mandrel 2.36.0 → 2.38.0

package/.agents/README.md

@@ -4,10 +4,10 @@ An opinionated workflow framework for AI coding assistants built on
 Story-centric GitHub orchestration. Planning, execution, and state all live natively in GitHub Issues, Labels, and Projects V2.
 
 This is the consumer README inside the distributed `.agents/` bundle. It explains what each part of the bundle is for and captures the cross-directory authoring conventions. The process narrative for
-`/plan` and `/deliver` stays in [`docs/SDLC.md`](docs/SDLC.md).
+`/mandrel-plan` and `/mandrel-deliver` stays in [`docs/SDLC.md`](docs/SDLC.md).
 
 The framework payload (`.agents/`) is consumed by host repos. It ships inside the [`mandrel`](https://www.npmjs.com/package/mandrel)
-npm package and is materialized into a consumer's `./.agents/` directory by `mandrel sync`. It carries a system prompt, a baseline rule pack, a two-tier skill library, a slash-command workflow set, and the orchestration engine that runs Story-centric plans on GitHub (`/plan` → Stories, `/deliver` → `story-*` → `main`).
+npm package and is materialized into a consumer's `./.agents/` directory by `mandrel sync`. It carries a system prompt, a baseline rule pack, a two-tier skill library, a slash-command workflow set, and the orchestration engine that runs Story-centric plans on GitHub (`/mandrel-plan` → Stories, `/mandrel-deliver` → `story-*` → `main`).
 
 The framework version is the version of the installed [`mandrel`](https://www.npmjs.com/package/mandrel) npm package — run `npm ls mandrel` (or read `package.json`), not a
 count here.
@@ -44,7 +44,7 @@ unattended.
 
 After it completes, `mandrel init` runs the onboarding tail automatically —
 stack detection, docs scaffolding offer, a `mandrel doctor` readiness gate,
-and a printed `/plan` handoff — so you land at planning in one command.
+and a printed `/mandrel-plan` handoff — so you land at planning in one command.
 
 ### Manual Install
 
@@ -273,10 +273,10 @@ For non-interactive (CI) installs, pass `--owner`, `--repo`, and
 After bootstrap, every Mandrel command is generated into a flat
 `.claude/commands/` tree by `npm run sync:commands` (kept current at install
 time and on every `mandrel sync`/`update`) and loads as a bare `/<command>`
-slash command — e.g. `/plan`, `/deliver`, `/audit-security`. The commands load
+slash command — e.g. `/mandrel-plan`, `/mandrel-deliver`, `/audit-security`. The commands load
 in every Claude Code environment. The [SDLC guide](docs/SDLC.md) walks end-to-end planning and
-delivery; Stories pair [`/plan`](workflows/plan.md) (idea → drafted Story Issue)
-with [`/deliver`](workflows/deliver.md) (Story Issue → merged
+delivery; Stories pair [`/mandrel-plan`](workflows/mandrel-plan.md) (idea → drafted Story Issue)
+with [`/mandrel-deliver`](workflows/mandrel-deliver.md) (Story Issue → merged
 PR).
 
 ---
@@ -319,12 +319,12 @@ in `runtime-deps.json`.
 
 ## Ticket Hierarchy
 
-Orchestration and planning are **Story-only** (`type::story`) — `/plan`
+Orchestration and planning are **Story-only** (`type::story`) — `/mandrel-plan`
 persists Stories with inline `acceptance[]` / `verify[]` and a folded
-`## Spec`; `/deliver` runs `helpers/deliver-story` on `story-<id>` → PR →
+`## Spec`; `/mandrel-deliver` runs `helpers/deliver-story` on `story-<id>` → PR →
 `main`. There is no `type::epic` / `type::task` label, Epic issue form, or
 `epic/<id>` integration branch; a ticket carrying an `Epic: #N` footer is
-refused by `/deliver`. The execution-model contract is owned by
+refused by `/mandrel-deliver`. The execution-model contract is owned by
 [`instructions.md` § 5.B](instructions.md) and [`docs/SDLC.md`](docs/SDLC.md).
 
 ---
@@ -334,7 +334,7 @@ refused by `/deliver`. The execution-model contract is owned by
 | Path | Purpose |
 | ---- | ------- |
 | [`instructions.md`](instructions.md) | Primary system prompt loaded by the host AI tool. |
-| [`docs/SDLC.md`](docs/SDLC.md) | Operator process for `/plan` and `/deliver`. |
+| [`docs/SDLC.md`](docs/SDLC.md) | Operator process for `/mandrel-plan` and `/mandrel-deliver`. |
 | [`starter-agentrc.json`](starter-agentrc.json) | Bootstrap delta-seed copied to the consumer repo root as `.agentrc.json`. |
 | [`agentrc-reference.json`](docs/agentrc-reference.json) | Exhaustive editor reference enumerating every schema key with its framework default. |
 | [`agents/`](agents/) | Optional role-scoped spawn boot contexts (`delivery.routing.roleScopedAgents`). |
@@ -535,7 +535,7 @@ sessions, `gh auth login` is sufficient.
 ## Self-Healing Checks
 
 `scripts/lib/checks/` is the discovery-based registry of named checks
-consumed by preflight guards (`/deliver`, `single-story-close`, `npm test`),
+consumed by preflight guards (`/mandrel-deliver`, `single-story-close`, `npm test`),
 the `diagnose.js` ad-hoc viewer, and the retro surface. Use one check per
 file. The runner (`index.js`) loads checks at process start and filters by
 scope at each call site.
@@ -636,7 +636,7 @@ Schema conventions:
 
 ## Code review providers (pluggable chain)
 
-`runCodeReview()` (invoked from `helpers/deliver-story` and `/deliver`'s
+`runCodeReview()` (invoked from `helpers/deliver-story` and `/mandrel-deliver`'s
 risk-routed ceremony) loads its review backend through a pluggable registry
 configured via `delivery.codeReview.providers` — an array of entries iterated
 in declaration order. The chain-entry field semantics (`name`, `scopes`,
@@ -666,7 +666,7 @@ documented once in
 ## Multi-developer coordination
 
 Two operators can drive the same repository at once — for example, two
-`/deliver <storyId>` runs from separate clones. The framework keeps those
+`/mandrel-deliver <storyId>` runs from separate clones. The framework keeps those
 runs from clobbering one another with **two distinct coordination layers**.
 They solve different problems and must not be confused:
 
@@ -712,14 +712,14 @@ yanks the claim back from whoever legitimately took over.
 
