@deftai/directive-core 0.87.0 → 0.89.0

package/dist/verify-source/contained-writes.d.ts

@@ -0,0 +1,59 @@
+/**
+ * contained-writes.ts — inventory gate for raw product write sinks (#2951).
+ *
+ * Scans TypeScript under packages/core/src (and optional roots) for raw write
+ * call patterns (`writeFileSync`, `appendFileSync`, `fs.writeFile`, etc.)
+ * outside an allowlist. Default remains **fail-open** (advisory exit 0) while
+ * mass migration continues; pass `--enforce` to fail closed (Phase 2+).
+ *
+ * Allowlist is the residual set of modules not yet migrated onto containedWrite.
+ * Phase 2 removed cache/io + lifecycle/events after sink migration.
+ *
+ * Exit codes:
+ *   0 — clean OR fail-open with findings (default)
+ *   1 — findings under `--enforce` (fail-closed)
+ *   2 — config error (project root missing)
+ *
+ * Refs #2951, #2980 (e2e/parity harness exclusions).
+ */
+/** Patterns that indicate a raw filesystem write sink in product code. */
+export declare const RAW_WRITE_PATTERNS: readonly RegExp[];
+/**
+ * Relative path prefixes (posix-style) allowed to use raw write sinks.
+ * Shrink as sinks migrate onto containedWrite (#2951 Phase 2+).
+ */
+export declare const CONTAINED_WRITES_ALLOWLIST: readonly string[];
+/**
+ * Non-product harness path markers excluded from the product inventory (#2980).
+ * Prefer exclusion over permanent CONTAINED_WRITES_ALLOWLIST entries for e2e/parity noise.
+ * Paths are matched as posix substrings after `toPosix` (always `/` separators).
+ */
+export declare const NON_PRODUCT_HARNESS_PATH_MARKERS: readonly string[];
+export interface ContainedWriteFinding {
+    readonly path: string;
+    readonly line: number;
+    readonly match: string;
+}
+export interface ContainedWritesOptions {
+    readonly projectRoot: string;
+    /** When true, exit 1 if any non-allowlisted raw write is found. Default false (fail-open). */
+    readonly enforce?: boolean;
+    /** Extra relative path prefixes to allow. */
+    readonly extraAllowlist?: readonly string[];
+    /** Roots to scan relative to projectRoot. Default packages/core/src. */
+    readonly scanRoots?: readonly string[];
+}
+export interface ContainedWritesResult {
+    readonly code: 0 | 1 | 2;
+    readonly message: string;
+    readonly stream: "stdout" | "stderr";
+    readonly findings: readonly ContainedWriteFinding[];
+    readonly enforce: boolean;
+    readonly failOpen: boolean;
+}
+/**
+ * Inventory raw write sinks under scan roots; fail-open by default (#2951).
+ * Pass `enforce: true` / `--enforce` to fail closed on findings (Phase 2 path).
+ */
+export declare function evaluateContainedWrites(options: ContainedWritesOptions): ContainedWritesResult;
+//# sourceMappingURL=contained-writes.d.ts.map

