sneakoscope 8.3.2 → 8.6.0

package/dist/core/pipeline-internals/runtime-core.js

@@ -38,7 +38,10 @@ import { NARUTO_GATE_FILENAME, NARUTO_SUMMARY_FILENAME, SUBAGENT_PLAN_FILENAME,
 import { buildSubagentEvidence, readSubagentEvents, recordSubagentEvent, SUBAGENT_EVIDENCE_FILENAME, SUBAGENT_EVENT_LOG_FILENAME, SUBAGENT_PARENT_SUMMARY_FILENAME } from '../subagents/subagent-evidence.js';
 import { effectiveSubagentTarget, normalizeLegacySubagentCountFields, subagentCountContractBlockers } from '../subagents/wave-lifecycle.js';
 import { officialSubagentEvidenceReady } from '../subagents/terminal-subagent-state.js';
+import { createArchitectureMapPlanBinding, maybeSeedArchitectureMapForPlan, planStagesArchitectureMap } from '../architecture-map-pipeline.js';
+import { BLOCKING_GATE_LIMITS, LIGHTWEIGHT_ROUTES, GATE_PROFILE_STAGES, STAGE_BLOCKING_GATE, selectPipelineLane, buildPipelineStages, planVerification, pipelineInvariants } from './pipeline-stage-builder.js';
 export { routePrompt };
+export { LIGHTWEIGHT_ROUTES, GATE_PROFILE_STAGES, STAGE_BLOCKING_GATE, BLOCKING_GATE_LIMITS };
 export const PIPELINE_PLAN_ARTIFACT = 'pipeline-plan.json';
 export const PIPELINE_PLAN_SCHEMA_VERSION = 1;
 const SKILL_DREAM_HOT_PATH_COUNTERS = new Map();
@@ -60,44 +63,6 @@ const HARD_BLOCKER_ARTIFACT = 'hard-blocker.json';
 const DEFAULT_COMPLIANCE_LOOP_LIMIT = 3;
 const CLARIFICATION_BYPASS_ROUTES = new Set(['Answer', 'DFix', 'Help', 'Wiki', 'ComputerUse', 'Goal']);
 const QUESTION_GATE_ROUTES = new Set(['QALoop', 'PPT']);
-const LIGHTWEIGHT_ROUTES = new Set(['Answer', 'DFix', 'Help', 'Wiki', 'Goal']);
-const GATE_PROFILE_STAGES = Object.freeze({
-    none: [],
-    minimal: ['route_classification', 'listed_verification'],
-    scoped: ['route_classification', 'ownership', 'listed_verification', 'honest_summary'],
-    full: ['route_classification', 'ambiguity_gate', 'safety_gate', 'ownership', 'listed_verification', 'honest_summary']
-});
-const STAGE_BLOCKING_GATE = Object.freeze({
-    ambiguity_gate: 'scope',
-    safety_gate: 'safety',
-    ssot_guard: 'safety',
-    context7_evidence: 'safety',
-    mistake_recall: 'safety',
-    ownership: 'ownership',
-    pipeline_plan: 'ownership',
-    focused_implementation: 'ownership',
-    triwiki_use_first: 'ownership',
-    subagent_plan: 'ownership',
-    official_subagent_execution: 'ownership',
-    parent_integration: 'ownership',
-    route_materialization: 'ownership',
-    work_order_coverage: 'ownership',
-    engineering_sanity_check: 'verification',
-    listed_verification: 'verification',
-    triwiki_validate_before_final: 'verification',
-    completion_proof: 'verification',
-    reflection: 'verification',
-    honest_summary: 'verification'
-});
-const BLOCKING_GATE_LIMITS = Object.freeze({
-    passthrough: 0,
-    answer: 0,
-    'tiny-change': 1,
-    'bounded-work': 2,
-    'parallel-read': 2,
-    'parallel-write': 3,
-    'high-risk': 4
-});
 function reflectionInstructionText(commandPrefix = 'sks') {
     return `Post-route reflection: full routes load \`reflection\` after work/tests and before final; DFix/Answer/Help/Wiki/SKS discovery are exempt. Write ${REFLECTION_ARTIFACT}; record only real misses/gaps, or no_issue_acknowledged. For lessons, append TriWiki claim rows to ${REFLECTION_MEMORY_PATH}. Run "${commandPrefix} wiki refresh" or pack, validate, then pass ${REFLECTION_GATE}.`;
 }
@@ -182,6 +147,8 @@ export function buildPipelinePlan(input = {}) {
         verification_budget: verificationBudget,
         verification,
         engineering_sanity_review: null,
+        architecture_map: null,
+        architecture_map_unavailable: null,
         invariants,
         proof_field: proof,
         ssot_guard: buildSsotGuard({ route: route?.id || 'SKS', mode: route?.mode || 'SKS', task }),
@@ -219,6 +186,16 @@ export async function writePipelinePlan(dir, input = {}) {
             changed_scope_base: resolveChangedScopeBase(root)
         };
     }
+    if (planStagesArchitectureMap(plan)) {
+        plan.architecture_map = createArchitectureMapPlanBinding();
+        const seeded = await maybeSeedArchitectureMapForPlan({
+            root, dir, plan, missionId: input.missionId, taskProfile
+        });
+        if (seeded && seeded.ok === false) {
+            plan.architecture_map = null;
+            plan.architecture_map_unavailable = { reason: seeded.reason || 'architecture_map_baseline_unavailable' };
+        }
+    }
     await writeJsonAtomic(path.join(dir, PIPELINE_PLAN_ARTIFACT), plan);
     if (plan.engineering_sanity_review) {
         const report = await writeCodeStructureReport(root, dir, {
@@ -244,7 +221,8 @@ export function pipelinePlanState(plan) {
         pipeline_plan_ready: validatePipelinePlan(plan).ok,
         pipeline_plan_path: PIPELINE_PLAN_ARTIFACT,
         engineering_sanity_required: Boolean(sanity),
-        engineering_sanity_scope_base: sanity?.changed_scope_base || null
+        engineering_sanity_scope_base: sanity?.changed_scope_base || null,
+        architecture_map_required: Boolean(plan?.architecture_map)
     };
 }
 export async function writeRequestIntakeArtifact(dir, input = {}) {
@@ -488,130 +466,6 @@ function routeEconomyPlan(proof = {}) {
         deletion_policy: 'do_not_delete_or_skip_pipeline_stages_until_report_only_metrics_are_calibrated'
     };
 }
-function selectPipelineLane(route, task, proof, taskProfile = classifyTaskProfile(task)) {
