peaks-loop 4.1.1 → 4.1.2

package/dist/cli/commands/session-resume-command.d.ts

@@ -1,5 +1,4 @@
 /**
- * `peaks session resume` — slice 011.
  *
  * Reads a checkpoint JSON (written by `peaks session checkpoint`) and
  * emits a structured markdown "resume context" block the skill can

package/dist/cli/commands/session-resume-command.js

@@ -1,5 +1,4 @@
 /**
- * `peaks session resume` — slice 011.
  *
  * Reads a checkpoint JSON (written by `peaks session checkpoint`) and
  * emits a structured markdown "resume context" block the skill can

package/dist/cli/commands/shadcn-commands.js

@@ -1,10 +1,8 @@
 /**
  * `peaks shadcn init` — dynamic wrapper around the upstream `shadcn` CLI.
  *
- * Slice B2 of 2026-09-09-ecc-dynamic-and-cleanup: `skills/bee/peaks-rd/SKILL.md`
  * and `references/frontend-project-generation.md` already tell RD to scaffold
  * a frontend with `peaks shadcn init --preset [CODE] --template vite`, but the
- * command did not exist and `shadcn` was not a dependency. Rather than add a
  * hard dependency, this mirrors `src/services/lint/detect-ocr-18.ts` +
  * `npx-resolver.ts`: the tool is obtained on demand via
  * `npx --package shadcn@<pin> -- shadcn ...`, so the skill reference is true

package/dist/cli/commands/share-commands.d.ts

@@ -1,7 +1,6 @@
 /**
  * `peaks sub-agent share | shared-read | await` — G8.4 + 2.7.0 await barrier.
  *
- * Pulled out of `sub-agent-commands.ts` (slice 2026-06-23-audit-p0-split)
  * to honor the 800-line file cap. These three commands share the G8.4
  * dispatcher-mediated cross-sub-agent signal channel:
  *   - `share` writes a `<role>.<event>` entry (≤ 1KB soft warn, ≥ 64KB reject).
@@ -49,7 +48,6 @@ export declare const FINALIZE_SELECTION_RULE: string;
  *
  * The branch this replaces `break`ed on the FIRST file whose record carried
  * the requestId and never looked at `status`. With a re-dispatched request
- * (this session holds six records for `2026-09-12-defect-remediation`) it
  * always resolved to the OLDEST one — the already-`done` RD record — so
  * finalizing reported success while the newer `queued` QA record stayed
  * queued forever. `--batch` never had that bug: it filters on `queued`.
@@ -65,7 +63,6 @@ export declare function registerShareCommand(parent: Command, io: ProgramIO): vo
 export declare function registerSharedReadCommand(parent: Command, io: ProgramIO): void;
 export declare function registerAwaitCommand(parent: Command, io: ProgramIO): void;
 /**
- * Slice 2026-07-17-D21: peaks sub-agent finalize — LLM-side completion
  * signal. Without this, dispatch records stay queued forever.
  *
  * Contract:

package/dist/cli/commands/share-commands.js

@@ -14,7 +14,6 @@ export const FINALIZE_SELECTION_RULE = 'prefer status=queued; among those, newes
  *
  * The branch this replaces `break`ed on the FIRST file whose record carried
  * the requestId and never looked at `status`. With a re-dispatched request
- * (this session holds six records for `2026-09-12-defect-remediation`) it
  * always resolved to the OLDEST one — the already-`done` RD record — so
  * finalizing reported success while the newer `queued` QA record stayed
  * queued forever. `--batch` never had that bug: it filters on `queued`.
@@ -71,7 +70,6 @@ export function registerShareCommand(parent, io) {
         }
         try {
             const projectRoot = options.project ?? process.cwd();
-            // Slice 2026-06-26-unknown-sid-fallback-fix: see dispatch-commands.ts.
             const sid = options.sessionId ??
                 process.env.PEAKS_SESSION_ID ??
                 getCurrentSessionId(projectRoot) ??
@@ -105,7 +103,6 @@ export function registerShareCommand(parent, io) {
                 warnings.push(`VALUE_SIZE_SOFT_WARN: ${result.entry.valueSize} > ${SHARED_CHANNEL_SOFT_VALUE_WARN} bytes`);
             }
             printResult(io, ok('sub-agent.share', {
-                // Slice 2026-06-23-audit-4th #E1: envelopeVersion marker
                 envelopeVersion: '2.1.0',
                 ok: true,
                 batchId: options.batch,
@@ -119,7 +116,6 @@ export function registerShareCommand(parent, io) {
                     options.batch +
                     '`.'
             ]), asJson);
-            // Slice 2026-06-23-audit-4th #B1: structured log on success.
             try {
                 writeLogEntry({
                     ts: new Date().toISOString(),
@@ -149,7 +145,6 @@ export function registerShareCommand(parent, io) {
     });
 }
 /**
- * Slice 2026-06-23-audit-3rd #9: branch on `error.code` so the LLM-side
  * runner gets an actionable hint instead of a generic "see error
  * message" fallback. Each branch names the most likely next step.
  */
@@ -182,7 +177,6 @@ export function registerSharedReadCommand(parent, io) {
         }
         try {
             const projectRoot = options.project ?? process.cwd();
-            // Slice 2026-06-26-unknown-sid-fallback-fix: see dispatch-commands.ts.
             const sid = options.sessionId ??
                 process.env.PEAKS_SESSION_ID ??
                 getCurrentSessionId(projectRoot) ??
@@ -197,7 +191,6 @@ export function registerSharedReadCommand(parent, io) {
                 ...(options.key !== undefined ? { keyPattern: options.key } : {})
             });
             printResult(io, ok('sub-agent.shared-read', {
-                // Slice 2026-06-23-audit-4th #E1: envelopeVersion marker
                 envelopeVersion: '2.1.0',
                 ok: true,
                 batchId: options.batch,
@@ -252,7 +245,6 @@ export function registerAwaitCommand(parent, io) {
             timeoutMs = n;
         }
         const projectRoot = options.project ?? process.cwd();
-        // Slice 2026-06-26-unknown-sid-fallback-fix: see dispatch-commands.ts.
         const sid = options.sessionId ??
             process.env.PEAKS_SESSION_ID ??
             getCurrentSessionId(projectRoot) ??
@@ -260,7 +252,6 @@ export function registerAwaitCommand(parent, io) {
         // Lazy-import IDE modules so `peaks sub-agent share` and
         // `peaks sub-agent shared-read` (the high-frequency G8.4 path) do not
         // pay for adapter resolution at module-load time. Slice
-        // 2026-06-23-audit-p0-cleanup.
         const { detectInstalledIde } = await import('../../services/ide/ide-detector.js');
         const { getAdapter } = await import('../../services/ide/ide-registry.js');
         const ide = detectInstalledIde(projectRoot) ?? 'claude-code';
@@ -274,7 +265,6 @@ export function registerAwaitCommand(parent, io) {
             return;
         }
         try {
-            // Slice 2026-09-16-n1-await-reports: resolve the batch's records from the
             // session's dispatch directory. `recordPaths` used to be hardcoded to
             // `[]`, and `awaitBatch` short-circuits on an empty list
             // (await-batch.ts:134) — so `await` reported zero results and exited 0
@@ -309,7 +299,6 @@ export function registerAwaitCommand(parent, io) {
             const results = await dispatcher.awaitBatch(input);
             const summary = summarizeBatchResults(results);
             printResult(io, ok('sub-agent.await', {
-                // Slice 2026-06-23-audit-4th #E1: envelopeVersion marker
                 envelopeVersion: '2.1.0',
                 batchId: options.batch,
                 ide: dispatcher.label,
@@ -321,7 +310,6 @@ export function registerAwaitCommand(parent, io) {
                     `${scan.unreadable.length} unreadable dispatch record(s) in this session were skipped and are NOT part of the results: ${scan.unreadable.join(', ')}`
                 ]
                 : [], [
-                // Slice 2026-09-15-s9: corrected. This used to tell users that the
                 // four non-Claude IDEs would report `awaitByLlm: <ide> 1.2 fallback`,
                 // the slice-1.2 marker that slice 1.3 replaced with a real
                 // file-polling await. The text survived because nothing tested it —
@@ -371,7 +359,6 @@ function safeRecordPath(p) {
     }
 }
 /**
- * Slice 2026-09-16-n1-await-reports: which on-disk records belong to a batch.
  *
  * Reuses the conventions already in the repo instead of inventing a new one:
  *   - records live at `.peaks/_sub_agents/<sid>/dispatch-<rid>-<ts>.json`

