peaks-loop 4.0.0-beta.9 → 4.0.3

package/dist/services/understand/understand-scan-service.js

@@ -1,7 +1,7 @@
 import { stat } from 'node:fs/promises';
 import { join } from 'node:path';
-import { isDirectory, pathExists, readText } from '../../shared/fs.js';
-import { getErrorMessage } from '../../shared/result.js';
+import { isDirectory, pathExists, readText } from 'peaks-loop-shared/fs';
+import { getErrorMessage } from 'peaks-loop-shared/result';
 import { loadPreferences } from '../preferences/preferences-service.js';
 function defaultArtifactDir(projectRoot) {
     return join(projectRoot, '.understand-anything');

package/dist/services/upgrade/upgrade-service.js

@@ -271,10 +271,11 @@ export function runUpgrade(input) {
     // a Unix-style environment that can run the shim directly.
     const here = dirname(fileURLToPath(import.meta.url));
     // Walk up from the compiled location to find bin/peaks.js.
-    // The compiled service lives at dist/src/services/upgrade/upgrade-service.js;
-    // bin/peaks.js is at the peaks-loop root.
+    // The compiled service lives at dist/services/upgrade/upgrade-service.js
+    // (rootDir=src in tsconfig.build.json trims the "src" segment); bin/peaks.js
+    // is at the peaks-loop root, 3 dirs up.
     const peaksBin = input.peaksBin ??
-        resolve(here, '..', '..', '..', '..', 'bin', 'peaks.js');
+        resolve(here, '..', '..', '..', 'bin', 'peaks.js');
     const fallbackPeaks = 'peaks';
     const resolvedPeaksBin = existsSync(peaksBin) ? peaksBin : fallbackPeaks;
     // Resolve the executor once at the top of runUpgrade so every

package/dist/services/verdict/envelopes.d.ts

@@ -23,8 +23,8 @@
  *     "missing → null" contract). Callers can detect "envelope missing"
  *     without throwing.
  */
-import { type SecurityAuditEnvelope } from '../audit-independent/security-audit-service.js';
-import { type PerfAuditEnvelope } from '../audit-independent/perf-audit-service.js';
+import { type SecurityAuditEnvelope } from '../audit-independent/index.js';
+import { type PerfAuditEnvelope } from '../audit-independent/index.js';
 import { type KarpathyEnvelope, type MutEnvelope, type QaEnvelope, type AggregatorInput } from './verdict-aggregator.js';
 /**
  * `kind` is the discriminator. The on-disk file format is unchanged;

package/dist/services/verdict/envelopes.js

@@ -23,8 +23,8 @@
  *     "missing → null" contract). Callers can detect "envelope missing"
  *     without throwing.
  */
-import { isSecurityAuditEnvelope } from '../audit-independent/security-audit-service.js';
-import { isPerfAuditEnvelope } from '../audit-independent/perf-audit-service.js';
+import { isSecurityAuditEnvelope } from '../audit-independent/index.js';
+import { isPerfAuditEnvelope } from '../audit-independent/index.js';
 // ─── 5 parsers (pure, never throw) ─────────────────────────────────────
 /**
  * v2.13.3 AC-1 — parse real v2.12.0 audit markdown.

package/dist/services/verdict/verdict-aggregator.d.ts

@@ -27,9 +27,9 @@
  *     SecurityAuditEnvelope / PerfAuditEnvelope type re-exports.
  *   - hard precedence; no scoring, no weighting, no RFC voting.
  */
-import type { SecurityAuditEnvelope } from '../audit-independent/security-audit-service.js';
-import type { PerfAuditEnvelope } from '../audit-independent/perf-audit-service.js';
-import type { ThresholdViolation } from '../mut/thresholds.js';
+import type { SecurityAuditEnvelope } from '../audit-independent/index.js';
+import type { PerfAuditEnvelope } from '../audit-independent/index.js';
+import type { ThresholdViolation } from 'peaks-loop-mut';
 export interface KarpathyViolation {
     readonly guideline: 'think-before-coding' | 'simplicity-first' | 'surgical-changes' | 'goal-driven-execution';
     readonly severity: 'CRITICAL' | 'HIGH' | 'MED' | 'LOW';

