peaks-loop 4.0.46 → 4.0.48

package/dist/services/prd/handoff-auto-regen.js

@@ -1,13 +1,18 @@
 /**
- * v2.13.2 AC-4 — prd/handoff.md auto-regen on prd:handed-off.
+ * v2.13.2 AC-4 — prd/handoff-<rid>.md auto-regen on prd:handed-off.
  *
  * When `peaks request transition --role prd --state handed-off` succeeds
- * and `prd/handoff.md` is missing, this helper writes a sha256-locked
+ * and this slice's capsule is missing, this helper writes a sha256-locked
  * handoff (schemaVersion: 2) using the request artifact body as the
- * handoff body. If the handoff already exists, it's NOT overwritten —
+ * handoff body. If the capsule already exists, it's NOT overwritten —
  * the existing handoff is canonical (it may carry a richer body that
  * peaks-prd produced in an earlier session).
  *
+ * Slice `2026-09-14-prd-capsule-rid-scoping`: the path carries the rid, so
+ * "already exists" is now asked per SLICE. The pre-rid-scoping bare name is
+ * deliberately NOT consulted — writing there would recreate the
+ * one-slot-per-session collision for the next slice in the session.
+ *
  * Karpathy §3 (Surgical Changes): this file only owns the auto-regen
  * path. The other 11 transitions are untouched.
  */
@@ -15,7 +20,8 @@ import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { createHash } from 'node:crypto';
 import { showRequestArtifact } from '../artifacts/request-artifact-service.js';
-import { sha256OfBody } from './handoff-service.js';
+import { serializeHandoffFrontmatter } from './handoff-frontmatter.js';
+import { handoffRelativePath, sha256OfBody } from './handoff-service.js';
 import { normalizePath } from '../../shared/path-utils.js';
 /**
  * Auto-regen the prd/handoff.md under `.peaks/_runtime/<sid>/prd/`.
@@ -25,7 +31,7 @@ export async function autoRegenPrdHandoff(opts) {
     if (opts.role !== 'prd') {
         return { status: 'failed', reason: 'role must be prd' };
     }
-    const handoffPath = join(opts.projectRoot, '.peaks', '_runtime', opts.sessionId, 'prd', 'handoff.md');
+    const handoffPath = join(opts.projectRoot, handoffRelativePath(opts.sessionId, opts.requestId));
     if (existsSync(handoffPath)) {
         return { status: 'skipped-exists', path: handoffPath };
     }
@@ -41,28 +47,26 @@ export async function autoRegenPrdHandoff(opts) {
     const body = artifact.content;
     const sha256 = sha256OfBody(body);
     // v2.13.3 AC-4 — align with `AUDIT_REQUIRES_HANDOFF` prereq which
-    // pins `mustContain: ['schemaVersion: 2', 'sha256:']`. The previous
-    // field name `handoffHash` made peaks-loop write a handoff that the
-    // own prereq resolver would reject with "missing section(s): sha256:".
-    // Primary field is now `sha256`; `handoffHash` is kept as a literal
-    // alias for back-compat with any consumer (UI / external scripts)
-    // that still reads the old key.
-    const frontmatter = [
-        '---',
-        `requestId: ${opts.requestId}`,
-        `sessionId: ${opts.sessionId}`,
-        'schemaVersion: 2',
-        `sha256: ${sha256}`,
-        `handoffHash: ${sha256}`,
-        `writtenAt: ${new Date().toISOString()}`,
-        'goals: []',
-        'acceptanceCriteria: []',
-        'preservedBehavior: []',
-        `handoffPath: ${normalizePath(handoffPath.replace(opts.projectRoot, '')).replace(/^\//, '')}`,
-        '---',
-        ''
-    ].join('\n');
-    const content = `${frontmatter}${body}`;
+    // pins `mustContain: ['schemaVersion: 2', 'sha256:']`. Primary field is
+    // `sha256`; `handoffHash` is kept as a literal alias for the readers that
+    // still use the old key.
+    //
+    // Slice `2026-09-14-handoff-writer-gate-divergence`: this block used to be
+    // hand-rolled here while `handoff-service.serializeHandoff` rendered the
+    // SAME contract a second, incompatible way. Both now go through
+    // `serializeHandoffFrontmatter`, so the two producers cannot drift again.
+    const frontmatter = {
+        requestId: opts.requestId,
+        sessionId: opts.sessionId,
+        schemaVersion: '2',
+        handoffHash: sha256,
+        writtenAt: new Date().toISOString(),
+        goals: [],
+        acceptanceCriteria: [],
+        preservedBehavior: [],
+        handoffPath: normalizePath(handoffPath.replace(opts.projectRoot, '')).replace(/^\//, '')
+    };
+    const content = `${serializeHandoffFrontmatter(frontmatter)}${body}`;
     mkdirSync(dirname(handoffPath), { recursive: true });
     writeFileSync(handoffPath, content, 'utf8');
     const recomputed = createHash('sha256').update(body, 'utf8').digest('hex');

