peaks-loop 4.0.47 → 4.0.49

package/dist/services/observability/observability-service.js

@@ -19,7 +19,7 @@
  * result (fire-and-forget by convention).
  */
 import { z } from 'zod';
-import { appendMetricLine, metricsFilePath, pruneMetricsFiles, readMetricLines } from './jsonl-store.js';
+import { appendMetricLine, pruneMetricsFiles, readMetricLines, tryMetricsFilePath } from './jsonl-store.js';
 export const OBSERVABILITY_SCHEMA_VERSION = 1;
 export const OBSERVABILITY_CATEGORIES = [
     'slice-transition',
@@ -74,7 +74,17 @@ export const ObservabilityEventSchema = z.object({
  * session count is below `MAX_METRICS_FILES`.
  */
 export function emitObservabilityEvent(event, options) {
-    const path = metricsFilePath(options.projectRoot, event.sessionId);
+    // The session id is resolved through the axis's TOTAL entry, before anything
+    // else. The contract two doc comments above is that this function never
+    // throws; the previous first line called the axis's THROWING entry, so an
+    // unsafe session id made it throw — measured (repair R4) as
+    // `Invalid session id: ../../../../RD-R4-PWNED`, against a legal control
+    // that returned `written: true`. A guard refusal is a failure like any
+    // other here: it becomes a reason, not an exception.
+    const path = tryMetricsFilePath(options.projectRoot, event.sessionId);
+    if (path === null) {
+        return { written: false, path: '', reason: 'invalid-session-id' };
+    }
     const validation = ObservabilityEventSchema.safeParse(event);
     if (!validation.success) {
         return { written: false, path, reason: 'invalid-schema' };
@@ -93,7 +103,10 @@ export function emitObservabilityEvent(event, options) {
  * lines and any record whose `schemaVersion` does not match the
  * current `OBSERVABILITY_SCHEMA_VERSION` (forward-compat per Q3).
  *
- * Returns [] when the session has no metrics file yet.
+ * Returns [] when the session has no metrics file yet, and [] when the
+ * session id names no session directory — both are "no events are
+ * readable here", and this reader does not throw (repair R6: it used to,
+ * via `readMetricLines` → `metricsFilePath`).
  */
 export function readObservabilityEvents(projectRoot, sessionId) {
     const lines = readMetricLines(projectRoot, sessionId);

package/dist/services/polyrepo/polyrepo-dispatcher.js

@@ -25,6 +25,7 @@
  */
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
 /** Compute the child-side path where the artifact should be mirrored.
  *  Mirrors the parent shape exactly: `.peaks/_runtime/<sid>/<role>/`. */
 function childArtifactPath(childRoot, sid, role, sourcePath) {
@@ -37,6 +38,16 @@ function ensureDirFor(file) {
 export function dispatchArtifact(opts) {
     const warnings = [];
     const perChild = [];
+    // `sid` becomes a path segment in every child (`childArtifactPath`). It has no
+    // pinned format (`--sid` is a free-form override), so it gets the repo's
+    // segment check — the same `isUnsafePathInput` `peaks evidence generate` and
+    // `peaks verdict aggregate` apply to their session id. Guard before the first
+    // mkdir so a rejected dispatch leaves nothing behind. Measured before this
+    // line existed: `--sid '../../../../../../PWNED-SID-ESCAPE'` wrote
+    // `<parent-of-fixture>/PWNED-SID-ESCAPE/prd/src.md`, above every project root.
+    if (isUnsafePathInput(opts.sid)) {
+        throw new Error(`Invalid session id: ${opts.sid} (must be a single path segment)`);
+    }
     // Validate targets against the manifest.
     const knownIds = new Set(opts.manifest.children.map((c) => c.id));
     const validTargets = [];

