sneakoscope 9.1.0 → 9.1.1

package/README.md

@@ -22,7 +22,7 @@ Proof-first orchestration for Codex CLI, ChatGPT Desktop, AI coding agents, mult
 Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.
 <!-- END SKS SEARCH VISIBILITY MARKETING -->
 
-This README documents package **SKS 9.1.0** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
+This README documents package **SKS 9.1.1** — its own identity, read from `package.json` and subject to release-gate verification, not advice about what to install.
 
 Use the official latest stable SKS and Codex CLI releases. The Codex compatibility SSOT is always the **current latest stable** host; capability probes measure what that host can actually do. Product docs do not crown a fixed `0.x.y` string as SSOT (release pins and schema directories are measured artifacts for the current package, not a permanent product version claim). Menu Bar / Center induce updates to the latest stable build. Run `sks update-check` for what is installed and read the capability report for what is supported. Install SSOT is npm `sneakoscope@latest`; PATH `sks` and Menu Bar stamped generation must match that version or gates fail. It resolves managed SKS skills from the authoritative global install, preserves a runnable Naruto child slot when `max_threads=2`, and keeps Menu Bar repair transactional so stamped generations remain verifiable. Naruto uses stable opt-in multi-agent V2 when the host exposes it (Codex official multi-agent wrap-only; SKS does not reimplement a parallel runtime). Local code search is mode-separated (`sks search files|text|structure|symbol|context`); `context` is answered by the compiled TriWiki Context Graph (`context-graph.json` is exhaustive authority; `context-pack.json` and managed `AGENTS.md` are bounded projections) — see [docs/architecture/context-graph.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/architecture/context-graph.md) and [docs/PRODUCT-CONTRACT.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/docs/PRODUCT-CONTRACT.md). See [CHANGELOG.md](https://github.com/mandarange/Sneakoscope-Codex/blob/main/CHANGELOG.md).
 

package/crates/sks-core/Cargo.lock

@@ -259,7 +259,7 @@ dependencies = [
 
 [[package]]
 name = "sks-core"
-version = "9.1.0"
+version = "9.1.1"
 dependencies = [
  "globset",
  "grep-matcher",

package/crates/sks-core/Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "sks-core"
-version = "9.1.0"
+version = "9.1.1"
 edition = "2021"
 
 [dependencies]

package/dist/config/skills-manifest.json

@@ -1,6 +1,6 @@
 {
   "schema": "sks.skills-manifest.v1",
-  "package_version": "9.1.0",
+  "package_version": "9.1.1",
   "skills": [
     {
       "canonical_name": "sks",

