mandrel 1.93.0 → 2.0.0

package/.agents/scripts/lib/checks/story-init-not-backgrounded.js

@@ -1,17 +1,17 @@
 /**
  * story-init-not-backgrounded — refuse-and-print check.
  *
- * Detects orchestration call sites that invoke `story-init.js` via the
- * Bash tool's `run_in_background: true` mode (with subsequent `Monitor`
+ * Detects orchestration call sites that invoke `single-story-init.js` via
+ * the Bash tool's `run_in_background: true` mode (with subsequent `Monitor`
  * waiting on completion) instead of a synchronous Bash call with a
  * 10-minute timeout. This guards the failure mode where `Monitor`'s wait
  * is not equivalent to script exit — a sub-agent that exits during a
- * Monitor wait kills `story-init.js` mid-batch, leaving a half-initialized
- * worktree and a failed wave aggregator.
+ * Monitor wait kills `single-story-init.js` mid-run, leaving a
+ * half-initialized worktree.
  *
  * Scope: 'epic-deliver', 'story-close', 'retro'. The check runs at every
- * preflight surface that has the opportunity to invoke story-init —
- * primarily `epic-deliver`'s wave loop — and surfaces as a retro audit
+ * preflight surface that has the opportunity to invoke Story init —
+ * primarily `/deliver`'s init step — and surfaces as a retro audit
  * signal if the failure mode resurfaces during a sprint.
  *
  * The check is `refuse-and-print`. Auto-rewriting an orchestration call
@@ -20,7 +20,8 @@
  * synchronous-call replacement pattern so they can apply it deliberately.
  *
  * Implementation note: we scan `.agents/` (markdown + js) for the
- * juxtaposition of a `story-init.js` reference and a backgrounding token
+ * juxtaposition of a `story-init.js` reference (which also matches
+ * `single-story-init.js` as a suffix) and a backgrounding token
  * (`run_in_background: true`, the literal `Monitor` tool name as a
  * fan-out target, or `&` shell backgrounding) within a small line window.
  */
@@ -39,7 +40,8 @@ const WINDOW_LINES = 20;
  * - `run_in_background: true` — Bash tool's backgrounding flag.
  * - `detached: true` — child_process.spawn options that detach the
  *   subprocess from the parent's lifecycle, equivalent to backgrounding.
- * - `story-init.js &` — POSIX shell ampersand backgrounding.
+ * - `single-story-init.js &` — POSIX shell ampersand backgrounding
+ *   (the pattern matches the `story-init.js` suffix of both names).
  */
 const BACKGROUND_TOKENS = [
   /run_in_background\s*:\s*true/,
@@ -85,12 +87,12 @@ function walkSources(dir) {
 
 /**
  * For one file, return an array of `{ line, kind }` offences: every line
- * referencing `story-init.js` that has a backgrounding token in the same
- * ±WINDOW_LINES window.
+ * referencing `story-init.js` (including `single-story-init.js`) that has
+ * a backgrounding token in the same ±WINDOW_LINES window.
  *
- * The check explicitly excludes the `story-init.js` file itself and any
- * dedicated check module (this file): the source-of-truth implementation
- * legitimately mentions itself.
+ * The check explicitly excludes the `single-story-init.js` file itself and
+ * any dedicated check module (this file): the source-of-truth
+ * implementation legitimately mentions itself.
  *
  * @param {string} file
  * @param {string} src
@@ -100,12 +102,12 @@ function scanFile(file, src) {
   const offences = [];
   // Don't flag the actual story-init script, self-references, or the
   // parallel-tooling helper — the helper documents both Rule 2
-  // (run_in_background) and the story-init.js anti-pattern in adjacent
-  // bullets, which collides with the scanner's ±20-line window even
-  // though there is no real invocation in the prose.
+  // (run_in_background) and the story-init backgrounding anti-pattern in
+  // adjacent bullets, which collides with the scanner's ±20-line window
+  // even though there is no real invocation in the prose.
   const basename = path.basename(file);
   if (
-    basename === 'story-init.js' ||
+    basename === 'single-story-init.js' ||
     basename === 'story-init-not-backgrounded.js' ||
     basename === 'story-init-not-backgrounded.test.js' ||
     basename === 'parallel-tooling.md'
@@ -129,13 +131,13 @@ function scanFile(file, src) {
 }
 
