peaks-loop 4.0.0-beta.9 → 4.0.3

package/dist/services/audit/red-line-catalog-p2-a.js

@@ -5,7 +5,7 @@ const SECTION_HARD_CONTRACTS = {
     id: 'rl-section-hard-contracts-001',
     rule: 'Section structure: Hard contracts for browser/IO surface',
     markers: ['MANDATORY', 'BLOCKING'],
-    phrases: ['hard contract', 'hard contracts for browser', 'must be read before'],
+    phrases: ['hard contract', 'hard contracts for browser', 'hard contracts (blocking)', 'must be read before'],
     enforcerRef: 'src/services/audit/enforcers/lint-style.ts',
 };
 const SECTION_MANDATORY_ARTIFACT = {
@@ -193,12 +193,184 @@ const CATALOG_PROSE_ONLY_RATIO = {
     phrases: ['prose-only ratio', 'prose-only threshold', 'prose-only ≤ 5%', 'prose-only < 10%'],
     enforcerRef: 'src/services/audit/enforcers/lint-catalog-governance.ts',
 };
+const SKILL_PRESENCE_MANDATORY = {
+    id: 'rl-skill-presence-mandatory-001',
+    rule: 'peaks-* bee SKILL.md must declare `## Skill presence (MANDATORY first action)` heading + body',
+    markers: ['MANDATORY'],
+    phrases: ['skill presence (mandatory first action)', 'skill presence ( first action', 'immediately run:'],
+    enforcerRef: 'src/services/audit/enforcers/lint-skill-presence-mandatory.ts',
+};
+const PRD_SOURCE_SNAPSHOT_PLACEMENT = {
+    id: 'rl-prd-source-snapshot-placement-001',
+    rule: 'peaks-prd SKILL.md must declare `## Document snapshot placement (BLOCKING)` heading + Prohibited paths + .peaks/_runtime/<session-id>/prd/source/ path',
+    markers: ['BLOCKING'],
+    phrases: ['document snapshot placement', 'prohibited paths', 'prd/source/'],
+    enforcerRef: 'src/services/audit/enforcers/lint-prd-source-snapshot.ts',
+};
+const PRD_ARTIFACT_HANDOFF = {
+    id: 'rl-prd-artifact-handoff-001',
+    rule: 'peaks-prd SKILL.md must declare the artifact handoff contract (Preserved behavior + step 5.5 + Transition verification gates)',
+    markers: ['BLOCKING'],
+    phrases: ['preserved behavior', '5.5 — write the immutable handoff', 'transition verification gates'],
+    enforcerRef: 'src/services/audit/enforcers/lint-prd-artifact-handoff.ts',
+};
+const RD_HANDOFF_CONTRACT = {
+    id: 'rl-rd-handoff-contract-001',
+    rule: 'peaks-rd SKILL.md must declare the QA-handoff BLOCKING contract (tech-doc + perf-baseline)',
+    markers: ['BLOCKING'],
+    phrases: ['do not hand off to qa without', 'tech-doc', 'perf-baseline'],
+    enforcerRef: 'src/services/audit/enforcers/lint-rd-handoff-coverage.ts',
+};
+const RD_COVERAGE_DISCIPLINE = {
+    id: 'rl-rd-coverage-discipline-001',
+    rule: 'peaks-rd SKILL.md must declare the coverage discipline (100% target + no-padding rule)',
+    markers: ['MANDATORY'],
+    phrases: ['100% coverage target on testable files', 'must not write coverage-padding tests'],
+    enforcerRef: 'src/services/audit/enforcers/lint-rd-handoff-coverage.ts',
+};
+const QA_GATEGUARD_PREFLIGHT = {
+    id: 'rl-qa-gateguard-preflight-001',
+    rule: 'peaks-qa SKILL.md must declare the gateguard-fact-force pre-flight BLOCKING section',
+    markers: ['BLOCKING'],
+    phrases: ['gateguard-fact-force conflict', 'pre-flight'],
+    enforcerRef: 'src/services/audit/enforcers/lint-qa-gateguard-and-runtime.ts',
+};
+const QA_RUNTIME_CONTRACT = {
+    id: 'rl-qa-runtime-contract-001',
+    rule: 'peaks-qa SKILL.md must declare the runtime contract (transition gates + Playwright MCP fallback + OpenSpec integration)',
+    markers: ['BLOCKING', 'MANDATORY'],
+    phrases: ['transition verification gates', 'playwright mcp is unavailable', 'when the target repository has openspec/'],
+    enforcerRef: 'src/services/audit/enforcers/lint-qa-gateguard-and-runtime.ts',
+};
+const PEAKS_UI_SUPERPOWERS_CHAIN = {
+    id: 'rl-peaks-ui-superpowers-chain-001',
+    rule: 'peaks-ui SKILL.md must declare the superpowers chain refusal + reference-material contract',
