@deftai/directive-core 0.90.0 → 0.92.0

package/dist/scope/main.js

@@ -3,19 +3,22 @@ import { dirname, join } from "node:path";
 import { maybeRunStalenessTickler } from "../staleness-tickler/run.js";
 import { reconcileUmbrellas, renderUmbrellasReport } from "../vbrief-reconcile/umbrellas.js";
 import { canonicalLogPath, readAll } from "./audit-log.js";
+import { batchPromote } from "./batch-promote.js";
 import { TRANSITIONS } from "./constants.js";
+import { isNonDeliveryDisposition, } from "./delivery-evidence.js";
 import { batchDemote, DEFAULT_OLDER_THAN_DAYS, demoteOne, resolveDemoteFilePath, resolveFilePath, resolveProjectRootStrict, } from "./demote.js";
 import { completedPathForScopeMove, findOpenUmbrellaReferences, renderOpenUmbrellaWarning, } from "./open-umbrella-warning.js";
 import { resolveProjectRoot } from "./project-context.js";
 import { recordWipCapOverride, runTransition } from "./transition.js";
 import { findByDecisionId, isAlreadyUndone, REVERSIBLE_ACTIONS, undoBatch, undoOne, } from "./undo.js";
 import { checkWipCap, formatWipCapRefusal } from "./wip-cap-check.js";
-const LIFECYCLE_USAGE_STDERR = "usage: scope_lifecycle.py [-h] [--project-root PROJECT_ROOT] [--force]\n" +
+const LIFECYCLE_USAGE_STDERR = "usage: scope_lifecycle.py [-h] [--project-root PROJECT_ROOT] [--force] [--batch]\n" +
     "                          {activate,block,cancel,complete,fail,promote,restore,unblock}\n" +
-    "                          file\n" +
-    "scope_lifecycle.py: error: the following arguments are required: action, file\n";
+    "                          [file ...]\n" +
+    "scope_lifecycle.py: error: the following arguments are required: action, file\n" +
+    "(promote --batch may omit file and promotes all proposed/ scopes; #3011)\n";
 function parseLifecycleArgv(argv) {
-    if (argv.length < 2) {
+    if (argv.length < 1) {
         return { args: null, error: "usage" };
     }
     const action = argv[0] ?? "";
@@ -25,6 +28,15 @@ function parseLifecycleArgv(argv) {
     let file = "";
     let projectRoot;
     let force = false;
+    let batch = false;
+    const batchFiles = [];
+    let nonDeliveryDisposition;
+    let prNumber;
+    let mergeCommit;
+    let prBase;
+    let deliveryBranch;
+    let repo;
+    let mergedAt;
     for (let i = 1; i < argv.length; i += 1) {
         const arg = argv[i];
         if (arg === undefined) {
@@ -33,6 +45,9 @@ function parseLifecycleArgv(argv) {
         if (arg === "--force") {
             force = true;
         }
+        else if (arg === "--batch") {
+            batch = true;
+        }
         else if (arg === "--project-root") {
             projectRoot = argv[i + 1];
             i += 1;
@@ -40,17 +55,122 @@ function parseLifecycleArgv(argv) {
         else if (arg?.startsWith("--project-root=")) {
             projectRoot = arg.slice("--project-root=".length);
         }
-        else if (!arg.startsWith("-") && file.length === 0) {
-            file = arg;
+        else if (arg === "--non-delivery" || arg === "--non-delivery-disposition") {
+            const raw = argv[i + 1];
+            i += 1;
+            if (raw === undefined || !isNonDeliveryDisposition(raw)) {
+                return { args: null, error: "usage" };
+            }
+            nonDeliveryDisposition = raw;
+        }
+        else if (arg?.startsWith("--non-delivery=")) {
+            const raw = arg.slice("--non-delivery=".length);
+            if (!isNonDeliveryDisposition(raw)) {
+                return { args: null, error: "usage" };
+            }
+            nonDeliveryDisposition = raw;
+        }
+        else if (arg === "--pr" && argv[i + 1] !== undefined) {
+            prNumber = Number.parseInt(argv[i + 1] ?? "", 10);
+            i += 1;
+        }
+        else if (arg?.startsWith("--pr=")) {
+            prNumber = Number.parseInt(arg.slice("--pr=".length), 10);
+        }
+        else if (arg === "--merge-commit" && argv[i + 1] !== undefined) {
+            mergeCommit = argv[i + 1];
+            i += 1;
+        }
+        else if (arg?.startsWith("--merge-commit=")) {
+            mergeCommit = arg.slice("--merge-commit=".length);
+        }
+        else if (arg === "--pr-base" && argv[i + 1] !== undefined) {
+            prBase = argv[i + 1];
+            i += 1;
+        }
+        else if (arg?.startsWith("--pr-base=")) {
+            prBase = arg.slice("--pr-base=".length);
+        }
+        else if (arg === "--delivery-branch" && argv[i + 1] !== undefined) {