 const FIX_COMMAND = [
-  '# Invoke story-init.js synchronously with a 10-minute timeout. The',
-  '# script is idempotent on partial state, so re-running after a',
+  '# Invoke single-story-init.js synchronously with a 10-minute timeout.',
+  '# The script is idempotent on partial state, so re-running after a',
   '# half-initialized worktree is safe — but blocking on the Bash call',
   '# is what prevents the half-init state in the first place.',
   '#',
   '# Replacement pattern (Bash tool):',
-  '#   Bash(timeout: 600000, command: "node .agents/scripts/story-init.js --story <id>")',
+  '#   Bash(timeout: 600000, command: "node .agents/scripts/single-story-init.js --story <id>")',
   '#',
   '# Do NOT use:',
   '#   Bash(run_in_background: true, ...) + Monitor(...)',
@@ -177,7 +179,7 @@ export default {
       id: 'story-init-not-backgrounded',
       severity: 'blocker',
       scope: state?.scope ?? 'epic-deliver',
-      summary: `${offences.length} orchestration call site(s) invoke story-init.js with Monitor backgrounding`,
+      summary: `${offences.length} orchestration call site(s) invoke single-story-init.js with Monitor backgrounding`,
       detail,
       fixCommand: FIX_COMMAND,
       autoCorrectable: false,

package/.agents/scripts/lib/cli/standard-args.js

@@ -13,7 +13,6 @@
  *
  * Contract
  * --------
- *   parseStandardCliArgs(argv, schema?) → { values, positionals }
  *   parseStandardCliArgs({ argv, schema?, extras? }) → { values, positionals }
  *
  *   - `argv`    — `process.argv.slice(2)` shape; the helper does NOT strip
@@ -99,24 +98,20 @@ function camelCase(name) {
 }
 
 /**
- * Normalize the call signature. Accepts either positional
- * `(argv, schema)` (backward compat) or the object form
- * `({ argv, schema, extras })`.
+ * Validate the call signature. Only the object form
+ * `({ argv, schema, extras })` is accepted.
  *
- * @param {unknown} argvOrOpts
- * @param {unknown} maybeSchema
+ * @param {unknown} opts
  * @returns {{ argv: string[], schema: object | undefined, extras: object | undefined }}
  */
-function normaliseCallSignature(argvOrOpts, maybeSchema) {
-  if (
-    argvOrOpts !== null &&
-    typeof argvOrOpts === 'object' &&
-    !Array.isArray(argvOrOpts)
-  ) {
-    const { argv, schema, extras } = argvOrOpts;
-    return { argv: argv ?? [], schema, extras };
+function normaliseCallSignature(opts) {
+  if (opts === null || typeof opts !== 'object' || Array.isArray(opts)) {
+    throw new Error(
+      'parseStandardCliArgs: options must be a plain object ({ argv, schema?, extras? })',
+    );
   }
-  return { argv: argvOrOpts ?? [], schema: maybeSchema, extras: undefined };
+  const { argv, schema, extras } = opts;
+  return { argv: argv ?? [], schema, extras };
 }
 
