mandrel 1.57.0

package/.agents/scripts/lib/config-resolver.js

@@ -0,0 +1,298 @@
+/**
+ * Unified Configuration Resolver — facade (Epic #1720 Story #1739).
+ *
+ * Resolution chain: `<project-root>/.agentrc.local.json` (optional) →
+ * `.agentrc.json` → built-in defaults. Object keys deep-merge; absent local
+ * file is a no-op.
+ * `.env` is loaded lazily once per resolved root via `loadEnv`.
+ *
+ * Post-reshape, `.agentrc.json` declares four top-level blocks:
+ * `project`, `github`, `planning`, `delivery`. The resolver runs the
+ * full-document AJV gate (`AGENTRC_SCHEMA`) on load and returns a wrapper
+ * carrying each block plus a `raw`/`source` metadata pair.
+ *
+ * Hard cutover (Epic #2880, Story #2947): both the input-side and
+ * output-side legacy shapes are gone. Legacy `agentSettings.*` /
+ * `orchestration.*` input documents are rejected by the AJV schema
+ * (`additionalProperties: false` at the top level), and the previously
+ * synthesized `agentSettings` / `orchestration` output pointers have been
+ * deleted from the resolver wrapper. Every internal call site reads the
+ * canonical `project` / `github` / `planning` / `delivery` blocks
+ * directly; consumers upgrade in lockstep with the framework bump
+ * (see `.agents/rules/git-conventions.md#contract-cutovers-—-no-shim-layer`).
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { getCiDelivery } from './config/ci.js';
+import { getCommands } from './config/commands.js';
+import { getGitHub } from './config/github.js';
+import { getLifecycle } from './config/lifecycle.js';
+import { resolvePaths } from './config/paths.js';
+import { validateOrchestrationConfig } from './config/validate-orchestration.js';
+import { getWorktreeIsolation } from './config/worktree-isolation.js';
+import { getAgentrcValidator } from './config-schema.js';
+import { loadEnv } from './env-loader.js';
+
+export { getAcceptanceEval } from './config/acceptance-eval.js';
+export { BASELINES_DEFAULTS, getBaselines } from './config/baselines.js';
+export { CI_DELIVERY_DEFAULTS, getCiDelivery } from './config/ci.js';
+export { COMMANDS_DEFAULTS, getCommands } from './config/commands.js';
+export { NOTIFICATIONS_DEFAULTS } from './config/github.js';
+export {
+  getLimits,
+  LIMITS_DEFAULTS,
+  resolvePreflightCeilings,
+} from './config/limits.js';
+export { getPaths } from './config/paths.js';
+export { getPreflight, PREFLIGHT_DEFAULTS } from './config/preflight.js';
+export {
+  CODING_GUARDRAILS_DEFAULTS,
+  getQuality,
+  resolveCodingGuardrails,
+  resolveMaintainabilityCrap,
+  resolveQuality,
+} from './config/quality.js';
+export { getRunners } from './config/runners.js';
+export {
+  resolveRuntime,
+  resolveSessionId,
+  resolveWorkingPath,
+  resolveWorktreeEnabled,
+} from './config/runtime.js';
+export { resolveListValue } from './config/shared.js';
+export { validateOrchestrationConfig } from './config/validate-orchestration.js';
+export { WORKTREE_ISOLATION_DEFAULTS } from './config/worktree-isolation.js';
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+// scripts/lib/ → scripts/ → .agents/ → project root
+export const PROJECT_ROOT = path.resolve(__dirname, '../../..');
+
+// Cache keyed by absolute root path so callers passing different cwds
+// (e.g. per-worktree) each get their own resolved config.
+const _cacheByRoot = new Map();
+const _envLoadedRoots = new Set();
+
+/**
+ * Enrich `github.notifications` with NOTIFICATIONS_DEFAULTS so an omitted
+ * block doesn't suppress notify.js's comment/webhook channels (which read
+ * the shim directly and treat an empty allowlist as "channel off").
