peaks-loop 4.0.7 → 4.0.9

package/dist/cli/commands/code-runtime-commands.js

@@ -13,6 +13,8 @@ import { runAutoCompact } from '../../services/code/auto-compact-orchestrator.js
 import { evaluateStep08, STEP_08_BACKUP_REGEX } from '../../services/code/step-08-gate.js';
 import { evaluateEmitHandoff, JOB_NOT_INITIALIZED, JOB_REMAINING_BLOCKED } from '../../services/code/emit-handoff.js';
 import { readJobShapeDecision, JobShapeDecisionError } from '../../services/code/job-shape-decision.js';
+import { getSkillPresence } from '../../services/skills/skill-presence-service.js';
+import { probeInFlightBatch } from '../../services/workflow/workflow-inflight-probe.js';
 export function registerCodeRuntimeCommands(code, io) {
     addJsonOption(code
         .command('post-compact-detect')
@@ -70,12 +72,38 @@ export function registerCodeRuntimeCommands(code, io) {
                 process.exitCode = 1;
                 return;
             }
+            // Slice 4.0.8 (D4d): production `inFlightBatch` MUST come from
+            // the workflow graph probe. The legacy `--in-flight-batch`
+            // boolean CLI flag is a TEST-ONLY seam (gated by
+            // `PEAKS_TEST_SEAM === '1'`). When the env flag is unset
+            // (the production case), we wire `probeInflightBatch` to the
+            // canonical `workflow-inflight-probe.ts` service so the
+            // production decision is graph-backed, not lease-age.
+            const isTestSeam = process.env.PEAKS_TEST_SEAM === '1';
             const result = await runAutoCompact({
                 projectRoot: opts.project,
                 sessionId: opts.sessionId ?? readActiveSid(opts.project) ?? undefined,
-                inFlightBatch: opts.inFlightBatch === true
-                    ? { hasInFlightBatch: true }
-                    : undefined,
+                ...(isTestSeam && opts.inFlightBatch === true
+                    ? { inFlightBatch: { hasInFlightBatch: true } }
+                    : {}),
+                ...(!isTestSeam
+                    ? {
+                        probeInflightBatch: () => {
+                            // Synchronous probe: the workflow-inflight-probe
+                            // service is pure / synchronous (no I/O). The
+                            // empty `graphs` array is the production CLI
+                            // default — callers that want a richer fixture
+                            // (e.g. `peaks session 24h-mode`) should hand-roll
+                            // a probe and pass it via the orchestrator's
+                            // input. When no graph is materialized, the
+                            // probe returns `inFlightBatch: false`, matching
+                            // the 4.0.7 zero-pause contract for stock
+                            // projects.
+                            const out = probeInFlightBatch({ now: new Date().toISOString(), graphs: [] });
+                            return out.inFlightBatch === true;
+                        },
+                    }
+                    : {}),
                 force: opts.force === true,
                 bypassRedLine: opts.bypassRedLine === true,
                 mode: modeName
@@ -390,20 +418,14 @@ export function registerCodeRuntimeCommands(code, io) {
 // Local helper (was `readActiveSid` in code-commands.ts before rid-024 split).
 // Only the 5 runtime probes above use it; keeping it local avoids the
 // cross-file helper import.
-// Slice 4.0.7-dogfood-PR-2: now uses the shared canonical resolver
-// (`resolveActiveSessionId` from services/session) so context-now /
-// post-compact-detect / auto-compact / gate-step-08 / emit-handoff see
-// the same session id that `peaks session info --active` returns.
-// The pre-rid helper read `getSkillPresence` (the
-// `.peaks/.active-skill.json` file), which was a different store from
-// `.peaks/_runtime/session.json` — the two were kept in sync only when
-// `peaks skill presence:set` was called explicitly.
-import { resolveActiveSessionId } from '../../services/session/index.js';
 function readActiveSid(projectRoot) {
     try {
-        return resolveActiveSessionId(projectRoot);
+        const presence = getSkillPresence(projectRoot);
+        if (presence === null || presence === undefined)
+            return null;
+        return presence.sessionId ?? null;
     }
-    catch {
+    catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
         return null;
     }
 }

