@deftai/directive-content 0.99.0 → 0.101.0

package/packs/strategies/strategies-pack-0.1.json

@@ -111,7 +111,7 @@
         "rapid"
       ],
       "path": "strategies/rapid.md",
-      "body": "# Rapid Strategy\n\nQuick prototyping workflow -- v0.20 date-prefixed story vBRIEF output with minimal gates and fast iteration.\n\n**Ceremony dial (#3214):** when `plan.policy.ceremonyDial` (or session inputs) selects depth `rapid` — default for S-task × frontier model on a project-shaped session — session ritual / gate depth follows this light path. See `task policy:show --field=ceremonyDial`. Non-project sessions select `minimal` and compose the #3014 minimal AGENTS profile research pointer instead.\n\n**v0.20 note (s5-migrate-speckit-rapid-enterprise / #1166):** Rapid now emits only the canonical v0.20 shape (date-prefixed story vBRIEFs in proposed/, full PROJECT-DEFINITION.vbrief.json via task project:render, seeded lifecycle folders, no legacy specification.vbrief.json). See the dedicated ## v0.20 Output Shape section and the canonical contract `strategies/v0-20-contract.md` (s1-contract of #1166).\n\nLegend (from RFC2119): !=MUST, ~=SHOULD, ≉=SHOULD NOT, ⊗=MUST NOT, ?=MAY.\n\n**⚠️ See also**: [strategies/interview.md](./interview.md) | [strategies/yolo.md](./yolo.md) | [strategies/README.md](./README.md) | [strategies/v0-20-contract.md](./v0-20-contract.md) | [artifact-guards.md](./artifact-guards.md)\n\n> Ship a throwaway prototype fast. Skip the PRD, skip approval gates, produce a\n> date-prefixed vBRIEF in proposed/ + PROJECT-DEFINITION and start building. Suited for spikes, proof-of-concepts, and\n> disposable experiments where learning speed matters more than long-term quality.\n\n---\n\n## When to Use\n\n- ~ Throwaway prototypes, spikes, and proof-of-concept experiments\n- ~ Validating a technical approach before committing to a full spec cycle\n- ~ Solo explorations where the cost of rework is low\n- ? Time-boxed experiments (e.g. \"spend 2 hours proving this works\")\n- ⊗ Production features, shared libraries, or anything with downstream consumers\n\n---\n\n## Workflow\n\n### Step 1: State the Goal\n\n! Describe the prototype goal in one sentence: what are you trying to learn or prove?\n\n- ! Record the goal in a new date-prefixed story vBRIEF written to `vbrief/proposed/YYYY-MM-DD-<kebab-slug>.vbrief.json` (e.g. as the plan title or a brief narrative in the v0.6 schema). Use today's date for the prefix and a descriptive slug.\n- ~ Include a time-box if applicable (e.g. \"4-hour spike\")\n- ⊗ Skip this step -- even throwaway work needs a clear objective\n\n### Step 2: Minimal Interview\n\n! Ask only the questions needed to unblock implementation. Skip sizing gate, skip PRD.\n\n- ! Identify: target platform, primary language, key dependency or API\n- ~ 3-5 questions maximum -- bias toward defaults and moving fast\n- ⊗ Run the full interview questionnaire -- that defeats the purpose of rapid\n\n### Step 3: Generate date-prefixed vBRIEF in proposed/ (Forced-Light Path)\n\n! Before writing output artifacts, follow the guards in [artifact-guards.md](./artifact-guards.md) (Preparatory Guard for proposed/ scope items; Spec-Generating Guard for PROJECT-DEFINITION).\n\n! Write a slim story scope vBRIEF to `vbrief/proposed/YYYY-MM-DD-<kebab-slug>.vbrief.json` -- no PRD, no approval gate. Decompose the rapid plan into one or more focused, buildable story vBRIEFs (v0.6 schema) rather than a monolithic legacy spec.\n\n- ! Use the Light path from [interview.md](./interview.md) unconditionally\n- ! Mark `plan.status` as `draft` (not `approved`) to signal prototype quality\n- ! After the proposed/ vBRIEF(s) are written, invoke `task project:render` (from repo root) to generate/refresh the complete `vbrief/PROJECT-DEFINITION.vbrief.json`\n- ~ Keep tasks coarse-grained -- 3-5 tasks is typical for a spike\n- ⊗ Generate a PRD or require approval -- rapid skips both\n- ⊗ Hand-author `SPECIFICATION.md` directly -- it is a rendered derivative only (see v0.20 Output Shape)\n\n! After emitting the proposed/ story vBRIEF(s), surface the GitHub-issue tracking hint from [emit-hints.md](./emit-hints.md) — name all three patterns (none / `--umbrella` / `--per-vbrief`).\n\n### Step 4: Build\n\n! Implement against the spec. Quality gates are relaxed but not absent.\n\n- ! Tests are still required, but coverage gate is relaxed to ≥50%\n- ~ Favour working code over clean code -- refactor later if the prototype graduates\n- ! `task check` must still pass (lint + fmt + tests)\n- ⊗ Skip `task check` entirely -- even prototypes must compile and pass basic checks\n\n### Step 5: Evaluate\n\n! At the end of the time-box (or when the prototype is done), decide next steps.\n\n- ! Record findings: what worked, what didn't, what surprised you\n- ~ Options: discard, iterate, or graduate to a full spec cycle via [interview.md](./interview.md)\n- ! If graduating: start a fresh interview -- do not carry forward the rapid spec as-is\n\n---\n\n## Output Artifacts\n\n- `vbrief/proposed/YYYY-MM-DD-*.vbrief.json` (one or more) -- lightweight story scope vBRIEF(s) with `draft` status (primary artifact; date-prefixed per v0.20 contract)\n- `vbrief/PROJECT-DEFINITION.vbrief.json` -- complete project gestalt + items registry (via `task project:render` invoked by Rapid)\n- `vbrief/{proposed,pending,active,completed,cancelled}/` -- all five lifecycle folders seeded\n- (optional derivative) `SPECIFICATION.md` -- read-only human-readable export (includes deprecated-redirect sentinel; via `task spec:render` if invoked)\n- Prototype code (may be discarded)\n- Findings summary (inline in the proposed/ vBRIEF or as a separate note)\n\n---\n\n## Fits into Chaining Gate\n\nRapid is a **spec-generating** strategy. Selecting it at the chaining gate produces date-prefixed story vBRIEF(s) in `vbrief/proposed/` (and refreshes `vbrief/PROJECT-DEFINITION.vbrief.json` via `task project:render`) and moves directly to implementation. There is no chaining back to preparatory strategies. See the v0.20 Output Shape section below for the exact contract.\n\n---\n\n## Anti-Patterns\n\n- ⊗ Using rapid for production features -- rapid output is explicitly throwaway\n- ⊗ Graduating a rapid prototype without a fresh spec cycle -- the shortcuts compound\n- ⊗ Running the full interview or PRD path -- that's interview strategy, not rapid\n- ⊗ Skipping `task check` -- even prototypes must pass basic quality checks\n- ⊗ Omitting the goal statement -- undirected spikes waste time\n- ⊗ Emitting the legacy singular specification artifact or bare-named vBRIEFs -- violates the v0.20 contract (see strategies/v0-20-contract.md)\n\n---\n\n## v0.20 Output Shape (s5-migrate-speckit-rapid-enterprise / #1166)\n\nThis strategy has been migrated to the full v0.20 output shape so rapid-generated projects are accepted by the build skill Pre-Cutover Detection Guard with zero errors on first attempt (resolves the rapid row from the #1166 inconsistency table and the s5 story acceptance criteria).