mandrel 1.83.0 → 1.85.0

package/.agents/docs/agentrc-reference.json

@@ -92,7 +92,6 @@
     "taskSizing": {
       "softFiles": 15,
       "hardFiles": 30,
-      "maxAcceptance": 14,
       "softAcceptanceCount": 10
     }
   },
@@ -101,7 +100,14 @@
     "maxTokenBudget": 300000,
     "lease": { "ttlMs": 900000 },
     "ci": {
-      "skipForStoryPushes": true
+      "skipForStoryPushes": true,
+      "earlyPr": true,
+      "watch": {
+        "pollIntervalMs": 30000,
+        "maxPolls": 120,
+        "maxResumes": 3
+      },
+      "autoMerge": "trust-ci"
     },
     "preflight": {
       "maxStories": 50,

package/.agents/docs/configuration.md

@@ -108,8 +108,7 @@ top-level keys are validation errors.
 | `taskSizing` | No | `object` | — | Story-sizing thresholds consumed by ticket-validator-sizing.js. Operator overrides shallow-merge with DEFAULT_TASK_SIZING defaults. Story #3760 collapsed the per-profile matrix and the parallel testSurface axis into a flat set of knobs; the sizingProfile enum was replaced by an optional body-level `wide` declaration that lifts the hardFiles rejection. Story #3874 cut over to one uniform relaxed profile sized for capability slices a frontier model delivers and self-verifies in one pass. |
 | `taskSizing.softFiles` | No | `integer` | — | File-count soft-warn threshold above which a typical-Story width finding fires (default 15). |
 | `taskSizing.hardFiles` | No | `integer` | — | File-count hard ceiling: a Story exceeding it is rejected unless it declares `wide` with a reason (default 30). |
-| `taskSizing.maxAcceptance` | No | `integer` | — | Hard ceiling on acceptance[] item count (default 14). |
-| `taskSizing.softAcceptanceCount` | No | `integer` | — | Soft-warn threshold on acceptance[] item count (default 10). |
+| `taskSizing.softAcceptanceCount` | No | `integer` | — | Soft-warn threshold on acceptance[] item count (default 10). Acceptance mass is advisory-only — there is no hard acceptance ceiling. |
 | `taskSizing.mergeCandidateMaxFiles` | No | `integer` | — | Under-size threshold (Story #4312): a Story with at most this many declared changes[] files, at most mergeCandidateMaxAcceptance acceptance items, and at least one depends_on edge to a sibling trips the advisory `merge-candidate` soft finding (default 3). |
 | `taskSizing.mergeCandidateMaxAcceptance` | No | `integer` | — | Under-size threshold (Story #4312): the acceptance[] item ceiling of the `merge-candidate` soft finding heuristic (default 4). |
 | `failOnSharedEditors` | No | `boolean` | — | — |
@@ -293,6 +292,12 @@ top-level keys are validation errors.
 | `acceptanceEval.maxRounds` | No | `integer` | — | Maximum number of redraft rounds before escalation. Default 2; clamped into [1, hard ceiling] by lib/config/acceptance-eval.js so the cap can never be disabled (maxRounds: 0 clamps up to 1). |
 | `ci` | No | `object` | — | Nested configuration block. |
 | `ci.skipForStoryPushes` | No | `boolean` | — | Story #2899 (Epic #2880, F13). When true (default), pre-push tooling appends a '[skip ci]' trailer to Story-branch commit subjects so intermediate pushes do not stampede the CI fleet. The Epic-branch merge commit produced by story-close.js never carries the marker, regardless of this flag. |
+| `ci.earlyPr` | No | `boolean` | — | Story #4356 (Epic #4355). When true (default), /deliver opens the Epic PR early — before every Story merges — so CI starts warming while later waves run. Set false to defer PR creation until the Epic branch is complete. |
+| `ci.watch` | No | `object` | — | Story #4356 (Epic #4355). Poll-loop tuning for the merge/CI watch. pollIntervalMs is the cadence between check probes; maxPolls caps total probes before the watcher gives up; maxResumes caps how many times the watcher may resume after a transient stall. |
+| `ci.watch.pollIntervalMs` | No | `integer` | — | — |
+| `ci.watch.maxPolls` | No | `integer` | — | — |
+| `ci.watch.maxResumes` | No | `integer` | — | — |
+| `ci.autoMerge` | No | `"trust-ci"` \| `"strict"` | — | Story #4356 (Epic #4355). Merge posture. 'trust-ci' (default) merges once required checks pass; 'strict' additionally requires a clean review gate. |
 | `preflight` | No | `object` | — | Story #2899 (Epic #2880, F13). Thresholds consumed by `.agents/scripts/epic-deliver-preflight.js`. When any value is exceeded the preflight envelope flags a breach and /deliver Phase 1 surfaces it via agent::blocked. |
 | `preflight.maxStories` | No | `integer` | — | — |
 | `preflight.maxWaves` | No | `integer` | — | — |

