peaks-loop 4.0.48 → 4.0.50

package/dist/services/capability-guard-runner/contracts/J03.js

@@ -1,24 +1,75 @@
-// src/services/capability-guard-runner/contracts/J03.ts
-import { readFileSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
 import { join } from 'node:path';
-const REQUIRED_DIMENSIONS = [
-    'functional-completeness',
-    'problem-resolution',
-    'no-new-bugs',
-    'existing-functionality-intact'
-];
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+const DETECTOR = ['scripts', 'lint', 'silent-warning-detector.mjs'];
+/**
+ * Violation ceilings measured on the frozen tree when this contract was
+ * written (2026-09-15, 767 files scanned). They are a RATCHET, not a target:
+ * the invariant is "no silent-catch or fake-green pattern is REINTRODUCED", so
+ * the check is that the count does not grow. Fixing violations lowers the
+ * ceiling in the same slice that fixes them.
+ */
+const CEILING = {
+    'catch-return-null': 41,
+    'empty-catch': 59
+};
+function parseCounts(stdout) {
+    const line = /\[silent-warning-detector\] summary: (.+)$/m.exec(stdout);
+    if (line === null)
+        return null;
+    const counts = {};
+    for (const pair of line[1].split(',')) {
+        const m = /^\s*([a-z-]+)=(\d+)\s*$/.exec(pair);
+        if (m !== null)
+            counts[m[1]] = Number(m[2]);
+    }
+    return counts;
+}
+/**
+ * Behavioural probe of the "no silent-catch / fake-green reintroduced"
+ * invariant.
+ *
+ * The previous version read `final-review-types.ts` and asserted it contained
+ * four dimension strings — a file whose own name is `final-review`, so the
+ * check restated its filename.
+ *
+ * Here the repository's own AST guard (`scripts/lint/silent-warning-detector.mjs`)
+ * is executed and its per-rule violation counts are compared against the frozen
+ * ceilings. A newly swallowed `catch` in `src/**` raises a count and reddens the
+ * journey.
+ */
 export async function runJ03Contract(ctx) {
-    // Static check: the 4-dim final-review type module MUST still export those 4 dimension strings.
-    // This is a contract against accidental removal, not a runtime test of an LLM.
-    const typesPath = join(ctx.projectRoot, 'src', 'services', 'final-review', 'final-review-types.ts');
-    const src = readFileSync(typesPath, 'utf8');
-    const missing = REQUIRED_DIMENSIONS.filter((d) => !src.includes(`'${d}'`));
-    const ok = missing.length === 0;
-    return {
-        journeyId: 'J03',
-        contract: 'workflow-trace',
-        status: ok ? 'pass' : 'fail',
-        ...(ok ? {} : { diff: { before: REQUIRED_DIMENSIONS.join(','), after: missing.join(','), reason: `J03#1 broken: missing dimensions ${missing.join(',')}` } }),
-        artifactPath: 'src/services/final-review/final-review-types.ts'
-    };
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const detectorPath = join(ctx.projectRoot, ...DETECTOR);
+    const detectorPresent = existsSync(detectorPath);
+    const run = detectorPresent
+        ? spawnSync('node', [detectorPath], { cwd: ctx.projectRoot, encoding: 'utf8', windowsHide: true })
+        : null;
+    const stdout = run?.stdout ?? '';
+    const counts = parseCounts(stdout);
+    const scanned = /scanned (\d+) files/.exec(stdout);
+    const grew = [];
+    const missingRules = [];
+    if (counts !== null) {
+        for (const rule of Object.keys(CEILING)) {
+            if (counts[rule] === undefined)
+                missingRules.push(rule);
+            else if (counts[rule] > CEILING[rule])
+                grew.push(`${rule}: ${String(counts[rule])} > ${String(CEILING[rule])}`);
+        }
+    }
+    const result = combineProbes([
+        probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+        probe(detectorPresent, `the repository AST guard is present (${detectorPath})`),
+        probe(scanned !== null && Number(scanned[1]) > 0, `the AST guard scanned files (${scanned?.[1] ?? 'none'})`),
+        probe(counts !== null, `the AST guard reported per-rule counts (${counts === null ? 'unparseable' : JSON.stringify(counts)})`),
+        probe(missingRules.length === 0, `every ratcheted rule was reported (missing: ${missingRules.join(',') || 'none'})`),
+        probe(grew.length === 0, `no silent-catch rule count grew past its ceiling (${grew.join('; ') || 'none'})`)
+    ]);
+    const artifact = row.sourceFiles[1] ?? 'src/services/final-review/final-review-service.ts';
+    if (result.ok)
+        return pass(ctx, artifact);
+    return fail(ctx, artifact, `silent-catch violation counts stay at or below ${JSON.stringify(CEILING)}`, result.detail, 'J03 invariant broken: a silent-catch or fake-green pattern was reintroduced under src/**');
 }

