@deftai/directive-runtime 0.129.5 → 0.129.7

package/Taskfile.yml

@@ -845,6 +845,322 @@ tasks:
         vars:
           ENGINE_CMD: 'release-wait-npm {{.CLI_ARGS}}'
 
+  # Phase 7 maintainer primary checkout closeout (#5953 Prefer-A Bound 6430511888).
+  # Inline cmds only — no engine:invoke / no deps:[ts:build] so the post-install
+  # payload can replace the N-1 runtime the cut was using. Never reset/force-push/
+  # commit / npm i -g.
+  release:local-update:
+    desc: "Phase 7 fail-closed maintainer checkout update (#5953) -- task release:local-update -- <version> --checkout <primary-occupancy-root>"
+    dir: '{{.USER_WORKING_DIR}}'
+    env:
+      PYTHONUTF8: "1"
+    cmds:
+      - |
+        set -e
+        # node -e bodies use shell single quotes + JS double quotes only (no apostrophes).
+        PARSE_OUT="$(node -e '
+          const raw = process.argv[1] || "";
+          const tokens = [];
+          let cur = "";
+          let q = null;
+          const DQ = String.fromCharCode(34);
+          const SQ = String.fromCharCode(39);
+          for (let i = 0; i < raw.length; i++) {
+            const ch = raw[i];
+            if (q) {
+              if (ch === q) { q = null; continue; }
+              cur += ch;
+              continue;
+            }
+            if (ch === DQ || ch === SQ) { q = ch; continue; }
+            if (/\s/.test(ch)) {
+              if (cur.length) { tokens.push(cur); cur = ""; }
+              continue;
+            }
+            cur += ch;
+          }
+          if (q) { console.error("release:local-update: unmatched quote in args"); process.exit(2); }
+          if (cur.length) tokens.push(cur);
+          let version = "";
+          let checkout = "";
+          for (let i = 0; i < tokens.length; i++) {
+            const t = tokens[i];
+            if (t === "--checkout") {
+              const v = tokens[++i];
+              if (!v) { console.error("release:local-update: --checkout requires a path"); process.exit(2); }
+              checkout = v;
+              continue;
+            }
+            if (t.startsWith("--")) {
+              console.error("release:local-update: unknown flag " + t);
+              console.error("Usage: task release:local-update -- <version> --checkout <maintainer-primary-occupancy-root>");
+              process.exit(2);
+            }
+            if (!version) { version = t; continue; }
+            console.error("release:local-update: unexpected arg " + t);
+            process.exit(2);
+          }
+          if (!version) {
+            console.error("release:local-update: missing <version>");
+            console.error("Usage: task release:local-update -- <version> --checkout <maintainer-primary-occupancy-root>");
+            process.exit(2);
+          }
+          if (!checkout) {
+            console.error("release:local-update: refuse ambient release-worktree-only success; require --checkout naming the maintainer primary occupancy root (#5953)");
+            process.exit(1);
+          }
+          process.stdout.write(JSON.stringify({ version, checkout }));
+        ' "{{.CLI_ARGS}}")"
+        VERSION="$(node -e 'const j=JSON.parse(process.argv[1]); process.stdout.write(j.version);' "$PARSE_OUT")"
+        CHECKOUT="$(node -e 'const j=JSON.parse(process.argv[1]); process.stdout.write(j.checkout);' "$PARSE_OUT")"
+        case "$CHECKOUT" in
+          /*|[A-Za-z]:*) ;;
+          *) CHECKOUT="$(pwd)/$CHECKOUT" ;;
+        esac
+        CHECKOUT="$(node -e 'const fs=require("fs"); const path=require("path"); const inPath=process.argv[1]; try { process.stdout.write(fs.realpathSync(inPath)); } catch { process.stdout.write(path.resolve(inPath)); }' "$CHECKOUT")"
+        if [ ! -d "$CHECKOUT/.git" ] && [ ! -f "$CHECKOUT/.git" ]; then
+          echo "release:local-update: --checkout is not a git checkout: $CHECKOUT" >&2
+          exit 1
+        fi
+        COMMON_DIR="$(git -C "$CHECKOUT" rev-parse --git-common-dir 2>/dev/null || true)"
+        if [ -z "$COMMON_DIR" ]; then
+          echo "release:local-update: cannot resolve git-common-dir for $CHECKOUT" >&2
+          exit 1
+        fi
+        case "$COMMON_DIR" in
+          /*|[A-Za-z]:*) ;;
+          *) COMMON_DIR="$CHECKOUT/$COMMON_DIR" ;;
+        esac
+        MAIN_ROOT="$(node -e 'const path=require("path"); process.stdout.write(path.resolve(path.dirname(process.argv[1])));' "$COMMON_DIR")"
+        SAME_MAIN="$(node -e 'const a=process.argv[1]; const b=process.argv[2]; const norm=s => process.platform==="win32" ? s.split(String.fromCharCode(92)).join("/").toLowerCase() : s.split(String.fromCharCode(92)).join("/"); process.stdout.write(norm(a)===norm(b)?"1":"0");' "$CHECKOUT" "$MAIN_ROOT")"
+        if [ "$SAME_MAIN" != "1" ]; then
+          echo "release:local-update: refuse ambient release-worktree-only success; --checkout must name the maintainer primary occupancy root (dirname git-common-dir=$MAIN_ROOT), not $CHECKOUT (#5953)" >&2
+          exit 1
+        fi
+        CHECKOUT_NORM="$(node -e 'process.stdout.write(String(process.argv[1]||"").split(String.fromCharCode(92)).join("/"));' "$CHECKOUT")"
+        case "$CHECKOUT_NORM" in
+          */.deft-scratch/worktrees/*)
+            echo "release:local-update: refuse ambient release-worktree-only success; --checkout must name the maintainer primary occupancy root, not $CHECKOUT (#5953)" >&2
+            exit 1
+            ;;
+        esac
+        print_deposit_recovery() {
+          echo "Phase 7 local closeout INCOMPLETE (#5953 / #6163 Prefer-A Bound 6772886751)." >&2
+          echo "Recovery: on the pin candidate, repair/write agent-hook deposit then force-add tip-required Cursor paths (.cursor/hooks.json + .cursor/hooks/deft-hook-<sha8>.mjs) so they co-travel with the pin (preparePinCandidateCursorDeposit / git add -f bounded set); merge that pin+deposit tip, then re-run:" >&2
+          echo "  task release:local-update -- $VERSION --checkout $CHECKOUT" >&2
