baldart 4.15.0 → 4.16.1

package/CHANGELOG.md

@@ -5,6 +5,44 @@ All notable changes to BALDART will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [4.16.1] - 2026-06-05
+
+**Review di allineamento `new` ↔ `new2`: 9 fix di fedeltà sui workflow `new2`/`new2-resolve` emersi da una review adversariale a 3 reviewer paralleli.** La v4.16.0 ha introdotto `new2` come variante workflow-hosted di `/new`; una review di allineamento (gate-coverage · child-workflow wiring · control-flow) ha refutato l'implementazione su difetti reali — di semantica/allineamento, non di esecuzione (il wiring tra i 3 workflow era contract-fedele). **PATCH** (bugfix di allineamento del nuovo `new2`, nessun cambio di capability, nessuna chiave `baldart.config.yml`).
+
+> **Why.** `new2` deve essere un A/B equo di `/new`: ogni gate va mappato con policy *fedele* alla semantica di `/new` (meno l'AskUserQuestion), e tutti i path/child-workflow vanno cablati. La review ha trovato punti dove la policy deterministica divergeva silenziosamente dalla SSOT o dove un segnale veniva letto ma non agito.
+
+### Fixed
+
+- **`framework/.claude/workflows/new2.js`**:
+  - **Final review `NEEDS_MANUAL_CONFIRMATION` non più ignorato** — il filtro blocker includeva solo `VERIFIED` mentre il commento dichiarava "treat as VERIFIED": ora include anche `NEEDS_MANUAL_CONFIRMATION` (tentato il fix, mai scartato in silenzio → ripristina l'invariante zero-drop di `final-review.md` F.4).
+  - **`status:'fatal'` di `new2-resolve` ora onorato** — `resolve()` setta `batchFatal` e sospende final review + merge, invece di degradarlo a `followup`.
+  - **Phase 7 Production Readiness aggiunta** (post-merge, non-bloccante) — ripristina la full-parity dichiarata (auto-esegue i deploy stack-matched, riporta gli item manuali).
+  - **Card crashata non più persa** — il catch del driver passa da `resolve('agent-crash')` (retry specialista, mai bypass su security/migration) e garantisce un follow-up tracciato (path `agent-crash` prima irraggiungibile).
+  - **G3 cross-card / G5 depends-on rafforzati** — il prompt pre-flight ora *applica* le azioni cross-card (force-sequential/warning in executionMode/groups), non le logga soltanto; G5 garantisce l'esclusione **transitiva** dei dipendenti.
+  - **Minori**: `fileDiffViolation` (E4) ora loggato nel gate ledger; `hasApiDataFiles` non più sempre-true (rimosso il disgiunto che rendeva irraggiungibile lo skip dell'api-perf-auditor); i resolve di `merge-blocker`/`qa-fail` passano `mayEditPaths` (confine ownership sui fix batch-wide).
+- **`framework/.claude/workflows/new2-resolve.js`**: obbligo esplicito di **re-run E2E (Phase 2.6)** quando un fix tocca file UI (app/components/`*.css`/`*.scss`), allineato a `codex-gate.md` step 6.
+
+## [4.16.0] - 2026-06-05
+
+**Nuova skill sperimentale `new2` + i workflow `new2`/`new2-resolve`: l'INTERA batch di `/new` può girare come un singolo dynamic workflow autonomo in background, per fare A/B testing sul context economy.** `/new` è una skill che gira nel main loop, quindi l'output di ogni subagent (architect, coder, reviewer, Codex, QA, E2E) gonfia il contesto dell'orchestrator — il driver di costo che si sposta d'asse a ogni fix (v4.12→v4.15). I dynamic workflow spostano l'orchestrazione in un runtime **isolato**: i risultati intermedi vivono in variabili di script e nel main loop torna **solo il report finale**. `new2` è la versione workflow-hosted di `/new`, **parallela e additiva** (NON sostituisce `/new`), pensata per misurare il delta di `usage` reale a parità di semantica. **MINOR** (nuova skill + 2 workflow, opt-in, Claude-only; nessun breaking change, nessuna chiave `baldart.config.yml` — il gating è runtime via presenza del tool `Workflow`, come v4.14.0).
+
+> **Il nodo: i workflow non possono chiedere input mid-run** ("For sign-off between stages, run each stage as its own workflow"). `/new` ha ~25 gate `AskUserQuestion` bloccanti. Invece di spezzare in stage interattivi, `new2` **rende deterministico ogni gate**: mappati tutti → zero `AskUserQuestion` → la batch intera è un solo workflow autonomo. Ogni gate collassa in due archetipi — **(A) auto-risolvi col default seamless** (stash/ff-pull/retry/revert) o **(B) fail → self-healing `new2-resolve`**. Le operazioni distruttive/outward (`reset --hard`, force-push, drop stash) non si auto-eseguono MAI → degradano a "lascia intatto + segnala". Decisioni utente recepite in design: **auto-merge completo** (G24, l'unica azione outward autonoma), **card in fail → si auto-risolve senza lasciare nulla indietro** (non skip, non halt), **E2E `error` di tooling → procedi con flag**, **full parity** (sequential + team-mode coder paralleli via `parallel()`).
+
+> **`new2-resolve` — "nulla lasciato indietro".** Su decisione esplicita dell'utente, un gate bloccante non salta né ferma la batch: innesca un workflow di risoluzione self-healing con 8 `kind` su 3 assi — **fail/blocco** (`ac-unmet`/`blocker`/`qa-fail`/`e2e-blocked`/`merge-blocker`), **scope-expansion** (un finding legittimo che allarga lo scope oltre la AC: confine deterministico ancorato a file-ownership map + Domain-Override, niente soglie arbitrarie → integra-entro-confine-sicuro **o** follow-up), e **edge trasversali** (`agent-crash` re-instradato al giusto specialista mai bypassando security/migration; `baseline-fail` = unico terminale batch-fatale). Strategia a tier: fix mirato → multi-attempt giudicato (`parallel()` + judge avversariale) → re-verifica → **terminale = follow-up card auto-materializzata** (l'opzione sancita dalla Scope Closure Discipline, NON un deferral silenzioso). La decisione umana si sposta da ~25 interruzioni mid-run a una sola review post-run della coda follow-up.
+
+> **A/B validity.** Per attribuire il delta SOLO al cambio di host (skill main-loop → workflow background) e non a drift semantico, `new2` riusa gli **stessi agenti** con gli **stessi briefing**: i prompt-agente del workflow **citano i moduli reference di `/new`** (`args.refModulesBase`) come SSOT semantica, e `new2.js` codifica solo la *shape di orchestrazione* + le policy di gate. La telemetria Phase-8 esce con discriminatore `variant: "new2"` su `skill-runs.jsonl`, confrontabile con i run `/new`. Limiti documentati (è un esperimento): Claude-only, recovery solo intra-sessione, ogni op git/bash diventa azione di un agent (lo script non ha fs/shell). Distribuzione: i `.js` sono raccolti automaticamente dal per-item symlink esistente (`MERGE_KINDS.workflow`, overlay:false, Codex `workflowsDir()=null`) — nessuna modifica all'installer; lo `framework-edit-gate` li scansiona by-path → tutti i fact via `args`.
+
+### Added
+
+- **`framework/.claude/skills/new2/SKILL.md`** — skill sottile di ingresso (`effort: high`): degradation gate (`Workflow` tool assente / `.claude/workflows/new2.js` non linkato → "usa /new" + HALT), parse args (stessa grammatica di `/new`: range, `-full`, `-stats`, `effort=`), feature gate (`has_backlog`), raccolta fact da `baldart.config.yml`, `Workflow({ name:'new2', args })`, e presentazione del report + telemetria `variant=new2`. Resta ~1 schermata nel main loop → costo context trascurabile.
+- **`framework/.claude/workflows/new2.js`** — orchestratore della batch: Pre-flight (un ops-agent esegue Phase 0 + worktree + cross-card con le policy deterministiche G1–G5/E2), pipeline per-card sequential **o** team-mode (`parallel()` per wave), Final review (delega a `new-final-review`), auto-merge (G24 + riconciliazione 6b/6c conservativa G19–G23). Ogni gate bloccante / finding di scope → `workflow('new2-resolve', …)`. Gate ledger + report + telemetria nel return.
+- **`framework/.claude/workflows/new2-resolve.js`** — workflow di risoluzione self-healing (8 `kind`, 3 assi; tier fix→judge→verify→follow-up). `agent()`/`parallel()` only (figlio, nessun nesting).
+
+### Changed
+
+- **`framework/docs/WORKFLOWS.md`** — tabella "What ships today": aggiunte le righe `new2` e `new2-resolve` + nota "esperimento, non rimpiazzo".
+- **`README.md`** — conteggio skill 29 → 30; `new2` aggiunto alla categoria Workflow con nota EXPERIMENTAL/Claude-only.
+
 ## [4.15.0] - 2026-06-04
 
 **Il pre-flight di `/new` smette di gonfiare il contesto dell'orchestrator: il setup worktree + baseline build e il check Codex cross-card girano in background fuori dal prefisso cached, e le scritture del tracker di pre-flight si fondono in un singolo flush.** Forensics su una run reale (`/new FEAT-0020 -full`, 8 card, team mode) — estrazione del campo `usage` per turno dal transcript — ha mostrato **~150k token di occupazione al solo pre-flight, prima di toccare una card**, con un `cache_read` cumulativo di ~10M token (il prefisso ri-letto a ogni turno × ~70 turni). La diagnosi ovvia («è il bloat della prosa della skill») è stata **refutata dai numeri**: dopo lo split di v4.14.0, la prosa skill-controllata in quei 150k è solo ~18%; il floor statico ambiente (schemi tool MCP + CLAUDE.md + memoria) è ~42% e non è toccabile da `/new`; il vero driver residuo è il **numero di turni dell'orchestrator nel pre-flight** (~70) — ognuno ri-bolla il prefisso — alimentato da tre sprechi concreti. **MINOR** (cambio di orchestrazione capability-preserving di `/new`: stessi gate, stessi output, stesso install-contract; nessuna chiave `baldart.config.yml`, nessuna modifica CLI).

package/README.md

@@ -208,12 +208,12 @@ Skills always-ask when required keys are missing — never silently default.
 never overwrites your file. Full guide:
 [`framework/docs/PROJECT-CONFIGURATION.md`](framework/docs/PROJECT-CONFIGURATION.md).
 
