@deftai/directive-core 0.71.1 → 0.72.0

package/dist/events/attribution-enrichment.d.ts

@@ -0,0 +1,35 @@
+/** Record-shape version for attribution ledger entries (#2376). Bump on shape changes. */
+export declare const ATTRIBUTION_SCHEMA_VERSION: 1;
+/** Project-local, gitignored install-identity file. */
+export declare const INSTALL_ID_REL: string;
+/** Identity + provenance fields stamped onto every attribution record (#2376). */
+export interface AttributionEnrichment {
+    /** Normalized `owner/name` of the origin remote, or null when unavailable. */
+    readonly repo: string | null;
+    /** directive engine version at emit time. */
+    readonly directive_version: string;
+    /** Stable per-checkout uuid, or null when it cannot be read/created. */
+    readonly install_id: string | null;
+    /** Attribution record-shape version. */
+    readonly schema_version: number;
+}
+/**
+ * Read-or-create a stable per-checkout install id in `.deft-cache/install-id`.
+ * Best-effort: returns null (never throws) if the file cannot be read or written.
+ */
+export declare function resolveInstallId(projectRoot: string): string | null;
+export interface BuildAttributionEnrichmentOptions {
+    /** Test seam for origin-repo resolution; defaults to `inferRepoFromGit`. */
+    readonly repoResolver?: (projectRoot: string) => string | null;
+}
+/**
+ * Build the identity/provenance enrichment stamped on attribution records (#2376).
+ *
+ * Memoized per `projectRoot` (identity/version/repo are stable within a session)
+ * so a caller that emits many signals in one run does not spawn a git process and
+ * open the install-id file per event -- mirrors `detectOriginOrg`'s cache to keep
+ * this off the hot emit path (#2377 review). A custom `repoResolver` bypasses the
+ * cache so tests stay deterministic. Every field degrades gracefully; never throws.
+ */
+export declare function buildAttributionEnrichment(projectRoot: string, options?: BuildAttributionEnrichmentOptions): AttributionEnrichment;
+//# sourceMappingURL=attribution-enrichment.d.ts.map

package/dist/events/attribution-enrichment.js

@@ -0,0 +1,74 @@
+import { randomUUID } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { readCorePackageVersion } from "../engine-version.js";
+import { inferRepoFromGit } from "../triage/queue/repo.js";
+/** Record-shape version for attribution ledger entries (#2376). Bump on shape changes. */
+export const ATTRIBUTION_SCHEMA_VERSION = 1;
+/** Project-local, gitignored install-identity file. */
+export const INSTALL_ID_REL = join(".deft-cache", "install-id");
+/**
+ * Read-or-create a stable per-checkout install id in `.deft-cache/install-id`.
+ * Best-effort: returns null (never throws) if the file cannot be read or written.
+ */
+export function resolveInstallId(projectRoot) {
+    const path = resolve(projectRoot, INSTALL_ID_REL);
+    try {
+        if (existsSync(path)) {
+            const existing = readFileSync(path, "utf8").trim();
+            if (existing.length > 0) {
+                return existing;
+            }
+        }
+    }
+    catch {
+        // fall through and try to (re)create
+    }
+    try {
+        const id = randomUUID();
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, `${id}\n`, "utf8");
+        return id;
+    }
+    catch {
+        return null;
+    }
+}
+const enrichmentCache = new Map();
+/**
+ * Build the identity/provenance enrichment stamped on attribution records (#2376).
+ *
+ * Memoized per `projectRoot` (identity/version/repo are stable within a session)
+ * so a caller that emits many signals in one run does not spawn a git process and
+ * open the install-id file per event -- mirrors `detectOriginOrg`'s cache to keep
+ * this off the hot emit path (#2377 review). A custom `repoResolver` bypasses the
+ * cache so tests stay deterministic. Every field degrades gracefully; never throws.
+ */
+export function buildAttributionEnrichment(projectRoot, options = {}) {
+    const useCache = options.repoResolver === undefined;
+    if (useCache) {
+        const cached = enrichmentCache.get(projectRoot);
+        if (cached !== undefined) {
+            return cached;
+        }
+    }
+    const resolver = options.repoResolver ?? inferRepoFromGit;
+    let repo = null;
+    try {
+        repo = resolver(projectRoot);
+    }
+    catch {
+        repo = null;
+    }
+    const enrichment = {
+        repo,
+        directive_version: readCorePackageVersion(),
+        install_id: resolveInstallId(projectRoot),
+        schema_version: ATTRIBUTION_SCHEMA_VERSION,
+    };
+    if (useCache) {
+        enrichmentCache.set(projectRoot, enrichment);
+    }
+    return enrichment;
+}
+//# sourceMappingURL=attribution-enrichment.js.map

