@deftai/directive-core 0.104.0 → 0.106.0

package/dist/policy/forge-outage-retry.d.ts

@@ -0,0 +1,47 @@
+/**
+ * Typed plan.policy.forgeOutageRetryMinutes (#3422).
+ *
+ * Re-probe interval after a forge / SCM API outage drop-back.
+ * Precedence: USER.md Personal > project policy > framework default 30.
+ * Integer minutes, minimum 5.
+ */
+export declare const FIELD_FORGE_OUTAGE_RETRY_MINUTES = "plan.policy.forgeOutageRetryMinutes";
+export declare const FIELD_FORGE_OUTAGE_RETRY_MINUTES_CLI_ALIAS = "forgeOutageRetryMinutes";
+export declare const DEFAULT_FORGE_OUTAGE_RETRY_MINUTES = 30;
+export declare const MIN_FORGE_OUTAGE_RETRY_MINUTES = 5;
+export type ForgeOutageRetrySource = "user-md" | "typed" | "default" | "default-on-error";
+export interface ForgeOutageRetryResolved {
+    readonly minutes: number;
+    readonly source: ForgeOutageRetrySource;
+    readonly error: string | null;
+}
+export interface ForgeOutageRetryPolicyField {
+    readonly name: typeof FIELD_FORGE_OUTAGE_RETRY_MINUTES;
+    readonly current: number;
+    readonly default: number;
+    readonly source: string;
+}
+export interface ResolveForgeOutageRetryOptions {
+    readonly projectRoot?: string | null;
+    readonly env?: NodeJS.ProcessEnv;
+    readonly userMdText?: string | null;
+}
+/** Validate a raw integer-minutes value. */
+export declare function validateForgeOutageRetryMinutes(raw: unknown): string | null;
+/**
+ * Parse USER.md Personal forge-outage retry minutes.
+ *
+ * Accepts `forgeOutageRetryMinutes: 15` or `Forge outage retry: 15m`.
+ */
+export declare function parseForgeOutageRetryMinutesFromUserMd(text: string): number | null;
+/**
+ * Resolve forge-outage re-probe minutes (#3422).
+ *
+ * 1. Valid USER.md Personal value
+ * 2. Valid plan.policy.forgeOutageRetryMinutes
+ * 3. Framework default 30
+ */
+export declare function resolveForgeOutageRetryMinutes(options?: ResolveForgeOutageRetryOptions): ForgeOutageRetryResolved;
+/** Inspector row for `task policy:show --field=forgeOutageRetryMinutes`. */
+export declare function inspectForgeOutageRetryMinutes(_data: Record<string, unknown> | null, projectRoot?: string): ForgeOutageRetryPolicyField;
+//# sourceMappingURL=forge-outage-retry.d.ts.map