\n\n- ! Seed the five lifecycle folders under `vbrief/` if any are missing: `proposed/`, `pending/`, `active/`, `completed/`, `cancelled/`.\n- ! Emit story scope items exclusively as date-prefixed scope vBRIEFs: `vbrief/proposed/YYYY-MM-DD-<kebab-slug>.vbrief.json` (use the run's creation date for the prefix; choose descriptive slugs). Decompose the rapid plan into one or more focused, buildable story vBRIEFs (v0.6 schema) rather than a monolithic legacy spec.\n- ! After the proposed/ stories are written, invoke `task project:render` (run from the repo root) to generate/refresh the complete `vbrief/PROJECT-DEFINITION.vbrief.json` (items registry is derived from the lifecycle folders).\n- ⊗ Never emit `vbrief/specification.vbrief.json` (or any legacy dual-write).\n- ~ `SPECIFICATION.md` at the project root, if produced at all, must be only a read-only derivative (e.g. via `task spec:render` after the vbriefs exist) that includes the v0.20 deprecated-redirect sentinel. The source of truth is the vbrief/ lifecycle stories + PROJECT-DEFINITION.\n- ! Before writing any proposed/ stories or PROJECT-DEFINITION, follow the guards in [artifact-guards.md](./artifact-guards.md) (Preparatory Guard for scope items in proposed/; Spec-Generating Guard for PROJECT-DEFINITION).\n- ! Final output tree must pass the deterministic v0.20 strategy output validation gate (s2-deterministic-gate) and the build Pre-Cutover Detection Guard with zero warnings/errors. See full acceptance in the s5 vBRIEF and the 1166 decomposition.\n- ! Cite the canonical contract `strategies/v0-20-contract.md` (s1-contract) for the exact shape and the per-strategy table row.\n\n---\n\n## Artifacts Summary (v0.20)\n\n**Rapid (Forced-Light path):**\n\n| Artifact | Purpose | Created By |\n|----------|---------|------------|\n| `vbrief/proposed/YYYY-MM-DD-*.vbrief.json` (one or more) | Focused story scope items (date-prefixed per vbrief convention and v0.20 contract) | Rapid |\n| `vbrief/PROJECT-DEFINITION.vbrief.json` | Project identity gestalt + complete scope items registry | `task project:render` (invoked by Rapid) |\n| `vbrief/{proposed,pending,active,completed,cancelled}/` | All five lifecycle folders seeded | Rapid |\n| (optional derivative) `SPECIFICATION.md` | Human-readable plan (includes deprecated-redirect sentinel) | `task spec:render` (if invoked) |\n\n**Pre-v0.20 / legacy artifacts that MUST NOT be produced by this strategy:**\n\n- `vbrief/specification.vbrief.json`\n- Primary handoff `SPECIFICATION.md` at project root (without sentinel)\n- Bare-named vBRIEFs in proposed/\n\nSee the full table and rules in `strategies/v0-20-contract.md` (rapid row: Must Create Lifecycle Folders: Yes; Must Write PROJECT-DEFINITION: Yes; Scope vBRIEFs Location: proposed/YYYY-MM-DD-*.vbrief.json only; specification.vbrief.json: Never; SPECIFICATION.md / PROJECT.md: Omit or deprecation redirect only).\n\n---\n\n## Invoking This Strategy\n\n```\n /deft:run:rapid [project name]\n```\n\nOr explicitly:\n"
+      "body": "# Rapid Strategy\n\nQuick prototyping workflow -- v0.20 date-prefixed story vBRIEF output with minimal gates and fast iteration.\n\n**Ceremony dial (#3214):** when `plan.policy.ceremonyDial` (or session inputs) selects depth `rapid` — default for S-task × frontier model on a project-shaped session — session ritual / gate depth follows this light path. See `task policy:show --field=ceremonyDial`. Non-project sessions select `minimal` and compose the #3014 minimal AGENTS profile research pointer instead.\n\n**v0.20 note (s5-migrate-speckit-rapid-enterprise / #1166):** Rapid now emits only the canonical v0.20 shape (date-prefixed story vBRIEFs in proposed/, full PROJECT-DEFINITION.vbrief.json via task project:render, seeded lifecycle folders, no legacy specification.vbrief.json). See the dedicated ## v0.20 Output Shape section and the canonical contract `strategies/v0-20-contract.md` (s1-contract of #1166).\n\nLegend (from RFC2119): !=MUST, ~=SHOULD, ≉=SHOULD NOT, ⊗=MUST NOT, ?=MAY.\n\n**⚠️ See also**: [strategies/interview.md](./interview.md) | [strategies/yolo.md](./yolo.md) | [strategies/README.md](./README.md) | [strategies/v0-20-contract.md](./v0-20-contract.md) | [artifact-guards.md](./artifact-guards.md)\n\n> Ship a throwaway prototype fast. Skip the PRD, skip approval gates, produce a\n> date-prefixed vBRIEF in proposed/ + PROJECT-DEFINITION and start building. Suited for spikes, proof-of-concepts, and\n> disposable experiments where learning speed matters more than long-term quality.\n\n---\n\n## When to Use\n\n- ~ Throwaway prototypes, spikes, and proof-of-concept experiments\n- ~ Validating a technical approach before committing to a full spec cycle\n- ~ Solo explorations where the cost of rework is low\n- ? Time-boxed experiments (e.g. \"spend 2 hours proving this works\")\n- ⊗ Production features, shared libraries, or anything with downstream consumers\n\n---\n\n## Workflow\n\n### Step 1: State the Goal\n\n! Describe the prototype goal in one sentence: what are you trying to learn or prove?\n\n- ! Record the goal in a new date-prefixed story vBRIEF written to `vbrief/proposed/YYYY-MM-DD-<kebab-slug>.vbrief.json` (e.g. as the plan title or a brief narrative in the v0.6 schema). Use today's date for the prefix and a descriptive slug.\n- ~ Include a time-box if applicable (e.g. \"4-hour spike\")\n- ⊗ Skip this step -- even throwaway work needs a clear objective\n\n### Step 2: Minimal Interview\n\n! Ask only the questions needed to unblock implementation. Skip sizing gate, skip PRD.\n\n- ! Identify: target platform, primary language, key dependency or API\n- ~ 3-5 questions maximum -- bias toward defaults and moving fast\n- ⊗ Run the full interview questionnaire -- that defeats the purpose of rapid\n\n### Step 3: Generate date-prefixed vBRIEF in proposed/ (Forced-Light Path)\n\n! Before writing output artifacts, follow the guards in [artifact-guards.md](./artifact-guards.md) (Preparatory Guard for proposed/ scope items; Spec-Generating Guard for PROJECT-DEFINITION).\n\n! Write a slim story scope vBRIEF to `vbrief/proposed/YYYY-MM-DD-<kebab-slug>.vbrief.json` -- no PRD, no approval gate. Decompose the rapid plan into one or more focused, buildable story vBRIEFs (v0.6 schema) rather than a monolithic legacy spec.\n\n- ! Use the Light path from [interview.md](./interview.md) unconditionally\n- ! Mark `plan.status` as `draft` (not `approved`) to signal prototype quality\n- ! After the proposed/ vBRIEF(s) are written, invoke `task project:render` (from repo root) to generate/refresh the complete `vbrief/PROJECT-DEFINITION.vbrief.json`\n- ~ Keep tasks coarse-grained -- 3-5 tasks is typical for a spike\n- ⊗ Generate a PRD or require approval -- rapid skips both\n- ⊗ Hand-author `SPECIFICATION.md` directly -- it is a rendered derivative only (see v0.20 Output Shape)\n\n! After emitting the proposed/ story vBRIEF(s), surface the GitHub-issue tracking hint from [emit-hints.md](./emit-hints.md) — name all three patterns (none / `--umbrella` / `--per-vbrief`).