@deftai/directive-core 0.101.0 → 0.103.0

package/dist/eval/later-graduation.js

@@ -0,0 +1,91 @@
+/**
+ * #3286 Later graduation trigger from a #3282 run summary (#3320).
+ *
+ * Named surface: eval:report prints graduate / do-not-graduate / unevaluable.
+ * A graduation or decline MUST cite an emitted share. Counts without a
+ * denominator are unevaluable — never invent a ratio.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { isAbsolute, resolve } from "node:path";
+import { computeRitualGateShare, parseRunSummaryJsonl, } from "../run-summary/share.js";
+import { DEFAULT_RUN_SUMMARY_BASENAME, ENV_RUN_SUMMARY_PATH } from "../run-summary/types.js";
+/** #3286 Later trigger: graduate when ritual+gate share is at least this fraction. */
+export const LATER_GRADUATION_SHARE_THRESHOLD = 0.25;
+function formatPercent(value) {
+    return `${(value * 100).toFixed(1)}%`;
+}
+export function laterGraduationFromShare(share, threshold = LATER_GRADUATION_SHARE_THRESHOLD) {
+    if (!share.evaluable || share.share === null || share.totalToolTurns === null) {
+        return {
+            evaluable: false,
+            verdict: "unevaluable",
+            summary: "trigger unevaluable (no tool/turn denominator on run summary)",
+            ritualGateCount: share.ritualGateCount,
+            totalToolTurns: share.totalToolTurns,
+            share: null,
+            threshold,
+        };
+    }
+    const graduate = share.share >= threshold;
+    const verdict = graduate ? "graduate" : "do-not-graduate";
+    return {
+        evaluable: true,
+        verdict,
+        summary: `ritual+gate share ${formatPercent(share.share)} (${share.ritualGateCount}/${share.totalToolTurns}) — ${verdict} (threshold ${formatPercent(threshold)})`,
+        ritualGateCount: share.ritualGateCount,
+        totalToolTurns: share.totalToolTurns,
+        share: share.share,
+        threshold,
+    };
+}
+/**
+ * Resolve a readable run-summary path. Unset env + missing default file → null
+ * (fail-open / unevaluable). stdout dest (`-`) is not a file.
+ */
+export function resolveRunSummaryReadPath(projectRoot, options = {}) {
+    if (options.runSummaryPath !== undefined && options.runSummaryPath.trim().length > 0) {
+        return resolve(options.runSummaryPath.trim());
+    }
+    const env = options.env ?? process.env;
+    const raw = env[ENV_RUN_SUMMARY_PATH];
+    if (raw !== undefined && raw.trim() === "-") {
+        return null;
+    }
+    if (raw !== undefined && raw.trim().length > 0) {
+        const trimmed = raw.trim();
+        return isAbsolute(trimmed) ? resolve(trimmed) : resolve(projectRoot, trimmed);
+    }
+    const fallback = resolve(projectRoot, DEFAULT_RUN_SUMMARY_BASENAME);
+    return existsSync(fallback) ? fallback : null;
+}
+function readSummaryText(path) {
+    try {
+        if (!existsSync(path)) {
+            return null;
+        }
+        return readFileSync(path, "utf8");
+    }
+    catch {
+        return null;
+    }
+}
+/** Evaluate #3286 Later from the run-summary file (or unevaluable). */
+export function evaluateLaterGraduationTrigger(options) {
+    const threshold = options.threshold ?? LATER_GRADUATION_SHARE_THRESHOLD;
+    const path = resolveRunSummaryReadPath(options.projectRoot, {
+        runSummaryPath: options.runSummaryPath,
+        env: options.env,
+    });
+    if (path === null) {
+        return laterGraduationFromShare({ evaluable: false, ritualGateCount: 0, totalToolTurns: null, share: null }, threshold);
+    }
+    const text = readSummaryText(path);
+    if (text === null) {
+        return laterGraduationFromShare({ evaluable: false, ritualGateCount: 0, totalToolTurns: null, share: null }, threshold);
+    }
+    return laterGraduationFromShare(computeRitualGateShare(parseRunSummaryJsonl(text)), threshold);
+}
+export function formatLaterGraduationLine(trigger) {
+    return `#3286 Later: ${trigger.summary}`;
+}
+//# sourceMappingURL=later-graduation.js.map

