peaks-loop 4.0.49 → 4.0.51

package/dist/services/capability-guard-runner/contracts/J10.js

@@ -1,40 +1,74 @@
-// src/services/capability-guard-runner/contracts/J10.ts
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-const CANDIDATE_FILES = [
-    'src/cli/commands/hooks-commands.ts',
-    'src/cli/commands/ide-commands.ts',
-    'src/cli/commands/hook-handle.ts',
-    'src/hooks/pre-tool-use-sub-agent.ts'
-];
+import { applyHookInstall, planHookInstall } from '../../skills/hooks-settings-service.js';
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+import { normalizePath } from '../../../shared/path-utils.js';
+function countOccurrences(haystack, needle) {
+    if (needle.length === 0)
+        return 0;
+    let count = 0;
+    let from = 0;
+    for (;;) {
+        const at = haystack.indexOf(needle, from);
+        if (at < 0)
+            return count;
+        count += 1;
+        from = at + needle.length;
+    }
+}
+/**
+ * Behavioural probe of "a plan is produced before anything is written, so the
+ * diff is reviewable".
+ *
+ * The previous version listed four hook/IDE files and passed if any of them
+ * contained the word "hook", "install", "ide" or "adapter" — `hooks-commands.ts`
+ * satisfies that from its own filename.
+ *
+ * Here `planHookInstall` runs against a fresh tmp project and the settings file
+ * must NOT appear; `applyHookInstall` then writes it, and a second apply must
+ * be a no-op that does not duplicate the entry.
+ */
 export async function runJ10Contract(ctx) {
-    const existing = CANDIDATE_FILES.filter((f) => existsSync(join(ctx.projectRoot, f)));
-    if (existing.length === 0) {
-        return {
-            journeyId: 'J10',
-            contract: 'hook-assertion',
-            status: 'fail',
-            diff: { before: 'a hooks/ide/handle CLI file exists', after: 'no candidate found', reason: 'J10#1 broken: no IDE install/hook infrastructure is present' },
-            artifactPath: 'src/cli/commands/hooks-commands.ts'
-        };
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const root = mkdtempSync(join(tmpdir(), 'cbl-J10-'));
+    try {
+        const plan = planHookInstall('project', root);
+        const settingsPath = plan.settingsPath;
+        const plannedInsideProject = normalizePath(settingsPath).startsWith(normalizePath(root));
+        const planIsReadOnly = !existsSync(settingsPath);
+        const freshProjectNotInstalled = plan.exists === false && plan.alreadyInstalled === false;
+        // Each managed hook entry is identified by its own sentinel; every one of
+        // them must land exactly once and stay at one across a re-apply.
+        const sentinels = plan.entryTargets.filter((t) => t.settingsPath === settingsPath).map((t) => t.sentinel);
+        const countsNow = () => existsSync(settingsPath) ? sentinels.map((s) => countOccurrences(readFileSync(settingsPath, 'utf8'), s)) : [];
+        const first = applyHookInstall('project', root);
+        const fileWritten = existsSync(settingsPath);
+        const installedCounts = countsNow();
+        const sentinelCount = installedCounts.length > 0 ? installedCounts[0] : -1;
+        const second = applyHookInstall('project', root);
+        const afterSecondApply = countsNow().length > 0 ? countsNow()[0] : -1;
+        const planAfterApply = planHookInstall('project', root);
+        const result = combineProbes([
+            probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+            probe(plannedInsideProject, `the plan targets a settings file inside the project (${settingsPath})`),
+            probe(freshProjectNotInstalled, 'a fresh project reports exists=false / alreadyInstalled=false'),
+            probe(planIsReadOnly, 'planning does not create the settings file — the diff is reviewable first'),
+            probe(first.applied === true, 'apply reports applied=true'),
+            probe(fileWritten, 'apply writes the settings file'),
+            probe(sentinels.length > 0, `the plan enumerates managed hook entries (${String(sentinels.length)})`),
+            probe(installedCounts.length > 0 && installedCounts.every((c) => c === 1), `apply installs every managed entry exactly once (counts=${installedCounts.join(',') || 'none'})`),
+            probe(second.applied === false, `a second apply is a no-op (applied=${String(second.applied)}, first sentinel count=${String(sentinelCount)})`),
+            probe(afterSecondApply === 1, `a duplicate apply does not duplicate the entry (count=${String(afterSecondApply)})`),
+            probe(planAfterApply.alreadyInstalled === true, 'the plan reports alreadyInstalled=true after a successful apply')
+        ]);
+        const artifact = row.sourceFiles[0] ?? 'src/services/skills/hooks-settings-service.ts';
+        if (result.ok)
+            return pass(ctx, artifact);
+        return fail(ctx, artifact, 'planHookInstall() produces a reviewable plan before applyHookInstall() writes, and re-applying is a no-op', result.detail, 'J10 invariant broken: hook install is no longer plan-then-apply, or is not idempotent');
     }
-    const primary = existing.some((f) => {
-        const src = readFileSync(join(ctx.projectRoot, f), 'utf8').toLowerCase();
-        return src.includes('hook') || src.includes('install') || src.includes('ide') || src.includes('adapter');
-    });
-    if (!primary) {
-        return {
-            journeyId: 'J10',
-            contract: 'hook-assertion',
-            status: 'fail',
-            diff: { before: 'hooks/ide commands reference install/hook/ide/adapter', after: 'no such reference', reason: 'J10#1 broken: hooks/ide commands do not implement install/hook/ide/adapter' },
-            artifactPath: existing[0]
-        };
+    finally {
+        rmSync(root, { recursive: true, force: true });
     }
-    return {
-        journeyId: 'J10',
-        contract: 'hook-assertion',
-        status: 'pass',
-        artifactPath: existing[0]
-    };
 }

