sneakoscope 8.4.0 → 8.6.0

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-This README documents package **SKS 8.4.0** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
+This README documents package **SKS 8.6.0** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
 
 Use the official latest stable SKS and Codex CLI releases. The Codex compatibility SSOT is always the **current latest stable** host; capability probes measure what that host can actually do. Product docs do not crown a fixed `0.x.y` string as SSOT (release pins and schema directories are measured artifacts for the current package, not a permanent product version claim). Menu Bar / Center induce updates to the latest stable build. Run `sks update-check` for what is installed and read the capability report for what is supported. Install SSOT is npm `sneakoscope@latest`; PATH `sks` and Menu Bar stamped generation must match that version or gates fail. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it (Codex official multi-agent wrap-only; SKS does not reimplement a parallel runtime). Local code search is mode-separated (`sks search files|text|structure|symbol|context`); `context` is answered by the compiled TriWiki Context Graph (`context-graph.json` is exhaustive authority; `context-pack.json` and managed `AGENTS.md` are bounded projections) — see [docs/architecture/context-graph.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/architecture/context-graph.md) and [docs/PRODUCT-CONTRACT.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/PRODUCT-CONTRACT.md). See [CHANGELOG.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/CHANGELOG.md).
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "8.4.0"
+version = "8.6.0"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "8.4.0"
+version = "8.6.0"
 edition = "2021"
 
 [dependencies]

package/dist/commands/doctor.js

@@ -825,6 +825,7 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
             phases: [
                 {
                     id: 'setup',
+                    report: () => setupRepair,
                     run: async () => ({
                         id: 'setup',
                         ok: setupRepair !== null,
@@ -835,6 +836,7 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
                 },
                 {
                     id: 'codex_startup_repair',
+                    report: () => codexStartupRepair,
                     run: async () => ({
                         id: 'codex_startup_repair',
                         ok: codexStartupRepair?.ok !== false,
@@ -846,6 +848,7 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
                 },
                 {
                     id: 'startup_config_repair',
+                    report: () => startupConfigRepair,
                     run: async () => ({
                         id: 'startup_config_repair',
                         ok: startupConfigRepair?.ok === true,
@@ -856,6 +859,7 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
                 },
                 {
                     id: 'codex_config_syntax_repair',
+                    report: () => codexConfigSyntaxRepair,
                     run: async () => ({
                         id: 'codex_config_syntax_repair',
                         ok: codexConfigSyntaxRepair?.ok !== false,
@@ -867,6 +871,7 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
                 },
                 {
                     id: 'context7_repair',
+                    report: () => context7Repair,
                     run: async () => ({
                         id: 'context7_repair',
                         ok: context7Repair?.ok !== false,
@@ -878,6 +883,7 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
                 },
                 {
                     id: 'context7_mcp_repair',
+                    report: () => context7McpRepair,
                     run: async () => ({
                         id: 'context7_mcp_repair',
                         ok: context7McpRepair?.ok === true,
@@ -890,6 +896,7 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
                 },
                 {
                     id: 'supabase_mcp_repair',
+                    report: () => supabaseMcpRepair,
                     required_for_ready: false,
                     run: async () => ({
                         id: 'supabase_mcp_repair',
@@ -904,6 +911,7 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
                 },
                 {
                     id: 'hook_trust_repair',
+                    report: () => hookTrustRepair,
                     run: async () => ({
                         id: 'hook_trust_repair',
                         ok: hookTrustRepair?.ok !== false,
@@ -917,6 +925,7 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
                 },
                 {
                     id: 'sks_menubar',
+                    report: () => sksMenuBar,
                     required_for_ready: false,
                     run: async () => ({
                         id: 'sks_menubar',
@@ -961,6 +970,7 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
                 },
                 {
                     id: 'command_alias_cleanup',
+                    report: () => commandAliasCleanupBeforeReceipt,
                     run: async () => ({
                         id: 'command_alias_cleanup',
                         ok: commandAliasCleanupBeforeReceipt?.ok !== false,
@@ -972,6 +982,7 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
                 },
                 {
                     id: 'native_capability_repair',
+                    report: () => doctorNativeCapabilityRepair,
                     required_for_ready: false,
                     run: async () => ({
                         id: 'native_capability_repair',
@@ -1214,6 +1225,20 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
             warnings: []
         }))
         : null;
+    const configDiskVerification = doctorFix
+        ? await (await import('../core/doctor/doctor-repair-postcheck.js')).verifyCodexConfigsOnDisk({ root })
+            .catch((err) => ({
+            schema: 'sks.doctor-config-disk-verification.v1',
+            ok: false,
+            project_config_path: '',
+            codex_home_config_path: '',
+            project_config_present: false,
+            codex_home_config_present: false,
+            multi_agent_v2_enabled: null,
+            agents_enabled: null,
+            blockers: [`config_disk_verification_failed:${err?.message || String(err)}`]
+        }))
+        : null;
     const codexAppHarnessMatrix = deepDiagnostics
         ? await buildCodexAppHarnessMatrix({ root, mode: 'read-only' }).catch((err) => ({
             schema: 'sks.codex-app-harness-matrix.v1',
@@ -1385,16 +1410,36 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
         }
     }
     const runtimeReadiness = buildRuntimeReadiness(codexNativeFeatureMatrix);
-    const resultOk = ready.ready
-        && (!sksUpdate || sksUpdate.ok !== false)
-        && (!doctorFix || migrationReceiptOwnsReconcile || skillsReconcile?.convergence?.ok === true)
-        && commandAliasCleanup.ok !== false
-        && codexStartupRepair.ok !== false
-        && codexConfigSyntaxRepair?.ok !== false
-        && agentRoleConfigRepair.ok !== false
-        && openRouterProviderRepair.ok !== false
-        && (officialSubagentConfig.blockers || []).length === 0
-        && (!doctorProfileRequiresDesktopBridgeReadiness(doctorProfile) || desktopBridge.ok !== false);
+    const resultBlockers = [
+        ...(ready.ready
+            ? []
+            : (Array.isArray(ready.blockers) && ready.blockers.length
+                ? ready.blockers.map((blocker) => `readiness:${String(blocker)}`)
+                : ['readiness_not_ready'])),
+        ...(sksUpdate && sksUpdate.ok === false ? ['sks_update_blocked'] : []),
+        ...(doctorFix && !migrationReceiptOwnsReconcile && skillsReconcile?.convergence?.ok !== true
+            ? ['managed_skill_reconcile_not_converged']
+            : []),
+        ...(commandAliasCleanup.ok === false ? ['command_alias_cleanup_blocked'] : []),
+        ...(codexStartupRepair.ok === false ? ['codex_startup_repair_blocked'] : []),
+        ...(codexConfigSyntaxRepair?.ok === false ? ['codex_config_syntax_repair_blocked'] : []),
+        ...(agentRoleConfigRepair.ok === false ? ['agent_role_config_repair_blocked'] : []),
+        ...(openRouterProviderRepair.ok === false ? ['openrouter_provider_repair_blocked'] : []),
+        ...((officialSubagentConfig.blockers || [])
+            .map((blocker) => `official_subagent_config:${String(blocker)}`)),
+        ...(doctorProfileRequiresDesktopBridgeReadiness(doctorProfile) && desktopBridge.ok === false
+            ? ['desktop_bridge_not_ready']
+            : []),
+        ...(mcpTransportCollisionRepair?.ok === false ? ['mcp_transport_collision_repair_blocked'] : []),
+        ...(codexNativeRepair?.ok === false ? ['codex_native_repair_blocked'] : []),
+        ...(configDiskVerification?.blockers || [])
+            .map((blocker) => `config_disk_verification:${String(blocker)}`)
+    ];
+    const resultOk = resultBlockers.length === 0;
+    const repairOperatorActions = [
+        ...(codexStartupRepair?.config_file_repair?.operator_actions || []),
+        ...(agentRoleConfigRepair?.operator_actions || [])
+    ].map(String).filter(Boolean);
     const result = {
         schema: 'sks.doctor-status.v3',
         elapsed_ms: Date.now() - startedAtMs,
@@ -1409,11 +1454,14 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
         not_counted_as_full_doctor: !deepDiagnostics,
         root,
         arg_warnings: argWarnings,
+        blockers: [...new Set(resultBlockers.map(String))],
         warnings: [...oauthCallbackPortDiagnostic.warnings, ...(desktopBridge.warnings || [])],
-        operator_actions: [
-            ...oauthCallbackOperatorActions,
-            ...(desktopBridge.ok === false ? desktopBridge.recovery_actions || [] : [])
-        ],
+        operator_actions: [...new Set([
+                ...oauthCallbackOperatorActions,
+                ...(desktopBridge.ok === false ? desktopBridge.recovery_actions || [] : []),
+                ...repairOperatorActions,
+                ...(resultOk ? [] : ['Each blocker above names a report under .sneakoscope/reports/; re-run `sks doctor --full --json` after resolving them.'])
+            ].map(String).filter(Boolean))],
         node: { ok: Number(process.versions.node.split('.')[0]) >= 20, version: process.version },
         codex,
         oauth_callback_port_diagnostic: oauthCallbackPortDiagnostic,
@@ -1438,8 +1486,9 @@ async function runDoctor(args = [], root, doctorFix, deps = {}) {
         supabase_mcp_repair: supabaseMcpRepair,
         doctor_fix_transaction: doctorFixTransaction,
         doctor_fix_postcheck: doctorFixPostcheck,
+        config_disk_verification: configDiskVerification,
         postcheck: doctorFixPostcheck ? {
-            ok: doctorFixPostcheck.ok === true,
+            ok: doctorFixPostcheck.ok === true && configDiskVerification?.ok !== false,
             pending_manual: doctorFixPostcheck.pending_manual || [],
             required_blockers: doctorFixPostcheck.required_blockers || [],
             optional_warnings: doctorFixPostcheck.optional_warnings || []