+    markers: ['BLOCKING'],
+    phrases: ['MUST NOT follow the superpowers chain', 'superpowers skills remain available as reference material'],
+    enforcerRef: 'src/services/audit/enforcers/lint-peaks-ui-sc-txt-runtime.ts',
+};
+const PEAKS_UI_INVOLVEMENT = {
+    id: 'rl-peaks-ui-involvement-001',
+    rule: 'peaks-ui SKILL.md must declare the UI-involvement identification block',
+    markers: ['MANDATORY'],
+    phrases: ['identify ui involvement'],
+    enforcerRef: 'src/services/audit/enforcers/lint-peaks-ui-sc-txt-runtime.ts',
+};
+const PEAKS_TXT_UPSTREAM = {
+    id: 'rl-peaks-txt-upstream-001',
+    rule: 'peaks-txt SKILL.md must declare the upstream-inspection + memory-block contract',
+    markers: ['MANDATORY'],
+    phrases: ['inspect upstream skill content before applying any method', 'memory block embedding rule'],
+    enforcerRef: 'src/services/audit/enforcers/lint-peaks-ui-sc-txt-runtime.ts',
+};
+const PEAKS_PERF_AUDIT_SCOPE = {
+    id: 'rl-peaks-perf-audit-scope-001',
+    rule: 'peaks-perf-audit SKILL.md must declare the non-perf MUST NOT invoke clause',
+    markers: ['MUST NOT'],
+    phrases: ['MUST NOT invoke this skill', 'non-perf'],
+    enforcerRef: 'src/services/audit/enforcers/lint-peaks-ui-sc-txt-runtime.ts',
+};
+const PEAKS_RD_RUNTIME_CONTRACT = {
+    id: 'rl-peaks-rd-runtime-contract-001',
+    rule: 'peaks-rd SKILL.md must declare the runtime contract (OpenSpec usage + Frontend project generation)',
+    markers: ['BLOCKING', 'MUST NOT'],
+    phrases: ['use openspec when the', 'rd work creates a frontend application'],
+    enforcerRef: 'src/services/audit/enforcers/lint-bee-runtime-contract.ts',
+};
+const PEAKS_UI_TRANSITION_GATES = {
+    id: 'rl-peaks-ui-transition-gates-001',
+    rule: 'peaks-ui SKILL.md must declare the Transition verification gates section',
+    markers: ['MANDATORY'],
+    phrases: ['transition verification gates'],
+    enforcerRef: 'src/services/audit/enforcers/lint-bee-runtime-contract.ts',
+};
+const PEAKS_SC_TRANSITION_GATES = {
+    id: 'rl-peaks-sc-transition-gates-001',
+    rule: 'peaks-sc SKILL.md must declare the Transition verification gates section',
+    markers: ['MANDATORY'],
+    phrases: ['transition verification gates'],
+    enforcerRef: 'src/services/audit/enforcers/lint-bee-runtime-contract.ts',
+};
+const PEAKS_TXT_RUNTIME_CONTRACT = {
+    id: 'rl-peaks-txt-runtime-contract-001',
+    rule: 'peaks-txt SKILL.md must declare the runtime contract (Transition verification gates + Memory block embedding rule)',
+    markers: ['MANDATORY'],
+    phrases: ['transition verification gates', 'memory block embedding rule'],
+    enforcerRef: 'src/services/audit/enforcers/lint-bee-runtime-contract.ts',
+};
+const PEAKS_CODE_RUNTIME_CONTRACT = {
+    id: 'rl-peaks-code-runtime-contract-001',
+    rule: 'peaks-code SKILL.md must declare the runbook section-marker skeleton (Scope, no auto-compact, superpowers bridge, npm-contract, startup sequence, step 0.8 job-shape, local intermediate artifact workspace, pre-rd project scan checklist, step 11 memory sediment, --enforce-job-mode v3.1.2).',
+    markers: ['BLOCKING', 'MANDATORY'],
+    phrases: [
+        'scope (rl-8',
+        'no auto-compact prose ban',
+        'peaks-loop superpowers 协作边界',
+        'npm-contract boundary',
+        'peaks-loop startup sequence',
+        'step 0.8',
+        'peaks-loop local intermediate artifact workspace',
+        'peaks-loop pre-rd project scan checklist',
+        'step 11',
+        'enforce-job-mode (v3.1.2)'
+    ],
+    enforcerRef: 'src/services/audit/enforcers/lint-peaks-code-runtime.ts',
+};
 /**
  * The 25 P2-a entries, in stable display order. Appending to a single
  * readonly array keeps the catalog growable: future slices (L2.4, L3.x)
  * can spread this list into RED_LINE_CATALOG and add their own without
  * touching this file.
