@deftai/directive-core 0.105.0 → 0.106.0

package/dist/policy/resolve.js

@@ -13,6 +13,16 @@ export const ENV_BYPASS = "DEFT_ALLOW_DEFAULT_BRANCH_COMMIT";
 export const LEGACY_NARRATIVE_KEY = "Allow direct commits to master";
 /** Audit log relative path (#746). */
 export const AUDIT_LOG_REL_PATH = "meta/policy-changes.log";
+/** Operator line when a policy writer matches current state and does not append (#3528). */
+export const POLICY_AUDIT_NOOP_STDOUT = "  no-op: value already matched (ledger unchanged).";
+const CHANGED_TOKEN_RE = /(?:^|\s)changed=(?:true|false)(?:\s|$)/;
+/** Stamp a machine-readable `changed=true|false` token (#3528 / UPGRADING.md). */
+export function stampChangedToken(entry, changed) {
+    if (CHANGED_TOKEN_RE.test(entry)) {
+        return entry;
+    }
+    return `${entry} changed=${changed ? "true" : "false"}`;
+}
 const TRUTHY = new Set(["1", "true", "yes", "on"]);
 /**
  * Resolve absolute path to PROJECT-DEFINITION. Layout-aware (#2109 part 2a):
@@ -176,10 +186,15 @@ export function resolvePolicy(projectRoot) {
 function nowIso() {
     return new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
 }
-/** Append a one-line audit entry to meta/policy-changes.log (#746). */
-export function appendAuditLog(projectRoot, entry) {
+/** Append a one-line audit entry to meta/policy-changes.log (#746).
+ * No-op (`changed=false`) does not create or modify the tracked file (#3528). */
+export function appendAuditLog(projectRoot, entry, changed = true) {
     const root = pathResolve(projectRoot);
     const logPath = join(root, AUDIT_LOG_REL_PATH);
+    const stamped = stampChangedToken(entry, changed);
+    if (!changed) {
+        return logPath;
+    }
     // #2980 wave D: product write sink routes through containedWrite.
     if (!existsSync(logPath)) {
         const header = "# meta/policy-changes.log -- audit trail for " +
@@ -194,7 +209,7 @@ export function appendAuditLog(projectRoot, entry) {
     containedWrite({
         root,
         target: AUDIT_LOG_REL_PATH,
-        data: `${nowIso()} ${entry}\n`,
+        data: `${nowIso()} ${stamped}\n`,
         mode: "append",
     });
     return logPath;
@@ -224,7 +239,7 @@ export function setPolicy(projectRoot, options) {
             }
         }
         const plan = data.plan;
-        migrateLegacyPolicyKey(plan);
+        const legacyKeyMigrated = migrateLegacyPolicyKey(plan);
         const existingPolicy = plan[PLAN_POLICY_KEY];
         if (typeof existingPolicy !== "object" ||
             existingPolicy === null ||
@@ -248,8 +263,7 @@ export function setPolicy(projectRoot, options) {
             delete narratives[LEGACY_NARRATIVE_KEY];
             legacyDropped = true;
         }
-        atomicWriteProjectDefinition(path, data);
-        const changed = previous !== Boolean(allowDirectCommits) || legacyDropped;
+        const changed = previous !== Boolean(allowDirectCommits) || legacyDropped || legacyKeyMigrated;
         const parts = [
             `actor=${actor}`,
             `allowDirectCommitsToMaster=${allowDirectCommits ? "true" : "false"}`,
@@ -261,8 +275,11 @@ export function setPolicy(projectRoot, options) {
         if (note) {
             parts.push(`note=${note.replace(/\n/g, " ").replace(/\r/g, " ")}`);
         }
-        const auditEntry = parts.join(" ");
-        appendAuditLog(projectRoot, auditEntry);
+        const auditEntry = stampChangedToken(parts.join(" "), changed);
+        if (changed) {
+            atomicWriteProjectDefinition(path, data);
+        }
+        appendAuditLog(projectRoot, auditEntry, changed);
         return { changed, auditEntry };
     });
 }

