sneakoscope 8.7.0 → 9.0.0

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-This README documents package **SKS 8.7.0** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
+This README documents package **SKS 9.0.0** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
 
 Use the official latest stable SKS and Codex CLI releases. The Codex compatibility SSOT is always the **current latest stable** host; capability probes measure what that host can actually do. Product docs do not crown a fixed `0.x.y` string as SSOT (release pins and schema directories are measured artifacts for the current package, not a permanent product version claim). Menu Bar / Center induce updates to the latest stable build. Run `sks update-check` for what is installed and read the capability report for what is supported. Install SSOT is npm `sneakoscope@latest`; PATH `sks` and Menu Bar stamped generation must match that version or gates fail. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it (Codex official multi-agent wrap-only; SKS does not reimplement a parallel runtime). Local code search is mode-separated (`sks search files|text|structure|symbol|context`); `context` is answered by the compiled TriWiki Context Graph (`context-graph.json` is exhaustive authority; `context-pack.json` and managed `AGENTS.md` are bounded projections) — see [docs/architecture/context-graph.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/architecture/context-graph.md) and [docs/PRODUCT-CONTRACT.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/PRODUCT-CONTRACT.md). See [CHANGELOG.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/CHANGELOG.md).
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "8.7.0"
+version = "9.0.0"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "8.7.0"
+version = "9.0.0"
 edition = "2021"
 
 [dependencies]

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "8.7.0",
+  "package_version": "9.0.0",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/agents/agent-janitor.js

@@ -3,6 +3,7 @@ import path from 'node:path';
 import { exists, nowIso, readJson, writeJsonAtomic } from '../fsx.js';
 import { normalizeAgentSessionRows } from './agent-session-rows.js';
 import { resolveOwnedNamespacePath } from './agent-namespace-safety.js';
+import { runAgentCleanupExecutor } from './agent-cleanup-executor.js';
 export async function runAgentJanitor(input) {
     const staleMs = input.staleMs ?? 30 * 60 * 1000;
     const agentRoot = path.join(input.missionDir, 'agents');
@@ -39,6 +40,11 @@ export async function runAgentJanitor(input) {
     const orphanTempDirs = await scopedExistingPaths(Array.isArray(namespace?.orphan_temp_dirs) ? namespace.orphan_temp_dirs : [], projectHash, namespace?.temp_dir ? [namespace.temp_dir] : []);
     const staleLocks = await scopedStaleLockPaths(namespace?.lock_dir ? [namespace.lock_dir] : [], projectHash, staleMs);
     const cleaned = [];
+    const reaped = input.reapOrphanProcesses
+        ? await runAgentCleanupExecutor({ missionDir: input.missionDir, missionId: input.missionId ?? null, action: 'cleanup', apply: true, staleMs })
+            .then((report) => (report?.actions || []).filter((row) => row?.kind === 'terminate_process' && row?.status === 'applied').length)
+            .catch(() => 0)
+        : 0;
     if (input.cleanup) {
         for (const dir of orphanGenerationDirs) {
             await fsp.rm(path.join(agentRoot, dir), { recursive: true, force: true }).catch(() => { });
@@ -69,6 +75,7 @@ export async function runAgentJanitor(input) {
         slot_generation_cleanup: cleaned.filter((entry) => entry.includes(`${path.sep}sessions${path.sep}`)),
         orphan_temp_dirs: orphanTempDirs,
         stale_locks: staleLocks,
+        reaped_orphan_processes: reaped,
         cleaned,
         blockers,
     };

