peaks-loop 4.0.54 → 4.1.0

package/dist/services/adapter/claude-adapter.d.ts

@@ -1,4 +1,4 @@
-import { Adapter, AdapterEnvelope, AdapterSegment } from "./adapter.js";
+import type { Adapter, AdapterEnvelope, AdapterSegment } from './adapter.js';
 export declare class ClaudeAdapter implements Adapter {
     private readonly opts;
     readonly name: "claude";

package/dist/services/adapter/claude-adapter.js

@@ -10,11 +10,11 @@
  * `src/services/ide/adapters/claude-code-adapter.ts` (IDE surface) and
  * `src/services/runtime/vendors/claude-code.ts` (runtime compact).
  */
-import { writeFileSync, mkdirSync, rmSync, existsSync } from "node:fs";
-import { join } from "node:path";
+import { writeFileSync, mkdirSync, rmSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
 export class ClaudeAdapter {
     opts;
-    name = "claude";
+    name = 'claude';
     constructor(opts) {
         this.opts = opts;
     }
@@ -22,7 +22,7 @@ export class ClaudeAdapter {
         return true; /* Claude is the default; ship this slice first */
     }
     async resolveScratchDir(beeName) {
-        return join(this.opts.home, ".claude", "skills", `peaks-bee-${beeName}.peaks-generated`);
+        return join(this.opts.home, '.claude', 'skills', `peaks-bee-${beeName}.peaks-generated`);
     }
     async materialize(beeName, env, segments) {
         const dir = await this.resolveScratchDir(beeName);
@@ -30,12 +30,12 @@ export class ClaudeAdapter {
             rmSync(dir, { recursive: true, force: true });
         mkdirSync(dir, { recursive: true });
         const frontmatter = `---\nname: peaks-bee-${beeName}\ndescription: peaks-loop generated bee ${beeName} — see local SkillHub for source\n---\n\n`;
-        const body = `${env.preamble}\n\n` + segments.map((s) => s.skillMd).join("\n\n");
-        writeFileSync(join(dir, "SKILL.md"), frontmatter + body);
-        mkdirSync(join(dir, "scripts"), { recursive: true });
+        const body = `${env.preamble}\n\n` + segments.map((s) => s.skillMd).join('\n\n');
+        writeFileSync(join(dir, 'SKILL.md'), frontmatter + body);
+        mkdirSync(join(dir, 'scripts'), { recursive: true });
         for (const s of segments) {
             for (const sc of s.scripts)
-                writeFileSync(join(dir, "scripts", sc.name), sc.content);
+                writeFileSync(join(dir, 'scripts', sc.name), sc.content);
         }
         return dir;
     }

package/dist/services/adapter/codex-adapter.d.ts

@@ -10,8 +10,8 @@
  * dispatched-sub-agent runtime). `detect()` here returns a hardcoded
  * `false`; every other method throws `ADAPTER_NOT_IMPLEMENTED`.
  */
-import { Adapter } from "./adapter.js";
-export declare class CodexAdapter implements Pick<Adapter, "name"> {
+import { Adapter } from './adapter.js';
+export declare class CodexAdapter implements Pick<Adapter, 'name'> {
     private readonly _o;
     readonly name: "codex";
     constructor(_o: {

