@deftai/directive-core 0.102.0 → 0.104.0

package/dist/init-deposit/scaffold.js

@@ -14,7 +14,7 @@ import { assertDestinationNotSymlink, ProjectionContainmentError, } from "../fs/
 import { agentsRefreshPlan } from "../platform/agents-md.js";
 import { MIGRATED_ARTIFACT_DIR } from "../xbrief-migrate/constants.js";
 import { CANONICAL_INSTALL_ROOT } from "./constants.js";
-import { assertInstallerAllowlistHonors1430, installerManagedGuardEre } from "./hygiene.js";
+import { assertInstallerAllowlistHonors1430, installerManagedGuardErePatterns } from "./hygiene.js";
 import { writeAgentsSkillsFromInventory } from "./skill-discovery-deposit.js";
 import { syncConsumerXbriefSchemas } from "./xbrief-projections.js";
 export { CANONICAL_INSTALL_ROOT };
@@ -501,16 +501,66 @@ export function mergeCoreGuardWorkflowRefresh(existing, desired) {
         return desired;
     return desired.slice(0, idx) + existingCheckout + desired.slice(idx + desiredCheckout.length);
 }
+/**
+ * Indent for shell lines inside the deposited workflow `run: |` block.
+ * YAML literal blocks end at any line less indented than this; the #3193
+ * Python body must stay at this column so GHA can load the workflow (#3345).
+ */
+const CORE_GUARD_RUN_INDENT = "          ";
+/**
+ * Soft max line length for deposited core-guard workflow YAML (#3345).
+ * Mega-line allowlist EREs previously sat near ~5k chars; keep well below.
+ * Enforced by {@link assertCoreGuardWorkflowLoadable} before deposit write.
+ */
+export const CORE_GUARD_WORKFLOW_MAX_LINE = 500;
+/**
+ * Fail closed if a rendered deft-core-guard workflow would not load in GHA
+ * (#3345): any `run: |` content line less indented than the block base, or a
+ * line longer than {@link CORE_GUARD_WORKFLOW_MAX_LINE}.
+ */
+export function assertCoreGuardWorkflowLoadable(content) {
+    if (!content.startsWith("name: deft-core-guard\n") &&
+        !content.startsWith("name: deft-core-guard\r\n")) {
+        throw new Error("deft-core-guard workflow must start with name: deft-core-guard (#3345)");
+    }
+    let inRun = false;
+    let baseIndent = null;
+    for (const [index, line] of content.split("\n").entries()) {
+        if (line.length > CORE_GUARD_WORKFLOW_MAX_LINE) {
+            throw new Error(`deft-core-guard workflow line ${index + 1} is ${line.length} chars ` +
+                `(max ${CORE_GUARD_WORKFLOW_MAX_LINE}; #3345 loadable YAML)`);
+        }
+        if (line.trim() === "run: |") {
+            inRun = true;
+            baseIndent = null;
+            continue;
+        }
+        if (!inRun || line.trim() === "")
+            continue;
+        const lead = line.match(/^( *)/)?.[1]?.length ?? 0;
+        if (baseIndent === null) {
+            baseIndent = lead;
+            continue;
+        }
+        if (lead < baseIndent) {
+            throw new Error(`deft-core-guard workflow line ${index + 1} dedents below run-block base ` +
+                `(indent ${lead} < ${baseIndent}; #3345 YAML load failure class)`);
+        }
+    }
+}
 /**
  * Embedded python3 content check for package.json / lockfiles when co-travelling
  * with .deft/core/** (#3193). Mirrors TS `isUpgradePinPathContentAllowed`.
  * Uses a single-quoted heredoc so GHA does not interpolate shell variables
  * inside the Python source (BASE/HEAD are argv).
+ *
+ * Every emitted line is indented to {@link CORE_GUARD_RUN_INDENT} so the YAML
+ * `run: |` block stays intact (#3345). After GHA strips the common indent, the
+ * shell heredoc body reaches python3 with correct relative indentation.
  */
 function coreGuardPinContentPython() {
     // Keep this compact: deposited into every consumer workflow on init/update.
