peaks-loop 4.0.0-beta.8 → 4.0.1

package/dist/services/vm/vm-lease.js

@@ -0,0 +1,137 @@
+/**
+ * vm-lease — pure-function lease store for `peaks vm spawn`.
+ *
+ * Slice 2026-07-29-worktree-l2-extended Part 35 (L4 VM runtime).
+ * Parallels the design of `worktree-lease.ts` (Part 1) and
+ * `container-lease.ts` (Part 12). The L4 VM isolation mode
+ * (`--isolation vm` in dispatch) needs its own lease surface
+ * so the PreToolUse gate can grant `docker`-class operations
+ * to sub-agents that own a VM lease.
+ *
+ * Hypervisor support:
+ *   - kvm:     virsh create + virsh destroy (Linux KVM via libvirt)
+ *   - hyperkit: hvftool create + hvftool stop (macOS HyperKit)
+ *   - hyperv:  hvc create + hvc stop (Windows Hyper-V via the
+ *     Hyper-V cmdlets; the operator wires the entry shim)
+ *
+ * Each hypervisor has its own spawn pattern; the lease file
+ * records which hypervisor was used so `peaks vm release`
+ * can dispatch to the right cleanup command.
+ */
+import { randomBytes } from 'node:crypto';
+import { posix as path } from 'node:path';
+export const VM_HYPERVISORS = Object.freeze([
+    'kvm', 'hyperkit', 'hyperv'
+]);
+export const DEFAULT_TTL_BY_ROLE = Object.freeze({
+    rd: 30 * 60 * 1_000,
+    qa: 15 * 60 * 1_000,
+    ui: 60 * 60 * 1_000,
+    sc: 30 * 60 * 1_000,
+    prd: 15 * 60 * 1_000,
+    general: 30 * 60 * 1_000
+});
+export const DEFAULT_TTL_MS = DEFAULT_TTL_BY_ROLE.rd;
+export const DEFAULT_VM_IMAGE = 'peaks-base:22-slim';
+export function vmLeaseStoreDir(sessionRuntimeDir) {
+    return joinPath(sessionRuntimeDir, 'vm-leases');
+}
+export function vmLeaseFilePath(sessionRuntimeDir, leaseId) {
+    return joinPath(vmLeaseStoreDir(sessionRuntimeDir), `${leaseId}.json`);
+}
+export function generateVmLeaseId() {
+    return randomBytes(8).toString('hex');
+}
+export function ttlForVmRole(role) {
+    const normalized = role.toLowerCase();
+    const candidate = DEFAULT_TTL_BY_ROLE[normalized];
+    const fallback = DEFAULT_TTL_BY_ROLE['rd'] ?? 30 * 60 * 1_000;
+    return candidate ?? fallback;
+}
+export function finalizeVmLease(draft) {
+    return { ...draft, status: 'active', consumedBySubAgents: [] };
+}
+export function markVmReleased(lease) {
+    return { ...lease, status: 'released' };
+}
+export function markVmExpired(lease) {
+    return { ...lease, status: 'expired' };
+}
+export function markVmGc(lease) {
+    return { ...lease, status: 'gc' };
+}
+export function recordVmConsumption(lease, subAgentId) {
+    if (lease.consumedBySubAgents.includes(subAgentId))
+        return lease;
+    return { ...lease, consumedBySubAgents: [...lease.consumedBySubAgents, subAgentId] };
+}
+export function isVmLeaseActive(lease, now = Date.now()) {
+    return lease.status === 'active' && lease.expiresAt > now;
+}
+export function serializeVmLease(lease) {
+    return JSON.stringify(lease, null, 2) + '\n';
+}
+export function deserializeVmLease(raw) {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== 'object' || parsed === null) {
+        throw new Error('vm lease file must contain a JSON object');
+    }
+    const obj = parsed;
+    const required = [
+        'leaseId', 'rid', 'role', 'path', 'hypervisor', 'image', 'vmId',
+        'createdAt', 'expiresAt', 'purpose', 'status', 'consumedBySubAgents'
+    ];
+    for (const k of required) {
+        if (!(k in obj))
+            throw new Error(`vm lease missing field: ${k}`);
+    }
+    if (!VM_HYPERVISORS.includes(obj.hypervisor)) {