package/dist/services/vm/vm-lease.d.ts

@@ -0,0 +1,40 @@
+export type VmHypervisor = 'kvm' | 'hyperkit' | 'hyperv';
+export declare const VM_HYPERVISORS: ReadonlyArray<VmHypervisor>;
+export declare const DEFAULT_TTL_BY_ROLE: Readonly<Record<string, number>>;
+export declare const DEFAULT_TTL_MS: number | undefined;
+export declare const DEFAULT_VM_IMAGE = "peaks-base:22-slim";
+export type VmLeaseStatus = 'active' | 'released' | 'expired' | 'gc';
+export interface VmLease {
+    readonly leaseId: string;
+    readonly rid: string;
+    readonly role: string;
+    /** Host path mounted into the VM working dir. */
+    readonly path: string;
+    /** Hypervisor the VM runs under (kvm | hyperkit | hyperv). */
+    readonly hypervisor: VmHypervisor;
+    /** VM image name (e.g. 'peaks-base:22-slim'). */
+    readonly image: string;
+    /** VM domain id reported by virsh / hvftool / hvc. */
+    readonly vmId: string;
+    /** Unix epoch ms when the lease was created. */
+    readonly createdAt: number;
+    /** Unix epoch ms when the lease expires. */
+    readonly expiresAt: number;
+    /** Operator-supplied purpose text (audit log). */
+    readonly purpose: string;
+    readonly status: VmLeaseStatus;
+    readonly consumedBySubAgents: ReadonlyArray<string>;
+}
+export type VmLeaseDraft = Omit<VmLease, 'status' | 'consumedBySubAgents'>;
+export declare function vmLeaseStoreDir(sessionRuntimeDir: string): string;
+export declare function vmLeaseFilePath(sessionRuntimeDir: string, leaseId: string): string;
+export declare function generateVmLeaseId(): string;
+export declare function ttlForVmRole(role: string): number;
+export declare function finalizeVmLease(draft: VmLeaseDraft): VmLease;
+export declare function markVmReleased(lease: VmLease): VmLease;
+export declare function markVmExpired(lease: VmLease): VmLease;
+export declare function markVmGc(lease: VmLease): VmLease;
+export declare function recordVmConsumption(lease: VmLease, subAgentId: string): VmLease;
+export declare function isVmLeaseActive(lease: VmLease, now?: number): boolean;
+export declare function serializeVmLease(lease: VmLease): string;
+export declare function deserializeVmLease(raw: string): VmLease;

