@deftai/directive-core 0.86.0 → 0.88.0

package/dist/swarm/routing.js

@@ -32,8 +32,8 @@ export const ROUTING_MODE_HARNESS_DEFAULT = "harness-default";
 export const ROUTING_FILENAME = "routing.local.json";
 /** Providers whose model is harness-bound -- deft cannot pin or verify a slug. */
 export const HARNESS_BOUND_PROVIDERS = new Set(["grok"]);
-/** Providers whose per-role model must be decided before sub-agent dispatch (#1739 / #1877). */
-export const ROUTING_GATED_DISPATCH_PROVIDERS = new Set(["cursor", "grok"]);
+/** Providers whose per-role model must be decided before sub-agent dispatch (#1739 / #1877 / #2875). */
+export const ROUTING_GATED_DISPATCH_PROVIDERS = new Set(["cursor", "grok", "openclaw"]);
 const TRUTHY_ENV = new Set(["1", "true", "yes", "on"]);
 function envTruthy(environ, name) {
     return TRUTHY_ENV.has((environ[name] ?? "").trim().toLowerCase());
@@ -149,6 +149,9 @@ export function dispatchProviderFromRuntime(runtimeMode) {
     if (normalized.length === 0) {
         return "unknown";
     }
+    if (normalized.includes("openclaw")) {
+        return "openclaw";
+    }
     if (normalized.includes("grok")) {
         return "grok";
     }
@@ -161,13 +164,20 @@ export function dispatchProviderFromRuntime(runtimeMode) {
  * Resolve the `dispatch_provider` routing key from the active runtime envelope.
  * Separate from `runtime_mode` (#1557): Cursor sessions may carry
  * `runtime_mode=cloud-headless` for gh-auth purposes but route under provider
- * `cursor` for model selection (#1877).
+ * `cursor` for model selection (#1877). OpenClaw routes under `openclaw` when
+ * `sessions_spawn` / OPENCLAW signals are present (#2875).
  */
 export function resolveDispatchProvider(environ = process.env) {
     if (envTruthy(environ, "CURSOR_COMPOSER") || envTruthy(environ, "CURSOR_AGENT")) {
         return "cursor";
     }
     const runtime = (environ.DEFT_AGENT_RUNTIME ?? "").trim().toLowerCase();
+    if (envTruthy(environ, "OPENCLAW") ||
+        envTruthy(environ, "DEFT_HAS_SESSIONS_SPAWN") ||
+        envTruthy(environ, "DEFT_PROBE_SESSIONS_SPAWN") ||
+        runtime === "openclaw") {
+        return "openclaw";
+    }
     if (envTruthy(environ, "GROK_BUILD") || runtime === "grok-build") {
         return "grok";
     }
@@ -178,7 +188,9 @@ export function resolveDispatchProvider(environ = process.env) {
         envTruthy(environ, "BUILDKITE") ||
         (envTruthy(environ, "CI") &&
             !envTruthy(environ, "CURSOR_COMPOSER") &&
-            !envTruthy(environ, "CURSOR_AGENT"))) {
+            !envTruthy(environ, "CURSOR_AGENT") &&
+            !envTruthy(environ, "OPENCLAW") &&
+            !envTruthy(environ, "DEFT_HAS_SESSIONS_SPAWN"))) {
         return "cloud-headless";
     }
     return "unknown";

