@deftai/directive-core 0.88.0 → 0.89.0

package/dist/scope/audit-log.js

@@ -1,6 +1,7 @@
 import { randomUUID } from "node:crypto";
-import { closeSync, existsSync, mkdirSync, openSync, readFileSync, unlinkSync, writeFileSync, writeSync, } from "node:fs";
-import { dirname, join, resolve } from "node:path";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
 import { resolveTriageCachePath } from "../triage/cache-path.js";
 import { utcNowIso } from "./vbrief-json.js";
 export class ScopeAuditLogError extends Error {
@@ -28,6 +29,12 @@ const DEMOTE_META_REQUIRED = [
     "demoted_from",
 ];
 let threadLock = false;
+/** Ensure parent exists and return it as the containment root for log writes. */
+function containmentRootForLog(logPath) {
+    const parent = dirname(logPath);
+    mkdirSync(parent, { recursive: true });
+    return resolve(parent);
+}
 function replacerSortKeys(_key, value) {
     if (typeof value === "object" && value !== null && !Array.isArray(value)) {
         const sorted = {};
@@ -97,34 +104,16 @@ export function canonicalLogPath(projectRoot) {
     // Layout-aware (#1703): triage working-set under `.triage-cache/`.
     return resolveTriageCachePath(resolve(projectRoot), "scope-lifecycle.jsonl");
 }
-function withAppendLock(logPath, fn) {
-    const lockPath = `${logPath}.lock`;
-    mkdirSync(dirname(logPath), { recursive: true });
+function withAppendLock(fn) {
     while (threadLock) {
         /* spin-wait for in-process serialization */
     }
     threadLock = true;
-    let fd = null;
     try {
-        fd = openSync(lockPath, "a+");
-        if (readFileSync(lockPath).length === 0) {
-            writeSync(fd, "\0");
-        }
         fn();
     }
     finally {
         threadLock = false;
-        if (fd !== null) {
-            closeSync(fd);
-        }
-        try {
-            if (existsSync(lockPath)) {
-                unlinkSync(lockPath);
-            }
-        }
-        catch {
-            /* best-effort lock cleanup */
-        }
     }
 }
 /** Validate and append an audit entry; returns decision_id. */
@@ -134,10 +123,16 @@ export function append(entry, logPath) {
     }
     validateEntry(entry);
     const logFile = resolve(logPath);
-    mkdirSync(join(logFile, ".."), { recursive: true });
+    const root = containmentRootForLog(logFile);
     const line = JSON.stringify(entry, replacerSortKeys);
-    withAppendLock(logFile, () => {
-        writeFileSync(logFile, `${line}\n`, { encoding: "utf8", flag: "a" });
+    // #2980 wave B: product write sink routes through containedWrite.
+    withAppendLock(() => {
+        containedWrite({
+            root,
+            target: logFile,
+            data: `${line}\n`,
+            mode: "append",
+        });
     });
     return String(entry.decision_id);
 }

package/dist/scope/decompose.js

@@ -6,10 +6,11 @@
  * A caller supplies a draft with child story definitions; this module validates
  * that draft, writes the child story vBRIEFs, and updates the parent scope references.
  */
-import { accessSync, constants, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { accessSync, constants, existsSync, mkdirSync, readFileSync } from "node:fs";
 import { basename, dirname, isAbsolute, join, resolve, sep } from "node:path";
 import { referenceTypeMatches } from "@deftai/directive-types";
-import { assertWriteTargetSafe, ProjectionContainmentError } from "../fs/projection-containment.js";
+import { containedWrite } from "../fs/contained-write.js";
+import { ProjectionContainmentError } from "../fs/projection-containment.js";
 import { hasArtifactSuffix, LEGACY_ARTIFACT_DIR, MIGRATED_ARTIFACT_DIR, resolveLifecycleRoot, } from "../layout/resolve.js";
 import { referenceWithDefaultTrust, slugify } from "../vbrief-build/build.js";
 import { EMITTED_VBRIEF_VERSION } from "../vbrief-build/constants.js";
@@ -54,9 +55,13 @@ function loadJson(path) {
     return data;
 }
 function writeJson(projectRoot, path, data) {
-    assertWriteTargetSafe(projectRoot, path);
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, formatBriefJson(data), "utf8");
+    // #2980 wave D: product write sink routes through containedWrite.
+    containedWrite({
+        root: resolve(projectRoot),
+        target: path,
+        data: formatBriefJson(data),
+        mode: "replace",
+    });
 }
 // ---------------------------------------------------------------------------
 // Story quality helpers (ported from _vbrief_story_quality.py)

