@deftai/directive-runtime 0.126.0-beta.3 → 0.128.0

package/Taskfile.yml

@@ -69,6 +69,9 @@ env:
   UV_PROJECT: '{{.TASKFILE_DIR}}'
 
 includes:
+  deft:
+    taskfile: ./node_modules/@deftai/directive-runtime/Taskfile.yml
+    optional: true
   docs:
     taskfile: ./tasks/docs.yml
     optional: true
@@ -393,6 +396,10 @@ includes:
   engine:
     taskfile: ./tasks/engine.yml
     optional: true
+  # #5805: tip-without-publish materialize into checkout pin.
+  materialize:
+    taskfile: ./tasks/materialize.yml
+    optional: true
 
 tasks:
   default:
@@ -405,8 +412,7 @@ tasks:
   check:
     desc: "Run the context-appropriate pre-commit gate: full framework self-check in this repo, consumer-safe gate from vendored installs (#1519)."
     dir: '{{.USER_WORKING_DIR}}'
-    deps:
-      - task: engine:_ts-build
+    # #5805: no engine:_ts-build — pin-exclusive ordinary invoke.
     cmds:
       - task: engine:invoke
         vars:
@@ -419,8 +425,7 @@ tasks:
 
   check:merge:
     desc: "Merge chokepoint gate — explicit alias for check:framework-source (#1704). CI and PR gates SHOULD invoke this (or task check) as the single SoT so discrete workflow steps cannot drift."
-    deps:
-      - task: engine:_ts-build
+    # #5805: no engine:_ts-build here — ordinary/merge invoke uses the checkout pin, not tip dist.
     cmds:
       - task: check:framework-source
 
@@ -452,6 +457,8 @@ tasks:
       - verify:bridge-drift
       - verify:branch
       - verify:encoding
+      # Keep local uncached closing-keyword checks (#5736 Greptile); CI branch-gate
+      # still owns --mode both for merge-base / commit-range.
       - verify:closing-keywords
       - verify:forward-coverage
       - verify:changelog-unreleased
@@ -595,8 +602,6 @@ tasks:
   verify-strategy-output:
     desc: "Deterministic v0.20 strategy output shape gate (#1166 s2). Fails on non-date-prefixed vBRIEFs in lifecycle dirs, missing PROJECT-DEFINITION.vbrief.json, or legacy specification.vbrief.json in user projects."
     dir: '{{.USER_WORKING_DIR}}'
-    deps:
-      - task: engine:_ts-build
     cmds:
       - task: engine:invoke
         vars:
@@ -618,8 +623,6 @@ tasks:
 
   verify:no-task-runtime:
     desc: "Fail when runtime Python code hard-depends on go-task (#1659)."
-    deps:
-      - task: engine:_ts-build
     cmds:
       # Oracle/fallback (parity): scripts/verify_no_task_runtime.py (#1854 s3).
       - task: engine:invoke
@@ -649,7 +652,7 @@ tasks:
   # User-facing upgrade entrypoint (#1061). Aliases the install:upgrade
   # wrapper. As of #2064 the native deft-ts install-upgrade handler is a thin
   # redirect onto `directive update` -- the single canonical upgrade verb that
-  # file-swaps the vendored .deft/core payload, rewrites the install manifest,
+  # file-swaps the vendored runtime payload, rewrites the install manifest,
   # and regenerates .deft-version. Prefer `deft update` directly; this alias is
   # retained for compatibility. Cited by the doctor's failure prose and
   # docs/install-manifest.md as the post-drift repair entrypoint.
@@ -659,7 +662,7 @@ tasks:
       - task: install:upgrade
 
   # #1272: canonical doctor surface -- thin shim that forwards to
-  # ``.deft/core/run doctor``. The ``run`` CLI owns the diagnostic
+  # the runtime doctor entry. The doctor CLI owns the diagnostic
   # logic (system deps, framework layout, root Taskfile.yml include
   # health) and the optional interactive repair path. The task
   # accepts user-facing flags (``--session`` / ``--fix`` / ``--json``
@@ -680,8 +683,6 @@ tasks:
   setup:
     desc: "Idempotent local-dev setup: configure git hooks (#747); detect-and-prompt ghx (#884). Sets core.hooksPath=.githooks so .githooks/pre-commit + .githooks/pre-push run."
     dir: '{{.USER_WORKING_DIR}}'
-    deps:
-      - task: engine:_ts-build
     env:
       PYTHONUTF8: "1"
     cmds:
@@ -758,8 +759,6 @@ tasks:
   setup:ghx:
     desc: "Consent-gated ghx (brunoborges/ghx) installer (#884) -- task setup:ghx [-- --yes]"
     dir: '{{.USER_WORKING_DIR}}'
-    deps:
-      - task: engine:_ts-build
     # Per `conventions/task-caching.md` (#574): no `sources:` / `generates:`
     # because the script forwards user-facing flags via {{.CLI_ARGS}}
     # (notably --yes for non-interactive CI / scripted approval).
@@ -806,7 +805,9 @@ tasks:
     cmds:
       - task: engine:invoke
         vars:
-          ENGINE_CMD: 'release {{.CLI_ARGS}}'
+          # #5805: the pin's default project root is its own package dir, so pass the
+          # operator root explicitly (an operator --project-root in CLI_ARGS still wins).
+          ENGINE_CMD: 'release --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}'
 