+ */
+function applyGithubDefaults(rawGithub) {
+  if (!rawGithub) return null;
+  return {
+    ...rawGithub,
+    notifications: getGitHub({ github: rawGithub }).notifications,
+  };
+}
+
+/**
+ * Enrich `project.commands` so an omitted field resolves to COMMANDS_DEFAULTS
+ * rather than `undefined` — callers that read `project.commands.test` etc.
+ * directly (without going through `getCommands()`) get the framework value.
+ */
+function applyCommandsDefaults(project) {
+  return { ...project, commands: getCommands({ project }) };
+}
+
+/**
+ * Enrich `delivery.worktreeIsolation` so an omitted field resolves to
+ * WORKTREE_ISOLATION_DEFAULTS. Critical for `enabled`/`root` —
+ * `Boolean(undefined) === false` previously disabled worktrees silently
+ * when the operator omitted the block.
+ */
+function applyDeliveryDefaults(rawDelivery) {
+  const delivery = { ...(rawDelivery ?? {}) };
+  delivery.worktreeIsolation = getWorktreeIsolation({
+    worktreeIsolation: delivery.worktreeIsolation,
+  });
+  delivery.lifecycle = getLifecycle({ lifecycle: delivery.lifecycle });
+  // Story #2899 (Epic #2880) — `delivery.ci` always carries
+  // `skipForStoryPushes: true` by default so Story-branch commit
+  // tooling applies the `[skip ci]` trailer without operator opt-in.
+  delivery.ci = getCiDelivery({ ci: delivery.ci });
+  return delivery;
+}
+
+/**
+ * Apply framework defaults for the four top-level blocks. Pure (no
+ * mutation) — returns a fresh object.
+ */
+/**
+ * Deep-merge plain objects for the `.agentrc.local.json` overlay. Arrays and
+ * scalars from `override` replace the base value at that key.
+ *
+ * @param {unknown} base
+ * @param {unknown} override
+ * @returns {unknown}
+ */
+function deepMergeObjects(base, override) {
+  if (
+    override === null ||
+    typeof override !== 'object' ||
+    Array.isArray(override)
+  ) {
+    return override;
+  }
+  if (base === null || typeof base !== 'object' || Array.isArray(base)) {
+    return { ...override };
+  }
+  const out = { ...base };
+  for (const key of Object.keys(override)) {
+    const baseVal = base[key];
+    const overrideVal = override[key];
+    if (
+      overrideVal !== null &&
+      typeof overrideVal === 'object' &&
+      !Array.isArray(overrideVal) &&
+      baseVal !== null &&
+      typeof baseVal === 'object' &&
+      !Array.isArray(baseVal)
+    ) {
+      out[key] = deepMergeObjects(baseVal, overrideVal);
+    } else {
+      out[key] = overrideVal;
+    }
+  }
+  return out;
+}
+
+/** @param {import('node:fs')} fsImpl */
+function readJsonConfigFile(fsImpl, filePath, label) {
+  try {
+    return JSON.parse(fsImpl.readFileSync(filePath, 'utf8'));
+  } catch (parseErr) {
+    throw new Error(
+      `[config] Failed to parse ${label}: ${parseErr.message}. ` +
+        `Fix the JSON syntax before proceeding.`,
+    );
+  }
+}
+
+const ZERO_CONFIG_RAW = Object.freeze({
+  project: {
+    paths: { agentRoot: '.agents', docsRoot: 'docs', tempRoot: 'temp' },
+  },
+});
+
+function applyDefaults(raw) {
+  const project = applyCommandsDefaults({ ...(raw.project ?? {}) });
+  // Default docsContextFiles list — same five files the framework has
+  // always shipped, preserved here so zero-config callers and configs
+  // that omit the list both get the canonical mandatory-reads set.
+  if (project.docsContextFiles == null) {
+    project.docsContextFiles = [
+      'architecture.md',
+      'data-dictionary.md',
+      'decisions.md',
+      'patterns.md',
+    ];
+  }
+  if (project.baseBranch == null) {
+    project.baseBranch = 'main';
+  }
+  project.paths = resolvePaths(project.paths);
+  return {
+    project,
+    github: applyGithubDefaults(raw.github),
+    planning: raw.planning ?? {},
+    delivery: applyDeliveryDefaults(raw.delivery),
+    // `qa` is an optional top-level block (agentrc.schema.json
+    // `#/$defs/qa`). It needs no default-layering — the harness resolver
+    // (`resolveQaContract`) owns normalization and required-field
+    // enforcement — it only needs to survive the reshape so
+    // `/qa-run-harness` Step 0 can read it off the resolved wrapper.
