baldart 4.89.2 → 4.92.1

package/framework/.claude/skills/new2/CHANGELOG.md

@@ -2,6 +2,52 @@
 
 Formato: [Keep a Changelog](https://keepachangelog.com/) · [SemVer](https://semver.org/).
 
+## 1.2.1 — 2026-07-02
+
+Review avversariale post-release (3 lenti indipendenti, finding verificati):
+- **Step 3.5 ramo AUTONOMOUS**: env-autonomous / origine delegata → mai una domanda;
+  verify green ⇒ prosegui, altrimenti `degraded` (deferral owner-gated di fine batch);
+  mai un apply command autonomo.
+- **Origine delegata = autonoma ovunque** (Step 1.5): l'escape hatch 3b è SKIPPED anche
+  con TTY (niente ciclo /new→new2→/new a costo pieno inline).
+- **Contatore resume DURABILE** (Step 5.3): `resume_attempt: N/3` appeso al batch
+  tracker prima di ogni re-invocazione (una compaction non resetta il bound) +
+  teardown del broker Codex prima di ogni uscita per stallo.
+- `new2.js`: verifier strutturale `status:"skipped"` = UNDERRUN (mai PASS);
+  re-verify deterministica una-tantum dopo un fix strutturale risolto;
+  `bindingCheck` CONSUMATO (violazioni → resolve ui; assente → ledger, fail-open);
+  `${MAIN}` quotato dentro `$(git -C …)` (path con spazi).
+
+## 1.2.0 — 2026-07-02
+
+- **Resume loop HARD-BOUNDED (Step 5.3)**: `resumeMaxAttempts = 3` con contatore
+  esplicito + stall detection (stesso set di card incomplete = stop immediato).
+  Un `degraded` persistente è un outage/blocker strutturale, non converge iterando
+  (~0–200k+ token a ciclo).
+
+## 1.1.1 — 2026-07-02
+
+- Fix B4 (location parallela in `new2.js`): il preflight creava il tracker in
+  `/tmp/batch-tracker-…` (volatile — la causa dei 2/3 run con "tracker LOST");
+  ora la location DURABILE `$(git -C $MAIN rev-parse --git-common-dir)/baldart/
+  run/…` allineata a new/SKILL.md § Context Tracking. Anche il riferimento del
+  merge allo stash Phase-0 aggiornato.
+- Cap adattivo del fan-out nei workflow review (`new-card-review.js` /
+  `new-final-review.js`): 5 → 2 al primo transient rate-limit (era fisso 3).
+
+## 1.1.0 — 2026-07-02
+
+- **Promossa a motore di default di `/new -auto`** (delegation gate v4.90.0):
+  non più solo variante sperimentale A/B. Nuovo Step 1.5 (contratto della
+  delega: grammar residua, mai `-auto`/`-auto-ship`/`-inline`; batch delegati
+  sempre migration-free — trovare una migrazione dichiarata su run delegata =
+  HALT + handback a `/new -inline`, mai una domanda).
+- `new2.js`: lane di fedeltà strutturale route-free per card con mockup
+  (markup-fidelity-verifier + obbligo Lane-Ledger: verifier assente →
+  `verification-coverage-gap`, card mai auto-DONE) + binding gate deterministico
+  nel brief di implement + campi cardGraph `designSrcDir`/`designHtml`/
+  `hasBindings` (T1.A).
+
 ## 1.0.0 — 2026-07-01
 
 - Baseline: versioning per-skill introdotto al framework v4.82.0.

