@deftai/directive 0.119.12 → 0.120.0

package/dist/authz.js

@@ -27,6 +27,7 @@ import { existsSync } from "node:fs";
 import { isAbsolute, resolve } from "node:path";
 import { onePrUnit } from "@deftai/directive-core";
 import { AFK_TEMPLATE_NAMES, AUTHZ_OPERATIONS, CLOSED_VERB_TEMPLATE_NAMES, FINISH_LOOP_TEMPLATE_NAME, formatDecomposeStructuralMintCommand, isAfkTemplateName, isClosedVerbTemplateName, isFinishLoopTemplateName, mintAfkTemplateGrant, mintDecomposeStructuralApplyGrant, mintHumanOriginGrant, revokeGrant, showAuthzSnapshot, startUatLease, suspendUatLease, toProjectRelativePosix, } from "@deftai/directive-core/authz";
+import { uatCampaignEndSeal } from "@deftai/directive-core/authz/campaign-end-seal";
 import { refuseMintWhileUatActive, refuseNonInteractiveMint, resolveHumanPresenceMintSeams, } from "./human-presence-mint.js";
 export { AUTHZ_AGENT_SHELL_ENV_MARKERS, AUTHZ_INTERACTIVE_CONFIRM_PHRASE, } from "./human-presence-mint.js";
 function parseOps(raw) {
@@ -328,13 +329,18 @@ export function main(argv = process.argv.slice(2), seams = {}) {
                 const blocked = gateConfirm();
                 if (blocked !== null)
                     return blocked;
-                const { lease } = startUatLease({
+                // Result narrowing; pinActive mint wiring stays parked (class 4).
+                const started = startUatLease({
                     projectRoot: args.projectRoot,
                     campaignId: args.campaign,
                     actor: args.actor,
                     note: args.note,
                 });
-                process.stdout.write(`✓ UAT lease ACTIVE campaign=${lease.campaignId} (human-origin operator-cli)\n`);
+                if (!started.ok) {
+                    process.stderr.write(`authz:uat-start: ${started.reason}\n`);
+                    return 2;
+                }
+                process.stdout.write(`✓ UAT lease ACTIVE campaign=${started.lease.campaignId} (human-origin operator-cli)\n`);
                 process.stdout.write("  Product edit/push/PR/merge denied until a named fix cohort grant is minted.\n");
                 process.stdout.write("  Tests, evidence capture, and issue filing remain allowed.\n");
                 return 0;
@@ -343,10 +349,18 @@ export function main(argv = process.argv.slice(2), seams = {}) {
                 const blocked = gateConfirm();
                 if (blocked !== null)
                     return blocked;
-                const state = suspendUatLease({
+                // Sealed campaign-end only after CLI human-presence gateConfirm (#4233).
+                // pinActive mint wiring stays parked (class 4 follow-up).
+                const suspended = suspendUatLease({
                     projectRoot: args.projectRoot,
                     actor: args.actor,
+                    campaignEndSeal: uatCampaignEndSeal(),
                 });
+                if (!suspended.ok) {
+                    process.stderr.write(`authz:uat-suspend: ${suspended.reason}\n`);
+                    return 2;
+                }
+                const state = suspended.state;
                 if (state.uat === null) {
                     process.stdout.write("UAT lease was already inactive.\n");
                 }
@@ -400,7 +414,7 @@ export function main(argv = process.argv.slice(2), seams = {}) {
                     const blocked = gateConfirm();
                     if (blocked !== null)
                         return blocked;
-                    const grant = mintDecomposeStructuralApplyGrant({
+                    const minted = mintDecomposeStructuralApplyGrant({
                         projectRoot: root,
                         parentPath: parentAbs,
                         draftPath: draftAbs,