package/dist/scope/decomposed-refs.js

@@ -1,6 +1,7 @@
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { dirname, relative, resolve } from "node:path";
 import { referenceTypeMatches } from "@deftai/directive-types";
+import { containedWrite } from "../fs/contained-write.js";
 import { formatBriefJson } from "./vbrief-json.js";
 import { collectChildUris, collectPlanRefs, resolveVbriefRef } from "./vbrief-ref.js";
 function rewriteOnePlanRef(value, oldParentResolved, newParentRel, vbriefDir) {
@@ -53,7 +54,14 @@ function rewriteParentChildReference(parentPath, oldChildResolved, newChildRel,
     }
     if (changed) {
         try {
-            writeFileSync(parentPath, formatBriefJson(parentData), "utf8");
+            // #2980 wave D: product write sink routes through containedWrite.
+            const dir = dirname(parentPath);
+            containedWrite({
+                root: resolve(dir),
+                target: parentPath,
+                data: formatBriefJson(parentData),
+                mode: "replace",
+            });
         }
         catch {
             return false;
@@ -127,7 +135,14 @@ function rewriteChildParentReference(childPath, oldParentResolved, newParentRel,
     }
     if (changed) {
         try {
-            writeFileSync(childPath, formatBriefJson(childData), "utf8");
+            // #2980 wave D: product write sink routes through containedWrite.
+            const dir = dirname(childPath);
+            containedWrite({
+                root: resolve(dir),
+                target: childPath,
+                data: formatBriefJson(childData),
+                mode: "replace",
+            });
         }
         catch {
             return false;

package/dist/scope/demote.js

@@ -1,5 +1,6 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync, writeFileSync, } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, statSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
 import { assertWriteTargetSafe, ProjectionContainmentError } from "../fs/projection-containment.js";
 import { hasArtifactSuffix, resolveLifecycleFolder } from "../layout/resolve.js";
 import { stripTrailingPathSeparators } from "../text/redos-safe.js";
@@ -85,7 +86,13 @@ export function demoteOne(filePath, projectRoot, reason, options = {}) {
     const timestamp = utcNowIso(now);
     planObj.status = TARGET_STATUS;
     planObj.updated = timestamp;
-    writeFileSync(resolved, formatBriefJson(data), "utf8");
+    // #2980 wave D: product write sink routes through containedWrite.
+    containedWrite({
+        root: resolve(projectRoot),
+        target: resolved,
+        data: formatBriefJson(data),
+        mode: "replace",
+    });
     const vbriefRoot = dirname(dirname(resolved));
     const targetDir = join(vbriefRoot, TARGET_FOLDER);
     mkdirSync(targetDir, { recursive: true });

package/dist/scope/undo.js

@@ -1,5 +1,6 @@
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, renameSync } from "node:fs";
 import { basename, join, relative, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
 import { assertWriteTargetSafe, ProjectionContainmentError } from "../fs/projection-containment.js";
 import { resolveLifecycleRoot } from "../layout/resolve.js";
 import { append, canonicalLogPath, newDecisionId, readAll } from "./audit-log.js";
@@ -185,7 +186,13 @@ function moveAndFlip(srcFile, destFolder, newStatus, timestamp, projectRoot) {
     const planObj = plan;
     planObj.status = newStatus;
     planObj.updated = timestamp;
-    writeFileSync(srcFile, formatBriefJson(data), "utf8");
+    // #2980 wave D: product write sink routes through containedWrite.
+    containedWrite({
+        root: resolve(projectRoot),
+        target: srcFile,
+        data: formatBriefJson(data),
+        mode: "replace",
+    });
     mkdirSync(destFolder, { recursive: true });
     const destPath = join(destFolder, basename(srcFile));
     renameSync(srcFile, destPath);

