peaks-loop 4.1.1 → 4.1.3

package/dist/cli/commands/worktree-lease-spawn-command.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `peaks worktree spawn` — write a lease and run `git worktree add`.
+ *
+ * Extracted verbatim from `worktree-lease-commands.ts` (mechanical move of
+ * the `.action()` body plus its two local helpers). The command name,
+ * every option and its help text, the ok/fail envelopes and the
+ * `process.exitCode = 1` on failure are unchanged.
+ */
+import type { Command } from 'commander';
+import { type ProgramIO } from '../cli-helpers.js';
+export declare function registerWorktreeLeaseSpawnCommand(auth: Command, io: ProgramIO): void;

package/dist/cli/commands/worktree-lease-spawn-command.js

@@ -0,0 +1,119 @@
+/**
+ * `peaks worktree spawn` — write a lease and run `git worktree add`.
+ *
+ * Extracted verbatim from `worktree-lease-commands.ts` (mechanical move of
+ * the `.action()` body plus its two local helpers). The command name,
+ * every option and its help text, the ok/fail envelopes and the
+ * `process.exitCode = 1` on failure are unchanged.
+ */
+import { fail, ok } from 'peaks-loop-shared/result';
+import { execSync } from 'node:child_process';
+import { addJsonOption, getErrorMessage, printResult } from '../cli-helpers.js';
+import { atomicWriteJson } from '../../services/ide/shared/atomic-json.js';
+import { emitLeaseEvent } from '../../services/observability/observability-service.js';
+import { finalizeLease, generateLeaseId, leaseFilePath, ttlForRole, worktreePath } from '../../services/worktree/worktree-lease.js';
+import { joinPathSession, resolveProjectRoot, resolveSessionId } from './worktree-lease-session.js';
+const SPAWN_DESCRIPTION = `Spawn a worktree under .peaks/_runtime/<sid>/worktrees/<leaseId>/ with a managed lease. ` +
+    `The lease is the source of truth for the L2 hook gate (Part 2 of this slice); ` +
+    `until the hook integration ships, sub-agents may still invoke raw \`git worktree add\` ` +
+    `with a current \`peaks worktree auth grant\` token. Default TTL is role-aware ` +
+    `(rd=30m / qa=15m / ui=1h); pass --ttl <ms> to override.`;
+const SPAWN_TTL_DESCRIPTION = `time-to-live in ms (default role-aware; override with positive number)`;
+// Branch names must be safe for git ref-format; the cap keeps a pathological
+// rid from producing an unusable ref.
+const MAX_BRANCH_NAME_LENGTH = 80;
+function resolveTtlMs(raw, role) {
+    if (typeof raw !== 'string' || raw.length === 0)
+        return ttlForRole(role);
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed) || parsed <= 0)
+        return ttlForRole(role);
+    return parsed;
+}
+function deriveBranch(rid) {
+    // Branch names must be safe for git ref-format. Strip leading
+    // `rid-` if present and replace any non-safe chars with `-`.
+    return rid.replace(/[^A-Za-z0-9._/-]/g, '-').slice(0, MAX_BRANCH_NAME_LENGTH);
+}
+function printSpawnOk(io, options, ctx) {
+    const { lease, sessionId, projectRoot, ttlMs, wtPath, branch } = ctx;
+    printResult(io, ok('worktree.spawn', {
+        lease,
+        sessionId,
+        projectRoot,
+        ttlMs,
+        nextActions: [
+            `Worktree path: ${wtPath}`,
+            `Branch: ${branch}`,
+            `Lease expires at: ${new Date(lease.expiresAt).toISOString()}`,
+            'Run `peaks worktree release --lease-id <leaseId>` when done',
+            'Hook integration (lease-aware gate) ships in Part 2'
+        ]
+    }, [], []), options.json);
+}
+function printSpawnFailed(io, options, error, sessionId) {
+    printResult(io, fail('worktree.spawn', 'SPAWN_FAILED', getErrorMessage(error), { rid: options.rid, role: options.role, sessionId }, [
+        'Verify `git worktree add` succeeded (output above).',
+        'If the lease file was NOT written, retry; the lease directory is .peaks/_runtime/<sid>/worktree-leases/.',
+        'For an existing branch, pass --branch <name> explicitly (the spawn refuses to overwrite an active branch).'
+    ]), options.json);
+    process.exitCode = 1;
+}
+function runSpawn(options, io) {
+    const projectRoot = resolveProjectRoot(options);
+    const sessionId = resolveSessionId(options, projectRoot);
+    try {
+        const leaseId = generateLeaseId();
+        const now = Date.now();
+        const ttlMs = resolveTtlMs(options.ttl, options.role);
+        const branch = options.branch ?? deriveBranch(options.rid);
+        const wtPath = worktreePath(joinPathSession(projectRoot, sessionId), leaseId);
+        const lease = finalizeLease({
+            leaseId,
+            rid: options.rid,
+            role: options.role,
+            path: wtPath,
+            branch,
+            createdAt: now,
+            expiresAt: now + ttlMs,
+            purpose: options.purpose
+        });
+        // Run `git worktree add` from the project root. The PreToolUse hook
+        // (Part 2 of this slice) will consult the lease file we just wrote
+        // and authorize this very `git worktree add`; for Part 1 we still
+        // require a current `peaks worktree auth grant` token to remain
+        // consistent with the slice-027 hard gate contract.
+        execSync(`git worktree add "${wtPath}" -b "${branch}"`, {
+            cwd: projectRoot,
+            stdio: 'pipe',
+            encoding: 'utf8',
+            windowsHide: true
+        });
+        atomicWriteJson(leaseFilePath(joinPathSession(projectRoot, sessionId), leaseId), lease);
+        // Part 4.A: emit spawn metric (fire-and-forget; never blocks).
+        emitLeaseEvent({
+            sessionId,
+            projectRoot,
+            kind: 'spawn',
+            leaseId,
+            rid: options.rid,
+            role: options.role
+        });
+        printSpawnOk(io, options, { lease, sessionId, projectRoot, ttlMs, wtPath, branch });
+    }
+    catch (error) {
+        printSpawnFailed(io, options, error, sessionId);
+    }
+}
+export function registerWorktreeLeaseSpawnCommand(auth, io) {
+    addJsonOption(auth
+        .command('spawn')
+        .description(SPAWN_DESCRIPTION)
+        .requiredOption('--rid <rid>', 'peaks request id the lease is associated with')
+        .requiredOption('--role <role>', 'sub-agent role (rd | qa | ui | sc | prd | general-purpose)')
+        .requiredOption('--purpose <text>', 'why this worktree was spawned (audit log)')
+        .option('--ttl <ms>', SPAWN_TTL_DESCRIPTION)
+        .option('--branch <name>', 'git branch name (default: derived from rid)')
+        .option('--session <sid>', 'override session id')
+        .option('--project <path>', 'project root (default: findProjectRoot(cwd))')).action((options) => runSpawn(options, io));
+}

