mandrel 2.10.0 → 2.12.0

package/.agents/docs/configuration.md

@@ -102,10 +102,9 @@ top-level keys are validation errors.
 | `codebaseSnapshot.include` | No | `array<string>` | — | — |
 | `codebaseSnapshot.exclude` | No | `array<string>` | — | — |
 | `codebaseSnapshot.recentCommitWindow` | No | `integer` | — | — |
-| `complexityGate` | No | `object` | — | Plan-time ceremony-lite complexity gate. Routes trivial single-artifact seeds onto a collapsed plan/deliver path; conservative (full on any doubt). Never relaxes the Story-ticket / PR-to-main / repo-gates / security-baseline non-negotiables. |
-| `complexityGate.enabled` | No | `boolean` | — | Master switch. When false, every seed takes the full plan/deliver ceremony. Default true. |
-| `complexityGate.maxSeedWords` | No | `integer` | — | Seed prose word ceiling for the lite path. A seed above this many words is not trivial and takes the full path. Default 150. |
-| `complexityGate.maxArtifacts` | No | `integer` | — | Enumerated-artifact ceiling for the lite path. A seed enumerating more than this many candidate artifacts is multi-capability and takes the full path. Default 1. |
+| `complexityGate` | No | `object` | — | Shape-derived ceremony-lite complexity routing. A lite claim is validated against the authored Story shape at persist and re-derived from the Story body at dispatch; conservative (full on any doubt). Never relaxes the Story-ticket / PR-to-main / repo-gates / security-baseline non-negotiables. |
+| `complexityGate.enabled` | No | `boolean` | — | Master switch. When false, lite routing is disabled everywhere: persist refuses lite claims and dispatch always takes the sub-agent path. Default true. |
+| `complexityGate.maxArtifacts` | No | `integer` | — | Enumerated-artifact threshold reported by the plan-context complexity signals. An input signal for the planner verdict — carries no routing authority. Default 1. |
 | `failOnSharedEditors` | No | `boolean` | — | When true, upgrade shared-editor conflict findings to hard errors (default false — advisory soft findings only). |
 | `requireExplicitCrossStoryDeps` | No | `boolean` | — | When true, upgrade implicit cross-Story dependency findings to hard errors (default false — advisory soft findings only). |
 | `failOnRegistryConflicts` | No | `boolean` | — | When true, upgrade cross-cutting registry conflict findings to hard errors (default false). |
@@ -189,6 +188,7 @@ top-level keys are validation errors.
 | `quality.gates.maintainability.floors` | No | `object<map>` | — | — |
 | `quality.gates.maintainability.components` | No | `object<map>` | — | — |
 | `quality.gates.maintainability.targetDirs` | No | `string[]` or `{ append?, prepend? }` | — | Directories whose JS sources the maintainability gate scores. Mandrel ships a `src/`-centric default; projects whose executable code lives elsewhere (e.g. this repo's `.agents/scripts/` plus `tests/`) override here. The framework default is intentionally not auto-discovered, so an override is the explicit, auditable signal. |
+| `quality.gates.maintainability.refreshTag` | No | `string` | — | — |
 | `quality.gates.maintainability.refreshTimeoutMs` | No | `integer` | — | Bounded timeout (ms) for `npm run maintainability:update` spawned by the baseline-attribution refresh path. Mirrors `coverage.timeoutMs`: a SIGKILL fired at the budget boundary maps to exit 124 so the close orchestrator can flip the Story to `agent::blocked`. Default 60000 (Story #2165). |
 | `quality.gates.maintainability.ignoreGlobs` | No | `array<string>` | — | Minimatch glob patterns matched against the canonicalised repo-relative path of each discovered file. Files matching any pattern are excluded from MI discovery before scoring. Orthogonal to `components` (grouping) — a file excluded here never appears in any component bucket. Absent or empty preserves the existing IGNORED_DIRS-only behaviour (Story #3217). |
 | `quality.gates.mutation` | No | `object` | — | Nested configuration block. |
@@ -351,36 +351,38 @@ scans `.agents/scripts/**`, `src/**`, `lib/**`, `app/**`, `packages/**` and
 `exclude` drops `node_modules`, build dirs, and test files. Override `include`
 only when the project's source layout differs.
 
