mandrel 1.92.0 → 1.94.0

package/.agents/scripts/lib/close-validation/gates.js

@@ -6,7 +6,12 @@
  * runner (`INDEPENDENT_GATE_NAMES` / `partitionGates`).
  */
 
+import { existsSync } from 'node:fs';
+
+import { _internals as baselineReaderInternals } from '../baselines/reader.js';
+import { getQuality } from '../config/quality.js';
 import { hasNpmScript, readPackageScripts } from '../npm-scripts.js';
+import { KNOWN_KINDS } from '../orchestration/check-baselines/phases/parse-args.js';
 import {
   buildFormatHint,
   FORMAT_CHECK_FALLBACK,
@@ -115,6 +120,106 @@ function buildTestGateEntry(coverageCaptureActive) {
   return [{ name: 'test', cmd: 'npm', args: ['test'] }];
 }
 
+const CHECK_BASELINES_HINT =
+  'Unified baselines gate breached. Inspect the JSON report (`node .agents/scripts/check-baselines.js`) to see which kind/component/axis fell below floor; remediate the underlying file(s) or — when the regression is intentional — refresh the relevant baseline through its per-kind update script and commit with a `baseline-refresh:` tagged subject.';
+
+/**
+ * Baseline kinds the resolved config enables for the unified
+ * `check-baselines` gate. Mirrors `selectEnabledGates` in the check-baselines
+ * pipeline (a kind runs when its `gates.<kind>` block is present and not
+ * explicitly disabled) so the registration probe's view of "what will run"
+ * matches the gate's own view exactly.
+ *
+ * @param {object|undefined|null} config canonical resolved config
+ * @returns {string[]}
+ */
+function enabledBaselineKinds(config) {
+  const gates = getQuality(config)?.gates ?? {};
+  return KNOWN_KINDS.filter((kind) => {
+    const block = gates[kind];
+    return block && typeof block === 'object' && block.enabled !== false;
+  });
+}
+
+/**
+ * Whether the consumer opted into fail-closed baseline enforcement via
+ * `delivery.quality.requireBaselines: true`. Default false — a consumer that
+ * enables baseline gates but has not committed baseline artifacts gets a
+ * clean skip (see `probeBaselinesGate`) rather than a deterministic first-try
+ * close failure. Mirrors the `delivery.ci.requireChecks` escape hatch (#4472).
+ *
+ * @param {object|undefined|null} config
+ * @returns {boolean}
+ */
+function baselinesRequiredByConfig(config) {
+  return config?.delivery?.quality?.requireBaselines === true;
+}
+
+function toKindSet(presentBaselines) {
+  if (presentBaselines instanceof Set) return presentBaselines;
+  if (Array.isArray(presentBaselines)) return new Set(presentBaselines);
+  return new Set();
+}
+
+/**
+ * Probe whether the `check-baselines` consumer contract is satisfied before
+ * registering the gate (#4495 — mirrors the #4473/#4480 coverage-capture
+ * remedy). The contract: every enabled baseline kind carries a committed
+ * baseline artifact on disk (the same path the gate's reader resolves).
+ *
+ * Decision shape:
+ *   - `{ register: false, reason }` — skip (caller logs the reason). Baseline
+ *     gates ARE enabled but none of the enabled kinds carry a committed
+ *     baseline artifact and the consumer has not set `requireBaselines`. This
+ *     is the bench/greenfield case: the gate would otherwise fail
+ *     deterministically on first try reading a non-existent
+ *     `baselines/<kind>.json`.
+ *   - `{ register: true }` — at least one committed baseline artifact is
+ *     present, OR no baseline kinds are enabled at all (the gate then self-
+ *     skips every kind and exits a clean empty PASS — no failure to avoid, so
+ *     the gate stays registered exactly as pre-#4495); run the gate.
+ *   - `{ register: true, hint }` — baselines are required-by-config
+ *     (`requireBaselines: true`) but absent; keep the gate registered so it
+ *     fails, with a preflight hint naming the fix.
+ *
