sneakoscope 8.2.1 → 8.3.0

package/dist/scripts/codex-current-capability-check.js

@@ -4,14 +4,16 @@ import { CODEX_CURRENT_FEATURE_KEYS, detectCodexCurrentCapability, writeCodexCur
 const requireReal = process.argv.includes('--require-real') || process.env.SKS_REQUIRE_CODEX_CURRENT === '1';
 if (!requireReal)
     process.env.SKS_CODEX_CURRENT_FAKE = '1';
-const cap = await detectCodexCurrentCapability({ requireReal });
-assertGate(cap.ok === true, 'Current Codex 0.146.0 capability probe must pass', cap);
-assertGate(Object.keys(cap.feature_states).length === CODEX_CURRENT_FEATURE_KEYS.length, 'Current Codex 0.146.0 feature count mismatch', cap);
-assertGate(Object.values(cap.feature_states).every((state) => String(state.certainty) !== 'assumed_by_version'), 'Current Codex 0.146.0 capability must not use assumed_by_version evidence', cap);
+const artifact = requireReal
+    ? await writeCodexCurrentCapabilityArtifacts(process.cwd(), { requireReal: true })
+    : null;
+const cap = artifact?.report || await detectCodexCurrentCapability({ requireReal });
+assertGate(cap.ok === true, 'Current package-derived Codex capability probe must pass', cap);
+assertGate(Object.keys(cap.feature_states).length === CODEX_CURRENT_FEATURE_KEYS.length, 'Current Codex feature count mismatch', cap);
+assertGate(Object.values(cap.feature_states).every((state) => String(state.certainty) !== 'assumed_by_version'), 'Current Codex capability must not use assumed_by_version evidence', cap);
 if (requireReal) {
-    assertGate(cap.probe_mode === 'real-schema', 'Current Codex 0.146.0 require-real must use generated schema evidence', cap);
-    assertGate(cap.release_authorizing === true, 'Current Codex 0.146.0 require-real must be release-authorizing', cap);
-    await writeCodexCurrentCapabilityArtifacts(process.cwd(), { requireReal: true });
+    assertGate(cap.probe_mode === 'real-schema', 'Current Codex require-real must use generated schema evidence', cap);
+    assertGate(cap.release_authorizing === true, 'Current Codex require-real must be release-authorizing', cap);
 }
 emitGate('codex:current:capability', {
     features: CODEX_CURRENT_FEATURE_KEYS.length,

package/dist/scripts/codex-current-dependency-check.js

@@ -0,0 +1,21 @@
+#!/usr/bin/env node
+import { assertGate, emitGate, readJson } from './gate-lib.js';
+import { CURRENT_CODEX_RUNTIME_CONTRACT, codexSdkDependencyVersion } from '../core/codex-compat/codex-runtime-contract.js';
+const pkg = readJson('package.json');
+const lock = readJson('package-lock.json');
+const expected = codexSdkDependencyVersion();
+const lockSdk = lock.packages?.['node_modules/@openai/codex-sdk']?.version;
+const lockCli = lock.packages?.['node_modules/@openai/codex']?.version;
+const lockRootVersion = lock.packages?.['']?.version || lock.version;
+const packageFiles = Array.isArray(pkg.files) ? pkg.files.map(String) : [];
+assertGate(pkg.dependencies?.['@openai/codex-sdk'] === expected, 'package.json must pin @openai/codex-sdk to one exact semver', { expected });
+assertGate(lockSdk === expected, 'package-lock must resolve @openai/codex-sdk to the package.json pin', { expected, lockSdk });
+assertGate(lockCli === expected, 'package-lock must resolve @openai/codex to the SDK dependency version', { expected, lockCli });
+assertGate(pkg.version === lockRootVersion, 'package version must match package-lock root version', { version: pkg.version, lockRootVersion });
+assertGate(!packageFiles.some((entry) => entry.startsWith('config/codex-releases/')), 'package must not ship a second version-specific Codex release manifest', { packageFiles });
+assertGate(!packageFiles.some((entry) => entry.startsWith('schemas/codex/app-server-')), 'package must generate the current App Server schema from the resolved runtime instead of shipping a versioned snapshot', { packageFiles });
+emitGate('codex:current:dependency-graph', {
+    dependency_source: CURRENT_CODEX_RUNTIME_CONTRACT.dependencySource,
+    sdk_version: expected,
+    target_tag: CURRENT_CODEX_RUNTIME_CONTRACT.targetTag
+});

