@deftai/directive-content 0.91.0 → 0.93.0

package/deployments/README.md

@@ -8,6 +8,14 @@ Platform-specific guidance for deployment environments (cloud.gov, Cloudflare, A
 - ~ Keep platform guidance separate from core Deft rules
 - ~ Enable export of platform instructions for external tools (e.g., Copilot)
 
+## Relation to CI/CD
+
+This layer covers **where and how you deploy** runtime apps. For **CI runner
+migration** (Blacksmith tiered vCPU sizing, agent migration prompts), use the
+optional [`ci-cd/`](../ci-cd/README.md) layer instead. Platform modules may still
+include a `cicd.md` for deploy-pipeline steps; that is not a substitute for
+runner-tier guidance under `ci-cd/`.
+
 ## Module Structure
 
 Create a directory per platform:

package/docs/deft-directive-disable.md

@@ -0,0 +1,96 @@
+# Temporary kill-switch: `.deft-directive-disable`
+
+Use a **root file flag** to turn Directive **enforcement** off for local testing (A/B, DevHammer, ceremony vs loop) **without** permanent project opt-out and **without** deleting the deposit.
+
+Tracker: [#3039](https://github.com/deftai/directive/issues/3039).
+
+**Not** permanent opt-out — that is [`.no-deft-directive`](./no-deft-directive.md) (#2926).
+
+## Filename and location
+
+```text
+.deft-directive-disable
+```
+
+- **Exact name:** lowercase `.deft-directive-disable`
+- **Location:** project / workspace **root only**
+- **Content:** empty file or a short `#` comment. Presence is the flag. No schema.
+- **Git:** **Must be gitignored** (deposit baseline includes this entry). Committed / tracked flag is a misconfig: doctor **warns**, and enforcement is **not** disabled (repo-controlled content must not turn off hooks for clones).
+
+## Distinct from permanent opt-out
+
+| File | Intent |
+|------|--------|
+| [`.no-deft-directive`](./no-deft-directive.md) | Permanent: project does not use Directive. Flag + deposit is **inconsistent**. |
+| `.deft-directive-disable` | Temporary: testing kill-switch. **Deposit OK**. |
+
+## Behavior
+
+| Surface | When flag present |
+|---------|-------------------|
+| **Doctor** | Status **disabled (test kill-switch)**; **not** the #2926 flag+deposit dirty path; prints full recovery (file gone + new session). |
+| **Agent** | Always-on AGENTS contract: stop further Directive process load; echo recovery. |
+| **CLI** (`session:start`, ritual paths) | Disabled + recovery; no ritual write / no half-DD automation. |
+| **Host hooks** | SessionStart / PreToolUse / compact skip ritual and enforcement. |
+
+Deposit (`.deft/core`) **may remain**. Init/update are not blocked by this flag alone (unlike permanent opt-out).
+
+## Recovery (hysteresis)
+
+Directive is **fully operational** only when:
+
+1. **`.deft-directive-disable` is absent**, and
+2. A **new agent session** has been started after the file was removed
+
+Canonical recovery message:
+
+```text
+Directive is DISABLED for this project via root `.deft-directive-disable` (test/local kill-switch).
+Deposit may still be present; enforcement (hooks, session ritual, automation) will not run.
+
+To fully re-enable Directive:
+  1. Delete the file:  rm .deft-directive-disable   (or equivalent)
+  2. Start a NEW agent session (reload AGENTS / host skills / hooks)
+Until both are done, Directive is not fully operational.
+```
+
+## Precedence
+
+1. `.deft-directive-disable` → test kill-switch (deposit OK; recovery = delete + new session)
+2. `.no-deft-directive` → permanent opt-out (#2926)
+3. Else normal Directive
+
+If **both** flags are present: one combined message; permanent install semantics still apply for init/update.
+
+## Consumer note (A/B / DevHammer)
+
+Typical arm for “without Directive enforcement”:
+
+```bash
+# Ensure ignore entry exists (init/update baseline)
+# Then:
+touch .deft-directive-disable
+# Start a new agent session — enforcement off; deposit may stay.
+```
+
+Re-enable:
+
+```bash
+rm .deft-directive-disable
+# Start a NEW agent session
+```
+
+## Non-goals (v1)
+
+- ⊗ Auto-delete `.deft/` or uninstall deposit
+- ⊗ Replace or weaken `.no-deft-directive`
+- ⊗ Rewrite AGENTS to a stub on disable
+- ⊗ Org-remote kill switch
+- ⊗ Nested monorepo package roots
+- ⊗ `DEFT_DISABLED=1` env (optional later)
+
+## Related
+
+- [no-deft-directive.md](./no-deft-directive.md) — permanent opt-out
+- [getting-started.md](./getting-started.md) — install and first project
+- `session:start`, `doctor`, host hooks (SessionStart / PreToolUse / compact)