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "8.4.0",
+  "package_version": "8.6.0",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/architecture-map-pipeline.js

@@ -46,9 +46,10 @@ export async function seedArchitectureMapPlanBinding(dir, plan) {
     return plan;
 }
 export async function maybeSeedArchitectureMapForPlan(input) {
-    if (!input.plan?.architecture_map || !input.missionId)
-        return;
-    await seedArchitectureMapBaselineArtifacts({
+    if (!input.plan?.architecture_map || !input.missionId) {
+        return { ok: false, reason: 'architecture_map_not_planned' };
+    }
+    return seedArchitectureMapBaselineArtifacts({
         root: input.root,
         dir: input.dir,
         missionId: String(input.missionId),

package/dist/core/codex/agent-config-file-repair.js

@@ -1,8 +1,13 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
 import { nowIso, readJson, writeJsonAtomic } from '../fsx.js';
-import { backupInvalidToml, inspectOfficialSubagentToml, mergeOfficialSubagentConfig, officialSubagentConfigOwnershipProof, officialSubagentConfigWarnings, readInheritedOfficialSubagentConfigText } from '../subagents/official-subagent-config.js';
+import { SKS_MANAGED_CODEX_CONFIG_MARKER, backupInvalidToml, inspectOfficialSubagentToml, mergeOfficialSubagentConfigResult, officialSubagentConfigOwnershipProof, officialSubagentConfigWarnings, readInheritedOfficialSubagentConfigText } from '../subagents/official-subagent-config.js';
 import { writeCodexConfigGuarded } from './codex-config-guard.js';
+function unmanagedConfigOperatorAction(configPath) {
+    return `Refused to modify ${configPath}: no SKS ownership proof. `
+        + `If SKS owns this file, add the line \`${SKS_MANAGED_CODEX_CONFIG_MARKER}\` as its first line `
+        + 'and re-run `sks doctor --fix`. Otherwise run `sks setup` to regenerate a managed config.';
+}
 export async function repairAgentConfigFileReferences(input) {
     const root = path.resolve(input.root);
     const configPath = path.join(root, '.codex', 'config.toml');
@@ -37,6 +42,10 @@ export async function repairAgentConfigFileReferences(input) {
                 ...(!ownershipProof.owned ? ['user_owned_file_without_sks_marker'] : [])
             ],
             warnings: [],
+            operator_actions: [
+                `${configPath} is not valid TOML; SKS preserved it and wrote a backup. Fix the syntax, then re-run \`sks doctor --fix\`.`,
+                ...(!ownershipProof.owned ? [unmanagedConfigOperatorAction(configPath)] : [])
+            ],
             ownership_proof: ownershipProof
         });
     }
@@ -55,6 +64,7 @@ export async function repairAgentConfigFileReferences(input) {
             manual_required: true,
             blockers: ['user_owned_file_without_sks_marker'],
             warnings: [],
+            operator_actions: [unmanagedConfigOperatorAction(configPath)],
             ownership_proof: ownershipProof
         });
     }
@@ -62,13 +72,14 @@ export async function repairAgentConfigFileReferences(input) {
         ...(input.home ? { home: input.home } : {}),
         ...(input.codexHome ? { codexHome: input.codexHome } : {})
     });
-    const merged = mergeOfficialSubagentConfig(original, {
+    const mergeResult = mergeOfficialSubagentConfigResult(original, {
         sksOwned: ownershipProof.owned,
         inheritedText
     });
+    const merged = mergeResult.text;
     const validation = inspectOfficialSubagentToml(merged);
     const warnings = officialSubagentConfigWarnings(merged, inheritedText);
-    const blockers = [];
+    const blockers = [...mergeResult.blockers];
     let changed = merged !== original;
     let writeSucceeded = input.apply !== true;
     let backupPath = null;
@@ -104,6 +115,9 @@ export async function repairAgentConfigFileReferences(input) {
         manual_required: blockers.length > 0,
         blockers,
         warnings,
+        operator_actions: blockers.map((blocker) => blocker === 'user_owned_file_without_sks_marker'
+            ? unmanagedConfigOperatorAction(configPath)
+            : `${configPath}: ${blocker}. Re-run \`sks doctor --fix\` after resolving it, or run \`sks setup\` to regenerate a managed config.`),
         ownership_proof: ownershipProof
     };
     return writeReport(input.reportPath, root, report);

package/dist/core/codex/codex-config-guard.js

@@ -4,6 +4,7 @@ import { randomBytes } from 'node:crypto';
 import { appendJsonl, ensureDir, nowIso, readText, sha256, writeTextAtomic } from '../fsx.js';
 import { diffCodexAppUiSnapshots, snapshotCodexAppUiState } from '../codex-app/codex-app-ui-state-snapshot.js';
 import { cleanupCodexConfigBackups, validateCodexConfigRoundTrip } from './codex-config-toml.js';
+import { hasManagedAgentsConfigFingerprint } from '../subagents/official-subagent-config.js';
 import { escapeRegExp } from '../text/regex.js';
 import { withFileLock } from '../locks/file-lock.js';
 export const SKS_MANAGED_CODEX_CONFIG_MARKER = '# SKS-MANAGED-CODEX-CONFIG';
@@ -576,7 +577,8 @@ export function isProjectCodexConfig(root, configPath) {
 export function hasSksManagedCodexConfigMarker(text) {
     const source = String(text || '');
     return hasExplicitSksManagedCodexConfigMarker(source)
-        || /(?:SKS managed|Sneakoscope|sneakoscope|sks_|agents\.native_agent|agents\.implementation_worker|multi_agent)/i.test(source)
+        || /(?:SKS managed|Sneakoscope|sneakoscope|sks_|agents\.native_agent|agents\.implementation_worker)/i.test(source)
+        || hasManagedAgentsConfigFingerprint(source)
         || /^\s*model_provider\s*=\s*["']codex-lb["']\s*(?:#.*)?$/mi.test(source)
         || /^\s*default_profile\s*=\s*["']sks-fast-high["']\s*(?:#.*)?$/mi.test(source)
         || /^\s*\[(?:user\.fast_mode|model_providers\.(?:"codex-lb"|codex-lb)|profiles\.(?:"sks-fast-high"|sks-fast-high))\]\s*(?:#.*)?$/mi.test(source);

