@deftai/directive-core 0.71.0 → 0.72.0

package/dist/events/attribution-enrichment.d.ts

@@ -0,0 +1,35 @@
+/** Record-shape version for attribution ledger entries (#2376). Bump on shape changes. */
+export declare const ATTRIBUTION_SCHEMA_VERSION: 1;
+/** Project-local, gitignored install-identity file. */
+export declare const INSTALL_ID_REL: string;
+/** Identity + provenance fields stamped onto every attribution record (#2376). */
+export interface AttributionEnrichment {
+    /** Normalized `owner/name` of the origin remote, or null when unavailable. */
+    readonly repo: string | null;
+    /** directive engine version at emit time. */
+    readonly directive_version: string;
+    /** Stable per-checkout uuid, or null when it cannot be read/created. */
+    readonly install_id: string | null;
+    /** Attribution record-shape version. */
+    readonly schema_version: number;
+}
+/**
+ * Read-or-create a stable per-checkout install id in `.deft-cache/install-id`.
+ * Best-effort: returns null (never throws) if the file cannot be read or written.
+ */
+export declare function resolveInstallId(projectRoot: string): string | null;
+export interface BuildAttributionEnrichmentOptions {
+    /** Test seam for origin-repo resolution; defaults to `inferRepoFromGit`. */
+    readonly repoResolver?: (projectRoot: string) => string | null;
+}
+/**
+ * Build the identity/provenance enrichment stamped on attribution records (#2376).
+ *
+ * Memoized per `projectRoot` (identity/version/repo are stable within a session)
+ * so a caller that emits many signals in one run does not spawn a git process and
+ * open the install-id file per event -- mirrors `detectOriginOrg`'s cache to keep
+ * this off the hot emit path (#2377 review). A custom `repoResolver` bypasses the
+ * cache so tests stay deterministic. Every field degrades gracefully; never throws.
+ */
+export declare function buildAttributionEnrichment(projectRoot: string, options?: BuildAttributionEnrichmentOptions): AttributionEnrichment;
+//# sourceMappingURL=attribution-enrichment.d.ts.map

package/dist/events/attribution-enrichment.js

@@ -0,0 +1,74 @@
+import { randomUUID } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { readCorePackageVersion } from "../engine-version.js";
+import { inferRepoFromGit } from "../triage/queue/repo.js";
+/** Record-shape version for attribution ledger entries (#2376). Bump on shape changes. */
+export const ATTRIBUTION_SCHEMA_VERSION = 1;
+/** Project-local, gitignored install-identity file. */
+export const INSTALL_ID_REL = join(".deft-cache", "install-id");
+/**
+ * Read-or-create a stable per-checkout install id in `.deft-cache/install-id`.
+ * Best-effort: returns null (never throws) if the file cannot be read or written.
+ */
+export function resolveInstallId(projectRoot) {
+    const path = resolve(projectRoot, INSTALL_ID_REL);
+    try {
+        if (existsSync(path)) {
+            const existing = readFileSync(path, "utf8").trim();
+            if (existing.length > 0) {
+                return existing;
+            }
+        }
+    }
+    catch {
+        // fall through and try to (re)create
+    }
+    try {
+        const id = randomUUID();
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, `${id}\n`, "utf8");
+        return id;
+    }
+    catch {
+        return null;
+    }
+}
+const enrichmentCache = new Map();
+/**
+ * Build the identity/provenance enrichment stamped on attribution records (#2376).
+ *
+ * Memoized per `projectRoot` (identity/version/repo are stable within a session)
+ * so a caller that emits many signals in one run does not spawn a git process and
+ * open the install-id file per event -- mirrors `detectOriginOrg`'s cache to keep
+ * this off the hot emit path (#2377 review). A custom `repoResolver` bypasses the
+ * cache so tests stay deterministic. Every field degrades gracefully; never throws.
+ */
+export function buildAttributionEnrichment(projectRoot, options = {}) {
+    const useCache = options.repoResolver === undefined;
+    if (useCache) {
+        const cached = enrichmentCache.get(projectRoot);
+        if (cached !== undefined) {
+            return cached;
+        }
+    }
+    const resolver = options.repoResolver ?? inferRepoFromGit;
+    let repo = null;
+    try {
+        repo = resolver(projectRoot);
+    }
+    catch {
+        repo = null;
+    }
+    const enrichment = {
+        repo,
+        directive_version: readCorePackageVersion(),
+        install_id: resolveInstallId(projectRoot),
+        schema_version: ATTRIBUTION_SCHEMA_VERSION,
+    };
+    if (useCache) {
+        enrichmentCache.set(projectRoot, enrichment);
+    }
+    return enrichment;
+}
+//# sourceMappingURL=attribution-enrichment.js.map

package/dist/events/attribution-ledger.js

@@ -2,6 +2,7 @@ import { resolve } from "node:path";
 import { DEFAULT_EVENT_LOG, emit } from "../lifecycle/events.js";
 import { isValueFeedbackPathAllowed, resolveValueFeedback, } from "../policy/value-feedback.js";
 import { ATTRIBUTION_EVENT_NAMES } from "./attribution-constants.js";
+import { buildAttributionEnrichment } from "./attribution-enrichment.js";
 export { ALL_ATTRIBUTION_EVENT_NAMES, ATTRIBUTION_EVENT_NAMES, ATTRIBUTION_REQUIRED_PAYLOAD, } from "./attribution-constants.js";
 function resolveLedgerLogPath(projectRoot, logPath) {
     if (logPath !== undefined && logPath !== null) {
@@ -28,9 +29,13 @@ export function emitAttributionSignal(name, payload, options) {
         }
         const signalClass = signalClassForEvent(name);
         const logPath = resolveLedgerLogPath(options.projectRoot, options.logPath);
+        const enrichment = buildAttributionEnrichment(options.projectRoot);
+        // Authoritative fields (signal_class + provenance enrichment) are spread LAST
+        // so a caller payload can never silently shadow them (#2377 review).
         return emit(name, {
-            signal_class: signalClass,
             ...payload,
+            signal_class: signalClass,
+            ...enrichment,
         }, { logPath });
     }
     catch {