+ * @param {{ config?: object, cwd?: string, presentBaselines?: string[]|Set<string> }} opts
+ *   `presentBaselines` injects the set of kinds whose baseline artifact
+ *   exists (tests), short-circuiting the on-disk probe.
+ * @returns {{ register: boolean, reason?: string, hint?: string }}
+ */
+function probeBaselinesGate({ config, cwd, presentBaselines } = {}) {
+  const enabled = enabledBaselineKinds(config);
+  if (enabled.length === 0) {
+    // No enabled baseline kinds → `check-baselines.js` self-skips every kind
+    // and exits clean (an empty PASS). There is no deterministic-failure risk
+    // to avoid, so keep the gate registered exactly as it was pre-#4495; the
+    // #4495 skip is confined strictly to the read-miss-would-fail case below.
+    return { register: true };
+  }
+  const injected =
+    presentBaselines != null ? toKindSet(presentBaselines) : null;
+  const present = enabled.filter((kind) =>
+    injected
+      ? injected.has(kind)
+      : existsSync(baselineReaderInternals.resolveBaselinePath(kind, { cwd })),
+  );
+  if (present.length > 0) return { register: true };
+  if (baselinesRequiredByConfig(config)) {
+    return {
+      register: true,
+      hint:
+        `Baselines are required (delivery.quality.requireBaselines) but no committed baseline artifact was found for enabled kind(s): ${enabled.join(', ')}. ` +
+        'Generate the baseline(s) with the per-kind update script (e.g. `npm run crap:update`, `npm run maintainability:update`) and commit them, or unset requireBaselines to skip the gate until baselines exist.',
+    };
+  }
+  return {
+    register: false,
+    reason:
+      `check-baselines skipped — enabled kind(s) ${enabled.join(', ')} have no committed baseline artifact under baselines/ ` +
+      'and delivery.quality.requireBaselines is not set. Commit baseline artifacts (or set requireBaselines to enforce them) to activate the gate.',
+  };
+}
+
 /**
  * Build the canonical close-validation gate list.
  *
@@ -152,15 +257,30 @@ function buildTestGateEntry(coverageCaptureActive) {
  * instead of a deterministic close failure with no test gate at all. The
  * probe reads `package.json` at `cwd` (the gate execution directory).
  *
- * @param {{ config?: object, epicBranch?: string, cwd?: string, packageScripts?: Record<string, string> }} [opts]
+ * Story #4495 — the unified `check-baselines` gate reads a committed
+ * `baselines/<kind>.json` for each enabled kind; a consumer that enables
+ * baseline gates but ships no `baselines/` tree (every bench sandbox, any
+ * greenfield consumer) failed the gate deterministically on first try. The
+ * gate is now registered only when its consumer contract is satisfied
+ * (`probeBaselinesGate`): at least one enabled kind carries a committed
+ * baseline, OR the consumer opted into fail-closed enforcement via
+ * `delivery.quality.requireBaselines`. When no baselines are committed and
+ * none are required, the gate is skipped with a logged reason (via `log`)
+ * instead of a blocking failure.
+ *
+ * @param {{ config?: object, epicBranch?: string, cwd?: string, packageScripts?: Record<string, string>, presentBaselines?: string[]|Set<string>, log?: (message: string) => void }} [opts]
  *   `config` is the canonical resolved config (`{ project, delivery, ... }`);
  *   gate commands resolve from `project.commands` and the CRAP toggle from
  *   `delivery.quality.gates.crap.enabled`. `epicBranch` is the close run's
  *   integration branch (`epic/<id>` for Epic-attached Stories, the base
  *   branch for standalone Stories). `cwd` is where the `package.json`
- *   coverage-script probe reads from (defaults to `process.cwd()`);
- *   `packageScripts` injects the scripts map directly (tests) and short-
- *   circuits the disk read.