  */
+const PEAKS_AUDIT_RUNTIME = {
+    id: 'rl-peaks-audit-runtime-001',
+    rule: 'peaks-audit SKILL.md must declare the audit-runtime contract (machine-readable audit log, six-dimension audit, author identity)',
+    markers: ['MANDATORY', 'BLOCKING'],
+    phrases: ['audit log is machine-readable', 'six dimensions', '6 dimensions', 'author identity.*local gitconfig'],
+    enforcerRef: 'src/services/audit/enforcers/lint-peaks-skill-runtime.ts',
+};
+const PEAKS_CONTENT_RUNTIME = {
+    id: 'rl-peaks-content-runtime-001',
+    rule: 'peaks-content SKILL.md must declare the content-runtime contract (what this skill do, failure mode, each red line is written)',
+    markers: ['MANDATORY', 'BLOCKING'],
+    phrases: ['what this skill do', 'failure mode', 'each red line is written'],
+    enforcerRef: 'src/services/audit/enforcers/lint-peaks-skill-runtime.ts',
+};
+const PEAKS_IDE_RUNTIME = {
+    id: 'rl-peaks-ide-runtime-001',
+    rule: 'peaks-ide SKILL.md must declare the ide-runtime contract (for any consumer, what this skill do, general workflow-gating tool)',
+    markers: ['MANDATORY'],
+    phrases: ['for any consumer of the v2 envelope', 'what this skill do', 'general workflow-gating tool'],
+    enforcerRef: 'src/services/audit/enforcers/lint-peaks-skill-runtime.ts',
+};
+const PEAKS_DOCTOR_RUNTIME = {
+    id: 'rl-peaks-doctor-runtime-001',
+    rule: 'peaks-doctor SKILL.md must declare the doctor-orchestrator marker',
+    markers: ['MANDATORY'],
+    phrases: ['peaks-loop doctor is a doctor orchestrator'],
+    enforcerRef: 'src/services/audit/enforcers/lint-peaks-skill-runtime.ts',
+};
+const PEAKS_ISSUE_FIX_ORCHESTRATOR_RUNTIME = {
+    id: 'rl-peaks-issue-fix-orchestrator-runtime-001',
+    rule: 'peaks-issue-fix-orchestrator SKILL.md must declare the deviation note + autonomous work proceed markers',
+    markers: ['MANDATORY'],
+    phrases: ['deviation note', 'autonomous work proceed'],
+    enforcerRef: 'src/services/audit/enforcers/lint-peaks-skill-runtime.ts',
+};
+const PEAKS_SOP_RUNTIME = {
+    id: 'rl-peaks-sop-runtime-001',
+    rule: 'peaks-sop SKILL.md must declare the sop-runtime contract (each red line below, sop lint reports findings)',
+    markers: ['MANDATORY'],
+    phrases: ['each red line below is written', 'sop lint reports findings'],
+    enforcerRef: 'src/services/audit/enforcers/lint-peaks-skill-runtime.ts',
+};
+const PEAKS_SLICE_DECOMPOSE_RUNTIME = {
+    id: 'rl-peaks-slice-decompose-runtime-001',
+    rule: 'peaks-slice-decompose SKILL.md must declare the slice-decompose contract (what this skill do, failure mode)',
+    markers: ['MANDATORY'],
+    phrases: ['what this skill do', 'failure mode ('],
+    enforcerRef: 'src/services/audit/enforcers/lint-peaks-skill-runtime.ts',
+};
 export const RED_LINE_CATALOG_P2_A = [
     SECTION_HARD_CONTRACTS,
     SECTION_MANDATORY_ARTIFACT,
@@ -226,4 +398,61 @@ export const RED_LINE_CATALOG_P2_A = [
     PEAKS_DOCTOR_SKILL_ACKNOWLEDGED,
     CATALOG_TOTAL_LE_45,
     CATALOG_PROSE_ONLY_RATIO,
+    // Slice 2026-07-29-rid-prose-only-sweep-001: close the first
+    // discovered prose-only line. peaks-prd-skill-md-56 was a
+    // "MANDATORY first action" marker on a "Skill presence" heading
+    // in skills/bee/* SKILL.md. The MANDATORY marker + the heading
+    // are now enforced by lint-skill-presence-mandatory.ts.
