@deftai/directive-core 0.98.0 → 0.99.0

package/dist/policy/deft-directive-disable.js

@@ -19,7 +19,7 @@
  * - Precedence: active kill-switch first, then `.no-deft-directive`, else normal.
  */
 import { execFileSync } from "node:child_process";
-import { statSync } from "node:fs";
+import { lstatSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { CANONICAL_INSTALL_ROOT } from "../init-deposit/constants.js";
 /** Canonical root-only filename (lowercase). Presence = candidate flag. */
@@ -51,9 +51,19 @@ const GIT_TRACKED_PROBE_TIMEOUT_MS = 1500;
 /** Process-local cache: avoid re-spawning git on every PreToolUse while the flag is present. */
 const trackedProbeCache = new Map();
 const TRACKED_PROBE_CACHE_TTL_MS = 30_000;
+/**
+ * Regular-file check that does **not** treat a symlink as an intentional kill-switch
+ * (#3213 residual after #3206). `statSync().isFile()` follows links, so
+ * `ln -sf /etc/hosts .deft-directive-disable` would activate enforcement off.
+ * Prefer `lstatSync`: only a non-symlink regular file counts as present.
+ */
 function defaultIsFile(path) {
     try {
-        return statSync(path).isFile();
+        const lst = lstatSync(path);
+        // Attacker-planted symlink → not an intentional operator flag (#3213).
+        if (lst.isSymbolicLink())
+            return false;
+        return lst.isFile();
     }
     catch {
         return false;

package/dist/policy/index.d.ts

@@ -1,6 +1,7 @@
 export * from "./agents-md-advisory.js";
 export * from "./autonomy.js";
 export * from "./capacity.js";
+export * from "./ceremony-dial.js";
 export * from "./check-resume.js";
 export * from "./coverage-check-resume-presets.js";
 export * from "./coverage-debt.js";

package/dist/policy/index.js

@@ -1,5 +1,6 @@
 import { FIELD_HOST_SKILL_DISCOVERY, FIELD_HOST_SKILL_DISCOVERY_CLI_ALIAS, inspectHostSkillDiscovery, } from "../init-deposit/skill-discovery-hosts.js";
 import { FIELD_OPENCLAW_PRODUCT_COMMANDS, FIELD_OPENCLAW_PRODUCT_COMMANDS_CLI_ALIAS, inspectOpenClawProductCommands, } from "../slash/openclaw-deposit.js";
+import { FIELD_CEREMONY_DIAL, FIELD_CEREMONY_DIAL_CLI_ALIAS, inspectCeremonyDial, } from "./ceremony-dial.js";
 import { FIELD_CHECK_RESUME, FIELD_CHECK_RESUME_CLI_ALIAS, inspectCheckResume, } from "./check-resume.js";
 import { FIELD_COVERAGE_DEBT, FIELD_COVERAGE_DEBT_CLI_ALIAS, inspectCoverageDebt, } from "./coverage-debt.js";
 import { FIELD_DELIVERY_BRANCH, FIELD_DELIVERY_BRANCH_CLI_ALIAS, inspectDeliveryBranch, } from "./delivery-branch.js";
@@ -18,6 +19,7 @@ import { DEFAULT_WIP_CAP } from "./wip.js";
 export * from "./agents-md-advisory.js";
 export * from "./autonomy.js";
 export * from "./capacity.js";
+export * from "./ceremony-dial.js";
 export * from "./check-resume.js";
 export * from "./coverage-check-resume-presets.js";
 export * from "./coverage-debt.js";
@@ -408,6 +410,15 @@ function inspectMinGreptileConfidenceField(data, projectRoot) {
         source: field.source,
     };
 }
+function inspectCeremonyDialField(data, projectRoot) {
+    const field = inspectCeremonyDial(data, projectRoot);
+    return {
+        name: field.name,
+        current: field.current,
+        default: field.default,
+        source: field.source,
+    };
+}
 const REGISTERED_POLICIES = [
     inspectAllowDirectCommits,
     inspectWipCap,
@@ -435,6 +446,7 @@ const REGISTERED_POLICIES = [
     inspectCheckResumeField,
     inspectRequireHumanMergeField,
     inspectHotfixCriteriaField,
+    inspectCeremonyDialField,
 ];
 /** Walk registered inspectors and return one row per field (#1148). */
 export function inspectAllPolicies(projectRoot) {
@@ -471,7 +483,9 @@ export function inspectOnePolicy(name, projectRoot) {
                                                         ? FIELD_DELIVERY_BRANCH
                                                         : name === FIELD_MIN_GREPTILE_CONFIDENCE_CLI_ALIAS
                                                             ? FIELD_MIN_GREPTILE_CONFIDENCE
-                                                            : name;
+                                                            : name === FIELD_CEREMONY_DIAL_CLI_ALIAS
+                                                                ? FIELD_CEREMONY_DIAL
+                                                                : name;
     for (const field of inspectAllPolicies(projectRoot)) {
         if (field.name === normalized)
             return field;

