@deftai/directive 0.119.7 → 0.119.9

package/dist/cli-package-version.d.ts

@@ -0,0 +1,3 @@
+/** Reads `@deftai/directive` version from the installed CLI package.json adjacent to dist/ or src/. */
+export declare function readCliPackageVersion(): string;
+//# sourceMappingURL=cli-package-version.d.ts.map

package/dist/cli-package-version.js

@@ -0,0 +1,23 @@
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+const FALLBACK_VERSION = "0.0.0";
+function parsePackageVersion(raw) {
+    const parsed = JSON.parse(raw);
+    if (parsed === null || typeof parsed !== "object") {
+        return FALLBACK_VERSION;
+    }
+    const version = parsed.version;
+    return typeof version === "string" && version.length > 0 ? version : FALLBACK_VERSION;
+}
+/** Reads `@deftai/directive` version from the installed CLI package.json adjacent to dist/ or src/. */
+export function readCliPackageVersion() {
+    try {
+        const pkgPath = join(dirname(fileURLToPath(import.meta.url)), "..", "package.json");
+        return parsePackageVersion(readFileSync(pkgPath, "utf8"));
+    }
+    catch {
+        return FALLBACK_VERSION;
+    }
+}
+//# sourceMappingURL=cli-package-version.js.map

package/dist/cli-router/route-argv.js

@@ -29,6 +29,7 @@ export const SCOPE_LIFECYCLE_VERBS = new Set([
     "block",
     "unblock",
     "stamp-evidence",
+    "bind-clause",
 ]);
 /** pr:* task names that do not hyphenate 1:1 to handler stems. */
 export const PR_VERB_MAP = {
@@ -82,6 +83,8 @@ export const SUBCOMMAND_ROUTES = {
     "policy:enable-directive": ["policy", "enable-directive"],
     "policy:enforce-branches": ["policy", "enforce-branches"],
     "policy:allow-direct-commits": ["policy", "allow-direct-commits"],
+    "policy:allow-destructive-gh-verbs": ["policy", "allow-destructive-gh-verbs"],
+    "policy:enforce-destructive-gh-verbs": ["policy", "enforce-destructive-gh-verbs"],
     "policy:allow-bot-merge": ["policy", "allow-bot-merge"],
     "policy:enable-value-feedback": ["policy", "enable-value-feedback"],
     "policy:disable-host-hooks": ["policy", "disable-host-hooks"],
@@ -207,6 +210,9 @@ function routeNamespaceVerb(ns, verb, rest) {
     if (ns === "scm" && verb === "issue:design-critique-chip") {
         return { kind: "dispatch", argv: ["scm", "issue", "design-critique-chip", ...rest] };
     }
+    if (ns === "scm" && verb === "issue:design-critique-stale-ready") {
+        return { kind: "dispatch", argv: ["scm", "issue", "design-critique-stale-ready", ...rest] };
+    }
     if (ns === "scm" && verb === "issue:work-claim") {
         return { kind: "dispatch", argv: ["scm", "issue", "work-claim", ...rest] };
     }