package/dist/core/codex/codex-feature-flags.js

@@ -0,0 +1,10 @@
+export const MANAGED_CODEX_FEATURE_FLAGS = Object.freeze(['hooks', 'fast_mode', 'apps']);
+export const REMOVED_CODEX_FEATURE_FLAGS = Object.freeze([
+    'fast_mode_ui',
+    'codex_hooks',
+    'remote_control',
+    'codex_git_commit',
+    'plugin_hooks',
+    'js_repl',
+    'multi_agent_mode'
+]);

package/dist/core/codex/codex-project-config-policy.js

@@ -118,20 +118,8 @@ export async function splitCodexProjectConfigPolicy(rootInput = process.cwd(), o
     let backupPath = null;
     let userConfigPath = null;
     let profileConfigPath = null;
-    if (opts.apply && changed) {
-        backupPath = `${configPath}.bak-${Date.now().toString(36)}`;
-        await ensureDir(path.dirname(configPath));
-        await fsp.copyFile(configPath, backupPath);
-        await cleanupCodexConfigBackups(configPath, { keepPerTag: 3, maxAgeMs: 30 * 24 * 60 * 60 * 1000 }).catch(() => undefined);
-        await writeCodexConfigGuarded({
-            root,
-            configPath,
-            before: String(original || ''),
-            cause: 'codex-project-config-policy',
-            mutate: () => projectText
-        });
-        actions.push('project_config_rewritten_with_backup');
-    }
+    const writeBlockers = [];
+    let machineLocalMoved = true;
     if (opts.apply && split.machine_text.trim()) {
         await ensureDir(codexHome);
         userConfigPath = codexHomeConfigPath;
@@ -139,15 +127,39 @@ export async function splitCodexProjectConfigPolicy(rootInput = process.cwd(), o
         const machineText = preserveExistingGlobalFastModeConfig(String(currentUser || ''), split.machine_text);
         const dedupedUser = removeConfigIds(String(currentUser || ''), configIds(machineText));
         const commentLine = `# SKS moved machine-local Codex config from ${path.relative(root, configPath) || configPath} at ${nowIso()}`;
-        const mergedUser = mergeMachineLocalIntoUserConfig(dedupedUser, machineText.trim(), commentLine);
-        await writeCodexConfigGuarded({
+        const mergedUser = mergeMachineLocalIntoUserConfig(stripSksMovedComments(dedupedUser), machineText.trim(), commentLine);
+        const homeWrite = await writeCodexConfigGuarded({
             root,
             configPath: userConfigPath,
             before: String(currentUser || ''),
             cause: 'codex-project-config-policy-machine-local',
             mutate: () => mergedUser
         });
-        actions.push('machine_local_keys_moved_to_codex_home_config');
+        machineLocalMoved = homeWrite.ok;
+        if (homeWrite.ok)
+            actions.push('machine_local_keys_moved_to_codex_home_config');
+        else
+            writeBlockers.push(`machine_local_move_refused:${homeWrite.status}`);
+    }
+    if (opts.apply && changed && machineLocalMoved) {
+        backupPath = `${configPath}.bak-${Date.now().toString(36)}`;
+        await ensureDir(path.dirname(configPath));
+        await fsp.copyFile(configPath, backupPath);
+        await cleanupCodexConfigBackups(configPath, { keepPerTag: 3, maxAgeMs: 30 * 24 * 60 * 60 * 1000 }).catch(() => undefined);
+        const projectWrite = await writeCodexConfigGuarded({
+            root,
+            configPath,
+            before: String(original || ''),
+            cause: 'codex-project-config-policy',
+            mutate: () => projectText
+        });
+        if (projectWrite.ok)
+            actions.push('project_config_rewritten_with_backup');
+        else
+            writeBlockers.push(`project_config_write_refused:${projectWrite.status}`);
+    }
+    else if (opts.apply && changed) {
+        writeBlockers.push('project_config_rewrite_skipped_machine_local_move_refused');
     }
     if (profileName)
         actions.push('legacy_project_profile_selector_removed');
@@ -157,7 +169,7 @@ export async function splitCodexProjectConfigPolicy(rootInput = process.cwd(), o
         root,
         config_path: configPath,
         codex_home: codexHome,
-        ok: parseSmoke.ok && split.blockers.length === 0,
+        ok: parseSmoke.ok && split.blockers.length === 0 && writeBlockers.length === 0,
         changed,
         applied: opts.apply === true,
         backup_path: backupPath,
@@ -175,7 +187,11 @@ export async function splitCodexProjectConfigPolicy(rootInput = process.cwd(), o
         deprecated_approval_policy_fixed: split.deprecated_approval_policy_fixed,
         actions,
         parse_smoke: parseSmoke,
-        blockers: [...split.blockers, ...(parseSmoke.ok ? [] : ['project_config_rewrite_parse_smoke_failed'])]
+        blockers: [
+            ...split.blockers,
+            ...writeBlockers,
+            ...(parseSmoke.ok ? [] : ['project_config_rewrite_parse_smoke_failed'])
+        ]
     };
     if (opts.writeReport !== false)
         await writeJsonAtomic(reportPath, { ...report, report_path: reportPath });
@@ -201,28 +217,36 @@ export async function repairCodexConfigStructure(configPathInput, opts = {}) {
     }
     const hoist = hoistMisplacedMachineLocalKeys(String(original));
     let backupPath = null;
+    let applied = false;
+    const writeBlockers = [];
     if (opts.apply && hoist.changed) {
         backupPath = `${configPath}.struct-bak-${Date.now().toString(36)}`;
         await ensureDir(path.dirname(configPath));
         await fsp.copyFile(configPath, backupPath);
         await cleanupCodexConfigBackups(configPath, { keepPerTag: 3, maxAgeMs: 30 * 24 * 60 * 60 * 1000 }).catch(() => undefined);
-        await writeCodexConfigGuarded({
+        const guarded = await writeCodexConfigGuarded({
             configPath,
             before: String(original || ''),
             cause: 'codex-config-structure-repair',
             mutate: () => hoist.text
         });
+        applied = guarded.ok;
+        if (!guarded.ok)
+            writeBlockers.push(`config_write_guard:${guarded.status}`);
     }
     const parseSmoke = tomlRewriteSmoke(hoist.text);
     return {
         config_path: configPath,
-        ok: parseSmoke.ok,
-        status: hoist.changed ? (opts.apply ? 'structure_repaired' : 'structure_repair_available') : 'structure_ok',
+        ok: parseSmoke.ok && writeBlockers.length === 0,
+        status: hoist.changed
+            ? (applied ? 'structure_repaired' : opts.apply ? 'structure_repair_refused' : 'structure_repair_available')
+            : 'structure_ok',
         changed: hoist.changed,
-        applied: opts.apply === true && hoist.changed,
+        applied,
         hoisted_keys: hoist.hoisted_keys,
         backup_path: backupPath,
-        parse_smoke: parseSmoke
+        parse_smoke: parseSmoke,
+        blockers: writeBlockers
     };
 }
 function isCodexConfigToml(file) {
@@ -451,12 +475,6 @@ function tomlRewriteSmoke(text) {
         invalid_table_header: badHeader || null
     };
 }
-function profileTableBody(blocks, profile) {
-    const block = blocks.find((item) => item.table === `profiles.${profile}`);
-    if (!block)
-        return '';
-    return block.text.split('\n').filter((line) => !/^\s*\[/.test(line)).join('\n');
-}
 function configIds(text) {
     const ids = { keys: new Set(), tables: new Set() };
     for (const block of tomlBlocks(text)) {
@@ -512,6 +530,12 @@ function mergeMachineLocalIntoUserConfig(userText, machineText, commentLine) {
     }
     return normalizeProjectText(sections.join('\n\n'));
 }
+function stripSksMovedComments(text) {
+    return normalizeProjectText(String(text || '')
+        .split('\n')
+        .filter((line) => !/^\s*#\s*SKS moved machine-local Codex config\b/i.test(line))
+        .join('\n'));
+}
 function collectTomlSections(text, preamble, tables) {
     for (const block of tomlBlocks(text)) {
         if (block.table)

