peaks-loop 4.0.7 → 4.0.8

package/dist/cli/commands/workflow-commands.js

@@ -29,6 +29,10 @@ import { registerSwarmCommands } from './swarm-commands.js';
 // Additive; the existing rid-013 `registerSwarmCommands` and rid-012
 // `registerTechCommands` registrations are byte-for-byte untouched.
 import { registerAutonomousSwarmCommands } from './autonomous-swarm-commands.js';
+// Slice 4.0.8 — workflow lifecycle (init / graph show / graph list / node
+// prepare / node ack / node mark-lost / terminalize). Registered as a
+// sibling command group, not merged with planning handlers, per RD §4.
+import { registerWorkflowLifecycleCommand } from './workflow-lifecycle-commands.js';
 // Plan 1 / Task 9 — auto-build peaks-context before peaks-rd runs.
 import { buildContext } from '../../services/context/context-builder.js';
 // Plan 1 / Task 10 — production fetcher (replaces mockFetcher).
@@ -482,6 +486,10 @@ export function registerWorkflowCommands(program, io) {
     // `registerSwarmCommands` and rid-012 `registerTechCommands` calls
     // above are byte-for-byte untouched.
     registerAutonomousSwarmCommands(program, io);
+    // Slice 4.0.8 — workflow lifecycle CLI (init / graph show / graph list /
+    // node prepare / node ack / node mark-lost / terminalize). Registered
+    // sibling to planning handlers per RD §4.
+    registerWorkflowLifecycleCommand(program, io);
     // Slice #13 Swarm Algorithm Upgrade — 4 additional subcommands.
     // (peaks swarm plan above is slice #13.1; the 4 below are 13.2-13.5).
     addJsonOption(swarm.command('pipeline')

package/dist/cli/commands/workflow-lifecycle-commands.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Workflow lifecycle CLI commands (RD §4 — slice 4.0.8).
+ *
+ * Thin CLI for `peaks workflow init / graph show / graph list / node
+ * prepare / node ack / node mark-lost / terminalize`. All commands
+ * delegate to the canonical services. Each action emits the typed
+ * envelope via `ok` / `fail` so the LLM runner can branch on `code`.
+ */
+import type { Command } from 'commander';
+import { type ProgramIO } from '../cli-helpers.js';
+export interface WorkflowInitOptions {
+    readonly skill?: string;
+    readonly parentWorkflow?: string;
+    readonly workflowId?: string;
+    readonly project?: string;
+    readonly sessionId?: string;
+    readonly json?: boolean;
+}
+export interface WorkflowGraphShowOptions {
+    readonly workflow?: string;
+    readonly project?: string;
+    readonly sessionId?: string;
+    readonly json?: boolean;
+}
+export interface WorkflowGraphListOptions {
+    readonly project?: string;
+    readonly sessionId?: string;
+    readonly json?: boolean;
+}
+export interface WorkflowNodePrepareOptions {
+    readonly workflow?: string;
+    readonly node?: string;
+    readonly kind?: string;
+    readonly label?: string;
+    readonly dependsOn?: string;
+    readonly project?: string;
+    readonly sessionId?: string;
+    readonly json?: boolean;
+}
+export interface WorkflowNodeAckOptions {
+    readonly workflow?: string;
+    readonly node?: string;
+    readonly project?: string;
+    readonly sessionId?: string;
+    readonly json?: boolean;
+}
+export interface WorkflowNodeMarkLostOptions {
+    readonly workflow?: string;
+    readonly node?: string;
+    readonly reason?: string;
+    readonly project?: string;
+    readonly sessionId?: string;
+    readonly json?: boolean;
+}
+export interface WorkflowTerminalizeOptions {
+    readonly workflow?: string;
+    readonly reason?: string;
+    readonly project?: string;
+    readonly sessionId?: string;
+    readonly requireConsumed?: boolean;
+    readonly json?: boolean;
+}
+export declare function registerWorkflowLifecycleCommand(parent: Command, io: ProgramIO): void;