package/dist/verify-source/contained-writes.js

@@ -0,0 +1,272 @@
+/**
+ * contained-writes.ts — inventory gate for raw product write sinks (#2951).
+ *
+ * Scans TypeScript under packages/core/src (and optional roots) for raw write
+ * call patterns (`writeFileSync`, `appendFileSync`, `fs.writeFile`, etc.)
+ * outside an allowlist. Default remains **fail-open** (advisory exit 0) while
+ * mass migration continues; pass `--enforce` to fail closed (Phase 2+).
+ *
+ * Allowlist is the residual set of modules not yet migrated onto containedWrite.
+ * Phase 2 removed cache/io + lifecycle/events after sink migration.
+ *
+ * Exit codes:
+ *   0 — clean OR fail-open with findings (default)
+ *   1 — findings under `--enforce` (fail-closed)
+ *   2 — config error (project root missing)
+ *
+ * Refs #2951, #2980 (e2e/parity harness exclusions).
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import { join, relative, resolve, sep } from "node:path";
+const EXIT_OK = 0;
+const EXIT_ENFORCE_FINDINGS = 1;
+const EXIT_CONFIG = 2;
+/** Patterns that indicate a raw filesystem write sink in product code. */
+export const RAW_WRITE_PATTERNS = [
+    /\bwriteFileSync\s*\(/,
+    /\bappendFileSync\s*\(/,
+    /\bfs\.writeFile\s*\(/,
+    /\bfs\.promises\.writeFile\s*\(/,
+    /\bcreateWriteStream\s*\(/,
+    /\bwriteFile\s*\(\s*[^)]+,\s*[^)]+,\s*['"]utf8['"]/,
+    // Low-level / async forms that also bypass containedWrite (#2951 Greptile P1).
+    /\bopenSync\s*\(/,
+    /\bwriteSync\s*\(/,
+    /\bappendFile\s*\(/,
+    /\.writeFile\s*\(/,
+    /\bpromises\.writeFile\s*\(/,
+    /\bfs\.open\s*\(/,
+    /\bfs\.write\s*\(/,
+];
+/**
+ * Relative path prefixes (posix-style) allowed to use raw write sinks.
+ * Shrink as sinks migrate onto containedWrite (#2951 Phase 2+).
+ */
+export const CONTAINED_WRITES_ALLOWLIST = [
+    // Implementation modules for containment + contained write.
+    "packages/core/src/fs/contained-write.ts",
+    "packages/core/src/fs/projection-containment.ts",
+    // Deposit tree copy / contain primitives (low-level install sinks).
+    "packages/core/src/deposit/copy-tree.ts",
+    "packages/core/src/deposit/contain.ts",
+    // Lock / stream primitives (not product payload writers) — #2980 residual.
+    "packages/core/src/slice/lock.ts",
+    "packages/core/src/vbrief-build/project-definition-io.ts", // openSync mutation lock only
+    "packages/core/src/release/build-dist.ts", // createWriteStream archive packer
+    // Temporary residual product sinks (#2980 wave D). Shrink as modules migrate.
+    "packages/core/src/doctor/main.ts",
+    "packages/core/src/eval-health-relocation/evaluate.ts",
+    "packages/core/src/intake/issue-ingest.ts",
+    "packages/core/src/intake/reconcile-issues.ts",
+    "packages/core/src/issue-sync/sync-from-xbrief.ts",
+    "packages/core/src/orchestration/probe-session.ts",
+    "packages/core/src/orchestration/verify-judgment-gates.ts",
+    "packages/core/src/platform/changelog-cli.ts",
+    "packages/core/src/release/gh.ts",
+    "packages/core/src/release/pipeline-fixture.ts",
+    "packages/core/src/release/pipeline.ts",
+    "packages/core/src/render/export-spec.ts",
+    "packages/core/src/render/prd-render.ts",
+    "packages/core/src/render/roadmap-render.ts",
+    "packages/core/src/render/rule-map.ts",
+    "packages/core/src/render/spec-render.ts",
+    "packages/core/src/scm/gh-rest.ts",
+    "packages/core/src/triage/actions/candidates-log.ts",
+    "packages/core/src/triage/bootstrap/index.ts",