package/dist/services/prd/handoff-frontmatter.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The ONE canonical serialization of `prd/handoff.md` frontmatter.
+ *
+ * Why this module exists (slice `2026-09-14-handoff-writer-gate-divergence`):
+ * the handoff capsule is written by two producers and read by four
+ * consumers, and they did not agree on the bytes:
+ *
+ *   | consumer / producer | requirement |
+ *   |---|---|
+ *   | `AUDIT_REQUIRES_HANDOFF` (`artifact-prerequisites.ts`) | SUBSTRING `schemaVersion: 2` (unquoted) + `sha256:` |
+ *   | `audit-independent/{security,perf}-audit-service.ts` | anchored `^schemaVersion:\s*(\d+)\s*$` and `^sha256:\s*([a-f0-9]{64})\s*$` |
+ *   | `handoff-service.readHandoff` | YAML string `handoffHash` |
+ *   | `handoff-service.verifyHandoff` | `handoffHash` === sha256(body), bare hex |
+ *
+ * `handoff-service.serializeHandoff` fed the frontmatter through
+ * `yaml.stringify`, which emits `schemaVersion: "2"` and a bare
+ * `handoffHash:` — failing the gate AND both loaders. `handoff-auto-regen.ts`
+ * hand-rolled a second serialization that happened to satisfy all four. Two
+ * producers, two facts about the same contract, one of them wrong: that is
+ * the defect, and copying the right shape into a third place would keep it.
+ *
+ * So both producers call THIS function. `sha256` is emitted only here, and
+ * it is emitted plain, because the two audit loaders anchor a regex on it.
+ *
+ * Scalar-quoting rule — one rule, one documented exception set:
+ *   - every ordinary string is emitted through `yamlScalar` (a JSON
+ *     double-quoted scalar, which is valid YAML 1.2 and round-trips
+ *     backslashes correctly on Windows paths);
+ *   - `schemaVersion` and `sha256` are the exception: emitted PLAIN, because
+ *     they are the two scalars the gate and the loaders match textually and a
+ *     quoted scalar is invisible to all three. Both values are structurally
+ *     constrained (a version digit and 64 hex chars), so plain is unambiguous.
+ *
+ * `handoffHash` is quoted even though it is also a 64-hex value: the reader
+ * parses the block through YAML and requires a STRING, and a bare all-digit
+ * sha256 would parse as a YAML number and be refused by the shape check.
+ */
+import type { HandoffFrontmatter } from './handoff-types.js';
+/**
+ * Serialize `frontmatter` into the fenced block, terminated by the closing
+ * `---` and a trailing newline. Callers append the body verbatim, which keeps
+ * the sha256 of the body independent of how the frontmatter renders.
+ */
+export declare function serializeHandoffFrontmatter(frontmatter: HandoffFrontmatter): string;

