@deftai/directive-core 0.82.0 → 0.84.0

package/dist/product-signal/consent.js

@@ -1,10 +1,13 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
+import { DEFAULT_PRODUCT_SIGNAL_SINK_REPO } from "../policy/product-signal.js";
 import { platformUserConfigDir } from "../user-config/resolve-user-md.js";
 export const PRODUCT_SIGNAL_CONSENT_FILENAME = "product-signal-consent.json";
-/** Consent record schema version (#2693 D2). */
-export const PRODUCT_SIGNAL_CONSENT_VERSION = 1;
+/** Consent record schema version (#2693 D2, #2767 v2 sink binding). */
+export const PRODUCT_SIGNAL_CONSENT_VERSION = 2;
+/** Legacy consent schema — authorizes default sink only (#2767). */
+const PRODUCT_SIGNAL_CONSENT_VERSION_V1 = 1;
 /** Phase-1 consent tier permitting qualitative outbound (#2693 D2). */
 export const PRODUCT_SIGNAL_CONSENT_TIER = "product-signal";
 function resolveHomeDirForConsent(options) {
@@ -32,25 +35,76 @@ export function resolveProductSignalConsentPath(options = {}) {
     const homeDir = resolveHomeDirForConsent(options);
     return join(platformUserConfigDir(platform, env, homeDir), PRODUCT_SIGNAL_CONSENT_FILENAME);
 }
+/** Normalize sinkRepo to lowercase owner/repo (#2767). */
+export function normalizeProductSignalSinkRepo(raw) {
+    const sink = raw.trim().replace(/^https?:\/\/github\.com\//i, "");
+    return sink.replace(/\/+$/, "").toLowerCase();
+}
 function parseConsentRecord(raw) {
     if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
         return null;
     }
     const rec = raw;
-    if (typeof rec.consentVersion !== "number" || typeof rec.grantedAt !== "string") {
+    if (typeof rec.consentVersion !== "number" ||
+        typeof rec.grantedAt !== "string" ||
+        typeof rec.tier !== "string") {
         return null;
     }
-    if (typeof rec.tier !== "string") {
+    const revokedAt = typeof rec.revokedAt === "string" ? rec.revokedAt : undefined;
+    let sinkRepo;
+    if (rec.consentVersion >= PRODUCT_SIGNAL_CONSENT_VERSION) {
+        if (typeof rec.sinkRepo !== "string" || rec.sinkRepo.trim().length === 0) {
+            return null;
+        }
+        sinkRepo = normalizeProductSignalSinkRepo(rec.sinkRepo);
+        if (sinkRepo.length === 0) {
+            return null;
+        }
+    }
+    else if (rec.consentVersion !== PRODUCT_SIGNAL_CONSENT_VERSION_V1) {
         return null;
     }
-    const revokedAt = typeof rec.revokedAt === "string" ? rec.revokedAt : undefined;
     return {
         consentVersion: rec.consentVersion,
         grantedAt: rec.grantedAt,
         tier: rec.tier,
+        sinkRepo,
         revokedAt,
     };
 }
+/** Resolve the sink authorized by a consent record (#2767). */
+export function resolveConsentedProductSignalSink(consent) {
+    if (consent === null) {
+        return null;
+    }
+    if (consent.consentVersion >= PRODUCT_SIGNAL_CONSENT_VERSION) {
+        return consent.sinkRepo ?? null;
+    }
+    if (consent.consentVersion === PRODUCT_SIGNAL_CONSENT_VERSION_V1) {
+        return normalizeProductSignalSinkRepo(DEFAULT_PRODUCT_SIGNAL_SINK_REPO);
+    }
+    return null;
+}
+/** Authorize configured sink against install consent (#2767). */
+export function authorizeProductSignalSink(configuredSink, consent) {
+    const configured = normalizeProductSignalSinkRepo(configuredSink);
+    const consented = resolveConsentedProductSignalSink(consent);
+    const sinksMatch = consented !== null && configured === consented;
+    let message = "sink authorized";
+    if (!sinksMatch) {
+        message =
+            consented === null
+                ? "product-signal requires consent (`task product-signal:consent -- --grant`)."
+                : `product-signal skipped (sink-unconsented): configured sink=${configured} does not match consented sink=${consented}. Re-run \`task product-signal:consent -- --grant\` after confirming the destination.`;
+    }
+    return {
+        authorized: sinksMatch,
+        configuredSink: configured,
+        consentedSink: consented,
+        sinksMatch,
+        message,
+    };
+}
 /** Read consent file; returns null when absent, invalid, or revoked. */
 export function readProductSignalConsent(options = {}) {
     const path = resolveProductSignalConsentPath(options);
@@ -76,13 +130,16 @@ export function readProductSignalConsent(options = {}) {
 export function isProductSignalConsented(options = {}) {
     return readProductSignalConsent(options) !== null;
 }
-/** Write a fresh consent grant (#2693 D17 yes path). */
+/** Write a fresh consent grant (#2693 D17 yes path, #2767 v2 sink binding). */
 export function grantProductSignalConsent(options = {}) {
     const now = options.now ?? new Date();
+    const normalizedSink = normalizeProductSignalSinkRepo((options.sinkRepo ?? DEFAULT_PRODUCT_SIGNAL_SINK_REPO).trim());
+    const sinkRepo = normalizedSink || normalizeProductSignalSinkRepo(DEFAULT_PRODUCT_SIGNAL_SINK_REPO);
     const record = {
         consentVersion: PRODUCT_SIGNAL_CONSENT_VERSION,
         grantedAt: now.toISOString().replace(/\.\d{3}Z$/, "Z"),
         tier: PRODUCT_SIGNAL_CONSENT_TIER,
+        sinkRepo,
     };
     const path = resolveProductSignalConsentPath(options);
     mkdirSync(dirname(path), { recursive: true });