package/dist/events/attribution-ledger.js

@@ -2,6 +2,7 @@ import { resolve } from "node:path";
 import { DEFAULT_EVENT_LOG, emit } from "../lifecycle/events.js";
 import { isValueFeedbackPathAllowed, resolveValueFeedback, } from "../policy/value-feedback.js";
 import { ATTRIBUTION_EVENT_NAMES } from "./attribution-constants.js";
+import { buildAttributionEnrichment } from "./attribution-enrichment.js";
 export { ALL_ATTRIBUTION_EVENT_NAMES, ATTRIBUTION_EVENT_NAMES, ATTRIBUTION_REQUIRED_PAYLOAD, } from "./attribution-constants.js";
 function resolveLedgerLogPath(projectRoot, logPath) {
     if (logPath !== undefined && logPath !== null) {
@@ -28,9 +29,13 @@ export function emitAttributionSignal(name, payload, options) {
         }
         const signalClass = signalClassForEvent(name);
         const logPath = resolveLedgerLogPath(options.projectRoot, options.logPath);
+        const enrichment = buildAttributionEnrichment(options.projectRoot);
+        // Authoritative fields (signal_class + provenance enrichment) are spread LAST
+        // so a caller payload can never silently shadow them (#2377 review).
         return emit(name, {
-            signal_class: signalClass,
             ...payload,
+            signal_class: signalClass,
+            ...enrichment,
         }, { logPath });
     }
     catch {

package/dist/policy/index.js

@@ -215,8 +215,8 @@ function inspectSwarmSubagentBackend(data) {
         source: "default-on-error",
     };
 }
-function inspectValueFeedbackField(data) {
-    const field = inspectValueFeedback(data);
+function inspectValueFeedbackField(data, projectRoot) {
+    const field = inspectValueFeedback(data, projectRoot);
     return {
         name: field.name,
         current: field.current,
@@ -241,7 +241,7 @@ const REGISTERED_POLICIES = [
 /** Walk registered inspectors and return one row per field (#1148). */
 export function inspectAllPolicies(projectRoot) {
     const [data] = loadProjectDefinition(projectRoot);
-    return REGISTERED_POLICIES.map((inspect) => inspect(data));
+    return REGISTERED_POLICIES.map((inspect) => inspect(data, projectRoot));
 }
 /** Look up a single registered field by canonical dotted-path name (or CLI alias). */
 export function inspectOnePolicy(name, projectRoot) {

package/dist/policy/value-feedback-autoenable.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Company-owned GitHub orgs whose repos auto-enable LOCAL value-feedback
+ * collection (#2376). Org membership is the consent for local, no-egress
+ * collection; network/upstream surfaces stay opt-in regardless.
+ */
+export declare const DEFAULT_AUTOENABLE_ORGS: readonly string[];
+/** Optional comma-separated env override that EXTENDS the built-in trusted-org set. */
+export declare const AUTOENABLE_ORGS_ENV = "DEFT_VALUE_AUTOENABLE_ORGS";
+/** Built-in trusted orgs plus any from the env override, normalized to lowercase. */
+export declare function resolveTrustedOrgs(env?: NodeJS.ProcessEnv): Set<string>;
+/** Test/hygiene hook: drop the memoized origin-org lookups. */
+export declare function clearOriginOrgCache(): void;
+export interface OriginOrgOptions {
+    /** Test seam for origin-repo resolution; defaults to `inferRepoFromGit`. */
+    readonly repoResolver?: (projectRoot: string) => string | null;
+    /** Override caching; defaults to caching only when no custom resolver is supplied. */
+    readonly useCache?: boolean;
+}
+/**
+ * Lowercased owner of the origin remote for `projectRoot`, or null when there is
+ * no remote / not a git checkout. Memoized per projectRoot (the org does not
+ * change within a session) to keep the resolver off the hot emit path.
+ */
+export declare function detectOriginOrg(projectRoot: string, options?: OriginOrgOptions): string | null;
+export interface OrgAutoEnableOptions extends OriginOrgOptions {
+    readonly env?: NodeJS.ProcessEnv;
+}
+/**
+ * True when `projectRoot`'s origin org is in the trusted-org set (#2376).
+ * Fail-safe: any resolution failure (no remote, non-GitHub, git absent) is false.
+ */
+export declare function isTrustedOrgAutoEnable(projectRoot: string, options?: OrgAutoEnableOptions): boolean;
+//# sourceMappingURL=value-feedback-autoenable.d.ts.map

