@deftai/directive-core 0.88.0 → 0.89.0

package/dist/policy/hotfix-criteria.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Typed hotfix classifier (#1193 R2 / Wave 2 of #2948).
+ *
+ * Hard structural predicates — not agent judgement. Agent may propose the
+ * label `hotfix-candidate` only; a human promotes to `hotfix`. Pipeline keys
+ * off `hotfix` exclusively; `hotfix-candidate` has zero pipeline meaning.
+ */
+import type { HotfixCriteria } from "@deftai/directive-types";
+export declare const FIELD_HOTFIX_CRITERIA = "plan.policy.hotfixCriteria";
+export declare const FIELD_HOTFIX_CRITERIA_CLI_ALIAS = "hotfixCriteria";
+/** Agent-proposed beacon only — never pipeline-authorizing. */
+export declare const HOTFIX_CANDIDATE_LABEL: "hotfix-candidate";
+/** Human-promoted label; deploy pipeline keys off this exclusively. */
+export declare const HOTFIX_LABEL: "hotfix";
+export declare const DEFAULT_HOTFIX_MAX_LINES = 10;
+export declare const DEFAULT_HOTFIX_MAX_FILES = 2;
+/** Paths that never qualify as hotfix (deploy / CI / migrations / secrets). */
+export declare const DEFAULT_FORBIDDEN_PATH_GLOBS: readonly string[];
+export declare const DEFAULT_HOTFIX_CRITERIA: Required<HotfixCriteria>;
+export interface HotfixEligibilityInput {
+    /** Total lines added+removed (or equivalent structural line count). */
+    readonly linesChanged: number;
+    /** Distinct files touched. */
+    readonly filesChanged: number;
+    /** Project-relative POSIX paths in the diff. */
+    readonly paths: readonly string[];
+    /** Pure revert of a prior change — always eligible. */
+    readonly isPureRevert?: boolean;
+    /** One-character / trivial edit signal (always eligible when true with restoresGreen). */
+    readonly isOneCharacterEdit?: boolean;
+    /** Refactors of any size are never hotfix. */
+    readonly isRefactor?: boolean;
+    /** New package / dependency entries. */
+    readonly addsNewDependency?: boolean;
+    /** Adds, removes, or renames an exported symbol/surface. */
+    readonly changesExportedSurface?: boolean;
+    /** Schema or migration changes. */
+    readonly touchesSchemaOrMigration?: boolean;
+    /** New handler/route/media-type surface. */
+    readonly addsNewHandlerOrRoute?: boolean;
+    /** Build was green on main; this change restores green. */
+    readonly restoresGreen?: boolean;
+    /** Criteria override (defaults + project typed policy). */
+    readonly criteria?: HotfixCriteria | null;
+}
+export type HotfixDenyReason = "refactor" | "new-export" | "new-dependency" | "schema-migration" | "new-handler-route" | "forbidden-path" | "too-many-lines" | "too-many-files" | "not-restoring-green";
+export interface HotfixEligibilityResult {
+    readonly eligible: boolean;
+    /** When eligible, the agent may apply this label only. */
+    readonly proposedLabel: typeof HOTFIX_CANDIDATE_LABEL | null;
+    readonly reasons: readonly string[];
+    readonly denyCodes: readonly HotfixDenyReason[];
+    readonly criteria: Required<HotfixCriteria>;
+}
+/**
+ * Pure hotfix eligibility evaluator (#1193 R2).
+ *
+ * Eligible (agent may propose `hotfix-candidate`):
+ * - pure revert always
+ * - one-character edit that restores green
+ * - small fix: ≤ maxLines AND ≤ maxFiles, no new deps/exports/schema, no forbidden
+ *   paths, not a refactor, restores green
+ *
+ * Never eligible: refactors, new handlers/routes, export surface changes, forbidden paths.
