@deftai/directive-core 0.85.0 → 0.87.0

package/dist/policy/org-force-on-migration.js

@@ -1,6 +1,7 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { readCorePackageVersion } from "../engine-version.js";
+import { assertWriteTargetSafe } from "../fs/projection-containment.js";
 import { atomicWriteProjectDefinition, projectDefinitionMutationLock, } from "../vbrief-build/project-definition-io.js";
 import { migrateLegacyPolicyKey, PLAN_POLICY_KEY, readPlanPolicy } from "./plan-extensions.js";
 import { appendAuditLog, loadProjectDefinition, projectDefinitionPath } from "./resolve.js";
@@ -56,6 +57,7 @@ export function readOrgForceOnMarker(projectRoot) {
 }
 function writeOrgForceOnMarker(projectRoot, marker) {
     const path = markerPath(projectRoot);
+    assertWriteTargetSafe(projectRoot, path);
     mkdirSync(join(path, ".."), { recursive: true });
     writeFileSync(path, `${JSON.stringify(marker, null, 2)}\n`, "utf8");
 }

package/dist/render/framework-commands.d.ts

@@ -25,7 +25,7 @@ export declare function formatFrameworkCommand(args: readonly string[], options?
     surface?: string;
     taskPrefix?: string | null;
 }): string;
-export declare function cmdCoreValidate(argv: readonly string[]): number;
+export declare function cmdCoreValidate(argv: readonly string[], root?: string): number;
 export declare function cmdCoreLint(_argv: readonly string[]): number;
 export declare function cmdCoreTest(_argv: readonly string[]): number;
 export declare function resolveFrameworkRoot(): string;

package/dist/render/framework-commands.js

@@ -154,7 +154,7 @@ export function formatFrameworkCommand(args, options = {}) {
     }
     return [surface, ...parts].join(" ");
 }
-const EXCLUDE_PARTS = new Set([".git", "backup"]);
+const EXCLUDE_PARTS = new Set([".git", "backup", "node_modules", ".deft-scratch"]);
 function collectMarkdownFiles(root) {
     const out = [];
     const walk = (dir, parts) => {
@@ -189,12 +189,12 @@ function collectMarkdownFiles(root) {
     walk(root, []);
     return out.sort();
 }
-export function cmdCoreValidate(argv) {
+export function cmdCoreValidate(argv, root = ".") {
     if (argv.length > 0) {
         process.stderr.write(`error: core:validate does not accept arguments: ${argv.join(" ")}\n`);
         return 2;
     }
-    const files = collectMarkdownFiles(".");
+    const files = collectMarkdownFiles(root);
     for (const path of files)
         process.stdout.write(`✓ ${path}\n`);
     process.stdout.write(`✓ All ${files.length} markdown files validated\n`);
@@ -271,7 +271,7 @@ function runBuildDistArgv(argv) {
     return result.status ?? 1;
 }
 const TS_INLINE = {
-    "framework_commands:_cmd_core_validate": (argv) => cmdCoreValidate(argv),
+    "framework_commands:_cmd_core_validate": (argv, cwd) => cmdCoreValidate(argv, cwd),
     "doctor:cmd_doctor": (argv) => cmdDoctor(argv),
     "build_dist:main": (argv) => runBuildDistArgv(argv),
 };
@@ -349,7 +349,7 @@ function invokeEntrypoint(entrypoint, argv, cwd, frameworkRoot, noArgv, capture)
             };
             let code;
             try {
-                code = inline(argv);
+                code = inline(argv, cwd);
             }
             finally {
                 process.stdout.write = prevOut;
@@ -357,7 +357,7 @@ function invokeEntrypoint(entrypoint, argv, cwd, frameworkRoot, noArgv, capture)
             }
             return { code, stdout: chunks.out, stderr: chunks.err };
         }
-        return { code: inline(argv), stdout: "", stderr: "" };
+        return { code: inline(argv, cwd), stdout: "", stderr: "" };
     }
     const verb = ENTRYPOINT_VERB[entrypoint];
     if (verb) {

