mandrel 1.94.0 → 2.0.0

package/.agents/scripts/lib/label-taxonomy.js

@@ -4,59 +4,30 @@
  *
  * All label names are sourced from `label-constants.js` so renames only need
  * to happen in one place. Colors come from `LABEL_COLORS` in the same module.
+ *
+ * v2 deleted the behavioral persona concept (`.agents/personas/` +
+ * `persona::*` labels). Role framing for spawns lives in `.agents/agents/`
+ * via `delivery.routing.roleScopedAgents`; QA auth identities live in
+ * `qa.personas` — neither is a GitHub label axis.
  */
 
-import fs from 'node:fs';
-import path from 'node:path';
-import { fileURLToPath } from 'node:url';
 import {
   ACCEPTANCE_LABELS,
   AGENT_LABELS,
   DELIVERY_LABELS,
   LABEL_COLORS,
-  PERSONA_LABEL_PREFIX,
   PLANNING_LABELS,
   STATUS_LABELS,
   TYPE_LABELS,
 } from './label-constants.js';
 
-const PERSONAS_DIR = path.resolve(
-  path.dirname(fileURLToPath(import.meta.url)),
-  '..',
-  '..',
-  'personas',
-);
-
-/**
- * Discover persona labels from `.agents/personas/*.md`. The filename
- * (without extension) is the label suffix — this is the same value the
- * context hydrator uses to resolve `persona::<name>` to its markdown file.
- */
-function buildPersonaLabels() {
-  return fs
-    .readdirSync(PERSONAS_DIR)
-    .filter((f) => f.endsWith('.md'))
-    .map((f) => f.slice(0, -3))
-    .sort()
-    .map((name) => ({
-      name: `${PERSONA_LABEL_PREFIX}${name}`,
-      color: LABEL_COLORS.PERSONA,
-      description: `${name} persona`,
-    }));
-}
-
 /** @type {Array<{ name: string, color: string, description: string }>} */
 export const LABEL_TAXONOMY = [
   // Type
-  {
-    name: TYPE_LABELS.EPIC,
-    color: LABEL_COLORS.TYPE,
-    description: 'Epic-level work item',
-  },
   {
     name: TYPE_LABELS.STORY,
     color: LABEL_COLORS.TYPE,
-    description: 'User story under an Epic',
+    description: 'Story work item',
   },
 
   // Agent State
@@ -95,9 +66,6 @@ export const LABEL_TAXONOMY = [
     description: 'Blocked by a dependency',
   },
 
-  // Persona — dynamically derived from .agents/personas/*.md
-  ...buildPersonaLabels(),
-
   // Acceptance axis — explicit opt-out signal for Epics that
   // intentionally have no acceptance-table coverage (waives the Epic
   // body's ## Acceptance Table section — Story #4324).
@@ -108,15 +76,13 @@ export const LABEL_TAXONOMY = [
   },
 
   // Planning axis — operator-applied waivers for the planning → delivery
-  // handoff gates. Currently the sole entry is the `healthcheck-waived`
-  // override consumed by `plan-persist.js` when the inline healthcheck
-  // (`runPlanHealthcheck`) returned `ok: false` for a reason the
-  // operator has triaged and accepted.
+  // handoff gates. `healthcheck-waived` remains for tickets that still
+  // carry the historical label; the healthcheck CLI was retired.
   {
     name: PLANNING_LABELS.HEALTHCHECK_WAIVED,
     color: LABEL_COLORS.PLANNING,
     description:
-      'Operator override — allows agent::ready handoff despite a failing post-plan healthcheck',
+      'Historical operator override for the retired post-plan healthcheck',
   },
 