package/dist/services/capability-guard-runner/contracts/J11.d.ts

@@ -1,2 +1,10 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * Behavioural probe of "doctor checks live under a code-driven fixed-registry
+ * tree, and each openspec change is generated from a real doctor finding".
+ *
+ * The previous version listed doctor/audit/openspec files and passed if any of
+ * them mentioned "doctor", "audit", "openspec" or "health" — `doctor-service.ts`
+ * satisfies that from its own filename.
+ */
 export declare function runJ11Contract(ctx: GuardContext): Promise<GuardRunResult>;

package/dist/services/capability-guard-runner/contracts/J11.js

@@ -1,39 +1,79 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, mkdtempSync, readdirSync, readFileSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-const CANDIDATE_FILES = [
-    'src/services/doctor/doctor-service.ts',
-    'src/services/audit/audit-service.ts',
-    'src/cli/commands/openspec-commands.ts',
-    'src/services/openspec/openspec-propose-from-doctor-service.ts'
+import { PLUGINS } from '../../doctor/doctor-service/plugin-registry.js';
+import { proposeFromDoctor } from '../../openspec/openspec-propose-from-doctor-service.js';
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+const CHECKS_DIR = ['src', 'services', 'doctor', 'doctor-service', 'checks'];
+const LEGACY_SHIM = ['src', 'services', 'doctor', 'doctor-service.ts'];
+const FROZEN_CLOCK = () => '2020-01-01T00:00:00.000Z';
+/** Strip block + line comments so only executable lines remain. */
+function executableLines(source) {
+    return source
+        .replace(/\/\*[\s\S]*?\*\//g, '')
+        .split('\n')
+        .map((line) => line.replace(/\/\/.*$/, '').trim())
+        .filter((line) => line.length > 0);
+}
+/**
+ * Constructs a re-export-only shim must not contain. `export * from` /
+ * `export { a, b } from` / `export type { ... }` are the only allowed forms;
+ * anything below means logic moved back into the legacy path.
+ */
+const FORBIDDEN_SHIM_PATTERNS = [
+    /\bfunction\b/,
+    /\breturn\b/,
+    /\bif\s*\(/,
+    /\bfor\s*\(/,
+    /\bwhile\s*\(/,
+    /\bconst\s+\w+\s*=/,
+    /=>\s*\{/
 ];
+/**
+ * Behavioural probe of "doctor checks live under a code-driven fixed-registry
+ * tree, and each openspec change is generated from a real doctor finding".
+ *
+ * The previous version listed doctor/audit/openspec files and passed if any of
+ * them mentioned "doctor", "audit", "openspec" or "health" — `doctor-service.ts`
+ * satisfies that from its own filename.
+ */
 export async function runJ11Contract(ctx) {
-    const existing = CANDIDATE_FILES.filter((f) => existsSync(join(ctx.projectRoot, f)));
-    if (existing.length === 0) {
-        return {
-            journeyId: 'J11',
-            contract: 'cli-output-golden',
-            status: 'fail',
-            diff: { before: 'a doctor/audit/openspec service exists', after: 'no candidate found', reason: 'J11#1 broken: no doctor surface is present' },
-            artifactPath: 'src/services/doctor/doctor-service.ts'
-        };
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const checksDirAbs = join(ctx.projectRoot, ...CHECKS_DIR);
+    const checkFiles = existsSync(checksDirAbs) ? readdirSync(checksDirAbs).filter((f) => f.endsWith('.ts')) : [];
+    const pluginIds = PLUGINS.map((p) => p.name);
+    const uniquePluginIds = new Set(pluginIds);
+    const shimAbs = join(ctx.projectRoot, ...LEGACY_SHIM);
