@deftai/directive-content 0.101.0 → 0.102.0

package/scm/github.md

@@ -393,9 +393,9 @@ Following a v1.0.0 release, commits:
 
 **Framework CI runners (#2672)**:
 - ! `deftai/directive` required CI prefers Blacksmith (`blacksmith-4vcpu-ubuntu-2404`) for TypeScript and Go cost
-- ! Capacity watchdog (~20 minute budget): if a Blacksmith primary job stays `queued` with `runner_name` null and no `started_at`, cancel that queued attempt (concurrency cancel-in-progress) and run the same suite on `ubuntu-latest`
-- ! Branch-protection required check names (`TypeScript (build + lint + test)`, `Go (test + build)`) live **only** on the aggregator jobs — never on primary/failover lane names
-- ⊗ Fail over `in_progress` jobs (execution hangs) — those stay timeout + fix (#2652); capacity failover is queue-stall only
+- ! Capacity watchdog (~20 minute budget): if a required Blacksmith job (TypeScript, Go, or merge-gate) stays unclaimed (`runner_name` null — `started_at` alone is not a claim), cancel that unclaimed attempt and run the same suite on `ubuntu-latest` (#3340)
+- ! Branch-protection required check names (`TypeScript (build + lint + test)`, `Go (test + build)`, `Merge gate (task check)`) live **only** on the aggregator jobs — never on primary/failover lane names
+- ⊗ Fail over a job that has `runner_name` (claimed execution hang) — those stay timeout + fix (#2652); capacity failover is unclaimed-queue stall only (#3340)
 - ! Consumer scaffolds and `npm-publish.yml` stay on GitHub-hosted `ubuntu-latest` (Blacksmith is opt-in for consumer orgs; npm `--provenance` requires GH-hosted)
 - ! Agents seeing `runner_capacity_stall` / `RUNNER_CAPACITY_STALL` MUST wait for auto-failover — ⊗ `--skip-ci` as a capacity remedy
 

package/skills/deft-directive-build/SKILL.md

@@ -366,6 +366,15 @@ task verify:ac -- <active-story-path>
 - ⊗ Skip this gate because ceremony dial is rapid/minimal — rapid's positive content is exactly this check (#3284).
 - ⊗ Leave `plan.acceptance.commands` empty without `none_stated: true` — absence must be an explicit decision.
 
+## Product-oracle gate integrity (#3322 / #3156)
+
+A red product verification may be resolved only by a product change or an independently re-derived oracle (both sides rebuilt from scratch, different method). In-place repair of the failing comparison then pass is not a pass — it is an unresolved discrepancy.
+
+- ! When a product oracle is red, resolve it by changing the product or by independently re-deriving the oracle, and record `independent_rederivation` on the run-summary `verification` event.
+- ! Emit a run-summary verification event `{check_id, method_fingerprint, outcome}` for each product-oracle attempt when `DEFT_RUN_SUMMARY_PATH` is set. `fail` then a different `method_fingerprint` then `pass` on one check id is machine-flagged.
+- ! `task verify:ac` treats comparison-method mutation as unresolved (exit non-zero) unless independent re-derivation is recorded. Lead the done report with any unresolved discrepancy (#1006).
+- ⊗ Self-adjudicate a red product oracle by editing the comparison (reference file, diff invocation, one-sided regenerate) and shipping the new pass as success.
+
 ## Operator-log hygiene (lazy-load, #1940)
 
 When the story touches **operator-facing** services (dashboards, multi-process
@@ -510,3 +519,4 @@ Docs: `docs/decision-log.md` · `xbrief/decisions/README.md`.
 - ⊗ Silently skip deepening for budget without a fail-loud summary note (#3266 / #1006)
 - ⊗ Chase post-bank out-of-scope findings when surplus budget is insufficient — report, do not thrash the banked pass (#3285)
 - ⊗ Skip finalize-on-green after first stated AC pass under a hard budget (#3285)
+- ⊗ Clear a red product oracle by editing the comparison method then treating the new pass as a pass — record independent re-derivation or fix the product (#3322 / #3156)