package/dist/init-deposit/gitignore.js

@@ -31,6 +31,16 @@ export const CANONICAL_GITIGNORE_BASELINE = [
     "vbrief/.triage-cache/scope-lifecycle.jsonl",
     "vbrief/.triage-cache/decompositions/",
     "vbrief/.triage-cache/doctor-state.json",
+    // Symmetric `xbrief/` layout entries (#2348). On the migrated `xbrief/` tree
+    // the engine writes operator-private triage-cache files to
+    // `xbrief/.triage-cache/`; without these the paths are trackable, violating
+    // the #1144 hybrid policy. Both layouts are emitted (harmless extra lines on
+    // the layout not in use) to match the both-layout `.eval/` treatment.
+    "xbrief/.triage-cache/candidates.jsonl",
+    "xbrief/.triage-cache/summary-history.jsonl",
+    "xbrief/.triage-cache/scope-lifecycle.jsonl",
+    "xbrief/.triage-cache/decompositions/",
+    "xbrief/.triage-cache/doctor-state.json",
     "vbrief/*.lock",
     ".deft/core.bak-*/",
     ".deft/*.bak-*",

package/dist/intake/candidates-log.d.ts

@@ -1,4 +1,3 @@
-export declare const DEFAULT_LOG_PATH: string;
 export declare class CandidatesLogError extends Error {
     constructor(message: string);
 }

package/dist/intake/candidates-log.js

@@ -2,7 +2,10 @@ import { randomUUID } from "node:crypto";
 import { closeSync, existsSync, fsyncSync, mkdirSync, openSync, readFileSync, unlinkSync, writeSync, } from "node:fs";
 import { dirname, join, resolve } from "node:path";
 import { pyRepr } from "../scm/py-format.js";
-export const DEFAULT_LOG_PATH = resolve(import.meta.dirname, "..", "..", "..", "..", "vbrief", ".eval", "candidates.jsonl");
+import { resolveCandidatesLogPath } from "../triage/cache-path.js";
+function defaultLogPath() {
+    return resolveCandidatesLogPath(process.cwd());
+}
 const VALID_DECISIONS = new Set([
     "accept",
     "reject",
@@ -105,7 +108,7 @@ function validateEntry(entry) {
     }
 }
 function resolvePath(path) {
-    return path !== undefined && path !== null ? resolve(path) : DEFAULT_LOG_PATH;
+    return path !== undefined && path !== null ? resolve(path) : defaultLogPath();
 }
 function acquireAppendLock(logPath) {
     while (threadLocked) {

package/dist/intake/issue-ingest.d.ts

@@ -44,6 +44,14 @@ export interface FetchIssueOptions {
     readonly cacheRoot?: string | null;
     readonly scmCall?: ScmCallFn;
 }
+/**
+ * Strip the `# #<number>: <title>` header that `renderContent` prepends when it
+ * materializes an issue's `content.md` at cache-put (#2314). The header is the
+ * only shape difference between the cache-read body and the live/raw-body path;
+ * removing it makes an ingested xBRIEF's `Overview` identical whether the source
+ * was a cache hit or a live fetch. A missing/older-shape header is left intact.
+ */
+export declare function stripRenderedIssueHeader(content: string, number: number): string;
 export declare function fetchFromCache(repo: string, number: number, options?: FetchIssueOptions): Record<string, unknown> | null;
 export declare function fetchIssueComments(repo: string, number: number, options?: FetchIssueOptions): IssueComment[];
 export declare function attachIssueCommentThread(issue: Record<string, unknown>, comments: readonly IssueComment[]): Record<string, unknown>;

package/dist/intake/issue-ingest.js

@@ -386,6 +386,20 @@ export function targetFilename(number, title, artifactSuffix = LEGACY_ARTIFACT_S
     const slug = slugify(title) || `issue-${number}`;
     return `${TODAY}-${number}-${slug}${artifactSuffix}`;
 }
+/**
+ * Strip the `# #<number>: <title>` header that `renderContent` prepends when it
+ * materializes an issue's `content.md` at cache-put (#2314). The header is the
+ * only shape difference between the cache-read body and the live/raw-body path;
+ * removing it makes an ingested xBRIEF's `Overview` identical whether the source
+ * was a cache hit or a live fetch. A missing/older-shape header is left intact.
+ */
+export function stripRenderedIssueHeader(content, number) {
+    if (!Number.isFinite(number)) {
+        return content;
+    }
+    const header = new RegExp(`^# #${number}:[^\\n]*\\n\\n`);
+    return content.replace(header, "");
+}
 export function fetchFromCache(repo, number, options = {}) {
     const key = `${repo}/${number}`;
     try {
@@ -405,7 +419,11 @@ export function fetchFromCache(repo, number, options = {}) {
         // buildIssueVbrief.
         if (result.contentPath !== null) {
             try {
-                issue.body = readFileSync(result.contentPath, "utf8");
+                // #2314: content.md is `renderContent`-prefixed with a `# #<n>: <title>`
+                // header at cache-put. Strip that header so the cache-read Overview
+                // matches the live/raw-body path (which has no header), keeping the
+                // durable xBRIEF identical for a cache hit vs a live fetch.
+                issue.body = stripRenderedIssueHeader(readFileSync(result.contentPath, "utf8"), Number(issue.number));
             }
             catch {
                 // fall back to the raw body (re-scanned downstream)