package/dist/render/roadmap-render.d.ts

@@ -3,7 +3,11 @@ export declare function renderRoadmapToBuffer(pendingDir: string, completedDir?:
 /** @deprecated Prefer ``renderRoadmapToBuffer`` — kept for existing imports and parity harnesses. */
 export declare function generateRoadmapContent(pendingDir: string, completedDir?: string): string;
 export type RenderRoadmapResult = readonly [boolean, string];
-export declare function renderRoadmap(pendingDir: string, outPath: string, completedDir?: string): RenderRoadmapResult;
+export type RenderRoadmapOptions = {
+    completedDir?: string;
+    projectRoot?: string;
+};
+export declare function renderRoadmap(pendingDir: string, outPath: string, completedDirOrOptions?: string | RenderRoadmapOptions): RenderRoadmapResult;
 export declare function checkDrift(pendingDir: string, roadmapPath: string, completedDir?: string): RenderRoadmapResult;
 /** CLI entry (mirrors ``scripts/roadmap_render.main``). */
 export declare function main(argv: readonly string[]): number;

package/dist/render/roadmap-render.js

@@ -1,5 +1,6 @@
 import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
 import { dirname, join, resolve } from "node:path";
+import { assertWriteTargetSafe } from "../fs/projection-containment.js";
 import { hasArtifactSuffix, resolveLifecycleRoot } from "../layout/resolve.js";
 import { MIGRATOR_METADATA_KEY, ROADMAP_BANNER } from "./constants.js";
 import { phaseSortKey } from "./text-utils.js";
@@ -351,9 +352,22 @@ export function renderRoadmapToBuffer(pendingDir, completedDir) {
 export function generateRoadmapContent(pendingDir, completedDir) {
     return renderRoadmapToBuffer(pendingDir, completedDir);
 }
-export function renderRoadmap(pendingDir, outPath, completedDir) {
+export function renderRoadmap(pendingDir, outPath, completedDirOrOptions) {
+    let completedDir;
+    let projectRoot;
+    if (typeof completedDirOrOptions === "string") {
+        completedDir = completedDirOrOptions;
+    }
+    else if (completedDirOrOptions !== undefined) {
+        completedDir = completedDirOrOptions.completedDir;
+        projectRoot = completedDirOrOptions.projectRoot;
+    }
     try {
         const content = renderRoadmapToBuffer(pendingDir, completedDir);
+        // Trust boundary is the project root — never dirname(outPath), which follows a
+        // diverted parent symlink and would make containment pass outside the checkout.
+        const projectDir = projectRoot !== undefined ? resolve(projectRoot) : resolve(pendingDir, "..", "..");
+        assertWriteTargetSafe(projectDir, resolve(outPath));
         writeFileSync(outPath, content, "utf8");
         return [true, `✓ Rendered ROADMAP.md to ${outPath}`];
     }
@@ -415,7 +429,11 @@ export function main(argv) {
         process.stdout.write(`${msg}\n`);
         return ok ? 0 : 1;
     }
-    const [ok, msg] = renderRoadmap(pendingDir, outPath);
+    // When --project-root is set, use it; otherwise renderRoadmap derives from pendingDir
+    // (…/xbrief|vbrief/pending → project root). Never use dirname(outPath).
+    const [ok, msg] = renderRoadmap(pendingDir, outPath, {
+        projectRoot: projectRoot !== undefined ? resolve(projectRoot) : undefined,
+    });
     process.stdout.write(`${msg}\n`);
     return ok ? 0 : 1;
 }

package/dist/render/rule-map.js

@@ -13,6 +13,7 @@
 import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
 import { basename, dirname, join, relative, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
+import { assertWriteTargetSafe } from "../fs/projection-containment.js";
 import { TEMPLATE } from "./rule-map-template.js";
 const MARKER_RE = /^\s*[-*]\s*([!~⊗≉?])\s/;
 const MARKER_LABEL = {
@@ -684,6 +685,10 @@ export function main(argv) {
         process.stdout.write("ok: docs/RULE-MAP.md is up to date\n");
         return 0;
     }
+    // Preflight both destinations before either write so a later HTML refusal
+    // cannot leave RULE-MAP.md updated while docs/rule-map/index.html stays stale.
+    assertWriteTargetSafe(repo, mdPath);
+    assertWriteTargetSafe(repo, htmlPath);
     mkdirSync(dirname(mdPath), { recursive: true });
     writeFileSync(mdPath, md, "utf8");
     mkdirSync(htmlDir, { recursive: true });

