peaks-loop 4.0.46 → 4.0.48

package/dist/services/skills/session-start-hook-constants.d.ts

@@ -25,6 +25,47 @@
  */
 /** Sentinel substring identifying a SessionStart outer-cache hook entry. */
 export declare const HOOK_OUTER_CACHE_SENTINEL = "peaks outer-cache write";
+/**
+ * rid `2026-09-13-a2-post-compact-reinject` — SessionStart entry scoped to
+ * `matcher: 'compact'` that puts the engineering state back into the context
+ * a compaction just emptied.
+ *
+ * This is the official mechanism, and the `matcher` is the load-bearing part
+ * of it: Claude Code adds a `SessionStart` hook's plain-text stdout to the
+ * context, and scoping to `compact` means the card is re-injected AFTER a
+ * compaction rather than on every fresh session. Compaction itself cannot be
+ * initiated from here — the harness performs it, and a hook can only observe
+ * or veto. Re-injection is the half that IS available to us.
+ *
+ * Why a separate entry instead of folding this into the `peaks session
+ * primer` entry that already runs on every SessionStart: the primer's own
+ * contract is "rotation + presence cleanup", it fires on `startup` too (where
+ * the dispatch context is still in the history and the card would be noise),
+ * and its output is a rotation envelope rather than an engineering-state
+ * card. Two entries, two intents — each one's output means exactly one thing.
+ */
+export declare const HOOK_POST_COMPACT_REINJECT_SENTINEL = "peaks session reinject";
+/**
+ * The reinject hook command. `--project "${CLAUDE_PROJECT_DIR}"` matches the
+ * other two SessionStart entries: `${CLAUDE_PROJECT_DIR}` is Claude Code's
+ * standard project-root convention, and the CLI resolves it strictly (a
+ * SessionStart payload is env-driven and must not be trusted as a path).
+ *
+ * `--quiet-failure` is NOT a flag and deliberately so: printing nothing on
+ * failure is this command's unconditional behaviour, not something a caller
+ * opts into. See `reinject-command.ts` — stdout IS context here, so an error
+ * message on stdout would be injected into the model's context as though
+ * peaks-loop meant it.
+ */
+export declare const HOOK_POST_COMPACT_REINJECT_COMMAND = "peaks session reinject --project \"${CLAUDE_PROJECT_DIR}\"";
+/** SessionStart hook event key (same as outer-cache + primer). */
+export declare const HOOK_POST_COMPACT_REINJECT_EVENT = "SessionStart";
+/**
+ * The SessionStart `source` value the re-injection is scoped to. Claude Code
+ * reports `compact` as the SessionStart source when the session is resuming
+ * from a compaction; the hook entry's `matcher` is matched against it.
+ */
+export declare const HOOK_POST_COMPACT_REINJECT_MATCHER = "compact";
 /** Default (claude-code) SessionStart hook command. */
 export declare const HOOK_OUTER_CACHE_COMMAND = "peaks outer-cache write --project \"${CLAUDE_PROJECT_DIR}\"";
 /** SessionStart hook event key for Claude Code. */
@@ -42,3 +83,48 @@ export declare const HOOK_WORKSPACE_INIT_SENTINEL = "peaks session primer";
 export declare const HOOK_WORKSPACE_INIT_COMMAND = "peaks session primer --project \"${CLAUDE_PROJECT_DIR}\"";
 /** SessionStart hook event key (same as outer-cache). */
 export declare const HOOK_WORKSPACE_INIT_EVENT = "SessionStart";
+/**
+ * rid `2026-09-13-compact-event-settle` — the `PostCompact` entry that lets the
+ * harness's own event settle a compact, instead of the next `context-now` probe
+ * inferring one from a ratio that fell.
+ *
+ * WHY THIS ENTRY IS NOT A `SessionStart` ONE, despite living in this file: the
+ * three entries above all ride `SessionStart` and differ only by matcher. A
+ * `PostCompact` hook is a different EVENT that carries the one fact no
+ * `SessionStart` payload has — whether the compaction the harness just
+ * completed was `auto` or `manual`. That distinction is the whole question
+ * ("has this machine ever auto-compacted?"), and without it peaks-loop can only
+ * ever see that SOMETHING compacted. See `compact-event-settle.ts` for what the
+ * command does with it.
+ *
+ * WHY THE MATCHER IS THE EMPTY STRING and not the documented `auto|manual`:
+ * both trigger values are wanted, so the matcher must filter nothing. An empty
+ * matcher is the convention the three `SessionStart` entries already rely on to
+ * match every source, and it is the only form that cannot fail SILENTLY — an
+ * alternation string is a match-everything pattern under regex semantics but
+ * matches NEITHER value under exact-equality semantics, and a hook that never
+ * fires looks exactly like a hook with nothing to report.
+ */
+export declare const HOOK_COMPACT_SETTLE_SENTINEL = "peaks compact settle";
+/**
+ * The settle hook command. `--project "${CLAUDE_PROJECT_DIR}"` is byte-for-byte
+ * the shape of the three `SessionStart` entries above — Claude Code's standard
+ * project-root convention, resolved strictly on the CLI side (a hook payload is
+ * env-driven and must not be trusted as a path).
+ *
+ * The command prints NOTHING on the hook path and exits 0 for every outcome.
+ * `PostCompact`'s stdin/stdout contract is truncated in the retrievable docs,
+ * so the safe assumption is the `SessionStart` one — stdout may be added to the
+ * model's context. An error message there would be read as a fact. See
+ * `compact-event-settle.ts`.
+ *
+ * No `shell` pin, deliberately: this entry lands in the shared, committed
+ * `.claude/settings.json`, and a `powershell` pin there would break every
+ * macOS / Linux reader of the file. See `resolveHookEntries`' comment block for
+ * the full reason the three `SessionStart` entries are unpinned too.
+ */
+export declare const HOOK_COMPACT_SETTLE_COMMAND = "peaks compact settle --project \"${CLAUDE_PROJECT_DIR}\"";
+/** The event this entry rides. Claude Code fires it after a compaction completes. */
+export declare const HOOK_COMPACT_SETTLE_EVENT = "PostCompact";
+/** Matcher: empty = every `trigger` (`auto` and `manual`). See the sentinel doc. */
+export declare const HOOK_COMPACT_SETTLE_MATCHER = "";

