peaks-loop 4.0.0-beta.8 → 4.0.1

package/skills/bee/peaks-rd/SKILL.md

@@ -136,30 +136,20 @@ If any gate fails, return to development for fixes or hand off as blocked. Do no
 
 ## Parallel review fan-out (v2.12.0 3-way fanout — code-reviewer + qa-test-cases-writer + karpathy-reviewer)
 
-The THREE review activities run in parallel via `peaks sub-agent dispatch <role>`, not sequentially. Sub-agents: `code-reviewer`, `qa-test-cases-writer` (writes `qa/test-cases/<rid>.md`), `karpathy-reviewer` (the **hard Karpathy-Gate**). This is the v2.12.0 3-way fanout. Feature / refactor / bugfix: all three. Config / docs / chore: no fan-out — no `karpathy-reviewer` dispatched. OCR augmentation (B3): `peaksConfig.ocr.llm` → `peaks code-review run-ocr --json` → merge into `code-review.md`; → `references/ocr-integration.md`.
+**v2.12.0 collapse (Group A — Tier 1+2+3):** the previous 5-way fan-out (slice 004 4-way + slice 5/6 `karpathy-reviewer` addition) totalled **5 sub-agents**. The `security-reviewer` and `perf-baseline-reviewer` slots moved out of the RD 3-way fan-out into two new standalone audit skills:
 
-> **v2.12.0 collapse (Group A):** the 5-way fan-out moved `security-reviewer` + `perf-baseline-reviewer` into standalone audit skills (`peaks-security-audit` + `peaks-perf-audit`). → `references/v2-12-fanout-collapse.md`.
+- `peaks-security-audit` — CLI: `peaks security-audit run`. Writes `audit/security.md` (under `.peaks/_runtime/<sessionId>/audit/security.md`). Required RD-side prereq `AUDIT_SECURITY`.
+- `peaks-perf-audit` — CLI: `peaks perf-audit run`. Writes `audit/perf.md` (under `.peaks/_runtime/<sessionId>/audit/perf.md`). Required RD-side prereq `AUDIT_PERF`.
 
-> **v2.15.0+:** 技术决策 AI 据 prd 业务场景块自决,user 不参与;存量项目无 UT,改 A 前跑 `peaks impact scan`(G13);fork 场景 tech-doc 列上游基线+业务 patch 集(G11)。详见 `.peaks/memory/peaks-loop-user-role-and-tech-decision.md`。
+Both audit skills consume the immutable peaks-prd handoff (`prd/handoff.md`) and the project-scoped audit templates under `.peaks/project-scan/{security-template, perf-template, audit-output-schema}.md`. The handoff presence is enforced by the `AUDIT_REQUIRES_HANDOFF` prereq. The 1-minor-release back-compat window (v2.12.0) keeps the old `rd/security-review.md` and `rd/perf-baseline.md` paths readable via `mustContainAny` — see `references/rd-fanout-contracts.md` §"Deprecated reviewer back-compat".
 
-> **Slice 2026-06-24-efficiency-4p-bundle / G4 (P1.3) — karpathy-skip policy authoritative.** Decision table at `src/services/rd/reviewer-dispatch-policy.ts` (`shouldDispatchKarpathy`, `reviewerListFor`). Pinned by `tests/unit/rd/karpathy-skip-on-config-docs-chore.test.ts`.
+**Current 3-way fan-out** (always runs for feature / refactor / bugfix; no fan-out for config / docs / chore):
 
-### Hard Karpathy-Gate (Slice 5/6)
+1. `code-reviewer` — writes `rd/code-review.md` (Gate B3).
+2. `qa-test-cases-writer` — writes `qa/test-cases/<rid>.md` (Gate C2).
+3. `karpathy-reviewer` — writes `rd/karpathy-review.md` (the **hard Karpathy-Gate**, KARPATHY_REVIEW prereq).
 
