@deftai/directive-content 0.55.2 → 0.56.0

package/tasks/session.yml

@@ -0,0 +1,19 @@
+version: '3'
+
+# tasks/session.yml -- fail-closed session ritual state surface (#1348).
+#
+# Per conventions/task-caching.md: no sources/generates because the task
+# forwards user-facing flags (--defer, --json, --no-history) via CLI_ARGS.
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+tasks:
+  start:
+    desc: "Run quick-tier session-start ritual and write .deft/ritual-state.json (#1348). Flags: --defer step=reason / --json"
+    dir: '{{.USER_WORKING_DIR}}'
+    deps: [":ts:build"]
+    env:
+      PYTHONUTF8: "1"
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" session:start --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}

package/tasks/setup.yml

@@ -0,0 +1,37 @@
+version: '3'
+
+# Windows toolchain bootstrap fragment (#902).
+#
+# Wired into the parent Taskfile.yml `includes:` block under namespace key
+# `setup`, so the inner task `toolchain` is reachable as `task setup:toolchain`.
+# This fragment is independent of the root-level `setup` task in
+# Taskfile.yml (which configures git hooks via core.hooksPath); the two
+# coexist because go-task treats `setup` and `setup:toolchain` as distinct
+# task names.
+#
+# Companion script: scripts/setup_windows.ps1
+# Companion test:   tests/scripts/test_setup_windows.ps1
+# Issue: #902
+#
+# Per `conventions/task-caching.md` (#574): NO `sources:` / `generates:`
+# declarations on these tasks because user-facing behaviour is determined at
+# runtime by host platform detection and the script's idempotent probe-
+# before-install logic, not by file mtimes.
+
+vars:
+  # Resolve the deft framework root from this fragment's directory. The
+  # joinPath idiom mirrors the convention documented in the root Taskfile.yml
+  # header (#566): {{.TASKFILE_DIR}}/.. evaluated by go-task's eager
+  # templating yields a native-separator absolute path that pwsh / Bash can
+  # open on Windows / macOS / Linux.
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+tasks:
+  toolchain:
+    desc: "Bootstrap the Windows maintainer toolchain (Go, Python, uv, Task, gh) via winget. Windows-only -- no-op on macOS / Linux. -- task setup:toolchain"
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - cmd: pwsh -NoProfile -ExecutionPolicy Bypass -File "{{.DEFT_ROOT}}/scripts/setup_windows.ps1"
+        platforms: [windows]
+      - cmd: echo "setup:toolchain currently supports Windows only. See CONTRIBUTING.md for macOS / Linux setup."
+        platforms: [linux, darwin]