@@ -409,6 +423,11 @@ export function main(argv = process.argv.slice(2), seams = {}) {
                         expiresAt: args.expiresAt,
                         singleUse: args.singleUse,
                     });
+                    if (!minted.ok) {
+                        process.stderr.write(`authz:grant: ${minted.reason}\n`);
+                        return 2;
+                    }
+                    const grant = minted.grant;
                     // mintDecomposeStructuralApplyGrant always sets contentDigest + worktree.
                     const digest = grant.scope.contentDigest || "";
                     process.stdout.write(`✓ human-origin structural grant minted id=${grant.id} origin=${grant.origin.kind}\n`);
@@ -474,7 +493,7 @@ export function main(argv = process.argv.slice(2), seams = {}) {
                     const blocked = gateConfirm();
                     if (blocked !== null)
                         return blocked;
-                    const grant = mintAfkTemplateGrant({
+                    const minted = mintAfkTemplateGrant({
                         projectRoot: args.projectRoot,
                         template: args.template,
                         target: args.target,
@@ -489,6 +508,11 @@ export function main(argv = process.argv.slice(2), seams = {}) {
                         issueIds: args.issueIds,
                         cohortId: args.cohort,
                     });
+                    if (!minted.ok) {
+                        process.stderr.write(`authz:grant: ${minted.reason}\n`);
+                        return 2;
+                    }
+                    const grant = minted.grant;
                     process.stdout.write(`✓ human-origin grant minted id=${grant.id} origin=${grant.origin.kind} ` +
                         `template=${args.template}\n`);
                     if (isFinishLoopTemplateName(args.template)) {
@@ -511,7 +535,7 @@ export function main(argv = process.argv.slice(2), seams = {}) {
                     if (blocked !== null)
                         return blocked;
                 }
-                const grant = mintHumanOriginGrant({
+                const minted = mintHumanOriginGrant({
                     projectRoot: args.projectRoot,
                     actor: args.actor,
                     operations: args.operations,
@@ -525,6 +549,11 @@ export function main(argv = process.argv.slice(2), seams = {}) {
                     expiresAt: args.expiresAt,
                     singleUse: args.singleUse,
                 });
+                if (!minted.ok) {
+                    process.stderr.write(`authz:grant: ${minted.reason}\n`);
+                    return 2;
+                }
+                const grant = minted.grant;
                 process.stdout.write(`✓ human-origin grant minted id=${grant.id} origin=${grant.origin.kind}\n`);
                 process.stdout.write(`  ops=[${grant.scope.operations.join(",")}] cohort=${grant.scope.cohortId ?? "-"}\n`);
                 if (grant.scope.surfaces.length > 0) {
@@ -542,10 +571,15 @@ export function main(argv = process.argv.slice(2), seams = {}) {
                     if (blocked !== null)
                         return blocked;
                 }
-                const revoked = revokeGrant({
+                const revokedResult = revokeGrant({
                     projectRoot: args.projectRoot,
                     grantId: args.grantId,
                 });
+                if (!revokedResult.ok) {
+                    process.stderr.write(`authz:revoke: ${revokedResult.reason}\n`);
+                    return 2;
+                }
+                const revoked = revokedResult.grant;
                 if (revoked === null) {
                     process.stderr.write(`authz: grant not found: ${args.grantId}\n`);
                     return 1;