   // Delivery routing — applied by `plan-persist.js` when the risk verdict

package/.agents/scripts/lib/observability/active-story-env.js

@@ -7,7 +7,7 @@
  * This module is the single writer/clearer of those vars:
  *
  *   - `setActiveStoryEnv({ epicId, storyId, workCwd })` is called from
- *     `story-init.js` after the worktree is materialised. It sets the
+ *     `single-story-init.js` after the worktree is materialised. It sets the
  *     vars on the current `process.env` (so any child commands the
  *     orchestrator spawns inherit them) and exports them to a sibling
  *     `.env.local` inside the worktree. The harness re-spawns the

package/.agents/scripts/lib/observability/hook-heartbeat.js

@@ -1,11 +1,11 @@
 /**
  * hook-heartbeat.js — Epic #4476 (M5): heartbeats OFF the token stream.
  *
- * Today the `story.heartbeat` / `slice.heartbeat` forward-progress signal the
- * `/deliver` §2e Idle Watchdog (`wave-tick.js --check-idle 30`) reads is an
- * **LLM obligation**: the delivery workflow instructs the agent to run
+ * Before M5, the `story.heartbeat` / `slice.heartbeat` forward-progress
+ * signal that idle-watchdog consumers read from the lifecycle ledger was an
+ * **LLM obligation**: the delivery workflow instructed the agent to run
  * `story-phase.js` / `slice-phase.js --event heartbeat` at least once per
- * meaningful step, and every such call is a full-priced LLM turn re-reading
+ * meaningful step, and every such call was a full-priced LLM turn re-reading
  * ~100k of cached context just to append one NDJSON line.
  *
  * This module makes that liveness signal a **free byproduct of the agent
@@ -19,11 +19,10 @@
  * mechanism moves off the token stream.
  *
  * ## Robustness contract (mirrors `tool-trace-hook.js`)
- *   - **No-op outside an active Story / slice.** When neither a valid
- *     `{ CC_EPIC_ID, CC_STORY_ID }` (fan-out child) nor a valid
- *     `{ CC_EPIC_ID, CC_SLICE_ID }` (single-delivery session) pair is present
- *     in the environment, `emitHeartbeatFromHook` returns without touching the
- *     filesystem.
+ *   - **No-op outside an active Story with an Epic-scoped ledger.** When a
+ *     valid `{ CC_EPIC_ID, CC_STORY_ID }` pair is not present in the
+ *     environment (v2 standalone Stories omit `CC_EPIC_ID`), `emitHeartbeatFromHook`
+ *     returns without touching the filesystem.
  *   - **Best-effort.** Every failure is swallowed. A heartbeat is
  *     observability, not state; a hook must never block tool execution.
  *   - **Throttled across processes.** Command hooks are spawned as fresh
@@ -39,7 +38,6 @@ import { statSync, utimesSync, writeFileSync } from 'node:fs';
 import path from 'node:path';
 
 import { epicTempDir } from '../config/temp-paths.js';
-import { emitSliceHeartbeat } from '../orchestration/lifecycle/emit-slice-lifecycle.js';
 import { emitStoryHeartbeat } from '../orchestration/lifecycle/emit-story-heartbeat.js';
 
 /**
@@ -53,25 +51,22 @@ const HEARTBEAT_MIN_INTERVAL_MS = 60_000;
 /**
  * Resolve the heartbeat target from the active-Story / active-slice env vars.
  *
- * Precedence: a present `CC_STORY_ID` (fan-out Story child) wins over
- * `CC_SLICE_ID` (single-delivery session) — the two are never set together in
- * practice, but the ordering keeps the resolution deterministic if they were.
- *
  * A `story.heartbeat` requires a parent `epicId` (its schema pins
  * `epicId >= 1`), so a **standalone** Story (`CC_STORY_ID` set, `CC_EPIC_ID`
  * absent) yields `null` — there is no Epic-scoped ledger to write to and the
  * standalone path is not watched by the Epic idle watchdog. The trace hook
  * still records that context's traces; only the heartbeat is skipped.
  *
+ * Inert `slice.*` lifecycle (and `CC_SLICE_ID` heartbeats) were removed in
+ * the v2 ceremony lock-in — `## Slicing` is prose-only.
+ *
  * @param {NodeJS.ProcessEnv} [env]
  * @returns {{ kind: 'story', epicId: number, storyId: number, operator?: string }
- *          | { kind: 'slice', epicId: number, sliceId: string, operator?: string }
  *          | null}
  */
 export function resolveHeartbeatTarget(env = process.env) {
   const epicRaw = env.CC_EPIC_ID;
   const storyRaw = env.CC_STORY_ID;
-  const sliceRaw = env.CC_SLICE_ID;
   const operator =
     typeof env.CC_OPERATOR === 'string' && env.CC_OPERATOR.length > 0
       ? env.CC_OPERATOR
@@ -93,17 +88,6 @@ export function resolveHeartbeatTarget(env = process.env) {
     };
   }
 