package/dist/services/prd/handoff-auto-regen.js

@@ -1,13 +1,18 @@
 /**
- * v2.13.2 AC-4 — prd/handoff.md auto-regen on prd:handed-off.
+ * v2.13.2 AC-4 — prd/handoff-<rid>.md auto-regen on prd:handed-off.
  *
  * When `peaks request transition --role prd --state handed-off` succeeds
- * and `prd/handoff.md` is missing, this helper writes a sha256-locked
+ * and this slice's capsule is missing, this helper writes a sha256-locked
  * handoff (schemaVersion: 2) using the request artifact body as the
- * handoff body. If the handoff already exists, it's NOT overwritten —
+ * handoff body. If the capsule already exists, it's NOT overwritten —
  * the existing handoff is canonical (it may carry a richer body that
  * peaks-prd produced in an earlier session).
  *
+ * Slice `2026-09-14-prd-capsule-rid-scoping`: the path carries the rid, so
+ * "already exists" is now asked per SLICE. The pre-rid-scoping bare name is
+ * deliberately NOT consulted — writing there would recreate the
+ * one-slot-per-session collision for the next slice in the session.
+ *
  * Karpathy §3 (Surgical Changes): this file only owns the auto-regen
  * path. The other 11 transitions are untouched.
  */
@@ -15,7 +20,8 @@ import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { createHash } from 'node:crypto';
 import { showRequestArtifact } from '../artifacts/request-artifact-service.js';
-import { sha256OfBody } from './handoff-service.js';
+import { serializeHandoffFrontmatter } from './handoff-frontmatter.js';
+import { handoffRelativePath, sha256OfBody } from './handoff-service.js';
 import { normalizePath } from '../../shared/path-utils.js';
 /**
  * Auto-regen the prd/handoff.md under `.peaks/_runtime/<sid>/prd/`.
@@ -25,7 +31,7 @@ export async function autoRegenPrdHandoff(opts) {
     if (opts.role !== 'prd') {
         return { status: 'failed', reason: 'role must be prd' };
     }
-    const handoffPath = join(opts.projectRoot, '.peaks', '_runtime', opts.sessionId, 'prd', 'handoff.md');
+    const handoffPath = join(opts.projectRoot, handoffRelativePath(opts.sessionId, opts.requestId));
     if (existsSync(handoffPath)) {
         return { status: 'skipped-exists', path: handoffPath };
     }
@@ -41,28 +47,26 @@ export async function autoRegenPrdHandoff(opts) {
     const body = artifact.content;
     const sha256 = sha256OfBody(body);
     // v2.13.3 AC-4 — align with `AUDIT_REQUIRES_HANDOFF` prereq which
-    // pins `mustContain: ['schemaVersion: 2', 'sha256:']`. The previous
-    // field name `handoffHash` made peaks-loop write a handoff that the
-    // own prereq resolver would reject with "missing section(s): sha256:".
-    // Primary field is now `sha256`; `handoffHash` is kept as a literal
-    // alias for back-compat with any consumer (UI / external scripts)
-    // that still reads the old key.
-    const frontmatter = [
-        '---',
-        `requestId: ${opts.requestId}`,
-        `sessionId: ${opts.sessionId}`,
-        'schemaVersion: 2',
-        `sha256: ${sha256}`,
-        `handoffHash: ${sha256}`,
-        `writtenAt: ${new Date().toISOString()}`,
-        'goals: []',
-        'acceptanceCriteria: []',
-        'preservedBehavior: []',
-        `handoffPath: ${normalizePath(handoffPath.replace(opts.projectRoot, '')).replace(/^\//, '')}`,
-        '---',
-        ''
-    ].join('\n');
-    const content = `${frontmatter}${body}`;
+    // pins `mustContain: ['schemaVersion: 2', 'sha256:']`. Primary field is
+    // `sha256`; `handoffHash` is kept as a literal alias for the readers that
+    // still use the old key.
+    //
+    // Slice `2026-09-14-handoff-writer-gate-divergence`: this block used to be
+    // hand-rolled here while `handoff-service.serializeHandoff` rendered the
+    // SAME contract a second, incompatible way. Both now go through
+    // `serializeHandoffFrontmatter`, so the two producers cannot drift again.
+    const frontmatter = {
+        requestId: opts.requestId,
+        sessionId: opts.sessionId,
+        schemaVersion: '2',
+        handoffHash: sha256,
+        writtenAt: new Date().toISOString(),
+        goals: [],
+        acceptanceCriteria: [],
+        preservedBehavior: [],
+        handoffPath: normalizePath(handoffPath.replace(opts.projectRoot, '')).replace(/^\//, '')
+    };
+    const content = `${serializeHandoffFrontmatter(frontmatter)}${body}`;
     mkdirSync(dirname(handoffPath), { recursive: true });
     writeFileSync(handoffPath, content, 'utf8');
     const recomputed = createHash('sha256').update(body, 'utf8').digest('hex');

