peaks-loop 4.1.0 → 4.1.2

package/dist/cli/commands/heartbeat-commands-action.js

@@ -27,7 +27,6 @@ import { appendHeartbeat, setStage, tryAutoReleaseLease } from '../../services/d
 import { assertSafeDispatchRecordPath } from '../../services/security/safe-settings-path.js';
 import { writeLogEntry } from '../../services/log/logger.js';
 import { failHeartbeat, heartbeatErrorCode, heartbeatErrorNextActions, resolveHeartbeatStage, validateHeartbeatArguments } from './heartbeat-commands-validation.js';
-// Slice 2026-07-29-worktree-l2-extended Part 3.A.2: the statuses that end a
 // dispatch. Hoisted out of the action body — a constant set is the same set on
 // every call, and its position in the sequence (after printResult) is unchanged.
 const TERMINAL_HEARTBEAT_STATUSES = new Set([
@@ -37,7 +36,6 @@ const TERMINAL_HEARTBEAT_STATUSES = new Set([
     'no-execution'
 ]);
 /**
- * Slice 2026-07-29-worktree-l2-extended Part 24: the heartbeat envelope
  * surfaces a `leaseHint` field when the dispatch owns a lease. The hint is a
  * one-line reminder for the sub-agent that the lease is the L2 surface it
  * should clean up before exiting (or, per Part 3.A.2, the auto-release hook
@@ -53,7 +51,6 @@ function leaseHintFor(result) {
 /** The success envelope's payload, field for field, exactly as the CLI printed it. */
 function heartbeatSuccessEnvelope(recordPath, result) {
     return {
-        // Slice 2026-06-23-audit-4th #E1: envelopeVersion marker
         // Part 24: bumped to 2.2.0 to advertise the new `leaseHint`
         // field; readers from 2.1.0 ignore the unknown field.
         envelopeVersion: '2.2.0',
@@ -66,7 +63,6 @@ function heartbeatSuccessEnvelope(recordPath, result) {
     };
 }
 /**
- * Slice 2026-07-29-worktree-l2-extended Part 3.A.2: when the heartbeat reports
  * a TERMINAL status (done / failed / cancelled / no-execution) AND the dispatch
  * owns a lease, fire the detached release. This is the common path: most
  * sub-agents finalize via heartbeat before the share-reducer calls
@@ -91,7 +87,6 @@ function releaseLeaseForTerminalHeartbeat(trustedRoot, status, result) {
         }
     }
 }
-/** Slice 2026-06-23-audit-4th #B1: structured log on success. */
 function logHeartbeatSuccess(recordPath, result) {
     try {
         writeLogEntry({
@@ -158,7 +153,6 @@ export function runHeartbeatAction(io, options) {
         return;
     }
     try {
-        // R-2 guard (slice 2026-06-23-audit-3rd): trust --project or process.cwd(),
         // NOT the --record path. deriveProjectRoot(recordPath) walked the path
         // itself, which let an attacker point --record at any other project's
         // .peaks/_sub_agents/ tree and slip past the guard. The relative()

package/dist/cli/commands/heartbeat-commands-validation.d.ts

@@ -38,7 +38,6 @@ export declare function failHeartbeat(io: ProgramIO, f: {
  */
 export declare function validateHeartbeatArguments(io: ProgramIO, asJson: boolean, options: HeartbeatActionOptions, recordPath: string): HeartbeatArgumentsCheck;
 /**
- * Slice 2026-07-29-dispatch-stall-governance / S5 (AC-5.2) — validate the
  * optional `--stage` against the bounded enum BEFORE the heartbeat write so the
  * caller gets a specific `INVALID_STAGE` error rather than a generic
  * `HEARTBEAT_ERROR`. An absent or empty flag is not an error: it yields
@@ -48,7 +47,6 @@ export declare function validateHeartbeatArguments(io: ProgramIO, asJson: boolea
  */
 export declare function resolveHeartbeatStage(io: ProgramIO, asJson: boolean, options: HeartbeatActionOptions, recordPath: string): HeartbeatStageCheck;
 /**
- * Slice 2026-06-23-audit-3rd #9: branch nextActions on `error.code` so
  * the LLM-side runner gets a specific hint instead of the generic
  * "see error message" fallback.
  */

