mandrel 1.73.0 → 1.75.0

package/.agents/README.md

@@ -33,7 +33,7 @@ It then shows a **two-option prompt**:
 
 1. **Configure now** — runs `node .agents/scripts/bootstrap.js`, forwarding any
    passthrough flags unchanged, to wire the project and GitHub side (creates the
-   GitHub repo + Projects board).
+   GitHub repo; board decoration and Issue Forms are opt-in — see below).
 2. **Just the files** — stops after materialization and prints a re-run hint
    (`mandrel init`) so you can configure later.
 
@@ -100,9 +100,13 @@ The bootstrap pipeline, in order:
    `.claude/commands/` tree so every `/<command>` loads), wires the system
    prompt (see below), gitignores derived artefacts, and runs the
    quality-gates installer.
-4. **GitHub-side mutations.** Creates the label taxonomy, Project V2
-   fields, branch protection, and merge-method settings. Skipped with
-   `--skip-github`.
+4. **GitHub-side mutations.** Creates the label taxonomy, branch protection,
+   and merge-method settings. Skipped with `--skip-github`. Two additional
+   mutations are **opt-in** (prompted y/N, defaulting No, or passed as flags):
+   - `--with-project-board` — provision the Projects V2 Status field and
+     custom fields on an existing board.
+   - `--with-issue-forms` — generate `.github/ISSUE_TEMPLATE/story.yml` and
+     `epic.yml` from the ticket-body schema.
 
 The bootstrap is idempotent — safe to re-run; an already-configured
 clone produces zero file mutations.
@@ -184,7 +188,7 @@ Reverses a recorded install using the install ledger
 (`.agents/.install-manifest.json`). Each ledger entry is a
 mutation-manifest record; uninstall walks reversible entries and undoes
 exactly what the install applied, without touching pre-existing operator
-content. GitHub-side state (labels, branch protection, Projects board)
+content. GitHub-side state (labels, branch protection, project board fields)
 requires manual reversal and is surfaced as a follow-up checklist.
 
 ```bash

package/.agents/instructions.md

@@ -76,6 +76,15 @@ environment variables that override project defaults. The config resolver
 deep-merges `.agentrc.local.json` over `.agentrc.json` (local wins; absent
 local file is a no-op). Do not modify these local files unless requested.
 
+**Durable slash commands.** Any `.md` file placed at
+`.agents/local/workflows/<name>.md` is automatically projected into
+`.claude/commands/<name>.md` by `sync-claude-commands.js`, making it
+invocable as `/<name>`. Because the entire `.agents/local/` subtree is
+exempt from `mandrel sync`'s prune pass, these commands survive
+`npm install`, `mandrel sync`, and `mandrel update` with no manual
+re-sync. Core payload commands of the same basename always win (the
+local copy is ignored with a `shadowed` warning).
+
 ### F. Modular Global Rules
 
 Before writing code or documentation, verify if any domain-agnostic rules

package/.agents/scripts/agents-bootstrap-github.js

@@ -43,7 +43,6 @@ import { Logger } from './lib/Logger.js';
 import {
   LABEL_TAXONOMY,
   PROJECT_FIELD_DEFS,
-  PROJECT_VIEW_DEFS,
   STATUS_FIELD_OPTIONS,
 } from './lib/label-taxonomy.js';
 import { createProvider } from './lib/provider-factory.js';
@@ -154,25 +153,6 @@ async function ensureStatusField(provider, log) {
   }
 }
 
-async function ensureViews(provider, log) {
-  try {
-    const views = await provider.ensureProjectViews(PROJECT_VIEW_DEFS);
-    if (views.unavailable) {
-      log(
-        `[Bootstrap] Projects V2 Views unavailable — skipped ${views.skipped.join(', ')}.${views.error ? ` (${views.error})` : ''} ${PROJECTS_DOC_POINTER}`,
-      );
-    } else {
-      log(
-        `[Bootstrap] Views — created: ${views.created.length}, skipped: ${views.skipped.length}`,
-      );
-    }
-    return views;
-  } catch (err) {
-    log(`[Bootstrap] Views provisioning failed: ${err.message}`);
-    return { created: [], skipped: [], unavailable: false };
-  }
-}
-
 /**
  * Audit the project's built-in workflows and, when explicitly opted-in
  * via `--reap-conflicting-workflows`, delete the ones that race against
@@ -283,10 +263,15 @@ async function ensureProjectFields(provider, project, log) {
  *   github?: object,
  *   baseBranch?: string,
  *   githubAdminApproved?: boolean,
+ *   withProjectBoard?: boolean,
  *   isTTY?: boolean,
  * }} [opts] - `githubAdminApproved` MUST be `true` for any GitHub mutation to
  *   occur; any other value (absent / `false`) is treated as "not approved"
  *   and the run is a verified no-op.