package/dist/services/prd/handoff-frontmatter.js

@@ -0,0 +1,75 @@
+/**
+ * The ONE canonical serialization of `prd/handoff.md` frontmatter.
+ *
+ * Why this module exists (slice `2026-09-14-handoff-writer-gate-divergence`):
+ * the handoff capsule is written by two producers and read by four
+ * consumers, and they did not agree on the bytes:
+ *
+ *   | consumer / producer | requirement |
+ *   |---|---|
+ *   | `AUDIT_REQUIRES_HANDOFF` (`artifact-prerequisites.ts`) | SUBSTRING `schemaVersion: 2` (unquoted) + `sha256:` |
+ *   | `audit-independent/{security,perf}-audit-service.ts` | anchored `^schemaVersion:\s*(\d+)\s*$` and `^sha256:\s*([a-f0-9]{64})\s*$` |
+ *   | `handoff-service.readHandoff` | YAML string `handoffHash` |
+ *   | `handoff-service.verifyHandoff` | `handoffHash` === sha256(body), bare hex |
+ *
+ * `handoff-service.serializeHandoff` fed the frontmatter through
+ * `yaml.stringify`, which emits `schemaVersion: "2"` and a bare
+ * `handoffHash:` — failing the gate AND both loaders. `handoff-auto-regen.ts`
+ * hand-rolled a second serialization that happened to satisfy all four. Two
+ * producers, two facts about the same contract, one of them wrong: that is
+ * the defect, and copying the right shape into a third place would keep it.
+ *
+ * So both producers call THIS function. `sha256` is emitted only here, and
+ * it is emitted plain, because the two audit loaders anchor a regex on it.
+ *
+ * Scalar-quoting rule — one rule, one documented exception set:
+ *   - every ordinary string is emitted through `yamlScalar` (a JSON
+ *     double-quoted scalar, which is valid YAML 1.2 and round-trips
+ *     backslashes correctly on Windows paths);
+ *   - `schemaVersion` and `sha256` are the exception: emitted PLAIN, because
+ *     they are the two scalars the gate and the loaders match textually and a
+ *     quoted scalar is invisible to all three. Both values are structurally
+ *     constrained (a version digit and 64 hex chars), so plain is unambiguous.
+ *
+ * `handoffHash` is quoted even though it is also a 64-hex value: the reader
+ * parses the block through YAML and requires a STRING, and a bare all-digit
+ * sha256 would parse as a YAML number and be refused by the shape check.
+ */
+/** Render a string as a YAML double-quoted scalar. JSON string escapes are a
+ *  subset of YAML 1.2's double-quoted escapes, so this is valid YAML and
+ *  handles `\` (Windows paths), quotes, colons and newlines in one step. */
+function yamlScalar(value) {
+    return JSON.stringify(value);
+}
+/** Render `key: []` or a YAML block sequence of quoted scalars. */
+function blockSequence(key, values) {
+    if (values.length === 0)
+        return [`${key}: []`];
+    return [`${key}:`, ...values.map((value) => `  - ${yamlScalar(value)}`)];
+}
+/**
+ * Serialize `frontmatter` into the fenced block, terminated by the closing
+ * `---` and a trailing newline. Callers append the body verbatim, which keeps
+ * the sha256 of the body independent of how the frontmatter renders.
+ */
+export function serializeHandoffFrontmatter(frontmatter) {
+    const lines = [
+        '---',
+        `requestId: ${yamlScalar(frontmatter.requestId)}`,
+        `sessionId: ${yamlScalar(frontmatter.sessionId)}`,
+        // PLAIN by construction (`HandoffSchemaVersion` is the literal '2').
+        `schemaVersion: ${frontmatter.schemaVersion}`,
+        // PLAIN: this is the field both audit loaders read, via an anchored
+        // regex that a quoted scalar would not match.
+        `sha256: ${frontmatter.handoffHash}`,
+        // Quoted: `readHandoff` requires a YAML string here.
+        `handoffHash: ${yamlScalar(frontmatter.handoffHash)}`,
+        `writtenAt: ${yamlScalar(frontmatter.writtenAt)}`,
+        ...blockSequence('goals', frontmatter.goals),
+        ...blockSequence('acceptanceCriteria', frontmatter.acceptanceCriteria),
+        ...blockSequence('preservedBehavior', frontmatter.preservedBehavior),
+        `handoffPath: ${yamlScalar(frontmatter.handoffPath)}`,
+        '---',
+    ];
+    return `${lines.join('\n')}\n`;
+}

