peaks-loop 4.1.1 → 4.1.3

package/dist/services/artifacts/request-artifact-service.d.ts

@@ -19,7 +19,6 @@ export type CreateRequestArtifactOptions = {
     requestType?: RequestType;
     clock?: () => string;
     /**
-     * Slice 020 — caller-keyed session binding. The callerId that initiated
      * this artifact creation (resolved via `resolveCallerId` by the CLI).
      * Recorded in the JSON envelope and on the artifact body's frontmatter
      * so a future reader knows which caller produced it. The caller-keyed
@@ -37,13 +36,11 @@ export type CreateRequestArtifactResult = {
     content: string;
     applied: boolean;
     /**
-     * Slice 020 — caller-keyed session binding. The resolved callerId
      * (D4 priority: flag > env > platform fallback) when --caller-id
      * was passed. Omitted from the result when no callerId was set.
      */
     callerId?: string;
     /**
-     * Slice 2026-06-23-request-init-change-scope-leak. The session-axis
      * dir resolved under `.peaks/_runtime/<sid>/`. Always populated so
      * the sub-agent prompt can report a stable, canonical scope
      * location to the writer.
@@ -51,7 +48,6 @@ export type CreateRequestArtifactResult = {
     scopeDir: string;
 };
 /**
- * F-1 (slice 025 security): reject rids that contain path separators, null
  * bytes, or traversal sequences. A request id is a single path segment, so
  * anything that builds a filename from one must test it against this first —
  * it is exported so those call sites reuse it instead of re-declaring a copy
@@ -63,7 +59,6 @@ export type RequestArtifactSummary = {
     role: RequestArtifactRole;
     /**
      * Durable scope of the artifact: the top-level `.peaks/_runtime/<sessionId>/`
-     * directory the file lives in. As of slice 2026-06-05-change-id-as-unit-of-work,
      * the prerequisite gate resolves paths under this dir (not the body
      * `- session:` line), so the file body and the on-disk path agree.
      */

