peaks-loop 4.1.0 → 4.1.2

package/dist/services/standards/standards-render.d.ts

@@ -1,6 +1,5 @@
 /**
  * Pure render / template functions extracted from
- * `project-standards-service.ts` (slice 2026-09-06-split-batch-b) so the
  * service stays under the 800-line cap. Behaviour-preserving verbatim move;
  * `export` keywords were added to the symbols the service still imports.
  */

package/dist/services/standards/standards-render.js

@@ -1,6 +1,5 @@
 /**
  * Pure render / template functions extracted from
- * `project-standards-service.ts` (slice 2026-09-06-split-batch-b) so the
  * service stays under the 800-line cap. Behaviour-preserving verbatim move;
  * `export` keywords were added to the symbols the service still imports.
  */

package/dist/services/standards/ui-library-dispatch-block.d.ts

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-09-06-ui-lib-dispatch-priority: render a `## Project stack`
  * markdown block for the RD/UI sub-agent dispatch system prompt, and the
  * dispatch-site convenience wrapper that computes it from a project root.
  *

package/dist/services/standards/ui-library-dispatch-block.js

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-09-06-ui-lib-dispatch-priority: render a `## Project stack`
  * markdown block for the RD/UI sub-agent dispatch system prompt, and the
  * dispatch-site convenience wrapper that computes it from a project root.
  *

package/dist/services/tech/tech-change-id-service.d.ts

@@ -1,5 +1,4 @@
 /**
- * tech-change-id-service — change-id-axis slice of the tech planner (rid-012).
  *
  * Purpose:
  *   The original `peaks tech plan` / `peaks tech status` (in `tech-service.ts`)
@@ -7,7 +6,6 @@
  *   v2.19.0). This module provides the *consumer-side wiring* that lets the
  *   same CLI surface be re-keyed by an explicit `--change-id <id>` for the
  *   OpenSpec / change-driven workflow. The path math, change-id validation,
- *   and workspace-unavailable response are all delegated to the rid-009
  *   helpers in `src/services/openspec/artifact-boundary.ts`.
  *
  * Style:
@@ -17,9 +15,7 @@
  *
  * Hard ban:
  *   - This file MUST NOT import from `peaks-loop-shared` (stays inside
- *     peaks-loop per §9 of the rid-012 plan).
  *   - This file MUST NOT touch `src/services/openspec/artifact-boundary.ts`
- *     (rid-009 helpers are frozen; we only consume via import).
  */
 import type { WorkspaceConfig } from '../config/config-types.js';
 import { type BoundaryError, type ChangeIdError, type PlanArtifactPathOutput, type WorkspaceUnavailableResponse, type Result } from '../openspec/artifact-boundary.js';
@@ -43,7 +39,6 @@ export type TechChangeStatus = {
 };
 /**
  * Validate a change-id string. This is a thin consumer-side wrapper that
- * delegates to `validateChangeId` (rid-009). The wrapper exists so the
  * change-id-axis service has a single named export point (`validateTechChangeId`)
  * and so the test file can import it without reaching across to openspec.
  */
@@ -58,7 +53,6 @@ export declare function validateTechChangeId(id: string): Result<{
  *   - `reviewChecklist`     → `<id>/architecture/tech-review-checklist.md`
  *   - `approvalTemplate`    → `<id>/architecture/tech-approval-record.template.md`
  *
- * Delegates to `planArtifactPath` (rid-009) for each one. Returns the FIRST
  * failure (so callers get a single, deterministic BoundaryError).
  *
  * Pure path math — does not touch the filesystem.
@@ -70,7 +64,6 @@ export declare function planTechArtifactPath(input: {
 }): Result<TechChangeArtifacts, BoundaryError>;
 /**
  * Build the workspace-unavailable response for the change-id-axis tech
- * planner. Thin wrapper around `buildWorkspaceUnavailable` (rid-009) so
  * the same single source of truth (nextActions constant) is reused.
  *
  * The `mode` discriminator matches the existing artifact-boundary shape

