@deftai/directive-content 0.55.1 → 0.56.0

package/tasks/scope-undo.yml

@@ -0,0 +1,36 @@
+version: '3'
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+# scope:undo fragment (D15 / #1134).
+#
+# Standalone fragment per the post-D12 sub-task convention so the
+# orchestrator's cross-child coordination contract does not collide
+# with edits on tasks/scope.yml. The user-facing alias `task scope:undo`
+# lives in the root Taskfile.yml below; this fragment exposes the inner
+# task name `undo` under the include namespace key `scope-undo`, so the
+# fragment-namespace form `task scope-undo:undo` is also reachable for
+# debugging but is not the documented surface.
+#
+# CLI_ARGS forwarded bare (matches every other scope:* verb -- go-task's
+# shell-escape pipeline misbehaves on Windows when CLI_ARGS is wrapped
+# in double quotes, see #577).
+#
+# `dir: '{{.USER_WORKING_DIR}}'` keeps Python CWD at the consumer project
+# root so `--project-root "{{.USER_WORKING_DIR}}"` resolves correctly
+# (#535 path-resolution invariant).
+#
+# `env: PYTHONUTF8: "1"` is a belt-and-suspenders guard for Windows cp1252
+# default (#540); root Taskfile.yml also sets this.
+#
+# Per `conventions/task-caching.md` (#574) no `sources:` / `generates:`
+# because the verb forwards user-facing flags (`--dry-run` / `--batch-id` /
+# `--decision-id`) via {{.CLI_ARGS}}.
+
+tasks:
+  undo:
+    desc: "Reverse a scope-lifecycle audit entry (#1134). Single: `task scope:undo -- <decision_id>` / `task scope:undo -- --decision-id=<uuid>`. Batch: `task scope:undo -- --batch-id=<uuid>`. Optional `--dry-run`."
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" scope-undo {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"

