mandrel 1.94.0 → 2.1.0

package/.agents/scripts/lib/close-validation/telemetry.js

@@ -3,19 +3,25 @@
  */
 
 import { writeFile as defaultWriteFile } from 'node:fs/promises';
-import { storyArtifactPath } from '../config/temp-paths.js';
+import path from 'node:path';
+import { storyTempDir } from '../config/temp-paths.js';
 import { getSpawnCount as defaultGetSpawnCount } from '../gh-exec.js';
 
 /**
  * Throw-away ghSpawnCount emitter (Story #1795 / Epic #1788).
  *
  * Writes the current `gh-exec` spawn counter to
- * `temp/epic-<eid>/stories/story-<sid>/gh-spawn-count.json` so the
- * `analyze-execution.js` child process can read it and emit a
- * `ghSpawnCount` field on the `story-perf-summary` payload. The Story-
- * close orchestrator calls this inside `runPostMergeClose` right before
- * the perf-summary phase, capturing every `gh` invocation from preflight
- * through the merge in one counter snapshot.
+ * `temp/run-<id>/stories/story-<sid>/gh-spawn-count.json`.
+ *
+ * Story #4545 — its reader is gone: `analyze-execution.js` consumed this file
+ * to emit a `ghSpawnCount` field on the `story-perf-summary` payload, and both
+ * that CLI and that payload were deleted with the execution-analysis surface.
+ * The writer itself already had no production caller before that (the
+ * `runPostMergeClose` orchestrator named below went in the v2.0.0 cutover), so
+ * this module is production-dead and kept alive only by its own test — the
+ * test-importer blind spot the dead-exports ratchet cannot see. It is left in
+ * place rather than deleted because reviving spawn telemetry against the live
+ * close path is a decision, not a sweep.
  *
  * @param {object} opts
  * @param {number|string} opts.epicId
@@ -50,7 +56,10 @@ export async function emitGhSpawnCount({
     );
     return { status: 'failed', reason: 'counter-read-failed' };
   }
-  const targetPath = storyArtifactPath(eid, sid, 'gh-spawn-count.json', config);
+  const targetPath = path.join(
+    storyTempDir(eid, sid, config),
+    'gh-spawn-count.json',
+  );
   const payload = {
     kind: 'gh-spawn-count',
     epicId: eid,

package/.agents/scripts/lib/config/ci.js

@@ -1,30 +1,17 @@
 /**
- * `delivery.ci` accessor + framework defaults — Story #2899 (Epic #2880, F13)
- * and Story #4356 (Epic #4355).
+ * `delivery.ci` accessor + framework defaults — Story #4356 (Epic #4355).
  *
- * `delivery.ci.skipForStoryPushes` defaults to `true` so per-Task Story-branch
- * commits append a `[skip ci]` trailer out of the box. The Epic-branch merge
- * commit produced by `story-close.js`'s merge runner never carries the
- * marker — that path is the one consumers actually want CI to evaluate.
- *
- * Story #4356 adds the CI-aware delivery knobs: `earlyPr` (default `true`)
- * gates whether /deliver opens the Epic PR early so CI warms while later
- * waves run; `watch` tunes the merge/CI watch poll loop; and `autoMerge`
+ * Surviving knobs: `watch` tunes the merge/CI watch poll loop; `autoMerge`
  * (default `"trust-ci"`) selects the merge posture — `"trust-ci"` merges once
  * required checks pass, `"strict"` additionally requires a clean review gate.
  *
- * Story #4472 adds `requireChecks` (default `false`): when `true` the
- * AutomergePredicate treats a checks-less repo ("no checks reported") as a
- * hard block rather than green, so a consumer that wants fail-closed-without-
- * checks as policy opts into it explicitly instead of the framework blocking
- * implicitly.
+ * Retired (no production readers on v2 Story-only delivery): `earlyPr`
+ * (Epic early-PR warmup) and `requireChecks` (AutomergePredicate escape hatch
+ * whose listener was never landed).
  */
 
 export const CI_DELIVERY_DEFAULTS = Object.freeze({
-  skipForStoryPushes: true,
-  earlyPr: true,
   autoMerge: 'trust-ci',
-  requireChecks: false,
 });
 