-### Skills (29 portable skills)
+### Skills (30 portable skills)
 
 Skills live under `.claude/skills/` and are auto-discovered by Claude Code.
 Bundled skills:
 
-- **Workflow**: `new`, `prd`, `prd-add`, `bug`, `simplify`, `worktree-manager`, `issue-review`, `context-primer`
+- **Workflow**: `new`, `new2` (v4.16.0 — EXPERIMENTAL workflow-hosted `/new`, Claude-only, for A/B testing context economy), `prd`, `prd-add`, `bug`, `simplify`, `worktree-manager`, `issue-review`, `context-primer`
 - **Code quality**: `skill-creator`, `find-skills`, `webapp-testing`, `playwright-skill`, `lsp-bootstrap` (v3.10.0), `e2e-review` (v3.18.0)
 - **Design**: `frontend-design`, `ui-design`, `motion-design`, `gamification-design`, `design-system-init` (v3.11.0)
 - **Product**: `seo-audit`, `copywriting`, `api-design-principles`

package/VERSION

@@ -1 +1 @@
-4.15.0
+4.16.1

package/framework/.claude/skills/new2/SKILL.md

@@ -0,0 +1,128 @@
+---
+name: new2
+effort: high
+description: >
+  EXPERIMENTAL workflow-hosted variant of /new (A/B testing). Implements one or
+  more backlog cards end-to-end by delegating the WHOLE batch to a background
+  dynamic workflow — so subagent output never enters the main orchestrator
+  context. Fully autonomous (zero AskUserQuestion): every /new gate is replaced by
+  a deterministic policy + a self-healing resolution pass. Claude-only (needs the
+  Workflow tool). Usage: /new2 CARD-IDS (same arg grammar as /new). Triggers on:
+  /new2, "implementa le card con workflow", "new2".
+---
+
+> **EXPERIMENT — not a replacement for `/new`.** `new2` exists to A/B-test the
+> context-economy of hosting the batch orchestration inside a Claude Code dynamic
+> workflow instead of the main loop. `/new` remains the SSOT, the cross-tool
+> default, and the recovery-safe path. Do NOT route to `new2` unless the user
+> explicitly asks for it.
+
+> **ZERO-ASK CONTRACT.** A dynamic workflow cannot prompt the user mid-run. `new2`
+> therefore runs the entire batch autonomously: every `/new` `AskUserQuestion`
+> gate is replaced by a deterministic policy (auto-resolve seamless defaults, or
+> fail → self-healing `new2-resolve`, or — last resort — auto-materialise a
+> tracked follow-up card). Destructive/outward ops (`reset --hard`, force-push,
+> stash drop) are NEVER auto-run; they degrade to "leave intact + report".
+
+## Project Context
+
+**Reads from `baldart.config.yml`:** `paths.backlog_dir`, `paths.references_dir`, `paths.metrics`, `paths.high_risk_modules`, `git.trunk_branch` (autodetected from `origin/HEAD` when absent), `git.merge_strategy`, `stack.*`, and `features.has_e2e_review` / `features.has_design_system` / `features.has_lsp_layer`.
+**Gated by features:** `features.has_backlog` (REFUSES to run when `false` — operates on backlog cards by definition).
+**Overlay:** loads `.baldart/overlays/new.md` if present (shared with `/new`: canonical-docs registry, tooling paths).
+**On missing/empty keys:** the deterministic pre-flight autodetects (trunk via `origin/HEAD`); only HALT when nothing resolves. See `framework/agents/project-context.md` § 3.
+
+## Effort
+
+**Baseline:** `effort: high` (frontmatter — the workflow runs a full implement+review
+batch autonomously, so it warrants deep reasoning). **Inline override:** pass
+`effort=<low|medium|high|xhigh|max>` anywhere in the invocation; detect once at
+kickoff, strip the token, and forward it to the workflow via `args.flags.effort`
+(agents inside the workflow honour it). Mapping/parsing: `framework/agents/effort-protocol.md`.
+
+---
+
+## What this skill does (thin coordinator — keep it out of the way)
+
+`new2` holds **almost no content in the main loop**. Its entire job is: parse the
+invocation, gather project facts, hand the batch to the `new2` background workflow,
+and present the report it returns. All the heavy orchestration (architect, coder,
+reviewers, Codex, QA, E2E, merge) lives in the workflow's isolated runtime — its
+output never lands in your context.
+
+### Step 1 — Degradation gate (BLOCKING, first thing)
+
+`new2` is **useless without the `Workflow` tool** (its whole point is the background
+runtime). If the `Workflow` tool is **not available** in this session (OpenAI Codex
+install — workflows are Claude-only; `disableWorkflows` set; or a Claude Code older
+than the dynamic-workflows research preview), do NOT attempt any fallback:
+
+> Print: `"/new2 richiede i dynamic workflow di Claude Code (non disponibili in questa sessione). Usa /new — stessa semantica, esecuzione nel main loop."` and **HALT**.
+
+Also verify the workflow script is linked: if `.claude/workflows/new2.js` is absent,
+print the same guidance and HALT (the framework did not link it — Codex tree, or a
+pre-v4.16 install).
+
+### Step 2 — Parse the invocation (same grammar as `/new`)
+
+Parse `CARD-IDS` exactly as `/new` does — space-separated, hyphen-range
+(`GLOB-001-GLOB-008`), comma-separated, and **epic expansion** (`-full` / `--full`
+expands all children of a parent: filename prefix `<PARENT>-` ∪ cards whose
+`group.parent == <PARENT>`, parent excluded, sorted by `group.sequence`). Strip the
+`-full` / `--full` and `-stats` / `--stats` tokens and the `effort=<level>` token
+before treating the rest as card IDs. If no card IDs are given, ask which cards
+(this is the ONE pre-launch question — it is NOT a mid-run gate). Resolve each card
+to its backlog YAML path under `${paths.backlog_dir}`.
+
+### Step 3 — Feature gate + gather facts
+
+- Read `features.has_backlog`. If `false` → print the same refusal as `/new`
+  (`"requires features.has_backlog: true — run npx baldart configure"`) and HALT.
+- Read `baldart.config.yml` and resolve: `$MAIN` (the main repo absolute path — walk
+  up from a worktree if needed), `$TRUNK` (`git.trunk_branch`, else autodetect via
+  `git symbolic-ref refs/remotes/origin/HEAD` → `develop`/`main`/`master`), `$METRICS`
+  (`paths.metrics`, default `docs/metrics`), and the `paths.*` / `stack.*` /
+  `features.*` the agents will need. Resolve `refModulesBase` = the directory holding
+  `/new`'s reference modules (`.claude/skills/new/references` — the workflow's agents
+  Read them for the review SEMANTICS, so `new2` stays a thin orchestration host and
+  the A/B test isolates the host, not the protocol).
+
+### Step 4 — Delegate the whole batch to the workflow
+
+Call the `Workflow` tool:
+
+```
+Workflow({ name: 'new2', args: {
+  cardIds,            // expanded list (ranges/-full already resolved here)
+  cardPaths,          // resolved backlog YAML paths
+  mainRepo,           // $MAIN absolute path
+  trunk,              // resolved $TRUNK
+  metricsDir,         // $METRICS
+  refModulesBase,     // .claude/skills/new/references (semantic SSOT)
+  config,             // the parsed baldart.config.yml (paths.*/stack.*/features.*/git.*)
+  flags: { stats, effort, full }
+}})
+```
+
+The workflow runs the entire batch in the background. **Do not poll it** — it
+returns when the batch is done. It returns:
+
+```
+{ report, perCardResults, gateLedger, residualFollowups, telemetry }
+```
+
+`report` is a ready-to-show markdown batch summary (files changed per card, review
+findings, QA, merge hash, any auto-created follow-up cards). `residualFollowups`
+lists every follow-up card `new2-resolve` materialised for an unresolved
+gate/scope-expansion (nothing was silently dropped). `telemetry` is the Phase-8
+record (same schema as `/new`, with `variant: "new2"`).
+
+### Step 5 — Present + record
+
+- Print `report` to the user verbatim (it is already the single batch summary).
+- If `residualFollowups` is non-empty, surface them prominently ("queste AC/finding
+  non risolti autonomamente sono stati tracciati come follow-up card: …") — this is
+  the post-run review that replaced the ~25 mid-run questions.
+- Append `telemetry` (with `variant: "new2"`) to `${metricsDir}/skill-runs.jsonl`
+  and, when `flags.stats`, run the session token-telemetry script the same way
+  `/new` Phase 8 does (`-stats`), so the A/B comparison has real `usage` data for
+  both variants. Do NOT re-summarise the cards yourself — the workflow already did.