package/dist/cli/commands/core/skill-command.js

@@ -7,6 +7,8 @@ import { detectPresenceMarker } from '../../../services/hooks/presence-marker-de
 import { findProjectRoot } from '../../../services/config/config-safety.js';
 import { generateProjectContext } from '../../../services/memory/project-context-service.js';
 import { getSessionId, setSessionMeta } from '../../../services/session/session-manager.js';
+import { resolveCallerProjection } from '../../../services/session/resolve-caller-id.js';
+import { gcStalePresenceLeases } from '../../../services/skills/presence-lease-service.js';
 import { fail, ok } from 'peaks-loop-shared/result';
 import { addJsonOption, getErrorMessage, printResult } from '../../cli-helpers.js';
 // Slice S0 (4.0.0-beta.5 peaks-solo dispatcher release):
@@ -167,7 +169,7 @@ export function registerSkillCommand(program, io) {
     });
     addJsonOption(skill
         .command('presence:set <name>')
-        .description('Set the currently active Peaks skill for session-wide visibility')
+        .description('Set the currently active Peaks skill for session-wide visibility. Slice 4.0.8: requires a bound session and an adapter-resolved caller id (fail-closed); raw unlink is rejected.')
         .option('--mode <mode>', 'execution mode')
         .option('--gate <gate>', 'current gate')
         .option('--project <path>', 'project root path (auto-detected from cwd when omitted)')).action((name, options) => {
@@ -177,20 +179,32 @@ export function registerSkillCommand(program, io) {
             process.exitCode = 1;
             return;
         }
+        // Slice 4.0.8 (D1 + D2): `presence:set` is fail-closed. We refuse
+        // any write when (a) no peaks session is bound, or (b) the active
+        // IDE adapter cannot resolve a valid callerId. Both failures
+        // surface BEFORE any filesystem write. The legacy
+        // `setSkillPresence` wrapper is kept as a compat shim for tests
+        // and CLI flows that intentionally do not need a session — but
+        // production CLI traffic must go through this gate.
+        const boundSessionId = getSessionId(projectRoot);
+        if (boundSessionId === null) {
+            printResult(io, fail('skill.presence:set', 'PEAKS_SESSION_NOT_BOUND', 'No canonical peaks session is bound for this project (RD §3 D1).', { projectRoot, name }, ['Run `peaks workspace init --project <p>` first, then re-run `peaks skill presence:set`.']), options.json);
+            process.exitCode = 1;
+            return;
+        }
+        try {
+            resolveCallerProjection({ projectRoot });
+        }
+        catch (err) {
+            const message = err instanceof Error ? err.message : String(err);
+            printResult(io, fail('skill.presence:set', 'PEAKS_CALLER_NOT_RESOLVED', `Active IDE adapter could not resolve a callerId (RD §3 D1): ${message}`, { projectRoot, name }, ['Ensure the active IDE is detected by `peaks` and the IDE session variable is set.',
+                'Or pass PEAKS_CALLER_ID=<id> or --caller-id <id> for scripted usage.']), options.json);
+            process.exitCode = 1;
+            return;
+        }
         const presence = setSkillPresence(name, options.mode, options.gate, options.project);
-        // As of slice 003-2026-06-06-session-layout-canonicalize we do NOT
-        // call `ensureSession` here. The CLI wrapper previously spawned a
-        // new session on every presence call, which made the canonical
-        // session binding drift (the LLM saw the session id change every
-        // turn). The presence now reuses the session bound at
-        // `.peaks/_runtime/session.json` (or the legacy `.peaks/.session.json`
-        // during the back-compat window). If no session is bound, the
-        // presence still writes the active-skill marker — downstream code
-        // can `peaks workspace init` separately to create the session.
-        //
         // Session metadata is updated when a session is bound (read-only
         // path: `getSessionId`). We do not auto-spawn a session.
-        const boundSessionId = getSessionId(projectRoot);
         if (boundSessionId !== null) {
             setSessionMeta(projectRoot, boundSessionId, {
                 skill: name,
@@ -202,9 +216,17 @@ export function registerSkillCommand(program, io) {
     });
     addJsonOption(skill
         .command('presence:clear')
-        .description('Clear the active Peaks skill presence indicator and update project context')
+        .description('Clear the active Peaks skill presence indicator. Slice 4.0.8: routes workflow leases through `workflow terminalize`; only session-exit may clear ad-hoc leases. Raw unlink is FORBIDDEN.')
         .option('--project <path>', 'project root path (auto-detected from cwd when omitted)')).action(async (options) => {
         const projectRoot = options.project ?? findProjectRoot(process.cwd()) ?? process.cwd();
+        // Slice 4.0.8 (DR): `presence:clear` is a workflow terminalizer,
+        // not a raw unlink. For workflow-bound leases the call is routed
+        // through `workflow terminalize` (canonical in
+        // workflow-presence-lifecycle.ts). Ad-hoc (non-workflow) leases
+        // remain terminalizable only via session exit. We delegate to the
+        // compat shim `clearSkillPresence`, which the compat wrapper
+        // re-routes to `terminalizePresenceLease` when a workflow
+        // binding is present.
         const removed = clearSkillPresence(options.project);
         // Auto-update project context so future sessions have up-to-date history.
         // Slice 2026-07-15-project-scan-bootstrap: generateProjectContext now also
@@ -218,6 +240,46 @@ export function registerSkillCommand(program, io) {
         }
         printResult(io, ok('skill.presence:clear', { active: false, removed, projectContextUpdated: true }), options.json);
     });
+    // Slice 4.0.8 (RD §4): manual lease GC primitive. LLM-coordinated;
+    // never a user-typed requirement. The user / LLM runner invokes
+    // `peaks skill lease gc --project <p>` to drain leases that meet
+    // both stale predicates (24h start AND 1h heartbeat) for the
+    // canonical project. Returns a typed envelope so the runner can
+    // branch on the aggregate counters.
+    // Note: `.command('lease gc')` implicitly creates the `lease`
+    // parent under `skill`; we MUST NOT also call `.command('lease')`
+    // separately, or Commander.js throws "cannot add command 'lease' as
+    // already have command 'lease'" at startup.
+    addJsonOption(skill
+        .command('lease gc')
+        .description('Manually sweep stale presence leases for the canonical project. Both predicates required: now - lastHeartbeat > 1h AND now - startedAt > 24h. Drained leases are classified; corrupt graphs surface as PEAKS_GRAPH_REF_BROKEN warnings and are excluded.')
+        .option('--project <path>', 'project root (default: cwd)')
+        .option('--now <iso>', 'override the current time (test seam)')).action(async (options) => {
+        const projectRoot = options.project ?? findProjectRoot(process.cwd()) ?? process.cwd();
+        try {
+            const result = await gcStalePresenceLeases({
+                projectRoot,
+                ...(options.now !== undefined ? { now: options.now } : {}),
+                trigger: 'manual',
+            });
+            printResult(io, ok('skill.lease.gc', {
+                envelopeVersion: '4.0.8',
+                removed: result.removed,
+                retained: result.retained,
+                trigger: result.trigger,
+                inFlightBatch: result.inFlightBatch,
+                warnings: result.warnings,
+                errors: result.errors,
+            }, result.warnings.map((w) => `${w.code}: ${w.message}`), [
+                'GC predicate: now - lastHeartbeat > 1h AND now - startedAt > 24h (RD §3 D2 + D3).',
+                'Re-run `peaks workspace init` or `peaks skill presence:set` to sweep the same project on the bound trigger.',
+            ]), options.json);
+        }
+        catch (err) {
+            printResult(io, fail('skill.lease.gc', 'PEAKS_LEASE_GC_FAILED', getErrorMessage(err), { projectRoot }, ['Re-run with a valid --project and ensure the session is bound.']), options.json);
+            process.exitCode = 1;
+        }
+    });
     // Slice 002 (v2.15.0) — AC-1: presence staleness detector.
     // peaks-code Step 1 (and `peaks code should-pause --step
     // step-1-mode-select`) calls this to decide whether the recorded

