@deftai/directive-core 0.79.4 → 0.81.0

package/dist/init-deposit/agent-hooks.d.ts

@@ -1,15 +1,18 @@
 import type { HookHost } from "../hooks/dispatcher.js";
 import type { InitDepositIo } from "./constants.js";
-export declare const DIRECT_WRITE_HOOK_MATCHER: string;
+export { DIRECT_WRITE_HOOK_MATCHER, SPAWN_HOOK_MATCHER } from "../hooks/tools.js";
 export declare const DEFT_HOOK_COMMAND_MARKER = "deft hook:dispatch";
 export declare const AGENT_HOOK_PATHS: readonly [".claude/settings.json", ".grok/hooks/deft.json", ".cursor/hooks.json", ".codex/hooks.json"];
 export type AgentHookPath = (typeof AGENT_HOOK_PATHS)[number];
 export type AgentHookRegistrationStatus = "healthy" | "missing" | "drifted";
+/** Whether the host receives a compact/resume hook deposit (#2113). */
+export type AgentHookCompactSupport = "deposited" | "unsupported";
 export interface AgentHookInspection {
     readonly host: HookHost;
     readonly path: AgentHookPath;
     readonly status: AgentHookRegistrationStatus;
     readonly detail: string;
+    readonly compactSupport: AgentHookCompactSupport;
 }
 export interface AgentHookDepositResult {
     readonly changed: boolean;

package/dist/init-deposit/agent-hooks.js

@@ -1,8 +1,8 @@
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { assertDepositContained } from "../deposit/contain.js";
-import { DIRECT_WRITE_TOOL_NAMES } from "../hooks/tools.js";
-export const DIRECT_WRITE_HOOK_MATCHER = DIRECT_WRITE_TOOL_NAMES.join("|");
+import { DIRECT_WRITE_HOOK_MATCHER, SPAWN_HOOK_MATCHER } from "../hooks/tools.js";
+export { DIRECT_WRITE_HOOK_MATCHER, SPAWN_HOOK_MATCHER } from "../hooks/tools.js";
 export const DEFT_HOOK_COMMAND_MARKER = "deft hook:dispatch";
 export const AGENT_HOOK_PATHS = [
     ".claude/settings.json",
@@ -67,9 +67,9 @@ function isManagedCursorEntry(value) {
     const entry = object(value);
     return typeof entry?.command === "string" && entry.command.includes(DEFT_HOOK_COMMAND_MARKER);
 }
-function nestedGroup(host, event) {
+function nestedGroup(host, event, matcher) {
     return {
-        ...(event === "tool.before" ? { matcher: DIRECT_WRITE_HOOK_MATCHER } : {}),
+        ...(event === "tool.before" && matcher !== undefined ? { matcher } : {}),
         hooks: [
             {
                 type: "command",
@@ -79,18 +79,29 @@ function nestedGroup(host, event) {
         ],
     };
 }
-function mergeNestedConfig(config, path, host) {
+function mergeNestedConfig(config, path, host, options = {}) {
     const hooks = hooksObject(config, path);
     const session = eventArray(hooks, "SessionStart", path).filter((entry) => !isManagedNestedGroup(entry));
     const preTool = eventArray(hooks, "PreToolUse", path).filter((entry) => !isManagedNestedGroup(entry));
     hooks.SessionStart = [...session, nestedGroup(host, "session.start")];
-    hooks.PreToolUse = [...preTool, nestedGroup(host, "tool.before")];
+    hooks.PreToolUse = [
+        ...preTool,
+        nestedGroup(host, "tool.before", DIRECT_WRITE_HOOK_MATCHER),
+        nestedGroup(host, "tool.before", SPAWN_HOOK_MATCHER),
+    ];
+    if (options.compact) {
+        const preCompact = eventArray(hooks, "PreCompact", path).filter((entry) => !isManagedNestedGroup(entry));
+        const postCompact = eventArray(hooks, "PostCompact", path).filter((entry) => !isManagedNestedGroup(entry));
+        hooks.PreCompact = [...preCompact, nestedGroup(host, "session.compact")];
+        hooks.PostCompact = [...postCompact, nestedGroup(host, "session.compact")];
+    }
     return { ...config, hooks };
 }
 function mergeCursorConfig(config, path) {
     const hooks = hooksObject(config, path);
     const session = eventArray(hooks, "sessionStart", path).filter((entry) => !isManagedCursorEntry(entry));
     const preTool = eventArray(hooks, "preToolUse", path).filter((entry) => !isManagedCursorEntry(entry));
+    const preCompact = eventArray(hooks, "preCompact", path).filter((entry) => !isManagedCursorEntry(entry));