package/dist/changelog-check.js

@@ -2,14 +2,19 @@
 import { resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { runChangelogCheck } from "@deftai/directive-core/task-surface";
-function parseProjectRoot(argv) {
+function parseChangelogCheckArgs(argv) {
     let projectRoot = ".";
+    let againstMergeBase = false;
     for (let i = 0; i < argv.length; i += 1) {
         const arg = argv[i] ?? "";
         if (arg === "--project-root") {
             const value = argv[i + 1];
             if (value === undefined) {
-                return { projectRoot, error: "argument --project-root: expected one argument" };
+                return {
+                    projectRoot,
+                    againstMergeBase,
+                    error: "argument --project-root: expected one argument",
+                };
             }
             projectRoot = value;
             i += 1;
@@ -17,14 +22,17 @@ function parseProjectRoot(argv) {
         else if (arg.startsWith("--project-root=")) {
             projectRoot = arg.slice("--project-root=".length);
         }
+        else if (arg === "--against-merge-base") {
+            againstMergeBase = true;
+        }
         else {
-            return { projectRoot, error: `unrecognized argument: ${arg}` };
+            return { projectRoot, againstMergeBase, error: `unrecognized argument: ${arg}` };
         }
     }
-    return { projectRoot };
+    return { projectRoot, againstMergeBase };
 }
 export function run(argv) {
-    const args = parseProjectRoot(argv);
+    const args = parseChangelogCheckArgs(argv);
     if (args.error !== undefined) {
         process.stderr.write(`changelog-check: ${args.error}\n`);
         return 2;
@@ -36,7 +44,7 @@ export function run(argv) {
         writeErr: (text) => {
             process.stderr.write(text);
         },
-    });
+    }, { againstMergeBase: args.againstMergeBase });
 }
 if (process.argv[1] !== undefined && fileURLToPath(import.meta.url) === process.argv[1]) {
     process.exit(run(process.argv.slice(2)));

