sneakoscope 8.3.2 → 8.4.0

package/dist/core/release/content-digest-cache.js

@@ -0,0 +1,70 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+export const CONTENT_DIGEST_CACHE_SCHEMA = 'sks.content-digest-cache.v1';
+export const CONTENT_DIGEST_CACHE_ENV = 'SKS_RELEASE_CONTENT_DIGEST_CACHE';
+const processMemo = new Map();
+export function contentDigestCacheEnabled() {
+    return process.env[CONTENT_DIGEST_CACHE_ENV] !== '0';
+}
+export function contentDigestCachePath(root) {
+    return path.join(root, '.sneakoscope', 'cache', 'release-digests.json');
+}
+export function statFingerprint(root, files) {
+    const hash = crypto.createHash('sha256');
+    for (const file of files) {
+        let stat;
+        try {
+            stat = fs.statSync(path.isAbsolute(file) ? file : path.join(root, file), { bigint: true });
+        }
+        catch {
+            hash.update(`${file}\0missing\0`);
+            continue;
+        }
+        hash.update(`${file}\0${stat.size}\0${stat.mtimeNs}\0${stat.ino}\0`);
+    }
+    return hash.digest('hex');
+}
+export function cachedByFingerprint(root, bucket, fingerprint, compute) {
+    if (!contentDigestCacheEnabled())
+        return compute();
+    const memoKey = `${path.resolve(root)}\0${bucket}`;
+    const memo = processMemo.get(memoKey);
+    if (memo?.fingerprint === fingerprint)
+        return structuredClone(memo.value);
+    const document = readCache(root);
+    const stored = document.entries[bucket];
+    if (stored && stored.fingerprint === fingerprint) {
+        processMemo.set(memoKey, { fingerprint, value: stored.value });
+        return structuredClone(stored.value);
+    }
+    const value = compute();
+    processMemo.set(memoKey, { fingerprint, value });
+    writeCache(root, bucket, fingerprint, value);
+    return value;
+}
+export function clearContentDigestProcessMemo() {
+    processMemo.clear();
+}
+function readCache(root) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(contentDigestCachePath(root), 'utf8'));
+        if (parsed?.schema === CONTENT_DIGEST_CACHE_SCHEMA && parsed.entries && typeof parsed.entries === 'object')
+            return parsed;
+    }
+    catch { }
+    return { schema: CONTENT_DIGEST_CACHE_SCHEMA, entries: {} };
+}
+function writeCache(root, bucket, fingerprint, value) {
+    const file = contentDigestCachePath(root);
+    try {
+        const document = readCache(root);
+        document.entries[bucket] = { fingerprint, value, recorded_at: new Date().toISOString() };
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        const temp = `${file}.${process.pid}.tmp`;
+        fs.writeFileSync(temp, `${JSON.stringify(document, null, 2)}\n`);
+        fs.renameSync(temp, file);
+    }
+    catch {
+    }
+}

package/dist/core/release/gate-manifest.js

@@ -65,6 +65,15 @@ function costFor(id) {
 export function affectedGlobsFor(id) {
     const prefix = id.split(':')[0];
     switch (prefix) {
+        case 'architecture-map':
+            return [
+                'src/core/triwiki/context-graph/architecture/**',
+                'src/core/triwiki/context-graph/projections/mermaid/**',
+                'src/core/triwiki/context-graph/store/architecture-map-store.ts',
+                'src/scripts/architecture-map-check.ts',
+                'config/architecture-map-policy.v1.json',
+                'package.json'
+            ];
         case 'architecture':
             return ['src/core/safety/ssot-guard.ts', 'src/core/pipeline-internals/runtime-core.ts', 'src/core/pipeline-internals/runtime-gates.ts', 'src/core/commands/naruto-command.ts', 'src/scripts/release-parallel-check.ts', 'src/scripts/architecture-guard-check.ts', 'docs/architecture-ts-rust-boundary.md', 'package.json'];
         case 'core-skill':