package/dist/eval/report.d.ts

@@ -1,3 +1,4 @@
+import { type LaterGraduationTrigger } from "./later-graduation.js";
 import { type GoldenRunRecord } from "./run.js";
 import { type CellVersionPurity, type MixedVersionPolicy } from "./version-pin.js";
 export declare const REPORT_SCHEMA_VERSION: 1;
@@ -39,6 +40,8 @@ export interface GoldenEvalReport {
     readonly holdoutTripwire: HoldoutTripwire;
     /** Cell-level framework version purity for the reported model (#3215). */
     readonly versionPurity: VersionPurityEvidence;
+    /** #3286 Later graduation trigger from the run-summary denominator (#3320). */
+    readonly laterGraduation: LaterGraduationTrigger;
 }
 export interface ReportGoldenEvalOptions {
     readonly projectRoot?: string;
@@ -50,6 +53,9 @@ export interface ReportGoldenEvalOptions {
      * ledger runs for this model disagree on framework version within a treatment.
      */
     readonly mixedVersionPolicy?: MixedVersionPolicy;
+    /** Override run-summary JSONL path (#3320). Default: DEFT_RUN_SUMMARY_PATH or repo default. */
+    readonly runSummaryPath?: string;
+    readonly env?: NodeJS.ProcessEnv;
 }
 export interface ReportGoldenEvalResult {
     readonly code: 0 | 1 | 2;

package/dist/eval/report.js

@@ -1,5 +1,6 @@
 import { existsSync, readFileSync } from "node:fs";
 import { resolveEvalPath } from "../layout/resolve.js";
+import { evaluateLaterGraduationTrigger, formatLaterGraduationLine, } from "./later-graduation.js";
 import { GOLDEN_RUNS_HISTORY_REL } from "./run.js";
 import { aggregateCellWithVersionPurity, evaluateLedgerVersionPurity, } from "./version-pin.js";
 export const REPORT_SCHEMA_VERSION = 1;
@@ -107,17 +108,33 @@ export function goldenRunToVersionedRun(record) {
 }
 /** Diff two directive versions with metric deltas and significance (#1703 Tier 2). */
 export function reportGoldenEval(options) {
-    if (!options.championVersion.trim() || !options.challengerVersion.trim()) {
+    const projectRoot = options.projectRoot ?? process.cwd();
+    const laterGraduation = evaluateLaterGraduationTrigger({
+        projectRoot,
+        runSummaryPath: options.runSummaryPath,
+        env: options.env,
+    });
+    const laterLine = formatLaterGraduationLine(laterGraduation);
+    const championMissing = !options.championVersion.trim();
+    const challengerMissing = !options.challengerVersion.trim();
+    const modelMissing = !options.model.trim();
+    if (championMissing && challengerMissing && modelMissing) {
+        return {
+            code: 0,
+            report: null,
+            message: `eval:report ${laterLine}`,
+        };
+    }
+    if (championMissing || challengerMissing) {
         return {
             code: 2,
             report: null,
-            message: "eval:report: --champion and --challenger are required",
+            message: `eval:report: --champion and --challenger are required\n  ${laterLine}`,
         };
     }
-    if (!options.model.trim()) {
-        return { code: 2, report: null, message: "eval:report: --model is required" };
+    if (modelMissing) {
+        return { code: 2, report: null, message: `eval:report: --model is required\n  ${laterLine}` };
     }
-    const projectRoot = options.projectRoot ?? process.cwd();
     const policy = options.mixedVersionPolicy ?? "refuse";
     const records = readGoldenRuns(projectRoot);
     const modelRecords = records.filter((r) => r.model === options.model);
@@ -157,7 +174,7 @@ export function reportGoldenEval(options) {
         return {
             code: 1,
             report: null,
-            message: `eval:report: mixed framework versions in treatment cell(s) — aggregation refused (#3215)\n  ${versionPurity.summary}`,
+            message: `eval:report: mixed framework versions in treatment cell(s) — aggregation refused (#3215)\n  ${versionPurity.summary}\n  ${laterLine}`,
         };
     }
     const champion = findLatestGoldenRun(records, options.championVersion, options.model);
@@ -166,14 +183,14 @@ export function reportGoldenEval(options) {
         return {
             code: 1,
             report: null,
-            message: `eval:report: no golden run found for champion v${options.championVersion} model=${options.model}`,
+            message: `eval:report: no golden run found for champion v${options.championVersion} model=${options.model}\n  ${laterLine}`,
         };
     }
     if (challenger === null) {
         return {
             code: 1,
             report: null,
-            message: `eval:report: no golden run found for challenger v${options.challengerVersion} model=${options.model}`,
+            message: `eval:report: no golden run found for challenger v${options.challengerVersion} model=${options.model}\n  ${laterLine}`,
         };
     }
     const championPrimary = champion.results.filter((r) => !r.holdout);
@@ -208,6 +225,7 @@ export function reportGoldenEval(options) {
         deltas,
         holdoutTripwire,
         versionPurity,
+        laterGraduation,
     };
     const lines = [
         `eval:report champion=v${options.championVersion} challenger=v${options.challengerVersion} model=${options.model}`,
@@ -223,6 +241,7 @@ export function reportGoldenEval(options) {
         `  version purity: ${versionPurity.pure ? "ok" : "mixed"} — ${versionPurity.summary}`,
         `  champion cell pin: v${champion.frameworkVersionPin?.frameworkVersion ?? champion.directiveVersion}`,
         `  challenger cell pin: v${challenger.frameworkVersionPin?.frameworkVersion ?? challenger.directiveVersion}`,
+        `  ${laterLine}`,
     ];
     const code = holdoutTripwire.triggered ? 1 : 0;
     return { code, report, message: lines.join("\n") };