package/framework/.claude/skills/new2/SKILL.md

@@ -1,15 +1,18 @@
 ---
 name: new2
 effort: high
-version: 1.0.0
+version: 1.2.1
 description: >
-  EXPERIMENTAL workflow-hosted variant of /new (A/B testing). Implements one or
+  Workflow-hosted batch engine for /new. Implements one or
   more backlog cards end-to-end by delegating the WHOLE batch to a background
   dynamic workflow — so subagent output never enters the main orchestrator
   context. The batch runs autonomously (zero AskUserQuestion during the run): every
   /new gate is replaced by a deterministic policy + a self-healing resolution pass;
   in interactive mode an optional post-batch escape hatch can hand the hard-case
-  follow-ups to /new for the real human gate. Claude-only (needs the Workflow tool).
+  follow-ups to /new for the real human gate. Since v4.90.0 this is ALSO the
+  default engine of `/new -auto` (its delegation gate invokes this skill when the
+  Workflow tool + new2.js are present — measured driver: 53–59% orchestrator
+  turn-tax on inline -auto runs). Claude-only (needs the Workflow tool).
   Usage: /new2 CARD-IDS (same arg grammar as /new). Triggers on:
   /new2, "implementa le card con workflow", "new2".
 ---
@@ -71,6 +74,24 @@ Also verify the workflow script is linked: if `.claude/workflows/new2.js` is abs
 print the same guidance and HALT (the framework did not link it — Codex tree, or a
 pre-v4.16 install).
 
+### Step 1.5 — Called by `/new -auto` (delegation note, v4.90.0)
+
+`/new`'s AUTONOMOUS OFF-CONTEXT DELEGATION GATE invokes this skill with the same
+residual grammar (card IDs + `-full` + `-stats` + `effort=`) — never
+`-auto`/`-auto-ship`/`-inline` (this skill IS autonomous by contract; the
+`AUTO_SHIP` deploy boundary stays in `/new`'s classic path). **A delegated run is
+AUTONOMOUS-ORIGIN**: treat it exactly like the env-signalled autonomous state
+everywhere this skill branches on it — Step 3.5 resolves deterministically (its
+AUTONOMOUS branch) and **Step 3b's escape hatch is SKIPPED** (the user asked for
+`-auto`; a post-batch question — and a possible `/new` re-invocation at full
+inline cost — would break that promise even with a TTY present). `/new` only
+delegates **migration-free** batches (it probes `migration_plan.required`
+itself), so Step 3.5's one interactive question cannot fire on a delegated run —
+if you nonetheless find a declared, unapplied migration in a delegated batch,
+HALT and hand back to `/new` classic (`"batch con migrazione dichiarata — riesegui
+/new <cards> -auto -inline"`) instead of asking. Everything else is identical to a
+direct `/new2` invocation.
+
 ### Step 2 — Parse the invocation (same grammar as `/new`)
 