package/dist/cli/commands/worktree-lease-status-command.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `peaks worktree lease-status` — show one lease in detail.
+ *
+ * Extracted verbatim from `worktree-lease-commands.ts` (mechanical move of
+ * the `.action()` body). The lease-file failures route through the shared
+ * `loadLeaseOrStop`; the computed `live` flag, the on-disk path
+ * diagnostics and the ok/fail envelopes are unchanged.
+ */
+import type { Command } from 'commander';
+import { type ProgramIO } from '../cli-helpers.js';
+export declare function registerWorktreeLeaseStatusCommand(auth: Command, io: ProgramIO): void;

package/dist/cli/commands/worktree-lease-status-command.js

@@ -0,0 +1,86 @@
+/**
+ * `peaks worktree lease-status` — show one lease in detail.
+ *
+ * Extracted verbatim from `worktree-lease-commands.ts` (mechanical move of
+ * the `.action()` body). The lease-file failures route through the shared
+ * `loadLeaseOrStop`; the computed `live` flag, the on-disk path
+ * diagnostics and the ok/fail envelopes are unchanged.
+ */
+import { fail, ok } from 'peaks-loop-shared/result';
+import { existsSync, statSync } from 'node:fs';
+import { addJsonOption, getErrorMessage, printResult } from '../cli-helpers.js';
+import { isLeaseActive, leaseFilePath } from '../../services/worktree/worktree-lease.js';
+import { loadLeaseOrStop } from './worktree-lease-load.js';
+import { joinPathSession, resolveProjectRoot, resolveSessionId } from './worktree-lease-session.js';
+const LEASE_STATUS_DESCRIPTION = 'Show one lease in detail: full lease record + computed `live` flag (active AND not past ' +
+    'expiry) + path/branch/path-exists-on-disk diagnostics. Use this when triaging why a ' +
+    'sub-agent cannot write to a worktree.';
+const STATUS_MISSING_HINTS = ['Run `peaks worktree list` to inspect available leases.'];
+const STATUS_INVALID_HINTS = ['Delete the malformed lease file manually and re-spawn.'];
+/** Whether the lease path is present on disk and is a directory. */
+function inspectLeasePath(leasePath) {
+    const pathExists = existsSync(leasePath);
+    if (!pathExists)
+        return { pathExists, pathIsDirectory: false };
+    try {
+        return { pathExists, pathIsDirectory: statSync(leasePath).isDirectory() };
+    }
+    catch {
+        return { pathExists, pathIsDirectory: false };
+    }
+}
+function printLeaseStatusOk(io, options, ctx) {
+    const { lease, sessionId, projectRoot } = ctx;
+    const now = Date.now();
+    const { pathExists, pathIsDirectory } = inspectLeasePath(lease.path);
+    const live = isLeaseActive(lease, now);
+    printResult(io, ok('worktree.lease-status', {
+        sessionId,
+        projectRoot,
+        file: '.peaks/_runtime/' + sessionId + '/worktree-leases/' + lease.leaseId + '.json',
+        lease,
+        live,
+        diagnostics: {
+            now,
+            remainingMs: lease.expiresAt - now,
+            pathExists,
+            pathIsDirectory
+        }
+    }, [], [
+        `Lease ${lease.leaseId} is ${live ? 'LIVE' : 'NOT LIVE'} ` +
+            `(status=${lease.status}, remaining=${lease.expiresAt - now}ms).`,
+        `Worktree path ${lease.path} ${pathExists ? (pathIsDirectory ? 'exists (dir)' : 'exists (NOT a dir)') : 'MISSING'}.`
+    ]), options.json);
+}
+function printLeaseStatusFailed(io, options, err, sessionId) {
+    printResult(io, fail('worktree.lease-status', 'STATUS_FAILED', getErrorMessage(err), { leaseId: options.leaseId, sessionId }, ['Re-run after fixing the failure (see cause in the error message).']), options.json);