package/tasks/slice.yml

@@ -0,0 +1,69 @@
+version: '3'
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+# slice:* fragment (N7 / #1147).
+#
+# Exposes the canonical `task slice:record-existing` backfill verb plus
+# the companion `task slice:list` read surface. Both delegate to
+# `scripts/slice_record_existing.py`. Inner tasks below are
+# `internal: true` so the fragment-namespace forms (`slice:record-existing`
+# under the include key `slice`) are surfaced as user-facing aliases in
+# the root `Taskfile.yml` (mirrors the established triage:* / scope:*
+# pattern -- see Taskfile.yml header comment for why aliases live at the
+# root rather than here).
+#
+# CLI_ARGS is forwarded bare -- go-task's shell-escape pipeline misbehaves
+# on Windows when CLI_ARGS is wrapped in double quotes (#577). The driver
+# script owns argv parsing (including the dynamic `--wave-N=<csv>` flag
+# shape that argparse cannot natively model).
+#
+# Windows quoting limitation (#1231 / SLizard P2): because CLI_ARGS is
+# substituted bare, arguments containing spaces (e.g. `--notes "A note
+# with spaces"`) may be re-split by the shell before `argparse` sees
+# them. The operator-facing workaround is to either avoid spaces in flag
+# values (use a single token like `--notes=backfill-after-N7`) or to
+# write the rationale to a file and embed a pointer. The fully-quoted
+# `{{.CLI_ARGS | shellQuote}}` form misbehaves on Windows go-task per
+# #577; switching to a temp-file dispatch is the long-term fix and is
+# tracked under #1231. The same caveat applies to every other verb that
+# forwards `{{.CLI_ARGS}}` bare under `tasks/` (audit list: every fragment
+# in this directory does -- the pattern is repo-wide).
+#
+# `dir: '{{.USER_WORKING_DIR}}'` keeps Python CWD at the consumer project
+# root so `--project-root` / `--repo` resolution lands in the consumer
+# tree, not in deft's own checkout (#535 path-resolution invariant).
+#
+# `env: PYTHONUTF8: "1"` is a belt-and-suspenders guard for Windows
+# cp1252 default (#540); root Taskfile.yml also sets this.
+#
+# Per `conventions/task-caching.md` (#574) no `sources:` / `generates:`
+# because the verbs forward user-facing flags (`--dry-run`, `--force`,
+# `--wave-N=<csv>`, `--actor`, etc.) via {{.CLI_ARGS}}.
+
+tasks:
+  _ensure-ts:
+    internal: true
+    desc: "Build the TS engine before slice gates (#1828 s4)"
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - pnpm --dir "{{.DEFT_ROOT}}" run build
+
+  record-existing:
+    desc: "Retrofit a slices.jsonl entry for a hand-filed cohort (#1147 / N7). Windows note (#1231): CLI_ARGS is forwarded bare to argparse so values containing spaces (e.g. --notes \"A note with spaces\") may be re-split by the shell -- prefer hyphenated single-token values like --notes=backfill-after-N7. -- task slice:record-existing -- --umbrella=N --children=A,B,C [--wave-1=A,B] [--wave-2=C] [--actor=manual:operator] [--expected-close-signal=all-children-merged] [--sliced-at=ISO] [--notes=TEXT] [--dry-run] [--force] [--skip-validation] [--repo OWNER/NAME]"
+    internal: true
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - _ensure-ts
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" slice record-existing {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"
+
+  list:
+    desc: "List recorded slices in vbrief/.eval/slices.jsonl (umbrella + child count + actor + sliced_at). -- task slice:list [-- --json]"
+    internal: true
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - _ensure-ts
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" slice list {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"

package/tasks/spec.yml

@@ -0,0 +1,41 @@
+version: '3'
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+# spec tasks -- consumer-safe CWD + script resolution (#539, #540, #566).
+# Scripts are dispatched via {{.DEFT_ROOT}} (defined locally in this file's
+# `vars:` block via ``{{joinPath .TASKFILE_DIR ".."}}`` -- see
+# ../Taskfile.yml for why root-level definition is avoided) to keep the
+# path traversal-free and avoid the {{.TASKFILE_DIR}}/.. form that breaks
+# on Windows under `uv --project "{{.DEFT_ROOT}}" run python` (#566).
+
+tasks:
+  _ts-build:
+    internal: true
+    desc: "Build @deftai/cli dist/ before TS-backed render gates run (#1854 s2)."
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - pnpm --dir "{{.DEFT_ROOT}}" run build
+
+  validate:
+    desc: Validate that vbrief/specification.vbrief.json exists and is well-formed JSON
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - _ts-build
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" spec-validate "{{.USER_WORKING_DIR}}/vbrief/specification.vbrief.json"
+
+  render:
+    desc: Render vbrief/specification.vbrief.json to SPECIFICATION.md
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - _ts-build
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" spec-render "{{.USER_WORKING_DIR}}/vbrief/specification.vbrief.json" "{{.USER_WORKING_DIR}}/SPECIFICATION.md"
+
+  pipeline:
+    desc: Run full spec pipeline (validate then render)
+    cmds:
+      - task: validate
+      - task: render