 /**
@@ -313,15 +308,11 @@ function normaliseValues(raw, extras) {
  * Parse the dispatcher's shared CLI flag surface. See module docstring
  * for the full contract.
  *
- * @param {string[]|{argv?: string[], schema?: object, extras?: object}} argvOrOpts
- * @param {Record<string, { required?: boolean }>} [maybeSchema]
+ * @param {{ argv?: string[], schema?: object, extras?: object }} [opts]
  * @returns {{ values: Record<string, unknown>, positionals: string[] }}
  */
-export function parseStandardCliArgs(argvOrOpts = [], maybeSchema) {
-  const { argv, schema, extras } = normaliseCallSignature(
-    argvOrOpts,
-    maybeSchema,
-  );
+export function parseStandardCliArgs(opts = {}) {
+  const { argv, schema, extras } = normaliseCallSignature(opts);
   if (!Array.isArray(argv)) {
     throw new Error('parseStandardCliArgs: argv must be an array');
   }

package/.agents/scripts/lib/cli-args.js

@@ -40,6 +40,12 @@ function coerceBooleanFlag(value) {
   return Boolean(value);
 }
 
+/** Like coerceBooleanFlag, but preserves `undefined` (flag absent). */
+function optionalBooleanFlag(value) {
+  if (value === undefined) return undefined;
+  return coerceBooleanFlag(value);
+}
+
 /**
  * Standardized CLI argument parser for sprint scripts.
  * Supports options like --epic, --story, --dry-run, --skip-dashboard.
@@ -58,7 +64,8 @@ export function parseSprintArgs(args = process.argv) {
       'skip-sync': { type: 'boolean', default: false },
       'no-auto-merge': { type: 'boolean', default: false },
       'no-full-scope-crap': { type: 'boolean', default: false },
-      'wait-merge': { type: 'boolean', default: false },
+      // No default — absent means "use delivery.routing.closeAndLand".
+      'wait-merge': { type: 'boolean' },
       'no-wait-merge': { type: 'boolean', default: false },
       executor: { type: 'string' },
       cwd: { type: 'string' },
@@ -81,11 +88,11 @@ export function parseSprintArgs(args = process.argv) {
     skipSync: coerceBooleanFlag(values['skip-sync']),
     noAutoMerge: coerceBooleanFlag(values['no-auto-merge']),
     noFullScopeCrap: coerceBooleanFlag(values['no-full-scope-crap']),
-    // Story #4428 — headless must-land signal for `single-story-close.js`:
-    // `--wait-merge` opts a headless run into polling to merge confirmation
-    // instead of resting at `agent::closing`; `--no-wait-merge` is the
-    // explicit opt-out (see `single-story-close/phases/options.js`).
-    waitForMerge: coerceBooleanFlag(values['wait-merge']),
+    // Close-and-land: `--wait-merge` forces land-in-close; `--no-wait-merge`
+    // opts out. When neither flag is present (`undefined`),
+    // `parseCloseOptions` applies `delivery.routing.closeAndLand` (default
+    // true) so attended and headless delivers share the same happy path.
+    waitForMerge: optionalBooleanFlag(values['wait-merge']),
     noWaitForMerge: coerceBooleanFlag(values['no-wait-merge']),
     executor: values.executor ?? null,
     // Resolve worktree cwd from flag or env. Empty string/whitespace → null.
@@ -95,7 +102,9 @@ export function parseSprintArgs(args = process.argv) {
       null,
     recutOf: parseTicketId(values['recut-of']),
     // Story #4253: pre-resolved Epic linkage threaded by the /deliver
-    // fan-out so `story-init.js` can skip the per-Story `getEpic` round-trip.
+    // fan-out so `single-story-init.js` can skip redundant Epic lookups when
+    // the parent already threaded Epic context (pre-v2; field retained for
+    // CLI compatibility).
     resume: values.resume ?? false,
     restart: values.restart ?? false,
     noEvidence: values['no-evidence'] ?? false,

package/.agents/scripts/lib/close-validation/gates.js

@@ -6,7 +6,12 @@
  * runner (`INDEPENDENT_GATE_NAMES` / `partitionGates`).
  */
 
+import { existsSync } from 'node:fs';
+
+import { _internals as baselineReaderInternals } from '../baselines/reader.js';
+import { getQuality } from '../config/quality.js';
 import { hasNpmScript, readPackageScripts } from '../npm-scripts.js';
+import { KNOWN_KINDS } from '../orchestration/check-baselines/phases/parse-args.js';
 import {
   buildFormatHint,
   FORMAT_CHECK_FALLBACK,
@@ -115,6 +120,106 @@ function buildTestGateEntry(coverageCaptureActive) {
   return [{ name: 'test', cmd: 'npm', args: ['test'] }];
 }
 
