mandrel 1.84.0 → 1.86.0

package/.agents/scripts/lib/orchestration/lifecycle/listeners/branch-cleaner.js

@@ -40,7 +40,11 @@
  *      - runs `git remote prune` to drop stale `<remote>/...` tracking
  *        refs left behind by `gh pr merge --delete-branch`;
  *      - deletes the `wt-branch` scratch ref left by `story-close.js`'s
- *        internal merge worktree when it is no longer checked out.
+ *        internal merge worktree when it is no longer checked out;
+ *      - fast-forwards the base branch to `<remote>/<baseBranch>` after the
+ *        confirmed merge so the local checkout converges to origin with no
+ *        manual `git pull` (skipped when the epic branch is kept for an
+ *        open PR).
  *   3. Record one classification entry per invocation (`reaped`,
  *      `no-state`, `failed`, or `skipped-duplicate`) so failures surface
  *      in the lifecycle ledger alongside Cleaner's archival outcome.
@@ -243,8 +247,8 @@ export class BranchCleaner {
  * Pure: condense a `reapEpicBranches()` result into the counts that the
  * classification log carries. Exported for tests.
  *
- * @param {{ reaped: Array<object>, pruned: { pruned: string[] }|null, wtBranch: { deleted: boolean }|null }} result
- * @returns {{ branchesDeleted: number, worktreesRemoved: number, tracksPruned: number, wtBranchDeleted: boolean }}
+ * @param {{ reaped: Array<object>, pruned: { pruned: string[] }|null, wtBranch: { deleted: boolean }|null, fastForward: { applied: boolean }|null }} result
+ * @returns {{ branchesDeleted: number, worktreesRemoved: number, tracksPruned: number, wtBranchDeleted: boolean, fastForwarded: boolean }}
  */
 export function summarizeReap(result) {
   const reaped = Array.isArray(result?.reaped) ? result.reaped : [];
@@ -255,5 +259,6 @@ export function summarizeReap(result) {
     ).length,
     tracksPruned: result?.pruned?.pruned?.length ?? 0,
     wtBranchDeleted: result?.wtBranch?.deleted === true,
+    fastForwarded: result?.fastForward?.applied === true,
   };
 }

package/.agents/scripts/lib/orchestration/lifecycle/listeners/finalizer.js

@@ -24,7 +24,11 @@
  *   4. Otherwise, invoke `runFinalizeFn`. The production default
  *      (`composeBusOwnedFinalize`) chains
  *        a. `openOrLocatePr({ epicId, headBranch, baseBranch })`
- *        b. `postHandoffComment({ epicId, prNumber, prUrl, provider })`
+ *        b. `markPrReady({ pr })` when `delivery.ci.earlyPr` is on
+ *           (Story #4359) — the wave-1 draft is flipped ready-for-review;
+ *           skipped when `earlyPr` is off (the PR was opened here, never a
+ *           draft).
+ *        c. `postHandoffComment({ epicId, prNumber, prUrl, provider })`
  *      and returns `{ prNumber, prUrl, handoff }`. (Story #4324 retired
  *      the `closePlanningTickets` sweep with the context-ticket classes —
  *      there are no planning tickets to close.)
@@ -60,13 +64,17 @@
  */
 
 import { spawnSync } from 'node:child_process';
+import { getCiDelivery } from '../../../config/ci.js';
 import {
   graduateAuditResults as defaultGraduateAuditResults,
   isAutoFileEnabled as isAuditResultsAutoFileEnabled,
 } from '../../../feedback-loop/audit-results-graduator.js';
 import { graduateFindings as defaultGraduateFindings } from '../../../feedback-loop/code-review-graduator.js';
 import { parsePrNumberFromUrl } from '../../../github-url.js';
-import { openOrLocatePr as defaultOpenOrLocatePr } from '../../finalize/open-or-locate-pr.js';
+import {
+  markPrReady as defaultMarkPrReady,
+  openOrLocatePr as defaultOpenOrLocatePr,
+} from '../../finalize/open-or-locate-pr.js';
 import { postHandoffComment as defaultPostHandoffComment } from '../../finalize/post-handoff-comment.js';
 