package/dist/product-signal/gates.d.ts

@@ -1,4 +1,4 @@
-export type ProductSignalOutcome = "submitted" | "dry-run" | "disabled" | "no-consent" | "no-network" | "non-interactive" | "sink-unreachable" | "sink-unauthorized" | "validation" | "error-config";
+export type ProductSignalOutcome = "submitted" | "dry-run" | "disabled" | "no-consent" | "no-network" | "non-interactive" | "sink-unconsented" | "sink-unreachable" | "sink-unauthorized" | "validation" | "error-config";
 export interface GateEvaluation {
     readonly allowed: boolean;
     readonly outcome: ProductSignalOutcome;

package/dist/product-signal/submit.d.ts

@@ -32,7 +32,11 @@ export declare function runProductSignalEnable(projectRoot: string | null, confi
     exitCode: 0 | 1 | 2;
     text: string;
 };
-export declare function runProductSignalConsent(action: "grant" | "revoke"): {
+export interface ProductSignalConsentRunOptions {
+    readonly action: "grant" | "revoke";
+    readonly projectRoot?: string | null;
+}
+export declare function runProductSignalConsent(options: ProductSignalConsentRunOptions): {
     exitCode: 0 | 1;
     text: string;
 };

package/dist/product-signal/submit.js

@@ -3,7 +3,7 @@ import { join, resolve } from "node:path";
 import { enableProductSignal, formatProductSignalStatusLine, resolveProductSignal, } from "../policy/product-signal.js";
 import { resolveProjectRoot } from "../scope/project-context.js";
 import { resolveActorName } from "./actor-name.js";
-import { grantProductSignalConsent, isProductSignalConsented, readProductSignalConsent, revokeProductSignalConsent, } from "./consent.js";
+import { authorizeProductSignalSink, grantProductSignalConsent, readProductSignalConsent, revokeProductSignalConsent, } from "./consent.js";
 import { evaluateProductSignalGates } from "./gates.js";
 import { GitHubPrivateSinkAdapter } from "./github-private-sink-adapter.js";
 import { collectInstallContext } from "./install-context.js";
@@ -105,15 +105,25 @@ export async function submitProductSignal(options) {
             payload,
         };
     }
+    const policy = resolveProductSignal(root);
+    const consent = readProductSignalConsent();
+    const sinkAuth = authorizeProductSignalSink(policy.sinkRepo, consent);
+    if (!sinkAuth.authorized) {
+        return {
+            outcome: "sink-unconsented",
+            exitCode: 0,
+            message: `${sinkAuth.message}\n`,
+            payload,
+        };
+    }
     if (options.dryRun) {
         return {
             outcome: "dry-run",
             exitCode: 0,
-            message: `[dry-run] payload valid for ${payload.surface}\n`,
+            message: `[dry-run] payload valid for ${payload.surface} (sink=${sinkAuth.configuredSink})\n`,
             payload,
         };
     }
-    const policy = resolveProductSignal(root);
     const adapter = new GitHubPrivateSinkAdapter({ sinkRepo: policy.sinkRepo });
     const result = await adapter.submit(payload, { gapText: options.gapText });
     if (result.outcome === "submitted") {
@@ -131,11 +141,13 @@ export async function submitProductSignal(options) {
 export function runProductSignalStatus(projectRoot) {
     const root = resolveProjectRoot(projectRoot ?? undefined) ?? process.cwd();
     const policy = resolveProductSignal(root);
-    const consented = isProductSignalConsented();
+    const consent = readProductSignalConsent();
+    const configuredSink = policy.sinkRepo;
+    const sinkAuth = authorizeProductSignalSink(configuredSink, consent);
     const last = readLastSubmitSummary(root);
     const lines = [
         formatProductSignalStatusLine(policy),
-        `[deft product-signal] consented=${String(consented)}`,