package/dist/policy/value-feedback.js

@@ -3,7 +3,7 @@ import { atomicWriteProjectDefinition, projectDefinitionMutationLock, } from "..
 import { valueFeedbackInstallForceOnSource } from "./org-force-on-migration.js";
 import { migrateLegacyPolicyKey, PLAN_POLICY_KEY, readPlanPolicy } from "./plan-extensions.js";
 import { policyColonInvocation } from "./policy-invocation.js";
-import { appendAuditLog, loadProjectDefinition, projectDefinitionPath } from "./resolve.js";
+import { appendAuditLog, loadProjectDefinition, POLICY_AUDIT_NOOP_STDOUT, projectDefinitionPath, } from "./resolve.js";
 import { isTrustedOrgAutoEnable } from "./value-feedback-autoenable.js";
 /** Canonical registered policy field name (matches other FIELD_* dotted paths). */
 export const FIELD_VALUE_FEEDBACK = "plan.policy.valueFeedback";
@@ -236,7 +236,7 @@ export function enableValueFeedback(projectRoot, options) {
                 }
             }
             const plan = data.plan;
-            migrateLegacyPolicyKey(plan);
+            const legacyKeyMigrated = migrateLegacyPolicyKey(plan);
             const existingPolicy = plan[PLAN_POLICY_KEY];
             if (typeof existingPolicy !== "object" ||
                 existingPolicy === null ||
@@ -273,7 +273,8 @@ export function enableValueFeedback(projectRoot, options) {
             const changedFlag = previousNormalized.enabled !== nextBlock.enabled ||
                 previousNormalized.emitEvents !== nextBlock.emitEvents ||
                 previousNormalized.sessionLine !== nextBlock.sessionLine ||
-                previousNormalized.upstreamPrompt !== nextBlock.upstreamPrompt;
+                previousNormalized.upstreamPrompt !== nextBlock.upstreamPrompt ||
+                legacyKeyMigrated;
             policyBlock.valueFeedback = nextBlock;
             if (changedFlag) {
                 atomicWriteProjectDefinition(path, data);
@@ -291,15 +292,13 @@ export function enableValueFeedback(projectRoot, options) {
             if (note) {
                 parts.push(`note=${note.replace(/\n/g, " ").replace(/\r/g, " ")}`);
             }
-            appendAuditLog(projectRoot, parts.join(" "));
+            appendAuditLog(projectRoot, parts.join(" "), changedFlag);
             return { changed: changedFlag };
         });
         const resolved = resolveValueFeedback(projectRoot);
         const lines = [
             `\u2713 ${FIELD_VALUE_FEEDBACK}.enabled=true (value-feedback ON).`,
-            changed
-                ? "  audit: meta/policy-changes.log updated."
-                : "  no-op: value already matched (audit entry still appended for trail).",
+            changed ? "  audit: meta/policy-changes.log updated." : POLICY_AUDIT_NOOP_STDOUT,
             formatValueFeedbackStatusLine(resolved),
         ];
         return { exitCode: 0, stdout: `${lines.join("\n")}\n`, changed };
@@ -354,7 +353,7 @@ export function clearValueFeedback(projectRoot, options = {}) {
             if (note) {
                 parts.push(`note=${note.replace(/\n/g, " ").replace(/\r/g, " ")}`);
             }
-            appendAuditLog(projectRoot, parts.join(" "));
+            appendAuditLog(projectRoot, parts.join(" "), true);
             return { changed: true };
         });
         const resolved = resolveValueFeedback(projectRoot);

package/dist/preflight-cache/evaluate.d.ts

@@ -32,6 +32,12 @@ export interface EvaluateOptions {
     forIssue?: number | null;
     allowStale?: boolean;
     allowMissingBootstrap?: boolean;
+    /**
+     * Skip the live GitHub drift probe only (#3507). Age staleness stays hard.
+     * Explicit flag — never inferred from a missing `--for-issue`.
+     * `--for-issue` (work selection) wins over this skip.
+     */
+    skipDriftProbe?: boolean;
     /** Injectable clock for tests. */
     nowFn?: () => Date;
     /** Injectable drift probe for tests. */
@@ -40,6 +46,12 @@ export interface EvaluateOptions {
     autoPopulateEmpty?: boolean;
 }
 export declare function normaliseRepoUrl(url: string): string | null;
+/**
+ * Drift skip is an explicit `--skip-drift-probe` request (#3507).
+ * Presence of `--for-issue` is work selection and re-arms the probe.
+ * Absence of `--for-issue` is not a skip signal.
+ */
+export declare function shouldSkipDriftProbe(options: EvaluateOptions): boolean;
 /**
  * Evaluate cache freshness for the given project root.
  *