package/dist/dispatch.d.ts

@@ -10,9 +10,9 @@ export interface DispatchIo {
     writeErr: (text: string) => void;
 }
 /** CLI modules in packages/cli/src (excluding parity harnesses and bin/index). */
-export declare const CLI_MODULE_VERBS: readonly ["agents-refresh", "cache", "check", "capacity-backfill", "capacity-show", "codebase-default-extractor", "codebase-map", "codebase-map-fresh", "codebase-projection-registry", "codebase-provider", "doctor", "install-upgrade", "install-uninstall", "migrate-preflight", "migrate-xbrief", "migrate-category-b", "framework-check-updates", "hook-dispatch", "umbrella-current-shape", "changelog-check", "change-init", "commit-lint", "coverage-hotspots", "policy", "authz", "escalation-cli", "pr-closing-keywords", "pr-merge-readiness", "pr-monitor", "pr-protected-issues", "pr-wait-mergeable", "pr-watch", "pr-finish-loop", "directive-finish-loop", "preflight-cache", "preflight-gh", "probe-session", "release", "release-e2e", "release-publish", "release-rollback", "release-wait-npm", "scope-lifecycle", "scope-record-approved-scope", "scope-record-observable-scope", "scope-record-intent-constraint", "scm-sync-default", "lifecycle-event", "lifecycle-stats", "session-start", "session-ready", "occupancy-steal", "occupancy-release", "occupancy-heartbeat", "occupancy-grant", "plan-sequence", "slice", "subagent-monitor", "toolchain-check", "triage-actions", "triage-bootstrap", "triage-bulk", "triage-classify", "triage-strip-withdrawn", "triage-evaluate", "triage-help", "triage-queue", "triage-reconcile", "triage-refresh", "triage-scope", "triage-scope-drift", "triage-smoketest", "triage-subscribe", "triage-summary", "triage-welcome", "ts-check-lane", "vbrief-activate", "vbrief-build", "vbrief-preflight", "vbrief-reconcile", "vbrief-validate", "vbrief-validation", "xbrief-create", "xbrief-verify", "verify-branch", "verify-encoding", "verify-forward-coverage", "verify-test-boundary", "verify-scope-provenance", "verify-consumer-check-contract", "verify-hooks-installed", "verify-investigation", "verify-judgment-gates", "verify-no-task-runtime", "validate-links", "validate-strategy-output", "verify-biome-config", "verify-bridge-drift", "verify-capacity", "verify-contained-writes", "verify-telemetry-coverage", "verify-content-manifest", "verify-deposit-closure", "verify-consumer-hard-stops", "verify-closing-keywords", "verify-skill-external-fetch-gate", "verify-semantic-single-source", "verify-contract-drift", "verify-cursor-tier1", "verify-openclaw-tier1", "verify-go-freeze", "verify-scm-boundary", "verify-session-ritual", "verify-plan-sequence", "verify-stubs", "verify-xbrief-drift", "verify-spec-prd-fresh", "rule-ownership-lint", "verify-story-ready", "verify-review-monitor", "verify-l4-owner", "verify-subagent-alive", "verify-subagent-steer", "review-monitor-register", "review-monitor-release", "verify-tools", "verify-wip-cap", "verify-orphan-active", "verify-pr-closeout-attestable", "verify-lifecycle-visible", "verify-completed-tracked", "verify-completed-write-guard", "verify-literal-ac", "verify-ac", "verify-agents-md-budget", "verify-agents-md-advisory", "verify-eval-health-relocation", "verify-eval-triggers-relocation", "verify-evaluator-surface", "verify-observable-scope", "verify-intent-constraint", "verify-consumer-test-lane", "eval-health", "eval-run", "eval-report", "eval-triggers"];
+export declare const CLI_MODULE_VERBS: readonly ["agents-refresh", "cache", "check", "capacity-backfill", "capacity-show", "codebase-default-extractor", "codebase-map", "codebase-map-fresh", "codebase-projection-registry", "codebase-provider", "doctor", "install-upgrade", "install-uninstall", "migrate-preflight", "migrate-xbrief", "migrate-category-b", "framework-check-updates", "hook-dispatch", "umbrella-current-shape", "changelog-check", "change-init", "commit-lint", "coverage-hotspots", "policy", "authz", "escalation-cli", "pr-closing-keywords", "pr-merge-readiness", "pr-monitor", "pr-protected-issues", "pr-wait-mergeable", "pr-watch", "pr-finish-loop", "directive-finish-loop", "preflight-cache", "preflight-gh", "probe-session", "release", "release-e2e", "release-publish", "release-rollback", "release-wait-npm", "scope-lifecycle", "scope-record-approved-scope", "scope-record-observable-scope", "scope-record-intent-constraint", "scm-sync-default", "lifecycle-event", "lifecycle-stats", "session-start", "session-ready", "occupancy-steal", "occupancy-release", "occupancy-heartbeat", "occupancy-grant", "plan-sequence", "slice", "subagent-monitor", "toolchain-check", "triage-actions", "triage-bootstrap", "triage-bulk", "triage-classify", "triage-strip-withdrawn", "triage-evaluate", "triage-help", "triage-queue", "triage-reconcile", "triage-refresh", "triage-scope", "triage-scope-drift", "triage-smoketest", "triage-subscribe", "triage-summary", "triage-welcome", "ts-check-lane", "vbrief-activate", "vbrief-build", "vbrief-preflight", "vbrief-reconcile", "vbrief-validate", "vbrief-validation", "xbrief-create", "xbrief-verify", "xbrief-adopt-stored-plan-id", "verify-branch", "verify-encoding", "verify-forward-coverage", "verify-test-boundary", "verify-class-checks", "verify-scope-provenance", "verify-consumer-check-contract", "verify-hooks-installed", "verify-investigation", "verify-judgment-gates", "verify-no-task-runtime", "validate-links", "validate-strategy-output", "verify-biome-config", "verify-bridge-drift", "verify-capacity", "verify-contained-writes", "verify-telemetry-coverage", "verify-content-manifest", "verify-deposit-closure", "verify-consumer-hard-stops", "verify-closing-keywords", "verify-skill-external-fetch-gate", "verify-semantic-single-source", "verify-contract-drift", "verify-cursor-tier1", "verify-openclaw-tier1", "verify-go-freeze", "verify-scm-boundary", "verify-session-ritual", "verify-plan-sequence", "verify-stubs", "verify-xbrief-drift", "verify-spec-prd-fresh", "rule-ownership-lint", "verify-story-ready", "verify-review-monitor", "verify-l4-owner", "verify-subagent-alive", "verify-subagent-steer", "review-monitor-register", "review-monitor-release", "verify-tools", "verify-wip-cap", "verify-orphan-active", "verify-pr-closeout-attestable", "verify-lifecycle-visible", "verify-completed-tracked", "verify-completed-write-guard", "verify-literal-ac", "verify-ac", "verify-agents-md-budget", "verify-agents-md-advisory", "verify-eval-health-relocation", "verify-eval-triggers-relocation", "verify-evaluator-surface", "verify-observable-scope", "verify-intent-constraint", "verify-consumer-test-lane", "eval-health", "eval-run", "eval-report", "eval-triggers"];
 /** Core-only CLI entrypoints without a packages/cli wrapper. */
-export declare const CORE_MODULE_VERBS: readonly ["scm", "scm-readiness", "github-auth-modes", "github-body", "issue-emit", "issue-ingest", "issue-sync-from-xbrief", "reconcile-issues", "swarm-launch", "swarm-complete-cohort", "swarm-finalize-cohort", "swarm-pre-dispatch", "swarm-readiness", "swarm-routing-verify", "swarm-routing-set", "swarm-verify-review-clean", "swarm-worktrees", "framework-commands", "pack-render", "packs-slice", "prd-render", "export-spec", "project-render", "roadmap-render", "rule-map", "spec-render", "spec-validate", "code-structure-validate", "pack-migrate-skills", "pack-migrate-rules", "pack-migrate-strategies", "pack-migrate-patterns", "pack-migrate-swarm-spec", "policy-set", "setup-ghx", "scope-undo", "scope-demote", "scope-decompose", "changelog-resolve-unreleased", "architecture-preflight-sor", "feedback-file", "value-readback", "product-signal", "freshness-report", "decision-write", "decision-list", "docs-impact"];
+export declare const CORE_MODULE_VERBS: readonly ["scm", "scm-readiness", "github-auth-modes", "github-body", "issue-emit", "issue-ingest", "issue-sync-from-xbrief", "reconcile-issues", "swarm-launch", "swarm-complete-cohort", "swarm-finalize-cohort", "swarm-pre-dispatch", "swarm-readiness", "swarm-routing-verify", "swarm-routing-set", "swarm-verify-review-clean", "swarm-worktrees", "framework-commands", "pack-render", "packs-slice", "prd-render", "export-spec", "project-render", "project-write-narratives", "roadmap-render", "rule-map", "spec-render", "spec-validate", "code-structure-validate", "pack-migrate-skills", "pack-migrate-rules", "pack-migrate-strategies", "pack-migrate-patterns", "pack-migrate-swarm-spec", "policy-set", "setup-ghx", "scope-undo", "scope-demote", "scope-decompose", "changelog-resolve-unreleased", "architecture-preflight-sor", "feedback-file", "value-readback", "product-signal", "freshness-report", "decision-write", "decision-list", "docs-impact"];
 /** Colon aliases for triage-actions (mirrors cli-router SUBCOMMAND_ROUTES). */
 export declare const TRIAGE_ACTION_ALIAS_SUBCOMMANDS: Readonly<Record<string, string>>;
 /** Colon aliases for policy subcommands (mirrors cli-router SUBCOMMAND_ROUTES). */