-- **`complexityGate`.** Plan-time ceremony-lite routing (Story #4683). The full
-  two-session plan/deliver ceremony buys measurable quality on capability-sized
-  work but imposes a large fixed cost premium on genuinely trivial
-  single-artifact scopes with no measured quality gain. The gate reads the
-  planning seed and emits a `complexityRoute` signal on the `/plan` context
-  envelope: `lite` collapses the plan/deliver session split and skips the
-  fresh-critic / Tech-Spec ceremony a one-artifact scope does not earn; `full`
-  keeps the whole ceremony. It is **deterministic and conservative** — `lite`
-  only when every trivial-scope signal agrees (seed ≤ `maxSeedWords` words **and**
-  ≤ `maxArtifacts` enumerated items), and `full` on any doubt (empty seed, over
-  the ceiling, multi-capability enumeration, or the gate disabled). The lite path
-  **never** relaxes a non-negotiable: it still produces a Story ticket, still
-  lands via a PR to `main`, still runs every repo quality gate, and still honours
-  `rules/security-baseline.md` — those gates run in `single-story-close.js`
-  regardless of route. **Threshold + override:** `enabled` (default `true`;
-  `false` forces every seed to `full`), `maxSeedWords` (default `150` —
-  raised from 60 by Story #4707: seed word count is a poor complexity proxy,
-  and the old ceiling punished a well-written 70-word trivial seed with the
-  full two-session ceremony), and
-  `maxArtifacts` (default `1`). The defaults are the single source of truth on
-  `DEFAULT_COMPLEXITY_GATE` in
+- **`complexityGate`.** Shape-derived ceremony-lite routing (Story #4722,
+  superseding the word-count gate of Stories #4683/#4707). The full ceremony
+  buys measurable quality on capability-sized work but imposes a large fixed
+  cost premium on genuinely trivial scopes — and seed word count is the wrong
+  proxy in both directions (a detailed prompt can describe trivial work, a
+  terse one complex work), so `maxSeedWords` was **removed** in the hard
+  cutover (a config still setting it is rejected as an additional property).
+  Routing is now staged on the objective shape of the work: `/plan`'s context
+  envelope emits advisory `complexitySignals` (enumerated-artifact count,
+  risk-heuristic hits, repo state of predicted paths, sensitive-path classes)
+  with **no routing authority**; the planner authors the trivial-vs-standard
+  verdict via `plan-persist.js --route-downgrade-reason "<why>"` (recorded on
+  every created Story's `story-plan-state` checkpoint); persist validates a
+  lite claim against each authored Story's own shape (`changes[]` count,
+  acceptance count, creates-vs-refactors mix, sensitive-path classes — the
+  framework constants `STORY_SHAPE_CEILINGS`) and **fails closed to `full`**
+  when the shape exceeds the ceilings; and `/deliver` re-derives the route
+  from the fetched Story body via the same shape function at dispatch. The
+  `route::lite` label is a human-visible hint only — a lost label cannot
+  misroute delivery. A lite-shaped Story executes inline (no story-worker or
+  acceptance-critic sub-agent fan-out); sensitivity always wins — a footprint
+  intersecting a sensitive-path class routes `full` and keeps its fresh
+  critic. The lite path **never** relaxes a non-negotiable: it still produces
+  a Story ticket, still lands via a PR to `main`, still runs every repo
+  quality gate, and still honours `rules/security-baseline.md` — those gates
+  run in `single-story-close.js` regardless of route. **Knobs:** `enabled`
+  (default `true`; `false` disables lite routing everywhere) and
+  `maxArtifacts` (default `1` — a signal threshold, not a router). Defaults
+  live on `DEFAULT_COMPLEXITY_GATE` in
   [`lib/orchestration/complexity-gate.js`](../scripts/lib/orchestration/complexity-gate.js);
-  a malformed or negative ceiling falls back to the default rather than widening
-  the lite path. **Planner downgrade + route marker (Story #4707):** the
-  planner may downgrade a `full` verdict to `lite` only via
-  `plan-persist.js --route-downgrade-reason "<why>"` — the reason is recorded
-  on every created Story's `story-plan-state` checkpoint, so the judgment is
-  auditable and never a silent gate change. A lite-routed plan's Stories carry
-  the runtime-derived `route::lite` label, which `/deliver` reads to execute
-  the Story inline (no sub-agent fan-out) with every close gate unchanged.
+  a malformed or negative value falls back to the default rather than
+  widening the lite path.
 