 /**
@@ -35,27 +22,15 @@ export const CI_DELIVERY_DEFAULTS = Object.freeze({
  * defaults; only the scalar knobs carry framework defaults here.
  *
  * @param {object | null | undefined} config
- * @returns {{ skipForStoryPushes: boolean, earlyPr: boolean, autoMerge: 'trust-ci' | 'strict', requireChecks: boolean, watch: object | undefined }}
+ * @returns {{ autoMerge: 'trust-ci' | 'strict', watch: object | undefined }}
  */
 export function getCiDelivery(config) {
   const ci = config?.delivery?.ci ?? config?.ci ?? config ?? {};
   return {
-    skipForStoryPushes:
-      typeof ci.skipForStoryPushes === 'boolean'
-        ? ci.skipForStoryPushes
-        : CI_DELIVERY_DEFAULTS.skipForStoryPushes,
-    earlyPr:
-      typeof ci.earlyPr === 'boolean'
-        ? ci.earlyPr
-        : CI_DELIVERY_DEFAULTS.earlyPr,
     autoMerge:
       ci.autoMerge === 'trust-ci' || ci.autoMerge === 'strict'
         ? ci.autoMerge
         : CI_DELIVERY_DEFAULTS.autoMerge,
-    requireChecks:
-      typeof ci.requireChecks === 'boolean'
-        ? ci.requireChecks
-        : CI_DELIVERY_DEFAULTS.requireChecks,
     watch:
       ci.watch && typeof ci.watch === 'object' ? { ...ci.watch } : undefined,
   };

package/.agents/scripts/lib/config/delivery-routing.js

@@ -1,48 +1,46 @@
 /**
- * `delivery.routing` accessor + framework defaults — Epic #4475 (M4-A),
- * the single-delivery-as-default foundation, plus Epic #4478 (M7-B), the
+ * `delivery.routing` accessor + framework defaults — Epic #4478 (M7-B), the
  * role-scoped-boot-context flip and the maker-checker sampling floor.
  *
- * `delivery.routing.singleDelivery` is the **global kill-switch** for the
- * single-delivery route. It defaults to `true` (single-delivery is the
- * default shape for epic-shaped work), and is shipped INERT in M4-A: the
- * `deliver.md` router's single verdict currently falls through to the
- * fan-out helper, so flipping this knob has no observable effect until
- * M4-B wires `deliver-epic-single.md`.
- *
- * When set to `false`, `resolveEpicDeliveryRoute` forces EVERY Epic — even
- * one carrying the `delivery::single` label or a `decompose.shape:"single"`
- * checkpoint — down the fan-out path. This is the instant, per-consumer
- * global revert that ships BEFORE the default flips: no code rollback, no
- * re-plan, just a config edit.
+ * Stage 6 dropped `delivery.routing.singleDelivery` (the v1 epic
+ * single-vs-fan-out kill-switch). v2 has one Story delivery path; routing
+ * here is only about spawn boot context and critic sampling.
  *
  * `delivery.routing.roleScopedAgents` is the **kill-switch for the role-scoped
- * boot contexts** (Epic #4478, M7-B). It mirrors the `singleDelivery` shape
- * exactly. It defaults to `true`: a converted spawn (`story-worker`,
- * `acceptance-critic`) boots on its own `.claude/agents/<role>.md` system
- * prompt instead of re-paying the full `CLAUDE.md` @-import closure, which is
- * the whole payoff of the context diet (≈50KB → ≈8KB per spawn). When set to
- * `false`, every converted spawn falls back to `subagent_type: general-purpose`
- * — the instant, code-rollback-free per-consumer revert, and the universal
- * escape for hosts that ignore `.claude/agents/`. Flipping it off never drops a
- * gate: the fallback is the full-closure agent that ran before M7-B.
+ * boot contexts** (Epic #4478, M7-B). It defaults to `true`: a converted spawn
+ * (`story-worker`, `acceptance-critic`) boots on its own
+ * `.claude/agents/<role>.md` system prompt instead of re-paying the full
+ * `CLAUDE.md` @-import closure, which is the whole payoff of the context diet
+ * (≈50KB → ≈8KB per spawn). When set to `false`, every converted spawn falls
+ * back to `subagent_type: general-purpose` — the instant, code-rollback-free
+ * per-consumer revert, and the universal escape for hosts that ignore
+ * `.claude/agents/`. Flipping it off never drops a gate: the fallback is the
+ * full-closure agent that ran before M7-B.
  *
  * `delivery.routing.freshCriticSampleRate` is the **maker-checker sampling
- * floor** (Epic #4478, M7-B, Part 2). Risk-routed ceremony sends a low-risk
- * acceptance cluster down the contract-identical *inline* critic path, but a
- * fraction of low-risk clusters are still forced through a *fresh-context*
- * critic so "low risk" never degrades to zero independent checking. The rate is
- * clamped into `[0, 1]`; `0` disables the floor (pure risk routing), `1` forces
- * every cluster fresh. The default is `0.2`. See `resolveCeremonyForRisk` in
+ * floor** (Epic #4478, M7-B, Part 2). Ceremony routing sends the acceptance
+ * clusters of a change set that touches no sensitive path down the
+ * contract-identical *inline* critic path, but a fraction of them are still
+ * forced through a *fresh-context* critic so a low derived level never degrades
+ * to zero independent checking. The rate is clamped into `[0, 1]`; `0` disables
+ * the floor (pure level routing), `1` forces every cluster fresh. The default is
+ * `0.2`. See `resolveCeremonyForRisk` in
  * `lib/orchestration/ceremony-routing.js`.
  *
  * Framework-defaults pattern mirrors `lib/config/ci.js#getCiDelivery`.
  */
 