package/dist/services/prd/handoff-frontmatter.d.ts

@@ -0,0 +1,44 @@
+/**
+ * The ONE canonical serialization of `prd/handoff.md` frontmatter.
+ *
+ * Why this module exists (slice `2026-09-14-handoff-writer-gate-divergence`):
+ * the handoff capsule is written by two producers and read by four
+ * consumers, and they did not agree on the bytes:
+ *
+ *   | consumer / producer | requirement |
+ *   |---|---|
+ *   | `AUDIT_REQUIRES_HANDOFF` (`artifact-prerequisites.ts`) | SUBSTRING `schemaVersion: 2` (unquoted) + `sha256:` |
+ *   | `audit-independent/{security,perf}-audit-service.ts` | anchored `^schemaVersion:\s*(\d+)\s*$` and `^sha256:\s*([a-f0-9]{64})\s*$` |
+ *   | `handoff-service.readHandoff` | YAML string `handoffHash` |
+ *   | `handoff-service.verifyHandoff` | `handoffHash` === sha256(body), bare hex |
+ *
+ * `handoff-service.serializeHandoff` fed the frontmatter through
+ * `yaml.stringify`, which emits `schemaVersion: "2"` and a bare
+ * `handoffHash:` — failing the gate AND both loaders. `handoff-auto-regen.ts`
+ * hand-rolled a second serialization that happened to satisfy all four. Two
+ * producers, two facts about the same contract, one of them wrong: that is
+ * the defect, and copying the right shape into a third place would keep it.
+ *
+ * So both producers call THIS function. `sha256` is emitted only here, and
+ * it is emitted plain, because the two audit loaders anchor a regex on it.
+ *
+ * Scalar-quoting rule — one rule, one documented exception set:
+ *   - every ordinary string is emitted through `yamlScalar` (a JSON
+ *     double-quoted scalar, which is valid YAML 1.2 and round-trips
+ *     backslashes correctly on Windows paths);
+ *   - `schemaVersion` and `sha256` are the exception: emitted PLAIN, because
+ *     they are the two scalars the gate and the loaders match textually and a
+ *     quoted scalar is invisible to all three. Both values are structurally
+ *     constrained (a version digit and 64 hex chars), so plain is unambiguous.
+ *
+ * `handoffHash` is quoted even though it is also a 64-hex value: the reader
+ * parses the block through YAML and requires a STRING, and a bare all-digit
+ * sha256 would parse as a YAML number and be refused by the shape check.
+ */
+import type { HandoffFrontmatter } from './handoff-types.js';
+/**
+ * Serialize `frontmatter` into the fenced block, terminated by the closing
+ * `---` and a trailing newline. Callers append the body verbatim, which keeps
+ * the sha256 of the body independent of how the frontmatter renders.
+ */
+export declare function serializeHandoffFrontmatter(frontmatter: HandoffFrontmatter): string;

package/dist/services/prd/handoff-frontmatter.js

@@ -0,0 +1,75 @@
+/**
+ * The ONE canonical serialization of `prd/handoff.md` frontmatter.
+ *
+ * Why this module exists (slice `2026-09-14-handoff-writer-gate-divergence`):
+ * the handoff capsule is written by two producers and read by four
+ * consumers, and they did not agree on the bytes:
+ *
+ *   | consumer / producer | requirement |
+ *   |---|---|
+ *   | `AUDIT_REQUIRES_HANDOFF` (`artifact-prerequisites.ts`) | SUBSTRING `schemaVersion: 2` (unquoted) + `sha256:` |
+ *   | `audit-independent/{security,perf}-audit-service.ts` | anchored `^schemaVersion:\s*(\d+)\s*$` and `^sha256:\s*([a-f0-9]{64})\s*$` |
+ *   | `handoff-service.readHandoff` | YAML string `handoffHash` |
+ *   | `handoff-service.verifyHandoff` | `handoffHash` === sha256(body), bare hex |
+ *
+ * `handoff-service.serializeHandoff` fed the frontmatter through
+ * `yaml.stringify`, which emits `schemaVersion: "2"` and a bare
+ * `handoffHash:` — failing the gate AND both loaders. `handoff-auto-regen.ts`
+ * hand-rolled a second serialization that happened to satisfy all four. Two
+ * producers, two facts about the same contract, one of them wrong: that is
+ * the defect, and copying the right shape into a third place would keep it.
+ *
+ * So both producers call THIS function. `sha256` is emitted only here, and
+ * it is emitted plain, because the two audit loaders anchor a regex on it.
+ *
+ * Scalar-quoting rule — one rule, one documented exception set:
+ *   - every ordinary string is emitted through `yamlScalar` (a JSON
+ *     double-quoted scalar, which is valid YAML 1.2 and round-trips
+ *     backslashes correctly on Windows paths);
+ *   - `schemaVersion` and `sha256` are the exception: emitted PLAIN, because
+ *     they are the two scalars the gate and the loaders match textually and a
+ *     quoted scalar is invisible to all three. Both values are structurally
+ *     constrained (a version digit and 64 hex chars), so plain is unambiguous.
+ *
+ * `handoffHash` is quoted even though it is also a 64-hex value: the reader
+ * parses the block through YAML and requires a STRING, and a bare all-digit
+ * sha256 would parse as a YAML number and be refused by the shape check.
+ */
+/** Render a string as a YAML double-quoted scalar. JSON string escapes are a
+ *  subset of YAML 1.2's double-quoted escapes, so this is valid YAML and
+ *  handles `\` (Windows paths), quotes, colons and newlines in one step. */
+function yamlScalar(value) {
+    return JSON.stringify(value);
+}
+/** Render `key: []` or a YAML block sequence of quoted scalars. */
+function blockSequence(key, values) {
+    if (values.length === 0)
+        return [`${key}: []`];
+    return [`${key}:`, ...values.map((value) => `  - ${yamlScalar(value)}`)];
+}
+/**
+ * Serialize `frontmatter` into the fenced block, terminated by the closing
+ * `---` and a trailing newline. Callers append the body verbatim, which keeps
+ * the sha256 of the body independent of how the frontmatter renders.
+ */
+export function serializeHandoffFrontmatter(frontmatter) {
+    const lines = [
+        '---',
+        `requestId: ${yamlScalar(frontmatter.requestId)}`,
+        `sessionId: ${yamlScalar(frontmatter.sessionId)}`,
+        // PLAIN by construction (`HandoffSchemaVersion` is the literal '2').
+        `schemaVersion: ${frontmatter.schemaVersion}`,
+        // PLAIN: this is the field both audit loaders read, via an anchored
+        // regex that a quoted scalar would not match.
+        `sha256: ${frontmatter.handoffHash}`,
+        // Quoted: `readHandoff` requires a YAML string here.
+        `handoffHash: ${yamlScalar(frontmatter.handoffHash)}`,
+        `writtenAt: ${yamlScalar(frontmatter.writtenAt)}`,
+        ...blockSequence('goals', frontmatter.goals),
+        ...blockSequence('acceptanceCriteria', frontmatter.acceptanceCriteria),
+        ...blockSequence('preservedBehavior', frontmatter.preservedBehavior),
+        `handoffPath: ${yamlScalar(frontmatter.handoffPath)}`,
+        '---',
+    ];
+    return `${lines.join('\n')}\n`;
+}

