sneakoscope 9.0.2 → 9.0.5

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-This README documents package **SKS 9.0.2** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
+This README documents package **SKS 9.0.5** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
 
 Use the official latest stable SKS and Codex CLI releases. The Codex compatibility SSOT is always the **current latest stable** host; capability probes measure what that host can actually do. Product docs do not crown a fixed `0.x.y` string as SSOT (release pins and schema directories are measured artifacts for the current package, not a permanent product version claim). Menu Bar / Center induce updates to the latest stable build. Run `sks update-check` for what is installed and read the capability report for what is supported. Install SSOT is npm `sneakoscope@latest`; PATH `sks` and Menu Bar stamped generation must match that version or gates fail. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it (Codex official multi-agent wrap-only; SKS does not reimplement a parallel runtime). Local code search is mode-separated (`sks search files|text|structure|symbol|context`); `context` is answered by the compiled TriWiki Context Graph (`context-graph.json` is exhaustive authority; `context-pack.json` and managed `AGENTS.md` are bounded projections) — see [docs/architecture/context-graph.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/architecture/context-graph.md) and [docs/PRODUCT-CONTRACT.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/PRODUCT-CONTRACT.md). See [CHANGELOG.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/CHANGELOG.md).
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "9.0.2"
+version = "9.0.5"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "9.0.2"
+version = "9.0.5"
 edition = "2021"
 
 [dependencies]

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "9.0.2",
+  "package_version": "9.0.5",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/codex-lb/desktop-bridge/http-forward.js

@@ -144,8 +144,13 @@ function writeHttpBridgeError(res, error, req) {
     });
     res.end(JSON.stringify({ error: { type: 'sks_bridge_error', code, message: code } }));
 }
+function safeUpstreamErrorId(value) {
+    const text = String(value ?? '').trim();
+    return /^[A-Za-z0-9_.:-]{1,64}$/.test(text) ? text : null;
+}
 async function readRedactedUpstreamError(response) {
     let total = 0;
+    const chunks = [];
     for await (const raw of response) {
         const chunk = Buffer.isBuffer(raw) ? raw : Buffer.from(raw);
         total += chunk.length;
@@ -153,14 +158,30 @@ async function readRedactedUpstreamError(response) {
             response.destroy();
             break;
         }
+        chunks.push(chunk);
     }
-    return Buffer.from(JSON.stringify({
-        error: {
-            type: 'upstream_error',
-            code: 'bridge_upstream_request_failed',
-            message: 'Upstream request failed'
-        }
-    }));
+    let upstreamCode = null;
+    let upstreamType = null;
+    try {
+        const parsed = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+        upstreamCode = safeUpstreamErrorId(parsed?.error?.code) ?? safeUpstreamErrorId(parsed?.detail);
+        upstreamType = safeUpstreamErrorId(parsed?.error?.type);
+    }
+    catch {
+    }
+    return {
+        upstreamCode,
+        upstreamType,
+        body: Buffer.from(JSON.stringify({
+            error: {
+                type: 'upstream_error',
+                code: 'bridge_upstream_request_failed',
+                message: 'Upstream request failed',
+                ...(upstreamType ? { upstream_type: upstreamType } : {}),
+                ...(upstreamCode ? { upstream_code: upstreamCode } : {})
+            }
+        }))
+    };
 }
 const upstreamAgents = new Map();
 function upstreamAgent(secure, key, idleTimeoutMs) {
@@ -252,21 +273,27 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
             upstream.once('response', (response) => {
                 const statusCode = response.statusCode || 502;
                 if (statusCode >= 400) {
-                    logHttpRejection({
-                        code: `bridge_upstream_status_${statusCode}`,
-                        transport: 'http',
-                        ...(req.method === undefined ? {} : { method: req.method }),
-                        ...(req.url === undefined ? {} : { url: req.url }),
-                        status: statusCode,
-                        provider_id: provider.provider_id,
-                        public_model: request.route.public_model,
-                    });
-                    void readRedactedUpstreamError(response).then((body) => {
+                    void readRedactedUpstreamError(response).then(({ body, upstreamCode, upstreamType }) => {
+                        const transientMislabel = statusCode === 404 && upstreamType === 'upstream_error' && !upstreamCode;
+                        const clientStatus = transientMislabel ? 503 : statusCode;
+                        logHttpRejection({
+                            code: transientMislabel
+                                ? `bridge_upstream_status_${statusCode}_translated_503`
+                                : upstreamCode ? `bridge_upstream_status_${statusCode}:${upstreamCode}` : `bridge_upstream_status_${statusCode}`,
+                            transport: 'http',
+                            ...(req.method === undefined ? {} : { method: req.method }),
+                            ...(req.url === undefined ? {} : { url: req.url }),
+                            status: clientStatus,
+                            provider_id: provider.provider_id,
+                            public_model: request.route.public_model,
+                        });
                         responseStarted = true;
                         const responseHeaders = rewriteResponseHeaders(response.headers, provider.base_url, authenticatedLocalBaseUrl);
                         responseHeaders['content-length'] = String(body.length);
                         delete responseHeaders['transfer-encoding'];
-                        res.writeHead(statusCode, responseHeaders);
+                        if (transientMislabel)
+                            responseHeaders['retry-after'] = '10';
+                        res.writeHead(clientStatus, responseHeaders);
                         res.end(body, () => finish());
                     }).catch(finish);
                     return;

