@deftai/directive-content 0.103.0 → 0.105.0

package/Taskfile.yml

@@ -142,9 +142,12 @@ includes:
   vbrief:
     taskfile: ./tasks/vbrief.yml
     optional: false
+  # Non-optional (#3483): the swarm skill names xbrief:validate / xbrief:activate
+  # / xbrief:preflight at MUST/⊗ level, so a silently-omitted include would
+  # reproduce the opaque exit-200 "task does not exist" failure at cohort close.
   xbrief:
     taskfile: ./tasks/xbrief.yml
-    optional: true
+    optional: false
   prd:
     taskfile: ./tasks/prd.yml
     optional: true
@@ -172,6 +175,9 @@ includes:
   session:
     taskfile: ./tasks/session.yml
     optional: true
+  occupancy:
+    taskfile: ./tasks/occupancy.yml
+    optional: true
   lifecycle:
     taskfile: ./tasks/lifecycle.yml
     optional: true
@@ -428,6 +434,7 @@ tasks:
       - verify:test-boundary
       - verify:scope-provenance
       - verify:consumer-check-contract
+      - verify:telemetry-coverage
       - verify:vbrief-conformance
       - verify:destructive-gh-verbs
       - verify:scm-boundary
@@ -1062,10 +1069,10 @@ tasks:
           CLI_ARGS: "{{.CLI_ARGS}}"
 
   # N7 (#1147): slice:record-existing backfill verb. Retrofits a
-  # vbrief/.eval/slices.jsonl entry for hand-filed umbrella cohorts that
-  # D13's writer (#1132) never saw because they were filed via
-  # `gh issue create` / `issue_write` MCP rather than via a slicing
-  # skill. Companion `slice:list` exposes the read surface.
+  # <lifecycle-root>/.triage-cache/slices.jsonl entry for hand-filed
+  # umbrella cohorts that D13's writer (#1132) never saw because they
+  # were filed via `gh issue create` / `issue_write` MCP rather than via
+  # a slicing skill. Companion `slice:list` exposes the read surface.
   slice:record-existing:
     desc: "Retrofit a slices.jsonl entry for a hand-filed cohort (#1147 / N7). -- task slice:record-existing -- --umbrella=N --children=A,B,C [--wave-1=A,B] [--wave-2=C] [--actor=manual:operator] [--expected-close-signal=all-children-merged] [--sliced-at=ISO] [--notes=TEXT] [--dry-run] [--force] [--skip-validation] [--repo OWNER/NAME]"
     cmds:
@@ -1074,7 +1081,7 @@ tasks:
           CLI_ARGS: "{{.CLI_ARGS}}"
 
   slice:list:
-    desc: "List recorded slices in vbrief/.eval/slices.jsonl (#1147 / N7). -- task slice:list [-- --json]"
+    desc: "List recorded slices in <lifecycle-root>/.triage-cache/slices.jsonl (#1147 / N7). -- task slice:list [-- --json]"
     cmds:
       - task: slice-record:list
         vars:

package/UPGRADING.md

@@ -217,6 +217,8 @@ the configured mirror.
 
    **Prettier / format gate (#2534):** managed `.deft/core/` is outside your consumer Prettier gate. `directive init` and `directive update` idempotently deposit or heal a root `.prettierignore` entry for `.deft/core/` so `prettier --check .` (and `task check` when Prettier is wired) does not fail on the vendored framework payload. You do not need to reformat `.deft/core/` after upgrade.
 
+   **Schema rewrite / format before the upgrade PR (#3395):** `deft update` may rewrite consumer-owned `xbrief/schemas/*`. It does **not** run your repo formatter. When the update summary lists rewritten consumer-owned paths, run `task fmt` (or your formatter) **before** opening the upgrade PR so Prettier / `task check` stay green.
+
    > **`deft update` is the single canonical upgrade verb (#2064).** The older `deft install-upgrade` (and its `task upgrade` maintainer alias) now print a one-line notice and delegate to this exact `deft update` path — they no longer have their own semantics. Previously `install-upgrade` only rewrote the marker/manifest without swapping the payload, so on a stale deposit it reported a false "Project already at X. Nothing to do." Use `deft update`; there is nothing `install-upgrade` does that `deft update` does not.
 
 3. **Stamp npm provenance (one-time, idempotent):**
@@ -282,6 +284,8 @@ A normal framework upgrade is **one PR**, not two stacked PRs. The deposited `de
 
 **Do not** split a routine version bump into “deposit-only” then “pin/GENERATION” PRs — that re-creates engine / deposit / pin skew between merges. **Do** keep product feature work on a separate branch/PR from the framework upgrade. Consumers should **not** hand-roll a forked `deft-core-guard.yml` for normal upgrades — the deposited workflow already enforces pin-only + lock follow-through.
 
+**Format before you open the PR (#3395):** if `deft update` listed rewritten consumer-owned `xbrief/schemas/*` paths, run `task fmt` (or your repo formatter) first. Update does not invoke the consumer formatter.
+
 **Load fix (#3345):** if GitHub Actions shows workflow name as the path string `.github/workflows/deft-core-guard.yml` (not `deft-core-guard`), or historical runs are 0s/0 jobs and the required check `no-mixed-core-and-app` never appears on PRs, the deposited workflow failed to load (invalid YAML from an unindented Python heredoc). Run `deft update` (or re-init deposit) so the fixed workflow is rewritten, then open a normal upgrade PR — classic branch protection that requires `no-mixed-core-and-app` can clear once the job posts.
 