package/skills/deft-directive-portfolio-priority/SKILL.md

@@ -84,16 +84,18 @@ Legend (from RFC2119): !=MUST, ~=SHOULD, ≉=SHOULD NOT, ⊗=MUST NOT, ?=MAY.
 3. ! Emit an ordered **shortlist** (deep dive / promote candidates) and a **park list** with park reasons.
 4. ! Separate **interrupt / non-portfolio** rows (escalate, hold, already dispositioned) so they are not ranked against park list.
 5. ⊗ Claim "#X supersedes #Y" from titles alone — see Phase 4 epistemic gates.
+6. ! **List-before-re-recommend** (#3315): for each cited `#N` before re-recommending an overlap, run `task decision:list -- --issue N --json` and match `relatedIssues` from the JSON. Park / do not re-shortlist as novel overlap only when a dispose decision's `relatedIssues` covers this overlap's members (not some other relationship that merely mentions N), unless `revisitTrigger` applies. Advisory diligence — not a `task check` gate. ⊗ Auto-close issues or treat the brief as the dispose record.
+7. Parent/child, leaf/tracker, and sibling-validator pairs are **not** duplicates — #3066/#3082, #95/#96, #513/#514.
 
 ### Phase 4 — Epistemic gates (MUST)
 
 Before citing any `#N` in the brief:
 
 1. ! **Verify existence + state** for every cited issue via live `gh api repos/OWNER/NAME/issues/N` (REST) **or** a proven-fresh cache entry whose state matches the claim.
-2. ! **Read the body** of every issue used for shortlist, park-as-superseded, pack membership, or "decided" claims.
+2. ! **Read the body** of every issue used for shortlist, park-as-superseded, duplicate/consolidate classification, pack membership, or "decided" claims.
 3. ! When claiming decided / superseded / closed-by-comment, also **read comments** (REST `issues/N/comments`).
 4. ! State **open/closed accurately**; never invent issue numbers.
-5. ⊗ **Title-only supersession** or ownership claims.
+5. ⊗ **Title-only supersession**, duplicate, or ownership claims.
 6. ⊗ Cite PRs as issues without filtering `pull_request` on mixed issue lists.
 
 ### Phase 5 — Emit priority brief
@@ -117,9 +119,10 @@ Before citing any `#N` in the brief:
 ### Phase 6 — Dispose checklist (hand off)
 
 1. ! Present the dispose checklist to the operator (accept/edit shortlist + park; record dispose; optional plan-sequence for P1).
-2. ! Point dispose targets: `task decision:write` (#1396 structured decision log under `xbrief/decisions/`; optional interim issue comment only if the write surface is unavailable), and/or `task plan-sequence:set`.
+2. ! Point dispose targets: `task decision:write` (#1396 / [`docs/decision-log.md`](../../docs/decision-log.md)): every overlap-cluster member in `relatedIssues`; include `revisitTrigger`; free-text MAY name relationship. Optional `task plan-sequence:set`. Interim issue comment only if the write surface is unavailable.
 3. ⊗ Auto-promote shortlist into plan-sequence without explicit operator dispose.
 4. ⊗ Exit treating the brief alone as durable prioritization memory (#2741 class).
+~ Dedicated duplicate-clusters ledger is deferred; earn it only when a pass re-litigates a cluster despite a dispose decision listing the members (#3310). Boundaries: #886, #1178, #786, #3198/#3201, #1396.
 
 ## Anti-Patterns
 
@@ -130,6 +133,7 @@ Before citing any `#N` in the brief:
 - ⊗ Full open-backlog unattended ranking without an explicit slice
 - ⊗ Replacing `triage:queue` for buildable work selection
 - ⊗ Treating the brief as the decision record without dispose
+- ⊗ Re-shortlist a disposed overlap without `task decision:list -- --issue N` (#3315)
 
 ## EXIT
 
@@ -141,4 +145,5 @@ Before citing any `#N` in the brief:
 
 - #3198 process + dogfood · #3201 this skill · #3200 / patterns pilot brief
 - #1396 decision log · #3179 propose-not-apply · #1423 / #3197 classify filter only
+- #3315 overlap dispose · #3310 ledger archive · #886 / #1178 / #786 boundaries
 - Siblings: `deft-directive-triage`, `deft-directive-refinement` — not #1419/#1511 post-promotion

package/skills/deft-directive-pre-pr/SKILL.md

@@ -181,6 +181,15 @@ When session effort-budget is hard-capped (`DEFT_MAX_TURNS` / `DEFT_MAX_BUDGET`
 - ! Full `task check` already runs `verify:ac` first; still run it explicitly before push when AC is stated so failures are visible without the full hygiene suite.
 - ⊗ Skip AC run on rapid/minimal ceremony dial — rapid = AC-only; AC never degrades when commands exist (#3284 / #3156).
 
