@deftai/directive 0.121.0 → 0.123.0

package/dist/authz.js

@@ -10,6 +10,7 @@
  *   deft authz:grant -- --operations edit,push --surfaces 'src/**' --cohort <id> ... [--confirm]
  *   deft authz:grant -- --template release-publish --target 0.30.0 [--confirm]
  *   deft authz:grant -- --template finish-loop [--confirm]
+ *   deft authz:grant -- --template spec-drift-override --target <baseline> --plan-ref <scopeId> --story-ids <ids> [--confirm]
  *   deft authz:grant -- --parent <parent.xbrief.json> --draft <draft.json> [--repo owner/name] [--confirm]
  *   deft authz:revoke -- <grant-id> [--confirm]
  *
@@ -28,6 +29,7 @@ import { isAbsolute, resolve } from "node:path";
 import { onePrUnit } from "@deftai/directive-core";
 import { AFK_TEMPLATE_NAMES, AUTHZ_OPERATIONS, CLOSED_VERB_TEMPLATE_NAMES, FINISH_LOOP_TEMPLATE_NAME, formatDecomposeStructuralMintCommand, isAfkTemplateName, isClosedVerbTemplateName, isFinishLoopTemplateName, mintAfkTemplateGrant, mintDecomposeStructuralApplyGrant, mintHumanOriginGrant, revokeGrant, showAuthzSnapshot, startUatLease, suspendUatLease, toProjectRelativePosix, } from "@deftai/directive-core/authz";
 import { uatCampaignEndSeal } from "@deftai/directive-core/authz/campaign-end-seal";
+import { isSpecDriftOverrideTemplateName, mintSpecDriftOverrideTemplateGrant, SPEC_DRIFT_OVERRIDE_TEMPLATE_NAME, } from "@deftai/directive-core/policy";
 import { refuseMintWhileUatActive, refuseNonInteractiveMint, resolveHumanPresenceMintSeams, } from "./human-presence-mint.js";
 export { AUTHZ_AGENT_SHELL_ENV_MARKERS, AUTHZ_INTERACTIVE_CONFIRM_PHRASE, } from "./human-presence-mint.js";
 function parseOps(raw) {
@@ -479,10 +481,51 @@ export function main(argv = process.argv.slice(2), seams = {}) {
                     process.stdout.write(`  origins=${claim.origins.map((o) => `${o.repo}#${o.issueId}`).join(",")}\n`);
                     return 0;
                 }
+                // Spec-drift override hatch (#5350): policy module, not authz/** (class 4).
+                if (args.template !== null && isSpecDriftOverrideTemplateName(args.template)) {
+                    if (args.target === null || args.target.trim().length === 0) {
+                        process.stderr.write("authz:grant --template spec-drift-override requires --target <baselineRevision>\n");
+                        return 2;
+                    }
+                    if (args.planRef === null || args.planRef.trim().length === 0) {
+                        process.stderr.write("authz:grant --template spec-drift-override requires --plan-ref <scopeId>\n");
+                        return 2;
+                    }
+                    if (args.storyIds.length === 0) {
+                        process.stderr.write("authz:grant --template spec-drift-override requires --story-ids <covered-item-ids>\n");
+                        return 2;
+                    }
+                    const blockedOverride = gateConfirm();
+                    if (blockedOverride !== null)
+                        return blockedOverride;
+                    const mintedOverride = mintSpecDriftOverrideTemplateGrant({
+                        projectRoot: args.projectRoot,
+                        target: args.target,
+                        planRef: args.planRef,
+                        storyIds: args.storyIds,
+                        actor: args.actor,
+                        expiresAt: args.expiresAt,
+                        singleUse: args.singleUse,
+                        repo: args.repo,
+                        branch: args.branch,
+                    });
+                    if (!mintedOverride.ok) {
+                        process.stderr.write(`authz:grant: ${mintedOverride.reason}\n`);
+                        return 2;
+                    }
+                    const overrideGrant = mintedOverride.grant;
+                    process.stdout.write(`✓ human-origin grant minted id=${overrideGrant.id} origin=${overrideGrant.origin.kind} ` +
+                        `template=${SPEC_DRIFT_OVERRIDE_TEMPLATE_NAME}\n`);
+                    process.stdout.write(`  ops=[${overrideGrant.scope.operations.join(",")}] scope=${overrideGrant.scope.planRef} ` +
+                        `items=${overrideGrant.scope.storyIds.join(",")} surfaces=${overrideGrant.scope.surfaces.join(", ")}\n`);
+                    process.stdout.write("  Hatch: discharges rewrite/coverage refuse for bound ids only under enforce; single-use preferred.\n");
+                    process.stdout.write("  Authorization SoT: Wave 1 grant store (.deft/authz/grants) — not session-auth.\n");
+                    return 0;
+                }
                 // AFK template path (#1095 / #871): presets only — still mintHumanOriginGrant.
                 if (args.template !== null && args.template.trim().length > 0) {
                     if (!isAfkTemplateName(args.template)) {
-                        process.stderr.write(`authz:grant unknown --template '${args.template}'; expected one of: ${AFK_TEMPLATE_NAMES.join(", ")}\n`);
+                        process.stderr.write(`authz:grant unknown --template '${args.template}'; expected one of: ${AFK_TEMPLATE_NAMES.join(", ")}, ${SPEC_DRIFT_OVERRIDE_TEMPLATE_NAME}\n`);
                         return 2;
                     }
                     if (isClosedVerbTemplateName(args.template) &&
@@ -526,7 +569,7 @@ export function main(argv = process.argv.slice(2), seams = {}) {
                     return 0;
                 }
                 if (args.operations.length === 0) {
-                    process.stderr.write("authz:grant requires --operations <edit,push,...>, --template <finish-loop|release-*>, " +
+                    process.stderr.write("authz:grant requires --operations <edit,push,...>, --template <finish-loop|release-*|spec-drift-override>, " +
                         "or --parent + --draft (structural scope:decompose apply)\n");
                     return 2;
                 }