 ### `delivery`
 

package/.agents/rules/orchestration-error-handling.md

@@ -46,8 +46,16 @@ success output is a per-turn tax on the whole session — not a one-time cost.
   their drivers — emit them single-line (`JSON.stringify(x)`), never
   pretty-printed (`null, 2` only adds resident bytes). Pretty output is
   reserved for explicit opt-in flags (`--pretty`).
+- **Streamed child output counts too (Story #4736).** A script that pipes a
+  child process's stdout/stderr through to the caller is emitting that output
+  as its own. `single-story-close.js` streamed every close-validation gate —
+  the whole of `npm test` included — and blew the budget by ~25× on a *passing*
+  close. Capture it to an artifact instead
+  ([`single-story-close/gate-log.js`](../scripts/lib/orchestration/single-story-close/gate-log.js)),
+  emit the digest, and **replay the tail inline on failure** — the bound is a
+  success-path bound, and a red gate's evidence belongs in front of the caller.
 - **Escape hatch.** `MANDREL_RESULT_DETAIL=inline` restores inline full
   detail for interactive debugging; scripts using `emitTerseResult` honor it
-  automatically.
+  automatically. `AGENT_LOG_LEVEL=verbose` restores live gate streaming.
 - **stdout purity is unchanged.** Scripts whose stdout is a machine contract
   (Story #2278) keep logs on stderr; the digest is the *only* stdout line.

package/.agents/schemas/agentrc.schema.json

@@ -329,21 +329,16 @@
         },
         "complexityGate": {
           "type": "object",
-          "description": "Plan-time ceremony-lite complexity gate. Routes trivial single-artifact seeds onto a collapsed plan/deliver path; conservative (full on any doubt). Never relaxes the Story-ticket / PR-to-main / repo-gates / security-baseline non-negotiables.",
+          "description": "Shape-derived ceremony-lite complexity routing. A lite claim is validated against the authored Story shape at persist and re-derived from the Story body at dispatch; conservative (full on any doubt). Never relaxes the Story-ticket / PR-to-main / repo-gates / security-baseline non-negotiables.",
           "properties": {
             "enabled": {
               "type": "boolean",
-              "description": "Master switch. When false, every seed takes the full plan/deliver ceremony. Default true."
-            },
-            "maxSeedWords": {
-              "type": "integer",
-              "minimum": 0,
-              "description": "Seed prose word ceiling for the lite path. A seed above this many words is not trivial and takes the full path. Default 150."
+              "description": "Master switch. When false, lite routing is disabled everywhere: persist refuses lite claims and dispatch always takes the sub-agent path. Default true."
             },
             "maxArtifacts": {
               "type": "integer",
               "minimum": 0,
-              "description": "Enumerated-artifact ceiling for the lite path. A seed enumerating more than this many candidate artifacts is multi-capability and takes the full path. Default 1."
+              "description": "Enumerated-artifact threshold reported by the plan-context complexity signals. An input signal for the planner verdict — carries no routing authority. Default 1."
             }
           },
           "additionalProperties": false
@@ -844,6 +839,16 @@
           "$ref": "#/$defs/listOrExtenderOfStrings",
           "description": "Directories whose JS sources the maintainability gate scores. Mandrel ships a `src/`-centric default; projects whose executable code lives elsewhere (e.g. this repo's `.agents/scripts/` plus `tests/`) override here. The framework default is intentionally not auto-discovered, so an override is the explicit, auditable signal."
         },
+        "refreshTag": {
+          "allOf": [
+            {
+              "$ref": "#/$defs/safeString"
+            },
+            {
+              "minLength": 1
+            }
+          ]
+        },
         "refreshTimeoutMs": {
           "type": "integer",
           "minimum": 1,

package/.agents/scripts/acceptance-eval.js

@@ -3,12 +3,16 @@
 /**
  * acceptance-eval.js — bounded per-Story acceptance self-eval gate (Story #3819).
  *
- * The Story-implementation phase runs an independent (fresh-context)
- * critic pass that scores the caller-injected change set against each
- * inline `acceptance[]` item, emitting one verdict file per round
+ * The Story-implementation phase runs ONE verdict-owner per acceptance
+ * cluster (Story #4723) — the fresh-context critic when
+ * `ceremony-routing.js` sensitivity-routes the cluster fresh, the
+ * contract-identical inline self-eval otherwise — which scores the
+ * caller-injected change set against each inline `acceptance[]` item and
+ * emits one verdict file per round
  * (`.agents/schemas/acceptance-eval-verdict.schema.json`). This CLI is the
- * deterministic substrate that turns that verdict into the loop's next
- * action:
+ * deterministic SCORER of that single authored verdict — it validates and
+ * decides, it never re-scores the criteria as an independent additional
+ * pass — turning the verdict into the loop's next action:
  *
  *   1. Validate the verdict file against the verdict JSON Schema (a
  *      malformed verdict is a hard error — the loop refuses to guess).