+## Product-oracle gate integrity (#3322 / #3156)
+
+A red product verification may be resolved only by a product change or an independently re-derived oracle (both sides rebuilt from scratch, different method). In-place repair of the failing comparison then pass is not a pass — it is an unresolved discrepancy.
+
+- ! When a product oracle is red, resolve it by changing the product or by independently re-deriving the oracle, and record `independent_rederivation` on the run-summary `verification` event.
+- ! Emit a run-summary verification event `{check_id, method_fingerprint, outcome}` for each product-oracle attempt when `DEFT_RUN_SUMMARY_PATH` is set. `fail` then a different `method_fingerprint` then `pass` on one check id is machine-flagged.
+- ! `task verify:ac` treats comparison-method mutation as unresolved (exit non-zero) unless independent re-derivation is recorded. Lead the done report with any unresolved discrepancy (#1006).
+- ⊗ Self-adjudicate a red product oracle by editing the comparison (reference file, diff invocation, one-sided regenerate) and shipping the new pass as success.
+
 ## Probe-then-fill remote claims (#3120)
 
 ! Before filling any **remote** handoff field (PR URL, PR number, commit/HEAD SHA, CI green/success, review score) or claiming `status: pass` / ship/gate done, MUST **probe then fill**:
@@ -228,5 +237,6 @@ Docs: `docs/decision-log.md`.
 - ⊗ Invent remote PR/SHA/CI/review claims in handoff evidence without same-turn probe binding — invented-done (#3120)
 - ⊗ Fill remote ship/gate fields from memory when only local work completed; legal partial omits PR fields (#3120)
 - ⊗ Clear a failing gate by editing the gate (definition, verifier, reward, required check, coverage floor, policy, eval fixture) instead of the work under test — gate integrity (#3156); see [docs/gate-integrity.md](../../docs/gate-integrity.md)
+- ⊗ Clear a red product oracle by editing the comparison method then treating the new pass as a pass — record independent re-derivation or fix the product (#3322 / #3156)
 - ⊗ Under a hard turn/cost budget, gold-plate pre-PR polish past the stated bar until the budget expires (#3266)
 - ⊗ Exit pre-PR after skipping deepen-for-budget without naming the skip in the summary (#3266 / #1006)

package/skills/deft-directive-release/SKILL.md

@@ -144,7 +144,7 @@ See [`docs/RELEASING.md`](../../../docs/RELEASING.md) § Fixable check failure d
 2. If **no open coverage-debt issue exists** → auto-hatch files `#N` (or operator files manually) with title prefix `coverage-debt:` and body containing both markers. The open `#N` remains WIP until coverage is restored and the issue is closed.
 3. If an **open coverage-debt issue from a prior hatch still exists** → ⊗ soft-pass again; restore real coverage (all four metrics ≥ 85%) and close the debt issue before the cut proceeds.
 
-**Framework-release-first (#3187):** auto-hatch applies to framework `task release` Step 5 (e.g. deftai/directive). Consumer expansion of auto-hatch is blocked on project `plan.policy.coverageDebt` (#3189) — refuse when `status=unset` or `mode=off`. Do not auto-file debt on the framework repo from consumer trees; consumer ledger is always the consumer repo.
+**Framework-release-first (#3187):** auto-hatch applies to framework `task release` Step 5 (e.g. deftai/directive). Consumer expansion of auto-hatch via `plan.policy.coverageDebt` is reserved; consumer expansion is not implemented (#3314). Refuse when unset or off. Live hatch is `--allow-coverage-debt=#N` (#2866). Do not auto-file debt on the framework repo from consumer trees; consumer ledger is always the consumer repo.
 
 ⊗ Auto-pass on a near-miss band without `#N` (#2573).
 ⊗ Silent soft-pass with no tracked issue.

package/tasks/engine-invoke.cjs

@@ -11,6 +11,18 @@
  */
 
 const { spawnSync } = require("node:child_process");
+const fs = require("node:fs");
+const path = require("node:path");
+
+/** Consumer-deposit identity (#3324). Present on @deftai/directive-content. */
+const CONSUMER_DEPOSIT_FIELD = "deftConsumerDeposit";
+/** Optional marker file at DEFT_ROOT (installer / test fixture). */
+const CONSUMER_DEPOSIT_MARKER_FILE = ".deft-consumer-deposit";
+/** Published content-package name also identifies a deposit. */
+const CONTENT_PACKAGE_NAME = "@deftai/directive-content";
+/** Single remediation when a deposit has no global CLI (#3324 / #3265). */
+const DEPOSIT_REMEDIATION = "npm i -g @deftai/directive";
+const SOURCE_BUILD_REMEDIATION = "task build";
 