package/docs/directive-lifecycle.md

@@ -65,6 +65,22 @@ framework:
 | **Ship** | PR merge and release — `task pr:*` and [`deft-directive-release`](../skills/deft-directive-release/SKILL.md). |
 | **Issues / Features** | GitHub issues and feature requests mirrored into `.deft-cache/` and surfaced as triage candidates. |
 
+## Delivery integrity vs deploy / UAT (#3041)
+
+`scope:complete` and swarm cohort completion mark **lifecycle bookkeeping**, not environment
+green. For **code-bearing** scopes, delivered completion requires durable proof that the
+implementation reached the configured **delivery branch** (`plan.policy.deliveryBranch`,
+defaulting to the repo default branch) — typically: PR `base.ref` equals that branch, and the
+merge commit is an ancestor of the refreshed remote delivery ref. A merge into an intermediate
+feature/integration branch is **not** delivery.
+
+Handoff states that Git can assert are distinct: `implemented` → `pr_open` →
+`merged_to_integration` → `delivered`. **Deployed** and **UAT verified** are separate evidence
+axes and are never inferred from Git alone. Explicit non-delivery dispositions
+(`accepted_not_delivered`, `superseded`, `experiment_archived`, `cancelled`) complete the
+lifecycle without claiming the work shipped. Legacy completed records without completion
+provenance surface as `unknown` / `unverified`, not retroactively `delivered`.
+
 ## Why it loops
 
 The central claim of the picture is that Directive is **reiterative**. Strategy analysis is

package/docs/getting-started.md

@@ -145,3 +145,5 @@ Full command reference for every triage and cache verb lives in [`commands.md`
 **Writing:** For docs, issues, and PR prose, follow [writing-ste100.md](./writing-ste100.md) (short controlled English; #2927).
 
 **Opt out:** To mark a repo as not using Directive, add root [`.no-deft-directive`](./no-deft-directive.md) (#2926). Tools skip install and session ritual when that file is present.
+
+**Temporary test kill-switch:** For local A/B or DevHammer without permanent opt-out, use root [`.deft-directive-disable`](./deft-directive-disable.md) (#3039). Deposit may stay; re-enable by deleting the file and starting a new agent session.

package/docs/no-deft-directive.md

@@ -82,6 +82,7 @@ When `deft-directive-setup` runs:
 
 ## Related
 
+- [deft-directive-disable.md](./deft-directive-disable.md) — **temporary** test/local kill-switch (deposit OK; not this flag)
 - [getting-started.md](./getting-started.md) — install and first project
 - [product-signal.md](./product-signal.md) — optional partner signal (defaults off; flag still wins locally)
 - `session:start`, `doctor`, `directive init`, `directive update`

package/docs/openclaw-agent-host.md

@@ -18,6 +18,52 @@ Epic spine: [#2874](https://github.com/deftai/directive/issues/2874). This doc i
 
 If you are installing Directive for the first time, start at [QUICK-START.md](../QUICK-START.md) or [getting-started.md](./getting-started.md), then return here for host-specific expectations.
 