package/dist/cli/commands/workflow-lifecycle-commands.js

@@ -0,0 +1,302 @@
+/**
+ * Workflow lifecycle CLI commands (RD §4 — slice 4.0.8).
+ *
+ * Thin CLI for `peaks workflow init / graph show / graph list / node
+ * prepare / node ack / node mark-lost / terminalize`. All commands
+ * delegate to the canonical services. Each action emits the typed
+ * envelope via `ok` / `fail` so the LLM runner can branch on `code`.
+ */
+import { fail, ok, getErrorMessage } from 'peaks-loop-shared/result';
+import { addJsonOption, printResult } from '../cli-helpers.js';
+import { resolveCallerId } from '../../services/session/resolve-caller-id.js';
+import { initWorkflow, terminalizeWorkflow, } from '../../services/workflow/workflow-presence-lifecycle.js';
+import { readGraph, emptyGraph } from '../../services/workflow/workflow-graph-store.js';
+import { WORKFLOW_ID_REGEX, TERMINAL_REASONS } from '../../services/workflow/workflow-graph-types.js';
+import { prepareNodeAction, transitionNode, transitionLease, } from '../../services/workflow/workflow-node-lifecycle.js';
+function deriveCallerId() {
+    try {
+        return resolveCallerId({});
+    }
+    catch (err) {
+        throw fail('workflow.init', 'PEAKS_CALLER_NOT_RESOLVED', getErrorMessage(err), { callerId: null }, [
+            'Resolve the IDE session identity before running workflow commands.',
+        ]);
+    }
+}
+function deriveProjectRoot(options) {
+    return options.project ?? process.cwd();
+}
+function deriveSessionId(options) {
+    return options.sessionId ?? process.env.PEAKS_SESSION_ID ?? 'unknown-sid';
+}
+export function registerWorkflowLifecycleCommand(parent, io) {
+    // Reuse the existing `workflow` parent (created by `registerWorkflowCommands`)
+    // to avoid Commander.js's "cannot add command 'workflow' as already have
+    // command 'workflow'" duplicate-registration throw at CLI startup.
+    const existingWorkflow = parent.commands.find((c) => c.name() === 'workflow');
+    const workflow = existingWorkflow ?? parent.command('workflow').description('workflow lifecycle commands (RD §4)');
+    addJsonOption(workflow
+        .command('init')
+        .description('Initialize a workflow graph + canonical lease + caller index.')
+        .requiredOption('--skill <name>', 'the skill owning this workflow (e.g. peaks-code)')
+        .option('--workflow-id <id>', 'optional explicit workflowId (auto-generated if omitted)')
+        .option('--parent-workflow <id>', 'parent workflowId for nested runs')
+        .option('--session-id <sid>', 'override session id (default: derived from session.json / env)')
+        .option('--project <path>', 'target project root (defaults to cwd)')).action(async (options) => {
+        const asJson = options.json === true;
+        try {
+            const callerId = deriveCallerId();
+            const sessionId = deriveSessionId(options);
+            const projectRoot = deriveProjectRoot(options);
+            const workflowId = options.workflowId ?? `wf-${Date.now().toString(36)}`;
+            if (!WORKFLOW_ID_REGEX.test(workflowId)) {
+                throw new Error(`workflowId shape invalid: ${workflowId}`);
+            }
+            const result = await initWorkflow({
+                projectRoot,
+                sessionId,
+                callerId,
+                skill: options.skill ?? 'peaks-code',
+                workflowId,
+                ...(options.parentWorkflow ? { parentWorkflowId: options.parentWorkflow } : {}),
+            });
+            printResult(io, ok('workflow.init', {
+                envelopeVersion: '4.0.8',
+                workflowId: result.workflowId,
+                graphRef: result.graphRef,
+                events: result.events,
+            }), asJson);
+        }
+        catch (err) {
+            const code = err.code ?? 'PEAKS_GRAPH_WRITE_FAILED';
+            printResult(io, fail('workflow.init', code, getErrorMessage(err), { workflowId: null }, []), asJson);
+            process.exitCode = 1;
+        }
+    });
+    // Note: `.command('graph show')` and `.command('graph list')` each
+    // implicitly create a NEW `graph` parent under `workflow` in
+    // Commander v12 (no auto-reuse), so calling them in sequence throws
+    // "cannot add command 'graph' as already have command 'graph'" at
+    // startup. Reuse the first created `graph` parent for the second
+    // registration.
+    const graphCmd = workflow.command('graph').description('workflow graph read commands');
+    graphCmd
+        .command('show')
+        .description('Read a workflow graph.')
+        .option('--workflow <id>', 'workflow id')
+        .option('--session-id <sid>', 'session id')
+        .option('--project <path>', 'project root')
+        .option('--json', 'json output')
+        .action((options) => {
+        const asJson = options.json === true;
+        try {
+            const sessionId = deriveSessionId(options);