package/dist/index.d.ts

@@ -74,6 +74,7 @@ export * as vbriefBuild from "./vbrief-build/index.js";
 export * as vbriefReconcile from "./vbrief-reconcile/index.js";
 export * as vbriefValidate from "./vbrief-validate/index.js";
 export * as vbriefValidation from "./vbrief-validation/index.js";
+export * as verifyAc from "./verify-ac/index.js";
 export * as verifyEnv from "./verify-env/index.js";
 export * as verifySource from "./verify-source/index.js";
 export * as wipCap from "./wip-cap/index.js";

package/dist/index.js

@@ -75,6 +75,7 @@ export * as vbriefBuild from "./vbrief-build/index.js";
 export * as vbriefReconcile from "./vbrief-reconcile/index.js";
 export * as vbriefValidate from "./vbrief-validate/index.js";
 export * as vbriefValidation from "./vbrief-validation/index.js";
+export * as verifyAc from "./verify-ac/index.js";
 export * as verifyEnv from "./verify-env/index.js";
 export * as verifySource from "./verify-source/index.js";
 export * as wipCap from "./wip-cap/index.js";

package/dist/init-deposit/hygiene.d.ts

@@ -42,7 +42,13 @@ export declare function installerManagedMatchers(): InstallerManagedMatcher[];
  *    so an unlisted `xbrief/active/another-scope.xbrief.json` matcher still fails.
  */
 export declare function assertInstallerAllowlistHonors1430(matchers?: readonly InstallerManagedMatcher[]): void;
-/** POSIX ERE alternation embedded in the deposited deft-core-guard workflow. */
+/**
+ * Individual POSIX ERE patterns for the deposited deft-core-guard allowlist.
+ * One pattern per line in the workflow heredoc (#3345) — joined form is still
+ * available via {@link installerManagedGuardEre} for tests and classifiers.
+ */
+export declare function installerManagedGuardErePatterns(): string[];
+/** POSIX ERE alternation (joined) for tests / tooling that want a single pattern. */
 export declare function installerManagedGuardEre(): string;
 export declare function isInstallerManagedPath(path: string): boolean;
 export interface MixedCoreAndAppClassification {

package/dist/init-deposit/hygiene.js

@@ -174,12 +174,20 @@ export function assertInstallerAllowlistHonors1430(matchers = installerManagedMa
         }
     }
 }
-/** POSIX ERE alternation embedded in the deposited deft-core-guard workflow. */
-export function installerManagedGuardEre() {
+/**
+ * Individual POSIX ERE patterns for the deposited deft-core-guard allowlist.
+ * One pattern per line in the workflow heredoc (#3345) — joined form is still
+ * available via {@link installerManagedGuardEre} for tests and classifiers.
+ */
+export function installerManagedGuardErePatterns() {
     const matchers = installerManagedMatchers();
     // Refuse to emit a guard workflow that would exempt consumer denylist paths.
     assertInstallerAllowlistHonors1430(matchers);
-    return matchers.map((matcher) => matcherToEre(matcher)).join("|");
+    return matchers.map((matcher) => matcherToEre(matcher));
+}
+/** POSIX ERE alternation (joined) for tests / tooling that want a single pattern. */
+export function installerManagedGuardEre() {
+    return installerManagedGuardErePatterns().join("|");
 }
 export function isInstallerManagedPath(path) {
     return matchesInstallerManaged(path, installerManagedMatchers());