package/dist/scripts/docs-truthfulness-check.js

@@ -19,13 +19,13 @@ const files = [
     'docs/release-readiness.md'
 ];
 const required = {
-    'README.md': ['CHANGELOG.md', 'docs/release-readiness.md', 'gpt-image-2', 'Telegram Bot API', '`sks telegram pair`'],
+    'README.md': ['CHANGELOG.md', 'docs/release-readiness.md', 'gpt-image-2', 'https://paseo.sh/', 'paseo run --provider codex'],
     'CHANGELOG.md': ['1.14.0', 'DFix Extreme Speed Kernel', 'hook trust doctor', 'warning-zero'],
     'docs/computer-use-evidence.md': ['sks.computer-use-live-evidence.v1', 'probe_only', 'live_capture_blocked', 'local-only', 'Codex Chrome Extension'],
     'docs/codex-lb.md': ['durable_env_file', 'durable_keychain', 'shell_profile', 'process_only_ephemeral', 'base URL only'],
-    'docs/codex-cli-compat.md': ['rust-v0.146.0', 'minimumSupportedVersion', '0.146.0', 'SubagentStart', 'sks_zero_warning_disallowed', 'strict subset'],
-    'docs/codex-app.md': ['rust-v0.146.0', 'App Server v2', 'Codex Chrome Extension', 'gpt-image-2'],
-    'docs/official-docs-compat.md': ['official-docs-compat-report.js', 'rust-v0.146.0', 'gpt-image-2', 'input_fidelity', 'additionalProperties:false'],
+    'docs/codex-cli-compat.md': ['package.json', 'runtime-generated', 'SubagentStart', 'sks_zero_warning_disallowed', 'strict subset'],
+    'docs/codex-app.md': ['package.json', 'App Server v2', 'Codex Chrome Extension', 'gpt-image-2'],
+    'docs/official-docs-compat.md': ['official-docs-compat-report.js', 'runtime-generated', 'gpt-image-2', 'input_fidelity', 'additionalProperties:false'],
     'docs/hooks-pat.md': ['SubagentStop', 'strict subset', 'zero-warning'],
     'docs/goal-to-loop-migration.md': ['only persisted goal owner', 'creates no SKS mission', '--legacy-goal-runtime', 'fail with an instruction'],
     'docs/known-gaps.md': ['No P0', 'P1'],
@@ -91,21 +91,6 @@ for (const file of files) {
         forbidden: forbiddenMatches
     });
 }
-const readmeText = fs.readFileSync(path.join(root, 'README.md'), 'utf8');
-const telegramOnboardingSteps = [
-    'sks telegram setup --token-stdin',
-    'sks menubar restart',
-    'sks telegram pair --json',
-    '/sks status {}'
-];
-const telegramOnboardingIndexes = telegramOnboardingSteps.map((step) => readmeText.indexOf(step));
-const telegramOnboardingOrdered = telegramOnboardingIndexes.every((index, position) => index >= 0 && (position === 0 || index > telegramOnboardingIndexes[position - 1]));
-results.push({
-    file: 'README.md#telegram-onboarding-order',
-    ok: telegramOnboardingOrdered,
-    missing: telegramOnboardingOrdered ? [] : telegramOnboardingSteps,
-    forbidden: []
-});
 for (const file of currentDollarSurfaceFiles) {
     const full = path.join(root, file);
     const text = fs.existsSync(full) ? fs.readFileSync(full, 'utf8') : '';

package/dist/scripts/fast-codex-service-tier-proof-check.js

@@ -28,7 +28,6 @@ fs.writeFileSync(path.join(reportDir, 'worker-process-report.json'), `${JSON.str
 const proof = await fastMode.writeFastModePropagationProof(temp, { policy: fastMode.resolveFastModePolicy({ fastMode: true }) });
 const ok = args.includes('-c')
     && args.includes('service_tier=fast')
-    && !args.includes('--full-auto')
     && !args.includes('--dangerously-bypass-approvals-and-sandbox')
     && proof.ok === true;
 console.log(JSON.stringify({ schema: 'sks.fast-codex-service-tier-proof-check.v1', ok, args, proof }, null, 2));

package/dist/scripts/latest-version-guidance-check.js

@@ -5,7 +5,7 @@ import { assertGate, emitGate, importDist, root } from './gate-lib.js';
 const { scanLatestVersionGuidance, latestVersionGuidanceReport } = await importDist('core/policy/latest-version-guidance.js');
 const DOC_EXEMPT_RE = /(?:^|\/)(?:CHANGELOG|RECALLPULSE_[^/]*|known-gaps|release-proof-truth)\.md$|compat|codex-0|migration|legacy-upgrade|sks-4-migration|-tasks\.md$/i;
 const SOURCE_EXEMPT = new Set([
-    'src/core/codex-compat/codex-release-manifest.ts',
+    'src/core/codex-compat/codex-runtime-contract.ts',
     'src/core/release/npm-stage-tarball-verifier-support.ts'
 ]);
 const SOURCE_EXEMPT_DIR_RE = /^src\/(?:scripts|vendor|generated)\//;

