@deftai/directive-runtime 0.129.6 → 0.129.8

package/scm/github.md

@@ -722,6 +722,11 @@ Up-to-date-required branch protection plus a required `Merge gate (task check)`
 
 ⊗ Mutate GitHub `mergeable_state` to encode semantic/policy readiness — forge enrollment + local probe are the dispositioned alternatives (#4888 Prefer-A Bound Reject E).
 
+### Lifecycle PRs: CHANGELOG and spec-drift ledger (#680)
+
+- `verify:changelog-unreleased` skips the new-entry compare when the change set versus merge-base (`git diff --name-only --no-renames`) is non-empty and every path is a lifecycle brief (`xbrief|vbrief/<lifecycle>/`), `CHANGELOG.md`, or `xbrief/.audit/spec-drift-ledger.json`. Activation and completion PRs need no operator CHANGELOG line. Product changes and an empty change set keep the requirement.
+- `scope:complete` writes the spec-drift ledger; `swarm:finalize-cohort` commits it with the completed briefs. Membership admits exactly that ledger path only when the whole change set is a completion move. The verbs own these writes, so agents do not hand-write CHANGELOG or ledger lines on a lifecycle PR.
+
 ### Before flipping (operator)
 
 1. Confirm the required context name is exactly `Merge gate (task check)` (the aggregator). Do not require primary or failover lane names.

package/skills/deft-directive-review-cycle/SKILL.md

@@ -536,13 +536,21 @@ REDISPATCH_OK: yes|no
 ⊗ Treat `ci_never_scheduled` as ordinary Greptile latency (`sha_match` / `terminal_check_run` only).
 ⊗ Silent `--skip-ci` / admin merge without the outage playbook audit trail below.
 
-### SLizard advisory-only for merge-ready wait (#3167)
+### SLizard advisory-only for merge-ready wait (#3167) — weather vs residual (#5102 / #4387)
 
-! Required bot for **merge-ready wait** / Step 6 exit ownership is **Greptile**. SLizard (Gemini Verify) is **advisory only**: timeouts, retries, missing check, or flaky SLizard conclusions MUST NOT gate the review-cycle wait loop or authorize unbounded re-push.
+! SLizard is advisory only for the Greptile merge-ready confidence floor; parseable blocking tip fingerprints are unfinished residual (#5102 / #3167).
 
-! `task pr:merge-ready` may still surface SLizard structure when present (#2189); agents MUST NOT idle-poll or thrash solely for SLizard when Greptile Step 6 is clean. Prefer continue / BLOCKED on CI weather / human decision.
+! Required bot for **merge-ready wait** / Step 6 exit ownership is **Greptile**. SLizard is **advisory only** for weather (timeout / cancelled / unparseable / zero-finding / missing-check): those MUST NOT gate the review-cycle wait loop (#3167). Parseable blocking tip fingerprints are unfinished residual (#5102).
 
-⊗ Block merge-ready babysit on SLizard alone when Greptile Step 6 all-of is satisfied on HEAD.
+! When `pr:merge-ready` / wait-mergeable reports **SLizard blocked** (parseable `request_changes` or `merge_impact=blocking` with non-zero findings) — especially Greptile CLEAN + SLizard blocked — before re-arming merge-ready wait or `pr:wait-mergeable-and-merge` the owner MUST read the tip SLizard **review body** in full, enumerate new and Previously mentioned fingerprints / deterministic tool names, and for each open P0/P1 falsify with `git show <head>:<path>` (slizard#2694) or fix in one residual batch. Do not idle-poll. Keep `pr:watch` Greptile ownership unchanged (#5102 / #2189 / #4387).
+
+! Compose existing head-blob check, same-fingerprint stop (#3448), and `--skip-slizard` override. Do not invent a third poller. `--skip-slizard` is explicit override only — not the default babysit escape.
+
+! Parseable blocking findings with open tip fingerprints are **unfinished residual**, not weather. Cross-link: `packages/core/src/pr-merge-readiness/slizard-gate.ts` (`evaluateSlizardGate`).
+
+⊗ Re-arm wait-mergeable / idle-poll while SLizard still has parseable blocking findings with open tip fingerprints (#5102).
+⊗ Treat parseable blocking SLizard findings as #3167 weather when Greptile Step 6 is clean (#5102 / #4387).
+⊗ Default to `--skip-slizard` to clear a merge-ready SLizard block (#5102).
 
 ### Outage admin-merge playbook (opt-in / human, #3167)
 
@@ -725,7 +733,7 @@ Cross-links: swarm decision tree `skills/deft-directive-swarm/references/core-ph
 
 ! When the platform descriptor indicates Tier 1 (sub-agent support) **and this agent owns the primitive as parent/orchestrator**, spawn a review-monitor sub-agent using the primitive matching the descriptor. ⊗ A grok-build / grok-bot / Cursor / Claude Code implementation leaf MUST NOT run these spawn steps.
 
