peaks-loop 4.0.7 → 4.0.9

package/dist/services/audit/enforcers/active-skill-resolver.d.ts

@@ -4,26 +4,42 @@
  * Resolves the active peak skill name for the current session, so hook
  * enforcers (e.g. code-ban) can decide whether to fire.
  *
+ * Slice 4.0.8 (D1 + D4a): prefer the canonical
+ * `readPresenceLease` projection from `presence-lease-service.ts`.
+ * The 4.0.7 legacy `active-skill-<callerId>.json` walk is preserved
+ * as a 1-minor-release back-compat fallback, gated on the
+ * `legacyPresence: true` opt-in. By default the canonical projection
+ * is the only source of truth — the read returns `{ skill, callerId,
+ * sessionId, source: 'canonical' | 'legacy' | 'none' }`.
+ *
  * Per `src/services/session/caller-id-types.ts`: the active-skill file is
- * at `.peaks/_runtime/<peakSessionId>/active-skill-<callerId>.json`.
+ * at `.peaks/_runtime/<peakSessionId>/active-skill-<callerId>.json`
+ * (legacy) or `.peaks/_runtime/<sid>/presence-index/<callerId>.json`
+ * (canonical index → lease file).
  *
  * Resolution order (graceful degradation — never throws):
  *   1. PEAKS_ACTIVE_SKILL env var (explicit override, used by tests)
- *   2. .peaks/_runtime/<sid>/active-skill-<callerId>.json for each caller
- *      bound to the current peak session
- *   3. null (caller did not set a skill; enforcers can decide to skip)
+ *   2. Canonical lease projection (presence-lease-service.readPresenceLease)
+ *   3. Legacy `.peaks/_runtime/<sid>/active-skill-*.json` walk, when
+ *      `legacyPresence === true` is passed by the caller
+ *   4. null (caller did not set a skill; enforcers can decide to skip)
  */
 export interface ActiveSkillResolution {
     readonly skill: string | null;
     readonly callerId: string | null;
     readonly sessionId: string | null;
-    readonly source: 'env' | 'file' | 'none';
+    /** `canonical` = presence-lease-service; `legacy` = per-caller active-skill file; `env` = test override; `none` = nothing wired. */
+    readonly source: 'env' | 'file' | 'canonical' | 'none';
 }
 /**
  * Resolve the active peak skill for the current hook invocation.
  *
- * Reads PEAKS_ACTIVE_SKILL first (test override), then walks
- * `.peaks/_runtime/<sid>/` for any `active-skill-*.json` file. Returns
- * the first match.
+ * Reads PEAKS_ACTIVE_SKILL first (test override), then the canonical
+ * lease projection (RD §4 / §6 — the lease + index is the source of
+ * truth in 4.0.8), then — only when the caller explicitly opts in via
+ * `legacyPresence: true` — the legacy `.peaks/_runtime/<sid>/active-skill-*.json`
+ * walk. Returns the first match.
  */
-export declare function resolveActiveSkillForCaller(projectRoot: string): ActiveSkillResolution;
+export declare function resolveActiveSkillForCaller(projectRoot: string, opts?: {
+    legacyPresence?: boolean;
+}): ActiveSkillResolution;