+ *   `withProjectBoard` (default `false`) — opt-in for Projects V2 board,
+ *   Status field, custom fields, and workflow audit. When absent or `false`,
+ *   the board decoration is skipped and only labels + branch protection +
+ *   merge methods are provisioned.
  */
 export async function runBootstrap(config, opts = {}) {
   // Explicit opt-in gate (Story #3526). Default-deny: absent or non-`true`
@@ -316,36 +301,46 @@ export async function runBootstrap(config, opts = {}) {
   log('[Bootstrap] API access verified.');
 
   const labels = await ensureLabels(provider, log);
-  const project = await resolveProject(provider, providerConfig, log);
 
-  const projectReady = !project.skipped && project.projectNumber;
+  // Board decoration (Projects V2 board, Status field, custom fields, workflow
+  // audit) is opt-in and defaults OFF. Minimal install = labels only. Gate is
+  // `opts.withProjectBoard === true`; absent or false skips all board work.
+  // ColumnSync already soft-noops when projectNumber is unset (column-sync.js:19-23).
+  const projectBoard = opts.withProjectBoard === true;
+  let project = { projectNumber: null, created: false, skipped: true };
   let statusField = { status: 'skipped', added: [] };
-  let views = { created: [], skipped: [], unavailable: false };
   let fields = { created: [], skipped: [] };
+  let workflowAudit = {
+    skipped: true,
+    reason: 'board-decoration-not-opted-in',
+  };
 
-  if (projectReady) {
-    statusField = await ensureStatusField(provider, log);
-    views = await ensureViews(provider, log);
-    fields = await ensureProjectFields(provider, project, log);
-  } else {
-    log('[Bootstrap] No active project — skipping legacy project-field setup.');
-  }
-
-  // Story #2845 — audit project workflows for the ones that race against
-  // the orchestrator's ColumnSync writes (notably `Pull request merged`
-  // and `Pull request linked to issue`, which both rewrite Status as a
-  // side-effect of auto-merge). When `--reap-conflicting-workflows` is
-  // set, also delete the offenders via `deleteProjectV2Workflow` (the
-  // only programmatic action GraphQL exposes today — `enabled` is
-  // read-only).
-  const workflowAudit = projectReady
-    ? await auditAndOptionallyReapWorkflows(
+  if (projectBoard) {
+    project = await resolveProject(provider, providerConfig, log);
+    const projectReady = !project.skipped && project.projectNumber;
+    if (projectReady) {
+      statusField = await ensureStatusField(provider, log);
+      fields = await ensureProjectFields(provider, project, log);
+      // Story #2845 — audit project workflows for the ones that race against
+      // the orchestrator's ColumnSync writes (notably `Pull request merged`
+      // and `Pull request linked to issue`, which both rewrite Status as a
+      // side-effect of auto-merge). When `--reap-conflicting-workflows` is
+      // set, also delete the offenders via `deleteProjectV2Workflow` (the
+      // only programmatic action GraphQL exposes today — `enabled` is
+      // read-only).