package/dist/core/release/main-push-guard.js

@@ -1,11 +1,12 @@
 import path from 'node:path';
+import { sameFilesystemPathSync } from '../fsx.js';
 import { readMacosMenubarProof, validateMacosMenubarProofArtifacts } from './macos-menubar-proof.js';
 import { fileSha256, gitOk, gitText, readJson, relative, unique } from './release-proof-io.js';
 import { releaseOriginIdentity } from './release-origin.js';
 import { releaseProofDir, validateLocalReleasePackBinding } from './release-pack-receipt.js';
 import { validatePhysicalReleaseGateInspection } from './physical-release-gates.js';
 import { validateFullReleaseStamp } from './release-stamp-proof.js';
-import { RELEASE_UPGRADE_BASELINE_SHA256, RELEASE_UPGRADE_BASELINE_VERSION, releaseUpgradeExpectedVersion, releaseUpgradeProofFilename } from './release-upgrade-baseline.js';
+import { RELEASE_UPGRADE_BASELINE_SHA256, RELEASE_UPGRADE_BASELINE_VERSION, isExpectedReleaseUpgradeLaunchctlCall, releaseUpgradeExpectedVersion, releaseUpgradeProofFilename } from './release-upgrade-baseline.js';
 export const MAIN_PUSH_GUARD_SCHEMA = 'sks.release-main-push-guard.v1';
 const RELEASE_UPGRADE_SMOKE_SCHEMA = 'sks.release-upgrade-smoke.v2';
 const RELEASE_UPGRADE_COMMAND_STAGES = Object.freeze([
@@ -244,7 +245,7 @@ function validateReleaseUpgradeIsolationAndCommands(report, blockers) {
         || !path.isAbsolute(String(safety?.launchctl_log_path || ''))
         || !lexicalSubpath(String(safety?.launchctl_log_path || ''), sandbox)
         || !Array.isArray(safety?.launchctl_calls)
-        || safety.launchctl_calls.some((call) => !/^(?:unsetenv (?:CODEX_LB_API_KEY|OPENROUTER_API_KEY)|print)$/.test(String(call)))
+        || safety.launchctl_calls.some((call) => !isExpectedReleaseUpgradeLaunchctlCall(call))
         || !Array.isArray(safety?.launchctl_unexpected_calls)
         || safety.launchctl_unexpected_calls.length > 0)
         blockers.push('install_safety_policy_invalid');
@@ -367,7 +368,7 @@ function validateDoctorCommandReceipt(command, stage, reportFile, isolation, tar
             || binding.matches_stdout !== true
             || binding.schema !== 'sks.doctor-status.v3'
             || binding.ok !== true
-            || binding.root !== isolation.workspace)
+            || !sameFilesystemPathSync(binding.root, isolation.workspace))
             blockers.push(`doctor_report_binding_invalid:${stage}`);
     }
     else if (stage !== 'target_doctor' && binding.validation_mode === 'pinned_baseline_stdout_only') {

package/dist/core/release/package-dist-snapshot.js

@@ -1,6 +1,7 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import { cachedByFingerprint, statFingerprint } from './content-digest-cache.js';
 export function packageDistSnapshot(root, pkg) {
     const distRoot = path.join(root, 'dist');
     if (!fs.existsSync(distRoot))
@@ -11,6 +12,9 @@ export function packageDistSnapshot(root, pkg) {
     const included = files
         .filter((file) => packageFileIncluded(`dist/${path.relative(distRoot, file).split(path.sep).join('/')}`, entries))
         .sort();
+    return cachedByFingerprint(root, 'package-dist-snapshot', statFingerprint(root, included), () => computePackageDistSnapshot(distRoot, included));
+}
+function computePackageDistSnapshot(distRoot, included) {
     const hash = crypto.createHash('sha256');
     for (const file of included) {
         const rel = path.relative(distRoot, file).split(path.sep).join('/');
@@ -48,6 +52,10 @@ export function packageFilesSnapshot(root, pkg) {
         }
     }
     const files = [...candidates].filter((file) => packageFileIncluded(file, entries)).sort();
+    const fingerprint = statFingerprint(root, [...missingEntries.map((entry) => `missing:${entry}`), ...files]);
+    return cachedByFingerprint(root, 'package-files-snapshot', fingerprint, () => computePackageFilesSnapshot(root, files, missingEntries));
+}
+function computePackageFilesSnapshot(root, files, missingEntries) {
     const hash = crypto.createHash('sha256');
     for (const entry of missingEntries.sort()) {
         hash.update(entry);
@@ -95,6 +103,15 @@ function packageFileIncluded(file, entries) {
     }
     return included;
 }
+const PATTERN_REGEXP_CACHE = new Map();
+function packagePatternRegExps(normalized) {
+    const cached = PATTERN_REGEXP_CACHE.get(normalized);
+    if (cached)
+        return cached;
+    const compiled = expandBracePatterns(normalized).map((expanded) => globPatternToRegExp(expanded));
+    PATTERN_REGEXP_CACHE.set(normalized, compiled);
+    return compiled;
+}
 function matchesPackagePattern(file, pattern) {
     const rel = normalizeRel(file);
     const normalized = normalizeRel(pattern);
@@ -102,8 +119,7 @@ function matchesPackagePattern(file, pattern) {
         return false;
     if (!hasGlob(normalized))
         return rel === normalized || rel.startsWith(`${normalized}/`);
-    for (const expanded of expandBracePatterns(normalized)) {
-        const re = globPatternToRegExp(expanded);
+    for (const re of packagePatternRegExps(normalized)) {
         if (re.test(rel))
             return true;
         const parts = rel.split('/');

