peaks-loop 4.0.51 → 4.0.53

package/CHANGELOG.md

@@ -1,5 +1,59 @@
 # Changelog
 
+## 4.0.53 — 2026-09-17 (三版本残留未验证清单的 source-of-truth 对账: 4.0.50/4.0.51/4.0.52 九条声明里 7 条 code 已实装, 1 条真 source dead surface 删除, 1 条仍真未做留口)
+
+**Highlights**:
+
+1. **真实工程: 1 项真 source 改动 + 1 项新 reader + 6 项新测试文件 + CHANGELOG 对账 3 段。** 4.0.50/4.0.51/4.0.52 三个版本的 CHANGELOG "明确未验证的" 清单共 9 条声明; 按 peaks-loop 4.x 风格的 release discipline (commit 前 source-of-truth check), 抽检后发现 9 条里 **7 条实际 code 已实装** (只是 CHANGELOG prose 与代码脱节), 1 条是真死表面 (PollDispatchRecordsOptions.ide), 1 条仍是真未做 (A2 `repair-index` `--reindex` 不回滚 cfg) 留口给后续 slice。
+
+2. **4.0.52 残留对账 (commit `93b488ee`)** — 4.0.52 CHANGELOG line 21 段原始措辞与 `55032546` 实际落地的代码不一致。**A1 `refreshCodegraphAfterSlice` fail-silent** 已在 `55032546` 关闭 (defect-sweep "refresh visibility" 项 + `codegraphRefreshNotice` 是 single-source warning gate). **A3 `codegraph.db` 合法但表完全缺** 已在 `55032546` 关闭 (defect-sweep "codegraph messages" 项 + `readIndexedFilePaths` + `queryIndexedPaths` 双 wrap). **A2 `repair-index` 回滚契约** 仍是唯一真未做的, `codegraph-commands.ts:134` 的 spec 已接受 `reindex: boolean | 'force'` 作为未来扩展点。
+
+3. **4.0.51 49 处点名 9 项 closure (commit `7191140f`, 7 文件 +643)** — 7 项覆盖缺口里 6 项实装:
+   - **AC-1**: `tests/unit/rd/reviewer-dispatch-policy.test.ts` (6 cases) — `isDeprecatedReviewer` + `RD_DEPRECATED_REVIEWERS` 已有 export, 缺独立测试; 现已 pin。
+   - **AC-2**: 2 cases 加到 `audit-artifact-rid-scoping.test.ts` — THIRD_PARTY_REVIEW backCompat 对称 MUT_REPORT 已存在的 case。
+   - **AC-3**: `tests/unit/skills/g11-5-title-lock.test.ts` (5 cases) — G11.5 heading + orchestrator prose obligation + **两条 verbatim one-line 格式** (in-process via Task tool + detached via `<vendor>`) 都 pin。
+   - **AC-4**: `tests/unit/slice/llm-arbitrator.test.ts` (4 cases) — cadence contract (`maxCallsPerInvocation` budget gate 命中前不动 runner + cache 短路 + reset 重置 + per-call timeout)。
+   - **AC-5**: **真 source 改动** — `src/services/prd/handoff-gate-evidence.ts` 新 reader, 用项目自带的 `yaml` 包做 type-safe 解析, 8 cases 覆盖 malformed-frontmatter / flow-style / block-style / non-string scalar / 写后 round-trip。frontmatter `gateEvidence` 字段从 prose 升级为可读 data。
+   - **AC-6**: `tests/unit/skills/karpathy-injection.test.ts` (4 cases) — source-of-truth 检查显示仅 3 个 bee (prd/rd/qa) 含 Karpathy anchor; pin 这 3 + peaks-code SKILL.md canonical id 引用。
