peaks-loop 4.0.48 → 4.0.50

package/dist/services/capability-audit-service/independent-checker.js

@@ -0,0 +1,140 @@
+// src/services/capability-audit-service/independent-checker.ts
+//
+// The live, credential-free audit scorer.
+//
+// WHY A DETERMINISTIC CHECKER AND NOT AN LLM CALL
+// ----------------------------------------------
+// `publish.yml` is a secretless OIDC trusted-publishing workflow: `id-token:
+// write`, no npm token, and no LLM credential of any kind in the environment.
+// An LLM scorer therefore cannot run in the gate that decides whether a
+// release happens. Adding a long-lived API secret to a secretless pipeline to
+// serve that gate would be a threat-model regression, and an LLM verdict is
+// non-deterministic — the same commit could flip between runs. So the live
+// scorer must be credential-free.
+//
+// WHY IT IS STILL "INDEPENDENT"
+// -----------------------------
+// Independence is a property of the information channel, not of the substrate
+// (RL-5 constrains what the scorer READS: `scorer.reads: evaluation_package_only`
+// — it never requires a model). The scorer this replaces was handed
+// `{baselineJourneyId, guard}` and asked to re-state it; an LLM given that same
+// payload would be exactly as much a rubber stamp. The disease was the payload.
+//
+// This checker answers a question no guard contract can answer, from inputs no
+// guard reads:
+//   - a guard sees only ITSELF, so it cannot report that the observation set was
+//     silently narrowed, or that a frozen row is armed by no contract at all;
+//   - this checker sees the whole frozen claim set AND the whole registry.
+// It reads only the evaluation package — no author reasoning, no session id, no
+// self-praise framing — so RL-5's exclusions hold by construction.
+//
+// WHAT IT DOES NOT COVER (stated, not hidden)
+// -------------------------------------------
+// It does not read `forbiddenChanges` prose, and it cannot judge behaviour
+// beyond what the 15 guard contracts already exercise. Its claim is narrower
+// than "the 15 journeys are intact"; `coverage` in the result discloses exactly
+// how narrow, so `consistent` is never read as more than it is.
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { P0_JOURNEY_IDS } from '../capability-baseline/types.js';
+function finding(code, journeyId, detail) {
+    return { code, journeyId, detail };
+}
+/**
+ * The observed journey set must be exactly the frozen P0 set. `runAllGuards`
+ * aggregates whatever contracts it was handed, so a registry that lost a
+ * journey reports a clean `pass: 14 / fail: 0` — a narrower check that looks
+ * exactly like a green one. Nothing in the guard results can say so; only the
+ * frozen set can.
+ */
+function checkObservationSet(frozen, observed) {
+    const out = [];
+    const counts = new Map();
+    for (const j of observed)
+        counts.set(j, (counts.get(j) ?? 0) + 1);
+    for (const j of frozen) {
+        const n = counts.get(j) ?? 0;
+        if (n === 0)
+            out.push(finding('OBSERVATION_INCOMPLETE', j, `${j} is in the frozen baseline but no guard result was observed for it`));
+        else if (n > 1)
+            out.push(finding('OBSERVATION_INCOMPLETE', j, `${j} produced ${String(n)} guard results; the frozen baseline declares it once`));
+    }
+    for (const j of counts.keys()) {
+        if (!frozen.includes(j))
+            out.push(finding('OBSERVATION_INCOMPLETE', j, `${j} was observed but is not a frozen P0 journey`));
+    }
+    return out;
+}
+/** The frozen claim set itself must be the P0 set, with no duplicate rows. */
+function checkFrozenRows(rows) {
+    const out = [];
+    const seen = new Map();
+    for (const r of rows)
+        seen.set(r.journeyId, (seen.get(r.journeyId) ?? 0) + 1);
+    for (const j of P0_JOURNEY_IDS) {
+        const n = seen.get(j) ?? 0;
+        if (n === 0)
+            out.push(finding('BASELINE_ROW_SET_INVALID', j, `frozen baseline has no row for ${j}`));
+        else if (n > 1)
+            out.push(finding('BASELINE_ROW_SET_INVALID', j, `frozen baseline declares ${j} ${String(n)} times`));
+    }
+    for (const j of seen.keys()) {
+        if (!P0_JOURNEY_IDS.includes(j))
+            out.push(finding('BASELINE_ROW_SET_INVALID', j, `frozen baseline declares ${j}, which is not a P0 journey`));
+    }
+    return out;
+}
+/**
+ * Every `sourceFiles` entry of every frozen row must still exist. The guard
+ * contracts check this too, but only through their own contract — so a
+ * contract rewritten to drop that probe takes the check with it. Reading the
+ * frozen text directly means the binding survives such a rewrite.
+ */
+function checkSourceBindings(projectRoot, rows) {
+    const out = [];
+    for (const row of rows) {
+        for (const f of row.sourceFiles) {
+            if (!existsSync(join(projectRoot, f))) {
+                out.push(finding('SOURCE_FILE_MISSING', row.journeyId, `frozen sourceFiles entry "${f}" is not on disk`));
+            }
+        }
+    }
+    return out;
+}
+function countArmed(rows, contracts) {
+    let armed = 0;
+    for (const row of rows) {
+        for (const inv of row.invariants) {
+            if (contracts.some((c) => c.source.baselineRow === row.journeyId && c.source.invariant === inv))
+                armed += 1;
+        }
+    }
+    return armed;
+}
+/**
+ * Run the credential-free independent evaluation. The verdict is `drifted`
+ * whenever a concrete deviation is observed — this function has no path that
+ * returns `consistent` without having checked.
+ */
+export function runIndependentCheck(input) {
+    const observed = input.guardResults.map((r) => r.journeyId);
+    const findings = [
+        ...checkFrozenRows(input.baselineRows),
+        ...checkObservationSet(input.baselineRows.map((r) => r.journeyId), observed),
+        ...checkSourceBindings(input.projectRoot, input.baselineRows)
+    ];
+    const coverage = {
+        observations: observed.length,
+        observationsExpected: P0_JOURNEY_IDS.length,
+        invariantsFrozen: input.baselineRows.reduce((n, r) => n + r.invariants.length, 0),
+        invariantsArmed: countArmed(input.baselineRows, input.contracts),
+        // Disclosed, not checked: free-text prohibitions cannot be judged
+        // deterministically without turning a keyword scan into a fake verdict.
+        forbiddenChangesUnverified: input.baselineRows.reduce((n, r) => n + r.forbiddenChanges.length, 0)
+    };
+    return {
+        verdict: findings.length === 0 ? 'consistent' : 'drifted',
+        findings,
+        coverage
+    };
+}

