peaks-loop 4.0.47 → 4.0.49

package/dist/shared/runtime-root.js

@@ -0,0 +1,77 @@
+/**
+ * The one seam through which a `.peaks/_runtime` path is built.
+ *
+ * Slice 2026-09-15 (runtime-path-unrepresentable). Three attempts to *detect*
+ * a caller-supplied id reaching a runtime join all failed the same way: the
+ * shipped text rule caught 4 of 12 fixture shapes where the name-based
+ * predicate it replaced caught 8, and the version that reached 10 of 12 gave
+ * back the change that reached 12 because it cost seven findings on live code —
+ * two of them structural (a guard helper, and readers that take the guarded
+ * value as a parameter). Its measured verdict: reassignment between guard and
+ * join, and guard-after-join, are **domination failures inside a single
+ * function, invisible to any text key**.
+ *
+ * So the instrument is retired in favour of a property. The id cannot reach a
+ * runtime join unguarded because there is no longer a join that accepts an
+ * unguarded string: `RuntimeRoot.join` takes `GuardedSegment`, and a
+ * `GuardedSegment` can only be produced by `guardRuntimeSegment`, which throws
+ * on the shapes the escapes used. A newly written unguarded join is a type
+ * error at authoring time — not a removed guard that some later scan notices.
+ *
+ * The raw root is not obtainable as a string except through `dir()`, which is
+ * named so that a join written from it (`join(root.dir(), id)`) reads at review
+ * time as the bypass it is. `dir()` exists because callers legitimately
+ * enumerate the root itself; it is not a join.
+ */
+import { join } from 'node:path';
+import { isUnsafePathInput } from './path-safety.js';
+/**
+ * Check a caller-supplied string and brand it for use as a runtime path
+ * segment. `label` names the id in the error the way the caller knows it
+ * ("session id", "project id"), because the throw site is one function away
+ * from the caller that supplied it.
+ *
+ * Rejects exactly the shapes `isUnsafePathInput` rejects: separators, `..`,
+ * absolute and drive-prefixed paths, UNC and URL shapes, and empty segments.
+ */
+export function guardRuntimeSegment(value, label) {
+    if (isUnsafePathInput(value)) {
+        throw new Error(`Invalid ${label}: ${value} (must be a single path segment)`);
+    }
+    return value;
+}
+/**
+ * The `.peaks/_runtime` root of one project, as a capability rather than a
+ * string. `#path` is a private field, so the raw root cannot be read off the
+ * object and joined by an unguarded `join()`.
+ */
+export class RuntimeRoot {
+    #path;
+    constructor(path) {
+        this.#path = path;
+    }
+    /** The runtime root of `projectRoot`. */
+    static at(projectRoot) {
+        return new RuntimeRoot(join(projectRoot, '.peaks', '_runtime'));
+    }
+    /**
+     * Join guarded segments onto the root. At least one segment is required: a
+     * zero-argument `join()` would hand back the bare root as a `string`, which
+     * is the capability this class exists to withhold.
+     */
+    join(first, ...rest) {
+        return join(this.#path, first, ...rest);
+    }
+    /**
+     * The root itself, for READ-only enumeration (`readdir`, `existsSync`) — not
+     * for joining. Deliberately a method rather than a property so a bypass is
+     * legible at the call site.
+     */
+    dir() {
+        return this.#path;
+    }
+}
+/** The runtime root of `projectRoot`. */
+export function runtimeRoot(projectRoot) {
+    return RuntimeRoot.at(projectRoot);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "peaks-loop",
-  "version": "4.0.47",
+  "version": "4.0.49",
   "description": "Loop Engineering CLI — workflow primitive / loop guards / evaluators / slice orchestration",
   "author": "SquabbyZ",
   "keywords": [
@@ -102,10 +102,10 @@
     "picomatch": "4.0.4",
     "yaml": "^2.9.0",
     "zod": "^4.4.3",
-    "peaks-loop-internal-runtime": "0.0.32",
-    "peaks-loop-shared": "0.0.81",
-    "peaks-loop-mut": "0.1.45",
-    "peaks-loop-shared-channel": "0.0.49"
+    "peaks-loop-internal-runtime": "0.0.34",
+    "peaks-loop-mut": "0.1.47",
+    "peaks-loop-shared": "0.0.83",
+    "peaks-loop-shared-channel": "0.0.51"
   },
   "devDependencies": {
     "@changesets/cli": "2.31.1",
@@ -141,7 +141,7 @@
     "test:dev": "vitest run tests/unit",
     "test:dev:cli": "vitest run tests/unit",
     "test:unit": "vitest run tests/unit",
-    "test:integration": "vitest run tests/integration",
+    "test:integration": "vitest run --config vitest.config.integration.ts tests/integration",
     "test:capability-guard": "vitest run --config vitest.config.integration.ts tests/integration/capability-guard",
     "test:cli": "vitest run tests/unit",
     "test:workflow": "vitest run tests/unit",

package/skills/bee/peaks-prd/SKILL.md

@@ -122,7 +122,7 @@ Then display: `Peaks-Loop Skill: peaks-prd | Peaks-Loop Gate: startup | Next: <o
 
 ## Mandatory per-request artifact
 
-Every PRD invocation — feature, bug, refactor, clarification — must write a durable artifact at `.peaks/_runtime/<session-id>/prd/requests/<request-id>.md`. The artifact is the canonical trace; the chat transcript is not. Handoff to RD/UI/QA is blocked while the artifact is missing or in `draft` state. After user confirmation, the **immutable handoff** is written separately at `.peaks/_runtime/<sid>/prd/handoff.md` (Step 5.5 below) — sha256-locked, schemaVersion: 2 — and is the source of truth for RD, QA, and the 4 audit sub-agents (code-reviewer / security-reviewer / karpathy-reviewer / qa-test-cases-writer).
+Every PRD invocation — feature, bug, refactor, clarification — must write a durable artifact at `.peaks/_runtime/<session-id>/prd/requests/<request-id>.md`. The artifact is the canonical trace; the chat transcript is not. Handoff to RD/UI/QA is blocked while the artifact is missing or in `draft` state. After user confirmation, the **immutable handoff** is written separately at `.peaks/_runtime/<sid>/prd/handoff-<rid>.md` (Step 5.5 below) — sha256-locked, schemaVersion: 2 — and is the source of truth for RD, QA, and the 4 audit sub-agents (code-reviewer / security-reviewer / karpathy-reviewer / qa-test-cases-writer).
 
 Use `<request-id>` of the form `YYYY-MM-DD-<kebab-slug>` (or whatever id the user assigned) so PRD/UI/RD/QA/SC can cross-link the same request.
 