package/dist/cli-router/route-argv.js

@@ -89,6 +89,7 @@ export const SUBCOMMAND_ROUTES = {
     "policy:enable-value-feedback": ["policy", "enable-value-feedback"],
     "policy:disable-host-hooks": ["policy", "disable-host-hooks"],
     "policy:set-ceremony-dial": ["policy", "set-ceremony-dial"],
+    "policy:set-spec-guard-enforcement": ["policy", "set-spec-guard-enforcement"],
     "policy:clear-value-feedback": ["policy", "clear-value-feedback"],
     "authz:show": ["authz", "show"],
     "authz:uat-start": ["authz", "uat-start"],

package/dist/coverage-hotspots.js

@@ -127,6 +127,16 @@ export function run(argv) {
         pathFilter: args.pathFilter.length > 0 ? args.pathFilter : null,
         useDiffPaths: args.useDiffPaths,
     });
+    // Exit 3 = authorized coverage N/A (#5421); keep machine-readable artifact on stdout for --json.
+    if (result.exitCode === 3) {
+        if (args.json && result.applicability) {
+            process.stdout.write(`${JSON.stringify(result.applicability, null, 2)}\n`);
+        }
+        else if (!args.quiet) {
+            process.stderr.write(`${result.message}\n`);
+        }
+        return result.exitCode;
+    }
     if (result.exitCode === 2 || result.report === null) {
         process.stderr.write(`${result.message}\n`);
         return result.exitCode;

