@deftai/directive-runtime 0.129.5 → 0.129.7

package/vendor/directive-content/skills/deft-directive-design-critique/SKILL.md

@@ -53,7 +53,7 @@ Yolo first-lean cites: Yolo leftover-pain. Honest pain cites. Not operator next-
 Walk / walk all. Auto-stamp when agents agree: Operator verbs.
 Parent chip write: scm:issue:design-critique-chip. Stale ingest-ready query: scm:issue:design-critique-stale-ready.
 Chip apply miss is non-blocking convenience; do not halt. On missing-repo-label chip miss, follow contract ensure-or-doctor recovery. Ingest waits on the completed-arc record, not a catalog chip.
-Run posture: missing defaults to no-ingest via resolveArcRunPostureForHost; ingest resolves checkout; closed collisions ask. Field lives in the contract.
+Run posture: missing defaults to no-ingest via resolveArcRunPostureForHost; ingest resolves checkout; closed collisions ask. Field lives in the contract. Arc dest: `deft design-critique:ensure-arc-dest` (guarded-prep default; `--install-mode process-only-no-install` for pin-read); fail closed if pin missing after guarded-prep. ⊗ gitignored `packages/core/dist` as SoT for ensureArcDest.
 Spend: closed n= wins for `spend:` (does not invent `spend-recommend:`); else call `deft design-critique:spend-resolve --utterance <text> --recommend` then resolve. Open with `--open-gate` at arc start before any structured ask (session-scoped state); `--clear` when the arc ends; `--unclosable-recommend` for parent-declared unclosable. Bare-arc missing recommend is a parent defect (record then resolve), not ask. Ask only for ambiguous mixes, bare panel, or unclosable recommend. Call spend-resolve before any operator surface. Field lives in the contract. Consume parseOperatorSpend / resolveDesignCritiqueSpend. ⊗ ask_user_question for spend on bare arc before spend-resolve / open-gate.
 Yolo standing: default on; noyolo clears; yolo affirms. Confirm conjunct only. Not ingest.
 Widget apply-set lives in the contract. Consume parseOperatorRunPosture / parseOperatorYoloStanding.

package/vendor/directive-content/skills/deft-directive-release/SKILL.md

@@ -17,7 +17,7 @@ description: >-
 
 # Deft Directive Release
 
-Structured 8-phase workflow for cutting a v0.X.Y release of the deft framework. Operationalizes the `task release` / `task release:publish` / `task release:rollback` / `task release:e2e` / `task release:wait-npm` surface introduced in #716 (safety hardening of #74; Phase 7 wait #4267).
+Structured 8-phase workflow for cutting a v0.X.Y release of the deft framework. Operationalizes the `task release` / `task release:publish` / `task release:rollback` / `task release:e2e` / `task release:wait-npm` / `task release:local-update` surface introduced in #716 (safety hardening of #74; Phase 7 wait #4267; maintainer checkout closeout #5953).
 
 Legend (from RFC2119): !=MUST, ~=SHOULD, ≉=SHOULD NOT, ⊗=MUST NOT, ?=MAY.
 
@@ -373,6 +373,10 @@ Race-condition mitigation: `download_count` is double-read with a 5s sleep betwe
 
 ! Only enter Phase 7 if Phase 6 took the Publish branch (rollback branch ends here with the unwind log).
 
