peaks-loop 4.1.3 → 4.1.4

package/dist/cli/commands/asset-crystallize-payload.d.ts

@@ -0,0 +1,47 @@
+import type { CrystallizationService, CrystallizationTrigger, EvidenceBrief } from '../../services/crystallization/index.js';
+import { type ProgramIO } from '../cli-helpers.js';
+export type CrystallizeOptions = {
+    fromTask: string;
+    loopId: string;
+    loopName: string;
+    loopScenario: string;
+    loopTriggerPolicy: string;
+    loopInteractionPolicy: string;
+    loopFeedbackPolicy: string;
+    loopEvolutionPolicy: string;
+    loopSuccessCriterion: string[];
+    loopEvaluatorPolicy: string[];
+    loopVersion: string;
+    beeName: string;
+    beeVersion: string;
+    beeDescription: string;
+    beeRelationReason: string;
+    briefWhatHappened: string;
+    briefWhyItMatters: string;
+    briefWhatLearned: string;
+    briefWhatAction: string;
+    briefBullet: string[];
+    sourceTrace: string[];
+    evaluatorSummary?: string;
+    userDecisionSummary?: string;
+    beeIntentRaw?: string;
+    beeParentVersion?: string;
+    beeChangelog?: string;
+    trigger: string;
+    project?: string;
+    json?: boolean;
+};
+/** The four brief sections as the caller supplied them. */
+export declare function briefFromOptions(options: CrystallizeOptions): Record<string, string>;
+export declare function buildCrystallizePayload(options: CrystallizeOptions, brief: EvidenceBrief, trigger: CrystallizationTrigger): Parameters<CrystallizationService['crystallize']>[0];
+export declare function printCrystallizeResult(io: ProgramIO, recommendation: {
+    payload: {
+        brief: unknown;
+        bullets: unknown;
+        source_trace_pointers: unknown;
+        evaluator_summary: unknown;
+    };
+}, result: {
+    loop_release_id: string;
+    crystallization_event_id: string;
+}, json: boolean | undefined): void;

package/dist/cli/commands/asset-crystallize-payload.js

@@ -0,0 +1,85 @@
+// src/cli/commands/asset-crystallize-payload.ts
+//
+// The `asset.crystallize` payload and success envelope: the options shape the
+// verb's registration fills in, the three builders that turn it into the
+// service argument, and the printer for a completed crystallization. Split out
+// of `asset-crystallize-command.ts` so no single module carries both halves.
+import { printResult } from '../cli-helpers.js';
+import { ok } from 'peaks-loop-shared/result';
+/** The four brief sections as the caller supplied them. */
+export function briefFromOptions(options) {
+    return {
+        what_happened: options.briefWhatHappened,
+        why_it_matters: options.briefWhyItMatters,
+        what_learned: options.briefWhatLearned,
+        what_action: options.briefWhatAction
+    };
+}
+function buildLoopInput(options) {
+    return {
+        id: options.loopId,
+        name: options.loopName,
+        scenario: options.loopScenario,
+        trigger_policy: options.loopTriggerPolicy,
+        success_criteria: options.loopSuccessCriterion,
+        interaction_policy: options.loopInteractionPolicy,
+        feedback_policy: options.loopFeedbackPolicy,
+        evolution_policy: options.loopEvolutionPolicy,
+        evaluator_policy: options.loopEvaluatorPolicy,
+        linked_bees: [],
+        run_history: [],
+        crystallization_evidence: [],
+        lifecycle_status: 'candidate',
+        version: options.loopVersion
+    };
+}
+function buildBeeInput(options) {
+    return {
+        bee_name: options.beeName,
+        version: options.beeVersion,
+        description: options.beeDescription,
+        ...(options.beeIntentRaw !== undefined ? { user_intent_raw: options.beeIntentRaw } : {}),
+        ...(options.beeParentVersion !== undefined ? { parent_version: options.beeParentVersion } : {}),
+        ...(options.beeChangelog !== undefined ? { changelog: options.beeChangelog } : {})
+    };
+}
+export function buildCrystallizePayload(options, brief, trigger) {
+    return {
+        task: {
+            task_id: options.fromTask,
+            task_status: 'completed',
+            gates_passed: true,
+            evidence_collected: true
+        },
+        loop_input: buildLoopInput(options),
+        bee_input: buildBeeInput(options),
+        bee_relation_reason: options.beeRelationReason,
+        evidence_brief: brief,
+        evidence_bullets: options.briefBullet ?? [],
+        source_trace_pointers: options.sourceTrace ?? [],
+        ...(options.evaluatorSummary !== undefined
+            ? { evaluator_summary: options.evaluatorSummary }
+            : {}),
+        ...(options.userDecisionSummary !== undefined
+            ? { user_decision_summary: options.userDecisionSummary }
+            : {}),
+        trigger
+    };
+}
+export function printCrystallizeResult(io, recommendation, result, json) {
+    printResult(io, ok('asset.crystallize', {
+        recommendation: {
+            brief: recommendation.payload.brief,
+            bullets: recommendation.payload.bullets,
+            source_trace_pointers: recommendation.payload.source_trace_pointers,
+            evaluator_summary: recommendation.payload.evaluator_summary
+        },
+        result,
+        nextActions: [
+            `Run \`peaks loop show --loop ${result.loop_release_id}\` to inspect the new loop_release.`,
+            `Run \`peaks asset dispose --crystallization-event ${result.crystallization_event_id} --mode trace_only\` to retire the event without touching the asset.`
+        ]
+    }, [], [
+        'The CLI has surfaced a complete 4-section brief; the LLM should now drive the user through AskUserQuestion picks (spec §5.3).'
+    ]), json);
+}