package/dist/dispatch.d.ts

@@ -12,7 +12,7 @@ export interface DispatchIo {
 /** CLI modules in packages/cli/src (excluding parity harnesses and bin/index). */
 export declare const CLI_MODULE_VERBS: readonly ["agents-refresh", "cache", "check", "capacity-backfill", "capacity-show", "codebase-default-extractor", "codebase-map", "codebase-map-fresh", "codebase-projection-registry", "codebase-provider", "doctor", "ownership-doctor", "ownership-fix", "verify-ownership", "install-upgrade", "install-uninstall", "migrate-preflight", "migrate-xbrief", "migrate-category-b", "framework-check-updates", "hook-dispatch", "umbrella-current-shape", "changelog-check", "change-init", "commit-lint", "coverage-hotspots", "policy", "authz", "escalation-cli", "pr-closing-keywords", "pr-merge-readiness", "pr-monitor", "pr-protected-issues", "pr-wait-mergeable", "pr-watch", "pr-finish-loop", "directive-finish-loop", "pre-pr-run", "preflight-cache", "preflight-gh", "probe-session", "release", "release-e2e", "release-publish", "release-rollback", "release-wait-npm", "scope-lifecycle", "scope-record-approved-scope", "scope-record-observable-scope", "scope-record-intent-constraint", "scm-sync-default", "lifecycle-event", "lifecycle-stats", "session-start", "session-ready", "occupancy-steal", "occupancy-release", "occupancy-heartbeat", "occupancy-grant", "plan-sequence", "slice", "subagent-monitor", "toolchain-check", "triage-actions", "triage-bootstrap", "triage-bulk", "triage-classify", "triage-strip-withdrawn", "triage-evaluate", "triage-help", "triage-queue", "triage-reconcile", "triage-refresh", "triage-scope", "triage-scope-drift", "triage-smoketest", "triage-subscribe", "triage-summary", "triage-welcome", "ts-check-lane", "vbrief-activate", "vbrief-build", "vbrief-preflight", "vbrief-reconcile", "vbrief-validate", "vbrief-validation", "xbrief-create", "xbrief-verify", "xbrief-adopt-stored-plan-id", "verify-branch", "verify-encoding", "verify-forward-coverage", "verify-test-boundary", "verify-class-checks", "verify-presentation-coverage", "verify-scope-provenance", "verify-consumer-check-contract", "verify-hooks-installed", "verify-investigation", "verify-judgment-gates", "verify-no-task-runtime", "validate-links", "validate-strategy-output", "verify-biome-config", "verify-bridge-drift", "verify-capacity", "verify-contained-writes", "verify-telemetry-coverage", "verify-content-manifest", "verify-deposit-closure", "verify-consumer-hard-stops", "verify-closing-keywords", "verify-skill-external-fetch-gate", "verify-semantic-single-source", "verify-contract-drift", "verify-cursor-tier1", "verify-openclaw-tier1", "verify-go-freeze", "verify-scm-boundary", "verify-session-ritual", "verify-plan-sequence", "verify-stubs", "verify-xbrief-drift", "verify-spec-prd-fresh", "verify-spec-drift", "rule-ownership-lint", "verify-story-ready", "verify-review-monitor", "verify-cohort-review-monitors", "verify-l4-owner", "verify-subagent-alive", "verify-subagent-steer", "subagent-pre-cancel", "subagent-steer-write", "review-monitor-register", "review-monitor-release", "verify-tools", "verify-wip-cap", "verify-orphan-active", "verify-pr-closeout-attestable", "verify-lifecycle-visible", "verify-completed-tracked", "verify-completed-write-guard", "verify-literal-ac", "verify-ac", "verify-agents-md-budget", "verify-consumer-header-placeholder", "verify-agents-md-advisory", "verify-persisted-planning-narratives", "verify-eval-health-relocation", "verify-eval-triggers-relocation", "verify-evaluator-surface", "verify-observable-scope", "verify-operator-scope-limit", "verify-presentation-ceiling", "verify-intent-constraint", "verify-durable-effect-acquisition", "verify-consumer-test-lane", "eval-health", "eval-run", "eval-report", "eval-triggers"];
 /** Core-only CLI entrypoints without a packages/cli wrapper. */
-export declare const CORE_MODULE_VERBS: readonly ["scm", "scm-readiness", "github-auth-modes", "github-body", "issue-emit", "issue-ingest", "issue-sync-from-xbrief", "reconcile-issues", "swarm-launch", "swarm-complete-cohort", "swarm-finalize-cohort", "swarm-finalize-owed", "swarm-pre-dispatch", "swarm-readiness", "swarm-routing-verify", "swarm-routing-set", "swarm-verify-review-clean", "swarm-worktrees", "framework-commands", "pack-render", "packs-slice", "prd-render", "export-spec", "project-render", "project-write-narratives", "roadmap-render", "rule-map", "spec-render", "spec-reconstruct", "spec-validate", "code-structure-validate", "pack-migrate-skills", "pack-migrate-rules", "pack-migrate-strategies", "pack-migrate-patterns", "pack-migrate-swarm-spec", "policy-set", "setup-ghx", "scope-undo", "scope-demote", "scope-decompose", "changelog-resolve-unreleased", "architecture-preflight-sor", "feedback-file", "value-readback", "product-signal", "freshness-report", "decision-write", "decision-list", "docs-impact", "migrate-clause-ids"];
+export declare const CORE_MODULE_VERBS: readonly ["scm", "scm-readiness", "github-auth-modes", "github-body", "issue-emit", "issue-ingest", "issue-sync-from-xbrief", "reconcile-issues", "swarm-launch", "swarm-complete-cohort", "swarm-finalize-cohort", "swarm-finalize-owed", "swarm-pre-dispatch", "swarm-readiness", "swarm-routing-verify", "swarm-routing-set", "swarm-verify-review-clean", "swarm-worktrees", "framework-commands", "pack-render", "packs-slice", "prd-render", "export-spec", "project-render", "project-write-narratives", "roadmap-render", "rule-map", "spec-render", "spec-reconstruct", "spec-validate", "code-structure-validate", "pack-migrate-skills", "pack-migrate-rules", "pack-migrate-strategies", "pack-migrate-patterns", "pack-migrate-swarm-spec", "policy-set", "setup-ghx", "scope-undo", "scope-demote", "scope-decompose", "changelog-resolve-unreleased", "architecture-preflight-sor", "feedback-file", "value-readback", "product-signal", "freshness-report", "decision-write", "decision-list", "docs-impact", "migrate-clause-ids", "migrate-confidence"];
 /** Colon aliases for triage-actions (mirrors cli-router SUBCOMMAND_ROUTES). */
 export declare const TRIAGE_ACTION_ALIAS_SUBCOMMANDS: Readonly<Record<string, string>>;
 /** Colon aliases for policy subcommands (mirrors cli-router SUBCOMMAND_ROUTES). */

