peaks-loop 4.1.1 → 4.1.2

package/dist/services/web/web-daemon-service.js

@@ -1,6 +1,5 @@
 /**
  * The `peaks web` daemon: loopback HTTP server, op routing, shutdown
- * (slice S2, file 16).
  *
  * One daemon per `(projectRoot, sessionId)` (design §10.2). It binds
  * `127.0.0.1:0` — an OS-assigned port, loopback only — and writes

package/dist/services/web/web-fallback.d.ts

@@ -1,5 +1,4 @@
 /**
- * The degradation chain, in one place (slice S3, file 19; AC5, tech-doc §5.4).
  *
  * Design §6 orders the chain: 1 local browser → 2 lazy download → 3 MCP
  * fallback → 4 explicit error + install guidance. Orchestrator decision C3 is

package/dist/services/web/web-fallback.js

@@ -1,5 +1,4 @@
 /**
- * The degradation chain, in one place (slice S3, file 19; AC5, tech-doc §5.4).
  *
  * Design §6 orders the chain: 1 local browser → 2 lazy download → 3 MCP
  * fallback → 4 explicit error + install guidance. Orchestrator decision C3 is

package/dist/services/web/web-install-service.js

@@ -1,6 +1,5 @@
 /**
  * Browser acquisition: the disable gate, the cache probe and the one-time
- * chromium install (slice S3, file 18; AC5, R2, R6).
  *
  * Three properties this module owns, all of them testable without a browser:
  *

package/dist/services/web/web-login-profile.js

@@ -1,6 +1,5 @@
 /**
  * The persistent login profile — its name guard, and the headed login that
- * produces it (slice S4, file 20; design §2/§5/§10.2, orchestrator decision C1).
  *
  * Two halves, one responsibility ("a profile the user explicitly asked to keep"):
  *

package/dist/services/web/web-protocol.d.ts

@@ -1,6 +1,5 @@
 /**
  * The `peaks web` daemon contract — on-disk (`daemon.json`) and on-the-wire
- * (`POST /op`) in one place (slice S1, files 5/6).
  *
  * `parseDaemonInfo` validates both shape and `PROTOCOL_VERSION`, so a daemon
  * left over from an older protocol is rejected (and therefore killed and

package/dist/services/web/web-protocol.js

@@ -1,6 +1,5 @@
 /**
  * The `peaks web` daemon contract — on-disk (`daemon.json`) and on-the-wire
- * (`POST /op`) in one place (slice S1, files 5/6).
  *
  * `parseDaemonInfo` validates both shape and `PROTOCOL_VERSION`, so a daemon
  * left over from an older protocol is rejected (and therefore killed and

package/dist/services/web/web-status-report.js

@@ -1,6 +1,5 @@
 /**
  * `peaks web status` — which daemon instances exist for this session, and which
- * of them are still real (slice S2, file 17).
  *
  * The three states are the three states of the loopback protocol (tech-doc
  * §1.3): `live` (pid alive AND `/health` answers), `orphaned` (pid alive,

package/dist/services/workflow/artifact-paths.js

@@ -1,5 +1,4 @@
 /**
- * Cross-slice artifact path resolvers (slice 025 — Security + Perf
  * Plan/Result split).
  *
  * The plan/result split introduces per-request `<rid>`-suffixed QA
@@ -36,7 +35,6 @@ const PERFORMANCE_FINDINGS_BASE = 'performance-findings';
  * fallback for un-migrated workspaces. The legacy misplaced
  * `.peaks/<sessionId>/qa/` form was a pre-1.3.0 write-path bug.
  *
- * Slice 2026-06-29-change-id-root-removal: the legacy
  * `peaks workspace migrate-change-scope` migration tool is gone;
  * operators must move misplaced dirs into the canonical location
  * by hand (or via `peaks workspace migrate`).
@@ -146,7 +144,6 @@ export function resolvePerformanceFindingsPath(args) {
  * log a warning when the legacy form is the one consumed.
  */
 export function lazyMigrateLegacyFindings(args) {
-    // Slice 2026-06-28: lazy migration operates on the canonical QA dir.
     const qaDir = canonicalQaDir(args.projectRoot, args.sessionId);
     const legacyPath = join(qaDir, args.legacyFile);
     const suffixedPath = join(qaDir, args.suffixedFile(args.rid));

