@deftai/directive-content 0.106.0 → 0.107.0

package/skills/deft-directive-design-critique/SKILL.md

@@ -1,10 +1,10 @@
 ---
 name: deft-directive-design-critique
 description: >-
-  Thin router for the design-critique motion: triggers and five pointer stops
-  into the contract. Use when the operator asks for a design critique,
-  design-critique, critique panel, or mechanism-shaped triage. Do NOT trigger
-  on ordinary implement, build, or swarm work.
+  Thin router for the design-critique motion: triggers and pointer stops into
+  the contract, including the operator-gated loop. Use when the operator asks
+  for a design critique, design-critique, critique panel, or mechanism-shaped
+  triage. Do NOT trigger on ordinary implement, build, or swarm work.
 triggers:
   - design critique
   - design-critique
@@ -30,7 +30,7 @@ Legend (from RFC2119): !=MUST, ~=SHOULD, ≉=SHOULD NOT, ⊗=MUST NOT, ?=MAY.
 
 ## Stops
 
-Normative rules live in [`contracts/design-critique.md`](../../contracts/design-critique.md). Fill [`templates/design-critique-brief.md`](../../templates/design-critique-brief.md) and dispatch from there. Phase 1 gate: [`docs/decisions/ADR-005-design-critique-judgment-gate.md`](../../../docs/decisions/ADR-005-design-critique-judgment-gate.md).
+Normative rules live in [`contracts/design-critique.md`](../../contracts/design-critique.md). Fill [`templates/design-critique-brief.md`](../../templates/design-critique-brief.md) and dispatch from there. Phase 1 gate: [`docs/decisions/ADR-005-design-critique-judgment-gate.md`](../../../docs/decisions/ADR-005-design-critique-judgment-gate.md). Parent-audit principle: [`docs/decisions/ADR-006-parent-side-substantiation.md`](../../../docs/decisions/ADR-006-parent-side-substantiation.md).
 
 1. Stop 1 — Gate
 2. Stop 2 — Variant selection
@@ -38,6 +38,15 @@ Normative rules live in [`contracts/design-critique.md`](../../contracts/design-
 4. Stop 4 — Residual reiteration
 5. Stop 5 — Verified synthesis
 
+Comment lead (model then role): Stop 3 — Critic envelope.
+Operator-gated loop. Successor lean. Parent-side substantiation. Operator verbs. Dual stop. Halt line. Bind after accepted synthesis.
+After critic post: posted successor lean, then verbs.
+Auto-stamp after operator confirm; not while same-round siblings outstanding.
+Walk / walk all. Auto-stamp when agents agree: Operator verbs.
+Parent chip write: scm:issue:design-critique-chip.
+
+Each critic dispatch EXITs after posting.
+
 ⊗ Auto-dispatch critics from this skill.
 ⊗ Copy the variant table, synthesis rules, or other contract bodies into this skill.
 

package/skills/deft-directive-feedback/SKILL.md

@@ -37,12 +37,19 @@ Legend (from RFC2119): !=MUST, ~=SHOULD, ≉=SHOULD NOT, ⊗=MUST NOT, ?=MAY.
 - ! Batch multiple friction items into one upstream issue when they share a root cause; otherwise prepare separate drafts
 - ~ Prefer attributed phrasing ("encoding gate blocked a valid file") over vague quality claims
 
+## Phase 1.5 -- Adoption-blocker judgment
+
+- ! Ask whether the gap blocks adoption. A gap blocks adoption when the consumer cannot complete an intended Directive flow and has no reasonable workaround.
+- ! When the answer is yes, collect the body evidence a privileged actor needs before applying `adoption-blocker`: affected consumer flow and version; documented alternatives attempted, or why they are not a reasonable workaround; observed recovery cost. Pass `--blocker` (and `--flow`, `--alternatives`, `--recovery-cost` when known) so the title carries `BLOCKER` and the body carries those sections.
+- ! When the answer is no or unknown, omit `--blocker`. Absence of the token does not mean "not a blocker" -- it means not classified.
+- ⊗ Apply or request the `adoption-blocker` ranking label from a consumer-authored title. The label is a privileged write after the body-evidence test.
+
 ## Phase 2 -- Draft + dedup
 
 - ! For each candidate report, run a dry draft:
 
 ```bash
-task feedback:file -- --summary "<one-line summary>" --context "<session context>" --expected "<expected>" --actual "<actual>" --notes "<optional>"
+task feedback:file -- --summary "<one-line summary>" --context "<session context>" --expected "<expected>" --actual "<actual>" --notes "<optional>" [--blocker --flow "<flow and version>" --alternatives "<alts>" --recovery-cost "<cost>"]
 ```
 
