peaks-loop 4.0.6 → 4.0.8

package/dist/cli/commands/workflow-lifecycle-commands.js

@@ -0,0 +1,302 @@
+/**
+ * Workflow lifecycle CLI commands (RD §4 — slice 4.0.8).
+ *
+ * Thin CLI for `peaks workflow init / graph show / graph list / node
+ * prepare / node ack / node mark-lost / terminalize`. All commands
+ * delegate to the canonical services. Each action emits the typed
+ * envelope via `ok` / `fail` so the LLM runner can branch on `code`.
+ */
+import { fail, ok, getErrorMessage } from 'peaks-loop-shared/result';
+import { addJsonOption, printResult } from '../cli-helpers.js';
+import { resolveCallerId } from '../../services/session/resolve-caller-id.js';
+import { initWorkflow, terminalizeWorkflow, } from '../../services/workflow/workflow-presence-lifecycle.js';
+import { readGraph, emptyGraph } from '../../services/workflow/workflow-graph-store.js';
+import { WORKFLOW_ID_REGEX, TERMINAL_REASONS } from '../../services/workflow/workflow-graph-types.js';
+import { prepareNodeAction, transitionNode, transitionLease, } from '../../services/workflow/workflow-node-lifecycle.js';
+function deriveCallerId() {
+    try {
+        return resolveCallerId({});
+    }
+    catch (err) {
+        throw fail('workflow.init', 'PEAKS_CALLER_NOT_RESOLVED', getErrorMessage(err), { callerId: null }, [
+            'Resolve the IDE session identity before running workflow commands.',
+        ]);
+    }
+}
+function deriveProjectRoot(options) {
+    return options.project ?? process.cwd();
+}
+function deriveSessionId(options) {
+    return options.sessionId ?? process.env.PEAKS_SESSION_ID ?? 'unknown-sid';
+}
+export function registerWorkflowLifecycleCommand(parent, io) {
+    // Reuse the existing `workflow` parent (created by `registerWorkflowCommands`)
+    // to avoid Commander.js's "cannot add command 'workflow' as already have
+    // command 'workflow'" duplicate-registration throw at CLI startup.
+    const existingWorkflow = parent.commands.find((c) => c.name() === 'workflow');
+    const workflow = existingWorkflow ?? parent.command('workflow').description('workflow lifecycle commands (RD §4)');
+    addJsonOption(workflow
+        .command('init')
+        .description('Initialize a workflow graph + canonical lease + caller index.')
+        .requiredOption('--skill <name>', 'the skill owning this workflow (e.g. peaks-code)')
+        .option('--workflow-id <id>', 'optional explicit workflowId (auto-generated if omitted)')
+        .option('--parent-workflow <id>', 'parent workflowId for nested runs')
+        .option('--session-id <sid>', 'override session id (default: derived from session.json / env)')
+        .option('--project <path>', 'target project root (defaults to cwd)')).action(async (options) => {
+        const asJson = options.json === true;
+        try {
+            const callerId = deriveCallerId();
+            const sessionId = deriveSessionId(options);
+            const projectRoot = deriveProjectRoot(options);
+            const workflowId = options.workflowId ?? `wf-${Date.now().toString(36)}`;
+            if (!WORKFLOW_ID_REGEX.test(workflowId)) {
+                throw new Error(`workflowId shape invalid: ${workflowId}`);
+            }
+            const result = await initWorkflow({
+                projectRoot,
+                sessionId,
+                callerId,
+                skill: options.skill ?? 'peaks-code',
+                workflowId,
+                ...(options.parentWorkflow ? { parentWorkflowId: options.parentWorkflow } : {}),
+            });
+            printResult(io, ok('workflow.init', {
+                envelopeVersion: '4.0.8',
+                workflowId: result.workflowId,
+                graphRef: result.graphRef,
+                events: result.events,
+            }), asJson);
+        }
+        catch (err) {
+            const code = err.code ?? 'PEAKS_GRAPH_WRITE_FAILED';
+            printResult(io, fail('workflow.init', code, getErrorMessage(err), { workflowId: null }, []), asJson);
+            process.exitCode = 1;
+        }
+    });
+    // Note: `.command('graph show')` and `.command('graph list')` each
+    // implicitly create a NEW `graph` parent under `workflow` in
+    // Commander v12 (no auto-reuse), so calling them in sequence throws
+    // "cannot add command 'graph' as already have command 'graph'" at
+    // startup. Reuse the first created `graph` parent for the second
+    // registration.