package/dist/services/adapter/codex-adapter.js

@@ -10,17 +10,29 @@
  * dispatched-sub-agent runtime). `detect()` here returns a hardcoded
  * `false`; every other method throws `ADAPTER_NOT_IMPLEMENTED`.
  */
-import { ADAPTER_NOT_IMPLEMENTED } from "./adapter.js";
+import { ADAPTER_NOT_IMPLEMENTED } from './adapter.js';
 export class CodexAdapter {
     _o;
-    name = "codex";
+    name = 'codex';
     constructor(_o) {
         this._o = _o;
     }
-    async detect() { return false; }
-    async resolveScratchDir() { throw new ADAPTER_NOT_IMPLEMENTED("codex", "resolveScratchDir"); }
-    async materialize() { throw new ADAPTER_NOT_IMPLEMENTED("codex", "materialize"); }
-    async publish() { throw new ADAPTER_NOT_IMPLEMENTED("codex", "publish"); }
-    async activate() { throw new ADAPTER_NOT_IMPLEMENTED("codex", "activate"); }
-    async cleanup() { throw new ADAPTER_NOT_IMPLEMENTED("codex", "cleanup"); }
+    async detect() {
+        return false;
+    }
+    async resolveScratchDir() {
+        throw new ADAPTER_NOT_IMPLEMENTED('codex', 'resolveScratchDir');
+    }
+    async materialize() {
+        throw new ADAPTER_NOT_IMPLEMENTED('codex', 'materialize');
+    }
+    async publish() {
+        throw new ADAPTER_NOT_IMPLEMENTED('codex', 'publish');
+    }
+    async activate() {
+        throw new ADAPTER_NOT_IMPLEMENTED('codex', 'activate');
+    }
+    async cleanup() {
+        throw new ADAPTER_NOT_IMPLEMENTED('codex', 'cleanup');
+    }
 }

package/dist/services/adapter/copilot-adapter.d.ts

@@ -10,8 +10,8 @@
  * dispatched-sub-agent runtime). `detect()` here returns a hardcoded
  * `false`; every other method throws `ADAPTER_NOT_IMPLEMENTED`.
  */
-import { Adapter } from "./adapter.js";
-export declare class CopilotAdapter implements Pick<Adapter, "name"> {
+import { Adapter } from './adapter.js';
+export declare class CopilotAdapter implements Pick<Adapter, 'name'> {
     private readonly _o;
     readonly name: "copilot";
     constructor(_o: {

package/dist/services/adapter/copilot-adapter.js

@@ -10,17 +10,29 @@
  * dispatched-sub-agent runtime). `detect()` here returns a hardcoded
  * `false`; every other method throws `ADAPTER_NOT_IMPLEMENTED`.
  */
-import { ADAPTER_NOT_IMPLEMENTED } from "./adapter.js";
+import { ADAPTER_NOT_IMPLEMENTED } from './adapter.js';
 export class CopilotAdapter {
     _o;
-    name = "copilot";
+    name = 'copilot';
     constructor(_o) {
         this._o = _o;
     }
-    async detect() { return false; }
-    async resolveScratchDir() { throw new ADAPTER_NOT_IMPLEMENTED("copilot", "resolveScratchDir"); }
-    async materialize() { throw new ADAPTER_NOT_IMPLEMENTED("copilot", "materialize"); }
-    async publish() { throw new ADAPTER_NOT_IMPLEMENTED("copilot", "publish"); }
-    async activate() { throw new ADAPTER_NOT_IMPLEMENTED("copilot", "activate"); }
-    async cleanup() { throw new ADAPTER_NOT_IMPLEMENTED("copilot", "cleanup"); }
+    async detect() {
+        return false;
+    }
+    async resolveScratchDir() {
+        throw new ADAPTER_NOT_IMPLEMENTED('copilot', 'resolveScratchDir');
+    }
+    async materialize() {
+        throw new ADAPTER_NOT_IMPLEMENTED('copilot', 'materialize');
+    }
+    async publish() {
+        throw new ADAPTER_NOT_IMPLEMENTED('copilot', 'publish');
+    }
+    async activate() {
+        throw new ADAPTER_NOT_IMPLEMENTED('copilot', 'activate');
+    }
+    async cleanup() {
+        throw new ADAPTER_NOT_IMPLEMENTED('copilot', 'cleanup');
+    }
 }

