@deftai/directive-runtime 0.129.5 → 0.129.7

package/skills/deft-directive-design-critique/SKILL.md

@@ -53,7 +53,7 @@ Yolo first-lean cites: Yolo leftover-pain. Honest pain cites. Not operator next-
 Walk / walk all. Auto-stamp when agents agree: Operator verbs.
 Parent chip write: scm:issue:design-critique-chip. Stale ingest-ready query: scm:issue:design-critique-stale-ready.
 Chip apply miss is non-blocking convenience; do not halt. On missing-repo-label chip miss, follow contract ensure-or-doctor recovery. Ingest waits on the completed-arc record, not a catalog chip.
-Run posture: missing defaults to no-ingest via resolveArcRunPostureForHost; ingest resolves checkout; closed collisions ask. Field lives in the contract.
+Run posture: missing defaults to no-ingest via resolveArcRunPostureForHost; ingest resolves checkout; closed collisions ask. Field lives in the contract. Arc dest: `deft design-critique:ensure-arc-dest` (guarded-prep default; `--install-mode process-only-no-install` for pin-read); fail closed if pin missing after guarded-prep. ⊗ gitignored `packages/core/dist` as SoT for ensureArcDest.
 Spend: closed n= wins for `spend:` (does not invent `spend-recommend:`); else call `deft design-critique:spend-resolve --utterance <text> --recommend` then resolve. Open with `--open-gate` at arc start before any structured ask (session-scoped state); `--clear` when the arc ends; `--unclosable-recommend` for parent-declared unclosable. Bare-arc missing recommend is a parent defect (record then resolve), not ask. Ask only for ambiguous mixes, bare panel, or unclosable recommend. Call spend-resolve before any operator surface. Field lives in the contract. Consume parseOperatorSpend / resolveDesignCritiqueSpend. ⊗ ask_user_question for spend on bare arc before spend-resolve / open-gate.
 Yolo standing: default on; noyolo clears; yolo affirms. Confirm conjunct only. Not ingest.
 Widget apply-set lives in the contract. Consume parseOperatorRunPosture / parseOperatorYoloStanding.

package/skills/deft-directive-release/SKILL.md

@@ -17,7 +17,7 @@ description: >-
 
 # Deft Directive Release
 
-Structured 8-phase workflow for cutting a v0.X.Y release of the deft framework. Operationalizes the `task release` / `task release:publish` / `task release:rollback` / `task release:e2e` / `task release:wait-npm` surface introduced in #716 (safety hardening of #74; Phase 7 wait #4267).
+Structured 8-phase workflow for cutting a v0.X.Y release of the deft framework. Operationalizes the `task release` / `task release:publish` / `task release:rollback` / `task release:e2e` / `task release:wait-npm` / `task release:local-update` surface introduced in #716 (safety hardening of #74; Phase 7 wait #4267; maintainer checkout closeout #5953).
 
 Legend (from RFC2119): !=MUST, ~=SHOULD, ≉=SHOULD NOT, ⊗=MUST NOT, ?=MAY.
 
@@ -373,6 +373,10 @@ Race-condition mitigation: `download_count` is double-read with a 5s sleep betwe
 
 ! Only enter Phase 7 if Phase 6 took the Publish branch (rollback branch ends here with the unwind log).
 
+! **Stable cut: decide npm latest explicitly (#5852).** A stable `X.Y.Z` publishes to the `maintainer` dist-tag and a prerelease to its id (`beta`, `rc`, ...); the publish never moves `latest` and the GitHub release is not marked Latest. For a stable cut, ask the operator: **promote now** or **record an explicit decline**. Promote is the separate `release-promote-latest` closed verb (mint `deft authz:grant -- --template release-promote-latest --target <version> --confirm` or set `DEFT_ALLOW_RELEASE_PROMOTE_LATEST=1`; a release-publish grant does not cover it). Run the gated command `deft release-publish --promote-latest <version>` (optional `--dry-run`); it evaluates the closed-verb gate and only then dispatches `gh workflow run npm-publish.yml --ref master -f action=promote-latest -f tag=v<version>`. That job (environment `npm`, concurrency `npm-promote-latest`) preflights both packages then moves `latest` for both and marks the GitHub release Latest. A decline is recorded in the release notes or record as "latest stays at <prior version>". Non-latest announcements give `npm i -g @deftai/directive@<dist-tag>`, not `@latest`.
+
+! Do not move `latest` with a bare shell `npm dist-tag add` or a bare `gh workflow run` for promote; use `deft release-publish --promote-latest`.
+
 1. ! **Wait until both public packages list the cut version (#4267, #1910, #3753).** Run `task release:wait-npm -- <version>`. That caller polls `npm view <pkg> versions` (prefer-online, doctor temp-cwd isolation) until both `@deftai/directive` and `@deftai/directive-runtime` list `<version>`, or 10 minutes. Partial visibility is **still-propagating** (wait before `npm i -g`); none visible after the wait is **publish-incomplete**. Report-only: must not fail the GitHub release. Confirm provenance on the npm page after the wait. ⊗ Treat a green `npm-publish.yml` job plus one visible sibling as registry truth. ⊗ Run `npm i -g`. `task release` Step 13 stays a single probe (timeout 0).
 2. ! **Report local-vs-released CLI drift (#3753).** `task release:wait-npm` already prints the local global CLI version, the released version, whether they match, and the exact remediation `npm i -g @deftai/directive@<version> --prefer-online`. Compare versions with `checkActiveCliAgainstTarget` (not bare `deft --version`) so a PATH-shadowed install cannot report success (#3233). The report must not fail the release.
 3. ! Verify GitHub auto-closed the discrete-task issue(s) referenced via `Closes #N` in the release notes (mirrors `skills/deft-directive-swarm/SKILL.md` Phase 6 Step 2)
@@ -381,6 +385,27 @@ Race-condition mitigation: `download_count` is double-read with a 5s sleep betwe
 6. ! Verify binaries are downloadable from the public release URL: `gh release view v<version> --json assets --jq '.assets[].url'` and curl one to confirm 200 OK
 7. ! For any umbrella / staying-OPEN issue (`Refs #N`) referenced in the release notes, run the Layer 3 reopen sweep from `skills/deft-directive-swarm/SKILL.md` Phase 6 Step 1: any protected issue that auto-closed MUST be reopened with a comment citing #701
 
+
+
+8. ! **Update the maintainer's local checkout (#5953 Prefer-A Bound 6430511888).** Required for every release; **required especially for maintainer (non-`latest`) cuts** where npm `latest` will not advance the checkout by accident. Anchor on the **tip-pin-equals-released** observable (tip `package.json` / lockfile pin equals released `<version>`), not a phantom pin-PR step.
+
+```
+task release:local-update -- <version> --checkout <maintainer-primary-occupancy-root>
+```
+
+The task fails closed and never resets, force-pushes, commits, or runs `npm i -g`:
+1. Require `--checkout <path>` naming the maintainer primary occupancy root; refuse ambient release-worktree-only success (running only in the release worktree without naming the primary).
+2. Refuse when the target checkout holds a live foreign occupancy lease before any write.
+3. On the checkout default branch: dirty-tree refuse; `git pull --ff-only` (never reset).
+4. When `pnpm-workspace.yaml` carries `minimumReleaseAgeExclude`, assert it already includes `@deftai/directive-runtime@<version>`; then `pnpm install --frozen-lockfile`.
+5. Assert tip-pin-equals-released: installed `node_modules/@deftai/directive-runtime` version equals `<version>` and matches the `package.json` pin.
+6. Require the version-matched agent-hook deposit already merged on tip (inspect against the post-install payload via the checkout runtime). Keep Phase 7 local closeout **incomplete** until that deposit evidence exists; print deposit-merge recovery paths.
+7. Re-resolve the upgrade binary from the checkout post-install tree and run `directive upgrade --target-version <version> --yes` (never registry-latest). `release:local-update` is inline Taskfile `cmds:` without `engine:invoke` or `deps: [ts:build]`.
+8. After upgrade, any tracked-file diff keeps closeout non-zero/incomplete with deposit-merge recovery paths for expected managed deposit files (`.grok/hooks/`, `.cursor/hooks.json`, `.claude/settings.json`, `.codex/` managed paths, and related deposit files).
+9. Run `deft verify:hooks-installed --project-root <checkout> --scope=all` from the checkout post-install runtime (⊗ bare `task verify:hooks-installed`) and re-assert installed runtime equals `<version>`.
+
+Report the local-update result (version now installed, hooks status) beside the existing global CLI drift report in Skill Completion.
+
 ⊗ Skip the post-publish verification. The closing-keyword false-positive (Layer 1 / Layer 2 / Layer 3) and the incremental-renderer-drift (#641, #614) are exactly the kind of issues that surface only AFTER a release is public.
 