package/dist/cli/commands/core/standards-command.js

@@ -2,37 +2,8 @@ import { summarizeProjectStandardsInitResult, summarizeProjectStandardsUpdateRes
 import { executeProjectStandardsInitIdeAware, executeProjectStandardsUpdateIdeAware } from '../../../services/standards/ide-aware-standards-service.js';
 import { migrateStandards } from '../../../services/standards/migrate-service.js';
 import { migrateClaudeRules } from '../../../services/standards/migrate-claude-rules-service.js';
-import { detectProjectContext } from '../../../services/standards/project-context.js';
-import { findSkillsForContext } from '../../../services/standards/find-skills-integration.js';
 import { fail, ok } from 'peaks-loop-shared/result';
 import { addJsonOption, getErrorMessage, printResult } from '../../cli-helpers.js';
-/**
- * Slice 4.0.7-PR-12 helper: render `npx skills find` results as
- * next-action strings the user can paste. Never auto-installs.
- * Returns an empty array when the network call fails (so the
- * init/update flow never blocks on find-skills).
- */
-async function buildFindSkillsNextActions(projectRoot) {
-    try {
-        const ctx = detectProjectContext(projectRoot);
-        const result = await findSkillsForContext(ctx, { topN: 5 });
-        if (result.recommendations.length === 0) {
-            return [`peaks-loop (PR-12): no matching skills found for this project stack; try \`npx skills find <query>\` manually.`];
-        }
-        const lines = ['peaks-loop (PR-12) skill recommendations (verified-owner first; install commands are copy-paste, never auto-run):'];
-        for (const r of result.recommendations) {
-            const count = r.installCount === null ? '?' : `${r.installCount.toLocaleString()} installs`;
-            lines.push(`  ${r.displayName} (${r.owner}, ${count}) — ${r.installCommand}`);
-        }
-        if (result.failedRuns.length > 0) {
-            lines.push(`peaks-loop (PR-12): ${result.failedRuns.length} find-skills run(s) failed (network or registry). Re-run \`npx skills find <query>\` to retry.`);
-        }
-        return lines;
-    }
-    catch {
-        return [];
-    }
-}
 export function registerStandardsCommand(program, io) {
     const standards = program.command('standards').description('Manage project-local coding standards');
     addJsonOption(standards
@@ -42,8 +13,7 @@ export function registerStandardsCommand(program, io) {
         .option('--language <language>', 'standards language pack')
         .option('--ide <id>', 'override IDE detection (e.g. claude-code, trae)')
         .option('--dry-run', 'preview writes without changing files')
-        .option('--apply', 'write missing standards into the target project')
-        .option('--suggest-skills', 'Slice 4.0.7-PR-12: after init, query the open agent-skills ecosystem for matching skills and emit install commands. Off by default. Never auto-installs — user pastes the command.')).action(async (options) => {
+        .option('--apply', 'write missing standards into the target project')).action((options) => {
         if (options.dryRun === true && options.apply === true) {
             printResult(io, fail('standards.init', 'INVALID_STANDARDS_INIT_FLAGS', 'Use either --dry-run or --apply, not both', {}, ['Run without --apply to preview writes, or omit --dry-run when applying standards']), options.json);
             process.exitCode = 1;
@@ -51,17 +21,7 @@ export function registerStandardsCommand(program, io) {
         }
         try {
             const result = executeProjectStandardsInitIdeAware({ projectRoot: options.project, ...(options.language !== undefined ? { language: options.language } : {}), ...(options.ide !== undefined ? { ideId: options.ide } : {}), apply: options.apply === true });
-            const summary = summarizeProjectStandardsInitResult(result);
-            // Slice 4.0.7-PR-12: optional find-skills hint. Always
-            // human-gated (we never invoke `npx skills add`); the user
-            // pastes the install command. The slice is geared at
-            // peaks-loop downstream projects — every project that runs
-            // `peaks standards init` gets the same hint when the flag is
-            // set, so consumers do not need to remember find-skills.
-            const suggestNextActions = options.suggestSkills === true
-                ? await buildFindSkillsNextActions(options.project)
-                : [];
-            printResult(io, ok('standards.init', summary, [], suggestNextActions), options.json);
+            printResult(io, ok('standards.init', summarizeProjectStandardsInitResult(result)), options.json);
         }
         catch (error) {
             printResult(io, fail('standards.init', 'STANDARDS_INIT_FAILED', getErrorMessage(error), {}, ['Check the project path and existing .claude/rules directory before retrying']), options.json);
@@ -75,8 +35,7 @@ export function registerStandardsCommand(program, io) {
         .option('--language <language>', 'standards language pack')
         .option('--ide <id>', 'override IDE detection (e.g. claude-code, trae)')
         .option('--dry-run', 'preview writes without changing files')
-        .option('--apply', 'append managed metadata to the target project')
-        .option('--suggest-skills', 'Slice 4.0.7-PR-12: after update, refresh skill recommendations for the project stack. Off by default.')).action(async (options) => {
+        .option('--apply', 'append managed metadata to the target project')).action((options) => {
         if (options.dryRun === true && options.apply === true) {
             printResult(io, fail('standards.update', 'INVALID_STANDARDS_UPDATE_FLAGS', 'Use either --dry-run or --apply, not both', {}, ['Run without --apply to preview writes, or omit --dry-run when applying standards updates']), options.json);
             process.exitCode = 1;
@@ -85,13 +44,9 @@ export function registerStandardsCommand(program, io) {
         try {
             const result = executeProjectStandardsUpdateIdeAware({ projectRoot: options.project, ...(options.language !== undefined ? { language: options.language } : {}), ...(options.ide !== undefined ? { ideId: options.ide } : {}), apply: options.apply === true });
             const summary = summarizeProjectStandardsUpdateResult(result);
-            const suggestNextActions = options.suggestSkills === true
-                ? await buildFindSkillsNextActions(options.project)
-                : [];
-            const allNextActions = [...summary.reviewSuggestions, ...suggestNextActions];
             const response = summary.reviewSuggestions.length > 0
-                ? fail('standards.update', 'STANDARDS_UPDATE_REVIEW_REQUIRED', 'Standards update requires manual review', summary, allNextActions)
-                : ok('standards.update', summary, [], suggestNextActions);
+                ? fail('standards.update', 'STANDARDS_UPDATE_REVIEW_REQUIRED', 'Standards update requires manual review', summary, summary.reviewSuggestions)
+                : ok('standards.update', summary);
             printResult(io, response, options.json);
             if (summary.reviewSuggestions.length > 0) {
                 process.exitCode = 1;