package/dist/session/release-availability.js

@@ -1,9 +1,10 @@
 import { spawnSync } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { existsSync, mkdirSync, readFileSync, renameSync, rmSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
 import { locateManifest, parseInstallManifest } from "../doctor/manifest.js";
 import { runningInsideDeftRepo } from "../doctor/paths.js";
 import { evaluateReleaseAvailability } from "../doctor/release-availability.js";
+import { containedWrite } from "../fs/contained-write.js";
 import { resolveTriageCachePath } from "../triage/cache-path.js";
 const THROTTLE_MS = 24 * 60 * 60 * 1000;
 const PUBLIC_NPM_REGISTRY = "https://registry.npmjs.org/";
@@ -56,10 +57,29 @@ function isThrottled(state, latestVersion, now) {
     return Number.isFinite(notifiedAt) && now.getTime() - notifiedAt < THROTTLE_MS;
 }
 function defaultWriteState(path, content) {
-    mkdirSync(dirname(path), { recursive: true });
-    const temporary = `${path}.${process.pid}.tmp`;
-    writeFileSync(temporary, content, "utf8");
-    renameSync(temporary, path);
+    const dir = dirname(path);
+    mkdirSync(dir, { recursive: true });
+    const tmpBase = `${basename(path)}.${process.pid}.tmp`;
+    const temporary = join(dir, tmpBase);
+    try {
+        // #2980 wave D: product write sink routes through containedWrite.
+        containedWrite({
+            root: resolve(dir),
+            target: tmpBase,
+            data: content,
+            mode: "create",
+        });
+        renameSync(temporary, path);
+    }
+    catch (err) {
+        try {
+            rmSync(temporary, { force: true });
+        }
+        catch {
+            /* best-effort cleanup */
+        }
+        throw err;
+    }
 }
 /**
  * Probe the public npm registry separately from doctor. Doctor stays offline

package/dist/session/ritual-sentinel.js

@@ -1,5 +1,6 @@
-import { closeSync, existsSync, fdatasyncSync, mkdirSync, openSync, readdirSync, readFileSync, renameSync, statSync, writeSync, } from "node:fs";
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, } from "node:fs";
 import { join, relative, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
 import { hasArtifactSuffix, LEGACY_ARTIFACT_DIR, MIGRATED_ARTIFACT_DIR, } from "../layout/resolve.js";
 import { stableJson } from "./json.js";
 import { RITUAL_STATE_CONTRACT } from "./posture.js";
@@ -92,24 +93,30 @@ function validateSteps(raw, key) {
     return [steps, null];
 }
 function atomicWriteJson(targetPath, payload, prefix) {
-    mkdirSync(join(targetPath, ".."), { recursive: true });
     const dir = join(targetPath, "..");
-    const tmpName = join(dir, `${prefix}${process.pid}.json.tmp`);
-    const fd = openSync(tmpName, "w");
+    mkdirSync(dir, { recursive: true });
+    const tmpBase = `${prefix}${process.pid}.json.tmp`;
+    const tmpName = join(dir, tmpBase);
+    const text = `${stableJson(payload, 2)}\n`;
     try {
-        const text = `${stableJson(payload, 2)}\n`;
-        writeSync(fd, text, undefined, "utf8");
+        // #2980 wave D: ritual-state product write routes through containedWrite.
+        containedWrite({
+            root: resolve(dir),
+            target: tmpBase,
+            data: text,
+            mode: "create",
+        });
+        renameSync(tmpName, targetPath);
+    }
+    catch (err) {
         try {
-            fdatasyncSync(fd);
+            rmSync(tmpName, { force: true });
         }
         catch {
-            // best-effort
+            /* best-effort cleanup */
         }
+        throw err;
     }
-    finally {
-        closeSync(fd);
-    }
-    renameSync(tmpName, targetPath);
 }
 export function readRitualState(projectRoot) {
     const stateFile = ritualStatePath(projectRoot);

