@deftai/directive-content 0.100.0 → 0.102.0

package/packs/strategies/strategies-pack-0.1.json

@@ -111,7 +111,7 @@
         "rapid"
       ],
       "path": "strategies/rapid.md",
-      "body": "# Rapid Strategy\n\nQuick prototyping workflow -- v0.20 date-prefixed story vBRIEF output with minimal gates and fast iteration.\n\n**Ceremony dial (#3214):** when `plan.policy.ceremonyDial` (or session inputs) selects depth `rapid` — default for S-task × frontier model on a project-shaped session — session ritual / gate depth follows this light path. See `task policy:show --field=ceremonyDial`. Non-project sessions select `minimal` and compose the #3014 minimal AGENTS profile research pointer instead.\n\n**v0.20 note (s5-migrate-speckit-rapid-enterprise / #1166):** Rapid now emits only the canonical v0.20 shape (date-prefixed story vBRIEFs in proposed/, full PROJECT-DEFINITION.vbrief.json via task project:render, seeded lifecycle folders, no legacy specification.vbrief.json). See the dedicated ## v0.20 Output Shape section and the canonical contract `strategies/v0-20-contract.md` (s1-contract of #1166).\n\nLegend (from RFC2119): !=MUST, ~=SHOULD, ≉=SHOULD NOT, ⊗=MUST NOT, ?=MAY.\n\n**⚠️ See also**: [strategies/interview.md](./interview.md) | [strategies/yolo.md](./yolo.md) | [strategies/README.md](./README.md) | [strategies/v0-20-contract.md](./v0-20-contract.md) | [artifact-guards.md](./artifact-guards.md)\n\n> Ship a throwaway prototype fast. Skip the PRD, skip approval gates, produce a\n> date-prefixed vBRIEF in proposed/ + PROJECT-DEFINITION and start building. Suited for spikes, proof-of-concepts, and\n> disposable experiments where learning speed matters more than long-term quality.\n\n---\n\n## When to Use\n\n- ~ Throwaway prototypes, spikes, and proof-of-concept experiments\n- ~ Validating a technical approach before committing to a full spec cycle\n- ~ Solo explorations where the cost of rework is low\n- ? Time-boxed experiments (e.g. \"spend 2 hours proving this works\")\n- ⊗ Production features, shared libraries, or anything with downstream consumers\n\n---\n\n## Workflow\n\n### Step 1: State the Goal\n\n! Describe the prototype goal in one sentence: what are you trying to learn or prove?\n\n- ! Record the goal in a new date-prefixed story vBRIEF written to `vbrief/proposed/YYYY-MM-DD-<kebab-slug>.vbrief.json` (e.g. as the plan title or a brief narrative in the v0.6 schema). Use today's date for the prefix and a descriptive slug.\n- ~ Include a time-box if applicable (e.g. \"4-hour spike\")\n- ⊗ Skip this step -- even throwaway work needs a clear objective\n\n### Step 2: Minimal Interview\n\n! Ask only the questions needed to unblock implementation. Skip sizing gate, skip PRD.\n\n- ! Identify: target platform, primary language, key dependency or API\n- ~ 3-5 questions maximum -- bias toward defaults and moving fast\n- ⊗ Run the full interview questionnaire -- that defeats the purpose of rapid\n\n### Step 3: Generate date-prefixed vBRIEF in proposed/ (Forced-Light Path)\n\n! Before writing output artifacts, follow the guards in [artifact-guards.md](./artifact-guards.md) (Preparatory Guard for proposed/ scope items; Spec-Generating Guard for PROJECT-DEFINITION).\n\n! Write a slim story scope vBRIEF to `vbrief/proposed/YYYY-MM-DD-<kebab-slug>.vbrief.json` -- no PRD, no approval gate. Decompose the rapid plan into one or more focused, buildable story vBRIEFs (v0.6 schema) rather than a monolithic legacy spec.\n\n- ! Use the Light path from [interview.md](./interview.md) unconditionally\n- ! Mark `plan.status` as `draft` (not `approved`) to signal prototype quality\n- ! After the proposed/ vBRIEF(s) are written, invoke `task project:render` (from repo root) to generate/refresh the complete `vbrief/PROJECT-DEFINITION.vbrief.json`\n- ~ Keep tasks coarse-grained -- 3-5 tasks is typical for a spike\n- ⊗ Generate a PRD or require approval -- rapid skips both\n- ⊗ Hand-author `SPECIFICATION.md` directly -- it is a rendered derivative only (see v0.20 Output Shape)\n\n! After emitting the proposed/ story vBRIEF(s), surface the GitHub-issue tracking hint from [emit-hints.md](./emit-hints.md) — name all three patterns (none / `--umbrella` / `--per-vbrief`).\n\n### Step 4: Build\n\n! Implement against the spec. Quality gates are relaxed but not absent.\n\n- ! Tests are still required, but coverage gate is relaxed to ≥50%\n- ~ Favour working code over clean code -- refactor later if the prototype graduates\n- ! `task check` must still pass (lint + fmt + tests)\n- ⊗ Skip `task check` entirely -- even prototypes must compile and pass basic checks\n\n### Step 5: Evaluate\n\n! At the end of the time-box (or when the prototype is done), decide next steps.\n\n- ! Record findings: what worked, what didn't, what surprised you\n- ~ Options: discard, iterate, or graduate to a full spec cycle via [interview.md](./interview.md)\n- ! If graduating: start a fresh interview -- do not carry forward the rapid spec as-is\n\n---\n\n## Output Artifacts\n\n- `vbrief/proposed/YYYY-MM-DD-*.vbrief.json` (one or more) -- lightweight story scope vBRIEF(s) with `draft` status (primary artifact; date-prefixed per v0.20 contract)\n- `vbrief/PROJECT-DEFINITION.vbrief.json` -- complete project gestalt + items registry (via `task project:render` invoked by Rapid)\n- `vbrief/{proposed,pending,active,completed,cancelled}/` -- all five lifecycle folders seeded\n- (optional derivative) `SPECIFICATION.md` -- read-only human-readable export (includes deprecated-redirect sentinel; via `task spec:render` if invoked)\n- Prototype code (may be discarded)\n- Findings summary (inline in the proposed/ vBRIEF or as a separate note)\n\n---\n\n## Fits into Chaining Gate\n\nRapid is a **spec-generating** strategy. Selecting it at the chaining gate produces date-prefixed story vBRIEF(s) in `vbrief/proposed/` (and refreshes `vbrief/PROJECT-DEFINITION.vbrief.json` via `task project:render`) and moves directly to implementation. There is no chaining back to preparatory strategies. See the v0.20 Output Shape section below for the exact contract.\n\n---\n\n## Literal acceptance-command verification (#3267)\n\nRapid lightens cold ceremony only. When the task statement names exact shell acceptance commands:\n\n- ! Capture them at intake as executable AC (`plan.metadata.literal_acceptance_commands`) — do not paraphrase.\n- ! Before done, run `task verify:literal-ac -- <active-story-path>` (verbatim flags/cwd). Fail closed on non-zero.\n- ! This check survives ceremony dial rapid/minimal (#3214) — it is the positive verification content of the light path.\n- ⊗ Treat self-chosen approximate checks as sufficient when the statement named exact commands.