package/dist/services/vm/vm-lease.js

@@ -0,0 +1,137 @@
+/**
+ * vm-lease — pure-function lease store for `peaks vm spawn`.
+ *
+ * Slice 2026-07-29-worktree-l2-extended Part 35 (L4 VM runtime).
+ * Parallels the design of `worktree-lease.ts` (Part 1) and
+ * `container-lease.ts` (Part 12). The L4 VM isolation mode
+ * (`--isolation vm` in dispatch) needs its own lease surface
+ * so the PreToolUse gate can grant `docker`-class operations
+ * to sub-agents that own a VM lease.
+ *
+ * Hypervisor support:
+ *   - kvm:     virsh create + virsh destroy (Linux KVM via libvirt)
+ *   - hyperkit: hvftool create + hvftool stop (macOS HyperKit)
+ *   - hyperv:  hvc create + hvc stop (Windows Hyper-V via the
+ *     Hyper-V cmdlets; the operator wires the entry shim)
+ *
+ * Each hypervisor has its own spawn pattern; the lease file
+ * records which hypervisor was used so `peaks vm release`
+ * can dispatch to the right cleanup command.
+ */
+import { randomBytes } from 'node:crypto';
+import { posix as path } from 'node:path';
+export const VM_HYPERVISORS = Object.freeze([
+    'kvm', 'hyperkit', 'hyperv'
+]);
+export const DEFAULT_TTL_BY_ROLE = Object.freeze({
+    rd: 30 * 60 * 1_000,
+    qa: 15 * 60 * 1_000,
+    ui: 60 * 60 * 1_000,
+    sc: 30 * 60 * 1_000,
+    prd: 15 * 60 * 1_000,
+    general: 30 * 60 * 1_000
+});
+export const DEFAULT_TTL_MS = DEFAULT_TTL_BY_ROLE.rd;
+export const DEFAULT_VM_IMAGE = 'peaks-base:22-slim';
+export function vmLeaseStoreDir(sessionRuntimeDir) {
+    return joinPath(sessionRuntimeDir, 'vm-leases');
+}
+export function vmLeaseFilePath(sessionRuntimeDir, leaseId) {
+    return joinPath(vmLeaseStoreDir(sessionRuntimeDir), `${leaseId}.json`);
+}
+export function generateVmLeaseId() {
+    return randomBytes(8).toString('hex');
+}
+export function ttlForVmRole(role) {
+    const normalized = role.toLowerCase();
+    const candidate = DEFAULT_TTL_BY_ROLE[normalized];
+    const fallback = DEFAULT_TTL_BY_ROLE['rd'] ?? 30 * 60 * 1_000;
+    return candidate ?? fallback;
+}
+export function finalizeVmLease(draft) {
+    return { ...draft, status: 'active', consumedBySubAgents: [] };
+}
+export function markVmReleased(lease) {
+    return { ...lease, status: 'released' };
+}
+export function markVmExpired(lease) {
+    return { ...lease, status: 'expired' };
+}
+export function markVmGc(lease) {
+    return { ...lease, status: 'gc' };
+}
+export function recordVmConsumption(lease, subAgentId) {
+    if (lease.consumedBySubAgents.includes(subAgentId))
+        return lease;
+    return { ...lease, consumedBySubAgents: [...lease.consumedBySubAgents, subAgentId] };
+}
+export function isVmLeaseActive(lease, now = Date.now()) {
+    return lease.status === 'active' && lease.expiresAt > now;
+}
+export function serializeVmLease(lease) {
+    return JSON.stringify(lease, null, 2) + '\n';
+}
+export function deserializeVmLease(raw) {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== 'object' || parsed === null) {
+        throw new Error('vm lease file must contain a JSON object');
+    }
+    const obj = parsed;
+    const required = [
+        'leaseId', 'rid', 'role', 'path', 'hypervisor', 'image', 'vmId',
+        'createdAt', 'expiresAt', 'purpose', 'status', 'consumedBySubAgents'
+    ];
+    for (const k of required) {
+        if (!(k in obj))
+            throw new Error(`vm lease missing field: ${k}`);
+    }
+    if (!VM_HYPERVISORS.includes(obj.hypervisor)) {
+        throw new Error(`vm lease hypervisor invalid: ${String(obj.hypervisor)}`);
+    }
+    if (typeof obj.leaseId !== 'string')
+        throw new Error('leaseId missing');
+    if (typeof obj.rid !== 'string')
+        throw new Error('rid missing');
+    if (typeof obj.role !== 'string')
+        throw new Error('role missing');
+    if (typeof obj.path !== 'string')
+        throw new Error('path missing');
+    if (typeof obj.image !== 'string')
+        throw new Error('image missing');
+    if (typeof obj.vmId !== 'string')
+        throw new Error('vmId missing');
+    if (typeof obj.createdAt !== 'number')
+        throw new Error('createdAt missing');
+    if (typeof obj.expiresAt !== 'number')
+        throw new Error('expiresAt missing');
+    if (typeof obj.purpose !== 'string')
+        throw new Error('purpose missing');
+    if (typeof obj.status !== 'string')
+        throw new Error('status missing');
+    if (!Array.isArray(obj.consumedBySubAgents))
+        throw new Error('consumedBySubAgents missing');
+    return {
+        leaseId: obj.leaseId,
+        rid: obj.rid,
+        role: obj.role,
+        path: obj.path,
+        hypervisor: obj.hypervisor,
+        image: obj.image,
+        vmId: obj.vmId,
+        createdAt: obj.createdAt,
+        expiresAt: obj.expiresAt,
+        purpose: obj.purpose,
+        status: obj.status,
+        consumedBySubAgents: obj.consumedBySubAgents
+    };
+}
+function joinPath(...segments) {
+    if (segments.length === 0)
+        return '';
+    const normalized = segments.map((s) => s.replace(/\\/g, '/'));
+    let acc = normalized[0];
+    for (let i = 1; i < normalized.length; i++) {
+        acc = path.join(acc, normalized[i]);
+    }
+    return acc;
+}

