peaks-loop 4.0.48 → 4.0.50

package/dist/services/capability-guard-runner/contracts/J12.js

@@ -1,34 +1,70 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-const CANDIDATE_FILES = [
-    'src/services/worktree/lease-store.ts',
-    'src/services/worktree/worktree-lease.ts',
-    'src/services/dispatch/sub-agent-dispatcher.ts',
-    'src/services/lease-metrics/lease-metrics-service.ts'
-];
-const REQUIRED_FRAGMENTS = ['lease', 'release'];
+import { deserializeLease, finalizeLease, isLeaseActive, isLeaseGcEligible, leaseFilePath, leaseStoreDir, listLeasesSync, markReleased, recordConsumption, renewLease, serializeLease, ttlForRole } from '../../worktree/worktree-lease.js';
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+const NOW = 1_700_000_000_000;
+const DRAFT = {
+    leaseId: '0123456789abcdef',
+    rid: '2026-09-15-s1-gate-contracts-honest',
+    role: 'rd',
+    path: 'C:/tmp/worktrees/0123456789abcdef',
+    branch: 'peaks/guard-J12',
+    createdAt: NOW - 1000,
+    expiresAt: NOW + 60_000,
+    purpose: 'J12 guard probe'
+};
+/**
+ * Behavioural probe of the lease lifecycle.
+ *
+ * The previous version passed if one of four worktree/dispatch files mentioned
+ * both "lease" and "release" — `worktree-lease.ts` satisfies that from its own
+ * filename.
+ *
+ * Here the real pure module is driven: a fresh lease must be active, releasing
+ * twice must be a no-op, a duplicate consumption must not append, an in-flight
+ * lease must never be gc-eligible, and a persisted lease must survive a
+ * serialize/deserialize round trip.
+ */
 export async function runJ12Contract(ctx) {
-    const existing = CANDIDATE_FILES.filter((f) => existsSync(join(ctx.projectRoot, f)));
-    if (existing.length === 0) {
-        return {
-            journeyId: 'J12',
-            contract: 'concurrency-lease',
-            status: 'fail',
-            diff: { before: 'a worktree/lease/dispatch service exists', after: 'no candidate found', reason: 'J12#1 broken: no lease infrastructure is present' },
-            artifactPath: 'src/services/worktree/'
-        };
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const lease = finalizeLease(DRAFT);
+    const onceReleased = markReleased(lease);
+    const twiceReleased = markReleased(onceReleased);
+    const consumed = recordConsumption(lease, 'batch-1');
+    const consumedTwice = recordConsumption(consumed, 'batch-1');
+    const renewed = renewLease(onceReleased, NOW + 120_000);
+    const root = mkdtempSync(join(tmpdir(), 'cbl-J12-'));
+    try {
+        const storeDir = leaseStoreDir(root);
+        const missingStore = listLeasesSync(storeDir, { readdir: readdirSync, readFile: (p) => readFileSync(p, 'utf8'), existsSync });
+        mkdirSync(storeDir, { recursive: true });
+        writeFileSync(leaseFilePath(root, lease.leaseId), serializeLease(lease));
+        const listed = listLeasesSync(storeDir, { readdir: readdirSync, readFile: (p) => readFileSync(p, 'utf8'), existsSync });
+        const result = combineProbes([
+            probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+            probe(lease.status === 'active' && lease.consumedBySubAgents.length === 0, 'a fresh lease is active with no consumers'),
+            probe(leaseStoreDir(root).replace(/\\/g, '/').endsWith('/worktree-leases'), `leases live under the session worktree-leases dir (${leaseStoreDir(root)})`),
+            probe(missingStore.kind === 'store-missing', 'an absent lease store is reported, not invented'),
+            probe(listed.kind === 'ok' && listed.leases.length === 1, `a persisted lease is listed back (${listed.kind === 'ok' ? String(listed.leases.length) : listed.kind})`),
+            probe(JSON.stringify(deserializeLease(serializeLease(lease))) === JSON.stringify(lease), 'serialize/deserialize round-trips the lease'),
+            probe(onceReleased.status === 'released', 'release moves the lease to released'),
+            probe(JSON.stringify(twiceReleased) === JSON.stringify(onceReleased), 'a duplicate release is a no-op'),
+            probe(JSON.stringify(consumedTwice) === JSON.stringify(consumed) && consumed.consumedBySubAgents.length === 1, 'a duplicate consumption is not appended twice'),
+            probe(renewed.status === 'active' && renewed.expiresAt === NOW + 120_000, 'renew extends expiry and returns the lease to active'),
+            probe(isLeaseActive(lease, NOW), 'an unexpired active lease is in flight'),
+            probe(!isLeaseGcEligible(lease, NOW), 'gc is NOT eligible for an in-flight lease'),
+            probe(isLeaseGcEligible(onceReleased, NOW), 'a released lease is gc-eligible'),
+            probe(isLeaseGcEligible(finalizeLease({ ...DRAFT, expiresAt: NOW - 1 }), NOW), 'an expired lease is gc-eligible'),
+            probe(ttlForRole('rd') > 0 && ttlForRole('no-such-role') === ttlForRole('rd'), 'unknown roles fall back to the rd TTL')
+        ]);
+        const artifact = row.sourceFiles[0] ?? 'src/services/worktree/worktree-lease.ts';
+        if (result.ok)
+            return pass(ctx, artifact);
+        return fail(ctx, artifact, 'the lease lifecycle is complete: release is idempotent and gc never touches an in-flight lease', result.detail, 'J12 invariant broken: the lease release lifecycle or its gc guard no longer holds');
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
     }
-    // Soft: at least one file references BOTH 'lease' AND 'release' in its content.
-    const fullCoverage = existing.some((f) => {
-        const src = readFileSync(join(ctx.projectRoot, f), 'utf8').toLowerCase();
-        return REQUIRED_FRAGMENTS.every((frag) => src.includes(frag));
-    });
-    const ok = fullCoverage;
-    return {
-        journeyId: 'J12',
-        contract: 'concurrency-lease',
-        status: ok ? 'pass' : 'fail',
-        ...(ok ? {} : { diff: { before: 'a worktree/lease service references both lease and release', after: 'no such file', reason: 'J12#1 broken: lease lifecycle (lease + release) is incomplete' } }),
-        artifactPath: existing[0]
-    };
 }