package/dist/core/codex/codex-startup-config-postcheck.js

@@ -16,9 +16,14 @@ export async function postcheckCodexStartupConfig(input) {
     const rolePlan = await installOfficialSubagentAgentConfigs(root, { apply: false });
     const tomlSmoke = tomlSyntaxSmoke(text);
     const orphanChildTables = orphanMcpChildTables(text);
+    const multiAgentV2Disabled = officialConfig.multiAgentV2.enabled === false;
     const blockers = [
         ...(!configPresent ? ['project_official_subagent_config_missing'] : []),
         ...(!tomlValidation.ok ? ['project_official_subagent_config_toml_parse_failed'] : []),
+        ...(multiAgentV2Disabled ? ['official_subagent_multi_agent_v2_disabled'] : []),
+        ...(multiAgentV2Disabled && officialConfig.enabled === false
+            ? ['official_subagent_agents_disabled']
+            : []),
         ...officialConfig.blockers.map((item) => `official_subagent_config:${item}`),
         ...rolePlan.missing.map((file) => `missing_official_subagent_agent:${file}`),
         ...rolePlan.stale.map((file) => `stale_official_subagent_agent:${file}`),

package/dist/core/codex-hooks/codex-hook-state-writer.js

@@ -160,6 +160,8 @@ function upsertTomlTable(text, table, block) {
             break;
         }
     }
+    while (end > start + 1 && !String(lines[end - 1] || '').trim())
+        end -= 1;
     lines.splice(start, end - start, ...blockLines);
     return lines.join('\n').replace(/\n{3,}/g, '\n\n');
 }

package/dist/core/codex-lb/desktop-bridge/security.js

@@ -158,22 +158,25 @@ export function resolveBridgeRequestRoute(request, policy, pins) {
     const sessionId = request.session_id ? canonicalSessionId(request.session_id) : null;
     const pin = sessionId ? pins.find((entry) => entry.thread_id === sessionId) || null : null;
     if (pin && pin.public_model === publicModel) {
-        if (pin.public_model !== publicModel
-            || pin.catalog_generation !== policy.catalog_generation
-            || pin.route_policy_generation !== policy.policy_generation) {
-            throw new DesktopBridgeError('session_pin_route_unavailable');
-        }
         const current = policy.model_routes[publicModel];
         if (!current || current.provider_id !== pin.provider_id || current.upstream_model !== pin.upstream_model) {
             throw new DesktopBridgeError('session_pin_route_unavailable');
         }
+        const aged = pin.catalog_generation !== policy.catalog_generation
+            || pin.route_policy_generation !== policy.policy_generation;
         return {
             provider_id: pin.provider_id,
             public_model: publicModel,
             upstream_model: pin.upstream_model,
-            catalog_generation: pin.catalog_generation,
-            route_policy_generation: pin.route_policy_generation,
-            session_pin: pin,
+            catalog_generation: policy.catalog_generation,
+            route_policy_generation: policy.policy_generation,
+            session_pin: aged
+                ? {
+                    ...pin,
+                    catalog_generation: policy.catalog_generation,
+                    route_policy_generation: policy.policy_generation,
+                }
+                : pin,
         };
     }
     const route = policy.model_routes[publicModel];

package/dist/core/codex-lb/request-route-resolver.js

@@ -22,11 +22,13 @@ export function resolveBridgeRequestRoute(request, policy, options) {
     if (options.active_catalog_generation && options.active_catalog_generation !== policy.catalog_generation) {
         return blocked(base, 'catalog_route_index_stale');
     }
-    const pin = request.thread_id ? findSessionPin(options.session_pins, request.thread_id) : null;
-    if (pin && canonicalizeBridgeModelId(pin.public_model) === model) {
-        const pinBlocker = validateSessionPin(pin, policy, options.route_index, options.registry);
-        if (pinBlocker)
-            return blocked(base, pinBlocker);
+    const threadPin = request.thread_id ? findSessionPin(options.session_pins, request.thread_id) : null;
+    const pin = threadPin && canonicalizeBridgeModelId(threadPin.public_model) === model ? threadPin : null;
+    const pinAffinity = pin ? sessionPinAffinity(pin, policy, options.route_index, options.registry) : null;
+    if (pinAffinity === 'unprovable')
+        return blocked(base, 'session_pin_route_unavailable');
+    const pinClaim = pinAffinity && pinAffinity !== 'honored' ? pinAffinity : null;
+    if (pin && pinAffinity === 'honored') {
         const route = { provider_id: pin.provider_id, upstream_model: pin.upstream_model };
         const providerBlocker = validateProviderRoute(route, request.requested_endpoint_origin, options.registry, options.route_index);
         if (providerBlocker)
@@ -51,6 +53,8 @@ export function resolveBridgeRequestRoute(request, policy, options) {
         return blocked(base, 'catalog_model_route_missing');
     if (!sameTarget(indexed, policyTarget))
         return blocked(base, 'bridge_route_policy_route_index_mismatch');
+    if (pinClaim && !sameTarget(indexed, pinClaim))
+        return blocked(base, 'session_pin_route_unavailable');
     const providerBlocker = validateProviderRoute(indexed, request.requested_endpoint_origin, options.registry, options.route_index);
     if (providerBlocker)
         return blocked(base, providerBlocker);
@@ -76,23 +80,22 @@ export function resolveBridgeRequestRoute(request, policy, options) {
         recovery_action: null
     };
 }
-function validateSessionPin(pin, policy, routeIndex, registry) {
-    if (pin.catalog_generation !== policy.catalog_generation
-        || pin.route_policy_generation !== policy.policy_generation) {
-        return 'session_pin_route_unavailable';
-    }
-    if (!isProviderId(pin.provider_id) || !registry.profiles[pin.provider_id]) {
-        return 'session_pin_route_unavailable';
-    }
+function sessionPinAffinity(pin, policy, routeIndex, registry) {
+    if (!isProviderId(pin.provider_id) || !registry.profiles[pin.provider_id])
+        return 'unprovable';
     const model = canonicalizeBridgeModelId(pin.public_model);
     const upstream = normalizeBridgeUpstreamModelId(pin.upstream_model);
     if (!model || !upstream)
-        return 'session_pin_route_unavailable';
-    const indexed = routeIndex.routes[model] || routeIndex.routes[`${pin.provider_id}:${model}`];
-    if (!indexed || indexed.provider_id !== pin.provider_id || indexed.upstream_model !== upstream) {
-        return 'session_pin_route_unavailable';
+        return 'unprovable';
+    const claim = { provider_id: pin.provider_id, upstream_model: upstream };
+    if (pin.catalog_generation !== policy.catalog_generation
+        || pin.route_policy_generation !== policy.policy_generation) {
+        return claim;
     }
-    return null;
+    const indexed = routeIndex.routes[model] || routeIndex.routes[`${pin.provider_id}:${model}`];
+    if (!indexed || !sameTarget(indexed, claim))
+        return claim;
+    return 'honored';
 }
 function validateProviderRoute(route, requestedOrigin, registry, routeIndex) {
     if (!isProviderId(route.provider_id))

package/dist/core/doctor/doctor-dirty-planner.js

@@ -1,4 +1,5 @@
 import fs from 'node:fs';
+import os from 'node:os';
 import path from 'node:path';
 import { spawnSync } from 'node:child_process';
 import { MANAGED_ASSET_VERSION } from '../managed-assets/managed-assets-manifest.js';
@@ -104,7 +105,21 @@ function phaseInputHash(root, id) {
             return { rel, hash: 'missing' };
         return hashSemanticPath(root, rel);
     });
-    return hashJson({ id, package: packageIdentity(), files, env: phaseEnvPresence(id), semantic_state: phaseSemanticState(root, id), phase_schema_version: 2 });
+    return hashJson({
+        id,
+        package: packageIdentity(),
+        files,
+        env: phaseEnvPresence(id),
+        semantic_state: phaseSemanticState(root, id),
+        project_codex_config: hashSemanticPath(root, '.codex/config.toml').hash,
+        codex_home_config: hashFileIfExists(codexHomeConfigPath()),
+        phase_schema_version: 3
+    });
+}
+function codexHomeConfigPath() {
+    const codexHome = process.env.CODEX_HOME
+        || path.join(process.env.HOME || os.homedir(), '.codex');
+    return path.join(codexHome, 'config.toml');
 }
 function phaseInputFiles(id) {
     if (id.includes('context7'))