+ *   coverage-script probe and the `baselines/<kind>.json` presence probe
+ *   read from (defaults to `process.cwd()`); `packageScripts` injects the
+ *   scripts map directly (tests) and short-circuits the coverage-script disk
+ *   read; `presentBaselines` injects the set of kinds whose baseline artifact
+ *   exists (tests) and short-circuits the baseline-presence disk read; `log`
+ *   receives the skip reason when the `check-baselines` gate is not
+ *   registered.
  * @returns {Gate[]}
  */
 export function buildDefaultGates({
@@ -168,6 +288,8 @@ export function buildDefaultGates({
   epicBranch,
   cwd,
   packageScripts,
+  presentBaselines,
+  log,
 } = {}) {
   const scripts = packageScripts ?? readPackageScripts(cwd);
   const coverageCaptureActive =
@@ -186,6 +308,14 @@ export function buildDefaultGates({
       ? buildChangedFileScope(epicBranch)
       : null;
   const baselinesGateEnv = buildBaselinesGateEnv(epicBranch);
+  const baselinesDecision = probeBaselinesGate({
+    config,
+    cwd,
+    presentBaselines,
+  });
+  if (!baselinesDecision.register && baselinesDecision.reason) {
+    log?.(`[close-validation] ${baselinesDecision.reason}`);
+  }
   return [
     {
       name: 'typecheck',
@@ -218,23 +348,31 @@ export function buildDefaultGates({
           },
         ]
       : []),
-    {
-      // Story #2210 — unified `check-baselines` gate is the only path for
-      // per-kind regression enforcement. The legacy per-kind in-process
-      // gates were retired because their regression-compare semantics are
-      // fully subsumed by this gate's attribution-wired floor + tolerance +
-      // schema enforcement, and running both paths in series was redundant
-      // and conflict-prone.
-      //
-      // `check-baselines.js` self-skips per-kind gates whose
-      // `enabled === false` is configured, so registering it
-      // unconditionally is safe.
-      name: 'check-baselines',
-      cmd: 'node',
-      args: ['.agents/scripts/check-baselines.js', '--format', 'text'],
-      hint: 'Unified baselines gate breached. Inspect the JSON report (`node .agents/scripts/check-baselines.js`) to see which kind/component/axis fell below floor; remediate the underlying file(s) or — when the regression is intentional — refresh the relevant baseline through its per-kind update script and commit with a `baseline-refresh:` tagged subject.',
-      ...(baselinesGateEnv ? { env: baselinesGateEnv } : {}),
-    },
+    // Story #2210 — unified `check-baselines` gate is the only path for
+    // per-kind regression enforcement. The legacy per-kind in-process gates
+    // were retired because their regression-compare semantics are fully
+    // subsumed by this gate's attribution-wired floor + tolerance + schema
+    // enforcement, and running both paths in series was redundant and
+    // conflict-prone.
+    //
+    // `check-baselines.js` self-skips per-kind gates whose `enabled === false`
+    // is configured. Story #4495: it is now also skipped entirely when the
+    // consumer enables baseline gates but ships no committed baseline artifact
+    // (and has not set `delivery.quality.requireBaselines`) — otherwise the
+    // gate fails deterministically on first try reading a non-existent
+    // `baselines/<kind>.json` (`probeBaselinesGate`). When required-by-config
+    // but absent, it stays registered with a preflight hint naming the fix.
+    ...(baselinesDecision.register
+      ? [
+          {
+            name: 'check-baselines',
+            cmd: 'node',
+            args: ['.agents/scripts/check-baselines.js', '--format', 'text'],
+            hint: baselinesDecision.hint ?? CHECK_BASELINES_HINT,
+            ...(baselinesGateEnv ? { env: baselinesGateEnv } : {}),
+          },
+        ]
+      : []),
   ];
 }
 

