mandrel 2.30.0 → 2.32.0

package/.agents/scripts/lib/config/limits.js

@@ -6,7 +6,6 @@
  * `planning.*` and `delivery.*`:
  *
  *   - `delivery.execution.timeoutMs` (per-process execution timeout)
- *   - `delivery.lease.ttlMs` (assignee-as-lease staleness window — Story #3480)
  *   - `delivery.signals.{rework, retry}` (performance-signal detector
  *     thresholds — `hotspot` retired with Epic #4406; `churn`/`idle` dropped)
  *
@@ -14,7 +13,9 @@
  *   - `maxTickets` — decomposer reviewability budget (Story #4163)
  *
  * Dropped entirely: `maxInstructionSteps`, `friction.*`, `executionMaxBuffer`,
- * `signals.{churn, idle}`, `delivery.preflight`, `delivery.maxTokenBudget`
+ * `signals.{churn, idle}`, `delivery.preflight`, `delivery.lease.ttlMs`
+ * (Story #5006 deleted the lease TTL: with no heartbeat source every foreign
+ * claim read live, so the window decided nothing), `delivery.maxTokenBudget`
  * (planning no longer sizes against a token-budget envelope; session-mass
  * ceilings are absolute in `DEFAULT_MODEL_CAPACITY`), and
  * `planning.context.{maxBytes, summaryMode}` (Story #4541 — the `applyBudget`
@@ -39,26 +40,12 @@ export const SIGNALS_DEFAULTS = Object.freeze({
   retry: Object.freeze({ repeatCount: 3 }),
 });
 
-/**
- * Default TTL for the assignee-as-lease primitive (Story #3480). A claim
- * whose owner's last heartbeat is older than this window is considered stale
- * and may be reclaimed by another operator.
- *
- * Note: no shipped caller supplies a real heartbeat — the emitter was inert
- * and was deleted (A22), so the guards anchor liveness to `now` and every
- * foreign claim reads live (fail-closed; clear a stranded claim with
- * `--steal`). This value is therefore only consulted by a caller that threads
- * its own `heartbeatAt`, and is kept as the documented default for that seam.
- */
-export const LEASE_TTL_MS_DEFAULT = 900000;
-
 /**
  * Framework defaults for the surviving limits surface.
  */
 export const LIMITS_DEFAULTS = Object.freeze({
   maxTickets: 80,
   executionTimeoutMs: 600000,
-  leaseTtlMs: LEASE_TTL_MS_DEFAULT,
   signals: SIGNALS_DEFAULTS,
 });
 
@@ -94,7 +81,6 @@ function mergeSignals(userSignals) {
  * @returns {{
  *   maxTickets: number,
  *   executionTimeoutMs: number,
- *   leaseTtlMs: number,
  *   signals: ReturnType<typeof mergeSignals>,
  * }}
  */
@@ -107,13 +93,10 @@ export function resolveLimits(config) {
     delivery.execution && typeof delivery.execution === 'object'
       ? delivery.execution
       : {};
-  const lease =
-    delivery.lease && typeof delivery.lease === 'object' ? delivery.lease : {};
   return {
     maxTickets: LIMITS_DEFAULTS.maxTickets,
     executionTimeoutMs:
       execution.timeoutMs ?? LIMITS_DEFAULTS.executionTimeoutMs,
-    leaseTtlMs: lease.ttlMs ?? LIMITS_DEFAULTS.leaseTtlMs,
     signals: mergeSignals(delivery.signals),
   };
 }
@@ -141,31 +124,3 @@ export function getLimits(config) {
 export function getSignals(config) {
   return getLimits(config).signals;
 }
-
-/**
- * Resolve the assignee-as-lease TTL in milliseconds (Story #3480). Standalone
- * accessor so the `ticket-lease` module can import it without dragging the
- * whole limits surface into its bundle. Precedence:
- *
- *   1. An explicit `override` (a positive finite number) — lets a caller or
- *      test pin the TTL directly.
- *   2. `delivery.lease.ttlMs` from the resolved config.
- *   3. `LEASE_TTL_MS_DEFAULT`.
- *
- * A non-positive or non-finite override is ignored (falls through to config /
- * default) so a stray `0` can never collapse every claim to instantly-stale.
- *
- * @param {object | null | undefined} config
- * @param {number} [override]
- * @returns {number}
- */
-export function resolveLeaseTtlMs(config, override) {
-  if (
-    typeof override === 'number' &&
-    Number.isFinite(override) &&
-    override > 0
-  ) {
-    return override;
-  }
-  return getLimits(config).leaseTtlMs;
-}

