@deftai/directive-core 0.105.0 → 0.106.0

package/dist/scope-provenance/evaluate.js

@@ -205,7 +205,7 @@ function listActiveXbriefPaths(projectRoot) {
 }
 function remediationForExpansion() {
     return ("Renew human approval: re-record the approved-scope digest after operator review " +
-        "(`task scope:record-approved-scope -- <xbrief-path> --actor <you>` writes " +
+        "(`task scope:record-approved-scope -- <xbrief-path> --actor <you> --confirm` writes " +
         "`.deft/approved-scope/<plan-id>.json` with a humanApproval stamp). Commit that " +
         "approval on the merge base (or a prior PR) before expanding or activating the " +
         "scoped xBRIEF in the implementation change set. Editing the active xBRIEF alone " +
@@ -344,7 +344,7 @@ export function evaluateOneScopeProvenance(input) {
                 detail: "active xBRIEF modified with a non-human (agent/missing) approved-scope stamp; " +
                     "only humanApproval stamps authorize non-empty file_scope",
                 remediation: "Record a human-origin approval via `task scope:record-approved-scope -- " +
-                    "<xbrief-path> --actor <you>` (#3145 / #3205).",
+                    "<xbrief-path> --actor <you> --confirm` (#3145 / #3205).",
             };
         }
     }
@@ -361,7 +361,7 @@ export function evaluateOneScopeProvenance(input) {
                 detail: "active xBRIEF modified with a non-human approved-scope stamp (scope shrink/noise path); " +
                     "only humanApproval stamps authorize non-empty file_scope",
                 remediation: "Record a human-origin approval via `task scope:record-approved-scope -- " +
-                    "<xbrief-path> --actor <you>` (#3145 / #3205).",
+                    "<xbrief-path> --actor <you> --confirm` (#3145 / #3205).",
             };
         }
         return null;

package/dist/session/ac-pass-banking.d.ts

@@ -173,6 +173,11 @@ export interface MaybeBankOnAcPassInput {
     readonly executableRuns: number;
     readonly quiet?: boolean;
     readonly productStateHash?: string | null;
+    /**
+     * Bank a verified-pass walk even when no shell runs were recorded (#3558).
+     * Soft/advisory empty passes still skip via executableRuns === 0.
+     */
+    readonly verifiedPass?: boolean;
 }
 export interface MaybeBankOnAcPassResult {
     readonly banked: boolean;

package/dist/session/ac-pass-banking.js

@@ -17,6 +17,7 @@ import { containedWrite } from "../fs/contained-write.js";
 import { DEFAULT_SURPLUS_THRESHOLD, resolveAcPassBanking, } from "../policy/ac-pass-banking.js";
 import { RunSummaryEmitter } from "../run-summary/emit.js";
 import { detectHardEffortBudget, formatDeepeningSkippedNote, recommendVerificationDepth, } from "./effort-budget.js";
+import { gitHead } from "./git.js";
 /** Durable bank ledger directory (gitignored under `.deft/`). */
 export const AC_PASS_BANK_DIR = ".deft/ac-pass-banks";
 export const AC_PASS_BANK_SCHEMA_VERSION = 1;
@@ -682,7 +683,7 @@ export function resolveBankingConfigForRoot(projectRoot, environ) {
  * Throws on I/O failure so verify:ac can fail closed (checkpoint mandatory).
  */
 export function maybeBankOnAcPass(input) {
-    if (input.executableRuns <= 0) {
+    if (input.executableRuns <= 0 && input.verifiedPass !== true) {
         return { banked: false, decision: null, bank: null, notes: [] };
     }
     const budget = input.budget ?? detectHardEffortBudget({ environ: input.environ ?? process.env });
@@ -699,7 +700,7 @@ export function maybeBankOnAcPass(input) {
         budget,
         surplus: decision.surplus,
         nextAction,
-        headSha: input.headSha ?? null,
+        headSha: input.headSha !== undefined ? input.headSha : gitHead(input.projectRoot).head,
         productStateHash: input.productStateHash ?? null,
         now: input.now,
         environ: input.environ,