package/dist/services/audit/enforcers/active-skill-resolver.js

@@ -4,28 +4,43 @@
  * Resolves the active peak skill name for the current session, so hook
  * enforcers (e.g. code-ban) can decide whether to fire.
  *
+ * Slice 4.0.8 (D1 + D4a): prefer the canonical
+ * `readPresenceLease` projection from `presence-lease-service.ts`.
+ * The 4.0.7 legacy `active-skill-<callerId>.json` walk is preserved
+ * as a 1-minor-release back-compat fallback, gated on the
+ * `legacyPresence: true` opt-in. By default the canonical projection
+ * is the only source of truth — the read returns `{ skill, callerId,
+ * sessionId, source: 'canonical' | 'legacy' | 'none' }`.
+ *
  * Per `src/services/session/caller-id-types.ts`: the active-skill file is
- * at `.peaks/_runtime/<peakSessionId>/active-skill-<callerId>.json`.
+ * at `.peaks/_runtime/<peakSessionId>/active-skill-<callerId>.json`
+ * (legacy) or `.peaks/_runtime/<sid>/presence-index/<callerId>.json`
+ * (canonical index → lease file).
  *
  * Resolution order (graceful degradation — never throws):
  *   1. PEAKS_ACTIVE_SKILL env var (explicit override, used by tests)
- *   2. .peaks/_runtime/<sid>/active-skill-<callerId>.json for each caller
- *      bound to the current peak session
- *   3. null (caller did not set a skill; enforcers can decide to skip)
+ *   2. Canonical lease projection (presence-lease-service.readPresenceLease)
+ *   3. Legacy `.peaks/_runtime/<sid>/active-skill-*.json` walk, when
+ *      `legacyPresence === true` is passed by the caller
+ *   4. null (caller did not set a skill; enforcers can decide to skip)
  */
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { getSessionIdCanonical } from '../../session/session-manager.js';
 import { getSessionDir } from '../../session/getSessionDir.js';
+import { readPresenceLease } from '../../skills/presence-lease-service.js';
+import { getCurrentSessionId } from '../../skills/skill-presence-service.js';
 const ACTIVE_SKILL_PREFIX = 'active-skill-';
 /**
  * Resolve the active peak skill for the current hook invocation.
  *
- * Reads PEAKS_ACTIVE_SKILL first (test override), then walks
- * `.peaks/_runtime/<sid>/` for any `active-skill-*.json` file. Returns
- * the first match.
+ * Reads PEAKS_ACTIVE_SKILL first (test override), then the canonical
+ * lease projection (RD §4 / §6 — the lease + index is the source of
+ * truth in 4.0.8), then — only when the caller explicitly opts in via
+ * `legacyPresence: true` — the legacy `.peaks/_runtime/<sid>/active-skill-*.json`
+ * walk. Returns the first match.
  */
-export function resolveActiveSkillForCaller(projectRoot) {
+export function resolveActiveSkillForCaller(projectRoot, opts) {
     const envOverride = process.env.PEAKS_ACTIVE_SKILL;
     if (typeof envOverride === 'string' && envOverride.length > 0) {
         return { skill: envOverride, callerId: null, sessionId: null, source: 'env' };
@@ -40,32 +55,79 @@ export function resolveActiveSkillForCaller(projectRoot) {
     if (sessionId === null) {
         return { skill: null, callerId: null, sessionId: null, source: 'none' };
     }
+    // 4.0.8 preferred: read the canonical lease projection. The lease
+    // service exposes `readPresenceLease({ projectRoot, sessionId,
+    // callerId, workflowId, graphRef })`; we need *some* callerId to
+    // point at a single lease. Hook enforcers don't have a callerId
+    // (they're per-IDE, per-window), so we walk the canonical
+    // presence-index to find any active lease. When the index is empty
+    // (e.g. ad-hoc / pre-migration projects) we fall through to the
+    // legacy walk below.
     const sessionDir = getSessionDir(projectRoot, sessionId);
     if (!existsSync(sessionDir)) {
-        return { skill: null, callerId: null, sessionId: sessionId, source: 'none' };
+        return { skill: null, callerId: null, sessionId, source: 'none' };
     }
-    let entries;
+    let entries = [];
     try {
         entries = readdirSync(sessionDir);
     }
     catch {
-        return { skill: null, callerId: null, sessionId: sessionId, source: 'none' };
+        entries = [];
     }
-    for (const entry of entries) {
-        if (!entry.startsWith(ACTIVE_SKILL_PREFIX) || !entry.endsWith('.json'))
+    const indexEntries = entries.filter((e) => !e.startsWith(ACTIVE_SKILL_PREFIX) && e.endsWith('.json') && !e.includes('.tmp-'));
+    for (const entry of indexEntries) {
+        // The canonical presence-index lives at `<sessionDir>/presence-index/<callerId>.json`.
+        // We synthesise the read from any presence-* lease file we find;
+        // the readPresenceLease call surfaces a typed `PresenceProjection`
+        // and we map `lease.skill` → resolution.
+        if (!entry.startsWith('presence-'))
+            continue;
+        const callerId = entry.slice('presence-'.length, -'.json'.length);
+        // Derive workflowId from the same file name (canonical
+        // leaseFilePath encodes `presence-<caller>-<workflow>.json`).
+        const lastDash = callerId.lastIndexOf('-');
+        if (lastDash < 0)
             continue;
-        const callerId = entry.slice(ACTIVE_SKILL_PREFIX.length, -'.json'.length);
-        const filePath = join(sessionDir, entry);
+        const workflowId = callerId.slice(lastDash + 1);
+        const pureCaller = callerId.slice(0, lastDash);
         try {
-            const raw = readFileSync(filePath, 'utf8');
-            const parsed = JSON.parse(raw);
-            if (typeof parsed.skill === 'string' && parsed.skill.length > 0) {
-                return { skill: parsed.skill, callerId, sessionId, source: 'file' };
+            const projection = readPresenceLease({
+                projectRoot,
+                sessionId,
+                callerId: pureCaller,
+                workflowId,
+                graphRef: `graphs/${workflowId}.json`,
+            });
+            if (projection.lease !== null && typeof projection.lease.skill === 'string' && projection.lease.skill.length > 0) {
+                return { skill: projection.lease.skill, callerId: pureCaller, sessionId, source: 'canonical' };
             }
         }
-        catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
-            // skip malformed file
+        catch { /* fall through to legacy walk */ }
+    }
+    // Legacy fall-back (one minor release). Gated on `legacyPresence:
+    // true` so production hooks prefer the canonical projection.
+    if (opts?.legacyPresence === true) {
+        for (const entry of entries) {
+            if (!entry.startsWith(ACTIVE_SKILL_PREFIX) || !entry.endsWith('.json'))
+                continue;
+            const callerId = entry.slice(ACTIVE_SKILL_PREFIX.length, -'.json'.length);
+            const filePath = join(sessionDir, entry);
+            try {
+                const raw = readFileSync(filePath, 'utf8');
+                const parsed = JSON.parse(raw);
+                if (typeof parsed.skill === 'string' && parsed.skill.length > 0) {
+                    return { skill: parsed.skill, callerId, sessionId, source: 'file' };
+                }
+            }
+            catch { // TODO(g2): legacy silent catch — grace: 1 minor release (v2.14.0)
+                // skip malformed file
+            }
         }
     }
+    // Suppress unused-import warnings for symbols reserved for the
+    // migration window. `getCurrentSessionId` is kept so the legacy
+    // walk can still resolve a session id if the canonical resolver
+    // returns null (e.g. ad-hoc projects without a `.peaks/_runtime/session.json`).
+    void getCurrentSessionId;
     return { skill: null, callerId: null, sessionId, source: 'none' };
 }