 /**
  * cmd.exe command separators / metacharacters. Free-text DEFT_ENGINE_CMD_JSON
@@ -73,6 +85,142 @@ function shellSplit(input) {
   return out;
 }
 
+/**
+ * True when DEFT_ROOT is a consumer deposit, not a framework source checkout.
+ * Honors an explicit package.json field, the content-package name, or a
+ * marker file. #3324: deposits must never take the self-build path.
+ * @param {string} root
+ * @param {{ fs?: typeof fs, path?: typeof path }} [opts]
+ */
+/**
+ * Consumer Taskfile includes live at `.deft/core/tasks/`, so DEFT_ROOT is
+ * `.deft/core`. Framework source uses repo-root `tasks/`. Go source-tarball
+ * deposits keep the unmarked monorepo package.json at that core root (#3324
+ * Greptile P1) — the path itself is the deposit identity.
+ * @param {string} root
+ */
+function isVendoredCoreRoot(root, opts = {}) {
+  const io = opts.fs || fs;
+  const pathMod = opts.path || path;
+  const norm = String(root).replace(/\\/g, "/").replace(/\/+$/, "");
+  if (!/(^|\/)\.deft\/core$/.test(norm)) {
+    return false;
+  }
+  // Installer tarballs exclude .git (#1425). A genuine source checkout mounted
+  // at this path still has .git and must keep the self-build path.
+  try {
+    if (io.existsSync(pathMod.join(root, ".git"))) {
+      return false;
+    }
+  } catch {
+    return false;
+  }
+  return true;
+}
+
+function hasConsumerDepositMarker(root, opts = {}) {
+  const io = opts.fs || fs;
+  const pathMod = opts.path || path;
+  if (!root) {
+    return false;
+  }
+  if (isVendoredCoreRoot(root, opts)) {
+    return true;
+  }
+  const markerPath = pathMod.join(root, CONSUMER_DEPOSIT_MARKER_FILE);
+  try {
+    if (io.existsSync(markerPath)) {
+      return true;
+    }
+  } catch {
+    // ignore unreadable marker path
+  }
+  const pkgPath = pathMod.join(root, "package.json");
+  try {
+    const pkg = JSON.parse(io.readFileSync(pkgPath, "utf8"));
+    if (pkg && pkg[CONSUMER_DEPOSIT_FIELD] === true) {
+      return true;
+    }
+    if (pkg && pkg.name === CONTENT_PACKAGE_NAME) {
+      return true;
+    }
+  } catch {
+    return false;
+  }
+  return false;
+}
+
+/**
+ * Buildable-source means "may run pnpm/corepack/`task build`". A deposit
+ * marker forces false even when packages/cli + scripts.build are present.
+ * @param {string} root
+ * @param {{ fs?: typeof fs, path?: typeof path }} [opts]
+ */
+function isBuildableSource(root, opts = {}) {
+  if (hasConsumerDepositMarker(root, opts)) {
+    return false;
+  }
+  const io = opts.fs || fs;
+  const pathMod = opts.path || path;
+  if (!root) {
+    return false;
+  }
+  const cliPkg = pathMod.join(root, "packages", "cli", "package.json");
+  const rootPkg = pathMod.join(root, "package.json");
+  try {
+    if (!io.existsSync(cliPkg) || !io.existsSync(rootPkg)) {
+      return false;
+    }
+    const pkg = JSON.parse(io.readFileSync(rootPkg, "utf8"));
+    return Boolean(pkg && pkg.scripts && pkg.scripts.build);
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Dispatch decision after local dist / buildable / runtime-whitelist probes.
+ * Deposit marker is applied via isBuildableSource(false); this keeps the
+ * runtime-verb whitelist for true source checkouts only (#3324 / #2409).
+ *
+ * @param {{
+ *   hasBin: boolean,
+ *   isBuildableSource: boolean,
+ *   isRuntimeVerb: boolean,
+ *   hasGlobalCli: boolean,
+ * }} input
+ * @returns {{
+ *   action: "vendored" | "global" | "fail-closed",
+ *   remediations?: string[],
+ *   exitCode?: number,
+ * }}
+ */
+function resolveInvokeDispatch(input) {
+  if (input.hasBin) {
+    return { action: "vendored" };
+  }
+  if (input.isBuildableSource) {
+    if (input.isRuntimeVerb && input.hasGlobalCli) {
+      return { action: "global" };
+    }
+    return {
+      action: "fail-closed",
+      remediations: input.isRuntimeVerb
+        ? [DEPOSIT_REMEDIATION, SOURCE_BUILD_REMEDIATION]
+        : [SOURCE_BUILD_REMEDIATION],
+      exitCode: 2,
+    };
+  }
+  if (input.hasGlobalCli) {
+    return { action: "global" };
+  }
+  return {
+    action: "fail-closed",
+    remediations: [DEPOSIT_REMEDIATION],
+    exitCode: 2,
+  };
+}
+
 function main() {
   const mode = process.argv[2];
   const target = process.argv[3];
@@ -171,7 +319,28 @@ function buildSpawnPlan(mode, target, argv, opts = {}) {
 }
 