package/dist/core/release/physical-release-gates.js

@@ -3,6 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { desktopBridgeReleaseSourceIdentitySha256, inspectDesktopBridgeReleaseEvidence } from './desktop-bridge-release-evidence.js';
+import { cloneBuffer, fileIdentity, inspectionKey, memoizeReleaseInspection, toolIdentity } from './release-inspection-memo.js';
 export const PHYSICAL_RELEASE_GATES_SCHEMA = 'sks.release-physical-gates.v2';
 export const PHYSICAL_RELEASE_GATES_INSPECTION_SCHEMA = 'sks.release-physical-gates-inspection.v2';
 export const PHYSICAL_RELEASE_EVIDENCE_ARTIFACT_MANIFEST_SCHEMA = 'sks.release-physical-evidence-artifact-manifest.v1';
@@ -375,6 +376,16 @@ function inspectPhysicalEvidenceArtifact(input) {
     };
 }
 function verifyGithubArtifactAttestation(input) {
+    const key = inspectionKey(input.archivePath, fileIdentity(input.archivePath), toolIdentity('gh'), input.repository, input.trustedWorkflow, input.sourceCommit, input.runId);
+    const verdict = memoizeReleaseInspection('github-artifact-attestation', key, () => {
+        const blockers = [];
+        const invocationUri = computeGithubArtifactAttestation({ ...input, blockers });
+        return { invocation_uri: invocationUri, blockers };
+    });
+    input.blockers.push(...verdict.blockers);
+    return verdict.invocation_uri;
+}
+function computeGithubArtifactAttestation(input) {
     const result = spawnSync('gh', [
         'attestation', 'verify', input.archivePath,
         '--repo', input.repository,
@@ -429,6 +440,15 @@ function readBoundArchive(file) {
     }
 }
 function listArchiveFiles(archivePath, blockers) {
+    const listing = memoizeReleaseInspection('physical-archive-listing', inspectionKey(archivePath, fileIdentity(archivePath), toolIdentity('tar')), () => {
+        const own = [];
+        const files = computeArchiveFiles(archivePath, own);
+        return { entries: files ? [...files] : null, blockers: own };
+    });
+    blockers.push(...listing.blockers);
+    return listing.entries ? new Map(listing.entries) : null;
+}
+function computeArchiveFiles(archivePath, blockers) {
     const result = spawnSync('tar', ['-tzf', archivePath], { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
     if (result.status !== 0) {
         blockers.push('physical_evidence_artifact_archive_unreadable');
@@ -455,12 +475,15 @@ function listArchiveFiles(archivePath, blockers) {
     return files;
 }
 function readArchiveMember(archivePath, member, label, blockers) {
-    const result = spawnSync('tar', ['-xOzf', archivePath, member], { encoding: 'buffer', maxBuffer: 64 * 1024 * 1024 });
-    if (result.status !== 0 || !Buffer.isBuffer(result.stdout)) {
+    const bytes = memoizeReleaseInspection('physical-archive-member', inspectionKey(archivePath, fileIdentity(archivePath), toolIdentity('tar'), member), () => {
+        const result = spawnSync('tar', ['-xOzf', archivePath, member], { encoding: 'buffer', maxBuffer: 64 * 1024 * 1024 });
+        return result.status !== 0 || !Buffer.isBuffer(result.stdout) ? null : result.stdout;
+    }, (value) => (value ? cloneBuffer(value) : null));
+    if (!bytes) {
         blockers.push(`${label}_unreadable`);
         return null;
     }
-    return result.stdout;
+    return bytes;
 }
 function safeArchivePath(value) {
     if (!value || value.includes('\\') || value.startsWith('/') || value.endsWith('/'))