package/dist/services/workflow/autonomous-resume-writer.js

@@ -1,7 +1,7 @@
 import { mkdir, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { getSessionDir } from '../session/getSessionDir.js';
-import { pathExists } from '../../shared/fs.js';
+import { pathExists } from 'peaks-loop-shared/fs';
 import { isUnsafePathInput } from '../../shared/path-safety.js';
 function defaultClock() {
     return new Date().toISOString();

package/dist/services/workflow/pipeline-verify-gate-support.d.ts

@@ -0,0 +1,47 @@
+/**
+ * peaks-workflow — internal support helpers for pipeline verification.
+ *
+ * Private helpers used by the slimmed `pipeline-verify-service.ts`
+ * orchestrator. NOT publicly re-exported; not part of the public API
+ * surface. Kept in a sibling file so the orchestrator can stay under
+ * the 400-line file-size cap (rid-006 split).
+ *
+ * File budget: ≤ 400 lines (rid-006 split).
+ */
+import type { RequestType } from '../artifacts/artifact-prerequisites.js';
+import type { PipelineGate } from './pipeline-verify-types.js';
+export declare function extractState(markdown: string): string;
+/**
+ * As of slice 2026-06-05-change-id-as-unit-of-work, the file's durable
+ * scope is the change-id (the `.peaks/_runtime/<sessionId>/` dir the file lives
+ * in), NOT the session-id. We resolve the on-disk location via
+ * `showRequestArtifact` (which scans all top-level dirs and returns the
+ * actual dir the file was found in) instead of assuming
+ * `.peaks/_runtime/<sessionId>/<role>/requests/`.
+ */
+export declare function findRequestFile(projectRoot: string, role: string, rid: string): Promise<{
+    path: string;
+    content: string;
+    sessionId: string;
+} | null>;
+export declare function rdGatesForType(requestType: RequestType): PipelineGate[];
+export declare function qaGatesForType(requestType: RequestType): PipelineGate[];
+export declare const RD_QA_HANDOFF_STATES: Set<string>;
+export declare const QA_COMPLETE_STATES: Set<string>;
+/** Tracker for canonical-path compliance (slice 2026-06-28-code-mode-bypass-fix). */
+export interface CanonicalPathTracker {
+    anyEvidenceResolved: boolean;
+    allResolvedPathsCanonical: boolean;
+}
+/** Resolve RD evidence files (tech-doc / bug-analysis / code-review / security-review)
+ *  by probing canonical + legacy paths for each gate. Mutates the gate.passed /
+ *  gate.detail fields in place and pushes violations / nextActions. Returns the
+ *  updated tracker. Verbatim-move from `pipeline-verify-service.ts`. */
+export declare function resolveRdEvidencePaths(gates: PipelineGate[], rdEvidenceDir: string, projectRoot: string, violations: string[], nextActions: string[], tracker: CanonicalPathTracker): CanonicalPathTracker;
+/** Resolve QA evidence files (test-cases / test-report / security-findings /
+ *  performance-findings) by probing canonical + legacy paths for each gate.
+ *  For security/perf findings, delegates to the artifact-paths resolver.
+ *  Mutates the gate.passed / gate.detail fields in place and pushes
+ *  violations / nextActions. Returns the updated tracker. Verbatim-move
+ *  from `pipeline-verify-service.ts`. */
+export declare function resolveQaEvidencePaths(gates: PipelineGate[], projectRoot: string, rdEvidenceDir: string, changeIdForResolver: string, rid: string, violations: string[], nextActions: string[], tracker: CanonicalPathTracker): CanonicalPathTracker;