package/dist/check.js

@@ -13,6 +13,7 @@ import { join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { dispatchTaskCheck } from "@deftai/directive-core/check";
 import { DEFT_REPO_POSITIVE_MARKERS } from "@deftai/directive-core/doctor";
+import { refuseIfWslOwnershipBlocked } from "./wsl-ownership-guard.js";
 function isFrameworkSourceCheckoutAt(projectRoot) {
     try {
         if (!statSync(join(projectRoot, "main.md")).isFile()) {
@@ -135,6 +136,10 @@ export function run(argv) {
         process.stderr.write(FRAMEWORK_ROOT_MISS);
         return 2;
     }
+    // #1617: live WSL ownership gate before first protected check write/orchestration.
+    const blocked = refuseIfWslOwnershipBlocked(args.projectRoot);
+    if (blocked !== null)
+        return blocked;
     return dispatchTaskCheck(args.frameworkRoot, args.projectRoot, { noCache: args.noCache });
 }
 /* v8 ignore start -- entry guard */

package/dist/dispatch.d.ts

@@ -10,9 +10,9 @@ export interface DispatchIo {
     writeErr: (text: string) => void;
 }
 /** CLI modules in packages/cli/src (excluding parity harnesses and bin/index). */
-export declare const CLI_MODULE_VERBS: readonly ["agents-refresh", "cache", "check", "capacity-backfill", "capacity-show", "codebase-default-extractor", "codebase-map", "codebase-map-fresh", "codebase-projection-registry", "codebase-provider", "doctor", "install-upgrade", "install-uninstall", "migrate-preflight", "migrate-xbrief", "migrate-category-b", "framework-check-updates", "hook-dispatch", "umbrella-current-shape", "changelog-check", "change-init", "commit-lint", "coverage-hotspots", "policy", "authz", "escalation-cli", "pr-closing-keywords", "pr-merge-readiness", "pr-monitor", "pr-protected-issues", "pr-wait-mergeable", "pr-watch", "pr-finish-loop", "directive-finish-loop", "preflight-cache", "preflight-gh", "probe-session", "release", "release-e2e", "release-publish", "release-rollback", "release-wait-npm", "scope-lifecycle", "scope-record-approved-scope", "scope-record-observable-scope", "scope-record-intent-constraint", "scm-sync-default", "lifecycle-event", "lifecycle-stats", "session-start", "session-ready", "occupancy-steal", "occupancy-release", "occupancy-heartbeat", "occupancy-grant", "plan-sequence", "slice", "subagent-monitor", "toolchain-check", "triage-actions", "triage-bootstrap", "triage-bulk", "triage-classify", "triage-strip-withdrawn", "triage-evaluate", "triage-help", "triage-queue", "triage-reconcile", "triage-refresh", "triage-scope", "triage-scope-drift", "triage-smoketest", "triage-subscribe", "triage-summary", "triage-welcome", "ts-check-lane", "vbrief-activate", "vbrief-build", "vbrief-preflight", "vbrief-reconcile", "vbrief-validate", "vbrief-validation", "xbrief-create", "xbrief-verify", "xbrief-adopt-stored-plan-id", "verify-branch", "verify-encoding", "verify-forward-coverage", "verify-test-boundary", "verify-class-checks", "verify-presentation-coverage", "verify-scope-provenance", "verify-consumer-check-contract", "verify-hooks-installed", "verify-investigation", "verify-judgment-gates", "verify-no-task-runtime", "validate-links", "validate-strategy-output", "verify-biome-config", "verify-bridge-drift", "verify-capacity", "verify-contained-writes", "verify-telemetry-coverage", "verify-content-manifest", "verify-deposit-closure", "verify-consumer-hard-stops", "verify-closing-keywords", "verify-skill-external-fetch-gate", "verify-semantic-single-source", "verify-contract-drift", "verify-cursor-tier1", "verify-openclaw-tier1", "verify-go-freeze", "verify-scm-boundary", "verify-session-ritual", "verify-plan-sequence", "verify-stubs", "verify-xbrief-drift", "verify-spec-prd-fresh", "rule-ownership-lint", "verify-story-ready", "verify-review-monitor", "verify-l4-owner", "verify-subagent-alive", "verify-subagent-steer", "review-monitor-register", "review-monitor-release", "verify-tools", "verify-wip-cap", "verify-orphan-active", "verify-pr-closeout-attestable", "verify-lifecycle-visible", "verify-completed-tracked", "verify-completed-write-guard", "verify-literal-ac", "verify-ac", "verify-agents-md-budget", "verify-agents-md-advisory", "verify-eval-health-relocation", "verify-eval-triggers-relocation", "verify-evaluator-surface", "verify-observable-scope", "verify-operator-scope-limit", "verify-presentation-ceiling", "verify-intent-constraint", "verify-durable-effect-acquisition", "verify-consumer-test-lane", "eval-health", "eval-run", "eval-report", "eval-triggers"];
