@deftai/directive-core 0.91.0 → 0.92.0

package/dist/cache/fetch.js

@@ -1,5 +1,5 @@
 import { existsSync, readdirSync, readFileSync } from "node:fs";
-import { join, resolve } from "node:path";
+import { dirname, join, resolve } from "node:path";
 import { ContainedWriteError, containedWrite } from "../fs/contained-write.js";
 import { GhRestError, InvalidRepoError, restIssueView, runGhApi, } from "../scm/gh-rest.js";
 import { DEFAULT_BATCH_SIZE, DEFAULT_DELAY_MS } from "./constants.js";
@@ -45,7 +45,8 @@ export function writeOpenInventoryStamp(options) {
         fetched_at: utcIso(clock, fetchedAt),
         open_count: 0,
     };
-    atomicWriteText(openInventoryStampPath(options.cacheRoot, options.source, options.repo), `${JSON.stringify(payload)}\n`);
+    // #3042: contain stamp write against project root (parent of cacheRoot).
+    atomicWriteText(openInventoryStampPath(options.cacheRoot, options.source, options.repo), `${JSON.stringify(payload)}\n`, { projectRoot: dirname(resolve(options.cacheRoot)) });
 }
 export const REST_MAX_PER_PAGE = 100;
 export const REST_PAGINATION_MAX_PAGES = 100;

package/dist/cache/io.d.ts

@@ -1,9 +1,20 @@
 import { tmpdir } from "node:os";
+export interface AtomicWriteTextOptions {
+    /**
+     * Project / checkout root used as the containment boundary (#3042).
+     * When set, refuses symlink parents and out-of-root targets before temp+rename.
+     * Prefer always passing this for product sinks (brief stay-path, agents refresh, cache).
+     * When omitted, falls back to parent-dir containment (legacy test / low-risk helpers).
+     */
+    readonly projectRoot?: string;
+}
 /**
  * Write text via tempfile + rename (mirrors Python `_atomic_write_text`).
- * #2951 Phase 2: temp payload write uses containedWrite under the parent dir.
+ * #2951 Phase 2: temp payload write uses containedWrite.
+ * #3042: when `projectRoot` is set, containment root is projectRoot (not dirname(path))
+ * so force-added lifecycle / cache directory symlinks fail closed.
  */
-export declare function atomicWriteText(path: string, text: string): void;
+export declare function atomicWriteText(path: string, text: string, options?: AtomicWriteTextOptions): void;
 /**
  * Append one JSON audit record (mirrors `_append_audit`).
  * #2951 Phase 2: product write sink routes through containedWrite.

package/dist/cache/io.js

@@ -3,24 +3,53 @@ import { mkdirSync, renameSync, rmSync, statSync, utimesSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { basename, dirname, join, resolve } from "node:path";
 import { containedWrite } from "../fs/contained-write.js";
+import { assertWriteTargetSafe } from "../fs/projection-containment.js";
 import { pythonJsonLine } from "./json.js";
 /**
  * Write text via tempfile + rename (mirrors Python `_atomic_write_text`).
- * #2951 Phase 2: temp payload write uses containedWrite under the parent dir.
+ * #2951 Phase 2: temp payload write uses containedWrite.
+ * #3042: when `projectRoot` is set, containment root is projectRoot (not dirname(path))
+ * so force-added lifecycle / cache directory symlinks fail closed.
  */
-export function atomicWriteText(path, text) {
-    const dir = dirname(path);
+export function atomicWriteText(path, text, options = {}) {
+    const targetAbs = resolve(path);
+    const dir = dirname(targetAbs);
+    const tmpBase = `${basename(targetAbs)}.${randomBytes(4).toString("hex")}.tmp`;
+    const tmp = join(dir, tmpBase);
+    if (options.projectRoot !== undefined) {
+        // Contain against projectRoot (parent-as-root fix #3042 / authz writeJsonContained pattern).
+        const root = resolve(options.projectRoot);
+        assertWriteTargetSafe(root, targetAbs);
+        try {
+            containedWrite({
+                root,
+                target: tmp,
+                data: text,
+                mode: "create",
+            });
+            renameSync(tmp, targetAbs);
+        }
+        catch (err) {
+            try {
+                rmSync(tmp, { force: true });
+            }
+            catch {
+                /* v8 ignore next -- best-effort cleanup */
+            }
+            throw err;
+        }
+        return;
+    }
+    // Legacy: parent-dir containment when no projectRoot (unit helpers / transitional call sites).
     mkdirSync(dir, { recursive: true });
-    const tmpName = `${basename(path)}.${randomBytes(4).toString("hex")}.tmp`;
-    const tmp = join(dir, tmpName);
     try {
         containedWrite({
             root: resolve(dir),
-            target: tmpName,
+            target: tmpBase,
             data: text,
             mode: "create",
         });
-        renameSync(tmp, path);
+        renameSync(tmp, targetAbs);
     }
     catch (err) {
         try {