+! **Stable cut: decide npm latest explicitly (#5852).** A stable `X.Y.Z` publishes to the `maintainer` dist-tag and a prerelease to its id (`beta`, `rc`, ...); the publish never moves `latest` and the GitHub release is not marked Latest. For a stable cut, ask the operator: **promote now** or **record an explicit decline**. Promote is the separate `release-promote-latest` closed verb (mint `deft authz:grant -- --template release-promote-latest --target <version> --confirm` or set `DEFT_ALLOW_RELEASE_PROMOTE_LATEST=1`; a release-publish grant does not cover it). Run the gated command `deft release-publish --promote-latest <version>` (optional `--dry-run`); it evaluates the closed-verb gate and only then dispatches `gh workflow run npm-publish.yml --ref master -f action=promote-latest -f tag=v<version>`. That job (environment `npm`, concurrency `npm-promote-latest`) preflights both packages then moves `latest` for both and marks the GitHub release Latest. A decline is recorded in the release notes or record as "latest stays at <prior version>". Non-latest announcements give `npm i -g @deftai/directive@<dist-tag>`, not `@latest`.
+
+! Do not move `latest` with a bare shell `npm dist-tag add` or a bare `gh workflow run` for promote; use `deft release-publish --promote-latest`.
+
 1. ! **Wait until both public packages list the cut version (#4267, #1910, #3753).** Run `task release:wait-npm -- <version>`. That caller polls `npm view <pkg> versions` (prefer-online, doctor temp-cwd isolation) until both `@deftai/directive` and `@deftai/directive-runtime` list `<version>`, or 10 minutes. Partial visibility is **still-propagating** (wait before `npm i -g`); none visible after the wait is **publish-incomplete**. Report-only: must not fail the GitHub release. Confirm provenance on the npm page after the wait. ⊗ Treat a green `npm-publish.yml` job plus one visible sibling as registry truth. ⊗ Run `npm i -g`. `task release` Step 13 stays a single probe (timeout 0).
 2. ! **Report local-vs-released CLI drift (#3753).** `task release:wait-npm` already prints the local global CLI version, the released version, whether they match, and the exact remediation `npm i -g @deftai/directive@<version> --prefer-online`. Compare versions with `checkActiveCliAgainstTarget` (not bare `deft --version`) so a PATH-shadowed install cannot report success (#3233). The report must not fail the release.
 3. ! Verify GitHub auto-closed the discrete-task issue(s) referenced via `Closes #N` in the release notes (mirrors `skills/deft-directive-swarm/SKILL.md` Phase 6 Step 2)
@@ -381,6 +385,27 @@ Race-condition mitigation: `download_count` is double-read with a 5s sleep betwe
 6. ! Verify binaries are downloadable from the public release URL: `gh release view v<version> --json assets --jq '.assets[].url'` and curl one to confirm 200 OK
 7. ! For any umbrella / staying-OPEN issue (`Refs #N`) referenced in the release notes, run the Layer 3 reopen sweep from `skills/deft-directive-swarm/SKILL.md` Phase 6 Step 1: any protected issue that auto-closed MUST be reopened with a comment citing #701
 
+
+
+8. ! **Update the maintainer's local checkout (#5953 Prefer-A Bound 6430511888).** Required for every release; **required especially for maintainer (non-`latest`) cuts** where npm `latest` will not advance the checkout by accident. Anchor on the **tip-pin-equals-released** observable (tip `package.json` / lockfile pin equals released `<version>`), not a phantom pin-PR step.
+
+```
+task release:local-update -- <version> --checkout <maintainer-primary-occupancy-root>
+```
+
+The task fails closed and never resets, force-pushes, commits, or runs `npm i -g`:
+1. Require `--checkout <path>` naming the maintainer primary occupancy root; refuse ambient release-worktree-only success (running only in the release worktree without naming the primary).
+2. Refuse when the target checkout holds a live foreign occupancy lease before any write.
+3. On the checkout default branch: dirty-tree refuse; `git pull --ff-only` (never reset).
+4. When `pnpm-workspace.yaml` carries `minimumReleaseAgeExclude`, assert it already includes `@deftai/directive-runtime@<version>`; then `pnpm install --frozen-lockfile`.
+5. Assert tip-pin-equals-released: installed `node_modules/@deftai/directive-runtime` version equals `<version>` and matches the `package.json` pin.
+6. Require the version-matched agent-hook deposit already merged on tip (inspect against the post-install payload via the checkout runtime). Keep Phase 7 local closeout **incomplete** until that deposit evidence exists; print deposit-merge recovery paths.
+7. Re-resolve the upgrade binary from the checkout post-install tree and run `directive upgrade --target-version <version> --yes` (never registry-latest). `release:local-update` is inline Taskfile `cmds:` without `engine:invoke` or `deps: [ts:build]`.
+8. After upgrade, any tracked-file diff keeps closeout non-zero/incomplete with deposit-merge recovery paths for expected managed deposit files (`.grok/hooks/`, `.cursor/hooks.json`, `.claude/settings.json`, `.codex/` managed paths, and related deposit files).
+9. Run `deft verify:hooks-installed --project-root <checkout> --scope=all` from the checkout post-install runtime (⊗ bare `task verify:hooks-installed`) and re-assert installed runtime equals `<version>`.
+
+Report the local-update result (version now installed, hooks status) beside the existing global CLI drift report in Skill Completion.
+
 ⊗ Skip the post-publish verification. The closing-keyword false-positive (Layer 1 / Layer 2 / Layer 3) and the incremental-renderer-drift (#641, #614) are exactly the kind of issues that surface only AFTER a release is public.
 