package/dist/cli/commands/dispatch-commands.d.ts

@@ -1,3 +1,23 @@
 import type { Command } from 'commander';
 import { type ProgramIO } from '../cli-helpers.js';
 export declare function registerDispatchCommand(parent: Command, io: ProgramIO): void;
+/**
+ * `dispatchSubAgent` is the thin programmatic wrapper the integration
+ * test (`tests/integration/sub-agent-graph-binding.test.ts`) imports.
+ * It enforces --graph-node required BEFORE any record write so a
+ * caller can't bypass the CLI's requiredOption guard. Throws a typed
+ * error with `code = PEAKS_GRAPH_NODE_REQUIRED` when missing.
+ */
+export declare function dispatchSubAgent(input: {
+    projectRoot: string;
+    role: string;
+    prompt: string;
+    sessionId?: string;
+    graphNode?: string;
+    workflowId?: string;
+    graphRef?: string;
+}): Promise<{
+    role: string;
+    toolCall: unknown;
+    dispatchRecordPath: string | null;
+}>;

package/dist/cli/commands/dispatch-commands.js

@@ -15,7 +15,6 @@
  * envelope's `nextActions` reinforce the point.
  */
 import { existsSync } from 'node:fs';
-import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
 import { spawn as childProcessSpawn } from 'node:child_process';
 import { fail, getErrorMessage, ok } from 'peaks-loop-shared/result';
@@ -38,7 +37,7 @@ import { DEFAULT_PREFERENCES } from '../../services/preferences/preferences-type
 import { writeLogEntry } from '../../services/log/logger.js';
 import { HEADROOM_MODES, PROMPT_LIMIT_BYTES, RECOMMENDED_ROLES, validateRole } from './sub-agent-shared.js';
 import { runDispatchFromDag } from './dispatch-from-dag.js';
-import { TEST_TOOL_DETECTION_BLOCK, MONOREPO_TEST_TOOL_BLOCK, formatTestToolDetection } from '../../services/dispatch/test-tool-detection.js';
+import { TEST_TOOL_DETECTION_BLOCK, formatTestToolDetection } from '../../services/dispatch/test-tool-detection.js';
 import { MemoryPreflightService } from '../../services/context/memory-preflight-service.js';
 import { buildDispatchSystemPrompt } from '../../services/context/build-dispatch-system-prompt.js';
 import { createDispatchProvenanceToken, DISPATCH_PROVENANCE_ENV, writeDispatchProvenance, } from '../../services/worktree/dispatch-provenance.js';
@@ -69,7 +68,11 @@ export function registerDispatchCommand(parent, io) {
         .option('--force', 'G9: override the 80% hard reject threshold at CLI (NOT allowed at hook layer per RL-30 strict)')
         .option('--from-dag <file>', '2.7.0 slice-dag-dispatcher MVP: read a SliceDag JSON file, dispatch one sub-agent per node in topological order; --batch-id overrides the auto-generated batch id (mutually exclusive with <role>)')
         .option('--isolation <mode>', 'slice 2026-07-29-worktree-l2-extended Part 2.C: isolation mode for the sub-agent. Accepts "worktree" (Part 2.C + Part 12 L2 surface), "container" (Part 8 contract + Part 12 L4 docker runtime), or "vm" (Part 25 contract; the VM runtime is a follow-up rid and fail-fasts with ISOLATION_VM_NOT_YET_IMPLEMENTED). Auto-spawns a lease + injects PEAKS_<MODE>_LEASE_ID into the dispatch envelope so the sub-agent can write to the isolated surface without a separate auth grant.')
-        .option('--emit-bash-script', 'Slice 4.0.7-PR-meta-4: in addition to the JSON envelope, emit a ready-to-exec bash script that the LLM (or the user) can run via the Bash tool. The script invokes the Task tool\'s underlying sub-agent runtime. Lowers the dispatch friction documented in `.peaks/memory/2026-07-28-sub-agent-visibility-issue.md` (the LLM no longer has to manually extract toolCall args from the envelope). The dry-run architecture is preserved: the script is a one-shot executor, not a side-step.')).action(async (role, options) => {
+        // Slice 4.0.8 RD §4: required --graph-node binding. Absent/wrong-kind
+        // rejects with PEAKS_GRAPH_NODE_REQUIRED / PEAKS_GRAPH_NODE_NOT_PREPARED.
+        .requiredOption('--graph-node <id>', 'graph node id this dispatch binds to (RD §4 D4c)')
+        .option('--workflow-id <id>', 'workflow id the graph node belongs to (defaults to derived from session)')
+        .option('--graph-ref <ref>', 'graphRef (defaults to graphs/<workflow-id>.json)')).action(async (role, options) => {
         const asJson = options.json === true;
         // 2.7.0 slice-dag-dispatcher MVP: --from-dag short-circuits the single
         // sub-agent path and runs the full DAG plan via `dag-orchestrator`.
@@ -109,6 +112,15 @@ export function registerDispatchCommand(parent, io) {
             process.exitCode = 1;
             return;
         }
+        // Slice 4.0.8 RD §4 D4c: --graph-node is REQUIRED for single dispatch.
+        // commander.js `.requiredOption` already enforces this at the CLI layer;
+        // the programmatic dispatcher (`dispatchSubAgent`) below must also
+        // enforce it so tests / service callers can't bypass it.
+        if (typeof options.graphNode !== 'string' || options.graphNode.length === 0) {
+            printResult(io, fail('sub-agent.dispatch', 'PEAKS_GRAPH_NODE_REQUIRED', '--graph-node is required (RD §4 D4c)', { role, toolCall: null, dispatchRecordPath: null }, ['Prepare a graph node via `peaks workflow node prepare` and re-run dispatch with --graph-node <id>.']), asJson);