     hooks.sessionStart = [...session, { command: command("cursor", "session.start"), timeout: 5 }];
     hooks.preToolUse = [
         ...preTool,
@@ -100,7 +111,14 @@ function mergeCursorConfig(config, path) {
             failClosed: true,
             timeout: 5,
         },
+        {
+            command: command("cursor", "tool.before"),
+            matcher: SPAWN_HOOK_MATCHER,
+            failClosed: true,
+            timeout: 5,
+        },
     ];
+    hooks.preCompact = [...preCompact, { command: command("cursor", "session.compact"), timeout: 5 }];
     return { ...config, version: 1, hooks };
 }
 function writeJsonIfChanged(path, payload) {
@@ -119,16 +137,16 @@ export function writeAgentHookDeposit(projectRoot, io = { printf: () => undefine
     const definitions = [
         {
             path: AGENT_HOOK_PATHS[0],
-            merge: (config, path) => mergeNestedConfig(config, path, "claude"),
+            merge: (config, path) => mergeNestedConfig(config, path, "claude", { compact: true }),
         },
         {
             path: AGENT_HOOK_PATHS[1],
-            merge: (config, path) => mergeNestedConfig(config, path, "grok"),
+            merge: (config, path) => mergeNestedConfig(config, path, "grok", { compact: true }),
         },
         { path: AGENT_HOOK_PATHS[2], merge: mergeCursorConfig },
         {
             path: AGENT_HOOK_PATHS[3],
-            merge: (config, path) => mergeNestedConfig(config, path, "codex"),
+            merge: (config, path) => mergeNestedConfig(config, path, "codex", { compact: false }),
         },
     ];
     const prepared = definitions.map((definition) => {
@@ -150,7 +168,7 @@ export function writeAgentHookDeposit(projectRoot, io = { printf: () => undefine
     }
     return { changed: changedPaths.length > 0, changedPaths };
 }
-function hasNestedRegistration(config, host) {
+function hasNestedRegistration(config, host, options = {}) {
     const hooks = object(config.hooks);
     if (hooks === null)
         return false;
@@ -158,11 +176,24 @@ function hasNestedRegistration(config, host) {
     const preTool = Array.isArray(hooks.PreToolUse) ? hooks.PreToolUse : [];
     const sessionCommand = command(host, "session.start");
     const toolCommand = command(host, "tool.before");
-    return (session.some((entry) => nestedCommands(entry).includes(sessionCommand)) &&
+    const compactCommand = command(host, "session.compact");
+    const base = session.some((entry) => nestedCommands(entry).includes(sessionCommand)) &&
         preTool.some((entry) => {
             const group = object(entry);
             return (group?.matcher === DIRECT_WRITE_HOOK_MATCHER && nestedCommands(entry).includes(toolCommand));
-        }));
+        }) &&
+        preTool.some((entry) => {
+            const group = object(entry);
+            return group?.matcher === SPAWN_HOOK_MATCHER && nestedCommands(entry).includes(toolCommand);
+        });
+    if (!base)
+        return false;
+    if (!options.compact)
+        return true;
+    const preCompact = Array.isArray(hooks.PreCompact) ? hooks.PreCompact : [];
+    const postCompact = Array.isArray(hooks.PostCompact) ? hooks.PostCompact : [];
+    return (preCompact.some((entry) => nestedCommands(entry).includes(compactCommand)) &&
+        postCompact.some((entry) => nestedCommands(entry).includes(compactCommand)));
 }
 function hasCursorRegistration(config) {
     const hooks = object(config.hooks);
@@ -170,13 +201,21 @@ function hasCursorRegistration(config) {
         return false;
     const session = Array.isArray(hooks.sessionStart) ? hooks.sessionStart : [];
     const preTool = Array.isArray(hooks.preToolUse) ? hooks.preToolUse : [];
+    const preCompact = Array.isArray(hooks.preCompact) ? hooks.preCompact : [];
     return (session.some((entry) => object(entry)?.command === command("cursor", "session.start")) &&
         preTool.some((entry) => {