 Refs: [#3127](https://github.com/deftai/directive/issues/3127), [#3193](https://github.com/deftai/directive/issues/3193), [#1430](https://github.com/deftai/directive/issues/1430), [#3117](https://github.com/deftai/directive/issues/3117), [#3345](https://github.com/deftai/directive/issues/3345).

package/coding/coding.md

@@ -47,7 +47,7 @@ See [../scm/git.md](../scm/git.md) for:
 
 **Modularity:**
 - ! One responsibility per file/module
-- ~ Files <300 lines ideal; <500 lines recommended; <1000 lines a review trigger — split when exceeded unless genuinely single-responsibility (size is a smell, not a hard cap; #1488)
+- ~ Keep files small. Ideal, recommended, and review-trigger line counts are FILE_SIZE_IDEAL_LINES, FILE_SIZE_RECOMMENDED_LINES, and FILE_SIZE_REVIEW_TRIGGER_LINES in the file-size-thresholds policy module (packages/core/src/policy/file-size-thresholds.ts). Split when a file exceeds the review trigger unless it is genuinely single-responsibility (size is a smell, not a hard cap; #1488 / #3424)
 - ! Explicit scope in task descriptions
 - ~ DRY: extract shared abstractions when logic is duplicated across 2+ call sites
 - ⊗ Copy-paste logic with minor variations — parameterise instead
@@ -234,7 +234,7 @@ See [debugging.md](debugging.md) for the full four-phase process, evidence disci
 
 - ⊗ Secrets in code or version control
 - ⊗ Claiming checks passed without running them
-- ⊗ Single files mixing multiple responsibilities (large line count, e.g. >1000 lines, is a trigger to check cohesion — not a defect by itself; #1488)
+- ⊗ Single files mixing multiple responsibilities (line count at or above FILE_SIZE_REVIEW_TRIGGER_LINES is a cohesion review trigger — not a defect by itself; #1488 / #3424)
 - ⊗ Skipping quality checks
 - ⊗ Breaking changes without explicit approval
 - ⊗ Using `grep` command when `rg` or Warp grep available

package/commands.md

@@ -132,10 +132,10 @@ Scope xBRIEFs live under `xbrief/{proposed,pending,active,completed,cancelled}/`
 
 Common commands:
 
