peaks-loop 4.1.0 → 4.1.2

package/dist/services/workflow/pipeline-verify-service.js

@@ -1,5 +1,4 @@
 /**
- * peaks-workflow — pipeline verification orchestrator (slimmed per rid-006).
  *
  * `verifyPipeline` resolves RD / QA evidence files for a given rid and
  * returns a structured `PipelineVerification` envelope. Type
@@ -11,7 +10,6 @@
  * bottom preserves the original public surface so existing import
  * paths compile unchanged.
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 import { isRequestType } from '../artifacts/artifact-prerequisites.js';
 import { readSkipState } from './workflow-state-store.js';
@@ -26,7 +24,6 @@ export async function verifyPipeline(options) {
     const nextActions = [];
     const rdGates = rdGatesForType(requestType);
     const qaGates = qaGatesForType(requestType);
-    // Slice 2026-06-13-peaks-workflow-skip: read the skip-state (if any)
     // and pre-mark matching gates as `status: 'skipped'`. We do this
     // BEFORE evaluating evidence files, so a skipped gate never
     // emits a "missing evidence" violation. The boolean `passed` is
@@ -125,7 +122,6 @@ export async function verifyPipeline(options) {
     }
     // Check QA evidence files. (The v2.18.1 bug #5 `changeIdForResolver`
     // fallback — current session id when no RD/QA artifact is on disk yet —
-    // was dropped by rid 2026-09-14-verify-pipeline-contract-drift along with
     // the security/perf findings branch that was its only consumer.)
     const qaTracker = resolveQaEvidencePaths(qaGates, options.projectRoot, rdEvidenceDir, requestType, options.rid, violations, nextActions, rdTracker);
     const anyEvidenceResolved = qaTracker.anyEvidenceResolved;
@@ -136,11 +132,9 @@ export async function verifyPipeline(options) {
         nextActions.push(`Complete QA gates → peaks request transition ${options.rid} --role qa --state verdict-issued`);
     }
     // RD invoked without QA — check is moved to AFTER markIfSkipped
-    // (slice 2026-06-13-peaks-workflow-skip) because the gate.status
     // values are only final after the post-process pass. We track the
     // decision with a placeholder here and resolve it below.
     const rdInvokedWithoutQaRaw = rdInvoked && !qaInvoked;
-    // Slice 2026-06-13-peaks-workflow-skip: post-process. For any gate
     // the user marked as skipped, override the evaluation result. The
     // boolean `passed` is set to true so the gate counts as satisfied;
     // the new `status: 'skipped'` field signals the bypass to
@@ -172,7 +166,6 @@ export async function verifyPipeline(options) {
     }
     // Resolve the "RD invoked without QA" check now that markIfSkipped
     // has run. The check is suppressed when every QA gate is skipped
-    // (slice 2026-06-13-peaks-workflow-skip: the user explicitly chose
     // to skip the QA phase).
     if (rdInvokedWithoutQaRaw) {
         const allQaSkipped = qaGates.every((g) => g.status === 'skipped');
@@ -181,11 +174,9 @@ export async function verifyPipeline(options) {
             nextActions.push('MUST invoke Skill(skill="peaks-qa") before declaring workflow complete');
         }
     }
-    // Slice 002 (v2.15.0) AC-3 — Gate H "feedback-promotion". Scans
     // `.peaks/memory/*.md` for `metadata.type === 'feedback'` entries
     // that lack a promotion marker (HTML comment or `.promotion.json`
     // sidecar) OR whose marker is not backed by the layer's artifact
-    // (rid 2026-09-14-gate-h-promotion). When any such feedback is
     // found, the gate fails and the pipeline does not complete until the
     // user promotes via `peaks feedback promote <memory-file> --layer
     // <A|B|C>` — which now produces the artifact, not just the marker.
@@ -203,7 +194,6 @@ export async function verifyPipeline(options) {
     ];
     try {
         const unpromoted = listUnpromotedFeedback({ projectRoot: options.projectRoot });
-        // rid 2026-09-14-gate-h-promotion (classify slice): memories that declare
         // themselves out of the gate are reported, never dropped. An exemption the
         // gate does not show would be indistinguishable from a fixed violation.
         const exempt = listPromotionExempt({ projectRoot: options.projectRoot });
@@ -215,7 +205,6 @@ export async function verifyPipeline(options) {
             feedbackGates[0].detail = `0 unpromoted feedback memories in .peaks/memory/${exemptNote}`;
         }
         else {
-            // rid 2026-09-14-gate-h-promotion: the gate no longer passes on a marker
             // alone. `listUnpromotedFeedback` now also reports markers whose layer
             // artifact is absent, so `unpromoted` mixes "never promoted" with
             // "promoted on paper only" — the reason on each entry says which.
@@ -243,15 +232,12 @@ export async function verifyPipeline(options) {
         allFeedbackGatesPassed &&
         RD_QA_HANDOFF_STATES.has(rdState) &&
         QA_COMPLETE_STATES.has(qaState);
-    // Slice 025 — derive the `acceptedForm` and `gateC` verdict. The form is
     // 'suffixed' when the contract's current path served the file and 'legacy'
     // when the deprecated fallback did; 'none' if neither gate passed.
     //
-    // rid 2026-09-14-verify-pipeline-contract-drift: the two gates moved from the
     // QA phase to the RD phase, because that is where the current contract puts
     // the evidence (`AUDIT_SECURITY` / `AUDIT_PERF` at `rd:qa-handoff`). The
     // `-<rid>.md` suffix that used to distinguish the forms is a real one again
-    // after slice `2026-09-14-audit-artifact-rid-scoping` rid-scoped the audit
     // paths; the resolver marks which form served the file with
     // `[LEGACY_EVIDENCE_PATH]`.
     const secGate = rdGates.find((g) => g.name === 'security-review');
@@ -266,7 +252,6 @@ export async function verifyPipeline(options) {
             : 'suffixed';
     const gateC = allQaGatesPassed ? 'pass' : 'fail';
     const gateH = allFeedbackGatesPassed ? 'pass' : 'fail';
-    // Slice 2026-06-28-code-mode-bypass-fix (defect #3): `true` when
     // every gate resolved on the canonical path; `false` when at least
     // one fell back to a legacy form. QA / TXT surface the value so the
     // user knows the legacy content must be moved into the canonical