package/dist/core/codex-lb/desktop-bridge/http-forward.js

@@ -148,6 +148,34 @@ function safeUpstreamErrorId(value) {
     const text = String(value ?? '').trim();
     return /^[A-Za-z0-9_.:-]{1,64}$/.test(text) ? text : null;
 }
+const TRANSIENT_UPSTREAM_STATUSES = new Set([500, 502, 503, 524]);
+const TRANSIENT_UPSTREAM_IDENTIFIERS = new Set(['upstream_error', 'upstream_request_timeout']);
+export const TRANSIENT_UPSTREAM_REPLAY_LIMIT = 3;
+const TRANSIENT_UPSTREAM_REPLAY_BACKOFF_MS = [200, 400, 800];
+function isTransientUpstreamIdentifier(value) {
+    return Boolean(value && TRANSIENT_UPSTREAM_IDENTIFIERS.has(value));
+}
+function delay(ms) {
+    return new Promise((resolve) => {
+        const timer = setTimeout(resolve, ms);
+        timer.unref();
+    });
+}
+function isTransientUpstreamFailure(statusCode, upstreamType, upstreamCode) {
+    if (statusCode === 429)
+        return false;
+    if (statusCode === 404) {
+        return isTransientUpstreamIdentifier(upstreamType) || isTransientUpstreamIdentifier(upstreamCode);
+    }
+    return TRANSIENT_UPSTREAM_STATUSES.has(statusCode);
+}
+function redactedUpstreamClientMessage(statusCode, transient) {
+    if (statusCode === 429)
+        return 'rate_limited';
+    if (transient)
+        return 'temporary_upstream_failure';
+    return 'bridge_upstream_request_failed';
+}
 async function readRedactedUpstreamError(response) {
     let total = 0;
     const chunks = [];
@@ -169,19 +197,18 @@ async function readRedactedUpstreamError(response) {
     }
     catch {
     }
-    return {
-        upstreamCode,
-        upstreamType,
-        body: Buffer.from(JSON.stringify({
-            error: {
-                type: 'upstream_error',
-                code: 'bridge_upstream_request_failed',
-                message: 'Upstream request failed',
-                ...(upstreamType ? { upstream_type: upstreamType } : {}),
-                ...(upstreamCode ? { upstream_code: upstreamCode } : {})
-            }
-        }))
-    };
+    return { upstreamCode, upstreamType };
+}
+function buildRedactedUpstreamErrorBody(statusCode, upstreamCode, upstreamType, transient) {
+    return Buffer.from(JSON.stringify({
+        error: {
+            type: 'upstream_error',
+            code: 'bridge_upstream_request_failed',
+            message: redactedUpstreamClientMessage(statusCode, transient),
+            ...(upstreamType ? { upstream_type: upstreamType } : {}),
+            ...(upstreamCode ? { upstream_code: upstreamCode } : {}),
+        },
+    }));
 }
 const upstreamAgents = new Map();
 function upstreamAgent(secure, key, idleTimeoutMs) {
@@ -240,7 +267,7 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
             delete headers['content-encoding'];
         const agent = upstreamAgent(provider.remote.secure, `${provider.remote.address}:${provider.remote.port}`, config.idleTimeoutMs);
         const replayable = Buffer.isBuffer(request.body);
-        const attempt = (useFreshConnection) => new Promise((resolve, reject) => {
+        const attempt = (useFreshConnection, canReplay) => new Promise((resolve, reject) => {
             let responseStarted = false;
             let settled = false;
             const abort = () => { if (!res.writableEnded)
@@ -273,15 +300,17 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
             upstream.once('response', (response) => {
                 const statusCode = response.statusCode || 502;
                 if (statusCode >= 400) {
-                    void readRedactedUpstreamError(response).then(({ body, upstreamCode, upstreamType }) => {
-                        const transientMislabel = statusCode === 404
-                            && (upstreamType === 'upstream_error' || upstreamCode === 'upstream_error');
-                        if (transientMislabel && replayable && !useFreshConnection) {
+                    void readRedactedUpstreamError(response).then(({ upstreamCode, upstreamType }) => {
+                        const transientMislabel = isTransientUpstreamFailure(statusCode, upstreamType, upstreamCode);
+                        if (transientMislabel && replayable && canReplay) {
                             responseStarted = true;
-                            finish(new StalePooledSocketFailure(new DesktopBridgeError('bridge_upstream_transient_mislabel')));
+                            finish(new StalePooledSocketFailure(new DesktopBridgeError(upstreamCode === 'upstream_request_timeout'
+                                ? 'bridge_upstream_request_timeout'
+                                : 'bridge_upstream_transient_mislabel')));
                             return;
                         }
                         const clientStatus = transientMislabel ? 503 : statusCode;
+                        const body = buildRedactedUpstreamErrorBody(statusCode, upstreamCode, upstreamType, transientMislabel);
                         logHttpRejection({
                             code: transientMislabel
                                 ? `bridge_upstream_status_${statusCode}_translated_503`
@@ -298,6 +327,8 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
                         responseHeaders['content-length'] = String(body.length);
                         delete responseHeaders['transfer-encoding'];
                         if (transientMislabel)
+                            responseHeaders['retry-after'] = String(responseHeaders['retry-after'] || '10');
+                        if (statusCode === 429 && !responseHeaders['retry-after'])
                             responseHeaders['retry-after'] = '10';
                         res.writeHead(clientStatus, responseHeaders);
                         res.end(body, () => finish());
@@ -321,21 +352,34 @@ export async function forwardHttp(req, res, config, prepared, authenticatedLocal
                 void pipeline(req, upstream).catch((error) => { if (!responseStarted)
                     finish(error); });
         });
-        try {
-            await attempt(false);
-        }
-        catch (error) {
-            if (!(error instanceof StalePooledSocketFailure))
-                throw error;
-            agent.destroy();
-            upstreamAgents.delete(`${provider.remote.secure ? 'https' : 'http'}:${provider.remote.address}:${provider.remote.port}`);
-            logHttpRejection({
-                code: `bridge_upstream_socket_stale_replayed:${underlyingErrorCode(error.reason) || 'unknown'}`,
-                transport: 'http',
-                ...(req.method === undefined ? {} : { method: req.method }),
-                ...(req.url === undefined ? {} : { url: req.url }),
-            });
-            await attempt(true);
+        let remainingReplays = replayable ? TRANSIENT_UPSTREAM_REPLAY_LIMIT : 0;
+        let useFreshConnection = false;
+        for (;;) {
+            try {
+                await attempt(useFreshConnection, remainingReplays > 0);
+                return;
+            }
+            catch (error) {
+                if (!(error instanceof StalePooledSocketFailure) || remainingReplays <= 0)
+                    throw error;
+                remainingReplays -= 1;
+                if (!useFreshConnection) {
+                    agent.destroy();
+                    upstreamAgents.delete(`${provider.remote.secure ? 'https' : 'http'}:${provider.remote.address}:${provider.remote.port}`);
+                }
+                logHttpRejection({
+                    code: `bridge_upstream_socket_stale_replayed:${underlyingErrorCode(error.reason) || 'unknown'}`,
+                    transport: 'http',
+                    ...(req.method === undefined ? {} : { method: req.method }),
+                    ...(req.url === undefined ? {} : { url: req.url }),
+                });
+                useFreshConnection = true;
+                const backoffIndex = TRANSIENT_UPSTREAM_REPLAY_LIMIT - remainingReplays - 1;
+                const backoffMs = TRANSIENT_UPSTREAM_REPLAY_BACKOFF_MS[Math.max(0, backoffIndex)]
+                    ?? TRANSIENT_UPSTREAM_REPLAY_BACKOFF_MS[TRANSIENT_UPSTREAM_REPLAY_BACKOFF_MS.length - 1];
+                if (backoffMs)
+                    await delay(backoffMs);
+            }
         }
     }
     catch (error) {