package/dist/triage/help/registry-data.d.ts

@@ -135,13 +135,13 @@ export declare const registryData: {
         };
         readonly "task triage:show": {
             readonly name: "task triage:show";
-            readonly summary: "Per-issue detail with optional drift diff";
-            readonly refs: "(D11 / #1128)";
-            readonly description: "Per-issue read-only detail (cached upstream payload + latest triage decision + audit timeline). Useful before running triage:accept / triage:defer to confirm context.";
-            readonly usage: "task triage:show -- <N> [--repo=owner/name]";
-            readonly flags: readonly [readonly ["<N>", "(required)", "Issue number (positional)."], readonly ["--repo owner/name", "(git remote)", "Explicit repo override."]];
-            readonly examples: readonly ["task triage:show -- 42", "task triage:show -- 42 --repo deftai/directive"];
-            readonly see_also: readonly ["task triage:queue", "task triage:status", "#1119 / D11"];
+            readonly summary: "Per-issue detail + optional operator brief";
+            readonly refs: "(D11 / #1128, #2890)";
+            readonly description: "Per-issue read-only detail (cached upstream payload + latest triage decision + audit timeline). --format=operator emits a pasteable Phase 3 candidate brief backbone (title/link/labels/summary/AC/latest decision/active-xBRIEF); agent still owns lean. Exit 0 on hit, 1 on cache miss.";
+            readonly usage: "task triage:show -- <N> [--format=default|operator] [--repo=owner/name]";
+            readonly flags: readonly [readonly ["<N>", "(required)", "Issue number (positional)."], readonly ["--format default|operator", "default", "default = audit/cache detail; operator = Phase 3 pasteable brief (#2890)."], readonly ["--repo owner/name", "(git remote)", "Explicit repo override."]];
+            readonly examples: readonly ["task triage:show -- 42", "task triage:show -- 42 --format=operator", "task triage:show -- 42 --repo deftai/directive"];
+            readonly see_also: readonly ["task triage:queue", "task triage:status", "#1119 / D11", "#2890"];
             readonly placeholder: false;
         };
         readonly "task triage:scope": {

package/dist/triage/help/registry-data.js

@@ -209,16 +209,25 @@ export const registryData = {
         },
         "task triage:show": {
             name: "task triage:show",
-            summary: "Per-issue detail with optional drift diff",
-            refs: "(D11 / #1128)",
-            description: "Per-issue read-only detail (cached upstream payload + latest triage decision + audit timeline). Useful before running triage:accept / triage:defer to confirm context.",
-            usage: "task triage:show -- <N> [--repo=owner/name]",
+            summary: "Per-issue detail + optional operator brief",
+            refs: "(D11 / #1128, #2890)",
+            description: "Per-issue read-only detail (cached upstream payload + latest triage decision + audit timeline). --format=operator emits a pasteable Phase 3 candidate brief backbone (title/link/labels/summary/AC/latest decision/active-xBRIEF); agent still owns lean. Exit 0 on hit, 1 on cache miss.",
+            usage: "task triage:show -- <N> [--format=default|operator] [--repo=owner/name]",
             flags: [
                 ["<N>", "(required)", "Issue number (positional)."],
+                [
+                    "--format default|operator",
+                    "default",
+                    "default = audit/cache detail; operator = Phase 3 pasteable brief (#2890).",
+                ],
                 ["--repo owner/name", "(git remote)", "Explicit repo override."],
             ],
-            examples: ["task triage:show -- 42", "task triage:show -- 42 --repo deftai/directive"],
-            see_also: ["task triage:queue", "task triage:status", "#1119 / D11"],
+            examples: [
+                "task triage:show -- 42",
+                "task triage:show -- 42 --format=operator",
+                "task triage:show -- 42 --repo deftai/directive",
+            ],
+            see_also: ["task triage:queue", "task triage:status", "#1119 / D11", "#2890"],
             placeholder: false,
         },
         "task triage:scope": {

package/dist/triage/queue/index.d.ts

@@ -10,5 +10,6 @@ export * from "./repo.js";
 export * from "./scope-ignores-filter.js";
 export * from "./scope-walk.js";
 export * from "./selection.js";
+export * from "./show.js";
 export * from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/triage/queue/index.js

@@ -10,5 +10,6 @@ export * from "./repo.js";
 export * from "./scope-ignores-filter.js";
 export * from "./scope-walk.js";
 export * from "./selection.js";
+export * from "./show.js";
 export * from "./types.js";
 //# sourceMappingURL=index.js.map