+      workflowAudit = await auditAndOptionallyReapWorkflows(
         provider,
         project.projectNumber,
         opts.reapConflictingWorkflows === true,
         log,
-      )
-    : { skipped: true, reason: 'no-project' };
+      );
+    } else {
+      log('[Bootstrap] No active project — skipping project-field setup.');
+      workflowAudit = { skipped: true, reason: 'no-project' };
+    }
+  } else {
+    log('[Bootstrap] Project board decoration skipped (opt-in not set).');
+  }
 
   // Consumer-facing bootstrap promotes the framework's CI-gates-only
   // stance: branch protection with enforce_admins + 0-approval-count and
@@ -405,7 +400,6 @@ export async function runBootstrap(config, opts = {}) {
     fields,
     project,
     statusField,
-    views,
     workflowAudit,
     branchProtection,
     mergeMethods,
@@ -490,6 +484,10 @@ async function main() {
   // invocation never silently reconfigures branch protection or merge methods.
   const githubAdminApproved =
     assumeYes || process.argv.includes('--approve-github-admin');
+  // Story #4234 — Board decoration is opt-in (default off). Pass
+  // `--with-project-board` to also provision the Projects V2 board, Status
+  // field, and custom fields.
+  const withProjectBoard = process.argv.includes('--with-project-board');
 
   try {
     const result = await runBootstrap(config, {
@@ -499,6 +497,7 @@ async function main() {
       assumeNo,
       reapConflictingWorkflows,
       githubAdminApproved,
+      withProjectBoard,
     });
     // A non-approved run returns the skip envelope (no full result shape);
     // the skip line is already logged inside runBootstrap, so render the

package/.agents/scripts/bootstrap.js

@@ -37,8 +37,16 @@
  *                             (labels, Projects V2, branch protection, merge
  *                             methods) without accepting every other default.
  *   --skip-github             Skip the GitHub-side bootstrap entirely
- *   --skip-quality            Skip the quality-gates bootstrap
+ *   --with-quality            Opt-in: install local quality gates (pre-commit
+ *                             hook + quality:preview/watch scripts). Off by
+ *                             default — prompted y/N.
  *   --dry-run                 Collect info and print the plan; change nothing
+ *   --with-project-board      Opt-in: provision the Projects V2 Status field
+ *                             and custom fields. Off by default — the project
+ *                             board object is still created when a project
+ *                             name is supplied, but decoration is skipped.
+ *   --with-issue-forms        Opt-in: generate .github/ISSUE_TEMPLATE/story.yml
+ *                             and epic.yml. Off by default.
  *   --reap-conflicting-workflows  Delete Projects V2 built-in workflows that
  *                             race against the orchestrator (destructive)
  *   --help                    Print this help
@@ -97,8 +105,14 @@ Flags:
                             (labels, Projects V2, branch protection, merge
                             methods) without accepting every other default.
   --skip-github             Skip the GitHub-side bootstrap entirely
-  --skip-quality            Skip the quality-gates bootstrap
+  --with-quality            Opt-in: install local quality gates (pre-commit
+                            hook + quality:preview/watch scripts).
+                            (default: off — prompted y/N).
   --dry-run                 Collect info and print the plan; change nothing
+  --with-project-board      Opt-in: provision the Projects V2 Status field
+                            and custom fields (default: off — prompted y/N).
+  --with-issue-forms        Opt-in: generate .github/ISSUE_TEMPLATE/story.yml
+                            and epic.yml (default: off — prompted y/N).
   --reap-conflicting-workflows  Delete Projects V2 built-in workflows that
                             race against the orchestrator (destructive)
   --help                    Print this help
@@ -157,16 +171,24 @@ export function resolveOwnerForPicker(defaults, flags, env = process.env) {
   return null;
 }
 
-/** Ask a yes/no question. Non-interactive runs auto-accept (return true). */
-async function confirmYesNo(message, interactive) {
-  if (!interactive) return true;
+/**
+ * Ask a yes/no question. `defaultAnswer` controls the default when the
+ * operator presses Enter without typing (true = Y/n, false = y/N). In
+ * non-interactive mode the default is returned immediately.