 if (require.main === module) {
+  const mode = process.argv[2];
+  if (mode === "deposit-marker") {
+    process.exit(hasConsumerDepositMarker(process.argv[3] || "") ? 0 : 1);
+  }
+  if (mode === "is-buildable-source") {
+    process.exit(isBuildableSource(process.argv[3] || "") ? 0 : 1);
+  }
   main();
 }
 
-module.exports = { shellSplit, quoteWin32Arg, buildSpawnPlan, WIN32_CMD_METACHAR_RE };
+module.exports = {
+  shellSplit,
+  quoteWin32Arg,
+  buildSpawnPlan,
+  WIN32_CMD_METACHAR_RE,
+  hasConsumerDepositMarker,
+  isVendoredCoreRoot,
+  isBuildableSource,
+  resolveInvokeDispatch,
+  CONSUMER_DEPOSIT_FIELD,
+  CONSUMER_DEPOSIT_MARKER_FILE,
+  CONTENT_PACKAGE_NAME,
+  DEPOSIT_REMEDIATION,
+  SOURCE_BUILD_REMEDIATION,
+};

package/tasks/engine-invoke.test.cjs

@@ -2,12 +2,23 @@
 "use strict";
 
 const assert = require("node:assert/strict");
-const { describe, it } = require("node:test");
+const { spawnSync } = require("node:child_process");
+const { mkdtempSync, mkdirSync, writeFileSync, rmSync } = require("node:fs");
+const { tmpdir } = require("node:os");
+const { join } = require("node:path");
+const { describe, it, after } = require("node:test");
 const {
   shellSplit,
   quoteWin32Arg,
   buildSpawnPlan,
   WIN32_CMD_METACHAR_RE,
+  hasConsumerDepositMarker,
+  isVendoredCoreRoot,
+  isBuildableSource,
+  resolveInvokeDispatch,
+  CONSUMER_DEPOSIT_MARKER_FILE,
+  CONTENT_PACKAGE_NAME,
+  DEPOSIT_REMEDIATION,
 } = require("./engine-invoke.cjs");
 
 const WIN32 = { platform: "win32", nodePath: "/node" };
@@ -203,7 +214,141 @@ describe("buildSpawnPlan — CodeQL absolute-path isolation (#3175 / alert #74)"
     assert.equal(plan.args[3].includes("node.exe"), false);
     assert.deepEqual(splitCmdTokens(plan.args[3]), ["deft", "release", "--summary", "ok"]);
   });
+});
+
+describe("consumer-deposit marker (#3324)", () => {
+  const created = [];
+
+  after(() => {
+    for (const dir of created.splice(0)) {
+      rmSync(dir, { recursive: true, force: true });
+    }
+  });
+
+  function tempRoot() {
+    const dir = mkdtempSync(join(tmpdir(), "3324-deposit-"));
+    created.push(dir);
+    return dir;
+  }
+
+  function writePkg(dir, pkg) {
+    mkdirSync(dir, { recursive: true });
+    writeFileSync(join(dir, "package.json"), JSON.stringify(pkg), "utf8");
+  }
+
+  function writeBuildableTree(dir, pkgExtra = {}) {
+    writePkg(dir, { name: "looks-like-source", scripts: { build: "tsc -b" }, ...pkgExtra });
+    mkdirSync(join(dir, "packages", "cli"), { recursive: true });
+    writePkg(join(dir, "packages", "cli"), { name: "@deftai/directive-cli" });
+  }
+
+  it("detects the package.json deftConsumerDeposit field", () => {
+    const root = tempRoot();
+    writePkg(root, { name: "app", deftConsumerDeposit: true, scripts: { build: "tsc" } });
+    assert.equal(hasConsumerDepositMarker(root), true);
+  });
+
+  it("detects @deftai/directive-content as a deposit", () => {
+    const root = tempRoot();
+    writePkg(root, { name: CONTENT_PACKAGE_NAME, scripts: { build: "tsc" } });
+    assert.equal(hasConsumerDepositMarker(root), true);
+  });
+
+  it("detects the .deft-consumer-deposit marker file", () => {
+    const root = tempRoot();
+    writePkg(root, { name: "app", scripts: { build: "tsc" } });
+    writeFileSync(join(root, CONSUMER_DEPOSIT_MARKER_FILE), "1\n", "utf8");
+    assert.equal(hasConsumerDepositMarker(root), true);
+  });
+
+  it("does not mark a framework source checkout", () => {
+    const root = tempRoot();
+    writeBuildableTree(root);
+    assert.equal(hasConsumerDepositMarker(root), false);
+    assert.equal(isBuildableSource(root), true);
+  });
+
+  it("treats a .deft/core DEFT_ROOT as a deposit (Go source-tarball layout)", () => {
+    const root = join(tempRoot(), ".deft", "core");
+    writeBuildableTree(root);
+    assert.equal(isVendoredCoreRoot(root), true);
+    assert.equal(hasConsumerDepositMarker(root), true);
+    assert.equal(isBuildableSource(root), false);
+  });
 
