@deftai/directive-runtime 0.127.0 → 0.128.0

package/.githooks/_directive-run.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env sh
+# Package-relative Directive git-hook helper (AC9.9).
+# Sourced by pre-commit/pre-push; defines run_directive.
+if [ -z "${REPO_ROOT:-}" ]; then
+  REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)"
+fi
+if [ -z "$REPO_ROOT" ]; then
+  echo "directive hooks: unable to resolve repo root." >&2
+  exit 1
+fi
+RUNTIME_BIN="$REPO_ROOT/node_modules/@deftai/directive-runtime/dist/bin.js"
+if [ ! -f "$RUNTIME_BIN" ]; then
+  echo "directive hooks: missing $RUNTIME_BIN" >&2
+  echo "Recovery: npm i -g @deftai/directive, then directive install --repair" >&2
+  exit 1
+fi
+run_directive() {
+  # #3039 / #5543: root local kill-switch — skip CLI spawn when flag is present,
+  # not a symlink, and not tracked by git (tracked flag must not disable clones).
+  _kill="$REPO_ROOT/.deft-directive-disable"
+  if [ -f "$_kill" ] && [ ! -L "$_kill" ]; then
+    if ! git -C "$REPO_ROOT" ls-files --error-unmatch -- .deft-directive-disable >/dev/null 2>&1; then
+      echo "Directive is DISABLED for this project via root .deft-directive-disable (test/local kill-switch)." >&2
+      echo "Git hooks skipping Directive CLI spawn (#5543 / #3039). Deposit may remain." >&2
+      echo "Recovery: rm .deft-directive-disable && start a new agent session." >&2
+      return 0
+    fi
+  fi
+  node "$RUNTIME_BIN" "$@"
+}

package/.githooks/pre-commit

@@ -1,25 +1,5 @@
 #!/usr/bin/env sh
-# .githooks/pre-commit -- deft CLI gates (#2049 / #747 / #798 / #1620).
-#
-# Activated by `git config core.hooksPath .githooks` via `task setup` or the
-# deft installer (#1463). Pure POSIX shell; prefers global `deft` on PATH,
-# falls back to local packages/runtime/dist/bin.js in the maintainer monorepo (#2067).
-
-REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)"
-if [ -z "$REPO_ROOT" ]; then
-    echo "deft pre-commit: unable to resolve repo root via 'git rev-parse'." >&2
-    exit 1
-fi
-
-. "$REPO_ROOT/.githooks/_deft-run.sh"
-
-run_deft verify:branch --project-root "$REPO_ROOT" || exit $?
-
-run_deft verify:encoding --staged --project-root "$REPO_ROOT" || exit $?
-
-run_deft verify:forward-coverage --staged --project-root "$REPO_ROOT" || exit $?
-
-if [ -d "$REPO_ROOT/xbrief" ] || [ -d "$REPO_ROOT/vbrief" ]; then
-    run_deft verify:vbrief-conformance --staged --project-root "$REPO_ROOT" || exit $?
-    run_deft verify:xbrief-drift --staged --project-root "$REPO_ROOT" || exit $?
-fi
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || exit 1
+# shellcheck source=/dev/null
+. "$REPO_ROOT/.githooks/_directive-run.sh"
+run_directive verify:encoding --staged --project-root "$REPO_ROOT" || exit $?

package/.githooks/pre-push

@@ -1,18 +1,12 @@
 #!/usr/bin/env sh
-# .githooks/pre-push -- refspec-aware default-branch push gate (#2049 / #1019 / #1814).
-#
-# Pre-push does NOT invoke verify:branch (#747). HEAD-only default-branch
-# protection remains on pre-commit; pre-push relies on preflight-gh for
-# refspec-aware protection (#1814 Option A). Pure POSIX shell; prefers global
-# `deft` on PATH, falls back to local packages/runtime/dist/bin.js (#2067).
-
-REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)"
-if [ -z "$REPO_ROOT" ]; then
-    echo "deft pre-push: unable to resolve repo root via 'git rev-parse'." >&2
-    exit 1
-fi
-
-. "$REPO_ROOT/.githooks/_deft-run.sh"
-
-run_deft preflight-gh --pre-push-stdin --project-root "$REPO_ROOT"
-exit $?
+# deft:pre-pr-bound-push-v1 — refuse-to-downgrade marker (#5804); marker-aware ensureGitHooks only
+REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || exit 1
+# shellcheck source=/dev/null
+. "$REPO_ROOT/.githooks/_directive-run.sh"
+run_directive verify:branch --project-root "$REPO_ROOT" || exit $?
+# Enrolled bound pre-PR arm: sole-stdin (do not redirect shared run_directive to /dev/null)
+# Pins older than #5804 lack --push-admit: keep the pre-#5804 hook there (verify:branch only).
+_pre_pr_help="$(run_directive pre-pr:run --help </dev/null 2>&1)" || exit $?
+case "$_pre_pr_help" in
+  *--push-admit*) run_directive pre-pr:run --push-admit --project-root "$REPO_ROOT" || exit $? ;;
+esac

package/Taskfile.yml

@@ -69,6 +69,9 @@ env:
   UV_PROJECT: '{{.TASKFILE_DIR}}'
 
 includes:
+  deft:
+    taskfile: ./node_modules/@deftai/directive-runtime/Taskfile.yml
+    optional: true
   docs:
     taskfile: ./tasks/docs.yml
     optional: true
@@ -393,6 +396,10 @@ includes:
   engine:
     taskfile: ./tasks/engine.yml
     optional: true
+  # #5805: tip-without-publish materialize into checkout pin.
+  materialize:
+    taskfile: ./tasks/materialize.yml
+    optional: true
 