package/.agents/scripts/lib/config/qa.js

@@ -0,0 +1,105 @@
+/**
+ * `qa.gherkinLint` accessor — the static Gherkin corpus gate's contract.
+ *
+ * The gate is **opt-in**: absent this block, `check-gherkin-corpus.js` reports
+ * that it is not configured and exits 0. That is not politeness. `.agents/`
+ * reaches a consumer by plain file copy, so every framework upgrade lands this
+ * gate in every project at once; a default-on corpus lint would redden the
+ * `lint` required check of every repo that happens to own a `.feature` file it
+ * never asked the framework to police.
+ *
+ * Inside the opt-in the posture inverts and the gate fails **closed** — an
+ * unresolvable parser or a scope that resolves no step definitions is an
+ * error, never a quiet pass. Both are the same blackout the gate exists to
+ * catch, wearing a different costume.
+ *
+ * Scopes are the load-bearing shape. Pooling every step root into one matcher
+ * list makes a cross-app false bind possible: a step defined only in app B's
+ * suite silently vouches for app A's feature, and the gate reports green on a
+ * corpus that cannot generate. Resolving each feature against **its own**
+ * scope's step roots makes that structurally impossible rather than merely
+ * unlikely.
+ */
+
+/**
+ * Framework defaults for the two escape hatches. `@skip` is the conventional
+ * "not meant to run" tag across cucumber-js and playwright-bdd, so it is the
+ * default exemption; the waiver list starts empty because every entry is a
+ * project-specific admission that the step index guessed wrong.
+ */
+const GHERKIN_LINT_DEFAULTS = Object.freeze({
+  exemptionTags: Object.freeze(['@skip']),
+  stepWaivers: Object.freeze([]),
+});
+
+/** Coerce a value to an array of non-empty strings. */
+function stringArray(value, fallback) {
+  if (!Array.isArray(value)) return [...fallback];
+  return value.filter((item) => typeof item === 'string' && item.length > 0);
+}
+
+/**
+ * Normalize one scope entry into `{ name, featureRoots, stepRoots }`.
+ *
+ * @param {string} name
+ * @param {object} raw
+ * @returns {{ name: string, featureRoots: string[], stepRoots: string[] }}
+ */
+function normalizeScope(name, raw) {
+  return {
+    name,
+    featureRoots: stringArray(raw?.featureRoots, []),
+    stepRoots: stringArray(raw?.stepRoots, []),
+  };
+}
+
+/**
+ * Normalize a raw `qa.gherkinLint` block.
+ *
+ * @param {object | null | undefined} raw
+ * @returns {{
+ *   scopes: Array<{ name: string, featureRoots: string[], stepRoots: string[] }>,
+ *   exemptionTags: string[],
+ *   stepWaivers: string[],
+ * } | null} `null` when the block is absent or not an object
+ */
+function resolveGherkinLint(raw) {
+  if (!raw || typeof raw !== 'object' || Array.isArray(raw)) return null;
+  const scopesRaw =
+    raw.scopes && typeof raw.scopes === 'object' && !Array.isArray(raw.scopes)
+      ? raw.scopes
+      : {};
+  return {
+    scopes: Object.keys(scopesRaw)
+      .sort()
+      .map((name) => normalizeScope(name, scopesRaw[name])),
+    exemptionTags: stringArray(
+      raw.exemptionTags,
+      GHERKIN_LINT_DEFAULTS.exemptionTags,
+    ),
+    stepWaivers: stringArray(
+      raw.stepWaivers,
+      GHERKIN_LINT_DEFAULTS.stepWaivers,
+    ),
+  };
+}
+
+/**
+ * Read the normalized `qa.gherkinLint` contract off a resolved config.
+ *
+ * @param {object | null | undefined} config
+ * @returns {ReturnType<typeof resolveGherkinLint>}
+ */
+export function getGherkinLint(config) {
+  return resolveGherkinLint(config?.qa?.gherkinLint);
+}
+
+/**
+ * Module-private surface the suite drives directly, bundled behind one export
+ * for the same reason as `bdd-step-index.js`: `getGherkinLint` is the whole
+ * public API, and the normalizer and its defaults are how it is built.
+ */
+export const __testing = Object.freeze({
+  GHERKIN_LINT_DEFAULTS,
+  resolveGherkinLint,
+});

package/.agents/scripts/lib/config/temp-paths.js

@@ -13,7 +13,7 @@
  *     ├─ techspec.md
  *     ├─ manifest.md          (dispatch manifest)
  *     ├─ retro.md             (mirror of GitHub retro at Epic close)
- *     ├─ lifecycle.ndjson     (lifecycle bus ledger)
+ *     ├─ lifecycle.ndjson     (lifecycle ledger)
  *     ├─ checkpoints/...      (pre-v2 epic-runner state store; retained layout)
  *     ├─ <name>               (runArtifactPath escape hatch)
  *     └─ stories/
@@ -124,7 +124,7 @@ export function _clearMainCheckoutRootCache() {
  *
  * The shared test bootstrap (`lib/test-env.js`) sets this to a fresh
  * `os.tmpdir()` directory before spawning the test runner, so any test that
- * reaches a writer (`signals-writer`, the lifecycle `LedgerWriter`, etc.)
+ * reaches a writer (`signals-writer`, `appendLedgerEvent`, etc.)
  * *without* explicitly injecting an absolute tempRoot still resolves under
  * scratch instead of the repo's real `temp/` tree. This is the single
  * injection seam: because every path helper funnels a relative root through
@@ -573,9 +573,10 @@ function storyArtifactPath(eid, sid, name, config) {
 }
 
 /**
- * `temp/run-<eid>/lifecycle.ndjson` — append-only lifecycle bus ledger
- * (Story #2510). The LedgerWriter persists every emitted/completed/failed
- * record here; the TraceLogger renders the companion markdown from it.
+ * `temp/run-<eid>/lifecycle.ndjson` — append-only lifecycle ledger
+ * (Story #2510). `appendLedgerEvent` persists one `emitted` record here per
+ * merge-terminal outcome; Story #5024 retired the `LedgerWriter` listener and
+ * the `TraceLogger` markdown companion that preceded it.
  *
  * The path is also the canonical input the standalone `lifecycle-emit`
  * CLI feeds to `buildDefaultListenerChain` when assembling the default