CLI Update Enforcement Grill Status

Branch Dashboard

Branch	Completion	Locked direction	Still open
Version pins	100%	`.devpunks/settings.json` persists `cliVersion` and `baselineVersion` pins. `cliVersion` updates when a `dp` CLI command is accepted as current local authority. `baselineVersion` updates whenever scaffold-managed content is written.	None.
Drift command	100%	Add `dp check` as the operator-facing drift command. It checks installed CLI drift and scaffold baseline drift without writing.	None.
Session-start enforcement	100%	Session-start hooks should call `dp check`, not raw `dp update --check`, so the hook reports both executable and baseline drift.	None.
User guidance	100%	Drift output must warn before work starts, explain why drift matters, summarize relevant changelog entries, and prompt for update/upgrade before relying on scaffolded guidance.	None.
Update execution ownership	100%	If the user accepts an update from session-start guidance, the update flow must run in a subagent so the main thread stays clean.	None.

CLI version pin: The .devpunks record of the @punks/cli version last used as local Harness CLI authority.
Baseline version pin: The .devpunks record of the scaffold baseline version that last wrote scaffold-managed content.
Drift check: A read-only command that compares local pins against latest available CLI and stable baseline sources.
Update flow: The write-capable remediation path that upgrades the CLI and/or refreshes scaffold-managed content after user approval.

Drift warnings happen before agent work relies on scaffolded prompts, skills, hooks, or subagent config.
A warning is not enough; drift output must include enough changelog context for the user to understand what would change.
Accepted update remediation runs in a subagent, not the main thread.
Remaining hook wording and changelog extraction mechanics are delivery details, not requirements blockers.