peaks-loop 4.0.49 → 4.0.50

package/dist/services/capability-guard-runner/contracts/J06.js

@@ -1,43 +1,61 @@
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-// v2: existence is the primary check; the single fragment is best-effort.
-// v1 required 3 strict fragments (deepestGate / resume / etc.) and was too strict for
-// 4.0.8 — the actual resume service uses camelCase variants and lives under session/.
-const CANDIDATE_FILES = [
-    'src/services/resume/resume-service.ts',
-    'src/services/resume/resume-types.ts',
-    'src/services/session/session-resume-service.ts',
-    'src/services/session/session-checkpoint-service.ts'
-];
+import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { classifyResume } from '../../skill/resume-detector.js';
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+const SESSION_ID = '2026-09-15-guard-j06';
+function write(sessionDir, relative, body) {
+    const abs = join(sessionDir, relative);
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(abs, body);
+}
+function request(body) {
+    return `# request\n\n## Status\n\n- state: ${body}\n`;
+}
+/**
+ * Behavioural probe for "the resume option always identifies the DEEPEST
+ * completed gate".
+ *
+ * The load-bearing part is that the SAME fixture is walked from shallow to
+ * deep: with only a PRD request the classifier must stop at `rd-planning`;
+ * the moment a deeper RD `qa-handoff` request appears (with its review
+ * artifacts) the point must move to `qa-validation`; adding the txt handoff
+ * must end the workflow. A classifier that returned a constant point, or that
+ * looked at file existence alone, cannot track that progression.
+ *
+ * The old check asserted that a file named `session-resume-service.ts` exists
+ * and contains the word "resume" — which the filename already guarantees.
+ */
 export async function runJ06Contract(ctx) {
-    const existing = CANDIDATE_FILES.filter((f) => existsSync(join(ctx.projectRoot, f)));
-    if (existing.length === 0) {
-        return {
-            journeyId: 'J06',
-            contract: 'workflow-trace',
-            status: 'fail',
-            diff: { before: 'a resume service file exists', after: 'none of the candidates found', reason: 'J06#1 broken: no resume service file is present' },
-            artifactPath: 'src/services/resume/'
-        };
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const root = mkdtempSync(join(tmpdir(), 'cbl-J06-'));
+    const peaksRoot = join(root, '_runtime');
+    const sessionDir = join(peaksRoot, SESSION_ID);
+    mkdirSync(sessionDir, { recursive: true });
+    try {
+        write(sessionDir, 'prd/requests/001-shallow.md', request('handed-off'));
+        const shallow = classifyResume(SESSION_ID, peaksRoot);
+        // `ridOf()` strips the `NNN-` index prefix, so the review artifacts are
+        // keyed by `deeper`, not `001-deeper`.
+        write(sessionDir, 'rd/requests/001-deeper.md', request('qa-handoff'));
+        write(sessionDir, 'rd/code-review-deeper.md', '# code review\n');
+        write(sessionDir, 'audit/security-deeper.md', '# security\n');
+        const deeper = classifyResume(SESSION_ID, peaksRoot);
+        write(sessionDir, 'txt/handoff.md', '# handoff\n');
+        const done = classifyResume(SESSION_ID, peaksRoot);
+        const result = combineProbes([
+            probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+            probe(shallow.kind === 'resume' && shallow.point === 'rd-planning', `shallow fixture resumes at rd-planning (saw kind=${shallow.kind} point=${String(shallow.point)})`),
+            probe(deeper.kind === 'resume' && deeper.point === 'qa-validation', `adding an RD qa-handoff request moves the point DEEPER to qa-validation (saw kind=${deeper.kind} point=${String(deeper.point)})`),
+            probe(done.kind === 'complete', `adding txt/handoff.md marks the workflow complete (saw kind=${done.kind} point=${String(done.point)})`)
+        ]);
+        const artifact = row.sourceFiles[0] ?? 'src/services/skill/resume-detector.ts';
+        if (result.ok)
+            return pass(ctx, artifact);
+        return fail(ctx, artifact, 'resume identifies the deepest completed gate (rd-planning → qa-validation → complete)', result.detail, 'J06 invariant broken: resume no longer tracks the deepest completed gate');
     }
-    // Soft check: at least one existing file mentions "resume".
-    const mentionsResume = existing.some((f) => {
-        const src = readFileSync(join(ctx.projectRoot, f), 'utf8');
-        return src.toLowerCase().includes('resume');
-    });
-    if (!mentionsResume) {
-        return {
-            journeyId: 'J06',
-            contract: 'workflow-trace',
-            status: 'fail',
-            diff: { before: 'resume service files mention "resume"', after: 'none mention resume', reason: 'J06#1 broken: resume service files do not reference the resume concept' },
-            artifactPath: existing[0]
-        };
+    finally {
+        rmSync(root, { recursive: true, force: true });
     }
-    return {
-        journeyId: 'J06',
-        contract: 'workflow-trace',
-        status: 'pass',
-        artifactPath: existing[0]
-    };
 }