package/.agents/scripts/lib/audit-suite/audit-rules-reader.js

@@ -0,0 +1,48 @@
+/**
+ * lib/audit-suite/audit-rules-reader.js — the one synchronous reader of the
+ * `audit-rules.json` manifest, memoized for the process lifetime.
+ *
+ * The manifest is shipped framework configuration resolved from one fixed
+ * path per process, and the shape-derivation path reads it once per Story at
+ * resolve AND persist — an un-memoized read is pure repeated I/O (measured
+ * 221 µs/op raw vs 5.5 µs seamed on the run adhoc-4722-4723 audit). Only a
+ * successful parse is cached: a read failure stays a per-call throw so a
+ * caller can observe a manifest that becomes readable later. Tests never
+ * reach this read — they inject fixture rules through the callers'
+ * `injectedRules` seam.
+ */
+
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { getPaths, PROJECT_ROOT, resolveConfig } from '../config-resolver.js';
+
+/** Process-lifetime memo of the parsed manifest (successful parses only). */
+let auditRulesCache = null;
+
+/**
+ * Read and parse the `audit-rules.json` manifest synchronously from the
+ * project's configured `schemasRoot`. Shared by the synchronous, ticket-free
+ * readers (`resolveLensTier`, `selectLocalLenses`,
+ * `selectSensitivePathClasses`) so the path resolution and read-failure
+ * handling live in one place rather than being duplicated per reader.
+ *
+ * @returns {{ audits?: Record<string, object> }} Parsed manifest.
+ * @throws {Error} When the manifest cannot be read or parsed.
+ */
+export function readAuditRulesSync() {
+  if (auditRulesCache !== null) return auditRulesCache;
+  const config = resolveConfig();
+  const rulesPath = path.join(
+    PROJECT_ROOT,
+    getPaths(config).schemasRoot,
+    'audit-rules.json',
+  );
+  try {
+    auditRulesCache = JSON.parse(readFileSync(rulesPath, 'utf8'));
+    return auditRulesCache;
+  } catch (err) {
+    throw new Error(
+      `audit-suite: failed to read audit-rules from ${rulesPath}: ${err.message}`,
+    );
+  }
+}

package/.agents/scripts/lib/audit-suite/selector.js

@@ -26,6 +26,7 @@ import { getPaths, PROJECT_ROOT, resolveConfig } from '../config-resolver.js';
 import { softFailOrThrow } from '../degraded-mode.js';
 import { gitSpawn } from '../git-utils.js';
 import { withTimeout } from '../util/with-timeout.js';
+import { readAuditRulesSync } from './audit-rules-reader.js';
 
 const DEFAULT_GIT_TIMEOUT_MS = 30000;
 
@@ -101,32 +102,6 @@ export const LENS_TIERS = Object.freeze(['local', 'cumulative', 'global']);
  *   manifest cannot be read, or the registered entry carries a scope outside
  *   {@link LENS_TIERS}.
  */
-/**
- * Read and parse the `audit-rules.json` manifest synchronously from the
- * project's configured `schemasRoot`. Shared by the synchronous, ticket-free
- * readers ({@link resolveLensTier}, {@link selectLocalLenses}) so the path
- * resolution and read-failure handling live in one place rather than being
- * duplicated per reader.
- *
- * @returns {{ audits?: Record<string, object> }} Parsed manifest.
- * @throws {Error} When the manifest cannot be read or parsed.
- */
-function readAuditRulesSync() {
-  const config = resolveConfig();
-  const rulesPath = path.join(
-    PROJECT_ROOT,
-    getPaths(config).schemasRoot,
-    'audit-rules.json',
-  );
-  try {
-    return JSON.parse(readFileSync(rulesPath, 'utf8'));
-  } catch (err) {
-    throw new Error(
-      `audit-suite: failed to read audit-rules from ${rulesPath}: ${err.message}`,
-    );
-  }
-}
-
 export function resolveLensTier(lens) {
   const rulesData = readAuditRulesSync();
 

package/.agents/scripts/lib/baselines/env-overrides.js

@@ -117,6 +117,39 @@ export function resolveBundleSizeEnvOverrides(env) {
   return { acknowledged, overrides };
 }
 