+    "packages/core/src/triage/reconcile/reconcile.ts",
+    "packages/core/src/triage/scope-drift/add-ignore.ts",
+    "packages/core/src/triage/scope/coverage.ts",
+    "packages/core/src/triage/scope/mutations-core.ts",
+    "packages/core/src/triage/smoketest/index.ts",
+    "packages/core/src/triage/subscribe/index.ts",
+    "packages/core/src/triage/summary/index.ts",
+    "packages/core/src/vbrief-build/speckit.ts",
+    "packages/core/src/vbrief-reconcile/reconciliation.ts",
+    "packages/core/src/vbrief-validation/safety.ts",
+    "packages/core/src/xbrief-migrate/agents-header.ts",
+    // Phase 2 removed: cache/io.ts, lifecycle/events.ts (migrated to containedWrite).
+];
+/** Path segments that mark a file as test or fixture (always allowlisted). */
+const TEST_PATH_MARKERS = [
+    ".test.ts",
+    ".test.tsx",
+    "/test-helpers.ts",
+    "/fixtures/",
+    "\\fixtures\\",
+];
+/**
+ * Non-product harness path markers excluded from the product inventory (#2980).
+ * Prefer exclusion over permanent CONTAINED_WRITES_ALLOWLIST entries for e2e/parity noise.
+ * Paths are matched as posix substrings after `toPosix` (always `/` separators).
+ */
+export const NON_PRODUCT_HARNESS_PATH_MARKERS = [
+    "/release-e2e/",
+    "/integration-e2e/",
+    "parity-scenarios.ts",
+    "parity-scenarios.tsx",
+];
+function toPosix(p) {
+    return p.split(sep).join("/");
+}
+function isTestPath(relPosix) {
+    return TEST_PATH_MARKERS.some((m) => relPosix.includes(m.replace(/\\/g, "/")));
+}
+/** E2E / parity harness under src/ — not product sinks (#2980 scanner hygiene). */
+function isNonProductHarnessPath(relPosix) {
+    return NON_PRODUCT_HARNESS_PATH_MARKERS.some((m) => relPosix.includes(m));
+}
+/** Strip trailing `/` without regex (CodeQL js/polynomial-redos safe). */
+function stripTrailingSlashes(path) {
+    let end = path.length;
+    while (end > 0 && path.charCodeAt(end - 1) === 47 /* / */) {
+        end -= 1;
+    }
+    return end === path.length ? path : path.slice(0, end);
+}
+function isAllowlisted(relPosix, allow) {
+    if (isTestPath(relPosix) || isNonProductHarnessPath(relPosix)) {
+        return true;
+    }
+    return allow.some((entry) => {
+        // Avoid regex on path input (CodeQL js/polynomial-redos on /\/+$/).
+        const e = stripTrailingSlashes(entry.split("\\").join("/"));
+        // Exact file match, or directory-prefix only (never bare endsWith — that
+        // lets `evil/.../packages/core/src/fs/contained-write.ts` slip through).
+        return relPosix === e || relPosix.startsWith(`${e}/`);
+    });
+}
+function walkTsFiles(dir, out) {
+    let entries;
+    try {
+        entries = readdirSync(dir);
+    }
+    catch {
+        return;
+    }
+    for (const name of entries) {
+        if (name === "node_modules" || name === "dist" || name === ".git") {
+            continue;
+        }
+        const full = join(dir, name);
+        let st;
+        try {
+            st = statSync(full);
+        }
+        catch {
+            continue;
+        }
+        if (st.isDirectory()) {
+            walkTsFiles(full, out);
+        }
+        else if (st.isFile() && (name.endsWith(".ts") || name.endsWith(".tsx"))) {
+            out.push(full);
+        }
+    }
+}
+function scanFile(absPath, relPosix) {
+    let text;
+    try {
+        text = readFileSync(absPath, "utf8");
+    }
+    catch {
+        return [];
+    }
+    const findings = [];
+    const lines = text.split(/\r?\n/);
+    for (let i = 0; i < lines.length; i += 1) {