\n\n## Anti-Patterns\n\n- ⊗ Using rapid for production features -- rapid output is explicitly throwaway\n- ⊗ Graduating a rapid prototype without a fresh spec cycle -- the shortcuts compound\n- ⊗ Running the full interview or PRD path -- that's interview strategy, not rapid\n- ⊗ Skipping `task check` -- even prototypes must pass basic quality checks\n- ⊗ Omitting the goal statement -- undirected spikes waste time\n- ⊗ Emitting the legacy singular specification artifact or bare-named vBRIEFs -- violates the v0.20 contract (see strategies/v0-20-contract.md)\n\n---\n\n## v0.20 Output Shape (s5-migrate-speckit-rapid-enterprise / #1166)\n\nThis strategy has been migrated to the full v0.20 output shape so rapid-generated projects are accepted by the build skill Pre-Cutover Detection Guard with zero errors on first attempt (resolves the rapid row from the #1166 inconsistency table and the s5 story acceptance criteria).\n\n- ! Seed the five lifecycle folders under `vbrief/` if any are missing: `proposed/`, `pending/`, `active/`, `completed/`, `cancelled/`.\n- ! Emit story scope items exclusively as date-prefixed scope vBRIEFs: `vbrief/proposed/YYYY-MM-DD-<kebab-slug>.vbrief.json` (use the run's creation date for the prefix; choose descriptive slugs). Decompose the rapid plan into one or more focused, buildable story vBRIEFs (v0.6 schema) rather than a monolithic legacy spec.\n- ! After the proposed/ stories are written, invoke `task project:render` (run from the repo root) to generate/refresh the complete `vbrief/PROJECT-DEFINITION.vbrief.json` (items registry is derived from the lifecycle folders).\n- ⊗ Never emit `vbrief/specification.vbrief.json` (or any legacy dual-write).\n- ~ `SPECIFICATION.md` at the project root, if produced at all, must be only a read-only derivative (e.g. via `task spec:render` after the vbriefs exist) that includes the v0.20 deprecated-redirect sentinel. The source of truth is the vbrief/ lifecycle stories + PROJECT-DEFINITION.\n- ! Before writing any proposed/ stories or PROJECT-DEFINITION, follow the guards in [artifact-guards.md](./artifact-guards.md) (Preparatory Guard for scope items in proposed/; Spec-Generating Guard for PROJECT-DEFINITION).\n- ! Final output tree must pass the deterministic v0.20 strategy output validation gate (s2-deterministic-gate) and the build Pre-Cutover Detection Guard with zero warnings/errors. See full acceptance in the s5 vBRIEF and the 1166 decomposition.\n- ! Cite the canonical contract `strategies/v0-20-contract.md` (s1-contract) for the exact shape and the per-strategy table row.\n\n---\n\n## Artifacts Summary (v0.20)\n\n**Rapid (Forced-Light path):**\n\n| Artifact | Purpose | Created By |\n|----------|---------|------------|\n| `vbrief/proposed/YYYY-MM-DD-*.vbrief.json` (one or more) | Focused story scope items (date-prefixed per vbrief convention and v0.20 contract) | Rapid |\n| `vbrief/PROJECT-DEFINITION.vbrief.json` | Project identity gestalt + complete scope items registry | `task project:render` (invoked by Rapid) |\n| `vbrief/{proposed,pending,active,completed,cancelled}/` | All five lifecycle folders seeded | Rapid |\n| (optional derivative) `SPECIFICATION.md` | Human-readable plan (includes deprecated-redirect sentinel) | `task spec:render` (if invoked) |\n\n**Pre-v0.20 / legacy artifacts that MUST NOT be produced by this strategy:**\n\n- `vbrief/specification.vbrief.json`\n- Primary handoff `SPECIFICATION.md` at project root (without sentinel)\n- Bare-named vBRIEFs in proposed/\n\nSee the full table and rules in `strategies/v0-20-contract.md` (rapid row: Must Create Lifecycle Folders: Yes; Must Write PROJECT-DEFINITION: Yes; Scope vBRIEFs Location: proposed/YYYY-MM-DD-*.vbrief.json only; specification.vbrief.json: Never; SPECIFICATION.md / PROJECT.md: Omit or deprecation redirect only).\n\n---\n\n## Invoking This Strategy\n\n```\n /deft:run:rapid [project name]\n```\n\nOr explicitly:\n"
+      "body": "# Rapid Strategy\n\nQuick prototyping workflow -- v0.20 date-prefixed story vBRIEF output with minimal gates and fast iteration.\n\n**Ceremony dial (#3214):** when `plan.policy.ceremonyDial` (or session inputs) selects depth `rapid` — default for S-task × frontier model on a project-shaped session — session ritual / gate depth follows this light path. See `task policy:show --field=ceremonyDial`. Non-project sessions select `minimal` and compose the #3014 minimal AGENTS profile research pointer instead.\n\n**v0.20 note (s5-migrate-speckit-rapid-enterprise / #1166):** Rapid now emits only the canonical v0.20 shape (date-prefixed story vBRIEFs in proposed/, full PROJECT-DEFINITION.vbrief.json via task project:render, seeded lifecycle folders, no legacy specification.vbrief.json). See the dedicated ## v0.20 Output Shape section and the canonical contract `strategies/v0-20-contract.md` (s1-contract of #1166).\n\nLegend (from RFC2119): !=MUST, ~=SHOULD, ≉=SHOULD NOT, ⊗=MUST NOT, ?=MAY.\n\n**⚠️ See also**: [strategies/interview.md](./interview.md) | [strategies/yolo.md](./yolo.md) | [strategies/README.md](./README.md) | [strategies/v0-20-contract.md](./v0-20-contract.md) | [artifact-guards.md](./artifact-guards.md)\n\n> Ship a throwaway prototype fast. Skip the PRD, skip approval gates, produce a\n> date-prefixed vBRIEF in proposed/ + PROJECT-DEFINITION and start building. Suited for spikes, proof-of-concepts, and\n> disposable experiments where learning speed matters more than long-term quality.\n\n---\n\n## When to Use\n\n- ~ Throwaway prototypes, spikes, and proof-of-concept experiments\n- ~ Validating a technical approach before committing to a full spec cycle\n- ~ Solo explorations where the cost of rework is low\n- ? Time-boxed experiments (e.g. \"spend 2 hours proving this works\")\n- ⊗ Production features, shared libraries, or anything with downstream consumers\n\n---\n\n## Workflow\n\n### Step 1: State the Goal\n\n! Describe the prototype goal in one sentence: what are you trying to learn or prove?\n\n- ! Record the goal in a new date-prefixed story vBRIEF written to `vbrief/proposed/YYYY-MM-DD-<kebab-slug>.vbrief.json` (e.g. as the plan title or a brief narrative in the v0.6 schema). Use today's date for the prefix and a descriptive slug.\n- ~ Include a time-box if applicable (e.g. \"4-hour spike\")\n- ⊗ Skip this step -- even throwaway work needs a clear objective\n\n### Step 2: Minimal Interview\n\n! Ask only the questions needed to unblock implementation. Skip sizing gate, skip PRD.\n\n- ! Identify: target platform, primary language, key dependency or API\n- ~ 3-5 questions maximum -- bias toward defaults and moving fast\n- ⊗ Run the full interview questionnaire -- that defeats the purpose of rapid\n\n### Step 3: Generate date-prefixed vBRIEF in proposed/ (Forced-Light Path)\n\n! Before writing output artifacts, follow the guards in [artifact-guards.md](./artifact-guards.md) (Preparatory Guard for proposed/ scope items; Spec-Generating Guard for PROJECT-DEFINITION).\n\n! Write a slim story scope vBRIEF to `vbrief/proposed/YYYY-MM-DD-<kebab-slug>.vbrief.json` -- no PRD, no approval gate. Decompose the rapid plan into one or more focused, buildable story vBRIEFs (v0.6 schema) rather than a monolithic legacy spec.\n\n- ! Use the Light path from [interview.md](./interview.md) unconditionally\n- ! Mark `plan.status` as `draft` (not `approved`) to signal prototype quality\n- ! After the proposed/ vBRIEF(s) are written, invoke `task project:render` (from repo root) to generate/refresh the complete `vbrief/PROJECT-DEFINITION.vbrief.json`\n- ~ Keep tasks coarse-grained -- 3-5 tasks is typical for a spike\n- ⊗ Generate a PRD or require approval -- rapid skips both\n- ⊗ Hand-author `SPECIFICATION.md` directly -- it is a rendered derivative only (see v0.20 Output Shape)\n\n! After emitting the proposed/ story vBRIEF(s), surface the GitHub-issue tracking hint from [emit-hints.md](./emit-hints.md) — name all three patterns (none / `--umbrella` / `--per-vbrief`).