package/dist/session/session-start.js

@@ -5,6 +5,7 @@ import { MIGRATE_COMPLETION_NUDGE, shouldEmitMigrateNudge } from "../init-deposi
 import { detectEnvironmentContext, environmentContextToDict, formatEnvironmentContext, } from "../platform/shell-context.js";
 import { disclosureLine } from "../policy/disclosure.js";
 import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_FLAG_NAME, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY, } from "../policy/no-deft-directive.js";
+import { humanMergeDisclosureLine, resolveHumanMergePolicy, } from "../policy/require-human-merge.js";
 import { resolvePolicy } from "../policy/resolve.js";
 import { maybeFormatProductSignalConsentPrompt } from "../product-signal/consent-prompt.js";
 import { maybeRunStalenessTickler } from "../staleness-tickler/run.js";
@@ -319,6 +320,12 @@ export function runSessionStart(projectRoot, options = {}) {
             exitCode: ok ? 0 : 2,
         });
         lines.push(message);
+        // Human merge gate disclosure (#1193) — surface when ON (or env bypass active).
+        const humanMerge = resolveHumanMergePolicy(projectRoot);
+        const humanMergeLine = humanMergeDisclosureLine(humanMerge);
+        if (humanMergeLine !== null) {
+            lines.push(humanMergeLine);
+        }
         const branchSync = defaultBranchSync(projectRoot, runGit);
         if (branchSync.warning) {
             lines.push(branchSync.warning);

package/dist/staleness-tickler/state.js

@@ -1,5 +1,6 @@
-import { mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { mkdirSync, readFileSync, renameSync, rmSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
 import { resolveTriageCachePath } from "../triage/cache-path.js";
 export const STATE_RELATIVE_PATH = join("xbrief", ".triage-cache", "staleness-tickler-state.json");
 const STATE_FILE_NAME = "staleness-tickler-state.json";
@@ -15,10 +16,29 @@ function defaultReadText(path) {
     }
 }
 function defaultWriteText(path, content) {
-    mkdirSync(dirname(path), { recursive: true });
-    const temporary = `${path}.${process.pid}.tmp`;
-    writeFileSync(temporary, content, "utf8");
-    renameSync(temporary, path);
+    const dir = dirname(path);
+    mkdirSync(dir, { recursive: true });
+    const tmpBase = `${basename(path)}.${process.pid}.tmp`;
+    const temporary = join(dir, tmpBase);
+    try {
+        // #2980 wave D: product write sink routes through containedWrite.
+        containedWrite({
+            root: resolve(dir),
+            target: tmpBase,
+            data: content,
+            mode: "create",
+        });
+        renameSync(temporary, path);
+    }
+    catch (err) {
+        try {
+            rmSync(temporary, { force: true });
+        }
+        catch {
+            /* best-effort cleanup */
+        }
+        throw err;
+    }
 }
 export function parseStalenessTicklerState(text) {
     if (text === null) {

package/dist/swarm/launch.js

@@ -1,5 +1,6 @@
-import { existsSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
-import { basename, isAbsolute, join, resolve } from "node:path";
+import { existsSync, mkdirSync, readdirSync, readFileSync } from "node:fs";
+import { basename, dirname, isAbsolute, join, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
 import { inferGithubAuthMode } from "../intake/github-auth-modes.js";
 import { getPlatformCapabilities } from "../intake/platform-capabilities.js";
 import { hasArtifactSuffix, resolveLifecycleFolder, stripArtifactSuffix, } from "../layout/resolve.js";
@@ -581,7 +582,16 @@ export function swarmLaunch(args) {
     const rendered = `${JSON.stringify(manifest, null, 2)}\n`;
     if (args.output !== undefined && args.output !== null) {
         try {
-            writeFileSync(args.output, rendered, "utf8");
+            // #2980 wave D: product write sink routes through containedWrite.
+            const abs = resolve(args.output);
+            const dir = dirname(abs);
+            mkdirSync(dir, { recursive: true });
+            containedWrite({
+                root: dir,
+                target: basename(abs),
+                data: rendered,
+                mode: "replace",
+            });
         }
         catch (exc) {
             return {

