@deftai/directive-core 0.96.0 → 0.97.0

package/dist/doctor/openclaw-soft-rebind.js

@@ -0,0 +1,164 @@
+/**
+ * Doctor check + --fix wire for OpenClaw soft AGENTS re-bind skill (#3171).
+ *
+ * Complements always-pins (#3001/#3008) and L2 product commands (#3064). This
+ * skill is the required durable soft post-amnesia surface for OpenClaw — not
+ * claimed via file-host PreCompact hooks alone.
+ */
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { formatOpenClawSoftRebindSkillMarkdown, isManagedOpenClawSoftRebindSkill, OPENCLAW_SOFT_REBIND_SKILL_ID, } from "../session/compact-ritual.js";
+import { assessOpenClawSoftRebindSkill, depositOpenClawSoftRebindSkill, } from "../session/openclaw-soft-rebind-deposit.js";
+import { detectOpenClaw, listInScopeSkillsDirs } from "./openclaw-skills.js";
+/** Stable doctor check id for JSON findings. */
+export const OPENCLAW_SOFT_REBIND_CHECK = "openclaw-soft-agents-rebind";
+const DOC_OPENCLAW_HOST = "docs/openclaw-agent-host.md";
+const REMEDIATION_FIX = "deft doctor --fix";
+function defaultIsDir(path) {
+    try {
+        return statSync(path).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+function assessGaps(skillsDirs) {
+    const expected = formatOpenClawSoftRebindSkillMarkdown();
+    const missing = [];
+    const stale = [];
+    let present = 0;
+    for (const skillsDir of skillsDirs) {
+        const path = join(skillsDir, OPENCLAW_SOFT_REBIND_SKILL_ID, "SKILL.md");
+        if (!existsSync(path)) {
+            missing.push(`${skillsDir}/${OPENCLAW_SOFT_REBIND_SKILL_ID}`);
+            continue;
+        }
+        let raw;
+        try {
+            raw = readFileSync(path, "utf8");
+        }
+        catch {
+            missing.push(`${skillsDir}/${OPENCLAW_SOFT_REBIND_SKILL_ID}`);
+            continue;
+        }
+        // Unmanaged content at the required slug is incomplete health, not pass
+        // (Greptile P1 #3171). Doctor --fix overwrites via deposit.
+        if (!isManagedOpenClawSoftRebindSkill(raw) || raw !== expected) {
+            stale.push(`${skillsDir}/${OPENCLAW_SOFT_REBIND_SKILL_ID}`);
+            continue;
+        }
+        present += 1;
+    }
+    return { missing, stale, present };
+}
+/**
+ * Doctor check: OpenClaw soft AGENTS re-bind skill present and current.
+ * No-ops when OpenClaw is not detected. Fix mode deposits managed skill.
+ */
+export function runOpenClawSoftRebindCheck(sink, addFinding, options) {
+    const seams = options.seams ?? {};
+    const env = seams.openclawEnv ?? process.env;
+    const homeDirFn = seams.openclawHomeDir ?? (() => homedir());
+    const isDir = seams.isDir ?? defaultIsDir;
+    const detect = detectOpenClaw(env, { homeDir: homeDirFn(), isDir });
+    if (!detect.detected) {
+        sink.info(`${OPENCLAW_SOFT_REBIND_CHECK}: skip -- OpenClaw not detected`);
+        addFinding({
+            severity: "skip",
+            message: "OpenClaw not detected",
+            check: OPENCLAW_SOFT_REBIND_CHECK,
+            status: "skip",
+            reason: "openclaw-not-detected",
+        });
+        return null;
+    }
+    const skillsDirs = listInScopeSkillsDirs(detect.stateDir, options.allAgents, {
+        isDir,
+    });
+    const gaps = assessGaps(skillsDirs);
+    if (gaps.missing.length === 0 && gaps.stale.length === 0) {