package/dist/services/capability-audit-service/index.d.ts

@@ -1,3 +1,5 @@
 export { crossCheck } from './cross-check.js';
+export { runIndependentCheck } from './independent-checker.js';
+export type { IndependentCheckInput } from './independent-checker.js';
 export { isStale } from './staleness.js';
-export type { AuditVerdict, AuditEvidenceKind, AuditDimension, CrossCheck, CapabilityAuditResult } from './types.js';
+export type { AuditVerdict, AuditEvidenceKind, AuditDimension, AuditFinding, AuditFindingCode, AuditCoverage, IndependentCheckResult, CrossCheck, CapabilityAuditResult } from './types.js';

package/dist/services/capability-audit-service/index.js

@@ -1,2 +1,3 @@
 export { crossCheck } from './cross-check.js';
+export { runIndependentCheck } from './independent-checker.js';
 export { isStale } from './staleness.js';

package/dist/services/capability-audit-service/runner.d.ts

@@ -1,21 +1,25 @@
 import type { CapabilityAuditResult } from './types.js';
-import type { JourneyId } from '../capability-baseline/types.js';
-import type { GuardRunResult } from '../capability-guard-runner/types.js';
+import type { CapabilityBaselineRow, JourneyId } from '../capability-baseline/types.js';
+import type { GuardContract, GuardRunResult } from '../capability-guard-runner/types.js';
+/**
+ * `stub` means the "independent" verdict came from a hard-coded response, not
+ * from a separate context. A stub is not an evaluation, so an audit that used
+ * one is marked `degraded` and can never report `consistent`.
+ *
+ * `live` runs the deterministic independent checker: a real separate-context
+ * evaluation that needs no credentials, which is why it is the only kind that
+ * can run inside the secretless OIDC publish gate.
+ */
+export type AuditScorerMode = 'stub' | 'live';
 export interface RunAuditInput {
     readonly projectRoot: string;
     readonly sessionId: string;
     readonly journeyId: JourneyId;
-    readonly llmRunner: {
-        call(system: string, user: string, opts: {
-            maxTokens: number;
-        }): Promise<{
-            output: string;
-            tokens: {
-                input: number;
-                output: number;
-            };
-        }>;
-    };
+    readonly scorerMode: AuditScorerMode;
+    /** The frozen claim set under audit. */
+    readonly baselineRows: ReadonlyArray<CapabilityBaselineRow>;
+    /** The arming witness: which frozen invariants some contract enforces. */
+    readonly contracts: ReadonlyArray<GuardContract>;
     readonly guardSummary: {
         readonly pass: number;
         readonly fail: number;