package/dist/scripts/packlist-performance-check.js

@@ -62,7 +62,6 @@ const packProof = writeNpmPackProof(root, info, packMs);
 const runtimeManifest = JSON.parse(fs.readFileSync(path.join(root, 'runtime-required-scripts.json'), 'utf8'));
 const runtimeScriptClosure = analyzeRuntimeScriptPackClosure(root);
 const customerPayloadForbidden = [
-    'dist/core/telegram/controller.js',
     'dist/core/agents/agent-cleanup-executor.js',
     'dist/core/release/npm-stage-tarball-verifier.js',
     'dist/core/release/npm-stage-tarball-verifier-support.js'

package/dist/scripts/release-metadata-check.js

@@ -62,7 +62,7 @@ const requiredPackageScripts = [
 ];
 const requiredReleaseGates = [
     'architecture:guard',
-    'codex:current:manifest',
+    'codex:current:dependency-graph',
     'codex:current:binary-identity',
     'codex:current:policy',
     'codex:current:app-server-v2',

package/dist/vendor/openai-codex/latest/hooks/permission-request.command.input.schema.json

@@ -10,6 +10,12 @@
     }
   },
   "properties": {
+    "agent_id": {
+      "type": "string"
+    },
+    "agent_type": {
+      "type": "string"
+    },
     "cwd": {
       "type": "string"
     },

package/dist/vendor/openai-codex/latest/hooks/permission-request.command.output.schema.json

@@ -2,21 +2,6 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "additionalProperties": false,
   "definitions": {
-    "HookEventNameWire": {
-      "enum": [
-        "PreToolUse",
-        "PermissionRequest",
-        "PostToolUse",
-        "PreCompact",
-        "PostCompact",
-        "SessionStart",
-        "UserPromptSubmit",
-        "SubagentStart",
-        "SubagentStop",
-        "Stop"
-      ],
-      "type": "string"
-    },
     "PermissionRequestBehaviorWire": {
       "enum": [
         "allow",
@@ -65,7 +50,8 @@
           "default": null
         },
         "hookEventName": {
-          "$ref": "#/definitions/HookEventNameWire"
+          "const": "PermissionRequest",
+          "type": "string"
         }
       },
       "required": [

package/dist/vendor/openai-codex/latest/hooks/post-compact.command.input.schema.json

@@ -10,6 +10,12 @@
     }
   },
   "properties": {
+    "agent_id": {
+      "type": "string"
+    },
+    "agent_type": {
+      "type": "string"
+    },
     "cwd": {
       "type": "string"
     },

package/dist/vendor/openai-codex/latest/hooks/post-tool-use.command.input.schema.json

@@ -10,6 +10,12 @@
     }
   },
   "properties": {
+    "agent_id": {
+      "type": "string"
+    },
+    "agent_type": {
+      "type": "string"
+    },
     "cwd": {
       "type": "string"
     },

package/dist/vendor/openai-codex/latest/hooks/post-tool-use.command.output.schema.json

@@ -8,21 +8,6 @@
       ],
       "type": "string"
     },
-    "HookEventNameWire": {
-      "enum": [
-        "PreToolUse",
-        "PermissionRequest",
-        "PostToolUse",
-        "PreCompact",
-        "PostCompact",
-        "SessionStart",
-        "UserPromptSubmit",
-        "SubagentStart",
-        "SubagentStop",
-        "Stop"
-      ],
-      "type": "string"
-    },
     "PostToolUseHookSpecificOutputWire": {
       "additionalProperties": false,
       "properties": {
@@ -31,7 +16,8 @@
           "type": "string"
         },
         "hookEventName": {
-          "$ref": "#/definitions/HookEventNameWire"
+          "const": "PostToolUse",
+          "type": "string"
         },
         "updatedMCPToolOutput": {
           "default": null

package/dist/vendor/openai-codex/latest/hooks/pre-compact.command.input.schema.json

@@ -10,6 +10,12 @@
     }
   },
   "properties": {
+    "agent_id": {
+      "type": "string"
+    },
+    "agent_type": {
+      "type": "string"
+    },
     "cwd": {
       "type": "string"
     },

package/dist/vendor/openai-codex/latest/hooks/pre-tool-use.command.input.schema.json

@@ -10,6 +10,12 @@
     }
   },
   "properties": {
+    "agent_id": {
+      "type": "string"
+    },
+    "agent_type": {
+      "type": "string"
+    },
     "cwd": {
       "type": "string"
     },

package/dist/vendor/openai-codex/latest/hooks/pre-tool-use.command.output.schema.json