 tasks:
   default:
@@ -405,8 +412,7 @@ tasks:
   check:
     desc: "Run the context-appropriate pre-commit gate: full framework self-check in this repo, consumer-safe gate from vendored installs (#1519)."
     dir: '{{.USER_WORKING_DIR}}'
-    deps:
-      - task: engine:_ts-build
+    # #5805: no engine:_ts-build — pin-exclusive ordinary invoke.
     cmds:
       - task: engine:invoke
         vars:
@@ -419,8 +425,7 @@ tasks:
 
   check:merge:
     desc: "Merge chokepoint gate — explicit alias for check:framework-source (#1704). CI and PR gates SHOULD invoke this (or task check) as the single SoT so discrete workflow steps cannot drift."
-    deps:
-      - task: engine:_ts-build
+    # #5805: no engine:_ts-build here — ordinary/merge invoke uses the checkout pin, not tip dist.
     cmds:
       - task: check:framework-source
 
@@ -452,6 +457,8 @@ tasks:
       - verify:bridge-drift
       - verify:branch
       - verify:encoding
+      # Keep local uncached closing-keyword checks (#5736 Greptile); CI branch-gate
+      # still owns --mode both for merge-base / commit-range.
       - verify:closing-keywords
       - verify:forward-coverage
       - verify:changelog-unreleased
@@ -595,8 +602,6 @@ tasks:
   verify-strategy-output:
     desc: "Deterministic v0.20 strategy output shape gate (#1166 s2). Fails on non-date-prefixed vBRIEFs in lifecycle dirs, missing PROJECT-DEFINITION.vbrief.json, or legacy specification.vbrief.json in user projects."
     dir: '{{.USER_WORKING_DIR}}'
-    deps:
-      - task: engine:_ts-build
     cmds:
       - task: engine:invoke
         vars:
@@ -618,8 +623,6 @@ tasks:
 
   verify:no-task-runtime:
     desc: "Fail when runtime Python code hard-depends on go-task (#1659)."
-    deps:
-      - task: engine:_ts-build
     cmds:
       # Oracle/fallback (parity): scripts/verify_no_task_runtime.py (#1854 s3).
       - task: engine:invoke
@@ -649,7 +652,7 @@ tasks:
   # User-facing upgrade entrypoint (#1061). Aliases the install:upgrade
   # wrapper. As of #2064 the native deft-ts install-upgrade handler is a thin
   # redirect onto `directive update` -- the single canonical upgrade verb that
-  # file-swaps the vendored .deft/core payload, rewrites the install manifest,
+  # file-swaps the vendored runtime payload, rewrites the install manifest,
   # and regenerates .deft-version. Prefer `deft update` directly; this alias is
   # retained for compatibility. Cited by the doctor's failure prose and
   # docs/install-manifest.md as the post-drift repair entrypoint.
@@ -659,7 +662,7 @@ tasks:
       - task: install:upgrade
 
   # #1272: canonical doctor surface -- thin shim that forwards to
-  # ``.deft/core/run doctor``. The ``run`` CLI owns the diagnostic
+  # the runtime doctor entry. The doctor CLI owns the diagnostic
   # logic (system deps, framework layout, root Taskfile.yml include
   # health) and the optional interactive repair path. The task
   # accepts user-facing flags (``--session`` / ``--fix`` / ``--json``
@@ -680,8 +683,6 @@ tasks:
   setup:
     desc: "Idempotent local-dev setup: configure git hooks (#747); detect-and-prompt ghx (#884). Sets core.hooksPath=.githooks so .githooks/pre-commit + .githooks/pre-push run."
     dir: '{{.USER_WORKING_DIR}}'
-    deps:
-      - task: engine:_ts-build
     env:
       PYTHONUTF8: "1"
     cmds:
@@ -758,8 +759,6 @@ tasks:
   setup:ghx:
     desc: "Consent-gated ghx (brunoborges/ghx) installer (#884) -- task setup:ghx [-- --yes]"
     dir: '{{.USER_WORKING_DIR}}'
-    deps:
-      - task: engine:_ts-build
     # Per `conventions/task-caching.md` (#574): no `sources:` / `generates:`
     # because the script forwards user-facing flags via {{.CLI_ARGS}}
     # (notably --yes for non-interactive CI / scripted approval).
@@ -806,7 +805,9 @@ tasks:
     cmds:
       - task: engine:invoke
         vars:
-          ENGINE_CMD: 'release {{.CLI_ARGS}}'
+          # #5805: the pin's default project root is its own package dir, so pass the
+          # operator root explicitly (an operator --project-root in CLI_ARGS still wins).
+          ENGINE_CMD: 'release --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}'
 
   release:publish:
     desc: "Flip a draft GitHub release to public (#716) -- task release:publish -- <version> [--dry-run] [--repo OWNER/REPO]"

package/contracts/design-critique.md

@@ -208,6 +208,7 @@ Strengths are not one level. Token presence is not behavioral evidence. Classifi
 
 - ! Re-verify the triage's anchors by running checks. Line cites are claims, not evidence. On a process-only dest, use the recorded `verification-path:` (default pin-read `git show <dispatch-sha>:`; provisioned runnable path only when a check must execute fixtures/tests). Launch-probe is not that path.
 - ! Inventory existing mechanisms before proposing new ones.
+- ! Prefer-A Bound / Bound-remedy size obeys Thin Fail-Closed (#3265): keep `## Bound remedy` a short mechanism list. Optional complexity is leftover-pain, footnote, or an implementation note — not a second design essay.
 - ! Classify every finding with the exact three tokens: `blocks-the-design`, `sharpens-framing`, or `footnote`.
 - ! Every classified finding names evidence, a concrete failure mode, and the disposition consequence — or it is a footnote.
 
