@deftai/directive-content 0.106.0 → 0.108.0

package/contracts/path-write-fence.md

@@ -52,7 +52,132 @@ path when `inspectActiveScope` reports one. Residual gaps (document, not silent)
 - Story JSON unreadable → story layer fail-open; project fence still applies
 
 Shell/MCP push/merge scopes remain project-only (`runtimeAuthority.scopes`); they are not
-re-scoped by `file_scope`.
+re-scoped by `file_scope`. Recognized Shell dest-forms (`git checkout --`, `git restore`,
+`rm`/`rmdir`) use the same write fence as Edit/Write, including story `file_scope` (#3438).
+
+### Dest-form enforcement is opt-in (#3438 / #3594)
+
+```jsonc
+// xbrief/PROJECT-DEFINITION.xbrief.json
+{ "plan": { "policy": { "runtimeAuthority": {
+  "shellDestForms": "off"      // default — Shell exactly as before #3438
+  // "shellDestForms": "enforce"  // opt in
+} } } }
+```
+
+`off` is the default and leaves Shell mutations unrecognized and fail-open, as they were before
+this gate existed, so landing the classifier denies nothing a consumer runs today. `enforce`
+turns on **both** halves together: recognized dest-forms go through `inspectMutationGates`, and
+targets that cannot be proved fail closed.
+
+- ⊗ Do not split the two halves behind separate switches. Enforcing only resolved dests would
+  allow `cd x && rm y` while denying `rm x/y`; enforcing only the fail-closed branch would deny
+  the compound while letting the in-scope simple form through unchecked.
+- Independent of `enabled` in both directions: opting into the gate does not require the
+  `runtimeAuthority` grant ladder, and enabling the ladder does not silently opt into the gate.
+- An unknown value (`"warn"`, `"on"`, a typo) resolves to `off` — the no-new-denials direction —
+  and `validateRuntimeAuthority` reports it, so it is never silent.
+- An unreadable policy also resolves to `off` rather than failing closed.
+- Tracked project policy may only **enable** this gate. A tracked switch that *disabled* it would
+  contradict `policy/deft-directive-disable.ts`, where repository-controlled content must not
+  disable hooks for downstream clones.
+
+⊗ There is no `warn` state. Its only purpose would be staging a breaking change, and with `off`
+as the default there is nothing to stage. It is also unimplementable today: `renderHostDecision`
+emits no text on the allow path for `tool.before`, so a warned denial would be
+indistinguishable from `git status` in the decision record. Revisit only alongside an allow-path
+sink (#3620).
+
+### Dest-form threat model (#3438) — read this first
+
+The Shell dest-form gate is a **guardrail for cooperative-but-careless agents, not a security
+boundary against adversarial ones.** An agent that wants out of the fence has unbounded exits
+and this layer cannot close them. State that plainly before reading the rules below, because
+every rule is scoped by it.
+
+Why the limit is structural: Edit/Write payloads are **declarative** — the target path is data
+in the payload, so gating them is sound. Shell payloads are **imperative** — the target is the
+output of running a program, so gating them by parsing the command string means predicting what
+a program will do without running it. Recognition of *destructive spellings* is decidable;
+prediction of *mutation* is not.
+
+What that means concretely — all of these are **fail-open today**:
+
+- Unrecognized mutators: `git reset --hard`, `git clean -fd`, `git stash drop`, `git checkout`
+  without `--`, `mv`, `cp`, `sed -i`, `truncate`, `find -delete`, and `>` / `>>` redirection
+- Interpreters: `bash -c 'rm x'`, `python -c`, `node -e`, `cmd /c`
+- Non-literal verbs: `\rm x`, `rm${IFS}x` — the tokenizer cannot see the verb, so even the
+  fail-closed branch does not fire
+- **cmd / PowerShell mutators are not recognized at all**: `del`, `erase`, `rd`, `move`,
+  `copy /y`, `Remove-Item`, `Out-File`. Only POSIX-shaped verbs are on the list, and the hook
+  cannot tell which shell will run the command (#3624)
+- Mutations by allowed programs: `npm run build`, `node scripts/clean.js`, `make` — inherent
+  to any string recognizer, since writing files is what those commands are *for*
+- **Nothing on the allow path is audited**, so a bypass currently leaves no trace
+
+Do not describe this gate as closing the Bash bypass. It raises the floor on the four
