sneakoscope 8.3.2 → 8.6.0

package/dist/core/align/code-navigation-align.js

@@ -7,15 +7,40 @@ import { guardedRename, guardedRm, guardContextForRoute } from '../safety/mutati
 import { createRequestedScopeContract } from '../safety/requested-scope-contract.js';
 import { projectTriwikiToAgentsMdTransactional } from '../triwiki/agents-md-projector.js';
 import { buildCodeNavigationContextPack, validateCodeNavigationContextPack } from '../triwiki/code-navigation-context-pack.js';
-import { CODE_NAVIGATION_FATAL_SKIP_REASONS, CODE_NAVIGATION_LIMITS, inspectCodeNavigationSources } from '../triwiki/code-navigation-policy.js';
+import { CODE_NAVIGATION_FATAL_SKIP_REASONS, CODE_NAVIGATION_LIMITS } from '../triwiki/code-navigation-policy.js';
 import { isCodePackProjectionBoundToSnapshot, projectCodePackFromGraph, validateCodePack } from '../triwiki/code-pack.js';
 import { validateContextGraphSnapshot } from '../triwiki/context-graph/contracts.js';
 import { compileContextGraph } from '../triwiki/context-graph/compiler/index.js';
 import { readSourceHashes } from '../triwiki/context-graph/compiler/freshness.js';
-import { codeNavigationGraphExtractors } from '../triwiki/context-graph/extractors/index.js';
+import { ARCHITECTURE_MAP_EXTRACTOR_IDS, architectureMapGraphExtractors } from '../triwiki/context-graph/extractors/index.js';
+import { computeContextGraphCacheKey } from '../triwiki/context-graph/compiler/cache-key.js';
+import { walkCodeInventory } from '../triwiki/context-graph/extractors/code/inventory.js';
+import { codeInventoryInputHashes } from '../triwiki/code-navigation-policy.js';
 import { clearContextGraphSnapshotCache } from '../triwiki/context-graph/query/snapshot-cache.js';
 import { withTriWikiStateLock } from '../triwiki/triwiki-cleanup.js';
+import { publishArchitectureMapToStage } from '../triwiki/context-graph/store/architecture-map-store.js';
 import { ALIGN_GATE_ARTIFACT, ALIGN_LEDGER_ARTIFACT, ALIGN_OUTPUT_ARTIFACTS, ALIGN_PLAN_ARTIFACT, ALIGN_STAGING_ROOT_REL, buildInitialAlignLedger, refreshAlignGate } from './align-route.js';
+const WIKI_PREFIX = '.sneakoscope/wiki/';
+function isArchitectureMapOptionalSkip(skip) {
+    const rel = skip.path.replace(/\\/g, '/');
+    if (skip.reason !== 'unreadable' && skip.reason !== 'excluded')
+        return false;
+    if (rel === '.sneakoscope/wiki/context-pack.json')
+        return true;
+    if (rel.startsWith('.sneakoscope/triwiki/proof-bank'))
+        return true;
+    if (rel.startsWith('.sneakoscope/wiki/'))
+        return true;
+    return false;
+}
+function isAlignFatalSkip(skip) {
+    if (!CODE_NAVIGATION_FATAL_SKIP_REASONS.has(skip.reason))
+        return false;
+    return !isArchitectureMapOptionalSkip(skip);
+}
+if (new Set(ALIGN_OUTPUT_ARTIFACTS).size !== ALIGN_OUTPUT_ARTIFACTS.length) {
+    throw new Error('align_output_artifacts_not_unique');
+}
 const ALIGN_REPLACED_SURFACES = Object.freeze([
     { key: 'wiki', rel: '.sneakoscope/wiki' },
     { key: 'memory', rel: '.sneakoscope/memory' },
@@ -116,19 +141,19 @@ async function buildPack(root, snapshot, meta, generatedAt) {
         observedSourceHashes: observed
     }).pack;
 }
-function buildManifest(generatedAt, inspection, snapshot) {
+function buildManifest(generatedAt, inventory, inventoryDigest, snapshot) {
     return {
         schema: 'sks.code-navigation-manifest.v1',
         generated_at: generatedAt,
         source_policy: 'repository_code_only',
         exhaustive_graph: 'context-graph.json',
-        inventory_digest: inspection.inventoryDigest,
+        inventory_digest: inventoryDigest,
         snapshot_hash: snapshot.snapshotHash,
-        source_file_count: inspection.inventory.files.length,
+        source_file_count: inventory.files.length,
         symbol_count: snapshot.nodes.filter((node) => node.kind === 'symbol').length,
         edge_count: snapshot.edgeCount,
         extractors: snapshot.extractors.map(({ id, revision }) => ({ id, revision })),
-        source_files: inspection.inventory.files.map((file) => ({
+        source_files: inventory.files.map((file) => ({
             path: file.rel,
             sha256: file.hash,
             language: file.language,
@@ -141,13 +166,15 @@ function buildManifest(generatedAt, inspection, snapshot) {
 }
 async function validateStaging(input) {
     for (const artifact of ALIGN_OUTPUT_ARTIFACTS) {
-        const stageFile = path.join(input.stageWiki, path.basename(artifact));
+        if (!artifact.startsWith(WIKI_PREFIX))
+            return false;