+ */
+export declare function evaluateHotfixEligibility(input: HotfixEligibilityInput): HotfixEligibilityResult;
+/** Resolve typed hotfixCriteria from a raw policy block value. */
+export declare function resolveHotfixCriteria(raw: unknown): Required<HotfixCriteria>;
+export interface HotfixCriteriaPolicyField {
+    readonly name: string;
+    readonly current: Required<HotfixCriteria>;
+    readonly default: Required<HotfixCriteria>;
+    readonly source: string;
+}
+/** Inspector row for `policy:show --field=hotfixCriteria`. */
+export declare function inspectHotfixCriteria(data: Record<string, unknown> | null): HotfixCriteriaPolicyField;
+/** Load hotfix criteria from project root. */
+export declare function loadHotfixCriteriaFromProject(projectRoot: string): Required<HotfixCriteria>;
+//# sourceMappingURL=hotfix-criteria.d.ts.map

package/dist/policy/hotfix-criteria.js

@@ -0,0 +1,197 @@
+/**
+ * Typed hotfix classifier (#1193 R2 / Wave 2 of #2948).
+ *
+ * Hard structural predicates — not agent judgement. Agent may propose the
+ * label `hotfix-candidate` only; a human promotes to `hotfix`. Pipeline keys
+ * off `hotfix` exclusively; `hotfix-candidate` has zero pipeline meaning.
+ */
+import { matchAny } from "../orchestration/pathspec.js";
+import { readPlanPolicy } from "./plan-extensions.js";
+import { loadProjectDefinition } from "./resolve.js";
+export const FIELD_HOTFIX_CRITERIA = "plan.policy.hotfixCriteria";
+export const FIELD_HOTFIX_CRITERIA_CLI_ALIAS = "hotfixCriteria";
+/** Agent-proposed beacon only — never pipeline-authorizing. */
+export const HOTFIX_CANDIDATE_LABEL = "hotfix-candidate";
+/** Human-promoted label; deploy pipeline keys off this exclusively. */
+export const HOTFIX_LABEL = "hotfix";
+export const DEFAULT_HOTFIX_MAX_LINES = 10;
+export const DEFAULT_HOTFIX_MAX_FILES = 2;
+/** Paths that never qualify as hotfix (deploy / CI / migrations / secrets). */
+export const DEFAULT_FORBIDDEN_PATH_GLOBS = [
+    "Dockerfile",
+    "**/Dockerfile",
+    "fly.toml",
+    "**/fly.toml",
+    ".github/workflows/**",
+    "migrations/**",
+    "**/migrations/**",
+    "**/*secret*",
+    "**/*billing*",
+    "**/.env",
+    "**/.env.*",
+    "**/auth/**",
+    "**/secrets/**",
+];
+export const DEFAULT_HOTFIX_CRITERIA = {
+    maxLines: DEFAULT_HOTFIX_MAX_LINES,
+    maxFiles: DEFAULT_HOTFIX_MAX_FILES,
+    forbiddenPathGlobs: DEFAULT_FORBIDDEN_PATH_GLOBS,
+};
+function normalizeCriteria(raw) {
+    const maxLines = typeof raw?.maxLines === "number" && Number.isInteger(raw.maxLines) && raw.maxLines >= 0
+        ? raw.maxLines
+        : DEFAULT_HOTFIX_MAX_LINES;
+    const maxFiles = typeof raw?.maxFiles === "number" && Number.isInteger(raw.maxFiles) && raw.maxFiles >= 0
+        ? raw.maxFiles
+        : DEFAULT_HOTFIX_MAX_FILES;
+    const forbidden = Array.isArray(raw?.forbiddenPathGlobs) && raw.forbiddenPathGlobs.length > 0
+        ? raw.forbiddenPathGlobs.filter((g) => typeof g === "string" && g.length > 0)
+        : DEFAULT_FORBIDDEN_PATH_GLOBS;
+    return { maxLines, maxFiles, forbiddenPathGlobs: forbidden };
+}
+function pathIsForbidden(path, globs) {
+    const posix = path.replace(/\\/g, "/");
+    // Basename-only defaults (Dockerfile, fly.toml) match any depth.