package/dist/services/audit/enforcers/lint-audit-regression.js

@@ -15,7 +15,6 @@
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { RED_LINE_CATALOG } from '../red-line-catalog.js';
-import { resolvePeaksLoopRoot } from '../backing-detector.js';
 export const CATALOG_STABILITY_GROWTH_CAP = 0.20;
 export const CATALOG_STABILITY_WINDOW_DAYS = 90;
 export const RUNTIME_BUDGET_MS = 2000;
@@ -42,19 +41,11 @@ export function lintCatalogStability(input) {
     return [syntheticHit('rl-audit-catalog-stability-001', 'catalog size has not grown > 20% in the last 90 days', `(growth ${(growth * 100).toFixed(1)}% over 90 days; currentSize=${input.currentSize}, priorSize=${input.sizeNinetyDaysAgo})`)];
 }
 export function lintNoOrphanEnforcer(projectRoot) {
-    // Slice 4.0.7-dogfood-PR-1: catalog enforcerRef paths are written
-    // relative to the peaks-loop source root (catalog + enforcers both
-    // live at <root>/src/services/audit/...). Resolving against the
-    // audited --project root produces false orphans on every downstream
-    // project. Use resolvePeaksLoopRoot() and keep `projectRoot` for
-    // test/legacy callers (the parameter is intentionally ignored here).
-    void projectRoot;
-    const peaksLoopRoot = resolvePeaksLoopRoot();
     const hits = [];
     for (const entry of RED_LINE_CATALOG) {
         if (!entry.enforcerRef)
             continue;
-        const absPath = join(peaksLoopRoot, entry.enforcerRef);
+        const absPath = join(projectRoot, entry.enforcerRef);
         if (!existsSync(absPath)) {
             hits.push(syntheticHit('rl-audit-no-orphan-enforcer-001', 'every enforcerRef points to a real file', `(enforcerRef "${entry.enforcerRef}" for ${entry.id} does not exist on disk)`));
         }

