peaks-loop 4.0.48 → 4.0.50

package/dist/services/prd/handoff-service.js

@@ -27,6 +27,8 @@ import { existsSync } from 'node:fs';
 import { mkdir, readFile, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { parse as parseYaml } from 'yaml';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
+import { REQUEST_ID_PATTERN } from '../artifacts/request-artifact-service.js';
 import { serializeHandoffFrontmatter } from './handoff-frontmatter.js';
 /** Required schema version for new handoffs. */
 const HANDOFF_SCHEMA_VERSION = '2';
@@ -34,6 +36,39 @@ const HANDOFF_SCHEMA_VERSION = '2';
 export function sha256OfBody(body) {
     return createHash('sha256').update(body, 'utf8').digest('hex');
 }
+/**
+ * Both ids in a handoff path are caller-supplied path segments, so both are
+ * checked at the join. Added 2026-09-14 (repair R1, security audit F2 of
+ * `2026-09-14-cli-id-escape-instrumentation`).
+ *
+ * This function was introduced by `0536d5bd` — the commit that instrumented
+ * this defect class — with neither id checked, and it sat outside rule D's
+ * scanned layer, so the instrument could not see its own new member.
+ * Measured on the pre-fix tree (`prd handoff init --apply`, temp project,
+ * `ok: true` both times):
+ *
+ *   --rid '../../../../../../README'  replaced the project-root README.md
+ *   --sid '../../../../SIDOUT'        wrote 4 levels above the project root
+ *
+ * The two axes need two different controls, for a recorded reason: the rid has
+ * a pinned format (`REQUEST_ID_PATTERN`, no separator, no dot-dot, no drive)
+ * and the sid has none, so it gets the segment check. `isUnsafePathInput`
+ * alone is NOT enough for the rid — it admits `a/b` (two non-empty segments),
+ * which `request-artifact-service.ts` would reject.
+ *
+ * Guarding HERE rather than at the three `prd`/`env` flags means every producer
+ * that writes through this constructor — `initHandoff`'s default,
+ * `handoff-auto-regen.ts`, `evidence-generator.ts` — is covered by the join
+ * itself, not by each caller re-deciding.
+ */
+function assertSafeHandoffIds(sessionId, requestId) {
+    if (!REQUEST_ID_PATTERN.test(requestId)) {
+        throw new Error(`Invalid request id: ${requestId} (expected letters, digits, dots, underscores, or dashes)`);
+    }
+    if (isUnsafePathInput(sessionId)) {
+        throw new Error(`Invalid session id: ${sessionId} (must be a single path segment)`);
+    }
+}
 /**
  * The canonical capsule path for ONE SLICE, relative to the project root.
  *
@@ -50,6 +85,7 @@ export function sha256OfBody(body) {
  * tolerate pre-rid-scoping sessions call `resolveHandoffPath` instead.
  */
 export function handoffRelativePath(sessionId, requestId) {
+    assertSafeHandoffIds(sessionId, requestId);
     return join('.peaks', '_runtime', sessionId, 'prd', `handoff-${requestId}.md`);
 }
 /**
@@ -69,6 +105,13 @@ export function handoffRelativePath(sessionId, requestId) {
  * this scoping exists to close (fail closed, not "some capsule is there").
  */
 export function resolveHandoffPath(opts) {
+    // The legacy bare-name candidate below is a second join of the same sid, in a
+    // second function, so it needs the sid guarded in its own right — the
+    // optional-requestId branch reaches `handoffRelativePath` (guarded there), but
+    // the branch that is taken when a caller has NO rid reaches this join only.
+    if (isUnsafePathInput(opts.sessionId)) {
+        throw new Error(`Invalid session id: ${opts.sessionId} (must be a single path segment)`);
+    }
     const candidates = [
         ...(opts.requestId !== undefined ? [handoffRelativePath(opts.sessionId, opts.requestId)] : []),
         join('.peaks', '_runtime', opts.sessionId, 'prd', 'handoff.md')