@@ -198,15 +198,17 @@ peaks request show <request-id> --role prd --project <repo> --json
 
 # 5.5 — write the immutable handoff (sha256-locked; BLOCKING before RD/QA handoff)
 # Reads the PRD request artifact body, computes sha256, writes a v2.11.0 handoff
-# at .peaks/_runtime/<sid>/prd/handoff.md that downstream RD + QA + 4 audit
-# sub-agents consume as the authoritative source of truth. Dry-run by default
-# (omit --apply) so the operator can review before commit.
+# at .peaks/_runtime/<sid>/prd/handoff-<rid>.md that downstream RD + QA + 4 audit
+# sub-agents consume as the authoritative source of truth. The rid is part of
+# the filename: one capsule per SLICE, so a second slice in the same session
+# cannot overwrite the first's. Dry-run by default (omit --apply) so the
+# operator can review before commit.
 peaks prd handoff init \
   --rid <request-id> --sid <session-id> --change-id <change-id> \
   --body "@.peaks/_runtime/<session-id>/prd/requests/<request-id>.md" \
   --goals <G-ids> --ac <AC-ids> --preserve <P-ids> \
   [--project <repo>] [--apply]
-peaks prd handoff verify --path .peaks/_runtime/<session-id>/prd/handoff.md
+peaks prd handoff verify --path .peaks/_runtime/<session-id>/prd/handoff-<request-id>.md
 
 peaks skill presence:clear --project <repo>                      # handoff complete, remove presence indicator
 ```

package/skills/bee/peaks-qa/SKILL.md

@@ -104,9 +104,9 @@ Project-level security + perf plans live at `.peaks/_runtime/<sessionId>/qa/secu
 
 ## QA fan-out (业务 only — v2.11.0 D1)
 
-When peaks-qa is the **main loop** (i.e. it is the active skill and is about to run its own sub-agent dispatch, rather than being a sub-agent itself), it fans out only the **business verification** sub-agent: `qa-business`. Security and performance review are **NOT** peaks-qa's responsibility in v2.11.0 — they are owned by peaks-rd's 4-way audit fan-out (code-review + security-review + perf-baseline + karpathy-review) and the rd-side evidence files (`rd/security-review.md`, `rd/perf-baseline.md`). peaks-qa reads those files by reference; it does NOT re-do them.
+When peaks-qa is the **main loop** (i.e. it is the active skill and is about to run its own sub-agent dispatch, rather than being a sub-agent itself), it fans out only the **business verification** sub-agent: `qa-business`. Security and performance review are **NOT** peaks-qa's responsibility in v2.11.0 — they are owned by peaks-rd's 4-way audit fan-out (code-review + security-review + perf-baseline + karpathy-review) and the rd-side evidence files (`audit/security-<rid>.md`, `audit/perf-<rid>.md`). peaks-qa reads those files by reference; it does NOT re-do them.
 
-> **v2.15.0+ 校准:** `qa-business` 只跑业务/产品视角的 6 项验收清单(业务流程 / 需求覆盖 / 边界 case / UI 装配 / 异常态语调 / 能上线吗),**不跑技术指标**(覆盖率 / 性能 / 安全)。技术指标由 RD 4-way fan-out 自决,QA 只读 `rd/security-review.md` + `rd/perf-baseline.md`。详见 `.peaks/memory/peaks-loop-slice-review-and-qa-perspective.md`。
+> **v2.15.0+ 校准:** `qa-business` 只跑业务/产品视角的 6 项验收清单(业务流程 / 需求覆盖 / 边界 case / UI 装配 / 异常态语调 / 能上线吗),**不跑技术指标**(覆盖率 / 性能 / 安全)。技术指标由 RD 4-way fan-out 自决,QA 只读 `audit/security-<rid>.md` + `audit/perf-<rid>.md`。详见 `.peaks/memory/peaks-loop-slice-review-and-qa-perspective.md`。
 
 If the PRD or project warrants it, subdivide `qa-business` further into roles like `qa-business-api` / `qa-business-frontend` / `qa-business-regression`. Subdivision must stay ≤ 2 levels deep (RL-4).
 
@@ -128,7 +128,7 @@ When this skill is running in the main Claude session (not as a sub-agent), befo
 - verify API behavior and frontend behavior when either surface exists;
 - generate a validation report with commands, browser evidence, findings, and residual risks.
 
-**Out of scope (v2.11.0 D1/D4):** peaks-qa does **not** own security review or performance review. Those are owned by peaks-rd's audit fan-out (sub-agents `security-review` and `perf-baseline`) and the rd-side evidence files. peaks-qa reads `rd/security-review.md` and `rd/perf-baseline.md` by reference; it does NOT produce `qa/security-findings.md` or `qa/performance-findings.md` of its own.
+**Out of scope (v2.11.0 D1/D4):** peaks-qa does **not** own security review or performance review. Those are owned by peaks-rd's audit fan-out (sub-agents `security-review` and `perf-baseline`) and the rd-side evidence files. peaks-qa reads `audit/security-<rid>.md` and `audit/perf-<rid>.md` by reference; it does NOT produce `qa/security-findings.md` or `qa/performance-findings.md` of its own.
 
 ## Mandatory per-request artifact
 
@@ -148,7 +148,7 @@ See `references/qa-runbook.md` for the full 10-step runbook (steps #0–#9) with
 
 You cannot declare a phase complete from memory. CLI enforcement: the gates below are ALSO enforced by `peaks request transition`, which fails with `code: PREREQUISITES_MISSING` if any are absent. Per-type required files: feature / refactor → test-cases + test-reports + security-findings + performance-findings; bugfix → test-cases + test-reports + security-findings (perf optional); config → security-findings only; docs / chore → none.
 
-Gate index: A (test-cases), A2 (tests executed), A3 (security reference — v2.11.0: read rd/security-review.md), A4 (performance reference — v2.11.0: read rd/perf-baseline.md), B (test-reports with results), C (all 3 QA files present before verdict: test-cases + test-reports + requests — security/perf evidence live under rd/), D (browser screenshots), E (acceptance coverage scan), F (QA artifact lint).
+Gate index: A (test-cases), A2 (tests executed), A3 (security reference — v2.12.0+: read audit/security-<rid>.md), A4 (performance reference — v2.12.0+: read audit/perf-<rid>.md), B (test-reports with results), C (all 3 QA files present before verdict: test-cases + test-reports + requests — security/perf evidence live under audit/), D (browser screenshots), E (acceptance coverage scan), F (QA artifact lint).
 
 → see `references/qa-transition-gates.md` for the full per-gate contract + `ls` / `grep` shell snippets.
 
@@ -194,7 +194,7 @@ Every QA invocation must produce a test-report artifact at `.peaks/_runtime/<ses
 
 ## Mandatory validation gates
 
-QA cannot pass a change until the report contains evidence for every applicable gate. The 9 gates (0 test-case generation, 1 test-report, 2 unit tests, 3 API validation, 4 frontend browser validation, 5 browser-error feedback loop, 8 library version regressions, 9 validation report, 10 acceptance coverage) are mapped to Peaks-Loop Gates A/A2/B/C/D/E/F. **v2.11.0 D1/D4 trim:** Gates A3 (security) and A4 (performance) are no longer peaks-qa's responsibility — security review and performance baseline live under peaks-rd's audit fan-out (rd/security-review.md + rd/perf-baseline.md) and are cited by reference from the test report.
+QA cannot pass a change until the report contains evidence for every applicable gate. The 9 gates (0 test-case generation, 1 test-report, 2 unit tests, 3 API validation, 4 frontend browser validation, 5 browser-error feedback loop, 8 library version regressions, 9 validation report, 10 acceptance coverage) are mapped to Peaks-Loop Gates A/A2/B/C/D/E/F. **v2.11.0 D1/D4 trim:** Gates A3 (security) and A4 (performance) are no longer peaks-qa's responsibility — security review and performance baseline live under peaks-rd's audit fan-out (audit/security-<rid>.md + audit/perf-<rid>.md) and are cited by reference from the test report.
 
 If Playwright MCP is unavailable, the LLM checks its own tool list for the Playwright MCP server entry; if absent, the LLM tells the user the install command (`claude mcp add playwright -- npx @playwright/mcp@latest` for Claude Code) and marks the gate blocked with the missing capability. Screenshots, logs, manual steps, or other tools must not substitute for the mandatory frontend browser gate. Do not silently downgrade frontend validation to API-only testing.
 

package/skills/bee/peaks-qa/references/qa-runbook.md

@@ -36,8 +36,8 @@ peaks openspec validate <change-id> --project <repo> --prefer-external --json
 # 5. EXECUTE tests against the actual implementation — Peaks-Loop Gate A2
 #    Run the project test command. Record output. Tests on paper are worthless.
 #    NOTE (v2.11.0 D1/D4): Security review + performance check are NOT run by peaks-qa.
-#    They are owned by peaks-rd's audit fan-out and surface as rd/security-review.md and
-#    rd/perf-baseline.md under .peaks/_runtime/<sessionId>/rd/. Read them by reference;
+#    They are owned by the independent audit skills and surface as audit/security-<rid>.md
+#    and audit/perf-<rid>.md under .peaks/_runtime/<sessionId>/audit/. Read them by reference;
 #    do NOT re-do them or create qa/security-findings.md / qa/performance-findings.md.
 
 # 6. write test-report — MANDATORY, write to .peaks/_runtime/<sessionId>/qa/test-reports/<request-id>.md

package/skills/bee/peaks-qa/references/qa-transition-gates.md

@@ -11,7 +11,7 @@
 | config | (none) | `qa/test-reports/<rid>.md` |
 | docs / chore | (none) | (none) |
 
-Security and performance evidence surface under `rd/security-review.md` and `rd/perf-baseline.md` (peaks-rd's audit fan-out) and are referenced by reference from the QA test report body. The pre-v2.11.0 `qa/security-findings.md` / `qa/performance-findings.md` files are no longer required; existing ones are kept for auditability but ignored by the gate.
+Security and performance evidence surface under `audit/security-<rid>.md` and `audit/perf-<rid>.md` (the independent `peaks-security-audit` / `peaks-perf-audit` skills, v2.12.0+; slice `2026-09-14-audit-artifact-rid-scoping` put the rid in the filename so two slices in one session cannot overwrite each other's evidence) and are referenced by reference from the QA test report body. The older `rd/security-review.md` / `rd/perf-baseline.md` and the ridless `audit/security.md` / `audit/perf.md` remain accepted back-compat tiers. The pre-v2.11.0 `qa/security-findings.md` / `qa/performance-findings.md` files are no longer required; existing ones are kept for auditability but ignored by the gate.
 
 **Peaks-Loop Gate A — After test-case generation:**
 ```bash
@@ -29,18 +29,18 @@ npx vitest run --changed --reporter=verbose 2>&1 | tail -30
 