+    process.exitCode = 1;
+}
+function runLeaseStatus(options, io) {
+    const projectRoot = resolveProjectRoot(options);
+    const sessionId = resolveSessionId(options, projectRoot);
+    try {
+        const file = leaseFilePath(joinPathSession(projectRoot, sessionId), options.leaseId);
+        const loaded = loadLeaseOrStop(io, options, {
+            command: 'worktree.lease-status',
+            file,
+            hints: { missing: STATUS_MISSING_HINTS, invalid: STATUS_INVALID_HINTS }
+        });
+        if (loaded.stop) {
+            process.exitCode = 1;
+            return;
+        }
+        printLeaseStatusOk(io, options, { lease: loaded.lease, sessionId, projectRoot });
+    }
+    catch (err) {
+        printLeaseStatusFailed(io, options, err, sessionId);
+    }
+}
+export function registerWorktreeLeaseStatusCommand(auth, io) {
+    addJsonOption(auth
+        .command('lease-status')
+        .description(LEASE_STATUS_DESCRIPTION)
+        .requiredOption('--lease-id <id>', 'lease id to inspect')
+        .option('--session <sid>', 'override session id')
+        .option('--project <path>', 'project root (default: findProjectRoot(cwd))')).action((options) => runLeaseStatus(options, io));
+}

package/dist/cli/commands/worktree-lease-store.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Shared lease-store reader for the two sweep-style commands (`list`, `gc`).
+ *
+ * Both enumerate the session's lease directory through the pure
+ * `listLeasesSync` helper with the same real-fs bindings, and both render
+ * the same `Malformed lease: <file> (<error>)` warning line per unreadable
+ * file. Extracted verbatim from `worktree-lease-commands.ts`.
+ */
+import { type LeaseListResult } from '../../services/worktree/worktree-lease.js';
+export interface LeaseStoreSnapshot {
+    storeDir: string;
+    result: LeaseListResult;
+}
+export declare function loadLeaseStore(projectRoot: string, sessionId: string): LeaseStoreSnapshot;
+/** One warning line per malformed lease file skipped by the store reader. */
+export declare function malformedLeaseWarnings(errors: ReadonlyArray<{
+    file: string;
+    error: string;
+}>): string[];

package/dist/cli/commands/worktree-lease-store.js

@@ -0,0 +1,24 @@
+/**
+ * Shared lease-store reader for the two sweep-style commands (`list`, `gc`).
+ *
+ * Both enumerate the session's lease directory through the pure
+ * `listLeasesSync` helper with the same real-fs bindings, and both render
+ * the same `Malformed lease: <file> (<error>)` warning line per unreadable
+ * file. Extracted verbatim from `worktree-lease-commands.ts`.
+ */
+import { existsSync, readdirSync, readFileSync as readFileSyncNode } from 'node:fs';
+import { leaseStoreDir, listLeasesSync } from '../../services/worktree/worktree-lease.js';
+import { joinPathSession } from './worktree-lease-session.js';
+export function loadLeaseStore(projectRoot, sessionId) {
+    const storeDir = leaseStoreDir(joinPathSession(projectRoot, sessionId));
+    const result = listLeasesSync(storeDir, {
+        readdir: (p) => readdirSync(p),
+        readFile: (p) => readFileSyncNode(p, 'utf8'),
+        existsSync: (p) => existsSync(p)
+    });
+    return { storeDir, result };
+}
+/** One warning line per malformed lease file skipped by the store reader. */
+export function malformedLeaseWarnings(errors) {
+    return errors.map((e) => `Malformed lease: ${e.file} (${e.error})`);
+}

