peaks-loop 4.0.48 → 4.0.50

package/dist/services/capability-guard-runner/contracts/J08.js

@@ -1,43 +1,70 @@
-// src/services/capability-guard-runner/contracts/J08.ts
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-// v2: existence is the primary check; a single soft fragment is best-effort.
-// v1 required 3 strict fragments (regressionSkeptic/independentEval/promote) that
-// do not all appear in the actual 4.0.8 crystallization service.
-const CANDIDATE_FILES = [
-    'src/services/crystallization/crystallization-service.ts',
-    'src/services/asset-crystallize/crystallization-service.ts',
-    'src/services/evolution/evolution-service.ts'
-];
+import Database from 'better-sqlite3';
+import { CrystallizationIntegrityError, CrystallizationService, CrystallizationTaskStateSchema } from '../../crystallization/crystallization-service.js';
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+/** Test doubles: `assertReady` never reaches any of them. */
+function probeService() {
+    const noop = () => undefined;
+    const opts = {
+        loopReleaseSchema: { parse: (input) => input },
+        loopBeeRelationSchema: { parse: (input) => input, omit: () => ({ parse: (input) => input }) },
+        insertLoopRelease: noop,
+        insertLoopBeeRelation: noop
+    };
+    return new CrystallizationService(new Database(':memory:'), opts);
+}
+/**
+ * Behavioural probe of the crystallization gate.
+ *
+ * Before this the contract only asserted that one of three candidate files
+ * exists and mentions "crystalliz"/"sediment"/"promot" — the file it found is
+ * named `crystallization-service.ts`, so the check restated its own filename.
+ *
+ * Here the real gate is driven with a completed and an incomplete task state:
+ * a task whose `gates_passed` is false must be refused at the Zod boundary AND
+ * again at the service boundary.
+ */
 export async function runJ08Contract(ctx) {
-    const existing = CANDIDATE_FILES.filter((f) => existsSync(join(ctx.projectRoot, f)));
-    if (existing.length === 0) {
-        return {
-            journeyId: 'J08',
-            contract: 'asset-roundtrip',
-            status: 'fail',
-            diff: { before: 'a crystallization/evolution service exists', after: 'no candidate found', reason: 'J08#1 broken: no sediment/promotion service is present' },
-            artifactPath: 'src/services/crystallization/'
-        };
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const ready = { task_id: 'guard-J08', task_status: 'completed', gates_passed: true, evidence_collected: true };
+    const schemaAcceptsReady = CrystallizationTaskStateSchema.safeParse(ready).success;
+    const schemaRejectsGatesFalse = !CrystallizationTaskStateSchema.safeParse({ ...ready, gates_passed: false }).success;
+    const schemaRejectsNotCompleted = !CrystallizationTaskStateSchema.safeParse({ ...ready, task_status: 'in_progress' }).success;
+    const schemaRejectsNoEvidence = !CrystallizationTaskStateSchema.safeParse({ ...ready, evidence_collected: false }).success;
+    const svc = probeService();
+    let serviceAcceptsReady = false;
+    try {
+        serviceAcceptsReady = svc.assertReady(ready).task_id === 'guard-J08';
     }
-    // Soft check: at least one existing file mentions crystallization, sediment, or promotion.
-    const primary = existing.some((f) => {
-        const src = readFileSync(join(ctx.projectRoot, f), 'utf8').toLowerCase();
-        return src.includes('crystallization') || src.includes('sediment') || src.includes('promot');
-    });
-    if (!primary) {
-        return {
-            journeyId: 'J08',
-            contract: 'asset-roundtrip',
-            status: 'fail',
-            diff: { before: 'crystallization service references sediment/promotion', after: 'no service mentions any of them', reason: 'J08#1 broken: crystallization service is not wired to sediment' },
-            artifactPath: existing[0]
-        };
+    catch {
+        serviceAcceptsReady = false;
     }
-    return {
-        journeyId: 'J08',
-        contract: 'asset-roundtrip',
-        status: 'pass',
-        artifactPath: existing[0]
-    };
+    const refused = [];
+    const badStates = [
+        ['gates_passed=false', { ...ready, gates_passed: false }],
+        ['task_status=in_progress', { ...ready, task_status: 'in_progress' }],
+        ['evidence_collected=false', { ...ready, evidence_collected: false }]
+    ];
+    for (const [label, task] of badStates) {
+        try {
+            svc.assertReady(task);
+        }
+        catch (e) {
+            if (e instanceof CrystallizationIntegrityError)
+                refused.push(label);
+        }
+    }
+    const result = combineProbes([
+        probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+        probe(schemaAcceptsReady, 'a completed, gate-passed, evidenced task passes the schema'),
+        probe(schemaRejectsGatesFalse, 'gates_passed=false is refused by the schema'),
+        probe(schemaRejectsNotCompleted, 'task_status!=completed is refused by the schema'),
+        probe(schemaRejectsNoEvidence, 'evidence_collected=false is refused by the schema'),
+        probe(serviceAcceptsReady, 'the service accepts a ready task'),
+        probe(refused.length === 3, `the service refuses every non-passing gate state with CrystallizationIntegrityError (refused: ${refused.join(', ') || 'none'})`)
+    ]);
+    const artifact = row.sourceFiles[0] ?? 'src/services/crystallization/crystallization-service.ts';
+    if (result.ok)
+        return pass(ctx, artifact);
+    return fail(ctx, artifact, 'crystallization refuses any task whose gates are not in a passing state', result.detail, 'J08 invariant broken: crystallization no longer enforces the pre-run gate');
 }