+        `[deft product-signal] consented=${String(consent !== null)} configuredSink=${configuredSink} consentedSink=${sinkAuth.consentedSink ?? "none"} sinksMatch=${String(sinkAuth.sinksMatch)}`,
         last ? `[deft product-signal] ${last}` : "[deft product-signal] last submit: none",
     ];
     return { exitCode: 0, text: `${lines.join("\n")}\n` };
@@ -148,12 +160,15 @@ export function runProductSignalEnable(projectRoot, confirm) {
     const result = enableProductSignal(root, { confirm });
     return { exitCode: result.exitCode, text: result.stdout };
 }
-export function runProductSignalConsent(action) {
-    if (action === "grant") {
-        const record = grantProductSignalConsent();
+export function runProductSignalConsent(options) {
+    if (options.action === "grant") {
+        const root = resolveProjectRoot(options.projectRoot ?? undefined);
+        const sinkRepo = root !== null ? resolveProductSignal(root).sinkRepo : undefined;
+        const record = grantProductSignalConsent({ sinkRepo });
         return {
             exitCode: 0,
-            text: `product-signal consent granted (tier=${record.tier}, version=${record.consentVersion}).\n`,
+            text: `product-signal consent granted (tier=${record.tier}, version=${record.consentVersion}, ` +
+                `sinkRepo=${record.sinkRepo ?? "unknown"}).\n`,
         };
     }
     const ok = revokeProductSignalConsent();
@@ -216,24 +231,29 @@ export function parseProductSignalSubmitArgs(argv) {
     }
     return { surface, dryRun, json, projectRoot, nps };
 }
+function parseOptionalProjectRootArg(argv, fallback) {
+    const rootIdx = argv.indexOf("--project-root");
+    if (rootIdx >= 0) {
+        return argv[rootIdx + 1] ?? fallback;
+    }
+    const eqArg = argv.find((a) => a.startsWith("--project-root="));
+    if (eqArg !== undefined) {
+        return eqArg.slice("--project-root=".length) || fallback;
+    }
+    return fallback;
+}
 /** CLI module entrypoint for dispatch (#2693). */
 export async function productSignalMain(argv = process.argv.slice(2)) {
     const sub = argv[0];
     if (sub === "status") {
-        const rootIdx = argv.indexOf("--project-root");
-        const root = rootIdx >= 0
-            ? (argv[rootIdx + 1] ?? ".")
-            : (argv.find((a) => a.startsWith("--project-root="))?.split("=")[1] ?? ".");
+        const root = parseOptionalProjectRootArg(argv, ".") ?? ".";
         const result = runProductSignalStatus(root);
         process.stdout.write(result.text);
         return result.exitCode;
     }
     if (sub === "enable") {
         const confirm = argv.includes("--confirm");
-        const rootIdx = argv.indexOf("--project-root");
-        const root = rootIdx >= 0
-            ? (argv[rootIdx + 1] ?? ".")
-            : (argv.find((a) => a.startsWith("--project-root="))?.split("=")[1] ?? ".");
+        const root = parseOptionalProjectRootArg(argv, ".") ?? ".";
         const result = runProductSignalEnable(root, confirm);
         process.stdout.write(result.text);
         return result.exitCode;
@@ -245,7 +265,11 @@ export async function productSignalMain(argv = process.argv.slice(2)) {
             process.stderr.write("usage: product-signal consent -- --grant|--revoke\n");
             return 1;
         }
-        const result = runProductSignalConsent(grant ? "grant" : "revoke");
+        const root = parseOptionalProjectRootArg(argv, null);
+        const result = runProductSignalConsent({
+            action: grant ? "grant" : "revoke",
+            projectRoot: root,
+        });
         process.stdout.write(result.text);
         return result.exitCode;
     }