package/dist/cli/commands/skill-search-commands.d.ts

@@ -2,8 +2,6 @@
  * peaks skill search — CLI primitive for S0 of the 4.0.0-beta.5
  * peaks-solo dispatcher release.
  *
- * Spec: docs/superpowers/specs/2026-07-08-peaks-solo-dispatcher-design.md §3.2
- * Plan: docs/superpowers/plans/2026-07-08-peaks-solo-dispatcher/s0-skill-search-cli.md
  *
  * Wired into the existing `peaks skill` group by
  * `src/cli/commands/core/skill-command.ts` (one import + one call).

package/dist/cli/commands/slice-commands.js

@@ -68,7 +68,6 @@ export function registerSliceCommands(program, io) {
             process.exitCode = 1;
         }
     });
-    // ---------- peaks slice ls (slice 2026-06-27-slice-ls) ----------
     // Read-only listing of every decomposition artifact under
     // .peaks/sc/slice-decomposition/. Used by operators to see what's
     // accumulated; companion to a future `peaks slice cleanup` subcommand.
@@ -393,7 +392,6 @@ function writeDecompositionFile(rid, result, projectRoot) {
 }
 /**
  * Stale threshold for slice decomposition artifacts. Matches the default
- * retention window promised by `peaks slice cleanup` (slice 2026-06-27-slice-cleanup,
  * recorded in .peaks/memory/ for follow-up). If that slice ships with a
  * different default, both must update here.
  */

package/dist/cli/commands/slice-integrate-commands.js

@@ -26,7 +26,6 @@ function loadContractsForSlices(projectRoot, sessionId, sliceIds) {
     for (const sliceId of sliceIds) {
         // Slice-id axis: the id becomes the FILENAME below, so `--slices a,../..`
         // reads a JSON file outside the contracts dir. Guarded 2026-09-14 (repair
-        // R1, security audit F3 of `2026-09-14-cli-id-escape-instrumentation`) —
         // the session guard above covers the other axis and this one was open.
         // Skipped with a warning rather than thrown, matching this function's
         // existing contract for a contract it cannot read.

package/dist/cli/commands/spill-demo-command.d.ts

@@ -1,5 +1,4 @@
 /**
- * Rid-032: opt-in spill/hydrate round-trip for 24h mode.
  * This demo command is additive; existing deferral behavior is unchanged.
  */
 import type { Command } from 'commander';

package/dist/cli/commands/statusline-commands.js

@@ -106,7 +106,6 @@ export async function runDefaultStatuslineRender(options, io) {
     const seeded = options.project
         ? { ...(stdin ?? {}), workspace: { current_dir: options.project } }
         : stdin;
-    // Slice 2026-08-07-statusline-flake: accept `--now <epoch-ms>` to pin
     // `Date.now()` for deterministic lifecycle-window checks under full-
     // suite concurrency. The integration test passes a test-time `now`
     // pinned at the moment `seedLifecycle` was called so the completed-
@@ -114,7 +113,6 @@ export async function runDefaultStatuslineRender(options, io) {
     // subprocess sat descheduled. Production callers omit the flag.
     const now = options.now !== undefined ? Number(options.now) : Date.now();
     const model = buildStatusLineModel(seeded, now);
-    // Slice 2026-09-13-statusline-window-witness (AC1): capture the harness's OWN
     // context numbers from the payload it just piped in. The project root and the
     // canonical session id are taken from the model that was JUST built, so the
     // witness lands under the same session this render already resolved — a second
@@ -261,7 +259,6 @@ export function registerStatusLineCommands(program, io) {
             process.exitCode = 1;
         }
     });
-    // peaks statusline compact (slice 2026-07-30-compact-visibility)
     //
     // --session-id contract: this flag is registered on the compact
     // subcommand but NOT on the default `peaks statusline` render path.
@@ -303,7 +300,6 @@ export function registerStatusLineCommands(program, io) {
                 ? merged.project
                 : (findProjectRoot(process.cwd()) ?? process.cwd());
             const sid = merged.sessionId ?? getSessionIdCanonical(projectRoot) ?? null;
-            // Slice 2026-08-07-statusline-flake: honor `--now` (epoch ms)
             // when present so deterministic lifecycle-window checks stay
             // in-range under full-suite concurrency. See `--now` doc on
             // the parent `statusline` command.