package/dist/services/tech/tech-change-id-service.js

@@ -1,5 +1,4 @@
 /**
- * tech-change-id-service — change-id-axis slice of the tech planner (rid-012).
  *
  * Purpose:
  *   The original `peaks tech plan` / `peaks tech status` (in `tech-service.ts`)
@@ -7,7 +6,6 @@
  *   v2.19.0). This module provides the *consumer-side wiring* that lets the
  *   same CLI surface be re-keyed by an explicit `--change-id <id>` for the
  *   OpenSpec / change-driven workflow. The path math, change-id validation,
- *   and workspace-unavailable response are all delegated to the rid-009
  *   helpers in `src/services/openspec/artifact-boundary.ts`.
  *
  * Style:
@@ -17,9 +15,7 @@
  *
  * Hard ban:
  *   - This file MUST NOT import from `peaks-loop-shared` (stays inside
- *     peaks-loop per §9 of the rid-012 plan).
  *   - This file MUST NOT touch `src/services/openspec/artifact-boundary.ts`
- *     (rid-009 helpers are frozen; we only consume via import).
  */
 import { buildWorkspaceUnavailable, planArtifactPath, validateChangeId } from '../openspec/artifact-boundary.js';
 /**
@@ -32,7 +28,6 @@ const TECH_CHANGE_ID_WAVES = ['scan', 'document', 'review', 'reducer'];
 const TECH_ARCHITECTURE_ROOT = '<changeId>/architecture';
 /**
  * Validate a change-id string. This is a thin consumer-side wrapper that
- * delegates to `validateChangeId` (rid-009). The wrapper exists so the
  * change-id-axis service has a single named export point (`validateTechChangeId`)
  * and so the test file can import it without reaching across to openspec.
  */
@@ -47,7 +42,6 @@ export function validateTechChangeId(id) {
  *   - `reviewChecklist`     → `<id>/architecture/tech-review-checklist.md`
  *   - `approvalTemplate`    → `<id>/architecture/tech-approval-record.template.md`
  *
- * Delegates to `planArtifactPath` (rid-009) for each one. Returns the FIRST
  * failure (so callers get a single, deterministic BoundaryError).
  *
  * Pure path math — does not touch the filesystem.
@@ -106,7 +100,6 @@ export function planTechArtifactPath(input) {
 }
 /**
  * Build the workspace-unavailable response for the change-id-axis tech
- * planner. Thin wrapper around `buildWorkspaceUnavailable` (rid-009) so
  * the same single source of truth (nextActions constant) is reused.
  *
  * The `mode` discriminator matches the existing artifact-boundary shape

package/dist/services/tech/tech-service.js

@@ -62,7 +62,6 @@ function assertNonEmptyGoal(goal) {
     }
 }
 function architectureRoot(_sessionId) {
-    // Slice 2026-06-29-change-id-root-removal: descriptor is now the bare
     // role-relative sub-path `<role>/architecture` (no `.peaks/_runtime/...`
     // prefix). The on-disk location is resolved by `architectureRootAbs`
     // via `getSessionDir`. Callers that previously split this string on
@@ -71,7 +70,6 @@ function architectureRoot(_sessionId) {
     return 'rd/architecture';
 }
 function architectureRootAbs(artifactWorkspacePath, sessionId) {
-    // Slice 2026-06-29-change-id-root-removal: on-disk path now resolves
     // via the session-axis `getSessionDir(root, sessionId)` (the change-id
     // identifier is reused as the session-dir name for tech-artifact
     // reads, matching the test helper `writeApprovedTechArtifacts` and
@@ -164,7 +162,6 @@ function isValidArtifactFile(rootPath, artifact) {
     }
 }
 function waveManifestPath(_sessionId, index, wave) {
-    // Slice 2026-06-29-change-id-root-removal: descriptor is now
     // `rd/architecture/waves/<file>`. The scope root is supplied by the
     // caller via `getSessionDir`.
     return `rd/architecture/waves/wave-${index + 1}-${wave}.json`;
@@ -173,7 +170,6 @@ function taskPurpose(taskId, goal) {
     return `${taskId.replace(/^tech-/, '').replace(/-/g, ' ')} for ${goal}`;
 }
 function createTechGraph(request) {
-    // Slice 2026-06-29-change-id-root-removal: change-id is metadata-only;
     // no structural validation gate fires here.
     assertNonEmptyGoal(request.goal);
     const [scanWave, documentWave, reviewWave] = TECH_WAVE_TASKS;
@@ -238,7 +234,6 @@ export function createTechPlan(request) {
     };
 }
 export function getTechStatus(options) {
-    // Slice 2026-06-29-change-id-root-removal: change-id is metadata-only;
     // no structural validation gate fires here.
     const artifactRoot = architectureRoot(options.sessionId);
     if (!options.artifactWorkspacePath) {