package/dist/review-monitor/constants.js

@@ -40,7 +40,7 @@ export const REVIEW_MONITOR_HELP = "usage: task verify:review-monitor -- --pr <N
     "\n" +
     "Claim a lease after spawning Approach 1:\n" +
     "  task review-monitor:register -- --pr <N> --monitor-agent-id <id> \\\n" +
-    "    --platform-primitive cursor-task|spawn_subagent|start_agent \\\n" +
+    "    --platform-primitive cursor-task|spawn_subagent|start_agent|sessions_spawn \\\n" +
     "    [--head-sha SHA] [--repo OWNER/REPO] [--force]\n" +
     "\n" +
     "Release when done:\n" +
@@ -54,7 +54,8 @@ export const REGISTER_HELP = "usage: task review-monitor:register -- --pr <N> --
     "required:\n" +
     "  --pr N                     Pull request number\n" +
     "  --monitor-agent-id ID      Stable poller agent id / Task handle\n" +
-    "  --platform-primitive P     start_agent | spawn_subagent | cursor-task\n" +
+    "  --platform-primitive P     start_agent | spawn_subagent | cursor-task |\n" +
+    "                             sessions_spawn | openclaw-sessions-spawn (#2876)\n" +
     "\n" +
     "options:\n" +
     "  --repo OWNER/REPO          Repository (default: origin / DEFT_TRIAGE_REPO)\n" +

package/dist/review-monitor/tier-detection.d.ts

@@ -1,5 +1,9 @@
 import { MONITORING_TIER_1, MONITORING_TIER_2, MONITORING_TIER_3 } from "./constants.js";
-export type PlatformPrimitive = "start_agent" | "spawn_subagent" | "cursor-task";
+/** Canonical Approach-1 platform primitives for review-monitor register/verify (#2655 / #2876). */
+export type PlatformPrimitive = "start_agent" | "spawn_subagent" | "cursor-task" | "sessions_spawn" | "openclaw-sessions-spawn";
+/** Accepted `--platform-primitive` values (register CLI + help text). */
+export declare const PLATFORM_PRIMITIVES: readonly PlatformPrimitive[];
+export declare const PLATFORM_PRIMITIVE_SET: Set<string>;
 export interface MonitoringTierProbe {
     readonly tier: typeof MONITORING_TIER_1 | typeof MONITORING_TIER_2 | typeof MONITORING_TIER_3;
     readonly primitive: PlatformPrimitive | null;
@@ -7,7 +11,7 @@ export interface MonitoringTierProbe {
 }
 /**
  * Inline Tier-1 detection aligned with the swarm Phase 3 / review-cycle matrix
- * (#1877 / #2655). Prefer `task platform:capabilities` when available (#1357);
+ * (#1877 / #2655 / #2876). Prefer `task platform:capabilities` when available (#1357);
  * this probe does not block MVP.
  */
 export declare function probeMonitoringTier(environ?: NodeJS.ProcessEnv): MonitoringTierProbe;

package/dist/review-monitor/tier-detection.js

@@ -1,12 +1,24 @@
 import { MONITORING_TIER_1, MONITORING_TIER_2, MONITORING_TIER_3 } from "./constants.js";
 const TRUTHY = new Set(["1", "true", "yes", "on"]);
+/** Accepted `--platform-primitive` values (register CLI + help text). */
+export const PLATFORM_PRIMITIVES = [
+    "start_agent",
+    "spawn_subagent",
+    "cursor-task",
+    "sessions_spawn",
+    "openclaw-sessions-spawn",
+];
+export const PLATFORM_PRIMITIVE_SET = new Set(PLATFORM_PRIMITIVES);
 function envTruthy(environ, name) {
     return TRUTHY.has((environ[name] ?? "").trim().toLowerCase());
 }
 function probeOverride(environ) {
     const raw = (environ.DEFT_MONITOR_TIER ?? environ.DEFT_MONITOR_TIER_OVERRIDE ?? "").trim();
     if (raw === "1" || raw.toLowerCase() === "tier1") {
-        const primitive = environ.DEFT_MONITOR_TIER1_PRIMITIVE ?? "cursor-task";
+        const requested = (environ.DEFT_MONITOR_TIER1_PRIMITIVE ?? "cursor-task").trim();
+        const primitive = PLATFORM_PRIMITIVE_SET.has(requested)
+            ? requested
+            : "cursor-task";
         return { tier: MONITORING_TIER_1, primitive, descriptor: "override-tier1" };
     }
     if (raw === "3" || raw.toLowerCase() === "tier3") {
@@ -16,7 +28,7 @@ function probeOverride(environ) {
 }
 /**
  * Inline Tier-1 detection aligned with the swarm Phase 3 / review-cycle matrix
- * (#1877 / #2655). Prefer `task platform:capabilities` when available (#1357);
+ * (#1877 / #2655 / #2876). Prefer `task platform:capabilities` when available (#1357);
  * this probe does not block MVP.
  */
 export function probeMonitoringTier(environ = process.env) {
@@ -41,6 +53,19 @@ export function probeMonitoringTier(environ = process.env) {
         };
     }
     const runtime = (environ.DEFT_AGENT_RUNTIME ?? "").trim().toLowerCase();
+    // OpenClaw: sessions_spawn is the Tier-1 Approach 1 primitive (#2876).
+    // Alias openclaw-sessions-spawn accepted on register for explicit naming.
+    if (envTruthy(environ, "DEFT_PROBE_SESSIONS_SPAWN") ||
+        envTruthy(environ, "DEFT_HAS_SESSIONS_SPAWN") ||
+        envTruthy(environ, "DEFT_PROBE_OPENCLAW") ||
+        envTruthy(environ, "OPENCLAW") ||
+        runtime === "openclaw" ||
+        runtime === "openclaw-sessions-spawn") {
+        const alias = (environ.DEFT_MONITOR_TIER1_PRIMITIVE ?? "").trim() === "openclaw-sessions-spawn"
+            ? "openclaw-sessions-spawn"
+            : "sessions_spawn";
+        return { tier: MONITORING_TIER_1, primitive: alias, descriptor: "openclaw" };
+    }
     if (envTruthy(environ, "DEFT_PROBE_GROK_BUILD") ||
         envTruthy(environ, "GROK_BUILD") ||
         runtime === "grok-build") {

