peaks-loop 4.0.47 → 4.0.48

package/dist/services/slice/slice-check-service.js

@@ -8,6 +8,7 @@ import { isDirectory } from 'peaks-loop-shared/fs';
 // is no longer read. Path-safety helpers now live at
 // `shared/path-safety.ts` if this module ever needs them.
 import { verifyPipeline } from '../workflow/pipeline-verify-service.js';
+import { REQUEST_ID_PATTERN } from '../artifacts/request-artifact-service.js';
 import { findMockViolations } from '../audit/enforcers/mock-placement.js';
 import { runRedLinesAudit } from '../audit/red-lines-service.js';
 /**
@@ -239,20 +240,29 @@ async function runUnitTests(projectRoot, runTests) {
         }
     };
 }
+// Slice `2026-09-14-audit-artifact-rid-scoping`: the evidence filenames
+// carry the rid now. Candidate order is canonical-first, then the
+// back-compat tiers — the same order `artifact-prerequisites.ts` resolves
+// in, so this boundary gate and the transition gate agree on which file is
+// a slice's evidence. `<rid>` is substituted at probe time.
 const REVIEW_FILES = [
-    { name: 'code-review', path: 'rd/code-review.md', label: 'code-review' },
+    {
+        name: 'code-review',
+        paths: ['rd/code-review-<rid>.md', 'rd/code-review.md'],
+        label: 'code-review'
+    },
     // v2.12.0 collapse: security + perf moved to standalone audit skills.
-    // `slice check` accepts EITHER the v2.11.x legacy path OR the v2.12.0
-    // canonical audit path during the 1-minor-release back-compat window
-    // (v2.13.0 hard-deletes the legacy paths — see CHANGELOG [2.12.0]).
+    // `slice check` accepts the rid-scoped audit path, the bare v2.12.0 path
+    // OR the v2.11.x legacy path during the 1-minor-release back-compat
+    // window (v2.13.0 hard-deletes the legacy paths — see CHANGELOG [2.12.0]).
     {
         name: 'security-review',
-        paths: ['audit/security.md', 'rd/security-review.md'],
+        paths: ['audit/security-<rid>.md', 'audit/security.md', 'rd/security-review.md'],
         label: 'security-review'
     },
     {
         name: 'perf-baseline',
-        paths: ['audit/perf.md', 'rd/perf-baseline.md'],
+        paths: ['audit/perf-<rid>.md', 'audit/perf.md', 'rd/perf-baseline.md'],
         label: 'perf-baseline'
     }
 ];
@@ -284,11 +294,11 @@ async function runReviewFanout(projectRoot, rid, refresh) {
     const found = [];
     for (const review of REVIEW_FILES) {
         let hit = null;
-        // v2.12.0 back-compat: each entry may list multiple candidate paths.
-        // First hit (in declared order) wins; canonical paths come first so
-        // v2.12.0+ slices preferentially report the new path even when both
-        // are present during migration.
-        const candidates = 'path' in review ? [review.path] : review.paths;
+        // Back-compat: each entry lists multiple candidate paths. First hit (in
+        // declared order) wins; canonical paths come first so a current slice
+        // preferentially reports its own rid-scoped evidence even when a legacy
+        // file is also present during migration.
+        const candidates = review.paths.map((candidate) => candidate.replace('<rid>', rid));
         for (const candidate of candidates) {
             for (const scope of scopes) {
                 const abs = join(projectRoot, '.peaks', scope, candidate);
@@ -367,6 +377,14 @@ export async function sliceCheck(options) {
         throw new Error('No --rid supplied. Pass --rid <id> on the CLI to identify which slice to check.');
     }
     const rid = options.rid;
+    // The rid becomes a filename in `runReviewFanout`'s candidate list and a
+    // directory segment in its `scopes` — both joined onto the project root. The
+    // rid is the repo's own request-id shape, and `request-artifact-service.ts`
+    // already refuses anything else; apply the same guard here rather than
+    // probing paths a hostile `--rid` steers.