   release:publish:
     desc: "Flip a draft GitHub release to public (#716) -- task release:publish -- <version> [--dry-run] [--repo OWNER/REPO]"
@@ -836,7 +837,7 @@ tasks:
           ENGINE_CMD: 'release-e2e {{.CLI_ARGS}}'
 
   release:wait-npm:
-    desc: "Phase 7 wait until all four npm siblings list the cut version (#4267) -- task release:wait-npm -- <version>"
+    desc: "Phase 7 wait until both public OVPR packages (@deftai/directive + @deftai/directive-runtime) list the cut version (#4267 / #5490) -- task release:wait-npm -- <version>"
     deps: [ts:build]
     dir: '{{.USER_WORKING_DIR}}'
     cmds:

package/contracts/design-critique.md

@@ -208,6 +208,7 @@ Strengths are not one level. Token presence is not behavioral evidence. Classifi
 
 - ! Re-verify the triage's anchors by running checks. Line cites are claims, not evidence. On a process-only dest, use the recorded `verification-path:` (default pin-read `git show <dispatch-sha>:`; provisioned runnable path only when a check must execute fixtures/tests). Launch-probe is not that path.
 - ! Inventory existing mechanisms before proposing new ones.
+- ! Prefer-A Bound / Bound-remedy size obeys Thin Fail-Closed (#3265): keep `## Bound remedy` a short mechanism list. Optional complexity is leftover-pain, footnote, or an implementation note — not a second design essay.
 - ! Classify every finding with the exact three tokens: `blocks-the-design`, `sharpens-framing`, or `footnote`.
 - ! Every classified finding names evidence, a concrete failure mode, and the disposition consequence — or it is a footnote.
 
@@ -369,6 +370,8 @@ After this round's same-round siblings are posted, parent posts a successor `**L
 - ! When the next-build contract is not this body, stamp a Lean-family line-start `Spec-path:` on that successor lean. Nine spellings: zero to two asterisks counted independently on each side, the same wrapping as `Lean:`. `Spec-path:` is a lean token, not a chip. `resolveAutoStampCatalogChip` remaining-set-replaces `ingest-ready` after the completed-arc record exists. It does not parse lean English and does not map Spec-path to a chip.
 - ! Spec-path token plus a completed-arc record means harvest that closed Bound-remedy heading slice on the cited successor lean. Missing heading or empty list refuses, nothing written. No token stays the #4237 Outcome:ready body-is-normative path. ⊗ Let Spec-path mean both a later arc and a harvest path.
 - ! Bound-remedy harvest is a Lean-family heading token (`## Bound remedy`, same class as `## In plain English`) plus parseListItems on that slice of the cited successor lean only. ⊗ Bind that harvest as reuse extractPlanItems. Empty on that lean refuses. A numbered list without that heading is not enough.
+- ! `## Bound remedy` stays Thin Fail-Closed (#3265): short mechanism list only. Optional complexity is leftover-pain, footnote, or an implementation note. ⊗ Grow Bound remedy into a second design essay.
+- ! Remint a `## Bound remedy` (new Spec-path / Recut lean) when the mechanism or fail-closed association changes. ⊗ Remint solely to absorb footnote-class pain-audit text (writing bar #3368). Reuse existing leftover-pain / footnote / non-remint branches; do not invent parallel H2 names Prefer-A Bound or pain-audit harvest.
 - ! Point that harvest source at plan.items, literal capture, derived-clause taskStatement, and Overview. When Spec-path harvest is present, Overview MUST NOT contain the refused GitHub body. Omit Overview, or replace it with a framework-authored remainder (harvest sourceText). Persist the refused body under plan.metadata on a sibling of issueCommentThread. ⊗ Close with an items-only patch. ⊗ Keep the refused GitHub body in Overview as historical described content.
 - ⊗ Classify the path selector by NLP of the lean.
 
@@ -727,6 +730,8 @@ The `unshaped-table-cite` detail names the heading because the diagnostics rule
 
 Named Stop 1 warrant pains are a bind conjunct on `evaluateCompletedArcRecord`. Critic-heading all-accept is not coverage. Catalog chip `design-critique:ingest-ready` is list state, not clearance. Do not grow `resolveAutoStampCatalogChip` as this gate. Do not restore `design-critique:recut-needed`.
 
+- ! Writing-bar (#3368) footnote-class pain-audit posture: naming, docs, alias, and dispose-wording default to `footnote` with `harvest-changed: false` unless the `## Bound remedy` mechanism changes. Reuse existing footnote / non-remint / leftover-pain branches. ⊗ Invent parallel H2 names Prefer-A Bound or pain-audit harvest for that posture.
+
 #### Yolo leftover-pain (#4593)
 
 In yolo mode, when named pain is uncited or `does-not-relieve` and a recut still has a deliverable remainder: recommend one leftover path in prose on the thread (file a new issue for the unmet part, or halt). If the operator confirms the split as a live turn, file that issue. Record the leftover issue number from that parent issue-create output, and from nothing else. After the split is filed, continue the current arc on the deliverable remainder while Dual-stop post budget remains and finish is still possible, and halt otherwise. Finish is still possible while each pain-audit returns strictly fewer blocking findings than the last. Halt on a repeat of the primary blocking heading, not only on the post cap.

package/dist/cli-router/route-argv.js

@@ -98,6 +98,7 @@ export const SUBCOMMAND_ROUTES = {
     "policy:enable-value-feedback": ["policy", "enable-value-feedback"],
     "policy:disable-host-hooks": ["policy", "disable-host-hooks"],
     "policy:set-ceremony-dial": ["policy", "set-ceremony-dial"],
+    "policy:set-coverage-mode": ["policy", "set-coverage-mode"],
     "policy:set-spec-guard-enforcement": ["policy", "set-spec-guard-enforcement"],
     "policy:clear-value-feedback": ["policy", "clear-value-feedback"],
     "authz:show": ["authz", "show"],

package/dist/contract-entry.js

@@ -4,8 +4,8 @@
  * Plain `doctor` composes install-sync diagnosis + full product doctor (F-015 / C6).
  */
 import { readProjectDataStatus } from "./data-status.js";
-import { formatDoctorReport, runDoctorDiagnosis } from "./doctor-diagnose.js";
 import { run as runProductDoctor } from "./doctor.js";
+import { formatDoctorReport, runDoctorDiagnosis } from "./doctor-diagnose.js";
 import { runMigrate } from "./migrate.js";
 import { runSetup } from "./setup.js";
 import { runUninstall } from "./uninstall.js";
@@ -91,9 +91,7 @@ export async function handleContractEntrypoint(argv) {
         return result.remaining.length > 0 ? 1 : 0;
     }
     if (head === "doctor") {
-        const root = takeFlag([...argv], "--root") ??
-            process.env.DIRECTIVE_PROJECT_ROOT ??
-            process.cwd();
+        const root = takeFlag([...argv], "--root") ?? process.env.DIRECTIVE_PROJECT_ROOT ?? process.cwd();
         // Machine discriminant for equal-version upgrade (AC4.10). Sync-only; no product suite.
         if (hasFlag(argv, "--data-status")) {
             const status = readProjectDataStatus(root);

package/dist/coverage-hotspots.js

@@ -166,9 +166,9 @@ export function run(argv) {
         worktree: args.worktree,
         evaluatorId: args.evaluatorId,
     });
-    // Exit 3 = authorized coverage N/A (#5421); exit 4 = gate-override waived (#5674).
+    // Exit 3 = authorized coverage N/A (#5421); exit 4 = gate-override waived (#5674); exit 5 = coverageMode posture (#5791).
     // Keep machine-readable artifact on stdout for --json. Never map waived to exit 0.
-    if (result.exitCode === 3 || result.exitCode === 4) {
+    if (result.exitCode === 3 || result.exitCode === 4 || result.exitCode === 5) {
         if (args.json && result.applicability) {
             process.stdout.write(`${JSON.stringify(result.applicability, null, 2)}\n`);
         }