package/dist/scope/transition.js

@@ -11,6 +11,43 @@ import { detectLifecycleFolder, updateDecomposedChildBackReferences, updateDecom
 import { syncProjectDefinitionAfterScopeMove } from "./project-definition-sync.js";
 import { syncSpecificationAfterScopeMove } from "./specification-sync.js";
 import { utcNowIso } from "./vbrief-json.js";
+/** Item statuses that still represent unfinished work and should advance on terminal transitions (#2862). */
+const NON_TERMINAL_ITEM_STATUSES = new Set(["pending", "proposed", "running"]);
+/** Terminal lifecycle actions that reconcile the brief's own plan.items (#2862). */
+const OWN_ITEMS_RECONCILE_ACTIONS = new Set(["complete", "fail", "cancel"]);
+/**
+ * Advance non-terminal plan.items / subItems to the terminal target status.
+ * Leaves cancelled / failed / completed / other non-pending-proposed-running items alone (#2862).
+ */
+function advanceNonTerminalOwnItems(items, targetStatus) {
+    if (!Array.isArray(items)) {
+        return;
+    }
+    for (const item of items) {
+        if (item === null || typeof item !== "object" || Array.isArray(item)) {
+            continue;
+        }
+        const obj = item;
+        const status = String(obj.status ?? "");
+        if (NON_TERMINAL_ITEM_STATUSES.has(status)) {
+            obj.status = targetStatus;
+        }
+        advanceNonTerminalOwnItems(obj.subItems, targetStatus);
+        advanceNonTerminalOwnItems(obj.items, targetStatus);
+    }
+}
+/**
+ * Refresh the document envelope `updated` stamp to match `plan.updated`.
+ * Stamps whichever of xBRIEFInfo (v0.8) / vBRIEFInfo (v0.6) is present — never creates one (#2862 / #2346).
+ */
+function stampEnvelopeUpdated(data, nowIso) {
+    for (const key of ["xBRIEFInfo", "vBRIEFInfo"]) {
+        const env = data[key];
+        if (typeof env === "object" && env !== null && !Array.isArray(env)) {
+            env.updated = nowIso;
+        }
+    }
+}
 export function runTransition(action, filePath, now = new Date()) {
     if (!(action in TRANSITIONS)) {
         const valid = Object.keys(TRANSITIONS).sort().join(", ");
@@ -96,6 +133,12 @@ export function runTransition(action, filePath, now = new Date()) {
     const nowIso = utcNowIso(now);
     planObj.status = targetStatus;
     planObj.updated = nowIso;
+    // Keep the envelope clock aligned with plan.updated on every mutating transition (#2862).
+    stampEnvelopeUpdated(data, nowIso);
+    // Reconcile the completing brief's own plan.items (mirrors #1527 / #2566 registry sync) (#2862).
+    if (OWN_ITEMS_RECONCILE_ACTIONS.has(act)) {
+        advanceNonTerminalOwnItems(planObj.items, targetStatus);
+    }
     if (act === "complete") {
         stampCompletionMetadata(planObj, projectRoot, nowIso);
     }