+    if (!REQUEST_ID_PATTERN.test(rid)) {
+        throw new Error(`Invalid request id: ${rid} (expected letters, digits, dots, underscores, or dashes)`);
+    }
     const totalStart = Date.now();
     const stages = [];
     let unitTestsRunMode = 'skipped';

package/dist/services/slice/slice-review-state.js

@@ -14,6 +14,7 @@
  */
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
 /** The 5 default review items per slice (the 12 Gaps memory checklist). */
 export const DEFAULT_REVIEW_ITEMS = [
     { id: 'business-match', question: '这个 slice 做完,业务流程对吗?(跟产品最初给的需求匹配)' },
@@ -32,6 +33,13 @@ export function buildEmptySliceReview(sliceId, sessionId, now = new Date()) {
     };
 }
 export function getReviewDir(projectRoot, sessionId) {
+    // Sid axis. Every `peaks slice-review|score|accept|reject` subcommand reaches
+    // the runtime tree through this one constructor. Measured: `--session-id
+    // ../../../../…/PWNED` wrote `slice-reviews/<slice-id>.json` outside every
+    // project root under an `ok: true` envelope (RD sweep case A26).
+    if (isUnsafePathInput(sessionId)) {
+        throw new Error(`Invalid session id: ${sessionId} (must be a single path segment)`);
+    }
     return resolve(projectRoot, '.peaks', '_runtime', sessionId, 'slice-reviews');
 }
 export function getReviewPath(projectRoot, sessionId, sliceId) {

package/dist/services/workflow/pipeline-verify-gate-support.d.ts

@@ -8,7 +8,8 @@
  *
  * File budget: ≤ 400 lines (rid-006 split).
  */
-import type { RequestType } from '../artifacts/artifact-prerequisites.js';
+import { type ArtifactPrerequisite, type RequestType } from '../artifacts/artifact-prerequisites.js';
+import type { RequestArtifactRole, RequestArtifactState } from '../artifacts/request-artifact-service.js';
 import type { PipelineGate } from './pipeline-verify-types.js';
 export declare function extractState(markdown: string): string;
 /**
@@ -24,6 +25,38 @@ export declare function findRequestFile(projectRoot: string, role: string, rid:
     content: string;
     sessionId: string;
 } | null>;
+/**
+ * Where the CURRENT contract puts one gate's evidence.
+ *
+ * The contract is the `artifact-prerequisites.ts` table — the table
+ * `peaks request transition` enforces and the one the peaks-qa prose
+ * contract mirrors (`skills/bee/peaks-qa/references/qa-transition-gates.md`).
+ * `probeName` is the location this checker probes today. The contract's
+ * `relativePath` is returned first, then its accepted historical locations in
+ * the table's own declared order — `legacyRelativePath`, then
+ * `legacyRelativePaths` (the same composition `artifact-prerequisites.ts`' own
+ * resolver performs, so a hit here and a hit there land on the same file).
+ *
+ * Returns `null` when the contract carries no prerequisite for that name at
+ * all — the artifact was retired and no gate may fail on it.
+ *
+ * This lookup exists because hard-coding the paths here is what let
+ * `verify-pipeline` fall a minor release behind the gate: it kept demanding
+ * `rd/security-review.md` as mandatory after the table had demoted that file
+ * to a `legacyRelativePath` fallback of `audit/security.md`, and it kept
+ * demanding `qa/security-findings-<rid>.md` / `qa/performance-findings-<rid>.md`
+ * after the v2.11.0 D1/D4 trim dropped them from `qa:verdict-issued`
+ * altogether (rid 2026-09-14-verify-pipeline-contract-drift).
+ */
+/**
+ * The prerequisite the contract carries for `probeName`, or null when it
+ * carries none. `contractEvidencePaths` is this object's path projection; the
+ * BODY contract (`mustContain` / `mustContainAny` / `headingMustContain`) rides
+ * on the same object, which is why `contractBodyViolations` below consults it
+ * instead of probing for the file's existence alone.
+ */
+export declare function contractPrerequisite(role: RequestArtifactRole, state: RequestArtifactState, requestType: RequestType, probeName: string): ArtifactPrerequisite | null;
+export declare function contractEvidencePaths(role: RequestArtifactRole, state: RequestArtifactState, requestType: RequestType, probeName: string): string[] | null;
 export declare function rdGatesForType(requestType: RequestType): PipelineGate[];
 export declare function qaGatesForType(requestType: RequestType): PipelineGate[];
 export declare const RD_QA_HANDOFF_STATES: Set<string>;
@@ -33,15 +66,19 @@ export interface CanonicalPathTracker {
     anyEvidenceResolved: boolean;
     allResolvedPathsCanonical: boolean;
 }
-/** Resolve RD evidence files (tech-doc / bug-analysis / code-review / security-review)
+/** Resolve RD evidence files (prd-handoff / bug-analysis / code-review / security-review / perf-baseline)
  *  by probing canonical + legacy paths for each gate. Mutates the gate.passed /
  *  gate.detail fields in place and pushes violations / nextActions. Returns the
  *  updated tracker. Verbatim-move from `pipeline-verify-service.ts`. */
-export declare function resolveRdEvidencePaths(gates: PipelineGate[], rdEvidenceDir: string, projectRoot: string, violations: string[], nextActions: string[], tracker: CanonicalPathTracker): CanonicalPathTracker;
-/** Resolve QA evidence files (test-cases / test-report / security-findings /
- *  performance-findings) by probing canonical + legacy paths for each gate.