+          echo "Expected managed deposit paths include: .grok/hooks/ .cursor/hooks.json .cursor/hooks/deft-hook-<sha8>.mjs .claude/settings.json .codex/ (and related deposit files)." >&2
+          echo "Do not auto-commit deposit bytes inside the release flow; do not npm i -g." >&2
+        }
+        OCC_FILE="$CHECKOUT/.deft/occupancy.json"
+        if [ -f "$OCC_FILE" ]; then
+          node -e '
+            const fs = require("fs");
+            const path = process.argv[1];
+            const checkout = process.argv[2];
+            const raw = fs.readFileSync(path, "utf8");
+            let rec;
+            try { rec = JSON.parse(raw); } catch { process.exit(0); }
+            const sid = String(rec.session_id || rec.sessionId || "");
+            const hb = Date.parse(rec.heartbeat_at || rec.heartbeatAt || "");
+            const claimed = Date.parse(rec.claimed_at || rec.claimedAt || "");
+            const now = Date.now();
+            const TTL = 20 * 60 * 1000;
+            const MAX = 24 * 60 * 60 * 1000;
+            if (!Number.isFinite(hb) || !Number.isFinite(claimed)) process.exit(0);
+            if (now - claimed > MAX || now - hb > TTL) process.exit(0);
+            const providers = ["grok", "claude", "cursor", "codex", "openclaw"];
+            const rawPresenters = [
+              process.env.DEFT_SESSION_ID,
+              process.env.GROK_SESSION_ID,
+              process.env.CLAUDE_SESSION_ID,
+              process.env.CURSOR_SESSION_ID,
+              process.env.CODEX_SESSION_ID,
+            ].filter((v) => typeof v === "string" && v.trim().length > 0).map((v) => v.trim());
+            const presenters = new Set(rawPresenters);
+            for (const p of rawPresenters) {
+              if (p.startsWith("host:")) continue;
+              for (const provider of providers) {
+                presenters.add("host:" + provider + ":v1:" + Buffer.from(p, "utf8").toString("base64url"));
+              }
+            }
+            let sidRaw = null;
+            const m = /^host:([a-z]+):v1:([A-Za-z0-9_-]+)$/.exec(sid);
+            if (m) {
+              try { sidRaw = Buffer.from(m[2], "base64url").toString("utf8"); } catch { sidRaw = null; }
+            }
+            const grants = Array.isArray(rec.grants) ? rec.grants : [];
+            const grantIds = grants
+              .filter((g) => Date.parse(g.expires_at || g.expiresAt || 0) > now)
+              .map((g) => g.session_id || g.sessionId || g.child_session_id || g.childSessionId)
+              .filter(Boolean)
+              .map(String);
+            const admitted = [...presenters].some((p) => p === sid || grantIds.includes(p) || (sidRaw && p === sidRaw));
+            if (!admitted && presenters.size > 0) {
+              console.error("release:local-update: refuse live foreign occupancy lease on " + checkout + " (occupant=" + sid + ") before any write (#5953)");
+              process.exit(1);
+            }
+            if (!admitted && presenters.size === 0 && sid) {
+              console.error("release:local-update: refuse live occupancy lease on " + checkout + " (occupant=" + sid + "); no presenter session id in env (#5953)");
+              process.exit(1);
+            }
+          ' "$OCC_FILE" "$CHECKOUT"
+        fi
+        cd "$CHECKOUT"
+        if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+          echo "release:local-update: not a git work tree: $CHECKOUT" >&2
+          exit 1
+        fi
+        if [ -n "$(git status --porcelain)" ]; then
+          echo "release:local-update: refuse dirty tree at $CHECKOUT" >&2
+          git status --short >&2
+          exit 1
+        fi
+        # #6164: shell parameter expansion strip (zero sed/awk/cut/grep); then git verify.
+        ORIGIN_HEAD="$(git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null || true)"
+        DEFAULT_BRANCH="${ORIGIN_HEAD#refs/remotes/origin/}"
+        if [ -z "$DEFAULT_BRANCH" ] || [ "$DEFAULT_BRANCH" = "$ORIGIN_HEAD" ]; then
+          DEFAULT_BRANCH=master
+        fi
+        if ! git rev-parse --verify --quiet "refs/remotes/origin/$DEFAULT_BRANCH" >/dev/null; then
+          echo "release:local-update: refuse; cannot verify refs/remotes/origin/$DEFAULT_BRANCH; run: git remote set-head origin -a" >&2
+          exit 1
+        fi
+        CURRENT="$(git rev-parse --abbrev-ref HEAD)"
+        if [ "$CURRENT" != "$DEFAULT_BRANCH" ]; then
+          echo "release:local-update: refuse; checkout must be on default branch $DEFAULT_BRANCH (on $CURRENT)" >&2
+          exit 1
+        fi
+        echo "release:local-update: ff-only pull on $DEFAULT_BRANCH at $CHECKOUT"
+        git pull --ff-only
+        # #6164: unconditional dependency-free AgeExclude gate (exact list-item; fail closed; no soft-skip).
+        node -e '
+          const fs = require("fs");
+          const version = process.argv[1] || "";
+          const want = "@deftai/directive-runtime@" + version;
+          let text;
+          try {
+            text = fs.readFileSync("pnpm-workspace.yaml", "utf8");
+          } catch (err) {
+            const detail = err && err.message ? err.message : String(err);
+            console.error("release:local-update: AgeExclude cannot read pnpm-workspace.yaml before frozen install (#6164): " + detail);
+            process.exit(1);
+          }
+          const lines = text.split(/\r?\n/);
+          const KEY_RE = /^(\s*)minimumReleaseAgeExclude:\s*(#.*)?$/;
+          const ITEM_RE = /^(\s*)-\s+(.*)$/;
+          const keyIdx = lines.findIndex((l) => KEY_RE.test(l));
+          if (keyIdx < 0) process.exit(0);
+          const keyLine = lines[keyIdx];
+          const keyIndent = keyLine.length - keyLine.trimStart().length;
+          const itemValue = (raw) => {
+            let v = String(raw || "").trim();
+            const SQ = String.fromCharCode(39);
+            const DQ = String.fromCharCode(34);
+            if (v.startsWith(SQ) || v.startsWith(DQ)) {