package/dist/policy/forge-outage-retry.js

@@ -0,0 +1,157 @@
+/**
+ * Typed plan.policy.forgeOutageRetryMinutes (#3422).
+ *
+ * Re-probe interval after a forge / SCM API outage drop-back.
+ * Precedence: USER.md Personal > project policy > framework default 30.
+ * Integer minutes, minimum 5.
+ */
+import { readFileSync } from "node:fs";
+import { resolveUserMdPath } from "../user-config/resolve-user-md.js";
+import { readPlanPolicy } from "./plan-extensions.js";
+import { loadProjectDefinition } from "./resolve.js";
+export const FIELD_FORGE_OUTAGE_RETRY_MINUTES = "plan.policy.forgeOutageRetryMinutes";
+export const FIELD_FORGE_OUTAGE_RETRY_MINUTES_CLI_ALIAS = "forgeOutageRetryMinutes";
+export const DEFAULT_FORGE_OUTAGE_RETRY_MINUTES = 30;
+export const MIN_FORGE_OUTAGE_RETRY_MINUTES = 5;
+/** Validate a raw integer-minutes value. */
+export function validateForgeOutageRetryMinutes(raw) {
+    if (typeof raw !== "number" || !Number.isInteger(raw)) {
+        return (`${FIELD_FORGE_OUTAGE_RETRY_MINUTES} must be an integer >= ` +
+            `${MIN_FORGE_OUTAGE_RETRY_MINUTES}; got ${typeof raw}`);
+    }
+    if (raw < MIN_FORGE_OUTAGE_RETRY_MINUTES) {
+        return (`${FIELD_FORGE_OUTAGE_RETRY_MINUTES} must be >= ` +
+            `${MIN_FORGE_OUTAGE_RETRY_MINUTES}; got ${raw}`);
+    }
+    return null;
+}
+/**
+ * Parse USER.md Personal forge-outage retry minutes.
+ *
+ * Accepts `forgeOutageRetryMinutes: 15` or `Forge outage retry: 15m`.
+ */
+export function parseForgeOutageRetryMinutesFromUserMd(text) {
+    const lines = text.split(/\r?\n/);
+    let inPersonal = false;
+    for (const line of lines) {
+        const trimmed = line.trim();
+        if (/^##\s+personal\b/i.test(trimmed)) {
+            inPersonal = true;
+            continue;
+        }
+        if (inPersonal && /^##\s+/.test(trimmed)) {
+            break;
+        }
+        if (!inPersonal)
+            continue;
+        const stripped = trimmed.replace(/\*\*/g, "").replace(/^-\s*/, "");
+        const keyed = stripped.match(/^forgeOutageRetryMinutes\s*:\s*(.+)$/i);
+        const labeled = stripped.match(/^Forge outage retry\s*:\s*(.+)$/i);
+        const raw = keyed?.[1] ?? labeled?.[1];
+        if (raw === undefined)
+            continue;
+        const parsed = parseMinutesToken(raw);
+        if (parsed !== null)
+            return parsed;
+    }
+    return null;
+}
+function parseMinutesToken(raw) {
+    const token = raw.replace(/\*\*/g, "").trim();
+    const match = token.match(/^(\d+)\s*(?:m(?:in(?:ute)?s?)?)?$/i);
+    if (match?.[1] === undefined)
+        return null;
+    const minutes = Number(match[1]);
+    if (!Number.isInteger(minutes))
+        return null;
+    return minutes;
+}
+function readUserMdText(options) {
+    if (options.userMdText !== undefined) {
+        return options.userMdText;
+    }
+    const projectRoot = options.projectRoot ?? process.cwd();
+    const resolved = resolveUserMdPath({
+        projectRoot,
+        env: options.env ?? process.env,
+    });
+    if (!resolved.found)
+        return null;
+    try {
+        return readFileSync(resolved.path, { encoding: "utf8" });
+    }
+    catch {
+        return null;
+    }
+}
+function readProjectMinutes(projectRoot) {
+    const [data, err] = loadProjectDefinition(projectRoot);
+    if (data === null) {
+        return { present: false, minutes: null, error: err };
+    }
+    const policyBlock = readPlanPolicy(data.plan);
+    if (typeof policyBlock !== "object" ||
+        policyBlock === null ||
+        Array.isArray(policyBlock) ||
+        !("forgeOutageRetryMinutes" in policyBlock)) {
+        return { present: false, minutes: null, error: null };
+    }
+    const raw = policyBlock.forgeOutageRetryMinutes;
+    if (raw === null) {
+        return { present: false, minutes: null, error: null };
+    }
+    const validationError = validateForgeOutageRetryMinutes(raw);
+    if (validationError !== null) {
+        return { present: true, minutes: null, error: validationError };
+    }
+    return { present: true, minutes: raw, error: null };
+}
+/**
+ * Resolve forge-outage re-probe minutes (#3422).
+ *
+ * 1. Valid USER.md Personal value
+ * 2. Valid plan.policy.forgeOutageRetryMinutes
+ * 3. Framework default 30
+ */
+export function resolveForgeOutageRetryMinutes(options = {}) {
+    const userMdText = readUserMdText(options);
+    if (userMdText !== null) {
+        const personal = parseForgeOutageRetryMinutesFromUserMd(userMdText);
+        if (personal !== null) {
+            const personalError = validateForgeOutageRetryMinutes(personal);
+            if (personalError === null) {
+                return { minutes: personal, source: "user-md", error: null };
+            }
+        }
+    }
+    const projectRoot = options.projectRoot;
+    if (projectRoot !== undefined && projectRoot !== null && projectRoot.length > 0) {
+        const project = readProjectMinutes(projectRoot);
+        if (project.minutes !== null) {
+            return { minutes: project.minutes, source: "typed", error: null };
+        }
+        if (project.present && project.error !== null) {
+            return {
+                minutes: DEFAULT_FORGE_OUTAGE_RETRY_MINUTES,
+                source: "default-on-error",
+                error: project.error,
+            };
+        }
+    }
+    return {
+        minutes: DEFAULT_FORGE_OUTAGE_RETRY_MINUTES,
+        source: "default",
+        error: null,
+    };
+}
+/** Inspector row for `task policy:show --field=forgeOutageRetryMinutes`. */
+export function inspectForgeOutageRetryMinutes(_data, projectRoot) {
+    const resolved = resolveForgeOutageRetryMinutes({ projectRoot });
+    return {
+        name: FIELD_FORGE_OUTAGE_RETRY_MINUTES,
+        current: resolved.minutes,
+        default: DEFAULT_FORGE_OUTAGE_RETRY_MINUTES,
+        source: resolved.source,
+    };
+}
+//# sourceMappingURL=forge-outage-retry.js.map