package/dist/services/qa/qa-business-review-state.js

@@ -17,6 +17,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { isUnsafePathInput } from '../../shared/path-safety.js';
+import { REQUEST_ID_PATTERN } from '../artifacts/request-artifact-service.js';
 /** 6-item business checklist (12 Gaps QA perspective). */
 export const QA_BUSINESS_ITEMS = [
     { id: 'business-flow', question: '这个功能"用起来"对吗?(业务流程顺不顺,操作路径是否反人类,跟现有系统交互有没有断层)' },
@@ -37,17 +38,30 @@ export function buildEmptyQaReview(requestId, sessionId, now = new Date()) {
     };
 }
 export function getQaReviewDir(projectRoot, sessionId) {
-    // Sid axis. Every `peaks qa-business-review|score|accept|reject` subcommand
-    // reaches the runtime tree through this one constructor, so one guard here
-    // covers the whole family — measured: `--session-id ../../../../…/PWNED`
-    // wrote `qa-business-reviews/<rid>.json` outside every project root under an
-    // `ok: true` envelope (RD sweep case A17).
+    // Sid axis ONLY. The guard here covers the session segment of every
+    // `peaks qa-business-review|score|accept|reject` subcommand — measured:
+    // `--session-id ../../../../…/PWNED` wrote `qa-business-reviews/<rid>.json`
+    // outside every project root under an `ok: true` envelope (RD sweep case A17).
+    //
+    // It does NOT cover the rid axis: the request id is joined one function later,
+    // in `getQaReviewPath` below. Corrected 2026-09-14 (repair R1) — this comment
+    // previously said "one guard here covers the whole family", and the security
+    // audit of `2026-09-14-cli-id-escape-instrumentation` (F1b) measured that claim
+    // false: `qa-business-review '../../../../…/EVILQA3'` wrote a `.json` file
+    // outside the project root under `ok: true`.
     if (isUnsafePathInput(sessionId)) {
         throw new Error(`Invalid session id: ${sessionId} (must be a single path segment)`);
     }
     return resolve(projectRoot, '.peaks', '_runtime', sessionId, 'qa-business-reviews');
 }
 export function getQaReviewPath(projectRoot, sessionId, requestId) {
+    // Rid axis. The requestId is the CLI positional (`qa-business-review
+    // <request-id>`), so it is caller-supplied and it becomes a filename segment
+    // here. `isUnsafePathInput` alone would admit `a/b`; the rid has a pinned
+    // format, so the format check is the control.
+    if (!REQUEST_ID_PATTERN.test(requestId)) {
+        throw new Error(`Invalid request id: ${requestId} (expected letters, digits, dots, underscores, or dashes)`);
+    }
     return join(getQaReviewDir(projectRoot, sessionId), `${requestId}.json`);
 }
 export function readQaReview(projectRoot, sessionId, requestId) {

package/dist/services/sc/sc-service.d.ts

@@ -51,6 +51,14 @@ export type CommitBoundary = {
     syncState: 'synced' | 'pending' | 'failed';
     rollbackPoint: string | null;
 };
+/**
+ * The repo's slice-id control — no separator, no drive, no `..`, non-empty, and
+ * not a bare `.`/`..`. Exported 2026-09-14 (repair R1) so the slice-id axis has
+ * ONE control: `slice-review-state.getReviewPath` joins a caller-supplied slice
+ * id into a filename and previously had none, and a second copy of this regex
+ * there would be the same axis decided twice.
+ */
+export declare const SLICE_ID_PATTERN: RegExp;
 /**
  * Resolution sources for `resolveArtifactSession`, in priority order.
  * - `active-skill`: the canonical sid-scoped lease projection

package/dist/services/sc/sc-service.js

@@ -44,7 +44,14 @@ const MODERN_RETENTION_REQUIREMENTS = [
     'qa/test-reports/{sliceId}.md',
     'txt/handoff.md'
 ];
-const SLICE_ID_PATTERN = /^(?!\.{1,2}$)[A-Za-z0-9._-]+$/;
+/**
+ * The repo's slice-id control — no separator, no drive, no `..`, non-empty, and
+ * not a bare `.`/`..`. Exported 2026-09-14 (repair R1) so the slice-id axis has
+ * ONE control: `slice-review-state.getReviewPath` joins a caller-supplied slice
+ * id into a filename and previously had none, and a second copy of this regex
+ * there would be the same axis decided twice.
+ */
+export const SLICE_ID_PATTERN = /^(?!\.{1,2}$)[A-Za-z0-9._-]+$/;
 function getPeaksPath(workspaceRoot) {
     return resolve(workspaceRoot, '.peaks');
 }