package/dist/cache/operations.js

@@ -129,14 +129,16 @@ export function cachePut(source, key, raw, options = {}) {
             incomingBytes: incomingDelta,
         });
     }
-    atomicWriteText(join(edir, "raw.json"), rawText);
+    // #3042: contain cache entry writes against project root (parent of cacheRoot).
+    const projectRoot = dirname(resolve(cacheRoot));
+    atomicWriteText(join(edir, "raw.json"), rawText, { projectRoot });
     const authoritativeSize = fileSize(join(edir, "raw.json"));
     const rendered = renderContent(source, raw);
     const scanResult = scan(rendered, utcIso(clock, fetched));
     const contentPath = join(edir, "content.md");
     let contentWritten = false;
     if (scanResult.passed) {
-        atomicWriteText(contentPath, scanResult.transformed_content);
+        atomicWriteText(contentPath, scanResult.transformed_content, { projectRoot });
         contentWritten = true;
     }
     else if (existsSync(contentPath)) {
@@ -158,7 +160,7 @@ export function cachePut(source, key, raw, options = {}) {
         clock,
     });
     validateMeta(meta);
-    atomicWriteText(join(edir, "meta.json"), pythonJsonDump(meta));
+    atomicWriteText(join(edir, "meta.json"), pythonJsonDump(meta), { projectRoot });
     appendAudit({
         event: "cache:put",
         source,

package/dist/doctor/main.js

@@ -4,6 +4,7 @@ import { VBRIEF_VERSION } from "@deftai/directive-types";
 import { evaluate as evaluateAgentsMdAdvisory } from "../agents-md-advisory/evaluate.js";
 import { contentRoot } from "../content-root.js";
 import { resolveProjectDefinitionPath } from "../layout/resolve.js";
+import { DEFT_DIRECTIVE_DISABLE_FLAG_NAME, DEFT_DIRECTIVE_DISABLE_STATUS, DEFT_DIRECTIVE_DISABLE_TRACKED_WARNING, detectDeftDirectiveDisable, formatDeftDirectiveDisableMessage, isDeftDirectiveDisableActive, } from "../policy/deft-directive-disable.js";
 import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_FLAG_NAME, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY, } from "../policy/no-deft-directive.js";
 import { describeShadowedPlanExtension, detectShadowedPlanExtensions, } from "../policy/plan-extensions.js";
 import { loadProjectDefinition } from "../policy/resolve.js";
@@ -70,6 +71,42 @@ export function cmdDoctor(args, seams = {}) {
     const consumerContext = resolve(projectRoot) !== resolve(frameworkRoot);
     const whichFn = seams.whichFn ?? defaultWhich;
     const nowFn = seams.now ?? (() => new Date());
+    // #3039: temporary test kill-switch. Active (untracked) → disabled short-circuit.
+    // Tracked/committed flag → warn only and continue normal doctor (no enforcement bypass).
+    const killSwitch = detectDeftDirectiveDisable(projectRoot, { skipTrackedCache: true });
+    if (killSwitch.present &&
+        killSwitch.trackedByGit &&
+        !isDeftDirectiveDisableActive(projectRoot, { skipTrackedCache: true })) {
+        if (!jsonMode && !quietMode) {
+            process.stderr.write(`${DEFT_DIRECTIVE_DISABLE_TRACKED_WARNING}\n`);
+        }
+        // Continue into full doctor; do not short-circuit.
+    }
+    else if (isDeftDirectiveDisableActive(projectRoot, { skipTrackedCache: true })) {
+        const optOutAlso = detectNoDeftDirective(projectRoot);
+        const message = formatDeftDirectiveDisableMessage({
+            permanentOptOutAlsoPresent: optOutAlso.present,
+            trackedByGit: false,
+        });
+        if (jsonMode) {
+            const payload = {
+                status: DEFT_DIRECTIVE_DISABLE_STATUS,
+                disabled: true,
+                disabled_via: DEFT_DIRECTIVE_DISABLE_FLAG_NAME,
+                kill_switch: true,
+                inconsistent: false,
+                deposit_present: killSwitch.depositPresent,
+                tracked_by_git: false,
+                permanent_opt_out_also_present: optOutAlso.present,
+                message,
+            };
+            process.stdout.write(`${pythonJsonDump(payload)}\n`);
+        }
+        else if (!quietMode) {
+            process.stdout.write(`${message}\n`);
+        }
+        return 0;
+    }
     // #2926: official root opt-out — short-circuit Directive doctor when clean;
     // diagnose flag+deposit inconsistency (warn; exit dirty).
     const optOut = detectNoDeftDirective(projectRoot);