 ## Phase 8 — Slack announcement
@@ -421,10 +446,15 @@ Where `<one-line guidance>` is one of:
 - "release v<version> rolled back -- the underlying defect needs a hot-fix in the next CHANGELOG entry"
 - "release deferred -- resume by running `task release:publish -- <version>` (GitHub only; npm already shipped at tag push) or `task release:rollback -- <version>` (GitHub unwind only; npm is forward-recovery) when ready"
 
+! On the Publish/live path, Skill Completion MUST also print the Phase 7 local-update result beside the global CLI drift report: checkout path, installed runtime version, hooks status (`verify:hooks-installed --scope=all`), and whether closeout is complete or incomplete (deposit-merge recovery). ⊗ Claim Phase 7 local closeout complete while `release:local-update` exited non-zero or was skipped on a maintainer non-latest cut (#5953).
+
 ⊗ Exit silently without confirming completion or providing next-step guidance.
 
 ## Anti-Patterns
 
+- ⊗ End the release with the maintainer's checkout still on the previous pin (#5953) — run `task release:local-update -- <version> --checkout <primary>` after tip-pin-equals-released
+- ⊗ Run `release:local-update` without `--checkout` naming the maintainer primary occupancy root, or claim success from the release worktree alone while primary stays stale (#5953)
+- ⊗ Soft/warn-only checkout lag; non-fatal green on post-upgrade tracked diffs; auto-commit of upgrade deposit inside release; `directive upgrade` without `--target-version` (registry latest); bare `task verify:hooks-installed` without `--project-root` / `--scope=all`; local-update via pin-exclusive `engine:invoke` on the N-1 runtime (#5953 Prefer-A Bound 6430511888)
 - ⊗ Foreground-block the operator chat on Phase 1 long prep (`reconcile:issues`, cache refresh) or Phase 3 `release:e2e` when background / subagent dispatch is available (#1880 Gap D / #2692) — the interactive channel must stay free for version confirmation, `--summary`, and the Phase 2 dry-run gate
 - ⊗ Proceed to `task release` on orientation-dirty `cache_fresh` or check-class stale-by-drift, or treat skip-drift ritual green / ritual-stale as that bar (#4399) — fetch-all first
 

package/vendor/directive-content/skills/deft-directive-review-cycle/SKILL.md

@@ -536,13 +536,21 @@ REDISPATCH_OK: yes|no
 ⊗ Treat `ci_never_scheduled` as ordinary Greptile latency (`sha_match` / `terminal_check_run` only).
 ⊗ Silent `--skip-ci` / admin merge without the outage playbook audit trail below.
 
-### SLizard advisory-only for merge-ready wait (#3167)
+### SLizard advisory-only for merge-ready wait (#3167) — weather vs residual (#5102 / #4387)
 
-! Required bot for **merge-ready wait** / Step 6 exit ownership is **Greptile**. SLizard (Gemini Verify) is **advisory only**: timeouts, retries, missing check, or flaky SLizard conclusions MUST NOT gate the review-cycle wait loop or authorize unbounded re-push.
+! SLizard is advisory only for the Greptile merge-ready confidence floor; parseable blocking tip fingerprints are unfinished residual (#5102 / #3167).
 