+Native **file-host** slash/prompt command registration (thin wrappers under `.claude/commands/`, `.cursor/commands/`, and peers) is documented in [slash-multi-host.md](./slash-multi-host.md) (epic #55). **OpenClaw L2 product commands** are a separate skills adapter ([#3064](https://github.com/deftai/directive/issues/3064)) — see § L2 product commands below. That surface is separate from always-pin skills (#3001/#3008), spawn/review mapping, and skill-discovery residual [#75](https://github.com/deftai/directive/issues/75).
+
+---
+
+## L2 product commands (OpenClaw adapter — #3064)
+
+OpenClaw does **not** load repo-local command files the way Claude/Cursor do. L2 parity for the **exactly 13** product commands is delivered as **thin user-invocable skills** deposited into the OpenClaw **main workspace skills** root (real copies — not symlink-escape into npm; same spirit as always-pins).
+
+### Hybrid layout (LockedDecisions D1–D3)
+
+| Artifact | OpenClaw slug | Role |
+|----------|---------------|------|
+| **Router** | `deft` | Preferred **native/menu-facing** entry (Telegram `BOT_COMMANDS` budget) |
+| **13 product skills** | e.g. `deft_run_interview`, `deft_continue` | Invocable as `/<slug>` text skills for discoverability |
+
+Stable map (logical slash → OpenClaw slug, `a-z0-9_`, max 32). Colons never appear in OC slugs. Example: `/deft:directive:run:interview` → `deft_run_interview`. Full table lives in `packages/core/src/slash/openclaw-slugs.ts` and is unit-tested for bijectivity against `listProductCommands()`.
+
+Bodies stay **thin** (L5): frontmatter + short dispatch pointer to the same content-relative targets as file hosts (`generateThinWrappers()` IR). ⊗ Inline full strategy/skill bodies. ⊗ Add `openclaw` to `HOST_COMMAND_LAYOUTS` / invent `.openclaw/commands/`.
+
+### Native menu / `commands.nativeSkills` (D3)
+
+| Setting | Expected behavior |
+|---------|-------------------|
+| Prefer menu safety | Use the **`deft` router** as the primary bot menu entry; invoke product work via router args or typed `/deft_run_*` skill text |
+| `commands.nativeSkills` **on** / aggressive native registration | All `user-invocable: true` skills (router + 13 + always-pins) **may** flood Telegram → `BOT_COMMANDS_TOO_MUCH` risk |
+| `auto` / selective | Prefer **router-first** for menu slots; keep the 13 invocable as skill/text without requiring 13 menu slots |
+| **off** | Skills remain loadable; operators type skill names / prose — no native menu flood |
+
+! Do not require 13 Telegram bot menu slots for L2 parity.
+
+### Wire path (D4–D5)
+
+1. **Primary recovery:** `deft doctor --fix` when OpenClaw is detected — deposits managed L2 skills next to always-pins.
+2. **init/update:** deposits when OpenClaw signals are present and `plan.policy.openClawProductCommands` is not false. **Fail-closed** when OpenClaw is not detected (no writes on non-OC machines).
+3. Multi-seat: `deft doctor --fix --openclaw-all-agents` (same flag as always-pins).
+4. Opt-out: `plan.policy.openClawProductCommands: false` — removes **managed** L2 thin skills only; preserves consumer custom skills at the same slug.
+5. After deposit: **restart the OpenClaw gateway or start a new session** so `available_skills` refreshes.
+
+Always-pin skills (`deft-directive-build`, `pre-pr`, `review-cycle`, `swarm`) remain a **different** surface from L2 product commands (`/deft:directive:run:interview`, `/deft:continue`, …).
+
+Inspect policy:
+
+```bash
+deft policy:show --field=openClawProductCommands
+```
+
 ---
 