package/dist/core/release/release-authorization-snapshot.js

@@ -2,6 +2,7 @@ import { spawnSync } from 'node:child_process';
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import { cachedByFingerprint, statFingerprint } from './content-digest-cache.js';
 import { packageDistSnapshot, packageFilesSnapshot } from './package-dist-snapshot.js';
 export const RELEASE_AUTHORIZATION_SNAPSHOT_KEYS = Object.freeze([
     'git_commit',
@@ -44,6 +45,9 @@ function releaseGateHash(root, pkg) {
 }
 function releaseSourceSnapshot(root) {
     const files = gitFiles(root).filter(releaseRelevant).sort();
+    return cachedByFingerprint(root, 'release-source-snapshot', statFingerprint(root, files), () => computeReleaseSourceSnapshot(root, files));
+}
+function computeReleaseSourceSnapshot(root, files) {
     const hash = crypto.createHash('sha256');
     for (const file of files) {
         const full = path.join(root, file);

package/dist/core/release/release-gate-cache-v2.js

@@ -292,10 +292,14 @@ function writeReleaseCacheBridgeReport(root, row) {
             parsed = existing;
     }
     catch { }
+    const stamped = { ...row, recorded_at: new Date().toISOString() };
     parsed.records = [
-        ...parsed.records.filter((item) => item.gate_id !== row.gate_id || item.cache_key !== row.cache_key || item.bridge !== row.bridge),
-        row
-    ].sort((a, b) => `${a.gate_id}:${a.bridge}`.localeCompare(`${b.gate_id}:${b.bridge}`));
+        ...parsed.records.filter((item) => item.gate_id !== row.gate_id || item.bridge !== row.bridge),
+        stamped
+    ]
+        .sort((a, b) => Date.parse(String(b.recorded_at || 0)) - Date.parse(String(a.recorded_at || 0)) || 0)
+        .slice(0, releaseCacheBridgeRecordLimit())
+        .sort((a, b) => `${a.gate_id}:${a.bridge}`.localeCompare(`${b.gate_id}:${b.bridge}`));
     fs.mkdirSync(path.dirname(file), { recursive: true });
     fs.writeFileSync(file, `${JSON.stringify(parsed, null, 2)}\n`);
 }
@@ -317,9 +321,29 @@ function writeCacheRecord(file, key, record) {
     parsed.schema = RELEASE_GATE_CACHE_V2_SCHEMA;
     parsed.records ||= {};
     parsed.records[key] = record;
+    parsed.records = pruneCacheRecords(parsed.records);
     fs.mkdirSync(path.dirname(file), { recursive: true });
     fs.writeFileSync(file, `${JSON.stringify(parsed, null, 2)}\n`);
 }
+export function pruneCacheRecords(records, keep = releaseGateCacheRecordLimit()) {
+    const entries = Object.entries(records || {});
+    if (entries.length <= keep)
+        return records;
+    const ordered = entries.sort((left, right) => recordedAtMs(right[1]) - recordedAtMs(left[1]));
+    return Object.fromEntries(ordered.slice(0, keep));
+}
+export function releaseGateCacheRecordLimit() {
+    const configured = Number(process.env.SKS_RELEASE_GATE_CACHE_RECORD_LIMIT);
+    return Number.isFinite(configured) && configured > 0 ? Math.floor(configured) : 600;
+}
+export function releaseCacheBridgeRecordLimit() {
+    const configured = Number(process.env.SKS_RELEASE_CACHE_BRIDGE_RECORD_LIMIT);
+    return Number.isFinite(configured) && configured > 0 ? Math.floor(configured) : 600;
+}
+function recordedAtMs(record) {
+    const parsed = Date.parse(String(record?.recorded_at || ''));
+    return Number.isFinite(parsed) ? parsed : 0;
+}
 function hashFileIfPresent(hash, file) {
     if (fs.existsSync(file) && fs.statSync(file).isFile())
         hash.update(fs.readFileSync(file));