package/dist/core/triwiki/context-graph/extractors/code/index.js

@@ -33,17 +33,21 @@ function sortedHashes(hashes) {
 }
 export class CodeGraphExtractor {
     preparedInventory;
+    sourceInventory;
     id = CODE_GRAPH_EXTRACTOR_ID;
     revision = CODE_GRAPH_EXTRACTOR_REVISION;
-    constructor(preparedInventory = null) {
+    constructor(preparedInventory = null, sourceInventory = null) {
         this.preparedInventory = preparedInventory;
+        this.sourceInventory = sourceInventory;
     }
     async extract(input) {
         const startedAt = Date.now();
         const deadline = startedAt + Math.max(1, input.limits.timeoutMs);
         const root = realRoot(input.root);
         const sink = new CodeGraphSink(input.limits, input.observedAt);
-        const inventory = this.preparedInventory ?? walkCodeInventory(root, input.limits);
+        const inventory = this.preparedInventory
+            ?? this.sourceInventory?.inventory(root, input.limits)
+            ?? walkCodeInventory(root, input.limits);
         for (const skip of inventory.skipped)
             sink.addSkip(skip);
         const hashes = new Map();
@@ -273,6 +277,6 @@ function collectNodeRels(factsByRel, parsedByRel, inventory, selectedRels) {
     return [...rels].sort();
 }
 export function createCodeGraphExtractor(options = {}) {
-    return new CodeGraphExtractor(options.preparedInventory ?? null);
+    return new CodeGraphExtractor(options.preparedInventory ?? null, options.sourceInventory ?? null);
 }
 export { CODE_GRAPH_EXTRACTOR_ID, CODE_GRAPH_EXTRACTOR_REVISION } from './types.js';

package/dist/core/triwiki/context-graph/extractors/evidence/index.js

@@ -2,15 +2,25 @@ import { lintWarning } from '../../contracts.js';
 import { extractContextPackEvidence } from './claims.js';
 import { extractProofEvidence } from './proofs.js';
 import { sanitizeEvidenceFragment } from './redaction.js';
+import { createSharedSourceInventory } from '../source-inventory.js';
 import { CONTEXT_PACK_REL, EVIDENCE_EXTRACTOR_ID, EVIDENCE_EXTRACTOR_REVISION, EvidenceFragmentBuilder, PROOF_BANK_REL, RiskDomainRegistry, evidenceContext, finalizeEvidenceFragment } from './shared.js';
 export { CONTEXT_PACK_REL, EVIDENCE_EXTRACTOR_ID, EVIDENCE_EXTRACTOR_REVISION, PROOF_BANK_REL, PROOF_INDEX_REL } from './shared.js';
 export { TRIWIKI_PROOF_INDEX_SCHEMA } from './proof-index.js';
 const MIN_FAN_IN_FOR_VERIFICATION_WARNING = 3;
 export class EvidenceGraphExtractor {
+    sourceInventory;
     id = EVIDENCE_EXTRACTOR_ID;
     revision = EVIDENCE_EXTRACTOR_REVISION;
+    constructor(sourceInventory = createSharedSourceInventory()) {
+        this.sourceInventory = sourceInventory;
+    }
     async extract(input) {
-        const ctx = evidenceContext({ root: input.root, observedAt: input.observedAt, limits: input.limits });
+        const ctx = evidenceContext({
+            root: input.root,
+            observedAt: input.observedAt,
+            limits: input.limits,
+            sourcePaths: this.sourceInventory.sourcePaths(input.root, input.limits)
+        });
         const builder = new EvidenceFragmentBuilder(input.limits, input.observedAt);
         const risks = new RiskDomainRegistry();
         const pack = extractContextPackEvidence(builder, ctx, risks);
@@ -26,8 +36,8 @@ export class EvidenceGraphExtractor {
         return finalizeEvidenceFragment(sanitizeEvidenceFragment(builder.fragment));
     }
 }
-export function createEvidenceGraphExtractor() {
-    return new EvidenceGraphExtractor();
+export function createEvidenceGraphExtractor(options = {}) {
+    return new EvidenceGraphExtractor(options.sourceInventory ?? createSharedSourceInventory());
 }
 function noteUnverifiedFanIn(builder) {
     const incoming = new Map();