package/dist/session/process-cost.d.ts

@@ -1,13 +1,3 @@
-/**
- * Local process-cost ceremony events (#2994).
- *
- * Always-on, best-effort appends to `.deft-cache/events.jsonl`.
- * Not gated on valueFeedback (distinct from #1709 attribution).
- * No remote / Product Insights upload (#2603 not required).
- *
- * Types are declared locally (not imported from session-start) so this module
- * does not form an import cycle with session-start call sites.
- */
 import { type BehavioralEventRecord } from "../lifecycle/events.js";
 export { PROCESS_COST_EVENT_NAMES, PROCESS_COST_REQUIRED_PAYLOAD, type ProcessCostEventName, } from "./process-cost-constants.js";
 /** Ceremony tier labels mirror session-start cold|rearm (#2992 / #2994). */
@@ -50,4 +40,36 @@ export declare function emitSessionStartProcessCost(input: SessionStartProcessCo
  * Returns null on any failure (telemetry must not change deny verdict).
  */
 export declare function emitSessionRitualBlockedProcessCost(input: SessionRitualBlockedProcessCostInput, options: EmitProcessCostOptions): BehavioralEventRecord | null;
+export interface CeremonyCostRollup {
+    /** Discriminator: CLI process time, not agent-turn wall clock (#3500 / #3508). */
+    readonly kind: "cli_process_time";
+    readonly windowLabel: string;
+    readonly lastColdDurationMs: number | null;
+    readonly lastRearmDurationMs: number | null;
+    readonly lastColdSteps: readonly ProcessCostStepTiming[];
+    readonly lastRearmSteps: readonly ProcessCostStepTiming[];
+    readonly blockedRitualCount: number;
+    readonly recoveryTierDistribution: Readonly<Record<string, number>>;
+}
+/**
+ * Roll up ceremony cost from `.deft-cache/events.jsonl` (#3508).
+ * Measures CLI process time, not agent-turn wall clock (#3500).
+ */
+export declare function computeCeremonyCostRollup(options: {
+    projectRoot: string;
+    logPath?: string | null;
+    windowMs?: number;
+    now?: Date;
+    windowLabel?: string;
+}): CeremonyCostRollup;
+/**
+ * Human rollup for the composed `value:show` reader (#3508).
+ * CLI process time, not agent-turn wall clock (#3500).
+ */
+export declare function formatCeremonyCostReport(rollup: CeremonyCostRollup): string;
+/**
+ * Operator-visible mutation `session:start` line (#3508).
+ * CLI process time only. ⊗ not #3286 Later graduation input.
+ */
+export declare function formatSessionStartCeremonyCostLine(ceremonyTier: ProcessCostCeremonyTier, durationMs: number): string;
 //# sourceMappingURL=process-cost.d.ts.map