-1. ! Launch via the matching primitive: `start_agent` (Warp), `spawn_subagent` (grok-build / TUI / non-Warp **parent**), the Cursor `Task` tool with `run_in_background: true` (`cursor-composer` / `cursor-cloud-agent`, #1877), the Claude Code `Agent` tool with `run_in_background: true` (`claude-code` / register `claude-agent`, #3134), OpenClaw `sessions_spawn` (`openclaw`, #2876), **or Grok Bot Task/executor/CloudAgent (`grok-bot` / register `grok-bot-executor`, #4201)** with a prompt that instructs it to poll for Greptile completion. For `spawn_subagent`, Cursor `Task`, Claude Code `Agent`, OpenClaw `sessions_spawn`, and Grok Bot executor the prompt MUST reference the canonical poller template `templates/swarm-greptile-poller-prompt.md` (with placeholders filled) plus the agent preamble; the working directory / context must be the PR branch (worktree or equivalent for hybrid).
+1. ! Launch via the matching primitive: `start_agent` (Warp), `spawn_subagent` (grok-build / TUI / non-Warp **parent**), the Cursor `Task` tool with `run_in_background: true` (`cursor-composer` / `cursor-cloud-agent`, #1877), the Claude Code `Agent` tool with `run_in_background: true` (`claude-code` / register `claude-agent`, #3134), OpenClaw `sessions_spawn` (`openclaw`, #2876), **or Grok Bot Task/executor/CloudAgent (`grok-bot` / register `grok-bot-executor`, #4201)** with a prompt that instructs it to poll for Greptile completion. For `spawn_subagent`, Cursor `Task`, Claude Code `Agent`, OpenClaw `sessions_spawn`, and Grok Bot executor the prompt MUST reference the canonical poller template `templates/swarm-greptile-poller-prompt.md` (with placeholders filled) plus the agent preamble; the working directory / context must be the PR branch (worktree or equivalent for hybrid). **Grok Approach 1 watch/report (#4781):** before `review-monitor:register` / child `pr:watch`, spawn with advertised `process_only: true` + dest `cwd` for `stop-at: pr-open` + `worker_role: review-monitor` seats only (`formatApproach1ProcessOnlySpawnShape` / `approach1BabysitterCommands`). Implement-class never sets `process_only`; dest-path is not the skip class; do not blanket-flag the fix-capable greptile poller.
 2. ! The sub-agent polls using the mechanism for its primitive: for `spawn_subagent` the **child** owns `pr:watch` / gh poll in its own process (adaptive cadence: ~20-30s first check after push, ~60s second, ~90s thereafter; Greptile typically lands in 3-7 min) — the user-facing parent MUST NOT enter `get_command_or_subagent_output`; a named durable-owner session MAY pull-wait (`host-grok-build.md` Gap D); for `start_agent` the native messaging path; for the Cursor `Task` tool the backgrounded-task completion-notification path; for Claude Code `Agent` the backgrounded-agent completion-notification path; for OpenClaw `sessions_spawn` the host session completion / messaging channel (prefer `task pr:watch` inside the child when available). Front-load the first check to catch fast reviews.
 3. ! When the exit condition is met (Greptile review current on the HEAD commit SHA, confidence meets resolved min (policy/dogfood/default; see Step 6 #3095), no P0/P1 remaining), the sub-agent reports completion back to the parent (via `send_message_to_agent`, the spawn_subagent result channel, or the OpenClaw sessions completion channel).
 4. ! The main conversation pane stays fully interactive during monitoring -- the user (or parent monitor) can continue other work. On Grok Build this is conditional until a measured completion-notify exists: it holds when the parent returns the turn after background spawn, not when the parent pull-waits (`host-grok-build.md` Gap D / #4796).
@@ -1029,7 +1037,8 @@ task lifecycle:event -- emit plan:approved \
 - ⊗ Workflow thrash or empty-commit spam during attributed platform outage without status-page probe (#3180)
 - ⊗ Tight forge-outage retry / empty-commit thrash without a one-shot human report (#3422)
 - ⊗ Merge or `--skip-ci` solely because a status page is red without check-run evidence (#3180)
-- ⊗ Block merge-ready wait on SLizard alone when Greptile Step 6 is clean (#3167)
+- ⊗ Re-arm wait-mergeable or treat parseable blocking SLizard tip fingerprints as #3167 weather when Greptile Step 6 is clean (#5102 / #3167)
+- ⊗ Idle-poll / skip reading tip SLizard review body while open Previously mentioned fingerprints remain (#5102)
 - ⊗ Silent admin / `--skip-ci` merge under Actions outage without audit comment and opt-in authority (#3167)
 - ⊗ Leave a deliberate `stop-at: pr-open` (or thin-DONE recovery) open PR without spawning/retaining one review-cycle babysit owner + lease continuity and post-merge `scope:complete` plan (#3153)
 - ⊗ Stand down at CLEAN under human-merge policy without a durable owner (sticky lease + live parent/monitor/Phase 6 closer) **and** a post-CLEAN observe path (poller / parent wake / Phase 6 re-poll) for post-merge `scope:complete` (#3153 / #1193 / #2321)

package/skills/deft-directive-swarm/references/host-claude-code.md

@@ -46,7 +46,17 @@ Probe order (must match engine `probeMonitoringTier` / `resolveDispatchProvider`
 
 1. The canonical `templates/agent-prompt-preamble.md` content as the preamble (AGENTS.md read mandate, #810 xBRIEF gate, #798 PowerShell UTF-8, pre-PR + review-cycle mandates).
 2. The standard worktree prompt (STEP 1-6 from the Prompt Template in `references/core-ops.md`).
-3. The worktree path set to the agent's isolated git worktree.
+3. ! **Per-worktree story binding (#6233).** Claude Code sub-agents share the parent's hook environment, so a per-worker `DEFT_ACTIVE_SCOPE` pin is not possible. Use this in-session sequence:
+   1. The parent launches the cohort through `deft swarm:launch`, so dispatch PREP registers each worker worktree with its story in the worker-auth assignment record.
+   2. The parent starts the session ritual in each worker worktree (`deft session:start`, then `deft verify:session-ritual -- --tier=gated`).
+   3. The parent holds no `DEFT_ACTIVE_SCOPE` pin. A pin that names a different story than the worktree's assignment is refused.
+   4. The parent gives each sub-agent the absolute path of its worktree, and the sub-agent writes only inside it.
+
+   The write fence then reads the story for a registered linked worktree from its assignment record. A reader failure, or an assigned story that is missing, ineligible or ambiguous, refuses the write with the failure kind and one repair step. An unregistered linked worktree and the main worktree keep the earlier selection.
+
+   ! **Fallback:** one headless Claude Code process per story, each with its own `DEFT_ACTIVE_SCOPE`, until the live two-story run in #6242 passes.
+
+   ! **Guarantee and limits:** this is destination-scoped cooperative fencing. The trusted writer is dispatch PREP (`swarm:launch`). It is not worker isolation: a worker process can still change the record. Coverage is Write/Edit, plus recognized shell destination forms when that policy is set to `enforce`. Other shell writes are not covered.
 4. ! **`run_in_background: true` (or host equivalent)** for any worker or poller whose loop runs longer than a short task (~3 min) — implementation, fix, and review-cycle workers — so the monitor conversation pane stays interactive (#1880 Gap D). The parent is notified on completion.
 5. ! **Deliberate model routing (#1739):** resolve `(dispatch_provider=claude, worker_role)` via `task verify:routing` / `task swarm:routing-set` and pass `resolved_model` into the spawn when non-null — stamping the C2 manifest is prep; the recorded model MUST reach the actual spawn call.
 

package/skills/deft-directive-swarm/references/host-grok-build.md

@@ -92,14 +92,15 @@ Until a measured callback exists, Grok wording is conditional: background `spawn
 