package/dist/core/triwiki/context-graph/extractors/evidence/proof-index.js

@@ -3,7 +3,7 @@ import { sha256 } from '../../../../fsx.js';
 import { resolveInsideWorkspace, tryNormalizeGraphPath } from '../../paths.js';
 import { PROOF_BANK_REL, PROOF_INDEX_REL, asArray, asRecord, asString, asStringList, readWorkspaceFile, statWorkspaceEntry } from './shared.js';
 export const TRIWIKI_PROOF_INDEX_SCHEMA = 'sks.triwiki-proof-index.v1';
-const MAX_PROOF_RECORDS = 512;
+const MAX_PROOF_RECORDS = 4096;
 const MAX_SCAN_DEPTH = 4;
 const SCAN_EXCLUDED_DIRS = new Set(['.locks', 'node_modules', '.git']);
 export function discoverProofRecords(ctx) {

package/dist/core/triwiki/context-graph/extractors/evidence/proofs.js

@@ -7,10 +7,6 @@ import { EvidenceFragmentBuilder, PROOF_BANK_REL, RiskDomainRegistry, asRecord,
 import { discoverProofRecords } from './proof-index.js';
 const MAX_DERIVED_INPUTS = 12;
 const PLACEHOLDER_HASHES = new Set(['', 'unknown', 'legacy-missing', 'none', 'null']);
-const HASH_PINNED_INPUTS = [
-    { field: 'package_lock_hash', rel: 'package-lock.json' },
-    { field: 'release_gates_hash', rel: 'release-gates.v2.json' }
-];
 export function extractProofEvidence(builder, ctx, risks) {
     const discovery = discoverProofRecords(ctx);
     for (const skip of discovery.skipped)
@@ -220,15 +216,7 @@ function linkSubject(builder, record, health, proofNodeId, mode) {
 }
 function linkDerivedInputs(builder, ctx, record, proofNodeId) {
     const raw = record.card;
-    const candidates = [];
-    if (raw) {
-        for (const pinned of HASH_PINNED_INPUTS) {
-            const hash = asString(raw[pinned.field]);
-            if (hash && !PLACEHOLDER_HASHES.has(hash))
-                candidates.push(pinned.rel);
-        }
-        candidates.push(...asStringList(raw.input_paths), ...asStringList(raw.source_paths));
-    }
+    const candidates = raw ? [...asStringList(raw.input_paths), ...asStringList(raw.source_paths)] : [];
     const seen = new Set();
     for (const candidate of candidates) {
         if (seen.size >= MAX_DERIVED_INPUTS)
@@ -236,6 +224,8 @@ function linkDerivedInputs(builder, ctx, record, proofNodeId) {
         const rel = tryNormalizeGraphPath(ctx.root, candidate);
         if (!rel || seen.has(rel))
             continue;
+        if (!ctx.sourcePaths.has(rel))
+            continue;
         const stat = statWorkspaceEntry(ctx.root, rel);
         if (!stat || !stat.isFile())
             continue;

package/dist/core/triwiki/context-graph/extractors/evidence/redaction.js

@@ -1,5 +1,6 @@
 import { REDACTION_MARKER, containsPlaintextSecret, redactString } from '../../../../secret-redaction.js';
 import { lintError } from '../../contracts.js';
+import { isStructuralValue } from '../../lint/rules.js';
 import { isWorkspaceRelativePosixPath } from '../../paths.js';
 export const EVIDENCE_REDACTED_PATH = '[redacted-path]';
 export const EVIDENCE_MAX_META_STRING = 160;
@@ -134,8 +135,11 @@ function sanitizeMetadataValue(value) {
     }
     return { value, changed: false };
 }
+function identityLooksSecret(value) {
+    return !isStructuralValue(value) && containsPlaintextSecret(value);
+}
 function guardNode(node, extractor) {
-    if (containsPlaintextSecret(node.id) || containsPlaintextSecret(node.label)) {
+    if (identityLooksSecret(node.id) || identityLooksSecret(node.label)) {
         return {
             node: null,
             issue: lintError('secret_like_value', 'evidence node identity looks secret-like and was refused', {
@@ -144,7 +148,7 @@ function guardNode(node, extractor) {
             })
         };
     }
-    if (node.path !== undefined && containsPlaintextSecret(node.path)) {
+    if (node.path !== undefined && identityLooksSecret(node.path)) {
         return {
             node: null,
             issue: lintError('secret_like_value', 'evidence node path looks secret-like and was refused', {