+        const line = lines[i] ?? "";
+        // Skip import lines and comments-only lines for noise reduction.
+        const trimmed = line.trim();
+        if (trimmed.startsWith("import ") ||
+            trimmed.startsWith("//") ||
+            trimmed.startsWith("*") ||
+            trimmed.startsWith("/*")) {
+            continue;
+        }
+        for (const re of RAW_WRITE_PATTERNS) {
+            if (re.test(line)) {
+                findings.push({
+                    path: relPosix,
+                    line: i + 1,
+                    match: trimmed.length > 100 ? `${trimmed.slice(0, 97)}...` : trimmed,
+                });
+                break;
+            }
+        }
+    }
+    return findings;
+}
+/**
+ * Inventory raw write sinks under scan roots; fail-open by default (#2951).
+ * Pass `enforce: true` / `--enforce` to fail closed on findings (Phase 2 path).
+ */
+export function evaluateContainedWrites(options) {
+    const root = resolve(options.projectRoot);
+    if (!existsSync(root)) {
+        return {
+            code: EXIT_CONFIG,
+            message: `verify:contained-writes: project root not found: ${root}`,
+            stream: "stderr",
+            findings: [],
+            enforce: Boolean(options.enforce),
+            failOpen: !options.enforce,
+        };
+    }
+    const enforce = options.enforce === true;
+    const allow = [...CONTAINED_WRITES_ALLOWLIST, ...(options.extraAllowlist ?? [])];
+    const scanRoots = options.scanRoots ?? ["packages/core/src"];
+    const findings = [];
+    for (const scanRel of scanRoots) {
+        const scanAbs = resolve(root, scanRel);
+        if (!existsSync(scanAbs)) {
+            continue;
+        }
+        const files = [];
+        walkTsFiles(scanAbs, files);
+        for (const abs of files) {
+            const relPosix = toPosix(relative(root, abs));
+            if (isAllowlisted(relPosix, allow)) {
+                continue;
+            }
+            findings.push(...scanFile(abs, relPosix));
+        }
+    }
+    if (findings.length === 0) {
+        return {
+            code: EXIT_OK,
+            message: `OK: verify:contained-writes — no non-allowlisted raw write sinks under ${scanRoots.join(", ")} (enforce=${enforce}).`,
+            stream: "stdout",
+            findings: [],
+            enforce,
+            failOpen: !enforce,
+        };
+    }
+    const lines = [
+        `verify:contained-writes: found ${findings.length} raw write sink(s) outside allowlist:`,
+        ...findings.slice(0, 50).map((f) => `  ${f.path}:${f.line}: ${f.match}`),
+    ];
+    if (findings.length > 50) {
+        lines.push(`  ... and ${findings.length - 50} more`);
+    }
+    if (enforce) {
+        lines.push("FAIL: --enforce is set; migrate sinks to packages/core/src/fs/contained-write.ts or add a justified allowlist entry (#2951).");
+        return {
+            code: EXIT_ENFORCE_FINDINGS,
+            message: lines.join("\n"),
+            stream: "stderr",
+            findings,
+            enforce: true,
+            failOpen: false,
+        };
+    }
+    lines.push("ADVISORY (fail-open): exit 0. Prefer containedWrite() for new sinks; pass --enforce to fail closed. See docs/reference/contained-write.md (#2951 Phase 2).");
+    return {
+        code: EXIT_OK,
+        message: lines.join("\n"),
+        stream: "stdout",
+        findings,
+        enforce: false,
+        failOpen: true,
+    };
+}
+//# sourceMappingURL=contained-writes.js.map