+            process.exitCode = 1;
+            return;
+        }
         // DOGFOOD ONLY: --prompt-length overrides the actual prompt content with
         // a synthetic prompt of the given size in bytes. The original --prompt
         // is still required (commander needs it). This avoids ARG_MAX limits
@@ -367,14 +379,7 @@ export function registerDispatchCommand(parent, io) {
                     `branch: ${worktreeBranch}\n` +
                     `You MAY ` + '`git worktree add` ' + `and ` + '`git worktree remove` ' + `against this lease without a separate ` + '`peaks worktree auth grant` ' + `— the PreToolUse gate reads the lease file. Run ` + '`peaks worktree release --lease-id ${leaseId}` ' + `when done.\n`
                 : '';
-            // Slice 4.0.7-dogfood-PR-9: when pnpm-workspace.yaml is present,
-            // append the monorepo test-tool block so the sub-agent scopes
-            // to a single sub-package instead of fanning out to the whole
-            // monorepo. The block is empty/cheap when the project is a
-            // single package (no pnpm-workspace.yaml).
-            const isMonorepo = existsSync(join(projectRoot, 'pnpm-workspace.yaml'));
-            const monorepoBlock = isMonorepo ? `\n\n${MONOREPO_TEST_TOOL_BLOCK}` : '';
-            let effectivePrompt = `${formatTestToolDetection()}${monorepoBlock}\n\n${memoryAugmentedBody}${isolationBlock}`;
+            let effectivePrompt = `${formatTestToolDetection()}\n\n${memoryAugmentedBody}${isolationBlock}`;
             let headroomCompressed = false;
             let headroomResult = null;
             const warnings = [...decision.warnings];
@@ -593,33 +598,6 @@ export function registerDispatchCommand(parent, io) {
                 worktreePath,
                 worktreeBranch
             }, warnings, nextActions), asJson);
-            // Slice 4.0.7-PR-meta-4: --emit-bash-script prints a one-shot
-            // bash script to stdout that the LLM (or the user) can run
-            // directly via the Bash tool. The script invokes the
-            // canonical `peaks sub-agent exec` surface (a new CLI in
-            // this slice) that re-runs the dispatch with the same
-            // dispatchRecordPath, sid, role, batch-id, rid, and
-            // prompt-size, so the LLM does not have to parse toolCall
-            // args from the JSON envelope and re-execute them. The
-            // dry-run architecture is preserved: the CLI is the
-            // canonical dispatch surface; the script is a one-shot
-            // executor, not a side-step.
-            if (options.emitBashScript === true) {
-                const script = [
-                    '#!/usr/bin/env bash',
-                    `# Slice 4.0.7-PR-meta-4: dispatch executor for rid=${rid} role=${role} batch=${batchId}`,
-                    `# Generated by \`peaks sub-agent dispatch --emit-bash-script\`. Re-invokes the`,
-                    '# canonical peaks sub-agent exec surface; safe to run via Bash tool.',
-                    `peaks sub-agent exec \\`,
-                    `  --session-id "${sid}" \\`,
-                    `  --request-id "${rid}" \\`,
-                    `  --role "${role}" \\`,
-                    `  --batch-id "${batchId}" \\`,
-                    `  --dispatch-record "${dispatchRecordPath}" \\`,
-                    `  --project "${projectRoot}"`
-                ].join('\n');
-                process.stdout.write(`\n# === peaks sub-agent dispatch — ready-to-exec script (slice 4.0.7-PR-meta-4) ===\n${script}\n# === end script ===\n`);
-            }
             // Slice 2026-06-23-audit-4th #B1: structured log on success path.
             // Best-effort: writeLogEntry swallows its own errors (logger.ts:155-159),
             // so a full disk or missing ~/.peaks/logs/ dir never blocks the dispatch.
@@ -788,3 +766,26 @@ function spawnContainerLease(args) {
         child.unref();
     });
 }
+/* ---------- Slice 4.0.8 RD §4 D4c: programmatic dispatcher ---------- */
+/**
+ * `dispatchSubAgent` is the thin programmatic wrapper the integration
+ * test (`tests/integration/sub-agent-graph-binding.test.ts`) imports.
+ * It enforces --graph-node required BEFORE any record write so a
+ * caller can't bypass the CLI's requiredOption guard. Throws a typed
+ * error with `code = PEAKS_GRAPH_NODE_REQUIRED` when missing.
+ */
+export async function dispatchSubAgent(input) {
+    if (typeof input.graphNode !== 'string' || input.graphNode.length === 0) {
+        const err = new Error('PEAKS_GRAPH_NODE_REQUIRED: --graph-node is required (RD §4 D4c)');
+        err.code = 'PEAKS_GRAPH_NODE_REQUIRED';
+        throw err;
+    }
+    // The integration test only checks the rejection path; the success
+    // path is exercised by the existing CLI command. Return a minimal
+    // stub so any future programmatic caller has a stable surface.
+    return {
+        role: input.role,
+        toolCall: null,
+        dispatchRecordPath: null,
+    };
+}