 **Where it's wired:**
 
-- **`/deliver`** runs each Story through `helpers/deliver-story`, which
+- **`/mandrel-deliver`** runs each Story through `helpers/deliver-story`, which
   acquires the lease on the **Story** ticket at init and releases it at close
   ([`single-story-lease-guard.js`](scripts/lib/orchestration/single-story-lease-guard.js)).
   A live foreign claim refuses the run; pass `--steal` to override. The Story
   path requires `github.operatorHandle` to be set — without an operator identity
   the lease has no owner to record.
-- **`/plan`** does not take a planning lease on an Epic ticket. Planning is a
-  short authoring ceremony over Stories; concurrent `/plan` runs coordinate
+- **`/mandrel-plan`** does not take a planning lease on an Epic ticket. Planning is a
+  short authoring ceremony over Stories; concurrent `/mandrel-plan` runs coordinate
   via ordinary GitHub issue creation, not an Epic lease guard.
 
 ---

package/.agents/agents/plan-critic.md

@@ -5,7 +5,7 @@ description: >-
   system prompt (no CLAUDE.md / instructions.md closure). Reviews an authored
   plan draft (stories.json, optional techspec.md) against a single critic
   charter — consolidation or pre-mortem — and returns findings, without seeing
-  the planner's authoring transcript. Dispatched by workflows/plan.md §2.5 when
+  the planner's authoring transcript. Dispatched by workflows/mandrel-plan.md §2.5 when
   delivery.routing.roleScopedAgents is enabled (the default).
 ---
 

package/.agents/docs/SDLC.md

@@ -11,7 +11,7 @@ An Epic may still exist as an **optional untyped human umbrella issue**
 `.github/ISSUE_TEMPLATE/story.yml`), but **delivery and planning
 orchestration are Story-only**: there is no Epic wave loop, no
 `epic/<id>` integration branch, no `epic.yaml` reconciler, and any ticket
-that still carries an `Epic: #N` footer is **refused** by `/deliver`
+that still carries an `Epic: #N` footer is **refused** by `/mandrel-deliver`
 (close it or re-plan it as a v2 Story).
 
 The framework is **Claude Code-first**: `.claude/`, hooks, skills, and
@@ -26,25 +26,25 @@ ADR 20260512-coupling-stance in [`../docs/decisions.md`](../../docs/decisions.md
 
 From zero to shipped:
 
-1. **Plan the work.** Run [`/plan`](../workflows/plan.md) in your agentic IDE.
+1. **Plan the work.** Run [`/mandrel-plan`](../workflows/mandrel-plan.md) in your agentic IDE.
    The framework authors **one Story by default** (folded Tech Spec in
    `## Spec`), splitting into N>1 only under the default-single split policy.
-   Three operator modes are the **only** accepted entries — `/plan --seed
-   "<text>"` (ideate from chat text), `/plan --seed-file <path>` (author from
+   Three operator modes are the **only** accepted entries — `/mandrel-plan --seed
+   "<text>"` (ideate from chat text), `/mandrel-plan --seed-file <path>` (author from
    on-disk notes / a plan seed — the [`/audit-to-stories`](../workflows/audit-to-stories.md)
-   handoff via `--emit-plan-seed`), and `/plan --tickets 123[,456…]` (analyze
-   existing issue(s), preferring an N=1 rewrite). `/plan` is a **single path**
+   handoff via `--emit-plan-seed`), and `/mandrel-plan --tickets 123[,456…]` (analyze
+   existing issue(s), preferring an N=1 rewrite). `/mandrel-plan` is a **single path**
    — interrogate → author → persist, bracketed by two HITL gates and a single
    critic gate — with no Epic/Story router, scope-triage verdict, or
    `deliveryShape`. Duplicate search targets open **Stories**, never Epics. The
-   step-by-step lives in [`plan.md`](../workflows/plan.md).
+   step-by-step lives in [`mandrel-plan.md`](../workflows/mandrel-plan.md).
 
-2. **Deliver the Story.** Run [`/deliver <storyId>`](../workflows/deliver.md)
-   (or `/deliver <a> <b> …` for several). `/deliver` takes only Story ids and
+2. **Deliver the Story.** Run [`/mandrel-deliver <storyId>`](../workflows/mandrel-deliver.md)
+   (or `/mandrel-deliver <a> <b> …` for several). `/mandrel-deliver` takes only Story ids and
    resolves their dependency graph from live state — body edges union native
    GitHub `blocked_by` edges, every blocker checked against its real issue
    state, so a Story whose blocker landed in an earlier plan run is simply
-   ready. `/deliver` owns input resolution and dispatch order — the declared
+   ready. `/mandrel-deliver` owns input resolution and dispatch order — the declared
    `depends_on` edges plus a delivery-time file-overlap guard that withholds
    two Stories whose footprints would race the same path (see
    [`architecture.md` § Scheduler safety mechanics](../../docs/architecture.md));
@@ -52,14 +52,14 @@ From zero to shipped:
    [`helpers/deliver-story`](../workflows/helpers/deliver-story.md) —
    init → implement → acceptance self-eval → ceremony → close → CI watch →
    confirm-merge — which owns its own per-step detail. For a multi-Story run,
-   `/deliver` sequences ready Stories by `depends_on` — plus that footprint
+   `/mandrel-deliver` sequences ready Stories by `depends_on` — plus that footprint
    guard — and runs the per-run epilogue (audit roster · follow-up roll-up ·
    sibling coherence) once after the last Story lands.
 
 That is the whole happy path. Everything below is **detail** — branching
 conventions, HITL escalation, audit lenses — that you only need when the
 default flow requires adjustment. It intentionally **links** to
-[`plan.md`](../workflows/plan.md) and [`deliver.md`](../workflows/deliver.md)
+[`mandrel-plan.md`](../workflows/mandrel-plan.md) and [`mandrel-deliver.md`](../workflows/mandrel-deliver.md)
 rather than re-documenting the ceremony they own.
 
 ## Core Principles
@@ -79,7 +79,7 @@ rather than re-documenting the ceremony they own.
   `story-<id>` branch. Each Story reaches `main` through its own PR
   (squash + required checks); there is **no** `epic/<id>` integration
   branch and **no** `--no-ff` wave merge.
-- **One delivery engine.** `/deliver` resolves and sequences a Story set;
+- **One delivery engine.** `/mandrel-deliver` resolves and sequences a Story set;
   `helpers/deliver-story` executes each Story identically (trivial or
   large). Story sub-agents run inside the operator's Claude session via
   the Agent tool — worktree filesystem isolation is preserved; only the
@@ -133,12 +133,12 @@ graph LR
 
     subgraph Phase0 ["Phase 0: Bootstrap"]
         direction TB
-        Z["👤 npx mandrel init<br/>(install → sync → bootstrap.js → onboarding tail → /plan handoff)"]:::manual
+        Z["👤 npx mandrel init<br/>(install → sync → bootstrap.js → onboarding tail → /mandrel-plan handoff)"]:::manual
     end
 