+        throw new Error(`vm lease hypervisor invalid: ${String(obj.hypervisor)}`);
+    }
+    if (typeof obj.leaseId !== 'string')
+        throw new Error('leaseId missing');
+    if (typeof obj.rid !== 'string')
+        throw new Error('rid missing');
+    if (typeof obj.role !== 'string')
+        throw new Error('role missing');
+    if (typeof obj.path !== 'string')
+        throw new Error('path missing');
+    if (typeof obj.image !== 'string')
+        throw new Error('image missing');
+    if (typeof obj.vmId !== 'string')
+        throw new Error('vmId missing');
+    if (typeof obj.createdAt !== 'number')
+        throw new Error('createdAt missing');
+    if (typeof obj.expiresAt !== 'number')
+        throw new Error('expiresAt missing');
+    if (typeof obj.purpose !== 'string')
+        throw new Error('purpose missing');
+    if (typeof obj.status !== 'string')
+        throw new Error('status missing');
+    if (!Array.isArray(obj.consumedBySubAgents))
+        throw new Error('consumedBySubAgents missing');
+    return {
+        leaseId: obj.leaseId,
+        rid: obj.rid,
+        role: obj.role,
+        path: obj.path,
+        hypervisor: obj.hypervisor,
+        image: obj.image,
+        vmId: obj.vmId,
+        createdAt: obj.createdAt,
+        expiresAt: obj.expiresAt,
+        purpose: obj.purpose,
+        status: obj.status,
+        consumedBySubAgents: obj.consumedBySubAgents
+    };
+}
+function joinPath(...segments) {
+    if (segments.length === 0)
+        return '';
+    const normalized = segments.map((s) => s.replace(/\\/g, '/'));
+    let acc = normalized[0];
+    for (let i = 1; i < normalized.length; i++) {
+        acc = path.join(acc, normalized[i]);
+    }
+    return acc;
+}

package/dist/services/workflow/artifact-paths.d.ts

@@ -0,0 +1,59 @@
+/** File name (with `<rid>` suffix) for the per-request security findings delta. */
+export declare const SECURITY_FINDINGS_SUFFIXED: (rid: string) => string;
+/** File name (legacy, no `<rid>` suffix) for the security findings artifact. */
+export declare const SECURITY_FINDINGS_LEGACY = "security-findings.md";
+/** File name (with `<rid>` suffix) for the per-request performance findings delta. */
+export declare const PERFORMANCE_FINDINGS_SUFFIXED: (rid: string) => string;
+/** File name (legacy, no `<rid>` suffix) for the performance findings artifact. */
+export declare const PERFORMANCE_FINDINGS_LEGACY = "performance-findings.md";
+export interface ResolveFindingsPathResult {
+    /** The resolved absolute path (suffixed preferred, legacy fallback). */
+    readonly path: string;
+    /** `'suffixed' | 'legacy' | 'legacy-redirect'` — useful for Gate C warnings. */
+    readonly form: 'suffixed' | 'legacy' | 'legacy-redirect';
+    /** When the consumer was redirected from a legacy to a suffixed path, the
+     * original legacy path. Otherwise null. */
+    readonly redirectedFrom: string | null;
+    /** The rid that was used to resolve the suffixed path, if any. */
+    readonly rid: string | null;
+}
+/**
+ * Resolve the security-findings artifact path. Preferred form is the
+ * `<rid>`-suffixed path; legacy non-suffixed path is accepted as a
+ * 1-minor-release back-compat fallback.
+ *
+ * When `rid` is provided and the suffixed form is missing, the legacy
+ * form is reported (NOT the suffixed path) so the caller can decide to
+ * log a warning. When `rid` is undefined, the legacy form is the
+ * canonical target.