+        const scope = options.allAgents ? "main + workspace-* seats" : "main workspace";
+        const message = `${OPENCLAW_SOFT_REBIND_CHECK}: soft AGENTS re-bind skill present ` +
+            `(${OPENCLAW_SOFT_REBIND_SKILL_ID}) in ${scope}`;
+        sink.success(message);
+        addFinding({
+            severity: "skip",
+            message,
+            check: OPENCLAW_SOFT_REBIND_CHECK,
+            status: "present",
+            skill: OPENCLAW_SOFT_REBIND_SKILL_ID,
+            skills_dirs: skillsDirs,
+        });
+        return null;
+    }
+    if (options.fixMode) {
+        const depositResult = depositOpenClawSoftRebindSkill({
+            env,
+            homeDir: homeDirFn(),
+            allAgents: options.allAgents,
+            isDir,
+            skillsDirs,
+        });
+        const after = assessGaps(skillsDirs);
+        if (after.missing.length === 0 && after.stale.length === 0) {
+            const message = `${OPENCLAW_SOFT_REBIND_CHECK}: deposited soft AGENTS re-bind skill; ` +
+                `restart OpenClaw gateway or start a new session (${DOC_OPENCLAW_HOST})`;
+            sink.success(message);
+            addFinding({
+                severity: "skip",
+                message,
+                check: OPENCLAW_SOFT_REBIND_CHECK,
+                status: "fixed",
+                written: depositResult.writtenPaths,
+            });
+            return depositResult;
+        }
+        // Partial fix: report remaining gaps from post-deposit assessment (SLizard P2).
+        const partsAfter = [];
+        if (after.missing.length > 0) {
+            partsAfter.push(`missing=${after.missing.join(", ")}`);
+        }
+        if (after.stale.length > 0) {
+            partsAfter.push(`stale=${after.stale.join(", ")}`);
+        }
+        const messageAfter = `${OPENCLAW_SOFT_REBIND_CHECK}: OpenClaw soft AGENTS re-bind skill incomplete after fix ` +
+            `(${partsAfter.join("; ")}). Remediation: ${REMEDIATION_FIX} — see ${DOC_OPENCLAW_HOST}`;
+        sink.warn(messageAfter);
+        addFinding({
+            severity: "warning",
+            message: messageAfter,
+            check: OPENCLAW_SOFT_REBIND_CHECK,
+            status: "incomplete",
+            missing: after.missing,
+            stale: after.stale,
+            written: depositResult.writtenPaths,
+            suggestion: REMEDIATION_FIX,
+            docs: [DOC_OPENCLAW_HOST],
+        });
+        return depositResult;
+    }
+    const parts = [];
+    if (gaps.missing.length > 0) {
+        parts.push(`missing=${gaps.missing.join(", ")}`);
+    }
+    if (gaps.stale.length > 0) {
+        parts.push(`stale=${gaps.stale.join(", ")}`);
+    }
+    const message = `${OPENCLAW_SOFT_REBIND_CHECK}: OpenClaw soft AGENTS re-bind skill incomplete ` +
+        `(${parts.join("; ")}). Remediation: ${REMEDIATION_FIX} — see ${DOC_OPENCLAW_HOST}`;
+    sink.warn(message);
+    addFinding({
+        severity: "warning",
+        message,
+        check: OPENCLAW_SOFT_REBIND_CHECK,
+        status: "incomplete",
+        missing: gaps.missing,
+        stale: gaps.stale,
+        suggestion: REMEDIATION_FIX,
+        docs: [DOC_OPENCLAW_HOST],
+    });
+    return null;
+}
+export { assessOpenClawSoftRebindSkill, depositOpenClawSoftRebindSkill };
+//# sourceMappingURL=openclaw-soft-rebind.js.map