+    const base = posix.includes("/") ? posix.slice(posix.lastIndexOf("/") + 1) : posix;
+    for (const g of globs) {
+        if (!g.includes("/") && !g.includes("*") && base === g)
+            return true;
+    }
+    return matchAny(globs, posix);
+}
+/**
+ * Pure hotfix eligibility evaluator (#1193 R2).
+ *
+ * Eligible (agent may propose `hotfix-candidate`):
+ * - pure revert always
+ * - one-character edit that restores green
+ * - small fix: ≤ maxLines AND ≤ maxFiles, no new deps/exports/schema, no forbidden
+ *   paths, not a refactor, restores green
+ *
+ * Never eligible: refactors, new handlers/routes, export surface changes, forbidden paths.
+ */
+export function evaluateHotfixEligibility(input) {
+    const criteria = normalizeCriteria(input.criteria);
+    const denyCodes = [];
+    const reasons = [];
+    if (input.isPureRevert === true) {
+        return {
+            eligible: true,
+            proposedLabel: HOTFIX_CANDIDATE_LABEL,
+            reasons: ["pure-revert always qualifies as hotfix-candidate"],
+            denyCodes: [],
+            criteria,
+        };
+    }
+    if (input.isOneCharacterEdit === true && input.restoresGreen !== false) {
+        return {
+            eligible: true,
+            proposedLabel: HOTFIX_CANDIDATE_LABEL,
+            reasons: ["one-character edit that restores green qualifies as hotfix-candidate"],
+            denyCodes: [],
+            criteria,
+        };
+    }
+    if (input.isRefactor === true) {
+        denyCodes.push("refactor");
+        reasons.push("refactors of any size are never hotfix");
+    }
+    if (input.changesExportedSurface === true) {
+        denyCodes.push("new-export");
+        reasons.push("exported surface add/remove/rename is never hotfix");
+    }
+    if (input.addsNewDependency === true) {
+        denyCodes.push("new-dependency");
+        reasons.push("new dependencies are never hotfix");
+    }
+    if (input.touchesSchemaOrMigration === true) {
+        denyCodes.push("schema-migration");
+        reasons.push("schema/migration changes are never hotfix");
+    }
+    if (input.addsNewHandlerOrRoute === true) {
+        denyCodes.push("new-handler-route");
+        reasons.push("new handlers/routes/media types are never hotfix");
+    }
+    for (const p of input.paths) {
+        if (pathIsForbidden(p, criteria.forbiddenPathGlobs)) {
+            denyCodes.push("forbidden-path");
+            reasons.push(`forbidden path: ${p}`);
+            break;
+        }
+    }
+    if (input.linesChanged > criteria.maxLines) {
+        denyCodes.push("too-many-lines");
+        reasons.push(`linesChanged ${input.linesChanged} > maxLines ${criteria.maxLines}`);
+    }
+    if (input.filesChanged > criteria.maxFiles) {
+        denyCodes.push("too-many-files");
+        reasons.push(`filesChanged ${input.filesChanged} > maxFiles ${criteria.maxFiles}`);
+    }
+    // Small-fix path requires restoring green unless pure-revert/one-char already returned.