package/dist/init-deposit/scaffold.d.ts

@@ -82,6 +82,18 @@ export declare function coreGuardCheckoutUsesLine(sha?: string, tag?: string): s
  * the managed guard script / allowlist body (#1672 option 1).
  */
 export declare function mergeCoreGuardWorkflowRefresh(existing: string, desired: string): string;
+/**
+ * Soft max line length for deposited core-guard workflow YAML (#3345).
+ * Mega-line allowlist EREs previously sat near ~5k chars; keep well below.
+ * Enforced by {@link assertCoreGuardWorkflowLoadable} before deposit write.
+ */
+export declare const CORE_GUARD_WORKFLOW_MAX_LINE = 500;
+/**
+ * Fail closed if a rendered deft-core-guard workflow would not load in GHA
+ * (#3345): any `run: |` content line less indented than the block base, or a
+ * line longer than {@link CORE_GUARD_WORKFLOW_MAX_LINE}.
+ */
+export declare function assertCoreGuardWorkflowLoadable(content: string): void;
 export declare function ensureGitattributes(projectDir: string, io: InitDepositIo): boolean;
 export declare function ensureGreptileIgnore(projectDir: string, io: InitDepositIo): boolean;
 export declare function ensureCodeqlPathsIgnore(projectDir: string, io: InitDepositIo): boolean;