package/dist/preflight-cache/evaluate.js

@@ -310,6 +310,16 @@ function runDriftProbe(resolvedRepo, cacheRoot, source, options) {
         return null;
     }
 }
+/**
+ * Drift skip is an explicit `--skip-drift-probe` request (#3507).
+ * Presence of `--for-issue` is work selection and re-arms the probe.
+ * Absence of `--for-issue` is not a skip signal.
+ */
+export function shouldSkipDriftProbe(options) {
+    if (options.forIssue !== undefined && options.forIssue !== null)
+        return false;
+    return options.skipDriftProbe === true;
+}
 const REMEDIATION_NO_CANDIDATES = [
     "  Recovery: run `deft triage:bootstrap` to initialise the triage log.",
 ].join("\n");
@@ -471,7 +481,8 @@ function evaluateWithContext(projectRoot, options, ctx) {
             ].join("\n"),
         };
     }
-    if (resolvedRepo !== null && !allowStale) {
+    const skipDrift = shouldSkipDriftProbe(options);
+    if (resolvedRepo !== null && !allowStale && !skipDrift) {
         const drift = runDriftProbe(resolvedRepo, cacheRoot, source, options);
         if (drift !== null &&
             (drift.stateDriftNumbers.length > 0 || drift.contentDriftNumbers.length > 0)) {
@@ -506,6 +517,9 @@ function evaluateWithContext(projectRoot, options, ctx) {
     if (options.forIssue !== undefined && options.forIssue !== null) {
         msg += ` Issue #${options.forIssue} latest decision = accept; in subscription scope.`;
     }
+    if (skipDrift) {
+        msg += " Drift probe skipped (no work selection).";
+    }
     return { code: 0, message: msg };
 }
 function evaluateForIssue(repo, issueNumber, candidatesPath, cacheRoot, source, scopeRules, _projectRoot) {

package/dist/preflight-cache/index.d.ts

@@ -1,3 +1,3 @@
 export type { EvaluateOptions, GateResult } from "./evaluate.js";
-export { CACHE_DIR_NAME, CANDIDATES_RELPATH, DEFAULT_MAX_AGE_HOURS, DEFAULT_SOURCE, ENV_MAX_AGE_HOURS, ENV_RELEASE_PREFLIGHT, ENV_TRIAGE_REPO, evaluate, REQUIRED_DECISION, } from "./evaluate.js";
+export { CACHE_DIR_NAME, CANDIDATES_RELPATH, DEFAULT_MAX_AGE_HOURS, DEFAULT_SOURCE, ENV_MAX_AGE_HOURS, ENV_RELEASE_PREFLIGHT, ENV_TRIAGE_REPO, evaluate, REQUIRED_DECISION, shouldSkipDriftProbe, } from "./evaluate.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/preflight-cache/index.js

@@ -1,2 +1,2 @@
-export { CACHE_DIR_NAME, CANDIDATES_RELPATH, DEFAULT_MAX_AGE_HOURS, DEFAULT_SOURCE, ENV_MAX_AGE_HOURS, ENV_RELEASE_PREFLIGHT, ENV_TRIAGE_REPO, evaluate, REQUIRED_DECISION, } from "./evaluate.js";
+export { CACHE_DIR_NAME, CANDIDATES_RELPATH, DEFAULT_MAX_AGE_HOURS, DEFAULT_SOURCE, ENV_MAX_AGE_HOURS, ENV_RELEASE_PREFLIGHT, ENV_TRIAGE_REPO, evaluate, REQUIRED_DECISION, shouldSkipDriftProbe, } from "./evaluate.js";
 //# sourceMappingURL=index.js.map

package/dist/product-first-done-gate/evaluate.d.ts

@@ -23,6 +23,10 @@ export interface VerifyAcResult extends LiteralAcceptanceGateResult {
     readonly clauseWalked?: boolean;
     /** How the result was obtained (#3387). */
     readonly servedFrom?: AcServedFrom;
+    /** Config-error cause when resolution is config (#3559). */
+    readonly cause?: string;
+    /** Reuse-gate miss cause when servedFrom is executed (#3558). */
+    readonly missReason?: string;
 }
 export interface EvaluateVerifyAcOptions extends EvaluateLiteralAcceptanceOptions {
     /**