 /**
@@ -79,17 +87,31 @@ import { postHandoffComment as defaultPostHandoffComment } from '../../finalize/
  * `{ blocker: { reason, detail } }` when a step fails with an
  * unrecoverable error that should keep the Epic at `agent::blocked`.
  *
+ * Story #4359 (Epic #4355) — early-PR draft mode. When `earlyPr` is on
+ * (the default resolved via `getCiDelivery`), the Epic PR already exists
+ * as a draft (opened at wave 1). Finalize then **locates** it (the
+ * `openOrLocatePr` probe short-circuits to `created: false`) and flips it
+ * ready-for-review via `markPrReady` rather than opening the draft as a
+ * `--draft`. When `earlyPr` is off, finalize opens the PR here with no
+ * draft — the pre-Story close-time timing. In both modes the title/body
+ * contract is identical and `markPrReady` is a no-op on an already-ready
+ * PR, so replay stays idempotent.
+ *
  * @param {{
  *   provider?: object|null,
+ *   earlyPr?: boolean,
  *   openOrLocatePrFn?: typeof defaultOpenOrLocatePr,
+ *   markPrReadyFn?: typeof defaultMarkPrReady,
  *   postHandoffCommentFn?: typeof defaultPostHandoffComment,
  * }} deps
  */
 export function composeBusOwnedFinalize(deps = {}) {
   const openOrLocatePrFn = deps.openOrLocatePrFn ?? defaultOpenOrLocatePr;
+  const markPrReadyFn = deps.markPrReadyFn ?? defaultMarkPrReady;
   const postHandoffCommentFn =
     deps.postHandoffCommentFn ?? defaultPostHandoffComment;
   const provider = deps.provider ?? null;
+  const earlyPr = deps.earlyPr !== false;
 
   return async function runBusOwnedFinalize({ epicId, cwd } = {}) {
     if (!Number.isInteger(epicId) || epicId < 1) {
@@ -129,6 +151,24 @@ export function composeBusOwnedFinalize(deps = {}) {
       };
     }
 
+    // Story #4359: when earlyPr is on, the located PR is the wave-1 draft —
+    // flip it ready-for-review. `gh pr ready` on an already-ready PR is a
+    // no-op, so a replay (or an earlyPr-off PR that was never a draft) is
+    // safe. A failure here is a hard blocker: leaving the PR a draft would
+    // silently park the merge gate.
+    if (earlyPr) {
+      try {
+        await markPrReadyFn({ pr: openResult.url, cwd });
+      } catch (err) {
+        return {
+          blocker: {
+            reason: 'mark-pr-ready-failed',
+            detail: err?.message ?? String(err),
+          },
+        };
+      }
+    }
+
     // The handoff comment requires a provider. The lifecycle-emit CLI
     // may construct the Finalizer without one; in that case the step
     // short-circuits (the run itself still succeeds — the PR is open and
@@ -256,9 +296,14 @@ export class Finalizer {
     this.cwd = opts.cwd ?? process.cwd();
     this.fullScope = opts.fullScope === true;
     this.provider = opts.provider ?? null;
+    // Story #4359: gate the finalize PR-open/ready branch on
+    // `delivery.ci.earlyPr` (default true) resolved via getCiDelivery.
+    // On → the wave-1 draft is located and marked ready; off → the PR is
+    // opened here at close time (pre-Story timing).
+    const earlyPr = getCiDelivery(opts.config ?? null).earlyPr;
     this.runFinalizeFn =
       opts.runFinalizeFn ??
-      composeBusOwnedFinalize({ provider: this.provider });
+      composeBusOwnedFinalize({ provider: this.provider, earlyPr });
     this.ghPrListHeadFn = opts.ghPrListHeadFn ?? ghPrListHead;
     // ultrareview bug_007: the existing-PR short-circuit must run the
     // handoff-comment upsert (idempotent) so crash-recovery replays

package/.agents/scripts/lib/orchestration/lifecycle/listeners/index.js

@@ -229,13 +229,18 @@ export async function buildDefaultListenerChain(opts = {}) {
   // 5. AutomergePredicate — emits epic.merge.{ready,blocked} based on
   //    the runtime predicate evaluation. Requires a truthy `provider`;
   //    skip cleanly when the caller omitted one (lifecycle-emit CLI
-  //    has no provider wired in by default).
+  //    has no provider wired in by default). `config` selects the
+  //    `delivery.ci.autoMerge` posture (trust-ci default vs strict) and
+  //    `cwd` (repoRoot) is where the live `gh pr checks --required`
+  //    probe shells out (Story #4361).
   let automergePredicate = null;
   if (provider) {
     automergePredicate = new AutomergePredicate({
       bus,
       epicId,
       provider,
+      config,
+      cwd: repoRoot,
       logger,
     });
     automergePredicate.register();