package/tasks/swarm.yml

@@ -0,0 +1,85 @@
+version: '3'
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+tasks:
+  readiness:
+    desc: "Report whether story vBRIEFs are ready for concurrent swarm allocation"
+    dir: '{{.USER_WORKING_DIR}}'
+    deps: [":ts:build"]
+    env:
+      PYTHONUTF8: "1"
+    cmds:
+      # Keep CLI_ARGS bare; go-task shell-escapes pass-through args and quoting breaks globs/multi-arg calls.
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" swarm-readiness {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"
+
+  # swarm:launch -- deterministic headless launch engine (#1387). Turns an
+  # operator-supplied, pre-approved cohort into a ready-to-spawn launch
+  # manifest: resolves --stories (issue numbers / story ids / paths) against
+  # vbrief/active, enforces the #810 preflight and swarm:readiness gates per
+  # story (exiting non-zero and naming the FIRST failing story), and emits
+  # the C2 launch-manifest JSON carrying the #1378 allocation-context token
+  # for each agent. Bare {{.CLI_ARGS}} per the readiness/verify-review-clean
+  # convention -- go-task already shell-escapes pass-through args, so wrapping
+  # in double quotes breaks multi-arg / path forwarding (see tasks/vbrief.yml
+  # preflight for the full rationale and tests/content/test_taskfile_cli_args.py).
+  #
+  # Companion script: scripts/swarm_launch.py
+  # Companion test:   tests/cli/test_swarm_launch.py
+  launch:
+    desc: "Resolve a pre-approved cohort, enforce the #810 + swarm:readiness gates and sub-agent backend policy per story, and emit the launch-manifest JSON (#1387, #1531e)"
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" swarm-launch {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"
+
+  # swarm:routing-set -- record an operator coding sub-agent model decision
+  # (#1739) into the gitignored, per-machine .deft/routing.local.json keyed by
+  # (dispatch_provider, worker_role). Supersedes the swarmSubagentBackend enum
+  # (#1531 / #1735): the resolved model is threaded into the launch manifest
+  # (resolved_model / model_source) so dispatch can actually honor it.
+  routing-set:
+    desc: "Record an operator coding sub-agent model decision (#1739): --role <role> (--model <slug> | --harness-default) [--provider <p>]. Writes the gitignored, per-machine .deft/routing.local.json."
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" swarm-routing-set {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"
+
+  # swarm:verify-review-clean -- cohort-level CLEAN verification gate (#1364).
+  # Mandate the monitor invokes this after Phase 6 pollers report and BEFORE
+  # the Phase 5 -> 6 merge discussion. Re-uses the Greptile rolling-summary
+  # parser from scripts/pr_merge_readiness.py so the per-PR merge gate and
+  # the cohort gate stay in lockstep -- a parser fix lands in both surfaces
+  # at once. The companion script writes its own diagnostics; this Taskfile
+  # target just forwards CLI_ARGS bare per the established convention.
+  #
+  # Companion script: scripts/swarm_verify_review_clean.py
+  # Companion test:   tests/cli/test_swarm_verify_review_clean.py
+  # Skill citation:   skills/deft-directive-swarm/SKILL.md Phase 5 Exit Condition + Phase 5 -> 6 gate
+  verify-review-clean:
+    desc: "Verify EVERY PR in a swarm cohort is CLEAN on current HEAD (confidence > 3, no P0/P1, not errored) before raising the Phase 5 -> 6 merge gate (#1364)"
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" swarm-verify-review-clean {{.CLI_ARGS}}
+
+  # swarm:complete-cohort -- deterministic cohort completion sweep (#1487).
+  # The REQUIRED Phase 6 step that moves a finished cohort's story vBRIEFs
+  # active/ -> completed/ and completes the decompose-created epic parents
+  # once all their children are settled. Routes every move through
+  # scripts/scope_lifecycle.py so the #1485 (child-move) and #1487 (parent-
+  # move) reference maintenance keeps `task vbrief:validate` green with no
+  # manual repair. Bare {{.CLI_ARGS}} per the readiness / verify-review-clean
+  # convention -- go-task already shell-escapes pass-through args, so wrapping
+  # in double quotes breaks multi-arg / glob forwarding.
+  #
+  # Companion script: scripts/swarm_complete_cohort.py
+  # Companion test:   tests/cli/test_swarm_complete_cohort.py
+  # Skill citation:   skills/deft-directive-swarm/SKILL.md Phase 6 cohort completion sweep
+  complete-cohort:
+    desc: "Sweep a finished swarm cohort's stories active/ -> completed/ and complete their epic parents, keeping vbrief:validate green (#1487)"
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" swarm-complete-cohort {{.CLI_ARGS}} --project-root "{{.USER_WORKING_DIR}}"

package/tasks/toolchain.yml

@@ -0,0 +1,13 @@
+version: '3'
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+tasks:
+  check:
+    desc: Verify required toolchain is installed (go, uv, git, gh, node, pnpm)
+    deps: [":ts:build"]
+    env:
+      PYTHONUTF8: "1"
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" toolchain:check