+              const q = v[0];
+              const end = v.indexOf(q, 1);
+              return end > 0 ? v.slice(1, end) : v;
+            }
+            const hash = v.search(/\s#/);
+            if (hash >= 0) v = v.slice(0, hash);
+            return v.trim();
+          };
+          let found = false;
+          for (let i = keyIdx + 1; i < lines.length; i++) {
+            const line = lines[i];
+            const trimmed = line.trim();
+            if (trimmed === "" || trimmed.startsWith("#")) continue;
+            const m = ITEM_RE.exec(line);
+            const indent = line.length - line.trimStart().length;
+            if (m === null || indent < keyIndent) break;
+            if (itemValue(m[2]) === want) { found = true; break; }
+          }
+          if (!found) {
+            console.error("release:local-update: AgeExclude missing " + want + " before frozen install (#5953 footnote / #6164)");
+            process.exit(1);
+          }
+        ' "$VERSION"
+        echo "release:local-update: pnpm install --frozen-lockfile"
+        pnpm install --frozen-lockfile
+        PIN_PKG="$(node -e 'const fs=require("fs"); const p=JSON.parse(fs.readFileSync("package.json","utf8")); const v=(p.dependencies||{})["@deftai/directive-runtime"]||(p.devDependencies||{})["@deftai/directive-runtime"]||""; console.log(String(v).replace(/^[^0-9]*/, ""));')"
+        INST_PKG="$(node -e 'const fs=require("fs"); const p=JSON.parse(fs.readFileSync("node_modules/@deftai/directive-runtime/package.json","utf8")); console.log(p.version);')"
+        if [ "$PIN_PKG" != "$VERSION" ] || [ "$INST_PKG" != "$VERSION" ]; then
+          echo "release:local-update: tip-pin-equals-released FAILED; want $VERSION; package.json pin=$PIN_PKG installed=$INST_PKG" >&2
+          exit 1
+        fi
+        echo "release:local-update: tip-pin-equals-released ok ($VERSION)"
+        RUNTIME_BIN="node_modules/@deftai/directive-runtime/dist/bin.js"
+        if [ ! -f "$RUNTIME_BIN" ]; then
+          echo "release:local-update: missing checkout runtime bin $RUNTIME_BIN" >&2
+          exit 1
+        fi
+        echo "release:local-update: require version-matched agent-hook deposit already on tip"
+        if ! DEFT_DOCTOR_HOOK_DIAGNOSTIC=1 node "$RUNTIME_BIN" verify:hooks-installed --project-root "$CHECKOUT" --scope=agent; then
+          print_deposit_recovery
+          exit 1
+        fi
+        # #6163 Prefer-A Bound 6772886751: committed-byte HEAD association (no repair/staging).
+        echo "release:local-update: require committed Cursor deposit association on HEAD"
+        if ! node --input-type=module -e '
+          import { pathToFileURL } from "node:url";
+          import { join, resolve } from "node:path";
+          const checkout = process.argv[1];
+          const vendor = join(
+            checkout,
+            "node_modules/@deftai/directive-runtime/vendor/directive-core/dist/init-deposit/agent-hooks.js",
+          );
+          let validate;
+          try {
+            ({ validateCursorDepositAssociation: validate } = await import(pathToFileURL(resolve(vendor)).href));
+          } catch (err) {
+            const detail = err && err.message ? err.message : String(err);
+            console.error("release:local-update: cannot load validateCursorDepositAssociation from installed runtime (#6163): " + detail);
+            process.exit(1);
+          }
+          if (typeof validate !== "function") {
+            console.error("release:local-update: installed runtime lacks validateCursorDepositAssociation (#6163); pin must co-travel the Bound helper");
+            process.exit(1);
+          }
+          const result = validate(checkout, { source: "HEAD" });
+          if (!result || result.ok !== true) {
+            console.error("release:local-update: committed Cursor deposit association FAILED on HEAD (#6163)");
+            console.error(result && result.detail ? result.detail : "unknown association failure");
+            process.exit(1);
+          }
+          console.log("release:local-update: committed Cursor deposit association ok (" + result.sha8 + ")");
+        ' "$CHECKOUT"; then
+          print_deposit_recovery
+          exit 1
+        fi
+        UPGRADE_BIN=""
+        if [ -x "node_modules/.bin/directive" ]; then
+          UPGRADE_BIN="node_modules/.bin/directive"
+        elif [ -f "node_modules/@deftai/directive/dist/bin.js" ]; then
+          UPGRADE_BIN="node node_modules/@deftai/directive/dist/bin.js"
+        elif command -v directive >/dev/null 2>&1; then
+          UPGRADE_BIN="directive"
+        else
+          echo "release:local-update: cannot resolve directive upgrade binary after frozen install" >&2
+          exit 1
+        fi
+        echo "release:local-update: $UPGRADE_BIN upgrade --target-version $VERSION --yes --root $CHECKOUT"
+        $UPGRADE_BIN upgrade --target-version "$VERSION" --yes --root "$CHECKOUT"
+        if [ -n "$(git status --porcelain)" ]; then
+          echo "release:local-update: tracked-file diff after upgrade; closeout non-zero/incomplete (#5953)" >&2
+          git status --short >&2
+          print_deposit_recovery
+          exit 1
+        fi
+        echo "release:local-update: verify:hooks-installed --project-root --scope=all"
+        DEFT_DOCTOR_HOOK_DIAGNOSTIC=1 node "$RUNTIME_BIN" verify:hooks-installed --project-root "$CHECKOUT" --scope=all
+        INST_PKG2="$(node -e 'const fs=require("fs"); const p=JSON.parse(fs.readFileSync("node_modules/@deftai/directive-runtime/package.json","utf8")); console.log(p.version);')"
+        if [ "$INST_PKG2" != "$VERSION" ]; then
+          echo "release:local-update: post-upgrade runtime $INST_PKG2 != $VERSION" >&2
+          exit 1
+        fi
+        echo "release:local-update COMPLETE; checkout=$CHECKOUT version=$INST_PKG2 hooks=verify:hooks-installed --scope=all green"
+        echo "global npm i -g was NOT run (report-only drift remains Phase 7 step 2)."
+
 