package/.agents/scripts/lib/orchestration/lifecycle/listeners/watcher.js

@@ -55,6 +55,35 @@ import { parsePrNumberFromUrl } from '../../../github-url.js';
  * Unknown / non-pending unrecognized values collapse to `'skipped'`
  * so any future GitHub state we haven't enumerated still validates.
  */
+/**
+ * The raw check-state tokens `normalizeCheckState` recognizes (lowercased).
+ * A token absent from this set is one we have NOT enumerated — the watch
+ * path collapses it to `'skipped'` (validate-anything), but a fail-closed
+ * consumer (the auto-merge arming probe) must treat it as unknown-therefore-
+ * blocking rather than trust the `'skipped'` collapse. Exported so that
+ * stricter consumer lives here as the single vocabulary owner.
+ */
+export const RECOGNIZED_CHECK_STATES = Object.freeze(
+  new Set([
+    '',
+    'pending',
+    'queued',
+    'in_progress',
+    'requested',
+    'waiting',
+    'success',
+    'completed',
+    'failure',
+    'startup_failure',
+    'neutral',
+    'cancelled',
+    'timed_out',
+    'action_required',
+    'stale',
+    'skipped',
+  ]),
+);
+
 export function normalizeCheckState(raw) {
   const v = String(raw ?? '')
     .trim()
@@ -266,19 +295,45 @@ export function allTerminal(outcomes) {
 }
 
 /**
- * Promote any `'pending'` outcomes to the schema-valid `'timed_out'`
- * sentinel before emit. Pure — exported for tests so the cap-fire
- * behaviour is reviewable. Called only when the poll loop exits via
- * the iteration cap.
+ * Sentinel outcome for a required check that never went terminal within
+ * the poll cap AND the resume budget — the CI job is genuinely slow, not
+ * red. Story #4358 made this a first-class outcome distinct from
+ * `'timed_out'` (a GitHub-reported terminal timeout) and `'failure'` (a
+ * red check): a `'still-running'` map means "re-arm the watch / hand off
+ * to `/loop`," never "the change is broken."
  */
-function promotePendingToTimedOut(outcomes) {
+export const STILL_RUNNING = 'still-running';
+
+/**
+ * Promote any leftover `'pending'` outcomes to the schema-valid
+ * `'still-running'` sentinel before emit. Pure — exported for tests so
+ * the cap-fire behaviour is reviewable. Called only when the poll loop
+ * (and its resume budget) exits with checks still pending and none
+ * failed — the slow-but-not-red terminal state.
+ */
+export function promotePendingToStillRunning(outcomes) {
   const out = {};
   for (const [k, v] of Object.entries(outcomes)) {
-    out[k] = v === 'pending' ? 'timed_out' : v;
+    out[k] = v === 'pending' ? STILL_RUNNING : v;
   }
   return out;
 }
 