package/dist/intake/reconcile-issues.js

@@ -6,6 +6,7 @@ import { call } from "../scm/call.js";
 import { updateDecomposedChildBackReferences } from "../scope/decomposed-refs.js";
 import { resolveProjectRoot } from "../scope/project-context.js";
 import { resolveProjectRepo } from "../slice/project-context.js";
+import { LEGACY_INFO_ROOT_KEY, MIGRATED_INFO_ROOT_KEY } from "../xbrief-migrate/constants.js";
 export const LIFECYCLE_FOLDERS = [
     "proposed",
     "pending",
@@ -633,8 +634,14 @@ export function applyLifecycleFixes(vbriefDir, report, projectRoot = null) {
         const terminalStatus = destFolder === "cancelled" ? "cancelled" : "completed";
         plan.status = terminalStatus;
         const stamp = utcNowIso();
-        const info = (data.vBRIEFInfo ?? {});
-        data.vBRIEFInfo = info;
+        // Stamp `updated` into whichever info envelope the file already uses (#2346).
+        // Canonical v0.8 briefs use `xBRIEFInfo`; stamping `vBRIEFInfo` unconditionally
+        // appended a stray, version-less `vBRIEFInfo` block that then failed
+        // `vbrief:validate` ('vBRIEFInfo.version' must be one of ..., got 'undefined').
+        // Legacy briefs (or files without either envelope) keep the `vBRIEFInfo` key.
+        const infoKey = MIGRATED_INFO_ROOT_KEY in data ? MIGRATED_INFO_ROOT_KEY : LEGACY_INFO_ROOT_KEY;
+        const info = (data[infoKey] ?? {});
+        data[infoKey] = info;
         info.updated = stamp;
         plan.updated = stamp;
         propagateItemStatus(plan.items, terminalStatus, stamp);

package/dist/orchestration/subagent-monitor.js

@@ -379,8 +379,8 @@ export function cmdSubagentMonitor(argv, cwd = process.cwd()) {
         process.stderr.write(`Error: ${args.error}\n`);
         return EXIT_EXTERNAL_ERROR;
     }
-    if (args.thresholdMinutes <= 0) {
-        process.stderr.write(`Error: --threshold-minutes must be positive, got ${args.thresholdMinutes}\n`);
+    if (Number.isNaN(args.thresholdMinutes) || args.thresholdMinutes <= 0) {
+        process.stderr.write(`Error: --threshold-minutes must be a positive number, got ${args.thresholdMinutes}\n`);
         return EXIT_EXTERNAL_ERROR;
     }
     const scratchEntries = args.scratchDirs.length > 0

package/dist/policy/index.js

@@ -215,8 +215,8 @@ function inspectSwarmSubagentBackend(data) {
         source: "default-on-error",
     };
 }
-function inspectValueFeedbackField(data) {
-    const field = inspectValueFeedback(data);
+function inspectValueFeedbackField(data, projectRoot) {
+    const field = inspectValueFeedback(data, projectRoot);
     return {
         name: field.name,
         current: field.current,
@@ -241,7 +241,7 @@ const REGISTERED_POLICIES = [
 /** Walk registered inspectors and return one row per field (#1148). */
 export function inspectAllPolicies(projectRoot) {
     const [data] = loadProjectDefinition(projectRoot);
-    return REGISTERED_POLICIES.map((inspect) => inspect(data));
+    return REGISTERED_POLICIES.map((inspect) => inspect(data, projectRoot));
 }
 /** Look up a single registered field by canonical dotted-path name (or CLI alias). */
 export function inspectOnePolicy(name, projectRoot) {

package/dist/policy/value-feedback-autoenable.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Company-owned GitHub orgs whose repos auto-enable LOCAL value-feedback
+ * collection (#2376). Org membership is the consent for local, no-egress
+ * collection; network/upstream surfaces stay opt-in regardless.
+ */
+export declare const DEFAULT_AUTOENABLE_ORGS: readonly string[];
+/** Optional comma-separated env override that EXTENDS the built-in trusted-org set. */
+export declare const AUTOENABLE_ORGS_ENV = "DEFT_VALUE_AUTOENABLE_ORGS";
+/** Built-in trusted orgs plus any from the env override, normalized to lowercase. */
+export declare function resolveTrustedOrgs(env?: NodeJS.ProcessEnv): Set<string>;
+/** Test/hygiene hook: drop the memoized origin-org lookups. */
+export declare function clearOriginOrgCache(): void;
+export interface OriginOrgOptions {
+    /** Test seam for origin-repo resolution; defaults to `inferRepoFromGit`. */
+    readonly repoResolver?: (projectRoot: string) => string | null;
+    /** Override caching; defaults to caching only when no custom resolver is supplied. */
+    readonly useCache?: boolean;
+}
+/**
+ * Lowercased owner of the origin remote for `projectRoot`, or null when there is
+ * no remote / not a git checkout. Memoized per projectRoot (the org does not
+ * change within a session) to keep the resolver off the hot emit path.
+ */
+export declare function detectOriginOrg(projectRoot: string, options?: OriginOrgOptions): string | null;
+export interface OrgAutoEnableOptions extends OriginOrgOptions {
+    readonly env?: NodeJS.ProcessEnv;
+}
+/**
+ * True when `projectRoot`'s origin org is in the trusted-org set (#2376).
+ * Fail-safe: any resolution failure (no remote, non-GitHub, git absent) is false.
+ */
+export declare function isTrustedOrgAutoEnable(projectRoot: string, options?: OrgAutoEnableOptions): boolean;
+//# sourceMappingURL=value-feedback-autoenable.d.ts.map