package/.agents/instructions.md

@@ -110,6 +110,10 @@ does not re-pay their bytes on every turn.
   - [`rules/orchestration-error-handling.md`](rules/orchestration-error-handling.md)
     — before writing or modifying orchestration scripts under
     `.agents/scripts/**`.
+  - [`rules/ci-remediation.md`](rules/ci-remediation.md) — before remediating
+    a red (or repeatedly slow) CI check during delivery (the root-cause-only
+    triage decision tree, the never-rerun / never-quarantine prohibitions,
+    and the escalation criteria).
   - [`rules/api-conventions.md`](rules/api-conventions.md),
     [`rules/gherkin-standards.md`](rules/gherkin-standards.md),
     [`rules/changelog-style.md`](rules/changelog-style.md),

package/.agents/rules/ci-remediation.md

@@ -0,0 +1,131 @@
+# CI Failure Triage & Remediation
+
+This rule applies when a delivery path is watching a pull request's CI checks
+and a required check is red (or repeatedly slow) — the Epic Phase 8
+watch-and-iterate loop
+([`deliver-epic.md`](../workflows/helpers/deliver-epic.md)) and the standalone
+single-Story Step 4 CI watch + fix loop
+([`single-story-deliver.md`](../workflows/helpers/single-story-deliver.md))
+both hand off to it. It is the single triage brain those mechanisms defer to:
+the watcher (`pr-watch-with-update.js`) surfaces the failing check, the run
+link, and the failure signature; this rule decides what to do next.
+
+The animating principle: **a red check is a defect until proven otherwise, and
+the fix is always to remove the defect — never to hide it.** There is no
+rerun-the-failed-job path and no quarantine path in this rule, by design.
+Reruns and quarantines mask defects; a flaky test that passes on the second
+attempt is still a bug that will fail a future run for a real user or a future
+delivery. Root-cause it or file it — never re-roll the dice.
+
+## The triage decision tree
+
+When a required check goes red, walk this tree top to bottom. Do **not** skip
+to "fix" before you have classified the failure — an unclassified fix is a
+guess.
+
+### 1. Pull the evidence
+
+Fetch the failing job log and record the failure signature (the failing check
+name, the run id / run link, and the first distinctive error line). The
+watcher already writes this to `temp/epic-<epicId>-ci-digest.{json,md}` (Epic
+path) or surfaces it inline (standalone path) — start from that digest.
+
+### 2. Classify the failure
+
+- **Deterministic (real) failure** — the check fails the same way every time,
+  and the failure is caused by the diff under review (a lint violation, a
+  broken test, a coverage regression, a baseline drift the diff genuinely
+  caused). → Go to [§ Real failures](#real-failures--route-to-the-per-check-fix-table).
+- **Infra / transient failure** — a runner died, a network fetch timed out, a
+  dependency registry 5xx'd, a step hit a platform-conditional path. → Go to
+  [§ Infra, transient, and flaky failures](#infra-transient-and-flaky-failures-are-root-cause-defects).
+- **Flaky failure** — the check fails intermittently: green on one run, red on
+  the next, with **no diff change** between them (order-dependent tests,
+  timing/race assertions, shared-state bleed, wall-clock or timezone
+  assumptions). → Go to
+  [§ Infra, transient, and flaky failures](#infra-transient-and-flaky-failures-are-root-cause-defects).
+
+## Real failures — route to the per-check fix table
+
+A deterministic failure caused by the diff is remediated at source. Use the
+existing per-check fix table — do **not** duplicate it here:
+
+- **Epic Phase 8**:
+  [`deliver-epic-reference.md` § Phase 8 — Watch-and-iterate remediation](../workflows/helpers/deliver-epic-reference.md#phase-8--watch-and-iterate-remediation)
+  (§ 8.1 Remediation).
+- **Standalone Step 4**:
+  [`single-story-deliver-reference.md` § Step 4 — CI watch + fix recovery](../workflows/helpers/single-story-deliver-reference.md#step-4--ci-watch--fix-recovery).
+
+In short: lint/format → `npm run lint` + biome apply; maintainability/crap
+baseline drift → re-run the ratcheted script and fix at source (refresh a
+baseline only when the diff demonstrably can't be covered); test failure →
+reproduce with `npm test`, fix source or test; coverage threshold → add tests.
+Commit the fix on the delivery branch (`epic/<epicId>` or `story-<storyId>`),
+push, and re-run the watcher. Auto-merge stays armed across retries.