package/dist/services/prd/handoff-service.d.ts

@@ -3,7 +3,9 @@
  * `v2-11-rm-rd-techdoc-immutable-handoff`).
  *
  * Owns the immutable handoff at
- * `.peaks/_runtime/<sessionId>/prd/handoff.md`:
+ * `.peaks/_runtime/<sessionId>/prd/handoff-<rid>.md` (one capsule per slice;
+ * the pre-rid-scoping `.peaks/_runtime/<sessionId>/prd/handoff.md` stays
+ * readable through `resolveHandoffPath`):
  *
  *   - `initHandoff` — pure; computes sha256 of the body and returns
  *     a Handoff whose frontmatter `handoffHash` matches.
@@ -23,6 +25,43 @@
 import type { Handoff, HandoffProbe } from './handoff-types.js';
 /** Compute the lowercase hex sha256 of a UTF-8 string. */
 export declare function sha256OfBody(body: string): string;
+/**
+ * The canonical capsule path for ONE SLICE, relative to the project root.
+ *
+ * Slice `2026-09-14-prd-capsule-rid-scoping`: the capsule used to be one slot
+ * per SESSION (`prd/handoff.md`), so the second slice's handoff silently
+ * overwrote the first slice's — and `AUDIT_REQUIRES_HANDOFF` stayed green
+ * because it never checked WHOSE rid the file named. Measured on
+ * `2026-09-13-session-21878f`: a four-slice job passed that prerequisite on a
+ * capsule left by a different line of work.
+ *
+ * This is the WRITE target, so it always carries the rid — a consumer-side
+ * fallback here would leave a rid-scoped requirement with a bare-name writer,
+ * which is the defect shape this slice exists to remove. Readers that must
+ * tolerate pre-rid-scoping sessions call `resolveHandoffPath` instead.
+ */
+export declare function handoffRelativePath(sessionId: string, requestId: string): string;
+/**
+ * The capsule a CONSUMER should read for (session, requestId): the rid-scoped
+ * path when it is on disk, else the pre-rid-scoping bare name. Returns null
+ * when neither exists.
+ *
+ * Three sessions on disk still hold only the bare file
+ * (`2026-09-06-session-a87ca4`, `2026-09-12-session-e37ef0`,
+ * `2026-09-13-session-21878f`), so the legacy tier has to keep resolving for
+ * the gate and for every reader below.
+ *
+ * `requestId` is optional because the detect-only audit surface reaches its
+ * service without one. Such a caller can name only the bare path: a session
+ * holding nothing but rid-scoped capsules reports missing rather than picking
+ * among its siblings' capsules, which would re-open the cross-slice mix-up
+ * this scoping exists to close (fail closed, not "some capsule is there").
+ */
+export declare function resolveHandoffPath(opts: {
+    projectRoot: string;
+    sessionId: string;
+    requestId?: string;
+}): string | null;
 /** Pure: produce a Handoff with the frontmatter populated. Hash is
  *  computed here; callers MUST NOT pre-populate `handoffHash`. */
 export declare function initHandoff(opts: {
@@ -33,7 +72,7 @@ export declare function initHandoff(opts: {
     goals: readonly string[];
     acceptanceCriteria: readonly string[];
     preservedBehavior: readonly string[];
-    /** Override path; defaults to `.peaks/_runtime/<sid>/prd/handoff.md`. */
+    /** Override path; defaults to `.peaks/_runtime/<sid>/prd/handoff-<rid>.md`. */
     handoffPath?: string;
 }): Handoff;
 /** Write a Handoff to disk. `projectRoot` is the absolute project