package/dist/init-deposit/scaffold.js

@@ -14,7 +14,7 @@ import { assertDestinationNotSymlink, ProjectionContainmentError, } from "../fs/
 import { agentsRefreshPlan } from "../platform/agents-md.js";
 import { MIGRATED_ARTIFACT_DIR } from "../xbrief-migrate/constants.js";
 import { CANONICAL_INSTALL_ROOT } from "./constants.js";
-import { assertInstallerAllowlistHonors1430, installerManagedGuardEre } from "./hygiene.js";
+import { assertInstallerAllowlistHonors1430, installerManagedGuardErePatterns } from "./hygiene.js";
 import { writeAgentsSkillsFromInventory } from "./skill-discovery-deposit.js";
 import { syncConsumerXbriefSchemas } from "./xbrief-projections.js";
 export { CANONICAL_INSTALL_ROOT };
@@ -501,16 +501,66 @@ export function mergeCoreGuardWorkflowRefresh(existing, desired) {
         return desired;
     return desired.slice(0, idx) + existingCheckout + desired.slice(idx + desiredCheckout.length);
 }
+/**
+ * Indent for shell lines inside the deposited workflow `run: |` block.
+ * YAML literal blocks end at any line less indented than this; the #3193
+ * Python body must stay at this column so GHA can load the workflow (#3345).
+ */
+const CORE_GUARD_RUN_INDENT = "          ";
+/**
+ * Soft max line length for deposited core-guard workflow YAML (#3345).
+ * Mega-line allowlist EREs previously sat near ~5k chars; keep well below.
+ * Enforced by {@link assertCoreGuardWorkflowLoadable} before deposit write.
+ */
+export const CORE_GUARD_WORKFLOW_MAX_LINE = 500;
+/**
+ * Fail closed if a rendered deft-core-guard workflow would not load in GHA
+ * (#3345): any `run: |` content line less indented than the block base, or a
+ * line longer than {@link CORE_GUARD_WORKFLOW_MAX_LINE}.
+ */
+export function assertCoreGuardWorkflowLoadable(content) {
+    if (!content.startsWith("name: deft-core-guard\n") &&
+        !content.startsWith("name: deft-core-guard\r\n")) {
+        throw new Error("deft-core-guard workflow must start with name: deft-core-guard (#3345)");
+    }
+    let inRun = false;
+    let baseIndent = null;
+    for (const [index, line] of content.split("\n").entries()) {
+        if (line.length > CORE_GUARD_WORKFLOW_MAX_LINE) {
+            throw new Error(`deft-core-guard workflow line ${index + 1} is ${line.length} chars ` +
+                `(max ${CORE_GUARD_WORKFLOW_MAX_LINE}; #3345 loadable YAML)`);
+        }
+        if (line.trim() === "run: |") {
+            inRun = true;
+            baseIndent = null;
+            continue;
+        }
+        if (!inRun || line.trim() === "")
+            continue;
+        const lead = line.match(/^( *)/)?.[1]?.length ?? 0;
+        if (baseIndent === null) {
+            baseIndent = lead;
+            continue;
+        }
+        if (lead < baseIndent) {
+            throw new Error(`deft-core-guard workflow line ${index + 1} dedents below run-block base ` +
+                `(indent ${lead} < ${baseIndent}; #3345 YAML load failure class)`);
+        }
+    }
+}
 /**
  * Embedded python3 content check for package.json / lockfiles when co-travelling
  * with .deft/core/** (#3193). Mirrors TS `isUpgradePinPathContentAllowed`.
  * Uses a single-quoted heredoc so GHA does not interpolate shell variables
  * inside the Python source (BASE/HEAD are argv).
+ *
+ * Every emitted line is indented to {@link CORE_GUARD_RUN_INDENT} so the YAML
+ * `run: |` block stays intact (#3345). After GHA strips the common indent, the
+ * shell heredoc body reaches python3 with correct relative indentation.
  */
 function coreGuardPinContentPython() {
     // Keep this compact: deposited into every consumer workflow on init/update.
-    return [
-        '          python3 - "$BASE_SHA" "$HEAD_SHA" <<\'PY\'',
+    const pyBody = [
         "import json, re, subprocess, sys",
         "base_sha, head_sha = sys.argv[1], sys.argv[2]",
         "def git_show(sha, path):",
@@ -766,7 +816,31 @@ function coreGuardPinContentPython() {
         "    print('\\n'.join(bad))",
         "    sys.exit(1)",
         "print('OK: package/lock content is Directive pin unit (#3193).')",
-        "PY",
+    ];
+    const run = CORE_GUARD_RUN_INDENT;
+    return [
+        `${run}python3 - "$BASE_SHA" "$HEAD_SHA" <<'PY'`,
+        ...pyBody.map((line) => `${run}${line}`),
+        `${run}PY`,
+    ].join("\n");
+}
+/**
+ * Shell that materializes the installer-managed allowlist as one ERE per line
+ * and filters "app" paths with `grep -vE -f` (#3345 — avoids a ~5k-char line
+ * that contributed to invalid workflow load). Semantics match the prior
+ * single-alternation ERE (OR of all matchers).
+ */
+function coreGuardAllowlistShell() {
+    const run = CORE_GUARD_RUN_INDENT;
+    const patterns = installerManagedGuardErePatterns();
+    return [
+        `${run}# Installer-managed allowlist — one ERE per line (#3345 loadable YAML)`,
+        `${run}allowlist=$(mktemp)`,
+        `${run}trap 'rm -f "$allowlist"' EXIT`,
+        `${run}cat > "$allowlist" <<'ALLOW'`,
+        ...patterns.map((p) => `${run}${p}`),
+        `${run}ALLOW`,
+        `${run}app=$(printf '%s\\n' "$changed" | grep -vE '^\\.deft/core/' | grep -vE -f "$allowlist" | grep -v '^$' || true)`,
     ].join("\n");
 }
 function coreGuardWorkflowContent() {
@@ -775,7 +849,7 @@ function coreGuardWorkflowContent() {
     const baseSha = githubActionsExpr("github.event.pull_request.base.sha");
     const headSha = githubActionsExpr("github.event.pull_request.head.sha");
     return ("name: deft-core-guard\n\n" +
-        "# Deft framework guard (#1430 / #3127 / #3193): a single PR should not mix changes to the\n" +
+        "# Deft framework guard (#1430 / #3127 / #3193 / #3345): a single PR should not mix changes to the\n" +
         "# vendored framework payload (.deft/core/**) with true application/product files.\n" +
         "# One upgrade PR MAY include deposit + installer-managed paths + package.json pin/lock\n" +
         "# + .deft/GENERATION.json when package.json is @deftai/directive* dependency-key pin-only\n" +
@@ -803,9 +877,7 @@ function coreGuardWorkflowContent() {
         '          echo "Changed files:"\n' +
         '          echo "$changed"\n' +
         "          core=$(printf '%s\\n' \"$changed\" | grep -E '^\\.deft/core/' || true)\n" +
-        "          app=$(printf '%s\\n' \"$changed\" | grep -vE '^\\.deft/core/' | grep -vE '" +
-        installerManagedGuardEre() +
-        "' | grep -v '^$' || true)\n" +
+        `${coreGuardAllowlistShell()}\n` +
         '          if [ -n "$core" ] && [ -n "$app" ]; then\n' +
         '            echo "::error title=deft-core guard (#1430)::This PR changes the vendored framework payload (.deft/core/**) AND non-framework files. Split the framework update into its own PR."\n' +
         '            echo "--- framework (.deft/core/**) changes ---"; printf \'%s\\n\' "$core"\n' +
@@ -951,6 +1023,7 @@ export function ensureCodeqlPathsIgnore(projectDir, io) {
 export function ensureCoreGuardWorkflow(projectDir, io) {
     const path = projectionTarget(projectDir, CORE_GUARD_WORKFLOW_REL);
     const desired = coreGuardWorkflowContent();
+    assertCoreGuardWorkflowLoadable(desired);
     if (existsSync(path)) {
         const existing = readFileSync(path, "utf8");
         if (!existing.includes("name: deft-core-guard")) {