\n\n### Step 4: Build\n\n! Implement against the spec. Quality gates are relaxed but not absent.\n\n- ! Tests are still required, but coverage gate is relaxed to ≥50%\n- ~ Favour working code over clean code -- refactor later if the prototype graduates\n- ! `task check` must still pass (lint + fmt + tests)\n- ⊗ Skip `task check` entirely -- even prototypes must compile and pass basic checks\n\n### Step 5: Evaluate\n\n! At the end of the time-box (or when the prototype is done), decide next steps.\n\n- ! Record findings: what worked, what didn't, what surprised you\n- ~ Options: discard, iterate, or graduate to a full spec cycle via [interview.md](./interview.md)\n- ! If graduating: start a fresh interview -- do not carry forward the rapid spec as-is\n\n---\n\n## Output Artifacts\n\n- `vbrief/proposed/YYYY-MM-DD-*.vbrief.json` (one or more) -- lightweight story scope vBRIEF(s) with `draft` status (primary artifact; date-prefixed per v0.20 contract)\n- `vbrief/PROJECT-DEFINITION.vbrief.json` -- complete project gestalt + items registry (via `task project:render` invoked by Rapid)\n- `vbrief/{proposed,pending,active,completed,cancelled}/` -- all five lifecycle folders seeded\n- (optional derivative) `SPECIFICATION.md` -- read-only human-readable export (includes deprecated-redirect sentinel; via `task spec:render` if invoked)\n- Prototype code (may be discarded)\n- Findings summary (inline in the proposed/ vBRIEF or as a separate note)\n\n---\n\n## Fits into Chaining Gate\n\nRapid is a **spec-generating** strategy. Selecting it at the chaining gate produces date-prefixed story vBRIEF(s) in `vbrief/proposed/` (and refreshes `vbrief/PROJECT-DEFINITION.vbrief.json` via `task project:render`) and moves directly to implementation. There is no chaining back to preparatory strategies. See the v0.20 Output Shape section below for the exact contract.\n\n---\n\n## Product-first done-gate / literal AC (#3284 / #3267)\n\nRapid lightens cold ceremony only. The **positive verification content** of the light path is stated acceptance commands — not framework hygiene.\n\n- ! Capture stated shell commands at intake into `plan.acceptance.commands` (and #3267 `literal_acceptance_commands`) — do not paraphrase. Empty requires `none_stated: true` with a ladder rung (`derived` or `project_floor`).\n- ! Before done, run `task verify:ac -- <active-story-path>` (verbatim flags/cwd). Fail closed on non-zero. (`verify:literal-ac` remains the #3267 mechanism alias.)\n- ! Ceremony dial rapid/minimal = **AC-only** verification for `task check` composition (#3284): hygiene degrades away; AC never degrades when commands exist.\n- ⊗ Treat self-chosen approximate checks as sufficient when the statement named exact commands.\n- ⊗ Skip AC because ceremony is rapid — rapid's job is to keep exactly this check.\n\n## Anti-Patterns\n\n- ⊗ Using rapid for production features -- rapid output is explicitly throwaway\n- ⊗ Graduating a rapid prototype without a fresh spec cycle -- the shortcuts compound\n- ⊗ Running the full interview or PRD path -- that's interview strategy, not rapid\n- ⊗ Skipping `task check` -- even prototypes must pass basic quality checks\n- ⊗ Omitting the goal statement -- undirected spikes waste time\n- ⊗ Emitting the legacy singular specification artifact or bare-named vBRIEFs -- violates the v0.20 contract (see strategies/v0-20-contract.md)\n\n---\n\n## v0.20 Output Shape (s5-migrate-speckit-rapid-enterprise / #1166)\n\nThis strategy has been migrated to the full v0.20 output shape so rapid-generated projects are accepted by the build skill Pre-Cutover Detection Guard with zero errors on first attempt (resolves the rapid row from the #1166 inconsistency table and the s5 story acceptance criteria).\n\n- ! Seed the five lifecycle folders under `vbrief/` if any are missing: `proposed/`, `pending/`, `active/`, `completed/`, `cancelled/`.\n- ! Emit story scope items exclusively as date-prefixed scope vBRIEFs: `vbrief/proposed/YYYY-MM-DD-<kebab-slug>.vbrief.json` (use the run's creation date for the prefix; choose descriptive slugs). Decompose the rapid plan into one or more focused, buildable story vBRIEFs (v0.6 schema) rather than a monolithic legacy spec.\n- ! After the proposed/ stories are written, invoke `task project:render` (run from the repo root) to generate/refresh the complete `vbrief/PROJECT-DEFINITION.vbrief.json` (items registry is derived from the lifecycle folders).\n- ⊗ Never emit `vbrief/specification.vbrief.json` (or any legacy dual-write).\n- ~ `SPECIFICATION.md` at the project root, if produced at all, must be only a read-only derivative (e.g. via `task spec:render` after the vbriefs exist) that includes the v0.20 deprecated-redirect sentinel. The source of truth is the vbrief/ lifecycle stories + PROJECT-DEFINITION.\n- ! Before writing any proposed/ stories or PROJECT-DEFINITION, follow the guards in [artifact-guards.md](./artifact-guards.md) (Preparatory Guard for scope items in proposed/; Spec-Generating Guard for PROJECT-DEFINITION).\n- ! Final output tree must pass the deterministic v0.20 strategy output validation gate (s2-deterministic-gate) and the build Pre-Cutover Detection Guard with zero warnings/errors. See full acceptance in the s5 vBRIEF and the 1166 decomposition.\n- ! Cite the canonical contract `strategies/v0-20-contract.md` (s1-contract) for the exact shape and the per-strategy table row.\n\n---\n\n## Artifacts Summary (v0.20)\n\n**Rapid (Forced-Light path):**\n\n| Artifact | Purpose | Created By |\n|----------|---------|------------|\n| `vbrief/proposed/YYYY-MM-DD-*.vbrief.json` (one or more) | Focused story scope items (date-prefixed per vbrief convention and v0.20 contract) | Rapid |\n| `vbrief/PROJECT-DEFINITION.vbrief.json` | Project identity gestalt + complete scope items registry | `task project:render` (invoked by Rapid) |\n| `vbrief/{proposed,pending,active,completed,cancelled}/` | All five lifecycle folders seeded | Rapid |\n| (optional derivative) `SPECIFICATION.md` | Human-readable plan (includes deprecated-redirect sentinel) | `task spec:render` (if invoked) |\n\n**Pre-v0.20 / legacy artifacts that MUST NOT be produced by this strategy:**\n\n- `vbrief/specification.vbrief.json`\n- Primary handoff `SPECIFICATION.md` at project root (without sentinel)\n- Bare-named vBRIEFs in proposed/\n\nSee the full table and rules in `strategies/v0-20-contract.md` (rapid row: Must Create Lifecycle Folders: Yes; Must Write PROJECT-DEFINITION: Yes; Scope vBRIEFs Location: proposed/YYYY-MM-DD-*.vbrief.json only; specification.vbrief.json: Never; SPECIFICATION.md / PROJECT.md: Omit or deprecation redirect only).\n\n---\n\n## Invoking This Strategy\n\n```\n /deft:run:rapid [project name]\n```\n\nOr explicitly:\n"
     },
     {
       "id": "research",