package/dist/services/capability-audit-service/cross-check.d.ts

@@ -0,0 +1,8 @@
+import type { CrossCheck } from './types.js';
+export declare function crossCheck(input: {
+    readonly guardPass: number;
+    readonly guardFail: number;
+    readonly independentPass: number;
+    readonly independentFail: number;
+    readonly karpathy: 'pass' | 'warn' | 'fail' | 'skipped';
+}): CrossCheck;

package/dist/services/capability-audit-service/cross-check.js

@@ -0,0 +1,11 @@
+export function crossCheck(input) {
+    const guardVerdict = input.guardFail === 0 ? 'pass' : 'fail';
+    const indepVerdict = input.independentFail === 0 ? 'pass' : 'fail';
+    const guardVsAudit = guardVerdict === indepVerdict ? 'agree'
+        : (Math.abs(input.guardPass - input.independentPass) <= 1) ? 'partial'
+            : 'diverge';
+    const karpathyVsAudit = input.karpathy === 'skipped' ? 'partial'
+        : (input.karpathy === 'warn' ? 'partial'
+            : (input.karpathy === 'pass' ? guardVsAudit : 'diverge'));
+    return { guardVsAudit, karpathyVsAudit };
+}

package/dist/services/capability-audit-service/index.d.ts

@@ -0,0 +1,3 @@
+export { crossCheck } from './cross-check.js';
+export { isStale } from './staleness.js';
+export type { AuditVerdict, AuditEvidenceKind, AuditDimension, CrossCheck, CapabilityAuditResult } from './types.js';

package/dist/services/capability-audit-service/index.js

@@ -0,0 +1,2 @@
+export { crossCheck } from './cross-check.js';
+export { isStale } from './staleness.js';

package/dist/services/capability-audit-service/runner.d.ts

@@ -0,0 +1,27 @@
+import type { CapabilityAuditResult } from './types.js';
+import type { JourneyId } from '../capability-baseline/types.js';
+import type { GuardRunResult } from '../capability-guard-runner/types.js';
+export interface RunAuditInput {
+    readonly projectRoot: string;
+    readonly sessionId: string;
+    readonly journeyId: JourneyId;
+    readonly llmRunner: {
+        call(system: string, user: string, opts: {
+            maxTokens: number;
+        }): Promise<{
+            output: string;
+            tokens: {
+                input: number;
+                output: number;
+            };
+        }>;
+    };
+    readonly guardSummary: {
+        readonly pass: number;
+        readonly fail: number;
+        readonly skipped: number;
+        readonly total: number;
+        readonly results: ReadonlyArray<GuardRunResult>;
+    };
+}
+export declare function runAudit(input: RunAuditInput): Promise<CapabilityAuditResult>;