-    return [
-        '          python3 - "$BASE_SHA" "$HEAD_SHA" <<\'PY\'',
+    const pyBody = [
         "import json, re, subprocess, sys",
         "base_sha, head_sha = sys.argv[1], sys.argv[2]",
         "def git_show(sha, path):",
@@ -766,7 +816,31 @@ function coreGuardPinContentPython() {
         "    print('\\n'.join(bad))",
         "    sys.exit(1)",
         "print('OK: package/lock content is Directive pin unit (#3193).')",
-        "PY",
+    ];
+    const run = CORE_GUARD_RUN_INDENT;
+    return [
+        `${run}python3 - "$BASE_SHA" "$HEAD_SHA" <<'PY'`,
+        ...pyBody.map((line) => `${run}${line}`),
+        `${run}PY`,
+    ].join("\n");
+}
+/**
+ * Shell that materializes the installer-managed allowlist as one ERE per line
+ * and filters "app" paths with `grep -vE -f` (#3345 — avoids a ~5k-char line
+ * that contributed to invalid workflow load). Semantics match the prior
+ * single-alternation ERE (OR of all matchers).
+ */
+function coreGuardAllowlistShell() {
+    const run = CORE_GUARD_RUN_INDENT;
+    const patterns = installerManagedGuardErePatterns();
+    return [
+        `${run}# Installer-managed allowlist — one ERE per line (#3345 loadable YAML)`,
+        `${run}allowlist=$(mktemp)`,
+        `${run}trap 'rm -f "$allowlist"' EXIT`,
+        `${run}cat > "$allowlist" <<'ALLOW'`,
+        ...patterns.map((p) => `${run}${p}`),
+        `${run}ALLOW`,
+        `${run}app=$(printf '%s\\n' "$changed" | grep -vE '^\\.deft/core/' | grep -vE -f "$allowlist" | grep -v '^$' || true)`,
     ].join("\n");
 }
 function coreGuardWorkflowContent() {
@@ -775,7 +849,7 @@ function coreGuardWorkflowContent() {
     const baseSha = githubActionsExpr("github.event.pull_request.base.sha");
     const headSha = githubActionsExpr("github.event.pull_request.head.sha");
     return ("name: deft-core-guard\n\n" +
-        "# Deft framework guard (#1430 / #3127 / #3193): a single PR should not mix changes to the\n" +
+        "# Deft framework guard (#1430 / #3127 / #3193 / #3345): a single PR should not mix changes to the\n" +
         "# vendored framework payload (.deft/core/**) with true application/product files.\n" +
         "# One upgrade PR MAY include deposit + installer-managed paths + package.json pin/lock\n" +
         "# + .deft/GENERATION.json when package.json is @deftai/directive* dependency-key pin-only\n" +
@@ -803,9 +877,7 @@ function coreGuardWorkflowContent() {
         '          echo "Changed files:"\n' +
         '          echo "$changed"\n' +
         "          core=$(printf '%s\\n' \"$changed\" | grep -E '^\\.deft/core/' || true)\n" +
-        "          app=$(printf '%s\\n' \"$changed\" | grep -vE '^\\.deft/core/' | grep -vE '" +
-        installerManagedGuardEre() +
-        "' | grep -v '^$' || true)\n" +
+        `${coreGuardAllowlistShell()}\n` +
         '          if [ -n "$core" ] && [ -n "$app" ]; then\n' +
         '            echo "::error title=deft-core guard (#1430)::This PR changes the vendored framework payload (.deft/core/**) AND non-framework files. Split the framework update into its own PR."\n' +
         '            echo "--- framework (.deft/core/**) changes ---"; printf \'%s\\n\' "$core"\n' +
@@ -951,6 +1023,7 @@ export function ensureCodeqlPathsIgnore(projectDir, io) {
 export function ensureCoreGuardWorkflow(projectDir, io) {
     const path = projectionTarget(projectDir, CORE_GUARD_WORKFLOW_REL);
     const desired = coreGuardWorkflowContent();
+    assertCoreGuardWorkflowLoadable(desired);
     if (existsSync(path)) {
         const existing = readFileSync(path, "utf8");
         if (!existing.includes("name: deft-core-guard")) {