package/framework/.claude/workflows/new2-resolve.js

@@ -0,0 +1,180 @@
+export const meta = {
+  name: 'new2-resolve',
+  description:
+    "Self-healing resolution pass for the autonomous new2 batch workflow. Called by new2 whenever a deterministic gate would otherwise need a human: a card fail/blocker (ac-unmet | blocker | qa-fail | e2e-blocked | merge-blocker), a legitimate scope-EXPANDING finding (scope-expansion), or a cross-cutting edge (agent-crash | baseline-fail). Runs an aggressive fix→verify loop (targeted coder → judged multi-attempt → adversarial re-verify); its TERMINAL is auto-materialising a tracked follow-up card so nothing is ever silently dropped. Domain-Override aware: doc fixes go to doc-reviewer, security/migration to coder and NEVER inline-bypassed. Agents Read /new's reference modules for semantics (args.refModulesBase). Uses agent()/parallel() only — no nested workflows.",
+  phases: [
+    { title: 'Diagnose', detail: 'classify the problem + decide scope-expansion boundary' },
+    { title: 'Repair', detail: 'targeted fix, then judged multi-attempt if needed' },
+    { title: 'Verify', detail: 'adversarial re-verify against the originating gate' },
+  ],
+}
+
+// ───────────────────────────────────────────────────────────────────────────
+// args contract (from new2.js resolve()):
+//   kind          'ac-unmet'|'blocker'|'qa-fail'|'e2e-blocked'|'merge-blocker'
+//                 |'scope-expansion'|'agent-crash'|'baseline-fail'
+//   cardId        string      card (or finding id) the problem belongs to
+//   evidence      string      verbatim AC / failing gate / finding evidence
+//   worktreePath  string      where the fix happens
+//   mayEditPaths  string[]    the card's file-ownership MAY-EDIT set
+//   scopeFiles    string[]    files in scope for re-verify
+//   domain        'doc'|'security'|'migration'|'code'|'perf'|'test'
+//   refModulesBase string     /new reference modules dir (semantics)
+//   config        object      parsed baldart.config.yml
+//
+// return (consumed by new2.js):
+//   { status: 'resolved'|'followup'|'fatal', followupCard?, reason? }
+// ───────────────────────────────────────────────────────────────────────────
+
+const a = args || {}
+const kind = a.kind || 'blocker'
+const card = a.cardId || 'CARD'
+const evidence = a.evidence || ''
+const worktree = a.worktreePath || '(cwd)'
+const mayEdit = Array.isArray(a.mayEditPaths) ? a.mayEditPaths : []
+const scopeFiles = Array.isArray(a.scopeFiles) ? a.scopeFiles : []
+const domain = a.domain || 'code'
+const REF = (a.refModulesBase || '.claude/skills/new/references').replace(/\/$/, '')
+const cfg = a.config || {}
+const paths = cfg.paths || {}
+const backlogDir = paths.backlog_dir || 'backlog'
+const protectedDomain = domain === 'security' || domain === 'migration'
+
+const FIX_SCHEMA = {
+  type: 'object', required: ['applied', 'verified'], additionalProperties: true,
+  properties: {
+    applied: { type: 'boolean', description: 'true if an edit was made' },
+    verified: { type: 'boolean', description: 'true if the originating gate now passes (re-run it)' },
+    crashed: { type: 'boolean', description: 'agent could not act (for agent-crash routing)' },
+    note: { type: 'string' },
+  },
+}
+const JUDGE_SCHEMA = {
+  type: 'object', required: ['best'], additionalProperties: false,
+  properties: { best: { type: 'number', description: '1-based index of the best attempt, or 0 if none works' }, rationale: { type: 'string' } },
+}
+const FOLLOWUP_SCHEMA = {
+  type: 'object', required: ['created', 'followupCard'], additionalProperties: true,
+  properties: { created: { type: 'boolean' }, followupCard: { type: 'string' }, note: { type: 'string' } },
+}
+
+const brief = [
+  `Worktree: ${worktree} (cd into it; run all gates/git yourself).`,
+  `Card: ${card}`,
+  `Problem kind: ${kind}`,
+  `Evidence: ${evidence}`,
+  `MAY-EDIT (file-ownership — do NOT touch anything else): ${mayEdit.join(', ') || '(card scope)'}`,
+  `Scope files for re-verify: ${scopeFiles.join(', ') || '(diff)'}`,
+  `Domain: ${domain}${protectedDomain ? ' (PROTECTED — security/migration: never inline-bypass; the right specialist MUST apply)' : ''}`,
+  `Reference modules (Read for exact semantics): ${REF}/`,
+  `UI re-verify obligation: if your fix touches a UI file (app dir / components / *.css / *.scss), you MUST re-run the Phase 2.6 E2E review (per ${REF}/review-cycle.md) before declaring verified — a code-review/Codex fix can reintroduce visual/functional drift (mirrors codex-gate.md step 6).`,
+].join('\n')
+
+// The agent that OWNS a fix in this domain (Domain-Override): doc → doc-reviewer.
+const fixerAgent = domain === 'doc' ? 'doc-reviewer' : 'coder'
+
+// ───────────────────────────────────────────────────────────────────────────
+// Phase Diagnose — branch by kind.
+// ───────────────────────────────────────────────────────────────────────────
+phase('Diagnose')
+
+// ---- baseline-fail (E2): try to make the trunk build; fatal if irrecoverable ---
+if (kind === 'baseline-fail') {
+  const r = await agent(
+    `The batch worktree's BASELINE build fails (trunk may not build — pre-existing). Try to make it build per ${REF}/setup.md step 6a.\n\n${brief}\n\nFix the build errors if they are tractable (missing dep, stale lock, trivial type error). Re-run tsc+lint+build. Return verified:true only if the baseline now passes. If the breakage is non-trivial/pre-existing and not safely fixable, return verified:false (the caller will treat the batch as fatal).`,
+    { label: `resolve:baseline:${card}`, phase: 'Diagnose', agentType: 'coder', schema: FIX_SCHEMA }
+  )
+  if (r && r.verified) { log('baseline recovered.'); return { status: 'resolved' } }
+  log('baseline irrecoverable — batch fatal.')
+  return { status: 'fatal', reason: 'baseline build irrecoverable' }
+}
+
+// ---- scope-expansion (Asse 2): deterministic boundary, no arbitrary threshold ---
+if (kind === 'scope-expansion') {
+  // Integrate iff: within MAY-EDIT ownership AND not security/migration AND not a NEW AC.
+  const decide = await agent(
+    `A review finding EXPANDS scope beyond card ${card}'s acceptance criteria (not a fail — extra legitimate work). Decide per the deterministic boundary (no line-count threshold):\n` +
+      `INTEGRATE NOW iff ALL hold: (1) the fix stays inside MAY-EDIT ownership; (2) domain is NOT security/migration; (3) it does NOT introduce a new user-facing acceptance criterion. Otherwise → MATERIALISE A FOLLOW-UP.\n\n${brief}\n\n` +
+      `If INTEGRATE: apply the fix via the domain owner discipline (you are ${fixerAgent}), re-run lint+tsc, return applied:true verified:true. If FOLLOW-UP: return applied:false verified:false note:'needs-followup: <why boundary failed>'. Do NOT prompt.`,
+    { label: `resolve:scope:${card}`, phase: 'Repair', agentType: fixerAgent, schema: FIX_SCHEMA }
+  )
+  if (decide && decide.verified) { log('scope-expansion integrated within ownership.'); return { status: 'resolved' } }
+  return await materialiseFollowup('scope-expansion', (decide && decide.note) || 'outside ownership / new AC / protected domain')
+}
+
+// ---- agent-crash (E1): retry → route to the right specialist; protected = never bypass --
+if (kind === 'agent-crash') {
+  const r = await agent(
+    `A subagent crashed while handling this work. Re-attempt it with the CORRECT specialist (${fixerAgent}) per ${REF}/commit.md § Sub-agent failure protocol.\n\n${brief}\n\nRetry the work once. ${protectedDomain ? 'This is a PROTECTED domain (security/migration): if you cannot complete it, return verified:false — NEVER inline-bypass.' : 'If transient, complete it.'} Re-verify the originating gate. Return verified:true only if done + verified.`,
+    { label: `resolve:crash:${card}`, phase: 'Repair', agentType: fixerAgent, schema: FIX_SCHEMA }
+  )
+  if (r && r.verified) return { status: 'resolved' }
+  return await materialiseFollowup('agent-crash', 'subagent crash unrecovered' + (protectedDomain ? ' (protected domain — not bypassed)' : ''))
+}
+
+// ───────────────────────────────────────────────────────────────────────────
+// Asse 1 (ac-unmet | blocker | qa-fail | e2e-blocked | merge-blocker)
+// Tier 1: targeted fix → re-verify. Tier 2: judged multi-attempt. Terminal: follow-up.
+// ───────────────────────────────────────────────────────────────────────────
+const gateHint = {
+  'ac-unmet': `Implement the unmet acceptance criterion EXACTLY (no scope expansion), per ${REF}/completeness.md Phase 2.5b. Re-verify the AC against the code.`,
+  blocker: `Fix the blocking finding per ${REF}/codex-gate.md / ${REF}/completeness.md. Re-run the failing gate.`,
+  'qa-fail': `Fix the failing QA gates per ${REF}/review-cycle.md Phase 3.5 — fix the code, not the tests (unless a test is wrong). Re-run qa-sentinel.`,
+  'e2e-blocked': `Fix the implementation so the E2E review passes per ${REF}/review-cycle.md Phase 2.6 (never override known-broken UI). Re-run /e2e-review.`,
+  'merge-blocker': `Fix the verified BLOCKER/HIGH from the final review per ${REF}/final-review.md F.5. Re-verify.`,
+}[kind] || `Fix the blocker and re-verify.`
+
+phase('Repair')
+let attempt = await agent(
+  `Tier-1 targeted repair for card ${card} (${kind}).\n\n${brief}\n\n${gateHint}\n\nApply the minimal correct fix within MAY-EDIT only. Re-run the originating gate yourself and report verified honestly (do NOT claim verified without re-running it).`,
+  { label: `resolve:${kind}:${card}`, phase: 'Repair', agentType: fixerAgent, schema: FIX_SCHEMA }
+)
+if (attempt && attempt.verified) { log(`${kind} resolved (tier 1).`); return { status: 'resolved' } }
+
+// Tier 2 — judged multi-attempt (parallel divergent fixes → judge → adversarial verify).
+// Budget guard: skip the fan-out when the run is near its token target.
+const canFanOut = !budget.total || budget.remaining() > 60000
+if (canFanOut && !protectedDomain) {
+  phase('Repair')
+  const angles = [
+    'Fix at the root cause (change the underlying logic/contract).',
+    'Fix defensively at the call site (guard/validate without changing the contract).',
+    'Fix by reusing an existing utility/pattern instead of new code.',
+  ]
+  const attempts = (await parallel(angles.map((angle, i) => () =>
+    agent(
+      `Tier-2 repair attempt #${i + 1} for card ${card} (${kind}), angle: ${angle}\n\n${brief}\n\n${gateHint}\n\nApply your fix within MAY-EDIT, re-run the gate, and report whether it now passes. Work in isolation; the best attempt will be selected.`,
+      { label: `resolve:${kind}:${card}#${i + 1}`, phase: 'Repair', agentType: fixerAgent, schema: FIX_SCHEMA }
+    ).then((r) => ({ i: i + 1, r })).catch(() => null)
+  ))).filter(Boolean)
+
+  const verified = attempts.filter((x) => x.r && x.r.verified)
+  if (verified.length) {
+    phase('Verify')
+    // Adversarial pick: judge which verified attempt is the soundest (refute the rest).
+    const judge = await agent(
+      `Adversarially judge these repair attempts for card ${card} (${kind}). Each claims the gate now passes. Pick the SOUNDEST (best minimal, least regression-prone) — try to refute each with path:line reasoning. Return its 1-based index, or 0 if none truly holds.\n\nEvidence: ${evidence}\nAttempts that claim verified: ${verified.map((v) => `#${v.i}: ${v.r.note || ''}`).join(' | ')}`,
+      { label: `resolve:judge:${card}`, phase: 'Verify', agentType: 'code-reviewer', schema: JUDGE_SCHEMA }
+    )
+    if (judge && judge.best > 0) { log(`${kind} resolved (tier 2, attempt #${judge.best}).`); return { status: 'resolved' } }
+  }
+} else if (protectedDomain) {
+  log('protected domain — single specialist attempt only (no parallel fan-out).')
+} else {
+  log('budget near target — skipping tier-2 fan-out.')
+}
+
+// Terminal — nothing resolved autonomously: materialise a tracked follow-up card.
+return await materialiseFollowup(kind, attempt && attempt.note ? attempt.note : 'unresolved after repair tiers')
+
+// ───────────────────────────────────────────────────────────────────────────
+async function materialiseFollowup(k, reason) {
+  const r = await agent(
+    `Materialise a follow-up backlog card so this residual is TRACKED, not dropped (per ${REF}/completeness.md Phase 2.5b option 3 — the sanctioned, NON-silent deferral).\n\n${brief}\nKind: ${k}\nReason it could not be auto-resolved: ${reason}\n\n` +
+      `Create ${backlogDir}/${card}-followup-<gate>.yml with status: TODO and the MINIMUM valid fields (non-empty requirements ≥1 derived from the residual, acceptance_criteria ≥1 = the verbatim residual, files_likely_touched ≥1 from this card's ownership). It MUST pass the /new pre-flight field check. Return the created card id.`,
+    { label: `resolve:followup:${card}`, phase: 'Verify', agentType: 'general-purpose', schema: FOLLOWUP_SCHEMA }
+  )
+  const followupCard = (r && r.followupCard) || `${card}-followup`
+  log(`${k} → follow-up card ${followupCard} (nothing dropped).`)
+  return { status: 'followup', followupCard, reason }
+}