package/dist/core/doctor/doctor-idempotence.js

@@ -17,6 +17,8 @@ export async function runDoctorIdempotence(root) {
         blockers.push(`second_doctor_exit_${second.exit_code}`);
     if (changedFilesSecond.length > 0)
         blockers.push('second_doctor_not_noop');
+    if (!reportsChangedFiles(second))
+        blockers.push('second_doctor_changed_files_unavailable');
     const report = {
         schema: 'sks.doctor-idempotence.v1',
         ok: blockers.length === 0,
@@ -60,6 +62,15 @@ async function runDoctor(root, home, codexHome) {
         parsed
     };
 }
+function reportsChangedFiles(run) {
+    if (!run.parsed)
+        return false;
+    return [
+        run.parsed?.repair?.doctor_transaction?.changed_files,
+        run.parsed?.doctor_fix_transaction?.changed_files,
+        run.parsed?.changed_files
+    ].some((value) => Array.isArray(value));
+}
 function extractChangedFiles(run) {
     const repair = run.parsed?.repair || {};
     const candidates = [

package/dist/core/doctor/doctor-repair-postcheck.js

@@ -1,4 +1,53 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { inspectOfficialSubagentToml, readOfficialSubagentConfig } from '../subagents/official-subagent-config.js';
 import {} from './doctor-transaction.js';
+export async function verifyCodexConfigsOnDisk(input) {
+    const root = path.resolve(input.root);
+    const home = input.home || process.env.HOME || os.homedir();
+    const codexHome = input.codexHome || process.env.CODEX_HOME || path.join(home, '.codex');
+    const projectConfigPath = path.join(root, '.codex', 'config.toml');
+    const codexHomeConfigPath = path.join(codexHome, 'config.toml');
+    const blockers = [];
+    const [projectText, homeText] = await Promise.all([
+        fs.readFile(projectConfigPath, 'utf8').catch(() => null),
+        fs.readFile(codexHomeConfigPath, 'utf8').catch(() => null)
+    ]);
+    if (projectText !== null && !inspectOfficialSubagentToml(projectText).ok) {
+        blockers.push('project_codex_config_unparseable_after_repair');
+    }
+    if (homeText !== null && !inspectOfficialSubagentToml(homeText).ok) {
+        blockers.push('codex_home_config_unparseable_after_repair');
+    }
+    let multiAgentV2Enabled = null;
+    let agentsEnabled = null;
+    if (!blockers.length) {
+        const config = await readOfficialSubagentConfig(root, { home, codexHome }).catch(() => null);
+        if (config) {
+            multiAgentV2Enabled = config.multiAgentV2.enabled;
+            agentsEnabled = config.enabled;
+            for (const blocker of config.blockers)
+                blockers.push(`official_subagent_config:${blocker}`);
+            if (multiAgentV2Enabled === false) {
+                blockers.push('official_subagent_multi_agent_v2_disabled_after_repair');
+                if (agentsEnabled === false)
+                    blockers.push('official_subagent_agents_disabled_after_repair');
+            }
+        }
+    }
+    return {
+        schema: 'sks.doctor-config-disk-verification.v1',
+        ok: blockers.length === 0,
+        project_config_path: projectConfigPath,
+        codex_home_config_path: codexHomeConfigPath,
+        project_config_present: projectText !== null,
+        codex_home_config_present: homeText !== null,
+        multi_agent_v2_enabled: multiAgentV2Enabled,
+        agents_enabled: agentsEnabled,
+        blockers: [...new Set(blockers)]
+    };
+}
 export function doctorRepairPostcheck(transaction) {
     const phases = transaction?.phases || [];
     const requiredBlockers = phases

package/dist/core/doctor/doctor-transaction.js

@@ -3,6 +3,47 @@ import { nowIso, writeJsonAtomic } from '../fsx.js';
 import { isDoctorPhaseClean, markDoctorPhaseClean } from './doctor-dirty-planner.js';
 import { ui as cliUi } from '../../cli/cli-theme.js';
 import { messageOf } from '../errors/message.js';
+const CHANGED_PATH_KEYS = Object.freeze([
+    'repaired_paths', 'created_files', 'created', 'updated', 'changed_files',
+    'written_files', 'removed_files', 'removed', 'quarantined', 'backups'
+]);
+export function changedFilesFromRepairReport(report) {
+    const found = new Set();
+    const walk = (value, depth) => {
+        if (depth > 6 || !value || typeof value !== 'object')
+            return;
+        if (Array.isArray(value)) {
+            for (const item of value)
+                walk(item, depth + 1);
+            return;
+        }
+        const row = value;
+        for (const key of CHANGED_PATH_KEYS) {
+            const entries = row[key];
+            if (Array.isArray(entries)) {
+                for (const entry of entries) {
+                    const text = String(entry || '').trim();
+                    if (text)
+                        found.add(text);
+                }
+            }
+            else if (typeof entries === 'string' && entries.trim()) {
+                found.add(entries.trim());
+            }
+        }
+        if (row.changed === true || row.applied === true) {
+            for (const key of ['config_path', 'backup_path', 'path', 'file']) {
+                const text = String(row[key] || '').trim();
+                if (text)
+                    found.add(text);
+            }
+        }
+        for (const nested of Object.values(row))
+            walk(nested, depth + 1);
+    };
+    walk(report, 0);
+    return [...found].sort();
+}
 export async function runDoctorFixTransaction(input) {
     const startedAt = nowIso();
     const phases = [];
@@ -110,7 +151,8 @@ export async function writeDoctorFixTransaction(input) {
         started_at: phase.started_at || null,
         completed_at: phase.completed_at || null,
         duration_ms: Number.isFinite(phase.duration_ms) ? Number(phase.duration_ms) : null,
-        rollback_performed: phase.rollback_performed === true
+        rollback_performed: phase.rollback_performed === true,
+        changed_files: [...new Set(phase.changed_files || [])].sort()
     }));
     const postcheckOk = phases.every((phase) => phase.ok || phase.required_for_ready === false);
     const mutationsWithoutRollback = phases.filter((phase) => phase.required_for_ready && phase.repaired && !phase.rollback_evidence).length;
@@ -124,6 +166,7 @@ export async function writeDoctorFixTransaction(input) {
         postcheck_ok: postcheckOk && mutationsWithoutRollback === 0,
         rollback_performed: input.rollbackPerformed === true,
         mutations_without_rollback: mutationsWithoutRollback,
+        changed_files: [...new Set(phases.flatMap((phase) => phase.changed_files))].sort(),
         raw_secret_values_recorded: false,
         skipped_clean_phases: phases.filter((phase) => phase.warnings.some((warning) => warning.startsWith('dirty_plan_skipped_clean_phase'))).map((phase) => phase.id),
         dirty_phases: input.dirtyPlan?.phases.filter((phase) => phase.status === 'dirty').map((phase) => phase.id) || phases.filter((phase) => !phase.warnings.some((warning) => warning.startsWith('dirty_plan_skipped_clean_phase'))).map((phase) => phase.id),
@@ -158,7 +201,9 @@ function normalizePhase(definition, result, fallback, startedMs) {
         started_at: phase.started_at || fallback.started_at || nowIso(),
         completed_at: phase.completed_at || nowIso(),
         duration_ms: phase.duration_ms ?? Math.max(0, Date.now() - startedMs),
-        rollback_performed: phase.rollback_performed === true
+        rollback_performed: phase.rollback_performed === true,
+        changed_files: phase.changed_files
+            ?? (definition.report ? changedFilesFromRepairReport(definition.report()) : [])
     };
 }
 function mergePhase(phase, update) {

package/dist/core/doctor/legacy-global-hook-cleanup.js

@@ -144,7 +144,7 @@ function projectSksHookCommand(value) {
     const command = String(value || '').trim();
     if (/[;&|`$<>\r\n]/.test(command))
         return null;
-    return command.match(/^node\s+\.\/dist\/bin\/sks\.js\s+hook\s+([a-z0-9-]+)$/i)?.[1] || null;
+    return command.match(/^(?:\S*[\\/])?(?:node\s+\S*sks\.js|sks)\s+hook\s+([a-z0-9-]+)$/i)?.[1] || null;
 }
 function hookRef(event, matcher, command) {
     return `${event}:${String(matcher ?? '')}:${command}`;

