peaks-loop 4.0.16 → 4.0.18

package/dist/services/dispatch/dispatch-record-writer.js

@@ -30,7 +30,21 @@ import { assertSafeDispatchRecordPath, dispatchRecordPath } from '../security/sa
 import { withFileLockSync } from 'peaks-loop-shared-channel';
 import { isStageLabel } from './stage-enum.js';
 import { emitLeaseEvent } from '../observability/observability-service.js';
-const MAX_PROMPT_BYTES = 256 * 1024;
+/**
+ * PRD-002b slice 2 — extract dispatch-record size budgets (max-prompt
+ * bytes, note truncation cap) + time-math primitives so the
+ * no-magic-numbers rule stops flagging the writer pipeline.
+ */
+const BYTES_PER_KB = 1024;
+const MAX_PROMPT_KB = 256;
+const MAX_PROMPT_BYTES = MAX_PROMPT_KB * BYTES_PER_KB;
+const NOTE_MAX_CHARS = 200;
+const MS_PER_SECOND = 1_000;
+const SECONDS_PER_MINUTE = 60;
+const MINUTES_PER_HOUR = 60;
+const HOURS_PER_DAY = 24;
+const MS_PER_DAY = HOURS_PER_DAY * MINUTES_PER_HOUR * SECONDS_PER_MINUTE * MS_PER_SECOND;
+const REDACTION_MAX_SCAN_DEPTH = 20;
 /** Write a new dispatch record (G2 + G5 + G6). Returns the absolute path. */
 export function writeInitialDispatchRecord(input) {
     const { projectRoot, sessionId, requestId, role, prompt, toolCall, batchId } = input;
@@ -43,7 +57,35 @@ export function writeInitialDispatchRecord(input) {
     }
     const path = dispatchRecordPath(projectRoot, sessionId, requestId, now());
     const safePath = assertSafeDispatchRecordPath(path, projectRoot);
-    const record = {
+    const record = buildInitialDispatchRecord(input, now);
+    writeAtomic(safePath, record);
+    // Slice 2026-06-23-audit-4th #A4: register the path in the
+    // session's active-dispatches index so a future restart can
+    // discover in-flight records without scanning the directory.
+    // The index is best-effort (no lock): the on-disk record is the
+    // source of truth; the index is purely a hint for the LLM-side
+    // runner. A crash between writeAtomic and the index write is
+    // non-fatal — the next restart scans the directory anyway.
+    registerActiveDispatch({
+        projectRoot,
+        sessionId,
+        recordPath: safePath,
+        requestId,
+        role,
+        batchId,
+        now
+    });
+    return { path: safePath, record };
+}
+/**
+ * Construct the initial `DispatchRecord` from a `WriteInitialDispatchInput`.
+ * PRD-002b slice 6: extracted from `writeInitialDispatchRecord` so the
+ * writer stays under the `max-lines-per-function: 50` ESLint ceiling.
+ * Behavior is byte-identical to the previous inline literal.
+ */
+function buildInitialDispatchRecord(input, now) {
+    const { role, requestId, sessionId, prompt, toolCall, batchId } = input;
+    return {
         version: '4.0.0',
         createdAt: now().toISOString(),
         completedAt: null,
@@ -100,24 +142,6 @@ export function writeInitialDispatchRecord(input) {
         graphNodeId: typeof input.graphNodeId === 'string' && /^[a-zA-Z0-9._-]{1,200}$/.test(input.graphNodeId) ? input.graphNodeId : null,
         graphRef: typeof input.graphRef === 'string' && input.graphRef.length > 0 ? input.graphRef : null,
     };
-    writeAtomic(safePath, record);
-    // Slice 2026-06-23-audit-4th #A4: register the path in the
-    // session's active-dispatches index so a future restart can
-    // discover in-flight records without scanning the directory.
-    // The index is best-effort (no lock): the on-disk record is the
-    // source of truth; the index is purely a hint for the LLM-side
-    // runner. A crash between writeAtomic and the index write is
-    // non-fatal — the next restart scans the directory anyway.