   # ------------------------------------------------------------------
   # Triage v1 user-facing alias tasks (#845, #913).

package/UPGRADING.md

@@ -949,6 +949,7 @@ Every **real** policy write (Phase 2 / Phase 4, and every other `meta/policy-cha
 - **On-disk layout changed.** Old: `.deft-cache/issues/<owner>-<repo>/<N>.{json,md}` (flat sidecar). New: `.deft-cache/<source>/<key>/{raw.json,content.md,meta.json}` (per-entry directory; schema-validated meta envelope). `cache:get` validates `meta.json` against `vbrief/schemas/cache-meta.schema.json` on every read so a corrupt or version-incompatible file fails closed.
 - **Audit log UNCHANGED.** `vbrief/.eval/candidates.jsonl` preserves accept / reject / defer / needs-ac / mark-duplicate / reset records across the migration. The Story 3 Tier-2 short-circuit (terminal-decision skip on bulk-* re-runs) operates on the same file.
 - **All other `triage:*` actions UNCHANGED.** `triage:accept` / `triage:reject` / `triage:defer` / `triage:needs-ac` / `triage:mark-duplicate` / `triage:bulk-accept` / `triage:bulk-reject` / `triage:bulk-defer` / `triage:bulk-needs-ac` / `triage:status` / `triage:reset` / `triage:history` / `triage:refresh-active` keep their v0.25.x surface byte-for-byte (13 aliases). The rebind onto `cache:get` is internal. `triage:bootstrap` keeps its v0.25.x command surface but its on-disk output is the new `.deft-cache/<source>/<key>/` per-entry layout (now delegates to `cache:fetch-all`); see the Commands list above.
+- **Gitcrawl fallback semantics no longer apply.** After this cache rebind, the old `docs/gitcrawl-fallback.md` gh-only install/recovery path is withdrawn. Do not follow that doc for v0.26+ triage/cache; use `cache:*` and this migration section instead (#1092).
 
 ### Rollback
 

package/commands.md

@@ -149,6 +149,7 @@ Common commands:
   - Bare `evidence` / `disposition` keys are **not** valid (#1620 / Option B #3305). They fail `verify:vbrief-conformance` and are treated as missing by `scope:complete` (no dual-read). Migrate bare keys or narrative-only `Result`/`Verification` workarounds to the namespaced fields above while items are still non-terminal.
   - Already-terminal items (`completed`/`failed`/`cancelled`/…) are not re-checked for typed evidence; pre-marking items complete to skip the gate is unsupported for the typed path.
   - `merge`/`review` alone cannot satisfy smoke/UAT/deploy/observed_behavior criteria (title/Acceptance text or explicit axis).
+  - **Delivery identity (#5710):** with an issue origin, the PR must be associated with the issue as of `merged_at` by one of: (a) a unique sole `deft-story: N` mark in the merge-time PR body (PRs that change only briefs and `CHANGELOG.md` are excluded and never count), (b) a closing keyword (`Closes #N`, `owner/repo#N`, or the issue URL) in the merge-time body, or (c) a Connected issue link at `merged_at`. Brief-in-PR-diff still counts. A mark, keyword or link added after merge does not count, and current `closingIssuesReferences` alone is not enough. Basis (a) scans every merged PR within 20 minutes, `graphql.remaining` ≥ 200 and REST core ≥ 100; any gap refuses. With no issue origin, stamp `plan.metadata.productPullRequest` and complete with `--pr <that number> --merge-commit <sha>`; the repository is the `origin` remote. `--non-delivery` refuses when the stamped PR is merged, and refuses when its merge state cannot be read. `xbrief:preflight` prints one note for a code-bearing brief with no issue origin.
 - `task scope:fail -- xbrief/active/<file>.xbrief.json` -- mark running work failed when the scope cannot complete.
 - `task scope:cancel -- <path>` -- move a scope to `cancelled/`.
 - `task scope:restore`, `task scope:block`, `task scope:unblock`, `task scope:demote`, and `task scope:undo:*` -- repair or reverse lifecycle transitions.
@@ -494,13 +495,14 @@ Cross-link: spawn three postures and deny recoveries live under § Agent-host di
 ### Mutable ritual (mutation posture)
 