package/dist/product-first-done-gate/evaluate.js

@@ -9,11 +9,12 @@
  */
 import { existsSync, readFileSync } from "node:fs";
 import { basename, isAbsolute, relative, resolve } from "node:path";
-import { emitAcceptanceStampFromPlan } from "../intake/clause-derivation.js";
+import { emitAcceptanceStampFromPlan, MISSING_AMBIGUITY_ATTESTATION_CAUSE, stampedAmbiguityAttestationError, } from "../intake/clause-derivation.js";
 import { appendLiteralAcceptanceAdvisory, evaluateLiteralAcceptanceFromPlan, isNoopRefusalReason, runLiteralAcceptanceCommands, stripLiteralAcceptanceAdvisory, } from "../literal-acceptance/index.js";
 import { ENV_RUN_SUMMARY_PATH, RunSummaryEmitter, } from "../run-summary/index.js";
 import { maybeBankOnAcPass } from "../session/ac-pass-banking.js";
 import { resolveAcReuse, resolveScopeIdForAcReuse, snapshotFromReuseFields, } from "../session/ac-pass-reuse.js";
+import { gitHead } from "../session/git.js";
 import { hashProductState } from "../session/product-state-hash.js";
 import { resolveVerifyAcSessionId, writeVerifyAcSessionCache, } from "../session/verify-ac-session-cache.js";
 import { formatClauseWalkMessage, walkAcceptanceClauses, } from "../verify-ac/clauses.js";
@@ -162,6 +163,24 @@ export function evaluateVerifyAcFromPlan(plan, options = {}) {
         }, optionsWithScope, plan);
     }
     const projectRoot = resolve(optionsWithScope.projectRoot ?? process.cwd());
+    const attestationError = stampedAmbiguityAttestationError(optionsWithScope.observedAcceptance !== undefined
+        ? optionsWithScope.observedAcceptance
+        : plan.acceptance);
+    if (attestationError !== null) {
+        return applyOracle({
+            ok: false,
+            code: 2,
+            message: optionsWithScope.quiet === true ? "" : attestationError.message,
+            commands: [],
+            runs: [],
+            sourceRung: acceptance.source_rung,
+            noneStated: acceptance.none_stated,
+            acceptance,
+            resolution: "config",
+            resolvedCommandCount: 0,
+            cause: attestationError.cause ?? MISSING_AMBIGUITY_ATTESTATION_CAUSE,
+        }, optionsWithScope, plan);
+    }
     const reused = tryReuseVerifyAc(plan, acceptance, optionsWithScope, projectRoot);
     if (reused !== null) {
         return applyOracle(reused, optionsWithScope, plan);
@@ -372,6 +391,8 @@ function emitAcceptanceOutcome(result, options, projectRoot) {
                 outcome: row.outcome,
             })),
             served_from: result.servedFrom ?? "executed",
+            ...(result.cause !== undefined ? { cause: result.cause } : {}),
+            miss_reason: (result.servedFrom ?? "executed") === "executed" ? result.missReason : undefined,
         });
     }
     catch {
@@ -524,10 +545,27 @@ function applyOracle(result, options, plan = {}) {
             next = { ...next, resolution: "fail" };
         }
     }
+    const servedFrom = next.servedFrom ?? "executed";
+    let missReason = next.missReason;
+    if (servedFrom === "executed" && (missReason === undefined || missReason.length === 0)) {
+        const reuse = resolveAcReuse({
+            projectRoot,
+            plan,
+            scopeId: options.bankScopeId,
+            sessionId: options.sessionId,
+            env: options.env,
+            productPaths: options.productPaths,
+            allowCache: (options.reuseMode ?? "auto") === "auto",
+            allowBank: true,
+        });
+        if (reuse.kind === "miss")
+            missReason = reuse.reason;
+    }
     const stamped = {
         ...next,
         message: options.quiet === true ? next.message : labelVerdict(next),
-        servedFrom: next.servedFrom ?? "executed",
+        servedFrom,
+        missReason: servedFrom === "executed" ? missReason : undefined,
     };
     persistVerifyAcSessionCache(stamped, options, projectRoot, plan);
     if (options.skipAcceptanceEmit !== true) {
@@ -634,14 +672,14 @@ export function resolveOracleScopeKey(plan, xbriefPath, projectRoot) {
     return rel;
 }
 /**
- * After executable AC pass, FINALIZE the banking checkpoint (#3285).
- * Soft/advisory passes with zero runs do not bank. Fail-open on ledger errors.
+ * After verified-pass, FINALIZE the banking checkpoint (#3285 / #3558).
+ * Soft/advisory empty-pass still skips. Ledger I/O failures fail closed.
  */
 function maybeAttachAcPassBank(result, plan, xbriefPath, options) {
     if (options.bankOnPass === false) {
         return result;
     }
-    if (!result.ok || result.runs.length === 0) {
+    if (!result.ok || result.resolution !== "verified-pass") {
         return result;
     }
     const projectRoot = resolve(options.projectRoot ?? process.cwd());
@@ -661,8 +699,11 @@ function maybeAttachAcPassBank(result, plan, xbriefPath, options) {
             projectRoot,
             scopeId,
             executableRuns: result.runs.length,
+            verifiedPass: true,
             quiet: options.quiet,
             productStateHash: hashed.complete ? hashed.digest : null,
+            environ: options.env,
+            headSha: gitHead(projectRoot).head,
         });
         if (options.quiet || banked.notes.length === 0) {
             return result;