package/dist/services/prd/handoff-service.d.ts

@@ -3,7 +3,9 @@
  * `v2-11-rm-rd-techdoc-immutable-handoff`).
  *
  * Owns the immutable handoff at
- * `.peaks/_runtime/<sessionId>/prd/handoff.md`:
+ * `.peaks/_runtime/<sessionId>/prd/handoff-<rid>.md` (one capsule per slice;
+ * the pre-rid-scoping `.peaks/_runtime/<sessionId>/prd/handoff.md` stays
+ * readable through `resolveHandoffPath`):
  *
  *   - `initHandoff` — pure; computes sha256 of the body and returns
  *     a Handoff whose frontmatter `handoffHash` matches.
@@ -23,6 +25,43 @@
 import type { Handoff, HandoffProbe } from './handoff-types.js';
 /** Compute the lowercase hex sha256 of a UTF-8 string. */
 export declare function sha256OfBody(body: string): string;
+/**
+ * The canonical capsule path for ONE SLICE, relative to the project root.
+ *
+ * Slice `2026-09-14-prd-capsule-rid-scoping`: the capsule used to be one slot
+ * per SESSION (`prd/handoff.md`), so the second slice's handoff silently
+ * overwrote the first slice's — and `AUDIT_REQUIRES_HANDOFF` stayed green
+ * because it never checked WHOSE rid the file named. Measured on
+ * `2026-09-13-session-21878f`: a four-slice job passed that prerequisite on a
+ * capsule left by a different line of work.
+ *
+ * This is the WRITE target, so it always carries the rid — a consumer-side
+ * fallback here would leave a rid-scoped requirement with a bare-name writer,
+ * which is the defect shape this slice exists to remove. Readers that must
+ * tolerate pre-rid-scoping sessions call `resolveHandoffPath` instead.
+ */
+export declare function handoffRelativePath(sessionId: string, requestId: string): string;
+/**
+ * The capsule a CONSUMER should read for (session, requestId): the rid-scoped
+ * path when it is on disk, else the pre-rid-scoping bare name. Returns null
+ * when neither exists.
+ *
+ * Three sessions on disk still hold only the bare file
+ * (`2026-09-06-session-a87ca4`, `2026-09-12-session-e37ef0`,
+ * `2026-09-13-session-21878f`), so the legacy tier has to keep resolving for
+ * the gate and for every reader below.
+ *
+ * `requestId` is optional because the detect-only audit surface reaches its
+ * service without one. Such a caller can name only the bare path: a session
+ * holding nothing but rid-scoped capsules reports missing rather than picking
+ * among its siblings' capsules, which would re-open the cross-slice mix-up
+ * this scoping exists to close (fail closed, not "some capsule is there").
+ */
+export declare function resolveHandoffPath(opts: {
+    projectRoot: string;
+    sessionId: string;
+    requestId?: string;
+}): string | null;
 /** Pure: produce a Handoff with the frontmatter populated. Hash is
  *  computed here; callers MUST NOT pre-populate `handoffHash`. */
 export declare function initHandoff(opts: {
@@ -33,7 +72,7 @@ export declare function initHandoff(opts: {
     goals: readonly string[];
     acceptanceCriteria: readonly string[];
     preservedBehavior: readonly string[];
-    /** Override path; defaults to `.peaks/_runtime/<sid>/prd/handoff.md`. */
+    /** Override path; defaults to `.peaks/_runtime/<sid>/prd/handoff-<rid>.md`. */
     handoffPath?: string;
 }): Handoff;
 /** Write a Handoff to disk. `projectRoot` is the absolute project