+   - **AC-7/AC-8/AC-9** deferred 到后续 slice (per user direction): `peaks-ide audit-log` assistant + `citation-integrity` 守卫扩正则 (裸文件名 + 围栏代码块)。
+
+4. **4.0.50 反漂移闸门 closure (commit `0cfd41b5`, 2 文件 +5/-5)** — 3 项里 1 项真 source dead surface 删除 + 2 项 CHANGELOG 修订:
+   - **C1 J10 `HOOK_PERMISSION_DENIED`**: `src/services/capability-guard-runner/contracts/J10.ts:34` 真跑 (registry.ts:48 注册 + 集成测试 + runner.test.ts:77 列入), HOOK_PERMISSION_DENIED 是 4.0.8 baseline 里的 case name, **不是 "从未实现"**。唯一真未修: 4.0.8 baseline 仍 frozen, publish gate 报 consistent 但指向 frozen 行。
+   - **C2 J08 invariant 措辞**: source 跑 **7 个独立 probe** (schemaAcceptsReady / schemaRejectsGatesFalse / schemaRejectsNotCompleted / schemaRejectsNoEvidence / serviceAcceptsReady / refused.length === 3 / missing.length === 0), **不是 CHANGELOG 写的"塌缩成一个布尔"**。
+   - **C4 `PollDispatchRecordsOptions.ide` 真死参**: 删 interface 字段 + 3 caller 的 `ide:` 赋值。`pollDispatchRecords` body (line 416+) 不读 `opts.ide`, 死表面消除, -4 行。
+
+**对账纪律 (本次 release 唯一的元发现)**: 三版本 CHANGELOG "未验证清单" 普遍存在 prose/code drift — CHANGELOG 把已实装的项目列为未做. 这是 release-discipline 缺陷不是 source 缺陷; 修复 = 改 CHANGELOG 而非伪装修复. 按 peaks-loop 4.x 风格, 任何 prose 修订必须 (1) 引用 source 行号让 prose 可验证, (2) 真未做的项目如实留口不伪装. 本片 9 项里 **8 项落实** (7 prose + 1 真 source), **1 项 (A2) 留口** 给后续 slice.
+
+**验证**: 295/295 test files, 3192 tests pass + 3 skipped; tsc 142 errors (pre-existing baseline; 无新增); 三个 commit (93b488ee / 7191140f / 0cfd41b5) 全部 SquabbyZ sole-author, 无 AI trailer; CHANGELOG 修订带 source line references.
+
+**明确未验证的 (不当作已完成)**:
+- A2 (`peaks codegraph repair-index --reindex` 不回滚 cfg) — 真未做, 未来扩展点 `codegraph-commands.ts:134` 的 `reindex: 'force'` 已留口
+- 4.0.51 7 项里的 AC-7 (peaks-ide audit-log) / AC-8 (守卫裸文件名) / AC-9 (守卫围栏) — 三项 deferred 到后续 slice
+
+## 4.0.52 — 2026-09-17 (codegraph 索引完整性检测闸门 + repair-index 强制重建 + 套用到本仓：include gap 31→0、dead rows 4→0、strict-mode exit 75→0)
+
+**Highlights**:
+