package/dist/services/capability-audit-service/runner.js

@@ -0,0 +1,40 @@
+import { mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { crossCheck } from './cross-check.js';
+const SYSTEM = 'You are an INDEPENDENT audit scorer. Compare the supplied capability baseline to the supplied current behavior summary. Output a single JSON object: {"verdict":"consistent" | "drifted" | "inconclusive"}. No prose.';
+export async function runAudit(input) {
+    const userPayload = JSON.stringify({ baselineJourneyId: input.journeyId, guard: input.guardSummary });
+    const r = await input.llmRunner.call(SYSTEM, userPayload, { maxTokens: 200 });
+    const { verdict: independentVerdict } = JSON.parse(r.output);
+    const xc = crossCheck({
+        guardPass: input.guardSummary.pass,
+        guardFail: input.guardSummary.fail,
+        independentPass: independentVerdict === 'consistent' ? 1 : 0,
+        independentFail: independentVerdict === 'drifted' ? 1 : 0,
+        karpathy: 'skipped'
+    });
+    let verdict = independentVerdict;
+    if (xc.guardVsAudit === 'diverge')
+        verdict = 'inconclusive';
+    const dimensions = [{
+            journeyId: input.journeyId,
+            consistencyScore: verdict === 'consistent' ? 1 : verdict === 'drifted' ? 0 : 0.5,
+            evidence: [
+                { kind: 'guard-run', ref: `capability-guard-runner:${input.guardSummary.total}`, summary: `${input.guardSummary.pass} pass / ${input.guardSummary.fail} fail` },
+                { kind: 'independent-eval', ref: 'audit-llm-context', summary: `independent verdict: ${independentVerdict}` }
+            ]
+        }];
+    const auditId = `audit-${Date.now()}-${Math.random().toString(16).slice(2, 8)}`;
+    const out = {
+        auditId,
+        auditedAt: new Date().toISOString(),
+        verdict,
+        dimensions,
+        crossCheck: xc,
+        requiresUserDecision: verdict === 'inconclusive'
+    };
+    const dir = join(input.projectRoot, '.peaks', '_runtime', input.sessionId, 'capability-audit');
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, `${auditId}.json`), JSON.stringify(out, null, 2));
+    return out;
+}

package/dist/services/capability-audit-service/staleness.d.ts

@@ -0,0 +1 @@
+export declare function isStale(auditedAtIso: string, nowMs: number): boolean;

package/dist/services/capability-audit-service/staleness.js

@@ -0,0 +1,7 @@
+const STALENESS_MS = 24 * 60 * 60 * 1000;
+export function isStale(auditedAtIso, nowMs) {
+    const t = Date.parse(auditedAtIso);
+    if (Number.isNaN(t))
+        return true;
+    return nowMs - t > STALENESS_MS;
+}

package/dist/services/capability-audit-service/types.d.ts

@@ -0,0 +1,24 @@
+import type { JourneyId } from '../capability-baseline/types.js';
+export type AuditVerdict = 'consistent' | 'drifted' | 'inconclusive';
+export type AuditEvidenceKind = 'guard-run' | 'independent-eval' | 'karpathy-cross-check';
+export interface AuditDimension {
+    readonly journeyId: JourneyId;
+    readonly consistencyScore: number;
+    readonly evidence: ReadonlyArray<{
+        readonly kind: AuditEvidenceKind;
+        readonly ref: string;
+        readonly summary: string;
+    }>;
+}
+export interface CrossCheck {
+    readonly guardVsAudit: 'agree' | 'diverge' | 'partial';
+    readonly karpathyVsAudit: 'agree' | 'diverge' | 'partial';
+}
+export interface CapabilityAuditResult {
+    readonly auditId: string;
+    readonly auditedAt: string;
+    readonly verdict: AuditVerdict;
+    readonly dimensions: ReadonlyArray<AuditDimension>;
+    readonly crossCheck: CrossCheck;
+    readonly requiresUserDecision: boolean;
+}

package/dist/services/capability-audit-service/types.js

@@ -0,0 +1 @@
+export {};