package/dist/services/prd/handoff-service.js

@@ -3,7 +3,9 @@
  * `v2-11-rm-rd-techdoc-immutable-handoff`).
  *
  * Owns the immutable handoff at
- * `.peaks/_runtime/<sessionId>/prd/handoff.md`:
+ * `.peaks/_runtime/<sessionId>/prd/handoff-<rid>.md` (one capsule per slice;
+ * the pre-rid-scoping `.peaks/_runtime/<sessionId>/prd/handoff.md` stays
+ * readable through `resolveHandoffPath`):
  *
  *   - `initHandoff` — pure; computes sha256 of the body and returns
  *     a Handoff whose frontmatter `handoffHash` matches.
@@ -21,20 +23,111 @@
  * markdown source — no normalization, no trailing-newline padding.
  */
 import { createHash } from 'node:crypto';
+import { existsSync } from 'node:fs';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
-import { parse as parseYaml, stringify as stringifyYaml } from 'yaml';
+import { parse as parseYaml } from 'yaml';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
+import { REQUEST_ID_PATTERN } from '../artifacts/request-artifact-service.js';
+import { serializeHandoffFrontmatter } from './handoff-frontmatter.js';
 /** Required schema version for new handoffs. */
 const HANDOFF_SCHEMA_VERSION = '2';
 /** Compute the lowercase hex sha256 of a UTF-8 string. */
 export function sha256OfBody(body) {
     return createHash('sha256').update(body, 'utf8').digest('hex');
 }
+/**
+ * Both ids in a handoff path are caller-supplied path segments, so both are
+ * checked at the join. Added 2026-09-14 (repair R1, security audit F2 of
+ * `2026-09-14-cli-id-escape-instrumentation`).
+ *
+ * This function was introduced by `0536d5bd` — the commit that instrumented
+ * this defect class — with neither id checked, and it sat outside rule D's
+ * scanned layer, so the instrument could not see its own new member.
+ * Measured on the pre-fix tree (`prd handoff init --apply`, temp project,
+ * `ok: true` both times):
+ *
+ *   --rid '../../../../../../README'  replaced the project-root README.md
+ *   --sid '../../../../SIDOUT'        wrote 4 levels above the project root
+ *
+ * The two axes need two different controls, for a recorded reason: the rid has
+ * a pinned format (`REQUEST_ID_PATTERN`, no separator, no dot-dot, no drive)
+ * and the sid has none, so it gets the segment check. `isUnsafePathInput`
+ * alone is NOT enough for the rid — it admits `a/b` (two non-empty segments),
+ * which `request-artifact-service.ts` would reject.
+ *
+ * Guarding HERE rather than at the three `prd`/`env` flags means every producer
+ * that writes through this constructor — `initHandoff`'s default,
+ * `handoff-auto-regen.ts`, `evidence-generator.ts` — is covered by the join
+ * itself, not by each caller re-deciding.
+ */
+function assertSafeHandoffIds(sessionId, requestId) {
+    if (!REQUEST_ID_PATTERN.test(requestId)) {
+        throw new Error(`Invalid request id: ${requestId} (expected letters, digits, dots, underscores, or dashes)`);
+    }
+    if (isUnsafePathInput(sessionId)) {
+        throw new Error(`Invalid session id: ${sessionId} (must be a single path segment)`);
+    }
+}
+/**
+ * The canonical capsule path for ONE SLICE, relative to the project root.
+ *
+ * Slice `2026-09-14-prd-capsule-rid-scoping`: the capsule used to be one slot
+ * per SESSION (`prd/handoff.md`), so the second slice's handoff silently
+ * overwrote the first slice's — and `AUDIT_REQUIRES_HANDOFF` stayed green
+ * because it never checked WHOSE rid the file named. Measured on
+ * `2026-09-13-session-21878f`: a four-slice job passed that prerequisite on a
+ * capsule left by a different line of work.
+ *
+ * This is the WRITE target, so it always carries the rid — a consumer-side
+ * fallback here would leave a rid-scoped requirement with a bare-name writer,
+ * which is the defect shape this slice exists to remove. Readers that must
+ * tolerate pre-rid-scoping sessions call `resolveHandoffPath` instead.
+ */
+export function handoffRelativePath(sessionId, requestId) {
+    assertSafeHandoffIds(sessionId, requestId);
+    return join('.peaks', '_runtime', sessionId, 'prd', `handoff-${requestId}.md`);
+}
+/**
+ * The capsule a CONSUMER should read for (session, requestId): the rid-scoped
+ * path when it is on disk, else the pre-rid-scoping bare name. Returns null
+ * when neither exists.
+ *
+ * Three sessions on disk still hold only the bare file
+ * (`2026-09-06-session-a87ca4`, `2026-09-12-session-e37ef0`,
+ * `2026-09-13-session-21878f`), so the legacy tier has to keep resolving for
+ * the gate and for every reader below.
