baldart 4.89.2 → 4.92.1

package/framework/.claude/workflows/new2.js

@@ -203,6 +203,12 @@ const PREFLIGHT_SCHEMA = {
           // F-016 — ACs whose only implementation file is outside the card MAY-EDIT,
           // pre-classified deferred-by-policy (never routed to resolve).
           policyDeferredACs: { type: 'array', items: { type: 'object', additionalProperties: true } },
+          // T1.A (v4.90.0) — the mockup's code-form sources, so the workflow can run the
+          // route-free structural fidelity lane (markup-fidelity-verifier) without
+          // re-reading the card. Empty string when absent.
+          designSrcDir: { type: 'string', description: "abs path of links.design_src / mockups/_src dir ('' when absent)" },
+          designHtml: { type: 'string', description: "abs path of an .html links.design mockup ('' when absent)" },
+          hasBindings: { type: 'boolean', description: 'card carries a non-empty component_bindings map' },
         },
       },
     },
@@ -277,7 +283,7 @@ try {
   preflight = await agentSafe(
     `You are the deterministic PRE-FLIGHT for an autonomous /new batch (variant new2). Follow ${REF}/setup.md (Phase 0 + Pre-flight) and ${REF}/implement.md (Phase 1 depends-on gate) for the SEMANTICS, but replace EVERY AskUserQuestion with the deterministic policy below. You run all git/bash yourself (the workflow cannot).\n\n` +
       `${projectBrief}\n\nCards in batch (Read each YAML):\n${cardPaths.join('\n')}\nCard IDs: ${cardIds.join(' ')}\n\n` +
-      `Create/maintain the recovery tracker at /tmp/batch-tracker-${firstCard}.md (per setup.md § Context Tracking).\n\n` +
+      `Create/maintain the recovery tracker at "$(git -C "${MAIN}" rev-parse --git-common-dir)/baldart/run/batch-tracker-${firstCard}.md" (mkdir -p its dir first; per setup.md § Context Tracking — DURABLE location, v4.91.0: /tmp is volatile and a paused/overnight run lost it — B4).\n\n` +
       `ROLE BOUNDARY (specialization integrity): you are the OPS/GIT agent. You NEVER edit source or doc files — any needed content change belongs to the coder specialist; report it instead.\n\n` +
       `DETERMINISTIC GATE POLICIES (NO user prompts):\n` +
       `• G1 dirty-tree (main repo ${MAIN}): partition framework-managed noise exactly as setup.md step 3 ($METRICS=${METRICS}, .baldart/generated|state.json|skill-conflicts.json — NOT overlays/). Genuine user work → auto-stash 'baldart-new2-${firstCard}' (main checkout) and record the label. Never commit/abort/prompt.\n` +
@@ -286,7 +292,7 @@ try {
       g3Bullet +
       `• G4 card-field validation (setup.md 1b/1c, card-schema.md consumer contract): card missing acceptance_criteria/files_likely_touched/scope → EXCLUDE (excluded[] + reason). \`requirements\` is CONDITIONAL, not an auto-exclude: if it is missing BUT acceptance_criteria + scope are both present and non-empty, FAITHFULLY DERIVE it (a concrete restatement/decomposition of the existing AC + scope — faithful, never inventing new scope) and WRITE it back to the card YAML on disk in ${MAIN}/${paths.backlog_dir || 'backlog'} (F-040: main repo, not the worktree copy; the card artifact is NOT a source/doc file, so this is allowed despite the role boundary), logging \`[BACKFILL] <id>: requirements=<N items, AC+scope-derived>\`. Only EXCLUDE for missing requirements when acceptance_criteria OR scope is ALSO empty (a genuinely thin card). Never HALT for one bad card.\n` +
       `• G5 depends-on: a card whose depends_on names a non-DONE card NOT in this batch → EXCLUDE it AND every in-batch card that transitively depends on it.\n` +
-      `• cardGraph (REQUIRED, F-021): for every runnable card return { id, dependsOn:[IN-BATCH deps only], ownerAgent (the card's owner_agent; G25 unknown→'coder'), hasMockup (BOOLEAN — true IFF the card has a non-empty links.design OR links.design_src; drives the mockup-first build override — implement.md §6a), reviewProfile (the card's review_profile; default 'balanced'), policyDeferredACs, alreadyCommitted, alreadyCommittedSha, isEpic (implement.md §6b epic guard: id ends '-00' OR filename ends '-epic.yml' OR group.is_epic:true OR review_profile 'skip' with no requirements), filesLikelyTouched (verbatim from the YAML) }.\n` +
+      `• cardGraph (REQUIRED, F-021): for every runnable card return { id, dependsOn:[IN-BATCH deps only], ownerAgent (the card's owner_agent; G25 unknown→'coder'), hasMockup (BOOLEAN — true IFF the card has a non-empty links.design OR links.design_src; drives the mockup-first build override — implement.md §6a), designSrcDir (ABS path of links.design_src / the PRD mockups/_src dir; '' when absent), designHtml (ABS path when links.design is an .html file; '' otherwise), hasBindings (BOOLEAN — non-empty component_bindings), reviewProfile (the card's review_profile; default 'balanced'), policyDeferredACs, alreadyCommitted, alreadyCommittedSha, isEpic (implement.md §6b epic guard: id ends '-00' OR filename ends '-epic.yml' OR group.is_epic:true OR review_profile 'skip' with no requirements), filesLikelyTouched (verbatim from the YAML) }.\n` +
       `• B1/F-026 idempotency (per card, AFTER the worktree exists): set alreadyCommitted:true (+ alreadyCommittedSha) IFF ALL hold: (a) a commit referencing the card id exists in ${TRUNK}..HEAD of the worktree; (b) the card's validation_commands re-run GREEN right now; (c) NO open follow-up card for it exists in ${paths.backlog_dir || 'backlog'}. On a FRESH worktree ${TRUNK}..HEAD is empty → all false, zero extra work.\n` +
