peaks-loop 4.0.46 → 4.0.48

package/dist/services/workflow/pipeline-verify-gate-support.js

@@ -8,17 +8,13 @@
  *
  * File budget: ≤ 400 lines (rid-006 split).
  */
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { getPrerequisitesFor, prerequisiteBodyViolations } from '../artifacts/artifact-prerequisites.js';
 import { showRequestArtifact } from '../artifacts/request-artifact-service.js';
-import { resolveSecurityFindingsPath, resolvePerformanceFindingsPath } from './artifact-paths.js';
+import { readArtifactState } from '../artifacts/request-artifact-state-helpers.js';
 export function extractState(markdown) {
-    for (const rawLine of markdown.split(/\r?\n/)) {
-        const match = /^-\s*state:\s*(.+?)\s*$/.exec(rawLine.trim());
-        if (match?.[1])
-            return match[1];
-    }
-    return 'unknown';
+    return readArtifactState(markdown) ?? 'unknown';
 }
 /**
  * As of slice 2026-06-05-change-id-as-unit-of-work, the file's durable
@@ -44,12 +40,91 @@ export async function findRequestFile(projectRoot, role, rid) {
     }
     return { path: artifact.path, content: artifact.content, sessionId };
 }
+/**
+ * Where the CURRENT contract puts one gate's evidence.
+ *
+ * The contract is the `artifact-prerequisites.ts` table — the table
+ * `peaks request transition` enforces and the one the peaks-qa prose
+ * contract mirrors (`skills/bee/peaks-qa/references/qa-transition-gates.md`).
+ * `probeName` is the location this checker probes today. The contract's
+ * `relativePath` is returned first, then its accepted historical locations in
+ * the table's own declared order — `legacyRelativePath`, then
+ * `legacyRelativePaths` (the same composition `artifact-prerequisites.ts`' own
+ * resolver performs, so a hit here and a hit there land on the same file).
+ *
+ * Returns `null` when the contract carries no prerequisite for that name at
+ * all — the artifact was retired and no gate may fail on it.
+ *
+ * This lookup exists because hard-coding the paths here is what let
+ * `verify-pipeline` fall a minor release behind the gate: it kept demanding
+ * `rd/security-review.md` as mandatory after the table had demoted that file
+ * to a `legacyRelativePath` fallback of `audit/security.md`, and it kept
+ * demanding `qa/security-findings-<rid>.md` / `qa/performance-findings-<rid>.md`
+ * after the v2.11.0 D1/D4 trim dropped them from `qa:verdict-issued`
+ * altogether (rid 2026-09-14-verify-pipeline-contract-drift).
+ */
+/**
+ * The prerequisite the contract carries for `probeName`, or null when it
+ * carries none. `contractEvidencePaths` is this object's path projection; the
+ * BODY contract (`mustContain` / `mustContainAny` / `headingMustContain`) rides
+ * on the same object, which is why `contractBodyViolations` below consults it
+ * instead of probing for the file's existence alone.
+ */
+export function contractPrerequisite(role, state, requestType, probeName) {
+    for (const prereq of getPrerequisitesFor(role, state, requestType)) {
+        const legacyPaths = [
+            ...(prereq.legacyRelativePath !== undefined ? [prereq.legacyRelativePath] : []),
+            ...(prereq.legacyRelativePaths ?? [])
+        ];
+        if (prereq.relativePath !== probeName && !legacyPaths.includes(probeName))
+            continue;
+        return prereq;
+    }
+    return null;
+}
+export function contractEvidencePaths(role, state, requestType, probeName) {
+    const prereq = contractPrerequisite(role, state, requestType, probeName);
+    if (prereq === null)
+        return null;
+    const legacyPaths = [
+        ...(prereq.legacyRelativePath !== undefined ? [prereq.legacyRelativePath] : []),
+        ...(prereq.legacyRelativePaths ?? [])
+    ];
+    return [prereq.relativePath, ...legacyPaths.filter((legacy) => legacy !== prereq.relativePath)];
+}
+/**
+ * The contract's BODY checks for the prerequisite named by `probeName`, applied
+ * to the file that resolved. Empty when the name matches nothing in the table or
+ * the table pins no body markers for it.
+ *
+ * `existsSync` alone made this checker laxer than the contract it claims to
+ * derive from: it reported `prd-handoff passed = true` for a handoff carrying
+ * `schemaVersion: 1` and no `sha256:` line — the exact file
+ * `AUDIT_REQUIRES_HANDOFF` refuses at `rd:qa-handoff`. Deriving the *path* from
+ * the table while dropping the table's *body* contract is the drift this module
+ * exists to remove, so the check goes through the table's own implementation
+ * (`prerequisiteBodyViolations`) rather than a second copy of the markers.