+export declare const CLI_MODULE_VERBS: readonly ["agents-refresh", "cache", "check", "capacity-backfill", "capacity-show", "codebase-default-extractor", "codebase-map", "codebase-map-fresh", "codebase-projection-registry", "codebase-provider", "doctor", "ownership-doctor", "ownership-fix", "verify-ownership", "install-upgrade", "install-uninstall", "migrate-preflight", "migrate-xbrief", "migrate-category-b", "framework-check-updates", "hook-dispatch", "umbrella-current-shape", "changelog-check", "change-init", "commit-lint", "coverage-hotspots", "policy", "authz", "escalation-cli", "pr-closing-keywords", "pr-merge-readiness", "pr-monitor", "pr-protected-issues", "pr-wait-mergeable", "pr-watch", "pr-finish-loop", "directive-finish-loop", "pre-pr-run", "preflight-cache", "preflight-gh", "probe-session", "release", "release-e2e", "release-publish", "release-rollback", "release-wait-npm", "scope-lifecycle", "scope-record-approved-scope", "scope-record-observable-scope", "scope-record-intent-constraint", "scm-sync-default", "lifecycle-event", "lifecycle-stats", "session-start", "session-ready", "occupancy-steal", "occupancy-release", "occupancy-heartbeat", "occupancy-grant", "plan-sequence", "slice", "subagent-monitor", "toolchain-check", "triage-actions", "triage-bootstrap", "triage-bulk", "triage-classify", "triage-strip-withdrawn", "triage-evaluate", "triage-help", "triage-queue", "triage-reconcile", "triage-refresh", "triage-scope", "triage-scope-drift", "triage-smoketest", "triage-subscribe", "triage-summary", "triage-welcome", "ts-check-lane", "vbrief-activate", "vbrief-build", "vbrief-preflight", "vbrief-reconcile", "vbrief-validate", "vbrief-validation", "xbrief-create", "xbrief-verify", "xbrief-adopt-stored-plan-id", "verify-branch", "verify-encoding", "verify-forward-coverage", "verify-test-boundary", "verify-class-checks", "verify-presentation-coverage", "verify-scope-provenance", "verify-consumer-check-contract", "verify-hooks-installed", "verify-investigation", "verify-judgment-gates", "verify-no-task-runtime", "validate-links", "validate-strategy-output", "verify-biome-config", "verify-bridge-drift", "verify-capacity", "verify-contained-writes", "verify-telemetry-coverage", "verify-content-manifest", "verify-deposit-closure", "verify-consumer-hard-stops", "verify-closing-keywords", "verify-skill-external-fetch-gate", "verify-semantic-single-source", "verify-contract-drift", "verify-cursor-tier1", "verify-openclaw-tier1", "verify-go-freeze", "verify-scm-boundary", "verify-session-ritual", "verify-plan-sequence", "verify-stubs", "verify-xbrief-drift", "verify-spec-prd-fresh", "rule-ownership-lint", "verify-story-ready", "verify-review-monitor", "verify-l4-owner", "verify-subagent-alive", "verify-subagent-steer", "review-monitor-register", "review-monitor-release", "verify-tools", "verify-wip-cap", "verify-orphan-active", "verify-pr-closeout-attestable", "verify-lifecycle-visible", "verify-completed-tracked", "verify-completed-write-guard", "verify-literal-ac", "verify-ac", "verify-agents-md-budget", "verify-consumer-header-placeholder", "verify-agents-md-advisory", "verify-persisted-planning-narratives", "verify-eval-health-relocation", "verify-eval-triggers-relocation", "verify-evaluator-surface", "verify-observable-scope", "verify-operator-scope-limit", "verify-presentation-ceiling", "verify-intent-constraint", "verify-durable-effect-acquisition", "verify-consumer-test-lane", "eval-health", "eval-run", "eval-report", "eval-triggers"];
 /** Core-only CLI entrypoints without a packages/cli wrapper. */
-export declare const CORE_MODULE_VERBS: readonly ["scm", "scm-readiness", "github-auth-modes", "github-body", "issue-emit", "issue-ingest", "issue-sync-from-xbrief", "reconcile-issues", "swarm-launch", "swarm-complete-cohort", "swarm-finalize-cohort", "swarm-finalize-owed", "swarm-pre-dispatch", "swarm-readiness", "swarm-routing-verify", "swarm-routing-set", "swarm-verify-review-clean", "swarm-worktrees", "framework-commands", "pack-render", "packs-slice", "prd-render", "export-spec", "project-render", "project-write-narratives", "roadmap-render", "rule-map", "spec-render", "spec-validate", "code-structure-validate", "pack-migrate-skills", "pack-migrate-rules", "pack-migrate-strategies", "pack-migrate-patterns", "pack-migrate-swarm-spec", "policy-set", "setup-ghx", "scope-undo", "scope-demote", "scope-decompose", "changelog-resolve-unreleased", "architecture-preflight-sor", "feedback-file", "value-readback", "product-signal", "freshness-report", "decision-write", "decision-list", "docs-impact"];
+export declare const CORE_MODULE_VERBS: readonly ["scm", "scm-readiness", "github-auth-modes", "github-body", "issue-emit", "issue-ingest", "issue-sync-from-xbrief", "reconcile-issues", "swarm-launch", "swarm-complete-cohort", "swarm-finalize-cohort", "swarm-finalize-owed", "swarm-pre-dispatch", "swarm-readiness", "swarm-routing-verify", "swarm-routing-set", "swarm-verify-review-clean", "swarm-worktrees", "framework-commands", "pack-render", "packs-slice", "prd-render", "export-spec", "project-render", "project-write-narratives", "roadmap-render", "rule-map", "spec-render", "spec-validate", "code-structure-validate", "pack-migrate-skills", "pack-migrate-rules", "pack-migrate-strategies", "pack-migrate-patterns", "pack-migrate-swarm-spec", "policy-set", "setup-ghx", "scope-undo", "scope-demote", "scope-decompose", "changelog-resolve-unreleased", "architecture-preflight-sor", "feedback-file", "value-readback", "product-signal", "freshness-report", "decision-write", "decision-list", "docs-impact", "migrate-clause-ids"];
 /** Colon aliases for triage-actions (mirrors cli-router SUBCOMMAND_ROUTES). */
 export declare const TRIAGE_ACTION_ALIAS_SUBCOMMANDS: Readonly<Record<string, string>>;
 /** Colon aliases for policy subcommands (mirrors cli-router SUBCOMMAND_ROUTES). */