package/dist/dispatch.d.ts

@@ -12,7 +12,7 @@ export interface DispatchIo {
 /** CLI modules in packages/cli/src (excluding parity harnesses and bin/index). */
 export declare const CLI_MODULE_VERBS: readonly ["agents-refresh", "cache", "check", "capacity-backfill", "capacity-show", "codebase-default-extractor", "codebase-map", "codebase-map-fresh", "codebase-projection-registry", "codebase-provider", "doctor", "ownership-doctor", "ownership-fix", "verify-ownership", "install-upgrade", "install-uninstall", "migrate-preflight", "migrate-xbrief", "migrate-category-b", "framework-check-updates", "hook-dispatch", "umbrella-current-shape", "changelog-check", "change-init", "commit-lint", "coverage-hotspots", "policy", "authz", "escalation-cli", "pr-closing-keywords", "pr-merge-readiness", "pr-monitor", "pr-protected-issues", "pr-wait-mergeable", "pr-watch", "pr-finish-loop", "directive-finish-loop", "pre-pr-run", "preflight-cache", "preflight-gh", "probe-session", "release", "release-e2e", "release-publish", "release-rollback", "release-wait-npm", "scope-lifecycle", "scope-record-approved-scope", "scope-record-observable-scope", "scope-record-intent-constraint", "scm-sync-default", "lifecycle-event", "lifecycle-stats", "session-start", "session-ready", "occupancy-steal", "occupancy-release", "occupancy-heartbeat", "occupancy-grant", "plan-sequence", "slice", "subagent-monitor", "toolchain-check", "triage-actions", "triage-bootstrap", "triage-bulk", "triage-classify", "triage-strip-withdrawn", "triage-evaluate", "triage-help", "triage-queue", "triage-reconcile", "triage-refresh", "triage-scope", "triage-scope-drift", "triage-smoketest", "triage-subscribe", "triage-summary", "triage-welcome", "ts-check-lane", "vbrief-activate", "vbrief-build", "vbrief-preflight", "vbrief-reconcile", "vbrief-validate", "vbrief-validation", "xbrief-create", "xbrief-verify", "xbrief-adopt-stored-plan-id", "verify-branch", "verify-encoding", "verify-forward-coverage", "verify-test-boundary", "verify-class-checks", "verify-presentation-coverage", "verify-scope-provenance", "verify-consumer-check-contract", "verify-hooks-installed", "verify-investigation", "verify-judgment-gates", "verify-no-task-runtime", "validate-links", "validate-strategy-output", "verify-biome-config", "verify-bridge-drift", "verify-capacity", "verify-contained-writes", "verify-telemetry-coverage", "verify-content-manifest", "verify-deposit-closure", "verify-consumer-hard-stops", "verify-closing-keywords", "verify-skill-external-fetch-gate", "verify-semantic-single-source", "verify-contract-drift", "verify-cursor-tier1", "verify-openclaw-tier1", "verify-go-freeze", "verify-scm-boundary", "verify-session-ritual", "verify-plan-sequence", "verify-stubs", "verify-xbrief-drift", "verify-spec-prd-fresh", "verify-spec-drift", "rule-ownership-lint", "verify-story-ready", "verify-review-monitor", "verify-cohort-review-monitors", "verify-l4-owner", "verify-subagent-alive", "verify-subagent-steer", "subagent-pre-cancel", "subagent-steer-write", "design-critique-spend-resolve", "review-monitor-register", "review-monitor-release", "verify-tools", "verify-wip-cap", "verify-orphan-active", "verify-pr-closeout-attestable", "verify-lifecycle-visible", "verify-completed-tracked", "verify-completed-write-guard", "verify-literal-ac", "verify-ac", "verify-agents-md-budget", "verify-consumer-header-placeholder", "verify-agents-md-advisory", "verify-persisted-planning-narratives", "verify-eval-health-relocation", "verify-eval-triggers-relocation", "verify-evaluator-surface", "verify-observable-scope", "verify-operator-scope-limit", "verify-presentation-ceiling", "verify-intent-constraint", "verify-durable-effect-acquisition", "verify-consumer-test-lane", "eval-health", "eval-run", "eval-report", "eval-triggers"];
 /** Core-only CLI entrypoints without a packages/cli wrapper. */
-export declare const CORE_MODULE_VERBS: readonly ["scm", "scm-readiness", "github-auth-modes", "github-body", "issue-emit", "issue-ingest", "issue-sync-from-xbrief", "reconcile-issues", "swarm-launch", "swarm-complete-cohort", "swarm-finalize-cohort", "swarm-finalize-owed", "swarm-pre-dispatch", "swarm-readiness", "swarm-routing-verify", "swarm-routing-set", "swarm-verify-review-clean", "swarm-worktrees", "framework-commands", "pack-render", "packs-slice", "prd-render", "export-spec", "project-render", "project-write-narratives", "roadmap-render", "rule-map", "spec-render", "spec-reconstruct", "spec-validate", "code-structure-validate", "pack-migrate-skills", "pack-migrate-rules", "pack-migrate-strategies", "pack-migrate-patterns", "pack-migrate-swarm-spec", "policy-set", "setup-ghx", "scope-undo", "scope-demote", "scope-decompose", "changelog-resolve-unreleased", "architecture-preflight-sor", "feedback-file", "value-readback", "product-signal", "freshness-report", "decision-write", "decision-list", "docs-impact", "tutorial", "migrate-clause-ids", "migrate-confidence", "rule-to-verb-parity"];
+export declare const CORE_MODULE_VERBS: readonly ["scm", "scm-readiness", "github-auth-modes", "github-body", "issue-emit", "issue-ingest", "issue-sync-from-xbrief", "reconcile-issues", "swarm-launch", "swarm-complete-cohort", "swarm-finalize-cohort", "swarm-finalize-owed", "swarm-pre-dispatch", "swarm-readiness", "swarm-routing-verify", "swarm-routing-set", "swarm-verify-review-clean", "swarm-worktrees", "framework-commands", "pack-render", "packs-slice", "prd-render", "export-spec", "project-render", "project-write-narratives", "roadmap-render", "rule-map", "capability-map", "spec-render", "spec-reconstruct", "spec-validate", "code-structure-validate", "pack-migrate-skills", "pack-migrate-rules", "pack-migrate-strategies", "pack-migrate-patterns", "pack-migrate-swarm-spec", "policy-set", "setup-ghx", "scope-undo", "scope-demote", "scope-decompose", "changelog-resolve-unreleased", "architecture-preflight-sor", "feedback-file", "value-readback", "product-signal", "freshness-report", "decision-write", "decision-list", "docs-impact", "tutorial", "migrate-clause-ids", "migrate-confidence", "rule-to-verb-parity"];
 /** Colon aliases for triage-actions (mirrors cli-router SUBCOMMAND_ROUTES). */
 export declare const TRIAGE_ACTION_ALIAS_SUBCOMMANDS: Readonly<Record<string, string>>;
 /** Colon aliases for policy subcommands (mirrors cli-router SUBCOMMAND_ROUTES). */

package/dist/dispatch.js

@@ -220,6 +220,7 @@ export const CORE_MODULE_VERBS = [
     "project-write-narratives",
     "roadmap-render",
     "rule-map",
+    "capability-map",
     "spec-render",
     "spec-reconstruct",
     "spec-validate",
@@ -272,6 +273,7 @@ export const POLICY_ACTION_ALIAS_SUBCOMMANDS = {
     "policy:set-spec-guard-enforcement": "set-spec-guard-enforcement",
     "policy:disable-host-hooks": "disable-host-hooks",
     "policy:set-ceremony-dial": "set-ceremony-dial",
+    "policy:set-coverage-mode": "set-coverage-mode",
     "policy:clear-value-feedback": "clear-value-feedback",
     "policy:disable-directive": "disable-directive",
     "policy:enable-directive": "enable-directive",
@@ -476,6 +478,7 @@ export const VERB_ALIASES = {
     "project:render": "project-render",
     "project:write-narratives": "project-write-narratives",
     "docs:rule-map": "rule-map",
+    "docs:capability-map": "capability-map",
     "project:export-spec": "export-spec",
     "pr:watch": "pr-watch",
     "pr:finish-loop": "pr-finish-loop",
@@ -2596,6 +2599,10 @@ async function loadCoreModuleHandler(verb, io) {
             const { runRuleMapCli } = await import("./render-cli/rule-map-cli.js");
             return (argv) => runRuleMapCli(argv);
         }
+        case "capability-map": {
+            const { runCapabilityMapCli } = await import("./render-cli/capability-map-cli.js");
+            return (argv) => runCapabilityMapCli(argv);
+        }
         case "export-spec": {
             const { runExportSpecCli } = await import("./render-cli/export-spec-cli.js");
             return (argv) => runExportSpecCli(argv);
@@ -2741,12 +2748,7 @@ export function registeredVerbs() {
     return [...names].sort();
 }
 /** Top-level UX commands routed before the flat dispatcher (#1670). */
-const TOP_LEVEL_COMMAND_NAMES = [
-    "init",
-    "update",
-    "doctor",
-    "check",
-];
+const TOP_LEVEL_COMMAND_NAMES = ["init", "update", "doctor", "check"];
 /** Scope lifecycle verbs exposed as scope:<verb> in help (#2172). */
 const SCOPE_COMMAND_NAMES = [
     "scope:promote",