package/dist/hooks/dispatcher.d.ts

@@ -140,7 +140,8 @@ export declare function decideHook(input: HookDispatchInput, seams?: HookPolicyS
  * Cursor deposits use `failClosed: true`. Cursor treats empty/null stdout as a
  * hook failure and blocks the tool — so Cursor allows must emit explicit
  * `{"permission":"allow"}`. Other hosts keep empty allow so the host permission
- * flow is unchanged.
+ * flow is unchanged — except session.start / session.compact soft re-bind
+ * injection (#3171), which surfaces checklist text without a write tool.
  *
  * Cursor stdout always includes `code` (stable machine-readable decision code)
  * so agents can distinguish policy denials from host-integration failures

package/dist/hooks/dispatcher.js

@@ -7,6 +7,7 @@ import { evaluateIntentCeilingFromEnv } from "../policy/intent-ceiling.js";
 import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, } from "../policy/no-deft-directive.js";
 import { classifyMcpTool, DEFAULT_RUNTIME_AUTHORITY_POLICY, evaluateRuntimeAuthorityDirectWrite, evaluateRuntimeAuthorityShellOp, listShellOps, loadRuntimeAuthorityFromProject, } from "../policy/runtime-authority.js";
 import { loadStoryWriteFenceFromPath, resolveWriteFence } from "../policy/write-fence.js";
+import { appendSoftAgentsRebindToMessage, decisionCarriesSoftAgentsRebind, formatSoftAgentsRebindChecklist, } from "../session/compact-ritual.js";
 import { detectBranch } from "../session/git.js";
 import { emitSessionRitualBlockedProcessCost } from "../session/process-cost.js";
 import { markRitualStaleAfterCompact } from "../session/ritual-sentinel.js";
@@ -716,7 +717,8 @@ export function decideHook(input, seams = {}) {
                     host: input.host,
                     toolName: null,
                     projectRoot,
-                    message: result.message,
+                    // Soft checklist still surfaces after compact even when ritual was absent (#3171).
+                    message: appendSoftAgentsRebindToMessage(result.message),
                     scopePath: null,
                 };
             }
@@ -727,7 +729,7 @@ export function decideHook(input, seams = {}) {
                 host: input.host,
                 toolName: null,
                 projectRoot,
-                message: result.message,
+                message: appendSoftAgentsRebindToMessage(result.message),
                 scopePath: null,
             };
         }
@@ -739,8 +741,8 @@ export function decideHook(input, seams = {}) {
                 host: input.host,
                 toolName: null,
                 projectRoot,
-                message: "Directive compact re-arm bookkeeping failed on its non-blocking path: " +
-                    `${String(cause)}`,
+                message: appendSoftAgentsRebindToMessage("Directive compact re-arm bookkeeping failed on its non-blocking path: " +
+                    `${String(cause)}`),
                 scopePath: null,
             };
         }
@@ -775,8 +777,9 @@ export function decideHook(input, seams = {}) {
                     host: input.host,
                     toolName: null,
                     projectRoot,
-                    message: `Directive SessionStart bookkeeping reported exit ${result.code} on its non-blocking path` +
-                        `${detail.length > 0 ? `: ${detail}` : "."}`,
+                    // Best-effort soft cue on SessionStart (Codex gap + resume/amnesia) (#3171).
+                    message: appendSoftAgentsRebindToMessage(`Directive SessionStart bookkeeping reported exit ${result.code} on its non-blocking path` +
+                        `${detail.length > 0 ? `: ${detail}` : "."}`),
                     scopePath: null,
                 };
             }
@@ -789,7 +792,7 @@ export function decideHook(input, seams = {}) {
                 host: input.host,
                 toolName: null,
                 projectRoot,
-                message: `Directive SessionStart bookkeeping failed on its non-blocking path: ${String(cause)}`,