package/dist/services/verdict/envelope-parsers.d.ts

@@ -41,9 +41,7 @@ export type AnyEnvelope = {
     envelope: QaEnvelope;
 };
 /**
- * v2.13.3 AC-1 — parse real v2.12.0 audit markdown.
  *
- * Strategy (per PRD AC-1 mitigation):
  *   1. Try JSON.parse first (back-compat with prior unit tests + any
  *      consumer that passes a JSON string explicitly).
  *   2. Fall back to markdown parse: extract `verdict:` from YAML

package/dist/services/verdict/envelope-parsers.js

@@ -20,9 +20,7 @@ import { isPerfAuditEnvelope, isSecurityAuditEnvelope } from '../audit-independe
 import { matchEnum, parseAuditMarkdown, parseFindingBullet, parseKarpathyViolations } from './envelopes.js';
 // ─── 5 parsers (pure, never throw) ─────────────────────────────────────
 /**
- * v2.13.3 AC-1 — parse real v2.12.0 audit markdown.
  *
- * Strategy (per PRD AC-1 mitigation):
  *   1. Try JSON.parse first (back-compat with prior unit tests + any
  *      consumer that passes a JSON string explicitly).
  *   2. Fall back to markdown parse: extract `verdict:` from YAML

package/dist/services/verdict/envelopes.d.ts

@@ -1,5 +1,4 @@
 /**
- * peaks-loop v2.13.3 — Envelope unification (AC-1: real markdown parse).
  *
  * The 5 input envelopes feeding `aggregateVerdict()` have always been
  * heterogeneous (peaks-security-audit / peaks-perf-audit / karpathy /

package/dist/services/vm/vm-lease.js

@@ -1,7 +1,6 @@
 /**
  * vm-lease — pure-function lease store for `peaks vm spawn`.
  *
- * Slice 2026-07-29-worktree-l2-extended Part 35 (L4 VM runtime).
  * Parallels the design of `worktree-lease.ts` (Part 1) and
  * `container-lease.ts` (Part 12). The L4 VM isolation mode
  * (`--isolation vm` in dispatch) needs its own lease surface

package/dist/services/web/aria-node.d.ts

@@ -1,5 +1,4 @@
 /**
- * The `ariaSnapshotJSON()` node type (slice S1, AC2 — the mechanism).
  *
  * Split out of `snapshot-pruner.ts` to keep the pruner under the
  * 300-raw-line file cap; it is the data model the pruner, the renderer and

package/dist/services/web/bounded-output.d.ts

@@ -1,5 +1,4 @@
 /**
- * Byte-aware output caps for `peaks web` (slice S1, AC2).
  *
  * `capText` is the only absolute guarantee in the snapshot pipeline: the
  * pruner (`snapshot-pruner.ts`) bounds node count and depth, but only a byte

package/dist/services/web/bounded-output.js

@@ -1,5 +1,4 @@
 /**
- * Byte-aware output caps for `peaks web` (slice S1, AC2).
  *
  * `capText` is the only absolute guarantee in the snapshot pipeline: the
  * pruner (`snapshot-pruner.ts`) bounds node count and depth, but only a byte

package/dist/services/web/browser-acquire.js

@@ -1,5 +1,4 @@
 /**
- * Acquire the chromium browser (slice S1, file 10; S3 adds the ordered gate).
  *
  * The order is load-bearing and is the whole of AC5's first half (tech-doc §5.1):
  *

package/dist/services/web/browser-cache-probe.js

@@ -1,7 +1,6 @@
 /**
  * `src/services/web/browser-cache-probe.ts`
  *
- * The browser-cache probe (slice S3, file 18; R6, tech-doc §5.3): it asks the
  * resolved Playwright package where its executable WOULD be and checks the
  * filesystem — no download, no spawn, so `peaks web status` can report cache
  * state on a machine with nothing installed. Moved verbatim (wave 3, file-size