+    const shimSource = existsSync(shimAbs) ? readFileSync(shimAbs, 'utf8') : '';
+    const shimLines = executableLines(shimSource);
+    const shimLogic = shimLines.filter((line) => FORBIDDEN_SHIM_PATTERNS.some((re) => re.test(line)));
+    const shimReexports = /export\s+(\*|\{[\s\S]*?\}|type\s*\{[\s\S]*?\})\s*from\s*'/.test(shimSource);
+    const shimIsReexportOnly = shimLines.length > 0 && shimLogic.length === 0 && shimReexports;
+    const root = mkdtempSync(join(tmpdir(), 'cbl-J11-'));
+    try {
+        const finding = { id: 'L3:l3-memory-health', rule: 'r', detail: 'd', severity: 'fail' };
+        const first = proposeFromDoctor({ projectRoot: root, finding, clock: FROZEN_CLOCK });
+        const second = proposeFromDoctor({ projectRoot: root, finding, clock: FROZEN_CLOCK });
+        const proposalMentionsFinding = existsSync(first.proposalPath)
+            ? readFileSync(first.proposalPath, 'utf8').includes(finding.id)
+            : false;
+        const result = combineProbes([
+            probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+            probe(checkFiles.length > 0 && PLUGINS.length === checkFiles.length, `the plugin registry enumerates every check module (${String(PLUGINS.length)} plugins / ${String(checkFiles.length)} checks)`),
+            probe(uniquePluginIds.size === PLUGINS.length, `plugin ids are unique (${String(uniquePluginIds.size)}/${String(PLUGINS.length)})`),
+            probe(shimIsReexportOnly, `the legacy doctor-service.ts shim holds no logic (${String(shimLines.length)} executable lines, ${String(shimLogic.length)} with logic${shimLogic.length > 0 ? `: ${shimLogic.slice(0, 3).join(' | ')}` : ''})`),
+            probe(first.changeId === '2020-01-01-fix-l3-l3-memory-health', `the change id is derived from the doctor finding (${first.changeId})`),
+            probe(first.created === true, 'the first proposal is created'),
+            probe(proposalMentionsFinding, 'the proposal names the originating finding id'),
+            probe(second.created === false, 'regenerating from the same finding is idempotent (created=false)')
+        ]);
+        const artifact = row.sourceFiles[0] ?? 'src/services/doctor/doctor-service/index.ts';
+        if (result.ok)
+            return pass(ctx, artifact);
+        return fail(ctx, artifact, 'doctor checks are a code-driven fixed-registry tree and openspec changes come from real findings', result.detail, 'J11 invariant broken: the doctor check registry or the finding-to-change conversion no longer holds');
     }
-    const primary = existing.some((f) => {
-        const src = readFileSync(join(ctx.projectRoot, f), 'utf8').toLowerCase();
-        return src.includes('doctor') || src.includes('audit') || src.includes('openspec') || src.includes('health');
-    });
-    if (!primary) {
-        return {
-            journeyId: 'J11',
-            contract: 'cli-output-golden',
-            status: 'fail',
-            diff: { before: 'doctor/audit/openspec references health/audit/openspec', after: 'no such reference', reason: 'J11#1 broken: doctor/audit/openspec services are not wired' },
-            artifactPath: existing[0]
-        };
+    finally {
+        rmSync(root, { recursive: true, force: true });
     }
-    return {
-        journeyId: 'J11',
-        contract: 'cli-output-golden',
-        status: 'pass',
-        artifactPath: existing[0]
-    };
 }