package/dist/dispatch.js

@@ -243,6 +243,7 @@ export const CORE_MODULE_VERBS = [
     "decision-list",
     "docs-impact",
     "migrate-clause-ids",
+    "migrate-confidence",
 ];
 /** Colon aliases for triage-actions (mirrors cli-router SUBCOMMAND_ROUTES). */
 export const TRIAGE_ACTION_ALIAS_SUBCOMMANDS = {
@@ -265,6 +266,7 @@ export const POLICY_ACTION_ALIAS_SUBCOMMANDS = {
     "policy:enforce-destructive-gh-verbs": "enforce-destructive-gh-verbs",
     "policy:allow-bot-merge": "allow-bot-merge",
     "policy:enable-value-feedback": "enable-value-feedback",
+    "policy:set-spec-guard-enforcement": "set-spec-guard-enforcement",
     "policy:disable-host-hooks": "disable-host-hooks",
     "policy:set-ceremony-dial": "set-ceremony-dial",
     "policy:clear-value-feedback": "clear-value-feedback",
@@ -430,6 +432,7 @@ export const VERB_ALIASES = {
     "migrate:xbrief": "migrate-xbrief",
     "migrate:category-b": "migrate-category-b",
     "migrate:clause-ids": "migrate-clause-ids",
+    "migrate:confidence": "migrate-confidence",
     "framework:check-updates": "framework-check-updates",
     "umbrella:current-shape": "umbrella-current-shape",
     "issue:sync-from-xbrief": "issue-sync-from-xbrief",
@@ -2655,6 +2658,10 @@ async function loadCoreModuleHandler(verb, io) {
             const { mainEntry } = await import("@deftai/directive-core/dist/xbrief-migrate/clause-ids.js");
             return (argv) => mainEntry(argv);
         }
+        case "migrate-confidence": {
+            const { mainEntry } = await import("@deftai/directive-core/dist/xbrief-migrate/confidence.js");
+            return (argv) => mainEntry(argv);
+        }
         default:
             throw new Error(`unknown core verb: ${verb}`);
     }