package/dist/services/web/browser-session-manager.js

@@ -1,5 +1,4 @@
 /**
- * All Playwright operations for `peaks web` (slice S1, file 11).
  *
  * One browser process per session; one browser CONTEXT per dispatch (Q8). The
  * context is what isolates cookies/localStorage between dispatches, which is

package/dist/services/web/daemon-entry.js

@@ -1,5 +1,4 @@
 /**
- * The `peaks web` daemon process entry (slice S2, file 15).
  *
  * This file IS the process: it is what `spawnDaemon` launches, so it must run
  * under plain `node` (built tree) as well as under `tsx` (source tree). It is

package/dist/services/web/daemon-registry.js

@@ -1,5 +1,4 @@
 /**
- * File + lock IO for the `peaks web` daemon (slice S1, file 7).
  *
  * Isolated from the HTTP client so each is testable alone (tech-doc §2). Every
  * WRITE goes through `assertUnder` first — the slice-wide guard against an

package/dist/services/web/daemon-supervisor.d.ts

@@ -50,9 +50,10 @@ export declare function interpreterArgs(entry: string): string[];
  * It arrived in 20.6.0 (backported to 18.19.0); below that the spelling is
  * `--loader`, and passing `--import` is a bad option that kills the daemon at
  * startup — inside a `READY_TIMEOUT_MS = 20 s` wait whose only diagnosis is a
- * line in `daemon.log`. `package.json` declares `engines.node >= 20.0.0`, which
- * includes 20.0–20.5, so the flag cannot be unconditional. `tsx` gates its own
- * child the same way and this mirrors it.
+ * line in `daemon.log`. `engines.node` names a higher floor, but this function answers for
+ * whatever interpreter the daemon is actually started with — a machine with several Nodes
+ * can hand `--import` to an older one — so the flag cannot be unconditional. `tsx` gates
+ * its own child the same way and this mirrors it.
  */
 export declare function supportsImportFlag(nodeVersion?: string): boolean;
 /**

package/dist/services/web/daemon-supervisor.js

@@ -1,5 +1,4 @@
 /**
- * CLI-side daemon lifecycle: reuse, cold start, stop (slice S1, file 8).
  *
  * The CLI process is short-lived; the daemon is not. `ensureDaemon` is the
  * whole cold-start/warm path from tech-doc §1.4. The lock exists because Q10
@@ -118,9 +117,10 @@ export function interpreterArgs(entry) {
  * It arrived in 20.6.0 (backported to 18.19.0); below that the spelling is
  * `--loader`, and passing `--import` is a bad option that kills the daemon at
  * startup — inside a `READY_TIMEOUT_MS = 20 s` wait whose only diagnosis is a
- * line in `daemon.log`. `package.json` declares `engines.node >= 20.0.0`, which
- * includes 20.0–20.5, so the flag cannot be unconditional. `tsx` gates its own
- * child the same way and this mirrors it.
+ * line in `daemon.log`. `engines.node` names a higher floor, but this function answers for
+ * whatever interpreter the daemon is actually started with — a machine with several Nodes
+ * can hand `--import` to an older one — so the flag cannot be unconditional. `tsx` gates
+ * its own child the same way and this mirrors it.
  */
 export function supportsImportFlag(nodeVersion = process.versions.node) {
     const [major = 0, minor = 0] = nodeVersion.split('.').map(Number);

package/dist/services/web/playwright-loader.js

@@ -1,5 +1,4 @@
 /**
- * Playwright resolution shim (slice S1, file 9; S3 hardened the scan).
  *
  * `playwright` is deliberately NOT a dependency (PRD non-goal): it is fetched
  * by `npx --package playwright@<pin>`. That has one sharp edge, verified on

package/dist/services/web/playwright-types.d.ts

@@ -1,6 +1,5 @@
 /**
  * The structural slice of the Playwright API this feature actually calls
- * (slice S1, file 9).
  *
  * Split out of `playwright-loader.ts` to keep the loader under the
  * 300-raw-line file cap — types only, no resolution or admission behaviour

package/dist/services/web/snapshot-pruner.js

@@ -1,5 +1,4 @@
 /**
- * ARIA snapshot pruner (slice S1, AC2 — the mechanism).
  *
  * Pure and browser-free by design (tech-doc §4.2): it operates on the object
  * tree `locator.ariaSnapshotJSON()` returns, so it is fully unit-testable with