package/dist/services/workflow/autonomous-resume-writer.js

@@ -108,7 +108,6 @@ Next actions:
 `;
 }
 function buildFiles(sessionId, goal, createdAt, artifactWorkspacePath) {
-    // Slice 2026-06-29-change-id-root-removal: route every reviewable
     // artifact under the session-axis dir at `.peaks/_runtime/<sid>/...`
     // via `getSessionDir`. The change-id identifier is reused as the
     // session-dir name (per-execution scope). The gitignore rule on
@@ -143,7 +142,6 @@ function buildFiles(sessionId, goal, createdAt, artifactWorkspacePath) {
     ];
 }
 export async function writeAutonomousResumeArtifacts(request) {
-    // Slice 2026-06-29-change-id-root-removal: change-id is metadata-only;
     // structural validation for the session id is a path-safety check
     // (no path-traversal / no absolute path) so unsafe ids never escape
     // the canonical `.peaks/_runtime/<sid>/` scope.

package/dist/services/workflow/pipeline-verify-gate-support.d.ts

@@ -4,16 +4,13 @@
  * Private helpers used by the slimmed `pipeline-verify-service.ts`
  * orchestrator. NOT publicly re-exported; not part of the public API
  * surface. Kept in a sibling file so the orchestrator can stay under
- * the 400-line file-size cap (rid-006 split).
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 import { type ArtifactPrerequisite, type RequestType } from '../artifacts/artifact-prerequisites.js';
 import type { RequestArtifactRole, RequestArtifactState } from '../artifacts/request-artifact-service.js';
 import type { PipelineGate } from './pipeline-verify-types.js';
 export declare function extractState(markdown: string): string;
 /**
- * As of slice 2026-06-05-change-id-as-unit-of-work, the file's durable
  * scope is the change-id (the `.peaks/_runtime/<sessionId>/` dir the file lives
  * in), NOT the session-id. We resolve the on-disk location via
  * `showRequestArtifact` (which scans all top-level dirs and returns the
@@ -46,7 +43,6 @@ export declare function findRequestFile(projectRoot: string, role: string, rid:
  * to a `legacyRelativePath` fallback of `audit/security.md`, and it kept
  * demanding `qa/security-findings-<rid>.md` / `qa/performance-findings-<rid>.md`
  * after the v2.11.0 D1/D4 trim dropped them from `qa:verdict-issued`
- * altogether (rid 2026-09-14-verify-pipeline-contract-drift).
  */
 /**
  * The prerequisite the contract carries for `probeName`, or null when it
@@ -61,7 +57,6 @@ export declare function rdGatesForType(requestType: RequestType): PipelineGate[]
 export declare function qaGatesForType(requestType: RequestType): PipelineGate[];
 export declare const RD_QA_HANDOFF_STATES: Set<string>;
 export declare const QA_COMPLETE_STATES: Set<string>;
-/** Tracker for canonical-path compliance (slice 2026-06-28-code-mode-bypass-fix). */
 export interface CanonicalPathTracker {
     anyEvidenceResolved: boolean;
     allResolvedPathsCanonical: boolean;