package/framework/.claude/workflows/new2.js

@@ -0,0 +1,480 @@
+export const meta = {
+  name: 'new2',
+  description:
+    "EXPERIMENTAL workflow host for /new (A/B testing). Runs an ENTIRE backlog-card batch autonomously in the background runtime — pre-flight, per-card implement+review pipeline (sequential or team-mode parallel coders), cross-batch final review, and auto-merge — so subagent output never enters the main orchestrator context. Zero AskUserQuestion: each /new gate is a deterministic policy; blocking gates and scope-expanding findings are routed to the new2-resolve self-healing workflow, whose terminal is an auto-materialised follow-up card (nothing silently dropped). Agents Read /new's reference modules for review semantics (args.refModulesBase) so this script encodes only orchestration shape + gate policy. Claude-only.",
+  phases: [
+    { title: 'Pre-flight', detail: 'deterministic workspace hygiene + worktree + cross-card grounding (Phase 0)' },
+    { title: 'Implement', detail: 'per-card implement+review pipeline; team-mode runs coders in parallel per wave' },
+    { title: 'Final', detail: 'cross-batch final review (delegates to new-final-review)' },
+    { title: 'Merge', detail: 'auto-merge to trunk via git.merge_strategy + cleanup' },
+    { title: 'Production', detail: 'post-merge production-readiness checklist (Phase 7, non-blocking)' },
+  ],
+}
+
+// ───────────────────────────────────────────────────────────────────────────
+// args contract — supplied by the new2 skill (it owns config-read + invocation):
+//   cardIds        string[]   expanded card ids (ranges/-full resolved by skill)
+//   cardPaths      string[]   resolved backlog YAML paths (agents Read them)
+//   mainRepo       string     absolute path of the main repo (not a worktree)
+//   trunk          string     resolved integration trunk (git.trunk_branch)
+//   metricsDir     string     paths.metrics (telemetry dir)
+//   refModulesBase string     dir holding /new reference modules (semantic SSOT)
+//   config         object     parsed baldart.config.yml (paths.*/stack.*/features.*/git.*)
+//   flags          { stats, effort, full }
+//
+// return (consumed by the skill at Step 5):
+//   { report, perCardResults, gateLedger, residualFollowups, telemetry }
+// ───────────────────────────────────────────────────────────────────────────
+
+const a = args || {}
+const cfg = a.config || {}
+const cardIds = Array.isArray(a.cardIds) ? a.cardIds : []
+const cardPaths = Array.isArray(a.cardPaths) ? a.cardPaths : []
+const MAIN = a.mainRepo || '(cwd)'
+const TRUNK = a.trunk || 'main'
+const METRICS = a.metricsDir || 'docs/metrics'
+const REF = (a.refModulesBase || '.claude/skills/new/references').replace(/\/$/, '')
+const FLAGS = a.flags || {}
+const features = cfg.features || {}
+const paths = cfg.paths || {}
+const gitCfg = cfg.git || {}
+const highRisk = paths.high_risk_modules || []
+const mergeStrategy = gitCfg.merge_strategy || 'pr'
+
+// Mutable batch state — the workflow's variables ARE the tracker (kept out of the
+// main loop). Agents also write the on-disk /tmp/batch-tracker-<id>.md for recovery.
+const firstCard = cardIds[0] || 'BATCH'
+const gateLedger = []       // { card, gate, decision, detail }
+const residualFollowups = []// { card, kind, followupCard, reason }
+const perCardResults = []   // structured per-card outcome
+let batchFatal = false      // set when a resolve() returns 'fatal' (unrecoverable)
+let prodReadiness = null    // Phase 7 result (post-merge, non-blocking)
+
+function ledger(card, gate, decision, detail) {
+  gateLedger.push({ card, gate, decision, detail: detail || '' })
+  log(`gate[${card}] ${gate} → ${decision}${detail ? ' — ' + detail : ''}`)
+}
+
+if (!cardIds.length) {
+  log('new2: no card IDs supplied — nothing to do.')
+  return emptyReturn('no cards supplied')
+}
+
+// ───────────────────────────────────────────────────────────────────────────
+// Schemas
+// ───────────────────────────────────────────────────────────────────────────
+const PREFLIGHT_SCHEMA = {
+  type: 'object',
+  required: ['ok', 'worktreePath', 'branch', 'baseline', 'executionMode', 'cards'],
+  additionalProperties: false,
+  properties: {
+    ok: { type: 'boolean', description: 'false only when the workspace cannot be made workable (e.g. baseline irrecoverable)' },
+    worktreePath: { type: 'string' },
+    branch: { type: 'string' },
+    port: { type: ['number', 'string'], description: 'dev port or "-"' },
+    baseline: { enum: ['pass', 'fail'] },
+    baselineLog: { type: 'string' },
+    executionMode: { enum: ['sequential', 'team'] },
+    groups: { type: 'array', items: { type: 'object', additionalProperties: true }, description: 'team-mode waves: [{ level, cards:[ids] }]' },
+    cards: { type: 'array', items: { type: 'string' }, description: 'card ids cleared to run (invalid/blocked-dep excluded)' },
+    excluded: { type: 'array', items: { type: 'object', additionalProperties: true }, description: '[{ card, reason }] for G4/G5 exclusions' },
+    ownershipMapPath: { type: 'string', description: '/tmp path to the file-ownership map' },
+    crossCard: { type: 'string', description: 'distilled cross-card findings or PASS/SKIPPED/UNAVAILABLE' },
+    workspaceNote: { type: 'string', description: 'G1/G2 distilled (stash label, ff-pull, divergence left + reported)' },
+    archBaselinePaths: { type: 'array', items: { type: 'string' }, description: 'per-card /tmp/arch-baseline-<id>.md (for final-review dedup)' },
+  },
+}
+
+const MERGE_SCHEMA = {
+  type: 'object', required: ['merged'], additionalProperties: false,
+  properties: {
+    merged: { type: 'boolean' },
+    mergeCommit: { type: 'string' },
+    mergeTs: { type: 'string' },
+    reconciliation: { type: 'string', description: 'Phase 6b/6c distilled (divergence left+reported, stash restore, sync markers)' },
+    note: { type: 'string' },
+  },
+}
+
+// Shared context fragment every per-card agent gets.
+const projectBrief = [
+  `Main repo: ${MAIN}`,
+  `Trunk: ${TRUNK}`,
+  `Reference modules (Read these for the EXACT /new semantics — this workflow only sequences them): ${REF}/`,
+  `Config facts: stack=${JSON.stringify(cfg.stack || {})}; features=${JSON.stringify(features)}; high_risk_modules=${JSON.stringify(highRisk)}; paths.backlog_dir=${paths.backlog_dir || '?'}; paths.references_dir=${paths.references_dir || '?'}.`,
+  FLAGS.effort ? `Reasoning effort for this run: ${FLAGS.effort}.` : '',
+].filter(Boolean).join('\n')
+
+// ───────────────────────────────────────────────────────────────────────────
+// Phase Pre-flight (Phase 0 + Pre-flight) — ONE ops agent runs all the git-heavy,
+// deterministic workspace work (the script itself has no shell). Gate policies:
+//   G1 dirty-tree  → auto-stash (restore at merge); restore-conflict → leave+report
+//   G2 divergence  → behind: ff-pull; ahead/diverged: proceed on isolated worktree + report
+//   G3 cross-card cap unavailable → proceed + log CAPABILITY_UNAVAILABLE
+//   G4 card-field invalid → exclude that card + continue
+//   G5 depends-on (dep outside batch, not DONE) → exclude card + its dependents
+//   E2 baseline build fail → retry once inside the agent; surface baseline:fail
+// ───────────────────────────────────────────────────────────────────────────
+phase('Pre-flight')
+const preflight = await agent(
+  `You are the deterministic PRE-FLIGHT for an autonomous /new batch (variant new2). Follow ${REF}/setup.md (Phase 0 + Pre-flight) and ${REF}/implement.md (Phase 1 depends-on gate) for the SEMANTICS, but replace EVERY AskUserQuestion with the deterministic policy below. You run all git/bash yourself (the workflow cannot).\n\n` +
+    `${projectBrief}\n\nCards in batch (Read each YAML):\n${cardPaths.join('\n')}\nCard IDs: ${cardIds.join(' ')}\n\n` +
+    `Create/maintain the recovery tracker at /tmp/batch-tracker-${firstCard}.md (per setup.md § Context Tracking).\n\n` +
+    `DETERMINISTIC GATE POLICIES (NO user prompts):\n` +
+    `• G1 dirty-tree (main repo ${MAIN}): partition framework-managed noise exactly as setup.md step 3 ($METRICS=${METRICS}, .baldart/generated|state.json|skill-conflicts.json — NOT overlays/). If genuine user work remains → auto-stash 'baldart-new2-${firstCard}-<ts>' (main checkout, safe) and record the MESSAGE label for restore at merge. Never commit/abort/prompt.\n` +
+    `• G2 divergence vs origin/${TRUNK}: behind-only AND HEAD==${TRUNK} → ff-pull; ahead-genuine or diverged → DO NOT push/rebase/reset; proceed (the worktree is isolated) and put a one-line note in workspaceNote. Framework-management commits are auto-ignored (setup.md step 4 reclassification).\n` +