package/dist/intake/clause-derivation.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Hand-authored briefs run #3323 clause derivation on activate/promote (#3360).
+ *
+ * issue:ingest already stamps clauses. The dominant consumer path authors the
+ * brief by hand; #3334 only required plan.acceptance to exist. This module is
+ * the missing derive step.
+ */
+import { type AcceptanceClause } from "../verify-ac/clauses.js";
+/** True when activate/promote must run #3323 (absent, empty none_stated, or command-only). */
+export declare function needsClauseDerivation(acceptance: unknown): boolean;
+/** Task-statement text from title, narratives, and item Acceptance fields. */
+export declare function collectTaskStatementFromPlan(plan: Record<string, unknown>): string;
+export interface ClauseDerivationResult {
+    readonly applied: boolean;
+    readonly clauses: readonly AcceptanceClause[];
+    readonly notice: string;
+}
+/**
+ * Stamp derived clauses onto plan.acceptance in place. Headless: records
+ * chosen_reading, never blocks on a question.
+ */
+export declare function applyClauseDerivationToPlan(plan: Record<string, unknown>, options?: {
+    readonly projectRoot?: string;
+    readonly emitStamp?: boolean;
+}): ClauseDerivationResult;
+/** Stable fingerprint of plan.acceptance for first-write / material-change detection (#3355). */
+export declare function acceptanceFingerprint(acceptance: unknown): string | null;
+/** True when next is a first write or a material change versus previous (#3355). */
+export declare function isMaterialAcceptanceChange(previous: unknown, next: unknown): boolean;
+/** Fail-open acceptance_stamp emission (same contract as issue:ingest / #3355). */
+export declare function emitAcceptanceStampFromPlan(projectRoot: string, plan: unknown, env?: NodeJS.ProcessEnv): void;
+/**
+ * Emit acceptance_stamp when plan.acceptance is first written or materially changed.
+ * State-observed: callers pass the before/after blocks from any lifecycle verb (#3355).
+ */
+export declare function maybeEmitAcceptanceStampFromChange(projectRoot: string, previous: unknown, next: unknown, env?: NodeJS.ProcessEnv): boolean;
+//# sourceMappingURL=clause-derivation.d.ts.map