       `• F-016 AC↔ownership consistency: for each acceptance_criterion, derive the file(s) it requires editing. If those files are NOT a subset of the card's MAY-EDIT/files_likely_touched → add the AC to policyDeferredACs:[{n,text,owningCard|owningFile,reason}] (it will become ONE follow-up, never a resolve). Do the same for any AC whose remedy is an owner-gated infra action (remote db push / deploy / secret / DNS).\n` +
       (migrationApplied
@@ -594,16 +600,21 @@ async function runCard(cardId, cardPath) {
   const phase1Brief = architectOk
     ? `Phase 1 already ran as specialist agents. READ the architecture baseline at ${baselinePath} BEFORE writing any code — it is your codebase context; do NOT redo the exploration.${auditCorrections.length ? `\nPlan-audit corrections (apply them as amendments to this briefing — do NOT modify the backlog YAML):\n${auditCorrections.map((c, i) => `  ${i + 1}. ${c}`).join('\n')}` : ''}`
     : `Phase 1 fallback: the architect specialist was unavailable — do the Phase 1 claim+architect exploration yourself per ${REF}/implement.md and persist the baseline to ${baselinePath} before coding.`
+  // T1.A (v4.90.0) — mockup cards: binding-compliance is verified deterministically by the
+  // check-bindings.mjs script (ui-implement Step 5b is the SSOT; this is the new2 parallel).
+  const bindingBit = node.hasMockup && node.hasBindings
+    ? `\nBINDING GATE (deterministic — ui-implement Step 5b parallel): after building, run \`node "$(ls .claude/skills/ui-implement/scripts/check-bindings.mjs .framework/framework/.claude/skills/ui-implement/scripts/check-bindings.mjs 2>/dev/null | head -1)" --bindings-json '<the card component_bindings as JSON>' --files <your touched implementation files>\`. Exit 3 = a reuse/reuse-variant binding is NOT used in the code: the map is AUTHORITATIVE — fix it before returning (one pass). Include the script's one-line JSON output as bindingCheck in your return.\n`
+    : ''
   let impl
   try {
     impl = await agentSafe(
-      `Implement card ${cardId} per ${REF}/implement.md Phase 2 — you ARE the owner_agent '${ownerAgent}' — and ${REF}/completeness.md (Phase 2.5 + 2.5b AC-closure ledger). Run all gates/bash yourself.\n\n${phase1Brief}\n\n${cardBrief}\n\n` +
+      `Implement card ${cardId} per ${REF}/implement.md Phase 2 — you ARE the owner_agent '${ownerAgent}' — and ${REF}/completeness.md (Phase 2.5 + 2.5b AC-closure ledger). Run all gates/bash yourself.\n${bindingBit}\n${phase1Brief}\n\n${cardBrief}\n\n` +
         `POLICIES: G26 Phase-2 lint/tsc/test/build failing after the module's retry cap → buildBlocked:true + blockedGate. Build the AC Closure Ledger (one row per AC: implemented|unmet|policy-deferred). DO NOT silently defer; report unmet rows (excluding policy-deferred). Persist the diff to /tmp/diff-${cardId}.txt.\n\n` +
         `E4 OWNERSHIP RECONCILE (implement.md §11b — do this BEFORE returning): the card's MAY-EDIT includes files_likely_touched ∪ paths NAMED EXPLICITLY in this card's acceptance_criteria/definition_of_done (e.g. an ADR the DoD says to update, the data-model / ER doc for a schema change). Editing THOSE is in-scope. For any OTHER dirty file outside MAY-EDIT (another card's file, or unrelated): \`git checkout -- <file>\` to revert it (NEVER leave it orphaned), list it in revertedOutOfOwnership. Set fileDiffViolation:true ONLY if such an edit genuinely could not be reverted (then say why in note) — it is no longer a silent label.\n\n` +
         `Return: { epic, buildBlocked, blockedGate, unmetACs:[{n,text}], scopeFiles, mayEditPaths, revertedOutOfOwnership:[paths], fileDiffViolation, note }`,
       { label: `implement:${cardId}`, phase: 'Implement', agentType: ownerAgent,
         schema: { type: 'object', required: ['epic', 'buildBlocked', 'unmetACs', 'scopeFiles'], additionalProperties: true,
-          properties: { epic: { type: 'boolean' }, buildBlocked: { type: 'boolean' }, blockedGate: { type: 'string' }, unmetACs: { type: 'array', items: { type: 'object', additionalProperties: true } }, scopeFiles: { type: 'array', items: { type: 'string' } }, mayEditPaths: { type: 'array', items: { type: 'string' } }, revertedOutOfOwnership: { type: 'array', items: { type: 'string' } }, fileDiffViolation: { type: 'boolean' }, note: { type: 'string' } } } }
+          properties: { epic: { type: 'boolean' }, buildBlocked: { type: 'boolean' }, blockedGate: { type: 'string' }, unmetACs: { type: 'array', items: { type: 'object', additionalProperties: true } }, scopeFiles: { type: 'array', items: { type: 'string' } }, mayEditPaths: { type: 'array', items: { type: 'string' } }, revertedOutOfOwnership: { type: 'array', items: { type: 'string' } }, fileDiffViolation: { type: 'boolean' }, note: { type: 'string' }, bindingCheck: { type: 'object', additionalProperties: true, description: 'check-bindings.mjs one-line JSON (mockup+bindings cards only)' } } } }
     )
   } catch (e) {
     if (e && e.transientExhausted) { noteDegraded('outage'); return { card: cardId, status: 'pending', gates } }
@@ -642,6 +653,74 @@ async function runCard(cardId, cardPath) {
     if (r.status !== 'resolved') { deferredOpen = true; deferredClasses.add(r.deferralClass || 'unresolved') }
   }
 