package/dist/pr-merge-readiness/evaluate.js

@@ -39,6 +39,16 @@ export function evaluateGates(_prNumber, headSha, verdict, inline = null, option
                 "Address remaining findings or push clarifying changes. " +
                 "Inspect the floor via `task policy:show --field=minGreptileConfidence` (#3095).");
         }
+        // #3225: advisory should-not-merge prose blocks regardless of formal review
+        // state / Ready-to-merge mechanical box. Composes with minGreptileConfidence
+        // (#3095): sub-threshold conf already fails above; this catches high-conf
+        // prose blocks and conf-only paths that still name should-not-merge.
+        if (verdict.shouldNotMerge) {
+            failures.push("Reviewer bot comment prose records a should-not-merge / not-safe-to-merge " +
+                "advisory verdict (no formal Changes-Requested required). " +
+                "Mechanical Ready-to-merge / green checks are necessary, never sufficient (#3225). " +
+                "Address residual risk or wait for a clean advisory re-review before merge.");
+        }
         if (verdict.p0Count > 0 || verdict.p1Count > 0) {
             failures.push(`Greptile reports ${verdict.p0Count} P0 and ${verdict.p1Count} P1 findings ` +
                 "on the current HEAD. All P0 / P1 findings MUST be addressed before merge " +

package/dist/pr-merge-readiness/mergeability.js

@@ -114,6 +114,11 @@ minConfidence = 4) {
         !meetsMinGreptileConfidence(verdict.confidence, minConfidence)) {
         return false;
     }
+    // Advisory should-not-merge prose is never soft (#3225): GitHub Ready-to-merge
+    // must not reconcile away explicit bot prose while formal review stays Comment.
+    if (verdict.shouldNotMerge) {
+        return false;
+    }
     if (verdict.p0Count > 0 || verdict.p1Count > 0) {
         return false;
     }

package/dist/pr-merge-readiness/output.js

@@ -12,6 +12,7 @@ function verdictToDict(verdict) {
         p2_count: verdict.p2Count,
         informal_clean: verdict.informalClean,
         excluded_author: verdict.excludedAuthor,
+        should_not_merge: verdict.shouldNotMerge,
         raw_body_excerpt: verdict.rawBodyExcerpt,
     };
 }
@@ -58,6 +59,7 @@ export function printHuman(result) {
         lines.push(`  Confidence:         ${confidenceStr}/5`);
         lines.push(`  Findings:           P0=${result.verdict.p0Count}  ` +
             `P1=${result.verdict.p1Count}  P2=${result.verdict.p2Count}`);
+        lines.push(`  Advisory should-not-merge: ${result.verdict.shouldNotMerge ? "True" : "False"} (#3225)`);
         lines.push(`  Errored sentinel:   ${result.verdict.errored ? "True" : "False"}`);
     }
     const ciBlock = result.partialData.ci;