+    `• G3 cross-card grounding (setup.md 3d): run the Codex cross-card check with the provenance skip; on CODEX_NOT_FOUND fall back to code-reviewer; if BOTH unavailable → proceed and set crossCard='CAPABILITY_UNAVAILABLE'. Read the audit file ONLY via the [codex]-stripping filter; return DISTILLED findings. CRITICAL — if conflicts are FOUND you MUST APPLY them, not just report: FILE_CONFLICT / ORDER_RISK → force the conflicting cards SEQUENTIAL (encode this in executionMode/groups AND the ownership map); STATE_MUTATION → fold a warning into the affected cards via the ownership map. The returned executionMode/groups MUST already reflect these constraints.\n` +
+    `• G4 card-field validation (setup.md 1b/1c): a card missing requirements/acceptance_criteria/files_likely_touched → EXCLUDE it (add to excluded[] with reason); continue with valid cards. Never HALT the batch for one bad card.\n` +
+    `• G5 depends-on (implement.md Phase 1 step 2): if a card's depends_on names a card that is NOT DONE and is NOT in this batch → exclude that card AND, TRANSITIVELY, every in-batch card that depends on it (excluded[], reason 'depends_on <dep> not DONE'). GUARANTEE: the returned cards[] must contain NO card that transitively depends on an excluded card. If the dep IS in this batch, keep it and order it first.\n` +
+    `• Worktree (setup.md step 4): create ONE code worktree off ${TRUNK} (slug from git_strategy.branch or the parent/lead card title), install deps, assign a port, run the baseline (tsc+lint+build). Use the git-authoritative idempotency pre-check (step 4a2). E2: if baseline FAILS, fix-attempt once (the trunk itself may not build); if still failing return baseline:'fail' with baselineLog (the caller treats it as batch-fatal).\n` +
+    `• Complexity (setup.md 3c): decide executionMode sequential|team and, for team, the groups [{level,cards}]. Build the file-ownership map; write it to /tmp and return ownershipMapPath.\n` +
+    `• Persist per-card architecture baselines you gather to /tmp/arch-baseline-<CARD>.md and return archBaselinePaths (final review reuses them).\n\n` +
+    `Return the structured PREFLIGHT object. ok:false ONLY if the workspace is unworkable (baseline irrecoverable / worktree uncreatable).`,
+  { label: 'preflight', phase: 'Pre-flight', agentType: 'general-purpose', schema: PREFLIGHT_SCHEMA }
+)
+
+if (!preflight || preflight.ok === false || preflight.baseline === 'fail') {
+  // E2 terminal — the only batch-fatal case: no workable tree.
+  ledger(firstCard, 'E2-baseline', 'BATCH-FATAL', (preflight && preflight.baselineLog) || 'workspace unworkable')
+  return finalReturn({ fatal: true, reason: 'baseline build irrecoverable — see baselineLog' })
+}
+
+for (const ex of preflight.excluded || []) ledger(ex.card, 'preflight-exclude', 'EXCLUDED', ex.reason)
+if (preflight.workspaceNote) ledger(firstCard, 'G1/G2-workspace', 'AUTO', preflight.workspaceNote)
+if (preflight.crossCard) ledger(firstCard, 'G3-cross-card', 'INFO', preflight.crossCard)
+
+const runnableCards = preflight.cards || []
+const sharedCtx = {
+  worktreePath: preflight.worktreePath,
+  branch: preflight.branch,
+  ownershipMapPath: preflight.ownershipMapPath,
+  archBaselinePaths: preflight.archBaselinePaths || [],
+}
+
+// ───────────────────────────────────────────────────────────────────────────
+// new2-resolve bridge — every blocking gate and every scope-expanding finding
+// goes here (Asse 1/2/3). Returns 'resolved' | 'followup' | 'fatal'.
+// ───────────────────────────────────────────────────────────────────────────
+async function resolve(kind, card, evidence, extra) {
+  const res = await workflow('new2-resolve', {
+    kind,
+    cardId: card,
+    evidence,
+    worktreePath: sharedCtx.worktreePath,
+    mayEditPaths: (extra && extra.mayEditPaths) || [],
+    scopeFiles: (extra && extra.scopeFiles) || [],
+    domain: (extra && extra.domain) || 'code',
+    refModulesBase: REF,
+    config: cfg,
+  }).catch((e) => ({ status: 'followup', reason: 'resolve workflow error: ' + (e && e.message) }))
+  const status = (res && res.status) || 'followup'
+  if (status === 'fatal') { batchFatal = true; ledger(card, 'resolve:' + kind, 'FATAL', (res && res.reason) || ''); return status }
+  if (status === 'followup' && res && res.followupCard) {
+    residualFollowups.push({ card, kind, followupCard: res.followupCard, reason: res.reason || '' })
+  }
+  ledger(card, 'resolve:' + kind, status, (res && (res.followupCard || res.reason)) || '')
+  return status
+}
+
+// A crashed runCard (E1) routes through new2-resolve(agent-crash) for a specialist
+// retry, then ALWAYS lands as a tracked followup — never a silent drop.
+async function crashFollowup(id, e) {
+  const msg = String(e && e.message)
+  const s = await resolve('agent-crash', id, 'runCard crashed: ' + msg, { mayEditPaths: [], scopeFiles: [] })
+  if (s !== 'followup') residualFollowups.push({ card: id, kind: 'agent-crash', followupCard: '(specialist retry attempted — manual check)', reason: msg })
+  return { card: id, status: 'followup', gates: [{ gate: 'runCard', decision: 'ERROR', detail: msg }], commit: '-', telemetry: {} }
+}
+
+// ───────────────────────────────────────────────────────────────────────────
+// Per-card pipeline — sequences /new Phases 1→4 via agents that Read the modules.
+// Each phase agent returns a structured verdict; this function applies the
+// deterministic gate policy and routes blocks to new2-resolve.
+// ───────────────────────────────────────────────────────────────────────────
+async function runCard(cardId, cardPath, lessons) {
+  const gates = []
+  const tele = {}
+  function g(name, decision, detail) { gates.push({ gate: name, decision, detail: detail || '' }); ledger(cardId, name, decision, detail) }
+
+  const cardBrief = `${projectBrief}\n\nCard: ${cardId}\nCard YAML: ${cardPath}\nWorktree: ${sharedCtx.worktreePath} (cd into it)\nFile-ownership map: ${sharedCtx.ownershipMapPath}\nBatch lessons so far: ${lessons.length ? lessons.join(' | ') : '(none)'}\nArch baseline (write to /tmp/arch-baseline-${cardId}.md): reuse if present.`
+
+  // --- Phase 1+2: claim, ground, implement (coder), completeness; returns the
+  //     completion verdict + the AC ledger + the file diff. Self-heals build gates
+  //     (G26) up to the module's retry cap before reporting unresolved. ---
+  const impl = await agent(
+    `Implement card ${cardId} per ${REF}/implement.md (Phase 1 claim+architect+plan-auditor, Phase 2 coder dispatch via owner_agent — G25: unknown owner_agent → default to coder, never HALT) and ${REF}/completeness.md (Phase 2.5 completeness + 2.5b AC-closure ledger). Run all gates/bash yourself.\n\n${cardBrief}\n\n` +
+      `POLICIES: G25 unknown owner_agent → coder + log. G26 Phase-2 lint/tsc/test/build failing after the module's retry cap (or stuck-loop) → return buildBlocked:true with the failing gate. Do NOT prompt. Build the AC Closure Ledger (one row per acceptance_criteria: implemented | unmet) — DO NOT silently defer; just report unmet rows. Persist the architecture baseline to /tmp/arch-baseline-${cardId}.md and the diff to /tmp/diff-${cardId}.txt.\n\n` +
+      `Return: { epic:boolean, buildBlocked:boolean, blockedGate:string, unmetACs:[{n,text}], scopeFiles:[...], mayEditPaths:[...], fileDiffViolation:boolean (already auto-reverted per 11b), note }`,
+    { label: `implement:${cardId}`, phase: 'Implement', agentType: 'general-purpose',
+      schema: { type: 'object', required: ['epic', 'buildBlocked', 'unmetACs', 'scopeFiles'], additionalProperties: true,
+        properties: { epic: { type: 'boolean' }, buildBlocked: { type: 'boolean' }, blockedGate: { type: 'string' }, unmetACs: { type: 'array', items: { type: 'object', additionalProperties: true } }, scopeFiles: { type: 'array', items: { type: 'string' } }, mayEditPaths: { type: 'array', items: { type: 'string' } }, fileDiffViolation: { type: 'boolean' }, note: { type: 'string' } } } }
+  )
+
+  if (impl && impl.epic) { g('router', 'EPIC-SKIPPED', 'epic card — not implemented'); return { card: cardId, status: 'epic-skipped', gates, commit: '-', telemetry: tele } }
+
+  const mayEdit = (impl && impl.mayEditPaths) || []
+  const scopeFiles = (impl && impl.scopeFiles) || []
+  if (impl && impl.fileDiffViolation) g('E4-file-diff', 'AUTO-REVERTED', 'coder touched files outside ownership — reverted per implement.md 11b')
+
+  // G26 — build gates not converging → self-heal.
+  if (impl && impl.buildBlocked) {
+    const s = await resolve('blocker', cardId, `Phase-2 gate failing: ${impl.blockedGate}`, { mayEditPaths: mayEdit, scopeFiles, domain: 'code' })
+    g('G26-build', s === 'resolved' ? 'RESOLVED' : 'FOLLOWUP', impl.blockedGate)
+    if (s !== 'resolved') return { card: cardId, status: 'followup', gates, commit: '-', scopeFiles, telemetry: tele }
+  }
+
+  // G6+G7 — AC-Closure: every unmet AC must be implemented (never silently deferred).
+  for (const ac of (impl && impl.unmetACs) || []) {