package/dist/cli/commands/heartbeat-commands-validation.js

@@ -69,7 +69,6 @@ export function validateHeartbeatArguments(io, asJson, options, recordPath) {
     return { ok: true, progress };
 }
 /**
- * Slice 2026-07-29-dispatch-stall-governance / S5 (AC-5.2) — validate the
  * optional `--stage` against the bounded enum BEFORE the heartbeat write so the
  * caller gets a specific `INVALID_STAGE` error rather than a generic
  * `HEARTBEAT_ERROR`. An absent or empty flag is not an error: it yields
@@ -95,7 +94,6 @@ export function resolveHeartbeatStage(io, asJson, options, recordPath) {
     return { ok: true, stage: stageLabel };
 }
 /**
- * Slice 2026-06-23-audit-3rd #9: branch nextActions on `error.code` so
  * the LLM-side runner gets a specific hint instead of the generic
  * "see error message" fallback.
  */

package/dist/cli/commands/heartbeat-commands.d.ts

@@ -1,7 +1,6 @@
 /**
  * `peaks sub-agent heartbeat` — G6: append a heartbeat to a dispatch record.
  *
- * Pulled out of `sub-agent-commands.ts` (slice 2026-06-23-audit-p0-split)
  * to honor the 800-line file cap. The heartbeat is fire-and-forget; the
  * parent Dispatcher polls the record during the batch-sync wait and
  * renders a status line. Sub-agents should call this at least every

package/dist/cli/commands/heartbeat-commands.js

@@ -11,7 +11,6 @@ export function registerHeartbeatCommand(parent, io) {
         .requiredOption('--status <state>', 'queued | running | finalizing | done | failed | stale | cancelled | no-execution | never-started | unreadable')
         .requiredOption('--progress <pct>', 'integer 0-100')
         .option('--note <text>', 'free-form progress note (≤ 200 chars)')
-        // Slice 2026-07-29-dispatch-stall-governance / S5 (AC-5.2) —
         // optional --stage flag. The label is bounded (see
         // src/services/dispatch/stage-enum.ts); an unknown value is
         // rejected with INVALID_STAGE so the watch surface never