\n\n### Step 4: Build\n\n! Implement against the spec. Quality gates are relaxed but not absent.\n\n- ! Tests are still required, but coverage gate is relaxed to ≥50%\n- ~ Favour working code over clean code -- refactor later if the prototype graduates\n- ! `task check` must still pass (lint + fmt + tests)\n- ⊗ Skip `task check` entirely -- even prototypes must compile and pass basic checks\n\n### Step 5: Evaluate\n\n! At the end of the time-box (or when the prototype is done), decide next steps.\n\n- ! Record findings: what worked, what didn't, what surprised you\n- ~ Options: discard, iterate, or graduate to a full spec cycle via [interview.md](./interview.md)\n- ! If graduating: start a fresh interview -- do not carry forward the rapid spec as-is\n\n---\n\n## Output Artifacts\n\n- `vbrief/proposed/YYYY-MM-DD-*.vbrief.json` (one or more) -- lightweight story scope vBRIEF(s) with `draft` status (primary artifact; date-prefixed per v0.20 contract)\n- `vbrief/PROJECT-DEFINITION.vbrief.json` -- complete project gestalt + items registry (via `task project:render` invoked by Rapid)\n- `vbrief/{proposed,pending,active,completed,cancelled}/` -- all five lifecycle folders seeded\n- (optional derivative) `SPECIFICATION.md` -- read-only human-readable export (includes deprecated-redirect sentinel; via `task spec:render` if invoked)\n- Prototype code (may be discarded)\n- Findings summary (inline in the proposed/ vBRIEF or as a separate note)\n\n---\n\n## Fits into Chaining Gate\n\nRapid is a **spec-generating** strategy. Selecting it at the chaining gate produces date-prefixed story vBRIEF(s) in `vbrief/proposed/` (and refreshes `vbrief/PROJECT-DEFINITION.vbrief.json` via `task project:render`) and moves directly to implementation. There is no chaining back to preparatory strategies. See the v0.20 Output Shape section below for the exact contract.\n\n---\n\n## Product-first done-gate / literal AC (#3284 / #3267)\n\nRapid lightens cold ceremony only. The **positive verification content** of the light path is stated acceptance commands — not framework hygiene.\n\n- ! Capture stated shell commands at intake into `plan.acceptance.commands` (and #3267 `literal_acceptance_commands`) — do not paraphrase. Empty requires `none_stated: true` with a ladder rung (`derived` or `project_floor`).\n- ! Before done, run `task verify:ac -- <active-story-path>` (verbatim flags/cwd). Fail closed on non-zero. (`verify:literal-ac` remains the #3267 mechanism alias.)\n- ! Ceremony dial rapid/minimal = **AC-only** verification for `task check` composition (#3284): hygiene degrades away; AC never degrades when commands exist.\n- ⊗ Treat self-chosen approximate checks as sufficient when the statement named exact commands.\n- ⊗ Skip AC because ceremony is rapid — rapid's job is to keep exactly this check.\n\n## Anti-Patterns\n\n- ⊗ Using rapid for production features -- rapid output is explicitly throwaway\n- ⊗ Graduating a rapid prototype without a fresh spec cycle -- the shortcuts compound\n- ⊗ Running the full interview or PRD path -- that's interview strategy, not rapid\n- ⊗ Skipping `task check` -- even prototypes must pass basic quality checks\n- ⊗ Omitting the goal statement -- undirected spikes waste time\n- ⊗ Emitting the legacy singular specification artifact or bare-named vBRIEFs -- violates the v0.20 contract (see strategies/v0-20-contract.md)\n\n---\n\n## v0.20 Output Shape (s5-migrate-speckit-rapid-enterprise / #1166)\n\nThis strategy has been migrated to the full v0.20 output shape so rapid-generated projects are accepted by the build skill Pre-Cutover Detection Guard with zero errors on first attempt (resolves the rapid row from the #1166 inconsistency table and the s5 story acceptance criteria).\n\n- ! Seed the five lifecycle folders under `vbrief/` if any are missing: `proposed/`, `pending/`, `active/`, `completed/`, `cancelled/`.\n- ! Emit story scope items exclusively as date-prefixed scope vBRIEFs: `vbrief/proposed/YYYY-MM-DD-<kebab-slug>.vbrief.json` (use the run's creation date for the prefix; choose descriptive slugs). Decompose the rapid plan into one or more focused, buildable story vBRIEFs (v0.6 schema) rather than a monolithic legacy spec.\n- ! After the proposed/ stories are written, invoke `task project:render` (run from the repo root) to generate/refresh the complete `vbrief/PROJECT-DEFINITION.vbrief.json` (items registry is derived from the lifecycle folders).\n- ⊗ Never emit `vbrief/specification.vbrief.json` (or any legacy dual-write).\n- ~ `SPECIFICATION.md` at the project root, if produced at all, must be only a read-only derivative (e.g. via `task spec:render` after the vbriefs exist) that includes the v0.20 deprecated-redirect sentinel. The source of truth is the vbrief/ lifecycle stories + PROJECT-DEFINITION.\n- ! Before writing any proposed/ stories or PROJECT-DEFINITION, follow the guards in [artifact-guards.md](./artifact-guards.md) (Preparatory Guard for scope items in proposed/; Spec-Generating Guard for PROJECT-DEFINITION).\n- ! Final output tree must pass the deterministic v0.20 strategy output validation gate (s2-deterministic-gate) and the build Pre-Cutover Detection Guard with zero warnings/errors. See full acceptance in the s5 vBRIEF and the 1166 decomposition.\n- ! Cite the canonical contract `strategies/v0-20-contract.md` (s1-contract) for the exact shape and the per-strategy table row.\n\n---\n\n## Artifacts Summary (v0.20)\n\n**Rapid (Forced-Light path):**\n\n| Artifact | Purpose | Created By |\n|----------|---------|------------|\n| `vbrief/proposed/YYYY-MM-DD-*.vbrief.json` (one or more) | Focused story scope items (date-prefixed per vbrief convention and v0.20 contract) | Rapid |\n| `vbrief/PROJECT-DEFINITION.vbrief.json` | Project identity gestalt + complete scope items registry | `task project:render` (invoked by Rapid) |\n| `vbrief/{proposed,pending,active,completed,cancelled}/` | All five lifecycle folders seeded | Rapid |\n| (optional derivative) `SPECIFICATION.md` | Human-readable plan (includes deprecated-redirect sentinel) | `task spec:render` (if invoked) |\n\n**Pre-v0.20 / legacy artifacts that MUST NOT be produced by this strategy:**\n\n- `vbrief/specification.vbrief.json`\n- Primary handoff `SPECIFICATION.md` at project root (without sentinel)\n- Bare-named vBRIEFs in proposed/\n\nSee the full table and rules in `strategies/v0-20-contract.md` (rapid row: Must Create Lifecycle Folders: Yes; Must Write PROJECT-DEFINITION: Yes; Scope vBRIEFs Location: proposed/YYYY-MM-DD-*.vbrief.json only; specification.vbrief.json: Never; SPECIFICATION.md / PROJECT.md: Omit or deprecation redirect only).\n\n---\n\n## Invoking This Strategy\n\n```\n /deft:run:rapid [project name]\n```\n\nOr explicitly:\n"
     },
     {
       "id": "research",