package/dist/services/artifacts/artifact-prerequisites.js

@@ -41,7 +41,10 @@ const CODE_REVIEW = {
     description: 'Code review evidence (CRITICAL/HIGH must be fixed before handoff)',
     mustContain: ['## Findings', 'CRITICAL']
 };
-const SECURITY_REVIEW = { relativePath: 'rd/security-review.md', description: 'Security review evidence for the changed surface' };
+const SECURITY_REVIEW = {
+    relativePath: 'rd/security-review.md',
+    description: 'Security review evidence for the changed surface'
+};
 // Gate B9 — RD-side perf baseline (peaks-rd SKILL "Parallel review fan-out").
 // The file must exist; the body must either carry a Results table marker
 // (per peaks-rd SKILL "Mandatory perf-baseline output") or the explicit
@@ -387,7 +390,8 @@ async function resolvePrerequisiteAbsolutePath(sessionRoot, prerequisite, reques
     try {
         entries = await readdir(dir);
     }
-    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+    catch {
+        // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
         return null;
     }
     const match = entries.find((name) => /^\d+-/.test(name) && name.endsWith(targetSuffix));
@@ -440,9 +444,9 @@ export function prerequisiteBodyViolations(prerequisite, body) {
 /** True when `prerequisite` declares any body check at all. Guards the read so
  *  a prereq with no body contract is never opened (unchanged behaviour). */
 function hasBodyChecks(prerequisite) {
-    return (prerequisite.mustContain?.length ?? 0) > 0
-        || (prerequisite.headingMustContain?.length ?? 0) > 0
-        || (prerequisite.mustContainAny?.length ?? 0) > 0;
+    return ((prerequisite.mustContain?.length ?? 0) > 0 ||
+        (prerequisite.headingMustContain?.length ?? 0) > 0 ||
+        (prerequisite.mustContainAny?.length ?? 0) > 0);
 }
 export async function checkPrerequisites(options) {
     const requirements = getPrerequisitesFor(options.role, options.newState, options.requestType);
@@ -470,9 +474,7 @@ export async function checkPrerequisites(options) {
     const canonicalSessionRoot = options.sessionId !== undefined
         ? join(options.projectRoot, '.peaks', '_runtime', options.sessionId)
         : null;
-    const legacySessionRoot = options.sessionId !== undefined
-        ? join(options.projectRoot, '.peaks', options.sessionId)
-        : null;
+    const legacySessionRoot = options.sessionId !== undefined ? join(options.projectRoot, '.peaks', options.sessionId) : null;
     const missing = [];
     const warnings = [];
     for (const prerequisite of requirements) {

package/dist/services/artifacts/artifact-service.js

@@ -83,7 +83,9 @@ export function createGuidedArtifactSetup() {
             '  - Run: peaks artifacts workspace',
             '',
             'Step 4: Complete',
-            artifactRepo ? '  - Artifact sync is ready when workspace has remote artifact storage configured' : '  - Local artifact storage is ready'
+            artifactRepo
+                ? '  - Artifact sync is ready when workspace has remote artifact storage configured'
+                : '  - Local artifact storage is ready'
         ]
     };
 }