package/dist/policy/value-feedback-autoenable.js

@@ -0,0 +1,67 @@
+import { inferRepoFromGit } from "../triage/queue/repo.js";
+/**
+ * Company-owned GitHub orgs whose repos auto-enable LOCAL value-feedback
+ * collection (#2376). Org membership is the consent for local, no-egress
+ * collection; network/upstream surfaces stay opt-in regardless.
+ */
+export const DEFAULT_AUTOENABLE_ORGS = ["deftai"];
+/** Optional comma-separated env override that EXTENDS the built-in trusted-org set. */
+export const AUTOENABLE_ORGS_ENV = "DEFT_VALUE_AUTOENABLE_ORGS";
+/** Built-in trusted orgs plus any from the env override, normalized to lowercase. */
+export function resolveTrustedOrgs(env = process.env) {
+    const orgs = new Set(DEFAULT_AUTOENABLE_ORGS.map((o) => o.toLowerCase()));
+    const raw = env[AUTOENABLE_ORGS_ENV];
+    if (typeof raw === "string") {
+        for (const part of raw.split(",")) {
+            const trimmed = part.trim().toLowerCase();
+            if (trimmed.length > 0) {
+                orgs.add(trimmed);
+            }
+        }
+    }
+    return orgs;
+}
+const originOrgCache = new Map();
+/** Test/hygiene hook: drop the memoized origin-org lookups. */
+export function clearOriginOrgCache() {
+    originOrgCache.clear();
+}
+/**
+ * Lowercased owner of the origin remote for `projectRoot`, or null when there is
+ * no remote / not a git checkout. Memoized per projectRoot (the org does not
+ * change within a session) to keep the resolver off the hot emit path.
+ */
+export function detectOriginOrg(projectRoot, options = {}) {
+    const useCache = options.useCache ?? options.repoResolver === undefined;
+    if (useCache && originOrgCache.has(projectRoot)) {
+        return originOrgCache.get(projectRoot) ?? null;
+    }
+    const resolver = options.repoResolver ?? inferRepoFromGit;
+    let org = null;
+    try {
+        const repo = resolver(projectRoot);
+        if (typeof repo === "string") {
+            const owner = repo.split("/")[0]?.trim().toLowerCase() ?? "";
+            org = owner.length > 0 ? owner : null;
+        }
+    }
+    catch {
+        org = null;
+    }
+    if (useCache) {
+        originOrgCache.set(projectRoot, org);
+    }
+    return org;
+}
+/**
+ * True when `projectRoot`'s origin org is in the trusted-org set (#2376).
+ * Fail-safe: any resolution failure (no remote, non-GitHub, git absent) is false.
+ */
+export function isTrustedOrgAutoEnable(projectRoot, options = {}) {
+    const org = detectOriginOrg(projectRoot, options);
+    if (org === null) {
+        return false;
+    }
+    return resolveTrustedOrgs(options.env).has(org);
+}
+//# sourceMappingURL=value-feedback-autoenable.js.map

package/dist/policy/value-feedback.d.ts

@@ -1,3 +1,4 @@
+import { type OrgAutoEnableOptions } from "./value-feedback-autoenable.js";
 /** Canonical registered policy field name (matches other FIELD_* dotted paths). */
 export declare const FIELD_VALUE_FEEDBACK = "plan.policy.valueFeedback";
 /** Short alias accepted by `policy:show --field=valueFeedback` (#1709). */
@@ -16,7 +17,7 @@ export interface ValueFeedbackConfig {
     readonly sessionLine: boolean;
     readonly upstreamPrompt: boolean;
 }
-export type ValueFeedbackSource = "typed" | "default" | "default-on-error";
+export type ValueFeedbackSource = "typed" | "org-auto" | "default" | "default-on-error";
 export interface ValueFeedbackResolved extends ValueFeedbackConfig {
     readonly source: ValueFeedbackSource;
     readonly error: string | null;
@@ -24,8 +25,20 @@ export interface ValueFeedbackResolved extends ValueFeedbackConfig {
 export declare const VALUE_FEEDBACK_CAPABILITY_COST_DISCLOSURE: string;
 /** Validate a `plan.policy.valueFeedback` payload. */
 export declare function validateValueFeedback(value: unknown): string[];
-/** Resolve `plan.policy.valueFeedback` from PROJECT-DEFINITION (#1709). */
-export declare function resolveValueFeedback(projectRoot: string): ValueFeedbackResolved;
+export interface ResolveValueFeedbackOptions {
+    /** Test seam for origin-org auto-enable resolution (#2376). */
+    readonly autoEnable?: OrgAutoEnableOptions;
+}
+/**
+ * Resolve `plan.policy.valueFeedback` from PROJECT-DEFINITION (#1709).
+ *
+ * Precedence (#2376): an explicit typed `valueFeedback` block always wins
+ * (including `enabled: false`). Only when the typed flag is ABSENT does the
+ * trusted-org auto-enable layer apply -- for company-owned (deftai) repos it
+ * turns LOCAL emit + session readback ON while leaving network/upstream OFF.
+ * Any other repo (or no origin remote) stays OFF.
+ */
+export declare function resolveValueFeedback(projectRoot: string, options?: ResolveValueFeedbackOptions): ValueFeedbackResolved;
 /** Master gate: when `enabled` is false, every downstream path is rejected. */
 export declare function isValueFeedbackPathAllowed(path: ValueFeedbackSubFlag, policy: ValueFeedbackResolved): boolean;
 /** Resolved per-path gate booleans for policy:show and enable status output. */
@@ -38,8 +51,20 @@ export interface ValueFeedbackPolicyField {
     readonly default: ValueFeedbackConfig;
     readonly source: string;
 }
-/** Inspector row for `policy:show --field=valueFeedback`. */
-export declare function inspectValueFeedback(data: Record<string, unknown> | null): ValueFeedbackPolicyField;
+export interface InspectValueFeedbackOptions {
+    /** Test seam for origin-org auto-enable resolution (#2376). */
+    readonly autoEnable?: OrgAutoEnableOptions;
+}
+/**
+ * Inspector row for `policy:show --field=valueFeedback`.
+ *
+ * When `projectRoot` is supplied this MUST mirror {@link resolveValueFeedback}'s
+ * precedence exactly (#2377 review): with no explicit typed block, a trusted-org
+ * checkout resolves to `org-auto`/ON so `policy:show` never reports OFF while the
+ * ledger is actively collecting. Omitting `projectRoot` keeps the legacy
+ * data-only behavior for callers that only need the field name/shape.
+ */
+export declare function inspectValueFeedback(data: Record<string, unknown> | null, projectRoot?: string, options?: InspectValueFeedbackOptions): ValueFeedbackPolicyField;
 export interface EnableValueFeedbackOptions {
     readonly confirm: boolean;
     readonly actor?: string;