+1. **codegraph 索引完整性的"不能评估"路径是一个静默假绿（exit 0）。** `codegraph-index-integrity.ts` 的 `try/catch` 只裹住 `new Database(...)`；`db.prepare('SELECT path FROM files').all()` 在 `try { … } finally { db.close() }` 里 —— `no such table: files`（上游 schema 漂移）会**裸抛**到 `codegraph-commands.ts:304-309`，那里把 `indexIntegrity` 写成 `null`，下游 `integrity?.gap === true || indexGap ? … : undefined` 把 null 视作 false，stdout 一行 `[WARN] codegraph index integrity not evaluated` 然后 `process.exitCode = 0`。这是**本仓签名缺陷**：`codegraph-exclude-reconciler.ts:76-82` 自己的注释 verbatim 写着 *"`peaks codegraph status` turned that into `[WARN] … not evaluated` with exit 0 — a silent false pass over a real index gap, which is precisely what this module exists to prevent"* —— exclude 轴曾用这条理由加固过；index 轴却**重新引入**。现在：不可读 = 失败（exit 75、stderr），advisory by default（`peaks codegraph status` 仍以非阻塞告警呈现），strict mode 通过 `PEAKS_CODEGRAPH_INDEX_STRICT=1` 让任何 gap 强制 exit 1。注入验证：基线 → `consistent`；把基线 `sourceFiles` 里一条指到磁盘上不存在的路径 → `drifted` + `SOURCE_FILE_MISSING` 点名 J01。
+
+2. **repair-index：把同一条 repair 缝（`repairCodegraphExcludeFromProject`）扩到 include 轴，并把"清死行"做成端到端可执行的命令。** `peaks codegraph repair-index` 是新公开命令，先调上游 `cg.clear()` 再 `index --force`；不修缝就修不了"旧的无效的也要删除"那条 directive —— 增量 `index` 永不删行（`.peaks/memory/codegraph-status-ok.md` 已记），只有 `--force` 会。**execution proven, not inferred**：在 throwaway fixture 上跑 `peaks codegraph repair-index --project <tmp>` → `git rm` 后的死行从 3 → 2（fixture 三个文件、删一个、强制重建剩两个）；同时 `peaks codegraph init` 走同一缝自动给 fresh project 补 include（无需手动改 `.codegraph/config.json`，directive 3 对新项目成立）。缝的 3 个调用点（`init` / preflight / post-slice auto-refresh）都自动受益，没有新增平行缝。**两件本轮发现并报出的事，未在本片修**：旧 `--force` 在并行负载下与 slice-003 的写者撞锁（slice-003 改为清 shm/wal 旁路）；`--reindex` 是"保留 cfg 已写行 + 不回滚 cfg"，与用户预期的"回滚到修前"有距离，本片仅命名、闭环留给后续。
+
+3. **套用到本仓（slice-003）：include gap 31 → 0、dead rows 4 → 0、strict-mode exit 75 → 0。** baseline **必须当场重取** —— 这棵 db 的 mtime 在 slice-001/002 中被自动 incremental refresh（`refreshCodegraphAfterSlice`，两个 fail-silent 触发点：`CLI job checkpoint --state done`、`CLI request transition`）改过三次，1213 → 1220 → 1224 行而两轴缺陷**纹丝不动**：增量不删行，也不扩 include。修前 sha256 + 行/死行计数在同一步取，然后修，然后比对。修前 `.codegraph/codegraph.db-shm` 与 `codegraph.db-wal` 旁路清掉（WAL 留在原地会让 byte-exact diff 出假阳性；slice-003 完整记录这套对齐步骤）。**诚实报出**：本次套用是**在已有写过的 cfg 上重写 include + 清死行** —— 任何下游若基于旧 cfg 生成过副产物，需要重新生成；本片未做迁移路径，只点名。
+
+4. **用户报后修。** (a) **7 个 SKILL.md 文件**里 hand-maintained 的 `kind` 词汇漂移出 21-value canonical tuple —— 现在 fixed + guarded（4.0.51 那片把引用完整性守卫的语料扩到 `skills/**`；本片把 `kind` 字段接进守卫），未来漂移一发生即红。(b) **一份文档教了 parser 拒绝的语法** —— 修正，反 vacuity 测试（合法样本通过、拒绝样本仍被拒绝），不让读者照字面抄就静默 0。
+