package/dist/hooks/dispatcher.d.ts

@@ -1,4 +1,5 @@
 import { type AuthzState, type HumanOriginGrant } from "../authz/index.js";
+import { detectDeftDirectiveDisable } from "../policy/deft-directive-disable.js";
 import { detectNoDeftDirective } from "../policy/no-deft-directive.js";
 import { type RuntimeAuthorityPolicy } from "../policy/runtime-authority.js";
 import { type VerifyResult } from "../session/verify-session-ritual.js";
@@ -16,7 +17,9 @@ export type CompactHookHost = (typeof COMPACT_HOOK_HOSTS)[number];
 /** Hosts without a native compact hook surface — deposit skips cleanly (#2113). */
 export declare const COMPACT_HOOK_SKIP_HOSTS: readonly ["codex"];
 export type HookVerdict = "allow" | "deny";
-export type HookDecisionCode = "session-start" | "session-start-disabled" | "session-start-degraded" | "session-compact-rearm" | "session-compact-rearm-degraded" | "session-compact-noop" | "not-direct-write" | "invalid-input"
+export type HookDecisionCode = "session-start" | "session-start-disabled" | "session-start-degraded"
+/** Enforcement skipped: root `.deft-directive-disable` test kill-switch (#3039). */
+ | "directive-disabled" | "session-compact-rearm" | "session-compact-rearm-degraded" | "session-compact-noop" | "not-direct-write" | "invalid-input"
 /** Host closed stdin with zero bytes — integration failure, not a policy gate (#2864). */
  | "stdin-empty" | "ritual-not-ready" | "scope-not-ready" | "write-propose-ready" | "write-ready" | "read-only-deny" | "spawn-explore-ready" | "spawn-ready" | "spawn-not-ready" | "runtime-policy-deny-path" | "runtime-policy-deny-scope"
 /** Shell/MCP classifiable push/merge allowed under runtimeAuthority (#2711). */
@@ -56,6 +59,8 @@ export interface HookPolicySeams {
     };
     /** Test seam for #2926 root opt-out on SessionStart. */
     readonly detectNoDeftDirective?: typeof detectNoDeftDirective;
+    /** Test seam for #3039 root test kill-switch (precedence over #2926 for enforcement). */
+    readonly detectDeftDirectiveDisable?: typeof detectDeftDirectiveDisable;
     readonly markCompactStale?: (projectRoot: string) => {
         changed: boolean;
         statePath: string;

package/dist/hooks/dispatcher.js

@@ -2,6 +2,7 @@ import { realpathSync } from "node:fs";
 import { dirname, isAbsolute, relative, resolve, sep } from "node:path";
 import { appendAuthzAudit, classifyHookAuthzOps, evaluateAuthzMutation, evidenceSatisfiesImplementationApproval, listActiveHumanGrants, loadAuthzStateResult, markGrantUsed, shouldConsumeSingleUseGrant, utcIso, } from "../authz/index.js";
 import { hasArtifactSuffix } from "../layout/resolve.js";
+import { detectDeftDirectiveDisable, formatDeftDirectiveDisableMessage, isDeftDirectiveDisableActive, } from "../policy/deft-directive-disable.js";
 import { evaluateIntentCeilingFromEnv } from "../policy/intent-ceiling.js";
 import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, } from "../policy/no-deft-directive.js";
 import { classifyMcpTool, DEFAULT_RUNTIME_AUTHORITY_POLICY, evaluateRuntimeAuthorityDirectWrite, evaluateRuntimeAuthorityShellOp, listShellOps, loadRuntimeAuthorityFromProject, } from "../policy/runtime-authority.js";
@@ -570,6 +571,35 @@ function inspectMutationGates(input, toolName, seams, options) {
 /** Decide a normalized event using only the P0 direct-write policy. */
 export function decideHook(input, seams = {}) {
     const projectRoot = resolve(input.projectRoot);
+    // #3039: local (untracked) `.deft-directive-disable` wins for enforcement
+    // short-circuit (SessionStart / compact / PreToolUse). Deposit may remain.
+    // Tracked/committed flags do NOT bypass gates (repo-controlled content must
+    // not disable enforcement for clones) — doctor warns instead.
+    {
+        const detectKill = seams.detectDeftDirectiveDisable ?? detectDeftDirectiveDisable;
+        const kill = detectKill(projectRoot);
+        const killActive = seams.detectDeftDirectiveDisable !== undefined
+            ? kill.active
+            : isDeftDirectiveDisableActive(projectRoot);
+        if (killActive) {
+            const detectOptOut = seams.detectNoDeftDirective ?? detectNoDeftDirective;
+            const optOut = detectOptOut(projectRoot);
+            const message = formatDeftDirectiveDisableMessage({
+                permanentOptOutAlsoPresent: optOut.present,
+                trackedByGit: false,
+            });
+            return {
+                verdict: "allow",
+                code: input.event === "session.start" ? "session-start-disabled" : "directive-disabled",
+                event: input.event,
+                host: input.host,
+                toolName: null,
+                projectRoot,
+                message,
+                scopePath: null,
+            };
+        }
+    }
     if (input.event === "session.compact") {
         try {
             const result = (seams.markCompactStale ?? markRitualStaleAfterCompact)(projectRoot);

package/dist/init-deposit/gitignore.js

@@ -13,6 +13,7 @@ import { existsSync, readFileSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { containedWrite } from "../fs/contained-write.js";
 import { assertWriteTargetSafe, ProjectionContainmentError } from "../fs/projection-containment.js";
+import { DEFT_DIRECTIVE_DISABLE_GITIGNORE_LINE } from "../policy/deft-directive-disable.js";
 import { FORBIDDEN_BLANKET_EVAL_LINES, stripGitignoreInlineComment, } from "../triage/bootstrap/gitignore.js";
 /** Directory ignore entry for the hybrid deposit (greenfield only). */
 export const GITIGNORE_DEFT_CORE_LINE = ".deft/core/";
@@ -29,6 +30,8 @@ export const CANONICAL_GITIGNORE_BASELINE = [
     ".deft/ritual-state.json",
     ".deft/last-session.json",
     ".deft/routing.local.json",
+    // Temporary test/local kill-switch — must stay untracked (#3039).
+    DEFT_DIRECTIVE_DISABLE_GITIGNORE_LINE,
     "vbrief/.triage-cache/candidates.jsonl",
     "vbrief/.triage-cache/summary-history.jsonl",
     "vbrief/.triage-cache/scope-lifecycle.jsonl",