package/dist/services/capability-audit-service/runner.js

@@ -1,29 +1,87 @@
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { crossCheck } from './cross-check.js';
-const SYSTEM = 'You are an INDEPENDENT audit scorer. Compare the supplied capability baseline to the supplied current behavior summary. Output a single JSON object: {"verdict":"consistent" | "drifted" | "inconclusive"}. No prose.';
+import { runIndependentCheck } from './independent-checker.js';
+function scoreFor(status) {
+    return status === 'pass' ? 1 : status === 'fail' ? 0 : 0.5;
+}
 export async function runAudit(input) {
-    const userPayload = JSON.stringify({ baselineJourneyId: input.journeyId, guard: input.guardSummary });
-    const r = await input.llmRunner.call(SYSTEM, userPayload, { maxTokens: 200 });
-    const { verdict: independentVerdict } = JSON.parse(r.output);
+    const degraded = input.scorerMode === 'stub';
+    // A stub run performs no evaluation, so the checker is not run either — its
+    // result would be misread as an evaluation that happened.
+    const check = degraded
+        ? null
+        : runIndependentCheck({
+            projectRoot: input.projectRoot,
+            baselineRows: input.baselineRows,
+            contracts: input.contracts,
+            guardResults: input.guardSummary.results
+        });
     const xc = crossCheck({
         guardPass: input.guardSummary.pass,
         guardFail: input.guardSummary.fail,
-        independentPass: independentVerdict === 'consistent' ? 1 : 0,
-        independentFail: independentVerdict === 'drifted' ? 1 : 0,
+        // A degraded run has no independent verdict to compare; 0/0 keeps the
+        // cross-check shape without inventing one.
+        independentPass: check?.verdict === 'consistent' ? 1 : 0,
+        independentFail: check?.verdict === 'drifted' ? 1 : 0,
         karpathy: 'skipped'
     });
-    let verdict = independentVerdict;
-    if (xc.guardVsAudit === 'diverge')
+    // S1's rule is unchanged and load-bearing: a run that performed no separate
+    // evaluation can never be `consistent`. S11 adds the live branch. Every
+    // concrete deviation — a failed guard contract, or a finding from the
+    // independent checker — reports `drifted` instead of hiding behind
+    // `inconclusive`. So `inconclusive` is now reachable only when no evaluation
+    // ran at all, which is what it should mean.
+    let verdict = 'consistent';
+    if (degraded)
         verdict = 'inconclusive';
-    const dimensions = [{
+    else if (input.guardSummary.fail > 0)
+        verdict = 'drifted';
+    else if ((check?.findings.length ?? 0) > 0)
+        verdict = 'drifted';
+    // One dimension per journey actually run, scored from the guard result —
+    // previously this was a single row whose score was derived from the stub.
+    const dimensions = input.guardSummary.results.map((g) => {
+        // When the contract fails, include the diff detail in the evidence summary
+        // so the gate step log (and any artifact) carries a real diagnostic
+        // instead of just "workflow-trace → fail". The summary is bounded so a
+        // runaway diff can't bloat every dimension; the contract itself is the
+        // authoritative source.
+        const detail = g.status === 'fail' && g.diff
+            ? ` | ${g.diff.reason}: ${g.diff.after}`.slice(0, 4000)
+            : '';
+        return {
+            journeyId: g.journeyId,
+            consistencyScore: scoreFor(g.status),
+            evidence: [{
+                    kind: 'guard-run',
+                    ref: `capability-guard-runner:${g.journeyId}`,
+                    summary: `${g.contract} → ${g.status}${detail}`
+                }]
+        };
+    });
+    if (dimensions.length === 0) {
+        dimensions.push({
             journeyId: input.journeyId,
             consistencyScore: verdict === 'consistent' ? 1 : verdict === 'drifted' ? 0 : 0.5,
-            evidence: [
-                { kind: 'guard-run', ref: `capability-guard-runner:${input.guardSummary.total}`, summary: `${input.guardSummary.pass} pass / ${input.guardSummary.fail} fail` },
-                { kind: 'independent-eval', ref: 'audit-llm-context', summary: `independent verdict: ${independentVerdict}` }
-            ]
-        }];
+            evidence: [{ kind: 'guard-run', ref: 'capability-guard-runner:0', summary: 'no contract results were supplied' }]
+        });
+    }
+    const independentRef = degraded ? 'audit-independent-checker:stub' : 'audit-independent-checker:deterministic';
+    const first = dimensions[0];
+    dimensions[0] = {
+        ...first,
+        evidence: [
+            ...first.evidence,
+            {
+                kind: 'independent-eval',
+                ref: independentRef,
+                summary: check === null
+                    ? 'degraded: stub scorer (no independent context ran); the verdict was not derived from an evaluation'
+                    : `independent verdict: ${check.verdict}; observations ${String(check.coverage.observations)}/${String(check.coverage.observationsExpected)}; invariants armed ${String(check.coverage.invariantsArmed)}/${String(check.coverage.invariantsFrozen)}; findings: ${check.findings.length === 0 ? 'none' : check.findings.map((f) => `${f.code}(${f.journeyId})`).join(',')}`
+            }
+        ]
+    };
     const auditId = `audit-${Date.now()}-${Math.random().toString(16).slice(2, 8)}`;
     const out = {
         auditId,
@@ -31,7 +89,10 @@ export async function runAudit(input) {
         verdict,
         dimensions,
         crossCheck: xc,
-        requiresUserDecision: verdict === 'inconclusive'
+        requiresUserDecision: verdict === 'inconclusive',
+        degraded,
+        findings: check === null ? null : check.findings,
+        coverage: check === null ? null : check.coverage
     };
     const dir = join(input.projectRoot, '.peaks', '_runtime', input.sessionId, 'capability-audit');
     mkdirSync(dir, { recursive: true });