package/tasks/scope.yml

@@ -0,0 +1,141 @@
+version: '3'
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+# scope lifecycle tasks.
+#
+# IMPORTANT: every task sets ``dir: '{{.USER_WORKING_DIR}}'`` so the Python
+# script's CWD is the consumer project root, NOT ``deft/``. The script path
+# is resolved via ``{{.DEFT_ROOT}}/scripts/`` (DEFT_ROOT is defined locally
+# in this file's `vars:` block via ``{{joinPath .TASKFILE_DIR ".."}}`` --
+# see ../Taskfile.yml for why root-level definition is avoided) so it
+# still points at ``deft/scripts/scope_lifecycle.py`` after the dir switch.
+# The previous ``{{.TASKFILE_DIR}}/../scripts/`` form broke on Windows
+# under `uv --project "{{.DEFT_ROOT}}" run python` (#566) because mixed-separator traversal
+# normalizes incorrectly and drops the deft/ prefix.
+#
+# CLI_ARGS: passed to the script raw / unquoted. go-task shell-escapes
+# CLI_ARGS with single quotes on its own, so wrapping the interpolation
+# in Taskfile-level double quotes produces ``"'path'"`` at dispatch time
+# on Windows (pwsh/cmd preserve nested quotes verbatim), and Python's
+# argv receives a literal single-quote-prefixed filename that fails to
+# open (#577). All seven scope:* commands therefore forward
+# ``{{.CLI_ARGS}}`` bare -- matching migrate.yml / prd.yml / issue.yml /
+# reconcile.yml.  ``scope_lifecycle.py`` handles both absolute and
+# relative values via ``_resolve_file_path`` + ``resolve_project_root``
+# -- the script owns path resolution, the task just forwards
+# ``--project-root`` so detection never silently falls back to deft's
+# own tree (#535). Relative paths resolve against the consumer root
+# thanks to ``--project-root``; absolute paths are used as-is.
+#
+# ``env: PYTHONUTF8: "1"`` is set per-task as a belt-and-suspenders guard
+# for Windows (cp1252 default crashes on -- / -> / x / !); the top-level
+# Taskfile.yml also sets this (#540).
+
+tasks:
+  _ensure-ts:
+    internal: true
+    desc: "Build the TS engine before lifecycle gates (#1828 s4)"
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - pnpm --dir "{{.DEFT_ROOT}}" run build
+
+  promote:
+    desc: "Promote a vBRIEF scope: proposed/ -> pending/ (status: pending)"
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - _ensure-ts
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" scope-lifecycle promote {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"
+
+  activate:
+    desc: "Activate a vBRIEF scope: pending/ -> active/ (status: running)"
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - _ensure-ts
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" scope-lifecycle activate {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"
+
+  complete:
+    desc: "Complete a vBRIEF scope: active/ -> completed/ (status: completed)"
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - _ensure-ts
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" scope-lifecycle complete {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"
+
+  fail:
+    # Terminal ``failed`` transition (#614). Parallels ``scope:complete``
+    # (same source + destination folders) and differs only in the
+    # resulting ``plan.status`` (``failed`` vs ``completed``). Semantic
+    # contract: use ``scope:fail`` when a scope was attempted but could
+    # not be completed (external blocker, infeasibility discovered
+    # mid-flight, deadline hit, agent exhausted retries) and should NOT
+    # be cancelled. ``scope:cancel`` remains the right call when the
+    # scope is no longer wanted / superseded / obsolete. The canonical
+    # v0.6 Status enum includes ``failed`` (see
+    # vbrief/schemas/vbrief-core.schema.json).
+    desc: "Fail a vBRIEF scope: active/ -> completed/ (status: failed)"
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - _ensure-ts
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" scope-lifecycle fail {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"
+
+  cancel:
+    desc: "Cancel a vBRIEF scope: any folder -> cancelled/ (status: cancelled)"
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - _ensure-ts
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" scope-lifecycle cancel {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"
+
+  restore:
+    desc: "Restore a cancelled vBRIEF scope: cancelled/ -> proposed/ (status: proposed)"
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - _ensure-ts
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" scope-lifecycle restore {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"
+
+  block:
+    desc: "Block a vBRIEF scope: stays in active/ (status: blocked)"
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - _ensure-ts
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" scope-lifecycle block {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"
+
+  unblock:
+    desc: "Unblock a vBRIEF scope: stays in active/ (status: running)"
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - _ensure-ts
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" scope-lifecycle unblock {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"
+
+  decompose:
+    desc: "Apply/check an approved epic/phase -> story decomposition draft"
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - _ensure-ts
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" scope-decompose {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"
+
+  # Operator-driven demote (D1 / #1121). Moves a vBRIEF scope from
+  # vbrief/pending/ back to vbrief/proposed/ and appends a structured
+  # audit entry (including a `demote_meta` block) to
+  # vbrief/.eval/scope-lifecycle.jsonl. Two modes are supported:
+  #   * Single: `task scope:demote -- path/to/foo.vbrief.json [--reason TEXT]`
+  #   * Batch:  `task scope:demote -- --batch [--older-than-days 45]`
+  # The 30%-threshold falsification gate from D17 was explicitly dropped
+  # per Current Shape Decision 2 on #1121; lightweight metrics over the
+  # audit log live separately at #1180.
+  demote:
+    desc: "Demote a vBRIEF scope: pending/ -> proposed/ (#1121). Single-file or --batch --older-than-days N (default 45)."
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - _ensure-ts
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" scope-demote {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"

package/tasks/session.yml

@@ -0,0 +1,19 @@
+version: '3'
+
+# tasks/session.yml -- fail-closed session ritual state surface (#1348).
+#
+# Per conventions/task-caching.md: no sources/generates because the task
+# forwards user-facing flags (--defer, --json, --no-history) via CLI_ARGS.
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+tasks:
+  start:
+    desc: "Run quick-tier session-start ritual and write .deft/ritual-state.json (#1348). Flags: --defer step=reason / --json"
+    dir: '{{.USER_WORKING_DIR}}'
+    deps: [":ts:build"]
+    env:
+      PYTHONUTF8: "1"
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" session:start --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}