package/dist/core/codex-lb/desktop-bridge/server.js

@@ -8,7 +8,7 @@ import { createDesktopBridgePublicState, desktopBridgeListenOrigin, desktopBridg
 import { DesktopBridgeError } from './types.js';
 import { PACKAGE_VERSION } from '../../version.js';
 import { DESKTOP_BRIDGE_CLIENT_PATH_PREFIX, DESKTOP_BRIDGE_DIAGNOSTIC_HEALTH_PATH, DESKTOP_BRIDGE_DIAGNOSTIC_PATH, DESKTOP_BRIDGE_DIAGNOSTIC_PROTOCOL } from './types.js';
-import { forwardWebSocket } from './websocket-forward.js';
+import { forwardWebSocket, safeEndUpgradeSocket } from './websocket-forward.js';
 function authenticateDesktopBridgeClient(req, input) {
     const raw = String(req.url || '/');
     if (/^[a-z][a-z0-9+.-]*:\/\//i.test(raw) || raw.startsWith('//') || /[\r\n\0]/.test(raw)) {
@@ -135,22 +135,14 @@ function writeUpgradeRejection(socket, error, req) {
         url: req?.url,
         status: rejectionStatus(safeBridgeErrorCode(error)),
     });
-    socket.on('error', () => undefined);
-    if (socket.destroyed || socket.writableEnded)
-        return;
     const code = safeBridgeErrorCode(error);
     const status = rejectionStatus(code);
-    try {
-        socket.end(`HTTP/1.1 ${status} ${rejectionStatusText(status)}\r\n`
-            + 'Content-Type: application/json\r\n'
-            + 'Cache-Control: no-store\r\n'
-            + 'Connection: close\r\n'
-            + '\r\n'
-            + JSON.stringify({ error: { type: 'sks_bridge_rejection', code, message: code } }));
-    }
-    catch {
-        socket.destroy();
-    }
+    safeEndUpgradeSocket(socket, `HTTP/1.1 ${status} ${rejectionStatusText(status)}\r\n`
+        + 'Content-Type: application/json\r\n'
+        + 'Cache-Control: no-store\r\n'
+        + 'Connection: close\r\n'
+        + '\r\n'
+        + JSON.stringify({ error: { type: 'sks_bridge_rejection', code, message: code } }));
 }
 function writeDiagnosticHealth(req, res, input) {
     if (req.method !== 'GET')