package/dist/services/capability-audit-service/types.d.ts

@@ -14,6 +14,41 @@ export interface CrossCheck {
     readonly guardVsAudit: 'agree' | 'diverge' | 'partial';
     readonly karpathyVsAudit: 'agree' | 'diverge' | 'partial';
 }
+/**
+ * Why an independent verdict came out `drifted`. Each code names a concrete,
+ * inspectable deviation rather than a summary judgement.
+ */
+export type AuditFindingCode = 
+/** The observed journey set is not the frozen P0 set. */
+'OBSERVATION_INCOMPLETE'
+/** The frozen baseline's own row set is not the P0 set. */
+ | 'BASELINE_ROW_SET_INVALID'
+/** A frozen `sourceFiles` entry no longer exists on disk. */
+ | 'SOURCE_FILE_MISSING';
+export interface AuditFinding {
+    readonly code: AuditFindingCode;
+    readonly journeyId: JourneyId;
+    readonly detail: string;
+}
+/**
+ * How wide the audit's claim actually is. Reported alongside the verdict so
+ * `consistent` is never read as broader than it is: the check verifies the
+ * frozen row set, the observation set and the file bindings — it does not
+ * evaluate `forbiddenChanges` prose, and it judges no behaviour beyond what
+ * the guard contracts already exercise.
+ */
+export interface AuditCoverage {
+    readonly observations: number;
+    readonly observationsExpected: number;
+    readonly invariantsFrozen: number;
+    readonly invariantsArmed: number;
+    readonly forbiddenChangesUnverified: number;
+}
+export interface IndependentCheckResult {
+    readonly verdict: 'consistent' | 'drifted';
+    readonly findings: ReadonlyArray<AuditFinding>;
+    readonly coverage: AuditCoverage;
+}
 export interface CapabilityAuditResult {
     readonly auditId: string;
     readonly auditedAt: string;
@@ -21,4 +56,17 @@ export interface CapabilityAuditResult {
     readonly dimensions: ReadonlyArray<AuditDimension>;
     readonly crossCheck: CrossCheck;
     readonly requiresUserDecision: boolean;
+    /**
+     * True when no separate-context evaluation ran at all — i.e. the scorer was
+     * the stub, not the deterministic independent checker. A degraded audit can
+     * never be `consistent`.
+     */
+    readonly degraded: boolean;
+    /**
+     * The independent checker's findings, in the order it produced them. Empty
+     * on a `consistent` live run; `null` on a degraded run, where no check ran.
+     */
+    readonly findings: ReadonlyArray<AuditFinding> | null;
+    /** How wide this audit's claim is; `null` on a degraded run. */
+    readonly coverage: AuditCoverage | null;
 }