package/dist/core/init.js

@@ -11,13 +11,15 @@ import { OFFICIAL_SUBAGENT_REVIEW_POLICY_TEXT } from './official-subagent-review
 import { AWESOME_DESIGN_MD_REFERENCE, CODEX_APP_IMAGE_GENERATION_DOC_URL, CODEX_COMPUTER_USE_ONLY_POLICY, CODEX_IMAGEGEN_REQUIRED_POLICY, CODEX_WEB_VERIFICATION_POLICY, DEFAULT_CODEX_APP_PLUGINS, DESIGN_SYSTEM_SSOT, DOLLAR_COMMANDS, DOLLAR_COMMAND_ALIASES, DOLLAR_SKILL_NAMES, FROM_CHAT_IMG_CHECKLIST_ARTIFACT, FROM_CHAT_IMG_COVERAGE_ARTIFACT, FROM_CHAT_IMG_QA_LOOP_ARTIFACT, FROM_CHAT_IMG_TEMP_TRIWIKI_ARTIFACT, FROM_CHAT_IMG_TEMP_TRIWIKI_SESSIONS, GETDESIGN_REFERENCE, IMAGEGEN_SOCIAL_SOURCE_POLICY, LEGACY_DOLLAR_SKILL_NAMES, OPENAI_CHATGPT_IMAGES_2_DOC_URL, OPENAI_GPT_IMAGE_2_MODEL_DOC_URL, OPENAI_IMAGE_GENERATION_DOC_URL, PPT_CONDITIONAL_SKILL_ALLOWLIST, PPT_PIPELINE_MCP_ALLOWLIST, PPT_PIPELINE_SKILL_ALLOWLIST, RECOMMENDED_DESIGN_REFERENCES, RECOMMENDED_MCP_SERVERS, RECOMMENDED_SKILLS, RESERVED_CODEX_PLUGIN_SKILL_NAMES, SOLUTION_SCOUT_SKILL_NAME, chatCaptureIntakeText, context7ConfigToml, getdesignReferencePolicyText, imageUxReviewPipelinePolicyText, outcomeRubricPolicyText, pptPipelineAllowlistPolicyText, prefixKnownSksDollarReferences, productDesignPluginPolicyText, sksPrefixedDollarCommand, speedLanePolicyText, stackCurrentDocsPolicyText, triwikiContextTracking, triwikiContextTrackingText, triwikiStagePolicyText } from './routes.js';
 import { SKILL_DREAM_POLICY, skillDreamPolicyText } from './skill-forge.js';
 import { CODEX_HOOK_EVENT_STATE_KEYS } from './codex-compat/codex-hook-events.js';
+import { MANAGED_CODEX_FEATURE_FLAGS, REMOVED_CODEX_FEATURE_FLAGS } from './codex/codex-feature-flags.js';
+import { writeCodexConfigGuarded } from './codex/codex-config-guard.js';
 import { codexCommandHookCurrentHash } from './codex-hooks/codex-hook-hash.js';
 import { buildSksCoreSkillManifest, isCoreSkillName, legacyCoreSkillNames } from './codex-native/core-skill-manifest.js';
 import { syncCoreSkillsIntegrity } from './codex-native/core-skill-integrity.js';
 import { AUTHORITATIVE_SKS_SKILL_ROOT_REFERENCE } from './codex-native/sks-skill-paths.js';
 import { currentGeneratedFileInventory, installCodexAgents, pruneStaleGeneratedFiles, REMOVED_SKS_SKILL_NAMES } from './init/skills.js';
 import { reconcileManagedSkillInstallation } from './init/managed-skill-install.js';
-import { backupInvalidToml, inspectOfficialSubagentToml, mergeOfficialSubagentConfig, officialSubagentConfigOwnershipProof, officialSubagentConfigWarnings, readInheritedOfficialSubagentConfigText, resolveInheritedOfficialSubagentConfigPath } from './subagents/official-subagent-config.js';
+import { backupInvalidToml, inspectOfficialSubagentToml, mergeOfficialSubagentConfig, officialSubagentConfigOwnershipProof, officialSubagentConfigWarnings, readInheritedOfficialSubagentConfigText, resolveInheritedOfficialSubagentConfigPath, stampSksManagedCodexConfigMarker } from './subagents/official-subagent-config.js';
 import { escapeRegExp } from './text/regex.js';
 export { installGlobalSkills, installProjectSkills, installSkills } from './init/skills.js';
 const REFLECTION_MEMORY_PATH = '.sneakoscope/memory/q2_facts/post-route-reflection.md';
@@ -206,6 +208,8 @@ function upsertCodexTrustTomlTable(text, table, block) {
             break;
         }
     }
+    while (end > start + 1 && !String(lines[end - 1] || '').trim())
+        end -= 1;
     lines.splice(start, end - start, ...blockLines);
     return lines.join('\n').replace(/\n{3,}/g, '\n\n');
 }
@@ -631,14 +635,11 @@ export async function initProject(root, opts = {}) {
             project_install: 'npm i -D sneakoscope && npx sks setup --install-scope project'
         };
     }
-    const MANAGED_CODEX_FEATURE_FLAGS = ['hooks', 'fast_mode', 'apps'];
-    const REMOVED_CODEX_FEATURE_FLAGS = [
-        'remote_control', 'fast_mode_ui', 'codex_git_commit', 'computer_use', 'browser_use',
-        'browser_use_external', 'image_generation', 'in_app_browser', 'guardian_approval',
-        'tool_suggest', 'plugins', 'codex_hooks', 'multi_agent'
-    ];
     function mergeManagedCodexConfigToml(existingContent = '', opts = {}) {
         let next = String(existingContent || '').trimEnd();
+        if (opts.sksOwned === true || opts.configWasFresh === true) {
+            next = stampSksManagedCodexConfigMarker(next);
+        }
         next = removeTomlTableKey(next, 'notice', 'fast_default_opt_out');
         next = removeTomlTableKey(next, 'features', 'codex_hooks');
         next = upsertTopLevelTomlBooleanIfAbsent(next, 'suppress_unstable_features_warning', true);
@@ -918,6 +919,7 @@ export async function initProject(root, opts = {}) {
         else {
             const managedCodexConfig = await mergeGlobalCodexConfigIfAvailable(mergeManagedCodexConfigToml(existingCodexConfig, {
                 sksOwned: configPreviouslySksOwned,
+                configWasFresh,
                 inheritedText: inheritedCodexConfig
             }), generatedCodexConfigPath, { home: opts.home, codexHome: opts.codexHome });
             const managedConfigValidation = inspectOfficialSubagentToml(managedCodexConfig);
@@ -934,16 +936,37 @@ export async function initProject(root, opts = {}) {
                 created.push('.codex/config.toml merge skipped (manual repair required)');
             }
             else {
-                await writeTextAtomic(generatedCodexConfigPath, managedCodexConfig);
-                codexConfigInstall = {
-                    ok: true,
-                    status: managedCodexConfig === existingCodexConfig ? 'present' : 'written',
-                    config_path: generatedCodexConfigPath,
-                    backup_path: null,
-                    manual_blockers: [],
-                    warnings: officialSubagentConfigWarnings(managedCodexConfig, inheritedCodexConfig)
-                };
-                created.push('.codex/config.toml');
+                const guarded = await writeCodexConfigGuarded({
+                    root,
+                    configPath: generatedCodexConfigPath,
+                    before: existingCodexConfig,
+                    cause: 'sks-init-managed-project-config',
+                    ownershipVerified: configWasFresh || configPreviouslySksOwned,
+                    preserveTextFormatting: true,
+                    mutate: () => managedCodexConfig
+                });
+                codexConfigInstall = guarded.ok
+                    ? {
+                        ok: true,
+                        status: managedCodexConfig === existingCodexConfig ? 'present' : 'written',
+                        config_path: generatedCodexConfigPath,
+                        backup_path: guarded.backup_path,
+                        manual_blockers: [],
+                        warnings: officialSubagentConfigWarnings(managedCodexConfig, inheritedCodexConfig)
+                    }
+                    : {
+                        ok: false,
+                        status: guarded.status,
+                        config_path: generatedCodexConfigPath,
+                        backup_path: guarded.backup_path,
+                        manual_blockers: [`manual_unmanaged_project_codex_config:${guarded.status}`],
+                        warnings: [],
+                        operator_actions: [
+                            `${generatedCodexConfigPath} is not proven SKS-owned, so setup left it unchanged. `
+                                + 'Run `sks config adopt` to bring it under management, or delete it and re-run `sks setup`.'
+                        ]
+                    };
+                created.push(guarded.ok ? '.codex/config.toml' : '.codex/config.toml preserved (user-owned)');
             }
         }
     }