package/dist/cli/commands/hooks-commands.js

@@ -76,7 +76,6 @@ function listExpectedEntriesForIde(ide, _skipProgress = false) {
         .map((entry) => ({ matcher: entry.matcher, sentinel: entry.sentinel }));
 }
 /**
- * Slice 2026-07-24-peaks-code-bridge-002-rootcause (G6b / G10): copy the
  * superpowers-bridge hook source from the peaks-loop repo
  * (src/services/hooks/pre-tool-superpowers-bridge.sh) into the user-global
  * `<userHome>/.claude/skills/peaks-code/hooks/` directory. The user-global
@@ -102,7 +101,6 @@ function listExpectedEntriesForIde(ide, _skipProgress = false) {
  * it without forcing the caller to inspect the filesystem.
  */
 /**
- * Slice 2026-07-29-worktree-layer3-deny: read the on-disk
  * `permissions.deny` block from a settings.json object and return
  * every peaks-managed entry currently present. Used by `hooks status`
  * to surface Layer 3 governance state without forcing the caller to
@@ -159,7 +157,6 @@ function copyBridgeHookIfPresent(userHome, dryRun = false) {
     return { copied: true, source, target };
 }
 /**
- * Slice 2026-08-06-codegate-vendor-neutral: copy the code-gate hook
  * source (`src/services/hooks/pre-tool-code-gate.sh`) into the user-
  * global peaks-code hooks dir, mirroring the bridge-hook copy. The
  * hook itself is vendor-neutral (no `claude` / `anthropic` strings in
@@ -206,7 +203,6 @@ export function registerHooksCommands(program, io) {
                 const bridgeCopy = scope === 'global'
                     ? copyBridgeHookIfPresent(process.env.USERPROFILE ?? process.env.HOME ?? '', true)
                     : { copied: false, source: '', target: '' };
-                // Slice 2026-08-06-codegate-vendor-neutral: also copy the
                 // code-gate hook script. The runtime gate lives at
                 // `peaks code-gate --json` (registered as a PreToolUse entry
                 // in the install output); the script is the build artifact
@@ -223,7 +219,6 @@ export function registerHooksCommands(program, io) {
                     entries: dryRunEntries,
                     bridgeHookCopy: bridgeCopy,
                     codeGateHookCopy: codeGateCopy,
-                    // Slice 2026-07-29-worktree-layer3-deny: surface the
                     // Layer 3 deny entries the install WOULD write. The
                     // dry-run branch never actually invokes
                     // `applyHookInstall`, so the on-disk snapshot is not
@@ -250,7 +245,6 @@ export function registerHooksCommands(program, io) {
             // claude-code default). The summary is derived from the install's own
             // entry table — see `listExpectedEntriesForIde`.
             const installedEntries = listExpectedEntriesForIde(ide, skipProgress);
-            // Slice 2026-07-24-peaks-code-bridge-002-rootcause (G6b / G10): when
             // the install targets global scope, also copy the superpowers-bridge
             // hook script from src/services/hooks/ to the user-global hooks
             // directory. Project scope does not need this — project's
@@ -258,7 +252,6 @@ export function registerHooksCommands(program, io) {
             const bridgeCopy = scope === 'global'
                 ? copyBridgeHookIfPresent(process.env.USERPROFILE ?? process.env.HOME ?? '')
                 : { copied: false, source: '', target: '' };
-            // Slice 2026-08-06-codegate-vendor-neutral: also copy the
             // code-gate hook script. The runtime gate lives at
             // `peaks code-gate --json` (registered as a PreToolUse entry
             // in the install output); the script is the build artifact
@@ -270,14 +263,12 @@ export function registerHooksCommands(program, io) {
                 ? [
                     'Restart the IDE (or reload the workspace) so the hook entries take effect',
                     `Installed: ${installedEntries.map((e) => `${e.matcher}→${e.sentinel}`).join(', ')}`,
-                    // Slice 2026-07-29-worktree-layer3-deny: surface L3 deny
                     // write alongside the hook install — single atomic write.
                     `Layer 3 deny: wrote ${listSuperpowersDenyEntries().length} permissions.deny entries (worktree governance)`,
                     describeHookCopy('bridge hook', bridgeCopy, scope, false),
                     describeHookCopy('code-gate hook', codeGateCopy, scope, false)
                 ].filter((line) => line !== null)
                 : [describeHookCopy('bridge hook', bridgeCopy, scope, false)].filter((line) => line !== null);
-            // Slice 2026-07-29-worktree-layer3-deny: emit L3 deny bookkeeping
             // in the JSON envelope so downstream automation (audit / sc) can
             // confirm Layer 3 was applied without re-reading the file. When
             // the install is a no-op (`applied: false`) the deny block was
@@ -313,7 +304,6 @@ export function registerHooksCommands(program, io) {
         const ide = resolveIdeForCommand(options, projectRoot);
         try {
             const result = removeHookInstall(scope, projectRoot, { ide });
-            // Slice 2026-07-29-worktree-layer3-deny: surface L3 deny removal
             // bookkeeping. `permissionsDenyRemoved` mirrors `removed` (the
             // service strips deny entries on the same atomic write that
             // strips the hook entries; they share the same boolean).
@@ -358,7 +348,6 @@ export function registerHooksCommands(program, io) {
             const localSettings = status.localSettingsPath !== undefined && existsSync(status.localSettingsPath)
                 ? readJsonObjectFile(status.localSettingsPath)
                 : {};
-            // Slice 2026-07-29-worktree-layer3-deny: report the Layer 3 deny
             // entries actually on disk. We read the existing settings.json
             // (above) and surface its `permissions.deny` block. Any entry
             // that matches the current `SUPERPOWERS_DENIED_SKILLS` set is

package/dist/cli/commands/ide-commands.d.ts

@@ -1,5 +1,4 @@
 /**
- * peaks ide * CLI (Slice 2026-07-09 add-zcode-adapter, Slice C).
  *
  * Slice C adds ONE verb:
  *

package/dist/cli/commands/job-add-slice-command.d.ts

@@ -1,5 +1,4 @@
 /**
- * rid 2026-10-03-job-ledger-truthfulness (D1) — `peaks job add-slice`.
  *
  * THE DEFECT. A job's slice list was decided once, at
  * `peaks job init --slice-list <one id>`, and no subcommand could add to it. The
@@ -9,7 +8,6 @@
  *
  *   peaks job add-slice …                          → error: unknown command 'add-slice'
  *   peaks job checkpoint --slice-id <new slice>    → ok:false  code:SLICE_NOT_FOUND
- *   peaks job progress --job-id 2026-10-02-c-wave9 → { done: 1, total: 1 }  (stuck)
  *
  * so a wave that plans its next slice only after the previous one lands — which is
  * how every split wave here runs — had no truthful way to record what it did. It