package/dist/policy/value-feedback.js

@@ -2,6 +2,7 @@ import { readFileSync } from "node:fs";
 import { atomicWriteProjectDefinition, projectDefinitionMutationLock, } from "../vbrief-build/project-definition-io.js";
 import { migrateLegacyPolicyKey, PLAN_POLICY_KEY, readPlanPolicy } from "./plan-extensions.js";
 import { appendAuditLog, loadProjectDefinition, projectDefinitionPath } from "./resolve.js";
+import { isTrustedOrgAutoEnable } from "./value-feedback-autoenable.js";
 /** Canonical registered policy field name (matches other FIELD_* dotted paths). */
 export const FIELD_VALUE_FEEDBACK = "plan.policy.valueFeedback";
 /** Short alias accepted by `policy:show --field=valueFeedback` (#1709). */
@@ -33,6 +34,20 @@ function defaultResolved(source, error = null) {
         error,
     };
 }
+/**
+ * Trusted-org auto-enable resolution (#2376): LOCAL emit + session readback ON,
+ * network/upstream OFF. Applies only when the typed flag is absent.
+ */
+function orgAutoResolved() {
+    return {
+        enabled: true,
+        emitEvents: VALUE_FEEDBACK_SUBFLAG_DEFAULTS_WHEN_ENABLED.emitEvents,
+        sessionLine: VALUE_FEEDBACK_SUBFLAG_DEFAULTS_WHEN_ENABLED.sessionLine,
+        upstreamPrompt: false,
+        source: "org-auto",
+        error: null,
+    };
+}
 function readSubFlag(block, key, masterEnabled) {
     if (!masterEnabled) {
         return false;
@@ -88,8 +103,16 @@ function resolveFromPolicyBlock(raw) {
         error: null,
     };
 }
-/** Resolve `plan.policy.valueFeedback` from PROJECT-DEFINITION (#1709). */
-export function resolveValueFeedback(projectRoot) {
+/**
+ * Resolve `plan.policy.valueFeedback` from PROJECT-DEFINITION (#1709).
+ *
+ * Precedence (#2376): an explicit typed `valueFeedback` block always wins
+ * (including `enabled: false`). Only when the typed flag is ABSENT does the
+ * trusted-org auto-enable layer apply -- for company-owned (deftai) repos it
+ * turns LOCAL emit + session readback ON while leaving network/upstream OFF.
+ * Any other repo (or no origin remote) stays OFF.
+ */
+export function resolveValueFeedback(projectRoot, options = {}) {
     const [data, err] = loadProjectDefinition(projectRoot);
     if (data === null) {
         return defaultResolved("default-on-error", err);
@@ -99,6 +122,9 @@ export function resolveValueFeedback(projectRoot) {
         policyBlock === null ||
         Array.isArray(policyBlock) ||
         !("valueFeedback" in policyBlock)) {
+        if (isTrustedOrgAutoEnable(projectRoot, options.autoEnable)) {
+            return orgAutoResolved();
+        }
         return defaultResolved("default");
     }
     return resolveFromPolicyBlock(policyBlock.valueFeedback);
@@ -126,57 +152,49 @@ export function formatValueFeedbackStatusLine(policy) {
         `sessionLine=${String(policy.sessionLine)} (path=${String(gates.sessionLine)}) ` +
         `upstreamPrompt=${String(policy.upstreamPrompt)} (path=${String(gates.upstreamPrompt)}).`);
 }
-function defaultInspectorConfig() {
-    const defaults = defaultResolved("default");
-    return {
-        enabled: defaults.enabled,
-        emitEvents: defaults.emitEvents,
-        sessionLine: defaults.sessionLine,
-        upstreamPrompt: defaults.upstreamPrompt,
-    };
-}
-function buildDefaultInspectorField() {
+function fieldFromResolved(resolved) {
     return {
         name: FIELD_VALUE_FEEDBACK,
-        current: defaultInspectorConfig(),
+        current: {
+            enabled: resolved.enabled,
+            emitEvents: resolved.emitEvents,
+            sessionLine: resolved.sessionLine,
+            upstreamPrompt: resolved.upstreamPrompt,
+        },
         default: {
             enabled: DEFAULT_VALUE_FEEDBACK_ENABLED,
             emitEvents: false,
             sessionLine: false,
             upstreamPrompt: false,
         },
-        source: "default",
+        source: resolved.source,
     };
 }
-/** Inspector row for `policy:show --field=valueFeedback`. */
-export function inspectValueFeedback(data) {
+/**
+ * Inspector row for `policy:show --field=valueFeedback`.
+ *
+ * When `projectRoot` is supplied this MUST mirror {@link resolveValueFeedback}'s
+ * precedence exactly (#2377 review): with no explicit typed block, a trusted-org
+ * checkout resolves to `org-auto`/ON so `policy:show` never reports OFF while the
+ * ledger is actively collecting. Omitting `projectRoot` keeps the legacy
+ * data-only behavior for callers that only need the field name/shape.
+ */
+export function inspectValueFeedback(data, projectRoot, options = {}) {
     if (data === null) {
-        return buildDefaultInspectorField();
+        return fieldFromResolved(defaultResolved("default"));
     }
     const policyBlock = readPlanPolicy(data.plan);
     if (typeof policyBlock !== "object" ||
         policyBlock === null ||
         Array.isArray(policyBlock) ||
         !("valueFeedback" in policyBlock)) {
-        return buildDefaultInspectorField();
+        if (projectRoot !== undefined && isTrustedOrgAutoEnable(projectRoot, options.autoEnable)) {
+            return fieldFromResolved(orgAutoResolved());
+        }
+        return fieldFromResolved(defaultResolved("default"));
     }
     const resolved = resolveFromPolicyBlock(policyBlock.valueFeedback);
-    return {
-        name: FIELD_VALUE_FEEDBACK,
-        current: {
-            enabled: resolved.enabled,
-            emitEvents: resolved.emitEvents,
-            sessionLine: resolved.sessionLine,
-            upstreamPrompt: resolved.upstreamPrompt,
-        },
-        default: {
-            enabled: DEFAULT_VALUE_FEEDBACK_ENABLED,
-            emitEvents: false,
-            sessionLine: false,
-            upstreamPrompt: false,
-        },
-        source: resolved.source,
-    };
+    return fieldFromResolved(resolved);
 }
 /** Persist `valueFeedback.enabled=true` after capability-cost disclosure (#1709). */
 export function enableValueFeedback(projectRoot, options) {