package/dist/services/capability-guard-runner/contracts/J04.d.ts

@@ -1,2 +1,8 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * Behavioural probe: drive `auditGoal()` with a complete and an incomplete
+ * payload and assert it accepts exactly one of them. Counting `dimension`
+ * occurrences in the source would have passed even if the six-element guard
+ * were replaced by a comment.
+ */
 export declare function runJ04Contract(ctx: GuardContext): Promise<GuardRunResult>;

package/dist/services/capability-guard-runner/contracts/J04.js

@@ -1,42 +1,75 @@
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { auditGoal, IncompleteAuditError } from '../../audit/audit-goal-service.js';
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+/** The six dimensions the frozen baseline names, in the baseline's own order. */
+const SIX_DIMENSIONS = [
+    'correctness', 'completeness', 'scope', 'risks', 'alternatives', 'constraints'
+];
+function runnerReturning(output) {
+    return { call: async () => ({ output, tokens: { input: 1, output: 1 } }) };
+}
+function envelope(dimensions, severity = 'info') {
+    return JSON.stringify({
+        summary: 's',
+        audit: dimensions.map((dimension) => ({ dimension, finding: 'f', severity })),
+        proposedGoal: 'g',
+        successCriteria: ['c'],
+        roughEffort: 'small',
+        confidence: 'high',
+        rationale: 'r'
+    });
+}
+/**
+ * Behavioural probe: drive `auditGoal()` with a complete and an incomplete
+ * payload and assert it accepts exactly one of them. Counting `dimension`
+ * occurrences in the source would have passed even if the six-element guard
+ * were replaced by a comment.
+ */
 export async function runJ04Contract(ctx) {
-    const bin = join(ctx.projectRoot, 'bin', 'peaks.js');
-    const tmp = mkdtempSync(join(tmpdir(), 'cbl-J04-'));
-    // Probe: `peaks audit goal` must be a registered subcommand (returns a help-like response or a structured envelope).
-    let helpOk = false;
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    let completeAccepted = false;
+    let completeCount = -1;
     try {
-        const stdout = execFileSync('node', [bin, 'audit', 'goal', '--help'], {
-            cwd: ctx.projectRoot,
-            env: { ...process.env, PEAKS_CALLER_ID: `guard-J04-${ctx.sessionId}` },
-            windowsHide: true
-        }).toString('utf8');
-        helpOk = stdout.length > 0 && !stdout.includes('unknown command');
+        const out = await auditGoal({ need: 'n' }, runnerReturning(envelope(SIX_DIMENSIONS)));
+        completeAccepted = true;
+        completeCount = out.audit.length;
     }
     catch {
-        helpOk = false;
+        completeAccepted = false;
     }
-    // Probe: `peaks audit goal` without a goal must not silently succeed.
-    let rejectsEmpty = false;
+    let fiveRejected = false;
+    let rejectName = 'none';
     try {
-        execFileSync('node', [bin, 'audit', 'goal', '--project', tmp, '--json'], {
-            cwd: ctx.projectRoot,
-            env: { ...process.env, PEAKS_CALLER_ID: `guard-J04-${ctx.sessionId}` },
-            stdio: ['ignore', 'pipe', 'pipe'],
-            windowsHide: true
-        });
+        await auditGoal({ need: 'n' }, runnerReturning(envelope(SIX_DIMENSIONS.slice(0, 5))));
     }
     catch (e) {
-        rejectsEmpty = true;
+        fiveRejected = true;
+        rejectName = e.name;
+    }
+    // Any one dimension dropped must be refused — not just the last one.
+    let eachDropRejected = true;
+    const accepted = new Set();
+    for (const dropped of SIX_DIMENSIONS) {
+        const dims = SIX_DIMENSIONS.filter((d) => d !== dropped);
+        try {
+            await auditGoal({ need: 'n' }, runnerReturning(envelope(dims)));
+            eachDropRejected = false;
+            accepted.add(dropped);
+        }
+        catch {
+            /* expected */
+        }
     }
-    const ok = helpOk && rejectsEmpty;
-    return {
-        journeyId: 'J04',
-        contract: 'hook-assertion',
-        status: ok ? 'pass' : 'fail',
-        ...(ok ? {} : { diff: { before: 'audit goal is registered and rejects empty input', after: `helpOk=${helpOk} rejectsEmpty=${rejectsEmpty}`, reason: 'J04#1 broken: audit goal binding is bypassed or missing' } }),
-        artifactPath: 'src/services/audit/audit-goal-service.ts'
-    };
+    const result = combineProbes([
+        probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+        probe(completeAccepted, 'six-dimension audit is accepted'),
+        probe(completeCount === 6, `accepted audit carries exactly 6 dimensions (saw ${completeCount})`),
+        probe(fiveRejected, 'five-dimension audit is rejected'),
+        probe(rejectName === 'IncompleteAuditError', `rejection is IncompleteAuditError (saw ${rejectName}, ${IncompleteAuditError.name})`),
+        probe(eachDropRejected, `dropping any single dimension is rejected (accepted: ${[...accepted].join(',') || 'none'})`)
+    ]);
+    const artifact = row.sourceFiles[0] ?? 'src/services/audit/audit-goal-service.ts';
+    if (result.ok)
+        return pass(ctx, artifact);
+    return fail(ctx, artifact, 'auditGoal() accepts a complete six-dimension payload and rejects any five-dimension payload', result.detail, 'J04 invariant broken: the audit does not cover exactly six dimensions');
 }