-- `task scope:promote -- xbrief/proposed/<file>.xbrief.json` -- move proposed work to `pending/` and set status to `pending`.
+- `task scope:promote -- xbrief/proposed/<file>.xbrief.json` -- move proposed work to `pending/` and set status to `pending`. When `plan.acceptance` is absent, empty-with-none_stated, or command-only-without-clauses, runs #3323 clause derivation and stamps `clauses[]` (#3360).
 - `task scope:promote -- --from-issue=<N> [--repo OWNER/NAME] [--strict] [--force-no-cache] [--path <file>]` -- promote the proposed scope for issue N via triage-cache reciprocity (#1136). Latest `candidates.jsonl` decision must be `accept` (non-accept refuses unless `--force-no-cache`; missing decision soft-warns, `--strict` fails). Path/`--batch` without `--from-issue` stay ungated.
 - `task scope:promote -- --batch` -- batch-promote **all** `xbrief/proposed/` scopes to `pending/` in one command (#3011 / epic #3009). Optional: `--batch <path>…` for an explicit list; `--force` overrides WIP cap (logged). Does **not** activate; implement remains one `scope:activate` at a time.
-- `task scope:activate -- xbrief/pending/<file>.xbrief.json` -- move accepted work to `active/` and set status to `running`.
+- `task scope:activate -- xbrief/pending/<file>.xbrief.json` -- move accepted work to `active/` and set status to `running`. Same #3323 derivation hook as promote; #3334 refusal names the derive step (#3360). Headless: records `chosen_reading`, never blocks on a question.
 - `task scope:complete -- xbrief/active/<file>.xbrief.json` -- move running work to `completed/` and set status to `completed`.
   - **Per-criterion acceptance evidence (#3240 / #3305):** each non-terminal `plan.items[]` entry needs either namespaced typed evidence or a human-origin disposition before complete may advance it:
     - `plan.items[].x-directive/evidence` — `{ kind: test|review|merge|deploy|smoke|uat|observed_behavior, pointer, recorded_at, recorded_by }`
@@ -158,7 +158,7 @@ task verify:story-ready -- --vbrief-path xbrief/active/<file>.xbrief.json
 deft xbrief:preflight -- xbrief/active/<file>.xbrief.json
 ```
 
-Gate 0 `task verify:story-ready` machine-checks working-tree cleanliness (or `--allow-dirty`), the target xBRIEF in `xbrief/active/` with `plan.status == "running"`, and the dispatch envelope's `## Allocation context` consent token (#1378). A `swarm-cohort` section is ready only when `allocation_plan_id` AND `batching_rationale` are non-null. Complete stories with `task scope:complete -- <active-story-path>`.
+Gate 0 `task verify:story-ready` machine-checks working-tree cleanliness (or `--allow-dirty`), the target xBRIEF in `xbrief/active/` with `plan.status == "running"`, and the dispatch envelope's `## Allocation context` consent token (#1378). A `swarm-cohort` section is ready only when `allocation_plan_id` AND `batching_rationale` are non-null. Both `verify:story-ready` and `xbrief:preflight` also fail closed when an applicable `plan.policy.projectInvariants` ID has no `coverage_map` disposition (list as of check time; completeness only). See `content/docs/project-invariants.md`. Complete stories with `task scope:complete -- <active-story-path>`.
 
 **Story Start Gate (#1378):** Before starting any new implementation story or switching stories, run `git status --short --branch`. If the working tree is dirty, stop and summarize the current branch, modified/untracked files, and whether the changes appear related to the next story — ask the operator to choose: commit existing work, stash existing work, include existing work in the current story, or stop. ⊗ Do not begin a new story while unrelated dirty work is present without explicit operator approval. When invoked as part of a swarm cohort dispatch, the approved Phase 5 allocation plan satisfies batching consent (#954); between stories checkpoint-commit it and proceed — do not pause to ask the operator mid-cohort. Promote/activate via `task scope:promote -- <path>` (or `task scope:promote -- --batch` for multi-scope pins, #3011) / `task scope:activate -- <path>`; preflight with `deft xbrief:preflight -- <active-story-path>`.
 
@@ -189,6 +189,24 @@ flowchart TD
 
 ---
 
+## Default-branch sync (`scm:sync-default`, #3391)
+
+Open dest-targeted sync PRs from typed `baseBranch` to `deliveryBranch`. Consumes the shared detector (#3388) and `syncMaxFiles` (#3390).
+
+```bash
+task scm:sync-default -- --dry-run
+task scm:sync-default -- --max-files 100
+```
+
+- Under the file-count limit: one new PR from source tip to dest.
+- Over the limit: merge-commit cuts; each dest-based leg is a new branch and a new PR. After a leg merges, run the verb again.
+- ⊗ `gh pr edit --base` or close-reopen of an oversized PR. Each leg must be new when the reviewer first sees it.
+- Required checks stay on except the Wave 1 core-guard sync exemption.
+
+Docs: [scm/github.md](./scm/github.md) § Default-branch sync.
+
+---
+
 ## Structured decision log (#1396)
 
 Lightweight intent-debt records for **significant** choices (architecture, product behavior, security, public/private boundary, data model, runtime topology, hard-to-reverse process). Not every trivial scope. Not ADR migration; leave `docs/decisions/ADR-*.md` alone. Split from lessons (#1513).