package/dist/intake/issue-ingest.js

@@ -6,12 +6,14 @@ import { assertWriteTargetSafe, ProjectionContainmentError } from "../fs/project
 import { hasArtifactSuffix, resolveLifecycleRoot } from "../layout/resolve.js";
 import { captureAndAttachLiteralAcceptance } from "../literal-acceptance/index.js";
 import { stampAcceptanceFromLiteralCapture } from "../product-first-done-gate/index.js";
+import { ENV_RUN_SUMMARY_PATH, RunSummaryEmitter } from "../run-summary/index.js";
 import { call } from "../scm/call.js";
 import { resolveProjectRoot } from "../scope/project-context.js";
 import { resolveProjectRepo } from "../slice/project-context.js";
 import { countMaintainerCurrentShapeComments, mapIssueCommentEntry, RAW_ISSUE_COMMENTS_KEY, selectCurrentShapeComment, } from "../umbrella-current-shape/index.js";
 import { slugify, TODAY } from "../vbrief-build/build.js";
 import { EMITTED_VBRIEF_VERSION } from "../vbrief-build/constants.js";
+import { stampDerivedClausesOnAcceptance } from "../verify-ac/clauses.js";
 import { LEGACY_ARTIFACT_SUFFIX, LEGACY_INFO_ROOT_KEY, MIGRATED_ARTIFACT_DIR, MIGRATED_ARTIFACT_SUFFIX, MIGRATED_INFO_ROOT_KEY, VBRIEF_VERSION, } from "../xbrief-migrate/constants.js";
 import { findAcHeading, parseCheckboxItems, parseListItems, sliceAcSection, stripCodeBlocks, stripFencedCodeBlocks, } from "./markdown-scanners.js";
 import { detectRepo, extractReferencesFromVbrief, fetchOpenIssues, GITHUB_ISSUE_REF_TYPES, LIFECYCLE_FOLDERS, parseIssueNumber, } from "./reconcile-issues.js";
@@ -475,6 +477,9 @@ export function buildIssueVbrief(issue, status, repoUrl, options = {}) {
         Object.assign(plan, attached.plan);
         // #3284: stamp plan.acceptance from captured literals (stated or none_stated floor).
         Object.assign(plan, stampAcceptanceFromLiteralCapture(plan));
+        // #3323: when no commands were stated, derive numbered clauses before product edit.
+        const derived = stampDerivedClausesOnAcceptance(plan, [title, overviewSource].filter((s) => s.length > 0).join("\n\n"));
+        Object.assign(plan, derived.plan);
     }
     else {
         // No body: still record none_stated acceptance so absence is a decision.
@@ -718,8 +723,45 @@ export function ingestOne(issue, options) {
     assertWriteTargetSafe(projectRoot, target);
     mkdirSync(folderPath, { recursive: true });
     writeFileSync(target, `${JSON.stringify(vbrief, null, 2)}\n`, "utf8");
+    emitIntakeAcceptanceStamp(projectRoot, vbrief.plan);
     return ["created", target, `CREATED ${folder}/${filename}`];
 }
+function emitIntakeAcceptanceStamp(projectRoot, plan) {
+    const rec = plan !== null && typeof plan === "object" && !Array.isArray(plan)
+        ? plan
+        : null;
+    if (rec === null) {
+        return;
+    }
+    const acceptance = rec.acceptance !== null && typeof rec.acceptance === "object" && !Array.isArray(rec.acceptance)
+        ? rec.acceptance
+        : null;
+    if (acceptance === null) {
+        return;
+    }
+    const env = process.env;
+    const dest = env[ENV_RUN_SUMMARY_PATH];
+    if (dest === undefined || dest.trim().length === 0) {
+        return;
+    }
+    try {
+        const sessionId = typeof env.DEFT_SESSION_ID === "string" && env.DEFT_SESSION_ID.trim().length > 0
+            ? env.DEFT_SESSION_ID.trim()
+            : "issue-ingest";
+        const emitter = new RunSummaryEmitter({ projectRoot, sessionId, env });
+        const commands = Array.isArray(acceptance.commands) ? acceptance.commands.length : 0;
+        const clauses = Array.isArray(acceptance.clauses) ? acceptance.clauses.length : 0;
+        emitter.emitAcceptanceStamp({
+            rung: typeof acceptance.source_rung === "string" ? acceptance.source_rung : "project_floor",
+            none_stated: acceptance.none_stated === true,
+            command_count: commands,
+            clause_count: clauses,
+        });
+    }
+    catch {
+        // fail-open
+    }
+}
 export function ingestBulk(issues, options) {
     let filtered = issues;
     if (options.label !== undefined && options.label !== null) {