             const hook = object(entry);
             return (hook?.command === command("cursor", "tool.before") &&
                 hook.matcher === DIRECT_WRITE_HOOK_MATCHER &&
                 hook.failClosed === true);
-        }));
+        }) &&
+        preTool.some((entry) => {
+            const hook = object(entry);
+            return (hook?.command === command("cursor", "tool.before") &&
+                hook.matcher === SPAWN_HOOK_MATCHER &&
+                hook.failClosed === true);
+        }) &&
+        preCompact.some((entry) => object(entry)?.command === command("cursor", "session.compact")));
 }
 /** Read-only registration probe shared by verify and doctor. */
 export function inspectAgentHookDeposit(projectRoot) {
@@ -184,28 +223,40 @@ export function inspectAgentHookDeposit(projectRoot) {
         {
             host: "claude",
             path: AGENT_HOOK_PATHS[0],
-            valid: (config) => hasNestedRegistration(config, "claude"),
+            compactSupport: "deposited",
+            valid: (config) => hasNestedRegistration(config, "claude", { compact: true }),
         },
         {
             host: "grok",
             path: AGENT_HOOK_PATHS[1],
-            valid: (config) => hasNestedRegistration(config, "grok"),
+            compactSupport: "deposited",
+            valid: (config) => hasNestedRegistration(config, "grok", { compact: true }),
+        },
+        {
+            host: "cursor",
+            path: AGENT_HOOK_PATHS[2],
+            compactSupport: "deposited",
+            valid: hasCursorRegistration,
         },
-        { host: "cursor", path: AGENT_HOOK_PATHS[2], valid: hasCursorRegistration },
         {
             host: "codex",
             path: AGENT_HOOK_PATHS[3],
-            valid: (config) => hasNestedRegistration(config, "codex"),
+            compactSupport: "unsupported",
+            valid: (config) => hasNestedRegistration(config, "codex", { compact: false }),
         },
     ];
     return definitions.map((definition) => {
         const absolute = join(projectRoot, definition.path);
+        const compactNote = definition.compactSupport === "unsupported"
+            ? " Compact re-arm is not deposited for Codex (no native compact hook surface)."
+            : " PreCompact/PostCompact or preCompact compact re-arm is deposited.";
         if (!existsSync(absolute)) {
             return {
                 host: definition.host,
                 path: definition.path,
                 status: "missing",
-                detail: `${definition.path} is missing.`,
+                compactSupport: definition.compactSupport,
+                detail: `${definition.path} is missing.${compactNote}`,
             };
         }
         try {
@@ -215,14 +266,18 @@ export function inspectAgentHookDeposit(projectRoot) {
                     host: definition.host,
                     path: definition.path,
                     status: "healthy",
-                    detail: "SessionStart and direct-write PreToolUse registrations are current.",
+                    compactSupport: definition.compactSupport,
+                    detail: "SessionStart, direct-write + spawn PreToolUse, and compact re-arm registrations are current." +
+                        (definition.compactSupport === "unsupported" ? compactNote : ""),
                 };
             }
             return {
                 host: definition.host,
                 path: definition.path,
                 status: "drifted",
-                detail: "Directive SessionStart or direct-write PreToolUse registration is missing/drifted.",
+                compactSupport: definition.compactSupport,
+                detail: "Directive SessionStart, direct-write/spawn PreToolUse, or compact re-arm registration is missing/drifted." +
+                    compactNote,
             };
         }
         catch (cause) {
@@ -230,7 +285,8 @@ export function inspectAgentHookDeposit(projectRoot) {