package/dist/session/release-availability.d.ts

@@ -1,3 +1,5 @@
+/** Display/back-compat constant; resolution flows through resolveTriageCachePath (#2869). */
+export declare const STATE_RELATIVE_PATH: string;
 export interface ReleaseAvailabilityProbeOptions {
     readonly now?: Date;
     readonly env?: NodeJS.ProcessEnv;

package/dist/session/release-availability.js

@@ -4,9 +4,15 @@ import { dirname, join } from "node:path";
 import { locateManifest, parseInstallManifest } from "../doctor/manifest.js";
 import { runningInsideDeftRepo } from "../doctor/paths.js";
 import { evaluateReleaseAvailability } from "../doctor/release-availability.js";
+import { resolveTriageCachePath } from "../triage/cache-path.js";
 const THROTTLE_MS = 24 * 60 * 60 * 1000;
 const PUBLIC_NPM_REGISTRY = "https://registry.npmjs.org/";
-const STATE_RELATIVE_PATH = join("xbrief", ".triage-cache", "release-availability-state.json");
+const STATE_FILE_NAME = "release-availability-state.json";
+/** Display/back-compat constant; resolution flows through resolveTriageCachePath (#2869). */
+export const STATE_RELATIVE_PATH = join("xbrief", ".triage-cache", STATE_FILE_NAME);
+function resolveReleaseAvailabilityStatePath(projectRoot) {
+    return resolveTriageCachePath(projectRoot, STATE_FILE_NAME);
+}
 function defaultReadText(path) {
     try {
         return readFileSync(path, "utf8");
@@ -91,18 +97,27 @@ export function probeSessionReleaseAvailability(projectRoot, options = {}) {
     const availability = evaluateReleaseAvailability(installed, npmResult.ok ? npmResult.version : null);
     if (availability.status !== "available")
         return { lines };
-    const statePath = join(projectRoot, STATE_RELATIVE_PATH);
-    const state = parseState((options.readState ?? defaultReadText)(statePath));
+    let statePath = null;
+    try {
+        statePath = resolveReleaseAvailabilityStatePath(projectRoot);
+    }
+    catch {
+        // Symlink-escaping triage-cache path: skip throttle state; still emit advisory (#2869).
+        statePath = null;
+    }
+    const state = parseState(statePath !== null ? (options.readState ?? defaultReadText)(statePath) : null);
     const now = options.now ?? new Date();
     if (isThrottled(state, availability.latestVersion, now))
         return { lines: [] };
     const message = `[deft release] Newer Directive release available: v${availability.latestVersion} ` +
         `(installed v${availability.installedVersion}). Run \`npm i -g @deftai/directive@latest\`.`;
-    try {
-        (options.writeState ?? defaultWriteState)(statePath, `${JSON.stringify({ latestVersion: availability.latestVersion, notifiedAt: now.toISOString() }, null, 2)}\n`);
-    }
-    catch {
-        // The advisory remains useful if its best-effort throttle state cannot persist.
+    if (statePath !== null) {
+        try {
+            (options.writeState ?? defaultWriteState)(statePath, `${JSON.stringify({ latestVersion: availability.latestVersion, notifiedAt: now.toISOString() }, null, 2)}\n`);
+        }
+        catch {
+            // The advisory remains useful if its best-effort throttle state cannot persist.
+        }
     }
     return { lines: [...lines, message] };
 }

