mandrel 1.84.0 → 1.86.0

package/.agents/docs/agentrc-reference.json

@@ -92,7 +92,6 @@
     "taskSizing": {
       "softFiles": 15,
       "hardFiles": 30,
-      "maxAcceptance": 14,
       "softAcceptanceCount": 10
     }
   },
@@ -101,7 +100,14 @@
     "maxTokenBudget": 300000,
     "lease": { "ttlMs": 900000 },
     "ci": {
-      "skipForStoryPushes": true
+      "skipForStoryPushes": true,
+      "earlyPr": true,
+      "watch": {
+        "pollIntervalMs": 30000,
+        "maxPolls": 120,
+        "maxResumes": 3
+      },
+      "autoMerge": "trust-ci"
     },
     "preflight": {
       "maxStories": 50,

package/.agents/docs/configuration.md

@@ -108,8 +108,7 @@ top-level keys are validation errors.
 | `taskSizing` | No | `object` | — | Story-sizing thresholds consumed by ticket-validator-sizing.js. Operator overrides shallow-merge with DEFAULT_TASK_SIZING defaults. Story #3760 collapsed the per-profile matrix and the parallel testSurface axis into a flat set of knobs; the sizingProfile enum was replaced by an optional body-level `wide` declaration that lifts the hardFiles rejection. Story #3874 cut over to one uniform relaxed profile sized for capability slices a frontier model delivers and self-verifies in one pass. |
 | `taskSizing.softFiles` | No | `integer` | — | File-count soft-warn threshold above which a typical-Story width finding fires (default 15). |
 | `taskSizing.hardFiles` | No | `integer` | — | File-count hard ceiling: a Story exceeding it is rejected unless it declares `wide` with a reason (default 30). |
-| `taskSizing.maxAcceptance` | No | `integer` | — | Hard ceiling on acceptance[] item count (default 14). |
-| `taskSizing.softAcceptanceCount` | No | `integer` | — | Soft-warn threshold on acceptance[] item count (default 10). |
+| `taskSizing.softAcceptanceCount` | No | `integer` | — | Soft-warn threshold on acceptance[] item count (default 10). Acceptance mass is advisory-only — there is no hard acceptance ceiling. |
 | `taskSizing.mergeCandidateMaxFiles` | No | `integer` | — | Under-size threshold (Story #4312): a Story with at most this many declared changes[] files, at most mergeCandidateMaxAcceptance acceptance items, and at least one depends_on edge to a sibling trips the advisory `merge-candidate` soft finding (default 3). |
 | `taskSizing.mergeCandidateMaxAcceptance` | No | `integer` | — | Under-size threshold (Story #4312): the acceptance[] item ceiling of the `merge-candidate` soft finding heuristic (default 4). |
 | `failOnSharedEditors` | No | `boolean` | — | — |
@@ -293,6 +292,12 @@ top-level keys are validation errors.
 | `acceptanceEval.maxRounds` | No | `integer` | — | Maximum number of redraft rounds before escalation. Default 2; clamped into [1, hard ceiling] by lib/config/acceptance-eval.js so the cap can never be disabled (maxRounds: 0 clamps up to 1). |
 | `ci` | No | `object` | — | Nested configuration block. |
 | `ci.skipForStoryPushes` | No | `boolean` | — | Story #2899 (Epic #2880, F13). When true (default), pre-push tooling appends a '[skip ci]' trailer to Story-branch commit subjects so intermediate pushes do not stampede the CI fleet. The Epic-branch merge commit produced by story-close.js never carries the marker, regardless of this flag. |
+| `ci.earlyPr` | No | `boolean` | — | Story #4356 (Epic #4355). When true (default), /deliver opens the Epic PR early — before every Story merges — so CI starts warming while later waves run. Set false to defer PR creation until the Epic branch is complete. |
+| `ci.watch` | No | `object` | — | Story #4356 (Epic #4355). Poll-loop tuning for the merge/CI watch. pollIntervalMs is the cadence between check probes; maxPolls caps total probes before the watcher gives up; maxResumes caps how many times the watcher may resume after a transient stall. |
+| `ci.watch.pollIntervalMs` | No | `integer` | — | — |
+| `ci.watch.maxPolls` | No | `integer` | — | — |
+| `ci.watch.maxResumes` | No | `integer` | — | — |
+| `ci.autoMerge` | No | `"trust-ci"` \| `"strict"` | — | Story #4356 (Epic #4355). Merge posture. 'trust-ci' (default) merges once required checks pass; 'strict' additionally requires a clean review gate. |
 | `preflight` | No | `object` | — | Story #2899 (Epic #2880, F13). Thresholds consumed by `.agents/scripts/epic-deliver-preflight.js`. When any value is exceeded the preflight envelope flags a breach and /deliver Phase 1 surfaces it via agent::blocked. |
 | `preflight.maxStories` | No | `integer` | — | — |
 | `preflight.maxWaves` | No | `integer` | — | — |