package/dist/policy.d.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { type CeremonyDepth, type HookHost } from "@deftai/directive-core/policy";
+import { type CeremonyDepth, type HookHost, type SpecGuardEnforcement } from "@deftai/directive-core/policy";
 interface ShowArgs {
     format: "text" | "json";
     changedOnly: boolean;
@@ -8,7 +8,7 @@ interface ShowArgs {
     error?: string;
 }
 interface SetArgs {
-    cmd: "show" | "enforce-branches" | "allow-direct-commits" | "allow-destructive-gh-verbs" | "enforce-destructive-gh-verbs" | "allow-bot-merge" | "enable-value-feedback" | "clear-value-feedback" | "set-ceremony-dial" | "disable-host-hooks" | "disable-directive" | "enable-directive" | "resolve";
+    cmd: "show" | "enforce-branches" | "allow-direct-commits" | "allow-destructive-gh-verbs" | "enforce-destructive-gh-verbs" | "allow-bot-merge" | "enable-value-feedback" | "clear-value-feedback" | "set-ceremony-dial" | "set-spec-guard-enforcement" | "disable-host-hooks" | "disable-directive" | "enable-directive" | "resolve";
     confirm: boolean;
     actor: string;
     note: string;
@@ -21,6 +21,8 @@ interface SetArgs {
     ceremonyOverride?: CeremonyDepth | null;
     /** #3214 ceremony dial enabled flag for set-ceremony-dial. */
     ceremonyEnabled?: boolean;
+    /** #5350 driftGuard.enforcement target for set-spec-guard-enforcement. */
+    specGuardEnforcement?: SpecGuardEnforcement;
     error?: string;
 }
 /** Parse policy:show flags (mirrors _policy_show_cli.py). */