 export const DELIVERY_ROUTING_DEFAULTS = Object.freeze({
-  singleDelivery: true,
   roleScopedAgents: true,
   freshCriticSampleRate: 0.2,
+  /** @type {'minimal'|'standard'|'strict'} */
+  ceremonyProfile: 'standard',
+  /**
+   * When true (default), attended `/deliver` lands through merge in one
+   * close (`--wait-merge` semantics) instead of stopping at `agent::closing`.
+   * Operators opt out per-run with `--no-wait-merge`.
+   */
+  closeAndLand: true,
 });
 
 /**
@@ -62,6 +60,19 @@ function clampSampleRate(value) {
   return value;
 }
 
+/**
+ * Normalize ceremony profile; unknown values → `standard`.
+ *
+ * @param {unknown} value
+ * @returns {'minimal'|'standard'|'strict'}
+ */
+function normalizeCeremonyProfile(value) {
+  if (value === 'minimal' || value === 'standard' || value === 'strict') {
+    return value;
+  }
+  return DELIVERY_ROUTING_DEFAULTS.ceremonyProfile;
+}
+
 /**
  * Read the merged `delivery.routing` block, applying framework defaults for
  * any field the operator omitted. Accepts the full resolved config, the bare
@@ -69,19 +80,25 @@ function clampSampleRate(value) {
  * tolerant unwrap so callers can pass whichever shape they hold.
  *
  * @param {object | null | undefined} config
- * @returns {{ singleDelivery: boolean, roleScopedAgents: boolean, freshCriticSampleRate: number }}
+ * @returns {{
+ *   roleScopedAgents: boolean,
+ *   freshCriticSampleRate: number,
+ *   ceremonyProfile: 'minimal'|'standard'|'strict',
+ *   closeAndLand: boolean,
+ * }}
  */
 export function getDeliveryRouting(config) {
   const routing = config?.delivery?.routing ?? config?.routing ?? config ?? {};
   return {
-    singleDelivery:
-      typeof routing.singleDelivery === 'boolean'
-        ? routing.singleDelivery
-        : DELIVERY_ROUTING_DEFAULTS.singleDelivery,
     roleScopedAgents:
       typeof routing.roleScopedAgents === 'boolean'
         ? routing.roleScopedAgents
         : DELIVERY_ROUTING_DEFAULTS.roleScopedAgents,
     freshCriticSampleRate: clampSampleRate(routing.freshCriticSampleRate),
+    ceremonyProfile: normalizeCeremonyProfile(routing.ceremonyProfile),
+    closeAndLand:
+      typeof routing.closeAndLand === 'boolean'
+        ? routing.closeAndLand
+        : DELIVERY_ROUTING_DEFAULTS.closeAndLand,
   };
 }