     subgraph Phase1 ["Phase 1: Plan"]
         direction TB
-        A["👤 /plan --seed | --seed-file | --tickets"]:::manual
+        A["👤 /mandrel-plan --seed | --seed-file | --tickets"]:::manual
         B["🤖 interrogate → author → persist"]:::agentic
         A --> B
         B -.-> B_Art["📄 type::story issue(s)<br/>(+ depends_on edges)"]:::artifact
@@ -146,7 +146,7 @@ graph LR
 
     subgraph Phase2 ["Phase 2: Deliver"]
         direction TB
-        E["👤 /deliver &lt;storyId&gt; [&lt;storyId&gt;…]"]:::manual
+        E["👤 /mandrel-deliver &lt;storyId&gt; [&lt;storyId&gt;…]"]:::manual
         F["🤖 deliver-story: story-&lt;id&gt; from main<br/>implement → self-eval → ceremony → close"]:::agentic
         G["🤖 close-validation → code-review → open PR"]:::agentic
         E --> F --> G
@@ -192,14 +192,14 @@ branch-protection entries are preserved; missing ones are added.
 
 ## Phase 1: Planning
 
-Planning is owned end-to-end by [`/plan`](../workflows/plan.md). Rather than
+Planning is owned end-to-end by [`/mandrel-plan`](../workflows/mandrel-plan.md). Rather than
 re-document the ceremony here, this section states the contract the rest of
 the SDLC depends on:
 
 - **Entry is text or tickets, never Epic.** The only accepted invocations
   are `--seed`, `--seed-file`, and `--tickets`. There is no `--idea`, no
-  `--one-pager`, no `--from-notes`, and no positional `/plan <epicId>`.
-- **One Story by default.** `/plan` authors a single `type::story` issue
+  `--one-pager`, no `--from-notes`, and no positional `/mandrel-plan <epicId>`.
+- **One Story by default.** `/mandrel-plan` authors a single `type::story` issue
   whose body carries a folded `## Spec` (inline only — never spilled to
   `docs/`) plus top-level `acceptance[]` / `verify[]`. It splits into N>1
   siblings (ordered by `depends_on` edges) **only**
@@ -213,7 +213,7 @@ the SDLC depends on:
   `assertAcceptancePartition` so every acceptance criterion belongs to
   exactly one Story.
 - **Handoff.** Persist creates the Story issue(s) at `agent::ready` and
-  names the delivery command: `/deliver <storyId> [<storyId> ...]`.
+  names the delivery command: `/mandrel-deliver <storyId> [<storyId> ...]`.
 
 Optional split advisory notes come from
 [`core/scope-triage`](../skills/core/scope-triage/SKILL.md); there is no
@@ -223,13 +223,13 @@ behind them.
 Audit findings enter planning through
 [`/audit-to-stories`](../workflows/audit-to-stories.md), which groups and
 deduplicates findings and hands off via `--emit-plan-seed` →
-`/plan --seed-file <path>`.
+`/mandrel-plan --seed-file <path>`.
 
 ---
 
 ## Phase 2: Delivery
 
-Delivery is owned end-to-end by [`/deliver`](../workflows/deliver.md), which
+Delivery is owned end-to-end by [`/mandrel-deliver`](../workflows/mandrel-deliver.md), which
 delegates every Story to
 [`helpers/deliver-story`](../workflows/helpers/deliver-story.md). This
 section states the contract; the per-Story step detail (init, implement,
@@ -241,11 +241,11 @@ self-eval, ceremony, close, CI watch, confirm-merge, cleanup) lives in the
 
 | Mode | Entry point | When to use |
 | --- | --- | --- |
-| **Single Story** | `/deliver <storyId>` | Deliver one Story end-to-end; ends with a PR open to `main`. |
-| **Story set** | `/deliver <storyId> [<storyId>…]` | Deliver multiple Stories in `depends_on` order (default concurrency **3**), resolved from live state so edges may point at Stories from earlier plan runs; a delivery-time file-overlap guard additionally withholds two Stories whose footprints would race the same path (`delivery.deliverRunner.footprintGuard`). Each lands through its own PR, and the per-run epilogue runs after the set lands. |
-| **Story worker (internal)** | *helper* `helpers/deliver-story <storyId>` | Per-Story engine invoked internally by `/deliver`; not an operator slash command. |
+| **Single Story** | `/mandrel-deliver <storyId>` | Deliver one Story end-to-end; ends with a PR open to `main`. |
+| **Story set** | `/mandrel-deliver <storyId> [<storyId>…]` | Deliver multiple Stories in `depends_on` order (default concurrency **3**), resolved from live state so edges may point at Stories from earlier plan runs; a delivery-time file-overlap guard additionally withholds two Stories whose footprints would race the same path (`delivery.deliverRunner.footprintGuard`). Each lands through its own PR, and the per-run epilogue runs after the set lands. |
+| **Story worker (internal)** | *helper* `helpers/deliver-story <storyId>` | Per-Story engine invoked internally by `/mandrel-deliver`; not an operator slash command. |
 
-The single operator-facing entry point is `/deliver`. It performs no
+The single operator-facing entry point is `/mandrel-deliver`. It performs no
 git/label mutations itself — `deliver-story` owns every script invocation
 per Story. Any ticket that is not `type::story`, or that still carries an
 `Epic: #N` reference, is a hard error naming the ID and the fix (close or
@@ -269,7 +269,7 @@ own planning risk. Hard gates (lint / test / format / coverage / CRAP /
 maintainability) always run at close — risk never disables them; it only
 tunes acceptance-critic mode, review depth, and audit-lens selection. The
 full profile × scope matrix lives in
-[`deliver.md` § Ceremony](../workflows/deliver.md).
+[`mandrel-deliver.md` § Ceremony](../workflows/mandrel-deliver.md).
 
 ### State sync
 
@@ -321,7 +321,7 @@ resolution.
 ## HITL (Human-in-the-Loop) model
 
 On the happy path there is exactly **one** mandatory operator touchpoint
-after `/deliver` fires (blocker resolution). PR merge is autonomous via
+after `/mandrel-deliver` fires (blocker resolution). PR merge is autonomous via
 armed auto-merge; the operator becomes a second touchpoint only by
 exception.
 