package/dist/intake/clause-derivation.js

@@ -0,0 +1,207 @@
+/**
+ * Hand-authored briefs run #3323 clause derivation on activate/promote (#3360).
+ *
+ * issue:ingest already stamps clauses. The dominant consumer path authors the
+ * brief by hand; #3334 only required plan.acceptance to exist. This module is
+ * the missing derive step.
+ */
+import { ENV_RUN_SUMMARY_PATH, RunSummaryEmitter } from "../run-summary/index.js";
+import { deriveAcceptanceClauses, readAcceptanceClauses, serializeAcceptanceClauses, } from "../verify-ac/clauses.js";
+const NARRATIVE_KEYS = [
+    "Overview",
+    "Description",
+    "Acceptance",
+    "AcceptanceCriteria",
+    "Acceptance sketch",
+    "AcceptanceSketch",
+    "Test",
+    "Verification",
+    "ImplementationPlan",
+];
+function asRecord(value) {
+    if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+        return value;
+    }
+    return null;
+}
+function isNonEmptyString(value) {
+    return typeof value === "string" && value.trim().length > 0;
+}
+/** True when activate/promote must run #3323 (absent, empty none_stated, or command-only). */
+export function needsClauseDerivation(acceptance) {
+    if (acceptance === undefined || acceptance === null) {
+        return true;
+    }
+    const rec = asRecord(acceptance);
+    if (rec === null) {
+        return true;
+    }
+    return !(Array.isArray(rec.clauses) && rec.clauses.length > 0);
+}
+/** Task-statement text from title, narratives, and item Acceptance fields. */
+export function collectTaskStatementFromPlan(plan) {
+    const parts = [];
+    if (isNonEmptyString(plan.title)) {
+        parts.push(plan.title.trim());
+    }
+    const narratives = asRecord(plan.narratives);
+    if (narratives !== null) {
+        const seen = new Set();
+        for (const key of NARRATIVE_KEYS) {
+            const value = narratives[key];
+            if (isNonEmptyString(value)) {
+                parts.push(value.trim());
+                seen.add(key.toLowerCase());
+            }
+        }
+        for (const [key, value] of Object.entries(narratives)) {
+            if (seen.has(key.toLowerCase()) || !isNonEmptyString(value)) {
+                continue;
+            }
+            parts.push(value.trim());
+        }
+    }
+    if (Array.isArray(plan.items)) {
+        for (const item of plan.items) {
+            const rec = asRecord(item);
+            if (rec === null) {
+                continue;
+            }
+            const narrative = asRecord(rec.narrative);
+            const text = narrative?.Acceptance;
+            if (isNonEmptyString(text)) {
+                parts.push(text.trim());
+            }
+        }
+    }
+    return parts.join("\n\n");
+}
+function formatAmbiguousClauseNotice(clauses) {
+    const flagged = clauses.filter((clause) => clause.ambiguous);
+    const lines = [
+        `#3323 clause derivation stamped ${clauses.length} clause(s)` +
+            (flagged.length > 0 ? `; flagged-ambiguous: ${flagged.length}` : ""),
+    ];
+    for (const clause of flagged) {
+        const chosen = clause.chosen_reading ?? 0;
+        const chosenPath = clause.readings?.[chosen]?.artifact_path ?? clause.artifact_path ?? "(none)";
+        lines.push(`  clause ${clause.id}: two readings; chosen_reading=${chosen} (${chosenPath}) [headless #3323]`);
+        for (const [index, reading] of (clause.readings ?? []).entries()) {
+            lines.push(`    reading ${index}: ${reading.artifact_path ?? "(none)"}`);
+        }
+    }
+    return lines.join("\n");
+}
+/**
+ * Stamp derived clauses onto plan.acceptance in place. Headless: records
+ * chosen_reading, never blocks on a question.
+ */
+export function applyClauseDerivationToPlan(plan, options = {}) {
+    if (!needsClauseDerivation(plan.acceptance)) {
+        return {
+            applied: false,
+            clauses: readAcceptanceClauses(plan.acceptance),
+            notice: "",
+        };
+    }
+    const clauses = deriveAcceptanceClauses(collectTaskStatementFromPlan(plan));
+    if (clauses.length === 0) {