+ */
+async function confirmYesNo(message, interactive, defaultAnswer = true) {
+  if (!interactive) return defaultAnswer;
   const rl = readline.createInterface({
     input: process.stdin,
     output: process.stdout,
   });
   try {
-    const raw = (await rl.question(`${message} [Y/n]: `)).trim().toLowerCase();
-    return raw === '' || raw === 'y' || raw === 'yes';
+    const hint = defaultAnswer ? '[Y/n]' : '[y/N]';
+    const raw = (await rl.question(`${message} ${hint}: `))
+      .trim()
+      .toLowerCase();
+    if (raw === '') return defaultAnswer;
+    return raw === 'y' || raw === 'yes';
   } finally {
     rl.close();
   }
@@ -688,6 +710,9 @@ async function runGithubBootstrap(answers, opts) {
     // interactive operator confirmation, `--assume-yes`, or
     // `--approve-github-admin`. Default-deny at the boundary gate when absent.
     githubAdminApproved: opts.githubAdminApproved === true,
+    // Opt-in: provision Status field + custom fields on the project board.
+    // Default off — prompted y/N during collect/confirm or via --with-project-board.
+    withProjectBoard: opts.withProjectBoard === true,
     // Opt-in: delete the Projects V2 built-in workflows that race against the
     // orchestrator's ColumnSync (e.g. "Pull request merged"). Off by default.
     reapConflictingWorkflows: Boolean(opts.reapConflictingWorkflows),
@@ -1011,7 +1036,48 @@ export async function collectAndConfirm(state) {
         return { ok: false, exit: 1 };
       }
     }
-    return { ok: true, payload: { answers, creation } };
+
+    // Opt-in: board decoration (Status field, custom fields). Default off.
+    // Dry-run halts immediately after this step — resolve without prompting.
+    let withProjectBoard = Boolean(state.flags['with-project-board']);
+    if (!state.flags['dry-run'] && !withProjectBoard) {
+      withProjectBoard = await confirmYesNo(
+        'Set up project board fields (Status, custom)?',
+        state.interactive,
+        false,
+      );
+    }
+
+    // Opt-in: GitHub Issue Form templates. Default off.
+    let withIssueForms = Boolean(state.flags['with-issue-forms']);
+    if (!state.flags['dry-run'] && !withIssueForms) {
+      withIssueForms = await confirmYesNo(
+        'Generate GitHub Issue Form templates?',
+        state.interactive,
+        false,
+      );
+    }
+
+    // Opt-in: local quality gates. Default off.
+    let withQuality = Boolean(state.flags['with-quality']);
+    if (!state.flags['dry-run'] && !withQuality) {
+      withQuality = await confirmYesNo(
+        'Install local quality gates (pre-commit hook + quality:preview/watch scripts)?',
+        state.interactive,
+        false,
+      );
+    }
+
+    return {
+      ok: true,
+      payload: {
+        answers,
+        creation,
+        withProjectBoard,
+        withIssueForms,
+        withQuality,
+      },
+    };
   }
 }
 
@@ -1157,7 +1223,8 @@ export async function executeBootstrap(state) {
     agentRoot: state.agentRoot,
     answers: state.answers,
     approvedGroups,
-    skipQuality: Boolean(state.flags['skip-quality']),
+    withQuality: state.withQuality === true,
+    withIssueForms: state.withIssueForms === true,
   });
   return { ok: true, payload: { report, approvedGroups } };
 }
@@ -1210,6 +1277,7 @@ export async function executeGithubBootstrap(state) {
     state.report.github = await runGithubBootstrap(state.answers, {
       assumeYes: state.assumeYes,
       githubAdminApproved: state.githubAdminApproved === true,
+      withProjectBoard: state.withProjectBoard === true,
       reapConflictingWorkflows: Boolean(
         state.flags['reap-conflicting-workflows'],
       ),
@@ -1232,7 +1300,7 @@ export function recordLedger(state) {
   const manifestCtx = {
     answers: state.answers,
     skipGithub: Boolean(state.flags['skip-github']),
-    skipQuality: Boolean(state.flags['skip-quality']),
+    withQuality: state.withQuality === true,
   };
   const entries = buildMutationManifest(manifestCtx).filter((e) =>
     appliedGroups.has(e.phaseGroup),
@@ -1384,7 +1452,7 @@ export async function main(argv = process.argv.slice(2), deps = {}) {
       `\n[Bootstrap] GitHub bootstrap failed: ${githubError}. ` +
         'Project-side setup (labels are GitHub-side; the local .agentrc.json / ' +
         'quality-gate / workflow files that were applied are recorded in the ' +
-        'install ledger) completed, but the GitHub label/board/views/protection ' +
+        'install ledger) completed, but the GitHub label/board/protection ' +
         'setup did not. Resolve the cause above (commonly `gh auth login` or a ' +
         'missing repo/project scope) and re-run `mandrel bootstrap` — the run is ' +
         'idempotent and will skip what already succeeded.',

package/.agents/scripts/lib/bootstrap/manifest.js

@@ -94,14 +94,14 @@ export const MANIFEST_ENTRY_FIELDS = Object.freeze([
  * platform; remote targets are scoped to the resolved `owner/repo` slug.