@@ -369,6 +370,8 @@ After this round's same-round siblings are posted, parent posts a successor `**L
 - ! When the next-build contract is not this body, stamp a Lean-family line-start `Spec-path:` on that successor lean. Nine spellings: zero to two asterisks counted independently on each side, the same wrapping as `Lean:`. `Spec-path:` is a lean token, not a chip. `resolveAutoStampCatalogChip` remaining-set-replaces `ingest-ready` after the completed-arc record exists. It does not parse lean English and does not map Spec-path to a chip.
 - ! Spec-path token plus a completed-arc record means harvest that closed Bound-remedy heading slice on the cited successor lean. Missing heading or empty list refuses, nothing written. No token stays the #4237 Outcome:ready body-is-normative path. ⊗ Let Spec-path mean both a later arc and a harvest path.
 - ! Bound-remedy harvest is a Lean-family heading token (`## Bound remedy`, same class as `## In plain English`) plus parseListItems on that slice of the cited successor lean only. ⊗ Bind that harvest as reuse extractPlanItems. Empty on that lean refuses. A numbered list without that heading is not enough.
+- ! `## Bound remedy` stays Thin Fail-Closed (#3265): short mechanism list only. Optional complexity is leftover-pain, footnote, or an implementation note. ⊗ Grow Bound remedy into a second design essay.
+- ! Remint a `## Bound remedy` (new Spec-path / Recut lean) when the mechanism or fail-closed association changes. ⊗ Remint solely to absorb footnote-class pain-audit text (writing bar #3368). Reuse existing leftover-pain / footnote / non-remint branches; do not invent parallel H2 names Prefer-A Bound or pain-audit harvest.
 - ! Point that harvest source at plan.items, literal capture, derived-clause taskStatement, and Overview. When Spec-path harvest is present, Overview MUST NOT contain the refused GitHub body. Omit Overview, or replace it with a framework-authored remainder (harvest sourceText). Persist the refused body under plan.metadata on a sibling of issueCommentThread. ⊗ Close with an items-only patch. ⊗ Keep the refused GitHub body in Overview as historical described content.
 - ⊗ Classify the path selector by NLP of the lean.
 
@@ -727,6 +730,8 @@ The `unshaped-table-cite` detail names the heading because the diagnostics rule
 
 Named Stop 1 warrant pains are a bind conjunct on `evaluateCompletedArcRecord`. Critic-heading all-accept is not coverage. Catalog chip `design-critique:ingest-ready` is list state, not clearance. Do not grow `resolveAutoStampCatalogChip` as this gate. Do not restore `design-critique:recut-needed`.
 
+- ! Writing-bar (#3368) footnote-class pain-audit posture: naming, docs, alias, and dispose-wording default to `footnote` with `harvest-changed: false` unless the `## Bound remedy` mechanism changes. Reuse existing footnote / non-remint / leftover-pain branches. ⊗ Invent parallel H2 names Prefer-A Bound or pain-audit harvest for that posture.
+
 #### Yolo leftover-pain (#4593)
 
 In yolo mode, when named pain is uncited or `does-not-relieve` and a recut still has a deliverable remainder: recommend one leftover path in prose on the thread (file a new issue for the unmet part, or halt). If the operator confirms the split as a live turn, file that issue. Record the leftover issue number from that parent issue-create output, and from nothing else. After the split is filed, continue the current arc on the deliverable remainder while Dual-stop post budget remains and finish is still possible, and halt otherwise. Finish is still possible while each pain-audit returns strictly fewer blocking findings than the last. Halt on a repeat of the primary blocking heading, not only on the post cap.

package/dist/cli-router/route-argv.js

@@ -98,6 +98,7 @@ export const SUBCOMMAND_ROUTES = {
     "policy:enable-value-feedback": ["policy", "enable-value-feedback"],
     "policy:disable-host-hooks": ["policy", "disable-host-hooks"],
     "policy:set-ceremony-dial": ["policy", "set-ceremony-dial"],
+    "policy:set-coverage-mode": ["policy", "set-coverage-mode"],
     "policy:set-spec-guard-enforcement": ["policy", "set-spec-guard-enforcement"],
     "policy:clear-value-feedback": ["policy", "clear-value-feedback"],
     "authz:show": ["authz", "show"],

package/dist/coverage-hotspots.js

@@ -166,9 +166,9 @@ export function run(argv) {
         worktree: args.worktree,
         evaluatorId: args.evaluatorId,
     });
-    // Exit 3 = authorized coverage N/A (#5421); exit 4 = gate-override waived (#5674).
+    // Exit 3 = authorized coverage N/A (#5421); exit 4 = gate-override waived (#5674); exit 5 = coverageMode posture (#5791).
     // Keep machine-readable artifact on stdout for --json. Never map waived to exit 0.
-    if (result.exitCode === 3 || result.exitCode === 4) {
+    if (result.exitCode === 3 || result.exitCode === 4 || result.exitCode === 5) {
         if (args.json && result.applicability) {
             process.stdout.write(`${JSON.stringify(result.applicability, null, 2)}\n`);
         }