@@ -2,21 +2,6 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "additionalProperties": false,
   "definitions": {
-    "HookEventNameWire": {
-      "enum": [
-        "PreToolUse",
-        "PermissionRequest",
-        "PostToolUse",
-        "PreCompact",
-        "PostCompact",
-        "SessionStart",
-        "UserPromptSubmit",
-        "SubagentStart",
-        "SubagentStop",
-        "Stop"
-      ],
-      "type": "string"
-    },
     "PreToolUseDecisionWire": {
       "enum": [
         "approve",
@@ -32,7 +17,8 @@
           "type": "string"
         },
         "hookEventName": {
-          "$ref": "#/definitions/HookEventNameWire"
+          "const": "PreToolUse",
+          "type": "string"
         },
         "permissionDecision": {
           "allOf": [

package/dist/vendor/openai-codex/latest/hooks/session-start.command.output.schema.json

@@ -2,21 +2,6 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "additionalProperties": false,
   "definitions": {
-    "HookEventNameWire": {
-      "enum": [
-        "PreToolUse",
-        "PermissionRequest",
-        "PostToolUse",
-        "PreCompact",
-        "PostCompact",
-        "SessionStart",
-        "UserPromptSubmit",
-        "SubagentStart",
-        "SubagentStop",
-        "Stop"
-      ],
-      "type": "string"
-    },
     "SessionStartHookSpecificOutputWire": {
       "additionalProperties": false,
       "properties": {
@@ -25,7 +10,8 @@
           "type": "string"
         },
         "hookEventName": {
-          "$ref": "#/definitions/HookEventNameWire"
+          "const": "SessionStart",
+          "type": "string"
         }
       },
       "required": [

package/dist/vendor/openai-codex/latest/hooks/snapshot-metadata.json

@@ -3,9 +3,10 @@
   "upstream": "openai/codex",
   "upstream_url": "https://github.com/openai/codex",
   "tag": "latest",
-  "commit": "791b69dd53703e928cbbda4ca41cfc795b7397b0",
-  "codex_version": "main-2026-05-21",
-  "captured_at": "2026-05-21T11:46:38Z",
+  "source_tag": "rust-v0.147.0",
+  "commit": "be6e8eac029b183056b7e4402879f15d2c85f61b",
+  "codex_version": "0.147.0",
+  "captured_at": "2026-08-07T05:18:28Z",
   "schema_files_count": 20,
   "events": [
     "PreToolUse",
@@ -21,7 +22,8 @@
   ],
   "source_path": "codex-rs/hooks/schema/generated",
   "notes": [
-    "Captured from upstream OpenAI Codex HEAD using vendored generated hook schema fixtures.",
-    "SubagentStart and SubagentStop are release-blocking events for SKS 1.14.1 hook compatibility."
+    "Captured from the current package-tracked upstream OpenAI Codex release using generated hook schema fixtures.",
+    "The latest directory is version-neutral; source_tag and commit preserve capture provenance.",
+    "SubagentStart and SubagentStop are release-blocking events for SKS hook compatibility."
   ]
 }

package/dist/vendor/openai-codex/latest/hooks/subagent-start.command.output.schema.json

@@ -2,22 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "additionalProperties": false,
   "definitions": {
-    "HookEventNameWire": {
-      "enum": [
-        "PreToolUse",
-        "PermissionRequest",
-        "PostToolUse",
-        "PreCompact",
-        "PostCompact",
-        "SessionStart",
-        "UserPromptSubmit",
-        "SubagentStart",
-        "SubagentStop",
-        "Stop"
-      ],
-      "type": "string"
-    },
-    "SessionStartHookSpecificOutputWire": {
+    "SubagentStartHookSpecificOutputWire": {
       "additionalProperties": false,
       "properties": {
         "additionalContext": {
@@ -25,7 +10,8 @@
           "type": "string"
         },
         "hookEventName": {
-          "$ref": "#/definitions/HookEventNameWire"
+          "const": "SubagentStart",
+          "type": "string"
         }
       },
       "required": [
@@ -42,7 +28,7 @@
     "hookSpecificOutput": {
       "allOf": [
         {
-          "$ref": "#/definitions/SessionStartHookSpecificOutputWire"
+          "$ref": "#/definitions/SubagentStartHookSpecificOutputWire"
         }
       ],
       "default": null

package/dist/vendor/openai-codex/latest/hooks/user-prompt-submit.command.input.schema.json

@@ -10,6 +10,12 @@
     }
   },
   "properties": {
+    "agent_id": {
+      "type": "string"
+    },
+    "agent_type": {
+      "type": "string"
+    },
     "cwd": {
       "type": "string"
     },

package/dist/vendor/openai-codex/latest/hooks/user-prompt-submit.command.output.schema.json