@@ -273,8 +291,8 @@ Current status: the validation, extractor, provider, registry, generated MAP, an
 - `task verify:xbrief-conformance` -- validate xBRIEF conformance surfaces.
 - `task verify:cache-fresh` -- validate cache freshness where required.
 - `task verify:capacity`, `task verify:wip-cap`, and `task verify:judgment-gates` -- policy/capacity gates.
-- `task verify:orphan-active` -- fail closed when active/running xBRIEFs still point at closed issues or merged PRs (#2321).
-- `task verify:completed-tracked` -- fail closed when closed scoped issues lack a tracked `xbrief/completed/` or `xbrief/cancelled/` artifact on the delivery tip (#3264); remediate with `task swarm:finalize-cohort` or a lifecycle PR. Standalone verb (not part of `task check`); use `--tip HEAD` when validating an in-flight land branch.
+- `task verify:orphan-active` -- fail closed when active/running xBRIEFs still point at closed issues or merged PRs (#2321). After merge, `task verify:orphan-active -- --issue N` scans briefs that reference that issue. Confirmed shipped prints `task scope:complete -- <path>`; unresolved lookup prints a retry remediation and still exits 1 (#3429). PR-only briefs stay on the unscoped scan or `task swarm:complete-cohort`.
+- `task verify:completed-tracked` -- fail closed when closed scoped issues lack a tracked `xbrief/completed/` or `xbrief/cancelled/` artifact on the delivery tip (#3264 / #3476); remediate with `task swarm:finalize-cohort` or a lifecycle PR. `task verify:completed-tracked -- --issue N` is the drive-to DONE form (delivery tip `origin/<deliveryBranch>`, not feature HEAD). Standalone verb (not part of `task check`); use `--tip HEAD` when validating an in-flight land branch. An unresolvable delivery tip fails closed (no silent HEAD fallback) -- fetch the delivery branch or pass an explicit `--tip`. Under `--skip-gh`, a named `--issue` with no cached state fails closed; the unscoped corpus scan keeps the offline allowance. Lifecycle-only lands (completed/cancelled xBRIEFs + optional CHANGELOG) use that verb plus finalize-cohort or the lifecycle PR. ⊗ Full `task check` / the TypeScript suite. ⊗ The drive-to story envelope (pre-pr + review-cycle + suite) for a file-copy land.
 - `task verify:ac` -- product-first acceptance gate (#3284). Runs `plan.acceptance.commands` (or #3267 literal ledger) **verbatim** before done; records AC-source rung (`stated`/`derived`/`project_floor`). Empty commands require `none_stated: true`. Empty resolution is not a green run when the project has no suite floor (`soft_empty` + stamp-acceptance remedy, #3334). Primary name used first in `task check` (fail-fast); `--soft-missing-xbrief` for check composition. Rapid ceremony = AC-only; pressure/degraded makes hygiene advisory. `--capture-only` lists resolved commands without executing. Extends #3267 / #973.
 - `task verify:literal-ac` -- #3267 mechanism alias for verbatim stated-command run (same flags/cwd); prefer `verify:ac` for product-first done-gate.
 - `task coverage:hotspots` / `deft coverage:hotspots` -- read the latest coverage report, compare global metrics to the project's vitest thresholds, fail closed below the branch floor or below configured headroom (default 0.3pp), and list lowest modules plus uncovered branch samples for git-diff paths (`--json` for agents). Complements `deft verify:forward-coverage` (#1310) and `--allow-coverage-debt=#N` (#2573); does not replace them.
@@ -375,6 +393,7 @@ After CLI/deposit upgrade, disk can show the new generation while a long-lived s
 - ! **USER.md path (#2544):** resolve via `deft session:start` output (`USER.md resolved …`); default platform paths: Windows `%APPDATA%\deft\USER.md`, Unix `~/.config/deft/USER.md`; override `$DEFT_USER_PATH`; workspace `<project>/.deft/USER.md`. ⊗ Invent or search `~/.config/deft` on Windows — AppData Roaming is canonical.
 - ! At mutation boundaries (code-writing, scope lifecycle moves, `start_agent`, commits, pushes, PR-from-local-changes, release work): run the mutable quick tier then gated verifier below before proceeding.
 - ? Explicit read-only alignment only: `deft session:start -- --read-only` (no ritual-state write).
+- ! **Worktree occupancy (#3433):** mutation `session:start` / `session:ready` claim a gitignored `.deft/occupancy.json` lease. A second mutation session on the same tree with a different `DEFT_SESSION_ID` fails closed (occupant id, intent, heartbeat age + remediation). Same-session re-arm heartbeats and keeps that id — it does not mint a new UUID. Steal with `occupancy:steal --confirm --occupant <id>` (or `session:start --steal --confirm --occupant <id>`). Expired heartbeat (20 min) is free. `--read-only` does not claim. Join (`occupancy:request`) is named in the remediation only. `swarm:launch` persists `occupancy_session_id` in a cohort-keyed record; close-out must use that cohort's entry (or `DEFT_SESSION_ID`), never a slot another launch can overwrite and never the live lease file.
 - ~ Operators MAY still explicitly request full `deft session:start`, `deft triage:welcome`, sync, or doctor in read-only sessions.
 