-    if (proof.attached && proof.lane) {
-        return {
-            lane: proof.lane,
-            source: 'proof_field',
-            fast_lane_allowed: Boolean(proof.fast_lane_allowed),
-            reason: proof.fast_lane_allowed ? 'Proof Field allowed the fast lane.' : `Proof Field selected ${proof.lane}.`,
-            blockers: proof.blockers || [],
-            skip_when_fast: proof.fast_lane_allowed ? SPEED_LANE_POLICY.skip_when_fast : [],
-            keep: proof.keep || SPEED_LANE_POLICY.always_keep
-        };
-    }
-    if (taskProfile === 'passthrough' || taskProfile === 'answer')
-        return { lane: 'no_pipeline', source: 'task_profile', fast_lane_allowed: true, reason: 'Light conversation does not create an execution pipeline.', blockers: [], skip_when_fast: [], keep: [] };
-    if (route?.id === 'ComputerUse')
-        return { lane: 'computer_use_fast_lane', source: 'route_policy', fast_lane_allowed: true, reason: 'Computer Use route is intentionally direct and defers wiki/honest checks to closeout.', blockers: [], skip_when_fast: ['planning_debate'], keep: ['focused_implementation', 'triwiki_validate_before_final', 'honest_mode'] };
-    if (taskProfile === 'tiny-change')
-        return { lane: 'minimal_change_lane', source: 'task_profile', fast_lane_allowed: true, reason: 'Tiny change uses one blocking gate and one focused check at most.', blockers: [], skip_when_fast: SPEED_LANE_POLICY.skip_when_fast, keep: ['listed_verification'] };
-    if (LIGHTWEIGHT_ROUTES.has(route?.id))
-        return { lane: `${String(route.id).toLowerCase()}_lightweight_lane`, source: 'route_policy', fast_lane_allowed: true, reason: 'Lightweight route bypasses full mission orchestration by design.', blockers: [], skip_when_fast: SPEED_LANE_POLICY.skip_when_fast, keep: ['focused_implementation', 'listed_verification', 'honest_mode'] };
-    if (routeRequiresSubagents(route, task, taskProfile))
-        return { lane: 'official_subagent_lane', source: 'task_profile', fast_lane_allowed: false, reason: 'Explicit Naruto or parallel work uses the Codex subagent workflow.', blockers: [], skip_when_fast: [], keep: ['subagent_plan', 'official_subagent_execution', 'parent_integration', 'listed_verification', 'honest_summary'] };
-    if (taskProfile === 'high-risk')
-        return { lane: SPEED_LANE_POLICY.full_lane, source: 'task_profile', fast_lane_allowed: false, reason: 'High-risk work uses the full risk gate profile.', blockers: [], skip_when_fast: [], keep: SPEED_LANE_POLICY.always_keep };
-    return { lane: SPEED_LANE_POLICY.balanced_lane, source: 'route_policy', fast_lane_allowed: false, reason: 'Balanced parent-owned route until Proof Field proves a narrower lane.', blockers: ['proof_field_not_attached'], skip_when_fast: [], keep: SPEED_LANE_POLICY.always_keep };
-}
-function buildPipelineStages(route, task, taskProfile, gateProfile, ambiguity, lane, context7Required, officialSubagentPolicy = normalizeOfficialSubagentPolicy(route, task, {})) {
-    if (gateProfile === 'none')
-        return [];
-    const ids = [...GATE_PROFILE_STAGES[gateProfile]];
-    const specializedRoute = Boolean(route?.id && !LIGHTWEIGHT_ROUTES.has(route.id) && route.id !== 'SKS');
-    if (gateProfile === 'scoped' || gateProfile === 'full' || specializedRoute)
-        ids.push('pipeline_plan', 'focused_implementation');
-    if ((gateProfile === 'full' || specializedRoute) && !ids.includes('ssot_guard'))
-        ids.push('ssot_guard');
-    if (context7Required)
-        ids.push('context7_evidence');
-    if ((gateProfile === 'scoped' || gateProfile === 'full') && !LIGHTWEIGHT_ROUTES.has(route?.id)) {
-        ids.push('triwiki_use_first', 'triwiki_validate_before_final', 'mistake_recall', 'work_order_coverage');
-    }
-    if (routeNeedsEngineeringSanityReview(route, task))
-        ids.push('engineering_sanity_check');
-    if (routeRequiresSubagents(route, task, taskProfile))
-        ids.push('subagent_plan', 'official_subagent_execution', 'parent_integration');
-    if (specializedRoute)
-        ids.push('route_materialization');
-    if (specializedRoute)
-        ids.push('completion_proof');
-    if (reflectionRequiredForRoute(route))
-        ids.push('reflection');
-    return [...new Set(ids)].map((id) => {
-        const configuredGate = STAGE_BLOCKING_GATE[id] || null;
-        const blockingGate = configuredGate === 'safety' && gateProfile !== 'full'
-            ? 'ownership'
-            : configuredGate;
-        const blocking = Boolean(blockingGate);
-        const metadata = { blocking, blocking_gate: blocking ? blockingGate : null };
-        if (id === OFFICIAL_SUBAGENT_EXECUTION_STAGE_ID)
-            return { ...officialSubagentPipelineStage(officialSubagentPolicy), status: 'required', reason: officialSubagentPolicy.reason, ...metadata };
-        if (id === 'engineering_sanity_check') {
-            return {
-                id,
-                status: 'keep',
-                reason: 'required_for_code_and_database_quality',
-                checks: [
-                    'trace actual callers and preserve basic SOLID responsibility and dependency boundaries',
-                    'inspect loops, collections, resolvers, and serializers for N+1 or repeated I/O',
-                    'prove render, recursion, event, retry, and polling loops are bounded and cancellable',