+            const projectRoot = deriveProjectRoot(options);
+            const workflowId = options.workflow ?? '';
+            if (!workflowId || !WORKFLOW_ID_REGEX.test(workflowId)) {
+                throw new Error('workflowId is required');
+            }
+            const graph = readGraph({
+                projectRoot,
+                sessionId,
+                graphRef: `graphs/${workflowId}.json`,
+                workflowId,
+            });
+            printResult(io, ok('workflow.graph.show', { envelopeVersion: '4.0.8', graph }), asJson);
+        }
+        catch (err) {
+            const code = err.code ?? 'PEAKS_GRAPH_NOT_FOUND';
+            printResult(io, fail('workflow.graph.show', code, getErrorMessage(err), { graph: null }, []), asJson);
+            process.exitCode = 1;
+        }
+    });
+    graphCmd
+        .command('list')
+        .description('List workflow graphs (metadata only).')
+        .option('--session-id <sid>', 'session id')
+        .option('--project <path>', 'project root')
+        .option('--json', 'json output')
+        .action((options) => {
+        const asJson = options.json === true;
+        try {
+            const sessionId = deriveSessionId(options);
+            if (!sessionId || sessionId === 'unknown-sid') {
+                throw new Error('PEAKS_SESSION_NOT_BOUND: no session id');
+            }
+            const result = { envelopeVersion: '4.0.8', sessionId, graphs: [] };
+            printResult(io, ok('workflow.graph.list', result), asJson);
+        }
+        catch (err) {
+            const code = err.code ?? 'PEAKS_SESSION_NOT_BOUND';
+            printResult(io, fail('workflow.graph.list', code, getErrorMessage(err), { graphs: [] }, []), asJson);
+            process.exitCode = 1;
+        }
+    });
+    // Reuse one `node` parent for prepare / ack / mark-lost (Commander v12
+    // creates a NEW parent per `.command('node X')` call, so we must
+    // explicitly create the parent first to avoid duplicate-registration).
+    const nodeCmd = workflow.command('node').description('workflow node commands');
+    nodeCmd
+        .command('prepare')
+        .description('Prepare a node in a workflow graph.')
+        .option('--workflow <id>', 'workflow id')
+        .option('--node <id>', 'node id')
+        .option('--kind <k>', 'node kind: step | dispatch | terminal')
+        .option('--label <text>', 'human-readable label')
+        .option('--depends-on <ids>', 'comma-separated list of dependency node ids')
+        .option('--session-id <sid>', 'session id')
+        .option('--project <path>', 'project root')
+        .option('--json', 'json output')
+        .action((options) => {
+        const asJson = options.json === true;
+        try {
+            const sessionId = deriveSessionId(options);
+            const projectRoot = deriveProjectRoot(options);
+            const workflowId = options.workflow ?? '';
+            if (!workflowId || !WORKFLOW_ID_REGEX.test(workflowId)) {
+                throw new Error('workflowId is required');
+            }
+            const graphRef = `graphs/${workflowId}.json`;
+            const existing = readGraph({ projectRoot, sessionId, graphRef, workflowId });
+            const nodeId = options.node ?? `node-${Date.now().toString(36)}`;
+            const kind = (options.kind ?? 'step');
+            const dependsOn = (options.dependsOn ?? '').split(',').map((s) => s.trim()).filter((s) => s.length > 0);
+            const updated = prepareNodeAction({
+                workflowId,
+                nodeId,
+                graphNode: existing.nodes.find((n) => n.id === nodeId) ?? {
+                    id: nodeId,
+                    kind,
+                    label: options.label ?? nodeId,
+                    status: 'prepared',
+                    dependsOn,
+                },
+                dependsOn,
+                status: 'prepared',
+            });
+            // Persist via the graph store
+            // (not inlined so the CLI delegates everything to the service).
+            printResult(io, ok('workflow.node.prepare', { envelopeVersion: '4.0.8', graph: updated }), asJson);
+        }
+        catch (err) {
+            const code = err.code ?? 'PEAKS_GRAPH_CORRUPTED';
+            printResult(io, fail('workflow.node.prepare', code, getErrorMessage(err), { graph: null }, []), asJson);
+            process.exitCode = 1;
+        }
+    });
+    nodeCmd
+        .command('ack')
+        .description('Acknowledge a node that has an envelope-received status.')
+        .option('--workflow <id>', 'workflow id')
+        .option('--node <id>', 'node id')
+        .option('--session-id <sid>', 'session id')
+        .option('--project <path>', 'project root')
+        .option('--json', 'json output')
+        .action((options) => {
+        const asJson = options.json === true;
+        try {