package/dist/services/capability-guard-runner/contracts/J05.js

@@ -1,21 +1,123 @@
-import { readFileSync } from 'node:fs';
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-const REQUIRED_FRAGMENTS = [
-    "'functional-completeness'",
-    "'problem-resolution'",
-    "'no-new-bugs'",
-    "'existing-functionality-intact'"
+import { IncompleteFinalReviewError, MAX_EVIDENCE_BYTES_PER_FILE, outputBudgetForEvidence, prepareFinalReview, resolveOutputBudget, undeliverableDimensions } from '../../final-review/final-review-service.js';
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+/** The four dimensions the frozen baseline names. The 5th is NOT one of them. */
+const FOUR_DIMENSIONS = [
+    'functional-completeness', 'problem-resolution', 'no-new-bugs', 'existing-functionality-intact'
 ];
-export async function runJ05Contract(ctx) {
-    const servicePath = join(ctx.projectRoot, 'src', 'services', 'final-review', 'final-review-service.ts');
-    const src = readFileSync(servicePath, 'utf8');
-    const missing = REQUIRED_FRAGMENTS.filter((f) => !src.includes(f));
-    const ok = missing.length === 0;
+const FIFTH_DIMENSION = 'capability-consistency';
+/**
+ * One oversized, omitted source that backs `dimension`. `omitted` + over-cap +
+ * zero delivered bytes is the structural case: nothing can ever deliver it.
+ */
+function undeliverableSource(dimension, totalBytes) {
     return {
-        journeyId: 'J05',
-        contract: 'workflow-trace',
-        status: ok ? 'pass' : 'fail',
-        ...(ok ? {} : { diff: { before: 'all 4 dim strings present in final-review-service.ts', after: missing.join(','), reason: `J05#1 broken: missing fragments ${missing.join(',')}` } }),
-        artifactPath: 'src/services/final-review/final-review-service.ts'
+        source: {
+            key: `k-${dimension}`,
+            label: dimension,
+            segments: [`${dimension}.md`],
+            supports: [dimension],
+            delivery: { kind: 'whole' }
+        },
+        relativePath: `${dimension}.md`,
+        absolutePath: `/nonexistent/${dimension}.md`,
+        status: 'omitted',
+        totalBytes,
+        includedBytes: 0,
+        content: '',
+        reason: 'over-cap'
     };
 }
+function reviewJson(dimensions) {
+    return JSON.stringify({
+        rid: 'J05-fixture',
+        generatedAt: new Date(0).toISOString(),
+        dimensions: dimensions.map((dimension) => ({
+            dimension,
+            verdict: 'pass',
+            summary: 's',
+            evidence: [],
+            confidence: 'high'
+        })),
+        overallSummary: 's',
+        allPass: true,
+        needsAttention: []
+    });
+}
+function runnerReturning(output) {
+    return { call: async () => ({ output, tokens: { input: 1, output: 1024 } }) };
+}
+/**
+ * Drive the real 4-dimension gate: a reply covering three of four dimensions
+ * must be refused, a reply covering all four must be accepted. Reading the
+ * four strings out of `final-review-service.ts` proved only that the literals
+ * were still typed somewhere in the file.
+ */
+async function probePrepareFinalReview() {
+    const root = mkdtempSync(join(tmpdir(), 'cbl-J05-'));
+    try {
+        const sessionId = 'guard-J05';
+        mkdirSync(join(root, '.peaks', '_runtime', sessionId, 'audit-goal'), { recursive: true });