 ! **Grok through-merge (#4529 / #4821 / #5219):** implement MUST use (b) `stop-at: pr-open`. Path (a) is for non-through-merge Grok leaves only. Named leftover (class A) requires a dest-cwd one-shot residual, stop-at after the push; then Approach 1 wait owner is a **`spawn_subagent` review-monitor sibling** whose `monitor_agent_id` is registered (`review-monitor:register --platform-primitive spawn_subagent`) and whose child-bound `pr:watch --monitor-agent-id <id>` satisfies `verify:review-monitor --merge-path-arm --live-wait`; then Phase 6 / parent-retained squash-merges via `pr:wait-mergeable-and-merge` only after CLEAN. Pass a declared wait budget when the envelope states one (#3984). Parent-retained is the **closer after CLEAN**, not the pre-CLEAN poller/fixer. Dest spawn deny is `BLOCKED` or dest-cwd residual via native implementation-capable spawn (#4215) — not parent-primary. ⊗ Send class-A residual through process-only CLI `grok --cwd`. ⊗ Choose Approach 1 sibling or parent-retained as the first partner without dest residual. ⊗ Dispatch a Grok through-merge implement as (a). ⊗ Harvest a Grok `drive-to: merge-ready` continuation as this closer. ⊗ Treat a parent-owned shell/`bash` `pr:watch` (heartbeat `parent_id=pr-watch`) as Approach 1 babysit when `spawn_subagent` is available (#5219).
 
-! **Exclusive lawful waits / cheapest admitted Approach 1 (#5219 P3 / #5229 / #5727):** after `pr-open`, when Tier-1 `spawn_subagent` is available, the **only lawful** pre-CLEAN wait is Approach 1 child `pr:watch --monitor-agent-id` after `review-monitor:register --platform-primitive spawn_subagent` with `verify:review-monitor --merge-path-arm --live-wait` green; after CLEAN, parent-retained `pr:wait-mergeable-and-merge`. Approach 1 is also the **cheapest admitted** path vs parent shell `pr:watch`, host `monitor`, forge-poll, or bespoke `%TEMP%` pollers. Prefer one background `spawn_subagent` babysitter that owns watch → class A residual handoff → re-watch until CLEAN, then hand CLEAN to the parent closer. Child register + watch first (heartbeat live); parent verify after:
+! **Exclusive lawful waits / cheapest admitted Approach 1 (#5219 P3 / #5229 / #5727 / #4781):** after `pr-open`, when Tier-1 `spawn_subagent` is available, the **only lawful** pre-CLEAN wait is Approach 1 child `pr:watch --monitor-agent-id` after `review-monitor:register --platform-primitive spawn_subagent` with `verify:review-monitor --merge-path-arm --live-wait` green; after CLEAN, parent-retained `pr:wait-mergeable-and-merge`. Approach 1 is also the **cheapest admitted** path vs parent shell `pr:watch`, host `monitor`, forge-poll, or bespoke `%TEMP%` pollers. Prefer one background `spawn_subagent` babysitter that owns watch → class A residual handoff → re-watch until CLEAN, then hand CLEAN to the parent closer. **Spawn shape before register/pr:watch (#4781):** for monitor-only seats (`stop-at: pr-open` + `worker_role: review-monitor` watch/report), pass advertised `process_only: true` with dest `cwd` (`formatApproach1ProcessOnlySpawnShape` / `approach1BabysitterCommands`). Implement-class never sets `process_only`; dest-path is not the skip class; do not blanket-flag the fix-capable greptile poller. Dest convention by write need: shared cwd-without-occupy for non-writing monitor/critic seats; one dest per validation seat that writes a report root. Specs/report writes stay on requirements posture (#4444) — do not fold report roots into the spawn skip class. Child register + watch first (heartbeat live); parent verify after:
 ```
+# process_only+cwd spawn (monitor-only), then:
 task review-monitor:register -- --pr <N> --monitor-agent-id <id> --platform-primitive spawn_subagent
 DEFT_MONITOR_AGENT_ID=<id> task pr:watch -- <N> --monitor-agent-id <id>
 # parent after child watch is live:
 task verify:review-monitor -- --pr <N> --merge-path-arm --live-wait
 ```
-Core helper: `formatApproach1BabysitterOneLiner` / `formatApproach1CheapestAdmissionCard` / `admitClaimedBabysitPath` (`packages/core/src/swarm/approach1-babysitter.ts`). Bounded-form deny: `evaluateBoundedPrWatchDeny` refuses Directive `pr:watch` / `task deft:pr:watch` without `--monitor-agent-id` when Tier 1 is provable. Claimed-wait deny: `evaluateClaimedBabysitPathDeny` / `admitClaimedBabysitPath` refuse `BabysitPathKind` forge-poll / bespoke-temp-poller / host-monitor / directive-pr-watch-bare and Approach 1 without bound evidence / different-PR arm. ⊗ Parent forge-poll / `gh` check-runs+mergeable_state sleep / bespoke `%TEMP%` PowerShell watchers as pre-CLEAN babysit (#5727). ⊗ Parent-shell `pr:watch --monitor-agent-id <leased id>` without spawn-injected `DEFT_MONITOR_AGENT_ID` (or CLI matching `GROK_SESSION_ID`) — that impersonation does not arm. ⊗ Start `pr:wait-mergeable-and-merge` before CLEAN (#4822). ⊗ Treat host `monitor` or bare shell `pr:watch` as the sole babysit when `spawn_subagent` is available (#5229).
+Core helper: `formatApproach1BabysitterOneLiner` / `formatApproach1CheapestAdmissionCard` / `formatApproach1ProcessOnlySpawnShape` / `admitClaimedBabysitPath` (`packages/core/src/swarm/approach1-babysitter.ts`). Bounded-form deny: `evaluateBoundedPrWatchDeny` refuses Directive `pr:watch` / `task deft:pr:watch` without `--monitor-agent-id` when Tier 1 is provable. Claimed-wait deny: `evaluateClaimedBabysitPathDeny` / `admitClaimedBabysitPath` refuse `BabysitPathKind` forge-poll / bespoke-temp-poller / host-monitor / directive-pr-watch-bare and Approach 1 without bound evidence / different-PR arm. ⊗ Parent forge-poll / `gh` check-runs+mergeable_state sleep / bespoke `%TEMP%` PowerShell watchers as pre-CLEAN babysit (#5727). ⊗ Parent-shell `pr:watch --monitor-agent-id <leased id>` without spawn-injected `DEFT_MONITOR_AGENT_ID` (or CLI matching `GROK_SESSION_ID`) — that impersonation does not arm. ⊗ Start `pr:wait-mergeable-and-merge` before CLEAN (#4822). ⊗ Treat host `monitor` or bare shell `pr:watch` as the sole babysit when `spawn_subagent` is available (#5229).
 