package/dist/verify-source/cursor-tier1.js

@@ -3,14 +3,19 @@ import { join, resolve } from "node:path";
 export const CURSOR_TIER1_TARGETS = [
     {
         path: "content/skills/deft-directive-swarm/SKILL.md",
-        label: "swarm Phase 3 capability matrix",
+        label: "swarm Phase 3 capability matrix (thin skill)",
         markers: [
             "Probe for the Cursor `Task` tool",
             "cursor-composer",
             "cursor-cloud-agent",
-            "Step 2e: Cursor Launch",
+            "host-cursor.md",
         ],
     },
+    {
+        path: "content/skills/deft-directive-swarm/references/host-cursor.md",
+        label: "swarm Cursor host adapter",
+        markers: ["Step 2e: Cursor Launch", "cursor-composer", "Task"],
+    },
     {
         path: "content/skills/deft-directive-review-cycle/SKILL.md",
         label: "review-cycle monitoring tier selection",

package/dist/verify-source/index.d.ts

@@ -1,5 +1,6 @@
 export * from "./biome-config.js";
 export * from "./code-structure-validate.js";
+export * from "./contained-writes.js";
 export * from "./content-manifest.js";
 export { CANONICAL_SCHEMA_REL, type ContractDriftOptions, type ContractDriftResult, evaluateContractDrift, PUBLISHED_SCHEMA_REL, } from "./contract-drift.js";
 export * from "./cursor-tier1.js";

package/dist/verify-source/index.js

@@ -1,5 +1,6 @@
 export * from "./biome-config.js";
 export * from "./code-structure-validate.js";
+export * from "./contained-writes.js";
 export * from "./content-manifest.js";
 export { CANONICAL_SCHEMA_REL, evaluateContractDrift, PUBLISHED_SCHEMA_REL, } from "./contract-drift.js";
 export * from "./cursor-tier1.js";