package/dist/services/capability-guard-runner/contracts/J13.d.ts

@@ -1,2 +1,13 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * Behavioural probe of the content-pipeline boundary.
+ *
+ * The previous version read the skill plus three unrelated files and passed if
+ * three of the five words draft/edit/tone/publish/archive appeared anywhere —
+ * and it counted "tone" (a GATE in the skill) as a STAGE.
+ *
+ * Here the skill's declared stages are anchored on the bees that implement
+ * them, and every file under the skill directory is scanned for a specifier
+ * that would reach into peaks-code internals.
+ */
 export declare function runJ13Contract(ctx: GuardContext): Promise<GuardRunResult>;

package/dist/services/capability-guard-runner/contracts/J13.js

@@ -1,45 +1,67 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
-const CANDIDATE_FILES = [
-    'skills/peaks-content/SKILL.md',
-    'src/services/content/',
-    'src/services/workflow/workflow-router-service.ts',
-    '.peaks/standards/loop-engineering-guidelines.md'
-];
-const STAGES = ['draft', 'edit', 'tone', 'publish', 'archive'];
-export async function runJ13Contract(ctx) {
-    const existing = CANDIDATE_FILES.filter((f) => existsSync(join(ctx.projectRoot, f)));
-    if (existing.length === 0) {
-        return {
-            journeyId: 'J13',
-            contract: 'workflow-trace',
-            status: 'fail',
-            diff: { before: 'a content / peaks-content skill exists', after: 'no candidate found', reason: 'J13#1 broken: no content production surface is present' },
-            artifactPath: 'skills/peaks-content/SKILL.md'
-        };
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+const SKILL_DIR = ['skills', 'peaks-content'];
+const SKILL_MD = [...SKILL_DIR, 'SKILL.md'];
+/**
+ * The content stages the skill must still declare, each anchored on the bee
+ * that implements it. "draft" appearing anywhere in the file is not evidence;
+ * `bee-content-draft` disappearing means the stage is gone.
+ */
+const STAGES = ['draft', 'edit', 'publish', 'archive'];
+/** Specifiers that would mean the skill reached into peaks-code domain logic. */
+const FORBIDDEN_SPECIFIER = /(^|[./\\])peaks-code([/\\]|$)|(^|\/)src\/(services|cli)\//;
+function walk(dir, out = []) {
+    if (!existsSync(dir))
+        return out;
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        const abs = join(dir, entry.name);
+        if (entry.isDirectory())
+            walk(abs, out);
+        else
+            out.push(abs);
     }
-    // Soft check: at least 3 of 5 stages appear in any existing file's content.
-    const matchedStages = new Set();
-    for (const file of existing) {
-        const src = readFileSync(join(ctx.projectRoot, file), 'utf8').toLowerCase();
-        for (const stage of STAGES) {
-            if (src.includes(stage))
-                matchedStages.add(stage);
+    return out;
+}
+/**
+ * Behavioural probe of the content-pipeline boundary.
+ *
+ * The previous version read the skill plus three unrelated files and passed if
+ * three of the five words draft/edit/tone/publish/archive appeared anywhere —
+ * and it counted "tone" (a GATE in the skill) as a STAGE.
+ *
+ * Here the skill's declared stages are anchored on the bees that implement