package/dist/core/pipeline-internals/runtime-core.js

@@ -148,6 +148,7 @@ export function buildPipelinePlan(input = {}) {
         verification,
         engineering_sanity_review: null,
         architecture_map: null,
+        architecture_map_unavailable: null,
         invariants,
         proof_field: proof,
         ssot_guard: buildSsotGuard({ route: route?.id || 'SKS', mode: route?.mode || 'SKS', task }),
@@ -187,6 +188,13 @@ export async function writePipelinePlan(dir, input = {}) {
     }
     if (planStagesArchitectureMap(plan)) {
         plan.architecture_map = createArchitectureMapPlanBinding();
+        const seeded = await maybeSeedArchitectureMapForPlan({
+            root, dir, plan, missionId: input.missionId, taskProfile
+        });
+        if (seeded && seeded.ok === false) {
+            plan.architecture_map = null;
+            plan.architecture_map_unavailable = { reason: seeded.reason || 'architecture_map_baseline_unavailable' };
+        }
     }
     await writeJsonAtomic(path.join(dir, PIPELINE_PLAN_ARTIFACT), plan);
     if (plan.engineering_sanity_review) {
@@ -201,9 +209,6 @@ export async function writePipelinePlan(dir, input = {}) {
             await writeJsonAtomic(reviewFile, createEngineeringSanityReviewSeed(plan.route?.command || plan.route?.id || null, report, reportText));
         }
     }
-    await maybeSeedArchitectureMapForPlan({
-        root, dir, plan, missionId: input.missionId, taskProfile
-    });
     return plan;
 }
 function planStagesEngineeringSanityReview(plan) {

package/dist/core/subagents/agent-catalog.js

@@ -100,7 +100,8 @@ export function officialSubagentFanoutPolicy(input = {}) {
         ...(input.suggestedRoles === undefined ? {} : { suggestedRoles: input.suggestedRoles }),
         ...(input.independentSliceCount === undefined ? {} : { independentSliceCount: input.independentSliceCount }),
         ...(input.maxThreads === undefined ? {} : { maxThreads: input.maxThreads }),
-        ...(input.hardware === undefined ? {} : { hardware: input.hardware })
+        ...(input.hardware === undefined ? {} : { hardware: input.hardware }),
+        ...(input.requiresWrite === undefined ? {} : { requiresWrite: input.requiresWrite })
     });
     const requested = explicit ? explicitRequested : automatic.count;
     const automaticReviewerCeiling = automatic.criticalMultiDomain
@@ -141,7 +142,8 @@ function automaticSubagentFanout(input) {
     const critical = CRITICAL_RISK_RE.test(text);
     const largeScale = LARGE_SCALE_WORK_RE.test(text);
     const criticalMultiDomain = highRisk && critical && riskDomains.length >= 3;
-    const reviewerOnly = isReviewerOnlyFanout(input.suggestedRoles || []);
+    const reviewerOnly = isReviewerOnlyFanout(input.suggestedRoles || [])
+        && input.requiresWrite !== true;
     const massLane = decideSubagentModel({ description: text }).policy;
     const massParallel = MASS_PARALLEL_WORK_RE.test(text)
         && !NON_CHEAP_MASS_ACTION_RE.test(text)