package/dist/services/capability-guard-runner/contracts/J09.d.ts

@@ -1,2 +1,15 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * Behavioural probe of the SOP id guard and the lint-before-register ordering.
+ *
+ * The previous version listed five SOP files and passed if any of them
+ * mentioned "sop", "gate" or "register" — every file in the list is named
+ * `sop-*.ts`, so the check could not fail.
+ *
+ * Here the real `initSop` / `registerSop` path runs against a tmp project:
+ * path-traversal and reserved ids must be refused, and a manifest that fails
+ * lint must stop the registration BEFORE `registry.json` is written. The
+ * positive control (a clean manifest DOES register) is what makes the negative
+ * assertion mean something.
+ */
 export declare function runJ09Contract(ctx: GuardContext): Promise<GuardRunResult>;

package/dist/services/capability-guard-runner/contracts/J09.js

@@ -1,44 +1,100 @@
-// src/services/capability-guard-runner/contracts/J09.ts
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-// v2: existence + soft fragment. v1 required 3 strict fragments (gate/checkable/register)
-// that don't all appear in every SOP service file in 4.0.8.
-const CANDIDATE_FILES = [
-    'src/services/sop/sop-service.ts',
-    'src/services/sop/sop-register.ts',
-    'src/services/sop/sop-check-service.ts',
-    'src/services/sop/sop-registry-service.ts',
-    'src/services/sop/sop-types.ts'
-];
+import { initSop } from '../../sop/sop-service.js';
+import { SOP_ID_PATTERN } from '../../sop/sop-types.js';
+import { registerSop, SopRegisterError } from '../../sop/sop-registry-service.js';
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+const VALID_ID = 'guard-demo';
+function registryPath(projectRoot) {
+    return join(projectRoot, '.peaks', 'sops', 'registry.json');
+}
+/**
+ * Behavioural probe of the SOP id guard and the lint-before-register ordering.
+ *
+ * The previous version listed five SOP files and passed if any of them
+ * mentioned "sop", "gate" or "register" — every file in the list is named
+ * `sop-*.ts`, so the check could not fail.
+ *
+ * Here the real `initSop` / `registerSop` path runs against a tmp project:
+ * path-traversal and reserved ids must be refused, and a manifest that fails
+ * lint must stop the registration BEFORE `registry.json` is written. The
+ * positive control (a clean manifest DOES register) is what makes the negative
+ * assertion mean something.
+ */
 export async function runJ09Contract(ctx) {
-    const existing = CANDIDATE_FILES.filter((f) => existsSync(join(ctx.projectRoot, f)));
-    if (existing.length === 0) {
-        return {
-            journeyId: 'J09',
-            contract: 'sop-register',
-            status: 'fail',
-            diff: { before: 'a SOP service file exists', after: 'no candidate found', reason: 'J09#1 broken: no SOP service is present' },
-            artifactPath: 'src/services/sop/'
-        };
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const root = mkdtempSync(join(tmpdir(), 'cbl-J09-'));
+    try {
+        const patternRejects = ['a.b', 'a/b', '../escape', 'Bad-Id', ''].every((id) => !SOP_ID_PATTERN.test(id));
+        const patternAccepts = ['demo', 'my-sop', 'a', 'sop2'].every((id) => SOP_ID_PATTERN.test(id));
+        const reservedRefused = [];
+        for (const id of ['peaks-x', 'peaks']) {
+            try {
+                await initSop({ id, projectRoot: root, apply: true });
+            }
+            catch (e) {
+                if (/reserved/i.test(e.message))
+                    reservedRefused.push(id);
+            }
+        }
+        let traversalRefused = false;
+        try {
+            await initSop({ id: '../escape', projectRoot: root, apply: true });
+        }
+        catch (e) {
+            traversalRefused = /invalid sop id|pattern|kebab/i.test(e.message);