+ *
+ * `requestId` is optional because the detect-only audit surface reaches its
+ * service without one. Such a caller can name only the bare path: a session
+ * holding nothing but rid-scoped capsules reports missing rather than picking
+ * among its siblings' capsules, which would re-open the cross-slice mix-up
+ * this scoping exists to close (fail closed, not "some capsule is there").
+ */
+export function resolveHandoffPath(opts) {
+    // The legacy bare-name candidate below is a second join of the same sid, in a
+    // second function, so it needs the sid guarded in its own right — the
+    // optional-requestId branch reaches `handoffRelativePath` (guarded there), but
+    // the branch that is taken when a caller has NO rid reaches this join only.
+    if (isUnsafePathInput(opts.sessionId)) {
+        throw new Error(`Invalid session id: ${opts.sessionId} (must be a single path segment)`);
+    }
+    const candidates = [
+        ...(opts.requestId !== undefined ? [handoffRelativePath(opts.sessionId, opts.requestId)] : []),
+        join('.peaks', '_runtime', opts.sessionId, 'prd', 'handoff.md')
+    ];
+    for (const relative of candidates) {
+        const absolute = join(opts.projectRoot, relative);
+        if (existsSync(absolute))
+            return absolute;
+    }
+    return null;
+}
 /** Pure: produce a Handoff with the frontmatter populated. Hash is
  *  computed here; callers MUST NOT pre-populate `handoffHash`. */
 export function initHandoff(opts) {
     const handoffPath = opts.handoffPath ??
-        join('.peaks', '_runtime', opts.sessionId, 'prd', 'handoff.md');
+        handoffRelativePath(opts.sessionId, opts.requestId);
     const handoffHash = sha256OfBody(opts.body);
     const frontmatter = {
         requestId: opts.requestId,
@@ -146,8 +239,11 @@ function parseHandoffContent(content) {
     };
 }
 function serializeHandoff(handoff) {
-    const yamlStr = stringifyYaml(handoff.frontmatter).trimEnd();
-    return `---\n${yamlStr}\n---\n${handoff.body}`;
+    // The one canonical frontmatter rendering, shared with
+    // `handoff-auto-regen.ts`. `yaml.stringify` used to render this block and
+    // emitted `schemaVersion: "2"` + a bare `handoffHash:`, which the
+    // `AUDIT_REQUIRES_HANDOFF` gate and both audit loaders all reject.
+    return `${serializeHandoffFrontmatter(handoff.frontmatter)}${handoff.body}`;
 }
 /**
  * N1: accept BOTH shapes of `schemaVersion` — the string `'2'` and the bare
@@ -161,13 +257,33 @@ function serializeHandoff(handoff) {
  * readable handoff was satisfied by a handoff the parser would not read, and
  * `peaks prd handoff verify` exited 1 on a healthy file.
  *
- * Quoting the writer instead is NOT a fix: it would delete the very substring
- * the prereq pins, turning a broken read into a broken gate. The tolerant read
- * is the only change that satisfies both consumers.
+ * Slice `2026-09-14-handoff-writer-gate-divergence` then fixed the other half:
+ * the writer no longer emits the quoted form at all (see
+ * `handoff-frontmatter.ts`). This tolerance stays because handoffs already on
+ * disk were written by the old writer and by hand; the writer fix must not
+ * retroactively make them unreadable.
  */
 function isSchemaVersion2(value) {
     return value === HANDOFF_SCHEMA_VERSION || value === 2;
 }
+/**
+ * The READER's shape check — deliberately looser than `verifyHandoff`:
+ * `handoffHash` must be a string, and nothing about its VALUE is validated here.
+ *
+ * The accepted-but-unverifiable shape, stated rather than left to be
+ * discovered: a capsule carrying `handoffHash: sha256:<hex>` — the form the
+ * pre-fix writer and this session's hand-corrected capsules use — is READ by
+ * `readHandoff` and can NEVER pass `verifyHandoff`. The verifier compares the
+ * value to `sha256OfBody(body)` byte for byte (`:127-135`) and no prefix
+ * normalization exists anywhere in this module, so the leading `sha256:`
+ * guarantees `hash-mismatch`. ONLY the bare-hex form verifies, which is what
+ * every writer now emits (`handoff-frontmatter.ts`).
+ *
+ * So `readHandoff` succeeding is NOT evidence that a capsule is verifiable —
+ * the tolerance above exists so old capsules stay READABLE, not so they become
+ * acceptable. Request §三 bullet 3 asked for exactly this confirmation
+ * (rid `2026-09-14-handoff-writer-gate-divergence`).
+ */
 function isHandoffFrontmatter(value) {
     if (!value || typeof value !== 'object')
         return false;