 - ! Read the printed draft title/body with the operator before proceeding
@@ -55,7 +62,7 @@ task feedback:file -- --summary "<one-line summary>" --context "<session context
 - ! Only after approval, re-run with `--confirm`:
 
 ```bash
-task feedback:file -- --summary "<one-line summary>" --context "<session context>" --expected "<expected>" --actual "<actual>" --confirm
+task feedback:file -- --summary "<one-line summary>" --context "<session context>" --expected "<expected>" --actual "<actual>" --confirm [--blocker]
 ```
 
 - ! Print the filed issue URL to the operator
@@ -71,3 +78,5 @@ task feedback:file -- --summary "<one-line summary>" --context "<session context
 - ⊗ Filing from the maintainer framework repo (consumer-only guard)
 - ⊗ Skipping dedup review when the command reports an existing open issue
 - ⊗ Treating `--confirm` as implicit from broad session approval -- require an explicit filing confirmation step
+- ⊗ Infer "not a blocker" from an unmarked report -- absence of `BLOCKER` means not classified
+- ⊗ Auto-apply `adoption-blocker` from a consumer-authored title

package/skills/deft-directive-issue-eval/SKILL.md

@@ -0,0 +1,48 @@
+---
+name: deft-directive-issue-eval
+description: >-
+  Thin router for Stage A issue evaluation: isolated origin/master validity,
+  parent WIP census, named gitignored sink. Use when the operator asks to
+  evaluate issues, run issue-eval, or triage:evaluate. Do NOT trigger on
+  ordinary implement, build, swarm, or design-critique dispatch.
+triggers:
+  - issue-eval
+  - issue eval
+  - triage:evaluate
+  - evaluate issues
+---
+<!-- AUTO-GENERATED by task packs:render -- DO NOT EDIT MANUALLY -->
+<!-- Purpose: rendered skill -->
+<!-- Source of truth: packs/skills/skills-pack-0.1.json -->
+<!-- Regenerate with: task packs:render -->
+<!-- Edit the source, not this file. Slice instead of loading every SKILL.md: task packs:slice skills by-trigger --trigger <kw> (or list) -->
+
+# Issue Eval
+
+Thin router into the issue-eval contract. Operator runs `task triage:evaluate`.
+
+Legend (from RFC2119): !=MUST, ~=SHOULD, ≉=SHOULD NOT, ⊗=MUST NOT, ?=MAY.
+
+## When to Use
+
+- Operator asks to evaluate issues, run issue-eval, or `triage:evaluate`
+- ⊗ Ordinary implement, build, swarm, or design-critique dispatch
+
+## Stops
+
+Normative rules live in [`contracts/issue-eval.md`](../../contracts/issue-eval.md).
+
+1. Split read sources
+2. Verdict sink
+3. Evaluator worktrees
+4. Value advice grammar
+5. No GitHub writes
+6. Fan-out
+
+⊗ Emit `design-critique: warranted | not warranted, because` from evaluation.
+⊗ Reuse `swarm:launch` until #3649.
+⊗ Write `xbrief/proposed/` or GitHub from this skill.
+
+## EXIT
+
+deft-directive-issue-eval complete -- exiting skill. Next: run `task triage:evaluate`, then decide with existing `triage:*` verbs.

package/skills/deft-directive-triage/SKILL.md

@@ -37,7 +37,7 @@ Legend (from RFC2119): !=MUST, ~=SHOULD, ≉=SHOULD NOT, ⊗=MUST NOT, ?=MAY.
 
 ## Deterministic Questions Contract
 
-! Every numbered-menu prompt rendered in this skill (Phase 2 candidate selection, Phase 3 per-item decision walk) ! MUST follow [`../../contracts/deterministic-questions.md`](../../contracts/deterministic-questions.md): render the canonical numbered menu in chat unless the host UI visibly preserves numeric option labels and returns numeric selections or exact displayed option text. The final two numbered options are `Discuss` and `Back`, in that order, and the Discuss-pause semantic from the contract applies verbatim -- on `Discuss` the agent halts the in-progress sequence and resumes only on an explicit user signal.
+! Every numbered-menu prompt rendered in this skill (Phase 2 candidate selection, Phase 3 per-item decision walk, post-Accept offer) ! MUST follow [`../../contracts/deterministic-questions.md`](../../contracts/deterministic-questions.md): render the canonical numbered menu in chat unless the host UI visibly preserves numeric option labels and returns numeric selections or exact displayed option text. The final two numbered options are `Discuss` and `Back`, in that order, and the Discuss-pause semantic from the contract applies verbatim -- on `Discuss` the agent halts the in-progress sequence and resumes only on an explicit user signal.
 