package/dist/core/release/release-gate-contract.js

@@ -2,6 +2,8 @@ import crypto from 'node:crypto';
 export const RELEASE_GATE_CONTRACT_SCHEMA = 'sks.release-gate-contract.v1';
 export const RELEASE_GATE_CONTRACT_IDS = Object.freeze([
     'architecture:guard',
+    'architecture-map:contract',
+    'architecture-map:legacy-closure',
     'codex:current:app-server-v2',
     'codex:current:binary-identity',
     'codex:current:capability',

package/dist/core/release/release-gate-dag.js

@@ -10,6 +10,7 @@ import { RELEASE_GATE_NODE_SCHEMA, validateReleaseGateManifest } from './release
 import { countReleaseGateResources, defaultReleaseGateBudget, summarizeReleaseGateBudget } from './release-gate-resource-governor.js';
 import { selectAffectedReleaseGates } from './release-gate-affected-selector.js';
 import { computeTriWikiAffectedGraph } from '../triwiki/triwiki-affected-graph.js';
+import { pruneTriWikiProofBank } from '../triwiki/triwiki-proof-bank.js';
 import { executeExtremeSchedule } from './extreme-parallel-scheduler.js';
 import { computeResourceClassBudget } from './resource-class-budget.js';
 import { guardedProcessKill, guardContextForRoute } from '../safety/mutation-guard.js';
@@ -106,6 +107,7 @@ export async function runReleaseGateDag(input) {
         throw new Error(`release_gate_selection_missing_dependencies:${[...new Set(missingSelectedDeps)].sort().join(',')}`);
     const runId = `rg-${new Date().toISOString().replace(/[:.]/g, '-')}-${process.pid}`;
     const retentionBefore = await pruneOldReleaseGateRunDirs(root);
+    const proofBankRetention = pruneTriWikiProofBank(root);
     await sweepSksTempDirs(root, { maxAgeHours: 24 }).catch(() => null);
     const reportDir = path.join(root, '.sneakoscope', 'reports', 'release-gates', runId);
     fs.mkdirSync(reportDir, { recursive: true });
@@ -113,6 +115,7 @@ export async function runReleaseGateDag(input) {
     const affectedGraphFile = path.join(reportDir, 'affected-gate-graph.json');
     const completionCertificateFile = path.join(reportDir, 'completion-certificate.json');
     appendReleaseGateJsonl(timeline, { event: 'retention', phase: 'before_run', ...retentionBefore, at: new Date().toISOString() });
+    appendReleaseGateJsonl(timeline, { event: 'proof_bank_retention', phase: 'before_run', ...proofBankRetention, at: new Date().toISOString() });
     const started = Date.now();
     const slaMs = Math.max(1, Math.floor(Number(input.slaMs || 300000)));
     const pending = new Map(selected.map((gate) => [gate.id, gate]));