+recognized verbs in simple commands. The bypass class remains open.
+
+### Dest-form target recognition (#3438)
+
+The fence resolves a target for exactly one shape: **a single simple command**. Everything
+else that is *recognized* is denied rather than resolved. An **absolute** dest is checked
+soundly; a **relative** dest is checked under the assumption that the shell's working
+directory is the project root, which persistent-shell hosts do not guarantee across tool
+calls (see the cwd residual below).
+
+A command is simple when it has no unquoted `&&`, `||`, `|`, `&`, `;`, or newline, no
+grouping or substitution (`(`, `)`, `{`, `}`, `` ` ``, `$`), and no git context option. Then
+each dest token is checked against the same fence as Edit/Write.
+
+Everything else **fails closed** — denied regardless of whether the path would have been in
+scope:
+
+| Fail-closed | Why |
+| --- | --- |
+| Any compound command (`cd x && rm y`, pipelines, `;`, `&`) | cwd is not provable |
+| Grouping / substitution (`(…)`, `{…;}`, `$(…)`, backticks) | target is computed at runtime |
+| Git context options (`-C`, `--work-tree`, `--git-dir`, `-c core.workTree`, `--config-env`, `GIT_WORK_TREE=`, `GIT_DIR=`) | relocates the tree; resolution depends on the git dir |
+| Glob / variable dests, or a leading `~` | expands at runtime (a *trailing* `~` as in `foo.ts~` is an ordinary path) |
+| A **retained** backslash — one not consumed as an escape (`rm C:\Repos\a.ts`, `rm foo\bar`) | dialect-ambiguous: a path separator on win32, an escape under a POSIX shell including Git Bash *on* win32, and the payload does not say which shell runs. Rewrite with forward slashes, which git and node accept on Windows (#3624) |
+| `git checkout\|restore --pathspec-from-file=<f>` / `--pathspec-file-nul` | the targets live inside a file; reading it means hook-time I/O plus resolving against an unknown cwd (#3624) |
+
+⊗ **Do not add cwd or git-context reconstruction back.** It was implemented and withdrawn
+(#3438): the target depends on operator precedence (`&` binds looser than `&&`, which binds
+looser than `|`), on exit status (`cd x || …` runs only when the `cd` failed), on subshell
+boundaries, and on git config — and every resolution rule added produced its own fence
+bypass. Recognition of a *legible* verb is cheap; resolution was not. Neither is total —
+see the threat model above.
+
+Rewrite guidance the deny message carries: name a concrete path in one simple command
+(`rm x/y`, not `cd x && rm y`), or issue one command per tool call. Prefer an **absolute**
+path: absolute dests are checked soundly, relative ones assume the shell is at the project
+root.
+
+**Cwd residual:** the classifier never consults the shell's working directory (`input.cwd`
+only supplies project-root candidates). A relative dest is resolved against the project root
+unconditionally, so whenever the shell's cwd differs — including a benign in-project `cd` in
+an earlier tool call — the fence checks a different path from the one mutated. Absolute dests
+are unaffected. Tracked in #3594.
+
+**Cost of the narrowing, accepted deliberately:** legitimate compound commands are denied,
+with the rewrite above. Cross-repo work has an escape: an absolute out-of-root dest is
+allowed, so `cd /other/repo` then `git checkout -- /other/repo/f.ts` works where
+`git -C /other/repo checkout -- f.ts` is denied. Quoting is honoured (an unquoted backslash
+escapes only a character that needs escaping, so `rm protected\ file` is ONE dest while
+`C:\Repos\file.ts` keeps its separators; `rm\ secret` is one word naming a nonexistent
+program and is correctly not a dest-form).
+
+**The fail-closed branch reaches no exemptions.** Because it never calls
+`inspectMutationGates`, assist/scratch, proposed-lifecycle, and story `file_scope` do not
+apply to it: `rm .deft-scratch/a.txt` is allowed under assist posture but
+`rm .deft-scratch/a.txt && rm .deft-scratch/b.txt` is denied. Split the calls. This is
+structural — a fail-closed dest has no path, so a path-conditional exemption cannot be
+evaluated.
+
+**Known-open — recognition, not resolution:** `python -c`, `cmd /c copy`, and obfuscated
+`bash -c 'rm …'` are not recognized as dest-forms at all, so they stay fail-open. Narrowing
+bounds what resolution can get wrong; it does not close the recognition gap.
 