package/dist/verify-source/openclaw-tier1.js

@@ -3,14 +3,32 @@ import { join, resolve } from "node:path";
 export const OPENCLAW_TIER1_TARGETS = [
     {
         path: "content/skills/deft-directive-swarm/SKILL.md",
-        label: "swarm Phase 3 capability matrix",
+        label: "swarm Phase 3 capability matrix (thin skill)",
         markers: [
             "Probe for the OpenClaw `sessions_spawn` tool",
             "sessions_spawn",
             "openclaw",
+            "host-openclaw.md",
+        ],
+    },
+    {
+        path: "content/skills/deft-directive-swarm/references/host-openclaw.md",
+        label: "swarm OpenClaw host adapter",
+        // Cold-start (#2968 A7): project root + Skills Index before freestyle; keep Tier-1 launch markers.
+        markers: [
             "Step 2f: OpenClaw Launch",
+            "sessions_spawn",
+            "openclaw",
+            "Cold-start",
+            "Skills Index",
+            "project root",
         ],
     },
+    {
+        path: "content/contracts/host-lifecycle-duties.md",
+        label: "host lifecycle duty list contract (#2968 A3)",
+        markers: ["Session start", "Deft-shaped user intent", "Skills Index", "project root"],
+    },
     {
         path: "packages/core/src/swarm/routing.ts",
         label: "swarm routing dispatch_provider",

package/dist/verify-source/verify-stubs.js

@@ -11,6 +11,9 @@ export const EXCLUDE_DIRS = new Set([
     "__pycache__",
     "dist",
     "scripts",
+    // Swarm / agent worktrees are not product source (#2953, #1656).
+    ".deft-scratch",
+    "swarm-worktrees",
 ]);
 export const EXTENSIONS = new Set([".py", ".go", ".sh"]);
 function isWordChar(ch) {

package/dist/xbrief-migrate/migrate-project.js

@@ -1,5 +1,6 @@
-import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync, } from "node:fs";
-import { dirname, join, relative, resolve } from "node:path";
+import { cpSync, existsSync, mkdirSync, readdirSync, readFileSync, rmSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
 import { assertWriteTargetSafe, ProjectionContainmentError } from "../fs/projection-containment.js";
 import { checkGitClean } from "../migrate-preflight/index.js";
 import { applyAgentsRefresh } from "../platform/agents-md.js";
@@ -48,19 +49,30 @@ function mapRelativePath(relativePath) {
         : segment)
         .join("/");
 }
-function writeMigratedFile(srcPath, destPath) {
-    mkdirSync(dirname(destPath), { recursive: true });
+function writeMigratedFile(projectRoot, srcPath, destPath) {
+    // #2980 wave C: product write sink routes through containedWrite.
+    const root = resolve(projectRoot);
     if (srcPath.endsWith(LEGACY_ARTIFACT_SUFFIX)) {
         const parsed = JSON.parse(readFileSync(srcPath, "utf8"));
         const result = transformArtifactV06ToV08Transactional(parsed);
         if (!result.ok) {
             throw new Error(result.error);
         }
-        writeFileSync(destPath, `${JSON.stringify(result.artifact, null, 2)}\n`, "utf8");
+        containedWrite({
+            root,
+            target: destPath,
+            data: `${JSON.stringify(result.artifact, null, 2)}\n`,
+            mode: "replace",
+        });
         return;
     }
     const raw = readFileSync(srcPath, "utf8");
-    writeFileSync(destPath, rewriteEmbeddedTokens(raw), "utf8");
+    containedWrite({
+        root,
+        target: destPath,
+        data: rewriteEmbeddedTokens(raw),
+        mode: "replace",
+    });
 }
 function backupMigrationInputs(projectRoot, legacyDir, migratedDir) {
     const stamp = new Date().toISOString().replace(/[:.]/g, "-");
@@ -100,7 +112,7 @@ function migrateLegacyTree(projectRoot, legacyDir, options) {
             if (shouldOmitLegacyMigrationFile(rel))
                 continue;
             const destPath = join(stagedDir, mapRelativePath(rel));
-            writeMigratedFile(srcPath, destPath);
+            writeMigratedFile(projectRoot, srcPath, destPath);
         }
         overlayCanonicalTriageCache(migratedDir, stagedDir);
         renameOrReplace(stagedDir, migratedDir);
@@ -123,14 +135,16 @@ function migrateLegacyTree(projectRoot, legacyDir, options) {
 /** Idempotently write the legacy-root deprecation marker (#2270 / #2869). */
 function writeVbriefDeprecationMarker(projectRoot, legacyDir) {
     const markerPath = join(legacyDir, VBRIEF_DEPRECATION_MARKER_FILENAME);
-    // Refuse leaf or parent-dir symlink escapes before mkdir/write (#2869).
-    assertWriteTargetSafe(projectRoot, legacyDir);
-    assertWriteTargetSafe(projectRoot, markerPath);
-    mkdirSync(legacyDir, { recursive: true });
+    // Refuse leaf or parent-dir symlink escapes via containedWrite (#2869 / #2980 wave C).
     if (hasVbriefDeprecationMarker(legacyDir)) {
         return;
     }
-    writeFileSync(markerPath, VBRIEF_DEPRECATION_MARKER_BODY, "utf8");
+    containedWrite({
+        root: resolve(projectRoot),
+        target: markerPath,
+        data: VBRIEF_DEPRECATION_MARKER_BODY,
+        mode: "replace",
+    });
 }
 /**
  * Converge a leftover legacy `vbrief/` root to an unambiguous state (#2270).