-                    'reject disabled checks, swallowed errors, placeholder success, and verification bypasses',
-                    'for DB work, verify the existing canonical adapter and connection/pool lifecycle before changes',
-                    'for sensitive or multi-step DB work, verify transaction rollback, error propagation, idempotency, and post-commit invariants'
-                ],
-                ...metadata
-            };
-        }
-        if (id === 'ambiguity_gate' && ambiguity?.required === false)
-            return { id, status: 'not_applicable', reason: 'ambiguity_gate_not_required_for_entrypoint', ...metadata };
-        if (id === 'ambiguity_gate' && ambiguity?.passed)
-            return { id, status: 'passed', reason: 'ambiguity_contract_already_sealed', ...metadata };
-        return { id, status: 'keep', reason: lane.fast_lane_allowed ? 'task_profile_minimal_lane' : 'required_by_task_and_route_profile', ...metadata };
-    });
-}
-function planVerification(route, task, proof, budget) {
-    if (budget === 'none')
-        return [];
-    const out = new Set(proof.verification || []);
-    if (budget === 'single-check')
-        out.add('run one focused check for the changed surface');
-    if (budget === 'affected')
-        out.add('run affected tests or checks for changed files');
-    if (budget === 'confidence') {
-        out.add('run the focused build or typecheck for the affected package');
-        out.add('run affected regression tests and the risk-specific safety check');
-    }
-    if (budget === 'release') {
-        out.add('npm run packcheck');
-        out.add('sks selftest --mock --json');
-    }
-    if (route?.id === 'Naruto')
-        out.add('validate official subagent evidence and the parent integration summary');
-    if (routeNeedsEngineeringSanityReview(route, task)) {
-        out.add('complete the engineering sanity review for SOLID boundaries, N+1/repeated I/O, bounded loops, and verification bypasses');
-    }
-    if (route?.id === 'DB' || route?.id === 'MadSKS') {
-        out.add('verify existing canonical DB access, pool lifecycle, and transaction integrity for sensitive or multi-step mutations');
-    }
-    if (reflectionRequiredForRoute(route))
-        out.add('sks wiki validate .sneakoscope/wiki/context-pack.json');
-    return [...out];
-}
-function pipelineInvariants(input) {
-    const out = ['no_unrequested_fallback_code'];
-    if (input.stages.some((stage) => stage.id === 'engineering_sanity_check'))
-        out.push('engineering_sanity_check');
-    if (input.verificationBudget !== 'none')
-        out.push('listed_verification');
-    if (input.stages.some((stage) => stage.id === 'ssot_guard' && stage.status !== 'not_applicable'))
-        out.push('ssot_guard');
-    if (input.stages.some((stage) => stage.id === 'triwiki_validate_before_final'))
-        out.push('triwiki_validate_before_final');
-    if (input.gateProfile !== 'none')
-        out.push('honest_summary');
-    return out;
-}
 function planNextActions(route, task, taskProfile, ambiguity, lane) {
     if (taskProfile === 'passthrough' || taskProfile === 'answer')
         return [];
@@ -1593,15 +1447,7 @@ function strictNarutoIntegerOption(text, option) {
 function routeState(id, route, phase, context7Required, extra = {}) {
     const reasoning = routeReasoning(route, extra.prompt || '');
     const subagentsRequired = routeRequiresSubagents(route, extra.prompt || '');
-    return { mission_id: id, route: route.id, route_command: route.command, mode: route.mode, phase, context7_required: context7Required, context7_verified: false, subagents_required: subagentsRequired, subagents_verified: !subagentsRequired, native_sessions_required: false, native_sessions_verified: false, reflection_required: reflectionRequiredForRoute(route), engineering_sanity_required: false, engineering_sanity_scope_base: null, visible_progress_required: true, context_tracking: 'triwiki', required_skills: route.requiredSkills, stop_gate: route.stopGate, reasoning_effort: reasoning.effort, reasoning_profile: reasoning.profile, reasoning_temporary: true, goal_continuation: ambientGoalContinuation(), ...extra };
-}
-function routeNeedsEngineeringSanityReview(route, task) {
-    const id = String(route?.id || '');
-    if (['DB', 'MadSKS'].includes(id))
-        return true;
-    if (['Answer', 'Help', 'Wiki', 'Goal', 'Research', 'AutoResearch', 'PPT', 'ImageUXReview', 'ComputerUse', 'GX'].includes(id))
-        return false;
-    return looksLikeCodeChangingWork(String(task || ''));
+    return { mission_id: id, route: route.id, route_command: route.command, mode: route.mode, phase, context7_required: context7Required, context7_verified: false, subagents_required: subagentsRequired, subagents_verified: !subagentsRequired, native_sessions_required: false, native_sessions_verified: false, reflection_required: reflectionRequiredForRoute(route), engineering_sanity_required: false, engineering_sanity_scope_base: null, architecture_map_required: false, visible_progress_required: true, context_tracking: 'triwiki', required_skills: route.requiredSkills, stop_gate: route.stopGate, reasoning_effort: reasoning.effort, reasoning_profile: reasoning.profile, reasoning_temporary: true, goal_continuation: ambientGoalContinuation(), ...extra };
 }
 function routeContext(route, id, task, required, next) {
     const visibleTask = stripVisibleDecisionAnswerBlocks(task);