package/dist/triage/queue/show.d.ts

@@ -0,0 +1,69 @@
+/**
+ * triage:show default + operator brief renderers (#1128 / #2890).
+ *
+ * Default format mirrors the pre-Python-removal `render_show` surface.
+ * `--format=operator` emits a pasteable Phase 3 candidate brief backbone;
+ * the agent still owns lean (not invented here).
+ */
+/** Loose audit row for show renderers (actions + queue shapes both work). */
+export type ShowAuditRow = {
+    readonly decision?: string;
+    readonly timestamp?: string;
+    readonly actor?: string;
+    readonly reason?: string;
+    readonly issue_number?: number;
+    readonly repo?: string;
+};
+/** One cached issue with body fields needed by show/operator formats. */
+export interface CachedIssueDetail {
+    readonly number: number;
+    readonly title: string;
+    readonly state: string;
+    readonly labels: readonly string[];
+    readonly updatedAt: string;
+    readonly body: string;
+    readonly htmlUrl: string | null;
+}
+/** Collapse CR/LF so cached attacker text cannot break markdown bullets (P2). */
+export declare function oneLine(value: string): string;
+/**
+ * Resolve a safe issue link. Always construct the canonical github.com path for
+ * `owner/name#N` rather than trusting payload URL substrings (CodeQL
+ * incomplete-url-substring-sanitization).
+ */
+export declare function resolveIssueHtmlUrl(repo: string, number: number): string;
+/** Load a single cached issue (include closed) or null on miss. */
+export declare function loadCachedIssueDetail(repo: string, number: number, options?: {
+    readonly projectRoot: string;
+    /** Absolute/relative path to `.deft-cache` root (CLI `--cache-root`). */
+    readonly cacheRoot?: string | null;
+    readonly source?: string;
+}): CachedIssueDetail | null;
+/** Default triage:show text (audit/cache oriented). */
+export declare function renderShow(options: {
+    readonly issue: CachedIssueDetail | null;
+    readonly repo: string;
+    readonly number: number;
+    readonly latestDecision: ShowAuditRow | null;
+    readonly history: readonly ShowAuditRow[];
+    readonly inActiveXbrief: boolean;
+}): string;
+/**
+ * Extract a short problem/context summary (2–5 lines) from issue body.
+ * Prefers text before the first `##` section; falls back to leading paragraphs.
+ */
+export declare function extractBodySummary(body: string, maxLines?: number): string;
+/**
+ * Extract acceptance-criteria bullets from body, or a thin-body note.
+ * Looks for AC / Acceptance headings and checkbox / bullet lists under them.
+ */
+export declare function extractAcceptanceCriteria(body: string): readonly string[];
+/** Operator-facing pasteable brief backbone for Phase 3 decisions (#2890). */
+export declare function renderOperatorBrief(options: {
+    readonly issue: CachedIssueDetail | null;
+    readonly repo: string;
+    readonly number: number;
+    readonly latestDecision: ShowAuditRow | null;
+    readonly inActiveXbrief: boolean;
+}): string;
+//# sourceMappingURL=show.d.ts.map