package/dist/services/capability-guard-runner/contracts/J07.d.ts

@@ -1,2 +1,11 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * Behavioural probe of the (mtime, sha256) gate.
+ *
+ * A cache entry is written for a passing test, then the file's CONTENT is
+ * changed while its mtime is restored to the original value. If the gate ever
+ * degraded to an mtime-only (or filename-only) check, the cache would report a
+ * hit for a file whose bytes changed — exactly the fake-green the invariant
+ * forbids. The mtime-only and status gates are probed the same way.
+ */
 export declare function runJ07Contract(ctx: GuardContext): Promise<GuardRunResult>;

package/dist/services/capability-guard-runner/contracts/J07.js

@@ -1,54 +1,83 @@
-import { execFileSync } from 'node:child_process';
-import { existsSync, readFileSync } from 'node:fs';
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-// v2: existence-of-CLI + source-contains-vitest, not actual invocation.
-// v1 failed with `spawn vitest ENOENT` because the test runner spawns a child vitest
-// that needs `pnpm`/PATH configured; the test fixture doesn't have that. A dry-run
-// probe is enough to prove the `peaks test` subcommand is registered and the runner
-// is wired to vitest, without actually executing a vitest child process.
-const TEST_COMMAND_FILES = [
-    'src/cli/commands/test-commands.ts',
-    'src/services/test/',
-    'src/services/test-runner/'
-];
-export async function runJ07Contract(ctx) {
-    // 1. CLI probe: `peaks test --help` must produce non-empty output.
-    let helpOk = false;
+import { TEST_CACHE_DIR, isCacheable, mtimeOfFile, readTestCache, recordTestResult, sha256OfFile, testCacheDir, writeTestCache } from '../../test-cache/test-cache-service.js';
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+const TEST_NAME = 'fingerprint probe';
+/** Highest vitest major the frozen baseline allows ("MUST NOT be locked at 5.x"). */
+const MAX_VITEST_MAJOR = 4;
+function vitestMajor(projectRoot) {
     try {
-        const bin = join(ctx.projectRoot, 'bin', 'peaks.js');
-        const out = execFileSync('node', [bin, 'test', '--help'], {
-            cwd: ctx.projectRoot,
-            env: { ...process.env, PEAKS_CALLER_ID: `guard-J07-${ctx.sessionId}` },
-            stdio: ['ignore', 'pipe', 'pipe'],
-            windowsHide: true
-        }).toString('utf8');
-        helpOk = out.length > 0 && !out.includes('unknown command');
+        const pkg = JSON.parse(readFileSync(join(projectRoot, 'package.json'), 'utf8'));
+        const raw = pkg.devDependencies?.['vitest'] ?? pkg.dependencies?.['vitest'];
+        if (typeof raw !== 'string')
+            return null;
+        const major = /(\d+)/.exec(raw);
+        return major === null ? null : Number(major[1]);
     }
     catch {
-        helpOk = false;
+        return null;
+    }
+}
+/**
+ * Behavioural probe of the (mtime, sha256) gate.
+ *
+ * A cache entry is written for a passing test, then the file's CONTENT is
+ * changed while its mtime is restored to the original value. If the gate ever
+ * degraded to an mtime-only (or filename-only) check, the cache would report a
+ * hit for a file whose bytes changed — exactly the fake-green the invariant
+ * forbids. The mtime-only and status gates are probed the same way.
+ */
+export async function runJ07Contract(ctx) {
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const root = mkdtempSync(join(tmpdir(), 'cbl-J07-'));
+    const file = join(root, 'probe.test.ts');
+    try {
+        writeFileSync(file, 'export const a = 1;\n');
+        recordTestResult(root, file, 'vitest', {
+            testName: TEST_NAME,
+            status: 'passed',
+            durationMs: 1,
+            lastRun: new Date().toISOString()
+        });
+        const baseline = isCacheable(root, file, TEST_NAME);
+        const cached = readTestCache(root, file);
+        // Gate 1, isolated: the file's bytes change but the recorded mtime is
+        // up-to-date, so ONLY the sha check can catch it. If the gate degraded to