+    SKILL_PRESENCE_MANDATORY,
+    // Slice 2026-07-29-rid-prose-only-sweep-002: close two more
+    // peaks-prd discovered lines (md-292, md-301) with one
+    // enforcer. The enforcer pattern-scans the source-snapshot
+    // placement guidance + prohibited-paths list.
+    PRD_SOURCE_SNAPSHOT_PLACEMENT,
+    // Slice 2026-07-29-rid-prose-only-sweep-004: close three
+    // peaks-prd discovered lines (md-99 / md-166 / md-193) with
+    // one enforcer. The handoff contract requires preserved
+    // behavior, step 5.5, and transition verification gates.
+    PRD_ARTIFACT_HANDOFF,
+    // Slice 2026-07-29-rid-prose-only-sweep-005: close three
+    // peaks-rd discovered lines (md-121 / md-127 / md-162) with
+    // two enforcers (handoff + coverage discipline).
+    RD_HANDOFF_CONTRACT,
+    RD_COVERAGE_DISCIPLINE,
+    // Slice 2026-07-29-rid-prose-only-sweep-006: close four
+    // peaks-qa discovered lines (md-26 gateguard + md-113
+    // transition gates + md-165 playwright + md-201 openspec).
+    QA_GATEGUARD_PREFLIGHT,
+    QA_RUNTIME_CONTRACT,
+    // Slice 2026-07-29-rid-prose-only-sweep-007: close six more
+    // discovered lines (3 peaks-ui + 2 peaks-txt + 1
+    // peaks-perf-audit) with four enforcers.
+    PEAKS_UI_SUPERPOWERS_CHAIN,
+    PEAKS_UI_INVOLVEMENT,
+    PEAKS_TXT_UPSTREAM,
+    PEAKS_PERF_AUDIT_SCOPE,
+    // Slice 2026-07-29-rid-prose-only-sweep-008: close six more
+    // discovered lines (2 peaks-rd + 1 peaks-sc + 1 peaks-txt +
+    // 1 peaks-ui + 1 peaks-ui) with four enforcers in
+    // lint-bee-runtime-contract.ts.
+    PEAKS_RD_RUNTIME_CONTRACT,
+    PEAKS_UI_TRANSITION_GATES,
+    PEAKS_SC_TRANSITION_GATES,
+    PEAKS_TXT_RUNTIME_CONTRACT,
+    // Slice 2026-07-29-rid-prose-only-sweep-009: close 13 of the
+    // remaining 33 discovered lines (all peaks-code) with one
+    // enforcer that checks the peaks-code runbook section-marker
+    // skeleton. Single catalog entry; multi-marker enforcer.
+    PEAKS_CODE_RUNTIME_CONTRACT,
+    // Slice 2026-07-29-rid-prose-only-sweep-010: 8 of the
+    // remaining 22 discovered lines (peaks-audit x4,
+    // peaks-content x2, peaks-ide x2) closed with 6 enforcers
+    // in one file.
+    PEAKS_AUDIT_RUNTIME,
+    PEAKS_CONTENT_RUNTIME,
+    PEAKS_IDE_RUNTIME,
+    PEAKS_DOCTOR_RUNTIME,
+    PEAKS_ISSUE_FIX_ORCHESTRATOR_RUNTIME,
+    PEAKS_SOP_RUNTIME,
+    PEAKS_SLICE_DECOMPOSE_RUNTIME,
 ];

package/dist/services/audit/static-service.d.ts

@@ -1,52 +1,59 @@
 /**
  * Static audit service — `peaks audit static`.
  *
- * Slice #6 L2.3 P2-a: soft-optional ECC AgentShield integration.