package/dist/services/capability-baseline/store.d.ts

@@ -0,0 +1,33 @@
+import type { BaselineError, BaselineLock, CapabilityBaselineFile } from './types.js';
+export declare function computeBaselineHash(file: CapabilityBaselineFile): string;
+export declare function verifyLock(file: CapabilityBaselineFile, lock: BaselineLock): {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly error: BaselineError;
+};
+export declare function writeBaselineFile(input: {
+    readonly projectRoot: string;
+    readonly file: CapabilityBaselineFile;
+}): {
+    readonly path: string;
+    readonly lockPath: string;
+};
+export declare function readBaselineFile(projectRoot: string): {
+    readonly ok: true;
+    readonly file: CapabilityBaselineFile;
+    readonly lock: BaselineLock;
+    readonly path: string;
+    readonly lockPath: string;
+} | {
+    readonly ok: false;
+    readonly error: BaselineError;
+};
+export declare function historySnapshot(input: {
+    readonly projectRoot: string;
+    readonly version: string;
+}): {
+    readonly path: string;
+    readonly lockPath: string;
+};
+export declare function currentPointer(sessionId: string, path: string, projectRoot: string): void;

package/dist/services/capability-baseline/store.js

@@ -0,0 +1,80 @@
+// src/services/capability-baseline/store.ts
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+const CURRENT_DIR = (root) => join(root, 'openspec', 'baselines', 'current');
+const FILE_PATH = (root) => join(CURRENT_DIR(root), 'capability-baseline.json');
+const LOCK_PATH = (root) => join(CURRENT_DIR(root), 'capability-baseline.lock');
+const POINTER = (root, sessionId) => join(root, '.peaks', '_runtime', sessionId, 'baselines', 'current.json');
+function hashFor(file) {
+    const stripped = {
+        schemaVersion: file.schemaVersion,
+        version: file.version,
+        rows: file.rows
+    };
+    const json = JSON.stringify(stripped, Object.keys(stripped).sort());
+    return createHash('sha256').update(json).digest('hex');
+}
+export function computeBaselineHash(file) {
+    return hashFor(file);
+}
+export function verifyLock(file, lock) {
+    if (lock.signedBy !== 'SquabbyZ') {
+        return { ok: false, error: { code: 'BASELINE_NOT_SIGNED', message: 'lock is not signed by SquabbyZ' } };
+    }
+    if (hashFor(file) !== lock.baselineHash) {
+        return { ok: false, error: { code: 'BASELINE_HASH_MISMATCH', message: 'lock hash does not match file' } };
+    }
+    return { ok: true };
+}
+export function writeBaselineFile(input) {
+    const path = FILE_PATH(input.projectRoot);
+    const lockPath = LOCK_PATH(input.projectRoot);
+    mkdirSync(CURRENT_DIR(input.projectRoot), { recursive: true });
+    writeFileSync(path, JSON.stringify(input.file, null, 2));
+    const lock = {
+        baselineHash: hashFor(input.file),
+        signedBy: 'SquabbyZ',
+        signedAt: input.file.signedAt,
+        version: input.file.version
+    };
+    writeFileSync(lockPath, JSON.stringify(lock, null, 2));
+    return { path, lockPath };
+}
+export function readBaselineFile(projectRoot) {
+    const path = FILE_PATH(projectRoot);
+    const lockPath = LOCK_PATH(projectRoot);
+    if (!existsSync(path) || !existsSync(lockPath)) {
+        return { ok: false, error: { code: 'BASELINE_NOT_FOUND', message: `baseline missing at ${path}` } };
+    }
+    let file;
+    let lock;
+    try {
+        file = JSON.parse(readFileSync(path, 'utf8'));
+        lock = JSON.parse(readFileSync(lockPath, 'utf8'));
+    }
+    catch (e) {
+        return { ok: false, error: { code: 'BASELINE_NOT_FOUND', message: e.message } };
+    }
+    if (file.signedBy !== 'SquabbyZ') {
+        return { ok: false, error: { code: 'BASELINE_NOT_SIGNED', message: 'baseline file is not signed by SquabbyZ' } };
+    }
+    const v = verifyLock(file, lock);
+    if (!v.ok)
+        return v;
+    return { ok: true, file, lock, path, lockPath };
+}
+export function historySnapshot(input) {
+    const target = join(input.projectRoot, 'openspec', 'baselines', 'history', input.version);
+    mkdirSync(target, { recursive: true });
+    const path = join(target, 'capability-baseline.json');
+    const lockPath = join(target, 'capability-baseline.lock');
+    copyFileSync(FILE_PATH(input.projectRoot), path);
+    copyFileSync(LOCK_PATH(input.projectRoot), lockPath);
+    return { path, lockPath };
+}
+export function currentPointer(sessionId, path, projectRoot) {
+    const p = POINTER(projectRoot, sessionId);
+    mkdirSync(dirname(p), { recursive: true });
+    writeFileSync(p, JSON.stringify({ pointsTo: path, at: new Date().toISOString() }, null, 2));
+}