+  // --- R1-F2 (v4.92.1): the binding gate result is CONSUMED, not write-only. The agent
+  // was already told to run check-bindings.mjs and fix before returning; here the workflow
+  // verifies the report: violations survive the agent's own pass → resolve (ui domain);
+  // report absent on a bindings card → fail-open but LEDGERED (audit trail, never silent).
+  if (node.hasMockup && node.hasBindings) {
+    const bc = impl && impl.bindingCheck
+    const bcViol = (bc && Array.isArray(bc.violations)) ? bc.violations : []
+    if (!bc) g('binding-gate', 'NOT-REPORTED', 'agent returned no bindingCheck — fail-open (script may be absent on older installs), recorded for audit')
+    else if (bcViol.length) {
+      g('binding-gate', 'VIOLATIONS', bcViol.map((v) => v.component).join(', '))
+      for (const v of bcViol) {
+        const r = await resolve('blocker', cardId, `binding-not-honored: region "${v.region || ''}" is bound action:${v.action || 'reuse'} → ${v.component}, but the component appears in NO touched implementation file — the binding map is authoritative (card-schema.md § component_bindings)`, { mayEditPaths: mayEdit, scopeFiles, domain: 'ui' })
+        if (r.status !== 'resolved') { deferredOpen = true; deferredClasses.add(r.deferralClass || 'unresolved') }
+      }
+    } else g('binding-gate', 'OK', `${(bc && bc.honored) || 0}/${(bc && bc.checked) || 0} bindings honored`)
+  }
+
+  // --- T1.A (v4.90.0): route-free structural fidelity lane — the new2 parallel of
+  // /e2e-review Phase 2.7. new2 has NO browser lanes (visual/quality verify runs only on
+  // the /new path), so the code-form structural check is its ONE per-card fidelity lane.
+  // Running it is a Lane-Ledger obligation (design-system-protocol § 6. Verification-Lane
+  // Ledger): a mockup card with a code-form source may NOT complete with zero fidelity
+  // verification (the FEAT-0064 under-run). Verifier unavailable → verification-coverage-gap
+  // residual + the card cannot be auto-DONE — an under-run blocks, never passes silently.
+  if (node.hasMockup && (node.designSrcDir || node.designHtml)) {
+    const structSrc = node.designSrcDir
+      ? { level: 'design_src', design_src_dir: node.designSrcDir }
+      : { level: 'html', mockup_path: node.designHtml }
+    const spawnMfv = () => agentSafe(
+      `Compare the implementation's code structure against the mockup's code structure and return JSON per your output schema (route-free — no browser, no dev server; cd into ${sharedCtx.worktreePath}).\n\nInput payload:\n${JSON.stringify({ card_id: cardId, route: '(card-level)', mockup_source: structSrc, implementation_files: scopeFiles, tolerance: 'strict' })}\n\nReturn STRICT JSON only: { status, findings:[{category,severity,description,expected,actual,fix_hint}] }`,
+      { label: `fidelity:${cardId}:structural`, phase: 'Implement', agentType: 'markup-fidelity-verifier',
+        schema: { type: 'object', required: ['findings'], additionalProperties: true, properties: { status: { type: 'string' }, findings: { type: 'array', items: { type: 'object', additionalProperties: true } } } } }
+    )
+    let mfv = null
+    try { mfv = await spawnMfv() } catch (e) { if (e && e.transientExhausted) noteDegraded('outage') }
+    // R1-F1 (v4.92.1): a verifier that RETURNS but self-reports `status:"skipped"`
+    // (no_structural_ground_truth — unreadable mockup / no layout-bearing impl) is an
+    // under-run exactly like an unavailable verifier, NEVER a PASS.
+    const mfvSkipped = mfv && /skip/i.test(String(mfv.status || ''))
+    if (!mfv || mfvSkipped) {
+      g('fidelity-structural', 'UNDERRUN', `planned lane did not verify (${!mfv ? 'verifier unavailable' : 'verifier skipped: ' + String((mfv && mfv.reason) || 'no_structural_ground_truth')}) — verification-coverage-gap, card cannot auto-DONE`)
+      deferredOpen = true; deferredClasses.add('unresolved')
+      residuals.push({ card: cardId, kind: 'verification-coverage-gap', evidence: `structural fidelity lane planned but did not verify (${!mfv ? 'markup-fidelity-verifier unavailable' : 'verifier skipped'})`, materialized: false })