-! `task pr:merge-ready` may still surface SLizard structure when present (#2189); agents MUST NOT idle-poll or thrash solely for SLizard when Greptile Step 6 is clean. Prefer continue / BLOCKED on CI weather / human decision.
+! Required bot for **merge-ready wait** / Step 6 exit ownership is **Greptile**. SLizard is **advisory only** for weather (timeout / cancelled / unparseable / zero-finding / missing-check): those MUST NOT gate the review-cycle wait loop (#3167). Parseable blocking tip fingerprints are unfinished residual (#5102).
 
-⊗ Block merge-ready babysit on SLizard alone when Greptile Step 6 all-of is satisfied on HEAD.
+! When `pr:merge-ready` / wait-mergeable reports **SLizard blocked** (parseable `request_changes` or `merge_impact=blocking` with non-zero findings) — especially Greptile CLEAN + SLizard blocked — before re-arming merge-ready wait or `pr:wait-mergeable-and-merge` the owner MUST read the tip SLizard **review body** in full, enumerate new and Previously mentioned fingerprints / deterministic tool names, and for each open P0/P1 falsify with `git show <head>:<path>` (slizard#2694) or fix in one residual batch. Do not idle-poll. Keep `pr:watch` Greptile ownership unchanged (#5102 / #2189 / #4387).
+
+! Compose existing head-blob check, same-fingerprint stop (#3448), and `--skip-slizard` override. Do not invent a third poller. `--skip-slizard` is explicit override only — not the default babysit escape.
+
+! Parseable blocking findings with open tip fingerprints are **unfinished residual**, not weather. Cross-link: `packages/core/src/pr-merge-readiness/slizard-gate.ts` (`evaluateSlizardGate`).
+
+⊗ Re-arm wait-mergeable / idle-poll while SLizard still has parseable blocking findings with open tip fingerprints (#5102).
+⊗ Treat parseable blocking SLizard findings as #3167 weather when Greptile Step 6 is clean (#5102 / #4387).
+⊗ Default to `--skip-slizard` to clear a merge-ready SLizard block (#5102).
 
 ### Outage admin-merge playbook (opt-in / human, #3167)
 
@@ -725,7 +733,7 @@ Cross-links: swarm decision tree `skills/deft-directive-swarm/references/core-ph
 
 ! When the platform descriptor indicates Tier 1 (sub-agent support) **and this agent owns the primitive as parent/orchestrator**, spawn a review-monitor sub-agent using the primitive matching the descriptor. ⊗ A grok-build / grok-bot / Cursor / Claude Code implementation leaf MUST NOT run these spawn steps.
 