package/dist/dispatch.js

@@ -14,6 +14,7 @@ import { appendAuditLog, disclosureLine, migrateLegacyPolicyKey, PLAN_POLICY_KEY
 import { defaultWhich } from "@deftai/directive-core/scm";
 import { KNOWN_SUBAGENT_BACKEND_IDS, probeSubagentBackends, resolveSwarmSubagentBackend, } from "@deftai/directive-core/swarm";
 import { withProjectDefinitionMutation, } from "@deftai/directive-core/vbrief-build";
+import { identityBanner } from "./identity-banner.js";
 const HANDLER_KEYS = [
     "run",
     "main",
@@ -110,10 +111,12 @@ export const CLI_MODULE_VERBS = [
     "vbrief-validation",
     "xbrief-create",
     "xbrief-verify",
+    "xbrief-adopt-stored-plan-id",
     "verify-branch",
     "verify-encoding",
     "verify-forward-coverage",
     "verify-test-boundary",
+    "verify-class-checks",
     "verify-scope-provenance",
     "verify-consumer-check-contract",
     "verify-hooks-installed",
@@ -198,6 +201,7 @@ export const CORE_MODULE_VERBS = [
     "prd-render",
     "export-spec",
     "project-render",
+    "project-write-narratives",
     "roadmap-render",
     "rule-map",
     "spec-render",
@@ -240,6 +244,8 @@ export const POLICY_ACTION_ALIAS_SUBCOMMANDS = {
     "policy:show": "show",
     "policy:enforce-branches": "enforce-branches",
     "policy:allow-direct-commits": "allow-direct-commits",
+    "policy:allow-destructive-gh-verbs": "allow-destructive-gh-verbs",
+    "policy:enforce-destructive-gh-verbs": "enforce-destructive-gh-verbs",
     "policy:allow-bot-merge": "allow-bot-merge",
     "policy:enable-value-feedback": "enable-value-feedback",
     "policy:disable-host-hooks": "disable-host-hooks",
@@ -297,6 +303,7 @@ export const VERB_ALIASES = {
     "verify:encoding": "verify-encoding",
     "verify:forward-coverage": "verify-forward-coverage",
     "verify:test-boundary": "verify-test-boundary",
+    "verify:class-checks": "verify-class-checks",
     "verify:scope-provenance": "verify-scope-provenance",
     "scope:record-approved-scope": "scope-record-approved-scope",
     "scope:record-observable-scope": "scope-record-observable-scope",
@@ -335,6 +342,7 @@ export const VERB_ALIASES = {
     "xbrief:preflight": "vbrief-preflight",
     "xbrief:create": "xbrief-create",
     "xbrief:verify": "xbrief-verify",
+    "xbrief:adopt-stored-plan-id": "xbrief-adopt-stored-plan-id",
     "vbrief:activate": "vbrief-activate",
     "verify:story-ready": "verify-story-ready",
     "verify:review-monitor": "verify-review-monitor",
@@ -413,6 +421,7 @@ export const VERB_ALIASES = {
     "spec:render": "spec-render",
     "prd:render": "prd-render",
     "project:render": "project-render",
+    "project:write-narratives": "project-write-narratives",
     "docs:rule-map": "rule-map",
     "project:export-spec": "export-spec",
     "pr:watch": "pr-watch",
@@ -475,6 +484,7 @@ const WRAPPER_CLI_STEMS = new Set([
     "vbrief-validation",
     "xbrief-create",
     "xbrief-verify",
+    "xbrief-adopt-stored-plan-id",
 ]);
 function emitCliResult(result, io) {
     if (result.stdout)
@@ -550,6 +560,10 @@ async function loadWrapperCliHandler(stem, io) {
             const { runXbriefVerifyCli } = await import("@deftai/directive-core/xbrief");
             return (argv) => emitCliResult(runXbriefVerifyCli(argv), io);
         }
+        case "xbrief-adopt-stored-plan-id": {
+            const { runAdoptStoredPlanIdCli } = await import("@deftai/directive-core/xbrief");
+            return (argv) => emitCliResult(runAdoptStoredPlanIdCli(argv), io);
+        }
         default:
             throw new Error(`no wrapper handler for ${stem}`);
     }
@@ -2497,6 +2511,10 @@ async function loadCoreModuleHandler(verb, io) {
             const { runProjectRenderCli } = await import("./render-cli/project-render-cli.js");
             return (argv) => runProjectRenderCli(argv);
         }
+        case "project-write-narratives": {
+            const { writePhase2NarrativesMain } = await import("@deftai/directive-core/dist/render/phase2-narratives-cli.js");
+            return (argv) => writePhase2NarrativesMain(argv);
+        }
         case "rule-map": {
             const { runRuleMapCli } = await import("./render-cli/rule-map-cli.js");
             return (argv) => runRuleMapCli(argv);
@@ -2764,12 +2782,20 @@ const CURATED_HELP_GROUPS = [
                 name: "xbrief:verify",
                 summary: "Verify a dense xBRIEF artifact at --out (requires --format); not scope:*",
             },
+            {
+                name: "xbrief:adopt-stored-plan-id",
+                summary: "Set plan.id from the stored plan-id binding; refuse if another artifact has it",
+            },
         ],
     },
     {
         title: "Project artifacts",
         commands: [
             { name: "project:render", summary: "Render PROJECT-DEFINITION projection" },
+            {
+                name: "project:write-narratives",
+                summary: "Store Phase 2 narratives in PROJECT-DEFINITION without policy keys",
+            },
             { name: "spec:render", summary: "Render specification projection" },
         ],
     },
@@ -2824,7 +2850,6 @@ async function invokeHandler(handler, argv) {
     const code = await handler(argv);
     return typeof code === "number" ? code : 0;
 }
-const CLI_PACKAGE = "@deftai/directive";
 const PLAN_SEQUENCE_VERBS = "set|current|clear|advance";
 /**
  * Unknown-colon-verb remediation (#3439 / #2652).
@@ -2843,8 +2868,7 @@ export function unknownColonVerbHint(verb) {
         `Hyphen stem: ${hyphen}.\n`);
 }
 function versionBanner() {
-    const info = engineInfo();
-    return `${CLI_PACKAGE} (engine: ${info.name}@${info.version})\n`;
+    return `${identityBanner()}\n`;
 }
 /** Dispatch argv to a registered verb; returns the handler exit code. */
 export async function dispatch(argv, io = defaultIo()) {

package/dist/identity-banner.d.ts

@@ -0,0 +1,13 @@
+export declare const CLI_PACKAGE: "@deftai/directive";
+export interface IdentityBannerParts {
+    readonly cliVersion: string;
+    readonly engineName: string;
+    readonly engineVersion: string;
+}
+/**
+ * Display-both identity line. Engine semver is first so parseVersionFromOutput
+ * in active-cli.ts and classify.ts still treat --version as the engine.
+ */
+export declare function formatIdentityBanner(parts: IdentityBannerParts): string;
+export declare function identityBanner(): string;
+//# sourceMappingURL=identity-banner.d.ts.map

package/dist/identity-banner.js

@@ -0,0 +1,19 @@
+import { engineInfo } from "@deftai/directive-core";
+import { readCliPackageVersion } from "./cli-package-version.js";
+export const CLI_PACKAGE = "@deftai/directive";
+/**
+ * Display-both identity line. Engine semver is first so parseVersionFromOutput
+ * in active-cli.ts and classify.ts still treat --version as the engine.
+ */
+export function formatIdentityBanner(parts) {
+    return `${CLI_PACKAGE} (engine: ${parts.engineName}@${parts.engineVersion}; package: ${CLI_PACKAGE}@${parts.cliVersion})`;
+}
+export function identityBanner() {
+    const info = engineInfo();
+    return formatIdentityBanner({
+        cliVersion: readCliPackageVersion(),
+        engineName: info.name,
+        engineVersion: info.version,
+    });
+}
+//# sourceMappingURL=identity-banner.js.map

package/dist/index.d.ts

@@ -5,7 +5,7 @@
  * (cli → core → types), proving the project-reference graph builds and
  * resolves end-to-end. Real commands land in later migration waves.
  */
-export declare const CLI_PACKAGE: "@deftai/directive";
-/** Renders the engine banner string, sourcing core engine metadata. */
+export { CLI_PACKAGE } from "./identity-banner.js";
+/** Renders CLI package and engine identity. First semver is the engine (#4766). */
 export declare function banner(): string;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.js