+ */
+export declare function resolveSecurityFindingsPath(args: {
+    projectRoot: string;
+    sessionId: string;
+    rid?: string;
+}): ResolveFindingsPathResult;
+/** Resolve the performance-findings artifact path (mirror of `resolveSecurityFindingsPath`). */
+export declare function resolvePerformanceFindingsPath(args: {
+    projectRoot: string;
+    sessionId: string;
+    rid?: string;
+}): ResolveFindingsPathResult;
+/**
+ * Lazy migration: rename a legacy non-suffixed QA artifact to the
+ * suffixed form for the given rid. Idempotent — re-running is a no-op
+ * once the suffixed form exists.
+ *
+ * Returns the resulting path. Callers (Gate C in `pipeline-verify-service.ts`)
+ * log a warning when the legacy form is the one consumed.
+ */
+export declare function lazyMigrateLegacyFindings(args: {
+    projectRoot: string;
+    sessionId: string;
+    rid: string;
+    base: 'security-findings' | 'performance-findings';
+    legacyFile: string;
+    suffixedFile: (rid: string) => string;
+}): {
+    renamed: boolean;
+    path: string;
+};

package/dist/services/workflow/artifact-paths.js

@@ -0,0 +1,166 @@
+/**
+ * Cross-slice artifact path resolvers (slice 025 — Security + Perf
+ * Plan/Result split).
+ *
+ * The plan/result split introduces per-request `<rid>`-suffixed QA
+ * artifacts (`security-findings-<rid>.md`, `performance-findings-<rid>.md`)
+ * in addition to the legacy non-suffixed form. This module is the single
+ * source of truth for the canonical and legacy paths and the lazy
+ * migration that bridges the 1-minor-release back-compat window.
+ *
+ * v2.17.0 hard-kill: the canonical QA artifact dir is the SESSION
+ * axis `.peaks/_runtime/<sessionId>/qa/`. The pre-v2.17.0 change axis
+ * `.peaks/_runtime/change/<sessionId>/qa/` is kept as a back-compat
+ * fallback for un-migrated workspaces — when consumed, the resolver
+ * tags the form `'legacy'` so Gate C can surface the deprecation
+ * warning. Same for the legacy misplaced `.peaks/<sessionId>/qa/` form.
+ */
+import { existsSync, renameSync } from 'node:fs';
+import { join } from 'node:path';
+const QA_DIR = 'qa';
+/** File name (with `<rid>` suffix) for the per-request security findings delta. */
+export const SECURITY_FINDINGS_SUFFIXED = (rid) => `security-findings-${rid}.md`;
+/** File name (legacy, no `<rid>` suffix) for the security findings artifact. */
+export const SECURITY_FINDINGS_LEGACY = 'security-findings.md';
+/** File name (with `<rid>` suffix) for the per-request performance findings delta. */
+export const PERFORMANCE_FINDINGS_SUFFIXED = (rid) => `performance-findings-${rid}.md`;
+/** File name (legacy, no `<rid>` suffix) for the performance findings artifact. */
+export const PERFORMANCE_FINDINGS_LEGACY = 'performance-findings.md';
+/** Base name (no extension) shared by both the suffixed and legacy forms. */
+const SECURITY_FINDINGS_BASE = 'security-findings';
+const PERFORMANCE_FINDINGS_BASE = 'performance-findings';
+/**
+ * v2.17.0 — canonical QA dir is the session axis
+ * `.peaks/_runtime/<sessionId>/qa/`. The pre-v2.17.0 change axis
+ * `.peaks/_runtime/change/<sessionId>/qa/` is kept as a back-compat
+ * fallback for un-migrated workspaces. The legacy misplaced
+ * `.peaks/<sessionId>/qa/` form was a pre-1.3.0 write-path bug.
+ *
+ * Slice 2026-06-29-change-id-root-removal: the legacy
+ * `peaks workspace migrate-change-scope` migration tool is gone;
+ * operators must move misplaced dirs into the canonical location
+ * by hand (or via `peaks workspace migrate`).
+ *
+ * During a 1-minor-release deprecation window the resolver falls back
+ * to the legacy paths so un-migrated workspaces still resolve. When
+ * a fallback fires, the result is tagged `'legacy'`.