package/dist/cli/commands/sub-agent/detached.js

@@ -6,7 +6,6 @@
  *
  * Default mode is in-process (backward compat — existing 106+ tests untouched).
  * This handler only fires when the user explicitly passes --mode detached.
- * Spec: docs/superpowers/specs/2026-08-10-peaks-detached-sub-agent-design.md §3.1 §5.3
  */
 import { dispatchDetached, ResourceBudgetGuard } from 'peaks-loop-internal-runtime';
 export async function dispatch(f) {
@@ -59,7 +58,6 @@ export async function dispatch(f) {
     });
     // The launch outcome is the envelope's `ok`, not a footnote. A vendor CLI
     // that is not installed is an expected environment, and the dispatch record
-    // already says `status: 'failed'`; the envelope used to say `ok: true` with
     // `pid: -1` and a "⏳ Spawning …" hint, so the two surfaces disagreed and the
     // orchestrator read a launch that never happened as a running one.
     //

package/dist/cli/commands/sub-agent-commands.d.ts

@@ -1,10 +1,8 @@
 /**
- * `peaks sub-agent` CLI command group — slice 2026-06-07-sub-agent-context-governance.
  *
  * Thin entry point that wires the four sub-command registrars
  * (`dispatch`, `heartbeat`, `share`, `shared-read`, `await`) to the
  * parent `sub-agent` command. The actual implementations live in
- * sibling files (slice 2026-06-23-audit-p0-split refactor):
  *
  *   - `dispatch-commands.ts`  — `dispatch` single-dispatch action
  *   - `dispatch-from-dag.ts`  — `dispatch --from-dag` codepath (slice 9 perf)
@@ -12,7 +10,6 @@
  *   - `share-commands.ts`     — `share` + `shared-read` + `await` actions (G8.4 / 2.7.0)
  *   - `sub-agent-shared.ts`   — shared types, constants, helpers
  *
- * Skill-first / CLI-auxiliary red line (PB-4 / AC-19/20):
  *   These commands are primitives that the peaks-code / peaks-rd /
  *   peaks-qa SKILL.md compose. Users do NOT invoke them directly.
  */