package/dist/services/prd/handoff-service.js

@@ -3,7 +3,9 @@
  * `v2-11-rm-rd-techdoc-immutable-handoff`).
  *
  * Owns the immutable handoff at
- * `.peaks/_runtime/<sessionId>/prd/handoff.md`:
+ * `.peaks/_runtime/<sessionId>/prd/handoff-<rid>.md` (one capsule per slice;
+ * the pre-rid-scoping `.peaks/_runtime/<sessionId>/prd/handoff.md` stays
+ * readable through `resolveHandoffPath`):
  *
  *   - `initHandoff` — pure; computes sha256 of the body and returns
  *     a Handoff whose frontmatter `handoffHash` matches.
@@ -21,20 +23,68 @@
  * markdown source — no normalization, no trailing-newline padding.
  */
 import { createHash } from 'node:crypto';
+import { existsSync } from 'node:fs';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
-import { parse as parseYaml, stringify as stringifyYaml } from 'yaml';
+import { parse as parseYaml } from 'yaml';
+import { serializeHandoffFrontmatter } from './handoff-frontmatter.js';
 /** Required schema version for new handoffs. */
 const HANDOFF_SCHEMA_VERSION = '2';
 /** Compute the lowercase hex sha256 of a UTF-8 string. */
 export function sha256OfBody(body) {
     return createHash('sha256').update(body, 'utf8').digest('hex');
 }
+/**
+ * The canonical capsule path for ONE SLICE, relative to the project root.
+ *
+ * Slice `2026-09-14-prd-capsule-rid-scoping`: the capsule used to be one slot
+ * per SESSION (`prd/handoff.md`), so the second slice's handoff silently
+ * overwrote the first slice's — and `AUDIT_REQUIRES_HANDOFF` stayed green
+ * because it never checked WHOSE rid the file named. Measured on
+ * `2026-09-13-session-21878f`: a four-slice job passed that prerequisite on a
+ * capsule left by a different line of work.
+ *
+ * This is the WRITE target, so it always carries the rid — a consumer-side
+ * fallback here would leave a rid-scoped requirement with a bare-name writer,
+ * which is the defect shape this slice exists to remove. Readers that must
+ * tolerate pre-rid-scoping sessions call `resolveHandoffPath` instead.
+ */
+export function handoffRelativePath(sessionId, requestId) {
+    return join('.peaks', '_runtime', sessionId, 'prd', `handoff-${requestId}.md`);
+}
+/**
+ * The capsule a CONSUMER should read for (session, requestId): the rid-scoped
+ * path when it is on disk, else the pre-rid-scoping bare name. Returns null
+ * when neither exists.
+ *
+ * Three sessions on disk still hold only the bare file
+ * (`2026-09-06-session-a87ca4`, `2026-09-12-session-e37ef0`,
+ * `2026-09-13-session-21878f`), so the legacy tier has to keep resolving for
+ * the gate and for every reader below.
+ *
+ * `requestId` is optional because the detect-only audit surface reaches its
+ * service without one. Such a caller can name only the bare path: a session
+ * holding nothing but rid-scoped capsules reports missing rather than picking
+ * among its siblings' capsules, which would re-open the cross-slice mix-up
+ * this scoping exists to close (fail closed, not "some capsule is there").
+ */
+export function resolveHandoffPath(opts) {
+    const candidates = [
+        ...(opts.requestId !== undefined ? [handoffRelativePath(opts.sessionId, opts.requestId)] : []),
+        join('.peaks', '_runtime', opts.sessionId, 'prd', 'handoff.md')
+    ];
+    for (const relative of candidates) {
+        const absolute = join(opts.projectRoot, relative);
+        if (existsSync(absolute))
+            return absolute;
+    }
+    return null;
+}
 /** Pure: produce a Handoff with the frontmatter populated. Hash is
  *  computed here; callers MUST NOT pre-populate `handoffHash`. */
 export function initHandoff(opts) {
     const handoffPath = opts.handoffPath ??
-        join('.peaks', '_runtime', opts.sessionId, 'prd', 'handoff.md');
+        handoffRelativePath(opts.sessionId, opts.requestId);
     const handoffHash = sha256OfBody(opts.body);
     const frontmatter = {
         requestId: opts.requestId,
@@ -146,8 +196,11 @@ function parseHandoffContent(content) {
     };
 }
 function serializeHandoff(handoff) {
-    const yamlStr = stringifyYaml(handoff.frontmatter).trimEnd();
-    return `---\n${yamlStr}\n---\n${handoff.body}`;
+    // The one canonical frontmatter rendering, shared with
+    // `handoff-auto-regen.ts`. `yaml.stringify` used to render this block and
+    // emitted `schemaVersion: "2"` + a bare `handoffHash:`, which the
+    // `AUDIT_REQUIRES_HANDOFF` gate and both audit loaders all reject.
+    return `${serializeHandoffFrontmatter(handoff.frontmatter)}${handoff.body}`;
 }
 /**
  * N1: accept BOTH shapes of `schemaVersion` — the string `'2'` and the bare
@@ -161,13 +214,33 @@ function serializeHandoff(handoff) {
  * readable handoff was satisfied by a handoff the parser would not read, and
  * `peaks prd handoff verify` exited 1 on a healthy file.
  *
- * Quoting the writer instead is NOT a fix: it would delete the very substring
- * the prereq pins, turning a broken read into a broken gate. The tolerant read
- * is the only change that satisfies both consumers.
+ * Slice `2026-09-14-handoff-writer-gate-divergence` then fixed the other half:
+ * the writer no longer emits the quoted form at all (see
+ * `handoff-frontmatter.ts`). This tolerance stays because handoffs already on
+ * disk were written by the old writer and by hand; the writer fix must not
+ * retroactively make them unreadable.
  */
 function isSchemaVersion2(value) {
     return value === HANDOFF_SCHEMA_VERSION || value === 2;
 }
+/**
+ * The READER's shape check — deliberately looser than `verifyHandoff`:
+ * `handoffHash` must be a string, and nothing about its VALUE is validated here.
+ *
+ * The accepted-but-unverifiable shape, stated rather than left to be
+ * discovered: a capsule carrying `handoffHash: sha256:<hex>` — the form the
+ * pre-fix writer and this session's hand-corrected capsules use — is READ by
+ * `readHandoff` and can NEVER pass `verifyHandoff`. The verifier compares the
+ * value to `sha256OfBody(body)` byte for byte (`:127-135`) and no prefix
+ * normalization exists anywhere in this module, so the leading `sha256:`
+ * guarantees `hash-mismatch`. ONLY the bare-hex form verifies, which is what
+ * every writer now emits (`handoff-frontmatter.ts`).
+ *
+ * So `readHandoff` succeeding is NOT evidence that a capsule is verifiable —
+ * the tolerance above exists so old capsules stay READABLE, not so they become
+ * acceptable. Request §三 bullet 3 asked for exactly this confirmation
+ * (rid `2026-09-14-handoff-writer-gate-divergence`).
+ */
 function isHandoffFrontmatter(value) {
     if (!value || typeof value !== 'object')
         return false;