- *  For security/perf findings, delegates to the artifact-paths resolver.
- *  Mutates the gate.passed / gate.detail fields in place and pushes
- *  violations / nextActions. Returns the updated tracker. Verbatim-move
- *  from `pipeline-verify-service.ts`. */
-export declare function resolveQaEvidencePaths(gates: PipelineGate[], projectRoot: string, rdEvidenceDir: string, changeIdForResolver: string, rid: string, violations: string[], nextActions: string[], tracker: CanonicalPathTracker): CanonicalPathTracker;
+export declare function resolveRdEvidencePaths(gates: PipelineGate[], rdEvidenceDir: string, projectRoot: string, rid: string, requestType: RequestType, violations: string[], nextActions: string[], tracker: CanonicalPathTracker): CanonicalPathTracker;
+/** Resolve QA evidence files (test-cases / test-report) by probing canonical
+ *  + legacy paths for each gate. Mutates the gate.passed / gate.detail fields
+ *  in place and pushes violations / nextActions. Returns the updated tracker.
+ *  Verbatim-move from `pipeline-verify-service.ts`.
+ *
+ *  The `security-findings` / `performance-findings` branches that used to live
+ *  here are gone: those artifacts are not in any `qa:verdict-issued` table
+ *  (v2.11.0 D1/D4), and the evidence they stood for is resolved on the RD side
+ *  at the contract's own paths (`audit/security-<rid>.md`,
+ *  `audit/perf-<rid>.md`). */
+export declare function resolveQaEvidencePaths(gates: PipelineGate[], projectRoot: string, rdEvidenceDir: string, requestType: RequestType, rid: string, violations: string[], nextActions: string[], tracker: CanonicalPathTracker): CanonicalPathTracker;

package/dist/services/workflow/pipeline-verify-gate-support.js

@@ -8,17 +8,13 @@
  *
  * File budget: ≤ 400 lines (rid-006 split).
  */
-import { existsSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
+import { getPrerequisitesFor, prerequisiteBodyViolations } from '../artifacts/artifact-prerequisites.js';
 import { showRequestArtifact } from '../artifacts/request-artifact-service.js';
-import { resolveSecurityFindingsPath, resolvePerformanceFindingsPath } from './artifact-paths.js';
+import { readArtifactState } from '../artifacts/request-artifact-state-helpers.js';
 export function extractState(markdown) {
-    for (const rawLine of markdown.split(/\r?\n/)) {
-        const match = /^-\s*state:\s*(.+?)\s*$/.exec(rawLine.trim());
-        if (match?.[1])
-            return match[1];
-    }
-    return 'unknown';
+    return readArtifactState(markdown) ?? 'unknown';
 }
 /**
  * As of slice 2026-06-05-change-id-as-unit-of-work, the file's durable
@@ -44,12 +40,91 @@ export async function findRequestFile(projectRoot, role, rid) {
     }
     return { path: artifact.path, content: artifact.content, sessionId };
 }
+/**
+ * Where the CURRENT contract puts one gate's evidence.
+ *
+ * The contract is the `artifact-prerequisites.ts` table — the table
+ * `peaks request transition` enforces and the one the peaks-qa prose
+ * contract mirrors (`skills/bee/peaks-qa/references/qa-transition-gates.md`).
+ * `probeName` is the location this checker probes today. The contract's
+ * `relativePath` is returned first, then its accepted historical locations in
+ * the table's own declared order — `legacyRelativePath`, then
+ * `legacyRelativePaths` (the same composition `artifact-prerequisites.ts`' own
+ * resolver performs, so a hit here and a hit there land on the same file).
+ *
+ * Returns `null` when the contract carries no prerequisite for that name at
+ * all — the artifact was retired and no gate may fail on it.