package/dist/services/artifacts/request-artifact-service.js

@@ -4,7 +4,6 @@ import { dirname, join } from 'node:path';
 import { isDirectory, listDirectories } from 'peaks-loop-shared/fs';
 import { checkPrerequisites, DEFAULT_REQUEST_TYPE, isRequestType, VALID_REQUEST_TYPES } from './artifact-prerequisites.js';
 import { ensureSession, getSessionIdCanonical } from '../session/session-manager.js';
-// Slice 2026-06-29-change-id-root-removal: `getCurrentChangeId` was
 // removed with the change-id axis. The change-id binding file is
 // gone; request-artifact callers pass `options.sessionId` explicitly
 // or accept the requestId as the default. Path-safety helpers now
@@ -22,7 +21,6 @@ export { VALID_REQUEST_TYPES, DEFAULT_REQUEST_TYPE, isRequestType };
 // tests) keep importing from this module unchanged. The render templates,
 // handoff-path helpers, and `RequestArtifactRole` type all live in the
 // sibling `artifact-templates.ts` module — see slice
-// 2026-06-24-handoff-path-canonicalization for the rationale.
 //
 // `import type` is required so the type is in scope as a bare identifier
 // within this file (the value re-export alone does not bring types into
@@ -30,7 +28,6 @@ export { VALID_REQUEST_TYPES, DEFAULT_REQUEST_TYPE, isRequestType };
 import { renderTemplate } from './artifact-templates.js';
 export { formatHandoffPath, formatCommitBoundaryPath, formatSkillUsageLessonsPath } from './artifact-templates.js';
 /**
- * F-1 (slice 025 security): reject rids that contain path separators, null
  * bytes, or traversal sequences. A request id is a single path segment, so
  * anything that builds a filename from one must test it against this first —
  * it is exported so those call sites reuse it instead of re-declaring a copy
@@ -65,7 +62,6 @@ function defaultSessionId(iso) {
  * — from `emitObservabilityEvent`'s own session-id check, i.e. after the write.
  */
 function requestArtifactRequestsDir(projectRoot, sessionId, role) {
-    // Slice 2026-09-15 (runtime-path-unrepresentable): the two ids are branded by
     // `guardRuntimeSegment`, which performs the same `isUnsafePathInput` check
     // this function used to spell inline. The join itself now *requires* the
     // brand, so a caller that reaches this dir without a guard does not compile.
@@ -84,7 +80,6 @@ export async function createRequestArtifact(options) {
     // Use provided session ID or get/create current session. The session
     // id is the binding for the artifact file's location.
     //
-    // Slice 006 collapses the per-change-id top-level dirs. The artifact
     // file is now written under the SESSION dir
     // (`.peaks/_runtime/<sid>/<role>/requests/`) instead of the
     // change-id dir. The 2-tier fallback (canonical session → legacy
@@ -100,17 +95,14 @@ export async function createRequestArtifact(options) {
     if (isUnsafePathInput(sessionId)) {
         throw new Error(`Invalid session id: ${sessionId} (must be a single path segment)`);
     }
-    // Slice 2026-06-29-change-id-root-removal: the `current-change`
     // binding file is gone. Resolution order for the change-id (file
     // body metadata) is now:
     //   1. Explicit `options.sessionId` (CLI `--change-id`).
     //   2. The requestId itself (every request is its own scope by default).
     const sessionSlug = options.sessionId ?? options.requestId;
-    // Slice 008 (F21 fix): fail fast when the resolved session id
     // looks like a real session id (matches the date+session prefix)
     // but does NOT correspond to an actual session dir under
     // `.peaks/_runtime/`. Pre-F21 a sub-agent with a typo or stale
-    // binding (e.g. `2025-01-01-session-deadbe`) silently planned
     // to write to a non-existent path. The check is intentionally
     // scoped to "looks like a real session id" — a sid like
     // `test-session` or `s` (no date prefix) is allowed through so
@@ -137,7 +129,6 @@ export async function createRequestArtifact(options) {
         // The writer lowercases the request id into a kebab slug
         // (`buildNumberedFilename`), so the duplicate-detection endsWith must
         // compare against the SAME slug — a mixed-case id like
-        // `2026-09-06-split-batchA` is stored as `...-split-batcha.md`.
         const slug = slugifyDescription(options.requestId);
         const alreadyExists = existingFiles.some((file) => {
             if (file === `${options.requestId}.md`)
@@ -155,7 +146,6 @@ export async function createRequestArtifact(options) {
     const path = join(requestsDir, filename);
     const content = renderTemplate(options.role, options.requestId, sessionId, sessionSlug, timestamp, requestType);
     if (options.apply !== true) {
-        // Slice 2026-06-29-change-id-root-removal: scopeDir is the
         // session-axis dir (`.peaks/_runtime/<sid>/`). Pre-resolved here
         // so dry-run output reports the canonical scope location.
         const scopeDir = runtimeRoot(options.projectRoot).join(guardRuntimeSegment(sessionId, 'session id'));
@@ -312,7 +302,6 @@ export async function showRequestArtifact(options) {
     // Search for files matching the requestId (supports both legacy and numbered formats)
     // The numbered format lowercases the request id into a kebab slug
     // (`buildNumberedFilename`), so the endsWith must compare against the SAME
-    // slug — a mixed-case id like `2026-09-06-split-batchA` is stored as
     // `...-split-batcha.md` and must still resolve here.
     const slug = slugifyDescription(options.requestId);
     const findFileInDir = async (dir) => {
@@ -422,7 +411,6 @@ export async function transitionRequestArtifact(options) {
     // (Removed in v2.11.0 Group A: the tech-doc-presence + tech-doc-mandatory-
     // sections gates. The rd → spec-locked transition now relies on the
     // immutable peaks-prd handoff (sha256-frontmatter) for the same intent;
-    // see PRD for `v2-11-rd-techdoc-removal-and-runtime-friction` AC-3/AC-4.)
     // Type sanity check for PRD handoff
     if (options.typeSanityCheck !== undefined &&
         options.role === 'prd' &&

package/dist/services/artifacts/request-artifact-state-helpers.d.ts

@@ -10,7 +10,6 @@ export declare class PrerequisitesNotSatisfiedError extends Error {
     readonly sessionId: string;
     readonly missing: PrerequisiteCheckResult['missing'];
     /**
-     * v2.13.3 AC-3 — soft-block warnings carried alongside the missing
      * entries. Surfaced in the CLI error response under `data.warnings`
      * so the operator can see which prereqs were soft-blocked under
      * the 1-minor-release back-compat window (e.g. MUT_REPORT). Always