+        }
+        // Positive control: a real SOP initialises and registers cleanly.
+        let cleanRegisters = false;
+        let registerError = '';
+        try {
+            await initSop({ id: VALID_ID, projectRoot: root, apply: true });
+            const reg = await registerSop({ id: VALID_ID, projectRoot: root });
+            cleanRegisters = reg.applied === true && existsSync(registryPath(root));
+        }
+        catch (e) {
+            registerError = `${e.name}: ${e.message.slice(0, 140)}`;
+        }
+        // Negative control: break the manifest so lint must fail, then register.
+        let dirtyRefused = false;
+        let dirtyCode = 'none';
+        rmSync(registryPath(root), { force: true });
+        const manifestPath = join(root, '.peaks', 'sops', VALID_ID, 'sop.json');
+        if (existsSync(manifestPath)) {
+            const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+            manifest['id'] = 'not-the-directory-id';
+            writeFileSync(manifestPath, JSON.stringify(manifest, null, 2));
+        }
+        else {
+            mkdirSync(join(root, '.peaks', 'sops', VALID_ID), { recursive: true });
+            writeFileSync(manifestPath, JSON.stringify({ id: 'not-the-directory-id', name: 'x', phases: ['p'], gates: [] }));
+        }
+        try {
+            await registerSop({ id: VALID_ID, projectRoot: root });
+        }
+        catch (e) {
+            dirtyCode = e instanceof SopRegisterError ? e.code : e.name;
+            dirtyRefused = dirtyCode === 'SOP_INVALID';
+        }
+        const wroteRegistryDespiteLintFailure = existsSync(registryPath(root));
+        const result = combineProbes([
+            probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+            probe(patternRejects, 'SOP_ID_PATTERN rejects dots, slashes, traversal and empty ids'),
+            probe(patternAccepts, 'SOP_ID_PATTERN accepts lowercase kebab ids'),
+            probe(reservedRefused.length === 2, `reserved ids are refused (refused: ${reservedRefused.join(',') || 'none'})`),
+            probe(traversalRefused, "initSop refuses '../escape'"),
+            probe(cleanRegisters, `a clean SOP registers and writes registry.json${registerError ? ` [${registerError}]` : ''}`),
+            probe(dirtyRefused, `a manifest that fails lint is refused with SOP_INVALID (saw ${dirtyCode})`),
+            probe(!wroteRegistryDespiteLintFailure, 'lint failure halts registration before registry.json is written')
+        ]);
+        const artifact = row.sourceFiles[0] ?? 'src/services/sop/sop-service.ts';
+        if (result.ok)
+            return pass(ctx, artifact);
+        return fail(ctx, artifact, 'SOP ids are pattern-guarded and lintSop() gates registerSop()', result.detail, 'J09 invariant broken: the SOP id guard or the lint-before-register ordering no longer holds');
     }
-    // Soft check: at least one existing file mentions sop, gate, or register.
-    const primary = existing.some((f) => {
-        const src = readFileSync(join(ctx.projectRoot, f), 'utf8').toLowerCase();
-        return src.includes('sop') || src.includes('gate') || src.includes('register');
-    });
-    if (!primary) {
-        return {
-            journeyId: 'J09',
-            contract: 'sop-register',
-            status: 'fail',
-            diff: { before: 'SOP service references sop/gate/register', after: 'no service mentions any of them', reason: 'J09#1 broken: SOP service is not wired to gate-able registration' },
-            artifactPath: existing[0]
-        };
+    finally {
+        rmSync(root, { recursive: true, force: true });
     }
-    return {
-        journeyId: 'J09',
-        contract: 'sop-register',
-        status: 'pass',
-        artifactPath: existing[0]
-    };
 }