package/dist/pr-merge-readiness/parse.js

@@ -1,3 +1,4 @@
+import { hasShouldNotMergeProse } from "../content-contracts/skills/greptile-detector.js";
 import { findLastReviewedCommitSha } from "../text/redos-safe.js";
 import { CONFIDENCE_RE, GREPTILE_ERRORED_SENTINEL, GREPTILE_EXCLUDED_AUTHOR_PHRASE, GREPTILE_STATUS_MARKER, INFORMAL_CLEAN_SIGNAL_RE, P0_BADGE, P1_BADGE, SECTION_RE, } from "./constants.js";
 export function emptyVerdict() {
@@ -11,6 +12,7 @@ export function emptyVerdict() {
         p2Count: 0,
         informalClean: false,
         excludedAuthor: false,
+        shouldNotMerge: false,
         rawBodyExcerpt: "",
     };
 }
@@ -81,6 +83,8 @@ export function parseGreptileBody(body) {
         p2Count,
         informalClean: false,
         excludedAuthor,
+        // #3225: advisory prose is a first-class hard block (not formal review state).
+        shouldNotMerge: hasShouldNotMergeProse(body),
         rawBodyExcerpt: body.slice(0, 200),
     };
     if (isInformalCleanMissingCanonicalFields(verdict, body)) {

package/dist/pr-merge-readiness/types.d.ts

@@ -9,6 +9,12 @@ export interface GreptileVerdict {
     readonly informalClean: boolean;
     /** Greptile deliberately skipped review for an excluded PR author (#2375). */
     readonly excludedAuthor: boolean;
+    /**
+     * Advisory should-not-merge / not-safe-to-merge prose in the bot comment body
+     * (#3225). Independent of formal Changes-Requested review state; a hard block
+     * for merge-ready even when GitHub reports Ready-to-merge.
+     */
+    readonly shouldNotMerge: boolean;
     readonly rawBodyExcerpt: string;
 }
 export interface GateResult {

package/dist/scope/effort-activate-gate.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Effort estimate activate gate (#1581).
+ *
+ * PlanItem.effort is optional (S|M|L|XL). XL means "needs breakdown" —
+ * a scope must not move into active/running while any plan item (nested
+ * via items or subItems) still carries effort === "XL".
+ */
+export declare const EFFORT_XL: "XL";
+export interface XlEffortHit {
+    readonly id: string;
+    readonly title: string;
+    readonly path: string;
+}
+export interface EffortActivateGateResult {
+    readonly ok: boolean;
+    readonly message: string;
+    readonly xlItems: readonly XlEffortHit[];
+}
+/**
+ * Walk plan.items / subItems and collect every item with effort === "XL".
+ */
+export declare function collectXlEffortItems(items: unknown, pathPrefix?: string): XlEffortHit[];
+/**
+ * Fail-closed activate gate: any XL plan item blocks pending → active.
+ * Omitted effort is allowed (field is optional).
+ */
+export declare function evaluateEffortActivateGate(plan: Record<string, unknown>): EffortActivateGateResult;
+//# sourceMappingURL=effort-activate-gate.d.ts.map

package/dist/scope/effort-activate-gate.js

@@ -0,0 +1,64 @@
+/**
+ * Effort estimate activate gate (#1581).
+ *
+ * PlanItem.effort is optional (S|M|L|XL). XL means "needs breakdown" —
+ * a scope must not move into active/running while any plan item (nested
+ * via items or subItems) still carries effort === "XL".
+ */
+export const EFFORT_XL = "XL";
+function itemLabel(item) {
+    if (typeof item.id === "string" && item.id.length > 0) {
+        return item.id;
+    }
+    if (typeof item.title === "string" && item.title.length > 0) {
+        return item.title;
+    }
+    return "<no-id>";
+}
+/**
+ * Walk plan.items / subItems and collect every item with effort === "XL".
+ */
+export function collectXlEffortItems(items, pathPrefix = "plan.items") {
+    if (!Array.isArray(items)) {
+        return [];
+    }
+    const hits = [];
+    for (let i = 0; i < items.length; i += 1) {
+        const raw = items[i];
+        if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+            continue;
+        }
+        const item = raw;
+        const id = itemLabel(item);
+        const path = `${pathPrefix}[${id}]`;
+        if (item.effort === EFFORT_XL) {
+            hits.push({
+                id,
+                title: typeof item.title === "string" ? item.title : id,
+                path,
+            });
+        }
+        hits.push(...collectXlEffortItems(item.items, `${path}.items`));
+        hits.push(...collectXlEffortItems(item.subItems, `${path}.subItems`));
+    }
+    return hits;
+}
+/**
+ * Fail-closed activate gate: any XL plan item blocks pending → active.
+ * Omitted effort is allowed (field is optional).
+ */
+export function evaluateEffortActivateGate(plan) {
+    const xlItems = collectXlEffortItems(plan.items);
+    if (xlItems.length === 0) {
+        return { ok: true, message: "", xlItems: [] };
+    }
+    const listing = xlItems.map((h) => `${h.path} ("${h.title}")`).join("; ");
+    return {
+        ok: false,
+        message: `Refusing activate: plan item(s) still have effort=XL and must be broken ` +
+            `into S/M/L before active/running (#1581): ${listing}. ` +
+            `Replace each XL item with smaller S/M/L sub-items (or re-estimate to S/M/L), then retry.`,
+        xlItems,
+    };
+}
+//# sourceMappingURL=effort-activate-gate.js.map