-  if (sliceRaw) {
-    if (typeof sliceRaw !== 'string' || sliceRaw.length === 0) return null;
-    if (!epicOk) return null;
-    return {
-      kind: 'slice',
-      epicId,
-      sliceId: sliceRaw,
-      ...(operator ? { operator } : {}),
-    };
-  }
-
   return null;
 }
 
@@ -115,11 +99,7 @@ export function resolveHeartbeatTarget(env = process.env) {
  * @returns {string}
  */
 export function heartbeatMarkerName(target) {
-  const key =
-    target.kind === 'story'
-      ? `story-${target.storyId}`
-      : `slice-${String(target.sliceId).replace(/[^A-Za-z0-9._-]/g, '_')}`;
-  return `.heartbeat-${key}`;
+  return `.heartbeat-story-${target.storyId}`;
 }
 
 /**
@@ -191,26 +171,14 @@ export function emitHeartbeatFromHook({
     }
 
     const timestamp = now.toISOString();
-    let res;
-    if (target.kind === 'story') {
-      res = emitStoryHeartbeat({
-        epicId: target.epicId,
-        storyId: target.storyId,
-        phase: 'implementing',
-        timestamp,
-        ...(target.operator ? { operator: target.operator } : {}),
-        config: config ?? undefined,
-      });
-    } else {
-      res = emitSliceHeartbeat({
-        epicId: target.epicId,
-        sliceId: target.sliceId,
-        phase: 'implementing',
-        timestamp,
-        ...(target.operator ? { operator: target.operator } : {}),
-        config: config ?? undefined,
-      });
-    }
+    const res = emitStoryHeartbeat({
+      epicId: target.epicId,
+      storyId: target.storyId,
+      phase: 'implementing',
+      timestamp,
+      ...(target.operator ? { operator: target.operator } : {}),
+      config: config ?? undefined,
+    });
     touchMarker(markerPath, now);
     return { emitted: true, kind: target.kind, ledgerPath: res?.ledgerPath };
   } catch {

package/.agents/scripts/lib/observability/source-classifier.js

@@ -57,7 +57,7 @@ function toScanString(value) {
 /**
  * Return true when `haystack` contains any framework prefix as a
  * substring. We use `includes` (not `startsWith`) because a command line
- * like `node .agents/scripts/story-init.js` carries the prefix in the
+ * like `node .agents/scripts/single-story-init.js` carries the prefix in the
  * middle, and a failing-path like `repo/.agents/foo.js` may carry an
  * absolute prefix.
  *
@@ -83,13 +83,13 @@ function containsFrameworkPrefix(haystack) {
  * Framework-wins: if either input matches a framework prefix, the result
  * is `"framework"` even when the other input looks consumer-shaped. This
  * matters for mixed cases like a consumer test invoking
- * `node .agents/scripts/story-init.js` — that's framework friction even
+ * `node .agents/scripts/single-story-init.js` — that's framework friction even
  * though the failing test path lives under the consumer.
  *
  * @param {unknown} failingPath  The path of the file or directory the
  *                               signal blames (e.g. `"tests/foo.test.js"`).
  * @param {unknown} command       The command line the signal blames
- *                                (e.g. `"node .agents/scripts/story-init.js"`).
+ *                                (e.g. `"node .agents/scripts/single-story-init.js"`).
  * @returns {"framework"|"consumer"}
  */
 export function classifyPathSource(failingPath, command) {

package/.agents/scripts/lib/onboard/init-tail.js

@@ -37,9 +37,7 @@ import { STUB_MARKER, scaffoldDocs } from './scaffold-docs.js';
  */
 export const PLAN_HANDOFF_TEXT =
   '\n✅  Mandrel is ready. Start your first project:\n\n' +
-  '    /plan --idea "<one-line description of what you want to build>"\n\n' +
-  'Or, if you already have a `type::epic` Issue open:\n\n' +
-  '    /plan <epicId>\n';
+  '    /plan --seed "<one-line description of what you want to build>"\n';
 