package/dist/triage/queue/show.js

@@ -0,0 +1,293 @@
+/**
+ * triage:show default + operator brief renderers (#1128 / #2890).
+ *
+ * Default format mirrors the pre-Python-removal `render_show` surface.
+ * `--format=operator` emits a pasteable Phase 3 candidate brief backbone;
+ * the agent still owns lean (not invented here).
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { CACHE_DIR_NAME, CACHE_SOURCE_GITHUB_ISSUE } from "./constants.js";
+function parseLabels(raw) {
+    if (!Array.isArray(raw)) {
+        return [];
+    }
+    const labels = [];
+    for (const item of raw) {
+        if (typeof item === "object" && item !== null) {
+            const name = item.name;
+            if (typeof name === "string") {
+                labels.push(name);
+            }
+        }
+        else if (typeof item === "string") {
+            labels.push(item);
+        }
+    }
+    return labels;
+}
+/** Collapse CR/LF so cached attacker text cannot break markdown bullets (P2). */
+export function oneLine(value) {
+    return value.replace(/\r?\n/gu, " ").trim();
+}
+/**
+ * Resolve a safe issue link. Always construct the canonical github.com path for
+ * `owner/name#N` rather than trusting payload URL substrings (CodeQL
+ * incomplete-url-substring-sanitization).
+ */
+export function resolveIssueHtmlUrl(repo, number) {
+    return `https://github.com/${repo}/issues/${number}`;
+}
+/** Load a single cached issue (include closed) or null on miss. */
+export function loadCachedIssueDetail(repo, number, options = {
+    projectRoot: process.cwd(),
+}) {
+    if (!repo.includes("/")) {
+        throw new Error(`repo must be 'owner/name'; got '${repo}'`);
+    }
+    const parts = repo.split("/", 2);
+    const owner = parts[0];
+    const name = parts[1];
+    if (owner === undefined || name === undefined || owner.length === 0 || name.length === 0) {
+        throw new Error(`repo must be 'owner/name'; got '${repo}'`);
+    }
+    const source = options.source ?? CACHE_SOURCE_GITHUB_ISSUE;
+    const cacheBase = options.cacheRoot !== null && options.cacheRoot !== undefined && options.cacheRoot.length > 0
+        ? resolve(options.cacheRoot)
+        : join(resolve(options.projectRoot), CACHE_DIR_NAME);
+    const entryDir = join(cacheBase, source, owner, name, String(number));
+    const rawPath = join(entryDir, "raw.json");
+    if (!existsSync(rawPath)) {
+        return null;
+    }
+    let payload;
+    try {
+        const parsed = JSON.parse(readFileSync(rawPath, { encoding: "utf8" }));
+        if (typeof parsed !== "object" || parsed === null) {
+            return null;
+        }
+        payload = parsed;
+    }
+    catch {
+        return null;
+    }
+    const n = typeof payload.number === "number" ? payload.number : number;
+    const stateRaw = payload.state ?? "open";
+    const state = typeof stateRaw === "string" ? stateRaw.toLowerCase() : "open";
+    const title = typeof payload.title === "string" ? payload.title : "";
+    const body = typeof payload.body === "string" ? payload.body : "";
+    const updatedAt = typeof payload.updated_at === "string"
+        ? payload.updated_at
+        : typeof payload.updatedAt === "string"
+            ? payload.updatedAt
+            : "";
+    return {
+        number: n,
+        title,
+        state,
+        labels: parseLabels(payload.labels),
+        updatedAt,
+        body,
+        htmlUrl: resolveIssueHtmlUrl(repo, n),
+    };
+}
+/** Default triage:show text (audit/cache oriented). */
+export function renderShow(options) {
+    const lines = [];
+    lines.push(`triage:show -- ${options.repo}#${options.number}`);
+    if (options.issue === null) {
+        lines.push("");
+        lines.push("  (issue not present in local cache)");
+        lines.push("  Run `task triage:bootstrap` to populate, or check the repo slug.");
+        return lines.join("\n");
+    }
+    const labels = options.issue.labels.map(oneLine);
+    lines.push(`  title:      ${oneLine(options.issue.title)}`);
+    lines.push(`  state:      ${oneLine(options.issue.state)}`);
+    lines.push(`  labels:     ${labels.length > 0 ? labels.join(", ") : "<none>"}`);
+    lines.push(`  updated_at: ${oneLine(options.issue.updatedAt)}`);
+    lines.push("");
+    lines.push(`  active xBRIEF reference: ${options.inActiveXbrief ? "yes" : "no"}`);
+    if (options.latestDecision !== null) {
+        const d = options.latestDecision;
+        lines.push(`  latest decision: ${oneLine(String(d.decision ?? "?"))} at ${oneLine(String(d.timestamp ?? "?"))} by ${oneLine(String(d.actor ?? "?"))}`);
+        if (typeof d.reason === "string" && d.reason.length > 0) {
+            lines.push(`    reason: ${oneLine(d.reason)}`);
+        }
+    }
+    else {
+        lines.push("  latest decision: <none -- untriaged>");
+    }
+    if (options.history.length > 0) {
+        lines.push("");
+        lines.push(`  history (${options.history.length} entries, oldest first):`);
+        for (const entry of options.history) {
+            const decision = oneLine(String(entry.decision ?? "?")).padEnd(14);
+            lines.push(`    - ${oneLine(String(entry.timestamp ?? "?"))} ${decision} by ${oneLine(String(entry.actor ?? "?"))}`);
+        }
+    }
+    return lines.join("\n");
+}
+/** Collapse blank lines and trim for summary extraction. */
+function normalizeBody(body) {
+    return body.replace(/\r\n/g, "\n").replace(/\r/g, "\n").trim();
+}
+/**
+ * Extract a short problem/context summary (2–5 lines) from issue body.
+ * Prefers text before the first `##` section; falls back to leading paragraphs.
+ */
+export function extractBodySummary(body, maxLines = 5) {
+    const text = normalizeBody(body);
+    if (text.length === 0) {
+        return "(thin body / no summary)";
+    }
+    // Drop leading H1/title lines
+    let rest = text.replace(/^#[^\n]*\n+/u, "");