+        writeFileSync(join(root, '.peaks', '_runtime', sessionId, 'audit-goal', 'J05-fixture.json'), JSON.stringify({ successCriteria: ['c'] }));
+        const opts = { projectRoot: root, sessionId };
+        let rejected = false;
+        let rejectName = 'none';
+        try {
+            await prepareFinalReview('J05-fixture', { ...opts, llmRunner: runnerReturning(reviewJson(FOUR_DIMENSIONS.slice(0, 3))) });
+        }
+        catch (e) {
+            rejected = e.name === IncompleteFinalReviewError.name;
+            rejectName = e.name;
+        }
+        let accepted = false;
+        let acceptError = '';
+        try {
+            const out = await prepareFinalReview('J05-fixture', { ...opts, llmRunner: runnerReturning(reviewJson(FOUR_DIMENSIONS)) });
+            accepted = out.dimensions.length === 4;
+        }
+        catch (e) {
+            acceptError = `${e.name}: ${e.message.slice(0, 160)}`;
+        }
+        return {
+            rejected,
+            accepted,
+            detail: `three-dimension reply rejected=${String(rejected)} (${rejectName}); four-dimension reply accepted=${String(accepted)}${acceptError ? ` [${acceptError}]` : ''}`
+        };
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+}
+export async function runJ05Contract(ctx) {
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const prepared = await probePrepareFinalReview();
+    const oversized = FOUR_DIMENSIONS.map((d) => undeliverableSource(d, MAX_EVIDENCE_BYTES_PER_FILE + 1000));
+    const reported = undeliverableDimensions(oversized).map((r) => r.dimension);
+    const fifthOnly = undeliverableDimensions([undeliverableSource(FIFTH_DIMENSION, MAX_EVIDENCE_BYTES_PER_FILE + 1000)]);
+    const floor = outputBudgetForEvidence(0);
+    const ceiling = outputBudgetForEvidence(Number.MAX_SAFE_INTEGER);
+    let badOverrideThrows = false;
+    try {
+        resolveOutputBudget(0, { PEAKS_FINAL_REVIEW_MAX_OUTPUT_TOKENS: 'abc' });
+    }
+    catch {
+        badOverrideThrows = true;
+    }
+    const result = combineProbes([
+        probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+        probe(prepared.rejected, `a three-dimension review is refused (${prepared.detail})`),
+        probe(prepared.accepted, `a four-dimension review is accepted (${prepared.detail})`),
+        probe(reported.length === 4 && FOUR_DIMENSIONS.every((d) => reported.includes(d)), `the canonical dimension set is exactly the four baseline dimensions (reported: ${reported.join(',') || 'none'})`),
+        probe(fifthOnly.length === 0, `the fifth dimension is not part of the required set (reported: ${fifthOnly.length})`),
+        probe(MAX_EVIDENCE_BYTES_PER_FILE === 10240, `per-file evidence cap divides the total by four (${String(MAX_EVIDENCE_BYTES_PER_FILE)})`),
+        probe(floor === 15288 && ceiling === 32000, `output budget is clamped on both ends (${String(floor)} / ${String(ceiling)})`),
+        probe(badOverrideThrows, 'a non-integer budget override throws instead of falling back silently')
+    ]);
+    const artifact = row.sourceFiles[0] ?? 'src/services/final-review/final-review-service.ts';
+    if (result.ok)
+        return pass(ctx, artifact);
+    return fail(ctx, artifact, 'every final review contains exactly four dimensions, and ambiguous ones never auto-pass', result.detail, 'J05 invariant broken: the final review no longer enforces exactly four dimensions');
+}