+  it("does not treat a source checkout mounted at .deft/core as a deposit", () => {
+    const root = join(tempRoot(), ".deft", "core");
+    writeBuildableTree(root);
+    mkdirSync(join(root, ".git"));
+    assert.equal(isVendoredCoreRoot(root), false);
+    assert.equal(isBuildableSource(root), true);
+  });
+
+  it("never treats a marked deposit as buildable source", () => {
+    const root = tempRoot();
+    writeBuildableTree(root, { deftConsumerDeposit: true });
+    assert.equal(hasConsumerDepositMarker(root), true);
+    assert.equal(isBuildableSource(root), false);
+  });
+
+  it("routes every deposit verb via global CLI (not the self-build path)", () => {
+    const plan = resolveInvokeDispatch({
+      hasBin: false,
+      isBuildableSource: false,
+      isRuntimeVerb: false,
+      hasGlobalCli: true,
+    });
+    assert.deepEqual(plan, { action: "global" });
+  });
+
+  it("fails closed with the one remediation when a deposit has no global CLI", () => {
+    const plan = resolveInvokeDispatch({
+      hasBin: false,
+      isBuildableSource: false,
+      isRuntimeVerb: false,
+      hasGlobalCli: false,
+    });
+    assert.equal(plan.action, "fail-closed");
+    assert.equal(plan.exitCode, 2);
+    assert.deepEqual(plan.remediations, [DEPOSIT_REMEDIATION]);
+    assert.equal(DEPOSIT_REMEDIATION, "npm i -g @deftai/directive");
+  });
+
+  it("keeps the runtime-verb whitelist for true source checkouts", () => {
+    const runtime = resolveInvokeDispatch({
+      hasBin: false,
+      isBuildableSource: true,
+      isRuntimeVerb: true,
+      hasGlobalCli: true,
+    });
+    assert.deepEqual(runtime, { action: "global" });
+
+    const check = resolveInvokeDispatch({
+      hasBin: false,
+      isBuildableSource: true,
+      isRuntimeVerb: false,
+      hasGlobalCli: true,
+    });
+    assert.equal(check.action, "fail-closed");
+    assert.deepEqual(check.remediations, ["task build"]);
+  });
+
+  it("CLI probe exits 0 for a marked deposit and 1 for is-buildable-source", () => {
+    const root = tempRoot();
+    writeBuildableTree(root, { deftConsumerDeposit: true });
+    const script = join(__dirname, "engine-invoke.cjs");
+    const marker = spawnSync(process.execPath, [script, "deposit-marker", root], {
+      encoding: "utf8",
+    });
+    assert.equal(marker.status, 0, marker.stderr);
+    const buildable = spawnSync(process.execPath, [script, "is-buildable-source", root], {
+      encoding: "utf8",
+    });
+    assert.equal(buildable.status, 1, buildable.stderr);
+  });
+});
+
+describe("buildSpawnPlan — CodeQL absolute-path isolation (#3175 / alert #74)", () => {
   it("uses nodePath only as the non-shell vendored command (never cmd.exe)", () => {
     const nodePath = String.raw`C:\Program Files\nodejs\node.exe`;
     const plan = buildSpawnPlan("vendored", String.raw`C:\repo\packages\cli\dist\bin.js`, ["session:start"], {

package/tasks/engine.yml

@@ -5,6 +5,8 @@ version: '3'
 # Framework-source checkouts invoke the vendored `packages/cli/dist/bin.js`.
 # npm consumer deposits copy @deftai/directive-content only — no bundled CLI —
 # so tasks fall back to the globally installed `deft` / `directive` command.
+# A deposit marker (package.json deftConsumerDeposit / .deft-consumer-deposit /
+# @deftai/directive-content name) forces that fallback for every verb (#3324).
 