+    if (input.restoresGreen === false) {
+        denyCodes.push("not-restoring-green");
+        reasons.push("change does not restore green on main");
+    }
+    if (denyCodes.length > 0) {
+        return {
+            eligible: false,
+            proposedLabel: null,
+            reasons,
+            denyCodes,
+            criteria,
+        };
+    }
+    return {
+        eligible: true,
+        proposedLabel: HOTFIX_CANDIDATE_LABEL,
+        reasons: [
+            `small fix within limits (≤${criteria.maxLines} lines, ≤${criteria.maxFiles} files); ` +
+                "agent may apply hotfix-candidate only — human promotes hotfix",
+        ],
+        denyCodes: [],
+        criteria,
+    };
+}
+/** Resolve typed hotfixCriteria from a raw policy block value. */
+export function resolveHotfixCriteria(raw) {
+    if (raw === null || raw === undefined)
+        return { ...DEFAULT_HOTFIX_CRITERIA };
+    if (typeof raw !== "object" || Array.isArray(raw))
+        return { ...DEFAULT_HOTFIX_CRITERIA };
+    return normalizeCriteria(raw);
+}
+/** Inspector row for `policy:show --field=hotfixCriteria`. */
+export function inspectHotfixCriteria(data) {
+    const defaults = { ...DEFAULT_HOTFIX_CRITERIA };
+    if (data === null) {
+        return { name: FIELD_HOTFIX_CRITERIA, current: defaults, default: defaults, source: "default" };
+    }
+    const policyBlock = readPlanPolicy(data.plan);
+    if (typeof policyBlock !== "object" ||
+        policyBlock === null ||
+        Array.isArray(policyBlock) ||
+        !("hotfixCriteria" in policyBlock)) {
+        return { name: FIELD_HOTFIX_CRITERIA, current: defaults, default: defaults, source: "default" };
+    }
+    return {
+        name: FIELD_HOTFIX_CRITERIA,
+        current: resolveHotfixCriteria(policyBlock.hotfixCriteria),
+        default: defaults,
+        source: "typed",
+    };
+}
+/** Load hotfix criteria from project root. */
+export function loadHotfixCriteriaFromProject(projectRoot) {
+    const [data] = loadProjectDefinition(projectRoot);
+    if (data === null)
+        return { ...DEFAULT_HOTFIX_CRITERIA };
+    const policyBlock = readPlanPolicy(data.plan);
+    if (typeof policyBlock !== "object" ||
+        policyBlock === null ||
+        Array.isArray(policyBlock) ||
+        !("hotfixCriteria" in policyBlock)) {
+        return { ...DEFAULT_HOTFIX_CRITERIA };
+    }
+    return resolveHotfixCriteria(policyBlock.hotfixCriteria);
+}
+//# sourceMappingURL=hotfix-criteria.js.map

package/dist/policy/index.d.ts

@@ -4,17 +4,21 @@ export * from "./capacity.js";
 export * from "./decisions.js";
 export * from "./disclosure.js";
 export * from "./host-hooks.js";
+export * from "./hotfix-criteria.js";
+export * from "./intent-ceiling.js";
 export * from "./no-deft-directive.js";
 export * from "./org-force-on-migration.js";
 export * from "./plan-extensions.js";
 export * from "./policy-invocation.js";
 export * from "./product-signal.js";
+export * from "./require-human-merge.js";
 export * from "./resolve.js";
 export * from "./runtime-authority.js";
 export * from "./staleness-tickler.js";
 export * from "./value-feedback.js";
 export * from "./value-feedback-autoenable.js";
 export * from "./wip.js";
+export * from "./write-fence.js";
 export declare const FIELD_ALLOW_DIRECT_COMMITS = "plan.policy.allowDirectCommitsToMaster";
 export declare const FIELD_WIP_CAP = "plan.policy.wipCap";
 export declare const FIELD_SESSION_RITUAL_STALENESS_HOURS = "plan.policy.sessionRitualStalenessHours";

package/dist/policy/index.js

@@ -1,6 +1,8 @@
 import { FIELD_HOST_HOOKS, FIELD_HOST_HOOKS_CLI_ALIAS, inspectHostHooks } from "./host-hooks.js";
+import { FIELD_HOTFIX_CRITERIA, FIELD_HOTFIX_CRITERIA_CLI_ALIAS, inspectHotfixCriteria, } from "./hotfix-criteria.js";
 import { readPlanPolicy } from "./plan-extensions.js";