package/dist/cli/commands/asset-crystallize-runner.d.ts

@@ -0,0 +1,3 @@
+import { type ProgramIO } from '../cli-helpers.js';
+import { type CrystallizeOptions } from './asset-crystallize-payload.js';
+export declare function runAssetCrystallize(io: ProgramIO, options: CrystallizeOptions): Promise<void>;

package/dist/cli/commands/asset-crystallize-runner.js

@@ -0,0 +1,133 @@
+// src/cli/commands/asset-crystallize-runner.ts
+//
+// The `asset.crystallize` action body and its failure envelopes. Split out of
+// `asset-crystallize-command.ts`; every error code, message and next-action
+// list is unchanged, including the rethrow of an error class the verb does not
+// handle itself.
+import { CrystallizationIntegrityError, BriefSectionError, safeRenderRecommendationPayload, CRYSTALLIZATION_TRIGGERS, parseEvidenceBrief } from '../../services/crystallization/index.js';
+import { printResult } from '../cli-helpers.js';
+import { fail } from 'peaks-loop-shared/result';
+import { createCrystallizationService, openAssetDb, parseTriggerFlag, resolveAssetProjectRoot } from './asset-command-shared.js';
+import { briefFromOptions, buildCrystallizePayload, printCrystallizeResult } from './asset-crystallize-payload.js';
+function failCrystallize(io, failure) {
+    printResult(io, fail('asset.crystallize', failure.code, failure.message, failure.data, failure.nextActions), failure.json);
+    process.exitCode = 1;
+}
+function printInvalidTrigger(io, options) {
+    failCrystallize(io, {
+        code: 'ASSET_INVALID_TRIGGER',
+        message: `--trigger must be one of: ${CRYSTALLIZATION_TRIGGERS.join('|')}`,
+        data: { trigger: options.trigger },
+        nextActions: ['Pass a valid --trigger value.'],
+        json: options.json
+    });
+}
+function printMissingBrief(io, err, candidateBrief, json) {
+    const briefErr = err;
+    failCrystallize(io, {
+        code: 'MISSING_BRIEF_SECTION',
+        message: briefErr.message,
+        data: { findings: [...briefErr.findings], flagsProvided: Object.keys(candidateBrief) },
+        nextActions: [
+            'Pass ALL FOUR brief sections via --brief-what-happened / --brief-why-it-matters / --brief-what-learned / --brief-what-action.',
+            'The CLI refuses to render a recommendation without a complete 4-section brief (spec §4.7 / RL-7).'
+        ],
+        json
+    });
+}
+function printRecommendationRejected(io, recommendation, candidateBrief, json) {
+    failCrystallize(io, {
+        code: recommendation.code ?? 'MISSING_BRIEF_SECTION',
+        message: 'recommendation envelope rejected — brief is missing one of its 4 sections',
+        data: { findings: recommendation.findings, briefProvided: candidateBrief },
+        nextActions: [
+            'Pass ALL FOUR brief sections via the matching CLI flags.',
+            'Counts in --brief-bullet may support the brief; they do NOT replace it (spec §4.7 / RL-7).'
+        ],
+        json
+    });
+}
+/** Terminal failures from the service. Anything else is rethrown, as before. */
+function handleCrystallizeError(io, err, json) {
+    if (err instanceof CrystallizationIntegrityError) {
+        const integrityErr = err;
+        failCrystallize(io, {
+            code: integrityErr.code,
+            message: integrityErr.message,