package/dist/release/closed-verb-gate.d.ts

@@ -0,0 +1,12 @@
+import type { ClosedVerbDecision } from "../authz/types.js";
+import type { ReleaseConfig, ReleaseSeams } from "./types.js";
+export declare const TAG_PUSH_CLOSED_VERB: "release-publish";
+export declare function evaluateReleaseTagPushGate(version: string, projectRoot: string, seams: ReleaseSeams, repo: string): ClosedVerbDecision;
+/**
+ * Fail closed before git tag + atomic tag push when skipTag is false.
+ * Dry-run and `--skip-tag` do not require a grant (no npm distribution).
+ * Returns EXIT_OK to continue, EXIT_VIOLATION to halt. Never spends the grant
+ * — draft-flip `release:publish` still owns markGrantUsed (#1095).
+ */
+export declare function assertTagPushClosedVerb(config: ReleaseConfig, seams: ReleaseSeams): number;
+//# sourceMappingURL=closed-verb-gate.d.ts.map

package/dist/release/closed-verb-gate.js

@@ -0,0 +1,51 @@
+/**
+ * Closed-verb gate on the tag-push / npm-publish boundary (#3527).
+ *
+ * Reuses the draft-flip evaluator (`evaluateReleasePublishGate`) so the
+ * distributing step carries the same authz tier. Does not delete or weaken
+ * the later `release:publish` draft-flip check.
+ */
+import { closedVerbEnvBypassKey } from "../authz/closed-verb.js";
+import { evaluateReleasePublishGate } from "../release-publish/pipeline.js";
+import { EXIT_OK, EXIT_VIOLATION, TOTAL_STEPS } from "./constants.js";
+function emitGate(label, status) {
+    process.stderr.write(`[10/${TOTAL_STEPS}] ${label}... ${status}\n`);
+}
+export const TAG_PUSH_CLOSED_VERB = "release-publish";
+export function evaluateReleaseTagPushGate(version, projectRoot, seams, repo) {
+    return evaluateReleasePublishGate(version, projectRoot, {
+        grants: seams.closedVerbGrants,
+        env: seams.closedVerbEnv,
+        repo,
+    });
+}
+/**
+ * Fail closed before git tag + atomic tag push when skipTag is false.
+ * Dry-run and `--skip-tag` do not require a grant (no npm distribution).
+ * Returns EXIT_OK to continue, EXIT_VIOLATION to halt. Never spends the grant
+ * — draft-flip `release:publish` still owns markGrantUsed (#1095).
+ */
+export function assertTagPushClosedVerb(config, seams) {
+    if (config.skipTag) {
+        return EXIT_OK;
+    }
+    const tag = `v${config.version}`;
+    const label = `Closed-verb gate ${TAG_PUSH_CLOSED_VERB} ${tag} (tag-push / npm-publish)`;
+    if (config.dryRun) {
+        emitGate(label, "DRYRUN (would require human-origin grant or DEFT_ALLOW_RELEASE_PUBLISH=1 before tag push)");
+        return EXIT_OK;
+    }
+    const gate = evaluateReleaseTagPushGate(config.version, config.projectRoot, seams, config.repo);
+    if (!gate.allowed) {
+        const bypassKey = gate.envBypassKey ??
+            closedVerbEnvBypassKey(TAG_PUSH_CLOSED_VERB, config.projectRoot) ??
+            "DEFT_ALLOW_RELEASE_PUBLISH";
+        emitGate(label, `FAIL (${gate.code}: ${gate.reason})`);
+        process.stderr.write(`[release] denied code=${gate.code} — set ${bypassKey}=1 or ` +
+            `mint \`deft authz:grant -- --template ${TAG_PUSH_CLOSED_VERB} --target ${config.version}\`\n`);
+        return EXIT_VIOLATION;
+    }
+    emitGate(label, `OK (${gate.code}${gate.humanApprovalRef !== null ? ` grant=${gate.humanApprovalRef}` : ""})`);
+    return EXIT_OK;
+}
+//# sourceMappingURL=closed-verb-gate.js.map

package/dist/release/index.d.ts

@@ -1,5 +1,6 @@
 export * from "./auto-hatch.js";
 export * from "./build-dist.js";
+export * from "./closed-verb-gate.js";
 export * from "./constants.js";
 export * from "./coverage-debt-ledger.js";
 export * from "./flags.js";

package/dist/release/index.js

@@ -1,6 +1,7 @@
 /* v8 ignore file -- re-export barrel; covered via main.ts */
 export * from "./auto-hatch.js";
 export * from "./build-dist.js";
+export * from "./closed-verb-gate.js";
 export * from "./constants.js";
 export * from "./coverage-debt-ledger.js";
 export * from "./flags.js";