+ */
+function canonicalQaDir(projectRoot, sessionId) {
+    // v2.17.0 canonical: session axis. The `<sessionId>` arg is treated
+    // as the on-disk session dir name (it equals the sessionId under
+    // the session-axis layout). Under v2.16.0 layouts the same string
+    // was the change-id dir name.
+    return join(projectRoot, '.peaks', '_runtime', sessionId, QA_DIR);
+}
+function legacyChangeAxisQaDir(projectRoot, sessionId) {
+    return join(projectRoot, '.peaks', '_runtime', 'change', sessionId, QA_DIR);
+}
+function legacyMisplacedQaDir(projectRoot, sessionId) {
+    return join(projectRoot, '.peaks', sessionId, QA_DIR);
+}
+/**
+ * Try the most-specific read first: the suffixed form. On miss, fall back
+ * to the legacy form. On legacy hit, run a one-shot lazy migration that
+ * renames the legacy file to `<base>-<rid>.md` (when the legacy body
+ * contains a recognizable rid), or leaves a 3-line redirect stub.
+ *
+ * Pure path resolver: does NOT write any new content. The lazy migration
+ * only renames an existing file; it does not invent data.
+ */
+function resolveFindingsPath(args) {
+    const qaDir = canonicalQaDir(args.projectRoot, args.sessionId);
+    if (args.rid !== undefined) {
+        const suffixedPath = join(qaDir, args.suffixedFile(args.rid));
+        if (existsSync(suffixedPath)) {
+            return { path: suffixedPath, form: 'suffixed', redirectedFrom: null, rid: args.rid };
+        }
+        // Try the v2.16.0 change-axis dir, the pre-1.3.0 misplaced
+        // `.peaks/<id>/qa/` form, and the sibling-of-`_runtime/` form.
+        // All three are migration targets handled in v2.19.0+ by
+        // manual relocation into the canonical location (the legacy
+        // `peaks workspace migrate-change-scope` CLI was removed).
+        const legacyCandidates = [
+            join(legacyChangeAxisQaDir(args.projectRoot, args.sessionId), args.suffixedFile(args.rid)),
+            join(legacyMisplacedQaDir(args.projectRoot, args.sessionId), args.suffixedFile(args.rid)),
+            join(legacyChangeAxisQaDir(args.projectRoot, args.sessionId), args.legacyFile),
+            join(legacyMisplacedQaDir(args.projectRoot, args.sessionId), args.legacyFile)
+        ];
+        for (const candidate of legacyCandidates) {
+            if (existsSync(candidate)) {
+                return {
+                    path: candidate,
+                    form: 'legacy',
+                    redirectedFrom: null,
+                    rid: args.rid
+                };
+            }
+        }
+        // No file present; report the would-be suffixed path so the caller can
+        // surface it in error messages.
+        return { path: suffixedPath, form: 'suffixed', redirectedFrom: null, rid: args.rid };
+    }
+    // rid is undefined — caller wants the legacy single-file form.
+    const legacyPath = join(qaDir, args.legacyFile);
+    if (existsSync(legacyPath)) {
+        return { path: legacyPath, form: 'legacy', redirectedFrom: null, rid: null };
+    }
+    return { path: legacyPath, form: 'legacy', redirectedFrom: null, rid: null };
+}
+/**
+ * Resolve the security-findings artifact path. Preferred form is the
+ * `<rid>`-suffixed path; legacy non-suffixed path is accepted as a
+ * 1-minor-release back-compat fallback.
+ *
+ * When `rid` is provided and the suffixed form is missing, the legacy
+ * form is reported (NOT the suffixed path) so the caller can decide to
+ * log a warning. When `rid` is undefined, the legacy form is the
+ * canonical target.