+const CHECK_BASELINES_HINT =
+  'Unified baselines gate breached. Inspect the JSON report (`node .agents/scripts/check-baselines.js`) to see which kind/component/axis fell below floor; remediate the underlying file(s) or — when the regression is intentional — refresh the relevant baseline through its per-kind update script and commit with a `baseline-refresh:` tagged subject.';
+
+/**
+ * Baseline kinds the resolved config enables for the unified
+ * `check-baselines` gate. Mirrors `selectEnabledGates` in the check-baselines
+ * pipeline (a kind runs when its `gates.<kind>` block is present and not
+ * explicitly disabled) so the registration probe's view of "what will run"
+ * matches the gate's own view exactly.
+ *
+ * @param {object|undefined|null} config canonical resolved config
+ * @returns {string[]}
+ */
+function enabledBaselineKinds(config) {
+  const gates = getQuality(config)?.gates ?? {};
+  return KNOWN_KINDS.filter((kind) => {
+    const block = gates[kind];
+    return block && typeof block === 'object' && block.enabled !== false;
+  });
+}
+
+/**
+ * Whether the consumer opted into fail-closed baseline enforcement via
+ * `delivery.quality.requireBaselines: true`. Default false — a consumer that
+ * enables baseline gates but has not committed baseline artifacts gets a
+ * clean skip (see `probeBaselinesGate`) rather than a deterministic first-try
+ * close failure. Fail-closed baseline posture (#4495).
+ *
+ * @param {object|undefined|null} config
+ * @returns {boolean}
+ */
+function baselinesRequiredByConfig(config) {
+  return config?.delivery?.quality?.requireBaselines === true;
+}
+
+function toKindSet(presentBaselines) {
+  if (presentBaselines instanceof Set) return presentBaselines;
+  if (Array.isArray(presentBaselines)) return new Set(presentBaselines);
+  return new Set();
+}
+
+/**
+ * Probe whether the `check-baselines` consumer contract is satisfied before
+ * registering the gate (#4495 — mirrors the #4473/#4480 coverage-capture
+ * remedy). The contract: every enabled baseline kind carries a committed
+ * baseline artifact on disk (the same path the gate's reader resolves).
+ *
+ * Decision shape:
+ *   - `{ register: false, reason }` — skip (caller logs the reason). Baseline
+ *     gates ARE enabled but none of the enabled kinds carry a committed
+ *     baseline artifact and the consumer has not set `requireBaselines`. This
+ *     is the bench/greenfield case: the gate would otherwise fail
+ *     deterministically on first try reading a non-existent
+ *     `baselines/<kind>.json`.
+ *   - `{ register: true }` — at least one committed baseline artifact is
+ *     present, OR no baseline kinds are enabled at all (the gate then self-
+ *     skips every kind and exits a clean empty PASS — no failure to avoid, so
+ *     the gate stays registered exactly as pre-#4495); run the gate.
+ *   - `{ register: true, hint }` — baselines are required-by-config
+ *     (`requireBaselines: true`) but absent; keep the gate registered so it
+ *     fails, with a preflight hint naming the fix.
+ *
+ * @param {{ config?: object, cwd?: string, presentBaselines?: string[]|Set<string> }} opts
+ *   `presentBaselines` injects the set of kinds whose baseline artifact
+ *   exists (tests), short-circuiting the on-disk probe.
+ * @returns {{ register: boolean, reason?: string, hint?: string }}
+ */
+function probeBaselinesGate({ config, cwd, presentBaselines } = {}) {
+  const enabled = enabledBaselineKinds(config);
+  if (enabled.length === 0) {