package/skills/deft-directive-build/SKILL.md

@@ -280,8 +280,40 @@ Multi-iteration implement-fix and pre-PR polish loops MUST carry **both** a succ
 - ⊗ Continue "one more fix" after the envelope is exhausted.
 - ⊗ Reset the counter by opening a new commit, rewording the same change, or swapping workers while the same failure class remains.
 
+
+### Budget-aware effort - bank the pass before deepening (#3266)
+
+When a hard turn or cost budget is detectable (session:start `effort_budget` / env `DEFT_MAX_TURNS` / `DEFT_MAX_BUDGET` / host descriptor #1461), size effort to the **stated** acceptance bar first. This is the success-side analog of dual-stop (#2442): dual-stop stops thrash on failure; bank-the-pass stops budget exhaustion on over-deepening.
+
+- ! At implement start, read the session effort-budget signal (`task session:start` lines or JSON `effort_budget`, or env). When `posture=hard-capped`, treat the run as budget-constrained.
+- ! **Bank the pass first:** satisfy stated acceptance criteria (xBRIEF items / issue AC / official checker) and produce the passing artifact **before** any self-imposed deeper verification suite that exceeds the stated bar.
+- ! Only with **remaining** budget after the stated pass, extend verification depth. Never deepen past the point where a found defect could not also be fixed within budget (default reserve: enough turns/cost for one fix batch).
+- ! Self-verification scope scales with remaining budget - prefer the official/stated checks under a tight cap.
+- ! When deepening is skipped for budget, MUST say so in the run summary / handoff (`deepening_skipped=true` + reason) - fail-loud (#1006). Use `formatDeepeningSkippedNote` semantics from `packages/core/src/session/effort-budget.ts`.
+- ~ When no hard budget is detected (`posture=unbounded`), normal dual-stop defaults still apply; bank-the-pass is optional discipline, not a license to skip stated AC.
+- ⊗ Exhaust the turn/cost budget on self-imposed gold-plating after the stated bar is already within reach (#3266).
+- ⊗ Silently skip deepening without naming it, or silently gold-plate under a hard cap (#1006 / #3266).
+- ⊗ Treat bank-the-pass as permission to ship without meeting stated AC - stated AC remains the success stop.
+
+Core helper: `packages/core/src/session/effort-budget.ts` (`detectHardEffortBudget`, `recommendVerificationDepth`). Composes #2442, #1581, #3214, #1006.
 **Enforcement note:** skill defaults are behavioral. Durable delivery/acceptance circuit-breaker: **#3143** `packages/core/src/delivery-attempt/` (`evaluatePreDispatch`, `.deft/delivery-attempts/`). Docs: `docs/delivery-attempt.md`. Route delivery/acceptance automatic retries through that gate; do not invent a parallel ledger in this skill.
 
+### AC-pass banking checkpoint - finalize on green (#3285)
+
+Sharpens #3266: the **first** moment stated/official acceptance criteria pass is a **banking checkpoint**, not a license to keep spending the turn budget on self-imposed depth.
+
+- ! When stated acceptance criteria first pass (`task verify:ac` / product-first done-gate #3284 / official checker), the **next** action is **FINALIZE**: checkpoint-commit the green state and record the bank (durable under `.deft/ac-pass-banks/`; optional run-summary line when `DEFT_RUN_SUMMARY_PATH` is set).
+- ! **Deepening after the bank requires surplus budget.** Self-imposed extra verification, refactors, or polish are permitted only when remaining budget meets `plan.policy.acPassBanking.surplusThreshold` (default **0.2** = 20% of max turns/cost still remaining) **and** the absolute reserve from #3266. Env override: `DEFT_AC_PASS_SURPLUS_THRESHOLD`.
+- ! Deepening, when allowed, happens **on top of** the committed checkpoint so a failed experiment can revert to banked green.
+- ! **Post-bank discoveries are reported, not chased** when surplus is insufficient: file a note/issue in the deliverable for out-of-scope defects unless they **regress stated AC** (then fix-regression). Finding beyond the bar is a win; thrashing a dying budget into a zero is the failure mode this rule closes.
+- ! When surplus is insufficient, ship the banked state and fail-loud (`deepening_skipped=true` + surplus reason) via `evaluateAcPassBanking` / `formatDeepeningSkippedNote` semantics.
+- ~ When no hard budget is detected, dual-stop still applies; bank-on-first-AC-pass remains good discipline but is not a hard surplus gate.
+- ⊗ Convert a banked official pass into a scored failure by chasing post-bank polish until the turn budget dies (#3285).
+- ⊗ Start post-bank deepening without a finalize checkpoint when a hard budget is active (#3285).
+- ⊗ Chase out-of-scope post-bank findings when surplus is below threshold (#3285).
+
+Core helpers: `packages/core/src/session/ac-pass-banking.ts` (`evaluateAcPassBanking`, `bankAcPass`, `decidePostBankFinding`, `simulateSurplusInsufficientRun`); policy: `packages/core/src/policy/ac-pass-banking.ts` (`plan.policy.acPassBanking`). Composes #3266, #3284, #3282 (optional bank-event JSONL), #1006.
+
 ## Step 3: Build Phase by Phase
 