 Parse `CARD-IDS` exactly as `/new` does — space-separated, hyphen-range
@@ -123,6 +144,14 @@ untouched), so the schema is live **before** the workflow starts. It mirrors `/n
    modalities (always include "Già applicata — prosegui" and "Abort"). This is the SAME class as the
    Step-2 "ONE pre-launch question" — pre-launch, not a mid-run gate; the zero-ask contract is about
    the *workflow*, which is untouched.
+   **AUTONOMOUS branch (v4.92.1 — env `BALDART_AUTONOMOUS` / `CI` / `GITHUB_ACTIONS`, or a
+   delegated `/new -auto` origin per Step 1.5): NEVER ask.** Resolve deterministically:
+   (a) `migration_plan.verify` exists → run it; green ⇒ treat as "Già applicata — prosegui",
+   red/absent ⇒ (b) set `migration = { status: 'degraded', reason: 'autonomous —
+   owner-gated apply deferred' }` and continue (the workflow's end-of-batch owner-gated
+   deferral handles it — a `db-migration-deploy` residual, exactly the `/new` Phase 0 1b
+   autonomous disposition). Never run an apply **command** modality autonomously (it is an
+   outward/irreversible action).
 6. **Execute the choice in `$MAIN`**:
    - **Schema-deploy-from-trunk-only guard** (when `stack.schema_deploy_from_trunk_only: true`): a
      **command** modality is a remote schema deploy → run it only from trunk. Check
@@ -239,11 +268,29 @@ returns when the batch is done. It returns:
    prints nothing, set the epic card `status: DONE` + `completed_date` + note
    `"epic-closure gate — all children DONE (post-run, new2 skill)"`, folded into the SAME
    reconciliation commit. If any child is still open, leave the epic untouched.
-3. **Resume if degraded.** If `degraded` is true, re-invoke the workflow with
-   `Workflow({ scriptPath, resumeFromRunId })` (same `args` + the new `ts`). The
-   per-card **skip-completed** guard makes the resume idempotent — already-committed
-   cards are skipped, only the incomplete/blocked ones run. Repeat until `degraded`
-   is false (or the same cards stall twice → surface to the user).
+3. **Resume if degraded — HARD-BOUNDED (v4.92.0).** If `degraded` is true, re-invoke
+   the workflow with `Workflow({ scriptPath, resumeFromRunId })` (same `args` + the
+   new `ts`). The per-card **skip-completed** guard makes the resume idempotent —
+   already-committed cards are skipped, only the incomplete/blocked ones run.
+   Bounds (BOTH enforced, count explicitly — do not rely on remembering):
+   - **`resumeMaxAttempts = 3`** total re-invocations per batch. The counter is
+     DURABLE, not a working note: append `resume_attempt: N/3 | <ts> | incomplete:
+     <card list>` to the batch tracker (`$(git -C "$MAIN" rev-parse
+     --git-common-dir)/baldart/run/batch-tracker-<FIRST-CARD-ID>.md`) BEFORE each
+     re-invocation — a compaction/crash between resumes must not reset the count
+     (re-read the tracker's `resume_attempt` lines to recover it). At 3 still
+     `degraded` → STOP resuming: run the **Codex broker teardown first** (the same
+     idempotent two-line block as step 6 below — a stall exit must not leak the
+     broker), then surface `"batch stalled after 3 resumes — manual intervention
+     needed"` with the incomplete card list (their follow-ups are already on disk
+     from step 1 — nothing is lost by stopping).
+   - **Stall detection**: if a resume completes with the SAME incomplete card set
+     as the previous attempt (zero progress — compare against the tracker's last
+     `resume_attempt` line), stop immediately even before the cap — a second
+     identical pass will not converge either. Same teardown-then-surface exit.
+   An unbounded resume loop re-pays the whole batch-loop cost per cycle (~0–200k+
+   tokens each) with no new information; a persistent `degraded` is an outage or a
+   structural blocker, not something iteration fixes.
 3b. **Escape-hatch escalation for the hard cases (INTERACTIVE mode only — the `new2`
    "relaxation").** `new2` is autonomous *during the batch* — but a genuinely-blocked
    card (the workflow rolled it back / left it `IN_PROGRESS`, DoD not met) is exactly the
@@ -256,8 +303,9 @@ returns when the batch is done. It returns:
    the offer is purely additive over an already-safe ledger — declining (or a closed
    terminal) never drops a residual.
    - **Skip this step entirely in AUTONOMOUS mode** (env `BALDART_AUTONOMOUS` / `CI` /
-     `GITHUB_ACTIONS` set, or no TTY) — leave the cards `IN_PROGRESS` + their follow-ups,
-     exactly as before. The escape hatch is interactive-only.
+     `GITHUB_ACTIONS` set, no TTY, **or a delegated `/new -auto` origin — Step 1.5**) —
+     leave the cards `IN_PROGRESS` + their follow-ups, exactly as before. The escape
+     hatch is interactive-only, and a delegated run is autonomous even with a TTY.
    - **Eligible set** = the follow-ups whose residual `deferralClass` is **code-actionable**:
      `unresolved`, `out-of-ownership`, `scope-expansion`. EXCLUDE `owner-gated` /
      `not-a-code-defect` / `policy-deferred-ac` (external infra steps — `/new` cannot perform

package/framework/.claude/skills/ui-implement/CHANGELOG.md

@@ -2,6 +2,26 @@
 
 Formato: [Keep a Changelog](https://keepachangelog.com/) · [SemVer](https://semver.org/).
 