 ! **Durable host→CLI capability stamp (#5229):** Before any CLI `verify:review-monitor` / `pr:watch` subprocess, write `.deft-scratch/host-capability-stamp.json` via `writeHostCapabilityStamp(projectRoot)` / `ensureHostCapabilityStampForBabysit` (and prefer exporting `GROK_BUILD=1` / `DEFT_HAS_SPAWN_SUBAGENT=1` into that subprocess). `review-monitor:register` also writes the stamp on successful claim/renew. Stamps older than 8h or bound to a different `host_session_id` are ignored so a later plain-terminal session cannot inherit Tier 1. Without a fresh stamp, bare `node … verify:review-monitor` can mis-detect Tier 3 / `generic-terminal` and fail-open with "no active review-monitor required" even though this parent owns `spawn_subagent`. `probeMonitoringTier` merges the stamp; `DEFT_MONITOR_TIER=3` is labeled `override-tier3` (not honest `generic-terminal`) and refused when stamp/env already proves Tier 1. `evaluateReviewMonitorGate` consults sticky lease `platform_primitive` before Approach 3 READY and before `!isTier1` READY. Bounded `pr:watch` without `--monitor-agent-id` is refused at the watch entry when Tier 1 is provable.
 

package/vendor/directive-content/Taskfile.yml

@@ -816,7 +816,9 @@ tasks:
     cmds:
       - task: engine:invoke
         vars:
-          ENGINE_CMD: 'release-publish {{.CLI_ARGS}}'
+          # #5805 / #5942: the pin's default project root is its own package dir, so pass the
+          # operator root explicitly (an operator --project-root in CLI_ARGS still wins).
+          ENGINE_CMD: 'release-publish --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}'
 
   release:rollback:
     desc: "State-aware release unwind (#716) -- task release:rollback -- <version> [--dry-run] [--allow-low-downloads N] [--allow-data-loss] [--force-strict-0]"
@@ -825,7 +827,9 @@ tasks:
     cmds:
       - task: engine:invoke
         vars:
-          ENGINE_CMD: 'release-rollback {{.CLI_ARGS}}'
+          # #5805 / #5942: the pin's default project root is its own package dir, so pass the
+          # operator root explicitly (an operator --project-root in CLI_ARGS still wins).
+          ENGINE_CMD: 'release-rollback --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}'
 
   release:e2e:
     desc: "End-to-end release rehearsal against an auto-created temp repo (#716, #2572 keep+report default) -- task release:e2e [-- --dry-run] [--owner OWNER] [--destroy-repo]"
@@ -834,7 +838,9 @@ tasks:
     cmds:
       - task: engine:invoke
         vars:
-          ENGINE_CMD: 'release-e2e {{.CLI_ARGS}}'
+          # #5805 / #5942: the pin's default project root is its own package dir, so pass the
+          # operator root explicitly (an operator --project-root in CLI_ARGS still wins).
+          ENGINE_CMD: 'release-e2e --project-root "{{.USER_WORKING_DIR}}" {{.CLI_ARGS}}'
 