+
+## Infra, transient, and flaky failures ARE root-cause defects
+
+Treat every infra/transient failure **and** every flaky failure as a
+root-cause defect. The remediation sequence is the same for both — you do not
+get to wave it off because "CI was flaky."
+
+1. **Reproduce.** Run the failing check locally (or in a clean environment as
+   close to CI as you can get). Re-run it enough times to observe the
+   intermittency for a flaky failure. If you cannot reproduce it at all after a
+   genuine attempt, that itself is a finding — record it in the issue you file
+   in step 4.
+2. **Check whether it also fails on `main`.** Run the same check against an
+   unmodified `main` (or the Epic base branch) checkout. If it fails on `main`
+   too, the defect is **pre-existing** — it is not caused by the diff under
+   review, and the fix belongs in a separate change, not silently folded into
+   this delivery.
+3. **Bisect environment vs. code.** Determine whether the failure is driven by
+   the environment (runner OS, Node version, concurrency, a platform-
+   conditional branch, an external service) or by the code (an
+   order-dependent test, a race, a shared-state assumption). This tells you
+   where the fix has to land.
+4. **Then either fix in-scope OR file the defect.**
+   - **Fix in-scope** when the root cause is within this delivery's footprint
+     and the fix is a cohesive part of the change under review (e.g. a race in
+     a test the diff touches, a timezone assumption in code the Story owns).
+     Commit it on the delivery branch, push, and re-run the watcher.
+   - **File a `meta::framework-gap` issue** when the root cause is outside this
+     delivery's scope — a pre-existing flaky test, a runner/infra weakness, a
+     framework-level environment gap. Open the issue with the
+     `meta::framework-gap` label (see
+     [`git-conventions.md` § `meta::framework-gap`](git-conventions.md)),
+     and include **the run link and the failure signature** (failing check,
+     run id, first distinctive error line) captured in step 1 so a later
+     `/plan` Phase 0 sweep can act on it. Then remediate this delivery only if
+     the pre-existing defect is genuinely blocking it; otherwise proceed once
+     the defect is filed and the check is not caused by your diff.
+
+**There is no shortcut.** You may **not** re-run the failed job to "see if it
+goes green," and you may **not** quarantine, skip, or `.only`/`.skip` a flaky
+test to get a green bar. Both mask the defect and are prohibited by this rule.
+
+## Escalation criteria
+
+Escalate — flip the ticket to `agent::blocked`, post a `friction` comment, and
+hand back to the operator — under **any** of the following. These extend the
+existing three-strikes halt rule; they do not replace it.
+
+- **Three strikes (existing).** Three consecutive remediation iterations on the
+  same failure class without convergence. Stop; the diagnosis is likely wrong
+  (see [`instructions.md` § 1.I Anti-Thrashing](../instructions.md)).
+- **Wall-clock timebox.** Regardless of iteration count, if you have spent more
+  than **30 minutes of active remediation** on a single CI failure without a
+  green bar in sight, stop and escalate. A long grind on one red check is
+  itself a signal that the failure exceeds a single delivery turn's judgment.
+- **Clearly-environmental → escalate immediately (fast path).** When the
+  failure is unambiguously environmental and outside your control — a runner
+  provisioning failure, a persistent registry/network outage, a
+  branch-protection or CI-configuration misconfiguration, an expired
+  credential — do **not** burn iterations trying to code around it. File the
+  `meta::framework-gap` issue (with run link + signature) and escalate on the
+  first encounter. This fast path exists so an operator-side or infra-side
+  problem reaches the operator immediately instead of consuming the turn.
+
+When you escalate, name the failing check, the run link, the failure
+signature, the classification you reached, and what you tried — never fall
+silent.

package/.agents/rules/testing-standards.md

@@ -161,6 +161,20 @@ assertions into a single "kitchen sink" test — split them.
 - Coverage targets apply to production code. Test helpers, fixtures, and
   generated code are excluded per the project's coverage config.
 