 - ! On **mutation** session start, run `deft session:start` (or `task session:start` in framework source) after loading AGENTS.md. Records quick-tier ritual in `.deft/ritual-state.json`: alignment confirmation, branch-policy disclosure, `deft verify:tools` guidance, default-branch sync warnings, and `deft triage:welcome` one-liner. State is worktree- and HEAD-bound; stale after `plan.policy.sessionRitualStalenessHours` hours (default 8). Mutation start also claims the worktree occupancy lease (`.deft/occupancy.json`); see Session routing (#3433).
-- ! **Orientation compression Now (#3286):** mutation cold `session:start` composes `doctor` + #3282 toolchain preflight (and deposit-sha fast-paths for `agents:refresh` / `verify:cache-fresh`) as inline sections with per-section status lines — composition of existing steps, not a new monolith. When the deposit fingerprint (payload + templates + engine) is unchanged, refresh surfaces print one-line `unchanged - sha match` no-ops. Opt-in compact output: `deft session:start --compact` or `DEFT_SESSION_COMPACT=1` (verbose remains the default). #2176 read-only default is unchanged. Dual-path Later (orient) stays open until run-summary telemetry shows ritual+gate share ≥ 25% after Now ships (#2899).
+- ! **Quiet-default success stdout (#4966):** mutation `session:start` success human output defaults to one trusted go-signal line with stable prefix `[deft session] ready=…` (ready + branch/HEAD + occupancy). Routine dial/host-surface/effort/orientation/ceremony prose is verbose-only via `deft session:start --verbose` or `DEFT_SESSION_VERBOSE=1`. Non-exhaustive always-on allowlist keeps actionable zero-exit exceptions, non-default policy/bypass and human-merge disclosures, finalize-owed unknown/deferred qualifications, and actionable lifecycle/work-claim notices on the quiet path. Fail/deny/steal/non-zero stay loud. Tip `#3286` `--compact` / `DEFT_SESSION_COMPACT` are deprecated as whole-stdout volume controls (no-op for human stdout selection; `--json` / run-summary unchanged). Exit 0 is not the mutation go-signal — render from structured ready/posture/occupancy state.
+- ! **Orientation compression Now (#3286):** mutation cold `session:start` composes `doctor` + #3282 toolchain preflight (and deposit-sha fast-paths for `agents:refresh` / `verify:cache-fresh`) as inline sections with per-section status lines — composition of existing steps, not a new monolith. When the deposit fingerprint (payload + templates + engine) is unchanged, refresh surfaces print one-line `unchanged - sha match` no-ops. Section formatting may still honor `--compact` / `DEFT_SESSION_COMPACT=1` inside the orientation bundle; whole-stdout volume is `#4966` quiet-default / `--verbose`. #2176 read-only default is unchanged. Dual-path Later (orient) stays open until run-summary telemetry shows ritual+gate share ≥ 25% after Now ships (#2899).
 - ! Cold `session:start` does **not** run the live agent-hook probe. Functional readiness belongs to the gated mutation path so cold ceremony retains the #2990/#2991 latency profile.
 - ! **Hot path latency (#2991):** by default, mutation `session:start` does **not** block ritual-state write on optional network. It skips the npm release-availability probe and triage cache empty-hydrate / self-heal (`ensureTriageCacheHydrated` / `maybeSelfHealCache`). Targets (operator-facing, not CI-hard): warm hot path typically under a few seconds once tools are on PATH; cold path dominated by local `verify:tools` and git, usually well under ~30s when optional network is off. Empty-cache GitHub fetch-all and npm `view` previously accounted for multi-minute hangs in the WWYSYDH pilot — those stay off the critical path unless opted in.
 - ! **Cold vs re-arm ceremony tiers (#2992):** default `session:start` is the **cold** (full) path. After age staleness or compact re-arm (#2113) on the **same worktree** with continuous HEAD and previously-passing quick steps, prefer `deft session:start --rearm` (alias `--tier=rearm`) to refresh the ritual clock + HEAD/worktree bind without `verify:tools`, triage welcome, release probe, or staleness tickler. Full cold remains required for missing/invalid state, worktree change, discontinuous HEAD, first install, or failed/missing quick steps. Compact marks `rearm_needed`; PreToolUse denial and inspect/verify messages prefer re-arm recovery when cold is unnecessary.
 - ? Opt into optional network: `deft session:start --with-network` or `DEFT_SESSION_START_NETWORK=1`. When enabled, the bounded release-availability probe runs against the public npm registry (skips framework source checkouts, non-release pins, and `DEFT_NO_NETWORK=1`; identical latest-version notices throttle for 24 hours in `xbrief/.triage-cache/release-availability-state.json`). Default-mode triage welcome then also hydrates/self-heals the triage cache. This is separate from `deft doctor`, whose bare and gated invocations remain offline by default (#2182). Refs #1692 / #2991. Re-arm never runs optional network.
 - ~ `session:start --json` includes `steps[]` with `name` + `duration_ms` for major phases (`alignment`, `branch_policy`, `verify_tools`, `triage_welcome`, `release_probe`, `ritual_write`), plus total `duration_ms`, `optional_network`, and `ceremony_tier` (`cold` | `rearm`). Skipped optional steps report `skipped: true` and `duration_ms: 0`. Use this for attribution when investigating ceremony wall-clock.
-- ~ **Process-cost events (#2994 / #3508):** on mutation `session:start` completion (cold or re-arm), Directive appends a local `session:start` behavioral event to `.deft-cache/events.jsonl` with `ceremony_tier`, `duration_ms`, `exit_code`, and optional `steps[]` (same labels as `--json`). Mutation `session:start` also prints one operator-visible `ceremony <tier> <ms>` line (hidden under `--compact` / `DEFT_SESSION_COMPACT`). When PreToolUse denies for `ritual-not-ready`, a local `session:ritual-blocked` event records `tool_name`, `code`, and optional `recovery_tier` / `detail`. Always-on best-effort (never blocks ceremony or deny path); not gated on `valueFeedback`; **no remote upload** (Product Insights #2603 is a separate opt-in). Pull the rollup with `task value:show` (composed reader; CLI process time, not agent-turn wall clock). See § Process-cost events below. ⊗ Do not use the printed CLI duration as #3286 Later graduation input.
+- ~ **Process-cost events (#2994 / #3508):** on mutation `session:start` completion (cold or re-arm), Directive appends a local `session:start` behavioral event to `.deft-cache/events.jsonl` with `ceremony_tier`, `duration_ms`, `exit_code`, and optional `steps[]` (same labels as `--json`). Mutation `session:start` also emits one operator-visible `ceremony <tier> <ms>` line on the verbose human path (`--verbose` / `DEFT_SESSION_VERBOSE`; quiet-default hides it per #4966). When PreToolUse denies for `ritual-not-ready`, a local `session:ritual-blocked` event records `tool_name`, `code`, and optional `recovery_tier` / `detail`. Always-on best-effort (never blocks ceremony or deny path); not gated on `valueFeedback`; **no remote upload** (Product Insights #2603 is a separate opt-in). Pull the rollup with `task value:show` (composed reader; CLI process time, not agent-turn wall clock). See § Process-cost events below. ⊗ Do not use the printed CLI duration as #3286 Later graduation input.
 - ~ At safe idle points (clean tree, no in-flight story), mutation session start and `deft scope:complete` may also run the staleness tickler: an interactive, consent-based offer to upgrade Directive (`npm i -g @deftai/directive@latest`) and/or migrate xBRIEF (`deft migrate:xbrief`). Escalation tiers, snooze windows, and opt-out live under `plan.policy.stalenessTickler` — inspect with `deft policy:show --field=stalenessTickler`. State persists in `xbrief/.triage-cache/staleness-tickler-state.json`. Skips framework source checkouts, dirty trees, CI/headless (`DEFT_SESSION_RITUAL_SKIP=1`), and typed opt-out. Refs #2488 / #2489.
 - ! Before any code-writing tool call or `start_agent` implementation dispatch, run `deft verify:session-ritual -- --tier=gated`. Gated tier fails closed unless quick-tier state is fresh; lazily records the non-deferrable `agent_hooks` readiness gate plus `deft doctor` and `task verify:cache-fresh` entrypoints. Agent-hook correctness is independent of doctor warnings and throttling. Step 0 of the pre-`start_agent` gate stack.
 - ! **One-shot recovery (#2993 / #3100 / #4399):** when PreToolUse denies writes for a stale/missing gated ritual, run `deft session:ready` (or `task session:ready`). It composes `session:start` (only when quick-tier is not green) + `verify:session-ritual -- --tier=gated` with check-class `cache_fresh` (age + live drift, no `--skip-drift-probe`) + `cache fetch-all --force` when `cache_fresh` is the remaining blocker, then re-verifies. Skip-drift ritual argv is not the ready bar — that is the `task check` / FRAMEWORK_CHECK_GATES evaluate, so stale-by-drift can still fire fetch-all. Even when gated inspect is already fresh, the fast path forces one live `agent_hooks` check and the same check-class `cache_fresh`; it still avoids unnecessary fetch-all when that evaluate is green. Flags: `--json`, `--repo OWNER/NAME`, `--with-network` (forwarded to session:start). Prefer this over juggling the multi-step recovery sequence under hook pressure.
@@ -550,7 +552,7 @@ Local ceremony cost signal for WWYSYDH / weekly process rollups. Emits to `.deft
 | PreToolUse ritual deny | `session:ritual-blocked` | Hook blocks write/spawn because gated ritual is not ready | `tool_name`, `code=ritual-not-ready`, `recovery_tier` (`cold`\|`rearm`) |
 | Per-step wall-clock | (field on `session:start`) | Same emit as session start | `steps[].name` + `steps[].duration_ms` (`alignment`, `scm_readiness`, `branch_policy`, `verify_tools`, `triage_welcome`, `release_probe`, `ritual_write`) |
 