package/dist/core/triwiki/context-graph/extractors/evidence/sources.js

@@ -95,8 +95,9 @@ export class EvidenceSourceGraph {
             tokenCost: tokenEstimate(rel.length, 64),
             metadata
         }, CONTEXT_PACK_REL);
-        if (!isDirectory && (diskHash || manifestHash))
+        if (!isDirectory && (diskHash || manifestHash) && this.ctx.sourcePaths.has(rel)) {
             this.linkBackingFile(id, rel, stat, diskHash, manifestHash);
+        }
         const state = { id, freshness };
         this.states.set(rel, state);
         return state;

package/dist/core/triwiki/context-graph/extractors/index.js

@@ -1,14 +1,25 @@
 import { createCodeGraphExtractor } from './code/index.js';
 import { createEvidenceGraphExtractor } from './evidence/index.js';
+import { createSharedSourceInventory } from './source-inventory.js';
 import { createTopologyGraphExtractor } from './topology/index.js';
 export function contextGraphExtractors() {
-    return [createCodeGraphExtractor(), createTopologyGraphExtractor(), createEvidenceGraphExtractor()];
+    const sourceInventory = createSharedSourceInventory();
+    return [
+        createCodeGraphExtractor({ sourceInventory }),
+        createTopologyGraphExtractor({ sourceInventory }),
+        createEvidenceGraphExtractor({ sourceInventory })
+    ];
 }
 export function codeNavigationGraphExtractors(options = {}) {
     return [createCodeGraphExtractor(options)];
 }
 export function architectureMapGraphExtractors(options = {}) {
-    return [createCodeGraphExtractor(options), createTopologyGraphExtractor(), createEvidenceGraphExtractor()];
+    const sourceInventory = createSharedSourceInventory(options.preparedInventory ?? null);
+    return [
+        createCodeGraphExtractor({ sourceInventory }),
+        createTopologyGraphExtractor({ sourceInventory }),
+        createEvidenceGraphExtractor({ sourceInventory })
+    ];
 }
 export const ARCHITECTURE_MAP_EXTRACTOR_IDS = Object.freeze(['code', 'topology', 'triwiki-evidence']);
 export { createCodeGraphExtractor, createEvidenceGraphExtractor, createTopologyGraphExtractor };

package/dist/core/triwiki/context-graph/extractors/source-inventory.js

@@ -0,0 +1,35 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { walkCodeInventory } from './code/inventory.js';
+function canonicalRoot(root) {
+    const absolute = path.resolve(root);
+    try {
+        return fs.realpathSync(absolute);
+    }
+    catch {
+        return absolute;
+    }
+}
+export function createSharedSourceInventory(prepared = null) {
+    let cachedRoot = null;
+    let cachedInventory = prepared;
+    let cachedSet = null;
+    const inventory = (root, limits) => {
+        if (prepared)
+            return prepared;
+        const canonical = canonicalRoot(root);
+        if (!cachedInventory || cachedRoot !== canonical) {
+            cachedInventory = walkCodeInventory(canonical, limits);
+            cachedRoot = canonical;
+        }
+        return cachedInventory;
+    };
+    const sourcePaths = (root, limits) => {
+        const current = inventory(root, limits);
+        if (!cachedSet || cachedSet.inventory !== current) {
+            cachedSet = { inventory: current, set: new Set(current.files.map((file) => file.rel)) };
+        }
+        return cachedSet.set;
+    };
+    return { inventory, sourcePaths };
+}

