.2.0",
+  "version": "8.2.1",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -40,6 +40,7 @@
     "!dist/scripts/**",
     "dist/scripts/canonical-test-runner.js",
     "dist/scripts/desktop-bridge-transport-client.js",
+    "dist/scripts/release-version-truth-check.js",
     "dist/scripts/{agent-guidance-dedup-check.js,agent-message-bus-reader-check.js,all-feature-deep-completion-check.js,appshots-thread-attachment-discovery-check.js,architecture-guard-check.js,certificate-sla-check.js,check-runtime-schemas.js,cli-output-consistency-check.js,codex-current-app-server-v2-check.js,codex-current-binary-identity-check.js,codex-current-capability-check.js,codex-current-core-real-probes-check.js,codex-current-manifest-check.js,codex-current-policy-check.js,codex-current-thread-store-check.js,codex-agent-role-rich-content-check.js,codex-agent-role-sync-check.js,codex-agent-type-routing-check.js,codex-app-execution-profile-check.js,codex-app-fast-ui-preservation-check.js,codex-app-handoff-check.js,codex-app-handoff-launch-check.js,codex-config-load-probe.js,context-graph-check.js,codex-control-all-pipelines-check.js,codex-control-event-stream-ledger-check.js,codex-control-tool-output-continuity-audit-check.js,desktop-bridge-transport-check.js,desktop-bridge-latency-check.js,desktop-bridge-capabilities-check.js,desktop-bridge-real-evidence-check.js,codex-native-agent-role-content-check.js,codex-native-feature-broker-blackbox.js,codex-native-feature-broker-check.js,codex-native-harness-compat-check.js,codex-native-hook-lifecycle-proof-check.js,codex-native-runtime-e2e-fixture.js,codex-plugin-app-template-policy-check.js,codex-sdk-all-pipelines-check.js,codex-sdk-backend-router-check.js,codex-sdk-capability-check.js,codex-sdk-event-stream-ledger-check.js,codex-sdk-real-smoke-check.js,concurrent-session-collision-check.js,context7-evidence-dedupe-check.js,core-skill-card-schema-check.js,core-skill-deployment-snapshot-check.js,core-skill-heldout-validation-check.js,core-skill-no-inference-optimizer-check.js,core-skill-patch-check.js,core-skill-route-runtime-integration-check.js,current-command-surface-check.js,current-surface-update-e2e-check.js,current-upgrade-matrix-check.js,desktop-bridge-unification-check.js,dfix-fixture-check.js,dfix-patch-handoff-check.js,dfix-verification-check.js,dfix-verification-recommendation-check.js,docs-truthfulness-check.js,doctor-codex-app-harness-check.js,doctor-fix-proves-codex-read-check.js,doctor-fixes-codex-app-fast-ui-check.js,evidence-flagship-coverage-check.js,fast-codex-service-tier-proof-check.js,fixtures/fake-codex-config-loader.js,gate-policy-audit-check.js,geo-claim-evidence-check.js,geo-cli-blackbox-check.js,geo-crawler-policy-check.js,git-worktree-checkpoint-check.js,git-worktree-cross-rebase-check.js,git-worktree-diff-envelope-check.js,git-worktree-dirty-lock-check.js,git-worktree-dirty-main-detection-check.js,git-worktree-integration-primary-check.js,git-worktree-manifest-append-check.js,git-worktree-untracked-diff-check.js,goal-artifact-compat-check.js,harness-benchmark-check.js,helper-dedup-check.js,hook-latency-budget-check.js,image-artifact-path-contract-check.js,imagegen-real-smoke-check.js,init-deep-backup-retention-check.js,installed-package-smoke-check.js,lib/codex-sdk-gate-lib.js,lib/ensure-dist-fresh.js,lib/git-worktree-fixture.js,lib/valid-png-fixture.js,local-collab-all-pipelines-final-gpt-check.js,loop-directive-check-lib.js,loop-integration-finalizer-check.js,loop-worker-fixture-child.js,mad-preflight-blocks-unreadable-config-check.js,mad-sks-app-ui-no-mutation-check.js}",
     "dist/scripts/{latest-version-guidance-check.js,mad-sks-launch-sql-plane-boundary-check.js,mad-sks-sql-plane-capability-check.js,mad-sks-sql-plane-lifecycle-hook-decision-check.js,mad-sks-sql-plane-result-lifecycle-check.js,managed-config-merge-check.js,mcp-plugin-inventory-check.js,model-call-concurrency-check.js,mutation-callsite-analysis.js,mutation-callsite-coverage-check.js,naruto-ssot-gate-aliases-check.js,naruto-ssot-pipeline-default-check.js,naruto-ssot-route-normalization-check.js,naruto-ssot-routing-check.js,naruto-worktree-coding-blackbox.js,native-capability-repair-matrix-check.js,native-image-generation-repair-check.js,official-subagent-workflow-check.js,package-published-contract-check.js,packlist-performance-check.js,pipeline-codex-native-doctor-mad-routing-check.js,pipeline-codex-native-doctor-mad-routing-real-blackbox.js,pipeline-codex-native-image-routing-check.js,pipeline-codex-native-image-routing-real-blackbox.js,pipeline-codex-native-loop-routing-check.js,pipeline-codex-native-loop-routing-real-blackbox.js,pipeline-codex-native-qa-routing-check.js,pipeline-codex-native-qa-routing-real-blackbox.js,pipeline-codex-native-research-routing-check.js,pipeline-codex-native-research-routing-real-blackbox.js,ppt-full-e2e-blackbox-check.js,ppt-real-export-adapter-check.js,ppt-real