-The `karpathy-reviewer` sub-agent is a **hard gate** for `rd:qa-handoff`. Per `andrej-karpathy-skills:karpathy-guidelines` §1 Think Before Coding ("state your assumptions") + §3 Surgical Changes ("touch only what the user asked"), `peaks request transition --state qa-handoff` is BLOCKED by the CLI gate until `.peaks/_runtime/<sessionId>/rd/karpathy-review.md` exists with the `## Karpathy-Gate` header and at least one of the 4 guideline section markers. The file is enforced by the `KARPATHY_REVIEW` prerequisite in `src/services/artifacts/artifact-prerequisites.ts` (added in Slice 5). The escape hatch is `peaks request transition --allow-incomplete --confirm` (assisted mode). The companion `peaks scan karpathy` CLI is a structural scanner for the same file (`src/services/scan/karpathy-service.ts`); the semantic review is the sub-agent's job.
-
-### Peaks-Loop Gate C — type-specific RD evidence
-
-The CLI gate at `rd:qa-handoff` is the authoritative check. Missing any required file → DO NOT attempt the qa-handoff transition; CLI will reject with `PREREQUISITES_MISSING`.
-
-| Request type | Required RD evidence |
-|---|---|
-| feature / refactor | `audit/security.md` + `audit/perf.md` + `rd/code-review.md` + `rd/karpathy-review.md` + `qa/test-cases/<rid>.md` + `prd/handoff.md` |
-| bugfix | `audit/security.md` + `audit/perf.md` (perf-shaped only) + `rd/code-review.md` + `rd/karpathy-review.md` + `qa/test-cases/<rid>.md` + `prd/handoff.md` |
-| config | `audit/security.md` |
-| docs / chore | (no extra evidence required) |
-
-→ see `references/rd-fanout-contracts.md` for the **3** sub-agents' contracts + hard prohibitions + aggregation + degradation. Pre-v2.12.0 `rd/{security-review,perf-baseline}.md` paths remain readable for the 1-minor-release back-compat window.
+Full dispatch contract (when-to-fan-out rules, dispatch template, prereq gates) lives in **`references/parallel-review-fanout.md`**. Read that file before issuing any 3-way fan-out.
 
 ## Refactor hard gates
 
@@ -229,6 +219,12 @@ Do not bypass the parallel review fan-out when the slice has a code-review / qa-
 
 **Security / perf audit boundary (v2.12.0):** security and perf audit run as standalone audit skills (`peaks-security-audit`, `peaks-perf-audit`) whose outputs land at `audit/security.md` / `audit/perf.md`. RD does **not** dispatch `security-reviewer` or `perf-baseline-reviewer` sub-agents. See `references/rd-fanout-contracts.md` §"Deprecated reviewer back-compat".
 
+## Karpathy cost self-review (slice 2026-07-30-karpathy-cost-self-review)
+
+The `karpathy-reviewer` sub-agent now reports its own runtime cost in the JSON envelope at `rd/karpathy-review.md` (fields `evaluationCost` + `costRatio`; see `agents/karpathy-reviewer.md` §4). The **orchestrator-side** command `peaks job karpathy-cost-check --review-file <path>` reads that envelope and decides whether to downgrade a `'block'` gateAction to `'warn'` when `costRatio > 10`. **24h-mode is the override** — the check is entirely skipped when `peaks session 24h-mode state` reports `24H_ACTIVE`.
+
+The main RD loop MUST call `peaks job karpathy-cost-check` after every `peaks request transition --state qa-handoff` and before the next-slice work begins. If the decision kind is `downgraded`, the LLM MUST honor the downgraded `warn` and proceed to the next slice; the `'block'` was an artifact of the reviewer's own cost, not the slice's quality. If the decision kind is `reported` (costRatio > 50, gate not `'block'`), the LLM MAY continue; the sediment will be appended by `peaks memory extract` at handoff time. The full design lives in `.peaks/memory/2026-07-30-karpathy-evaluation-cost-self-review-design.md` (sediment locked 2026-07-30).
+
 ## Sub-agent context governance (G7 + G7.7 + G8 + G9 — slice #010)
 
 RD sub-agent prompt template MUST include the G7 path convention + G8.6 share protocol. Detailed protocol: `skills/peaks-code/references/context-governance.md` + `skills/peaks-code/references/headroom-integration.md`.
@@ -283,4 +279,17 @@ Index of every `references/` file in this skill. Read on demand.
 | `references/rd-transition-gates.md` | Per-gate A-A3-B-B9 contract. |
 | `references/refactor-workflow.md` | Refactor hard gates + required artifacts. |
 | `references/skill-presence-and-title.md` | RD skill presence (main loop only). |
-| `references/v2-12-fanout-collapse.md` | v2.12.0 fan-out collapse. |
+| `references/v2-12-fanout-collapse.md` | v2.12.0 fan-out collapse. |
+## L2 surface reference (post rid-l2-extended)
+
+For RD slices that touch the lease / dispatch / observability stack, the canonical L2 surface is the L2 ecosystem shipped 2026-07-29 (commits `33aad895` through `075321af`). The high-leverage CLIs RD slices will encounter:
+
+- `peaks worktree spawn / renew / list / gc / lease-status / release` — lease lifecycle (source of truth for L2 hook gate)
+- `peaks sub-agent dispatch --isolation worktree|container` — auto-spawns a lease; `PEAKS_WORKTREE_LEASE_ID` env var is the gate's lookup key
+- `peaks container spawn / release` — L4 container runtime (Part 12); pairs with `--isolation container` on dispatch
+- `peaks lease-metrics [--rate] [--all-sessions]` — per-kind event counts + leak-rate + lifetime stats
+- `peaks lease-stats` — project-wide summary (per-rid / per-role / per-isolation breakdown)
+- `peaks cron init / list / run` — scheduled tasks (lease-gc-daily built-in); `peaks cron-scheduler start` for daemon mode
+- `peaks audit red-lines` — 119 catalog red-lines; 66 cli-backed enforcers (sweep 003) + 53 catalog
+
+The pre-existing SKILL.md reference set (this section is additive — not a replacement) covers the LLM-flow contracts. The CLIs above are operator / dashboard surfaces.