package/dist/services/scan/api-diff-types.js

@@ -8,7 +8,25 @@
  * is not merely annotated. `confidence: 'exact'` is reserved for lines where
  * both sides were parsed AND the recorded interface was fully readable.
  */
+import { realpathSync } from 'node:fs';
 import { resolve, sep } from 'node:path';
+/**
+ * Canonicalize through symlinks so two paths that name the same directory through
+ * different prefixes (the macOS `/var` <-> `/private/var` quirk the brief calls
+ * out) line up as the same literal on both sides of the prefix test below.
+ * Falls back to `resolve()` when the path does not exist yet — `realpathSync`
+ * throws on missing paths, and several callers in the suite inspect not-yet-
+ * created paths (e.g. the "string prefix of a sibling" guard at
+ * api-diff-service.test.ts:462).
+ */
+function safeRealpath(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return resolve(p);
+    }
+}
 /** The honest boundary of the feature. Printed in the output, not just documented. */
 export const NOT_DETECTABLE = [
     'a field whose type is unchanged but whose meaning changed',
@@ -38,8 +56,8 @@ export function isRecord(value) {
  * the misleading `archive/docs/api.json`.
  */
 export function toDisplayPath(projectRoot, file) {
-    const rootParts = resolve(projectRoot).split(sep);
-    const fileParts = resolve(file).split(sep);
+    const rootParts = safeRealpath(projectRoot).split(sep);
+    const fileParts = safeRealpath(file).split(sep);
     const inside = fileParts.length > rootParts.length
         && rootParts.every((part, index) => part === fileParts[index]);
     return (inside ? fileParts.slice(rootParts.length) : fileParts).join('/');

package/dist/services/security/safe-settings-path.js

@@ -71,12 +71,30 @@ export function assertSafeDispatchRecordPath(recordPath, projectRoot) {
         // to create it). Fall back to lexical comparison against the
         // canonical projectRoot — the write will then create the file,
         // and any symlink in the parent will be caught on the next read.
+        //
+        // macOS note: the project's own realpath may still resolve the
+        // `/var -> /private/var` symlink even when the sub-agent dir does
+        // not exist yet, so the caller can compare on a stable prefix
+        // instead of having one side of the comparison on `/var/...` and
+        // the other on `/private/var/...`. We still validate that the
+        // canonical record path lives under the canonical projectRoot.
         const fallback = resolve(projectRoot, '.peaks', SUB_AGENTS_DIR);
         const rel2 = relative(fallback, recordPath);
         if (rel2.startsWith('..') || isAbsolute(rel2)) {
             throw invalidPathError(recordPath, 'must be under .peaks/_sub_agents/');
         }
-        return recordPath;
+        try {
+            realRoot = realpathSync(projectRoot);
+            const canonicalRecord = resolve(realRoot, '.peaks', SUB_AGENTS_DIR, recordPath.slice(fallback.length + 1));
+            const realRel = relative(realRoot, canonicalRecord);
+            if (realRel.startsWith('..' + sep) || realRel === '..' || isAbsolute(realRel)) {
+                throw invalidPathError(recordPath, 'escapes project root via symlink');
+            }
+            return canonicalRecord;
+        }
+        catch {
+            return recordPath;
+        }
     }
     const realRel = relative(realRoot, realRecord);
     if (realRel.startsWith('..' + sep) || realRel === '..' || isAbsolute(realRel)) {