package/dist/services/artifacts/artifact-template-bodies.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Static template bodies for the five request-artifact templates in
+ * artifact-templates.ts, hoisted VERBATIM for the 300-line cap
+ * (C-family wave 4, leaf c4w1-artifacts). Each constant is the byte-exact
+ * middle chunk of the corresponding template markdown body; the render
+ * functions compose head + body + tail, so emitted markdown is unchanged.
+ */
+export declare const PRD_TEMPLATE_BODY = "## Goals\n\n- ...\n\n## Non-goals\n\n- ...\n\n## Preserved behavior\n\n- ...\n\n## Acceptance criteria\n\n- ... (browser-verifiable when frontend is in scope)\n\n## Frontend delta (only when target is frontend)\n\n- pages / routes / components / states / permissions / data deps / edge cases\n- \u5F85\u8054\u8C03\u6001: ...\n- API contracts pending: ...\n\n## Risks and open questions\n\n- ...\n\n";
+export declare const UI_TEMPLATE_BODY = "## Affected surfaces\n\n- pages / routes / components / modals / states (loading, empty, error, hover, focus, active, responsive)\n- explicit out-of-scope surfaces (do not modify)\n\n## UX flow and page states\n\n- entry points, primary flow, secondary flows, exit points\n- state machine per surface when state transitions matter\n\n## Visual constraints\n\n- typography pair: ...\n- palette: ...\n- density and motion intensity dials: ...\n- rejected generic patterns\n\n## Interaction constraints\n\n- keyboard, focus order, ARIA roles, gesture support, accessibility minima\n\n## UI regression seeds\n\n- list of visible regressions QA must check against the prior state\n\n## Browser evidence\n\n- sanitized observations only \u2014 no login URLs, cookies, headers, tokens, storage state, browser traces, or screenshots/logs with PII / SSO / MFA material\n\n";
+export declare const RD_TEMPLATE_BODY = "## Red-line scope\n\n- in-scope files / routes / API paths / data models\n- explicit out-of-scope surfaces (do not modify, mock, delete, or replace)\n\n## Standards preflight\n\n- peaks standards init/update --project <path> --dry-run output paths and status\n- planned application: apply | review-only | blocked\n\n## OpenSpec linkage (when openspec/ exists)\n\n- change-id: <openspec change id>\n- entry validate: peaks openspec validate <change-id> data.valid status\n- to-rd projection: peaks openspec to-rd <change-id> artifact path\n- exit validate (after implementation): status\n\n## Coverage status\n\n- current total UT coverage: <percent>\n- new/changed code coverage: <percent>\n- gate verdict: pass | legacy-accepted | blocked\n\n## Slice contract\n\n- slice id, functional boundary, pre-refactor behavior, target structure, unit-test requirements, acceptance checks, rollback plan, commit boundary\n\n## Implementation evidence\n\n- diff paths, test commands + outputs, code review findings + fixes, security review findings + fixes, dry-run output\n\n## MCP usage (when external docs lookup was used)\n\n- capabilityId / tool / sanitized args\n- artifact path of stored result\n- no secrets, no full network bodies\n\n";
+export declare const QA_TEMPLATE_BODY = "## Red-line boundary check\n\n- in-scope changes seen in the diff (match PRD + RD scope)\n- out-of-scope changes flagged (any extra file, route, mock, fixture, behavior)\n- verdict: clean | boundary-violation\n\n## OpenSpec exit gate (when openspec/ exists)\n\n- change-id: <id>\n- peaks openspec validate <id> data.valid: true | false\n- issues: ...\n\n## Acceptance checks\n\n- per-criterion: check method, result (pass | fail | blocked), evidence path\n\n## Mandatory validation gates\n\n- unit tests: command + pass/fail + coverage delta\n- API validation (when applicable): request paths exercised, evidence\n- browser E2E (when frontend): headed gstack/browse/dist/browse visible-browser confirmation, sanitized route/actions, console/network observations\n- browser-error feedback loop: page errors, console exceptions, broken network, hydration failures \u2192 return-to-RD evidence\n- security check: tool used, findings, fixes, unresolved risks\n- performance check: tool used, baseline vs after numbers when available\n- validation report path\n\n## Regression matrix\n\n- list of surfaces / API paths / browser flows checked\n- pass/fail per row\n\n## Browser evidence\n\n- sanitized observations only \u2014 no login URLs, cookies, headers, tokens, storage state, browser traces, or screenshots/logs with PII / SSO / MFA material\n\n## Verdict\n\n- overall: pass | return-to-rd | blocked\n\n";
+export declare const SC_TEMPLATE_BODY = "## Change impact\n\n- modules / files / routes / data models touched\n- blast radius: local | cross-cutting | release-critical\n- rollback strategy\n\n## Commit boundaries\n\n- one commit per OpenSpec heading (when openspec/ exists)\n- otherwise: list of slice ids \u2192 commit message + scope\n\n## Artifact retention\n\n- prd artifact: ...\n- rd artifact: ...\n- qa artifact: ...\n- ui artifact: ... (when UI involved)\n- coverage evidence: ...\n- code review evidence: ...\n\n## Sync / authorization\n\n";