package/dist/services/workflow/pipeline-verify-types.d.ts

@@ -3,9 +3,7 @@
  *
  * Pure type module. No runtime helpers, no constants. The slimmed
  * `pipeline-verify-service.ts` re-exports the types so existing
- * import paths compile unchanged (rid-006 split).
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 import type { RequestType } from '../artifacts/artifact-prerequisites.js';
 export type PipelineGate = {
@@ -14,7 +12,6 @@ export type PipelineGate = {
     passed: boolean;
     detail: string;
     /**
-     * Slice 2026-06-13-peaks-workflow-skip: optional status that
      * distinguishes a gate that was BYPASSED via `peaks workflow skip`
      * from one that actually passed evaluation. When set, the gate
      * was NOT evaluated by `evaluateGate` — the user/CLI explicitly
@@ -47,12 +44,10 @@ export type PipelineVerification = {
         gates: PipelineGate[];
     };
     /**
-     * Slice 002 (v2.15.0) AC-3: Gate H "feedback-promotion". Always
      * present (single-element array). Evaluates whether every
      * `metadata.type === 'feedback'` memory in `.peaks/memory/`
      * carries a promotion marker (comment OR sidecar) AND whether the
      * layer that marker claims is actually backed by its artifact
-     * (rid 2026-09-14-gate-h-promotion). Failures block the `complete`
      * verdict via the `gateH` field below; the pipeline only completes
      * when every gate in this array passes.
      */
@@ -62,12 +57,10 @@ export type PipelineVerification = {
     violations: string[];
     nextActions: string[];
     /** Form of the security/performance evidence the RD gates accepted
-     * (slice 025). `'suffixed'` when the current contract's path served the
      * file, `'legacy'` when a deprecated fallback did, `'none'` when neither
      * gate passed. The per-rid `<rid>.md` suffix the union was named after was
      * retired with `qa/security-findings-<rid>.md` (v2.11.0 D1/D4); the evidence
      * now lives at `audit/security-<rid>.md` / `audit/perf-<rid>.md`
-     * (rid-scoped since slice `2026-09-14-audit-artifact-rid-scoping`) with
      * `audit/security.md` / `audit/perf.md` and
      * `rd/security-review.md` / `rd/perf-baseline.md` as the declared legacy
      * fallbacks (rid 2026-09-14-verify-pipeline-contract-drift). */
@@ -75,13 +68,11 @@ export type PipelineVerification = {
     /** `gateC` is the pre-computed verdict string (AC7 dogfood shape). */
     gateC?: 'pass' | 'fail';
     /**
-     * Slice 002 (v2.15.0) AC-3: Gate H verdict string. `'pass'` when
      * all feedback memories are promoted; `'fail'` when at least one
      * unpromoted feedback memory was found.
      */
     gateH?: 'pass' | 'fail';
     /**
-     * Slice 2026-06-28-code-mode-bypass-fix (defect #3): `true` when
      * every evidence file resolved on the canonical path
      * (`.peaks/_runtime/change/<sessionId>/...`). `false` when at least
      * one evidence file resolved via a legacy fallback (`.peaks/<sessionId>/...`
@@ -89,7 +80,6 @@ export type PipelineVerification = {
      * so users know to move misplaced evidence into the canonical
      * location.
      *
-     * Slice 2026-06-29-change-id-root-removal: the legacy
      * `peaks workspace migrate-change-scope` migration tool is gone;
      * users must now move misplaced content into the canonical
      * `.peaks/_runtime/change/<sessionId>/<role>/` dir manually (or via