package/dist/scope/decompose.js

@@ -9,6 +9,7 @@
 import { accessSync, constants, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { referenceTypeMatches } from "@deftai/directive-types";
+import { assertWriteTargetSafe, ProjectionContainmentError } from "../fs/projection-containment.js";
 import { hasArtifactSuffix, LEGACY_ARTIFACT_DIR, MIGRATED_ARTIFACT_DIR, resolveLifecycleRoot, } from "../layout/resolve.js";
 import { referenceWithDefaultTrust, slugify } from "../vbrief-build/build.js";
 import { EMITTED_VBRIEF_VERSION } from "../vbrief-build/constants.js";
@@ -52,7 +53,8 @@ function loadJson(path) {
     }
     return data;
 }
-function writeJson(path, data) {
+function writeJson(projectRoot, path, data) {
+    assertWriteTargetSafe(projectRoot, path);
     mkdirSync(dirname(path), { recursive: true });
     writeFileSync(path, formatBriefJson(data), "utf8");
 }
@@ -871,7 +873,7 @@ export function applyDecomposition(opts) {
     }
     for (let i = 0; i < childPaths.length; i += 1) {
         // biome-ignore lint/style/noNonNullAssertion: loop bound ensures these exist
-        writeJson(childPaths[i].target, childDocs[i]);
+        writeJson(projectRoot, childPaths[i].target, childDocs[i]);
     }
     let parentPlan = parent.plan;
     if (parentPlan === null || parentPlan === undefined) {
@@ -911,7 +913,7 @@ export function applyDecomposition(opts) {
     planObj.references = dedupeReferences(references
         .filter((r) => typeof r === "object" && r !== null && !Array.isArray(r))
         .map((r) => r));
-    writeJson(parentPath, parent);
+    writeJson(projectRoot, parentPath, parent);
     actions.push(`UPDATE ${parentRel} references`);
     return actions;
 }
@@ -1022,6 +1024,10 @@ export function decomposeMain(argv) {
             process.stderr.write(`ERROR: ${err.message}\n`);
             return 1;
         }
+        if (err instanceof ProjectionContainmentError) {
+            process.stderr.write(`ERROR: ${err.message}\n`);
+            return 2;
+        }
         process.stderr.write(`ERROR: ${String(err)}\n`);
         return 1;
     }