package/dist/services/workflow/pipeline-verify-gate-support.js

@@ -0,0 +1,194 @@
+/**
+ * peaks-workflow — internal support helpers for pipeline verification.
+ *
+ * Private helpers used by the slimmed `pipeline-verify-service.ts`
+ * orchestrator. NOT publicly re-exported; not part of the public API
+ * surface. Kept in a sibling file so the orchestrator can stay under
+ * the 400-line file-size cap (rid-006 split).
+ *
+ * File budget: ≤ 400 lines (rid-006 split).
+ */
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { showRequestArtifact } from '../artifacts/request-artifact-service.js';
+import { resolveSecurityFindingsPath, resolvePerformanceFindingsPath } from './artifact-paths.js';
+export function extractState(markdown) {
+    for (const rawLine of markdown.split(/\r?\n/)) {
+        const match = /^-\s*state:\s*(.+?)\s*$/.exec(rawLine.trim());
+        if (match?.[1])
+            return match[1];
+    }
+    return 'unknown';
+}
+/**
+ * As of slice 2026-06-05-change-id-as-unit-of-work, the file's durable
+ * scope is the change-id (the `.peaks/_runtime/<sessionId>/` dir the file lives
+ * in), NOT the session-id. We resolve the on-disk location via
+ * `showRequestArtifact` (which scans all top-level dirs and returns the
+ * actual dir the file was found in) instead of assuming
+ * `.peaks/_runtime/<sessionId>/<role>/requests/`.
+ */
+export async function findRequestFile(projectRoot, role, rid) {
+    const artifact = await showRequestArtifact({ projectRoot, role: role, requestId: rid });
+    if (artifact === null)
+        return null;
+    // Slice 2026-06-28-code-mode-bypass-fix (defect #3): the legacy
+    // `showRequestArtifact` returns the FULL SCOPE (`_runtime/<sid>`)
+    // as `sessionId`, not just the trailing id segment. The canonical
+    // evidence lookup needs only the bare id (`.peaks/_runtime/change/<id>/`).
+    // When the scope starts with `_runtime/`, strip that prefix so the
+    // path resolver builds the right canonical location.
+    let sessionId = artifact.sessionId;
+    if (sessionId.startsWith('_runtime/') || sessionId.startsWith('_runtime\\')) {
+        sessionId = sessionId.replace(/^_runtime[\\/]/, '');
+    }
+    return { path: artifact.path, content: artifact.content, sessionId };
+}
+export function rdGatesForType(requestType) {
+    const gates = [
+        { name: 'rd-request-exists', description: 'RD request artifact created', passed: false, detail: '' }
+    ];
+    if (requestType === 'feature' || requestType === 'refactor') {
+        gates.push({ name: 'tech-doc', description: 'Technical design doc', passed: false, detail: '' });
+    }
+    if (requestType === 'bugfix') {
+        gates.push({ name: 'bug-analysis', description: 'Bug root-cause analysis', passed: false, detail: '' });
+    }
+    if (requestType !== 'docs' && requestType !== 'chore' && requestType !== 'config') {
+        gates.push({ name: 'code-review', description: 'Code review evidence', passed: false, detail: '' });
+    }
+    if (requestType === 'feature' || requestType === 'refactor' || requestType === 'bugfix' || requestType === 'config') {
+        gates.push({ name: 'security-review', description: 'Security review evidence', passed: false, detail: '' });
+    }
+    return gates;
+}
+export function qaGatesForType(requestType) {
+    const gates = [
+        { name: 'qa-request-exists', description: 'QA request artifact created', passed: false, detail: '' }
+    ];
+    if (requestType === 'feature' || requestType === 'refactor' || requestType === 'bugfix') {
+        gates.push({ name: 'test-cases', description: 'QA test cases', passed: false, detail: '' });