package/dist/scope/index.d.ts

@@ -4,6 +4,7 @@ export * from "./constants.js";
 export * from "./decomposed-refs.js";
 export * from "./delivery-evidence.js";
 export * from "./demote.js";
+export * from "./effort-activate-gate.js";
 export * from "./main.js";
 export * from "./open-umbrella-warning.js";
 export * from "./project-context.js";

package/dist/scope/index.js

@@ -4,6 +4,7 @@ export * from "./constants.js";
 export * from "./decomposed-refs.js";
 export * from "./delivery-evidence.js";
 export * from "./demote.js";
+export * from "./effort-activate-gate.js";
 export * from "./main.js";
 export * from "./open-umbrella-warning.js";
 export * from "./project-context.js";

package/dist/scope/transition.js

@@ -9,6 +9,7 @@ import { stampCompletionMetadata } from "./capacity-stamp.js";
 import { LIFECYCLE_FOLDERS, MOVE_LABELS, STATUS_PRECONDITIONS, STAY_LABELS, TRANSITIONS, } from "./constants.js";
 import { detectLifecycleFolder, updateDecomposedChildBackReferences, updateDecomposedParentBackReferences, } from "./decomposed-refs.js";
 import { classifyStoredDeliveryDisposition, evaluateDeliveryGate, stampDeliveryProvenance, } from "./delivery-evidence.js";
+import { evaluateEffortActivateGate } from "./effort-activate-gate.js";
 import { syncProjectDefinitionAfterScopeMove } from "./project-definition-sync.js";
 import { syncSpecificationAfterScopeMove } from "./specification-sync.js";
 import { utcNowIso } from "./vbrief-json.js";
@@ -138,6 +139,13 @@ export function runTransition(action, filePath, now = new Date(), options = {})
         }
     }
     const nowIso = utcNowIso(now);
+    // #1581: fail closed before activating a scope that still has XL plan items.
+    if (act === "activate") {
+        const effortGate = evaluateEffortActivateGate(planObj);
+        if (!effortGate.ok) {
+            return { ok: false, message: effortGate.message };
+        }
+    }
     // #3041: fail closed before mutating a code-bearing complete without delivery evidence.
     if (act === "complete") {
         const gate = evaluateDeliveryGate({

package/dist/scope-provenance/evaluate.d.ts

@@ -61,6 +61,27 @@ export declare function normalizeRepoRelPath(p: string): string;
  * Git C-quoting / slash folding may produce (Greptile conf=4 residual).
  */
 export declare function changedSetHasPath(changedSet: ReadonlySet<string>, rel: string): boolean;
+/**
+ * Parse + lightly validate an approved-scope JSON blob (base-ref `git show` or disk).
+ * Returns null when schema fields required for authorization are missing/malformed.
+ */
+export declare function parseApprovedScopeRecordRaw(raw: string): ApprovedScopeRecord | null;
+/**
+ * True when the merge-base approved-scope record authorizes the current scope and
+ * the current disk record is semantically unchanged from that base authority (#3205).
+ *
+ * Authority comes from the approval record on the base, not from whether the active
+ * xBRIEF path existed on the base (pending→active is the normal first activation).
+ */
+export declare function baseApprovalAuthorizesCurrent(input: {
+    readonly projectRoot: string;
+    readonly baseRef: string | null;
+    readonly approvalRecordRel: string;
+    readonly planId: string;
+    readonly xbriefRelPath: string;
+    readonly currentDigest: string;
+    readonly currentApproved: ApprovedScopeRecord;
+}): boolean;
 /**
  * Pure evaluation of one active xBRIEF against its approved baseline.
  * Exported for unit tests without git.