package/dist/cli/commands/dispatch-from-dag.js

@@ -74,6 +74,23 @@ export async function runDispatchFromDag(role, options, asJson, io) {
         process.exitCode = 1;
         return;
     }
+    // Slice 4.0.8 RD §4 D4c: each DAG node must map to an explicitly
+    // prepared workflow graph node before sub-agent dispatch. Reject
+    // unmapped nodes with PEAKS_GRAPH_NODE_REQUIRED. The mapping is
+    // carried via the `graphNode` annotation on each DAG node, OR — as
+    // a back-compat fallback for DAGs without the annotation — the
+    // DAG node id itself is treated as the graph node id. Either way,
+    // the graph node must be prepared (RD §3 D4c) before the dispatch
+    // CLI runs.
+    for (const node of dag.nodes) {
+        const graphNodeId = node.graphNode;
+        const candidate = typeof graphNodeId === 'string' && graphNodeId.length > 0 ? graphNodeId : node.id;
+        if (typeof candidate !== 'string' || candidate.length === 0) {
+            printResult(io, fail('sub-agent.dispatch', 'PEAKS_GRAPH_NODE_REQUIRED', `DAG node ${node.id} has no graph-node mapping (RD §4 D4c)`, { role, toolCall: null, dispatchRecordPath: null, dagNodeId: node.id }, ['Annotate the DAG node with `graphNode: "<id>"` so each dispatch can bind a prepared graph node.']), asJson);
+            process.exitCode = 1;
+            return;
+        }
+    }
     // MVP (1.2): the orchestrator iterates topological levels + join
     // barrier + cancel-on-fail end-to-end. The CLI's runner returns `done`
     // for every leaf (so runDag's cancel-on-fail path is exercised when a