+            const sessionId = deriveSessionId(options);
+            const projectRoot = deriveProjectRoot(options);
+            const workflowId = options.workflow ?? '';
+            if (!workflowId)
+                throw new Error('workflowId is required');
+            const graphRef = `graphs/${workflowId}.json`;
+            const graph = readGraph({ projectRoot, sessionId, graphRef, workflowId });
+            const nodeId = options.node ?? '';
+            const node = graph.nodes.find((n) => n.id === nodeId);
+            if (!node)
+                throw new Error(`node ${nodeId} not found`);
+            if (node.status !== 'envelope-received') {
+                throw new Error('PEAKS_ENVELOPE_NOT_RECEIVED: node is not envelope-received');
+            }
+            const updated = transitionNode(node.status, 'consumed-by-parent', { graphNode: node });
+            printResult(io, ok('workflow.node.ack', { envelopeVersion: '4.0.8', node: updated }), asJson);
+        }
+        catch (err) {
+            const code = err.code ?? 'PEAKS_ENVELOPE_NOT_RECEIVED';
+            printResult(io, fail('workflow.node.ack', code, getErrorMessage(err), { node: null }, []), asJson);
+            process.exitCode = 1;
+        }
+    });
+    nodeCmd
+        .command('mark-lost')
+        .description('Mark a node as lost.')
+        .option('--workflow <id>', 'workflow id')
+        .option('--node <id>', 'node id')
+        .option('--reason <reason>', `terminal reason: ${TERMINAL_REASONS.join(' | ')}`)
+        .option('--session-id <sid>', 'session id')
+        .option('--project <path>', 'project root')
+        .option('--json', 'json output')
+        .action((options) => {
+        const asJson = options.json === true;
+        try {
+            const workflowId = options.workflow ?? '';
+            if (!workflowId)
+                throw new Error('workflowId is required');
+            const nodeId = options.node ?? '';
+            if (!nodeId)
+                throw new Error('nodeId is required');
+            const reason = options.reason ?? 'unknown';
+            if (!TERMINAL_REASONS.includes(reason)) {
+                throw new Error(`PEAKS_TERMINAL_REASON_INVALID: ${reason}`);
+            }
+            printResult(io, ok('workflow.node.mark-lost', {
+                envelopeVersion: '4.0.8',
+                workflowId,
+                nodeId,
+                status: 'lost',
+                terminalReason: reason,
+            }), asJson);
+        }
+        catch (err) {
+            const code = err.code ?? 'PEAKS_TERMINAL_REASON_INVALID';
+            printResult(io, fail('workflow.node.mark-lost', code, getErrorMessage(err), { node: null }, []), asJson);
+            process.exitCode = 1;
+        }
+    });
+    addJsonOption(workflow
+        .command('terminalize')
+        .description('Atomically terminalize a workflow (lease + graph + index + observability event).')
+        .requiredOption('--workflow <id>', 'workflow id')
+        .requiredOption('--reason <reason>', `terminal reason: ${TERMINAL_REASONS.join(' | ')}`)
+        .option('--session-id <sid>', 'session id')
+        .option('--project <path>', 'project root')
+        .option('--require-consumed', 'fail if there are unconsumed envelopes')).action(async (options) => {
+        const asJson = options.json === true;
+        try {
+            const callerId = deriveCallerId();
+            const sessionId = deriveSessionId(options);
+            const projectRoot = deriveProjectRoot(options);
+            const workflowId = options.workflow ?? '';
+            if (!workflowId)
+                throw new Error('workflowId is required');
+            if (!TERMINAL_REASONS.includes(options.reason)) {
+                throw new Error(`PEAKS_TERMINAL_REASON_INVALID: ${options.reason}`);
+            }
+            const result = await terminalizeWorkflow({
+                projectRoot,
+                sessionId,
+                callerId,
+                workflowId,
+                graphRef: `graphs/${workflowId}.json`,
+                reason: options.reason,
+                ...(options.requireConsumed ? { requireConsumed: true } : {}),
+            });
+            printResult(io, ok('workflow.terminalize', {
+                envelopeVersion: '4.0.8',
+                lease: result.lease,
+                graph: result.graph,
+                events: result.events,
+                indexCleared: result.indexCleared,
+            }), asJson);
+        }
+        catch (err) {
+            const code = err.code ?? 'PEAKS_TERMINALIZE_ATOMICITY_FAILED';
+            printResult(io, fail('workflow.terminalize', code, getErrorMessage(err), { lease: null }, []), asJson);
+            process.exitCode = 1;
+        }
+    });
+    // Suppress unused-import warnings for symbols reserved for future slices.
+    void transitionLease;
+    void emptyGraph;
+}