+    const s = await resolve('ac-unmet', cardId, `AC-${ac.n}: ${ac.text}`, { mayEditPaths: mayEdit, scopeFiles, domain: 'code' })
+    g('G7-ac-closure', s === 'resolved' ? 'RESOLVED' : 'FOLLOWUP', `AC-${ac.n}`)
+  }
+
+  // --- Phases 2.55 / 2.6 / 3 / 3.5 / 3.7 — review fan-out. One agent runs the
+  //     review pipeline per the modules and returns each gate's verdict + any
+  //     scope-expanding findings. Auto-revert gates (G9/G12) are handled inside. ---
+  const review = await agent(
+    `Run the per-card review pipeline for ${cardId} per ${REF}/review-cycle.md (Phase 2.55 Simplify, 2.6 E2E, 3 doc, 3.5 QA) and ${REF}/codex-gate.md (Phase 3.7 Codex). Run all agents/gates yourself.\n\n${cardBrief}\nDiff: /tmp/diff-${cardId}.txt\n\n` +
+      `POLICIES (NO prompts): G9 simplify-regression after retries → AUTO-REVERT the simplify fixes, proceed. G12 doc-phase regression after retries → AUTO-REVERT the doc edits that broke the build. G11 E2E 'error' (tooling) → proceed with e2eStatus:'ERROR' (flag only). For BLOCKING failures that survive the module's retry cap, report them so the caller routes them to new2-resolve: G10 E2E 'blocked', G13 QA fail, G14 Codex BLOCKER/HIGH, G8 alias-mutation un-guarded, G15 Codex crash (security domain: never inline-bypass). Also report scopeExpansion findings (legitimate findings BEYOND this card's AC: from Simplify/Codex/doc-drift→bug).\n\n` +
+      `Return: { simplify:'clean|reverted|applied', e2eStatus:'passed|skipped|blocked|error|overridden', qa:'pass|fail|skip', codex:'pass|blocker|crash', blocks:[{gate,domain,evidence}], scopeExpansion:[{evidence,domain,withinOwnership:boolean,newAC:boolean}], docGaps:{found,fixed}, qaFirstAttempt:'pass|fail|n/a' }`,
+    { label: `review:${cardId}`, phase: 'Implement', agentType: 'general-purpose',
+      schema: { type: 'object', required: ['blocks', 'scopeExpansion'], additionalProperties: true,
+        properties: { simplify: { type: 'string' }, e2eStatus: { type: 'string' }, qa: { type: 'string' }, codex: { type: 'string' }, blocks: { type: 'array', items: { type: 'object', additionalProperties: true } }, scopeExpansion: { type: 'array', items: { type: 'object', additionalProperties: true } }, docGaps: { type: 'object', additionalProperties: true }, qaFirstAttempt: { type: 'string' } } } }
+  )
+
+  if (review) {
+    if (review.simplify) g('G9-simplify', review.simplify === 'reverted' ? 'AUTO-REVERT' : 'OK', review.simplify)
+    if (review.e2eStatus) g('G10/G11-e2e', review.e2eStatus === 'error' ? 'FLAG' : review.e2eStatus.toUpperCase())
+    if (review.qaFirstAttempt) tele.qa_first_attempt = review.qaFirstAttempt
+    if (review.docGaps) tele.doc_gaps = review.docGaps
+  }
+
+  // Route blocking review failures (G8/G10/G13/G14/G15) to new2-resolve.
+  let cardBlocked = false
+  for (const b of (review && review.blocks) || []) {
+    const kind = b.gate && /e2e/i.test(b.gate) ? 'e2e-blocked' : (b.gate && /qa/i.test(b.gate) ? 'qa-fail' : 'blocker')
+    const s = await resolve(kind, cardId, `${b.gate}: ${b.evidence || ''}`, { mayEditPaths: mayEdit, scopeFiles, domain: b.domain || 'code' })
+    g(b.gate || 'review-block', s === 'resolved' ? 'RESOLVED' : 'FOLLOWUP', b.evidence || '')
+    if (s !== 'resolved') cardBlocked = true
+  }
+
+  // Scope-expansion findings (Asse 2) — deterministic boundary inside new2-resolve.
+  for (const sx of (review && review.scopeExpansion) || []) {
+    const s = await resolve('scope-expansion', cardId, sx.evidence || '', { mayEditPaths: mayEdit, scopeFiles, domain: sx.domain || 'code' })
+    g('scope-expansion', s === 'resolved' ? 'INTEGRATED' : 'FOLLOWUP', sx.evidence || '')
+  }
+
+  if (cardBlocked) return { card: cardId, status: 'followup', gates, commit: '-', scopeFiles, archBaselinePath: `/tmp/arch-baseline-${cardId}.md`, telemetry: tele }
+
+  // --- Phase 4 — commit (G16: auto-clear COMMIT_LOCK + retry; persistent → resolve). ---
+  const commitRes = await agent(
+    `Commit card ${cardId} in the worktree per ${REF}/commit.md (Phase 4 explicit-staging — NEVER git add -A, NEVER git stash in a worktree — + Phase 5 context clean; mark the card DONE + ssot-registry). Run git yourself.\n\n${cardBrief}\n\n` +
+      `POLICY G16: on commit failure auto-clear stale COMMIT_LOCK and retry (module cap). 'nothing to commit' = already committed (record HEAD). If still locked after the cap → return committed:false (caller routes to new2-resolve).\n\n` +
+      `Return: { committed:boolean, commit:string, filesChanged:[...] }`,
+    { label: `commit:${cardId}`, phase: 'Implement', agentType: 'general-purpose',
+      schema: { type: 'object', required: ['committed'], additionalProperties: true, properties: { committed: { type: 'boolean' }, commit: { type: 'string' }, filesChanged: { type: 'array', items: { type: 'string' } } } } }
+  )
+
+  if (!commitRes || !commitRes.committed) {
+    const s = await resolve('blocker', cardId, 'commit blocked after retries', { mayEditPaths: mayEdit, scopeFiles, domain: 'code' })
+    g('G16-commit', s === 'resolved' ? 'RESOLVED' : 'FOLLOWUP')
+    if (s !== 'resolved') return { card: cardId, status: 'followup', gates, commit: '-', scopeFiles, archBaselinePath: `/tmp/arch-baseline-${cardId}.md`, telemetry: tele }
+  }
+
+  g('commit', 'COMMITTED', (commitRes && commitRes.commit) || '')
+  return {
+    card: cardId, status: 'committed',
+    commit: (commitRes && commitRes.commit) || '-',
+    filesChanged: (commitRes && commitRes.filesChanged) || [],
+    scopeFiles, archBaselinePath: `/tmp/arch-baseline-${cardId}.md`,
+    gates, telemetry: tele,
+  }
+}
+
+// ───────────────────────────────────────────────────────────────────────────
+// Phase Implement — driver: sequential or team-mode (parallel coders per wave).
+// ───────────────────────────────────────────────────────────────────────────
+phase('Implement')
+const lessons = []
+const pathById = {}
+cardIds.forEach((id, i) => { pathById[id] = cardPaths[i] || `${paths.backlog_dir || ''}/${id}.yml` })
+
+if (preflight.executionMode === 'team' && Array.isArray(preflight.groups) && preflight.groups.length) {
+  // Waves run in order (a higher level waits for lower levels); cards within a wave
+  // run concurrently — parallel() keeps every coder's bloat inside the runtime.
+  const sortedGroups = preflight.groups.slice().sort((x, y) => (x.level || 0) - (y.level || 0))
+  for (const grp of sortedGroups) {
+    const ids = (grp.cards || []).filter((id) => runnableCards.includes(id))
+    if (!ids.length) continue
+    log(`Team wave level=${grp.level}: ${ids.length} card(s) in parallel.`)
+    const waveResults = await parallel(ids.map((id) => () => runCard(id, pathById[id], lessons).catch((e) => crashFollowup(id, e))))
+    for (const r of waveResults.filter(Boolean)) { perCardResults.push(r); if (r.note) lessons.push(`${r.card}: ${r.note}`) }
+  }
+} else {
+  // Sequential — cards share one worktree and run one at a time.
+  for (const id of runnableCards) {
+    const r = await runCard(id, pathById[id], lessons).catch((e) => crashFollowup(id, e))
+    perCardResults.push(r)
+    if (r && r.note) lessons.push(`${r.card}: ${r.note}`)
+  }
+}
+
+const committed = perCardResults.filter((r) => r.status === 'committed')
+
+// ───────────────────────────────────────────────────────────────────────────
+// Phase Final — cross-batch final review (reuse new-final-review). F.5 user gates
+// become deterministic: G17 needs-manual → treat as VERIFIED (the workflow already
+// drops only FALSE_POSITIVE); G18 unresolved BLOCKER/HIGH → new2-resolve, else
+// block the merge.
+// ───────────────────────────────────────────────────────────────────────────
+phase('Final')
+let finalSummary = null
+let mergeBlocked = batchFatal
+if (committed.length && !batchFatal) {
+  const reviewScopeFiles = dedupe(committed.flatMap((r) => r.scopeFiles || []))
+  const archPaths = committed.map((r) => r.archBaselinePath).filter(Boolean)
+  const allArch = archPaths.length === committed.length ? archPaths : null
+  const hasApiDataFiles = reviewScopeFiles.some((f) => /api\/|data-model|\.sql$|migrations?\//i.test(f))
+
+  const final = await workflow('new-final-review', {
+    firstCardId: firstCard,
+    worktreePath: sharedCtx.worktreePath,
+    baseBranch: TRUNK,
+    cardPaths: committed.map((r) => pathById[r.card]).filter(Boolean),
+    reviewScopeFiles,
+    archBaselinePaths: allArch,
+    hasApiDataFiles,
+    config: cfg,
+  }).catch(() => null)
+
+  if (final) {
+    finalSummary = final.summary || null
+    ledger(firstCard, 'final-review', 'DONE', `engine=${final.codexEngine}; verified=${final.summary ? final.summary.verified : '?'}`)
+    // G18 — apply BLOCKER/HIGH fixes; unresolved → block merge. G17: a workflow
+    // cannot ask the user, so NEEDS_MANUAL_CONFIRMATION is treated as VERIFIED