package/tasks/setup.yml

@@ -0,0 +1,37 @@
+version: '3'
+
+# Windows toolchain bootstrap fragment (#902).
+#
+# Wired into the parent Taskfile.yml `includes:` block under namespace key
+# `setup`, so the inner task `toolchain` is reachable as `task setup:toolchain`.
+# This fragment is independent of the root-level `setup` task in
+# Taskfile.yml (which configures git hooks via core.hooksPath); the two
+# coexist because go-task treats `setup` and `setup:toolchain` as distinct
+# task names.
+#
+# Companion script: scripts/setup_windows.ps1
+# Companion test:   tests/scripts/test_setup_windows.ps1
+# Issue: #902
+#
+# Per `conventions/task-caching.md` (#574): NO `sources:` / `generates:`
+# declarations on these tasks because user-facing behaviour is determined at
+# runtime by host platform detection and the script's idempotent probe-
+# before-install logic, not by file mtimes.
+
+vars:
+  # Resolve the deft framework root from this fragment's directory. The
+  # joinPath idiom mirrors the convention documented in the root Taskfile.yml
+  # header (#566): {{.TASKFILE_DIR}}/.. evaluated by go-task's eager
+  # templating yields a native-separator absolute path that pwsh / Bash can
+  # open on Windows / macOS / Linux.
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+tasks:
+  toolchain:
+    desc: "Bootstrap the Windows maintainer toolchain (Go, Python, uv, Task, gh) via winget. Windows-only -- no-op on macOS / Linux. -- task setup:toolchain"
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - cmd: pwsh -NoProfile -ExecutionPolicy Bypass -File "{{.DEFT_ROOT}}/scripts/setup_windows.ps1"
+        platforms: [windows]
+      - cmd: echo "setup:toolchain currently supports Windows only. See CONTRIBUTING.md for macOS / Linux setup."
+        platforms: [linux, darwin]

package/tasks/slice.yml

@@ -0,0 +1,69 @@
+version: '3'
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+# slice:* fragment (N7 / #1147).
+#
+# Exposes the canonical `task slice:record-existing` backfill verb plus
+# the companion `task slice:list` read surface. Both delegate to
+# `scripts/slice_record_existing.py`. Inner tasks below are
+# `internal: true` so the fragment-namespace forms (`slice:record-existing`
+# under the include key `slice`) are surfaced as user-facing aliases in
+# the root `Taskfile.yml` (mirrors the established triage:* / scope:*
+# pattern -- see Taskfile.yml header comment for why aliases live at the
+# root rather than here).
+#
+# CLI_ARGS is forwarded bare -- go-task's shell-escape pipeline misbehaves
+# on Windows when CLI_ARGS is wrapped in double quotes (#577). The driver
+# script owns argv parsing (including the dynamic `--wave-N=<csv>` flag
+# shape that argparse cannot natively model).
+#
+# Windows quoting limitation (#1231 / SLizard P2): because CLI_ARGS is
+# substituted bare, arguments containing spaces (e.g. `--notes "A note
+# with spaces"`) may be re-split by the shell before `argparse` sees
+# them. The operator-facing workaround is to either avoid spaces in flag
+# values (use a single token like `--notes=backfill-after-N7`) or to
+# write the rationale to a file and embed a pointer. The fully-quoted
+# `{{.CLI_ARGS | shellQuote}}` form misbehaves on Windows go-task per
+# #577; switching to a temp-file dispatch is the long-term fix and is
+# tracked under #1231. The same caveat applies to every other verb that
+# forwards `{{.CLI_ARGS}}` bare under `tasks/` (audit list: every fragment
+# in this directory does -- the pattern is repo-wide).
+#
+# `dir: '{{.USER_WORKING_DIR}}'` keeps Python CWD at the consumer project
+# root so `--project-root` / `--repo` resolution lands in the consumer
+# tree, not in deft's own checkout (#535 path-resolution invariant).
+#
+# `env: PYTHONUTF8: "1"` is a belt-and-suspenders guard for Windows
+# cp1252 default (#540); root Taskfile.yml also sets this.
+#
+# Per `conventions/task-caching.md` (#574) no `sources:` / `generates:`
+# because the verbs forward user-facing flags (`--dry-run`, `--force`,
+# `--wave-N=<csv>`, `--actor`, etc.) via {{.CLI_ARGS}}.
+
+tasks:
+  _ensure-ts:
+    internal: true
+    desc: "Build the TS engine before slice gates (#1828 s4)"
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - pnpm --dir "{{.DEFT_ROOT}}" run build
+
+  record-existing:
+    desc: "Retrofit a slices.jsonl entry for a hand-filed cohort (#1147 / N7). Windows note (#1231): CLI_ARGS is forwarded bare to argparse so values containing spaces (e.g. --notes \"A note with spaces\") may be re-split by the shell -- prefer hyphenated single-token values like --notes=backfill-after-N7. -- task slice:record-existing -- --umbrella=N --children=A,B,C [--wave-1=A,B] [--wave-2=C] [--actor=manual:operator] [--expected-close-signal=all-children-merged] [--sliced-at=ISO] [--notes=TEXT] [--dry-run] [--force] [--skip-validation] [--repo OWNER/NAME]"
+    internal: true
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - _ensure-ts
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" slice record-existing {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"
+
+  list:
+    desc: "List recorded slices in vbrief/.eval/slices.jsonl (umbrella + child count + actor + sliced_at). -- task slice:list [-- --json]"
+    internal: true
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - _ensure-ts
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" slice list {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"