 ## Skill behavior (build / swarm)
 

package/contracts/runtime-authority.md

@@ -46,6 +46,8 @@ When `enabled: true`:
 | **MCP merge** | tool names matching `merge_pull_request`, `pr_merge`, … | `scopes.merge` |
 | **MCP push** | tool names matching `git_push`, `push_branch`, … | `scopes.push` |
 
+Product dest-forms (`git checkout --`, `git restore`, `rm`/`rmdir`) are a separate PreToolUse slice (#3438) and are not classified here as push or merge.
+
 **Fail open (allow)** when:
 
 - the tool is Shell/MCP but the command/tool name is **not** classifiable as push or merge (e.g. `git status`, unrelated MCP tools)

package/contracts/scm-readiness.md

@@ -37,8 +37,8 @@ on interactive auth prompts in headless envs without a clear diagnostic.
 | --- | --- | --- |
 | `session:start` default | shallow (PATH + token + `gh auth status`) | no |
 | `session:start --with-network` | deep (API + optional repo) | no |
-| `deft scm:status` | shallow default; `--deep` opt-in | n/a (exit 0/1/2) |
-| `deft github-auth-modes` | mode validation (#1557) | n/a |
+| `deft scm:status` | shallow default; `--deep` opt-in (derives target repo; expected user login via flags/env) | n/a (exit 0/1/2) |
+| `deft github-auth-modes` | mode + principal validation (#1557 / #3665) | n/a |
 
 JSON field shape (`session:start --json` → `scm`, or `scm:status --json`):
 

package/docs/delivery-attempt.md

@@ -102,7 +102,8 @@ task swarm:pre-dispatch -- --scope-id <story|issue|xbrief-id> --target-id <workt
 Default unit key: `scopeId` + `targetId` + `workflowId=drive-to:merge-ready`.
 Actions: `begin` (default), `complete` (`--status succeeded|failed|cancelled|blocked`), `cancel` (takeover step 1).
 Monitors MUST run begin before any peer implement spawn; spawn only on exit 0.
-Takeover: cancel prior attempt, then begin again — never concurrent dual active.
+Takeover after REDISPATCH_OK: cancel prior attempt, then begin again — never concurrent dual active.
+A killed worker stays `queued`/`running` until cancel; REDISPATCH_OK does not lift `DENY_DUPLICATE_ACTIVE` (#3730).
 Implementation: `packages/core/src/swarm/pre-dispatch.ts` + `task swarm:pre-dispatch`.
 
 ## Skill routing

package/docs/freshness-contract.md

@@ -35,10 +35,15 @@ When a mutation `session:start` (cold or re-arm) loads payload surfaces into
 runtime context, it binds the live generation:
 
 ```text
-.deft/session-binds/<safe-session-id>.json   # multi-agent isolation (preferred)
+.deft/session-binds/<sha256-slice>.json      # multi-agent isolation (preferred)
 .deft/session-bind.json                      # default / last-bind convenience
 ```
 