package/skills/bee/peaks-rd/references/rd-sub-agent-dispatch.md

@@ -2,6 +2,28 @@
 
 > Body of `## Sub-agent dispatch`. When this skill is launched as a sub-agent via `peaks sub-agent dispatch <role>` (then the LLM executes the returned toolCall) from `peaks-code`, the following sections of THIS skill are **suspended** for the sub-agent run:
 
+## Superpowers chain refusal (L1 worktree governance — locked 2026-07-29)
+
+You MUST NOT follow the superpowers chain for worktree decisions:
+
+- superpowers:brainstorming → superpowers:writing-plans →
+  superpowers:subagent-driven-development → superpowers:using-git-worktrees
+
+This chain ends with `git worktree add` (superpowers:using-git-worktrees SKILL.md line 96). It bypasses peaks-loop's L2 hook gate and L3 IDE `permissions.deny`. Even when L3 denies the terminal Skill, the chain has already taught you to use raw `git worktree add`, so L3 is not sufficient.
+
+For worktree operations, use ONLY:
+
+- `peaks worktree spawn --rid <rid> --ttl <duration> --purpose <text>` (after rid-L2-extended ships)
+- until then: `peaks worktree auth grant --rid <id> --reason <text> --ttl <5m>`
+
+The superpowers skills remain available as REFERENCE material for brainstorming / planning techniques, but MUST NOT be used as a workflow. peaks-rd's own PRD/RD artifacts (`.peaks/_runtime/<sessionId>/rd/requests/<rid>.md`) are authoritative.
+
+If the upstream superpowers chain suggests raw `git worktree add`:
+
+1. STOP
+2. Re-author the plan as a peaks-rd artifact
+3. Continue with `peaks worktree spawn` (or the auth-grant fallback)
+
 ## Default `--from-dag` is mandatory (slice 2026-06-24-efficiency-4p-bundle / G2 / P0.3)
 
 > **Hard constraint**: when the swarm plan DAG has ≥ 2 leaves at the
@@ -74,6 +96,23 @@ What the sub-agent **MUST** still do, from this skill's contract:
 
 After returning, Code re-checks Gate B (`ls .peaks/_runtime/<sessionId>/rd/requests/<rid>.md` etc.) and proceeds to RD implementation, which is a different sub-agent or inline run.
 
+## G11.5 visibility contract (mandatory, slice 2026-07-28-sub-agent-visibility)
+
+Any RD/QA/SC sub-agent dispatched by `peaks sub-agent dispatch --from-dag` (or by the single-shot `dispatch <role> --prompt ...` path) MUST register an artifact path via `--write-artifact <path>` BEFORE spawning, and the orchestrator MUST surface a 1-line `⏳ Spawning sub-agent via Task tool: <description>` prose to the user BEFORE each `Agent` tool call.
+
+**Hard rules (text-locked, no skip):**
+
+1. **Artifact registration is mandatory for non-trivial RD/QA/SC sub-agents.** The dispatch CLI now exposes two new envelope fields — `artifactsPublicPaths: string[]` and `orchestratorVisibleHint: string` — that the orchestrator reads back to the user. The RD/QA/SC sub-agent MUST register the artifact path it intends to write via `--write-artifact <absolute-path>` so the envelope surfaces the path to the user before the agent actually starts. Skipping `--write-artifact` is a visibility regression: the user cannot tell what file the sub-agent will create.
+2. **Orchestrator surfaces the prose BEFORE spawning.** For every `Agent` tool call that materializes a `peaks sub-agent dispatch` envelope, the orchestrator MUST emit one visible line of prose to the user of the form `⏳ Spawning sub-agent via Task tool: <description>` where `<description>` is ≥ 6 chars and includes the rid. The line lives in the orchestrator's reply text, not in the tool result.
+3. **Fan-out keeps the line singular.** When the envelope returns `dispatchCount > 1` (i.e. `--from-dag` with N ≥ 2 leaves), the orchestrator emits the prose once for the whole batch, not N times. Per-leaf prose defeats the wall-time benefit of fan-out.
+4. **No auto-commit disclaimer survives this contract.** The same prompt template that today forbids `git commit / git push / install hooks / apply settings.json mutations` (slice 2026-06-28 incident) is unchanged. G11.5 layers ABOVE that — visibility first, hard prohibitions second.
+
+**Where the orchestrator reads the values from**: `data.orchestratorVisibleHint` (one line, copy verbatim) and `data.artifactsPublicPaths` (the public list of artifact paths the sub-agent will own). The CLI fills these in; the orchestrator just transcribes.
+
+**Regression guard**: `tests/unit/dispatch/dispatch-fanout-mandatory.test.ts` parses `rd-sub-agent-dispatch.md` and asserts the G11.5 heading is present. Do not delete the heading without updating the guard.
+
+---
+
 ## Test Tool Detection (mandatory)
 