+ * Slice 3 of 4.0.0-beta.11 dropped the ECC AgentShield subprocess
+ * integration entirely. The pre-Slice-3 implementation probed
+ * `npx ecc-agentshield --version` and shelled out to
+ * `npx ecc-agentshield scan --json --target <path>` on every audit
+ * call, but the upstream `affaan-m/everything-claude-code` v2.0.0
+ * release ships no `ecc-agentshield` binary — the repo is
+ * `agents/*.md` flat files plus SKILL.md descriptors.
  *
- * Per spec §5.3, the audit framework integrates with ECC AgentShield
- * (102 lint rules) on a soft-optional basis. When ECC is installed
- * AND `agentShieldEnabled: true`, the audit subprocess spawns the
- * ECC scanner and merges its findings; when either is missing, the
- * audit completes with peaks-loop-only findings.
+ * The new contract: `peaks audit static` runs the peaks-loop lint
+ * layer only. There is no subprocess probe, no `installed` flag,
+ * no agent-shield reason code. The `agentShield` field is preserved
+ * on the result type as a frozen "always disabled" stub so any
+ * downstream consumer keeps compiling, but the merged findings list
+ * is always the peaks-loop findings list (no ECC findings).
  *
- * The subprocess is **observability enhancement**, not a structural
- * gate — every soft-fail path returns a well-formed audit report.
+ * The subprocess-runner seam (`SubprocessRunner`, `defaultSubprocessRunner`)
+ * is preserved as an EXPORTED TYPE so legacy tests can still
+ * mock it; the runner itself is never invoked from production code.
  */
 import { type ProseRatioResult } from './prose-ratio-calculator.js';
 import type { EnforcerFinding, RedLineAudit } from './types.js';
 export interface StaticAuditInput {
     readonly projectRoot: string;
-    /** Override the preference for a single call. Default: read from preferences. */
+    /** Slice 3: retained for backward-compat; no longer wired. */
     readonly enableAgentShield?: boolean | undefined;
-    /**
-     * Optional subprocess runner injection point. Used by tests
-     * to mock `npx ecc-agentshield`. Production callers should
-     * leave this undefined; the default uses `child_process.spawnSync`.
-     */
+    /** Slice 3: retained as a type seam; never invoked in production. */
     readonly subprocessRunner?: SubprocessRunner | undefined;
 }
 export interface StaticAuditResult {
     readonly audit: RedLineAudit;
     readonly agentShield: AgentShieldState;
     readonly warnings: readonly string[];
-    /** v2.14.0 Slice C: prose-only ratio with informational exclusion (per A3.1). */
     readonly proseRatio: ProseRatioResult;
 }
+/**
+ * Frozen stub. Slice 3 collapsed the agent-shield reason set to a
+ * single value (`'disabled-and-ecc-missing'`) because the
+ * subprocess integration was removed; we preserve the other
+ * reason literals as TYPE-LEVEL members so any test or
+ * downstream consumer that pattern-matches on `'flag-enabled-but-ecc-missing'`
+ * keeps type-checking, but the runtime value is always the
+ * single collapsed state.
+ */
 export interface AgentShieldState {
-    /** Whether the agent-shield subprocess was spawned. */
-    readonly spawned: boolean;
-    /** Whether ECC AgentShield is installed (regardless of whether it was spawned). */
-    readonly installed: boolean;
-    /** Why the subprocess was or was not spawned. */
+    readonly spawned: false;
+    readonly installed: false;
     readonly reason: 'enabled-and-installed' | 'disabled-by-preference' | 'flag-disabled' | 'flag-enabled-but-ecc-missing' | 'disabled-and-ecc-missing';
-    /** The merged ECC findings (empty if not spawned). */
     readonly findings: readonly EnforcerFinding[];
 }
 /**
- * Subprocess runner interface — the only seam tests need to
- * mock the `npx ecc-agentshield` subprocess. Production callers
- * leave `subprocessRunner` undefined; the default delegates to
- * `child_process.spawnSync` (synchronous, captures stdout).
+ * Subprocess runner interface — preserved as a TYPE for legacy
+ * test code. Production no longer invokes it; the audit always
+ * runs peaks-loop-only findings.
  */
 export interface SubprocessRunner {
     run(command: string, args: readonly string[], timeoutMs: number): SubprocessResult;

package/dist/services/audit/static-service.js

@@ -1,130 +1,51 @@
 /**
  * Static audit service — `peaks audit static`.
  *
- * Slice #6 L2.3 P2-a: soft-optional ECC AgentShield integration.