+                message: appendSoftAgentsRebindToMessage(`Directive SessionStart bookkeeping failed on its non-blocking path: ${String(cause)}`),
                 scopePath: null,
             };
         }
@@ -800,7 +803,8 @@ export function decideHook(input, seams = {}) {
             host: input.host,
             toolName: null,
             projectRoot,
-            message: "SessionStart bookkeeping completed on a non-blocking path.",
+            // Soft AGENTS re-bind on SessionStart without requiring a write tool (#3171 / #2769).
+            message: appendSoftAgentsRebindToMessage("SessionStart bookkeeping completed on a non-blocking path."),
             scopePath: null,
         };
     }
@@ -881,13 +885,27 @@ export function decideHook(input, seams = {}) {
     }
     return inspectMutationGates(input, toolName, seams, { proposedLifecycleExempt: true });
 }
+/**
+ * Soft AGENTS re-bind text for host injection when decision carries soft path (#3171).
+ * Prefer the checklist portion of the decision message; fall back to SoT formatter.
+ */
+function softAgentsRebindWireText(decision) {
+    if (!decisionCarriesSoftAgentsRebind({ event: decision.event, code: decision.code })) {
+        return null;
+    }
+    if (decision.message.includes("Soft AGENTS re-bind checklist:")) {
+        return decision.message;
+    }
+    return formatSoftAgentsRebindChecklist();
+}
 /**
  * Render host-facing hook output.
  *
  * Cursor deposits use `failClosed: true`. Cursor treats empty/null stdout as a
  * hook failure and blocks the tool — so Cursor allows must emit explicit
  * `{"permission":"allow"}`. Other hosts keep empty allow so the host permission
- * flow is unchanged.
+ * flow is unchanged — except session.start / session.compact soft re-bind
+ * injection (#3171), which surfaces checklist text without a write tool.
  *
  * Cursor stdout always includes `code` (stable machine-readable decision code)
  * so agents can distinguish policy denials from host-integration failures
@@ -896,9 +914,45 @@ export function decideHook(input, seams = {}) {
  */
 export function renderHostDecision(host, decision) {
     if (decision.verdict === "allow") {
+        const soft = softAgentsRebindWireText(decision);
         if (host === "cursor") {
+            if (decision.event === "session.start" && soft !== null) {
+                // Cursor sessionStart injects additional_context into the conversation.
+                return JSON.stringify({
+                    permission: "allow",
+                    code: decision.code,
+                    additional_context: soft,
+                });
+            }
+            if (decision.event === "session.compact" && soft !== null) {
+                // Cursor preCompact is observational; user_message surfaces the soft cue.
+                // Hard re-arm still ran via bookkeeping; agent path also gets SessionStart on resume.
+                return JSON.stringify({
+                    user_message: soft,
+                    code: decision.code,
+                });
+            }
             return JSON.stringify({ permission: "allow", code: decision.code });
         }
+        if (soft !== null &&
+            (decision.event === "session.start" || decision.event === "session.compact")) {
+            if (host === "claude" || host === "codex") {
+                const hookEventName = decision.event === "session.start" ? "SessionStart" : "PostCompact";
+                return JSON.stringify({
+                    hookSpecificOutput: {
+                        hookEventName,
+                        additionalContext: soft,
+                    },
+                });
+            }
+            if (host === "grok") {
+                return JSON.stringify({
+                    decision: "allow",
+                    reason: soft,
+                    additional_context: soft,
+                });
+            }
+        }
         return "";
     }
     switch (host) {