 ## Phase 8 — Slack announcement
@@ -421,10 +446,15 @@ Where `<one-line guidance>` is one of:
 - "release v<version> rolled back -- the underlying defect needs a hot-fix in the next CHANGELOG entry"
 - "release deferred -- resume by running `task release:publish -- <version>` (GitHub only; npm already shipped at tag push) or `task release:rollback -- <version>` (GitHub unwind only; npm is forward-recovery) when ready"
 
+! On the Publish/live path, Skill Completion MUST also print the Phase 7 local-update result beside the global CLI drift report: checkout path, installed runtime version, hooks status (`verify:hooks-installed --scope=all`), and whether closeout is complete or incomplete (deposit-merge recovery). ⊗ Claim Phase 7 local closeout complete while `release:local-update` exited non-zero or was skipped on a maintainer non-latest cut (#5953).
+
 ⊗ Exit silently without confirming completion or providing next-step guidance.
 
 ## Anti-Patterns
 
+- ⊗ End the release with the maintainer's checkout still on the previous pin (#5953) — run `task release:local-update -- <version> --checkout <primary>` after tip-pin-equals-released
+- ⊗ Run `release:local-update` without `--checkout` naming the maintainer primary occupancy root, or claim success from the release worktree alone while primary stays stale (#5953)
+- ⊗ Soft/warn-only checkout lag; non-fatal green on post-upgrade tracked diffs; auto-commit of upgrade deposit inside release; `directive upgrade` without `--target-version` (registry latest); bare `task verify:hooks-installed` without `--project-root` / `--scope=all`; local-update via pin-exclusive `engine:invoke` on the N-1 runtime (#5953 Prefer-A Bound 6430511888)
 - ⊗ Foreground-block the operator chat on Phase 1 long prep (`reconcile:issues`, cache refresh) or Phase 3 `release:e2e` when background / subagent dispatch is available (#1880 Gap D / #2692) — the interactive channel must stay free for version confirmation, `--summary`, and the Phase 2 dry-run gate
 - ⊗ Proceed to `task release` on orientation-dirty `cache_fresh` or check-class stale-by-drift, or treat skip-drift ritual green / ritual-stale as that bar (#4399) — fetch-all first
 

package/skills/deft-directive-review-cycle/SKILL.md

@@ -536,13 +536,21 @@ REDISPATCH_OK: yes|no
 ⊗ Treat `ci_never_scheduled` as ordinary Greptile latency (`sha_match` / `terminal_check_run` only).
 ⊗ Silent `--skip-ci` / admin merge without the outage playbook audit trail below.
 
-### SLizard advisory-only for merge-ready wait (#3167)
+### SLizard advisory-only for merge-ready wait (#3167) — weather vs residual (#5102 / #4387)
 
-! Required bot for **merge-ready wait** / Step 6 exit ownership is **Greptile**. SLizard (Gemini Verify) is **advisory only**: timeouts, retries, missing check, or flaky SLizard conclusions MUST NOT gate the review-cycle wait loop or authorize unbounded re-push.
+! SLizard is advisory only for the Greptile merge-ready confidence floor; parseable blocking tip fingerprints are unfinished residual (#5102 / #3167).
 
-! `task pr:merge-ready` may still surface SLizard structure when present (#2189); agents MUST NOT idle-poll or thrash solely for SLizard when Greptile Step 6 is clean. Prefer continue / BLOCKED on CI weather / human decision.
+! Required bot for **merge-ready wait** / Step 6 exit ownership is **Greptile**. SLizard is **advisory only** for weather (timeout / cancelled / unparseable / zero-finding / missing-check): those MUST NOT gate the review-cycle wait loop (#3167). Parseable blocking tip fingerprints are unfinished residual (#5102).
 
-⊗ Block merge-ready babysit on SLizard alone when Greptile Step 6 all-of is satisfied on HEAD.
+! When `pr:merge-ready` / wait-mergeable reports **SLizard blocked** (parseable `request_changes` or `merge_impact=blocking` with non-zero findings) — especially Greptile CLEAN + SLizard blocked — before re-arming merge-ready wait or `pr:wait-mergeable-and-merge` the owner MUST read the tip SLizard **review body** in full, enumerate new and Previously mentioned fingerprints / deterministic tool names, and for each open P0/P1 falsify with `git show <head>:<path>` (slizard#2694) or fix in one residual batch. Do not idle-poll. Keep `pr:watch` Greptile ownership unchanged (#5102 / #2189 / #4387).
+
+! Compose existing head-blob check, same-fingerprint stop (#3448), and `--skip-slizard` override. Do not invent a third poller. `--skip-slizard` is explicit override only — not the default babysit escape.
+
+! Parseable blocking findings with open tip fingerprints are **unfinished residual**, not weather. Cross-link: `packages/core/src/pr-merge-readiness/slizard-gate.ts` (`evaluateSlizardGate`).
+
+⊗ Re-arm wait-mergeable / idle-poll while SLizard still has parseable blocking findings with open tip fingerprints (#5102).
+⊗ Treat parseable blocking SLizard findings as #3167 weather when Greptile Step 6 is clean (#5102 / #4387).
+⊗ Default to `--skip-slizard` to clear a merge-ready SLizard block (#5102).
 
 ### Outage admin-merge playbook (opt-in / human, #3167)
 
@@ -725,7 +733,7 @@ Cross-links: swarm decision tree `skills/deft-directive-swarm/references/core-ph
 
 ! When the platform descriptor indicates Tier 1 (sub-agent support) **and this agent owns the primitive as parent/orchestrator**, spawn a review-monitor sub-agent using the primitive matching the descriptor. ⊗ A grok-build / grok-bot / Cursor / Claude Code implementation leaf MUST NOT run these spawn steps.
 