package/dist/release/pipeline.js

@@ -4,6 +4,7 @@ import { assertProjectionContained } from "../fs/projection-containment.js";
 import { readCoverageTotalsFromReport } from "../vitest-runner/coverage-debt.js";
 import { buildCoverageDebtIssueDraft, classifyStep5FailureWithFreshness, evaluateAutoHatch, formatAutoHatchBanner, parseExitCodeFromReason, reasonLooksLikeTimeout, } from "./auto-hatch.js";
 import { prependUpgradeBanner, promoteChangelog, sectionForVersion } from "./changelog.js";
+import { assertTagPushClosedVerb } from "./closed-verb-gate.js";
 import { EXIT_CONFIG_ERROR, EXIT_OK, EXIT_VIOLATION, RELEASE_ARTIFACTS, RELEASE_CHECK_TIMEOUT_MINUTES, TOTAL_STEPS, VERIFY_DRAFT_INTERVAL_SECONDS, VERIFY_DRAFT_MAX_ATTEMPTS, } from "./constants.js";
 import { createCoverageDebtIssue, probeOpenCoverageDebtLedger } from "./coverage-debt-ledger.js";
 import { checkTagAvailable, createGithubRelease, readTextFile, verifyReleaseDraft } from "./gh.js";
@@ -373,6 +374,12 @@ export function runPipeline(config, seams = {}) {
             return EXIT_VIOLATION;
         }
     }
+    // Step 10–11 boundary: closed-verb gate before tag + atomic push (#3527).
+    // npm publish fires on tag push; draft-flip `release:publish` stays (#1095).
+    const tagPushGate = assertTagPushClosedVerb(config, seams);
+    if (tagPushGate !== EXIT_OK) {
+        return tagPushGate;
+    }
     // Step 10: git tag.
     label = `Tag v${version}`;
     if (config.skipTag) {

package/dist/release/types.d.ts

@@ -1,3 +1,5 @@
+import type { EnvMap } from "../authz/closed-verb.js";
+import type { HumanOriginGrant } from "../authz/types.js";
 export interface ReleaseConfig {
     readonly version: string;
     readonly repo: string;
@@ -77,5 +79,15 @@ export interface ReleaseSeams {
     readonly headSha?: (projectRoot: string) => string | null;
     /** #3187 — CI detector; when true suite stamp is never trusted. */
     readonly isCi?: () => boolean;
+    /**
+     * #3527 — closed-verb grants for the tag-push / npm-publish gate.
+     * When omitted, production loads active human-origin grants from disk.
+     */
+    readonly closedVerbGrants?: readonly HumanOriginGrant[];
+    /**
+     * #3527 — env map for DEFT_ALLOW_RELEASE_PUBLISH. When omitted, process.env.
+     * Tests inject `{}` so a host env bypass cannot leak into fail-closed cases.
+     */
+    readonly closedVerbEnv?: EnvMap;
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/render/constants.d.ts

@@ -1,6 +1,7 @@
 /** Canonical v0.6 status enum (matches `scripts/spec_validate.py`). */
 export declare const VALID_STATUSES: Set<string>;
-export declare const VALID_VBRIEF_VERSIONS: Set<string>;
+export { VALID_VBRIEF_VERSIONS } from "../vbrief-validate/constants.js";
+export { resolveInfoBlock } from "../vbrief-validate/schema.js";
 export declare const SPECIFICATION_NARRATIVE_KEY_ORDER: readonly ["Overview", "ProblemStatement", "Goals", "UserStories", "Requirements", "SuccessMetrics", "EdgeCases", "Architecture", "TechDecisions", "ImplementationPhases", "PreImplementationGates"];
 /** Migration capture narrative; omitted from default compact SPECIFICATION.md (#1566). */
 export declare const LEGACY_ARTIFACTS_NARRATIVE_KEY = "LegacyArtifacts";

package/dist/render/constants.js

@@ -10,7 +10,8 @@ export const VALID_STATUSES = new Set([
     "failed",
     "cancelled",
 ]);
-export const VALID_VBRIEF_VERSIONS = new Set(["0.6"]);
+export { VALID_VBRIEF_VERSIONS } from "../vbrief-validate/constants.js";
+export { resolveInfoBlock } from "../vbrief-validate/schema.js";
 export const SPECIFICATION_NARRATIVE_KEY_ORDER = [
     "Overview",
     "ProblemStatement",