package/dist/task-surface/index.js

@@ -37,7 +37,10 @@ export function runChangelogCheck(projectRoot, io) {
         io.writeOut("FAIL: CHANGELOG.md not found\n");
         return 1;
     }
-    const text = readFileSync(path, "utf8");
+    // Normalize CRLF -> LF before matching (#2329). On Windows checkouts with
+    // core.autocrlf=true the working tree uses CRLF, and the `[ \t]*\n` header
+    // pattern does not consume the `\r`, so the section falsely reads as absent.
+    const text = readFileSync(path, "utf8").replace(/\r\n/g, "\n");
     const match = UNRELEASED_RE.exec(text);
     if (match === null) {
         io.writeOut("FAIL: No [Unreleased] section found in CHANGELOG.md\n");

package/dist/triage/actions/index.js

@@ -1,8 +1,7 @@
-import { spawnSync } from "node:child_process";
-import { dirname, join, resolve } from "node:path";
-import { fileURLToPath } from "node:url";
+import { join } from "node:path";
 import { CacheNotFoundError } from "../../cache/errors.js";
 import { cacheGet } from "../../cache/operations.js";
+import { ingestSingleForAccept as ingestSingleForAcceptTs } from "../../intake/issue-ingest.js";
 import { call } from "../../scm/call.js";
 import { ScmStubError } from "../../scm/errors.js";
 import { createCandidatesLog, findByIssue, resolveAuditLogPath, rollbackAuditEntry, } from "./candidates-log.js";
@@ -18,12 +17,6 @@ const TERMINAL_DECISIONS = new Set(["accept", "reject", "mark-duplicate"]);
 const DEFAULT_ACTOR = "agent:triage";
 const DEFAULT_NEEDS_AC_COMMENT = "This issue lacks acceptance criteria. Please add a Test/Acceptance " +
     "narrative before this can be triaged. (deft #845)";
-function resolveDeftRoot() {
-    if (process.env.DEFT_ROOT !== undefined && process.env.DEFT_ROOT.length > 0) {
-        return resolve(process.env.DEFT_ROOT);
-    }
-    return resolve(dirname(fileURLToPath(import.meta.url)), "..", "..", "..", "..", "..");
-}
 function defaultNowIso() {
     return new Date().toISOString().replace(/\.\d{3}Z$/, "Z");
 }
@@ -62,39 +55,22 @@ function defaultScmRunner() {
         },
     };
 }
-function defaultIssueIngest(deftRoot) {
+function defaultIssueIngest() {
     return {
         ingestSingleForAccept(issueNumber, repo, options = {}) {
             const projectRoot = options.projectRoot ?? process.cwd();
-            const script = [
-                "import sys",
-                "from pathlib import Path",
-                `sys.path.insert(0, ${JSON.stringify(join(deftRoot, "scripts"))})`,
-                "import issue_ingest",
-                "issue_ingest.ingest_single_for_accept(",
-                `${issueNumber},`,
-                `${JSON.stringify(repo)},`,
-                `project_root=Path(${JSON.stringify(projectRoot)}),`,
-                ")",
-            ].join("\n");
-            const result = spawnSync("uv", ["run", "python", "-c", script], {
-                cwd: deftRoot,
-                encoding: "utf8",
-                stdio: ["ignore", "pipe", "pipe"],
-            });
-            if (result.status !== 0) {
-                const stderr = (result.stderr ?? "").trim();
-                throw new Error(stderr || "issue:ingest delegation failed");
-            }
+            // Delegate to the native TS intake path (#2350). The legacy Python
+            // `scripts/issue_ingest.py` shell-out was orphaned when #1933 removed the
+            // Python surface, leaving `triage:accept` raising ModuleNotFoundError.
+            ingestSingleForAcceptTs(issueNumber, repo, { projectRoot });
         },
     };
 }
 /** Default dependency bundle for production CLI use. */
 export function createDefaultDeps(projectRoot) {
-    const deftRoot = resolveDeftRoot();
     const deps = {
         candidatesLog: createCandidatesLog(projectRoot),
-        issueIngest: defaultIssueIngest(deftRoot),
+        issueIngest: defaultIssueIngest(),
         scm: defaultScmRunner(),
         nowIso: defaultNowIso,
         stderr: (message) => process.stderr.write(`${message}\n`),