package/dist/dispatch.js

@@ -38,6 +38,9 @@ export const CLI_MODULE_VERBS = [
     "codebase-projection-registry",
     "codebase-provider",
     "doctor",
+    "ownership-doctor",
+    "ownership-fix",
+    "verify-ownership",
     "install-upgrade",
     "install-uninstall",
     "migrate-preflight",
@@ -61,6 +64,7 @@ export const CLI_MODULE_VERBS = [
     "pr-watch",
     "pr-finish-loop",
     "directive-finish-loop",
+    "pre-pr-run",
     "preflight-cache",
     "preflight-gh",
     "probe-session",
@@ -165,7 +169,9 @@ export const CLI_MODULE_VERBS = [
     "verify-literal-ac",
     "verify-ac",
     "verify-agents-md-budget",
+    "verify-consumer-header-placeholder",
     "verify-agents-md-advisory",
+    "verify-persisted-planning-narratives",
     "verify-eval-health-relocation",
     "verify-eval-triggers-relocation",
     "verify-evaluator-surface",
@@ -231,6 +237,7 @@ export const CORE_MODULE_VERBS = [
     "decision-write",
     "decision-list",
     "docs-impact",
+    "migrate-clause-ids",
 ];
 /** Colon aliases for triage-actions (mirrors cli-router SUBCOMMAND_ROUTES). */
 export const TRIAGE_ACTION_ALIAS_SUBCOMMANDS = {
@@ -304,6 +311,7 @@ export const FRESHNESS_ALIAS_SUBCOMMANDS = {
 const FRESHNESS_COLON_ALIASES = Object.fromEntries(Object.keys(FRESHNESS_ALIAS_SUBCOMMANDS).map((alias) => [alias, "freshness-report"]));
 /** Task-style aliases (framework_commands / Taskfile names). */
 export const VERB_ALIASES = {
+    "pre-pr:run": "pre-pr-run",
     "hook:dispatch": "hook-dispatch",
     "verify:encoding": "verify-encoding",
     "verify:forward-coverage": "verify-forward-coverage",
@@ -330,7 +338,9 @@ export const VERB_ALIASES = {
     "verify:ac": "verify-ac",
     "verify:acceptance": "verify-ac",
     "verify:agents-md-budget": "verify-agents-md-budget",
+    "verify:consumer-header-placeholder": "verify-consumer-header-placeholder",
     "verify:agents-md-advisory": "verify-agents-md-advisory",
+    "verify:persisted-planning-narratives": "verify-persisted-planning-narratives",
     "verify:eval-health-relocation": "verify-eval-health-relocation",
     "verify:eval-triggers-relocation": "verify-eval-triggers-relocation",
     "verify:evaluator-surface": "verify-evaluator-surface",
@@ -410,6 +420,7 @@ export const VERB_ALIASES = {
     "migrate:preflight": "migrate-preflight",
     "migrate:xbrief": "migrate-xbrief",
     "migrate:category-b": "migrate-category-b",
+    "migrate:clause-ids": "migrate-clause-ids",
     "framework:check-updates": "framework-check-updates",
     "umbrella:current-shape": "umbrella-current-shape",
     "issue:sync-from-xbrief": "issue-sync-from-xbrief",
@@ -437,6 +448,12 @@ export const VERB_ALIASES = {
     "pr:finish-loop": "pr-finish-loop",
     "directive:finish-loop": "directive-finish-loop",
     doctor: "doctor",
+    "ownership:doctor": "ownership-doctor",
+    "ownership:fix": "ownership-fix",
+    "verify:ownership": "verify-ownership",
+    "deft:ownership:doctor": "ownership-doctor",
+    "deft:ownership:fix": "ownership-fix",
+    "deft:verify:ownership": "verify-ownership",
     "eval:health": "eval-health",
     "feedback:file": "feedback-file",
     "value:show": "value-readback",
@@ -2619,6 +2636,10 @@ async function loadCoreModuleHandler(verb, io) {
             const { docsImpactMain } = await import("@deftai/directive-core/dist/docs/docs-impact.js");
             return (argv) => docsImpactMain(argv);
         }
+        case "migrate-clause-ids": {
+            const { mainEntry } = await import("@deftai/directive-core/dist/xbrief-migrate/clause-ids.js");
+            return (argv) => mainEntry(argv);
+        }
         default:
             throw new Error(`unknown core verb: ${verb}`);
     }

package/dist/init-cli/update.js

@@ -1,4 +1,5 @@
 import { parseUpdateArgv, runRefreshDepositCli, UnknownUpdateFlagError, } from "@deftai/directive-core/init-deposit";
+import { refuseIfWslOwnershipBlocked } from "../wsl-ownership-guard.js";
 import { CANONICAL_UPDATE_ARGV, UPDATE_DRY_RUN_FLAGS } from "./constants.js";
 import { argvWantsHelp, printUpdateHelp } from "./help.js";
 /** True when the user argv asked for a classify-only dry-run (`--dry-run`/`--plan`). */
@@ -13,6 +14,12 @@ export function runUpdate(argv, io) {
     }
     try {
         const args = parseUpdateArgv(CANONICAL_UPDATE_ARGV, argv);
+        // #1617: live ownership gate before deposit mutation (dry-run exempt).
+        if (!isUpdateDryRun(argv)) {
+            const blocked = refuseIfWslOwnershipBlocked(args.projectDir, io.writeErr);
+            if (blocked !== null)
+                return Promise.resolve(blocked);
+        }
         return runRefreshDepositCli({
             ...args,
             dryRun: isUpdateDryRun(argv),

package/dist/ownership-doctor.d.ts

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+export interface OwnershipDoctorArgs {
+    projectRoot: string;
+    json: boolean;
+    owner: string | null;
+    error?: string;
+}
+export declare function parseArgs(argv: readonly string[]): OwnershipDoctorArgs;
+export declare function run(argv: readonly string[]): number;
+//# sourceMappingURL=ownership-doctor.d.ts.map