 import { FIELD_PRODUCT_SIGNAL, FIELD_PRODUCT_SIGNAL_CLI_ALIAS, inspectProductSignal, } from "./product-signal.js";
+import { FIELD_REQUIRE_HUMAN_MERGE, FIELD_REQUIRE_HUMAN_MERGE_CLI_ALIAS, inspectRequireHumanMerge, } from "./require-human-merge.js";
 import { coerceLegacyNarrative, LEGACY_NARRATIVE_KEY, loadProjectDefinition } from "./resolve.js";
 import { FIELD_RUNTIME_AUTHORITY, FIELD_RUNTIME_AUTHORITY_CLI_ALIAS, inspectRuntimeAuthority, } from "./runtime-authority.js";
 import { FIELD_STALENESS_TICKLER, FIELD_STALENESS_TICKLER_CLI_ALIAS, inspectStalenessTickler, } from "./staleness-tickler.js";
@@ -12,17 +14,21 @@ export * from "./capacity.js";
 export * from "./decisions.js";
 export * from "./disclosure.js";
 export * from "./host-hooks.js";
+export * from "./hotfix-criteria.js";
+export * from "./intent-ceiling.js";
 export * from "./no-deft-directive.js";
 export * from "./org-force-on-migration.js";
 export * from "./plan-extensions.js";
 export * from "./policy-invocation.js";
 export * from "./product-signal.js";
+export * from "./require-human-merge.js";
 export * from "./resolve.js";
 export * from "./runtime-authority.js";
 export * from "./staleness-tickler.js";
 export * from "./value-feedback.js";
 export * from "./value-feedback-autoenable.js";
 export * from "./wip.js";
+export * from "./write-fence.js";
 export const FIELD_ALLOW_DIRECT_COMMITS = "plan.policy.allowDirectCommitsToMaster";
 export const FIELD_WIP_CAP = "plan.policy.wipCap";
 export const FIELD_SESSION_RITUAL_STALENESS_HOURS = "plan.policy.sessionRitualStalenessHours";
@@ -272,6 +278,24 @@ function inspectHostHooksField(data) {
         source: field.source,
     };
 }
+function inspectRequireHumanMergeField(data, projectRoot) {
+    const field = inspectRequireHumanMerge(data, projectRoot);
+    return {
+        name: field.name,
+        current: field.current,
+        default: field.default,
+        source: field.source,
+    };
+}
+function inspectHotfixCriteriaField(data) {
+    const field = inspectHotfixCriteria(data);
+    return {
+        name: field.name,
+        current: field.current,
+        default: field.default,
+        source: field.source,
+    };
+}
 const REGISTERED_POLICIES = [
     inspectAllowDirectCommits,
     inspectWipCap,
@@ -289,6 +313,8 @@ const REGISTERED_POLICIES = [
     inspectRuntimeAuthorityField,
     inspectProductSignalField,
     inspectValueFeedbackField,
+    inspectRequireHumanMergeField,
+    inspectHotfixCriteriaField,
 ];
 /** Walk registered inspectors and return one row per field (#1148). */
 export function inspectAllPolicies(projectRoot) {
@@ -307,7 +333,11 @@ export function inspectOnePolicy(name, projectRoot) {
                     ? FIELD_RUNTIME_AUTHORITY
                     : name === FIELD_HOST_HOOKS_CLI_ALIAS
                         ? FIELD_HOST_HOOKS
-                        : name;
+                        : name === FIELD_REQUIRE_HUMAN_MERGE_CLI_ALIAS
+                            ? FIELD_REQUIRE_HUMAN_MERGE
+                            : name === FIELD_HOTFIX_CRITERIA_CLI_ALIAS
+                                ? FIELD_HOTFIX_CRITERIA
+                                : name;
     for (const field of inspectAllPolicies(projectRoot)) {
         if (field.name === normalized)
             return field;

package/dist/policy/intent-ceiling.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Slash-command intent containment (#1193 / extends #810).
+ *
+ * When a session inherits a slash command as its verb, that verb is the *only*
+ * authorized intent for the session. Non-implement verbs must not authorize
+ * implement / push / PR / merge / deploy tool paths.
+ *
+ * Provenance: set `DEFT_SESSION_SLASH_VERB` (e.g. `/github-issue`, `github-issue`,
+ * `/build`) for the session, or pass `sessionVerb` explicitly to pure evaluators.