@@ -1,4 +1,4 @@
-import { engineInfo } from "@deftai/directive-core";
+import { identityBanner } from "./identity-banner.js";
 /**
  * `@deftai/directive` — entrypoint for the deft directive TypeScript engine.
  *
@@ -6,10 +6,9 @@ import { engineInfo } from "@deftai/directive-core";
  * (cli → core → types), proving the project-reference graph builds and
  * resolves end-to-end. Real commands land in later migration waves.
  */
-export const CLI_PACKAGE = "@deftai/directive";
-/** Renders the engine banner string, sourcing core engine metadata. */
+export { CLI_PACKAGE } from "./identity-banner.js";
+/** Renders CLI package and engine identity. First semver is the engine (#4766). */
 export function banner() {
-    const info = engineInfo();
-    return `${CLI_PACKAGE} (engine: ${info.name}@${info.version})`;
+    return identityBanner();
 }
 //# sourceMappingURL=index.js.map

package/dist/policy.d.ts

@@ -8,7 +8,7 @@ interface ShowArgs {
     error?: string;
 }
 interface SetArgs {
-    cmd: "show" | "enforce-branches" | "allow-direct-commits" | "allow-bot-merge" | "enable-value-feedback" | "clear-value-feedback" | "set-ceremony-dial" | "disable-host-hooks" | "disable-directive" | "enable-directive" | "resolve";
+    cmd: "show" | "enforce-branches" | "allow-direct-commits" | "allow-destructive-gh-verbs" | "enforce-destructive-gh-verbs" | "allow-bot-merge" | "enable-value-feedback" | "clear-value-feedback" | "set-ceremony-dial" | "disable-host-hooks" | "disable-directive" | "enable-directive" | "resolve";
     confirm: boolean;
     actor: string;
     note: string;