package/dist/swarm/routing.js

@@ -14,8 +14,9 @@
  * explicit default.
  */
 import { execFileSync } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { dirname, isAbsolute, join, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
 import { assertWriteTargetSafe } from "../fs/projection-containment.js";
 /**
  * The fixed worker-role vocabulary (reused from #1531). No separate tier
@@ -234,7 +235,12 @@ export function writeModelDecision(projectRoot, path, provider, role, decision)
         decidedAt: decision.decidedAt ?? new Date().toISOString(),
     };
     file[provider] = block;
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, `${JSON.stringify(file, null, 2)}\n`, "utf8");
+    // #2980 wave D: product write sink routes through containedWrite.
+    containedWrite({
+        root: resolve(projectRoot),
+        target: path,
+        data: `${JSON.stringify(file, null, 2)}\n`,
+        mode: "replace",
+    });
 }
 //# sourceMappingURL=routing.js.map

package/dist/task-surface/index.js

@@ -1,8 +1,9 @@
 import { execFileSync } from "node:child_process";
-import { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { LEGACY_VBRIEF_VERSION } from "@deftai/directive-types";
-import { assertProjectionContained, assertWriteTargetSafe, ProjectionContainmentError, } from "../fs/projection-containment.js";
+import { ContainedWriteError, containedWrite } from "../fs/contained-write.js";
+import { assertProjectionContained, ProjectionContainmentError, } from "../fs/projection-containment.js";
 const UNRELEASED_RE = /## \[Unreleased\][ \t]*\n([\s\S]*?)(?=\n## \[|$)/;
 const CHANGE_NAME_RE = /^[\w][\w-]*$/;
 const COMMIT_TYPES = "feat|fix|docs|chore|refactor|test|style|perf|ci|build|revert";
@@ -14,7 +15,7 @@ function projectionTarget(projectDir, ...relSegments) {
     return target;
 }
 function containmentExitCode(io, err) {
-    if (err instanceof ProjectionContainmentError) {
+    if (err instanceof ProjectionContainmentError || err instanceof ContainedWriteError) {
         io.writeErr(`FAIL: ${err.message}\n`);
         return 2;
     }
@@ -93,10 +94,19 @@ export function runChangeInit(projectRoot, name, io) {
         mkdirSync(specsDir, { recursive: true });
         const proposalPath = join(base, "proposal.xbrief.json");
         const tasksPath = join(base, "tasks.xbrief.json");
-        assertWriteTargetSafe(projectAbs, proposalPath);
-        assertWriteTargetSafe(projectAbs, tasksPath);
-        writeFileSync(proposalPath, `${JSON.stringify(proposalTemplate(trimmed), null, 2)}\n`, "utf8");
-        writeFileSync(tasksPath, `${JSON.stringify(tasksTemplate(trimmed), null, 2)}\n`, "utf8");
+        // #2980 wave D: product write sinks route through containedWrite.
+        containedWrite({
+            root: projectAbs,
+            target: proposalPath,
+            data: `${JSON.stringify(proposalTemplate(trimmed), null, 2)}\n`,
+            mode: "create",
+        });
+        containedWrite({
+            root: projectAbs,
+            target: tasksPath,
+            data: `${JSON.stringify(tasksTemplate(trimmed), null, 2)}\n`,
+            mode: "create",
+        });
         io.writeOut(`OK: Created change proposal at ${base}/\n`);
         for (const file of ["proposal.xbrief.json", "tasks.xbrief.json", "specs/"]) {
             io.writeOut(`  - ${file}\n`);
@@ -150,8 +160,13 @@ export function runInstallUninstall(projectRoot, io) {
     const next = filtered.join("");
     if (next !== original) {
         try {
-            assertWriteTargetSafe(resolve(projectRoot), path);
-            writeFileSync(path, next, "utf8");
+            // #2980 wave D: product write sink routes through containedWrite.
+            containedWrite({
+                root: resolve(projectRoot),
+                target: path,
+                data: next,
+                mode: "replace",
+            });
             io.writeOut("Removed deft entry from AGENTS.md\n");
         }
         catch (err) {