+            deliveryBranch = argv[i + 1];
+            i += 1;
+        }
+        else if (arg?.startsWith("--delivery-branch=")) {
+            deliveryBranch = arg.slice("--delivery-branch=".length);
+        }
+        else if (arg === "--repo" && argv[i + 1] !== undefined) {
+            repo = argv[i + 1];
+            i += 1;
+        }
+        else if (arg?.startsWith("--repo=")) {
+            repo = arg.slice("--repo=".length);
+        }
+        else if (arg === "--merged-at" && argv[i + 1] !== undefined) {
+            mergedAt = argv[i + 1];
+            i += 1;
+        }
+        else if (arg?.startsWith("--merged-at=")) {
+            mergedAt = arg.slice("--merged-at=".length);
+        }
+        else if (!arg.startsWith("-")) {
+            if (batch) {
+                batchFiles.push(arg);
+            }
+            else if (file.length === 0) {
+                file = arg;
+            }
+            else {
+                return { args: null, error: "usage" };
+            }
         }
         else {
             return { args: null, error: "usage" };
         }
     }
+    const deliveryEvidence = prNumber !== undefined ||
+        mergeCommit !== undefined ||
+        prBase !== undefined ||
+        deliveryBranch !== undefined ||
+        repo !== undefined ||
+        mergedAt !== undefined
+        ? {
+            prNumber: prNumber !== undefined && Number.isFinite(prNumber) ? prNumber : null,
+            mergeCommit: mergeCommit ?? null,
+            prBase: prBase ?? null,
+            deliveryBranch: deliveryBranch ?? null,
+            repository: repo ?? null,
+            mergedAt: mergedAt ?? (mergeCommit !== undefined ? "supplied" : null),
+            verifier: "scope:complete",
+        }
+        : undefined;
+    if (batch) {
+        if (action !== "promote") {
+            return { args: null, error: "usage" };
+        }
+        return {
+            args: {
+                action,
+                file: file.length > 0 ? file : "",
+                projectRoot,
+                force,
+                batch: true,
+                batchFiles: batchFiles.length > 0 ? batchFiles : file.length > 0 ? [file] : [],
+            },
+        };
+    }
     if (file.length === 0) {
         return { args: null, error: "usage" };
     }
-    return { args: { action, file, projectRoot, force } };
+    return {
+        args: {
+            action,
+            file,
+            projectRoot,
+            force,
+            nonDeliveryDisposition,
+            deliveryEvidence,
+        },
+    };
 }
 /** Main entry for scope_lifecycle.py parity. */
 export function lifecycleMain(argv) {
@@ -61,7 +181,28 @@ export function lifecycleMain(argv) {
         }
         return 2;
     }
-    const { action, file, projectRoot, force } = parsed.args;
+    const { action, file, projectRoot, force, batch, batchFiles, nonDeliveryDisposition, deliveryEvidence, } = parsed.args;
+    if (batch === true && action === "promote") {
+        const result = batchPromote({
+            files: batchFiles && batchFiles.length > 0 ? batchFiles : undefined,
+            force: force === true,
+            projectRoot,
+        });
+        for (const line of result.messages) {
+            process.stdout.write(`${line}\n`);
+        }
+        for (const line of result.skipped) {
+            process.stdout.write(`  skipped: ${line}\n`);
+        }
+        if (!result.ok && result.exitCode !== 0) {
+            for (const line of result.messages) {
+                if (line.startsWith("ERROR:") || line.includes("WIP cap")) {
+                    process.stderr.write(`${line}\n`);
+                }
+            }
+        }
+        return result.exitCode;
+    }
     const [filePath, error] = resolveFilePath(file, projectRoot);
     if (error !== null || filePath === null) {
         process.stderr.write(`Error: ${error}\n`);
@@ -78,7 +219,12 @@ export function lifecycleMain(argv) {
             }
         }
     }
-    const result = runTransition(action, filePath);
+    const transitionOptions = {
+        nonDeliveryDisposition,
+        deliveryEvidence,
+        verifier: "scope:complete",
+    };
+    const result = runTransition(action, filePath, new Date(), transitionOptions);
     if (result.ok) {
         if (action === "promote" && capCheck !== null && capCheck.forceOverride) {
             const rootForAudit = resolveProjectRoot(projectRoot);