package/.agents/scripts/lib/config/explain.js

@@ -63,13 +63,13 @@ const SECRET_SEGMENT_PATTERNS = Object.freeze([
 const KEY_MEANINGS = Object.freeze({
   // project.*
   'project.baseBranch':
-    'Default base branch Epics and Stories branch from and merge back into.',
+    'Default base branch Stories branch from and merge back into.',
   'project.paths.agentRoot':
     'Directory holding the distributed agent bundle (instructions, skills, scripts).',
   'project.paths.docsRoot':
     'Directory the mandatory docs-context reads resolve against.',
   'project.paths.tempRoot':
-    'Root for gitignored scratch output (per-Epic run state, mirrors, logs).',
+    'Root for gitignored scratch output (per-run state, mirrors, logs).',
   'project.docsContextFiles':
     'Authoritative files an agent must read before starting any task.',
   'project.commands.lintBaseline':
@@ -90,6 +90,8 @@ const KEY_MEANINGS = Object.freeze({
   'github.projectOwner': 'Owner of the GitHub Projects board.',
   'github.operatorHandle':
     'GitHub @handle mentioned when a run needs operator attention.',
+  'github.defaultTimeoutMs':
+    'Default timeout (ms) for GitHub CLI / API calls when a caller does not supply one.',
   'github.branchProtection.enforce':
     'Whether the framework applies branch-protection rules.',
   'github.branchProtection.requiredChecks':
@@ -112,10 +114,6 @@ const KEY_MEANINGS = Object.freeze({
     'Allowlist of events that fire a webhook notification.',
 
   // planning.*
-  'planning.context.maxBytes':
-    'Byte budget for the planning-context payload before summary mode kicks in.',
-  'planning.context.summaryMode':
-    'When the planner switches to a summarized context representation.',
   'planning.codebaseSnapshot.tier':
     'Depth of the structural codebase view threaded into spec authoring.',
   'planning.codebaseSnapshot.include':
@@ -126,28 +124,28 @@ const KEY_MEANINGS = Object.freeze({
     'How many recent commits the snapshot summarizes.',
   'planning.riskHeuristics':
     'Phrases that flag a Story as high-risk for HITL escalation.',
-  'planning.taskSizing.softAcceptanceCount':
-    'Acceptance-criteria count above which a Story is flagged as large (advisory-only — there is no hard acceptance ceiling).',
-  'planning.taskSizing.softFiles':
-    'Touched-file count above which a Story is flagged as large.',
-  'planning.taskSizing.hardFiles':
-    'Touched-file count above which a Story is rejected unless it declares `wide` with a reason.',
   'planning.failOnSharedEditors':
     'Whether shared-editor conflict findings are promoted to hard errors.',
   'planning.requireExplicitCrossStoryDeps':
     'Whether implicit cross-Story dependencies are promoted to hard errors.',
+  'planning.failOnRegistryConflicts':
+    'Whether cross-cutting registry conflict findings are promoted to hard errors.',
+  'planning.failOnLargeFanOut':
+    'Whether large fan-out findings are promoted to hard errors.',
+  'planning.largeFanOutThreshold':
+    'Story count above which a plan is flagged as a large fan-out.',
+  'planning.crossCuttingRegistries':
+    'Glob patterns naming cross-cutting registry files the planner conflict-checks.',
+  'planning.navigation.routeGlobs':
+    'Glob patterns marking paths that add a user-facing route (plan-time reachability gate).',
+  'planning.navigation.navRegistry':
+    'Tokens identifying the nav-registry SSOT a route-adding Story is expected to reference.',
 