package/dist/services/workflow/pipeline-verify-types.js

@@ -3,8 +3,6 @@
  *
  * Pure type module. No runtime helpers, no constants. The slimmed
  * `pipeline-verify-service.ts` re-exports the types so existing
- * import paths compile unchanged (rid-006 split).
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 export {};

package/dist/services/workflow/plan-reader.d.ts

@@ -2,7 +2,6 @@ import { type ResultEnvelope } from 'peaks-loop-shared/result';
 export type PlanType = 'security' | 'perf';
 /** Back-compat env-var. When set to "1", fall back to legacy paths. */
 export declare const BACK_COMPAT_FLAG = "PEAKS_PLAN_LEGACY_FALLBACK";
-/** F-1 (slice 025 security): canonical session-id shape. */
 export declare const SESSION_ID_PATTERN: RegExp;
 export interface ReadPlanArgs {
     readonly type: PlanType;

package/dist/services/workflow/plan-reader.js

@@ -1,5 +1,4 @@
 /**
- * `peaks workflow plan read` — slice 025 (Security + Perf Plan/Result split).
  *
  * Returns the envelope `{ exists, path, hash, refreshedAt }` for the
  * session-scoped security-test-plan or perf-baseline plan. The hash is
@@ -19,7 +18,6 @@ import { fail, ok } from 'peaks-loop-shared/result';
 import { getSessionDir } from '../session/getSessionDir.js';
 /** Back-compat env-var. When set to "1", fall back to legacy paths. */
 export const BACK_COMPAT_FLAG = 'PEAKS_PLAN_LEGACY_FALLBACK';
-/** F-1 (slice 025 security): canonical session-id shape. */
 export const SESSION_ID_PATTERN = /^\d{4}-\d{2}-\d{2}-[a-z][a-z0-9-]*[a-z0-9]$/;
 const PLAN_FILE = {
     security: 'security-test-plan.md',
@@ -60,7 +58,6 @@ function buildData(args) {
     };
 }
 /**
- * F-2 (slice 025 security): resolve symlinks and confirm the real path
  * still lives under the expected base directory. A canonical path
  * may itself be a symlink (or a directory in the path chain may be),
  * which would let a malicious or accidental symlink escape the
@@ -85,7 +82,6 @@ function assertContained(args) {
             message: `resolved path escapes base directory: cannot resolve ${args.path}`
         };
     }
-    // Slice 2026-06-13-repair-pre-existing-test-failures: realpath the
     // expectedBase too. On macOS the OS exposes /tmp and
     // /var/folders/... as symlinks to /private/tmp and
     // /private/var/folders/.... `mkdtempSync` returns the unresolved
@@ -112,7 +108,6 @@ function assertContained(args) {
     return { ok: true, real };
 }
 export function readPlan(args) {
-    // F-1 (slice 025 security): reject path-traversal payloads before any
     // filesystem call. The CLI also validates, but the service is the
     // authoritative gate — every caller (CLI, skill, integration test)
     // benefits from the same rejection shape.