package/dist/services/capability-guard-runner/contracts/J12.d.ts

@@ -1,2 +1,14 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * Behavioural probe of the lease lifecycle.
+ *
+ * The previous version passed if one of four worktree/dispatch files mentioned
+ * both "lease" and "release" — `worktree-lease.ts` satisfies that from its own
+ * filename.
+ *
+ * Here the real pure module is driven: a fresh lease must be active, releasing
+ * twice must be a no-op, a duplicate consumption must not append, an in-flight
+ * lease must never be gc-eligible, and a persisted lease must survive a
+ * serialize/deserialize round trip.
+ */
 export declare function runJ12Contract(ctx: GuardContext): Promise<GuardRunResult>;

package/dist/services/capability-guard-runner/contracts/J12.js

@@ -1,34 +1,70 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-const CANDIDATE_FILES = [
-    'src/services/worktree/lease-store.ts',
-    'src/services/worktree/worktree-lease.ts',
-    'src/services/dispatch/sub-agent-dispatcher.ts',
-    'src/services/lease-metrics/lease-metrics-service.ts'
-];
-const REQUIRED_FRAGMENTS = ['lease', 'release'];
+import { deserializeLease, finalizeLease, isLeaseActive, isLeaseGcEligible, leaseFilePath, leaseStoreDir, listLeasesSync, markReleased, recordConsumption, renewLease, serializeLease, ttlForRole } from '../../worktree/worktree-lease.js';
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+const NOW = 1_700_000_000_000;
+const DRAFT = {
+    leaseId: '0123456789abcdef',
+    rid: '2026-09-15-s1-gate-contracts-honest',
+    role: 'rd',
+    path: 'C:/tmp/worktrees/0123456789abcdef',
+    branch: 'peaks/guard-J12',
+    createdAt: NOW - 1000,
+    expiresAt: NOW + 60_000,
+    purpose: 'J12 guard probe'
+};
+/**
+ * Behavioural probe of the lease lifecycle.
+ *
+ * The previous version passed if one of four worktree/dispatch files mentioned
+ * both "lease" and "release" — `worktree-lease.ts` satisfies that from its own
+ * filename.
+ *
+ * Here the real pure module is driven: a fresh lease must be active, releasing
+ * twice must be a no-op, a duplicate consumption must not append, an in-flight
+ * lease must never be gc-eligible, and a persisted lease must survive a
+ * serialize/deserialize round trip.
+ */
 export async function runJ12Contract(ctx) {
-    const existing = CANDIDATE_FILES.filter((f) => existsSync(join(ctx.projectRoot, f)));
-    if (existing.length === 0) {
-        return {
-            journeyId: 'J12',
-            contract: 'concurrency-lease',
-            status: 'fail',
-            diff: { before: 'a worktree/lease/dispatch service exists', after: 'no candidate found', reason: 'J12#1 broken: no lease infrastructure is present' },
-            artifactPath: 'src/services/worktree/'
-        };
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const lease = finalizeLease(DRAFT);
+    const onceReleased = markReleased(lease);
+    const twiceReleased = markReleased(onceReleased);
+    const consumed = recordConsumption(lease, 'batch-1');
+    const consumedTwice = recordConsumption(consumed, 'batch-1');
+    const renewed = renewLease(onceReleased, NOW + 120_000);
+    const root = mkdtempSync(join(tmpdir(), 'cbl-J12-'));
+    try {
+        const storeDir = leaseStoreDir(root);
+        const missingStore = listLeasesSync(storeDir, { readdir: readdirSync, readFile: (p) => readFileSync(p, 'utf8'), existsSync });
+        mkdirSync(storeDir, { recursive: true });
+        writeFileSync(leaseFilePath(root, lease.leaseId), serializeLease(lease));
+        const listed = listLeasesSync(storeDir, { readdir: readdirSync, readFile: (p) => readFileSync(p, 'utf8'), existsSync });
+        const result = combineProbes([