 // ---------------------------------------------------------------------------
 // Internal helpers

package/.agents/scripts/lib/orchestration/audit-lens-routing.js

@@ -0,0 +1,128 @@
+/**
+ * audit-lens-routing.js — risk-envelope → audit-lens roster helpers.
+ *
+ * Extracted from `code-review.js` so the review runner stays focused on
+ * executing a review pass, while callers that only need risk→lens mapping
+ * (ceremony routing, plan-run epilogue consumers, unit tests) import a
+ * smaller pure module.
+ */
+
+import { selectAuditStrategy } from '../dynamic-workflow/capability.js';
+
+/**
+ * The axes whose presence (at `high` risk) routes a specific post-delivery
+ * audit lens. Mirrors the audit-workflow names under
+ * `.agents/workflows/audit-*.md`. Story #3939 broadened the routing so every
+ * high-risk REQUIRED axis maps to a lens rather than leaving three of them
+ * (`data-migration`, `destructive-mutation`, `billing`) routing nothing:
+ *
+ *   - `security`             → `audit-security`     (auth/secret boundary)
+ *   - `public-api`           → `audit-architecture` (the canonical
+ *                              architectural axis; a breaking public surface)
+ *   - `data-migration`       → `audit-quality`      (migration correctness +
+ *                              regression coverage)
+ *   - `destructive-mutation` → `audit-security`     (irreversible mutation is
+ *                              an auth/abuse boundary; co-routes with
+ *                              `security`, de-duplicated)
+ *   - `billing`              → `audit-privacy`      (money + the PII/consent
+ *                              surface that travels with it)
+ *   - `critical-workflow`    → `audit-quality`      (the load-bearing path
+ *                              warrants the deepest coverage pass)
+ *
+ * The `visible-behavior` axis intentionally routes NO lens: it forces the
+ * acceptance-spec disposition at plan time and no audit lens maps cleanly to
+ * it. Any other axis (or a low/medium-risk axis) contributes no lens.
+ *
+ * Every key here MUST be a value in the `axis` enum of
+ * `.agents/schemas/risk-verdict.schema.json` — the verdict-derived envelope
+ * can only ever carry schema-valid axes, so a key absent from that enum is
+ * unreachable dead routing (Story #3889 removed the unreachable
+ * `architecture` key; the architectural axis is `public-api`).
+ */
+const AXIS_TO_LENS = Object.freeze({
+  security: 'audit-security',
+  'public-api': 'audit-architecture',
+  'data-migration': 'audit-quality',
+  'destructive-mutation': 'audit-security',
+  billing: 'audit-privacy',
+  'critical-workflow': 'audit-quality',
+});
+
+/**
+ * Stable output order for routed lenses so the lens list is deterministic
+ * regardless of axis ordering in the verdict. Every lens any axis can route
+ * appears here exactly once; `resolveAuditLenses` filters this canonical
+ * order down to the matched set (Story #3939).
+ */
+const LENS_ORDER = Object.freeze([
+  'audit-security',
+  'audit-architecture',
+  'audit-quality',
+  'audit-privacy',
+]);
+
+/**
+ * Resolve the set of post-delivery audit lenses a judged risk envelope routes.
+ *
+ * High-risk axes map to their audit lens via {@link AXIS_TO_LENS}; only axes
+ * judged `high` contribute (a `low`/`medium` axis carries no lens). The result
+ * is de-duplicated and stably ordered by {@link LENS_ORDER} so an envelope
+ * listing the `public-api` axis more than once routes `['audit-architecture']`
+ * once, not twice — and two distinct axes routing the same lens (e.g.
+ * `security` + `destructive-mutation` both → `audit-security`) collapse to a
+ * single entry. A low-risk envelope — or any envelope with no high-risk routed
+ * axis — resolves to an empty array (no lens beyond the existing baseline
+ * gates).
+ *
+ * Pure function — no I/O, no side effects.
+ *
+ * @param {{ axes?: Array<{ axis?: string, level?: string }> }} [envelope]
+ * @returns {string[]} Ordered, de-duplicated audit-lens identifiers.
+ */
+export function resolveAuditLenses(envelope = {}) {
+  const axes = Array.isArray(envelope?.axes) ? envelope.axes : [];
+  const matched = new Set();
+  for (const entry of axes) {
+    if (!entry || entry.level !== 'high') continue;
+    const lens = AXIS_TO_LENS[entry.axis];
+    if (lens) matched.add(lens);
+  }
+  return LENS_ORDER.filter((lens) => matched.has(lens));
+}
+
+/**
+ * Build the post-delivery audit-lens execution plan for a judged risk
+ * envelope. Each routed lens (see {@link resolveAuditLenses}) is paired with a
+ * strategy decision from the **existing** `selectAuditStrategy` engine — no new
+ * audit machinery is introduced. A low-risk envelope resolves to an empty
+ * `lenses` array and runs no audit beyond the baseline gates (Story #3876).
+ *
+ * Pure with respect to the injected `selectAuditStrategyFn` (default is the
+ * shared dynamic-workflow engine, which is itself pure over its snapshot).
+ *
+ * @param {{ axes?: Array<{ axis?: string, level?: string }> }} [envelope]
+ * @param {{
+ *   snapshot?: object,
+ *   forceStrategy?: ('orchestrated'|'sequential'|null),
+ *   selectAuditStrategyFn?: typeof selectAuditStrategy,
+ * }} [opts]
+ * @returns {{ lenses: string[], plan: Array<{ lens: string, strategy: string, reason: string, forced: boolean }> }}
+ */
+export function planAuditLenses(envelope = {}, opts = {}) {
+  const {
+    snapshot = {},
+    forceStrategy = null,
+    selectAuditStrategyFn = selectAuditStrategy,
+  } = opts;
+  const lenses = resolveAuditLenses(envelope);
+  const plan = lenses.map((lens) => {
+    const decision = selectAuditStrategyFn({ snapshot, forceStrategy });
+    return {
+      lens,
+      strategy: decision.strategy,
+      reason: decision.reason,
+      forced: decision.forced,
+    };
+  });
+  return { lenses, plan };
+}