package/dist/services/workflow/pipeline-verify-gate-support.js

@@ -4,9 +4,7 @@
  * Private helpers used by the slimmed `pipeline-verify-service.ts`
  * orchestrator. NOT publicly re-exported; not part of the public API
  * surface. Kept in a sibling file so the orchestrator can stay under
- * the 400-line file-size cap (rid-006 split).
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
@@ -17,7 +15,6 @@ export function extractState(markdown) {
     return readArtifactState(markdown) ?? 'unknown';
 }
 /**
- * As of slice 2026-06-05-change-id-as-unit-of-work, the file's durable
  * scope is the change-id (the `.peaks/_runtime/<sessionId>/` dir the file lives
  * in), NOT the session-id. We resolve the on-disk location via
  * `showRequestArtifact` (which scans all top-level dirs and returns the
@@ -32,7 +29,6 @@ export async function findRequestFile(projectRoot, role, rid) {
     });
     if (artifact === null)
         return null;
-    // Slice 2026-06-28-code-mode-bypass-fix (defect #3) used to strip a
     // `_runtime/` prefix here, because `showRequestArtifact` then returned the
     // FULL SCOPE (`_runtime/<sid>`) as `sessionId`. Repair R5 removed that
     // round-trip at its source: `readSummary` now builds the summary from the
@@ -64,7 +60,6 @@ export async function findRequestFile(projectRoot, role, rid) {
  * to a `legacyRelativePath` fallback of `audit/security.md`, and it kept
  * demanding `qa/security-findings-<rid>.md` / `qa/performance-findings-<rid>.md`
  * after the v2.11.0 D1/D4 trim dropped them from `qa:verdict-issued`
- * altogether (rid 2026-09-14-verify-pipeline-contract-drift).
  */
 /**
  * The prerequisite the contract carries for `probeName`, or null when it
@@ -124,7 +119,6 @@ export function rdGatesForType(requestType) {
         }
     ];
     // This slot used to pin a `tech-doc` gate to `rd/tech-doc.md`, an artifact
-    // v2.11.0 Group A retired and the table no longer carries — so the gate
     // failed trees `peaks request transition` accepts (QA repair cycle 1). The
     // design / scope record the contract DOES name at `rd:qa-handoff` is
     // `prd/handoff.md`, so that is the gate: table-derived, like the others.
@@ -168,8 +162,6 @@ export function rdGatesForType(requestType) {
     }
     // The perf evidence the contract requires at `rd:qa-handoff` is `AUDIT_PERF`
     // — `audit/perf-<rid>.md`, with `audit/perf.md` and `rd/perf-baseline.md` as
-    // its two declared legacy tiers (rid-scoped since slice
-    // `2026-09-14-audit-artifact-rid-scoping`). This gate used to live on the QA
     // side as `performance-findings`, checking `qa/performance-findings-<rid>.md`
     // — a path the v2.11.0 D1/D4 trim dropped. Relocating the gate (rather than
     // deleting it) is what keeps AC3's control meaningful: perf evidence that is
@@ -203,13 +195,10 @@ export function qaGatesForType(requestType) {
         });
     }
     // The `security-findings` / `performance-findings` gates were removed here
-    // (rid 2026-09-14-verify-pipeline-contract-drift). peaks-qa does not own
     // security review or performance review — `peaks-qa/SKILL.md` says so, and
     // the v2.11.0 D1/D4 trim dropped both from every `qa:verdict-issued` table.
     // The evidence they used to demand is now checked on the RD side, at the
     // paths the contract actually names (`audit/security-<rid>.md`,
-    // `audit/perf-<rid>.md`; rid-scoped since slice
-    // `2026-09-14-audit-artifact-rid-scoping`, with `audit/security.md` /
     // `audit/perf.md` and `rd/security-review.md` / `rd/perf-baseline.md` as the
     // declared legacy tiers behind them).
     return gates;

package/dist/services/workflow/pipeline-verify-service.d.ts

@@ -1,5 +1,4 @@
 /**
- * peaks-workflow — pipeline verification orchestrator (slimmed per rid-006).
  *
  * `verifyPipeline` resolves RD / QA evidence files for a given rid and
  * returns a structured `PipelineVerification` envelope. Type
@@ -11,7 +10,6 @@
  * bottom preserves the original public surface so existing import
  * paths compile unchanged.
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 import type { PipelineVerification } from './pipeline-verify-types.js';
 export declare function verifyPipeline(options: {