package/dist/core/codex-lb/desktop-bridge/websocket-forward.js

@@ -107,6 +107,17 @@ const PERMANENT_UPGRADE_REFUSALS = new Set([
     'catalog_model_route_missing',
     'bridge_provider_route_unavailable',
 ]);
+export function safeEndUpgradeSocket(socket, payload) {
+    socket.on('error', () => undefined);
+    if (socket.destroyed || socket.writableEnded)
+        return;
+    try {
+        socket.end(payload);
+    }
+    catch {
+        socket.destroy();
+    }
+}
 function writeUpgradeFailure(client, error, req) {
     const code = safeBridgeErrorCode(error) || 'bridge_websocket_upstream_unavailable';
     const permanent = PERMANENT_UPGRADE_REFUSALS.has(code);
@@ -119,9 +130,7 @@ function writeUpgradeFailure(client, error, req) {
         ...(req?.url === undefined ? {} : { url: req.url }),
         status,
     });
-    if (client.destroyed)
-        return;
-    client.end(`HTTP/1.1 ${status} ${reason}\r\nContent-Type: application/json\r\nCache-Control: no-store\r\nConnection: close\r\n\r\n`
+    safeEndUpgradeSocket(client, `HTTP/1.1 ${status} ${reason}\r\nContent-Type: application/json\r\nCache-Control: no-store\r\nConnection: close\r\n\r\n`
         + JSON.stringify({ error: { type: 'sks_bridge_error', code, retryable: !permanent } }));
 }
 export async function forwardWebSocket(req, client, head, config, authenticatedLocalBaseUrl = desktopBridgeListenOrigin(config)) {

package/dist/core/hooks-runtime/official-subagent-lifecycle.js

@@ -18,6 +18,28 @@ import { MAX_LIFECYCLE_THREADS } from './subagent-skill-availability-contract.js
 import { officialSubagentEvidenceReady, terminalBlockedNarutoGate } from '../subagents/terminal-subagent-state.js';
 const SUBAGENT_LIFECYCLE_CAPTURE_FAILURE_SCHEMA = 'sks.subagent-lifecycle-capture-failure.v1';
 const MAX_SUBAGENT_LIFECYCLE_CAPTURE_FAILURES = 528;
+export const ACTIVE_OFFICIAL_WORKFLOW_IDLE_MS = 2 * 60 * 60 * 1000;
+function parseIsoMs(value) {
+    const parsed = Date.parse(String(value || ''));
+    return Number.isFinite(parsed) ? parsed : 0;
+}
+export function officialWorkflowLastActivityMs(input) {
+    const times = [
+        parseIsoMs(input.plan?.created_at),
+        parseIsoMs(input.plan?.updated_at),
+        parseIsoMs(input.plan?.wave_lifecycle?.updated_at),
+        parseIsoMs(input.plan?.wave_lifecycle?.created_at),
+        parseIsoMs(input.gate?.updated_at),
+        parseIsoMs(input.gate?.created_at),
+        ...(input.events || []).map((event) => parseIsoMs(event.occurred_at ?? event.ts))
+    ];
+    return times.reduce((max, value) => (value > max ? value : max), 0);
+}
+export function officialWorkflowIsIdle(activityMs, nowMs = Date.now()) {
+    if (activityMs <= 0)
+        return true;
+    return nowMs - activityMs > ACTIVE_OFFICIAL_WORKFLOW_IDLE_MS;
+}
 export async function inspectActiveOfficialSubagentWorkflow(root, state, sessionKey = null) {
     const missionId = String(state?.mission_id || '').trim();
     const workflowRunId = String(state?.official_subagent_run_id || '').trim();
@@ -71,8 +93,14 @@ export async function inspectActiveOfficialSubagentWorkflow(root, state, session
             if (events.length > 0 && openThreads !== liveThreads.size) {
                 return { status: 'invalid', missionId, workflowRunId, reason: 'active_lifecycle_event_mismatch' };
             }
+            if (officialWorkflowIsIdle(officialWorkflowLastActivityMs({ plan, gate, events }))) {
+                return { status: 'inactive' };
+            }
             return { status: 'active', missionId, workflowRunId, openThreads };
         }
+        if (officialWorkflowIsIdle(officialWorkflowLastActivityMs({ plan, gate, events }))) {
+            return { status: 'inactive' };
+        }
         return { status: 'active', missionId, workflowRunId, openThreads: liveThreads.size };
     }
     catch {