+        gates.push({ name: 'test-report', description: 'QA test report with execution results', passed: false, detail: '' });
+    }
+    if (requestType === 'feature' || requestType === 'refactor' || requestType === 'bugfix' || requestType === 'config') {
+        gates.push({ name: 'security-findings', description: 'QA security findings', passed: false, detail: '' });
+    }
+    if (requestType === 'feature' || requestType === 'refactor') {
+        gates.push({ name: 'performance-findings', description: 'QA performance findings', passed: false, detail: '' });
+    }
+    return gates;
+}
+export const RD_QA_HANDOFF_STATES = new Set(['qa-handoff', 'handed-off', 'implemented']);
+export const QA_COMPLETE_STATES = new Set(['verdict-issued']);
+/** Resolve RD evidence files (tech-doc / bug-analysis / code-review / security-review)
+ *  by probing canonical + legacy paths for each gate. Mutates the gate.passed /
+ *  gate.detail fields in place and pushes violations / nextActions. Returns the
+ *  updated tracker. Verbatim-move from `pipeline-verify-service.ts`. */
+export function resolveRdEvidencePaths(gates, rdEvidenceDir, projectRoot, violations, nextActions, tracker) {
+    const RD_EVIDENCE_FILE = {
+        'tech-doc': 'tech-doc.md',
+        'bug-analysis': 'bug-analysis.md',
+        'code-review': 'code-review.md',
+        'security-review': 'security-review.md'
+    };
+    let anyEvidenceResolved = tracker.anyEvidenceResolved;
+    let allResolvedPathsCanonical = tracker.allResolvedPathsCanonical;
+    for (const gate of gates.slice(1)) {
+        const fileName = RD_EVIDENCE_FILE[gate.name];
+        const canonicalPath = join(projectRoot, '.peaks', '_runtime', rdEvidenceDir, 'rd', fileName);
+        const legacyMisplacedPath = join(projectRoot, '.peaks', rdEvidenceDir, 'rd', fileName);
+        const legacyChangeAxisPath = join(projectRoot, '.peaks', '_runtime', 'change', rdEvidenceDir, 'rd', fileName);
+        let resolvedPath = null;
+        let usedLegacy = false;
+        for (const candidate of [canonicalPath, legacyMisplacedPath, legacyChangeAxisPath]) {
+            if (existsSync(candidate)) {
+                resolvedPath = candidate;
+                usedLegacy = candidate !== canonicalPath;
+                break;
+            }
+        }
+        if (resolvedPath !== null) {
+            anyEvidenceResolved = true;
+            if (usedLegacy)
+                allResolvedPathsCanonical = false;
+            gate.passed = true;
+            gate.detail = resolvedPath + (usedLegacy ? ' [DEPRECATION_LEGACY_PATH_USED]' : '');
+            if (usedLegacy) {
+                violations.push(`DEPRECATION_LEGACY_PATH_USED: ${resolvedPath} — move the file into .peaks/_runtime/${rdEvidenceDir}/rd/ (the canonical location) so subsequent runs resolve on the canonical path. The legacy \`peaks workspace migrate-change-scope\` helper was removed in v2.19.0; use \`peaks workspace migrate\` to relocate misplaced content.`);
+            }
+        }
+        else {
+            gate.detail = `missing: ${canonicalPath}`;
+            violations.push(`RD evidence missing: ${gate.description} (${fileName})`);
+            nextActions.push(`Create .peaks/_runtime/${rdEvidenceDir}/rd/${fileName}`);
+        }
+    }
+    return { anyEvidenceResolved, allResolvedPathsCanonical };
+}
+/** Resolve QA evidence files (test-cases / test-report / security-findings /
+ *  performance-findings) by probing canonical + legacy paths for each gate.
+ *  For security/perf findings, delegates to the artifact-paths resolver.
+ *  Mutates the gate.passed / gate.detail fields in place and pushes