package/dist/services/workflow/pipeline-verify-service.js

@@ -1,5 +1,4 @@
 /**
- * peaks-workflow — pipeline verification orchestrator (slimmed per rid-006).
  *
  * `verifyPipeline` resolves RD / QA evidence files for a given rid and
  * returns a structured `PipelineVerification` envelope. Type
@@ -11,7 +10,6 @@
  * bottom preserves the original public surface so existing import
  * paths compile unchanged.
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 import { isRequestType } from '../artifacts/artifact-prerequisites.js';
 import { readSkipState } from './workflow-state-store.js';
@@ -26,7 +24,6 @@ export async function verifyPipeline(options) {
     const nextActions = [];
     const rdGates = rdGatesForType(requestType);
     const qaGates = qaGatesForType(requestType);
-    // Slice 2026-06-13-peaks-workflow-skip: read the skip-state (if any)
     // and pre-mark matching gates as `status: 'skipped'`. We do this
     // BEFORE evaluating evidence files, so a skipped gate never
     // emits a "missing evidence" violation. The boolean `passed` is
@@ -125,7 +122,6 @@ export async function verifyPipeline(options) {
     }
     // Check QA evidence files. (The v2.18.1 bug #5 `changeIdForResolver`
     // fallback — current session id when no RD/QA artifact is on disk yet —
-    // was dropped by rid 2026-09-14-verify-pipeline-contract-drift along with
     // the security/perf findings branch that was its only consumer.)
     const qaTracker = resolveQaEvidencePaths(qaGates, options.projectRoot, rdEvidenceDir, requestType, options.rid, violations, nextActions, rdTracker);
     const anyEvidenceResolved = qaTracker.anyEvidenceResolved;
@@ -136,11 +132,9 @@ export async function verifyPipeline(options) {
         nextActions.push(`Complete QA gates → peaks request transition ${options.rid} --role qa --state verdict-issued`);
     }
     // RD invoked without QA — check is moved to AFTER markIfSkipped
-    // (slice 2026-06-13-peaks-workflow-skip) because the gate.status
     // values are only final after the post-process pass. We track the
     // decision with a placeholder here and resolve it below.
     const rdInvokedWithoutQaRaw = rdInvoked && !qaInvoked;
-    // Slice 2026-06-13-peaks-workflow-skip: post-process. For any gate
     // the user marked as skipped, override the evaluation result. The
     // boolean `passed` is set to true so the gate counts as satisfied;
     // the new `status: 'skipped'` field signals the bypass to
@@ -172,7 +166,6 @@ export async function verifyPipeline(options) {
     }
     // Resolve the "RD invoked without QA" check now that markIfSkipped
     // has run. The check is suppressed when every QA gate is skipped
-    // (slice 2026-06-13-peaks-workflow-skip: the user explicitly chose
     // to skip the QA phase).
     if (rdInvokedWithoutQaRaw) {
         const allQaSkipped = qaGates.every((g) => g.status === 'skipped');
@@ -181,11 +174,9 @@ export async function verifyPipeline(options) {
             nextActions.push('MUST invoke Skill(skill="peaks-qa") before declaring workflow complete');
         }
     }
-    // Slice 002 (v2.15.0) AC-3 — Gate H "feedback-promotion". Scans
     // `.peaks/memory/*.md` for `metadata.type === 'feedback'` entries
     // that lack a promotion marker (HTML comment or `.promotion.json`
     // sidecar) OR whose marker is not backed by the layer's artifact
-    // (rid 2026-09-14-gate-h-promotion). When any such feedback is
     // found, the gate fails and the pipeline does not complete until the
     // user promotes via `peaks feedback promote <memory-file> --layer
     // <A|B|C>` — which now produces the artifact, not just the marker.
@@ -203,7 +194,6 @@ export async function verifyPipeline(options) {
     ];
     try {
         const unpromoted = listUnpromotedFeedback({ projectRoot: options.projectRoot });
-        // rid 2026-09-14-gate-h-promotion (classify slice): memories that declare
         // themselves out of the gate are reported, never dropped. An exemption the
         // gate does not show would be indistinguishable from a fixed violation.
         const exempt = listPromotionExempt({ projectRoot: options.projectRoot });
@@ -215,7 +205,6 @@ export async function verifyPipeline(options) {
             feedbackGates[0].detail = `0 unpromoted feedback memories in .peaks/memory/${exemptNote}`;
         }
         else {
-            // rid 2026-09-14-gate-h-promotion: the gate no longer passes on a marker
             // alone. `listUnpromotedFeedback` now also reports markers whose layer
             // artifact is absent, so `unpromoted` mixes "never promoted" with
             // "promoted on paper only" — the reason on each entry says which.
@@ -243,15 +232,12 @@ export async function verifyPipeline(options) {
         allFeedbackGatesPassed &&
         RD_QA_HANDOFF_STATES.has(rdState) &&
         QA_COMPLETE_STATES.has(qaState);
-    // Slice 025 — derive the `acceptedForm` and `gateC` verdict. The form is
     // 'suffixed' when the contract's current path served the file and 'legacy'
     // when the deprecated fallback did; 'none' if neither gate passed.
     //
-    // rid 2026-09-14-verify-pipeline-contract-drift: the two gates moved from the
     // QA phase to the RD phase, because that is where the current contract puts
     // the evidence (`AUDIT_SECURITY` / `AUDIT_PERF` at `rd:qa-handoff`). The
     // `-<rid>.md` suffix that used to distinguish the forms is a real one again
-    // after slice `2026-09-14-audit-artifact-rid-scoping` rid-scoped the audit
     // paths; the resolver marks which form served the file with
     // `[LEGACY_EVIDENCE_PATH]`.
     const secGate = rdGates.find((g) => g.name === 'security-review');
@@ -266,7 +252,6 @@ export async function verifyPipeline(options) {
             : 'suffixed';
     const gateC = allQaGatesPassed ? 'pass' : 'fail';
     const gateH = allFeedbackGatesPassed ? 'pass' : 'fail';
-    // Slice 2026-06-28-code-mode-bypass-fix (defect #3): `true` when
     // every gate resolved on the canonical path; `false` when at least
     // one fell back to a legacy form. QA / TXT surface the value so the
     // user knows the legacy content must be moved into the canonical