package/dist/services/artifacts/request-artifact-state-helpers.js

@@ -15,7 +15,6 @@ export class PrerequisitesNotSatisfiedError extends Error {
     sessionId;
     missing;
     /**
-     * v2.13.3 AC-3 — soft-block warnings carried alongside the missing
      * entries. Surfaced in the CLI error response under `data.warnings`
      * so the operator can see which prereqs were soft-blocked under
      * the 1-minor-release back-compat window (e.g. MUT_REPORT). Always

package/dist/services/audit/artifact-writer.d.ts

@@ -1,5 +1,4 @@
 /**
- * Audit artifact writer — Slice 2026-06-26-audit-artifact-writer-generalization.
  *
  * Generalizes the original `decision-writer.ts` (which only knew how to
  * persist a `RedLineAudit` snapshot) into a polymorphic writer that

package/dist/services/audit/artifact-writer.js

@@ -1,5 +1,4 @@
 /**
- * Audit artifact writer — Slice 2026-06-26-audit-artifact-writer-generalization.
  *
  * Generalizes the original `decision-writer.ts` (which only knew how to
  * persist a `RedLineAudit` snapshot) into a polymorphic writer that

package/dist/services/audit/decision-writer.js

@@ -116,6 +116,9 @@ export function renderDecisionMarkdown(audit, options) {
         `description: ${description}`,
         'metadata:',
         '  type: decision',
+        // The other three artifact writers all carry `artifactType`; without it a
+        // decision record is the one kind future tooling cannot query by artifact.
+        '  artifactType: decision',
         '  auditType: red-lines',
         `  totalRedLines: ${audit.totalRedLines}`,
         `  cliBacked: ${audit.cliBacked}`,
@@ -213,7 +216,6 @@ export function writeAuditDecision(audit, options) {
     };
 }
 // ---------------------------------------------------------------------------
-// Back-compat re-export — Slice 2026-06-26-audit-artifact-writer-generalization.
 //
 // `writeAuditDecision` is preserved above (no caller signature change).
 // New callers should use `writeDecision` from `artifact-writer.ts` directly.

package/dist/services/audit/enforcer-liveness.js

@@ -1,5 +1,4 @@
 /**
- * Enforcer liveness — A9 of `.peaks/docs/diagnosis-2026-09-15-peaks-loop-state.md`.
  *
  * `cli-backed` used to mean "the `enforcerRef` path exists on disk"
  * (`backing-detector.ts`). It did not mean "the enforcer runs". Ten catalog

package/dist/services/audit/enforcers/active-skill-resolver.d.ts

@@ -32,10 +32,8 @@ export interface ActiveSkillResolution {
      * Mode token recorded on the canonical lease (e.g. `full-auto`,
      * `assisted`, `strict`, `24h`). Normalized on read: a legacy
      * on-disk `'swarm'` surfaces as `'full-auto'` (slice
-     * 2026-09-09-mode-consolidation). `null` when the source is not
      * `canonical` (the legacy `active-skill-*.json` files do not
      * surface a mode field, and the `env` / `none` cases are test
-     * overrides). Slice 2026-08-04-rid-005 surfaced this so the
      * statusline can render the orchestrator's mode alongside the
      * active leaf role.
      */

package/dist/services/audit/enforcers/active-skill-resolver.js

@@ -65,7 +65,6 @@ export function resolveActiveSkillForCaller(projectRoot, opts) {
     // ad-hoc / pre-migration projects) we fall through to the legacy
     // walk below.
     // `getSessionDir` refuses an unsafe session id by throwing (slice
-    // 2026-09-14-getsessiondir-guard). This function's contract is the
     // resolution order's "graceful degradation — never throws", so an unsafe
     // id degrades to the same `source: 'none'` shape an absent session dir
     // produces, exactly as it did before that guard existed. Without this,
@@ -94,7 +93,6 @@ export function resolveActiveSkillForCaller(projectRoot, opts) {
         if (typeof lease.skill !== 'string' || lease.skill.length === 0)
             continue;
         // When a callerId is supplied, restrict the walk to that
-        // caller's lease. Slice 2026-08-04-rid-005 surfaces this for the
         // statusline read so two concurrent sessions bound to the same
         // project session do not see each other's skill.
         if (typeof opts?.callerId === 'string' &&