+    // No enabled baseline kinds → `check-baselines.js` self-skips every kind
+    // and exits clean (an empty PASS). There is no deterministic-failure risk
+    // to avoid, so keep the gate registered exactly as it was pre-#4495; the
+    // #4495 skip is confined strictly to the read-miss-would-fail case below.
+    return { register: true };
+  }
+  const injected =
+    presentBaselines != null ? toKindSet(presentBaselines) : null;
+  const present = enabled.filter((kind) =>
+    injected
+      ? injected.has(kind)
+      : existsSync(baselineReaderInternals.resolveBaselinePath(kind, { cwd })),
+  );
+  if (present.length > 0) return { register: true };
+  if (baselinesRequiredByConfig(config)) {
+    return {
+      register: true,
+      hint:
+        `Baselines are required (delivery.quality.requireBaselines) but no committed baseline artifact was found for enabled kind(s): ${enabled.join(', ')}. ` +
+        'Generate the baseline(s) with the per-kind update script (e.g. `npm run crap:update`, `npm run maintainability:update`) and commit them, or unset requireBaselines to skip the gate until baselines exist.',
+    };
+  }
+  return {
+    register: false,
+    reason:
+      `check-baselines skipped — enabled kind(s) ${enabled.join(', ')} have no committed baseline artifact under baselines/ ` +
+      'and delivery.quality.requireBaselines is not set. Commit baseline artifacts (or set requireBaselines to enforce them) to activate the gate.',
+  };
+}
+
 /**
  * Build the canonical close-validation gate list.
  *
@@ -152,15 +257,30 @@ function buildTestGateEntry(coverageCaptureActive) {
  * instead of a deterministic close failure with no test gate at all. The
  * probe reads `package.json` at `cwd` (the gate execution directory).
  *
- * @param {{ config?: object, epicBranch?: string, cwd?: string, packageScripts?: Record<string, string> }} [opts]
+ * Story #4495 — the unified `check-baselines` gate reads a committed
+ * `baselines/<kind>.json` for each enabled kind; a consumer that enables
+ * baseline gates but ships no `baselines/` tree (every bench sandbox, any
+ * greenfield consumer) failed the gate deterministically on first try. The
+ * gate is now registered only when its consumer contract is satisfied
+ * (`probeBaselinesGate`): at least one enabled kind carries a committed
+ * baseline, OR the consumer opted into fail-closed enforcement via
+ * `delivery.quality.requireBaselines`. When no baselines are committed and
+ * none are required, the gate is skipped with a logged reason (via `log`)
+ * instead of a blocking failure.
+ *
+ * @param {{ config?: object, epicBranch?: string, cwd?: string, packageScripts?: Record<string, string>, presentBaselines?: string[]|Set<string>, log?: (message: string) => void }} [opts]
  *   `config` is the canonical resolved config (`{ project, delivery, ... }`);
  *   gate commands resolve from `project.commands` and the CRAP toggle from
  *   `delivery.quality.gates.crap.enabled`. `epicBranch` is the close run's
  *   integration branch (`epic/<id>` for Epic-attached Stories, the base
  *   branch for standalone Stories). `cwd` is where the `package.json`
- *   coverage-script probe reads from (defaults to `process.cwd()`);
- *   `packageScripts` injects the scripts map directly (tests) and short-
- *   circuits the disk read.
+ *   coverage-script probe and the `baselines/<kind>.json` presence probe
+ *   read from (defaults to `process.cwd()`); `packageScripts` injects the
+ *   scripts map directly (tests) and short-circuits the coverage-script disk