@@ -411,7 +411,7 @@ pass — the tiers below *are* the audit machinery.
 | --- | --- | --- | --- |
 | Tier 1 — write-time | During Story implementation | Footprint-matched **local**-lens authoring checklists threaded into the Story prompt (`checklistPath`) | advisory |
 | Tier 2 — Story-scope | `single-story-close.js` (maker-blind subprocess) | Local-tier lens roster over the Story diff (`selectLocalLenses`) + review pillars, posted as `verification-results` | blocking on 🔴 |
-| Tier 3 — run closeout | `/deliver` per-run epilogue (`plan-run-epilogue.js`, N>1 only) | Cumulative + global lenses (`selectAudits`) over the combined landed tip | blocking |
+| Tier 3 — run closeout | `/mandrel-deliver` per-run epilogue (`plan-run-epilogue.js`, N>1 only) | Cumulative + global lenses (`selectAudits`) over the combined landed tip | blocking |
 
 - **`local`** lenses (decidable from a single Story's diff) are verified at
   Tiers 1–2 and are **not** re-run at run closeout.
@@ -452,7 +452,7 @@ baseline edits. The runbooks (bootstrap, refresh, floor policy) are owned by
 The standalone `/audit-<dimension>` workflows write
 `audit-<dimension>-results.md` under `temp/audits/`;
 [`/audit-to-stories`](../workflows/audit-to-stories.md) groups and deduplicates
-those findings and hands off to `/plan --seed-file` (or opens standalone
+those findings and hands off to `/mandrel-plan --seed-file` (or opens standalone
 Stories), closing the loop back into planning.
 
 ---
@@ -560,9 +560,9 @@ Editing the main checkout's `.agentrc.json` only affects **the next**
 
 ### `Epic: #N` refusal
 
-`/deliver` refuses any ticket that still carries an `Epic: #N` footer or is
+`/mandrel-deliver` refuses any ticket that still carries an `Epic: #N` footer or is
 not `type::story`. This is expected — v2 has no Epic delivery path. Close
-the ticket or re-plan the work as a v2 Story via `/plan --tickets <id>`.
+the ticket or re-plan the work as a v2 Story via `/mandrel-plan --tickets <id>`.
 
 ---
 
@@ -570,13 +570,13 @@ the ticket or re-plan the work as a v2 Story via `/plan --tickets <id>`.
 
 | Command | Purpose |
 | --- | --- |
-| `npx mandrel init` | Cold-start — install `mandrel` (if absent), `mandrel sync`, `bootstrap.js` (provisions repo + Projects V2 board, labels, branch protection), then the onboarding tail (stack detection, docs scaffolding, doctor gate, `/plan` handoff). |
-| `/plan --seed "<text>"` | Plan from chat text — interrogate → author **one Story by default** → persist `type::story`. |
-| `/plan --seed-file <path>` | Plan from on-disk notes / a plan seed (the `/audit-to-stories` handoff). |
-| `/plan --tickets <ids>` | Analyze existing issue(s) into proper Stories (prefer an N=1 rewrite). |
-| `/deliver <storyId>` | Deliver one Story via `helpers/deliver-story` — `story-<id>` → PR → `main`. |
-| `/deliver <storyId> [<storyId>…]` | Deliver multiple Stories in `depends_on` order (resolved from live state), then run the per-run epilogue. |
-| *helper* `helpers/deliver-story` | Per-Story engine invoked by `/deliver`; not an operator slash command. See [`deliver-story.md`](../workflows/helpers/deliver-story.md). |
-| `/audit-to-stories` | Convert audit findings into a plan seed / Stories → `/plan --seed-file`. |
+| `npx mandrel init` | Cold-start — install `mandrel` (if absent), `mandrel sync`, `bootstrap.js` (provisions repo + Projects V2 board, labels, branch protection), then the onboarding tail (stack detection, docs scaffolding, doctor gate, `/mandrel-plan` handoff). |
+| `/mandrel-plan --seed "<text>"` | Plan from chat text — interrogate → author **one Story by default** → persist `type::story`. |
+| `/mandrel-plan --seed-file <path>` | Plan from on-disk notes / a plan seed (the `/audit-to-stories` handoff). |
+| `/mandrel-plan --tickets <ids>` | Analyze existing issue(s) into proper Stories (prefer an N=1 rewrite). |
+| `/mandrel-deliver <storyId>` | Deliver one Story via `helpers/deliver-story` — `story-<id>` → PR → `main`. |
+| `/mandrel-deliver <storyId> [<storyId>…]` | Deliver multiple Stories in `depends_on` order (resolved from live state), then run the per-run epilogue. |
+| *helper* `helpers/deliver-story` | Per-Story engine invoked by `/mandrel-deliver`; not an operator slash command. See [`deliver-story.md`](../workflows/helpers/deliver-story.md). |
+| `/audit-to-stories` | Convert audit findings into a plan seed / Stories → `/mandrel-plan --seed-file`. |
 | `/qa-explore` · `/qa-assist` · `/qa-run` | Agent-led / human-led exploratory QA and the automated Gherkin harness. |
 | `/git-deliver` | Ad-hoc delivery of working-tree changes — detects the git setup and escalates to commit, commit + push, or commit + push + PR (auto-merge armed). |

package/.agents/docs/configuration.md

@@ -55,8 +55,8 @@ top-level keys are validation errors.
 | ------------- | -------- | ---------------------------------------------------------------------------------- |
 | `project`     | **Yes**  | Project-local paths, base branch, validation commands, and context-hydration files. |
 | `github`      | No       | Ticketing provider config: owner/repo, branch protection, merge methods, notifications. |
-| `planning`    | No       | `/plan` tuning: conflict advisories, complexity routing, navigability gate. (Story sizing ceilings and the planner-context cap are code-absolute — not agentrc.) |
-| `delivery`    | No       | `/deliver` tuning: quality gates, worktree isolation, runners, CI watch, code-review providers. |
+| `planning`    | No       | `/mandrel-plan` tuning: conflict advisories, complexity routing, navigability gate. (Story sizing ceilings and the planner-context cap are code-absolute — not agentrc.) |
+| `delivery`    | No       | `/mandrel-deliver` tuning: quality gates, worktree isolation, runners, CI watch, code-review providers. |
 | `qa`          | No       | Agent-driven QA harness contract: feature root, fixtures, environments, personas. |
 | `$schema`     | No       | JSON Schema pointer for editor tooling.                                            |
 
@@ -118,7 +118,7 @@ GitHub provider identity plus the remote stance the bootstrap enforces. `owner`,
 
 ### `planning` (optional)
 
-Inputs to `/plan`: risk escalation heuristics, ceremony-lite routing, and the cross-Story conflict-finding severity gates.
+Inputs to `/mandrel-plan`: risk escalation heuristics, ceremony-lite routing, and the cross-Story conflict-finding severity gates.
 
 | Key | Required | Type | Default | Description |
 | --- | --- | --- | --- | --- |
@@ -138,7 +138,7 @@ Inputs to `/plan`: risk escalation heuristics, ceremony-lite routing, and the cr
 
 ### `delivery` (optional)
 
-Everything `/deliver` and `single-story-close` consume: execution timeouts, worktree isolation, runner concurrency, docs freshness, signals, quality gates, merge/CI watch, review ceremony, and the feedback loop.
+Everything `/mandrel-deliver` and `single-story-close` consume: execution timeouts, worktree isolation, runner concurrency, docs freshness, signals, quality gates, merge/CI watch, review ceremony, and the feedback loop.
 