package/dist/cli/commands/job-add-slice-command.js

@@ -1,5 +1,4 @@
 /**
- * rid 2026-10-03-job-ledger-truthfulness (D1) — `peaks job add-slice`.
  *
  * THE DEFECT. A job's slice list was decided once, at
  * `peaks job init --slice-list <one id>`, and no subcommand could add to it. The
@@ -9,7 +8,6 @@
  *
  *   peaks job add-slice …                          → error: unknown command 'add-slice'
  *   peaks job checkpoint --slice-id <new slice>    → ok:false  code:SLICE_NOT_FOUND
- *   peaks job progress --job-id 2026-10-02-c-wave9 → { done: 1, total: 1 }  (stuck)
  *
  * so a wave that plans its next slice only after the previous one lands — which is
  * how every split wave here runs — had no truthful way to record what it did. It

package/dist/cli/commands/job-commands.js

@@ -36,7 +36,6 @@ export function asJson(opts) {
     return opts.json === true;
 }
 /**
- * F1 (rid 2026-09-17-exit-code-truth): report a FAILED envelope **and** make the
  * process exit non-zero.
  *
  * WHY THIS EXISTS. `printResult` (`src/cli/cli-helpers.ts`) renders a failed
@@ -355,7 +354,6 @@ export function registerJobCommands(program, io = {
         }
         const sliceId = slice.sliceId;
         const orch = new JobOrchestrator(store);
-        // 2026-09-03-codegraph-autorefresh: set on --state done so the ok
         // envelope carries a non-blocking `codegraph` result; null for
         // failed/skipped (no slice-complete boundary).
         let codegraph = null;
@@ -496,7 +494,6 @@ export function registerJobCommands(program, io = {
         .requiredOption('--job-id <jid>')
         .option('--session-id <sid>', SESSION_ID_HELP)
         .option('--project <repo>')
-        // H3 (rid 2026-09-17-exit-code-root-cause): this string used to promise
         // "return done=0/total=0 envelope instead of failing when progress.json is
         // absent". No code path has ever returned such an envelope — the option was
         // born in `d9a1a098` with `process.exitCode = 1` on the same branch — so it
@@ -523,7 +520,6 @@ export function registerJobCommands(program, io = {
                 // share one rule instead of this one being the lone precedent.
                 failResult(io, fail('progress', 'NO_PROGRESS', `No progress.json for job ${opts.jobId} at .peaks/_runtime/${sessId}/job/${opts.jobId}/progress.json`, { jobId: opts.jobId, sessionId: sessId }, [
                     'Run `peaks job checkpoint --state done ...` at least once to seed progress.json.',
-                    // H3: the second action used to read "Or pass --allow-missing to
                     // return a zero-progress envelope." That line could only ever be
                     // printed when `--allow-missing` had ALREADY been passed — this
                     // `progress === null` branch is unreachable otherwise, because the

package/dist/cli/commands/lease-metrics-commands.d.ts

@@ -1,5 +1,4 @@
 /**
- * `peaks lease-metrics` — slice 2026-07-29-worktree-l2-extended Part 4.A + Part 5.
  *
  * Part 4.A: aggregate lease-kind observability events for one session,
  * render per-kind counts + a 5-event chronological tail.

package/dist/cli/commands/lease-metrics-commands.js

@@ -1,5 +1,4 @@
 /**
- * `peaks lease-metrics` — slice 2026-07-29-worktree-l2-extended Part 4.A + Part 5.
  *
  * Part 4.A: aggregate lease-kind observability events for one session,
  * render per-kind counts + a 5-event chronological tail.