+ * them, and every file under the skill directory is scanned for a specifier
+ * that would reach into peaks-code internals.
+ */
+export async function runJ13Contract(ctx) {
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const skillAbs = join(ctx.projectRoot, ...SKILL_MD);
+    const body = existsSync(skillAbs) ? readFileSync(skillAbs, 'utf8') : '';
+    const absentStages = STAGES.filter((stage) => !body.includes(`bee-content-${stage}`));
+    const toneGatePresent = body.includes('Tone gate');
+    const files = walk(join(ctx.projectRoot, ...SKILL_DIR));
+    const offenders = [];
+    for (const file of files) {
+        const text = readFileSync(file, 'utf8');
+        for (const line of text.split('\n')) {
+            const spec = /(?:from|import|require\()\s*['"]([^'"]+)['"]/.exec(line);
+            if (spec !== null && FORBIDDEN_SPECIFIER.test(spec[1])) {
+                offenders.push(`${file.replace(/\\/g, '/')} → ${spec[1]}`);
+            }
         }
     }
-    if (matchedStages.size < 3) {
-        return {
-            journeyId: 'J13',
-            contract: 'workflow-trace',
-            status: 'fail',
-            diff: { before: 'at least 3 of draft/edit/tone/publish/archive stages are referenced', after: `only ${[...matchedStages].join(',')} found`, reason: 'J13#1 broken: content pipeline has too few stages' },
-            artifactPath: existing[0]
-        };
-    }
-    return {
-        journeyId: 'J13',
-        contract: 'workflow-trace',
-        status: 'pass',
-        artifactPath: existing[0]
-    };
+    const result = combineProbes([
+        probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+        probe(body.length > 0, 'the peaks-content skill file is readable'),
+        probe(absentStages.length === 0, `every content stage is anchored on its bee (missing: ${absentStages.join(',') || 'none'})`),
+        probe(toneGatePresent, 'the tone gate is still declared between draft and edit'),
+        probe(files.length > 0, `the skill directory is non-empty (${String(files.length)} files)`),
+        probe(offenders.length === 0, `no skill file imports peaks-code internals (${offenders.join('; ') || 'none'})`)
+    ]);
+    const artifact = row.sourceFiles[0] ?? 'skills/peaks-content/SKILL.md';
+    if (result.ok)
+        return pass(ctx, artifact);
+    return fail(ctx, artifact, 'peaks-content declares its four stages and imports no peaks-code internals', result.detail, 'J13 invariant broken: the content pipeline stages or the peaks-code boundary changed');
 }

package/dist/services/capability-guard-runner/contracts/J14.d.ts

@@ -1,2 +1,13 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * Behavioural probe of the RL-3 AI-modified declaration rule.
+ *
+ * The previous version read the skill plus two markdown files and passed if at
+ * least two of the words triage/classify/fix/commit appeared — words that
+ * appear throughout the prose regardless of whether any rule survived.
+ *
+ * Here the rule is anchored on its heading, its literal commit-body markers,
+ * the forbidden-trailer list and the survey-banned globs. Deleting the rule
+ * section reddens the journey.
+ */
 export declare function runJ14Contract(ctx: GuardContext): Promise<GuardRunResult>;