package/dist/services/session/getSessionDir.d.ts

@@ -1 +1,34 @@
 export declare function getSessionDir(projectRoot: string, sessionId: string): string;
+/**
+ * The TOTAL entry to the same axis. Same predicate, same path; the only
+ * difference is that this one is total — it never throws.
+ *
+ * WHY TWO ENTRIES RATHER THAN ONE. The partial entry above is correct
+ * for a caller that cannot proceed without a session dir: a throw is
+ * the one failure a caller cannot forget to handle. It is the WRONG
+ * shape for a frame whose own doc promises never to throw — the
+ * statusline, the fire-and-forget telemetry writer, the best-effort
+ * probe. Each of those frames had to wrap the partial entry in a
+ * `try { } catch { return null }`, and that swallow cannot be told
+ * apart from a real "there is nothing here" answer. Measured on the
+ * compact backoff (`auto-compact-lifecycle.ts`), the conflation turned
+ * an unresolvable id into the ADMIT branch and re-opened a dispatch
+ * that the open run should have suppressed.
+ *
+ * The split does NOT make a swallow unwriteable — TypeScript has no
+ * checked exceptions, so nothing here can. It makes the swallow
+ * UNNECESSARY at a named place, and it gives every checker a stable
+ * name to key on: a frame that degrades must say so by calling this
+ * function, and the degrading branch (`ok: false`) is then a value the
+ * caller has to handle rather than a `catch` nobody reads.
+ *
+ * `reason` is a single-line English sentence fit for an envelope — no
+ * stack traces, no CLI verbs (see `human-nl-choice-only-tenet`).
+ */
+export declare function tryGetSessionDir(projectRoot: string, sessionId: string): {
+    readonly ok: true;
+    readonly dir: string;
+} | {
+    readonly ok: false;
+    readonly reason: string;
+};

package/dist/services/session/getSessionDir.js

@@ -22,11 +22,71 @@
  *       legacy `.peaks/<sid>/...` artifact path that a sub-agent would
  *       follow verbatim.
  *
+ * `sessionId` is the last caller-supplied segment of every session-scoped
+ * path here, so its segment check lives at this join rather than being
+ * re-derived at each call site: `../../x` used to be joined verbatim, and
+ * the CLI wrote outside the project root while still returning `ok: true`.
+ *
+ * The predicate is `isUnsafePathInput`, NOT `SESSION_ID_PATTERN` /
+ * `validateSessionId`. The latter are stricter than the segment axis and
+ * reject ids that are legal today (`sid-1`, a request id reused as the
+ * session-dir name), so adopting them would change results for
+ * well-formed callers.
+ *
+ * Not covered, recorded rather than implied: the `\0` axis
+ * (`isUnsafePathInput` admits a NUL, and `execFileSync` raises EINVAL
+ * before it can be exercised), and callers that hand-roll
+ * `join(root, '.peaks', '_runtime', sid, ...)` instead of calling this.
+ *
  * @param projectRoot - Absolute path to the project root.
  * @param sessionId - The session identifier (e.g. `2026-06-06-session-5b1095`).
  * @returns Absolute path to the canonical session directory.
+ * @throws Error when `sessionId` is not a single path segment.
  */
 import { join } from 'node:path';
+import { isUnsafePathInput } from '../../shared/path-safety.js';
 export function getSessionDir(projectRoot, sessionId) {
+    // Throwing, not `null` / a tagged result: those widen the return type
+    // to `string | null` and make every call site handle a bad id — the
+    // per-site slice this guard replaces. This is also the shape the repo
+    // already refuses with, and a caller cannot forget to handle a throw.
+    if (isUnsafePathInput(sessionId)) {
+        throw new Error(`Invalid session id: ${sessionId} (must be a single path segment)`);
+    }
     return join(projectRoot, '.peaks', '_runtime', sessionId);
 }
+/**
+ * The TOTAL entry to the same axis. Same predicate, same path; the only
+ * difference is that this one is total — it never throws.
+ *
+ * WHY TWO ENTRIES RATHER THAN ONE. The partial entry above is correct
+ * for a caller that cannot proceed without a session dir: a throw is
+ * the one failure a caller cannot forget to handle. It is the WRONG
+ * shape for a frame whose own doc promises never to throw — the
+ * statusline, the fire-and-forget telemetry writer, the best-effort
+ * probe. Each of those frames had to wrap the partial entry in a
+ * `try { } catch { return null }`, and that swallow cannot be told
+ * apart from a real "there is nothing here" answer. Measured on the
+ * compact backoff (`auto-compact-lifecycle.ts`), the conflation turned
+ * an unresolvable id into the ADMIT branch and re-opened a dispatch
+ * that the open run should have suppressed.
+ *
+ * The split does NOT make a swallow unwriteable — TypeScript has no
+ * checked exceptions, so nothing here can. It makes the swallow
+ * UNNECESSARY at a named place, and it gives every checker a stable
+ * name to key on: a frame that degrades must say so by calling this
+ * function, and the degrading branch (`ok: false`) is then a value the
+ * caller has to handle rather than a `catch` nobody reads.
+ *
+ * `reason` is a single-line English sentence fit for an envelope — no
+ * stack traces, no CLI verbs (see `human-nl-choice-only-tenet`).
+ */
+export function tryGetSessionDir(projectRoot, sessionId) {
+    // Deliberately NOT `try { return {ok:true, dir: getSessionDir(...)} } catch`.
+    // That would re-introduce the swallow this function exists to remove, and it
+    // would also catch a throw from `join` for reasons that are not a bad id.
+    if (isUnsafePathInput(sessionId)) {
+        return { ok: false, reason: `Invalid session id: ${sessionId} (must be a single path segment)` };
+    }
+    return { ok: true, dir: join(projectRoot, '.peaks', '_runtime', sessionId) };
+}