 ## Work selection fork (#2542 / #2402)
 
@@ -101,6 +101,7 @@ What would you like to do with this candidate?
 - ~ Bulk: `task triage:bulk-{accept,reject,defer,needs-ac}`; results still flow through the audit log.
 - ⊗ Write to `xbrief/proposed/` directly -- only `task triage:accept` is authorised.
 - ~ **Accept → pending chain (#1136):** `task triage:accept` ingests into **`proposed/`**. To stage into WIP (`pending/`) in one operator action: `task triage:accept -- --issue <N> --repo OWNER/NAME --auto-promote` (WIP cap still enforced; use `--force` on the accept command for WIP override). Separately, promote an already-accepted proposed scope by issue: `task scope:promote -- --from-issue=<N> [--repo OWNER/NAME]` (gates on latest `candidates.jsonl` decision = `accept`; non-accept refuses unless `--force-no-cache`; no decision soft-warns, `--strict` fails). Path-based `task scope:promote -- <file>` remains ungated for refinement scaffolds.
+- ? **After Accept (#3708):** offer `deft-directive-design-critique`. Optional; same after `--auto-promote` (promote already happened). Decline writes nothing. Menu: 1. Run critique (existing ADR-005 path) 2. Skip 3. Discuss 4. Back. Back = Skip (do not re-open Accept; undo is `task triage:reset`).
 
 ## Phase 4 -- Audit
 
@@ -141,5 +142,5 @@ Live walkers (`triage:queue`, scope-drift, bootstrap) scan `.deft-cache/github-i
 
 ## References
 
-- #1119 D6; #1128 D11 (`triage:queue` / `show` / `audit`); #2890 Phase 3 operator brief; #3116 validity + URL-first; #1122 / #1123 / #1127 / #1129 / #1131; #1136 (`scope:promote --from-issue` / `triage:accept --auto-promote`)
+- #1119 D6; #1128 D11 (`triage:queue` / `show` / `audit`); #2890 Phase 3 operator brief; #3116 validity + URL-first; #1122 / #1123 / #1127 / #1129 / #1131; #1136 (`scope:promote --from-issue` / `triage:accept --auto-promote`); #3708 (post-Accept design-critique offer)
 - Siblings: `deft-directive-refinement`, `deft-directive-swarm`, `deft-directive-sync`

package/tasks/engine.yml

@@ -102,6 +102,8 @@ tasks:
             " session:start "|" session-start "|\
             " session:ready "|" session-ready "|\
             " occupancy:steal "|" occupancy-steal "|\
+            " occupancy:release "|" occupancy-release "|\
+            " session:end "|" session-end "|\
             " lifecycle:event "|" lifecycle-event "|\
             " verify:session-ritual "|" verify-session-ritual "|\
             " verify:tools "|" verify-tools "|\

package/tasks/feedback.yml

@@ -5,7 +5,7 @@ vars:
 
 tasks:
   file:
-    desc: "Draft or file a deduped framework-gap issue upstream (#1709). -- task feedback:file -- [--summary TEXT | positional] [--context ...] [--confirm] [--dry-run] [--json]"
+    desc: "Draft or file a deduped framework-gap issue upstream (#1709 / #3713). -- task feedback:file -- [--summary TEXT | positional] [--context ...] [--blocker] [--confirm] [--dry-run] [--json]"
     deps:
       - task: :engine:_ts-build
     cmds:

package/tasks/occupancy.yml

@@ -15,3 +15,14 @@ tasks:
       - task: :engine:invoke
         vars:
           ENGINE_CMD: 'occupancy:steal --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}'
+
+  release:
+    desc: "Release this worktree occupancy lease (#3604). Owner live or expired residue. Non-owner live denied."
+    dir: '{{.USER_WORKING_DIR}}'
+    # Runtime/session dispatch: no engine:_ts-build / pnpm build (#2181).
+    env:
+      PYTHONUTF8: "1"
+    cmds:
+      - task: :engine:invoke
+        vars:
+          ENGINE_CMD: 'occupancy:release --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}'