+/**
+ * Pure helper: resolve the one-shot maintainability refresh/acknowledge flag
+ * (Story #4731). This is the env-parity sibling of
+ * `resolveBundleSizeEnvOverrides`: `MAINTAINABILITY_REFRESH=1` (or `true`,
+ * case-insensitive) tells `check-baselines --gate maintainability` to demote
+ * this run's head-vs-base maintainability regressions to `unchanged` for this
+ * invocation only. Floors still apply — an acknowledged run can still fail on
+ * an absolute floor breach (e.g. a row below `min` 70); only the
+ * ratchet-vs-base regression comparison is suspended.
+ *
+ * Unlike bundle-size, maintainability also has a **commit-tagged** trigger
+ * (a `baseline-refresh:`-tagged commit in the compared range that touches the
+ * maintainability baseline file) resolved in the evaluate phase — this env
+ * flag is the manual override the two share by shape. Neither is persisted:
+ * the next run without the flag / tag re-enforces the ratchet at full
+ * strength automatically.
+ *
+ * Accepted truthy values: `1`, `true` (case-insensitive). Anything else
+ * (including unset/empty) resolves to `acknowledged: false`.
+ *
+ * @param {NodeJS.ProcessEnv} env
+ * @returns {{ acknowledged: boolean, overrides: string[] }}
+ */
+export function resolveMaintainabilityRefreshOverrides(env) {
+  const raw = env?.MAINTAINABILITY_REFRESH;
+  const acknowledged =
+    typeof raw === 'string' && /^(1|true)$/i.test(raw.trim());
+  const overrides = acknowledged
+    ? [`acknowledged=true (MAINTAINABILITY_REFRESH=${raw})`]
+    : [];
+  return { acknowledged, overrides };
+}
+
 /**
  * Pure helper: resolve the effective MI tolerance by layering precedence:
  *   1. `CRAP_TOLERANCE` env-var (CI override — the baseline-refresh-

package/.agents/scripts/lib/baselines/preview-gates.js

@@ -263,6 +263,11 @@ export async function runCrapPreview({
   const requireCoverage = crap.requireCoverage !== false;
   const coveragePath = crap.coveragePath ?? 'coverage/coverage-final.json';
   const coverage = loadCoverage(path.resolve(cwd, coveragePath));
+  // Story #4731 (AC-3) — feed the CRAP regression compare the *configured*
+  // crap tolerance (env override → `gates.crap.tolerance` → framework default)
+  // so `compareCrap` demotes positive deltas at or under tolerance rather than
+  // failing on any positive delta; over-tolerance deltas still fail. This keeps
+  // the pre-commit/pre-push preview aligned with the authoritative gate.
   const { newMethodCeiling, tolerance } = resolveCrapEnvOverrides(
     crap,
     process.env,

package/.agents/scripts/lib/config/gates/maintainability.schema.js

@@ -1,12 +1,21 @@
 /* node:coverage ignore file -- AJV schema declaration (data-as-code) */
 
-import { GATE_BASE, LIST_OR_EXTENDER_OF_STRINGS } from './shared.js';
+import {
+  GATE_BASE,
+  LIST_OR_EXTENDER_OF_STRINGS,
+  SAFE_STRING,
+} from './shared.js';
 
 export const MAINTAINABILITY_GATE = {
   type: 'object',
   properties: {
     ...GATE_BASE,
     targetDirs: LIST_OR_EXTENDER_OF_STRINGS,
+    // Story #4731 — commit-subject substring that acknowledges a deliberate
+    // maintainability baseline refresh in the compared range. Mirrors the CRAP
+    // gate's `refreshTag`; a range commit carrying it that touches the baseline
+    // file demotes head-vs-base regressions (floors still enforced).
+    refreshTag: { ...SAFE_STRING, minLength: 1 },
     // Story #2165 — bounded timeout for `npm run maintainability:update`
     // spawned by the baseline-attribution refresh path. Mirrors
     // `coverage.timeoutMs` (Story #2142).

