baldart 4.16.2 → 4.17.0

package/framework/docs/WORKFLOWS.md

@@ -14,8 +14,8 @@ workflows are unavailable behaves exactly as before.
 | Workflow | Used by | What it does |
 | :--- | :--- | :--- |
 | `new-final-review` | `/new` Final Review (Step F.1.5) | Runs the read-only cross-batch review fan-out — architecture baseline + Codex ‖ doc-reviewer ‖ api-perf-cost-auditor ‖ qa-sentinel — then adversarially verifies low-confidence findings and returns them classified. Applies no fixes (the skill owns fix application + user gates). |
-| `new2` (v4.16.0) | `/new2` skill (the whole batch) | **EXPERIMENTAL A/B variant of `/new`.** Hosts the ENTIRE batch orchestration — pre-flight, per-card implement+review pipeline (sequential or team-mode parallel coders), final review (delegates to `new-final-review`), and auto-merge — in the background runtime, so subagent output never enters the main context. Fully autonomous: every `/new` `AskUserQuestion` gate is a deterministic policy; blocking gates / scope-expanding findings route to `new2-resolve`. Agents Read `/new`'s reference modules for semantics, so the script encodes only orchestration shape + gate policy. |
-| `new2-resolve` (v4.16.0) | `new2` (self-healing) | Resolution pass invoked by `new2` for any gate that would otherwise need a human: card fail/blocker, scope-EXPANDING finding, or cross-cutting edge (agent-crash, baseline-fail). Runs targeted fix → judged multi-attempt → adversarial re-verify; its terminal auto-materialises a tracked follow-up card so nothing is silently dropped. Domain-Override aware (doc→doc-reviewer; security/migration never inline-bypassed). |
+| `new2` (v4.17.0) | `/new2` skill (the whole batch) | **EXPERIMENTAL A/B variant of `/new`.** Hosts the ENTIRE batch in the background runtime so subagent output never enters the main context. **v4.17.0 hardening (single-wave):** a **dependency-gated DAG scheduler** runs a card only when all in-batch deps are *committed* (and blocks transitive dependents of a failed dep instead of routing them to resolve); each card uses its **owner_agent** + a **specialized review fan-out** (not general-purpose); the worktree is kept **atomic per card** (rollback-to-HEAD on failure); transient API errors are retried and a sustained **outage degrades cleanly** (`degraded` return + durable resume via the skill); a **run ledger** dedups resolves and records accepted deferrals (no re-routing loop); the **merge is integrity-gated** (never force-DONE, never `git add` unreviewed code, never merge an incomplete/degraded batch); mechanical steps (commit / follow-up) run on **Haiku**; telemetry carries real **cost** (`total_tokens` via `budget.spent()`, `agent_count`, skill-stamped `wall_clock_s`) + `degraded`. Agents Read `/new`'s reference modules for semantics. |
+| `new2-resolve` (v4.17.0) | `new2` (self-healing) | Resolution pass for any gate that would otherwise need a human. **v4.17.0:** a **terminal short-circuit** skips the costly multi-attempt when the problem is impossible-by-definition (`out-of-ownership` verified in JS; other terminal reasons ratified by a judge); a **MANDATORY adversarial judge** cross-checks every `verified` claim — the judge independently greps the files and the workflow verifies they fall inside MAY-EDIT (defeats fabricated success); accepts a **batched `findings` list** (one resolve per fix-area); domain-specialized fixer + judge (doc→doc-reviewer, ui→ui-expert, security→security-reviewer judge, perf→api-perf-cost-auditor judge); incidental out-of-scope findings are surfaced (not dropped); follow-up materialisation is offline-safe (deferred to the skill if no agent can write). |
 
 > **`new2` is an experiment, not a replacement.** It exists to A/B-test the
 > context-economy of workflow-hosting `/new`. `/new` remains the SSOT, the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "baldart",
-  "version": "4.16.2",
+  "version": "4.17.0",
   "description": "Claude Agent Framework - Reusable framework for coordinating AI agents and humans in software projects",
   "bin": {
     "baldart": "./bin/baldart.js"