+## 1.1.1 — 2026-07-02
+
+- Return Contract (SKILL.md): documentati i campi `bindings` + `lane_coverage`/`lanes`
+  del JSON programmatico (lo schema resta SSOT in references/integration.md).
+
+## 1.1.0 — 2026-07-02
+
+- **Binding-compliance gate (Step 5b)**: nuovo script deterministico
+  `scripts/check-bindings.mjs` — ogni `component_bindings` entry `reuse`/
+  `reuse-variant` deve comparire (import o uso JSX) nei file toccati dalla build;
+  violazione = `binding-not-honored` (Critical, 1 retry a `ui-expert`, poi
+  `blocked`). Chiude il buco "la mappa è autoritativa ma nessuno verifica che la
+  build l'abbia onorata". Fail-open sugli errori interni dello script.
+- **Build-with-eyes nel briefing (Step 4)**: il brief di `ui-expert` ora porta
+  l'obbligo del self-check in-build (`ui-expert.md` § "Build-with-eyes": check
+  strutturale deterministico via `structural-compare.mjs` + check visivo con
+  screenshot Playwright quando catturabile, max 2 iterazioni, degrado onesto su
+  runtime non-multimodale) — costruisci-bene a monte invece di
+  cattura-e-ripara a valle.
+
 ## 1.0.0 — 2026-07-01
 
 - Skill introdotta (framework v4.82.0). Estrae da `/new` il playbook mockup→code

package/framework/.claude/skills/ui-implement/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: ui-implement
 effort: medium
-version: 1.0.0
+version: 1.1.1
 description: >
   Implement an ALREADY-APPROVED mockup into the codebase end-to-end and
   self-verify its fidelity. Takes a mockup in any channel — a Claude Design
@@ -123,11 +123,15 @@ Each step is a delegation. Read the cited SSOT; do not paraphrase it.
 4. **Implement — spawn `ui-expert`.** Build via the `ui-expert` agent with a
    briefing that carries: the chosen build workflow (Step 1), the mockup path(s),
    the registry-first cascade declaration requirement, the design-source
-   declaration requirement (when code-src exists), the `component_bindings`, and
-   the i18n / states-taxonomy / token-cascade constraints. All of these are
-   `ui-expert.md`'s own contracts — the briefing points at them; it does not
-   re-teach them. (Codex / no-subagents → the skill performs the build inline
-   following the same `ui-expert.md` contracts.)
+   declaration requirement (when code-src exists), the `component_bindings`, the
+   **build-with-eyes self-check obligation** (`ui-expert.md` § "Build-with-eyes"
+   — bounded structural + visual self-check BEFORE returning; the completion
+   report must carry its one-line outcome), and the i18n / states-taxonomy /
+   token-cascade constraints. All of these are `ui-expert.md`'s own contracts —
+   the briefing points at them; it does not re-teach them. (Codex /
+   no-subagents → the skill performs the build inline following the same
+   `ui-expert.md` contracts; a non-multimodal runtime degrades the visual
+   self-check to a logged skip.)
 
 5. **Ground the design-source declaration** *(only when the card has
    `links.design_src` / `mockups/_src/` exists)*. After the agent's first
@@ -137,6 +141,27 @@ Each step is a delegation. Read the cited SSOT; do not paraphrase it.
    re-spawn. Log `design-source: grounded` | `rejected (<reason>)`. (This is the
    Step 7b grounding lifted out of `/new`.)
 