package/dist/core/triwiki/context-graph/extractors/topology/gate-edges.js

@@ -50,22 +50,26 @@ export function buildGateVerificationEdges(ctx, gates) {
     const verified = new Set();
     for (const gate of gates) {
         let emitted = 0;
+        let capped = false;
         for (const candidate of gateCheckCandidates(gate.command)) {
-            if (emitted >= TOPOLOGY_GATE_VERIFIED_CAP)
-                break;
             const expansion = expandGlob(ctx.files, candidate, TOPOLOGY_GLOB_MATCH_CAP);
-            if (expansion.capped) {
-                recordSkip(ctx, gate.manifestPath, 'cap_reached', `check pattern ${candidate} matched ${expansion.total} files`);
+            if (!expansion.total) {
+                recordSkip(ctx, gate.manifestPath, 'excluded', `check implementation ${candidate} is not in this workspace`);
                 continue;
             }
-            if (!expansion.matches.length) {
-                recordSkip(ctx, gate.manifestPath, 'excluded', `check implementation ${candidate} is not in this workspace`);
+            verified.add(gate.id);
+            if (expansion.capped) {
+                recordSkip(ctx, gate.manifestPath, 'excluded', `check pattern ${candidate} matched ${expansion.total} files; kept whole as checkScripts metadata on the gate node`);
                 continue;
             }
             const confidence = isGlobPattern(candidate) ? 'derived' : 'manifest';
             for (const match of expansion.matches) {
-                if (emitted >= TOPOLOGY_GATE_VERIFIED_CAP)
+                if (!ctx.sourcePaths.has(match))
+                    continue;
+                if (emitted >= TOPOLOGY_GATE_VERIFIED_CAP) {
+                    capped = true;
                     break;
+                }
                 const fileId = ensureFileNode(ctx, match, 'gate_check', gate.manifestPath);
                 if (!fileId)
                     continue;
@@ -78,11 +82,14 @@ export function buildGateVerificationEdges(ctx, gates) {
                     hash: gate.manifestHash,
                     line: gate.line
                 });
-                if (added) {
+                if (added)
                     emitted += 1;
-                    verified.add(gate.id);
-                }
             }
+            if (capped)
+                break;
+        }
+        if (capped) {
+            recordSkip(ctx, gate.manifestPath, 'cap_reached', `gate ${gate.id} hit the verified_by edge cap (${TOPOLOGY_GATE_VERIFIED_CAP}); check relations are missing`);
         }
     }
     return verified;
@@ -91,21 +98,26 @@ export function buildGateAffectedEdges(ctx, gates) {
     const affected = new Set();
     for (const gate of gates) {
         let emitted = 0;
+        let capped = false;
         const seen = new Set();
         for (const input of gate.cacheInputs) {
-            if (emitted >= TOPOLOGY_GATE_AFFECTED_CAP)
-                break;
             const expansion = expandGlob(ctx.files, input, TOPOLOGY_GLOB_MATCH_CAP);
+            if (expansion.total > 0)
+                affected.add(gate.id);
             if (expansion.capped) {
-                recordSkip(ctx, gate.manifestPath, 'cap_reached', `cache input ${input} matched ${expansion.total} files`);
+                recordSkip(ctx, gate.manifestPath, 'excluded', `cache input ${input} matched ${expansion.total} files; kept whole as cacheInputs metadata on the gate node`);
                 continue;
             }
             for (const match of expansion.matches) {
-                if (emitted >= TOPOLOGY_GATE_AFFECTED_CAP)
-                    break;
                 if (seen.has(match))
                     continue;
                 seen.add(match);
+                if (!ctx.sourcePaths.has(match))
+                    continue;
+                if (emitted >= TOPOLOGY_GATE_AFFECTED_CAP) {
+                    capped = true;
+                    break;
+                }
                 const fileId = ensureFileNode(ctx, match, 'gate_cache_input', gate.manifestPath);
                 if (!fileId)
                     continue;
@@ -118,11 +130,14 @@ export function buildGateAffectedEdges(ctx, gates) {
                     hash: gate.manifestHash,
                     line: gate.line
                 });
-                if (added) {
+                if (added)
                     emitted += 1;
-                    affected.add(gate.id);
-                }
             }
+            if (capped)
+                break;
+        }
+        if (capped) {
+            recordSkip(ctx, gate.manifestPath, 'cap_reached', `gate ${gate.id} hit the affected_by edge cap (${TOPOLOGY_GATE_AFFECTED_CAP}); cache-input relations are missing`);
         }
     }
     return affected;