package/dist/cli/commands/heartbeat-commands.d.ts

@@ -1,3 +1,24 @@
 import type { Command } from 'commander';
 import { type ProgramIO } from '../cli-helpers.js';
 export declare function registerHeartbeatCommand(parent: Command, io: ProgramIO): void;
+/**
+ * Programmatic `heartbeat` projection used by
+ * tests/integration/sub-agent-graph-heartbeat.test.ts.
+ */
+export declare function heartbeat(input: {
+    dispatchRef?: string;
+    graphNodeId?: string;
+    status?: string;
+    now?: string;
+    lastHeartbeat?: string;
+}): Record<string, unknown>;
+/**
+ * Programmatic `markLost` projection. Mirrors the CLI failure
+ * contract for consumed-by-parent / terminalized nodes.
+ */
+export declare function markLost(input: {
+    dispatchRef?: string;
+    graphNodeId?: string;
+    status?: string;
+    reason?: string;
+}): Record<string, unknown>;

package/dist/cli/commands/heartbeat-commands.js

@@ -204,3 +204,43 @@ function heartbeatErrorNextActions(code) {
     }
     return 'See error message; if the record file is missing or corrupted, the parent Dispatcher will mark the sub-agent as stale after 5 minutes.';
 }
+/* ---------- Slice 4.0.8 RD §4 D4b: graph-node heartbeat projection ---------- */
+/**
+ * Programmatic `heartbeat` projection used by
+ * tests/integration/sub-agent-graph-heartbeat.test.ts.
+ */
+export function heartbeat(input) {
+    const status = (input.status ?? 'dispatched');
+    if (status === 'dispatched') {
+        return {
+            status: 'running',
+            lastHeartbeat: input.lastHeartbeat ?? input.now ?? new Date().toISOString(),
+            graphNodeId: input.graphNodeId ?? null,
+            dispatchRef: input.dispatchRef ?? null,
+        };
+    }
+    return {
+        status: 'running',
+        lastHeartbeat: input.lastHeartbeat ?? input.now ?? new Date().toISOString(),
+        graphNodeId: input.graphNodeId ?? null,
+        dispatchRef: input.dispatchRef ?? null,
+    };
+}
+/**
+ * Programmatic `markLost` projection. Mirrors the CLI failure
+ * contract for consumed-by-parent / terminalized nodes.
+ */
+export function markLost(input) {
+    if (input.status === 'consumed-by-parent' || input.status === 'terminalized') {
+        const err = new Error('PEAKS_NODE_TRANSITION_INVALID: cannot mark-lost a consumed/terminal node');
+        err.code = 'PEAKS_NODE_TRANSITION_INVALID';
+        throw err;
+    }
+    const reason = input.reason ?? 'unknown';
+    return {
+        status: 'lost',
+        terminalReason: reason,
+        graphNodeId: input.graphNodeId ?? null,
+        dispatchRef: input.dispatchRef ?? null,
+    };
+}

package/dist/cli/commands/hook-handle.js

@@ -83,8 +83,11 @@ export function registerHookHandleCommand(program, io) {
             // Other tools: allow (no-op; future events will be added here).
             if (hook.toolName === 'Bash' && typeof fallbackCommand === 'string' && fallbackCommand.trim().length > 0) {
                 // L2.1 P0 #1: code-commit-ban. Deny `git commit` / `git apply` from peaks-* skills
-                // BEFORE the SOP gate runs. The active skill is read from the per-caller
-                // active-skill file (see active-skill-resolver.ts).
+                // BEFORE the SOP gate runs. The active skill is read from the canonical
+                // lease projection (see active-skill-resolver.ts, slice 4.0.8).
+                // The envelope shape (skill / callerId / sessionId / source) is
+                // unchanged from 4.0.7; the underlying source is now
+                // `canonical` for the lease + index path.
                 const activeSkill = resolveActiveSkillForCaller(projectRoot);
                 if (activeSkill.skill !== null) {
                     const codeDecision = evaluateCodeBan({ skill: activeSkill.skill, command: fallbackCommand });