+/**
+ * True when at least one required check has genuinely failed — the hard
+ * stop that consumes NO resume budget and exits 1 immediately. A
+ * `'pending'` check is not a failure (it is still running); anything
+ * outside the non-failing set AND outside `'pending'` is a red block.
+ * Pure — exported for tests.
+ */
+export function hasFailingCheck(outcomes) {
+  for (const v of Object.values(outcomes)) {
+    if (v === 'pending') continue;
+    if (!GREEN_CHECK_OUTCOMES.has(v)) return true;
+  }
+  return false;
+}
+
 /**
  * Default sleeper. Hoisted so tests can stub without faking timers.
  */
@@ -355,8 +410,13 @@ export async function pollUntilTerminal({
  * @param {object} opts
  * @param {string} opts.prUrl              PR URL or number (passed to `gh` verbatim).
  * @param {string} opts.cwd
- * @param {number} opts.maxPolls           Hard cap on total poll iterations.
+ * @param {number} opts.maxPolls           Hard cap on total poll iterations per arm.
  * @param {number} opts.maxUpdates         Cap on `gh pr update-branch` recovery calls.
+ * @param {number} [opts.maxResumes]       Story #4358: after the poll cap fires with
+ *   one or more required checks still pending (and NONE failed), re-arm the poll
+ *   loop up to this many times before giving up with a `still-running` verdict.
+ *   A genuinely red check short-circuits immediately and consumes no resume
+ *   budget. Defaults to 0 (no resume) so existing callers are unchanged.
  * @param {number} opts.pollIntervalMs     Delay between poll ticks.
  * @param {Function} [opts.ghPrChecksFn]   `gh pr checks` invoker. Defaults
  *   to the real `gh pr checks` spawn so the CLI path (which injects no
@@ -379,19 +439,24 @@ export async function pollUntilTerminal({
  *   requiredChecks: string[],
  *   polls: number,
  *   updatesApplied: number,
+ *   resumesApplied: number,
  *   terminal: boolean,
  *   green: boolean,
+ *   stillRunning: boolean,
  *   error?: string,
  * }>}
  *   `outcomes` is schema-valid (no `'pending'` — leftover pending is
- *   promoted to `'timed_out'` when the cap fires). `error` is set only
- *   when the first probe could not resolve the required-check set.
+ *   promoted to `'still-running'` when the cap and resume budget are both
+ *   exhausted with no failed check). `stillRunning` is true in exactly
+ *   that case (slow CI, not red). `error` is set only when the first
+ *   probe could not resolve the required-check set.
  */
 export async function watchPrToTerminal({
   prUrl,
   cwd,
   maxPolls,
   maxUpdates,
+  maxResumes = 0,
   pollIntervalMs,
   ghPrChecksFn = ghPrChecks,
   ghPrViewFn = ghPrView,
@@ -417,8 +482,10 @@ export async function watchPrToTerminal({
       requiredChecks: [],
       polls: 0,
       updatesApplied: 0,
+      resumesApplied: 0,
       terminal: false,
       green: false,
+      stillRunning: false,
       error: `gh-checks-failed:status=${first.status}`,
     };
   }
@@ -433,68 +500,95 @@ export async function watchPrToTerminal({
   let outcomes = reduceOutcomes(firstEntries);
   let polls = 0;
   let updatesApplied = 0;
-  while (polls < maxPolls) {
-    ({ outcomes, polls } = await pollUntilTerminal({
-      prUrl,
-      cwd,
-      outcomes,
-      polls,
-      maxPolls,
-      ghPrChecksFn,
-      pollIntervalMs,
-      sleepFn,
-      logger,
-    }));
-    // Checks have either all gone terminal or we hit the iteration cap.
-    // BEHIND-recovery (Story #2327): when every required check is green
-    // AND the PR is BEHIND its base, issue ONE `gh pr update-branch`
-    // call and re-poll the checks against the freshly-rebased commit. A
-    // red check is a hard block — stop here regardless of merge state.
-    // Bounded by `maxUpdates` so a racing base branch can't ping-pong
-    // indefinitely.
-    if (!allTerminal(outcomes) || !allGreen(outcomes)) break;
-    if (updatesApplied >= maxUpdates) break;
-    const view = ghPrViewFn({ prUrl, cwd });
-    if (view.status !== 0) {
-      logger.warn?.(
-        `[Watcher] gh pr view failed (status=${view.status}): ${view.stderr}`,
-      );
-      break;
-    }
-    const mergeStateStatus = parseMergeStateStatus(view.stdout);
-    if (mergeStateStatus !== 'BEHIND') break;
-    const update = ghPrUpdateBranchFn({ prUrl, cwd });
-    if (update.status !== 0) {
-      logger.warn?.(
-        `[Watcher] gh pr update-branch failed (status=${update.status}): ${update.stderr}`,
+  let resumesApplied = 0;
+  // Outer resume loop (Story #4358). Each iteration runs one full
+  // poll-to-cap + BEHIND-recovery arm. When the arm ends with checks
+  // still pending but NONE failed, we re-arm (reset the poll counter)
+  // up to `maxResumes` times before declaring `still-running`. A red
+  // check breaks out immediately without consuming resume budget.
+  for (;;) {
+    while (polls < maxPolls) {
+      ({ outcomes, polls } = await pollUntilTerminal({
+        prUrl,
+        cwd,
+        outcomes,
+        polls,
+        maxPolls,
+        ghPrChecksFn,
+        pollIntervalMs,
+        sleepFn,
+        logger,
+      }));
+      // Checks have either all gone terminal or we hit the iteration cap.
+      // BEHIND-recovery (Story #2327): when every required check is green
+      // AND the PR is BEHIND its base, issue ONE `gh pr update-branch`
+      // call and re-poll the checks against the freshly-rebased commit. A
+      // red check is a hard block — stop here regardless of merge state.
+      // Bounded by `maxUpdates` so a racing base branch can't ping-pong
+      // indefinitely.
+      if (!allTerminal(outcomes) || !allGreen(outcomes)) break;
+      if (updatesApplied >= maxUpdates) break;
+      const view = ghPrViewFn({ prUrl, cwd });
+      if (view.status !== 0) {
+        logger.warn?.(
+          `[Watcher] gh pr view failed (status=${view.status}): ${view.stderr}`,
+        );
+        break;
+      }
+      const mergeStateStatus = parseMergeStateStatus(view.stdout);
+      if (mergeStateStatus !== 'BEHIND') break;
+      const update = ghPrUpdateBranchFn({ prUrl, cwd });
+      if (update.status !== 0) {
+        logger.warn?.(
+          `[Watcher] gh pr update-branch failed (status=${update.status}): ${update.stderr}`,
+        );
+        break;
+      }
+      updatesApplied += 1;
+      logger.info?.(
+        `[Watcher] PR BEHIND base — issued gh pr update-branch (#${updatesApplied}/${maxUpdates}); re-polling required checks.`,
       );
-      break;
+      await sleepFn(pollIntervalMs);
+      // After update-branch, the freshly-rebased commit invalidates the
+      // previous terminal outcomes. Reset to force the inner poll loop to
+      // re-evaluate the new CI cycle.
+      outcomes = {};
+      for (const name of requiredChecks) outcomes[name] = 'pending';
     }
-    updatesApplied += 1;
+
+    // Arm complete. Decide whether to re-arm. A genuinely red check is a
+    // hard stop that consumes NO resume budget — the change is broken,
+    // resuming would only burn wall-clock. Only re-arm when the arm timed
+    // out with pending-but-not-failed checks and resume budget remains.
+    if (allTerminal(outcomes) || hasFailingCheck(outcomes)) break;
+    if (resumesApplied >= maxResumes) break;
+    resumesApplied += 1;
+    polls = 0;
     logger.info?.(
-      `[Watcher] PR BEHIND base — issued gh pr update-branch (#${updatesApplied}/${maxUpdates}); re-polling required checks.`,
+      `[Watcher] poll cap reached with checks still pending; re-arming watch (resume #${resumesApplied}/${maxResumes}).`,
     );
-    await sleepFn(pollIntervalMs);
-    // After update-branch, the freshly-rebased commit invalidates the
-    // previous terminal outcomes. Reset to force the inner poll loop to
-    // re-evaluate the new CI cycle.
-    outcomes = {};
-    for (const name of requiredChecks) outcomes[name] = 'pending';
   }
 