-1. ! Launch via the matching primitive: `start_agent` (Warp), `spawn_subagent` (grok-build / TUI / non-Warp **parent**), the Cursor `Task` tool with `run_in_background: true` (`cursor-composer` / `cursor-cloud-agent`, #1877), the Claude Code `Agent` tool with `run_in_background: true` (`claude-code` / register `claude-agent`, #3134), OpenClaw `sessions_spawn` (`openclaw`, #2876), **or Grok Bot Task/executor/CloudAgent (`grok-bot` / register `grok-bot-executor`, #4201)** with a prompt that instructs it to poll for Greptile completion. For `spawn_subagent`, Cursor `Task`, Claude Code `Agent`, OpenClaw `sessions_spawn`, and Grok Bot executor the prompt MUST reference the canonical poller template `templates/swarm-greptile-poller-prompt.md` (with placeholders filled) plus the agent preamble; the working directory / context must be the PR branch (worktree or equivalent for hybrid).
+1. ! Launch via the matching primitive: `start_agent` (Warp), `spawn_subagent` (grok-build / TUI / non-Warp **parent**), the Cursor `Task` tool with `run_in_background: true` (`cursor-composer` / `cursor-cloud-agent`, #1877), the Claude Code `Agent` tool with `run_in_background: true` (`claude-code` / register `claude-agent`, #3134), OpenClaw `sessions_spawn` (`openclaw`, #2876), **or Grok Bot Task/executor/CloudAgent (`grok-bot` / register `grok-bot-executor`, #4201)** with a prompt that instructs it to poll for Greptile completion. For `spawn_subagent`, Cursor `Task`, Claude Code `Agent`, OpenClaw `sessions_spawn`, and Grok Bot executor the prompt MUST reference the canonical poller template `templates/swarm-greptile-poller-prompt.md` (with placeholders filled) plus the agent preamble; the working directory / context must be the PR branch (worktree or equivalent for hybrid). **Grok Approach 1 watch/report (#4781):** before `review-monitor:register` / child `pr:watch`, spawn with advertised `process_only: true` + dest `cwd` for `stop-at: pr-open` + `worker_role: review-monitor` seats only (`formatApproach1ProcessOnlySpawnShape` / `approach1BabysitterCommands`). Implement-class never sets `process_only`; dest-path is not the skip class; do not blanket-flag the fix-capable greptile poller.
 2. ! The sub-agent polls using the mechanism for its primitive: for `spawn_subagent` the **child** owns `pr:watch` / gh poll in its own process (adaptive cadence: ~20-30s first check after push, ~60s second, ~90s thereafter; Greptile typically lands in 3-7 min) — the user-facing parent MUST NOT enter `get_command_or_subagent_output`; a named durable-owner session MAY pull-wait (`host-grok-build.md` Gap D); for `start_agent` the native messaging path; for the Cursor `Task` tool the backgrounded-task completion-notification path; for Claude Code `Agent` the backgrounded-agent completion-notification path; for OpenClaw `sessions_spawn` the host session completion / messaging channel (prefer `task pr:watch` inside the child when available). Front-load the first check to catch fast reviews.
 3. ! When the exit condition is met (Greptile review current on the HEAD commit SHA, confidence meets resolved min (policy/dogfood/default; see Step 6 #3095), no P0/P1 remaining), the sub-agent reports completion back to the parent (via `send_message_to_agent`, the spawn_subagent result channel, or the OpenClaw sessions completion channel).
 4. ! The main conversation pane stays fully interactive during monitoring -- the user (or parent monitor) can continue other work. On Grok Build this is conditional until a measured completion-notify exists: it holds when the parent returns the turn after background spawn, not when the parent pull-waits (`host-grok-build.md` Gap D / #4796).
@@ -1029,7 +1037,8 @@ task lifecycle:event -- emit plan:approved \
 - ⊗ Workflow thrash or empty-commit spam during attributed platform outage without status-page probe (#3180)
 - ⊗ Tight forge-outage retry / empty-commit thrash without a one-shot human report (#3422)
 - ⊗ Merge or `--skip-ci` solely because a status page is red without check-run evidence (#3180)
-- ⊗ Block merge-ready wait on SLizard alone when Greptile Step 6 is clean (#3167)
+- ⊗ Re-arm wait-mergeable or treat parseable blocking SLizard tip fingerprints as #3167 weather when Greptile Step 6 is clean (#5102 / #3167)
+- ⊗ Idle-poll / skip reading tip SLizard review body while open Previously mentioned fingerprints remain (#5102)
 - ⊗ Silent admin / `--skip-ci` merge under Actions outage without audit comment and opt-in authority (#3167)
 - ⊗ Leave a deliberate `stop-at: pr-open` (or thin-DONE recovery) open PR without spawning/retaining one review-cycle babysit owner + lease continuity and post-merge `scope:complete` plan (#3153)
 - ⊗ Stand down at CLEAN under human-merge policy without a durable owner (sticky lease + live parent/monitor/Phase 6 closer) **and** a post-CLEAN observe path (poller / parent wake / Phase 6 re-poll) for post-merge `scope:complete` (#3153 / #1193 / #2321)

package/skills/deft-directive-swarm/references/host-grok-build.md

@@ -92,14 +92,15 @@ Until a measured callback exists, Grok wording is conditional: background `spawn
 
 ! **Grok through-merge (#4529 / #4821 / #5219):** implement MUST use (b) `stop-at: pr-open`. Path (a) is for non-through-merge Grok leaves only. Named leftover (class A) requires a dest-cwd one-shot residual, stop-at after the push; then Approach 1 wait owner is a **`spawn_subagent` review-monitor sibling** whose `monitor_agent_id` is registered (`review-monitor:register --platform-primitive spawn_subagent`) and whose child-bound `pr:watch --monitor-agent-id <id>` satisfies `verify:review-monitor --merge-path-arm --live-wait`; then Phase 6 / parent-retained squash-merges via `pr:wait-mergeable-and-merge` only after CLEAN. Pass a declared wait budget when the envelope states one (#3984). Parent-retained is the **closer after CLEAN**, not the pre-CLEAN poller/fixer. Dest spawn deny is `BLOCKED` or dest-cwd residual via native implementation-capable spawn (#4215) — not parent-primary. ⊗ Send class-A residual through process-only CLI `grok --cwd`. ⊗ Choose Approach 1 sibling or parent-retained as the first partner without dest residual. ⊗ Dispatch a Grok through-merge implement as (a). ⊗ Harvest a Grok `drive-to: merge-ready` continuation as this closer. ⊗ Treat a parent-owned shell/`bash` `pr:watch` (heartbeat `parent_id=pr-watch`) as Approach 1 babysit when `spawn_subagent` is available (#5219).
 
-! **Exclusive lawful waits / cheapest admitted Approach 1 (#5219 P3 / #5229 / #5727):** after `pr-open`, when Tier-1 `spawn_subagent` is available, the **only lawful** pre-CLEAN wait is Approach 1 child `pr:watch --monitor-agent-id` after `review-monitor:register --platform-primitive spawn_subagent` with `verify:review-monitor --merge-path-arm --live-wait` green; after CLEAN, parent-retained `pr:wait-mergeable-and-merge`. Approach 1 is also the **cheapest admitted** path vs parent shell `pr:watch`, host `monitor`, forge-poll, or bespoke `%TEMP%` pollers. Prefer one background `spawn_subagent` babysitter that owns watch → class A residual handoff → re-watch until CLEAN, then hand CLEAN to the parent closer. Child register + watch first (heartbeat live); parent verify after:
+! **Exclusive lawful waits / cheapest admitted Approach 1 (#5219 P3 / #5229 / #5727 / #4781):** after `pr-open`, when Tier-1 `spawn_subagent` is available, the **only lawful** pre-CLEAN wait is Approach 1 child `pr:watch --monitor-agent-id` after `review-monitor:register --platform-primitive spawn_subagent` with `verify:review-monitor --merge-path-arm --live-wait` green; after CLEAN, parent-retained `pr:wait-mergeable-and-merge`. Approach 1 is also the **cheapest admitted** path vs parent shell `pr:watch`, host `monitor`, forge-poll, or bespoke `%TEMP%` pollers. Prefer one background `spawn_subagent` babysitter that owns watch → class A residual handoff → re-watch until CLEAN, then hand CLEAN to the parent closer. **Spawn shape before register/pr:watch (#4781):** for monitor-only seats (`stop-at: pr-open` + `worker_role: review-monitor` watch/report), pass advertised `process_only: true` with dest `cwd` (`formatApproach1ProcessOnlySpawnShape` / `approach1BabysitterCommands`). Implement-class never sets `process_only`; dest-path is not the skip class; do not blanket-flag the fix-capable greptile poller. Dest convention by write need: shared cwd-without-occupy for non-writing monitor/critic seats; one dest per validation seat that writes a report root. Specs/report writes stay on requirements posture (#4444) — do not fold report roots into the spawn skip class. Child register + watch first (heartbeat live); parent verify after:
 ```
+# process_only+cwd spawn (monitor-only), then:
 task review-monitor:register -- --pr <N> --monitor-agent-id <id> --platform-primitive spawn_subagent
 DEFT_MONITOR_AGENT_ID=<id> task pr:watch -- <N> --monitor-agent-id <id>
 # parent after child watch is live:
 task verify:review-monitor -- --pr <N> --merge-path-arm --live-wait
 ```
-Core helper: `formatApproach1BabysitterOneLiner` / `formatApproach1CheapestAdmissionCard` / `admitClaimedBabysitPath` (`packages/core/src/swarm/approach1-babysitter.ts`). Bounded-form deny: `evaluateBoundedPrWatchDeny` refuses Directive `pr:watch` / `task deft:pr:watch` without `--monitor-agent-id` when Tier 1 is provable. Claimed-wait deny: `evaluateClaimedBabysitPathDeny` / `admitClaimedBabysitPath` refuse `BabysitPathKind` forge-poll / bespoke-temp-poller / host-monitor / directive-pr-watch-bare and Approach 1 without bound evidence / different-PR arm. ⊗ Parent forge-poll / `gh` check-runs+mergeable_state sleep / bespoke `%TEMP%` PowerShell watchers as pre-CLEAN babysit (#5727). ⊗ Parent-shell `pr:watch --monitor-agent-id <leased id>` without spawn-injected `DEFT_MONITOR_AGENT_ID` (or CLI matching `GROK_SESSION_ID`) — that impersonation does not arm. ⊗ Start `pr:wait-mergeable-and-merge` before CLEAN (#4822). ⊗ Treat host `monitor` or bare shell `pr:watch` as the sole babysit when `spawn_subagent` is available (#5229).
+Core helper: `formatApproach1BabysitterOneLiner` / `formatApproach1CheapestAdmissionCard` / `formatApproach1ProcessOnlySpawnShape` / `admitClaimedBabysitPath` (`packages/core/src/swarm/approach1-babysitter.ts`). Bounded-form deny: `evaluateBoundedPrWatchDeny` refuses Directive `pr:watch` / `task deft:pr:watch` without `--monitor-agent-id` when Tier 1 is provable. Claimed-wait deny: `evaluateClaimedBabysitPathDeny` / `admitClaimedBabysitPath` refuse `BabysitPathKind` forge-poll / bespoke-temp-poller / host-monitor / directive-pr-watch-bare and Approach 1 without bound evidence / different-PR arm. ⊗ Parent forge-poll / `gh` check-runs+mergeable_state sleep / bespoke `%TEMP%` PowerShell watchers as pre-CLEAN babysit (#5727). ⊗ Parent-shell `pr:watch --monitor-agent-id <leased id>` without spawn-injected `DEFT_MONITOR_AGENT_ID` (or CLI matching `GROK_SESSION_ID`) — that impersonation does not arm. ⊗ Start `pr:wait-mergeable-and-merge` before CLEAN (#4822). ⊗ Treat host `monitor` or bare shell `pr:watch` as the sole babysit when `spawn_subagent` is available (#5229).
 