   // delivery.*
   'delivery.execution.timeoutMs':
     'Per-execution timeout for orchestrated delivery steps.',
-  'delivery.maxTokenBudget':
-    'Cap on the hydrated task-prompt size handed to an agent.',
   'delivery.lease.ttlMs':
-    'Time-to-live for the Epic lease before a stale claim is reclaimable.',
-  'delivery.ci.skipForStoryPushes':
-    'Whether Story-branch pushes carry a [skip ci] trailer.',
-  'delivery.ci.earlyPr':
-    'Whether /deliver opens the Epic PR early so CI warms during later waves.',
+    'Time-to-live for the delivery lease before a stale claim is reclaimable.',
   'delivery.ci.watch.pollIntervalMs':
     'Poll cadence (ms) for the merge/CI watch loop.',
   'delivery.ci.watch.maxPolls':
@@ -156,40 +154,28 @@ const KEY_MEANINGS = Object.freeze({
     'Maximum times the CI watch may resume after a transient stall.',
   'delivery.ci.autoMerge':
     'Merge posture: trust-ci merges on green checks; strict also requires a clean review gate.',
-  'delivery.preflight.maxStories':
-    'Pre-dispatch ceiling on estimated Story count (no cap when unset).',
-  'delivery.preflight.maxWaves':
-    'Pre-dispatch ceiling on estimated wave count.',
-  'delivery.preflight.maxInstallCostSeconds':
-    'Pre-dispatch ceiling on estimated dependency-install seconds.',
-  'delivery.preflight.maxGithubApiRequests':
-    'Pre-dispatch ceiling on estimated GitHub API request volume.',
-  'delivery.preflight.maxClaudeQuotaTokens':
-    'Pre-dispatch ceiling on estimated Claude quota-token burn.',
   'delivery.docsFreshness.paths':
     'Docs whose freshness is checked at delivery time.',
   'delivery.deliverRunner.concurrencyCap':
-    'Maximum Stories dispatched in parallel within one wave. Default 3 — conservative by design to keep host-quota consumption predictable. Operators running wide-wave Epics with adequate parallel-agent quota should raise this to reduce wall-clock time proportionally.',
-  'delivery.deliverRunner.progressReportIntervalSec':
-    'Cadence for delivery progress reporting.',
-  'delivery.deliverRunner.verifyConcurrencyCap':
-    'Maximum verify steps run in parallel.',
+    'Maximum Stories dispatched in parallel within one wave. Default 3 — conservative by design to keep host-quota consumption predictable. Operators running wide waves with adequate parallel-agent quota should raise this to reduce wall-clock time proportionally.',
   'delivery.worktreeIsolation.enabled':
     'Whether each Story runs in its own git worktree.',
   'delivery.worktreeIsolation.root':
     'Directory under which per-Story worktrees are created.',
   'delivery.worktreeIsolation.nodeModulesStrategy':
-    'How node_modules is provisioned per worktree.',
+    'How node_modules is provisioned per worktree (default clone on darwin/linux; per-worktree on win32).',
   'delivery.worktreeIsolation.primeFromPath':
     'Source path a worktree primes its node_modules from.',
   'delivery.worktreeIsolation.allowSymlinkOnWindows':
     'Whether symlink node_modules strategy is allowed on Windows.',
   'delivery.worktreeIsolation.reapOnSuccess':
     'Whether a worktree is removed after a Story closes cleanly.',
-  'delivery.worktreeIsolation.reapOnCancel':
-    'Whether a worktree is removed after a cancelled run.',
   'delivery.worktreeIsolation.bootstrapFiles':
-    'Files copied into each new worktree (e.g. .env, .mcp.json).',
+    'Files copied into each new worktree (e.g. .env, .mcp.json, local overrides).',
+  'delivery.mergeWatch.intervalSeconds':
+    'Poll cadence (seconds) for the close-and-land merge wait after the arm.',
+  'delivery.mergeWatch.maxBudgetSeconds':
+    'Cumulative wall-clock budget (seconds) across resumes before the merge wait gives up and blocks.',
   'delivery.codeReview.providers':
     'Ordered provider chain the code-review phase consults.',
   'delivery.codeReview.maxFixAttempts':
@@ -198,14 +184,34 @@ const KEY_MEANINGS = Object.freeze({
     'Maximum files an auto-fix may touch in one attempt.',
   'delivery.codeReview.autoFixSeverity':
     'Severity threshold for on-branch code-review remediation (medium fixes 🔴/🟠/🟡, high fixes 🔴/🟠 only; default medium).',
-  'delivery.epicAudit.autoFixSeverity':
-    'Severity threshold for on-branch epic-audit remediation (medium fixes 🔴/🟠/🟡, high fixes 🔴/🟠 only; default medium).',
+  'delivery.routing.roleScopedAgents':
+    'Whether delivery spawns boot on role-scoped .claude/agents/<role>.md contexts.',
+  'delivery.routing.freshCriticSampleRate':
+    'Fraction of low-risk acceptance clusters forced through a fresh-context critic (maker-checker floor).',
+  'delivery.routing.ceremonyProfile':
+    'Acceptance-ceremony depth: minimal (always inline), standard (derived-level routed), or strict (always fresh).',
+  'delivery.routing.closeAndLand':
+    'When true, single-story-close lands through merge in one close (opt out with --no-wait-merge).',
+  'delivery.feedbackLoop.auditResultsAutoFile':
+    'When true, auto-file non-blocking audit findings as follow-up issues.',
+  'delivery.feedbackLoop.retroProposals':
+    'When true, auto-file actionable retro proposals as follow-up issues.',
+  'delivery.quality.formatAutofix.timeoutMs':
+    'Bounded timeout (ms) for the close-time format autofix spawn.',
+  'delivery.quality.requireBaselines':
+    'When true, absent baseline artifacts fail close-validation instead of skipping cleanly.',
+  'delivery.quality.navigability.routeGlobs':
+    'Glob patterns marking user-facing routes for the navigability lens / journey gate.',
+  'delivery.quality.navigability.navRegistry':
+    'Tokens identifying the nav-registry SSOT the navigability lens expects.',
+  'delivery.quality.navigability.journeySuite':
+    'Optional journey-suite path the post-wave navigability integration gate runs.',
   'delivery.refactorStage.enabled':
     'Whether a dedicated refactor stage runs during delivery.',
   'delivery.acceptanceEval.maxRounds':
     'Redraft rounds the per-Story acceptance self-eval loop runs before escalating to agent::blocked (default 2; clamped to a hard ceiling that cannot be disabled).',
   'delivery.acceptanceEval.clusterCeiling':
-    'Max acceptance criteria one single-delivery acceptance critic scores per fresh-context pass; the Epic ACs are split into ceil(totalACs / clusterCeiling) maker-blind critic clusters (default 4; clamped to [1, 8]).',
+    'Max acceptance criteria one single-delivery acceptance critic scores per fresh-context pass; the Story ACs are split into ceil(totalACs / clusterCeiling) maker-blind critic clusters (default 4; clamped to [1, 8]).',
 