package/dist/cli/program.js

@@ -8,6 +8,7 @@ import { registerWorkflowCommands } from './commands/workflow-commands.js';
 import { registerCapabilityWorkerConfigAndSCCommands } from './commands/capability-worker-config-sc-commands.js';
 import { registerSubAgentCommands } from './commands/sub-agent-commands.js';
 import { registerLeaseMetricsCommand } from './commands/lease-metrics-commands.js';
+import { registerMcpCommands } from './commands/mcp-commands.js';
 import { registerLeaseStatsCommand } from './commands/lease-stats-commands.js';
 import { registerContainerCommand } from './commands/container-commands.js';
 import { registerVmCommand } from './commands/vm-commands.js';
@@ -22,7 +23,6 @@ import { applyRetention } from '../services/log/retention.js';
 import { writeLogEntry, maybeWriteStderr } from '../services/log/logger.js';
 import { printSuperCommandCatalog } from './cli-helpers.js';
 export { printErrorEnvelope, printResult } from './cli-helpers.js';
-// Slice rid-001 (P0-1 envelope closure, fix #4): the prior default
 // `ProgramIO` funneled Commander's `configureOutput().writeErr` callback
 // through raw `console.error`, which bypassed the canonical envelope
 // path and left a `// TODO(g2): legacy console.error without envelope`
@@ -39,7 +39,6 @@ function defaultStdoutSink(text) {
     process.stdout.write(`${text}\n`);
 }
 /**
- * Slice 2026-06-16-cli-logging (G1, G2, G3, G7). One structured
  * `peaks-loop start` entry per CLI invocation, plus a 7-day
  * retention sweep. Wired into the global program so EVERY
  * peaks-loop command — even a bare `peaks` quickstart — writes
@@ -79,7 +78,6 @@ function bootstrapLogger(verbose) {
         maybeWriteStderr(entry, { verbose: true });
     }
 }
-// Slice 2026-06-16-cli-logging (AC1 regression fix, repair cycle 1):
 // Process-scoped guard so the bootstrap log line is written AT MOST
 // once per process, regardless of whether it fires from the
 // `preAction` hook (subcommand path) or from the version action
@@ -107,7 +105,6 @@ Run peaks (no arguments) for a quickstart. You likely want one of:
         writeOut: (text) => io.stdout(text.trimEnd()),
         writeErr: (text) => io.stderr(text.trimEnd())
     })
-        // Slice 2026-06-16-cli-logging (AC1 regression fix, repair cycle 1):
         // We DO NOT use Commander's built-in `.version()` here. Commander's
         // built-in version handler short-circuits the program BEFORE the
         // `preAction` hook fires, which means a bare `peaks --version`
@@ -122,7 +119,6 @@ Run peaks (no arguments) for a quickstart. You likely want one of:
         // per process.
         .option('-v, --version', 'output the version number')
         .option('-V', 'output the version number')
-        // Slice 2026-06-16-cli-logging (G3): global verbose flag. Mirrors
         // the PEAKS_LOG_LEVEL=debug env var; with this set, the logger
         // mirrors every entry to stderr IN ADDITION to the file.
         // Long-only: `-v` is already bound to `--version` by the
@@ -131,7 +127,6 @@ Run peaks (no arguments) for a quickstart. You likely want one of:
         .option('--verbose', 'mirror log lines to stderr (also: PEAKS_LOG_LEVEL=debug)')
         .hook('preAction', () => {
         const opts = program.opts();
-        // Slice 2026-06-16-cli-logging (repair cycle 2): gate the bootstrap on
         // the same `bootstrapRan` guard the version action uses, so a single
         // process that invokes the program twice (vitest, programmatic) does
         // not emit duplicate `peaks-loop start` JSONL entries.
@@ -203,13 +198,16 @@ Run peaks (no arguments) for a quickstart. You likely want one of:
     registerVmCommand(program, io);
     registerCronCommand(program, io);
     registerCronSchedulerCommand(program, io);
+    // The read-only MCP surface's command family. `serve` spawns the server
+    // module by path rather than importing it, so `src/services/mcp/` stays
+    // deletable (see the header of `mcp-commands.ts`).
+    registerMcpCommands(program, io);
     // Auto-route the remaining 60+ commands after the orchestrators so the
     // lazy `skill` parent (used by adapter-commands / sediment-commands)
     // finds the existing `peaks skill` group registered by
     // registerCoreAndArtifactCommands instead of being created twice.
     autoRegisterAllCommands(program, io);
     registerSkillVisibilityCommand(program, repoRoot);
-    // Slice rid-statusline-stale-ux AC-2: register `peaks session primer`
     // so it appears in `peaks session --help` for LLM `<TAB>`-discovery.
     // Mounted as a CHILD of the existing `session` commander group
     // (verified at src/cli/commands/core/session-command.ts:32). NOT