package/dist/scope-provenance/evaluate.js

@@ -203,9 +203,83 @@ function listActiveXbriefPaths(projectRoot) {
 }
 function remediationForExpansion() {
     return ("Renew human approval: re-record the approved-scope digest after operator review " +
-        "(`task scope:record-approved-scope` / write `.deft/approved-scope/<plan-id>.json` " +
-        "with humanApproval stamp). Editing the active xBRIEF alone does not authorize new " +
-        "paths (#3145). See content/docs/scope-provenance.md.");
+        "(`task scope:record-approved-scope -- <xbrief-path> --actor <you>` writes " +
+        "`.deft/approved-scope/<plan-id>.json` with a humanApproval stamp). Commit that " +
+        "approval on the merge base (or a prior PR) before expanding or activating the " +
+        "scoped xBRIEF in the implementation change set. Editing the active xBRIEF alone " +
+        "does not authorize new paths (#3145 / #3205). See content/docs/scope-provenance.md.");
+}
+/**
+ * Parse + lightly validate an approved-scope JSON blob (base-ref `git show` or disk).
+ * Returns null when schema fields required for authorization are missing/malformed.
+ */
+export function parseApprovedScopeRecordRaw(raw) {
+    try {
+        const data = JSON.parse(raw);
+        if (data === null || typeof data !== "object" || Array.isArray(data))
+            return null;
+        const rec = data;
+        if (rec.schemaVersion !== undefined && rec.schemaVersion !== 1)
+            return null;
+        if (typeof rec.planId !== "string" || rec.planId.trim().length === 0)
+            return null;
+        if (typeof rec.xbriefRelPath !== "string" || rec.xbriefRelPath.trim().length === 0) {
+            return null;
+        }
+        if (typeof rec.fileScopeDigest !== "string" || rec.fileScopeDigest.length === 0) {
+            return null;
+        }
+        if (!Array.isArray(rec.fileScope))
+            return null;
+        // Digest must match the recorded path list — never trust a forged digest alone (#3205 Greptile).
+        const scopePaths = rec.fileScope.filter((x) => typeof x === "string");
+        const expected = computeFileScopeDigest(scopePaths);
+        if (rec.fileScopeDigest !== expected)
+            return null;
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * True when the merge-base approved-scope record authorizes the current scope and
+ * the current disk record is semantically unchanged from that base authority (#3205).
+ *
+ * Authority comes from the approval record on the base, not from whether the active
+ * xBRIEF path existed on the base (pending→active is the normal first activation).
+ */
+export function baseApprovalAuthorizesCurrent(input) {
+    if (input.baseRef === null || input.baseRef === "")
+        return false;
+    const baseRaw = readRepoFileAtRef(input.projectRoot, input.baseRef, input.approvalRecordRel);
+    if (baseRaw === null)
+        return false;
+    const baseRec = parseApprovedScopeRecordRaw(baseRaw);
+    if (baseRec === null)
+        return false;
+    if (!isHumanApprovalStamp(baseRec.humanApproval))
+        return false;
+    if (baseRec.planId !== input.planId)
+        return false;
+    if (normalizeRepoRelPath(baseRec.xbriefRelPath) !== normalizeRepoRelPath(input.xbriefRelPath)) {
+        return false;
+    }
+    // Base record must authorize the *current* file_scope (digest match).
+    if (baseRec.fileScopeDigest !== input.currentDigest)
+        return false;
+    // Current on-disk/injected record must not diverge from base authority fields.
+    if (input.currentApproved.fileScopeDigest !== baseRec.fileScopeDigest)
+        return false;
+    if (input.currentApproved.planId !== baseRec.planId)
+        return false;
+    if (normalizeRepoRelPath(input.currentApproved.xbriefRelPath) !==
+        normalizeRepoRelPath(baseRec.xbriefRelPath)) {
+        return false;
+    }
+    if (!isHumanApprovalStamp(input.currentApproved.humanApproval))
+        return false;
+    return true;
 }
 function configError(message) {
     return { exitCode: 2, findings: [], message };