package/dist/policy/ceremony-dial-escalation.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Ceremony-dial escalation evaluation + start-tier provenance (#3319).
+ *
+ * Observability only: does not change escalate-on-evidence thresholds or the
+ * default start tier. A declined evaluation is distinct from never-evaluated.
+ */
+import type { DialEscalationEvaluationOutcome } from "../run-summary/types.js";
+import { type CeremonyDepth, type CeremonyDialInputs, type CeremonyDialSelection, type CeremonyModelTier } from "./ceremony-dial.js";
+export declare const CEREMONY_START_TIER_PROVENANCES: readonly ["cold-start", "external-pin", "operator"];
+export type CeremonyStartTierProvenance = (typeof CEREMONY_START_TIER_PROVENANCES)[number];
+export declare const CEREMONY_DEPTH_RANK: Readonly<Record<CeremonyDepth, number>>;
+export interface ResolveCeremonyStartTierProvenanceInput {
+    readonly selection: CeremonyDialSelection;
+    /** True when session:start received a pre-resolved selection (CLI/harness). */
+    readonly injectedSelection: boolean;
+    readonly hint?: CeremonyStartTierProvenance;
+}
+export declare function resolveCeremonyStartTierProvenance(input: ResolveCeremonyStartTierProvenanceInput): CeremonyStartTierProvenance;
+export declare function isCeremonyStartTierPinned(provenance: CeremonyStartTierProvenance): boolean;
+/** Session-start fail-closed line when a pin bypasses #3274 cold-start selection. */
+export declare function formatCeremonyDialPinBypassLine(provenance: CeremonyStartTierProvenance): string | null;
+export interface CeremonyDialEscalationEvaluation {
+    readonly tier: CeremonyDepth;
+    readonly outcome: DialEscalationEvaluationOutcome;
+    readonly reason: string;
+    readonly from: CeremonyDepth;
+    readonly to: CeremonyDepth;
+}
+export interface EvaluateCeremonyDialEscalationInput {
+    readonly from: CeremonyDepth;
+    readonly to: CeremonyDepth;
+    readonly inputs?: CeremonyDialInputs;
+}
+/**
+ * Pure escalate-on-evidence evaluation. `to > from` → escalated; else declined.
+ * Does not persist a transition.
+ */
+export declare function evaluateCeremonyDialEscalation(input: EvaluateCeremonyDialEscalationInput): CeremonyDialEscalationEvaluation;
+/** Cold-start vs selected depth at session:start (unpinned path only). */
+export declare function evaluateSessionStartCeremonyDialEscalation(input: {
+    readonly selection: CeremonyDialSelection;
+    readonly modelTier?: CeremonyModelTier | null;
+}): CeremonyDialEscalationEvaluation;
+export interface EmitCeremonyDialEscalationEvaluationOptions {
+    readonly projectRoot: string;
+    readonly sessionId: string;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly evaluation: CeremonyDialEscalationEvaluation;
+}
+/** Fail-open emit of a #3319 evaluation event. */
+export declare function emitCeremonyDialEscalationEvaluation(options: EmitCeremonyDialEscalationEvaluationOptions): void;
+//# sourceMappingURL=ceremony-dial-escalation.d.ts.map