package/dist/services/audit/red-line-audit-input.d.ts

@@ -0,0 +1,11 @@
+import type { RedLineAudit } from './types.js';
+/** The refusal the CLI reports as `AUDIT_ARTIFACT_INPUT_INVALID`. */
+export declare class RedLineAuditInputError extends Error {
+    constructor(problem: string);
+}
+/**
+ * Parse and validate a RedLineAudit JSON document. Throws
+ * `RedLineAuditInputError` naming the first field that failed; returns the
+ * parsed value typed as `RedLineAudit` once every field holds.
+ */
+export declare function parseRedLineAuditInput(text: string): RedLineAudit;

package/dist/services/audit/red-line-audit-input.js

@@ -0,0 +1,103 @@
+// src/services/audit/red-line-audit-input.ts
+//
+// Validates the JSON a caller hands to `peaks audit artifact write --kind
+// decision`.
+//
+// The input crosses a system boundary — it is a file from disk, usually an
+// archived scan — and the writer it feeds renders whatever it is given into a
+// memory record with no further checks. Without a validator here, a truncated
+// or reshaped JSON would land in `.peaks/memory/audit-decisions/` as if it were
+// a verdict, and the memory index would treat it as one. So the shape is
+// asserted field by field, and every refusal names the field that failed.
+//
+// Why not a schema library: the contract is six fields and two item shapes, all
+// of which already exist as TypeScript types in `./types.js`. A runtime schema
+// would be a second spelling of the same contract, free to drift.
+/** The refusal the CLI reports as `AUDIT_ARTIFACT_INPUT_INVALID`. */
+export class RedLineAuditInputError extends Error {
+    constructor(problem) {
+        super(`decision input is not a RedLineAudit: ${problem}`);
+        this.name = 'RedLineAuditInputError';
+    }
+}
+const COUNT_FIELDS = ['totalRedLines', 'cliBacked', 'partial', 'proseOnly'];
+const ENTRY_FIELDS = ['id', 'rule', 'source', 'backing'];
+const FINDING_FIELDS = ['enforcerId', 'rule', 'severity', 'file', 'detail'];
+const FINDING_SEVERITIES = ['pass', 'warn', 'fail'];
+function asRecord(value, label) {
+    if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+        throw new RedLineAuditInputError(`${label} must be an object`);
+    }
+    return value;
+}
+function requireCounts(audit) {
+    for (const field of COUNT_FIELDS) {
+        const value = audit[field];
+        if (typeof value !== 'number' || !Number.isInteger(value) || value < 0) {
+            throw new RedLineAuditInputError(`${field} must be a non-negative integer`);
+        }
+    }
+}
+function requireEntries(audit) {
+    const entries = audit['audit'];
+    if (!Array.isArray(entries)) {
+        throw new RedLineAuditInputError('audit must be an array of red-line entries');
+    }
+    for (const entry of entries) {
+        const record = asRecord(entry, 'audit[]');
+        for (const field of ENTRY_FIELDS) {
+            if (typeof record[field] !== 'string') {
+                throw new RedLineAuditInputError(`audit[].${field} must be a string`);
+            }
+        }
+        const ref = record['enforcerRef'];
+        if (typeof ref !== 'string' && ref !== null) {
+            throw new RedLineAuditInputError('audit[].enforcerRef must be a string or null');
+        }
+    }
+}
+function requireFindings(audit) {
+    const findings = audit['enforcerFindings'];
+    if (!Array.isArray(findings)) {
+        throw new RedLineAuditInputError('enforcerFindings must be an array');
+    }
+    for (const finding of findings) {
+        const record = asRecord(finding, 'enforcerFindings[]');
+        for (const field of FINDING_FIELDS) {
+            if (typeof record[field] !== 'string') {
+                throw new RedLineAuditInputError(`enforcerFindings[].${field} must be a string`);
+            }
+        }
+        const severity = record['severity'];
+        if (typeof severity !== 'string' ||
+            !FINDING_SEVERITIES.includes(severity)) {
+            throw new RedLineAuditInputError(`enforcerFindings[].severity must be one of ${FINDING_SEVERITIES.join(' | ')}`);
+        }
+    }
+}
+/**
+ * Parse and validate a RedLineAudit JSON document. Throws
+ * `RedLineAuditInputError` naming the first field that failed; returns the
+ * parsed value typed as `RedLineAudit` once every field holds.
+ */
+export function parseRedLineAuditInput(text) {
+    let parsed;
+    try {
+        parsed = JSON.parse(text);
+    }
+    catch (error) {
+        throw new RedLineAuditInputError(`invalid JSON (${String(error)})`);
+    }
+    const audit = asRecord(parsed, 'the document');
+    requireCounts(audit);
+    requireEntries(audit);
+    requireFindings(audit);
+    return {
+        totalRedLines: Number(audit['totalRedLines']),
+        cliBacked: Number(audit['cliBacked']),
+        partial: Number(audit['partial']),
+        proseOnly: Number(audit['proseOnly']),
+        audit: audit['audit'].map((entry) => entry),
+        enforcerFindings: audit['enforcerFindings'].map((finding) => finding)
+    };
+}