package/dist/policy/host-hooks.d.ts

@@ -1,6 +1,12 @@
 import type { HookHost } from "../hooks/dispatcher.js";
+export type { HookHost };
 export declare const FIELD_HOST_HOOKS = "plan.policy.hostHooks";
 export declare const FIELD_HOST_HOOKS_CLI_ALIAS = "hostHooks";
+export declare const DISABLE_HOST_HOOKS_SUBCOMMAND = "disable-host-hooks";
+/** Confirm-gated disable verb for unused-host recovery copy (#3571). CLI form: no go-task `--`. */
+export declare function disableHostHooksInvocation(trailing?: string): string;
+export declare const HOST_HOOKS_DISABLE_CAPABILITY_COST_DISCLOSURE: string;
+export declare const UNUSED_HOST_HOOKS_RECOVERY: string;
 /** Per-host Directive hook deposit toggles (#2752). */
 export type HostHooksPolicy = Record<HookHost, boolean>;
 export declare const DEFAULT_HOST_HOOKS_POLICY: HostHooksPolicy;
@@ -18,4 +24,18 @@ export declare function isHostHookDepositEnabled(host: HookHost, policy?: HostHo
 export declare function inspectHostHooks(data: Record<string, unknown> | null): HostHooksPolicyField;
 /** Resolve host hook deposit policy from PROJECT-DEFINITION on disk. */
 export declare function loadHostHooksPolicyFromProject(projectRoot: string): HostHooksPolicy;
+export declare function parseHookHost(value: string | undefined): HookHost | null;
+export interface DisableHostHooksOptions {
+    readonly host: HookHost;
+    readonly confirm: boolean;
+    readonly actor?: string;
+    readonly note?: string;
+}
+export interface DisableHostHooksResult {
+    readonly exitCode: 0 | 1 | 2;
+    readonly stdout: string;
+    readonly changed: boolean;
+}
+/** Persist `hostHooks.<host>=false` after capability-cost disclosure (#3571). */
+export declare function disableHostHooks(projectRoot: string, options: DisableHostHooksOptions): DisableHostHooksResult;
 //# sourceMappingURL=host-hooks.d.ts.map