+            probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+            probe(lease.status === 'active' && lease.consumedBySubAgents.length === 0, 'a fresh lease is active with no consumers'),
+            probe(leaseStoreDir(root).replace(/\\/g, '/').endsWith('/worktree-leases'), `leases live under the session worktree-leases dir (${leaseStoreDir(root)})`),
+            probe(missingStore.kind === 'store-missing', 'an absent lease store is reported, not invented'),
+            probe(listed.kind === 'ok' && listed.leases.length === 1, `a persisted lease is listed back (${listed.kind === 'ok' ? String(listed.leases.length) : listed.kind})`),
+            probe(JSON.stringify(deserializeLease(serializeLease(lease))) === JSON.stringify(lease), 'serialize/deserialize round-trips the lease'),
+            probe(onceReleased.status === 'released', 'release moves the lease to released'),
+            probe(JSON.stringify(twiceReleased) === JSON.stringify(onceReleased), 'a duplicate release is a no-op'),
+            probe(JSON.stringify(consumedTwice) === JSON.stringify(consumed) && consumed.consumedBySubAgents.length === 1, 'a duplicate consumption is not appended twice'),
+            probe(renewed.status === 'active' && renewed.expiresAt === NOW + 120_000, 'renew extends expiry and returns the lease to active'),
+            probe(isLeaseActive(lease, NOW), 'an unexpired active lease is in flight'),
+            probe(!isLeaseGcEligible(lease, NOW), 'gc is NOT eligible for an in-flight lease'),
+            probe(isLeaseGcEligible(onceReleased, NOW), 'a released lease is gc-eligible'),
+            probe(isLeaseGcEligible(finalizeLease({ ...DRAFT, expiresAt: NOW - 1 }), NOW), 'an expired lease is gc-eligible'),
+            probe(ttlForRole('rd') > 0 && ttlForRole('no-such-role') === ttlForRole('rd'), 'unknown roles fall back to the rd TTL')
+        ]);
+        const artifact = row.sourceFiles[0] ?? 'src/services/worktree/worktree-lease.ts';
+        if (result.ok)
+            return pass(ctx, artifact);
+        return fail(ctx, artifact, 'the lease lifecycle is complete: release is idempotent and gc never touches an in-flight lease', result.detail, 'J12 invariant broken: the lease release lifecycle or its gc guard no longer holds');
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
     }
-    // Soft: at least one file references BOTH 'lease' AND 'release' in its content.
-    const fullCoverage = existing.some((f) => {
-        const src = readFileSync(join(ctx.projectRoot, f), 'utf8').toLowerCase();
-        return REQUIRED_FRAGMENTS.every((frag) => src.includes(frag));
-    });
-    const ok = fullCoverage;
-    return {
-        journeyId: 'J12',
-        contract: 'concurrency-lease',
-        status: ok ? 'pass' : 'fail',
-        ...(ok ? {} : { diff: { before: 'a worktree/lease service references both lease and release', after: 'no such file', reason: 'J12#1 broken: lease lifecycle (lease + release) is incomplete' } }),
-        artifactPath: existing[0]
-    };
 }

package/dist/services/capability-guard-runner/contracts/J13.d.ts

@@ -1,2 +1,13 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * Behavioural probe of the content-pipeline boundary.
+ *
+ * The previous version read the skill plus three unrelated files and passed if
+ * three of the five words draft/edit/tone/publish/archive appeared anywhere —
+ * and it counted "tone" (a GATE in the skill) as a STAGE.
+ *
+ * Here the skill's declared stages are anchored on the bees that implement
+ * them, and every file under the skill directory is scanned for a specifier
+ * that would reach into peaks-code internals.
+ */
 export declare function runJ13Contract(ctx: GuardContext): Promise<GuardRunResult>;