package/dist/policy.js

@@ -6,7 +6,7 @@
 import { existsSync } from "node:fs";
 import { resolve as pathResolve, relative } from "node:path";
 import { fileURLToPath } from "node:url";
-import { ALLOW_BOT_MERGE_CAPABILITY_COST, ALLOW_DESTRUCTIVE_GH_VERBS_CAPABILITY_COST, CEREMONY_DEPTHS, clearValueFeedback, createNoDeftDirectiveFlag, describeShadowedPlanExtension, detectNoDeftDirective, detectShadowedPlanExtensions, disableHostHooks, disclosureLine, enableValueFeedback, FIELD_VALUE_FEEDBACK, FIELD_VALUE_FEEDBACK_CLI_ALIAS, formatValueFeedbackStatusLine, humanMergeDisclosureLine, inspectAllPolicies, inspectOnePolicy, loadProjectDefinition, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_FLAG_NAME, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, POLICY_AUDIT_NOOP_STDOUT, parseHookHost, policyColonInvocation, projectDefinitionPath, pythonListRepr, pythonStringRepr, registeredPolicyNames, removeNoDeftDirectiveFlag, renderJson, renderText, resolveHumanMergePolicy, resolvePolicy, resolveValueFeedback, setAllowDestructiveGhVerbs, setCeremonyDial, setPolicy, setRequireHumanMerge, } from "@deftai/directive-core/policy";
+import { ALLOW_BOT_MERGE_CAPABILITY_COST, ALLOW_DESTRUCTIVE_GH_VERBS_CAPABILITY_COST, CEREMONY_DEPTHS, clearValueFeedback, createNoDeftDirectiveFlag, describeShadowedPlanExtension, detectNoDeftDirective, detectShadowedPlanExtensions, disableHostHooks, disclosureLine, enableValueFeedback, FIELD_VALUE_FEEDBACK, FIELD_VALUE_FEEDBACK_CLI_ALIAS, formatValueFeedbackStatusLine, humanMergeDisclosureLine, inspectAllPolicies, inspectOnePolicy, loadProjectDefinition, NO_DEFT_DIRECTIVE_DISABLED_MESSAGE, NO_DEFT_DIRECTIVE_FLAG_NAME, NO_DEFT_DIRECTIVE_INCONSISTENT_MESSAGE, POLICY_AUDIT_NOOP_STDOUT, parseHookHost, policyColonInvocation, projectDefinitionPath, promoteSpecGuardDriftEnforcement, pythonListRepr, pythonStringRepr, registeredPolicyNames, removeNoDeftDirectiveFlag, renderJson, renderText, resolveHumanMergePolicy, resolvePolicy, resolveValueFeedback, SPEC_GUARD_ENFORCEMENTS, setAllowDestructiveGhVerbs, setCeremonyDial, setPolicy, setRequireHumanMerge, } from "@deftai/directive-core/policy";
 const CAPABILITY_COST_DISCLOSURE = "\u26a0 Capability-cost disclosure -- enabling direct commits to the default " +
     "branch turns OFF the deft branch-protection policy.\n" +
     "  \u2022 Pre-commit + pre-push hooks will no longer block default-branch " +
@@ -114,10 +114,87 @@ export function parseShowArgs(argv) {
 /** Parse argv for the policy CLI (show + set subcommands). */
 export function parseArgs(argv) {
     if (argv.length === 0) {
-        const usage = "usage: policy [show|enforce-branches|allow-direct-commits|allow-destructive-gh-verbs|enforce-destructive-gh-verbs|allow-bot-merge|enable-value-feedback|clear-value-feedback|set-ceremony-dial|disable-host-hooks|disable-directive|enable-directive|resolve] ...";
+        const usage = "usage: policy [show|enforce-branches|allow-direct-commits|allow-destructive-gh-verbs|enforce-destructive-gh-verbs|allow-bot-merge|enable-value-feedback|clear-value-feedback|set-ceremony-dial|set-spec-guard-enforcement|disable-host-hooks|disable-directive|enable-directive|resolve] ...";
         return makeSetError(usage);
     }
     const cmd = argv[0];
+    if (cmd === "set-spec-guard-enforcement") {
+        let confirm = false;
+        let actor = policyColonInvocation("set-spec-guard-enforcement");
+        let note = "";
+        let projectRoot = ".";
+        let specGuardEnforcement;
+        for (let i = 1; i < argv.length; i += 1) {
+            const arg = argv[i];
+            if (arg === "--confirm") {
+                confirm = true;
+            }
+            else if (arg === "--actor") {
+                const v = argv[i + 1];
+                if (v === undefined)
+                    return makeSetError("argument --actor: expected one argument");
+                actor = v;
+                i += 1;
+            }
+            else if (arg?.startsWith("--actor=")) {
+                actor = arg.slice("--actor=".length);
+            }
+            else if (arg === "--note") {
+                const v = argv[i + 1];