package/dist/policy/host-hooks.js

@@ -1,8 +1,36 @@
+import { readFileSync } from "node:fs";
 import { HOOK_HOSTS } from "../hooks/dispatcher.js";
-import { readPlanPolicy } from "./plan-extensions.js";
-import { loadProjectDefinition } from "./resolve.js";
+import { atomicWriteProjectDefinition, projectDefinitionMutationLock, } from "../vbrief-build/project-definition-io.js";
+import { migrateLegacyPolicyKey, PLAN_POLICY_KEY, readPlanPolicy } from "./plan-extensions.js";
+import { policyColonInvocation } from "./policy-invocation.js";
+import { appendAuditLog, loadProjectDefinition, POLICY_AUDIT_NOOP_STDOUT, projectDefinitionPath, } from "./resolve.js";
 export const FIELD_HOST_HOOKS = "plan.policy.hostHooks";
 export const FIELD_HOST_HOOKS_CLI_ALIAS = "hostHooks";
+export const DISABLE_HOST_HOOKS_SUBCOMMAND = "disable-host-hooks";
+/** Confirm-gated disable verb for unused-host recovery copy (#3571). CLI form: no go-task `--`. */
+export function disableHostHooksInvocation(trailing = " --host <host> --confirm") {
+    return policyColonInvocation(DISABLE_HOST_HOOKS_SUBCOMMAND, trailing);
+}
+export const HOST_HOOKS_DISABLE_CAPABILITY_COST_DISCLOSURE = "\u26a0 Capability-cost disclosure -- disabling hostHooks for a host removes " +
+    "deft-hook pre-execution guardrails for anyone who later opens this repo in that host. " +
+    "The result is tracked.\n" +
+    "  \u2022 Opted-out hosts skip Directive hook deposit; leftover-free files write {}.\n" +
+    "  \u2022 This is not a timeout or live-probe fix. Retry the gated ritual when load is the cause.\n" +
+    "  \u2022 Inspect: `" +
+    policyColonInvocation("show", " --field=hostHooks") +
+    "`.\n" +
+    "  \u2022 Apply: `" +
+    disableHostHooksInvocation() +
+    "`.\n" +
+    "  \u2022 Reversible: set the host back to true and run `deft update`.\n" +
+    "  \u2022 Hand-edit of plan.policy.hostHooks plus `deft update` still strips " +
+    "(human high-trust bypass).\n" +
+    "  \u2022 Changes are recorded to meta/policy-changes.log for auditability.";
+export const UNUSED_HOST_HOOKS_RECOVERY = "If an affected host is unused, inspect `" +
+    policyColonInvocation("show", " --field=hostHooks") +
+    "`, then run `" +
+    disableHostHooksInvocation() +
+    "`. That removes deft-hook pre-execution guardrails for that host and the result is tracked.";
 export const DEFAULT_HOST_HOOKS_POLICY = {
     claude: true,
     cursor: true,
@@ -93,4 +121,95 @@ export function loadHostHooksPolicyFromProject(projectRoot) {
     }
     return resolveHostHooksPolicy(policyBlock.hostHooks);
 }
+export function parseHookHost(value) {
+    if (value === undefined)
+        return null;
+    return HOOK_HOSTS.includes(value) ? value : null;
+}
+/** Persist `hostHooks.<host>=false` after capability-cost disclosure (#3571). */
+export function disableHostHooks(projectRoot, options) {
+    if (!HOOK_HOSTS.includes(options.host)) {
+        return {
+            exitCode: 2,
+            stdout: `\u274c ${FIELD_HOST_HOOKS}.${String(options.host)} is not a deposited host (${HOOK_HOSTS.join(", ")}).\n`,
+            changed: false,
+        };
+    }
+    if (!options.confirm) {
+        return {
+            exitCode: 1,
+            stdout: `${HOST_HOOKS_DISABLE_CAPABILITY_COST_DISCLOSURE}\n\n` +
+                `Re-run with --confirm to apply: ${disableHostHooksInvocation(` --host ${options.host} --confirm`)}\n`,
+            changed: false,
+        };
+    }
+    const path = projectDefinitionPath(projectRoot);
+    try {
+        const { changed } = projectDefinitionMutationLock(projectRoot, () => {
+            const parsed = JSON.parse(readFileSync(path, { encoding: "utf8" }));
+            if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+                throw new Error(`PROJECT-DEFINITION at ${path} top-level value is not a JSON object`);
+            }
+            const data = parsed;
+            if (typeof data.plan !== "object" || data.plan === null || Array.isArray(data.plan)) {
+                if (data.plan === undefined) {
+                    data.plan = {};
+                }
+                else {
+                    throw new Error("PROJECT-DEFINITION 'plan' is not an object");
+                }
+            }
+            const plan = data.plan;
+            const legacyKeyMigrated = migrateLegacyPolicyKey(plan);
+            const existingPolicy = plan[PLAN_POLICY_KEY];
+            if (typeof existingPolicy !== "object" ||
+                existingPolicy === null ||
+                Array.isArray(existingPolicy)) {
+                if (existingPolicy === undefined) {
+                    plan[PLAN_POLICY_KEY] = {};
+                }
+                else {
+                    throw new Error("plan.policy is not an object");
+                }
+            }
+            const policyBlock = plan[PLAN_POLICY_KEY];
+            const previous = resolveHostHooksPolicy(policyBlock.hostHooks);
+            const next = { ...previous, [options.host]: false };
+            const changedFlag = previous[options.host] !== false || legacyKeyMigrated;
+            policyBlock.hostHooks = next;
+            if (changedFlag) {
+                atomicWriteProjectDefinition(path, data);
+            }
+            const actor = options.actor ?? disableHostHooksInvocation();
+            const note = options.note ?? "";
+            const parts = [
+                `actor=${actor}`,
+                `${FIELD_HOST_HOOKS}.${options.host}=false`,
+                `previous=${JSON.stringify(previous)}`,
+            ];
+            if (note) {
+                parts.push(`note=${note.replace(/\n/g, " ").replace(/\r/g, " ")}`);
+            }
+            appendAuditLog(projectRoot, parts.join(" "), changedFlag);
+            return { changed: changedFlag };
+        });
+        const lines = [
+            `\u2713 ${FIELD_HOST_HOOKS}.${options.host}=false (deft-hook guardrails removed for ${options.host}; result is tracked).`,
+            changed ? "  audit: meta/policy-changes.log updated." : POLICY_AUDIT_NOOP_STDOUT,
+            "  Run `deft update` to strip Directive-managed hook entries for that host.",
+        ];
+        return { exitCode: 0, stdout: `${lines.join("\n")}\n`, changed };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (message.includes("ENOENT") || message.includes("PROJECT-DEFINITION not found")) {
+            return {
+                exitCode: 2,
+                stdout: `\u274c PROJECT-DEFINITION not found at ${path}\n`,
+                changed: false,
+            };
+        }
+        return { exitCode: 2, stdout: `\u274c Config error: ${message}\n`, changed: false };
+    }
+}
 //# sourceMappingURL=host-hooks.js.map