package/dist/core/release/release-inspection-memo.js

@@ -0,0 +1,69 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { SksLruCache } from '../perf/lru-cache.js';
+export const RELEASE_INSPECTION_MEMO_ENV = 'SKS_RELEASE_INSPECTION_MEMO';
+const MAX_ENTRIES_PER_BUCKET = 64;
+const buckets = new Map();
+export function releaseInspectionMemoEnabled() {
+    return process.env[RELEASE_INSPECTION_MEMO_ENV] !== '0';
+}
+export function fileIdentity(file) {
+    try {
+        const stat = fs.lstatSync(file, { bigint: true });
+        if (!stat.isFile() || stat.isSymbolicLink())
+            return null;
+        return `${stat.dev}:${stat.ino}:${stat.size}:${stat.mtimeNs}:${stat.ctimeNs}`;
+    }
+    catch {
+        return null;
+    }
+}
+export function toolIdentity(command) {
+    const searchPath = String(process.env.PATH || '').split(path.delimiter).filter(Boolean);
+    for (const dir of searchPath) {
+        const candidate = path.join(dir, command);
+        let resolved;
+        try {
+            resolved = fs.realpathSync(candidate);
+        }
+        catch {
+            continue;
+        }
+        const identity = fileIdentity(resolved);
+        if (identity)
+            return `${candidate}>${resolved}#${identity}`;
+    }
+    return null;
+}
+export function inspectionKey(...parts) {
+    if (parts.some((part) => part === null || part === undefined))
+        return null;
+    return crypto.createHash('sha256').update(parts.map(String).join('\0')).digest('hex');
+}
+export function memoizeReleaseInspection(bucket, key, compute, clone = defaultClone) {
+    if (!key || !releaseInspectionMemoEnabled())
+        return compute();
+    let cache = buckets.get(bucket);
+    if (!cache) {
+        cache = new SksLruCache(MAX_ENTRIES_PER_BUCKET);
+        buckets.set(bucket, cache);
+    }
+    const hit = cache.get(key);
+    if (hit !== null)
+        return clone(hit);
+    const value = compute();
+    cache.set(key, value);
+    return clone(value);
+}
+function defaultClone(value) {
+    if (value === null || typeof value !== 'object')
+        return value;
+    return structuredClone(value);
+}
+export function cloneBuffer(value) {
+    return Buffer.from(value);
+}
+export function clearReleaseInspectionMemo() {
+    buckets.clear();
+}

package/dist/core/release/release-pack-content-scanner.js

@@ -3,7 +3,12 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { fileIdentity, inspectionKey, memoizeReleaseInspection, toolIdentity } from './release-inspection-memo.js';
 export function scanTarballTextContents(input) {
+    const key = inspectionKey(input.temp_prefix, input.tarball, fileIdentity(input.tarball), toolIdentity('tar'), String(input.max_findings), input.include_allowlisted_count === true ? 'allowlisted' : 'plain', input.patterns.map((pattern) => `${pattern.kind}=${pattern.regex.source}/${pattern.regex.flags}`).join('\0'), String(input.allow_finding || 'no_allowlist'), String(input.finding_blocker));
+    return memoizeReleaseInspection('tarball-content-scan', key, () => computeTarballTextContents(input));
+}
+function computeTarballTextContents(input) {
     const temp = fs.mkdtempSync(path.join(os.tmpdir(), input.temp_prefix));
     const findings = [];
     const blockers = [];