+## Anti-Gaming (review-side complement)
+
+These standards define what a *correct* test looks like; they cannot, on
+their own, catch a change that reaches green by **weakening the check rather
+than fixing the code** — a relaxed assertion, a skipped or deleted test, a
+swallowed error, a stub return, a fake rename, or a warning silenced by
+comment deletion. That shortcut taxonomy is enumerated, and the reviewer-facing
+detection lens for it lives, in the **Anti-Gaming / Shortcut Detection** pillar
+(Pillar 4) of
+[`../workflows/helpers/code-review.md`](../workflows/helpers/code-review.md#pillar-4-anti-gaming--shortcut-detection).
+When you loosen a matcher, quarantine a test, or remove coverage, record the
+spec-sanctioned rationale in the commit body or Story comment so that pillar
+reads it as a deliberate decision rather than gaming.
+
 ## Property-Based Testing (a technique, not a tier)
 
 Property-based testing is a **technique** — generating a domain of inputs and

package/.agents/schemas/agentrc.schema.json

@@ -339,15 +339,10 @@
           "minimum": 1,
           "description": "File-count hard ceiling: a Story exceeding it is rejected unless it declares `wide` with a reason (default 30)."
         },
-        "maxAcceptance": {
-          "type": "integer",
-          "minimum": 1,
-          "description": "Hard ceiling on acceptance[] item count (default 14)."
-        },
         "softAcceptanceCount": {
           "type": "integer",
           "minimum": 1,
-          "description": "Soft-warn threshold on acceptance[] item count (default 10)."
+          "description": "Soft-warn threshold on acceptance[] item count (default 10). Acceptance mass is advisory-only — there is no hard acceptance ceiling."
         },
         "mergeCandidateMaxFiles": {
           "type": "integer",
@@ -1421,6 +1416,34 @@
             "skipForStoryPushes": {
               "type": "boolean",
               "description": "Story #2899 (Epic #2880, F13). When true (default), pre-push tooling appends a '[skip ci]' trailer to Story-branch commit subjects so intermediate pushes do not stampede the CI fleet. The Epic-branch merge commit produced by story-close.js never carries the marker, regardless of this flag."
+            },
+            "earlyPr": {
+              "type": "boolean",
+              "description": "Story #4356 (Epic #4355). When true (default), /deliver opens the Epic PR early — before every Story merges — so CI starts warming while later waves run. Set false to defer PR creation until the Epic branch is complete."
+            },
+            "watch": {
+              "type": "object",
+              "description": "Story #4356 (Epic #4355). Poll-loop tuning for the merge/CI watch. pollIntervalMs is the cadence between check probes; maxPolls caps total probes before the watcher gives up; maxResumes caps how many times the watcher may resume after a transient stall.",
+              "properties": {
+                "pollIntervalMs": {
+                  "type": "integer",
+                  "minimum": 1
+                },
+                "maxPolls": {
+                  "type": "integer",
+                  "minimum": 1
+                },
+                "maxResumes": {
+                  "type": "integer",
+                  "minimum": 0
+                }
+              },
+              "additionalProperties": false
+            },
+            "autoMerge": {
+              "type": "string",
+              "enum": ["trust-ci", "strict"],
+              "description": "Story #4356 (Epic #4355). Merge posture. 'trust-ci' (default) merges once required checks pass; 'strict' additionally requires a clean review gate."
             }
           },
           "additionalProperties": false