+ */
+export function resolveSecurityFindingsPath(args) {
+    return resolveFindingsPath({
+        projectRoot: args.projectRoot,
+        sessionId: args.sessionId,
+        ...(args.rid !== undefined ? { rid: args.rid } : {}),
+        base: SECURITY_FINDINGS_BASE,
+        legacyFile: SECURITY_FINDINGS_LEGACY,
+        suffixedFile: SECURITY_FINDINGS_SUFFIXED
+    });
+}
+/** Resolve the performance-findings artifact path (mirror of `resolveSecurityFindingsPath`). */
+export function resolvePerformanceFindingsPath(args) {
+    return resolveFindingsPath({
+        projectRoot: args.projectRoot,
+        sessionId: args.sessionId,
+        ...(args.rid !== undefined ? { rid: args.rid } : {}),
+        base: PERFORMANCE_FINDINGS_BASE,
+        legacyFile: PERFORMANCE_FINDINGS_LEGACY,
+        suffixedFile: PERFORMANCE_FINDINGS_SUFFIXED
+    });
+}
+/**
+ * Lazy migration: rename a legacy non-suffixed QA artifact to the
+ * suffixed form for the given rid. Idempotent — re-running is a no-op
+ * once the suffixed form exists.
+ *
+ * Returns the resulting path. Callers (Gate C in `pipeline-verify-service.ts`)
+ * log a warning when the legacy form is the one consumed.
+ */
+export function lazyMigrateLegacyFindings(args) {
+    // Slice 2026-06-28: lazy migration operates on the canonical QA dir.
+    const qaDir = canonicalQaDir(args.projectRoot, args.sessionId);
+    const legacyPath = join(qaDir, args.legacyFile);
+    const suffixedPath = join(qaDir, args.suffixedFile(args.rid));
+    if (!existsSync(legacyPath)) {
+        return { renamed: false, path: suffixedPath };
+    }
+    if (existsSync(suffixedPath)) {
+        return { renamed: false, path: suffixedPath };
+    }
+    try {
+        renameSync(legacyPath, suffixedPath);
+        return { renamed: true, path: suffixedPath };
+    }
+    catch {
+        return { renamed: false, path: legacyPath };
+    }
+}

package/dist/services/workflow/autonomous-resume-writer.d.ts

@@ -0,0 +1,16 @@
+export type AutonomousResumeWriteRequest = {
+    readonly sessionId: string;
+    readonly goal: string;
+    readonly artifactWorkspacePath: string;
+    readonly apply?: boolean;
+    readonly clock?: () => string;
+};
+export type AutonomousResumeArtifactFile = {
+    readonly path: string;
+    readonly content: string;
+};
+export type AutonomousResumeWriteResult = {
+    readonly applied: boolean;
+    readonly files: readonly AutonomousResumeArtifactFile[];
+};
+export declare function writeAutonomousResumeArtifacts(request: AutonomousResumeWriteRequest): Promise<AutonomousResumeWriteResult>;

package/dist/services/workflow/autonomous-resume-writer.js

@@ -0,0 +1,170 @@
+import { mkdir, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { getSessionDir } from '../session/getSessionDir.js';
+import { pathExists } from 'peaks-loop-shared/fs';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
+function defaultClock() {
+    return new Date().toISOString();
+}
+function normalizeGoal(goal) {
+    const trimmed = goal.trim();
+    if (!trimmed) {
+        throw new Error('Goal must be non-empty');
+    }
+    return trimmed;
+}
+function renderGoalPackage(sessionId, goal) {
+    return `${JSON.stringify({
+        sessionId,
+        artifactType: 'goal-package',
+        status: 'ready',
+        goal,
+        doneCondition: `Autonomous plan for ${sessionId} is complete when all acceptance criteria pass, the worker queue is empty or blocked with next actions, and validation evidence is recorded.`,
+        resumeCondition: `Resume ${sessionId} only after checkpoint artifacts, worker queue state, and validation evidence requirements have been verified.`,
+        acceptanceCriteria: [
+            'A resumable autonomous RD plan exists with checkpoints, worker queue, and validation evidence requirements.',
+            'Curated capabilities from docs/accessRepo.md and docs/mcpServer.md are considered before custom implementation.',
+            'Resume after compact verifies checkpoints and evidence before continuing.',
+            'All execution remains dry-run until explicitly approved.'