@@ -250,13 +324,42 @@ export function evaluateOneScopeProvenance(input) {
         isHumanApprovalStamp(input.approved.humanApproval)) {
         return null;
     }
+    // Matching digest without human origin: empty-scope body edits may soft-warn
+    // via the missing-digest path only when no usable approval; agent/malformed
+    // stamps must not authorize non-empty scopes (#3205).
+    if (input.approved.fileScopeDigest === currentDigest) {
+        if (currentScope.length === 0) {
+            return null;
+        }
+        if (!isHumanApprovalStamp(input.approved.humanApproval)) {
+            return {
+                xbriefRelPath: input.xbriefRelPath,
+                planId,
+                kind: "active-xbrief-modified-without-digest",
+                expandedPaths: currentScope,
+                detail: "active xBRIEF modified with a non-human (agent/missing) approved-scope stamp; " +
+                    "only humanApproval stamps authorize non-empty file_scope",
+                remediation: "Record a human-origin approval via `task scope:record-approved-scope -- " +
+                    "<xbrief-path> --actor <you>` (#3145 / #3205).",
+            };
+        }
+    }
     const expanded = scopeExpansion(input.approved.fileScope, currentScope);
     if (expanded.length === 0) {
-        // Scope shrink or identical after normalize — body edit without expansion is OK
-        if (input.approved.fileScopeDigest === currentDigest) {
-            return null;
+        // Scope shrink or digest noise without path expansion — OK for v1 when human-stamped.
+        // Non-empty current scope still requires human origin (agent shrink must not bypass #3205).
+        if (currentScope.length > 0 && !isHumanApprovalStamp(input.approved.humanApproval)) {
+            return {
+                xbriefRelPath: input.xbriefRelPath,
+                planId,
+                kind: "active-xbrief-modified-without-digest",
+                expandedPaths: currentScope,
+                detail: "active xBRIEF modified with a non-human approved-scope stamp (scope shrink/noise path); " +
+                    "only humanApproval stamps authorize non-empty file_scope",
+                remediation: "Record a human-origin approval via `task scope:record-approved-scope -- " +
+                    "<xbrief-path> --actor <you>` (#3145 / #3205).",
+            };
         }
-        // Digest mismatch without path expansion (reorder/noise) — still OK for v1
         return null;
     }
     // Expansion without renewed human approval = self-authorization
@@ -303,10 +406,18 @@ export function evaluateScopeProvenance(projectRoot, options = {}) {
             if (baseRef === undefined || baseRef === "" || baseRef === "HEAD") {
                 const resolved = resolveDefaultBaseRef(root);
                 if (resolved === null) {
-                    return configError("verify_scope_provenance: no merge-base ref found (origin/master|main, " +
-                        "DEFT_BASE_REF, or GITHUB_BASE_REF).\n" +
-                        "  Recovery: fetch the default branch or pass --base-ref <ref>. " +
-                        "Bare HEAD cannot see committed PR scope expansion (#3145).");
+                    // Greenfield / single-commit consumer trees often have no origin/* and no
+                    // default-branch ref yet. Fail closed only when the caller demanded an
+                    // explicit --base-ref; otherwise soft-skip (same posture as non-git trees)
+                    // so verify:scope-provenance does not brick `task check` on init (#3205 smoke).
+                    return {
+                        exitCode: 0,
+                        findings: [],
+                        message: "verify_scope_provenance: skipped -- no merge-base ref found " +
+                            "(origin/master|main, DEFT_BASE_REF, or GITHUB_BASE_REF). " +
+                            "Fetch the default branch or pass --base-ref <ref> before enforcing " +
+                            "PR scope expansion (#3145 / #3205).",
+                    };