+        // an mtime-only check this reports a hit for a file nobody verified.
+        writeFileSync(file, 'export const a = 2;\n');
+        writeTestCache(root, { ...cached, fileMtime: mtimeOfFile(file) });
+        const afterSilentEdit = isCacheable(root, file, TEST_NAME);
+        // Gate 2, isolated: the sha is up-to-date but the recorded mtime is stale.
+        writeTestCache(root, { ...cached, fileSha256: sha256OfFile(file), fileMtime: cached.fileMtime - 5_000 });
+        const afterTouch = isCacheable(root, file, TEST_NAME);
+        // A non-passing status must never be served as a hit.
+        recordTestResult(root, file, 'vitest', {
+            testName: 'skipped probe',
+            status: 'skipped',
+            durationMs: 0,
+            lastRun: new Date().toISOString()
+        });
+        const skipped = isCacheable(root, file, 'skipped probe');
+        const unknown = isCacheable(root, file, 'never recorded');
+        const major = vitestMajor(ctx.projectRoot);
+        const result = combineProbes([
+            probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+            probe(baseline.hit, `an unchanged passing test is a cache hit (reason=${String(baseline.reason)})`),
+            probe(!afterSilentEdit.hit && afterSilentEdit.reason === 'sha-changed', `a same-mtime content edit is NOT a hit (hit=${String(afterSilentEdit.hit)} reason=${String(afterSilentEdit.reason)})`),
+            probe(!afterTouch.hit && afterTouch.reason === 'mtime-changed', `a touched file is NOT a hit (hit=${String(afterTouch.hit)} reason=${String(afterTouch.reason)})`),
+            probe(!skipped.hit && skipped.reason === 'previous-skipped', `a previously skipped test is NOT a hit (hit=${String(skipped.hit)} reason=${String(skipped.reason)})`),
+            probe(!unknown.hit && unknown.reason === 'no-cache', `an unrecorded test is NOT a hit (reason=${String(unknown.reason)})`),
+            probe(testCacheDir(ctx.projectRoot).replace(/\\/g, '/').endsWith(`.peaks/_runtime/${TEST_CACHE_DIR}`), `the cache writes under .peaks/_runtime/${TEST_CACHE_DIR} (got ${testCacheDir(ctx.projectRoot)})`),
+            probe(major !== null && major <= MAX_VITEST_MAJOR, `vitest major is <= ${String(MAX_VITEST_MAJOR)} (saw ${String(major)})`)
+        ]);
+        const artifact = row.sourceFiles[1] ?? 'src/services/test-cache/test-cache-service.ts';
+        if (result.ok)
+            return pass(ctx, artifact);
+        return fail(ctx, artifact, 'the per-test fingerprint cache only serves a hit for a file whose mtime AND sha256 are unchanged and whose last status passed', result.detail, 'J07 invariant broken: the fingerprint cache can return passed for an unverified file');
     }
-    // 2. Source probe: at least one test command file references vitest.
-    const sourceMentionsVitest = TEST_COMMAND_FILES.some((f) => {
-        const abs = join(ctx.projectRoot, f);
-        if (!existsSync(abs))
-            return false;
-        if (existsSync(abs) && readFileSync(abs, 'utf8').includes('vitest'))
-            return true;
-        return false;
-    });
-    // 3. package.json probe: vitest is in dependencies.
-    const pkgPath = join(ctx.projectRoot, 'package.json');
-    let pkgHasVitest = false;
-    if (existsSync(pkgPath)) {
-        const pkg = readFileSync(pkgPath, 'utf8');
-        pkgHasVitest = /"vitest"\s*:/i.test(pkg);
+    finally {
+        rmSync(root, { recursive: true, force: true });
     }
-    const ok = helpOk && sourceMentionsVitest && pkgHasVitest;
-    return {
-        journeyId: 'J07',
-        contract: 'cli-output-golden',
-        status: ok ? 'pass' : 'fail',
-        ...(ok ? {} : { diff: { before: 'peaks test --help works, test commands reference vitest, package.json has vitest', after: `helpOk=${helpOk} sourceMentionsVitest=${sourceMentionsVitest} pkgHasVitest=${pkgHasVitest}`, reason: 'J07#1 broken: peaks test does not delegate to vitest' } }),
-        artifactPath: 'src/cli/commands/test-commands.ts'
-    };
 }