+ *
+ * This lookup exists because hard-coding the paths here is what let
+ * `verify-pipeline` fall a minor release behind the gate: it kept demanding
+ * `rd/security-review.md` as mandatory after the table had demoted that file
+ * to a `legacyRelativePath` fallback of `audit/security.md`, and it kept
+ * demanding `qa/security-findings-<rid>.md` / `qa/performance-findings-<rid>.md`
+ * after the v2.11.0 D1/D4 trim dropped them from `qa:verdict-issued`
+ * altogether (rid 2026-09-14-verify-pipeline-contract-drift).
+ */
+/**
+ * The prerequisite the contract carries for `probeName`, or null when it
+ * carries none. `contractEvidencePaths` is this object's path projection; the
+ * BODY contract (`mustContain` / `mustContainAny` / `headingMustContain`) rides
+ * on the same object, which is why `contractBodyViolations` below consults it
+ * instead of probing for the file's existence alone.
+ */
+export function contractPrerequisite(role, state, requestType, probeName) {
+    for (const prereq of getPrerequisitesFor(role, state, requestType)) {
+        const legacyPaths = [
+            ...(prereq.legacyRelativePath !== undefined ? [prereq.legacyRelativePath] : []),
+            ...(prereq.legacyRelativePaths ?? [])
+        ];
+        if (prereq.relativePath !== probeName && !legacyPaths.includes(probeName))
+            continue;
+        return prereq;
+    }
+    return null;
+}
+export function contractEvidencePaths(role, state, requestType, probeName) {
+    const prereq = contractPrerequisite(role, state, requestType, probeName);
+    if (prereq === null)
+        return null;
+    const legacyPaths = [
+        ...(prereq.legacyRelativePath !== undefined ? [prereq.legacyRelativePath] : []),
+        ...(prereq.legacyRelativePaths ?? [])
+    ];
+    return [prereq.relativePath, ...legacyPaths.filter((legacy) => legacy !== prereq.relativePath)];
+}
+/**
+ * The contract's BODY checks for the prerequisite named by `probeName`, applied
+ * to the file that resolved. Empty when the name matches nothing in the table or
+ * the table pins no body markers for it.
+ *
+ * `existsSync` alone made this checker laxer than the contract it claims to
+ * derive from: it reported `prd-handoff passed = true` for a handoff carrying
+ * `schemaVersion: 1` and no `sha256:` line — the exact file
+ * `AUDIT_REQUIRES_HANDOFF` refuses at `rd:qa-handoff`. Deriving the *path* from
+ * the table while dropping the table's *body* contract is the drift this module
+ * exists to remove, so the check goes through the table's own implementation
+ * (`prerequisiteBodyViolations`) rather than a second copy of the markers.
+ */
+function contractBodyViolations(role, state, requestType, probeName, absolutePath) {
+    const prerequisite = contractPrerequisite(role, state, requestType, probeName);
+    if (prerequisite === null)
+        return [];
+    return prerequisiteBodyViolations(prerequisite, readFileSync(absolutePath, 'utf8'));
+}
 export function rdGatesForType(requestType) {
     const gates = [
         { name: 'rd-request-exists', description: 'RD request artifact created', passed: false, detail: '' }
     ];
-    if (requestType === 'feature' || requestType === 'refactor') {
-        gates.push({ name: 'tech-doc', description: 'Technical design doc', passed: false, detail: '' });
+    // This slot used to pin a `tech-doc` gate to `rd/tech-doc.md`, an artifact
+    // v2.11.0 Group A retired and the table no longer carries — so the gate
+    // failed trees `peaks request transition` accepts (QA repair cycle 1). The
+    // design / scope record the contract DOES name at `rd:qa-handoff` is
+    // `prd/handoff.md`, so that is the gate: table-derived, like the others.
+    // (`rd/tech-doc.md` still has two non-gate readers — final-review's evidence
+    // budget and the resume detector. Neither is served by failing a compliant
+    // slice.)