+            data: { findings: [...integrityErr.findings] },
+            nextActions: [
+                integrityErr.code === 'CRYSTALLIZATION_PRE_RUN'
+                    ? 'Re-shape the candidate task so task_status=completed AND gates_passed=true AND evidence_collected=true (spec §5 / RL-2).'
+                    : integrityErr.code === 'MISSING_BRIEF_SECTION'
+                        ? 'Pass ALL FOUR brief sections (RL-7); the CLI refuses to render a recommendation without them.'
+                        : 'Inspect the failure findings and re-shape the payload.'
+            ],
+            json
+        });
+        return;
+    }
+    if (err instanceof BriefSectionError) {
+        const briefErr = err;
+        failCrystallize(io, {
+            code: 'MISSING_BRIEF_SECTION',
+            message: briefErr.message,
+            data: { findings: [...briefErr.findings] },
+            nextActions: ['Pass all 4 brief sections (RL-7).'],
+            json
+        });
+        return;
+    }
+    throw err;
+}
+export async function runAssetCrystallize(io, options) {
+    try {
+        const trigger = parseTriggerFlag(options.trigger);
+        if (!trigger) {
+            printInvalidTrigger(io, options);
+            return;
+        }
+        // Build the brief from CLI flags and re-validate it through
+        // the canonical schema (so a partial brief is caught BEFORE
+        // any DB side effects fire).
+        const candidateBrief = briefFromOptions(options);
+        let brief;
+        try {
+            brief = parseEvidenceBrief(candidateBrief);
+        }
+        catch (err) {
+            if (err instanceof BriefSectionError) {
+                printMissingBrief(io, err, candidateBrief, options.json);
+                return;
+            }
+            throw err;
+        }
+        // Render the recommendation envelope up-front so the CLI can
+        // refuse to write if any brief section is missing. This is
+        // the same code path the crystallization service uses.
+        const recommendation = safeRenderRecommendationPayload({
+            brief,
+            bullets: options.briefBullet ?? [],
+            source_trace_pointers: options.sourceTrace ?? [],
+            evaluator_summary: {
+                one_liner: options.evaluatorSummary ?? '',
+                risk_tags: []
+            }
+        });
+        if (!recommendation.ok) {
+            printRecommendationRejected(io, recommendation, candidateBrief, options.json);
+            return;
+        }
+        const db = openAssetDb(resolveAssetProjectRoot(options.project));
+        try {
+            const svc = createCrystallizationService(db);
+            const result = svc.crystallize(buildCrystallizePayload(options, brief, trigger));
+            printCrystallizeResult(io, recommendation, result, options.json);
+        }
+        finally {
+            db.close();
+        }
+    }
+    catch (err) {
+        handleCrystallizeError(io, err, options.json);
+    }
+}

package/dist/cli/commands/asset-dispose-command.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+import { type ProgramIO } from '../cli-helpers.js';
+export declare function registerAssetDisposeCommand(asset: Command, io: ProgramIO): void;