package/dist/index.d.ts

@@ -14,7 +14,9 @@ export * as branch from "./branch/index.js";
 export * as cache from "./cache/index.js";
 export * as capacity from "./capacity/index.js";
 export * as codebase from "./codebase/index.js";
+export * as consumerCheckContract from "./consumer-check-contract/index.js";
 export * from "./coverage-hotspots/index.js";
+export * as deliveryAttempt from "./delivery-attempt/index.js";
 export * as doctor from "./doctor/index.js";
 export * from "./encoding/index.js";
 export * as escalation from "./escalation/index.js";
@@ -52,11 +54,13 @@ export * as render from "./render/index.js";
 export * as resolution from "./resolution/index.js";
 export * as scm from "./scm/index.js";
 export * as scope from "./scope/index.js";
+export * as scopeProvenance from "./scope-provenance/index.js";
 export * as session from "./session/index.js";
 export * as slash from "./slash/index.js";
 export * as slice from "./slice/index.js";
 export * as storyReady from "./story-ready/index.js";
 export * as swarm from "./swarm/index.js";
+export * as testBoundary from "./test-boundary/index.js";
 export * as toolEvents from "./tool-events/index.js";
 export * as triage from "./triage/index.js";
 export * as userConfig from "./user-config/index.js";

package/dist/index.js

@@ -14,7 +14,9 @@ export * as branch from "./branch/index.js";
 export * as cache from "./cache/index.js";
 export * as capacity from "./capacity/index.js";
 export * as codebase from "./codebase/index.js";
+export * as consumerCheckContract from "./consumer-check-contract/index.js";
 export * from "./coverage-hotspots/index.js";
+export * as deliveryAttempt from "./delivery-attempt/index.js";
 export * as doctor from "./doctor/index.js";
 export * from "./encoding/index.js";
 export * as escalation from "./escalation/index.js";
@@ -53,11 +55,13 @@ export * as render from "./render/index.js";
 export * as resolution from "./resolution/index.js";
 export * as scm from "./scm/index.js";
 export * as scope from "./scope/index.js";
+export * as scopeProvenance from "./scope-provenance/index.js";
 export * as session from "./session/index.js";
 export * as slash from "./slash/index.js";
 export * as slice from "./slice/index.js";
 export * as storyReady from "./story-ready/index.js";
 export * as swarm from "./swarm/index.js";
+export * as testBoundary from "./test-boundary/index.js";
 export * as toolEvents from "./tool-events/index.js";
 export * as triage from "./triage/index.js";
 export * as userConfig from "./user-config/index.js";

package/dist/init-deposit/gitignore.js

@@ -37,6 +37,11 @@ export const CANONICAL_GITIGNORE_BASELINE = [
     "vbrief/.triage-cache/scope-lifecycle.jsonl",
     "vbrief/.triage-cache/decompositions/",
     "vbrief/.triage-cache/doctor-state.json",
+    // Per-clone session state (#3146): throttle / release-availability JSON
+    // written under the lifecycle .triage-cache; selective ignore only (hybrid
+    // #1144 — never blanket-ignore the whole .triage-cache directory).
+    "vbrief/.triage-cache/staleness-tickler-state.json",
+    "vbrief/.triage-cache/release-availability-state.json",
     // Symmetric `xbrief/` layout entries (#2348). On the migrated `xbrief/` tree
     // the engine writes operator-private triage-cache files to
     // `xbrief/.triage-cache/`; without these the paths are trackable, violating
@@ -47,6 +52,8 @@ export const CANONICAL_GITIGNORE_BASELINE = [
     "xbrief/.triage-cache/scope-lifecycle.jsonl",
     "xbrief/.triage-cache/decompositions/",
     "xbrief/.triage-cache/doctor-state.json",
+    "xbrief/.triage-cache/staleness-tickler-state.json",
+    "xbrief/.triage-cache/release-availability-state.json",
     "vbrief/*.lock",
     ".deft/core.bak-*/",
     ".deft/*.bak-*",

package/dist/init-deposit/init-deposit.js

@@ -15,6 +15,7 @@ import { resolveInstalledContentRoot } from "../deposit/resolve-content.js";
 import { readCorePackageVersion } from "../engine-version.js";
 import { stampLiveGeneration } from "../freshness/generation.js";
 import { renderProjectDefinition } from "../render/project-render.js";
+import { depositOpenClawSoftRebindSkill } from "../session/openclaw-soft-rebind-deposit.js";
 import { depositOpenClawL2ProductCommands } from "../slash/openclaw-deposit.js";
 import { agentHookReadinessJson, evaluateAgentHookReadiness, evaluateAgentHookReadinessSafely, } from "../verify-env/agent-hook-readiness.js";
 import { removeStaleMigratedFrameworkNarrative } from "../xbrief-migrate/migrate-project.js";
@@ -201,6 +202,10 @@ export async function runInitDeposit(args, io, seams = {}) {
     writeConsumerGitHooks(projectDir, deftDir, io, seams.gitHooks);
     writeAgentHookDeposit(projectDir, io);
     writeSlashCommandDeposit(projectDir, io);
+    // #3171: OpenClaw soft AGENTS re-bind skill when OC signals present (fail-closed otherwise).
+    depositOpenClawSoftRebindSkill({
+    /* env defaults; skip when OpenClaw not detected */
+    });
     // #3064: OpenClaw L2 product-command skills when OC signals present (fail-closed otherwise).
     depositOpenClawL2ProductCommands({
         projectRoot: projectDir,