 ### Assist / research posture (#1802)
@@ -402,7 +421,7 @@ Cross-link: spawn three postures and deny recoveries live under § Agent-host di
 
 ### Mutable ritual (mutation posture)
 
-- ! On **mutation** session start, run `deft session:start` (or `task session:start` in framework source) after loading AGENTS.md. Records quick-tier ritual in `.deft/ritual-state.json`: alignment confirmation, branch-policy disclosure, `deft verify:tools` guidance, default-branch sync warnings, and `deft triage:welcome` one-liner. State is worktree- and HEAD-bound; stale after `plan.policy.sessionRitualStalenessHours` hours (default 4).
+- ! On **mutation** session start, run `deft session:start` (or `task session:start` in framework source) after loading AGENTS.md. Records quick-tier ritual in `.deft/ritual-state.json`: alignment confirmation, branch-policy disclosure, `deft verify:tools` guidance, default-branch sync warnings, and `deft triage:welcome` one-liner. State is worktree- and HEAD-bound; stale after `plan.policy.sessionRitualStalenessHours` hours (default 4). Mutation start also claims the worktree occupancy lease (`.deft/occupancy.json`); see Session routing (#3433).
 - ! **Orientation compression Now (#3286):** mutation cold `session:start` composes `doctor` + #3282 toolchain preflight (and deposit-sha fast-paths for `agents:refresh` / `verify:cache-fresh`) as inline sections with per-section status lines — composition of existing steps, not a new monolith. When the deposit fingerprint (payload + templates + engine) is unchanged, refresh surfaces print one-line `unchanged - sha match` no-ops. Opt-in compact output: `deft session:start -- --compact` or `DEFT_SESSION_COMPACT=1` (verbose remains the default). #2176 read-only default is unchanged. Dual-path Later (`deft orient`) stays open until run-summary telemetry shows ritual+gate share ≥ 25% after Now ships (#2899).
 - ! Cold `session:start` does **not** run the live agent-hook probe. Functional readiness belongs to the gated mutation path so cold ceremony retains the #2990/#2991 latency profile.
 - ! **Hot path latency (#2991):** by default, mutation `session:start` does **not** block ritual-state write on optional network. It skips the npm release-availability probe and triage cache empty-hydrate / self-heal (`ensureTriageCacheHydrated` / `maybeSelfHealCache`). Targets (operator-facing, not CI-hard): warm hot path typically under a few seconds once tools are on PATH; cold path dominated by local `verify:tools` and git, usually well under ~30s when optional network is off. Empty-cache GitHub fetch-all and npm `view` previously accounted for multi-minute hangs in the WWYSYDH pilot — those stay off the critical path unless opted in.
@@ -587,9 +606,10 @@ flowchart TD
   - `task pr:check-closing-keywords` -- Layer 0 FP lint (#737) **plus intent mode** (#3015 class D). Default `--mode both`: fails on negation/quote/example/code-block hits **and** on any real `Closes|Fixes|Resolves #N` unless allowlisted via `--allow-close N,M` (CLI only; body trailers are not an authorization path). Offline: `--body-file` / `--commits-file`. Prefer `Tracking: #N` / `Refs #N` until full issue DoD.
 - `task release:*` -- release, publish, rollback, and e2e release rehearsal.
   - Step 3 (`Pre-flight vBRIEF lifecycle sync`) fetches GitHub issue states via REST. On HTTP 403 rate-limit exhaustion it sleeps once (capped at 120s) and retries before failing.
-  - When Step 3 still fails with rate-limit exhaustion, stderr includes a `gh api rate_limit` probe (`core.remaining`, reset time) and recovery guidance. After local `task vbrief:validate` (or `task xbrief:validate`) exits 0, operators may pass `--allow-vbrief-drift` to skip Step 3 for that cut — reserved for transient SCM bucket stalls, not unreviewed lifecycle drift.
+  - When Step 3 still fails with rate-limit exhaustion, stderr includes a `gh api rate_limit` probe (`core.remaining`, reset time) and recovery guidance. After local `task xbrief:validate` exits 0, operators may pass `--allow-vbrief-drift` to skip Step 3 for that cut — reserved for transient SCM bucket stalls, not unreviewed lifecycle drift.
 - `task swarm:*` -- readiness, launch, pre-dispatch deny gate (#3228), review-clean verification, and cohort completion.
-- **Operator follow-up after dual-stop / hard stop (#3273):** when a dual-stop or conf-hold halt report lands, re-authorize one residual pass with phrases *pursue residual* / *follow-up hard-stop* / *same as conf-hold* / *continue dual-stopped PR* — steps in `skills/deft-directive-swarm` and `skills/deft-directive-review-cycle` § Operator follow-up after dual-stop / hard stop (not a separate task verb).
+- **Operator follow-up after dual-stop / hard stop (#3273 / #3448):** one-shot *pursue residual* / *follow-up hard-stop* / *same as conf-hold* / *continue dual-stopped PR* is one pass then re-stop. Standing *until floor or loop* / *until greptile meets policy* / *pursue residuals until told otherwise* keeps class A leftovers on open cohort/plan units moving until the resolved `#3095` floor or the **Same-fingerprint stop** in `skills/deft-directive-review-cycle/SKILL.md` Dual stop (not a separate task verb). Steps in `skills/deft-directive-swarm` and `skills/deft-directive-review-cycle` § Operator follow-up after dual-stop / hard stop.