+5b. **Binding-compliance gate (deterministic — only when the card carries
+   `component_bindings`).** The bindings are authoritative (Step 3), but until
+   now nothing verified the built code actually HONORED them. Run:
+
+   ```bash
+   node .claude/skills/ui-implement/scripts/check-bindings.mjs \
+     --bindings-json '<the card's component_bindings serialized to JSON>' \
+     --files <the build's touched implementation files>
+   ```
+
+   One JSON line on stdout; exit `3` = violations. Every `reuse`/`reuse-variant`
+   binding whose component appears in NO touched file (import or JSX usage) is a
+   **`binding-not-honored`** finding (Critical, UI domain): re-spawn `ui-expert`
+   ONCE with the violation list ("the binding map is authoritative — use
+   `<Component>` for region `<region>`, do not re-invent it"); still violated →
+   the card is `blocked` (this is a fidelity-contract breach, not a taste issue).
+   `action: new` entries are informational here — their governance belongs to the
+   Post-Intervention Coherence Check (Step 6). Script errors fail OPEN (`skipped`,
+   exit 0) — the gate is a safety net, never a tribunal. Log
+   `bindings: ok (N honored)` | `violations (<components>)` | `skipped`.
+
 6. **Post-Intervention Coherence Check (BLOCKING).** Reconcile the design-system
    sources in the SAME change — CITE `design-system-protocol.md`
    § "Post-Intervention Coherence Check": INDEX (`DS_INDEX_DRIFT`), component spec
@@ -208,7 +233,12 @@ older install), `/new` falls back to an inline **coarse** build brief + a direct
 
 **Mode:** COMPACT (default). Your final message is bounded — verdict
 (`passed | blocked | overridden | skipped | error`) + the chosen build workflow +
-key findings as `path:line` + `Report: <path>`. Persist the long form (the
+key findings as `path:line` + `Report: <path>`. The programmatic JSON ALSO carries
+(since 1.1.1): `bindings` (the Step 5b `check-bindings.mjs` one-line result, when
+the card has `component_bindings`) and `lane_coverage` + `lanes` (forwarded from
+the internal `/e2e-review` report) — full schema:
+[references/integration.md](references/integration.md) § Return contract (the
+SSOT; do not restate it here). Persist the long form (the
 `/e2e-review` report + tracker), return the short form. FULL narrative only when the
 user invoked you directly. Schema + persist-then-summarize rule:
 `framework/agents/return-contract-protocol.md`.