package/dist/services/workflow/pipeline-verify-types.d.ts

@@ -3,9 +3,7 @@
  *
  * Pure type module. No runtime helpers, no constants. The slimmed
  * `pipeline-verify-service.ts` re-exports the types so existing
- * import paths compile unchanged (rid-006 split).
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 import type { RequestType } from '../artifacts/artifact-prerequisites.js';
 export type PipelineGate = {
@@ -14,7 +12,6 @@ export type PipelineGate = {
     passed: boolean;
     detail: string;
     /**
-     * Slice 2026-06-13-peaks-workflow-skip: optional status that
      * distinguishes a gate that was BYPASSED via `peaks workflow skip`
      * from one that actually passed evaluation. When set, the gate
      * was NOT evaluated by `evaluateGate` — the user/CLI explicitly
@@ -47,12 +44,10 @@ export type PipelineVerification = {
         gates: PipelineGate[];
     };
     /**
-     * Slice 002 (v2.15.0) AC-3: Gate H "feedback-promotion". Always
      * present (single-element array). Evaluates whether every
      * `metadata.type === 'feedback'` memory in `.peaks/memory/`
      * carries a promotion marker (comment OR sidecar) AND whether the
      * layer that marker claims is actually backed by its artifact
-     * (rid 2026-09-14-gate-h-promotion). Failures block the `complete`
      * verdict via the `gateH` field below; the pipeline only completes
      * when every gate in this array passes.
      */
@@ -62,12 +57,10 @@ export type PipelineVerification = {
     violations: string[];
     nextActions: string[];
     /** Form of the security/performance evidence the RD gates accepted
-     * (slice 025). `'suffixed'` when the current contract's path served the
      * file, `'legacy'` when a deprecated fallback did, `'none'` when neither
      * gate passed. The per-rid `<rid>.md` suffix the union was named after was
      * retired with `qa/security-findings-<rid>.md` (v2.11.0 D1/D4); the evidence
      * now lives at `audit/security-<rid>.md` / `audit/perf-<rid>.md`
-     * (rid-scoped since slice `2026-09-14-audit-artifact-rid-scoping`) with
      * `audit/security.md` / `audit/perf.md` and
      * `rd/security-review.md` / `rd/perf-baseline.md` as the declared legacy
      * fallbacks (rid 2026-09-14-verify-pipeline-contract-drift). */
@@ -75,13 +68,11 @@ export type PipelineVerification = {
     /** `gateC` is the pre-computed verdict string (AC7 dogfood shape). */
     gateC?: 'pass' | 'fail';
     /**
-     * Slice 002 (v2.15.0) AC-3: Gate H verdict string. `'pass'` when
      * all feedback memories are promoted; `'fail'` when at least one
      * unpromoted feedback memory was found.
      */
     gateH?: 'pass' | 'fail';
     /**
-     * Slice 2026-06-28-code-mode-bypass-fix (defect #3): `true` when
      * every evidence file resolved on the canonical path
      * (`.peaks/_runtime/change/<sessionId>/...`). `false` when at least
      * one evidence file resolved via a legacy fallback (`.peaks/<sessionId>/...`
@@ -89,7 +80,6 @@ export type PipelineVerification = {
      * so users know to move misplaced evidence into the canonical
      * location.
      *
-     * Slice 2026-06-29-change-id-root-removal: the legacy
      * `peaks workspace migrate-change-scope` migration tool is gone;
      * users must now move misplaced content into the canonical
      * `.peaks/_runtime/change/<sessionId>/<role>/` dir manually (or via

package/dist/services/workflow/pipeline-verify-types.js

@@ -3,8 +3,6 @@
  *
  * Pure type module. No runtime helpers, no constants. The slimmed
  * `pipeline-verify-service.ts` re-exports the types so existing
- * import paths compile unchanged (rid-006 split).
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 export {};

package/dist/services/workflow/plan-reader.d.ts

@@ -2,7 +2,6 @@ import { type ResultEnvelope } from 'peaks-loop-shared/result';
 export type PlanType = 'security' | 'perf';
 /** Back-compat env-var. When set to "1", fall back to legacy paths. */
 export declare const BACK_COMPAT_FLAG = "PEAKS_PLAN_LEGACY_FALLBACK";
-/** F-1 (slice 025 security): canonical session-id shape. */
 export declare const SESSION_ID_PATTERN: RegExp;
 export interface ReadPlanArgs {
     readonly type: PlanType;