+ */
+function contractBodyViolations(role, state, requestType, probeName, absolutePath) {
+    const prerequisite = contractPrerequisite(role, state, requestType, probeName);
+    if (prerequisite === null)
+        return [];
+    return prerequisiteBodyViolations(prerequisite, readFileSync(absolutePath, 'utf8'));
+}
 export function rdGatesForType(requestType) {
     const gates = [
         { name: 'rd-request-exists', description: 'RD request artifact created', passed: false, detail: '' }
     ];
-    if (requestType === 'feature' || requestType === 'refactor') {
-        gates.push({ name: 'tech-doc', description: 'Technical design doc', passed: false, detail: '' });
+    // This slot used to pin a `tech-doc` gate to `rd/tech-doc.md`, an artifact
+    // v2.11.0 Group A retired and the table no longer carries — so the gate
+    // failed trees `peaks request transition` accepts (QA repair cycle 1). The
+    // design / scope record the contract DOES name at `rd:qa-handoff` is
+    // `prd/handoff.md`, so that is the gate: table-derived, like the others.
+    // (`rd/tech-doc.md` still has two non-gate readers — final-review's evidence
+    // budget and the resume detector. Neither is served by failing a compliant
+    // slice.)
+    if (contractEvidencePaths('rd', 'qa-handoff', requestType, 'prd/handoff.md') !== null) {
+        gates.push({ name: 'prd-handoff', description: 'PRD handoff capsule (approved scope + non-goals)', passed: false, detail: '' });
     }
     if (requestType === 'bugfix') {
         gates.push({ name: 'bug-analysis', description: 'Bug root-cause analysis', passed: false, detail: '' });
@@ -60,6 +135,17 @@ export function rdGatesForType(requestType) {
     if (requestType === 'feature' || requestType === 'refactor' || requestType === 'bugfix' || requestType === 'config') {
         gates.push({ name: 'security-review', description: 'Security review evidence', passed: false, detail: '' });
     }
+    // The perf evidence the contract requires at `rd:qa-handoff` is `AUDIT_PERF`
+    // — `audit/perf-<rid>.md`, with `audit/perf.md` and `rd/perf-baseline.md` as
+    // its two declared legacy tiers (rid-scoped since slice
+    // `2026-09-14-audit-artifact-rid-scoping`). This gate used to live on the QA
+    // side as `performance-findings`, checking `qa/performance-findings-<rid>.md`
+    // — a path the v2.11.0 D1/D4 trim dropped. Relocating the gate (rather than
+    // deleting it) is what keeps AC3's control meaningful: perf evidence that is
+    // genuinely absent must still fail.
+    if (contractEvidencePaths('rd', 'qa-handoff', requestType, 'rd/perf-baseline.md') !== null) {
+        gates.push({ name: 'perf-baseline', description: 'Performance audit evidence', passed: false, detail: '' });
+    }
     return gates;
 }
 export function qaGatesForType(requestType) {
@@ -70,124 +156,157 @@ export function qaGatesForType(requestType) {
         gates.push({ name: 'test-cases', description: 'QA test cases', passed: false, detail: '' });
         gates.push({ name: 'test-report', description: 'QA test report with execution results', passed: false, detail: '' });
     }
-    if (requestType === 'feature' || requestType === 'refactor' || requestType === 'bugfix' || requestType === 'config') {
-        gates.push({ name: 'security-findings', description: 'QA security findings', passed: false, detail: '' });
-    }
-    if (requestType === 'feature' || requestType === 'refactor') {
-        gates.push({ name: 'performance-findings', description: 'QA performance findings', passed: false, detail: '' });
-    }
+    // The `security-findings` / `performance-findings` gates were removed here
+    // (rid 2026-09-14-verify-pipeline-contract-drift). peaks-qa does not own
+    // security review or performance review — `peaks-qa/SKILL.md` says so, and
+    // the v2.11.0 D1/D4 trim dropped both from every `qa:verdict-issued` table.