package/framework/.claude/skills/ui-implement/references/integration.md

@@ -34,6 +34,9 @@ only the input source and the return shape differ.
   "findings": [ /* gating findings, canonical severity taxonomy */ ],
   "ds_drift_codes": [ "DS_INDEX_DRIFT" | "DS_COMPONENT_STALE" | "DS_TOKENS_DRIFT" ],
   "design_system_coherence": { /* INDEX / components / tokens / mirror reconciled */ },
+  "bindings": { /* Step 5b check-bindings.mjs one-line JSON (skill ≥1.1.0); absent when the card has no component_bindings */ },
+  "lane_coverage": "complete" | "incomplete",
+  "lanes": { /* forwarded from the internal /e2e-review report (skill ≥1.1.0, e2e-review ≥1.1.0) */ },
   "report_path": ".baldart/e2e-review/<id>/report.json"
 }
 ```
@@ -85,8 +88,14 @@ same opt-in contract as `/prd` → `/ds-handoff`.
 ## `new2` (workflow) note
 
 `new2.js` hosts the batch in a background workflow and reads `implement.md` /
-`review-cycle.md` for the per-card semantics. In this release `new2` keeps its
-**inline** implement+verify path (the fallback prose stays valid), so no `new2.js`
-change is required. Full `new2` parity — delegating the UI card's implement+verify
+`review-cycle.md` for the per-card semantics. `new2` keeps its **inline**
+implement path (the fallback prose stays valid), with two T1.A parallels wired in
+directly (v4.90.0): the mockup card's implement brief carries the
+**binding-compliance gate** (same `check-bindings.mjs` script as Step 5b), and a
+**route-free structural fidelity lane** (`markup-fidelity-verifier`) runs after
+implement for every card with a code-form mockup — its Lane-Ledger obligation
+(`design-system-protocol.md` § 6): verifier unavailable → `verification-coverage-gap`
+residual, the card cannot auto-DONE. Browser lanes (visual/quality) remain
+`/new`-path only. Full `new2` parity — delegating the UI card's implement+verify
 off-context via `workflow()` — is a follow-up, to be taken after the context-economy
 measurement (`SKILL.md` scope note + the plan's measure-first gate).

package/framework/.claude/skills/ui-implement/scripts/check-bindings.mjs

@@ -0,0 +1,103 @@
+#!/usr/bin/env node
+// check-bindings.mjs — deterministic `binding-not-honored` gate (T1.A, framework v4.90.0).
+//
+// A card's `component_bindings` (card-schema.md § component_bindings) is AUTHORITATIVE
+// over the mockup: each `action: reuse | reuse-variant` entry promises that the bound
+// registry component is actually USED in the implementation. Until now nothing verified
+// that promise after the build — a ui-expert that ignored a binding and re-invented the
+// primitive sailed through (the verifier trio checks fidelity-to-mockup, not
+// binding-compliance). This script closes that gap without a model call.
+//
+// Contract:
+//   node check-bindings.mjs --bindings-json '<json array>' --files <f1> <f2> ...
+//   node check-bindings.mjs --bindings-file <path.json>    --files <f1> <f2> ...
+//
+//   - `--bindings-json` is the card's `component_bindings` serialized to JSON by the
+//     caller (the orchestrator/agent already has the card in context; YAML parsing is
+//     deliberately NOT re-implemented here — the deterministic part is the code check).
+//   - `--files` are the implementation files the card touched (the build's scopeFiles).
+//   - Prints ONE JSON line to stdout:
+//       { status: "ok" | "violations" | "skipped",
+//         checked, honored, violations:[{component, region, action}],
+//         results:[{component, region, action, status, matched_in:[...]}] }
+//   - Exit codes: 0 = ok/skipped (nothing to gate), 3 = violations (gate fires).
+//     Internal errors NEVER crash the caller: fail-open → {status:"skipped"} exit 0
+//     (same philosophy as the framework-edit-gate: a safety net, not a tribunal).
+//
+// Matching rule (deterministic, conservative — prefer false-negative over false-block):
+//   an entry with action reuse/reuse-variant is HONORED when the component identifier
+//   appears in ≥1 provided file as an import specifier OR a JSX opening tag
+//   (`<Component` / `<NS.Component`). `action: new` entries are reported as
+//   informational (`new-component`) and never count as violations here — the
+//   Post-Intervention Coherence Check owns their governance.
+
+import fs from 'node:fs';
+
+function emit(obj, code) {
+  process.stdout.write(JSON.stringify(obj) + '\n');
+  process.exit(code);
+}
+
+function parseArgs(argv) {
+  const a = { bindingsJson: null, bindingsFile: null, files: [] };