package/dist/cli/commands/asset-dispose-command.js

@@ -0,0 +1,99 @@
+// src/cli/commands/asset-dispose-command.ts
+//
+// `peaks asset dispose` — trace-only / retain / destroy. Split out of
+// `asset-commands.ts`; the verb name, its options, the envelope shape and
+// every error code are unchanged.
+import { addJsonOption, getErrorMessage, printResult } from '../cli-helpers.js';
+import { fail, ok } from 'peaks-loop-shared/result';
+import { DISPOSE_MODES, createCrystallizationService, openAssetDb, resolveAssetProjectRoot } from './asset-command-shared.js';
+function printInvalidDisposeMode(io, options) {
+    printResult(io, fail('asset.dispose', 'ASSET_INVALID_MODE', `--mode must be one of: ${DISPOSE_MODES.join('|')}`, { mode: options.mode }, ['Pass --mode trace_only / retain / destroy.']), options.json);
+    process.exitCode = 1;
+}
+function printDisposeEventNotFound(io, options) {
+    printResult(io, fail('asset.dispose', 'ASSET_EVENT_NOT_FOUND', `crystallization event '${options.crystallizationEvent}' not found`, { eventId: options.crystallizationEvent }, ['Verify the event id.']), options.json);
+    process.exitCode = 1;
+}
+/** `retain` → no DB change; the user wants to keep the event as evidence. */
+function printDisposeRetained(io, existing, mode, json) {
+    printResult(io, ok('asset.dispose', {
+        crystallization_event_id: existing.id,
+        mode,
+        lifecycle_status: existing.lifecycle_status,
+        note: 'no DB change; event retained as-is'
+    }, [], ['Run `peaks asset status --loop <id>` to inspect the lifecycle state of the linked assets.']), json);
+}
+/**
+ * `destroy` → retire the created/updated loop_release rows as well. We do NOT
+ * delete rows — retirement is a status flip (spec §5.6).
+ */
+function retireLinkedLoops(db, updated) {
+    const retireLoop = db.prepare("UPDATE loop_release SET lifecycle_status = 'retired' WHERE id IN (?, ?)");
+    const ids = [
+        updated.created_loop_release_id ?? null,
+        updated.updated_loop_release_id ?? null
+    ].filter((x) => x !== null);
+    for (const id of ids) {
+        retireLoop.run(id, id);
+    }
+}
+function printDisposeResult(io, outcome, json) {
+    printResult(io, ok('asset.dispose', {
+        crystallization_event_id: outcome.existing.id,
+        mode: outcome.mode,
+        lifecycle_status: outcome.updated?.lifecycle_status ?? 'retired',
+        retired_assets: outcome.mode === 'destroy' ? 'loop_release retired (no rows deleted)' : 'none',
+        nextActions: ['Run `peaks asset status` to confirm the lifecycle transition.']
+    }, [], []), json);
+}
+function printDisposeFailure(io, err, options) {
+    printResult(io, fail('asset.dispose', 'ASSET_DISPOSE_FAILED', getErrorMessage(err), { eventId: options.crystallizationEvent }, ['Verify the event id and --mode flag.']), options.json);
+    process.exitCode = 1;
+}
+async function runAssetDispose(io, options) {
+    try {
+        if (!DISPOSE_MODES.includes(options.mode)) {
+            printInvalidDisposeMode(io, options);
+            return;
+        }
+        const mode = options.mode;
+        const db = openAssetDb(resolveAssetProjectRoot(options.project));
+        try {
+            const svc = createCrystallizationService(db);
+            const existing = svc.read(options.crystallizationEvent);
+            if (!existing) {
+                printDisposeEventNotFound(io, options);
+                return;
+            }
+            // trace_only → retire the event row; the source traces are
+            // untouched (workflow traces are immutable per spec §4.3).
+            // retain → no DB change; the user wants to keep the event
+            // as historical evidence.
+            // destroy → retire the event + retire the created/updated
+            // assets (no asset delete; retirement only).
+            if (mode === 'retain') {
+                printDisposeRetained(io, existing, mode, options.json);
+                return;
+            }
+            const updated = svc.updateStatus(existing.id, 'retired');
+            if (mode === 'destroy' && updated) {
+                retireLinkedLoops(db, updated);
+            }
+            printDisposeResult(io, { existing, mode, updated }, options.json);
+        }
+        finally {
+            db.close();
+        }
+    }
+    catch (err) {
+        printDisposeFailure(io, err, options);
+    }
+}
+export function registerAssetDisposeCommand(asset, io) {
+    addJsonOption(asset
+        .command('dispose')
+        .description('M5: dispose a crystallization event. mode=trace_only retires the event but keeps the trace; mode=retain keeps both; mode=destroy retires the event and marks the created/updated assets retired.')
+        .requiredOption('--crystallization-event <id>', 'the crystallization event id (returned by `peaks asset crystallize`)')
+        .requiredOption('--mode <mode>', `dispose mode (one of: ${DISPOSE_MODES.join('|')}; default: trace_only)`, 'trace_only')
+        .option('--project <path>', 'project root (default: cwd)')).action((options) => runAssetDispose(io, options));
+}