 The dispatch CLI (`peaks sub-agent dispatch`) automatically prepends a Test Tool Detection block to every sub-agent prompt — telling the sub-agent to read `package.json#scripts.test` first and use the project-local runner (`./node_modules/.bin/<runner>` or `pnpm test -- <file>`). NEVER use `npx <runner>`. This rule is machine-injected, not a prompt ritual — every sub-agent gets it including rd/qa/ui/txt/sc.

package/skills/bee/peaks-rd/test-prompts.json

@@ -0,0 +1,12 @@
+[
+  {
+    "id": 1,
+    "prompt": "根据 peaks-prd 产出的前端待联调 delta，在 /Users/yuanyuan/Desktop/work/platform-rag-web 中实现 UI/交互/API mock。项目没有后端 swagger.json，需要先用 mock/API contract 开发。",
+    "expected": "RD 先做 standards init/update dry-run 和项目扫描；非平凡变更检查 OpenSpec；按最小 slice 实现；新增/变更代码有单测或合理 focused coverage；前端/UI slice 自测必须用 headed gstack/browse/dist/browse 有头浏览器端到端验证并记录脱敏 route/actions、脱敏 console/network 观察和验收结果；完成 code review、安全 review、post-check dry-run 后才交给 QA；所有进入 .peaks/_runtime/<session-id>/rd/ 的浏览器证据必须脱敏，不得保留登录 URL、cookie、headers、tokens、storage state、browser traces、raw browser/network state 或 PII/SSO/MFA 截图/日志。"
+  },
+  {
+    "id": 2,
+    "prompt": "目标项目是存量前端项目，整体 UT 覆盖率可能不达标，但本次只要求新增和改动部分覆盖。",
+    "expected": "不能因历史低覆盖直接失败；必须要求新增/改动代码的 focused test/coverage 证据，缺失则阻塞 RD completion。"
+  }
+]

package/skills/bee/peaks-reviewer/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: peaks-reviewer
+visibility: internal
 description: Third-party independent code-review skill for Peaks. Use as a parallel reviewer to karpathy-reviewer when a workflow needs an out-of-band (non-RD-model) review pass to mitigate single-LLM self-dogfood blind spots. Emits a schema-validated ReviewerEnvelope (no free-form LLM JSON). v2.14.0 G4.
 ---
 
@@ -74,3 +75,19 @@ Missing section: reviewer is skipped (transition still passes; envelope records
 ## Sub-agent dispatch (when launched by peaks-code swarm)
 
 When this skill runs as a sub-agent dispatched by peaks-code, the sub-agent receives the parent session id and change-id via envelope. It MUST write its output to `.peaks/_runtime/<sessionId>/rd/third-party-review.json` + `.md` and return a compact JSON envelope.
+
+## L2 surface reference (post rid-l2-extended)
+
+For slices that touch the L2 surface, the canonical CLIs are:
+- `peaks worktree {spawn,renew,list,gc,lease-status,release}` — lease lifecycle (Part 1-2)
+- `peaks sub-agent dispatch --isolation worktree|container` — auto-spawns a lease (Part 2.C + Part 8 contract)
+- `peaks container {spawn,release}` — L4 container runtime (Part 12, docker)
+- `peaks lease-metrics [--rate] [--all-sessions]` — per-kind counts + leak rate (Part 4-5)
+- `peaks lease-stats` — project-wide summary (Part 6)
+- `peaks cron {init,list,run}` + `peaks cron-scheduler start` — periodic lease gc (Part 14-15)
+- `peaks audit red-lines --project .` — 119 catalog red-lines / 86+ cli-backed enforcers / 0 prose-only (Part 13)
+
+Verify the surface (no need to re-derive):
+1. `peaks audit red-lines --project .` reports `proseOnly: 0` for any shipped L2 surface.
+2. `peaks lease-metrics --rate` after a clean run reports `estimatedLeaked: 0`.
+3. `peaks worktree list` returns 0 active leases after a clean run.