+
 - `task slice:*` -- feature-slice helpers.
 - `task policy:*` and `task capacity:*` -- policy inspection and allocation helpers.
 

package/docs/directive-lifecycle.md

@@ -65,14 +65,22 @@ framework:
 | **Ship** | PR merge and release — `task pr:*` and [`deft-directive-release`](../skills/deft-directive-release/SKILL.md). |
 | **Issues / Features** | GitHub issues and feature requests mirrored into `.deft-cache/` and surfaced as triage candidates. |
 
-## Delivery integrity vs deploy / UAT (#3041)
+## Delivery integrity vs deploy / UAT (#3041 / #3380)
 
 `scope:complete` and swarm cohort completion mark **lifecycle bookkeeping**, not environment
 green. For **code-bearing** scopes, delivered completion requires durable proof that the
 implementation reached the configured **delivery branch** (`plan.policy.deliveryBranch`,
-defaulting to the repo default branch) — typically: PR `base.ref` equals that branch, and the
-merge commit is an ancestor of the refreshed remote delivery ref. A merge into an intermediate
-feature/integration branch is **not** delivery.
+defaulting to the repo default branch). Ancestry on the refreshed remote delivery ref
+(`origin/<deliveryBranch>`) is delivery. PR `base.ref` / `prBase` is provenance only: a
+develop-targeted scope PR can still complete as delivered when its merge commit is already
+an ancestor of `origin/<deliveryBranch>`. `merged_to_integration` applies only when that
+ancestry fails.
+
+Squash-sync from develop to main can rewrite commits so a develop merge SHA is no longer
+an ancestor of `origin/main`. Wait until the work is reachable on the delivery ref, or
+type `plan.policy.deliveryBranch` to the branch you actually ship from
+(`task policy:show --field=deliveryBranch`). This document does not prescribe a squash-sync
+repair.
 
 Handoff states that Git can assert are distinct: `implemented` → `pr_open` →
 `merged_to_integration` → `delivered`. **Deployed** and **UAT verified** are separate evidence

package/docs/project-invariants.md

@@ -0,0 +1,79 @@
+# Project invariants (`plan.policy.projectInvariants`)
+
+Refs: #3425 · Related: #3238 `coverage_map`, #3241 parent lineage, #516 / #3145 `file_scope`
+
+Authored must-not-break contracts for a shared product. Every running story must
+declare how it treats the invariants that apply to its `file_scope`. Empty or
+absent list is a no-op.
+
+## Authored list
+
+SoT is PROJECT-DEFINITION `plan.policy.projectInvariants`. Inspect with
+`task policy:show --field=projectInvariants`.
+
+Each entry:
+
+- `id` — stable key reused on the scope `coverage_map`
+- `statement` — the contract in operator language
+- contract surface — `paths` and/or `moduleIds` (module ids resolve through
+  `plan.architecture.codeStructure.modules[].pathGlobs`)
+
+## Scope coverage
+
+Reuse the #3238 `coverage_map` shape against **applicable** project IDs:
+
+| Disposition | Required side field |
+| --- | --- |
+| `covered` | none |
+| `deferred` | `provenance.reason` + target |
+| `behavioral_delta` | `delta_id` linked in `behavioral_deltas` |
+| `not_applicable` | `reason` |
+
+`split` is excluded at project level.
+
+Applicability is contract surface × the story's `file_scope`. Empty intersection
+means no disposition is required for that ID.
+
+## Gate
+
+`task xbrief:preflight` and `task verify:story-ready` fail closed when an
+applicable ID has no disposition. The message names the omitted ID. Slice-scoped
+and worktree-scoped stories use the same check.
+
+The check evaluates the list **as of preflight time**. An ID added after a story
+was authored fails that story on its next preflight and names the new ID.
+
+## Honesty limit
+
+The gate verifies **completeness of declarations**, not truth. A scope cannot
+break an *undeclared* applicable contract without failing preflight. A declared
+`covered` is not executed or scored. Truth-checking is review-cycle / follow-up.
+
+This slice does **not** load the list at session-start or in the preamble.
+
+## Authored examples (not framework oracles)
+
+Operators author product entries. Directive never runs Visage or scores
+"module purpose." Two shapes that belong in a consumer PROJECT-DEFINITION, not
+in Directive itself:
+
+```json
+{
+  "plan": {
+    "policy": {
+      "projectInvariants": [
+        {
+          "id": "visage-load-save",
+          "statement": "Launch-prep must not change a project folder so Visage can no longer load it.",
+          "paths": ["src/launch-prep/**"]
+        },
+        {
+          "id": "sibling-purpose",
+          "statement": "Existing modules stay independently useful. Integration with a new module is optional; independence is required.",
+          "moduleIds": ["project-io", "canvas"]
+        }
+      ]
+    }
+  }
+}
+```

package/docs/scope-provenance.md

@@ -58,32 +58,77 @@ Authority comes from the approval record in the **merge base**, not from whether
 
 ## Operator command: `scope:record-approved-scope`
 
-Deposit a human-origin digest (first adoption or renewal):
+Deposit a human-origin digest (first adoption or renewal). Mint on a real TTY, then commit the approval artifacts to the merge base (or a prior PR) before implement.
 