package/dist/services/capability-guard-runner/contracts/J10.d.ts

@@ -1,2 +1,14 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * Behavioural probe of "a plan is produced before anything is written, so the
+ * diff is reviewable".
+ *
+ * The previous version listed four hook/IDE files and passed if any of them
+ * contained the word "hook", "install", "ide" or "adapter" — `hooks-commands.ts`
+ * satisfies that from its own filename.
+ *
+ * Here `planHookInstall` runs against a fresh tmp project and the settings file
+ * must NOT appear; `applyHookInstall` then writes it, and a second apply must
+ * be a no-op that does not duplicate the entry.
+ */
 export declare function runJ10Contract(ctx: GuardContext): Promise<GuardRunResult>;

package/dist/services/capability-guard-runner/contracts/J10.js

@@ -1,40 +1,74 @@
-// src/services/capability-guard-runner/contracts/J10.ts
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-const CANDIDATE_FILES = [
-    'src/cli/commands/hooks-commands.ts',
-    'src/cli/commands/ide-commands.ts',
-    'src/cli/commands/hook-handle.ts',
-    'src/hooks/pre-tool-use-sub-agent.ts'
-];
+import { applyHookInstall, planHookInstall } from '../../skills/hooks-settings-service.js';
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+import { normalizePath } from '../../../shared/path-utils.js';
+function countOccurrences(haystack, needle) {
+    if (needle.length === 0)
+        return 0;
+    let count = 0;
+    let from = 0;
+    for (;;) {
+        const at = haystack.indexOf(needle, from);
+        if (at < 0)
+            return count;
+        count += 1;
+        from = at + needle.length;
+    }
+}
+/**
+ * Behavioural probe of "a plan is produced before anything is written, so the
+ * diff is reviewable".
+ *
+ * The previous version listed four hook/IDE files and passed if any of them
+ * contained the word "hook", "install", "ide" or "adapter" — `hooks-commands.ts`
+ * satisfies that from its own filename.
+ *
+ * Here `planHookInstall` runs against a fresh tmp project and the settings file
+ * must NOT appear; `applyHookInstall` then writes it, and a second apply must
+ * be a no-op that does not duplicate the entry.
+ */
 export async function runJ10Contract(ctx) {
-    const existing = CANDIDATE_FILES.filter((f) => existsSync(join(ctx.projectRoot, f)));
-    if (existing.length === 0) {
-        return {
-            journeyId: 'J10',
-            contract: 'hook-assertion',
-            status: 'fail',
-            diff: { before: 'a hooks/ide/handle CLI file exists', after: 'no candidate found', reason: 'J10#1 broken: no IDE install/hook infrastructure is present' },
-            artifactPath: 'src/cli/commands/hooks-commands.ts'
-        };
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const root = mkdtempSync(join(tmpdir(), 'cbl-J10-'));
+    try {
+        const plan = planHookInstall('project', root);
+        const settingsPath = plan.settingsPath;
+        const plannedInsideProject = normalizePath(settingsPath).startsWith(normalizePath(root));
+        const planIsReadOnly = !existsSync(settingsPath);
+        const freshProjectNotInstalled = plan.exists === false && plan.alreadyInstalled === false;
+        // Each managed hook entry is identified by its own sentinel; every one of
+        // them must land exactly once and stay at one across a re-apply.