package/dist/services/prd/handoff-types.d.ts

@@ -14,8 +14,9 @@
  * (D1 in `v2-11-rm-rd-techdoc-immutable-handoff`).
  *
  * Path convention: the file lands at
- * `.peaks/_runtime/<sessionId>/prd/handoff.md` (gitignored session
- * artifact; the binding to `<sessionId>` lives in
+ * `.peaks/_runtime/<sessionId>/prd/handoff-<rid>.md` (one capsule per slice;
+ * `.peaks/_runtime/<sessionId>/prd/handoff.md` is the pre-rid-scoping tier and
+ * stays readable). Gitignored session artifact; the binding to `<sessionId>` lives in
  * `.peaks/_runtime/current-change`). NEVER write under
  * `.peaks/_runtime/<change-id>/...` directly (slice 2.8.3 hard ban).
  */

package/dist/services/prd/handoff-types.js

@@ -14,8 +14,9 @@
  * (D1 in `v2-11-rm-rd-techdoc-immutable-handoff`).
  *
  * Path convention: the file lands at
- * `.peaks/_runtime/<sessionId>/prd/handoff.md` (gitignored session
- * artifact; the binding to `<sessionId>` lives in
+ * `.peaks/_runtime/<sessionId>/prd/handoff-<rid>.md` (one capsule per slice;
+ * `.peaks/_runtime/<sessionId>/prd/handoff.md` is the pre-rid-scoping tier and
+ * stays readable). Gitignored session artifact; the binding to `<sessionId>` lives in
  * `.peaks/_runtime/current-change`). NEVER write under
  * `.peaks/_runtime/<change-id>/...` directly (slice 2.8.3 hard ban).
  */

package/dist/services/qa/qa-business-review-state.js

@@ -16,6 +16,7 @@
  */
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
 /** 6-item business checklist (12 Gaps QA perspective). */
 export const QA_BUSINESS_ITEMS = [
     { id: 'business-flow', question: '这个功能"用起来"对吗?(业务流程顺不顺,操作路径是否反人类,跟现有系统交互有没有断层)' },
@@ -36,6 +37,14 @@ export function buildEmptyQaReview(requestId, sessionId, now = new Date()) {
     };
 }
 export function getQaReviewDir(projectRoot, sessionId) {
+    // Sid axis. Every `peaks qa-business-review|score|accept|reject` subcommand
+    // reaches the runtime tree through this one constructor, so one guard here
+    // covers the whole family — measured: `--session-id ../../../../…/PWNED`
+    // wrote `qa-business-reviews/<rid>.json` outside every project root under an
+    // `ok: true` envelope (RD sweep case A17).
+    if (isUnsafePathInput(sessionId)) {
+        throw new Error(`Invalid session id: ${sessionId} (must be a single path segment)`);
+    }
     return resolve(projectRoot, '.peaks', '_runtime', sessionId, 'qa-business-reviews');
 }
 export function getQaReviewPath(projectRoot, sessionId, requestId) {

package/dist/services/release/version-precheck-service.d.ts

@@ -34,7 +34,8 @@ export interface PrecheckOptions {
 export interface PrecheckEnvelope {
     readonly ok: boolean;
     readonly overall: LayerStatus;
-    readonly rootVersion: string;
+    /** `null` when the root `package.json` is missing or unreadable — see `rootVsShared`. */
+    readonly rootVersion: string | null;
     readonly strict: boolean;
     readonly snapshotAt: string;
     readonly layers: {