+        const stageFile = path.join(input.stageWiki, artifact.slice(WIKI_PREFIX.length));
         const stat = await fsp.stat(stageFile).catch(() => null);
         if (!stat?.isFile() || stat.size <= 0)
             return false;
     }
     const meta = await readJson(path.join(input.stageWiki, 'context-graph.meta.json'), null);
-    if (meta?.snapshotHash !== input.snapshot.snapshotHash || meta?.cacheKeyParts?.sourcePolicy !== 'repository_code_only')
+    if (meta?.snapshotHash !== input.snapshot.snapshotHash || meta?.cacheKeyParts?.sourcePolicy !== 'workspace')
         return false;
     const manifest = await readJson(path.join(input.stageWiki, 'code-navigation-manifest.json'), null);
     if (manifest?.inventory_digest !== input.manifest.inventory_digest || manifest?.source_file_count !== input.manifest.source_file_count)
@@ -174,21 +201,31 @@ async function runLocked(root, dir, missionId, plan, ledger, beforeFinalSourceCa
     ledger.validation.absent_or_existing_input_supported = plan.requires_cleanup_receipt === false
         && plan.acceptance.absent_or_existing_triwiki_supported === true;
     ledger.validation.prior_state_ignored = true;
-    const extractorIdentities = codeNavigationGraphExtractors();
-    const inspection = await inspectCodeNavigationSources(root, extractorIdentities, CODE_NAVIGATION_LIMITS);
-    const extractors = codeNavigationGraphExtractors({ preparedInventory: inspection.inventory });
-    ledger.scan.inventory_digest = inspection.inventoryDigest;
-    ledger.scan.source_file_count = inspection.inventory.files.length;
-    ledger.scan.source_bytes = inspection.inventory.files.reduce((sum, file) => sum + file.bytes, 0);
-    ledger.scan.source_lines = inspection.inventory.files.reduce((sum, file) => sum + file.lines, 0);
-    ledger.scan.languages = countsBy(inspection.inventory.files, (file) => file.language);
-    ledger.scan.allowed_exclusions = inspection.inventory.skipped
-        .filter((skip) => !CODE_NAVIGATION_FATAL_SKIP_REASONS.has(skip.reason))
+    const extractorIdentities = architectureMapGraphExtractors();
+    const inventory = walkCodeInventory(root, CODE_NAVIGATION_LIMITS);
+    const inputHashes = codeInventoryInputHashes(inventory);
+    const codeInventoryDigest = crypto
+        .createHash('sha256')
+        .update(Object.entries(inputHashes)
+        .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+        .map(([relative, hash]) => `${relative}\0${hash}`)
+        .join('\n'))
+        .digest('hex');
+    const cacheKey = await computeContextGraphCacheKey({ root, extractors: extractorIdentities });
+    const fatalSkips = inventory.skipped.filter((skip) => isAlignFatalSkip(skip));
+    ledger.scan.inventory_digest = codeInventoryDigest;
+    ledger.scan.source_file_count = inventory.files.length;
+    ledger.scan.source_bytes = inventory.files.reduce((sum, file) => sum + file.bytes, 0);
+    ledger.scan.source_lines = inventory.files.reduce((sum, file) => sum + file.lines, 0);
+    ledger.scan.languages = countsBy(inventory.files, (file) => file.language);
+    ledger.scan.allowed_exclusions = inventory.skipped
+        .filter((skip) => !isAlignFatalSkip(skip))
         .map((skip) => ({ path: skip.path, reason: skip.reason }));
-    ledger.scan.fatal_skips = inspection.fatalSkips.map((skip) => ({ ...skip }));
-    ledger.validation.source_inventory_complete = inspection.fatalSkips.length === 0;
-    if (inspection.fatalSkips.length)
-        throw new Error(`code_navigation_fatal_skips:${inspection.fatalSkips.map((skip) => `${skip.reason}:${skip.path}`).join('|')}`);
+    ledger.scan.fatal_skips = fatalSkips.map((skip) => ({ ...skip }));
+    ledger.validation.source_inventory_complete = fatalSkips.length === 0;
+    if (fatalSkips.length)
+        throw new Error(`code_navigation_fatal_skips:${fatalSkips.map((skip) => `${skip.reason}:${skip.path}`).join('|')}`);
+    const extractors = architectureMapGraphExtractors({ preparedInventory: inventory });
     const generatedAt = nowIso();
     const compiled = await compileContextGraph({
         root,
@@ -197,12 +234,12 @@ async function runLocked(root, dir, missionId, plan, ledger, beforeFinalSourceCa
         limits: CODE_NAVIGATION_LIMITS,
         observedAt: generatedAt,
         useFragmentCache: false,
-        cacheKey: inspection.cacheKey,
+        cacheKey,
         persistArtifacts: false,
         useCompileLock: false
     });
     ledger.validation.graph_compile = compiled.ok;
-    const compileFatal = compiled.skipped.filter((skip) => CODE_NAVIGATION_FATAL_SKIP_REASONS.has(skip.reason));