package/.agents/instructions.md

@@ -110,6 +110,10 @@ does not re-pay their bytes on every turn.
   - [`rules/orchestration-error-handling.md`](rules/orchestration-error-handling.md)
     — before writing or modifying orchestration scripts under
     `.agents/scripts/**`.
+  - [`rules/ci-remediation.md`](rules/ci-remediation.md) — before remediating
+    a red (or repeatedly slow) CI check during delivery (the root-cause-only
+    triage decision tree, the never-rerun / never-quarantine prohibitions,
+    and the escalation criteria).
   - [`rules/api-conventions.md`](rules/api-conventions.md),
     [`rules/gherkin-standards.md`](rules/gherkin-standards.md),
     [`rules/changelog-style.md`](rules/changelog-style.md),

package/.agents/rules/ci-remediation.md

@@ -0,0 +1,131 @@
+# CI Failure Triage & Remediation
+
+This rule applies when a delivery path is watching a pull request's CI checks
+and a required check is red (or repeatedly slow) — the Epic Phase 8
+watch-and-iterate loop
+([`deliver-epic.md`](../workflows/helpers/deliver-epic.md)) and the standalone
+single-Story Step 4 CI watch + fix loop
+([`single-story-deliver.md`](../workflows/helpers/single-story-deliver.md))
+both hand off to it. It is the single triage brain those mechanisms defer to:
+the watcher (`pr-watch-with-update.js`) surfaces the failing check, the run
+link, and the failure signature; this rule decides what to do next.
+
+The animating principle: **a red check is a defect until proven otherwise, and
+the fix is always to remove the defect — never to hide it.** There is no
+rerun-the-failed-job path and no quarantine path in this rule, by design.
+Reruns and quarantines mask defects; a flaky test that passes on the second
+attempt is still a bug that will fail a future run for a real user or a future
+delivery. Root-cause it or file it — never re-roll the dice.
+
+## The triage decision tree
+
+When a required check goes red, walk this tree top to bottom. Do **not** skip
+to "fix" before you have classified the failure — an unclassified fix is a
+guess.
+
+### 1. Pull the evidence
+
+Fetch the failing job log and record the failure signature (the failing check
+name, the run id / run link, and the first distinctive error line). The
+watcher already writes this to `temp/epic-<epicId>-ci-digest.{json,md}` (Epic
+path) or surfaces it inline (standalone path) — start from that digest.
+
+### 2. Classify the failure
+
+- **Deterministic (real) failure** — the check fails the same way every time,
+  and the failure is caused by the diff under review (a lint violation, a
+  broken test, a coverage regression, a baseline drift the diff genuinely
+  caused). → Go to [§ Real failures](#real-failures--route-to-the-per-check-fix-table).
+- **Infra / transient failure** — a runner died, a network fetch timed out, a
+  dependency registry 5xx'd, a step hit a platform-conditional path. → Go to
+  [§ Infra, transient, and flaky failures](#infra-transient-and-flaky-failures-are-root-cause-defects).
+- **Flaky failure** — the check fails intermittently: green on one run, red on
+  the next, with **no diff change** between them (order-dependent tests,
+  timing/race assertions, shared-state bleed, wall-clock or timezone
+  assumptions). → Go to
+  [§ Infra, transient, and flaky failures](#infra-transient-and-flaky-failures-are-root-cause-defects).
+
+## Real failures — route to the per-check fix table
+
+A deterministic failure caused by the diff is remediated at source. Use the
+existing per-check fix table — do **not** duplicate it here:
+
+- **Epic Phase 8**:
+  [`deliver-epic-reference.md` § Phase 8 — Watch-and-iterate remediation](../workflows/helpers/deliver-epic-reference.md#phase-8--watch-and-iterate-remediation)
+  (§ 8.1 Remediation).
+- **Standalone Step 4**:
+  [`single-story-deliver-reference.md` § Step 4 — CI watch + fix recovery](../workflows/helpers/single-story-deliver-reference.md#step-4--ci-watch--fix-recovery).
+
+In short: lint/format → `npm run lint` + biome apply; maintainability/crap
+baseline drift → re-run the ratcheted script and fix at source (refresh a
+baseline only when the diff demonstrably can't be covered); test failure →
+reproduce with `npm test`, fix source or test; coverage threshold → add tests.
+Commit the fix on the delivery branch (`epic/<epicId>` or `story-<storyId>`),