+    // (attempt the fix) — never silently ignored (the count-only path was the bug).
+    const blockers = (final.findings || []).filter((f) => (f.classification === 'VERIFIED' || f.classification === 'NEEDS_MANUAL_CONFIRMATION') && (f.severity === 'BLOCKER' || f.severity === 'HIGH'))
+    for (const f of blockers) {
+      const s = await resolve('merge-blocker', f.finding_id || firstCard, `${f.classification} ${f.severity} ${f.title}: ${f.evidence}`, { mayEditPaths: reviewScopeFiles, scopeFiles: reviewScopeFiles, domain: f.domain || 'code' })
+      if (s !== 'resolved') mergeBlocked = true
+    }
+    if ((final.summary && final.summary.failingGates && final.summary.failingGates.length)) {
+      const s = await resolve('qa-fail', firstCard, `final gates failing: ${final.summary.failingGates.join(', ')}`, { mayEditPaths: reviewScopeFiles, scopeFiles: reviewScopeFiles, domain: 'code' })
+      if (s !== 'resolved') mergeBlocked = true
+    }
+  } else {
+    ledger(firstCard, 'final-review', 'SKIPPED', 'workflow returned null')
+  }
+} else {
+  ledger(firstCard, 'final-review', 'SKIPPED', batchFatal ? 'batch fatal — review/merge halted' : 'no committed cards')
+}
+
+// ───────────────────────────────────────────────────────────────────────────
+// Phase Merge — auto-merge to trunk (G24) + Phase 6b/6c reconciliation (conservative
+// git policies: G19–G23). Skipped when a final BLOCKER/HIGH is unresolved.
+// ───────────────────────────────────────────────────────────────────────────
+phase('Merge')
+let mergeResult = null
+if (!committed.length) {
+  ledger(firstCard, 'merge', 'SKIPPED', 'no committed cards')
+} else if (mergeBlocked) {
+  ledger(firstCard, 'merge', 'BLOCKED', 'unresolved final BLOCKER/HIGH — worktree left intact for review')
+} else {
+  mergeResult = await agent(
+    `Auto-merge the batch worktree to ${TRUNK} per ${REF}/merge-cleanup.md (Phase 6 via /mw programmatic with checksAlreadyPassed:true, Phase 6b status reconciliation, Phase 6c workspace hygiene). Run git yourself.\n\n${projectBrief}\nWorktree: ${sharedCtx.worktreePath}\nBranch: ${sharedCtx.branch}\nmerge_strategy: ${mergeStrategy}\nCommitted cards: ${committed.map((r) => r.card).join(' ')}\nPhase-0 stash to restore (if any): see /tmp/batch-tracker-${firstCard}.md ## Workspace Snapshot.\n\n` +
+      `DETERMINISTIC POLICIES (NO prompts): G24 → auto-merge via merge_strategy. G19 sync-deferred → if HEAD==${TRUNK} ff-pull, else leave+report. G20 sync-needs-decision → leave+report (never touch foreign files). G21 post-batch dirty (no stash) → partition-ignore framework artifacts; leave the rest + report. G22 divergence → behind: ff-pull; ahead/both: leave+report; NEVER reset --hard / force-push. G23 stash restore conflict → leave the stash intact + report (never drop). Phase 6b: force any non-DONE batch card to DONE.\n\n` +
+      `Return: { merged:boolean, mergeCommit, mergeTs, reconciliation, note }`,
+    { label: 'merge', phase: 'Merge', agentType: 'general-purpose', schema: MERGE_SCHEMA }
+  )
+  ledger(firstCard, 'G24-merge', (mergeResult && mergeResult.merged) ? 'MERGED' : 'INCOMPLETE', (mergeResult && (mergeResult.mergeCommit || mergeResult.note)) || '')
+  if (mergeResult && mergeResult.reconciliation) ledger(firstCard, 'G19-23-reconcile', 'AUTO', mergeResult.reconciliation)
+}
+
+// ───────────────────────────────────────────────────────────────────────────
+// Phase Production (Phase 7) — post-merge readiness checklist (non-blocking, full
+// parity with /new). Auto-executes stack-matched deploys; reports the manual items.
+// ───────────────────────────────────────────────────────────────────────────
+phase('Production')
+if (mergeResult && mergeResult.merged) {
+  prodReadiness = await agent(
+    `Run the post-merge Production Readiness checklist per ${REF}/production-readiness.md (Phase 7) over the batch's changed files. Auto-EXECUTE only stack-matched index / access-rule / cron deploys; REPORT (do not execute) env vars, feature flags, DB migrations, third-party secrets, DNS changes. NON-BLOCKING — never fail the batch.\n\n${projectBrief}\nChanged files: ${dedupe(committed.flatMap((r) => r.filesChanged || [])).join(', ') || '(derive from git)'}\n\nReturn: { autoExecuted:[...], manualItems:[...], note }`,
+    { label: 'production-readiness', phase: 'Production', agentType: 'general-purpose',
+      schema: { type: 'object', required: ['manualItems'], additionalProperties: true, properties: { autoExecuted: { type: 'array', items: { type: 'string' } }, manualItems: { type: 'array', items: { type: 'string' } }, note: { type: 'string' } } } }
+  )
+  ledger(firstCard, 'phase7-production', 'DONE', `auto=${((prodReadiness && prodReadiness.autoExecuted) || []).length} manual=${((prodReadiness && prodReadiness.manualItems) || []).length}`)
+} else {
+  ledger(firstCard, 'phase7-production', 'SKIPPED', 'not merged')
+}
+
+// ───────────────────────────────────────────────────────────────────────────
+// Return — assemble the report + Phase-8 telemetry (variant new2).
+// ───────────────────────────────────────────────────────────────────────────
+return finalReturn({ fatal: false })
+
+// ───────────────────────────────────────────────────────────────────────────
+function finalReturn(opts) {
+  const fatal = opts && opts.fatal
+  const telemetry = buildTelemetry()
+  const report = buildReport({ fatal, reason: opts && opts.reason, finalSummary, mergeResult })
+  return { report, perCardResults, gateLedger, residualFollowups, telemetry }
+}
+
+function buildTelemetry() {
+  const total = cardIds.length
+  const done = perCardResults.filter((r) => r.status === 'committed').length
+  const fixCycles = gateLedger.filter((x) => /resolve:/.test(x.gate)).length
+  return {
+    variant: 'new2',
+    batch: cardIds,
+    first_card: firstCard,
+    cards_total: total,
+    cards_committed: done,
+    cards_followup: perCardResults.filter((r) => r.status === 'followup').length,
+    followups_created: residualFollowups.length,
+    resolve_invocations: fixCycles,
+    final_review: finalSummary || null,
+    merged: !!(mergeResult && mergeResult.merged),
+    execution_mode: preflight ? preflight.executionMode : 'sequential',
+    per_card: perCardResults.map((r) => ({ card: r.card, status: r.status, telemetry: r.telemetry || {} })),
+    stats_requested: !!FLAGS.stats,
+  }
+}
+
+function buildReport(o) {
+  const L = []
+  L.push(`# new2 batch — ${cardIds.join(' ')}`)
+  L.push(`Variant: **new2** (workflow-hosted) · Mode: ${preflight ? preflight.executionMode : '?'} · Trunk: ${TRUNK}`)
+  if (o.fatal) { L.push(``, `## ⛔ BATCH FATAL`, o.reason || 'workspace unworkable'); return L.join('\n') }
+  L.push(``, `## Esito card`)
+  L.push(`| Card | Status | Commit | File |`)
+  L.push(`|------|--------|--------|------|`)
+  for (const r of perCardResults) L.push(`| ${r.card} | ${r.status} | ${r.commit || '-'} | ${(r.filesChanged || []).length} |`)
+  if (finalSummary) {
+    L.push(``, `## Final review`)
+    L.push(`Verified: ${finalSummary.verified} (BLOCKER ${finalSummary.blockers} / HIGH ${finalSummary.highs}) · needs-manual ${finalSummary.needsManual} · failing gates: ${(finalSummary.failingGates || []).join(', ') || 'none'}`)
+  }
+  L.push(``, `## Merge`)
+  if (mergeResult && mergeResult.merged) L.push(`Merged → ${TRUNK} @ ${mergeResult.mergeCommit || '?'}${mergeResult.reconciliation ? ' · ' + mergeResult.reconciliation : ''}`)
+  else if (mergeBlocked) L.push(`Merge BLOCKED — ${batchFatal ? 'batch fatal (new2-resolve)' : 'unresolved final BLOCKER/HIGH'}. Worktree left intact at ${sharedCtx.worktreePath}.`)
+  else L.push(`Not merged (no committed cards or incomplete).`)
+  if (prodReadiness) {
+    const man = prodReadiness.manualItems || []
+    L.push(``, `## Production readiness (Phase 7)`)
+    L.push(`Auto-eseguiti: ${(prodReadiness.autoExecuted || []).length} · Da fare a mano: ${man.length}`)
+    for (const m of man) L.push(`- [ ] ${m}`)
+  }
+  if (residualFollowups.length) {
+    L.push(``, `## ⚠️ Follow-up auto-creati (residui non risolti autonomamente — nulla perso)`)
+    for (const f of residualFollowups) L.push(`- **${f.followupCard}** ← ${f.card} (${f.kind})${f.reason ? ': ' + f.reason : ''}`)
+  }
+  const excluded = gateLedger.filter((x) => x.decision === 'EXCLUDED')
+  if (excluded.length) {
+    L.push(``, `## Card escluse in pre-flight`)
+    for (const e of excluded) L.push(`- ${e.card}: ${e.detail}`)
+  }
+  L.push(``, `_Gate ledger: ${gateLedger.length} decisioni deterministiche, 0 AskUserQuestion._`)
+  return L.join('\n')
+}
+
+function dedupe(arr) { return Array.from(new Set(arr)) }
+function emptyReturn(reason) {
+  return { report: `# new2 — no-op\n${reason}`, perCardResults: [], gateLedger: [], residualFollowups: [], telemetry: { variant: 'new2', cards_total: 0, reason } }
+}