package/dist/services/skills/session-start-hook-constants.js

@@ -25,6 +25,47 @@
  */
 /** Sentinel substring identifying a SessionStart outer-cache hook entry. */
 export const HOOK_OUTER_CACHE_SENTINEL = 'peaks outer-cache write';
+/**
+ * rid `2026-09-13-a2-post-compact-reinject` — SessionStart entry scoped to
+ * `matcher: 'compact'` that puts the engineering state back into the context
+ * a compaction just emptied.
+ *
+ * This is the official mechanism, and the `matcher` is the load-bearing part
+ * of it: Claude Code adds a `SessionStart` hook's plain-text stdout to the
+ * context, and scoping to `compact` means the card is re-injected AFTER a
+ * compaction rather than on every fresh session. Compaction itself cannot be
+ * initiated from here — the harness performs it, and a hook can only observe
+ * or veto. Re-injection is the half that IS available to us.
+ *
+ * Why a separate entry instead of folding this into the `peaks session
+ * primer` entry that already runs on every SessionStart: the primer's own
+ * contract is "rotation + presence cleanup", it fires on `startup` too (where
+ * the dispatch context is still in the history and the card would be noise),
+ * and its output is a rotation envelope rather than an engineering-state
+ * card. Two entries, two intents — each one's output means exactly one thing.
+ */
+export const HOOK_POST_COMPACT_REINJECT_SENTINEL = 'peaks session reinject';
+/**
+ * The reinject hook command. `--project "${CLAUDE_PROJECT_DIR}"` matches the
+ * other two SessionStart entries: `${CLAUDE_PROJECT_DIR}` is Claude Code's
+ * standard project-root convention, and the CLI resolves it strictly (a
+ * SessionStart payload is env-driven and must not be trusted as a path).
+ *
+ * `--quiet-failure` is NOT a flag and deliberately so: printing nothing on
+ * failure is this command's unconditional behaviour, not something a caller
+ * opts into. See `reinject-command.ts` — stdout IS context here, so an error
+ * message on stdout would be injected into the model's context as though
+ * peaks-loop meant it.
+ */
+export const HOOK_POST_COMPACT_REINJECT_COMMAND = `peaks session reinject --project "\${CLAUDE_PROJECT_DIR}"`;
+/** SessionStart hook event key (same as outer-cache + primer). */
+export const HOOK_POST_COMPACT_REINJECT_EVENT = 'SessionStart';
+/**
+ * The SessionStart `source` value the re-injection is scoped to. Claude Code
+ * reports `compact` as the SessionStart source when the session is resuming
+ * from a compaction; the hook entry's `matcher` is matched against it.
+ */
+export const HOOK_POST_COMPACT_REINJECT_MATCHER = 'compact';
 /** Default (claude-code) SessionStart hook command. */
 export const HOOK_OUTER_CACHE_COMMAND = `peaks outer-cache write --project "\${CLAUDE_PROJECT_DIR}"`;
 /** SessionStart hook event key for Claude Code. */
@@ -42,3 +83,48 @@ export const HOOK_WORKSPACE_INIT_SENTINEL = 'peaks session primer';
 export const HOOK_WORKSPACE_INIT_COMMAND = `peaks session primer --project "\${CLAUDE_PROJECT_DIR}"`;
 /** SessionStart hook event key (same as outer-cache). */
 export const HOOK_WORKSPACE_INIT_EVENT = 'SessionStart';
+/**
+ * rid `2026-09-13-compact-event-settle` — the `PostCompact` entry that lets the
+ * harness's own event settle a compact, instead of the next `context-now` probe
+ * inferring one from a ratio that fell.
+ *
+ * WHY THIS ENTRY IS NOT A `SessionStart` ONE, despite living in this file: the