package/dist/services/workflow/plan-reader.js

@@ -1,5 +1,4 @@
 /**
- * `peaks workflow plan read` — slice 025 (Security + Perf Plan/Result split).
  *
  * Returns the envelope `{ exists, path, hash, refreshedAt }` for the
  * session-scoped security-test-plan or perf-baseline plan. The hash is
@@ -19,7 +18,6 @@ import { fail, ok } from 'peaks-loop-shared/result';
 import { getSessionDir } from '../session/getSessionDir.js';
 /** Back-compat env-var. When set to "1", fall back to legacy paths. */
 export const BACK_COMPAT_FLAG = 'PEAKS_PLAN_LEGACY_FALLBACK';
-/** F-1 (slice 025 security): canonical session-id shape. */
 export const SESSION_ID_PATTERN = /^\d{4}-\d{2}-\d{2}-[a-z][a-z0-9-]*[a-z0-9]$/;
 const PLAN_FILE = {
     security: 'security-test-plan.md',
@@ -60,7 +58,6 @@ function buildData(args) {
     };
 }
 /**
- * F-2 (slice 025 security): resolve symlinks and confirm the real path
  * still lives under the expected base directory. A canonical path
  * may itself be a symlink (or a directory in the path chain may be),
  * which would let a malicious or accidental symlink escape the
@@ -85,7 +82,6 @@ function assertContained(args) {
             message: `resolved path escapes base directory: cannot resolve ${args.path}`
         };
     }
-    // Slice 2026-06-13-repair-pre-existing-test-failures: realpath the
     // expectedBase too. On macOS the OS exposes /tmp and
     // /var/folders/... as symlinks to /private/tmp and
     // /private/var/folders/.... `mkdtempSync` returns the unresolved
@@ -112,7 +108,6 @@ function assertContained(args) {
     return { ok: true, real };
 }
 export function readPlan(args) {
-    // F-1 (slice 025 security): reject path-traversal payloads before any
     // filesystem call. The CLI also validates, but the service is the
     // authoritative gate — every caller (CLI, skill, integration test)
     // benefits from the same rejection shape.

package/dist/services/workflow/plan-refresher.js

@@ -1,5 +1,4 @@
 /**
- * `peaks workflow plan refresh` — slice 025 (Security + Perf Plan/Result split).
  *
  * Deterministically regenerates a security-test-plan or perf-baseline
  * plan body. Without `--apply`, computes the would-be body + hash but
@@ -226,7 +225,6 @@ export function refreshPlan(args) {
             bodyPreview: rawBody
         });
     }
-    // F-2 (slice 025 security): if the parent dir chain has a symlink
     // that escapes the session dir, refuse to write. We resolve the
     // parent (the dir we are about to mkdir/write into) and confirm its
     // real path stays under the expected base.

package/dist/services/workflow/plan-trigger-detector.d.ts

@@ -1,5 +1,4 @@
 /**
- * `peaks workflow plan detect-trigger` — slice 025 (Security + Perf
  * Plan/Result split).
  *
  * Compares the current project state (filesystem + package.json) to the
@@ -13,7 +12,6 @@
  */
 import { type ResultEnvelope } from 'peaks-loop-shared/result';
 export type TriggerReason = 'new-dependency' | 'auth-surface-added' | 'hot-path-added' | 'manual-override' | 'no-change' | 'no-triggering-change';
-/** F-1 (slice 025 security): canonical request-id shape. */
 export declare const REQUEST_ID_PATTERN: RegExp;
 export interface DetectTriggerArgs {
     readonly project: string;

package/dist/services/workflow/plan-trigger-detector.js

@@ -1,5 +1,4 @@
 /**
- * `peaks workflow plan detect-trigger` — slice 025 (Security + Perf
  * Plan/Result split).
  *
  * Compares the current project state (filesystem + package.json) to the
@@ -14,7 +13,6 @@
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { join } from 'node:path';
 import { fail, ok } from 'peaks-loop-shared/result';
-/** F-1 (slice 025 security): canonical request-id shape. */
 export const REQUEST_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
 const SENSITIVE_SERVICE_DIRS = ['auth', 'security', 'secrets', 'payments', 'filesystem'];
 function readPackageJson(projectRoot) {
@@ -113,7 +111,6 @@ function findNewHotPathFile(diff) {
     return null;
 }
 export function detectTrigger(args) {
-    // F-1 (slice 025 security): reject traversal/separator payloads at
     // the service boundary so every caller (CLI, skill, integration test)
     // gets the same rejection shape.
     if (!REQUEST_ID_PATTERN.test(args.rid)) {