 For each phase:
@@ -319,6 +351,21 @@ task test:coverage  # >=85% or PROJECT-DEFINITION.xbrief.json override
 - ⊗ Re-run full install/session ceremony after offline seed when ritual is already complete (#3010) — use `session:ready` for recovery only.
 
 
+## Product-first done-gate (#3284) / literal AC (#3267)
+
+At intake, capture the task statement's **exact** acceptance commands as executable AC (`plan.acceptance.commands` + #3267 `literal_acceptance_commands`). Empty is allowed only with `none_stated: true` (ladder: stated → derived → project_floor). Before declaring done, run them **verbatim** — same paths, same flags, same working directory. Self-chosen verification is supplementary, never a substitute. Extends #973. `task check` runs `verify:ac` **first** (fail-fast); hygiene is second and may become advisory under pressure. Rapid ceremony = **AC-only**.
+
+- ! When reading the active scope xBRIEF / issue body at story start, capture stated shell acceptance commands into `plan.acceptance.commands` (issue:ingest stamps this + the #3267 ledger automatically). Do not paraphrase.
+- ! Before claiming phase or story done (and before merge-chokepoint PR handoff), run:
+```
+task verify:ac -- <active-story-path>
+```
+  Exit 0 = pass or none stated with valid marker; exit 1 = a stated command failed; exit 2 = config. (`verify:literal-ac` is the #3267 mechanism alias.)
+- ! Quote the literal invocations and their outputs in the completion note when commands were stated.
+- ⊗ Substitute a self-chosen approximation (`pnpm test` when the statement said `pnpm exec vitest run packages/core/src`) for the stated command.
+- ⊗ Skip this gate because ceremony dial is rapid/minimal — rapid's positive content is exactly this check (#3284).
+- ⊗ Leave `plan.acceptance.commands` empty without `none_stated: true` — absence must be an explicit decision.
+
 ## Operator-log hygiene (lazy-load, #1940)
 
 When the story touches **operator-facing** services (dashboards, multi-process
@@ -459,3 +506,7 @@ Docs: `docs/decision-log.md` · `xbrief/decisions/README.md`.
 - ⊗ Fill remote ship/gate fields from memory when only local work completed; legal partial omits PR fields (#3120)
 - ⊗ Run multi-iteration implement / pre-PR loops without a failure stop (max iterations and/or no-progress) or without an operator-visible halt report when the envelope is exhausted (#2442)
 - ⊗ Silently continue after dual-stop failure halt — escalate; do not thrash (#2442)
+- ⊗ Exhaust hard turn/cost budget on self-imposed deepening after the stated acceptance bar is within reach (#3266)
+- ⊗ Silently skip deepening for budget without a fail-loud summary note (#3266 / #1006)
+- ⊗ Chase post-bank out-of-scope findings when surplus budget is insufficient — report, do not thrash the banked pass (#3285)
+- ⊗ Skip finalize-on-green after first stated AC pass under a hard budget (#3285)

package/skills/deft-directive-pre-pr/SKILL.md

@@ -164,6 +164,23 @@ git --no-pager diff master
 - ~ Track iteration count -- if you exceed 3 iterations, pause and assess whether you are oscillating between competing fixes
 
 
+
+## Budget-aware pre-PR depth (#3266)
+
+When session effort-budget is hard-capped (`DEFT_MAX_TURNS` / `DEFT_MAX_BUDGET` / session:start `effort_budget`):
+
+- ! Complete the merge-chokepoint path that proves stated AC (full `task check` once, stated AC evidence) before optional polish that only deepens beyond the bar.
+- ! If remaining budget cannot fund another full Read-Write-Lint-Diff pass **and** a fix for a new finding, stop after the stated-pass chokepoint and record `deepening_skipped=true` with reason (#1006).
+- ! Dual-stop pre-PR defaults (max 3 polish / 2 no-diff) still apply; under a hard cap, prefer fewer polish iterations once AC + check are green.
+- ⊗ Start an unbounded self-imposed verification suite that exceeds stated AC while the hard budget is nearly exhausted (#3266).
+
+## Product-first done-gate (#3284) / literal AC (#3267)
+
+- ! Before Phase 3 Lint exit / push, when the active scope xBRIEF has acceptance commands (`plan.acceptance` or #3267 metadata/narratives), run `task verify:ac -- <active-xbrief>` and fail closed on exit 1. (`verify:literal-ac` is the mechanism alias.)
+- ! Commands must be the exact strings from the task statement — same flags and cwd. Self-chosen verification is supplementary only.
+- ! Full `task check` already runs `verify:ac` first; still run it explicitly before push when AC is stated so failures are visible without the full hygiene suite.
+- ⊗ Skip AC run on rapid/minimal ceremony dial — rapid = AC-only; AC never degrades when commands exist (#3284 / #3156).
+
 ## Probe-then-fill remote claims (#3120)
 
 ! Before filling any **remote** handoff field (PR URL, PR number, commit/HEAD SHA, CI green/success, review score) or claiming `status: pass` / ship/gate done, MUST **probe then fill**:
@@ -211,3 +228,5 @@ Docs: `docs/decision-log.md`.
 - ⊗ Invent remote PR/SHA/CI/review claims in handoff evidence without same-turn probe binding — invented-done (#3120)
 - ⊗ Fill remote ship/gate fields from memory when only local work completed; legal partial omits PR fields (#3120)
 - ⊗ Clear a failing gate by editing the gate (definition, verifier, reward, required check, coverage floor, policy, eval fixture) instead of the work under test — gate integrity (#3156); see [docs/gate-integrity.md](../../docs/gate-integrity.md)
+- ⊗ Under a hard turn/cost budget, gold-plate pre-PR polish past the stated bar until the budget expires (#3266)
+- ⊗ Exit pre-PR after skipping deepen-for-budget without naming the skip in the summary (#3266 / #1006)

package/skills/deft-directive-review-cycle/SKILL.md

@@ -48,6 +48,7 @@ Legend (from RFC2119): !=MUST, ~=SHOULD, ≉=SHOULD NOT, ⊗=MUST NOT, ?=MAY.
 - Operator asks to **babysit**, **shepherd**, or **watch** a PR -- including the Cursor product action **babysit-pull-request-in-cloud** (#2261 / #1862 intent-routing class)
 - A bot reviewer (Greptile) has posted findings on an open PR
 - Dispatching a cloud or background agent to monitor and resolve PR review findings until merge-ready
+- Operator re-authorizes after conf-hold / dual-stop residual: **pursue residual**, **follow-up hard-stop**, **same as conf-hold**, **continue dual-stopped PR**, or **re-babysit residual** — route to § Operator follow-up after dual-stop / hard stop (#3273)
 