package/dist/dispatch.d.ts

@@ -12,7 +12,7 @@ export interface DispatchIo {
 /** CLI modules in packages/cli/src (excluding parity harnesses and bin/index). */
 export declare const CLI_MODULE_VERBS: readonly ["agents-refresh", "cache", "check", "capacity-backfill", "capacity-show", "codebase-default-extractor", "codebase-map", "codebase-map-fresh", "codebase-projection-registry", "codebase-provider", "doctor", "ownership-doctor", "ownership-fix", "verify-ownership", "install-upgrade", "install-uninstall", "migrate-preflight", "migrate-xbrief", "migrate-category-b", "framework-check-updates", "hook-dispatch", "umbrella-current-shape", "changelog-check", "change-init", "commit-lint", "coverage-hotspots", "policy", "authz", "escalation-cli", "pr-closing-keywords", "pr-merge-readiness", "pr-monitor", "pr-protected-issues", "pr-wait-mergeable", "pr-watch", "pr-finish-loop", "directive-finish-loop", "pre-pr-run", "preflight-cache", "preflight-gh", "probe-session", "release", "release-e2e", "release-publish", "release-rollback", "release-wait-npm", "scope-lifecycle", "scope-record-approved-scope", "scope-record-observable-scope", "scope-record-intent-constraint", "scm-sync-default", "lifecycle-event", "lifecycle-stats", "session-start", "session-ready", "occupancy-steal", "occupancy-release", "occupancy-heartbeat", "occupancy-grant", "plan-sequence", "slice", "subagent-monitor", "toolchain-check", "triage-actions", "triage-bootstrap", "triage-bulk", "triage-classify", "triage-strip-withdrawn", "triage-evaluate", "triage-help", "triage-queue", "triage-reconcile", "triage-refresh", "triage-scope", "triage-scope-drift", "triage-smoketest", "triage-subscribe", "triage-summary", "triage-welcome", "ts-check-lane", "vbrief-activate", "vbrief-build", "vbrief-preflight", "vbrief-reconcile", "vbrief-validate", "vbrief-validation", "xbrief-create", "xbrief-verify", "xbrief-adopt-stored-plan-id", "verify-branch", "verify-encoding", "verify-forward-coverage", "verify-test-boundary", "verify-class-checks", "verify-presentation-coverage", "verify-scope-provenance", "verify-consumer-check-contract", "verify-hooks-installed", "verify-investigation", "verify-judgment-gates", "verify-no-task-runtime", "validate-links", "validate-strategy-output", "verify-biome-config", "verify-bridge-drift", "verify-capacity", "verify-contained-writes", "verify-telemetry-coverage", "verify-content-manifest", "verify-deposit-closure", "verify-consumer-hard-stops", "verify-closing-keywords", "verify-skill-external-fetch-gate", "verify-semantic-single-source", "verify-contract-drift", "verify-cursor-tier1", "verify-openclaw-tier1", "verify-go-freeze", "verify-scm-boundary", "verify-session-ritual", "verify-plan-sequence", "verify-stubs", "verify-xbrief-drift", "verify-spec-prd-fresh", "verify-spec-drift", "rule-ownership-lint", "verify-story-ready", "verify-review-monitor", "verify-cohort-review-monitors", "verify-l4-owner", "verify-subagent-alive", "verify-subagent-steer", "subagent-pre-cancel", "subagent-steer-write", "design-critique-spend-resolve", "review-monitor-register", "review-monitor-release", "verify-tools", "verify-wip-cap", "verify-orphan-active", "verify-pr-closeout-attestable", "verify-lifecycle-visible", "verify-completed-tracked", "verify-completed-write-guard", "verify-literal-ac", "verify-ac", "verify-agents-md-budget", "verify-consumer-header-placeholder", "verify-agents-md-advisory", "verify-persisted-planning-narratives", "verify-eval-health-relocation", "verify-eval-triggers-relocation", "verify-evaluator-surface", "verify-observable-scope", "verify-operator-scope-limit", "verify-presentation-ceiling", "verify-intent-constraint", "verify-durable-effect-acquisition", "verify-consumer-test-lane", "eval-health", "eval-run", "eval-report", "eval-triggers"];
 /** Core-only CLI entrypoints without a packages/cli wrapper. */
-export declare const CORE_MODULE_VERBS: readonly ["scm", "scm-readiness", "github-auth-modes", "github-body", "issue-emit", "issue-ingest", "issue-sync-from-xbrief", "reconcile-issues", "swarm-launch", "swarm-complete-cohort", "swarm-finalize-cohort", "swarm-finalize-owed", "swarm-pre-dispatch", "swarm-readiness", "swarm-routing-verify", "swarm-routing-set", "swarm-verify-review-clean", "swarm-worktrees", "framework-commands", "pack-render", "packs-slice", "prd-render", "export-spec", "project-render", "project-write-narratives", "roadmap-render", "rule-map", "spec-render", "spec-reconstruct", "spec-validate", "code-structure-validate", "pack-migrate-skills", "pack-migrate-rules", "pack-migrate-strategies", "pack-migrate-patterns", "pack-migrate-swarm-spec", "policy-set", "setup-ghx", "scope-undo", "scope-demote", "scope-decompose", "changelog-resolve-unreleased", "architecture-preflight-sor", "feedback-file", "value-readback", "product-signal", "freshness-report", "decision-write", "decision-list", "docs-impact", "tutorial", "migrate-clause-ids", "migrate-confidence", "rule-to-verb-parity"];
+export declare const CORE_MODULE_VERBS: readonly ["scm", "scm-readiness", "github-auth-modes", "github-body", "issue-emit", "issue-ingest", "issue-sync-from-xbrief", "reconcile-issues", "swarm-launch", "swarm-complete-cohort", "swarm-finalize-cohort", "swarm-finalize-owed", "swarm-pre-dispatch", "swarm-readiness", "swarm-routing-verify", "swarm-routing-set", "swarm-verify-review-clean", "swarm-worktrees", "framework-commands", "pack-render", "packs-slice", "prd-render", "export-spec", "project-render", "project-write-narratives", "roadmap-render", "rule-map", "capability-map", "spec-render", "spec-reconstruct", "spec-validate", "code-structure-validate", "pack-migrate-skills", "pack-migrate-rules", "pack-migrate-strategies", "pack-migrate-patterns", "pack-migrate-swarm-spec", "policy-set", "setup-ghx", "scope-undo", "scope-demote", "scope-decompose", "changelog-resolve-unreleased", "architecture-preflight-sor", "feedback-file", "value-readback", "product-signal", "freshness-report", "decision-write", "decision-list", "docs-impact", "tutorial", "migrate-clause-ids", "migrate-confidence", "rule-to-verb-parity"];
 /** Colon aliases for triage-actions (mirrors cli-router SUBCOMMAND_ROUTES). */
 export declare const TRIAGE_ACTION_ALIAS_SUBCOMMANDS: Readonly<Record<string, string>>;
 /** Colon aliases for policy subcommands (mirrors cli-router SUBCOMMAND_ROUTES). */