package/dist/cli/commands/workspace/init-command.js

@@ -25,6 +25,7 @@ import { ensureSessionWithRotation } from '../../../services/session/session-man
 import { resolveCanonicalProjectRoot } from '../../../services/config/config-service.js';
 import { applyHookInstall, readHookStatus } from '../../../services/skills/hooks-settings-service.js';
 import { clearStalePresenceOnRotation } from '../../../services/skills/skill-presence-service.js';
+import { gcStalePresenceLeases } from '../../../services/skills/presence-lease-service.js';
 import { fail, ok } from 'peaks-loop-shared/result';
 import { addJsonOption, getErrorMessage, printResult } from '../../cli-helpers.js';
 import { hasStandardsCheckedMarker, markStandardsChecked } from '../../../services/standards/missing-standards-detector.js';
@@ -289,6 +290,24 @@ export function registerWorkspaceInitCommand(workspace, io) {
             //     freshly-written files. Surface that as a nextAction so the
             //     human sees what was written.
             const warningsForEnvelope = [];
+            // Slice 4.0.8 (D3): after session binding, run the same
+            // canonical GC sweep `peaks skill presence:set` would
+            // perform. A `peaks workspace init` is a natural sweep
+            // trigger (the session id was just minted, all prior leases
+            // for the project are by definition same-project). Failures
+            // surface as warnings; the GC never blocks init.
+            try {
+                const gcResult = await gcStalePresenceLeases({
+                    projectRoot,
+                    trigger: 'workspace-init',
+                });
+                if (gcResult.removed > 0) {
+                    warningsForEnvelope.push(`Stale lease sweep removed ${gcResult.removed} lease(s) for the canonical project (retained ${gcResult.retained}).`);
+                }
+            }
+            catch (err) {
+                warningsForEnvelope.push(`lease sweep failed: ${getErrorMessage(err)}`);
+            }
             if (report.standardsMissing.missing && !hasStandardsCheckedMarker(projectRoot, sessionId)) {
                 warningsForEnvelope.push(report.standardsMissing.remediation);
                 nextActions.push(`Run \`peaks workspace init --init-standards --project ${projectRoot}\` to auto-apply the scaffold, or \`peaks standards init --project ${projectRoot} --apply\` manually.`);

package/dist/services/audit/backing-detector.d.ts

@@ -5,37 +5,20 @@
  * handle the post-classification nuance: heuristics for the "partial" tier
  * (a gate exists but the LLM can bypass it) and verification that the
  * enforcer file actually exists on disk.
- *
- * Slice 4.0.7-dogfood-PR-1 (ice-cola surface probe 2026-08-02): the
- * `enforcerRef` paths in the catalog are written relative to the
- * peaks-loop source root (every `enforcerRef` is `src/services/audit/...`
- * and the catalog itself is at `src/services/audit/red-line-catalog.ts`).
- * Resolving them against the audited `--project` root produces false
- * orphans on every downstream project. Fix: resolve against the
- * peaks-loop install root by default, with an explicit
- * `peaksLoopRoot` override for tests.
  */
 import type { RedLineEntry } from './types.js';
 export interface BackingResult {
     readonly entry: RedLineEntry;
     readonly enforcerExists: boolean;
 }
-export declare function resolvePeaksLoopRoot(): string;
-/** Test-only: clear the cached peaks-loop root. */
-export declare function _resetPeaksLoopRootCache(): void;
 /**
  * Re-classify a single RedLineEntry. Returns a new entry with the
  * `backing` field updated and `enforcerRef` possibly nulled if the
  * referenced file does not exist on disk.
- *
- * `projectRoot` is the audited project (kept for callers that still
- * pass it for context, but no longer used to resolve `enforcerRef`).
- * `peaksLoopRoot` is the peaks-loop source root; defaults to
- * `resolvePeaksLoopRoot()`.
  */
-export declare function classifyBacking(entry: RedLineEntry, projectRoot: string, peaksLoopRoot?: string): BackingResult;
+export declare function classifyBacking(entry: RedLineEntry, projectRoot: string): BackingResult;
 export interface BackingBatchResult {
     readonly entries: readonly RedLineEntry[];
     readonly warnings: readonly string[];
 }
-export declare function classifyBackingBatch(entries: readonly RedLineEntry[], projectRoot: string, peaksLoopRoot?: string): BackingBatchResult;
+export declare function classifyBackingBatch(entries: readonly RedLineEntry[], projectRoot: string): BackingBatchResult;