package/dist/services/capability-guard-runner/contracts/J01.js

@@ -1,5 +1,6 @@
 import { execFileSync } from 'node:child_process';
 import { join } from 'node:path';
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
 const FIXTURES = [
     ['make', 'implement a CLI parser'],
     ['make', 'refactor the service'],
@@ -9,9 +10,11 @@ const FIXTURES = [
     ['run', 'execute a workflow']
 ];
 export async function runJ01Contract(ctx) {
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
     const bin = process.env.PEAKS_BIN_OVERRIDE ?? join(ctx.projectRoot, 'bin', 'peaks.js');
-    let allOk = true;
-    let firstFailure = '';
+    const failures = [];
+    let routed = 0;
     for (const [command, input] of FIXTURES) {
         try {
             const stdout = execFileSync('node', [bin, command, input], {
@@ -21,29 +24,25 @@ export async function runJ01Contract(ctx) {
             }).toString('utf8');
             const env = JSON.parse(stdout);
             if (!env.ok) {
-                allOk = false;
-                firstFailure = `${command} ${input}`;
-                break;
+                failures.push(`${command} ${input}: ok=false`);
+            }
+            else if (typeof env.data?.routedSkill === 'string' && env.data.routedSkill.length > 0) {
+                routed += 1;
             }
         }
         catch (e) {
-            allOk = false;
-            firstFailure = `${command} ${input}: ${e.message}`;
-            break;
+            failures.push(`${command} ${input}: ${e.message.slice(0, 120)}`);
         }
     }
-    return allOk
-        ? {
-            journeyId: 'J01',
-            contract: 'envelope-arg-shapes',
-            status: 'pass',
-            artifactPath: 'tests/integration/super-command-routing.test.ts'
-        }
-        : {
-            journeyId: 'J01',
-            contract: 'envelope-arg-shapes',
-            status: 'fail',
-            diff: { before: 'all 6 routing cases ok', after: firstFailure, reason: 'J01#1 broken: super-command routing NL path deviates from frozen baseline' },
-            artifactPath: 'tests/integration/super-command-routing.test.ts'
-        };
+    const result = combineProbes([
+        probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+        probe(failures.length === 0, `all ${String(FIXTURES.length)} NL routing cases return ok (failures: ${failures.join('; ') || 'none'})`),
+        // The invariant is that the SYSTEM picks the skill: a bare ok envelope is
+        // not enough, the answer must name the skill it chose.
+        probe(routed > 0, `the envelope names the routed skill (${String(routed)}/${String(FIXTURES.length)})`)
+    ]);
+    const artifact = row.sourceFiles[2] ?? 'tests/integration/super-command-routing.test.ts';
+    if (result.ok)
+        return pass(ctx, artifact);
+    return fail(ctx, artifact, 'every NL fixture routes through the super-command surface and the envelope names the chosen skill', result.detail, 'J01 invariant broken: super-command routing deviates from the frozen baseline');
 }

package/dist/services/capability-guard-runner/contracts/J02.d.ts

@@ -1,2 +1,2 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
-export declare function runJ02Contract(ctx: GuardContext, projectRoot?: string): Promise<GuardRunResult>;
+export declare function runJ02Contract(ctx: GuardContext): Promise<GuardRunResult>;