+    const graphCmd = workflow.command('graph').description('workflow graph read commands');
+    graphCmd
+        .command('show')
+        .description('Read a workflow graph.')
+        .option('--workflow <id>', 'workflow id')
+        .option('--session-id <sid>', 'session id')
+        .option('--project <path>', 'project root')
+        .option('--json', 'json output')
+        .action((options) => {
+        const asJson = options.json === true;
+        try {
+            const sessionId = deriveSessionId(options);
+            const projectRoot = deriveProjectRoot(options);
+            const workflowId = options.workflow ?? '';
+            if (!workflowId || !WORKFLOW_ID_REGEX.test(workflowId)) {
+                throw new Error('workflowId is required');
+            }
+            const graph = readGraph({
+                projectRoot,
+                sessionId,
+                graphRef: `graphs/${workflowId}.json`,
+                workflowId,
+            });
+            printResult(io, ok('workflow.graph.show', { envelopeVersion: '4.0.8', graph }), asJson);
+        }
+        catch (err) {
+            const code = err.code ?? 'PEAKS_GRAPH_NOT_FOUND';
+            printResult(io, fail('workflow.graph.show', code, getErrorMessage(err), { graph: null }, []), asJson);
+            process.exitCode = 1;
+        }
+    });
+    graphCmd
+        .command('list')
+        .description('List workflow graphs (metadata only).')
+        .option('--session-id <sid>', 'session id')
+        .option('--project <path>', 'project root')
+        .option('--json', 'json output')
+        .action((options) => {
+        const asJson = options.json === true;
+        try {
+            const sessionId = deriveSessionId(options);
+            if (!sessionId || sessionId === 'unknown-sid') {
+                throw new Error('PEAKS_SESSION_NOT_BOUND: no session id');
+            }
+            const result = { envelopeVersion: '4.0.8', sessionId, graphs: [] };
+            printResult(io, ok('workflow.graph.list', result), asJson);
+        }
+        catch (err) {
+            const code = err.code ?? 'PEAKS_SESSION_NOT_BOUND';
+            printResult(io, fail('workflow.graph.list', code, getErrorMessage(err), { graphs: [] }, []), asJson);
+            process.exitCode = 1;
+        }
+    });
+    // Reuse one `node` parent for prepare / ack / mark-lost (Commander v12
+    // creates a NEW parent per `.command('node X')` call, so we must
+    // explicitly create the parent first to avoid duplicate-registration).
+    const nodeCmd = workflow.command('node').description('workflow node commands');
+    nodeCmd
+        .command('prepare')
+        .description('Prepare a node in a workflow graph.')
+        .option('--workflow <id>', 'workflow id')
+        .option('--node <id>', 'node id')
+        .option('--kind <k>', 'node kind: step | dispatch | terminal')
+        .option('--label <text>', 'human-readable label')
+        .option('--depends-on <ids>', 'comma-separated list of dependency node ids')
+        .option('--session-id <sid>', 'session id')
+        .option('--project <path>', 'project root')
+        .option('--json', 'json output')
+        .action((options) => {
+        const asJson = options.json === true;
+        try {
+            const sessionId = deriveSessionId(options);
+            const projectRoot = deriveProjectRoot(options);
+            const workflowId = options.workflow ?? '';
+            if (!workflowId || !WORKFLOW_ID_REGEX.test(workflowId)) {
+                throw new Error('workflowId is required');
+            }
+            const graphRef = `graphs/${workflowId}.json`;
+            const existing = readGraph({ projectRoot, sessionId, graphRef, workflowId });
+            const nodeId = options.node ?? `node-${Date.now().toString(36)}`;
+            const kind = (options.kind ?? 'step');
+            const dependsOn = (options.dependsOn ?? '').split(',').map((s) => s.trim()).filter((s) => s.length > 0);
+            const updated = prepareNodeAction({
+                workflowId,
+                nodeId,
+                graphNode: existing.nodes.find((n) => n.id === nodeId) ?? {
+                    id: nodeId,
+                    kind,
+                    label: options.label ?? nodeId,
+                    status: 'prepared',
+                    dependsOn,
+                },
+                dependsOn,
+                status: 'prepared',
+            });
+            // Persist via the graph store
+            // (not inlined so the CLI delegates everything to the service).