package/dist/services/workflow/workflow-autonomous-resume-helpers.js

@@ -15,7 +15,6 @@
  */
 import { closeSync, fstatSync, lstatSync, openSync, readSync, realpathSync, statSync } from 'node:fs';
 import { isAbsolute, relative, resolve } from 'node:path';
-// Slice 2026-06-29-change-id-root-removal: `buildArtifactRelativePath`
 // was removed with the change-id axis. The artifact under each
 // resume helper now resolves the absolute path via the session-axis
 // `getSessionDir` + an explicit role-relative segment; the
@@ -25,7 +24,6 @@ import { getSessionDir } from '../session/getSessionDir.js';
 import { normalizePath } from '../../shared/path-utils.js';
 import { extractMarkdownListSection, getCheckpointValidationRefs, getMarkdownBody, isValidResumeArtifact } from './workflow-autonomous-resume-validation.js';
 const MAX_RESUME_ARTIFACT_BYTES = 256_000;
-// Slice 2026-06-29-change-id-root-removal: return the bare role-relative
 // sub-paths instead of `.peaks/_runtime/change/<id>/<role>/...` strings.
 // `getResumeRequiredArtifacts` was previously consumed by callers that
 // joined the descriptor with the on-disk session dir computed by
@@ -60,7 +58,6 @@ function readFully(fd, size) {
     return buffer.toString('utf8');
 }
 function normalizeRoleRelativePath(artifact, _sessionId) {
-    // Slice 2026-06-29-change-id-root-removal: `getResumeRequiredArtifacts`
     // returns role-relative sub-paths (e.g.
     // `rd/swarm/checkpoints/checkpoint-1.json`). The helper normalises
     // the path separators and strips any leading `/`; the `sessionId`
@@ -69,7 +66,6 @@ function normalizeRoleRelativePath(artifact, _sessionId) {
     return normalizePath(artifact).replace(/^\/+/, '');
 }
 function readResumeArtifact(artifactWorkspacePath, sessionId, artifact) {
-    // Slice 2026-06-29-change-id-root-removal: on-disk home now lives under
     // the session-axis `getSessionDir(root, sessionId)`. The role/swarm
     // sub-path (e.g. `rd/swarm/checkpoints/checkpoint-1.json`) is
     // strictly a sub-root drill, not a top-level dir derivation.
@@ -150,7 +146,6 @@ function getResumeArtifactsStatus(artifactWorkspacePath, requiredArtifacts, sess
     let hasInvalidArtifact = false;
     const artifactContents = new Map();
     for (const artifact of requiredArtifacts) {
-        // Slice 2026-06-29-change-id-root-removal: pass the explicit
         // sessionId so `readResumeArtifact` can route through `getSessionDir`
         // rather than guessing from path segments. The prefix-strip is now
         // a simple `/` + backslash normaliser since descriptors are

package/dist/services/workflow/workflow-autonomous-service.js

@@ -1,5 +1,4 @@
 import { join } from 'node:path';
-// Slice 2026-06-29-change-id-root-removal: `validateChangeIdOrThrow`
 // was removed with the change-id axis. Path-safety helpers now live
 // at `shared/path-safety.ts` if this module ever needs them.
 import { WORKSPACE_UNAVAILABLE_NEXT_ACTIONS } from '../../shared/planner-response.js';
@@ -236,7 +235,6 @@ function uniqueStrings(values) {
     return [...new Set(values)];
 }
 export function createAutonomousWorkflowPlan(request) {
-    // Slice 2026-06-29-change-id-root-removal: change-id is metadata-only;
     // no structural validation gate fires here.
     const goal = normalizeGoal(request.goal);
     const maxWorkers = request.maxWorkers ?? 40;

package/dist/services/workflow/workflow-autonomous-types.d.ts

@@ -3,7 +3,6 @@
  *
  * Pure type module. No runtime helpers, no constants. The slimmed
  * `workflow-autonomous-service.ts` re-exports the types so existing
- * import paths compile unchanged (rid-006 split).
  *
  * Per PRD EC-1, this module is consumed by both
  * `workflow-autonomous-service.ts` and
@@ -12,7 +11,6 @@
  * resume-helpers ↔ autonomous-service runtime cycle (both modules
  * previously re-exported `AutonomousResumePlan` from each other).
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 import type { CapabilityItemType } from '../recommendations/recommendation-types.js';
 import type { ModelProviderConfig, WorkspaceConfig } from '../config/config-types.js';