package/scm/github.md

@@ -393,9 +393,9 @@ Following a v1.0.0 release, commits:
 
 **Framework CI runners (#2672)**:
 - ! `deftai/directive` required CI prefers Blacksmith (`blacksmith-4vcpu-ubuntu-2404`) for TypeScript and Go cost
-- ! Capacity watchdog (~20 minute budget): if a Blacksmith primary job stays `queued` with `runner_name` null and no `started_at`, cancel that queued attempt (concurrency cancel-in-progress) and run the same suite on `ubuntu-latest`
-- ! Branch-protection required check names (`TypeScript (build + lint + test)`, `Go (test + build)`) live **only** on the aggregator jobs — never on primary/failover lane names
-- ⊗ Fail over `in_progress` jobs (execution hangs) — those stay timeout + fix (#2652); capacity failover is queue-stall only
+- ! Capacity watchdog (~20 minute budget): if a required Blacksmith job (TypeScript, Go, or merge-gate) stays unclaimed (`runner_name` null — `started_at` alone is not a claim), cancel that unclaimed attempt and run the same suite on `ubuntu-latest` (#3340)
+- ! Branch-protection required check names (`TypeScript (build + lint + test)`, `Go (test + build)`, `Merge gate (task check)`) live **only** on the aggregator jobs — never on primary/failover lane names
+- ⊗ Fail over a job that has `runner_name` (claimed execution hang) — those stay timeout + fix (#2652); capacity failover is unclaimed-queue stall only (#3340)
 - ! Consumer scaffolds and `npm-publish.yml` stay on GitHub-hosted `ubuntu-latest` (Blacksmith is opt-in for consumer orgs; npm `--provenance` requires GH-hosted)
 - ! Agents seeing `runner_capacity_stall` / `RUNNER_CAPACITY_STALL` MUST wait for auto-failover — ⊗ `--skip-ci` as a capacity remedy
 

package/skills/deft-directive-build/SKILL.md

@@ -298,6 +298,22 @@ When a hard turn or cost budget is detectable (session:start `effort_budget` / e
 Core helper: `packages/core/src/session/effort-budget.ts` (`detectHardEffortBudget`, `recommendVerificationDepth`). Composes #2442, #1581, #3214, #1006.
 **Enforcement note:** skill defaults are behavioral. Durable delivery/acceptance circuit-breaker: **#3143** `packages/core/src/delivery-attempt/` (`evaluatePreDispatch`, `.deft/delivery-attempts/`). Docs: `docs/delivery-attempt.md`. Route delivery/acceptance automatic retries through that gate; do not invent a parallel ledger in this skill.
 
+### AC-pass banking checkpoint - finalize on green (#3285)
+
+Sharpens #3266: the **first** moment stated/official acceptance criteria pass is a **banking checkpoint**, not a license to keep spending the turn budget on self-imposed depth.
+
+- ! When stated acceptance criteria first pass (`task verify:ac` / product-first done-gate #3284 / official checker), the **next** action is **FINALIZE**: checkpoint-commit the green state and record the bank (durable under `.deft/ac-pass-banks/`; optional run-summary line when `DEFT_RUN_SUMMARY_PATH` is set).
+- ! **Deepening after the bank requires surplus budget.** Self-imposed extra verification, refactors, or polish are permitted only when remaining budget meets `plan.policy.acPassBanking.surplusThreshold` (default **0.2** = 20% of max turns/cost still remaining) **and** the absolute reserve from #3266. Env override: `DEFT_AC_PASS_SURPLUS_THRESHOLD`.
+- ! Deepening, when allowed, happens **on top of** the committed checkpoint so a failed experiment can revert to banked green.
+- ! **Post-bank discoveries are reported, not chased** when surplus is insufficient: file a note/issue in the deliverable for out-of-scope defects unless they **regress stated AC** (then fix-regression). Finding beyond the bar is a win; thrashing a dying budget into a zero is the failure mode this rule closes.
+- ! When surplus is insufficient, ship the banked state and fail-loud (`deepening_skipped=true` + surplus reason) via `evaluateAcPassBanking` / `formatDeepeningSkippedNote` semantics.
+- ~ When no hard budget is detected, dual-stop still applies; bank-on-first-AC-pass remains good discipline but is not a hard surplus gate.
+- ⊗ Convert a banked official pass into a scored failure by chasing post-bank polish until the turn budget dies (#3285).
+- ⊗ Start post-bank deepening without a finalize checkpoint when a hard budget is active (#3285).
+- ⊗ Chase out-of-scope post-bank findings when surplus is below threshold (#3285).
+
+Core helpers: `packages/core/src/session/ac-pass-banking.ts` (`evaluateAcPassBanking`, `bankAcPass`, `decidePostBankFinding`, `simulateSurplusInsufficientRun`); policy: `packages/core/src/policy/ac-pass-banking.ts` (`plan.policy.acPassBanking`). Composes #3266, #3284, #3282 (optional bank-event JSONL), #1006.
+
 ## Step 3: Build Phase by Phase
 
 For each phase:
@@ -335,19 +351,29 @@ task test:coverage  # >=85% or PROJECT-DEFINITION.xbrief.json override
 - ⊗ Re-run full install/session ceremony after offline seed when ritual is already complete (#3010) — use `session:ready` for recovery only.
 