package/dist/services/capability-baseline/types.d.ts

@@ -0,0 +1,45 @@
+export type JourneyId = 'J01' | 'J02' | 'J03' | 'J04' | 'J05' | 'J06' | 'J07' | 'J08' | 'J09' | 'J10' | 'J11' | 'J12' | 'J13' | 'J14' | 'J15';
+export declare const P0_JOURNEY_IDS: ReadonlyArray<JourneyId>;
+export interface InputCase {
+    readonly name: string;
+    readonly shape: string;
+}
+export interface OutputCase {
+    readonly name: string;
+    readonly shape: string;
+}
+export interface ErrorCase {
+    readonly name: string;
+    readonly code: string;
+}
+export interface CapabilityBaselineRow {
+    readonly journeyId: JourneyId;
+    readonly intent: string;
+    readonly observable: {
+        readonly inputs: ReadonlyArray<InputCase>;
+        readonly outputs: ReadonlyArray<OutputCase>;
+        readonly errors: ReadonlyArray<ErrorCase>;
+    };
+    readonly invariants: ReadonlyArray<string>;
+    readonly forbiddenChanges: ReadonlyArray<string>;
+    readonly sourceFiles: ReadonlyArray<string>;
+}
+export interface CapabilityBaselineFile {
+    readonly schemaVersion: '2026-08-03';
+    readonly version: string;
+    readonly signedBy: 'SquabbyZ';
+    readonly signedAt: string;
+    readonly rows: ReadonlyArray<CapabilityBaselineRow>;
+}
+export interface BaselineLock {
+    readonly baselineHash: string;
+    readonly signedBy: 'SquabbyZ';
+    readonly signedAt: string;
+    readonly version: string;
+}
+export type BaselineErrorCode = 'BASELINE_NOT_FOUND' | 'BASELINE_HASH_MISMATCH' | 'BASELINE_NOT_SIGNED' | 'BASELINE_INCOMPLETE' | 'BASELINE_HISTORY_GAP' | 'BASELINE_ROW_SHAPE_INVALID' | 'BASELINE_FORBIDDEN_ALIAS';
+export interface BaselineError {
+    readonly code: BaselineErrorCode;
+    readonly message: string;
+    readonly detail?: string;
+}

package/dist/services/capability-baseline/types.js

@@ -0,0 +1,5 @@
+export const P0_JOURNEY_IDS = [
+    'J01', 'J02', 'J03', 'J04', 'J05',
+    'J06', 'J07', 'J08', 'J09', 'J10',
+    'J11', 'J12', 'J13', 'J14', 'J15'
+];

package/dist/services/capability-baseline/validator.d.ts

@@ -0,0 +1,19 @@
+import { type BaselineError, type CapabilityBaselineFile, type CapabilityBaselineRow } from './types.js';
+export declare function validateRowShape(row: CapabilityBaselineRow): {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly error: BaselineError;
+};
+export declare function validateBaselineFile(file: CapabilityBaselineFile): {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly error: BaselineError;
+};
+export declare function assertSignedBySquabbyZ(file: CapabilityBaselineFile): {
+    readonly ok: true;
+} | {
+    readonly ok: false;
+    readonly error: BaselineError;
+};