package/dist/services/capability-guard-runner/contracts/J08.d.ts

@@ -1,2 +1,13 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * Behavioural probe of the crystallization gate.
+ *
+ * Before this the contract only asserted that one of three candidate files
+ * exists and mentions "crystalliz"/"sediment"/"promot" — the file it found is
+ * named `crystallization-service.ts`, so the check restated its own filename.
+ *
+ * Here the real gate is driven with a completed and an incomplete task state:
+ * a task whose `gates_passed` is false must be refused at the Zod boundary AND
+ * again at the service boundary.
+ */
 export declare function runJ08Contract(ctx: GuardContext): Promise<GuardRunResult>;

package/dist/services/capability-guard-runner/contracts/J08.js

@@ -1,43 +1,70 @@
-// src/services/capability-guard-runner/contracts/J08.ts
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-// v2: existence is the primary check; a single soft fragment is best-effort.
-// v1 required 3 strict fragments (regressionSkeptic/independentEval/promote) that
-// do not all appear in the actual 4.0.8 crystallization service.
-const CANDIDATE_FILES = [
-    'src/services/crystallization/crystallization-service.ts',
-    'src/services/asset-crystallize/crystallization-service.ts',
-    'src/services/evolution/evolution-service.ts'
-];
+import Database from 'better-sqlite3';
+import { CrystallizationIntegrityError, CrystallizationService, CrystallizationTaskStateSchema } from '../../crystallization/crystallization-service.js';
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+/** Test doubles: `assertReady` never reaches any of them. */
+function probeService() {
+    const noop = () => undefined;
+    const opts = {
+        loopReleaseSchema: { parse: (input) => input },
+        loopBeeRelationSchema: { parse: (input) => input, omit: () => ({ parse: (input) => input }) },
+        insertLoopRelease: noop,
+        insertLoopBeeRelation: noop
+    };
+    return new CrystallizationService(new Database(':memory:'), opts);
+}
+/**
+ * Behavioural probe of the crystallization gate.
+ *
+ * Before this the contract only asserted that one of three candidate files
+ * exists and mentions "crystalliz"/"sediment"/"promot" — the file it found is
+ * named `crystallization-service.ts`, so the check restated its own filename.
+ *
+ * Here the real gate is driven with a completed and an incomplete task state:
+ * a task whose `gates_passed` is false must be refused at the Zod boundary AND
+ * again at the service boundary.
+ */
 export async function runJ08Contract(ctx) {
-    const existing = CANDIDATE_FILES.filter((f) => existsSync(join(ctx.projectRoot, f)));
-    if (existing.length === 0) {
-        return {
-            journeyId: 'J08',
-            contract: 'asset-roundtrip',
-            status: 'fail',
-            diff: { before: 'a crystallization/evolution service exists', after: 'no candidate found', reason: 'J08#1 broken: no sediment/promotion service is present' },
-            artifactPath: 'src/services/crystallization/'
-        };
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const ready = { task_id: 'guard-J08', task_status: 'completed', gates_passed: true, evidence_collected: true };