package/dist/policy/value-feedback-autoenable.js

@@ -0,0 +1,67 @@
+import { inferRepoFromGit } from "../triage/queue/repo.js";
+/**
+ * Company-owned GitHub orgs whose repos auto-enable LOCAL value-feedback
+ * collection (#2376). Org membership is the consent for local, no-egress
+ * collection; network/upstream surfaces stay opt-in regardless.
+ */
+export const DEFAULT_AUTOENABLE_ORGS = ["deftai"];
+/** Optional comma-separated env override that EXTENDS the built-in trusted-org set. */
+export const AUTOENABLE_ORGS_ENV = "DEFT_VALUE_AUTOENABLE_ORGS";
+/** Built-in trusted orgs plus any from the env override, normalized to lowercase. */
+export function resolveTrustedOrgs(env = process.env) {
+    const orgs = new Set(DEFAULT_AUTOENABLE_ORGS.map((o) => o.toLowerCase()));
+    const raw = env[AUTOENABLE_ORGS_ENV];
+    if (typeof raw === "string") {
+        for (const part of raw.split(",")) {
+            const trimmed = part.trim().toLowerCase();
+            if (trimmed.length > 0) {
+                orgs.add(trimmed);
+            }
+        }
+    }
+    return orgs;
+}
+const originOrgCache = new Map();
+/** Test/hygiene hook: drop the memoized origin-org lookups. */
+export function clearOriginOrgCache() {
+    originOrgCache.clear();
+}
+/**
+ * Lowercased owner of the origin remote for `projectRoot`, or null when there is
+ * no remote / not a git checkout. Memoized per projectRoot (the org does not
+ * change within a session) to keep the resolver off the hot emit path.
+ */
+export function detectOriginOrg(projectRoot, options = {}) {
+    const useCache = options.useCache ?? options.repoResolver === undefined;
+    if (useCache && originOrgCache.has(projectRoot)) {
+        return originOrgCache.get(projectRoot) ?? null;
+    }
+    const resolver = options.repoResolver ?? inferRepoFromGit;
+    let org = null;
+    try {
+        const repo = resolver(projectRoot);
+        if (typeof repo === "string") {
+            const owner = repo.split("/")[0]?.trim().toLowerCase() ?? "";
+            org = owner.length > 0 ? owner : null;
+        }
+    }
+    catch {
+        org = null;
+    }
+    if (useCache) {
+        originOrgCache.set(projectRoot, org);
+    }
+    return org;
+}
+/**
+ * True when `projectRoot`'s origin org is in the trusted-org set (#2376).
+ * Fail-safe: any resolution failure (no remote, non-GitHub, git absent) is false.
+ */
+export function isTrustedOrgAutoEnable(projectRoot, options = {}) {
+    const org = detectOriginOrg(projectRoot, options);
+    if (org === null) {
+        return false;
+    }
+    return resolveTrustedOrgs(options.env).has(org);
+}
+//# sourceMappingURL=value-feedback-autoenable.js.map