package/skills/bee/peaks-sc/SKILL.md

@@ -170,3 +170,19 @@ git log --oneline -5
 Do not implement code or test logic. Do not create GitHub repositories directly from the skill body. Use the Peaks-Loop CLI artifact commands.
 
 Reference: `references/artifact-retention.md`.
+
+## L2 surface reference (post rid-l2-extended)
+
+For slices that touch the L2 surface, the canonical CLIs are:
+- `peaks worktree {spawn,renew,list,gc,lease-status,release}` — lease lifecycle (Part 1-2)
+- `peaks sub-agent dispatch --isolation worktree|container` — auto-spawns a lease (Part 2.C + Part 8 contract)
+- `peaks container {spawn,release}` — L4 container runtime (Part 12, docker)
+- `peaks lease-metrics [--rate] [--all-sessions]` — per-kind counts + leak rate (Part 4-5)
+- `peaks lease-stats` — project-wide summary (Part 6)
+- `peaks cron {init,list,run}` + `peaks cron-scheduler start` — periodic lease gc (Part 14-15)
+- `peaks audit red-lines --project .` — 119 catalog red-lines / 86 cli-backed enforcers / 51 discovered (Part 13)
+
+Verify the surface (no need to re-derive):
+1. `peaks audit red-lines --project .` reports `proseOnly: 0` for any shipped L2 surface.
+2. `peaks lease-metrics --rate` after a clean run reports `estimatedLeaked: 0`.
+3. `peaks worktree list` returns 0 active leases after a clean run.

package/skills/bee/peaks-security-audit/SKILL.md

@@ -1,5 +1,6 @@
 ---
 name: peaks-security-audit
+visibility: internal
 description: Independent security audit skill. Reads the immutable peaks-prd handoff + the project-level security-template.md, performs an OWASP Top-10 + 8-dimension threat model audit, and writes a structured envelope to `.peaks/_runtime/<sessionId>/audit/security-<rid>.md`. Decoupled from peaks-rd 5-way fan-out per slice v2.12.0 (Group A, Tier 2). Use when the slice introduces authn/authz, secrets, input validation, path/filesystem trust, SQL/NoSQL injection, XSS/content injection, dependency supply chain, or external API surface changes.
 metadata:
   appliesTo: peaks-loop v2.12.0+
@@ -165,3 +166,19 @@ The `peaks-rd` aggregator picks up the artifact from
   template, or the diff under audit. It only writes a new audit artifact.
 - **#4 Goal-Driven Execution** — every audit output references a
   verifiable handoff goal via the `handoffHash` field.
+
+## L2 surface reference (post rid-l2-extended)
+
+For slices that touch the L2 surface, the canonical CLIs are:
+- `peaks worktree {spawn,renew,list,gc,lease-status,release}` — lease lifecycle (Part 1-2)
+- `peaks sub-agent dispatch --isolation worktree|container` — auto-spawns a lease (Part 2.C + Part 8 contract)
+- `peaks container {spawn,release}` — L4 container runtime (Part 12, docker)
+- `peaks lease-metrics [--rate] [--all-sessions]` — per-kind counts + leak rate (Part 4-5)
+- `peaks lease-stats` — project-wide summary (Part 6)
+- `peaks cron {init,list,run}` + `peaks cron-scheduler start` — periodic lease gc (Part 14-15)
+- `peaks audit red-lines --project .` — 119 catalog red-lines / 86+ cli-backed enforcers / 0 prose-only (Part 13)
+
+Verify the surface (no need to re-derive):
+1. `peaks audit red-lines --project .` reports `proseOnly: 0` for any shipped L2 surface.
+2. `peaks lease-metrics --rate` after a clean run reports `estimatedLeaked: 0`.
+3. `peaks worktree list` returns 0 active leases after a clean run.

package/skills/bee/peaks-txt/SKILL.md

@@ -307,3 +307,19 @@ The TXT handoff summarizes the slice by listing the artifact metas + the share e
 
 Same G9 threshold table. TXT handoff messages can grow large when the slice has many batches; use `--use-headroom` proactively for handoff prompts > 50%.
 