+  for (let i = 2; i < argv.length; i++) {
+    if (argv[i] === '--bindings-json') a.bindingsJson = argv[++i];
+    else if (argv[i] === '--bindings-file') a.bindingsFile = argv[++i];
+    else if (argv[i] === '--files') {
+      while (i + 1 < argv.length && !argv[i + 1].startsWith('--')) a.files.push(argv[++i]);
+    }
+  }
+  return a;
+}
+
+function main() {
+  const args = parseArgs(process.argv);
+  let raw = args.bindingsJson;
+  if (!raw && args.bindingsFile) {
+    if (!fs.existsSync(args.bindingsFile)) emit({ status: 'skipped', reason: 'bindings file not found: ' + args.bindingsFile }, 0);
+    raw = fs.readFileSync(args.bindingsFile, 'utf8');
+  }
+  if (!raw) emit({ status: 'skipped', reason: 'no --bindings-json / --bindings-file' }, 0);
+
+  let bindings;
+  try { bindings = JSON.parse(raw); } catch (e) { emit({ status: 'skipped', reason: 'bindings JSON unparsable: ' + e.message }, 0); }
+  if (!Array.isArray(bindings) || bindings.length === 0) emit({ status: 'ok', checked: 0, honored: 0, violations: [], results: [], note: 'no bindings to check' }, 0);
+
+  const sources = [];
+  for (const f of args.files) {
+    try {
+      if (fs.existsSync(f) && fs.statSync(f).isFile()) sources.push({ path: f, text: fs.readFileSync(f, 'utf8') });
+    } catch { /* unreadable file → treated as absent, fail-open per-file */ }
+  }
+  if (sources.length === 0) emit({ status: 'skipped', reason: 'no readable implementation files passed via --files' }, 0);
+
+  const results = [];
+  for (const b of bindings) {
+    const component = String(b.component || b.name || '').trim();
+    const action = String(b.action || 'reuse').trim();
+    const region = String(b.region || '').trim();
+    if (!component) { results.push({ component: '(missing)', region, action, status: 'skipped-malformed', matched_in: [] }); continue; }
+    if (action === 'new') { results.push({ component, region, action, status: 'new-component', matched_in: [] }); continue; }
+
+    // Import specifier or JSX opening tag, word-bounded. Conservative: any hit counts.
+    const esc = component.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const importRe = new RegExp(`import[^;]*\\b${esc}\\b[^;]*from`, 'm');
+    const jsxRe = new RegExp(`<(?:[A-Za-z_$][\\w$]*\\.)?${esc}[\\s/>]`);
+    const bareRe = new RegExp(`\\b${esc}\\b`);
+    const matched = sources.filter((s) => importRe.test(s.text) || jsxRe.test(s.text) || (/\.(css|scss)$/.test(s.path) && bareRe.test(s.text)));
+    results.push({
+      component, region, action,
+      status: matched.length ? 'honored' : 'not-found',
+      matched_in: matched.map((s) => s.path),
+    });
+  }
+
+  const violations = results.filter((r) => r.status === 'not-found').map(({ component, region, action }) => ({ component, region, action }));
+  const honored = results.filter((r) => r.status === 'honored').length;
+  emit(
+    { status: violations.length ? 'violations' : 'ok', checked: results.length, honored, violations, results },
+    violations.length ? 3 : 0
+  );
+}
+
+try { main(); } catch (e) { emit({ status: 'skipped', reason: 'internal error: ' + (e && e.message) }, 0); }

package/framework/.claude/workflows/new-card-review.js

@@ -46,18 +46,28 @@ const protocolRef = '.claude/skills/new/references/review-cycle.md'
 // (kills agents mid-work). Cap concurrent agents at 3 — a rolling worker pool (NOT chunked barriers,
 // which would block fast finders behind the slow background Codex poll). Mirrors the team-mode coder
 // cap so review + implementation obey the same ceiling.
-const MAX_PARALLEL = 3
-async function parallelCapped(thunks, cap) {
+// ADAPTIVE since v4.91.0 (mirrors new-final-review.js): start at 5; on the FIRST rate-limit
+// transient anywhere in the run drop to 2 (below the old fixed 3 — when the shared org limit
+// is hot, narrower is what keeps reviewers alive; when it is not, the fixed cap was pure
+// queue-wait tax). Surplus workers retire at their next pickup.
+const CAP = { value: 5 }
+const MAX_PARALLEL = CAP.value // kept for arg-compat at call sites; capNow() is authoritative
+const capNow = () => CAP.value
+function noteRateLimitPressure(src) {
+  if (CAP.value > 2) { CAP.value = 2; log(`parallelCapped: rate-limit transient (${src}) → cap 5→2 for the rest of the run`) }
+}
+async function parallelCapped(thunks, _cap) {
   if (!Array.isArray(thunks) || !thunks.length) return []
   const results = new Array(thunks.length)
   let next = 0
-  const worker = async () => {