package/dist/scope/registry-artifact-sync.js

@@ -164,7 +164,10 @@ export function syncRegistryArtifactAfterScopeMove(registryPath, scopeData, oldP
                 hooks.persist(registryPath, registry);
             }
             else {
-                atomicWriteText(registryPath, formatBriefJson(registry));
+                // #3042: contain registry stay-path write against project root (parent of xbrief/).
+                atomicWriteText(registryPath, formatBriefJson(registry), {
+                    projectRoot: dirname(resolve(vbriefRoot)),
+                });
             }
         }
     }

package/dist/scope/transition.d.ts

@@ -1,10 +1,20 @@
+import type { GitRunner } from "../session/git.js";
 import { detectLifecycleFolder } from "./decomposed-refs.js";
+import { type DeliveryEvidenceInput, type NonDeliveryDisposition } from "./delivery-evidence.js";
 import type { WipCapCheck } from "./wip-cap-check.js";
 export interface TransitionResult {
     readonly ok: boolean;
     readonly message: string;
 }
-export declare function runTransition(action: string, filePath: string, now?: Date): TransitionResult;
+/** Optional completion evidence / disposition for the delivery gate (#3041). */
+export interface TransitionOptions {
+    readonly deliveryEvidence?: DeliveryEvidenceInput | null;
+    readonly nonDeliveryDisposition?: NonDeliveryDisposition | null;
+    readonly runGit?: GitRunner;
+    readonly verifier?: string;
+    readonly assumeEvidenceValidated?: boolean;
+}
+export declare function runTransition(action: string, filePath: string, now?: Date, options?: TransitionOptions): TransitionResult;
 export declare function recordWipCapOverride(filePath: string, projectRoot: string, check: WipCapCheck, now?: Date): void;
 export { detectLifecycleFolder };
 //# sourceMappingURL=transition.d.ts.map