 
-## Literal acceptance-command verification (#3267)
+## Product-first done-gate (#3284) / literal AC (#3267)
 
-At intake, capture the task statement's **exact** acceptance commands (when present) as executable AC. Before declaring done, run them **verbatim** — same paths, same flags, same working directory. Self-chosen verification is supplementary, never a substitute. Extends #973 machine-verifiable-spec. Required on ceremony dial rapid/minimal (#3214) — verification depth is constant (#3156).
+At intake, capture the task statement's **exact** acceptance commands as executable AC (`plan.acceptance.commands` + #3267 `literal_acceptance_commands`). Empty is allowed only with `none_stated: true` (ladder: stated → derived → project_floor). Before declaring done, run them **verbatim** — same paths, same flags, same working directory. Self-chosen verification is supplementary, never a substitute. Extends #973. `task check` runs `verify:ac` **first** (fail-fast); hygiene is second and may become advisory under pressure. Rapid ceremony = **AC-only**.
 
-- ! When reading the active scope xBRIEF / issue body at story start, capture stated shell acceptance commands into `plan.metadata.literal_acceptance_commands` (issue:ingest does this automatically). Do not paraphrase into a different command.
+- ! When reading the active scope xBRIEF / issue body at story start, capture stated shell acceptance commands into `plan.acceptance.commands` (issue:ingest stamps this + the #3267 ledger automatically). Do not paraphrase.
 - ! Before claiming phase or story done (and before merge-chokepoint PR handoff), run:
 ```
-task verify:literal-ac -- <active-story-path>
+task verify:ac -- <active-story-path>
 ```
-  Exit 0 = pass or no commands stated; exit 1 = a stated command failed; exit 2 = config.
+  Exit 0 = pass or none stated with valid marker; exit 1 = a stated command failed; exit 2 = config. (`verify:literal-ac` is the #3267 mechanism alias.)
 - ! Quote the literal invocations and their outputs in the completion note when commands were stated.
 - ⊗ Substitute a self-chosen approximation (`pnpm test` when the statement said `pnpm exec vitest run packages/core/src`) for the stated command.
-- ⊗ Skip this gate because ceremony dial is rapid/minimal — the check survives light ceremony.
+- ⊗ Skip this gate because ceremony dial is rapid/minimal — rapid's positive content is exactly this check (#3284).
+- ⊗ Leave `plan.acceptance.commands` empty without `none_stated: true` — absence must be an explicit decision.
+
+## Product-oracle gate integrity (#3322 / #3156)
+
+A red product verification may be resolved only by a product change or an independently re-derived oracle (both sides rebuilt from scratch, different method). In-place repair of the failing comparison then pass is not a pass — it is an unresolved discrepancy.
+
+- ! When a product oracle is red, resolve it by changing the product or by independently re-deriving the oracle, and record `independent_rederivation` on the run-summary `verification` event.
+- ! Emit a run-summary verification event `{check_id, method_fingerprint, outcome}` for each product-oracle attempt when `DEFT_RUN_SUMMARY_PATH` is set. `fail` then a different `method_fingerprint` then `pass` on one check id is machine-flagged.
+- ! `task verify:ac` treats comparison-method mutation as unresolved (exit non-zero) unless independent re-derivation is recorded. Lead the done report with any unresolved discrepancy (#1006).
+- ⊗ Self-adjudicate a red product oracle by editing the comparison (reference file, diff invocation, one-sided regenerate) and shipping the new pass as success.
 
 ## Operator-log hygiene (lazy-load, #1940)
 
@@ -491,3 +517,6 @@ Docs: `docs/decision-log.md` · `xbrief/decisions/README.md`.
 - ⊗ Silently continue after dual-stop failure halt — escalate; do not thrash (#2442)
 - ⊗ Exhaust hard turn/cost budget on self-imposed deepening after the stated acceptance bar is within reach (#3266)
 - ⊗ Silently skip deepening for budget without a fail-loud summary note (#3266 / #1006)
+- ⊗ Chase post-bank out-of-scope findings when surplus budget is insufficient — report, do not thrash the banked pass (#3285)
+- ⊗ Skip finalize-on-green after first stated AC pass under a hard budget (#3285)
+- ⊗ Clear a red product oracle by editing the comparison method then treating the new pass as a pass — record independent re-derivation or fix the product (#3322 / #3156)

package/skills/deft-directive-portfolio-priority/SKILL.md

@@ -84,16 +84,18 @@ Legend (from RFC2119): !=MUST, ~=SHOULD, ≉=SHOULD NOT, ⊗=MUST NOT, ?=MAY.
 3. ! Emit an ordered **shortlist** (deep dive / promote candidates) and a **park list** with park reasons.
 4. ! Separate **interrupt / non-portfolio** rows (escalate, hold, already dispositioned) so they are not ranked against park list.
 5. ⊗ Claim "#X supersedes #Y" from titles alone — see Phase 4 epistemic gates.
+6. ! **List-before-re-recommend** (#3315): for each cited `#N` before re-recommending an overlap, run `task decision:list -- --issue N --json` and match `relatedIssues` from the JSON. Park / do not re-shortlist as novel overlap only when a dispose decision's `relatedIssues` covers this overlap's members (not some other relationship that merely mentions N), unless `revisitTrigger` applies. Advisory diligence — not a `task check` gate. ⊗ Auto-close issues or treat the brief as the dispose record.
+7. Parent/child, leaf/tracker, and sibling-validator pairs are **not** duplicates — #3066/#3082, #95/#96, #513/#514.
 
 ### Phase 4 — Epistemic gates (MUST)
 
 Before citing any `#N` in the brief:
 
 1. ! **Verify existence + state** for every cited issue via live `gh api repos/OWNER/NAME/issues/N` (REST) **or** a proven-fresh cache entry whose state matches the claim.
-2. ! **Read the body** of every issue used for shortlist, park-as-superseded, pack membership, or "decided" claims.
+2. ! **Read the body** of every issue used for shortlist, park-as-superseded, duplicate/consolidate classification, pack membership, or "decided" claims.
 3. ! When claiming decided / superseded / closed-by-comment, also **read comments** (REST `issues/N/comments`).
 4. ! State **open/closed accurately**; never invent issue numbers.
-5. ⊗ **Title-only supersession** or ownership claims.
+5. ⊗ **Title-only supersession**, duplicate, or ownership claims.
 6. ⊗ Cite PRs as issues without filtering `pull_request` on mixed issue lists.
 
 ### Phase 5 — Emit priority brief
@@ -117,9 +119,10 @@ Before citing any `#N` in the brief:
 ### Phase 6 — Dispose checklist (hand off)
 
 1. ! Present the dispose checklist to the operator (accept/edit shortlist + park; record dispose; optional plan-sequence for P1).
-2. ! Point dispose targets: `task decision:write` (#1396 structured decision log under `xbrief/decisions/`; optional interim issue comment only if the write surface is unavailable), and/or `task plan-sequence:set`.
+2. ! Point dispose targets: `task decision:write` (#1396 / [`docs/decision-log.md`](../../docs/decision-log.md)): every overlap-cluster member in `relatedIssues`; include `revisitTrigger`; free-text MAY name relationship. Optional `task plan-sequence:set`. Interim issue comment only if the write surface is unavailable.
 3. ⊗ Auto-promote shortlist into plan-sequence without explicit operator dispose.
 4. ⊗ Exit treating the brief alone as durable prioritization memory (#2741 class).
+~ Dedicated duplicate-clusters ledger is deferred; earn it only when a pass re-litigates a cluster despite a dispose decision listing the members (#3310). Boundaries: #886, #1178, #786, #3198/#3201, #1396.
 