package/dist/services/capability-guard-runner/contracts/J02.js

@@ -1,34 +1,120 @@
 import { execFileSync } from 'node:child_process';
-import { mkdtempSync } from 'node:fs';
+import { mkdtempSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { join, resolve } from 'node:path';
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
 const STATES = ['spec-locked', 'implemented', 'qa-handoff', 'handed-off'];
-export async function runJ02Contract(ctx, projectRoot = ctx.projectRoot) {
-    const bin = join(ctx.projectRoot, 'bin', 'peaks.js');
+// Per-child timeout. J02 runs six peaks CLIs in a fresh cwd; on cold CI
+// runners the first invocation pays tsx startup before the resolved file is
+// hot, and any single child that hangs would block the whole guard run until
+// the default node timeout (forever). 60s is comfortable on warm hosts and
+// tight enough that a genuine hang surfaces in the gate step within the
+// publish workflow's per-step budget.
+const CHILD_TIMEOUT_MS = 60_000;
+export async function runJ02Contract(ctx) {
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    // Must be ABSOLUTE: the child runs with `cwd: tmp`, so a relative
+    // `bin/peaks.js` would be resolved against the temp workspace.
+    const bin = resolve(ctx.projectRoot, 'bin', 'peaks.js');
     const tmp = mkdtempSync(join(tmpdir(), 'cbl-J02-'));
-    const ws = execFileSync('node', [bin, 'workspace', 'init', '--project', tmp, '--json'], { cwd: tmp, windowsHide: true }).toString('utf8');
-    const { data: { sessionId } } = JSON.parse(ws);
-    const rid = '2026-08-03-j02-fixture';
-    const initOut = execFileSync('node', [bin, 'request', 'init', '--role', 'rd', '--id', rid, '--project', tmp, '--session-id', sessionId, '--apply', '--json'], { cwd: tmp, windowsHide: true }).toString('utf8');
-    const initEnv = JSON.parse(initOut);
-    // `request init` writes the file as `NNN-<id-slug>.md`. The transition CLI accepts
-    // the file's basename (without .md) as the requestId. Derive it from data.path.
-    const baseName = initEnv.data.path.split(/[\\/]/).pop() ?? '';
-    const requestId = baseName.replace(/\.md$/i, '');
-    let last = '';
-    for (const s of STATES) {
-        const out = execFileSync('node', [bin, 'request', 'transition', requestId, '--role', 'rd', '--state', s,
-            '--project', tmp, '--session-id', sessionId, '--confirm', '--allow-incomplete',
-            '--reason', 'J02 contract fixture', '--json'], { cwd: tmp, windowsHide: true }).toString('utf8');
-        const env = JSON.parse(out);
-        last = env.data.state;
-    }
-    const ok = last === 'handed-off';
-    return {
-        journeyId: 'J02',
-        contract: 'workflow-trace',
-        status: ok ? 'pass' : 'fail',
-        ...(ok ? {} : { diff: { before: 'handed-off', after: last, reason: 'J02#1 broken: RD state machine no longer reaches handed-off' } }),
-        artifactPath: 'tests/integration/business-capability-e2e.test.ts'
+    // Each peaks-CLI invocation in this contract is wrapped so a child that
+    // hangs (or a child that produces no stdout) cannot silently pin the gate
+    // step until CI's job-level timeout fires. `execFileSync` already throws on
+    // non-zero exit; we additionally enforce timeout and surface the actual
+    // stderr in the error so a future failure can be diagnosed without re-running
+    // with a debugger.
+    const run = (args) => {
+        try {
+            const stdout = execFileSync('node', [bin, ...args], {
+                cwd: tmp,
+                windowsHide: true,
+                timeout: CHILD_TIMEOUT_MS,
+                encoding: 'utf8',
+                // The contract spawns peaks CLIs in a temp workspace; on a CI runner
+                // there is no IDE context, so peaks would refuse every `request.*`
+                // command with CALLER_ID_INVALID. Provide a deterministic caller id
+                // tied to the contract name. The contract is the only producer of
+                // this artifact, so the synthetic id cannot collide with anything
+                // real a developer is working on.
+                env: { ...process.env, PEAKS_CALLER_ID: `guard-J02-${ctx.sessionId}` }
+            });
+            return { stdout, stderr: '' };
+        }
+        catch (e) {
+            const err = e;
+            const stderr = typeof err.stderr === 'string'
+                ? err.stderr
+                : Buffer.isBuffer(err.stderr) ? err.stderr.toString('utf8') : '';
+            const stdout = typeof err.stdout === 'string'