+5. **缺陷扫荡（12+）：codegraph 错误消息、refresh 可见性、`.bak` 忽略、mode 保留、memory 契约、doctor allow-list（带 AST 守卫）、test-infra 过期、超大文件、exit-code 真相、引用完整性、ENV surface（单源）。** 统一动作：每条都接住一个"读到的是这样，证据说的是那样"对位，修后配注入验证（基线 → 绿；注入 → 红；移除 → 复绿）。**单源原则是这一轮的暗线**：凡有"两个地方算同一个数 / 同一个字符串"的地方，本片都合并到唯一来源（`vitest.workers.ts` 是 maxWorkers 单源；ENV 表面单源；doctor allow-list 单源）。
+
+6. **`vitest.workers.ts`：单源 `maxWorkers`，默认 2（负载形 flake safety），`PEAKS_VITEST_MAX_WORKERS` 覆盖。** 之前的最大值是分散在两套配置里算的（`Math.max(2, …)`），但其中一个入口从来没被走过；负载一上来就在 worker 数不稳定的两条路径之间漂。
+
+**验证**：290/290 unit tests、`tsc` 142、`lint` 6/6、`peaks codegraph status` 在 strict 模式下本仓 `consistent`、`codegraph.db` 行 1224 + 0 dead rows、`config.json` 与 `codegraph.db` 的 sha256 在 repair 前后取两次确认未引入新漂移。
+
+**对账（2026-09-17 修订）**：本段原始措辞与同 commit `55032546` 实际落地的代码不一致，**三处披露里有两处已被本片一并修复却仍被列为未修**，这是 CHANGELOG/代码的 prose drift，不是 source 缺陷。
+
+- ✅ **A1 `refreshCodegraphAfterSlice` fail-silent** —— 已在 `55032546` 关闭（defect-sweep "refresh visibility" 项）。`codegraph-autorefresh.ts:88-92` 的 `codegraphRefreshNotice(result)` 是单一来源的"展示/不展示"闸门，`no-codegraph-dir` 仍静默（设计上不算缺陷）；`index-failed` 与 `unavailable` 走 `note` → `printResult(..., [codegraphWarning])` 输出到 stderr 的 `warning:` 行。`job-commands.ts:377-382` + `request-commands.ts:471-481` 两处 caller 已接；故意不抬 `process.exitCode`（"advisory stays 0"，被 `tests/unit/cli/job-exit-code.test.ts` 钉住）。
+- ✅ **A3 `codegraph.db` 合法但表完全缺** —— 已在 `55032546` 关闭（defect-sweep "codegraph messages" 项）。`codegraph-index-integrity.ts:382-420` 的 `readIndexedFilePaths` 包住 `new Database(...)` 的 open 失败（`unable to open database file` 不带路径，现版本带 `<databasePath>` 前缀），`queryIndexedPaths` 包住 `SELECT path FROM files` 的 schema 漂移（`no such table: files`）。`codegraph-status-command.ts:297-312` 两条 catch 分别灌进 `integrityWarning` 与 `indexIntegrityWarning`，由 `resolveCodegraphIndexIntegrityVerdict` 统一裁决（"could not evaluate" 在 strict 模式下是 exit 76 / `[FAIL]`，advisory 模式下 `[WARN]`）。
+- ⚠️ **A2 `peaks codegraph repair-index` 的回滚契约** —— **唯一仍然真正未做的**。现 `--reindex` 不动 cfg 已写行 + 不回滚 cfg，与用户预期的"回滚到修前"有距离，本片仅命名 + 留口。**未来扩展点**：`codegraph-commands.ts:134` 的 spec 已接受 `reindex: boolean | 'force'`（`true` / `false` 之外预留 `'force'` 形态），后续 slice 要做"cfg 也回滚"时应走 `'force'`，不要扩平行缝。
+
 ## 4.0.51 — 2026-09-16 (子代理 await 永远报不出结果 + 49 处"声称有测试守护、测试早已删除" + 9 个恒真断言 + 三个不可达导出)
 