package/dist/services/audit/red-line-catalog-p2-a-bee-runtime.d.ts

@@ -1,6 +1,5 @@
 /**
  * P2-a red lines that bind a specific peaks-* bee: the prose-only-sweep
- * entries (slice 2026-07-29-rid-prose-only-sweep-001 … -010) that make a
  * SKILL.md declare its own runtime contract. Hoisted verbatim out of
  * `red-line-catalog-p2-a.ts` by the b1 file-size campaign — no `id`, `rule`,
  * `markers`, `phrases` or `enforcerRef` value was edited, and the names are

package/dist/services/audit/red-line-catalog-p2-a.js

@@ -27,40 +27,33 @@ export const RED_LINE_CATALOG_P2_A = [
     PEAKS_DOCTOR_SKILL_ACKNOWLEDGED,
     CATALOG_TOTAL_LE_45,
     CATALOG_PROSE_ONLY_RATIO,
-    // Slice 2026-07-29-rid-prose-only-sweep-001: close the first
     // discovered prose-only line. peaks-prd-skill-md-56 was a
     // "MANDATORY first action" marker on a "Skill presence" heading
     // in skills/bee/* SKILL.md. The MANDATORY marker + the heading
     // are now enforced by lint-skill-presence-mandatory.ts.
     SKILL_PRESENCE_MANDATORY,
-    // Slice 2026-07-29-rid-prose-only-sweep-002: close two more
     // peaks-prd discovered lines (md-292, md-301) with one
     // enforcer. The enforcer pattern-scans the source-snapshot
     // placement guidance + prohibited-paths list.
     PRD_SOURCE_SNAPSHOT_PLACEMENT,
-    // Slice 2026-07-29-rid-prose-only-sweep-004: close three
     // peaks-prd discovered lines (md-99 / md-166 / md-193) with
     // one enforcer. The handoff contract requires preserved
     // behavior, step 5.5, and transition verification gates.
     PRD_ARTIFACT_HANDOFF,
-    // Slice 2026-07-29-rid-prose-only-sweep-005: close three
     // peaks-rd discovered lines (md-121 / md-127 / md-162) with
     // two enforcers (handoff + coverage discipline).
     RD_HANDOFF_CONTRACT,
     RD_COVERAGE_DISCIPLINE,
-    // Slice 2026-07-29-rid-prose-only-sweep-006: close four
     // peaks-qa discovered lines (md-26 gateguard + md-113
     // transition gates + md-165 playwright + md-201 openspec).
     QA_GATEGUARD_PREFLIGHT,
     QA_RUNTIME_CONTRACT,
-    // Slice 2026-07-29-rid-prose-only-sweep-007: close six more
     // discovered lines (3 peaks-ui + 2 peaks-txt + 1
     // peaks-perf-audit) with four enforcers.
     PEAKS_UI_SUPERPOWERS_CHAIN,
     PEAKS_UI_INVOLVEMENT,
     PEAKS_TXT_UPSTREAM,
     PEAKS_PERF_AUDIT_SCOPE,
-    // Slice 2026-07-29-rid-prose-only-sweep-008: close six more
     // discovered lines (2 peaks-rd + 1 peaks-sc + 1 peaks-txt +
     // 1 peaks-ui + 1 peaks-ui) with four enforcers in
     // lint-bee-runtime-contract.ts.
@@ -68,12 +61,10 @@ export const RED_LINE_CATALOG_P2_A = [
     PEAKS_UI_TRANSITION_GATES,
     PEAKS_SC_TRANSITION_GATES,
     PEAKS_TXT_RUNTIME_CONTRACT,
-    // Slice 2026-07-29-rid-prose-only-sweep-009: close 13 of the
     // remaining 33 discovered lines (all peaks-code) with one
     // enforcer that checks the peaks-code runbook section-marker
     // skeleton. Single catalog entry; multi-marker enforcer.
     PEAKS_CODE_RUNTIME_CONTRACT,
-    // Slice 2026-07-29-rid-prose-only-sweep-010: 8 of the
     // remaining 22 discovered lines (peaks-audit x4,
     // peaks-content x2, peaks-ide x2) closed with 6 enforcers
     // in one file.