+        return { applied: false, clauses: [], notice: "" };
+    }
+    const existing = asRecord(plan.acceptance);
+    const commands = existing !== null && Array.isArray(existing.commands) ? existing.commands : [];
+    const hasCommands = commands.length > 0;
+    const noneStated = hasCommands ? existing?.none_stated === true : true;
+    const sourceRung = hasCommands && existing?.none_stated !== true
+        ? isNonEmptyString(existing?.source_rung)
+            ? existing.source_rung
+            : "stated"
+        : "derived";
+    plan.acceptance = {
+        ...(existing ?? {}),
+        commands: hasCommands ? commands : [],
+        none_stated: noneStated,
+        source_rung: sourceRung,
+        derived_reason: `derived ${clauses.length} independently testable clauses from the task statement before product edit (#3323)`,
+        clauses: serializeAcceptanceClauses(clauses),
+    };
+    if (options.emitStamp !== false && options.projectRoot !== undefined) {
+        emitAcceptanceStampFromPlan(options.projectRoot, plan);
+    }
+    return {
+        applied: true,
+        clauses,
+        notice: formatAmbiguousClauseNotice(clauses),
+    };
+}
+/** Stable fingerprint of plan.acceptance for first-write / material-change detection (#3355). */
+export function acceptanceFingerprint(acceptance) {
+    const rec = asRecord(acceptance);
+    if (rec === null) {
+        return null;
+    }
+    const commands = Array.isArray(rec.commands) ? rec.commands.length : 0;
+    const clauses = Array.isArray(rec.clauses)
+        ? rec.clauses.map((entry, index) => {
+            const row = asRecord(entry);
+            if (row === null) {
+                return `${index}`;
+            }
+            return `${row.id ?? index}:${row.text ?? ""}:${row.artifact_path ?? ""}`;
+        })
+        : [];
+    const rung = typeof rec.source_rung === "string" ? rec.source_rung : "";
+    return `${rung}|${rec.none_stated === true}|${commands}|${clauses.join(";")}`;
+}
+/** True when next is a first write or a material change versus previous (#3355). */
+export function isMaterialAcceptanceChange(previous, next) {
+    const nextFp = acceptanceFingerprint(next);
+    if (nextFp === null) {
+        return false;
+    }
+    return acceptanceFingerprint(previous) !== nextFp;
+}
+/** Fail-open acceptance_stamp emission (same contract as issue:ingest / #3355). */
+export function emitAcceptanceStampFromPlan(projectRoot, plan, env = process.env) {
+    const rec = asRecord(plan);
+    if (rec === null) {
+        return;
+    }
+    const acceptance = asRecord(rec.acceptance);
+    if (acceptance === null) {
+        return;
+    }
+    const dest = env[ENV_RUN_SUMMARY_PATH];
+    if (dest === undefined || dest.trim().length === 0) {
+        return;
+    }
+    try {
+        const sessionId = typeof env.DEFT_SESSION_ID === "string" && env.DEFT_SESSION_ID.trim().length > 0
+            ? env.DEFT_SESSION_ID.trim()
+            : "clause-derivation";
+        const emitter = new RunSummaryEmitter({ projectRoot, sessionId, env });
+        const commands = Array.isArray(acceptance.commands) ? acceptance.commands.length : 0;
+        const clauses = Array.isArray(acceptance.clauses) ? acceptance.clauses.length : 0;
+        emitter.emitAcceptanceStamp({
+            rung: typeof acceptance.source_rung === "string" ? acceptance.source_rung : "project_floor",
+            none_stated: acceptance.none_stated === true,
+            command_count: commands,
+            clause_count: clauses,
+        });
+    }
+    catch {
+        // fail-open
+    }
+}
+/**
+ * Emit acceptance_stamp when plan.acceptance is first written or materially changed.
+ * State-observed: callers pass the before/after blocks from any lifecycle verb (#3355).
+ */
+export function maybeEmitAcceptanceStampFromChange(projectRoot, previous, next, env = process.env) {
+    if (!isMaterialAcceptanceChange(previous, next)) {
+        return false;
+    }
+    emitAcceptanceStampFromPlan(projectRoot, { acceptance: next }, env);
+    return true;
+}
+//# sourceMappingURL=clause-derivation.js.map