+    ...(raw.qa !== undefined ? { qa: raw.qa } : {}),
+  };
+}
+
+/**
+ * Load + validate `.agentrc.json` and return the resolved wrapper.
+ *
+ * Returned shape:
+ *   {
+ *     project, github, planning, delivery,  // post-reshape canonical blocks
+ *     qa,                                    // optional QA-harness block (present iff authored)
+ *     raw, source,
+ *   }
+ *
+ * Error policy:
+ *   - File missing (ENOENT) → fall through to built-in defaults (zero-config).
+ *   - File present but malformed JSON → throw immediately.
+ *   - Schema validation failure → throw with a single-line error list.
+ *
+ * @param {{ bustCache?: boolean, cwd?: string, validate?: boolean, ctx?: object }} [opts]
+ */
+export function resolveConfig(opts) {
+  const envCwd = process.env.AP_AGENTRC_CWD;
+  const root = path.resolve(opts?.cwd ?? envCwd ?? PROJECT_ROOT);
+  const validate = opts?.validate !== false;
+  const fsImpl = opts?.ctx?.fs ?? fs;
+
+  if (!opts?.bustCache && _cacheByRoot.has(root)) {
+    return _cacheByRoot.get(root);
+  }
+
+  if (!_envLoadedRoots.has(root)) {
+    loadEnv(root);
+    _envLoadedRoots.add(root);
+  }
+
+  const agentrcPath = path.join(root, '.agentrc.json');
+  const localPath = path.join(root, '.agentrc.local.json');
+  const hasAgentrc = fsImpl.existsSync(agentrcPath);
+  const hasLocal = fsImpl.existsSync(localPath);
+
+  if (!hasAgentrc && !hasLocal) {
+    const blocks = applyDefaults({ ...ZERO_CONFIG_RAW });
+    const resolved = {
+      ...blocks,
+      raw: null,
+      source: 'built-in defaults',
+    };
+    _cacheByRoot.set(root, resolved);
+    return resolved;
+  }
+
+  let raw = hasAgentrc
+    ? readJsonConfigFile(fsImpl, agentrcPath, '.agentrc.json')
+    : { ...ZERO_CONFIG_RAW };
+
+  let source = hasAgentrc ? agentrcPath : 'built-in defaults';
+
+  if (hasLocal) {
+    const localRaw = readJsonConfigFile(
+      fsImpl,
+      localPath,
+      '.agentrc.local.json',
+    );
+    raw = deepMergeObjects(raw, localRaw);
+    source =
+      source === 'built-in defaults'
+        ? `${localPath} (overrides built-in defaults)`
+        : `${localPath} (overrides ${agentrcPath})`;
+  }
+
+  if (validate) {
+    const validateAgentrc = getAgentrcValidator();
+    if (!validateAgentrc(raw)) {
+      const details = (validateAgentrc.errors || [])
+        .map((e) => `${e.instancePath || '(root)'} ${e.message}`)
+        .join(', ');
+      throw new Error(`[config] Invalid .agentrc.json: ${details}`);
+    }
+  }
+
+  const blocks = applyDefaults(raw);
+
+  if (validate) validateOrchestrationConfig(blocks);
+
+  const resolved = {
+    ...blocks,
+    raw,
+    source,
+  };
+  _cacheByRoot.set(root, resolved);
+  return resolved;
+}

package/.agents/scripts/lib/config-schema-shared.js

@@ -0,0 +1,32 @@
+/**
+ * Shell-injection pattern source (string form) used inside JSON Schema
+ * `not.pattern` clauses. Kept as a string so the schema literal and the
+ * regex form share one definition.
+ *
+ * Matches `;`, `&`, `|`, backtick, or `$(`.