package/tasks/triage-actions.yml

@@ -0,0 +1,94 @@
+version: '3'
+
+# tasks/triage-actions.yml -- per-issue triage commands (#845 Story 3).
+#
+# Wired into the parent Taskfile.yml `includes:` block under namespace key
+# `triage-actions` (#845 Story 6). Inner task names below dropped the
+# `triage:` prefix in #913 -- the prior names produced a doubled prefix
+# (`triage-actions:triage:accept`) under go-task's include-namespace
+# concatenation. Combined with `internal: true` the fragment-namespace
+# forms (`triage-actions:accept` / `triage-actions:reject` / ...) are
+# hidden from `task -l`; the documented `task triage:accept` / `triage:reject`
+# / `triage:defer` / `triage:needs-ac` / `triage:mark-duplicate` /
+# `triage:status` / `triage:reset` / `triage:history` surface lives as
+# root-level alias tasks in Taskfile.yml that delegate here.
+#
+# Per `conventions/task-caching.md`: NO `sources:` / `generates:` because every
+# target accepts user-facing flags via `{{.CLI_ARGS}}` (--issue, --repo,
+# --reason, --of, --comment, --actor) -- the cached `cmds:` skip would
+# silently swallow recovery flags. Same rationale that gated `task release`
+# (#74), `task pr:check-protected-issues` (#702), and `task verify:encoding`
+# (#798).
+#
+# Companion script: scripts/triage_actions.py
+# Companion tests:  tests/test_triage_actions.py
+# Upstream contracts (frozen): scripts/candidates_log.py (#845 Story 2 audit log),
+#                              scripts/cache.py          (#883 Story 2 unified cache).
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+tasks:
+  accept:
+    desc: "Accept an issue for triage. Records an audit entry. (#845 Story 3)"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-actions accept {{.CLI_ARGS}}
+
+  reject:
+    desc: "Reject an issue. Closes upstream via gh + applies triage-rejected label; rolls audit back on gh failure. (#845 Story 3)"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-actions reject {{.CLI_ARGS}}
+
+  defer:
+    desc: "Defer an issue. Records an audit entry. (#845 Story 3)"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-actions defer {{.CLI_ARGS}}
+
+  needs-ac:
+    desc: "Mark an issue as needing acceptance criteria + post AC-request comment upstream. (#845 Story 3)"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-actions needs-ac {{.CLI_ARGS}}
+
+  mark-duplicate:
+    desc: "Link an issue as a duplicate of another (validated against Story 1 cache). (#845 Story 3)"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-actions mark-duplicate {{.CLI_ARGS}}
+
+  status:
+    desc: "Print the latest triage decision for an issue. Read-only. (#845 Story 3)"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-actions status {{.CLI_ARGS}}
+
+  reset:
+    desc: "Reset an issue's triage state. Appends a reset audit entry referencing prior; does NOT delete history. (#845 Story 3)"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-actions reset {{.CLI_ARGS}}
+
+  history:
+    desc: "Print the full triage timeline for an issue, ordered by timestamp. Read-only. (#845 Story 3)"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-actions history {{.CLI_ARGS}}