+ *   read; `presentBaselines` injects the set of kinds whose baseline artifact
+ *   exists (tests) and short-circuits the baseline-presence disk read; `log`
+ *   receives the skip reason when the `check-baselines` gate is not
+ *   registered.
  * @returns {Gate[]}
  */
 export function buildDefaultGates({
@@ -168,6 +288,8 @@ export function buildDefaultGates({
   epicBranch,
   cwd,
   packageScripts,
+  presentBaselines,
+  log,
 } = {}) {
   const scripts = packageScripts ?? readPackageScripts(cwd);
   const coverageCaptureActive =
@@ -186,6 +308,14 @@ export function buildDefaultGates({
       ? buildChangedFileScope(epicBranch)
       : null;
   const baselinesGateEnv = buildBaselinesGateEnv(epicBranch);
+  const baselinesDecision = probeBaselinesGate({
+    config,
+    cwd,
+    presentBaselines,
+  });
+  if (!baselinesDecision.register && baselinesDecision.reason) {
+    log?.(`[close-validation] ${baselinesDecision.reason}`);
+  }
   return [
     {
       name: 'typecheck',
@@ -218,30 +348,38 @@ export function buildDefaultGates({
           },
         ]
       : []),
-    {
-      // Story #2210 — unified `check-baselines` gate is the only path for
-      // per-kind regression enforcement. The legacy per-kind in-process
-      // gates were retired because their regression-compare semantics are
-      // fully subsumed by this gate's attribution-wired floor + tolerance +
-      // schema enforcement, and running both paths in series was redundant
-      // and conflict-prone.
-      //
-      // `check-baselines.js` self-skips per-kind gates whose
-      // `enabled === false` is configured, so registering it
-      // unconditionally is safe.
-      name: 'check-baselines',
-      cmd: 'node',
-      args: ['.agents/scripts/check-baselines.js', '--format', 'text'],
-      hint: 'Unified baselines gate breached. Inspect the JSON report (`node .agents/scripts/check-baselines.js`) to see which kind/component/axis fell below floor; remediate the underlying file(s) or — when the regression is intentional — refresh the relevant baseline through its per-kind update script and commit with a `baseline-refresh:` tagged subject.',
-      ...(baselinesGateEnv ? { env: baselinesGateEnv } : {}),
-    },
+    // Story #2210 — unified `check-baselines` gate is the only path for
+    // per-kind regression enforcement. The legacy per-kind in-process gates
+    // were retired because their regression-compare semantics are fully
+    // subsumed by this gate's attribution-wired floor + tolerance + schema
+    // enforcement, and running both paths in series was redundant and
+    // conflict-prone.
+    //
+    // `check-baselines.js` self-skips per-kind gates whose `enabled === false`
+    // is configured. Story #4495: it is now also skipped entirely when the
+    // consumer enables baseline gates but ships no committed baseline artifact
+    // (and has not set `delivery.quality.requireBaselines`) — otherwise the
+    // gate fails deterministically on first try reading a non-existent
+    // `baselines/<kind>.json` (`probeBaselinesGate`). When required-by-config
+    // but absent, it stays registered with a preflight hint naming the fix.
+    ...(baselinesDecision.register
+      ? [
+          {
+            name: 'check-baselines',
+            cmd: 'node',
+            args: ['.agents/scripts/check-baselines.js', '--format', 'text'],
+            hint: baselinesDecision.hint ?? CHECK_BASELINES_HINT,
+            ...(baselinesGateEnv ? { env: baselinesGateEnv } : {}),
+          },
+        ]
+      : []),
   ];
 }
 