package/dist/reporters/bdd-reporter.js

@@ -1,6 +1,5 @@
 // src/reporters/bdd-reporter.ts
 //
-// rid-2026-08-05-bdd-test-style Slice C — vitest custom reporter that
 // emits a pure BDD document view of the run. Designed for business
 // reviewers and downstream LLM prompts; it is NOT a replacement for
 // the default reporter.

package/dist/services/24h-mode/auto-engage.d.ts

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-09-09-mode-consolidation (Slice B): auto-engage may set the
  * 24h MODE — and ONLY the 24h mode.
  *
  * `24h` is the single mode that may be set without an explicit user pick

package/dist/services/24h-mode/auto-engage.js

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-09-09-mode-consolidation (Slice B): auto-engage may set the
  * 24h MODE — and ONLY the 24h mode.
  *
  * `24h` is the single mode that may be set without an explicit user pick

package/dist/services/24h-mode/decider.d.ts

@@ -1,7 +1,6 @@
 /**
  * 24h mode B3 trigger evaluation + attempts counter.
  *
- * Rid-020a (state-only slice). `fireB3` is the single mutating
  * primitive: it increments the per-key counter and escalates with a
  * `B3Escalation` when the count reaches `B3_THRESHOLD` (3). The
  * counter is **per-key** — AC-T3 mandates B1 and B2 retries do not
@@ -95,8 +94,6 @@ export type HandoffExitCondition = (typeof HANDOFF_EXIT_CONDITIONS)[number];
 export declare function isHandoffExitCondition(s: string): s is HandoffExitCondition;
 export declare function isHandoffState(s: State): boolean;
 /**
- * Slice 2026-07-28 (rid-027), re-keyed by slice
- * 2026-09-09-mode-consolidation: resolve the auto-compact mode from
  * the PRESENCE MODE, not the 24h state machine. Returns `'partial'`
  * when the mode is `24h`, otherwise `'standard'`. This is the CLI-side
  * default; the explicit `--mode` flag in `peaks code auto-compact`

package/dist/services/24h-mode/decider.js

@@ -1,7 +1,6 @@
 /**
  * 24h mode B3 trigger evaluation + attempts counter.
  *
- * Rid-020a (state-only slice). `fireB3` is the single mutating
  * primitive: it increments the per-key counter and escalates with a
  * `B3Escalation` when the count reaches `B3_THRESHOLD` (3). The
  * counter is **per-key** — AC-T3 mandates B1 and B2 retries do not
@@ -132,8 +131,6 @@ export function isHandoffState(s) {
     return s === 'HANDOFF';
 }
 /**
- * Slice 2026-07-28 (rid-027), re-keyed by slice
- * 2026-09-09-mode-consolidation: resolve the auto-compact mode from
  * the PRESENCE MODE, not the 24h state machine. Returns `'partial'`
  * when the mode is `24h`, otherwise `'standard'`. This is the CLI-side
  * default; the explicit `--mode` flag in `peaks code auto-compact`

package/dist/services/24h-mode/index.d.ts

@@ -1,9 +1,7 @@
 /**
  * Public barrel for 24h-mode service module.
  *
- * Rid-020a (state-only slice). Exports the 6-state enum, the
  * DecisionKey enum, the persistence API, and the B3 decider API
- * so that the `peaks session 24h-mode` CLI (and future rid-020b
  * `peaks code run --24h`) can consume them without reaching into
  * the internal file layout.
  */

package/dist/services/24h-mode/index.js

@@ -1,9 +1,7 @@
 /**
  * Public barrel for 24h-mode service module.
  *
- * Rid-020a (state-only slice). Exports the 6-state enum, the
  * DecisionKey enum, the persistence API, and the B3 decider API
- * so that the `peaks session 24h-mode` CLI (and future rid-020b
  * `peaks code run --24h`) can consume them without reaching into
  * the internal file layout.
  */