package/.agents/schemas/lifecycle/epic.watch.end.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/dsj1984/mandrel/blob/main/.agents/schemas/lifecycle/epic.watch.end.schema.json",
   "title": "epic.watch.end",
-  "description": "Emitted by Watcher when required checks settle. checkOutcomes maps check-name → terminal state (success | failure | timed_out | skipped). AutomergePredicate subscribes to this event (test-only Watcher path; the production Phase 8.5 boundary is epic.automerge.start).",
+  "description": "Emitted by Watcher when required checks settle. checkOutcomes maps check-name → terminal state (success | failure | timed_out | skipped) or the slow-but-not-failed sentinel `still-running` (Story #4358: the poll cap fired with the check still pending after the resume budget was exhausted — distinct from a genuine `failure`). AutomergePredicate subscribes to this event (test-only Watcher path; the production Phase 8.5 boundary is epic.automerge.start).",
   "type": "object",
   "required": ["prUrl", "checkOutcomes"],
   "properties": {
@@ -17,6 +17,7 @@
           "neutral",
           "cancelled",
           "timed_out",
+          "still-running",
           "action_required",
           "stale",
           "skipped"

package/.agents/scripts/git-pr-quality-gate.js

@@ -2,7 +2,7 @@
 /* node:coverage ignore file -- top-level CLI gate; spawns lint/format/test and asserts exit codes — heavy mocking would assert only mock structure */
 
 /**
- * git-pr-quality-gate.js — Lint / format / test gate for `/git-merge-pr`.
+ * git-pr-quality-gate.js — Lint / test / baselines gate for `/git-merge-pr`.
  *
  * `/git-merge-pr` Steps 3–4 previously hardcoded the command sequence
  * (`npm run lint`, `npm run format:check`, `npm test`) in the workflow
@@ -11,10 +11,12 @@
  * skill every time.
  *
  * This script runs the gate and emits a structured result so the .md routes
- * on outcome rather than re-implementing the command sequence. The three
- * checks it runs are read from
+ * on outcome rather than re-implementing the command sequence. The checks it
+ * runs are read from
  * `.agentrc.json → github.branchProtection.requiredChecks` when present,
- * falling back to the hardcoded default trio.
+ * falling back to the hardcoded default trio, which mirrors the live required
+ * check set (`lint`, `test`, `baselines` — Story #4356, Epic #4355; the stale
+ * `lifecycle-doc-drift` check was pruned in the same slice).
  *
  * Usage:
  *   node .agents/scripts/git-pr-quality-gate.js [--json] [--skip <name>[,<name>]]
@@ -48,8 +50,8 @@ import { Logger } from './lib/Logger.js';
  */
 export const DEFAULT_CHECKS = Object.freeze([
   { name: 'lint', cmd: ['npm', 'run', 'lint'] },
-  { name: 'format:check', cmd: ['npm', 'run', 'format:check'] },
   { name: 'test', cmd: ['npm', 'test'] },
+  { name: 'baselines', cmd: ['node', '.agents/scripts/check-baselines.js'] },
 ]);
 
 function resolveChecks(config) {

package/.agents/scripts/lib/config/ci.js

@@ -1,23 +1,34 @@
 /**
- * `delivery.ci` accessor + framework defaults — Story #2899 (Epic #2880, F13).
+ * `delivery.ci` accessor + framework defaults — Story #2899 (Epic #2880, F13)
+ * and Story #4356 (Epic #4355).
  *
  * `delivery.ci.skipForStoryPushes` defaults to `true` so per-Task Story-branch
  * commits append a `[skip ci]` trailer out of the box. The Epic-branch merge
  * commit produced by `story-close.js`'s merge runner never carries the
  * marker — that path is the one consumers actually want CI to evaluate.
+ *
+ * Story #4356 adds the CI-aware delivery knobs: `earlyPr` (default `true`)
+ * gates whether /deliver opens the Epic PR early so CI warms while later
+ * waves run; `watch` tunes the merge/CI watch poll loop; and `autoMerge`
+ * (default `"trust-ci"`) selects the merge posture — `"trust-ci"` merges once
+ * required checks pass, `"strict"` additionally requires a clean review gate.
  */
 
 export const CI_DELIVERY_DEFAULTS = Object.freeze({
   skipForStoryPushes: true,
+  earlyPr: true,
+  autoMerge: 'trust-ci',
 });
 