package/dist/policy/index.d.ts

@@ -1,6 +1,8 @@
 export * from "./ac-pass-banking.js";
 export * from "./agents-md-advisory.js";
 export * from "./autonomy.js";
+export * from "./base-branch.js";
+export * from "./branch-sync.js";
 export * from "./capacity.js";
 export * from "./ceremony-dial.js";
 export * from "./ceremony-dial-escalation.js";
@@ -10,6 +12,8 @@ export * from "./decisions.js";
 export * from "./deft-directive-disable.js";
 export * from "./delivery-branch.js";
 export * from "./disclosure.js";
+export * from "./file-size-thresholds.js";
+export * from "./forge-outage-retry.js";
 export * from "./host-hooks.js";
 export * from "./host-slash-commands.js";
 export * from "./hotfix-criteria.js";
@@ -21,10 +25,13 @@ export * from "./org-force-on-migration.js";
 export * from "./plan-extensions.js";
 export * from "./policy-invocation.js";
 export * from "./product-signal.js";
+export * from "./project-invariants.js";
 export * from "./require-human-merge.js";
 export * from "./resolve.js";
 export * from "./runtime-authority.js";
 export * from "./staleness-tickler.js";
+export * from "./sync-default.js";
+export * from "./sync-max-files.js";
 export * from "./value-feedback.js";
 export * from "./value-feedback-autoenable.js";
 export * from "./wip.js";