package/dist/render/framework-commands.js

@@ -85,6 +85,9 @@ export const COMMANDS = {
     "verify:orphan-active": spec("verify:orphan-active", "verify_orphan_active:main", {
         projectRootArg: "--project-root",
     }),
+    "verify:lifecycle-visible": spec("verify:lifecycle-visible", "verify_lifecycle_visible:main", {
+        projectRootArg: "--project-root",
+    }),
     "verify:completed-tracked": spec("verify:completed-tracked", "verify_completed_tracked:main", {
         projectRootArg: "--project-root",
     }),
@@ -302,6 +305,7 @@ const ENTRYPOINT_VERB = {
     "preflight_cache:main": "preflight-cache",
     "preflight_wip_cap:main": "verify-wip-cap",
     "verify_orphan_active:main": "verify-orphan-active",
+    "verify_lifecycle_visible:main": "verify-lifecycle-visible",
     "verify_completed_tracked:main": "verify-completed-tracked",
     "pack_render:main": "pack-render",
     "validate_strategy_output:main": "validate-strategy-output",

package/dist/render/spec-validate.js

@@ -1,6 +1,8 @@
 import { existsSync, readFileSync } from "node:fs";
 import { basename } from "node:path";
-import { VALID_STATUSES, VALID_VBRIEF_VERSIONS } from "./constants.js";
+import { VALID_INFO_ROOT_KEYS, VALID_VBRIEF_VERSIONS } from "../vbrief-validate/constants.js";
+import { resolveInfoBlock } from "../vbrief-validate/schema.js";
+import { VALID_STATUSES } from "./constants.js";
 function validateNarratives(narratives, path, errors) {
     if (typeof narratives !== "object" || narratives === null || Array.isArray(narratives)) {
         errors.push(`${path} must be an object`);
@@ -46,19 +48,28 @@ function validatePlanItem(item, path, errors) {
 }
 function validateSchema(data) {
     const errors = [];
-    if (!("vBRIEFInfo" in data)) {
-        errors.push("missing required top-level key 'vBRIEFInfo'");
+    const resolved = resolveInfoBlock(data);
+    if (resolved === null) {
+        let infoShapeError = false;
+        for (const key of VALID_INFO_ROOT_KEYS) {
+            if (!(key in data))
+                continue;
+            const info = data[key];
+            if (info === null || Array.isArray(info) || typeof info !== "object") {
+                errors.push(`'${key}' must be an object`);
+                infoShapeError = true;
+                break;
+            }
+        }
+        if (!infoShapeError) {
+            errors.push("missing required top-level key 'vBRIEFInfo' or 'xBRIEFInfo'");
+        }
     }
     else {
-        const info = data.vBRIEFInfo;
-        if (typeof info !== "object" || info === null || Array.isArray(info)) {
-            errors.push("'vBRIEFInfo' must be an object");
-        }
-        else {
-            const version = info.version;
-            if (!VALID_VBRIEF_VERSIONS.has(String(version))) {
-                errors.push(`'vBRIEFInfo.version' must be '0.6' (canonical v0.6 schema, #533), got ${JSON.stringify(version)}. Run \`task migrate:vbrief\` to upgrade pre-existing v0.5 vBRIEFs in-place.`);
-            }
+        const version = resolved.info.version;
+        if (!VALID_VBRIEF_VERSIONS.has(String(version))) {
+            const allowed = [...VALID_VBRIEF_VERSIONS].map((v) => `'${v}'`).join(", ");
+            errors.push(`'${resolved.key}.version' must be one of ${allowed} (canonical v0.6/v0.8 schema, #2107), got ${JSON.stringify(version)}. Run \`task migrate:xbrief\` to upgrade pre-existing v0.5 vBRIEFs in-place.`);
         }
     }
     if (!("plan" in data)) {

package/dist/run-summary/types.d.ts

@@ -128,6 +128,10 @@ export interface AcceptanceRunSummaryPayload {
     readonly clause_outcomes?: readonly AcceptanceClauseOutcomeRow[];
     /** bank | cache | executed — how verify:ac obtained this result (#3387). */
     readonly served_from?: "bank" | "cache" | "executed";
+    /** Config-error cause when outcome is config-error (#3559). */
+    readonly cause?: string;
+    /** Reuse-gate miss cause when served_from is executed (#3558). */
+    readonly miss_reason?: string;
 }
 /** Intake-time stamp: which rung locked, whether commands were stated, counts (#3323). */
 export interface AcceptanceStampRunSummaryPayload {