+    const schemaAcceptsReady = CrystallizationTaskStateSchema.safeParse(ready).success;
+    const schemaRejectsGatesFalse = !CrystallizationTaskStateSchema.safeParse({ ...ready, gates_passed: false }).success;
+    const schemaRejectsNotCompleted = !CrystallizationTaskStateSchema.safeParse({ ...ready, task_status: 'in_progress' }).success;
+    const schemaRejectsNoEvidence = !CrystallizationTaskStateSchema.safeParse({ ...ready, evidence_collected: false }).success;
+    const svc = probeService();
+    let serviceAcceptsReady = false;
+    try {
+        serviceAcceptsReady = svc.assertReady(ready).task_id === 'guard-J08';
     }
-    // Soft check: at least one existing file mentions crystallization, sediment, or promotion.
-    const primary = existing.some((f) => {
-        const src = readFileSync(join(ctx.projectRoot, f), 'utf8').toLowerCase();
-        return src.includes('crystallization') || src.includes('sediment') || src.includes('promot');
-    });
-    if (!primary) {
-        return {
-            journeyId: 'J08',
-            contract: 'asset-roundtrip',
-            status: 'fail',
-            diff: { before: 'crystallization service references sediment/promotion', after: 'no service mentions any of them', reason: 'J08#1 broken: crystallization service is not wired to sediment' },
-            artifactPath: existing[0]
-        };
+    catch {
+        serviceAcceptsReady = false;
     }
-    return {
-        journeyId: 'J08',
-        contract: 'asset-roundtrip',
-        status: 'pass',
-        artifactPath: existing[0]
-    };
+    const refused = [];
+    const badStates = [
+        ['gates_passed=false', { ...ready, gates_passed: false }],
+        ['task_status=in_progress', { ...ready, task_status: 'in_progress' }],
+        ['evidence_collected=false', { ...ready, evidence_collected: false }]
+    ];
+    for (const [label, task] of badStates) {
+        try {
+            svc.assertReady(task);
+        }
+        catch (e) {
+            if (e instanceof CrystallizationIntegrityError)
+                refused.push(label);
+        }
+    }
+    const result = combineProbes([
+        probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+        probe(schemaAcceptsReady, 'a completed, gate-passed, evidenced task passes the schema'),
+        probe(schemaRejectsGatesFalse, 'gates_passed=false is refused by the schema'),
+        probe(schemaRejectsNotCompleted, 'task_status!=completed is refused by the schema'),
+        probe(schemaRejectsNoEvidence, 'evidence_collected=false is refused by the schema'),
+        probe(serviceAcceptsReady, 'the service accepts a ready task'),
+        probe(refused.length === 3, `the service refuses every non-passing gate state with CrystallizationIntegrityError (refused: ${refused.join(', ') || 'none'})`)
+    ]);
+    const artifact = row.sourceFiles[0] ?? 'src/services/crystallization/crystallization-service.ts';
+    if (result.ok)
+        return pass(ctx, artifact);
+    return fail(ctx, artifact, 'crystallization refuses any task whose gates are not in a passing state', result.detail, 'J08 invariant broken: crystallization no longer enforces the pre-run gate');
 }