package/dist/services/capability-guard-runner/contracts/J06.d.ts

@@ -1,2 +1,16 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * Behavioural probe for "the resume option always identifies the DEEPEST
+ * completed gate".
+ *
+ * The load-bearing part is that the SAME fixture is walked from shallow to
+ * deep: with only a PRD request the classifier must stop at `rd-planning`;
+ * the moment a deeper RD `qa-handoff` request appears (with its review
+ * artifacts) the point must move to `qa-validation`; adding the txt handoff
+ * must end the workflow. A classifier that returned a constant point, or that
+ * looked at file existence alone, cannot track that progression.
+ *
+ * The old check asserted that a file named `session-resume-service.ts` exists
+ * and contains the word "resume" — which the filename already guarantees.
+ */
 export declare function runJ06Contract(ctx: GuardContext): Promise<GuardRunResult>;

package/dist/services/capability-guard-runner/contracts/J06.js

@@ -1,43 +1,61 @@
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-// v2: existence is the primary check; the single fragment is best-effort.
-// v1 required 3 strict fragments (deepestGate / resume / etc.) and was too strict for
-// 4.0.8 — the actual resume service uses camelCase variants and lives under session/.
-const CANDIDATE_FILES = [
-    'src/services/resume/resume-service.ts',
-    'src/services/resume/resume-types.ts',
-    'src/services/session/session-resume-service.ts',
-    'src/services/session/session-checkpoint-service.ts'
-];
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { classifyResume } from '../../skill/resume-detector.js';
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+const SESSION_ID = '2026-09-15-guard-j06';
+function write(sessionDir, relative, body) {
+    const abs = join(sessionDir, relative);
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(abs, body);
+}
+function request(body) {
+    return `# request\n\n## Status\n\n- state: ${body}\n`;
+}
+/**
+ * Behavioural probe for "the resume option always identifies the DEEPEST
+ * completed gate".
+ *
+ * The load-bearing part is that the SAME fixture is walked from shallow to
+ * deep: with only a PRD request the classifier must stop at `rd-planning`;
+ * the moment a deeper RD `qa-handoff` request appears (with its review
+ * artifacts) the point must move to `qa-validation`; adding the txt handoff
+ * must end the workflow. A classifier that returned a constant point, or that
+ * looked at file existence alone, cannot track that progression.
+ *
+ * The old check asserted that a file named `session-resume-service.ts` exists
+ * and contains the word "resume" — which the filename already guarantees.
+ */
 export async function runJ06Contract(ctx) {
-    const existing = CANDIDATE_FILES.filter((f) => existsSync(join(ctx.projectRoot, f)));
-    if (existing.length === 0) {
-        return {
-            journeyId: 'J06',
-            contract: 'workflow-trace',
-            status: 'fail',
-            diff: { before: 'a resume service file exists', after: 'none of the candidates found', reason: 'J06#1 broken: no resume service file is present' },
-            artifactPath: 'src/services/resume/'
-        };
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const root = mkdtempSync(join(tmpdir(), 'cbl-J06-'));
+    const peaksRoot = join(root, '_runtime');