package/dist/triage/bootstrap/gitignore.d.ts

@@ -9,6 +9,8 @@ export declare function gitattributesTriageCacheGlob(projectRoot: string): strin
 export declare const GITATTRIBUTES_EVAL_RULE = "vbrief/.triage-cache/*.jsonl  merge=union";
 export declare const FORBIDDEN_BLANKET_EVAL_LINES: readonly string[];
 export declare const EVAL_README_BODY = "# `vbrief/.triage-cache/` -- triage working-set artefacts\n\nThis directory holds the append-only JSON-lines logs that the triage and\nslicing skills emit. The framework governs which files in here are tracked\nby git versus gitignored using a **hybrid policy** (#1144, child of #1119).\n\n## Tracking policy\n\n| File | Tracked? | Why |\n| --- | --- | --- |\n| `slices.jsonl` | Yes -- **committed** | Team-shared cohort records produced by slicing skills (D13 / #1132). New operators joining the team need to see prior cohort outputs to detect orphans and avoid re-slicing the same scope. |\n| `candidates.jsonl` | No -- **gitignored** | Operator-private triage decisions (#845 Story 2). Each operator's local accept / defer / reject stream is per-machine state; sharing it would conflate operators' timing + identity across the team. Re-derive on a fresh clone via `task triage:bootstrap`. |\n| `summary-history.jsonl` | No -- **gitignored** | Operator-private observability for `task triage:summary` output time-series. Not load-bearing for any decision. |\n| `scope-lifecycle.jsonl` | No -- **gitignored** | Operator-private scope-lifecycle audit decisions (D1 / #1121). Each demote (`task scope:demote`) appends one entry including a `demote_meta` block (`was_promoted`, `original_promotion_decision_id`, `days_in_pending`, `demote_reason`, `demoted_from`). Per-operator stream; sharing would conflate operators' demote timing across the team. Lightweight metrics over this log are tracked separately at #1180. |\n| `decompositions/` | No -- **gitignored** | Temporary story-decomposition proposal drafts. These JSON drafts are local scratch artifacts, not vBRIEFs; generated child story vBRIEFs are created by `task scope:decompose` in lifecycle folders, defaulting to `vbrief/pending/`. |\n| `doctor-state.json` | No -- **gitignored** | Per-machine `task doctor` throttle state (last exit code + timestamps) persisted to gate the 24h/4h re-probe window (#1308 / #1464). Local to each clone; never committed. |\n\nThe gitignore lines live in the repo-root `.gitignore` (`vbrief/.triage-cache/candidates.jsonl`,\n`vbrief/.triage-cache/summary-history.jsonl`, `vbrief/.triage-cache/scope-lifecycle.jsonl`,\n`vbrief/.triage-cache/decompositions/`, and `vbrief/.triage-cache/doctor-state.json`). All paths\nnot listed above remain committed by default.\n\n## Fresh-clone regeneration\n\nOn a fresh clone (or any machine that has never run triage), `candidates.jsonl`\nis absent. Regenerate it with:\n\n```\ntask triage:bootstrap\n```\n\nThe bootstrap path detects the missing file, runs the auto-classifier, and\nwrites a fresh `vbrief/.triage-cache/candidates.jsonl`. It does NOT touch the tracked\n`slices.jsonl`; cohort records remain a team-shared resource.\n\n## `merge=union` policy for `*.jsonl`\n\nThe repo-root `.gitattributes` declares:\n\n```\nvbrief/.triage-cache/*.jsonl  merge=union\n```\n\nThe `union` merge driver concatenates both sides' appended lines on\nauto-merge, so two branches that each appended a different record to the\nsame JSON-lines file rebase cleanly without operator surgery. Two things\noperators should know:\n\n- **Concatenation, not set-union.** When two branches append DIFFERENT\n  records to the file, the merge driver concatenates both sides' lines\n  -- there is no smart deduplication of \"semantically similar\" records.\n  (Identical line-for-line appends collapse because git's three-way\n  merge sees them as the same change, but distinct records always\n  survive verbatim, even if a downstream reader would consider them\n  redundant.) The append-only writers in `scripts/candidates_log.py`\n  mint a fresh `decision_id` per call, so genuinely duplicate records\n  are not the expected case, but downstream readers MUST tolerate\n  multiple records describing the same logical decision.\n- **Single-operator scope only.** This is the foundational rebase\n  ergonomic for the single-operator case (operator A rebases their\n  feature branch onto a master that grew while they were AFK).\n  Multi-operator merge-conflict resolution is explicitly out of scope per\n  #1119 R4 (tracked separately as M1-M4 in #1183).\n\n## See also\n\n- Current Shape comment on #1144 for the canonical decisions (the source\n  of truth this README documents).\n- `.gitignore` -- selective gitignore entries for the operator-private\n  files.\n- `.gitattributes` -- the `merge=union` rule.\n- `scripts/candidates_log.py` -- the writer for `candidates.jsonl`.\n";
+/** Layout-aware triage-cache README body for the active lifecycle tree (#2344 / #2349). */
+export declare function generateTriageCacheReadmeBody(projectRoot: string): string;
 /** Strip an inline `# ...` comment from a gitignore line. */
 export declare function stripGitignoreInlineComment(line: string): string;
 /** Append `.deft-cache/` to `.gitignore` when absent. */