 ## Mental model (host class)

package/docs/skill-discovery-hosts.md

@@ -0,0 +1,84 @@
+# Multi-host skill discovery (#75)
+
+Directive deposits **thin skill discovery pointers** so agent hosts that do not
+scan `.agents/skills/` still auto-load the same consumer skill inventory.
+
+## Canonical vs additional paths
+
+| Path | Role |
+|------|------|
+| `.agents/skills/` | **Canonical** consumer discovery (landed with #94 / install `writeAgentsSkills`) |
+| `.claude/skills/` | Claude Code |
+| `.codex/skills/` | OpenAI Codex |
+| `.github/skills/` | GitHub Copilot |
+| `.cursor/skills/` | Cursor (when not fully covered by optional OpenPackage install) |
+
+Additional host paths **mirror** the same thin `SKILL.md` inventory as
+`.agents/skills/`. They do not fork independent skill bodies. Full skill text
+lives under `.deft/core/skills/…` (or `.deft/core/SKILL.md` for the root
+`deft` skill).
+
+## Thin pointers only
+
+Each deposited `SKILL.md` is a short frontmatter + `Read and follow: .deft/core/…`
+line. Init/update **must not** copy full skill process docs into host skill dirs
+(those rot on framework upgrade).
+
+Windows: deposit uses ordinary file writes (contained projection). Elevated
+symlinks are **not** required.
+
+## When deposit runs
+
+- `directive init` / greenfield scaffold — after `.agents/skills/`
+- `directive update` / refresh — every refresh (idempotent rewrite of managed
+  pointers when content drifts)
+
+## Per-host opt-out
+
+Typed policy: `plan.policy.hostSkillDiscovery`
+
+```json
+{
+  "plan": {
+    "policy": {
+      "hostSkillDiscovery": {
+        "claude": true,
+        "cursor": true,
+        "codex": true,
+        "github": false
+      }
+    }
+  }
+}
+```
+
+- Default: all four residual hosts **enabled**
+- Inspect: `deft policy:show --field=hostSkillDiscovery`
+- Opt-out skips deposit for that host only (does not remove unrelated user files)
+
+Distinct from `plan.policy.hostHooks` (hook JSON deposit, #2752).
+
+## Relationship to #55 slash registration
+
+| | **#75 skill discovery** | **#55 slash / commands** |
+|--|-------------------------|---------------------------|
+| Artifact | Host **skill** dirs (`…/skills/`) | Host **command/prompt** files (`…/commands/`, `…/prompts/`) |
+| Product set | Existing consumer skill inventory | Locked product slash set (L2) |
+| Content | Thin skill pointer `SKILL.md` | Thin command wrapper (~40–100 tok) |
+| Deposit | This doc / `skill-discovery-deposit` | Epic children #3052–#3055 |
+
+Do **not** treat slash completion as closing skill-path residual, or skill
+deposit as registering slash commands.
+
+## Relationship to OpenPackage
+
+OpenPackage (#2462 / #2370) is an optional tiered pack install for some hosts.
+It does **not** replace init/update multi-host skill discovery for the residual
+matrix above. Close #75 only when residual host paths are deposited (or
+explicitly opted out), not solely because OpenPackage exists.
+
+## Implementation pointers
+
+- Layouts + policy: `packages/core/src/init-deposit/skill-discovery-hosts.ts`
+- Deposit: `packages/core/src/init-deposit/skill-discovery-deposit.ts`
+- Shared inventory with `.agents/skills/`: `CONSUMER_SKILL_DISCOVERY_INVENTORY`

package/docs/skill-pin-policy.md

@@ -69,9 +69,16 @@ The managed AGENTS.md section `## Skill pin policy (#2508)` carries the framewor
 
 Skills-pack entries (`content/packs/skills/skills-pack-0.1.json`) MAY record `"alwaysPin": true` on metadata-only rows so slice tooling and future gates can list pins without parsing AGENTS.md. The authoritative runtime list for agents remains the AGENTS.md pin section; the catalog field is advisory for tooling (#1535).
 
+## Through-merge is false-negative sensitive (#3032)
+
+Operator phrases such as **through merge**, **drive to merge**, **land/ship issue**, or explicit **drive-to: merge-ready** often start implementation **without** a clear `swarm` keyword. That is the same false-negative class this policy targets: the parent may code instead of loading `deft-directive-swarm` and dispatching a worker.
+
+! AGENTS.md carries short always-on `!` / `⊗` bullets under **Through-merge worker dispatch (#3032)** (agents-entry + maintainer multi-agent doctrine). N=1 still uses the swarm/solo launch path; parent MUST NOT implement when background subagent/worktree dispatch is available. See also swarm Phase 0 `references/core-phase-0.md` and #1880 Gap C.
+
 ## Related
 
 - Skills Index: `REFERENCES.md` § Skills Index
 - Progressive disclosure: #2484
 - Trigger coverage evals: #1586
 - Review-surface precedence: #2308 / `deft-directive-review-cycle`
+- Through-merge parent-must-dispatch: #3032 / AGENTS.md `## Through-merge worker dispatch (#3032)`