 **Peaks-Loop Gate A3 — Security review referenced (v2.11.0 D1/D4: read-only reference, NOT a separate QA file):**
 ```bash
-# peaks-qa does NOT own a qa/security-findings.md. peaks-rd's audit fan-out
-# produces rd/security-review.md; QA references it by path in the test report body.
-grep -E "rd/security-review\\.md|security-review" .peaks/_runtime/<sessionId>/qa/test-reports/<rid>.md 2>&1
+# peaks-qa does NOT own a qa/security-findings.md. The security audit produces
+# audit/security-<rid>.md; QA references it by path in the test report body.
+grep -E "audit/security|rd/security-review|security-review" .peaks/_runtime/<sessionId>/qa/test-reports/<rid>.md 2>&1
 # Expected: at least one reference to the rd-side security review.
 # Empty → BLOCKED: the test report must cite where security evidence lives.
 ```
 
 **Peaks-Loop Gate A4 — Performance baseline referenced (v2.11.0 D1/D4: read-only reference, NOT a separate QA file):**
 ```bash
-# peaks-qa does NOT own a qa/performance-findings.md. peaks-rd's audit fan-out
-# produces rd/perf-baseline.md; QA references it by path in the test report body.
-grep -E "rd/perf-baseline\\.md|perf-baseline" .peaks/_runtime/<sessionId>/qa/test-reports/<rid>.md 2>&1
+# peaks-qa does NOT own a qa/performance-findings.md. The perf audit produces
+# audit/perf-<rid>.md; QA references it by path in the test report body.
+grep -E "audit/perf|rd/perf-baseline|perf-baseline" .peaks/_runtime/<sessionId>/qa/test-reports/<rid>.md 2>&1
 # Expected: at least one reference to the rd-side perf baseline.
 # Empty → BLOCKED: the test report must cite where perf evidence lives.
 ```

package/skills/bee/peaks-rd/SKILL.md

@@ -172,16 +172,18 @@ If any gate fails, return to development for fixes or hand off as blocked. Do no
 
 **v2.12.0 collapse (Group A — Tier 1+2+3):** the previous 5-way fan-out (slice 004 4-way + slice 5/6 `karpathy-reviewer` addition) totalled **5 sub-agents**. The `security-reviewer` and `perf-baseline-reviewer` slots moved out of the RD 3-way fan-out into two new standalone audit skills:
 
-- `peaks-security-audit` — CLI: `peaks security-audit run`. Writes `audit/security.md` (under `.peaks/_runtime/<sessionId>/audit/security.md`). Required RD-side prereq `AUDIT_SECURITY`.
-- `peaks-perf-audit` — CLI: `peaks perf-audit run`. Writes `audit/perf.md` (under `.peaks/_runtime/<sessionId>/audit/perf.md`). Required RD-side prereq `AUDIT_PERF`.
+- `peaks-security-audit` — CLI: `peaks security-audit run`. Writes `audit/security-<rid>.md` (under `.peaks/_runtime/<sessionId>/audit/security-<rid>.md`). Required RD-side prereq `AUDIT_SECURITY`.
+- `peaks-perf-audit` — CLI: `peaks perf-audit run`. Writes `audit/perf-<rid>.md` (under `.peaks/_runtime/<sessionId>/audit/perf-<rid>.md`). Required RD-side prereq `AUDIT_PERF`.
+
+  **The rid is part of the filename** (slice `2026-09-14-audit-artifact-rid-scoping`). Two slices run in the same session share `.peaks/_runtime/<sessionId>/audit/`, so a ridless filename makes the second slice's write silently destroy the first slice's audit — which is what happened to `audit/perf.md` on 2026-09-13, irrecoverably. The bare `audit/security.md` / `audit/perf.md` (and the older `rd/security-review.md` / `rd/perf-baseline.md`) are still **read** as back-compat fallbacks, but never write there.
 
 Both audit skills consume the immutable peaks-prd handoff (`prd/handoff.md`) and the project-scoped audit templates under `.peaks/project-scan/{security-template, perf-template, audit-output-schema}.md`. The handoff presence is enforced by the `AUDIT_REQUIRES_HANDOFF` prereq. The 1-minor-release back-compat window (v2.12.0) keeps the old `rd/security-review.md` and `rd/perf-baseline.md` paths readable via `mustContainAny` — see `references/rd-fanout-contracts.md` §"Deprecated reviewer back-compat".
 
 **Current 3-way fan-out** (always runs for feature / refactor / bugfix; no fan-out for config / docs / chore):
 
-1. `code-reviewer` — writes `rd/code-review.md` (Gate B3).
+1. `code-reviewer` — writes `rd/code-review-<rid>.md` (Gate B3). **Not** `rd/code-review.md`: the ridless name is shared by every slice in the session, so slice 2 would overwrite slice 1's review (it did on 2026-09-13). The ridless path is still read as a back-compat fallback.
 2. `qa-test-cases-writer` — writes `qa/test-cases/<rid>.md` (Gate C2).
-3. `karpathy-reviewer` — writes `rd/karpathy-review.md` (the **hard Karpathy-Gate**, KARPATHY_REVIEW prereq).
+3. `karpathy-reviewer` — writes `rd/karpathy-review-<rid>.md` (the **hard Karpathy-Gate**, KARPATHY_REVIEW prereq). Same rule: the ridless `rd/karpathy-review.md` is read but never written.
 