package/dist/triage/bootstrap/gitignore.js

@@ -152,6 +152,12 @@ operators should know:
 - \`.gitattributes\` -- the \`merge=union\` rule.
 - \`scripts/candidates_log.py\` -- the writer for \`candidates.jsonl\`.
 `;
+/** Layout-aware triage-cache README body for the active lifecycle tree (#2344 / #2349). */
+export function generateTriageCacheReadmeBody(projectRoot) {
+    const layout = resolveLifecycleLayout(projectRoot);
+    const triagePrefix = `${layout.artifactDir}/${TRIAGE_CACHE_DIR_NAME}`;
+    return EVAL_README_BODY.replaceAll("vbrief/.triage-cache", triagePrefix);
+}
 function stepOutcome(name, ok, message, details = {}, error = null) {
     return { name, ok, message, error, details };
 }
@@ -338,7 +344,8 @@ function ensureGitattributesMergeUnion(gitattributesPath, stepName, glob, ruleLi
         gitattributes_created: true,
     });
 }
-function ensureEvalReadme(readmePath, readmeRel, stepName) {
+function ensureEvalReadme(options) {
+    const { projectRoot, readmePath, readmeRel, stepName } = options;
     try {
         readFileSync(readmePath, { encoding: "utf8" });
         return stepOutcome(stepName, true, `${readmeRel} already present (no-op)`, {
@@ -351,7 +358,7 @@ function ensureEvalReadme(readmePath, readmeRel, stepName) {
     }
     try {
         mkdirSync(dirname(readmePath), { recursive: true });
-        writeFileSync(readmePath, EVAL_README_BODY, { encoding: "utf8" });
+        writeFileSync(readmePath, generateTriageCacheReadmeBody(projectRoot), { encoding: "utf8" });
     }
     catch (exc) {
         return stepOutcome(stepName, false, `could not create ${readmePath}`, { readme_created: false }, String(exc));
@@ -385,7 +392,7 @@ export function stepEnsureGitignoreEvalEntries(projectRoot) {
         return stepOutcome(stepName, false, gaResult.message, details, gaResult.error ?? null);
     }
     Object.assign(details, gaResult.details);
-    const rdResult = ensureEvalReadme(readmePath, readmeRel, stepName);
+    const rdResult = ensureEvalReadme({ projectRoot, readmePath, readmeRel, stepName });
     if (!rdResult.ok) {
         Object.assign(details, rdResult.details);
         return stepOutcome(stepName, false, rdResult.message, details, rdResult.error ?? null);

package/dist/triage/cache-path.d.ts

@@ -16,6 +16,8 @@ export interface TriageCacheMigrationResult {
     readonly migratedFiles: readonly string[];
     readonly skippedFiles: readonly string[];
     readonly migratedDirs: readonly string[];
+    readonly regeneratedFiles: readonly string[];
+    readonly removedLegacyFiles: readonly string[];
 }
 /** Absolute path to the layout-aware `.triage-cache/` directory. */
 export declare function resolveTriageCacheDir(projectRoot: string): string;

package/dist/triage/cache-path.js

@@ -4,9 +4,10 @@
  * Triage append-only logs and scratch dirs live under `.triage-cache/` so the
  * `.eval/` namespace can be reclaimed for version-eval results (#1703 Tier 2).
  */
-import { existsSync, mkdirSync, renameSync } from "node:fs";
+import { existsSync, mkdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
 import { join, relative } from "node:path";
 import { resolveEvalDir, resolveLifecycleLayout, resolveLifecycleRoot } from "../layout/resolve.js";
+import { generateTriageCacheReadmeBody } from "./bootstrap/gitignore.js";
 /** Directory name for the triage working-set cache (not version-eval results). */
 export const TRIAGE_CACHE_DIR_NAME = ".triage-cache";
 /** Legacy directory that previously held triage cache files before #1703. */
@@ -42,8 +43,10 @@ export function migrateLegacyTriageCacheFromEval(projectRoot) {
     const migratedFiles = [];
     const skippedFiles = [];
     const migratedDirs = [];
+    const regeneratedFiles = [];
+    const removedLegacyFiles = [];
     if (!existsSync(legacyDir)) {
-        return { migratedFiles, skippedFiles, migratedDirs };
+        return { migratedFiles, skippedFiles, migratedDirs, regeneratedFiles, removedLegacyFiles };
     }
     mkdirSync(targetDir, { recursive: true });
     for (const name of TRIAGE_CACHE_FILE_NAMES) {
@@ -52,8 +55,21 @@ export function migrateLegacyTriageCacheFromEval(projectRoot) {
         if (!existsSync(legacyPath)) {
             continue;
         }
+        if (name === "README.md") {
+            if (existsSync(targetPath)) {
+                unlinkSync(legacyPath);
+                removedLegacyFiles.push(name);
+            }
+            else {
+                writeFileSync(targetPath, generateTriageCacheReadmeBody(projectRoot), "utf8");
+                unlinkSync(legacyPath);
+                regeneratedFiles.push(name);
+            }
+            continue;
+        }
         if (existsSync(targetPath)) {
-            skippedFiles.push(name);
+            unlinkSync(legacyPath);
+            removedLegacyFiles.push(name);
             continue;
         }
         renameSync(legacyPath, targetPath);
@@ -72,7 +88,7 @@ export function migrateLegacyTriageCacheFromEval(projectRoot) {
         renameSync(legacyPath, targetPath);
         migratedDirs.push(name);
     }
-    return { migratedFiles, skippedFiles, migratedDirs };
+    return { migratedFiles, skippedFiles, migratedDirs, regeneratedFiles, removedLegacyFiles };
 }
 /** Resolve a path under `.triage-cache/`, migrating legacy `.eval/` files first. */
 export function resolveTriageCachePath(projectRoot, ...segments) {
@@ -91,6 +107,7 @@ export function resolveCandidatesLogPath(projectRoot) {
 }
 /** Ensure the triage cache directory exists (post-migration). */
 export function ensureTriageCacheDir(projectRoot) {
+    migrateLegacyTriageCacheFromEval(projectRoot);
     const dir = resolveTriageCacheDir(projectRoot);
     mkdirSync(dir, { recursive: true });
     return dir;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive-core",
-  "version": "0.71.0",
+  "version": "0.72.0",
   "description": "TypeScript engine core for the Directive framework.",
   "type": "module",
   "main": "./dist/index.js",
@@ -281,8 +281,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-content": "^0.71.0",
-    "@deftai/directive-types": "^0.71.0",
+    "@deftai/directive-content": "^0.72.0",
+    "@deftai/directive-types": "^0.72.0",
     "archiver": "^8.0.0"
   },
   "scripts": {