-    registerActiveDispatch({
-        projectRoot,
-        sessionId,
-        recordPath: safePath,
-        requestId,
-        role,
-        batchId,
-        now
-    });
-    return { path: safePath, record };
 }
 function activeDispatchIndexPath(projectRoot, sessionId) {
     return resolve(projectRoot, '.peaks', '_sub_agents', sessionId, 'active-dispatches.json');
@@ -238,7 +262,7 @@ export function isOrphanDispatchRecord(opts) {
     const s = statSync(opts.recordPath);
     const now = opts.now ?? new Date();
     const ageMs = now.getTime() - s.mtimeMs;
-    const ttlMs = DISPATCH_RECORD_TTL_DAYS * 24 * 60 * 60 * 1000;
+    const ttlMs = DISPATCH_RECORD_TTL_DAYS * MS_PER_DAY;
     return ageMs > ttlMs;
 }
 /** Append a heartbeat (G6). Idempotent on (at, status) — append-only. */
@@ -250,7 +274,7 @@ export function appendHeartbeat(input) {
         err.code = 'INVALID_PROGRESS';
         throw err;
     }
-    if (note !== undefined && note.length > 200) {
+    if (note !== undefined && note.length > NOTE_MAX_CHARS) {
         const err = new Error(`note must be ≤ 200 chars (got ${note.length})`);
         err.code = 'NOTE_TOO_LONG';
         throw err;
@@ -345,68 +369,7 @@ export function tryAutoReleaseLease(args) {
     // `node:child_process` is loaded via dynamic import so this module
     // remains ESM-compatible (the compiled heartbeat CLI throws
     // `require is not defined` if we use `require` here).
-    void (async () => {
-        let spawned = false;
-        try {
-            const cp = await import('node:child_process');
-            const child = cp.spawn(process.execPath, [
-                process.argv[1] ?? '',
-                'worktree', 'release',
-                '--lease-id', args.leaseId,
-                '--project', args.projectRoot,
-                '--session', args.sessionId,
-                '--json'
-            ], 
-            // `pipe` rather than `ignore` so a spawn failure (e.g. ENOENT
-            // on process.argv[1] in a test) shows up on stderr instead
-            // of vanishing into the void. The release CLI is short-lived
-            // so buffering is irrelevant.
-            { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true, detached: true });
-            spawned = true;
-            if (process.env.PEAKS_WORKTREE_LEASE_DEBUG) {
-                child.stderr?.on('data', (d) => process.stderr.write(`[release] ${d.toString('utf8')}`));
-                child.stdout?.on('data', (d) => process.stderr.write(`[release] ${d.toString('utf8')}`));
-                child.on('error', (e) => process.stderr.write(`[release error] ${e.message}\n`));
-                child.on('exit', (code) => process.stderr.write(`[release exit] code=${code}\n`));
-            }
-            else {
-                child.stderr?.on('data', () => { });
-                child.stdout?.on('data', () => { });
-                child.on('error', () => { });
-            }
-            child.unref();
-        }
-        catch (e) {
-            // Slice 2026-07-29-worktree-l2-extended Part 4.A: surface
-            // auto-release failures to the observability stream so the
-            // dashboard can alert. The spawn-attempt itself threw (not
-            // a child-process exit-code failure — those are not
-            // catchable from the parent because the child is detached
-            // and unref'd). emitLeaseEvent is fire-and-forget; it
-            // returns a result we don't inspect.
-            emitLeaseEvent({
-                sessionId: args.sessionId,
-                projectRoot: args.projectRoot,
-                kind: 'autoRelease-failed',
-                leaseId: args.leaseId,
-                reason: e.message
-            });
-        }
-        if (spawned) {
-            // Record the success path. Idempotent with the manual
-            // `peaks worktree release` metric — the release CLI itself
-            // emits a 'release' event when it runs and lands. Two
-            // events for one logical release is acceptable; the
-            // dashboard can dedup or count both under
-            // lease.autoRelease.count.
-            emitLeaseEvent({
-                sessionId: args.sessionId,
-                projectRoot: args.projectRoot,
-                kind: 'autoRelease',
-                leaseId: args.leaseId
-            });
-        }
-    })();
+    void spawnLeaseReleaseChild(args);
     // NB: we deliberately do NOT log per-call here — every heartbeat
     // that reports done in a busy session would otherwise spam the
     // log. The release CLI itself emits a structured envelope on
@@ -415,6 +378,75 @@ export function tryAutoReleaseLease(args) {
         args.logger(`peaks.worktree.autoRelease leaseId=${args.leaseId} sessionId=${args.sessionId}`);
     }
 }
+/**
+ * Spawn the detached `peaks worktree release` subprocess.