+    // The evidence they used to demand is now checked on the RD side, at the
+    // paths the contract actually names (`audit/security-<rid>.md`,
+    // `audit/perf-<rid>.md`; rid-scoped since slice
+    // `2026-09-14-audit-artifact-rid-scoping`, with `audit/security.md` /
+    // `audit/perf.md` and `rd/security-review.md` / `rd/perf-baseline.md` as the
+    // declared legacy tiers behind them).
     return gates;
 }
 export const RD_QA_HANDOFF_STATES = new Set(['qa-handoff', 'handed-off', 'implemented']);
 export const QA_COMPLETE_STATES = new Set(['verdict-issued']);
-/** Resolve RD evidence files (tech-doc / bug-analysis / code-review / security-review)
+/** Resolve RD evidence files (prd-handoff / bug-analysis / code-review / security-review / perf-baseline)
  *  by probing canonical + legacy paths for each gate. Mutates the gate.passed /
  *  gate.detail fields in place and pushes violations / nextActions. Returns the
  *  updated tracker. Verbatim-move from `pipeline-verify-service.ts`. */
-export function resolveRdEvidencePaths(gates, rdEvidenceDir, projectRoot, violations, nextActions, tracker) {
-    const RD_EVIDENCE_FILE = {
-        'tech-doc': 'tech-doc.md',
-        'bug-analysis': 'bug-analysis.md',
-        'code-review': 'code-review.md',
-        'security-review': 'security-review.md'
+export function resolveRdEvidencePaths(gates, rdEvidenceDir, projectRoot, rid, requestType, violations, nextActions, tracker) {
+    // The path each gate is about. The contract is consulted first — see
+    // `contractEvidencePaths`; `rdGatesForType` only builds a gate when the
+    // contract carries its prerequisite, so this is the name the gate stands
+    // for, not a second path table.
+    const RD_EVIDENCE_PROBE = {
+        'prd-handoff': 'prd/handoff.md',
+        'bug-analysis': 'rd/bug-analysis.md',
+        'code-review': 'rd/code-review.md',
+        'security-review': 'rd/security-review.md',
+        'perf-baseline': 'rd/perf-baseline.md'
     };
     let anyEvidenceResolved = tracker.anyEvidenceResolved;
     let allResolvedPathsCanonical = tracker.allResolvedPathsCanonical;
     for (const gate of gates.slice(1)) {
-        const fileName = RD_EVIDENCE_FILE[gate.name];
-        const canonicalPath = join(projectRoot, '.peaks', '_runtime', rdEvidenceDir, 'rd', fileName);
-        const legacyMisplacedPath = join(projectRoot, '.peaks', rdEvidenceDir, 'rd', fileName);
-        const legacyChangeAxisPath = join(projectRoot, '.peaks', '_runtime', 'change', rdEvidenceDir, 'rd', fileName);
-        let resolvedPath = null;
-        let usedLegacy = false;
-        for (const candidate of [canonicalPath, legacyMisplacedPath, legacyChangeAxisPath]) {
-            if (existsSync(candidate)) {
-                resolvedPath = candidate;
-                usedLegacy = candidate !== canonicalPath;
-                break;
+        const probeName = RD_EVIDENCE_PROBE[gate.name];
+        const relativePaths = (contractEvidencePaths('rd', 'qa-handoff', requestType, probeName) ?? [probeName])
+            .map((relative) => relative.replace('<rid>', rid));
+        const primaryRelativePath = relativePaths[0];
+        const canonicalPath = join(projectRoot, '.peaks', '_runtime', rdEvidenceDir, primaryRelativePath);
+        // Two independent axes, kept apart because they mean different things:
+        //   - `legacyRoot` — the file sits under a pre-F3 session home
+        //     (`.peaks/<sid>/…` or `.peaks/_runtime/change/<sid>/…`). That is a
+        //     misplaced write, and it is the DEPRECATION violation's subject.
+        //   - `legacyForm` — the file sits under one of the contract's declared
+        //     `legacyRelativePaths`. The contract accepts those on purpose ("a
+        //     legacy hit must keep the gate open, or existing sessions would fail
+        //     the transition on upgrade"), so this is reported through
+        //     `acceptedForm` and is *not* a violation.
+        const candidates = [];
+        for (const relative of relativePaths) {
+            const legacyForm = relative !== primaryRelativePath;
+            for (const [root, legacyRoot] of [
+                [join(projectRoot, '.peaks', '_runtime', rdEvidenceDir), false],
+                [join(projectRoot, '.peaks', rdEvidenceDir), true],
+                [join(projectRoot, '.peaks', '_runtime', 'change', rdEvidenceDir), true]
+            ]) {
+                candidates.push({ path: join(root, relative), legacyRoot, legacyForm });
             }
         }
-        if (resolvedPath !== null) {
+        const hit = candidates.find((candidate) => existsSync(candidate.path));
+        if (hit !== undefined) {
             anyEvidenceResolved = true;
-            if (usedLegacy)
+            if (hit.legacyRoot)
                 allResolvedPathsCanonical = false;
-            gate.passed = true;
-            gate.detail = resolvedPath + (usedLegacy ? ' [DEPRECATION_LEGACY_PATH_USED]' : '');
-            if (usedLegacy) {
-                violations.push(`DEPRECATION_LEGACY_PATH_USED: ${resolvedPath} — move the file into .peaks/_runtime/${rdEvidenceDir}/rd/ (the canonical location) so subsequent runs resolve on the canonical path. The legacy \`peaks workspace migrate-change-scope\` helper was removed in v2.19.0; use \`peaks workspace migrate\` to relocate misplaced content.`);
+            // Existing is not the contract — the file must also satisfy the body
+            // markers the table pins for this prereq (see `contractBodyViolations`).