package/dist/services/workflow/plan-refresher.js

@@ -1,5 +1,4 @@
 /**
- * `peaks workflow plan refresh` — slice 025 (Security + Perf Plan/Result split).
  *
  * Deterministically regenerates a security-test-plan or perf-baseline
  * plan body. Without `--apply`, computes the would-be body + hash but
@@ -226,7 +225,6 @@ export function refreshPlan(args) {
             bodyPreview: rawBody
         });
     }
-    // F-2 (slice 025 security): if the parent dir chain has a symlink
     // that escapes the session dir, refuse to write. We resolve the
     // parent (the dir we are about to mkdir/write into) and confirm its
     // real path stays under the expected base.

package/dist/services/workflow/plan-trigger-detector.d.ts

@@ -1,5 +1,4 @@
 /**
- * `peaks workflow plan detect-trigger` — slice 025 (Security + Perf
  * Plan/Result split).
  *
  * Compares the current project state (filesystem + package.json) to the
@@ -13,7 +12,6 @@
  */
 import { type ResultEnvelope } from 'peaks-loop-shared/result';
 export type TriggerReason = 'new-dependency' | 'auth-surface-added' | 'hot-path-added' | 'manual-override' | 'no-change' | 'no-triggering-change';
-/** F-1 (slice 025 security): canonical request-id shape. */
 export declare const REQUEST_ID_PATTERN: RegExp;
 export interface DetectTriggerArgs {
     readonly project: string;

package/dist/services/workflow/plan-trigger-detector.js

@@ -1,5 +1,4 @@
 /**
- * `peaks workflow plan detect-trigger` — slice 025 (Security + Perf
  * Plan/Result split).
  *
  * Compares the current project state (filesystem + package.json) to the
@@ -14,7 +13,6 @@
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { fail, ok } from 'peaks-loop-shared/result';
-/** F-1 (slice 025 security): canonical request-id shape. */
 export const REQUEST_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 const SENSITIVE_SERVICE_DIRS = ['auth', 'security', 'secrets', 'payments', 'filesystem'];
 function readPackageJson(projectRoot) {
@@ -113,7 +111,6 @@ function findNewHotPathFile(diff) {
     return null;
 }
 export function detectTrigger(args) {
-    // F-1 (slice 025 security): reject traversal/separator payloads at
     // the service boundary so every caller (CLI, skill, integration test)
     // gets the same rejection shape.
     if (!REQUEST_ID_PATTERN.test(args.rid)) {

package/dist/services/workflow/workflow-autonomous-resume-helpers.js

@@ -15,7 +15,6 @@
  */
 import { closeSync, fstatSync, lstatSync, openSync, readSync, realpathSync, statSync } from 'node:fs';
 import { isAbsolute, relative, resolve } from 'node:path';
-// Slice 2026-06-29-change-id-root-removal: `buildArtifactRelativePath`
 // was removed with the change-id axis. The artifact under each
 // resume helper now resolves the absolute path via the session-axis
 // `getSessionDir` + an explicit role-relative segment; the
@@ -25,7 +24,6 @@ import { getSessionDir } from '../session/getSessionDir.js';
 import { normalizePath } from '../../shared/path-utils.js';
 import { extractMarkdownListSection, getCheckpointValidationRefs, getMarkdownBody, isValidResumeArtifact } from './workflow-autonomous-resume-validation.js';
 const MAX_RESUME_ARTIFACT_BYTES = 256_000;
-// Slice 2026-06-29-change-id-root-removal: return the bare role-relative
 // sub-paths instead of `.peaks/_runtime/change/<id>/<role>/...` strings.
 // `getResumeRequiredArtifacts` was previously consumed by callers that
 // joined the descriptor with the on-disk session dir computed by
@@ -60,7 +58,6 @@ function readFully(fd, size) {
     return buffer.toString('utf8');
 }
 function normalizeRoleRelativePath(artifact, _sessionId) {
-    // Slice 2026-06-29-change-id-root-removal: `getResumeRequiredArtifacts`
     // returns role-relative sub-paths (e.g.
     // `rd/swarm/checkpoints/checkpoint-1.json`). The helper normalises
     // the path separators and strips any leading `/`; the `sessionId`
@@ -69,7 +66,6 @@ function normalizeRoleRelativePath(artifact, _sessionId) {
     return normalizePath(artifact).replace(/^\/+/, '');
 }
 function readResumeArtifact(artifactWorkspacePath, sessionId, artifact) {
-    // Slice 2026-06-29-change-id-root-removal: on-disk home now lives under
     // the session-axis `getSessionDir(root, sessionId)`. The role/swarm
     // sub-path (e.g. `rd/swarm/checkpoints/checkpoint-1.json`) is
     // strictly a sub-root drill, not a top-level dir derivation.
@@ -150,7 +146,6 @@ function getResumeArtifactsStatus(artifactWorkspacePath, requiredArtifacts, sess
     let hasInvalidArtifact = false;
     const artifactContents = new Map();
     for (const artifact of requiredArtifacts) {
-        // Slice 2026-06-29-change-id-root-removal: pass the explicit
         // sessionId so `readResumeArtifact` can route through `getSessionDir`
         // rather than guessing from path segments. The prefix-strip is now
         // a simple `/` + backslash normaliser since descriptors are