                 }
                 baseRef = resolved;
             }
@@ -412,38 +523,36 @@ export function evaluateScopeProvenance(projectRoot, options = {}) {
                 return (n.includes("/approved-scope/") &&
                     (n.endsWith(`/${safe}.json`) || n.endsWith(`${safe}.json`)));
             });
-        // Ignored / untracked approved-scope files never appear in git changedSet.
-        // Concurrent rewrite attack: scope *expanded* vs base AND an untracked disk
-        // approval was rewritten to match the *new* digest. Body-only xBRIEF edits
-        // with a pre-existing matching approval must NOT fail (Greptile conf=2).
+        // Disk-only / concurrent-rewrite inference (#3205):
+        // Authority is the *approval record on the merge base*, not whether the
+        // active xBRIEF path existed there. pending→active leaves the active path
+        // absent on base; treating that as an approval rewrite is a false positive.
+        // Fail closed when base approval is missing, malformed, agent-stamped,
+        // path/plan/digest mismatched, or the current record diverged from base.
+        // Same-PR git changes still hard-fail via approvalInGitChange.
         let approvalDiskOnly = false;
         if (modified &&
             approved !== null &&
             renewed === null &&
             approvalRecordRel !== null &&
+            planId !== null &&
             !approvalInGitChange &&
             existsSync(join(root, approvalRecordRel)) &&
             isHumanApprovalStamp(approved.humanApproval)) {
             const currentDigest = computeFileScopeDigest(normalizeFileScope(extractFileScope(payload)));
             if (approved.fileScopeDigest === currentDigest) {
-                const baseRaw = discoveryBaseRef !== null ? readRepoFileAtRef(root, discoveryBaseRef, rel) : null;
-                if (baseRaw === null) {
-                    // New active xBRIEF with untracked matching approval → fail closed.
+                const baseAuthorizes = baseApprovalAuthorizesCurrent({
+                    projectRoot: root,
+                    baseRef: discoveryBaseRef,
+                    approvalRecordRel,
+                    planId,
+                    xbriefRelPath: rel,
+                    currentDigest,
+                    currentApproved: approved,
+                });
+                if (!baseAuthorizes) {
                     approvalDiskOnly = true;
                 }
-                else {
-                    try {
-                        const basePayload = JSON.parse(baseRaw);
-                        const baseDigest = computeFileScopeDigest(normalizeFileScope(extractFileScope(basePayload)));
-                        // Only concurrent-rewrite when file-scope actually grew/changed.
-                        if (baseDigest !== currentDigest) {
-                            approvalDiskOnly = true;
-                        }
-                    }
-                    catch {
-                        approvalDiskOnly = true;
-                    }
-                }
             }
         }
         const approvalRecordRewritten = approvalInGitChange || approvalDiskOnly;
@@ -463,8 +572,9 @@ export function evaluateScopeProvenance(projectRoot, options = {}) {
                 expandedPaths: currentScope,
                 detail: "approved-scope record rewritten in the same change set as the active xBRIEF; " +
                     "cannot self-authorize via concurrent approval rewrite",
-                remediation: "Record renewed human approval outside the implementation PR (or pass an " +
-                    "independent renewed stamp). Same-PR approval rewrites do not authorize expansion (#3145).",
+                remediation: "Commit human approval via `task scope:record-approved-scope` on the merge base " +
+                    "(or a prior PR), then activate/expand without rewriting the approval in this " +
+                    "change set. Same-PR approval rewrites do not authorize expansion (#3145 / #3205).",
             });
             continue;
         }