 vars:
   DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
@@ -24,7 +26,7 @@ tasks:
 
   _ts-build:
     internal: true
-    desc: "Build CLI dist from the framework source checkout; no-op on npm consumer deposits that ship no packages/ source (#2022 Phase 3 / #2126)."
+    desc: "Build CLI dist from the framework source checkout; no-op on consumer deposits (#2022 / #2126 / #3324)."
     # Run from the operator project root (USER_WORKING_DIR), NOT an absolute
     # DEFT_ROOT: an absolute `dir:` doubles onto the invocation cwd on Windows
     # when the Taskfile is invoked via `task -t <absolute-path>` (observed as
@@ -45,9 +47,9 @@ tasks:
     cmds:
       - |
         set -eu
-        if [ -f "{{.DEFT_ROOT}}/packages/cli/package.json" ] \
-           && [ -f "{{.DEFT_ROOT}}/package.json" ] \
-           && node -e "const fs=require('fs');const j=JSON.parse(fs.readFileSync(process.argv[1],'utf8'));process.exit(j.scripts&&j.scripts.build?0:1)" "{{.DEFT_ROOT}}/package.json"; then
+        # #3324: consumer-deposit marker forces a no-op even when stray
+        # packages/cli + scripts.build make the tree look buildable.
+        if node "{{.TASKFILE_DIR}}/engine-invoke.cjs" is-buildable-source "{{.DEFT_ROOT}}"; then
           if node "{{.TASKFILE_DIR}}/ts-build-fresh.cjs" "{{.DEFT_ROOT}}"; then
             exit 0
           fi
@@ -56,7 +58,7 @@ tasks:
 
   invoke:
     internal: true
-    desc: "Run a deft-ts verb from vendored bin.js (source checkout) or global deft (npm consumer deposit / runtime fallback #2409). Runtime/session verbs must not trigger engine:_ts-build / pnpm (#2181)."
+    desc: "Run a deft-ts verb from vendored bin.js (source checkout) or global deft (deposit / runtime fallback #2409 / #3324). Runtime/session verbs must not trigger engine:_ts-build / pnpm (#2181)."
     # Run from the operator project root so deft verbs resolve USER_WORKING_DIR
     # correctly; without this, included engine.yml defaults cwd to tasks/ (#2022).
     dir: '{{.USER_WORKING_DIR}}'
@@ -70,10 +72,10 @@ tasks:
         set -eu
         bin="{{.DEFT_ROOT}}/packages/cli/dist/bin.js"
         root_pkg="{{.DEFT_ROOT}}/package.json"
+        # #3324: deposit marker (package.json field / file / content-package
+        # name) forces is_buildable_source=0 so every verb uses global CLI.
         is_buildable_source=0
-        if [ -f "{{.DEFT_ROOT}}/packages/cli/package.json" ] \
-           && [ -f "$root_pkg" ] \
-           && node -e "const fs=require('fs');const j=JSON.parse(fs.readFileSync(process.argv[1],'utf8'));process.exit(j.scripts&&j.scripts.build?0:1)" "$root_pkg"; then
+        if node "{{.TASKFILE_DIR}}/engine-invoke.cjs" is-buildable-source "{{.DEFT_ROOT}}"; then
           is_buildable_source=1
         fi
         if [ -f "$bin" ]; then

package/templates/agent-prompt-preamble.md

@@ -530,6 +530,11 @@ The parent monitor watches the heartbeat file directly (three-state exit 0 ok /
 - Monitors run `task verify:subagent-alive -- --require-agent <agent-id> [--scratch-dir <worktree>/.deft-scratch/subagent-status]` each poll iteration.
 - Workers run `task agent:monitor` (raw sweep) or the gate verb above; both wrap `subagent-monitor` (#1365).
 