package/dist/scope/main.js

@@ -1,6 +1,7 @@
 import { existsSync } from "node:fs";
 import { dirname } from "node:path";
 import { maybeRunStalenessTickler } from "../staleness-tickler/run.js";
+import { interceptHelp } from "../triage/help/index.js";
 import { reconcileUmbrellas, renderUmbrellasReport } from "../vbrief-reconcile/umbrellas.js";
 import { canonicalLogPath, readAll } from "./audit-log.js";
 import { batchPromote } from "./batch-promote.js";
@@ -13,12 +14,11 @@ import { promoteFromIssue } from "./promote-from-issue.js";
 import { promotePath } from "./promote-path.js";
 import { runTransition } from "./transition.js";
 import { findByDecisionId, isAlreadyUndone, REVERSIBLE_ACTIONS, undoBatch, undoOne, } from "./undo.js";
-const LIFECYCLE_USAGE_STDERR = "usage: scope_lifecycle.py [-h] [--project-root PROJECT_ROOT] [--force] [--batch]\n" +
-    "                          [--from-issue N] [--repo OWNER/NAME] [--strict] [--force-no-cache]\n" +
+const LIFECYCLE_USAGE_STDERR = "usage: deft scope:<action> [file] [--batch] [--from-issue N] [--repo OWNER/NAME]\n" +
+    "                          [--force] [--project-root PATH] [--strict] [--force-no-cache]\n" +
     "                          [--path PATH]\n" +
-    "                          {activate,block,cancel,complete,fail,promote,restore,unblock}\n" +
-    "                          [file ...]\n" +
-    "scope_lifecycle.py: error: the following arguments are required: action, file\n" +
+    "  actions: activate, block, cancel, complete, fail, promote, restore, unblock\n" +
+    "The verb already encodes the action (e.g. deft scope:promote <file>). Do not pass the action again.\n" +
     "(promote --batch may omit file and promotes all proposed/ scopes; #3011)\n" +
     "(promote --from-issue=N may omit file; #1136)\n";
 function parseLifecycleArgv(argv) {
@@ -50,6 +50,8 @@ function parseLifecycleArgv(argv) {
         if (arg === undefined) {
             return { args: null, error: "usage" };
         }
+        if (arg === "--")
+            continue;
         if (arg === "--force") {
             force = true;
         }
@@ -236,6 +238,14 @@ function parseLifecycleArgv(argv) {
 }
 /** Main entry for scope_lifecycle.py parity. */
 export function lifecycleMain(argv) {
+    if (argv.includes("--help") || argv.includes("-h")) {
+        const helpRc = interceptHelp("scope_lifecycle", argv);
+        if (helpRc !== null) {
+            return helpRc;
+        }
+        process.stdout.write(LIFECYCLE_USAGE_STDERR);
+        return 0;
+    }
     const parsed = parseLifecycleArgv(argv);
     if (parsed.args === null) {
         if (parsed.error === "usage") {

package/dist/scope/promote-from-issue.js

@@ -195,7 +195,7 @@ export function promoteFromIssue(options) {
                 return {
                     ok: false,
                     message: `No triage-cache decision for #${n} (${repoSafe}). ` +
-                        `Accept first: task triage:accept -- --issue ${n} --repo ${repoSafe} ` +
+                        `Accept first: deft triage:accept --issue ${n} --repo ${repoSafe} ` +
                         `(or omit --strict to soft-warn and proceed; --force-no-cache skips the gate).`,
                     exitCode: 1,
                     warnings,
@@ -212,7 +212,7 @@ export function promoteFromIssue(options) {
                 ok: false,
                 message: `Refusing promote for #${n} (${repoSafe}): latest triage decision is '${sanitizeMsg(latest.decision)}' ` +
                     `(decision_id=${latest.decision_id}). ` +
-                    `Accept first: task triage:accept -- --issue ${n} --repo ${repoSafe} ` +
+                    `Accept first: deft triage:accept --issue ${n} --repo ${repoSafe} ` +
                     `or override with --force-no-cache.`,
                 exitCode: 1,
                 warnings,
@@ -315,8 +315,8 @@ export function promoteFromIssue(options) {
         return {
             ok: false,
             message: `No proposed/ scope artifact found for issue #${n} (${repoSafe}). ` +
-                `Ingest first (task triage:accept -- --issue ${n} --repo ${repoSafe}) ` +
-                `or pass an explicit path: task scope:promote -- <path>.`,
+                `Ingest first (deft triage:accept --issue ${n} --repo ${repoSafe}) ` +
+                `or pass an explicit path: deft scope:promote <path>.`,
             exitCode: 1,
             warnings,
             repo,
@@ -330,7 +330,7 @@ export function promoteFromIssue(options) {
         return {
             ok: false,
             message: `Multiple proposed/ artifacts match issue #${n}; refuse to guess.\n${list}\n` +
-                `Promote one path explicitly: task scope:promote -- <path> ` +
+                `Promote one path explicitly: deft scope:promote <path> ` +
                 `or re-run with --path <one-of-the-above>.`,
             exitCode: 1,
             warnings,