package/.agents/scripts/lib/orchestration/bookkeeping-outbox.js

@@ -37,24 +37,27 @@ import {
 } from 'node:fs';
 import path from 'node:path';
 
-import { epicTempDir } from '../config/temp-paths.js';
+import { runTempDir } from '../config/temp-paths.js';
 import { STATE_LABELS } from './ticketing/reads.js';
 import { upsertStructuredComment } from './ticketing/state.js';
 import { transitionTicketState } from './ticketing/transition.js';
 
-/** Canonical basename for the per-Epic bookkeeping outbox. */
+/** Canonical basename for the per-run bookkeeping outbox. */
 const OUTBOX_BASENAME = 'bookkeeping-outbox.ndjson';
 
 /**
- * Resolve the canonical outbox path for an Epic:
- * `temp/epic-<id>/bookkeeping-outbox.ndjson`.
+ * Resolve the canonical outbox path for a run:
+ * `temp/run-<id>/bookkeeping-outbox.ndjson`.
+ *
+ * Uses `runTempDir` directly; callers may still pass an `epicId`-named
+ * variable while the broader file/flag rename remains out of this pass.
  *
  * @param {number} epicId
  * @param {object} [config] Resolved config (tempRoot).
  * @returns {string}
  */
 export function outboxPathFor(epicId, config) {
-  return path.join(epicTempDir(epicId, config), OUTBOX_BASENAME);
+  return path.join(runTempDir(epicId, config), OUTBOX_BASENAME);
 }
 