package/dist/services/audit/types.d.ts

@@ -1,8 +1,6 @@
 /**
  * Red-line audit framework — types.
  *
- * Spec: docs/superpowers/specs/2026-06-11-peaks-loop-l1-l2-l3-redesign.md §5
- * PRD:  .peaks/_runtime/2026-06-11-session-f0312d/prd/requests/001-001-l2-1-redlines-audit.md
  * OpenSpec: openspec/changes/2026-06-11-l2-1-redlines-audit/
  *
  * The audit framework classifies MANDATORY / BLOCKING / MUST NOT / RED LINE

package/dist/services/audit/types.js

@@ -1,8 +1,6 @@
 /**
  * Red-line audit framework — types.
  *
- * Spec: docs/superpowers/specs/2026-06-11-peaks-loop-l1-l2-l3-redesign.md §5
- * PRD:  .peaks/_runtime/2026-06-11-session-f0312d/prd/requests/001-001-l2-1-redlines-audit.md
  * OpenSpec: openspec/changes/2026-06-11-l2-1-redlines-audit/
  *
  * The audit framework classifies MANDATORY / BLOCKING / MUST NOT / RED LINE

package/dist/services/audit-independent/perf-audit-service.d.ts

@@ -103,9 +103,7 @@ export declare function detectPerfAudit(input: {
     readonly sessionId: string;
     /**
      * The slice whose capsule this run audits. Slice
-     * `2026-09-14-prd-capsule-rid-scoping` put the rid in the capsule's
      * filename, so a caller that knows it must pass it or the probe resolves
-     * only the pre-rid-scoping bare name. Both callers pass it:
      * `runPerfAudit` always did, and `peaks perf-audit detect` forwards its
      * long-standing `--rid` flag as of the post-verification repair round.
      */

package/dist/services/audit-independent/security-audit-service.d.ts

@@ -2,7 +2,6 @@
  * peaks-security-audit service — independent security audit skill driver.
  *
  * Slice v2.12.0 (Group A, Tier 2). The skill is decoupled from the
- * peaks-rd 5-way fan-out (per PRD AC-2.x) and lives as a standalone
  * CLI surface: `peaks security-audit run --rid <id> ...`.
  *
  * The service owns:
@@ -19,7 +18,6 @@
  * is the pure I/O + validation core; the LLM is the judgement core.
  *
  * Why a service (not inlined in the CLI):
- *   - Unit-testable in isolation (6 case per PRD AC-2.8)
  *   - The 5-state detector mirrors the ecc-bridge detectEcc pattern
  *     (slice 7 Group D), keeping the surface uniform
  *   - Future migration to peaks sub-agent dispatch (peaks-rd main
@@ -37,7 +35,6 @@
  *
  *   - `ready`              — handoff + template + project all present
  *   - `handoff-missing`    — this slice's `.peaks/_runtime/<sid>/prd/handoff-<rid>.md`
- *                        (or the pre-rid-scoping `prd/handoff.md`) absent
  *   - `template-missing`   — `.peaks/project-scan/security-template.md` absent
  *   - `dispatch-failed`    — parent LLM threw before returning the audit envelope
  *   - `envelope-malformed` — parent LLM returned a value that fails `isSecurityAuditEnvelope`
@@ -110,9 +107,7 @@ export declare function detectSecurityAudit(input: {
     readonly sessionId: string;
     /**
      * The slice whose capsule this run audits. Slice
-     * `2026-09-14-prd-capsule-rid-scoping` put the rid in the capsule's
      * filename, so a caller that knows it must pass it or the probe resolves
-     * only the pre-rid-scoping bare name. Both callers pass it:
      * `runSecurityAudit` always did, and `peaks security-audit detect` forwards
      * its long-standing `--rid` flag as of the post-verification repair round.
      */