package/dist/cli/commands/asset-status-command.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+import { type ProgramIO } from '../cli-helpers.js';
+export declare function registerAssetStatusCommand(asset: Command, io: ProgramIO): void;

package/dist/cli/commands/asset-status-command.js

@@ -0,0 +1,100 @@
+// src/cli/commands/asset-status-command.ts
+//
+// `peaks asset status` — loop + bee lifecycle state plus the crystallization
+// events that reference them. Split out of `asset-commands.ts`; the verb name,
+// its options and the envelope shape are unchanged.
+import { addJsonOption, getErrorMessage, printResult } from '../cli-helpers.js';
+import { fail, ok } from 'peaks-loop-shared/result';
+import { createCrystallizationService, openAssetDb, resolveAssetProjectRoot } from './asset-command-shared.js';
+/** The events a `--loop` filter selects, deduplicated by id; all of them otherwise. */
+function collectEvents(svc, loop) {
+    if (!loop) {
+        return svc.list();
+    }
+    const events = [
+        ...svc.list({ created_loop_release_id: loop }),
+        ...svc.list({ updated_loop_release_id: loop })
+    ];
+    // Deduplicate by id.
+    const seen = new Set();
+    return events.filter((e) => {
+        const key = e?.id ?? '';
+        if (!key || seen.has(key))
+            return false;
+        seen.add(key);
+        return true;
+    });
+}
+/**
+ * Companion query: loop lifecycle counts. We compute from the DB so the CLI is
+ * the single source of truth.
+ */
+function collectLoopCounts(db) {
+    const rows = db
+        .prepare('SELECT lifecycle_status, COUNT(*) AS n FROM loop_release GROUP BY lifecycle_status')
+        .all();
+    return rows.reduce((acc, r) => {
+        acc[r.lifecycle_status] = r.n;
+        return acc;
+    }, {});
+}
+/** Companion query: bee lifecycle counts, narrowed by `--bee` when given. */
+function collectBeeCounts(db, bee) {
+    const rows = db
+        .prepare('SELECT bee_name, COUNT(*) AS n FROM bee_release GROUP BY bee_name ORDER BY bee_name ASC')
+        .all();
+    return rows.filter((r) => bee === undefined || r.bee_name === bee);
+}
+function statusData(options, events, loopCounts, beeCounts) {
+    return {
+        filters: {
+            ...(options.loop !== undefined ? { loop: options.loop } : {}),
+            ...(options.bee !== undefined ? { bee: options.bee } : {})
+        },
+        crystallization_events: events.length,
+        events: events.map((e) => ({
+            id: e?.id,
+            trigger: e?.trigger,
+            lifecycle_status: e?.lifecycle_status,
+            created_loop_release_id: e?.created_loop_release_id,
+            created_bee_release_id: e?.created_bee_release_id,
+            updated_loop_release_id: e?.updated_loop_release_id,
+            updated_bee_release_id: e?.updated_bee_release_id,
+            created_at: e?.created_at
+        })),
+        loop_release_counts_by_lifecycle: loopCounts,
+        bee_release_counts_by_name: beeCounts,
+        nextActions: [
+            options.loop
+                ? `Run \`peaks loop show --loop ${options.loop}\` for the loop detail view.`
+                : "Pass --loop <id> to drill into a specific loop's crystallization history."
+        ]
+    };
+}
+async function runAssetStatus(io, options) {
+    try {
+        const db = openAssetDb(resolveAssetProjectRoot(options.project));
+        try {
+            const svc = createCrystallizationService(db);
+            const events = collectEvents(svc, options.loop);
+            const loopCounts = collectLoopCounts(db);
+            const beeCounts = collectBeeCounts(db, options.bee);
+            printResult(io, ok('asset.status', statusData(options, events, loopCounts, beeCounts), [], []), options.json);
+        }
+        finally {
+            db.close();
+        }
+    }
+    catch (err) {
+        printResult(io, fail('asset.status', 'ASSET_STATUS_FAILED', getErrorMessage(err), { loop: options.loop, bee: options.bee }, ['Verify the loop / bee identifiers.']), options.json);
+        process.exitCode = 1;
+    }
+}
+export function registerAssetStatusCommand(asset, io) {
+    addJsonOption(asset
+        .command('status')
+        .description('M5: list loop + bee lifecycle state. With --loop, returns the loop + all linked bee_releases + all crystallization events referencing them.')
+        .option('--loop <id>', 'filter by loop_release id')
+        .option('--bee <name>', 'filter by bee_name')
+        .option('--project <path>', 'project root (default: cwd)')).action((options) => runAssetStatus(io, options));
+}