package/tasks/scm.yml

@@ -13,6 +13,7 @@ version: '3'
 #   - scm:issue:view    (thin wrapper over `ghx|gh issue view`)
 #   - scm:issue:close   (thin wrapper over `ghx|gh issue close`)
 #   - scm:issue:edit    (thin wrapper over `ghx|gh issue edit`)
+#   - scm:issue:design-critique-chip (#3642 closed catalog remaining-set)
 #   - scm:body:*        (#1555 safe Markdown body posting via github-body TS CLI)
 #
 # Each command is a thin pass-through to `ghx <verb>` (when ghx is on PATH)
@@ -34,8 +35,9 @@ version: '3'
 # stub deliberately does not re-implement; #881 owns the full surface.
 #
 # Forward-compat marker: v1 was issue:* plus #1555 body-posting. #3391
-# adds scm:sync-default (dest-targeted staged sync PRs). Other PR verbs
-# remain #881.
+# adds scm:sync-default (dest-targeted staged sync PRs). #3642 adds
+# scm:issue:design-critique-chip (closed catalog remaining-set). Other PR
+# verbs remain #881.
 # ---------------------------------------------------------------------------
 
 vars:
@@ -89,6 +91,16 @@ tasks:
         vars:
           ENGINE_CMD: 'scm issue edit {{.CLI_ARGS}}'
 
+  issue:design-critique-chip:
+    desc: "[#3642] Exclusive design-critique catalog chip -- task scm:issue:design-critique-chip -- --issue N --chip triage-ready|mechanism-shaped [--repo OWNER/NAME]"
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - task: :engine:_ts-build
+    cmds:
+      - task: :engine:invoke
+        vars:
+          ENGINE_CMD: 'scm issue design-critique-chip {{.CLI_ARGS}}'
+
   body:issue:create:
     desc: "[#1555] Safely create an issue body from --body-file without shell Markdown interpolation"
     dir: '{{.USER_WORKING_DIR}}'

package/tasks/session.yml

@@ -30,3 +30,14 @@ tasks:
       - task: :engine:invoke
         vars:
           ENGINE_CMD: 'session:ready --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}'
+
+  end:
+    desc: "End this mutation session by releasing occupancy (#3604). Same as occupancy:release."
+    dir: '{{.USER_WORKING_DIR}}'
+    # Runtime/session dispatch: no engine:_ts-build / pnpm build (#2181).
+    env:
+      PYTHONUTF8: "1"
+    cmds:
+      - task: :engine:invoke
+        vars:
+          ENGINE_CMD: 'session:end --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}'

package/tasks/triage-evaluate.yml

@@ -0,0 +1,22 @@
+version: '3'
+
+# tasks/triage-evaluate.yml -- Stage A isolated issue-eval (#3648).
+#
+# Wired into Taskfile.yml under include key `triage-evaluate`. Inner task
+# `evaluate` is exposed as `task triage:evaluate`.
+#
+# Per conventions/task-caching.md: NO sources/generates -- user-facing flags.
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+tasks:
+  evaluate:
+    desc: "Evaluate issues off origin/master (validity + parent WIP + value). -- task triage:evaluate -- <N...> [--concurrency N] [--repo OWNER/NAME] [--json]"
+    internal: true
+    deps: [":engine:_ts-build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - task: :engine:invoke
+        vars:
+          ENGINE_CMD: 'triage-evaluate --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}'

package/tasks/verify.yml

@@ -512,6 +512,16 @@ tasks:
         vars:
           ENGINE_CMD: 'verify:orphan-active --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}'
 
+  completed-write-guard:
+    desc: "Fail-closed completed/ write guard (#3679). Newly added xbrief/completed/ (or vbrief/completed/) artifacts must have been written by scope:complete / scope:fail. Historical corpus is advisory via doctor. Remediation names the leftover land PR (#3476). Three-state exit (0 clean / 1 unguarded add / 2 config). Does not change verify:completed-tracked."
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - task: :engine:_ts-build
+    cmds:
+      - task: :engine:invoke
+        vars:
+          ENGINE_CMD: 'verify:completed-write-guard --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}'
+
   completed-tracked:
     desc: "Fail-closed completed-tracked land guard (#3264 / #1358 / #3476). Closed scoped GitHub issues with a known lifecycle xBRIEF origin must have a tracked xbrief/completed/ or xbrief/cancelled/ artifact on the delivery tip. --issue N is the drive-to DONE form. Remediation: task swarm:finalize-cohort or a lifecycle PR. Three-state exit (0 clean / 1 missing land / 2 config). Pass --skip-gh to rely on triage cache only; --tip to override delivery tip."
     dir: '{{.USER_WORKING_DIR}}'

package/templates/agent-prompt-preamble.md

@@ -130,6 +130,7 @@ When present, document the fields in a separate `## Runtime and GitHub auth mode
 