package/docs/slash-multi-host.md

@@ -0,0 +1,241 @@
+# Multi-host native slash-command registration
+
+Operator guide for **host-native** Directive slash and prompt files after epic [#55](https://github.com/deftai/directive/issues/55).
+
+This surface is **not** skill auto-discovery ([#75](https://github.com/deftai/directive/issues/75)). Skills stay under skill deposit paths. Slash registration writes thin command/prompt wrappers so hosts can show `/deft…` (or the host equivalent) in autocomplete.
+
+Legend (RFC2119): `!`=MUST, `~`=SHOULD, `≉`=SHOULD NOT, `⊗`=MUST NOT, `?`=MAY.
+
+Product locks: **LockedDecisions L1–L10** on [#55](https://github.com/deftai/directive/issues/55). Code waves: [#3052](https://github.com/deftai/directive/issues/3052) generator, [#3053](https://github.com/deftai/directive/issues/3053) emitters, [#3054](https://github.com/deftai/directive/issues/3054) deposit. This page is the docs/dogfood child [#3055](https://github.com/deftai/directive/issues/3055).
+
+Prose SoT for routing and deprecation aliases: [commands.md § Slash Command Namespaces](../commands.md#slash-command-namespaces-418--1670).
+
+---
+
+## What you get
+
+On `directive init` and `deft update`, Directive deposits **exactly 13** thin wrappers (L2) for every **enabled** host that has a real emitter (L6).
+
+| Host id | Directory | Surface |
+|---------|-----------|---------|
+| `claude` | `.claude/commands/` | commands |
+| `cursor` | `.cursor/commands/` | commands |
+| `grok` | `.grok/commands/` | commands |
+| `codex` | `.codex/prompts/` | prompts |
+| **OpenClaw** (adapter, not file emitter) | OpenClaw **workspace skills** (`~/.openclaw/workspace/skills` or `$OPENCLAW_STATE_DIR/...`) | user-invocable skills + router |
+
+File hosts use portable hyphen filenames (L4), for example `deft-directive-run-interview.md` and `deft-continue.md`. Logical slash ids keep the namespace form (`/deft:directive:run:interview`).
+
+**OpenClaw** is **not** a fifth row in `SLASH_EMITTER_HOSTS` / `HOST_COMMAND_LAYOUTS`. There is no project-tree `.openclaw/commands/` deposit (that would be stub theater — Gateway does not load that path). OpenClaw L2 parity ships as a **skills/plugin adapter** ([#3064](https://github.com/deftai/directive/issues/3064)): thin **user-invocable** skills under the main workspace skills root, with a stable `logicalId → openClawSlug` map (`a-z0-9_`, max 32). See [openclaw-agent-host.md](./openclaw-agent-host.md) § L2 product commands.
+
+⊗ Treat last-writer-wins single-host install as the product default. One repo may use many hosts; deposit targets the **configured set** in one pass.
+
+---
+
+## Product set (L2 — exactly 13)
+
+| # | Logical slash id | Filename stem |
+|---|------------------|---------------|
+| 1 | `/deft:directive:change` | `deft-directive-change` |
+| 2 | `/deft:directive:change:apply` | `deft-directive-change-apply` |
+| 3 | `/deft:directive:change:verify` | `deft-directive-change-verify` |
+| 4 | `/deft:directive:change:archive` | `deft-directive-change-archive` |
+| 5 | `/deft:directive:run:interview` | `deft-directive-run-interview` |
+| 6 | `/deft:directive:run:yolo` | `deft-directive-run-yolo` |
+| 7 | `/deft:directive:run:map` | `deft-directive-run-map` |
+| 8 | `/deft:directive:run:discuss` | `deft-directive-run-discuss` |
+| 9 | `/deft:directive:run:research` | `deft-directive-run-research` |
+| 10 | `/deft:directive:run:speckit` | `deft-directive-run-speckit` |
+| 11 | `/deft:directive:run:probe` | `deft-directive-run-probe` |
+| 12 | `/deft:continue` | `deft-continue` |
+| 13 | `/deft:checkpoint` | `deft-checkpoint` |
+
+⊗ Auto-register every `deft-directive-*` skill as a slash entry.  
+⊗ Expand N without an amendment to L2 on #55.
+
+Legacy prose aliases (`/deft:change`, `/deft:run:…`) remain accepted in agent text with deprecation guidance. Native host files emit **canonical names only** (L3) — no second set of alias files.
+
+---
+
+## Thin wrappers (L5)
+
+Each managed file is a short pointer, not a copy of a strategy or skill:
+
+- YAML frontmatter: `description` (and `argument-hint` when needed)
+- Body: load the content-relative target under `.deft/core/` when installed; honor `$ARGUMENTS`; do not inline the target body
+
+Token intent (catalog ≤ ~1k tok for the set; invoke body ~40–100 tok). Real cost is the strategy/skill after invoke.
+
+Contributors: keep wrappers thin. Emitters consume `generateThinWrappers()` / `listProductCommands()` — do not maintain a second name table.
+
+---
+
+## Policy opt-out (`plan.policy.hostSlashCommands`)
+
+Default: all emitter hosts enabled (`claude`, `cursor`, `grok`, `codex`).
+
+Set a host to `false` in `xbrief/PROJECT-DEFINITION.xbrief.json` (or consumer deposit layout) to skip that host:
+
+```json
+{
+  "plan": {
+    "policy": {
+      "hostSlashCommands": {
+        "claude": true,
+        "cursor": true,
+        "grok": false,
+        "codex": true
+      }
+    }
+  }
+}
+```
+
+Inspect:
+
+```bash
+deft policy:show --field=hostSlashCommands
+```
+
+On opt-out, init/update **removes only** Directive-managed thin wrappers for that host. Consumer-customized files at the same path are left alone. Unknown host keys fail validation.
+
+This policy is parallel to `plan.policy.hostHooks` (enforcement hooks). Hooks and slash deposit are separate surfaces.
+
+### OpenClaw adapter opt-out (`plan.policy.openClawProductCommands`)
+
+OpenClaw L2 deposit is **separate** from the four file emitters. Default **on** when the adapter is real and OpenClaw is detected.
+
+```json
+{
+  "plan": {
+    "policy": {
+      "openClawProductCommands": false
+    }
+  }
+}
+```
+
+```bash