package/dist/services/24h-mode/state.d.ts

@@ -1,7 +1,6 @@
 /**
  * 24h mode state machine — state types + DecisionKey enum.
  *
- * Rid-020a (state-only slice). The proposal defines six states that
  * capture the lifecycle of a 24h code run; the DecisionKey enum is the
  * enumeration of B1/B2 decision keys whose retry counter lives in
  * `AttemptsMap`. Persistence and trigger evaluation live in sibling

package/dist/services/24h-mode/state.js

@@ -1,7 +1,6 @@
 /**
  * 24h mode state machine — state types + DecisionKey enum.
  *
- * Rid-020a (state-only slice). The proposal defines six states that
  * capture the lifecycle of a 24h code run; the DecisionKey enum is the
  * enumeration of B1/B2 decision keys whose retry counter lives in
  * `AttemptsMap`. Persistence and trigger evaluation live in sibling

package/dist/services/24h-mode/store.d.ts

@@ -2,7 +2,6 @@
  * 24h mode persistence — atomic JSON snapshot under
  * `.peaks/_runtime/<sessionId>/24h-state.json`.
  *
- * Rid-020a (state-only slice). The store never invents a session id:
  * the caller passes one (the CLI resolves it from `.peaks/_runtime/session.json`).
  * Writes use the temp-file + rename pattern so a crash mid-write never
  * leaves a half-written state file (atomic on POSIX, near-atomic on

package/dist/services/24h-mode/store.js

@@ -2,7 +2,6 @@
  * 24h mode persistence — atomic JSON snapshot under
  * `.peaks/_runtime/<sessionId>/24h-state.json`.
  *
- * Rid-020a (state-only slice). The store never invents a session id:
  * the caller passes one (the CLI resolves it from `.peaks/_runtime/session.json`).
  * Writes use the temp-file + rename pattern so a crash mid-write never
  * leaves a half-written state file (atomic on POSIX, near-atomic on

package/dist/services/adapter/adapter-registry.js

@@ -1,5 +1,4 @@
 /**
- * Adapter registry — slice S2-a of RD-2.
  *
  * Persists user-registered vendor adapters to
  * `.peaks/runtime/adapters.json` and resolves them by id. The

package/dist/services/artifacts/artifact-prerequisites.d.ts

@@ -49,13 +49,9 @@ export type ArtifactPrerequisite = {
     legacyRelativePath?: string;
     /**
      * Further, older locations, tried **in declared order** after
-     * `legacyRelativePath`. Slice `2026-09-14-audit-artifact-rid-scoping`
      * added this because the two audit artifacts have a two-release
-     * history behind their rid-scoped path: the pre-rid-scoping
      * `audit/security.md` (v2.12.0) and, behind it, the v2.11.x
      * `rd/security-review.md`. Three sessions on disk
-     * (`2026-09-06-session-a87ca4`, `2026-09-10-session-528a63`,
-     * `2026-09-12-session-e37ef0`) hold their security evidence only at
      * the last of those, so the oldest tier still has to resolve.
      */
     legacyRelativePaths?: ReadonlyArray<string>;
@@ -67,7 +63,6 @@ export type PrerequisiteCheckResult = {
         description: string;
     }>;
     /**
-     * v2.13.2 AC-5 — soft-block warnings. Each entry is a prereq
      * path that is currently missing but is in a 1-minor-release
      * back-compat window. The transition gate does not throw on
      * `missing`-only (so legacy callers keep working) but surfaces the