package/dist/services/workflow/workflow-autonomous-service.js

@@ -1,5 +1,4 @@
 import { join } from 'node:path';
-// Slice 2026-06-29-change-id-root-removal: `validateChangeIdOrThrow`
 // was removed with the change-id axis. Path-safety helpers now live
 // at `shared/path-safety.ts` if this module ever needs them.
 import { WORKSPACE_UNAVAILABLE_NEXT_ACTIONS } from '../../shared/planner-response.js';
@@ -236,7 +235,6 @@ function uniqueStrings(values) {
     return [...new Set(values)];
 }
 export function createAutonomousWorkflowPlan(request) {
-    // Slice 2026-06-29-change-id-root-removal: change-id is metadata-only;
     // no structural validation gate fires here.
     const goal = normalizeGoal(request.goal);
     const maxWorkers = request.maxWorkers ?? 40;

package/dist/services/workflow/workflow-autonomous-types.d.ts

@@ -3,7 +3,6 @@
  *
  * Pure type module. No runtime helpers, no constants. The slimmed
  * `workflow-autonomous-service.ts` re-exports the types so existing
- * import paths compile unchanged (rid-006 split).
  *
  * Per PRD EC-1, this module is consumed by both
  * `workflow-autonomous-service.ts` and
@@ -12,7 +11,6 @@
  * resume-helpers ↔ autonomous-service runtime cycle (both modules
  * previously re-exported `AutonomousResumePlan` from each other).
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 import type { CapabilityItemType } from '../recommendations/recommendation-types.js';
 import type { ModelProviderConfig, WorkspaceConfig } from '../config/config-types.js';

package/dist/services/workflow/workflow-autonomous-types.js

@@ -3,7 +3,6 @@
  *
  * Pure type module. No runtime helpers, no constants. The slimmed
  * `workflow-autonomous-service.ts` re-exports the types so existing
- * import paths compile unchanged (rid-006 split).
  *
  * Per PRD EC-1, this module is consumed by both
  * `workflow-autonomous-service.ts` and
@@ -12,7 +11,6 @@
  * resume-helpers ↔ autonomous-service runtime cycle (both modules
  * previously re-exported `AutonomousResumePlan` from each other).
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 export {};
 // Note: `CapabilityAvailabilityStatus` is referenced by the orchestrator's

package/dist/services/workflow/workflow-graph-types.d.ts

@@ -42,7 +42,6 @@ export interface WorkflowGraph {
 }
 /**
  * `id` regex: ASCII letters, digits, dot, underscore, hyphen; 1-200 chars.
- * Excludes path separators / NUL / whitespace / Unicode (per D1 of the
  * caller-id contract — node ids appear in file paths).
  */
 export declare const NODE_ID_REGEX: RegExp;

package/dist/services/workflow/workflow-graph-types.js

@@ -35,7 +35,6 @@ export const GRAPH_NODE_STATUSES = [
 ];
 /**
  * `id` regex: ASCII letters, digits, dot, underscore, hyphen; 1-200 chars.
- * Excludes path separators / NUL / whitespace / Unicode (per D1 of the
  * caller-id contract — node ids appear in file paths).
  */
 export const NODE_ID_REGEX = /^[a-zA-Z0-9._-]{1,200}$/;

