peaks-loop 4.0.47 → 4.0.49

package/skills/peaks-code/references/resume-detection.md

@@ -12,12 +12,18 @@
 sid=$(peaks session info --active --project "$(git rev-parse --show-toplevel)" --json | python3 -c "import sys,json; print(json.load(sys.stdin)['data']['sessionId'])")
 
 # 2. Enumerate the session's artifact tree (one `find` call, no new CLI)
-find ".peaks/$sid/" -type f 2>/dev/null | sort
+find ".peaks/_runtime/$sid/" -type f 2>/dev/null | sort
 
 # 3. For each role request artifact present, read its `state:` field
-#    (one-pass grep; only files that exist)
-for f in .peaks/$sid/prd/requests/*.md .peaks/$sid/rd/requests/*.md .peaks/$sid/qa/requests/*.md; do
-  [ -f "$f" ] && echo "$f: $(grep -m1 '^state:' "$f" | awk '{print $2}')"
+#    (only files that exist). Artifacts are append-only: every round appends its
+#    own `## Status` block and `request transition` rewrites the NEWEST
+#    `- state:` line in place, so the LAST match is the current state and the
+#    earlier ones are history. Reading the FIRST match returns a superseded
+#    round — that was the 2026-09-14 defect. The leading `-` is part of the
+#    field: an unanchored `^state:` matches nothing (artifacts write
+#    `- state:`), so it reported an empty state, silently.
+for f in .peaks/_runtime/$sid/prd/requests/*.md .peaks/_runtime/$sid/rd/requests/*.md .peaks/_runtime/$sid/qa/requests/*.md; do
+  [ -f "$f" ] && echo "$f: $(grep '^-[[:space:]]*state:' "$f" | tail -n1 | sed 's/^-[[:space:]]*state:[[:space:]]*//; s/[[:space:]]*$//')"
 done
 
 # 4. Compute "deepest completed gate" by file-presence + state mapping
@@ -28,7 +34,7 @@ done
 
 | Files present | State | Deepest completed gate | Resume point (if any) |
 |---|---|---|---|
-| only `.peaks/$sid/.session.json` | (no slice) | (none) | fresh — skip to Step 1 |
+| only `.peaks/_runtime/$sid/session.json` | (no slice) | (none) | fresh — skip to Step 1 |
 | `prd/requests/<rid>.md` | `state: handed-off` | Gate B (swarm converged) | resume at Step 3 (swarm) — but if swarm already ran and produced `rd/tech-doc.md` / `qa/test-cases/<rid>.md`, drop to deepest |
 | `rd/requests/<rid>.md` | `state: qa-handoff` | Gate C (RD done) | resume at Step 6 (QA validation) |
 | `qa/requests/<rid>.md` | `state: verdict-issued` | Gate D (QA done) | resume at Step 10 (TXT handoff) |
@@ -39,8 +45,8 @@ done
 | Missing file | Resume at |
 |---|---|
 | `rd/tech-doc.md` (for `feature`/`refactor`) or `rd/bug-analysis.md` (for `bugfix`) | Step 3b (RD planning) |
-| `rd/code-review.md` or `rd/security-review.md` | Step 5 (RD review fan-out) |
-| `rd/perf-baseline.md` (for `feature`/`refactor`) | Step 5 (perf baseline) |
+| `rd/code-review-<rid>.md` or `audit/security-<rid>.md` | Step 5 (RD review fan-out) |
+| `audit/perf-<rid>.md` (for `feature`/`refactor`) | Step 5 (perf baseline) |
 | `qa/test-cases/<rid>.md` | Step 6 (QA test-case generation) |
 | `qa/test-reports/<rid>.md` or `qa/security-findings.md` or `qa/performance-findings.md` | Step 6 (QA execution) |
 | `txt/handoff.md` | Step 10 (TXT handoff) |

package/skills/peaks-code/references/runbook.md

@@ -153,8 +153,9 @@ peaks request transition <rid> --role rd --state implemented --project <repo> --
 
 # 5. Peaks-Loop Code review + security review BEFORE qa-handoff transition.
 #    Produce the evidence files the CLI gate enforces:
-#      - .peaks/_runtime/<id>/rd/code-review.md     (CRITICAL/HIGH findings + fixes; required for feature/bugfix/refactor)
-#      - .peaks/_runtime/<id>/rd/security-review.md (required for feature/bugfix/refactor/config)
+#      - .peaks/_runtime/<id>/rd/code-review-<rid>.md  (CRITICAL/HIGH findings + fixes; required for feature/bugfix/refactor)
+#      - .peaks/_runtime/<id>/audit/security-<rid>.md  (required for feature/bugfix/refactor; the ridless rd/security-review.md is the config-type requirement)
+#      The pre-rid names remain accepted back-compat tiers, but writing one re-opens the two-slices-one-session collision (slice 2026-09-14-audit-artifact-rid-scoping).
 #    Then transition. If --type is docs/chore the gate is empty and the transition is unguarded.
 peaks request transition <rid> --role rd --state qa-handoff --project <repo> --json
 