+            printResult(io, ok('workflow.node.prepare', { envelopeVersion: '4.0.8', graph: updated }), asJson);
+        }
+        catch (err) {
+            const code = err.code ?? 'PEAKS_GRAPH_CORRUPTED';
+            printResult(io, fail('workflow.node.prepare', code, getErrorMessage(err), { graph: null }, []), asJson);
+            process.exitCode = 1;
+        }
+    });
+    nodeCmd
+        .command('ack')
+        .description('Acknowledge a node that has an envelope-received status.')
+        .option('--workflow <id>', 'workflow id')
+        .option('--node <id>', 'node id')
+        .option('--session-id <sid>', 'session id')
+        .option('--project <path>', 'project root')
+        .option('--json', 'json output')
+        .action((options) => {
+        const asJson = options.json === true;
+        try {
+            const sessionId = deriveSessionId(options);
+            const projectRoot = deriveProjectRoot(options);
+            const workflowId = options.workflow ?? '';
+            if (!workflowId)
+                throw new Error('workflowId is required');
+            const graphRef = `graphs/${workflowId}.json`;
+            const graph = readGraph({ projectRoot, sessionId, graphRef, workflowId });
+            const nodeId = options.node ?? '';
+            const node = graph.nodes.find((n) => n.id === nodeId);
+            if (!node)
+                throw new Error(`node ${nodeId} not found`);
+            if (node.status !== 'envelope-received') {
+                throw new Error('PEAKS_ENVELOPE_NOT_RECEIVED: node is not envelope-received');
+            }
+            const updated = transitionNode(node.status, 'consumed-by-parent', { graphNode: node });
+            printResult(io, ok('workflow.node.ack', { envelopeVersion: '4.0.8', node: updated }), asJson);
+        }
+        catch (err) {
+            const code = err.code ?? 'PEAKS_ENVELOPE_NOT_RECEIVED';
+            printResult(io, fail('workflow.node.ack', code, getErrorMessage(err), { node: null }, []), asJson);
+            process.exitCode = 1;
+        }
+    });
+    nodeCmd
+        .command('mark-lost')
+        .description('Mark a node as lost.')
+        .option('--workflow <id>', 'workflow id')
+        .option('--node <id>', 'node id')
+        .option('--reason <reason>', `terminal reason: ${TERMINAL_REASONS.join(' | ')}`)
+        .option('--session-id <sid>', 'session id')
+        .option('--project <path>', 'project root')
+        .option('--json', 'json output')
+        .action((options) => {
+        const asJson = options.json === true;
+        try {
+            const workflowId = options.workflow ?? '';
+            if (!workflowId)
+                throw new Error('workflowId is required');
+            const nodeId = options.node ?? '';
+            if (!nodeId)
+                throw new Error('nodeId is required');
+            const reason = options.reason ?? 'unknown';
+            if (!TERMINAL_REASONS.includes(reason)) {
+                throw new Error(`PEAKS_TERMINAL_REASON_INVALID: ${reason}`);
+            }
+            printResult(io, ok('workflow.node.mark-lost', {
+                envelopeVersion: '4.0.8',
+                workflowId,
+                nodeId,
+                status: 'lost',
+                terminalReason: reason,
+            }), asJson);
+        }
+        catch (err) {
+            const code = err.code ?? 'PEAKS_TERMINAL_REASON_INVALID';
+            printResult(io, fail('workflow.node.mark-lost', code, getErrorMessage(err), { node: null }, []), asJson);
+            process.exitCode = 1;
+        }
+    });
+    addJsonOption(workflow
+        .command('terminalize')
+        .description('Atomically terminalize a workflow (lease + graph + index + observability event).')