+    } else {
+      const gatingOf = (x) => ((x && x.findings) || []).filter((f) => /critical|major/i.test(String(f.severity || '')))
+      const gating = gatingOf(mfv)
+      g('fidelity-structural', gating.length ? 'BLOCKED' : 'PASS', gating.length ? `${gating.length} gating structural finding(s)` : `ran — ${(mfv.findings || []).length} finding(s), none gating`)
+      let anyResolved = false
+      for (const f of gating) {
+        const r = await resolve('blocker', cardId, `structural fidelity (${f.category || 'layout'}): ${f.description || ''} — expected: ${f.expected || '(see mockup)'}`, { mayEditPaths: mayEdit, scopeFiles, domain: 'ui' })
+        if (r.status !== 'resolved') { deferredOpen = true; deferredClasses.add(r.deferralClass || 'unresolved') }
+        else anyResolved = true
+      }
+      // R1-F3 (v4.92.1): a resolved structural fix is RE-VERIFIED by the deterministic
+      // verifier once (mirror of /e2e-review Phase 5b step 2 — a fixer's self-report is
+      // not the verifier's confirmation). Single re-check, no loop: still-gating after
+      // the re-run → deferral (the follow-up carries it), never a second fix pass here.
+      if (anyResolved) {
+        let mfvRe = null
+        try { mfvRe = await spawnMfv() } catch (e) { if (e && e.transientExhausted) noteDegraded('outage') }
+        const reGating = mfvRe && !/skip/i.test(String(mfvRe.status || '')) ? gatingOf(mfvRe) : null
+        if (reGating === null) { g('fidelity-structural-reverify', 'UNDERRUN', 're-verify did not run — treated as unresolved'); deferredOpen = true; deferredClasses.add('unresolved') }
+        else if (reGating.length) { g('fidelity-structural-reverify', 'STILL-BLOCKED', `${reGating.length} gating finding(s) survive the fix — deferred`); deferredOpen = true; deferredClasses.add('unresolved'); residuals.push({ card: cardId, kind: 'blocker', domain: 'ui', evidence: `structural fidelity still failing after fix: ${reGating.map((f) => f.category).join(', ')}`, materialized: false }) }
+        else g('fidelity-structural-reverify', 'PASS', 'fix confirmed by the verifier')
+      }
+    }
+  }
+
   // --- Review fan-out (F-024/F-025): specialized agents, trimmed by review_profile. ---
   // G5 — scopeFiles tokens alone miss a security card whose files don't carry them. Also
   // trigger security-reviewer on the card's RAW owner_agent and its brief (title/requirements).
@@ -1106,7 +1185,7 @@ if (!committed.length) {
 } else {
   try {
     mergeResult = await agentSafe(
-      `Auto-merge the batch worktree to ${TRUNK} per ${REF}/merge-cleanup.md: Phase 6 via the DETERMINISTIC script merge-worktree.sh, then Phase 6b status reconciliation + Phase 6c hygiene. Run git yourself.\n\n${projectBrief}\nWorktree: ${sharedCtx.worktreePath}\nBranch: ${sharedCtx.branch}\nmerge_strategy: ${mergeStrategy}\nCommitted cards: ${committed.map((r) => r.card).join(' ')}\nPhase-0 stash to restore (if any): see /tmp/batch-tracker-${firstCard}.md.\n\n` +
+      `Auto-merge the batch worktree to ${TRUNK} per ${REF}/merge-cleanup.md: Phase 6 via the DETERMINISTIC script merge-worktree.sh, then Phase 6b status reconciliation + Phase 6c hygiene. Run git yourself.\n\n${projectBrief}\nWorktree: ${sharedCtx.worktreePath}\nBranch: ${sharedCtx.branch}\nmerge_strategy: ${mergeStrategy}\nCommitted cards: ${committed.map((r) => r.card).join(' ')}\nPhase-0 stash to restore (if any): see "$(git -C "${MAIN}" rev-parse --git-common-dir)/baldart/run/batch-tracker-${firstCard}.md".\n\n` +
         `PHASE 6 — run the SSOT script (the merge analogue of setup-worktree.sh; NOT a hand-rolled merge, NOT /mw inline):\n` +
         `  MERGE_SH="$(ls .framework/framework/.claude/skills/worktree-manager/scripts/merge-worktree.sh .claude/skills/worktree-manager/scripts/merge-worktree.sh 2>/dev/null | head -1)"\n` +
         `  bash "$MERGE_SH" --worktree ${sharedCtx.worktreePath} --manifest /tmp/new2-merge-status-${firstCard}.txt --skip-checks\n` +