package/dist/services/capability-guard-runner/contracts/J09.d.ts

@@ -1,2 +1,15 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * Behavioural probe of the SOP id guard and the lint-before-register ordering.
+ *
+ * The previous version listed five SOP files and passed if any of them
+ * mentioned "sop", "gate" or "register" — every file in the list is named
+ * `sop-*.ts`, so the check could not fail.
+ *
+ * Here the real `initSop` / `registerSop` path runs against a tmp project:
+ * path-traversal and reserved ids must be refused, and a manifest that fails
+ * lint must stop the registration BEFORE `registry.json` is written. The
+ * positive control (a clean manifest DOES register) is what makes the negative
+ * assertion mean something.
+ */
 export declare function runJ09Contract(ctx: GuardContext): Promise<GuardRunResult>;

package/dist/services/capability-guard-runner/contracts/J09.js

@@ -1,44 +1,100 @@
-// src/services/capability-guard-runner/contracts/J09.ts
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-// v2: existence + soft fragment. v1 required 3 strict fragments (gate/checkable/register)
-// that don't all appear in every SOP service file in 4.0.8.
-const CANDIDATE_FILES = [
-    'src/services/sop/sop-service.ts',
-    'src/services/sop/sop-register.ts',
-    'src/services/sop/sop-check-service.ts',
-    'src/services/sop/sop-registry-service.ts',
-    'src/services/sop/sop-types.ts'
-];
+import { initSop } from '../../sop/sop-service.js';
+import { SOP_ID_PATTERN } from '../../sop/sop-types.js';
+import { registerSop, SopRegisterError } from '../../sop/sop-registry-service.js';
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+const VALID_ID = 'guard-demo';
+function registryPath(projectRoot) {
+    return join(projectRoot, '.peaks', 'sops', 'registry.json');
+}
+/**
+ * Behavioural probe of the SOP id guard and the lint-before-register ordering.
+ *
+ * The previous version listed five SOP files and passed if any of them
+ * mentioned "sop", "gate" or "register" — every file in the list is named
+ * `sop-*.ts`, so the check could not fail.
+ *
+ * Here the real `initSop` / `registerSop` path runs against a tmp project:
+ * path-traversal and reserved ids must be refused, and a manifest that fails
+ * lint must stop the registration BEFORE `registry.json` is written. The
+ * positive control (a clean manifest DOES register) is what makes the negative
+ * assertion mean something.
+ */
 export async function runJ09Contract(ctx) {
-    const existing = CANDIDATE_FILES.filter((f) => existsSync(join(ctx.projectRoot, f)));
-    if (existing.length === 0) {
-        return {
-            journeyId: 'J09',
-            contract: 'sop-register',
-            status: 'fail',
-            diff: { before: 'a SOP service file exists', after: 'no candidate found', reason: 'J09#1 broken: no SOP service is present' },
-            artifactPath: 'src/services/sop/'
-        };
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const root = mkdtempSync(join(tmpdir(), 'cbl-J09-'));
+    try {
+        const patternRejects = ['a.b', 'a/b', '../escape', 'Bad-Id', ''].every((id) => !SOP_ID_PATTERN.test(id));
+        const patternAccepts = ['demo', 'my-sop', 'a', 'sop2'].every((id) => SOP_ID_PATTERN.test(id));
+        const reservedRefused = [];
+        for (const id of ['peaks-x', 'peaks']) {
+            try {
+                await initSop({ id, projectRoot: root, apply: true });
+            }
+            catch (e) {
+                if (/reserved/i.test(e.message))
+                    reservedRefused.push(id);
+            }
+        }
+        let traversalRefused = false;
+        try {
+            await initSop({ id: '../escape', projectRoot: root, apply: true });
+        }
+        catch (e) {
+            traversalRefused = /invalid sop id|pattern|kebab/i.test(e.message);
+        }
+        // Positive control: a real SOP initialises and registers cleanly.
+        let cleanRegisters = false;
+        let registerError = '';
+        try {
+            await initSop({ id: VALID_ID, projectRoot: root, apply: true });
+            const reg = await registerSop({ id: VALID_ID, projectRoot: root });