+        .requiredOption('--workflow <id>', 'workflow id')
+        .requiredOption('--reason <reason>', `terminal reason: ${TERMINAL_REASONS.join(' | ')}`)
+        .option('--session-id <sid>', 'session id')
+        .option('--project <path>', 'project root')
+        .option('--require-consumed', 'fail if there are unconsumed envelopes')).action(async (options) => {
+        const asJson = options.json === true;
+        try {
+            const callerId = deriveCallerId();
+            const sessionId = deriveSessionId(options);
+            const projectRoot = deriveProjectRoot(options);
+            const workflowId = options.workflow ?? '';
+            if (!workflowId)
+                throw new Error('workflowId is required');
+            if (!TERMINAL_REASONS.includes(options.reason)) {
+                throw new Error(`PEAKS_TERMINAL_REASON_INVALID: ${options.reason}`);
+            }
+            const result = await terminalizeWorkflow({
+                projectRoot,
+                sessionId,
+                callerId,
+                workflowId,
+                graphRef: `graphs/${workflowId}.json`,
+                reason: options.reason,
+                ...(options.requireConsumed ? { requireConsumed: true } : {}),
+            });
+            printResult(io, ok('workflow.terminalize', {
+                envelopeVersion: '4.0.8',
+                lease: result.lease,
+                graph: result.graph,
+                events: result.events,
+                indexCleared: result.indexCleared,
+            }), asJson);
+        }
+        catch (err) {
+            const code = err.code ?? 'PEAKS_TERMINALIZE_ATOMICITY_FAILED';
+            printResult(io, fail('workflow.terminalize', code, getErrorMessage(err), { lease: null }, []), asJson);
+            process.exitCode = 1;
+        }
+    });
+    // Suppress unused-import warnings for symbols reserved for future slices.
+    void transitionLease;
+    void emptyGraph;
+}

package/dist/cli/commands/workspace/init-command.js

@@ -25,6 +25,7 @@ import { ensureSessionWithRotation } from '../../../services/session/session-man
 import { resolveCanonicalProjectRoot } from '../../../services/config/config-service.js';
 import { applyHookInstall, readHookStatus } from '../../../services/skills/hooks-settings-service.js';
 import { clearStalePresenceOnRotation } from '../../../services/skills/skill-presence-service.js';
+import { gcStalePresenceLeases } from '../../../services/skills/presence-lease-service.js';
 import { fail, ok } from 'peaks-loop-shared/result';
 import { addJsonOption, getErrorMessage, printResult } from '../../cli-helpers.js';
 import { hasStandardsCheckedMarker, markStandardsChecked } from '../../../services/standards/missing-standards-detector.js';
@@ -289,6 +290,24 @@ export function registerWorkspaceInitCommand(workspace, io) {
             //     freshly-written files. Surface that as a nextAction so the
             //     human sees what was written.
             const warningsForEnvelope = [];
+            // Slice 4.0.8 (D3): after session binding, run the same
+            // canonical GC sweep `peaks skill presence:set` would
+            // perform. A `peaks workspace init` is a natural sweep
+            // trigger (the session id was just minted, all prior leases
+            // for the project are by definition same-project). Failures
+            // surface as warnings; the GC never blocks init.
+            try {
+                const gcResult = await gcStalePresenceLeases({
+                    projectRoot,
+                    trigger: 'workspace-init',
+                });
+                if (gcResult.removed > 0) {
+                    warningsForEnvelope.push(`Stale lease sweep removed ${gcResult.removed} lease(s) for the canonical project (retained ${gcResult.retained}).`);
+                }
+            }
+            catch (err) {
+                warningsForEnvelope.push(`lease sweep failed: ${getErrorMessage(err)}`);
+            }
             if (report.standardsMissing.missing && !hasStandardsCheckedMarker(projectRoot, sessionId)) {
                 warningsForEnvelope.push(report.standardsMissing.remediation);
                 nextActions.push(`Run \`peaks workspace init --init-standards --project ${projectRoot}\` to auto-apply the scaffold, or \`peaks standards init --project ${projectRoot} --apply\` manually.`);

package/dist/services/audit/enforcers/active-skill-resolver.d.ts

@@ -4,26 +4,42 @@
  * Resolves the active peak skill name for the current session, so hook
  * enforcers (e.g. code-ban) can decide whether to fire.
  *
+ * Slice 4.0.8 (D1 + D4a): prefer the canonical
+ * `readPresenceLease` projection from `presence-lease-service.ts`.
+ * The 4.0.7 legacy `active-skill-<callerId>.json` walk is preserved
+ * as a 1-minor-release back-compat fallback, gated on the
+ * `legacyPresence: true` opt-in. By default the canonical projection
+ * is the only source of truth — the read returns `{ skill, callerId,
+ * sessionId, source: 'canonical' | 'legacy' | 'none' }`.
+ *
  * Per `src/services/session/caller-id-types.ts`: the active-skill file is
- * at `.peaks/_runtime/<peakSessionId>/active-skill-<callerId>.json`.