 /**
  * Default gate list resolved with no consumer config — uses the
  * `npm run typecheck` fallback for the typecheck gate. Call sites that have a
- * resolved config object in scope (e.g. `story-close.js`) should
+ * resolved config object in scope (e.g. `single-story-close.js`) should
  * prefer `buildDefaultGates({ config })` so a configured
  * `project.commands.typecheck` is honoured.
  *

package/.agents/scripts/lib/config/acceptance-eval.js

@@ -38,6 +38,7 @@
  */
 export const ACCEPTANCE_EVAL_DEFAULTS = Object.freeze({
   maxRounds: 2,
+  clusterCeiling: 4,
 });
 
 /**
@@ -50,6 +51,22 @@ export const ACCEPTANCE_EVAL_DEFAULTS = Object.freeze({
  */
 export const ACCEPTANCE_EVAL_MAX_ROUNDS_CEILING = 5;
 
+/**
+ * Hard, undisableable ceiling on `clusterCeiling` — the max ACs one
+ * single-delivery acceptance critic scores in a single fresh-context pass
+ * (Epic #4475, M4-B, design §S2a). It is the **acceptance-dilution guard**:
+ * single delivery collapses the whole Epic into one session, so the only
+ * acceptance coverage left is the per-AC-cluster critic fan-out
+ * (`ceil(totalACs / clusterCeiling)` independent maker-blind passes). A
+ * pathologically large `clusterCeiling` would collapse that fan-out to a
+ * single critic scoring every AC at once — exactly the dilution the design
+ * forecloses — so a configured value above this ceiling is clamped down to
+ * it. Kept small on purpose.
+ *
+ * @type {number}
+ */
+export const ACCEPTANCE_EVAL_CLUSTER_CEILING_MAX = 8;
+
 /**
  * Clamp a candidate round count into the inviolable `[1, ceiling]` range.
  * Non-integer / non-finite inputs fall back to the documented default.
@@ -68,19 +85,43 @@ function clampRounds(value, fallback) {
   return candidate;
 }
 
+/**
+ * Clamp a candidate cluster ceiling into the inviolable
+ * `[1, ACCEPTANCE_EVAL_CLUSTER_CEILING_MAX]` range. Non-integer / non-finite
+ * inputs fall back to the documented default. Mirrors `clampRounds` — the
+ * anti-dilution guard cannot be disabled (`clusterCeiling: 0` or a negative
+ * clamps up to 1; an over-max value clamps down to the hard cap).
+ *
+ * @param {unknown} value
+ * @param {number} fallback
+ * @returns {number}
+ */
+function clampClusterCeiling(value, fallback) {
+  const candidate =
+    typeof value === 'number' && Number.isInteger(value) ? value : fallback;
+  if (candidate < 1) return 1;
+  if (candidate > ACCEPTANCE_EVAL_CLUSTER_CEILING_MAX) {
+    return ACCEPTANCE_EVAL_CLUSTER_CEILING_MAX;
+  }
+  return candidate;
+}
+
 /**
  * Read the merged acceptance-eval block. Returns the canonical shape:
  *
  *   {
- *     maxRounds: number,   // clamped into [1, ceiling]
- *     ceiling: number,     // the undisableable hard cap
+ *     maxRounds: number,        // clamped into [1, roundsCeiling]
+ *     ceiling: number,          // the undisableable hard cap on rounds
+ *     clusterCeiling: number,   // clamped into [1, clusterCeilingMax]
+ *     clusterCeilingMax: number // the undisableable hard cap on cluster size
  *   }
  *
- * `maxRounds` is always a positive integer no greater than `ceiling`,
- * regardless of what the resolved config carried.
+ * `maxRounds` is always a positive integer no greater than `ceiling`;
+ * `clusterCeiling` is always a positive integer no greater than
+ * `clusterCeilingMax`, regardless of what the resolved config carried.
  *
  * @param {object | null | undefined} config
- * @returns {{ maxRounds: number, ceiling: number }}
+ * @returns {{ maxRounds: number, ceiling: number, clusterCeiling: number, clusterCeilingMax: number }}
  */
 export function getAcceptanceEval(config) {
   const user = config?.delivery?.acceptanceEval ?? {};
@@ -88,8 +129,14 @@ export function getAcceptanceEval(config) {
     user.maxRounds,
     ACCEPTANCE_EVAL_DEFAULTS.maxRounds,
   );
+  const clusterCeiling = clampClusterCeiling(
+    user.clusterCeiling,
+    ACCEPTANCE_EVAL_DEFAULTS.clusterCeiling,
+  );
   return {
     maxRounds,
     ceiling: ACCEPTANCE_EVAL_MAX_ROUNDS_CEILING,
+    clusterCeiling,
+    clusterCeilingMax: ACCEPTANCE_EVAL_CLUSTER_CEILING_MAX,
   };
 }