+    // Prefer content before first ## heading (often Summary/Description)
+    const firstSection = rest.search(/^##\s+/mu);
+    if (firstSection > 0) {
+        rest = rest.slice(0, firstSection).trim();
+    }
+    else if (firstSection === 0) {
+        // Body starts with ## — take the first section body
+        const next = rest.search(/\n##\s+/u);
+        const block = next === -1 ? rest : rest.slice(0, next);
+        rest = block.replace(/^##[^\n]*\n?/u, "").trim();
+    }
+    const paragraphs = rest
+        .split(/\n{2,}/u)
+        .map((p) => p.replace(/\s+/gu, " ").trim())
+        .filter((p) => p.length > 0 && !p.startsWith("#"));
+    if (paragraphs.length === 0) {
+        const lines = rest
+            .split("\n")
+            .map((l) => l.trim())
+            .filter((l) => l.length > 0 && !l.startsWith("#"));
+        if (lines.length === 0) {
+            return "(thin body / no summary)";
+        }
+        return lines.slice(0, maxLines).join("\n");
+    }
+    const out = [];
+    for (const para of paragraphs) {
+        if (out.length >= maxLines)
+            break;
+        // Soft-wrap long paragraphs into ~100-char lines for pasteability
+        if (para.length <= 120) {
+            out.push(para);
+        }
+        else {
+            const words = para.split(/\s+/u);
+            let line = "";
+            for (const w of words) {
+                const next = line.length === 0 ? w : `${line} ${w}`;
+                if (next.length > 100 && line.length > 0) {
+                    out.push(line);
+                    line = w;
+                    if (out.length >= maxLines)
+                        break;
+                }
+                else {
+                    line = next;
+                }
+            }
+            if (line.length > 0 && out.length < maxLines) {
+                out.push(line);
+            }
+        }
+    }
+    return out.slice(0, maxLines).join("\n");
+}
+/**
+ * Extract acceptance-criteria bullets from body, or a thin-body note.
+ * Looks for AC / Acceptance headings and checkbox / bullet lists under them.
+ */
+export function extractAcceptanceCriteria(body) {
+    const text = normalizeBody(body);
+    if (text.length === 0) {
+        return [];
+    }
+    const headingRe = /^#{1,3}\s*(?:acceptance\s*criteria|acceptance|ac\b|success\s*criteria)[^\n]*$/imu;
+    const match = headingRe.exec(text);
+    if (match === null || match.index === undefined) {
+        // Loose: checkbox list near top without a heading
+        const loose = [];
+        for (const line of text.split("\n")) {
+            const m = /^\s*[-*]\s*\[[ xX]\]\s+(.+)$/u.exec(line);
+            if (m?.[1] !== undefined) {
+                loose.push(m[1].trim());
+            }
+        }
+        return loose.slice(0, 12);
+    }
+    const after = text.slice(match.index + match[0].length);
+    // Stop only at a next ## (H2) peer section — keep ### subsections (A/B/C…) inside AC.
+    const nextPeer = after.search(/\n##\s+\S/u);
+    const section = nextPeer === -1 ? after : after.slice(0, nextPeer);
+    const bullets = [];
+    for (const line of section.split("\n")) {
+        const checkbox = /^\s*[-*]\s*\[[ xX]\]\s+(.+)$/u.exec(line);
+        if (checkbox?.[1] !== undefined) {
+            bullets.push(checkbox[1].trim());
+            continue;
+        }
+        // Prefer checkboxes under AC; plain bullets are also accepted
+        const bullet = /^\s*[-*]\s+(.+)$/u.exec(line);
+        if (bullet?.[1] !== undefined) {
+            // Skip nested subsection-only markers that are just headings-as-bullets
+            bullets.push(bullet[1].trim());
+            continue;
+        }
+        const numbered = /^\s*\d+[.)]\s+(.+)$/u.exec(line);
+        if (numbered?.[1] !== undefined) {
+            bullets.push(numbered[1].trim());
+        }
+    }
+    return bullets.slice(0, 12);
+}
+/** Operator-facing pasteable brief backbone for Phase 3 decisions (#2890). */
+export function renderOperatorBrief(options) {
+    const lines = [];
+    lines.push(`triage:show --format=operator -- ${options.repo}#${options.number}`);
+    if (options.issue === null) {
+        lines.push("");
+        lines.push("  (issue not present in local cache)");
+        lines.push("  Run `task triage:bootstrap` / re-sync per Phase 0, or check the repo slug.");
+        return lines.join("\n");
+    }
+    const issue = options.issue;
+    const link = issue.htmlUrl ?? resolveIssueHtmlUrl(options.repo, options.number);
+    const labels = issue.labels.length > 0 ? issue.labels.map(oneLine).join(", ") : "<none>";
+    lines.push(`#${options.number}  ${oneLine(issue.title)}`);
+    lines.push(`link:    ${oneLine(link)}`);
+    lines.push(`labels:  ${labels}`);
+    lines.push("");
+    lines.push("summary:");
+    for (const line of extractBodySummary(issue.body).split("\n")) {
+        lines.push(`  ${oneLine(line)}`);
+    }
+    lines.push("");
+    const ac = extractAcceptanceCriteria(issue.body);
+    if (ac.length === 0) {
+        lines.push("acceptance criteria: (thin body / no AC)");
+    }
+    else {
+        lines.push("acceptance criteria:");
+        for (const item of ac) {
+            lines.push(`  - ${oneLine(item)}`);
+        }
+    }
+    lines.push("");
+    if (options.latestDecision !== null) {
+        const d = options.latestDecision;
+        lines.push(`latest decision: ${oneLine(String(d.decision ?? "?"))} at ${oneLine(String(d.timestamp ?? "?"))} by ${oneLine(String(d.actor ?? "?"))}`);
+    }
+    else {
+        lines.push("latest decision: <none -- untriaged>");
+    }
+    lines.push(`active xBRIEF: ${options.inActiveXbrief ? "yes" : "no"}`);
+    lines.push("");
+    lines.push("lean: (agent-owned — not filled by triage:show)");
+    return lines.join("\n");
+}
+//# sourceMappingURL=show.js.map