   release:wait-npm:
     desc: "Phase 7 wait until both public OVPR packages (@deftai/directive + @deftai/directive-runtime) list the cut version (#4267 / #5490) -- task release:wait-npm -- <version>"
@@ -945,10 +951,10 @@ tasks:
             ;;
         esac
         print_deposit_recovery() {
-          echo "Phase 7 local closeout INCOMPLETE (#5953)." >&2
-          echo "Recovery: merge the version-matched agent-hook deposit for $VERSION onto tip, then re-run:" >&2
+          echo "Phase 7 local closeout INCOMPLETE (#5953 / #6163 Prefer-A Bound 6772886751)." >&2
+          echo "Recovery: on the pin candidate, repair/write agent-hook deposit then force-add tip-required Cursor paths (.cursor/hooks.json + .cursor/hooks/deft-hook-<sha8>.mjs) so they co-travel with the pin (preparePinCandidateCursorDeposit / git add -f bounded set); merge that pin+deposit tip, then re-run:" >&2
           echo "  task release:local-update -- $VERSION --checkout $CHECKOUT" >&2
-          echo "Expected managed deposit paths include: .grok/hooks/ .cursor/hooks.json .claude/settings.json .codex/ (and related deposit files)." >&2
+          echo "Expected managed deposit paths include: .grok/hooks/ .cursor/hooks.json .cursor/hooks/deft-hook-<sha8>.mjs .claude/settings.json .codex/ (and related deposit files)." >&2
           echo "Do not auto-commit deposit bytes inside the release flow; do not npm i -g." >&2
         }
         OCC_FILE="$CHECKOUT/.deft/occupancy.json"
@@ -1015,8 +1021,16 @@ tasks:
           git status --short >&2
           exit 1
         fi
-        DEFAULT_BRANCH="$(git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed "s@^refs/remotes/origin/@@" || true)"
-        if [ -z "$DEFAULT_BRANCH" ]; then DEFAULT_BRANCH=master; fi
+        # #6164: shell parameter expansion strip (zero sed/awk/cut/grep); then git verify.
+        ORIGIN_HEAD="$(git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null || true)"
+        DEFAULT_BRANCH="${ORIGIN_HEAD#refs/remotes/origin/}"
+        if [ -z "$DEFAULT_BRANCH" ] || [ "$DEFAULT_BRANCH" = "$ORIGIN_HEAD" ]; then
+          DEFAULT_BRANCH=master
+        fi
+        if ! git rev-parse --verify --quiet "refs/remotes/origin/$DEFAULT_BRANCH" >/dev/null; then
+          echo "release:local-update: refuse; cannot verify refs/remotes/origin/$DEFAULT_BRANCH; run: git remote set-head origin -a" >&2
+          exit 1
+        fi
         CURRENT="$(git rev-parse --abbrev-ref HEAD)"
         if [ "$CURRENT" != "$DEFAULT_BRANCH" ]; then
           echo "release:local-update: refuse; checkout must be on default branch $DEFAULT_BRANCH (on $CURRENT)" >&2
@@ -1024,14 +1038,54 @@ tasks:
         fi
         echo "release:local-update: ff-only pull on $DEFAULT_BRANCH at $CHECKOUT"
         git pull --ff-only
-        if [ -f pnpm-workspace.yaml ]; then
-          if grep -q "minimumReleaseAgeExclude" pnpm-workspace.yaml; then
-            if ! grep -q "@deftai/directive-runtime@$VERSION" pnpm-workspace.yaml; then
-              echo "release:local-update: AgeExclude missing @deftai/directive-runtime@$VERSION before frozen install (#5953 footnote)" >&2
-              exit 1
-            fi
-          fi
-        fi
+        # #6164: unconditional dependency-free AgeExclude gate (exact list-item; fail closed; no soft-skip).
+        node -e '
+          const fs = require("fs");
+          const version = process.argv[1] || "";
+          const want = "@deftai/directive-runtime@" + version;
+          let text;
+          try {
+            text = fs.readFileSync("pnpm-workspace.yaml", "utf8");
+          } catch (err) {
+            const detail = err && err.message ? err.message : String(err);
+            console.error("release:local-update: AgeExclude cannot read pnpm-workspace.yaml before frozen install (#6164): " + detail);
+            process.exit(1);
+          }
+          const lines = text.split(/\r?\n/);
+          const KEY_RE = /^(\s*)minimumReleaseAgeExclude:\s*(#.*)?$/;
+          const ITEM_RE = /^(\s*)-\s+(.*)$/;
+          const keyIdx = lines.findIndex((l) => KEY_RE.test(l));
+          if (keyIdx < 0) process.exit(0);
+          const keyLine = lines[keyIdx];
+          const keyIndent = keyLine.length - keyLine.trimStart().length;
+          const itemValue = (raw) => {
+            let v = String(raw || "").trim();
+            const SQ = String.fromCharCode(39);
+            const DQ = String.fromCharCode(34);
+            if (v.startsWith(SQ) || v.startsWith(DQ)) {
+              const q = v[0];
+              const end = v.indexOf(q, 1);
+              return end > 0 ? v.slice(1, end) : v;
+            }
+            const hash = v.search(/\s#/);
+            if (hash >= 0) v = v.slice(0, hash);
+            return v.trim();
+          };
+          let found = false;
+          for (let i = keyIdx + 1; i < lines.length; i++) {
+            const line = lines[i];
+            const trimmed = line.trim();
+            if (trimmed === "" || trimmed.startsWith("#")) continue;
+            const m = ITEM_RE.exec(line);
+            const indent = line.length - line.trimStart().length;
+            if (m === null || indent < keyIndent) break;
+            if (itemValue(m[2]) === want) { found = true; break; }
+          }
+          if (!found) {
+            console.error("release:local-update: AgeExclude missing " + want + " before frozen install (#5953 footnote / #6164)");
+            process.exit(1);
+          }
+        ' "$VERSION"
         echo "release:local-update: pnpm install --frozen-lockfile"
         pnpm install --frozen-lockfile
         PIN_PKG="$(node -e 'const fs=require("fs"); const p=JSON.parse(fs.readFileSync("package.json","utf8")); const v=(p.dependencies||{})["@deftai/directive-runtime"]||(p.devDependencies||{})["@deftai/directive-runtime"]||""; console.log(String(v).replace(/^[^0-9]*/, ""));')"
@@ -1051,6 +1105,39 @@ tasks:
           print_deposit_recovery
           exit 1
         fi
+        # #6163 Prefer-A Bound 6772886751: committed-byte HEAD association (no repair/staging).
+        echo "release:local-update: require committed Cursor deposit association on HEAD"
+        if ! node --input-type=module -e '
+          import { pathToFileURL } from "node:url";
+          import { join, resolve } from "node:path";
+          const checkout = process.argv[1];
+          const vendor = join(
+            checkout,
+            "node_modules/@deftai/directive-runtime/vendor/directive-core/dist/init-deposit/agent-hooks.js",
+          );
+          let validate;
+          try {
+            ({ validateCursorDepositAssociation: validate } = await import(pathToFileURL(resolve(vendor)).href));
+          } catch (err) {
+            const detail = err && err.message ? err.message : String(err);
+            console.error("release:local-update: cannot load validateCursorDepositAssociation from installed runtime (#6163): " + detail);
+            process.exit(1);
+          }
+          if (typeof validate !== "function") {
+            console.error("release:local-update: installed runtime lacks validateCursorDepositAssociation (#6163); pin must co-travel the Bound helper");
+            process.exit(1);
+          }
+          const result = validate(checkout, { source: "HEAD" });
+          if (!result || result.ok !== true) {
+            console.error("release:local-update: committed Cursor deposit association FAILED on HEAD (#6163)");
+            console.error(result && result.detail ? result.detail : "unknown association failure");
+            process.exit(1);
+          }
+          console.log("release:local-update: committed Cursor deposit association ok (" + result.sha8 + ")");
+        ' "$CHECKOUT"; then
+          print_deposit_recovery
+          exit 1
+        fi
         UPGRADE_BIN=""
         if [ -x "node_modules/.bin/directive" ]; then
           UPGRADE_BIN="node_modules/.bin/directive"