package/dist/swarm/routing-set-cli.js

@@ -2,9 +2,8 @@
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { PROJECTION_CONTAINMENT_REFUSED_EXIT_CODE, ProjectionContainmentError, } from "../fs/projection-containment.js";
-import { getPlatformCapabilities } from "../intake/platform-capabilities.js";
 import { EXIT_CONFIG_ERROR, EXIT_OK } from "./constants.js";
-import { dispatchProviderFromRuntime, HARNESS_BOUND_PROVIDERS, ROUTING_MODE_HARNESS_DEFAULT, ROUTING_MODE_PINNED, resolveRoutingPath, SWARM_WORKER_ROLES, writeModelDecision, } from "./routing.js";
+import { HARNESS_BOUND_PROVIDERS, ROUTING_MODE_HARNESS_DEFAULT, ROUTING_MODE_PINNED, resolveDispatchProvider, resolveRoutingPath, SWARM_WORKER_ROLES, writeModelDecision, } from "./routing.js";
 export function routingSetMain(argv = process.argv.slice(2)) {
     let projectRoot = ".";
     let provider = null;
@@ -47,14 +46,10 @@ export function routingSetMain(argv = process.argv.slice(2)) {
     }
     let resolvedProvider = provider;
     if (resolvedProvider === null || resolvedProvider.length === 0) {
-        let runtimeMode = "";
-        try {
-            runtimeMode = getPlatformCapabilities().runtimeMode;
-        }
-        catch {
-            runtimeMode = "";
-        }
-        resolvedProvider = dispatchProviderFromRuntime(runtimeMode);
+        // Same key as launch + verify:routing: OPENCLAW / sessions_spawn → openclaw
+        // (#2875 Greptile P1). Do not map via runtimeMode alone — OpenClaw-only envs
+        // are often local-unsandboxed while still dispatching under provider openclaw.
+        resolvedProvider = resolveDispatchProvider(process.env);
     }
     if (harnessDefault) {
         if (model !== null) {

package/dist/swarm/routing.d.ts

@@ -9,7 +9,7 @@ export declare const ROUTING_MODE_HARNESS_DEFAULT = "harness-default";
 export declare const ROUTING_FILENAME = "routing.local.json";
 /** Providers whose model is harness-bound -- deft cannot pin or verify a slug. */
 export declare const HARNESS_BOUND_PROVIDERS: Set<string>;
-/** Providers whose per-role model must be decided before sub-agent dispatch (#1739 / #1877). */
+/** Providers whose per-role model must be decided before sub-agent dispatch (#1739 / #1877 / #2875). */
 export declare const ROUTING_GATED_DISPATCH_PROVIDERS: Set<string>;
 export interface RouteDecision {
     model: string | null;
@@ -54,7 +54,8 @@ export declare function dispatchProviderFromRuntime(runtimeMode: string): string
  * Resolve the `dispatch_provider` routing key from the active runtime envelope.
  * Separate from `runtime_mode` (#1557): Cursor sessions may carry
  * `runtime_mode=cloud-headless` for gh-auth purposes but route under provider
- * `cursor` for model selection (#1877).
+ * `cursor` for model selection (#1877). OpenClaw routes under `openclaw` when
+ * `sessions_spawn` / OPENCLAW signals are present (#2875).
  */
 export declare function resolveDispatchProvider(environ?: NodeJS.ProcessEnv): string;
 /**

package/dist/swarm/routing.js

@@ -32,8 +32,8 @@ export const ROUTING_MODE_HARNESS_DEFAULT = "harness-default";
 export const ROUTING_FILENAME = "routing.local.json";
 /** Providers whose model is harness-bound -- deft cannot pin or verify a slug. */
 export const HARNESS_BOUND_PROVIDERS = new Set(["grok"]);
-/** Providers whose per-role model must be decided before sub-agent dispatch (#1739 / #1877). */
-export const ROUTING_GATED_DISPATCH_PROVIDERS = new Set(["cursor", "grok"]);
+/** Providers whose per-role model must be decided before sub-agent dispatch (#1739 / #1877 / #2875). */
+export const ROUTING_GATED_DISPATCH_PROVIDERS = new Set(["cursor", "grok", "openclaw"]);
 const TRUTHY_ENV = new Set(["1", "true", "yes", "on"]);
 function envTruthy(environ, name) {
     return TRUTHY_ENV.has((environ[name] ?? "").trim().toLowerCase());
@@ -149,6 +149,9 @@ export function dispatchProviderFromRuntime(runtimeMode) {
     if (normalized.length === 0) {
         return "unknown";
     }
+    if (normalized.includes("openclaw")) {
+        return "openclaw";
+    }
     if (normalized.includes("grok")) {
         return "grok";
     }
@@ -161,13 +164,20 @@ export function dispatchProviderFromRuntime(runtimeMode) {
  * Resolve the `dispatch_provider` routing key from the active runtime envelope.
  * Separate from `runtime_mode` (#1557): Cursor sessions may carry
  * `runtime_mode=cloud-headless` for gh-auth purposes but route under provider
- * `cursor` for model selection (#1877).
+ * `cursor` for model selection (#1877). OpenClaw routes under `openclaw` when
+ * `sessions_spawn` / OPENCLAW signals are present (#2875).
  */
 export function resolveDispatchProvider(environ = process.env) {
     if (envTruthy(environ, "CURSOR_COMPOSER") || envTruthy(environ, "CURSOR_AGENT")) {
         return "cursor";
     }
     const runtime = (environ.DEFT_AGENT_RUNTIME ?? "").trim().toLowerCase();
+    if (envTruthy(environ, "OPENCLAW") ||
+        envTruthy(environ, "DEFT_HAS_SESSIONS_SPAWN") ||
+        envTruthy(environ, "DEFT_PROBE_SESSIONS_SPAWN") ||
+        runtime === "openclaw") {
+        return "openclaw";
+    }
     if (envTruthy(environ, "GROK_BUILD") || runtime === "grok-build") {
         return "grok";
     }
@@ -178,7 +188,9 @@ export function resolveDispatchProvider(environ = process.env) {
         envTruthy(environ, "BUILDKITE") ||
         (envTruthy(environ, "CI") &&
             !envTruthy(environ, "CURSOR_COMPOSER") &&
-            !envTruthy(environ, "CURSOR_AGENT"))) {
+            !envTruthy(environ, "CURSOR_AGENT") &&
+            !envTruthy(environ, "OPENCLAW") &&
+            !envTruthy(environ, "DEFT_HAS_SESSIONS_SPAWN"))) {
         return "cloud-headless";
     }
     return "unknown";