+ * PRD-002b slice 6: extracted from `tryAutoReleaseLease` so the
+ * public wrapper stays under the `max-lines-per-function: 50`
+ * ESLint ceiling. Behavior is byte-identical to the previous
+ * inline IIFE.
+ */
+async function spawnLeaseReleaseChild(args) {
+    let spawned = false;
+    try {
+        const cp = await import('node:child_process');
+        const child = cp.spawn(process.execPath, [
+            process.argv[1] ?? '',
+            'worktree', 'release',
+            '--lease-id', args.leaseId,
+            '--project', args.projectRoot,
+            '--session', args.sessionId,
+            '--json'
+        ], 
+        // `pipe` rather than `ignore` so a spawn failure (e.g. ENOENT
+        // on process.argv[1] in a test) shows up on stderr instead
+        // of vanishing into the void. The release CLI is short-lived
+        // so buffering is irrelevant.
+        { stdio: ['ignore', 'pipe', 'pipe'], windowsHide: true, detached: true });
+        spawned = true;
+        if (process.env.PEAKS_WORKTREE_LEASE_DEBUG) {
+            child.stderr?.on('data', (d) => process.stderr.write(`[release] ${d.toString('utf8')}`));
+            child.stdout?.on('data', (d) => process.stderr.write(`[release] ${d.toString('utf8')}`));
+            child.on('error', (e) => process.stderr.write(`[release error] ${e.message}\n`));
+            child.on('exit', (code) => process.stderr.write(`[release exit] code=${code}\n`));
+        }
+        else {
+            child.stderr?.on('data', () => { });
+            child.stdout?.on('data', () => { });
+            child.on('error', () => { });
+        }
+        child.unref();
+    }
+    catch (e) {
+        // Slice 2026-07-29-worktree-l2-extended Part 4.A: surface
+        // auto-release failures to the observability stream so the
+        // dashboard can alert. The spawn-attempt itself threw (not
+        // a child-process exit-code failure — those are not
+        // catchable from the parent because the child is detached
+        // and unref'd). emitLeaseEvent is fire-and-forget; it
+        // returns a result we don't inspect.
+        emitLeaseEvent({
+            sessionId: args.sessionId,
+            projectRoot: args.projectRoot,
+            kind: 'autoRelease-failed',
+            leaseId: args.leaseId,
+            reason: e.message
+        });
+    }
+    if (spawned) {
+        // Record the success path. Idempotent with the manual
+        // `peaks worktree release` metric — the release CLI itself
+        // emits a 'release' event when it runs and lands. Two
+        // events for one logical release is acceptable; the
+        // dashboard can dedup or count both under
+        // lease.autoRelease.count.
+        emitLeaseEvent({
+            sessionId: args.sessionId,
+            projectRoot: args.projectRoot,
+            kind: 'autoRelease',
+            leaseId: args.leaseId
+        });
+    }
+}
 /** Mark a record as completed (success / failed / cancelled / no-execution). */
 export function markCompleted(input) {
     // Slice 2026-06-23-audit-3rd #3: lock + re-read so a concurrent
@@ -444,55 +476,7 @@ export function markCompleted(input) {
     // (best-effort; the dispatch record itself is the source of truth
     // and the transition is observable through the graph store).
     if (result.record.workflowId !== null && result.record.graphNodeId !== null && result.record.graphRef !== null) {
-        try {
-            // Lazy ESM dynamic import: the graph lifecycle service is not
-            // on the dispatch hot path; it would be wasteful to import it
-            // for non-graph-bound dispatches. ESM dynamic import returns
-            // a promise; we do not await (best-effort) — the dispatch
-            // record write is the load-bearing artifact, and the graph
-            // node transition is observable to the next CLI call.