+            const bodyViolations = contractBodyViolations('rd', 'qa-handoff', requestType, probeName, hit.path);
+            if (bodyViolations.length > 0) {
+                gate.passed = false;
+                gate.detail = `${hit.path} — ${bodyViolations.join('; ')}`;
+                violations.push(`RD evidence does not satisfy the contract: ${gate.description} (${primaryRelativePath}) — ${bodyViolations.join('; ')}`);
+                nextActions.push(`Fix .peaks/_runtime/${rdEvidenceDir}/${primaryRelativePath} to satisfy the contract: ${bodyViolations.join('; ')}`);
+            }
+            else {
+                gate.passed = true;
+                gate.detail = hit.path
+                    + (hit.legacyRoot ? ' [DEPRECATION_LEGACY_PATH_USED]' : '')
+                    + (hit.legacyForm ? ' [LEGACY_EVIDENCE_PATH]' : '');
+            }
+            if (hit.legacyRoot) {
+                violations.push(`DEPRECATION_LEGACY_PATH_USED: ${hit.path} — move the file into .peaks/_runtime/${rdEvidenceDir}/${primaryRelativePath} (the canonical location) so subsequent runs resolve on the canonical path. The legacy \`peaks workspace migrate-change-scope\` helper was removed in v2.19.0; use \`peaks workspace migrate\` to relocate misplaced content.`);
             }
         }
         else {
             gate.detail = `missing: ${canonicalPath}`;
-            violations.push(`RD evidence missing: ${gate.description} (${fileName})`);
-            nextActions.push(`Create .peaks/_runtime/${rdEvidenceDir}/rd/${fileName}`);
+            violations.push(`RD evidence missing: ${gate.description} (${primaryRelativePath})`);
+            nextActions.push(`Create .peaks/_runtime/${rdEvidenceDir}/${primaryRelativePath}`);
         }
     }
     return { anyEvidenceResolved, allResolvedPathsCanonical };
 }
-/** Resolve QA evidence files (test-cases / test-report / security-findings /
- *  performance-findings) by probing canonical + legacy paths for each gate.
- *  For security/perf findings, delegates to the artifact-paths resolver.
- *  Mutates the gate.passed / gate.detail fields in place and pushes
- *  violations / nextActions. Returns the updated tracker. Verbatim-move
- *  from `pipeline-verify-service.ts`. */
-export function resolveQaEvidencePaths(gates, projectRoot, rdEvidenceDir, changeIdForResolver, rid, violations, nextActions, tracker) {
-    const QA_EVIDENCE_FILE = {
-        'test-cases': `test-cases/${rid}.md`,
-        'test-report': `test-reports/${rid}.md`,
-        'security-findings': '',
-        'performance-findings': ''
+/** Resolve QA evidence files (test-cases / test-report) by probing canonical
+ *  + legacy paths for each gate. Mutates the gate.passed / gate.detail fields
+ *  in place and pushes violations / nextActions. Returns the updated tracker.
+ *  Verbatim-move from `pipeline-verify-service.ts`.