+ * three entries above all ride `SessionStart` and differ only by matcher. A
+ * `PostCompact` hook is a different EVENT that carries the one fact no
+ * `SessionStart` payload has — whether the compaction the harness just
+ * completed was `auto` or `manual`. That distinction is the whole question
+ * ("has this machine ever auto-compacted?"), and without it peaks-loop can only
+ * ever see that SOMETHING compacted. See `compact-event-settle.ts` for what the
+ * command does with it.
+ *
+ * WHY THE MATCHER IS THE EMPTY STRING and not the documented `auto|manual`:
+ * both trigger values are wanted, so the matcher must filter nothing. An empty
+ * matcher is the convention the three `SessionStart` entries already rely on to
+ * match every source, and it is the only form that cannot fail SILENTLY — an
+ * alternation string is a match-everything pattern under regex semantics but
+ * matches NEITHER value under exact-equality semantics, and a hook that never
+ * fires looks exactly like a hook with nothing to report.
+ */
+export const HOOK_COMPACT_SETTLE_SENTINEL = 'peaks compact settle';
+/**
+ * The settle hook command. `--project "${CLAUDE_PROJECT_DIR}"` is byte-for-byte
+ * the shape of the three `SessionStart` entries above — Claude Code's standard
+ * project-root convention, resolved strictly on the CLI side (a hook payload is
+ * env-driven and must not be trusted as a path).
+ *
+ * The command prints NOTHING on the hook path and exits 0 for every outcome.
+ * `PostCompact`'s stdin/stdout contract is truncated in the retrievable docs,
+ * so the safe assumption is the `SessionStart` one — stdout may be added to the
+ * model's context. An error message there would be read as a fact. See
+ * `compact-event-settle.ts`.
+ *
+ * No `shell` pin, deliberately: this entry lands in the shared, committed
+ * `.claude/settings.json`, and a `powershell` pin there would break every
+ * macOS / Linux reader of the file. See `resolveHookEntries`' comment block for
+ * the full reason the three `SessionStart` entries are unpinned too.
+ */
+export const HOOK_COMPACT_SETTLE_COMMAND = `peaks compact settle --project "\${CLAUDE_PROJECT_DIR}"`;
+/** The event this entry rides. Claude Code fires it after a compaction completes. */
+export const HOOK_COMPACT_SETTLE_EVENT = 'PostCompact';
+/** Matcher: empty = every `trigger` (`auto` and `manual`). See the sentinel doc. */
+export const HOOK_COMPACT_SETTLE_MATCHER = '';

package/dist/services/skills/skill-presence-service.js

@@ -604,6 +604,15 @@ export function clearSkillPresence(projectRootOverride) {
     // shim; the LLM runner calls `peaks workflow terminalize` or
     // `terminalizePresenceLease` directly).
     //
+    // That rule is the surrounding DESIGN, not a description of this
+    // function: nothing below routes anywhere. This shim has no session
+    // lock, no lease argument and no workflow id, so it cannot route —
+    // it cleans up deprecated files and returns whether it removed any.
+    // The truthful report of what remains is the caller's job
+    // (`skill-command.ts` re-reads the live projection and emits
+    // `cleared` / `reason`). Do not read the paragraph above as a
+    // promise about this function.
+    //
     // The shim still removes the legacy `active-skill.json` /
     // `.peaks/.active-skill.json` so a stale marker from a prior CLI
     // version cannot resurrect after a fresh `clear`. The canonical