package/dist/services/artifacts/artifact-prerequisites.js

@@ -27,7 +27,6 @@ const BUG_ANALYSIS = {
     description: 'Bug root-cause analysis (reproduction, affected paths, fix approach, regression test plan)',
     mustContain: ['## Root cause', '## Fix approach']
 };
-// Slice `2026-09-14-audit-artifact-rid-scoping`: the rid is part of the
 // filename (`code-review-<rid>.md`). A fixed per-session path cannot hold
 // two slices' evidence at once — the second slice's write silently
 // destroyed the first slice's on 2026-09-13, and the gate stayed green
@@ -66,13 +65,11 @@ const PERF_BASELINE = {
 // handoff (`prd/handoff.md`) — see `AUDIT_REQUIRES_HANDOFF` below.
 //
 // Back-compat: the canonical location is `audit/security-<rid>.md`
-// (and `audit/perf-<rid>.md`); the pre-rid-scoping `audit/security.md`
 // (and `audit/perf.md`) plus the older `rd/security-review.md` (and
 // `rd/perf-baseline.md`) are accepted via `legacyRelativePaths`, in
 // that order, for the back-compat window.
 const AUDIT_SECURITY = {
     relativePath: 'audit/security-<rid>.md',
-    // Two legacy tiers behind the rid-scoped path: the pre-rid-scoping
     // v2.12.0 location, then the v2.11.x one. Both are live on disk.
     legacyRelativePath: 'audit/security.md',
     legacyRelativePaths: ['rd/security-review.md'],
@@ -108,22 +105,18 @@ const AUDIT_PERF = {
 // rd-side CLI hard gate (blocks `rd → qa-handoff`), while qa-side
 // consumption remains soft.
 //
-// v2.13.2 AC-5 — 1-minor-release back-compat window. When
 // `backCompat: true` is set, a MISSING file downgrades to a warning
 // (`mut-report-missing-deprecated-in-v2.14.0`) instead of a hard
 // failure. The hard-fail behavior for `passed: false` is preserved
 // (the body still has to carry `"passed": true` when present).
 // v2.14.0 will remove `backCompat` and re-elevate missing → throw.
 //
-// Slice `2026-09-14-audit-artifact-rid-scoping` deliberately does NOT
-// rid-scope this path, unlike the four audit/review artifacts above. The
 // repo's own producer/reader constant is `mutReportPath()` in
 // `packages/peaks-loop-mut/src/services/mut/report-loader.ts`, which names
 // `mut/mut-report.json`, and `peaks mut run`'s `--out` is supplied by the
 // caller. A `<rid>`-templated requirement here would be a name no producer
 // in the repo can write — a gate that exists only in prose, sitting behind
 // `backCompat: true` so it gates nothing at all. If mut ever gains a
-// rid-scoped producer, the constant and this path move together.
 const MUT_REPORT = {
     relativePath: 'mut/mut-report.json',
     description: 'peaks-mut mutation + weak-assertion report (Plan 2, v2.12.0+). v2.13.1: required at rd:qa-handoff for feature / bugfix / refactor slices. v2.13.2: back-compat window — missing file downgrades to a warning (1-minor-release); passed:false still throws. The body must carry `"passed": true` when present; failed runs are blocked at this gate. CONFIG / DOCS / CHORE slices retain the legacy "no acceptance surface" exemption.',
@@ -137,10 +130,8 @@ const MUT_REPORT = {
 };
 // v2.12.0 Group B Tier 5 — gate that the peaks-prd handoff (the
 // immutable, per-slice handoff capsule at `prd/handoff-<rid>.md`
-// since slice `2026-09-14-prd-capsule-rid-scoping`) exists before any
 // audit skill is allowed to consume it. The peaks-security-audit
 // and peaks-perf-audit CLI commands read frontmatter from the
-// capsule (AC-2.4 / AC-3.4); if the handoff is missing the
 // audit skill aborts — and so should the prereq gate when those
 // audits are required at rd:qa-handoff.
 //
@@ -150,7 +141,6 @@ const MUT_REPORT = {
 // PRD handoff exists for small CONFIG-only commits).
 const AUDIT_REQUIRES_HANDOFF = {
     relativePath: 'prd/handoff-<rid>.md',
-    // Slice `2026-09-14-prd-capsule-rid-scoping`: the rid is part of the
     // filename, like the four audit/review artifacts above. A single slot per
     // SESSION cannot hold two slices' capsules — `peaks prd handoff init`
     // overwrote it on every call, and this gate stayed green because it pinned
@@ -159,9 +149,7 @@ const AUDIT_REQUIRES_HANDOFF = {
     // prerequisite on a capsule written for a different line of work.
     // The bare path stays accepted (see `legacyRelativePath`) so the three
     // sessions on disk that hold only `prd/handoff.md` keep passing. That tier
-    // is rid-blind by design — the scoping binds for capsules written from now
     // on, and every producer (`handoff-service.initHandoff`,
-    // `handoff-auto-regen`, `evidence generate`) writes the rid-scoped name.
     legacyRelativePath: 'prd/handoff.md',