package/dist/triage/bootstrap/gitignore.js

@@ -1,5 +1,6 @@
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, relative } from "node:path";
+import { existsSync, mkdirSync, readFileSync } from "node:fs";
+import { dirname, relative, resolve } from "node:path";
+import { containedWrite } from "../../fs/contained-write.js";
 import { assertProjectionContained, ProjectionContainmentError, } from "../../fs/projection-containment.js";
 import { MIGRATED_ARTIFACT_DIR, resolveLifecycleLayout } from "../../layout/resolve.js";
 import { resolveCandidatesLogPath, resolveTriageCachePath, TRIAGE_CACHE_DIR_NAME, triageCacheRelPath, } from "../cache-path.js";
@@ -197,7 +198,14 @@ function ensureGitignoreLine(projectRoot, gitignorePath, line, stepName, createI
             return stepOutcome(stepName, false, `.gitignore not present after the prior gitignore step; ${line} not written -- re-run bootstrap to retry`, { created: false, appended: false, skipped: "no-gitignore" }, "prior gitignore step did not create .gitignore");
         }
         try {
-            writeFileSync(gitignorePath, `${line}\n`, { encoding: "utf8" });
+            // #2980 wave D: product write sink routes through containedWrite.
+            const root = resolve(projectRoot);
+            containedWrite({
+                root,
+                target: gitignorePath,
+                data: `${line}\n`,
+                mode: "create",
+            });
         }
         catch (exc) {
             return stepOutcome(stepName, false, "could not create .gitignore", {}, String(exc));
@@ -232,7 +240,13 @@ function ensureGitignoreLine(projectRoot, gitignorePath, line, stepName, createI
     const suffix = existing.endsWith("\n") || existing === "" ? "" : "\n";
     const newContent = `${existing + suffix + rationaleBlock + line}\n`;
     try {
-        writeFileSync(gitignorePath, newContent, { encoding: "utf8" });
+        // #2980 wave D: product write sink routes through containedWrite.
+        containedWrite({
+            root: resolve(projectRoot),
+            target: gitignorePath,
+            data: newContent,
+            mode: "replace",
+        });
     }
     catch (exc) {
         return stepOutcome(stepName, false, "could not write .gitignore", {}, String(exc));
@@ -303,7 +317,13 @@ function ensureGitignoreSelectiveEntries(projectRoot, stepName, entries) {
         : `${EVAL_ENTRIES_RATIONALE}${missing.join("\n")}\n`;
     const newContent = existing + suffix + appendedBlock;
     try {
-        writeFileSync(gitignorePath, newContent, { encoding: "utf8" });
+        // #2980 wave D: product write sink routes through containedWrite.
+        containedWrite({
+            root: resolve(projectRoot),
+            target: gitignorePath,
+            data: newContent,
+            mode: "replace",
+        });
     }
     catch (exc) {
         return stepOutcome(stepName, false, "could not write .gitignore", { gitignore_appended_lines: 0 }, String(exc));
@@ -341,7 +361,13 @@ function ensureGitattributesMergeUnion(projectRoot, stepName, glob, ruleLine) {
         const suffix = existing.endsWith("\n") || existing === "" ? "" : "\n";
         const newContent = `${existing + suffix + GITATTRIBUTES_EVAL_RATIONALE + ruleLine}\n`;
         try {
-            writeFileSync(gitattributesPath, newContent, { encoding: "utf8" });
+            // #2980 wave D: product write sink routes through containedWrite.
+            containedWrite({
+                root: resolve(projectRoot),
+                target: gitattributesPath,
+                data: newContent,
+                mode: "replace",
+            });
         }
         catch (exc) {
             return stepOutcome(stepName, false, "could not write .gitattributes", { gitattributes_appended: false }, String(exc));
@@ -353,7 +379,13 @@ function ensureGitattributesMergeUnion(projectRoot, stepName, glob, ruleLine) {
     }
     const newContent = `${GITATTRIBUTES_EVAL_RATIONALE + ruleLine}\n`;
     try {
-        writeFileSync(gitattributesPath, newContent, { encoding: "utf8" });
+        // #2980 wave D: product write sink routes through containedWrite.
+        containedWrite({
+            root: resolve(projectRoot),
+            target: gitattributesPath,
+            data: newContent,
+            mode: "create",
+        });
     }
     catch (exc) {
         return stepOutcome(stepName, false, "could not create .gitattributes", { gitattributes_appended: false }, String(exc));
@@ -382,8 +414,13 @@ function ensureEvalReadme(options) {
         // create below
     }
     try {
-        mkdirSync(dirname(readmePath), { recursive: true });
-        writeFileSync(readmePath, generateTriageCacheReadmeBody(projectRoot), { encoding: "utf8" });
+        // #2980 wave D: product write sink routes through containedWrite.
+        containedWrite({
+            root: resolve(projectRoot),
+            target: readmePath,
+            data: generateTriageCacheReadmeBody(projectRoot),
+            mode: "create",
+        });
     }
     catch (exc) {
         return stepOutcome(stepName, false, `could not create ${readmePath}`, { readme_created: false }, String(exc));
@@ -474,7 +511,13 @@ export function stepSeedCandidatesLog(projectRoot) {
         // create below
     }
     try {
-        writeFileSync(auditPath, "", { encoding: "utf8" });
+        // #2980 wave D: product write sink routes through containedWrite.
+        containedWrite({
+            root: resolve(projectRoot),
+            target: auditPath,
+            data: "",
+            mode: "create",
+        });
     }
     catch (exc) {
         return stepOutcome("seed_candidates_log", false, `could not seed ${auditPath}`, {}, String(exc));