+ */
+/** Env var carrying the session's slash-command verb (#1193). */
+export declare const ENV_SESSION_SLASH_VERB = "DEFT_SESSION_SLASH_VERB";
+/**
+ * Free-text action verbs that authorize implementation under #810.
+ * Parallel list for slash forms lives in IMPLEMENT_SLASH_VERBS.
+ */
+export declare const FREE_TEXT_IMPLEMENT_VERBS: readonly ["build", "implement", "ship", "swarm", "run agents", "start agent"];
+/**
+ * Slash-command stems that authorize implementation (#1193 R1).
+ * Matched after normalizing `/prefix` and `:namespace` forms.
+ */
+export declare const IMPLEMENT_SLASH_VERBS: Set<string>;
+/**
+ * Explicit non-implement slash stems — always contained.
+ * Unknown stems default to non-implement (fail closed for lifecycle escalation).
+ */
+export declare const NON_IMPLEMENT_SLASH_VERBS: Set<string>;
+/** Lifecycle ops gated by the intent ceiling. */
+export declare const INTENT_CEILING_OPS: readonly ["implement", "push", "pr", "merge", "deploy"];
+export type IntentCeilingOp = (typeof INTENT_CEILING_OPS)[number];
+export type IntentCeilingCode = "intent-allow-no-slash" | "intent-allow-implement-verb" | "intent-deny-non-implement" | "intent-deny-unknown-slash";
+export interface IntentCeilingDecision {
+    readonly allowed: boolean;
+    readonly code: IntentCeilingCode;
+    readonly reason: string;
+    /** Normalized slash stem (without leading `/`), or null when no slash provenance. */
+    readonly sessionVerb: string | null;
+    readonly requestedOp: IntentCeilingOp;
+}
+/**
+ * Normalize a slash command or free-text verb to a comparable stem.
+ * `/deft:directive:github-issue` → `github-issue`; `/build` → `build`.
+ */
+export declare function normalizeSessionVerb(raw: string | null | undefined): string | null;
+/** True when the normalized stem authorizes implementation. */
+export declare function isImplementSlashVerb(stem: string | null): boolean;
+/** True when the stem is an explicitly known non-implement command. */
+export declare function isNonImplementSlashVerb(stem: string | null): boolean;
+export interface EvaluateIntentCeilingInput {
+    readonly sessionVerb?: string | null;
+    readonly requestedOp: IntentCeilingOp;
+}
+/**
+ * Pure intent-ceiling evaluator (#1193 R1).
+ *
+ * - No slash verb → allow (free-text #810 action-verb remains agent/AGENTS gate).
+ * - Implement slash verb → allow all lifecycle ops.
+ * - Non-implement / unknown slash verb → deny implement/push/pr/merge/deploy.
+ */
+export declare function evaluateIntentCeiling(input: EvaluateIntentCeilingInput): IntentCeilingDecision;
+/** Read session slash verb from the environment. */
+export declare function readSessionSlashVerbFromEnv(env?: NodeJS.ProcessEnv): string | null;
+/**
+ * Evaluate intent ceiling for a lifecycle op using env-backed session verb.
+ * Convenience for preflight / hooks / merge gates.
+ */
+export declare function evaluateIntentCeilingFromEnv(requestedOp: IntentCeilingOp, env?: NodeJS.ProcessEnv): IntentCeilingDecision;
+/**
+ * Map classifiable shell/MCP lifecycle signals onto intent-ceiling ops.
+ * Returns null when the tool path is not a gated lifecycle op.
+ */
+export declare function intentOpFromShellSignals(signals: {
+    readonly isPush?: boolean;
+    readonly isMerge?: boolean;
+    readonly isPr?: boolean;
+    readonly isDeploy?: boolean;
+    readonly isImplement?: boolean;
+}): IntentCeilingOp | null;
+//# sourceMappingURL=intent-ceiling.d.ts.map

package/dist/policy/intent-ceiling.js

@@ -0,0 +1,181 @@
+/**
+ * Slash-command intent containment (#1193 / extends #810).