package/dist/services/skills/skill-statusline-service.d.ts

@@ -7,6 +7,20 @@ export type StatusLineStdin = {
     cwd?: string;
     session_id?: string;
     caller_id?: string;
+    /**
+     * The harness's own context numbers. Declared here because this type IS the
+     * documented shape of the payload the harness pipes in; omitting a documented
+     * field would make the type lie by omission, and a consumer that reached for
+     * it would have to cast. Read (never written) by
+     * `harness-context-witness.ts` — see that module for why
+     * `context_window_size` is NOT a denominator.
+     */
+    context_window?: {
+        context_window_size?: unknown;
+        used_percentage?: unknown;
+        remaining_percentage?: unknown;
+        current_usage?: Record<string, unknown> | undefined;
+    } | undefined;
 };
 export type StatusLineState = 'active' | 'idle' | 'stale' | 'invalid-presence';
 export type StatusLinePresence = {

package/dist/services/slice/slice-check-service.js

@@ -8,6 +8,7 @@ import { isDirectory } from 'peaks-loop-shared/fs';
 // is no longer read. Path-safety helpers now live at
 // `shared/path-safety.ts` if this module ever needs them.
 import { verifyPipeline } from '../workflow/pipeline-verify-service.js';
+import { REQUEST_ID_PATTERN } from '../artifacts/request-artifact-service.js';
 import { findMockViolations } from '../audit/enforcers/mock-placement.js';
 import { runRedLinesAudit } from '../audit/red-lines-service.js';
 /**
@@ -96,7 +97,8 @@ function runCommand(command, args, cwd, timeoutMs) {
             cwd,
             stdio: ['ignore', 'pipe', 'pipe'],
             timeout: timeoutMs,
-            maxBuffer: EXEC_MAX_BUFFER_BYTES
+            maxBuffer: EXEC_MAX_BUFFER_BYTES,
+            windowsHide: true
         }).toString('utf8');
         return {
             status: 'pass',
@@ -238,20 +240,29 @@ async function runUnitTests(projectRoot, runTests) {
         }
     };
 }
+// Slice `2026-09-14-audit-artifact-rid-scoping`: the evidence filenames
+// carry the rid now. Candidate order is canonical-first, then the
+// back-compat tiers — the same order `artifact-prerequisites.ts` resolves
+// in, so this boundary gate and the transition gate agree on which file is
+// a slice's evidence. `<rid>` is substituted at probe time.
 const REVIEW_FILES = [
-    { name: 'code-review', path: 'rd/code-review.md', label: 'code-review' },
+    {
+        name: 'code-review',
+        paths: ['rd/code-review-<rid>.md', 'rd/code-review.md'],
+        label: 'code-review'
+    },
     // v2.12.0 collapse: security + perf moved to standalone audit skills.
-    // `slice check` accepts EITHER the v2.11.x legacy path OR the v2.12.0
-    // canonical audit path during the 1-minor-release back-compat window
-    // (v2.13.0 hard-deletes the legacy paths — see CHANGELOG [2.12.0]).
+    // `slice check` accepts the rid-scoped audit path, the bare v2.12.0 path
+    // OR the v2.11.x legacy path during the 1-minor-release back-compat
+    // window (v2.13.0 hard-deletes the legacy paths — see CHANGELOG [2.12.0]).
     {
         name: 'security-review',
-        paths: ['audit/security.md', 'rd/security-review.md'],
+        paths: ['audit/security-<rid>.md', 'audit/security.md', 'rd/security-review.md'],
         label: 'security-review'
     },
     {
         name: 'perf-baseline',
-        paths: ['audit/perf.md', 'rd/perf-baseline.md'],
+        paths: ['audit/perf-<rid>.md', 'audit/perf.md', 'rd/perf-baseline.md'],
         label: 'perf-baseline'
     }
 ];
@@ -283,11 +294,11 @@ async function runReviewFanout(projectRoot, rid, refresh) {
     const found = [];
     for (const review of REVIEW_FILES) {
         let hit = null;
-        // v2.12.0 back-compat: each entry may list multiple candidate paths.
-        // First hit (in declared order) wins; canonical paths come first so
-        // v2.12.0+ slices preferentially report the new path even when both
-        // are present during migration.
-        const candidates = 'path' in review ? [review.path] : review.paths;
+        // Back-compat: each entry lists multiple candidate paths. First hit (in
+        // declared order) wins; canonical paths come first so a current slice
+        // preferentially reports its own rid-scoped evidence even when a legacy
+        // file is also present during migration.
+        const candidates = review.paths.map((candidate) => candidate.replace('<rid>', rid));
         for (const candidate of candidates) {
             for (const scope of scopes) {
                 const abs = join(projectRoot, '.peaks', scope, candidate);
@@ -366,6 +377,14 @@ export async function sliceCheck(options) {
         throw new Error('No --rid supplied. Pass --rid <id> on the CLI to identify which slice to check.');
     }
     const rid = options.rid;
+    // The rid becomes a filename in `runReviewFanout`'s candidate list and a
+    // directory segment in its `scopes` — both joined onto the project root. The
+    // rid is the repo's own request-id shape, and `request-artifact-service.ts`
+    // already refuses anything else; apply the same guard here rather than
+    // probing paths a hostile `--rid` steers.
+    if (!REQUEST_ID_PATTERN.test(rid)) {
+        throw new Error(`Invalid request id: ${rid} (expected letters, digits, dots, underscores, or dashes)`);
+    }
     const totalStart = Date.now();
     const stages = [];
     let unitTestsRunMode = 'skipped';