+deft policy:show --field=openClawProductCommands
+```
+
+When false, init/update/doctor **removes only** Directive-managed OpenClaw L2 thin skills (router + 13 product slugs). Consumer-customized skills at the same slug are left alone. Deposit **does not write** OpenClaw artifacts when OpenClaw is not detected (fail-closed).
+
+Primary recovery: `deft doctor --fix` (optional `--openclaw-all-agents` for multi-seat).
+
+---
+
+## Git policy (L8 — prefer commit)
+
+! **Prefer committing** managed product command/prompt files so every clone and every host share the same `/deft…` surface.
+
+- Managed paths are exact product filenames (installer allowlist), not “claim the whole `.claude/commands/` tree.”
+- Custom files you add next to managed ones stay app-owned.
+- Idempotent rewrite on init/update keeps managed thin wrappers current either way.
+
+? Personal gitignore of host command dirs remains an escape for machine-local only setups. That is **not** the default team recommendation. Multi-host shared repos benefit most from a committed deposit.
+
+⊗ Do not use single-host last-writer-wins as the team sharing model.
+
+---
+
+## Prose fallback (L9)
+
+File hosts without native registration (or with all file hosts opted out) still use the agent text convention in [commands.md](../commands.md). AGENTS.md and skills routing continue to work without native autocomplete files.
+
+**OpenClaw** after [#3064](https://github.com/deftai/directive/issues/3064): when the adapter has deposited L2 skills, operators should prefer the invocable skills / router — not prose-only discovery. Prose `/deft:directive:…` remains accepted in agent text when skills are not yet wired (doctor not run, policy off, or host without OpenClaw signals).
+
+---
+
+## Slash registration vs skill discovery (#55 vs #75 vs #3064)
+
+| Concern | Tracker | What lands |
+|---------|---------|------------|
+| Native slash / prompt **command files** | #55 | Thin wrappers under host command/prompt dirs; multi-host deposit |
+| Skill auto-discovery paths | #75 | `SKILL.md` discovery under `.agents/skills/`, `.claude/skills/`, etc. |
+| OpenClaw L2 product commands | #3064 | Thin **user-invocable** skills + router in OpenClaw workspace skills (not a file emitter) |
+
+! Do not treat skill discovery alone as “slash registration done.”  
+! Do not dual-maintain full skill bodies as command file contents (L7).  
+! Do not invent project `.openclaw/commands/` for L2 parity.
+
+Agent-host runtime notes (OpenClaw spawn/review + L2 skills) live under [openclaw-agent-host.md](./openclaw-agent-host.md).
+
+---
+
+## Dogfood checklist (multi-host clone)
+
+Use this after install or upgrade when two or more hosts share one repo.
+
+1. **Upgrade / deposit**
+
+   ```bash
+   npm i -g @deftai/directive@latest   # when using the npm channel
+   directive update                    # or directive init on a new project
+   ```
+
+2. **Confirm policy**
+
+   ```bash
+   deft policy:show --field=hostSlashCommands
+   ```
+
+   Expect enabled hosts = emitters you want (default: all four true).
+
+3. **Smoke paths on disk** (enabled hosts only)
+
+   ```text
+   .claude/commands/deft-continue.md
+   .cursor/commands/deft-continue.md
+   .grok/commands/deft-continue.md
+   .codex/prompts/deft-continue.md
+   ```
+
+   Spot-check count: **13** managed files per enabled host. Bodies stay short (description + dispatch pointer).
+
+4. **Two-host UI check**
+
+   - Open the same clone in host A (for example Claude Code) and host B (for example Cursor).
+   - Type `/` (or the host prompt picker) and confirm Directive entries such as `deft-directive-run-interview` / `/deft:continue` appear on **both** hosts when both are enabled.
+   - Invoke one strategy command and one session command; agent should load the pointed strategy/resilience doc, not a fat inlined body.
+
+5. **Opt-out smoke (optional)**
+
+   - Set one host to `false`, run `directive update`, confirm that host’s **managed** product files were removed and other hosts remain.
+   - Restore `true` and update again to redeposit.
+
+6. **Git**
+
+   - Stage managed product paths (or let the installer staging path include them) and commit so teammates inherit the surface.
+   - ~ Avoid gitignoring the whole host command directory on team repos.
+
+7. **Hooks still separate**
+
+   - `deft verify:hooks-installed --scope=agent` checks hooks, not slash files.
+   - Missing autocomplete after a clean deposit is a host UI/cache issue or policy opt-out — re-run update and re-check policy before filing a deposit bug.
+
+---
+
+## Related surfaces
+
+| Surface | Role |
+|---------|------|
+| [commands.md § Slash Command Namespaces](../commands.md#slash-command-namespaces-418--1670) | Prose namespaces, routing, deprecation aliases, deposit pointer |
+| `packages/core/src/slash/` | Generator IR + emitters + OpenClaw adapter (maintainers) |
+| `writeSlashCommandDeposit` | init/update file-host deposit |
+| `depositOpenClawL2ProductCommands` / doctor OpenClaw L2 check | OpenClaw skills adapter (#3064) |
+| `plan.policy.openClawProductCommands` | OpenClaw L2 adapter opt-out |
+| `plan.policy.hostHooks` | Host enforcement hooks (#2438) — not slash files |
+| [#75](https://github.com/deftai/directive/issues/75) | Skill discovery residual |
+| [#3064](https://github.com/deftai/directive/issues/3064) | OpenClaw L2 product-command adapter |
+
+---
+
+## Design reading order (#55)
+
+1. LockedDecisions L1–L10 on #55  
+2. Multi-host deposit amendment on #55  
+3. Token / context design rules on #55  
+4. This page + `commands.md`  
+
+Issue body (2026-03) on #55 is historical intent only.