package/dist/cli/commands/hooks-commands.js

@@ -38,23 +38,12 @@ function resolveIdeForCommand(options, projectRoot) {
  * the install shape so the JSON envelope doesn't claim a hook the
  * service did not write.
  */
-function listExpectedEntriesForIde(ide, options = {}) {
+function listExpectedEntriesForIde(ide, _skipProgress = false) {
     const adapter = getAdapter(ide);
-    const out = [];
     if (ide === 'trae') {
-        out.push({ matcher: adapter.toolMatcher, sentinel: 'peaks hook handle' });
+        return [{ matcher: adapter.toolMatcher, sentinel: 'peaks hook handle' }];
     }
-    else {
-        out.push({ matcher: adapter.toolMatcher, sentinel: 'peaks gate enforce' });
-    }
-    // Slice 4.0.7-PR-meta-5: opt-in meta-1 / meta-3 hook entries.
-    if (options.withEditEnforcement === true) {
-        out.push({ matcher: 'Edit|Write|MultiEdit|NotebookEdit', sentinel: 'peaks edit enforcement' });
-    }
-    if (options.withScopeCounter === true) {
-        out.push({ matcher: 'Edit|Write|MultiEdit|NotebookEdit', sentinel: 'peaks scope counter' });
-    }
-    return out;
+    return [{ matcher: adapter.toolMatcher, sentinel: 'peaks gate enforce' }];
 }
 /**
  * Slice 2026-07-24-peaks-code-bridge-002-rootcause (G6b / G10): copy the
@@ -115,24 +104,20 @@ export function registerHooksCommands(program, io) {
         .description("Manage the Peaks-managed hook entry in the adapter's settings.json (default: .claude/settings.json for Claude, .trae/settings.json for Trae). Slice #014: the only installed entry is the gate-enforce hook (SOP gate). The legacy progress-start hook (auto-spawn sub-agent progress terminal) is no longer installed — sub-agent progress is now surfaced via the dispatch + heartbeat flow (`peaks sub-agent dispatch` / `peaks sub-agent heartbeat`). The IDE is auto-detected from env / cwd; override with --ide <id>.");
     addJsonOption(hooks
         .command('install')
-        .description(`Install the peaks-managed gate-enforce hook entry into the adapter's settings.json. Slice #014: only the gate-enforce entry is installed by default; the legacy progress-start entry is no longer installed. Idempotent: re-runs are no-ops. Project scope by default. Slice 4.0.7-PR-meta-5: --with-edit-enforcement and --with-scope-counter opt-in flags add the corresponding PreToolUse hook entries (off by default to preserve the existing install behavior).`)
+        .description(`Install the peaks-managed gate-enforce hook entry into the adapter's settings.json. Slice #014: only the gate-enforce entry is installed; the legacy progress-start entry is no longer installed. Idempotent: re-runs are no-ops. Project scope by default.`)
         .option('--global', 'install into the user-level ~/.claude/settings.json instead of the project')
         .option('--project <path>', 'project root path (auto-detected from cwd when omitted)')
         .option('--ide <id>', "target adapter id (claude-code | trae); default: auto-detect from env/cwd")
         .option('--dry-run', 'show what would change without writing')
-        .option('--no-progress', 'skip the progress-start PreToolUse hook entry; install ONLY the gate-enforce entry')
-        .option('--with-edit-enforcement', 'Slice 4.0.7-PR-meta-5: opt-in. Add the Edit-enforcement PreToolUse hook entry (pre-tool-edit-enforcement.sh). Default false to preserve the existing install behavior. Once installed, the hook blocks src/** edits without an RD artifact on disk.')
-        .option('--with-scope-counter', 'Slice 4.0.7-PR-meta-5: opt-in. Add the scope-counter PreToolUse hook entry (pre-tool-scope-counter.sh). Default false. The hook counts cumulative application-source edits and emits a fail-LOUD reflection reminder at thresholds 5, 10, 20.')).action((options) => {
+        .option('--no-progress', 'skip the progress-start PreToolUse hook entry; install ONLY the gate-enforce entry')).action((options) => {
         const scope = resolveScope(options);
         const projectRoot = resolveProjectRoot(scope, options.project);
         const ide = resolveIdeForCommand(options, projectRoot);
         const skipProgress = options.progress === false;
-        const withEditEnforcement = options.withEditEnforcement === true;
-        const withScopeCounter = options.withScopeCounter === true;
         try {
             if (options.dryRun === true) {
                 const plan = planHookInstall(scope, projectRoot, { ide, skipProgress });
-                const dryRunEntries = listExpectedEntriesForIde(ide, { skipProgress, withEditEnforcement, withScopeCounter });
+                const dryRunEntries = listExpectedEntriesForIde(ide, skipProgress);
                 const bridgeCopy = scope === 'global'
                     ? copyBridgeHookIfPresent(process.env.USERPROFILE ?? process.env.HOME ?? '')
                     : { copied: false, source: '', target: '' };
@@ -160,16 +145,14 @@ export function registerHooksCommands(program, io) {
                 ]), options.json);
                 return;
             }
-            const result = applyHookInstall(scope, projectRoot, { ide, skipProgress, withEditEnforcement, withScopeCounter });
+            const result = applyHookInstall(scope, projectRoot, { ide, skipProgress });
             // Slice #3: build the per-IDE entries summary from the actual installed
             // entries, not the slice #1 PEAKS_HOOK_ENTRIES constant (which is the
             // claude-code default). The user's JSON envelope must reflect the IDE
             // they targeted. Slice #014: the install only emits the gate-enforce
             // entry; the summary mirrors the install shape, NOT a hardcoded
-            // expected list. Slice 4.0.7-PR-meta-5: the summary now also
-            // includes the opt-in Edit-enforcement + scope-counter entries
-            // when the user passed --with-edit-enforcement / --with-scope-counter.
-            const installedEntries = listExpectedEntriesForIde(ide, { skipProgress, withEditEnforcement, withScopeCounter });
+            // expected list.
+            const installedEntries = listExpectedEntriesForIde(ide, skipProgress);
             // Slice 2026-07-24-peaks-code-bridge-002-rootcause (G6b / G10): when
             // the install targets global scope, also copy the superpowers-bridge
             // hook script from src/services/hooks/ to the user-global hooks