package/skills/peaks-code/references/session-overload-signal-index.md

@@ -45,7 +45,8 @@ LLM senses context pressure
   │   │     ├─ Job mode → MUST auto-compact now
   │   │     └─ non-Job  → wait for next idle turn, then compact
   │   ├─ 0.85 ≤ ratio < 0.95 → pre-compact zone; auto-compact MUST fire
-  │   └─ ratio ≥ 0.95       → red-line; synchronous gate (Karpathy §4)
+  │   └─ ratio ≥ 0.95       → red-line; compact REQUESTED, dispatch NOT blocked (Karpathy §4)
+  │                                 keep working, re-probe, do not stall
   ├─► Check statusline compact bar (signal #4)
   │   ├─ queued / preparing / compacting / verifying → wait
   │   ├─ failed → read failure reason, do NOT spawn new session

package/skills/peaks-code/references/workflow-gates-and-types.md

@@ -104,11 +104,13 @@ The CLI gate (`peaks request transition --state qa-handoff`) is the authoritativ
 
 | Request type | Required RD evidence (under `.peaks/_runtime/<sessionId>/`) |
 |---|---|
-| `feature` / `refactor` | `rd/tech-doc.md` + `rd/code-review.md` + `rd/security-review.md` + `rd/perf-baseline.md` + `qa/test-cases/<rid>.md` (qa/test-cases pre-drafted by the 4th sub-agent in peaks-rd's parallel fan-out — slice 004) |
-| `bugfix` | `rd/bug-analysis.md` + `rd/code-review.md` + `rd/security-review.md` + `qa/test-cases/<rid>.md` (rd/perf-baseline.md only when the bug is performance-shaped) |
-| `config` | `rd/security-review.md` |
+| `feature` / `refactor` | `rd/tech-doc.md` + `rd/code-review-<rid>.md` + `audit/security-<rid>.md` + `audit/perf-<rid>.md` + `qa/test-cases/<rid>.md` (qa/test-cases pre-drafted by the 4th sub-agent in peaks-rd's parallel fan-out — slice 004) |
+| `bugfix` | `rd/bug-analysis.md` + `rd/code-review-<rid>.md` + `audit/security-<rid>.md` + `audit/perf-<rid>.md` + `qa/test-cases/<rid>.md` (the perf artifact is always required; a bug with no perf surface satisfies it with the `N/A — no perf surface` stub) |
+| `config` | `rd/security-review.md` (this one is genuinely ridless — `SECURITY_REVIEW.relativePath` carries no `<rid>`) |
 | `docs` / `chore` | (no extra evidence required) |
 
+> The four rid-scoped names above are the gate's **primary** tier (slice `2026-09-14-audit-artifact-rid-scoping`): two slices in one session share `rd/` and `audit/`, so a ridless write silently destroyed the earlier slice's evidence. The pre-rid names (`rd/code-review.md`, `audit/security.md`, `audit/perf.md`, `rd/security-review.md`, `rd/perf-baseline.md`) remain accepted as **back-compat tiers** — they keep old sessions passing, but a new slice must write the rid-scoped name or it reopens the collision.
+
 Always required (in addition to the type-specific row): `ls .peaks/_runtime/<sessionId>/rd/requests/<rid>.md`. Missing any required file → DO NOT attempt the qa-handoff transition; CLI will reject with PREREQUISITES_MISSING.
 
 ```bash
@@ -116,10 +118,10 @@ Always required (in addition to the type-specific row): `ls .peaks/_runtime/<ses
 ls .peaks/_runtime/<sessionId>/rd/requests/<rid>.md
 
 # Type-specific RD evidence (must match the type recorded in the artifact body)
-#   feature / refactor → ls rd/tech-doc.md rd/code-review.md rd/security-review.md rd/perf-baseline.md qa/test-cases/<rid>.md
+#   feature / refactor → ls rd/tech-doc.md rd/code-review-<rid>.md audit/security-<rid>.md audit/perf-<rid>.md qa/test-cases/<rid>.md
 #                         (qa/test-cases/<rid>.md pre-drafted by the 4th sub-agent in peaks-rd's parallel fan-out — slice 004)
-#   bugfix             → ls rd/bug-analysis.md rd/code-review.md rd/security-review.md qa/test-cases/<rid>.md
-#                         (rd/perf-baseline.md only when the bug is performance-shaped)
+#   bugfix             → ls rd/bug-analysis.md rd/code-review-<rid>.md audit/security-<rid>.md audit/perf-<rid>.md qa/test-cases/<rid>.md
+#                         (the perf artifact is always required; use the "N/A — no perf surface" stub when there is no perf surface)
 #   config             → ls rd/security-review.md
 #   docs / chore       → (no extra evidence required)
 # Missing any required file → DO NOT attempt the qa-handoff transition; CLI will reject with PREREQUISITES_MISSING.