                 host: definition.host,
                 path: definition.path,
                 status: "drifted",
-                detail: String(cause),
+                compactSupport: definition.compactSupport,
+                detail: `${String(cause)}${compactNote}`,
             };
         }
     });

package/dist/policy/index.d.ts

@@ -5,7 +5,10 @@ export * from "./decisions.js";
 export * from "./disclosure.js";
 export * from "./plan-extensions.js";
 export * from "./policy-invocation.js";
+export * from "./product-signal.js";
 export * from "./resolve.js";
+export * from "./runtime-authority.js";
+export * from "./staleness-tickler.js";
 export * from "./value-feedback.js";
 export * from "./wip.js";
 export declare const FIELD_ALLOW_DIRECT_COMMITS = "plan.policy.allowDirectCommitsToMaster";

package/dist/policy/index.js

@@ -1,5 +1,8 @@
 import { readPlanPolicy } from "./plan-extensions.js";
+import { FIELD_PRODUCT_SIGNAL, FIELD_PRODUCT_SIGNAL_CLI_ALIAS, inspectProductSignal, } from "./product-signal.js";
 import { coerceLegacyNarrative, LEGACY_NARRATIVE_KEY, loadProjectDefinition } from "./resolve.js";
+import { FIELD_RUNTIME_AUTHORITY, FIELD_RUNTIME_AUTHORITY_CLI_ALIAS, inspectRuntimeAuthority, } from "./runtime-authority.js";
+import { FIELD_STALENESS_TICKLER, FIELD_STALENESS_TICKLER_CLI_ALIAS, inspectStalenessTickler, } from "./staleness-tickler.js";
 import { FIELD_VALUE_FEEDBACK, FIELD_VALUE_FEEDBACK_CLI_ALIAS, inspectValueFeedback, } from "./value-feedback.js";
 import { DEFAULT_WIP_CAP } from "./wip.js";
 export * from "./agents-md-advisory.js";
@@ -9,7 +12,10 @@ export * from "./decisions.js";
 export * from "./disclosure.js";
 export * from "./plan-extensions.js";
 export * from "./policy-invocation.js";
+export * from "./product-signal.js";
 export * from "./resolve.js";
+export * from "./runtime-authority.js";
+export * from "./staleness-tickler.js";
 export * from "./value-feedback.js";
 export * from "./wip.js";
 export const FIELD_ALLOW_DIRECT_COMMITS = "plan.policy.allowDirectCommitsToMaster";
@@ -216,6 +222,15 @@ function inspectSwarmSubagentBackend(data) {
         source: "default-on-error",
     };
 }
+function inspectProductSignalField(data, projectRoot) {
+    const field = inspectProductSignal(data, projectRoot);
+    return {
+        name: field.name,
+        current: field.current,
+        default: field.default,
+        source: field.source,
+    };
+}
 function inspectValueFeedbackField(data, projectRoot) {
     const field = inspectValueFeedback(data, projectRoot);
     return {
@@ -225,6 +240,24 @@ function inspectValueFeedbackField(data, projectRoot) {
         source: field.source,
     };
 }
+function inspectStalenessTicklerField(data) {
+    const field = inspectStalenessTickler(data);
+    return {
+        name: field.name,
+        current: field.current,
+        default: field.default,
+        source: field.source,
+    };
+}
+function inspectRuntimeAuthorityField(data) {
+    const field = inspectRuntimeAuthority(data);
+    return {
+        name: field.name,
+        current: field.current,
+        default: field.default,
+        source: field.source,
+    };
+}
 const REGISTERED_POLICIES = [
     inspectAllowDirectCommits,
     inspectWipCap,
@@ -237,6 +270,9 @@ const REGISTERED_POLICIES = [
         emptyIsTyped: true,
     }),
     inspectSwarmSubagentBackend,
+    inspectStalenessTicklerField,
+    inspectRuntimeAuthorityField,
+    inspectProductSignalField,
     inspectValueFeedbackField,
 ];
 /** Walk registered inspectors and return one row per field (#1148). */
@@ -246,7 +282,15 @@ export function inspectAllPolicies(projectRoot) {
 }
 /** Look up a single registered field by canonical dotted-path name (or CLI alias). */
 export function inspectOnePolicy(name, projectRoot) {
-    const normalized = name === FIELD_VALUE_FEEDBACK_CLI_ALIAS ? FIELD_VALUE_FEEDBACK : name;