-1. ! Launch via the matching primitive: `start_agent` (Warp), `spawn_subagent` (grok-build / TUI / non-Warp **parent**), the Cursor `Task` tool with `run_in_background: true` (`cursor-composer` / `cursor-cloud-agent`, #1877), the Claude Code `Agent` tool with `run_in_background: true` (`claude-code` / register `claude-agent`, #3134), OpenClaw `sessions_spawn` (`openclaw`, #2876), **or Grok Bot Task/executor/CloudAgent (`grok-bot` / register `grok-bot-executor`, #4201)** with a prompt that instructs it to poll for Greptile completion. For `spawn_subagent`, Cursor `Task`, Claude Code `Agent`, OpenClaw `sessions_spawn`, and Grok Bot executor the prompt MUST reference the canonical poller template `templates/swarm-greptile-poller-prompt.md` (with placeholders filled) plus the agent preamble; the working directory / context must be the PR branch (worktree or equivalent for hybrid).
+1. ! Launch via the matching primitive: `start_agent` (Warp), `spawn_subagent` (grok-build / TUI / non-Warp **parent**), the Cursor `Task` tool with `run_in_background: true` (`cursor-composer` / `cursor-cloud-agent`, #1877), the Claude Code `Agent` tool with `run_in_background: true` (`claude-code` / register `claude-agent`, #3134), OpenClaw `sessions_spawn` (`openclaw`, #2876), **or Grok Bot Task/executor/CloudAgent (`grok-bot` / register `grok-bot-executor`, #4201)** with a prompt that instructs it to poll for Greptile completion. For `spawn_subagent`, Cursor `Task`, Claude Code `Agent`, OpenClaw `sessions_spawn`, and Grok Bot executor the prompt MUST reference the canonical poller template `templates/swarm-greptile-poller-prompt.md` (with placeholders filled) plus the agent preamble; the working directory / context must be the PR branch (worktree or equivalent for hybrid). **Grok Approach 1 watch/report (#4781):** before `review-monitor:register` / child `pr:watch`, spawn with advertised `process_only: true` + dest `cwd` for `stop-at: pr-open` + `worker_role: review-monitor` seats only (`formatApproach1ProcessOnlySpawnShape` / `approach1BabysitterCommands`). Implement-class never sets `process_only`; dest-path is not the skip class; do not blanket-flag the fix-capable greptile poller.
 2. ! The sub-agent polls using the mechanism for its primitive: for `spawn_subagent` the **child** owns `pr:watch` / gh poll in its own process (adaptive cadence: ~20-30s first check after push, ~60s second, ~90s thereafter; Greptile typically lands in 3-7 min) — the user-facing parent MUST NOT enter `get_command_or_subagent_output`; a named durable-owner session MAY pull-wait (`host-grok-build.md` Gap D); for `start_agent` the native messaging path; for the Cursor `Task` tool the backgrounded-task completion-notification path; for Claude Code `Agent` the backgrounded-agent completion-notification path; for OpenClaw `sessions_spawn` the host session completion / messaging channel (prefer `task pr:watch` inside the child when available). Front-load the first check to catch fast reviews.
 3. ! When the exit condition is met (Greptile review current on the HEAD commit SHA, confidence meets resolved min (policy/dogfood/default; see Step 6 #3095), no P0/P1 remaining), the sub-agent reports completion back to the parent (via `send_message_to_agent`, the spawn_subagent result channel, or the OpenClaw sessions completion channel).
 4. ! The main conversation pane stays fully interactive during monitoring -- the user (or parent monitor) can continue other work. On Grok Build this is conditional until a measured completion-notify exists: it holds when the parent returns the turn after background spawn, not when the parent pull-waits (`host-grok-build.md` Gap D / #4796).
@@ -1029,7 +1037,8 @@ task lifecycle:event -- emit plan:approved \
 - ⊗ Workflow thrash or empty-commit spam during attributed platform outage without status-page probe (#3180)
 - ⊗ Tight forge-outage retry / empty-commit thrash without a one-shot human report (#3422)
 - ⊗ Merge or `--skip-ci` solely because a status page is red without check-run evidence (#3180)
-- ⊗ Block merge-ready wait on SLizard alone when Greptile Step 6 is clean (#3167)
+- ⊗ Re-arm wait-mergeable or treat parseable blocking SLizard tip fingerprints as #3167 weather when Greptile Step 6 is clean (#5102 / #3167)
+- ⊗ Idle-poll / skip reading tip SLizard review body while open Previously mentioned fingerprints remain (#5102)
 - ⊗ Silent admin / `--skip-ci` merge under Actions outage without audit comment and opt-in authority (#3167)
 - ⊗ Leave a deliberate `stop-at: pr-open` (or thin-DONE recovery) open PR without spawning/retaining one review-cycle babysit owner + lease continuity and post-merge `scope:complete` plan (#3153)
 - ⊗ Stand down at CLEAN under human-merge policy without a durable owner (sticky lease + live parent/monitor/Phase 6 closer) **and** a post-CLEAN observe path (poller / parent wake / Phase 6 re-poll) for post-merge `scope:complete` (#3153 / #1193 / #2321)

package/vendor/directive-content/skills/deft-directive-swarm/references/host-grok-build.md

@@ -92,14 +92,15 @@ Until a measured callback exists, Grok wording is conditional: background `spawn
 