@@ -8,21 +8,6 @@
       ],
       "type": "string"
     },
-    "HookEventNameWire": {
-      "enum": [
-        "PreToolUse",
-        "PermissionRequest",
-        "PostToolUse",
-        "PreCompact",
-        "PostCompact",
-        "SessionStart",
-        "UserPromptSubmit",
-        "SubagentStart",
-        "SubagentStop",
-        "Stop"
-      ],
-      "type": "string"
-    },
     "UserPromptSubmitHookSpecificOutputWire": {
       "additionalProperties": false,
       "properties": {
@@ -31,7 +16,8 @@
           "type": "string"
         },
         "hookEventName": {
-          "$ref": "#/definitions/HookEventNameWire"
+          "const": "UserPromptSubmit",
+          "type": "string"
         }
       },
       "required": [

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "8.2.1",
+  "version": "8.3.0",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",
@@ -41,7 +41,7 @@
     "dist/scripts/canonical-test-runner.js",
     "dist/scripts/desktop-bridge-transport-client.js",
     "dist/scripts/release-version-truth-check.js",
-    "dist/scripts/{agent-guidance-dedup-check.js,agent-message-bus-reader-check.js,all-feature-deep-completion-check.js,appshots-thread-attachment-discovery-check.js,architecture-guard-check.js,certificate-sla-check.js,check-runtime-schemas.js,cli-output-consistency-check.js,codex-current-app-server-v2-check.js,codex-current-binary-identity-check.js,codex-current-capability-check.js,codex-current-core-real-probes-check.js,codex-current-manifest-check.js,codex-current-policy-check.js,codex-current-thread-store-check.js,codex-agent-role-rich-content-check.js,codex-agent-role-sync-check.js,codex-agent-type-routing-check.js,codex-app-execution-profile-check.js,codex-app-fast-ui-preservation-check.js,codex-app-handoff-check.js,codex-app-handoff-launch-check.js,codex-config-load-probe.js,context-graph-check.js,codex-control-all-pipelines-check.js,codex-control-event-stream-ledger-check.js,codex-control-tool-output-continuity-audit-check.js,desktop-bridge-transport-check.js,desktop-bridge-latency-check.js,desktop-bridge-capabilities-check.js,desktop-bridge-real-evidence-check.js,codex-native-agent-role-content-check.js,codex-native-feature-broker-blackbox.js,codex-native-feature-broker-check.js,codex-native-harness-compat-check.js,codex-native-hook-lifecycle-proof-check.js,codex-native-runtime-e2e-fixture.js,codex-plugin-app-template-policy-check.js,codex-sdk-all-pipelines-check.js,codex-sdk-backend-router-check.js,codex-sdk-capability-check.js,codex-sdk-event-stream-ledger-check.js,codex-sdk-real-smoke-check.js,concurrent-session-collision-check.js,context7-evidence-dedupe-check.js,core-skill-card-schema-check.js,core-skill-deployment-snapshot-check.js,core-skill-heldout-validation-check.js,core-skill-no-inference-optimizer-check.js,core-skill-patch-check.js,core-skill-route-runtime-integration-check.js,current-command-surface-check.js,current-surface-update-e2e-check.js,current-upgrade-matrix-check.js,desktop-bridge-unification-check.js,dfix-fixture-check.js,dfix-patch-handoff-check.js,dfix-verification-check.js,dfix-verification-recommendation-check.js,docs-truthfulness-check.js,doctor-codex-app-harness-check.js,doctor-fix-proves-codex-read-check.js,doctor-fixes-codex-app-fast-ui-check.js,evidence-flagship-coverage-check.js,fast-codex-service-tier-proof-check.js,fixtures/fake-codex-config-loader.js,gate-policy-audit-check.js,geo-claim-evidence-check.js,geo-cli-blackbox-check.js,geo-crawler-policy-check.js,git-worktree-checkpoint-check.js,git-worktree-cross-rebase-check.js,git-worktree-diff-envelope-check.js,git-worktree-dirty-lock-check.js,git-worktree-dirty-main-detection-check.js,git-worktree-integration-primary-check.js,git-worktree-manifest-append-check.js,git-worktree-untracked-diff-check.js,goal-artifact-compat-check.js,harness-benchmark-check.js,helper-dedup-check.js,hook-latency-budget-check.js,image-artifact-path-contract-check.js,imagegen-real-smoke-check.js,init-deep-backup-retention-check.js,installed-package-smoke-check.js,lib/codex-sdk-gate-lib.js,lib/ensure-dist-fresh.js,lib/git-worktree-fixture.js,lib/valid-png-fixture.js,local-collab-all-pipelines-final-gpt-check.js,loop-directive-check-lib.js,loop-integration-finalizer-check.js,loop-worker-fixture-child.js,mad-preflight-blocks-unreadable-config-check.js,mad-sks-app-ui-no-mutation-check.js}",