package/dist/policy.js

@@ -6,7 +6,7 @@
 import { existsSync } from "node:fs";
 import { resolve as pathResolve, relative } from "node:path";
 import { fileURLToPath } from "node:url";
-import { ALLOW_BOT_MERGE_CAPABILITY_COST, CEREMONY_DEPTHS, clearValueFeedback, createNoDeftDirectiveFlag, describeShadowedPlanExtension, detectNoDeftDirective, detectShadowedPlanExtensions, disableHostHooks, disclosureLine, enableValueFeedback, FIELD_VALUE_FEEDBACK, FIELD_VALUE_FEEDBACK_CLI_ALIAS, formatValueFeedbackStatusLine, humanMergeDisclosureLine, inspectAllPolicies, inspectOnePolicy, loadProjectDefinition, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_FLAG_NAME, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, POLICY_AUDIT_NOOP_STDOUT, parseHookHost, policyColonInvocation, projectDefinitionPath, pythonListRepr, pythonStringRepr, registeredPolicyNames, removeNoDeftDirectiveFlag, renderJson, renderText, resolveHumanMergePolicy, resolvePolicy, resolveValueFeedback, setCeremonyDial, setPolicy, setRequireHumanMerge, } from "@deftai/directive-core/policy";
+import { ALLOW_BOT_MERGE_CAPABILITY_COST, ALLOW_DESTRUCTIVE_GH_VERBS_CAPABILITY_COST, CEREMONY_DEPTHS, clearValueFeedback, createNoDeftDirectiveFlag, describeShadowedPlanExtension, detectNoDeftDirective, detectShadowedPlanExtensions, disableHostHooks, disclosureLine, enableValueFeedback, FIELD_VALUE_FEEDBACK, FIELD_VALUE_FEEDBACK_CLI_ALIAS, formatValueFeedbackStatusLine, humanMergeDisclosureLine, inspectAllPolicies, inspectOnePolicy, loadProjectDefinition, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_FLAG_NAME, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, POLICY_AUDIT_NOOP_STDOUT, parseHookHost, policyColonInvocation, projectDefinitionPath, pythonListRepr, pythonStringRepr, registeredPolicyNames, removeNoDeftDirectiveFlag, renderJson, renderText, resolveHumanMergePolicy, resolvePolicy, resolveValueFeedback, setAllowDestructiveGhVerbs, setCeremonyDial, setPolicy, setRequireHumanMerge, } from "@deftai/directive-core/policy";
 const CAPABILITY_COST_DISCLOSURE = "\u26a0 Capability-cost disclosure -- enabling direct commits to the default " +
     "branch turns OFF the deft branch-protection policy.\n" +
     "  \u2022 Pre-commit + pre-push hooks will no longer block default-branch " +
@@ -114,7 +114,7 @@ export function parseShowArgs(argv) {
 /** Parse argv for the policy CLI (show + set subcommands). */
 export function parseArgs(argv) {
     if (argv.length === 0) {
-        const usage = "usage: policy [show|enforce-branches|allow-direct-commits|allow-bot-merge|enable-value-feedback|clear-value-feedback|set-ceremony-dial|disable-host-hooks|disable-directive|enable-directive|resolve] ...";
+        const usage = "usage: policy [show|enforce-branches|allow-direct-commits|allow-destructive-gh-verbs|enforce-destructive-gh-verbs|allow-bot-merge|enable-value-feedback|clear-value-feedback|set-ceremony-dial|disable-host-hooks|disable-directive|enable-directive|resolve] ...";
         return makeSetError(usage);
     }
     const cmd = argv[0];
@@ -148,6 +148,8 @@ export function parseArgs(argv) {
     }
     if (cmd === "enforce-branches" ||
         cmd === "allow-direct-commits" ||
+        cmd === "allow-destructive-gh-verbs" ||
+        cmd === "enforce-destructive-gh-verbs" ||
         cmd === "allow-bot-merge" ||
         cmd === "enable-value-feedback" ||
         cmd === "clear-value-feedback" ||
@@ -160,19 +162,23 @@ export function parseArgs(argv) {
             ? policyColonInvocation("enforce-branches")
             : cmd === "allow-direct-commits"
                 ? policyColonInvocation("allow-direct-commits")
-                : cmd === "allow-bot-merge"
-                    ? policyColonInvocation("allow-bot-merge")
-                    : cmd === "enable-value-feedback"
-                        ? policyColonInvocation("enable-value-feedback")
-                        : cmd === "clear-value-feedback"
-                            ? policyColonInvocation("clear-value-feedback")
-                            : cmd === "set-ceremony-dial"
-                                ? policyColonInvocation("set-ceremony-dial")
-                                : cmd === "disable-host-hooks"
-                                    ? policyColonInvocation("disable-host-hooks")
-                                    : cmd === "disable-directive"
-                                        ? policyColonInvocation("disable-directive")
-                                        : policyColonInvocation("enable-directive");
+                : cmd === "allow-destructive-gh-verbs"
+                    ? policyColonInvocation("allow-destructive-gh-verbs")
+                    : cmd === "enforce-destructive-gh-verbs"
+                        ? policyColonInvocation("enforce-destructive-gh-verbs")
+                        : cmd === "allow-bot-merge"
+                            ? policyColonInvocation("allow-bot-merge")
+                            : cmd === "enable-value-feedback"
+                                ? policyColonInvocation("enable-value-feedback")
+                                : cmd === "clear-value-feedback"
+                                    ? policyColonInvocation("clear-value-feedback")
+                                    : cmd === "set-ceremony-dial"
+                                        ? policyColonInvocation("set-ceremony-dial")
+                                        : cmd === "disable-host-hooks"
+                                            ? policyColonInvocation("disable-host-hooks")
+                                            : cmd === "disable-directive"
+                                                ? policyColonInvocation("disable-directive")
+                                                : policyColonInvocation("enable-directive");
         let note = "";
         let projectRoot = ".";
         let host;
@@ -476,6 +482,51 @@ function runEnableDirective(args) {
     process.stdout.write("Directive opt-out cleared. Run `directive init` or `directive update` to ensure install.\n");
     return 0;
 }
+/** Allow or re-enforce the #1019 destructive-gh-verb gate. */
+function runDestructiveGhVerbs(args) {
+    const projectRoot = pathResolve(args.projectRoot);
+    const allow = args.cmd === "allow-destructive-gh-verbs";
+    if (allow && !args.confirm) {
+        process.stdout.write(`${ALLOW_DESTRUCTIVE_GH_VERBS_CAPABILITY_COST}\n\n`);
+        process.stdout.write(`Re-run with --confirm to apply: ${policyColonInvocation("allow-destructive-gh-verbs", " -- --confirm")}\n`);
+        return 1;
+    }
+    try {
+        const result = setAllowDestructiveGhVerbs(projectRoot, {
+            allowDestructiveGhVerbs: allow,
+            actor: args.actor,
+            note: args.note,
+        });
+        if (!result.ok) {
+            process.stderr.write(`\u274c ${result.message}\n`);
+            if (result.message.includes("PROJECT-DEFINITION not found")) {
+                const pdRel = relative(projectRoot, projectDefinitionPath(projectRoot));
+                process.stderr.write(`  Recovery: run \`task setup\` to generate ${pdRel}.\n`);
+            }
+            return 2;
+        }
+        process.stdout.write(`\u2713 plan.policy.allowDestructiveGhVerbs=${allow ? "true" : "false"} ` +
+            `(#1019 gate ${allow ? "OFF" : "ON"}).\n`);
+        if (result.changed) {
+            process.stdout.write(`  audit: meta/policy-changes.log :: ${result.auditEntry}\n`);
+        }
+        else {
+            process.stdout.write(`${POLICY_AUDIT_NOOP_STDOUT}\n`);
+        }
+        return 0;
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        if (message.includes("PROJECT-DEFINITION not found")) {
+            process.stderr.write(`\u274c ${message}\n`);
+            const pdRel = relative(projectRoot, projectDefinitionPath(projectRoot));
+            process.stderr.write(`  Recovery: run \`task setup\` to generate ${pdRel}.\n`);
+            return 2;
+        }
+        process.stderr.write(`\u274c Config error: ${message}\n`);
+        return 2;
+    }
+}
 /** Allow agent/bot merge by writing requireHumanMerge=false (#1193). */
 function runAllowBotMerge(args) {
     const projectRoot = pathResolve(args.projectRoot);
@@ -539,6 +590,9 @@ export function run(argv) {
     if (args.cmd === "enforce-branches" || args.cmd === "allow-direct-commits") {
         return runSet(args);
     }
+    if (args.cmd === "allow-destructive-gh-verbs" || args.cmd === "enforce-destructive-gh-verbs") {
+        return runDestructiveGhVerbs(args);
+    }
     if (args.cmd === "allow-bot-merge") {
         return runAllowBotMerge(args);
     }