+    if (contractEvidencePaths('rd', 'qa-handoff', requestType, 'prd/handoff.md') !== null) {
+        gates.push({ name: 'prd-handoff', description: 'PRD handoff capsule (approved scope + non-goals)', passed: false, detail: '' });
     }
     if (requestType === 'bugfix') {
         gates.push({ name: 'bug-analysis', description: 'Bug root-cause analysis', passed: false, detail: '' });
@@ -60,6 +135,17 @@ export function rdGatesForType(requestType) {
     if (requestType === 'feature' || requestType === 'refactor' || requestType === 'bugfix' || requestType === 'config') {
         gates.push({ name: 'security-review', description: 'Security review evidence', passed: false, detail: '' });
     }
+    // The perf evidence the contract requires at `rd:qa-handoff` is `AUDIT_PERF`
+    // — `audit/perf-<rid>.md`, with `audit/perf.md` and `rd/perf-baseline.md` as
+    // its two declared legacy tiers (rid-scoped since slice
+    // `2026-09-14-audit-artifact-rid-scoping`). This gate used to live on the QA
+    // side as `performance-findings`, checking `qa/performance-findings-<rid>.md`
+    // — a path the v2.11.0 D1/D4 trim dropped. Relocating the gate (rather than
+    // deleting it) is what keeps AC3's control meaningful: perf evidence that is
+    // genuinely absent must still fail.
+    if (contractEvidencePaths('rd', 'qa-handoff', requestType, 'rd/perf-baseline.md') !== null) {
+        gates.push({ name: 'perf-baseline', description: 'Performance audit evidence', passed: false, detail: '' });
+    }
     return gates;
 }
 export function qaGatesForType(requestType) {
@@ -70,124 +156,157 @@ export function qaGatesForType(requestType) {
         gates.push({ name: 'test-cases', description: 'QA test cases', passed: false, detail: '' });
         gates.push({ name: 'test-report', description: 'QA test report with execution results', passed: false, detail: '' });
     }
-    if (requestType === 'feature' || requestType === 'refactor' || requestType === 'bugfix' || requestType === 'config') {
-        gates.push({ name: 'security-findings', description: 'QA security findings', passed: false, detail: '' });
-    }
-    if (requestType === 'feature' || requestType === 'refactor') {
-        gates.push({ name: 'performance-findings', description: 'QA performance findings', passed: false, detail: '' });
-    }
+    // The `security-findings` / `performance-findings` gates were removed here
+    // (rid 2026-09-14-verify-pipeline-contract-drift). peaks-qa does not own
+    // security review or performance review — `peaks-qa/SKILL.md` says so, and
+    // the v2.11.0 D1/D4 trim dropped both from every `qa:verdict-issued` table.
+    // The evidence they used to demand is now checked on the RD side, at the
+    // paths the contract actually names (`audit/security-<rid>.md`,
+    // `audit/perf-<rid>.md`; rid-scoped since slice
+    // `2026-09-14-audit-artifact-rid-scoping`, with `audit/security.md` /
+    // `audit/perf.md` and `rd/security-review.md` / `rd/perf-baseline.md` as the
+    // declared legacy tiers behind them).
     return gates;
 }
 export const RD_QA_HANDOFF_STATES = new Set(['qa-handoff', 'handed-off', 'implemented']);
 export const QA_COMPLETE_STATES = new Set(['verdict-issued']);
-/** Resolve RD evidence files (tech-doc / bug-analysis / code-review / security-review)
+/** Resolve RD evidence files (prd-handoff / bug-analysis / code-review / security-review / perf-baseline)
  *  by probing canonical + legacy paths for each gate. Mutates the gate.passed /
  *  gate.detail fields in place and pushes violations / nextActions. Returns the
  *  updated tracker. Verbatim-move from `pipeline-verify-service.ts`. */
-export function resolveRdEvidencePaths(gates, rdEvidenceDir, projectRoot, violations, nextActions, tracker) {
-    const RD_EVIDENCE_FILE = {
-        'tech-doc': 'tech-doc.md',
-        'bug-analysis': 'bug-analysis.md',
-        'code-review': 'code-review.md',
-        'security-review': 'security-review.md'
+export function resolveRdEvidencePaths(gates, rdEvidenceDir, projectRoot, rid, requestType, violations, nextActions, tracker) {
+    // The path each gate is about. The contract is consulted first — see
+    // `contractEvidencePaths`; `rdGatesForType` only builds a gate when the
+    // contract carries its prerequisite, so this is the name the gate stands
+    // for, not a second path table.