package/dist/services/skill/skill-search-service.d.ts

@@ -32,14 +32,14 @@ export declare const SkillSearchInputSchema: z.ZodObject<{
         status: "status";
         resume: "resume";
         audit: "audit";
-        ide: "ide";
+        "final-review": "final-review";
         content: "content";
+        ide: "ide";
         test: "test";
-        research: "research";
         doctor: "doctor";
+        research: "research";
         triage: "triage";
         sop: "sop";
-        "final-review": "final-review";
         "slice-decompose": "slice-decompose";
         "issue-fix-orchestrator": "issue-fix-orchestrator";
         "perf-audit": "perf-audit";

package/dist/services/slice/slice-review-state.js

@@ -15,6 +15,7 @@
 import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { isUnsafePathInput } from '../../shared/path-safety.js';
+import { SLICE_ID_PATTERN } from '../sc/sc-service.js';
 /** The 5 default review items per slice (the 12 Gaps memory checklist). */
 export const DEFAULT_REVIEW_ITEMS = [
     { id: 'business-match', question: '这个 slice 做完,业务流程对吗?(跟产品最初给的需求匹配)' },
@@ -33,16 +34,30 @@ export function buildEmptySliceReview(sliceId, sessionId, now = new Date()) {
     };
 }
 export function getReviewDir(projectRoot, sessionId) {
-    // Sid axis. Every `peaks slice-review|score|accept|reject` subcommand reaches
-    // the runtime tree through this one constructor. Measured: `--session-id
-    // ../../../../…/PWNED` wrote `slice-reviews/<slice-id>.json` outside every
-    // project root under an `ok: true` envelope (RD sweep case A26).
+    // Sid axis ONLY. Every `peaks slice-review|score|accept|reject` subcommand
+    // reaches the runtime tree through this one constructor. Measured:
+    // `--session-id ../../../../…/PWNED` wrote `slice-reviews/<slice-id>.json`
+    // outside every project root under an `ok: true` envelope (RD sweep case A26).
+    //
+    // It does NOT cover the slice-id axis: the slice id is joined one function
+    // later, in `getReviewPath` below. Corrected 2026-09-14 (repair R1) — this
+    // comment previously said one guard covered the whole family; the security
+    // audit of `2026-09-14-cli-id-escape-instrumentation` (F1b) measured that
+    // false: `slice-review '../../../../…/EVILSL'` wrote a `.json` file outside
+    // the project root under `ok: true`.
     if (isUnsafePathInput(sessionId)) {
         throw new Error(`Invalid session id: ${sessionId} (must be a single path segment)`);
     }
     return resolve(projectRoot, '.peaks', '_runtime', sessionId, 'slice-reviews');
 }
 export function getReviewPath(projectRoot, sessionId, sliceId) {
+    // Slice-id axis. The slice id is the CLI positional (`slice-review
+    // <slice-id>`), so it is caller-supplied and it becomes a filename segment
+    // here. Same control as the rid axis: a pinned format beats the segment check,
+    // which admits `a/b`.
+    if (!SLICE_ID_PATTERN.test(sliceId)) {
+        throw new Error(`Invalid slice id: ${sliceId} (expected letters, digits, dots, underscores, or dashes)`);
+    }
     return join(getReviewDir(projectRoot, sessionId), `${sliceId}.json`);
 }
 export function readSliceReview(projectRoot, sessionId, sliceId) {