 ```bash
-task scope:record-approved-scope -- xbrief/pending/story.xbrief.json --actor scott
+task scope:record-approved-scope -- xbrief/pending/story.xbrief.json --actor scott --confirm
 # or after expansion review:
-task scope:record-approved-scope -- xbrief/active/story.xbrief.json --actor scott --kind renewed-approval
+task scope:record-approved-scope -- xbrief/active/story.xbrief.json --actor scott --kind renewed-approval --confirm
 ```
 
+`--actor` is **display only**. It never authorizes mint. `--actor Flynn` from an agent or CI shell cannot mint.
+
+Mint uses the shared #3110 human-presence gate (same module as `authz`):
+
+- Interactive TTY (stdin + stdout) and a controlling terminal (`/dev/tty` or `CONIN$`)
+- Explicit `--confirm`
+- Typed phrase `mint` on the controlling TTY
+- Agent/CI env markers (`AUTHZ_AGENT_SHELL_ENV_MARKERS`) refuse fail-closed
+- An active UAT lease refuses mint with no TTY / `--confirm` / phrase escape
+
+No authz grant is written. `verify:scope-provenance` does not read `.deft/authz/grants`.
+
 Flags:
 
 | Flag | Required | Notes |
 | --- | --- | --- |
 | `<xbrief-path>` | yes | pending or active xBRIEF JSON |
-| `--actor` | yes | human operator identity (agent actors refused) |
+| `--actor` | yes | display-only human identity (never authorization) |
+| `--confirm` | yes | required; flag alone never authorizes mint |
 | `--kind` | no | default `operator`; also `human`, `renewed-approval`, … |
 | `--project-root` | no | defaults via Taskfile to consumer CWD |
 | `--xbrief-rel-path` | no | override path binding; default maps `pending/` → `active/` |
+| `--repo` | no | `owner/name` seed for preimage `approvedRepos` (same source as `issue:emit`) |
+
+Commit **both** `.deft/approved-scope/<plan-id>.json` and `<plan-id>.intent.json` on the **merge base** (or a prior PR) before the implementation PR activates or expands the scoped xBRIEF. Read the preimage before you commit — that file is the approved intent.
+
+## Three layers (do not mix)
+
+| Layer | What it is | Who writes it |
+| --- | --- | --- |
+| **Product intent** | What the story asks for — titles, narratives, acceptance, architecture, items, edges, origin refs | Human in the xBRIEF |
+| **Approved derivation** | The extracted preimage + path digest frozen at mint | `scope:record-approved-scope` on a TTY |
+| **Implementation choice** | How the worker codes the story | The implementation PR; must not rewrite pinned intent |
+
+`verify:scope-provenance` compares live extraction to the **base-committed** preimage. It never treats working-tree copies, `xbriefBodyDigest`, or authz grants as authority.
+
+## Wave 2 intent pin (#3385)
+
+Mint writes one record and one preimage as a fail-closed pair under a per-plan lock. Both dests land as `.next` first, then dests copy from that pair. A crash mid-publish is recovered without a remint: finish the flip from `.next`, or restore the bak pair (or neither dest). Dead-owner lock files are reclaimed. A dest-write failure restores the previous pair or leaves neither dest. If restore also fails, leftover dests are cleared and the mint error names both failures. `intentDigest` is a checksum of `.deft/approved-scope/<plan-id>.intent.json` (`intent-extract-v1`).
+
+Extracted: `plan.title`, `plan.narratives.*`, `plan.acceptance`, `plan.architecture`, `plan.items[]` `{id,title,summary,narrative,type}`, `plan.id`, resolved parent id (`planRef` raw path is machine), origin `references[]` (no `TrustLevel`), `plan.edges`, swarm `file_scope` plus free-text swarm notes, and any unknown `plan.*` key (pinned wholesale). `plan.tags` is machine.
+
+Verify:
+
+1. `git show <base>:` for record **and** preimage
+2. Recompute preimage digest vs `intentDigest`
+3. Re-extract the live brief and compare
+4. Same-PR rewrite of record or preimage fails
+5. Duplicate object keys need a real tokenizer (not `JSON.parse`)
+6. `Decisions` and `references[]` are append-only; new github-issue URLs must be in the base `approvedRepos`
+
+First activation with nonempty `file_scope` needs that base-committed pin. Same-PR mint + activate fails.
+
+### Wave 1 records are legacy under Wave 2 (#3384 / #3385)
 
-Commit the written `.deft/approved-scope/<plan-id>.json` on the **merge base** (or a prior PR) before the implementation PR activates or expands the scoped xBRIEF.
+Wave 1 mints write the path record with a human-looking stamp. They do **not** write `xbriefBodyDigest` and they carry **no** `intentDigest`. Under Wave 2 those records are **legacy**: they authorize **paths only**. Intent edits warn this release, then fail; gated remint is the remediation. That is intended, not a bug. No silent backfill.
 
 ## First-adoption flow (single consumer upgrade)
 
 When the first non-empty `file_scope` story and the 0.97+/0.98 gate land together:
 
 1. Author the pending xBRIEF with the intended `file_scope`
-2. Run `task scope:record-approved-scope -- <pending-xbrief> --actor <you>`
+2. Run `task scope:record-approved-scope -- <pending-xbrief> --actor <you> --confirm`
 3. **Commit and merge** the approval record (and preferably the pending xBRIEF) first — multi-PR bootstrap
 4. In a follow-up PR, activate (`pending/` → `active/`) without rewriting the approval
 5. `task verify:scope-provenance -- --base-ref origin/master --enforce` exits 0
@@ -105,8 +150,8 @@ Emptying `file_scope` to soft-warn past the gate is **not** the supported migrat
 ## Remediation
 