package/dist/services/audit-independent/security-audit-service.js

@@ -2,7 +2,6 @@
  * peaks-security-audit service — independent security audit skill driver.
  *
  * Slice v2.12.0 (Group A, Tier 2). The skill is decoupled from the
- * peaks-rd 5-way fan-out (per PRD AC-2.x) and lives as a standalone
  * CLI surface: `peaks security-audit run --rid <id> ...`.
  *
  * The service owns:
@@ -19,7 +18,6 @@
  * is the pure I/O + validation core; the LLM is the judgement core.
  *
  * Why a service (not inlined in the CLI):
- *   - Unit-testable in isolation (6 case per PRD AC-2.8)
  *   - The 5-state detector mirrors the ecc-bridge detectEcc pattern
  *     (slice 7 Group D), keeping the surface uniform
  *   - Future migration to peaks sub-agent dispatch (peaks-rd main

package/dist/services/autonomous-swarm/autonomous-swarm-service.d.ts

@@ -1,5 +1,4 @@
 /**
- * autonomous-swarm-service — slice rid-014.
  *
  * Purpose:
  *   Build a dry-run-only autonomous RD swarm planner that turns a
@@ -8,12 +7,8 @@
  *   checkpoint queue, worker-queue placeholders (no spawn), evidence
  *   requirements, and resume instructions.
  *
- * Reuse (per rid-014 plan §1):
  *   - `validateChangeId` + `planArtifactPath` + `buildWorkspaceUnavailable`
- *     from `src/services/openspec/artifact-boundary.ts` (rid-009).
- *   - `getTechStatus` from `src/services/tech/tech-service.ts` (rid-012).
  *   - `planRdSwarmGraph` shape from `src/services/rd-swarm/rd-swarm-service.ts`
- *     (rid-013) — composed as the workerQueue feed.
  *
  * Style:
  *   - Named function exports — matches `rd-swarm-service.ts` + `artifact-boundary.ts`.

package/dist/services/autonomous-swarm/autonomous-swarm-service.js

@@ -1,5 +1,4 @@
 /**
- * autonomous-swarm-service — slice rid-014.
  *
  * Purpose:
  *   Build a dry-run-only autonomous RD swarm planner that turns a
@@ -8,12 +7,8 @@
  *   checkpoint queue, worker-queue placeholders (no spawn), evidence
  *   requirements, and resume instructions.
  *
- * Reuse (per rid-014 plan §1):
  *   - `validateChangeId` + `planArtifactPath` + `buildWorkspaceUnavailable`
- *     from `src/services/openspec/artifact-boundary.ts` (rid-009).
- *   - `getTechStatus` from `src/services/tech/tech-service.ts` (rid-012).
  *   - `planRdSwarmGraph` shape from `src/services/rd-swarm/rd-swarm-service.ts`
- *     (rid-013) — composed as the workerQueue feed.
  *
  * Style:
  *   - Named function exports — matches `rd-swarm-service.ts` + `artifact-boundary.ts`.

package/dist/services/best-practice/language-detector.js

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-08-12 best-practice-scan — language detector.
  *
  * Detects the project's primary language from well-known marker files.
  * Returns one of: typescript | javascript | python | go | java | unknown.

package/dist/services/best-practice/output-formatter.d.ts

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-08-12 best-practice-scan — output formatter.
  *
  * Renders the 8-row business-decision comparison table (per spec §5) plus
  * the 3-line footer (spec §5 footer + §7 ⚠️ gate). The formatter is the

package/dist/services/best-practice/scan-orchestrator.d.ts

@@ -1,5 +1,4 @@
 /**
- * Slice 2026-08-12 best-practice-scan — scan orchestrator.
  *
  * Resolves a doc-fragment set for a (intent, language) query via the
  * following priority chain:

package/dist/services/capability-audit-service/types.d.ts

@@ -22,9 +22,7 @@ export type AuditFindingCode =
 /** The observed journey set is not the frozen P0 set. */
 'OBSERVATION_INCOMPLETE'
 /** The frozen baseline's own row set is not the P0 set. */
- | 'BASELINE_ROW_SET_INVALID'
-/** A frozen `sourceFiles` entry no longer exists on disk. */
- | 'SOURCE_FILE_MISSING';
+ | 'BASELINE_ROW_SET_INVALID' | 'SOURCE_FILE_MISSING';
 export interface AuditFinding {
     readonly code: AuditFindingCode;
     readonly journeyId: JourneyId;