package/dist/services/artifacts/artifact-template-bodies.js

@@ -0,0 +1,165 @@
+/**
+ * Static template bodies for the five request-artifact templates in
+ * artifact-templates.ts, hoisted VERBATIM for the 300-line cap
+ * (C-family wave 4, leaf c4w1-artifacts). Each constant is the byte-exact
+ * middle chunk of the corresponding template markdown body; the render
+ * functions compose head + body + tail, so emitted markdown is unchanged.
+ */
+export const PRD_TEMPLATE_BODY = `## Goals
+
+- ...
+
+## Non-goals
+
+- ...
+
+## Preserved behavior
+
+- ...
+
+## Acceptance criteria
+
+- ... (browser-verifiable when frontend is in scope)
+
+## Frontend delta (only when target is frontend)
+
+- pages / routes / components / states / permissions / data deps / edge cases
+- 待联调态: ...
+- API contracts pending: ...
+
+## Risks and open questions
+
+- ...
+
+`;
+export const UI_TEMPLATE_BODY = `## Affected surfaces
+
+- pages / routes / components / modals / states (loading, empty, error, hover, focus, active, responsive)
+- explicit out-of-scope surfaces (do not modify)
+
+## UX flow and page states
+
+- entry points, primary flow, secondary flows, exit points
+- state machine per surface when state transitions matter
+
+## Visual constraints
+
+- typography pair: ...
+- palette: ...
+- density and motion intensity dials: ...
+- rejected generic patterns
+
+## Interaction constraints
+
+- keyboard, focus order, ARIA roles, gesture support, accessibility minima
+
+## UI regression seeds
+
+- list of visible regressions QA must check against the prior state
+
+## Browser evidence
+
+- sanitized observations only — no login URLs, cookies, headers, tokens, storage state, browser traces, or screenshots/logs with PII / SSO / MFA material
+
+`;
+export const RD_TEMPLATE_BODY = `## Red-line scope
+
+- in-scope files / routes / API paths / data models
+- explicit out-of-scope surfaces (do not modify, mock, delete, or replace)
+
+## Standards preflight
+
+- peaks standards init/update --project <path> --dry-run output paths and status
+- planned application: apply | review-only | blocked
+
+## OpenSpec linkage (when openspec/ exists)
+
+- change-id: <openspec change id>
+- entry validate: peaks openspec validate <change-id> data.valid status
+- to-rd projection: peaks openspec to-rd <change-id> artifact path
+- exit validate (after implementation): status
+
+## Coverage status
+
+- current total UT coverage: <percent>
+- new/changed code coverage: <percent>
+- gate verdict: pass | legacy-accepted | blocked
+
+## Slice contract
+
+- slice id, functional boundary, pre-refactor behavior, target structure, unit-test requirements, acceptance checks, rollback plan, commit boundary
+
+## Implementation evidence
+
+- diff paths, test commands + outputs, code review findings + fixes, security review findings + fixes, dry-run output
+
+## MCP usage (when external docs lookup was used)
+
+- capabilityId / tool / sanitized args
+- artifact path of stored result
+- no secrets, no full network bodies
+
+`;
+export const QA_TEMPLATE_BODY = `## Red-line boundary check
+
+- in-scope changes seen in the diff (match PRD + RD scope)
+- out-of-scope changes flagged (any extra file, route, mock, fixture, behavior)
+- verdict: clean | boundary-violation
+
+## OpenSpec exit gate (when openspec/ exists)
+
+- change-id: <id>
+- peaks openspec validate <id> data.valid: true | false
+- issues: ...
+
+## Acceptance checks
+
+- per-criterion: check method, result (pass | fail | blocked), evidence path
+
+## Mandatory validation gates
+
+- unit tests: command + pass/fail + coverage delta
+- API validation (when applicable): request paths exercised, evidence
+- browser E2E (when frontend): headed gstack/browse/dist/browse visible-browser confirmation, sanitized route/actions, console/network observations
+- browser-error feedback loop: page errors, console exceptions, broken network, hydration failures → return-to-RD evidence
+- security check: tool used, findings, fixes, unresolved risks
+- performance check: tool used, baseline vs after numbers when available
+- validation report path
+
+## Regression matrix
+
+- list of surfaces / API paths / browser flows checked
+- pass/fail per row
+
+## Browser evidence
+
+- sanitized observations only — no login URLs, cookies, headers, tokens, storage state, browser traces, or screenshots/logs with PII / SSO / MFA material
+
+## Verdict
+
+- overall: pass | return-to-rd | blocked
+
+`;
+export const SC_TEMPLATE_BODY = `## Change impact
+
+- modules / files / routes / data models touched
+- blast radius: local | cross-cutting | release-critical
+- rollback strategy
+
+## Commit boundaries
+
+- one commit per OpenSpec heading (when openspec/ exists)
+- otherwise: list of slice ids → commit message + scope
+
+## Artifact retention
+
+- prd artifact: ...
+- rd artifact: ...
+- qa artifact: ...
+- ui artifact: ... (when UI involved)
+- coverage evidence: ...
+- code review evidence: ...
+
+## Sync / authorization
+
+`;