package/dist/core/agents/agent-orchestrator.js

@@ -216,7 +216,7 @@ export async function runNativeAgentOrchestrator(opts = {}) {
         partition = applyNarutoWorkGraphToPartition(partition, opts.narutoWorkGraph, roster, targetActiveSlots, prompt);
         augmentVerificationRollbackDagForNaruto(strategyCompiled.verification_rollback_dag, partition.slices);
     }
-    await runAgentJanitor({ missionDir: dir, missionId, projectHash: namespace.root_hash });
+    const preSpawnSweep = await runAgentJanitor({ missionDir: dir, missionId, projectHash: namespace.root_hash, reapOrphanProcesses: true });
     const ledgerRoot = await initializeAgentCentralLedger(dir, { missionId, roster, partition, route, prompt, dynamicScheduler: true });
     const triwikiContext = await loadTriWikiRuntimeContext(root);
     await writeTriWikiContextArtifact(ledgerRoot, triwikiContext);
@@ -617,7 +617,7 @@ export async function runNativeAgentOrchestrator(opts = {}) {
         backend,
         ledger_root: path.relative(root, ledgerRoot),
         roster,
-        partition: { ok: partition.ok, slice_count: partition.slices.length, lease_count: partition.leases.length, blockers: partition.blockers },
+        partition: { ok: partition.ok, slice_count: partition.slices.length, lease_count: partition.leases.length, blockers: partition.blockers, pre_spawn_reaped: preSpawnSweep.reaped_orphan_processes },
         task_graph: partition.task_graph?.route_work_count_summary || null,
         requested_work_items: partition.task_graph?.desired_work_items || desiredWorkItemCount,
         actual_total_work_items: partition.task_graph?.total_work_items || partition.slices.length,

package/dist/core/agents/agent-recursion-guard.js

@@ -86,8 +86,9 @@ export function agentWorkerHookRecursionDecision(state = {}, payload = {}, comma
         reason: `Agent command recursion guard blocked nested SKS route command in Codex PreToolUse hook: ${guard.violations.join(', ')}`
     };
 }
-export function agentWorkerHookContext(state = {}, payload = {}) {
-    const env = {
+export function agentWorkerHookContext(state = {}, payload = {}, env = process.env) {
+    const declared = {
+        ...(env || {}),
         ...(payload.env || {}),
         ...(payload.tool_input?.env || {}),
         ...(payload.toolInput?.env || {}),
@@ -95,11 +96,24 @@ export function agentWorkerHookContext(state = {}, payload = {}) {
         ...(payload.tool?.input?.env || {})
     };
     void state;
-    return Boolean(String(env.SKS_AGENT_WORKER || '') === '1'
-        || String(env.SKS_DISABLE_ROUTE_RECURSION || '') === '1'
+    return Boolean(String(declared.SKS_AGENT_WORKER || '') === '1'
+        || String(declared.SKS_DISABLE_ROUTE_RECURSION || '') === '1'
+        || agentGenerationDepth(declared) > 0
         || payload.agent_worker === true
         || payload.agentWorker === true);
 }
+export function agentGenerationDepth(env = process.env) {
+    const raw = Number.parseInt(String(env[AGENT_GENERATION_DEPTH_ENV] || ''), 10);
+    return Number.isFinite(raw) && raw > 0 ? Math.min(raw, MAX_AGENT_GENERATION_DEPTH * 4) : 0;
+}
+export const AGENT_GENERATION_DEPTH_ENV = 'SKS_AGENT_GENERATION_DEPTH';
+export const MAX_AGENT_GENERATION_DEPTH = 1;
+export function nextAgentGenerationEnv(env = process.env) {
+    return { [AGENT_GENERATION_DEPTH_ENV]: String(agentGenerationDepth(env) + 1) };
+}
+export function agentGenerationDepthExceeded(env = process.env) {
+    return agentGenerationDepth(env) > MAX_AGENT_GENERATION_DEPTH;
+}
 export function assertNoAgentRecursion(text) {
     const result = scanAgentTextForRecursion(text);
     if (!result.ok)