package/vendor/directive-content/commands.md

@@ -149,6 +149,8 @@ Common commands:
   - Bare `evidence` / `disposition` keys are **not** valid (#1620 / Option B #3305). They fail `verify:vbrief-conformance` and are treated as missing by `scope:complete` (no dual-read). Migrate bare keys or narrative-only `Result`/`Verification` workarounds to the namespaced fields above while items are still non-terminal.
   - Already-terminal items (`completed`/`failed`/`cancelled`/…) are not re-checked for typed evidence; pre-marking items complete to skip the gate is unsupported for the typed path.
   - `merge`/`review` alone cannot satisfy smoke/UAT/deploy/observed_behavior criteria (title/Acceptance text or explicit axis).
+  - **Delivery identity (#5710):** with an issue origin, the PR must be associated with the issue as of `merged_at` by one of: (a) a unique sole `deft-story: N` mark in the merge-time PR body (PRs that change only lifecycle briefs, `CHANGELOG.md` and the spec-drift ledger are excluded and never count), (b) a closing keyword (`Closes #N`, `owner/repo#N`, or the issue URL) in the merge-time body, or (c) a Connected issue link at `merged_at`. Brief-in-PR-diff still counts. A mark, keyword or link added after merge does not count, and current `closingIssuesReferences` alone is not enough. Basis (a) scans every merged PR within 20 minutes, `graphql.remaining` ≥ 200 and REST core ≥ 100; any gap refuses. With no issue origin, stamp `plan.metadata.productPullRequest` and complete with `--pr <that number> --merge-commit <sha>`; the repository is the `origin` remote. `--non-delivery` refuses when the stamped PR is merged, and refuses when its merge state cannot be read. `xbrief:preflight` prints one note for a code-bearing brief with no issue origin.
+  - **Lifecycle completion (#680):** completion admission uses the merge-time bases above; there is no separate keyword-only refuse. `swarm:finalize-owed` also lists an active issue-less brief with a stamped `productPullRequest` (shown as `pr #P`, no issue number, no origin-issue check or origin-close); briefs that share a product PR finalize together under one claim. In a batched `swarm:finalize-cohort`, a refused `deft-story` mark is not an error: that story stays pending, unstamped and unswept (`refused_marks`, exit 3 incomplete), and the other stories stamp, sweep, commit and land. A failed changed-file lookup and real delivery errors still fail the batch. `scope:complete` writes the spec-drift ledger as verb output; finalize commits it with the completed briefs, and scope-provenance membership admits exactly `xbrief/.audit/spec-drift-ledger.json` only when the whole change set is a completion move. `verify:changelog-unreleased` needs no new `[Unreleased]` line when the change set versus merge-base (`git diff --name-only --no-renames`) is non-empty and only lifecycle briefs, `CHANGELOG.md` and that ledger, so lifecycle verbs write no CHANGELOG line. Product changes and an empty change set still need one.
 - `task scope:fail -- xbrief/active/<file>.xbrief.json` -- mark running work failed when the scope cannot complete.
 - `task scope:cancel -- <path>` -- move a scope to `cancelled/`.
 - `task scope:restore`, `task scope:block`, `task scope:unblock`, `task scope:demote`, and `task scope:undo:*` -- repair or reverse lifecycle transitions.
@@ -181,6 +183,8 @@ The implementation gate succeeds only for active scope xBRIEFs with `plan.status
 
 **Hotfix classifier (#1193):** Typed `plan.policy.hotfixCriteria` + pure `evaluateHotfixEligibility`. Small fix / pure revert may propose label `hotfix-candidate` only; a human promotes to `hotfix`. Refactors, new exports/handlers, and forbidden paths (Dockerfile, fly.toml, workflows, migrations, auth/secrets) never qualify.
 