package/dist/scope/transition.js

@@ -8,6 +8,7 @@ import { atomicWriteBrief, formatBriefJson, readBriefForMutation } from "./brief
 import { stampCompletionMetadata } from "./capacity-stamp.js";
 import { LIFECYCLE_FOLDERS, MOVE_LABELS, STATUS_PRECONDITIONS, STAY_LABELS, TRANSITIONS, } from "./constants.js";
 import { detectLifecycleFolder, updateDecomposedChildBackReferences, updateDecomposedParentBackReferences, } from "./decomposed-refs.js";
+import { classifyStoredDeliveryDisposition, evaluateDeliveryGate, stampDeliveryProvenance, } from "./delivery-evidence.js";
 import { syncProjectDefinitionAfterScopeMove } from "./project-definition-sync.js";
 import { syncSpecificationAfterScopeMove } from "./specification-sync.js";
 import { utcNowIso } from "./vbrief-json.js";
@@ -48,7 +49,7 @@ function stampEnvelopeUpdated(data, nowIso) {
         }
     }
 }
-export function runTransition(action, filePath, now = new Date()) {
+export function runTransition(action, filePath, now = new Date(), options = {}) {
     if (!(action in TRANSITIONS)) {
         const valid = Object.keys(TRANSITIONS).sort().join(", ");
         return { ok: false, message: `Unknown action '${action}'. Valid actions: ${valid}` };
@@ -95,9 +96,15 @@ export function runTransition(action, filePath, now = new Date()) {
     const requiredStatus = STATUS_PRECONDITIONS[act];
     if (requiredStatus !== undefined) {
         if (currentStatus === targetStatus) {
+            // Surface legacy delivery disposition on already-completed briefs (#3041).
+            let dispositionSuffix = "";
+            if (act === "complete" && currentFolder === "completed") {
+                const disposition = classifyStoredDeliveryDisposition(planObj);
+                dispositionSuffix = ` (deliveryDisposition=${disposition})`;
+            }
             return {
                 ok: true,
-                message: `No-op: ${basename} is already ${targetStatus} in ${currentFolder}/`,
+                message: `No-op: ${basename} is already ${targetStatus} in ${currentFolder}/${dispositionSuffix}`,
             };
         }
         if (currentStatus !== requiredStatus) {
@@ -131,6 +138,25 @@ export function runTransition(action, filePath, now = new Date()) {
         }
     }
     const nowIso = utcNowIso(now);
+    // #3041: fail closed before mutating a code-bearing complete without delivery evidence.
+    if (act === "complete") {
+        const gate = evaluateDeliveryGate({
+            projectRoot,
+            plan: planObj,
+            nowIso,
+            evidence: options.deliveryEvidence,
+            nonDeliveryDisposition: options.nonDeliveryDisposition,
+            runGit: options.runGit,
+            verifier: options.verifier ?? "scope:complete",
+            assumeEvidenceValidated: options.assumeEvidenceValidated,
+        });
+        if (!gate.ok) {
+            return { ok: false, message: gate.message };
+        }
+        if (gate.provenance !== null) {
+            stampDeliveryProvenance(planObj, gate.provenance);
+        }
+    }
     planObj.status = targetStatus;
     planObj.updated = nowIso;
     // Keep the envelope clock aligned with plan.updated on every mutating transition (#2862).
@@ -153,7 +179,7 @@ export function runTransition(action, filePath, now = new Date()) {
         }
         // #2578: stamp terminal status at the destination path in the same write as
         // folder placement — never leave a non-terminal status under completed/.
-        const writeResult = atomicWriteBrief(destPath, data, vbriefRoot);
+        const writeResult = atomicWriteBrief(destPath, data, vbriefRoot, { projectRoot });
         if (!writeResult.ok) {
             return { ok: false, message: writeResult.message };
         }
@@ -193,7 +219,7 @@ export function runTransition(action, filePath, now = new Date()) {
             message: `${actionLabel} ${basename}: ${currentFolder}/ -> ${targetFolder}/ (status: ${targetStatus})`,
         };
     }
-    const writeResult = atomicWriteBrief(resolvedPath, data, vbriefRoot);
+    const writeResult = atomicWriteBrief(resolvedPath, data, vbriefRoot, { projectRoot });
     if (!writeResult.ok) {
         return { ok: false, message: writeResult.message };
     }

package/dist/scope/wip-cap-check.d.ts

@@ -7,5 +7,11 @@ export interface WipCapCheck {
 }
 /** Resolve WIP cap and decide if promotion is allowed (#1124). */
 export declare function checkWipCap(projectRoot: string, force?: boolean): WipCapCheck;
+/**
+ * WIP check for promoting `additional` scopes in one batch (#3011).
+ * Single promote is `additional = 1` (same as historic count >= cap refuse).
+ * Batch of N refuses when `count + N > cap` unless `--force`.
+ */
+export declare function checkWipCapForAdditional(projectRoot: string, additional: number, force?: boolean): WipCapCheck;
 export declare function formatWipCapRefusal(check: WipCapCheck): string;
 //# sourceMappingURL=wip-cap-check.d.ts.map