 Full dispatch contract (when-to-fan-out rules, dispatch template, prereq gates) lives in **`references/parallel-review-fanout.md`**. Read that file before issuing any 3-way fan-out.
 
@@ -269,11 +271,11 @@ Do not bypass PRD/QA artifacts. Do not install hooks, agents, MCP, or settings.
 
 Do not bypass the parallel review fan-out when the slice has a code-review / qa-test-cases / karpathy-review surface — see `## Parallel review fan-out` above. The three review activities are fan-out, not sequential; sequential re-implementation of the same logic by the main RD loop defeats the wall-clock benefit and is treated as a red-line violation.
 
-**Security / perf audit boundary (v2.12.0):** security and perf audit run as standalone audit skills (`peaks-security-audit`, `peaks-perf-audit`) whose outputs land at `audit/security.md` / `audit/perf.md`. RD does **not** dispatch `security-reviewer` or `perf-baseline-reviewer` sub-agents. See `references/rd-fanout-contracts.md` §"Deprecated reviewer back-compat".
+**Security / perf audit boundary (v2.12.0):** security and perf audit run as standalone audit skills (`peaks-security-audit`, `peaks-perf-audit`) whose outputs land at `audit/security-<rid>.md` / `audit/perf-<rid>.md`. RD does **not** dispatch `security-reviewer` or `perf-baseline-reviewer` sub-agents. See `references/rd-fanout-contracts.md` §"Deprecated reviewer back-compat".
 
 ## Karpathy cost self-review (slice 2026-07-30-karpathy-cost-self-review)
 
-The `karpathy-reviewer` sub-agent now reports its own runtime cost in the JSON envelope at `rd/karpathy-review.md` (fields `evaluationCost` + `costRatio`; see `agents/karpathy-reviewer.md` §4). The **orchestrator-side** command `peaks job karpathy-cost-check --review-file <path>` reads that envelope and decides whether to downgrade a `'block'` gateAction to `'warn'` when `costRatio > 10`. **24h-mode is the override** — the check is entirely skipped when `peaks session 24h-mode state` reports `24H_ACTIVE`.
+The `karpathy-reviewer` sub-agent now reports its own runtime cost in the JSON envelope at `rd/karpathy-review-<rid>.md` (fields `evaluationCost` + `costRatio`; see `agents/karpathy-reviewer.md` §4). The **orchestrator-side** command `peaks job karpathy-cost-check --review-file <path>` reads that envelope and decides whether to downgrade a `'block'` gateAction to `'warn'` when `costRatio > 10`. **24h-mode is the override** — the check is entirely skipped when `peaks session 24h-mode state` reports `24H_ACTIVE`.
 
 The main RD loop MUST call `peaks job karpathy-cost-check` after every `peaks request transition --state qa-handoff` and before the next-slice work begins. If the decision kind is `downgraded`, the LLM MUST honor the downgraded `warn` and proceed to the next slice; the `'block'` was an artifact of the reviewer's own cost, not the slice's quality. If the decision kind is `reported` (costRatio > 50, gate not `'block'`), the LLM MAY continue; the sediment will be appended by `peaks memory extract` at handoff time. The full design lives in `.peaks/memory/2026-07-30-karpathy-evaluation-cost-self-review-design.md` (sediment locked 2026-07-30).
 

package/skills/bee/peaks-rd/references/artifact-per-request.md

@@ -99,8 +99,8 @@ For each slice in this request:
 |---|---|---|---|
 | `.peaks/_runtime/<sessionId>/prd/handoff.md` | per-slice — immutable peaks-prd source of truth (v2.11.0+) | RD, QA, all sub-agents | Goals, non-goals, acceptance criteria, architecture, slice graph, mock strategy, cross-cutting decisions. sha256-hashed in frontmatter; sub-agents verify the hash before reading. |
 | `.peaks/_runtime/<sessionId>/rd/requests/<rid>.md` | per-slice — one request, one planning artifact | QA, SC, the lint gate | Red-line scope, in-scope / out-of-scope, unit-test requirements, **Implementation evidence** (file list, `pnpm test` output, git diff excerpts), MCP usage, handoff, status. **This is the file the lint gate checks for placeholders.** |
-| `.peaks/_runtime/<sessionId>/rd/code-review.md` | per-session — the engineering review | QA, the human reviewer | Code review findings + fixes. |
-| `.peaks/_runtime/<sessionId>/rd/security-review.md` | per-session — the security review | QA | Security review findings + fixes. |
+| `.peaks/_runtime/<sessionId>/rd/code-review-<rid>.md` | per-slice — the engineering review | QA, the human reviewer | Code review findings + fixes. |
+| `.peaks/_runtime/<sessionId>/audit/security-<rid>.md` | per-slice — the independent security audit | QA | Security audit findings + verdict. |
 
 > **v2.11.0 change (Group A):** `rd/tech-doc.md` is removed. The per-slice source of truth moves to the immutable peaks-prd handoff (`prd/handoff.md`); the per-slice planning record is `rd/requests/<rid>.md`. The "per-session" content category is no longer RD's responsibility — it lives upstream in the PRD handoff.
 

package/skills/bee/peaks-rd/references/parallel-review-fanout.md

@@ -4,8 +4,10 @@
 
 **v2.12.0 collapse (Group A — Tier 1+2+3):** the previous 4-way fan-out (slice 004) plus the appended `karpathy-reviewer` (slice 5/6) totalled **5 sub-agents**. The `security-reviewer` and `perf-baseline-reviewer` slots moved out of the RD fan-out into two new standalone audit skills:
 
-- `peaks-security-audit` — CLI: `peaks security-audit run`. Writes `.peaks/_runtime/<sessionId>/audit/security.md`. Required RD-side prereq `AUDIT_SECURITY`.
-- `peaks-perf-audit` — CLI: `peaks perf-audit run`. Writes `.peaks/_runtime/<sessionId>/audit/perf.md`. Required RD-side prereq `AUDIT_PERF`.
+- `peaks-security-audit` — CLI: `peaks security-audit run`. Writes `.peaks/_runtime/<sessionId>/audit/security-<rid>.md`. Required RD-side prereq `AUDIT_SECURITY`.
+- `peaks-perf-audit` — CLI: `peaks perf-audit run`. Writes `.peaks/_runtime/<sessionId>/audit/perf-<rid>.md`. Required RD-side prereq `AUDIT_PERF`.
+
+The rid is part of the filename (slice `2026-09-14-audit-artifact-rid-scoping`): every slice in a session shares `.peaks/_runtime/<sessionId>/audit/`, so a ridless name means the second slice's audit silently replaces the first slice's. The ridless locations are still read as fallbacks.
 
 Both audit skills consume the immutable peaks-prd handoff (`prd/handoff.md`) and the project-scoped audit templates under `.peaks/project-scan/{security-template, perf-template, audit-output-schema}.md`. The handoff presence is enforced by the `AUDIT_REQUIRES_HANDOFF` prereq. The 1-minor-release back-compat window (`v2.12.0`) keeps the old `rd/{security-review,perf-baseline}.md` paths readable via `mustContainAny` — see `tests/unit/rd/deprecated-reviewer-back-compat.test.ts` (8 cases) and `tests/unit/artifact-prerequisites-typed.test.ts`.
 