 ## Cursor global babysit supersession (#2261)
 
@@ -204,11 +205,31 @@ Review fix cycles are multi-iteration work and MUST carry dual stop (`main.md` `
 
 **On failure stop:**
 
-- ! Halt automatic re-fix. Prefer `BLOCKED:` with PR number, HEAD SHA, blocker class (`review_cycle_cap` / `greptile_p0_p1` / `no_progress`), what was tried, and human decision needed (preamble §11 / #2843).
+- ! Halt automatic re-fix. Prefer `BLOCKED:` with PR number, HEAD SHA, blocker class (`review_cycle_cap` / `greptile_p0_p1` / `conf_floor` / `no_progress`), what was tried, and human decision needed (preamble §11 / #2843).
+- ! **Halt-report resume line (MUST, #3273 / AC6):** End the terminal halt with residual class + conf (if any) + PR URL, example phrases (**pursue residual** | **follow-up hard-stop** | **same as conf-hold** | **continue dual-stopped PR**), and skill pointer to § Operator follow-up after dual-stop / hard stop (#3273). Same affordance shape as swarm `references/core-phase-4.md`.
 - ⊗ Continue silent fix rounds after the envelope is exhausted.
 - ⊗ Reset the fix-batch counter solely by re-pushing, empty-committing, or swapping workers when the same primary finding fingerprint remains (poll-wait timer MAY reset for a new HEAD; the dual-stop fix-batch counter MUST NOT).
 
-**Enforcement note:** skill defaults are behavioral. Durable delivery/acceptance circuit breaker: **#3143** packages/core/src/delivery-attempt/ (valuatePreDispatch). Docs: docs/delivery-attempt.md.
+**Enforcement note:** skill defaults are behavioral. Durable delivery/acceptance circuit breaker: **#3143** `packages/core/src/delivery-attempt/` (`evaluatePreDispatch`). Docs: `docs/delivery-attempt.md`.
+
+### Operator follow-up after dual-stop / hard stop (#3273)
+
+Operator-initiated resume after conf-hold, residual dual-stop, or hard-stop exit — **not** automatic re-thrash. Composes Greptile floor (#3095) and advisory should-not-merge (#3225). Portable consumer + maintainer (`task` / `deft` dual-invoke).
+
+**Triggers:** pursue residual · follow-up hard-stop · same as conf-hold · continue dual-stopped PR · re-babysit residual
+
+**One residual pass under operator consent:**
+1. Ground-truth: dual-invoke `pr:merge-ready` / `pr:watch --one-shot` (#2893).
+2. Apply **one** residual fix batch **or** one re-review wait — not both as an unbounded loop.
+3. If operator authorized a conf floor for **this PR only** (e.g. ≥4/5): post a PR audit comment (floor, HEAD SHA, authorizer). That is the human-merge / documented-override trail — it does **not** rewrite policy or make `pr:merge-ready` / `pr:watch` CLEAN below `minGreptileConfidence`. ⊗ Silent policy edit for one residual.
+4. Re-evaluate Step 6; merge when **policy** floor + gates met, or human-merge after the documented PR-local floor is met in the bot body; else halt again with a fresh resume line.
+5. Post-merge `scope:complete` when this owner holds lifecycle (#2321 / #3264).
+
+! Dual-stop re-entry: one residual pass then re-stop without new consent. Fresh operator consent required for another pass.
+
+⊗ Unlimited auto-retry after dual-stop without new operator consent (#3273 / #2442).
+⊗ Treat conf-only holds as authorization for unbounded redesign (#2881).
+⊗ Lower project-wide `minGreptileConfidence` for one residual.
 
 ### Step 3: Fix all findings in ONE batch commit
 
@@ -818,6 +839,8 @@ task lifecycle:event -- emit plan:approved \
 - ⊗ Misclassify Claude Code as `cursor-composer` from bare `Task` alone (#3134)
 - ⊗ Expand active story scope past xBRIEF AC mid-babysit without follow-up issue or consented brief amend (#2881)
 - ⊗ Treat confidence-only holds (0 P0/P1) as a mandate for unbounded redesign (#2881)
+- ⊗ Dual-stop / conf-residual terminal halt without #3273 resume line (residual class + pursue residual / follow-up hard-stop / same as conf-hold / continue dual-stopped PR + skill section pointer) (#3273)
+- ⊗ Unlimited residual auto-retry after dual-stop without new operator consent (#3273 / #2442)
 - ⊗ Invent freestyle sleep/poll loops when dual-invoke probes fail for `pr:watch` — use the official gh-only fallback and fail-loud missing-task (#2878 / #2893)
 - ⊗ Treat bare `task pr:watch` as the only consumer gate form — probe `deft` then `task deft:` first (#2893)
 - ⊗ Treat a passing SLizard/Greptile check run, a non-blocking review comment, or an ad hoc fix commit as the review-cycle exit predicate -- Step 6 fail-closed all-of (#1259) and multi-reviewer registry triage (#769) still apply

package/skills/deft-directive-swarm/SKILL.md

@@ -43,6 +43,7 @@ The swarm skill creates branches per agent so the guard is mostly informational
 - User says "run agents", "parallel agents", "swarm", or "launch N agents on stories"
 - Multiple independent story-level xBRIEFs in `xbrief/active/` need to be worked on simultaneously
 - A batch of stories are ready and have no mutual dependencies
+- Operator re-authorizes a dual-stopped / hard-stopped / conf-hold unit: **pursue residual**, **follow-up hard-stop**, **same as conf-hold**, **continue dual-stopped PR**, or **re-babysit residual** — route to § Operator follow-up after dual-stop / hard stop (#3273)
 
 ## Prerequisites
 
@@ -138,8 +139,14 @@ Large multi-host skills use a **host-neutral core** plus **one** per-host adapte
 
 ! On failure stop: halt automatic continuation; emit an operator-visible report (what was tried, what is missing, what human decision is needed). ⊗ Silent re-dispatch or infinite monitor continuation after the envelope is exhausted.
 