package/dist/cli/commands/lease-stats-commands.d.ts

@@ -1,5 +1,4 @@
 /**
- * `peaks lease-stats` — slice 2026-07-29-worktree-l2-extended Part 6.
  *
  * Single top-level command that aggregates lease observability for
  * the whole project root and returns a summary envelope suitable

package/dist/cli/commands/lease-stats-commands.js

@@ -1,5 +1,4 @@
 /**
- * `peaks lease-stats` — slice 2026-07-29-worktree-l2-extended Part 6.
  *
  * Single top-level command that aggregates lease observability for
  * the whole project root and returns a summary envelope suitable

package/dist/cli/commands/log-commands.d.ts

@@ -1,7 +1,6 @@
 /**
  * `peaks log *` subcommands.
  *
- * Slice 2026-06-16-cli-logging (G4). Two subcommands:
  *   - `peaks log tail [--lines N]` — print the last N lines of
  *     today's JSONL log to stdout. With `--json`, prints as a
  *     JSON envelope (matching the project's response shape).
@@ -10,7 +9,6 @@
  * The CLI layer is intentionally thin: it formats the output and
  * delegates the actual filesystem reads to
  * `src/services/log/log-commands-service.ts`. That service is
- * already covered by `tests/unit/log/log-commands.test.ts`.
  */
 import type { Command } from 'commander';
 import { type ProgramIO } from '../cli-helpers.js';

package/dist/cli/commands/log-commands.js

@@ -1,7 +1,6 @@
 /**
  * `peaks log *` subcommands.
  *
- * Slice 2026-06-16-cli-logging (G4). Two subcommands:
  *   - `peaks log tail [--lines N]` — print the last N lines of
  *     today's JSONL log to stdout. With `--json`, prints as a
  *     JSON envelope (matching the project's response shape).
@@ -10,7 +9,6 @@
  * The CLI layer is intentionally thin: it formats the output and
  * delegates the actual filesystem reads to
  * `src/services/log/log-commands-service.ts`. That service is
- * already covered by `tests/unit/log/log-commands.test.ts`.
  */
 import { join } from 'node:path';
 import { homedir } from 'node:os';
@@ -26,7 +24,6 @@ export function registerLogCommands(program, io) {
         .description("Print the last 50 lines of today's peaks-loop log (JSONL). Pass --lines N to change the count, --date YYYY-MM-DD to read a different day, --batch <id> to filter by batchId, --json to print a JSON envelope.")
         .option('--lines <n>', 'number of lines to show (default 50)', (value) => Number(value))
         .option('--date <YYYY-MM-DD>', 'read the log for this UTC date instead of today (PRD AC2: PEAKS_LOG_DATE_OVERRIDE)')
-        // Slice 2026-06-23-audit-4th #B2: --batch filter for cross-run
         // correlation. Without this, a user post-hoc cannot group the
         // log lines for one batch (they interleave in the JSONL file).
         .option('--batch <id>', 'filter entries by batchId (sub-agent dispatch / heartbeat / share)')).action((options) => {

package/dist/cli/commands/loop-eval-commands.js

@@ -69,7 +69,6 @@ export function registerWorkflowEvalCommands(program, io) {
     // peaks workflow graph <id>  (dry-run graph render)
     // Renamed from `plan` to `graph` to avoid collision with the existing
     // `peaks workflow plan <read|refresh|detect-trigger>` family registered
-    // by workflow-plan-commands.ts (slice 025).
     // Reuse the existing `graph` parent if `registerWorkflowLifecycleCommand`
     // already created one (it owns `peaks workflow graph show|list`).
     const existingGraph = workflow.commands.find((c) => c.name() === 'graph');
@@ -175,9 +174,7 @@ export function registerWorkflowEvalCommands(program, io) {
                     return;
                 }
                 // Sid axis AND rid axis — the join below takes TWO ids, not one.
-                // Corrected 2026-09-14 (repair R1): this comment used to say one guard
                 // covers "the whole `--capture-score` write path". The security audit of
-                // `2026-09-14-cli-id-escape-instrumentation` (F1b) measured that false —
                 // the `--session` guard passed and the `rid` slot escaped:
                 // `peaks loop eval '../../../../…/EVILCYC' --capture-score --session
                 // <legal>` created `<projectRoot>/../EVILCYC/cycles/cycle-1.json` under

package/dist/cli/commands/memory-commands.d.ts

@@ -26,7 +26,6 @@ export interface MemoryReindexCommandOptions {
     summary?: boolean;
 }
 /**
- * Slice 2026-09-10-context-audit-and-discipline (Slice B): bounded view of
  * `memory reindex`. The full report's arrays stay on disk / in the default
  * envelope; this replaces them with `{count, names}` views (≤ 2 KB).
  */