package/dist/services/workflow/workflow-router-service.js

@@ -2,7 +2,6 @@ import { getConfiguredExecutionModelId, getStrongestModelId } from '../config/mo
 import { getLocalArtifactPath } from '../artifacts/workspace-service.js';
 import { createRdSwarmPlan } from '../rd/rd-service.js';
 import { createTechPlan, getTechStatus } from '../tech/tech-service.js';
-// Slice 2026-06-29-change-id-root-removal: `validateChangeIdOrThrow`
 // was removed with the change-id axis. Path-safety helpers now live
 // at `shared/path-safety.ts` if this module ever needs them.
 import { WORKSPACE_UNAVAILABLE_NEXT_ACTIONS } from '../../shared/planner-response.js';
@@ -285,12 +284,10 @@ function getCodeMode(mode, codeMode) {
 export function createWorkflowRouterPlan(request) {
     assertSupportedMode(request.mode);
     assertCodeModeAllowed(request.mode, request.codeMode);
-    // Slice 2026-06-29-change-id-root-removal: change-id is metadata-only;
     // no structural validation gate fires here.
     const goal = normalizeGoal(request.goal);
     const maxWorkers = request.maxWorkers ?? 40;
     // Slice 2.0.1-bug1 round 3: project policy defaults. The slim 2.0.1 DEFAULT_CONFIG
-    // no longer carries economyMode / swarmMode (those moved to per-project preferences),
     // so we cannot fall back to `DEFAULT_CONFIG.economyMode` / `swarmMode` here. Both
     // flags are project-policy opt-outs: the absence of an explicit `false` means
     // "enabled" (matches the pre-2.0.1 implicit default).
@@ -305,7 +302,6 @@ export function createWorkflowRouterPlan(request) {
     const effectiveProviders = request.config?.providers ?? {
         anthropic: { model: 'claude-opus-4-7' }
     };
-    // Slice 2026-07-09 add-zcode-adapter (A.3): the strongest
     // planner/reviewer model is now resolved via `getStrongestModelId`,
     // which reads `config.model` (if present) or falls back to the
     // env-var-overridable default. This decouples the strongest-model

package/dist/services/workflow/workflow-skip-service.d.ts

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-06-13-peaks-workflow-skip — `peaks workflow skip` service.
  *
  * Pure-function classifier (`canSkipSlice`) + side-effecting applicator
  * (`applySkip`). Both are testable without filesystem mocks (the

package/dist/services/workflow/workflow-skip-service.js

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-06-13-peaks-workflow-skip — `peaks workflow skip` service.
  *
  * Pure-function classifier (`canSkipSlice`) + side-effecting applicator
  * (`applySkip`). Both are testable without filesystem mocks (the

package/dist/services/workflow/workflow-spec-lint.d.ts

@@ -1,12 +1,10 @@
 /**
- * peaks-workflow v3.0.0 — `lintWorkflowSpec` (moved verbatim per rid-006)
  *
  * Pure lint over a typed `WorkflowSpec`. No parser/build helpers, no
  * YAML helpers — lint is pure on the typed spec. The slimmed
  * `workflow-spec.ts` re-exports `lintWorkflowSpec` under its original
  * name so existing call sites compile unchanged.
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 import type { WorkflowLintReport, WorkflowSpec } from './workflow-spec-types.js';
 /** Lint a parsed spec — returns a report with semantic errors / warnings. */

package/dist/services/workflow/workflow-spec-lint.js

@@ -1,12 +1,10 @@
 /**
- * peaks-workflow v3.0.0 — `lintWorkflowSpec` (moved verbatim per rid-006)
  *
  * Pure lint over a typed `WorkflowSpec`. No parser/build helpers, no
  * YAML helpers — lint is pure on the typed spec. The slimmed
  * `workflow-spec.ts` re-exports `lintWorkflowSpec` under its original
  * name so existing call sites compile unchanged.
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 /** Lint a parsed spec — returns a report with semantic errors / warnings. */
 export function lintWorkflowSpec(spec) {

package/dist/services/workflow/workflow-spec-types.d.ts

@@ -8,7 +8,6 @@
  * live in `workflow-spec-yaml.ts`; the lint function lives in
  * `workflow-spec-lint.ts`.
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 /** A workflow phase = a single step the runtime executes. */
 export interface WorkflowPhase {

package/dist/services/workflow/workflow-spec-types.js

@@ -8,6 +8,5 @@
  * live in `workflow-spec-yaml.ts`; the lint function lives in
  * `workflow-spec-lint.ts`.
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 export {};