package/framework/docs/WORKFLOWS.md

@@ -14,6 +14,13 @@ workflows are unavailable behaves exactly as before.
 | Workflow | Used by | What it does |
 | :--- | :--- | :--- |
 | `new-final-review` | `/new` Final Review (Step F.1.5) | Runs the read-only cross-batch review fan-out — architecture baseline + Codex ‖ doc-reviewer ‖ api-perf-cost-auditor ‖ qa-sentinel — then adversarially verifies low-confidence findings and returns them classified. Applies no fixes (the skill owns fix application + user gates). |
+| `new2` (v4.16.0) | `/new2` skill (the whole batch) | **EXPERIMENTAL A/B variant of `/new`.** Hosts the ENTIRE batch orchestration — pre-flight, per-card implement+review pipeline (sequential or team-mode parallel coders), final review (delegates to `new-final-review`), and auto-merge — in the background runtime, so subagent output never enters the main context. Fully autonomous: every `/new` `AskUserQuestion` gate is a deterministic policy; blocking gates / scope-expanding findings route to `new2-resolve`. Agents Read `/new`'s reference modules for semantics, so the script encodes only orchestration shape + gate policy. |
+| `new2-resolve` (v4.16.0) | `new2` (self-healing) | Resolution pass invoked by `new2` for any gate that would otherwise need a human: card fail/blocker, scope-EXPANDING finding, or cross-cutting edge (agent-crash, baseline-fail). Runs targeted fix → judged multi-attempt → adversarial re-verify; its terminal auto-materialises a tracked follow-up card so nothing is silently dropped. Domain-Override aware (doc→doc-reviewer; security/migration never inline-bypassed). |
+
+> **`new2` is an experiment, not a replacement.** It exists to A/B-test the
+> context-economy of workflow-hosting `/new`. `/new` remains the SSOT, the
+> cross-tool default, and the recovery-safe path. `new2` is Claude-only and its
+> skill HALTs with a pointer to `/new` when the `Workflow` tool is unavailable.
 
 ## How distribution works
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "baldart",
-  "version": "4.15.0",
+  "version": "4.16.1",
   "description": "Claude Agent Framework - Reusable framework for coordinating AI agents and humans in software projects",
   "bin": {
     "baldart": "./bin/baldart.js"