+        const sentinels = plan.entryTargets.filter((t) => t.settingsPath === settingsPath).map((t) => t.sentinel);
+        const countsNow = () => existsSync(settingsPath) ? sentinels.map((s) => countOccurrences(readFileSync(settingsPath, 'utf8'), s)) : [];
+        const first = applyHookInstall('project', root);
+        const fileWritten = existsSync(settingsPath);
+        const installedCounts = countsNow();
+        const sentinelCount = installedCounts.length > 0 ? installedCounts[0] : -1;
+        const second = applyHookInstall('project', root);
+        const afterSecondApply = countsNow().length > 0 ? countsNow()[0] : -1;
+        const planAfterApply = planHookInstall('project', root);
+        const result = combineProbes([
+            probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+            probe(plannedInsideProject, `the plan targets a settings file inside the project (${settingsPath})`),
+            probe(freshProjectNotInstalled, 'a fresh project reports exists=false / alreadyInstalled=false'),
+            probe(planIsReadOnly, 'planning does not create the settings file — the diff is reviewable first'),
+            probe(first.applied === true, 'apply reports applied=true'),
+            probe(fileWritten, 'apply writes the settings file'),
+            probe(sentinels.length > 0, `the plan enumerates managed hook entries (${String(sentinels.length)})`),
+            probe(installedCounts.length > 0 && installedCounts.every((c) => c === 1), `apply installs every managed entry exactly once (counts=${installedCounts.join(',') || 'none'})`),
+            probe(second.applied === false, `a second apply is a no-op (applied=${String(second.applied)}, first sentinel count=${String(sentinelCount)})`),
+            probe(afterSecondApply === 1, `a duplicate apply does not duplicate the entry (count=${String(afterSecondApply)})`),
+            probe(planAfterApply.alreadyInstalled === true, 'the plan reports alreadyInstalled=true after a successful apply')
+        ]);
+        const artifact = row.sourceFiles[0] ?? 'src/services/skills/hooks-settings-service.ts';
+        if (result.ok)
+            return pass(ctx, artifact);
+        return fail(ctx, artifact, 'planHookInstall() produces a reviewable plan before applyHookInstall() writes, and re-applying is a no-op', result.detail, 'J10 invariant broken: hook install is no longer plan-then-apply, or is not idempotent');
     }
-    const primary = existing.some((f) => {
-        const src = readFileSync(join(ctx.projectRoot, f), 'utf8').toLowerCase();
-        return src.includes('hook') || src.includes('install') || src.includes('ide') || src.includes('adapter');
-    });
-    if (!primary) {
-        return {
-            journeyId: 'J10',
-            contract: 'hook-assertion',
-            status: 'fail',
-            diff: { before: 'hooks/ide commands reference install/hook/ide/adapter', after: 'no such reference', reason: 'J10#1 broken: hooks/ide commands do not implement install/hook/ide/adapter' },
-            artifactPath: existing[0]
-        };
+    finally {
+        rmSync(root, { recursive: true, force: true });
     }
-    return {
-        journeyId: 'J10',
-        contract: 'hook-assertion',
-        status: 'pass',
-        artifactPath: existing[0]
-    };
 }