package/dist/services/workflow/workflow-spec-yaml.d.ts

@@ -4,9 +4,7 @@
  * Private helpers used by the parser in `workflow-spec.ts`. NOT publicly
  * re-exported; not part of the public API surface. Kept in a sibling
  * file so the slimmed `workflow-spec.ts` can stay under the 400-line
- * file-size cap (rid-006 split).
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 export declare function leadingSpaces(line: string): number;
 export declare function parseScalar(raw: string): unknown;

package/dist/services/workflow/workflow-spec-yaml.js

@@ -4,9 +4,7 @@
  * Private helpers used by the parser in `workflow-spec.ts`. NOT publicly
  * re-exported; not part of the public API surface. Kept in a sibling
  * file so the slimmed `workflow-spec.ts` can stay under the 400-line
- * file-size cap (rid-006 split).
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 export function leadingSpaces(line) {
     let n = 0;

package/dist/services/workflow/workflow-spec.js

@@ -199,7 +199,6 @@ export function parseWorkflowYaml(raw, expectedId) {
     // Build the typed spec.
     return buildSpec(root, expectedId);
 }
-// ─── verbatim re-export shim (rid-006) ────────────────────────────────────
 // External callers (`workflow-loader.ts`, `loop-eval-commands.ts`,
 // `evaluator-dispatcher.ts`) import the public types and the lint
 // function from this module. Re-export them under their original names

package/dist/services/workflow/workflow-state-store.js

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-06-13-peaks-workflow-skip — workflow state store.
  *
  * Per-slice ephemeral runtime state, keyed by rid. Lives under
  * `.peaks/_runtime/<sessionId>/workflow-state/<rid>.json` (gitignored

package/dist/services/workspace/claude-settings-template.d.ts

@@ -78,7 +78,6 @@ export declare const CLAUDE_SETTINGS_LOCAL_FILENAME = ".claude/settings.local.js
  *           place for half of every Bash tool call.
  *   1.6.0 — the `Write|Edit|MultiEdit` handler no longer inlines its
  *           JavaScript as `node -e "<js>"`. It invokes the shipped script
- *           `src/services/hooks/write-gate.js` instead, so the command
  *           string carries no shell-escaped payload at all and the handler
  *           can take the same platform `shell` pin as its siblings. The
  *           decision itself is a verbatim relocation — see that file.
@@ -88,7 +87,6 @@ export declare const CLAUDE_SETTINGS_LOCAL_FILENAME = ".claude/settings.local.js
  *           on-disk file to declare those exemptions too, so a project
  *           installed by an earlier release refreshes once and converges.
  *   1.8.0 — REMOVED the `Write|Edit|MultiEdit` handler and the shipped
- *           script it invoked (`src/services/hooks/write-gate.js`, also
  *           deleted). The handler abstained on every path by design (see
  *           that file's header for the rationale — it is the reason this
  *           is a deletion and not a repair), so the only things it still
@@ -105,7 +103,6 @@ export declare const TEMPLATE_VERSION = "1.8.0";
  * Compare two serialized template strings: does the on-disk file already
  * declare every entry the generated tree declares?
  *
- * OWNERSHIP IS PER ENTRY, NOT PER KEY (rid 2026-09-13-two-decisions item ②).
  * This comparator answers "is each entry the GENERATED tree declares present
  * on disk?", NOT "are the two `hooks` trees identical". Extra on-disk entries
  * are IGNORED, so an entry another writer put in this file never makes it look
@@ -144,7 +141,6 @@ export declare function templateContentMatches(generated: string, onDisk: string
 /**
  * Merge the on-disk `hooks.PreToolUse` list with the template's.
  *
- * THE OWNERSHIP RULE (rid 2026-09-13-two-decisions item ②): this template owns
  * the entries IT DECLARES — and nothing else. Every other on-disk entry is
  * carried across verbatim, whatever its matcher, because the template has no
  * opinion about it:

package/dist/services/workspace/claude-settings-template.js

@@ -79,7 +79,6 @@ export const CLAUDE_SETTINGS_LOCAL_FILENAME = '.claude/settings.local.json';
  *           place for half of every Bash tool call.
  *   1.6.0 — the `Write|Edit|MultiEdit` handler no longer inlines its
  *           JavaScript as `node -e "<js>"`. It invokes the shipped script
- *           `src/services/hooks/write-gate.js` instead, so the command
  *           string carries no shell-escaped payload at all and the handler
  *           can take the same platform `shell` pin as its siblings. The
  *           decision itself is a verbatim relocation — see that file.
@@ -89,7 +88,6 @@ export const CLAUDE_SETTINGS_LOCAL_FILENAME = '.claude/settings.local.json';
  *           on-disk file to declare those exemptions too, so a project
  *           installed by an earlier release refreshes once and converges.
  *   1.8.0 — REMOVED the `Write|Edit|MultiEdit` handler and the shipped
- *           script it invoked (`src/services/hooks/write-gate.js`, also
  *           deleted). The handler abstained on every path by design (see
  *           that file's header for the rationale — it is the reason this
  *           is a deletion and not a repair), so the only things it still
@@ -106,7 +104,6 @@ export const TEMPLATE_VERSION = '1.8.0';
  * Compare two serialized template strings: does the on-disk file already
  * declare every entry the generated tree declares?
  *
- * OWNERSHIP IS PER ENTRY, NOT PER KEY (rid 2026-09-13-two-decisions item ②).
  * This comparator answers "is each entry the GENERATED tree declares present
  * on disk?", NOT "are the two `hooks` trees identical". Extra on-disk entries
  * are IGNORED, so an entry another writer put in this file never makes it look
@@ -196,7 +193,6 @@ export function templateContentMatches(generated, onDisk) {
 /**
  * Merge the on-disk `hooks.PreToolUse` list with the template's.
  *
- * THE OWNERSHIP RULE (rid 2026-09-13-two-decisions item ②): this template owns
  * the entries IT DECLARES — and nothing else. Every other on-disk entry is
  * carried across verbatim, whatever its matcher, because the template has no
  * opinion about it:

package/dist/services/workspace/generated-artifacts-stamp.d.ts

@@ -13,8 +13,8 @@
  *
  * `.claude/settings.local.json` IS drift-checked against the current template
  * — but only when something calls `initWorkspace`, which is precisely the
- * event that stopped happening. The escape hatch (`peaks upgrade
- * --apply-init`) is real and idempotent. What was missing is anything that
+ * event that stopped happening. The escape hatch (`peaks workspace init`) is
+ * real and idempotent. What was missing is anything that
  * tells the user — or the LLM driving them — that they need it. That is the
  * gap this module closes: a stamp the generator writes, and a detector that
  * can answer "the file on disk was produced by 4.0.40 while the installed

package/dist/services/workspace/generated-artifacts-stamp.js

@@ -13,8 +13,8 @@
  *
  * `.claude/settings.local.json` IS drift-checked against the current template
  * — but only when something calls `initWorkspace`, which is precisely the
- * event that stopped happening. The escape hatch (`peaks upgrade
- * --apply-init`) is real and idempotent. What was missing is anything that
+ * event that stopped happening. The escape hatch (`peaks workspace init`) is
+ * real and idempotent. What was missing is anything that
  * tells the user — or the LLM driving them — that they need it. That is the
  * gap this module closes: a stamp the generator writes, and a detector that
  * can answer "the file on disk was produced by 4.0.40 while the installed

package/dist/services/workspace/migrate-1-4-1-service.d.ts

@@ -3,7 +3,6 @@
  *
  * Cleanup command for projects upgraded from peaks-loop 1.4.1 → 1.4.2.
  *
- * Slice 006 (1.4.0) moved the canonical per-session root to
  * `.peaks/_runtime/<sid>/`. Per-request artifacts (PRD, RD, QA, SC requests)
  * were written to the new root, but per-session artifacts (tech-doc.md,
  * code-review.md, test-cases/<rid>.md, etc.) were kept at the legacy

package/dist/services/workspace/migrate-1-4-1-service.js

@@ -3,7 +3,6 @@
  *
  * Cleanup command for projects upgraded from peaks-loop 1.4.1 → 1.4.2.
  *
- * Slice 006 (1.4.0) moved the canonical per-session root to
  * `.peaks/_runtime/<sid>/`. Per-request artifacts (PRD, RD, QA, SC requests)
  * were written to the new root, but per-session artifacts (tech-doc.md,
  * code-review.md, test-cases/<rid>.md, etc.) were kept at the legacy