package/dist/services/release/version-precheck-service.js

@@ -37,12 +37,45 @@ function upgrade(result, strict) {
     }
     return result;
 }
+/** Read + parse a JSON manifest, mapping both failure modes onto a blocker description. */
+function readPackageJson(path, label) {
+    let raw;
+    try {
+        raw = readFileSync(path, 'utf8');
+    }
+    catch {
+        return {
+            ok: false,
+            message: `${label} is missing or unreadable at ${path}`,
+            remediation: `run \`peaks release precheck\` from a project root that has a readable ${label}`
+        };
+    }
+    try {
+        return { ok: true, value: JSON.parse(raw) };
+    }
+    catch {
+        return {
+            ok: false,
+            message: `${label} at ${path} is not valid JSON`,
+            remediation: `fix the ${label} syntax; \`peaks release precheck\` cannot gate a version it cannot parse`
+        };
+    }
+}
 function readRootVersion(projectRoot) {
-    const pkg = JSON.parse(readFileSync(join(projectRoot, 'package.json'), 'utf8'));
+    const path = join(projectRoot, 'package.json');
+    const read = readPackageJson(path, 'root package.json');
+    if (!read.ok) {
+        return read;
+    }
+    const pkg = read.value;
     if (typeof pkg.version !== 'string' || !SEMVER_RE.test(pkg.version)) {
-        throw new Error(`invalid root package.json#version: ${JSON.stringify(pkg.version)}`);
+        return {
+            ok: false,
+            message: `invalid root package.json#version: ${JSON.stringify(pkg.version)}`,
+            remediation: 'set root package.json#version to a clean semver (e.g. 4.0.0) before running `peaks release precheck`'
+        };
     }
-    return pkg.version;
+    return { ok: true, version: pkg.version };
 }
 function rollup(layers, strict) {
     const statuses = Object.values(layers).map((l) => l.status);
@@ -58,7 +91,16 @@ function rollup(layers, strict) {
 // Layer A — rootVsShared (mirrors publish.yml §(A) on-disk gate only)
 // ---------------------------------------------------------------------------
 export function runRootVsShared(opts) {
-    const rootVersion = readRootVersion(opts.projectRoot);
+    const rootRead = readRootVersion(opts.projectRoot);
+    if (!rootRead.ok) {
+        return {
+            status: 'blocker',
+            message: rootRead.message,
+            remediation: rootRead.remediation,
+            observed: { rootVersion: null, sharedVersion: null }
+        };
+    }
+    const rootVersion = rootRead.version;
     const sharedDist = join(opts.projectRoot, 'packages', 'peaks-loop-shared', 'dist', 'version.js');
     let sharedVersion = null;
     let distExists = false;
@@ -112,7 +154,18 @@ export function runRootVsShared(opts) {
 // Layer B — tagCollision (CLI-only; not in publish.yml today)
 // ---------------------------------------------------------------------------
 export function runTagCollision(opts) {
-    const rootVersion = readRootVersion(opts.projectRoot);
+    const rootRead = readRootVersion(opts.projectRoot);
+    if (!rootRead.ok) {
+        // Fail closed: without a version there is no tag name to check, so this
+        // layer cannot claim "safe to publish".
+        return {
+            status: 'blocker',
+            message: rootRead.message,
+            remediation: rootRead.remediation,
+            observed: { tagName: null }
+        };
+    }
+    const rootVersion = rootRead.version;
     const tagName = `v${rootVersion}`;
     // 2026-09-10: no shell. `git` is `git.exe` on Windows, so the wrapper bought
     // nothing — and it actively broke this layer, because `projectRoot` is an
@@ -125,7 +178,8 @@ export function runTagCollision(opts) {
     // blocker). It also emitted DEP0190 on every run, on every layer.
     const res = spawnSync('git', ['-C', opts.projectRoot, 'tag', '--list', tagName], {
         encoding: 'utf8',
-        timeout: 5_000
+        timeout: 5_000,
+        windowsHide: true
     });
     if (res.error !== null && res.error !== undefined) {
         return {
@@ -198,8 +252,16 @@ export function runChangesetStaged(opts) {
 // Layer D — workspaceLockstep (CLI-only; not in publish.yml today)
 // ---------------------------------------------------------------------------
 export function runWorkspaceLockstep(opts) {
-    const rootPkgRaw = readFileSync(join(opts.projectRoot, 'package.json'), 'utf8');
-    const rootPkg = JSON.parse(rootPkgRaw);
+    const rootRead = readPackageJson(join(opts.projectRoot, 'package.json'), 'root package.json');
+    if (!rootRead.ok) {
+        return {
+            status: 'blocker',
+            message: rootRead.message,
+            remediation: rootRead.remediation,
+            observed: { sharedDep: null }
+        };
+    }
+    const rootPkg = rootRead.value;
     const allDeps = {
         ...(rootPkg.dependencies ?? {}),
         ...(rootPkg.devDependencies ?? {})
@@ -222,9 +284,16 @@ export function runWorkspaceLockstep(opts) {
             observed: { sharedDep }
         };
     }
-    const sharedPkgRaw = readFileSync(join(opts.projectRoot, 'packages', 'peaks-loop-shared', 'package.json'), 'utf8');
-    const sharedPkg = JSON.parse(sharedPkgRaw);
-    const sharedVersion = sharedPkg.version ?? '';
+    const sharedRead = readPackageJson(join(opts.projectRoot, 'packages', 'peaks-loop-shared', 'package.json'), 'packages/peaks-loop-shared/package.json');
+    if (!sharedRead.ok) {
+        return {
+            status: 'blocker',
+            message: sharedRead.message,
+            remediation: sharedRead.remediation,
+            observed: { sharedDep, sharedVersion: null }
+        };
+    }
+    const sharedVersion = sharedRead.value.version ?? '';
     if (!SEMVER_RE.test(sharedVersion)) {
         return {
             status: 'blocker',
@@ -244,7 +313,8 @@ export function runWorkspaceLockstep(opts) {
 // runAllLayers — orchestrator
 // ---------------------------------------------------------------------------
 export function runAllLayers(opts) {
-    const rootVersion = readRootVersion(opts.projectRoot);
+    const rootRead = readRootVersion(opts.projectRoot);
+    const rootVersion = rootRead.ok ? rootRead.version : null;
     const strict = opts.strict === true;
     const layers = {
         rootVsShared: upgrade(runRootVsShared(opts), strict),