+The per-session record is named by a 24-hex SHA-256 slice of the session id, so
+a directory listing carries no fragment of the id (#3768). Records written
+before that rename also carried a 32-character id prefix; they are read-accepted
+until the next bind supersedes them.
+
 Multi-agent hosts **must** pin session identity so one session cannot certify
 another as current:
 

package/docs/getting-started.md

@@ -16,21 +16,18 @@ Before the mechanics below, it helps to see the whole loop. Directive is two con
 
 ## Prerequisites
 
-- **Node 20+** and **pnpm** for live gates and the npm distribution channel (see `.nvmrc` in the framework payload).
+- **Node 20+** and the package manager declared by the project (`npm` or `pnpm`) for live consumer gates and the npm distribution channel (see `.nvmrc` in the framework payload). npm is bundled with Node; a pnpm-pinned project enables pnpm through Corepack.
+- **Git** and **GitHub CLI (`gh`)** are also checked by the consumer toolchain gate.
 - **Go 1.22+** only if you use the bootstrap Go installer or build from source.
-- **Python 3.11+**, **uv**, **task**, **git**, and **gh** for full framework workflows — run `directive toolchain:check` (or `deft toolchain:check`) after install.
+- **Python 3.11+**, **uv**, and **task** for the framework-maintainer and session workflows that name them. The consumer toolchain probe itself does not check those tools. Run `directive toolchain:check --consumer --project-root .` after install.
 
 ---
 
 ## Installation
 
-### npm (coming soon — not yet published)
+### npm (canonical)
 
-> ⚠️ **The `@deftai/directive` npm package is not yet published** to the registry (provisioning tracked by [#1909](https://github.com/deftai/directive/issues/1909)). **Until it goes live, install via the [Go installer](#go-installer-bootstrap) below.** The commands shown here are what the install will become once the package is published.
-
-<!-- TODO(#1909): flip to npm-canonical and remove this "coming soon" notice when @deftai/directive is published -->
-
-Once published, when Node is already available you will install Directive globally:
+With Node already available, install Directive globally from npm:
 
 ```bash
 npm i -g @deftai/directive
@@ -38,16 +35,18 @@ directive --version    # primary command
 deft --version         # alias — same binary
 ```
 
-One-shot without a global install (also once published):
+One-shot without a global install:
 
 ```bash
 npx @deftai/directive doctor
 npx @deftai/directive session:start
 ```
 
-This npm path is the emerging primary distribution channel under `@deftai/directive` ([#11](https://github.com/deftai/directive/issues/11)); the Go installer below remains the install/bootstrap option today and during the staged retire window.
+This npm path has been the canonical distribution channel since v0.55.1. A pnpm-managed repository can install the same package with `pnpm add -g @deftai/directive` or project-locally with `pnpm add -D @deftai/directive`.
+
+### Go installer (legacy bridge)
 
-### Go installer (bootstrap)
+The Go installer is a frozen legacy bridge for older installs and source-oriented recovery. New consumer installs should use npm above; see [UPGRADING.md](../UPGRADING.md#one-time-migration-from-the-go-installer-legacy--npm) when migrating an existing Go-installer layout.
 
 Download a platform installer from the [Directive release page](https://github.com/deftai/directive/releases) and run it from the project you want to adopt:
 