package/dist/dispatch.js

@@ -220,6 +220,7 @@ export const CORE_MODULE_VERBS = [
     "project-write-narratives",
     "roadmap-render",
     "rule-map",
+    "capability-map",
     "spec-render",
     "spec-reconstruct",
     "spec-validate",
@@ -272,6 +273,7 @@ export const POLICY_ACTION_ALIAS_SUBCOMMANDS = {
     "policy:set-spec-guard-enforcement": "set-spec-guard-enforcement",
     "policy:disable-host-hooks": "disable-host-hooks",
     "policy:set-ceremony-dial": "set-ceremony-dial",
+    "policy:set-coverage-mode": "set-coverage-mode",
     "policy:clear-value-feedback": "clear-value-feedback",
     "policy:disable-directive": "disable-directive",
     "policy:enable-directive": "enable-directive",
@@ -476,6 +478,7 @@ export const VERB_ALIASES = {
     "project:render": "project-render",
     "project:write-narratives": "project-write-narratives",
     "docs:rule-map": "rule-map",
+    "docs:capability-map": "capability-map",
     "project:export-spec": "export-spec",
     "pr:watch": "pr-watch",
     "pr:finish-loop": "pr-finish-loop",
@@ -2596,6 +2599,10 @@ async function loadCoreModuleHandler(verb, io) {
             const { runRuleMapCli } = await import("./render-cli/rule-map-cli.js");
             return (argv) => runRuleMapCli(argv);
         }
+        case "capability-map": {
+            const { runCapabilityMapCli } = await import("./render-cli/capability-map-cli.js");
+            return (argv) => runCapabilityMapCli(argv);
+        }
         case "export-spec": {
             const { runExportSpecCli } = await import("./render-cli/export-spec-cli.js");
             return (argv) => runExportSpecCli(argv);

package/dist/policy.d.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { type CeremonyDepth, type HookHost, type SpecGuardEnforcement } from "@deftai/directive-core/policy";
+import { type CeremonyDepth, type CoverageMode, type HookHost, type SpecGuardEnforcement } from "@deftai/directive-core/policy";
 interface ShowArgs {
     format: "text" | "json";
     changedOnly: boolean;
@@ -8,7 +8,7 @@ interface ShowArgs {
     error?: string;
 }
 interface SetArgs {
-    cmd: "show" | "enforce-branches" | "allow-direct-commits" | "allow-destructive-gh-verbs" | "enforce-destructive-gh-verbs" | "allow-bot-merge" | "enable-value-feedback" | "clear-value-feedback" | "set-ceremony-dial" | "set-spec-guard-enforcement" | "disable-host-hooks" | "disable-directive" | "enable-directive" | "resolve";
+    cmd: "show" | "enforce-branches" | "allow-direct-commits" | "allow-destructive-gh-verbs" | "enforce-destructive-gh-verbs" | "allow-bot-merge" | "enable-value-feedback" | "clear-value-feedback" | "set-ceremony-dial" | "set-coverage-mode" | "set-spec-guard-enforcement" | "disable-host-hooks" | "disable-directive" | "enable-directive" | "resolve";
     confirm: boolean;
     actor: string;
     note: string;
@@ -21,6 +21,8 @@ interface SetArgs {
     ceremonyOverride?: CeremonyDepth | null;
     /** #3214 ceremony dial enabled flag for set-ceremony-dial. */
     ceremonyEnabled?: boolean;
+    /** #5791 coverageMode target for set-coverage-mode. */
+    coverageMode?: CoverageMode;
     /** #5350 driftGuard.enforcement target for set-spec-guard-enforcement. */
     specGuardEnforcement?: SpecGuardEnforcement;
     /** #4375 audited setter for valueFeedback.upstreamPrompt. */