 ! **Durable host→CLI capability stamp (#5229):** Before any CLI `verify:review-monitor` / `pr:watch` subprocess, write `.deft-scratch/host-capability-stamp.json` via `writeHostCapabilityStamp(projectRoot)` / `ensureHostCapabilityStampForBabysit` (and prefer exporting `GROK_BUILD=1` / `DEFT_HAS_SPAWN_SUBAGENT=1` into that subprocess). `review-monitor:register` also writes the stamp on successful claim/renew. Stamps older than 8h or bound to a different `host_session_id` are ignored so a later plain-terminal session cannot inherit Tier 1. Without a fresh stamp, bare `node … verify:review-monitor` can mis-detect Tier 3 / `generic-terminal` and fail-open with "no active review-monitor required" even though this parent owns `spawn_subagent`. `probeMonitoringTier` merges the stamp; `DEFT_MONITOR_TIER=3` is labeled `override-tier3` (not honest `generic-terminal`) and refused when stamp/env already proves Tier 1. `evaluateReviewMonitorGate` consults sticky lease `platform_primitive` before Approach 3 READY and before `!isTier1` READY. Bounded `pr:watch` without `--monitor-agent-id` is refused at the watch entry when Tier 1 is provable.
 

package/vendor/directive-content/Taskfile.yml

@@ -845,6 +845,322 @@ tasks:
         vars:
           ENGINE_CMD: 'release-wait-npm {{.CLI_ARGS}}'
 