package/dist/services/standards/loop-engineering-lint.d.ts

@@ -18,7 +18,7 @@
  * `peaks standards lint --category loop-engineering` (registered in M0's
  * plan) will read this file from disk and call this function.
  */
-export declare const EXPECTED_RED_LINE_IDS: readonly ["RL-0", "RL-1", "RL-2", "RL-3", "RL-4", "RL-5", "RL-6", "RL-7", "RL-8", "RL-9"];
+export declare const EXPECTED_RED_LINE_IDS: readonly ["RL-0", "RL-1", "RL-2", "RL-3", "RL-4", "RL-5", "RL-6", "RL-7", "RL-8", "RL-9", "RL-10"];
 export type RedLineId = (typeof EXPECTED_RED_LINE_IDS)[number];
 export declare const REQUIRED_SECTIONS: readonly ["Failure modes", "Rewrite", "Self-check", "Out-of-scope"];
 export type RedLineSection = (typeof REQUIRED_SECTIONS)[number];

package/dist/services/standards/loop-engineering-lint.js

@@ -29,6 +29,12 @@ export const EXPECTED_RED_LINE_IDS = [
     'RL-7',
     'RL-8',
     'RL-9',
+    // RL-10 was written into the guideline file (its 4 sections included) but
+    // never added here, so the lint could not see it: the closed set stopped one
+    // short of the file it was supposed to police. The file's own footer said
+    // "Total red lines: 9 (RL-0..RL-9)" while RL-10 sat below it — the two
+    // statements contradicted each other and only the file was ever read.
+    'RL-10',
 ];
 export const REQUIRED_SECTIONS = [
     'Failure modes',

package/dist/services/web/daemon-registry.js

@@ -5,10 +5,29 @@
  * WRITE goes through `assertUnder` first — the slice-wide guard against an
  * artifact escaping `<root>/.peaks/_runtime/<sid>/web/` (AC1).
  */
-import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, realpathSync, unlinkSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { assertUnder, webDaemonDir, webDaemonInfoPath, webSpawnLockPath } from './web-artifact-paths.js';
 import { parseDaemonInfo } from './web-protocol.js';
+/**
+ * Canonicalize through symlinks so two paths that name the same directory through
+ * different prefixes compare equal — the macOS `/var` <-> `/private/var` quirk
+ * makes `mkdtempSync(...)` return `/var/folders/...` while `process.cwd()` after
+ * `chdir` returns `/private/var/folders/...`. They are the same directory on
+ * disk; without `realpathSync` the ownership check below silently rejects a
+ * legitimate record and the CLI cold-starts a real daemon instead of reusing
+ * the stub. Falls back to `resolve()` when the path is absent: a planted
+ * record naming a directory that does not exist still has to fail the
+ * containment test, and a `realpathSync` on it would throw.
+ */
+function safeRealpath(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return p;
+    }
+}
 /** A spawn lock older than this is reclaimed even if its owner pid is alive. */
 const SPAWN_LOCK_STALE_MS = 120_000;
 /**
@@ -46,7 +65,13 @@ export function readDaemonInfo(projectRoot, sessionId) {
     }
     try {
         const info = parseDaemonInfo(readFileSync(target, 'utf8'));
-        if (info === null || info.projectRoot !== projectRoot || info.sessionId !== sessionId) {
+        if (info === null || info.sessionId !== sessionId) {
+            return null;
+        }
+        // Canonicalize both sides — a record written from one prefix (say
+        // `/var/folders/...`) and read from the canonical one (`/private/var/...`)
+        // describes the same project on macOS.
+        if (safeRealpath(info.projectRoot) !== safeRealpath(projectRoot)) {
             return null;
         }
         return info;