+    const compileFatal = compiled.skipped.filter((skip) => isAlignFatalSkip(skip));
     if (compileFatal.length)
         ledger.scan.fatal_skips.push(...compileFatal.map((skip) => ({ ...skip })));
     if (!compiled.ok || !compiled.snapshot || !compiled.meta || compileFatal.length) {
@@ -218,7 +255,7 @@ async function runLocked(root, dir, missionId, plan, ledger, beforeFinalSourceCa
     ledger.graph.test_nodes = snapshot.nodes.filter((node) => node.kind === 'test').length;
     ledger.graph.edge_count = snapshot.edgeCount;
     ledger.graph.edges_by_type = countsBy(snapshot.edges, (edge) => edge.type);
-    const inventoryPaths = inspection.inventory.files.map((file) => file.rel).sort();
+    const inventoryPaths = inventory.files.map((file) => file.rel).sort();
     const fileNodePaths = snapshot.nodes.filter((node) => node.kind === 'file').map((node) => String(node.path || '')).filter(Boolean).sort();
     const inventorySet = new Set(inventoryPaths);
     const fileNodeSet = new Set(fileNodePaths);
@@ -229,12 +266,16 @@ async function runLocked(root, dir, missionId, plan, ledger, beforeFinalSourceCa
         && fileNodePaths.length === inventoryPaths.length;
     if (!ledger.graph.exact_file_coverage)
         throw new Error('code_navigation_exact_file_coverage_failed');
-    if (ledger.graph.extractor_ids.length !== 1 || ledger.graph.extractor_ids[0] !== 'code')
-        throw new Error('code_navigation_non_code_extractor_present');
+    const expectedExtractors = [...ARCHITECTURE_MAP_EXTRACTOR_IDS];
+    if (ledger.graph.extractor_ids.length !== expectedExtractors.length
+        || expectedExtractors.some((id, index) => ledger.graph.extractor_ids[index] !== id)) {
+        throw new Error(`code_navigation_architecture_map_extractors_mismatch:${ledger.graph.extractor_ids.join(',')}`);
+    }
     const graphValidation = validateContextGraphSnapshot(snapshot);
     ledger.validation.graph_schema = graphValidation.ok;
-    if (!graphValidation.ok || meta.cacheKeyParts.sourcePolicy !== 'repository_code_only')
+    if (!graphValidation.ok || meta.cacheKeyParts.sourcePolicy !== 'workspace') {
         throw new Error('code_navigation_graph_validation_failed');
+    }
     const pack = await buildPack(root, snapshot, meta, generatedAt);
     const packValidation = await validateCodePack(pack, root);
     ledger.validation.code_pack = packValidation.ok
@@ -255,7 +296,7 @@ async function runLocked(root, dir, missionId, plan, ledger, beforeFinalSourceCa
     ledger.validation.context_pack = contextValidation.ok;
     if (!contextValidation.ok)
         throw new Error('code_navigation_context_pack_invalid');
-    const manifest = buildManifest(generatedAt, inspection, snapshot);
+    const manifest = buildManifest(generatedAt, inventory, codeInventoryDigest, snapshot);
     const stageRoot = path.join(stageBase, `${missionId}-${randomUUID().slice(0, 8)}`);
     const stageWiki = path.join(stageRoot, 'new-wiki');
     const previousRoot = path.join(stageRoot, 'previous');
@@ -271,6 +312,7 @@ async function runLocked(root, dir, missionId, plan, ledger, beforeFinalSourceCa
         await writeJsonAtomic(path.join(stageWiki, 'code-navigation-manifest.json'), manifest);
         await writeJsonAtomic(path.join(stageWiki, 'code-pack.json'), pack);
         await writeJsonAtomic(path.join(stageWiki, 'context-pack.json'), contextPack);
+        await publishArchitectureMapToStage(stageWiki, snapshot, { root, missionId });
         ledger.publication.staged = true;
         ledger.validation.staged_readback = await validateStaging({ stageWiki, root, snapshot, pack, contextPack, manifest });
         if (!ledger.validation.staged_readback)
@@ -308,9 +350,23 @@ async function runLocked(root, dir, missionId, plan, ledger, beforeFinalSourceCa
         }
         ledger.validation.artifact_hashes = Object.keys(ledger.publication.artifact_sha256).length === ALIGN_OUTPUT_ARTIFACTS.length;
         await beforeFinalSourceCas?.();
-        const finalInspection = await inspectCodeNavigationSources(root, extractorIdentities, CODE_NAVIGATION_LIMITS);
-        ledger.scan.source_cas_verified = finalInspection.fatalSkips.length === 0
-            && finalInspection.cacheKey.key === inspection.cacheKey.key;
+        const finalInventory = walkCodeInventory(root, CODE_NAVIGATION_LIMITS);
+        const finalFatal = finalInventory.skipped.filter((skip) => isAlignFatalSkip(skip));
+        const finalCacheKey = await computeContextGraphCacheKey({ root, extractors: extractorIdentities });