   // qa.*
   'qa.featureRoot': 'Root directory holding the QA harness .feature files.',
@@ -240,11 +246,19 @@ const PREFIX_MEANINGS = Object.freeze([
   ],
   ['delivery.quality', 'Delivery-time quality configuration.'],
   ['delivery.signals', 'Threshold for a delivery friction/telemetry signal.'],
-  ['delivery.lifecycle.timeouts', 'Timeout for a lifecycle-bus phase.'],
-  ['delivery.lifecycle', 'Lifecycle-bus configuration.'],
+  ['delivery.mergeWatch', 'Merge-wait poll cadence and wall-clock budget.'],
   [
-    'planning.taskSizing',
-    'Story-sizing threshold for the decompose validator.',
+    'delivery.feedbackLoop',
+    'Opt-out toggles for auto-filing non-blocking findings.',
+  ],
+  [
+    'delivery.routing',
+    'Delivery-spawn routing and acceptance-ceremony profile.',
+  ],
+  ['delivery.ci', 'CI-aware delivery namespace (watch, auto-merge).'],
+  [
+    'planning.navigation',
+    'Plan-time navigability reachability gate (route globs + nav registry).',
   ],
   [
     'qa.environments',
@@ -262,9 +276,8 @@ const PREFIX_MEANINGS = Object.freeze([
 const BLOCK_MEANINGS = Object.freeze({
   project: 'Project identity, paths, and command configuration.',
   github: 'GitHub provider identity and merge/notification policy.',
-  planning: 'Inputs and guardrails for /epic-plan.',
-  delivery:
-    'Execution, isolation, quality, and lifecycle settings for delivery.',
+  planning: 'Inputs and guardrails for /plan.',
+  delivery: 'Execution, isolation, quality, and CI settings for delivery.',
   qa: 'Agent-driven QA harness contract.',
 });
 

package/.agents/scripts/lib/config/github.js

@@ -55,11 +55,13 @@ export const NOTIFICATIONS_DEFAULTS = Object.freeze({
     'operator-message',
   ]),
   webhookEvents: Object.freeze([
-    'epic-started',
-    'epic-progress',
-    'epic-blocked',
-    'epic-unblocked',
-    'epic-complete',
+    'state-transition',
+    'story-merged',
+    'story-closing',
+    'operator-message',
+    'merge.unlanded',
+    'merge.flip-failed',
+    'loop.tick',
   ]),
 });
 