package/dist/core/pipeline-internals/runtime-gates.js

@@ -17,6 +17,8 @@ import { checkStopGate } from '../stop-gate/stop-gate-check.js';
 import { readWorkOrderLedger, evaluateWorkOrderCoverage } from '../work-order-ledger.js';
 import { DB_ACCESS_REVIEW_ARTIFACT, DB_REVIEW_ARTIFACT, validateDbAccessReviewArtifact, validateDbReview, validateMadSksSqlPlaneCompletion } from '../db-review.js';
 import { ENGINEERING_SANITY_REVIEW_ARTIFACT, validateEngineeringSanityReviewArtifact } from '../engineering-sanity-review.js';
+import { ARCHITECTURE_MAP_REVIEW_ARTIFACT } from '../architecture-map-review.js';
+import { architectureMapGateStatus } from '../architecture-map-pipeline.js';
 import { clarificationStopReason, context7Evidence, hasContext7DocsEvidence, hasSubagentEvidence, subagentEvidence, PIPELINE_PLAN_ARTIFACT, } from './runtime-core.js';
 import { projectTriwikiToAgentsMd } from '../triwiki/agents-md-projector.js';
 import { effectiveSubagentTarget, normalizeLegacySubagentCountFields, subagentCountContractBlockers } from '../subagents/wave-lifecycle.js';
@@ -256,6 +258,7 @@ export async function evaluateStop(root, state, payload, opts = {}) {
         && !completionProofRequired
         && !reflectionRequired
         && state?.engineering_sanity_required !== true
+        && state?.architecture_map_required !== true
         && state?.db_access_review_required !== true) {
         return null;
     }
@@ -267,12 +270,14 @@ export async function evaluateStop(root, state, payload, opts = {}) {
         && activeGatePreview?.covered_gate === 'official-subagent-evidence';
     const dbAccessPromise = dbAccessReviewGateStatus(root, state, jsonCache);
     const engineeringSanityPromise = engineeringSanityGateStatus(root, state, jsonCache);
+    const architectureMapPromise = architectureMapGateStatus(root, state);
     const context7Promise = state?.context7_required ? hasContext7DocsEvidence(root, state) : Promise.resolve(true);
     const subagentPromise = state?.subagents_required && !activeGateNotApplicable ? hasSubagentEvidence(root, state) : Promise.resolve(true);
     const mistakeRecallPromise = mistakeRecallGateStatus(root, state);
-    const [dbAccess, engineeringSanity, context7Ok, subagentOk, mistakeRecall] = await Promise.all([
+    const [dbAccess, engineeringSanity, architectureMap, context7Ok, subagentOk, mistakeRecall] = await Promise.all([
         dbAccessPromise,
         engineeringSanityPromise,
+        architectureMapPromise,
         context7Promise,
         subagentPromise,
         mistakeRecallPromise
@@ -280,6 +285,7 @@ export async function evaluateStop(root, state, payload, opts = {}) {
     await resolveRecoveredComplianceBlocker(root, state, {
         [DB_ACCESS_REVIEW_ARTIFACT]: dbAccess.ok,
         [ENGINEERING_SANITY_REVIEW_ARTIFACT]: engineeringSanity.ok,
+        [ARCHITECTURE_MAP_REVIEW_ARTIFACT]: architectureMap.ok,
         'context7-evidence': context7Ok,
         'official-subagent-evidence': subagentOk
     });
@@ -289,6 +295,9 @@ export async function evaluateStop(root, state, payload, opts = {}) {
     if (!engineeringSanity.ok) {
         return complianceBlock(root, state, `SKS ${state.route_command || state.mode || 'route'} must complete the engineering sanity review before completion. Static candidates are advisory only; inspect added hunks and real callers for SOLID boundaries, N+1/repeated I/O, bounded render/recursion/event/retry/polling behavior, and verification bypasses. Missing: ${(engineeringSanity.blockers || []).join(', ')}.`, { gate: ENGINEERING_SANITY_REVIEW_ARTIFACT, missing: engineeringSanity.blockers });
     }
+    if (!architectureMap.ok) {
+        return complianceBlock(root, state, `SKS ${state.route_command || state.mode || 'route'} must seal Architecture Map baseline before mutation and produce a passing architecture-map-review before completion. Missing: ${(architectureMap.blockers || []).join(', ')}.`, { gate: ARCHITECTURE_MAP_REVIEW_ARTIFACT, missing: architectureMap.blockers });
+    }
     if (state?.context7_required && !context7Ok) {
         return complianceBlock(root, state, `SKS ${state.route_command || state.mode || 'route'} requires Context7 evidence before completion. Use Context7 resolve-library-id, then query-docs, so SKS can record context7-evidence.jsonl.`, { gate: 'context7-evidence' });
     }
@@ -518,6 +527,8 @@ async function markReflectionInvalidatedForGateFailure(root, state = {}, detail
         return;
     if (/^work-order-ledger$/i.test(gate) || /^completion-proof$/i.test(gate))
         return;
+    if (/^atlas:/.test(gate) || /^architecture-map:/.test(gate) || /(^|[\\/])?(architecture-atlas-review|architecture-map-review|atlas-gate)(\.json)?$/i.test(gate))
+        return;
     await setCurrent(root, {
         mission_id: state.mission_id,
         reflection_invalidation_required: true,