  *
  * The `github-admin` group is omitted when `ctx.skipGithub` is set, and the
- * `quality-gates` group is omitted when `ctx.skipQuality` is set, so the
- * preview reflects the same flags the executing pipeline honours.
+ * `quality-gates` group is included only when `ctx.withQuality` is true, so
+ * the preview reflects the same flags the executing pipeline honours.
  *
  * @param {object} [ctx]
  * @param {{ owner?: string, repo?: string }} [ctx.answers] — scopes the
  *   `github-admin` targets to the `owner/repo` slug.
  * @param {boolean} [ctx.skipGithub] — omit the `github-admin` group.
- * @param {boolean} [ctx.skipQuality] — omit the `quality-gates` group.
+ * @param {boolean} [ctx.withQuality] — include the `quality-gates` group.
  * @returns {MutationManifestEntry[]}
  */
 export function buildMutationManifest(ctx = {}) {
@@ -189,8 +189,8 @@ export function buildMutationManifest(ctx = {}) {
 
   // --- quality-gates ----------------------------------------------------
   // Stabilized quality-gate surface (husky pre-commit, quality npm
-  // scripts, .agentrc quality defaults).
-  if (!ctx.skipQuality) {
+  // scripts, .agentrc quality defaults). Included only when opted in.
+  if (ctx.withQuality) {
     entries.push(
       {
         phaseGroup: PHASE_GROUPS.QUALITY_GATES,

package/.agents/scripts/lib/bootstrap/project-bootstrap.js

@@ -724,7 +724,10 @@ export const BOOTSTRAP_PHASES = Object.freeze([
   {
     name: 'issueForms',
     phaseGroup: PHASE_GROUPS.REPO_CONFIG,
-    run: (ctx) => ensureIssueFormsPhase(ctx),
+    run: (ctx) =>
+      ctx.withIssueForms === true
+        ? ensureIssueFormsPhase(ctx)
+        : { skipped: true, reason: 'issue-forms-not-opted-in' },
   },
   {
     name: 'sync',
@@ -742,9 +745,9 @@ export const BOOTSTRAP_PHASES = Object.freeze([
     name: 'quality',
     phaseGroup: PHASE_GROUPS.QUALITY_GATES,
     run: (ctx) =>
-      ctx.skipQuality
-        ? { skipped: true }
-        : applyQualityBootstrap({ projectRoot: ctx.projectRoot }),
+      ctx.withQuality === true
+        ? applyQualityBootstrap({ projectRoot: ctx.projectRoot })
+        : { skipped: true, reason: 'quality-not-opted-in' },
   },
   {
     name: 'winPerf',
@@ -844,7 +847,7 @@ export async function runPhases(phases, ctx) {
  * @param {Set<string>} [ctx.approvedGroups] — when present, only phases
  *   whose `phaseGroup` is in this set execute (the consent-first gate from
  *   Story #3524); always-run infrastructure phases ignore it.