+**Small-change lane (#6204):** Under the `rapid` ceremony dial, a scope with stated acceptance commands may use a thin brief: title, issue ref, `file_scope` and acceptance commands only (`emitThinBrief`, `packages/core/src/intake/thin-brief.ts`). The bound defaults to 5 production files and 500 changed lines (added plus deleted, tests included; briefs and CHANGELOG excluded). `plan.policy.ceremonyDial.smallChangeLane` (`maxProductionFiles`, `maxChangedLines`) overrides each field; an invalid value refuses. `scope:promote`, `scope:activate`, `xbrief:preflight`, `verify:ac` and `scope:complete` admit the thin shape, and each one remeasures the cumulative product diff (git, against the lane-admit base in `plan.metadata["x-directive/smallChangeLane"]`; at `scope:complete`, the delivered merge commit against its first parent). A crossed bound, a public-surface change (manifest, entry, task file or export line), an unknown public surface, or a depth other than `rapid` refuses. A crossed bound or public-surface change is recorded on the brief (lane state `crossed`), so every later retry refuses even if the diff shrinks. The public-surface check reads export statements with the TypeScript parser, so a change inside a multi-line export list or exported signature counts. The one remediation is lane exit: convert the scope to the full shape (`escalateThinBriefToFullShape`), which keeps scope identity and acceptance evidence. Raising the dial (#3319) does not clear the refusal. One-PR delivery is not part of this lane; Path B brief-first stays lawful (#6203 / #680).
+
 ```mermaid
 flowchart TD
     Candidate["Scope xBRIEF exists"] --> Promote{"In proposed?"}
@@ -494,13 +498,14 @@ Cross-link: spawn three postures and deny recoveries live under § Agent-host di
 ### Mutable ritual (mutation posture)
 
 - ! On **mutation** session start, run `deft session:start` (or `task session:start` in framework source) after loading AGENTS.md. Records quick-tier ritual in `.deft/ritual-state.json`: alignment confirmation, branch-policy disclosure, `deft verify:tools` guidance, default-branch sync warnings, and `deft triage:welcome` one-liner. State is worktree- and HEAD-bound; stale after `plan.policy.sessionRitualStalenessHours` hours (default 8). Mutation start also claims the worktree occupancy lease (`.deft/occupancy.json`); see Session routing (#3433).
-- ! **Orientation compression Now (#3286):** mutation cold `session:start` composes `doctor` + #3282 toolchain preflight (and deposit-sha fast-paths for `agents:refresh` / `verify:cache-fresh`) as inline sections with per-section status lines — composition of existing steps, not a new monolith. When the deposit fingerprint (payload + templates + engine) is unchanged, refresh surfaces print one-line `unchanged - sha match` no-ops. Opt-in compact output: `deft session:start --compact` or `DEFT_SESSION_COMPACT=1` (verbose remains the default). #2176 read-only default is unchanged. Dual-path Later (orient) stays open until run-summary telemetry shows ritual+gate share ≥ 25% after Now ships (#2899).
+- ! **Quiet-default success stdout (#4966):** mutation `session:start` success human output defaults to one trusted go-signal line with stable prefix `[deft session] ready=…` (ready + branch/HEAD + occupancy). Routine dial/host-surface/effort/orientation/ceremony prose is verbose-only via `deft session:start --verbose` or `DEFT_SESSION_VERBOSE=1`. Non-exhaustive always-on allowlist keeps actionable zero-exit exceptions, non-default policy/bypass and human-merge disclosures, finalize-owed unknown/deferred qualifications, and actionable lifecycle/work-claim notices on the quiet path. Fail/deny/steal/non-zero stay loud. Tip `#3286` `--compact` / `DEFT_SESSION_COMPACT` are deprecated as whole-stdout volume controls (no-op for human stdout selection; `--json` / run-summary unchanged). Exit 0 is not the mutation go-signal — render from structured ready/posture/occupancy state.
+- ! **Orientation compression Now (#3286):** mutation cold `session:start` composes `doctor` + #3282 toolchain preflight (and deposit-sha fast-paths for `agents:refresh` / `verify:cache-fresh`) as inline sections with per-section status lines — composition of existing steps, not a new monolith. When the deposit fingerprint (payload + templates + engine) is unchanged, refresh surfaces print one-line `unchanged - sha match` no-ops. Section formatting may still honor `--compact` / `DEFT_SESSION_COMPACT=1` inside the orientation bundle; whole-stdout volume is `#4966` quiet-default / `--verbose`. #2176 read-only default is unchanged. Dual-path Later (orient) stays open until run-summary telemetry shows ritual+gate share ≥ 25% after Now ships (#2899).
 - ! Cold `session:start` does **not** run the live agent-hook probe. Functional readiness belongs to the gated mutation path so cold ceremony retains the #2990/#2991 latency profile.
 - ! **Hot path latency (#2991):** by default, mutation `session:start` does **not** block ritual-state write on optional network. It skips the npm release-availability probe and triage cache empty-hydrate / self-heal (`ensureTriageCacheHydrated` / `maybeSelfHealCache`). Targets (operator-facing, not CI-hard): warm hot path typically under a few seconds once tools are on PATH; cold path dominated by local `verify:tools` and git, usually well under ~30s when optional network is off. Empty-cache GitHub fetch-all and npm `view` previously accounted for multi-minute hangs in the WWYSYDH pilot — those stay off the critical path unless opted in.
 - ! **Cold vs re-arm ceremony tiers (#2992):** default `session:start` is the **cold** (full) path. After age staleness or compact re-arm (#2113) on the **same worktree** with continuous HEAD and previously-passing quick steps, prefer `deft session:start --rearm` (alias `--tier=rearm`) to refresh the ritual clock + HEAD/worktree bind without `verify:tools`, triage welcome, release probe, or staleness tickler. Full cold remains required for missing/invalid state, worktree change, discontinuous HEAD, first install, or failed/missing quick steps. Compact marks `rearm_needed`; PreToolUse denial and inspect/verify messages prefer re-arm recovery when cold is unnecessary.
 - ? Opt into optional network: `deft session:start --with-network` or `DEFT_SESSION_START_NETWORK=1`. When enabled, the bounded release-availability probe runs against the public npm registry (skips framework source checkouts, non-release pins, and `DEFT_NO_NETWORK=1`; identical latest-version notices throttle for 24 hours in `xbrief/.triage-cache/release-availability-state.json`). Default-mode triage welcome then also hydrates/self-heals the triage cache. This is separate from `deft doctor`, whose bare and gated invocations remain offline by default (#2182). Refs #1692 / #2991. Re-arm never runs optional network.
 - ~ `session:start --json` includes `steps[]` with `name` + `duration_ms` for major phases (`alignment`, `branch_policy`, `verify_tools`, `triage_welcome`, `release_probe`, `ritual_write`), plus total `duration_ms`, `optional_network`, and `ceremony_tier` (`cold` | `rearm`). Skipped optional steps report `skipped: true` and `duration_ms: 0`. Use this for attribution when investigating ceremony wall-clock.
-- ~ **Process-cost events (#2994 / #3508):** on mutation `session:start` completion (cold or re-arm), Directive appends a local `session:start` behavioral event to `.deft-cache/events.jsonl` with `ceremony_tier`, `duration_ms`, `exit_code`, and optional `steps[]` (same labels as `--json`). Mutation `session:start` also prints one operator-visible `ceremony <tier> <ms>` line (hidden under `--compact` / `DEFT_SESSION_COMPACT`). When PreToolUse denies for `ritual-not-ready`, a local `session:ritual-blocked` event records `tool_name`, `code`, and optional `recovery_tier` / `detail`. Always-on best-effort (never blocks ceremony or deny path); not gated on `valueFeedback`; **no remote upload** (Product Insights #2603 is a separate opt-in). Pull the rollup with `task value:show` (composed reader; CLI process time, not agent-turn wall clock). See § Process-cost events below. ⊗ Do not use the printed CLI duration as #3286 Later graduation input.
+- ~ **Process-cost events (#2994 / #3508):** on mutation `session:start` completion (cold or re-arm), Directive appends a local `session:start` behavioral event to `.deft-cache/events.jsonl` with `ceremony_tier`, `duration_ms`, `exit_code`, and optional `steps[]` (same labels as `--json`). Mutation `session:start` also emits one operator-visible `ceremony <tier> <ms>` line on the verbose human path (`--verbose` / `DEFT_SESSION_VERBOSE`; quiet-default hides it per #4966). When PreToolUse denies for `ritual-not-ready`, a local `session:ritual-blocked` event records `tool_name`, `code`, and optional `recovery_tier` / `detail`. Always-on best-effort (never blocks ceremony or deny path); not gated on `valueFeedback`; **no remote upload** (Product Insights #2603 is a separate opt-in). Pull the rollup with `task value:show` (composed reader; CLI process time, not agent-turn wall clock). See § Process-cost events below. ⊗ Do not use the printed CLI duration as #3286 Later graduation input.