-            void (async () => {
-                try {
-                    const lifecycleMod = await import('../workflow/workflow-node-lifecycle.js');
-                    const storeMod = await import('../workflow/workflow-graph-store.js');
-                    const sessionRoot = (() => {
-                        try {
-                            return storeMod.graphPathFor({
-                                projectRoot: input.projectRoot ?? '',
-                                sessionId: result.record.sessionId,
-                                graphRef: result.record.graphRef ?? '',
-                                workflowId: result.record.workflowId ?? '',
-                            });
-                        }
-                        catch {
-                            return null;
-                        }
-                    })();
-                    if (sessionRoot === null)
-                        return;
-                    const graph = storeMod.readGraph({
-                        projectRoot: input.projectRoot ?? '',
-                        sessionId: result.record.sessionId,
-                        graphRef: result.record.graphRef ?? '',
-                        workflowId: result.record.workflowId ?? '',
-                    });
-                    const node = graph.nodes.find((n) => n.id === result.record.graphNodeId);
-                    if (node === undefined)
-                        return;
-                    // Use the dispatch record's path as the dispatchRef. The
-                    // record itself is the load-bearing artifact; the
-                    // graph-node transition is a derived side-effect.
-                    const dispatchRef = input.recordPath;
-                    lifecycleMod.writeEnvelope({
-                        graphNode: node,
-                        dispatchRef,
-                        envelopeDispatchRef: dispatchRef,
-                    });
-                }
-                catch { /* best-effort graph transition */ }
-            })();
-        }
-        catch { /* best-effort */ }
+        scheduleGraphEnvelopeTransition(input, result.record);
     }
     // Slice 2026-06-23-audit-4th #A4: update the active-dispatches
     // index. Best-effort (the on-disk record is the source of truth);
@@ -533,6 +517,67 @@ export function markCompleted(input) {
     }
     return result;
 }
+/**
+ * Schedule a detached graph-envelope transition for a completed dispatch.
+ * PRD-002b slice 6: extracted from `markCompleted` to keep that function
+ * under the `max-lines-per-function: 50` ESLint ceiling. Behavior is
+ * byte-identical to the previous inline block:
+ *   - skip when graph binding fields are all non-null on the record;
+ *   - dynamic ESM import the lifecycle + store modules (not on hot path);
+ *   - best-effort; failures swallowed so the dispatch record write is
+ *     load-bearing and the next CLI call can observe the transition.
+ */
+function scheduleGraphEnvelopeTransition(input, record) {
+    try {
+        // Lazy ESM dynamic import: the graph lifecycle service is not
+        // on the dispatch hot path; it would be wasteful to import it
+        // for non-graph-bound dispatches. ESM dynamic import returns
+        // a promise; we do not await (best-effort) — the dispatch
+        // record write is the load-bearing artifact, and the graph
+        // node transition is observable to the next CLI call.
+        void (async () => {
+            try {
+                const lifecycleMod = await import('../workflow/workflow-node-lifecycle.js');
+                const storeMod = await import('../workflow/workflow-graph-store.js');
+                const sessionRoot = (() => {
+                    try {
+                        return storeMod.graphPathFor({
+                            projectRoot: input.projectRoot ?? '',
+                            sessionId: record.sessionId,
+                            graphRef: record.graphRef ?? '',
+                            workflowId: record.workflowId ?? '',
+                        });
+                    }
+                    catch {
+                        return null;
+                    }
+                })();
+                if (sessionRoot === null)
+                    return;
+                const graph = storeMod.readGraph({
+                    projectRoot: input.projectRoot ?? '',
+                    sessionId: record.sessionId,
+                    graphRef: record.graphRef ?? '',
+                    workflowId: record.workflowId ?? '',
+                });
+                const node = graph.nodes.find((n) => n.id === record.graphNodeId);
+                if (node === undefined)
+                    return;
+                // Use the dispatch record's path as the dispatchRef. The
+                // record itself is the load-bearing artifact; the
+                // graph-node transition is a derived side-effect.
+                const dispatchRef = input.recordPath;
+                lifecycleMod.writeEnvelope({
+                    graphNode: node,
+                    dispatchRef,
+                    envelopeDispatchRef: dispatchRef,
+                });
+            }
+            catch { /* best-effort graph transition */ }
+        })();
+    }
+    catch { /* best-effort */ }
+}
 /** Mark a record as disposed (reducer ran). */
 export function markDisposed(recordPath, now = () => new Date()) {
     // Lock + re-read (see markCompleted).
