peaks-loop 4.0.49 → 4.0.50

package/CHANGELOG.md

@@ -1,5 +1,29 @@
 # Changelog
 
+## 4.0.50 — 2026-09-16 (自审把 29% 从分母里排除 + 反漂移闸门报 15/15 而只跑了 1 条 + 一条"no exceptions"的红线没有任何执行者 + 五个测试套件从未运行过 + macOS 从未进 CI)
+
+**Highlights**:
+
+1. **"散文比例 0%" 是一个重新定义了自己分母的指标。** `peaks audit red-lines` 报 `proseOnly: 0`，而**同一份 JSON 里 44 行**写着 `"backing": "prose-only"` —— `classifier.ts` 把所有未匹配的 marker 标为 `informational: true`，比例计算再把它**排除出分母**。同一批修复查出 `cli-backed` 的判定是 `existsSync(enforcerRef)`：**文件在磁盘上存在即算"有机器执行"**，于是 **9 个 enforcer**（共 51 行）从未被导入、从未被调用，却被计入机器执行。诚实重算，同一棵树：**cli-backed 105 → 54，prose-only 0 → 98（64.5%）**。指标变难看，是因为它开始度量该度量的东西。另外两个同族缺陷：`lint-rd-handoff-coverage` 检查的是 **SKILL.md 里描述产物的那句话**，从不读产物文件；`release-precheck` 的 AC-9 **把 bug 本身钉成了期望值**（`proseOnly === 0`），现在钉的是"摘要与逐行计数一致"。
+
+2. **RL-10 指定的反漂移机制在自证，而它能自证是因为它只跑了一条。** `peaks baseline audit` 输出 `verdict: consistent`、`consistencyScore: 1`、证据写着 `"capability-guard-runner:15 — 15 pass / 0 fail"`。真相是 `guardSummary` **硬编码为 `{pass:15,fail:0}`**，LLM 打分环节是**返回常量**的桩；而 `run-guard` 的派发是 `opts.journey === 'J01' ? … : {status:'skipped'}` —— **不带参数时只跑 J01**，其余 14 条返回 `skipped` 且 **exit 0**，与"通过"在退出码上不可区分。15 个 guard contract 里 13 个是 `existsSync` + 常见词子串（J10 断言 `hooks-commands.ts` 含词 `hook`；J06 的注释书面承认把闸门改松以让它通过）。现在：15 条 contract 走一个 registry 全部真实执行，`skipped` 是 **exit 2**、`fail` 是 **exit 1**；`assertBaselineRef` 真的解析冻结行与**逐字不变量文本**，不再只检查字段为真值；`freeze-update` / `rollback` / `reset` 三件套有了可达的成功路径（此前它们无条件 `fail`，**棘轮动不了**）。**诚实否定**：J10 的 `HOOK_PERMISSION_DENIED` 在基线 JSON 里存在但从未实现 —— 没有把它编码成探针，因为那会造出一盏永久的红灯；J08 的不变量措辞夸大了四个 gate 实际塌缩成一个布尔。
+
+3. **发布闸门从"只拒一个字面量"改成白名单，于是它立刻挡住了发布。** `publish.yml` 原本只在 `verdict` **精确等于 `"drifted"`** 时失败 —— `partial` / `inconclusive` / 任何别的值都会放行。改成白名单（仅 `consistent` 放行）之后，上面那条伪造的 15/15 不再能放行任何东西，**发布被挡住了**。这是刻意的、也是被接受的：闸门不再是摆设，代价是它开始真的挡。解开它的不是放宽，而是接上一个**能失败的确定性独立检查器**（见第 4 条）。同一轮里 `describeMode()` 被发现把自己描述成 `0.85/0.95`，**漏掉真正生效的 0.80 档**；往下挖还查出一条真实分叉：`peaks skill presence`（每轮都调）在 **≥0.80** 触发 `auto-fire`，而 `peaks code context-now` —— SKILL.md 自己声明的 single source of truth —— **硬编码了它自己的 0.85**。只改描述，**没碰阈值和行为**。
+
+4. **独立打分器：独立性是信息通道的属性，不是基质的属性。** 桩打分器不能自证之后，需要的是一个**真正独立**的评估者。选择确定性检查器而非 LLM，有两个理由：其一，**LLM 喂原来那份 payload `{baselineJourneyId, guard}` 只是更贵的橡皮图章** —— 它会把守卫结果重述一遍；其二，也是决定性的，**`publish.yml` 是 secretless 的**（OIDC，`contents: read` / `id-token: write`，任何步骤都没有 token），LLM 打分器需要 key，加一个 key 等于**用一个无密钥的发布管线去换一个非确定性的外部依赖，还塞在闸门里**。检查器改为读**冻结行 + 武装它们的 contract registry + 守卫摘要**三者比对。`llmRunner` 接缝被**删除**，而不是留成一个带假调用者的死参数。裁决语义**收紧而非放宽**：`consistent` 现在要求 `guardFail === 0` **且**零 findings，`inconclusive` 只能从 `--scorer stub` 到达。**残留如实披露**：每次运行都报 `coverage`，本轮是 `invariantsArmed 15/45`、`forbiddenChangesUnverified 30` —— 所以 `consistent` 读作"在当前度量范围内一致"，不可过度解读。注入验证（真实基线 + registry，三臂 + 干净对照）：对照 `consistent`；把一个冻结的 `sourceFiles` 条目指向磁盘上不存在的路径 → **`drifted`**，`SOURCE_FILE_MISSING` 点名 J01。
+
+5. **多个"闸门"的共同形状：声称有执行者，执行者不在。** (a) `CLAUDE.md:34` 称顶层目录禁令由 `tests/unit/workspace/top-level-change-id-guard.test.ts`「**will fail the suite**」守护 —— **该文件不存在**，死于 `457b9a87`；四层防护的第 2 层缺失。(b) 红线文件称 RL-0..RL-10 由 `peaks standards lint --category loop-engineering` 强制 —— **该子命令根本没注册**，其实现函数 `lintLoopEngineeringGuidelines` **全仓零调用者**；现在动词已注册，RL-10 进了校验集，`EXPECTED_RED_LINE_IDS` 不再止于 RL-9。(c) `CLAUDE.md` 描述的 `--change-id` 流程与 `current-change` 绑定文件**两者都不存在**，且与 `.peaks/PROJECT.md` 明文矛盾 —— 以 PROJECT.md 为准修正。(d) 三份权威设计文档（含 `docs/adr/` **整个目录**）不存在，定位所依赖的结晶设计 spec **只活在记忆的散文里**。(e) `package.json` 的 `test:race` 点名 4 个文件、**只有 1 个存在**，靠 `passWithNoTests` **静默空跑退出 0**。(f) `Co-Authored-By` 红线称 "no exceptions"，而 `.git/hooks` 里只有 `.sample`、无 husky/lefthook/commitlint、`tests/` 里只出现在一个 fixture 的散文中 —— 现在有了 vitest 守卫（选它而非 hook，因为 `.git/hooks` 不被 git 跟踪、clone 后不存在），失败路径是一条**永久用例**：建真仓库、提交违规信息、断言变红，配干净对照。两条排除规则是被真实历史逼出来的：**只有行首 trailer**，且**括号里的说明不是身份**（`Co-Authored-By: (omitted per CLAUDE.md red rule)` 历史上出现过两次，天真搜索**一出生就是红的**）。**残留如实披露**：它检出，不阻止。另新增一个**引用完整性守卫** —— 文档里被反引号括起的仓库路径若不存在则变红（注入验证过）。**而它自己有作用域缺口**，见第 8 条。
+
+6. **五个测试套件从未运行过。** 整个 `tests/e2e/`（5 个真实 CLI 关键路径测试 + 3 个 shell 脚本）被**两个 vitest 配置同时排除**，且**没有任何脚本或 CI 步骤选中它**。另有 7 个测试门控在一个**无处设置**的环境变量 `PEAKS_BUILD_AVAILABLE` 上 —— 以无人设置的环境变量为条件的 skip 就是穿着戏服的永久 skip。`stryker.vitest.config.mjs` 指向两个在 `f17aa377` 被删除的路径，**变异测试按当前配置跑不起来**；修好后它跑到变异阶段并诚实报 **0.00%**：4 个被变异的文件里**有 3 个没有任何测试导入**。两条不可能失败的断言被重写并注入验证（一条上一行刚构造出 `markerPath`、下一行断言它 `endsWith(...)`，注释自认目的是消除 lint 告警；另一条测试名声称 "preserves the original errorId"，而被调函数**根本没有 errorId 参数**）。`vm-kvm` 的三个测试在 CI 的全部平台上永不执行，现在 skip 原因进了测试名。**一个测试套件复活后失败的代价被如实计入而非消除。**
+
+7. **消费者真机路径：升级不刷新生成物，而 macOS 从未进过 CI。** `npm i -g` 升级**不刷新**已生成的 `.claude/*.json` —— 唯一写入者是 `initWorkspace`，而 `ensureSession` 在项目已有绑定时**提前返回**，刷新路径不再触发；逃生舱 `peaks upgrade --apply-init` 存在，但**没有任何东西告知用户其配置已陈旧**。生成物也因此**没有版本戳**，落后与否不可判定；现在有了戳和检测器（伪装一个旧版本戳 → 检测器报 `stale: true, package-upgraded`）。管理段 `.gitignore` 是**写入一次、内容永不传播**且无漂移检测。`postinstall` **无条件在 `$HOME` 创建 10 个 IDE 目录** —— 包括用户根本没有的工具；hermes/openclaw 的 profile 不在探测表里，**永远探测不到**；`installProjectConfig` 是有定义、有导出、**零调用**的死代码。**macOS 此前不在任何 workflow 里**，于是每一类 Mac 专属缺陷**在构造上就不可见**（`findTranscriptJsonl` 的 ESM `require` 假绿 —— vitest 因 esbuild 注入的 CommonJS shim 而在完全破损的生产路径上 6/6 全绿）。矩阵现在含 `macos-latest`，并**明确承诺不抑制红色单元格**。另外 `peaks workflow init` **不解析会话绑定、静默把图写进 `unknown-sid`** —— 那个桶自 2026-09-01 起累积了**至少 4 个不同 caller id** 的产物，即**对谁都没成功过**；现在解析失败会明确报错而不是静默兜底。
+
+8. **一个"三个同名层"的适配器结构与一批从未被测过的路径。** 9 个 IDE 适配器只有 1 个有专属测试文件，且只覆盖 compact 路径；**4 个 sub-agent dispatcher**（claudeCode / trae / traeCn / cursor）在全仓测试中**零引用**，含它们产出的 `awaitByLlm` 字段 0 命中 —— 即**"扇出到非 claude-code IDE"这条路径从未被测过**。新增 5 个测试文件 / 114 个用例，6 次注入各配干净对照。两件本不该为真的事：`share-commands.ts` **告诉用户会出现 `awaitByLlm` 标记，而没有任何 adapter 产出它**；`src/services/adapter/{adapter,auto-adapter,claude,codex,copilot}` 是**第三个同名层且完全死掉**（零 importer，方法不收参数）—— 标注而非删除，因为诊断文档引用了那些路径，删除会制造本仓正在清理的那类悬空引用。**移交不吸收**：`traeCnSubAgentDispatcher` / `awaitByLlmFallback` / `registerClaudeCodeAwait` 全仓零引用、`peaks sub-agent await` 传 `recordPaths: []` 因而**永远报不出结果**、9 个 `supportsScope` 谓词全是同义反复 —— 全部报出，未修。同一轮查出**引用完整性守卫自身的作用域缺口**：`de0872b7`（2026-07-05）把 9 个技能移到 `skills/bee/` 却**没有更新指向它们的路径**，而守卫的语料（`CLAUDE.md` / `.peaks/PROJECT.md` / `README.md` / `.peaks/standards`）**不含 `skills/**`** —— 锚点正则接受 `skills/`，语料不含它。**未修，刻意**：扩围守卫会让套件变红，扩围与修复必须同一片落地；规模只作线索（临时扫描器给出 313 处引用 / 95 处缺失，但本仓规矩是用已有 AST 守卫而非另写正则扫描）。
+
+9. **第二个编辑闸门是个空操作，而它的弃用理由论证是对的。** `write-gate.js` 的 `decide()` **对每一条路径都弃权**，且这是刻意的、有完整论证的：退出码 2 才阻塞，其他非零码是**非阻塞错误** —— 动作照常执行，但每次编辑都在 transcript 里刷 `<hook> hook error`，所以旧的"静默 fall through 到闸门"其实是**最吵的那个结果**。弃权正确，**安装不该存在**：它往每个消费者的配置里放了一条 `node "C:/…/nvm/v24.14.0/…"` 指令，**钉死在安装时解析到的那一个 Node 版本目录上**，外加一个 `shell: powershell` 钉。删除的是**安装**而非那个决策，论证保留在 `.claude/HOOKS.md`；**没有**恢复那个 handler —— 那正是本轮的清理对象：一个零调用者却因为"有东西指着它"而活着的东西。删除顺带暴露了刷新路径里的一个真 bug：`templateContentMatches` **把超集判成 current**，于是**已退役的条目原样存活**；修完后在真 CLI 上验证 3 条 → 2 条。
+
+10. **两套编辑闸门装在同一 matcher 上而无人协调**（matcher 写法顺序都不同），且一个消费者项目的会话绑定解析、hook 装配与生成物刷新此前**没有任何一处**是端到端验证过的。本轮的每一次修复都配了**能失败的验证**：能红、能复现、红的理由精确到行号或文件名。**已知未闭合**：`src/` 下已无 `.js` 文件，因此 vendor-neutrality 守卫里那条"`.js` 扩展名盲区"断言被删除，该盲区现在由结构与散文覆盖、**不再由测试覆盖** —— 这是本轮唯一一处**把覆盖换成更弱而非更强**的地方，如实记录而非留给读者发现。
+
 ## 4.0.49 — 2026-09-15 (闸门验的是描述产物的话而不是产物本身 + id 轴三次布防后改走结构 + 两处吞异常与一个不是证据的 mtime + 套件自己把夹具写进了收集 glob)
 
 **Highlights**:

package/README-en.md

@@ -140,7 +140,7 @@ Every lane opens with **one slash command**.
 
 | | |
 | --- | --- |
-| **Latest** | [![npm](https://img.shields.io/npm/v/peaks-loop?style=for-the-badge&logo=npm&logoColor=white&color=cb3837)](https://www.npmjs.com/package/peaks-loop) — 4.0.49 (2026-09-15) |
+| **Latest** | [![npm](https://img.shields.io/npm/v/peaks-loop?style=for-the-badge&logo=npm&logoColor=white&color=cb3837)](https://www.npmjs.com/package/peaks-loop) — 4.0.50 (2026-09-16) |
 | **Domains** | Code (`peaks-code`) · Content (`peaks-content`) · Project health (`peaks-doctor`) · Issue sweep (`peaks-issue-fix-orchestrator`) · Custom SOP (`peaks-sop`) · Cross-domain primitives (`peaks-solo` dispatcher · `peaks-resume` · `peaks-status` · `peaks-test` · `peaks-slice-decompose`) |
 | **Sediment pool** | `~/.peaks/` local pool · twice-clean runs auto-promote to a bee · broken runs come back for you to redefine · the bee grows with your taste |
 | **Test suite** | 285+ cases · 4 packages (peaks-loop / peaks-loop-mut / peaks-loop-shared-channel / peaks-loop-shared) · **0 timeouts** · 14 BDD caller-binding edge cases |

package/README.md

@@ -140,7 +140,7 @@ npm i -g peaks-loop
 
 | | |
 | --- | --- |
-| **最新版本** | [![npm](https://img.shields.io/npm/v/peaks-loop?style=for-the-badge&logo=npm&logoColor=white&color=cb3837)](https://www.npmjs.com/package/peaks-loop) — 4.0.49(2026-09-15) |
+| **最新版本** | [![npm](https://img.shields.io/npm/v/peaks-loop?style=for-the-badge&logo=npm&logoColor=white&color=cb3837)](https://www.npmjs.com/package/peaks-loop) — 4.0.50(2026-09-16) |
 | **覆盖域** | 代码(`peaks-code`) · 内容(`peaks-content`) · 项目健康(`peaks-doctor`) · 批量修 issue(`peaks-issue-fix-orchestrator`) · 自定义 SOP(`peaks-sop`) · 通用原语(`peaks-solo` 分诊 / `peaks-resume` 续 / `peaks-status` 看 / `peaks-test` 测 / `peaks-slice-decompose` 切片) |
 | **沉淀池** | `~/.peaks/` 本地池 · 跑两次自动晋升成 bee · 跑翻车让你重定义 · bee 跟着你的口味长 |
 | **测试套件** | 1096 cases · 4 packages (peaks-loop 1015 / runtime 39 / mut 22 / shared-channel 20) · **CI 首次全绿**(ubuntu + windows) · 14 BDD caller-binding coverage |

package/dist/cli/commands/audit-commands.js

@@ -455,6 +455,7 @@ function emptyProseRatioResult() {
         cliBacked: 0,
         partial: 0,
         proseOnly: 0,
+        discoveredProseOnly: 0,
         informational: 0,
         ratio: 0,
         target: 0.05,

package/dist/cli/commands/baseline-commands.js

@@ -1,7 +1,11 @@
 // src/cli/commands/baseline-commands.ts
-import { readFileSync } from 'node:fs';
+import { copyFileSync, existsSync, mkdirSync, readFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
 import { historySnapshot, readBaselineFile, writeBaselineFile } from '../../services/capability-baseline/store.js';
 import { validateBaselineFile } from '../../services/capability-baseline/validator.js';
+import { P0_JOURNEY_IDS } from '../../services/capability-baseline/types.js';
+import { GUARD_CONTRACTS, getGuardContract, isJourneyId } from '../../services/capability-guard-runner/registry.js';
+import { exitCodeForGuardSummary, runAllGuards } from '../../services/capability-guard-runner/runner.js';
 function fail(io, code, message, data = {}) {
     io.stdout(JSON.stringify({ ok: false, command: `baseline`, code, message, data, warnings: [], nextActions: [] }));
     process.exitCode = 1;
@@ -9,6 +13,23 @@ function fail(io, code, message, data = {}) {
 function ok(io, command, data, nextActions = []) {
     io.stdout(JSON.stringify({ ok: true, command, data, warnings: [], nextActions }));
 }
+const CURRENT_DIR = (root) => join(root, 'openspec', 'baselines', 'current');
+const HISTORY_DIR = (root, version) => join(root, 'openspec', 'baselines', 'history', version);
+/** Whitelist of supported `--scorer` values for `peaks baseline audit`. */
+const SCORER_MODES = ['live', 'stub'];
+/**
+ * `live` is the default because it is the credential-free one. Defaulting to
+ * `stub` would leave the publish gate permanently inconclusive; defaulting to a
+ * scorer that needs a key would leave it unrunnable in CI.
+ */
+const DEFAULT_SCORER_MODE = 'live';
+function isScorerMode(v) {
+    return v !== undefined && SCORER_MODES.includes(v);
+}
+/** The guard `run-guard` / `audit` execute against. */
+function guardContext(projectRoot) {
+    return { projectRoot, sessionId: 'cli', contract: {}, baselineInvariant: 'auto' };
+}
 export function registerBaselineCommands(program, io) {
     const baseline = program.command('baseline').description('Manage the capability baseline (frozen product semantics for 15 P0 journeys).');
     baseline
@@ -69,16 +90,38 @@ export function registerBaselineCommands(program, io) {
     });
     baseline
         .command('run-guard')
-        .description('Run a guard contract over the frozen baseline.')
-        .option('--journey <id>', 'Run only one journey; default is all 15.')
+        .description('Run the guard contracts over the frozen baseline. Runs all 15 journeys unless --journey is given.')
+        .option('--journey <id>', `Run only one journey (${P0_JOURNEY_IDS.join('|')}); default is all 15.`)
         .option('--project <path>', 'Project root', '.')
         .option('--json', 'Emit JSON envelope')
         .action(async (opts) => {
         const projectRoot = opts.project ?? '.';
-        const { runJ01Contract } = await import('../../services/capability-guard-runner/contracts/J01.js');
-        const ctx = { projectRoot, sessionId: 'cli', contract: {}, baselineInvariant: 'auto' };
-        const r = opts.journey ? await (opts.journey === 'J01' ? runJ01Contract(ctx) : Promise.resolve({ status: 'skipped' })) : await runJ01Contract(ctx);
-        ok(io, 'baseline.run-guard', r);
+        let contracts;
+        if (opts.journey === undefined) {
+            contracts = GUARD_CONTRACTS;
+        }
+        else if (!isJourneyId(opts.journey)) {
+            fail(io, 'UNKNOWN_JOURNEY', `unknown journey "${opts.journey}"; expected one of ${P0_JOURNEY_IDS.join(', ')}`);
+            return;
+        }
+        else {
+            const contract = getGuardContract(opts.journey);
+            if (contract === undefined) {
+                fail(io, 'UNKNOWN_JOURNEY', `no guard contract is registered for ${opts.journey}`);
+                return;
+            }
+            contracts = [contract];
+        }
+        const summary = await runAllGuards(contracts, guardContext(projectRoot));
+        const data = summary;
+        const exitCode = exitCodeForGuardSummary(summary);
+        if (exitCode === 0) {
+            ok(io, 'baseline.run-guard', data);
+            return;
+        }
+        fail(io, exitCode === 1 ? 'GUARD_FAILED' : 'GUARD_SKIPPED', `${String(summary.fail)} failed, ${String(summary.skipped)} skipped of ${String(summary.total)} guard contracts`, data);
+        // `fail` sets 1; a skipped run is a distinct outcome from a failed one.
+        process.exitCode = exitCode;
     });
     baseline
         .command('diff')
@@ -96,51 +139,146 @@ export function registerBaselineCommands(program, io) {
     });
     baseline
         .command('audit')
-        .description('Run the capability audit (independent-context scorer).')
+        .description('Run the capability audit (independent-context scorer). Exits non-zero unless the verdict is consistent.')
+        .option('--scorer <mode>', `Scorer to run: ${SCORER_MODES.join('|')}. 'live' (default) runs the deterministic independent checker, which needs no credentials; 'stub' performs no evaluation and can never be consistent.`, DEFAULT_SCORER_MODE)
         .option('--project <path>', 'Project root', '.')
         .option('--json', 'Emit JSON envelope')
         .action(async (opts) => {
         const projectRoot = opts.project ?? '.';
+        if (!isScorerMode(opts.scorer)) {
+            fail(io, 'UNKNOWN_SCORER', `unknown scorer "${String(opts.scorer)}"; expected one of ${SCORER_MODES.join(', ')}`);
+            return;
+        }
         const r = readBaselineFile(projectRoot);
         if (!r.ok) {
             fail(io, r.error.code, r.error.message);
             return;
         }
-        const guardSummary = { pass: 15, fail: 0, skipped: 0, total: 15, results: [] };
-        const stub = {
-            call: async (_system, _user, _opts) => ({
-                output: JSON.stringify({ verdict: 'consistent' }),
-                tokens: { input: _system.length, output: _user.length }
-            })
-        };
+        // The guard summary is the REAL aggregate of the 15 contracts. It used to
+        // be a literal `{pass:15,fail:0,skipped:0,total:15}` that no run produced.
+        const guardSummary = await runAllGuards(GUARD_CONTRACTS, guardContext(projectRoot));
+        // `live` is the deterministic independent checker: a real
+        // separate-context evaluation that needs no credentials, which is why it
+        // is the only kind that can run inside the secretless OIDC publish gate.
+        // It is handed the frozen rows and the registry, not just the guard
+        // summary — a scorer that only sees the guard result is a restatement.
         const { runAudit } = await import('../../services/capability-audit-service/runner.js');
-        const audit = await runAudit({ projectRoot, sessionId: 'cli', journeyId: 'J01', llmRunner: stub, guardSummary });
-        ok(io, 'baseline.audit', audit);
+        const audit = await runAudit({
+            projectRoot,
+            sessionId: 'cli',
+            journeyId: 'J01',
+            scorerMode: opts.scorer,
+            baselineRows: r.file.rows,
+            contracts: GUARD_CONTRACTS,
+            guardSummary
+        });
+        const data = audit;
+        if (audit.verdict === 'consistent' && !audit.degraded) {
+            ok(io, 'baseline.audit', data);
+            return;
+        }
+        fail(io, 'AUDIT_NOT_CONSISTENT', `capability audit verdict is "${audit.verdict}"${audit.degraded ? ' (degraded: stub scorer)' : ''}`, data);
     });
     baseline
         .command('freeze-update')
-        .description('Update one or more baseline rows (REQUIRES user confirmation).')
+        .description('Update one or more baseline rows. The LLM authors the JSON; --confirm records the user\'s approval.')
         .option('--from <path>', 'Path to the new baseline JSON input')
+        .option('--confirm', "Record the user's approval (collected via AskUserQuestion) for this ratchet change")
         .option('--project <path>', 'Project root', '.')
         .option('--json', 'Emit JSON envelope')
         .action((opts) => {
-        fail(io, 'HUMAN_NL_DECISION_REQUIRED', 'freeze-update requires the user to confirm via AskUserQuestion; LLM may not auto-run this command. The LLM must surface a multi-choice prompt to the user before retrying.');
+        const projectRoot = opts.project ?? '.';
+        if (opts.confirm !== true) {
+            fail(io, 'HUMAN_NL_DECISION_REQUIRED', 'freeze-update requires the user to approve the ratchet change via AskUserQuestion. The LLM must surface a multi-choice prompt, then re-run with --confirm.');
+            return;
+        }
+        if (!opts.from) {
+            fail(io, 'MISSING_ARG', '--from is required');
+            return;
+        }
+        const r = readBaselineFile(projectRoot);
+        if (!r.ok) {
+            fail(io, r.error.code, r.error.message);
+            return;
+        }
+        const file = JSON.parse(readFileSync(opts.from, 'utf8'));
+        const v = validateBaselineFile(file);
+        if (!v.ok) {
+            fail(io, v.error.code, v.error.message);
+            return;
+        }
+        const out = writeBaselineFile({ projectRoot, file });
+        historySnapshot({ projectRoot, version: file.version });
+        ok(io, 'baseline.freeze-update', {
+            path: out.path,
+            lockPath: out.lockPath,
+            fromVersion: r.file.version,
+            version: file.version
+        });
     });
     baseline
         .command('rollback')
-        .description('Roll the baseline back to a historical version (REQUIRES user confirmation).')
+        .description('Roll the baseline back to a historical version. --confirm records the user\'s approval.')
         .option('--to <version>', 'Historical version to roll back to')
+        .option('--confirm', "Record the user's approval (collected via AskUserQuestion) for this rollback")
         .option('--project <path>', 'Project root', '.')
         .option('--json', 'Emit JSON envelope')
-        .action(() => {
-        fail(io, 'HUMAN_NL_DECISION_REQUIRED', 'rollback requires the user to confirm via AskUserQuestion; LLM may not auto-run this command.');
+        .action((opts) => {
+        const projectRoot = opts.project ?? '.';
+        if (opts.confirm !== true) {
+            fail(io, 'HUMAN_NL_DECISION_REQUIRED', 'rollback requires the user to approve via AskUserQuestion. The LLM must surface a multi-choice prompt, then re-run with --confirm.');
+            return;
+        }
+        if (!opts.to) {
+            fail(io, 'MISSING_ARG', '--to is required');
+            return;
+        }
+        const source = HISTORY_DIR(projectRoot, opts.to);
+        const from = join(source, 'capability-baseline.json');
+        const fromLock = join(source, 'capability-baseline.lock');
+        if (!existsSync(from) || !existsSync(fromLock)) {
+            fail(io, 'BASELINE_HISTORY_GAP', `no frozen baseline recorded for version ${opts.to}`);
+            return;
+        }
+        const r = readBaselineFile(projectRoot);
+        if (!r.ok) {
+            fail(io, r.error.code, r.error.message);
+            return;
+        }
+        mkdirSync(CURRENT_DIR(projectRoot), { recursive: true });
+        copyFileSync(from, join(CURRENT_DIR(projectRoot), 'capability-baseline.json'));
+        copyFileSync(fromLock, join(CURRENT_DIR(projectRoot), 'capability-baseline.lock'));
+        // Re-read through the locked store so a tampered history entry cannot be
+        // installed: the copy is only reported successful if it verifies.
+        const after = readBaselineFile(projectRoot);
+        if (!after.ok) {
+            fail(io, after.error.code, after.error.message);
+            return;
+        }
+        ok(io, 'baseline.rollback', { fromVersion: r.file.version, toVersion: after.file.version, historyPath: source });
     });
     baseline
         .command('reset')
-        .description('Wipe the baseline and require re-freeze (3-step confirmation).')
+        .description('Wipe the current baseline and require a re-freeze. --confirm records the user\'s approval.')
+        .option('--confirm', "Record the user's approval (collected via AskUserQuestion) for the wipe")
         .option('--project <path>', 'Project root', '.')
         .option('--json', 'Emit JSON envelope')
-        .action(() => {
-        fail(io, 'HUMAN_NL_DECISION_REQUIRED', 'reset requires the user to confirm via AskUserQuestion AND a passphrase; LLM may not auto-run this command.');
+        .action((opts) => {
+        const projectRoot = opts.project ?? '.';
+        if (opts.confirm !== true) {
+            fail(io, 'HUMAN_NL_DECISION_REQUIRED', 'reset requires the user to approve via AskUserQuestion. The LLM must surface a multi-choice prompt, then re-run with --confirm.');
+            return;
+        }
+        const r = readBaselineFile(projectRoot);
+        // A missing baseline is already "wiped" — but an unreadable one (hash
+        // mismatch / unsigned lock) must not be silently discarded.
+        if (!r.ok && r.error.code !== 'BASELINE_NOT_FOUND') {
+            fail(io, r.error.code, r.error.message);
+            return;
+        }
+        const wipedVersion = r.ok ? r.file.version : null;
+        rmSync(join(CURRENT_DIR(projectRoot), 'capability-baseline.json'), { force: true });
+        rmSync(join(CURRENT_DIR(projectRoot), 'capability-baseline.lock'), { force: true });
+        ok(io, 'baseline.reset', { wipedVersion, nextAction: 're-freeze with `baseline freeze --from <path>`' });
     });
 }

package/dist/cli/commands/core/skill-command.js

@@ -15,6 +15,7 @@ import { resolveAutoCompactProfile } from '../../../services/mode/mode-status-se
 import { gcStalePresenceLeases } from '../../../services/skills/presence-lease-service.js';
 import { fail, ok } from 'peaks-loop-shared/result';
 import { stableRealPath } from '../../../shared/path-utils.js';
+import { detectStaleGeneratedArtifacts } from '../../../services/workspace/generated-artifacts-stamp.js';
 /**
  * Canonicalize a user-supplied `--project <path>` value.
  *
@@ -94,6 +95,52 @@ function canonicalizeProjectOption(project) {
         return project;
     }
 }
+/**
+ * D1 (2026-09-15) — generated-config staleness, carried on `skill presence`.
+ *
+ * WHY THIS CALL. `npm i -g peaks-loop@<newer>` upgrades the CLI and leaves the
+ * project's generated config exactly as the OLD release wrote it:
+ * `initWorkspace` is the only writer and `ensureSession` early-returns once a
+ * session is bound, so nothing re-runs the generator. `.claude/settings.local.json`
+ * is drift-checked — but only on an init that never comes. The user found the
+ * previous instance of this by deleting their `.claude/*.json` and restarting;
+ * nothing in the product told them to.
+ *
+ * `peaks skill presence` is the ONE peaks call every skill makes in every turn
+ * (CLAUDE.md mandates it at the start of every response), so it is the only
+ * channel guaranteed to carry a drift notice to the LLM that can act on it —
+ * the same reasoning as the loop-hygiene verdict attached one screen down. A
+ * rule that lives only in a SKILL.md body is compacted away; a warning that
+ * rides the per-turn tool output is not.
+ *
+ * The field is additive and present only when stale, so no existing consumer
+ * of the envelope changes shape. `null` projectRoot means the caller had no
+ * project to inspect — skipped, not assumed stale.
+ */
+function generatedConfigNotice(projectRoot) {
+    if (projectRoot === undefined)
+        return { field: {}, warnings: [] };
+    const staleness = detectStaleGeneratedArtifacts(projectRoot);
+    if (!staleness.stale)
+        return { field: {}, warnings: [] };
+    const onDiskVersion = staleness.onDisk?.packageVersion ?? '(unstamped)';
+    return {
+        field: {
+            generatedArtifacts: {
+                stale: true,
+                reasons: staleness.reasons,
+                onDiskPackageVersion: staleness.onDisk?.packageVersion ?? null,
+                installedPackageVersion: staleness.expected.packageVersion
+            }
+        },
+        warnings: [
+            `Generated config at '${projectRoot}' was produced by peaks-loop ${onDiskVersion} ` +
+                `but ${staleness.expected.packageVersion} is installed (${staleness.reasons.join(', ')}). ` +
+                `Re-run \`peaks workspace init\` (or the idempotent \`peaks upgrade --apply-init\`) ` +
+                `to regenerate .claude/settings.local.json and the offline template copy.`
+        ]
+    };
+}
 import { addJsonOption, getErrorMessage, printResult } from '../../cli-helpers.js';
 // Slice S0 (4.0.0-beta.5 peaks-solo dispatcher release):
 // `peaks skill search` is the CLI primitive that feeds the
@@ -228,9 +275,10 @@ export function registerSkillCommand(program, io) {
         .option('--check-stale', 'slice 002 (v2.15.0): also report whether the recorded outer session id still matches the current one. Default false (back-compat).')
         .option('--project <path>', 'project root (default: cwd)')).action((options) => {
         const projectOption = canonicalizeProjectOption(options.project);
+        const generatedConfig = generatedConfigNotice(projectOption ?? findProjectRoot(process.cwd()) ?? process.cwd());
         const presence = getSkillPresence(projectOption);
         if (presence === null) {
-            printResult(io, ok('skill.presence', { active: false }), options.json);
+            printResult(io, ok('skill.presence', { active: false, ...generatedConfig.field }, generatedConfig.warnings), options.json);
             return;
         }
         // Loop-hygiene verdict: attached to every ACTIVE read, so the
@@ -251,11 +299,12 @@ export function registerSkillCommand(program, io) {
                 staleReason: staleness.reason,
                 currentOuterSessionId: staleness.currentOuterSessionId,
                 recordedOuterSessionId: staleness.recordedOuterSessionId,
-                ...(verdict.context !== null ? { context: verdict.context } : {})
-            }, [], verdict.nextActions), options.json);
+                ...(verdict.context !== null ? { context: verdict.context } : {}),
+                ...generatedConfig.field
+            }, generatedConfig.warnings, verdict.nextActions), options.json);
             return;
         }
-        printResult(io, ok('skill.presence', { active: true, ...presence, ...(verdict.context !== null ? { context: verdict.context } : {}) }, [], verdict.nextActions), options.json);
+        printResult(io, ok('skill.presence', { active: true, ...presence, ...(verdict.context !== null ? { context: verdict.context } : {}), ...generatedConfig.field }, generatedConfig.warnings, verdict.nextActions), options.json);
     });
     addJsonOption(skill
         .command('presence:set <name>')

package/dist/cli/commands/core/standards-command.d.ts

@@ -1,3 +1,27 @@
 import type { Command } from 'commander';
 import { type ProgramIO } from '../../cli-helpers.js';
+/** The only `--category` this subcommand implements today. */
+export declare const LOOP_ENGINEERING_CATEGORY = "loop-engineering";
+/** Project-relative location of the file the `loop-engineering` lint reads. */
+export declare const LOOP_ENGINEERING_GUIDELINES_RELATIVE_PATH = ".peaks/standards/loop-engineering-guidelines.md";
+export interface StandardsLintEnvelope {
+    ok: boolean;
+    code: string;
+    message: string;
+    data: {
+        category: string;
+        path: string;
+        redLineCount: number;
+        redLineIds: string[];
+        findings: string[];
+    };
+    nextActions: string[];
+}
+/**
+ * Pure helper: read the loop-engineering guideline file under `projectRoot`
+ * and lint it. Kept out of the Commander action so unit tests can drive it
+ * without spawning a child process (same shape as
+ * `runReadinessLint` in skill-loop-engineering-readiness-commands.ts).
+ */
+export declare function runLoopEngineeringLint(projectRoot: string): StandardsLintEnvelope;
 export declare function registerStandardsCommand(program: Command, io: ProgramIO): void;

package/dist/cli/commands/core/standards-command.js

@@ -1,9 +1,58 @@
+import { existsSync, readFileSync } from 'node:fs';
+import { join, resolve } from 'node:path';
 import { summarizeProjectStandardsInitResult, summarizeProjectStandardsUpdateResult } from '../../../services/standards/project-standards-service.js';
 import { executeProjectStandardsInitIdeAware, executeProjectStandardsUpdateIdeAware } from '../../../services/standards/ide-aware-standards-service.js';
 import { migrateStandards } from '../../../services/standards/migrate-service.js';
 import { migrateClaudeRules } from '../../../services/standards/migrate-claude-rules-service.js';
+import { lintLoopEngineeringGuidelines, EXPECTED_RED_LINE_IDS } from '../../../services/standards/loop-engineering-lint.js';
 import { fail, ok } from 'peaks-loop-shared/result';
 import { addJsonOption, getErrorMessage, printResult } from '../../cli-helpers.js';
+/** The only `--category` this subcommand implements today. */
+export const LOOP_ENGINEERING_CATEGORY = 'loop-engineering';
+/** Project-relative location of the file the `loop-engineering` lint reads. */
+export const LOOP_ENGINEERING_GUIDELINES_RELATIVE_PATH = '.peaks/standards/loop-engineering-guidelines.md';
+/**
+ * Pure helper: read the loop-engineering guideline file under `projectRoot`
+ * and lint it. Kept out of the Commander action so unit tests can drive it
+ * without spawning a child process (same shape as
+ * `runReadinessLint` in skill-loop-engineering-readiness-commands.ts).
+ */
+export function runLoopEngineeringLint(projectRoot) {
+    const root = resolve(projectRoot);
+    const guidelinePath = join(root, LOOP_ENGINEERING_GUIDELINES_RELATIVE_PATH);
+    const data = { category: LOOP_ENGINEERING_CATEGORY, path: guidelinePath, redLineCount: 0, redLineIds: [], findings: [] };
+    if (!existsSync(guidelinePath)) {
+        return {
+            ok: false,
+            code: 'LINT_FILE_NOT_FOUND',
+            message: `no ${LOOP_ENGINEERING_GUIDELINES_RELATIVE_PATH} under ${root}`,
+            data,
+            nextActions: [`Pass --project pointing at a peaks-loop checkout (the lint reads its own guideline file).`],
+        };
+    }
+    const result = lintLoopEngineeringGuidelines(readFileSync(guidelinePath, 'utf-8'));
+    const redLineIds = result.redLines.map((rl) => rl.id);
+    const fullData = { ...data, redLineCount: redLineIds.length, redLineIds };
+    if (result.ok) {
+        return {
+            ok: true,
+            code: 'STANDARDS_LINT_OK',
+            message: `${redLineIds.length} red line(s) present with all 4 sections (expected: ${EXPECTED_RED_LINE_IDS.join(', ')})`,
+            data: fullData,
+            nextActions: ['Any new red line must use the 4-section form or this lint will reject it.'],
+        };
+    }
+    return {
+        ok: false,
+        code: 'STANDARDS_LINT_FAILED',
+        message: `guideline file failed the lint (${result.findings.length} finding(s))`,
+        data: { ...fullData, findings: result.findings },
+        nextActions: [
+            'Address every finding in data.findings, then re-run the lint.',
+            'Each red line must be a `## RL-N — <title>` heading with the 4 sections: Failure modes / Rewrite / Self-check / Out-of-scope.',
+        ],
+    };
+}
 export function registerStandardsCommand(program, io) {
     const standards = program.command('standards').description('Manage project-local coding standards');
     addJsonOption(standards
@@ -92,4 +141,29 @@ export function registerStandardsCommand(program, io) {
             process.exitCode = 1;
         }
     });
+    addJsonOption(standards
+        .command('lint')
+        .description('Lint a guideline file for structural completeness (the loop-engineering red lines)')
+        .requiredOption('--category <category>', `guideline category to lint (${LOOP_ENGINEERING_CATEGORY})`)
+        .option('--project <path>', 'project root holding .peaks/standards/ (default: cwd)')).action((options) => {
+        if (options.category !== LOOP_ENGINEERING_CATEGORY) {
+            printResult(io, fail('standards.lint', 'UNKNOWN_LINT_CATEGORY', `only --category ${LOOP_ENGINEERING_CATEGORY} is implemented`, { category: options.category }, [`Pass --category ${LOOP_ENGINEERING_CATEGORY}.`]), options.json);
+            process.exitCode = 1;
+            return;
+        }
+        try {
+            const envelope = runLoopEngineeringLint(options.project ?? process.cwd());
+            const response = envelope.ok
+                ? ok('standards.lint', envelope.data, [], envelope.nextActions)
+                : fail('standards.lint', envelope.code, envelope.message, envelope.data, envelope.nextActions);
+            printResult(io, response, options.json);
+            if (!envelope.ok) {
+                process.exitCode = 1;
+            }
+        }
+        catch (error) {
+            printResult(io, fail('standards.lint', 'STANDARDS_LINT_ERROR', getErrorMessage(error), { category: options.category }, ['Verify the guideline file is readable.']), options.json);
+            process.exitCode = 1;
+        }
+    });
 }