package/dist/cli/commands/memory-commands.js

@@ -11,7 +11,6 @@ import { getErrorMessage, printResult } from '../cli-helpers.js';
 import { join } from 'node:path';
 const VALID_KINDS = VALID_PROJECT_MEMORY_KINDS;
 /**
- * Slice 2026-09-10-context-audit-and-discipline (Slice B): bounded view of
  * `memory reindex`. The full report's arrays stay on disk / in the default
  * envelope; this replaces them with `{count, names}` views (≤ 2 KB).
  */

package/dist/cli/commands/observability-commands.d.ts

@@ -1,13 +1,7 @@
 /**
  * `peaks observability <subcommand>` — Slice B/C of v2.11.1.
  *
- * Slice B ships 4 read-only subcommands (AC-1 to AC-4):
- *   - `peaks observability status`         (AC-1)
- *   - `peaks observability slices`         (AC-2)
- *   - `peaks observability fanout`         (AC-3)
- *   - `peaks observability repair-cycles`  (AC-4)
  *
- * `peaks observability report` (AC-5) lands in Slice D when the
  * markdown report formatter is implemented.
  *
  * Read-only — never writes. Reads the JSONL metrics files emitted

package/dist/cli/commands/observability-commands.js

@@ -1,13 +1,7 @@
 /**
  * `peaks observability <subcommand>` — Slice B/C of v2.11.1.
  *
- * Slice B ships 4 read-only subcommands (AC-1 to AC-4):
- *   - `peaks observability status`         (AC-1)
- *   - `peaks observability slices`         (AC-2)
- *   - `peaks observability fanout`         (AC-3)
- *   - `peaks observability repair-cycles`  (AC-4)
  *
- * `peaks observability report` (AC-5) lands in Slice D when the
  * markdown report formatter is implemented.
  *
  * Read-only — never writes. Reads the JSONL metrics files emitted

package/dist/cli/commands/outer-cache-commands.js

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-08-06-session-outer-cache (G1 / G2) — per-project outer-session
  * cache CLI surface.
  *
  * Writes and reads `.peaks/_runtime/.outer-session-cache.json` so that
@@ -90,7 +89,6 @@ export function registerOuterCacheCommands(program, io) {
         const capturedAt = new Date().toISOString();
         const payload = { outerSessionId, capturedAt };
         try {
-            // Slice 2026-08-06-session-cacde8-A.5c: atomic write (temp +
             // rename) so a power-loss mid-write cannot leave the cache file
             // truncated. `atomicWriteJson` owns its own
             // `mkdirSync(dir, { recursive: true })` so the inline mkdir

package/dist/cli/commands/playwright-commands.d.ts

@@ -83,7 +83,6 @@ export declare function registerBrowserActionCommand(program: Command): void;
  * Resolve and validate a caller-supplied `--user-data-dir`. The dir must
  * live under `projectRoot` so a malicious `--user-data-dir /etc/foo`
  * cannot coerce the playwright-mcp browser into writing state to an
- * arbitrary filesystem path (slice 2026-06-23-audit-3rd #5).
  *
  * Resolves `..` segments before checking, so a path like
  * `<projectRoot>/../escape` is correctly normalized and rejected.

package/dist/cli/commands/playwright-commands.js

@@ -427,7 +427,6 @@ function isSupportedIntent(value) {
  * Resolve and validate a caller-supplied `--user-data-dir`. The dir must
  * live under `projectRoot` so a malicious `--user-data-dir /etc/foo`
  * cannot coerce the playwright-mcp browser into writing state to an
- * arbitrary filesystem path (slice 2026-06-23-audit-3rd #5).
  *
  * Resolves `..` segments before checking, so a path like
  * `<projectRoot>/../escape` is correctly normalized and rejected.

package/dist/cli/commands/polyrepo-commands.d.ts

@@ -1,7 +1,6 @@
 /**
  * `peaks polyrepo *` — polyrepo workflow CLI surface.
  *
- * Slice S2-b of RD-2 (2026-07-08 session). Three subcommands:
  *
  *   init      — scan the parent dir for child git repos + write a
  *               polyrepo manifest to `.peaks/polyrepo.json`.