package/dist/cli/commands/baseline-audit-command.d.ts

@@ -0,0 +1,3 @@
+import type { Command } from 'commander';
+import type { ProgramIO } from '../cli-helpers.js';
+export declare function registerBaselineAuditCommand(baseline: Command, io: ProgramIO): void;

package/dist/cli/commands/baseline-audit-command.js

@@ -0,0 +1,64 @@
+// src/cli/commands/baseline-audit-command.ts
+//
+// `peaks baseline audit` — the independent-context capability scorer. Split
+// out of `baseline-commands.ts`; the scorer vocabulary, the guard summary the
+// audit is handed, the sessionless scope and the verdict rule are unchanged.
+import { readBaselineFile } from '../../services/capability-baseline/store.js';
+import { GUARD_CONTRACTS } from '../../services/capability-guard-runner/registry.js';
+import { runAllGuards } from '../../services/capability-guard-runner/runner.js';
+import { RUNTIME_SESSIONLESS_SCOPE } from '../../services/workspace/runtime-layout.js';
+import { DEFAULT_SCORER_MODE, fail, guardContext, isScorerMode, ok, SCORER_MODES } from './baseline-command-shared.js';
+async function runAudit(io, opts) {
+    const projectRoot = opts.project ?? '.';
+    if (!isScorerMode(opts.scorer)) {
+        fail(io, 'UNKNOWN_SCORER', `unknown scorer "${String(opts.scorer)}"; expected one of ${SCORER_MODES.join(', ')}`);
+        return;
+    }
+    const r = readBaselineFile(projectRoot);
+    if (!r.ok) {
+        fail(io, r.error.code, r.error.message);
+        return;
+    }
+    // The guard summary is the REAL aggregate of the 15 contracts. It used to
+    // be a literal `{pass:15,fail:0,skipped:0,total:15}` that no run produced.
+    const guardSummary = await runAllGuards(GUARD_CONTRACTS, guardContext(projectRoot));
+    // `live` is the deterministic independent checker: a real
+    // separate-context evaluation that needs no credentials, which is why it
+    // is the only kind that can run inside the secretless OIDC publish gate.
+    // It is handed the frozen rows and the registry, not just the guard
+    // summary — a scorer that only sees the guard result is a restatement.
+    //
+    // `sessionId` is the on-disk scope for the audit artifacts. This command
+    // has NO session — it is the credential-free scorer that runs inside the
+    // secretless OIDC publish gate — and it used to pass the literal `'cli'`,
+    // so every run wrote `.peaks/_runtime/cli/capability-audit/*.json` into
+    // the operator's real workspace. That directory is indistinguishable from
+    // a session dir whose id failed validation, so `peaks doctor`'s
+    // orphan-session check failed on it permanently. The reserved
+    // underscore-prefixed scope says "machinery, not a session" in the name.
+    const { runAudit: runIndependentAudit } = await import('../../services/capability-audit-service/runner.js');
+    const audit = await runIndependentAudit({
+        projectRoot,
+        sessionId: RUNTIME_SESSIONLESS_SCOPE,
+        journeyId: 'J01',
+        scorerMode: opts.scorer,
+        baselineRows: r.file.rows,
+        contracts: GUARD_CONTRACTS,
+        guardSummary
+    });
+    const data = audit;
+    if (audit.verdict === 'consistent' && !audit.degraded) {
+        ok(io, 'baseline.audit', data);
+        return;
+    }
+    fail(io, 'AUDIT_NOT_CONSISTENT', `capability audit verdict is "${audit.verdict}"${audit.degraded ? ' (degraded: stub scorer)' : ''}`, data);
+}
+export function registerBaselineAuditCommand(baseline, io) {
+    baseline
+        .command('audit')
+        .description('Run the capability audit (independent-context scorer). Exits non-zero unless the verdict is consistent.')
+        .option('--scorer <mode>', `Scorer to run: ${SCORER_MODES.join('|')}. 'live' (default) runs the deterministic independent checker, which needs no credentials; 'stub' performs no evaluation and can never be consistent.`, DEFAULT_SCORER_MODE)
+        .option('--project <path>', 'Project root', '.')
+        .option('--json', 'Emit JSON envelope')
+        .action((opts) => runAudit(io, opts));
+}