 | Key | Required | Type | Default | Description |
 | --- | --- | --- | --- | --- |
@@ -154,8 +154,8 @@ Everything `/deliver` and `single-story-close` consume: execution timeouts, work
 | `tempRetention.classes.validationEvidence` | No | `boolean` | `true` | Per-Story validation-evidence.json, lifecycle.ndjson, and manifest.md under the standalone and per-run story trees. |
 | `tempRetention.classes.auditResults` | No | `boolean` | `true` | <tempRoot>/audits/ — audit lens reports. |
 | `tempRetention.classes.planDirs` | No | `boolean` | `true` | <tempRoot>/plan-<slug>/ — abandoned plan authoring dirs. Age-floored only; the current run is always excluded. |
-| `deliverRunner` | No | `object` | — | Bounded-concurrency knob for the /deliver fan-out. |
-| `deliverRunner.concurrencyCap` | No | `integer` | `3` | Maximum ready Stories dispatched by /deliver at once. Default 3. Moderate by design — keeps host-quota consumption predictable while allowing a small ready-set fan-out. Set 1 for strictly sequential delivery; raise further on hosts with adequate parallel-agent quota. See deliver.md for the sequencing model and throughput tradeoff. |
+| `deliverRunner` | No | `object` | — | Bounded-concurrency knob for the /mandrel-deliver fan-out. |
+| `deliverRunner.concurrencyCap` | No | `integer` | `3` | Maximum ready Stories dispatched by /mandrel-deliver at once. Default 3. Moderate by design — keeps host-quota consumption predictable while allowing a small ready-set fan-out. Set 1 for strictly sequential delivery; raise further on hosts with adequate parallel-agent quota. See deliver.md for the sequencing model and throughput tradeoff. |
 | `deliverRunner.footprintGuard` | No | `"enforce"` \| `"advisory"` | `"enforce"` | How a file-footprint collision affects dispatch. 'enforce' (default, and the behaviour to keep unless you have a reason) withholds a Story whose footprint races a peer admitted this beat or one still in flight — the guard encodes delivery-time-only knowledge (open implementation windows, foreign leases, ground that moved since planning) that no depends_on edge can carry. 'advisory' still DETECTS every collision and reports each would-be withhold in the tick envelope, but lets dispatch follow the declared depends_on edges alone — a deliberate throughput trade for a run whose ordering is fully declared. See stories-wave-tick.js and helpers/deliver-reference.md. |
 | `worktreeIsolation` | No | `object` | — | Per-Story git worktree provisioning. Each Story is implemented in its own checkout so concurrent siblings never share a working tree. |
 | `worktreeIsolation.enabled` | No | `boolean` | `true` | When true, `single-story-init.js` materializes a worktree per Story. False implements every Story in the main checkout, which is only safe for strictly serial delivery. |
@@ -284,22 +284,22 @@ Everything `/deliver` and `single-story-close` consume: execution timeouts, work
 | `quality.baselineEpsilon.bundle-size` | No | `number` | `1024` | — |
 | `quality.baselineEpsilon.duplication` | No | `number` | `0.5` | — |
 | `quality.requireBaselines` | No | `boolean` | `false` | Story #4495. Fail-closed baseline-enforcement policy for the unified check-baselines close-validation gate. When false (default), a consumer that enables baseline gates (crap/maintainability/…) but has not committed the corresponding baseline artifacts under baselines/ gets a clean skip-with-reason instead of a deterministic first-try close failure. Set true to keep the gate registered so an absent baseline artifact fails close-validation with a preflight hint naming the fix (the fail-closed posture). |
-| `quality.navigability` | No | `object` | — | Navigability lens + journey-suite config (Epic #4131, F2/F3/F1/F4). Read by audit-suite/selector.js (route globs) and /deliver's per-Story ceremony (journey suite). Opt-in: absent or empty routeGlobs degrades to a silent no-op. |
+| `quality.navigability` | No | `object` | — | Navigability lens + journey-suite config (Epic #4131, F2/F3/F1/F4). Read by audit-suite/selector.js (route globs) and /mandrel-deliver's per-Story ceremony (journey suite). Opt-in: absent or empty routeGlobs degrades to a silent no-op. |
 | `quality.navigability.routeGlobs` | No | `array<string>` | `[]` | Glob patterns (pages/**, app/**/route.ts) marking paths that add a user-facing route — the route-tree SSOT the navigability lens enumerates and the route-added routing predicate matches against. |
 | `quality.navigability.navRegistry` | No | `array<string>` | `[]` | Tokens identifying the nav-registry SSOT the navigability lens checks every route resolves a nav door against. |
-| `quality.navigability.journeySuite` | No | `string` | — | Path or command for the per-persona journey suite /deliver's per-Story ceremony runs. |
+| `quality.navigability.journeySuite` | No | `string` | — | Path or command for the per-persona journey suite /mandrel-deliver's per-Story ceremony runs. |
 | `mergeWatch` | No | `object` | — | Knobs consumed by the close-and-land merge wait (Story #4543; defaults in `lib/orchestration/merge-poll.js`). `mode` (Story #4698) selects the close-time merge posture. `intervalSeconds` is the poll cadence between `gh pr view` probes after the arm. `maxWaitSeconds` bounds ONE invocation of the merge wait and its expiry returns a resumable `pending` terminal with no label mutation; `maxBudgetSeconds` bounds the CUMULATIVE wait across resumes (anchored at the PR's createdAt, so a resume does not restart the clock) and exhausting it is the genuine give-up that classifies and blocks. `updateAttempts` caps the bounded update of a behind-the-base PR. |
 | `mergeWatch.mode` | No | `"sync"` \| `"async"` | — | Close-time merge-wait posture (Story #4698). `sync` (default) keeps the in-close foreground merge wait unchanged. `async` caps the per-invocation wait to a short ~60s probe window — long enough to catch an instant merge and, via the head-anchored required-check predicate, an instantly-red required check — then returns the resumable `pending` terminal (exit 3) with a `nextCommand`. Opt in when slow CI makes the foreground wait routinely expire: the worker launches `nextCommand` in the background instead of burning the host tool slot polling. `maxBudgetSeconds` (the cumulative give-up) is unchanged. |