package/dist/services/capability-guard-runner/contracts/J13.js

@@ -1,45 +1,67 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
-const CANDIDATE_FILES = [
-    'skills/peaks-content/SKILL.md',
-    'src/services/content/',
-    'src/services/workflow/workflow-router-service.ts',
-    '.peaks/standards/loop-engineering-guidelines.md'
-];
-const STAGES = ['draft', 'edit', 'tone', 'publish', 'archive'];
-export async function runJ13Contract(ctx) {
-    const existing = CANDIDATE_FILES.filter((f) => existsSync(join(ctx.projectRoot, f)));
-    if (existing.length === 0) {
-        return {
-            journeyId: 'J13',
-            contract: 'workflow-trace',
-            status: 'fail',
-            diff: { before: 'a content / peaks-content skill exists', after: 'no candidate found', reason: 'J13#1 broken: no content production surface is present' },
-            artifactPath: 'skills/peaks-content/SKILL.md'
-        };
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+const SKILL_DIR = ['skills', 'peaks-content'];
+const SKILL_MD = [...SKILL_DIR, 'SKILL.md'];
+/**
+ * The content stages the skill must still declare, each anchored on the bee
+ * that implements it. "draft" appearing anywhere in the file is not evidence;
+ * `bee-content-draft` disappearing means the stage is gone.
+ */
+const STAGES = ['draft', 'edit', 'publish', 'archive'];
+/** Specifiers that would mean the skill reached into peaks-code domain logic. */
+const FORBIDDEN_SPECIFIER = /(^|[./\\])peaks-code([/\\]|$)|(^|\/)src\/(services|cli)\//;
+function walk(dir, out = []) {
+    if (!existsSync(dir))
+        return out;
+    for (const entry of readdirSync(dir, { withFileTypes: true })) {
+        const abs = join(dir, entry.name);
+        if (entry.isDirectory())
+            walk(abs, out);
+        else
+            out.push(abs);
     }
-    // Soft check: at least 3 of 5 stages appear in any existing file's content.
-    const matchedStages = new Set();
-    for (const file of existing) {
-        const src = readFileSync(join(ctx.projectRoot, file), 'utf8').toLowerCase();
-        for (const stage of STAGES) {
-            if (src.includes(stage))
-                matchedStages.add(stage);
+    return out;
+}
+/**
+ * Behavioural probe of the content-pipeline boundary.
+ *
+ * The previous version read the skill plus three unrelated files and passed if
+ * three of the five words draft/edit/tone/publish/archive appeared anywhere —
+ * and it counted "tone" (a GATE in the skill) as a STAGE.
+ *
+ * Here the skill's declared stages are anchored on the bees that implement
+ * them, and every file under the skill directory is scanned for a specifier
+ * that would reach into peaks-code internals.
+ */
+export async function runJ13Contract(ctx) {
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const skillAbs = join(ctx.projectRoot, ...SKILL_MD);
+    const body = existsSync(skillAbs) ? readFileSync(skillAbs, 'utf8') : '';
+    const absentStages = STAGES.filter((stage) => !body.includes(`bee-content-${stage}`));
+    const toneGatePresent = body.includes('Tone gate');
+    const files = walk(join(ctx.projectRoot, ...SKILL_DIR));
+    const offenders = [];
+    for (const file of files) {
+        const text = readFileSync(file, 'utf8');
+        for (const line of text.split('\n')) {
+            const spec = /(?:from|import|require\()\s*['"]([^'"]+)['"]/.exec(line);
+            if (spec !== null && FORBIDDEN_SPECIFIER.test(spec[1])) {
+                offenders.push(`${file.replace(/\\/g, '/')} → ${spec[1]}`);
+            }
         }
     }
-    if (matchedStages.size < 3) {
-        return {
-            journeyId: 'J13',
-            contract: 'workflow-trace',
-            status: 'fail',
-            diff: { before: 'at least 3 of draft/edit/tone/publish/archive stages are referenced', after: `only ${[...matchedStages].join(',')} found`, reason: 'J13#1 broken: content pipeline has too few stages' },
-            artifactPath: existing[0]
-        };
-    }
-    return {
-        journeyId: 'J13',
-        contract: 'workflow-trace',
-        status: 'pass',
-        artifactPath: existing[0]
-    };
+    const result = combineProbes([
+        probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+        probe(body.length > 0, 'the peaks-content skill file is readable'),
+        probe(absentStages.length === 0, `every content stage is anchored on its bee (missing: ${absentStages.join(',') || 'none'})`),
+        probe(toneGatePresent, 'the tone gate is still declared between draft and edit'),
+        probe(files.length > 0, `the skill directory is non-empty (${String(files.length)} files)`),
+        probe(offenders.length === 0, `no skill file imports peaks-code internals (${offenders.join('; ') || 'none'})`)
+    ]);
+    const artifact = row.sourceFiles[0] ?? 'skills/peaks-content/SKILL.md';
+    if (result.ok)
+        return pass(ctx, artifact);
+    return fail(ctx, artifact, 'peaks-content declares its four stages and imports no peaks-code internals', result.detail, 'J13 invariant broken: the content pipeline stages or the peaks-code boundary changed');
 }