package/dist/services/capability-guard-runner/contracts/J14.js

@@ -1,36 +1,65 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-const CANDIDATE_FILES = [
-    'skills/peaks-issue-fix-orchestrator/SKILL.md',
-    '.peaks/memory/peaks-loop-positioning-loop-engineering.md',
-    '.peaks/standards/loop-engineering-guidelines.md'
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+const SKILL_MD = ['skills', 'peaks-issue-fix-orchestrator', 'SKILL.md'];
+/**
+ * The RL-3 declaration's literal lines. Anchored on the exact marker text the
+ * self-check greps for — "AI-modified" appearing once in the frontmatter
+ * description is not evidence that the rule survived.
+ */
+const REQUIRED_MARKERS = [
+    'AI-modified: yes',
+    'Repository:',
+    'Modifying tool: peaks-loop / peaks-issue-fix-orchestrator',
+    "grep -E 'Repository:|AI-modified:'",
+    'Forbidden trailers:'
 ];
-const REQUIRED_STAGES = ['triage', 'classify', 'fix', 'commit'];
+/** Every trailer the repo's own red rule bans (CLAUDE.md, 2026-07-01). */
+const FORBIDDEN_TRAILERS = [
+    'Co-Authored-By: Claude',
+    'Co-Authored-By: Anthropic'
+];
+/** Survey-banned target globs that must still be refused before any commit. */
+const BANNED_TARGETS = [
+    'tools/mcp_oauth.py',
+    'agent/auth/*',
+    'agent/conversation_loop.py',
+    'agent/tool_guardrails.py',
+    '*/prompt_cache*',
+    '*/token_cache*'
+];
+/**
+ * Behavioural probe of the RL-3 AI-modified declaration rule.
+ *
+ * The previous version read the skill plus two markdown files and passed if at
+ * least two of the words triage/classify/fix/commit appeared — words that
+ * appear throughout the prose regardless of whether any rule survived.
+ *
+ * Here the rule is anchored on its heading, its literal commit-body markers,
+ * the forbidden-trailer list and the survey-banned globs. Deleting the rule
+ * section reddens the journey.
+ */
 export async function runJ14Contract(ctx) {
-    const existing = CANDIDATE_FILES.filter((f) => existsSync(join(ctx.projectRoot, f)));
-    if (existing.length === 0) {
-        return {
-            journeyId: 'J14',
-            contract: 'workflow-trace',
-            status: 'fail',
-            diff: { before: 'a peaks-issue-fix-orchestrator skill or memory file exists', after: 'no candidate found', reason: 'J14#1 broken: no issue-sweep surface is present' },
-            artifactPath: 'skills/peaks-issue-fix-orchestrator/SKILL.md'
-        };
-    }
-    const matched = new Set();
-    for (const file of existing) {
-        const src = readFileSync(join(ctx.projectRoot, file), 'utf8').toLowerCase();
-        for (const stage of REQUIRED_STAGES) {
-            if (src.includes(stage))
-                matched.add(stage);
-        }
-    }
-    const ok = matched.size >= 2;
-    return {
-        journeyId: 'J14',
-        contract: 'workflow-trace',
-        status: ok ? 'pass' : 'fail',
-        ...(ok ? {} : { diff: { before: 'at least 2 of triage/classify/fix/commit are referenced', after: `only ${[...matched].join(',')} found`, reason: 'J14#1 broken: issue-sweep pipeline has too few stages' } }),
-        artifactPath: existing[0]
-    };
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const abs = join(ctx.projectRoot, ...SKILL_MD);
+    const body = existsSync(abs) ? readFileSync(abs, 'utf8') : '';
+    // The heading carries an em dash, so match the two stable halves instead of
+    // the literal punctuation.
+    const headingPresent = /###\s+RL-3\b[^\n]*AI-modified declaration/.test(body);
+    const missingMarkers = REQUIRED_MARKERS.filter((m) => !body.includes(m));
+    const missingTrailers = FORBIDDEN_TRAILERS.filter((t) => !body.includes(t));
+    const missingTargets = BANNED_TARGETS.filter((t) => !body.includes(t));
+    const result = combineProbes([
+        probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+        probe(body.length > 0, 'the issue-fix orchestrator skill file is readable'),
+        probe(headingPresent, 'the RL-3 AI-modified declaration section is still present'),
+        probe(missingMarkers.length === 0, `the commit-body markers are intact (missing: ${missingMarkers.join(', ') || 'none'})`),
+        probe(missingTrailers.length === 0, `the AI trailer ban is intact (missing: ${missingTrailers.join(', ') || 'none'})`),
+        probe(missingTargets.length === 0, `the survey-banned target globs are intact (missing: ${missingTargets.join(', ') || 'none'})`)
+    ]);
+    const artifact = row.sourceFiles[0] ?? 'skills/peaks-issue-fix-orchestrator/SKILL.md';
+    if (result.ok)
+        return pass(ctx, artifact);
+    return fail(ctx, artifact, 'every fix carries the RL-3 AI-modified declaration and the banned-target list survives', result.detail, 'J14 invariant broken: the AI-modified declaration rule or the banned-target list was removed');
 }