@@ -44,14 +46,14 @@ Note: sub-agent 1 (code-reviewer) and sub-agent 3 (karpathy-reviewer) write to `
 - Read the git diff for this slice (`git diff main...HEAD` or equivalent).
 - Read `.peaks/_runtime/<sessionId>/prd/handoff.md` for slice intent (v2.11.0: the immutable peaks-prd handoff replaces `rd/tech-doc.md`). Verify the handoff hash matches the dispatched value before proceeding.
 - Inspect for: correctness, type safety, error handling, mutation patterns, file-size, naming, dead code, regressions, contract drift.
-- Output: `.peaks/_runtime/<sessionId>/rd/code-review.md` with sections: Summary, Findings, Required Fixes, Recommended, Verdict.
+- Output: `.peaks/_runtime/<sessionId>/rd/code-review-<rid>.md` with sections: Summary, Findings, Required Fixes, Recommended, Verdict. (Rid in the filename — a ridless `rd/code-review.md` is shared by every slice in the session and gets overwritten by the next one; it is still read as a fallback.)
 - Required for Gate B3.
 - **v2.11.0 Tier 7 (Group D) + 2026-09-09-ecc-dynamic:** the code-reviewer dispatch goes through the **ECC bridge** (`src/services/code-review/ecc-bridge.ts`). Fallback order is **native plugin → cache-backed generic agent → inline**:
   1. **Native plugin** (`detectEcc` state `ready`): invoke the Agent tool with `subagent_type: "ecc:code-reviewer"` (plugin `ecc` + agent `code-reviewer`; see `DEFAULT_NATIVE_ECC_AGENT_ID`); it returns the structured envelope `{ passed, violations[], gateAction }`.
   2. **Cache-backed generic agent** (`detectEcc` state `ready-via-cache` — plugin or its review agent absent, but a materialized ECC agent exists under `~/.peaks/agents/ecc/`): resolve the agent's REAL name first — `resolveMaterializedAgentName(['code-reviewer', 'code-review'])` from `peaks-loop-mut` (upstream ships `code-reviewer.md`; a hardcoded `code-review.md` never resolves). Read `~/.peaks/agents/ecc/<resolved>.md`, pass the name through as `detectEcc({ ..., cacheAgentName: resolved })`, build the prompt with `buildCacheBackedEccPrompt({ rid, instructions, diff })` (agent body + diff + `ECC_OUTPUT_CONTRACT`), dispatch a **generic** sub-agent, and validate its reply with `isEccEnvelope`. No ECC plugin required. If the cache is empty, run `peaks ecc install` first (dynamic acquisition); if that fails offline, degrade to inline.
   3. **Inline** (`detectEcc` states `plugin-missing` / `agent-missing` / `dispatch-failed` / `envelope-malformed`): fall back to inline review — TXT note `code-review-ecc-degraded-to-inline`.
 
-  In all dispatchable cases the envelope is rendered by the SAME bridge adapter (`adaptEccEnvelopeToRdCodeReview`) into the canonical `rd/code-review.md` markdown shape that Gate B3 reads (`mustContain: ['## Findings', 'CRITICAL']`). The materialized copy lives under `~/.peaks/agents/ecc/` — peaks-loop NEVER writes into `~/.claude/`.
+  In all dispatchable cases the envelope is rendered by the SAME bridge adapter (`adaptEccEnvelopeToRdCodeReview`) into the canonical `rd/code-review-<rid>.md` markdown shape that Gate B3 reads (`mustContain: ['## Findings', 'CRITICAL']`). The materialized copy lives under `~/.peaks/agents/ecc/` — peaks-loop NEVER writes into `~/.claude/`.
 
 **Sub-agent 2 — qa-test-cases-writer (always runs for feature / refactor / bugfix):**
 - Read the git diff and the PRD acceptance criteria.
@@ -63,7 +65,7 @@ Note: sub-agent 1 (code-reviewer) and sub-agent 3 (karpathy-reviewer) write to `
 **Sub-agent 3 — karpathy-reviewer (always runs for feature / refactor / bugfix — the hard gate):**
 - Inspect the diff + handoff against the 4 Karpathy-guidelines.
 - Read `.peaks/_runtime/<sessionId>/prd/handoff.md` (v2.11.0: architecture summary — the immutable peaks-prd handoff replaces `rd/tech-doc.md`).
-- Output: `.peaks/_runtime/<sessionId>/rd/karpathy-review.md` containing a `## Karpathy-Gate` header and the 4 guideline section markers (Think Before Coding / Simplicity First / Surgical Changes / Goal-Driven Execution).
+- Output: `.peaks/_runtime/<sessionId>/rd/karpathy-review-<rid>.md` containing a `## Karpathy-Gate` header and the 4 guideline section markers (Think Before Coding / Simplicity First / Surgical Changes / Goal-Driven Execution). (Rid in the filename, same reason as the code review; the ridless `rd/karpathy-review.md` is still read as a fallback.)
 - Required for the `KARPATHY_REVIEW` prereq. The transition CLI gate reads those markers and refuses `rd:qa-handoff` when the file is missing or the markers are absent.
 - See `references/rd-fanout-contracts.md` §"karpathy-reviewer contract" for the JSON envelope shape + file format.
 

package/skills/bee/peaks-rd/references/rd-fanout-contracts.md

@@ -11,9 +11,9 @@ end of implementation, RD fires 3 sub-agents in parallel via
 > skills consumed at pre-RD / pre-QA time:
 >
 > - `peaks-security-audit` — CLI: `peaks security-audit run`. Output:
->   `audit/security.md`. Required RD-side prereq: `AUDIT_SECURITY`.
+>   `audit/security-<rid>.md`. Required RD-side prereq: `AUDIT_SECURITY`.
 > - `peaks-perf-audit` — CLI: `peaks perf-audit run`. Output:
->   `audit/perf.md`. Required RD-side prereq: `AUDIT_PERF`.
+>   `audit/perf-<rid>.md`. Required RD-side prereq: `AUDIT_PERF`.
 >
 > Both audit skills consume the immutable peaks-prd handoff
 > (`prd/handoff.md`) and the project-scoped audit templates under
@@ -29,7 +29,7 @@ end of implementation, RD fires 3 sub-agents in parallel via
 > **Karpathy pointer (Slice 1/6):** Each of the 3 sub-agents below operates under the 4 Karpathy guidelines. The canonical reference is `andrej-karpathy-skills:karpathy-guidelines` (full text) and `peaks-rd/SKILL.md` §"Karpathy enforcement". The dispatch primitive also injects the verbatim context block from `rd-sub-agent-dispatch.md` §"Karpathy-guidelines context" into every sub-agent prompt. Sub-agents MUST NOT silently drop the block.
 
 - **Sub-agent 1 — code-reviewer** runs `code-review` against the diff and
-  writes `rd/code-review.md`. **v2.11.0 Tier 7 (Group D) + 2026-09-09-ecc-dynamic:**
+  writes `rd/code-review-<rid>.md`. **v2.11.0 Tier 7 (Group D) + 2026-09-09-ecc-dynamic:**
   the dispatch goes through the **ECC bridge** (`src/services/code-review/ecc-bridge.ts`)
   with fallback order **native plugin → cache-backed generic agent → inline**:
   - `detectEcc` state `ready` → `Agent({ subagent_type: 'ecc:code-reviewer', ... })`
@@ -58,22 +58,22 @@ end of implementation, RD fires 3 sub-agents in parallel via
   writer's only write target is `qa/test-cases/<rid>.md`.
 - **Sub-agent 3 — karpathy-reviewer** (Slice 5/6 — hard gate) inspects
   the diff + handoff against the 4 Karpathy-guidelines and writes
-  `rd/karpathy-review.md` (v2.11.0: the immutable peaks-prd handoff
+  `rd/karpathy-review-<rid>.md` (v2.11.0: the immutable peaks-prd handoff
   at `prd/handoff.md` replaces `rd/tech-doc.md`). The file MUST
   contain a `## Karpathy-Gate` header and at least one of the 4
   guideline section markers; the transition CLI gate reads those
   markers and refuses `rd:qa-handoff` when the file is missing or
   the markers are absent. The sub-agent returns a JSON envelope
   `{ passed, violations, gateAction }` (see contract below). Do NOT
-  modify code; the writer's only write target is `rd/karpathy-review.md`.
+  modify code; the writer's only write target is `rd/karpathy-review-<rid>.md`.
 