 - `runtime_mode`: one of `local-unsandboxed`, `cursor-native-sandbox`, or `cloud-headless` -- the execution envelope the worker runs in (from the read-only runtime probe, #1557a).
 - `github_auth_mode`: one of `host-gh` or `injected-token` -- which GitHub credential rule applies to this worker (#1557b).
+- `expected_github_login`: the bound user login when the dispatcher injected a user-bearing credential (#1351 / #3665). Login only -- never a token value. Omit when `github_auth_mode` is `host-gh` and no injection occurred.
 
 Launch-manifest entries (#1387 C2 contract) carry the same two fields at the top level alongside `allocation_context`. Workers MUST read the dispatch envelope (or launch manifest) and apply the identity-separation rules in §8 according to `github_auth_mode`, not the historical one-size-fits-all injected-token default.
 
@@ -149,10 +150,24 @@ Worked example (cloud / headless worker):
 
 - runtime_mode: cloud-headless
 - github_auth_mode: injected-token
+- expected_github_login: deft-swarm-bot
 ```
 
 Reference: `packages/core/src/platform/platform-capabilities.ts` (#1557a), `packages/core/src/intake/github-auth-modes.ts` (#1557b), issue #1557.
 
+## 2.75 Identity-bound worker credential injection (#1351)
+
+When a dispatcher holds a user-bearing worker credential, it MUST inject that credential at spawn on the grok-build and local hybrid paths. Injection binds an identity; it does not only place a token. This helper is the operator-implemented injection the §8 conjunction names -- a dispatcher-invoked function, not a prompt-embedded token.
+
+- ! Before spawn, call `prepareWorkerCredentialInjection` (`packages/core/src/swarm/launch.ts`). It validates the held credential as a **user** principal with the existing `validateGithubAuthForWorker`. Do not write a second validator and do not invent a second approval surface.
+- ! On success, apply the returned `spawnEnv` to the worker **process environment** (`GH_TOKEN` plus `DEFT_EXPECTED_GITHUB_LOGIN`) and copy `envelopeSection` into the dispatch envelope. Stamp `expected_github_login` on the launch-manifest entry when launch already validated the same credential.
+- ! On no available credential and a write-requiring injected-token operation, halt `BLOCKED`, naming the missing credential (`GH_TOKEN` / `GITHUB_TOKEN` / `GH_ENTERPRISE_TOKEN`) and the dispatcher-side remedy. Do not spawn.
+- ⊗ Inject an App-installation credential. Those fail closed as `installation_identity_unverifiable` (#3693).
+- ⊗ Continue under a detected host or maintainer identity, or fall back to the host `gh` token (`patterns/multi-agent.md` :70-75).
+- ⊗ Place a credential value in the dispatch prompt, a transcript, or a launch-manifest entry. `spawnEnv` is process-env only.
+
+Token minting remains an operator-owned #983 non-goal. This helper delivers a credential the dispatcher already holds; it does not mint one.
+
 ## 3. PowerShell 5.1 non-ASCII rule (#798)
 
 If your shell is `pwsh 5.x` on Windows AND you are editing a file containing any non-ASCII glyph (em dashes, en dashes, arrows, smart quotes, ⊗, ✓, ellipses, emoji, ...), you MUST route the read AND write through Python `pathlib`:
@@ -436,7 +451,7 @@ Why: maintainer and workers sharing a single PAT couples the human review/merge
 ### injected-token mode (required for `github_auth_mode: injected-token` and always for `runtime_mode: cloud-headless`)
 
 - ! Consume the GitHub credential injected by the dispatcher (typically `GH_TOKEN` / `GITHUB_TOKEN` / `GH_ENTERPRISE_TOKEN` in the prompt-supplied env). If unset and no other dispatcher-supplied credential is present, FAIL LOUD -- do not silently run under the host's `gh auth status` token.
-- ~ Confirm the credential's identity matches expectation: `gh api user --jq .login` should return the bot/App login, not the maintainer login. Mismatch is `BLOCKED: identity mismatch` to the parent.