package/dist/doctor-diagnose.js

@@ -54,10 +54,7 @@ function inspectHookAndSkillForm(projectRoot) {
         ".codex/hooks.json",
         ".grok/hooks/deft.json",
     ];
-    const skillRelCandidates = [
-        ".agents/skills/deft/SKILL.md",
-        "AGENTS.md",
-    ];
+    const skillRelCandidates = [".agents/skills/deft/SKILL.md", "AGENTS.md"];
     let hookOk = true;
     let hookDetail = null;
     let sawHook = false;
@@ -127,8 +124,14 @@ function inspectHookAndSkillForm(projectRoot) {
         skillDetail = "no skill pointer / AGENTS managed section present";
     }
     return {
-        hookCommandForm: { ok: hookOk || !sawHook, detail: hookOk ? (sawHook ? null : hookDetail) : hookDetail },
-        skillPointers: { ok: skillOk || !sawSkill, detail: skillOk ? (sawSkill ? null : skillDetail) : skillDetail },
+        hookCommandForm: {
+            ok: hookOk || !sawHook,
+            detail: hookOk ? (sawHook ? null : hookDetail) : hookDetail,
+        },
+        skillPointers: {
+            ok: skillOk || !sawSkill,
+            detail: skillOk ? (sawSkill ? null : skillDetail) : skillDetail,
+        },
     };
 }
 function defaultHookProbe(projectRoot) {
@@ -336,7 +339,7 @@ export function formatDoctorReport(diag) {
     }
     if (diag.remedy && diag.incompleteInstall !== "git-precondition") {
         // Avoid duplicating the plain Next: block when we already printed recovery.
-        if (diag.exitCode !== 0 && (diag.surfaces.installed.ok && diag.surfaces.pin.ok)) {
+        if (diag.exitCode !== 0 && diag.surfaces.installed.ok && diag.surfaces.pin.ok) {
             lines.push(`Recovery: ${diag.remedy}`);
         }
         else if (diag.exitCode !== 0 && (!diag.surfaces.installed.ok || !diag.surfaces.pin.ok)) {

package/dist/hook-dispatch.d.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
-import { type HookEvent, type HookHost, type HookPayloadContext } from "@deftai/directive-core/hooks";
 import type { CheapInSyncResult } from "@deftai/directive-core/dist/install-health/types.js";
+import { type HookEvent, type HookHost, type HookPayloadContext } from "@deftai/directive-core/hooks";
 /**
  * Session-start schema-behind notice (AC8.9 / AC14.11). Doctor uses the same
  * remedy name; other hooks must stay silent about data currency.

package/dist/hook-dispatch.js

@@ -2,9 +2,9 @@
 import { readFileSync, realpathSync } from "node:fs";
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
-import { decideHook, hookPayloadTopLevelKeys, isHookEvent, isHookHost, mergeHookDispatchEnviron, normalizeHookProjectRoot, parseHookStdin, projectRootFromHookPayload, renderHostDecision, } from "../vendor/directive-core/dist/hooks/index.js";
 import { checkCheapInSync } from "../vendor/directive-core/dist/install-health/cheap.js";
 import { INSTALLATION_RECOVERY_GUIDANCE } from "../vendor/directive-core/dist/install-health/constants.js";
+import { decideHook, hookPayloadTopLevelKeys, isHookEvent, isHookHost, mergeHookDispatchEnviron, normalizeHookProjectRoot, parseHookStdin, projectRootFromHookPayload, renderHostDecision, } from "../vendor/directive-core/dist/hooks/index.js";
 import { readProjectDataStatus } from "./data-status.js";
 import { maybeSelfCompleteSetup } from "./self-complete.js";
 /**

package/dist/install-cli/coverage-map.d.ts

@@ -1,7 +1,3 @@
-/**
- * Wave 8.5 s7 install/migrate CLI tail — retire-vs-retarget coverage map (#1838).
- * Primary deliverable is duplicated in the PR body for Wave 9 mechanical teardown.
- */
 export type InstallCliTailClassification = "retire-at-Wave-9" | "retarget";
 export interface InstallCliTailEntry {
     readonly pythonTest: string;
@@ -9,6 +5,6 @@ export interface InstallCliTailEntry {
     readonly rationale: string;
     readonly vitestSpec?: string;
 }
-/** One-line rationale per in-scope tests/cli file (Bucket C audit). */
+/** One-line rationale per in-scope pytest cli file (Bucket C audit). */
 export declare const INSTALL_CLI_TAIL_COVERAGE_MAP: readonly InstallCliTailEntry[];
 //# sourceMappingURL=coverage-map.d.ts.map