package/dist/session/process-cost.js

@@ -7,8 +7,13 @@
  *
  * Types are declared locally (not imported from session-start) so this module
  * does not form an import cycle with session-start call sites.
+ *
+ * #3508: composed readers live on `task value:show` (`value/readback.ts`).
+ * This module measures CLI process time, not agent-turn wall clock (#3500).
+ * ⊗ Do not use a printed CLI duration as #3286 Later graduation input.
  */
-import { emit } from "../lifecycle/events.js";
+import { resolve } from "node:path";
+import { DEFAULT_EVENT_LOG, emit, readEvents, } from "../lifecycle/events.js";
 import { PROCESS_COST_EVENT_NAMES } from "./process-cost-constants.js";
 export { PROCESS_COST_EVENT_NAMES, PROCESS_COST_REQUIRED_PAYLOAD, } from "./process-cost-constants.js";
 /**
@@ -79,4 +84,187 @@ export function emitSessionRitualBlockedProcessCost(input, options) {
         return null;
     }
 }
+function isRecordPayload(payload) {
+    return payload !== null && typeof payload === "object" && !Array.isArray(payload);
+}
+function parseDetectedAt(record) {
+    const raw = record.detected_at;
+    if (typeof raw !== "string" || raw.trim().length === 0) {
+        return null;
+    }
+    let text = raw.trim();
+    if (text.endsWith("Z")) {
+        text = `${text.slice(0, -1)}+00:00`;
+    }
+    const parsed = new Date(text);
+    return Number.isNaN(parsed.getTime()) ? null : parsed;
+}
+function payloadNumber(payload, key) {
+    const raw = payload[key];
+    return typeof raw === "number" && Number.isFinite(raw) ? raw : null;
+}
+function resolveProcessCostLogPath(projectRoot, logPath) {
+    if (logPath !== undefined && logPath !== null) {
+        return resolve(logPath);
+    }
+    return resolve(projectRoot, DEFAULT_EVENT_LOG);
+}
+function parseSteps(payload) {
+    const raw = payload?.steps;
+    if (!Array.isArray(raw)) {
+        return [];
+    }
+    const out = [];
+    for (const item of raw) {
+        if (item === null || typeof item !== "object" || Array.isArray(item)) {
+            continue;
+        }
+        const rec = item;
+        if (typeof rec.name !== "string" || typeof rec.duration_ms !== "number") {
+            continue;
+        }
+        if (!Number.isFinite(rec.duration_ms)) {
+            continue;
+        }
+        const step = {
+            name: rec.name,
+            duration_ms: rec.duration_ms,
+        };
+        if (rec.skipped === true) {
+            out.push({ ...step, skipped: true });
+        }
+        else {
+            out.push(step);
+        }
+    }
+    return out;
+}
+function lastSessionStartForTier(events, tier) {
+    for (let i = events.length - 1; i >= 0; i -= 1) {
+        const record = events[i];
+        if (record === undefined || record.event !== PROCESS_COST_EVENT_NAMES.sessionStart) {
+            continue;
+        }
+        const payload = isRecordPayload(record.payload) ? record.payload : null;
+        if (payload?.ceremony_tier === tier) {
+            return record;
+        }
+    }
+    return null;
+}
+function durationFrom(record) {
+    if (record === null || !isRecordPayload(record.payload)) {
+        return null;
+    }
+    return payloadNumber(record.payload, "duration_ms");
+}
+function formatWindowLabel(windowMs) {
+    const days = Math.round(windowMs / 86_400_000);
+    if (days >= 1 && days * 86_400_000 === windowMs) {
+        return `${days}d`;
+    }
+    const hours = Math.round(windowMs / 3_600_000);
+    if (hours >= 1 && hours * 3_600_000 === windowMs) {
+        return `${hours}h`;
+    }
+    return `${windowMs}ms`;
+}
+/**
+ * Roll up ceremony cost from `.deft-cache/events.jsonl` (#3508).
+ * Measures CLI process time, not agent-turn wall clock (#3500).
+ */
+export function computeCeremonyCostRollup(options) {
+    const windowMs = options.windowMs ?? 7 * 86_400_000;
+    const now = options.now ?? new Date();