-imagegen-smoke-check.js,ppt-real-imagegen-wiring-check.js,ppt-reexport-rereview-check.js,prepublish-fast-check.js,publish-preflight.js,prepublish-release-check-or-fast.js,probe-memoization-check.js,product-design-plugin-routing-check.js,prompt-placeholder-guard-check.js,proof-root-cause-policy-check.js,provider-badge-context-check.js,python-codex-sdk-all-pipelines-check.js,qa-loop-app-handoff-capability-check.js,qa-loop-app-handoff-check.js,qa-loop-app-handoff-cli-check.js,qa-loop-app-handoff-confirmation-check.js,qa-loop-app-handoff-gate-lifecycle-check.js,qa-loop-app-handoff-launch-check.js,qa-loop-app-handoff-status-lifecycle-check.js,qa-loop-budget-policy-check.js,qa-loop-effort-escalation-check.js,qa-loop-execution-profile-routing-check.js,qa-loop-image-path-exposure-check.js,qa-loop-image-path-prompt-injection-check.js,release-affected-selector-check.js,release-aggressive-resource-governor-check.js,release-cache-glob-hashing-check.js,release-cache-input-classifier-check.js,release-cache-neutralization-report-check.js,release-cache-version-neutral-fixture-check.js,release-check-stamp.js,release-dynamic-presets-check.js,release-full-parallelism-blackbox.js,release-gate-batch-runner-check.js,release-gate-budget-check.js,release-gate-dag-runner-check.js,release-gate-dag-runner.js,release-latency-slo-check.js,release-metadata-check.js,release-pack-receipt.js,release-parallel-speed-budget-check.js,release-physical-gates-check.js,release-proof-truth-check.js,release-provenance-check.js,release-real-check.js,release-runtime-truth-matrix-check.js,release-speed-summary.js,research-blueprint-densifier-check.js,research-claim-builder-check.js,research-complete-package-fixture-check.js,research-execution-profile-routing-check.js,research-final-reviewer-blackbox.js,responses-retry-policy-centralized-check.js,runtime-proof-summary-check.js,runtime-script-pack-closure-check.js,scheduler-batch-dispatch-check.js,scheduler-parallel-proof-consistency-check.js,scheduler-utilization-integral-check.js,search-visibility-gate-lib.js,secret-preservation-check.js,seo-audit-fixture-check.js,seo-cli-blackbox-check.js,seo-geo-geo-disambiguation-check.js,seo-geo-route-identity-check.js,seo-geo-skill-rich-content-check.js,seo-no-mutation-by-default-check.js,shared-memory-fixture-check.js,side-effect-runtime-report-check.js,skill-name-canonicalizer-check.js,skill-surface-modernization-check.js,skills-manifest-continuity-check.js,sks-cli-gate-lib.js}",
     "dist/scripts/{real-execution-check-lib.js,gate-lib.js,runtime-domain-gate-lib.js,typed-routing-gate-lib.js,codex-native-gate-lib.js,skill-fixture-check-lib.js,sks-uninstall-regression-check.js,sksd-daemon-check.js,super-search-provider-interface-check.js,triwiki-cache-key-check.js,triwiki-proof-bank-blackbox.js,triwiki-proof-bank-check.js,triwiki-proof-card-check.js,trust-fixture-check.js,type-surface-codex-app-check.js,ultra-router-auto-router-check.js,uninstall-inventory-check.js,install-surface-ssot-check.js,ux-review-extract-wires-real-extractor-check.js,ux-review-imagegen-blackbox-check.js,ux-review-patch-diff-recheck-check.js,ux-review-real-imagegen-smoke-check.js,ux-review-run-wires-imagegen-check.js,wrongness-fixture-check.js}",

package/release-gates.v2.json

@@ -703,6 +703,43 @@
       ],
       "output_contract": "sks.gate-result.v2"
     },
+    {
+      "id": "release:version-truth",
+      "command": "node ./dist/scripts/release-version-truth-check.js",
+      "deps": [],
+      "resource": [
+        "cpu-light",
+        "fs-read"
+      ],
+      "side_effect": "hermetic",
+      "timeout_ms": 60000,
+      "cache": {
+        "enabled": false,
+        "inputs": [
+          "package.json",
+          "package-lock.json",
+          "plugins/sks/.codex-plugin/plugin.json",
+          "src/core/version.ts",
+          "src/core/fsx.ts",
+          "src/bin/sks.ts",
+          "crates/sks-core/Cargo.toml",
+          "crates/sks-core/Cargo.lock",
+          "dist/build-manifest.json",
+          "CHANGELOG.md",
+          "README.md",
+          "src/scripts/release-version-truth-check.ts"
+        ]
+      },
+      "isolation": {
+        "home": "temp",
+        "codex_home": "temp",
+        "report_dir": "per-gate"
+      },
+      "preset": [
+        "release"
+      ],
+      "output_contract": "sks.gate-result.v2"
+    },
     {
       "id": "install-surface:ssot",
       "command": "node ./dist/scripts/install-surface-ssot-check.js",
@@ -714,7 +751,7 @@
       "side_effect": "hermetic",
       "timeout_ms": 60000,
       "cache": {
-        "enabled": true,
+        "enabled": false,
         "inputs": [
           "package.json",
           "plugins/sks/.codex-plugin/plugin.json",
@@ -727,7 +764,7 @@
         "report_dir": "per-gate"
       },
       "preset": [
-        "confidence"
+        "release"
       ],
       "output_contract": "sks.gate-result.v2"
     },