package/dist/services/slice/slice-decompose-runners.js

@@ -98,7 +98,8 @@ function runCodegraph(args, projectRoot) {
         cwd: projectRoot,
         stdio: ['ignore', 'pipe', 'pipe'],
         timeout: 60_000,
-        maxBuffer: 32 * 1024 * 1024
+        maxBuffer: 32 * 1024 * 1024,
+        windowsHide: true
     };
     // Use `peaks codegraph` (the peaks wrapper), which adds --project support.
     // 2026-09-10: no shell. `peaks` on Windows is a `.cmd` shim, which Node >= 20

package/dist/services/slice/slice-review-state.js

@@ -14,6 +14,7 @@
  */
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
 /** The 5 default review items per slice (the 12 Gaps memory checklist). */
 export const DEFAULT_REVIEW_ITEMS = [
     { id: 'business-match', question: '这个 slice 做完,业务流程对吗?(跟产品最初给的需求匹配)' },
@@ -32,6 +33,13 @@ export function buildEmptySliceReview(sliceId, sessionId, now = new Date()) {
     };
 }
 export function getReviewDir(projectRoot, sessionId) {
+    // Sid axis. Every `peaks slice-review|score|accept|reject` subcommand reaches
+    // the runtime tree through this one constructor. Measured: `--session-id
+    // ../../../../…/PWNED` wrote `slice-reviews/<slice-id>.json` outside every
+    // project root under an `ok: true` envelope (RD sweep case A26).
+    if (isUnsafePathInput(sessionId)) {
+        throw new Error(`Invalid session id: ${sessionId} (must be a single path segment)`);
+    }
     return resolve(projectRoot, '.peaks', '_runtime', sessionId, 'slice-reviews');
 }
 export function getReviewPath(projectRoot, sessionId, sliceId) {

package/dist/services/upgrade/upgrade-service.js

@@ -47,6 +47,7 @@ export const defaultSubstepExecutor = (command, args, timeoutMs) => {
             encoding: 'utf8',
             stdio: ['ignore', 'pipe', 'pipe'],
             timeout: timeoutMs,
+            windowsHide: true,
         });
         return {
             status: result.status,