 ## Anti-Patterns
 
@@ -130,6 +133,7 @@ Before citing any `#N` in the brief:
 - ⊗ Full open-backlog unattended ranking without an explicit slice
 - ⊗ Replacing `triage:queue` for buildable work selection
 - ⊗ Treating the brief as the decision record without dispose
+- ⊗ Re-shortlist a disposed overlap without `task decision:list -- --issue N` (#3315)
 
 ## EXIT
 
@@ -141,4 +145,5 @@ Before citing any `#N` in the brief:
 
 - #3198 process + dogfood · #3201 this skill · #3200 / patterns pilot brief
 - #1396 decision log · #3179 propose-not-apply · #1423 / #3197 classify filter only
+- #3315 overlap dispose · #3310 ledger archive · #886 / #1178 / #786 boundaries
 - Siblings: `deft-directive-triage`, `deft-directive-refinement` — not #1419/#1511 post-promotion

package/skills/deft-directive-pre-pr/SKILL.md

@@ -174,11 +174,21 @@ When session effort-budget is hard-capped (`DEFT_MAX_TURNS` / `DEFT_MAX_BUDGET`
 - ! Dual-stop pre-PR defaults (max 3 polish / 2 no-diff) still apply; under a hard cap, prefer fewer polish iterations once AC + check are green.
 - ⊗ Start an unbounded self-imposed verification suite that exceeds stated AC while the hard budget is nearly exhausted (#3266).
 
-## Literal acceptance-command verification (#3267)
+## Product-first done-gate (#3284) / literal AC (#3267)
 
-- ! Before Phase 3 Lint exit / push, when the active scope xBRIEF has stated acceptance commands (metadata or narratives), run `task verify:literal-ac -- <active-xbrief>` and fail closed on exit 1.
+- ! Before Phase 3 Lint exit / push, when the active scope xBRIEF has acceptance commands (`plan.acceptance` or #3267 metadata/narratives), run `task verify:ac -- <active-xbrief>` and fail closed on exit 1. (`verify:literal-ac` is the mechanism alias.)
 - ! Commands must be the exact strings from the task statement — same flags and cwd. Self-chosen verification is supplementary only.
-- ⊗ Skip literal AC run on rapid/minimal ceremony dial — #3267 is required at every depth.
+- ! Full `task check` already runs `verify:ac` first; still run it explicitly before push when AC is stated so failures are visible without the full hygiene suite.
+- ⊗ Skip AC run on rapid/minimal ceremony dial — rapid = AC-only; AC never degrades when commands exist (#3284 / #3156).
+
+## Product-oracle gate integrity (#3322 / #3156)
+
+A red product verification may be resolved only by a product change or an independently re-derived oracle (both sides rebuilt from scratch, different method). In-place repair of the failing comparison then pass is not a pass — it is an unresolved discrepancy.
+
+- ! When a product oracle is red, resolve it by changing the product or by independently re-deriving the oracle, and record `independent_rederivation` on the run-summary `verification` event.
+- ! Emit a run-summary verification event `{check_id, method_fingerprint, outcome}` for each product-oracle attempt when `DEFT_RUN_SUMMARY_PATH` is set. `fail` then a different `method_fingerprint` then `pass` on one check id is machine-flagged.
+- ! `task verify:ac` treats comparison-method mutation as unresolved (exit non-zero) unless independent re-derivation is recorded. Lead the done report with any unresolved discrepancy (#1006).
+- ⊗ Self-adjudicate a red product oracle by editing the comparison (reference file, diff invocation, one-sided regenerate) and shipping the new pass as success.
 
 ## Probe-then-fill remote claims (#3120)
 
@@ -227,5 +237,6 @@ Docs: `docs/decision-log.md`.
 - ⊗ Invent remote PR/SHA/CI/review claims in handoff evidence without same-turn probe binding — invented-done (#3120)
 - ⊗ Fill remote ship/gate fields from memory when only local work completed; legal partial omits PR fields (#3120)
 - ⊗ Clear a failing gate by editing the gate (definition, verifier, reward, required check, coverage floor, policy, eval fixture) instead of the work under test — gate integrity (#3156); see [docs/gate-integrity.md](../../docs/gate-integrity.md)
+- ⊗ Clear a red product oracle by editing the comparison method then treating the new pass as a pass — record independent re-derivation or fix the product (#3322 / #3156)
 - ⊗ Under a hard turn/cost budget, gold-plate pre-PR polish past the stated bar until the budget expires (#3266)
 - ⊗ Exit pre-PR after skipping deepen-for-budget without naming the skip in the summary (#3266 / #1006)

package/skills/deft-directive-release/SKILL.md

@@ -144,7 +144,7 @@ See [`docs/RELEASING.md`](../../../docs/RELEASING.md) § Fixable check failure d
 2. If **no open coverage-debt issue exists** → auto-hatch files `#N` (or operator files manually) with title prefix `coverage-debt:` and body containing both markers. The open `#N` remains WIP until coverage is restored and the issue is closed.
 3. If an **open coverage-debt issue from a prior hatch still exists** → ⊗ soft-pass again; restore real coverage (all four metrics ≥ 85%) and close the debt issue before the cut proceeds.
 
-**Framework-release-first (#3187):** auto-hatch applies to framework `task release` Step 5 (e.g. deftai/directive). Consumer expansion of auto-hatch is blocked on project `plan.policy.coverageDebt` (#3189) — refuse when `status=unset` or `mode=off`. Do not auto-file debt on the framework repo from consumer trees; consumer ledger is always the consumer repo.
+**Framework-release-first (#3187):** auto-hatch applies to framework `task release` Step 5 (e.g. deftai/directive). Consumer expansion of auto-hatch via `plan.policy.coverageDebt` is reserved; consumer expansion is not implemented (#3314). Refuse when unset or off. Live hatch is `--allow-coverage-debt=#N` (#2866). Do not auto-file debt on the framework repo from consumer trees; consumer ledger is always the consumer repo.
 
 ⊗ Auto-pass on a near-miss band without `#N` (#2573).
 ⊗ Silent soft-pass with no tracked issue.

package/strategies/rapid.md

@@ -101,14 +101,15 @@ Rapid is a **spec-generating** strategy. Selecting it at the chaining gate produ
 
 ---
 
-## Literal acceptance-command verification (#3267)
+## Product-first done-gate / literal AC (#3284 / #3267)
 
-Rapid lightens cold ceremony only. When the task statement names exact shell acceptance commands:
+Rapid lightens cold ceremony only. The **positive verification content** of the light path is stated acceptance commands — not framework hygiene.
 
-- ! Capture them at intake as executable AC (`plan.metadata.literal_acceptance_commands`) — do not paraphrase.
-- ! Before done, run `task verify:literal-ac -- <active-story-path>` (verbatim flags/cwd). Fail closed on non-zero.
-- ! This check survives ceremony dial rapid/minimal (#3214) — it is the positive verification content of the light path.
+- ! Capture stated shell commands at intake into `plan.acceptance.commands` (and #3267 `literal_acceptance_commands`) — do not paraphrase. Empty requires `none_stated: true` with a ladder rung (`derived` or `project_floor`).
+- ! Before done, run `task verify:ac -- <active-story-path>` (verbatim flags/cwd). Fail closed on non-zero. (`verify:literal-ac` remains the #3267 mechanism alias.)
+- ! Ceremony dial rapid/minimal = **AC-only** verification for `task check` composition (#3284): hygiene degrades away; AC never degrades when commands exist.
 - ⊗ Treat self-chosen approximate checks as sufficient when the statement named exact commands.
+- ⊗ Skip AC because ceremony is rapid — rapid's job is to keep exactly this check.
 