+ * Slice 3 of 4.0.0-beta.11 dropped the ECC AgentShield subprocess
+ * integration entirely. The pre-Slice-3 implementation probed
+ * `npx ecc-agentshield --version` and shelled out to
+ * `npx ecc-agentshield scan --json --target <path>` on every audit
+ * call, but the upstream `affaan-m/everything-claude-code` v2.0.0
+ * release ships no `ecc-agentshield` binary — the repo is
+ * `agents/*.md` flat files plus SKILL.md descriptors.
  *
- * Per spec §5.3, the audit framework integrates with ECC AgentShield
- * (102 lint rules) on a soft-optional basis. When ECC is installed
- * AND `agentShieldEnabled: true`, the audit subprocess spawns the
- * ECC scanner and merges its findings; when either is missing, the
- * audit completes with peaks-loop-only findings.
+ * The new contract: `peaks audit static` runs the peaks-loop lint
+ * layer only. There is no subprocess probe, no `installed` flag,
+ * no agent-shield reason code. The `agentShield` field is preserved
+ * on the result type as a frozen "always disabled" stub so any
+ * downstream consumer keeps compiling, but the merged findings list
+ * is always the peaks-loop findings list (no ECC findings).
  *
- * The subprocess is **observability enhancement**, not a structural
- * gate — every soft-fail path returns a well-formed audit report.
+ * The subprocess-runner seam (`SubprocessRunner`, `defaultSubprocessRunner`)
+ * is preserved as an EXPORTED TYPE so legacy tests can still
+ * mock it; the runner itself is never invoked from production code.
  */
-import { spawnSync } from 'node:child_process';
 import { runRedLinesAudit } from './red-lines-service.js';
 import { loadPreferences } from '../preferences/preferences-service.js';
 import { computeProseRatio } from './prose-ratio-calculator.js';
-const ECC_DETECT_TIMEOUT_MS = 5000;
-const ECC_SCAN_TIMEOUT_MS = 30000;
-const defaultSubprocessRunner = {
-    run(command, args, timeoutMs) {
-        try {
-            const r = spawnSync(command, args, {
-                timeout: timeoutMs,
-                encoding: 'utf8',
-                stdio: ['ignore', 'pipe', 'pipe'],
-                maxBuffer: 16 * 1024 * 1024,
-            });
-            return {
-                status: r.status,
-                stdout: r.stdout ?? '',
-                stderr: r.stderr ?? '',
-            };
-        }
-        catch (err) {
-            return {
-                status: null,
-                stdout: '',
-                stderr: '',
-                error: err,
-            };
-        }
-    },
-};
-function isEccInstalled(runner) {
-    const result = runner.run('npx', ['ecc-agentshield', '--version'], ECC_DETECT_TIMEOUT_MS);
-    if (result.error)
-        return false;
-    return result.status === 0;
-}
-function runEccScan(projectRoot, runner) {
-    try {
-        // Per spec §7.2 line 828: the canonical ECC subprocess call uses
-        // `--target <path>`, NOT `--project`. The peaks-loop CLI flag
-        // (`peaks audit static --project <path>`) follows peaks-loop
-        // convention; the inner ecc-agentshield call follows the
-        // upstream ECC contract.
-        const result = runner.run('npx', ['ecc-agentshield', 'scan', '--json', '--target', projectRoot], ECC_SCAN_TIMEOUT_MS);
-        if (result.error || result.status !== 0)
-            return [];
-        const stdout = result.stdout;
-        let parsed;
-        try {
-            parsed = JSON.parse(stdout);
-        }
-        catch {
-            return [];
-        }
-        if (!parsed.findings)
-            return [];
-        return parsed.findings.map((f, idx) => ({
-            enforcerId: `ecc-agentshield:${f.ruleId ?? `unknown-${idx}`}`,
-            rule: f.rule ?? 'ECC AgentShield rule',
-            severity: f.severity ?? 'warn',
-            file: f.file ?? '(unknown)',
-            detail: f.detail ?? '',
-        }));
-    }
-    catch {
-        return [];
-    }
-}
 export function runStaticAudit(input) {
-    // Read the project-local preferences; the CLI flag overrides.
-    const prefs = loadPreferences(input.projectRoot);
-    const prefEnabled = prefs.agentShieldEnabled;
-    const flagEnabled = input.enableAgentShield;
-    const runner = input.subprocessRunner ?? defaultSubprocessRunner;
-    // Resolve the effective "should spawn" decision.