package/dist/preflight-gh.d.ts

@@ -3,6 +3,7 @@ interface ParsedArgs {
     mode?: "self-test" | "command" | "pre-push-stdin";
     command?: string;
     defaultBranches?: Set<string>;
+    projectRoot?: string;
     quiet?: boolean;
     error?: string;
 }

package/dist/preflight-gh.js

@@ -7,11 +7,13 @@
  *   deft-ts preflight-gh --command "<gh ...>"
  *   deft-ts preflight-gh --pre-push-stdin  (reads from stdin)
  *
- * Thin shim -- delegates to @deftai/directive-core/preflight-gh.
+ * Thin shim -- delegates through @deftai/directive-core/preflight
+ * (re-exports the preflight-gh API; vitest already aliases that subpath).
+ * --project-root is consulted by evaluatePrePush / evaluateCommand (#4384).
  */
 import { createInterface } from "node:readline";
 import { fileURLToPath } from "node:url";
-import { DEFAULT_BRANCHES, ENV_BYPASS, evaluateCommand, runSelfTest, } from "@deftai/directive-core/preflight-gh";
+import { DEFAULT_BRANCHES, evaluateCommand, evaluatePrePush, parsePrePushStdin, runSelfTest, } from "@deftai/directive-core/preflight";
 export function parseArgs(argv) {
     const parsed = { defaultBranches: new Set(DEFAULT_BRANCHES) };
     for (let i = 0; i < argv.length; i++) {
@@ -44,7 +46,11 @@ export function parseArgs(argv) {
             i++;
         }
         else if (arg === "--project-root") {
-            // accepted for parity with preflight_branch.py; ignored here
+            const next = argv[i + 1];
+            if (next === undefined) {
+                return { ...parsed, error: "argument --project-root: expected one argument" };
+            }
+            parsed.projectRoot = next;
             i++;
         }
         else {
@@ -73,7 +79,9 @@ export function run(argv) {
         return code;
     }
     if (args.mode === "command" && args.command !== undefined) {
-        const [code, msg] = evaluateCommand(args.command, branches);
+        const [code, msg] = evaluateCommand(args.command, branches, {
+            projectRoot: args.projectRoot,
+        });
         if (code === 0) {
             if (!quiet)
                 process.stdout.write(`${msg}\n`);
@@ -84,85 +92,19 @@ export function run(argv) {
         return code;
     }
     if (args.mode === "pre-push-stdin") {
-        return runPrePushStdin(branches, quiet);
+        return runPrePushStdin(branches, quiet, args.projectRoot);
     }
     process.stderr.write("preflight-gh: one of --self-test / --command / --pre-push-stdin required\n");
     return 2;
 }
-function parsePrePushLines(text) {
-    return text
-        .split("\n")
-        .map((l) => l.trim())
-        .filter((l) => l.length > 0)
-        .flatMap((l) => {
-        const parts = l.split(/\s+/);
-        if (parts.length !== 4)
-            return [];
-        return [
-            {
-                localRef: parts[0] ?? "",
-                localOid: parts[1] ?? "",
-                remoteRef: parts[2] ?? "",
-                remoteOid: parts[3] ?? "",
-            },
-        ];
-    });
-}
-const ZERO_OID_RE = /^0+$/;
-function evaluatePrePush(refs, branches) {
-    if (refs.length === 0) {
-        return [0, "✓ deft destructive-gh-verb gate (pre-push): no refs in stdin -- nothing to gate."];
-    }
-    const branchesLower = new Set([...branches].map((b) => b.toLowerCase()));
-    const blocked = [];
-    for (const { localRef, localOid, remoteRef, remoteOid } of refs) {
-        const branch = remoteRef.replace(/^refs\/heads\//, "");
-        if (!branchesLower.has(branch.toLowerCase()))
-            continue;
-        if (ZERO_OID_RE.test(remoteOid)) {
-            blocked.push(`create ${branch} (local=${localRef})`);
-        }
-        else if (ZERO_OID_RE.test(localOid)) {
-            blocked.push(`delete ${branch}`);
-        }
-        else {
-            blocked.push(`update ${branch} (local=${localRef})`);
-        }
-    }
-    if (blocked.length === 0) {
-        return [
-            0,
-            "✓ deft destructive-gh-verb gate (pre-push): no pushes to default branches detected -- proceeding.",
-        ];
-    }
-    const bypass = (process.env[ENV_BYPASS] ?? "").trim().toLowerCase();
-    if (["1", "true", "yes", "on"].includes(bypass)) {
-        return [
-            0,
-            `⚠ deft destructive-gh-verb gate (pre-push): default-branch push detected (${blocked.join("; ")}) but ${ENV_BYPASS}=1 is set -- policy bypassed for this invocation.`,
-        ];
-    }
-    return [
-        1,
-        [
-            "❌ deft destructive-gh-verb gate (pre-push): refusing to push directly to the default branch.",
-            `  Detail: ${blocked.join("; ")}`,
-            "",
-            "  How to proceed:",
-            "    • push to a feature branch and open a PR",
-            `    • or set the env-var bypass for this shell:  ${ENV_BYPASS}=1`,
-            "  See scm/github.md (## Destructive gh verbs (#1019)).",
-        ].join("\n"),
-    ];
-}
-function runPrePushStdin(branches, quiet) {
+function runPrePushStdin(branches, quiet, projectRoot) {
     return new Promise((resolve) => {
         const lines = [];
         const rl = createInterface({ input: process.stdin });
         rl.on("line", (l) => lines.push(l));
         rl.on("close", () => {
-            const refs = parsePrePushLines(lines.join("\n"));
-            const [code, msg] = evaluatePrePush(refs, branches);
+            const refs = parsePrePushStdin(lines.join("\n"));
+            const [code, msg] = evaluatePrePush(refs, { branches, projectRoot });
             if (code === 0) {
                 if (!quiet)
                     process.stdout.write(`${msg}\n`);