package/dist/services/capability-baseline/validator.js

@@ -0,0 +1,38 @@
+// src/services/capability-baseline/validator.ts
+import { P0_JOURNEY_IDS } from './types.js';
+export function validateRowShape(row) {
+    if (row.intent.trim().length === 0)
+        return { ok: false, error: { code: 'BASELINE_ROW_SHAPE_INVALID', message: `row ${row.journeyId} has empty intent` } };
+    if (row.invariants.length === 0)
+        return { ok: false, error: { code: 'BASELINE_ROW_SHAPE_INVALID', message: `row ${row.journeyId} has no invariants` } };
+    if (row.forbiddenChanges.length === 0)
+        return { ok: false, error: { code: 'BASELINE_ROW_SHAPE_INVALID', message: `row ${row.journeyId} has no forbiddenChanges` } };
+    if (row.sourceFiles.length === 0)
+        return { ok: false, error: { code: 'BASELINE_ROW_SHAPE_INVALID', message: `row ${row.journeyId} has no sourceFiles` } };
+    return { ok: true };
+}
+export function validateBaselineFile(file) {
+    if (file.schemaVersion !== '2026-08-03') {
+        return { ok: false, error: { code: 'BASELINE_ROW_SHAPE_INVALID', message: `unsupported schemaVersion ${file.schemaVersion}` } };
+    }
+    const signed = assertSignedBySquabbyZ(file);
+    if (!signed.ok)
+        return signed;
+    for (const r of file.rows) {
+        const v = validateRowShape(r);
+        if (!v.ok)
+            return v;
+    }
+    const present = new Set(file.rows.map((r) => r.journeyId));
+    const missing = P0_JOURNEY_IDS.filter((j) => !present.has(j));
+    if (missing.length > 0) {
+        return { ok: false, error: { code: 'BASELINE_INCOMPLETE', message: `missing journeys: ${missing.join(',')}` } };
+    }
+    return { ok: true };
+}
+export function assertSignedBySquabbyZ(file) {
+    if (file.signedBy !== 'SquabbyZ') {
+        return { ok: false, error: { code: 'BASELINE_NOT_SIGNED', message: 'baseline not signed by SquabbyZ' } };
+    }
+    return { ok: true };
+}

package/dist/services/capability-guard-runner/contracts/J01.d.ts

@@ -0,0 +1,2 @@
+import type { GuardContext, GuardRunResult } from '../types.js';
+export declare function runJ01Contract(ctx: GuardContext): Promise<GuardRunResult>;

package/dist/services/capability-guard-runner/contracts/J01.js

@@ -0,0 +1,48 @@
+import { execFileSync } from 'node:child_process';
+import { join } from 'node:path';
+const FIXTURES = [
+    ['make', 'implement a CLI parser'],
+    ['make', 'refactor the service'],
+    ['make', 'write a blog article'],
+    ['learn', 'author an SOP checklist'],
+    ['check', 'run red-lines audit'],
+    ['run', 'execute a workflow']
+];
+export async function runJ01Contract(ctx) {
+    const bin = process.env.PEAKS_BIN_OVERRIDE ?? join(ctx.projectRoot, 'bin', 'peaks.js');
+    let allOk = true;
+    let firstFailure = '';
+    for (const [command, input] of FIXTURES) {
+        try {
+            const stdout = execFileSync('node', [bin, command, input], {
+                cwd: ctx.projectRoot,
+                env: { ...process.env, PEAKS_CALLER_ID: `guard-J01-${ctx.sessionId}` }
+            }).toString('utf8');
+            const env = JSON.parse(stdout);
+            if (!env.ok) {
+                allOk = false;
+                firstFailure = `${command} ${input}`;
+                break;
+            }
+        }
+        catch (e) {
+            allOk = false;
+            firstFailure = `${command} ${input}: ${e.message}`;
+            break;
+        }
+    }
+    return allOk
+        ? {
+            journeyId: 'J01',
+            contract: 'envelope-arg-shapes',
+            status: 'pass',
+            artifactPath: 'tests/integration/super-command-routing.test.ts'
+        }
+        : {
+            journeyId: 'J01',
+            contract: 'envelope-arg-shapes',
+            status: 'fail',
+            diff: { before: 'all 6 routing cases ok', after: firstFailure, reason: 'J01#1 broken: super-command routing NL path deviates from frozen baseline' },
+            artifactPath: 'tests/integration/super-command-routing.test.ts'
+        };
+}