@@ -626,6 +671,42 @@ function upgradeRecord(parsed) {
         throw new Error(`Dispatch record version mismatch: expected '4.0.0', '3.2', '3.1', 3, 2, or 1, got ${JSON.stringify(rawVersion)}. ` +
             'The v1 → v4.0.0 migration is in-file; records from much older or newer builds must be regenerated.');
     }
+    const legacy = parseUpgradeRecordLegacyFields(obj);
+    const migration = parseUpgradeRecordMigrationFields(obj);
+    return {
+        version: '4.0.0',
+        createdAt: legacy.createdAt,
+        completedAt: legacy.completedAt,
+        outcome: legacy.outcome,
+        artifactPaths: legacy.artifactPaths,
+        disposed: legacy.disposed,
+        disposedAt: legacy.disposedAt,
+        role: legacy.role,
+        requestId: legacy.requestId,
+        sessionId: legacy.sessionId,
+        prompt: legacy.prompt,
+        toolCall: legacy.toolCall,
+        batchId: legacy.batchId,
+        heartbeats: legacy.heartbeats,
+        lastBeatAt: legacy.lastBeatAt,
+        status: legacy.status,
+        stage: migration.stage,
+        leaseId: migration.leaseId,
+        isolationStartedAt: migration.isolationStartedAt,
+        serviceKill: migration.serviceKill,
+        mergeBackAttempts: migration.mergeBackAttempts,
+        workflowId: migration.workflowId,
+        graphNodeId: migration.graphNodeId,
+        graphRef: migration.graphRef
+    };
+}
+/**
+ * Parse the v1..v3.2 core fields of a legacy dispatch record.
+ * PRD-002b slice 6: extracted from `upgradeRecord` so the reader
+ * stays under the `max-lines-per-function: 50` ESLint ceiling.
+ * Behavior is byte-identical to the previous inline block.
+ */
+function parseUpgradeRecordLegacyFields(obj) {
     const role = stringField(obj, 'role');
     const requestId = stringField(obj, 'requestId');
     const sessionId = stringField(obj, 'sessionId');
@@ -666,22 +747,31 @@ function upgradeRecord(parsed) {
         ? obj.batchId
         : 'legacy-batch';
     return {
-        version: '4.0.0',
-        createdAt,
-        completedAt,
-        outcome,
-        artifactPaths,
-        disposed,
-        disposedAt,
         role,
         requestId,
         sessionId,
         prompt,
         toolCall,
-        batchId,
+        createdAt,
         heartbeats,
         lastBeatAt,
         status,
+        completedAt,
+        outcome,
+        artifactPaths,
+        disposed,
+        disposedAt,
+        batchId
+    };
+}
+/**
+ * Parse the post-v3 migration fields of a legacy dispatch record.
+ * PRD-002b slice 6: extracted from `upgradeRecord` so the reader
+ * stays under the `max-lines-per-function: 50` ESLint ceiling.
+ * Behavior is byte-identical to the previous inline block.
+ */
+function parseUpgradeRecordMigrationFields(obj) {
+    return {
         // Slice 2026-07-29-dispatch-stall-governance / S5 (AC-5.1 / PB-2)
         // — legacy records (pre-slice) had no `stage` field. The reader
         // defaults to `null` so the watch surface can tell "no stage ever

package/dist/services/evolution/evolution-types.js

@@ -1,4 +1,21 @@
 import { z } from "zod";
+/* ---------------------------------------------------------------------- */
+/* PRD-002b slice 2 — schema-limit constants extracted from inline         */
+/* `.max(N)` calls so the no-magic-numbers rule stops flagging the        */
+/* constraint values. Names describe the field, not just the number.     */
+/* ---------------------------------------------------------------------- */
+const EVO_TARGET_RELEASE_ID_MAX = 256;
+const EVO_OPTIMIZATION_DIMENSION_MAX = 200;
+const EVO_AUTHOR_ID_MAX = 200;
+const EVO_RISK_TAG_MAX = 200;
+const EVO_RED_LINE_MAX = 2000;
+const EVO_SOURCE_TRACE_MAX = 256;
+const EVO_EVAL_ID_MAX = 128;
+const EVO_DIMENSION_ITEM_MAX = 200;
+const EVO_SCORING_SCALE_MAX = 10;
+const EVO_REFUTE_PARAGRAPH_MAX = 8000;
+const EVO_SKEPTIC_RISK_MAX = 2000;
+const EVO_POINTER_MAX = 512;
 /**
  * EvolutionEvaluation — spec §4.4 / §6.