+        ]
+    }, null, 2)}\n`;
+}
+function renderRdPlan(sessionId) {
+    return `${JSON.stringify({
+        sessionId,
+        artifactType: 'rd-plan',
+        status: 'ready',
+        workerQueueStatus: 'ready',
+        taskCount: 1,
+        reducerRequired: true
+    }, null, 2)}\n`;
+}
+function renderCheckpoint(sessionId, createdAt) {
+    return `${JSON.stringify({
+        sessionId,
+        artifactType: 'checkpoint',
+        status: 'ready',
+        checkpointId: 'checkpoint-1',
+        createdAt,
+        workerQueueState: {},
+        validationRefs: ['unit-tests.md']
+    }, null, 2)}\n`;
+}
+function renderValidationReport(sessionId) {
+    return `---
+sessionId: ${sessionId}
+artifactType: validation-report
+status: passed
+---
+
+Validation summary:
+
+- Resume artifact scaffold generated for ${sessionId}.
+
+Checks:
+
+- unit-tests
+
+Result: passed
+
+Evidence refs:
+
+- unit-tests.md
+`;
+}
+function renderUnitTestsEvidence(sessionId) {
+    return `# unit-tests evidence for ${sessionId}
+
+Replace this stub with the real test command, output, and coverage delta. The autonomous resume validator only requires this file to exist and be a safe markdown name listed in checkpoint-1.json validationRefs.
+`;
+}
+function renderResumeInstructions(sessionId) {
+    return `---
+sessionId: ${sessionId}
+artifactType: resume-instructions
+status: passed
+---
+
+Resume steps:
+
+- Read autonomous-goal-package.json and confirm acceptance criteria.
+- Read autonomous-rd-plan.json and reconcile worker queue with current diff.
+- Read checkpoint-1.json and verify worker queue state matches what is on disk.
+- Read evidence/*.md referenced by checkpoint validationRefs and confirm Result: passed.
+
+Preconditions:
+
+- Artifact workspace is local and matches sessionId ${sessionId}.
+- No destructive --apply has run without explicit authorization.
+
+Blocked actions:
+
+- Resume cannot proceed if checkpoint validationRefs or evidence files are missing or invalid.
+
+Next actions:
+
+- Run peaks workflow autonomous --change-id ${sessionId} --goal "<goal>" --json to recompute the plan.
+- Compare blockedReasons; resolve before reattempting resume.
+`;
+}
+function buildFiles(sessionId, goal, createdAt, artifactWorkspacePath) {
+    // Slice 2026-06-29-change-id-root-removal: route every reviewable
+    // artifact under the session-axis dir at `.peaks/_runtime/<sid>/...`
+    // via `getSessionDir`. The change-id identifier is reused as the
+    // session-dir name (per-execution scope). The gitignore rule on
+    // `.peaks/_runtime/` covers the path; the reviewable-vs-ephemeral
+    // split is preserved.
+    const scopeRoot = getSessionDir(artifactWorkspacePath, sessionId);
+    return [
+        {
+            path: join(scopeRoot, 'prd', 'autonomous-goal-package.json'),
+            content: renderGoalPackage(sessionId, goal)
+        },
+        {
+            path: join(scopeRoot, 'rd', 'swarm', 'autonomous-rd-plan.json'),
+            content: renderRdPlan(sessionId)
+        },
+        {
+            path: join(scopeRoot, 'rd', 'swarm', 'checkpoints', 'checkpoint-1.json'),
+            content: renderCheckpoint(sessionId, createdAt)
+        },
+        {
+            path: join(scopeRoot, 'rd', 'swarm', 'evidence', 'unit-tests.md'),
+            content: renderUnitTestsEvidence(sessionId)
+        },
+        {
+            path: join(scopeRoot, 'rd', 'swarm', 'evidence', 'validation-report.md'),
+            content: renderValidationReport(sessionId)
+        },
+        {
+            path: join(scopeRoot, 'rd', 'swarm', 'resume-instructions.md'),
+            content: renderResumeInstructions(sessionId)
+        }
+    ];
+}
+export async function writeAutonomousResumeArtifacts(request) {
+    // Slice 2026-06-29-change-id-root-removal: change-id is metadata-only;
+    // structural validation for the session id is a path-safety check
+    // (no path-traversal / no absolute path) so unsafe ids never escape
+    // the canonical `.peaks/_runtime/<sid>/` scope.