package/dist/init-deposit/hygiene.d.ts

@@ -2,7 +2,13 @@
  * Scoped staging + installer-managed allowlist for TS-native init/update (#1453).
  *
  * Mirrors cmd/deft-install/hygiene.go + deposit.go installerManagedMatchers.
- * Refs #1576, #1453, #1430.
+ *
+ * CRITICAL (#1430 / #3030): the allowlist MUST honor the SPEC consumer-path
+ * denylist (`CONSUMER_GUARD_MUST_FIRE`). Consumer-authored PROJECT-DEFINITION
+ * and scope briefs are never installer-managed; if they reappear in
+ * `installerManagedMatchers()`, unit tests and deposit-time assert fail closed.
+ *
+ * Refs #1576, #1453, #1430, #3029, #3030.
  */
 import { type InitDepositIo } from "./constants.js";
 export declare const CODEQL_CONFIG_REL = ".github/codeql/codeql-config.yml";
@@ -11,11 +17,47 @@ export interface InstallerManagedMatcher {
     readonly exact?: string;
     readonly prefix?: string;
 }
+/**
+ * Consumer paths that MUST trip no-mixed-core-and-app when mixed with
+ * `.deft/core/**` (#1430 SPEC). These probe paths must never match
+ * `installerManagedMatchers()` / the deposited guard ERE.
+ *
+ * Legitimate installer scaffolding (xbrief/.deft-version, lifecycle .gitkeep,
+ * schemas/, migration/, xbrief.md) is NOT in this denylist — see #2277.
+ * Init may still *create* PROJECT-DEFINITION (#3013); create ≠ allowlist.
+ *
+ * Refs #3030, #3029, #1430.
+ */
+export declare const CONSUMER_GUARD_MUST_FIRE: readonly string[];
 /** Single source of truth for installer-managed paths (#1440 / #1576). */
 export declare function installerManagedMatchers(): InstallerManagedMatcher[];
+/**
+ * Fail closed when the installer-managed allowlist would exempt consumer
+ * PROJECT-DEFINITION or scope briefs (#3030 / #1430). Pure over `matchers` so
+ * tests can inject a bad matcher without mutating production state.
+ *
+ * Checks both:
+ * 1. Explicit probe paths in {@link CONSUMER_GUARD_MUST_FIRE}
+ * 2. Structural patterns (any exact consumer scope brief / PD; forbidden prefixes)
+ *    so an unlisted `xbrief/active/another-scope.xbrief.json` matcher still fails.
+ */
+export declare function assertInstallerAllowlistHonors1430(matchers?: readonly InstallerManagedMatcher[]): void;
 /** POSIX ERE alternation embedded in the deposited deft-core-guard workflow. */
 export declare function installerManagedGuardEre(): string;
 export declare function isInstallerManagedPath(path: string): boolean;
+export interface MixedCoreAndAppClassification {
+    readonly core: string[];
+    readonly installerManaged: string[];
+    readonly app: string[];
+    /** True when both core and app are non-empty — the deposited guard fails. */
+    readonly wouldFail: boolean;
+}
+/**
+ * TS twin of Go `classifyChangedPaths` / deposited shell guard (#1430).
+ * Core = `.deft/core/**`; installer-managed = allowlist; app = everything else.
+ * Guard fails iff both core and app are non-empty.
+ */
+export declare function classifyMixedCoreAndApp(changedPaths: readonly string[], matchers?: readonly InstallerManagedMatcher[]): MixedCoreAndAppClassification;
 export interface FrameworkStagePathsOptions {
     /**
      * Include the vendored `.deft/core` payload in the stage set. Defaults to

package/dist/init-deposit/hygiene.js

@@ -2,7 +2,13 @@
  * Scoped staging + installer-managed allowlist for TS-native init/update (#1453).
  *
  * Mirrors cmd/deft-install/hygiene.go + deposit.go installerManagedMatchers.
- * Refs #1576, #1453, #1430.
+ *
+ * CRITICAL (#1430 / #3030): the allowlist MUST honor the SPEC consumer-path
+ * denylist (`CONSUMER_GUARD_MUST_FIRE`). Consumer-authored PROJECT-DEFINITION
+ * and scope briefs are never installer-managed; if they reappear in
+ * `installerManagedMatchers()`, unit tests and deposit-time assert fail closed.
+ *
+ * Refs #1576, #1453, #1430, #3029, #3030.
  */
 import { execFileSync } from "node:child_process";
 import { existsSync, readdirSync, rmSync } from "node:fs";
@@ -15,6 +21,26 @@ export const CORE_GUARD_WORKFLOW_REL = ".github/workflows/deft-core-guard.yml";
 // The lifecycle dir names are identical across the legacy `vbrief/` tree and the
 // post-#2034 / #2110 `xbrief/` tree, so both allowlist families reuse this list.
 const VBRIEF_LIFECYCLE_DIRS = ["proposed", "pending", "active", "completed", "cancelled"];
+/**
+ * Consumer paths that MUST trip no-mixed-core-and-app when mixed with
+ * `.deft/core/**` (#1430 SPEC). These probe paths must never match
+ * `installerManagedMatchers()` / the deposited guard ERE.
+ *
+ * Legitimate installer scaffolding (xbrief/.deft-version, lifecycle .gitkeep,
+ * schemas/, migration/, xbrief.md) is NOT in this denylist — see #2277.
+ * Init may still *create* PROJECT-DEFINITION (#3013); create ≠ allowlist.
+ *
+ * Refs #3030, #3029, #1430.
+ */
+export const CONSUMER_GUARD_MUST_FIRE = [
+    "xbrief/PROJECT-DEFINITION.xbrief.json",
+    "vbrief/PROJECT-DEFINITION.vbrief.json",
+    // Representative consumer scope briefs (not scaffolding markers).
+    "xbrief/active/example-scope.xbrief.json",
+    "vbrief/active/example-scope.vbrief.json",
+    "xbrief/proposed/example-scope.xbrief.json",
+    "vbrief/pending/example-scope.vbrief.json",
+];
 /** Single source of truth for installer-managed paths (#1440 / #1576). */
 export function installerManagedMatchers() {
     return [
@@ -45,9 +71,10 @@ export function installerManagedMatchers() {
         // `deft update` framework-deposit PR trips no-mixed-core-and-app (#2277).
         { exact: "xbrief/.deft-version" },
         { exact: "xbrief/xbrief.md" },
-        // Minimal render-ready seed from init (#3013); operator may later edit identity.
-        { exact: "xbrief/PROJECT-DEFINITION.xbrief.json" },
-        { exact: "vbrief/PROJECT-DEFINITION.vbrief.json" },
+        // CRITICAL (#1430 / #3029 / #3030): do NOT allowlist consumer-authored
+        // PROJECT-DEFINITION (xbrief/ or vbrief/) or consumer scope briefs.
+        // Init may still seed PD (#3013); the seed is app-owned for guard classification
+        // so core+PD mixed PRs fail no-mixed-core-and-app. See CONSUMER_GUARD_MUST_FIRE.
         { prefix: "xbrief/schemas/" },
         { prefix: "xbrief/migration/" },
         ...VBRIEF_LIFECYCLE_DIRS.map((sub) => ({ exact: `xbrief/${sub}/.gitkeep` })),
@@ -61,12 +88,6 @@ function matcherToEre(matcher) {
         return `^${escapeEre(matcher.exact)}$`;
     return `^${escapeEre(matcher.prefix ?? "")}`;
 }
-/** POSIX ERE alternation embedded in the deposited deft-core-guard workflow. */
-export function installerManagedGuardEre() {
-    return installerManagedMatchers()
-        .map((matcher) => matcherToEre(matcher))
-        .join("|");
-}
 function matchesInstallerManaged(path, matchers) {
     for (const matcher of matchers) {
         if (matcher.exact && path === matcher.exact)
@@ -76,9 +97,90 @@ function matchesInstallerManaged(path, matchers) {
     }
     return false;
 }
+/** Consumer scope-brief filenames under lifecycle dirs (not scaffolding). */
+const CONSUMER_SCOPE_BRIEF_EXACT = /^(xbrief|vbrief)\/(proposed|pending|active|completed|cancelled)\/.+\.(x|v)brief\.json$/;
+/** PROJECT-DEFINITION exact paths (xbrief or legacy vbrief). */
+const CONSUMER_PROJECT_DEFINITION_EXACT = /^(xbrief|vbrief)\/PROJECT-DEFINITION\.(x|v)brief\.json$/;
+/**
+ * Prefixes that would exempt entire consumer lifecycle trees or the whole
+ * xbrief/vbrief tree — never installer-managed (#1430).
+ */
+const FORBIDDEN_CONSUMER_PREFIXES = new Set([
+    "xbrief/",
+    "vbrief/",
+    ...VBRIEF_LIFECYCLE_DIRS.flatMap((sub) => [`xbrief/${sub}/`, `vbrief/${sub}/`]),
+]);
+/**
+ * Fail closed when the installer-managed allowlist would exempt consumer
+ * PROJECT-DEFINITION or scope briefs (#3030 / #1430). Pure over `matchers` so
+ * tests can inject a bad matcher without mutating production state.
+ *
+ * Checks both:
+ * 1. Explicit probe paths in {@link CONSUMER_GUARD_MUST_FIRE}
+ * 2. Structural patterns (any exact consumer scope brief / PD; forbidden prefixes)
+ *    so an unlisted `xbrief/active/another-scope.xbrief.json` matcher still fails.
+ */
+export function assertInstallerAllowlistHonors1430(matchers = installerManagedMatchers()) {
+    for (const path of CONSUMER_GUARD_MUST_FIRE) {
+        if (matchesInstallerManaged(path, matchers)) {
+            throw new Error(`#1430 violation: ${path} must not be installer-managed (SPEC consumer denylist; see CONSUMER_GUARD_MUST_FIRE / #3030)`);
+        }
+    }
+    for (const matcher of matchers) {
+        if (matcher.exact) {
+            if (CONSUMER_PROJECT_DEFINITION_EXACT.test(matcher.exact) ||
+                CONSUMER_SCOPE_BRIEF_EXACT.test(matcher.exact)) {
+                throw new Error(`#1430 violation: exact matcher ${matcher.exact} must not be installer-managed (consumer brief denylist / #3030)`);
+            }
+        }
+        if (matcher.prefix) {
+            const normalized = matcher.prefix.endsWith("/") ? matcher.prefix : `${matcher.prefix}/`;
+            if (FORBIDDEN_CONSUMER_PREFIXES.has(normalized)) {
+                throw new Error(`#1430 violation: prefix matcher ${matcher.prefix} must not cover consumer brief trees (#3030)`);
+            }
+        }
+    }
+}
+/** POSIX ERE alternation embedded in the deposited deft-core-guard workflow. */
+export function installerManagedGuardEre() {
+    const matchers = installerManagedMatchers();
+    // Refuse to emit a guard workflow that would exempt consumer denylist paths.
+    assertInstallerAllowlistHonors1430(matchers);
+    return matchers.map((matcher) => matcherToEre(matcher)).join("|");
+}
 export function isInstallerManagedPath(path) {
     return matchesInstallerManaged(path, installerManagedMatchers());
 }
+/**
+ * TS twin of Go `classifyChangedPaths` / deposited shell guard (#1430).
+ * Core = `.deft/core/**`; installer-managed = allowlist; app = everything else.
+ * Guard fails iff both core and app are non-empty.
+ */
+export function classifyMixedCoreAndApp(changedPaths, matchers = installerManagedMatchers()) {
+    const core = [];
+    const installerManaged = [];
+    const app = [];
+    for (const raw of changedPaths) {
+        const path = raw.replace(/\\/g, "/");
+        if (!path)
+            continue;
+        if (path === ".deft/core" || path.startsWith(".deft/core/")) {
+            core.push(path);
+        }
+        else if (matchesInstallerManaged(path, matchers)) {
+            installerManaged.push(path);
+        }
+        else {
+            app.push(path);
+        }
+    }
+    return {
+        core,
+        installerManaged,
+        app,
+        wouldFail: core.length > 0 && app.length > 0,
+    };
+}
 export function frameworkStagePaths(projectDir, deftDir, options = {}) {
     const paths = [];
     const seen = new Set();