 | `mergeWatch.intervalSeconds` | No | `integer` | `30` | Seconds between merge-wait polls. Default 30. |
 | `mergeWatch.maxWaitSeconds` | No | `integer` | — | Per-invocation merge-wait bound (seconds). Default 300 (5 minutes) — chosen to fit inside a single host tool invocation (~10 min ceiling) alongside the close gates that precede the wait. Expiry yields `pending` (exit 3), never a block. Headless callers with no host ceiling raise this to land in one block. |
 | `mergeWatch.maxBudgetSeconds` | No | `integer` | `3600` | Cumulative wall-clock budget (seconds) across merge-wait resumes, anchored at the PR's createdAt. Default 3600 (60 minutes). Exhausting this classifies the block and transitions the Story to agent::blocked. |
 | `mergeWatch.updateAttempts` | No | `integer` | — | Maximum times the merge wait will bring a behind-the-base PR up to date before giving up on the branch. Default 3. Set 0 to disable the update. |
-| `codeReview` | No | `object` | — | Review-provider chain plus bounded-retry knobs for the /deliver code-review ceremony. |
+| `codeReview` | No | `object` | — | Review-provider chain plus bounded-retry knobs for the /mandrel-deliver code-review ceremony. |
 | `codeReview.providers[]` | No | `array<object>` | `[{"name":"native"},{"name":"security-review","scopes":["story"],"optional":true},{"name":"ultrareview","scopes":["story"],"manualPrompt":true,"when":{"label":"risk::high"}}]` | Review-provider chain (Story #2871). When unset or empty, defaults to [{ name: "native" }]. The orchestrator iterates inline entries in declaration order and merges their Finding[] before posting one structured comment; manual-prompt entries (e.g. ultrareview) contribute a trailing 'Manual review suggestions' section. Selecting an adapter whose probe fails hard-fails at factory construction unless declared `optional: true` in the chain. Each item has: name, scopes, optional, manualPrompt, when. |
 | `codeReview.providerConfig` | No | `object` | — | Optional escape hatch for adapter-specific configuration. No documented keys in Epic #2815; reserved so future adapters can be configured without another schema migration. |
-| `codeReview.maxFixAttempts` | No | `integer` | `3` | Maximum auto-fix retry attempts per finding in /deliver Phase 5 (code-review). 0 disables auto-fix. Default 3. |
+| `codeReview.maxFixAttempts` | No | `integer` | `3` | Maximum auto-fix retry attempts per finding in /mandrel-deliver Phase 5 (code-review). 0 disables auto-fix. Default 3. |
 | `codeReview.maxFixScopeFiles` | No | `integer` | `5` | Maximum file count a single auto-fix may modify before escalating to agent::blocked. Default 5. |
-| `codeReview.autoFixSeverity` | No | `"high"` \| `"medium"` | `"medium"` | Severity threshold for on-branch remediation in /deliver Phase 5 (code-review). `medium` (default) routes 🔴/🟠/🟡 findings into the host-LLM focused-fix routing (Mediums batched per lens: one commit per lens, a single validation + rescan at the end) while 🟢 suggestions still graduate to follow-up issues; `high` reproduces the pre-4399 Critical/High-only routing. Hard cutover — no back-compat flag. |
+| `codeReview.autoFixSeverity` | No | `"high"` \| `"medium"` | `"medium"` | Severity threshold for on-branch remediation in /mandrel-deliver Phase 5 (code-review). `medium` (default) routes 🔴/🟠/🟡 findings into the host-LLM focused-fix routing (Mediums batched per lens: one commit per lens, a single validation + rescan at the end) while 🟢 suggestions still graduate to follow-up issues; `high` reproduces the pre-4399 Critical/High-only routing. Hard cutover — no back-compat flag. |
 | `review` | No | `object` | — | Close-scope review tuning (Story #4699). Governs the Story-scope local-lens pass that runs inside the close subprocess; the maker-blind code-review pass and all hard gates are unaffected. |
 | `review.lensDiffFloor` | No | `integer` | — | Changed-line floor for the close-scope lens walk (Story #4699). A diff strictly below this many changed lines (additions + deletions) with zero sensitive-path hits skips lens materialization and records the skip in the findings-yield ledger. Default 40; 0 disables the skip. Hard gates and the maker-blind code-review pass are unaffected. |
 | `refactorStage` | No | `object` | — | Opt-in, config-gated post-green refactor checkpoint wired into story-deliver (Story #3430, Epic #3418). Strictly additive and default-OFF: when disabled, story-deliver behaves exactly as before. Advisory only — never changes existing close-validation gate semantics. |
@@ -414,7 +414,7 @@ A config still carrying the retired key is a hard validation failure; the
   proxy in both directions (a detailed prompt can describe trivial work, a
   terse one complex work), so `maxSeedWords` was **removed** in the hard
   cutover (a config still setting it is rejected as an additional property).
-  Routing is now staged on the objective shape of the work: `/plan`'s context
+  Routing is now staged on the objective shape of the work: `/mandrel-plan`'s context
   envelope emits advisory `complexitySignals` (enumerated-artifact count,
   risk-heuristic hits, repo state of predicted paths, sensitive-path classes)
   with **no routing authority**; the planner authors the trivial-vs-standard
@@ -423,7 +423,7 @@ A config still carrying the retired key is a hard validation failure; the
   lite claim against each authored Story's own shape (`changes[]` count,
   acceptance count, creates-vs-refactors mix, sensitive-path classes — the
   framework constants `STORY_SHAPE_CEILINGS`) and **fails closed to `full`**
-  when the shape exceeds the ceilings; and `/deliver` re-derives the route
+  when the shape exceeds the ceilings; and `/mandrel-deliver` re-derives the route
   from the fetched Story body via the same shape function at dispatch. The
   `route::lite` label is a human-visible hint only — a lost label cannot
   misroute delivery. A lite-shaped Story executes inline (no story-worker or
@@ -515,7 +515,7 @@ number of keys.
 