package/.agents/scripts/lib/config/acceptance-eval.js

@@ -38,6 +38,7 @@
  */
 export const ACCEPTANCE_EVAL_DEFAULTS = Object.freeze({
   maxRounds: 2,
+  clusterCeiling: 4,
 });
 
 /**
@@ -50,6 +51,22 @@ export const ACCEPTANCE_EVAL_DEFAULTS = Object.freeze({
  */
 export const ACCEPTANCE_EVAL_MAX_ROUNDS_CEILING = 5;
 
+/**
+ * Hard, undisableable ceiling on `clusterCeiling` — the max ACs one
+ * single-delivery acceptance critic scores in a single fresh-context pass
+ * (Epic #4475, M4-B, design §S2a). It is the **acceptance-dilution guard**:
+ * single delivery collapses the whole Epic into one session, so the only
+ * acceptance coverage left is the per-AC-cluster critic fan-out
+ * (`ceil(totalACs / clusterCeiling)` independent maker-blind passes). A
+ * pathologically large `clusterCeiling` would collapse that fan-out to a
+ * single critic scoring every AC at once — exactly the dilution the design
+ * forecloses — so a configured value above this ceiling is clamped down to
+ * it. Kept small on purpose.
+ *
+ * @type {number}
+ */
+export const ACCEPTANCE_EVAL_CLUSTER_CEILING_MAX = 8;
+
 /**
  * Clamp a candidate round count into the inviolable `[1, ceiling]` range.
  * Non-integer / non-finite inputs fall back to the documented default.
@@ -68,19 +85,43 @@ function clampRounds(value, fallback) {
   return candidate;
 }
 
+/**
+ * Clamp a candidate cluster ceiling into the inviolable
+ * `[1, ACCEPTANCE_EVAL_CLUSTER_CEILING_MAX]` range. Non-integer / non-finite
+ * inputs fall back to the documented default. Mirrors `clampRounds` — the
+ * anti-dilution guard cannot be disabled (`clusterCeiling: 0` or a negative
+ * clamps up to 1; an over-max value clamps down to the hard cap).
+ *
+ * @param {unknown} value
+ * @param {number} fallback
+ * @returns {number}
+ */
+function clampClusterCeiling(value, fallback) {
+  const candidate =
+    typeof value === 'number' && Number.isInteger(value) ? value : fallback;
+  if (candidate < 1) return 1;
+  if (candidate > ACCEPTANCE_EVAL_CLUSTER_CEILING_MAX) {
+    return ACCEPTANCE_EVAL_CLUSTER_CEILING_MAX;
+  }
+  return candidate;
+}
+
 /**
  * Read the merged acceptance-eval block. Returns the canonical shape:
  *
  *   {
- *     maxRounds: number,   // clamped into [1, ceiling]
- *     ceiling: number,     // the undisableable hard cap
+ *     maxRounds: number,        // clamped into [1, roundsCeiling]
+ *     ceiling: number,          // the undisableable hard cap on rounds
+ *     clusterCeiling: number,   // clamped into [1, clusterCeilingMax]
+ *     clusterCeilingMax: number // the undisableable hard cap on cluster size
  *   }
  *
- * `maxRounds` is always a positive integer no greater than `ceiling`,
- * regardless of what the resolved config carried.
+ * `maxRounds` is always a positive integer no greater than `ceiling`;
+ * `clusterCeiling` is always a positive integer no greater than
+ * `clusterCeilingMax`, regardless of what the resolved config carried.
  *
  * @param {object | null | undefined} config
- * @returns {{ maxRounds: number, ceiling: number }}
+ * @returns {{ maxRounds: number, ceiling: number, clusterCeiling: number, clusterCeilingMax: number }}
  */
 export function getAcceptanceEval(config) {
   const user = config?.delivery?.acceptanceEval ?? {};
@@ -88,8 +129,14 @@ export function getAcceptanceEval(config) {
     user.maxRounds,
     ACCEPTANCE_EVAL_DEFAULTS.maxRounds,
   );
+  const clusterCeiling = clampClusterCeiling(
+    user.clusterCeiling,
+    ACCEPTANCE_EVAL_DEFAULTS.clusterCeiling,
+  );
   return {
     maxRounds,
     ceiling: ACCEPTANCE_EVAL_MAX_ROUNDS_CEILING,
+    clusterCeiling,
+    clusterCeilingMax: ACCEPTANCE_EVAL_CLUSTER_CEILING_MAX,
   };
 }