package/dist/services/artifacts/artifact-templates.js

@@ -1,3 +1,4 @@
+import { PRD_TEMPLATE_BODY, UI_TEMPLATE_BODY, RD_TEMPLATE_BODY, QA_TEMPLATE_BODY, SC_TEMPLATE_BODY } from './artifact-template-bodies.js';
 /**
  * Handoff path helpers.
  *
@@ -26,40 +27,16 @@ export function formatSkillUsageLessonsPath(sessionId) {
     return `.peaks/_runtime/${sessionId}/txt/skill-usage-lessons.md`;
 }
 function renderPrdTemplate(requestId, _sessionId, sessionId, timestamp, requestType) {
-    return `# PRD Request ${requestId}
+    return (`# PRD Request ${requestId}
 
 - session: ${sessionId}
 - type: ${requestType}
 - source: <ticket, message URL, or "verbal" with a short sanitized quote>
 - raw input (sanitized): <one-paragraph restatement of what the user actually asked for>
 
-## Goals
-
-- ...
-
-## Non-goals
-
-- ...
-
-## Preserved behavior
-
-- ...
-
-## Acceptance criteria
-
-- ... (browser-verifiable when frontend is in scope)
-
-## Frontend delta (only when target is frontend)
-
-- pages / routes / components / states / permissions / data deps / edge cases
-- 待联调态: ...
-- API contracts pending: ...
-
-## Risks and open questions
-
-- ...
-
-## Handoff
+` +
+        PRD_TEMPLATE_BODY +
+        `## Handoff
 
 - to peaks-rd: ${formatHandoffPath(sessionId, 'rd', requestId)}
 - to peaks-qa: ${formatHandoffPath(sessionId, 'qa', requestId)}
@@ -70,10 +47,10 @@ function renderPrdTemplate(requestId, _sessionId, sessionId, timestamp, requestT
 - created: ${timestamp}
 - last update: ${timestamp}
 - state: draft
-`;
+`);
 }
 function renderUiTemplate(requestId, _sessionId, sessionId, timestamp, requestType) {
-    return `# UI Request ${requestId}
+    return (`# UI Request ${requestId}
 