package/tasks/spec.yml

@@ -0,0 +1,41 @@
+version: '3'
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+# spec tasks -- consumer-safe CWD + script resolution (#539, #540, #566).
+# Scripts are dispatched via {{.DEFT_ROOT}} (defined locally in this file's
+# `vars:` block via ``{{joinPath .TASKFILE_DIR ".."}}`` -- see
+# ../Taskfile.yml for why root-level definition is avoided) to keep the
+# path traversal-free and avoid the {{.TASKFILE_DIR}}/.. form that breaks
+# on Windows under `uv --project "{{.DEFT_ROOT}}" run python` (#566).
+
+tasks:
+  _ts-build:
+    internal: true
+    desc: "Build @deftai/cli dist/ before TS-backed render gates run (#1854 s2)."
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - pnpm --dir "{{.DEFT_ROOT}}" run build
+
+  validate:
+    desc: Validate that vbrief/specification.vbrief.json exists and is well-formed JSON
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - _ts-build
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" spec-validate "{{.USER_WORKING_DIR}}/vbrief/specification.vbrief.json"
+
+  render:
+    desc: Render vbrief/specification.vbrief.json to SPECIFICATION.md
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - _ts-build
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" spec-render "{{.USER_WORKING_DIR}}/vbrief/specification.vbrief.json" "{{.USER_WORKING_DIR}}/SPECIFICATION.md"
+
+  pipeline:
+    desc: Run full spec pipeline (validate then render)
+    cmds:
+      - task: validate
+      - task: render