package/dist/policy/value-feedback.d.ts

@@ -1,3 +1,4 @@
+import { type OrgAutoEnableOptions } from "./value-feedback-autoenable.js";
 /** Canonical registered policy field name (matches other FIELD_* dotted paths). */
 export declare const FIELD_VALUE_FEEDBACK = "plan.policy.valueFeedback";
 /** Short alias accepted by `policy:show --field=valueFeedback` (#1709). */
@@ -16,7 +17,7 @@ export interface ValueFeedbackConfig {
     readonly sessionLine: boolean;
     readonly upstreamPrompt: boolean;
 }
-export type ValueFeedbackSource = "typed" | "default" | "default-on-error";
+export type ValueFeedbackSource = "typed" | "org-auto" | "default" | "default-on-error";
 export interface ValueFeedbackResolved extends ValueFeedbackConfig {
     readonly source: ValueFeedbackSource;
     readonly error: string | null;
@@ -24,8 +25,20 @@ export interface ValueFeedbackResolved extends ValueFeedbackConfig {
 export declare const VALUE_FEEDBACK_CAPABILITY_COST_DISCLOSURE: string;
 /** Validate a `plan.policy.valueFeedback` payload. */
 export declare function validateValueFeedback(value: unknown): string[];
-/** Resolve `plan.policy.valueFeedback` from PROJECT-DEFINITION (#1709). */
-export declare function resolveValueFeedback(projectRoot: string): ValueFeedbackResolved;
+export interface ResolveValueFeedbackOptions {
+    /** Test seam for origin-org auto-enable resolution (#2376). */
+    readonly autoEnable?: OrgAutoEnableOptions;
+}
+/**
+ * Resolve `plan.policy.valueFeedback` from PROJECT-DEFINITION (#1709).
+ *
+ * Precedence (#2376): an explicit typed `valueFeedback` block always wins
+ * (including `enabled: false`). Only when the typed flag is ABSENT does the
+ * trusted-org auto-enable layer apply -- for company-owned (deftai) repos it
+ * turns LOCAL emit + session readback ON while leaving network/upstream OFF.
+ * Any other repo (or no origin remote) stays OFF.
+ */
+export declare function resolveValueFeedback(projectRoot: string, options?: ResolveValueFeedbackOptions): ValueFeedbackResolved;
 /** Master gate: when `enabled` is false, every downstream path is rejected. */
 export declare function isValueFeedbackPathAllowed(path: ValueFeedbackSubFlag, policy: ValueFeedbackResolved): boolean;
 /** Resolved per-path gate booleans for policy:show and enable status output. */
@@ -38,8 +51,20 @@ export interface ValueFeedbackPolicyField {
     readonly default: ValueFeedbackConfig;
     readonly source: string;
 }
-/** Inspector row for `policy:show --field=valueFeedback`. */
-export declare function inspectValueFeedback(data: Record<string, unknown> | null): ValueFeedbackPolicyField;
+export interface InspectValueFeedbackOptions {
+    /** Test seam for origin-org auto-enable resolution (#2376). */
+    readonly autoEnable?: OrgAutoEnableOptions;
+}
+/**
+ * Inspector row for `policy:show --field=valueFeedback`.
+ *
+ * When `projectRoot` is supplied this MUST mirror {@link resolveValueFeedback}'s
+ * precedence exactly (#2377 review): with no explicit typed block, a trusted-org
+ * checkout resolves to `org-auto`/ON so `policy:show` never reports OFF while the
+ * ledger is actively collecting. Omitting `projectRoot` keeps the legacy
+ * data-only behavior for callers that only need the field name/shape.
+ */
+export declare function inspectValueFeedback(data: Record<string, unknown> | null, projectRoot?: string, options?: InspectValueFeedbackOptions): ValueFeedbackPolicyField;
 export interface EnableValueFeedbackOptions {
     readonly confirm: boolean;
     readonly actor?: string;