+ *
+ *  The `security-findings` / `performance-findings` branches that used to live
+ *  here are gone: those artifacts are not in any `qa:verdict-issued` table
+ *  (v2.11.0 D1/D4), and the evidence they stood for is resolved on the RD side
+ *  at the contract's own paths (`audit/security-<rid>.md`,
+ *  `audit/perf-<rid>.md`). */
+export function resolveQaEvidencePaths(gates, projectRoot, rdEvidenceDir, requestType, rid, violations, nextActions, tracker) {
+    const QA_EVIDENCE_PROBE = {
+        'test-cases': 'qa/test-cases/<rid>.md',
+        'test-report': 'qa/test-reports/<rid>.md'
     };
     let anyEvidenceResolved = tracker.anyEvidenceResolved;
     let allResolvedPathsCanonical = tracker.allResolvedPathsCanonical;
     for (const gate of gates.slice(1)) {
-        if (gate.name === 'security-findings' || gate.name === 'performance-findings') {
-            const resolver = gate.name === 'security-findings' ? resolveSecurityFindingsPath : resolvePerformanceFindingsPath;
-            const resolved = resolver({ projectRoot, sessionId: changeIdForResolver, rid });
-            if (existsSync(resolved.path)) {
-                anyEvidenceResolved = true;
-                if (resolved.form === 'legacy')
-                    allResolvedPathsCanonical = false;
-                gate.passed = true;
-                gate.detail = resolved.path;
-                if (resolved.form === 'legacy') {
-                    violations.push(`QA evidence accepted in legacy form (will be rejected after next minor release): ${resolved.path} — re-run peaks workflow plan refresh to migrate`);
-                }
-            }
-            else {
-                gate.detail = `missing: ${resolved.path}`;
-                violations.push(`QA evidence missing: ${gate.description} (${resolved.path})`);
-                nextActions.push(`Create ${resolved.path} (or use the legacy non-suffixed form during the 1-minor-release back-compat window)`);
-            }
-            continue;
-        }
-        const fileName = QA_EVIDENCE_FILE[gate.name];
-        const canonicalQaPath = join(projectRoot, '.peaks', '_runtime', rdEvidenceDir, 'qa', fileName);
-        const legacyMisplacedQaPath = join(projectRoot, '.peaks', rdEvidenceDir, 'qa', fileName);
-        const legacyChangeAxisQaPath = join(projectRoot, '.peaks', '_runtime', 'change', rdEvidenceDir, 'qa', fileName);
-        let resolvedQaPath = null;
-        let usedLegacyQa = false;
-        for (const candidate of [canonicalQaPath, legacyMisplacedQaPath, legacyChangeAxisQaPath]) {
-            if (existsSync(candidate)) {
-                resolvedQaPath = candidate;
-                usedLegacyQa = candidate !== canonicalQaPath;
-                break;
+        const probeName = QA_EVIDENCE_PROBE[gate.name];
+        const relativePaths = (contractEvidencePaths('qa', 'verdict-issued', requestType, probeName) ?? [probeName])
+            .map((relative) => relative.replace('<rid>', rid));
+        const primaryRelativePath = relativePaths[0];
+        const canonicalQaPath = join(projectRoot, '.peaks', '_runtime', rdEvidenceDir, primaryRelativePath);
+        const candidates = [];
+        for (const relative of relativePaths) {
+            for (const [root, legacyRoot] of [
+                [join(projectRoot, '.peaks', '_runtime', rdEvidenceDir), false],
+                [join(projectRoot, '.peaks', rdEvidenceDir), true],
+                [join(projectRoot, '.peaks', '_runtime', 'change', rdEvidenceDir), true]
+            ]) {
+                candidates.push({ path: join(root, relative), legacyRoot });
             }
         }
-        if (resolvedQaPath !== null) {
+        const hit = candidates.find((candidate) => existsSync(candidate.path));
+        if (hit !== undefined) {
             anyEvidenceResolved = true;
-            if (usedLegacyQa)
+            if (hit.legacyRoot)
                 allResolvedPathsCanonical = false;
-            gate.passed = true;
-            gate.detail = resolvedQaPath + (usedLegacyQa ? ' [DEPRECATION_LEGACY_PATH_USED]' : '');
-            if (usedLegacyQa) {
-                violations.push(`DEPRECATION_LEGACY_PATH_USED: ${resolvedQaPath} — move the file into .peaks/_runtime/${rdEvidenceDir}/qa/ (the canonical location) so subsequent runs resolve on the canonical path. The legacy \`peaks workspace migrate-change-scope\` helper was removed in v2.19.0; use \`peaks workspace migrate\` to relocate misplaced content.`);
+            // Same contract check as the RD side: the `test-report` / `test-cases`
+            // prereqs pin `## Test execution` / `## Test cases` / `test(`, and a
+            // checker that only probed existence reported green on files the
+            // `qa:verdict-issued` gate rejects.