+ */
+export const SHELL_INJECTION_PATTERN_STRING = '([;&|`]|\\$\\()';
+
+/**
+ * Regex form of the lenient shell-injection pattern for runtime string checks.
+ */
+export const SHELL_INJECTION_RE = new RegExp(SHELL_INJECTION_PATTERN_STRING);
+
+/**
+ * Stricter shell metacharacter pattern for orchestration runtime values
+ * (owner, repo, operator handle, webhook URL) where no shell metacharacters
+ * are ever legitimate.
+ */
+export const SHELL_INJECTION_RE_STRICT = /[&|;`<>()$]/;
+
+// Re-export the canonical baseline schema registry (Story #1888). The
+// registry implementation lives in `baseline-schema-registry.js`; this
+// re-export keeps `config-schema-shared.js` as the canonical import surface
+// for downstream consumers and the mirror-drift test.
+export {
+  BASELINE_ENVELOPE_FILE,
+  BASELINE_KIND_SCHEMA_FILES,
+  BASELINE_SCHEMA_FILES,
+  BASELINE_SCHEMAS_DIR,
+  buildBaselineSchemaAjv,
+} from './baseline-schema-registry.js';

package/.agents/scripts/lib/config-schema.js

@@ -0,0 +1,20 @@
+/* node:coverage ignore file -- AJV schema declaration (data-as-code); MI < 70 is inherent to large flat schema literals, no business logic to test */
+
+// Shell-injection constants live in config-schema-shared.js so the settings
+// schema file can import them without pulling this module's AJV bundle.
+// Re-exported here for backward-compatible import paths.
+export {
+  SHELL_INJECTION_PATTERN_STRING,
+  SHELL_INJECTION_RE,
+  SHELL_INJECTION_RE_STRICT,
+} from './config-schema-shared.js';
+
+// The full agentrc schema lives in its own module to keep this file under
+// escomplex's Halstead-volume ceiling. Re-exported here for import stability.
+export {
+  AGENT_SETTINGS_STRING_FIELDS,
+  AGENTRC_SCHEMA,
+  COMMENT_EVENT_NAMES,
+  getAgentrcValidator,
+  WEBHOOK_EVENT_NAMES,
+} from './config-settings-schema.js';

package/.agents/scripts/lib/config-settings-schema-delivery.js

@@ -0,0 +1,332 @@
+/* node:coverage ignore file -- AJV schema declaration (data-as-code); MI < 70 is inherent to large flat schema literals, no business logic to test */
+
+// ---------------------------------------------------------------------------
+// delivery.* sub-schemas — extracted from config-settings-schema.js to keep
+// the aggregate AGENTRC_SCHEMA module under the maintainability floor. These
+// are pure declarative AJV fragments referenced by DELIVERY_SCHEMA; moving
+// them here does not change validation semantics (the resolved schema is
+// byte-for-byte equivalent in effect).
+// ---------------------------------------------------------------------------
+
+import { SHELL_INJECTION_PATTERN_STRING } from './config-schema-shared.js';
+// `delivery.quality` and `delivery.codeReview` sub-schemas live in a
+// further-split module (refs #3457) so each schema file stays above the
+// maintainability floor.
+import {
+  CODE_REVIEW_SCHEMA,
+  QUALITY_SCHEMA,
+} from './config-settings-schema-quality.js';
+
+const SAFE_STRING = {
+  type: 'string',
+  not: { pattern: SHELL_INJECTION_PATTERN_STRING },
+};
+
+const EXECUTION_SCHEMA = {
+  type: 'object',
+  properties: {
+    timeoutMs: { type: 'integer', minimum: 1 },
+  },
+  additionalProperties: false,
+};
+
+/**
+ * `delivery.lease` — assignee-as-lease primitive (Story #3480). `ttlMs` is
+ * the staleness window: a ticket claim whose owner has not emitted a
+ * `story.heartbeat` within this many milliseconds is reclaimable by another
+ * operator. Defaults to 900000 (15 min) in `lib/config/limits.js`.