package/dist/triage/scope/cli.js

@@ -232,9 +232,12 @@ export function runCliCapture(argv) {
             cacheRoot: args.cacheRoot !== undefined ? resolve(args.cacheRoot) : undefined,
         });
         const subHash = subscriptionHash(rules);
+        // When --cache-root is outside the project tree, contain against that root
+        // instead of projectRoot (tests and operators may redirect the cache) (#2869).
         const record = writeCoverageDenominator(path, {
             count: args.count,
             subscriptionHashValue: subHash,
+            projectRoot: args.cacheRoot !== undefined ? resolve(args.cacheRoot) : projectRoot,
         });
         stdout.push(`triage:scope: wrote coverage denominator count=${record.count} ` +
             `subscription-hash=${record.subscriptionHash} path=${path}\n`);

package/dist/triage/scope/coverage.d.ts

@@ -14,6 +14,8 @@ export declare function writeCoverageDenominator(path: string, options: {
     count: number;
     subscriptionHashValue: string;
     fetchedAt?: Date;
+    /** Project (or cache) root for symlink containment (#2869). */
+    projectRoot?: string;
 }): CoverageRecord;
 export declare function readCoverageDenominator(path: string, options: {
     currentHash: string;

package/dist/triage/scope/coverage.js

@@ -1,5 +1,6 @@
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
+import { assertWriteTargetSafe } from "../../fs/projection-containment.js";
 import { CACHE_DIR_NAME, COVERAGE_FILENAME, DEFAULT_COVERAGE_TTL_HOURS, ENV_COVERAGE_TTL_HOURS, } from "./constants.js";
 import { parseIso, utcIso, utcNow } from "./time.js";
 export function coveragePath(source, repo, options = {}) {
@@ -29,14 +30,28 @@ export function writeCoverageDenominator(path, options) {
     if (!options.subscriptionHashValue) {
         throw new Error("subscription_hash_value must be a non-empty string");
     }
+    const absPath = resolve(path);
+    // Production CLI always passes projectRoot. When omitted (unit tests with a
+    // bare cacheRoot), walk up to the deepest existing ancestor so containment
+    // can realpath the root before mkdir creates intermediate dirs (#2869).
+    let containmentRoot = options.projectRoot !== undefined ? resolve(options.projectRoot) : dirname(absPath);
+    if (options.projectRoot === undefined) {
+        while (!existsSync(containmentRoot)) {
+            const parent = dirname(containmentRoot);
+            if (parent === containmentRoot)
+                break;
+            containmentRoot = parent;
+        }
+    }
+    assertWriteTargetSafe(containmentRoot, absPath);
     const stamp = utcIso(options.fetchedAt ?? null);
-    mkdirSync(join(path, ".."), { recursive: true });
+    mkdirSync(dirname(absPath), { recursive: true });
     const payload = {
         count: options.count,
         fetched_at: stamp,
         subscription_hash: options.subscriptionHashValue,
     };
-    writeFileSync(path, `${JSON.stringify(payload, Object.keys(payload).sort())}\n`, "utf8");
+    writeFileSync(absPath, `${JSON.stringify(payload, Object.keys(payload).sort())}\n`, "utf8");
     return {
         count: options.count,
         fetchedAt: stamp,

