mandrel 2.0.0 → 2.2.0

package/.agents/scripts/lib/orchestration/story-plan-state.js

@@ -1,9 +1,22 @@
+/**
+ * story-plan-state.js — read the v2 Story planning checkpoint.
+ *
+ * `plan-persist.js` upserts one `story-plan-state` structured comment per
+ * created Story carrying the persist receipt (when the plan completed, how many
+ * Stories it created, and their ids). Story #4542 removed the risk fields it
+ * used to carry: the planner-authored verdict, the envelope derived from it,
+ * and the review routing computed from that envelope. Nothing read any of them
+ * back — review depth is now derived from the diff at close time
+ * (`review-depth.js#deriveChangeLevel`), so no checkpoint read sits on the
+ * delivery path at all.
+ */
+
 import { parseFencedJsonComment } from './structured-comment-parser.js';
 import { findStructuredComment } from './ticketing.js';
 
 /**
  * Read the v2 Story planning checkpoint. Missing/malformed comments degrade
- * to null so unplanned Stories still receive the neutral review posture.
+ * to null — an unplanned Story simply has no persist receipt.
  */
 export async function readStoryPlanState({
   provider,
@@ -18,31 +31,3 @@ export async function readStoryPlanState({
   const state = parseFencedJsonComment(comment);
   return state && typeof state === 'object' ? state : null;
 }
-
-export async function readStoryPlanningRisk(args) {
-  const state = await readStoryPlanState(args);
-  return state?.planningRisk ?? null;
-}
-
-export async function readStoryPlanningRiskSafe(args) {
-  try {
-    return await readStoryPlanningRisk(args);
-  } catch {
-    return null;
-  }
-}
-
-/**
- * Prefer an explicit `planningRisk` override; otherwise load the Story
- * checkpoint. Callers that omit the field (or pass `undefined`) get the
- * persisted plan risk; callers that pass `null` keep the neutral posture.
- */
-export async function resolveStoryPlanningRisk({
-  provider,
-  storyId,
-  planningRisk,
-  findCommentFn,
-}) {
-  if (planningRisk !== undefined) return planningRisk;
-  return readStoryPlanningRiskSafe({ provider, storyId, findCommentFn });
-}

package/.agents/scripts/lib/orchestration/task-body-validator.js

@@ -24,6 +24,15 @@
  * name at least one path-shaped token so vague verbs ("clean up",
  * "refactor") can't slip through.
  *
+ * `acceptance` / `verify` are the **top-level machine contract** (Story
+ * #4541). The decomposer prompt tells authors to write those lists once at
+ * the ticket's top level and omit the matching body sections; persist syncs
+ * them into the body at assemble time. Validation runs *before* that sync,
+ * so this validator resolves each contract field from the parsed body and
+ * falls back to the ticket's top-level array when the body section is
+ * absent. Without that fallback the validator rejected the very shape its
+ * own prompt prescribes.
+ *
  * `body.changes` items must be object-form `{ path: string, assumption: enum }`
  * entries (Story #2636 shape). Plain string bullets are rejected at parse
  * time and by this validator.
@@ -51,8 +60,8 @@ import { FILE_ASSUMPTION_VALUES } from './file-assumption-enum.js';
 
 /**
  * Canonical testing-tier labels that a `verify[]` entry must name (in
- * parentheses) to pass plan-time validation. Mirrors the skill contract in
- * `core/epic-plan-decompose-author/SKILL.md § verify rules`.
+ * parentheses) to pass plan-time validation. Mirrors the verify-rules contract
+ * in `.agents/scripts/lib/templates/decomposer-prompts.js`.
  *
  * Entries that do not end with `(<tier>)` and are not `manual:<reason>` are
  * rejected by `collectVerifyErrors`.
@@ -164,6 +173,39 @@ function resolveStructuredBody(ticket) {
   }
 }
 
+/**
+ * The two contract fields that live at the ticket's top level and are
+ * synced into the body by `plan-persist` at assemble time.
+ */
+const CONTRACT_FIELDS = Object.freeze(['acceptance', 'verify']);
+
+/**
+ * Resolve the body's contract fields against the ticket's top-level arrays
+ * (Story #4541). The decomposer prompt prescribes authoring `acceptance[]`
+ * / `verify[]` **once** at top level and omitting the matching body
+ * sections; `assemblePlanStories#syncContractFieldFromTopLevel` performs
+ * the sync, but it runs *after* validation. So an absent body section is
+ * not a violation when the ticket carries the list at top level — it is the
+ * preferred shape. A body section that is present and disagrees with the
+ * top level is left alone here: the sync itself fails closed on that
+ * mismatch, and duplicating the check would report it twice.
+ *
+ * @param {object} ticket
+ * @param {object} bodyObject Parsed / structured body.
+ * @returns {object} A copy of `bodyObject` with the contract fields resolved.
+ */
+function resolveContractFieldsFromTopLevel(ticket, bodyObject) {
+  const resolved = { ...bodyObject };
+  for (const field of CONTRACT_FIELDS) {
+    const bodyValue = Array.isArray(resolved[field]) ? resolved[field] : [];
+    if (bodyValue.length > 0) continue;
+    const topLevel = Array.isArray(ticket?.[field]) ? ticket[field] : [];
+    if (topLevel.length === 0) continue;
+    resolved[field] = topLevel.map(String);
+  }
+  return resolved;
+}
+
 /**
  * Validate one Story body and return every violation it exhibits. Empty
  * array means clean. Splits the per-ticket cascade out of
@@ -182,13 +224,14 @@ function resolveStructuredBody(ticket) {
  */
 export function validateTaskBodyShape(ticket) {
   const prefix = `Story "${ticket.title}" (${ticket.slug})`;
-  const { body, error } = resolveStructuredBody(ticket);
+  const { body: parsed, error } = resolveStructuredBody(ticket);
   if (error !== null) {
     return [error];
   }
-  if (body === null || typeof body !== 'object') {
-    return [`${prefix}: body must be an object, got ${typeof body}.`];
+  if (parsed === null || typeof parsed !== 'object') {
+    return [`${prefix}: body must be an object, got ${typeof parsed}.`];
   }
+  const body = resolveContractFieldsFromTopLevel(ticket, parsed);
   const errors = [];
   if (typeof body.goal !== 'string' || body.goal.trim() === '') {
     errors.push(`${prefix}: body.goal must be a non-empty string.`);
@@ -300,7 +343,9 @@ function collectReferencesErrors(prefix, rawReferences) {
 function collectAcceptanceErrors(prefix, rawAcceptance) {
   const acceptance = Array.isArray(rawAcceptance) ? rawAcceptance : [];
   if (acceptance.length === 0) {
-    return [`${prefix}: body.acceptance must list at least one criterion.`];
+    return [
+      `${prefix}: acceptance must list at least one criterion — author it at the ticket's top level (preferred) or in the body's ## Acceptance section.`,
+    ];
   }
   return [];
 }
@@ -323,7 +368,7 @@ function collectVerifyErrors(prefix, rawVerify) {
   const verify = Array.isArray(rawVerify) ? rawVerify : [];
   if (verify.length === 0) {
     return [
-      `${prefix}: body.verify must list at least one entry. Use "manual:<reason>" only when truly unverifiable in isolation.`,
+      `${prefix}: verify must list at least one entry — author it at the ticket's top level (preferred) or in the body's ## Verify section. Use "manual:<reason>" only when truly unverifiable in isolation.`,
     ];
   }
   const errors = [];

package/.agents/scripts/lib/orchestration/ticket-lease.js

@@ -5,9 +5,19 @@
  * an exclusive, time-bounded claim on a ticket so two concurrent runs do not
  * both drive the same Story. Rather than invent a new state column, the lease
  * rides the ticket's existing **assignees** surface: the single assignee *is*
- * the lease owner. Liveness is decided by the owner's most-recent
- * `story.heartbeat` timestamp (the `operator` field added in this Story links
- * a heartbeat back to the claimant) compared against a configured TTL.
+ * the lease owner. Liveness is decided by the owner's last-heartbeat epoch-ms
+ * compared against a configured TTL.
+ *
+ * **There is no live heartbeat source.** The `story.heartbeat` emitter this
+ * module was designed against was structurally inert (it demanded an
+ * `epicId >= 1` that v2, which has no Epics, never supplies) and has been
+ * deleted. Every caller now reaches `acquireLease` through
+ * `lease-guard-shared.acquireLeaseFailClosed` with `anchorHeartbeatToNow`,
+ * which pins `heartbeatAt` to `now`: the lease **fails closed**, so any
+ * foreign claim reads as live and refuses. A stranded claim is cleared with
+ * `--steal`, never by TTL expiry. The TTL and the stale-reclaim branch below
+ * are therefore reachable only via an explicit caller-supplied `heartbeatAt`
+ * — the seam is kept, the automatic expiry is not real.
  *
  * The three exported operations are deliberately thin and provider-agnostic:
  *
@@ -31,19 +41,16 @@
  * Liveness seam: callers supply the owner's last-heartbeat epoch-ms via the
  * `heartbeatAt` option (a number, or `null`/`undefined` when no heartbeat has
  * ever been recorded for the current owner). Threading the timestamp in keeps
- * this module pure and trivially unit-testable — it does not read the
- * lifecycle ledger itself. A claim with no heartbeat is treated as stale
- * (reclaimable) so an abandoned assignment never wedges the ticket.
+ * this module pure and trivially unit-testable — it does not read any ledger
+ * itself. A claim with no heartbeat is treated as stale (reclaimable) by
+ * `isClaimLive`; note the live guards never take that branch, per the
+ * fail-closed anchoring described above.
  *
  * `now` is injectable (epoch ms) for deterministic tests; it defaults to
  * `Date.now()`.
  */
 
-import { readFileSync } from 'node:fs';
-
 import { resolveLeaseTtlMs } from '../config/limits.js';
-import { epicLedgerPath } from '../config/temp-paths.js';
-import { parseLedger } from './lifecycle/trace-logger.js';
 
 /**
  * The shipped, non-personal operator-identity placeholder (and its bare,
@@ -87,76 +94,22 @@ export function normalizeOperatorHandle(raw) {
   return trimmed;
 }
 
-/**
- * Read the most-recent `story.heartbeat` epoch-ms recorded for a given lease
- * owner from an Epic lifecycle ledger. Returns `null` when the ledger is
- * absent, unreadable, or carries no heartbeat for that owner — which the lease
- * primitive treats as a stale (reclaimable) claim.
- *
- * The ledger is NDJSON; each `story.heartbeat` record carries
- * `payload.operator` (Story #3480) and `payload.timestamp` (ISO-8601). A
- * malformed ledger downgrades to `null` rather than throwing so a corrupt
- * observability artifact never wedges the lease preflight.
- *
- * This is the shared liveness source the lease guards thread into
- * `acquireLease` via `heartbeatAt`; `/plan` and `/deliver` both
- * reuse it so a live foreign claim actually refuses.
- *
- * @param {object} args
- * @param {number} args.epicId
- * @param {string} args.owner            Lease owner whose heartbeat to find.
- * @param {object} [args.config]         Resolved config (for ledger path).
- * @param {string} [args.ledgerPath]     Explicit path override (tests).
- * @param {(eid: number, config?: object) => string} [args.ledgerPathResolver]
- *        Injectable resolver (tests). Defaults to `epicLedgerPath`.
- * @param {(p: string) => string} [args.readFile]  Injectable reader (tests).
- * @returns {number|null}
- */
-export function latestHeartbeatForOwner({
-  epicId,
-  owner,
-  config,
-  ledgerPath,
-  ledgerPathResolver = epicLedgerPath,
-  readFile = (p) => readFileSync(p, 'utf8'),
-}) {
-  if (typeof owner !== 'string' || owner.length === 0) return null;
-  const resolvedPath = ledgerPath ?? ledgerPathResolver(epicId, config);
-
-  let text;
-  try {
-    text = readFile(resolvedPath);
-  } catch (_err) {
-    // No ledger yet (fresh Epic) → no heartbeat → reclaimable.
-    return null;
-  }
-
-  let records;
-  try {
-    records = parseLedger(text);
-  } catch (_err) {
-    // Corrupt ledger is an observability problem, not a coordination blocker.
-    return null;
-  }
-
-  let latest = null;
-  for (const record of records) {
-    const payload = record?.payload;
-    if (!payload || payload.event !== 'story.heartbeat') continue;
-    if (payload.operator !== owner) continue;
-    const ts = Date.parse(payload.timestamp ?? '');
-    if (!Number.isFinite(ts)) continue;
-    if (latest === null || ts > latest) latest = ts;
-  }
-  return latest;
-}
-
 /**
  * Decide whether a foreign claim is still "live" given the owner's last
  * heartbeat and the configured TTL. A claim is live when a heartbeat exists
  * and is no older than `ttlMs`. A missing heartbeat (`null`/`undefined`) or a
  * heartbeat older than the TTL is stale and therefore reclaimable.
  *
+ * The `heartbeatAt` seam is retained, but there is no longer any in-repo
+ * heartbeat *source*: the `story.heartbeat` emitter was structurally inert
+ * (it required an `epicId >= 1` that v2 never sets) and was deleted along
+ * with the ledger reader that scanned for it. Every live caller reaches this
+ * through `lease-guard-shared.acquireLeaseFailClosed` with
+ * `anchorHeartbeatToNow`, which pins `heartbeatAt` to `now` so ANY foreign
+ * claim reads live and the guard fails closed — a stranded claim is cleared
+ * with `--steal`, not by TTL expiry. The parameter stays because that
+ * anchoring is expressed through it.
+ *
  * @param {object} args
  * @param {number|null|undefined} args.heartbeatAt  Owner's last heartbeat (epoch ms).
  * @param {number} args.ttlMs                        Lease TTL in milliseconds.

package/.agents/scripts/lib/orchestration/ticket-validator-conflicts.js

@@ -589,13 +589,53 @@ function registryRegistry(producers, assumptionEntries, patterns, cache) {
 }
 
 /**
- * Compute `fan-out-warning` findings (Story #2962).
+ * Normalize a fan-out probe result into `{ count, files, probe }`.
  *
- * For each `body.changes` entry whose `assumption` is `"deletes"` (or
- * `"refactors-existing"` when the planner declared a symbol replacement),
- * count the number of distinct files in the base branch that reference
- * the deleted module via its basename. When the count exceeds the
- * configured `largeFanOutThreshold`, emit a finding.
+ * The production probe reports its referencing files and the exact command
+ * that found them so an operator can reproduce the figure (Story #4547).
+ * A bare number stays valid — injected test counters and any consumer
+ * counter written against the Story #2962 contract keep working, they just
+ * carry no audit trail.
+ */
+function normalizeFanOutProbe(result) {
+  if (typeof result === 'number') {
+    return { count: result, files: [], probe: null };
+  }
+  if (result === null || typeof result !== 'object') {
+    return { count: 0, files: [], probe: null };
+  }
+  const files = Array.isArray(result.files) ? result.files : [];
+  const count = Number.isFinite(result.count) ? result.count : files.length;
+  return { count, files, probe: result.probe ?? null };
+}
+
+/**
+ * Index the basenames this spec *creates*, so a deletion that is really one
+ * half of a move can be told apart from a genuine wide-coupling removal.
+ */
+function indexCreatedBasenames(assumptionEntries) {
+  const byBasename = new Map();
+  for (const entry of assumptionEntries) {
+    if (entry.assumption !== 'creates') continue;
+    const base = entry.path.slice(entry.path.lastIndexOf('/') + 1);
+    if (!byBasename.has(base)) byBasename.set(base, entry.path);
+  }
+  return byBasename;
+}
+
+/**
+ * Compute `fan-out-warning` findings (Story #2962, reworked in #4547).
+ *
+ * For each `body.changes` entry whose `assumption` is `"deletes"`, probe the
+ * files at the base branch that genuinely import or require the deleted
+ * module. When that count exceeds the configured `largeFanOutThreshold`,
+ * emit a finding carrying the referencing files and the probe that produced
+ * them.
+ *
+ * The finding also records whether the deletion is **rename-shaped** — the
+ * same spec creates a file with the deleted module's basename elsewhere —
+ * because the remedy diverges: a move wants its importers repointed in one
+ * Story, not a subsystem-by-subsystem migration split across several.
  *
  * The default severity is always `'soft'` — the persist gate enforces a
  * hard refusal via the `--allow-large-fan-out` operator flag, since the
@@ -613,21 +653,28 @@ function computeFanOutFindings({
   if (!Number.isFinite(threshold) || threshold < 0) return [];
   const findings = [];
   const cache = new Map();
+  const createdBasenames = indexCreatedBasenames(assumptionEntries);
   for (const entry of assumptionEntries) {
     if (entry.assumption !== 'deletes') continue;
-    let count = cache.get(entry.path);
-    if (count === undefined) {
-      count = counter({ path: entry.path }) ?? 0;
-      cache.set(entry.path, count);
+    let probed = cache.get(entry.path);
+    if (probed === undefined) {
+      probed = normalizeFanOutProbe(counter({ path: entry.path }));
+      cache.set(entry.path, probed);
     }
-    if (count <= threshold) continue;
+    if (probed.count <= threshold) continue;
+    const base = entry.path.slice(entry.path.lastIndexOf('/') + 1);
+    const renameTarget = createdBasenames.get(base);
     findings.push({
       kind: 'fan-out-warning',
       severity,
       taskSlug: entry.taskSlug,
       storySlug: entry.storySlug,
       path: entry.path,
-      callSiteCount: count,
+      callSiteCount: probed.count,
+      callSites: probed.files,
+      probe: probed.probe,
+      renameShaped: renameTarget !== undefined && renameTarget !== entry.path,
+      renameTarget: renameTarget === entry.path ? null : (renameTarget ?? null),
       threshold,
     });
   }
@@ -701,6 +748,60 @@ export function computeConflictFindings({ stories, policy } = {}) {
   ];
 }
 
+/**
+ * Render the audit trail behind a fan-out finding's number, so an operator
+ * can check the figure rather than trust it (Story #4547).
+ *
+ * Every importer is named — the list is deliberately **not** truncated. A
+ * gate that fires at 100 importers is precisely when the operator needs the
+ * list, and a `…and 109 more` tail would leave the figure uncheckable in
+ * exactly the case the gate exists for. This message is a fail-closed stop,
+ * not a log line; its length is the point.
+ *
+ * The probe is reported as what it is — the *candidate* net, which each hit
+ * is then re-resolved against. It will report at least as many lines as the
+ * gate counts files, so labelling it as the thing that produced the number
+ * would send an operator chasing a discrepancy that is by design.
+ *
+ * Returns `''` for a bare-number counter, which carries no audit trail.
+ */
+export function renderFanOutEvidence(finding) {
+  const files = Array.isArray(finding.callSites) ? finding.callSites : [];
+  const parts = [];
+  if (files.length > 0) {
+    parts.push(`    Importers (${files.length}):`);
+    for (const file of files) parts.push(`      ${file}`);
+  }
+  if (finding.probe) {
+    parts.push(
+      `    Candidate probe (each hit re-resolved against its importer's directory):`,
+      `      ${finding.probe}`,
+    );
+  }
+  return parts.length > 0 ? `\n${parts.join('\n')}` : '';
+}
+
+/**
+ * Render the remedy that actually fits the finding. A rename-shaped
+ * deletion has nowhere to split to — the importers just need repointing at
+ * the path the same plan creates — so telling the operator to split it
+ * across Stories leaves the override as the only exit, which is exactly the
+ * habit that defeats the gate (Story #4547).
+ */
+export function renderFanOutRemedy(finding) {
+  if (finding.renameShaped && finding.renameTarget) {
+    return (
+      `This deletion is rename-shaped: the same plan creates "${finding.renameTarget}" under the same basename. ` +
+      `Repoint the importer(s) at the new path inside this Story — a move has no subsystems to split across — ` +
+      `then rerun --allow-large-fan-out.`
+    );
+  }
+  return (
+    `Split the deletion into a subsystem-by-subsystem migration across multiple Stories, ` +
+    `or rerun --allow-large-fan-out after confirming the deletion is intentional.`
+  );
+}
+
 /**
  * Render a `'hard'`-severity conflict finding as a human-readable error
  * message. Used by the validator when policy flags upgrade a finding to
@@ -712,14 +813,18 @@ export function renderHardConflictError(finding) {
     return `Shared-editor conflict: "${finding.path}" is written by ${finding.storySlugs.length} concurrent Stories (${stories}). Add depends_on chains between them or split the edits into a dedicated late-wave wiring Story.`;
   }
   if (finding.kind === 'implicit-cross-story-dep') {
-    return `Implicit cross-Story dependency: Task "${finding.consumer.taskSlug}" in Story "${finding.consumer.storySlug}" references "${finding.path}" (produced by Task "${finding.producer.taskSlug}" in Story "${finding.producer.storySlug}") via body.${finding.consumer.sourceField}, but Story "${finding.consumer.storySlug}" has no depends_on link to Story "${finding.producer.storySlug}". Add depends_on: ["${finding.producer.storySlug}"] to the consumer Story or remove the reference.`;
+    return `Implicit cross-Story dependency: Story "${finding.consumer.storySlug}" references "${finding.path}" (produced by Story "${finding.producer.storySlug}") via body.${finding.consumer.sourceField}, but Story "${finding.consumer.storySlug}" has no depends_on link to Story "${finding.producer.storySlug}". Add depends_on: ["${finding.producer.storySlug}"] to the consumer Story or remove the reference.`;
   }
   if (finding.kind === 'cross-cutting-registries') {
     const stories = finding.storySlugs.map((s) => `"${s}"`).join(', ');
     return `Cross-cutting registry conflict: ${finding.storySlugs.length} concurrent Stories (${stories}) edit or register into "${finding.registryPath}". Add depends_on chains between them so the registry updates serialize, or split the registration into a dedicated late-wave wiring Story.`;
   }
   if (finding.kind === 'fan-out-warning') {
-    return `Large fan-out: Task "${finding.taskSlug}" in Story "${finding.storySlug}" deletes "${finding.path}" with ${finding.callSiteCount} call site(s) on the base branch (threshold ${finding.threshold}). Split into a subsystem-by-subsystem migration across multiple Stories, or rerun --allow-large-fan-out after confirming the deletion is intentional.`;
+    return (
+      `Large fan-out: Story "${finding.storySlug}" deletes "${finding.path}" ` +
+      `with ${finding.callSiteCount} importer(s) on the base branch (threshold ${finding.threshold}). ` +
+      `${renderFanOutRemedy(finding)}${renderFanOutEvidence(finding)}`
+    );
   }
   if (finding.kind === 'missing-bdd-scaffold') {
     return `Missing BDD scaffold: Story "${finding.consumer.storySlug}" verifies against "${finding.path}" (created by Story "${finding.producer.storySlug}") via body.${finding.consumer.sourceField}, but "${finding.consumer.storySlug}" has no depends_on path to "${finding.producer.storySlug}" — the .feature file is scaffolded in the same wave (or later), so verification runs before the file exists. Add depends_on: ["${finding.producer.storySlug}"] to the consumer Story so the scaffold lands in an earlier wave.`;

package/.agents/scripts/lib/orchestration/ticket-validator-sizing.js

@@ -14,10 +14,9 @@
  *
  * `DEFAULT_MODEL_CAPACITY` is the **single source of truth** for the capacity
  * thresholds. The decomposer prompt template
- * (`.agents/scripts/lib/templates/decomposer-prompts.js`) and the authoring
- * SKILL (`.agents/skills/core/epic-plan-decompose-author/SKILL.md`) reference
- * these numbers rather than restating divergent ones — the prompt generates
- * its threshold sentence from this constant so the two surfaces cannot drift.
+ * (`.agents/scripts/lib/templates/decomposer-prompts.js`) generates its
+ * threshold sentence from this constant rather than restating divergent
+ * numbers, so the two surfaces cannot drift.
  *
  * Capacity model:
  *   - Plan-time **session mass** = authored tokens only (`estimateTokens` of