package/dist/core/agents/native-cli-worker-runtime.js

@@ -1,13 +1,15 @@
 import fs from 'node:fs';
 import { spawn } from 'node:child_process';
 import path from 'node:path';
-import { ensureDir, exists, nowIso, packageRoot, readJson, writeJsonAtomic } from '../fsx.js';
+import { ensureDir, exists, nowIso, packageRoot, readJson, registerDetachedProcessGroup, terminateProcessTree, writeJsonAtomic } from '../fsx.js';
 import { fastModeEnv } from './fast-mode-policy.js';
 import { validateAgentWorkerResult } from './agent-worker-pipeline.js';
 import { appendParallelRuntimeEvent } from './parallel-runtime-proof.js';
 import { appendAgentMessage } from './agent-message-bus.js';
 import { markLoopWorkerInterrupted, registerLoopActiveWorker } from '../loops/loop-interrupt-registry.js';
 export const NATIVE_CLI_WORKER_RUNTIME_SCHEMA = 'sks.native-cli-worker-runtime.v3';
+export const NATIVE_CLI_WORKER_DEFAULT_TIMEOUT_MS = 60 * 60 * 1000;
+export const NATIVE_CLI_WORKER_TIMEOUT_BLOCKER = 'native_cli_worker_timeout';
 export function createNativeCliWorkerRuntimeRecorder(root, input) {
     return new NativeCliWorkerRuntimeRecorder(root, input);
 }
@@ -63,7 +65,7 @@ class NativeCliWorkerRuntimeRecorder {
             recursion_guard_env: true
         };
         await writeJsonAtomic(path.join(this.root, intakeRel), intake);
-        const workerEntrypoint = await resolveWorkerEntrypointPath();
+        const workerEntrypoint = this.input.workerEntrypointPath || await resolveWorkerEntrypointPath();
         const args = [workerEntrypoint, '--intake', path.join(this.root, intakeRel), '--json'];
         const record = {
             schema: 'sks.native-cli-worker-session-record.v2',
@@ -117,9 +119,16 @@ class NativeCliWorkerRuntimeRecorder {
                 SKS_AGENT_SLOT_ID: String(ctx.agent.slot_id || ''),
                 SKS_AGENT_GENERATION_INDEX: String(ctx.agent.generation_index || 1)
             },
-            stdio: ['ignore', 'pipe', 'pipe']
+            stdio: ['ignore', 'pipe', 'pipe'],
+            detached: process.platform !== 'win32'
+        });
+        child.stdout?.pipe(stdout);
+        child.stderr?.pipe(stderr);
+        const unregisterProcessGroup = registerDetachedProcessGroup(child);
+        const supervisor = superviseWorkerChild(child, {
+            timeoutMs: resolveWorkerTimeoutMs(ctx.opts),
+            ...(ctx.opts?.signal ? { signal: ctx.opts.signal } : {})
         });
-        const removeAbortListener = terminateChildOnAbort(child, ctx.opts?.signal);
         const exitPromise = new Promise((resolve) => {
             child.once('close', (code, signal) => resolve({ code, signal }));
             child.once('error', () => resolve({ code: 1, signal: null }));
@@ -130,48 +139,57 @@ class NativeCliWorkerRuntimeRecorder {
         if (child.pid)
             this.active.add(child.pid);
         this.maxObserved = Math.max(this.maxObserved, this.active.size);
-        await this.record(record);
-        const loopHandle = await registerLoopWorkerHandle({
-            root: ctx.opts.projectRoot || this.input.projectRoot || ctx.opts.cwd || packageRoot(),
-            env: ctx.opts.env || {},
-            agentId: String(ctx.agent.id || ctx.agent.session_id || 'agent'),
-            sessionId: ctx.agent.session_id || null,
-            pid: child.pid || null
-        });
-        await appendParallelRuntimeEvent(this.root, this.input.missionId, {
-            event_type: 'worker_process_spawned',
-            slot_id: ctx.agent.slot_id || ctx.agent.id || null,
-            generation_index: ctx.agent.generation_index || null,
-            session_id: ctx.agent.session_id || null,
-            pid: child.pid || null,
-            backend: this.input.backend,
-            placement: 'process',
-            worktree_id: worktree?.id || null
-        }).catch(() => undefined);
-        await this.lifecycle(ctx, {
-            eventType: 'worker_spawned',
-            status: 'launching',
-            artifacts: [intakeRel, heartbeatRel, resultRel, stdoutRel, stderrRel],
-            logTail: `pid=${child.pid || 'unknown'}`
-        });
-        child.stdout?.pipe(stdout);
-        child.stderr?.pipe(stderr);
-        const exit = await exitPromise;
-        removeAbortListener();
-        stdout.end();
-        stderr.end();
-        if (child.pid)
-            this.active.delete(child.pid);
+        let exit;
+        let loopHandle = null;
+        try {
+            await this.record(record);
+            loopHandle = await registerLoopWorkerHandle({
+                root: ctx.opts.projectRoot || this.input.projectRoot || ctx.opts.cwd || packageRoot(),
+                env: ctx.opts.env || {},
+                agentId: String(ctx.agent.id || ctx.agent.session_id || 'agent'),
+                sessionId: ctx.agent.session_id || null,
+                pid: child.pid || null
+            });
+            await appendParallelRuntimeEvent(this.root, this.input.missionId, {
+                event_type: 'worker_process_spawned',
+                slot_id: ctx.agent.slot_id || ctx.agent.id || null,
+                generation_index: ctx.agent.generation_index || null,
+                session_id: ctx.agent.session_id || null,
+                pid: child.pid || null,
+                backend: this.input.backend,
+                placement: 'process',
+                worktree_id: worktree?.id || null
+            }).catch(() => undefined);
+            await this.lifecycle(ctx, {
+                eventType: 'worker_spawned',
+                status: 'launching',
+                artifacts: [intakeRel, heartbeatRel, resultRel, stdoutRel, stderrRel],
+                logTail: `pid=${child.pid || 'unknown'}`
+            });
+            exit = await exitPromise;
+        }
+        finally {
+            supervisor.dispose();
+            await supervisor.terminate();
+            unregisterProcessGroup();
+            stdout.end();
+            stderr.end();
+            if (child.pid)
+                this.active.delete(child.pid);
+        }
         record.closed_at = nowIso();
         record.exit_code = exit.code;
         record.signal = exit.signal;
         record.status = exit.code === 0 ? 'closed' : 'failed';
+        const timeoutBlockers = supervisor.timedOut ? [NATIVE_CLI_WORKER_TIMEOUT_BLOCKER] : [];
+        if (supervisor.timedOut)
+            record.status = 'failed';
         if (loopHandle) {