- * @param {boolean} [ctx.skipQuality]
+ * @param {boolean} [ctx.withQuality]
  * @param {boolean} [ctx.skipGithub]
  * @param {boolean} [ctx.skipInstall]
  * @param {boolean} [ctx.quiet]

package/.agents/scripts/lib/bootstrap/prompt.js

@@ -41,7 +41,7 @@ export const KNOWN_FLAGS = Object.freeze({
     'assume-yes',
     'approve-github-admin',
     'skip-github',
-    'skip-quality',
+    'with-quality',
     'help',
     'dry-run',
     'reap-conflicting-workflows',

package/.agents/scripts/lib/bootstrap/summary.js

@@ -57,12 +57,6 @@ export function printSummary(result) {
   Logger.info(`Fields skipped: ${result.fields.skipped.length}`);
   Logger.info(`Project: ${formatProjectSummary(result.project)}`);
   Logger.info(`Status field: ${result.statusField.status}`);
-  const unavailableSuffix = result.views.unavailable
-    ? ' (mutation unavailable)'
-    : '';
-  Logger.info(
-    `Views — created: ${result.views.created.length}, skipped: ${result.views.skipped.length}${unavailableSuffix}`,
-  );
   Logger.info(
     `Workflow audit: ${formatWorkflowAuditSummary(result.workflowAudit)}`,
   );

package/.agents/scripts/lib/bootstrap/workflow-audit.js

@@ -36,6 +36,8 @@
  *   {@link reapConflictingWorkflows}.
  */
 
+import { resolveProjectMeta } from '../orchestration/project-meta-resolver.js';
+
 /**
  * Workflows that **must not** be enabled when the orchestrator owns
  * the Status column. Each entry writes Status as a side-effect of an
@@ -207,14 +209,23 @@ export async function reapConflictingWorkflows(args) {
 }
 
 /**
- * Resolve a Project v2 node id from a project number against the viewer
- * scope. Used by the bootstrap CLI to convert the resolver's
- * `projectNumber` into the node id required by
- * {@link auditProjectWorkflows}. Returns `null` when the viewer cannot
- * see the project (e.g. missing scope, project not under viewer) so the
- * caller can degrade gracefully.
+ * Resolve a Project v2 node id from a project number. Used by the
+ * bootstrap CLI to convert the resolver's `projectNumber` into the node
+ * id required by {@link auditProjectWorkflows}.
+ *
+ * Walks the shared owner-type ladder — `organization(login:$owner)` →
+ * `user(login:$owner)` → `viewer` — via {@link resolveProjectMeta}, so an
+ * **org-owned** board resolves here the same way it does for `ColumnSync`
+ * (Story #4237). The owner login is read from `provider.projectOwner`
+ * (explicit board owner) and falls back to `provider.owner` (the repo
+ * owner) so org boards resolve even when no separate `projectOwner` is
+ * configured. Returns `null` when no owner scope can see the project
+ * (e.g. missing scope) so the caller can degrade gracefully.
  *
- * @param {{ provider: { graphql: Function }, projectNumber: number }} args
+ * @param {{
+ *   provider: { graphql: Function, owner?: string|null, projectOwner?: string|null },
+ *   projectNumber: number,
+ * }} args
  * @returns {Promise<string|null>}
  */
 export async function resolveProjectIdByNumber(args) {
@@ -230,11 +241,13 @@ export async function resolveProjectIdByNumber(args) {
     );
   }
   try {
-    const data = await provider.graphql(
-      `query($n: Int!) { viewer { projectV2(number: $n) { id } } }`,
-      { n: projectNumber },
-    );
-    return data?.viewer?.projectV2?.id ?? null;
+    const project = await resolveProjectMeta({
+      provider,
+      owner: provider.projectOwner ?? provider.owner ?? null,
+      projectNumber,
+      projectFields: 'id',
+    });
+    return project?.id ?? null;
   } catch {
     return null;
   }

package/.agents/scripts/lib/label-taxonomy.js

@@ -156,40 +156,3 @@ export const PROJECT_FIELD_DEFS = [
  * @type {string[]}
  */
 export const STATUS_FIELD_OPTIONS = ['Todo', 'In Progress', 'Done'];
-
-/**
- * Default Projects V2 saved Views. Filter strings follow GitHub's Projects
- * search syntax (`label:`, `status:`, `assignee:`). Each is grouped by the
- * Status field to match the board's columnar layout.