package/dist/policy.js

@@ -6,7 +6,7 @@
 import { existsSync } from "node:fs";
 import { resolve as pathResolve, relative } from "node:path";
 import { fileURLToPath } from "node:url";
-import { ALLOW_BOT_MERGE_CAPABILITY_COST, ALLOW_DESTRUCTIVE_GH_VERBS_CAPABILITY_COST, CEREMONY_DEPTHS, clearValueFeedback, createNoDeftDirectiveFlag, describeShadowedPlanExtension, detectNoDeftDirective, detectShadowedPlanExtensions, disableHostHooks, disclosureLine, enableValueFeedback, FIELD_VALUE_FEEDBACK, FIELD_VALUE_FEEDBACK_CLI_ALIAS, formatValueFeedbackStatusLine, humanMergeDisclosureLine, inspectAllPolicies, inspectOnePolicy, loadProjectDefinition, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_FLAG_NAME, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, POLICY_AUDIT_NOOP_STDOUT, parseHookHost, policyColonInvocation, projectDefinitionPath, promoteSpecGuardDriftEnforcement, pythonListRepr, pythonStringRepr, registeredPolicyNames, removeNoDeftDirectiveFlag, renderJson, renderText, resolveHumanMergePolicy, resolvePolicy, resolveValueFeedback, SPEC_GUARD_ENFORCEMENTS, setAllowDestructiveGhVerbs, setCeremonyDial, setPolicy, setRequireHumanMerge, } from "../vendor/directive-core/dist/policy/index.js";
+import { ALLOW_BOT_MERGE_CAPABILITY_COST, ALLOW_DESTRUCTIVE_GH_VERBS_CAPABILITY_COST, CEREMONY_DEPTHS, COVERAGE_MODES, clearValueFeedback, createNoDeftDirectiveFlag, describeShadowedPlanExtension, detectNoDeftDirective, detectShadowedPlanExtensions, disableHostHooks, disclosureLine, enableValueFeedback, FIELD_VALUE_FEEDBACK, FIELD_VALUE_FEEDBACK_CLI_ALIAS, formatValueFeedbackStatusLine, humanMergeDisclosureLine, inspectAllPolicies, inspectOnePolicy, loadProjectDefinition, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_FLAG_NAME, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, POLICY_AUDIT_NOOP_STDOUT, parseHookHost, policyColonInvocation, projectDefinitionPath, promoteSpecGuardDriftEnforcement, pythonListRepr, pythonStringRepr, registeredPolicyNames, removeNoDeftDirectiveFlag, renderJson, renderText, resolveHumanMergePolicy, resolvePolicy, resolveValueFeedback, SPEC_GUARD_ENFORCEMENTS, setAllowDestructiveGhVerbs, setCeremonyDial, setCoverageMode, setPolicy, setRequireHumanMerge, } from "../vendor/directive-core/dist/policy/index.js";
 const CAPABILITY_COST_DISCLOSURE = "\u26a0 Capability-cost disclosure -- enabling direct commits to the default " +
     "branch turns OFF the deft branch-protection policy.\n" +
     "  \u2022 Pre-commit + pre-push hooks will no longer block default-branch " +
@@ -114,10 +114,87 @@ export function parseShowArgs(argv) {
 /** Parse argv for the policy CLI (show + set subcommands). */
 export function parseArgs(argv) {
     if (argv.length === 0) {
-        const usage = "usage: policy [show|enforce-branches|allow-direct-commits|allow-destructive-gh-verbs|enforce-destructive-gh-verbs|allow-bot-merge|enable-value-feedback|clear-value-feedback|set-ceremony-dial|set-spec-guard-enforcement|disable-host-hooks|disable-directive|enable-directive|resolve] ...";
+        const usage = "usage: policy [show|enforce-branches|allow-direct-commits|allow-destructive-gh-verbs|enforce-destructive-gh-verbs|allow-bot-merge|enable-value-feedback|clear-value-feedback|set-ceremony-dial|set-coverage-mode|set-spec-guard-enforcement|disable-host-hooks|disable-directive|enable-directive|resolve] ...";
         return makeSetError(usage);
     }
     const cmd = argv[0];
+    if (cmd === "set-coverage-mode") {
+        let confirm = false;
+        let actor = policyColonInvocation("set-coverage-mode");
+        let note = "";
+        let projectRoot = ".";
+        let coverageMode;
+        for (let i = 1; i < argv.length; i += 1) {
+            const arg = argv[i];
+            if (arg === "--confirm") {
+                confirm = true;
+            }
+            else if (arg === "--actor") {
+                const v = argv[i + 1];
+                if (v === undefined)
+                    return makeSetError("argument --actor: expected one argument");
+                actor = v;
+                i += 1;
+            }
+            else if (arg?.startsWith("--actor=")) {
+                actor = arg.slice("--actor=".length);
+            }
+            else if (arg === "--note") {
+                const v = argv[i + 1];
+                if (v === undefined)
+                    return makeSetError("argument --note: expected one argument");
+                note = v;
+                i += 1;
+            }
+            else if (arg?.startsWith("--note=")) {
+                note = arg.slice("--note=".length);
+            }
+            else if (arg === "--mode") {
+                const v = argv[i + 1];
+                if (v === undefined) {
+                    return makeSetError("argument --mode: expected initial|disabled|full");
+                }
+                if (!COVERAGE_MODES.includes(v)) {
+                    return makeSetError("argument --mode: expected initial|disabled|full, got " + JSON.stringify(v));
+                }
+                coverageMode = v;
+                i += 1;
+            }
+            else if (arg?.startsWith("--mode=")) {
+                const v = arg.slice("--mode=".length);
+                if (!COVERAGE_MODES.includes(v)) {
+                    return makeSetError("argument --mode: expected initial|disabled|full, got " + JSON.stringify(v));
+                }
+                coverageMode = v;
+            }
+            else if (arg === "--project-root") {
+                const v = argv[i + 1];
+                if (v === undefined)
+                    return makeSetError("argument --project-root: expected one argument");
+                projectRoot = v;
+                i += 1;
+            }
+            else if (arg?.startsWith("--project-root=")) {
+                projectRoot = arg.slice("--project-root=".length);
+            }
+            else if (arg === "--") {
+            }
+            else {
+                return makeSetError("unrecognized argument: " + arg);
+            }
+        }
+        return {
+            cmd: "set-coverage-mode",
+            confirm,
+            actor,
+            note,
+            projectRoot,
+            format: "text",
+            changedOnly: false,
+            field: null,
+            coverageMode,
+        };
+    }
     if (cmd === "set-spec-guard-enforcement") {
         let confirm = false;
         let actor = policyColonInvocation("set-spec-guard-enforcement");
@@ -691,6 +768,9 @@ export function run(argv) {
     if (args.cmd === "set-ceremony-dial") {
         return runSetCeremonyDial(args);
     }
+    if (args.cmd === "set-coverage-mode") {
+        return runSetCoverageMode(args);
+    }
     if (args.cmd === "set-spec-guard-enforcement") {
         return runSetSpecGuardEnforcement(args);
     }
@@ -720,6 +800,25 @@ function runSetSpecGuardEnforcement(args) {
     process.stdout.write(result.stdout);
     return result.exitCode;
 }
+/** Persist plan.policy.coverageMode (#5791). */
+function runSetCoverageMode(args) {
+    const root = pathResolve(args.projectRoot);
+    if (args.coverageMode === undefined) {
+        process.stdout.write("usage: policy set-coverage-mode -- --mode initial|disabled|full [--confirm] [--project-root PATH]\n" +
+            "  Inspect: " +
+            policyColonInvocation("show", " --field=coverageMode") +
+            "\n");
+        return 1;
+    }
+    const result = setCoverageMode(root, {
+        mode: args.coverageMode,
+        confirm: args.confirm,
+        actor: args.actor,
+        note: args.note,
+    });
+    process.stdout.write(result.stdout);
+    return result.exitCode;
+}
 /** Persist plan.policy.ceremonyDial override/enabled (#3214). */
 function runSetCeremonyDial(args) {
     const root = pathResolve(args.projectRoot);