+    "dist/scripts/{agent-guidance-dedup-check.js,agent-message-bus-reader-check.js,all-feature-deep-completion-check.js,appshots-thread-attachment-discovery-check.js,architecture-guard-check.js,certificate-sla-check.js,check-runtime-schemas.js,cli-output-consistency-check.js,codex-current-app-server-v2-check.js,codex-current-binary-identity-check.js,codex-current-capability-check.js,codex-current-core-real-probes-check.js,codex-current-dependency-check.js,codex-current-policy-check.js,codex-current-thread-store-check.js,codex-agent-role-rich-content-check.js,codex-agent-role-sync-check.js,codex-agent-type-routing-check.js,codex-app-execution-profile-check.js,codex-app-fast-ui-preservation-check.js,codex-app-handoff-check.js,codex-app-handoff-launch-check.js,codex-config-load-probe.js,context-graph-check.js,codex-control-all-pipelines-check.js,codex-control-event-stream-ledger-check.js,codex-control-tool-output-continuity-audit-check.js,desktop-bridge-transport-check.js,desktop-bridge-latency-check.js,desktop-bridge-capabilities-check.js,desktop-bridge-real-evidence-check.js,codex-native-agent-role-content-check.js,codex-native-feature-broker-blackbox.js,codex-native-feature-broker-check.js,codex-native-harness-compat-check.js,codex-native-hook-lifecycle-proof-check.js,codex-native-runtime-e2e-fixture.js,codex-plugin-app-template-policy-check.js,codex-sdk-all-pipelines-check.js,codex-sdk-backend-router-check.js,codex-sdk-capability-check.js,codex-sdk-event-stream-ledger-check.js,codex-sdk-real-smoke-check.js,concurrent-session-collision-check.js,context7-evidence-dedupe-check.js,core-skill-card-schema-check.js,core-skill-deployment-snapshot-check.js,core-skill-heldout-validation-check.js,core-skill-no-inference-optimizer-check.js,core-skill-patch-check.js,core-skill-route-runtime-integration-check.js,current-command-surface-check.js,current-surface-update-e2e-check.js,current-upgrade-matrix-check.js,desktop-bridge-unification-check.js,dfix-fixture-check.js,dfix-patch-handoff-check.js,dfix-verification-check.js,dfix-verification-recommendation-check.js,docs-truthfulness-check.js,doctor-codex-app-harness-check.js,doctor-fix-proves-codex-read-check.js,doctor-fixes-codex-app-fast-ui-check.js,evidence-flagship-coverage-check.js,fast-codex-service-tier-proof-check.js,fixtures/fake-codex-config-loader.js,gate-policy-audit-check.js,geo-claim-evidence-check.js,geo-cli-blackbox-check.js,geo-crawler-policy-check.js,git-worktree-checkpoint-check.js,git-worktree-cross-rebase-check.js,git-worktree-diff-envelope-check.js,git-worktree-dirty-lock-check.js,git-worktree-dirty-main-detection-check.js,git-worktree-integration-primary-check.js,git-worktree-manifest-append-check.js,git-worktree-untracked-diff-check.js,goal-artifact-compat-check.js,harness-benchmark-check.js,helper-dedup-check.js,hook-latency-budget-check.js,image-artifact-path-contract-check.js,imagegen-real-smoke-check.js,init-deep-backup-retention-check.js,installed-package-smoke-check.js,lib/codex-sdk-gate-lib.js,lib/ensure-dist-fresh.js,lib/git-worktree-fixture.js,lib/valid-png-fixture.js,local-collab-all-pipelines-final-gpt-check.js,loop-directive-check-lib.js,loop-integration-finalizer-check.js,loop-worker-fixture-child.js,mad-preflight-blocks-unreadable-config-check.js,mad-sks-app-ui-no-mutation-check.js}",
     "dist/scripts/{latest-version-guidance-check.js,mad-sks-launch-sql-plane-boundary-check.js,mad-sks-sql-plane-capability-check.js,mad-sks-sql-plane-lifecycle-hook-decision-check.js,mad-sks-sql-plane-result-lifecycle-check.js,managed-config-merge-check.js,mcp-plugin-inventory-check.js,model-call-concurrency-check.js,mutation-callsite-analysis.js,mutation-callsite-coverage-check.js,naruto-ssot-gate-aliases-check.js,naruto-ssot-pipeline-default-check.js,naruto-ssot-route-normalization-check.js,naruto-ssot-routing-check.js,naruto-worktree-coding-blackbox.js,native-capability-repair-matrix-check.js,native-image-generation-repair-check.js,official-subagent-workflow-check.js,package-published-contract-check.js,packlist-performance-check.js,pipeline-codex-native-doctor-mad-routing-check.js,pipeline-codex-native-doctor-mad-routing-real-blackbox.js,pipeline-codex-native-image-routing-check.js,pipeline-codex-native-image-routing-real-blackbox.js,pipeline-codex-native-loop-routing-check.js,pipeline-codex-native-loop-routing-real-blackbox.js,pipeline-codex-native-qa-routing-check.js,pipeline-codex-native-qa-routing-real-blackbox.js,pipeline-codex-native-research-routing