package/.agents/scripts/lib/config/delivery-routing.js

@@ -0,0 +1,87 @@
+/**
+ * `delivery.routing` accessor + framework defaults — Epic #4475 (M4-A),
+ * the single-delivery-as-default foundation, plus Epic #4478 (M7-B), the
+ * role-scoped-boot-context flip and the maker-checker sampling floor.
+ *
+ * `delivery.routing.singleDelivery` is the **global kill-switch** for the
+ * single-delivery route. It defaults to `true` (single-delivery is the
+ * default shape for epic-shaped work), and is shipped INERT in M4-A: the
+ * `deliver.md` router's single verdict currently falls through to the
+ * fan-out helper, so flipping this knob has no observable effect until
+ * M4-B wires `deliver-epic-single.md`.
+ *
+ * When set to `false`, `resolveEpicDeliveryRoute` forces EVERY Epic — even
+ * one carrying the `delivery::single` label or a `decompose.shape:"single"`
+ * checkpoint — down the fan-out path. This is the instant, per-consumer
+ * global revert that ships BEFORE the default flips: no code rollback, no
+ * re-plan, just a config edit.
+ *
+ * `delivery.routing.roleScopedAgents` is the **kill-switch for the role-scoped
+ * boot contexts** (Epic #4478, M7-B). It mirrors the `singleDelivery` shape
+ * exactly. It defaults to `true`: a converted spawn (`story-worker`,
+ * `acceptance-critic`) boots on its own `.claude/agents/<role>.md` system
+ * prompt instead of re-paying the full `CLAUDE.md` @-import closure, which is
+ * the whole payoff of the context diet (≈50KB → ≈8KB per spawn). When set to
+ * `false`, every converted spawn falls back to `subagent_type: general-purpose`
+ * — the instant, code-rollback-free per-consumer revert, and the universal
+ * escape for hosts that ignore `.claude/agents/`. Flipping it off never drops a
+ * gate: the fallback is the full-closure agent that ran before M7-B.
+ *
+ * `delivery.routing.freshCriticSampleRate` is the **maker-checker sampling
+ * floor** (Epic #4478, M7-B, Part 2). Risk-routed ceremony sends a low-risk
+ * acceptance cluster down the contract-identical *inline* critic path, but a
+ * fraction of low-risk clusters are still forced through a *fresh-context*
+ * critic so "low risk" never degrades to zero independent checking. The rate is
+ * clamped into `[0, 1]`; `0` disables the floor (pure risk routing), `1` forces
+ * every cluster fresh. The default is `0.2`. See `resolveCeremonyForRisk` in
+ * `lib/orchestration/ceremony-routing.js`.
+ *
+ * Framework-defaults pattern mirrors `lib/config/ci.js#getCiDelivery`.
+ */
+
+export const DELIVERY_ROUTING_DEFAULTS = Object.freeze({
+  singleDelivery: true,
+  roleScopedAgents: true,
+  freshCriticSampleRate: 0.2,
+});
+
+/**
+ * Clamp a candidate sample rate into `[0, 1]`. Non-finite / non-number inputs
+ * fall back to the framework default so a degraded config never yields a
+ * NaN-driven or out-of-range floor.
+ *
+ * @param {unknown} value
+ * @returns {number}
+ */
+function clampSampleRate(value) {
+  if (typeof value !== 'number' || !Number.isFinite(value)) {
+    return DELIVERY_ROUTING_DEFAULTS.freshCriticSampleRate;
+  }
+  if (value < 0) return 0;
+  if (value > 1) return 1;
+  return value;
+}
+
+/**
+ * Read the merged `delivery.routing` block, applying framework defaults for
+ * any field the operator omitted. Accepts the full resolved config, the bare
+ * `delivery` bag, or the bare `routing` bag — mirroring `getCiDelivery`'s
+ * tolerant unwrap so callers can pass whichever shape they hold.
+ *
+ * @param {object | null | undefined} config
+ * @returns {{ singleDelivery: boolean, roleScopedAgents: boolean, freshCriticSampleRate: number }}
+ */
+export function getDeliveryRouting(config) {
+  const routing = config?.delivery?.routing ?? config?.routing ?? config ?? {};
+  return {
+    singleDelivery:
+      typeof routing.singleDelivery === 'boolean'
+        ? routing.singleDelivery
+        : DELIVERY_ROUTING_DEFAULTS.singleDelivery,
+    roleScopedAgents:
+      typeof routing.roleScopedAgents === 'boolean'
+        ? routing.roleScopedAgents
+        : DELIVERY_ROUTING_DEFAULTS.roleScopedAgents,
+    freshCriticSampleRate: clampSampleRate(routing.freshCriticSampleRate),
+  };
+}