 /**
  * Read the merged `delivery.ci` block, applying framework defaults for any
  * field the operator omitted. Accepts the full resolved config, the bare
- * delivery bag, or the bare ci bag.
+ * delivery bag, or the bare ci bag. The `watch` sub-block is passed through
+ * as-is (undefined when unset) so consumers apply their own poll-loop
+ * defaults; only the scalar knobs carry framework defaults here.
  *
  * @param {object | null | undefined} config
- * @returns {typeof CI_DELIVERY_DEFAULTS}
+ * @returns {{ skipForStoryPushes: boolean, earlyPr: boolean, autoMerge: 'trust-ci' | 'strict', watch: object | undefined }}
  */
 export function getCiDelivery(config) {
   const ci = config?.delivery?.ci ?? config?.ci ?? config ?? {};
@@ -26,5 +37,15 @@ export function getCiDelivery(config) {
       typeof ci.skipForStoryPushes === 'boolean'
         ? ci.skipForStoryPushes
         : CI_DELIVERY_DEFAULTS.skipForStoryPushes,
+    earlyPr:
+      typeof ci.earlyPr === 'boolean'
+        ? ci.earlyPr
+        : CI_DELIVERY_DEFAULTS.earlyPr,
+    autoMerge:
+      ci.autoMerge === 'trust-ci' || ci.autoMerge === 'strict'
+        ? ci.autoMerge
+        : CI_DELIVERY_DEFAULTS.autoMerge,
+    watch:
+      ci.watch && typeof ci.watch === 'object' ? { ...ci.watch } : undefined,
   };
 }

package/.agents/scripts/lib/config/explain.js

@@ -126,10 +126,8 @@ const KEY_MEANINGS = Object.freeze({
     'How many recent commits the snapshot summarizes.',
   'planning.riskHeuristics':
     'Phrases that flag a Story as high-risk for HITL escalation.',
-  'planning.taskSizing.maxAcceptance':
-    'Hard ceiling on acceptance criteria per Story.',
   'planning.taskSizing.softAcceptanceCount':
-    'Acceptance-criteria count above which a Story is flagged as large.',
+    'Acceptance-criteria count above which a Story is flagged as large (advisory-only — there is no hard acceptance ceiling).',
   'planning.taskSizing.softFiles':
     'Touched-file count above which a Story is flagged as large.',
   'planning.taskSizing.hardFiles':
@@ -148,6 +146,16 @@ const KEY_MEANINGS = Object.freeze({
     'Time-to-live for the Epic lease before a stale claim is reclaimable.',
   'delivery.ci.skipForStoryPushes':
     'Whether Story-branch pushes carry a [skip ci] trailer.',
+  'delivery.ci.earlyPr':
+    'Whether /deliver opens the Epic PR early so CI warms during later waves.',
+  'delivery.ci.watch.pollIntervalMs':
+    'Poll cadence (ms) for the merge/CI watch loop.',
+  'delivery.ci.watch.maxPolls':
+    'Maximum number of poll probes before the CI watch gives up.',
+  'delivery.ci.watch.maxResumes':
+    'Maximum times the CI watch may resume after a transient stall.',
+  'delivery.ci.autoMerge':
+    'Merge posture: trust-ci merges on green checks; strict also requires a clean review gate.',
   'delivery.preflight.maxStories':
     'Pre-dispatch ceiling on estimated Story count (no cap when unset).',
   'delivery.preflight.maxWaves':

package/.agents/scripts/lib/config/github.js

@@ -13,23 +13,27 @@
  */
 
 /**
- * Default required-check suite. The framework runs lint + format:check +
- * test by default; consumers override via
- * `github.branchProtection.requiredChecks` in `.agentrc.json`.
+ * Default required-check suite. Mirrors the live CI required-check set
+ * (`lint` + `test` + `baselines`); consumers override via
+ * `github.branchProtection.requiredChecks` in `.agentrc.json`. Kept in sync
+ * with `DEFAULT_CHECKS` in `git-pr-quality-gate.js` and the CI job names in
+ * `.github/workflows/ci.yml` — the retired `format:check` folded into `lint`
+ * (Story #1829) and `lifecycle-doc-drift` collapsed into `lint`/`docs:check`
+ * (Epic #1943), so neither belongs in the default set.
  */
 export const DEFAULT_REQUIRED_CHECKS = Object.freeze([
   Object.freeze({
     name: 'lint',
     cmd: Object.freeze(['npm', 'run', 'lint']),
   }),
-  Object.freeze({
-    name: 'format:check',
-    cmd: Object.freeze(['npm', 'run', 'format:check']),
-  }),
   Object.freeze({
     name: 'test',
     cmd: Object.freeze(['npm', 'test']),
   }),
+  Object.freeze({
+    name: 'baselines',
+    cmd: Object.freeze(['node', '.agents/scripts/check-baselines.js']),
+  }),
 ]);
 