package/dist/ownership-doctor.js

@@ -0,0 +1,96 @@
+#!/usr/bin/env node
+/**
+ * ownership:doctor / ownership-doctor (#1617)
+ * Diagnose WSL root-runtime vs filesystem project-owner mismatch.
+ * Reachable under mismatch (not blocked by the protected-mutation guard).
+ */
+import { resolve } from "node:path";
+import { evaluateWslOwnershipGuard, OWNERSHIP_FACTS_CLASSIFIER, ownershipGuardToDict, } from "@deftai/directive-core/platform";
+import { isDirectEntrypoint } from "./entrypoint.js";
+export function parseArgs(argv) {
+    const parsed = {
+        projectRoot: ".",
+        json: false,
+        owner: null,
+    };
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === "--") {
+        }
+        else if (arg === "--json") {
+            parsed.json = true;
+        }
+        else if (arg === "--project-root") {
+            const value = argv[i + 1];
+            if (value === undefined) {
+                return { ...parsed, error: "argument --project-root: expected one argument" };
+            }
+            parsed.projectRoot = value;
+            i += 1;
+        }
+        else if (arg?.startsWith("--project-root=")) {
+            parsed.projectRoot = arg.slice("--project-root=".length);
+        }
+        else if (arg === "--owner") {
+            const value = argv[i + 1];
+            if (value === undefined) {
+                return { ...parsed, error: "argument --owner: expected uid:gid" };
+            }
+            parsed.owner = value;
+            i += 1;
+        }
+        else if (arg?.startsWith("--owner=")) {
+            parsed.owner = arg.slice("--owner=".length);
+        }
+        else if (arg === "--help" || arg === "-h") {
+            return { ...parsed, error: "__help__" };
+        }
+        else {
+            return { ...parsed, error: `unrecognized argument: ${arg}` };
+        }
+    }
+    return parsed;
+}
+const HELP = "usage: deft ownership:doctor [--project-root PATH] [--owner uid:gid] [--json]\n" +
+    "Diagnose WSL agent-as-root vs filesystem project-owner mismatch (#1617).\n" +
+    `Classifier: ${OWNERSHIP_FACTS_CLASSIFIER}\n` +
+    "Vocabulary: filesystem project-owner (this command) ≠ occupancy/session owner ≠ issue-emit recovery owner.\n" +
+    "Recovery: deft ownership:fix -- --project-root . [--owner uid:gid]\n";
+export function run(argv) {
+    const args = parseArgs(argv);
+    if (args.error === "__help__") {
+        process.stdout.write(HELP);
+        return 0;
+    }
+    if (args.error !== undefined) {
+        process.stderr.write(`ownership:doctor: ${args.error}\n`);
+        return 2;
+    }
+    const projectRoot = resolve(args.projectRoot);
+    const verdict = evaluateWslOwnershipGuard({
+        projectRoot,
+        explicitOwner: args.owner,
+    });
+    if (args.json) {
+        process.stdout.write(`${JSON.stringify(ownershipGuardToDict(verdict), null, 2)}\n`);
+    }
+    else {
+        for (const line of verdict.messages) {
+            process.stdout.write(`${line}\n`);
+        }
+        if (verdict.intendedOwner.uid !== null) {
+            process.stdout.write(`filesystem project-owner: ${verdict.intendedOwner.uid}:${verdict.intendedOwner.gid}` +
+                `${verdict.intendedOwner.account ? ` (${verdict.intendedOwner.account})` : ""}` +
+                ` via ${verdict.intendedOwner.source}\n`);
+        }
+        process.stdout.write(`status=${verdict.status} wsl=${verdict.wsl} mount=${verdict.mount.capability} ` +
+            `block_protected_mutation=${verdict.blockProtectedMutation}\n`);
+    }
+    if (verdict.status === "fail")
+        return 1;
+    return 0;
+}
+if (isDirectEntrypoint(import.meta.url)) {
+    process.exit(run(process.argv.slice(2)));
+}
+//# sourceMappingURL=ownership-doctor.js.map

package/dist/ownership-fix.d.ts

@@ -0,0 +1,10 @@
+#!/usr/bin/env node
+export interface OwnershipFixArgs {
+    projectRoot: string;
+    owner: string | null;
+    json: boolean;
+    error?: string;
+}
+export declare function parseArgs(argv: readonly string[]): OwnershipFixArgs;
+export declare function run(argv: readonly string[]): number;
+//# sourceMappingURL=ownership-fix.d.ts.map