package/.agents/scripts/lib/config/explain.js

@@ -204,6 +204,8 @@ const KEY_MEANINGS = Object.freeze({
     'Whether a dedicated refactor stage runs during delivery.',
   'delivery.acceptanceEval.maxRounds':
     'Redraft rounds the per-Story acceptance self-eval loop runs before escalating to agent::blocked (default 2; clamped to a hard ceiling that cannot be disabled).',
+  'delivery.acceptanceEval.clusterCeiling':
+    'Max acceptance criteria one single-delivery acceptance critic scores per fresh-context pass; the Epic ACs are split into ceil(totalACs / clusterCeiling) maker-blind critic clusters (default 4; clamped to [1, 8]).',
 
   // qa.*
   'qa.featureRoot': 'Root directory holding the QA harness .feature files.',

package/.agents/scripts/lib/config-resolver.js

@@ -19,7 +19,7 @@
  * deleted from the resolver wrapper. Every internal call site reads the
  * canonical `project` / `github` / `planning` / `delivery` blocks
  * directly; consumers upgrade in lockstep with the framework bump
- * (see `.agents/rules/git-conventions.md#contract-cutovers-—-no-shim-layer`).
+ * (see `.agents/rules/git-conventions-reference.md#contract-cutovers-—-no-shim-layer`).
  */
 
 import fs from 'node:fs';

package/.agents/scripts/lib/config-settings-schema-delivery.js

@@ -233,6 +233,33 @@ const EPIC_AUDIT_SCHEMA = {
   additionalProperties: false,
 };
 