+
+## L2 surface reference (post rid-l2-extended)
+
+For slices that touch the L2 surface, the canonical CLIs are:
+- `peaks worktree {spawn,renew,list,gc,lease-status,release}` — lease lifecycle (Part 1-2)
+- `peaks sub-agent dispatch --isolation worktree|container` — auto-spawns a lease (Part 2.C + Part 8 contract)
+- `peaks container {spawn,release}` — L4 container runtime (Part 12, docker)
+- `peaks lease-metrics [--rate] [--all-sessions]` — per-kind counts + leak rate (Part 4-5)
+- `peaks lease-stats` — project-wide summary (Part 6)
+- `peaks cron {init,list,run}` + `peaks cron-scheduler start` — periodic lease gc (Part 14-15)
+- `peaks audit red-lines --project .` — 119 catalog red-lines / 86 cli-backed enforcers / 51 discovered (Part 13)
+
+Verify the surface (no need to re-derive):
+1. `peaks audit red-lines --project .` reports `proseOnly: 0` for any shipped L2 surface.
+2. `peaks lease-metrics --rate` after a clean run reports `estimatedLeaked: 0`.
+3. `peaks worktree list` returns 0 active leases after a clean run.

package/skills/bee/peaks-txt/test-prompts.json

@@ -0,0 +1,12 @@
+[
+  {
+    "id": 1,
+    "prompt": "本次 peaks-code 实战发现了 Feishu 登录、前端 mock 联调、浏览器可见 E2E 和本地 .peaks 产物的使用习惯，需要沉淀给后续 session。",
+    "expected": "Peaks TXT 在 .peaks/_runtime/<session-id>/txt/skill-usage-lessons.md 和 context-capsule.md 中记录规则、原因、影响技能、未来应用方式和是否适合 memory extraction，不保存 secrets、登录态、PII 或原始浏览器数据。"
+  },
+  {
+    "id": 2,
+    "prompt": "流程被打断，需要下个 session 接着做。",
+    "expected": "输出紧凑 capsule：模式、已验证决策、artifact paths、标准变更、开放问题、下一步，不复述完整日志。"
+  }
+]

package/skills/bee/peaks-ui/SKILL.md

@@ -130,12 +130,10 @@ peaks request show <request-id> --role prd --project <repo> --json   # read link
 
 # 2. ensure Playwright MCP is available for the visible browser check
 # Slice #016: peaks-loop no longer manages MCP install. The LLM checks
-# its own tool list for any Playwright MCP entry in the LLM tool list. If absent, the
-# LLM tells the user the install command (`claude mcp add playwright
+# its own tool list for any Playwright MCP entry. If absent, the LLM
+# tells the user the install command (`claude mcp add playwright
 # -- npx @playwright/mcp@latest` in Claude Code) and reports the gate
-# as blocked. Do NOT silently downgrade to screenshots-only, manual
-# steps, or other tools. Do NOT route through chrome-devtools-mcp as a
-# browser-launch substitute (it cannot launch a browser of its own).
+# as blocked. Do NOT silently downgrade or route through chrome-devtools-mcp.
 
 # 3. read project-scan for component library and CSS framework context
 #    check .peaks/project-scan/project-scan.md (blocking if missing for existing projects)
@@ -148,32 +146,24 @@ peaks request show <request-id> --role prd --project <repo> --json   # read link
 #    See "Prototype fidelity gate" section for the full decision tree.
 
 # 5. drive the running page or prototype through Claude Code MCP tools
-#    (the LLM invokes these directly from its tool list — no peaks-loop envelope)
-#    browser_navigate --args '{"url":"<url>"}'
-#    → URL (after allow-list check), launches headed browser
-#
+#    (the LLM invokes these directly — no peaks-loop envelope)
+#    browser_navigate --args '{"url":"<url>"}' → URL (after allow-list), launches headed browser
 #    LOGIN GATE: after browser_navigate, check for login/CAPTCHA/SSO/MFA redirect.
-#    If detected → visible browser is open; WAIT for user to complete login and
-#    explicitly confirm ("登录好了" or equivalent). Do NOT
-#    infer login from DOM. If user does not confirm → pause and ask.
-#
-#    After confirmation: browser_take_screenshot (filename), browser_snapshot (a11y tree),
+#    If detected → WAIT for user to complete login and explicitly confirm ("登录好了"
+#    or equivalent). Do NOT infer login from DOM. If user does not confirm → pause and ask.
+#    After confirmation: browser_take_screenshot, browser_snapshot (a11y tree),
 #    browser_console_messages (errors), browser_network_requests (failures), browser_close.
 # The skill body NEVER bakes in the Playwright MCP prefix; the LLM's runtime resolves the name.
 