package/dist/ownership-fix.js

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+/**
+ * ownership:fix / ownership-fix (#1617)
+ * Scoped repair of root-owned objects under approved roots only.
+ * Reachable under mismatch; env-sourced owner alone does not authorize chown.
+ */
+import { resolve } from "node:path";
+import { DEFT_PROJECT_OWNER, fixScopedOwnership, OWNERSHIP_FACTS_CLASSIFIER, } from "@deftai/directive-core/platform";
+import { isDirectEntrypoint } from "./entrypoint.js";
+export function parseArgs(argv) {
+    const parsed = {
+        projectRoot: ".",
+        owner: null,
+        json: false,
+    };
+    for (let i = 0; i < argv.length; i += 1) {
+        const arg = argv[i];
+        if (arg === "--") {
+        }
+        else if (arg === "--json") {
+            parsed.json = true;
+        }
+        else if (arg === "--project-root") {
+            const value = argv[i + 1];
+            if (value === undefined) {
+                return { ...parsed, error: "argument --project-root: expected one argument" };
+            }
+            parsed.projectRoot = value;
+            i += 1;
+        }
+        else if (arg?.startsWith("--project-root=")) {
+            parsed.projectRoot = arg.slice("--project-root=".length);
+        }
+        else if (arg === "--owner") {
+            const value = argv[i + 1];
+            if (value === undefined) {
+                return { ...parsed, error: "argument --owner: expected uid:gid" };
+            }
+            parsed.owner = value;
+            i += 1;
+        }
+        else if (arg?.startsWith("--owner=")) {
+            parsed.owner = arg.slice("--owner=".length);
+        }
+        else if (arg === "--help" || arg === "-h") {
+            return { ...parsed, error: "__help__" };
+        }
+        else {
+            return { ...parsed, error: `unrecognized argument: ${arg}` };
+        }
+    }
+    return parsed;
+}
+const HELP = "usage: deft ownership:fix [--project-root PATH] [--owner uid:gid] [--json]\n" +
+    "Repair root-owned objects under approved project roots only (#1617).\n" +
+    "No blanket HOME chown. No symlink follow outside approved roots.\n" +
+    `Pass --owner uid:gid or ${DEFT_PROJECT_OWNER}=uid:gid when inference is ambiguous.\n` +
+    `Classifier: ${OWNERSHIP_FACTS_CLASSIFIER}\n`;
+export function run(argv) {
+    const args = parseArgs(argv);
+    if (args.error === "__help__") {
+        process.stdout.write(HELP);
+        return 0;
+    }
+    if (args.error !== undefined) {
+        process.stderr.write(`ownership:fix: ${args.error}\n`);
+        return 2;
+    }
+    const projectRoot = resolve(args.projectRoot);
+    const result = fixScopedOwnership({
+        projectRoot,
+        explicitOwner: args.owner,
+    });
+    if (args.json) {
+        process.stdout.write(`${JSON.stringify({
+            repaired: result.repaired,
+            skipped_protected: result.skippedProtected,
+            failed: result.failed,
+            messages: result.messages,
+            ok: result.ok,
+        }, null, 2)}\n`);
+    }
+    else {
+        for (const line of result.messages) {
+            process.stdout.write(`${line}\n`);
+        }
+    }
+    return result.exitCode;
+}
+if (isDirectEntrypoint(import.meta.url)) {
+    process.exit(run(process.argv.slice(2)));
+}
+//# sourceMappingURL=ownership-fix.js.map

package/dist/pre-pr-run.d.ts

@@ -0,0 +1,39 @@
+#!/usr/bin/env node
+interface ParsedArgs {
+    repo: string;
+    baseSha: string;
+    headSha: string;
+    treeHash: string;
+    prBodyHash: string;
+    prNodeId: string | null;
+    approvedRevision: string;
+    scope: string[];
+    acceptance: string;
+    generation: number;
+    skillVersion: string;
+    policyVersion: string;
+    runId: string | null;
+    complete: boolean;
+    observeCommand: boolean;
+    observeSemantic: boolean;
+    phase: string | null;
+    command: string;
+    exitCode: number | null;
+    inputHash: string | null;
+    skipReason: string | null;
+    suppliedContentsHash: string;
+    controllerObservedHash: string;
+    criteriaDigest: string | null;
+    reviewedFiles: string[];
+    reviewerReportRef: string | null;
+    markComplete: boolean;
+    skillOpen: boolean;
+    evaluate: boolean;
+    json: boolean;
+    help: boolean;
+    error?: string;
+}
+export declare function parseArgs(argv: string[]): ParsedArgs;
+export declare function run(argv: string[]): number;
+export {};
+//# sourceMappingURL=pre-pr-run.d.ts.map