package/dist/cli/commands/prd-commands.d.ts

@@ -9,7 +9,6 @@
  *   peaks prd handoff show   — print the raw handoff markdown
  *
  * Help text MUST NOT reference the legacy `peaks prd write-handoff`
- * subcommand (AC-1 in the v2.11.0 PRD). The legacy service module at
  * `services/handoff/` is a separate slice-025 layout (different
  * schema) and is intentionally not exposed here.
  */

package/dist/cli/commands/prd-commands.js

@@ -9,7 +9,6 @@
  *   peaks prd handoff show   — print the raw handoff markdown
  *
  * Help text MUST NOT reference the legacy `peaks prd write-handoff`
- * subcommand (AC-1 in the v2.11.0 PRD). The legacy service module at
  * `services/handoff/` is a separate slice-025 layout (different
  * schema) and is intentionally not exposed here.
  */
@@ -60,7 +59,6 @@ export function registerPrdCommands(program, io) {
             const body = await resolveBody(options.body);
             const projectRoot = options.project ?? process.cwd();
             const writtenAt = new Date().toISOString();
-            // B2 / F1 of `rid-b1-qa`: the ONLY production caller of `initHandoff`
             // used to pass no `gateEvidence`, so no capsule written by this command
             // ever carried the field. It is derived now — from the request type
             // recorded on this rid's PRD artifact — and `undefined` (no artifact, or
@@ -94,7 +92,12 @@ export function registerPrdCommands(program, io) {
                     bodyBytes: Buffer.byteLength(body, 'utf8'),
                     goals: handoff.frontmatter.goals,
                     acceptanceCriteria: handoff.frontmatter.acceptanceCriteria,
-                    preservedBehavior: handoff.frontmatter.preservedBehavior
+                    preservedBehavior: handoff.frontmatter.preservedBehavior,
+                    // The derived declaration is printed, not just written. A reader
+                    // deciding whether to `--apply` must be able to see which gate
+                    // keys this slice declares and at what paths; before this, the
+                    // only way to learn the five key names was to read the source.
+                    gateEvidence: handoff.frontmatter.gateEvidence ?? null
                 }), options.json);
                 return;
             }
@@ -104,7 +107,8 @@ export function registerPrdCommands(program, io) {
                 path: written.path,
                 hash: written.hash,
                 requestId: handoff.frontmatter.requestId,
-                sessionId: handoff.frontmatter.sessionId
+                sessionId: handoff.frontmatter.sessionId,
+                gateEvidence: handoff.frontmatter.gateEvidence ?? null
             }), options.json);
         }
         catch (error) {

package/dist/cli/commands/preferences-commands.js

@@ -150,7 +150,6 @@ export function registerPreferencesCommands(program) {
             const hadKey = Object.prototype.hasOwnProperty.call(raw, opts.key);
             if (hadKey) {
                 delete raw[opts.key];
-                // Slice 2026-06-23-audit-4th #A2: write atomically (tmp+rename)
                 // so a crash mid-write cannot leave a half-written file. Same
                 // pattern as preferences-service.savePreferences (post-fix) and
                 // dispatch-record-writer.writeAtomic. renameSync is imported
@@ -171,7 +170,6 @@ export function registerPreferencesCommands(program) {
             process.exit(1);
         }
     });
-    // Slice 2026-06-23-audit-4th #C1: peaks preferences migrate — apply
     // the v1 → v2 (and future) schema migration. Default is dry-run
     // (preview the change list + migrated JSON without writing); pass
     // --apply to write. Without this CLI, an old preferences.json

package/dist/cli/commands/primer-command.d.ts

@@ -1,5 +1,4 @@
 /**
- * Slice rid-statusline-stale-ux AC-2: `peaks session primer --project <path>`.
  *
  * Lightweight SessionStart primer that fires rotation + presence
  * cleanup BEFORE the first statusline render of a fresh session.

package/dist/cli/commands/primer-command.js

@@ -1,5 +1,4 @@
 /**
- * Slice rid-statusline-stale-ux AC-2: `peaks session primer --project <path>`.
  *
  * Lightweight SessionStart primer that fires rotation + presence
  * cleanup BEFORE the first statusline render of a fresh session.

package/dist/cli/commands/project-commands.js

@@ -80,7 +80,6 @@ export function registerProjectCommands(program, io) {
                 path: result.path,
                 sessionCount: result.sessionCount,
                 content: result.content,
-                // Slice 2026-07-15-project-scan-bootstrap (G1 + G2): the
                 // context command also bootstraps the project-scan tree.
                 // The envelope surfaces write counts + duration so the LLM
                 // (and the user) see what landed.