             await markLoopWorkerInterrupted(ctx.opts.projectRoot || this.input.projectRoot || ctx.opts.cwd || packageRoot(), loopHandle.mission_id, loopHandle.worker_id, record.status === 'closed' ? 'completed' : 'failed').catch(() => undefined);
         }
         const parsed = await readJson(path.join(this.root, resultRel), null).catch(() => null);
         if (!parsed) {
-            record.blockers = ['native_cli_worker_result_missing'];
+            record.blockers = [...timeoutBlockers, 'native_cli_worker_result_missing'];
             await this.lifecycle(ctx, {
                 eventType: 'worker_failed',
                 status: 'failed',
@@ -199,6 +217,8 @@ class NativeCliWorkerRuntimeRecorder {
         }
         const result = validateAgentWorkerResult({
             ...parsed,
+            ...(timeoutBlockers.length ? { status: 'failed' } : {}),
+            blockers: [...timeoutBlockers, ...(Array.isArray(parsed.blockers) ? parsed.blockers : [])],
             artifacts: [...new Set([...(Array.isArray(parsed.artifacts) ? parsed.artifacts : []), stdoutRel, stderrRel])]
         });
         record.status = result.status === 'done' ? 'closed' : result.status;
@@ -293,30 +313,37 @@ class NativeCliWorkerRuntimeRecorder {
         };
     }
 }
-function terminateChildOnAbort(child, signal) {
-    if (!signal)
-        return () => undefined;
-    let hardKillTimer = null;
+function superviseWorkerChild(child, input) {
+    let timedOut = false;
+    let teardown = null;
     const terminate = () => {
         if (child.exitCode !== null || child.signalCode !== null)
-            return;
-        child.kill('SIGTERM');
-        hardKillTimer = setTimeout(() => {
-            if (child.exitCode === null && child.signalCode === null)
-                child.kill('SIGKILL');
-        }, 1500);
-        hardKillTimer.unref?.();
+            return Promise.resolve();
+        teardown = teardown || terminateProcessTree(child.pid, child);
+        return teardown;
     };
-    if (signal.aborted)
-        terminate();
-    else
-        signal.addEventListener('abort', terminate, { once: true });
-    return () => {
-        signal.removeEventListener('abort', terminate);
-        if (hardKillTimer)
-            clearTimeout(hardKillTimer);
+    const onAbort = () => { void terminate(); };
+    const timer = setTimeout(() => { timedOut = true; void terminate(); }, input.timeoutMs);
+    timer.unref?.();
+    if (input.signal) {
+        if (input.signal.aborted)
+            void terminate();
+        else
+            input.signal.addEventListener('abort', onAbort, { once: true });
+    }
+    return {
+        get timedOut() { return timedOut; },
+        terminate,
+        dispose() {
+            clearTimeout(timer);
+            input.signal?.removeEventListener('abort', onAbort);
+        }
     };
 }
+function resolveWorkerTimeoutMs(opts) {
+    const candidate = Number(opts?.workerTimeoutMs ?? opts?.timeoutMs);
+    return Number.isFinite(candidate) && candidate > 0 ? candidate : NATIVE_CLI_WORKER_DEFAULT_TIMEOUT_MS;
+}
 async function resolveWorkerEntrypointPath() {
     const distEntrypoint = path.join(packageRoot(), 'dist', 'core', 'agents', 'native-cli-worker-entry.js');
     if (await exists(distEntrypoint))