+ *
+ * When a session inherits a slash command as its verb, that verb is the *only*
+ * authorized intent for the session. Non-implement verbs must not authorize
+ * implement / push / PR / merge / deploy tool paths.
+ *
+ * Provenance: set `DEFT_SESSION_SLASH_VERB` (e.g. `/github-issue`, `github-issue`,
+ * `/build`) for the session, or pass `sessionVerb` explicitly to pure evaluators.
+ */
+/** Env var carrying the session's slash-command verb (#1193). */
+export const ENV_SESSION_SLASH_VERB = "DEFT_SESSION_SLASH_VERB";
+/**
+ * Free-text action verbs that authorize implementation under #810.
+ * Parallel list for slash forms lives in IMPLEMENT_SLASH_VERBS.
+ */
+export const FREE_TEXT_IMPLEMENT_VERBS = [
+    "build",
+    "implement",
+    "ship",
+    "swarm",
+    "run agents",
+    "start agent",
+];
+/**
+ * Slash-command stems that authorize implementation (#1193 R1).
+ * Matched after normalizing `/prefix` and `:namespace` forms.
+ */
+export const IMPLEMENT_SLASH_VERBS = new Set([
+    "build",
+    "implement",
+    "ship",
+    "ship-hotfix",
+    "swarm",
+    "start-agent",
+    "start_agent",
+    "run-agents",
+    "run_agents",
+]);
+/**
+ * Explicit non-implement slash stems — always contained.
+ * Unknown stems default to non-implement (fail closed for lifecycle escalation).
+ */
+export const NON_IMPLEMENT_SLASH_VERBS = new Set([
+    "github-issue",
+    "github_issue",
+    "issue",
+    "triage",
+    "refine",
+    "refinement",
+    "discuss",
+    "research",
+    "probe",
+    "glossary",
+    "sync",
+    "continue",
+    "checkpoint",
+    "feedback",
+    "article-review",
+    "cost",
+    "setup",
+    "interview",
+    "map",
+    "yolo",
+    "speckit",
+    "change",
+]);
+/** Lifecycle ops gated by the intent ceiling. */
+export const INTENT_CEILING_OPS = ["implement", "push", "pr", "merge", "deploy"];
+/**
+ * Normalize a slash command or free-text verb to a comparable stem.
+ * `/deft:directive:github-issue` → `github-issue`; `/build` → `build`.
+ */
+export function normalizeSessionVerb(raw) {
+    if (raw === null || raw === undefined)
+        return null;
+    let s = raw.trim().toLowerCase();
+    if (s.length === 0)
+        return null;
+    // Strip leading slashes.
+    while (s.startsWith("/"))
+        s = s.slice(1);
+    // Drop product namespaces: deft:directive:github-issue → github-issue
+    if (s.includes(":")) {
+        const parts = s.split(":").filter((p) => p.length > 0);
+        s = parts[parts.length - 1] ?? s;
+    }
+    // Normalize underscores to hyphens for allowlist matching.
+    s = s.replace(/_/g, "-");
+    return s.length > 0 ? s : null;
+}
+/** True when the normalized stem authorizes implementation. */
+export function isImplementSlashVerb(stem) {
+    if (stem === null)
+        return false;
+    if (IMPLEMENT_SLASH_VERBS.has(stem))
+        return true;
+    // Free-text multi-word forms already hyphenated by normalize (run agents → not here).
+    return false;
+}
+/** True when the stem is an explicitly known non-implement command. */
+export function isNonImplementSlashVerb(stem) {
+    if (stem === null)
+        return false;
+    return NON_IMPLEMENT_SLASH_VERBS.has(stem);
+}
+/**
+ * Pure intent-ceiling evaluator (#1193 R1).
+ *
+ * - No slash verb → allow (free-text #810 action-verb remains agent/AGENTS gate).
+ * - Implement slash verb → allow all lifecycle ops.
+ * - Non-implement / unknown slash verb → deny implement/push/pr/merge/deploy.