+            const bodyViolations = contractBodyViolations('qa', 'verdict-issued', requestType, probeName, hit.path);
+            if (bodyViolations.length > 0) {
+                gate.passed = false;
+                gate.detail = `${hit.path} — ${bodyViolations.join('; ')}`;
+                violations.push(`QA evidence does not satisfy the contract: ${gate.description} (${primaryRelativePath}) — ${bodyViolations.join('; ')}`);
+                nextActions.push(`Fix .peaks/_runtime/${rdEvidenceDir}/${primaryRelativePath} to satisfy the contract: ${bodyViolations.join('; ')}`);
+            }
+            else {
+                gate.passed = true;
+                gate.detail = hit.path + (hit.legacyRoot ? ' [DEPRECATION_LEGACY_PATH_USED]' : '');
+            }
+            if (hit.legacyRoot) {
+                violations.push(`DEPRECATION_LEGACY_PATH_USED: ${hit.path} — move the file into .peaks/_runtime/${rdEvidenceDir}/${primaryRelativePath} (the canonical location) so subsequent runs resolve on the canonical path. The legacy \`peaks workspace migrate-change-scope\` helper was removed in v2.19.0; use \`peaks workspace migrate\` to relocate misplaced content.`);
             }
         }
         else {
             gate.detail = `missing: ${canonicalQaPath}`;
-            violations.push(`QA evidence missing: ${gate.description} (${fileName})`);
-            nextActions.push(`Create .peaks/_runtime/${rdEvidenceDir}/qa/${fileName}`);
+            violations.push(`QA evidence missing: ${gate.description} (${primaryRelativePath})`);
+            nextActions.push(`Create .peaks/_runtime/${rdEvidenceDir}/${primaryRelativePath}`);
         }
     }
     return { anyEvidenceResolved, allResolvedPathsCanonical };

package/dist/services/workflow/pipeline-verify-service.js

@@ -96,7 +96,7 @@ export async function verifyPipeline(options) {
     // to `options.rid` would make every missing-evidence path look like
     // a per-rid scope dir.
     const rdEvidenceDir = resolvedChangeId || options.sessionId || getSessionIdCanonical(options.projectRoot) || options.rid;
-    const rdTracker = resolveRdEvidencePaths(rdGates, rdEvidenceDir, options.projectRoot, violations, nextActions, { anyEvidenceResolved: false, allResolvedPathsCanonical: true });
+    const rdTracker = resolveRdEvidencePaths(rdGates, rdEvidenceDir, options.projectRoot, options.rid, requestType, violations, nextActions, { anyEvidenceResolved: false, allResolvedPathsCanonical: true });
     // Check if RD reached qa-handoff
     if (rdInvoked && !RD_QA_HANDOFF_STATES.has(rdState)) {
         violations.push(`RD not ready for QA: state is "${rdState}" — must reach "qa-handoff" (unit tests, karpathy-guidelines §1 Think / §2 Simplicity / §3 Surgical / §4 Goal-Driven, code review, security review complete)`);
@@ -118,16 +118,11 @@ export async function verifyPipeline(options) {
         nextActions.push('Invoke Skill(skill="peaks-qa") with the request-id for functional/performance/security testing');
         qaGates[0].detail = 'not found';
     }
-    // Check QA evidence files.
-    // v2.18.1 bug #5 fix: when no RD/QA artifact is on disk yet
-    // (resolvedChangeId is empty), fall back to the current session id
-    // from the binding-store instead of `rdEvidenceDir` (= the rid). The
-    // session axis `.peaks/_runtime/<sessionId>/qa/...` is the canonical
-    // v2.17.0 home; the legacy `_runtime/change/<sessionId>/qa/...` probe
-    // should only fire for pre-v2.17.0 workspaces, not as a default for
-    // new requests.
-    const changeIdForResolver = resolvedChangeId || getSessionIdCanonical(options.projectRoot) || rdEvidenceDir;
-    const qaTracker = resolveQaEvidencePaths(qaGates, options.projectRoot, rdEvidenceDir, changeIdForResolver, options.rid, violations, nextActions, rdTracker);
+    // Check QA evidence files. (The v2.18.1 bug #5 `changeIdForResolver`
+    // fallback — current session id when no RD/QA artifact is on disk yet —
+    // was dropped by rid 2026-09-14-verify-pipeline-contract-drift along with
+    // the security/perf findings branch that was its only consumer.)
+    const qaTracker = resolveQaEvidencePaths(qaGates, options.projectRoot, rdEvidenceDir, requestType, options.rid, violations, nextActions, rdTracker);
     const anyEvidenceResolved = qaTracker.anyEvidenceResolved;
     const allResolvedPathsCanonical = qaTracker.allResolvedPathsCanonical;
     // Check if QA reached verdict-issued
@@ -225,20 +220,26 @@ export async function verifyPipeline(options) {
     const complete = rdInvoked && qaInvoked && allRdGatesPassed && allQaGatesPassed && allFeedbackGatesPassed
         && RD_QA_HANDOFF_STATES.has(rdState) && QA_COMPLETE_STATES.has(qaState);
     // Slice 025 — derive the `acceptedForm` and `gateC` verdict. The form is
-    // 'suffixed' if both the security + perf gates passed via the new
-    // per-rid path; 'legacy' if either was consumed via the legacy fallback;
-    // 'none' if neither passed.