package/framework/agents/code-search-protocol.md

@@ -91,6 +91,30 @@ Before picking a tier, classify the query:
   ~8–12M tokens with three coders independently re-discovering one NUL byte in a
   single multi-hundred-KB `data.ts`.)
 
+## Large-file read discipline (hot files)
+
+A **hot file** is any source file **> 800 lines** that multiple agents touch in the
+same run (a form client, a data layer, a locale dictionary). Forensics on real
+`/new` batches showed hot-file FULL re-reads are the dominant repeated-read cost —
+NOT the framework modules (read 1× each): one 2110-line client component (~29k
+tokens per full view) was read **28 times** across architect → coder → fixer →
+verifier spawns in a single run, because each fresh context re-read it whole.
+
+Rules (every agent, every runtime):
+
+1. **Map once, range-read after.** The `codebase-architect` baseline carries a
+   `## Hot-File Map` for every in-scope file > 800 lines (per-symbol line ranges —
+   see `codebase-architect.md` § terse contract). When you need a hot file and a
+   map exists, `Read` the **target range only** (offset/limit around the symbol),
+   never the whole file.
+2. **No map → locate first, then range-read.** `rg -n "<symbol>"` (or LSP
+   go-to-definition when the flag is on) to find the line, then `Read` a bounded
+   window around it. A whole-file `Read` of a hot file is justified ONLY when the
+   edit genuinely spans dispersed regions of it — say so in one line when you do it.
+3. **Briefs pass paths, not bodies.** An orchestrator briefing an agent passes the
+   baseline **path** (e.g. `/tmp/arch-baseline-<CARD-ID>.md`), never its inlined
+   content — and never inlines a hot file into a prompt.
+
 ## Fallback rules
 
 - LSP tool not loaded / plugin missing → silently fall back to Grep with the

package/framework/agents/design-system-protocol.md

@@ -654,6 +654,33 @@ card's `owner_agent: coder` (correct for its logic/review ownership) sent the UI
 `coder`. `owner_agent` still governs the review/ownership semantics; it just does not pick
 the build agent when a mockup is present.
 
+### 6. Verification-Lane Ledger — planned vs executed (no silent lane under-run)
+
+Checks 1–4 above each guard ONE lane. This check guards the **whole matrix**: the run
+that silently executes *fewer lanes than it planned*. The driving lesson (FEAT-0064,
+post-mortem of run `a73a52d0`): a mockup card went through "fidelity review" in which
+**only** the structural verifier ever spawned — no `visual-fidelity-verifier`, no
+`ui-quality-critic` — and nothing in the verdict recorded the under-run; the escaped
+polish surfaced later as a hand-worked bug card. A lane that is planned and then not
+executed is invisible to per-lane guards, so the ledger is reconciled globally:
+
+- **At plan time** the verifying orchestrator (`/e2e-review` Phase 2; the degraded
+  direct-trio path in `/ui-implement`; the `new2.js` structural lane) derives, per
+  route/surface, the set of REQUIRED lanes — `structural` (when a code-form mockup
+  exists), `visual` per in-scope viewport, `quality` (when a quality oracle exists),
+  `functional` (when scenarios exist) — and persists it.
+- **At verdict time** it reconciles planned vs executed. Every planned lane must be
+  `ran` or `skipped(<authorized reason>)` where the authorized reasons are ONLY the
+  ones this protocol enumerates (pixel-diff pre-filter pass, `render_unavailable` with
+  structural covered, `no_quality_oracle`, harness-render fidelity guard,
+  desktop-only route for the responsive pass). A planned lane that is simply
+  **`not_run`** synthesizes a **`verification-coverage-gap`** (Critical) — the matrix
+  twin of `coverage-gap`: not fixable by an agent, bypasses the self-heal loop, maps
+  to `blocked`. A verdict of `passed` with an unreconciled lane ledger is a protocol
+  violation, and no self-served "accepted (harness limit)" style verdict exists —
+  accepting an un-run lane requires the explicit override path (human reason) or the
+  caller's escalation, never the verifier's own discretion.
+
 ### Gating philosophy (calibration)
 
 Vision-model reliability research (*MLLM as a UI Judge*, 2025) shows multimodal judges are