+ */
+const LEASE_SCHEMA = {
+  type: 'object',
+  properties: {
+    ttlMs: { type: 'integer', minimum: 1 },
+  },
+  additionalProperties: false,
+};
+
+const DOCS_FRESHNESS_SCHEMA = {
+  type: 'object',
+  properties: {
+    paths: {
+      type: 'array',
+      items: { ...SAFE_STRING, minLength: 1 },
+    },
+  },
+  additionalProperties: false,
+};
+
+/**
+ * `delivery.deliverRunner` — bounded-concurrency knob for the epic-deliver
+ * fan-out. Flattened post-reshape — no `runners.` wrapper, no `enabled`
+ * field (operators dial concurrency directly).
+ */
+const DELIVER_RUNNER_SCHEMA = {
+  type: 'object',
+  properties: {
+    concurrencyCap: { type: 'integer', minimum: 1 },
+    progressReportIntervalSec: { type: 'integer', minimum: 0 },
+    verifyConcurrencyCap: { type: 'integer', minimum: 1 },
+  },
+  additionalProperties: false,
+};
+
+/**
+ * `delivery.retro.perfThresholds` (Story #3042, Task #3043) — operator-tunable
+ * gates for the retro perf-signals classifier. Defaults are documented inline
+ * here and mirrored in `lib/orchestration/retro-perf-heuristics.js
+ * (DEFAULT_RETRO_PERF_THRESHOLDS)` and the static schema mirror.
+ *
+ * `utilisation` / `bootstrapShare` are unit-interval ratios; values outside
+ * [0, 1] fall back to defaults at the resolver. `capBindingRunLength` is a
+ * positive integer count of consecutive cap-binding waves.
+ */
+const RETRO_PERF_THRESHOLDS_SCHEMA = {
+  type: 'object',
+  properties: {
+    utilisation: { type: 'number', minimum: 0, maximum: 1 },
+    bootstrapShare: { type: 'number', minimum: 0, maximum: 1 },
+    capBindingRunLength: { type: 'integer', minimum: 1 },
+  },
+  additionalProperties: false,
+};
+
+const RETRO_SCHEMA = {
+  type: 'object',
+  properties: {
+    perfThresholds: RETRO_PERF_THRESHOLDS_SCHEMA,
+  },
+  additionalProperties: false,
+};
+
+const WORKTREE_ISOLATION_SCHEMA = {
+  type: 'object',
+  properties: {
+    enabled: { type: 'boolean' },
+    root: { type: 'string', minLength: 1 },
+    nodeModulesStrategy: {
+      type: 'string',
+      enum: ['per-worktree', 'symlink', 'pnpm-store'],
+    },
+    primeFromPath: { type: ['string', 'null'], minLength: 1 },
+    allowSymlinkOnWindows: { type: 'boolean' },
+    reapOnSuccess: { type: 'boolean' },
+    reapOnCancel: { type: 'boolean' },
+    bootstrapFiles: {
+      type: 'array',
+      items: { type: 'string', minLength: 1 },
+      default: ['.env', '.mcp.json'],
+    },
+  },
+  additionalProperties: false,
+  // `root` is required only when isolation is explicitly enabled.
+  allOf: [
+    {
+      if: {
+        properties: { enabled: { const: true } },
+        required: ['enabled'],
+      },
+      // biome-ignore lint/suspicious/noThenProperty: JSON Schema if/then keyword
+      then: { required: ['root'] },
+    },
+  ],
+};
+
+/**
+ * `delivery.signals` — detector thresholds for the three surviving
+ * performance-signal categories. `churn` and `idle` were dropped (low
+ * signal-to-noise). Each block is shallow-merged by the resolver.