+    const sinceMs = now.getTime() - windowMs;
+    const logPath = resolveProcessCostLogPath(options.projectRoot, options.logPath);
+    let records = [];
+    try {
+        records = readEvents(logPath).filter((record) => {
+            if (record.event !== PROCESS_COST_EVENT_NAMES.sessionStart &&
+                record.event !== PROCESS_COST_EVENT_NAMES.sessionRitualBlocked) {
+                return false;
+            }
+            const at = parseDetectedAt(record);
+            if (at === null) {
+                return false;
+            }
+            return at.getTime() >= sinceMs;
+        });
+    }
+    catch {
+        records = [];
+    }
+    const lastCold = lastSessionStartForTier(records, "cold");
+    const lastRearm = lastSessionStartForTier(records, "rearm");
+    const recoveryTierDistribution = {};
+    let blockedRitualCount = 0;
+    for (const record of records) {
+        if (record.event !== PROCESS_COST_EVENT_NAMES.sessionRitualBlocked) {
+            continue;
+        }
+        blockedRitualCount += 1;
+        const payload = isRecordPayload(record.payload) ? record.payload : null;
+        const rawTier = payload?.recovery_tier;
+        const tier = typeof rawTier === "string" && rawTier.trim().length > 0 ? rawTier.trim() : "unspecified";
+        recoveryTierDistribution[tier] = (recoveryTierDistribution[tier] ?? 0) + 1;
+    }
+    return {
+        kind: "cli_process_time",
+        windowLabel: options.windowLabel ?? formatWindowLabel(windowMs),
+        lastColdDurationMs: durationFrom(lastCold),
+        lastRearmDurationMs: durationFrom(lastRearm),
+        lastColdSteps: parseSteps(lastCold !== null && isRecordPayload(lastCold.payload) ? lastCold.payload : null),
+        lastRearmSteps: parseSteps(lastRearm !== null && isRecordPayload(lastRearm.payload) ? lastRearm.payload : null),
+        blockedRitualCount,
+        recoveryTierDistribution,
+    };
+}
+function formatMs(value) {
+    return value === null ? "none" : `${value}ms`;
+}
+function formatSteps(steps) {
+    if (steps.length === 0) {
+        return "none";
+    }
+    return steps
+        .map((step) => {
+        const skip = step.skipped === true ? " skipped" : "";
+        return `${step.name}=${step.duration_ms}ms${skip}`;
+    })
+        .join(", ");
+}
+function formatRecovery(distribution) {
+    const parts = Object.entries(distribution)
+        .sort(([a], [b]) => a.localeCompare(b))
+        .map(([tier, count]) => `${tier}=${count}`);
+    return parts.length === 0 ? "none" : parts.join(", ");
+}
+/**
+ * Human rollup for the composed `value:show` reader (#3508).
+ * CLI process time, not agent-turn wall clock (#3500).
+ */
+export function formatCeremonyCostReport(rollup) {
+    const lines = [
+        `[ceremony] CLI process time (not agent-turn wall clock; #3508 / #2994) ` +
+            `(${rollup.windowLabel}):`,
+        `  last cold: ${formatMs(rollup.lastColdDurationMs)}`,
+        `  last re-arm: ${formatMs(rollup.lastRearmDurationMs)}`,
+        `  steps (last cold ${PROCESS_COST_EVENT_NAMES.sessionStart}): ` +
+            formatSteps(rollup.lastColdSteps),
+        `  steps (last re-arm ${PROCESS_COST_EVENT_NAMES.sessionStart}): ` +
+            formatSteps(rollup.lastRearmSteps),
+        `  blocked-ritual (${PROCESS_COST_EVENT_NAMES.sessionRitualBlocked}): ` +
+            String(rollup.blockedRitualCount),
+        `  recovery-tier: ${formatRecovery(rollup.recoveryTierDistribution)}`,
+    ];
+    return `${lines.join("\n")}\n`;
+}
+/**
+ * Operator-visible mutation `session:start` line (#3508).
+ * CLI process time only. ⊗ not #3286 Later graduation input.
+ */
+export function formatSessionStartCeremonyCostLine(ceremonyTier, durationMs) {
+    return `[deft session] ceremony ${ceremonyTier} ${durationMs}ms`;
+}
 //# sourceMappingURL=process-cost.js.map