  *
@@ -62,7 +79,7 @@ export const EVOLUTION_VERDICTS = [
  * target_kind; we keep this as a non-empty string and let the
  * service layer validate per target_kind.
  */
-const TargetReleaseIdSchema = z.string().min(1).max(256);
+const TargetReleaseIdSchema = z.string().min(1).max(EVO_TARGET_RELEASE_ID_MAX);
 /**
  * EvolutionProposal — the create payload.
  *
@@ -86,7 +103,7 @@ export const EvolutionProposalInputSchema = z.object({
         .string()
         .trim()
         .min(1, "optimization_dimension is required (single dimension per round)")
-        .max(200),
+        .max(EVO_OPTIMIZATION_DIMENSION_MAX),
     before_snapshot: z.record(z.unknown()).default({}),
     after_snapshot: z.record(z.unknown()).default({}),
     diff: z.record(z.unknown()).default({}),
@@ -94,12 +111,12 @@ export const EvolutionProposalInputSchema = z.object({
         .number()
         .finite("before_score must be a finite number")
         .min(0, "before_score must be >= 0")
-        .max(10, "before_score must be <= 10"),
+        .max(EVO_SCORING_SCALE_MAX, "before_score must be <= 10"),
     after_score: z
         .number()
         .finite("after_score must be a finite number")
         .min(0, "after_score must be >= 0")
-        .max(10, "after_score must be <= 10"),
+        .max(EVO_SCORING_SCALE_MAX, "after_score must be <= 10"),
     score_delta_min: z
         .number()
         .finite("score_delta_min must be a finite number")
@@ -109,7 +126,7 @@ export const EvolutionProposalInputSchema = z.object({
         .string()
         .trim()
         .min(1, "author_id is required")
-        .max(200),
+        .max(EVO_AUTHOR_ID_MAX),
     /**
      * The LLM-side marker that this proposal targets a SINGLE object
      * (AC-8). Multi-object proposals must be split into multiple
@@ -132,8 +149,8 @@ export const EvolutionProposalInputSchema = z.object({
         }),
     }),
     rubric: z.record(z.unknown()).default({}),
-    red_lines: z.array(z.string().min(1).max(2000)).default([]),
-    source_traces: z.array(z.string().min(1).max(256)).default([]),
+    red_lines: z.array(z.string().min(1).max(EVO_RED_LINE_MAX)).default([]),
+    source_traces: z.array(z.string().min(1).max(EVO_SOURCE_TRACE_MAX)).default([]),
 });
 /**
  * The PERSISTED proposal shape — adds `dimensions` (a length-1
@@ -145,12 +162,12 @@ export const EvolutionProposalSchema = EvolutionProposalInputSchema.extend({
     id: z
         .string()
         .min(1)
-        .max(128)
+        .max(EVO_EVAL_ID_MAX)
         .regex(/^eval-[0-9a-f-]{8,}$/, {
         message: "id must start with 'eval-' followed by a hex/UUID-ish suffix",
     }),
     dimensions: z
-        .array(z.string().min(1).max(200))
+        .array(z.string().min(1).max(EVO_DIMENSION_ITEM_MAX))
         .length(1, "dimensions must be exactly length 1 (AC-8)"),
     target_count: z.literal(1),
     schema_version: z
@@ -171,23 +188,23 @@ export const IndependentEvaluatorResultSchema = z.object({
         .number()
         .finite()
         .min(0, "evaluator score must be >= 0")
-        .max(10, "evaluator score must be <= 10"),
-    riskTags: z.array(z.string().min(1).max(200)).default([]),
+        .max(EVO_SCORING_SCALE_MAX, "evaluator score must be <= 10"),
+    riskTags: z.array(z.string().min(1).max(EVO_RISK_TAG_MAX)).default([]),
     refuteParagraph: z
         .string()
         .trim()
         .min(1, "refuteParagraph is required (one paragraph of independent-context rebuttal)")
-        .max(8000),
+        .max(EVO_REFUTE_PARAGRAPH_MAX),
 });
 /**
  * The regression skeptic's verdict. AC-14: a separate sub-agent
  * that attempts to refute the proposal.