package/dist/core/release/release-pack-receipt.js

@@ -6,6 +6,7 @@ import { spawnSync } from 'node:child_process';
 import { tmpdir } from '../fsx.js';
 import { DEFAULT_MAX_PACK_BYTES, DEFAULT_MAX_UNPACKED_BYTES } from './package-size-budget.js';
 import { readCurrentNpmPackGateArtifacts } from './npm-pack-proof.js';
+import { inspectionKey, memoizeReleaseInspection, toolIdentity } from './release-inspection-memo.js';
 import { scanTarballTextContents } from './release-pack-content-scanner.js';
 import { RELEASE_PACK_COMPARE_SCHEMA, RELEASE_PACK_RECEIPT_SCHEMA } from './release-pack-contract.js';
 import { tarInventory, tarPackageJson, tarUnpackedBytes } from './release-pack-tarball.js';
@@ -298,12 +299,32 @@ export function inspectLocalReleaseSourceState(root) {
     else if (String(fullStatus.stdout || '').split(/\r?\n/).some((line) => line.startsWith('?? '))) {
         blockers.push('npm_pack_untracked_files_present');
     }
+    const inventory = memoizeReleaseInspection('npm-pack-source-inventory', inspectionKey(path.resolve(root), head, toolIdentity('git'), toolIdentity('npm'), process.env.SKS_RELEASE_NPM_CACHE || '', String(trackedStatus.status), String(trackedStatus.stdout || ''), String(fullStatus.status), String(fullStatus.stdout || '')), () => packSourceInventory(root));
+    const trackedFiles = inventory.tracked_files ? new Set(inventory.tracked_files) : null;
+    if (!trackedFiles)
+        blockers.push('npm_pack_tracked_file_inventory_unavailable');
+    const packedFiles = inventory.packed_files;
+    if (!packedFiles)
+        blockers.push('npm_pack_dry_run_file_inventory_unavailable');
+    const packEligibleUntracked = trackedFiles && packedFiles
+        ? unique(packedFiles.filter((relative) => !trackedFiles.has(relative) && !isGeneratedDistPackagePath(relative))).sort()
+        : [];
+    if (packEligibleUntracked.length > 0)
+        blockers.push('npm_pack_eligible_untracked_files_present');
+    return {
+        ok: blockers.length === 0,
+        head,
+        source_tree_sha256: sourceTreeSha256,
+        tracked_changes: trackedChanges,
+        pack_eligible_untracked: packEligibleUntracked,
+        blockers: unique(blockers)
+    };
+}
+function packSourceInventory(root) {
     const trackedFilesResult = spawnSync('git', ['ls-files', '-z'], { cwd: root, encoding: 'utf8', maxBuffer: 32 * 1024 * 1024 });
     const trackedFiles = trackedFilesResult.status === 0
-        ? new Set(String(trackedFilesResult.stdout || '').split('\0').filter(Boolean).map(normalizePath))
+        ? unique(String(trackedFilesResult.stdout || '').split('\0').filter(Boolean).map(normalizePath))
         : null;
-    if (!trackedFiles)
-        blockers.push('npm_pack_tracked_file_inventory_unavailable');
     const dryRun = spawnSync('npm', ['pack', '--dry-run', '--ignore-scripts', '--json'], {
         cwd: root,
         encoding: 'utf8',
@@ -323,21 +344,7 @@ export function inspectLocalReleaseSourceState(root) {
             packedFiles = null;
         }
     }
-    if (!packedFiles)
-        blockers.push('npm_pack_dry_run_file_inventory_unavailable');
-    const packEligibleUntracked = trackedFiles && packedFiles
-        ? unique(packedFiles.filter((relative) => !trackedFiles.has(relative) && !isGeneratedDistPackagePath(relative))).sort()
-        : [];
-    if (packEligibleUntracked.length > 0)
-        blockers.push('npm_pack_eligible_untracked_files_present');
-    return {
-        ok: blockers.length === 0,
-        head,
-        source_tree_sha256: sourceTreeSha256,
-        tracked_changes: trackedChanges,
-        pack_eligible_untracked: packEligibleUntracked,
-        blockers: unique(blockers)
-    };
+    return { tracked_files: trackedFiles, packed_files: packedFiles };
 }
 export function writeReleaseJson(file, value) {
     fs.mkdirSync(path.dirname(file), { recursive: true });
@@ -536,6 +543,9 @@ function gitHead(root) {
     return result.status === 0 ? String(result.stdout || '').trim() : '';
 }
 function gitTreeSha256(root, commit) {
+    return memoizeReleaseInspection('git-tree-sha256', inspectionKey(path.resolve(root), commit, toolIdentity('git')), () => computeGitTreeSha256(root, commit));
+}
+function computeGitTreeSha256(root, commit) {
     if (!/^[a-f0-9]{40}$/i.test(commit))
         return '';
     const verified = spawnSync('git', ['rev-parse', '--verify', `${commit}^{commit}`], { cwd: root, encoding: 'utf8' });