package/dist/scope-provenance/index.d.ts

@@ -2,5 +2,5 @@
  * scope-provenance package surface (#3145).
  */
 export { APPROVED_SCOPE_DIR, type ApprovedScopeRecord, approvedScopeDir, approvedScopeRecordPath, buildApprovedScopeRecord, computeFileScopeDigest, computeTextDigest, extractFileScope, extractPlanId, isHumanApprovalStamp, listApprovedScopeRecords, normalizeFileScope, readApprovedScopeRecord, scopeExpansion, writeApprovedScopeRecord, } from "./digest.js";
-export { evaluateOneScopeProvenance, evaluateScopeProvenance, resolveDefaultBaseRef, type ScopeProvenanceFinding, type ScopeProvenanceOptions, type ScopeProvenanceResult, type ScopeProvenanceViolationKind, } from "./evaluate.js";
+export { baseApprovalAuthorizesCurrent, evaluateOneScopeProvenance, evaluateScopeProvenance, parseApprovedScopeRecordRaw, resolveDefaultBaseRef, type ScopeProvenanceFinding, type ScopeProvenanceOptions, type ScopeProvenanceResult, type ScopeProvenanceViolationKind, } from "./evaluate.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/scope-provenance/index.js

@@ -2,5 +2,5 @@
  * scope-provenance package surface (#3145).
  */
 export { APPROVED_SCOPE_DIR, approvedScopeDir, approvedScopeRecordPath, buildApprovedScopeRecord, computeFileScopeDigest, computeTextDigest, extractFileScope, extractPlanId, isHumanApprovalStamp, listApprovedScopeRecords, normalizeFileScope, readApprovedScopeRecord, scopeExpansion, writeApprovedScopeRecord, } from "./digest.js";
-export { evaluateOneScopeProvenance, evaluateScopeProvenance, resolveDefaultBaseRef, } from "./evaluate.js";
+export { baseApprovalAuthorizesCurrent, evaluateOneScopeProvenance, evaluateScopeProvenance, parseApprovedScopeRecordRaw, resolveDefaultBaseRef, } from "./evaluate.js";
 //# sourceMappingURL=index.js.map

package/dist/session/session-start.d.ts

@@ -1,4 +1,6 @@
+import { type HostContentSurfaceSeams } from "../platform/host-content-surface.js";
 import { type EnvironmentContext } from "../platform/shell-context.js";
+import { type CeremonyDialInputs, type CeremonyDialSelection, type ProvisionalCeremonyEstimateHints } from "../policy/ceremony-dial.js";
 import { type ProbeScmReadinessOptions, type ScmReadinessReport } from "../scm/readiness.js";
 import { type ResolveUserMdResult } from "../user-config/resolve-user-md.js";
 import type { GitRunner } from "./git.js";
@@ -15,7 +17,7 @@ export declare const SESSION_CEREMONY_TIERS: readonly ["cold", "rearm"];
 export type SessionCeremonyTier = (typeof SESSION_CEREMONY_TIERS)[number];
 export declare const COLD_CEREMONY_TIER: SessionCeremonyTier;
 export declare const REARM_CEREMONY_TIER: SessionCeremonyTier;
-export declare const QUICK_STEPS: readonly ["alignment", "branch_policy", "triage_welcome"];
+export declare const QUICK_STEPS: readonly ["alignment", "branch_policy", "triage_welcome", "verify_tools"];
 export declare const GATED_STEPS: readonly ["agent_hooks", "doctor", "cache_fresh"];
 export type GatedStepName = (typeof GATED_STEPS)[number];
 /** Env opt-in for optional session:start network (release probe + triage cache hydrate) (#2991). */
@@ -69,6 +71,11 @@ export interface SessionStartOptions {
     };
     readonly resolveUserMd?: (projectRoot: string) => ResolveUserMdResult;
     readonly probeEnvironment?: () => EnvironmentContext;
+    /**
+     * #3162: host content-surface class + managed-section drift seams (tests inject).
+     * Fail-open advisory only — never blocks session:start.
+     */
+    readonly hostContentSurfaceSeams?: HostContentSurfaceSeams;
     readonly probeReleaseAvailability?: (projectRoot: string, options: ReleaseAvailabilityProbeOptions) => {
         lines: readonly string[];
     };
@@ -94,6 +101,22 @@ export interface SessionStartOptions {
      * network is enabled. Inject in tests.
      */
     readonly probeScm?: (options: ProbeScmReadinessOptions) => ScmReadinessReport;
+    /**
+     * #3214: ceremony dial inputs (task size × model tier × project shape).
+     * Missing fields are filled by the headless provisional classifier
+     * (env / verb / file-scope / deposit layout) — no plan-item effort (#1581).
+     */
+    readonly ceremonyDialInputs?: CeremonyDialInputs;
+    /**
+     * #3214: optional intake hints for provisional size (prompt/verb/files).
+     * Vanilla deposit session:start runs provisional fill without policy opt-in.
+     */
+    readonly ceremonyDialHints?: Omit<ProvisionalCeremonyEstimateHints, "projectRoot" | "env">;
+    /**
+     * #3214: optional pre-resolved dial (tests). When omitted, resolveCeremonyDial
+     * loads plan.policy.ceremonyDial and applies inputs (after provisional fill).
+     */
+    readonly ceremonyDial?: CeremonyDialSelection;
 }
 /** Format preferred `session:start` recovery command for cold vs re-arm (#2992). */
 export declare function formatSessionStartRecoveryCommand(tier?: SessionCeremonyTier): string;