 # 5. write design-draft artifact to .peaks/_runtime/<session-id>/ui/design-draft.md
 
 # 5.5 DESIGN-DRAFT CONFIRMATION GATE (MANDATORY):
-#      After writing the design-draft, present a summary to the user:
-#        - style direction and rationale
-#        - key design dials (variance, motion, density, palette)
-#        - component tree
-#        - anti-template items rejected
-#      Ask user to confirm before handing off to RD.
-#      In full-auto mode: if the design-draft passes the anti-template checklist
-#      and browser validation shows no regressions, auto-confirm.
-#      If browser validation was blocked (no Playwright MCP), always ask user
-#      to explicitly confirm the design-draft before proceeding.
+#      After writing the design-draft, present a summary (style direction, key design
+#      dials, component tree, anti-template items rejected) and ask user to confirm
+#      before handing off to RD. In full-auto mode: if the design-draft passes the
+#      anti-template checklist and browser validation shows no regressions, auto-confirm.
+#      If browser validation was blocked (no Playwright MCP), always ask user to
+#      explicitly confirm the design-draft before proceeding.
 
 # 6. record visual direction, rejected generic patterns, regression seeds in the request artifact
 
@@ -192,16 +182,13 @@ You cannot declare a phase complete from memory. Each gate below is a `ls` comma
 **Peaks-Loop Gate A — After design-draft write:**
 ```bash
 ls .peaks/_runtime/<sessionId>/ui/design-draft.md
-# Expected output: .peaks/_runtime/<sessionId>/ui/design-draft.md
-# "No such file" → STOP, write the design-draft first. Do not proceed to handoff.
+# Expected: .peaks/_runtime/<sessionId>/ui/design-draft.md
+# No such file → STOP, write the design-draft first. Do not proceed to handoff.
 
-# Peaks-Loop Gate A also requires an ASCII wireframe section with at least one fenced block.
+# Gate A also requires an ASCII wireframe section with at least one fenced block.
 grep -c "^## Layout (ASCII wireframe)" .peaks/_runtime/<sessionId>/ui/design-draft.md
-# Expected: >= 1. Zero → BLOCKED. The mandatory ASCII wireframe section is missing.
 grep -c '^```' .peaks/_runtime/<sessionId>/ui/design-draft.md
-# Expected: >= 2 (one or more fenced code blocks for ASCII wireframes).
-# Zero → BLOCKED. Prose-only layout description is not acceptable; add ASCII wireframes
-# for the main page and every meaningful modal/drawer/state.
+# Both >= 1. Zero in either → BLOCKED. Prose-only layout is not acceptable.
 ```
 
 **Peaks-Loop Gate B — Before handoff to RD:**
@@ -281,27 +268,21 @@ Before writing design-draft.md, verify:
 
 In full-auto frontend design with NO prototype (verified above), default to the curated taste path instead of generic component generation. External skills are optional enhancements, not prerequisites.
 
-**If a prototype exists, skip this section.** The prototype IS the design direction. Use the prototype fidelity gate checklist above instead.
+**If a prototype exists, skip this section.** The prototype IS the design direction.
 
 **Self-contained design process (always available):**
 
 1. choose a specific style direction: editorial, bento, Swiss, luxury, retro-futurist, glass, or product-specific system UI. Pick one that fits the product's tone — do not default to "clean minimal."
-2. define design dials with concrete values:
-   - variance: conservative (subtle radius/shadows) | moderate (mixed depths) | bold (asymmetric, overlapping)
-   - motion: minimal (opacity-only) | medium (transform+opacity) | rich (staggered, spring, scroll-triggered)
-   - density: sparse (generous whitespace) | comfortable (standard) | dense (data-heavy)
-   - typography: one display/heading + one body font from system or project stack
-   - palette: 5 tokens (primary, surface, text-primary, text-secondary, accent) in oklch()/hsl() with concrete values
-3. reject anti-patterns: centered stock heroes, default card grids, unmodified library defaults, AI purple-blue gradients, generic three-card feature rows, safe gray-on-white
-4. require 6 states per surface: loading (skeleton), empty (illustration+CTA), error (message+retry), hover, focus, active
-5. browser-check with Playwright MCP, wait for user confirmation after any login challenge, iterate until UI looks intentional
+2. define design dials: variance (conservative | moderate | bold) / motion (minimal | medium | rich) / density (sparse | comfortable | dense) / typography (one display + one body) / palette (5 tokens in oklch/hsl).
+3. reject anti-patterns: centered stock heroes, default card grids, unmodified library defaults, AI purple-blue gradients, generic three-card feature rows, safe gray-on-white.
+4. require 6 states per surface: loading, empty, error, hover, focus, active.
+5. browser-check with Playwright MCP, wait for user confirmation after any login challenge, iterate.
 