package/dist/services/workflow/pipeline-verify-gate-support.js

@@ -28,17 +28,16 @@ export async function findRequestFile(projectRoot, role, rid) {
     const artifact = await showRequestArtifact({ projectRoot, role: role, requestId: rid });
     if (artifact === null)
         return null;
-    // Slice 2026-06-28-code-mode-bypass-fix (defect #3): the legacy
-    // `showRequestArtifact` returns the FULL SCOPE (`_runtime/<sid>`)
-    // as `sessionId`, not just the trailing id segment. The canonical
-    // evidence lookup needs only the bare id (`.peaks/_runtime/change/<id>/`).
-    // When the scope starts with `_runtime/`, strip that prefix so the
-    // path resolver builds the right canonical location.
-    let sessionId = artifact.sessionId;
-    if (sessionId.startsWith('_runtime/') || sessionId.startsWith('_runtime\\')) {
-        sessionId = sessionId.replace(/^_runtime[\\/]/, '');
-    }
-    return { path: artifact.path, content: artifact.content, sessionId };
+    // Slice 2026-06-28-code-mode-bypass-fix (defect #3) used to strip a
+    // `_runtime/` prefix here, because `showRequestArtifact` then returned the
+    // FULL SCOPE (`_runtime/<sid>`) as `sessionId`. Repair R5 removed that
+    // round-trip at its source: `readSummary` now builds the summary from the
+    // already-resolved directory and the bare id, so `sessionId` is the bare id
+    // and the prefix strip could never fire. It was removed by repair R7 rather
+    // than left in place as dead code with a comment asserting a behaviour its
+    // callee no longer has — an artifact claiming something the code does not do
+    // is the defect class this line of work exists to remove.
+    return { path: artifact.path, content: artifact.content, sessionId: artifact.sessionId };
 }
 /**
  * Where the CURRENT contract puts one gate's evidence.

package/dist/services/workflow/pipeline-verify-service.d.ts

@@ -5,7 +5,7 @@
  * returns a structured `PipelineVerification` envelope. Type
  * declarations live in `pipeline-verify-types.ts`; private gate
  * helpers (`rdGatesForType`, `qaGatesForType`, `extractState`,
- * `findRequestFile`, the `_runtime/` prefix strip, the RD/QA handoff
+ * `findRequestFile`, the RD/QA handoff
  * state sets, and the RD/QA evidence path probes) live in
  * `pipeline-verify-gate-support.ts`. The re-export shim at the
  * bottom preserves the original public surface so existing import