+push, and re-run the watcher. Auto-merge stays armed across retries.
+
+## Infra, transient, and flaky failures ARE root-cause defects
+
+Treat every infra/transient failure **and** every flaky failure as a
+root-cause defect. The remediation sequence is the same for both — you do not
+get to wave it off because "CI was flaky."
+
+1. **Reproduce.** Run the failing check locally (or in a clean environment as
+   close to CI as you can get). Re-run it enough times to observe the
+   intermittency for a flaky failure. If you cannot reproduce it at all after a
+   genuine attempt, that itself is a finding — record it in the issue you file
+   in step 4.
+2. **Check whether it also fails on `main`.** Run the same check against an
+   unmodified `main` (or the Epic base branch) checkout. If it fails on `main`
+   too, the defect is **pre-existing** — it is not caused by the diff under
+   review, and the fix belongs in a separate change, not silently folded into
+   this delivery.
+3. **Bisect environment vs. code.** Determine whether the failure is driven by
+   the environment (runner OS, Node version, concurrency, a platform-
+   conditional branch, an external service) or by the code (an
+   order-dependent test, a race, a shared-state assumption). This tells you
+   where the fix has to land.
+4. **Then either fix in-scope OR file the defect.**
+   - **Fix in-scope** when the root cause is within this delivery's footprint
+     and the fix is a cohesive part of the change under review (e.g. a race in
+     a test the diff touches, a timezone assumption in code the Story owns).
+     Commit it on the delivery branch, push, and re-run the watcher.
+   - **File a `meta::framework-gap` issue** when the root cause is outside this
+     delivery's scope — a pre-existing flaky test, a runner/infra weakness, a
+     framework-level environment gap. Open the issue with the
+     `meta::framework-gap` label (see
+     [`git-conventions.md` § `meta::framework-gap`](git-conventions.md)),
+     and include **the run link and the failure signature** (failing check,
+     run id, first distinctive error line) captured in step 1 so a later
+     `/plan` Phase 0 sweep can act on it. Then remediate this delivery only if
+     the pre-existing defect is genuinely blocking it; otherwise proceed once
+     the defect is filed and the check is not caused by your diff.
+
+**There is no shortcut.** You may **not** re-run the failed job to "see if it
+goes green," and you may **not** quarantine, skip, or `.only`/`.skip` a flaky
+test to get a green bar. Both mask the defect and are prohibited by this rule.
+
+## Escalation criteria
+
+Escalate — flip the ticket to `agent::blocked`, post a `friction` comment, and
+hand back to the operator — under **any** of the following. These extend the
+existing three-strikes halt rule; they do not replace it.
+
+- **Three strikes (existing).** Three consecutive remediation iterations on the
+  same failure class without convergence. Stop; the diagnosis is likely wrong
+  (see [`instructions.md` § 1.I Anti-Thrashing](../instructions.md)).
+- **Wall-clock timebox.** Regardless of iteration count, if you have spent more
+  than **30 minutes of active remediation** on a single CI failure without a
+  green bar in sight, stop and escalate. A long grind on one red check is
+  itself a signal that the failure exceeds a single delivery turn's judgment.
+- **Clearly-environmental → escalate immediately (fast path).** When the
+  failure is unambiguously environmental and outside your control — a runner
+  provisioning failure, a persistent registry/network outage, a
+  branch-protection or CI-configuration misconfiguration, an expired
+  credential — do **not** burn iterations trying to code around it. File the
+  `meta::framework-gap` issue (with run link + signature) and escalate on the
+  first encounter. This fast path exists so an operator-side or infra-side
+  problem reaches the operator immediately instead of consuming the turn.
+
+When you escalate, name the failing check, the run link, the failure
+signature, the classification you reached, and what you tried — never fall
+silent.

package/.agents/rules/git-conventions.md

@@ -120,6 +120,39 @@ rejected by `pre-push` hooks):
       (`--no-errors-on-unmatched` or equivalent) before escalating via
       `agent::blocked`.
 