 > **Removed from v2.12.0 fan-out (back-compat window only):**
 > - ~~Sub-agent — security-reviewer~~ — moved to standalone
->   `peaks-security-audit` skill; output `audit/security.md`. The legacy
+>   `peaks-security-audit` skill; output `audit/security-<rid>.md`. The legacy
 >   path `.peaks/_runtime/<sessionId>/rd/security-review.md` remains
 >   readable via `mustContainAny` for the v2.12.0 1-minor-release window.
 > - ~~Sub-agent — perf-baseline-reviewer~~ — moved to standalone
->   `peaks-perf-audit` skill; output `audit/perf.md`. The legacy path
+>   `peaks-perf-audit` skill; output `audit/perf-<rid>.md`. The legacy path
 >   `.peaks/_runtime/<sessionId>/rd/perf-baseline.md` remains readable
 >   via `mustContainAny` for the v2.12.0 1-minor-release window.
 >
@@ -103,7 +103,7 @@ on the produced artifacts, and only then attempts
 `peaks request transition --state qa-handoff`. The aggregation step
 runs 3 ls checks: Gate B3 (code-review file), Gate C2 (qa-test-cases
 pre-draft, the 2nd sub-agent's deliverable), and the KARPATHY_REVIEW
-prereq (the 3rd sub-agent's `rd/karpathy-review.md`). The audit
+prereq (the 3rd sub-agent's `rd/karpathy-review-<rid>.md`). The audit
 prereqs (`AUDIT_SECURITY` + `AUDIT_PERF` + `AUDIT_REQUIRES_HANDOFF`)
 are NOT fan-out outputs — they are produced by the standalone audit
 skills and consumed by the CLI gate. A failure in any of the 3
@@ -140,7 +140,7 @@ karpathy §1 Think Before Coding + §3 Surgical Changes.
   any violation is detected, `gateAction` is `warn`. When clean,
   `gateAction` is `pass`.
 