package/dist/core/release/content-digest-cache.js

@@ -0,0 +1,70 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+export const CONTENT_DIGEST_CACHE_SCHEMA = 'sks.content-digest-cache.v1';
+export const CONTENT_DIGEST_CACHE_ENV = 'SKS_RELEASE_CONTENT_DIGEST_CACHE';
+const processMemo = new Map();
+export function contentDigestCacheEnabled() {
+    return process.env[CONTENT_DIGEST_CACHE_ENV] !== '0';
+}
+export function contentDigestCachePath(root) {
+    return path.join(root, '.sneakoscope', 'cache', 'release-digests.json');
+}
+export function statFingerprint(root, files) {
+    const hash = crypto.createHash('sha256');
+    for (const file of files) {
+        let stat;
+        try {
+            stat = fs.statSync(path.isAbsolute(file) ? file : path.join(root, file), { bigint: true });
+        }
+        catch {
+            hash.update(`${file}\0missing\0`);
+            continue;
+        }
+        hash.update(`${file}\0${stat.size}\0${stat.mtimeNs}\0${stat.ino}\0`);
+    }
+    return hash.digest('hex');
+}
+export function cachedByFingerprint(root, bucket, fingerprint, compute) {
+    if (!contentDigestCacheEnabled())
+        return compute();
+    const memoKey = `${path.resolve(root)}\0${bucket}`;
+    const memo = processMemo.get(memoKey);
+    if (memo?.fingerprint === fingerprint)
+        return structuredClone(memo.value);
+    const document = readCache(root);
+    const stored = document.entries[bucket];
+    if (stored && stored.fingerprint === fingerprint) {
+        processMemo.set(memoKey, { fingerprint, value: stored.value });
+        return structuredClone(stored.value);
+    }
+    const value = compute();
+    processMemo.set(memoKey, { fingerprint, value });
+    writeCache(root, bucket, fingerprint, value);
+    return value;
+}
+export function clearContentDigestProcessMemo() {
+    processMemo.clear();
+}
+function readCache(root) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(contentDigestCachePath(root), 'utf8'));
+        if (parsed?.schema === CONTENT_DIGEST_CACHE_SCHEMA && parsed.entries && typeof parsed.entries === 'object')
+            return parsed;
+    }
+    catch { }
+    return { schema: CONTENT_DIGEST_CACHE_SCHEMA, entries: {} };
+}
+function writeCache(root, bucket, fingerprint, value) {
+    const file = contentDigestCachePath(root);
+    try {
+        const document = readCache(root);
+        document.entries[bucket] = { fingerprint, value, recorded_at: new Date().toISOString() };
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        const temp = `${file}.${process.pid}.tmp`;
+        fs.writeFileSync(temp, `${JSON.stringify(document, null, 2)}\n`);
+        fs.renameSync(temp, file);
+    }
+    catch {
+    }
+}

package/dist/core/release/gate-manifest.js

@@ -65,6 +65,15 @@ function costFor(id) {
 export function affectedGlobsFor(id) {
     const prefix = id.split(':')[0];
     switch (prefix) {
+        case 'architecture-map':
+            return [
+                'src/core/triwiki/context-graph/architecture/**',
+                'src/core/triwiki/context-graph/projections/mermaid/**',
+                'src/core/triwiki/context-graph/store/architecture-map-store.ts',
+                'src/scripts/architecture-map-check.ts',
+                'config/architecture-map-policy.v1.json',
+                'package.json'
+            ];
         case 'architecture':
             return ['src/core/safety/ssot-guard.ts', 'src/core/pipeline-internals/runtime-core.ts', 'src/core/pipeline-internals/runtime-gates.ts', 'src/core/commands/naruto-command.ts', 'src/scripts/release-parallel-check.ts', 'src/scripts/architecture-guard-check.ts', 'docs/architecture-ts-rust-boundary.md', 'package.json'];
         case 'core-skill':