package/docs/hook-runtime-unavailable.md

@@ -0,0 +1,54 @@
+# Hook runtime unavailable: `deft-hook` is not on PATH
+
+On a host that cannot execute `deft-hook`, the Cursor `preToolUse` registration is `failClosed: true`, so **every mutation is denied** — and because the binary never runs, no Directive code is left to say why. The visible symptom is an opaque non-zero exit, typically **127** (command not found).
+
+Tracker: [#3785](https://github.com/deftai/directive/issues/3785). Related: [#3736](https://github.com/deftai/directive/issues/3736) (timeout), [#3571](https://github.com/deftai/directive/issues/3571) (unused-host recovery), [#2752](https://github.com/deftai/directive/issues/2752) (per-host toggles).
+
+## Who hits this
+
+The registration travels via git; the runtime does not. `.cursor/hooks.json` is trackable by design and the `.deft/core/` deposit is born-ignored, so any environment that gets the repo without a Node install of the CLI inherits the fence without the implementation:
+
+- cloud agent VMs whose image has no Node and no global install
+- CI runners and containers that never run `npm i -g @deftai/directive`
+- a fresh clone on a new workstation
+
+## Recovery is out of band
+
+There is no in-session escape. Run this from a shell where Node and the CLI **are** available — your workstation, or the repo before you push it:
+
+```bash
+deft policy:disable-host-hooks --host cursor --confirm
+```
+
+That sets `plan.policy.hostHooks.cursor = false` in `xbrief/PROJECT-DEFINITION.xbrief.json`, and the next `deft update` strips the Cursor registration. Commit and push; the locked-out environment clears on its next pull or fresh clone.
+
+⚠ Capability cost: disabling `hostHooks` for a host removes `deft-hook` pre-execution guardrails for anyone who later opens this repo in that host. The change is tracked and recorded to `meta/policy-changes.log`. Inspect with `deft policy:show --field=hostHooks`; reverse by setting the host back to `true` and running `deft update`.
+
+## Preferred fix: make the runtime travel with the registration
+
+If Cursor is a host you rely on, restore the runtime rather than removing the fence. Either:
+
+- commit a `package.json` dependency on `@deftai/directive` — a published version or another spec a clone can fetch, since a location spec (`file:`, `link:`, `../directive`, an absolute path) resolves only on the machine that wrote it — and run `npm install` in the image or clone, which puts `deft-hook` in `node_modules/.bin`; or
+- add `npm i -g @deftai/directive` to the image build.
+
+`deft init` and `deft update` warn when a hook registration travels with the repository — already committed, or merely untracked and not ignored, so the next `git add` carries it — while neither anchor is present. The warning names the affected file and this document.
+
+## ⊗ Do not hand-edit `failClosed` in the deposited hook file
+
+Setting `failClosed: false` in `.cursor/hooks.json` clears the block exactly once. That file is a managed deposit: the next `deft update` rewrites the entries with `failClosed: true` and **silently re-arms the lockout**, usually long after anyone remembers editing it. Use the policy verb above, which is durable and tracked.
+
+## Why the flags do not help
+
+| Escape hatch | Why it does not reach this failure |
+|---|---|
+| `.deft-directive-disable` | Evaluated *inside* `deft-hook`. When the binary is missing, nothing reads the flag. |
+| `.no-deft-directive` | Consulted at `session.start` only; it never reaches `preToolUse`. |
+| Host-side "skip hook" | A host concept. Directive has no such bypass. |
+
+## Absent, crashed, and timed out are one class
+
+The hook exit contract already decouples the exit code from the verdict: exit `0` means a decision was **rendered** — allow *or* deny — so every non-zero exit is by construction a *non-decision*. Absence, a crash, and a host timeout kill are the same state, and all three stay fail-closed.
+
+They stay fail-closed because fail-open-on-absence is a bypass primitive, not a lenience: removing the binary is an ordinary shell call, so treating absence as allow would convert a self-inflicted denial into a bypass of the write fence, the intent ceiling, the session ritual, and the occupancy lease ([#3156](https://github.com/deftai/directive/issues/3156)). What these cases need is legibility and an out-of-band escape — this page — not a relaxed fence.
+
+For a timeout specifically, retry the gated ritual first when machine load is the likely cause; the Cursor `tool.before` budget is sized for a gated ritual plus live readiness, so a repeated timeout is a real signal rather than noise.