-CLI mirror (no JSONL required): `deft session:start --json` already exposes the same `steps` / `duration_ms` / `ceremony_tier` fields for one-shot inspection. Human mutation output adds one `ceremony <tier> <ms>` line unless compact hides it (#3508).
+CLI mirror (no JSONL required): `deft session:start --json` already exposes the same `steps` / `duration_ms` / `ceremony_tier` fields for one-shot inspection. Human mutation output adds one `ceremony <tier> <ms>` line on the verbose path (#3508 / #4966).
 
 Composed reader (no new verb): `task value:show` / `deft value:show` prints last cold vs re-arm duration, last per-step breakdown, blocked-ritual count, and recovery-tier distribution from the same ledger. This is **CLI process time**, not agent-turn wall clock (#3500). ⊗ Do not feed the printed CLI duration into #3286 Later graduation.
 

package/contracts/design-critique.md

@@ -65,7 +65,7 @@ Record `arc-mode: no-ingest` or `arc-mode: checkout` on the Stop 1 write-back. `
 - ! Parent-unclaimed is its own MUST: `session:start --read-only`, or an explicit occupancy release if a mutation lease is already held. Dest create does not clear occupancy.
 - ! Recognition of `no-ingest` happens before mutation initialization. Refuse github-only when mutation `session:start` has already occurred, unless the lease is released first.
 - ! Posting path that survives a foreign lease: `gh issue comment --body-file -` (stdin). Least-authority envelope: bounded GitHub reads and one comment post.
-- ! Parent fetches, then creates or verifies one dest at origin/<default> tip (`ensureArcDest`). dispatch-sha equals that tip. Against-implementation dest is the fetched PR head SHA, recorded on Stop 1. ⊗ Pin dest to local HEAD.
+- ! Parent fetches, then creates or verifies one dest at origin/<default> tip via the sanctioned pin-bin verb `deft design-critique:ensure-arc-dest` (library `ensureArcDest`; guarded-prep default, or explicit `process-only-no-install`). When guarded-prep is selected, success requires the outer-visible runtime pin. dispatch-sha equals that tip. Against-implementation dest is the fetched PR head SHA, recorded on Stop 1. ⊗ Pin dest to local HEAD. ⊗ Treat gitignored `packages/core/dist` as SoT for `ensureArcDest` on framework-source.
 - ! N>1 process-only critics share that dest with cwd-without-occupy. They are not swarm Phase 2 and not a #4066 mutating worker. Unique dest-lock stays for implement-class. Skip class is a host-visible Grok stdin marker (`subagent_type` `plan` or `process_only`), not dest-path. That marker is the process-only skip class, not an implementation-gate bypass: implement-class never sets `process_only`. ⊗ Skip #2885 on destProven. Keep #4066 primary-path deny. ⊗ Pin dest / process_only skip-class rules into `templates/agents-entry.md`.
 - ! Pin reads to `git show <dispatch-sha>:` against the recorded SHA. ⊗ A moving branch ref.
 - ! Before panel-deposit on a process-only dest, record a closed `verification-path:` line that either (a) names the read-only pin-read path (`git show <dispatch-sha>:`, dest cwd-without-occupy for on-pin file reads), or (b) records a provisioned runnable path when a specific check requires executing fixtures/tests. Default to (a). Keep N≥3 launch-probe (`evaluateN3LaunchProbe`) as launchability, separate from method-verification. `verificationPathRecordLine` / `evaluateVerificationPathBeforePanelDeposit` are the fixtures. ⊗ Mandate full install-on-dest for every panel.