package/dist/cli/commands/sub-agent-shared.d.ts

@@ -1,7 +1,6 @@
 /**
  * Shared types, constants, and helpers for the `peaks sub-agent` command group.
  *
- * Slice 2026-06-23-audit-p0-split — pulled out of `sub-agent-commands.ts` (968
  * lines) to honor the 800-line file cap (Karpathy #2 Simplicity First).
  *
  * Public exports:
@@ -28,7 +27,6 @@ export type DispatchOptions = {
     force?: boolean;
     fromDag?: string;
     /**
-     * Slice 2026-07-29-worktree-l2-extended Part 2.C: dispatch isolation mode.
      * Only `worktree` is currently recognised. When set, dispatch
      * auto-spawns a worktree lease (delegates to `peaks worktree spawn`)
      * and injects `PEAKS_WORKTREE_LEASE_ID=<id>` into the dispatch
@@ -45,7 +43,6 @@ export type DispatchOptions = {
     workflowId?: string;
     graphRef?: string;
     /**
-     * rid-001 detached sub-agent dispatch (slice 2026-08-11): dispatch
      * execution mode. `in-process` (default) keeps the existing warm-path
      * CLI dispatch; `detached` shells out to
      * `peaks-loop-internal-runtime/dispatch.dispatchDetached` for vendor
@@ -54,26 +51,22 @@ export type DispatchOptions = {
      */
     mode?: 'in-process' | 'detached';
     /**
-     * rid-001 detached sub-agent dispatch: target vendor CLI when
      * --mode detached is selected. Only consulted in the detached path;
      * ignored in the default in-process path. Accepts `claude | codex
      * | copilot` (matches VendorAdapterRegistry).
      */
     vendor?: 'claude' | 'codex' | 'copilot';
     /**
-     * rid-001 Task 11.5 budget ceiling: user-overrides ResourceBudgetGuard
      * when active concurrent fan-out would otherwise throttle detached
      * dispatch. The user accepts the risk; surfaces as `warnings[]` only.
      */
     noThrottle?: boolean;
     /**
-     * rid-001 Task 11.5: override the per-tenant max-concurrent budget
      * (default 8). Effective in both detached (ResourceBudgetGuard) and
      * in-process (batch-counter) paths.
      */
     maxConcurrent?: string;
     /**
-     * F5 follow-up (sediment 2026-08-11-rid-001-redo-fake-green-recovery-closure
      * §Lesson 1): frontmatter `--must-ls-files <glob>` flag. When set, the
      * dispatch CLI runs `git ls-files <glob>` upfront, surfaces
      * `mustLsFilesVerification: { path, exists, files }` in the envelope,
@@ -139,7 +132,6 @@ export type ContractStoreModule = typeof import('../../services/dispatch/contrac
  */
 export declare function validateRole(role: string): string | null;
 /**
- * Slice F2 (rid-f2-ac1-wiring) — the dispatch-side twin of the prereq-side
  * back-compat in `artifact-prerequisites.ts` (`AUDIT_SECURITY` /
  * `AUDIT_PERF` accept `rd/security-review.md` / `rd/perf-baseline.md` via
  * `legacyRelativePaths`).

package/dist/cli/commands/sub-agent-shared.js

@@ -1,15 +1,12 @@
-// Slice F2 (rid-f2-ac1-wiring) — first caller of the RD dispatch policy
 // module. Before this wiring `src/services/rd/reviewer-dispatch-policy.ts`
 // had zero importers in src/ + packages/ + scripts/ and the 2 slots it
 // governs (`security-reviewer`, `perf-baseline-reviewer`) were neither
 // rejected nor rerouted by anything on the dispatch path.
 import { isDeprecatedReviewer } from '../../services/rd/reviewer-dispatch-policy.js';
-// Slice 2026-07-29-dispatch-stall-governance / S6 — `probeShell` is
 // re-exported here so the dispatch chokepoint (`dispatch-commands.ts`)
 // and the sub-agent batch-sync wait can lazily acquire a typed
 // shell-probe report without importing the env service at every
 // call site. Codifies .peaks/memory/2026-07-27-windows-shell-pref.md
-// at the dispatch / tool boundary (AC-6.2).
 export { probeShell } from '../../services/env/shell-probe.js';
 export const RECOMMENDED_ROLES = 'rd | qa | ui | txt | qa-business | qa-perf | qa-security | qa-business-<*> | general-purpose';
 // Slice 2026-07-29-dispatch-stall-governance / S2 — align the per-
@@ -17,7 +14,6 @@ export const RECOMMENDED_ROLES = 'rd | qa | ui | txt | qa-business | qa-perf | q
 // union. The CLI --status help, the writer's isHeartbeatStatus guard,
 // and this constant must stay byte-identical (the parity test in
 // tests/unit/dispatch/heartbeat-parity.test.ts pins it). Adding
-// `cancelled` / `no-execution` closes AC-2.1; adding `never-started`
 // and `unreadable` closes the S1 status surface.
 export const HEARTBEAT_STATUSES = [
     'queued',
@@ -58,7 +54,6 @@ export function validateRole(role) {
     return null;
 }
 /**
- * Slice F2 (rid-f2-ac1-wiring) — the dispatch-side twin of the prereq-side
  * back-compat in `artifact-prerequisites.ts` (`AUDIT_SECURITY` /
  * `AUDIT_PERF` accept `rd/security-review.md` / `rd/perf-baseline.md` via
  * `legacyRelativePaths`).