-    // flagEnabled (CLI override) > preference > false
-    const shouldSpawn = flagEnabled ?? prefEnabled;
-    // Detect ECC.
-    const installed = isEccInstalled(runner);
-    const warnings = [];
-    let state;
-    if (!shouldSpawn) {
-        // Disabled path — no subprocess, no warnings.
-        const reason = flagEnabled === false
-            ? 'flag-disabled'
-            : 'disabled-by-preference';
-        state = { spawned: false, installed, reason, findings: [] };
-    }
-    else if (!installed) {
-        // Enabled but ECC missing — soft-fail with a warning.
-        warnings.push('agentShieldEnabled is true but `npx ecc-agentshield --version` failed. ' +
-            'Run `npx ecc-agentshield --help` to install. Audit ran with peaks-loop findings only.');
-        state = { spawned: false, installed: false, reason: 'flag-enabled-but-ecc-missing', findings: [] };
-    }
-    else {
-        // Enabled and installed — spawn the subprocess.
-        const findings = runEccScan(input.projectRoot, runner);
-        state = { spawned: true, installed: true, reason: 'enabled-and-installed', findings };
-    }
-    // Always run the peaks-loop lint layer; merge ECC findings.
+    // Slice 3: agent-shield integration removed. The CLI flag and
+    // preference are still read for backward-compat (a user with a
+    // stale preferences.json that sets `agentShieldEnabled: true`
+    // does not get a hard error) but neither spawns a subprocess.
+    loadPreferences(input.projectRoot);
+    // Always run the peaks-loop lint layer; no ECC findings merged.
     const peaksResult = runRedLinesAudit({ projectRoot: input.projectRoot });
     const mergedAudit = {
         ...peaksResult.audit,
-        enforcerFindings: [...peaksResult.audit.enforcerFindings, ...state.findings],
+        enforcerFindings: [...peaksResult.audit.enforcerFindings],
+    };
+    const state = {
+        spawned: false,
+        installed: false,
+        reason: 'disabled-and-ecc-missing',
+        findings: [],
     };
-    // v2.14.0 Slice C: compute prose-only ratio with informational
-    // exclusion. Surfaced in the JSON envelope so CI can gate on it.
     const proseRatio = computeProseRatio(mergedAudit.audit);
     return {
         audit: mergedAudit,
         agentShield: state,
-        warnings,
+        warnings: [],
         proseRatio,
     };
 }

package/dist/services/audit-independent/index.d.ts

@@ -0,0 +1,2 @@
+export { runSecurityAudit, isSecurityAuditEnvelope, detectSecurityAudit, readSecurityTemplate, renderSecurityAuditArtifact, type SecurityAuditEnvelope, type SecurityAuditViolation, type SecurityAuditVerdict, type SecurityAuditDetectState, type SecurityAuditDetectResult, type HandoffFrontmatter, readAndVerifyHandoff, } from './security-audit-service.js';
+export { runPerfAudit, isPerfAuditEnvelope, detectPerfAudit, readPerfTemplate, renderPerfAuditArtifact, type PerfAuditEnvelope, type PerfAuditViolation, type PerfAuditVerdict, type PerfAuditDetectState, type PerfAuditDetectResult, } from './perf-audit-service.js';

package/dist/services/audit-independent/index.js

@@ -0,0 +1,2 @@
+export { runSecurityAudit, isSecurityAuditEnvelope, detectSecurityAudit, readSecurityTemplate, renderSecurityAuditArtifact, readAndVerifyHandoff, } from './security-audit-service.js';
+export { runPerfAudit, isPerfAuditEnvelope, detectPerfAudit, readPerfTemplate, renderPerfAuditArtifact, } from './perf-audit-service.js';

package/dist/services/autonomous-swarm/autonomous-swarm-service.d.ts

@@ -0,0 +1,127 @@
+/**
+ * autonomous-swarm-service — slice rid-014.
+ *
+ * Purpose:
+ *   Build a dry-run-only autonomous RD swarm planner that turns a
+ *   user-supplied goal + change-id + mode into a *resumable* plan:
+ *   goal package (done / resume conditions), capability reuse list,
+ *   checkpoint queue, worker-queue placeholders (no spawn), evidence
+ *   requirements, and resume instructions.
+ *
+ * Reuse (per rid-014 plan §1):
+ *   - `validateChangeId` + `planArtifactPath` + `buildWorkspaceUnavailable`
+ *     from `src/services/openspec/artifact-boundary.ts` (rid-009).