+ *  violations / nextActions. Returns the updated tracker. Verbatim-move
+ *  from `pipeline-verify-service.ts`. */
+export function resolveQaEvidencePaths(gates, projectRoot, rdEvidenceDir, changeIdForResolver, rid, violations, nextActions, tracker) {
+    const QA_EVIDENCE_FILE = {
+        'test-cases': `test-cases/${rid}.md`,
+        'test-report': `test-reports/${rid}.md`,
+        'security-findings': '',
+        'performance-findings': ''
+    };
+    let anyEvidenceResolved = tracker.anyEvidenceResolved;
+    let allResolvedPathsCanonical = tracker.allResolvedPathsCanonical;
+    for (const gate of gates.slice(1)) {
+        if (gate.name === 'security-findings' || gate.name === 'performance-findings') {
+            const resolver = gate.name === 'security-findings' ? resolveSecurityFindingsPath : resolvePerformanceFindingsPath;
+            const resolved = resolver({ projectRoot, sessionId: changeIdForResolver, rid });
+            if (existsSync(resolved.path)) {
+                anyEvidenceResolved = true;
+                if (resolved.form === 'legacy')
+                    allResolvedPathsCanonical = false;
+                gate.passed = true;
+                gate.detail = resolved.path;
+                if (resolved.form === 'legacy') {
+                    violations.push(`QA evidence accepted in legacy form (will be rejected after next minor release): ${resolved.path} — re-run peaks workflow plan refresh to migrate`);
+                }
+            }
+            else {
+                gate.detail = `missing: ${resolved.path}`;
+                violations.push(`QA evidence missing: ${gate.description} (${resolved.path})`);
+                nextActions.push(`Create ${resolved.path} (or use the legacy non-suffixed form during the 1-minor-release back-compat window)`);
+            }
+            continue;
+        }
+        const fileName = QA_EVIDENCE_FILE[gate.name];
+        const canonicalQaPath = join(projectRoot, '.peaks', '_runtime', rdEvidenceDir, 'qa', fileName);
+        const legacyMisplacedQaPath = join(projectRoot, '.peaks', rdEvidenceDir, 'qa', fileName);
+        const legacyChangeAxisQaPath = join(projectRoot, '.peaks', '_runtime', 'change', rdEvidenceDir, 'qa', fileName);
+        let resolvedQaPath = null;
+        let usedLegacyQa = false;
+        for (const candidate of [canonicalQaPath, legacyMisplacedQaPath, legacyChangeAxisQaPath]) {
+            if (existsSync(candidate)) {
+                resolvedQaPath = candidate;
+                usedLegacyQa = candidate !== canonicalQaPath;
+                break;
+            }
+        }
+        if (resolvedQaPath !== null) {
+            anyEvidenceResolved = true;
+            if (usedLegacyQa)
+                allResolvedPathsCanonical = false;
+            gate.passed = true;
+            gate.detail = resolvedQaPath + (usedLegacyQa ? ' [DEPRECATION_LEGACY_PATH_USED]' : '');
+            if (usedLegacyQa) {
+                violations.push(`DEPRECATION_LEGACY_PATH_USED: ${resolvedQaPath} — move the file into .peaks/_runtime/${rdEvidenceDir}/qa/ (the canonical location) so subsequent runs resolve on the canonical path. The legacy \`peaks workspace migrate-change-scope\` helper was removed in v2.19.0; use \`peaks workspace migrate\` to relocate misplaced content.`);
+            }
+        }
+        else {
+            gate.detail = `missing: ${canonicalQaPath}`;
+            violations.push(`QA evidence missing: ${gate.description} (${fileName})`);
+            nextActions.push(`Create .peaks/_runtime/${rdEvidenceDir}/qa/${fileName}`);
+        }
+    }
+    return { anyEvidenceResolved, allResolvedPathsCanonical };
+}