+    const sessionDir = join(peaksRoot, SESSION_ID);
+    mkdirSync(sessionDir, { recursive: true });
+    try {
+        write(sessionDir, 'prd/requests/001-shallow.md', request('handed-off'));
+        const shallow = classifyResume(SESSION_ID, peaksRoot);
+        // `ridOf()` strips the `NNN-` index prefix, so the review artifacts are
+        // keyed by `deeper`, not `001-deeper`.
+        write(sessionDir, 'rd/requests/001-deeper.md', request('qa-handoff'));
+        write(sessionDir, 'rd/code-review-deeper.md', '# code review\n');
+        write(sessionDir, 'audit/security-deeper.md', '# security\n');
+        const deeper = classifyResume(SESSION_ID, peaksRoot);
+        write(sessionDir, 'txt/handoff.md', '# handoff\n');
+        const done = classifyResume(SESSION_ID, peaksRoot);
+        const result = combineProbes([
+            probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+            probe(shallow.kind === 'resume' && shallow.point === 'rd-planning', `shallow fixture resumes at rd-planning (saw kind=${shallow.kind} point=${String(shallow.point)})`),
+            probe(deeper.kind === 'resume' && deeper.point === 'qa-validation', `adding an RD qa-handoff request moves the point DEEPER to qa-validation (saw kind=${deeper.kind} point=${String(deeper.point)})`),
+            probe(done.kind === 'complete', `adding txt/handoff.md marks the workflow complete (saw kind=${done.kind} point=${String(done.point)})`)
+        ]);
+        const artifact = row.sourceFiles[0] ?? 'src/services/skill/resume-detector.ts';
+        if (result.ok)
+            return pass(ctx, artifact);
+        return fail(ctx, artifact, 'resume identifies the deepest completed gate (rd-planning → qa-validation → complete)', result.detail, 'J06 invariant broken: resume no longer tracks the deepest completed gate');
     }
-    // Soft check: at least one existing file mentions "resume".
-    const mentionsResume = existing.some((f) => {
-        const src = readFileSync(join(ctx.projectRoot, f), 'utf8');
-        return src.toLowerCase().includes('resume');
-    });
-    if (!mentionsResume) {
-        return {
-            journeyId: 'J06',
-            contract: 'workflow-trace',
-            status: 'fail',
-            diff: { before: 'resume service files mention "resume"', after: 'none mention resume', reason: 'J06#1 broken: resume service files do not reference the resume concept' },
-            artifactPath: existing[0]
-        };
+    finally {
+        rmSync(root, { recursive: true, force: true });
     }
-    return {
-        journeyId: 'J06',
-        contract: 'workflow-trace',
-        status: 'pass',
-        artifactPath: existing[0]
-    };
 }

package/dist/services/capability-guard-runner/contracts/J07.d.ts

@@ -1,2 +1,11 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * Behavioural probe of the (mtime, sha256) gate.
+ *
+ * A cache entry is written for a passing test, then the file's CONTENT is
+ * changed while its mtime is restored to the original value. If the gate ever
+ * degraded to an mtime-only (or filename-only) check, the cache would report a
+ * hit for a file whose bytes changed — exactly the fake-green the invariant
+ * forbids. The mtime-only and status gates are probed the same way.
+ */
 export declare function runJ07Contract(ctx: GuardContext): Promise<GuardRunResult>;