 - session: ${sessionId}
 - linked-prd: ${formatHandoffPath(sessionId, 'prd', requestId)}
@@ -81,36 +58,9 @@ function renderUiTemplate(requestId, _sessionId, sessionId, timestamp, requestTy
 - scope: full new surface | iteration on existing surface | regression fix | visual refresh
 - design direction: editorial | bento | Swiss | luxury | retro-futurist | glass | product-system | other-explicit-name
 
-## Affected surfaces
-
-- pages / routes / components / modals / states (loading, empty, error, hover, focus, active, responsive)
-- explicit out-of-scope surfaces (do not modify)
-
-## UX flow and page states
-
-- entry points, primary flow, secondary flows, exit points
-- state machine per surface when state transitions matter
-
-## Visual constraints
-
-- typography pair: ...
-- palette: ...
-- density and motion intensity dials: ...
-- rejected generic patterns
-
-## Interaction constraints
-
-- keyboard, focus order, ARIA roles, gesture support, accessibility minima
-
-## UI regression seeds
-
-- list of visible regressions QA must check against the prior state
-
-## Browser evidence
-
-- sanitized observations only — no login URLs, cookies, headers, tokens, storage state, browser traces, or screenshots/logs with PII / SSO / MFA material
-
-## Handoff
+` +
+        UI_TEMPLATE_BODY +
+        `## Handoff
 
 - to peaks-rd: ${formatHandoffPath(sessionId, 'rd', requestId)}
 - to peaks-qa: ${formatHandoffPath(sessionId, 'qa', requestId)}
@@ -120,54 +70,19 @@ function renderUiTemplate(requestId, _sessionId, sessionId, timestamp, requestTy
 - created: ${timestamp}
 - last update: ${timestamp}
 - state: draft
-`;
+`);
 }
 function renderRdTemplate(requestId, _sessionId, sessionId, timestamp, requestType) {
-    return `# RD Request ${requestId}
+    return (`# RD Request ${requestId}
 
 - session: ${sessionId}
 - linked-prd: ${formatHandoffPath(sessionId, 'prd', requestId)}
 - linked-ui:  ${formatHandoffPath(sessionId, 'ui', requestId)}  (when UI involved)
 - type: ${requestType}
 
-## Red-line scope
-
-- in-scope files / routes / API paths / data models
-- explicit out-of-scope surfaces (do not modify, mock, delete, or replace)
-
-## Standards preflight
-
-- peaks standards init/update --project <path> --dry-run output paths and status
-- planned application: apply | review-only | blocked
-
-## OpenSpec linkage (when openspec/ exists)
-
-- change-id: <openspec change id>
-- entry validate: peaks openspec validate <change-id> data.valid status
-- to-rd projection: peaks openspec to-rd <change-id> artifact path
-- exit validate (after implementation): status
-
-## Coverage status
-
-- current total UT coverage: <percent>
-- new/changed code coverage: <percent>
-- gate verdict: pass | legacy-accepted | blocked
-
-## Slice contract
-
-- slice id, functional boundary, pre-refactor behavior, target structure, unit-test requirements, acceptance checks, rollback plan, commit boundary
-
-## Implementation evidence
-
-- diff paths, test commands + outputs, code review findings + fixes, security review findings + fixes, dry-run output
-
-## MCP usage (when external docs lookup was used)
-
-- capabilityId / tool / sanitized args
-- artifact path of stored result
-- no secrets, no full network bodies
-
-## Handoff
+` +
+        RD_TEMPLATE_BODY +
+        `## Handoff
 
 - to peaks-qa: ${formatHandoffPath(sessionId, 'qa', requestId)}
 - to peaks-sc: ${formatCommitBoundaryPath(sessionId, requestId)}
@@ -177,10 +92,10 @@ function renderRdTemplate(requestId, _sessionId, sessionId, timestamp, requestTy
 - created: ${timestamp}
 - last update: ${timestamp}
 - state: draft
-`;
+`);
 }
 function renderQaTemplate(requestId, _sessionId, sessionId, timestamp, requestType) {
-    return `# QA Request ${requestId}
+    return (`# QA Request ${requestId}
 