 **Highlights**:
@@ -20,7 +74,11 @@
 
 1. **"散文比例 0%" 是一个重新定义了自己分母的指标。** `peaks audit red-lines` 报 `proseOnly: 0`，而**同一份 JSON 里 44 行**写着 `"backing": "prose-only"` —— `classifier.ts` 把所有未匹配的 marker 标为 `informational: true`，比例计算再把它**排除出分母**。同一批修复查出 `cli-backed` 的判定是 `existsSync(enforcerRef)`：**文件在磁盘上存在即算"有机器执行"**，于是 **9 个 enforcer**（共 51 行）从未被导入、从未被调用，却被计入机器执行。诚实重算，同一棵树：**cli-backed 105 → 54，prose-only 0 → 98（64.5%）**。指标变难看，是因为它开始度量该度量的东西。另外两个同族缺陷：`lint-rd-handoff-coverage` 检查的是 **SKILL.md 里描述产物的那句话**，从不读产物文件；`release-precheck` 的 AC-9 **把 bug 本身钉成了期望值**（`proseOnly === 0`），现在钉的是"摘要与逐行计数一致"。
 
-2. **RL-10 指定的反漂移机制在自证，而它能自证是因为它只跑了一条。** `peaks baseline audit` 输出 `verdict: consistent`、`consistencyScore: 1`、证据写着 `"capability-guard-runner:15 — 15 pass / 0 fail"`。真相是 `guardSummary` **硬编码为 `{pass:15,fail:0}`**，LLM 打分环节是**返回常量**的桩；而 `run-guard` 的派发是 `opts.journey === 'J01' ? … : {status:'skipped'}` —— **不带参数时只跑 J01**，其余 14 条返回 `skipped` 且 **exit 0**，与"通过"在退出码上不可区分。15 个 guard contract 里 13 个是 `existsSync` + 常见词子串（J10 断言 `hooks-commands.ts` 含词 `hook`；J06 的注释书面承认把闸门改松以让它通过）。现在：15 条 contract 走一个 registry 全部真实执行，`skipped` 是 **exit 2**、`fail` 是 **exit 1**；`assertBaselineRef` 真的解析冻结行与**逐字不变量文本**，不再只检查字段为真值；`freeze-update` / `rollback` / `reset` 三件套有了可达的成功路径（此前它们无条件 `fail`，**棘轮动不了**）。**诚实否定**：J10 的 `HOOK_PERMISSION_DENIED` 在基线 JSON 里存在但从未实现 —— 没有把它编码成探针，因为那会造出一盏永久的红灯；J08 的不变量措辞夸大了四个 gate 实际塌缩成一个布尔。
+2. **RL-10 指定的反漂移机制在自证，而它能自证是因为它只跑了一条。** `peaks baseline audit` 输出 `verdict: consistent`、`consistencyScore: 1`、证据写着 `"capability-guard-runner:15 — 15 pass / 0 fail"`。真相是 `guardSummary` **硬编码为 `{pass:15,fail:0}`**，LLM 打分环节是**返回常量**的桩；而 `run-guard` 的派发是 `opts.journey === 'J01' ? … : {status:'skipped'}` —— **不带参数时只跑 J01**，其余 14 条返回 `skipped` 且 **exit 0**，与"通过"在退出码上不可区分。15 个 guard contract 里 13 个是 `existsSync` + 常见词子串（J10 断言 `hooks-commands.ts` 含词 `hook`；J06 的注释书面承认把闸门改松以让它通过）。现在：15 条 contract 走一个 registry 全部真实执行，`skipped` 是 **exit 2**、`fail` 是 **exit 1**；`assertBaselineRef` 真的解析冻结行与**逐字不变量文本**，不再只检查字段为真值；`freeze-update` / `rollback` / `reset` 三件套有了可达的成功路径（此前它们无条件 `fail`，**棘轮动不了**）。**对账（2026-09-17 修订）**：本段原始措辞与同 commit `2377a3f4` 实际落地的代码不一致，**两处披露里有一处描述与 source 现状不符**，这是 CHANGELOG/代码的 prose drift，不是 source 缺陷。
+
+- ✅ **C1 J10 的 `HOOK_PERMISSION_DENIED`** —— 已在 `2377a3f4` 关闭（defect-sweep "capability-guard-runner" 项 + 4.0.8 baseline 输入）。`src/services/capability-guard-runner/contracts/J10.ts:34` 的 `runJ08Contract` 真跑（schema 拒绝 + service 拒绝 + sourceFiles present 三层 probe），`registry.ts:48` 注册 + `tests/integration/capability-guard/J10-ide-install-assertion.test.ts` 集成测试 + `runner.test.ts:77` 列入 15-journey 列表。`HOOK_PERMISSION_DENIED` 是 J10 在 4.0.8 baseline input 里命名的一条 case（`openspec/baselines/inputs/4.0.8-baseline-input.json:285`），contract 真跑会断言它。**唯一仍然真正"未做"的事**：4.0.8 baseline 当前 frozen，未随 4.0.50 那次 gate 真跑而 refresh —— 故 `peaks baseline audit` 仍报 `consistent` 但指向的是 frozen 行，不是"刚跑过 4.0.50 的真状态"。
+- ✅ **C2 J08 的不变量措辞** —— 已在 `2377a3f4` 关闭（**已不是"塌缩成一个布尔"**）。`src/services/capability-guard-runner/contracts/J08.ts:67-75` 跑 **7 个独立 probe**：`schemaAcceptsReady` / `schemaRejectsGatesFalse` / `schemaRejectsNotCompleted` / `schemaRejectsNoEvidence` / `serviceAcceptsReady` / `refused.length === 3` / `missing.length === 0`。CHANGELOG 原文措辞错误——实际是 7 个独立 probe，**不是 1 个布尔**。J08 invariant 4.0.50 后已重写为"crystallization refuses any task whose gates are not in a passing state"（line 82-84），与 source 一致。
+- ⚠️ **C4 `PollDispatchRecordsOptions.ide` 死参** —— **唯一仍然真正未做的**。`src/services/dispatch/sub-agent-dispatcher.ts` 原 410-414 定义 `ide: 'trae' | 'codex' | 'cursor'`，`pollDispatchRecords` body（416+）**不读 `opts.ide`**。4.0.51 那次 cleanup 命名 + 报出，未修。本片 4.0.55 修。
 