-check.js,pipeline-codex-native-research-routing-real-blackbox.js,ppt-full-e2e-blackbox-check.js,ppt-real-export-adapter-check.js,ppt-real-imagegen-smoke-check.js,ppt-real-imagegen-wiring-check.js,ppt-reexport-rereview-check.js,prepublish-fast-check.js,publish-preflight.js,prepublish-release-check-or-fast.js,probe-memoization-check.js,product-design-plugin-routing-check.js,prompt-placeholder-guard-check.js,proof-root-cause-policy-check.js,provider-badge-context-check.js,python-codex-sdk-all-pipelines-check.js,qa-loop-app-handoff-capability-check.js,qa-loop-app-handoff-check.js,qa-loop-app-handoff-cli-check.js,qa-loop-app-handoff-confirmation-check.js,qa-loop-app-handoff-gate-lifecycle-check.js,qa-loop-app-handoff-launch-check.js,qa-loop-app-handoff-status-lifecycle-check.js,qa-loop-budget-policy-check.js,qa-loop-effort-escalation-check.js,qa-loop-execution-profile-routing-check.js,qa-loop-image-path-exposure-check.js,qa-loop-image-path-prompt-injection-check.js,release-affected-selector-check.js,release-aggressive-resource-governor-check.js,release-cache-glob-hashing-check.js,release-cache-input-classifier-check.js,release-cache-neutralization-report-check.js,release-cache-version-neutral-fixture-check.js,release-check-stamp.js,release-dynamic-presets-check.js,release-full-parallelism-blackbox.js,release-gate-batch-runner-check.js,release-gate-budget-check.js,release-gate-dag-runner-check.js,release-gate-dag-runner.js,release-latency-slo-check.js,release-metadata-check.js,release-pack-receipt.js,release-parallel-speed-budget-check.js,release-physical-gates-check.js,release-proof-truth-check.js,release-provenance-check.js,release-real-check.js,release-runtime-truth-matrix-check.js,release-speed-summary.js,research-blueprint-densifier-check.js,research-claim-builder-check.js,research-complete-package-fixture-check.js,research-execution-profile-routing-check.js,research-final-reviewer-blackbox.js,responses-retry-policy-centralized-check.js,runtime-proof-summary-check.js,runtime-script-pack-closure-check.js,scheduler-batch-dispatch-check.js,scheduler-parallel-proof-consistency-check.js,scheduler-utilization-integral-check.js,search-visibility-gate-lib.js,secret-preservation-check.js,seo-audit-fixture-check.js,seo-cli-blackbox-check.js,seo-geo-geo-disambiguation-check.js,seo-geo-route-identity-check.js,seo-geo-skill-rich-content-check.js,seo-no-mutation-by-default-check.js,shared-memory-fixture-check.js,side-effect-runtime-report-check.js,skill-name-canonicalizer-check.js,skill-surface-modernization-check.js,skills-manifest-continuity-check.js,sks-cli-gate-lib.js}",
     "dist/scripts/{real-execution-check-lib.js,gate-lib.js,runtime-domain-gate-lib.js,typed-routing-gate-lib.js,codex-native-gate-lib.js,skill-fixture-check-lib.js,sks-uninstall-regression-check.js,sksd-daemon-check.js,super-search-provider-interface-check.js,triwiki-cache-key-check.js,triwiki-proof-bank-blackbox.js,triwiki-proof-bank-check.js,triwiki-proof-card-check.js,trust-fixture-check.js,type-surface-codex-app-check.js,ultra-router-auto-router-check.js,uninstall-inventory-check.js,install-surface-ssot-check.js,ux-review-extract-wires-real-extractor-check.js,ux-review-imagegen-blackbox-check.js,ux-review-patch-diff-recheck-check.js,ux-review-real-imagegen-smoke-check.js,ux-review-run-wires-imagegen-check.js,wrongness-fixture-check.js}",
     "dist/scripts/check-publish-tag.js",
@@ -55,8 +55,6 @@
     "!dist/core/proof/route-finalizer-fixtures.js",
     "!dist/core/release/npm-stage-tarball-verifier.js",
     "!dist/core/release/npm-stage-tarball-verifier-support.js",
-    "!dist/vendor/openai-codex/rust-v0.131.0",
-    "config/codex-releases/rust-v0.146.0.json",
     "config/installed-public-surface-closure.v1.json",
     "config/competitor-scorecard-baseline.json",
     "config/architecture-budgets.v1.json",
@@ -66,8 +64,6 @@
     "infra-harness-gates.json",
     "runtime-required-scripts.json",
     "schemas",
-    "!schemas/codex/app-server-*/**",
-    "schemas/codex/app-server-0.146/codex_app_server_protocol.v2.schemas.json",
     "crates/sks-core/Cargo.lock",
     "crates/sks-core/Cargo.toml",
     "crates/sks-core/src",
@@ -203,7 +199,7 @@
   "dependencies": {
     "@modelcontextprotocol/client": "2.0.0",
     "@modelcontextprotocol/server": "2.0.0",
-    "@openai/codex-sdk": "0.146.0",
+    "@openai/codex-sdk": "0.147.0",
     "smol-toml": "^1.7.0",
     "typescript": "^5.9.3"
   },