package/dist/scope-record-intent-constraint.d.ts

@@ -5,6 +5,7 @@ export interface ParsedArgs {
     xbriefPath: string;
     actor: string;
     kind: string;
+    mintedVia: string;
     quiet: boolean;
     confirm: boolean;
     help?: boolean;

package/dist/scope-record-intent-constraint.js

@@ -11,12 +11,18 @@ import { buildIntentConstraintRecord, extractIntentConstraintFromPlan, parseInte
 import { isDirectEntrypoint } from "./entrypoint.js";
 import { refuseMintWhileUatActive, refuseNonInteractiveMint, resolveHumanPresenceMintSeams, } from "./human-presence-mint.js";
 import { isPathInsideRoot } from "./scope-record-approved-scope.js";
+const DEFAULT_MINTED_VIA = "scope:record-intent-constraint";
+const ALLOWED_MINTED_VIA = new Set([DEFAULT_MINTED_VIA, "in-harness-ask"]);
 function usage() {
     return ("usage: scope:record-intent-constraint -- <xbrief-path> --actor <name> --confirm " +
-        "[--kind operator] [--project-root <dir>] [--quiet]\n" +
+        "[--kind operator] [--minted-via in-harness-ask|scope:record-intent-constraint] " +
+        "[--project-root <dir>] [--quiet]\n" +
         '  Writes .deft/intent-constraint/<plan-id>.json from plan["x-directive/intentConstraint"].\n' +
-        "  --actor is display only and never authorizes mint. Mint requires a real TTY, " +
-        "controlling terminal, --confirm, and typed phrase mint (#3110). Agent/CI shells refuse.");
+        "  Attended mid-build (#5010): ask in parent chat; on yes the human runs this verb on a real TTY " +
+        "with --minted-via=in-harness-ask (attestation is not an agent-shell bypass). Commit the record on " +
+        "the delivery-branch merge base, then rebase the implementation branch — same-PR working-tree-only " +
+        "records are not authoritative. Unattended/C1: rewrite or park. --actor is display only. Mint still " +
+        "requires a real TTY, controlling terminal, --confirm, and typed phrase mint (#3110). Agent/CI shells refuse.");
 }
 function extractPlanId(payload) {
     if (payload === null || typeof payload !== "object" || Array.isArray(payload))
@@ -33,6 +39,7 @@ export function parseArgs(argv) {
         xbriefPath: "",
         actor: "",
         kind: "operator",
+        mintedVia: DEFAULT_MINTED_VIA,
         quiet: false,
         confirm: false,
     };
@@ -77,6 +84,16 @@ export function parseArgs(argv) {
         else if (arg?.startsWith("--kind=")) {
             parsed.kind = arg.slice("--kind=".length);
         }
+        else if (arg === "--minted-via") {
+            const value = argv[i + 1];
+            if (value === undefined)
+                return { ...parsed, error: "argument --minted-via: expected one argument" };
+            parsed.mintedVia = value;
+            i += 1;
+        }
+        else if (arg?.startsWith("--minted-via=")) {
+            parsed.mintedVia = arg.slice("--minted-via=".length);
+        }
         else if (arg?.startsWith("-")) {
             return { ...parsed, error: `unrecognized argument: ${arg}` };
         }
@@ -98,6 +115,13 @@ export function parseArgs(argv) {
             error: `argument --actor is required (human operator identity)\n${usage()}`,
         };
     }
+    if (!ALLOWED_MINTED_VIA.has(parsed.mintedVia.trim())) {
+        return {
+            ...parsed,
+            error: `argument --minted-via must be one of: ${[...ALLOWED_MINTED_VIA].join(", ")}\n${usage()}`,
+        };
+    }
+    parsed.mintedVia = parsed.mintedVia.trim();
     return parsed;
 }
 export function run(argv, seams = {}) {
@@ -159,7 +183,7 @@ export function run(argv, seams = {}) {
             kind: args.kind,
             actor: args.actor,
             mintedAt: new Date().toISOString().replace(/\.\d{3}Z$/, "Z"),
-            mintedVia: "scope:record-intent-constraint",
+            mintedVia: args.mintedVia,
         },
     });
     if ("error" in rec) {