 | File                              | Audience                            | Role                                                                                                                                |
 | --------------------------------- | ----------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- |
-| `.agentrc.json` (repo root)       | The framework dogfooding itself     | Live config used when running `/plan` and `/deliver` against this repo. Exercises the framework end-to-end on its own source tree. |
+| `.agentrc.json` (repo root)       | The framework dogfooding itself     | Live config used when running `/mandrel-plan` and `/mandrel-deliver` against this repo. Exercises the framework end-to-end on its own source tree. |
 | `.agents/starter-agentrc.json`    | Downstream consumer repos           | Bootstrap delta-seed a consumer copies via `cp .agents/starter-agentrc.json .agentrc.json`. Minimum schema-required keys only.      |
 | `.agents/docs/agentrc-reference.json`       | Operators and reviewers             | Exhaustive editor reference enumerating every schema key with its framework default. Not a copy target.                             |
 
@@ -637,8 +637,8 @@ under one identity. So each contributor sets their own in `.agentrc.local.json`:
 carries only the non-personal placeholder `@[USERNAME]` (so CI and fresh clones
 validate without naming a real person). The placeholder is **not** a usable
 identity: [`normalizeOperatorHandle`](../scripts/lib/orchestration/ticket-lease.js)
-resolves `@[USERNAME]` to `null`, and the lease guards (`/plan`,
-`/deliver`, `/deliver`) **fail closed** — they throw with a
+resolves `@[USERNAME]` to `null`, and the lease guards (`/mandrel-plan`,
+`/mandrel-deliver`, `/mandrel-deliver`) **fail closed** — they throw with a
 "set your own handle in `.agentrc.local.json`" message rather than running an
 ownerless, unguarded workflow. Your local overlay replaces the placeholder with
 your real handle, and the guards proceed. By contrast, `github.owner` / `repo`
@@ -683,6 +683,31 @@ Claude Code web environment-variables UI for web sessions.
 | `NOTIFICATION_WEBHOOK_URL` | No        | POST target for in-band Notifier events (Make.com / Slack / Discord). Unset disables the webhook channel; `log` and `epic-comment` channels still fire. |
 | `WEBHOOK_SECRET`           | No        | Shared secret used to sign outbound webhook payloads as `X-Signature-256: sha256=<hmac>`. Unset ships unsigned payloads.                                 |
 | `MANDREL_ALLOW_TEST_WEBHOOKS` | No     | Set to `1` to keep `NOTIFICATION_WEBHOOK_URL` live inside `npm test` / `npm run test:profile`. Default behaviour scrubs the env var from the test child so no URL resolves and the webhook never fires (see below). |
+| `MANDREL_POOL_CONCURRENCY` | No | Upper bound on the width of every `runOnPool` worker pool in the process (the MI and CRAP scan pools). Precedence is: a caller's explicit `concurrency` → this variable → a clamp of 4 under `node:test` → `os.availableParallelism()`. Set it on a constrained or shared runner where one pool per core oversubscribes the host; a non-numeric value is ignored rather than collapsing the pool. |
+| `MANDREL_AGENTRC_VALIDATOR` | No | Set to `dynamic` to compile the `.agentrc.json` AJV validator at runtime instead of loading the committed precompiled one (see below). Costs ~35 ms per process; the escape hatch exists for a hand-edited schema or a host where the generated module will not load. |
+
+### The `.agentrc` validator is precompiled
+
+`getAgentrcValidator()` returns AJV's **standalone emit** for
+`AGENTRC_SCHEMA`, committed at
+[`.agents/scripts/lib/generated/agentrc-validator.js`](../scripts/lib/generated/agentrc-validator.js).
+Compiling that schema costs ~35 ms, and 36 of the framework's entry scripts
+resolve configuration, so the compile was being paid over and over to
+re-derive a function from a literal that is already in the repository.
+
+The artifact is generated — never hand-edited — by
+[`check-generated-validator.js`](../scripts/check-generated-validator.js):
+
+```bash
+npm run validator:gen     # rewrite it after a deliberate schema change
+npm run validator:check   # fail when it is stale (also run by `npm run lint`)
+```
+
+`npm run lint` runs the `--check` mode, so a schema edit that skips
+regeneration is refused rather than shipping a validator that accepts the
+wrong config. Validation behaviour is unchanged in either mode: the generated
+code is AJV's own, emitted with the same `allErrors: true` option the dynamic
+path uses, and returns the same verdict and the same `errors` array.
 
 ### Test-mode webhook isolation
 

package/.agents/docs/execution-reference.md

@@ -73,9 +73,9 @@ and schema mechanics are in [§ Friction telemetry](#friction-telemetry) above.
 
 Mandrel does **not** enforce live LLM spend from response metadata. It bounds
 two things, both **fixed framework constants** rather than operator knobs, and
-both **fail closed**: the assembled `/plan` context envelope, and plan-time
+both **fail closed**: the assembled `/mandrel-plan` context envelope, and plan-time
 Story sizing. Your host runtime (editor / CLI) owns session quota and hard
-stops. Consult this section when reasoning about why `/plan` refused an
+stops. Consult this section when reasoning about why `/mandrel-plan` refused an
 over-ceiling envelope or an over-budget Story count.
 
 > **There is no configurable context budget.** `planning.context.maxBytes` /
@@ -90,7 +90,7 @@ over-ceiling envelope or an over-budget Story count.
 > and was deleted in Story #5005; only its `estimateTokens` helper survived,
 > re-homed in `lib/orchestration/spec-spill.js`.
 
-### Planner-context envelope (`/plan`)
+### Planner-context envelope (`/mandrel-plan`)
 
 - **`PLAN_CONTEXT_ENVELOPE_BYTE_CEILING`** (`lib/orchestration/plan-context.js`):
   256 KB (≈64K tokens at the ≈4-chars/token estimate) on the serialized

package/.agents/docs/quality-gates.md

@@ -35,7 +35,7 @@ it once and reuse the context as you read through any individual gate.
 
 ## Concurrent close safety
 
-`/deliver` may close multiple Stories from separate branches in quick
+`/mandrel-deliver` may close multiple Stories from separate branches in quick
 succession; each rebases onto the latest `main` in its own base-sync phase
 (`phases/base-sync.js`) before the push, so concurrent closes serialize
 through their own worktrees rather than racing one shared branch. The push
@@ -517,7 +517,7 @@ should land in a commit whose:
 
 There is no CI guardrail rejecting unlabeled baseline edits; the convention is
 preserved so the operator can grep refresh commits in a PR diff, but
-self-policing is the operator's job during `/deliver`'s watch loop.
+self-policing is the operator's job during `/mandrel-deliver`'s watch loop.
 
 ### The per-method coverage join (Story #4775)
 

package/.agents/docs/workflows.md

@@ -16,7 +16,7 @@ compose. This file is only for "which command does X?" lookups.
 Every command file lives at `.agents/workflows/<name>.md` and is projected
 into a flat `.claude/commands/` tree by `npm run sync:commands` (kept
 current at install time and on every `mandrel sync`/`update`) so it shows
-up as a bare `/<name>` slash command (e.g. `/deliver`). The projection
+up as a bare `/<name>` slash command (e.g. `/mandrel-deliver`). The projection
 writes only `.claude/commands/<name>.md` — there is no plugin manifest and no
 marketplace listing. The commands load in every Claude Code environment.
 
@@ -52,16 +52,16 @@ description, edit the workflow file’s front-matter and regenerate.
 | `/audit-security` | Audit dependency CVEs, input-validation gaps, secrets handling, and auth boundaries; emit a structured High/Medium/Low findings report. |
 | `/audit-seo` | Audit SEO fundamentals and Generative Engine Optimization signals (meta, structured data, crawlability); only relevant for web targets. |
 | `/audit-sre` | "Audit production-readiness for a release candidate: SLOs, observability, runbooks, error budgets, and rollback paths." |
-| `/audit-to-stories` | Convert findings produced by the audit-\* workflows into actionable GitHub Stories. Reads temp/audits/audit-\*-results.md, groups findings cross-audit, deduplicates against existing Issues by fingerprint, and either chains into /plan --seed-file or opens standalone Stories. |
+| `/audit-to-stories` | Convert findings produced by the audit-\* workflows into actionable GitHub Stories. Reads temp/audits/audit-\*-results.md, groups findings cross-audit, deduplicates against existing Issues by fingerprint, and either chains into /mandrel-plan --seed-file or opens standalone Stories. |
 | `/audit-ux-ui` | Audit UX/UI consistency and design system adherence |
-| `/deliver` | Unified delivery entry point. Takes Story ids or a plain-language prompt, derives which path the work belongs on, and lands it via the single deliver-story engine — story-<id> → PR → main. |
 | `/git-cleanup` | Tidy the local checkout in four phases: fast-forward `main`, prune stale remote-tracking refs, sweep merged branches (squash-aware), and triage `git stash` entries — each step gated by operator confirmation. |
 | `/git-deliver` | Single ad-hoc delivery command for working-tree changes. Detects the git setup and escalates to the right terminal step — commit only, commit + push, or commit + push + open a PR with native auto-merge — picking the default from observable state and letting flags pin any level explicitly. Replaces the retired git-commit-all, git-push, and git-pr-all trio. |
+| `/mandrel-deliver` | Unified delivery entry point. Takes Story ids or a plain-language prompt, derives which path the work belongs on, and lands it via the single deliver-story engine — story-<id> → PR → main. |
+| `/mandrel-plan` | Unified planning entry point. Interrogate → author → persist. Emits one Story by default; splits into N>1 only under the default-single split policy. |
 | `/mandrel-update` | npm-era upgrade wraparound for a Mandrel consumer. Runs `npx mandrel update` (resolve newest published version → install → re-materialize `.agents/` → migrate → doctor → surface changelog) as the single mechanical step, then walks the operator through the judgment wraparound the CLI deliberately leaves unowned: reconcile `.agentrc.json`, install the stabilized quality-gate surface, refresh the harness permission allowlist, reconcile the consumer's `AGENTS.md` / runbooks against the surfaced changelog, and stage + commit the staged lockfile bump. |
-| `/memory-consolidate` | Attended consolidation pass over this project's agent memory pool — merge duplicates, verify claims against the current tree, prune with operator confirmation, rewrite the index, and stamp the pool so the /plan advisory goes quiet. |
-| `/plan` | Unified planning entry point. Interrogate → author → persist. Emits one Story by default; splits into N>1 only under the default-single split policy. |
+| `/memory-consolidate` | Attended consolidation pass over this project's agent memory pool — merge duplicates, verify claims against the current tree, prune with operator confirmation, rewrite the index, and stamp the pool so the /mandrel-plan advisory goes quiet. |
 | `/prototype` | Operator-invoked UI prototype pass. Discovers the consumer's design-system SSOT first, then — only after the operator confirms — writes exactly one self-contained HTML file under the gitignored workspace-root temp tree, so a layout can be reviewed before its UI acceptance criteria are authored. |
-| `/qa-assist` | Human-led QA assist loop — set up, then ride a rolling multi-observation intake session. The operator reports observations in any order; the agent enriches each (repro + root-cause file:line + coverage verdict for bugs; analysis + options + recommendation for enhancements), asks clarifying questions only when ambiguous, and appends a redacted ledger item — recording, never planning — to a persistent, resumable session under temp/qa/. Only when the operator says they are done does it review the full ledger and hand off to /plan. |
+| `/qa-assist` | Human-led QA assist loop — set up, then ride a rolling multi-observation intake session. The operator reports observations in any order; the agent enriches each (repro + root-cause file:line + coverage verdict for bugs; analysis + options + recommendation for enhancements), asks clarifying questions only when ambiguous, and appends a redacted ledger item — recording, never planning — to a persistent, resumable session under temp/qa/. Only when the operator says they are done does it review the full ledger and hand off to /mandrel-plan. |
 | `/qa-explore` | Agent-led exploratory-QA loop — the agent Plans a surface with an explicit static-vs-drive method choice, drives it (browser MCP or static), and captures ledger items read-only, then Triages — a bounded per-surface session, HITL-gated at every phase transition, routed through the shared dedup/coverage/classification/missing-test/redaction/session core under temp/qa/ |
 | `/qa-run` | Drive Gherkin scenarios through a real browser as an agent-driven QA sweep |
 

package/.agents/instructions.md

@@ -114,7 +114,7 @@ always wins regardless of tier.
 ## 2. FinOps & Token Budgeting (Economic Guardrails)
 
 Mandrel does not enforce live LLM spend; your host owns session quota.
-Fixed framework ceilings (the `/plan` context envelope, plan-time Story
+Fixed framework ceilings (the `/mandrel-plan` context envelope, plan-time Story
 sizing) **fail closed** naming what to trim:
 [`docs/execution-reference.md`](docs/execution-reference.md#finops--token-budgeting-economic-guardrails).
 
@@ -132,7 +132,7 @@ sizing) **fail closed** naming what to trim:
    `acceptance[]` / `verify[]`); prefer targeted retrieval over broad
    reads.
 2. **Plan First.** For non-trivial tasks (3+ steps or architectural
-   decisions), update the Story's `## Spec` via `/plan` before code.
+   decisions), update the Story's `## Spec` via `/mandrel-plan` before code.
 3. **Artifacts over Chat.** Write test/build/debug output to log
    files, not into chat.
 4. **Idempotency.** Scripts must be safe to run repeatedly.
@@ -174,10 +174,10 @@ prompted.
 The v2 ticket model is Story-only: `acceptance[]` / `verify[]` live
 inline plus the folded Tech Spec in `## Spec` (over-budget Specs fail
 closed — split or tighten; never write Specs under `docs/`). Optional
-`depends_on` edges order rare multi-Story runs, resolved by `/deliver`
+`depends_on` edges order rare multi-Story runs, resolved by `/mandrel-deliver`
 from live state; the `plan-run::<id>` label is filter metadata only.
 Commit subjects reference the Story via `(refs #<storyId>)`. There is no
-`type::epic` / `type::task` label; `/deliver` refuses tickets carrying an
+`type::epic` / `type::task` label; `/mandrel-deliver` refuses tickets carrying an
 `Epic: #N` footer.
 
 ---
@@ -192,7 +192,7 @@ anything under it.
 
 ## 7. Complexity-Aware Execution
 
-`/plan` sizes each Story as a **capability slice a frontier model
+`/mandrel-plan` sizes each Story as a **capability slice a frontier model
 delivers and self-verifies in one pass** — a broad footprint is normal
 when the change is cohesive (backstop: `DEFAULT_MODEL_CAPACITY` in
 `ticket-validator-sizing.js`); do not re-slice it into per-module