+    const normalized = name === FIELD_VALUE_FEEDBACK_CLI_ALIAS
+        ? FIELD_VALUE_FEEDBACK
+        : name === FIELD_PRODUCT_SIGNAL_CLI_ALIAS
+            ? FIELD_PRODUCT_SIGNAL
+            : name === FIELD_STALENESS_TICKLER_CLI_ALIAS
+                ? FIELD_STALENESS_TICKLER
+                : name === FIELD_RUNTIME_AUTHORITY_CLI_ALIAS
+                    ? FIELD_RUNTIME_AUTHORITY
+                    : name;
     for (const field of inspectAllPolicies(projectRoot)) {
         if (field.name === normalized)
             return field;

package/dist/policy/product-signal.d.ts

@@ -0,0 +1,45 @@
+/** Canonical registered policy field name (#2693). */
+export declare const FIELD_PRODUCT_SIGNAL = "plan.policy.productSignal";
+/** Short alias for `policy:show --field=productSignal`. */
+export declare const FIELD_PRODUCT_SIGNAL_CLI_ALIAS = "productSignal";
+export declare const DEFAULT_PRODUCT_SIGNAL_ENABLED = false;
+/** Baked-in default private sink (#2693 D6). */
+export declare const DEFAULT_PRODUCT_SIGNAL_SINK_REPO = "deftai/product-signal";
+export interface ProductSignalConfig {
+    readonly enabled: boolean;
+    readonly sinkRepo: string;
+}
+export type ProductSignalSource = "typed" | "default" | "default-on-error";
+export interface ProductSignalResolved extends ProductSignalConfig {
+    readonly source: ProductSignalSource;
+    readonly error: string | null;
+}
+export declare const PRODUCT_SIGNAL_CAPABILITY_COST_DISCLOSURE: string;
+/** Validate a `plan.policy.productSignal` payload. */
+export declare function validateProductSignal(value: unknown): string[];
+/** Resolve `plan.policy.productSignal` from PROJECT-DEFINITION (#2693). */
+export declare function resolveProductSignal(projectRoot: string): ProductSignalResolved;
+/** Human-readable status line for CLI surfaces. */
+export declare function formatProductSignalStatusLine(policy: ProductSignalResolved): string;
+export interface ProductSignalPolicyField {
+    readonly name: typeof FIELD_PRODUCT_SIGNAL;
+    readonly current: ProductSignalConfig;
+    readonly default: ProductSignalConfig;
+    readonly source: string;
+}
+/** Inspector row for `policy:show --field=productSignal`. */
+export declare function inspectProductSignal(data: Record<string, unknown> | null, projectRoot?: string): ProductSignalPolicyField;
+export interface EnableProductSignalOptions {
+    readonly confirm: boolean;
+    readonly actor?: string;
+    readonly note?: string;
+    readonly sinkRepo?: string;
+}
+export interface EnableProductSignalResult {
+    readonly exitCode: 0 | 1 | 2;
+    readonly stdout: string;
+    readonly changed: boolean;
+}
+/** Persist `productSignal.enabled=true` after capability-cost disclosure (#2693). */
+export declare function enableProductSignal(projectRoot: string, options: EnableProductSignalOptions): EnableProductSignalResult;
+//# sourceMappingURL=product-signal.d.ts.map

package/dist/policy/product-signal.js

@@ -0,0 +1,210 @@
+import { readFileSync } from "node:fs";
+import { atomicWriteProjectDefinition, projectDefinitionMutationLock, } from "../vbrief-build/project-definition-io.js";
+import { migrateLegacyPolicyKey, PLAN_POLICY_KEY, readPlanPolicy } from "./plan-extensions.js";
+import { policyColonInvocation } from "./policy-invocation.js";
+import { appendAuditLog, loadProjectDefinition, projectDefinitionPath } from "./resolve.js";
+/** Canonical registered policy field name (#2693). */
+export const FIELD_PRODUCT_SIGNAL = "plan.policy.productSignal";
+/** Short alias for `policy:show --field=productSignal`. */
+export const FIELD_PRODUCT_SIGNAL_CLI_ALIAS = "productSignal";
+export const DEFAULT_PRODUCT_SIGNAL_ENABLED = false;
+/** Baked-in default private sink (#2693 D6). */
+export const DEFAULT_PRODUCT_SIGNAL_SINK_REPO = "deftai/product-signal";
+export const PRODUCT_SIGNAL_CAPABILITY_COST_DISCLOSURE = "\u26a0 Capability-cost disclosure -- enabling product signal opts into " +