package/dist/session/product-state-hash.js

@@ -19,6 +19,8 @@ const EXCLUDED_DIR_NAMES = new Set([
     ".planning",
 ]);
 const EXCLUDED_PATH_PREFIXES = ["xbrief/", "vbrief/", ".deft/", ".git/"];
+/** Repo-root run-summary telemetry must not invalidate a green bank (#3558). */
+const ROOT_RUN_SUMMARY_REL = ".deft-run-summary.json";
 function asRecord(value) {
     if (typeof value === "object" && value !== null && !Array.isArray(value)) {
         return value;
@@ -39,13 +41,15 @@ function stableJson(value) {
 function toPosix(rel) {
     return rel.replace(/\\/g, "/");
 }
-function isExcludedRel(rel) {
+function isExcludedRel(rel, options) {
     const posix = toPosix(rel);
     if (posix === "." || posix.length === 0)
         return false;
     const first = posix.split("/")[0] ?? "";
     if (EXCLUDED_DIR_NAMES.has(first))
         return true;
+    if (!options?.keepTelemetryFiles && posix === ROOT_RUN_SUMMARY_REL)
+        return true;
     return EXCLUDED_PATH_PREFIXES.some((prefix) => posix === prefix.slice(0, -1) || posix.startsWith(prefix));
 }
 function hashBytes(buf) {
@@ -130,7 +134,7 @@ function relFromRootBytes(root, abs) {
     }
     return toPosix(relative(root, abs.toString("utf8")));
 }
-function walkFiles(root, dir, out, seen = new Set()) {
+function walkFiles(root, dir, out, seen = new Set(), keepTelemetryFiles = false) {
     const dirBuf = asPathBuf(dir);
     let real;
     try {
@@ -153,7 +157,7 @@ function walkFiles(root, dir, out, seen = new Set()) {
         const nameLatin1 = nameBuf.toString("latin1");
         const abs = joinNameBytes(dirBuf, nameBuf);
         const rel = relFromRootBytes(root, abs);
-        if (isExcludedRel(rel))
+        if (isExcludedRel(rel, { keepTelemetryFiles }))
             continue;
         let st;
         try {
@@ -165,7 +169,7 @@ function walkFiles(root, dir, out, seen = new Set()) {
         if (st.isDirectory()) {
             if (EXCLUDED_DIR_NAMES.has(nameLatin1))
                 continue;
-            walkFiles(root, abs, out, seen);
+            walkFiles(root, abs, out, seen, keepTelemetryFiles);
             continue;
         }
         if (st.isFile())
@@ -409,7 +413,7 @@ function literalDirPrefix(rel) {
     }
     return literal.join("/");
 }
-function expandPath(root, relOrGlob) {
+function expandPath(root, relOrGlob, keepTelemetryFiles = false) {
     const rel = toPosix(relOrGlob).replace(/^\.\//, "");
     if (looksLikeGlob(rel)) {
         try {
@@ -418,8 +422,11 @@ function expandPath(root, relOrGlob) {
             for (const pattern of globPatternsIncludingDotfiles(rel)) {
                 for (const match of globSync(pattern, { cwd: root })) {
                     const posix = toPosix(relative(root, resolve(root, match)));
-                    if (posix.length === 0 || isExcludedRel(posix) || seen.has(posix))
+                    if (posix.length === 0 ||
+                        isExcludedRel(posix, { keepTelemetryFiles }) ||
+                        seen.has(posix)) {
                         continue;
+                    }
                     seen.add(posix);
                     const absMatch = resolve(root, posix);
                     let st;
@@ -432,7 +439,7 @@ function expandPath(root, relOrGlob) {
                     if (st.isFile())
                         out.push(posix);
                     else if (st.isDirectory())
-                        walkFiles(root, absMatch, out);
+                        walkFiles(root, absMatch, out, new Set(), keepTelemetryFiles);
                 }
             }
             {
@@ -448,7 +455,7 @@ function expandPath(root, relOrGlob) {
                     }
                     if (st?.isDirectory()) {
                         const walked = [];
-                        walkFiles(root, startDir, walked);
+                        walkFiles(root, startDir, walked, new Set(), keepTelemetryFiles);
                         const re = globToRegExp(rel);
                         for (const file of walked) {
                             if (seen.has(file) || !re.test(file))
@@ -472,7 +479,7 @@ function expandPath(root, relOrGlob) {
         const st = statSync(abs);
         if (st.isDirectory()) {
             const out = [];
-            walkFiles(root, abs, out);
+            walkFiles(root, abs, out, new Set(), keepTelemetryFiles);
             return out;
         }
         if (st.isFile())
@@ -629,45 +636,55 @@ export function hashProductState(input) {
     const runGit = input.runGit ?? defaultGitRunner;
     const files = new Set();
     let statusOk = true;
+    const scope = fileScopePaths(input.plan);
+    const specifiedSurface = input.productPaths !== undefined || scope.length > 0;
+    const keepTelemetryFiles = specifiedSurface;
     if (input.productPaths !== undefined) {
         for (const rel of input.productPaths) {
-            for (const expanded of expandPath(root, rel))
+            for (const expanded of expandPath(root, rel, true))
                 files.add(expanded);
         }
     }
-    else {
-        const scope = fileScopePaths(input.plan);
-        if (scope.length > 0) {
-            for (const entry of scope) {
-                for (const expanded of expandPath(root, entry))
-                    files.add(expanded);
-            }
+    else if (scope.length > 0) {
+        for (const entry of scope) {
+            for (const expanded of expandPath(root, entry, keepTelemetryFiles))
+                files.add(expanded);
         }
-        else {
-            const git = existsSync(join(root, ".git"));
-            if (git) {
-                const dirty = dirtyProductFiles(root, runGit);
-                statusOk = dirty.ok;
+    }
+    else {
+        const git = existsSync(join(root, ".git"));
+        if (git) {
+            const dirty = dirtyProductFiles(root, runGit);
+            if (dirty.ok) {
+                statusOk = true;
                 for (const rel of dirty.files) {
                     for (const expanded of expandIfDirectory(root, rel))
                         files.add(expanded);
                 }
             }
             else {
+                // git status failed (containers, missing git, safe.directory).
+                // Walk product files instead of miss-forever (#3558 / #3549).
                 const walked = [];
                 walkFiles(root, root, walked);
                 for (const rel of walked)
                     files.add(rel);
+                statusOk = true;
             }
         }
+        else {
+            const walked = [];
+            walkFiles(root, root, walked);
+            for (const rel of walked)
+                files.add(rel);
+        }
     }
-    const sorted = [...files].sort();
+    const sorted = [...files].filter((rel) => !isExcludedRel(rel, { keepTelemetryFiles })).sort();
     const fileHashes = {};
     for (const rel of sorted) {
         fileHashes[rel] = hashProductRel(root, rel, runGit);
     }
     const head = existsSync(join(root, ".git")) ? gitHead(root, runGit).head : null;
-    const specifiedSurface = input.productPaths !== undefined || fileScopePaths(input.plan).length > 0;
     const hasSurface = specifiedSurface
         ? sorted.length > 0
         : statusOk && (sorted.length > 0 || head !== null);