package/dist/services/capability-guard-runner/contracts/J11.d.ts

@@ -1,2 +1,10 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * Behavioural probe of "doctor checks live under a code-driven fixed-registry
+ * tree, and each openspec change is generated from a real doctor finding".
+ *
+ * The previous version listed doctor/audit/openspec files and passed if any of
+ * them mentioned "doctor", "audit", "openspec" or "health" — `doctor-service.ts`
+ * satisfies that from its own filename.
+ */
 export declare function runJ11Contract(ctx: GuardContext): Promise<GuardRunResult>;

package/dist/services/capability-guard-runner/contracts/J11.js

@@ -1,39 +1,79 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-const CANDIDATE_FILES = [
-    'src/services/doctor/doctor-service.ts',
-    'src/services/audit/audit-service.ts',
-    'src/cli/commands/openspec-commands.ts',
-    'src/services/openspec/openspec-propose-from-doctor-service.ts'
+import { PLUGINS } from '../../doctor/doctor-service/plugin-registry.js';
+import { proposeFromDoctor } from '../../openspec/openspec-propose-from-doctor-service.js';
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+const CHECKS_DIR = ['src', 'services', 'doctor', 'doctor-service', 'checks'];
+const LEGACY_SHIM = ['src', 'services', 'doctor', 'doctor-service.ts'];
+const FROZEN_CLOCK = () => '2020-01-01T00:00:00.000Z';
+/** Strip block + line comments so only executable lines remain. */
+function executableLines(source) {
+    return source
+        .replace(/\/\*[\s\S]*?\*\//g, '')
+        .split('\n')
+        .map((line) => line.replace(/\/\/.*$/, '').trim())
+        .filter((line) => line.length > 0);
+}
+/**
+ * Constructs a re-export-only shim must not contain. `export * from` /
+ * `export { a, b } from` / `export type { ... }` are the only allowed forms;
+ * anything below means logic moved back into the legacy path.
+ */
+const FORBIDDEN_SHIM_PATTERNS = [
+    /\bfunction\b/,
+    /\breturn\b/,
+    /\bif\s*\(/,
+    /\bfor\s*\(/,
+    /\bwhile\s*\(/,
+    /\bconst\s+\w+\s*=/,
+    /=>\s*\{/
 ];
+/**
+ * Behavioural probe of "doctor checks live under a code-driven fixed-registry
+ * tree, and each openspec change is generated from a real doctor finding".
+ *
+ * The previous version listed doctor/audit/openspec files and passed if any of
+ * them mentioned "doctor", "audit", "openspec" or "health" — `doctor-service.ts`
+ * satisfies that from its own filename.
+ */
 export async function runJ11Contract(ctx) {
-    const existing = CANDIDATE_FILES.filter((f) => existsSync(join(ctx.projectRoot, f)));
-    if (existing.length === 0) {
-        return {
-            journeyId: 'J11',
-            contract: 'cli-output-golden',
-            status: 'fail',
-            diff: { before: 'a doctor/audit/openspec service exists', after: 'no candidate found', reason: 'J11#1 broken: no doctor surface is present' },
-            artifactPath: 'src/services/doctor/doctor-service.ts'
-        };
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const checksDirAbs = join(ctx.projectRoot, ...CHECKS_DIR);
+    const checkFiles = existsSync(checksDirAbs) ? readdirSync(checksDirAbs).filter((f) => f.endsWith('.ts')) : [];
+    const pluginIds = PLUGINS.map((p) => p.name);
+    const uniquePluginIds = new Set(pluginIds);
+    const shimAbs = join(ctx.projectRoot, ...LEGACY_SHIM);
+    const shimSource = existsSync(shimAbs) ? readFileSync(shimAbs, 'utf8') : '';
+    const shimLines = executableLines(shimSource);
+    const shimLogic = shimLines.filter((line) => FORBIDDEN_SHIM_PATTERNS.some((re) => re.test(line)));
+    const shimReexports = /export\s+(\*|\{[\s\S]*?\}|type\s*\{[\s\S]*?\})\s*from\s*'/.test(shimSource);