 - ~ At safe idle points (clean tree, no in-flight story), mutation session start and `deft scope:complete` may also run the staleness tickler: an interactive, consent-based offer to upgrade Directive (`npm i -g @deftai/directive@latest`) and/or migrate xBRIEF (`deft migrate:xbrief`). Escalation tiers, snooze windows, and opt-out live under `plan.policy.stalenessTickler` — inspect with `deft policy:show --field=stalenessTickler`. State persists in `xbrief/.triage-cache/staleness-tickler-state.json`. Skips framework source checkouts, dirty trees, CI/headless (`DEFT_SESSION_RITUAL_SKIP=1`), and typed opt-out. Refs #2488 / #2489.
 - ! Before any code-writing tool call or `start_agent` implementation dispatch, run `deft verify:session-ritual -- --tier=gated`. Gated tier fails closed unless quick-tier state is fresh; lazily records the non-deferrable `agent_hooks` readiness gate plus `deft doctor` and `task verify:cache-fresh` entrypoints. Agent-hook correctness is independent of doctor warnings and throttling. Step 0 of the pre-`start_agent` gate stack.
 - ! **One-shot recovery (#2993 / #3100 / #4399):** when PreToolUse denies writes for a stale/missing gated ritual, run `deft session:ready` (or `task session:ready`). It composes `session:start` (only when quick-tier is not green) + `verify:session-ritual -- --tier=gated` with check-class `cache_fresh` (age + live drift, no `--skip-drift-probe`) + `cache fetch-all --force` when `cache_fresh` is the remaining blocker, then re-verifies. Skip-drift ritual argv is not the ready bar — that is the `task check` / FRAMEWORK_CHECK_GATES evaluate, so stale-by-drift can still fire fetch-all. Even when gated inspect is already fresh, the fast path forces one live `agent_hooks` check and the same check-class `cache_fresh`; it still avoids unnecessary fetch-all when that evaluate is green. Flags: `--json`, `--repo OWNER/NAME`, `--with-network` (forwarded to session:start). Prefer this over juggling the multi-step recovery sequence under hook pressure.
@@ -550,7 +555,7 @@ Local ceremony cost signal for WWYSYDH / weekly process rollups. Emits to `.deft
 | PreToolUse ritual deny | `session:ritual-blocked` | Hook blocks write/spawn because gated ritual is not ready | `tool_name`, `code=ritual-not-ready`, `recovery_tier` (`cold`\|`rearm`) |
 | Per-step wall-clock | (field on `session:start`) | Same emit as session start | `steps[].name` + `steps[].duration_ms` (`alignment`, `scm_readiness`, `branch_policy`, `verify_tools`, `triage_welcome`, `release_probe`, `ritual_write`) |
 
-CLI mirror (no JSONL required): `deft session:start --json` already exposes the same `steps` / `duration_ms` / `ceremony_tier` fields for one-shot inspection. Human mutation output adds one `ceremony <tier> <ms>` line unless compact hides it (#3508).
+CLI mirror (no JSONL required): `deft session:start --json` already exposes the same `steps` / `duration_ms` / `ceremony_tier` fields for one-shot inspection. Human mutation output adds one `ceremony <tier> <ms>` line on the verbose path (#3508 / #4966).
 
 Composed reader (no new verb): `task value:show` / `deft value:show` prints last cold vs re-arm duration, last per-step breakdown, blocked-ritual count, and recovery-tier distribution from the same ledger. This is **CLI process time**, not agent-turn wall clock (#3500). ⊗ Do not feed the printed CLI duration into #3286 Later graduation.
 

package/vendor/directive-content/docs/getting-started.md

@@ -58,6 +58,8 @@ directive doctor
 
 After clone or a new worktree: run the project package manager (`npm install` / `pnpm install`), then the first eligible runtime command or registered hook completes local activation.
 
+**Dependabot / pin-only bumps (AC14.10):** a PR that changes only the `@deftai/directive-runtime` pin + lockfile is valid. After `pnpm install` / `npm install` brings `node_modules` to the new pin, the first eligible skill, hook, or ordinary runtime command runs local automatic setup (wiring / `GENERATION` / readiness). `directive doctor` stays read-only — dirty doctor output before that eligible invocation is expected. CI may either rely on that first eligible command or run explicit `directive install --repair --yes`. Do not treat "deposit bytes must land in the same pin PR" as product law. Human-test mirror: HT-17 in `docs/installer-refactor-ovpr/install-ovpr-human-test-plan.md`. Schema/data behind the new pin still needs `directive upgrade` (AC14.11), not repair alone.
+
 **Repair (pin unchanged):** `npm i -g @deftai/directive`, then `directive install --repair`.
 
 **Upgrade version or migrate data:** `directive upgrade` (alias: `update`).

package/vendor/directive-content/docs/scope-provenance.md

@@ -45,10 +45,24 @@ Allowance = clamp(count of **concrete** production files on the merge-base `file
 When the bound story is in the change set:
 
 1. A human-stamped merge-base mint for the **continuity-resolved** story is the allowlist when present (planId match ignores stale `xbriefRelPath`; no-`plan.id` is path-first + basename-keyed mint with matching `xbriefRelPath`).
-2. Otherwise membership evaluates against the merge-base brief's **concrete** `file_scope` as agent precommitment. Head brief cannot widen.
+2. Otherwise membership evaluates against the merge-base brief's **concrete** `file_scope` as agent precommitment. Head brief cannot widen, except under a qualifying forge approval (#6203, below).
 3. Free paths: bound brief, verified peer briefs, `CHANGELOG.md`, and continuity lifecycle paths of the bound identity. An xBRIEF-only change set may omit a mint.
 4. Empty / invalid / unreadable mint records fail closed (they are not absence).
 
+#### Forge-approved head brief (#6203)
+
+A PR can carry a new or widened brief plus its code when a human approves it on GitHub. With PR context (`--pr N` / `--repo OWNER/NAME`, or `GITHUB_PR_NUMBER` / `GITHUB_REPOSITORY` in CI), a failing membership check under precommitment or missing authority consults the forge. When a qualifying approval exists, membership evaluates against the **head** brief's concrete `file_scope` instead of the merge-base brief.
+
+- **Mint wins.** A present mint keeps the mint path. The forge is never consulted.
+- **Auth-hash v1** (`sha256:` over canonical JSON; strings byte-exact, no Unicode normalization) covers `plan.id`, the xbrief path, the concrete `file_scope`, and the acceptanceCriteria array: `plan.acceptance`, `plan.narratives.AcceptanceCriteria`, and each item's `narrative.Acceptance`, in document order. `productPullRequest` and other delivery metadata stay out, so a PPR stamp keeps the approval. Any change to the covered fields drops it.
+- **Qualifying approval:** the reviewer's latest deciding review (APPROVED / CHANGES_REQUESTED / DISMISSED) is APPROVED; the reviewer is a `User` (not Bot or App), not the PR author, and has `write`, `maintain` or `admin` on the repo; the repo is the checkout's `origin` (a `--repo` value may only confirm it, so a fork's approval never counts) and is the PR's base repo; the evaluated HEAD is the PR head (or GitHub's merge commit whose second parent is the PR head); and the brief at the reviewed commit hashes the same as the head brief.
+- **Fallback:** missing PR context, no qualifying approval, a hash mismatch, or an unavailable forge keeps today's Path B or mint finding unchanged. The result message adds one `forge approval (#6203)` line with the reason.
+- **Membership only.** The production fence still reads the merge-base brief. A widened brief can pass membership and still fail `production-scope-over-budget`. A brand-new brief has no production fence (as today).
+- **Re-run after approval.** Approval does not re-trigger CI. Re-run the merge gate (or push) after the approval lands.
+- **Residual (#6207):** an agent that holds a second human forge token can satisfy every predicate above. The hash binds the approved bytes; it does not prove independent human intent and does not close that confused-deputy risk. That posture stays open on #6207.
+
+Code: `packages/core/src/scope-provenance/forge-approval.ts`.
+
 #### Path A planning split (#5551)
 
 When an active implementation brief is **outside** the change set, membership is a no-op for that identity (Path A). Supported planning publication is two change sets, not one: