peaks-cli 1.4.2 → 2.0.0

package/dist/src/services/audit/enforcers/sub-agent-sid.js

@@ -0,0 +1,63 @@
+/**
+ * sub-agent-sid enforcer — dogfood of Slice 0.5 sid-naming-guard.
+ *
+ * Per L2 redesign §5.4, "sub-agent-sid" is one of the 5 P0 red lines.
+ * Slice 0.5 (Task 7) shipped `isValidSessionId` in
+ * `src/services/workspace/sid-naming-guard.ts`. This enforcer exposes the
+ * same check to the red-line audit framework, so any invalid sid under
+ * `.peaks/_sub_agents/` shows up as a backable red line in the audit.
+ */
+import { existsSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { isValidSessionId } from '../../workspace/sid-naming-guard.js';
+const SUB_AGENTS_DIR = '.peaks/_sub_agents';
+const RUNTIME_DIR = '.peaks/_runtime';
+/**
+ * Find sids under `.peaks/_sub_agents/<sid>/` that fail `isValidSessionId`.
+ * Bare forms (sid-3, unknown-sid) and date-mismatched sids all fail.
+ */
+export function findInvalidSubAgentSids(projectRoot) {
+    const subAgentsRoot = join(projectRoot, SUB_AGENTS_DIR);
+    if (!existsSync(subAgentsRoot)) {
+        return { invalid: [], valid: [], scanned: false };
+    }
+    const entries = readdirSync(subAgentsRoot, { withFileTypes: true })
+        .filter((e) => e.isDirectory())
+        .map((e) => e.name);
+    const invalid = [];
+    const valid = [];
+    for (const name of entries) {
+        if (isValidSessionId(name)) {
+            valid.push(name);
+        }
+        else {
+            invalid.push(name);
+        }
+    }
+    return { invalid, valid, scanned: true };
+}
+/**
+ * Same check, for `.peaks/_runtime/<sid>/`. Slice 0.5's clean-service
+ * already handles the sub-agents dir; the audit framework also wants to
+ * know about invalid runtime sids (which would be a different failure mode).
+ */
+export function findInvalidRuntimeSids(projectRoot) {
+    const runtimeRoot = join(projectRoot, RUNTIME_DIR);
+    if (!existsSync(runtimeRoot)) {
+        return { invalid: [], valid: [], scanned: false };
+    }
+    const entries = readdirSync(runtimeRoot, { withFileTypes: true })
+        .filter((e) => e.isDirectory())
+        .map((e) => e.name);
+    const invalid = [];
+    const valid = [];
+    for (const name of entries) {
+        if (isValidSessionId(name)) {
+            valid.push(name);
+        }
+        else {
+            invalid.push(name);
+        }
+    }
+    return { invalid, valid, scanned: true };
+}

package/dist/src/services/audit/enforcers/tech-doc-presence.d.ts

@@ -0,0 +1,28 @@
+/**
+ * tech-doc-presence enforcer — refuses `peaks request transition <rid>
+ * spec-locked` if the slice's tech-doc.md is missing.
+ *
+ * Per L2 redesign §5.4. The tech-doc is the BLOCKING artifact for the
+ * spec-locked transition. This enforcer is called from
+ * `request-transition-service.ts` BEFORE the state machine runs.
+ *
+ * The session id is resolved from the current working directory using
+ * the canonical workspace resolver (per
+ * `src-services-session-canonical-workspace-resolver.md` memory).
+ */
+export interface TechDocPresenceInput {
+    readonly projectRoot: string;
+    readonly sessionId: string;
+}
+export interface TechDocPresenceResult {
+    readonly exists: boolean;
+    readonly path: string;
+    readonly isEmpty: boolean;
+}
+export declare function checkTechDocPresence(input: TechDocPresenceInput): TechDocPresenceResult;
+/**
+ * Hard-coded error message used by `request-transition-service.ts` when
+ * the spec-locked transition is refused.
+ */
+export declare const TECH_DOC_MISSING_MESSAGE: string;
+export declare const TECH_DOC_MISSING_CODE = "TECH_DOC_MISSING";

package/dist/src/services/audit/enforcers/tech-doc-presence.js

@@ -0,0 +1,35 @@
+/**
+ * tech-doc-presence enforcer — refuses `peaks request transition <rid>
+ * spec-locked` if the slice's tech-doc.md is missing.
+ *
+ * Per L2 redesign §5.4. The tech-doc is the BLOCKING artifact for the
+ * spec-locked transition. This enforcer is called from
+ * `request-transition-service.ts` BEFORE the state machine runs.
+ *
+ * The session id is resolved from the current working directory using
+ * the canonical workspace resolver (per
+ * `src-services-session-canonical-workspace-resolver.md` memory).
+ */
+import { existsSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+export function checkTechDocPresence(input) {
+    const docPath = join(input.projectRoot, '.peaks/_runtime', input.sessionId, 'rd/tech-doc.md');
+    if (!existsSync(docPath)) {
+        return { exists: false, path: docPath, isEmpty: false };
+    }
+    let stat;
+    try {
+        stat = statSync(docPath);
+    }
+    catch {
+        return { exists: false, path: docPath, isEmpty: false };
+    }
+    return { exists: true, path: docPath, isEmpty: stat.size === 0 };
+}
+/**
+ * Hard-coded error message used by `request-transition-service.ts` when
+ * the spec-locked transition is refused.
+ */
+export const TECH_DOC_MISSING_MESSAGE = 'spec-locked transition requires `rd/tech-doc.md` to exist and be non-empty. ' +
+    'Run `peaks-rd` to produce the tech-doc first, then retry the transition.';
+export const TECH_DOC_MISSING_CODE = 'TECH_DOC_MISSING';

package/dist/src/services/audit/red-line-catalog-p2-a.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Red-line catalog — P2-a entries (Slice #6 L2.3).
+ *
+ * These 25 entries close the lint-style gap left by L2.1 (P0) and
+ * L2.2 (P1). Per spec §5.4, P2-a targets 25-40 lint-style red-lines
+ * for SKILL.md, references/, and openspec/. They are small,
+ * pattern-based, and reference the existing CLI surface (no new
+ * runtime dependencies).
+ *
+ * Enforcer functions live in `enforcers/lint-style-*.ts` and are
+ * wired into the audit framework via the same `enforcerRef`
+ * discovery path as the P0 / P1 entries.
+ */
+import type { RedLineCatalogEntry } from './red-line-catalog.js';
+/**
+ * The 25 P2-a entries, in stable display order. Appending to a single
+ * readonly array keeps the catalog growable: future slices (L2.4, L3.x)
+ * can spread this list into RED_LINE_CATALOG and add their own without
+ * touching this file.
+ */
+export declare const RED_LINE_CATALOG_P2_A: readonly RedLineCatalogEntry[];

package/dist/src/services/audit/red-line-catalog-p2-a.js

@@ -0,0 +1,233 @@
+/** Theme A — Section structure (5 enforcers). The section-shape and
+ *  frontmatter-shape enforcers both live in lint-style.ts (a single
+ *  file groups the small per-skill pattern scans). */
+const SECTION_HARD_CONTRACTS = {
+    id: 'rl-section-hard-contracts-001',
+    rule: 'Section structure: Hard contracts for browser/IO surface',
+    markers: ['MANDATORY', 'BLOCKING'],
+    phrases: ['hard contract', 'hard contracts for browser', 'must be read before'],
+    enforcerRef: 'src/services/audit/enforcers/lint-style.ts',
+};
+const SECTION_MANDATORY_ARTIFACT = {
+    id: 'rl-section-mandatory-artifact-001',
+    rule: 'Section structure: Mandatory per-request artifact',
+    markers: ['MANDATORY', 'BLOCKING'],
+    phrases: ['mandatory per-request artifact', 'mandatory per-slice', 'mandatory .peaks/'],
+    enforcerRef: 'src/services/audit/enforcers/lint-style.ts',
+};
+const SECTION_DEFAULT_RUNBOOK = {
+    id: 'rl-section-default-runbook-001',
+    rule: 'Section structure: Default runbook pointer',
+    markers: ['MANDATORY'],
+    phrases: ['default runbook', 'runbook is in the references', 'full runbook', '## Default runbook'],
+    enforcerRef: 'src/services/audit/enforcers/lint-style.ts',
+};
+const SECTION_GATE_INDEX = {
+    id: 'rl-section-gate-index-001',
+    rule: 'Section structure: Gate index',
+    markers: ['MANDATORY'],
+    phrases: ['gate index', 'rd gate index', 'qa gate index', 'cli-backed gates'],
+    enforcerRef: 'src/services/audit/enforcers/lint-style.ts',
+};
+const SECTION_NAMING_AXIOM = {
+    id: 'rl-section-naming-axiom-001',
+    rule: 'Section structure: Two-axis naming axiom',
+    markers: ['MANDATORY'],
+    phrases: ['two-axis naming', 'change-id', 'session-id', 'two orthogonal axes'],
+    enforcerRef: 'src/services/audit/enforcers/lint-style.ts',
+};
+/** Theme A wireframe — the "ASCII wireframe" hint from spec §5.4
+ *  line 647. The section-order enforcer in lint-style.ts checks
+ *  that the canonical sections appear in the documented order. */
+const SECTION_ORDER_WIREFRAME = {
+    id: 'rl-section-order-wireframe-001',
+    rule: 'Section structure: ASCII wireframe — sections in canonical order',
+    markers: ['MANDATORY'],
+    phrases: ['wireframe', 'section order', 'canonical order', 'ascii wireframe'],
+    enforcerRef: 'src/services/audit/enforcers/lint-style.ts',
+};
+/** Theme B — Frontmatter shape (3 enforcers). Grouped with Theme A
+ *  in lint-style.ts; the loadStrategy check is a helper
+ *  `lintReferenceLoadStrategy` that takes the references dir. */
+const FRONTMATTER_PARSEABLE = {
+    id: 'rl-frontmatter-skills-md-001',
+    rule: 'Frontmatter shape: skills_md parseable frontmatter',
+    markers: ['MANDATORY'],
+    phrases: ['frontmatter', 'parseable', 'name: peaks-', 'description:'],
+    enforcerRef: 'src/services/audit/enforcers/lint-style.ts',
+};
+const FRONTMATTER_REFERENCES_LOAD_STRATEGY = {
+    id: 'rl-frontmatter-references-load-strategy-001',
+    rule: 'Frontmatter shape: references loadStrategy declared',
+    markers: ['MANDATORY'],
+    phrases: ['loadstrategy', 'load-strategy', 'always | on-demand'],
+    enforcerRef: 'src/services/audit/enforcers/lint-style.ts',
+};
+const FRONTMATTER_APPLICABLE_TASK_LEVELS = {
+    id: 'rl-frontmatter-applicable-task-levels-001',
+    rule: 'Frontmatter shape: skill applicable task levels',
+    markers: ['MANDATORY'],
+    phrases: ['applicabletasklevels', 'task levels invoke', 'applies to'],
+    enforcerRef: 'src/services/audit/enforcers/lint-style.ts',
+};
+/** Theme C — Output style (3 enforcers) */
+const OUTPUT_STYLE_STATUS_HEADER = {
+    id: 'rl-output-style-status-header-001',
+    rule: 'Output style: Peaks-Cli status header on every response',
+    markers: ['MANDATORY'],
+    phrases: ['peaks-cli skill:', 'peaks-cli gate:', 'peaks-cli next:', 'status header'],
+    enforcerRef: 'src/services/audit/enforcers/lint-output-style.ts',
+};
+const OUTPUT_STYLE_NO_FLUFF = {
+    id: 'rl-output-style-no-fluff-001',
+    rule: 'Output style: no greeting / persona fluff in SKILL.md',
+    markers: ['MUST NOT'],
+    phrases: ['你好,', '你好!', 'hello, i am', 'i am a', '作为一个', '我是'],
+    enforcerRef: 'src/services/audit/enforcers/lint-output-style.ts',
+};
+const OUTPUT_STYLE_NO_CLOSING_PROMPT = {
+    id: 'rl-output-style-no-closing-prompt-001',
+    rule: 'Output style: no closing-prompt flattery',
+    markers: ['MUST NOT'],
+    phrases: ['let me know if', '如有任何需要', '如有需要', 'feel free to ask', 'do not hesitate'],
+    enforcerRef: 'src/services/audit/enforcers/lint-output-style.ts',
+};
+/** Theme D — CLI-back gaps (4 enforcers) */
+const CLI_BACK_MANDATORY_TEXT = {
+    id: 'rl-cli-back-mandatory-text-001',
+    rule: 'CLI-back: MANDATORY text has peaks * enforcer in the surrounding ±2 lines',
+    markers: ['MANDATORY'],
+    phrases: ['mandatory', 'mandatory peaks', 'cli-enforced-by', 'enforced by peaks'],
+    enforcerRef: 'src/services/audit/enforcers/lint-cli-back.ts',
+};
+const CLI_BACK_NO_ORPHAN_BLOCKING = {
+    id: 'rl-cli-back-no-orphan-blocking-001',
+    rule: 'CLI-back: no orphan BLOCKING marker without a peaks * enforcer',
+    markers: ['BLOCKING'],
+    phrases: ['blocking', 'blocking peaks', 'blocking gate'],
+    enforcerRef: 'src/services/audit/enforcers/lint-cli-back.ts',
+};
+const CLI_BACK_NO_ORPHAN_MUST_NOT = {
+    id: 'rl-cli-back-no-orphan-must-not-001',
+    rule: 'CLI-back: no orphan MUST NOT marker without a peaks * enforcer',
+    markers: ['MUST NOT'],
+    phrases: ['must not', 'must not peaks', 'must not be'],
+    enforcerRef: 'src/services/audit/enforcers/lint-cli-back.ts',
+};
+const CLI_BACK_PROSE_ONLY_THRESHOLD = {
+    id: 'rl-cli-back-prose-only-threshold-001',
+    rule: 'CLI-back: prose-only ratio must stay ≤ 5%',
+    markers: ['MANDATORY'],
+    phrases: ['prose-only', 'prose only', 'prose-only ratio', 'prose-only threshold'],
+    enforcerRef: 'src/services/audit/enforcers/lint-cli-back.ts',
+};
+/** Theme E — Reference integrity (4 enforcers) */
+const REF_PATH_RESOLVES = {
+    id: 'rl-ref-path-resolves-001',
+    rule: 'Reference integrity: every references/<file>.md link resolves',
+    markers: ['MANDATORY'],
+    phrases: ['see references/', 'see `references/', 'see the references file', '→ see'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-integrity.ts',
+};
+const REF_NO_BROKEN_MKDIR = {
+    id: 'rl-ref-no-broken-mkdir-001',
+    rule: 'Reference integrity: no `mkdir -p` outside the project root',
+    markers: ['MUST NOT'],
+    phrases: ['mkdir -p', 'mkdir -p /', 'mkdir outside', 'mkdir the'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-integrity.ts',
+};
+const REF_NO_PWD_SYMLINK_JUMPS = {
+    id: 'rl-ref-no-pwd-symlink-jumps-001',
+    rule: 'Reference integrity: no `cd ..` chain jumping outside the project',
+    markers: ['MUST NOT'],
+    phrases: ['cd ..', 'cd ../..', 'cd ../../..', 'cd outside the project'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-integrity.ts',
+};
+const REF_NO_RELATIVE_ARCHIVE_PATHS = {
+    id: 'rl-ref-no-relative-archive-paths-001',
+    rule: 'Reference integrity: no `cp`/`mv`/`ln` to absolute /tmp paths',
+    markers: ['MUST NOT'],
+    phrases: ['cp /tmp', 'mv /tmp', 'ln /tmp', 'cp -r /tmp', 'do not use /tmp'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-integrity.ts',
+};
+/** Theme F — Workflow-bound shape (4 enforcers) */
+const OPENSPEC_PROPOSAL_HAS_AC_BULLETS = {
+    id: 'rl-openspec-proposal-has-acceptance-bullets-001',
+    rule: 'Workflow: openspec proposal has non-empty Acceptance Criteria bullets',
+    markers: ['MANDATORY'],
+    phrases: ['acceptance criteria', 'a1 —', 'a2 —', '## acceptance criteria'],
+    enforcerRef: 'src/services/audit/enforcers/lint-workflow-shape.ts',
+};
+const OPENSPEC_PROPOSAL_HAS_SPEC_CHANGES = {
+    id: 'rl-openspec-proposal-has-spec-changes-001',
+    rule: 'Workflow: openspec proposal has Spec reference (canonical) link',
+    markers: ['MANDATORY'],
+    phrases: ['spec reference (canonical)', 'spec reference', 'see the spec'],
+    enforcerRef: 'src/services/audit/enforcers/lint-workflow-shape.ts',
+};
+const TECH_DOC_PRESENCE_PRE_RD = {
+    id: 'rl-tech-doc-presence-pre-rd-001',
+    rule: 'Workflow: rd/tech-doc.md has Red-line scope + Implementation evidence',
+    markers: ['MANDATORY'],
+    phrases: ['red-line scope', 'implementation evidence', '## red-line scope', '## implementation evidence'],
+    enforcerRef: 'src/services/audit/enforcers/lint-workflow-shape.ts',
+};
+const PEAKS_DOCTOR_SKILL_ACKNOWLEDGED = {
+    id: 'rl-peaks-doctor-skill-acknowledged-001',
+    rule: 'Workflow: skill that writes a request artifact acknowledges peaks doctor',
+    markers: ['MANDATORY'],
+    phrases: ['peaks doctor', 'peaks-doctor', 'doctor scan', 'doctor route'],
+    enforcerRef: 'src/services/audit/enforcers/lint-workflow-shape.ts',
+};
+/** Theme G — Catalog governance (2 enforcers). The catalog-size
+ *  enforcer was already planned; the prose-only-ratio enforcer is
+ *  the partner check that flags when the catalog has too many
+ *  prose-only entries (i.e. when CLI-back coverage is regressing). */
+const CATALOG_TOTAL_LE_45 = {
+    id: 'rl-catalog-total-001',
+    rule: 'Catalog governance: catalog size must grow to ≥ 40 (L2.3 P2-a target)',
+    markers: ['MANDATORY'],
+    phrases: ['total red lines', 'totalredlines', 'catalog size', 'catalog grows'],
+    enforcerRef: 'src/services/audit/enforcers/lint-catalog-governance.ts',
+};
+const CATALOG_PROSE_ONLY_RATIO = {
+    id: 'rl-catalog-prose-only-ratio-001',
+    rule: 'Catalog governance: prose-only ratio must stay ≤ 5% (per §10.2 L2 acceptance)',
+    markers: ['MANDATORY'],
+    phrases: ['prose-only ratio', 'prose-only threshold', 'prose-only ≤ 5%', 'prose-only < 10%'],
+    enforcerRef: 'src/services/audit/enforcers/lint-catalog-governance.ts',
+};
+/**
+ * The 25 P2-a entries, in stable display order. Appending to a single
+ * readonly array keeps the catalog growable: future slices (L2.4, L3.x)
+ * can spread this list into RED_LINE_CATALOG and add their own without
+ * touching this file.
+ */
+export const RED_LINE_CATALOG_P2_A = [
+    SECTION_HARD_CONTRACTS,
+    SECTION_MANDATORY_ARTIFACT,
+    SECTION_DEFAULT_RUNBOOK,
+    SECTION_GATE_INDEX,
+    SECTION_NAMING_AXIOM,
+    SECTION_ORDER_WIREFRAME,
+    FRONTMATTER_PARSEABLE,
+    FRONTMATTER_REFERENCES_LOAD_STRATEGY,
+    FRONTMATTER_APPLICABLE_TASK_LEVELS,
+    OUTPUT_STYLE_STATUS_HEADER,
+    OUTPUT_STYLE_NO_FLUFF,
+    OUTPUT_STYLE_NO_CLOSING_PROMPT,
+    CLI_BACK_MANDATORY_TEXT,
+    CLI_BACK_NO_ORPHAN_BLOCKING,
+    CLI_BACK_NO_ORPHAN_MUST_NOT,
+    CLI_BACK_PROSE_ONLY_THRESHOLD,
+    REF_PATH_RESOLVES,
+    REF_NO_BROKEN_MKDIR,
+    REF_NO_PWD_SYMLINK_JUMPS,
+    REF_NO_RELATIVE_ARCHIVE_PATHS,
+    OPENSPEC_PROPOSAL_HAS_AC_BULLETS,
+    OPENSPEC_PROPOSAL_HAS_SPEC_CHANGES,
+    TECH_DOC_PRESENCE_PRE_RD,
+    PEAKS_DOCTOR_SKILL_ACKNOWLEDGED,
+    CATALOG_TOTAL_LE_45,
+    CATALOG_PROSE_ONLY_RATIO,
+];

package/dist/src/services/audit/red-line-catalog-p2-b.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Red-line catalog — P2-b entries (Slice #7 L2.4).
+ *
+ * These 25 entries close the references/*.md + audit-regression
+ * gap left by L2.1 (P0), L2.2 (P1), and L2.3 (P2-a). Per spec
+ * §5.4, P2-b targets 25-40 lint-style red-lines for
+ * references/*.md and the audit regression stage.
+ *
+ * Enforcer functions live in:
+ *   - enforcers/lint-reference-shape.ts (Themes H-K, M-P)
+ *   - enforcers/lint-audit-regression.ts (Theme L)
+ */
+import type { RedLineCatalogEntry } from './red-line-catalog.js';
+/**
+ * The 25 P2-b entries, in stable display order. Spread into
+ * RED_LINE_CATALOG (after P2-a's block) so future slices can
+ * append without touching this file.
+ */
+export declare const RED_LINE_CATALOG_P2_B: readonly RedLineCatalogEntry[];

package/dist/src/services/audit/red-line-catalog-p2-b.js

@@ -0,0 +1,225 @@
+/** Theme H — Reference structural shape (3 enforcers) */
+const REF_H1_TITLE_REQUIRED = {
+    id: 'rl-ref-h1-title-required-001',
+    rule: 'Reference shape: every references/*.md starts with `# <title>`',
+    markers: ['MANDATORY'],
+    phrases: ['# ', 'h1 title', 'top heading'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-shape.ts',
+};
+const REF_APPLICABLE_TASK_LEVELS = {
+    id: 'rl-ref-applicable-task-levels-declared-001',
+    rule: 'Reference shape: every references/*.md declares applicableTaskLevels',
+    markers: ['MANDATORY'],
+    phrases: ['applicable task levels', 'applies to', 'task levels:'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-shape.ts',
+};
+const REF_SEE_ALSO_SECTION = {
+    id: 'rl-ref-see-also-section-001',
+    rule: 'Reference shape: every references/*.md has a `## See also` section',
+    markers: ['MANDATORY'],
+    phrases: ['see also', 'related references', '## see also'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-shape.ts',
+};
+/** Theme I — Reference cross-references (3 enforcers) */
+const REF_CROSS_REF_RESOLVES = {
+    id: 'rl-ref-cross-ref-resolves-001',
+    rule: 'Reference integrity: every `../<file>.md` link from a reference resolves',
+    markers: ['MANDATORY'],
+    phrases: ['cross-reference', 'see also', 'see ./'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-shape.ts',
+};
+const REF_NO_SELF_REFERENCE = {
+    id: 'rl-ref-no-self-reference-001',
+    rule: 'Reference integrity: no reference file links to itself',
+    markers: ['MUST NOT'],
+    phrases: ['self reference', 'circular reference', 'recursive link'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-shape.ts',
+};
+const REF_NO_ORPHAN_LINK = {
+    id: 'rl-ref-no-orphan-link-001',
+    rule: 'Reference integrity: no link to a non-existent file or section',
+    markers: ['MUST NOT'],
+    phrases: ['orphan link', 'broken link', 'dead link'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-shape.ts',
+};
+/** Theme J — Reference size + structure (3 enforcers) */
+const REF_LINE_COUNT_LE_800 = {
+    id: 'rl-ref-line-count-le-800-001',
+    rule: 'Reference size: each reference ≤ 800 lines (Karpathy 4 原则 §2.3)',
+    markers: ['MANDATORY'],
+    phrases: ['800 lines', 'line count', 'karpathy cap', 'file size'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-shape.ts',
+};
+const REF_H2_COUNT_LE_12 = {
+    id: 'rl-ref-h2-count-le-12-001',
+    rule: 'Reference size: at most 12 `## <heading>` per reference',
+    markers: ['MANDATORY'],
+    phrases: ['h2 count', '12 h2', 'depth cap'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-shape.ts',
+};
+const REF_OVERVIEW_SECTION_NEAR_TOP = {
+    id: 'rl-ref-overview-section-near-top-001',
+    rule: 'Reference size: long references (>200 lines) must have `## Overview` within the first 30 lines',
+    markers: ['MANDATORY'],
+    phrases: ['overview section', 'top of file', '## overview'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-shape.ts',
+};
+/** Theme K — loadStrategy behavior (2 enforcers) */
+const REF_LOADSTRATEGY_ON_DEMAND_FALLBACK = {
+    id: 'rl-ref-loadstrategy-on-demand-fallback-001',
+    rule: 'loadStrategy: on-demand references must declare a fallback path',
+    markers: ['MANDATORY'],
+    phrases: ['on-demand fallback', 'fallback path', 'loadstrategy: on-demand'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-shape.ts',
+};
+const REF_LOADSTRATEGY_ALWAYS_CACHEABLE = {
+    id: 'rl-ref-loadstrategy-always-cacheable-001',
+    rule: 'loadStrategy: always references must be safe to load unconditionally',
+    markers: ['MANDATORY'],
+    phrases: ['always-cacheable', 'unconditional load', 'loadstrategy: always'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-shape.ts',
+};
+/** Theme L — Audit regression (4 enforcers) */
+const AUDIT_CATALOG_STABILITY = {
+    id: 'rl-audit-catalog-stability-001',
+    rule: 'Audit regression: catalog size has not grown > 20% in the last 90 days',
+    markers: ['MANDATORY'],
+    phrases: ['catalog stability', 'catalog growth', 'catalog drift'],
+    enforcerRef: 'src/services/audit/enforcers/lint-audit-regression.ts',
+};
+const AUDIT_NO_ORPHAN_ENFORCER = {
+    id: 'rl-audit-no-orphan-enforcer-001',
+    rule: 'Audit regression: every enforcerRef points to a real file',
+    markers: ['MUST NOT'],
+    phrases: ['orphan enforcer', 'missing enforcer file', 'enforcerref'],
+    enforcerRef: 'src/services/audit/enforcers/lint-audit-regression.ts',
+};
+const AUDIT_NO_ORPHAN_CATALOG = {
+    id: 'rl-audit-no-orphan-catalog-001',
+    rule: 'Audit regression: every catalog entry has a non-null enforcerRef (or a documented reason)',
+    markers: ['MUST NOT'],
+    phrases: ['orphan catalog', 'prose-only entry', 'enforcerref: null'],
+    enforcerRef: 'src/services/audit/enforcers/lint-audit-regression.ts',
+};
+const AUDIT_RUNTIME_BUDGET = {
+    id: 'rl-audit-runtime-budget-001',
+    rule: 'Audit regression: peaks audit red-lines completes in < 2 seconds on a 100-reference project',
+    markers: ['MANDATORY'],
+    phrases: ['runtime budget', 'audit performance', '2 second budget'],
+    enforcerRef: 'src/services/audit/enforcers/lint-audit-regression.ts',
+};
+/** Theme M — Inline shell patterns (3 enforcers) */
+const REF_NO_BASH_HEREDOC = {
+    id: 'rl-ref-no-bash-heredoc-001',
+    rule: 'Reference inline shell: no `cat <<EOF` (YAGNI for the demo skill)',
+    markers: ['MUST NOT'],
+    phrases: ['bash heredoc', 'cat <<eof', 'heredoc pattern'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-shape.ts',
+};
+const REF_NO_SUDO = {
+    id: 'rl-ref-no-sudo-001',
+    rule: 'Reference inline shell: no `sudo` (peaks-cli is user-scope)',
+    markers: ['MUST NOT'],
+    phrases: ['no sudo', 'user-scope', 'sudo command'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-shape.ts',
+};
+const REF_NO_CURL_PIPE_BASH = {
+    id: 'rl-ref-no-curl-pipe-bash-001',
+    rule: 'Reference inline shell: no `curl ... | bash` (LLM supply-chain attack vector)',
+    markers: ['MUST NOT'],
+    phrases: ['curl pipe bash', 'remote code execution', 'supply-chain'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-shape.ts',
+};
+/** Theme N — Code blocks (3 enforcers) */
+const REF_CODE_BLOCK_LANGUAGE = {
+    id: 'rl-ref-code-block-language-declared-001',
+    rule: 'Reference code blocks: every fenced block has a language tag',
+    markers: ['MANDATORY'],
+    phrases: ['fenced code block', 'language tag', 'typescript | bash | json'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-shape.ts',
+};
+const REF_NO_FAKE_PROMPT = {
+    id: 'rl-ref-no-fake-prompt-001',
+    rule: 'Reference code blocks: no `# fake prompt` / `$ fake` markers',
+    markers: ['MUST NOT'],
+    phrases: ['fake prompt', 'placeholder code', 'demo marker'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-shape.ts',
+};
+const REF_NO_ABSOLUTE_PATHS = {
+    id: 'rl-ref-no-absolute-paths-001',
+    rule: 'Reference code blocks: no `C:\\` or `/usr/local` (use peaks-cli primitives)',
+    markers: ['MUST NOT'],
+    phrases: ['absolute path', 'c:\\', '/usr/local', 'machine-specific'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-shape.ts',
+};
+/** Theme O — Permissions + numbers (2 enforcers) */
+const REF_NO_CHMOD_777 = {
+    id: 'rl-ref-no-chmod-777-001',
+    rule: 'Reference inline shell: no `chmod 777` (security red flag)',
+    markers: ['MUST NOT'],
+    phrases: ['chmod 777', 'world-writable', 'insecure permission'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-shape.ts',
+};
+const REF_NO_MAGIC_NUMBERS = {
+    id: 'rl-ref-no-magic-numbers-001',
+    rule: 'Reference code blocks: no unsigned integer ≥ 100 that is not a named constant',
+    markers: ['MUST NOT'],
+    phrases: ['magic number', 'named constant', 'hard-coded threshold'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-shape.ts',
+};
+/** Theme P — Dogfooding (2 enforcers) */
+const REF_SKILL_CITES_EVERY_EXISTING = {
+    id: 'rl-ref-skill-cites-every-existing-reference-001',
+    rule: 'Reference dogfooding: every reference file IS cited in its parent SKILL.md',
+    markers: ['MANDATORY'],
+    phrases: ['uncited reference', 'dead reference', 'reference not cited'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-shape.ts',
+};
+const REF_LOADSTRATEGY_MATCHES_SIZE = {
+    id: 'rl-ref-loadstrategy-matches-size-001',
+    rule: 'Reference dogfooding: loadStrategy matches file size (>5KB → on-demand)',
+    markers: ['MANDATORY'],
+    phrases: ['loadstrategy matches size', 'context budget', 'on-demand for large'],
+    enforcerRef: 'src/services/audit/enforcers/lint-reference-shape.ts',
+};
+/**
+ * The 25 P2-b entries, in stable display order. Spread into
+ * RED_LINE_CATALOG (after P2-a's block) so future slices can
+ * append without touching this file.
+ */
+export const RED_LINE_CATALOG_P2_B = [
+    // Theme H
+    REF_H1_TITLE_REQUIRED,
+    REF_APPLICABLE_TASK_LEVELS,
+    REF_SEE_ALSO_SECTION,
+    // Theme I
+    REF_CROSS_REF_RESOLVES,
+    REF_NO_SELF_REFERENCE,
+    REF_NO_ORPHAN_LINK,
+    // Theme J
+    REF_LINE_COUNT_LE_800,
+    REF_H2_COUNT_LE_12,
+    REF_OVERVIEW_SECTION_NEAR_TOP,
+    // Theme K
+    REF_LOADSTRATEGY_ON_DEMAND_FALLBACK,
+    REF_LOADSTRATEGY_ALWAYS_CACHEABLE,
+    // Theme L
+    AUDIT_CATALOG_STABILITY,
+    AUDIT_NO_ORPHAN_ENFORCER,
+    AUDIT_NO_ORPHAN_CATALOG,
+    AUDIT_RUNTIME_BUDGET,
+    // Theme M
+    REF_NO_BASH_HEREDOC,
+    REF_NO_SUDO,
+    REF_NO_CURL_PIPE_BASH,
+    // Theme N
+    REF_CODE_BLOCK_LANGUAGE,
+    REF_NO_FAKE_PROMPT,
+    REF_NO_ABSOLUTE_PATHS,
+    // Theme O
+    REF_NO_CHMOD_777,
+    REF_NO_MAGIC_NUMBERS,
+    // Theme P
+    REF_SKILL_CITES_EVERY_EXISTING,
+    REF_LOADSTRATEGY_MATCHES_SIZE,
+];