  */
 export const RegressionSkepticResultSchema = z.object({
-    driftRisks: z.array(z.string().min(1).max(2000)).default([]),
-    overfitRisks: z.array(z.string().min(1).max(2000)).default([]),
-    safetyRegressionRisks: z.array(z.string().min(1).max(2000)).default([]),
-    blocker: z.string().trim().min(1).max(2000).optional(),
+    driftRisks: z.array(z.string().min(1).max(EVO_SKEPTIC_RISK_MAX)).default([]),
+    overfitRisks: z.array(z.string().min(1).max(EVO_SKEPTIC_RISK_MAX)).default([]),
+    safetyRegressionRisks: z.array(z.string().min(1).max(EVO_SKEPTIC_RISK_MAX)).default([]),
+    blocker: z.string().trim().min(1).max(EVO_SKEPTIC_RISK_MAX).optional(),
 });
 /**
  * The full evolution evaluation row as persisted. Differs from the
@@ -207,7 +224,7 @@ export const EvolutionEvaluationInputSchema = z.object({
     id: z
         .string()
         .min(1)
-        .max(128)
+        .max(EVO_EVAL_ID_MAX)
         .regex(/^eval-[0-9a-f-]{8,}$/, {
         message: "id must start with 'eval-' followed by a hex/UUID-ish suffix",
     }),
@@ -216,12 +233,12 @@ export const EvolutionEvaluationInputSchema = z.object({
         .string()
         .trim()
         .min(1, "evaluator_id is required (independent scorer; AC-12)")
-        .max(200),
+        .max(EVO_AUTHOR_ID_MAX),
     skeptic_id: z
         .string()
         .trim()
         .min(1, "skeptic_id is required (regression skeptic; AC-14)")
-        .max(200),
+        .max(EVO_AUTHOR_ID_MAX),
     evaluator_result: IndependentEvaluatorResultSchema,
     skeptic_result: RegressionSkepticResultSchema,
     verdict: EvolutionVerdictSchema,
@@ -229,13 +246,13 @@ export const EvolutionEvaluationInputSchema = z.object({
         .string()
         .trim()
         .min(1, "user_confirmation_pointer is required (AC-15)")
-        .max(512)
+        .max(EVO_POINTER_MAX)
         .optional(),
     brief_pointer: z
         .string()
         .trim()
         .min(1, "brief_pointer is required (spec §4.4)")
-        .max(512)
+        .max(EVO_POINTER_MAX)
         .optional(),
     schema_version: z
         .literal("peaks.evolution/1")

package/dist/services/feedback/feedback-promotion-service.js

@@ -27,6 +27,14 @@
  */
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
+/**
+ * PRD-002b slice 2 — extract magic numbers used by the promotion
+ * helper. `slice(0, 5)` was used as a heuristic on the user's body
+ * to keep the rule stub short; `slice(0, 2000)` caps error-mirror
+ * stderr payload size to avoid unbounded log growth.
+ */
+const RULE_BODY_PREVIEW_LINES = 5;
+const STDERR_TRUNCATE_BYTES = 2000;
 export const PROMOTION_LAYERS = ['A', 'B', 'C'];
 export const PROMOTION_LAYER_DETAILS = [
     { layer: 'A', label: 'peaks-sop gate', description: 'Append to sops/*.md and reference from a peaks-sop check. Procedural rules.' },
@@ -211,7 +219,7 @@ export function generatePromotionStub(opts) {
     const { layer, feedbackName } = opts;
     if (layer === 'A') {
         return {
-            snippet: `# SOP entry for feedback "${feedbackName}"\n\n<!-- Append the rule + acceptance criteria below. Reference from a new peaks-sop gate. -->\n\n## Rule\n\n${opts.feedbackBody.split('\n').slice(0, 5).join('\n')}\n\n## Enforcement\n\nAdd a check to sops/<name>.md and reference from .claude/rules/.`,
+            snippet: `# SOP entry for feedback "${feedbackName}"\n\n<!-- Append the rule + acceptance criteria below. Reference from a new peaks-sop gate. -->\n\n## Rule\n\n${opts.feedbackBody.split('\n').slice(0, RULE_BODY_PREVIEW_LINES).join('\n')}\n\n## Enforcement\n\nAdd a check to sops/<name>.md and reference from .claude/rules/.`,
             targetFiles: [`sops/${feedbackName}.md`]
         };
     }