package/dist/session/git.d.ts

@@ -10,5 +10,7 @@ export declare function gitHead(projectRoot: string, runGit?: GitRunner): {
     error: string | null;
 };
 export declare function worktreePath(projectRoot: string, runGit?: GitRunner): string;
+/** True when `ancestor` is reachable from `descendant` (same commit counts). */
+export declare function gitIsAncestor(projectRoot: string, ancestor: string, descendant: string, runGit?: GitRunner): boolean | null;
 export declare function detectBranch(projectRoot: string, runGit?: GitRunner): string | null;
 //# sourceMappingURL=git.d.ts.map

package/dist/session/git.js

@@ -35,6 +35,20 @@ export function worktreePath(projectRoot, runGit = defaultGitRunner) {
     }
     return resolve(projectRoot);
 }
+/** True when `ancestor` is reachable from `descendant` (same commit counts). */
+export function gitIsAncestor(projectRoot, ancestor, descendant, runGit = defaultGitRunner) {
+    if (ancestor === descendant) {
+        return true;
+    }
+    const { code } = runGit(projectRoot, ["merge-base", "--is-ancestor", ancestor, descendant]);
+    if (code === 0) {
+        return true;
+    }
+    if (code === 1) {
+        return false;
+    }
+    return null;
+}
 export function detectBranch(projectRoot, runGit = defaultGitRunner) {
     const sym = runGit(projectRoot, ["symbolic-ref", "--short", "HEAD"]);
     if (sym.code === 0 && sym.stdout.trim()) {

package/dist/session/verify-session-ritual.js

@@ -1,6 +1,6 @@
 import { existsSync } from "node:fs";
 import { formatFrameworkCommand } from "../render/framework-commands.js";
-import { defaultGitRunner, gitHead, worktreePath } from "./git.js";
+import { defaultGitRunner, gitHead, gitIsAncestor, worktreePath } from "./git.js";
 import { pythonJsonDump } from "./json.js";
 import { ENV_SESSION_POSTURE, readOnlyPostureMessage, resolveSessionPosture, ritualStateIsPostureAuthority, } from "./posture.js";
 import { defaultRitualRunner } from "./ritual-entrypoint.js";
@@ -59,6 +59,10 @@ function runGatedStep(projectRoot, payload, stepName, runner, now) {
     }
     return null;
 }
+function headDriftRecoveryMessage() {
+    return (`session ritual state is stale because git HEAD changed discontinuously. ` +
+        `Run \`${formatFrameworkCommand(["session:start"])}\` again.`);
+}
 function evaluateLoadedState(projectRoot, state, input) {
     const runGit = input.runGit ?? defaultGitRunner;
     const { head: currentHead, error: headError } = gitHead(projectRoot, runGit);
@@ -73,10 +77,22 @@ function evaluateLoadedState(projectRoot, state, input) {
         ];
     }
     if (state.gitHead !== currentHead) {
-        return [
-            1,
-            `session ritual state is stale because git HEAD changed. Run \`${formatFrameworkCommand(["session:start"])}\` again.`,
-        ];
+        const forward = gitIsAncestor(projectRoot, state.gitHead, currentHead, runGit);
+        if (forward === null) {
+            return [2, "could not verify git history for session ritual"];
+        }
+        if (!forward) {
+            return [1, headDriftRecoveryMessage()];
+        }
+        if (input.rebindForwardHead) {
+            const payload = { ...state.raw, git_head: currentHead };
+            try {
+                writeRitualState(projectRoot, payload);
+            }
+            catch (exc) {
+                return [2, `could not rebind session ritual git HEAD: ${String(exc)}`];
+            }
+        }
     }
     const staleness = resolveSessionRitualStalenessHours(projectRoot);
     if (staleness.source === "default-on-error") {
@@ -157,6 +173,7 @@ export function inspectSessionRitual(projectRoot, options = {}) {
         tier,
         now: options.now ?? new Date(),
         runGit: options.runGit,
+        rebindForwardHead: false,
     });
     return {
         code,
@@ -246,6 +263,7 @@ export function verifySessionRitual(projectRoot, options = {}) {
             tier: "quick",
             now: instant,
             runGit: options.runGit,
+            rebindForwardHead: true,
         });
         if (precheckCode !== 0) {
             return {
@@ -259,6 +277,21 @@ export function verifySessionRitual(projectRoot, options = {}) {
                 ritualStateRequired,
             };
         }
+        const reloadedAfterPrecheck = readRitualState(projectRoot);
+        state = reloadedAfterPrecheck[0];
+        err = reloadedAfterPrecheck[1];
+        if (state === null) {
+            return {
+                code: 2,
+                message: err ?? "ritual state invalid after precheck",
+                tier,
+                statePath,
+                bypassed: false,
+                wouldFailCode: null,
+                posture,
+                ritualStateRequired,
+            };
+        }
         const payload = { ...state.raw };
         const gated = { ...payload.gated_steps };
         payload.gated_steps = gated;
@@ -303,6 +336,7 @@ export function verifySessionRitual(projectRoot, options = {}) {
         tier,
         now: instant,
         runGit: options.runGit,
+        rebindForwardHead: true,
     });
     if (isBypassed) {
         return {