package/dist/session/ritual-entrypoint.js

@@ -46,12 +46,27 @@ function parseProjectRoot(argv) {
     }
     return ".";
 }
+function parseOptionalForIssue(argv) {
+    for (let i = 0; i < argv.length; i += 1) {
+        if (argv[i] !== "--for-issue")
+            continue;
+        const next = argv[i + 1];
+        if (next === undefined || next.startsWith("-"))
+            return null;
+        const parsed = Number.parseInt(next, 10);
+        return Number.isNaN(parsed) ? null : parsed;
+    }
+    return null;
+}
 /** CLI-shaped cache-fresh entrypoint (mirrors scripts/preflight_cache.py main). */
 export function runCacheFreshMain(argv) {
     const projectRoot = parseProjectRoot(argv);
     const allowMissingBootstrap = argv.includes("--allow-missing-bootstrap");
     const quiet = argv.includes("--quiet");
-    const result = evaluate(projectRoot, { allowMissingBootstrap });
+    const workSelection = argv.includes("--work-selection");
+    const skipDriftProbe = argv.includes("--skip-drift-probe") && !workSelection;
+    const forIssue = parseOptionalForIssue(argv);
+    const result = evaluate(projectRoot, { allowMissingBootstrap, skipDriftProbe, forIssue });
     if (result.code === 0) {
         if (!quiet) {
             if (result.message.startsWith("⚠")) {

package/dist/session/session-start.d.ts

@@ -1,3 +1,4 @@
+import { type LifecycleVisibleResult } from "../lifecycle-visible/evaluate.js";
 import { type HostContentSurfaceSeams } from "../platform/host-content-surface.js";
 import { type EnvironmentContext } from "../platform/shell-context.js";
 import { type CeremonyDialInputs, type CeremonyDialSelection, type ProvisionalCeremonyEstimateHints } from "../policy/ceremony-dial.js";
@@ -117,6 +118,11 @@ export interface SessionStartOptions {
      * network is enabled. Inject in tests.
      */
     readonly probeScm?: (options: ProbeScmReadinessOptions) => ScmReadinessReport;
+    /**
+     * #3505: per-clone lifecycle-root visibility (ignore / skip-worktree).
+     * Warn-only; never blocks session:start. Inject in tests.
+     */
+    readonly probeLifecycleVisible?: (projectRoot: string, runGit: GitRunner) => LifecycleVisibleResult;
     /**
      * #3214: ceremony dial inputs (task size × model tier × project shape).
      * Missing fields are filled by the headless provisional classifier