+  # Phase 7 maintainer primary checkout closeout (#5953 Prefer-A Bound 6430511888).
+  # Inline cmds only — no engine:invoke / no deps:[ts:build] so the post-install
+  # payload can replace the N-1 runtime the cut was using. Never reset/force-push/
+  # commit / npm i -g.
+  release:local-update:
+    desc: "Phase 7 fail-closed maintainer checkout update (#5953) -- task release:local-update -- <version> --checkout <primary-occupancy-root>"
+    dir: '{{.USER_WORKING_DIR}}'
+    env:
+      PYTHONUTF8: "1"
+    cmds:
+      - |
+        set -e
+        # node -e bodies use shell single quotes + JS double quotes only (no apostrophes).
+        PARSE_OUT="$(node -e '
+          const raw = process.argv[1] || "";
+          const tokens = [];
+          let cur = "";
+          let q = null;
+          const DQ = String.fromCharCode(34);
+          const SQ = String.fromCharCode(39);
+          for (let i = 0; i < raw.length; i++) {
+            const ch = raw[i];
+            if (q) {
+              if (ch === q) { q = null; continue; }
+              cur += ch;
+              continue;
+            }
+            if (ch === DQ || ch === SQ) { q = ch; continue; }
+            if (/\s/.test(ch)) {
+              if (cur.length) { tokens.push(cur); cur = ""; }
+              continue;
+            }
+            cur += ch;
+          }
+          if (q) { console.error("release:local-update: unmatched quote in args"); process.exit(2); }
+          if (cur.length) tokens.push(cur);
+          let version = "";
+          let checkout = "";
+          for (let i = 0; i < tokens.length; i++) {
+            const t = tokens[i];
+            if (t === "--checkout") {
+              const v = tokens[++i];
+              if (!v) { console.error("release:local-update: --checkout requires a path"); process.exit(2); }
+              checkout = v;
+              continue;
+            }
+            if (t.startsWith("--")) {
+              console.error("release:local-update: unknown flag " + t);
+              console.error("Usage: task release:local-update -- <version> --checkout <maintainer-primary-occupancy-root>");
+              process.exit(2);
+            }
+            if (!version) { version = t; continue; }
+            console.error("release:local-update: unexpected arg " + t);
+            process.exit(2);
+          }
+          if (!version) {
+            console.error("release:local-update: missing <version>");
+            console.error("Usage: task release:local-update -- <version> --checkout <maintainer-primary-occupancy-root>");
+            process.exit(2);
+          }
+          if (!checkout) {
+            console.error("release:local-update: refuse ambient release-worktree-only success; require --checkout naming the maintainer primary occupancy root (#5953)");
+            process.exit(1);
+          }
+          process.stdout.write(JSON.stringify({ version, checkout }));
+        ' "{{.CLI_ARGS}}")"
+        VERSION="$(node -e 'const j=JSON.parse(process.argv[1]); process.stdout.write(j.version);' "$PARSE_OUT")"
+        CHECKOUT="$(node -e 'const j=JSON.parse(process.argv[1]); process.stdout.write(j.checkout);' "$PARSE_OUT")"
+        case "$CHECKOUT" in
+          /*|[A-Za-z]:*) ;;
+          *) CHECKOUT="$(pwd)/$CHECKOUT" ;;
+        esac
+        CHECKOUT="$(node -e 'const fs=require("fs"); const path=require("path"); const inPath=process.argv[1]; try { process.stdout.write(fs.realpathSync(inPath)); } catch { process.stdout.write(path.resolve(inPath)); }' "$CHECKOUT")"
+        if [ ! -d "$CHECKOUT/.git" ] && [ ! -f "$CHECKOUT/.git" ]; then
+          echo "release:local-update: --checkout is not a git checkout: $CHECKOUT" >&2
+          exit 1
+        fi
+        COMMON_DIR="$(git -C "$CHECKOUT" rev-parse --git-common-dir 2>/dev/null || true)"
+        if [ -z "$COMMON_DIR" ]; then
+          echo "release:local-update: cannot resolve git-common-dir for $CHECKOUT" >&2
+          exit 1
+        fi
+        case "$COMMON_DIR" in
+          /*|[A-Za-z]:*) ;;
+          *) COMMON_DIR="$CHECKOUT/$COMMON_DIR" ;;
+        esac
+        MAIN_ROOT="$(node -e 'const path=require("path"); process.stdout.write(path.resolve(path.dirname(process.argv[1])));' "$COMMON_DIR")"
+        SAME_MAIN="$(node -e 'const a=process.argv[1]; const b=process.argv[2]; const norm=s => process.platform==="win32" ? s.split(String.fromCharCode(92)).join("/").toLowerCase() : s.split(String.fromCharCode(92)).join("/"); process.stdout.write(norm(a)===norm(b)?"1":"0");' "$CHECKOUT" "$MAIN_ROOT")"
+        if [ "$SAME_MAIN" != "1" ]; then
+          echo "release:local-update: refuse ambient release-worktree-only success; --checkout must name the maintainer primary occupancy root (dirname git-common-dir=$MAIN_ROOT), not $CHECKOUT (#5953)" >&2
+          exit 1
+        fi
+        CHECKOUT_NORM="$(node -e 'process.stdout.write(String(process.argv[1]||"").split(String.fromCharCode(92)).join("/"));' "$CHECKOUT")"
+        case "$CHECKOUT_NORM" in
+          */.deft-scratch/worktrees/*)
+            echo "release:local-update: refuse ambient release-worktree-only success; --checkout must name the maintainer primary occupancy root, not $CHECKOUT (#5953)" >&2
+            exit 1
+            ;;
+        esac
+        print_deposit_recovery() {
+          echo "Phase 7 local closeout INCOMPLETE (#5953 / #6163 Prefer-A Bound 6772886751)." >&2
+          echo "Recovery: on the pin candidate, repair/write agent-hook deposit then force-add tip-required Cursor paths (.cursor/hooks.json + .cursor/hooks/deft-hook-<sha8>.mjs) so they co-travel with the pin (preparePinCandidateCursorDeposit / git add -f bounded set); merge that pin+deposit tip, then re-run:" >&2
+          echo "  task release:local-update -- $VERSION --checkout $CHECKOUT" >&2
+          echo "Expected managed deposit paths include: .grok/hooks/ .cursor/hooks.json .cursor/hooks/deft-hook-<sha8>.mjs .claude/settings.json .codex/ (and related deposit files)." >&2
+          echo "Do not auto-commit deposit bytes inside the release flow; do not npm i -g." >&2
+        }
+        OCC_FILE="$CHECKOUT/.deft/occupancy.json"
+        if [ -f "$OCC_FILE" ]; then
+          node -e '
+            const fs = require("fs");
+            const path = process.argv[1];
+            const checkout = process.argv[2];
+            const raw = fs.readFileSync(path, "utf8");
+            let rec;
+            try { rec = JSON.parse(raw); } catch { process.exit(0); }
+            const sid = String(rec.session_id || rec.sessionId || "");
+            const hb = Date.parse(rec.heartbeat_at || rec.heartbeatAt || "");
+            const claimed = Date.parse(rec.claimed_at || rec.claimedAt || "");
+            const now = Date.now();
+            const TTL = 20 * 60 * 1000;
+            const MAX = 24 * 60 * 60 * 1000;
+            if (!Number.isFinite(hb) || !Number.isFinite(claimed)) process.exit(0);
+            if (now - claimed > MAX || now - hb > TTL) process.exit(0);
+            const providers = ["grok", "claude", "cursor", "codex", "openclaw"];
+            const rawPresenters = [
+              process.env.DEFT_SESSION_ID,
+              process.env.GROK_SESSION_ID,
+              process.env.CLAUDE_SESSION_ID,
+              process.env.CURSOR_SESSION_ID,
+              process.env.CODEX_SESSION_ID,
+            ].filter((v) => typeof v === "string" && v.trim().length > 0).map((v) => v.trim());
+            const presenters = new Set(rawPresenters);
+            for (const p of rawPresenters) {
+              if (p.startsWith("host:")) continue;
+              for (const provider of providers) {
+                presenters.add("host:" + provider + ":v1:" + Buffer.from(p, "utf8").toString("base64url"));
+              }
+            }
+            let sidRaw = null;
+            const m = /^host:([a-z]+):v1:([A-Za-z0-9_-]+)$/.exec(sid);
+            if (m) {
+              try { sidRaw = Buffer.from(m[2], "base64url").toString("utf8"); } catch { sidRaw = null; }
+            }
+            const grants = Array.isArray(rec.grants) ? rec.grants : [];
+            const grantIds = grants
+              .filter((g) => Date.parse(g.expires_at || g.expiresAt || 0) > now)
+              .map((g) => g.session_id || g.sessionId || g.child_session_id || g.childSessionId)
+              .filter(Boolean)
+              .map(String);
+            const admitted = [...presenters].some((p) => p === sid || grantIds.includes(p) || (sidRaw && p === sidRaw));
+            if (!admitted && presenters.size > 0) {
+              console.error("release:local-update: refuse live foreign occupancy lease on " + checkout + " (occupant=" + sid + ") before any write (#5953)");
+              process.exit(1);
+            }
+            if (!admitted && presenters.size === 0 && sid) {
+              console.error("release:local-update: refuse live occupancy lease on " + checkout + " (occupant=" + sid + "); no presenter session id in env (#5953)");
+              process.exit(1);
+            }
+          ' "$OCC_FILE" "$CHECKOUT"
+        fi
+        cd "$CHECKOUT"
+        if ! git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+          echo "release:local-update: not a git work tree: $CHECKOUT" >&2
+          exit 1
+        fi
+        if [ -n "$(git status --porcelain)" ]; then
+          echo "release:local-update: refuse dirty tree at $CHECKOUT" >&2
+          git status --short >&2
+          exit 1
+        fi
+        # #6164: shell parameter expansion strip (zero sed/awk/cut/grep); then git verify.
+        ORIGIN_HEAD="$(git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null || true)"
+        DEFAULT_BRANCH="${ORIGIN_HEAD#refs/remotes/origin/}"
+        if [ -z "$DEFAULT_BRANCH" ] || [ "$DEFAULT_BRANCH" = "$ORIGIN_HEAD" ]; then
+          DEFAULT_BRANCH=master
+        fi
+        if ! git rev-parse --verify --quiet "refs/remotes/origin/$DEFAULT_BRANCH" >/dev/null; then
+          echo "release:local-update: refuse; cannot verify refs/remotes/origin/$DEFAULT_BRANCH; run: git remote set-head origin -a" >&2
+          exit 1
+        fi
+        CURRENT="$(git rev-parse --abbrev-ref HEAD)"
+        if [ "$CURRENT" != "$DEFAULT_BRANCH" ]; then
+          echo "release:local-update: refuse; checkout must be on default branch $DEFAULT_BRANCH (on $CURRENT)" >&2
+          exit 1
+        fi
+        echo "release:local-update: ff-only pull on $DEFAULT_BRANCH at $CHECKOUT"
+        git pull --ff-only
+        # #6164: unconditional dependency-free AgeExclude gate (exact list-item; fail closed; no soft-skip).
+        node -e '
+          const fs = require("fs");
+          const version = process.argv[1] || "";
+          const want = "@deftai/directive-runtime@" + version;
+          let text;
+          try {
+            text = fs.readFileSync("pnpm-workspace.yaml", "utf8");
+          } catch (err) {
+            const detail = err && err.message ? err.message : String(err);
+            console.error("release:local-update: AgeExclude cannot read pnpm-workspace.yaml before frozen install (#6164): " + detail);
+            process.exit(1);
+          }
+          const lines = text.split(/\r?\n/);
+          const KEY_RE = /^(\s*)minimumReleaseAgeExclude:\s*(#.*)?$/;
+          const ITEM_RE = /^(\s*)-\s+(.*)$/;
+          const keyIdx = lines.findIndex((l) => KEY_RE.test(l));
+          if (keyIdx < 0) process.exit(0);
+          const keyLine = lines[keyIdx];
+          const keyIndent = keyLine.length - keyLine.trimStart().length;
+          const itemValue = (raw) => {
+            let v = String(raw || "").trim();
+            const SQ = String.fromCharCode(39);
+            const DQ = String.fromCharCode(34);
+            if (v.startsWith(SQ) || v.startsWith(DQ)) {
+              const q = v[0];
+              const end = v.indexOf(q, 1);
+              return end > 0 ? v.slice(1, end) : v;
+            }
+            const hash = v.search(/\s#/);
+            if (hash >= 0) v = v.slice(0, hash);
+            return v.trim();
+          };
+          let found = false;
+          for (let i = keyIdx + 1; i < lines.length; i++) {
+            const line = lines[i];
+            const trimmed = line.trim();
+            if (trimmed === "" || trimmed.startsWith("#")) continue;
+            const m = ITEM_RE.exec(line);
+            const indent = line.length - line.trimStart().length;
+            if (m === null || indent < keyIndent) break;
+            if (itemValue(m[2]) === want) { found = true; break; }
+          }
+          if (!found) {
+            console.error("release:local-update: AgeExclude missing " + want + " before frozen install (#5953 footnote / #6164)");
+            process.exit(1);
+          }
+        ' "$VERSION"
+        echo "release:local-update: pnpm install --frozen-lockfile"
+        pnpm install --frozen-lockfile
+        PIN_PKG="$(node -e 'const fs=require("fs"); const p=JSON.parse(fs.readFileSync("package.json","utf8")); const v=(p.dependencies||{})["@deftai/directive-runtime"]||(p.devDependencies||{})["@deftai/directive-runtime"]||""; console.log(String(v).replace(/^[^0-9]*/, ""));')"
+        INST_PKG="$(node -e 'const fs=require("fs"); const p=JSON.parse(fs.readFileSync("node_modules/@deftai/directive-runtime/package.json","utf8")); console.log(p.version);')"
+        if [ "$PIN_PKG" != "$VERSION" ] || [ "$INST_PKG" != "$VERSION" ]; then
+          echo "release:local-update: tip-pin-equals-released FAILED; want $VERSION; package.json pin=$PIN_PKG installed=$INST_PKG" >&2
+          exit 1
+        fi
+        echo "release:local-update: tip-pin-equals-released ok ($VERSION)"
+        RUNTIME_BIN="node_modules/@deftai/directive-runtime/dist/bin.js"
+        if [ ! -f "$RUNTIME_BIN" ]; then
+          echo "release:local-update: missing checkout runtime bin $RUNTIME_BIN" >&2
+          exit 1
+        fi
+        echo "release:local-update: require version-matched agent-hook deposit already on tip"
+        if ! DEFT_DOCTOR_HOOK_DIAGNOSTIC=1 node "$RUNTIME_BIN" verify:hooks-installed --project-root "$CHECKOUT" --scope=agent; then
+          print_deposit_recovery
+          exit 1
+        fi
+        # #6163 Prefer-A Bound 6772886751: committed-byte HEAD association (no repair/staging).
+        echo "release:local-update: require committed Cursor deposit association on HEAD"
+        if ! node --input-type=module -e '
+          import { pathToFileURL } from "node:url";
+          import { join, resolve } from "node:path";
+          const checkout = process.argv[1];
+          const vendor = join(
+            checkout,
+            "node_modules/@deftai/directive-runtime/vendor/directive-core/dist/init-deposit/agent-hooks.js",
+          );
+          let validate;
+          try {
+            ({ validateCursorDepositAssociation: validate } = await import(pathToFileURL(resolve(vendor)).href));
+          } catch (err) {
+            const detail = err && err.message ? err.message : String(err);
+            console.error("release:local-update: cannot load validateCursorDepositAssociation from installed runtime (#6163): " + detail);
+            process.exit(1);
+          }
+          if (typeof validate !== "function") {
+            console.error("release:local-update: installed runtime lacks validateCursorDepositAssociation (#6163); pin must co-travel the Bound helper");
+            process.exit(1);
+          }
+          const result = validate(checkout, { source: "HEAD" });
+          if (!result || result.ok !== true) {
+            console.error("release:local-update: committed Cursor deposit association FAILED on HEAD (#6163)");
+            console.error(result && result.detail ? result.detail : "unknown association failure");
+            process.exit(1);
+          }
+          console.log("release:local-update: committed Cursor deposit association ok (" + result.sha8 + ")");
+        ' "$CHECKOUT"; then
+          print_deposit_recovery
+          exit 1
+        fi
+        UPGRADE_BIN=""
+        if [ -x "node_modules/.bin/directive" ]; then
+          UPGRADE_BIN="node_modules/.bin/directive"
+        elif [ -f "node_modules/@deftai/directive/dist/bin.js" ]; then
+          UPGRADE_BIN="node node_modules/@deftai/directive/dist/bin.js"
+        elif command -v directive >/dev/null 2>&1; then
+          UPGRADE_BIN="directive"
+        else
+          echo "release:local-update: cannot resolve directive upgrade binary after frozen install" >&2
+          exit 1
+        fi
+        echo "release:local-update: $UPGRADE_BIN upgrade --target-version $VERSION --yes --root $CHECKOUT"
+        $UPGRADE_BIN upgrade --target-version "$VERSION" --yes --root "$CHECKOUT"
+        if [ -n "$(git status --porcelain)" ]; then
+          echo "release:local-update: tracked-file diff after upgrade; closeout non-zero/incomplete (#5953)" >&2
+          git status --short >&2
+          print_deposit_recovery
+          exit 1
+        fi
+        echo "release:local-update: verify:hooks-installed --project-root --scope=all"
+        DEFT_DOCTOR_HOOK_DIAGNOSTIC=1 node "$RUNTIME_BIN" verify:hooks-installed --project-root "$CHECKOUT" --scope=all
+        INST_PKG2="$(node -e 'const fs=require("fs"); const p=JSON.parse(fs.readFileSync("node_modules/@deftai/directive-runtime/package.json","utf8")); console.log(p.version);')"
+        if [ "$INST_PKG2" != "$VERSION" ]; then
+          echo "release:local-update: post-upgrade runtime $INST_PKG2 != $VERSION" >&2
+          exit 1
+        fi
+        echo "release:local-update COMPLETE; checkout=$CHECKOUT version=$INST_PKG2 hooks=verify:hooks-installed --scope=all green"
+        echo "global npm i -g was NOT run (report-only drift remains Phase 7 step 2)."
+
 