package/dist/services/web/untrusted-envelope.d.ts

@@ -1,5 +1,4 @@
 /**
- * UNTRUSTED page-content envelope (slice S1, AC4 / R4).
  *
  * This MITIGATES prompt injection from page content; it does not solve it. No
  * string in this module (or in any help text, comment, or warning built on it)

package/dist/services/web/web-artifact-paths.js

@@ -1,5 +1,4 @@
 /**
- * Canonical path resolvers for the `peaks web` artifact tree (slice S1, AC1).
  *
  * What is actually guaranteed here, and what is not:
  *

package/dist/services/web/web-client.d.ts

@@ -1,5 +1,4 @@
 /**
- * Loopback HTTP client for the `peaks web` daemon (slice S1, file 6).
  *
  * The CLI layer never speaks HTTP itself: this class is the only thing it
  * knows how to talk to, so every transport concern (bearer token, timeouts,

package/dist/services/web/web-daemon-service.js

@@ -1,6 +1,5 @@
 /**
  * The `peaks web` daemon: loopback HTTP server, op routing, shutdown
- * (slice S2, file 16).
  *
  * One daemon per `(projectRoot, sessionId)` (design §10.2). It binds
  * `127.0.0.1:0` — an OS-assigned port, loopback only — and writes

package/dist/services/web/web-fallback.d.ts

@@ -1,5 +1,4 @@
 /**
- * The degradation chain, in one place (slice S3, file 19; AC5, tech-doc §5.4).
  *
  * Design §6 orders the chain: 1 local browser → 2 lazy download → 3 MCP
  * fallback → 4 explicit error + install guidance. Orchestrator decision C3 is

package/dist/services/web/web-fallback.js

@@ -1,5 +1,4 @@
 /**
- * The degradation chain, in one place (slice S3, file 19; AC5, tech-doc §5.4).
  *
  * Design §6 orders the chain: 1 local browser → 2 lazy download → 3 MCP
  * fallback → 4 explicit error + install guidance. Orchestrator decision C3 is

package/dist/services/web/web-install-service.js

@@ -1,6 +1,5 @@
 /**
  * Browser acquisition: the disable gate, the cache probe and the one-time
- * chromium install (slice S3, file 18; AC5, R2, R6).
  *
  * Three properties this module owns, all of them testable without a browser:
  *

package/dist/services/web/web-login-profile.js

@@ -1,6 +1,5 @@
 /**
  * The persistent login profile — its name guard, and the headed login that
- * produces it (slice S4, file 20; design §2/§5/§10.2, orchestrator decision C1).
  *
  * Two halves, one responsibility ("a profile the user explicitly asked to keep"):
  *

package/dist/services/web/web-protocol.d.ts

@@ -1,6 +1,5 @@
 /**
  * The `peaks web` daemon contract — on-disk (`daemon.json`) and on-the-wire
- * (`POST /op`) in one place (slice S1, files 5/6).
  *
  * `parseDaemonInfo` validates both shape and `PROTOCOL_VERSION`, so a daemon
  * left over from an older protocol is rejected (and therefore killed and

package/dist/services/web/web-protocol.js

@@ -1,6 +1,5 @@
 /**
  * The `peaks web` daemon contract — on-disk (`daemon.json`) and on-the-wire
- * (`POST /op`) in one place (slice S1, files 5/6).
  *
  * `parseDaemonInfo` validates both shape and `PROTOCOL_VERSION`, so a daemon
  * left over from an older protocol is rejected (and therefore killed and

package/dist/services/web/web-status-report.js

@@ -1,6 +1,5 @@
 /**
  * `peaks web status` — which daemon instances exist for this session, and which
- * of them are still real (slice S2, file 17).
  *
  * The three states are the three states of the loopback protocol (tech-doc
  * §1.3): `live` (pid alive AND `/health` answers), `orphaned` (pid alive,