+                ? err.stdout
+                : Buffer.isBuffer(err.stdout) ? err.stdout.toString('utf8') : '';
+            // Preserve the original error type/message but attach stderr so the
+            // outer try-catch's `e.message.slice(0, 160)` sees something useful.
+            // Truncate stdout aggressively to keep the audit envelope bounded, but
+            // pick the HEAD and TAIL of the buffer so the leading envelope header
+            // and the trailing error are both visible.
+            const stdoutHead = stdout.slice(0, 600);
+            const stdoutTail = stdout.length > 1200 ? stdout.slice(-400) : '';
+            const stdoutPart = stdoutTail
+                ? `${stdoutHead}...<truncated ${stdout.length - 1000}B>...${stdoutTail}`
+                : stdoutHead;
+            const wrapped = new Error(`${err.message} | stderr=${stderr.slice(0, 400)} | stdout=${stdoutPart}`);
+            wrapped.stdout = stdout;
+            throw wrapped;
+        }
     };
+    try {
+        const ws = run(['workspace', 'init', '--project', tmp, '--json']);
+        const { data: { sessionId } } = JSON.parse(ws.stdout);
+        const rid = '2026-08-03-j02-fixture';
+        const initOut = run(['request', 'init', '--role', 'rd', '--id', rid, '--project', tmp, '--session-id', sessionId, '--apply', '--json']);
+        const initEnv = JSON.parse(initOut.stdout);
+        // `request init` writes the file as `NNN-<id-slug>.md`. The transition CLI accepts
+        // the file's basename (without .md) as the requestId. Derive it from data.path.
+        const baseName = initEnv.data.path.split(/[\\/]/).pop() ?? '';
+        const requestId = baseName.replace(/\.md$/i, '');
+        const transition = (state, extra) => run([
+            'request', 'transition', requestId, '--role', 'rd', '--state', state,
+            '--project', tmp, '--session-id', sessionId, '--confirm',
+            '--reason', 'J02 contract fixture', ...extra, '--json'
+        ]).stdout;
+        // Hard-gate probe, run FIRST: from the freshly initialised state, jumping
+        // straight to the terminal state skips every intermediate gate and must not
+        // be accepted without the explicit incomplete-work escape hatch. Doing this
+        // before the legal walk is what makes it a skip (from `qa-handoff` the move
+        // to `handed-off` is legal and proves nothing).
+        let gateSkipRefused = false;
+        let skipError = 'not attempted';
+        try {
+            transition('handed-off', []);
+            skipError = 'transition was accepted';
+        }
+        catch (e) {
+            gateSkipRefused = true;
+            skipError = e.message.slice(0, 160);
+        }
+        let last = '';
+        try {
+            for (const s of STATES) {
+                const env = JSON.parse(transition(s, ['--allow-incomplete']));
+                last = env.data.state;
+            }
+        }
+        catch (e) {
+            last = `error: ${e.message.slice(0, 160)}`;
+        }
+        const result = combineProbes([
+            probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+            probe(gateSkipRefused, `an incomplete jump to handed-off is refused (${skipError})`),
+            probe(last === 'handed-off', `the RD state machine reaches handed-off (saw ${last})`)
+        ]);
+        const artifact = row.sourceFiles[3] ?? 'tests/integration/job-e2e.test.ts';
+        if (result.ok)
+            return pass(ctx, artifact);
+        return fail(ctx, artifact, 'every hard gate is enforced and the RD state machine still reaches handed-off', result.detail, 'J02 invariant broken: the RD state machine or its hard-gate enforcement changed');
+    }
+    finally {
+        rmSync(tmp, { recursive: true, force: true });
+    }
 }

package/dist/services/capability-guard-runner/contracts/J03.d.ts

@@ -1,2 +1,15 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * Behavioural probe of the "no silent-catch / fake-green reintroduced"
+ * invariant.
+ *
+ * The previous version read `final-review-types.ts` and asserted it contained
+ * four dimension strings — a file whose own name is `final-review`, so the
+ * check restated its filename.
+ *
+ * Here the repository's own AST guard (`scripts/lint/silent-warning-detector.mjs`)
+ * is executed and its per-rule violation counts are compared against the frozen
+ * ceilings. A newly swallowed `catch` in `src/**` raises a count and reddens the
+ * journey.
+ */
 export declare function runJ03Contract(ctx: GuardContext): Promise<GuardRunResult>;