package/dist/scope/wip-cap-check.js

@@ -1,10 +1,21 @@
 import { countVbriefWip, resolveWipCap } from "../policy/wip.js";
 /** Resolve WIP cap and decide if promotion is allowed (#1124). */
 export function checkWipCap(projectRoot, force = false) {
+    return checkWipCapForAdditional(projectRoot, 1, force);
+}
+/**
+ * WIP check for promoting `additional` scopes in one batch (#3011).
+ * Single promote is `additional = 1` (same as historic count >= cap refuse).
+ * Batch of N refuses when `count + N > cap` unless `--force`.
+ */
+export function checkWipCapForAdditional(projectRoot, additional, force = false) {
     const capResult = resolveWipCap(projectRoot);
     const cap = capResult.cap;
     const count = countVbriefWip(projectRoot);
-    const overCap = count >= cap;
+    const add = Math.max(0, Math.floor(additional));
+    // Single-promote parity: refuse when already at/over cap before adding one.
+    // Batch: refuse when current + additional would exceed the cap.
+    const overCap = add <= 1 ? count >= cap : count + add > cap;
     if (!overCap) {
         return { allowed: true, cap, count, source: capResult.source, forceOverride: false };
     }
@@ -18,6 +29,7 @@ export function formatWipCapRefusal(check) {
         "Either:\n" +
         "  task scope:demote <existing>                              # return one to proposed/\n" +
         "  task scope:demote --batch --older-than-days 30            # bulk relief (D9 folded into D1)\n" +
-        "  task scope:promote <file> --force                          # override (logged)");
+        "  task scope:promote <file> --force                          # override (logged)\n" +
+        "  task scope:promote --batch --force                         # batch override (#3011)");
 }
 //# sourceMappingURL=wip-cap-check.js.map

package/dist/session/ritual-sentinel.js

@@ -1,6 +1,7 @@
-import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, } from "node:fs";
-import { join, relative, resolve } from "node:path";
+import { existsSync, readdirSync, readFileSync, renameSync, rmSync, statSync } from "node:fs";
+import { basename, dirname, join, relative, resolve } from "node:path";
 import { containedWrite } from "../fs/contained-write.js";
+import { assertWriteTargetSafe } from "../fs/projection-containment.js";
 import { hasArtifactSuffix, LEGACY_ARTIFACT_DIR, MIGRATED_ARTIFACT_DIR, } from "../layout/resolve.js";
 import { stableJson } from "./json.js";
 import { RITUAL_STATE_CONTRACT } from "./posture.js";
@@ -95,21 +96,29 @@ function validateSteps(raw, key) {
     }
     return [steps, null];
 }
-function atomicWriteJson(targetPath, payload, prefix) {
-    const dir = join(targetPath, "..");
-    mkdirSync(dir, { recursive: true });
-    const tmpBase = `${prefix}${process.pid}.json.tmp`;
+/**
+ * Contained atomic JSON write for ritual/sentinel state (#3042).
+ * Containment root is projectRoot (not dirname(target)) so a force-added `.deft`
+ * directory symlink fails closed before temp+rename.
+ */
+function atomicWriteJson(projectRoot, targetPath, payload, prefix) {
+    const root = resolve(projectRoot);
+    const abs = resolve(targetPath);
+    // Refuse leaf/parent symlinks on the final path before temp+rename publish.
+    assertWriteTargetSafe(root, abs);
+    const dir = dirname(abs);
+    const tmpBase = `${prefix}${process.pid}.${basename(abs)}.tmp`;
     const tmpName = join(dir, tmpBase);
     const text = `${stableJson(payload, 2)}\n`;
     try {
-        // #2980 wave D: ritual-state product write routes through containedWrite.
+        // #2980 wave D / #3042: product write routes through containedWrite under projectRoot.
         containedWrite({
-            root: resolve(dir),
-            target: tmpBase,
+            root,
+            target: tmpName,
             data: text,
             mode: "create",
         });
-        renameSync(tmpName, targetPath);
+        renameSync(tmpName, abs);
     }
     catch (err) {
         try {
@@ -191,7 +200,7 @@ export function readRitualState(projectRoot) {
 }
 export function writeRitualState(projectRoot, payload) {
     const stateFile = ritualStatePath(projectRoot);
-    atomicWriteJson(stateFile, payload, ".ritual-state.");
+    atomicWriteJson(projectRoot, stateFile, payload, ".ritual-state.");
     return stateFile;
 }
 /** Instant guaranteed to fail `evaluateLoadedState` age checks on any policy horizon. */
@@ -303,7 +312,7 @@ export function writeSentinel(projectRoot, input) {
             .replace(`${LEGACY_ARTIFACT_DIR}/active/`, `${MIGRATED_ARTIFACT_DIR}/active/`),
         lastBranch: input.lastBranch,
     };
-    atomicWriteJson(sentinelFile, payload, ".last-session.");
+    atomicWriteJson(projectRoot, sentinelFile, payload, ".last-session.");
     return sentinelFile;
 }
 function formatElapsed(deltaMs) {