+## Local checkout hygiene
+
+**Invariant: the delivering flow owns tidying the local checkout — reaping its
+own merged refs and fast-forwarding the base branch. `/git-cleanup` is a
+recovery tool, not a routine chore.**
+
+Every flow that lands work — `/deliver` (Epic and standalone-Story paths),
+`/git-deliver` — is responsible for leaving the local checkout tidy without
+operator intervention:
+
+- **Fast-forwarding the base branch is owned by the flow.** The standalone
+  multi-Story path fast-forwards `main` itself in its summary phase (via
+  `git-cleanup.js --fast-forward-main --execute --yes`); the Epic path
+  fast-forwards `epic/<id>` / `main` on its merge-and-reap beat. No workflow
+  ends by telling the operator to "run `/git-cleanup` afterwards to catch up".
+- **Reaping merged local refs is owned by the flow's next boot.** `/plan` and
+  `/git-deliver` open with a **protected boot sweep**
+  (`boot-sweep.js`) that fast-forwards `main`, prunes stale remote-tracking
+  refs, and reaps every local branch whose PR is already merged — skipping any
+  candidate with unpushed work, a dirty worktree, or a still-open parent
+  ticket. A branch a flow leaves behind (e.g. a `/git-deliver` feature branch
+  whose PR merges out of band) is therefore reaped automatically at the next
+  workflow boot, not left for the operator to sweep by hand.
+- **`/git-cleanup` is recovery, not routine.** Run it by hand only to recover
+  an unusual state the automated hygiene does not cover — triaging stashes,
+  reaping across non-standard branch namespaces, or `--remote` pruning after a
+  force-push diverged a tip. It is **not** the expected way to keep `main`
+  current or to clear merged branches after a normal delivery; the delivering
+  flows already own that. If you find yourself reaching for `/git-cleanup`
+  after every routine `/deliver` or `/git-deliver` run, that is a signal the
+  owning flow's hygiene step regressed — fix the flow, do not codify the manual
+  sweep.
+
 ## Meta Labels (Retrospective Signal Routing)
 
 Two `meta::*` labels route retrospective signals into durable substrates so

package/.agents/schemas/agentrc.schema.json

@@ -339,15 +339,10 @@
           "minimum": 1,
           "description": "File-count hard ceiling: a Story exceeding it is rejected unless it declares `wide` with a reason (default 30)."
         },
-        "maxAcceptance": {
-          "type": "integer",
-          "minimum": 1,
-          "description": "Hard ceiling on acceptance[] item count (default 14)."
-        },
         "softAcceptanceCount": {
           "type": "integer",
           "minimum": 1,
-          "description": "Soft-warn threshold on acceptance[] item count (default 10)."
+          "description": "Soft-warn threshold on acceptance[] item count (default 10). Acceptance mass is advisory-only — there is no hard acceptance ceiling."
         },
         "mergeCandidateMaxFiles": {
           "type": "integer",
@@ -1421,6 +1416,34 @@
             "skipForStoryPushes": {
               "type": "boolean",
               "description": "Story #2899 (Epic #2880, F13). When true (default), pre-push tooling appends a '[skip ci]' trailer to Story-branch commit subjects so intermediate pushes do not stampede the CI fleet. The Epic-branch merge commit produced by story-close.js never carries the marker, regardless of this flag."
+            },
+            "earlyPr": {
+              "type": "boolean",
+              "description": "Story #4356 (Epic #4355). When true (default), /deliver opens the Epic PR early — before every Story merges — so CI starts warming while later waves run. Set false to defer PR creation until the Epic branch is complete."
+            },
+            "watch": {
+              "type": "object",
+              "description": "Story #4356 (Epic #4355). Poll-loop tuning for the merge/CI watch. pollIntervalMs is the cadence between check probes; maxPolls caps total probes before the watcher gives up; maxResumes caps how many times the watcher may resume after a transient stall.",
+              "properties": {
+                "pollIntervalMs": {
+                  "type": "integer",
+                  "minimum": 1
+                },
+                "maxPolls": {
+                  "type": "integer",
+                  "minimum": 1
+                },
+                "maxResumes": {
+                  "type": "integer",
+                  "minimum": 0
+                }
+              },
+              "additionalProperties": false
+            },
+            "autoMerge": {
+              "type": "string",
+              "enum": ["trust-ci", "strict"],
+              "description": "Story #4356 (Epic #4355). Merge posture. 'trust-ci' (default) merges once required checks pass; 'strict' additionally requires a clean review gate."
             }
           },
           "additionalProperties": false