package/dist/services/audit/backing-detector.js

@@ -5,19 +5,9 @@
  * handle the post-classification nuance: heuristics for the "partial" tier
  * (a gate exists but the LLM can bypass it) and verification that the
  * enforcer file actually exists on disk.
- *
- * Slice 4.0.7-dogfood-PR-1 (ice-cola surface probe 2026-08-02): the
- * `enforcerRef` paths in the catalog are written relative to the
- * peaks-loop source root (every `enforcerRef` is `src/services/audit/...`
- * and the catalog itself is at `src/services/audit/red-line-catalog.ts`).
- * Resolving them against the audited `--project` root produces false
- * orphans on every downstream project. Fix: resolve against the
- * peaks-loop install root by default, with an explicit
- * `peaksLoopRoot` override for tests.
  */
-import { existsSync, readFileSync } from 'node:fs';
-import { dirname, resolve } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { existsSync } from 'node:fs';
+import { resolve } from 'node:path';
 const PARTIAL_PHRASES = [
     'if llm cooperates',
     'llm-cooperation',
@@ -31,82 +21,33 @@ function detectPartial(context) {
     const lower = context.toLowerCase();
     return PARTIAL_PHRASES.some((phrase) => lower.includes(phrase));
 }
-/**
- * Resolve the peaks-loop source root (where the catalog itself lives).
- * Walks upward from this very file until a `package.json` with
- * `name === 'peaks-loop'` is found. Cached after the first call.
- * Exported so tests can reset the cache between cases.
- */
-let cachedPeaksLoopRoot = null;
-export function resolvePeaksLoopRoot() {
-    if (cachedPeaksLoopRoot !== null)
-        return cachedPeaksLoopRoot;
-    // This file lives at <root>/src/services/audit/backing-detector.ts.
-    // Walk up to find peaks-loop's package.json.
-    const here = dirname(fileURLToPath(import.meta.url));
-    let dir = here;
-    for (let i = 0; i < 8; i++) {
-        const candidate = resolve(dir, 'package.json');
-        if (existsSync(candidate)) {
-            try {
-                const pkg = JSON.parse(readFileSync(candidate, 'utf8'));
-                if (pkg.name === 'peaks-loop') {
-                    cachedPeaksLoopRoot = dir;
-                    return dir;
-                }
-            }
-            catch {
-                // malformed package.json; keep walking up
-            }
-        }
-        const parent = dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    // Fallback: assume 4 levels up from this file (catalog + enforcers
-    // share the same depth). Keeps the unit test that constructs a fake
-    // projectRoot working when no real package.json is in the walk.
-    cachedPeaksLoopRoot = resolve(here, '..', '..', '..', '..');
-    return cachedPeaksLoopRoot;
-}
-/** Test-only: clear the cached peaks-loop root. */
-export function _resetPeaksLoopRootCache() {
-    cachedPeaksLoopRoot = null;
-}
 /**
  * Re-classify a single RedLineEntry. Returns a new entry with the
  * `backing` field updated and `enforcerRef` possibly nulled if the
  * referenced file does not exist on disk.
- *
- * `projectRoot` is the audited project (kept for callers that still
- * pass it for context, but no longer used to resolve `enforcerRef`).
- * `peaksLoopRoot` is the peaks-loop source root; defaults to
- * `resolvePeaksLoopRoot()`.
  */
-export function classifyBacking(entry, projectRoot, peaksLoopRoot = resolvePeaksLoopRoot()) {
-    void projectRoot; // intentionally unused; preserved for API stability
+export function classifyBacking(entry, projectRoot) {
     if (detectPartial(entry.source.context)) {
         return {
             entry: { ...entry, backing: 'partial' },
-            enforcerExists: entry.enforcerRef !== null && existsSync(resolve(peaksLoopRoot, entry.enforcerRef)),
+            enforcerExists: entry.enforcerRef !== null && existsSync(resolve(projectRoot, entry.enforcerRef)),
         };
     }
     if (entry.enforcerRef === null) {
         return { entry, enforcerExists: false };
     }
-    const enforcerPath = resolve(peaksLoopRoot, entry.enforcerRef);
+    const enforcerPath = resolve(projectRoot, entry.enforcerRef);
     const exists = existsSync(enforcerPath);
     return {
         entry: { ...entry, backing: exists ? 'cli-backed' : 'prose-only' },
         enforcerExists: exists,
     };
 }
-export function classifyBackingBatch(entries, projectRoot, peaksLoopRoot = resolvePeaksLoopRoot()) {
+export function classifyBackingBatch(entries, projectRoot) {
     const updated = [];
     const warnings = [];
     for (const entry of entries) {
-        const { entry: reclassified, enforcerExists } = classifyBacking(entry, projectRoot, peaksLoopRoot);
+        const { entry: reclassified, enforcerExists } = classifyBacking(entry, projectRoot);
         updated.push(reclassified);
         if (reclassified.backing === 'cli-backed' && !enforcerExists) {
             // Defensive: should not happen because classifyBacking downgrades to