   const terminal = allTerminal(outcomes);
-  // The schema enum forbids `'pending'`; promote any leftover pending
-  // entries (cap-fire path) to `'timed_out'` for the returned map.
+  const failing = hasFailingCheck(outcomes);
+  // Slow-but-not-red: the poll cap AND resume budget are exhausted with
+  // one or more checks still pending and NONE failed. The schema enum
+  // forbids `'pending'`; promote leftover pending entries to the
+  // `'still-running'` sentinel (never `'timed_out'` — that would read as
+  // a genuine terminal failure to the auto-merge predicate).
+  const stillRunning = !terminal && !failing;
   const finalOutcomes = terminal
     ? outcomes
-    : promotePendingToTimedOut(outcomes);
+    : promotePendingToStillRunning(outcomes);
   return {
     outcomes: finalOutcomes,
     requiredChecks,
     polls,
     updatesApplied,
+    resumesApplied,
     terminal,
     green: terminal && allGreen(finalOutcomes),
+    stillRunning,
   };
 }
 
@@ -513,6 +607,9 @@ export class Watcher {
    *   recovery calls per `pr.created` event; default 3. Mirrors the
    *   legacy `pr-watch-with-update` cap so a racing base branch
    *   can't induce an infinite update-branch ping-pong.
+   * @param {number} [opts.maxResumes] Story #4358: how many times to
+   *   re-arm the poll loop after the cap fires with checks still pending
+   *   (and none failed) before declaring `still-running`; default 0.
    * @param {Function} [opts.ghPrChecksFn] override for tests.
    * @param {Function} [opts.ghPrViewFn] override for tests; resolves
    *   `mergeStateStatus` for the BEHIND-recovery gate.
@@ -539,6 +636,10 @@ export class Watcher {
       Number.isInteger(opts.maxUpdates) && opts.maxUpdates >= 0
         ? opts.maxUpdates
         : 3;
+    this.maxResumes =
+      Number.isInteger(opts.maxResumes) && opts.maxResumes >= 0
+        ? opts.maxResumes
+        : 0;
     this.ghPrChecksFn = opts.ghPrChecksFn ?? ghPrChecks;
     this.ghPrViewFn = opts.ghPrViewFn ?? ghPrView;
     this.ghPrUpdateBranchFn = opts.ghPrUpdateBranchFn ?? ghPrUpdateBranch;
@@ -549,8 +650,8 @@ export class Watcher {
     /**
      * Classification log — every `pr.created` we observe lands here
      * with the outcome (`watched`, `failed`, `skipped-duplicate`,
-     * `timed-out`). Mirrors the Finalizer / Reconciler "no silent skip"
-     * surface.
+     * `still-running`, `timed-out`). Mirrors the Finalizer / Reconciler
+     * "no silent skip" surface.
      */
     this.classifications = [];
     this.events = Object.freeze(['pr.created']);
@@ -631,12 +732,15 @@ export class Watcher {
       outcomes: emitOutcomes,
       polls,
       updatesApplied,
+      resumesApplied,
       terminal,
+      stillRunning,
     } = await watchPrToTerminal({
       prUrl,
       cwd: this.cwd,
       maxPolls: this.maxPolls,
       maxUpdates: this.maxUpdates,
+      maxResumes: this.maxResumes,
       pollIntervalMs: this.pollIntervalMs,
       ghPrChecksFn: this.ghPrChecksFn,
       ghPrViewFn: this.ghPrViewFn,
@@ -646,12 +750,22 @@ export class Watcher {
       firstProbe: first,
     });
 
+    // `still-running` (slow CI, not red) is a distinct classification from
+    // a genuine `timed-out` — reserved for a check that never went
+    // terminal within the poll cap AND the resume budget while none
+    // failed. `watched` covers every terminal arm (green or red).
+    const outcome = terminal
+      ? 'watched'
+      : stillRunning
+        ? 'still-running'
+        : 'timed-out';
     this.classifications.push({
       event,
       seqId,
-      outcome: terminal ? 'watched' : 'timed-out',
+      outcome,
       polls,
       updatesApplied,
+      resumesApplied,
       requiredChecks: requiredChecks.length,
     });
     try {

package/.agents/scripts/lib/orchestration/single-story-close/phases/auto-merge.js

@@ -139,6 +139,7 @@ function makeDefaultGhAutoMergeRunner(gh) {
  *   prNumber: number|null,
  *   prUrl: string,
  *   noAutoMerge: boolean,
+ *   autoMergePolicy?: 'trust-ci'|'strict',
  *   gh?: ReturnType<typeof import('../../../gh-exec.js').createGh>,
  *   progress: (tag: string, msg: string) => void,
  * }} args
@@ -149,6 +150,7 @@ export async function runAutoMergePhase({
   prNumber,
   prUrl,
   noAutoMerge,
+  autoMergePolicy = 'trust-ci',
   gh,
   progress,
 }) {
@@ -156,6 +158,23 @@ export async function runAutoMergePhase({
     progress('PR', '⏭  Auto-merge disabled (--no-auto-merge).');
     return { autoMergeEnabled: false, autoMergeReason: 'disabled-by-flag' };
   }
+  // `delivery.ci.autoMerge: "strict"` opts standalone Stories out of
+  // auto-merge (parallel to the Epic path's strict predicate): the PR opens
+  // and waits for an operator merge instead of arming native auto-merge.
+  // The default `"trust-ci"` keeps arming on green required CI — GitHub's
+  // native `--auto` is the required-check gate, so no client-side predicate
+  // is needed here (unlike the Epic path, which gates on local
+  // audit/review/retro signals a standalone Story does not produce).
+  if (autoMergePolicy === 'strict') {
+    progress(
+      'PR',
+      '⏭  Auto-merge skipped (delivery.ci.autoMerge="strict") — operator merges.',
+    );
+    return {
+      autoMergeEnabled: false,
+      autoMergeReason: 'disabled-by-policy-strict',
+    };
+  }
   if (prNumber == null) {
     progress(
       'PR',