-**File write**: the sub-agent writes ONLY `rd/karpathy-review.md`,
+**File write**: the sub-agent writes ONLY `rd/karpathy-review-<rid>.md`,
 formatted as:
 
 ```md
@@ -208,9 +208,9 @@ failing the gate.
 
 | Request type | Required RD evidence (under `.peaks/_runtime/<sessionId>/`) |
 |---|---|
-| feature / refactor | `prd/handoff.md` (immutable) + `audit/security.md` (peaks-security-audit) + `audit/perf.md` (peaks-perf-audit) + `rd/code-review.md` + `rd/karpathy-review.md` + `qa/test-cases/<rid>.md` |
-| bugfix | `prd/handoff.md` (immutable) + `audit/security.md` (peaks-security-audit) + `audit/perf.md` (peaks-perf-audit, perf-shaped only) + `rd/code-review.md` + `rd/karpathy-review.md` + `qa/test-cases/<rid>.md` |
-| config | `audit/security.md` (peaks-security-audit) |
+| feature / refactor | `prd/handoff.md` (immutable) + `audit/security-<rid>.md` (peaks-security-audit) + `audit/perf-<rid>.md` (peaks-perf-audit) + `rd/code-review-<rid>.md` + `rd/karpathy-review-<rid>.md` + `qa/test-cases/<rid>.md` |
+| bugfix | `prd/handoff.md` (immutable) + `audit/security-<rid>.md` (peaks-security-audit) + `audit/perf-<rid>.md` (peaks-perf-audit, perf-shaped only) + `rd/code-review-<rid>.md` + `rd/karpathy-review-<rid>.md` + `qa/test-cases/<rid>.md` |
+| config | `rd/security-review.md` (genuinely ridless — `SECURITY_REVIEW.relativePath` carries no `<rid>`) |
 | docs / chore | (no extra evidence required) |
 
 Always required (in addition to the type-specific row):
@@ -225,6 +225,6 @@ DO NOT attempt the qa-handoff transition; CLI will reject with
 >
 > **v2.12.0 change (Group A — Tier 4+5):** `rd/security-review.md` and
 > `rd/perf-baseline.md` are removed from the required-evidence matrix;
-> `audit/security.md` (peaks-security-audit) + `audit/perf.md`
+> `audit/security-<rid>.md` (peaks-security-audit) + `audit/perf-<rid>.md`
 > (peaks-perf-audit) replace them. The `AUDIT_REQUIRES_HANDOFF` prereq
 > enforces the immutable handoff consumption by the audit skills.

package/skills/bee/peaks-rd/references/rd-runbook.md

@@ -131,9 +131,13 @@ peaks codegraph affected --project <repo> <changed-files...> --json
 #     writes). Falls back to empty diff if git is unavailable (degraded mode).
 
 # 1.z Karpathy scan (Slice 5/6 + Slice 6/6 — `peaks scan karpathy` + karpathy-reviewer sub-agent)
-#     After the slice is implemented, scan `rd/karpathy-review.md` for the
+#     After the slice is implemented, scan `rd/karpathy-review-<rid>.md` for the
 #     4 Karpathy guidelines (Think / Simplicity / Surgical / Goal) and verify
 #     the hard Karpathy-Gate (KARPATHY_REVIEW prereq in artifact-prerequisites.ts).
+#     NOTE: `peaks scan karpathy` itself has no rid and probes the ridless
+#     back-compat name `rd/karpathy-review.md`; it reports `block` for a slice
+#     that wrote only the rid-scoped name. `peaks request transition` is the
+#     authoritative gate.
 #     The structural scanner covers regex / file-presence checks; the semantic
 #     review is owned by the karpathy-reviewer sub-agent.
 #
@@ -142,7 +146,7 @@ peaks codegraph affected --project <repo> <changed-files...> --json
 #       peaks scan karpathy --project <path> --format json         # machine-readable
 #       peaks scan karpathy --project <path> --scope all           # full audit (gateAction: block if missing)
 #     Required output before `peaks request transition --state qa-handoff`:
-#       - `rd/karpathy-review.md` exists with `## Karpathy-Gate` header
+#       - `rd/karpathy-review-<rid>.md` exists with `## Karpathy-Gate` header
 #       - 4 title-case section headers present (Think Before Coding / Simplicity First / Surgical Changes / Goal-Driven Execution)
 #       - `gateAction: pass` (or `warn` with documented justification)
 #
@@ -153,7 +157,7 @@ peaks codegraph affected --project <repo> <changed-files...> --json
 #     which is the project-internal draft at
 #     `skills/peaks-rd/references/karpathy-reviewer-prompt.md` plus a
 #     `rd/karpathy-reviewer-agent-handoff.md` install guide.
-#     Hard gate: missing karpathy-reviewer sub-agent OR missing rd/karpathy-review.md
+#     Hard gate: missing karpathy-reviewer sub-agent OR missing rd/karpathy-review-<rid>.md
 #     → `peaks request transition --state qa-handoff` returns `code: PREREQUISITES_MISSING`.
 #     Escape hatch (assisted mode): `--allow-incomplete --confirm`.
 
@@ -163,8 +167,8 @@ peaks codegraph affected --project <repo> <changed-files...> --json
 
 # 7. AFTER implementation, BEFORE QA handoff — RUN THESE GATES:
 #    Peaks-Loop Gate B2: unit tests exist and pass for the changed surface → npx vitest run --changed (or project equivalent; the changed-only mode is the peaks slice check default as of run 017; use --run-tests for the full suite, or invoke /peaks-code-test to run the full suite standalone)
-#    Peaks-Loop Gate B3: code review evidence → .peaks/_runtime/<sessionId>/rd/code-review.md
-#    Peaks-Loop Gate B4: security review evidence → .peaks/_runtime/<sessionId>/rd/security-review.md
+#    Peaks-Loop Gate B3: code review evidence → .peaks/_runtime/<sessionId>/rd/code-review-<rid>.md
+#    Peaks-Loop Gate B4: security review evidence → .peaks/_runtime/<sessionId>/audit/security-<rid>.md
 #    Peaks-Loop Gate B5 (NEW): RD artifact body has no unfilled placeholders.
 peaks request lint <rid> --role rd --project <repo> --session-id <session-id> --json
 #    Peaks-Loop Gate B6 (NEW): declared --type still matches the actual diff after implementation.

package/skills/bee/peaks-rd/references/rd-transition-gates.md

@@ -10,9 +10,11 @@ You cannot declare a phase complete from memory. Each gate below is a `ls` or `g
 >
 > | Type | rd:implemented requires | rd:qa-handoff also requires |
 > |---|---|---|
-> | feature / refactor | `rd/tech-doc.md` | `rd/code-review.md` + `rd/security-review.md` + `rd/perf-baseline.md` (filled Results table, or `N/A — no perf surface` in Notes) + **`qa/test-cases/<rid>.md`** (added in slice 004; pre-drafted by the 4th sub-agent in the parallel fan-out) |
-> | bugfix | `rd/bug-analysis.md` (lighter than tech-doc; root cause + fix + regression test plan) | `rd/code-review.md` + `rd/security-review.md` + **`qa/test-cases/<rid>.md`**; `rd/perf-baseline.md` only when the bug is performance-shaped (matches the L449-452 "When this applies" criteria) |
-> | config | (none) | `rd/security-review.md` only |
+> | feature / refactor | `rd/tech-doc.md` | `rd/code-review-<rid>.md` + `audit/security-<rid>.md` + `audit/perf-<rid>.md` (filled Results table, or `N/A — no perf surface` in Notes) + **`qa/test-cases/<rid>.md`** (added in slice 004; pre-drafted by the 4th sub-agent in the parallel fan-out) |
+> | bugfix | `rd/bug-analysis.md` (lighter than tech-doc; root cause + fix + regression test plan) | `rd/code-review-<rid>.md` + `audit/security-<rid>.md` + **`qa/test-cases/<rid>.md`**; `audit/perf-<rid>.md` only when the bug is performance-shaped (matches the L449-452 "When this applies" criteria) |
+> | config | (none) | `rd/security-review.md` only — this one is genuinely ridless (`SECURITY_REVIEW.relativePath` carries no `<rid>`) |
+>
+> The `<rid>`-bearing names are the ones `peaks request transition` resolves first; the pre-rid names (`rd/code-review.md`, `rd/security-review.md`, `audit/security.md`, `audit/perf.md`) stay **readable** as back-compat tiers for sessions written before slice `2026-09-14-audit-artifact-rid-scoping` — read, never written. Exception: `rd/perf-baseline.md` is the RD-side Gate B9 baseline (a different artifact from `audit/perf-<rid>.md`) and is still both written by `peaks perf baseline --apply` and read as `AUDIT_PERF`'s oldest legacy tier.
 > | docs / chore | (none) | (none) |
 >
 > The escape hatch `--allow-incomplete --reason "<text>"` still exists for one-off exceptions; the bypass is recorded in the artifact transition note.
@@ -68,16 +70,16 @@ npx vitest run --changed --reporter=verbose 2>&1 | tail -20
 
 **Peaks-Loop Gate B3 — Before QA handoff: code review evidence exists:**
 ```bash
-ls .peaks/_runtime/<sessionId>/rd/code-review.md 2>&1
-# Expected: .peaks/_runtime/<sessionId>/rd/code-review.md
+ls .peaks/_runtime/<sessionId>/rd/code-review-<rid>.md 2>&1
+# Expected: .peaks/_runtime/<sessionId>/rd/code-review-<rid>.md
 # "No such file" → BLOCKED. Run code review (use code-reviewer agent or equivalent),
 # record findings, fix CRITICAL/HIGH issues, then re-check.
 ```
 
 **Peaks-Loop Gate B4 — Before QA handoff: security review evidence exists:**
 ```bash
-ls .peaks/_runtime/<sessionId>/rd/security-review.md 2>&1
-# Expected: .peaks/_runtime/<sessionId>/rd/security-review.md
+ls .peaks/_runtime/<sessionId>/audit/security-<rid>.md 2>&1
+# Expected: .peaks/_runtime/<sessionId>/audit/security-<rid>.md
 # "No such file" → BLOCKED. Run security review (use security-reviewer agent or equivalent),
 # fix CRITICAL/HIGH issues, record findings, then re-check.
 ```

package/skills/bee/peaks-rd/references/writing-handoff-frontmatter.md

@@ -4,7 +4,7 @@ Every RD handoff artifact carries a **YAML frontmatter block** so peaks-qa (and
 
 ## Path
 
-`.peaks/_runtime/<sessionId>/prd/handoff.md` — the canonical immutable PRD handoff path (v2.11.0+). The handoff is written by peaks-prd, sha256-hashed in frontmatter, and verified by every downstream sub-agent against the dispatched hash before reading.
+`.peaks/_runtime/<sessionId>/prd/handoff-<rid>.md` — the canonical immutable PRD handoff path (v2.11.0+; one capsule per slice since `2026-09-14-prd-capsule-rid-scoping`). The pre-scoping `.peaks/_runtime/<sessionId>/prd/handoff.md` is still readable as the legacy tier. The handoff is written by peaks-prd, sha256-hashed in frontmatter, and verified by every downstream sub-agent against the dispatched hash before reading.
 
 > **v2.11.0 change (Group A):** the per-session `rd/tech-doc.md` is removed; the immutable peaks-prd handoff replaces it as the slice's source-of-truth architecture document.
 
@@ -19,7 +19,7 @@ scope:
 files:
   - src/services/slice/schema-router.ts
   - src/services/audit/audit-goal-service.ts
-handoffPath: .peaks/_runtime/<sessionId>/prd/handoff.md
+handoffPath: .peaks/_runtime/<sessionId>/prd/handoff-<rid>.md
 handoffHash: sha256:<64 hex chars>
 decisions:
   - id: D1
@@ -34,10 +34,10 @@ nextActions:
   - "If Gate C passes, transition to txt handoff"
 gateEvidence:
   projectScan: .peaks/project-scan/project-scan.md
-  prdHandoff: .peaks/_runtime/<sessionId>/prd/handoff.md
-  codeReview: .peaks/_runtime/<sessionId>/rd/code-review.md
-  securityReview: .peaks/_runtime/<sessionId>/rd/security-review.md
-  perfBaseline: .peaks/_runtime/<sessionId>/rd/perf-baseline.md
+  prdHandoff: .peaks/_runtime/<sessionId>/prd/handoff-<rid>.md
+  codeReview: .peaks/_runtime/<sessionId>/rd/code-review-<rid>.md
+  securityReview: .peaks/_runtime/<sessionId>/audit/security-<rid>.md
+  perfBaseline: .peaks/_runtime/<sessionId>/audit/perf-<rid>.md
 schemaVersion: '2.0'
 ---
 ```