+ */
+export function evaluateIntentCeiling(input) {
+    const stem = normalizeSessionVerb(input.sessionVerb ?? null);
+    const op = input.requestedOp;
+    if (stem === null) {
+        return {
+            allowed: true,
+            code: "intent-allow-no-slash",
+            reason: "No slash-command session verb; free-text #810 action-verb rules apply.",
+            sessionVerb: null,
+            requestedOp: op,
+        };
+    }
+    if (isImplementSlashVerb(stem)) {
+        return {
+            allowed: true,
+            code: "intent-allow-implement-verb",
+            reason: `Slash verb '/${stem}' authorizes implementation lifecycle ops.`,
+            sessionVerb: stem,
+            requestedOp: op,
+        };
+    }
+    const knownNon = isNonImplementSlashVerb(stem);
+    const code = knownNon
+        ? "intent-deny-non-implement"
+        : "intent-deny-unknown-slash";
+    return {
+        allowed: false,
+        code,
+        reason: `Slash-command intent ceiling (#1193): session verb '/${stem}' does not authorize ` +
+            `${op}. Non-implement verbs terminate at their named outcome; file a follow-up issue ` +
+            `instead of escalating to implement/push/PR/merge/deploy. ` +
+            `Implement verbs: /build, /ship, /ship-hotfix, /swarm, /implement.`,
+        sessionVerb: stem,
+        requestedOp: op,
+    };
+}
+/** Read session slash verb from the environment. */
+export function readSessionSlashVerbFromEnv(env = process.env) {
+    return normalizeSessionVerb(env[ENV_SESSION_SLASH_VERB] ?? null);
+}
+/**
+ * Evaluate intent ceiling for a lifecycle op using env-backed session verb.
+ * Convenience for preflight / hooks / merge gates.
+ */
+export function evaluateIntentCeilingFromEnv(requestedOp, env = process.env) {
+    return evaluateIntentCeiling({
+        sessionVerb: readSessionSlashVerbFromEnv(env),
+        requestedOp,
+    });
+}
+/**
+ * Map classifiable shell/MCP lifecycle signals onto intent-ceiling ops.
+ * Returns null when the tool path is not a gated lifecycle op.
+ */
+export function intentOpFromShellSignals(signals) {
+    if (signals.isDeploy)
+        return "deploy";
+    if (signals.isMerge)
+        return "merge";
+    if (signals.isPr)
+        return "pr";
+    if (signals.isPush)
+        return "push";
+    if (signals.isImplement)
+        return "implement";
+    return null;
+}
+//# sourceMappingURL=intent-ceiling.js.map

package/dist/policy/no-deft-directive.js

@@ -13,8 +13,9 @@
  *   mutating install/update paths **fail closed**.
  * - Creating the flag does **not** delete an existing deposit.
  */
-import { existsSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { existsSync, statSync, unlinkSync } from "node:fs";
 import { join, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
 import { assertWriteTargetSafe } from "../fs/projection-containment.js";
 import { CANONICAL_INSTALL_ROOT } from "../init-deposit/constants.js";
 /** Canonical root-only filename (lowercase). Presence = flag. */
@@ -75,13 +76,19 @@ export function isNoDeftDirectivePresent(projectRoot, seams = {}) {
  */
 export function createNoDeftDirectiveFlag(projectRoot, options = {}) {
     const path = noDeftDirectiveFlagPath(projectRoot);
-    assertWriteTargetSafe(projectRoot, path);
     if (defaultIsDir(path)) {
         throw new Error(`${NO_DEFT_DIRECTIVE_FLAG_NAME} exists as a directory at ${path}; remove it before creating the opt-out flag file.`);
     }
     const rationale = options.rationale?.trim() ?? "";
     const body = rationale.length > 0 ? `# ${rationale}\n` : "";
-    writeFileSync(path, body, "utf8");
+    // #2951: product write sinks route through containedWrite (create|replace).
+    // Use replace so re-running with a new rationale updates the flag file.
+    containedWrite({
+        root: resolve(projectRoot),
+        target: path,
+        data: body,
+        mode: "replace",
+    });
     return path;
 }
 /**