package/dist/triage/help/registry-data.d.ts

@@ -135,13 +135,13 @@ export declare const registryData: {
         };
         readonly "task triage:show": {
             readonly name: "task triage:show";
-            readonly summary: "Per-issue detail with optional drift diff";
-            readonly refs: "(D11 / #1128)";
-            readonly description: "Per-issue read-only detail (cached upstream payload + latest triage decision + audit timeline). Useful before running triage:accept / triage:defer to confirm context.";
-            readonly usage: "task triage:show -- <N> [--repo=owner/name]";
-            readonly flags: readonly [readonly ["<N>", "(required)", "Issue number (positional)."], readonly ["--repo owner/name", "(git remote)", "Explicit repo override."]];
-            readonly examples: readonly ["task triage:show -- 42", "task triage:show -- 42 --repo deftai/directive"];
-            readonly see_also: readonly ["task triage:queue", "task triage:status", "#1119 / D11"];
+            readonly summary: "Per-issue detail + optional operator brief";
+            readonly refs: "(D11 / #1128, #2890)";
+            readonly description: "Per-issue read-only detail (cached upstream payload + latest triage decision + audit timeline). --format=operator emits a pasteable Phase 3 candidate brief backbone (title/link/labels/summary/AC/latest decision/active-xBRIEF); agent still owns lean. Exit 0 on hit, 1 on cache miss.";
+            readonly usage: "task triage:show -- <N> [--format=default|operator] [--repo=owner/name]";
+            readonly flags: readonly [readonly ["<N>", "(required)", "Issue number (positional)."], readonly ["--format default|operator", "default", "default = audit/cache detail; operator = Phase 3 pasteable brief (#2890)."], readonly ["--repo owner/name", "(git remote)", "Explicit repo override."]];
+            readonly examples: readonly ["task triage:show -- 42", "task triage:show -- 42 --format=operator", "task triage:show -- 42 --repo deftai/directive"];
+            readonly see_also: readonly ["task triage:queue", "task triage:status", "#1119 / D11", "#2890"];
             readonly placeholder: false;
         };
         readonly "task triage:scope": {

package/dist/triage/help/registry-data.js

@@ -209,16 +209,25 @@ export const registryData = {
         },
         "task triage:show": {
             name: "task triage:show",
-            summary: "Per-issue detail with optional drift diff",
-            refs: "(D11 / #1128)",
-            description: "Per-issue read-only detail (cached upstream payload + latest triage decision + audit timeline). Useful before running triage:accept / triage:defer to confirm context.",
-            usage: "task triage:show -- <N> [--repo=owner/name]",
+            summary: "Per-issue detail + optional operator brief",
+            refs: "(D11 / #1128, #2890)",
+            description: "Per-issue read-only detail (cached upstream payload + latest triage decision + audit timeline). --format=operator emits a pasteable Phase 3 candidate brief backbone (title/link/labels/summary/AC/latest decision/active-xBRIEF); agent still owns lean. Exit 0 on hit, 1 on cache miss.",
+            usage: "task triage:show -- <N> [--format=default|operator] [--repo=owner/name]",
             flags: [
                 ["<N>", "(required)", "Issue number (positional)."],
+                [
+                    "--format default|operator",
+                    "default",
+                    "default = audit/cache detail; operator = Phase 3 pasteable brief (#2890).",
+                ],
                 ["--repo owner/name", "(git remote)", "Explicit repo override."],
             ],
-            examples: ["task triage:show -- 42", "task triage:show -- 42 --repo deftai/directive"],
-            see_also: ["task triage:queue", "task triage:status", "#1119 / D11"],
+            examples: [
+                "task triage:show -- 42",
+                "task triage:show -- 42 --format=operator",
+                "task triage:show -- 42 --repo deftai/directive",
+            ],
+            see_also: ["task triage:queue", "task triage:status", "#1119 / D11", "#2890"],
             placeholder: false,
         },
         "task triage:scope": {