package/dist/session/session-start-hook.d.ts

@@ -1,3 +1,4 @@
+import { detectDeftDirectiveDisable } from "../policy/deft-directive-disable.js";
 import { detectNoDeftDirective } from "../policy/no-deft-directive.js";
 import { writeSentinel } from "./ritual-sentinel.js";
 export interface SessionStartHookOptions {
@@ -7,6 +8,8 @@ export interface SessionStartHookOptions {
     readonly writeSentinelFn?: typeof writeSentinel;
     /** Test seam for #2926 opt-out detection. */
     readonly detectNoDeftDirectiveFn?: typeof detectNoDeftDirective;
+    /** Test seam for #3039 test kill-switch detection. */
+    readonly detectDeftDirectiveDisableFn?: typeof detectDeftDirectiveDisable;
 }
 /** Write ``.deft/last-session.json`` from current git state (#1269). */
 export declare function runSessionStartHookWrite(projectRoot: string, options?: SessionStartHookOptions): {

package/dist/session/session-start-hook.js

@@ -1,9 +1,30 @@
 import { resolveVersion } from "../doctor/paths.js";
+import { detectDeftDirectiveDisable, formatDeftDirectiveDisableMessage, isDeftDirectiveDisableActive, } from "../policy/deft-directive-disable.js";
 import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, } from "../policy/no-deft-directive.js";
 import { detectBranch } from "./git.js";
 import { detectLatestActiveVbrief, writeSentinel } from "./ritual-sentinel.js";
 /** Write ``.deft/last-session.json`` from current git state (#1269). */
 export function runSessionStartHookWrite(projectRoot, options = {}) {
+    const detectKill = options.detectDeftDirectiveDisableFn ?? detectDeftDirectiveDisable;
+    // #3039: local (untracked) kill-switch — skip ritual bookkeeping (deposit OK).
+    // Tracked flags do not short-circuit (enforcement stays on).
+    const kill = detectKill(projectRoot);
+    const killActive = options.detectDeftDirectiveDisableFn !== undefined
+        ? kill.active
+        : isDeftDirectiveDisableActive(projectRoot);
+    if (killActive) {
+        const detectOptOut = options.detectNoDeftDirectiveFn ?? detectNoDeftDirective;
+        const optOut = detectOptOut(projectRoot);
+        const message = formatDeftDirectiveDisableMessage({
+            permanentOptOutAlsoPresent: optOut.present,
+            trackedByGit: false,
+        });
+        return {
+            code: 0,
+            stdout: `${message}\n`,
+            stderr: "",
+        };
+    }
     const detectOptOut = options.detectNoDeftDirectiveFn ?? detectNoDeftDirective;
     // #2926: root opt-out wins — host SessionStart must not write ritual bookkeeping.
     const optOut = detectOptOut(projectRoot);

package/dist/session/session-start.d.ts

@@ -1,4 +1,5 @@
 import { type EnvironmentContext } from "../platform/shell-context.js";
+import { type ProbeScmReadinessOptions, type ScmReadinessReport } from "../scm/readiness.js";
 import { type ResolveUserMdResult } from "../user-config/resolve-user-md.js";
 import type { GitRunner } from "./git.js";
 import { type ReleaseAvailabilityProbeOptions } from "./release-availability.js";
@@ -86,6 +87,12 @@ export interface SessionStartOptions {
     readonly allowOptionalNetwork?: boolean;
     /** Process env for network opt-in resolution (tests inject). */
     readonly env?: NodeJS.ProcessEnv;
+    /**
+     * #2275: SCM tooling + auth readiness probe for mismatched/headless envs.
+     * Defaults to probeScmReadiness; shallow on hot path, deep when optional
+     * network is enabled. Inject in tests.
+     */
+    readonly probeScm?: (options: ProbeScmReadinessOptions) => ScmReadinessReport;
 }
 /** Format preferred `session:start` recovery command for cold vs re-arm (#2992). */
 export declare function formatSessionStartRecoveryCommand(tier?: SessionCeremonyTier): string;