 3. **发布闸门从"只拒一个字面量"改成白名单，于是它立刻挡住了发布。** `publish.yml` 原本只在 `verdict` **精确等于 `"drifted"`** 时失败 —— `partial` / `inconclusive` / 任何别的值都会放行。改成白名单（仅 `consistent` 放行）之后，上面那条伪造的 15/15 不再能放行任何东西，**发布被挡住了**。这是刻意的、也是被接受的：闸门不再是摆设，代价是它开始真的挡。解开它的不是放宽，而是接上一个**能失败的确定性独立检查器**（见第 4 条）。同一轮里 `describeMode()` 被发现把自己描述成 `0.85/0.95`，**漏掉真正生效的 0.80 档**；往下挖还查出一条真实分叉：`peaks skill presence`（每轮都调）在 **≥0.80** 触发 `auto-fire`，而 `peaks code context-now` —— SKILL.md 自己声明的 single source of truth —— **硬编码了它自己的 0.85**。只改描述，**没碰阈值和行为**。
 

package/README-en.md

@@ -140,7 +140,7 @@ Every lane opens with **one slash command**.
 
 | | |
 | --- | --- |
-| **Latest** | [![npm](https://img.shields.io/npm/v/peaks-loop?style=for-the-badge&logo=npm&logoColor=white&color=cb3837)](https://www.npmjs.com/package/peaks-loop) — 4.0.51 (2026-09-16) |
+| **Latest** | [![npm](https://img.shields.io/npm/v/peaks-loop?style=for-the-badge&logo=npm&logoColor=white&color=cb3837)](https://www.npmjs.com/package/peaks-loop) — 4.0.53 (2026-09-17) |
 | **Domains** | Code (`peaks-code`) · Content (`peaks-content`) · Project health (`peaks-doctor`) · Issue sweep (`peaks-issue-fix-orchestrator`) · Custom SOP (`peaks-sop`) · Cross-domain primitives (`peaks-solo` dispatcher · `peaks-resume` · `peaks-status` · `peaks-test` · `peaks-slice-decompose`) |
 | **Sediment pool** | `~/.peaks/` local pool · twice-clean runs auto-promote to a bee · broken runs come back for you to redefine · the bee grows with your taste |
 | **Test suite** | 285+ cases · 4 packages (peaks-loop / peaks-loop-mut / peaks-loop-shared-channel / peaks-loop-shared) · **0 timeouts** · 14 BDD caller-binding edge cases |

package/README.md

@@ -140,7 +140,7 @@ npm i -g peaks-loop
 
 | | |
 | --- | --- |
-| **最新版本** | [![npm](https://img.shields.io/npm/v/peaks-loop?style=for-the-badge&logo=npm&logoColor=white&color=cb3837)](https://www.npmjs.com/package/peaks-loop) — 4.0.51(2026-09-16) |
+| **最新版本** | [![npm](https://img.shields.io/npm/v/peaks-loop?style=for-the-badge&logo=npm&logoColor=white&color=cb3837)](https://www.npmjs.com/package/peaks-loop) — 4.0.53(2026-09-17) |
 | **覆盖域** | 代码(`peaks-code`) · 内容(`peaks-content`) · 项目健康(`peaks-doctor`) · 批量修 issue(`peaks-issue-fix-orchestrator`) · 自定义 SOP(`peaks-sop`) · 通用原语(`peaks-solo` 分诊 / `peaks-resume` 续 / `peaks-status` 看 / `peaks-test` 测 / `peaks-slice-decompose` 切片) |
 | **沉淀池** | `~/.peaks/` 本地池 · 跑两次自动晋升成 bee · 跑翻车让你重定义 · bee 跟着你的口味长 |
 | **测试套件** | 1096 cases · 4 packages (peaks-loop 1015 / runtime 39 / mut 22 / shared-channel 20) · **CI 首次全绿**(ubuntu + windows) · 14 BDD caller-binding coverage |