     description: 'PRD handoff capsule (v2.12.0+) — peaks-security-audit / peaks-perf-audit both read frontmatter from this file. Must exist before audit prereqs are evaluated at rd:qa-handoff. The rid is part of the filename so two slices in one session do not collide; the bare pre-rid-scoping location is accepted as the legacy tier.',
     // Empty `mustContain` is fine — file existence is the contract.
@@ -200,7 +188,6 @@ const KARPATHY_REVIEW = {
 // pass the gate. The full envelope lives at the JSON sibling path
 // (`rd/third-party-review.json`); this MD file is the human-readable
 // companion. The body is also expected to declare a `modelFamily`
-// distinct from the karpathy-reviewer's modelFamily (AC-4.4 — the CI
 // gate diffs `rd/third-party-review.json.modelFamily` against
 // `rd/karpathy-review.md` parsed `modelFamily`); equality fails the
 // build. When `~/.peaks/config.json` lacks a `reviewer.providers`
@@ -249,7 +236,6 @@ const PRD_CONTENT = {
 // describe business behavior" — and `it(` is the dominant one by ~8x.
 // Measured 2026-09-16 (`grep -rho '\bit(' tests | wc -l`, same for `test(`):
 // `it(` 3015 vs `test(` 372 across `tests/`; the three test files slice
-// 2026-09-16-codegraph-index-integrity added contain `it(` 58 / `test(` 0.
 // The gate was in fact passing on artifacts whose ONLY `test(` was prose —
 // including this repo's own generated template `buildTestCases`
 // (`src/services/evidence/evidence-generator.ts`), which literally reads
@@ -462,7 +448,6 @@ export async function checkPrerequisites(options) {
     if (options.sessionId !== undefined && isUnsafePathInput(options.sessionId)) {
         throw new Error(`Invalid session id: ${options.sessionId} (must be a single path segment)`);
     }
-    // Slice 006 simplifies the resolution to a 2-tier fallback. The
     // per-change-id scope (`.peaks/_runtime/<sessionId>/<role>/`) is gone — new
     // artifacts go to the session dir directly. The 2 tiers are:
     //   1. `.peaks/_runtime/<sid>/<role>/...` (post-F3 canonical
@@ -481,7 +466,6 @@ export async function checkPrerequisites(options) {
         const relative = resolvePrerequisitePath(prerequisite, options.requestId);
         const absolute = await resolvePrerequisiteAbsolutePathWithFallback(canonicalSessionRoot, legacySessionRoot, prerequisite, options.requestId);
         if (absolute === null) {
-            // v2.13.2 AC-5: back-compat window for MUT_REPORT — missing
             // file downgrades to a warning, NOT a hard failure. v2.14.0
             // will remove this branch and re-elevate missing → throw.
             const backCompat = prerequisite.backCompat === true;
@@ -503,7 +487,6 @@ export async function checkPrerequisites(options) {
             }
         }
     }
-    // GATE C, second half (B2, rid `rid-b2-gate-evidence-wiring`): the capsule's
     // own `gateEvidence` DECLARATION must be true — every path it names must
     // exist. The table loop above owns "which artifacts this type must produce";
     // this owns "the handoff may not claim evidence it does not have". They are
@@ -570,7 +553,6 @@ function emitPrereqTransitionEvent(opts) {
 }
 /**
  * Resolve a prerequisite to an on-disk path, with a 2-tier fallback
- * (slice 006 — the per-change-id tier was dropped because per-change-id
  * dirs are no longer created):
  *   1. `<canonicalSessionRoot>/<relative>` (post-F3 canonical session
  *      home, when `canonicalSessionRoot` is provided).
@@ -586,7 +568,6 @@ function emitPrereqTransitionEvent(opts) {
  * missing. This covers both artifacts that moved location
  * (`rd/security-review.md` → `audit/security.md`) and ones that later
  * gained a rid in the filename (`audit/security.md` →
- * `audit/security-<rid>.md`, slice `2026-09-14-audit-artifact-rid-scoping`).
  */
 async function resolvePrerequisiteAbsolutePathWithFallback(canonicalSessionRoot, legacySessionRoot, prerequisite, requestId) {
     const roots = [canonicalSessionRoot, legacySessionRoot];

package/dist/services/artifacts/artifact-templates.d.ts

@@ -9,7 +9,6 @@ export type RequestArtifactRole = 'prd' | 'ui' | 'rd' | 'qa' | 'sc';
 /**
  * Handoff path helpers.
  *
- * Slice 2026-06-29-change-id-root-removal: all handoff paths now key
  * on the session-id axis (`.peaks/_runtime/<sessionId>/<role>/...`)
  * instead of the deleted change-id axis
  * (`.peaks/_runtime/change/<sessionId>/<role>/...`). The session

package/dist/services/artifacts/artifact-templates.js

@@ -2,7 +2,6 @@ import { PRD_TEMPLATE_BODY, UI_TEMPLATE_BODY, RD_TEMPLATE_BODY, QA_TEMPLATE_BODY
 /**
  * Handoff path helpers.
  *
- * Slice 2026-06-29-change-id-root-removal: all handoff paths now key
  * on the session-id axis (`.peaks/_runtime/<sessionId>/<role>/...`)
  * instead of the deleted change-id axis
  * (`.peaks/_runtime/change/<sessionId>/<role>/...`). The session