package/dist/core/subagents/official-subagent-config.js

@@ -20,17 +20,23 @@ export const LEGACY_SKS_MAX_THREAD_VALUES = Object.freeze([4, 5, 6, 12]);
 export const AGENTS_MAX_CONCURRENT_THREADS_KEY = 'max_concurrent_threads_per_session';
 export const LEGACY_AGENTS_MAX_THREADS_KEY = 'max_threads';
 export const LEGACY_AGENTS_JOB_MAX_RUNTIME_KEY = 'job_max_runtime_seconds';
+export const SKS_MANAGED_CODEX_CONFIG_MARKER = '# SKS-MANAGED-CODEX-CONFIG';
 export function mergeOfficialSubagentConfig(text = '', opts = {}) {
+    return mergeOfficialSubagentConfigResult(text, opts).text;
+}
+export function mergeOfficialSubagentConfigResult(text = '', opts = {}) {
     const source = String(text || '');
-    if (!inspectToml(source).ok)
-        return source;
+    if (!inspectToml(source).ok) {
+        return { text: source, blockers: ['project_official_subagent_config_toml_parse_failed'] };
+    }
     const inherited = parsedToml(opts.inheritedText || '');
     const inheritedAgents = objectValue(inherited?.agents);
     const inheritedFeatures = objectValue(inherited?.features);
     let next = source.trimEnd();
     if (!next.trim())
-        next = '# SKS-MANAGED-CODEX-CONFIG';
+        next = SKS_MANAGED_CODEX_CONFIG_MARKER;
     if (opts.sksOwned === true) {
+        next = stampManagedConfigMarker(next);
         next = removeExactLegacyManagedAgentBlocks(next);
         next = stripLegacyUnsupportedAgentKeys(next);
     }
@@ -48,10 +54,12 @@ export function mergeOfficialSubagentConfig(text = '', opts = {}) {
     next = mergeOfficialMultiAgentV2FeatureConfig(next, {
         sksOwned: opts.sksOwned === true,
         inheritedFeatures,
-        maxThreads: readAgentsMaxThreads(next) || targetMaxThreads
+        maxThreads: Math.min(readAgentsMaxThreads(next) || targetMaxThreads, HARD_NARUTO_MAX_THREADS)
     });
     const merged = ensureTrailingNewline(next);
-    return inspectToml(merged).ok ? merged : source;
+    if (inspectToml(merged).ok)
+        return { text: merged, blockers: [] };
+    return { text: source, blockers: ['official_subagent_config_merge_produced_invalid_toml'] };
 }
 export function mergeOfficialMultiAgentV2FeatureConfig(text = '', opts = {}) {
     const source = String(text || '');
@@ -61,18 +69,21 @@ export function mergeOfficialMultiAgentV2FeatureConfig(text = '', opts = {}) {
     const inheritedMaV2 = featureTomlObject(inheritedFeatures.multi_agent_v2);
     let next = source.trimEnd();
     if (!next.trim())
-        next = '# SKS-MANAGED-CODEX-CONFIG';
-    if (hasTomlTableKey(next, 'features', 'multi_agent_v2')) {
+        next = SKS_MANAGED_CODEX_CONFIG_MARKER;
+    if (hasUnmanageableMultiAgentV2Declaration(next))
+        return ensureTrailingNewline(next);
+    const booleanForm = readTomlTableBoolean(next, 'features', 'multi_agent_v2');
+    if (booleanForm !== null) {
         next = removeTomlTableKey(next, 'features', 'multi_agent_v2');
     }
     const maxThreads = boundedManagedMaxThreads(opts.maxThreads, DEFAULT_OFFICIAL_SUBAGENT_MAX_THREADS);
     const targetTotal = Math.max(1, maxThreads + 1);
     if (!hasTomlTable(next, 'features.multi_agent_v2')) {
-        if (inheritedMaV2)
+        if (inheritedMaV2 && booleanForm === null)
             return ensureTrailingNewline(next);
         next = upsertTomlTable(next, 'features.multi_agent_v2', [
             '[features.multi_agent_v2]',
-            'enabled = true',
+            `enabled = ${booleanForm === null ? true : booleanForm}`,
             `max_concurrent_threads_per_session = ${targetTotal}`,
             'expose_spawn_agent_model_overrides = true'
         ].join('\n'));
@@ -81,7 +92,7 @@ export function mergeOfficialMultiAgentV2FeatureConfig(text = '', opts = {}) {
     if (opts.sksOwned === true) {
         next = upsertTomlTableKey(next, 'features.multi_agent_v2', 'enabled = true');
         const currentTotal = readTomlTableInteger(next, 'features.multi_agent_v2', 'max_concurrent_threads_per_session');
-        if (currentTotal === DEFAULT_NARUTO_LEGACY_TOTAL_THREADS || currentTotal === null) {
+        if (currentTotal === null || LEGACY_MANAGED_V2_TOTAL_THREADS.includes(currentTotal)) {
             next = upsertTomlTableKey(next, 'features.multi_agent_v2', `max_concurrent_threads_per_session = ${targetTotal}`);
         }
         if (!hasTomlTableKey(next, 'features.multi_agent_v2', 'expose_spawn_agent_model_overrides')) {
@@ -105,6 +116,10 @@ export function mergeOfficialMultiAgentV2FeatureConfig(text = '', opts = {}) {
     return ensureTrailingNewline(next);
 }
 const DEFAULT_NARUTO_LEGACY_TOTAL_THREADS = 13;
+const LEGACY_MANAGED_V2_TOTAL_THREADS = Object.freeze([
+    ...LEGACY_SKS_MAX_THREAD_VALUES.map((value) => value + 1),
+    DEFAULT_NARUTO_LEGACY_TOTAL_THREADS
+]);
 export async function readOfficialSubagentConfig(root, opts = {}) {
     const projectConfigPath = path.resolve(opts.projectConfigPath || path.join(root, '.codex', 'config.toml'));
     const home = opts.home || process.env.HOME || os.homedir();
@@ -173,6 +188,9 @@ export function officialSubagentConfigWarnings(text = '', inheritedText = '') {
             ? [`official_subagent_max_depth_coerced_to_one:${maxDepth.value}:${maxDepth.source}`]
             : []),
         ...capacityNormalizationWarnings(maxThreads, multiAgentV2),
+        ...(hasUnmanageableMultiAgentV2Declaration(text)
+            ? ['project_multi_agent_v2_declaration_form_unmanaged']
+            : []),
         ...project.legacyWarnings,
         ...inherited.legacyWarnings
     ];
@@ -315,6 +333,8 @@ export function officialSubagentConfigOwnershipProof(input = {}) {
     }
     if (hasExactManagedConfigMarker(text))
         reasons.push('managed_marker_or_hash');
+    if (hasManagedAgentsConfigFingerprint(text))
+        reasons.push('managed_agents_config_fingerprint');
     if (migrationReceiptProvesManagedMaxThreads(input.migrationReceipt)) {
         reasons.push('migration_receipt:agents.max_concurrent_threads_per_session');
     }
@@ -482,7 +502,38 @@ function featureTomlObject(value) {
     return Object.keys(row).length ? row : null;
 }
 function hasExactManagedConfigMarker(text) {
-    return /^(?:#\s*SKS-MANAGED-CODEX-CONFIG\b|#\s*SKS managed Codex config\b|#\s*sks_managed_(?:body_)?sha256\s*=\s*["'][a-f0-9]{64}["'])/mi.test(text);
+    return /^\s*(?:#\s*SKS-MANAGED-CODEX-CONFIG\b|#\s*SKS managed Codex config\b|#\s*sks_managed_(?:body_)?sha256\s*=\s*["'][a-f0-9]{64}["'])/mi.test(text);
+}
+export function stampSksManagedCodexConfigMarker(text) {
+    return stampManagedConfigMarker(text);
+}
+function stampManagedConfigMarker(text) {
+    const source = String(text || '');
+    if (hasExactManagedConfigMarker(source))
+        return source;
+    const body = source.replace(/^\n+/, '');
+    return body ? `${SKS_MANAGED_CODEX_CONFIG_MARKER}\n${body}` : SKS_MANAGED_CODEX_CONFIG_MARKER;
+}
+const MANAGED_AGENTS_FINGERPRINT_KEYS = Object.freeze([
+    'enabled',
+    'max_depth',
+    'interrupt_message',
+    'default_subagent_model',
+    'default_subagent_reasoning_effort'
+]);
+export function hasManagedAgentsConfigFingerprint(text) {
+    const parsed = parsedToml(text);
+    if (!parsed)
+        return false;
+    const agents = objectValue(parsed.agents);
+    if (!MANAGED_AGENTS_FINGERPRINT_KEYS.every((key) => hasOwn(agents, key)))
+        return false;
+    if (readAgentsMaxThreadsFromRecord(agents) === undefined)
+        return false;
+    if (agents.max_depth !== DEFAULT_OFFICIAL_SUBAGENT_MAX_DEPTH)
+        return false;
+    const multiAgentV2 = featureTomlObject(objectValue(parsed.features).multi_agent_v2);
+    return multiAgentV2 !== null && hasOwn(multiAgentV2, 'expose_spawn_agent_model_overrides');
 }
 function migrationReceiptProvesManagedMaxThreads(value) {
     const root = objectValue(value);
@@ -676,11 +727,37 @@ function upsertDefaultUnlessInherited(text, inheritedAgents, key, line) {
 }
 function readTomlTableInteger(text, table, key) {
     const line = tomlTableKeyLine(text, table, key);
-    const match = line?.match(/^\s*[^=]+\s*=\s*([0-9]+)\s*(?:#.*)?$/);
-    if (!match?.[1])
+    const raw = line?.match(/^\s*[^=]+\s*=\s*([^#]+?)\s*(?:#.*)?$/)?.[1];
+    return parseTomlInteger(raw);
+}
+function parseTomlInteger(raw) {
+    const value = String(raw ?? '').trim().replace(/_/g, '');
+    const match = value.match(/^([+-]?)(?:0x([0-9a-fA-F]+)|0o([0-7]+)|0b([01]+)|([0-9]+))$/);
+    if (!match)
         return null;
-    const value = Number(match[1]);
-    return Number.isSafeInteger(value) ? value : null;
+    const magnitude = match[2] !== undefined
+        ? Number.parseInt(match[2], 16)
+        : match[3] !== undefined
+            ? Number.parseInt(match[3], 8)
+            : match[4] !== undefined
+                ? Number.parseInt(match[4], 2)
+                : Number(match[5]);
+    const parsed = (match[1] === '-' ? -1 : 1) * magnitude;
+    return Number.isSafeInteger(parsed) ? parsed : null;
+}
+function hasUnmanageableMultiAgentV2Declaration(text) {
+    const parsed = parsedToml(text);
+    if (!parsed)
+        return false;
+    if (!hasOwn(objectValue(parsed.features), 'multi_agent_v2'))
+        return false;
+    return !hasTomlTable(text, 'features.multi_agent_v2')
+        && readTomlTableBoolean(text, 'features', 'multi_agent_v2') === null;
+}
+function readTomlTableBoolean(text, table, key) {
+    const line = tomlTableKeyLine(text, table, key);
+    const match = line?.match(/^\s*[^=]+\s*=\s*(true|false)\s*(?:#.*)?$/);
+    return match?.[1] ? match[1] === 'true' : null;
 }
 function hasTomlTableKey(text, table, key) {
     return tomlTableKeyLine(text, table, key) !== null;

package/dist/core/subagents/official-subagent-preparation.js

@@ -107,6 +107,7 @@ async function prepareOfficialSubagentMissionLocked(input) {
         taskProfile,
         suggestedRoles: suggestedAgents,
         goal,
+        requiresWrite: input.readOnly !== true,
         maxThreads: input.maxThreads ?? officialConfig.maxThreads,
         ...(input.hardware ? { hardware: input.hardware } : {}),
         ...(slices.length > 0 ? { independentSliceCount: slices.length } : {})

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '8.4.0';
+export const PACKAGE_VERSION = '8.6.0';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "8.4.0",
+  "version": "8.6.0",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",