package/dist/services/capability-guard-runner/contracts/J14.d.ts

@@ -1,2 +1,13 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * Behavioural probe of the RL-3 AI-modified declaration rule.
+ *
+ * The previous version read the skill plus two markdown files and passed if at
+ * least two of the words triage/classify/fix/commit appeared — words that
+ * appear throughout the prose regardless of whether any rule survived.
+ *
+ * Here the rule is anchored on its heading, its literal commit-body markers,
+ * the forbidden-trailer list and the survey-banned globs. Deleting the rule
+ * section reddens the journey.
+ */
 export declare function runJ14Contract(ctx: GuardContext): Promise<GuardRunResult>;

package/dist/services/capability-guard-runner/contracts/J14.js

@@ -1,36 +1,65 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-const CANDIDATE_FILES = [
-    'skills/peaks-issue-fix-orchestrator/SKILL.md',
-    '.peaks/memory/peaks-loop-positioning-loop-engineering.md',
-    '.peaks/standards/loop-engineering-guidelines.md'
+import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
+const SKILL_MD = ['skills', 'peaks-issue-fix-orchestrator', 'SKILL.md'];
+/**
+ * The RL-3 declaration's literal lines. Anchored on the exact marker text the
+ * self-check greps for — "AI-modified" appearing once in the frontmatter
+ * description is not evidence that the rule survived.
+ */
+const REQUIRED_MARKERS = [
+    'AI-modified: yes',
+    'Repository:',
+    'Modifying tool: peaks-loop / peaks-issue-fix-orchestrator',
+    "grep -E 'Repository:|AI-modified:'",
+    'Forbidden trailers:'
 ];
-const REQUIRED_STAGES = ['triage', 'classify', 'fix', 'commit'];
+/** Every trailer the repo's own red rule bans (CLAUDE.md, 2026-07-01). */
+const FORBIDDEN_TRAILERS = [
+    'Co-Authored-By: Claude',
+    'Co-Authored-By: Anthropic'
+];
+/** Survey-banned target globs that must still be refused before any commit. */
+const BANNED_TARGETS = [
+    'tools/mcp_oauth.py',
+    'agent/auth/*',
+    'agent/conversation_loop.py',
+    'agent/tool_guardrails.py',
+    '*/prompt_cache*',
+    '*/token_cache*'
+];
+/**
+ * Behavioural probe of the RL-3 AI-modified declaration rule.
+ *
+ * The previous version read the skill plus two markdown files and passed if at
+ * least two of the words triage/classify/fix/commit appeared — words that
+ * appear throughout the prose regardless of whether any rule survived.
+ *
+ * Here the rule is anchored on its heading, its literal commit-body markers,
+ * the forbidden-trailer list and the survey-banned globs. Deleting the rule
+ * section reddens the journey.
+ */
 export async function runJ14Contract(ctx) {
-    const existing = CANDIDATE_FILES.filter((f) => existsSync(join(ctx.projectRoot, f)));
-    if (existing.length === 0) {
-        return {
-            journeyId: 'J14',
-            contract: 'workflow-trace',
-            status: 'fail',
-            diff: { before: 'a peaks-issue-fix-orchestrator skill or memory file exists', after: 'no candidate found', reason: 'J14#1 broken: no issue-sweep surface is present' },
-            artifactPath: 'skills/peaks-issue-fix-orchestrator/SKILL.md'
-        };
-    }
-    const matched = new Set();