package/dist/init-deposit/scaffold.js

@@ -14,7 +14,7 @@ import { assertDestinationNotSymlink, ProjectionContainmentError, } from "../fs/
 import { agentsRefreshPlan } from "../platform/agents-md.js";
 import { MIGRATED_ARTIFACT_DIR } from "../xbrief-migrate/constants.js";
 import { CANONICAL_INSTALL_ROOT } from "./constants.js";
-import { installerManagedGuardEre } from "./hygiene.js";
+import { assertInstallerAllowlistHonors1430, installerManagedGuardEre } from "./hygiene.js";
 import { syncConsumerXbriefSchemas } from "./xbrief-projections.js";
 export { CANONICAL_INSTALL_ROOT };
 export const CORE_GLOB = ".deft/core/**";
@@ -632,6 +632,8 @@ export function mergeCoreGuardWorkflowRefresh(existing, desired) {
     return desired.slice(0, idx) + existingCheckout + desired.slice(idx + desiredCheckout.length);
 }
 function coreGuardWorkflowContent() {
+    // Fail closed before emitting guard ERE if allowlist violates #1430 denylist (#3030).
+    assertInstallerAllowlistHonors1430();
     const baseSha = githubActionsExpr("github.event.pull_request.base.sha");
     const headSha = githubActionsExpr("github.event.pull_request.head.sha");
     return ("name: deft-core-guard\n\n" +