package/dist/policy/index.js

@@ -1,25 +1,31 @@
 import { FIELD_HOST_SKILL_DISCOVERY, FIELD_HOST_SKILL_DISCOVERY_CLI_ALIAS, inspectHostSkillDiscovery, } from "../init-deposit/skill-discovery-hosts.js";
 import { FIELD_OPENCLAW_PRODUCT_COMMANDS, FIELD_OPENCLAW_PRODUCT_COMMANDS_CLI_ALIAS, inspectOpenClawProductCommands, } from "../slash/openclaw-deposit.js";
 import { FIELD_AC_PASS_BANKING, FIELD_AC_PASS_BANKING_CLI_ALIAS, inspectAcPassBanking, } from "./ac-pass-banking.js";
+import { FIELD_BASE_BRANCH, FIELD_BASE_BRANCH_CLI_ALIAS, inspectBaseBranch, } from "./base-branch.js";
 import { FIELD_CEREMONY_DIAL, FIELD_CEREMONY_DIAL_CLI_ALIAS, inspectCeremonyDial, } from "./ceremony-dial.js";
 import { FIELD_CHECK_RESUME, FIELD_CHECK_RESUME_CLI_ALIAS, inspectCheckResume, } from "./check-resume.js";
 import { FIELD_COVERAGE_DEBT, FIELD_COVERAGE_DEBT_CLI_ALIAS, inspectCoverageDebt, } from "./coverage-debt.js";
 import { FIELD_DELIVERY_BRANCH, FIELD_DELIVERY_BRANCH_CLI_ALIAS, inspectDeliveryBranch, } from "./delivery-branch.js";
+import { FIELD_FORGE_OUTAGE_RETRY_MINUTES, FIELD_FORGE_OUTAGE_RETRY_MINUTES_CLI_ALIAS, inspectForgeOutageRetryMinutes, } from "./forge-outage-retry.js";
 import { FIELD_HOST_HOOKS, FIELD_HOST_HOOKS_CLI_ALIAS, inspectHostHooks } from "./host-hooks.js";
 import { FIELD_HOST_SLASH_COMMANDS, FIELD_HOST_SLASH_COMMANDS_CLI_ALIAS, inspectHostSlashCommands, } from "./host-slash-commands.js";
 import { FIELD_HOTFIX_CRITERIA, FIELD_HOTFIX_CRITERIA_CLI_ALIAS, inspectHotfixCriteria, } from "./hotfix-criteria.js";
 import { FIELD_MIN_GREPTILE_CONFIDENCE, FIELD_MIN_GREPTILE_CONFIDENCE_CLI_ALIAS, inspectMinGreptileConfidence, } from "./min-greptile-confidence.js";
 import { readPlanPolicy } from "./plan-extensions.js";
 import { FIELD_PRODUCT_SIGNAL, FIELD_PRODUCT_SIGNAL_CLI_ALIAS, inspectProductSignal, } from "./product-signal.js";
+import { FIELD_PROJECT_INVARIANTS, FIELD_PROJECT_INVARIANTS_CLI_ALIAS, inspectProjectInvariants, } from "./project-invariants.js";
 import { FIELD_REQUIRE_HUMAN_MERGE, FIELD_REQUIRE_HUMAN_MERGE_CLI_ALIAS, inspectRequireHumanMerge, } from "./require-human-merge.js";
 import { coerceLegacyNarrative, LEGACY_NARRATIVE_KEY, loadProjectDefinition } from "./resolve.js";
 import { FIELD_RUNTIME_AUTHORITY, FIELD_RUNTIME_AUTHORITY_CLI_ALIAS, inspectRuntimeAuthority, } from "./runtime-authority.js";
 import { FIELD_STALENESS_TICKLER, FIELD_STALENESS_TICKLER_CLI_ALIAS, inspectStalenessTickler, } from "./staleness-tickler.js";
+import { FIELD_SYNC_MAX_FILES, FIELD_SYNC_MAX_FILES_CLI_ALIAS, inspectSyncMaxFiles, } from "./sync-max-files.js";
 import { FIELD_VALUE_FEEDBACK, FIELD_VALUE_FEEDBACK_CLI_ALIAS, inspectValueFeedback, } from "./value-feedback.js";
 import { DEFAULT_WIP_CAP } from "./wip.js";
 export * from "./ac-pass-banking.js";
 export * from "./agents-md-advisory.js";
 export * from "./autonomy.js";
+export * from "./base-branch.js";
+export * from "./branch-sync.js";
 export * from "./capacity.js";
 export * from "./ceremony-dial.js";
 export * from "./ceremony-dial-escalation.js";
@@ -29,6 +35,8 @@ export * from "./decisions.js";
 export * from "./deft-directive-disable.js";
 export * from "./delivery-branch.js";
 export * from "./disclosure.js";
+export * from "./file-size-thresholds.js";
+export * from "./forge-outage-retry.js";
 export * from "./host-hooks.js";
 export * from "./host-slash-commands.js";
 export * from "./hotfix-criteria.js";
@@ -40,10 +48,13 @@ export * from "./org-force-on-migration.js";
 export * from "./plan-extensions.js";
 export * from "./policy-invocation.js";
 export * from "./product-signal.js";
+export * from "./project-invariants.js";
 export * from "./require-human-merge.js";
 export * from "./resolve.js";
 export * from "./runtime-authority.js";
 export * from "./staleness-tickler.js";
+export * from "./sync-default.js";
+export * from "./sync-max-files.js";
 export * from "./value-feedback.js";
 export * from "./value-feedback-autoenable.js";
 export * from "./wip.js";
@@ -404,6 +415,15 @@ function inspectDeliveryBranchField(data, projectRoot) {
         source: field.source,
     };
 }
+function inspectBaseBranchField(data, projectRoot) {
+    const field = inspectBaseBranch(data, projectRoot);
+    return {
+        name: field.name,
+        current: field.current,
+        default: field.default,
+        source: field.source,
+    };
+}
 function inspectMinGreptileConfidenceField(data, projectRoot) {