-    const secGate = qaGates.find((g) => g.name === 'security-findings');
-    const perfGate = qaGates.find((g) => g.name === 'performance-findings');
-    const secForm = secGate?.detail?.includes(`-${options.rid}.md`) ? 'suffixed' : 'legacy';
-    const perfForm = perfGate?.detail?.includes(`-${options.rid}.md`) ? 'suffixed' : 'legacy';
+    // 'suffixed' when the contract's current path served the file and 'legacy'
+    // when the deprecated fallback did; 'none' if neither gate passed.
+    //
+    // rid 2026-09-14-verify-pipeline-contract-drift: the two gates moved from the
+    // QA phase to the RD phase, because that is where the current contract puts
+    // the evidence (`AUDIT_SECURITY` / `AUDIT_PERF` at `rd:qa-handoff`). The
+    // `-<rid>.md` suffix that used to distinguish the forms is a real one again
+    // after slice `2026-09-14-audit-artifact-rid-scoping` rid-scoped the audit
+    // paths; the resolver marks which form served the file with
+    // `[LEGACY_EVIDENCE_PATH]`.
+    const secGate = rdGates.find((g) => g.name === 'security-review');
+    const perfGate = rdGates.find((g) => g.name === 'perf-baseline');
+    const formOf = (gate) => gate?.passed === true && !gate.detail.includes('LEGACY_EVIDENCE_PATH') ? 'suffixed' : 'legacy';
+    const secForm = formOf(secGate);
+    const perfForm = formOf(perfGate);
     const acceptedForm = !secGate?.passed && !perfGate?.passed
         ? 'none'
-        : (secForm === 'suffixed' && perfForm === 'suffixed')
-            ? 'suffixed'
-            : (secForm === 'legacy' || perfForm === 'legacy')
-                ? 'legacy'
-                : 'suffixed';
+        : (secForm === 'legacy' || perfForm === 'legacy')
+            ? 'legacy'
+            : 'suffixed';
     const gateC = allQaGatesPassed ? 'pass' : 'fail';
     const gateH = allFeedbackGatesPassed ? 'pass' : 'fail';
     // Slice 2026-06-28-code-mode-bypass-fix (defect #3): `true` when

package/dist/services/workflow/pipeline-verify-types.d.ts

@@ -59,9 +59,16 @@ export type PipelineVerification = {
     };
     violations: string[];
     nextActions: string[];
-    /** Form of the security/performance findings artifacts Gate C accepted
-     * (slice 025). `'suffixed'` for the new per-rid form, `'legacy'` for the
-     * pre-slice-025 non-suffixed form, `'none'` when neither was found. */
+    /** Form of the security/performance evidence the RD gates accepted
+     * (slice 025). `'suffixed'` when the current contract's path served the
+     * file, `'legacy'` when a deprecated fallback did, `'none'` when neither
+     * gate passed. The per-rid `<rid>.md` suffix the union was named after was
+     * retired with `qa/security-findings-<rid>.md` (v2.11.0 D1/D4); the evidence
+     * now lives at `audit/security-<rid>.md` / `audit/perf-<rid>.md`
+     * (rid-scoped since slice `2026-09-14-audit-artifact-rid-scoping`) with
+     * `audit/security.md` / `audit/perf.md` and
+     * `rd/security-review.md` / `rd/perf-baseline.md` as the declared legacy
+     * fallbacks (rid 2026-09-14-verify-pipeline-contract-drift). */
     acceptedForm?: 'suffixed' | 'legacy' | 'none';
     /** `gateC` is the pre-computed verdict string (AC7 dogfood shape). */
     gateC?: 'pass' | 'fail';

package/dist/services/workflow/workflow-skip-service.js

@@ -186,7 +186,8 @@ function resolveSkipAppliedBy() {
         const { execFileSync } = require('node:child_process');
         const out = execFileSync('git', ['config', '--global', 'user.name'], {
             encoding: 'utf8',
-            stdio: ['ignore', 'pipe', 'ignore']
+            stdio: ['ignore', 'pipe', 'ignore'],
+            windowsHide: true
         });
         const trimmed = out.trim();
         if (trimmed.length > 0) {

package/dist/services/workspace/claude-settings-template.d.ts

@@ -83,15 +83,35 @@ export declare const CLAUDE_SETTINGS_LOCAL_FILENAME = ".claude/settings.local.js
  */
 export declare const TEMPLATE_VERSION = "1.7.0";
 /**
- * Compare two serialized template strings for semantic equivalence: does the
- * on-disk file already declare everything the generated template declares?