package/dist/services/workflow/artifact-paths.js

@@ -1,5 +1,4 @@
 /**
- * Cross-slice artifact path resolvers (slice 025 — Security + Perf
  * Plan/Result split).
  *
  * The plan/result split introduces per-request `<rid>`-suffixed QA
@@ -36,7 +35,6 @@ const PERFORMANCE_FINDINGS_BASE = 'performance-findings';
  * fallback for un-migrated workspaces. The legacy misplaced
  * `.peaks/<sessionId>/qa/` form was a pre-1.3.0 write-path bug.
  *
- * Slice 2026-06-29-change-id-root-removal: the legacy
  * `peaks workspace migrate-change-scope` migration tool is gone;
  * operators must move misplaced dirs into the canonical location
  * by hand (or via `peaks workspace migrate`).
@@ -146,7 +144,6 @@ export function resolvePerformanceFindingsPath(args) {
  * log a warning when the legacy form is the one consumed.
  */
 export function lazyMigrateLegacyFindings(args) {
-    // Slice 2026-06-28: lazy migration operates on the canonical QA dir.
     const qaDir = canonicalQaDir(args.projectRoot, args.sessionId);
     const legacyPath = join(qaDir, args.legacyFile);
     const suffixedPath = join(qaDir, args.suffixedFile(args.rid));

package/dist/services/workflow/autonomous-resume-writer.js

@@ -108,7 +108,6 @@ Next actions:
 `;
 }
 function buildFiles(sessionId, goal, createdAt, artifactWorkspacePath) {
-    // Slice 2026-06-29-change-id-root-removal: route every reviewable
     // artifact under the session-axis dir at `.peaks/_runtime/<sid>/...`
     // via `getSessionDir`. The change-id identifier is reused as the
     // session-dir name (per-execution scope). The gitignore rule on
@@ -143,7 +142,6 @@ function buildFiles(sessionId, goal, createdAt, artifactWorkspacePath) {
     ];
 }
 export async function writeAutonomousResumeArtifacts(request) {
-    // Slice 2026-06-29-change-id-root-removal: change-id is metadata-only;
     // structural validation for the session id is a path-safety check
     // (no path-traversal / no absolute path) so unsafe ids never escape
     // the canonical `.peaks/_runtime/<sid>/` scope.

package/dist/services/workflow/pipeline-verify-gate-support.d.ts

@@ -4,16 +4,13 @@
  * Private helpers used by the slimmed `pipeline-verify-service.ts`
  * orchestrator. NOT publicly re-exported; not part of the public API
  * surface. Kept in a sibling file so the orchestrator can stay under
- * the 400-line file-size cap (rid-006 split).
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 import { type ArtifactPrerequisite, type RequestType } from '../artifacts/artifact-prerequisites.js';
 import type { RequestArtifactRole, RequestArtifactState } from '../artifacts/request-artifact-service.js';
 import type { PipelineGate } from './pipeline-verify-types.js';
 export declare function extractState(markdown: string): string;
 /**
- * As of slice 2026-06-05-change-id-as-unit-of-work, the file's durable
  * scope is the change-id (the `.peaks/_runtime/<sessionId>/` dir the file lives
  * in), NOT the session-id. We resolve the on-disk location via
  * `showRequestArtifact` (which scans all top-level dirs and returns the
@@ -46,7 +43,6 @@ export declare function findRequestFile(projectRoot: string, role: string, rid:
  * to a `legacyRelativePath` fallback of `audit/security.md`, and it kept
  * demanding `qa/security-findings-<rid>.md` / `qa/performance-findings-<rid>.md`
  * after the v2.11.0 D1/D4 trim dropped them from `qa:verdict-issued`
- * altogether (rid 2026-09-14-verify-pipeline-contract-drift).
  */
 /**
  * The prerequisite the contract carries for `probeName`, or null when it
@@ -61,7 +57,6 @@ export declare function rdGatesForType(requestType: RequestType): PipelineGate[]
 export declare function qaGatesForType(requestType: RequestType): PipelineGate[];
 export declare const RD_QA_HANDOFF_STATES: Set<string>;
 export declare const QA_COMPLETE_STATES: Set<string>;
-/** Tracker for canonical-path compliance (slice 2026-06-28-code-mode-bypass-fix). */
 export interface CanonicalPathTracker {
     anyEvidenceResolved: boolean;
     allResolvedPathsCanonical: boolean;