package/dist/core/align/align-context-index.js

@@ -0,0 +1,68 @@
+import path from 'node:path';
+import { readSourceHashes } from '../triwiki/context-graph/compiler/freshness.js';
+import { computeSourceInventoryFingerprint } from '../triwiki/context-graph/compiler/fragment-manifest.js';
+import { publishContextIndexGeneration } from '../triwiki/context-graph/compiler/publish-index.js';
+import { openWorkspaceContextIndex } from '../triwiki/context-graph/query/index.js';
+import { ContextIndexStoreError } from '../triwiki/context-graph/store/generation-errors.js';
+import { ContextIndexWriterError } from '../triwiki/context-graph/runtime-index/writer.js';
+import { ContextIndexFormatError } from '../triwiki/context-graph/runtime-index/format.js';
+import { projectCodePackFromGraph } from '../triwiki/code-pack.js';
+export const ALIGN_PENDING_ROOT_DIR = 'pending';
+export const ALIGN_CONTEXT_INDEX_BLOCKER = 'code_navigation_context_index_blocked';
+export function alignPendingRoot(stageRoot) {
+    return path.join(stageRoot, ALIGN_PENDING_ROOT_DIR);
+}
+export function alignPendingWiki(stageRoot) {
+    return path.join(alignPendingRoot(stageRoot), '.sneakoscope', 'wiki');
+}
+export function alignSourceFingerprint(inputHashes) {
+    return computeSourceInventoryFingerprint(new Map(Object.entries(inputHashes)));
+}
+function alignBlocker(error) {
+    if (error instanceof ContextIndexStoreError) {
+        return new Error(`${ALIGN_CONTEXT_INDEX_BLOCKER}:${error.publicCode}:${error.code}`);
+    }
+    if (error instanceof ContextIndexWriterError || error instanceof ContextIndexFormatError) {
+        return new Error(`${ALIGN_CONTEXT_INDEX_BLOCKER}:${error.publicCode}:${error.code}`);
+    }
+    return error instanceof Error ? error : new Error(String(error));
+}
+export async function publishAlignContextIndex(input) {
+    try {
+        return await publishContextIndexGeneration({
+            root: input.pendingRoot,
+            snapshot: input.snapshot,
+            sourceFingerprint: input.sourceFingerprint,
+            fragmentManifestHash: input.fragmentManifestHash ?? null,
+            ...(input.lintErrors === undefined ? {} : { lintErrors: input.lintErrors }),
+            ...(input.lintWarnings === undefined ? {} : { lintWarnings: input.lintWarnings })
+        });
+    }
+    catch (error) {
+        throw alignBlocker(error);
+    }
+}
+function citedPaths(pack) {
+    return [...new Set(pack.entries.flatMap((entry) => entry.citations.map((citation) => citation.path)))].sort();
+}
+export async function projectAlignCodePack(input) {
+    let reader;
+    try {
+        const handle = await openWorkspaceContextIndex(input.pendingRoot, {
+            cache: null,
+            expectedSourceFingerprint: input.sourceFingerprint
+        });
+        reader = handle.reader;
+    }
+    catch (error) {
+        throw alignBlocker(error);
+    }
+    const options = {
+        generatedAt: input.generatedAt,
+        gitHeadSha: input.gitHeadSha,
+        snapshotFreshness: 'fresh'
+    };
+    const first = projectCodePackFromGraph(input.root, reader, options);
+    const observed = await readSourceHashes(input.root, citedPaths(first.pack));
+    return projectCodePackFromGraph(input.root, reader, { ...options, observedSourceHashes: observed }).pack;
+}

package/dist/core/align/align-route.js

@@ -20,6 +20,8 @@ export const ALIGN_SOURCE_POLICY = Object.freeze({
 export const ALIGN_OUTPUT_ARTIFACTS = Object.freeze([
     '.sneakoscope/wiki/context-graph.json',
     '.sneakoscope/wiki/context-graph.meta.json',
+    '.sneakoscope/wiki/context-graph/current.json',
+    '.sneakoscope/wiki/context-graph/context-graph.meta.json',
     '.sneakoscope/wiki/code-navigation-manifest.json',
     '.sneakoscope/wiki/code-pack.json',
     '.sneakoscope/wiki/context-pack.json',