package/dist/cli/commands/baseline-command-shared.d.ts

@@ -0,0 +1,23 @@
+import type { ProgramIO } from '../cli-helpers.js';
+import type { GuardContext } from '../../services/capability-guard-runner/types.js';
+/** The `--project` / `--json` pair every verb in this family declares. */
+export type BaselineOptions = {
+    project?: string;
+    json?: boolean;
+};
+export declare function fail(io: ProgramIO, code: string, message: string, data?: Record<string, unknown>): void;
+export declare function ok(io: ProgramIO, command: string, data: Record<string, unknown>, nextActions?: ReadonlyArray<string>): void;
+export declare const CURRENT_DIR: (root: string) => string;
+export declare const HISTORY_DIR: (root: string, version: string) => string;
+/** Whitelist of supported `--scorer` values for `peaks baseline audit`. */
+export declare const SCORER_MODES: readonly ["live", "stub"];
+export type ScorerMode = (typeof SCORER_MODES)[number];
+/**
+ * `live` is the default because it is the credential-free one. Defaulting to
+ * `stub` would leave the publish gate permanently inconclusive; defaulting to a
+ * scorer that needs a key would leave it unrunnable in CI.
+ */
+export declare const DEFAULT_SCORER_MODE: ScorerMode;
+export declare function isScorerMode(v: string | undefined): v is ScorerMode;
+/** The guard `run-guard` / `audit` execute against. */
+export declare function guardContext(projectRoot: string): GuardContext;

package/dist/cli/commands/baseline-command-shared.js

@@ -0,0 +1,39 @@
+// src/cli/commands/baseline-command-shared.ts
+//
+// What every `peaks baseline *` verb shares: its two envelope writers, the
+// on-disk layout helpers, the guard context and the `--scorer` vocabulary.
+// Split out of `baseline-commands.ts`; every path, envelope field and exit
+// code is unchanged.
+import { join } from 'node:path';
+export function fail(io, code, message, data = {}) {
+    io.stdout(JSON.stringify({
+        ok: false,
+        command: `baseline`,
+        code,
+        message,
+        data,
+        warnings: [],
+        nextActions: []
+    }));
+    process.exitCode = 1;
+}
+export function ok(io, command, data, nextActions = []) {
+    io.stdout(JSON.stringify({ ok: true, command, data, warnings: [], nextActions }));
+}
+export const CURRENT_DIR = (root) => join(root, 'openspec', 'baselines', 'current');
+export const HISTORY_DIR = (root, version) => join(root, 'openspec', 'baselines', 'history', version);
+/** Whitelist of supported `--scorer` values for `peaks baseline audit`. */
+export const SCORER_MODES = ['live', 'stub'];
+/**
+ * `live` is the default because it is the credential-free one. Defaulting to
+ * `stub` would leave the publish gate permanently inconclusive; defaulting to a
+ * scorer that needs a key would leave it unrunnable in CI.
+ */
+export const DEFAULT_SCORER_MODE = 'live';
+export function isScorerMode(v) {
+    return v !== undefined && SCORER_MODES.includes(v);
+}
+/** The guard `run-guard` / `audit` execute against. */
+export function guardContext(projectRoot) {
+    return { projectRoot, sessionId: 'cli', contract: {}, baselineInvariant: 'auto' };
+}