 /**

package/.agents/scripts/lib/orchestration/ceremony-routing.js

@@ -1,25 +1,33 @@
 /**
- * lib/orchestration/ceremony-routing.js — risk-routed acceptance ceremony
- * resolver (Epic #4478, M7-B, Part 2).
+ * lib/orchestration/ceremony-routing.js — ceremony-profile + risk-routed
+ * acceptance ceremony resolver.
  *
  * The sibling of `review-depth.js` (risk → review depth) and
- * `code-review.js#resolveAuditLenses` (risk → audit lens): it folds the
- * planner-judged risk envelope into a per-cluster ceremony decision for the
- * single-delivery acceptance critic — **fresh-context spawn** vs the
- * contract-identical **inline** critic. It does NOT invent a new risk score
- * and it does NOT own clustering.
+ * `audit-lens-routing.js#resolveAuditLenses` (risk → audit lens): it folds the
+ * operator ceremony profile and the planner-judged risk envelope into a
+ * per-cluster ceremony decision for the single-delivery acceptance critic —
+ * **fresh-context spawn** vs the contract-identical **inline** critic. It
+ * does NOT invent a new risk score and it does NOT own clustering.
+ *
+ * ## Ceremony profiles (`delivery.routing.ceremonyProfile`)
+ *
+ *   - `minimal`  — always `inline` (skip fresh critic + sampling floor).
+ *                  Use for tiny N=1 Stories the operator trusts.
+ *   - `standard` — risk-routed (default). Low → inline (+ sampling floor);
+ *                  medium/high → fresh.
+ *   - `strict`   — always `fresh` regardless of risk.
  *
  * ## The load-bearing invariant (M4-B acceptance floor — DO NOT VIOLATE)
  *
  * Risk-routing chooses fresh-vs-inline **PER CLUSTER**. It NEVER changes the
  * cluster COUNT. The cluster count is `ceil(totalACs / clusterCeiling)` with
  * the non-disableable `[1, 8]` clamp, owned entirely by
- * `acceptance-clusters.js` and untouched here. A low-risk Epic still gets one
+ * `acceptance-clusters.js` and untouched here. A low-risk Story still gets one
  * verdict per cluster — just possibly authored inline instead of by a fresh
  * sub-agent. This module takes the cluster index as an INPUT and returns a
  * decision for that one cluster; it has no way to add or remove clusters.
  *
- * ## Tier rules (per cluster)
+ * ## Tier rules (per cluster, `standard` profile)
  *
  *   - `high` risk        → `fresh`   (a fresh-context maker-blind spawn).
  *   - `medium` risk      → `fresh`   (fail toward more ceremony, never less —
@@ -27,7 +35,7 @@
  *   - `low` risk         → `inline`  (the contract-identical inline critic),
  *                                     UNLESS the maker-checker sampling floor
  *                                     selects this cluster → `fresh`.
- *   - missing / unknown  → `fresh`   (fail-safe: an Epic that skipped `/plan`
+ *   - missing / unknown  → `fresh`   (fail-safe: a Story that skipped `/plan`
  *                                     has no risk verdict; treat it as needing
  *                                     the full fresh-context ceremony, exactly
  *                                     as `review-depth` degrades to `standard`
@@ -36,18 +44,42 @@
  *
  * ## Maker-checker sampling floor
  *
- * Even at `low` risk, a fraction of clusters (`freshCriticSampleRate`, default
- * 0.2) is forced `fresh` so low risk never means zero independent checking. The
- * selection is **deterministic** in the cluster index (a fixed stride), so it
- * is stable across re-runs and — critically — never changes the cluster count:
- * it only re-labels which of the fixed set of clusters run fresh.
+ * Even at `low` risk under `standard`, a fraction of clusters
+ * (`freshCriticSampleRate`, default 0.2) is forced `fresh` so low risk never
+ * means zero independent checking. The selection is **deterministic** in the
+ * cluster index (a fixed stride), so it is stable across re-runs and —
+ * critically — never changes the cluster count: it only re-labels which of
+ * the fixed set of clusters run fresh. Profiles `minimal` and `strict`
+ * ignore the sampling floor.
  *
  * Pure and total: inputs in, decision out. No I/O, no throws. `null` /
  * `undefined` / malformed inputs degrade to `fresh` + `full` ceremony.
  *
  * @typedef {'fresh'|'inline'} CeremonyMode
  * @typedef {'low'|'medium'|'high'} RiskLevel
+ * @typedef {'minimal'|'standard'|'strict'} CeremonyProfile
+ */
+
+/** @type {readonly CeremonyProfile[]} */
+export const CEREMONY_PROFILES = Object.freeze([
+  'minimal',
+  'standard',
+  'strict',
+]);
+
+/**
+ * Normalize an operator/config ceremony profile. Unknown values degrade to
+ * `standard` (fail toward the documented default, not toward less ceremony).
+ *
+ * @param {unknown} value
+ * @returns {CeremonyProfile}
  */
+export function normalizeCeremonyProfile(value) {
+  if (value === 'minimal' || value === 'standard' || value === 'strict') {
+    return value;
+  }
+  return 'standard';
+}
 