package/dist/core/hooks-runtime.js

@@ -2,7 +2,7 @@ import fsp from 'node:fs/promises';
 import path from 'node:path';
 import { projectRoot, readJson, writeJsonAtomic, writeTextAtomic, appendJsonl, nowIso, sha256, packageRoot } from './fsx.js';
 import { looksInteractiveCommand, interactiveCommandReason } from './no-question-guard.js';
-import { loadStateForSession, missionDir, sessionStateKey, setCurrent, stateFileForSession } from './mission.js';
+import { loadOwnedRouteState, missionDir, sessionStateKey, setCurrent, stateFileForSession } from './mission.js';
 import { checkDbOperation, dbBlockReason, handleMadSksUserConfirmation } from './db-safety.js';
 import { maybeRecordMadSksSqlPlaneToolResultFromToolUse } from './mad-sks/sql-plane/result-lifecycle.js';
 import { checkHarnessModification, harnessGuardBlockReason, isHarnessSourceProject } from './harness-guard.js';
@@ -53,7 +53,7 @@ export { selftestCodexCommitHooks } from './hooks-runtime/codex-commit-hooks-sel
 async function loadState(root, payload = {}) {
     const sessionKey = conversationId(payload);
     if (!explicitConversationId(payload))
-        return loadStateForSession(root, sessionKey);
+        return loadOwnedRouteState(root);
     const hashed = sessionStateKey(sessionKey);
     const sessionState = await readJson(stateFileForSession(root, sessionKey), null).catch(() => null);
     return sessionState ? { ...sessionState, _session_key: sessionState._session_key || hashed } : {};

package/dist/core/init/skills.js

@@ -228,6 +228,12 @@ export async function installProjectSkills(root) {
 export async function installSkills(root) {
     return installGlobalSkills(root);
 }
+function hostExtraRemovedSkillTargets(home) {
+    return [
+        { scope: 'global-host-extra', ownerRoot: home, targetDir: path.join(home, '.cursor', 'skills'), managedOnly: true },
+        { scope: 'global-host-extra', ownerRoot: home, targetDir: path.join(home, '.claude', 'skills'), managedOnly: true },
+    ];
+}
 export async function cleanupRemovedSksSkillResidue(opts) {
     const projectRoot = path.resolve(opts.root);
     const home = path.resolve(opts.home || os.homedir());
@@ -238,7 +244,8 @@ export async function cleanupRemovedSksSkillResidue(opts) {
         { scope: 'project', ownerRoot: projectRoot, targetDir: path.join(projectRoot, '.agents', 'skills') },
         { scope: 'project-codex', ownerRoot: projectRoot, targetDir: path.join(projectRoot, '.codex', 'skills') },
         { scope: 'global-runtime', ownerRoot: globalRuntimeRoot, targetDir: path.join(globalRuntimeRoot, '.agents', 'skills') },
-        { scope: 'global-runtime-codex', ownerRoot: globalRuntimeRoot, targetDir: path.join(globalRuntimeRoot, '.codex', 'skills') }
+        { scope: 'global-runtime-codex', ownerRoot: globalRuntimeRoot, targetDir: path.join(globalRuntimeRoot, '.codex', 'skills') },
+        ...hostExtraRemovedSkillTargets(home),
     ];
     if (projectRoot !== home && projectRoot !== globalRuntimeRoot) {
         const scan = await collectNestedProjectRoots(projectRoot, new Set([home, globalRuntimeRoot]));
@@ -365,6 +372,8 @@ async function reconcileRemovedSkillTargets(targets, fix) {
                 remaining.push(displayPath);
                 continue;
             }
+            if (!managed && target.managedOnly)
+                continue;
             detected.push({
                 scope: target.scope,
                 name,
@@ -394,7 +403,7 @@ async function reconcileRemovedSkillTargets(targets, fix) {
             quarantinedManifestCollisions,
             remaining,
             errors
-        });
+        }, { managedOnly: target.managedOnly === true });
         if (fix)
             await removeEmptySkillParents(target, errors);
     }
@@ -448,7 +457,7 @@ async function removeEmptySkillParents(target, errors) {
         }
     }
 }
-async function reconcileRemovedSkillManifests(target, rowByName, fix, report) {
+async function reconcileRemovedSkillManifests(target, rowByName, fix, report, opts = {}) {
     for (const fileName of [SKS_SKILL_MANIFEST_FILE, 'skills-manifest.json']) {
         if (!rowByName.has(fileName))
             continue;
@@ -466,6 +475,8 @@ async function reconcileRemovedSkillManifests(target, rowByName, fix, report) {
         if (!inspection.exists)
             continue;
         if (inspection.leafSymlink || !inspection.stat?.isFile()) {
+            if (opts.managedOnly)
+                continue;
             if (fix) {
                 try {
                     await quarantineSkillDir(target.ownerRoot, manifestPath, fileName, 'removed-skill-manifest-collision');
@@ -496,6 +507,8 @@ async function reconcileRemovedSkillManifests(target, rowByName, fix, report) {
         catch {
             if (!manifestTextContainsRetiredJsonValue(text))
                 continue;
+            if (opts.managedOnly)
+                continue;
             if (fix) {
                 try {
                     await quarantineSkillDir(target.ownerRoot, manifestPath, fileName, 'unparseable-removed-skill-manifest-collision');
@@ -514,6 +527,8 @@ async function reconcileRemovedSkillManifests(target, rowByName, fix, report) {
         if (!scrubbed.valid) {
             if (!scrubbed.hasRetiredResidue)
                 continue;
+            if (opts.managedOnly)
+                continue;
             if (fix) {
                 try {
                     await quarantineSkillDir(target.ownerRoot, manifestPath, fileName, 'unmanaged-removed-skill-manifest-collision');
@@ -726,7 +741,7 @@ async function reconcileSkillsUnlocked(opts) {
             scope: 'global-runtime-codex',
             ownerRoot: globalRuntimeRoot,
             targetDir: path.join(globalRuntimeRoot, '.codex', 'skills')
-        });
+        }, ...hostExtraRemovedSkillTargets(root));
     }
     const removedResidue = await reconcileRemovedSkillTargets(removedResidueTargets, opts.fix);
     report.retired_residue = {