package/contracts/path-write-fence.md

@@ -195,6 +195,12 @@ OS-temp dests and commands with no recognized dest (`git status`,
   remains **escape** polarity (in-tree dest whose realpath leaves the tree) and is
   not this check. The hook still runs before the shell, so a link created between
   check and write is TOCTOU.
+- **Kill-switch / permanent opt-out plant (#6136):** Shell write reissue checks
+  `.deft-directive-disable` / `.no-deft-directive` basenames **before** the
+  `isInRepoShellWritePath` skip, so an out-of-tree plant cannot fail-open. Agent
+  Write/Edit/Shell of those basenames is always-on deny without a human-origin
+  settings grant (docs: `deft-directive-disable.md`). General protected-target /
+  out-of-tree floor work stays on #6138; deny wording on #6139.
 
 Fail-open at this predicate is the bound posture (#3997). Inverting it to
 fail-closed on dests the parser cannot prove external is that issue's refuted

package/dist/applying-host-release.d.ts

@@ -0,0 +1,16 @@
+#!/usr/bin/env node
+/**
+ * Clear the worktree applying-host soft claim (#6143 Prefer-A).
+ *
+ * session:end / occupancy:release already clear applying-host with the lease.
+ * This verb clears an abandoned no-lease claim or the matching owner record.
+ */
+export declare function formatApplyingHostReleaseHelp(): string;
+export declare function parseArgs(argv: readonly string[]): {
+    projectRoot: string;
+    sessionId?: string;
+    help?: boolean;
+    error?: string;
+};
+export declare function run(argv: readonly string[]): number;
+//# sourceMappingURL=applying-host-release.d.ts.map

package/dist/applying-host-release.js

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+import { fileURLToPath } from "node:url";
+import { clearApplyingHost } from "../vendor/directive-core/dist/session/index.js";
+import { occupancyUnrecognizedArgument } from "./occupancy-unrecognized.js";
+/**
+ * Clear the worktree applying-host soft claim (#6143 Prefer-A).
+ *
+ * session:end / occupancy:release already clear applying-host with the lease.
+ * This verb clears an abandoned no-lease claim or the matching owner record.
+ */
+export function formatApplyingHostReleaseHelp() {
+    return [
+        "Usage: deft applying-host:release [--project-root <path>] [--session-id <id>]",
+        "",
+        "Clear .deft/applying-host.json for this worktree.",
+        "Owner match always clears. With no live foreign occupant, an abandoned",
+        "no-lease soft claim may be cleared without impersonating the recorded owner.",
+        "Live foreign lease keeps the record (use occupancy:release / session:end or steal).",
+        "",
+    ].join("\n");
+}
+export function parseArgs(argv) {
+    const parsed = {
+        projectRoot: ".",
+    };
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === "--help" || arg === "-h") {
+            parsed.help = true;
+        }
+        else if (arg === "--project-root") {
+            const value = argv[i + 1];
+            if (value === undefined || value.startsWith("--")) {
+                return { ...parsed, error: "argument --project-root: expected one argument" };
+            }
+            parsed.projectRoot = value;
+            i += 1;
+        }
+        else if (arg?.startsWith("--project-root=")) {
+            const value = arg.slice("--project-root=".length);
+            if (value.length === 0 || value.startsWith("--")) {
+                return { ...parsed, error: "argument --project-root: expected one argument" };
+            }
+            parsed.projectRoot = value;
+        }
+        else if (arg === "--session-id") {
+            const value = argv[i + 1];
+            if (value === undefined || value.startsWith("--")) {
+                return { ...parsed, error: "argument --session-id: expected one argument" };
+            }
+            const sessionId = value.trim();
+            if (sessionId.length === 0 || sessionId.startsWith("--")) {
+                return { ...parsed, error: "argument --session-id: expected a non-empty value" };
+            }
+            parsed.sessionId = sessionId;
+            i += 1;
+        }
+        else if (arg?.startsWith("--session-id=")) {
+            const sessionId = arg.slice("--session-id=".length).trim();
+            if (sessionId.length === 0 || sessionId.startsWith("--")) {
+                return { ...parsed, error: "argument --session-id: expected a non-empty value" };
+            }
+            parsed.sessionId = sessionId;
+        }
+        else {
+            return { ...parsed, error: occupancyUnrecognizedArgument(arg) };
+        }
+    }
+    return parsed;
+}
+export function run(argv) {
+    const args = parseArgs(argv);
+    if (args.error !== undefined) {
+        process.stderr.write(`applying-host:release: ${args.error}\n`);
+        return 2;
+    }
+    if (args.help === true) {
+        process.stdout.write(formatApplyingHostReleaseHelp());
+        return 0;
+    }
+    const result = clearApplyingHost(args.projectRoot, {
+        sessionId: args.sessionId ?? process.env.DEFT_SESSION_ID ?? null,
+    });
+    if (result.status === "missing") {
+        process.stdout.write("applying-host already clear\n");
+        return 0;
+    }
+    if (result.status === "denied") {
+        process.stderr.write(`${result.message}\n`);
+        return 1;
+    }
+    process.stdout.write(`applying-host cleared (${result.previousSessionId})\n`);
+    return 0;
+}
+if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1]) {
+    process.exit(run(process.argv.slice(2)));
+}
+//# sourceMappingURL=applying-host-release.js.map