package/dist/cli/commands/qa-commands.d.ts

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-06-16-playwright-restart-loop — G1, G2, G4, G5, G6.
  *
  * `peaks qa run` — runs a peaks-qa slice for the active project.
  *

package/dist/cli/commands/qa-commands.js

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-06-16-playwright-restart-loop — G1, G2, G4, G5, G6.
  *
  * `peaks qa run` — runs a peaks-qa slice for the active project.
  *
@@ -284,7 +283,6 @@ export function registerQaCommands(program, io) {
             process.exitCode = 1;
         }
     });
-    // rid-012 (2026-07-27) — screenshot archive.
     // Enforces peaks-qa SKILL.md "Hard contracts for browser validation"
     // Contract 1: every Playwright `browser_take_screenshot` MUST land under
     // `.peaks/_runtime/<sessionId>/qa/screenshots/`, not at the project root.

package/dist/cli/commands/release-commands.js

@@ -29,17 +29,12 @@ const CANARY_PERCENTS = {
     10: 'canary-10',
     50: 'canary-50'
 };
-// rid-010 — extracted canary action handler so AC-8 can drive the canary
 // precheck-guard via direct function call (not via program.parseAsync with a
 // mocked service). Returns the result envelope for the caller to print.
 export function executeCanaryAction(opts, io, projectRoot) {
-    // rid-010 — precheck guard (Layer A or Layer B blocker refuses canary).
-    // rid-011 — changeset hard gate runs inline in the canary closure BEFORE
     // this function is called (step 0 short-circuits with CHANGESET_BLOCKED).
     // Layers C/D default warning → do not block canary; --strict upgrade would
-    // be a separate flag (out of scope for rid-011).
     // Layers C/D default warning → do not block canary; --strict upgrade would
-    // be a separate flag (out of scope for rid-010).
     const precheck = runAllLayers({ projectRoot, strict: false });
     const blockerEntry = Object.entries(precheck.layers).find(([, l]) => l.status === 'blocker');
     if (blockerEntry !== undefined) {
@@ -113,7 +108,6 @@ export function registerReleaseCommands(program, io) {
             currentStage: result.record.currentStage
         }, [], ['Run `peaks release canary --percent 10` to begin the canary phase.']), opts.json ?? false);
     });
-    // 2. canary — rid-010 wires precheck as the first step via executeCanaryAction
     addJsonOption(release
         .command('canary')
         .description('Advance the active release to a canary stage. Two percent values supported: ' +
@@ -124,7 +118,6 @@ export function registerReleaseCommands(program, io) {
         .option('--note <text>', 'optional note for the stage transition')
         .option('--project <path>', 'project root (default: cwd)')).action((opts) => {
         const projectRoot = opts.project ?? findProjectRoot(process.cwd()) ?? process.cwd();
-        // rid-011 — changeset hard gate (step 0).
         const gate = runChangesetHardGate(projectRoot);
         if (gate.state === 'staged-present') {
             process.exitCode = 1;
@@ -286,7 +279,6 @@ export function registerReleaseCommands(program, io) {
         .option('--note <text>', 'optional hotfix note')
         .option('--project <path>', 'project root (default: cwd)')).action((version, opts) => {
         const projectRoot = opts.project ?? findProjectRoot(process.cwd()) ?? process.cwd();
-        // rid-011 — changeset hard gate (step 0). No --skip-changeset-check override.
         const changesetGate = runChangesetHardGate(projectRoot);
         if (changesetGate.state === 'staged-present') {
             process.exitCode = 1;
@@ -312,7 +304,6 @@ export function registerReleaseCommands(program, io) {
             currentStage: result.record.currentStage
         }, [], ['Hotfix started at canary-10. Run `peaks release canary --percent 50` to advance.']), opts.json ?? false);
     });
-    // 8. precheck — rid-010 (Phase 4 slice 1) — 4-layer version precheck.
     addJsonOption(release
         .command('precheck')
         .description('Run the 4-layer version precheck (rootVsShared / tagCollision / ' +

package/dist/cli/commands/request-commands.d.ts

@@ -2,7 +2,6 @@ import { Command } from 'commander';
 import { type RequestArtifactSummary } from '../../services/artifacts/request-artifact-service.js';
 import { type ProgramIO } from '../cli-helpers.js';
 /**
- * Slice 2026-09-10-context-audit-and-discipline (Slice B): bounded view of
  * `request list`. `count` is the true total; `names` carries
  * `role/requestId (state)` labels for the first N entries. The full `items`
  * array (with paths + timestamps) is one flag away — omit `--summary`.