package/dist/core/update/update-migration-state/simple-stages.js

@@ -1,32 +1,38 @@
 import { codexHookTrustDoctor } from '../../codex-hooks/codex-hook-trust-doctor.js';
 export async function runOtherHarnessCleanupStage(root) {
-    const { scanHarnessConflicts } = await import('../../harness-conflicts.js');
+    const { cleanupOtherHarnessConflicts, scanHarnessConflicts } = await import('../../harness-conflicts.js');
     const scan = await scanHarnessConflicts(root);
-    if (scan.hard_block) {
+    if (!scan.hard_block) {
         return {
-            ok: false,
-            status: 'failed',
-            actions: ['other_harness_conflict_detected'],
-            blockers: scan.hard.map((row) => `other_harness_conflict:${row.path}`),
+            ok: true,
+            status: 'ok',
+            actions: ['other_harness_conflict_check_clean'],
+            blockers: [],
             warnings: [],
             detail: {
                 cleaned_count: 0,
-                remaining_count: scan.hard.length,
-                error_count: 0,
-                cleanup_prompt_command: 'sks conflicts cleanup --yes'
+                remaining_count: 0,
+                error_count: 0
             }
         };
     }
+    const cleanup = await cleanupOtherHarnessConflicts(root);
+    const remaining = Array.isArray(cleanup.remaining) ? cleanup.remaining : [];
+    const errors = Array.isArray(cleanup.errors) ? cleanup.errors : [];
+    const blockers = [
+        ...remaining.map((row) => `other_harness_conflict:${row.path || 'unknown'}`),
+        ...errors.map((row) => `other_harness_cleanup_failed:${row.path || 'unknown'}:${row.error || 'error'}`),
+    ];
     return {
-        ok: true,
-        status: 'ok',
-        actions: ['other_harness_conflict_check_clean'],
-        blockers: [],
+        ok: blockers.length === 0,
+        status: blockers.length ? 'failed' : 'ok',
+        actions: ['other_harness_conflicts_quarantined'],
+        blockers,
         warnings: [],
         detail: {
-            cleaned_count: 0,
-            remaining_count: 0,
-            error_count: 0
+            cleaned_count: Array.isArray(cleanup.cleaned) ? cleanup.cleaned.length : 0,
+            remaining_count: remaining.length,
+            error_count: errors.length
         }
     };
 }

package/dist/core/version.js

@@ -1 +1 @@
-export const PACKAGE_VERSION = '9.1.0';
+export const PACKAGE_VERSION = '9.1.1';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "sneakoscope",
   "displayName": "ㅅㅋㅅ",
-  "version": "9.1.0",
+  "version": "9.1.1",
   "description": "Sneakoscope Codex (`sks`) is an open-source trust layer for Codex CLI and ChatGPT Desktop. It coordinates bounded AI coding agents, records machine-verifiable evidence, preserves project memory, and blocks release claims that are not supported by current tests or artifacts. Search visibility outcomes are measured separately; SKS does not promise rankings or traffic.",
   "type": "module",
   "homepage": "https://github.com/mandarange/Sneakoscope-Codex#readme",