package/dist/services/workflow/pipeline-verify-service.js

@@ -5,7 +5,7 @@
  * returns a structured `PipelineVerification` envelope. Type
  * declarations live in `pipeline-verify-types.ts`; private gate
  * helpers (`rdGatesForType`, `qaGatesForType`, `extractState`,
- * `findRequestFile`, the `_runtime/` prefix strip, the RD/QA handoff
+ * `findRequestFile`, the RD/QA handoff
  * state sets, and the RD/QA evidence path probes) live in
  * `pipeline-verify-gate-support.ts`. The re-export shim at the
  * bottom preserves the original public surface so existing import
@@ -16,7 +16,7 @@
 import { isRequestType } from '../artifacts/artifact-prerequisites.js';
 import { readSkipState } from './workflow-state-store.js';
 import { getSessionIdCanonical } from '../session/session-manager.js';
-import { listUnpromotedFeedback } from '../feedback/feedback-promotion-service.js';
+import { listPromotionExempt, listUnpromotedFeedback } from '../feedback/feedback-promotion-service.js';
 import { QA_COMPLETE_STATES, RD_QA_HANDOFF_STATES, extractState, findRequestFile, qaGatesForType, rdGatesForType, resolveQaEvidencePaths, resolveRdEvidencePaths } from './pipeline-verify-gate-support.js';
 export async function verifyPipeline(options) {
     const requestType = isRequestType(options.requestType ?? '') ? options.requestType : 'feature';
@@ -178,10 +178,12 @@ export async function verifyPipeline(options) {
     }
     // Slice 002 (v2.15.0) AC-3 — Gate H "feedback-promotion". Scans
     // `.peaks/memory/*.md` for `metadata.type === 'feedback'` entries
-    // without a promotion marker (HTML comment or `.promotion.json`
-    // sidecar). When any unpromoted feedback is found, the gate fails
-    // and the pipeline does not complete until the user promotes via
-    // `peaks feedback promote <memory-file> --layer <A|B|C>`.
+    // that lack a promotion marker (HTML comment or `.promotion.json`
+    // sidecar) OR whose marker is not backed by the layer's artifact
+    // (rid 2026-09-14-gate-h-promotion). When any such feedback is
+    // found, the gate fails and the pipeline does not complete until the
+    // user promotes via `peaks feedback promote <memory-file> --layer
+    // <A|B|C>` — which now produces the artifact, not just the marker.
     //
     // The scan is intentionally non-throwing — a missing or unreadable
     // memory dir is treated as "no feedback found, gate passes" so
@@ -196,14 +198,25 @@ export async function verifyPipeline(options) {
     ];
     try {
         const unpromoted = listUnpromotedFeedback({ projectRoot: options.projectRoot });
+        // rid 2026-09-14-gate-h-promotion (classify slice): memories that declare
+        // themselves out of the gate are reported, never dropped. An exemption the
+        // gate does not show would be indistinguishable from a fixed violation.
+        const exempt = listPromotionExempt({ projectRoot: options.projectRoot });
+        const exemptNote = exempt.length === 0
+            ? ''
+            : `; ${exempt.length} declared not-to-be-promoted: ${exempt.map((e) => `${e.name} (${e.code})`).join('; ')}`;
         if (unpromoted.length === 0) {
             feedbackGates[0].passed = true;
-            feedbackGates[0].detail = `0 unpromoted feedback memories in .peaks/memory/`;
+            feedbackGates[0].detail = `0 unpromoted feedback memories in .peaks/memory/${exemptNote}`;
         }
         else {
-            feedbackGates[0].detail = `${unpromoted.length} unpromoted feedback memor${unpromoted.length === 1 ? 'y' : 'ies'}: ${unpromoted.map((u) => u.name).join(', ')}`;
-            violations.push(`Gate H feedback-promotion FAILED: ${unpromoted.length} feedback memor${unpromoted.length === 1 ? 'y is' : 'ies are'} not yet promoted to an enforcement layer (${unpromoted.map((u) => u.name).join(', ')}). Run \`peaks feedback promote <memory-file> --layer <A|B|C>\` for each. See sops/feedback-promotion-sop.md.`);
-            nextActions.push(`Run \`peaks feedback promote <memory-file> --layer <A|B|C>\` for each unpromoted feedback memory to satisfy Gate H.`);
+            // rid 2026-09-14-gate-h-promotion: the gate no longer passes on a marker
+            // alone. `listUnpromotedFeedback` now also reports markers whose layer
+            // artifact is absent, so `unpromoted` mixes "never promoted" with
+            // "promoted on paper only" — the reason on each entry says which.
+            feedbackGates[0].detail = `${unpromoted.length} feedback memor${unpromoted.length === 1 ? 'y' : 'ies'} without a backed promotion: ${unpromoted.map((u) => `${u.name} (${u.reason})`).join('; ')}${exemptNote}`;
+            violations.push(`Gate H feedback-promotion FAILED: ${unpromoted.length} feedback memor${unpromoted.length === 1 ? 'y is' : 'ies are'} not yet promoted to an enforcement layer with a real artifact (${unpromoted.map((u) => u.name).join(', ')})${exemptNote}. A marker alone does not count: layer A needs a registered SOP manifest, layer B a hook command that runs something named after the rule in .peaks/.claude-settings-template.json, layer C a hard-floor category in src/services/code/mode-gate.ts. Run \`peaks feedback promote <memory-file> --layer <A|B|C>\` for each and read what it reports. See sops/feedback-promotion-sop.md.`);
+            nextActions.push(`Run \`peaks feedback promote <memory-file> --layer <A|B|C>\` for each feedback memory without a backed promotion to satisfy Gate H.`);
         }
     }
     catch {

package/dist/services/workflow/pipeline-verify-types.d.ts

@@ -50,9 +50,11 @@ export type PipelineVerification = {
      * Slice 002 (v2.15.0) AC-3: Gate H "feedback-promotion". Always
      * present (single-element array). Evaluates whether every
      * `metadata.type === 'feedback'` memory in `.peaks/memory/`
-     * carries a promotion marker (comment OR sidecar). Failures
-     * block the `complete` verdict via the `gateH` field below; the
-     * pipeline only completes when every gate in this array passes.
+     * carries a promotion marker (comment OR sidecar) AND whether the
+     * layer that marker claims is actually backed by its artifact
+     * (rid 2026-09-14-gate-h-promotion). Failures block the `complete`
+     * verdict via the `gateH` field below; the pipeline only completes
+     * when every gate in this array passes.
      */
     feedbackPhase?: {
         gates: PipelineGate[];