package/docs/orphan-active-verdict-basis.md

@@ -0,0 +1,166 @@
+# `verify:orphan-active`: verdict basis and freshness (#3767)
+
+`verify:orphan-active` decides whether an `xbrief/active/` brief with
+`plan.status == running` is really still live work. Until #3767 it answered
+that question from a triage-cache hit returned **unconditionally** — no age
+bound, no re-validation. A cached `open` written twelve hours earlier beat
+reality and suppressed the live read that would have corrected it, so the gate
+exited 0 while scanning the very brief whose issue had already closed.
+
+This document records what the gate now does, why, and what it still cannot
+promise.
+
+Legend (RFC2119): `!`=MUST, `~`=SHOULD, `⊗`=MUST NOT, `?`=MAY.
+
+---
+
+## Two modes, split by query shape
+
+The gate has two callers with different obligations, so it has two mechanisms.
+
+| | Scoped `--issue N` | Unscoped aggregate |
+|---|---|---|
+| Caller | after-merge DONE proof (#3429 / #3476) | `task check`, pre-commit, pre-push sweep |
+| Mechanism | authoritative per-issue REST read | one complete open-issue inventory |
+| N | 1 | one call regardless of brief count |
+| Unknown state | **fail closed** (exit 1, `unresolved`) | **fail open** (exit 0, reported `unverified`) |
+| Latency budget | 5 s | 15 s |
+
+The unknown asymmetry is deliberate and predates this change. Scoped is a proof
+obligation before a worker claims DONE about one named origin. The aggregate
+sweep must not make offline work network-authorized — hard-failing every
+aggregate unknown would break `--skip-gh`, offline runs, and fresh clones.
+
+⊗ Do not flatten the two unknown policies into one rule.
+
+---
+
+## The freshness choice
+
+**Age bound plus re-validation, applied per mode.** Both options offered by
+#3767 are used, because each mode needs a different one.
+
+- A cache hit is honoured only when it is at most **15 minutes** old
+  (`ISSUE_CACHE_MAX_AGE_MS`). Older entries are not evidence.
+- Scoped `--issue N` re-validates first: it takes the authoritative read and
+  falls back to the cache only inside the age bound, when the live read is
+  unavailable. Unknown after that is `unresolved`.
+- The aggregate sweep resolves from the open-issue inventory when the network
+  is allowed, and uses an in-bound cache hit only under `--skip-gh` or when the
+  inventory itself is unavailable.
+
+15 minutes keeps a warm-cache offline run working while making an overnight
+entry non-authoritative — the measured entry was roughly twelve hours old.
+
+---
+
+## The aggregate inventory
+
+The sweep reuses `restIssueListOpenInventory` (#3752): one
+`gh api --paginate --slurp repos/<owner>/<repo>/issues?state=open&per_page=100`
+subprocess. It excludes pull-request rows and **fails closed** on command
+failure, non-JSON output, a non-array payload, a malformed row, buffer
+exhaustion, and the pagination cap.
+
+! The inventory MUST be complete. `probeCacheDrift`'s helper defaults to a
+1,000-item limit; reusing that capped set as a closed-state oracle would
+misclassify open issue 1001+ in a larger repository.
+
+Membership in a successful inventory means open. **Absence means "not open"**,
+which is the direction that tells an operator to run `scope:complete` on what
+may be live work — so absence is confirmed by one authoritative per-issue read
+before the gate acts on it. That confirming result is reused for the rest of
+the run when several briefs name the same issue. In the ordinary case
+(everything open) that costs zero extra calls.
+
+When the inventory is unavailable the gate reports `unverified` rather than
+inferring closed. Fail-closed here means never manufacturing a false "closed",
+not turning the sweep into a connectivity check.
+
+### Why not a live read per brief
+
+Per-brief live reads are the mechanism #3752 removed. Measured: the inventory
+is **4.2 s constant**, against **14.2 s** and **76.6 s** for sequential
+per-brief reads at the WIP cap of 20 on two different hosts. Crossover is about