package/dist/services/runtime/vendor-adapter.d.ts

@@ -20,11 +20,36 @@
  *
  * Vendor-specific verb strings (`claude --compact`, `codex --compact`,
  * `copilot compact`) MUST live ONLY in adapter implementations under
- * `src/services/runtime/vendors/<vendor>.ts`. The runtime service that
+ * `src/services/runtime/vendors/<vendor>.ts` and
+ * `src/services/ide/adapters/<vendor>-adapter.ts`. The runtime service that
  * orchestrates these adapters (runtime-service.ts) and the CLI commands
- * (`peaks runtime compact --via <id>`) MUST NOT contain vendor verbs
- * — verified by AC-1: `rg -n "claude --compact|codex --compact|copilot
- * compact" src/services/code/` must return 0 matches.
+ * (`peaks runtime compact --via <id>`) MUST NOT contain vendor verbs.
+ *
+ * Slice 2026-09-12-auto-compact-vendor-neutrality widened AC-1's scope from
+ * `src/services/code/` to ALL of `src/`, and had to change how it is
+ * enforced. Both changes came from measurement:
+ *
+ *   - The old scope excluded the files that carried the defect AC-1
+ *     describes — the compact dispatcher (`src/services/context/`) and the
+ *     hook installer (`src/services/hooks/`) — so it returned 0 by
+ *     construction. A grep over a directory that does not contain the code
+ *     being checked is not evidence of anything.
+ *   - Widened as a raw grep over `src/`, the check returns 13, not 0. Twelve
+ *     hits are the phrase quoted in COMMENTS and doc strings (this block
+ *     among them); the thirteenth is `compactCommand: 'claude --compact'`
+ *     in `src/services/ide/adapters/claude-code-adapter.ts` — the one place
+ *     the string is supposed to be. A text grep measures prose, not code.
+ *
+ * AC-1 is therefore enforced by the AST-based check in
+ * `tests/unit/runtime/vendor-neutral-identity-guard.test.ts`: no vendor
+ * verb in any STRING LITERAL of `src/` outside the adapter implementations.
+ * Parsed, the count is 1 and the single hit is that adapter — which is the
+ * property AC-1 was always about.
+ *
+ * AC-1 covers VERB STRINGS only. The compact path's defects were IDENTITY
+ * COMPARISONS (`ideId !== 'claude-code'`), a second shape the same guard
+ * file covers and AC-1 never could. Read that guard's header for what
+ * neither check catches before treating vendor neutrality as proven.
  *
  * See `.peaks/_runtime/2026-07-08-session-17918f/prd/002-adapter-runtime-and-polyrepo.md`
  * for the source PRD.