 export const BRANCH_PROTECTION_DEFAULTS = Object.freeze({

package/.agents/scripts/lib/config-settings-schema-delivery.js

@@ -226,10 +226,31 @@ const EPIC_AUDIT_SCHEMA = {
 // commit subjects so intermediate pushes do not stampede the CI fleet.
 // The Epic-branch merge commit produced by story-close.js's merge
 // runner never carries the marker, regardless of this flag.
+//
+// Story #4356 (Epic #4355) — CI-aware delivery namespace. `earlyPr` gates
+// whether /deliver opens the Epic PR early (before every Story merges) so CI
+// starts warming while later waves run; defaults to `true` via getCiDelivery.
+// `watch.*` tunes the merge/CI watch poll loop (poll cadence, poll cap, and
+// how many times the watcher may resume after a transient stall).
+// `autoMerge` selects the merge posture: `"trust-ci"` (default) merges once
+// required checks pass, `"strict"` additionally requires a clean review gate.
+const CI_WATCH_SCHEMA = {
+  type: 'object',
+  properties: {
+    pollIntervalMs: { type: 'integer', minimum: 1 },
+    maxPolls: { type: 'integer', minimum: 1 },
+    maxResumes: { type: 'integer', minimum: 0 },
+  },
+  additionalProperties: false,
+};
+
 const CI_DELIVERY_SCHEMA = {
   type: 'object',
   properties: {
     skipForStoryPushes: { type: 'boolean' },
+    earlyPr: { type: 'boolean' },
+    watch: CI_WATCH_SCHEMA,
+    autoMerge: { type: 'string', enum: ['trust-ci', 'strict'] },
   },
   additionalProperties: false,
 };

package/.agents/scripts/lib/config-settings-schema.js

@@ -250,18 +250,18 @@ const CODEBASE_SNAPSHOT_SCHEMA = {
  * `planning.taskSizing` — Story-sizing thresholds consumed by
  * `ticket-validator-sizing.js`. Operator overrides shallow-merge with
  * `DEFAULT_TASK_SIZING` defaults (softFiles 15, hardFiles 30,
- * maxAcceptance 14, softAcceptanceCount 10 — the uniform relaxed profile
- * from Story #3874). Story #3760 collapsed the per-profile matrix and the
- * parallel `testSurface` axis into a flat set of knobs; the `sizingProfile`
- * enum was replaced by an optional body-level `wide` declaration that lifts
- * the `hardFiles` rejection.
+ * softAcceptanceCount 10 — the uniform relaxed profile from Story #3874).
+ * Story #3760 collapsed the per-profile matrix and the parallel
+ * `testSurface` axis into a flat set of knobs; the `sizingProfile` enum was
+ * replaced by an optional body-level `wide` declaration that lifts the
+ * `hardFiles` rejection. The hard `maxAcceptance` ceiling was removed after
+ * the Epic #4355 decomposition experiment — acceptance mass is advisory-only.
  */
 const TASK_SIZING_SCHEMA = {
   type: 'object',
   properties: {
     softFiles: { type: 'integer', minimum: 1 },
     hardFiles: { type: 'integer', minimum: 1 },
-    maxAcceptance: { type: 'integer', minimum: 1 },
     softAcceptanceCount: { type: 'integer', minimum: 1 },
     // Under-size (merge-candidate) thresholds (Story #4312). A Story whose
     // footprint is at or below BOTH ceilings and that carries a `depends_on`