+5 briefs on `gh` and about 1 on `ghx`. `verify:orphan-active` sits in the
+fast-preflight tier, where wall clock rather than REST quota is the constraint.
+
+---
+
+## Reported basis
+
+Every run now says how it decided, so a verified pass is distinguishable from
+an unverified one:
+
+```text
+verify:orphan-active: no orphaned active/running xBRIEFs (scanned 3 running briefs in active/).
+  Basis: inventory 2, cache 1 (max age 4m).
+```
+
+```text
+verify:orphan-active: no orphaned active/running xBRIEFs (scanned 1 running brief in active/).
+  Basis: unverified 1.
+  UNVERIFIED: state could not be established for the references below, so this run is
+  not evidence that they are unshipped:
+    - #8001 (open-issue inventory unavailable: gh api failed: ...)
+```
+
+`EvaluateResult.basis` carries the same counts structurally
+(`inventory`, `live`, `cache`, `unverified`, `maxCacheAgeMs`, `proxied`,
+`elapsedMs`, `budgetMs`).
+
+⊗ Do not cite an exit 0 with `unverified > 0` as evidence that a tree is clean.
+
+---
+
+## The `ghx` caveat
+
+"Live" is itself a cache. `defaultRunGh` resolves through `resolveBinary()`,
+which prefers **`ghx`**, a cached read-only GET proxy whose age nothing in this
+gate can inspect.
+
+This gate therefore **pins plain `gh`** for its authoritative reads when `gh` is
+on PATH. When only `ghx` is available the gate still runs, sets
+`basis.proxied`, and prints:
+
+```text
+  Note: reads resolved through `ghx`, a cached GET proxy; freshness is bounded by that
+  proxy, which this gate cannot inspect (#3737).
+```
+
+⊗ Do not claim the gate detects a closed origin "regardless of cache age" while
+`ghx` is in the path. Whether `resolveBinary` should prefer `ghx` at all is
+[#3737](https://github.com/deftai/directive/issues/3737).
+
+---
+
+## Latency budgets
+
+There were none before #3767, which is why "affordable" was unfalsifiable.
+
+| Mode | Budget | Basis |
+|---|---|---|
+| Scoped `--issue N` | 5 s | one issue read plus at most one linked-PR read, measured ~0.75 s each |
+| Unscoped aggregate | 15 s | one 4.2 s inventory plus confirming reads for apparent closes |
+
+Exceeding a budget prints an advisory line and does **not** change the exit
+code. Budget drift is a signal to re-measure the mechanism, not a new failure
+mode for callers.
+
+---
+
+## Out of scope
+
+- The offline crash when neither `gh` nor `ghx` is on PATH
+  ([#3774](https://github.com/deftai/directive/issues/3774)).
+- Whether `resolveBinary` should prefer `ghx`
+  ([#3737](https://github.com/deftai/directive/issues/3737)).
+- The `cache_fresh` forge-error fail-open decided on
+  [#3738](https://github.com/deftai/directive/issues/3738).
+
+## Related
+
+- [#3429](https://github.com/deftai/directive/issues/3429) — the gate's contract
+- [#3476](https://github.com/deftai/directive/issues/3476) — `verify:completed-tracked`
+- [#3752](https://github.com/deftai/directive/issues/3752) — the open-inventory mechanism reused here
+- [#3156](https://github.com/deftai/directive/issues/3156) — gate integrity; this was a deliberate gate-definition change

package/docs/scope-provenance.md

@@ -70,7 +70,7 @@ task scope:record-approved-scope -- xbrief/active/story.xbrief.json --actor scot
 
 Mint uses the shared #3110 human-presence gate (same module as `authz`):
 
-- Interactive TTY (stdin + stdout) and a controlling terminal (`/dev/tty` or `CONIN$`)
+- Interactive TTY (stdin + stdout) and a controlling terminal (`/dev/tty` or `\\.\CONIN$`)
 - Explicit `--confirm`
 - Typed phrase `mint` on the controlling TTY
 - Agent/CI env markers (`AUTHZ_AGENT_SHELL_ENV_MARKERS`) refuse fail-closed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive-content",
-  "version": "0.106.0",
+  "version": "0.108.0",
   "deftConsumerDeposit": true,
   "description": "Shippable Directive framework content in the consumer .deft/core/ layout (C1 flatten), plus the engine surfaces (.githooks/, Taskfile.yml, tasks/) the deposit wires. Python-free per #2022 Phase 3. Refs #11, #1669, #1967.",
   "license": "MIT",