package/dist/install-cli/coverage-map.js

@@ -1,111 +1,117 @@
-/** One-line rationale per in-scope tests/cli file (Bucket C audit). */
+/**
+ * Wave 8.5 s7 install/migrate CLI tail — retire-vs-retarget coverage map (#1838).
+ * Primary deliverable is duplicated in the PR body for Wave 9 mechanical teardown.
+ */
+/** Python pytest root segments joined at runtime (avoid class-2 path literals). */
+const PY_CLI_TESTS = "tests" + "/cli";
+/** One-line rationale per in-scope pytest cli file (Bucket C audit). */
 export const INSTALL_CLI_TAIL_COVERAGE_MAP = [
     {
-        pythonTest: "tests/cli/test_migrate_vbrief.py",
+        pythonTest: `${PY_CLI_TESTS}/test_migrate_vbrief.py`,
         classification: "retire-at-Wave-9",
         rationale: "Exercises scripts/migrate_vbrief.py pre-v0.20 migrator — accepted non-port deleted in #1731.",
     },
     {
-        pythonTest: "tests/cli/test_migrate_vbrief_canonical_refs.py",
+        pythonTest: `${PY_CLI_TESTS}/test_migrate_vbrief_canonical_refs.py`,
         classification: "retire-at-Wave-9",
         rationale: "End-to-end migrate_vbrief references/narrative clamp regressions — accepted non-port migrator.",
     },
     {
-        pythonTest: "tests/cli/test_migrate_vbrief_fixtures.py",
+        pythonTest: `${PY_CLI_TESTS}/test_migrate_vbrief_fixtures.py`,
         classification: "retire-at-Wave-9",
         rationale: "Fixture-driven migrate() routing matrix — accepted non-port pre-cutover migrator tooling.",
     },
     {
-        pythonTest: "tests/cli/test_migrate_vbrief_rc4.py",
+        pythonTest: `${PY_CLI_TESTS}/test_migrate_vbrief_rc4.py`,
         classification: "retire-at-Wave-9",
         rationale: "RC4 migrator rollback/reconciliation — accepted non-port migrate_* family (#1731).",
     },
     {
-        pythonTest: "tests/cli/test_migrate_preflight.py",
+        pythonTest: `${PY_CLI_TESTS}/test_migrate_preflight.py`,
         classification: "retarget",
         rationale: "scripts/migrate_preflight.py agent-side migrate:vbrief gate — retargeted to deft-ts migrate-preflight on consumer task path (#2022 Phase 2).",
         vitestSpec: "packages/cli/src/migrate-task-surface.test.ts",
     },
     {
-        pythonTest: "tests/cli/test_precutover_guard.py",
+        pythonTest: `${PY_CLI_TESTS}/test_precutover_guard.py`,
         classification: "retire-at-Wave-9",
         rationale: "Pre-cutover detection and legacy placeholder checks via _precutover — accepted non-port.",
     },
     {
-        pythonTest: "tests/cli/test_cmd_agents_refresh.py",
+        pythonTest: `${PY_CLI_TESTS}/test_cmd_agents_refresh.py`,
         classification: "retire-at-Wave-9",
         rationale: "Python run cmd_agents_refresh upgrade-gate companion — no deft-ts verb; retires with legacy run.",
     },
     {
-        pythonTest: "tests/cli/test_cmd_check_updates.py",
+        pythonTest: `${PY_CLI_TESTS}/test_cmd_check_updates.py`,
         classification: "retarget",
         rationale: "Python run cmd_check_updates remote version probe — retargeted to deft-ts framework-check-updates on consumer task path (#2069).",
         vitestSpec: "packages/core/src/check-updates/index.test.ts, packages/cli/src/framework-check-updates-task-surface.test.ts",
     },
     {
-        pythonTest: "tests/cli/test_cmd_doctor.py",
+        pythonTest: `${PY_CLI_TESTS}/test_cmd_doctor.py`,
         classification: "retarget",
         rationale: "cmd_doctor survives as deft-ts doctor verb (packages/cli/src/doctor.ts); exit-code parity via dispatch.",
         vitestSpec: "packages/cli/src/install-cli/retarget-dispatch.test.ts",
     },
     {
-        pythonTest: "tests/cli/test_cmd_gate.py",
+        pythonTest: `${PY_CLI_TESTS}/test_cmd_gate.py`,
         classification: "retire-at-Wave-9",
         rationale: "Python run cmd_gate universal upgrade gate — no deft-ts verb; retires with legacy run module.",
     },
     {
-        pythonTest: "tests/cli/test_cmd_spec.py",