package/dist/services/capability-guard-runner/contracts/J15.d.ts

@@ -1,2 +1,13 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * Behavioural probe of the fixed coverage-summary discovery order.
+ *
+ * The previous version listed three openspec files and passed if any of them
+ * mentioned "Capability Mapping" AND "coverage" — the string "coverage" appears
+ * in `coverage-evidence-reader.ts` from its own filename.
+ *
+ * Here the real resolver is driven against a tmp project where BOTH candidate
+ * files exist, then only the second, then neither. Only a resolver that honours
+ * the documented order can produce `coverage/` → `openspec/` → missing.
+ */
 export declare function runJ15Contract(ctx: GuardContext): Promise<GuardRunResult>;

package/dist/services/capability-guard-runner/contracts/J15.js

@@ -1,40 +1,75 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-const CANDIDATE_FILES = [
-    'src/services/openspec/openspec-archive-service.ts',
-    'src/services/openspec/coverage-evidence-reader.ts',
-    'src/cli/commands/openspec-commands.ts'
-];
-const REQUIRED_FRAGMENTS = ['Capability Mapping', 'coverage'];
+import { parseCapabilityMapping, resolveCoverageSummaryPath } from '../../openspec/coverage-evidence-reader.js';
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+const COVERAGE_REL = ['coverage', 'coverage-summary.json'];
+const OPENSPEC_REL = ['openspec', 'coverage-summary.json'];
+function writeJson(root, parts, body) {
+    const abs = join(root, ...parts);
+    mkdirSync(join(root, ...parts.slice(0, -1)), { recursive: true });
+    writeFileSync(abs, JSON.stringify(body));
+}
+const PROPOSAL_WITH_MAPPING = [
+    '# change',
+    '',
+    '## Capability Mapping',
+    '',
+    '| capability | source | test anchor |',
+    '| --- | --- | --- |',
+    '| runner | src/services/capability-guard-runner/runner.ts | tests/unit/capability-guard-runner/runner.test.ts |',
+    '',
+    '## Next section',
+    'trailing prose'
+].join('\n');
+/**
+ * Behavioural probe of the fixed coverage-summary discovery order.
+ *
+ * The previous version listed three openspec files and passed if any of them
+ * mentioned "Capability Mapping" AND "coverage" — the string "coverage" appears
+ * in `coverage-evidence-reader.ts` from its own filename.
+ *
+ * Here the real resolver is driven against a tmp project where BOTH candidate
+ * files exist, then only the second, then neither. Only a resolver that honours
+ * the documented order can produce `coverage/` → `openspec/` → missing.
+ */
 export async function runJ15Contract(ctx) {
-    const existing = CANDIDATE_FILES.filter((f) => existsSync(join(ctx.projectRoot, f)));
-    if (existing.length === 0) {
-        return {
-            journeyId: 'J15',
-            contract: 'spec-coverage',
-            status: 'fail',
-            diff: { before: 'an openspec archive/coverage service exists', after: 'no candidate found', reason: 'J15#1 broken: no openspec/coverage surface is present' },
-            artifactPath: 'src/services/openspec/'
-        };
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const root = mkdtempSync(join(tmpdir(), 'cbl-J15-'));
+    try {
+        const both = join(root, ...COVERAGE_REL);
+        const fallback = join(root, ...OPENSPEC_REL);
+        writeJson(root, COVERAGE_REL, { total: { lines: { pct: 100 } } });
+        writeJson(root, OPENSPEC_REL, { total: { lines: { pct: 0 } } });
+        const first = await resolveCoverageSummaryPath({ projectRoot: root });