package/dist/core/release/main-push-guard.js

@@ -1,11 +1,12 @@
 import path from 'node:path';
+import { sameFilesystemPathSync } from '../fsx.js';
 import { readMacosMenubarProof, validateMacosMenubarProofArtifacts } from './macos-menubar-proof.js';
 import { fileSha256, gitOk, gitText, readJson, relative, unique } from './release-proof-io.js';
 import { releaseOriginIdentity } from './release-origin.js';
 import { releaseProofDir, validateLocalReleasePackBinding } from './release-pack-receipt.js';
 import { validatePhysicalReleaseGateInspection } from './physical-release-gates.js';
 import { validateFullReleaseStamp } from './release-stamp-proof.js';
-import { RELEASE_UPGRADE_BASELINE_SHA256, RELEASE_UPGRADE_BASELINE_VERSION, releaseUpgradeExpectedVersion, releaseUpgradeProofFilename } from './release-upgrade-baseline.js';
+import { RELEASE_UPGRADE_BASELINE_SHA256, RELEASE_UPGRADE_BASELINE_VERSION, isExpectedReleaseUpgradeLaunchctlCall, releaseUpgradeExpectedVersion, releaseUpgradeProofFilename } from './release-upgrade-baseline.js';
 export const MAIN_PUSH_GUARD_SCHEMA = 'sks.release-main-push-guard.v1';
 const RELEASE_UPGRADE_SMOKE_SCHEMA = 'sks.release-upgrade-smoke.v2';
 const RELEASE_UPGRADE_COMMAND_STAGES = Object.freeze([
@@ -244,7 +245,7 @@ function validateReleaseUpgradeIsolationAndCommands(report, blockers) {
         || !path.isAbsolute(String(safety?.launchctl_log_path || ''))
         || !lexicalSubpath(String(safety?.launchctl_log_path || ''), sandbox)
         || !Array.isArray(safety?.launchctl_calls)
-        || safety.launchctl_calls.some((call) => !/^(?:unsetenv (?:CODEX_LB_API_KEY|OPENROUTER_API_KEY)|print)$/.test(String(call)))
+        || safety.launchctl_calls.some((call) => !isExpectedReleaseUpgradeLaunchctlCall(call))
         || !Array.isArray(safety?.launchctl_unexpected_calls)
         || safety.launchctl_unexpected_calls.length > 0)
         blockers.push('install_safety_policy_invalid');
@@ -367,7 +368,7 @@ function validateDoctorCommandReceipt(command, stage, reportFile, isolation, tar
             || binding.matches_stdout !== true
             || binding.schema !== 'sks.doctor-status.v3'
             || binding.ok !== true
-            || binding.root !== isolation.workspace)
+            || !sameFilesystemPathSync(binding.root, isolation.workspace))
             blockers.push(`doctor_report_binding_invalid:${stage}`);
     }
     else if (stage !== 'target_doctor' && binding.validation_mode === 'pinned_baseline_stdout_only') {

package/dist/core/release/package-dist-snapshot.js

@@ -1,6 +1,7 @@
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import { cachedByFingerprint, statFingerprint } from './content-digest-cache.js';
 export function packageDistSnapshot(root, pkg) {
     const distRoot = path.join(root, 'dist');
     if (!fs.existsSync(distRoot))
@@ -11,6 +12,9 @@ export function packageDistSnapshot(root, pkg) {
     const included = files
         .filter((file) => packageFileIncluded(`dist/${path.relative(distRoot, file).split(path.sep).join('/')}`, entries))
         .sort();
+    return cachedByFingerprint(root, 'package-dist-snapshot', statFingerprint(root, included), () => computePackageDistSnapshot(distRoot, included));
+}
+function computePackageDistSnapshot(distRoot, included) {
     const hash = crypto.createHash('sha256');
     for (const file of included) {
         const rel = path.relative(distRoot, file).split(path.sep).join('/');
@@ -48,6 +52,10 @@ export function packageFilesSnapshot(root, pkg) {
         }
     }
     const files = [...candidates].filter((file) => packageFileIncluded(file, entries)).sort();
+    const fingerprint = statFingerprint(root, [...missingEntries.map((entry) => `missing:${entry}`), ...files]);
+    return cachedByFingerprint(root, 'package-files-snapshot', fingerprint, () => computePackageFilesSnapshot(root, files, missingEntries));
+}
+function computePackageFilesSnapshot(root, files, missingEntries) {
     const hash = crypto.createHash('sha256');
     for (const entry of missingEntries.sort()) {
         hash.update(entry);
@@ -95,6 +103,15 @@ function packageFileIncluded(file, entries) {
     }
     return included;
 }
+const PATTERN_REGEXP_CACHE = new Map();
+function packagePatternRegExps(normalized) {
+    const cached = PATTERN_REGEXP_CACHE.get(normalized);
+    if (cached)
+        return cached;
+    const compiled = expandBracePatterns(normalized).map((expanded) => globPatternToRegExp(expanded));
+    PATTERN_REGEXP_CACHE.set(normalized, compiled);
+    return compiled;
+}
 function matchesPackagePattern(file, pattern) {
     const rel = normalizeRel(file);
     const normalized = normalizeRel(pattern);
@@ -102,8 +119,7 @@ function matchesPackagePattern(file, pattern) {
         return false;
     if (!hasGlob(normalized))
         return rel === normalized || rel.startsWith(`${normalized}/`);
-    for (const expanded of expandBracePatterns(normalized)) {
-        const re = globPatternToRegExp(expanded);
+    for (const re of packagePatternRegExps(normalized)) {
         if (re.test(rel))
             return true;
         const parts = rel.split('/');