+    const shimIsReexportOnly = shimLines.length > 0 && shimLogic.length === 0 && shimReexports;
+    const root = mkdtempSync(join(tmpdir(), 'cbl-J11-'));
+    try {
+        const finding = { id: 'L3:l3-memory-health', rule: 'r', detail: 'd', severity: 'fail' };
+        const first = proposeFromDoctor({ projectRoot: root, finding, clock: FROZEN_CLOCK });
+        const second = proposeFromDoctor({ projectRoot: root, finding, clock: FROZEN_CLOCK });
+        const proposalMentionsFinding = existsSync(first.proposalPath)
+            ? readFileSync(first.proposalPath, 'utf8').includes(finding.id)
+            : false;
+        const result = combineProbes([
+            probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+            probe(checkFiles.length > 0 && PLUGINS.length === checkFiles.length, `the plugin registry enumerates every check module (${String(PLUGINS.length)} plugins / ${String(checkFiles.length)} checks)`),
+            probe(uniquePluginIds.size === PLUGINS.length, `plugin ids are unique (${String(uniquePluginIds.size)}/${String(PLUGINS.length)})`),
+            probe(shimIsReexportOnly, `the legacy doctor-service.ts shim holds no logic (${String(shimLines.length)} executable lines, ${String(shimLogic.length)} with logic${shimLogic.length > 0 ? `: ${shimLogic.slice(0, 3).join(' | ')}` : ''})`),
+            probe(first.changeId === '2020-01-01-fix-l3-l3-memory-health', `the change id is derived from the doctor finding (${first.changeId})`),
+            probe(first.created === true, 'the first proposal is created'),
+            probe(proposalMentionsFinding, 'the proposal names the originating finding id'),
+            probe(second.created === false, 'regenerating from the same finding is idempotent (created=false)')
+        ]);
+        const artifact = row.sourceFiles[0] ?? 'src/services/doctor/doctor-service/index.ts';
+        if (result.ok)
+            return pass(ctx, artifact);
+        return fail(ctx, artifact, 'doctor checks are a code-driven fixed-registry tree and openspec changes come from real findings', result.detail, 'J11 invariant broken: the doctor check registry or the finding-to-change conversion no longer holds');
     }
-    const primary = existing.some((f) => {
-        const src = readFileSync(join(ctx.projectRoot, f), 'utf8').toLowerCase();
-        return src.includes('doctor') || src.includes('audit') || src.includes('openspec') || src.includes('health');
-    });
-    if (!primary) {
-        return {
-            journeyId: 'J11',
-            contract: 'cli-output-golden',
-            status: 'fail',
-            diff: { before: 'doctor/audit/openspec references health/audit/openspec', after: 'no such reference', reason: 'J11#1 broken: doctor/audit/openspec services are not wired' },
-            artifactPath: existing[0]
-        };
+    finally {
+        rmSync(root, { recursive: true, force: true });
     }
-    return {
-        journeyId: 'J11',
-        contract: 'cli-output-golden',
-        status: 'pass',
-        artifactPath: existing[0]
-    };
 }

package/dist/services/capability-guard-runner/contracts/J12.d.ts

@@ -1,2 +1,14 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * Behavioural probe of the lease lifecycle.
+ *
+ * The previous version passed if one of four worktree/dispatch files mentioned
+ * both "lease" and "release" — `worktree-lease.ts` satisfies that from its own
+ * filename.
+ *
+ * Here the real pure module is driven: a fresh lease must be active, releasing
+ * twice must be a no-op, a duplicate consumption must not append, an in-flight
+ * lease must never be gc-eligible, and a persisted lease must survive a
+ * serialize/deserialize round trip.
+ */
 export declare function runJ12Contract(ctx: GuardContext): Promise<GuardRunResult>;