package/dist/services/capability-guard-runner/contracts/J07.js

@@ -1,54 +1,83 @@
-import { execFileSync } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-// v2: existence-of-CLI + source-contains-vitest, not actual invocation.
-// v1 failed with `spawn vitest ENOENT` because the test runner spawns a child vitest
-// that needs `pnpm`/PATH configured; the test fixture doesn't have that. A dry-run
-// probe is enough to prove the `peaks test` subcommand is registered and the runner
-// is wired to vitest, without actually executing a vitest child process.
-const TEST_COMMAND_FILES = [
-    'src/cli/commands/test-commands.ts',
-    'src/services/test/',
-    'src/services/test-runner/'
-];
-export async function runJ07Contract(ctx) {
-    // 1. CLI probe: `peaks test --help` must produce non-empty output.
-    let helpOk = false;
+import { TEST_CACHE_DIR, isCacheable, mtimeOfFile, readTestCache, recordTestResult, sha256OfFile, testCacheDir, writeTestCache } from '../../test-cache/test-cache-service.js';
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+const TEST_NAME = 'fingerprint probe';
+/** Highest vitest major the frozen baseline allows ("MUST NOT be locked at 5.x"). */
+const MAX_VITEST_MAJOR = 4;
+function vitestMajor(projectRoot) {
     try {
-        const bin = join(ctx.projectRoot, 'bin', 'peaks.js');
-        const out = execFileSync('node', [bin, 'test', '--help'], {
-            cwd: ctx.projectRoot,
-            env: { ...process.env, PEAKS_CALLER_ID: `guard-J07-${ctx.sessionId}` },
-            stdio: ['ignore', 'pipe', 'pipe'],
-            windowsHide: true
-        }).toString('utf8');
-        helpOk = out.length > 0 && !out.includes('unknown command');
+        const pkg = JSON.parse(readFileSync(join(projectRoot, 'package.json'), 'utf8'));
+        const raw = pkg.devDependencies?.['vitest'] ?? pkg.dependencies?.['vitest'];
+        if (typeof raw !== 'string')
+            return null;
+        const major = /(\d+)/.exec(raw);
+        return major === null ? null : Number(major[1]);
     }
     catch {
-        helpOk = false;
+        return null;
+    }
+}
+/**
+ * Behavioural probe of the (mtime, sha256) gate.
+ *
+ * A cache entry is written for a passing test, then the file's CONTENT is
+ * changed while its mtime is restored to the original value. If the gate ever
+ * degraded to an mtime-only (or filename-only) check, the cache would report a
+ * hit for a file whose bytes changed — exactly the fake-green the invariant
+ * forbids. The mtime-only and status gates are probed the same way.
+ */
+export async function runJ07Contract(ctx) {
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const root = mkdtempSync(join(tmpdir(), 'cbl-J07-'));
+    const file = join(root, 'probe.test.ts');
+    try {
+        writeFileSync(file, 'export const a = 1;\n');
+        recordTestResult(root, file, 'vitest', {
+            testName: TEST_NAME,
+            status: 'passed',
+            durationMs: 1,
+            lastRun: new Date().toISOString()
+        });
+        const baseline = isCacheable(root, file, TEST_NAME);
+        const cached = readTestCache(root, file);
+        // Gate 1, isolated: the file's bytes change but the recorded mtime is
+        // up-to-date, so ONLY the sha check can catch it. If the gate degraded to
+        // an mtime-only check this reports a hit for a file nobody verified.
+        writeFileSync(file, 'export const a = 2;\n');
+        writeTestCache(root, { ...cached, fileMtime: mtimeOfFile(file) });
+        const afterSilentEdit = isCacheable(root, file, TEST_NAME);
+        // Gate 2, isolated: the sha is up-to-date but the recorded mtime is stale.
+        writeTestCache(root, { ...cached, fileSha256: sha256OfFile(file), fileMtime: cached.fileMtime - 5_000 });
+        const afterTouch = isCacheable(root, file, TEST_NAME);
+        // A non-passing status must never be served as a hit.
+        recordTestResult(root, file, 'vitest', {
+            testName: 'skipped probe',