+ *   - `getTechStatus` from `src/services/tech/tech-service.ts` (rid-012).
+ *   - `planRdSwarmGraph` shape from `src/services/rd-swarm/rd-swarm-service.ts`
+ *     (rid-013) — composed as the workerQueue feed.
+ *
+ * Style:
+ *   - Named function exports — matches `rd-swarm-service.ts` + `artifact-boundary.ts`.
+ *   - Hand-rolled `Result<T, E>` unions — no `neverthrow` dep.
+ *   - Pure path math + intentional capability fs reads (no side effects).
+ *   - No real workers, no MCP install, no settings mutation, no target-repo edit.
+ *
+ * Hard ban:
+ *   - MUST NOT install / invoke / import any external skill or MCP server.
+ *   - MUST NOT launch workers or mutate the target repo.
+ *   - MUST NOT touch `src/services/openspec/artifact-boundary.ts`,
+ *     `src/services/tech/`, or `src/services/rd-swarm/`.
+ */
+import { buildWorkspaceUnavailable, type Result, type BoundaryError } from '../openspec/artifact-boundary.js';
+export type AutonomousMode = 'code' | 'team';
+export type GoalCommandMarker = {
+    marker: '/goal';
+    nonDurable: true;
+    notes: string;
+};
+export type AutonomousGoalPackage = {
+    changeId: string;
+    goal: string;
+    mode: AutonomousMode;
+    autonomyMode: 'dry-run';
+    nonGoals: string[];
+    doneCondition: string;
+    resumeCondition: string;
+    riskNotes: string[];
+    goalCommand?: GoalCommandMarker;
+};
+export type CheckpointStatus = 'pending' | 'verified' | 'failed';
+export type Checkpoint = {
+    id: string;
+    name: string;
+    evidencePath: string;
+    status: CheckpointStatus;
+};
+export type WorkerQueueEntry = {
+    taskId: string;
+    wave: string;
+    status: 'planned' | 'running' | 'done' | 'blocked';
+    briefPath: string;
+    dependsOn: string[];
+};
+export type EvidenceRequirement = {
+    id: string;
+    kind: 'validation-report' | 'coverage-report' | 'reducer-report';
+    path: string;
+    required: boolean;
+};
+export type CapabilityEntry = {
+    source: string;
+    purpose: string;
+    trustLevel: 'internal' | 'external' | 'unknown';
+    activation: string;
+    risk: string;
+};
+export type CapabilityReuseResult = {
+    entries: CapabilityEntry[];
+    truncated: boolean;
+    warnings: string[];
+};
+export type ResumeInstructions = {
+    summary: string;
+    steps: string[];
+    checkpointStates: Array<{
+        id: string;
+        status: CheckpointStatus;
+    }>;
+};
+export type AutonomousRdPlan = {
+    changeId: string;
+    goal: string;
+    mode: AutonomousMode;
+    autonomyMode: 'dry-run';
+    available: boolean;
+    goalPackage: AutonomousGoalPackage;
+    capabilityReuse: CapabilityReuseResult;
+    checkpoints: Checkpoint[];
+    workerQueue: WorkerQueueEntry[];
+    evidence: EvidenceRequirement[];
+    artifactRoot: string;
+    gateStatus: {
+        techApprovalRequired: boolean;
+        techStatus: string;
+        skipReason?: string;
+    };
+    blockedReasons: string[];
+    nextActions: string[];
+    resumeInstructions: ResumeInstructions;
+};
+export type BuildAutonomousGoalPackageInput = {
+    changeId: string;
+    goal: string;
+    mode: AutonomousMode;
+    maxWorkers: number;
+    dryRun: true;
+    workspaceRoot: string;
+};
+export type PlanAutonomousRdSwarmInput = BuildAutonomousGoalPackageInput & {
+    requiresTechApproval?: boolean;
+};
+export declare function buildAutonomousGoalPackage(input: BuildAutonomousGoalPackageInput): AutonomousGoalPackage;
+export declare function planCapabilityReuse(input: {
+    workspaceRoot: string;
+}): CapabilityReuseResult;
+export declare function buildResumeInstructions(plan: AutonomousRdPlan): ResumeInstructions;
+export declare function planAutonomousRdSwarm(input: PlanAutonomousRdSwarmInput): AutonomousRdPlan;
+export type { Result, BoundaryError };
+export { buildWorkspaceUnavailable };