+        rmSync(both, { force: true });
+        const second = await resolveCoverageSummaryPath({ projectRoot: root });
+        rmSync(fallback, { force: true });
+        const neither = await resolveCoverageSummaryPath({ projectRoot: root });
+        const proposalPath = join(root, 'proposal.md');
+        writeFileSync(proposalPath, PROPOSAL_WITH_MAPPING);
+        const withBlock = await parseCapabilityMapping(proposalPath);
+        writeFileSync(proposalPath, '# change\n\n## Other section\n');
+        const withoutBlock = await parseCapabilityMapping(proposalPath);
+        const triedPaths = !neither.ok && neither.error.code === 'missing' ? neither.error.triedPaths : [];
+        const result = combineProbes([
+            probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+            probe(first.ok && first.value.replace(/\\/g, '/').endsWith('/coverage/coverage-summary.json'), `with both summaries present the c8 wrapper default wins (${first.ok ? first.value : first.error.code})`),
+            probe(second.ok && second.value.replace(/\\/g, '/').endsWith('/openspec/coverage-summary.json'), `with only the openspec summary present the override is used (${second.ok ? second.value : second.error.code})`),
+            probe(!neither.ok && neither.error.code === 'missing', `with neither summary present resolution fails (${neither.ok ? 'resolved' : neither.error.code})`),
+            probe(triedPaths.length === 2 &&
+                triedPaths[0].replace(/\\/g, '/').endsWith('/coverage/coverage-summary.json') &&
+                triedPaths[1].replace(/\\/g, '/').endsWith('/openspec/coverage-summary.json'), `the tried-path list reports the fixed order (${triedPaths.join(' | ') || 'none'})`),
+            probe(withBlock.present && withBlock.rows.length === 1, `a ## Capability Mapping block parses to one row (present=${String(withBlock.present)} rows=${String(withBlock.rows.length)})`),
+            probe(!withoutBlock.present && withoutBlock.rows.length === 0, 'a proposal without the block is reported as absent, not guessed')
+        ]);
+        const artifact = row.sourceFiles[0] ?? 'src/services/openspec/coverage-evidence-reader.ts';
+        if (result.ok)
+            return pass(ctx, artifact);
+        return fail(ctx, artifact, 'coverage-summary discovery order is coverage/ then openspec/, and the Capability Mapping block is parsed not guessed', result.detail, 'J15 invariant broken: the coverage evidence discovery order or the Capability Mapping parse changed');
     }
-    // At least one file references BOTH "Capability Mapping" AND "coverage".
-    const fullCoverage = existing.some((f) => {
-        const src = readFileSync(join(ctx.projectRoot, f), 'utf8');
-        return REQUIRED_FRAGMENTS.every((frag) => src.includes(frag));
-    });
-    if (!fullCoverage) {
-        return {
-            journeyId: 'J15',
-            contract: 'spec-coverage',
-            status: 'fail',
-            diff: { before: 'openspec services reference both "Capability Mapping" and "coverage"', after: 'no such service', reason: 'J15#1 broken: openspec archive gate is missing the Capability Mapping + coverage cross-check' },
-            artifactPath: existing[0]
-        };
+    finally {
+        rmSync(root, { recursive: true, force: true });
     }
-    return {
-        journeyId: 'J15',
-        contract: 'spec-coverage',
-        status: 'pass',
-        artifactPath: existing[0]
-    };
 }