 **When external design skills ARE available** (confirm via `peaks capabilities --source access-repo --json` first, reference only):
-
 - `awesome-design-md`: layout composition, rhythm, atmosphere
 - `taste-skill` / `design-taste-frontend`: anti-template, typography, color, density, motion critique
 
-Full-auto Peaks-Loop UI output must include a short taste report: visual direction, references used, rejected generic patterns, browser observations, remaining design risks, and the next visual iteration if the page is not yet good enough.
+Full-auto output must include a short taste report: visual direction, references used, rejected generic patterns, browser observations, remaining design risks, and the next visual iteration if the page is not yet good enough.
 
 ## Mandatory design-draft output
 
@@ -360,6 +341,15 @@ UI sub-agents follow the same G7 metadata-only + G8.6 share protocol. UI artifac
 
 ### G8.6 — UI sub-agent prompt template
 
+**Superpowers chain refusal (L1 worktree governance — locked 2026-07-29):** you MUST NOT follow the superpowers chain for worktree decisions: `superpowers:brainstorming` → `superpowers:writing-plans` → `superpowers:subagent-driven-development` → `superpowers:using-git-worktrees`. The chain ends with `git worktree add` (superpowers:using-git-worktrees SKILL.md line 96) and bypasses peaks-loop's L2 hook gate and L3 IDE `permissions.deny`. Even when L3 denies the terminal Skill, the chain has already taught you to use raw `git worktree add`, so L3 is not sufficient.
+
+For worktree operations, use ONLY:
+
+- `peaks worktree spawn --rid <rid> --ttl <duration> --purpose <text>` (after rid-L2-extended ships)
+- until then: `peaks worktree auth grant --rid <id> --reason <text> --ttl <5m>`
+
+The superpowers skills remain available as REFERENCE material for brainstorming / planning techniques, but MUST NOT be used as a workflow. peaks-ui's own UI artifacts (`.peaks/_runtime/<sessionId>/ui/<artifact>.md`) are authoritative. Full design: `skills/peaks-code/references/worktree-governance.md`.
+
 ```
 You are sub-agent role ui, batch <batchId>.
 
@@ -373,3 +363,19 @@ PROTOCOL (mandatory):
 
 Same as RD/QA. Use `--use-headroom` proactively.
 
+
+## L2 surface reference (post rid-l2-extended)
+
+For slices that touch the L2 surface, the canonical CLIs are:
+- `peaks worktree {spawn,renew,list,gc,lease-status,release}` — lease lifecycle (Part 1-2)
+- `peaks sub-agent dispatch --isolation worktree|container` — auto-spawns a lease (Part 2.C + Part 8 contract)
+- `peaks container {spawn,release}` — L4 container runtime (Part 12, docker)
+- `peaks lease-metrics [--rate] [--all-sessions]` — per-kind counts + leak rate (Part 4-5)
+- `peaks lease-stats` — project-wide summary (Part 6)
+- `peaks cron {init,list,run}` + `peaks cron-scheduler start` — periodic lease gc (Part 14-15)
+- `peaks audit red-lines --project .` — 119 catalog red-lines / 86 cli-backed enforcers / 51 discovered (Part 13)
+
+Verify the surface (no need to re-derive):
+1. `peaks audit red-lines --project .` reports `proseOnly: 0` for any shipped L2 surface.
+2. `peaks lease-metrics --rate` after a clean run reports `estimatedLeaked: 0`.
+3. `peaks worktree list` returns 0 active leases after a clean run.

package/skills/bee/peaks-ui/test-prompts.json

@@ -0,0 +1,12 @@
+[
+  {
+    "id": 1,
+    "prompt": "根据产品文档做前端页面迭代，要求全自动模式下设计不要模板化，要比普通 Tailwind/shadcn 默认页更好看。",
+    "expected": "Peaks UI 走 awesome-design-md + taste-skill/design-taste-frontend 的参考和品味链路，先定义风格方向、字体、色彩、动效、密度和交互状态，避免默认卡片栅格、居中 hero、AI 紫蓝渐变，并用浏览器可见检查迭代。"
+  },
+  {
+    "id": 2,
+    "prompt": "前端实现已经完成，但页面看起来像默认模板。",
+    "expected": "Peaks UI 产出 taste report，指出弱层级、模板感、交互状态缺失、响应式问题，并退回设计/RD 迭代后再 QA。"
+  }
+]