package/dist/swarm/routing-set-cli.js

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { PROJECTION_CONTAINMENT_REFUSED_EXIT_CODE, ProjectionContainmentError, } from "../fs/projection-containment.js";
 import { getPlatformCapabilities } from "../intake/platform-capabilities.js";
 import { EXIT_CONFIG_ERROR, EXIT_OK } from "./constants.js";
 import { dispatchProviderFromRuntime, HARNESS_BOUND_PROVIDERS, ROUTING_MODE_HARNESS_DEFAULT, ROUTING_MODE_PINNED, resolveRoutingPath, SWARM_WORKER_ROLES, writeModelDecision, } from "./routing.js";
@@ -66,11 +67,21 @@ export function routingSetMain(argv = process.argv.slice(2)) {
             "so only --harness-default is recordable here.\n");
         return EXIT_CONFIG_ERROR;
     }
-    const path = resolveRoutingPath(resolve(projectRoot));
-    writeModelDecision(path, resolvedProvider, role, {
-        model,
-        mode: harnessDefault ? ROUTING_MODE_HARNESS_DEFAULT : ROUTING_MODE_PINNED,
-    });
+    const root = resolve(projectRoot);
+    const path = resolveRoutingPath(root);
+    try {
+        writeModelDecision(root, path, resolvedProvider, role, {
+            model,
+            mode: harnessDefault ? ROUTING_MODE_HARNESS_DEFAULT : ROUTING_MODE_PINNED,
+        });
+    }
+    catch (err) {
+        if (err instanceof ProjectionContainmentError) {
+            process.stderr.write(`ERROR: ${err.message}\n`);
+            return PROJECTION_CONTAINMENT_REFUSED_EXIT_CODE;
+        }
+        throw err;
+    }
     const modelText = model ?? "<harness default>";
     process.stdout.write(`Recorded route: provider '${resolvedProvider}', role '${role}' -> model ${modelText}.\n` +
         `Route file: ${path}\n`);

package/dist/swarm/routing.d.ts

@@ -62,5 +62,5 @@ export declare function resolveDispatchProvider(environ?: NodeJS.ProcessEnv): st
  * `decidedAt` when the caller did not supply one. Used by the interactive
  * resolver path (resolver step 5) and the `swarm:routing-set` task.
  */
-export declare function writeModelDecision(path: string, provider: string, role: string, decision: RouteDecision): void;
+export declare function writeModelDecision(projectRoot: string, path: string, provider: string, role: string, decision: RouteDecision): void;
 //# sourceMappingURL=routing.d.ts.map