+    if (isUnsafePathInput(request.sessionId)) {
+        throw new Error(`Refusing to write: session id '${request.sessionId}' is unsafe (path-traversal, absolute, or otherwise malformed).`);
+    }
+    const goal = normalizeGoal(request.goal);
+    const clock = request.clock ?? defaultClock;
+    const createdAt = clock();
+    const files = buildFiles(request.sessionId, goal, createdAt, request.artifactWorkspacePath);
+    if (request.apply !== true) {
+        return { applied: false, files };
+    }
+    for (const file of files) {
+        if (await pathExists(file.path)) {
+            throw new Error(`Refusing to write: ${file.path} already exists. Remove it before re-running peaks autonomous resume init --apply.`);
+        }
+    }
+    for (const file of files) {
+        await mkdir(dirname(file.path), { recursive: true });
+        await writeFile(file.path, file.content, 'utf8');
+    }
+    return { applied: true, files };
+}

package/dist/services/workflow/pipeline-verify-gate-support.d.ts

@@ -0,0 +1,47 @@
+/**
+ * peaks-workflow — internal support helpers for pipeline verification.
+ *
+ * Private helpers used by the slimmed `pipeline-verify-service.ts`
+ * orchestrator. NOT publicly re-exported; not part of the public API
+ * surface. Kept in a sibling file so the orchestrator can stay under
+ * the 400-line file-size cap (rid-006 split).
+ *
+ * File budget: ≤ 400 lines (rid-006 split).
+ */
+import type { RequestType } from '../artifacts/artifact-prerequisites.js';
+import type { PipelineGate } from './pipeline-verify-types.js';
+export declare function extractState(markdown: string): string;
+/**
+ * As of slice 2026-06-05-change-id-as-unit-of-work, the file's durable
+ * scope is the change-id (the `.peaks/_runtime/<sessionId>/` dir the file lives
+ * in), NOT the session-id. We resolve the on-disk location via
+ * `showRequestArtifact` (which scans all top-level dirs and returns the
+ * actual dir the file was found in) instead of assuming
+ * `.peaks/_runtime/<sessionId>/<role>/requests/`.
+ */
+export declare function findRequestFile(projectRoot: string, role: string, rid: string): Promise<{
+    path: string;
+    content: string;
+    sessionId: string;
+} | null>;
+export declare function rdGatesForType(requestType: RequestType): PipelineGate[];
+export declare function qaGatesForType(requestType: RequestType): PipelineGate[];
+export declare const RD_QA_HANDOFF_STATES: Set<string>;
+export declare const QA_COMPLETE_STATES: Set<string>;
+/** Tracker for canonical-path compliance (slice 2026-06-28-code-mode-bypass-fix). */
+export interface CanonicalPathTracker {
+    anyEvidenceResolved: boolean;
+    allResolvedPathsCanonical: boolean;
+}
+/** Resolve RD evidence files (tech-doc / bug-analysis / code-review / security-review)
+ *  by probing canonical + legacy paths for each gate. Mutates the gate.passed /
+ *  gate.detail fields in place and pushes violations / nextActions. Returns the
+ *  updated tracker. Verbatim-move from `pipeline-verify-service.ts`. */
+export declare function resolveRdEvidencePaths(gates: PipelineGate[], rdEvidenceDir: string, projectRoot: string, violations: string[], nextActions: string[], tracker: CanonicalPathTracker): CanonicalPathTracker;
+/** Resolve QA evidence files (test-cases / test-report / security-findings /
+ *  performance-findings) by probing canonical + legacy paths for each gate.
+ *  For security/perf findings, delegates to the artifact-paths resolver.
+ *  Mutates the gate.passed / gate.detail fields in place and pushes
+ *  violations / nextActions. Returns the updated tracker. Verbatim-move
+ *  from `pipeline-verify-service.ts`. */
+export declare function resolveQaEvidencePaths(gates: PipelineGate[], projectRoot: string, rdEvidenceDir: string, changeIdForResolver: string, rid: string, violations: string[], nextActions: string[], tracker: CanonicalPathTracker): CanonicalPathTracker;