package/dist/services/workflow/workflow-autonomous-types.js

@@ -3,7 +3,6 @@
  *
  * Pure type module. No runtime helpers, no constants. The slimmed
  * `workflow-autonomous-service.ts` re-exports the types so existing
- * import paths compile unchanged (rid-006 split).
  *
  * Per PRD EC-1, this module is consumed by both
  * `workflow-autonomous-service.ts` and
@@ -12,7 +11,6 @@
  * resume-helpers ↔ autonomous-service runtime cycle (both modules
  * previously re-exported `AutonomousResumePlan` from each other).
  *
- * File budget: ≤ 400 lines (rid-006 split).
  */
 export {};
 // Note: `CapabilityAvailabilityStatus` is referenced by the orchestrator's

package/dist/services/workflow/workflow-graph-types.d.ts

@@ -42,7 +42,6 @@ export interface WorkflowGraph {
 }
 /**
  * `id` regex: ASCII letters, digits, dot, underscore, hyphen; 1-200 chars.
- * Excludes path separators / NUL / whitespace / Unicode (per D1 of the
  * caller-id contract — node ids appear in file paths).
  */
 export declare const NODE_ID_REGEX: RegExp;

package/dist/services/workflow/workflow-graph-types.js

@@ -35,7 +35,6 @@ export const GRAPH_NODE_STATUSES = [
 ];
 /**
  * `id` regex: ASCII letters, digits, dot, underscore, hyphen; 1-200 chars.
- * Excludes path separators / NUL / whitespace / Unicode (per D1 of the
  * caller-id contract — node ids appear in file paths).
  */
 export const NODE_ID_REGEX = /^[a-zA-Z0-9._-]{1,200}$/;

package/dist/services/workflow/workflow-router-service.js

@@ -2,7 +2,6 @@ import { getConfiguredExecutionModelId, getStrongestModelId } from '../config/mo
 import { getLocalArtifactPath } from '../artifacts/workspace-service.js';
 import { createRdSwarmPlan } from '../rd/rd-service.js';
 import { createTechPlan, getTechStatus } from '../tech/tech-service.js';
-// Slice 2026-06-29-change-id-root-removal: `validateChangeIdOrThrow`
 // was removed with the change-id axis. Path-safety helpers now live
 // at `shared/path-safety.ts` if this module ever needs them.
 import { WORKSPACE_UNAVAILABLE_NEXT_ACTIONS } from '../../shared/planner-response.js';
@@ -285,12 +284,10 @@ function getCodeMode(mode, codeMode) {
 export function createWorkflowRouterPlan(request) {
     assertSupportedMode(request.mode);
     assertCodeModeAllowed(request.mode, request.codeMode);
-    // Slice 2026-06-29-change-id-root-removal: change-id is metadata-only;
     // no structural validation gate fires here.
     const goal = normalizeGoal(request.goal);
     const maxWorkers = request.maxWorkers ?? 40;
     // Slice 2.0.1-bug1 round 3: project policy defaults. The slim 2.0.1 DEFAULT_CONFIG
-    // no longer carries economyMode / swarmMode (those moved to per-project preferences),
     // so we cannot fall back to `DEFAULT_CONFIG.economyMode` / `swarmMode` here. Both
     // flags are project-policy opt-outs: the absence of an explicit `false` means
     // "enabled" (matches the pre-2.0.1 implicit default).
@@ -305,7 +302,6 @@ export function createWorkflowRouterPlan(request) {
     const effectiveProviders = request.config?.providers ?? {
         anthropic: { model: 'claude-opus-4-7' }
     };
-    // Slice 2026-07-09 add-zcode-adapter (A.3): the strongest
     // planner/reviewer model is now resolved via `getStrongestModelId`,
     // which reads `config.model` (if present) or falls back to the
     // env-var-overridable default. This decouples the strongest-model

package/dist/services/workflow/workflow-skip-service.d.ts

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-06-13-peaks-workflow-skip — `peaks workflow skip` service.
  *
  * Pure-function classifier (`canSkipSlice`) + side-effecting applicator
  * (`applySkip`). Both are testable without filesystem mocks (the

package/dist/services/workflow/workflow-skip-service.js

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-06-13-peaks-workflow-skip — `peaks workflow skip` service.
  *
  * Pure-function classifier (`canSkipSlice`) + side-effecting applicator
  * (`applySkip`). Both are testable without filesystem mocks (the