package/dist/xbrief-migrate/transforms.d.ts

@@ -15,8 +15,10 @@ export declare function readDeclaredArtifactVersion(artifact: JsonObject): strin
 export declare function rewriteEmbeddedTokens(value: string): string;
 /**
  * Convert a single v0.6 in-document artifact to v0.8 semantics.
- * Idempotent: v0.8 artifacts are returned unchanged (deep-cloned).
- * Transactional: on failure the original input object is not mutated.
+ * Accepts classic `vBRIEFInfo@0.6` or hybrid `xBRIEFInfo@0.6` (layout renamed,
+ * envelope not bumped — #2970). Idempotent: v0.8 artifacts are returned
+ * unchanged (deep-cloned). Transactional: on failure the original input
+ * object is not mutated.
  */
 export declare function transformArtifactV06ToV08(input: JsonObject): JsonObject;
 /**

package/dist/xbrief-migrate/transforms.js

@@ -74,30 +74,53 @@ function isAlreadyV08Artifact(artifact) {
     const info = artifact[MIGRATED_INFO_ROOT_KEY];
     return isPlainObject(info) && info.version === VBRIEF_VERSION;
 }
+/**
+ * Resolve a v0.6 info block from classic `vBRIEFInfo` or hybrid `xBRIEFInfo@0.6`.
+ * Prefer the classic key when both are present. Layout rename ≠ envelope bump (#2970).
+ */
+function resolveV06InfoBlock(artifact) {
+    if (LEGACY_INFO_ROOT_KEY in artifact) {
+        const legacyInfo = artifact[LEGACY_INFO_ROOT_KEY];
+        if (!isPlainObject(legacyInfo)) {
+            throw new TransformError(`'${LEGACY_INFO_ROOT_KEY}' must be an object`);
+        }
+        const declaredVersion = legacyInfo.version;
+        if (declaredVersion !== LEGACY_VBRIEF_VERSION) {
+            throw new TransformError(`expected ${LEGACY_INFO_ROOT_KEY}.version ${LEGACY_VBRIEF_VERSION}, got ${String(declaredVersion)}`);
+        }
+        return legacyInfo;
+    }
+    if (MIGRATED_INFO_ROOT_KEY in artifact) {
+        const hybridInfo = artifact[MIGRATED_INFO_ROOT_KEY];
+        if (!isPlainObject(hybridInfo)) {
+            throw new TransformError(`'${MIGRATED_INFO_ROOT_KEY}' must be an object`);
+        }
+        const declaredVersion = hybridInfo.version;
+        if (declaredVersion !== LEGACY_VBRIEF_VERSION) {
+            throw new TransformError(`expected hybrid ${MIGRATED_INFO_ROOT_KEY}.version ${LEGACY_VBRIEF_VERSION} (or ${VBRIEF_VERSION} for already-migrated), got ${String(declaredVersion)}`);
+        }
+        return hybridInfo;
+    }
+    throw new TransformError(`missing required legacy info block '${LEGACY_INFO_ROOT_KEY}' or hybrid '${MIGRATED_INFO_ROOT_KEY}'@${LEGACY_VBRIEF_VERSION} for v0.6 -> v0.8 transform`);
+}
 /**
  * Convert a single v0.6 in-document artifact to v0.8 semantics.
- * Idempotent: v0.8 artifacts are returned unchanged (deep-cloned).
- * Transactional: on failure the original input object is not mutated.
+ * Accepts classic `vBRIEFInfo@0.6` or hybrid `xBRIEFInfo@0.6` (layout renamed,
+ * envelope not bumped — #2970). Idempotent: v0.8 artifacts are returned
+ * unchanged (deep-cloned). Transactional: on failure the original input
+ * object is not mutated.
  */
 export function transformArtifactV06ToV08(input) {
     const working = structuredClone(input);
     if (isAlreadyV08Artifact(working)) {
         return working;
     }
-    if (!(LEGACY_INFO_ROOT_KEY in working)) {
-        throw new TransformError(`missing required legacy info block '${LEGACY_INFO_ROOT_KEY}' for v0.6 -> v0.8 transform`);
-    }
-    const legacyInfo = working[LEGACY_INFO_ROOT_KEY];
-    if (!isPlainObject(legacyInfo)) {
-        throw new TransformError(`'${LEGACY_INFO_ROOT_KEY}' must be an object`);
-    }
-    const declaredVersion = legacyInfo.version;
-    if (declaredVersion !== LEGACY_VBRIEF_VERSION) {
-        throw new TransformError(`expected ${LEGACY_INFO_ROOT_KEY}.version ${LEGACY_VBRIEF_VERSION}, got ${String(declaredVersion)}`);
-    }
+    const info = resolveV06InfoBlock(working);
+    // Drop both keys so a dual-key hybrid cannot leave a stale vBRIEFInfo behind.
     delete working[LEGACY_INFO_ROOT_KEY];
+    delete working[MIGRATED_INFO_ROOT_KEY];
     working[MIGRATED_INFO_ROOT_KEY] = {
-        ...legacyInfo,
+        ...info,
         version: VBRIEF_VERSION,
     };
     const rewritten = deepRewriteValues(working);

package/package.json

@@ -1,7 +1,8 @@
 {
   "name": "@deftai/directive-core",
-  "version": "0.87.0",
+  "version": "0.89.0",
   "description": "TypeScript engine core for the Directive framework.",
+  "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -74,6 +75,14 @@
       "types": "./dist/hooks/index.d.ts",
       "default": "./dist/hooks/index.js"
     },
+    "./authz": {
+      "types": "./dist/authz/index.d.ts",
+      "default": "./dist/authz/index.js"
+    },
+    "./escalation": {
+      "types": "./dist/escalation/index.d.ts",
+      "default": "./dist/escalation/index.js"
+    },
     "./plan-sequence": {
       "types": "./dist/plan-sequence/index.d.ts",
       "default": "./dist/plan-sequence/index.js"
@@ -178,6 +187,10 @@
       "types": "./dist/pr-watch/index.d.ts",
       "default": "./dist/pr-watch/index.js"
     },
+    "./finish-loop": {
+      "types": "./dist/finish-loop/index.d.ts",
+      "default": "./dist/finish-loop/index.js"
+    },
     "./vbrief-build": {
       "types": "./dist/vbrief-build/index.d.ts",
       "default": "./dist/vbrief-build/index.js"
@@ -317,8 +330,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-content": "^0.87.0",
-    "@deftai/directive-types": "^0.87.0",
+    "@deftai/directive-content": "^0.89.0",
+    "@deftai/directive-types": "^0.89.0",
     "archiver": "^8.0.0"
   },
   "scripts": {