     const field = inspectMinGreptileConfidence(data, projectRoot);
     return {
@@ -431,6 +451,33 @@ function inspectAcPassBankingField(data, projectRoot) {
         source: field.source,
     };
 }
+function inspectSyncMaxFilesField(data, projectRoot) {
+    const field = inspectSyncMaxFiles(data, projectRoot);
+    return {
+        name: field.name,
+        current: field.current,
+        default: field.default,
+        source: field.source,
+    };
+}
+function inspectForgeOutageRetryMinutesField(data, projectRoot) {
+    const field = inspectForgeOutageRetryMinutes(data, projectRoot);
+    return {
+        name: field.name,
+        current: field.current,
+        default: field.default,
+        source: field.source,
+    };
+}
+function inspectProjectInvariantsField(data, projectRoot) {
+    const field = inspectProjectInvariants(data, projectRoot);
+    return {
+        name: field.name,
+        current: field.current,
+        default: field.default,
+        source: field.source,
+    };
+}
 const REGISTERED_POLICIES = [
     inspectAllowDirectCommits,
     inspectWipCap,
@@ -445,6 +492,7 @@ const REGISTERED_POLICIES = [
     inspectTriageLabelMirrorField,
     inspectSwarmSubagentBackend,
     inspectDeliveryBranchField,
+    inspectBaseBranchField,
     inspectMinGreptileConfidenceField,
     inspectHostHooksField,
     inspectHostSlashCommandsField,
@@ -460,6 +508,9 @@ const REGISTERED_POLICIES = [
     inspectHotfixCriteriaField,
     inspectCeremonyDialField,
     inspectAcPassBankingField,
+    inspectSyncMaxFilesField,
+    inspectForgeOutageRetryMinutesField,
+    inspectProjectInvariantsField,
 ];
 /** Walk registered inspectors and return one row per field (#1148). */
 export function inspectAllPolicies(projectRoot) {
@@ -494,13 +545,21 @@ export function inspectOnePolicy(name, projectRoot) {
                                                     ? FIELD_HOTFIX_CRITERIA
                                                     : name === FIELD_DELIVERY_BRANCH_CLI_ALIAS
                                                         ? FIELD_DELIVERY_BRANCH
-                                                        : name === FIELD_MIN_GREPTILE_CONFIDENCE_CLI_ALIAS
-                                                            ? FIELD_MIN_GREPTILE_CONFIDENCE
-                                                            : name === FIELD_CEREMONY_DIAL_CLI_ALIAS
-                                                                ? FIELD_CEREMONY_DIAL
-                                                                : name === FIELD_AC_PASS_BANKING_CLI_ALIAS
-                                                                    ? FIELD_AC_PASS_BANKING
-                                                                    : name;
+                                                        : name === FIELD_BASE_BRANCH_CLI_ALIAS
+                                                            ? FIELD_BASE_BRANCH
+                                                            : name === FIELD_MIN_GREPTILE_CONFIDENCE_CLI_ALIAS
+                                                                ? FIELD_MIN_GREPTILE_CONFIDENCE
+                                                                : name === FIELD_CEREMONY_DIAL_CLI_ALIAS
+                                                                    ? FIELD_CEREMONY_DIAL
+                                                                    : name === FIELD_AC_PASS_BANKING_CLI_ALIAS
+                                                                        ? FIELD_AC_PASS_BANKING
+                                                                        : name === FIELD_SYNC_MAX_FILES_CLI_ALIAS
+                                                                            ? FIELD_SYNC_MAX_FILES
+                                                                            : name === FIELD_FORGE_OUTAGE_RETRY_MINUTES_CLI_ALIAS
+                                                                                ? FIELD_FORGE_OUTAGE_RETRY_MINUTES
+                                                                                : name === FIELD_PROJECT_INVARIANTS_CLI_ALIAS
+                                                                                    ? FIELD_PROJECT_INVARIANTS
+                                                                                    : name;
     for (const field of inspectAllPolicies(projectRoot)) {
         if (field.name === normalized)
             return field;