package/tasks/swarm.yml

@@ -0,0 +1,85 @@
+version: '3'
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+tasks:
+  readiness:
+    desc: "Report whether story vBRIEFs are ready for concurrent swarm allocation"
+    dir: '{{.USER_WORKING_DIR}}'
+    deps: [":ts:build"]
+    env:
+      PYTHONUTF8: "1"
+    cmds:
+      # Keep CLI_ARGS bare; go-task shell-escapes pass-through args and quoting breaks globs/multi-arg calls.
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" swarm-readiness {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"
+
+  # swarm:launch -- deterministic headless launch engine (#1387). Turns an
+  # operator-supplied, pre-approved cohort into a ready-to-spawn launch
+  # manifest: resolves --stories (issue numbers / story ids / paths) against
+  # vbrief/active, enforces the #810 preflight and swarm:readiness gates per
+  # story (exiting non-zero and naming the FIRST failing story), and emits
+  # the C2 launch-manifest JSON carrying the #1378 allocation-context token
+  # for each agent. Bare {{.CLI_ARGS}} per the readiness/verify-review-clean
+  # convention -- go-task already shell-escapes pass-through args, so wrapping
+  # in double quotes breaks multi-arg / path forwarding (see tasks/vbrief.yml
+  # preflight for the full rationale and tests/content/test_taskfile_cli_args.py).
+  #
+  # Companion script: scripts/swarm_launch.py
+  # Companion test:   tests/cli/test_swarm_launch.py
+  launch:
+    desc: "Resolve a pre-approved cohort, enforce the #810 + swarm:readiness gates and sub-agent backend policy per story, and emit the launch-manifest JSON (#1387, #1531e)"
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" swarm-launch {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"
+
+  # swarm:routing-set -- record an operator coding sub-agent model decision
+  # (#1739) into the gitignored, per-machine .deft/routing.local.json keyed by
+  # (dispatch_provider, worker_role). Supersedes the swarmSubagentBackend enum
+  # (#1531 / #1735): the resolved model is threaded into the launch manifest
+  # (resolved_model / model_source) so dispatch can actually honor it.
+  routing-set:
+    desc: "Record an operator coding sub-agent model decision (#1739): --role <role> (--model <slug> | --harness-default) [--provider <p>]. Writes the gitignored, per-machine .deft/routing.local.json."
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" swarm-routing-set {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"
+
+  # swarm:verify-review-clean -- cohort-level CLEAN verification gate (#1364).
+  # Mandate the monitor invokes this after Phase 6 pollers report and BEFORE
+  # the Phase 5 -> 6 merge discussion. Re-uses the Greptile rolling-summary
+  # parser from scripts/pr_merge_readiness.py so the per-PR merge gate and
+  # the cohort gate stay in lockstep -- a parser fix lands in both surfaces
+  # at once. The companion script writes its own diagnostics; this Taskfile
+  # target just forwards CLI_ARGS bare per the established convention.
+  #
+  # Companion script: scripts/swarm_verify_review_clean.py
+  # Companion test:   tests/cli/test_swarm_verify_review_clean.py
+  # Skill citation:   skills/deft-directive-swarm/SKILL.md Phase 5 Exit Condition + Phase 5 -> 6 gate
+  verify-review-clean:
+    desc: "Verify EVERY PR in a swarm cohort is CLEAN on current HEAD (confidence > 3, no P0/P1, not errored) before raising the Phase 5 -> 6 merge gate (#1364)"
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" swarm-verify-review-clean {{.CLI_ARGS}}
+
+  # swarm:complete-cohort -- deterministic cohort completion sweep (#1487).
+  # The REQUIRED Phase 6 step that moves a finished cohort's story vBRIEFs
+  # active/ -> completed/ and completes the decompose-created epic parents
+  # once all their children are settled. Routes every move through
+  # scripts/scope_lifecycle.py so the #1485 (child-move) and #1487 (parent-
+  # move) reference maintenance keeps `task vbrief:validate` green with no
+  # manual repair. Bare {{.CLI_ARGS}} per the readiness / verify-review-clean
+  # convention -- go-task already shell-escapes pass-through args, so wrapping
+  # in double quotes breaks multi-arg / glob forwarding.
+  #
+  # Companion script: scripts/swarm_complete_cohort.py
+  # Companion test:   tests/cli/test_swarm_complete_cohort.py
+  # Skill citation:   skills/deft-directive-swarm/SKILL.md Phase 6 cohort completion sweep
+  complete-cohort:
+    desc: "Sweep a finished swarm cohort's stories active/ -> completed/ and complete their epic parents, keeping vbrief:validate green (#1487)"
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" swarm-complete-cohort {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"

package/tasks/toolchain.yml

@@ -0,0 +1,13 @@
+version: '3'
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+tasks:
+  check:
+    desc: Verify required toolchain is installed (go, uv, git, gh, node, pnpm)
+    deps: [":ts:build"]
+    env:
+      PYTHONUTF8: "1"
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" toolchain:check