package/dist/services/workflow/pipeline-verify-gate-support.d.ts

@@ -8,7 +8,8 @@
  *
  * File budget: ≤ 400 lines (rid-006 split).
  */
-import type { RequestType } from '../artifacts/artifact-prerequisites.js';
+import { type ArtifactPrerequisite, type RequestType } from '../artifacts/artifact-prerequisites.js';
+import type { RequestArtifactRole, RequestArtifactState } from '../artifacts/request-artifact-service.js';
 import type { PipelineGate } from './pipeline-verify-types.js';
 export declare function extractState(markdown: string): string;
 /**
@@ -24,6 +25,38 @@ export declare function findRequestFile(projectRoot: string, role: string, rid:
     content: string;
     sessionId: string;
 } | null>;
+/**
+ * Where the CURRENT contract puts one gate's evidence.
+ *
+ * The contract is the `artifact-prerequisites.ts` table — the table
+ * `peaks request transition` enforces and the one the peaks-qa prose
+ * contract mirrors (`skills/bee/peaks-qa/references/qa-transition-gates.md`).
+ * `probeName` is the location this checker probes today. The contract's
+ * `relativePath` is returned first, then its accepted historical locations in
+ * the table's own declared order — `legacyRelativePath`, then
+ * `legacyRelativePaths` (the same composition `artifact-prerequisites.ts`' own
+ * resolver performs, so a hit here and a hit there land on the same file).
+ *
+ * Returns `null` when the contract carries no prerequisite for that name at
+ * all — the artifact was retired and no gate may fail on it.
+ *
+ * This lookup exists because hard-coding the paths here is what let
+ * `verify-pipeline` fall a minor release behind the gate: it kept demanding
+ * `rd/security-review.md` as mandatory after the table had demoted that file
+ * to a `legacyRelativePath` fallback of `audit/security.md`, and it kept
+ * demanding `qa/security-findings-<rid>.md` / `qa/performance-findings-<rid>.md`
+ * after the v2.11.0 D1/D4 trim dropped them from `qa:verdict-issued`
+ * altogether (rid 2026-09-14-verify-pipeline-contract-drift).
+ */
+/**
+ * The prerequisite the contract carries for `probeName`, or null when it
+ * carries none. `contractEvidencePaths` is this object's path projection; the
+ * BODY contract (`mustContain` / `mustContainAny` / `headingMustContain`) rides
+ * on the same object, which is why `contractBodyViolations` below consults it
+ * instead of probing for the file's existence alone.
+ */
+export declare function contractPrerequisite(role: RequestArtifactRole, state: RequestArtifactState, requestType: RequestType, probeName: string): ArtifactPrerequisite | null;
+export declare function contractEvidencePaths(role: RequestArtifactRole, state: RequestArtifactState, requestType: RequestType, probeName: string): string[] | null;
 export declare function rdGatesForType(requestType: RequestType): PipelineGate[];
 export declare function qaGatesForType(requestType: RequestType): PipelineGate[];
 export declare const RD_QA_HANDOFF_STATES: Set<string>;
@@ -33,15 +66,19 @@ export interface CanonicalPathTracker {
     anyEvidenceResolved: boolean;
     allResolvedPathsCanonical: boolean;
 }
-/** Resolve RD evidence files (tech-doc / bug-analysis / code-review / security-review)
+/** Resolve RD evidence files (prd-handoff / bug-analysis / code-review / security-review / perf-baseline)
  *  by probing canonical + legacy paths for each gate. Mutates the gate.passed /
  *  gate.detail fields in place and pushes violations / nextActions. Returns the
  *  updated tracker. Verbatim-move from `pipeline-verify-service.ts`. */
-export declare function resolveRdEvidencePaths(gates: PipelineGate[], rdEvidenceDir: string, projectRoot: string, violations: string[], nextActions: string[], tracker: CanonicalPathTracker): CanonicalPathTracker;
-/** Resolve QA evidence files (test-cases / test-report / security-findings /
- *  performance-findings) by probing canonical + legacy paths for each gate.
- *  For security/perf findings, delegates to the artifact-paths resolver.
- *  Mutates the gate.passed / gate.detail fields in place and pushes
- *  violations / nextActions. Returns the updated tracker. Verbatim-move
- *  from `pipeline-verify-service.ts`. */
-export declare function resolveQaEvidencePaths(gates: PipelineGate[], projectRoot: string, rdEvidenceDir: string, changeIdForResolver: string, rid: string, violations: string[], nextActions: string[], tracker: CanonicalPathTracker): CanonicalPathTracker;
+export declare function resolveRdEvidencePaths(gates: PipelineGate[], rdEvidenceDir: string, projectRoot: string, rid: string, requestType: RequestType, violations: string[], nextActions: string[], tracker: CanonicalPathTracker): CanonicalPathTracker;
+/** Resolve QA evidence files (test-cases / test-report) by probing canonical
+ *  + legacy paths for each gate. Mutates the gate.passed / gate.detail fields
+ *  in place and pushes violations / nextActions. Returns the updated tracker.
+ *  Verbatim-move from `pipeline-verify-service.ts`.
+ *
+ *  The `security-findings` / `performance-findings` branches that used to live
+ *  here are gone: those artifacts are not in any `qa:verdict-issued` table
+ *  (v2.11.0 D1/D4), and the evidence they stood for is resolved on the RD side
+ *  at the contract's own paths (`audit/security-<rid>.md`,
+ *  `audit/perf-<rid>.md`). */
+export declare function resolveQaEvidencePaths(gates: PipelineGate[], projectRoot: string, rdEvidenceDir: string, requestType: RequestType, rid: string, violations: string[], nextActions: string[], tracker: CanonicalPathTracker): CanonicalPathTracker;