+! **Halt-report resume line (MUST, #3273 / AC6):** Terminal dual-stop / hard-stop / conf-residual halt reports MUST end with residual class + conf (if any) + PR URL, example resume phrases (**pursue residual** | **follow-up hard-stop** | **same as conf-hold** | **continue dual-stopped PR**), and pointer to § Operator follow-up after dual-stop / hard stop. Full template: [`references/core-phase-4.md`](references/core-phase-4.md).
+
 ! Composes with minimal-subgraph repair guidance (#2439): keep repairs minimal **and** bounded by dual-stop -- minimal repair is not a license to thrash. Durable delivery/acceptance circuit-breaker: **#3143** `packages/core/src/delivery-attempt/` (`evaluatePreDispatch`, unit ledger). Docs: `docs/delivery-attempt.md`. Skill defaults remain behavioral; mechanical gate lives in core.
 
+### Operator follow-up after dual-stop / hard stop (#3273)
+
+Operator-initiated **one residual pass** after dual-stop / hard stop / conf-hold — not automatic re-thrash. Depth (steps, anti-thrash, conf-floor this-PR-only): [`references/core-phase-4.md`](references/core-phase-4.md) same section title. Thin pointer: dual-invoke `pr:merge-ready` / `pr:watch`; spawn **one** residual worker or review-cycle owner; document authorized conf floor for this PR only as human-merge/override trail (⊗ silent policy rewrite; `pr:merge-ready` still uses policy floor); re-stop without new consent. ⊗ Unlimited auto-retry. ⊗ Parent self-implement (#2843). Portable consumer + maintainer.
+
 ## Runtime Capability Detection (summary)
 
 ! Before selecting a launch method, probe the environment. Full probe text: [`references/core-phase-3.md`](references/core-phase-3.md).
@@ -210,6 +217,7 @@ Named mode **beside** dispatch-and-collect. Canon: [`../../swarm/swarm.md`](../.
 - ⊗ Misclassify OpenClaw `sessions_spawn` as `grok-build` or `generic-terminal` (#2875)
 - ⊗ Misclassify Claude Code as `cursor-composer` / `generic-terminal` (#3134)
 - ⊗ Run multi-iteration repair/monitor loops without a failure stop or with silent continuation after the envelope is exhausted (#2442)
+- ⊗ Dual-stop/hard-stop halt without #3273 resume line, or unlimited residual auto-retry without new operator consent (#3273)
 - ⊗ Force a second full dispatch on a retain-capable host solely for a mid-scope gate, or invent retain on one-shot hosts (#3158)
 - ⊗ Use retained-child messaging for mid-run constitution self-edit (#3158 / #3164)
 

package/skills/deft-directive-swarm/references/core-ops.md

@@ -158,6 +158,8 @@ CONSTRAINTS:
 - ⊗ Full dual-source re-QC solely because the harness re-delivered the same settle event (#3092)
 - ⊗ Run multi-iteration repair, monitor, or implement-fix loops without a dual-stop failure envelope (max iterations and/or no-progress and/or budget) (#2442)
 - ⊗ Silently continue, re-dispatch, or open another identical attempt after the failure stop fires — halt with an operator-visible report (what was tried, what is missing, what human decision is needed) (#2442)
+- ⊗ Emit a dual-stop / hard-stop / conf-residual terminal halt report **without** the #3273 resume line (residual class + example phrases pursue residual / follow-up hard-stop / same as conf-hold / continue dual-stopped PR + skill section pointer) — primary discovery path; see `core-phase-4.md` Operator follow-up after dual-stop / hard stop
+- ⊗ Unlimited auto-retry or parent self-implement after dual-stop without new operator consent (#3273 / #2843 / #2442)
 - ⊗ Treat dual-stop skill defaults as a durable delivery-attempt ledger — mechanical cross-revision circuit breaker is #3143 (`packages/core/src/delivery-attempt/`), not prompt-only thrashing control (#2442)
 - ⊗ Spawn a second implement leaf without `task swarm:pre-dispatch` exit 0, or while exit 1 (`DENY_DUPLICATE_ACTIVE`) — gate is authoritative (#3228 / #3143); takeover is cancel-then-begin, not dual active
 - ⊗ Force a second full dispatch on a retain-capable host solely because a mid-scope approval gate exists — re-message the live child (message-later / steer-mid-flight) instead (#3158)

package/skills/deft-directive-swarm/references/core-phase-4.md

@@ -74,6 +74,40 @@ tools: explore=0 commit=3 verify=0 coordinate=0 unknown=1 | anomalies: commit-wi
 
 ! When the failure stop fires: **halt** automatic repair/re-dispatch; emit an **operator-visible halt report** (what was tried, current stage, missing evidence, human decision needed). Prefer `BLOCKED:` over thin `DONE` when the unit cannot reach merge-ready inside the envelope.
 
+! **Halt-report resume line (MUST, #3273 / AC6):** Terminal dual-stop / hard-stop / conf-residual halt reports MUST end with a copy-pasteable operator resume affordance so agents discover the follow-up path without prior chat memory:
+
+```
+RESUME: residual=<class> conf=<n/5|n/a> PR=<url>
+Operator may re-authorize **one residual pass** with: pursue residual | follow-up hard-stop | same as conf-hold | continue dual-stopped PR
+Skill: deft-directive-swarm § Operator follow-up after dual-stop / hard stop (#3273) · deft-directive-review-cycle same section
+```
+
+Residual class examples: `review_cycle_cap` / `greptile_p0_p1` / `conf_floor` / `no_progress` / `ci_weather` / `thin_done`.
+
+### Operator follow-up after dual-stop / hard stop (#3273)
+
+Operator-initiated resume after dual-stop, hard-stop, or conf-floor residual — **not** automatic re-thrash. Primary discovery is the halt-report resume line above; this section holds the steps. Portable for consumer deposit and maintainer tree (`task` / `deft` dual-invoke; no framework-monorepo-only path).
+
+**Triggers:** pursue residual · follow-up hard-stop · same as conf-hold · continue dual-stopped PR · re-babysit residual
+
+**One residual pass (then re-stop):**
+1. Ground-truth: dual-invoke `pr:merge-ready` / `pr:watch --one-shot` on the PR (CLI `deft` first, then `task deft:` — see review-cycle #2893).
+2. If a delivery attempt is still active, cancel then begin with the **same unit ids** (exit 0 required before residual spawn) (#3228 / #3143):
+   ```
+   task swarm:pre-dispatch -- --scope-id <story-or-issue-or-xbrief-id> --target-id <worktree-path-or-branch> --action cancel
+   task swarm:pre-dispatch -- --scope-id <story-or-issue-or-xbrief-id> --target-id <worktree-path-or-branch>
+   ```
+3. Spawn **one** active residual worker or review-cycle owner (not sleep-only re-poll as the only work). Monitor MUST NOT self-implement product fixes after merge-ready leaf handback (#2843).
+4. If the operator authorized a conf floor for **this PR only** (e.g. ≥4/5): post a PR audit comment naming the floor, HEAD SHA, and who authorized it. That comment is the **human-merge / documented-override trail** — it does **not** rewrite `plan.policy.review.minGreptileConfidence` or make `pr:merge-ready` / `pr:watch` exit CLEAN below policy. Merge still requires policy CLEAN, bot-merge authority + override path, or human merge after the documented floor is met in the bot body. ⊗ Silent policy edit of `minGreptileConfidence` for one residual.
+5. Wait re-review; merge when policy floor + gates met (or human-merge after documented PR-local floor). Run `scope:complete` + lifecycle land when in scope (#3264 / finalize).
+
+! Dual-stop re-entry: after the residual pass (+ re-review wait), if still blocked, halt again with a fresh resume line. Another pass requires **new** operator consent.
+
+⊗ Unlimited auto-retry after dual-stop without new operator consent (#3273 / #2442).
+⊗ Sleep-only multi-hour re-poll as the sole residual work.
+⊗ Parent/monitor self-implement after merge-ready leaf handback (#2843).
+⊗ Lower project-wide `minGreptileConfidence` for one residual.
+
 ! Composes with minimal-subgraph repair (#2439): repairs stay minimal **and** dual-stop bounded. Mechanical delivery/acceptance circuit breaker: **#3143** `packages/core/src/delivery-attempt/` (`evaluatePreDispatch`). Docs: `docs/delivery-attempt.md`.
 