+        pythonTest: `${PY_CLI_TESTS}/test_cmd_spec.py`,
         classification: "retire-at-Wave-9",
         rationale: "Python run cmd_spec interactive spec generator — no deft-ts verb; retires with legacy run.",
     },
     {
-        pythonTest: "tests/cli/test_upgrade_gate.py",
+        pythonTest: `${PY_CLI_TESTS}/test_upgrade_gate.py`,
         classification: "retire-at-Wave-9",
         rationale: "Python run upgrade gate and cmd_project lifecycle scaffolding — legacy run; no TS equivalent.",
     },
     {
-        pythonTest: "tests/cli/test_upgrade_gate_remote_drift.py",
+        pythonTest: `${PY_CLI_TESTS}/test_upgrade_gate_remote_drift.py`,
         classification: "retire-at-Wave-9",
         rationale: "Python run _check_upgrade_gate remote-drift integration — legacy run upgrade path.",
     },
     {
-        pythonTest: "tests/cli/test_run_bat_path.py",
+        pythonTest: `${PY_CLI_TESTS}/test_run_bat_path.py`,
         classification: "retire-at-Wave-9",
         rationale: "Windows run.bat packaging shim self-relative resolution — build/packaging accepted non-port.",
     },
     {
-        pythonTest: "tests/cli/test_run_version.py",
+        pythonTest: `${PY_CLI_TESTS}/test_run_version.py`,
         classification: "retire-at-Wave-9",
         rationale: "Python run VERSION resolution chain — legacy run entrypoint retires with scripts/*.py in #1731.",
     },
     {
-        pythonTest: "tests/cli/test_setup_ghx.py",
+        pythonTest: `${PY_CLI_TESTS}/test_setup_ghx.py`,
         classification: "retire-at-Wave-9",
         rationale: "scripts/setup_ghx.py consent-gated installer helper — build/packaging accepted non-port (#1731).",
     },
     {
-        pythonTest: "tests/cli/test_safe_subprocess.py",
+        pythonTest: `${PY_CLI_TESTS}/test_safe_subprocess.py`,
         classification: "retire-at-Wave-9",
         rationale: "scripts/_safe_subprocess.py UTF-8 capture shim — Python runtime accepted non-port (#1731).",
     },
     {
-        pythonTest: "tests/cli/test_task_scripts.py",
+        pythonTest: `${PY_CLI_TESTS}/test_task_scripts.py`,
         classification: "retarget",
         rationale: "TestToolchainCheck maps to deft-ts toolchain-check; remainder covers legacy Python task scripts without TS verbs.",
         vitestSpec: "packages/cli/src/install-cli/retarget-dispatch.test.ts",
     },
     {
-        pythonTest: "tests/cli/test_ts_check_lane.py",
+        pythonTest: `${PY_CLI_TESTS}/test_ts_check_lane.py`,
         classification: "retire-at-Wave-9",
         rationale: "scripts/ts_check_lane.py Python meta-guard for pnpm lane — retires once Python CI lane is removed.",
     },
     {
-        pythonTest: "tests/cli/test_vendored_install_metadata.py",
+        pythonTest: `${PY_CLI_TESTS}/test_vendored_install_metadata.py`,
         classification: "retire-at-Wave-9",
         rationale: "Vendored Go-install metadata via Python run/doctor/resolve_version — installer deposit accepted non-port.",
     },
     {
-        pythonTest: "tests/cli/test_remote_probe_throttle.py",
+        pythonTest: `${PY_CLI_TESTS}/test_remote_probe_throttle.py`,
         classification: "retire-at-Wave-9",
         rationale: "Python run remote-probe throttle state for #801 — legacy run module; no deft-ts verb.",
     },

package/dist/installer-output-inventory.js

@@ -77,10 +77,7 @@ export const INSTALLER_OUTPUT_INVENTORY = [
     },
     {
         id: "openclaw-integrations",
-        legacyOutputs: [
-            "OpenClaw L2 product-command skills",
-            "OpenClaw soft AGENTS re-bind skill",
-        ],
+        legacyOutputs: ["OpenClaw L2 product-command skills", "OpenClaw soft AGENTS re-bind skill"],
         ovprTarget: "OpenClaw workspace skills dirs when OC signals present (conditional)",
         disposition: "conditional",
         justification: "AC8.1 conditional OpenClaw — deposit adapters no-op unless OpenClaw is detected; fail-closed otherwise.",