package/dist/cli/commands/sub-agent-shutdown-commands.d.ts

@@ -1,7 +1,6 @@
 /**
  * `peaks sub-agent shutdown register|unregister|list` CLI verbs.
  *
- * Slice 2026-08-01-subagent-merge-and-e2e (Task 6). The sub-agent
  * dispatches a long-lived local process (vite dev, mock API, docker
  * proxy, etc.). Before it exits, it MUST register the process with
  * `peaks sub-agent shutdown register --pid <pid> --name <label>`. The

package/dist/cli/commands/tech-commands.d.ts

@@ -1,5 +1,4 @@
 /**
- * tech-commands — change-id-axis CLI registration (rid-012).
  *
  * Adds two nested subcommands under the existing `peaks tech` parent:
  *
@@ -8,14 +7,12 @@
  *
  * These are ADDITIVE — the existing session-axis commands (`peaks tech plan`
  * / `peaks tech status`) are untouched. The new subcommands reuse the
- * rid-009 helpers (validateChangeId / planArtifactPath / buildWorkspaceUnavailable)
  * via the consumer-side wrapper in
  * `src/services/tech/tech-change-id-service.ts`.
  *
  * Hard ban:
  *   - Do NOT touch the existing `runTechPlan` / `runTechStatus` /
  *     `addTechPlanOptions` / `addTechStatusOptions` in `workflow-commands.ts`
- *     (B2 contract preservation rule from the rid-009 closure record).
  */
 import type { Command } from 'commander';
 import { type ProgramIO } from '../cli-helpers.js';
@@ -31,7 +28,6 @@ export declare function addTechChangeIdStatusOptions(command: Command): Command;
  *
  * The subcommand names are `plan-change-id` and `status-change-id` (NOT
  * `plan` / `status`) to avoid colliding with the existing session-axis
- * registrations at `workflow-commands.ts:441-445` (rid-012 risk register R6).
  */
 export declare function registerTechCommands(program: Command, io: ProgramIO): void;
 export type { _WorkspaceConfig };

package/dist/cli/commands/tech-commands.js

@@ -1,5 +1,4 @@
 /**
- * tech-commands — change-id-axis CLI registration (rid-012).
  *
  * Adds two nested subcommands under the existing `peaks tech` parent:
  *
@@ -8,14 +7,12 @@
  *
  * These are ADDITIVE — the existing session-axis commands (`peaks tech plan`
  * / `peaks tech status`) are untouched. The new subcommands reuse the
- * rid-009 helpers (validateChangeId / planArtifactPath / buildWorkspaceUnavailable)
  * via the consumer-side wrapper in
  * `src/services/tech/tech-change-id-service.ts`.
  *
  * Hard ban:
  *   - Do NOT touch the existing `runTechPlan` / `runTechStatus` /
  *     `addTechPlanOptions` / `addTechStatusOptions` in `workflow-commands.ts`
- *     (B2 contract preservation rule from the rid-009 closure record).
  */
 import { addJsonOption, failUnsupportedNonDryRun, getErrorMessage, printResult } from '../cli-helpers.js';
 import { fail, ok } from 'peaks-loop-shared/result';
@@ -166,7 +163,6 @@ export function addTechChangeIdStatusOptions(command) {
  *
  * The subcommand names are `plan-change-id` and `status-change-id` (NOT
  * `plan` / `status`) to avoid colliding with the existing session-axis
- * registrations at `workflow-commands.ts:441-445` (rid-012 risk register R6).
  */
 export function registerTechCommands(program, io) {
     const tech = program.commands.find((c) => c.name() === 'tech');

package/dist/cli/commands/vendor-detect.d.ts

@@ -1,7 +1,6 @@
 /**
  * Phase B Task 20: peaks vendor-detect CLI.
  * Reports which vendor CLIs are installed on PATH + recommends default.
- * Spec: docs/superpowers/specs/2026-08-10-peaks-detached-sub-agent-design.md §3.3
  */
 import type { Command } from 'commander';
 import { type ProgramIO } from '../cli-helpers.js';
@@ -16,8 +15,6 @@ export declare function vendorDetect(opts: {
     };
 }>;
 /**
- * `peaks vendor-detect` CLI registration (rid-001 redo).
- * Slice 2026-08-11 detached-sub-agent-design §3.3 + §5.3 — register the
  * previously-dead-coded `vendorDetect()` handler at the top-level program
  * surface so `peaks vendor-detect --json` actually reaches it (was
  * dead-coded at the CLI seam even though the handler existed).