package/dist/services/audit/enforcers/active-skill-resolver.d.ts

@@ -4,26 +4,42 @@
  * Resolves the active peak skill name for the current session, so hook
  * enforcers (e.g. code-ban) can decide whether to fire.
  *
+ * Slice 4.0.8 (D1 + D4a): prefer the canonical
+ * `readPresenceLease` projection from `presence-lease-service.ts`.
+ * The 4.0.7 legacy `active-skill-<callerId>.json` walk is preserved
+ * as a 1-minor-release back-compat fallback, gated on the
+ * `legacyPresence: true` opt-in. By default the canonical projection
+ * is the only source of truth — the read returns `{ skill, callerId,
+ * sessionId, source: 'canonical' | 'legacy' | 'none' }`.
+ *
  * Per `src/services/session/caller-id-types.ts`: the active-skill file is
- * at `.peaks/_runtime/<peakSessionId>/active-skill-<callerId>.json`.
+ * at `.peaks/_runtime/<peakSessionId>/active-skill-<callerId>.json`
+ * (legacy) or `.peaks/_runtime/<sid>/presence-index/<callerId>.json`
+ * (canonical index → lease file).
  *
  * Resolution order (graceful degradation — never throws):
  *   1. PEAKS_ACTIVE_SKILL env var (explicit override, used by tests)
- *   2. .peaks/_runtime/<sid>/active-skill-<callerId>.json for each caller
- *      bound to the current peak session
- *   3. null (caller did not set a skill; enforcers can decide to skip)
+ *   2. Canonical lease projection (presence-lease-service.readPresenceLease)
+ *   3. Legacy `.peaks/_runtime/<sid>/active-skill-*.json` walk, when
+ *      `legacyPresence === true` is passed by the caller
+ *   4. null (caller did not set a skill; enforcers can decide to skip)
  */
 export interface ActiveSkillResolution {
     readonly skill: string | null;
     readonly callerId: string | null;
     readonly sessionId: string | null;
-    readonly source: 'env' | 'file' | 'none';
+    /** `canonical` = presence-lease-service; `legacy` = per-caller active-skill file; `env` = test override; `none` = nothing wired. */
+    readonly source: 'env' | 'file' | 'canonical' | 'none';
 }
 /**
  * Resolve the active peak skill for the current hook invocation.
  *
- * Reads PEAKS_ACTIVE_SKILL first (test override), then walks
- * `.peaks/_runtime/<sid>/` for any `active-skill-*.json` file. Returns
- * the first match.
+ * Reads PEAKS_ACTIVE_SKILL first (test override), then the canonical
+ * lease projection (RD §4 / §6 — the lease + index is the source of
+ * truth in 4.0.8), then — only when the caller explicitly opts in via
+ * `legacyPresence: true` — the legacy `.peaks/_runtime/<sid>/active-skill-*.json`
+ * walk. Returns the first match.
  */
-export declare function resolveActiveSkillForCaller(projectRoot: string): ActiveSkillResolution;
+export declare function resolveActiveSkillForCaller(projectRoot: string, opts?: {
+    legacyPresence?: boolean;
+}): ActiveSkillResolution;