package/dist/core/release/physical-release-gates.js

@@ -3,6 +3,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { desktopBridgeReleaseSourceIdentitySha256, inspectDesktopBridgeReleaseEvidence } from './desktop-bridge-release-evidence.js';
+import { cloneBuffer, fileIdentity, inspectionKey, memoizeReleaseInspection, toolIdentity } from './release-inspection-memo.js';
 export const PHYSICAL_RELEASE_GATES_SCHEMA = 'sks.release-physical-gates.v2';
 export const PHYSICAL_RELEASE_GATES_INSPECTION_SCHEMA = 'sks.release-physical-gates-inspection.v2';
 export const PHYSICAL_RELEASE_EVIDENCE_ARTIFACT_MANIFEST_SCHEMA = 'sks.release-physical-evidence-artifact-manifest.v1';
@@ -375,6 +376,16 @@ function inspectPhysicalEvidenceArtifact(input) {
     };
 }
 function verifyGithubArtifactAttestation(input) {
+    const key = inspectionKey(input.archivePath, fileIdentity(input.archivePath), toolIdentity('gh'), input.repository, input.trustedWorkflow, input.sourceCommit, input.runId);
+    const verdict = memoizeReleaseInspection('github-artifact-attestation', key, () => {
+        const blockers = [];
+        const invocationUri = computeGithubArtifactAttestation({ ...input, blockers });
+        return { invocation_uri: invocationUri, blockers };
+    });
+    input.blockers.push(...verdict.blockers);
+    return verdict.invocation_uri;
+}
+function computeGithubArtifactAttestation(input) {
     const result = spawnSync('gh', [
         'attestation', 'verify', input.archivePath,
         '--repo', input.repository,
@@ -429,6 +440,15 @@ function readBoundArchive(file) {
     }
 }
 function listArchiveFiles(archivePath, blockers) {
+    const listing = memoizeReleaseInspection('physical-archive-listing', inspectionKey(archivePath, fileIdentity(archivePath), toolIdentity('tar')), () => {
+        const own = [];
+        const files = computeArchiveFiles(archivePath, own);
+        return { entries: files ? [...files] : null, blockers: own };
+    });
+    blockers.push(...listing.blockers);
+    return listing.entries ? new Map(listing.entries) : null;
+}
+function computeArchiveFiles(archivePath, blockers) {
     const result = spawnSync('tar', ['-tzf', archivePath], { encoding: 'utf8', maxBuffer: 16 * 1024 * 1024 });
     if (result.status !== 0) {
         blockers.push('physical_evidence_artifact_archive_unreadable');
@@ -455,12 +475,15 @@ function listArchiveFiles(archivePath, blockers) {
     return files;
 }
 function readArchiveMember(archivePath, member, label, blockers) {
-    const result = spawnSync('tar', ['-xOzf', archivePath, member], { encoding: 'buffer', maxBuffer: 64 * 1024 * 1024 });
-    if (result.status !== 0 || !Buffer.isBuffer(result.stdout)) {
+    const bytes = memoizeReleaseInspection('physical-archive-member', inspectionKey(archivePath, fileIdentity(archivePath), toolIdentity('tar'), member), () => {
+        const result = spawnSync('tar', ['-xOzf', archivePath, member], { encoding: 'buffer', maxBuffer: 64 * 1024 * 1024 });
+        return result.status !== 0 || !Buffer.isBuffer(result.stdout) ? null : result.stdout;
+    }, (value) => (value ? cloneBuffer(value) : null));
+    if (!bytes) {
         blockers.push(`${label}_unreadable`);
         return null;
     }
-    return result.stdout;
+    return bytes;
 }
 function safeArchivePath(value) {
     if (!value || value.includes('\\') || value.startsWith('/') || value.endsWith('/'))

package/dist/core/release/release-authorization-snapshot.js

@@ -2,6 +2,7 @@ import { spawnSync } from 'node:child_process';
 import crypto from 'node:crypto';
 import fs from 'node:fs';
 import path from 'node:path';
+import { cachedByFingerprint, statFingerprint } from './content-digest-cache.js';
 import { packageDistSnapshot, packageFilesSnapshot } from './package-dist-snapshot.js';
 export const RELEASE_AUTHORIZATION_SNAPSHOT_KEYS = Object.freeze([
     'git_commit',
@@ -44,6 +45,9 @@ function releaseGateHash(root, pkg) {
 }
 function releaseSourceSnapshot(root) {
     const files = gitFiles(root).filter(releaseRelevant).sort();
+    return cachedByFingerprint(root, 'release-source-snapshot', statFingerprint(root, files), () => computeReleaseSourceSnapshot(root, files));
+}
+function computeReleaseSourceSnapshot(root, files) {
     const hash = crypto.createHash('sha256');
     for (const file of files) {
         const full = path.join(root, file);