 ## Anti-Patterns
 

package/tasks/engine-invoke.cjs

@@ -11,6 +11,18 @@
  */
 
 const { spawnSync } = require("node:child_process");
+const fs = require("node:fs");
+const path = require("node:path");
+
+/** Consumer-deposit identity (#3324). Present on @deftai/directive-content. */
+const CONSUMER_DEPOSIT_FIELD = "deftConsumerDeposit";
+/** Optional marker file at DEFT_ROOT (installer / test fixture). */
+const CONSUMER_DEPOSIT_MARKER_FILE = ".deft-consumer-deposit";
+/** Published content-package name also identifies a deposit. */
+const CONTENT_PACKAGE_NAME = "@deftai/directive-content";
+/** Single remediation when a deposit has no global CLI (#3324 / #3265). */
+const DEPOSIT_REMEDIATION = "npm i -g @deftai/directive";
+const SOURCE_BUILD_REMEDIATION = "task build";
 
 /**
  * cmd.exe command separators / metacharacters. Free-text DEFT_ENGINE_CMD_JSON
@@ -73,6 +85,142 @@ function shellSplit(input) {
   return out;
 }
 
+/**
+ * True when DEFT_ROOT is a consumer deposit, not a framework source checkout.
+ * Honors an explicit package.json field, the content-package name, or a
+ * marker file. #3324: deposits must never take the self-build path.
+ * @param {string} root
+ * @param {{ fs?: typeof fs, path?: typeof path }} [opts]
+ */
+/**
+ * Consumer Taskfile includes live at `.deft/core/tasks/`, so DEFT_ROOT is
+ * `.deft/core`. Framework source uses repo-root `tasks/`. Go source-tarball
+ * deposits keep the unmarked monorepo package.json at that core root (#3324
+ * Greptile P1) — the path itself is the deposit identity.
+ * @param {string} root
+ */
+function isVendoredCoreRoot(root, opts = {}) {
+  const io = opts.fs || fs;
+  const pathMod = opts.path || path;
+  const norm = String(root).replace(/\\/g, "/").replace(/\/+$/, "");
+  if (!/(^|\/)\.deft\/core$/.test(norm)) {
+    return false;
+  }
+  // Installer tarballs exclude .git (#1425). A genuine source checkout mounted
+  // at this path still has .git and must keep the self-build path.
+  try {
+    if (io.existsSync(pathMod.join(root, ".git"))) {
+      return false;
+    }
+  } catch {
+    return false;
+  }
+  return true;
+}
+
+function hasConsumerDepositMarker(root, opts = {}) {
+  const io = opts.fs || fs;
+  const pathMod = opts.path || path;
+  if (!root) {
+    return false;
+  }
+  if (isVendoredCoreRoot(root, opts)) {
+    return true;
+  }
+  const markerPath = pathMod.join(root, CONSUMER_DEPOSIT_MARKER_FILE);
+  try {
+    if (io.existsSync(markerPath)) {
+      return true;
+    }
+  } catch {
+    // ignore unreadable marker path
+  }
+  const pkgPath = pathMod.join(root, "package.json");
+  try {
+    const pkg = JSON.parse(io.readFileSync(pkgPath, "utf8"));
+    if (pkg && pkg[CONSUMER_DEPOSIT_FIELD] === true) {
+      return true;
+    }
+    if (pkg && pkg.name === CONTENT_PACKAGE_NAME) {
+      return true;
+    }
+  } catch {
+    return false;
+  }
+  return false;
+}
+
+/**
+ * Buildable-source means "may run pnpm/corepack/`task build`". A deposit
+ * marker forces false even when packages/cli + scripts.build are present.
+ * @param {string} root
+ * @param {{ fs?: typeof fs, path?: typeof path }} [opts]
+ */
+function isBuildableSource(root, opts = {}) {
+  if (hasConsumerDepositMarker(root, opts)) {
+    return false;
+  }
+  const io = opts.fs || fs;
+  const pathMod = opts.path || path;
+  if (!root) {
+    return false;
+  }
+  const cliPkg = pathMod.join(root, "packages", "cli", "package.json");
+  const rootPkg = pathMod.join(root, "package.json");
+  try {
+    if (!io.existsSync(cliPkg) || !io.existsSync(rootPkg)) {
+      return false;
+    }
+    const pkg = JSON.parse(io.readFileSync(rootPkg, "utf8"));
+    return Boolean(pkg && pkg.scripts && pkg.scripts.build);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Dispatch decision after local dist / buildable / runtime-whitelist probes.
+ * Deposit marker is applied via isBuildableSource(false); this keeps the
+ * runtime-verb whitelist for true source checkouts only (#3324 / #2409).
+ *
+ * @param {{
+ *   hasBin: boolean,
+ *   isBuildableSource: boolean,
+ *   isRuntimeVerb: boolean,
+ *   hasGlobalCli: boolean,
+ * }} input
+ * @returns {{
+ *   action: "vendored" | "global" | "fail-closed",
+ *   remediations?: string[],
+ *   exitCode?: number,
+ * }}
+ */
+function resolveInvokeDispatch(input) {
+  if (input.hasBin) {
+    return { action: "vendored" };
+  }
+  if (input.isBuildableSource) {
+    if (input.isRuntimeVerb && input.hasGlobalCli) {
+      return { action: "global" };
+    }
+    return {
+      action: "fail-closed",
+      remediations: input.isRuntimeVerb
+        ? [DEPOSIT_REMEDIATION, SOURCE_BUILD_REMEDIATION]
+        : [SOURCE_BUILD_REMEDIATION],
+      exitCode: 2,
+    };
+  }
+  if (input.hasGlobalCli) {
+    return { action: "global" };
+  }
+  return {
+    action: "fail-closed",
+    remediations: [DEPOSIT_REMEDIATION],
+    exitCode: 2,
+  };
+}
+
 function main() {
   const mode = process.argv[2];
   const target = process.argv[3];
@@ -171,7 +319,28 @@ function buildSpawnPlan(mode, target, argv, opts = {}) {
 }
 
 if (require.main === module) {
+  const mode = process.argv[2];
+  if (mode === "deposit-marker") {
+    process.exit(hasConsumerDepositMarker(process.argv[3] || "") ? 0 : 1);
+  }
+  if (mode === "is-buildable-source") {
+    process.exit(isBuildableSource(process.argv[3] || "") ? 0 : 1);
+  }
   main();
 }
 