package/tasks/triage-bootstrap.yml

@@ -0,0 +1,43 @@
+version: '3'
+
+# Triage v1 bootstrap fragment (#845 Story 6).
+#
+# Standalone fragment: this file is wired into the parent Taskfile.yml via the
+# `includes:` block (see Taskfile.yml `## triage v1 fragment includes` comment).
+# When included under namespace key `triage-bootstrap`, the inner task
+# `bootstrap` is reachable as `task triage-bootstrap:bootstrap`. The parent
+# Taskfile.yml additionally exposes the user-facing alias `task triage:bootstrap`
+# which delegates here.
+#
+# Companion files in the four-fragment cluster (#845):
+#   tasks/triage-cache.yml      (Story 1 -- cache populate + show)
+#   tasks/triage-actions.yml    (Story 3 -- accept/reject/defer/...)
+#   tasks/triage-bulk.yml       (Story 4 -- bulk ops + freshness)
+#   tasks/triage-bootstrap.yml  (Story 6 -- this file)
+#
+# Companion script: scripts/triage_bootstrap.py
+# Companion test:   tests/test_triage_bootstrap.py
+#
+# Per `conventions/task-caching.md` (#574): NO `sources:` / `generates:`
+# declarations on this task because user-facing recovery flags
+# (`--repo`, `--fetch-timeout-s`, `--json`, `--quiet`) are forwarded via
+# {{.CLI_ARGS}} and go-task's incremental-build cache layer would silently
+# swallow them. The Story 3 rebind dropped the v0.25.x `--skip-gitcrawl`
+# install path entirely (#951): the script's argparse never accepted it.
+
+vars:
+  # Resolve the deft framework root from this fragment's directory. The
+  # joinPath idiom mirrors the existing convention documented in the root
+  # Taskfile.yml header (#566): `{{.TASKFILE_DIR}}/..` evaluated by go-task's
+  # eager templating yields a native-separator absolute path that
+  # `node .../bin.js` can open on Windows / macOS / Linux.
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+tasks:
+  bootstrap:
+    desc: "Idempotent triage v1 installer (#845): populate cache, backfill audit log, ensure gitignore for .deft-cache/ and vbrief/.eval/. Re-runnable; per-step progress on stderr; cache:fetch-all wall-clock cap (#952). -- task triage:bootstrap [-- --repo OWNER/NAME] [--limit N] [--state open|closed|all] [--fetch-timeout-s N] [--quiet] [--json]"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-bootstrap --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}

package/tasks/triage-bulk.yml

@@ -0,0 +1,75 @@
+version: '3'
+
+# tasks/triage-bulk.yml -- Story 4 of #845 + #915 cache-walk re-enable.
+#
+# Wired into the parent ../Taskfile.yml `includes:` block under namespace
+# key `triage-bulk` (#845 Story 6). The user-facing `task triage:bulk-accept`
+# / `triage:bulk-reject` / `triage:bulk-defer` / `triage:bulk-needs-ac` /
+# `triage:refresh-active` surface lives as root-level alias tasks in
+# Taskfile.yml that delegate here (#913); inner tasks below are
+# `internal: true` so the fragment-namespace forms (`triage-bulk:bulk-*`)
+# are hidden from `task -l`.
+#
+# The disable-gate `cmds:` blocks introduced by PR #916 (#915 hot-fix) were
+# REVERSED once scripts/triage_bulk.py was rewritten to walk the local
+# cache instead of live `gh issue list`. As of #883 Story 3 the cache walk
+# consumes the unified `cache:get` surface
+# (`.deft-cache/github-issue/<owner>/<repo>/<N>/`); the four `bulk-*`
+# targets continue to invoke triage_bulk.py directly. The cache-empty
+# hard-fail (exit 2) and Tier-2 audit-log short-circuit are enforced
+# inside triage_bulk.py itself (#915 fix).
+#
+# Per `conventions/task-caching.md` (#574): every target here accepts user
+# flags via `{{.CLI_ARGS}}` (--label, --author, --age-days, --cluster,
+# --reason, --repo, --re-action) so MUST NOT declare `sources:` /
+# `generates:` -- the cached cmds: skip would silently swallow the
+# recovery flag.
+#
+# Path resolution mirrors the convention from tasks/issue.yml + tasks/policy.yml:
+# `DEFT_ROOT` is defined locally via `joinPath .TASKFILE_DIR ".."` so
+# `node .../bin.js` resolves cleanly on Windows under go-task's mvdan/sh
+# interpreter (#566).
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+tasks:
+  bulk-accept:
+    desc: "Bulk accept candidates (#845 Story 4) -- task triage:bulk-accept -- --repo OWNER/NAME [--label L] [--author A] [--age-days N] [--cluster C] [--re-action]"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-bulk accept {{.CLI_ARGS}}
+
+  bulk-reject:
+    desc: "Bulk reject candidates (#845 Story 4) -- task triage:bulk-reject -- --repo OWNER/NAME --reason 'why' [--label L] [--author A] [--age-days N] [--cluster C] [--re-action]"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-bulk reject {{.CLI_ARGS}}
+
+  bulk-defer:
+    desc: "Bulk defer candidates (#845 Story 4) -- task triage:bulk-defer -- --repo OWNER/NAME [--label L] [--author A] [--age-days N] [--cluster C] [--re-action]"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-bulk defer {{.CLI_ARGS}}
+
+  bulk-needs-ac:
+    desc: "Bulk needs-ac candidates (#845 Story 4) -- task triage:bulk-needs-ac -- --repo OWNER/NAME [--label L] [--author A] [--age-days N] [--cluster C] [--re-action]"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-bulk needs-ac {{.CLI_ARGS}}
+
+  refresh-active:
+    desc: "Pre-swarm freshness gate (#845 Story 4) -- detects drift between cached and live `gh issue view` for every issue referenced in vbrief/active/*.vbrief.json"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-refresh --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}