package/dist/core/align/code-navigation-align.js

@@ -8,17 +8,17 @@ import { createRequestedScopeContract } from '../safety/requested-scope-contract
 import { projectTriwikiToAgentsMdTransactional } from '../triwiki/agents-md-projector.js';
 import { buildCodeNavigationContextPack, validateCodeNavigationContextPack } from '../triwiki/code-navigation-context-pack.js';
 import { CODE_NAVIGATION_FATAL_SKIP_REASONS, CODE_NAVIGATION_LIMITS } from '../triwiki/code-navigation-policy.js';
-import { isCodePackProjectionBoundToSnapshot, projectCodePackFromGraph, validateCodePack } from '../triwiki/code-pack.js';
+import { isCodePackProjectionBoundToSnapshot, validateCodePack } from '../triwiki/code-pack.js';
 import { validateContextGraphSnapshot } from '../triwiki/context-graph/contracts.js';
 import { compileContextGraph } from '../triwiki/context-graph/compiler/index.js';
-import { readSourceHashes } from '../triwiki/context-graph/compiler/freshness.js';
 import { ARCHITECTURE_MAP_EXTRACTOR_IDS, architectureMapGraphExtractors } from '../triwiki/context-graph/extractors/index.js';
 import { computeContextGraphCacheKey } from '../triwiki/context-graph/compiler/cache-key.js';
 import { walkCodeInventory } from '../triwiki/context-graph/extractors/code/inventory.js';
 import { codeInventoryInputHashes } from '../triwiki/code-navigation-policy.js';
-import { clearContextGraphSnapshotCache } from '../triwiki/context-graph/query/snapshot-cache.js';
+import { clearContextGraphSnapshotCache, clearWorkspaceContextIndex } from '../triwiki/context-graph/query/index.js';
 import { withTriWikiStateLock } from '../triwiki/triwiki-cleanup.js';
 import { publishArchitectureMapToStage } from '../triwiki/context-graph/store/architecture-map-store.js';
+import { alignPendingRoot, alignPendingWiki, alignSourceFingerprint, projectAlignCodePack, publishAlignContextIndex } from './align-context-index.js';
 import { ALIGN_GATE_ARTIFACT, ALIGN_LEDGER_ARTIFACT, ALIGN_OUTPUT_ARTIFACTS, ALIGN_PLAN_ARTIFACT, ALIGN_STAGING_ROOT_REL, buildInitialAlignLedger, refreshAlignGate } from './align-route.js';
 const WIKI_PREFIX = '.sneakoscope/wiki/';
 function isArchitectureMapOptionalSkip(skip) {
@@ -65,9 +65,6 @@ function countsBy(values, key) {
 function difference(left, right) {
     return left.filter((value) => !right.has(value)).sort();
 }
-function citedPaths(pack) {
-    return [...new Set(pack.entries.flatMap((entry) => entry.citations.map((citation) => citation.path)))].sort();
-}
 function alignGuard(root) {
     const contract = createRequestedScopeContract({
         route: '$sks-align',
@@ -127,20 +124,6 @@ async function writeEvidence(root, dir, ledger, missionId) {
     await writeJsonAtomic(path.join(dir, ALIGN_LEDGER_ARTIFACT), ledger);
     return (await refreshAlignGate(dir, missionId, root)).gate;
 }
-async function buildPack(root, snapshot, meta, generatedAt) {
-    const first = projectCodePackFromGraph(root, snapshot, {
-        generatedAt,
-        gitHeadSha: meta.cacheKeyParts.head,
-        snapshotFreshness: 'fresh'
-    });
-    const observed = await readSourceHashes(root, citedPaths(first.pack));
-    return projectCodePackFromGraph(root, snapshot, {
-        generatedAt,
-        gitHeadSha: meta.cacheKeyParts.head,
-        snapshotFreshness: 'fresh',
-        observedSourceHashes: observed
-    }).pack;
-}
 function buildManifest(generatedAt, inventory, inventoryDigest, snapshot) {
     return {
         schema: 'sks.code-navigation-manifest.v1',
@@ -276,29 +259,9 @@ async function runLocked(root, dir, missionId, plan, ledger, beforeFinalSourceCa
     if (!graphValidation.ok || meta.cacheKeyParts.sourcePolicy !== 'workspace') {
         throw new Error('code_navigation_graph_validation_failed');
     }
-    const pack = await buildPack(root, snapshot, meta, generatedAt);
-    const packValidation = await validateCodePack(pack, root);
-    ledger.validation.code_pack = packValidation.ok
-        && pack.source_file_count === inventoryPaths.length
-        && isCodePackProjectionBoundToSnapshot(snapshot.snapshotHash, pack);
-    if (!ledger.validation.code_pack)
-        throw new Error(`code_navigation_code_pack_invalid:${packValidation.issues.join('|')}`);
-    const contextPack = buildCodeNavigationContextPack({