package/main.md

@@ -32,6 +32,7 @@ Legend (from RFC2119): !=MUST, ~=SHOULD, ≉=SHOULD NOT, ⊗=MUST NOT, ?=MAY.
 - Interfaces: [interfaces/cli.md](./content/interfaces/cli.md), [interfaces/tui.md](./content/interfaces/tui.md), [interfaces/web.md](./content/interfaces/web.md), [interfaces/rest.md](./content/interfaces/rest.md)
 - Tools: [tools/taskfile.md](./content/tools/taskfile.md), [scm/git.md](./content/scm/git.md), [scm/github.md](./content/scm/github.md), [tools/telemetry.md](./content/tools/telemetry.md)
 - Testing: [coding/testing.md](./content/coding/testing.md)
+- Review process: [coding/review.md](./content/coding/review.md) (tool-agnostic; Greptile adapter via review-cycle skill)
 
 **Advanced:**
 - Contracts: [contracts/hierarchy.md](./content/contracts/hierarchy.md), [contracts/boundary-maps.md](./content/contracts/boundary-maps.md)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive-content",
-  "version": "0.91.0",
+  "version": "0.93.0",
   "description": "Shippable Directive framework content in the consumer .deft/core/ layout (C1 flatten), plus the engine surfaces (.githooks/, Taskfile.yml, tasks/) the deposit wires. Python-free per #2022 Phase 3. Refs #11, #1669, #1967.",
   "license": "MIT",
   "type": "module",