package/tasks/triage-actions.yml

@@ -0,0 +1,94 @@
+version: '3'
+
+# tasks/triage-actions.yml -- per-issue triage commands (#845 Story 3).
+#
+# Wired into the parent Taskfile.yml `includes:` block under namespace key
+# `triage-actions` (#845 Story 6). Inner task names below dropped the
+# `triage:` prefix in #913 -- the prior names produced a doubled prefix
+# (`triage-actions:triage:accept`) under go-task's include-namespace
+# concatenation. Combined with `internal: true` the fragment-namespace
+# forms (`triage-actions:accept` / `triage-actions:reject` / ...) are
+# hidden from `task -l`; the documented `task triage:accept` / `triage:reject`
+# / `triage:defer` / `triage:needs-ac` / `triage:mark-duplicate` /
+# `triage:status` / `triage:reset` / `triage:history` surface lives as
+# root-level alias tasks in Taskfile.yml that delegate here.
+#
+# Per `conventions/task-caching.md`: NO `sources:` / `generates:` because every
+# target accepts user-facing flags via `{{.CLI_ARGS}}` (--issue, --repo,
+# --reason, --of, --comment, --actor) -- the cached `cmds:` skip would
+# silently swallow recovery flags. Same rationale that gated `task release`
+# (#74), `task pr:check-protected-issues` (#702), and `task verify:encoding`
+# (#798).
+#
+# Companion script: scripts/triage_actions.py
+# Companion tests:  tests/test_triage_actions.py
+# Upstream contracts (frozen): scripts/candidates_log.py (#845 Story 2 audit log),
+#                              scripts/cache.py          (#883 Story 2 unified cache).
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+tasks:
+  accept:
+    desc: "Accept an issue for triage. Records an audit entry. (#845 Story 3)"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-actions accept {{.CLI_ARGS}}
+
+  reject:
+    desc: "Reject an issue. Closes upstream via gh + applies triage-rejected label; rolls audit back on gh failure. (#845 Story 3)"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-actions reject {{.CLI_ARGS}}
+
+  defer:
+    desc: "Defer an issue. Records an audit entry. (#845 Story 3)"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-actions defer {{.CLI_ARGS}}
+
+  needs-ac:
+    desc: "Mark an issue as needing acceptance criteria + post AC-request comment upstream. (#845 Story 3)"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-actions needs-ac {{.CLI_ARGS}}
+
+  mark-duplicate:
+    desc: "Link an issue as a duplicate of another (validated against Story 1 cache). (#845 Story 3)"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-actions mark-duplicate {{.CLI_ARGS}}
+
+  status:
+    desc: "Print the latest triage decision for an issue. Read-only. (#845 Story 3)"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-actions status {{.CLI_ARGS}}
+
+  reset:
+    desc: "Reset an issue's triage state. Appends a reset audit entry referencing prior; does NOT delete history. (#845 Story 3)"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-actions reset {{.CLI_ARGS}}
+
+  history:
+    desc: "Print the full triage timeline for an issue, ordered by timestamp. Read-only. (#845 Story 3)"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-actions history {{.CLI_ARGS}}

package/tasks/triage-bootstrap.yml

@@ -0,0 +1,43 @@
+version: '3'
+
+# Triage v1 bootstrap fragment (#845 Story 6).
+#
+# Standalone fragment: this file is wired into the parent Taskfile.yml via the
+# `includes:` block (see Taskfile.yml `## triage v1 fragment includes` comment).
+# When included under namespace key `triage-bootstrap`, the inner task
+# `bootstrap` is reachable as `task triage-bootstrap:bootstrap`. The parent
+# Taskfile.yml additionally exposes the user-facing alias `task triage:bootstrap`
+# which delegates here.
+#
+# Companion files in the four-fragment cluster (#845):
+#   tasks/triage-cache.yml      (Story 1 -- cache populate + show)
+#   tasks/triage-actions.yml    (Story 3 -- accept/reject/defer/...)
+#   tasks/triage-bulk.yml       (Story 4 -- bulk ops + freshness)
+#   tasks/triage-bootstrap.yml  (Story 6 -- this file)
+#
+# Companion script: scripts/triage_bootstrap.py
+# Companion test:   tests/test_triage_bootstrap.py
+#
+# Per `conventions/task-caching.md` (#574): NO `sources:` / `generates:`
+# declarations on this task because user-facing recovery flags
+# (`--repo`, `--fetch-timeout-s`, `--json`, `--quiet`) are forwarded via
+# {{.CLI_ARGS}} and go-task's incremental-build cache layer would silently
+# swallow them. The Story 3 rebind dropped the v0.25.x `--skip-gitcrawl`
+# install path entirely (#951): the script's argparse never accepted it.
+
+vars:
+  # Resolve the deft framework root from this fragment's directory. The
+  # joinPath idiom mirrors the existing convention documented in the root
+  # Taskfile.yml header (#566): `{{.TASKFILE_DIR}}/..` evaluated by go-task's
+  # eager templating yields a native-separator absolute path that
+  # `node .../bin.js` can open on Windows / macOS / Linux.
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+tasks:
+  bootstrap:
+    desc: "Idempotent triage v1 installer (#845): populate cache, backfill audit log, ensure gitignore for .deft-cache/ and vbrief/.eval/. Re-runnable; per-step progress on stderr; cache:fetch-all wall-clock cap (#952). -- task triage:bootstrap [-- --repo OWNER/NAME] [--limit N] [--state open|closed|all] [--fetch-timeout-s N] [--quiet] [--json]"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-bootstrap --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}