-    for (const file of existing) {
-        const src = readFileSync(join(ctx.projectRoot, file), 'utf8').toLowerCase();
-        for (const stage of REQUIRED_STAGES) {
-            if (src.includes(stage))
-                matched.add(stage);
-        }
-    }
-    const ok = matched.size >= 2;
-    return {
-        journeyId: 'J14',
-        contract: 'workflow-trace',
-        status: ok ? 'pass' : 'fail',
-        ...(ok ? {} : { diff: { before: 'at least 2 of triage/classify/fix/commit are referenced', after: `only ${[...matched].join(',')} found`, reason: 'J14#1 broken: issue-sweep pipeline has too few stages' } }),
-        artifactPath: existing[0]
-    };
+    const row = requireBaselineRow(ctx);
+    const missing = missingSourceFiles(ctx, row);
+    const abs = join(ctx.projectRoot, ...SKILL_MD);
+    const body = existsSync(abs) ? readFileSync(abs, 'utf8') : '';
+    // The heading carries an em dash, so match the two stable halves instead of
+    // the literal punctuation.
+    const headingPresent = /###\s+RL-3\b[^\n]*AI-modified declaration/.test(body);
+    const missingMarkers = REQUIRED_MARKERS.filter((m) => !body.includes(m));
+    const missingTrailers = FORBIDDEN_TRAILERS.filter((t) => !body.includes(t));
+    const missingTargets = BANNED_TARGETS.filter((t) => !body.includes(t));
+    const result = combineProbes([
+        probe(missing.length === 0, `baseline sourceFiles present (${row.sourceFiles.length})`),
+        probe(body.length > 0, 'the issue-fix orchestrator skill file is readable'),
+        probe(headingPresent, 'the RL-3 AI-modified declaration section is still present'),
+        probe(missingMarkers.length === 0, `the commit-body markers are intact (missing: ${missingMarkers.join(', ') || 'none'})`),
+        probe(missingTrailers.length === 0, `the AI trailer ban is intact (missing: ${missingTrailers.join(', ') || 'none'})`),
+        probe(missingTargets.length === 0, `the survey-banned target globs are intact (missing: ${missingTargets.join(', ') || 'none'})`)
+    ]);
+    const artifact = row.sourceFiles[0] ?? 'skills/peaks-issue-fix-orchestrator/SKILL.md';
+    if (result.ok)
+        return pass(ctx, artifact);
+    return fail(ctx, artifact, 'every fix carries the RL-3 AI-modified declaration and the banned-target list survives', result.detail, 'J14 invariant broken: the AI-modified declaration rule or the banned-target list was removed');
 }

package/dist/services/capability-guard-runner/contracts/J15.d.ts

@@ -1,2 +1,13 @@
 import type { GuardContext, GuardRunResult } from '../types.js';
+/**
+ * Behavioural probe of the fixed coverage-summary discovery order.
+ *
+ * The previous version listed three openspec files and passed if any of them
+ * mentioned "Capability Mapping" AND "coverage" — the string "coverage" appears
+ * in `coverage-evidence-reader.ts` from its own filename.
+ *
+ * Here the real resolver is driven against a tmp project where BOTH candidate
+ * files exist, then only the second, then neither. Only a resolver that honours
+ * the documented order can produce `coverage/` → `openspec/` → missing.
+ */
 export declare function runJ15Contract(ctx: GuardContext): Promise<GuardRunResult>;