package/dist/pre-pr-run.d.ts

@@ -29,6 +29,8 @@ interface ParsedArgs {
     markComplete: boolean;
     skillOpen: boolean;
     evaluate: boolean;
+    pushAdmit: boolean;
+    projectRoot: string | null;
     json: boolean;
     help: boolean;
     error?: string;

package/dist/pre-pr-run.js

@@ -4,7 +4,9 @@
  * `deft pre-pr:run` starts the prescribed workflow. Opening the skill file
  * is not completion. Generic mark-complete cannot mint a pass.
  */
+import { readFileSync } from "node:fs";
 import { completeRun, computeControllerObservedHash, controllerPublisher, digestApprovedCriteria, evaluateLivePrePrCheck, getDefaultPrePrStore, markComplete, noteSkillFileOpen, observeCommandPhase, PRE_PR_PHASE_IDS, phaseSpec, resolveRecordFromStore, startControllerRun, submitReviewerReport, } from "../vendor/directive-core/dist/pre-pr-controller/index.js";
+import { evaluatePrePush, parsePrePushStdin } from "../vendor/directive-core/dist/preflight/index.js";
 import { isDirectEntrypoint } from "./entrypoint.js";
 const USAGE = `Usage: deft pre-pr:run [options]
 
@@ -42,6 +44,8 @@ Options:
   --mark-complete         always refuses; cannot mint a pass
   --skill-open            always refuses; opening the skill is not completion
   --evaluate              evaluate live binding against the private store
+  --push-admit            enrolled push admission (#5804); reads pre-push stdin
+  --project-root <path>   project root for --push-admit / store resolution
   --json
   --help
 `;
@@ -76,6 +80,8 @@ export function parseArgs(argv) {
         markComplete: false,
         skillOpen: false,
         evaluate: false,
+        pushAdmit: false,
+        projectRoot: null,
         json: false,
         help: false,
     };
@@ -205,6 +211,18 @@ export function parseArgs(argv) {
         else if (arg === "--evaluate") {
             parsed.evaluate = true;
         }
+        else if (arg === "--push-admit") {
+            parsed.pushAdmit = true;
+        }
+        else if (arg === "--project-root" || arg?.startsWith("--project-root=")) {
+            const value = arg === "--project-root" ? argv[i + 1] : arg.slice("--project-root=".length);
+            if (value === undefined) {
+                return { ...parsed, error: "argument --project-root: expected one argument" };
+            }
+            parsed.projectRoot = value;
+            if (arg === "--project-root")
+                i += 1;
+        }
         else if (arg === "--repo" || arg?.startsWith("--repo=")) {
             const value = arg === "--repo" ? argv[i + 1] : arg.slice("--repo=".length);
             if (value === undefined)
@@ -346,6 +364,27 @@ export function run(argv) {
         process.stderr.write(`pre_pr_run: ${args.error}\n`);
         return 2;
     }
+    if (args.pushAdmit) {
+        const projectRoot = args.projectRoot?.trim() || process.cwd();
+        let rawStdin = "";
+        try {
+            rawStdin = readFileSync(0, "utf8");
+        }
+        catch {
+            rawStdin = "";
+        }
+        const refs = parsePrePushStdin(rawStdin);
+        const [code, msg] = evaluatePrePush(refs, {
+            projectRoot,
+            enrolledBoundPrePr: true,
+            rawStdin,
+        });
+        if (code === 0)
+            process.stdout.write(`${msg}\n`);
+        else
+            process.stderr.write(`${msg}\n`);
+        return code;
+    }
     if (args.skillOpen) {
         const d = noteSkillFileOpen();
         emit(args.json, d, d.message, true);
@@ -377,6 +416,7 @@ export function run(argv) {
                 process.stderr.write("pre_pr_run: --observe-command requires --exit-code\n");
                 return 2;
             }
+            // #5814 / #5791: mode-skip pairs use non-zero exit (lint_iteration exit 5 + LINT_ITERATION_MODE_SKIP).
             if (args.skipReason !== null && args.skipReason.length > 0 && args.exitCode === 0) {
                 process.stderr.write("pre_pr_run: skip requires a non-zero --exit-code plus --skip-reason\n");
                 return 2;