+## 10.55 Rule Authority and Thin Fail-Closed (#3313)
+
+Principle: `main.md` `## Rule Authority [AXIOM]`.
+Principle: `main.md` `## Thin Fail-Closed Design (#3265)`.
+
 ## 10.6 Dual stop for multi-iteration worker loops (#2442)
 
 Multi-iteration implement, pre-PR, repair, and monitor loops require **two** stops: **success** (goal / AC / checker met) and **failure or budget** (max iterations, no-progress, or time/token budget). Single-turn tasks are exempt. Principle and defaults: `main.md` `## Dual Stop Rule (#2442)`; build skill dual-stop table; swarm Phase 4 / core-ops.

package/templates/agents-entry.md

@@ -53,7 +53,6 @@ Legacy `vbrief/` read-accepted; `deft migrate:xbrief` for `xbrief/` (v0.6→v0.8
 ## Content packs
 
 ! Before improvising: `deft packs:slice --list-packs`, then `deft packs:slice <pack> --list` / `deft packs:slice <pack> <slice>` — `commands.md` (§ packs); never enumerate names here.
-
 ## Codebase MAP Projection (#1595 / #1498)
 
 ! `plan.architecture.codeStructure` is durable SoT; `.planning/codebase/MAP.md` is generated — `deft codebase:map` / `deft verify:codebase-map-fresh` (`commands.md`). ⊗ Do not hand-edit MAP, block on stale/absent MAP, or elevate projection above xBRIEF (#1595 / #1498).
@@ -61,13 +60,16 @@ Legacy `vbrief/` read-accepted; `deft migrate:xbrief` for `xbrief/` (v0.6→v0.8
 ## Skills
 
 ! **Skills Index** (Level-0) in `.deft/core/REFERENCES.md` — scan before improvising; read `SKILL.md` only on index match. `welcome` / `onboard triage` → `deft triage:welcome --onboard` (N3 / #1143); lessons → packs:slice.
-
 ## Skill pin policy (#2508)
 
 ! Process-critical skills with false-negative risk MUST be named in AGENTS.md (always-pin tier) — tier definitions: `.deft/core/docs/skill-pin-policy.md` (#2508).
 ! **Default always-pins:** `deft-directive-build`, `deft-directive-pre-pr`, `deft-directive-review-cycle`, `deft-directive-swarm` — read each `SKILL.md` when that work type starts.
 ⊗ Pin entire language packs, deployment docs, or framework bulk into AGENTS.md — pins are for false-negative-sensitive process gates only (#2508).
 ! **Dual stop (#2442):** multi-iteration work MUST have success + failure/budget stop (max iters / no-progress / budget); single-turn exempt; halt with operator-visible report; ⊗ thrash. Defaults: build, swarm, review-cycle skills. See main.md Dual Stop Rule. Ledger #3143 (`packages/core/src/delivery-attempt/`).
+## Rule Authority [AXIOM]
+! Prefer `task deft:*` over AGENTS.md prose. See main.md.
+## Thin Fail-Closed Design (#3265)
+! One fail-closed `task deft:*` check + one remediation. See main.md.
 
 ## Through-merge worker dispatch (#3032)
 
@@ -93,7 +95,6 @@ Legacy `vbrief/` read-accepted; `deft migrate:xbrief` for `xbrief/` (v0.6→v0.8
 
 ! Mid-scope gates: **split-dispatch** when `agent_id` is terminal; retain-capable hosts (continue-by-agent-id / message-later / steer-mid-flight) MAY re-message the live child. Retention = orchestration only — not constitution self-edit (#3164). Depth: preamble §10; `deft-directive-swarm`. Topology: #3155 nuclear-family. ⊗ Invent retain on one-shot hosts.
 
-
 ## Review-surface precedence (#2308)
 
 ! Route PR shepherding / review work through `deft-directive-review-cycle` — `.deft/core/.agents/skills/deft-directive-review-cycle/SKILL.md`; host `babysit` / `bugbot` / `security-review` advisory-only (#2308 / #2261).
@@ -104,7 +105,6 @@ Legacy `vbrief/` read-accepted; `deft migrate:xbrief` for `xbrief/` (v0.6→v0.8
 
 ## Structured decision log (#1396 / #3211)
 ! Significant choices → `deft decision:write`; re-load → `deft decision:list` / `xbrief/decisions/`; depth `.deft/core/docs/decision-log.md` (not triage/ADRs/lessons).
-
 ## Eval and framework health (#1703)
 
 ! `deft eval:health` when orienting or after gate/policy changes (Tier 0; 4-hour debounce). Release: `deft eval:run` / `deft eval:report`; skill routing: `deft eval:triggers` (#1586 / #1703).