package/dist/init-deposit/refresh.js

@@ -22,6 +22,7 @@ import { resolveLifecycleRoot } from "../layout/resolve.js";
 import { detectNoDeftDirective, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_FLAG_NAME, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, NO_DEFT_DIRECTIVE_INCONSISTENT_POLICY, } from "../policy/no-deft-directive.js";
 import { runOrgForceOnMigration } from "../policy/org-force-on-migration.js";
 import { checkLocalEngineIntegrity, classify, ENGINE_PACKAGE, plan, renderGlobalInstall, resolveEngine, } from "../resolution/index.js";
+import { depositOpenClawSoftRebindSkill } from "../session/openclaw-soft-rebind-deposit.js";
 import { depositOpenClawL2ProductCommands } from "../slash/openclaw-deposit.js";
 import { gitPorcelain } from "../story-ready/git.js";
 import { agentHookReadinessJson, evaluateAgentHookReadiness, evaluateAgentHookReadinessSafely, } from "../verify-env/agent-hook-readiness.js";
@@ -506,6 +507,8 @@ export async function runRefreshDeposit(args, io, seams = {}) {
     // #75 residual: multi-host thin skill discovery (mirror `.agents/skills` inventory).
     writeMultiHostSkillDiscovery(projectDir, io);
     writeSlashCommandDeposit(projectDir, io);
+    // #3171: OpenClaw soft AGENTS re-bind skill when OC signals present (fail-closed otherwise).
+    depositOpenClawSoftRebindSkill({});
     // #3064: OpenClaw L2 product-command skills when OC signals present (fail-closed otherwise).
     depositOpenClawL2ProductCommands({
         projectRoot: projectDir,

package/dist/pr-merge-readiness/ci-gate.d.ts

@@ -1,5 +1,21 @@
 import type { CheckRunRecord } from "./gh.js";
-export type CiReadyState = "ready" | "blocked" | "not_ready_yet" | "runner_capacity_stall" | "skipped";
+/**
+ * Bot-reviewer check-runs are not CI workflow jobs. Presence of only these
+ * (or empty check-runs) is the `ci_never_scheduled` weather signal (#3167).
+ */
+export declare function isBotReviewCheck(name: string): boolean;
+/**
+ * Suite family for cancelled↔green sibling matching (#3167 / Greptile P1).
+ * Unrelated greens (CodeQL, Socket, …) must not clear a cancelled TypeScript/Go lane.
+ * Returns null when the check is not a TS/Go CI suite job.
+ */
+export declare function suiteFamilyOf(name: string): "typescript" | "go" | null;
+/**
+ * Branch-protection SoT aggregators only (#3168 map). Primary/failover lanes are
+ * not authoritative: a green primary must not clear a cancelled aggregator.
+ */
+export declare function isAuthoritativeSuiteAggregator(name: string): boolean;
+export type CiReadyState = "ready" | "blocked" | "ci_failures" | "not_ready_yet" | "runner_capacity_stall" | "ci_never_scheduled" | "ci_cancelled_no_failover" | "skipped";
 export interface CiGateOptions {
     readonly skipCi?: boolean;
     readonly ignoreCheckNames?: readonly string[];
@@ -23,6 +39,8 @@ export interface CiGateSummary {
     readonly pending_required: readonly string[];
     /** Required checks classified as capacity-stalled (#2672). */
     readonly capacity_stalled_required: readonly string[];
+    /** Required checks cancelled without a green failover sibling (#3167). */
+    readonly cancelled_required: readonly string[];
     readonly conclusions: readonly CiCheckConclusion[];
 }
 export interface CiGateResult {
@@ -30,5 +48,15 @@ export interface CiGateResult {
     readonly summary: CiGateSummary;
 }
 export declare function buildCiSummaryLine(summary: CiGateSummary): string;
+/**
+ * Classify required CI weather for a HEAD check-run list (#2169 / #2672 / #3167).
+ *
+ * Distinct ready_state codes:
+ * - `ci_never_scheduled` — no CI workflow check-runs (bots alone / empty)
+ * - `runner_capacity_stall` — queued past budget, no runner claimed
+ * - `ci_failures` — completed failure / timed_out with product evidence
+ * - `ci_cancelled_no_failover` — only cancelled failures; no green failover
+ * - `not_ready_yet` / `ready` / `blocked` / `skipped` — legacy + residual
+ */
 export declare function evaluateCiGate(checkRuns: readonly CheckRunRecord[], options?: CiGateOptions): CiGateResult;
 //# sourceMappingURL=ci-gate.d.ts.map