+- ~ Confirm the credential is the expected worker principal before GitHub operations. For a user-bearing credential, `gh api user --jq .login` should return the expected bot/account login, not the maintainer login. For a GitHub App installation credential, `/user` is inapplicable (structural 403; no authenticated user) -- do not treat that 403 as API unreachability. Installation identity cannot be verified from the token; fail closed and point at #3693. Do not accept the credential from endpoint reachability or a declared App slug. A user-login mismatch is `BLOCKED: identity mismatch` to the parent.
 - ⊗ Inherit the maintainer's `gh auth status` token implicitly. Host `gh` fallback is forbidden in injected-token and cloud-headless modes.
 
 ### host-gh mode (permitted only when `github_auth_mode: host-gh`)
@@ -444,12 +459,14 @@ Why: maintainer and workers sharing a single PAT couples the human review/merge
 Applies to local interactive workers (`runtime_mode: local-unsandboxed` or, after validation, `cursor-native-sandbox`) where swarm launch preflight confirmed `gh auth status` and repo access from the worker environment.
 
 - ! Use the worker environment's `gh` credential store -- the dispatch envelope explicitly authorises host `gh` for this worker. Do NOT require an injected `GH_TOKEN` when host gh auth is already valid in the worker shell.
-- ! Still verify identity before GitHub operations: `gh auth status` must pass and `gh api user --jq .login` must return the expected account.
+- ! Still verify identity before GitHub operations: `gh auth status` must pass. For a user-bearing credential, `gh api user --jq .login` must return the expected account. For a GitHub App installation credential, `/user` cannot return an account and the token cannot disclose which App it belongs to -- fail closed and point at #3693. Do not accept the credential from a declared App slug or from endpoint reachability, including a target-repo GET. User-login mismatch is `BLOCKED: identity mismatch`.
 - ⊗ Fall back to host `gh` when `github_auth_mode` is `injected-token` or `runtime_mode` is `cloud-headless` -- those modes forbid host credential store use regardless of what is available on the host.
 - ~ When `runtime_mode: cursor-native-sandbox`, host `gh` may fail inside the sandbox even when the parent session is authenticated. Fail loud with remediation (full-access execution, trusted-path allowlist, or switch to injected-token handoff) rather than assuming parent auth is visible to the worker.
 
 Dispatchers MUST inject worker credentials for injected-token / cloud-headless dispatches and MUST record the selected `github_auth_mode` in the launch manifest and dispatch envelope. v1 deliberately keeps token injection operator-implemented; mode labels make the contract explicit without placing token values in prompts or transcripts.
 
+#1351 supplies the identity-bound delivery helper in §2.75. Dispatchers on grok-build and local hybrid still record the mode on **both** the launch manifest and the dispatch envelope. They apply `prepareWorkerCredentialInjection` at spawn so the worker receives the token in process env and a stamped `DEFT_EXPECTED_GITHUB_LOGIN` / `expected_github_login`, not a prompt-embedded secret.
+
 This rule is complementary to §5 (REST-by-default) and §7 (rate-limit-aware throttle): REST-by-default reduces GraphQL demand on whichever bucket the worker is using; rate-limit throttle keeps the worker from exhausting its own bucket; mode-aware identity separation prevents the worker bucket from being the maintainer's bucket when injected-token mode applies. All three are required for stable swarm operation.
 
 ## 9. Sub-agent spawn rules per #727

package/templates/agents-entry.md

@@ -3,7 +3,7 @@
 
 Deft is installed in .deft/core/. Full guidelines: .deft/core/main.md
 
-! If any .deft/core/.agents/skills/ path referenced in this file cannot be read (missing file, stale path from a previous framework version, or a deprecation redirect stub), read .deft/core/QUICK-START.md instead and follow it. QUICK-START refreshes this section idempotently for the current framework version.
+! If any .deft/core/.agents/skills/ path here cannot be read (missing, stale, or a redirect stub), read .deft/core/QUICK-START.md and follow it — it refreshes this section idempotently for the current version.
 
 ## Temporary test kill-switch (#3039)
 
@@ -12,7 +12,7 @@ Deft is installed in .deft/core/. Full guidelines: .deft/core/main.md
 