+// Epic #4475 (M4-A) — single-delivery routing kill-switch.
+// `delivery.routing.singleDelivery` (default true via getDeliveryRouting) is
+// the global kill-switch for the single-delivery route. When true (the
+// default), an Epic marked `delivery::single` at plan time routes to the
+// single-delivery helper; when false, EVERY Epic — even a single-marked one —
+// is forced down the fan-out path (the instant, code-rollback-free per-consumer
+// revert). Shipped INERT in M4-A: the router's single verdict falls through to
+// fan-out until M4-B wires the executor, so the knob has no observable effect
+// yet.
+// Epic #4478 (M7-B) — role-scoped-agent kill-switch + maker-checker floor.
+// `delivery.routing.roleScopedAgents` (default true via getDeliveryRouting)
+// flips converted delivery spawns onto their `.claude/agents/<role>.md` boot
+// context; false falls back to `subagent_type: general-purpose` (the instant
+// per-consumer revert + the escape for hosts that ignore `.claude/agents/`).
+// `delivery.routing.freshCriticSampleRate` (default 0.2, clamped [0, 1]) is the
+// maker-checker sampling floor forcing a fraction of low-risk acceptance
+// clusters through a fresh critic.
+const ROUTING_SCHEMA = {
+  type: 'object',
+  properties: {
+    singleDelivery: { type: 'boolean' },
+    roleScopedAgents: { type: 'boolean' },
+    freshCriticSampleRate: { type: 'number', minimum: 0, maximum: 1 },
+  },
+  additionalProperties: false,
+};
+
 // Story #2899 (Epic #2880) — performance defaults + preflight (F13).
 // `delivery.ci.skipForStoryPushes` (default true via getCiDelivery): when
 // true, pre-push tooling appends a `[skip ci]` trailer to Story-branch
@@ -296,8 +323,8 @@ const PREFLIGHT_SCHEMA = {
  * checkpoint wired into story-deliver (Story #3430, Epic #3418). Strictly
  * additive and default-OFF: when `enabled` is unset or `false`, story-deliver
  * behaves exactly as before. When `true`, the worker runs an advisory
- * post-green refactor pass (the `refactorer` persona +
- * `core/refactoring-discipline` skill) after the suite is green. The stage is
+ * post-green refactor pass (the `core/code-review-and-quality` skill's
+ * Post-Green Refactor Pass) after the suite is green. The stage is
  * advisory only — it never changes existing close-validation gate semantics.
  */
 const REFACTOR_STAGE_SCHEMA = {
@@ -306,7 +333,7 @@ const REFACTOR_STAGE_SCHEMA = {
     enabled: {
       type: 'boolean',
       description:
-        'When true, story-deliver runs an advisory post-green refactor stage (refactorer persona + core/refactoring-discipline skill) after the suite is green. Default false — when unset the stage is skipped and close-validation gate semantics are unchanged.',
+        'When true, story-deliver runs an advisory post-green refactor stage (core/code-review-and-quality skill, Post-Green Refactor Pass) after the suite is green. Default false — when unset the stage is skipped and close-validation gate semantics are unchanged.',
     },
   },
   additionalProperties: false,
@@ -337,6 +364,12 @@ const ACCEPTANCE_EVAL_SCHEMA = {
       description:
         'Maximum number of redraft rounds the acceptance self-eval loop runs before escalating to agent::blocked when criteria remain unmet. Default 2; clamped into [1, hard ceiling] by the resolver so the cap can never be disabled.',
     },
+    clusterCeiling: {
+      type: 'integer',
+      minimum: 1,
+      description:
+        'Epic #4475 (M4-B). Max acceptance criteria one single-delivery acceptance critic scores in a single fresh-context pass. Single delivery clusters the Epic ## Acceptance Table ACs into ceil(totalACs / clusterCeiling) groups and spawns one maker-blind critic per cluster, restoring the distributed acceptance coverage the per-Story critic fan-out gave for free. Default 4; clamped into [1, 8] by the resolver so a large value cannot collapse the fan-out to a single diluted critic. Ignored on the fan-out route.',
+    },
   },
   additionalProperties: false,
 };
@@ -384,6 +417,7 @@ export const DELIVERY_SCHEMA = {
     acceptanceEval: ACCEPTANCE_EVAL_SCHEMA,
     feedbackLoop: FEEDBACK_LOOP_SCHEMA,
     ci: CI_DELIVERY_SCHEMA,
+    routing: ROUTING_SCHEMA,
     preflight: PREFLIGHT_SCHEMA,
     // Cross-Story concurrency-hazard gate (Story #2297). When true,
     // `epic-deliver-prepare` refuses to flip the Epic to