+    const RD_EVIDENCE_PROBE = {
+        'prd-handoff': 'prd/handoff.md',
+        'bug-analysis': 'rd/bug-analysis.md',
+        'code-review': 'rd/code-review.md',
+        'security-review': 'rd/security-review.md',
+        'perf-baseline': 'rd/perf-baseline.md'
     };
     let anyEvidenceResolved = tracker.anyEvidenceResolved;
     let allResolvedPathsCanonical = tracker.allResolvedPathsCanonical;
     for (const gate of gates.slice(1)) {
-        const fileName = RD_EVIDENCE_FILE[gate.name];
-        const canonicalPath = join(projectRoot, '.peaks', '_runtime', rdEvidenceDir, 'rd', fileName);
-        const legacyMisplacedPath = join(projectRoot, '.peaks', rdEvidenceDir, 'rd', fileName);
-        const legacyChangeAxisPath = join(projectRoot, '.peaks', '_runtime', 'change', rdEvidenceDir, 'rd', fileName);
-        let resolvedPath = null;
-        let usedLegacy = false;
-        for (const candidate of [canonicalPath, legacyMisplacedPath, legacyChangeAxisPath]) {
-            if (existsSync(candidate)) {
-                resolvedPath = candidate;
-                usedLegacy = candidate !== canonicalPath;
-                break;
+        const probeName = RD_EVIDENCE_PROBE[gate.name];
+        const relativePaths = (contractEvidencePaths('rd', 'qa-handoff', requestType, probeName) ?? [probeName])
+            .map((relative) => relative.replace('<rid>', rid));
+        const primaryRelativePath = relativePaths[0];
+        const canonicalPath = join(projectRoot, '.peaks', '_runtime', rdEvidenceDir, primaryRelativePath);
+        // Two independent axes, kept apart because they mean different things:
+        //   - `legacyRoot` — the file sits under a pre-F3 session home
+        //     (`.peaks/<sid>/…` or `.peaks/_runtime/change/<sid>/…`). That is a
+        //     misplaced write, and it is the DEPRECATION violation's subject.
+        //   - `legacyForm` — the file sits under one of the contract's declared
+        //     `legacyRelativePaths`. The contract accepts those on purpose ("a
+        //     legacy hit must keep the gate open, or existing sessions would fail
+        //     the transition on upgrade"), so this is reported through
+        //     `acceptedForm` and is *not* a violation.
+        const candidates = [];
+        for (const relative of relativePaths) {
+            const legacyForm = relative !== primaryRelativePath;
+            for (const [root, legacyRoot] of [
+                [join(projectRoot, '.peaks', '_runtime', rdEvidenceDir), false],
+                [join(projectRoot, '.peaks', rdEvidenceDir), true],
+                [join(projectRoot, '.peaks', '_runtime', 'change', rdEvidenceDir), true]
+            ]) {
+                candidates.push({ path: join(root, relative), legacyRoot, legacyForm });
             }
         }
-        if (resolvedPath !== null) {
+        const hit = candidates.find((candidate) => existsSync(candidate.path));
+        if (hit !== undefined) {
             anyEvidenceResolved = true;
-            if (usedLegacy)
+            if (hit.legacyRoot)
                 allResolvedPathsCanonical = false;
-            gate.passed = true;
-            gate.detail = resolvedPath + (usedLegacy ? ' [DEPRECATION_LEGACY_PATH_USED]' : '');
-            if (usedLegacy) {
-                violations.push(`DEPRECATION_LEGACY_PATH_USED: ${resolvedPath} — move the file into .peaks/_runtime/${rdEvidenceDir}/rd/ (the canonical location) so subsequent runs resolve on the canonical path. The legacy \`peaks workspace migrate-change-scope\` helper was removed in v2.19.0; use \`peaks workspace migrate\` to relocate misplaced content.`);
+            // Existing is not the contract — the file must also satisfy the body
+            // markers the table pins for this prereq (see `contractBodyViolations`).