package/dist/policy/org-force-on-migration.js

@@ -421,6 +421,7 @@ function applyForceOn(projectRoot, options, intent) {
                 ? existing.previousProductSignal
                 : ORG_FORCE_ON_NO_BASELINE;
         const actor = options.actor ?? "directive-update";
+        const changed = valueFeedbackChanged || productSignalChanged;
         appendAuditLog(projectRoot, [
             `actor=${actor}`,
             "org-force-on-v2822",
@@ -428,7 +429,7 @@ function applyForceOn(projectRoot, options, intent) {
             `productSignal=${needsPs ? "forced-on" : "unchanged"}`,
             `previousValueFeedback=${JSON.stringify(normalizePolicySnapshot(markerPreviousVf))}`,
             `previousProductSignal=${JSON.stringify(normalizePolicySnapshot(markerPreviousPs))}`,
-        ].join(" "));
+        ].join(" "), changed);
         writeMarker(projectRoot, options, {
             // OR with existing so partial re-apply does not clear install-force-on source.
             valueFeedback: needsVf || (existing?.valueFeedback ?? false),

package/dist/policy/plan-extensions.d.ts

@@ -41,7 +41,7 @@ export declare function readPlanOnboarding(plan: unknown): unknown;
  * policy key is present. Used by writers so a mutation never strands a legacy
  * bare block alongside the namespaced one.
  */
-export declare function migrateLegacyPolicyKey(plan: Record<string, unknown>): void;
+export declare function migrateLegacyPolicyKey(plan: Record<string, unknown>): boolean;
 /** The namespaced/legacy key pairs a bare block can silently shadow (#2301). */
 export declare const SHADOWABLE_PLAN_EXTENSIONS: ReadonlyArray<{
     readonly namespacedKey: string;

package/dist/policy/plan-extensions.js

@@ -68,7 +68,9 @@ export function migrateLegacyPolicyKey(plan) {
     if (plan[PLAN_POLICY_KEY] === undefined && plan[LEGACY_PLAN_POLICY_KEY] !== undefined) {
         plan[PLAN_POLICY_KEY] = plan[LEGACY_PLAN_POLICY_KEY];
         delete plan[LEGACY_PLAN_POLICY_KEY];
+        return true;
     }
+    return false;
 }
 /** The namespaced/legacy key pairs a bare block can silently shadow (#2301). */
 export const SHADOWABLE_PLAN_EXTENSIONS = [

package/dist/policy/product-signal.js

@@ -3,7 +3,7 @@ import { atomicWriteProjectDefinition, projectDefinitionMutationLock, } from "..
 import { productSignalInstallForceOnSource } from "./org-force-on-migration.js";
 import { migrateLegacyPolicyKey, PLAN_POLICY_KEY, readPlanPolicy } from "./plan-extensions.js";
 import { policyColonInvocation } from "./policy-invocation.js";
-import { appendAuditLog, loadProjectDefinition, projectDefinitionPath } from "./resolve.js";
+import { appendAuditLog, loadProjectDefinition, POLICY_AUDIT_NOOP_STDOUT, projectDefinitionPath, } from "./resolve.js";
 /** Canonical registered policy field name (#2693). */
 export const FIELD_PRODUCT_SIGNAL = "plan.policy.productSignal";
 /** Short alias for `policy:show --field=productSignal`. */
@@ -157,7 +157,7 @@ export function enableProductSignal(projectRoot, options) {
                 }
             }
             const plan = data.plan;
-            migrateLegacyPolicyKey(plan);
+            const legacyKeyMigrated = migrateLegacyPolicyKey(plan);
             const existingPolicy = plan[PLAN_POLICY_KEY];
             if (typeof existingPolicy !== "object" ||
                 existingPolicy === null ||
@@ -181,7 +181,8 @@ export function enableProductSignal(projectRoot, options) {
             const nextBlock = { enabled: true, sinkRepo };
             const previousNormalized = resolveProductSignalFromTypedBlock(previous);
             const changedFlag = previousNormalized.enabled !== nextBlock.enabled ||
-                previousNormalized.sinkRepo !== nextBlock.sinkRepo;
+                previousNormalized.sinkRepo !== nextBlock.sinkRepo ||
+                legacyKeyMigrated;
             policyBlock.productSignal = nextBlock;
             if (changedFlag) {
                 atomicWriteProjectDefinition(path, data);
@@ -197,15 +198,13 @@ export function enableProductSignal(projectRoot, options) {
             if (note) {
                 parts.push(`note=${note.replace(/\n/g, " ").replace(/\r/g, " ")}`);
             }
-            appendAuditLog(projectRoot, parts.join(" "));
+            appendAuditLog(projectRoot, parts.join(" "), changedFlag);
             return { changed: changedFlag };
         });
         const resolved = resolveProductSignal(projectRoot);
         const lines = [
             `\u2713 ${FIELD_PRODUCT_SIGNAL}.enabled=true (product-signal ON).`,
-            changed
-                ? "  audit: meta/policy-changes.log updated."
-                : "  no-op: value already matched (audit entry still appended for trail).",
+            changed ? "  audit: meta/policy-changes.log updated." : POLICY_AUDIT_NOOP_STDOUT,
             formatProductSignalStatusLine(resolved),
         ];
         return { exitCode: 0, stdout: `${lines.join("\n")}\n`, changed };