package/dist/swarm/routing.js

@@ -16,6 +16,7 @@
 import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
+import { assertWriteTargetSafe } from "../fs/projection-containment.js";
 /**
  * The fixed worker-role vocabulary (reused from #1531). No separate tier
  * vocabulary to start; decisions are strictly per-role.
@@ -201,9 +202,10 @@ function assertSafeRoutingKey(kind, key) {
  * `decidedAt` when the caller did not supply one. Used by the interactive
  * resolver path (resolver step 5) and the `swarm:routing-set` task.
  */
-export function writeModelDecision(path, provider, role, decision) {
+export function writeModelDecision(projectRoot, path, provider, role, decision) {
     assertSafeRoutingKey("provider", provider);
     assertSafeRoutingKey("role", role);
+    assertWriteTargetSafe(projectRoot, path);
     const { data } = loadRoutingFile(path);
     // Null-prototype write targets so a computed provider/role key can only ever
     // set an own property and can never reach `Object.prototype`, even if the

package/dist/value/readback.js

@@ -2,6 +2,7 @@ import { appendFileSync, existsSync, mkdirSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { runningInsideDeftRepo } from "../doctor/paths.js";
 import { ALL_ATTRIBUTION_EVENT_NAMES } from "../events/attribution-constants.js";
+import { assertWriteTargetSafe, ProjectionContainmentError } from "../fs/projection-containment.js";
 import { DEFAULT_EVENT_LOG, readEvents } from "../lifecycle/events.js";
 import { policyColonInvocation } from "../policy/policy-invocation.js";
 import { isValueFeedbackPathAllowed, resolveValueFeedback, } from "../policy/value-feedback.js";
@@ -229,10 +230,14 @@ function appendReadbackHistory(projectRoot, eventId, line, options = {}) {
         line,
     };
     try {
+        assertWriteTargetSafe(projectRoot, path);
         mkdirSync(join(path, ".."), { recursive: true });
         appendFileSync(path, `${JSON.stringify(record)}\n`, "utf8");
     }
-    catch {
+    catch (err) {
+        if (err instanceof ProjectionContainmentError) {
+            throw err;
+        }
         // observability only
     }
 }

package/dist/vbrief-validate/plan-hooks.d.ts

@@ -6,6 +6,8 @@ export declare function validateSessionRitualStalenessHoursOnPlan(plan: unknown,
 export declare function validateTriageRankingLabelsOnPlan(plan: unknown, filepath: string): string[];
 /** vbrief_validate hook: validate ``plan.policy.runtimeAuthority`` (#1394). */
 export declare function validateRuntimeAuthorityOnPlan(plan: unknown, filepath: string): string[];
+/** vbrief_validate hook: validate ``plan.policy.hostHooks`` (#2752). */
+export declare function validateHostHooksOnPlan(plan: unknown, filepath: string): string[];
 /** vbrief_validate hook: validate ``plan.policy.stalenessTickler`` (#2489). */
 export declare function validateStalenessTicklerOnPlan(plan: unknown, filepath: string): string[];
 /** Run all PROJECT-DEFINITION policy hooks (mirrors lazy-import block in Python). */

package/dist/vbrief-validate/plan-hooks.js

@@ -1,3 +1,4 @@
+import { validateHostHooks } from "../policy/host-hooks.js";
 import { readPlanPolicy } from "../policy/plan-extensions.js";
 import { validateRuntimeAuthority } from "../policy/runtime-authority.js";
 import { validateStalenessTickler } from "../policy/staleness-tickler.js";
@@ -121,6 +122,24 @@ export function validateRuntimeAuthorityOnPlan(plan, filepath) {
     }
     return out;
 }
+/** vbrief_validate hook: validate ``plan.policy.hostHooks`` (#2752). */
+export function validateHostHooksOnPlan(plan, filepath) {
+    if (typeof plan !== "object" || plan === null || Array.isArray(plan)) {
+        return [];
+    }
+    const policy = readPlanPolicy(plan);
+    if (typeof policy !== "object" || policy === null || Array.isArray(policy)) {
+        return [];
+    }
+    if (!("hostHooks" in policy)) {
+        return [];
+    }
+    const out = [];
+    for (const err of validateHostHooks(policy.hostHooks)) {
+        out.push(`${filepath}: ${err} (#2752)`);
+    }
+    return out;
+}
 /** vbrief_validate hook: validate ``plan.policy.stalenessTickler`` (#2489). */
 export function validateStalenessTicklerOnPlan(plan, filepath) {
     if (typeof plan !== "object" || plan === null || Array.isArray(plan)) {
@@ -191,6 +210,12 @@ export function runProjectDefinitionHooks(plan, filepath) {
     catch {
         /* hook must not break validation */
     }
+    try {
+        errors.push(...validateHostHooksOnPlan(plan, filepath));
+    }
+    catch {
+        /* hook must not break validation */
+    }
     return errors;
 }
 //# sourceMappingURL=plan-hooks.js.map