 ! **Grok through-merge (#4529 / #4821 / #5219):** implement MUST use (b) `stop-at: pr-open`. Path (a) is for non-through-merge Grok leaves only. Named leftover (class A) requires a dest-cwd one-shot residual, stop-at after the push; then Approach 1 wait owner is a **`spawn_subagent` review-monitor sibling** whose `monitor_agent_id` is registered (`review-monitor:register --platform-primitive spawn_subagent`) and whose child-bound `pr:watch --monitor-agent-id <id>` satisfies `verify:review-monitor --merge-path-arm --live-wait`; then Phase 6 / parent-retained squash-merges via `pr:wait-mergeable-and-merge` only after CLEAN. Pass a declared wait budget when the envelope states one (#3984). Parent-retained is the **closer after CLEAN**, not the pre-CLEAN poller/fixer. Dest spawn deny is `BLOCKED` or dest-cwd residual via native implementation-capable spawn (#4215) — not parent-primary. ⊗ Send class-A residual through process-only CLI `grok --cwd`. ⊗ Choose Approach 1 sibling or parent-retained as the first partner without dest residual. ⊗ Dispatch a Grok through-merge implement as (a). ⊗ Harvest a Grok `drive-to: merge-ready` continuation as this closer. ⊗ Treat a parent-owned shell/`bash` `pr:watch` (heartbeat `parent_id=pr-watch`) as Approach 1 babysit when `spawn_subagent` is available (#5219).
 