package/dist/services/prd/handoff-types.d.ts

@@ -14,8 +14,9 @@
  * (D1 in `v2-11-rm-rd-techdoc-immutable-handoff`).
  *
  * Path convention: the file lands at
- * `.peaks/_runtime/<sessionId>/prd/handoff.md` (gitignored session
- * artifact; the binding to `<sessionId>` lives in
+ * `.peaks/_runtime/<sessionId>/prd/handoff-<rid>.md` (one capsule per slice;
+ * `.peaks/_runtime/<sessionId>/prd/handoff.md` is the pre-rid-scoping tier and
+ * stays readable). Gitignored session artifact; the binding to `<sessionId>` lives in
  * `.peaks/_runtime/current-change`). NEVER write under
  * `.peaks/_runtime/<change-id>/...` directly (slice 2.8.3 hard ban).
  */

package/dist/services/prd/handoff-types.js

@@ -14,8 +14,9 @@
  * (D1 in `v2-11-rm-rd-techdoc-immutable-handoff`).
  *
  * Path convention: the file lands at
- * `.peaks/_runtime/<sessionId>/prd/handoff.md` (gitignored session
- * artifact; the binding to `<sessionId>` lives in
+ * `.peaks/_runtime/<sessionId>/prd/handoff-<rid>.md` (one capsule per slice;
+ * `.peaks/_runtime/<sessionId>/prd/handoff.md` is the pre-rid-scoping tier and
+ * stays readable). Gitignored session artifact; the binding to `<sessionId>` lives in
  * `.peaks/_runtime/current-change`). NEVER write under
  * `.peaks/_runtime/<change-id>/...` directly (slice 2.8.3 hard ban).
  */

package/dist/services/qa/qa-business-review-state.js

@@ -16,6 +16,8 @@
  */
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
+import { REQUEST_ID_PATTERN } from '../artifacts/request-artifact-service.js';
 /** 6-item business checklist (12 Gaps QA perspective). */
 export const QA_BUSINESS_ITEMS = [
     { id: 'business-flow', question: '这个功能"用起来"对吗?(业务流程顺不顺,操作路径是否反人类,跟现有系统交互有没有断层)' },
@@ -36,9 +38,30 @@ export function buildEmptyQaReview(requestId, sessionId, now = new Date()) {
     };
 }
 export function getQaReviewDir(projectRoot, sessionId) {
+    // Sid axis ONLY. The guard here covers the session segment of every
+    // `peaks qa-business-review|score|accept|reject` subcommand — measured:
+    // `--session-id ../../../../…/PWNED` wrote `qa-business-reviews/<rid>.json`
+    // outside every project root under an `ok: true` envelope (RD sweep case A17).
+    //
+    // It does NOT cover the rid axis: the request id is joined one function later,
+    // in `getQaReviewPath` below. Corrected 2026-09-14 (repair R1) — this comment
+    // previously said "one guard here covers the whole family", and the security
+    // audit of `2026-09-14-cli-id-escape-instrumentation` (F1b) measured that claim
+    // false: `qa-business-review '../../../../…/EVILQA3'` wrote a `.json` file
+    // outside the project root under `ok: true`.
+    if (isUnsafePathInput(sessionId)) {
+        throw new Error(`Invalid session id: ${sessionId} (must be a single path segment)`);
+    }
     return resolve(projectRoot, '.peaks', '_runtime', sessionId, 'qa-business-reviews');
 }
 export function getQaReviewPath(projectRoot, sessionId, requestId) {
+    // Rid axis. The requestId is the CLI positional (`qa-business-review
+    // <request-id>`), so it is caller-supplied and it becomes a filename segment
+    // here. `isUnsafePathInput` alone would admit `a/b`; the rid has a pinned
+    // format, so the format check is the control.
+    if (!REQUEST_ID_PATTERN.test(requestId)) {
+        throw new Error(`Invalid request id: ${requestId} (expected letters, digits, dots, underscores, or dashes)`);
+    }
     return join(getQaReviewDir(projectRoot, sessionId), `${requestId}.json`);
 }
 export function readQaReview(projectRoot, sessionId, requestId) {