package/dist/intake/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./candidates-log.js";
+export * from "./clause-derivation.js";
 export * from "./github-auth-modes.js";
 export { resultToDict } from "./github-auth-modes.js";
 export * from "./github-body.js";

package/dist/intake/index.js

@@ -1,4 +1,5 @@
 export * from "./candidates-log.js";
+export * from "./clause-derivation.js";
 export * from "./github-auth-modes.js";
 export { resultToDict } from "./github-auth-modes.js";
 export * from "./github-body.js";

package/dist/intake/issue-ingest.js

@@ -6,7 +6,6 @@ import { assertWriteTargetSafe, ProjectionContainmentError } from "../fs/project
 import { hasArtifactSuffix, resolveLifecycleRoot } from "../layout/resolve.js";
 import { captureAndAttachLiteralAcceptance } from "../literal-acceptance/index.js";
 import { stampAcceptanceFromLiteralCapture } from "../product-first-done-gate/index.js";
-import { ENV_RUN_SUMMARY_PATH, RunSummaryEmitter } from "../run-summary/index.js";
 import { call } from "../scm/call.js";
 import { resolveProjectRoot } from "../scope/project-context.js";
 import { resolveProjectRepo } from "../slice/project-context.js";
@@ -15,6 +14,7 @@ import { slugify, TODAY } from "../vbrief-build/build.js";
 import { EMITTED_VBRIEF_VERSION } from "../vbrief-build/constants.js";
 import { stampDerivedClausesOnAcceptance } from "../verify-ac/clauses.js";
 import { LEGACY_ARTIFACT_SUFFIX, LEGACY_INFO_ROOT_KEY, MIGRATED_ARTIFACT_DIR, MIGRATED_ARTIFACT_SUFFIX, MIGRATED_INFO_ROOT_KEY, VBRIEF_VERSION, } from "../xbrief-migrate/constants.js";
+import { emitAcceptanceStampFromPlan } from "./clause-derivation.js";
 import { findAcHeading, parseCheckboxItems, parseListItems, sliceAcSection, stripCodeBlocks, stripFencedCodeBlocks, } from "./markdown-scanners.js";
 import { detectRepo, extractReferencesFromVbrief, fetchOpenIssues, GITHUB_ISSUE_REF_TYPES, LIFECYCLE_FOLDERS, parseIssueNumber, } from "./reconcile-issues.js";
 /** Reference type pointing at the canonical current-shape comment permalink (#1870). */
@@ -723,45 +723,9 @@ export function ingestOne(issue, options) {
     assertWriteTargetSafe(projectRoot, target);
     mkdirSync(folderPath, { recursive: true });
     writeFileSync(target, `${JSON.stringify(vbrief, null, 2)}\n`, "utf8");
-    emitIntakeAcceptanceStamp(projectRoot, vbrief.plan);
+    emitAcceptanceStampFromPlan(projectRoot, vbrief.plan);
     return ["created", target, `CREATED ${folder}/${filename}`];
 }
-function emitIntakeAcceptanceStamp(projectRoot, plan) {
-    const rec = plan !== null && typeof plan === "object" && !Array.isArray(plan)
-        ? plan
-        : null;
-    if (rec === null) {
-        return;
-    }
-    const acceptance = rec.acceptance !== null && typeof rec.acceptance === "object" && !Array.isArray(rec.acceptance)
-        ? rec.acceptance
-        : null;
-    if (acceptance === null) {
-        return;
-    }
-    const env = process.env;
-    const dest = env[ENV_RUN_SUMMARY_PATH];
-    if (dest === undefined || dest.trim().length === 0) {
-        return;
-    }
-    try {
-        const sessionId = typeof env.DEFT_SESSION_ID === "string" && env.DEFT_SESSION_ID.trim().length > 0
-            ? env.DEFT_SESSION_ID.trim()
-            : "issue-ingest";
-        const emitter = new RunSummaryEmitter({ projectRoot, sessionId, env });
-        const commands = Array.isArray(acceptance.commands) ? acceptance.commands.length : 0;
-        const clauses = Array.isArray(acceptance.clauses) ? acceptance.clauses.length : 0;
-        emitter.emitAcceptanceStamp({
-            rung: typeof acceptance.source_rung === "string" ? acceptance.source_rung : "project_floor",
-            none_stated: acceptance.none_stated === true,
-            command_count: commands,
-            clause_count: clauses,
-        });
-    }
-    catch {
-        // fail-open
-    }
-}
 export function ingestBulk(issues, options) {
     let filtered = issues;
     if (options.label !== undefined && options.label !== null) {