 - session: ${sessionId}
 - linked-prd: ${formatHandoffPath(sessionId, 'prd', requestId)}
@@ -188,54 +103,17 @@ function renderQaTemplate(requestId, _sessionId, sessionId, timestamp, requestTy
 - linked-ui:  ${formatHandoffPath(sessionId, 'ui', requestId)}  (when UI involved)
 - type: ${requestType}
 
-## Red-line boundary check
-
-- in-scope changes seen in the diff (match PRD + RD scope)
-- out-of-scope changes flagged (any extra file, route, mock, fixture, behavior)
-- verdict: clean | boundary-violation
-
-## OpenSpec exit gate (when openspec/ exists)
-
-- change-id: <id>
-- peaks openspec validate <id> data.valid: true | false
-- issues: ...
-
-## Acceptance checks
-
-- per-criterion: check method, result (pass | fail | blocked), evidence path
-
-## Mandatory validation gates
-
-- unit tests: command + pass/fail + coverage delta
-- API validation (when applicable): request paths exercised, evidence
-- browser E2E (when frontend): headed gstack/browse/dist/browse visible-browser confirmation, sanitized route/actions, console/network observations
-- browser-error feedback loop: page errors, console exceptions, broken network, hydration failures → return-to-RD evidence
-- security check: tool used, findings, fixes, unresolved risks
-- performance check: tool used, baseline vs after numbers when available
-- validation report path
-
-## Regression matrix
-
-- list of surfaces / API paths / browser flows checked
-- pass/fail per row
-
-## Browser evidence
-
-- sanitized observations only — no login URLs, cookies, headers, tokens, storage state, browser traces, or screenshots/logs with PII / SSO / MFA material
-
-## Verdict
-
-- overall: pass | return-to-rd | blocked
-
-## Status
+` +
+        QA_TEMPLATE_BODY +
+        `## Status
 
 - created: ${timestamp}
 - last update: ${timestamp}
 - state: draft
-`;
+`);
 }
 function renderScTemplate(requestId, _sessionId, sessionId, timestamp, requestType) {
-    return `# SC Request ${requestId}
+    return (`# SC Request ${requestId}
 
 - session: ${sessionId}
 - linked-prd: ${formatHandoffPath(sessionId, 'prd', requestId)}
@@ -244,29 +122,9 @@ function renderScTemplate(requestId, _sessionId, sessionId, timestamp, requestTy
 - linked-ui:  ${formatHandoffPath(sessionId, 'ui', requestId)}  (when UI involved)
 - type: ${requestType}
 
-## Change impact
-
-- modules / files / routes / data models touched
-- blast radius: local | cross-cutting | release-critical
-- rollback strategy
-
-## Commit boundaries
-
-- one commit per OpenSpec heading (when openspec/ exists)
-- otherwise: list of slice ids → commit message + scope
-
-## Artifact retention
-
-- prd artifact: ...
-- rd artifact: ...
-- qa artifact: ...
-- ui artifact: ... (when UI involved)
-- coverage evidence: ...
-- code review evidence: ...
-
-## Sync / authorization
-
-- artifact workspace path: .peaks/_runtime/${sessionId}/
+` +
+        SC_TEMPLATE_BODY +
+        `- artifact workspace path: .peaks/_runtime/${sessionId}/
 - memory sync authorized: yes | no
 - artifact sync authorized: yes | no
 - rationale if not authorized: keep local
@@ -284,7 +142,7 @@ function renderScTemplate(requestId, _sessionId, sessionId, timestamp, requestTy
 - created: ${timestamp}
 - last update: ${timestamp}
 - state: draft
-`;
+`);
 }
 export function renderTemplate(role, requestId, sessionId, changeSlug, timestamp, requestType) {
     switch (role) {