package/tasks/triage-classify.yml

@@ -0,0 +1,30 @@
+version: '3'
+
+# tasks/triage-classify.yml -- auto-classification surface (#1129 / D10).
+#
+# Wired into the parent Taskfile.yml via the `includes:` block under
+# namespace key `triage-classify` (mirroring the four-fragment cluster
+# pattern from #845 / #1131). When included, the inner task `classify`
+# is reachable as `task triage-classify:classify`. The parent Taskfile
+# exposes the documented `task triage:classify` alias.
+#
+# Per `conventions/task-caching.md` (#574): NO `sources:` / `generates:`
+# declarations on this task because user-facing flags (`--list`,
+# `--validate`, `--project-root`) are forwarded via {{.CLI_ARGS}} and
+# go-task's incremental-build cache layer would silently swallow them.
+#
+# Companion script: scripts/triage_classify.py (+ scripts/_triage_classify_cli.py)
+# Companion tests:  tests/test_triage_classify.py
+# Current Shape:    https://github.com/deftai/directive/issues/1129#issuecomment-4471901622
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+tasks:
+  classify:
+    desc: "Inspect / validate plan.policy.triageAutoClassify[] + triageHoldMarkers[] (#1129 / D10). -- task triage:classify -- [--list | --validate]"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-classify --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}

package/tasks/triage-queue.yml

@@ -0,0 +1,50 @@
+version: '3'
+
+# tasks/triage-queue.yml -- ranked triage queue + per-item show + audit
+# surface (#1128 / D11 of #1119).
+#
+# Wired into the parent Taskfile.yml via the `includes:` block under
+# namespace key `triage-queue` (matching the four-fragment cluster pattern
+# from #845 and the D12 #1131 pattern landed in tasks/triage-scope.yml).
+# When included that way, the inner tasks `queue` / `show` / `audit` are
+# reachable as `task triage-queue:queue` / `task triage-queue:show` /
+# `task triage-queue:audit`. The parent Taskfile exposes the documented
+# `task triage:queue` / `task triage:show` / `task triage:audit` aliases.
+#
+# Per `conventions/task-caching.md` (#574): NO `sources:` / `generates:`
+# declarations because each inner task accepts user-facing flags
+# (`--repo`, `--limit`, `--format=json`, `--vbrief-staleness`,
+# `--project-root`, `--cache-root`, `--audit-log`) via {{.CLI_ARGS}} and
+# go-task's incremental-build cache layer would silently swallow them.
+#
+# Companion script: scripts/triage_queue.py (+ scripts/_triage_queue_cli.py)
+# Companion tests:  tests/test_triage_queue.py
+# Current Shape:    https://github.com/deftai/directive/issues/1128#issuecomment-4471272093
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+tasks:
+  queue:
+    desc: "Print the ranked triage queue (#1128 / D11). -- task triage:queue [-- --repo OWNER/NAME] [--limit N]"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-queue queue --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}
+
+  show:
+    desc: "Per-issue triage detail (#1128 / D11). -- task triage:show -- <N> [--repo OWNER/NAME]"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-queue show --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}
+
+  audit:
+    desc: "Audit-log surface (#1128 / D11, #1180). -- task triage:audit [-- --format=text|json] [--vbrief-staleness] [--since=<window>] [--action=<verb>] [--repo OWNER/NAME]"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-queue audit --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}