package/.agents/scripts/lib/orchestration/single-story-close/runner.js

@@ -2,6 +2,7 @@ import nodeFs from 'node:fs';
 import path from 'node:path';
 import { buildDefaultGates } from '../../close-validation/gates.js';
 import { runCloseValidation } from '../../close-validation/runner.js';
+import { getCiDelivery } from '../../config/ci.js';
 import { resolveConfig } from '../../config-resolver.js';
 import { getStoryBranch, gitSync } from '../../git-utils.js';
 import { Logger } from '../../Logger.js';
@@ -316,6 +317,7 @@ export async function runSingleStoryClose({
     prNumber,
     prUrl,
     noAutoMerge: options.noAutoMerge,
+    autoMergePolicy: getCiDelivery(config).autoMerge,
     gh: injectedGh,
     progress,
   });

package/.agents/scripts/lib/orchestration/story-close/baseline-attribution/phases/gate-failure.js

@@ -47,6 +47,51 @@ export const DEFAULT_GATE_REGISTRY = {
   },
 };
 
+/** Gate names that fan out to per-kind refreshers via `_gateKind` tags. */
+const COMPOSITE_GATE_KINDS = new Set(['check-baselines']);
+
+/**
+ * Resolve the refresh metadata + the regression subset a single failure
+ * cycle should act on.
+ *
+ * A direct per-kind gate (`check-maintainability` / `check-crap`) maps
+ * straight through. The unified `check-baselines` gate is a **composite**:
+ * its projected regressions are tagged with `_gateKind`, and each attribution
+ * cycle picks the first regressed kind not already refreshed this cycle
+ * (`cycleState.refreshedKinds`), scoping classify + refresh to that one kind.
+ * The retry loop re-drives for any remaining kinds — so a close that regresses
+ * both maintainability and CRAP converges in two cycles instead of dead-ending
+ * on an unrecognised gate name (framework-gap #4377).
+ *
+ * @returns {{ meta: object, regressions: Array } | null}
+ */
+export function resolveGateMeta({
+  gateName,
+  regressions,
+  cycleState = null,
+  gateRegistry = DEFAULT_GATE_REGISTRY,
+}) {
+  if (!Array.isArray(regressions) || regressions.length === 0) return null;
+
+  const direct = gateRegistry[gateName];
+  if (direct) return { meta: direct, regressions };
+
+  if (COMPOSITE_GATE_KINDS.has(gateName)) {
+    const refreshed = cycleState?.refreshedKinds ?? new Set();
+    for (const row of regressions) {
+      const kind = row?._gateKind;
+      const subMeta = kind ? gateRegistry[`check-${kind}`] : null;
+      if (subMeta && !refreshed.has(subMeta.kind)) {
+        return {
+          meta: subMeta,
+          regressions: regressions.filter((r) => r?._gateKind === kind),
+        };
+      }
+    }
+  }
+  return null;
+}
+
 /**
  * Top-level: handle a baseline gate failure by classifying drift and
  * either auto-refreshing (attributable-only) or posting friction (any
@@ -88,11 +133,14 @@ export async function handleBaselineGateFailure({
   gateRegistry = DEFAULT_GATE_REGISTRY,
   deps = {},
 } = {}) {
-  const meta = gateRegistry[gateName];
-  if (!meta) return { action: 'rethrow' };
-  if (!Array.isArray(regressions) || regressions.length === 0) {
-    return { action: 'rethrow' };
-  }
+  const resolved = resolveGateMeta({
+    gateName,
+    regressions,
+    cycleState,
+    gateRegistry,
+  });
+  if (!resolved) return { action: 'rethrow' };
+  const { meta, regressions: scopedRegressions } = resolved;
 
   const classify = deps.classifyBaselineDrift ?? defaultClassifyBaselineDrift;
   const renderBody =
@@ -114,7 +162,7 @@ export async function handleBaselineGateFailure({
 
   const epicRef = `origin/${epicBranch}`;
   const { attributable, nonAttributable } = classify({
-    regressions,
+    regressions: scopedRegressions,
     storyDiffPaths,
     epicRef,
     cwd,