+ * Compare two serialized template strings: does the on-disk file already
+ * declare every entry the generated tree declares?
  *
- * Returns `true` iff both strings parse to objects whose
- * `hooks.PreToolUse` arrays are structurally identical (same length;
- * each entry's `matcher`, `hooks[].type`, `hooks[].command` match) AND the
- * on-disk `env` already carries every exemption the template declares (extra
- * on-disk keys and extra globs are allowed — a user may exempt other trees,
- * and a requirement the file already exceeds must not re-trigger a write).
+ * OWNERSHIP IS PER ENTRY, NOT PER KEY (rid 2026-09-13-two-decisions item ②).
+ * This comparator answers "is each entry the GENERATED tree declares present
+ * on disk?", NOT "are the two `hooks` trees identical". Extra on-disk entries
+ * are IGNORED, so an entry another writer put in this file never makes it look
+ * drifted.
+ *
+ * That is the deliberate other half of the entry-level merge in
+ * `mergeTemplateOwnedHooks` / `workspace-claude-settings-materializer.ts`.
+ * `.claude/settings.local.json` has a SECOND writer of `hooks.PreToolUse`:
+ * `installAutoCompactHook` appends a `Bash|Task` entry. Under the previous
+ * exact-tree rule the merged file carried 4 entries against a 3-entry
+ * generated tree, so every `peaks workspace init` answered "drifted",
+ * rewrote, and reported `refreshed` forever — precisely the state whole-key
+ * ownership existed to prevent, and the reason the merge could not ship alone.
+ *
+ * Matching is order-insensitive AND multiset-aware: the template declares TWO
+ * `Bash` entries, and each must have its own counterpart on disk, so a file
+ * carrying only one of them is still reported as drifted (the previous
+ * index-by-index loop had the same property; it is load-bearing, not a
+ * detail).
+ *
+ * Returns `true` iff both strings parse to objects whose `hooks.PreToolUse`
+ * arrays satisfy that containment AND the on-disk `env` already carries every
+ * exemption the template declares (extra on-disk keys and extra globs are
+ * allowed — a user may exempt other trees, and a requirement the file already
+ * exceeds must not re-trigger a write).
  *
  * Returns `false` on any `JSON.parse` error, shape mismatch, or
  * missing `hooks.PreToolUse`. Whitespace and key order do NOT affect
@@ -101,6 +121,34 @@ export declare const TEMPLATE_VERSION = "1.7.0";
  * refresh a stale `.peaks/.claude-settings-template.json` on disk.
  */
 export declare function templateContentMatches(generated: string, onDisk: string): boolean;
+/**
+ * Merge the on-disk `hooks.PreToolUse` list with the template's.
+ *
+ * THE OWNERSHIP RULE (rid 2026-09-13-two-decisions item ②): this template owns
+ * the entries IT DECLARES — and nothing else. Every other on-disk entry is
+ * carried across verbatim, whatever its matcher, because the template has no
+ * opinion about it:
+ *
+ *   - a `matcher` the template does not declare (`Bash|Task`, the auto-compact
+ *     hook `installAutoCompactHook` appends) is never touched;
+ *   - surplus entries BEYOND the template's count for a declared matcher (a
+ *     user's own `Bash` hook) are surplus too, and survive;
+ *   - an on-disk entry that fills a declared slot is REPLACED by the template's
+ *     entry for it. That is what makes a hand-edited (or older-release) entry
+ *     self-heal instead of lingering next to a correct copy of itself.
+ *
+ * Slot counting is per `matcher` and positional within it: the template
+ * declares TWO `Bash` entries, so the first two on-disk `Bash` entries are
+ * theirs and a third is the user's. The template's entries are emitted first,
+ * in template order, then the preserved ones in their on-disk order — which is
+ * a fixed point: re-merging the result yields the result (the template's own
+ * entries are encountered first and refill their own slots).
+ *
+ * Non-conforming entries (no string `matcher`, no `hooks` array) are preserved
+ * rather than dropped: guessing at their shape is how a user's entry gets
+ * deleted.
+ */
+export declare function mergeTemplateOwnedHooks(onDisk: ReadonlyArray<unknown>, template: ReadonlyArray<unknown>): unknown[];
 /**
  * Absolute path of the shipped Write|Edit|MultiEdit gate script.
  *