+  const worker = async (idx) => {
     while (next < thunks.length) {
+      if (idx >= capNow()) return // adaptive shrink
       const i = next++
       try { results[i] = await thunks[i]() } catch (_) { results[i] = null }
     }
   }
-  await Promise.all(Array.from({ length: Math.min(cap, thunks.length) }, worker))
+  await Promise.all(Array.from({ length: Math.min(capNow(), thunks.length) }, (_, idx) => worker(idx)))
   return results
 }
 
@@ -79,7 +89,11 @@ async function agentSafe(prompt, opts, maxAttempts) {
     try {
       const o = i === 0 ? opts : Object.assign({}, opts, { label: `${(opts && opts.label) || 'agent'}~retry${i}` })
       return await agent(prompt, o)
-    } catch (e) { lastErr = e; if (!isTransient(e)) throw e } // permanent error → surface
+    } catch (e) {
+      lastErr = e
+      if (!isTransient(e)) throw e // permanent error → surface
+      noteRateLimitPressure((opts && opts.label) || 'agent') // v4.91.0 — shrink the pool for the rest of the run
+    }
   }
   const err = new Error('transient-exhausted: ' + String((lastErr && lastErr.message) || lastErr))
   err.transientExhausted = true

package/framework/.claude/workflows/new-final-review.js

@@ -53,22 +53,33 @@ const editableFiles = Array.isArray(a.editableFiles) ? a.editableFiles.filter(Bo
 const tcCmds = (cfg.toolchain && cfg.toolchain.commands) || {}
 const tc = (key, fallback) => (tcCmds[key] && String(tcCmds[key]).trim()) || fallback
 
-// Concurrency cap (v4.53.6 — API rate-limit guardrail; mirrors new-card-review.js + the team-mode
-// coder cap). The org-level rate limit is SHARED across every terminal/session; a wide agent fan-out
-// saturates it and the server throttles. Cap concurrent agents at 3 via a rolling worker pool (NOT
-// chunked barriers — those would block fast finders behind the slow background Codex poll).
-const MAX_PARALLEL = 3
-async function parallelCapped(thunks, cap) {
+// Concurrency cap (v4.53.6 guardrail, ADAPTIVE since v4.91.0 — mirrors new-card-review.js + the
+// team-mode coder cap). The org-level rate limit is SHARED across every terminal/session; a wide
+// agent fan-out saturates it and the server throttles (the v4.66.0 transient-kill class). The old
+// fixed cap of 3 protected against that but taxed EVERY run's wall-clock, including the majority
+// with no rate pressure (measured: review fan-out ≈ 50 min on a small batch, mostly queue wait).
+// Adaptive policy: start at 5; on the FIRST rate-limit transient seen anywhere in the run, drop to
+// 2 for the remainder (BELOW the old cap — when the org limit is hot, narrower is what saves the
+// reviewers). Rolling worker pool (NOT chunked barriers — those would block fast finders behind
+// the slow background Codex poll); workers above the current cap retire at their next pickup.
+const CAP = { value: 5 }
+const MAX_PARALLEL = CAP.value // kept for arg-compat at call sites; capNow() is authoritative
+const capNow = () => CAP.value
+function noteRateLimitPressure(src) {
+  if (CAP.value > 2) { CAP.value = 2; log(`parallelCapped: rate-limit transient (${src}) → cap 5→2 for the rest of the run`) }
+}
+async function parallelCapped(thunks, _cap) {
   if (!Array.isArray(thunks) || !thunks.length) return []
   const results = new Array(thunks.length)
   let next = 0
-  const worker = async () => {
+  const worker = async (idx) => {
     while (next < thunks.length) {
+      if (idx >= capNow()) return // adaptive shrink: retire surplus workers at pickup time
       const i = next++
       try { results[i] = await thunks[i]() } catch (_) { results[i] = null }
     }
   }
-  await Promise.all(Array.from({ length: Math.min(cap, thunks.length) }, worker))
+  await Promise.all(Array.from({ length: Math.min(capNow(), thunks.length) }, (_, idx) => worker(idx)))
   return results
 }
 
@@ -91,7 +102,11 @@ async function agentSafe(prompt, opts, maxAttempts) {
     try {
       const o = i === 0 ? opts : Object.assign({}, opts, { label: `${(opts && opts.label) || 'agent'}~retry${i}` })
       return await agent(prompt, o)
-    } catch (e) { lastErr = e; if (!isTransient(e)) throw e } // permanent error → surface
+    } catch (e) {
+      lastErr = e
+      if (!isTransient(e)) throw e // permanent error → surface
+      noteRateLimitPressure((opts && opts.label) || 'agent') // v4.91.0 — shrink the pool for the rest of the run
+    }
   }
   const err = new Error('transient-exhausted: ' + String((lastErr && lastErr.message) || lastErr))
   err.transientExhausted = true