+                if (v === undefined)
+                    return makeSetError("argument --note: expected one argument");
+                note = v;
+                i += 1;
+            }
+            else if (arg?.startsWith("--note=")) {
+                note = arg.slice("--note=".length);
+            }
+            else if (arg === "--set") {
+                const v = argv[i + 1];
+                if (v === undefined) {
+                    return makeSetError("argument --set: expected advise|shadow|enforce");
+                }
+                if (!SPEC_GUARD_ENFORCEMENTS.has(v)) {
+                    return makeSetError(`argument --set: expected advise|shadow|enforce, got ${JSON.stringify(v)}`);
+                }
+                specGuardEnforcement = v;
+                i += 1;
+            }
+            else if (arg?.startsWith("--set=")) {
+                const v = arg.slice("--set=".length);
+                if (!SPEC_GUARD_ENFORCEMENTS.has(v)) {
+                    return makeSetError(`argument --set: expected advise|shadow|enforce, got ${JSON.stringify(v)}`);
+                }
+                specGuardEnforcement = v;
+            }
+            else if (arg === "--project-root") {
+                const v = argv[i + 1];
+                if (v === undefined)
+                    return makeSetError("argument --project-root: expected one argument");
+                projectRoot = v;
+                i += 1;
+            }
+            else if (arg?.startsWith("--project-root=")) {
+                projectRoot = arg.slice("--project-root=".length);
+            }
+            else if (arg === "--") {
+            }
+            else {
+                return makeSetError(`unrecognized argument: ${arg}`);
+            }
+        }
+        return {
+            cmd: "set-spec-guard-enforcement",
+            confirm,
+            actor,
+            note,
+            projectRoot,
+            format: "text",
+            changedOnly: false,
+            field: null,
+            specGuardEnforcement,
+        };
+    }
     if (cmd === "show") {
         const show = parseShowArgs(argv.slice(1));
         return {
@@ -608,6 +685,9 @@ export function run(argv) {
     if (args.cmd === "set-ceremony-dial") {
         return runSetCeremonyDial(args);
     }
+    if (args.cmd === "set-spec-guard-enforcement") {
+        return runSetSpecGuardEnforcement(args);
+    }
     if (args.cmd === "disable-directive") {
         return runDisableDirective(args);
     }
@@ -616,6 +696,24 @@ export function run(argv) {
     }
     return 2;
 }
+/** Persist plan.policy.specGuard.driftGuard.enforcement (#5350). */
+function runSetSpecGuardEnforcement(args) {
+    const root = pathResolve(args.projectRoot);
+    if (args.specGuardEnforcement === undefined) {
+        process.stdout.write("usage: policy set-spec-guard-enforcement -- --set advise|shadow|enforce [--confirm] [--project-root PATH]\n" +
+            "  Promote ladder: advise → shadow → enforce (advise→enforce skip refused without shadow attestation).\n" +
+            `  Inspect: ${policyColonInvocation("show", " --field=specGuard")}\n`);
+        return 1;
+    }
+    const result = promoteSpecGuardDriftEnforcement(root, {
+        to: args.specGuardEnforcement,
+        confirm: args.confirm,
+        actor: args.actor,
+        note: args.note,
+    });
+    process.stdout.write(result.stdout);
+    return result.exitCode;
+}
 /** Persist plan.policy.ceremonyDial override/enabled (#3214). */
 function runSetCeremonyDial(args) {
     const root = pathResolve(args.projectRoot);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deftai/directive",
-  "version": "0.121.0",
+  "version": "0.123.0",
   "description": "Directive CLI — npm install path for the Deft Directive framework.",
   "license": "MIT",
   "homepage": "https://deftai.github.io/directive/",
@@ -35,8 +35,8 @@
     "provenance": true
   },
   "dependencies": {
-    "@deftai/directive-core": "^0.121.0",
-    "@deftai/directive-content": "^0.121.0"
+    "@deftai/directive-core": "^0.123.0",
+    "@deftai/directive-content": "^0.123.0"
   },
   "scripts": {
     "build": "tsc -b",