+        const finalCodeDigest = crypto
+            .createHash('sha256')
+            .update(Object.entries(codeInventoryInputHashes(finalInventory))
+            .sort(([left], [right]) => (left < right ? -1 : left > right ? 1 : 0))
+            .map(([relative, hash]) => `${relative}\0${hash}`)
+            .join('\n'))
+            .digest('hex');
+        const casStable = finalCacheKey.parts.tsconfigHash === cacheKey.parts.tsconfigHash
+            && finalCacheKey.parts.commandManifestHash === cacheKey.parts.commandManifestHash
+            && finalCacheKey.parts.gateManifestHash === cacheKey.parts.gateManifestHash
+            && finalCacheKey.parts.schemaRevision === cacheKey.parts.schemaRevision
+            && finalCacheKey.parts.proofIndexHash === cacheKey.parts.proofIndexHash
+            && finalCodeDigest === codeInventoryDigest;
+        ledger.scan.source_cas_verified = finalFatal.length === 0 && casStable;
         if (!ledger.scan.source_cas_verified)
             throw new Error('code_navigation_source_changed_during_scan');
         commitStarted = true;

package/dist/core/architecture-map-pipeline.js

@@ -0,0 +1,173 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+import { exists, nowIso, readJson, writeJsonAtomic } from './fsx.js';
+import { ARCHITECTURE_CAPSULE_ARTIFACT, ARCHITECTURE_MAP_BASELINE_ARTIFACT, ARCHITECTURE_MAP_MANIFEST_ARTIFACT, ARCHITECTURE_MAP_REVIEW_ARTIFACT, bindArchitectureMapBaseline, buildAfterReview, sealBaseline, validateArchitectureMapBaselineArtifact, validateArchitectureMapReviewArtifact } from './architecture-map-review.js';
+import { readContextGraphSnapshot } from './triwiki/context-graph/store/snapshot-store.js';
+export { ARCHITECTURE_MAP_REVIEW_ARTIFACT };
+export const ARCHITECTURE_MAP_BASELINE_STAGE = 'architecture_map_baseline';
+export const ARCHITECTURE_MAP_REVIEW_STAGE = 'architecture_map_review';
+const ARCHITECTURE_MAP_EXEMPT_ROUTES = new Set([
+    'Answer',
+    'DFix',
+    'Help',
+    'Wiki',
+    'Goal',
+    'GX',
+    'DB'
+]);
+export function routeNeedsArchitectureMap(route) {
+    const id = String(route?.id || '');
+    if (!id)
+        return false;
+    if (ARCHITECTURE_MAP_EXEMPT_ROUTES.has(id))
+        return false;
+    return true;
+}
+export function createArchitectureMapPlanBinding() {
+    return Object.freeze({
+        baseline_artifact: ARCHITECTURE_MAP_BASELINE_ARTIFACT,
+        review_artifact: ARCHITECTURE_MAP_REVIEW_ARTIFACT,
+        capsule_artifact: ARCHITECTURE_CAPSULE_ARTIFACT,
+        manifest_artifact: ARCHITECTURE_MAP_MANIFEST_ARTIFACT,
+        required: true,
+        seeded_at: nowIso()
+    });
+}
+export function planStagesArchitectureMap(plan) {
+    return Array.isArray(plan?.stages)
+        && plan.stages.some((stage) => String(stage?.id || '') === ARCHITECTURE_MAP_BASELINE_STAGE
+            && !['skipped', 'not_applicable'].includes(String(stage?.status || '')));
+}
+export async function seedArchitectureMapPlanBinding(dir, plan) {
+    if (!planStagesArchitectureMap(plan))
+        return plan;
+    plan.architecture_map = createArchitectureMapPlanBinding();
+    await writeJsonAtomic(path.join(dir, 'pipeline-plan.json'), plan);
+    return plan;
+}
+export async function maybeSeedArchitectureMapForPlan(input) {
+    if (!input.plan?.architecture_map || !input.missionId) {
+        return { ok: false, reason: 'architecture_map_not_planned' };
+    }
+    return seedArchitectureMapBaselineArtifacts({
+        root: input.root,
+        dir: input.dir,
+        missionId: String(input.missionId),
+        routeId: String(input.plan.route?.id || input.plan.route?.command || 'SKS'),
+        taskProfile: String(input.taskProfile || input.plan.task_profile || '')
+    });
+}
+export async function seedArchitectureMapBaselineArtifacts(input) {
+    const baselinePath = path.join(input.dir, ARCHITECTURE_MAP_BASELINE_ARTIFACT);
+    if (await exists(baselinePath))
+        return { ok: true, baselinePath };
+    const load = await readContextGraphSnapshot(input.root);
+    if (load.status !== 'ok' || !load.snapshot) {
+        return { ok: false, reason: load.blocker || 'architecture_map_graph_unavailable' };
+    }
+    const sealed = sealBaseline({
+        missionId: input.missionId,
+        routeId: input.routeId,
+        snapshot: load.snapshot,
+        policyRoot: input.root,
+        capturedAt: nowIso(),
+        ...(input.taskProfile ? { taskProfile: input.taskProfile } : {})
+    });
+    await fsp.mkdir(input.dir, { recursive: true });
+    await writeJsonAtomic(baselinePath, sealed.baseline);
+    await writeJsonAtomic(path.join(input.dir, ARCHITECTURE_MAP_MANIFEST_ARTIFACT), sealed.manifest);
+    await writeArchitectureMapCapsule(input.dir, sealed.capsule.text);
+    return { ok: true, baselinePath };
+}
+export async function ensureArchitectureMapReviewArtifacts(input) {
+    const reviewPath = path.join(input.dir, ARCHITECTURE_MAP_REVIEW_ARTIFACT);
+    if (await exists(reviewPath))
+        return { ok: true, reviewPath };
+    const baselinePath = path.join(input.dir, ARCHITECTURE_MAP_BASELINE_ARTIFACT);
+    if (!(await exists(baselinePath))) {
+        return { ok: false, reason: 'architecture_map_baseline_missing' };
+    }
+    const baseline = await readJson(baselinePath, null);
+    if (!baseline)
+        return { ok: false, reason: 'architecture_map_baseline_unreadable' };
+    const load = await readContextGraphSnapshot(input.root);
+    if (load.status !== 'ok' || !load.snapshot) {
+        return { ok: false, reason: load.blocker || 'architecture_map_graph_unavailable' };
+    }
+    const built = buildAfterReview({
+        missionId: input.missionId,
+        ...(input.routeId ? { routeId: input.routeId } : {}),
+        baseline,
+        afterSnapshot: load.snapshot,
+        policyRoot: input.root,
+        generatedAt: nowIso()
+    });
+    await fsp.mkdir(input.dir, { recursive: true });
+    await writeJsonAtomic(reviewPath, built.review);
+    await writeJsonAtomic(path.join(input.dir, ARCHITECTURE_MAP_MANIFEST_ARTIFACT), built.manifest);
+    await writeArchitectureMapCapsule(input.dir, built.capsule.text);
+    await writeJsonAtomic(path.join(input.dir, 'architecture-map-delta.json'), built.delta);
+    return { ok: true, reviewPath };
+}
+export async function architectureMapGateStatus(root, state = {}) {
+    if (state?.architecture_map_required !== true)
+        return { ok: true, blockers: [] };
+    const missionId = state?.mission_id;
+    if (!missionId)
+        return { ok: false, blockers: ['architecture_map_mission_missing'] };
+    const dir = path.join(root, '.sneakoscope/missions', missionId);
+    const plan = await readJson(path.join(dir, 'pipeline-plan.json'), null);
+    if (!plan?.architecture_map)
+        return { ok: true, blockers: [], not_applicable: true };
+    if (await exists(path.join(dir, ARCHITECTURE_MAP_BASELINE_ARTIFACT))) {
+        await ensureArchitectureMapReviewArtifacts({
+            root,
+            dir,
+            missionId,
+            routeId: String(plan?.route?.id || state?.route || '')
+        });
+    }
+    const blockers = [];
+    const baselinePath = path.join(dir, ARCHITECTURE_MAP_BASELINE_ARTIFACT);
+    const reviewPath = path.join(dir, ARCHITECTURE_MAP_REVIEW_ARTIFACT);
+    if (!(await exists(baselinePath))) {
+        blockers.push('architecture_map_baseline_missing');
+    }
+    else {
+        const baseline = await readJson(baselinePath, null);
+        const validation = validateArchitectureMapBaselineArtifact(baseline);
+        if (!validation.ok)
+            blockers.push('architecture_map_baseline_invalid', ...validation.blockers.map((b) => `baseline:${b}`));
+        else {
+            const binding = bindArchitectureMapBaseline({ baseline: baseline, missionId });
+            if (!binding.ok)
+                blockers.push(...binding.blockers.map((b) => `architecture_map_baseline_${b}`));
+            if (baseline && baseline.capturedBeforeMutation !== true)
+                blockers.push('architecture_map_baseline_late');
+        }
+    }
+    if (!(await exists(reviewPath))) {
+        blockers.push('architecture_map_review_missing');
+    }
+    else {
+        const review = await readJson(reviewPath, null);
+        const validation = validateArchitectureMapReviewArtifact(review);
+        if (!validation.ok)
+            blockers.push('architecture_map_review_invalid', ...validation.blockers.map((b) => `review:${b}`));
+        else if (review?.verdict !== 'pass') {
+            blockers.push('architecture_map_review_blocked');
+            if (Array.isArray(review?.unaccountedChangedPaths) && review.unaccountedChangedPaths.length) {
+                blockers.push('architecture_map_unaccounted_changed_file');
+            }
+            for (const id of review?.blockingFindingIds || [])
+                blockers.push(`architecture_map_finding:${id}`);
+        }
+    }
+    return { ok: blockers.length === 0, blockers: [...new Set(blockers)] };
+}
+export async function writeArchitectureMapCapsule(dir, text) {
+    const file = path.join(dir, ARCHITECTURE_CAPSULE_ARTIFACT);
+    await fsp.mkdir(dir, { recursive: true });
+    await fsp.writeFile(file, text.endsWith('\n') ? text : `${text}\n`, 'utf8');
+    return file;
+}

package/dist/core/architecture-map-review.js

@@ -0,0 +1,180 @@
+import { sha256 } from './fsx.js';
+import { ARCHITECTURE_BASELINE_SCHEMA, ARCHITECTURE_MAP_MANIFEST_SCHEMA, ARCHITECTURE_REVIEW_SCHEMA } from './triwiki/context-graph/architecture/contracts.js';
+import { buildArchitectureBaseline, verifyArchitectureBaselineSeal } from './triwiki/context-graph/architecture/baseline.js';
+import { renderArchitectureCapsule } from './triwiki/context-graph/architecture/capsule.js';
+import { buildArchitectureDelta, buildArchitectureReview } from './triwiki/context-graph/architecture/delta.js';
+import { buildArchitectureInputBundle, policyContentHash } from './triwiki/context-graph/architecture/input-bundle.js';
+import { loadArchitectureMapPolicy } from './triwiki/context-graph/architecture/policy.js';
+import { buildArchitectureScope } from './triwiki/context-graph/architecture/slice.js';
+import { validateArchitectureBaseline, validateArchitectureInputBundle, validateArchitectureMapManifest, validateArchitectureReview } from './triwiki/context-graph/architecture/validation.js';
+import { buildArchitectureMapManifest, buildArchitectureMapViews } from './triwiki/context-graph/projections/mermaid/index.js';
+export const ARCHITECTURE_MAP_BASELINE_ARTIFACT = 'architecture-map-baseline.json';
+export const ARCHITECTURE_MAP_REVIEW_ARTIFACT = 'architecture-map-review.json';
+export const ARCHITECTURE_CAPSULE_ARTIFACT = 'architecture-capsule.txt';
+export const ARCHITECTURE_MAP_MANIFEST_ARTIFACT = 'architecture-map-manifest.json';
+export const ARCHITECTURE_MAP_REVIEW_SCHEMA = ARCHITECTURE_REVIEW_SCHEMA;
+export const ARCHITECTURE_MAP_BASELINE_SCHEMA = ARCHITECTURE_BASELINE_SCHEMA;
+export const ARCHITECTURE_MAP_MANIFEST_SCHEMA_ID = ARCHITECTURE_MAP_MANIFEST_SCHEMA;
+export function resolveArchitectureMapPolicy(input) {
+    if (input.policy)
+        return input.policy;
+    if (input.policyRoot)
+        return loadArchitectureMapPolicy(input.policyRoot);
+    throw new Error('architecture_map_policy_required');
+}
+export function sealBaseline(input) {
+    const policy = resolveArchitectureMapPolicy(input);
+    const rootId = input.rootId ?? 'workspace';
+    const profile = input.profile ?? 'global';
+    const bundle = buildArchitectureInputBundle({
+        rootId,
+        graph: input.snapshot,
+        policy,
+        profile
+    });
+    const views = buildArchitectureMapViews(input.snapshot, policy, {
+        rootId,
+        missionId: input.missionId
+    });
+    const viewHashes = Object.freeze(Object.fromEntries(views.views.map((view) => [view.viewId, view.projection.contentHash])));
+    const scope = buildArchitectureScope({
+        profile,
+        ...(input.seedNodeIds ? { seedNodeIds: input.seedNodeIds } : {}),
+        ...(input.seedPaths ? { seedPaths: input.seedPaths } : {})
+    });
+    const baseline = buildArchitectureBaseline({
+        missionId: input.missionId,
+        routeId: input.routeId,
+        taskProfile: input.taskProfile ?? profile,
+        capturedAt: input.capturedAt,
+        bundle,
+        policy,
+        scope,
+        viewHashes,
+        findings: views.findings,
+        metrics: views.metrics
+    });
+    const capsule = renderArchitectureCapsule({
+        profile,
+        missionId: input.missionId,
+        routeId: input.routeId,
+        baseline,
+        metrics: views.metrics,
+        findings: views.findings,
+        ...(input.seedPaths ? { seedPaths: input.seedPaths } : {}),
+        mapArtifact: ARCHITECTURE_MAP_MANIFEST_ARTIFACT
+    });
+    return Object.freeze({
+        baseline,
+        bundle,
+        manifest: views.manifest,
+        capsule,
+        policy
+    });
+}
+export function buildAfterReview(input) {
+    const policy = resolveArchitectureMapPolicy(input);
+    const rootId = input.rootId ?? 'workspace';
+    const profile = input.profile ?? input.baseline.scope.profile;
+    const afterBundle = buildArchitectureInputBundle({
+        rootId,
+        graph: input.afterSnapshot,
+        policy,
+        profile,
+        policyHash: policyContentHash(policy)
+    });
+    const views = buildArchitectureMapViews(input.afterSnapshot, policy, {
+        rootId,
+        missionId: input.missionId