package/dist/cli/commands/baseline-commands.js

@@ -6,6 +6,7 @@ import { validateBaselineFile } from '../../services/capability-baseline/validat
 import { P0_JOURNEY_IDS } from '../../services/capability-baseline/types.js';
 import { GUARD_CONTRACTS, getGuardContract, isJourneyId } from '../../services/capability-guard-runner/registry.js';
 import { exitCodeForGuardSummary, runAllGuards } from '../../services/capability-guard-runner/runner.js';
+import { RUNTIME_SESSIONLESS_SCOPE } from '../../services/workspace/runtime-layout.js';
 function fail(io, code, message, data = {}) {
     io.stdout(JSON.stringify({ ok: false, command: `baseline`, code, message, data, warnings: [], nextActions: [] }));
     process.exitCode = 1;
@@ -163,9 +164,18 @@ export function registerBaselineCommands(program, io) {
         // It is handed the frozen rows and the registry, not just the guard
         // summary — a scorer that only sees the guard result is a restatement.
         const { runAudit } = await import('../../services/capability-audit-service/runner.js');
+        // `sessionId` is the on-disk scope for the audit artifacts. This command
+        // has NO session — it is the credential-free scorer that runs inside the
+        // secretless OIDC publish gate — and it used to pass the literal `'cli'`,
+        // so every run wrote `.peaks/_runtime/cli/capability-audit/*.json` into
+        // the operator's real workspace. That directory is indistinguishable from
+        // a session dir whose id failed validation, so `peaks doctor`'s
+        // orphan-session check failed on it permanently (`4 orphan session(s)
+        // …: callers, cli, unknown-sid, x`, exit 1). The reserved
+        // underscore-prefixed scope says "machinery, not a session" in the name.
         const audit = await runAudit({
             projectRoot,
-            sessionId: 'cli',
+            sessionId: RUNTIME_SESSIONLESS_SCOPE,
             journeyId: 'J01',
             scorerMode: opts.scorer,
             baselineRows: r.file.rows,

package/dist/cli/commands/codegraph-command-runtime.d.ts

@@ -0,0 +1,28 @@
+import { type CodegraphInvocationOptions } from '../../services/codegraph/codegraph-service.js';
+import { type ProgramIO } from '../cli-helpers.js';
+export interface CommonCodegraphOptions {
+    project: string;
+    peaksJson?: boolean;
+}
+export declare function printCodegraphFailure(io: ProgramIO, command: string, error: unknown, asJson?: boolean, exitCode?: number): void;
+/**
+ * Rewrites bare upstream `codegraph <subcommand>` hints to the peaks-loop
+ * equivalent (`peaks codegraph <subcommand>`). The upstream binary is a
+ * nested transitive dependency and is NOT on PATH, so an LLM that follows
+ * a bare hint like `Run "codegraph init" to initialize` would hit
+ * "command not found". Already-prefixed `peaks codegraph ...` hints and
+ * other `codegraph` references (e.g. `@colbymchenry/codegraph`) are left
+ * untouched.
+ */
+export declare function rewriteBareCodegraphHints(text: string): string;
+/**
+ * Proxy one upstream invocation. Returns whether UPSTREAM FAILED — the
+ * caller needs that to rank the exit-code precedence (an upstream failure
+ * outranks every localized integrity verdict: see the tail of
+ * `runCodegraphStatusCommand`), and it cannot re-derive it from
+ * `process.exitCode` once a later branch has overwritten it.
+ *
+ * Callers that do not rank precedence (every command but `status`) simply
+ * ignore the return value.
+ */
+export declare function runCodegraphCommand(io: ProgramIO, command: string, options: CodegraphInvocationOptions, asJson?: boolean, attributeStdout?: (text: string) => string): Promise<boolean>;