package/dist/core/release/release-pack-tarball.js

@@ -2,7 +2,11 @@ import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
+import { fileIdentity, inspectionKey, memoizeReleaseInspection, toolIdentity } from './release-inspection-memo.js';
 export function tarInventory(tarball) {
+    return memoizeReleaseInspection('tar-inventory', inspectionKey(tarball, fileIdentity(tarball), toolIdentity('tar')), () => computeTarInventory(tarball));
+}
+function computeTarInventory(tarball) {
     const result = spawnSync('tar', ['-tzf', tarball], { encoding: 'utf8', maxBuffer: 32 * 1024 * 1024 });
     if (result.status !== 0)
         return { files: [], blockers: ['tarball_inventory_command_failed'] };
@@ -28,6 +32,9 @@ export function tarInventory(tarball) {
     return { files, blockers };
 }
 export function tarPackageJson(tarball) {
+    return memoizeReleaseInspection('tar-package-json', inspectionKey(tarball, fileIdentity(tarball), toolIdentity('tar')), () => computeTarPackageJson(tarball));
+}
+function computeTarPackageJson(tarball) {
     const result = spawnSync('tar', ['-xOzf', tarball, 'package/package.json'], { encoding: 'utf8', maxBuffer: 1024 * 1024 });
     if (result.status !== 0)
         return null;
@@ -40,6 +47,9 @@ export function tarPackageJson(tarball) {
     }
 }
 export function tarUnpackedBytes(tarball) {
+    return memoizeReleaseInspection('tar-unpacked-bytes', inspectionKey(tarball, fileIdentity(tarball), toolIdentity('tar')), () => computeTarUnpackedBytes(tarball));
+}
+function computeTarUnpackedBytes(tarball) {
     const temp = fs.mkdtempSync(path.join(os.tmpdir(), 'sks-release-pack-unpacked-'));
     try {
         const result = spawnSync('tar', ['-xzf', tarball, '-C', temp], { encoding: 'utf8', maxBuffer: 32 * 1024 * 1024 });

package/dist/core/release/release-upgrade-baseline.js

@@ -4,6 +4,10 @@ export const RELEASE_UPGRADE_BASELINE_SHA256 = '40a9e89f3a234dfcd32507ab7deeb950
 export function releaseUpgradeProofFilename(targetVersion) {
     return `upgrade-${RELEASE_UPGRADE_BASELINE_LABEL}-to-${targetVersion}.json`;
 }
+export function isExpectedReleaseUpgradeLaunchctlCall(call) {
+    return /^(?:unsetenv (?:CODEX_LB_API_KEY|OPENROUTER_API_KEY)|print|bootout (?:com\.sneakoscope\.sks-menubar|com\.sneakoscope\.telegram-hub))$/
+        .test(String(call));
+}
 export function releaseUpgradeExpectedVersion(stateName, targetVersion) {
     return stateName.startsWith('target_') ? targetVersion : RELEASE_UPGRADE_BASELINE_VERSION;
 }

package/dist/core/routes.js

@@ -647,7 +647,7 @@ export const COMMAND_CATALOG = [
     { name: 'check', usage: 'sks check --tier instant|affected|confidence|release|real-check [--sla 5m] [--changed-since auto] [--json]', description: 'Run build-once proof-bank checks: affected/confidence use incremental build and cached proof reuse; release keeps full clean proof for publish readiness.' },
     { name: 'task', usage: 'sks task run [--sla 5m] [--json]', description: 'Run the normal affected-scope, release-equivalent task verification path.' },
     { name: 'release', usage: 'sks release affected|full|background|stage [--json]', description: 'Run affected release proof, full release proof, or background release proof explicitly, or drive the staged npm publish up to the human approval step.' },
-    { name: 'triwiki', usage: 'sks triwiki index|affected|proof-bank [--json]', description: 'Inspect TriWiki module cards, gate impact maps, affected graphs, and proof bank status.' },
+    { name: 'triwiki', usage: 'sks triwiki index|affected|proof-bank|graph-status|graph-lint|graph-query|atlas-status|atlas-lint|atlas-list|atlas-show|atlas-why [--json]', description: 'Inspect TriWiki module cards, gate impact maps, affected graphs, proof bank status, and Architecture Map views.' },
     { name: 'daemon', usage: 'sks daemon status|warm|stop [--json]', description: 'Inspect or warm the local SKS daemon cache state for build/proof reuse.' },
     { name: 'run', usage: 'sks run "task" [--visual|--research|--db] [--json]', description: 'Classify a plain-language task, materialize a mission, and route it through the SKS trust kernel.' },
     { name: 'plan', usage: 'sks plan "task" [--json]', description: 'Write a planning-only artifact under .sneakoscope/plans without editing code.' },