package/dist/render-cli/capability-map-cli.d.ts

@@ -0,0 +1,3 @@
+/** Thin dispatch wrapper for `capability-map` (#5841); mirrors rule-map-cli. */
+export declare function runCapabilityMapCli(argv: readonly string[]): number;
+//# sourceMappingURL=capability-map-cli.d.ts.map

package/dist/render-cli/capability-map-cli.js

@@ -0,0 +1,6 @@
+import { capabilityMapMain } from "../../vendor/directive-core/dist/docs/capability-map.js";
+/** Thin dispatch wrapper for `capability-map` (#5841); mirrors rule-map-cli. */
+export function runCapabilityMapCli(argv) {
+    return capabilityMapMain(argv);
+}
+//# sourceMappingURL=capability-map-cli.js.map

package/dist/setup-wiring.d.ts

@@ -80,6 +80,8 @@ export declare function ensureHostHooks(projectRoot: string, hostHooksPolicy?: H
     created: string[];
     modified: string[];
 };
+/** Monotonic refuse-to-downgrade marker for marker-aware ensureGitHooks (#5804). */
+export declare const PRE_PUSH_BOUND_PRE_PR_MARKER = "deft:pre-pr-bound-push-v1";
 /** AC8.6 / AC2.5 / F-008 — disclosed when hooks files exist but core.hooksPath cannot activate. */
 export declare const GIT_HOOKS_INACTIVE_NO_GIT = "Git hooks inactive until git init + eligible repair/self-complete (core.hooksPath not set)";
 export declare function ensureGitHooks(projectRoot: string): {

package/dist/setup-wiring.js

@@ -705,11 +705,16 @@ REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || exit 1
 run_directive verify:encoding --staged --project-root "$REPO_ROOT" || exit $?
 `;
 const PRE_PUSH = `#!/usr/bin/env sh
+# deft:pre-pr-bound-push-v1 — refuse-to-downgrade marker (#5804); marker-aware ensureGitHooks only
 REPO_ROOT="$(git rev-parse --show-toplevel 2>/dev/null)" || exit 1
 # shellcheck source=/dev/null
 . "$REPO_ROOT/.githooks/_directive-run.sh"
 run_directive verify:branch --project-root "$REPO_ROOT" || exit $?
+# Enrolled bound pre-PR arm: sole-stdin (do not redirect shared run_directive to /dev/null)
+run_directive pre-pr:run --push-admit --project-root "$REPO_ROOT" || exit $?
 `;
+/** Monotonic refuse-to-downgrade marker for marker-aware ensureGitHooks (#5804). */
+export const PRE_PUSH_BOUND_PRE_PR_MARKER = "deft:pre-pr-bound-push-v1";
 /**
  * Current OVPR helpers plus supported latest-legacy Directive git hooks
  * (`_deft-run.sh` / `run_deft` / copied-core era). True third-party hooks
@@ -751,6 +756,15 @@ export function ensureGitHooks(projectRoot) {
             conflicts.push(`${file.rel}: existing hook is not Directive-managed; refusing to overwrite (chain or remove manually)`);
             continue;
         }
+        // Refuse-to-downgrade: marker-aware installer will not replace a newer enrolled
+        // pre-push arm with an older body that lacks the monotonic marker (#5804).
+        if (file.rel === ".githooks/pre-push" &&
+            prior !== null &&
+            prior.includes(PRE_PUSH_BOUND_PRE_PR_MARKER) &&
+            !next.includes(PRE_PUSH_BOUND_PRE_PR_MARKER)) {
+            conflicts.push(`${file.rel}: refuse-to-downgrade enrolled bound pre-PR arm (${PRE_PUSH_BOUND_PRE_PR_MARKER}); keeping newer hook`);
+            continue;
+        }
         const change = trackChange(projectRoot, file.rel, next);
         if (change.created)
             created.push(file.rel);

package/docs/getting-started.md

@@ -39,6 +39,8 @@ Two published packages: global **`@deftai/directive`** (launcher) and project-pi
 
 Framework maintainers of this repository use a separate Node 24 pin; see [CONTRIBUTING.md](../../CONTRIBUTING.md).
 
+Maintainer execution on this repo: after `git pull` / FF, hooks and ordinary `task <verb>` use the pin under `node_modules/@deftai/directive-runtime`. Tip dogfood without publishing is an explicit `task materialize:runtime` into **this** checkout only (each worktree installs/materializes its own pin). See [launcher.md](./launcher.md).
+
 ---
 
 ## Installation