+    "consented qualitative check-ins that may submit minimized local summaries " +
+    "to a private GitHub sink when you also grant install-level consent.\n" +
+    "  \u2022 Default OFF; no ambient consent nag while disabled.\n" +
+    "  \u2022 Outbound requires enable + recorded consent (`product-signal:consent`).\n" +
+    "  \u2022 Payloads include install context and windowed value/health/helped summaries " +
+    "(not raw ledgers or chat).\n" +
+    "  \u2022 Inspect: `" +
+    policyColonInvocation("show", " --field=productSignal") +
+    "` and `task product-signal:status`.\n" +
+    "  \u2022 Reversible: set `enabled: false` or revoke consent.\n" +
+    "  \u2022 Changes are recorded to meta/policy-changes.log for auditability.";
+function defaultResolved(source, error = null) {
+    return {
+        enabled: DEFAULT_PRODUCT_SIGNAL_ENABLED,
+        sinkRepo: DEFAULT_PRODUCT_SIGNAL_SINK_REPO,
+        source,
+        error,
+    };
+}
+/** Validate a `plan.policy.productSignal` payload. */
+export function validateProductSignal(value) {
+    if (value === null || value === undefined) {
+        return [];
+    }
+    if (typeof value !== "object" || Array.isArray(value)) {
+        return [`${FIELD_PRODUCT_SIGNAL} must be an object; got ${typeof value}`];
+    }
+    const rec = value;
+    const errors = [];
+    if ("enabled" in rec && typeof rec.enabled !== "boolean") {
+        errors.push(`${FIELD_PRODUCT_SIGNAL}.enabled must be a boolean`);
+    }
+    if ("sinkRepo" in rec && typeof rec.sinkRepo !== "string") {
+        errors.push(`${FIELD_PRODUCT_SIGNAL}.sinkRepo must be a string`);
+    }
+    return errors;
+}
+function resolveFromPolicyBlock(raw) {
+    const errors = validateProductSignal(raw);
+    if (errors.length > 0) {
+        return defaultResolved("default-on-error", errors[0] ?? "invalid productSignal block");
+    }
+    if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+        return defaultResolved("default");
+    }
+    const block = raw;
+    const enabled = typeof block.enabled === "boolean" ? block.enabled : DEFAULT_PRODUCT_SIGNAL_ENABLED;
+    const sinkRepo = typeof block.sinkRepo === "string" && block.sinkRepo.trim().length > 0
+        ? block.sinkRepo.trim()
+        : DEFAULT_PRODUCT_SIGNAL_SINK_REPO;
+    return {
+        enabled,
+        sinkRepo,
+        source: "typed",
+        error: null,
+    };
+}
+/** Resolve `plan.policy.productSignal` from PROJECT-DEFINITION (#2693). */
+export function resolveProductSignal(projectRoot) {
+    const [data, err] = loadProjectDefinition(projectRoot);
+    if (data === null) {
+        return defaultResolved("default-on-error", err);
+    }
+    const policyBlock = readPlanPolicy(data.plan);
+    if (typeof policyBlock !== "object" ||
+        policyBlock === null ||
+        Array.isArray(policyBlock) ||
+        !("productSignal" in policyBlock)) {
+        return defaultResolved("default");
+    }
+    return resolveFromPolicyBlock(policyBlock.productSignal);
+}
+/** Human-readable status line for CLI surfaces. */
+export function formatProductSignalStatusLine(policy) {
+    return (`[deft policy] productSignal enabled=${String(policy.enabled)} ` +
+        `sinkRepo=${policy.sinkRepo}.`);
+}
+function fieldFromResolved(resolved) {
+    return {
+        name: FIELD_PRODUCT_SIGNAL,
+        current: {
+            enabled: resolved.enabled,
+            sinkRepo: resolved.sinkRepo,
+        },
+        default: {
+            enabled: DEFAULT_PRODUCT_SIGNAL_ENABLED,
+            sinkRepo: DEFAULT_PRODUCT_SIGNAL_SINK_REPO,
+        },
+        source: resolved.source,
+    };
+}
+/** Inspector row for `policy:show --field=productSignal`. */
+export function inspectProductSignal(data, projectRoot) {
+    if (data === null) {
+        return fieldFromResolved(defaultResolved("default"));
+    }
+    const policyBlock = readPlanPolicy(data.plan);
+    if (typeof policyBlock !== "object" ||
+        policyBlock === null ||