 ## Session routing (#2176)
 
-! **Read-only default** until mutation intent: load AGENTS.md / main.md / USER.md / `xbrief/PROJECT-DEFINITION.xbrief.json`; resolve USER.md via `deft session:start` (`USER.md resolved …`; win32 `%APPDATA%\deft\USER.md`; unix `~/.config/deft/USER.md`; ⊗ invent `~/.config/deft` on Windows #2544); confirm Deft alignment + addressing-name; ⊗ no mutable `deft session:start` / triage welcome / sync / branch-policy unless asked or implementation-ready (#2176) — `.deft/core/commands.md` § Session routing. Bootstrap: cold-start → README § Cold-start (#2273) ⊗ never `.deft/core/`; pre-cutover → setup Pre-Cutover (#2068); missing USER.md / PROJECT-DEFINITION → setup Phase 1/2 (#1813) ⊗ before answering; else main → USER → PROJECT-DEFINITION; ~ sync. Mutation → `deft session:start` then `deft verify:session-ritual -- --tier=gated` (#1149). Mutation ceremony claims a worktree occupancy lease (#3433; `commands.md` § Session routing). ? `deft session:start -- --read-only` (#2176).
+! **Read-only default** until mutation intent: load AGENTS.md / main.md / USER.md / `xbrief/PROJECT-DEFINITION.xbrief.json`; resolve USER.md via `deft session:start` (`USER.md resolved …`; win32 `%APPDATA%\deft\USER.md`; unix `~/.config/deft/USER.md`; ⊗ invent `~/.config/deft` on Windows #2544); confirm Deft alignment + addressing-name; ⊗ no mutable `deft session:start` / triage welcome / sync / branch-policy unless asked or implementation-ready (#2176) — `.deft/core/commands.md` § Session routing. Bootstrap: cold-start → README § Cold-start (#2273) ⊗ never `.deft/core/`; pre-cutover → setup Pre-Cutover (#2068); missing USER.md / PROJECT-DEFINITION → setup Phase 1/2 (#1813) ⊗ before answering; else main → USER → PROJECT-DEFINITION; ~ sync. Mutation → `deft session:start` then `deft verify:session-ritual -- --tier=gated` (#1149). Mutation occupancy lease (#3433/#3604): occupant `occupancy:release`/`session:end` (`commands.md`). ? `deft session:start -- --read-only` (#2176).
 
 ## Session-start ritual (#1149)
 
@@ -88,10 +88,9 @@ Legacy `vbrief/` read-accepted; `deft migrate:xbrief` for `xbrief/` (v0.6→v0.8
 ## Envelope selection SLA (#3153)
 
 ! Default story / through-merge unit of work is `drive-to: merge-ready`. Deliberate `stop-at: pr-open` is allowed only when a **partner merge-path owner** is planned (review-cycle babysit / Approach 1 lease / parent-retained) for Greptile + CI + post-merge `scope:complete` — triggers: capacity stall, wall-clock budget, large multi-gate, host nest limits (swarm Phase 0 decision tree). Depth: `deft-directive-swarm` + `deft-directive-review-cycle` partner merge-path.
-! Under human-merge policy, a **durable** owner (parent/monitor sticky lease or Phase 6 closer) MUST remain for post-merge `scope:complete` — CLEAN alone is not lifecycle complete.
+! Under human-merge policy, a **durable** owner (parent/monitor sticky lease or Phase 6 closer) MUST remain for post-merge `scope:complete` — CLEAN alone is not lifecycle complete; ⊗ stand down at CLEAN with no reachable owner.
 ⊗ Silent PR-open handback for a worker already scoped `drive-to: merge-ready`.
 ⊗ `stop-at: pr-open` without a named babysit / merge-path owner, or dual review-monitor leases on recovery (#3044 / #2261).
-⊗ Stand down at CLEAN under human-merge with no reachable post-merge `scope:complete` owner.
 ! After merge of issue `#N`, `deft verify:orphan-active -- --issue N` MUST exit 0 before `DONE` (#3429). After `scope:complete`, `deft verify:completed-tracked -- --issue N` MUST exit 0 on `origin/<deliveryBranch>` before `DONE` (#3476). Exit 1 shipped → printed `scope:complete`; missing tracked land → `swarm:finalize-cohort` or a lifecycle PR; unresolved lookup → retry / `BLOCKED` (⊗ complete unfinished scope).
 ⊗ Emit `ISSUE: closed` while that brief is still in `active/`.
 
@@ -112,6 +111,7 @@ Legacy `vbrief/` read-accepted; `deft migrate:xbrief` for `xbrief/` (v0.6→v0.8
 ## Value feedback and attribution (#1709)
 
 ! `plan.policy.valueFeedback.enabled` defaults OFF — `deft policy:show --field=valueFeedback` / `deft policy:enable-value-feedback -- --confirm`; `deft value:show`; `deft feedback:file`; `.deft/core/.agents/skills/deft-directive-feedback/SKILL.md` (#1709).