package/framework/docs/WORKFLOWS.md

@@ -15,12 +15,17 @@ workflows are unavailable behaves exactly as before.
 | :--- | :--- | :--- |
 | `new-final-review` | `/new` Final Review (Step F.1.5) | Runs the read-only cross-batch review fan-out — architecture baseline + Codex ‖ doc-reviewer ‖ api-perf-cost-auditor ‖ qa-sentinel — then adversarially verifies low-confidence findings and returns them classified. Applies no fixes (the skill owns fix application + user gates). **v4.17.1+:** Codex availability is resolved by a **deterministic pre-flight glob + background poll** (no false negatives from a synchronous-run timeout); a **single-card batch** slims the breadth finders **per-finder, coverage-gated** (caller-supplied `slimDoc`/`slimApi`): it drops a duplicate Claude reviewer only when that reviewer already ran per-card on the same card — `new2` drops both doc + api (it runs both per-card, relevance-gated); classic `/new` drops only `doc-reviewer` (when Phase 3 ran it) and **keeps `api-perf-cost-auditor`** (deferred-to-final by design — the final is its only run). Codex + qa gates always run. Backward-compatible: callers without the flags get the full reviewer set. |
 | `new-card-review` (v4.34.0) | `/new` per-card review cluster — sequential (`review-cycle.md` § Phase 2.5x) **and** team-mode (`team-mode.md` D.1.6) | Hosts the **per-wave** review-cluster OUTSIDE the orchestrator context — the biggest prefix-growth source on long epics. Takes **1..N co-located cards** (1 = sequential per-card; N = a team-mode group, so it runs **once per wave, not per card**) and fans out the finders per card: Simplify + cross-model Codex (agent-launched binary, `code-reviewer` fallback) + qa-sentinel (group max tier) + security-reviewer (high-risk only), each specialist FP-checking its own findings. Then **ONE `coder` applies all VERIFIED code/perf/security/simplify findings in a single pass** (files disjoint by ownership) and re-verifies lint/tsc/build. Returns a compact `{perCard:{fixesApplied,residual}, gateTable, summary}` — the minority `residual` (doc, needs-manual, scope, unconverged) the skill resolves with the right specialist / user gate. **Doc-review and E2E stay in the skill** (doc is write-mode + must see final code; E2E is human-gated + nests a skill); **api-perf is deferred to the Final FULL gate**. Maps to `review-cycle.md` Phase 2.55+3.5+3.7. |
-| `new2` (v4.17.2) | `/new2` skill (the whole batch) | **EXPERIMENTAL A/B variant of `/new`.** Hosts the ENTIRE batch in the background runtime so subagent output never enters the main context. A **dependency-gated DAG scheduler** runs a card only when all in-batch deps are *committed* (and blocks transitive dependents of a failed dep instead of routing them to resolve); each card uses its **owner_agent** + a **specialized review fan-out** (not general-purpose); the worktree is kept **atomic per card** (rollback-to-HEAD on failure); transient API errors are retried and a sustained **outage degrades cleanly** (`degraded` return + durable resume via the skill); a **run ledger** dedups resolves and records accepted deferrals (no re-routing loop); the **merge is integrity-gated** (never force-DONE, never `git add` unreviewed code, never merge an incomplete/degraded batch); the commit step runs on **Haiku** while **follow-up cards are written by `prd-card-writer`**; telemetry carries real **cost** (`total_tokens` via `budget.spent()`, `agent_count`, skill-stamped `wall_clock_s`) + `degraded`. **v4.17.2:** the pre-flight **G3 cross-card Codex check is deterministic** (glob-first + background poll, skipped on single-card batches; `codex_resolved` in telemetry); a non-transient card crash is terminal-with-residual (no orphaned self-healing). Agents Read `/new`'s reference modules for semantics. |
+| `new2` (v4.17.2, promoted v4.90.0) | `/new2` skill (the whole batch) **+ `/new -auto` via its delegation gate** | **Workflow-hosted batch engine of `/new`.** Hosts the ENTIRE batch in the background runtime so subagent output never enters the main context. A **dependency-gated DAG scheduler** runs a card only when all in-batch deps are *committed* (and blocks transitive dependents of a failed dep instead of routing them to resolve); each card uses its **owner_agent** + a **specialized review fan-out** (not general-purpose); the worktree is kept **atomic per card** (rollback-to-HEAD on failure); transient API errors are retried and a sustained **outage degrades cleanly** (`degraded` return + durable resume via the skill); a **run ledger** dedups resolves and records accepted deferrals (no re-routing loop); the **merge is integrity-gated** (never force-DONE, never `git add` unreviewed code, never merge an incomplete/degraded batch); the commit step runs on **Haiku** while **follow-up cards are written by `prd-card-writer`**; telemetry carries real **cost** (`total_tokens` via `budget.spent()`, `agent_count`, skill-stamped `wall_clock_s`) + `degraded`. **v4.17.2:** the pre-flight **G3 cross-card Codex check is deterministic** (glob-first + background poll, skipped on single-card batches; `codex_resolved` in telemetry); a non-transient card crash is terminal-with-residual (no orphaned self-healing). Agents Read `/new`'s reference modules for semantics. |
 | `new2-resolve` (v4.17.2) | `new2` (self-healing) | Resolution pass for any gate that would otherwise need a human (`ac-unmet · blocker · qa-fail · e2e-blocked · merge-blocker · scope-expansion`). A **terminal short-circuit** skips the costly multi-attempt when the problem is impossible-by-definition (`out-of-ownership` verified in JS; other terminal reasons ratified by a judge); a **MANDATORY adversarial judge** cross-checks every `verified` claim — the judge independently greps the files and the workflow verifies **at least one** falls inside MAY-EDIT (`.some()`, so listing adjacent changed files is not mistaken for fabrication); accepts a **batched `findings` list** (one resolve per fix-area). **The domain is normalized** (freeform `documentation`→`doc`, …) before routing the **fixer** (doc→doc-reviewer, ui→ui-expert, security→security-reviewer, else coder) and judge, and a **doc finding gets doc-tree MAY-EDIT** (not the card's code scope); the 3-angle Tier-2 fan-out is reserved for code domains (single retry for doc/test). Follow-ups are written by **`prd-card-writer`**, offline-safe (deferred to the skill if no agent can write). |
 
-> **`new2` is an experiment, not a replacement.** It exists to A/B-test the
-> context-economy of workflow-hosting `/new`. `/new` remains the SSOT, the
-> cross-tool default, and the recovery-safe path. `new2` is Claude-only and its
+> **`new2` is the engine, `/new` is the SSOT.** Since v4.90.0 `/new -auto`
+> delegates the whole batch here by default (AUTONOMOUS OFF-CONTEXT DELEGATION
+> GATE — measured driver: 53–59% of an inline `-auto` run's billed tokens is the
+> orchestrator's own turn-tax; escape hatch `-inline`; `-auto-ship`, declared
+> migrations, interactive runs and every Codex run stay on the classic inline
+> path). `/new` remains the semantic SSOT and the cross-tool default — `new2`'s
+> agents Read `/new`'s reference modules; the gate map in `new2.js` encodes only
+> orchestration shape + deterministic policy. `new2` is Claude-only and its
 > skill HALTs with a pointer to `/new` when the `Workflow` tool is unavailable.
 