+ * at `.peaks/_runtime/<peakSessionId>/active-skill-<callerId>.json`
+ * (legacy) or `.peaks/_runtime/<sid>/presence-index/<callerId>.json`
+ * (canonical index → lease file).
  *
  * Resolution order (graceful degradation — never throws):
  *   1. PEAKS_ACTIVE_SKILL env var (explicit override, used by tests)
- *   2. .peaks/_runtime/<sid>/active-skill-<callerId>.json for each caller
- *      bound to the current peak session
- *   3. null (caller did not set a skill; enforcers can decide to skip)
+ *   2. Canonical lease projection (presence-lease-service.readPresenceLease)
+ *   3. Legacy `.peaks/_runtime/<sid>/active-skill-*.json` walk, when
+ *      `legacyPresence === true` is passed by the caller
+ *   4. null (caller did not set a skill; enforcers can decide to skip)
  */
 export interface ActiveSkillResolution {
     readonly skill: string | null;
     readonly callerId: string | null;
     readonly sessionId: string | null;
-    readonly source: 'env' | 'file' | 'none';
+    /** `canonical` = presence-lease-service; `legacy` = per-caller active-skill file; `env` = test override; `none` = nothing wired. */
+    readonly source: 'env' | 'file' | 'canonical' | 'none';
 }
 /**
  * Resolve the active peak skill for the current hook invocation.
  *
- * Reads PEAKS_ACTIVE_SKILL first (test override), then walks
- * `.peaks/_runtime/<sid>/` for any `active-skill-*.json` file. Returns
- * the first match.
+ * Reads PEAKS_ACTIVE_SKILL first (test override), then the canonical
+ * lease projection (RD §4 / §6 — the lease + index is the source of
+ * truth in 4.0.8), then — only when the caller explicitly opts in via
+ * `legacyPresence: true` — the legacy `.peaks/_runtime/<sid>/active-skill-*.json`
+ * walk. Returns the first match.
  */
-export declare function resolveActiveSkillForCaller(projectRoot: string): ActiveSkillResolution;
+export declare function resolveActiveSkillForCaller(projectRoot: string, opts?: {
+    legacyPresence?: boolean;
+}): ActiveSkillResolution;

package/dist/services/audit/enforcers/active-skill-resolver.js

@@ -4,28 +4,43 @@
  * Resolves the active peak skill name for the current session, so hook
  * enforcers (e.g. code-ban) can decide whether to fire.
  *
+ * Slice 4.0.8 (D1 + D4a): prefer the canonical
+ * `readPresenceLease` projection from `presence-lease-service.ts`.
+ * The 4.0.7 legacy `active-skill-<callerId>.json` walk is preserved
+ * as a 1-minor-release back-compat fallback, gated on the
+ * `legacyPresence: true` opt-in. By default the canonical projection
+ * is the only source of truth — the read returns `{ skill, callerId,
+ * sessionId, source: 'canonical' | 'legacy' | 'none' }`.
+ *
  * Per `src/services/session/caller-id-types.ts`: the active-skill file is
- * at `.peaks/_runtime/<peakSessionId>/active-skill-<callerId>.json`.
+ * at `.peaks/_runtime/<peakSessionId>/active-skill-<callerId>.json`
+ * (legacy) or `.peaks/_runtime/<sid>/presence-index/<callerId>.json`
+ * (canonical index → lease file).
  *
  * Resolution order (graceful degradation — never throws):
  *   1. PEAKS_ACTIVE_SKILL env var (explicit override, used by tests)
- *   2. .peaks/_runtime/<sid>/active-skill-<callerId>.json for each caller
- *      bound to the current peak session
- *   3. null (caller did not set a skill; enforcers can decide to skip)
+ *   2. Canonical lease projection (presence-lease-service.readPresenceLease)
+ *   3. Legacy `.peaks/_runtime/<sid>/active-skill-*.json` walk, when
+ *      `legacyPresence === true` is passed by the caller
+ *   4. null (caller did not set a skill; enforcers can decide to skip)
  */
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { getSessionIdCanonical } from '../../session/session-manager.js';
 import { getSessionDir } from '../../session/getSessionDir.js';
+import { readPresenceLease } from '../../skills/presence-lease-service.js';
+import { getCurrentSessionId } from '../../skills/skill-presence-service.js';
 const ACTIVE_SKILL_PREFIX = 'active-skill-';
 /**
  * Resolve the active peak skill for the current hook invocation.