package/dist/core/triwiki/context-graph/extractors/topology/index.js

@@ -4,6 +4,7 @@ import { buildCommandGraph, collectRuntimeManifest } from './commands.js';
 import { buildGateAffectedEdges, buildGateDependencyEdges, buildGatePresetPipelines, buildGateVerificationEdges, reportUnbackedProtectedGates } from './gate-edges.js';
 import { buildGateNodes, collectTopologyGates } from './gates.js';
 import { buildFileInventory } from './globs.js';
+import { createSharedSourceInventory } from '../source-inventory.js';
 import { buildRouteGraph } from './routes.js';
 import { TOPOLOGY_EXTRACTOR_ID, TOPOLOGY_EXTRACTOR_REVISION, createTopologyContext, recordSkip, topologyExpired } from './shared.js';
 const INVENTORY_SKIP_PATH = 'release-gates.v2.json';
@@ -45,8 +46,12 @@ function finalize(ctx) {
     return fragment;
 }
 export class TopologyGraphExtractor {
+    sourceInventory;
     id = TOPOLOGY_EXTRACTOR_ID;
     revision = TOPOLOGY_EXTRACTOR_REVISION;
+    constructor(sourceInventory = createSharedSourceInventory()) {
+        this.sourceInventory = sourceInventory;
+    }
     async extract(input) {
         const startedAt = Date.now();
         const files = buildFileInventory(input.root, input.limits.maxFiles);
@@ -55,6 +60,7 @@ export class TopologyGraphExtractor {
             observedAt: input.observedAt,
             limits: input.limits,
             files,
+            sourcePaths: this.sourceInventory.sourcePaths(input.root, input.limits),
             startedAt
         });
         if (files.truncated) {
@@ -83,8 +89,8 @@ export class TopologyGraphExtractor {
         return finalize(ctx);
     }
 }
-export function createTopologyGraphExtractor() {
-    return new TopologyGraphExtractor();
+export function createTopologyGraphExtractor(options = {}) {
+    return new TopologyGraphExtractor(options.sourceInventory ?? createSharedSourceInventory());
 }
 export { TOPOLOGY_EXTRACTOR_ID, TOPOLOGY_EXTRACTOR_REVISION } from './shared.js';
 export { TOPOLOGY_GATE_MANIFESTS } from './gates.js';

package/dist/core/triwiki/context-graph/extractors/topology/shared.js

@@ -4,10 +4,10 @@ import { lintError } from '../../contracts.js';
 import { contextGraphEdgeId, contextGraphNodeId } from '../../ids.js';
 import { ContextGraphPathError, isWorkspaceRelativePosixPath, resolveInsideWorkspace } from '../../paths.js';
 export const TOPOLOGY_EXTRACTOR_ID = 'topology';
-export const TOPOLOGY_EXTRACTOR_REVISION = '1.0.0';
+export const TOPOLOGY_EXTRACTOR_REVISION = '1.1.0';
 export const TOPOLOGY_GLOB_MATCH_CAP = 48;
-export const TOPOLOGY_GATE_AFFECTED_CAP = 96;
-export const TOPOLOGY_GATE_VERIFIED_CAP = 24;
+export const TOPOLOGY_GATE_AFFECTED_CAP = 256;
+export const TOPOLOGY_GATE_VERIFIED_CAP = 96;
 export function createTopologyContext(params) {
     const timeout = Number.isFinite(params.limits.timeoutMs) && params.limits.timeoutMs > 0 ? params.limits.timeoutMs : 0;
     return {
@@ -16,6 +16,7 @@ export function createTopologyContext(params) {
         limits: params.limits,
         deadline: params.startedAt + timeout,
         files: params.files,
+        sourcePaths: params.sourcePaths,
         nodes: new Map(),
         edges: new Map(),
         issues: [],
@@ -114,6 +115,8 @@ export function addEdge(ctx, input) {
 export function ensureFileNode(ctx, relativePath, role, sourcePath) {
     if (!isWorkspaceRelativePosixPath(relativePath))
         return null;
+    if (!ctx.sourcePaths.has(relativePath))
+        return null;
     const id = contextGraphNodeId({ kind: 'file', path: relativePath });
     const classification = ctx.fileClassification.get(relativePath);
     const metadata = {

package/dist/core/triwiki/context-graph/lint/rules.js

@@ -82,7 +82,7 @@ function looksHighEntropy(token) {
         return true;
     return /[A-Z]/.test(token) && /[a-z]/.test(token) && /[0-9]/.test(token);
 }
-function isStructuralValue(value) {
+export function isStructuralValue(value) {
     if (value.length > 512)
         return false;
     for (const run of value.match(HIGH_ENTROPY_RUN_RE) ?? []) {

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '9.0.2';
+export const PACKAGE_VERSION = '9.0.5';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "9.0.2",
+  "version": "9.0.5",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",