 ## How distribution works

package/framework/scripts/structural-compare.mjs

@@ -0,0 +1,183 @@
+#!/usr/bin/env node
+// structural-compare.mjs — deterministic STRUCTURAL pre-gate for the mockup→code
+// fidelity chain (T1.B, framework v4.90.0). Zero-dep, heuristic, CONSERVATIVE.
+//
+// Compares a code-form mockup (an .html file, or a design_src dir of .jsx/.tsx/.css)
+// against the implementation files on a small set of CLEAR structural signals:
+//   - landmark census (header/nav/aside/main/footer present in mockup, absent in impl)
+//   - max grid column count (multi-column mockup built single-column — the FEAT-0061 class)
+//   - responsive signals (@media breakpoints / Tailwind responsive prefixes present in
+//     the mockup, entirely absent in the impl)
+//
+// SEMANTICS — signals, not verdicts. The implementation may COMPOSE primitives (a
+// `<SplitView>` that owns the grid, a `<TopBar>` that renders the <header>), and this
+// script only sees the card-touched files — so a "divergence" here is a deterministic
+// SIGNAL with a per-finding `confidence`, never a standalone verdict:
+//   - in-build (ui-expert self-check): the builder judges each signal — it knows which
+//     primitives it composed — and fixes what is real BEFORE returning.
+//   - in Phase 2.7 (/e2e-review): the signals are passed to `markup-fidelity-verifier`
+//     as `deterministic_signals` focus hints; the verifier confirms or dismisses each
+//     (it can read the composed primitives). The verifier spawn is NEVER skipped on a
+//     "match" — a regex match is necessary, not sufficient.
+//
+// Contract:
+//   node structural-compare.mjs --mockup <file-or-dir> --impl <f1> <f2> ...
+//   → one JSON line: { status: "match" | "divergence" | "skipped",
+//                      mockup_signature, impl_signature,
+//                      findings:[{category,severity,description,expected,actual}] }
+//   Exit: 0 = match/skipped (nothing provable), 3 = divergence (findings are evidence).
+//   Internal errors fail OPEN ({status:"skipped"}, exit 0) — pre-gate, not tribunal.
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+function emit(obj, code) {
+  process.stdout.write(JSON.stringify(obj) + '\n');
+  process.exit(code);
+}
+
+function parseArgs(argv) {
+  const a = { mockup: null, impl: [] };
+  for (let i = 2; i < argv.length; i++) {
+    if (argv[i] === '--mockup') a.mockup = argv[++i];
+    else if (argv[i] === '--impl') {
+      while (i + 1 < argv.length && !argv[i + 1].startsWith('--')) a.impl.push(argv[++i]);
+    }
+  }
+  return a;
+}
+
+function readSources(target) {
+  const texts = [];
+  const push = (p) => { try { texts.push(fs.readFileSync(p, 'utf8')); } catch { /* fail-open per file */ } };
+  try {
+    const st = fs.statSync(target);
+    if (st.isDirectory()) {
+      for (const f of fs.readdirSync(target)) {
+        if (/\.(html?|jsx?|tsx?|css|scss|svelte|vue)$/i.test(f)) push(path.join(target, f));
+      }
+    } else push(target);
+  } catch { /* absent target → empty */ }
+  return texts;
+}
+
+// Count top-level tracks in a grid-template-columns value: "repeat(2, minmax(0,1fr))" → 2,
+// "1fr 320px" → 2. Parens-aware split; `repeat(N, ...)` contributes N (integer N only).
+function countTracks(value) {
+  const v = value.trim();
+  if (!v || /^(subgrid|none|inherit|initial|unset)/.test(v)) return 0;
+  const parts = [];
+  let depth = 0, cur = '';
+  for (const ch of v) {
+    if (ch === '(') { depth++; cur += ch; }
+    else if (ch === ')') { depth--; cur += ch; }
+    else if (/\s/.test(ch) && depth === 0) { if (cur) { parts.push(cur); cur = ''; } }
+    else cur += ch;
+  }
+  if (cur) parts.push(cur);
+  let n = 0;
+  for (const p of parts) {
+    const rep = p.match(/^repeat\(\s*(\d+)\s*,/);
+    if (rep) n += parseInt(rep[1], 10);
+    else if (/^\[.*\]$/.test(p)) continue; // named grid line, not a track
+    else n += 1;
+  }
+  return n;
+}
+
+function signature(texts) {
+  const sig = {
+    landmarks: { header: 0, nav: 0, aside: 0, main: 0, footer: 0 },
+    grid_cols_max: 0,
+    grid_cols_responsive_max: 0, // max cols behind a responsive gate (md:/lg:/@media)
+    has_media_queries: false,
+    has_responsive_prefixes: false,
+    files: texts.length,
+  };
+  for (const t of texts) {
+    for (const lm of Object.keys(sig.landmarks)) {
+      const m = t.match(new RegExp(`<${lm}[\\s/>]`, 'gi'));
+      if (m) sig.landmarks[lm] += m.length;
+    }
+    // CSS: grid-template-columns (also inside <style> blocks / .css files / inline style=)
+    for (const m of t.matchAll(/grid-template-columns\s*:\s*([^;"'}]+)/gi)) {
+      sig.grid_cols_max = Math.max(sig.grid_cols_max, countTracks(m[1]));
+    }