package/dist/cli/commands/vendor-detect.js

@@ -12,8 +12,6 @@ export async function vendorDetect(opts) {
     return { ok: true, command: 'vendor-detect', data: { installed, recommended } };
 }
 /**
- * `peaks vendor-detect` CLI registration (rid-001 redo).
- * Slice 2026-08-11 detached-sub-agent-design §3.3 + §5.3 — register the
  * previously-dead-coded `vendorDetect()` handler at the top-level program
  * surface so `peaks vendor-detect --json` actually reaches it (was
  * dead-coded at the CLI seam even though the handler existed).

package/dist/cli/commands/verdict-aggregate-command.d.ts

@@ -1,5 +1,4 @@
 /**
- * v2.13.2 AC-2 — `peaks verdict aggregate` CLI surface.
  *
  * Reads the 5 envelope sources under `.peaks/_runtime/<sid>/` for a
  * given rid, runs `aggregateVerdict()`, and prints the verdict +

package/dist/cli/commands/verdict-aggregate-command.js

@@ -8,11 +8,8 @@ import { isUnsafePathInput } from '../../shared/path-safety.js';
 import { DEFAULT_REQUEST_TYPE } from '../../services/artifacts/artifact-prerequisites.js';
 import { REQUEST_ID_PATTERN } from '../../services/artifacts/request-artifact-service.js';
 import { contractEvidencePaths } from '../../services/workflow/pipeline-verify-gate-support.js';
-// Slice `2026-09-14-audit-artifact-rid-scoping`: the audit/review evidence
 // filenames carry the rid. The ridless names are the pre-rid locations and
-// stay readable during the back-compat window. `mut/` is NOT rid-scoped —
 // see `MUT_REPORT` in `artifact-prerequisites.ts`: no producer in the repo
-// can write a rid-scoped mut report, so probing a templated name here would
 // look for a file that no writer can create.
 //
 // The candidate lists are read FROM the contract — the same
@@ -27,7 +24,6 @@ const MUT_REL = 'mut/mut-report.json';
 const QA_REL = 'qa/test-reports';
 /**
  * The declared tiers for one artifact name, primary first. Probed by the name
- * this command used before the rid-scoping (the table matches it as either
  * the primary or a legacy tier), so the lookup survives the primary moving.
  * `verdict aggregate` is request-type-agnostic and every fanout-trigger type
  * declares these artifacts identically, so the default type's list is the
@@ -94,7 +90,6 @@ export function registerVerdictAggregateCommands(program, io) {
         }
         try {
             const sources = {
-                // v2.13.3 AC-1: use the canonical markdown-aware parser from
                 // envelopes.ts. The old inline `parseSecurityFromMarkdown`
                 // only understood shape A (`- [SEV] dim @ file:line — hint`),
                 // so real dogfood fixtures using shape B (`- HIGH: hint in file:line`)
@@ -157,7 +152,6 @@ export function registerVerdictAggregateCommands(program, io) {
     });
 }
 function readAudit(projectRoot, sid, rid, rels, parse) {
-    // Canonical rid-scoped location first, then the pre-rid locations.
     for (const rel of rels) {
         const path = join(projectRoot, '.peaks', '_runtime', sid, rel.replace('<rid>', rid));
         if (existsSync(path))
@@ -195,7 +189,6 @@ function readQa(projectRoot, sid, rid) {
 function parseMutJson(json) {
     return parseMutEnvelope(json);
 }
-// v2.13.3 AC-1: removed inline `parseSecurityFromMarkdown` /
 // `parsePerfFromMarkdown` (only handled shape A). The canonical
 // `parseSecurityEnvelope` / `parsePerfEnvelope` in envelopes.ts now
 // own the markdown parse + JSON back-compat fallback.