package/.agents/scripts/lib/config/limits.js

@@ -5,25 +5,23 @@
  * Post-reshape, the surviving operator-configurable keys are split across
  * `planning.*` and `delivery.*`:
  *
- *   - `planning.context.{maxBytes, summaryMode}` (planning-context budget)
- *   - `delivery.maxTokenBudget` (task-prompt hydration cap)
  *   - `delivery.execution.timeoutMs` (per-process execution timeout)
  *   - `delivery.lease.ttlMs` (assignee-as-lease staleness window — Story #3480)
- *   - `delivery.signals.{hotspot, rework, retry}` (performance-signal
- *     detector thresholds — `churn` and `idle` dropped)
+ *   - `delivery.signals.{rework, retry}` (performance-signal detector
+ *     thresholds — `hotspot` retired with Epic #4406; `churn`/`idle` dropped)
  *
- * `maxTickets` (the decomposer reviewability budget) is a **framework
- * constant** — Story #4163 collapsed the never-overridden
- * `planning.maxTickets` operator knob to `LIMITS_DEFAULTS.maxTickets` and
- * removed it from the AJV schema, the published mirror, and the explain
- * map. The persist-time over-budget gate (ADR-20260610) still reads the
- * constant via `getLimits(config).maxTickets`; `resolveLimits` no longer
- * reads `planning.maxTickets`, so setting it in a config is inert.
+ * Framework constants (not operator-tunable via `.agentrc.json`):
+ *   - `maxTickets` — decomposer reviewability budget (Story #4163)
  *
- * Dropped entirely: `maxInstructionSteps`, `friction.*` (the LLM
- * self-pacing thresholds rewritten as qualitative prose in
- * `.agents/instructions.md`), `executionMaxBuffer` (now a framework-internal
- * constant in the spawn caller modules), `signals.{churn, idle}`.
+ * Dropped entirely: `maxInstructionSteps`, `friction.*`, `executionMaxBuffer`,
+ * `signals.{churn, idle}`, `delivery.preflight`, `delivery.maxTokenBudget`
+ * (planning no longer sizes against a token-budget envelope; session-mass
+ * ceilings are absolute in `DEFAULT_MODEL_CAPACITY`), and
+ * `planning.context.{maxBytes, summaryMode}` (Story #4541 — the `applyBudget`
+ * pass they fed lost its last caller in the v2 cutover, and it bounded a field
+ * the envelope builders discarded; the live bound on planner-context size is
+ * the fixed `PLAN_CONTEXT_ENVELOPE_BYTE_CEILING` in
+ * `lib/orchestration/plan-context.js`).
  *
  * The historic combined accessor `getLimits(config)` is preserved as a
  * compatibility surface: it returns a wrapper carrying the surviving
@@ -31,45 +29,36 @@
  * working. New call sites should prefer the specific accessors below.
  */
 
-import { getPreflight } from './preflight.js';
-
 /**
- * Framework defaults for the performance-signal detector thresholds. The two
- * dropped detectors (`churn`, `idle`) are omitted entirely.
+ * Framework defaults for the performance-signal detector thresholds.
+ * `hotspot` was retired with its detector (Epic #4406); `churn` and `idle`
+ * were dropped earlier.
  */
 export const SIGNALS_DEFAULTS = Object.freeze({
-  hotspot: Object.freeze({ p95Multiplier: 1.25 }),
   rework: Object.freeze({ editsPerFile: 5 }),
   retry: Object.freeze({ repeatCount: 3 }),
 });
 
 /**
  * Default TTL for the assignee-as-lease primitive (Story #3480). A claim
- * whose owner has not emitted a `story.heartbeat` within this window is
- * considered stale and may be reclaimed by another operator. 15 minutes
- * gives a healthy run comfortable headroom over the §2e idle watchdog's
- * 10-minute re-tick while still releasing a genuinely dead claim promptly.
+ * whose owner's last heartbeat is older than this window is considered stale
+ * and may be reclaimed by another operator.
+ *
+ * Note: no shipped caller supplies a real heartbeat — the emitter was inert
+ * and was deleted (A22), so the guards anchor liveness to `now` and every
+ * foreign claim reads live (fail-closed; clear a stranded claim with
+ * `--steal`). This value is therefore only consulted by a caller that threads
+ * its own `heartbeatAt`, and is kept as the documented default for that seam.
  */
 export const LEASE_TTL_MS_DEFAULT = 900000;
 
 /**
- * Framework defaults for the surviving limits surface. `executionTimeoutMs`
- * bumps from 5 min to 10 min per the Story 1 decisions log.
- *
- * `maxTokenBudget` is a **single global value** (Story #3875 — raised once
- * from 200000 to 300000 so capability-sized Stories are not clipped by
- * hydration elision). There is intentionally no per-profile or
- * per-complexity budget branch anywhere in the resolver.
+ * Framework defaults for the surviving limits surface.
  */
 export const LIMITS_DEFAULTS = Object.freeze({
   maxTickets: 80,
-  maxTokenBudget: 300000,
   executionTimeoutMs: 600000,
   leaseTtlMs: LEASE_TTL_MS_DEFAULT,
-  planningContext: Object.freeze({
-    maxBytes: 50000,
-    summaryMode: 'auto',
-  }),
   signals: SIGNALS_DEFAULTS,
 });
 