   # ------------------------------------------------------------------
   # Triage v1 user-facing alias tasks (#845, #913).

package/vendor/directive-content/UPGRADING.md

@@ -949,6 +949,7 @@ Every **real** policy write (Phase 2 / Phase 4, and every other `meta/policy-cha
 - **On-disk layout changed.** Old: `.deft-cache/issues/<owner>-<repo>/<N>.{json,md}` (flat sidecar). New: `.deft-cache/<source>/<key>/{raw.json,content.md,meta.json}` (per-entry directory; schema-validated meta envelope). `cache:get` validates `meta.json` against `vbrief/schemas/cache-meta.schema.json` on every read so a corrupt or version-incompatible file fails closed.
 - **Audit log UNCHANGED.** `vbrief/.eval/candidates.jsonl` preserves accept / reject / defer / needs-ac / mark-duplicate / reset records across the migration. The Story 3 Tier-2 short-circuit (terminal-decision skip on bulk-* re-runs) operates on the same file.
 - **All other `triage:*` actions UNCHANGED.** `triage:accept` / `triage:reject` / `triage:defer` / `triage:needs-ac` / `triage:mark-duplicate` / `triage:bulk-accept` / `triage:bulk-reject` / `triage:bulk-defer` / `triage:bulk-needs-ac` / `triage:status` / `triage:reset` / `triage:history` / `triage:refresh-active` keep their v0.25.x surface byte-for-byte (13 aliases). The rebind onto `cache:get` is internal. `triage:bootstrap` keeps its v0.25.x command surface but its on-disk output is the new `.deft-cache/<source>/<key>/` per-entry layout (now delegates to `cache:fetch-all`); see the Commands list above.
+- **Gitcrawl fallback semantics no longer apply.** After this cache rebind, the old `docs/gitcrawl-fallback.md` gh-only install/recovery path is withdrawn. Do not follow that doc for v0.26+ triage/cache; use `cache:*` and this migration section instead (#1092).
 
 ### Rollback
 

package/vendor/directive-content/commands.md

@@ -149,6 +149,7 @@ Common commands:
   - Bare `evidence` / `disposition` keys are **not** valid (#1620 / Option B #3305). They fail `verify:vbrief-conformance` and are treated as missing by `scope:complete` (no dual-read). Migrate bare keys or narrative-only `Result`/`Verification` workarounds to the namespaced fields above while items are still non-terminal.
   - Already-terminal items (`completed`/`failed`/`cancelled`/…) are not re-checked for typed evidence; pre-marking items complete to skip the gate is unsupported for the typed path.
   - `merge`/`review` alone cannot satisfy smoke/UAT/deploy/observed_behavior criteria (title/Acceptance text or explicit axis).
+  - **Delivery identity (#5710):** with an issue origin, the PR must be associated with the issue as of `merged_at` by one of: (a) a unique sole `deft-story: N` mark in the merge-time PR body (PRs that change only briefs and `CHANGELOG.md` are excluded and never count), (b) a closing keyword (`Closes #N`, `owner/repo#N`, or the issue URL) in the merge-time body, or (c) a Connected issue link at `merged_at`. Brief-in-PR-diff still counts. A mark, keyword or link added after merge does not count, and current `closingIssuesReferences` alone is not enough. Basis (a) scans every merged PR within 20 minutes, `graphql.remaining` ≥ 200 and REST core ≥ 100; any gap refuses. With no issue origin, stamp `plan.metadata.productPullRequest` and complete with `--pr <that number> --merge-commit <sha>`; the repository is the `origin` remote. `--non-delivery` refuses when the stamped PR is merged, and refuses when its merge state cannot be read. `xbrief:preflight` prints one note for a code-bearing brief with no issue origin.
 - `task scope:fail -- xbrief/active/<file>.xbrief.json` -- mark running work failed when the scope cannot complete.
 - `task scope:cancel -- <path>` -- move a scope to `cancelled/`.
 - `task scope:restore`, `task scope:block`, `task scope:unblock`, `task scope:demote`, and `task scope:undo:*` -- repair or reverse lifecycle transitions.
@@ -494,13 +495,14 @@ Cross-link: spawn three postures and deny recoveries live under § Agent-host di
 ### Mutable ritual (mutation posture)
 