+ */
+const SIGNALS_SCHEMA = {
+  type: 'object',
+  properties: {
+    hotspot: {
+      type: 'object',
+      properties: {
+        p95Multiplier: { type: 'number', minimum: 0 },
+      },
+      additionalProperties: false,
+    },
+    rework: {
+      type: 'object',
+      properties: {
+        editsPerFile: { type: 'integer', minimum: 1 },
+      },
+      additionalProperties: false,
+    },
+    retry: {
+      type: 'object',
+      properties: {
+        repeatCount: { type: 'integer', minimum: 1 },
+      },
+      additionalProperties: false,
+    },
+  },
+  additionalProperties: false,
+};
+
+/**
+ * `delivery.lifecycle` — knobs consumed by the lifecycle event bus
+ * (Epic #2172). `timeouts` is a per-event budget map (eventName → seconds)
+ * used by Story 11's `TimeoutWatchdog` listener; missing entries fall back
+ * to in-listener defaults. `heartbeatWarnSeconds` is the no-progress
+ * threshold consumed by `HeartbeatMonitor`. Story #2227 lays down the
+ * keys; consumers land in later stories.
+ */
+const LIFECYCLE_SCHEMA = {
+  type: 'object',
+  properties: {
+    timeouts: {
+      type: 'object',
+      additionalProperties: { type: 'integer', minimum: 1 },
+    },
+    heartbeatWarnSeconds: { type: 'integer', minimum: 1 },
+  },
+  additionalProperties: false,
+};
+
+/**
+ * `delivery.mergeWatch` — knobs consumed by the MergeWatcher lifecycle
+ * listener (Story #2896, Epic #2880). `intervalSeconds` is the poll
+ * cadence between `gh pr view --json mergeCommit,mergedAt` probes after
+ * `epic.merge.armed`; `maxBudgetSeconds` is the total wall-clock budget
+ * before the watcher surfaces `agent::blocked` with reason
+ * `budget-exceeded`. Both keys default in the listener when omitted
+ * (30s / 3600s).
+ */
+const MERGE_WATCH_SCHEMA = {
+  type: 'object',
+  properties: {
+    intervalSeconds: { type: 'integer', minimum: 1 },
+    maxBudgetSeconds: { type: 'integer', minimum: 1 },
+  },
+  additionalProperties: false,
+};
+
+/**
+ * `delivery.epicAudit` — bounded-retry knobs for /epic-deliver Phase 4
+ * (epic-audit). `maxFixAttempts` caps how many times the auto-fix loop
+ * retries a single finding (Story #2611, Epic #2586). `maxFixScopeFiles`
+ * caps how many files a single auto-fix may touch before escalating to
+ * `agent::blocked` (default 5) — a deliberately narrow bound for
+ * unattended auto-fixes, independent of the Story-sizing thresholds in
+ * `ticket-validator-sizing.js`.
+ */
+const EPIC_AUDIT_SCHEMA = {
+  type: 'object',
+  properties: {
+    maxFixAttempts: { type: 'integer', minimum: 0 },
+    maxFixScopeFiles: { type: 'integer', minimum: 1 },
+  },
+  additionalProperties: false,
+};
+
+// Story #2899 (Epic #2880) — performance defaults + preflight (F13).
+// `delivery.ci.skipForStoryPushes` (default true via getCiDelivery): when
+// true, pre-push tooling appends a `[skip ci]` trailer to Story-branch
+// commit subjects so intermediate pushes do not stampede the CI fleet.
+// The Epic-branch merge commit produced by story-close.js's merge
+// runner never carries the marker, regardless of this flag.
+const CI_DELIVERY_SCHEMA = {
+  type: 'object',
+  properties: {
+    skipForStoryPushes: { type: 'boolean' },
+  },
+  additionalProperties: false,
+};
+
+// Story #2899 (Epic #2880) — `delivery.preflight.*` thresholds consumed
+// by `epic-deliver-preflight.js`. When any value is exceeded the CLI
+// surfaces a breach in its envelope and the workflow flips the Epic to
+// `agent::blocked` (see /epic-deliver Phase 1 prelude).