package/tasks/triage-reconcile.yml

@@ -0,0 +1,29 @@
+version: '3'
+
+# tasks/triage-reconcile.yml -- `task triage:reconcile` audit-log self-heal (#1468).
+#
+# Wired into the parent Taskfile.yml via the `includes:` block under namespace
+# key `triage-reconcile`. The inner task `reconcile` is reachable as
+# `task triage-reconcile:reconcile`; the parent Taskfile exposes the documented
+# `task triage:reconcile` alias.
+#
+# Per `conventions/task-caching.md` (#574): NO `sources:` / `generates:`
+# declarations because user-facing flags (`--repo`, `--dry-run`, `--json`,
+# `--project-root`) are forwarded via {{.CLI_ARGS}} and go-task's
+# incremental-build cache layer would silently swallow them.
+#
+# Companion script: scripts/triage_reconcile.py
+# Companion tests:  tests/test_triage_reconcile.py
+# Pattern reference: tasks/triage-bootstrap.yml (#845 Story 6).
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+tasks:
+  reconcile:
+    desc: "Self-heal the triage audit log (#1468): backfill missing `accept` decisions for proposed/pending/active vBRIEFs carrying an x-vbrief/github-issue reference, without a cache re-fetch. Idempotent. -- task triage:reconcile [-- --repo OWNER/NAME] [--dry-run] [--json]"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-reconcile --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}

package/tasks/triage-scope-drift.yml

@@ -0,0 +1,29 @@
+version: '3'
+
+# tasks/triage-scope-drift.yml -- subscription drift detection (#1133 / D14).
+#
+# Wired into the parent Taskfile.yml via the `includes:` block under namespace
+# key `triage-scope-drift`. When included that way, the inner task
+# `scope-drift` is reachable as `task triage-scope-drift:scope-drift`. The
+# parent Taskfile exposes the documented `task triage:scope-drift` alias.
+#
+# Per `conventions/task-caching.md` (#574): NO `sources:` / `generates:`
+# declarations on this task because user-facing flags (`--ignore-label`,
+# `--ignore-milestone`, `--threshold`, `--cache-root`) are forwarded via
+# {{.CLI_ARGS}} and go-task's incremental-build cache layer would silently
+# swallow them.
+#
+# Companion script: scripts/triage_scope_drift.py (+ shims).
+# Companion tests:  tests/test_triage_scope_drift.py.
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+tasks:
+  scope-drift:
+    desc: "Detect subscription drift -- unsubscribed labels/milestones on cached open issues (#1133 / D14). -- task triage:scope-drift [-- --ignore-label=L | --ignore-milestone=M]"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-scope-drift --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}

package/tasks/triage-scope.yml

@@ -0,0 +1,31 @@
+version: '3'
+
+# tasks/triage-scope.yml -- typed plan.policy.triageScope[] surface (#1131 / D12).
+#
+# Wired into the parent Taskfile.yml via the `includes:` block under namespace
+# key `triage-scope` (matching the four-fragment cluster pattern from #845).
+# When included that way, the inner task `scope` is reachable as
+# `task triage-scope:scope`. The parent Taskfile exposes the documented
+# `task triage:scope` alias.
+#
+# Per `conventions/task-caching.md` (#574): NO `sources:` / `generates:`
+# declarations on this task because user-facing flags (`--list`,
+# `--refresh-denominator`, `--repo`, `--count`, `--cache-root`) are forwarded
+# via {{.CLI_ARGS}} and go-task's incremental-build cache layer would
+# silently swallow them.
+#
+# Companion script: scripts/triage_scope.py (+ scripts/_triage_scope_cli.py)
+# Companion tests:  tests/test_triage_scope.py
+# Current Shape:    https://github.com/deftai/directive/issues/1131#issuecomment-4471901494
+
+vars:
+  DEFT_ROOT: '{{joinPath .TASKFILE_DIR ".."}}'
+
+tasks:
+  scope:
+    desc: "Inspect / mutate / diff the typed plan.policy.triageScope[] subscription + triageScopeIgnores[] (#1131 / D12, #1133 / D14, #1182 / D14c). -- task triage:scope -- [--list] [--add-label=L | --add-milestone=M | --ignore-label=L] [--diff-from-upstream --repo OWNER/NAME] [--refresh-denominator --repo OWNER/NAME --count N]"
+    internal: true
+    deps: [":ts:build"]
+    dir: '{{.USER_WORKING_DIR}}'
+    cmds:
+      - node "{{.DEFT_ROOT}}/packages/cli/dist/bin.js" triage-scope --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}