+        Array.isArray(policyBlock) ||
+        !("productSignal" in policyBlock)) {
+        if (projectRoot !== undefined) {
+            return fieldFromResolved(resolveProductSignal(projectRoot));
+        }
+        return fieldFromResolved(defaultResolved("default"));
+    }
+    return fieldFromResolved(resolveFromPolicyBlock(policyBlock.productSignal));
+}
+/** Persist `productSignal.enabled=true` after capability-cost disclosure (#2693). */
+export function enableProductSignal(projectRoot, options) {
+    if (!options.confirm) {
+        return {
+            exitCode: 1,
+            stdout: `${PRODUCT_SIGNAL_CAPABILITY_COST_DISCLOSURE}\n\n` +
+                `Re-run with --confirm to apply: task product-signal:enable -- --confirm\n`,
+            changed: false,
+        };
+    }
+    const path = projectDefinitionPath(projectRoot);
+    try {
+        const { changed } = projectDefinitionMutationLock(projectRoot, () => {
+            const parsed = JSON.parse(readFileSync(path, { encoding: "utf8" }));
+            if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+                throw new Error(`PROJECT-DEFINITION at ${path} top-level value is not a JSON object`);
+            }
+            const data = parsed;
+            if (typeof data.plan !== "object" || data.plan === null || Array.isArray(data.plan)) {
+                if (data.plan === undefined) {
+                    data.plan = {};
+                }
+                else {
+                    throw new Error("PROJECT-DEFINITION 'plan' is not an object");
+                }
+            }
+            const plan = data.plan;
+            migrateLegacyPolicyKey(plan);
+            const existingPolicy = plan[PLAN_POLICY_KEY];
+            if (typeof existingPolicy !== "object" ||
+                existingPolicy === null ||
+                Array.isArray(existingPolicy)) {
+                if (existingPolicy === undefined) {
+                    plan[PLAN_POLICY_KEY] = {};
+                }
+                else {
+                    throw new Error("plan.policy is not an object");
+                }
+            }
+            const policyBlock = plan[PLAN_POLICY_KEY];
+            const previous = policyBlock.productSignal;
+            const prevObj = typeof previous === "object" && previous !== null && !Array.isArray(previous)
+                ? previous
+                : {};
+            const sinkRepo = options.sinkRepo?.trim() ||
+                (typeof prevObj.sinkRepo === "string" && prevObj.sinkRepo.trim().length > 0
+                    ? prevObj.sinkRepo.trim()
+                    : DEFAULT_PRODUCT_SIGNAL_SINK_REPO);
+            const nextBlock = { enabled: true, sinkRepo };
+            const previousNormalized = resolveFromPolicyBlock(previous);
+            const changedFlag = previousNormalized.enabled !== nextBlock.enabled ||
+                previousNormalized.sinkRepo !== nextBlock.sinkRepo;
+            policyBlock.productSignal = nextBlock;
+            if (changedFlag) {
+                atomicWriteProjectDefinition(path, data);
+            }
+            const actor = options.actor ?? "task product-signal:enable";
+            const note = options.note ?? "";
+            const parts = [
+                `actor=${actor}`,
+                "productSignal.enabled=true",
+                `sinkRepo=${sinkRepo}`,
+                `previous=${JSON.stringify(previous ?? null)}`,
+            ];
+            if (note) {
+                parts.push(`note=${note.replace(/\n/g, " ").replace(/\r/g, " ")}`);
+            }
+            appendAuditLog(projectRoot, parts.join(" "));
+            return { changed: changedFlag };
+        });
+        const resolved = resolveProductSignal(projectRoot);
+        const lines = [
+            `\u2713 ${FIELD_PRODUCT_SIGNAL}.enabled=true (product-signal ON).`,
+            changed
+                ? "  audit: meta/policy-changes.log updated."