package/dist/services/workflow/pipeline-verify-gate-support.js

@@ -4,9 +4,7 @@
  * Private helpers used by the slimmed `pipeline-verify-service.ts`
  * orchestrator. NOT publicly re-exported; not part of the public API
  * surface. Kept in a sibling file so the orchestrator can stay under
- * the 400-line file-size cap (rid-006 split).
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -17,7 +15,6 @@ export function extractState(markdown) {
     return readArtifactState(markdown) ?? 'unknown';
 }
 /**
- * As of slice 2026-06-05-change-id-as-unit-of-work, the file's durable
  * scope is the change-id (the `.peaks/_runtime/<sessionId>/` dir the file lives
  * in), NOT the session-id. We resolve the on-disk location via
  * `showRequestArtifact` (which scans all top-level dirs and returns the
@@ -32,7 +29,6 @@ export async function findRequestFile(projectRoot, role, rid) {
     });
     if (artifact === null)
         return null;
-    // Slice 2026-06-28-code-mode-bypass-fix (defect #3) used to strip a
     // `_runtime/` prefix here, because `showRequestArtifact` then returned the
     // FULL SCOPE (`_runtime/<sid>`) as `sessionId`. Repair R5 removed that
     // round-trip at its source: `readSummary` now builds the summary from the
@@ -64,7 +60,6 @@ export async function findRequestFile(projectRoot, role, rid) {
  * to a `legacyRelativePath` fallback of `audit/security.md`, and it kept
  * demanding `qa/security-findings-<rid>.md` / `qa/performance-findings-<rid>.md`
  * after the v2.11.0 D1/D4 trim dropped them from `qa:verdict-issued`
- * altogether (rid 2026-09-14-verify-pipeline-contract-drift).
  */
 /**
  * The prerequisite the contract carries for `probeName`, or null when it
@@ -124,7 +119,6 @@ export function rdGatesForType(requestType) {
         }
     ];
     // This slot used to pin a `tech-doc` gate to `rd/tech-doc.md`, an artifact
-    // v2.11.0 Group A retired and the table no longer carries — so the gate
     // failed trees `peaks request transition` accepts (QA repair cycle 1). The
     // design / scope record the contract DOES name at `rd:qa-handoff` is
     // `prd/handoff.md`, so that is the gate: table-derived, like the others.
@@ -168,8 +162,6 @@ export function rdGatesForType(requestType) {
     }
     // The perf evidence the contract requires at `rd:qa-handoff` is `AUDIT_PERF`
     // — `audit/perf-<rid>.md`, with `audit/perf.md` and `rd/perf-baseline.md` as
-    // its two declared legacy tiers (rid-scoped since slice
-    // `2026-09-14-audit-artifact-rid-scoping`). This gate used to live on the QA
     // side as `performance-findings`, checking `qa/performance-findings-<rid>.md`
     // — a path the v2.11.0 D1/D4 trim dropped. Relocating the gate (rather than
     // deleting it) is what keeps AC3's control meaningful: perf evidence that is
@@ -203,13 +195,10 @@ export function qaGatesForType(requestType) {
         });
     }
     // The `security-findings` / `performance-findings` gates were removed here
-    // (rid 2026-09-14-verify-pipeline-contract-drift). peaks-qa does not own
     // security review or performance review — `peaks-qa/SKILL.md` says so, and
     // the v2.11.0 D1/D4 trim dropped both from every `qa:verdict-issued` table.
     // The evidence they used to demand is now checked on the RD side, at the
     // paths the contract actually names (`audit/security-<rid>.md`,
-    // `audit/perf-<rid>.md`; rid-scoped since slice
-    // `2026-09-14-audit-artifact-rid-scoping`, with `audit/security.md` /
     // `audit/perf.md` and `rd/security-review.md` / `rd/perf-baseline.md` as the
     // declared legacy tiers behind them).
     return gates;

package/dist/services/workflow/pipeline-verify-service.d.ts

@@ -1,5 +1,4 @@
 /**
- * peaks-workflow — pipeline verification orchestrator (slimmed per rid-006).
  *
  * `verifyPipeline` resolves RD / QA evidence files for a given rid and
  * returns a structured `PipelineVerification` envelope. Type
@@ -11,7 +10,6 @@
  * bottom preserves the original public surface so existing import
  * paths compile unchanged.
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 import type { PipelineVerification } from './pipeline-verify-types.js';
 export declare function verifyPipeline(options: {