package/.agents/scripts/lib/config/quality.js

@@ -110,6 +110,13 @@ export const MAINTAINABILITY_GATE_DEFAULTS = Object.freeze({
   tolerance: DEFAULT_MI_TOLERANCE,
   floors: DEFAULT_MI_FLOORS,
   targetDirs: Object.freeze([]),
+  // Story #4731 — the commit-subject substring that acknowledges a deliberate
+  // maintainability baseline refresh in the compared range. Mirrors the CRAP
+  // gate's `refreshTag`; the evaluate phase demotes head-vs-base regressions
+  // (floors still enforced) when a range commit carrying this tag touches the
+  // baseline file. Kept identical to the CRAP default so one refresh commit
+  // can acknowledge both gates.
+  refreshTag: 'baseline-refresh:',
   // Story #2165 — bounded timeout (ms) for `npm run maintainability:update`
   // spawned by the baseline-attribution refresh path. Defaults to 60 s.
   refreshTimeoutMs: 60_000,
@@ -154,6 +161,7 @@ const MI_GATE_KEYS = new Set([
   'tolerance',
   'floors',
   'targetDirs',
+  'refreshTag',
   'refreshTimeoutMs',
   'ignoreGlobs',
 ]);
@@ -268,6 +276,7 @@ function resolveMaintainabilityQuality(userBlock, gateScoping) {
   if (userBlock == null || typeof userBlock !== 'object') {
     return {
       targetDirs: [...defaults.targetDirs],
+      refreshTag: defaults.refreshTag,
       refreshTimeoutMs: defaults.refreshTimeoutMs,
       ignoreGlobs: [...defaults.ignoreGlobs],
       defaultScope: scoping.defaultScope,
@@ -277,6 +286,10 @@ function resolveMaintainabilityQuality(userBlock, gateScoping) {
   warnUnknownKeys(userBlock, MI_GATE_KEYS, 'quality.gates.maintainability');
   const out = {
     targetDirs: resolveListValue(defaults.targetDirs, userBlock.targetDirs),
+    refreshTag:
+      typeof userBlock.refreshTag === 'string' && userBlock.refreshTag.length
+        ? userBlock.refreshTag
+        : defaults.refreshTag,
     refreshTimeoutMs: resolvePositiveIntegerMs(
       userBlock.refreshTimeoutMs,
       defaults.refreshTimeoutMs,

package/.agents/scripts/lib/config-settings-schema.js

@@ -278,34 +278,30 @@ const PLANNING_SCHEMA = {
   properties: {
     riskHeuristics: LIST_OR_EXTENDER_OF_STRINGS,
     codebaseSnapshot: CODEBASE_SNAPSHOT_SCHEMA,
-    // Story #4683 — plan-time ceremony-lite complexity gate. Routes a trivial
-    // single-artifact seed onto a collapsed plan/deliver path while a
-    // multi-capability seed keeps the full ceremony. Deterministic and
-    // conservative (full on any doubt); the lite path never relaxes a
-    // non-negotiable (Story ticket, PR-to-main, repo gates, security baseline).
-    // Defaults live on DEFAULT_COMPLEXITY_GATE in
-    // `lib/orchestration/complexity-gate.js`.
+    // Story #4722 (superseding #4683's word-count gate) — shape-derived
+    // ceremony-lite routing. Complexity routes on the objective shape of the
+    // authored work (changes[] count, acceptance count, creates-vs-refactors
+    // mix, sensitive-path classes), never on seed word count: `maxSeedWords`
+    // was removed in the hard cutover and is rejected as an additional
+    // property. The lite path never relaxes a non-negotiable (Story ticket,
+    // PR-to-main, repo gates, security baseline). Defaults live on
+    // DEFAULT_COMPLEXITY_GATE in `lib/orchestration/complexity-gate.js`;
+    // shape ceilings are the framework constants STORY_SHAPE_CEILINGS.
     complexityGate: {
       type: 'object',
       description:
-        'Plan-time ceremony-lite complexity gate. Routes trivial single-artifact seeds onto a collapsed plan/deliver path; conservative (full on any doubt). Never relaxes the Story-ticket / PR-to-main / repo-gates / security-baseline non-negotiables.',
+        'Shape-derived ceremony-lite complexity routing. A lite claim is validated against the authored Story shape at persist and re-derived from the Story body at dispatch; conservative (full on any doubt). Never relaxes the Story-ticket / PR-to-main / repo-gates / security-baseline non-negotiables.',
       properties: {
         enabled: {
           type: 'boolean',
           description:
-            'Master switch. When false, every seed takes the full plan/deliver ceremony. Default true.',
-        },
-        maxSeedWords: {
-          type: 'integer',
-          minimum: 0,
-          description:
-            'Seed prose word ceiling for the lite path. A seed above this many words is not trivial and takes the full path. Default 150.',
+            'Master switch. When false, lite routing is disabled everywhere: persist refuses lite claims and dispatch always takes the sub-agent path. Default true.',
         },
         maxArtifacts: {
           type: 'integer',
           minimum: 0,
           description:
-            'Enumerated-artifact ceiling for the lite path. A seed enumerating more than this many candidate artifacts is multi-capability and takes the full path. Default 1.',
+            'Enumerated-artifact threshold reported by the plan-context complexity signals. An input signal for the planner verdict — carries no routing authority. Default 1.',
         },
       },
       additionalProperties: false,