- *
- * GitHub's GraphQL surface does not expose a public `createProjectV2View`
- * mutation, so bootstrap creates these via the REST Projects V2 views
- * endpoint best-effort; when the endpoint is unavailable the views must be
- * configured manually in the GitHub Projects UI.
- *
- * @type {Array<{ name: string, filter: string, groupBy: string,
- *   layout?: 'table'|'board'|'roadmap' }>}
- */
-export const PROJECT_VIEW_DEFS = [
-  {
-    name: 'Mandrel Board',
-    filter: '',
-    groupBy: 'Status',
-    layout: 'board',
-  },
-  {
-    name: 'Epic Roadmap',
-    filter: 'label:type::epic',
-    groupBy: 'Status',
-  },
-  {
-    name: 'Active Stories',
-    filter: 'label:type::story -status:Done',
-    groupBy: 'Status',
-  },
-  {
-    name: 'My Queue',
-    filter: 'assignee:@me',
-    groupBy: 'Status',
-  },
-];

package/.agents/scripts/lib/onboard/init-tail.js

@@ -62,23 +62,22 @@ function formatMissingList(missing) {
 }
 
 /** Prompt text shown only on a TTY when asking to scaffold. */
-const SCAFFOLD_PROMPT = '\nCreate placeholders? [Y/n]: ';
+const SCAFFOLD_PROMPT = '\nCreate placeholders? [y/N]: ';
 
 /**
  * Async y/N read from stdin via `node:readline` (mirrors the prompt mechanism
  * in `bootstrap.js`). Returns on Enter and never blocks waiting for EOF the way
  * `fs.readFileSync(0)` did — that EOF-blocking read hung `mandrel init` on an
- * interactive TTY. Yes is the default (`[Y/n]`): a bare Enter — or anything but
- * an explicit `n`/`no` — resolves to `true` (create the placeholders), since the
- * missing docs are known-needed and the stubs carry a `MANDREL:STUB` marker the
- * `/plan` preflight still flags until they are fleshed out. A read error
- * resolves to `false` so a genuine I/O failure never writes unattended. The
- * prompt text is written by the caller via `stdout`, so the question string
- * passed here is empty.
+ * interactive TTY. No is the default (`[y/N]`): only an explicit `y`/`yes`
+ * resolves to `true` (create the placeholders). A bare Enter or any other input
+ * declines, matching the same default-off policy as `--with-issue-forms`. A
+ * read error resolves to `false` so a genuine I/O failure never writes
+ * unattended. The prompt text is written by the caller via `stdout`, so the
+ * question string passed here is empty.
  *
  * `terminal: false` is **load-bearing**: with terminal mode on (the default
  * when stdout is a TTY) readline emits cursor-control escapes
- * (`\x1b[1G\x1b[0J`) that erase the `Create placeholders? [Y/n]:` prompt already
+ * (`\x1b[1G\x1b[0J`) that erase the `Create placeholders? [y/N]:` prompt already
  * written via the caller's `stdout`, leaving the operator staring at a blank,
  * dead-looking line. Disabling terminal mode preserves the pre-written prompt
  * and reads the line via the TTY's cooked-mode echo. `createInterface` is
@@ -97,7 +96,7 @@ export async function readConfirm({
   });
   try {
     const answer = (await rl.question('')).trim().toLowerCase();
-    return answer !== 'n' && answer !== 'no';
+    return answer === 'y' || answer === 'yes';
   } catch {
     return false;
   } finally {