package/dist/services/capability-guard-runner/contracts/J08.js

@@ -1,4 +1,4 @@
-import Database from 'better-sqlite3';
+import { openSqlite } from '../../sqlite/sqlite-driver.js';
 import { CrystallizationIntegrityError, CrystallizationService, CrystallizationTaskStateSchema } from '../../crystallization/crystallization-service.js';
 import { combineProbes, fail, missingSourceFiles, pass, probe, requireBaselineRow } from './_shared.js';
 /** Test doubles: `assertReady` never reaches any of them. */
@@ -13,7 +13,7 @@ function probeService() {
         insertLoopRelease: noop,
         insertLoopBeeRelation: noop
     };
-    return new CrystallizationService(new Database(':memory:'), opts);
+    return new CrystallizationService(openSqlite(':memory:'), opts);
 }
 /**
  * Behavioural probe of the crystallization gate.

package/dist/services/changeset/changeset-check-service.d.ts

@@ -1,13 +1,10 @@
 /**
- * rid-011 — peaks changeset check hard gate (Phase 4 slice 2).
  *
  * Module path: src/services/changeset/changeset-check-service.ts
  * Mirror of publish.yml gate-changeset step (lines 220-243). Hard-gate,
  * no warning mode, no opt-out. Auto-wired as step 0 of `peaks release
  * canary` and `peaks release hotfix` BEFORE the rid-010 precheck guard.
  *
- * Decoupling note: rid-010 Layer C (`runChangesetStaged`) is ad-hoc
- * precheck (warning by default, --strict upgrade); rid-011 hard gate is
  * unconditional. Both filters inspect `.changeset/*.md` (excluding
  * README.md) but with different policy semantics.
  */

package/dist/services/changeset/changeset-check-service.js

@@ -1,13 +1,10 @@
 /**
- * rid-011 — peaks changeset check hard gate (Phase 4 slice 2).
  *
  * Module path: src/services/changeset/changeset-check-service.ts
  * Mirror of publish.yml gate-changeset step (lines 220-243). Hard-gate,
  * no warning mode, no opt-out. Auto-wired as step 0 of `peaks release
  * canary` and `peaks release hotfix` BEFORE the rid-010 precheck guard.
  *
- * Decoupling note: rid-010 Layer C (`runChangesetStaged`) is ad-hoc
- * precheck (warning by default, --strict upgrade); rid-011 hard gate is
  * unconditional. Both filters inspect `.changeset/*.md` (excluding
  * README.md) but with different policy semantics.
  */

package/dist/services/classify/classify-service.d.ts

@@ -1,7 +1,6 @@
 /**
  * L1a task classification service.
  *
- * Spec: docs/superpowers/specs/2026-06-11-peaks-loop-l1-l2-l3-redesign.md §4
  *
  * Hybrid mechanism: signal-based heuristic + user override + audit log.
  *

package/dist/services/classify/classify-service.js

@@ -1,7 +1,6 @@
 /**
  * L1a task classification service.
  *
- * Spec: docs/superpowers/specs/2026-06-11-peaks-loop-l1-l2-l3-redesign.md §4
  *
  * Hybrid mechanism: signal-based heuristic + user override + audit log.
  *

package/dist/services/classify/classify-types.d.ts

@@ -1,7 +1,6 @@
 /**
  * L1a task classification — types and per-level gate sets.
  *
- * Spec: docs/superpowers/specs/2026-06-11-peaks-loop-l1-l2-l3-redesign.md §4
  *
  * Five task levels: typo / bug / feature / refactor / migration. Each
  * level has a gate set (the "配套 gate set" — L1b) that the slice

package/dist/services/classify/classify-types.js

@@ -1,7 +1,6 @@
 /**
  * L1a task classification — types and per-level gate sets.
  *
- * Spec: docs/superpowers/specs/2026-06-11-peaks-loop-l1-l2-l3-redesign.md §4
  *
  * Five task levels: typo / bug / feature / refactor / migration. Each
  * level has a gate set (the "配套 gate set" — L1b) that the slice