+            status: 'skipped',
+            durationMs: 0,
+            lastRun: new Date().toISOString()
+        });
+        const skipped = isCacheable(root, file, 'skipped probe');
+        const unknown = isCacheable(root, file, 'never recorded');
+        const major = vitestMajor(ctx.projectRoot);
+        const result = combineProbes([
+            probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+            probe(baseline.hit, `an unchanged passing test is a cache hit (reason=${String(baseline.reason)})`),
+            probe(!afterSilentEdit.hit && afterSilentEdit.reason === 'sha-changed', `a same-mtime content edit is NOT a hit (hit=${String(afterSilentEdit.hit)} reason=${String(afterSilentEdit.reason)})`),
+            probe(!afterTouch.hit && afterTouch.reason === 'mtime-changed', `a touched file is NOT a hit (hit=${String(afterTouch.hit)} reason=${String(afterTouch.reason)})`),
+            probe(!skipped.hit && skipped.reason === 'previous-skipped', `a previously skipped test is NOT a hit (hit=${String(skipped.hit)} reason=${String(skipped.reason)})`),
+            probe(!unknown.hit && unknown.reason === 'no-cache', `an unrecorded test is NOT a hit (reason=${String(unknown.reason)})`),
+            probe(testCacheDir(ctx.projectRoot).replace(/\\/g, '/').endsWith(`.peaks/_runtime/${TEST_CACHE_DIR}`), `the cache writes under .peaks/_runtime/${TEST_CACHE_DIR} (got ${testCacheDir(ctx.projectRoot)})`),
+            probe(major !== null && major <= MAX_VITEST_MAJOR, `vitest major is <= ${String(MAX_VITEST_MAJOR)} (saw ${String(major)})`)
+        ]);
+        const artifact = row.sourceFiles[1] ?? 'src/services/test-cache/test-cache-service.ts';
+        if (result.ok)
+            return pass(ctx, artifact);
+        return fail(ctx, artifact, 'the per-test fingerprint cache only serves a hit for a file whose mtime AND sha256 are unchanged and whose last status passed', result.detail, 'J07 invariant broken: the fingerprint cache can return passed for an unverified file');
     }
-    // 2. Source probe: at least one test command file references vitest.
-    const sourceMentionsVitest = TEST_COMMAND_FILES.some((f) => {
-        const abs = join(ctx.projectRoot, f);
-        if (!existsSync(abs))
-            return false;
-        if (existsSync(abs) && readFileSync(abs, 'utf8').includes('vitest'))
-            return true;
-        return false;
-    });
-    // 3. package.json probe: vitest is in dependencies.
-    const pkgPath = join(ctx.projectRoot, 'package.json');
-    let pkgHasVitest = false;
-    if (existsSync(pkgPath)) {
-        const pkg = readFileSync(pkgPath, 'utf8');
-        pkgHasVitest = /"vitest"\s*:/i.test(pkg);
+    finally {
+        rmSync(root, { recursive: true, force: true });
     }
-    const ok = helpOk && sourceMentionsVitest && pkgHasVitest;
-    return {
-        journeyId: 'J07',
-        contract: 'cli-output-golden',
-        status: ok ? 'pass' : 'fail',
-        ...(ok ? {} : { diff: { before: 'peaks test --help works, test commands reference vitest, package.json has vitest', after: `helpOk=${helpOk} sourceMentionsVitest=${sourceMentionsVitest} pkgHasVitest=${pkgHasVitest}`, reason: 'J07#1 broken: peaks test does not delegate to vitest' } }),
-        artifactPath: 'src/cli/commands/test-commands.ts'
-    };
 }

package/dist/services/capability-guard-runner/contracts/J08.d.ts

@@ -1,2 +1,13 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * Behavioural probe of the crystallization gate.
+ *
+ * Before this the contract only asserted that one of three candidate files
+ * exists and mentions "crystalliz"/"sediment"/"promot" — the file it found is
+ * named `crystallization-service.ts`, so the check restated its own filename.
+ *
+ * Here the real gate is driven with a completed and an incomplete task state:
+ * a task whose `gates_passed` is false must be refused at the Zod boundary AND
+ * again at the service boundary.
+ */
 export declare function runJ08Contract(ctx: GuardContext): Promise<GuardRunResult>;