package/dist/triage/queue/index.d.ts

@@ -10,5 +10,6 @@ export * from "./repo.js";
 export * from "./scope-ignores-filter.js";
 export * from "./scope-walk.js";
 export * from "./selection.js";
+export * from "./show.js";
 export * from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/triage/queue/index.js

@@ -10,5 +10,6 @@ export * from "./repo.js";
 export * from "./scope-ignores-filter.js";
 export * from "./scope-walk.js";
 export * from "./selection.js";
+export * from "./show.js";
 export * from "./types.js";
 //# sourceMappingURL=index.js.map

package/dist/triage/queue/show.d.ts

@@ -0,0 +1,69 @@
+/**
+ * triage:show default + operator brief renderers (#1128 / #2890).
+ *
+ * Default format mirrors the pre-Python-removal `render_show` surface.
+ * `--format=operator` emits a pasteable Phase 3 candidate brief backbone;
+ * the agent still owns lean (not invented here).
+ */
+/** Loose audit row for show renderers (actions + queue shapes both work). */
+export type ShowAuditRow = {
+    readonly decision?: string;
+    readonly timestamp?: string;
+    readonly actor?: string;
+    readonly reason?: string;
+    readonly issue_number?: number;
+    readonly repo?: string;
+};
+/** One cached issue with body fields needed by show/operator formats. */
+export interface CachedIssueDetail {
+    readonly number: number;
+    readonly title: string;
+    readonly state: string;
+    readonly labels: readonly string[];
+    readonly updatedAt: string;
+    readonly body: string;
+    readonly htmlUrl: string | null;
+}
+/** Collapse CR/LF so cached attacker text cannot break markdown bullets (P2). */
+export declare function oneLine(value: string): string;
+/**
+ * Resolve a safe issue link. Always construct the canonical github.com path for
+ * `owner/name#N` rather than trusting payload URL substrings (CodeQL
+ * incomplete-url-substring-sanitization).
+ */
+export declare function resolveIssueHtmlUrl(repo: string, number: number): string;
+/** Load a single cached issue (include closed) or null on miss. */
+export declare function loadCachedIssueDetail(repo: string, number: number, options?: {
+    readonly projectRoot: string;
+    /** Absolute/relative path to `.deft-cache` root (CLI `--cache-root`). */
+    readonly cacheRoot?: string | null;
+    readonly source?: string;
+}): CachedIssueDetail | null;
+/** Default triage:show text (audit/cache oriented). */
+export declare function renderShow(options: {
+    readonly issue: CachedIssueDetail | null;
+    readonly repo: string;
+    readonly number: number;
+    readonly latestDecision: ShowAuditRow | null;
+    readonly history: readonly ShowAuditRow[];
+    readonly inActiveXbrief: boolean;
+}): string;
+/**
+ * Extract a short problem/context summary (2–5 lines) from issue body.
+ * Prefers text before the first `##` section; falls back to leading paragraphs.
+ */
+export declare function extractBodySummary(body: string, maxLines?: number): string;
+/**
+ * Extract acceptance-criteria bullets from body, or a thin-body note.
+ * Looks for AC / Acceptance headings and checkbox / bullet lists under them.
+ */
+export declare function extractAcceptanceCriteria(body: string): readonly string[];
+/** Operator-facing pasteable brief backbone for Phase 3 decisions (#2890). */
+export declare function renderOperatorBrief(options: {
+    readonly issue: CachedIssueDetail | null;
+    readonly repo: string;
+    readonly number: number;
+    readonly latestDecision: ShowAuditRow | null;
+    readonly inActiveXbrief: boolean;
+}): string;
+//# sourceMappingURL=show.d.ts.map