+    });
+    const projectionAccounting = Object.freeze(Object.fromEntries(views.views.map((view) => [
+        view.viewId,
+        {
+            selectedNodeCount: view.projection.accounting.selectedNodeIds.length,
+            emittedNodeCount: view.projection.accounting.emittedNodeIds.length,
+            omittedNodeCount: view.projection.accounting.omittedNodes.length,
+            selectedEdgeCount: view.projection.accounting.selectedEdgeIds.length,
+            emittedEdgeCount: view.projection.accounting.emittedEdgeIds.length,
+            omittedEdgeCount: view.projection.accounting.omittedEdges.length,
+            accountingRatio: view.projection.accounting.selectedNodeIds.length === 0
+                ? 1
+                : view.projection.accounting.emittedNodeIds.length /
+                    view.projection.accounting.selectedNodeIds.length
+        }
+    ])));
+    const review = buildArchitectureReview({
+        missionId: input.missionId,
+        baseline: input.baseline,
+        afterBundle,
+        policy,
+        generatedAt: input.generatedAt,
+        projectionAccounting,
+        ...(input.accountedChangedPaths
+            ? { accountedChangedPaths: input.accountedChangedPaths }
+            : {})
+    });
+    const delta = buildArchitectureDelta({
+        missionId: input.missionId,
+        baseline: input.baseline,
+        afterBundle,
+        policy
+    });
+    const capsule = renderArchitectureCapsule({
+        profile,
+        missionId: input.missionId,
+        ...(input.routeId ? { routeId: input.routeId } : {}),
+        baseline: input.baseline,
+        metrics: views.metrics,
+        findings: views.findings,
+        mapArtifact: 'architecture-map-delta.mmd'
+    });
+    return Object.freeze({
+        review,
+        delta,
+        afterBundle,
+        manifest: views.manifest,
+        capsule,
+        policy
+    });
+}
+export function validateArchitectureMapBaselineArtifact(value) {
+    return validateArchitectureBaseline(value);
+}
+export function validateArchitectureMapReviewArtifact(value) {
+    return validateArchitectureReview(value);
+}
+export function validateArchitectureMapManifestArtifact(value) {
+    return validateArchitectureMapManifest(value);
+}
+export function validateArchitectureMapInputBundleArtifact(value) {
+    return validateArchitectureInputBundle(value);
+}
+export function bindArchitectureMapBaseline(input) {
+    const validation = validateArchitectureBaseline(input.baseline);
+    const blockers = [...validation.blockers];
+    if (input.baseline.missionId !== input.missionId)
+        blockers.push('mission_mismatch');
+    if (!verifyArchitectureBaselineSeal(input.baseline))
+        blockers.push('seal_mismatch');
+    if (blockers.length)
+        return { ok: false, blockers, binding: null };
+    return {
+        ok: true,
+        blockers: [],
+        binding: {
+            missionId: input.baseline.missionId,
+            seal: input.baseline.seal,
+            canonicalPayloadHash: input.baseline.canonicalPayloadHash,
+            policyHash: input.baseline.policyHash,
+            graphHash: input.baseline.graphHash,
+            worktreeFingerprintHash: input.baseline.worktreeFingerprintHash
+        }
+    };
+}
+export function architectureMapReviewDigest(review) {
+    return sha256(JSON.stringify(review ?? null));
+}
+export function architectureMapBaselineDigest(baseline) {
+    return sha256(JSON.stringify(baseline ?? null));
+}
+export { buildArchitectureMapManifest, buildArchitectureMapViews };

package/dist/core/codex/agent-config-file-repair.js

@@ -1,8 +1,13 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { nowIso, readJson, writeJsonAtomic } from '../fsx.js';
-import { backupInvalidToml, inspectOfficialSubagentToml, mergeOfficialSubagentConfig, officialSubagentConfigOwnershipProof, officialSubagentConfigWarnings, readInheritedOfficialSubagentConfigText } from '../subagents/official-subagent-config.js';
+import { SKS_MANAGED_CODEX_CONFIG_MARKER, backupInvalidToml, inspectOfficialSubagentToml, mergeOfficialSubagentConfigResult, officialSubagentConfigOwnershipProof, officialSubagentConfigWarnings, readInheritedOfficialSubagentConfigText } from '../subagents/official-subagent-config.js';
 import { writeCodexConfigGuarded } from './codex-config-guard.js';
+function unmanagedConfigOperatorAction(configPath) {
+    return `Refused to modify ${configPath}: no SKS ownership proof. `