package/.agents/scripts/lib/orchestration/ceremony-routing.js

@@ -35,6 +35,19 @@
  * sub-agent. This module takes the cluster index as an INPUT and returns a
  * decision for that one cluster; it has no way to add or remove clusters.
  *
+ * ## One verdict-owner per cluster (Story #4723)
+ *
+ * The resolved decision names the cluster's **single verdict owner** via
+ * `verdictOwner`: `'fresh-critic'` when the mode is `fresh`,
+ * `'inline-self-eval'` when the mode is `inline`. Exactly one pass authors
+ * the cluster's verdict — the fresh maker-blind critic OR the
+ * contract-identical inline self-eval, never both, and never an additional
+ * pre-pass self-assessment before the owner runs. `acceptance-eval.js` is
+ * the deterministic SCORER of that one authored verdict (schema validation,
+ * round cap, proceed/redraft/block) — it is not a third pass over the
+ * criteria. This removes a redundant pass only; it never removes a
+ * cluster's verdict (the M4-B floor above holds).
+ *
  * ## Tier rules (per cluster, `standard` profile)
  *
  *   - `high` level       → `fresh`   (a sensitive path was touched — a
@@ -63,10 +76,23 @@
  * `undefined` / malformed inputs degrade to `fresh` + `full` ceremony.
  *
  * @typedef {'fresh'|'inline'} CeremonyMode
+ * @typedef {'fresh-critic'|'inline-self-eval'} VerdictOwner
  * @typedef {import('./review-depth.js').ChangeLevel} ChangeLevel
  * @typedef {'minimal'|'standard'|'strict'} CeremonyProfile
  */
 
+/**
+ * Map a resolved ceremony mode to the cluster's single verdict owner
+ * (Story #4723). Total: any non-`fresh` value maps to the inline
+ * self-eval owner, mirroring how the mode itself degrades.
+ *
+ * @param {CeremonyMode} mode
+ * @returns {VerdictOwner}
+ */
+export function verdictOwnerForMode(mode) {
+  return mode === 'fresh' ? 'fresh-critic' : 'inline-self-eval';
+}
+
 /** @type {readonly CeremonyProfile[]} */
 export const CEREMONY_PROFILES = Object.freeze([
   'minimal',
@@ -133,9 +159,28 @@ export function sampledFresh(clusterIndex, rate) {
  *   reason: string,
  *   sampled: boolean,
  *   profile: CeremonyProfile,
+ *   verdictOwner: VerdictOwner,
  * }}
  */
 export function resolveCeremonyForRisk(input = {}) {
+  const decision = resolveCeremonyDecision(input);
+  return { ...decision, verdictOwner: verdictOwnerForMode(decision.mode) };
+}
+
+/**
+ * Internal mode/reason resolution — the tier rules and sampling floor.
+ * `resolveCeremonyForRisk` decorates the result with the single
+ * `verdictOwner` derived from the mode (Story #4723).
+ *
+ * @param {Parameters<typeof resolveCeremonyForRisk>[0]} [input]
+ * @returns {{
+ *   mode: CeremonyMode,
+ *   reason: string,
+ *   sampled: boolean,
+ *   profile: CeremonyProfile,
+ * }}
+ */
+function resolveCeremonyDecision(input = {}) {
   const derivedLevel =
     input && typeof input === 'object' ? input.derivedLevel : undefined;
   const clusterIndex =