package/dist/session/session-start.js

@@ -3,6 +3,7 @@ import { emitSessionEvalReadback } from "../eval/readback.js";
 import { bindSessionGeneration } from "../freshness/bind.js";
 import { readLiveGeneration } from "../freshness/generation.js";
 import { MIGRATE_COMPLETION_NUDGE, shouldEmitMigrateNudge } from "../init-deposit/migrate.js";
+import { evaluateLifecycleVisible, formatLifecycleVisibleSessionLines, } from "../lifecycle-visible/evaluate.js";
 import { hostContentSurfaceToDict, maybeFormatHostContentSurfaceLines, } from "../platform/host-content-surface.js";
 import { detectEnvironmentContext, environmentContextToDict, formatEnvironmentContext, } from "../platform/shell-context.js";
 import { ceremonyDialToDict, formatCeremonyDialStatusLine, mergeCeremonyDialDeferrals, resolveCeremonyDial, resolveSessionCeremonyDialInputs, } from "../policy/ceremony-dial.js";
@@ -26,8 +27,8 @@ import { ceremonyDialEvidenceToDict, collectCeremonyDialConsumerEvidence, format
 import { effortBudgetToDict, maybeFormatEffortBudgetLines, resolveProductionHostEffortDescriptor, } from "./effort-budget.js";
 import { defaultGitRunner, gitHead, gitIsAncestor, worktreePath } from "./git.js";
 import { applyWorktreeOccupancy, } from "./occupancy.js";
-import { runOrientationCompression, } from "./orientation-compression.js";
-import { emitSessionStartProcessCost } from "./process-cost.js";
+import { resolveSessionCompact, runOrientationCompression, } from "./orientation-compression.js";
+import { emitSessionStartProcessCost, formatSessionStartCeremonyCostLine } from "./process-cost.js";
 import { probeSessionReleaseAvailability, } from "./release-availability.js";
 import { newRitualStatePayload, readRitualState, ritualStatePath, ritualStep, writeRitualState, } from "./ritual-sentinel.js";
 import { timestampIso } from "./time.js";
@@ -50,6 +51,18 @@ export const QUICK_STEPS = [
     "verify_tools",
 ];
 export const GATED_STEPS = ["agent_hooks", "doctor", "cache_fresh"];
+/** Per-clone ignore/index hide of lifecycle roots — warn-only (#3505). */
+function pushLifecycleVisibleAdvisory(lines, projectRoot, options, runGit) {
+    try {
+        const probe = options.probeLifecycleVisible ??
+            ((root, git) => evaluateLifecycleVisible({ projectRoot: root, runGit: git }));
+        const result = probe(projectRoot, runGit);
+        lines.push(...formatLifecycleVisibleSessionLines(result));
+    }
+    catch {
+        // best-effort — session:start must not abort on a clone-local advisory
+    }
+}
 /** Standing one-liner when coverageDebt/checkResume is non-default (#3314). */
 function pushCoverageCheckResumeDisclosure(lines, projectRoot) {
     try {
@@ -494,6 +507,8 @@ function runReadOnlySessionStart(projectRoot, options, instant, environment) {
     lines.push(...formatScmReadinessLines(scm));
     lines.push(...hostSurface.lines);
     lines.push(...effortBudget.lines);
+    const runGit = options.runGit ?? defaultGitRunner;
+    pushLifecycleVisibleAdvisory(lines, projectRoot, options, runGit);
     const resultPayload = {
         ready: true,
         exit_code: 0,
@@ -576,6 +591,7 @@ function runSessionRearm(projectRoot, options, instant, environment) {
         ...effortBudget.lines,
         REARM_SKIPPED_FAT_PATH_MESSAGE,
     ];
+    pushLifecycleVisibleAdvisory(lines, projectRoot, options, runGit);
     // Light branch-policy disclosure (local only) so re-arm still surfaces policy state.
     const policyResult = resolvePolicy(projectRoot);
     const policyMessage = disclosureLine(policyResult);
@@ -739,6 +755,10 @@ function runSessionRearm(projectRoot, options, instant, environment) {
         optionalNetwork: false,
         steps: stepTimings,
     }, { projectRoot });
+    // #3508: operator-visible CLI process time. ⊗ not #3286 Later graduation input.
+    if (!resolveSessionCompact({ compact: options.compact, env: options.env })) {
+        lines.push(formatSessionStartCeremonyCostLine(REARM_CEREMONY_TIER, totalMs));
+    }
     return {
         code,
         payload: {
@@ -976,6 +996,12 @@ export function runSessionStart(projectRoot, options = {}) {
         name: "effort_budget",
         duration_ms: elapsedMs(effortBudgetStepStarted),
     });
+    const lifecycleVisibleStarted = performance.now();
+    pushLifecycleVisibleAdvisory(lines, projectRoot, options, runGit);
+    stepTimings.push({
+        name: "lifecycle_visible",
+        duration_ms: elapsedMs(lifecycleVisibleStarted),
+    });
     if (!quickSteps.branch_policy) {
         const stepStarted = performance.now();
         const result = resolvePolicy(projectRoot);
@@ -1461,6 +1487,10 @@ export function runSessionStart(projectRoot, options = {}) {
         optionalNetwork: allowOptionalNetwork,
         steps: stepTimings,
     }, { projectRoot });
+    // #3508: operator-visible CLI process time. ⊗ not #3286 Later graduation input.
+    if (!resolveSessionCompact({ compact: options.compact, env: options.env })) {
+        lines.push(formatSessionStartCeremonyCostLine(COLD_CEREMONY_TIER, totalMs));
+    }
     return { code, payload: resultPayload, lines };
 }
 export { ritualStatePath };