 /**
  * Decide whether the sampling floor forces this low-risk cluster fresh.
@@ -79,16 +111,22 @@ export function sampledFresh(clusterIndex, rate) {
 }
 
 /**
- * Resolve the acceptance ceremony for one cluster from the judged risk level
- * and the maker-checker sampling floor. See the module header for the tier
- * rules and the untouchable cluster-count invariant.
+ * Resolve the acceptance ceremony for one cluster from the ceremony profile,
+ * judged risk level, and the maker-checker sampling floor. See the module
+ * header for the tier rules and the untouchable cluster-count invariant.
  *
  * @param {{
  *   overallLevel?: (RiskLevel|string|null|undefined),
  *   clusterIndex?: (number|null|undefined),
  *   freshCriticSampleRate?: (number|null|undefined),
+ *   ceremonyProfile?: (CeremonyProfile|string|null|undefined),
  * }} [input]
- * @returns {{ mode: CeremonyMode, reason: string, sampled: boolean }}
+ * @returns {{
+ *   mode: CeremonyMode,
+ *   reason: string,
+ *   sampled: boolean,
+ *   profile: CeremonyProfile,
+ * }}
  */
 export function resolveCeremonyForRisk(input = {}) {
   const overallLevel =
@@ -99,12 +137,33 @@ export function resolveCeremonyForRisk(input = {}) {
     input && typeof input === 'object'
       ? input.freshCriticSampleRate
       : undefined;
+  const profile = normalizeCeremonyProfile(
+    input && typeof input === 'object' ? input.ceremonyProfile : undefined,
+  );
+
+  if (profile === 'minimal') {
+    return {
+      mode: 'inline',
+      reason: 'ceremonyProfile=minimal: inline critic (no fresh spawn)',
+      sampled: false,
+      profile,
+    };
+  }
+  if (profile === 'strict') {
+    return {
+      mode: 'fresh',
+      reason: 'ceremonyProfile=strict: fresh-context critic',
+      sampled: false,
+      profile,
+    };
+  }
 
   if (overallLevel === 'high') {
     return {
       mode: 'fresh',
       reason: 'high-risk: fresh-context critic',
       sampled: false,
+      profile,
     };
   }
   if (overallLevel === 'medium') {
@@ -112,6 +171,7 @@ export function resolveCeremonyForRisk(input = {}) {
       mode: 'fresh',
       reason: 'medium-risk: fresh-context critic (fail toward more ceremony)',
       sampled: false,
+      profile,
     };
   }
   if (overallLevel === 'low') {
@@ -121,21 +181,24 @@ export function resolveCeremonyForRisk(input = {}) {
         reason:
           'low-risk cluster forced fresh by the maker-checker sampling floor',
         sampled: true,
+        profile,
       };
     }
     return {
       mode: 'inline',
       reason: 'low-risk: contract-identical inline critic',
       sampled: false,
+      profile,
     };
   }
   // Missing / unknown / malformed risk → fail-safe fresh + full ceremony,
   // matching how review-depth.js and deriveRiskEnvelope degrade on an
-  // unjudged Epic.
+  // unjudged Story.
   return {
     mode: 'fresh',
     reason:
       'risk absent/unknown: fail-safe fresh-context critic + full ceremony',
     sampled: false,
+    profile,
   };
 }