package/.agents/schemas/lifecycle/epic.watch.end.schema.json

@@ -2,7 +2,7 @@
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "https://github.com/dsj1984/mandrel/blob/main/.agents/schemas/lifecycle/epic.watch.end.schema.json",
   "title": "epic.watch.end",
-  "description": "Emitted by Watcher when required checks settle. checkOutcomes maps check-name → terminal state (success | failure | timed_out | skipped). AutomergePredicate subscribes to this event (test-only Watcher path; the production Phase 8.5 boundary is epic.automerge.start).",
+  "description": "Emitted by Watcher when required checks settle. checkOutcomes maps check-name → terminal state (success | failure | timed_out | skipped) or the slow-but-not-failed sentinel `still-running` (Story #4358: the poll cap fired with the check still pending after the resume budget was exhausted — distinct from a genuine `failure`). AutomergePredicate subscribes to this event (test-only Watcher path; the production Phase 8.5 boundary is epic.automerge.start).",
   "type": "object",
   "required": ["prUrl", "checkOutcomes"],
   "properties": {
@@ -17,6 +17,7 @@
           "neutral",
           "cancelled",
           "timed_out",
+          "still-running",
           "action_required",
           "stale",
           "skipped"

package/.agents/scripts/boot-sweep.js

@@ -0,0 +1,183 @@
+#!/usr/bin/env node
+/* node:coverage ignore file */
+
+/**
+ * boot-sweep.js — protected boot-sweep CLI (Story #4373).
+ *
+ * A thin, non-interactive wrapper over the scope-agnostic
+ * [`sweepMergedBranches`](./lib/single-story-sweep.js) engine, exposed so
+ * workflow prose can invoke a *protected* boot sweep directly. Unlike the
+ * plain `git-cleanup.js --branches` phase (which reaps every merged
+ * candidate the planner surfaces), this surface always applies the
+ * `evaluateProtection` partition — a merged branch with unpushed work, a
+ * dirty worktree, or a still-open parent Story ticket is skipped, not
+ * reaped.
+ *
+ * The sweep is best-effort: any failure (lock contention, git/gh error)
+ * is swallowed and reported in the result envelope, never thrown, so a
+ * caller can wire it into a boot path without risking the host run.
+ *
+ * Usage:
+ *   node .agents/scripts/boot-sweep.js [--include <glob>...] \
+ *     [--exclude <glob>...] [--current <branch>] [--base <branch>] \
+ *     [--no-fast-forward] [--json]
+ *
+ * Defaults: `--include story-*`, fast-forward the base branch on.
+ * Exit code is always 0 — a boot sweep never fails its host.
+ */
+
+import path from 'node:path';
+import { parseArgs } from 'node:util';
+
+import { runAsCli } from './lib/cli-utils.js';
+import { PROJECT_ROOT, resolveConfig } from './lib/config-resolver.js';
+import { Logger } from './lib/Logger.js';
+import { createProvider } from './lib/provider-factory.js';
+import { buildProtectionCtx } from './lib/single-story-sweep/protection-ctx.js';
+import { sweepMergedBranches } from './lib/single-story-sweep.js';
+
+const HELP = `Usage: node .agents/scripts/boot-sweep.js [options]
+
+Runs the protected merged-branch boot sweep non-interactively: reaps every
+local branch whose PR is MERGED and whose HEAD matches the merged headRefOid,
+skipping any candidate the protection partition flags (unpushed work, dirty
+worktree, still-open parent Story), then fast-forwards the base branch.
+
+Options:
+  --include <glob>     Branch glob to sweep (repeatable). Default: story-*
+  --exclude <glob>     Branch glob to exclude (repeatable).
+  --current <branch>   A branch to always exclude (e.g. the active story).
+  --base <branch>      Base branch to fast-forward. Default: project baseBranch.
+  --no-fast-forward    Skip the base-branch fast-forward step.
+  --json               Emit the result envelope as JSON.
+`;
+
+/**
+ * Run the protected boot sweep. Best-effort: swallows any error and
+ * returns the sweep envelope so no caller can be blocked by a failure.
+ *
+ * DI-friendly: `injectedConfig` / `injectedProvider` let a caller (e.g.
+ * `epic-deliver-prepare.js`) reuse an already-resolved config + provider,
+ * and `injectedSweep` swaps the engine for unit tests.
+ *
+ * @param {{
+ *   cwd?: string,
+ *   base?: string,
+ *   include?: string[],
+ *   exclude?: string[],
+ *   current?: string,
+ *   fastForward?: boolean,
+ *   injectedConfig?: object,
+ *   injectedProvider?: object,
+ *   injectedSweep?: Function,
+ *   logger?: { info?: Function, warn?: Function },
+ * }} [args]
+ * @returns {Promise<object>} the {@link sweepMergedBranches} envelope.
+ */
+export async function runBootSweep({
+  cwd,
+  base,
+  include,
+  exclude,
+  current,
+  fastForward = true,
+  injectedConfig,
+  injectedProvider,
+  injectedSweep,
+  logger = Logger,
+} = {}) {
+  const root = path.resolve(cwd ?? PROJECT_ROOT);
+  try {
+    // Config/provider resolution is inside the try so a malformed
+    // `.agentrc.json` (or a provider-construction throw) degrades to the
+    // swallowed `ok:false` envelope below rather than propagating and
+    // exiting non-zero — the "host continues, exit 0" boot-sweep contract
+    // must hold even when config resolution is the thing that fails.
+    const config = injectedConfig ?? resolveConfig({ cwd: root });
+    const provider = injectedProvider ?? createProvider(config);
+    const baseBranch = base ?? config.project?.baseBranch ?? 'main';
+
+    const includeGlobs =
+      Array.isArray(include) && include.length > 0 ? include : ['story-*'];
+    const excludeGlobs = Array.isArray(exclude) ? [...exclude] : [];
+    if (typeof current === 'string' && current.length > 0) {
+      excludeGlobs.push(current);
+    }
+
+    const tempRoot = config?.project?.paths?.tempRoot ?? 'temp';
+    const lockPath = path.resolve(root, tempRoot, 'boot-sweep.lock');
+    const lockTimeoutMs =
+      config.delivery?.worktreeIsolation?.sweepLockMs ?? 60_000;
+
+    const sweepFn = injectedSweep ?? sweepMergedBranches;
+    return await sweepFn({
+      cwd: root,
+      baseBranch,
+      include: includeGlobs,
+      exclude: excludeGlobs,
+      fastForward,
+      logTag: '[boot-sweep]',
+      logger: {
+        info: (m) => logger.info?.(m),
+        warn: (m) => logger.warn?.(m),
+      },
+      protectionCtx: buildProtectionCtx({ cwd: root, provider }),
+      lockPath,
+      lockTimeoutMs,
+    });
+  } catch (err) {
+    const msg = err?.message ?? String(err);
+    logger.warn?.(`[boot-sweep] sweep threw (host continues): ${msg}`);
+    return {
+      ok: false,
+      skipped: true,
+      error: msg,
+      candidates: 0,
+      localDeleted: 0,
+      remoteDeleted: 0,
+      protected: [],
+      failures: [],
+    };
+  }
+}
+
+async function main() {
+  const { values } = parseArgs({
+    options: {
+      base: { type: 'string' },
+      cwd: { type: 'string' },
+      include: { type: 'string', multiple: true, default: [] },
+      exclude: { type: 'string', multiple: true, default: [] },
+      current: { type: 'string' },
+      'no-fast-forward': { type: 'boolean', default: false },
+      json: { type: 'boolean', default: false },
+      help: { type: 'boolean', short: 'h' },
+    },
+    strict: false,
+  });
+
+  if (values.help) {
+    Logger.info(HELP);
+    return;
+  }
+
+  const result = await runBootSweep({
+    cwd: typeof values.cwd === 'string' ? values.cwd : undefined,
+    base: typeof values.base === 'string' ? values.base : undefined,
+    include: Array.isArray(values.include) ? values.include : [],
+    exclude: Array.isArray(values.exclude) ? values.exclude : [],
+    current: typeof values.current === 'string' ? values.current : undefined,
+    fastForward: values['no-fast-forward'] !== true,
+  });
+
+  if (values.json) {
+    Logger.info(JSON.stringify(result, null, 2));
+  } else {
+    const protectedCount = result.protected?.length ?? 0;
+    Logger.info(
+      `[boot-sweep] reaped ${result.localDeleted} local + ${result.remoteDeleted} remote; protected ${protectedCount}.`,
+    );
+  }
+}
+
+runAsCli(import.meta.url, main, { source: 'boot-sweep' });

package/.agents/scripts/epic-deliver-prepare.js

@@ -36,6 +36,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { parseArgs } from 'node:util';
 
+import { runBootSweep } from './boot-sweep.js';
 import { runAsCli } from './lib/cli-utils.js';
 import { getPaths, getRunners, resolveConfig } from './lib/config-resolver.js';
 import { currentBranch as gitCurrentBranch } from './lib/git-branch-lifecycle.js';
@@ -218,6 +219,49 @@ async function runPreflightGuardsForPrepare({
   });
 }
 
+/**
+ * Route the Epic boot cleanup through the shared protected boot-sweep
+ * engine (Story #4373). Reaps merged, done `story-*` branches left over
+ * from prior runs — the protection partition skips any branch with
+ * unpushed work, a dirty worktree, or a still-open parent Story, so an
+ * in-flight Story is never touched. Fast-forward is off: the prepare may
+ * run on the Epic branch, and the fast-forward phase would otherwise
+ * check out the base branch.
+ *
+ * Best-effort — a sweep failure (lock contention, git/gh error) is
+ * swallowed and never blocks or fails the prepare. Skipped in the same
+ * injected-test shape the preflight guards use (a provider injected with
+ * no git seam) so unit tests never spawn real git/gh.
+ */
+async function runBootSweepForPrepare({
+  cwd,
+  config,
+  provider,
+  injectedProvider,
+  injectedGit,
+  injectedSweep,
+  skipPreflightGuards,
+}) {
+  const suppressed =
+    skipPreflightGuards || (Boolean(injectedProvider) && !injectedGit);
+  if (suppressed) return;
+  try {
+    await runBootSweep({
+      cwd,
+      include: ['story-*'],
+      fastForward: false,
+      injectedConfig: config,
+      injectedProvider: provider,
+      injectedSweep,
+      logger: Logger,
+    });
+  } catch (err) {
+    Logger.warn(
+      `[epic-deliver-prepare] ⚠️ boot sweep threw (prepare continues): ${err?.message ?? err}`,
+    );
+  }
+}
+
 /**
  * Resolve the Epic state, preferring the preflight cache (Story #3027) and
  * falling back to a fresh snapshot + wave-DAG pass on miss or baseSha
@@ -333,6 +377,7 @@ export async function runEpicDeliverPrepare({
   steal = false,
   asOperator,
   injectedGit,
+  injectedSweep,
   leaseHeartbeatAt,
   leaseNow,
   skipPreflightGuards = false,
@@ -365,6 +410,16 @@ export async function runEpicDeliverPrepare({
     skipPreflightGuards,
   });
 
+  await runBootSweepForPrepare({
+    cwd,
+    config,
+    provider,
+    injectedProvider,
+    injectedGit,
+    injectedSweep,
+    skipPreflightGuards,
+  });
+
   const { state, cacheStatus } = await resolvePrepareState({
     epicId,
     cwd,

package/.agents/scripts/git-pr-quality-gate.js

@@ -2,7 +2,7 @@
 /* node:coverage ignore file -- top-level CLI gate; spawns lint/format/test and asserts exit codes — heavy mocking would assert only mock structure */
 
 /**
- * git-pr-quality-gate.js — Lint / format / test gate for `/git-merge-pr`.
+ * git-pr-quality-gate.js — Lint / test / baselines gate for `/git-merge-pr`.
  *
  * `/git-merge-pr` Steps 3–4 previously hardcoded the command sequence
  * (`npm run lint`, `npm run format:check`, `npm test`) in the workflow
@@ -11,10 +11,12 @@
  * skill every time.
  *
  * This script runs the gate and emits a structured result so the .md routes
- * on outcome rather than re-implementing the command sequence. The three
- * checks it runs are read from
+ * on outcome rather than re-implementing the command sequence. The checks it
+ * runs are read from
  * `.agentrc.json → github.branchProtection.requiredChecks` when present,
- * falling back to the hardcoded default trio.
+ * falling back to the hardcoded default trio, which mirrors the live required
+ * check set (`lint`, `test`, `baselines` — Story #4356, Epic #4355; the stale
+ * `lifecycle-doc-drift` check was pruned in the same slice).
  *
  * Usage:
  *   node .agents/scripts/git-pr-quality-gate.js [--json] [--skip <name>[,<name>]]
@@ -48,8 +50,8 @@ import { Logger } from './lib/Logger.js';
  */
 export const DEFAULT_CHECKS = Object.freeze([
   { name: 'lint', cmd: ['npm', 'run', 'lint'] },
-  { name: 'format:check', cmd: ['npm', 'run', 'format:check'] },
   { name: 'test', cmd: ['npm', 'test'] },
+  { name: 'baselines', cmd: ['node', '.agents/scripts/check-baselines.js'] },
 ]);
 
 function resolveChecks(config) {

package/.agents/scripts/lib/config/ci.js

@@ -1,23 +1,34 @@
 /**
- * `delivery.ci` accessor + framework defaults — Story #2899 (Epic #2880, F13).
+ * `delivery.ci` accessor + framework defaults — Story #2899 (Epic #2880, F13)
+ * and Story #4356 (Epic #4355).
  *
  * `delivery.ci.skipForStoryPushes` defaults to `true` so per-Task Story-branch
  * commits append a `[skip ci]` trailer out of the box. The Epic-branch merge
  * commit produced by `story-close.js`'s merge runner never carries the
  * marker — that path is the one consumers actually want CI to evaluate.
+ *
+ * Story #4356 adds the CI-aware delivery knobs: `earlyPr` (default `true`)
+ * gates whether /deliver opens the Epic PR early so CI warms while later
+ * waves run; `watch` tunes the merge/CI watch poll loop; and `autoMerge`
+ * (default `"trust-ci"`) selects the merge posture — `"trust-ci"` merges once
+ * required checks pass, `"strict"` additionally requires a clean review gate.
  */
 
 export const CI_DELIVERY_DEFAULTS = Object.freeze({
   skipForStoryPushes: true,
+  earlyPr: true,
+  autoMerge: 'trust-ci',
 });
 
 /**
  * Read the merged `delivery.ci` block, applying framework defaults for any
  * field the operator omitted. Accepts the full resolved config, the bare
- * delivery bag, or the bare ci bag.
+ * delivery bag, or the bare ci bag. The `watch` sub-block is passed through
+ * as-is (undefined when unset) so consumers apply their own poll-loop
+ * defaults; only the scalar knobs carry framework defaults here.
  *
  * @param {object | null | undefined} config
- * @returns {typeof CI_DELIVERY_DEFAULTS}
+ * @returns {{ skipForStoryPushes: boolean, earlyPr: boolean, autoMerge: 'trust-ci' | 'strict', watch: object | undefined }}
  */
 export function getCiDelivery(config) {
   const ci = config?.delivery?.ci ?? config?.ci ?? config ?? {};
@@ -26,5 +37,15 @@ export function getCiDelivery(config) {
       typeof ci.skipForStoryPushes === 'boolean'
         ? ci.skipForStoryPushes
         : CI_DELIVERY_DEFAULTS.skipForStoryPushes,
+    earlyPr:
+      typeof ci.earlyPr === 'boolean'
+        ? ci.earlyPr
+        : CI_DELIVERY_DEFAULTS.earlyPr,
+    autoMerge:
+      ci.autoMerge === 'trust-ci' || ci.autoMerge === 'strict'
+        ? ci.autoMerge
+        : CI_DELIVERY_DEFAULTS.autoMerge,
+    watch:
+      ci.watch && typeof ci.watch === 'object' ? { ...ci.watch } : undefined,
   };
 }