package/skills/peaks-code/SKILL.md

@@ -203,7 +203,7 @@ Before the first planning action, run `peaks fresh-context preflight --prompt "<
 |---|---|---|
 | `< 0.85` | normal | skip — LLM keeps working |
 | `0.85 ≤ ratio < 0.95` | **pre-compact zone** | `peaks code auto-compact` fires **automatically** (deferred only when in-flight sub-agent batch is running; fires the moment the batch lands). The LLM does not prompt the user. |
-| `ratio ≥ 0.95` | **red-line (Karpathy §4)** | synchronous gate — `peaks code auto-compact` invoked immediately; `peaks code context-now` returns `action: 'red-line'` and refuses to advance until ratio drops below 0.85. **Karpathy §4 automatic exception** — LLM cannot opt out. |
+| `ratio ≥ 0.95` | **red-line (Karpathy §4)** | `peaks code auto-compact` invoked immediately; `peaks code context-now` returns `action: 'red-line'`. **Since 4.0.47 the red line REQUESTS the compaction and says it is waiting — it does NOT block sub-agent dispatch, and it does not refuse to advance.** Keep working and re-probe with `peaks code context-now`; the harness performs the compaction, and nothing peaks-loop can do lowers the ratio on its own, so blocking here was a deadlock rather than a gate. If the ratio keeps climbing and no compaction lands, report that and hand control back — do not stall. `--bypass-red-line` is a no-op. |
 
 **Probe primitive (single source of truth):** `peaks code context-now --json`. Do NOT use `peaks context check --prompt-size` (deprecated, will silently under-report ratio). Returns `{ ratio, action: 'ok' | 'soft-warn' | 'auto-compact-now' | 'red-line' }` — Code reads `action` and dispatches `peaks code auto-compact` on `auto-compact-now` or `red-line` without user confirmation.
 

package/skills/peaks-code/references/a2a-artifact-mapping.md

@@ -20,7 +20,7 @@ The mapping below uses peaks's own paths verbatim. Each row also notes where pea
 |---|---|---|---|
 | **AgentCard** (capability advertisement) | `peaks-skill-output-style` + `.peaks/.active-skill.json` | `.peaks/.active-skill.json`, `.peaks/.session.json` | peaks is a *local* tool, not a service. The "card" is the active-skill file plus a peek at `.peaks/PROJECT.md` for human-readable history. There is no `/.well-known/agent-card.json` endpoint. |
 | **Task** (stateful unit of work) | `peaks request` state machine for a single `<rid>` | `.peaks/_runtime/<sid>/{prd,rd,qa,ui,sc}/requests/<rid>.md` (the request artefact); `.peaks/_runtime/<sid>/<role>/session.json` (per-session metadata) | peaks's task lifecycle is `prd:confirmed-by-user → handed-off`, then per role `draft → spec-locked → implemented → qa-handoff`, then `qa:running → verdict-issued`. The full state graph is enforced by `peaks request transition`. A2A's Task object is JSON; peaks's task is **a set of files with a `state` field per role**. |
-| **Artifact** (immutable output) | `rd/tech-doc.md`, `rd/code-review.md`, `rd/security-review.md`, `qa/test-cases/<rid>.md`, `qa/test-reports/<rid>.md`, `qa/security-findings.md`, `qa/performance-findings.md`, `sc/handoff.md` | as listed | peaks's artefacts are *append-once*, not strictly immutable: a `qa/test-reports/<rid>.md` may be re-emitted on repair cycles. The convention is "newest write wins; the file at the end of the workflow is the truth", which is close enough to A2A's immutable-Artifact semantics for translation purposes. |
+| **Artifact** (immutable output) | `rd/tech-doc.md`, `rd/code-review-<rid>.md`, `audit/security-<rid>.md`, `qa/test-cases/<rid>.md`, `qa/test-reports/<rid>.md`, `qa/security-findings.md`, `qa/performance-findings.md`, `sc/handoff.md` | as listed | peaks's artefacts are *append-once*, not strictly immutable: a `qa/test-reports/<rid>.md` may be re-emitted on repair cycles. The convention is "newest write wins; the file at the end of the workflow is the truth", which is close enough to A2A's immutable-Artifact semantics for translation purposes. |
 | **Message** (non-artifact communication) | `peaks skill presence` heartbeat + transition `--reason` notes | `.peaks/.active-skill.json` (`lastHeartbeat`), transition notes in `.peaks/_runtime/<sid>/<role>/requests/<rid>.md` | peaks does **not** separate Messages from Artifacts at the storage layer; a "message" is anything that is not the artefact body (the `<!-- peaks-memory:start -->` markers, the `state` field, the `--reason` text on a transition). Treat these as inline metadata of the artefact, not as separate objects. |
 | **Part** (atomic content unit) | Markdown sections within an artefact, frontmatter fields | inline within the artefact | peaks's Artifacts are single Markdown files, so the "Part" concept maps to a heading or a frontmatter field. A `Part`'s `kind` in A2A terms is `text` (the prose), `file` (a `<!-- peaks-memory:start -->` block as a structured chunk), or `data` (the frontmatter). A2A's `form` / `iframe` / video `Part` kinds are not produced by peaks. |
 
@@ -78,8 +78,8 @@ A user runs `peaks-code` for a "add user authentication" feature. Mapping the re
 .peaks/_runtime/<sessionId>/ui/design-draft.md       → A2A Artifact (kind=visual-spec)
 .peaks/_runtime/<sessionId>/rd/tech-doc.md           → A2A Artifact (kind=implementation-plan)
 .peaks/_runtime/<sessionId>/qa/test-cases/001.md     → A2A Artifact (kind=test-cases)
-.peaks/_runtime/<sessionId>/rd/code-review.md        → A2A Artifact (kind=review, status=fixed)
-.peaks/_runtime/<sessionId>/rd/security-review.md    → A2A Artifact (kind=security-review)
+.peaks/_runtime/<sessionId>/rd/code-review-<rid>.md  → A2A Artifact (kind=review, status=fixed)
+.peaks/_runtime/<sessionId>/audit/security-<rid>.md  → A2A Artifact (kind=security-review)
 .peaks/_runtime/<sessionId>/qa/test-reports/001.md    → A2A Artifact (kind=test-report, verdict=pass)
 .peaks/_runtime/<sessionId>/qa/security-findings.md  → A2A Artifact (kind=security-findings)
 .peaks/_runtime/<sessionId>/qa/performance-findings.md → A2A Artifact (kind=performance-findings)

package/skills/peaks-code/references/local-artifact-workspace.md

@@ -53,7 +53,7 @@ Files written into these directories during the workflow (not pre-created — th
 - `rd/project-scan.md` (Code step 0.6)
 - `rd/tech-doc.md` (feature/refactor planning; required by `rd → implemented` gate)
 - `rd/bug-analysis.md` (bugfix planning; required by `rd → implemented` gate for `--type bugfix`)
-- `rd/code-review.md`, `rd/security-review.md` (required by `rd → qa-handoff` gate for feature/bugfix/refactor; security-review only for config)
+- `rd/code-review-<rid>.md`, `audit/security-<rid>.md` (required by `rd → qa-handoff` gate for feature/bugfix/refactor; the `config` type instead requires the ridless `rd/security-review.md`)
 - `rd/mock-plan.md` (frontend-only mode)
 - `ui/design-draft.md` (UI step)
 - `system/existing-system.md` (Code step 0.7; legacy projects only)