package/dist/triage/cache-path.js

@@ -4,8 +4,9 @@
  * Triage append-only logs and scratch dirs live under `.triage-cache/` so the
  * `.eval/` namespace can be reclaimed for version-eval results (#1703 Tier 2).
  */
-import { existsSync, mkdirSync, renameSync, unlinkSync, writeFileSync } from "node:fs";
-import { join, relative } from "node:path";
+import { existsSync, mkdirSync, renameSync, unlinkSync } from "node:fs";
+import { join, relative, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
 import { assertProjectionContained } from "../fs/projection-containment.js";
 import { MIGRATED_ARTIFACT_DIR, resolveEvalDir, resolveLifecycleLayout, resolveLifecycleRoot, } from "../layout/resolve.js";
 import { generateTriageCacheReadmeBody } from "./bootstrap/gitignore.js";
@@ -99,7 +100,13 @@ export function migrateLegacyTriageCacheFromEval(projectRoot) {
                 removedLegacyFiles.push(name);
             }
             else {
-                writeFileSync(targetPath, generateTriageCacheReadmeBody(projectRoot), "utf8");
+                // #2980 wave D: product write sink routes through containedWrite.
+                containedWrite({
+                    root: resolve(projectRoot),
+                    target: targetPath,
+                    data: generateTriageCacheReadmeBody(projectRoot),
+                    mode: "create",
+                });
                 unlinkSync(legacyPath);
                 regeneratedFiles.push(name);
             }

package/dist/triage/welcome/summary.js

@@ -1,5 +1,6 @@
-import { appendFileSync, existsSync, mkdirSync, readdirSync, readFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { basename, dirname, join, resolve } from "node:path";
+import { containedWrite } from "../../fs/contained-write.js";
 import { hasArtifactSuffix, resolveLifecycleFolder, resolveProjectDefinitionPath, } from "../../layout/resolve.js";
 import { readPlanPolicy } from "../../policy/plan-extensions.js";
 import { countVbriefWip, resolveWipCap } from "../../policy/wip.js";
@@ -296,8 +297,14 @@ export function appendHistory(historyPath, result, line) {
         reconcilable: result.reconcilable,
     };
     try {
-        mkdirSync(join(historyPath, ".."), { recursive: true });
-        appendFileSync(historyPath, `${JSON.stringify(record)}\n`, "utf8");
+        // #2980 wave D: product write sink routes through containedWrite.
+        const dir = dirname(historyPath);
+        containedWrite({
+            root: resolve(dir),
+            target: basename(historyPath),
+            data: `${JSON.stringify(record)}\n`,
+            mode: "append",
+        });
     }
     catch {
         // observability only