-        root,
-        codePack: pack,
-        snapshotHash: snapshot.snapshotHash,
-        fileCount: inventoryPaths.length,
-        symbolCount: ledger.graph.symbol_nodes,
-        edgeCount: snapshot.edgeCount,
-        extractorRevisions: snapshot.extractors.map(({ id, revision }) => ({ id, revision }))
-    });
-    const contextValidation = validateCodeNavigationContextPack(contextPack, root);
-    ledger.validation.context_pack = contextValidation.ok;
-    if (!contextValidation.ok)
-        throw new Error('code_navigation_context_pack_invalid');
-    const manifest = buildManifest(generatedAt, inventory, codeInventoryDigest, snapshot);
     const stageRoot = path.join(stageBase, `${missionId}-${randomUUID().slice(0, 8)}`);
-    const stageWiki = path.join(stageRoot, 'new-wiki');
+    const pendingRoot = alignPendingRoot(stageRoot);
+    const stageWiki = alignPendingWiki(stageRoot);
     const previousRoot = path.join(stageRoot, 'previous');
     const activeWiki = path.join(root, '.sneakoscope', 'wiki');
     const movedPrior = [];
@@ -307,6 +270,41 @@ async function runLocked(root, dir, missionId, plan, ledger, beforeFinalSourceCa
     let commitStarted = false;
     try {
         await ensureDir(stageWiki);
+        const sourceFingerprint = alignSourceFingerprint(inputHashes);
+        const published = await publishAlignContextIndex({
+            pendingRoot,
+            snapshot,
+            sourceFingerprint,
+            fragmentManifestHash: null,
+            lintWarnings: compiled.issues.length
+        });
+        const pack = await projectAlignCodePack({
+            root,
+            pendingRoot,
+            gitHeadSha: meta.cacheKeyParts.head,
+            generatedAt,
+            sourceFingerprint: published.sourceFingerprint
+        });
+        const packValidation = await validateCodePack(pack, root);
+        ledger.validation.code_pack = packValidation.ok
+            && pack.source_file_count === inventoryPaths.length
+            && isCodePackProjectionBoundToSnapshot(snapshot.snapshotHash, pack);
+        if (!ledger.validation.code_pack)
+            throw new Error(`code_navigation_code_pack_invalid:${packValidation.issues.join('|')}`);
+        const contextPack = buildCodeNavigationContextPack({
+            root,
+            codePack: pack,
+            snapshotHash: snapshot.snapshotHash,
+            fileCount: inventoryPaths.length,
+            symbolCount: ledger.graph.symbol_nodes,
+            edgeCount: snapshot.edgeCount,
+            extractorRevisions: snapshot.extractors.map(({ id, revision }) => ({ id, revision }))
+        });
+        const contextValidation = validateCodeNavigationContextPack(contextPack, root);
+        ledger.validation.context_pack = contextValidation.ok;
+        if (!contextValidation.ok)
+            throw new Error('code_navigation_context_pack_invalid');
+        const manifest = buildManifest(generatedAt, inventory, codeInventoryDigest, snapshot);
         await writeJsonAtomic(path.join(stageWiki, 'context-graph.json'), snapshot);
         await writeJsonAtomic(path.join(stageWiki, 'context-graph.meta.json'), meta);
         await writeJsonAtomic(path.join(stageWiki, 'code-navigation-manifest.json'), manifest);
@@ -333,6 +331,7 @@ async function runLocked(root, dir, missionId, plan, ledger, beforeFinalSourceCa
         await guardedRename(guard, stageWiki, activeWiki);
         promoted = true;
         clearContextGraphSnapshotCache();
+        clearWorkspaceContextIndex(root);
         ledger.publication.transactional_directory_replaced = true;
         ledger.publication.active_artifacts = [...ALIGN_OUTPUT_ARTIFACTS];
         projection = await projectTriwikiToAgentsMdTransactional(root);
@@ -401,6 +400,7 @@ async function runLocked(root, dir, missionId, plan, ledger, beforeFinalSourceCa
                     await ensureDir(path.dirname(stageWiki));
                     await guardedRename(guard, activeWiki, stageWiki);
                     clearContextGraphSnapshotCache();
+                    clearWorkspaceContextIndex(root);
                 }
                 catch (rollbackError) {
                     rollbackFailures.push(`wiki:${String(rollbackError)}`);