  *
- * Reads PEAKS_ACTIVE_SKILL first (test override), then walks
- * `.peaks/_runtime/<sid>/` for any `active-skill-*.json` file. Returns
- * the first match.
+ * Reads PEAKS_ACTIVE_SKILL first (test override), then the canonical
+ * lease projection (RD §4 / §6 — the lease + index is the source of
+ * truth in 4.0.8), then — only when the caller explicitly opts in via
+ * `legacyPresence: true` — the legacy `.peaks/_runtime/<sid>/active-skill-*.json`
+ * walk. Returns the first match.
  */
-export function resolveActiveSkillForCaller(projectRoot) {
+export function resolveActiveSkillForCaller(projectRoot, opts) {
     const envOverride = process.env.PEAKS_ACTIVE_SKILL;
     if (typeof envOverride === 'string' && envOverride.length > 0) {
         return { skill: envOverride, callerId: null, sessionId: null, source: 'env' };
@@ -40,32 +55,79 @@ export function resolveActiveSkillForCaller(projectRoot) {
     if (sessionId === null) {
         return { skill: null, callerId: null, sessionId: null, source: 'none' };
     }
+    // 4.0.8 preferred: read the canonical lease projection. The lease
+    // service exposes `readPresenceLease({ projectRoot, sessionId,
+    // callerId, workflowId, graphRef })`; we need *some* callerId to
+    // point at a single lease. Hook enforcers don't have a callerId
+    // (they're per-IDE, per-window), so we walk the canonical
+    // presence-index to find any active lease. When the index is empty
+    // (e.g. ad-hoc / pre-migration projects) we fall through to the
+    // legacy walk below.
     const sessionDir = getSessionDir(projectRoot, sessionId);
     if (!existsSync(sessionDir)) {
-        return { skill: null, callerId: null, sessionId: sessionId, source: 'none' };
+        return { skill: null, callerId: null, sessionId, source: 'none' };
     }
-    let entries;
+    let entries = [];
     try {
         entries = readdirSync(sessionDir);
     }
     catch {
-        return { skill: null, callerId: null, sessionId: sessionId, source: 'none' };
+        entries = [];
     }
-    for (const entry of entries) {
-        if (!entry.startsWith(ACTIVE_SKILL_PREFIX) || !entry.endsWith('.json'))
+    const indexEntries = entries.filter((e) => !e.startsWith(ACTIVE_SKILL_PREFIX) && e.endsWith('.json') && !e.includes('.tmp-'));
+    for (const entry of indexEntries) {
+        // The canonical presence-index lives at `<sessionDir>/presence-index/<callerId>.json`.
+        // We synthesise the read from any presence-* lease file we find;
+        // the readPresenceLease call surfaces a typed `PresenceProjection`
+        // and we map `lease.skill` → resolution.
+        if (!entry.startsWith('presence-'))
+            continue;
+        const callerId = entry.slice('presence-'.length, -'.json'.length);
+        // Derive workflowId from the same file name (canonical
+        // leaseFilePath encodes `presence-<caller>-<workflow>.json`).
+        const lastDash = callerId.lastIndexOf('-');
+        if (lastDash < 0)
             continue;
-        const callerId = entry.slice(ACTIVE_SKILL_PREFIX.length, -'.json'.length);
-        const filePath = join(sessionDir, entry);
+        const workflowId = callerId.slice(lastDash + 1);
+        const pureCaller = callerId.slice(0, lastDash);
         try {
-            const raw = readFileSync(filePath, 'utf8');
-            const parsed = JSON.parse(raw);
-            if (typeof parsed.skill === 'string' && parsed.skill.length > 0) {
-                return { skill: parsed.skill, callerId, sessionId, source: 'file' };
+            const projection = readPresenceLease({
+                projectRoot,
+                sessionId,
+                callerId: pureCaller,
+                workflowId,
+                graphRef: `graphs/${workflowId}.json`,
+            });
+            if (projection.lease !== null && typeof projection.lease.skill === 'string' && projection.lease.skill.length > 0) {
+                return { skill: projection.lease.skill, callerId: pureCaller, sessionId, source: 'canonical' };
             }
         }
-        catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
-            // skip malformed file
+        catch { /* fall through to legacy walk */ }
+    }
+    // Legacy fall-back (one minor release). Gated on `legacyPresence:
+    // true` so production hooks prefer the canonical projection.