package/.agents/scripts/lib/config-settings-schema-quality.js

@@ -96,6 +96,15 @@ export const QUALITY_SCHEMA = {
     codingGuardrails: CODING_GUARDRAILS_SCHEMA,
     autoRefresh: AUTO_REFRESH_SCHEMA,
     baselineEpsilon: BASELINE_EPSILON_SCHEMA,
+    // Story #4495. Fail-closed baseline-enforcement policy for the unified
+    // check-baselines close-validation gate. Default false: a consumer that
+    // enables baseline gates but has not committed baseline artifacts under
+    // baselines/ gets a clean skip-with-reason from buildDefaultGates rather
+    // than a deterministic first-try close failure. Set true to keep the gate
+    // registered so an absent baseline artifact fails close-validation with a
+    // preflight hint (the fail-closed posture, analogous to
+    // delivery.ci.requireChecks).
+    requireBaselines: { type: 'boolean' },
     // Navigability lens + post-wave integration gate config (Epic #4131,
     // F2/F3/F1/F4). Read by audit-suite/selector.js (route globs) and the
     // deliver-epic.md Phase 6.5 gate (journey suite). Opt-in: absent or empty

package/.agents/scripts/lib/doc-tiers.js

@@ -24,10 +24,16 @@
  *   - `onDemand`      — the on-demand `.agents/rules/*.md` set (instructions.md
  *                       § 1.F): every rule file that is **not** part of the
  *                       always-on core already captured in `alwaysLoaded`.
+ *   - `agentBoot`     — the role-scoped boot contexts `.agents/agents/*.md`
+ *                       (issue #4478). Each is a standalone system prompt a
+ *                       converted spawn boots on **instead of** the always-loaded
+ *                       closure, so it is budgeted independently (per-file ≤8KB
+ *                       ceiling gated by `check-context-budget.js`).
  *
  * A file that could appear in more than one tier is kept in its **highest**
  * tier only (alwaysLoaded > mandatoryRead > digestVisible > onDemand), so the
- * four arrays partition the doc set with no double-counting.
+ * arrays partition the doc set with no double-counting. `agentBoot` is disjoint
+ * from the read-tiers (it lives under `.agents/agents/`, not the doc/rules set).
  *
  * The closure is discovered by parsing `@`-import references and following
  * them recursively (cycle-safe via a visited set). A candidate `@`-token only
@@ -216,6 +222,7 @@ export function docsContextPaths(config) {
  *   mandatoryRead: Array<{ path: string, bytes: number }>,
  *   digestVisible: Array<{ path: string, bytes: number }>,
  *   onDemand: Array<{ path: string, bytes: number }>,
+ *   agentBoot: Array<{ path: string, bytes: number }>,
  * } }}
  */
 export function resolveDocTiers(
@@ -254,7 +261,35 @@ export function resolveDocTiers(
   //    (the always-on ones already live in the alwaysLoaded closure).
   const onDemand = collect(listOnDemandRules(root, fs));
 
-  return { tiers: { alwaysLoaded, mandatoryRead, digestVisible, onDemand } };
+  // 5. agent-boot: role-scoped boot contexts .agents/agents/*.md (#4478). These
+  //    are standalone system prompts, disjoint from the doc read-tiers.
+  const agentBoot = collect(listAgentDefs(root, fs));
+
+  return {
+    tiers: { alwaysLoaded, mandatoryRead, digestVisible, onDemand, agentBoot },
+  };
+}
+
+/**
+ * List the role-scoped agent-boot defs (repo-relative posix): every
+ * `.agents/agents/*.md`. Returns [] when the directory is absent.
+ *
+ * @param {string} root absolute repo root
+ * @param {FsLike} fs
+ * @returns {string[]}
+ */
+function listAgentDefs(root, fs) {
+  const agentsDir = path.resolve(root, '.agents', 'agents');
+  let names;
+  try {
+    names = fs.readdirSync(agentsDir);
+  } catch {
+    return [];
+  }
+  return names
+    .filter((n) => n.endsWith('.md'))
+    .map((n) => path.posix.join('.agents', 'agents', n))
+    .sort();
 }
 
 /**