package/.agents/scripts/lib/orchestration/finalize/open-or-locate-pr.js

@@ -27,6 +27,20 @@
  * does not attempt to create a duplicate PR. This is the AC-10
  * idempotency contract the Finalizer relies on for cross-process
  * re-runs of `/deliver`.
+ *
+ * Early-PR draft mode — Story #4359 (Epic #4355).
+ *
+ *   When `delivery.ci.earlyPr` is on (the default), `/deliver` opens the
+ *   Epic PR as a **draft** at wave 1 (`openOrLocatePr({ draft: true })`)
+ *   so every subsequent per-wave push runs CI attributed to its own wave.
+ *   The `draft` flag only appends `--draft` to the `gh pr create` shell —
+ *   the probe/locate path is unchanged, so a re-run on the same head
+ *   branch still short-circuits without opening a duplicate. Phase 7 then
+ *   flips that existing draft to ready-for-review via `markPrReady` rather
+ *   than creating the PR. When `earlyPr` is off, no draft is opened at
+ *   wave 1 and Phase 7 opens the PR at close time exactly as before
+ *   (`openOrLocatePr` with no `draft`). The title/body contract
+ *   (`feat: Epic #<id>` / `Closes #<id>`) is identical in both modes.
  */
 
 import { spawnSync } from 'node:child_process';
@@ -119,6 +133,12 @@ export function parsePrViewResult(stdout) {
  *   or changelog entry).
  * @param {string} [args.body] — explicit PR body override; defaults to
  *   `Closes #<epicId>`.
+ * @param {boolean} [args.draft] — when `true`, open the new PR as a draft
+ *   (`gh pr create --draft`). Story #4359: the early-PR path opens the
+ *   Epic PR as a draft at wave 1 so per-wave pushes warm CI; Phase 7 later
+ *   flips it ready via `markPrReady`. Only affects the create path — the
+ *   locate short-circuit never inspects draft state, so a re-run stays
+ *   idempotent. Default `false`.
  * @param {string} [args.cwd] — working directory for the gh shells.
  *   Default `process.cwd()`.
  * @param {Function} [args.ghSpawn] — override the gh invocation for
@@ -131,6 +151,7 @@ export async function openOrLocatePr({
   baseBranch = 'main',
   title,
   body,
+  draft = false,
   cwd = process.cwd(),
   ghSpawn = defaultGhSpawn,
 } = {}) {
@@ -206,6 +227,11 @@ export async function openOrLocatePr({
       finalTitle,
       '--body',
       finalBody,
+      // Story #4359: open as a draft when the early-PR path requests it.
+      // The flag is elided entirely when `draft` is false so the
+      // close-time (earlyPr=false) create path is byte-identical to the
+      // pre-Story behaviour.
+      ...(draft ? ['--draft'] : []),
     ],
     cwd,
   });
@@ -239,3 +265,42 @@ export async function openOrLocatePr({
   }
   return { prNumber: parsed.number, url: parsed.url, created: true };
 }
+
+/**
+ * Mark an existing draft PR as ready-for-review — Story #4359 (Epic
+ * #4355). This is the Phase-7 counterpart to the wave-1 draft open: when
+ * `delivery.ci.earlyPr` is on, the Epic PR already exists as a draft, so
+ * finalize flips it ready rather than creating a PR.
+ *
+ * Idempotent: `gh pr ready` on an already-ready PR is a no-op that exits
+ * 0, so re-running finalize (or replaying after a crash) is safe. When the
+ * PR reference does not resolve, `gh` exits non-zero and this helper
+ * throws with the stderr detail.
+ *
+ * @param {object} args
+ * @param {string} args.pr — a PR reference `gh pr ready` accepts: the
+ *   numeric id, the branch name, or the html URL. `openOrLocatePr`
+ *   returns both `prNumber` and `url`; either is a valid input.
+ * @param {string} [args.cwd] — working directory for the gh shell.
+ *   Default `process.cwd()`.
+ * @param {Function} [args.ghSpawn] — override the gh invocation for
+ *   tests. Same shape as `defaultGhSpawn`.
+ * @returns {Promise<{ pr: string, ready: true }>}
+ */
+export async function markPrReady({
+  pr,
+  cwd = process.cwd(),
+  ghSpawn = defaultGhSpawn,
+} = {}) {
+  const ref = pr == null ? '' : String(pr).trim();
+  if (ref.length === 0) {
+    throw new TypeError('markPrReady: pr must be a non-empty reference');
+  }
+  const ready = ghSpawn({ args: ['pr', 'ready', ref], cwd });
+  if (ready.status !== 0) {
+    throw new Error(
+      `markPrReady: gh pr ready failed (status=${ready.status}): ${ready.stderr.trim()}`,
+    );
+  }
+  return { pr: ref, ready: true };
+}