package/dist/preflight/evaluate.d.ts

@@ -1,4 +1,5 @@
 import { type ParentLineageResult } from "../scope/parent-lineage.js";
+import { type FetchOriginUpdatedAt } from "../vbrief-reconcile/origin-freshness.js";
 /** Canonical eligibility folder — only vbrief/active/ may spawn implementation. */
 export declare const ACTIVE_FOLDER = "active";
 /** Canonical eligibility status — only `running` signals an active handoff. */
@@ -20,6 +21,10 @@ export interface EvaluateOptions {
     readonly projectRoot?: string;
     /** Skip parent-lineage check (tests / opt-out). Default false. */
     readonly skipParentLineage?: boolean;
+    /** Skip origin timestamp freshness (#3363). Default false. */
+    readonly skipOriginFreshness?: boolean;
+    /** Injected origin fetch for tests. Default: live `gh api` REST. */
+    readonly fetchOriginUpdatedAt?: FetchOriginUpdatedAt;
 }
 /** Substitute `{path}` without `$`-pattern expansion in user paths (#1721). */
 export declare function formatActivateHint(path: string): string;

package/dist/preflight/evaluate.js

@@ -2,6 +2,7 @@ import { readFileSync, statSync } from "node:fs";
 import { basename, dirname } from "node:path";
 import { evaluateIntentCeilingFromEnv } from "../policy/intent-ceiling.js";
 import { evaluateParentLineage, formatParentLineageLine, } from "../scope/parent-lineage.js";
+import { evaluateOriginFreshness, } from "../vbrief-reconcile/origin-freshness.js";
 /** Canonical eligibility folder — only vbrief/active/ may spawn implementation. */
 export const ACTIVE_FOLDER = "active";
 /** Canonical eligibility status — only `running` signals an active handoff. */
@@ -154,6 +155,19 @@ export function evaluate(vbriefPath, options = {}) {
             message: buildReject(path, `${lineage.message}${defect}\n  ${formatParentLineageLine(lineage)}`),
         };
     }
+    // #3363: fail closed when the live GitHub origin is newer than the brief.
+    const originFreshness = evaluateOriginFreshness(record, {
+        skip: options.skipOriginFreshness === true,
+        fetchOriginUpdatedAt: options.fetchOriginUpdatedAt,
+        cwd: options.projectRoot,
+    });
+    if (!originFreshness.ok) {
+        return {
+            exitCode: 1,
+            parentLineage: lineage,
+            message: buildReject(path, originFreshness.message),
+        };
+    }
     // Keep the historical OK line when lineage is N/A (backward-compatible tests / agents).
     const message = lineage.applicable
         ? `OK ${path} -- ready for implementation. parent lineage OK ` +

package/dist/preflight/index.d.ts

@@ -1,3 +1,3 @@
-export type { EvaluateResult } from "./evaluate.js";
+export type { EvaluateOptions, EvaluateResult } from "./evaluate.js";
 export { ACTIVATE_HINT, ACTIVE_FOLDER, ELIGIBLE_LIFECYCLE_DIRS, ELIGIBLE_STATUS, emitJson, evaluate, formatActivateHint, PREFLIGHT_USAGE_HINT, } from "./evaluate.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/product-first-done-gate/empty-resolution.d.ts

@@ -7,7 +7,7 @@
 import type { PlanAcceptance } from "./types.js";
 export declare const EMPTY_AC_OUTCOME: "soft_empty";
 export declare const EMPTY_AC_CAUSE = "no acceptance stamped \u2014 floor is empty in this project";
-export declare const EMPTY_AC_REMEDY = "stamp plan.acceptance (author commands or run intake capture / task issue:ingest)";
+export declare const EMPTY_AC_REMEDY = "stamp plan.acceptance via clause derivation (scope:activate / scope:promote runs #3323, or task issue:ingest)";
 export type VerifyAcResolution = "verified-pass" | "empty-pass" | "soft_empty" | "fail" | "config" | "skipped";
 /** True when this project check composition includes a suite gate (#3188). */
 export declare function projectHasSuiteFloor(projectRoot: string): boolean;