package/dist/services/sc/sc-service.d.ts

@@ -51,6 +51,14 @@ export type CommitBoundary = {
     syncState: 'synced' | 'pending' | 'failed';
     rollbackPoint: string | null;
 };
+/**
+ * The repo's slice-id control — no separator, no drive, no `..`, non-empty, and
+ * not a bare `.`/`..`. Exported 2026-09-14 (repair R1) so the slice-id axis has
+ * ONE control: `slice-review-state.getReviewPath` joins a caller-supplied slice
+ * id into a filename and previously had none, and a second copy of this regex
+ * there would be the same axis decided twice.
+ */
+export declare const SLICE_ID_PATTERN: RegExp;
 /**
  * Resolution sources for `resolveArtifactSession`, in priority order.
  * - `active-skill`: the canonical sid-scoped lease projection

package/dist/services/sc/sc-service.js

@@ -44,7 +44,14 @@ const MODERN_RETENTION_REQUIREMENTS = [
     'qa/test-reports/{sliceId}.md',
     'txt/handoff.md'
 ];
-const SLICE_ID_PATTERN = /^(?!\.{1,2}$)[A-Za-z0-9._-]+$/;
+/**
+ * The repo's slice-id control — no separator, no drive, no `..`, non-empty, and
+ * not a bare `.`/`..`. Exported 2026-09-14 (repair R1) so the slice-id axis has
+ * ONE control: `slice-review-state.getReviewPath` joins a caller-supplied slice
+ * id into a filename and previously had none, and a second copy of this regex
+ * there would be the same axis decided twice.
+ */
+export const SLICE_ID_PATTERN = /^(?!\.{1,2}$)[A-Za-z0-9._-]+$/;
 function getPeaksPath(workspaceRoot) {
     return resolve(workspaceRoot, '.peaks');
 }

package/dist/services/scan/karpathy-service.js

@@ -68,7 +68,7 @@ export async function scanKarpathy(options) {
                 warnings: [
                     `Karpathy review file missing: ${reviewRel}`,
                     'Per karpathy §1 Think Before Coding: state your assumptions. Without a review file, no 5-way fanout evidence is available.',
-                    'Per karpathy §3 Surgical Changes: touch only what the request requires. Create a minimal rd/karpathy-review.md stub before requesting qa-handoff.'
+                    'Per karpathy §3 Surgical Changes: touch only what the request requires. The rd:qa-handoff gate is satisfied by rd/karpathy-review-<rid>.md; this scanner has no rid and reads only the back-compat name rd/karpathy-review.md, so a rid-scoped-only slice still reads as missing here. `peaks request transition --state qa-handoff` is the authoritative gate.'
                 ]
             };
         }
@@ -223,6 +223,6 @@ export function formatKarpathyMarkdown(report, opts = {}) {
     }
     lines.push('### Karpathy-Gate');
     lines.push('');
-    lines.push('Per `andrej-karpathy-skills:karpathy-guidelines` §1 Think Before Coding / §3 Surgical Changes, the hard Karpathy-Gate requires `rd/karpathy-review.md` to be present with all 4 guideline sections before `peaks request transition --state qa-handoff`.');
+    lines.push('Per `andrej-karpathy-skills:karpathy-guidelines` §1 Think Before Coding / §3 Surgical Changes, the hard Karpathy-Gate requires `rd/karpathy-review-<rid>.md` to be present with all 4 guideline sections before `peaks request transition --state qa-handoff`. (`rd/karpathy-review.md` is the accepted back-compat tier, and the only name this scanner probes.)');
     return lines.join('\n');
 }