+            const bodyViolations = contractBodyViolations('rd', 'qa-handoff', requestType, probeName, hit.path);
+            if (bodyViolations.length > 0) {
+                gate.passed = false;
+                gate.detail = `${hit.path} — ${bodyViolations.join('; ')}`;
+                violations.push(`RD evidence does not satisfy the contract: ${gate.description} (${primaryRelativePath}) — ${bodyViolations.join('; ')}`);
+                nextActions.push(`Fix .peaks/_runtime/${rdEvidenceDir}/${primaryRelativePath} to satisfy the contract: ${bodyViolations.join('; ')}`);
+            }
+            else {
+                gate.passed = true;
+                gate.detail = hit.path
+                    + (hit.legacyRoot ? ' [DEPRECATION_LEGACY_PATH_USED]' : '')
+                    + (hit.legacyForm ? ' [LEGACY_EVIDENCE_PATH]' : '');
+            }
+            if (hit.legacyRoot) {
+                violations.push(`DEPRECATION_LEGACY_PATH_USED: ${hit.path} — move the file into .peaks/_runtime/${rdEvidenceDir}/${primaryRelativePath} (the canonical location) so subsequent runs resolve on the canonical path. The legacy \`peaks workspace migrate-change-scope\` helper was removed in v2.19.0; use \`peaks workspace migrate\` to relocate misplaced content.`);
             }
         }
         else {
             gate.detail = `missing: ${canonicalPath}`;
-            violations.push(`RD evidence missing: ${gate.description} (${fileName})`);
-            nextActions.push(`Create .peaks/_runtime/${rdEvidenceDir}/rd/${fileName}`);
+            violations.push(`RD evidence missing: ${gate.description} (${primaryRelativePath})`);
+            nextActions.push(`Create .peaks/_runtime/${rdEvidenceDir}/${primaryRelativePath}`);
         }
     }
     return { anyEvidenceResolved, allResolvedPathsCanonical };
 }
-/** Resolve QA evidence files (test-cases / test-report / security-findings /
- *  performance-findings) by probing canonical + legacy paths for each gate.
- *  For security/perf findings, delegates to the artifact-paths resolver.
- *  Mutates the gate.passed / gate.detail fields in place and pushes
- *  violations / nextActions. Returns the updated tracker. Verbatim-move
- *  from `pipeline-verify-service.ts`. */
-export function resolveQaEvidencePaths(gates, projectRoot, rdEvidenceDir, changeIdForResolver, rid, violations, nextActions, tracker) {
-    const QA_EVIDENCE_FILE = {
-        'test-cases': `test-cases/${rid}.md`,
-        'test-report': `test-reports/${rid}.md`,
-        'security-findings': '',
-        'performance-findings': ''
+/** Resolve QA evidence files (test-cases / test-report) by probing canonical
+ *  + legacy paths for each gate. Mutates the gate.passed / gate.detail fields
+ *  in place and pushes violations / nextActions. Returns the updated tracker.
+ *  Verbatim-move from `pipeline-verify-service.ts`.
+ *
+ *  The `security-findings` / `performance-findings` branches that used to live
+ *  here are gone: those artifacts are not in any `qa:verdict-issued` table
+ *  (v2.11.0 D1/D4), and the evidence they stood for is resolved on the RD side
+ *  at the contract's own paths (`audit/security-<rid>.md`,
+ *  `audit/perf-<rid>.md`). */
+export function resolveQaEvidencePaths(gates, projectRoot, rdEvidenceDir, requestType, rid, violations, nextActions, tracker) {
+    const QA_EVIDENCE_PROBE = {
+        'test-cases': 'qa/test-cases/<rid>.md',
+        'test-report': 'qa/test-reports/<rid>.md'
     };
     let anyEvidenceResolved = tracker.anyEvidenceResolved;
     let allResolvedPathsCanonical = tracker.allResolvedPathsCanonical;
     for (const gate of gates.slice(1)) {
-        if (gate.name === 'security-findings' || gate.name === 'performance-findings') {
-            const resolver = gate.name === 'security-findings' ? resolveSecurityFindingsPath : resolvePerformanceFindingsPath;
-            const resolved = resolver({ projectRoot, sessionId: changeIdForResolver, rid });
-            if (existsSync(resolved.path)) {
-                anyEvidenceResolved = true;
-                if (resolved.form === 'legacy')
-                    allResolvedPathsCanonical = false;
-                gate.passed = true;
-                gate.detail = resolved.path;
-                if (resolved.form === 'legacy') {
-                    violations.push(`QA evidence accepted in legacy form (will be rejected after next minor release): ${resolved.path} — re-run peaks workflow plan refresh to migrate`);
-                }
-            }
-            else {
-                gate.detail = `missing: ${resolved.path}`;
-                violations.push(`QA evidence missing: ${gate.description} (${resolved.path})`);