+    // @media-scoped multi-col: approximate — a grid-template-columns inside a file that
+    // also has @media counts as responsive-capable (regex cannot scope blocks reliably).
+    if (/@media[^{]*\(\s*(min|max)-width/i.test(t)) {
+      sig.has_media_queries = true;
+      for (const m of t.matchAll(/grid-template-columns\s*:\s*([^;"'}]+)/gi)) {
+        sig.grid_cols_responsive_max = Math.max(sig.grid_cols_responsive_max, countTracks(m[1]));
+      }
+    }
+    // Tailwind: grid-cols-N (+ responsive variants), incl. arbitrary grid-cols-[a_b].
+    // Arbitrary values use `_` as the space stand-in and may contain functions —
+    // `grid-cols-[repeat(2,_minmax(0,1fr))]` is 2 tracks, not split('_').length=3:
+    // normalize `_`→space and reuse the parens-aware countTracks().
+    for (const m of t.matchAll(/(?:^|[\s"'`])(?:(sm|md|lg|xl|2xl):)?grid-cols-(\d+|\[[^\]]+\])/g)) {
+      const cols = m[2].startsWith('[')
+        ? countTracks(m[2].slice(1, -1).replace(/_/g, ' '))
+        : parseInt(m[2], 10);
+      sig.grid_cols_max = Math.max(sig.grid_cols_max, cols);
+      if (m[1]) {
+        sig.has_responsive_prefixes = true;
+        sig.grid_cols_responsive_max = Math.max(sig.grid_cols_responsive_max, cols);
+      }
+    }
+    if (/(?:^|[\s"'`])(?:sm|md|lg|xl|2xl):[\w[-]/m.test(t)) sig.has_responsive_prefixes = true;
+  }
+  return sig;
+}
+
+function main() {
+  const args = parseArgs(process.argv);
+  if (!args.mockup || args.impl.length === 0) emit({ status: 'skipped', reason: 'usage: --mockup <file-or-dir> --impl <files...>' }, 0);
+
+  const mockTexts = readSources(args.mockup);
+  if (mockTexts.length === 0) emit({ status: 'skipped', reason: 'mockup unreadable: ' + args.mockup }, 0);
+  const implTexts = args.impl.flatMap((f) => readSources(f));
+  if (implTexts.length === 0) emit({ status: 'skipped', reason: 'no readable implementation files' }, 0);
+
+  const mock = signature(mockTexts);
+  const impl = signature(implTexts);
+  const findings = [];
+
+  // Confidence encodes the composition caveat: the impl files are the card-touched set,
+  // and grids/landmarks may live INSIDE a reused primitive this scan cannot see.
+  // 1. Multi-column mockup built single-column (the FEAT-0061 layout-break class).
+  if (mock.grid_cols_max >= 2 && impl.grid_cols_max <= 1) {
+    findings.push({
+      category: 'layout-break', severity: 'critical', confidence: 'medium',
+      description: `mockup declares a ${mock.grid_cols_max}-column grid; implementation files declare no multi-column grid (unless a composed primitive owns it — verify)`,
+      expected: `grid with ${mock.grid_cols_max} columns (mockup)`, actual: `max ${impl.grid_cols_max} column(s) found in touched files`,
+    });
+  }
+  // 2. Mockup gates multi-col behind a breakpoint; impl has NO responsive machinery at all.
+  if ((mock.has_media_queries || mock.has_responsive_prefixes) && !impl.has_media_queries && !impl.has_responsive_prefixes) {
+    findings.push({
+      category: 'responsiveness-break', severity: 'major', confidence: 'medium',
+      description: 'mockup is breakpoint-aware (@media / responsive prefixes); implementation files have neither (unless a composed primitive owns the breakpoints — verify)',
+      expected: 'breakpoint-gated layout as in the mockup', actual: 'no @media, no responsive class prefixes in touched files',
+    });
+  }
+  // 3. Landmark regions present in the mockup, entirely absent in the implementation.
+  //    LOW confidence by construction: component-based impls render landmarks inside
+  //    reused shell primitives (<TopBar> → <header>) invisible to this scan.
+  for (const lm of Object.keys(mock.landmarks)) {
+    if (mock.landmarks[lm] > 0 && impl.landmarks[lm] === 0) {
+      findings.push({
+        category: 'component-missing', severity: 'minor', confidence: 'low',
+        description: `mockup contains <${lm}> landmark region(s); none in the touched files (may be rendered by a composed shell primitive — verify)`,
+        expected: `<${lm}> region (mockup has ${mock.landmarks[lm]})`, actual: 'absent from touched files',
+      });
+    }
+  }
+
+  emit(
+    { status: findings.length ? 'divergence' : 'match', mockup_signature: mock, impl_signature: impl, findings },
+    findings.length ? 3 : 0
+  );
+}
+
+try { main(); } catch (e) { emit({ status: 'skipped', reason: 'internal error: ' + (e && e.message) }, 0); }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "baldart",
-  "version": "4.89.2",
+  "version": "4.92.1",
   "description": "Claude Agent Framework - Reusable framework for coordinating AI agents and humans in software projects",
   "bin": {
     "baldart": "./bin/baldart.js"