+const PREFLIGHT_SCHEMA = {
+  type: 'object',
+  properties: {
+    maxStories: { type: 'integer', minimum: 1 },
+    maxWaves: { type: 'integer', minimum: 1 },
+    maxInstallCostSeconds: { type: 'integer', minimum: 1 },
+    maxGithubApiRequests: { type: 'integer', minimum: 1 },
+    maxClaudeQuotaTokens: { type: 'integer', minimum: 1 },
+  },
+  additionalProperties: false,
+};
+
+/**
+ * `delivery.refactorStage` — opt-in, config-gated post-green refactor
+ * checkpoint wired into story-deliver (Story #3430, Epic #3418). Strictly
+ * additive and default-OFF: when `enabled` is unset or `false`, story-deliver
+ * behaves exactly as before. When `true`, the worker runs an advisory
+ * post-green refactor pass (the `refactorer` persona +
+ * `core/refactoring-discipline` skill) after the suite is green. The stage is
+ * advisory only — it never changes existing close-validation gate semantics.
+ */
+const REFACTOR_STAGE_SCHEMA = {
+  type: 'object',
+  properties: {
+    enabled: {
+      type: 'boolean',
+      description:
+        'When true, story-deliver runs an advisory post-green refactor stage (refactorer persona + core/refactoring-discipline skill) after the suite is green. Default false — when unset the stage is skipped and close-validation gate semantics are unchanged.',
+    },
+  },
+  additionalProperties: false,
+};
+
+/**
+ * `delivery.acceptanceEval` — bounded per-Story acceptance self-eval loop
+ * (Story #3819). After the implementation commits land and before the
+ * Story-implementation phase flips to `closing`, an independent
+ * (fresh-context) critic pass scores the working diff against each inline
+ * `acceptance[]` item, redrafts the unmet items, and re-evaluates — capped
+ * at `maxRounds` redraft rounds.
+ *
+ * `maxRounds` is the operator-tunable redraft ceiling (default 2 via
+ * `lib/config/acceptance-eval.js`). It is a soft knob inside an
+ * **undisableable** hard cap: `lib/config/acceptance-eval.js` clamps any
+ * configured value into `[1, ACCEPTANCE_EVAL_MAX_ROUNDS_CEILING]`, so no
+ * configuration can switch the loop off (`maxRounds: 0`) or let it spin
+ * unbounded. There is intentionally **no** `enabled` flag — the loop is a
+ * hard cutover, always on, per `rules/git-conventions.md`.
+ */
+const ACCEPTANCE_EVAL_SCHEMA = {
+  type: 'object',
+  properties: {
+    maxRounds: {
+      type: 'integer',
+      minimum: 1,
+      description:
+        'Maximum number of redraft rounds the acceptance self-eval loop runs before escalating to agent::blocked when criteria remain unmet. Default 2; clamped into [1, hard ceiling] by the resolver so the cap can never be disabled.',
+    },
+  },
+  additionalProperties: false,
+};
+
+export const DELIVERY_SCHEMA = {
+  type: 'object',
+  properties: {
+    execution: EXECUTION_SCHEMA,
+    maxTokenBudget: { type: 'integer', minimum: 1 },
+    lease: LEASE_SCHEMA,
+    docsFreshness: DOCS_FRESHNESS_SCHEMA,
+    deliverRunner: DELIVER_RUNNER_SCHEMA,
+    worktreeIsolation: WORKTREE_ISOLATION_SCHEMA,
+    signals: SIGNALS_SCHEMA,
+    quality: QUALITY_SCHEMA,
+    lifecycle: LIFECYCLE_SCHEMA,
+    mergeWatch: MERGE_WATCH_SCHEMA,
+    epicAudit: EPIC_AUDIT_SCHEMA,
+    codeReview: CODE_REVIEW_SCHEMA,
+    retro: RETRO_SCHEMA,
+    refactorStage: REFACTOR_STAGE_SCHEMA,
+    acceptanceEval: ACCEPTANCE_EVAL_SCHEMA,
+    ci: CI_DELIVERY_SCHEMA,
+    preflight: PREFLIGHT_SCHEMA,
+    // Cross-Story concurrency-hazard gate (Story #2297). When true,
+    // `epic-deliver-prepare` refuses to flip the Epic to
+    // `agent::executing` if the upcoming waves still carry any conflict
+    // finding (Story #2296). Off by default; operators using the gate
+    // also need to wire findings into prepare via the runtime injection
+    // surface.
+    failOnConcurrencyHazards: { type: 'boolean' },
+  },
+  additionalProperties: false,
+};