 ⊗ Silently continue the monitor repair loop after the envelope is exhausted.

package/strategies/rapid.md

@@ -101,6 +101,16 @@ Rapid is a **spec-generating** strategy. Selecting it at the chaining gate produ
 
 ---
 
+## Product-first done-gate / literal AC (#3284 / #3267)
+
+Rapid lightens cold ceremony only. The **positive verification content** of the light path is stated acceptance commands — not framework hygiene.
+
+- ! Capture stated shell commands at intake into `plan.acceptance.commands` (and #3267 `literal_acceptance_commands`) — do not paraphrase. Empty requires `none_stated: true` with a ladder rung (`derived` or `project_floor`).
+- ! Before done, run `task verify:ac -- <active-story-path>` (verbatim flags/cwd). Fail closed on non-zero. (`verify:literal-ac` remains the #3267 mechanism alias.)
+- ! Ceremony dial rapid/minimal = **AC-only** verification for `task check` composition (#3284): hygiene degrades away; AC never degrades when commands exist.
+- ⊗ Treat self-chosen approximate checks as sufficient when the statement named exact commands.
+- ⊗ Skip AC because ceremony is rapid — rapid's job is to keep exactly this check.
+
 ## Anti-Patterns
 
 - ⊗ Using rapid for production features -- rapid output is explicitly throwaway

package/tasks/verify.yml

@@ -472,6 +472,36 @@ tasks:
         vars:
           ENGINE_CMD: 'verify:orphan-active --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}'
 
+  completed-tracked:
+    desc: "Fail-closed completed-tracked land guard (#3264 / #1358 recurrence). Closed scoped GitHub issues with a known lifecycle xBRIEF origin must have a tracked xbrief/completed/ or xbrief/cancelled/ artifact on the delivery tip. Remediation: task swarm:finalize-cohort or a lifecycle PR. Three-state exit (0 clean / 1 missing land / 2 config). Pass --skip-gh to rely on triage cache only; --tip to override delivery tip."
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - task: :engine:_ts-build
+    cmds:
+      - task: :engine:invoke
+        vars:
+          ENGINE_CMD: 'verify:completed-tracked --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}'
+
+  literal-ac:
+    desc: "Literal acceptance-command verification (#3267). Run stated acceptance commands from the active (or --xbrief) scope artifact VERBATIM before done — same flags/cwd. Capture-only audit: --capture-only. Three-state exit (0 pass or none stated / 1 command failed / 2 config). Extends #973; required on ceremony dial rapid/minimal (#3214). Prefer verify:ac (#3284) as the product-first primary name."
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - task: :engine:_ts-build
+    cmds:
+      - task: :engine:invoke
+        vars:
+          ENGINE_CMD: 'verify:literal-ac --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}'
+
+  ac:
+    desc: "Product-first acceptance gate (#3284). Runs plan.acceptance.commands (or #3267 literal ledger) FIRST and never skippable when commands exist. Check composition uses --soft-missing-xbrief. Rapid ceremony = AC-only; pressure/degraded makes hygiene advisory. Capture-only: --capture-only. Three-state exit (0 pass or none / 1 fail / 2 config). Architecture for #3267."
+    dir: '{{.USER_WORKING_DIR}}'
+    deps:
+      - task: :engine:_ts-build
+    cmds:
+      - task: :engine:invoke
+        vars:
+          ENGINE_CMD: 'verify:ac --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}'
+
   agents-md-budget:
     desc: "Layered AGENTS.md budget instrument (#645 + #2450). Fail-closed relative ratchet: counts the managed section and the unmanaged region separately (the #1309 propagation duplicates content across the marker) and fails when either region grows past plan.policy.agentsMdBudget. Seeded at current size, so it ships green; growth past the ratchet fails. ADVISORY absolute north-star: also reports managed-section size vs ≤8 KB / ~2k tok (#2372 layered instrument) without affecting exit codes in Wave 1. Three-state exit (0 within / 1 over ratchet / 2 config error)."
     dir: '{{.USER_WORKING_DIR}}'

package/templates/agents-entry.md

@@ -16,7 +16,7 @@ Deft is installed in .deft/core/. Full guidelines: .deft/core/main.md
 
 ## Session-start ritual (#1149)
 
-! On **mutation** session start, run `deft session:start`; before code-writing or `start_agent` dispatch run `deft verify:session-ritual -- --tier=gated` (stale after `plan.policy.sessionRitualStalenessHours`; records `deft verify:tools` / `deft doctor` / `deft verify:cache-fresh` / `deft agents:refresh` / `npm i -g @deftai/directive@latest`; #1149 / #1348) — `.deft/core/commands.md` § Session-start ritual.
+! On **mutation** session start, run `deft session:start`; before code-writing or `start_agent` dispatch run `deft verify:session-ritual -- --tier=gated` (stale after `plan.policy.sessionRitualStalenessHours`; records `deft verify:tools` / `deft doctor` / `deft verify:cache-fresh` / `deft agents:refresh` / `npm i -g @deftai/directive@latest`; #1149 / #1348) — `.deft/core/commands.md` § Session-start ritual. ! SCM mirror tip (#3124): restate existence + get-the-most user-visible when tip fires (depth `commands.md`). ⊗ Absorb tip without restating.
 
 ## WIP cap