package/dist/core/release/release-gate-cache-v2.js

@@ -292,10 +292,14 @@ function writeReleaseCacheBridgeReport(root, row) {
             parsed = existing;
     }
     catch { }
+    const stamped = { ...row, recorded_at: new Date().toISOString() };
     parsed.records = [
-        ...parsed.records.filter((item) => item.gate_id !== row.gate_id || item.cache_key !== row.cache_key || item.bridge !== row.bridge),
-        row
-    ].sort((a, b) => `${a.gate_id}:${a.bridge}`.localeCompare(`${b.gate_id}:${b.bridge}`));
+        ...parsed.records.filter((item) => item.gate_id !== row.gate_id || item.bridge !== row.bridge),
+        stamped
+    ]
+        .sort((a, b) => Date.parse(String(b.recorded_at || 0)) - Date.parse(String(a.recorded_at || 0)) || 0)
+        .slice(0, releaseCacheBridgeRecordLimit())
+        .sort((a, b) => `${a.gate_id}:${a.bridge}`.localeCompare(`${b.gate_id}:${b.bridge}`));
     fs.mkdirSync(path.dirname(file), { recursive: true });
     fs.writeFileSync(file, `${JSON.stringify(parsed, null, 2)}\n`);
 }
@@ -317,9 +321,29 @@ function writeCacheRecord(file, key, record) {
     parsed.schema = RELEASE_GATE_CACHE_V2_SCHEMA;
     parsed.records ||= {};
     parsed.records[key] = record;
+    parsed.records = pruneCacheRecords(parsed.records);
     fs.mkdirSync(path.dirname(file), { recursive: true });
     fs.writeFileSync(file, `${JSON.stringify(parsed, null, 2)}\n`);
 }
+export function pruneCacheRecords(records, keep = releaseGateCacheRecordLimit()) {
+    const entries = Object.entries(records || {});
+    if (entries.length <= keep)
+        return records;
+    const ordered = entries.sort((left, right) => recordedAtMs(right[1]) - recordedAtMs(left[1]));
+    return Object.fromEntries(ordered.slice(0, keep));
+}
+export function releaseGateCacheRecordLimit() {
+    const configured = Number(process.env.SKS_RELEASE_GATE_CACHE_RECORD_LIMIT);
+    return Number.isFinite(configured) && configured > 0 ? Math.floor(configured) : 600;
+}
+export function releaseCacheBridgeRecordLimit() {
+    const configured = Number(process.env.SKS_RELEASE_CACHE_BRIDGE_RECORD_LIMIT);
+    return Number.isFinite(configured) && configured > 0 ? Math.floor(configured) : 600;
+}
+function recordedAtMs(record) {
+    const parsed = Date.parse(String(record?.recorded_at || ''));
+    return Number.isFinite(parsed) ? parsed : 0;
+}
 function hashFileIfPresent(hash, file) {
     if (fs.existsSync(file) && fs.statSync(file).isFile())
         hash.update(fs.readFileSync(file));

package/dist/core/release/release-gate-contract.js

@@ -2,6 +2,8 @@ import crypto from 'node:crypto';
 export const RELEASE_GATE_CONTRACT_SCHEMA = 'sks.release-gate-contract.v1';
 export const RELEASE_GATE_CONTRACT_IDS = Object.freeze([
     'architecture:guard',
+    'architecture-map:contract',
+    'architecture-map:legacy-closure',
     'codex:current:app-server-v2',
     'codex:current:binary-identity',
     'codex:current:capability',

package/dist/core/release/release-gate-dag.js

@@ -10,6 +10,7 @@ import { RELEASE_GATE_NODE_SCHEMA, validateReleaseGateManifest } from './release
 import { countReleaseGateResources, defaultReleaseGateBudget, summarizeReleaseGateBudget } from './release-gate-resource-governor.js';
 import { selectAffectedReleaseGates } from './release-gate-affected-selector.js';
 import { computeTriWikiAffectedGraph } from '../triwiki/triwiki-affected-graph.js';
+import { pruneTriWikiProofBank } from '../triwiki/triwiki-proof-bank.js';
 import { executeExtremeSchedule } from './extreme-parallel-scheduler.js';
 import { computeResourceClassBudget } from './resource-class-budget.js';
 import { guardedProcessKill, guardContextForRoute } from '../safety/mutation-guard.js';
@@ -106,6 +107,7 @@ export async function runReleaseGateDag(input) {
         throw new Error(`release_gate_selection_missing_dependencies:${[...new Set(missingSelectedDeps)].sort().join(',')}`);
     const runId = `rg-${new Date().toISOString().replace(/[:.]/g, '-')}-${process.pid}`;
     const retentionBefore = await pruneOldReleaseGateRunDirs(root);
+    const proofBankRetention = pruneTriWikiProofBank(root);
     await sweepSksTempDirs(root, { maxAgeHours: 24 }).catch(() => null);
     const reportDir = path.join(root, '.sneakoscope', 'reports', 'release-gates', runId);
     fs.mkdirSync(reportDir, { recursive: true });
@@ -113,6 +115,7 @@ export async function runReleaseGateDag(input) {
     const affectedGraphFile = path.join(reportDir, 'affected-gate-graph.json');
     const completionCertificateFile = path.join(reportDir, 'completion-certificate.json');
     appendReleaseGateJsonl(timeline, { event: 'retention', phase: 'before_run', ...retentionBefore, at: new Date().toISOString() });
+    appendReleaseGateJsonl(timeline, { event: 'proof_bank_retention', phase: 'before_run', ...proofBankRetention, at: new Date().toISOString() });
     const started = Date.now();
     const slaMs = Math.max(1, Math.floor(Number(input.slaMs || 300000)));
     const pending = new Map(selected.map((gate) => [gate.id, gate]));