+    if (opts?.legacyPresence === true) {
+        for (const entry of entries) {
+            if (!entry.startsWith(ACTIVE_SKILL_PREFIX) || !entry.endsWith('.json'))
+                continue;
+            const callerId = entry.slice(ACTIVE_SKILL_PREFIX.length, -'.json'.length);
+            const filePath = join(sessionDir, entry);
+            try {
+                const raw = readFileSync(filePath, 'utf8');
+                const parsed = JSON.parse(raw);
+                if (typeof parsed.skill === 'string' && parsed.skill.length > 0) {
+                    return { skill: parsed.skill, callerId, sessionId, source: 'file' };
+                }
+            }
+            catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+                // skip malformed file
+            }
         }
     }
+    // Suppress unused-import warnings for symbols reserved for the
+    // migration window. `getCurrentSessionId` is kept so the legacy
+    // walk can still resolve a session id if the canonical resolver
+    // returns null (e.g. ad-hoc projects without a `.peaks/_runtime/session.json`).
+    void getCurrentSessionId;
     return { skill: null, callerId: null, sessionId, source: 'none' };
 }

package/dist/services/code/auto-compact-orchestrator.d.ts

@@ -5,8 +5,26 @@ import { type CompactLifecycleRecord, type CompactLifecycleStage } from '../comp
 export interface AutoCompactInput {
     /** Project root for context (default cwd). */
     readonly projectRoot: string;
-    /** Caller-provided in-flight batch probe (default false). */
+    /**
+     * Caller-provided in-flight batch probe (default false). Slice
+     * 4.0.8 (D4d): production callers should pass a `probeInflightBatch`
+     * function (see below). The legacy `inFlightBatch` boolean
+     * remains as a TEST-ONLY seam — the CLI gates it behind
+     * `process.env.PEAKS_TEST_SEAM === '1'` so a production run
+     * never consults the boolean as truth.
+     */
     readonly inFlightBatch?: InFlightBatchProbe | undefined;
+    /**
+     * Slice 4.0.8 (D4d): graph-only in-flight probe. When supplied,
+     * the orchestrator calls this function and uses the boolean
+     * result as the production `inFlightBatch` signal. The legacy
+     * boolean parameter is suppressed in production callers — the
+     * CLI's `--in-flight-batch` flag is gated behind
+     * `PEAKS_TEST_SEAM === '1'`. The pure decision function
+     * `evaluateAutoCompactDecision` retains the boolean signature
+     * for the test seam + the red-line override.
+     */
+    readonly probeInflightBatch?: (() => boolean) | undefined;
     /**
      * Force execute even when ratio < threshold (test seam). In
      * production this is always `false` — peaks-loop drives compact
@@ -96,7 +114,20 @@ export declare function evaluateCompactTrigger(ratio: number, mode?: AutoCompact
  */
 export declare function evaluateAutoCompactDecision(input: {
     ratio: number;
-    inFlightBatch?: InFlightBatchProbe | undefined;
+    /**
+     * Caller-provided in-flight batch signal. Accepts either a plain
+     * boolean (convenience / repro seam) or the full `InFlightBatchProbe`
+     * shape (production callers — graph-probe-backed). When the boolean
+     * form is `true`, the normalized probe carries
+     * `hasInFlightBatch: true`. Slice 4.0.8 hotfix.
+     */
+    inFlightBatch?: boolean | InFlightBatchProbe | undefined;
+    /**
+     * Legacy camelCase alias for `inFlightBatch`. Production repro
+     * inputs use `inflightBatch: true|false`; the orchestrator
+     * normalizes it to the same internal shape. Slice 4.0.8 hotfix.
+     */
+    inflightBatch?: boolean | InFlightBatchProbe | undefined;
     force?: boolean | undefined;
     bypassRedLine?: boolean | undefined;
     mode?: AutoCompactMode | undefined;
@@ -111,6 +142,8 @@ export declare function evaluateAutoCompactDecision(input: {
     shouldCompact: boolean;
     reason: 'below-threshold' | 'in-flight-batch' | 'pre-compact' | 'red-line';
     trigger: CompactTrigger;
+    /** Typed verdict enum (RD §4 24h-mode contract). Slice 4.0.8 hotfix. */
+    action: 'ok' | 'soft-warn' | 'auto-compact-now' | 'red-line' | 'defer';
 };
 /**
  * Build the convergence plan that D7's post-compact-detect will read