+! Consumer hard-stop (#3713): `BLOCKER` is the sole permitted title classification — `deft feedback:file --blocker`; absence is not a verdict. ⊗ Derive `adoption-blocker` from a consumer title (privileged, body-evidence gated); `.deft/core/scm/github.md`.
 
 ## Structured decision log (#1396 / #3211)
 ! Significant choices → `deft decision:write`; re-load → `deft decision:list` / `xbrief/decisions/`; depth `.deft/core/docs/decision-log.md` (not triage/ADRs/lessons).
@@ -122,7 +122,7 @@ Legacy `vbrief/` read-accepted; `deft migrate:xbrief` for `xbrief/` (v0.6→v0.8
 ## Branch policy & branch verification
 
 ! Feature branches — `deft verify:branch`, `deft verify:forward-coverage` (90% warn-first changed-branch coverage, not the 75 floor, #3514), `deft coverage:hotspots`, hooks, `deft check` (#746 / #747) — `.deft/core/scm/github.md` § Branch policy.
-! Test placement + scope provenance (#3145) — `deft verify:test-boundary`, `deft verify:scope-provenance`, `deft verify:consumer-check-contract` (docs: `docs/test-boundary.md`, `docs/scope-provenance.md`, `docs/consumer-check-contract.md`); defaults warn-only until authored policy.
+! Test placement + scope provenance (#3145) — `deft verify:test-boundary` (warn-only until authored policy), `deft verify:scope-provenance` (`--enforce` is empty-scope only; declared `file_scope` without base approval fails closed), `deft verify:consumer-check-contract` (check composition fails closed; CI omissions warn) (docs: `docs/test-boundary.md`, `docs/scope-provenance.md`, `docs/consumer-check-contract.md`).
 
 ## Branch Policy Disclosure (#746)
 

package/templates/design-critique-brief.md

@@ -4,20 +4,24 @@ Dispatch envelope skeleton for one critic or synthesis pass. Fill the fields. Re
 
 ## Envelope fields
 
+- Model (copy onto the first line of the posted comment as `model: <slug>`):
+- Role (copy onto the second line of the posted comment as `role: triage|critic|parent`):
 - Issue:
-- Variant (refutation | open critique | panel) and one-line reason:
+- Charter (refutation | open critique), spend (N=1 | N≥3 when panel permission is used), and one-line reason:
 - Round (1 critic | 2 reiteration | 3 synthesis | 4 Pass-4 audit):
 - Critic role (fresh | resume):
 - Id ceiling (GitHub comment id, inclusive):
 - SHA at dispatch:
 - Target (work issue or umbrella):
+- Audit targets (marker ids, comma-separated, or `none`; ids only, no parent rationale):
 
 ## Forbidden inputs
 
 Do not put these in the envelope:
 
 - parent hypotheses
-- named refutation target (unless the recorded variant is refutation)
+- parent rationale on the audit-targets field (ids only)
+- named refutation target (unless the recorded charter is refutation)
 - parent-edited critic text
 - thread comments after the id ceiling
 - the superseded proposed skill outline on #3434
@@ -31,11 +35,21 @@ Read, do not restate:
 | Topic | Contract heading |
 |---|---|
 | Gate (ADR-005) | Stop 1 — Gate |
+| Stop 1 `refutation-target:` | Stop 1 — Gate |
 | Variant selection | Stop 2 — Variant selection |
-| Charter, envelope and ceiling | Stop 3 — Critic envelope |
+| Parent-facing dispatch rules | Parent-facing dispatch rules |
+| Critic method | Critic method |
+| Envelope and ceiling | Envelope and ceiling |
+| Comment lead (model then role) | Stop 3 — Critic envelope |
 | Fresh reiteration | Stop 4 — Residual reiteration |
+| Operator-gated loop | Operator-gated loop |
+| Successor lean | Successor lean |
+| Parent-side substantiation | Parent-side substantiation |
+| Operator verbs | Operator verbs |
+| Dual stop | Dual stop |
+| Halt line | Halt line |
 | Synthesis format | Stop 5 — Verified synthesis |
-| Dual stop | Failure and budget stop |
+| Bind after accepted synthesis | Bind after accepted synthesis |
 | Untrusted threads | Security context (#480) |
 
-Operator dispatches. Auto-dispatch is deferred. The five stops live in the contract.
+Operator dispatches. Auto-dispatch is deferred. Each critic dispatch EXITs after posting. The five stops and the operator-gated loop live in the contract.