package/dist/verify-env/agent-hooks.d.ts

@@ -1,4 +1,5 @@
 import { type AgentHookInspection } from "../init-deposit/agent-hooks.js";
+import type { HostHooksPolicy } from "../policy/host-hooks.js";
 import type { OutputStream } from "./verify-hooks-installed.js";
 export interface AgentHookHealthResult {
     readonly code: 0 | 1 | 2;
@@ -7,5 +8,5 @@ export interface AgentHookHealthResult {
     readonly registrations: readonly AgentHookInspection[];
 }
 /** Read-only P0 agent-host registration health, independent of git hooks. */
-export declare function evaluateAgentHooks(projectRoot: string): AgentHookHealthResult;
+export declare function evaluateAgentHooks(projectRoot: string, hostHooksPolicy?: HostHooksPolicy): AgentHookHealthResult;
 //# sourceMappingURL=agent-hooks.d.ts.map

package/dist/verify-env/agent-hooks.js

@@ -1,6 +1,7 @@
 import { statSync } from "node:fs";
 import { resolve } from "node:path";
 import { inspectAgentHookDeposit } from "../init-deposit/agent-hooks.js";
+import { loadHostHooksPolicyFromProject } from "../policy/host-hooks.js";
 function isDirectory(path) {
     try {
         return statSync(path).isDirectory();
@@ -10,7 +11,7 @@ function isDirectory(path) {
     }
 }
 /** Read-only P0 agent-host registration health, independent of git hooks. */
-export function evaluateAgentHooks(projectRoot) {
+export function evaluateAgentHooks(projectRoot, hostHooksPolicy = loadHostHooksPolicyFromProject(projectRoot)) {
     const root = resolve(projectRoot);
     if (!isDirectory(root)) {
         return {
@@ -20,7 +21,7 @@ export function evaluateAgentHooks(projectRoot) {
             registrations: [],
         };
     }
-    const registrations = inspectAgentHookDeposit(root);
+    const registrations = inspectAgentHookDeposit(root, hostHooksPolicy);
     const unhealthy = registrations.filter((entry) => entry.status !== "healthy");
     if (unhealthy.length > 0) {
         return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive-core",
-  "version": "0.82.0",
+  "version": "0.84.0",
   "description": "TypeScript engine core for the Directive framework.",
   "type": "module",
   "main": "./dist/index.js",
@@ -86,6 +86,10 @@
       "types": "./dist/cache/index.d.ts",
       "default": "./dist/cache/index.js"
     },
+    "./cache/task-cache": {
+      "types": "./dist/cache/task-cache/index.d.ts",
+      "default": "./dist/cache/task-cache/index.js"
+    },
     "./doctor": {
       "types": "./dist/doctor/index.d.ts",
       "default": "./dist/doctor/index.js"
@@ -313,8 +317,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-content": "^0.82.0",
-    "@deftai/directive-types": "^0.82.0",
+    "@deftai/directive-content": "^0.84.0",
+    "@deftai/directive-types": "^0.84.0",
     "archiver": "^8.0.0"
   },
   "scripts": {