 ```bash
-task scope:record-approved-scope -- <xbrief-path> --actor <you>
-git add .deft/approved-scope/<plan-id>.json
+task scope:record-approved-scope -- <xbrief-path> --actor <you> --confirm
+git add .deft/approved-scope/<plan-id>.json .deft/approved-scope/<plan-id>.intent.json
 # merge that commit before (or without) co-changing the active xBRIEF expansion
 ```
 

package/docs/writing-ste100.md

@@ -1,12 +1,14 @@
 # Controlled English for docs and issues
 
-Directive uses a short **controlled-English** bar for product docs, issues, PRs, and agent-facing prose.
+Directive's writing bar is **clarity, simplicity, and brevity**.
 
-**ASD-STE100** is Simplified Technical English (aerospace controlled language). Here it means a practical subset. It is not a certification program.
+Use that outcome bar for documents and user communications, including sub-agent status and handbacks.
+
+**ASD-STE100** is Simplified Technical English (aerospace controlled language). Here it means a practical subset. It is not a certification program. The four rules below are the how.
 
 Legend (RFC2119): `!`=MUST, `~`=SHOULD, `≉`=SHOULD NOT, `⊗`=MUST NOT, `?`=MAY.
 
-Tracker: [#2927](https://github.com/deftai/directive/issues/2927).
+Tracker: [#3368](https://github.com/deftai/directive/issues/3368). Mechanics from [#2927](https://github.com/deftai/directive/issues/2927).
 
 ---
 
@@ -17,18 +19,45 @@ Tracker: [#2927](https://github.com/deftai/directive/issues/2927).
 3. **One term = one meaning.** Keep product terms stable (`xbrief`, host, skill pack, swarm, deposit). Do not reuse one word for two concepts.
 4. **First-use definitions.** Define a tech term the first time it appears when the reader may not know it.
 
-! Apply these four rules to **new and touched** prose that maintainers or agents author for this repo.
+! Apply these four rules to documents and user communications, including sub-agent status and handbacks — not only new-and-touched files.
 
 ~ Prefer clarity over ceremony. When a product term already has a glossary or category note, reuse that meaning.
 
 ---
 
+## Ceremony vs required fields
+
+! Cut ceremony, not required protocol fields. Keep these complete:
+
+- `DONE` / `BLOCKED` / `FAILED` status lines
+- Allocation context
+- SHAs
+- Exit codes
+- Evidence cites
+
+⊗ Drop a required field to look brief.
+
+---
+
 ## Where it applies
 
 - Agent and maintainer communications about Directive
 - Product docs (including `content/docs/` and related guides)
 - GitHub issues, PRs, and review comments that maintainers or agents author here
 - Skill and strategy prose where clarity matters for agent load
+- Sub-agent status, handbacks, and sibling reports
+
+! The bar governs communication **about** the work, not the work itself.
+
+! Product content with its own specified voice (fiction, game dialogue, marketing, brand copy) follows the scope's style requirements. No toggle: this is a scoping sentence, not a config flag.
+
+---
+
+## Reasoning is out of scope
+
+! The bar does not govern reasoning itself. Thinking budgets are harness knobs (effort tier, per-role routing #1739), not prose rules.
+
+⊗ Extend the bar to thinking. Terse reasoning trades correctness for style.
 
 ---
 
@@ -37,6 +66,8 @@ Tracker: [#2927](https://github.com/deftai/directive/issues/2927).
 - ⊗ Full ASD-STE100 dictionary compliance or formal STE tooling certification
 - ⊗ A big-bang rewrite of the historical issue corpus
 - ⊗ A red CI style gate in v1 that blocks merges on style nitpicks
+- ⊗ A second `[AXIOM]` label
+- ⊗ Prefacing the rule ("per the writing bar…")
 
 Process expectation only: follow the bar by default. Do not invent a merge blocker from this page alone.
 
@@ -46,8 +77,11 @@ Process expectation only: follow the bar by default. Do not invent a merge block
 
 | Issue | Role |
 |-------|------|
+| [#3368](https://github.com/deftai/directive/issues/3368) | Always-on outcome bar (clarity, simplicity, brevity) |
+| [#2927](https://github.com/deftai/directive/issues/2927) | Four STE mechanics (closed) |
 | [#740](https://github.com/deftai/directive/issues/740) | Plain-English UX pass (closed; interview-focused) |
 | [#865](https://github.com/deftai/directive/issues/865) | Every rule is a token tax |
 | [#847](https://github.com/deftai/directive/issues/847) | Lean context first |
 | [#2484](https://github.com/deftai/directive/issues/2484) | Progressive disclosure for large skills |
 | [#2905](https://github.com/deftai/directive/issues/2905) | Category terms (host vs skill pack vs practice layer) |
+| [#1739](https://github.com/deftai/directive/issues/1739) | Per-role routing (thinking budgets; not this bar) |

package/main.md

@@ -200,10 +200,12 @@ Propagation: the canonical orchestrator preamble at [templates/agent-prompt-prea
 - ! Scope vBRIEFs live in lifecycle folders: `proposed/`, `pending/`, `active/`, `completed/`, `cancelled/`
 - ! Scope vBRIEF filenames MUST follow: `YYYY-MM-DD-descriptive-slug.vbrief.json` (slug rules: [`conventions/vbrief-filenames.md`](./content/conventions/vbrief-filenames.md))
 - ! Playbooks use `playbook-{name}.vbrief.json` (named, not ULID-suffixed)
+- ! Completed xBRIEFs are evidence of what was built — full standing as a record of *what is*, zero authority over *what to build next* (#3383). The current contract is the active xBRIEF plus the human operator's live instruction. Both halves are required.
 - ⊗ Use ULID-suffixed filenames for plan, todo, or continue files
 - ⊗ Place vBRIEF files at workspace root
 - ⊗ Write `SPECIFICATION.md` directly — it MUST be generated from `specification.vbrief.json`
 - ⊗ Move scope vBRIEFs between lifecycle folders without updating `plan.status`
+- ⊗ Treat a completed xBRIEF as the next-build contract, or let it override the active story or the live human instruction
 
 ### Schema version: v0.6 (canonical)
 

package/meta/ralph.md

@@ -115,7 +115,7 @@ For each code generation, check:
 - [ ] **Documentation complete**
 - [ ] **No obvious security issues**
 - [ ] **Dependencies justified**
-- [ ] **Files <500 lines** (must be <1000)
+- [ ] **Files stay small** (review trigger, not a hard cap; see file-size-thresholds policy module / #1488 / #3424)
 
 ## 🛠️ Implementation in Warp (TBD)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive-content",
-  "version": "0.103.0",
+  "version": "0.105.0",
   "deftConsumerDeposit": true,
   "description": "Shippable Directive framework content in the consumer .deft/core/ layout (C1 flatten), plus the engine surfaces (.githooks/, Taskfile.yml, tasks/) the deposit wires. Python-free per #2022 Phase 3. Refs #11, #1669, #1967.",
   "license": "MIT",