-                nextActions.push(`Create ${resolved.path} (or use the legacy non-suffixed form during the 1-minor-release back-compat window)`);
-            }
-            continue;
-        }
-        const fileName = QA_EVIDENCE_FILE[gate.name];
-        const canonicalQaPath = join(projectRoot, '.peaks', '_runtime', rdEvidenceDir, 'qa', fileName);
-        const legacyMisplacedQaPath = join(projectRoot, '.peaks', rdEvidenceDir, 'qa', fileName);
-        const legacyChangeAxisQaPath = join(projectRoot, '.peaks', '_runtime', 'change', rdEvidenceDir, 'qa', fileName);
-        let resolvedQaPath = null;
-        let usedLegacyQa = false;
-        for (const candidate of [canonicalQaPath, legacyMisplacedQaPath, legacyChangeAxisQaPath]) {
-            if (existsSync(candidate)) {
-                resolvedQaPath = candidate;
-                usedLegacyQa = candidate !== canonicalQaPath;
-                break;
+        const probeName = QA_EVIDENCE_PROBE[gate.name];
+        const relativePaths = (contractEvidencePaths('qa', 'verdict-issued', requestType, probeName) ?? [probeName])
+            .map((relative) => relative.replace('<rid>', rid));
+        const primaryRelativePath = relativePaths[0];
+        const canonicalQaPath = join(projectRoot, '.peaks', '_runtime', rdEvidenceDir, primaryRelativePath);
+        const candidates = [];
+        for (const relative of relativePaths) {
+            for (const [root, legacyRoot] of [
+                [join(projectRoot, '.peaks', '_runtime', rdEvidenceDir), false],
+                [join(projectRoot, '.peaks', rdEvidenceDir), true],
+                [join(projectRoot, '.peaks', '_runtime', 'change', rdEvidenceDir), true]
+            ]) {
+                candidates.push({ path: join(root, relative), legacyRoot });
             }
         }
-        if (resolvedQaPath !== null) {
+        const hit = candidates.find((candidate) => existsSync(candidate.path));
+        if (hit !== undefined) {
             anyEvidenceResolved = true;
-            if (usedLegacyQa)
+            if (hit.legacyRoot)
                 allResolvedPathsCanonical = false;
-            gate.passed = true;
-            gate.detail = resolvedQaPath + (usedLegacyQa ? ' [DEPRECATION_LEGACY_PATH_USED]' : '');
-            if (usedLegacyQa) {
-                violations.push(`DEPRECATION_LEGACY_PATH_USED: ${resolvedQaPath} — move the file into .peaks/_runtime/${rdEvidenceDir}/qa/ (the canonical location) so subsequent runs resolve on the canonical path. The legacy \`peaks workspace migrate-change-scope\` helper was removed in v2.19.0; use \`peaks workspace migrate\` to relocate misplaced content.`);
+            // Same contract check as the RD side: the `test-report` / `test-cases`
+            // prereqs pin `## Test execution` / `## Test cases` / `test(`, and a
+            // checker that only probed existence reported green on files the
+            // `qa:verdict-issued` gate rejects.
+            const bodyViolations = contractBodyViolations('qa', 'verdict-issued', requestType, probeName, hit.path);
+            if (bodyViolations.length > 0) {
+                gate.passed = false;
+                gate.detail = `${hit.path} — ${bodyViolations.join('; ')}`;
+                violations.push(`QA evidence does not satisfy the contract: ${gate.description} (${primaryRelativePath}) — ${bodyViolations.join('; ')}`);
+                nextActions.push(`Fix .peaks/_runtime/${rdEvidenceDir}/${primaryRelativePath} to satisfy the contract: ${bodyViolations.join('; ')}`);
+            }
+            else {
+                gate.passed = true;
+                gate.detail = hit.path + (hit.legacyRoot ? ' [DEPRECATION_LEGACY_PATH_USED]' : '');
+            }
+            if (hit.legacyRoot) {
+                violations.push(`DEPRECATION_LEGACY_PATH_USED: ${hit.path} — move the file into .peaks/_runtime/${rdEvidenceDir}/${primaryRelativePath} (the canonical location) so subsequent runs resolve on the canonical path. The legacy \`peaks workspace migrate-change-scope\` helper was removed in v2.19.0; use \`peaks workspace migrate\` to relocate misplaced content.`);
             }
         }
         else {
             gate.detail = `missing: ${canonicalQaPath}`;
-            violations.push(`QA evidence missing: ${gate.description} (${fileName})`);
-            nextActions.push(`Create .peaks/_runtime/${rdEvidenceDir}/qa/${fileName}`);
+            violations.push(`QA evidence missing: ${gate.description} (${primaryRelativePath})`);
+            nextActions.push(`Create .peaks/_runtime/${rdEvidenceDir}/${primaryRelativePath}`);
         }
     }
     return { anyEvidenceResolved, allResolvedPathsCanonical };