package/.agents/scripts/lib/config/ci.js

@@ -1,30 +1,17 @@
 /**
- * `delivery.ci` accessor + framework defaults — Story #2899 (Epic #2880, F13)
- * and Story #4356 (Epic #4355).
+ * `delivery.ci` accessor + framework defaults — Story #4356 (Epic #4355).
  *
- * `delivery.ci.skipForStoryPushes` defaults to `true` so per-Task Story-branch
- * commits append a `[skip ci]` trailer out of the box. The Epic-branch merge
- * commit produced by `story-close.js`'s merge runner never carries the
- * marker — that path is the one consumers actually want CI to evaluate.
- *
- * Story #4356 adds the CI-aware delivery knobs: `earlyPr` (default `true`)
- * gates whether /deliver opens the Epic PR early so CI warms while later
- * waves run; `watch` tunes the merge/CI watch poll loop; and `autoMerge`
+ * Surviving knobs: `watch` tunes the merge/CI watch poll loop; `autoMerge`
  * (default `"trust-ci"`) selects the merge posture — `"trust-ci"` merges once
  * required checks pass, `"strict"` additionally requires a clean review gate.
  *
- * Story #4472 adds `requireChecks` (default `false`): when `true` the
- * AutomergePredicate treats a checks-less repo ("no checks reported") as a
- * hard block rather than green, so a consumer that wants fail-closed-without-
- * checks as policy opts into it explicitly instead of the framework blocking
- * implicitly.
+ * Retired (no production readers on v2 Story-only delivery): `earlyPr`
+ * (Epic early-PR warmup) and `requireChecks` (AutomergePredicate escape hatch
+ * whose listener was never landed).
  */
 
 export const CI_DELIVERY_DEFAULTS = Object.freeze({
-  skipForStoryPushes: true,
-  earlyPr: true,
   autoMerge: 'trust-ci',
-  requireChecks: false,
 });
 
 /**
@@ -35,27 +22,15 @@ export const CI_DELIVERY_DEFAULTS = Object.freeze({
  * defaults; only the scalar knobs carry framework defaults here.
  *
  * @param {object | null | undefined} config
- * @returns {{ skipForStoryPushes: boolean, earlyPr: boolean, autoMerge: 'trust-ci' | 'strict', requireChecks: boolean, watch: object | undefined }}
+ * @returns {{ autoMerge: 'trust-ci' | 'strict', watch: object | undefined }}
  */
 export function getCiDelivery(config) {
   const ci = config?.delivery?.ci ?? config?.ci ?? config ?? {};
   return {
-    skipForStoryPushes:
-      typeof ci.skipForStoryPushes === 'boolean'
-        ? ci.skipForStoryPushes
-        : CI_DELIVERY_DEFAULTS.skipForStoryPushes,
-    earlyPr:
-      typeof ci.earlyPr === 'boolean'
-        ? ci.earlyPr
-        : CI_DELIVERY_DEFAULTS.earlyPr,
     autoMerge:
       ci.autoMerge === 'trust-ci' || ci.autoMerge === 'strict'
         ? ci.autoMerge
         : CI_DELIVERY_DEFAULTS.autoMerge,
-    requireChecks:
-      typeof ci.requireChecks === 'boolean'
-        ? ci.requireChecks
-        : CI_DELIVERY_DEFAULTS.requireChecks,
     watch:
       ci.watch && typeof ci.watch === 'object' ? { ...ci.watch } : undefined,
   };