 - ! On **mutation** session start, run `deft session:start` (or `task session:start` in framework source) after loading AGENTS.md. Records quick-tier ritual in `.deft/ritual-state.json`: alignment confirmation, branch-policy disclosure, `deft verify:tools` guidance, default-branch sync warnings, and `deft triage:welcome` one-liner. State is worktree- and HEAD-bound; stale after `plan.policy.sessionRitualStalenessHours` hours (default 8). Mutation start also claims the worktree occupancy lease (`.deft/occupancy.json`); see Session routing (#3433).
-- ! **Orientation compression Now (#3286):** mutation cold `session:start` composes `doctor` + #3282 toolchain preflight (and deposit-sha fast-paths for `agents:refresh` / `verify:cache-fresh`) as inline sections with per-section status lines — composition of existing steps, not a new monolith. When the deposit fingerprint (payload + templates + engine) is unchanged, refresh surfaces print one-line `unchanged - sha match` no-ops. Opt-in compact output: `deft session:start --compact` or `DEFT_SESSION_COMPACT=1` (verbose remains the default). #2176 read-only default is unchanged. Dual-path Later (orient) stays open until run-summary telemetry shows ritual+gate share ≥ 25% after Now ships (#2899).
+- ! **Quiet-default success stdout (#4966):** mutation `session:start` success human output defaults to one trusted go-signal line with stable prefix `[deft session] ready=…` (ready + branch/HEAD + occupancy). Routine dial/host-surface/effort/orientation/ceremony prose is verbose-only via `deft session:start --verbose` or `DEFT_SESSION_VERBOSE=1`. Non-exhaustive always-on allowlist keeps actionable zero-exit exceptions, non-default policy/bypass and human-merge disclosures, finalize-owed unknown/deferred qualifications, and actionable lifecycle/work-claim notices on the quiet path. Fail/deny/steal/non-zero stay loud. Tip `#3286` `--compact` / `DEFT_SESSION_COMPACT` are deprecated as whole-stdout volume controls (no-op for human stdout selection; `--json` / run-summary unchanged). Exit 0 is not the mutation go-signal — render from structured ready/posture/occupancy state.
+- ! **Orientation compression Now (#3286):** mutation cold `session:start` composes `doctor` + #3282 toolchain preflight (and deposit-sha fast-paths for `agents:refresh` / `verify:cache-fresh`) as inline sections with per-section status lines — composition of existing steps, not a new monolith. When the deposit fingerprint (payload + templates + engine) is unchanged, refresh surfaces print one-line `unchanged - sha match` no-ops. Section formatting may still honor `--compact` / `DEFT_SESSION_COMPACT=1` inside the orientation bundle; whole-stdout volume is `#4966` quiet-default / `--verbose`. #2176 read-only default is unchanged. Dual-path Later (orient) stays open until run-summary telemetry shows ritual+gate share ≥ 25% after Now ships (#2899).
 - ! Cold `session:start` does **not** run the live agent-hook probe. Functional readiness belongs to the gated mutation path so cold ceremony retains the #2990/#2991 latency profile.
 - ! **Hot path latency (#2991):** by default, mutation `session:start` does **not** block ritual-state write on optional network. It skips the npm release-availability probe and triage cache empty-hydrate / self-heal (`ensureTriageCacheHydrated` / `maybeSelfHealCache`). Targets (operator-facing, not CI-hard): warm hot path typically under a few seconds once tools are on PATH; cold path dominated by local `verify:tools` and git, usually well under ~30s when optional network is off. Empty-cache GitHub fetch-all and npm `view` previously accounted for multi-minute hangs in the WWYSYDH pilot — those stay off the critical path unless opted in.
 - ! **Cold vs re-arm ceremony tiers (#2992):** default `session:start` is the **cold** (full) path. After age staleness or compact re-arm (#2113) on the **same worktree** with continuous HEAD and previously-passing quick steps, prefer `deft session:start --rearm` (alias `--tier=rearm`) to refresh the ritual clock + HEAD/worktree bind without `verify:tools`, triage welcome, release probe, or staleness tickler. Full cold remains required for missing/invalid state, worktree change, discontinuous HEAD, first install, or failed/missing quick steps. Compact marks `rearm_needed`; PreToolUse denial and inspect/verify messages prefer re-arm recovery when cold is unnecessary.
 - ? Opt into optional network: `deft session:start --with-network` or `DEFT_SESSION_START_NETWORK=1`. When enabled, the bounded release-availability probe runs against the public npm registry (skips framework source checkouts, non-release pins, and `DEFT_NO_NETWORK=1`; identical latest-version notices throttle for 24 hours in `xbrief/.triage-cache/release-availability-state.json`). Default-mode triage welcome then also hydrates/self-heals the triage cache. This is separate from `deft doctor`, whose bare and gated invocations remain offline by default (#2182). Refs #1692 / #2991. Re-arm never runs optional network.
 - ~ `session:start --json` includes `steps[]` with `name` + `duration_ms` for major phases (`alignment`, `branch_policy`, `verify_tools`, `triage_welcome`, `release_probe`, `ritual_write`), plus total `duration_ms`, `optional_network`, and `ceremony_tier` (`cold` | `rearm`). Skipped optional steps report `skipped: true` and `duration_ms: 0`. Use this for attribution when investigating ceremony wall-clock.
-- ~ **Process-cost events (#2994 / #3508):** on mutation `session:start` completion (cold or re-arm), Directive appends a local `session:start` behavioral event to `.deft-cache/events.jsonl` with `ceremony_tier`, `duration_ms`, `exit_code`, and optional `steps[]` (same labels as `--json`). Mutation `session:start` also prints one operator-visible `ceremony <tier> <ms>` line (hidden under `--compact` / `DEFT_SESSION_COMPACT`). When PreToolUse denies for `ritual-not-ready`, a local `session:ritual-blocked` event records `tool_name`, `code`, and optional `recovery_tier` / `detail`. Always-on best-effort (never blocks ceremony or deny path); not gated on `valueFeedback`; **no remote upload** (Product Insights #2603 is a separate opt-in). Pull the rollup with `task value:show` (composed reader; CLI process time, not agent-turn wall clock). See § Process-cost events below. ⊗ Do not use the printed CLI duration as #3286 Later graduation input.
+- ~ **Process-cost events (#2994 / #3508):** on mutation `session:start` completion (cold or re-arm), Directive appends a local `session:start` behavioral event to `.deft-cache/events.jsonl` with `ceremony_tier`, `duration_ms`, `exit_code`, and optional `steps[]` (same labels as `--json`). Mutation `session:start` also emits one operator-visible `ceremony <tier> <ms>` line on the verbose human path (`--verbose` / `DEFT_SESSION_VERBOSE`; quiet-default hides it per #4966). When PreToolUse denies for `ritual-not-ready`, a local `session:ritual-blocked` event records `tool_name`, `code`, and optional `recovery_tier` / `detail`. Always-on best-effort (never blocks ceremony or deny path); not gated on `valueFeedback`; **no remote upload** (Product Insights #2603 is a separate opt-in). Pull the rollup with `task value:show` (composed reader; CLI process time, not agent-turn wall clock). See § Process-cost events below. ⊗ Do not use the printed CLI duration as #3286 Later graduation input.
 - ~ At safe idle points (clean tree, no in-flight story), mutation session start and `deft scope:complete` may also run the staleness tickler: an interactive, consent-based offer to upgrade Directive (`npm i -g @deftai/directive@latest`) and/or migrate xBRIEF (`deft migrate:xbrief`). Escalation tiers, snooze windows, and opt-out live under `plan.policy.stalenessTickler` — inspect with `deft policy:show --field=stalenessTickler`. State persists in `xbrief/.triage-cache/staleness-tickler-state.json`. Skips framework source checkouts, dirty trees, CI/headless (`DEFT_SESSION_RITUAL_SKIP=1`), and typed opt-out. Refs #2488 / #2489.
 - ! Before any code-writing tool call or `start_agent` implementation dispatch, run `deft verify:session-ritual -- --tier=gated`. Gated tier fails closed unless quick-tier state is fresh; lazily records the non-deferrable `agent_hooks` readiness gate plus `deft doctor` and `task verify:cache-fresh` entrypoints. Agent-hook correctness is independent of doctor warnings and throttling. Step 0 of the pre-`start_agent` gate stack.
 - ! **One-shot recovery (#2993 / #3100 / #4399):** when PreToolUse denies writes for a stale/missing gated ritual, run `deft session:ready` (or `task session:ready`). It composes `session:start` (only when quick-tier is not green) + `verify:session-ritual -- --tier=gated` with check-class `cache_fresh` (age + live drift, no `--skip-drift-probe`) + `cache fetch-all --force` when `cache_fresh` is the remaining blocker, then re-verifies. Skip-drift ritual argv is not the ready bar — that is the `task check` / FRAMEWORK_CHECK_GATES evaluate, so stale-by-drift can still fire fetch-all. Even when gated inspect is already fresh, the fast path forces one live `agent_hooks` check and the same check-class `cache_fresh`; it still avoids unnecessary fetch-all when that evaluate is green. Flags: `--json`, `--repo OWNER/NAME`, `--with-network` (forwarded to session:start). Prefer this over juggling the multi-step recovery sequence under hook pressure.
@@ -550,7 +552,7 @@ Local ceremony cost signal for WWYSYDH / weekly process rollups. Emits to `.deft
 | PreToolUse ritual deny | `session:ritual-blocked` | Hook blocks write/spawn because gated ritual is not ready | `tool_name`, `code=ritual-not-ready`, `recovery_tier` (`cold`\|`rearm`) |
 | Per-step wall-clock | (field on `session:start`) | Same emit as session start | `steps[].name` + `steps[].duration_ms` (`alignment`, `scm_readiness`, `branch_policy`, `verify_tools`, `triage_welcome`, `release_probe`, `ritual_write`) |
 