package/dist/product-first-done-gate/empty-resolution.js

@@ -7,7 +7,7 @@
 import { isFrameworkRepoRoot } from "../check/context.js";
 export const EMPTY_AC_OUTCOME = "soft_empty";
 export const EMPTY_AC_CAUSE = "no acceptance stamped — floor is empty in this project";
-export const EMPTY_AC_REMEDY = "stamp plan.acceptance (author commands or run intake capture / task issue:ingest)";
+export const EMPTY_AC_REMEDY = "stamp plan.acceptance via clause derivation (scope:activate / scope:promote runs #3323, or task issue:ingest)";
 /** True when this project check composition includes a suite gate (#3188). */
 export function projectHasSuiteFloor(projectRoot) {
     return isFrameworkRepoRoot(projectRoot);

package/dist/product-first-done-gate/evaluate.d.ts

@@ -8,6 +8,7 @@
  * floor, empty resolution is soft_empty — not a green run (#3334).
  */
 import { type EvaluateLiteralAcceptanceOptions, type LiteralAcceptanceGateResult } from "../literal-acceptance/index.js";
+import { type AcceptanceRunSummaryOutcome } from "../run-summary/index.js";
 import { type ClauseWalkResult } from "../verify-ac/clauses.js";
 import { type VerifyAcResolution } from "./empty-resolution.js";
 import type { AcSourceRung, PlanAcceptance } from "./types.js";
@@ -62,15 +63,43 @@ export interface EvaluateVerifyAcOptions extends EvaluateLiteralAcceptanceOption
      * emit after the #3285 bank checkpoint.
      */
     readonly skipAcceptanceEmit?: boolean;
+    /**
+     * Raw plan.acceptance as observed on the brief (#3355). Distinct from the
+     * synthesized floor: stamp only when the plan actually carries a block.
+     */
+    readonly observedAcceptance?: unknown;
+    /**
+     * Active scope key for product-oracle check_id namespacing (#3337).
+     * Prefer plan.id; path stem when id is missing. Multi-active verify:ac
+     * under one session must not share a single global `verify:ac` check id.
+     */
+    readonly oracleScopeKey?: string | null;
 }
 /**
  * Evaluate product AC from an in-memory plan.
  */
 export declare function evaluateVerifyAcFromPlan(plan: Record<string, unknown>, options?: EvaluateVerifyAcOptions): VerifyAcResult;
+/**
+ * CLI-only early returns that never reach evaluate still emit an acceptance
+ * outcome so field streams see config-error / soft-missing (#3355).
+ */
+export declare function emitVerifyAcTerminalOutcome(input: {
+    readonly projectRoot: string;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly outcome: AcceptanceRunSummaryOutcome;
+    readonly sourceRung?: AcSourceRung;
+    readonly noneStated?: boolean;
+}): void;
 /**
  * Evaluate from xBRIEF path.
  */
 export declare function evaluateVerifyAcFromPath(xbriefPath: string, options?: EvaluateVerifyAcOptions): VerifyAcResult;
+/**
+ * Unique product-oracle scope key for one active xBRIEF path (#3337).
+ * Relative path is always unique across active roots; plan.id alone is not
+ * (duplicate ids / same stem in xbrief+vbrief). Prefer `id@relPath` when both exist.
+ */
+export declare function resolveOracleScopeKey(plan: Record<string, unknown>, xbriefPath: string, projectRoot: string): string;
 /** Pure: product AC is required at every ceremony depth (#3284 / #3267 / #3156). */
 export declare function isVerifyAcRequiredAtCeremonyDepth(_depth: string | null | undefined): boolean;
 //# sourceMappingURL=evaluate.d.ts.map