package/dist/services/workflow/pipeline-verify-service.d.ts

@@ -1,84 +1,19 @@
-import type { RequestType } from '../artifacts/artifact-prerequisites.js';
-export type PipelineGate = {
-    name: string;
-    description: string;
-    passed: boolean;
-    detail: string;
-    /**
-     * Slice 2026-06-13-peaks-workflow-skip: optional status that
-     * distinguishes a gate that was BYPASSED via `peaks workflow skip`
-     * from one that actually passed evaluation. When set, the gate
-     * was NOT evaluated by `evaluateGate` — the user/CLI explicitly
-     * marked it as skipped. The boolean `passed` is set to `true` so
-     * existing consumers (which only check `passed`) treat a skipped
-     * gate as "satisfied", but downstream consumers that need
-     * audit-grade distinction (e.g. CI badges, dashboards) can read
-     * `status` to tell pass / fail / skipped apart.
-     *
-     *   - omitted (default): not set, gate was evaluated; treat as legacy.
-     *   - 'pass':          gate evaluated and passed.
-     *   - 'fail':          gate evaluated and failed.
-     *   - 'skipped':       gate was bypassed; never evaluated.
-     */
-    status?: 'pass' | 'fail' | 'skipped';
-};
-export type PipelineVerification = {
-    rid: string;
-    sessionId: string;
-    requestType: RequestType;
-    complete: boolean;
-    rdPhase: {
-        invoked: boolean;
-        state: string;
-        gates: PipelineGate[];
-    };
-    qaPhase: {
-        invoked: boolean;
-        state: string;
-        gates: PipelineGate[];
-    };
-    /**
-     * Slice 002 (v2.15.0) AC-3: Gate H "feedback-promotion". Always
-     * present (single-element array). Evaluates whether every
-     * `metadata.type === 'feedback'` memory in `.peaks/memory/`
-     * carries a promotion marker (comment OR sidecar). Failures
-     * block the `complete` verdict via the `gateH` field below; the
-     * pipeline only completes when every gate in this array passes.
-     */
-    feedbackPhase?: {
-        gates: PipelineGate[];
-    };
-    violations: string[];
-    nextActions: string[];
-    /** Form of the security/performance findings artifacts Gate C accepted
-     * (slice 025). `'suffixed'` for the new per-rid form, `'legacy'` for the
-     * pre-slice-025 non-suffixed form, `'none'` when neither was found. */
-    acceptedForm?: 'suffixed' | 'legacy' | 'none';
-    /** `gateC` is the pre-computed verdict string (AC7 dogfood shape). */
-    gateC?: 'pass' | 'fail';
-    /**
-     * Slice 002 (v2.15.0) AC-3: Gate H verdict string. `'pass'` when
-     * all feedback memories are promoted; `'fail'` when at least one
-     * unpromoted feedback memory was found.
-     */
-    gateH?: 'pass' | 'fail';
-    /**
-     * Slice 2026-06-28-code-mode-bypass-fix (defect #3): `true` when
-     * every evidence file resolved on the canonical path
-     * (`.peaks/_runtime/change/<sessionId>/...`). `false` when at least
-     * one evidence file resolved via a legacy fallback (`.peaks/<sessionId>/...`
-     * or `.peaks/_runtime/<sessionId>/...`). QA / TXT surface the value
-     * so users know to move misplaced evidence into the canonical
-     * location.
-     *
-     * Slice 2026-06-29-change-id-root-removal: the legacy
-     * `peaks workspace migrate-change-scope` migration tool is gone;
-     * users must now move misplaced content into the canonical
-     * `.peaks/_runtime/change/<sessionId>/<role>/` dir manually (or via
-     * `peaks workspace migrate`).
-     */
-    usedCanonicalPath?: boolean;
-};
+/**
+ * peaks-workflow — pipeline verification orchestrator (slimmed per rid-006).
+ *
+ * `verifyPipeline` resolves RD / QA evidence files for a given rid and
+ * returns a structured `PipelineVerification` envelope. Type
+ * declarations live in `pipeline-verify-types.ts`; private gate
+ * helpers (`rdGatesForType`, `qaGatesForType`, `extractState`,
+ * `findRequestFile`, the `_runtime/` prefix strip, the RD/QA handoff
+ * state sets, and the RD/QA evidence path probes) live in
+ * `pipeline-verify-gate-support.ts`. The re-export shim at the
+ * bottom preserves the original public surface so existing import
+ * paths compile unchanged.
+ *
+ * File budget: ≤ 400 lines (rid-006 split).
+ */
+import type { PipelineVerification } from './pipeline-verify-types.js';
 export declare function verifyPipeline(options: {
     projectRoot: string;
     rid: string;
@@ -88,3 +23,4 @@ export declare function verifyPipeline(options: {
     sessionId?: string;
     requestType?: string;
 }): Promise<PipelineVerification>;
+export type { PipelineGate, PipelineVerification } from './pipeline-verify-types.js';