package/dist/authz.d.ts

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import { type HumanPresenceMintSeams } from "./human-presence-mint.js";
 export type { HumanPresenceMintSeams as AuthzMainSeams } from "./human-presence-mint.js";
-export { AUTHZ_AGENT_SHELL_ENV_MARKERS, AUTHZ_INTERACTIVE_CONFIRM_PHRASE, } from "./human-presence-mint.js";
+export { AUTHZ_AGENT_SHELL_ENV_MARKERS, AUTHZ_INTERACTIVE_CONFIRM_PHRASE, detectedAgentShellMarkers, looksLikeAgentShell, } from "./human-presence-mint.js";
 export declare function main(argv?: string[], seams?: HumanPresenceMintSeams): number;
 export default main;
 //# sourceMappingURL=authz.d.ts.map

package/dist/authz.js

@@ -33,7 +33,7 @@ import { AFK_TEMPLATE_NAMES, AUTHZ_OPERATIONS, CLOSED_VERB_TEMPLATE_NAMES, FINIS
 import { uatCampaignEndSeal } from "../vendor/directive-core/dist/authz/campaign-end-seal.js";
 import { isSpecDriftOverrideTemplateName, mintSpecDriftOverrideTemplateGrant, SPEC_DRIFT_OVERRIDE_TEMPLATE_NAME, } from "../vendor/directive-core/dist/policy/index.js";
 import { refuseMintWhileUatActive, refuseNonInteractiveMint, resolveHumanPresenceMintSeams, } from "./human-presence-mint.js";
-export { AUTHZ_AGENT_SHELL_ENV_MARKERS, AUTHZ_INTERACTIVE_CONFIRM_PHRASE, } from "./human-presence-mint.js";
+export { AUTHZ_AGENT_SHELL_ENV_MARKERS, AUTHZ_INTERACTIVE_CONFIRM_PHRASE, detectedAgentShellMarkers, looksLikeAgentShell, } from "./human-presence-mint.js";
 function parseOps(raw) {
     const allowed = new Set(AUTHZ_OPERATIONS);
     const out = [];

package/dist/check.d.ts

@@ -8,6 +8,7 @@ export interface ParsedArgs {
 /**
  * Resolve check's framework-root from `projectRoot` without last-resort
  * `resolveDefaultFrameworkRoot` (#4722). Returns null on miss (fail-closed).
+ * OVPR pin under node_modules/@deftai/directive-runtime is a candidate (#5996).
  */
 export declare function resolveCheckFrameworkRoot(projectRoot: string, explicitRoot?: string | null): string | null;
 export declare function parseArgs(argv: readonly string[]): ParsedArgs;

package/dist/check.js

@@ -5,15 +5,18 @@
  * Usage: deft-ts check [--framework-root <path>] [--project-root <path>] [--no-cache]
  *
  * Omitted --project-root defaults to cwd. Omitted --framework-root walks
- * explicit / DEFT_ROOT / source checkout / .deft/core / legacy deft/ and
- * fail-closes instead of resolveDefaultFrameworkRoot (#4722).
+ * explicit / DEFT_ROOT / source checkout / .deft/core / legacy deft/ /
+ * node_modules/@deftai/directive-runtime and fail-closes instead of
+ * resolveDefaultFrameworkRoot (#4722 / #5996).
  */
-import { statSync } from "node:fs";
+import { existsSync, statSync } from "node:fs";
 import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { dispatchTaskCheck } from "../vendor/directive-core/dist/check/index.js";
 import { DEFT_REPO_POSITIVE_MARKERS } from "../vendor/directive-core/dist/doctor/index.js";
 import { refuseIfWslOwnershipBlocked } from "./wsl-ownership-guard.js";
+/** OVPR pin package path under a consumer project root (#5996). */
+const OVPR_RUNTIME_PACKAGE_REL = join("node_modules", "@deftai", "directive-runtime");
 function isFrameworkSourceCheckoutAt(projectRoot) {
     try {
         if (!statSync(join(projectRoot, "main.md")).isFile()) {
@@ -32,9 +35,25 @@ function isFrameworkSourceCheckoutAt(projectRoot) {
         }
     });
 }
+/**
+ * True when `candidate` is an installed `@deftai/directive-runtime` package
+ * root (directory + main.md), matching resolveFrameworkRootForProject (#5490).
+ */
+function looksLikeRuntimePackageRoot(candidate) {
+    try {
+        if (!statSync(candidate).isDirectory()) {
+            return false;
+        }
+    }
+    catch {
+        return false;
+    }
+    return existsSync(join(candidate, "main.md"));
+}
 /**
  * Resolve check's framework-root from `projectRoot` without last-resort
  * `resolveDefaultFrameworkRoot` (#4722). Returns null on miss (fail-closed).
+ * OVPR pin under node_modules/@deftai/directive-runtime is a candidate (#5996).
  */
 export function resolveCheckFrameworkRoot(projectRoot, explicitRoot) {
     const explicit = explicitRoot?.trim();
@@ -60,6 +79,10 @@ export function resolveCheckFrameworkRoot(projectRoot, explicitRoot) {
             // try next candidate
         }
     }
+    const ovprRuntime = join(root, OVPR_RUNTIME_PACKAGE_REL);
+    if (looksLikeRuntimePackageRoot(ovprRuntime)) {
+        return ovprRuntime;
+    }
     return null;
 }
 function takeRootOptionValue(argv, index, flag) {
@@ -125,7 +148,7 @@ export function parseArgs(argv) {
     }
     return parsed;
 }
-const FRAMEWORK_ROOT_MISS = "check: no framework-root at this project (source checkout, .deft/core, or legacy deft/). Run directive init.\n";
+const FRAMEWORK_ROOT_MISS = "check: no framework-root at this project (source checkout, .deft/core, legacy deft/, or node_modules/@deftai/directive-runtime). Install @deftai/directive-runtime (project package manager) or run directive install.\n";
 export function run(argv) {
     const args = parseArgs(argv);
     if (args.error !== undefined) {