+                : "  no-op: value already matched (audit entry still appended for trail).",
+            formatProductSignalStatusLine(resolved),
+        ];
+        return { exitCode: 0, stdout: `${lines.join("\n")}\n`, changed };
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (message.includes("PROJECT-DEFINITION not found")) {
+            return { exitCode: 2, stdout: `\u274c ${message}\n`, changed: false };
+        }
+        return { exitCode: 2, stdout: `\u274c Config error: ${message}\n`, changed: false };
+    }
+}
+//# sourceMappingURL=product-signal.js.map

package/dist/policy/runtime-authority.d.ts

@@ -0,0 +1,54 @@
+export declare const FIELD_RUNTIME_AUTHORITY = "plan.policy.runtimeAuthority";
+export declare const FIELD_RUNTIME_AUTHORITY_CLI_ALIAS = "runtimeAuthority";
+/** Graduated permission scopes (#1394 steipete ladder). */
+export interface RuntimeAuthorityScopes {
+    /** Direct edit/write tools (PreToolUse classifiable today). */
+    readonly edits: boolean;
+    /** git push / tag push — enforced only when Shell payload is classifiable (host gap). */
+    readonly push: boolean;
+    /** merge / close / release — enforced only when Shell payload is classifiable (host gap). */
+    readonly merge: boolean;
+}
+export interface RuntimeAuthorityPolicy {
+    readonly enabled: boolean;
+    /** When non-empty, write targets must match at least one pattern. Empty = allow all paths. */
+    readonly allowPaths: readonly string[];
+    /** Deny wins over allow. */
+    readonly denyPaths: readonly string[];
+    readonly scopes: RuntimeAuthorityScopes;
+}
+export declare const DEFAULT_RUNTIME_AUTHORITY_SCOPES: RuntimeAuthorityScopes;
+/** Safe default: opt-in only — existing consumers see no runtime authority until enabled. */
+export declare const DEFAULT_RUNTIME_AUTHORITY_POLICY: RuntimeAuthorityPolicy;
+export interface RuntimeAuthorityPolicyField {
+    readonly name: string;
+    readonly current: RuntimeAuthorityPolicy;
+    readonly default: RuntimeAuthorityPolicy;
+    readonly source: string;
+}
+export declare function resolveRuntimeAuthorityPolicy(raw: unknown): RuntimeAuthorityPolicy;
+export declare function validateRuntimeAuthority(value: unknown): string[];
+/** Inspector row for `policy:show --field=runtimeAuthority`. */
+export declare function inspectRuntimeAuthority(data: Record<string, unknown> | null): RuntimeAuthorityPolicyField;
+/** Resolve typed runtime authority policy from PROJECT-DEFINITION. */
+export declare function loadRuntimeAuthorityPolicy(data: Record<string, unknown> | null): RuntimeAuthorityPolicy;
+/** Load runtime authority from a project root (PROJECT-DEFINITION on disk). */
+export declare function loadRuntimeAuthorityFromProject(projectRoot: string): RuntimeAuthorityPolicy;
+export type RuntimeAuthorityPathVerdict = "allow" | "deny-allowlist" | "deny-denylist";
+/** Evaluate a project-relative POSIX path against allow/deny globs. */
+export declare function evaluateRuntimeAuthorityPath(policy: RuntimeAuthorityPolicy, relPathPosix: string): RuntimeAuthorityPathVerdict;
+export interface RuntimeAuthorityDirectWriteInput {
+    readonly policy: RuntimeAuthorityPolicy;
+    readonly relPathPosix: string | null;
+}
+export interface RuntimeAuthorityDirectWriteResult {
+    readonly allowed: boolean;
+    readonly reason: string | null;
+    readonly code: "runtime-policy-deny-scope" | "runtime-policy-deny-path" | null;
+}
+/**
+ * Evaluate direct-write runtime authority after ritual/scope gates (#1394).
+ * Unclassifiable paths (null) pass — host gap documented for Shell/MCP.
+ */
+export declare function evaluateRuntimeAuthorityDirectWrite(input: RuntimeAuthorityDirectWriteInput): RuntimeAuthorityDirectWriteResult;
+//# sourceMappingURL=runtime-authority.d.ts.map