-CLI mirror (no JSONL required): `deft session:start --json` already exposes the same `steps` / `duration_ms` / `ceremony_tier` fields for one-shot inspection. Human mutation output adds one `ceremony <tier> <ms>` line unless compact hides it (#3508).
+CLI mirror (no JSONL required): `deft session:start --json` already exposes the same `steps` / `duration_ms` / `ceremony_tier` fields for one-shot inspection. Human mutation output adds one `ceremony <tier> <ms>` line on the verbose path (#3508 / #4966).
 
 Composed reader (no new verb): `task value:show` / `deft value:show` prints last cold vs re-arm duration, last per-step breakdown, blocked-ritual count, and recovery-tier distribution from the same ledger. This is **CLI process time**, not agent-turn wall clock (#3500). ⊗ Do not feed the printed CLI duration into #3286 Later graduation.
 

package/vendor/directive-content/contracts/design-critique.md

@@ -65,7 +65,7 @@ Record `arc-mode: no-ingest` or `arc-mode: checkout` on the Stop 1 write-back. `
 - ! Parent-unclaimed is its own MUST: `session:start --read-only`, or an explicit occupancy release if a mutation lease is already held. Dest create does not clear occupancy.
 - ! Recognition of `no-ingest` happens before mutation initialization. Refuse github-only when mutation `session:start` has already occurred, unless the lease is released first.
 - ! Posting path that survives a foreign lease: `gh issue comment --body-file -` (stdin). Least-authority envelope: bounded GitHub reads and one comment post.
-- ! Parent fetches, then creates or verifies one dest at origin/<default> tip (`ensureArcDest`). dispatch-sha equals that tip. Against-implementation dest is the fetched PR head SHA, recorded on Stop 1. ⊗ Pin dest to local HEAD.
+- ! Parent fetches, then creates or verifies one dest at origin/<default> tip via the sanctioned pin-bin verb `deft design-critique:ensure-arc-dest` (library `ensureArcDest`; guarded-prep default, or explicit `process-only-no-install`). When guarded-prep is selected, success requires the outer-visible runtime pin. dispatch-sha equals that tip. Against-implementation dest is the fetched PR head SHA, recorded on Stop 1. ⊗ Pin dest to local HEAD. ⊗ Treat gitignored `packages/core/dist` as SoT for `ensureArcDest` on framework-source.
 - ! N>1 process-only critics share that dest with cwd-without-occupy. They are not swarm Phase 2 and not a #4066 mutating worker. Unique dest-lock stays for implement-class. Skip class is a host-visible Grok stdin marker (`subagent_type` `plan` or `process_only`), not dest-path. That marker is the process-only skip class, not an implementation-gate bypass: implement-class never sets `process_only`. ⊗ Skip #2885 on destProven. Keep #4066 primary-path deny. ⊗ Pin dest / process_only skip-class rules into `templates/agents-entry.md`.
 - ! Pin reads to `git show <dispatch-sha>:` against the recorded SHA. ⊗ A moving branch ref.
 - ! Before panel-deposit on a process-only dest, record a closed `verification-path:` line that either (a) names the read-only pin-read path (`git show <dispatch-sha>:`, dest cwd-without-occupy for on-pin file reads), or (b) records a provisioned runnable path when a specific check requires executing fixtures/tests. Default to (a). Keep N≥3 launch-probe (`evaluateN3LaunchProbe`) as launchability, separate from method-verification. `verificationPathRecordLine` / `evaluateVerificationPathBeforePanelDeposit` are the fixtures. ⊗ Mandate full install-on-dest for every panel.

package/vendor/directive-content/contracts/path-write-fence.md

@@ -195,6 +195,12 @@ OS-temp dests and commands with no recognized dest (`git status`,
   remains **escape** polarity (in-tree dest whose realpath leaves the tree) and is
   not this check. The hook still runs before the shell, so a link created between
   check and write is TOCTOU.
+- **Kill-switch / permanent opt-out plant (#6136):** Shell write reissue checks
+  `.deft-directive-disable` / `.no-deft-directive` basenames **before** the
+  `isInRepoShellWritePath` skip, so an out-of-tree plant cannot fail-open. Agent
+  Write/Edit/Shell of those basenames is always-on deny without a human-origin
+  settings grant (docs: `deft-directive-disable.md`). General protected-target /
+  out-of-tree floor work stays on #6138; deny wording on #6139.
 
 Fail-open at this predicate is the bound posture (#3997). Inverting it to
 fail-closed on dests the parser cannot prove external is that issue's refuted

package/vendor/directive-content/docs/deft-directive-disable.md

@@ -82,11 +82,11 @@ rm .deft-directive-disable
 # Start a NEW agent session
 ```
 
-## Agent self-serve ban under UAT (#3186)
+## Agent self-serve ban (always-on, grant-gated) (#3186 / #6136)
 
-Operators plant and remove this flag **outside** an agent session (or with a prior human-origin grant). Under **active UAT**, PreToolUse classifies Shell writes that create `.deft-directive-disable` (and permanent opt-out `.no-deft-directive`) as **settings** and **denies** them without a human grant — same posture as `authz:grant` (#3110). Agents must not self-serve the kill-switch to bypass Write / push / PR / merge gates.
+Operators plant and remove this flag **outside** an agent session (or with a prior human-origin grant covering **settings**). PreToolUse **always** denies agent Write / Edit / Shell that creates or renames-to `.deft-directive-disable` (and permanent opt-out `.no-deft-directive`) without that grant — not only under active UAT. Shell write reissue checks the protected basename **before** skipping out-of-tree dests, so a plant outside the repo tree cannot fail-open. Agents must not self-serve the kill-switch to bypass Write / push / PR / merge gates.
 
-Related: `policy:allow-bot-merge`, `policy:allow-direct-commits`, and `policy:disable-directive` (peers) are also settings under UAT and require a human grant.
+Related: `policy:allow-bot-merge`, `policy:allow-direct-commits`, and `policy:disable-directive` (peers) are settings under UAT and require a human grant.
 
 ## Non-goals (v1)