package/dist/policy/ceremony-dial-escalation.js

@@ -0,0 +1,92 @@
+/**
+ * Ceremony-dial escalation evaluation + start-tier provenance (#3319).
+ *
+ * Observability only: does not change escalate-on-evidence thresholds or the
+ * default start tier. A declined evaluation is distinct from never-evaluated.
+ */
+import { RunSummaryEmitter } from "../run-summary/emit.js";
+import { selectCeremonyColdStartDepth, } from "./ceremony-dial.js";
+export const CEREMONY_START_TIER_PROVENANCES = ["cold-start", "external-pin", "operator"];
+export const CEREMONY_DEPTH_RANK = {
+    minimal: 0,
+    rapid: 1,
+    standard: 2,
+    elevated: 3,
+};
+export function resolveCeremonyStartTierProvenance(input) {
+    if (input.hint !== undefined) {
+        return input.hint;
+    }
+    if (input.selection.source === "override") {
+        return input.injectedSelection ? "external-pin" : "operator";
+    }
+    return "cold-start";
+}
+export function isCeremonyStartTierPinned(provenance) {
+    return provenance === "external-pin" || provenance === "operator";
+}
+/** Session-start fail-closed line when a pin bypasses #3274 cold-start selection. */
+export function formatCeremonyDialPinBypassLine(provenance) {
+    if (!isCeremonyStartTierPinned(provenance)) {
+        return null;
+    }
+    const pinLabel = provenance === "external-pin" ? "external-pin" : "operator pin";
+    return (`[deft ceremony-dial] #3274 cold-start selection is bypassed (${pinLabel}). ` +
+        "Unset the pin (--ceremony-depth or plan.policy.ceremonyDial.override) to exercise #3274.");
+}
+/**
+ * Pure escalate-on-evidence evaluation. `to > from` → escalated; else declined.
+ * Does not persist a transition.
+ */
+export function evaluateCeremonyDialEscalation(input) {
+    const size = input.inputs?.taskSize ?? null;
+    const modelTier = input.inputs?.modelTier ?? null;
+    const evidence = `size=${size ?? "-"} modelTier=${modelTier ?? "-"}`;
+    const raised = CEREMONY_DEPTH_RANK[input.to] > CEREMONY_DEPTH_RANK[input.from];
+    if (raised) {
+        return {
+            tier: input.to,
+            outcome: "escalated",
+            reason: `evidence raised ${input.from} -> ${input.to} (${evidence})`,
+            from: input.from,
+            to: input.to,
+        };
+    }
+    return {
+        tier: input.from,
+        outcome: "declined",
+        reason: `insufficient evidence to raise above ${input.from} (${evidence})`,
+        from: input.from,
+        to: input.to,
+    };
+}
+/** Cold-start vs selected depth at session:start (unpinned path only). */
+export function evaluateSessionStartCeremonyDialEscalation(input) {
+    const modelTier = input.modelTier ?? input.selection.inputs.modelTier;
+    const from = selectCeremonyColdStartDepth(modelTier);
+    return evaluateCeremonyDialEscalation({
+        from,
+        to: input.selection.depth,
+        inputs: input.selection.inputs,
+    });
+}
+/** Fail-open emit of a #3319 evaluation event. */
+export function emitCeremonyDialEscalationEvaluation(options) {
+    try {
+        const emitter = new RunSummaryEmitter({
+            projectRoot: options.projectRoot,
+            sessionId: options.sessionId,
+            env: options.env,
+        });
+        emitter.emitDialEscalationEvaluation({
+            tier: options.evaluation.tier,
+            outcome: options.evaluation.outcome,
+            reason: options.evaluation.reason,
+        });
+        emitter.emitKnownToolTurnDenominator();
+    }
+    catch {
+        // fail-open
+    }
+}
+//# sourceMappingURL=ceremony-dial-escalation.js.map

package/dist/policy/ceremony-dial.d.ts

@@ -161,7 +161,9 @@ export interface ResolveCeremonyDialOptions {
  */
 export declare function resolveCeremonyDial(projectRoot: string, options?: ResolveCeremonyDialOptions): CeremonyDialSelection;
 /** Human-readable status line for session:start / policy:show. */
-export declare function formatCeremonyDialStatusLine(selection: CeremonyDialSelection): string;
+export declare function formatCeremonyDialStatusLine(selection: CeremonyDialSelection, extras?: {
+    readonly startTierProvenance?: string;
+}): string;
 /** JSON-serializable dial snapshot for ritual-state / session payload. */
 export declare function ceremonyDialToDict(selection: CeremonyDialSelection): Record<string, unknown>;
 export interface CeremonyDialPolicyField {