package/dist/cli/commands/codegraph-command-runtime.js

@@ -0,0 +1,72 @@
+// src/cli/commands/codegraph-command-runtime.ts
+//
+// Shared invocation runtime for every `peaks codegraph <verb>`: the option
+// shape they all extend, the failure envelope they all print, the hint
+// rewriter that keeps upstream's bare `codegraph …` hints runnable, and the
+// upstream proxy itself.
+//
+// Extracted verbatim from `codegraph-commands.ts` (rid
+// 2026-09-17-oversize-and-scale, D1 — the 800-line file-size cap). Every moved
+// line is byte-identical and no behaviour changed; `codegraph-commands.ts`
+// re-exports `rewriteBareCodegraphHints` so the public surface is stable.
+//
+// This module is the BOTTOM of the codegraph CLI's import graph. It must not
+// import `codegraph-commands.ts` or `codegraph-status-command.ts`, or the
+// extraction would introduce a cycle.
+import { createCodegraphInvocation, executeCodegraphInvocation } from '../../services/codegraph/codegraph-service.js';
+import { fail } from 'peaks-loop-shared/result';
+import { getErrorMessage, printResult, redactSensitiveErrorMessage } from '../cli-helpers.js';
+export function printCodegraphFailure(io, command, error, asJson, exitCode = 1) {
+    printResult(io, fail(command, 'CODEGRAPH_COMMAND_FAILED', redactSensitiveErrorMessage(getErrorMessage(error)), {}, ['Check the codegraph command options and project path before retrying']), asJson);
+    process.exitCode = exitCode;
+}
+/**
+ * Rewrites bare upstream `codegraph <subcommand>` hints to the peaks-loop
+ * equivalent (`peaks codegraph <subcommand>`). The upstream binary is a
+ * nested transitive dependency and is NOT on PATH, so an LLM that follows
+ * a bare hint like `Run "codegraph init" to initialize` would hit
+ * "command not found". Already-prefixed `peaks codegraph ...` hints and
+ * other `codegraph` references (e.g. `@colbymchenry/codegraph`) are left
+ * untouched.
+ */
+export function rewriteBareCodegraphHints(text) {
+    return text.replace(/(?<![\w-])(?<!peaks\s)codegraph(?=\s+(?:status|init|index|query|files|context|affected)\b)/g, 'peaks codegraph');
+}
+/**
+ * Proxy one upstream invocation. Returns whether UPSTREAM FAILED — the
+ * caller needs that to rank the exit-code precedence (an upstream failure
+ * outranks every localized integrity verdict: see the tail of
+ * `runCodegraphStatusCommand`), and it cannot re-derive it from
+ * `process.exitCode` once a later branch has overwritten it.
+ *
+ * Callers that do not rank precedence (every command but `status`) simply
+ * ignore the return value.
+ */
+export async function runCodegraphCommand(io, command, options, asJson, attributeStdout) {
+    try {
+        const invocation = createCodegraphInvocation(options);
+        const result = await executeCodegraphInvocation(invocation);
+        if (result.exitCode !== null && result.exitCode !== 0 && asJson === true) {
+            printCodegraphFailure(io, command, new Error(result.stderr || result.stdout || `codegraph exited with code ${result.exitCode}`), true, result.exitCode);
+            return true;
+        }
+        const didFail = result.exitCode !== null && result.exitCode !== 0;
+        const rewritten = rewriteBareCodegraphHints(result.stdout);
+        const stdout = attributeStdout === undefined ? rewritten : attributeStdout(rewritten);
+        const stderr = rewriteBareCodegraphHints(result.stderr);
+        if (stdout.length > 0) {
+            io.stdout((didFail ? redactSensitiveErrorMessage(stdout) : stdout).trimEnd());
+        }
+        if (stderr.length > 0) {
+            io.stderr((didFail ? redactSensitiveErrorMessage(stderr) : stderr).trimEnd());
+        }
+        if (didFail) {
+            process.exitCode = result.exitCode;
+        }
+        return didFail;
+    }
+    catch (error) {
+        printCodegraphFailure(io, command, error, asJson);
+        return true;
+    }
+}

package/dist/cli/commands/codegraph-commands.d.ts

@@ -1,14 +1,5 @@
 import { Command } from 'commander';
 import { type ProgramIO } from '../cli-helpers.js';
-/**
- * Rewrites bare upstream `codegraph <subcommand>` hints to the peaks-loop
- * equivalent (`peaks codegraph <subcommand>`). The upstream binary is a
- * nested transitive dependency and is NOT on PATH, so an LLM that follows
- * a bare hint like `Run "codegraph init" to initialize` would hit
- * "command not found". Already-prefixed `peaks codegraph ...` hints and
- * other `codegraph` references (e.g. `@colbymchenry/codegraph`) are left
- * untouched.
- */
-export declare function rewriteBareCodegraphHints(text: string): string;
-export declare function attributeUpstreamUpToDateLine(stdout: string): string;
+export { rewriteBareCodegraphHints } from './codegraph-command-runtime.js';
+export { attributeUpstreamUpToDateLine } from './codegraph-status-command.js';
 export declare function registerCodegraphCommands(program: Command, io: ProgramIO): void;