package/dist/cli/commands/vm-commands.d.ts

@@ -1,5 +1,4 @@
 /**
- * `peaks vm spawn | release` — slice 2026-07-29-worktree-l2-extended Part 35.
  *
  * L4 VM isolation runtime. Parallels the design of
  * `container-commands.ts` (Part 12, docker) and

package/dist/cli/commands/vm-commands.js

@@ -1,5 +1,4 @@
 /**
- * `peaks vm spawn | release` — slice 2026-07-29-worktree-l2-extended Part 35.
  *
  * L4 VM isolation runtime. Parallels the design of
  * `container-commands.ts` (Part 12, docker) and
@@ -34,6 +33,8 @@ import { findProjectRoot } from '../../services/config/config-safety.js';
 import { getCurrentSessionId } from '../../services/skills/skill-presence-service.js';
 import { atomicWriteJson } from '../../services/ide/shared/atomic-json.js';
 import { DEFAULT_VM_IMAGE, deserializeVmLease, finalizeVmLease, generateVmLeaseId, markVmReleased, ttlForVmRole, vmLeaseFilePath } from '../../services/vm/vm-lease.js';
+import { detectHypervisor } from './vm-hypervisor-probe.js';
+import { registerVmStatusCommand } from './vm-status-command.js';
 function joinPathSession(projectRoot, sessionId) {
     return `${projectRoot.replace(/[\\/]+$/, '')}/.peaks/_runtime/${sessionId}`;
 }
@@ -45,34 +46,6 @@ function resolveTtlMs(raw, role) {
         return ttlForVmRole(role);
     return parsed;
 }
-function detectHypervisor(requested) {
-    let binary;
-    switch (requested) {
-        case 'kvm':
-            binary = 'virsh';
-            break;
-        case 'hyperkit':
-            binary = 'hvftool';
-            break;
-        case 'hyperv':
-            binary = 'hvc';
-            break;
-    }
-    try {
-        const v = execSync(`${binary} --version`, {
-            stdio: ['ignore', 'pipe', 'pipe'],
-            encoding: 'utf8',
-            windowsHide: true
-        });
-        if (requested === 'kvm' && !existsSync('/dev/kvm')) {
-            return { ok: false, stderr: 'KVM kernel module not loaded (/dev/kvm absent)' };
-        }
-        return { ok: true, binary: `${binary} (${v.trim().split('\n')[0] ?? ''})` };
-    }
-    catch (err) {
-        return { ok: false, stderr: err.message };
-    }
-}
 function spawnVmWithHypervisor(args) {
     if (args.hypervisor === 'kvm') {
         // virsh create expects a domain XML file. We emit a minimal
@@ -134,6 +107,9 @@ export function registerVmCommand(program, io) {
     const cmd = program
         .command('vm')
         .description('L4 VM isolation: spawn/release VM leases via kvm | hyperkit | hyperv (Part 35; pairs with --isolation vm on dispatch).');
+    // The host probe rides on the same parent, so `peaks vm status`
+    // can say which prerequisite is missing before a spawn fails.
+    registerVmStatusCommand(cmd, io);
     addJsonOption(cmd
         .command('spawn')
         .description('Spawn a VM via the requested hypervisor (kvm | hyperkit | hyperv) and write a VM lease. ' +

package/dist/cli/commands/vm-hypervisor-probe.d.ts

@@ -0,0 +1,27 @@
+import type { VmHypervisor } from '../../services/vm/vm-lease.js';
+export type HypervisorProbeRow = {
+    readonly hypervisor: VmHypervisor;
+    readonly binary: string;
+    readonly available: boolean;
+    /** The version line when available; why not when it is not. */
+    readonly detail: string;
+};
+/** Every hypervisor the CLI can dispatch to, and the binary it shells out to. */
+export declare const VM_HYPERVISOR_BINARIES: ReadonlyArray<{
+    hypervisor: VmHypervisor;
+    binary: string;
+}>;
+export declare function binaryForHypervisor(requested: VmHypervisor): string;
+/**
+ * Is this hypervisor usable here right now? `kvm` needs both the libvirt CLI
+ * and the kernel device node; the others need their binary to answer.
+ */
+export declare function detectHypervisor(requested: VmHypervisor): {
+    ok: true;
+    binary: string;
+} | {
+    ok: false;
+    stderr: string;
+};
+/** Probe every dispatchable hypervisor, in the order the CLI lists them. */
+export declare function probeHypervisors(): HypervisorProbeRow[];