package/dist/services/capability-guard-runner/contracts/_shared.d.ts

@@ -0,0 +1,24 @@
+import type { CapabilityBaselineRow } from '../../capability-baseline/types.js';
+import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * The frozen baseline row this contract is bound to. Throws when the baseline
+ * is unreadable or the row is absent — a contract with no baseline behind it
+ * must not be able to report green.
+ */
+export declare function requireBaselineRow(ctx: GuardContext): CapabilityBaselineRow;
+/**
+ * Every `sourceFiles` entry of the row must still exist. The baseline names the
+ * files that carry the journey; a vanished file is drift, so this returns the
+ * missing ones rather than filtering them out.
+ */
+export declare function missingSourceFiles(ctx: GuardContext, row: CapabilityBaselineRow): ReadonlyArray<string>;
+export declare function pass(ctx: GuardContext, artifactPath: string): GuardRunResult;
+export declare function fail(ctx: GuardContext, artifactPath: string, before: string, after: string, reason: string): GuardRunResult;
+/** Result of a source-level probe; `ok` drives pass/fail, `detail` the diff. */
+export interface Probe {
+    readonly ok: boolean;
+    readonly detail: string;
+}
+export declare function combineProbes(probes: ReadonlyArray<Probe>): Probe;
+/** Convenience: build a probe whose ok-ness is a boolean and a label. */
+export declare function probe(ok: boolean, detail: string): Probe;

package/dist/services/capability-guard-runner/contracts/_shared.js

@@ -0,0 +1,67 @@
+// src/services/capability-guard-runner/contracts/_shared.ts
+//
+// Helpers shared by the J01–J15 guard contracts.
+//
+// The point of these contracts is to answer "is this journey's behaviour still
+// right?", not "does some file still contain some word?". The helpers here
+// keep that honest and cheap:
+//   - the file list comes from the FROZEN BASELINE ROW, never from a
+//     hand-written candidate list inside the contract (so a baseline/source
+//     drift is visible instead of being papered over by a fallback path);
+//   - a missing source file is a contract failure, not a silently narrower
+//     check.
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { readBaselineFile } from '../../capability-baseline/store.js';
+/**
+ * The frozen baseline row this contract is bound to. Throws when the baseline
+ * is unreadable or the row is absent — a contract with no baseline behind it
+ * must not be able to report green.
+ */
+export function requireBaselineRow(ctx) {
+    const journeyId = ctx.contract.source.baselineRow;
+    const r = readBaselineFile(ctx.projectRoot);
+    if (!r.ok) {
+        throw new Error(`baseline unreadable at ${ctx.projectRoot} (${r.error.code}: ${r.error.message})`);
+    }
+    const row = r.file.rows.find((x) => x.journeyId === journeyId);
+    if (!row) {
+        throw new Error(`baseline row ${journeyId} is not in the frozen baseline`);
+    }
+    return row;
+}
+/**
+ * Every `sourceFiles` entry of the row must still exist. The baseline names the
+ * files that carry the journey; a vanished file is drift, so this returns the
+ * missing ones rather than filtering them out.
+ */
+export function missingSourceFiles(ctx, row) {
+    return row.sourceFiles.filter((f) => !existsSync(join(ctx.projectRoot, f)));
+}
+export function pass(ctx, artifactPath) {
+    return {
+        journeyId: ctx.contract.journeyId,
+        contract: ctx.contract.kind,
+        status: 'pass',
+        artifactPath
+    };
+}
+export function fail(ctx, artifactPath, before, after, reason) {
+    return {
+        journeyId: ctx.contract.journeyId,
+        contract: ctx.contract.kind,
+        status: 'fail',
+        diff: { before, after, reason },
+        artifactPath
+    };
+}
+export function combineProbes(probes) {
+    const bad = probes.filter((p) => !p.ok);
+    if (bad.length === 0)
+        return { ok: true, detail: probes.map((p) => p.detail).join('; ') };
+    return { ok: false, detail: bad.map((p) => p.detail).join('; ') };
+}
+/** Convenience: build a probe whose ok-ness is a boolean and a label. */
+export function probe(ok, detail) {
+    return { ok, detail };
+}

package/dist/services/capability-guard-runner/registry.d.ts

@@ -0,0 +1,5 @@
+import { type JourneyId } from '../capability-baseline/types.js';
+import type { GuardContract } from './types.js';
+export declare const GUARD_CONTRACTS: ReadonlyArray<GuardContract>;
+export declare function getGuardContract(journeyId: JourneyId): GuardContract | undefined;
+export declare function isJourneyId(value: string): value is JourneyId;