package/dist/orchestration/probe-session.d.ts

@@ -36,7 +36,11 @@ export declare function detectGitBranch(projectRoot: string, execGit?: (args: st
 }): string;
 /** Read probe session from project root. */
 export declare function readSession(projectRoot: string): ProbeSession | null;
-/** Atomically persist session to .deft/probe-session.json. */
+/**
+ * Atomically persist session to .deft/probe-session.json.
+ * #3042: contain against projectRoot; refuse escaping `.deft` symlink parents
+ * (no bare open/write/rename).
+ */
 export declare function writeSession(projectRoot: string, session: ProbeSession): string;
 export declare function startSession(projectRoot: string, options: {
     target: string;

package/dist/orchestration/probe-session.js

@@ -3,8 +3,10 @@
  */
 import { execFileSync } from "node:child_process";
 import { randomBytes } from "node:crypto";
-import { closeSync, existsSync, fdatasyncSync, mkdirSync, openSync, readFileSync, renameSync, writeSync, } from "node:fs";
+import { existsSync, readFileSync, renameSync, rmSync } from "node:fs";
 import { join, resolve } from "node:path";
+import { containedWrite } from "../fs/contained-write.js";
+import { assertWriteTargetSafe } from "../fs/projection-containment.js";
 export const SCHEMA_VERSION = 1;
 export const SESSION_RELPATH = [".deft", "probe-session.json"];
 export const STATE_INTERROGATE = "interrogate";
@@ -188,11 +190,16 @@ export function readSession(projectRoot) {
         completed_at: completedAt,
     };
 }
-/** Atomically persist session to .deft/probe-session.json. */
+/**
+ * Atomically persist session to .deft/probe-session.json.
+ * #3042: contain against projectRoot; refuse escaping `.deft` symlink parents
+ * (no bare open/write/rename).
+ */
 export function writeSession(projectRoot, session) {
-    const sessionFile = sessionPath(projectRoot);
-    mkdirSync(join(projectRoot, ".deft"), { recursive: true });
-    const tmpName = join(projectRoot, ".deft", `.probe-session.${randomBytes(8).toString("hex")}.json.tmp`);
+    const root = resolve(projectRoot);
+    const sessionFile = sessionPath(root);
+    assertWriteTargetSafe(root, sessionFile);
+    const tmpName = join(root, ".deft", `.probe-session.${randomBytes(8).toString("hex")}.json.tmp`);
     const sortedPayload = sessionToDict(session);
     const sortedKeys = Object.keys(sortedPayload).sort();
     const sortedObj = {};
@@ -200,20 +207,24 @@ export function writeSession(projectRoot, session) {
         sortedObj[k] = sortedPayload[k];
     }
     const finalContent = `${JSON.stringify(sortedObj, null, 2)}\n`;
-    const fd = openSync(tmpName, "w");
     try {
-        writeSync(fd, finalContent, undefined, "utf8");
+        containedWrite({
+            root,
+            target: tmpName,
+            data: finalContent,
+            mode: "create",
+        });
+        renameSync(tmpName, sessionFile);
+    }
+    catch (err) {
         try {
-            fdatasyncSync(fd);
+            rmSync(tmpName, { force: true });
         }
         catch {
-            // best effort
+            /* best-effort cleanup */
         }
+        throw err;
     }
-    finally {
-        closeSync(fd);
-    }
-    renameSync(tmpName, sessionFile);
     return sessionFile;
 }
 export function startSession(projectRoot, options) {

package/dist/platform/agents-md.js

@@ -324,7 +324,7 @@ export function applyAgentsRefresh(projectRoot, options = {}, seams = {}, lockDe
             const writable = AGENTS_REFRESH_WRITABLE_STATES.has(state) && typeof newContent === "string";
             return { state, path, wrote: false, writable };
         }
-        atomicWriteText(path, newContent);
+        atomicWriteText(path, newContent, { projectRoot });
         return { state, path, wrote: true, writable: true };
     }, lockDeps);
 }