package/tasks/triage-bulk.yml

@@ -0,0 +1,75 @@
+version: '3'
+
+# tasks/triage-bulk.yml -- Story 4 of #845 + #915 cache-walk re-enable.
+#
+# Wired into the parent ../Taskfile.yml `includes:` block under namespace
+# key `triage-bulk` (#845 Story 6). The user-facing `task triage:bulk-accept`
+# / `triage:bulk-reject` / `triage:bulk-defer` / `triage:bulk-needs-ac` /
+# `triage:refresh-active` surface lives as root-level alias tasks in
+# Taskfile.yml that delegate here (#913); inner tasks below are
+# `internal: true` so the fragment-namespace forms (`triage-bulk:bulk-*`)
+# are hidden from `task -l`.
+#
+# The disable-gate `cmds:` blocks introduced by PR #916 (#915 hot-fix) were
+# REVERSED once scripts/triage_bulk.py was rewritten to walk the local
+# cache instead of live `gh issue list`. As of #883 Story 3 the cache walk
+# consumes the unified `cache:get` surface
+# (`.deft-cache/github-issue/<owner>/<repo>/<N>/`); the four `bulk-*`
+# targets continue to invoke triage_bulk.py directly. The cache-empty
+# hard-fail (exit 2) and Tier-2 audit-log short-circuit are enforced
+# inside triage_bulk.py itself (#915 fix).
+#
+# Per `conventions/task-caching.md` (#574): every target here accepts user
+# flags via `{{.CLI_ARGS}}` (--label, --author, --age-days, --cluster,
+# --reason, --repo, --re-action) so MUST NOT declare `sources:` /
+# `generates:` -- the cached cmds: skip would silently swallow the
+# recovery flag.
+#
+# Path resolution mirrors the convention from tasks/issue.yml + tasks/policy.yml:
+# `DEFT_ROOT` is defined locally via `joinPath .TASKFILE_DIR ".."` so
+# `node .../bin.js` resolves cleanly on Windows under go-task's mvdan/sh
+# interpreter (#566).
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+tasks:
+  bulk-accept:
+    desc: "Bulk accept candidates (#845 Story 4) -- task triage:bulk-accept -- --repo OWNER/NAME [--label L] [--author A] [--age-days N] [--cluster C] [--re-action]"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-bulk accept {{.CLI_ARGS}}
+
+  bulk-reject:
+    desc: "Bulk reject candidates (#845 Story 4) -- task triage:bulk-reject -- --repo OWNER/NAME --reason 'why' [--label L] [--author A] [--age-days N] [--cluster C] [--re-action]"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-bulk reject {{.CLI_ARGS}}
+
+  bulk-defer:
+    desc: "Bulk defer candidates (#845 Story 4) -- task triage:bulk-defer -- --repo OWNER/NAME [--label L] [--author A] [--age-days N] [--cluster C] [--re-action]"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-bulk defer {{.CLI_ARGS}}
+
+  bulk-needs-ac:
+    desc: "Bulk needs-ac candidates (#845 Story 4) -- task triage:bulk-needs-ac -- --repo OWNER/NAME [--label L] [--author A] [--age-days N] [--cluster C] [--re-action]"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-bulk needs-ac {{.CLI_ARGS}}
+
+  refresh-active:
+    desc: "Pre-swarm freshness gate (#845 Story 4) -- detects drift between cached and live `gh issue view` for every issue referenced in vbrief/active/*.vbrief.json"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-refresh --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}