-module.exports = { shellSplit, quoteWin32Arg, buildSpawnPlan, WIN32_CMD_METACHAR_RE };
+module.exports = {
+  shellSplit,
+  quoteWin32Arg,
+  buildSpawnPlan,
+  WIN32_CMD_METACHAR_RE,
+  hasConsumerDepositMarker,
+  isVendoredCoreRoot,
+  isBuildableSource,
+  resolveInvokeDispatch,
+  CONSUMER_DEPOSIT_FIELD,
+  CONSUMER_DEPOSIT_MARKER_FILE,
+  CONTENT_PACKAGE_NAME,
+  DEPOSIT_REMEDIATION,
+  SOURCE_BUILD_REMEDIATION,
+};

package/tasks/engine-invoke.test.cjs

@@ -2,12 +2,23 @@
 "use strict";
 
 const assert = require("node:assert/strict");
-const { describe, it } = require("node:test");
+const { spawnSync } = require("node:child_process");
+const { mkdtempSync, mkdirSync, writeFileSync, rmSync } = require("node:fs");
+const { tmpdir } = require("node:os");
+const { join } = require("node:path");
+const { describe, it, after } = require("node:test");
 const {
   shellSplit,
   quoteWin32Arg,
   buildSpawnPlan,
   WIN32_CMD_METACHAR_RE,
+  hasConsumerDepositMarker,
+  isVendoredCoreRoot,
+  isBuildableSource,
+  resolveInvokeDispatch,
+  CONSUMER_DEPOSIT_MARKER_FILE,
+  CONTENT_PACKAGE_NAME,
+  DEPOSIT_REMEDIATION,
 } = require("./engine-invoke.cjs");
 
 const WIN32 = { platform: "win32", nodePath: "/node" };
@@ -203,7 +214,141 @@ describe("buildSpawnPlan — CodeQL absolute-path isolation (#3175 / alert #74)"
     assert.equal(plan.args[3].includes("node.exe"), false);
     assert.deepEqual(splitCmdTokens(plan.args[3]), ["deft", "release", "--summary", "ok"]);
   });
+});
+
+describe("consumer-deposit marker (#3324)", () => {
+  const created = [];
+
+  after(() => {
+    for (const dir of created.splice(0)) {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  function tempRoot() {
+    const dir = mkdtempSync(join(tmpdir(), "3324-deposit-"));
+    created.push(dir);
+    return dir;
+  }
+
+  function writePkg(dir, pkg) {
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, "package.json"), JSON.stringify(pkg), "utf8");
+  }
+
+  function writeBuildableTree(dir, pkgExtra = {}) {
+    writePkg(dir, { name: "looks-like-source", scripts: { build: "tsc -b" }, ...pkgExtra });
+    mkdirSync(join(dir, "packages", "cli"), { recursive: true });
+    writePkg(join(dir, "packages", "cli"), { name: "@deftai/directive-cli" });
+  }
+
+  it("detects the package.json deftConsumerDeposit field", () => {
+    const root = tempRoot();
+    writePkg(root, { name: "app", deftConsumerDeposit: true, scripts: { build: "tsc" } });
+    assert.equal(hasConsumerDepositMarker(root), true);
+  });
+
+  it("detects @deftai/directive-content as a deposit", () => {
+    const root = tempRoot();
+    writePkg(root, { name: CONTENT_PACKAGE_NAME, scripts: { build: "tsc" } });
+    assert.equal(hasConsumerDepositMarker(root), true);
+  });
+
+  it("detects the .deft-consumer-deposit marker file", () => {
+    const root = tempRoot();
+    writePkg(root, { name: "app", scripts: { build: "tsc" } });
+    writeFileSync(join(root, CONSUMER_DEPOSIT_MARKER_FILE), "1\n", "utf8");
+    assert.equal(hasConsumerDepositMarker(root), true);
+  });
+
+  it("does not mark a framework source checkout", () => {
+    const root = tempRoot();
+    writeBuildableTree(root);
+    assert.equal(hasConsumerDepositMarker(root), false);
+    assert.equal(isBuildableSource(root), true);
+  });
+
+  it("treats a .deft/core DEFT_ROOT as a deposit (Go source-tarball layout)", () => {
+    const root = join(tempRoot(), ".deft", "core");
+    writeBuildableTree(root);
+    assert.equal(isVendoredCoreRoot(root), true);
+    assert.equal(hasConsumerDepositMarker(root), true);
+    assert.equal(isBuildableSource(root), false);
+  });
 
+  it("does not treat a source checkout mounted at .deft/core as a deposit", () => {
+    const root = join(tempRoot(), ".deft", "core");
+    writeBuildableTree(root);
+    mkdirSync(join(root, ".git"));
+    assert.equal(isVendoredCoreRoot(root), false);
+    assert.equal(isBuildableSource(root), true);
+  });
+
+  it("never treats a marked deposit as buildable source", () => {
+    const root = tempRoot();
+    writeBuildableTree(root, { deftConsumerDeposit: true });
+    assert.equal(hasConsumerDepositMarker(root), true);
+    assert.equal(isBuildableSource(root), false);
+  });
+
+  it("routes every deposit verb via global CLI (not the self-build path)", () => {
+    const plan = resolveInvokeDispatch({
+      hasBin: false,
+      isBuildableSource: false,
+      isRuntimeVerb: false,
+      hasGlobalCli: true,
+    });
+    assert.deepEqual(plan, { action: "global" });
+  });
+
+  it("fails closed with the one remediation when a deposit has no global CLI", () => {
+    const plan = resolveInvokeDispatch({
+      hasBin: false,
+      isBuildableSource: false,
+      isRuntimeVerb: false,
+      hasGlobalCli: false,
+    });
+    assert.equal(plan.action, "fail-closed");
+    assert.equal(plan.exitCode, 2);
+    assert.deepEqual(plan.remediations, [DEPOSIT_REMEDIATION]);
+    assert.equal(DEPOSIT_REMEDIATION, "npm i -g @deftai/directive");
+  });
+
+  it("keeps the runtime-verb whitelist for true source checkouts", () => {
+    const runtime = resolveInvokeDispatch({
+      hasBin: false,
+      isBuildableSource: true,
+      isRuntimeVerb: true,
+      hasGlobalCli: true,
+    });
+    assert.deepEqual(runtime, { action: "global" });
+
+    const check = resolveInvokeDispatch({
+      hasBin: false,
+      isBuildableSource: true,
+      isRuntimeVerb: false,
+      hasGlobalCli: true,
+    });
+    assert.equal(check.action, "fail-closed");
+    assert.deepEqual(check.remediations, ["task build"]);
+  });
+
+  it("CLI probe exits 0 for a marked deposit and 1 for is-buildable-source", () => {
+    const root = tempRoot();
+    writeBuildableTree(root, { deftConsumerDeposit: true });
+    const script = join(__dirname, "engine-invoke.cjs");
+    const marker = spawnSync(process.execPath, [script, "deposit-marker", root], {
+      encoding: "utf8",
+    });
+    assert.equal(marker.status, 0, marker.stderr);
+    const buildable = spawnSync(process.execPath, [script, "is-buildable-source", root], {
+      encoding: "utf8",
+    });
+    assert.equal(buildable.status, 1, buildable.stderr);
+  });
+});
+
+describe("buildSpawnPlan — CodeQL absolute-path isolation (#3175 / alert #74)", () => {
   it("uses nodePath only as the non-shell vendored command (never cmd.exe)", () => {
     const nodePath = String.raw`C:\Program Files\nodejs\node.exe`;
     const plan = buildSpawnPlan("vendored", String.raw`C:\repo\packages\cli\dist\bin.js`, ["session:start"], {