-! **Exclusive lawful waits / cheapest admitted Approach 1 (#5219 P3 / #5229 / #5727):** after `pr-open`, when Tier-1 `spawn_subagent` is available, the **only lawful** pre-CLEAN wait is Approach 1 child `pr:watch --monitor-agent-id` after `review-monitor:register --platform-primitive spawn_subagent` with `verify:review-monitor --merge-path-arm --live-wait` green; after CLEAN, parent-retained `pr:wait-mergeable-and-merge`. Approach 1 is also the **cheapest admitted** path vs parent shell `pr:watch`, host `monitor`, forge-poll, or bespoke `%TEMP%` pollers. Prefer one background `spawn_subagent` babysitter that owns watch → class A residual handoff → re-watch until CLEAN, then hand CLEAN to the parent closer. Child register + watch first (heartbeat live); parent verify after:
+! **Exclusive lawful waits / cheapest admitted Approach 1 (#5219 P3 / #5229 / #5727 / #4781):** after `pr-open`, when Tier-1 `spawn_subagent` is available, the **only lawful** pre-CLEAN wait is Approach 1 child `pr:watch --monitor-agent-id` after `review-monitor:register --platform-primitive spawn_subagent` with `verify:review-monitor --merge-path-arm --live-wait` green; after CLEAN, parent-retained `pr:wait-mergeable-and-merge`. Approach 1 is also the **cheapest admitted** path vs parent shell `pr:watch`, host `monitor`, forge-poll, or bespoke `%TEMP%` pollers. Prefer one background `spawn_subagent` babysitter that owns watch → class A residual handoff → re-watch until CLEAN, then hand CLEAN to the parent closer. **Spawn shape before register/pr:watch (#4781):** for monitor-only seats (`stop-at: pr-open` + `worker_role: review-monitor` watch/report), pass advertised `process_only: true` with dest `cwd` (`formatApproach1ProcessOnlySpawnShape` / `approach1BabysitterCommands`). Implement-class never sets `process_only`; dest-path is not the skip class; do not blanket-flag the fix-capable greptile poller. Dest convention by write need: shared cwd-without-occupy for non-writing monitor/critic seats; one dest per validation seat that writes a report root. Specs/report writes stay on requirements posture (#4444) — do not fold report roots into the spawn skip class. Child register + watch first (heartbeat live); parent verify after:
 ```
+# process_only+cwd spawn (monitor-only), then:
 task review-monitor:register -- --pr <N> --monitor-agent-id <id> --platform-primitive spawn_subagent
 DEFT_MONITOR_AGENT_ID=<id> task pr:watch -- <N> --monitor-agent-id <id>
 # parent after child watch is live:
 task verify:review-monitor -- --pr <N> --merge-path-arm --live-wait
 ```
-Core helper: `formatApproach1BabysitterOneLiner` / `formatApproach1CheapestAdmissionCard` / `admitClaimedBabysitPath` (`packages/core/src/swarm/approach1-babysitter.ts`). Bounded-form deny: `evaluateBoundedPrWatchDeny` refuses Directive `pr:watch` / `task deft:pr:watch` without `--monitor-agent-id` when Tier 1 is provable. Claimed-wait deny: `evaluateClaimedBabysitPathDeny` / `admitClaimedBabysitPath` refuse `BabysitPathKind` forge-poll / bespoke-temp-poller / host-monitor / directive-pr-watch-bare and Approach 1 without bound evidence / different-PR arm. ⊗ Parent forge-poll / `gh` check-runs+mergeable_state sleep / bespoke `%TEMP%` PowerShell watchers as pre-CLEAN babysit (#5727). ⊗ Parent-shell `pr:watch --monitor-agent-id <leased id>` without spawn-injected `DEFT_MONITOR_AGENT_ID` (or CLI matching `GROK_SESSION_ID`) — that impersonation does not arm. ⊗ Start `pr:wait-mergeable-and-merge` before CLEAN (#4822). ⊗ Treat host `monitor` or bare shell `pr:watch` as the sole babysit when `spawn_subagent` is available (#5229).
+Core helper: `formatApproach1BabysitterOneLiner` / `formatApproach1CheapestAdmissionCard` / `formatApproach1ProcessOnlySpawnShape` / `admitClaimedBabysitPath` (`packages/core/src/swarm/approach1-babysitter.ts`). Bounded-form deny: `evaluateBoundedPrWatchDeny` refuses Directive `pr:watch` / `task deft:pr:watch` without `--monitor-agent-id` when Tier 1 is provable. Claimed-wait deny: `evaluateClaimedBabysitPathDeny` / `admitClaimedBabysitPath` refuse `BabysitPathKind` forge-poll / bespoke-temp-poller / host-monitor / directive-pr-watch-bare and Approach 1 without bound evidence / different-PR arm. ⊗ Parent forge-poll / `gh` check-runs+mergeable_state sleep / bespoke `%TEMP%` PowerShell watchers as pre-CLEAN babysit (#5727). ⊗ Parent-shell `pr:watch --monitor-agent-id <leased id>` without spawn-injected `DEFT_MONITOR_AGENT_ID` (or CLI matching `GROK_SESSION_ID`) — that impersonation does not arm. ⊗ Start `pr:wait-mergeable-and-merge` before CLEAN (#4822). ⊗ Treat host `monitor` or bare shell `pr:watch` as the sole babysit when `spawn_subagent` is available (#5229).
 
 ! **Durable host→CLI capability stamp (#5229):** Before any CLI `verify:review-monitor` / `pr:watch` subprocess, write `.deft-scratch/host-capability-stamp.json` via `writeHostCapabilityStamp(projectRoot)` / `ensureHostCapabilityStampForBabysit` (and prefer exporting `GROK_BUILD=1` / `DEFT_HAS_SPAWN_SUBAGENT=1` into that subprocess). `review-monitor:register` also writes the stamp on successful claim/renew. Stamps older than 8h or bound to a different `host_session_id` are ignored so a later plain-terminal session cannot inherit Tier 1. Without a fresh stamp, bare `node … verify:review-monitor` can mis-detect Tier 3 / `generic-terminal` and fail-open with "no active review-monitor required" even though this parent owns `spawn_subagent`. `probeMonitoringTier` merges the stamp; `DEFT_MONITOR_TIER=3` is labeled `override-tier3` (not honest `generic-terminal`) and refused when stamp/env already proves Tier 1. `evaluateReviewMonitorGate` consults sticky lease `platform_primitive` before Approach 3 READY and before `!isTier1` READY. Bounded `pr:watch` without `--monitor-agent-id` is refused at the watch entry when Tier 1 is provable.