package/dist/verify-source/cursor-tier1.js

@@ -3,14 +3,19 @@ import { join, resolve } from "node:path";
 export const CURSOR_TIER1_TARGETS = [
     {
         path: "content/skills/deft-directive-swarm/SKILL.md",
-        label: "swarm Phase 3 capability matrix",
+        label: "swarm Phase 3 capability matrix (thin skill)",
         markers: [
             "Probe for the Cursor `Task` tool",
             "cursor-composer",
             "cursor-cloud-agent",
-            "Step 2e: Cursor Launch",
+            "host-cursor.md",
         ],
     },
+    {
+        path: "content/skills/deft-directive-swarm/references/host-cursor.md",
+        label: "swarm Cursor host adapter",
+        markers: ["Step 2e: Cursor Launch", "cursor-composer", "Task"],
+    },
     {
         path: "content/skills/deft-directive-review-cycle/SKILL.md",
         label: "review-cycle monitoring tier selection",

package/dist/verify-source/index.d.ts

@@ -3,6 +3,7 @@ export * from "./code-structure-validate.js";
 export * from "./content-manifest.js";
 export { CANONICAL_SCHEMA_REL, type ContractDriftOptions, type ContractDriftResult, evaluateContractDrift, PUBLISHED_SCHEMA_REL, } from "./contract-drift.js";
 export * from "./cursor-tier1.js";
+export * from "./openclaw-tier1.js";
 export * from "./python-call-scan.js";
 export * from "./rule-ownership-lint.js";
 export * from "./scm-boundary.js";

package/dist/verify-source/index.js

@@ -3,6 +3,7 @@ export * from "./code-structure-validate.js";
 export * from "./content-manifest.js";
 export { CANONICAL_SCHEMA_REL, evaluateContractDrift, PUBLISHED_SCHEMA_REL, } from "./contract-drift.js";
 export * from "./cursor-tier1.js";
+export * from "./openclaw-tier1.js";
 export * from "./python-call-scan.js";
 export * from "./rule-ownership-lint.js";
 export * from "./scm-boundary.js";

package/dist/verify-source/openclaw-tier1.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Deterministic gate: assert that OpenClaw is enumerated as a Tier-1 descriptor
+ * in the swarm Phase 3 capability matrix and that routing accepts openclaw as a
+ * dispatch_provider (#2875). Without this gate the "OpenClaw -> Tier 1" mapping
+ * is prose-trusted; a doc edit that drops the sessions_spawn descriptor would
+ * silently re-open misclassification (OpenClaw falling through to grok-build or
+ * generic-terminal).
+ *
+ * Review-cycle skill markers for OpenClaw Approach 1 are owned by sibling #2876
+ * and are intentionally out of scope for this gate.
+ */
+export interface OpenclawTier1Target {
+    /** Project-root-relative path to the surface file. */
+    readonly path: string;
+    /** Human label for the surface, used in failure output. */
+    readonly label: string;
+    /** Whitespace-normalized substrings that MUST all be present. */
+    readonly markers: readonly string[];
+}
+export declare const OPENCLAW_TIER1_TARGETS: readonly OpenclawTier1Target[];
+export interface OpenclawTier1Finding {
+    readonly path: string;
+    readonly label: string;
+    readonly missingMarkers: readonly string[];
+}
+export interface OpenclawTier1Result {
+    readonly code: 0 | 1 | 2;
+    readonly findings: readonly OpenclawTier1Finding[];
+    readonly message: string;
+    readonly stream: "stdout" | "stderr";
+}
+export interface OpenclawTier1Options {
+    readonly targets?: readonly OpenclawTier1Target[];
+    readonly quiet?: boolean;
+}
+export declare function evaluateOpenclawTier1(projectRoot: string, options?: OpenclawTier1Options): OpenclawTier1Result;
+//# sourceMappingURL=openclaw-tier1.d.ts.map