+            cleanRegisters = reg.applied === true && existsSync(registryPath(root));
+        }
+        catch (e) {
+            registerError = `${e.name}: ${e.message.slice(0, 140)}`;
+        }
+        // Negative control: break the manifest so lint must fail, then register.
+        let dirtyRefused = false;
+        let dirtyCode = 'none';
+        rmSync(registryPath(root), { force: true });
+        const manifestPath = join(root, '.peaks', 'sops', VALID_ID, 'sop.json');
+        if (existsSync(manifestPath)) {
+            const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+            manifest['id'] = 'not-the-directory-id';
+            writeFileSync(manifestPath, JSON.stringify(manifest, null, 2));
+        }
+        else {
+            mkdirSync(join(root, '.peaks', 'sops', VALID_ID), { recursive: true });
+            writeFileSync(manifestPath, JSON.stringify({ id: 'not-the-directory-id', name: 'x', phases: ['p'], gates: [] }));
+        }
+        try {
+            await registerSop({ id: VALID_ID, projectRoot: root });
+        }
+        catch (e) {
+            dirtyCode = e instanceof SopRegisterError ? e.code : e.name;
+            dirtyRefused = dirtyCode === 'SOP_INVALID';
+        }
+        const wroteRegistryDespiteLintFailure = existsSync(registryPath(root));
+        const result = combineProbes([
+            probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+            probe(patternRejects, 'SOP_ID_PATTERN rejects dots, slashes, traversal and empty ids'),
+            probe(patternAccepts, 'SOP_ID_PATTERN accepts lowercase kebab ids'),
+            probe(reservedRefused.length === 2, `reserved ids are refused (refused: ${reservedRefused.join(',') || 'none'})`),
+            probe(traversalRefused, "initSop refuses '../escape'"),
+            probe(cleanRegisters, `a clean SOP registers and writes registry.json${registerError ? ` [${registerError}]` : ''}`),
+            probe(dirtyRefused, `a manifest that fails lint is refused with SOP_INVALID (saw ${dirtyCode})`),
+            probe(!wroteRegistryDespiteLintFailure, 'lint failure halts registration before registry.json is written')
+        ]);
+        const artifact = row.sourceFiles[0] ?? 'src/services/sop/sop-service.ts';
+        if (result.ok)
+            return pass(ctx, artifact);
+        return fail(ctx, artifact, 'SOP ids are pattern-guarded and lintSop() gates registerSop()', result.detail, 'J09 invariant broken: the SOP id guard or the lint-before-register ordering no longer holds');
     }
-    // Soft check: at least one existing file mentions sop, gate, or register.
-    const primary = existing.some((f) => {
-        const src = readFileSync(join(ctx.projectRoot, f), 'utf8').toLowerCase();
-        return src.includes('sop') || src.includes('gate') || src.includes('register');
-    });
-    if (!primary) {
-        return {
-            journeyId: 'J09',
-            contract: 'sop-register',
-            status: 'fail',
-            diff: { before: 'SOP service references sop/gate/register', after: 'no service mentions any of them', reason: 'J09#1 broken: SOP service is not wired to gate-able registration' },
-            artifactPath: existing[0]
-        };
+    finally {
+        rmSync(root, { recursive: true, force: true });
     }
-    return {
-        journeyId: 'J09',
-        contract: 'sop-register',
-        status: 'pass',
-        artifactPath: existing[0]
-    };
 }

package/dist/services/capability-guard-runner/contracts/J10.d.ts

@@ -1,2 +1,14 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * Behavioural probe of "a plan is produced before anything is written, so the
+ * diff is reviewable".
+ *
+ * The previous version listed four hook/IDE files and passed if any of them
+ * contained the word "hook", "install", "ide" or "adapter" — `hooks-commands.ts`
+ * satisfies that from its own filename.
+ *
+ * Here `planHookInstall` runs against a fresh tmp project and the settings file
+ * must NOT appear; `applyHookInstall` then writes it, and a second apply must
+ * be a no-op that does not duplicate the entry.
+ */
 export declare function runJ10Contract(ctx: GuardContext): Promise<GuardRunResult>;