package/release-gates.v2.json

@@ -1837,9 +1837,7 @@
           "src/core/codex-compat/**",
           "src/core/codex-runtime/**",
           "src/core/codex-app-server/**",
-          "config/codex-releases/**",
-          "schemas/codex-*.json",
-          "schemas/codex/**"
+          "schemas/codex-*.json"
         ]
       },
       "isolation": {
@@ -3805,8 +3803,8 @@
       "output_contract": "sks.gate-result.v2"
     },
     {
-      "id": "codex:current:manifest",
-      "command": "node ./dist/scripts/codex-current-manifest-check.js",
+      "id": "codex:current:dependency-graph",
+      "command": "node ./dist/scripts/codex-current-dependency-check.js",
       "deps": [],
       "resource": [
         "cpu-light",
@@ -3822,9 +3820,7 @@
           "release-gates.v2.json",
           "src/core/codex-control/**",
           "src/core/codex-compat/**",
-          "src/core/codex-runtime/**",
-          "config/codex-releases/**",
-          "schemas/codex/**"
+          "src/core/codex-runtime/**"
         ]
       },
       "isolation": {
@@ -3841,7 +3837,7 @@
       "id": "codex:current:binary-identity",
       "command": "node ./dist/scripts/codex-current-binary-identity-check.js",
       "deps": [
-        "codex:current:manifest"
+        "codex:current:dependency-graph"
       ],
       "resource": [
         "cpu-light",
@@ -3874,7 +3870,7 @@
       "id": "codex:current:policy",
       "command": "node ./dist/scripts/codex-current-policy-check.js",
       "deps": [
-        "codex:current:manifest"
+        "codex:current:dependency-graph"
       ],
       "resource": [
         "cpu-light",
@@ -3905,7 +3901,7 @@
       "id": "codex:current:app-server-v2",
       "command": "node ./dist/scripts/codex-current-app-server-v2-check.js",
       "deps": [
-        "codex:current:manifest"
+        "codex:current:dependency-graph"
       ],
       "resource": [
         "cpu-light",
@@ -3920,7 +3916,6 @@
           "release-gates.v2.json",
           "src/core/codex-control/**",
           "src/core/codex-compat/**",
-          "schemas/codex/app-server-0.146/**",
           "src/scripts/codex-current-app-server-v2-check.ts"
         ]
       },
@@ -3938,7 +3933,7 @@
       "id": "codex:current:thread-store",
       "command": "node ./dist/scripts/codex-current-thread-store-check.js",
       "deps": [
-        "codex:current:manifest"
+        "codex:current:dependency-graph"
       ],
       "resource": [
         "cpu-light",
@@ -3969,7 +3964,7 @@
       "id": "codex:current:capability",
       "command": "node ./dist/scripts/codex-current-capability-check.js",
       "deps": [
-        "codex:current:manifest",
+        "codex:current:dependency-graph",
         "codex:current:binary-identity",
         "codex:current:app-server-v2"
       ],
@@ -3987,9 +3982,7 @@
           "release-gates.v2.json",
           "src/core/codex-control/**",
           "src/core/codex-compat/**",
-          "src/core/codex-runtime/**",
-          "config/codex-releases/**",
-          "schemas/codex/app-server-0.146/**"
+          "src/core/codex-runtime/**"
         ]
       },
       "isolation": {