package/dist/session/verify-session-ritual.d.ts

@@ -6,6 +6,26 @@ export { formatCacheFetchAllRecoveryCommand, recoveryHintForStaleFailure, } from
 export declare const ENV_SKIP = "DEFT_SESSION_RITUAL_SKIP";
 export { ENTRYPOINT_TIMEOUT_EXIT_CODE, ENTRYPOINT_TIMEOUT_SECONDS, } from "./ritual-entrypoint.js";
 export declare const GATED_ENTRYPOINT_COMMANDS: Readonly<Record<GatedStepName, readonly string[]>>;
+/** Explicit skip flag threaded through the gated `cache_fresh` argv (#3507). */
+export declare const SKIP_DRIFT_PROBE_FLAG = "--skip-drift-probe";
+/** Explicit work-selection flag threaded through the gated `cache_fresh` argv (#3507). */
+export declare const WORK_SELECTION_FLAG = "--work-selection";
+/** Distinct ritual-state field — never `deferred_reason` (#3507). */
+export declare const DRIFT_PROBE_SKIPPED_NO_WORK_SELECTION = "skipped-no-work-selection";
+export type WorkSelectionKind = "none" | "active-story" | "triage-queue" | "ordered-plan" | "for-issue" | "explicit-flag";
+export interface WorkSelectionSignal {
+    readonly inPlay: boolean;
+    readonly kind: WorkSelectionKind;
+}
+export type DetectWorkSelection = (projectRoot: string) => WorkSelectionSignal;
+/**
+ * Default work-selection detector for the gated `cache_fresh` seam (#3507).
+ * Active story xBRIEF (scope:activate residue), unexhausted ordered-plan /
+ * triage sequence. `--for-issue` is a positive evaluate override, not this
+ * detector — the gated argv never carries it.
+ */
+export declare function detectWorkSelection(projectRoot: string): WorkSelectionSignal;
+export declare function resolveGatedEntrypointCommand(stepName: GatedStepName, projectRoot: string, detect?: DetectWorkSelection): string[];
 export interface VerifyResult {
     readonly code: number;
     readonly message: string;
@@ -30,7 +50,8 @@ export type RitualRunner = (command: readonly string[], projectRoot: string) =>
 export declare function formatRitualRecoveryInstruction(tier?: SessionCeremonyTier): string;
 /**
  * Sanctioned audited defer copy for gated `cache_fresh` failure (#3506 / #3507).
- * The gated argv is always `["verify:cache-fresh"]`, so this is unconditional.
+ * Independent of the #3507 work-selection argv seam — defer is still the
+ * operator-audited escape, not the drift-probe skip.
  */
 export declare function formatCacheFreshDeferSoftPath(): string;
 export interface VerifySessionRitualOptions {
@@ -58,6 +79,8 @@ export interface VerifySessionRitualOptions {
      * {@link checkActiveCliAgainstTarget}.
      */
     readonly checkActiveCli?: (targetVersion: string | null, seams?: ActiveCliCheckSeams) => ActiveCliCheckResult;
+    /** Injectable work-selection detector for gated `cache_fresh` (#3507). */
+    readonly detectWorkSelection?: DetectWorkSelection;
 }
 export interface InspectSessionRitualOptions {
     readonly tier?: "quick" | "gated";