+        + `If SKS owns this file, add the line \`${SKS_MANAGED_CODEX_CONFIG_MARKER}\` as its first line `
+        + 'and re-run `sks doctor --fix`. Otherwise run `sks setup` to regenerate a managed config.';
+}
 export async function repairAgentConfigFileReferences(input) {
     const root = path.resolve(input.root);
     const configPath = path.join(root, '.codex', 'config.toml');
@@ -37,6 +42,10 @@ export async function repairAgentConfigFileReferences(input) {
                 ...(!ownershipProof.owned ? ['user_owned_file_without_sks_marker'] : [])
             ],
             warnings: [],
+            operator_actions: [
+                `${configPath} is not valid TOML; SKS preserved it and wrote a backup. Fix the syntax, then re-run \`sks doctor --fix\`.`,
+                ...(!ownershipProof.owned ? [unmanagedConfigOperatorAction(configPath)] : [])
+            ],
             ownership_proof: ownershipProof
         });
     }
@@ -55,6 +64,7 @@ export async function repairAgentConfigFileReferences(input) {
             manual_required: true,
             blockers: ['user_owned_file_without_sks_marker'],
             warnings: [],
+            operator_actions: [unmanagedConfigOperatorAction(configPath)],
             ownership_proof: ownershipProof
         });
     }
@@ -62,13 +72,14 @@ export async function repairAgentConfigFileReferences(input) {
         ...(input.home ? { home: input.home } : {}),
         ...(input.codexHome ? { codexHome: input.codexHome } : {})
     });
-    const merged = mergeOfficialSubagentConfig(original, {
+    const mergeResult = mergeOfficialSubagentConfigResult(original, {
         sksOwned: ownershipProof.owned,
         inheritedText
     });
+    const merged = mergeResult.text;
     const validation = inspectOfficialSubagentToml(merged);
     const warnings = officialSubagentConfigWarnings(merged, inheritedText);
-    const blockers = [];
+    const blockers = [...mergeResult.blockers];
     let changed = merged !== original;
     let writeSucceeded = input.apply !== true;
     let backupPath = null;
@@ -104,6 +115,9 @@ export async function repairAgentConfigFileReferences(input) {
         manual_required: blockers.length > 0,
         blockers,
         warnings,
+        operator_actions: blockers.map((blocker) => blocker === 'user_owned_file_without_sks_marker'
+            ? unmanagedConfigOperatorAction(configPath)
+            : `${configPath}: ${blocker}. Re-run \`sks doctor --fix\` after resolving it, or run \`sks setup\` to regenerate a managed config.`),
         ownership_proof: ownershipProof
     };
     return writeReport(input.reportPath, root, report);

package/dist/core/codex/codex-config-guard.js

@@ -4,6 +4,7 @@ import { randomBytes } from 'node:crypto';
 import { appendJsonl, ensureDir, nowIso, readText, sha256, writeTextAtomic } from '../fsx.js';
 import { diffCodexAppUiSnapshots, snapshotCodexAppUiState } from '../codex-app/codex-app-ui-state-snapshot.js';
 import { cleanupCodexConfigBackups, validateCodexConfigRoundTrip } from './codex-config-toml.js';
+import { hasManagedAgentsConfigFingerprint } from '../subagents/official-subagent-config.js';
 import { escapeRegExp } from '../text/regex.js';
 import { withFileLock } from '../locks/file-lock.js';
 export const SKS_MANAGED_CODEX_CONFIG_MARKER = '# SKS-MANAGED-CODEX-CONFIG';
@@ -576,7 +577,8 @@ export function isProjectCodexConfig(root, configPath) {
 export function hasSksManagedCodexConfigMarker(text) {
     const source = String(text || '');
     return hasExplicitSksManagedCodexConfigMarker(source)
-        || /(?:SKS managed|Sneakoscope|sneakoscope|sks_|agents\.native_agent|agents\.implementation_worker|multi_agent)/i.test(source)
+        || /(?:SKS managed|Sneakoscope|sneakoscope|sks_|agents\.native_agent|agents\.implementation_worker)/i.test(source)
+        || hasManagedAgentsConfigFingerprint(source)
         || /^\s*model_provider\s*=\s*["']codex-lb["']\s*(?:#.*)?$/mi.test(source)
         || /^\s*default_profile\s*=\s*["']sks-fast-high["']\s*(?:#.*)?$/mi.test(source)
         || /^\s*\[(?:user\.fast_mode|model_providers\.(?:"codex-lb"|codex-lb)|profiles\.(?:"sks-fast-high"|sks-fast-high))\]\s*(?:#.*)?$/mi.test(source);

package/dist/core/codex/codex-feature-flags.js

@@ -0,0 +1,10 @@
+export const MANAGED_CODEX_FEATURE_FLAGS = Object.freeze(['hooks', 'fast_mode', 'apps']);
+export const REMOVED_CODEX_FEATURE_FLAGS = Object.freeze([
+    'fast_mode_ui',
+    'codex_hooks',
+    'remote_control',
+    'codex_git_commit',
+    'plugin_hooks',
+    'js_repl',
+    'multi_agent_mode'
+]);