@@ -79,7 +68,7 @@ export const LIMITS_DEFAULTS = Object.freeze({
  * operator can override a single threshold without re-listing the others.
  *
  * @param {object|undefined} userSignals
- * @returns {{ hotspot: {p95Multiplier: number}, rework: {editsPerFile: number}, retry: {repeatCount: number} }}
+ * @returns {{ rework: {editsPerFile: number}, retry: {repeatCount: number} }}
  */
 function mergeSignals(userSignals) {
   const user =
@@ -97,35 +86,23 @@ function mergeSignals(userSignals) {
 
 /**
  * Resolve the surviving limits surface against a `.agentrc.json` shape
- * (post-reshape). Accepts the resolved-config wrapper or a partial bag —
- * `maxTickets` is the framework constant `LIMITS_DEFAULTS.maxTickets`
- * (no longer operator-configurable; Story #4163), pulls `planningContext`
- * from `planning.*`, pulls `maxTokenBudget` and `executionTimeoutMs` from
- * `delivery.*`, pulls signals from `delivery.signals.*`.
+ * (post-reshape). `maxTickets` is a framework constant (never read from
+ * config); pulls `executionTimeoutMs` from `delivery.*`, pulls signals from
+ * `delivery.signals.*`.
  *
  * @param {object|undefined} config
  * @returns {{
  *   maxTickets: number,
- *   maxTokenBudget: number,
  *   executionTimeoutMs: number,
  *   leaseTtlMs: number,
- *   planningContext: { maxBytes: number, summaryMode: string },
  *   signals: ReturnType<typeof mergeSignals>,
  * }}
  */
 export function resolveLimits(config) {
-  const planning =
-    config?.planning && typeof config.planning === 'object'
-      ? config.planning
-      : {};
   const delivery =
     config?.delivery && typeof config.delivery === 'object'
       ? config.delivery
       : {};
-  const planningContextUser =
-    planning.context && typeof planning.context === 'object'
-      ? planning.context
-      : {};
   const execution =
     delivery.execution && typeof delivery.execution === 'object'
       ? delivery.execution
@@ -133,18 +110,10 @@ export function resolveLimits(config) {
   const lease =
     delivery.lease && typeof delivery.lease === 'object' ? delivery.lease : {};
   return {
-    // `maxTickets` is a framework constant (Story #4163) — never read from
-    // `planning.maxTickets`. The persist-time over-budget gate still reads
-    // this value via getLimits().maxTickets.
     maxTickets: LIMITS_DEFAULTS.maxTickets,
-    maxTokenBudget: delivery.maxTokenBudget ?? LIMITS_DEFAULTS.maxTokenBudget,
     executionTimeoutMs:
       execution.timeoutMs ?? LIMITS_DEFAULTS.executionTimeoutMs,
     leaseTtlMs: lease.ttlMs ?? LIMITS_DEFAULTS.leaseTtlMs,
-    planningContext: {
-      ...LIMITS_DEFAULTS.planningContext,
-      ...planningContextUser,
-    },
     signals: mergeSignals(delivery.signals),
   };
 }
@@ -173,26 +142,6 @@ export function getSignals(config) {
   return getLimits(config).signals;
 }
 
-/**
- * Resolve the configured `delivery.preflight.max*` ceilings as a plain
- * object holding **only** the keys the operator actually configured
- * (Story #3875 — plan-time/delivery-time reconciliation). Unconfigured
- * ceilings (`null` floors, meaning "no cap") are omitted entirely so the
- * decomposition context can thread a compact, non-null envelope to the
- * planner. An Epic on a zero-config project yields `{}` — never `null`.
- *
- * @param {object | null | undefined} config
- * @returns {Record<string, number>}
- */
-export function resolvePreflightCeilings(config) {
-  const resolved = getPreflight(config);
-  const ceilings = {};
-  for (const [key, value] of Object.entries(resolved)) {
-    if (value !== null) ceilings[key] = value;
-  }
-  return ceilings;
-}
-
 /**
  * Resolve the assignee-as-lease TTL in milliseconds (Story #3480). Standalone
  * accessor so the `ticket-lease` module can import it without dragging the