package/dist/policy/value-feedback.js

@@ -2,6 +2,7 @@ import { readFileSync } from "node:fs";
 import { atomicWriteProjectDefinition, projectDefinitionMutationLock, } from "../vbrief-build/project-definition-io.js";
 import { migrateLegacyPolicyKey, PLAN_POLICY_KEY, readPlanPolicy } from "./plan-extensions.js";
 import { appendAuditLog, loadProjectDefinition, projectDefinitionPath } from "./resolve.js";
+import { isTrustedOrgAutoEnable } from "./value-feedback-autoenable.js";
 /** Canonical registered policy field name (matches other FIELD_* dotted paths). */
 export const FIELD_VALUE_FEEDBACK = "plan.policy.valueFeedback";
 /** Short alias accepted by `policy:show --field=valueFeedback` (#1709). */
@@ -33,6 +34,20 @@ function defaultResolved(source, error = null) {
         error,
     };
 }
+/**
+ * Trusted-org auto-enable resolution (#2376): LOCAL emit + session readback ON,
+ * network/upstream OFF. Applies only when the typed flag is absent.
+ */
+function orgAutoResolved() {
+    return {
+        enabled: true,
+        emitEvents: VALUE_FEEDBACK_SUBFLAG_DEFAULTS_WHEN_ENABLED.emitEvents,
+        sessionLine: VALUE_FEEDBACK_SUBFLAG_DEFAULTS_WHEN_ENABLED.sessionLine,
+        upstreamPrompt: false,
+        source: "org-auto",
+        error: null,
+    };
+}
 function readSubFlag(block, key, masterEnabled) {
     if (!masterEnabled) {
         return false;
@@ -88,8 +103,16 @@ function resolveFromPolicyBlock(raw) {
         error: null,
     };
 }
-/** Resolve `plan.policy.valueFeedback` from PROJECT-DEFINITION (#1709). */
-export function resolveValueFeedback(projectRoot) {
+/**
+ * Resolve `plan.policy.valueFeedback` from PROJECT-DEFINITION (#1709).
+ *
+ * Precedence (#2376): an explicit typed `valueFeedback` block always wins
+ * (including `enabled: false`). Only when the typed flag is ABSENT does the
+ * trusted-org auto-enable layer apply -- for company-owned (deftai) repos it
+ * turns LOCAL emit + session readback ON while leaving network/upstream OFF.
+ * Any other repo (or no origin remote) stays OFF.
+ */
+export function resolveValueFeedback(projectRoot, options = {}) {
     const [data, err] = loadProjectDefinition(projectRoot);
     if (data === null) {
         return defaultResolved("default-on-error", err);
@@ -99,6 +122,9 @@ export function resolveValueFeedback(projectRoot) {
         policyBlock === null ||
         Array.isArray(policyBlock) ||
         !("valueFeedback" in policyBlock)) {
+        if (isTrustedOrgAutoEnable(projectRoot, options.autoEnable)) {
+            return orgAutoResolved();
+        }
         return defaultResolved("default");
     }
     return resolveFromPolicyBlock(policyBlock.valueFeedback);
@@ -126,57 +152,49 @@ export function formatValueFeedbackStatusLine(policy) {
         `sessionLine=${String(policy.sessionLine)} (path=${String(gates.sessionLine)}) ` +
         `upstreamPrompt=${String(policy.upstreamPrompt)} (path=${String(gates.upstreamPrompt)}).`);
 }
-function defaultInspectorConfig() {
-    const defaults = defaultResolved("default");
-    return {
-        enabled: defaults.enabled,
-        emitEvents: defaults.emitEvents,
-        sessionLine: defaults.sessionLine,
-        upstreamPrompt: defaults.upstreamPrompt,
-    };
-}
-function buildDefaultInspectorField() {
+function fieldFromResolved(resolved) {
     return {
         name: FIELD_VALUE_FEEDBACK,
-        current: defaultInspectorConfig(),
+        current: {
+            enabled: resolved.enabled,
+            emitEvents: resolved.emitEvents,
+            sessionLine: resolved.sessionLine,
+            upstreamPrompt: resolved.upstreamPrompt,
+        },
         default: {
             enabled: DEFAULT_VALUE_FEEDBACK_ENABLED,
             emitEvents: false,
             sessionLine: false,
             upstreamPrompt: false,
         },
-        source: "default",
+        source: resolved.source,
     };
 }
-/** Inspector row for `policy:show --field=valueFeedback`. */
-export function inspectValueFeedback(data) {
+/**
+ * Inspector row for `policy:show --field=valueFeedback`.
+ *
+ * When `projectRoot` is supplied this MUST mirror {@link resolveValueFeedback}'s
+ * precedence exactly (#2377 review): with no explicit typed block, a trusted-org
+ * checkout resolves to `org-auto`/ON so `policy:show` never reports OFF while the
+ * ledger is actively collecting. Omitting `projectRoot` keeps the legacy
+ * data-only behavior for callers that only need the field name/shape.
+ */
+export function inspectValueFeedback(data, projectRoot, options = {}) {
     if (data === null) {
-        return buildDefaultInspectorField();
+        return fieldFromResolved(defaultResolved("default"));
     }
     const policyBlock = readPlanPolicy(data.plan);
     if (typeof policyBlock !== "object" ||
         policyBlock === null ||
         Array.isArray(policyBlock) ||
         !("valueFeedback" in policyBlock)) {
-        return buildDefaultInspectorField();
+        if (projectRoot !== undefined && isTrustedOrgAutoEnable(projectRoot, options.autoEnable)) {
+            return fieldFromResolved(orgAutoResolved());
+        }
+        return fieldFromResolved(defaultResolved("default"));
     }
     const resolved = resolveFromPolicyBlock(policyBlock.valueFeedback);
-    return {
-        name: FIELD_VALUE_FEEDBACK,
-        current: {
-            enabled: resolved.enabled,
-            emitEvents: resolved.emitEvents,
-            sessionLine: resolved.sessionLine,
-            upstreamPrompt: resolved.upstreamPrompt,
-        },
-        default: {
-            enabled: DEFAULT_VALUE_FEEDBACK_ENABLED,
-            emitEvents: false,
-            sessionLine: false,
-            upstreamPrompt: false,
-        },
-        source: resolved.source,
-    };
+    return fieldFromResolved(resolved);
 }
 /** Persist `valueFeedback.enabled=true` after capability-cost disclosure (#1709). */
 export function enableValueFeedback(projectRoot, options) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive-core",
-  "version": "0.71.1",
+  "version": "0.72.0",
   "description": "TypeScript engine core for the Directive framework.",
   "type": "module",
   "main": "./dist/index.js",
@@ -281,8 +281,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-content": "^0.71.1",
-    "@deftai/directive-types": "^0.71.1",
+    "@deftai/directive-content": "^0.72.0",
+    "@deftai/directive-types": "^0.72.0",
     "archiver": "^8.0.0"
   },
   "scripts": {