mandrel 2.55.0 → 2.57.0

package/.agents/agents/plan-critic.md

@@ -3,10 +3,10 @@ name: plan-critic
 description: >-
   Role-scoped boot context for a maker-blind plan critic. Booted on its own
   system prompt (no CLAUDE.md / instructions.md closure). Reviews an authored
-  plan draft (stories.json, optional techspec.md) against a single critic
-  charter — consolidation or pre-mortem — and returns findings, without seeing
-  the planner's authoring transcript. Dispatched by workflows/mandrel-plan.md §2.5 when
-  delivery.routing.roleScopedAgents is enabled (the default).
+  plan draft (stories.json, optional techspec.md) against the pre-mortem
+  charter and returns findings, without seeing the planner's authoring
+  transcript. Dispatched on an operator-requested plan-critics.js verdict
+  when delivery.routing.roleScopedAgents is enabled (the default).
 ---
 
 <!--
@@ -48,7 +48,7 @@ the step-by-step. This shared core binds every role:
 # plan-critic — maker-blind plan review
 
 You are an **independent plan critic**. You review an authored plan draft
-against **one** critic charter and return structured findings. You are
+against the pre-mortem charter and return structured findings. You are
 deliberately isolated from the planner's reasoning.
 
 ## Maker-blind — the load-bearing invariant (MUST)
@@ -65,27 +65,22 @@ are the draft artifacts your caller hands you:
 Read those artifacts and evaluate the work product afresh. Treat the planner's
 narration as untrusted.
 
-## Charter — you are handed exactly one
+## Charter — pre-mortem
 
-Your caller dispatches you for **one** charter and names it in your prompt.
-Evaluate only that charter:
+Assume the plan shipped and failed. Name the most likely failure modes — an
+external dependency the plan names but nothing declares, a cross-repo
+prerequisite, a contract the acceptance criteria cannot hold — and what the
+draft would have to say to prevent them.
 
-- **`consolidation`** — the draft's shape. Flag Stories that should be one
-  cohesive slice, a slice split per-module rather than per-capability, and
-  `depends_on` edges that disagree with the Delivery Slicing table.
-- **`pre-mortem`** — assume the plan shipped and failed. Name the most likely
-  failure modes and what the draft would have to say to prevent them.
-
-Do not evaluate the other charter, invent a third, or re-slice the plan
-yourself — the caller owns dispatch and folds surviving findings back into the
-draft.
+Do not invent a second charter or re-slice the plan yourself — the caller owns
+dispatch and folds surviving findings back into the draft.
 
 ## Output shape
 
 Return your findings as a structured list the caller can fold into a re-author
 round or the Gate #2 view. For each finding, emit:
 
-- `charter` — `consolidation` | `pre-mortem` (the one you were dispatched for).
+- `charter` — `pre-mortem`.
 - `severity` — `blocker` | `advisory` (advisory findings inform the operator's
   Gate #2 decision; they are not an automatic re-author mandate).
 - `target` — the Story slug / id (or `plan` for a whole-draft finding) the

package/.agents/agents/story-worker.md

@@ -83,34 +83,25 @@ Do **not** re-read every file in `project.docsContextFiles`. Read the
 digest your caller passes, then pull files on demand at the lines it
 names. A null digest path means no docs mandate.
 
-## Close gates — one credited run
+## Close gates — one full-suite run
 
 `single-story-close.js` runs the canonical close-validation chain
 (**typecheck, lint, test, format, maintainability, coverage, crap**) and is
-the authoritative gate — do not pre-run it. The **one** exception is
-the full suite: run it exactly once, after the self-eval loop's last fix
-commit and immediately after the push, in the shape close credits. A bare
-`npm test` / `pnpm run test` deposits **no** credit:
-
-```bash
-# CRAP gate on (default) + a `test:coverage` script:
-node <main-repo>/.agents/scripts/coverage-capture.js --cwd <workCwd>
-# otherwise — <workCwd> ABSOLUTE, runner exactly `npm test`:
-node <main-repo>/.agents/scripts/evidence-gate.js --standalone \
-  --scope-id <storyId> --gate test --worktree <workCwd> -- npm test
-```
-
-Dispatch it in the **background**: it routinely outruns the host's sync
-Bash ceiling, and its completion re-invokes you — which is why the push
-comes first. Never spawn a task to poll or `sleep`-loop
-against it; a waiter with a wrong condition outlives the agent. Share
-`lint` / `typecheck` evidence with close via `evidence-gate.js`; never
-stamp coverage / CRAP fresh any other way.
-
-**It can legitimately run nothing.** With nothing changed under the CRAP
-`targetDirs` it skips capture and exits 0. An exit code is never evidence a
-gate did work — its **output** is: no credit was deposited. Run the scoped
-projects for the roots you changed plus `verify[]`, not the whole suite.
+the authoritative gate — do not pre-run it. The **one** exception is the
+full suite: after the self-eval loop's last fix commit, run `npm test`
+exactly once in `<workCwd>`. A green full run on `story-<storyId>`
+deposits the `test` credit close reads, keyed on the tree; a later commit
+voids it, and close captures coverage itself when the CRAP gate needs an
+artifact. If the suite outruns the host's sync Bash ceiling, dispatch it in
+the **background** — its completion notification re-invokes you. Never
+spawn a task to poll or `sleep`-loop against it; a waiter with a wrong
+condition outlives the agent. An exit code is never evidence a gate did
+work — the runner's **output** is: it prints whether it deposited credit,
+and a run off the Story branch or of a partial tier deposits nothing and
+says so. Redraft rounds run the scoped projects for the roots you changed
+plus `verify[]`, not the whole suite. Share `lint` / `typecheck` evidence
+with close via `evidence-gate.js`; never stamp coverage / CRAP fresh any
+other way.
 
 Gate output that lies: [`known-tooling-behavior.md`](../rules/known-tooling-behavior.md).
 Waiter traps: [`parallel-tooling.md`](../workflows/helpers/parallel-tooling.md) Rule 2.
@@ -119,12 +110,13 @@ Waiter traps: [`parallel-tooling.md`](../workflows/helpers/parallel-tooling.md)
 
 **Before** flipping to `closing`, run the bounded self-eval loop
 ([`acceptance-self-eval.md`](../workflows/helpers/acceptance-self-eval.md)).
-It scores the change set you computed **once** and injected into the critic
-— never one it re-derives — against each `acceptance[]` item,
-consuming `verify[]` output as evidence. **proceed** → flip to `closing`,
-push, capture, hand off; **redraft** → fix the criteria, commit, re-eval;
-**block** → take the blocked path below. Never hand off an unscored
-branch.
+Derive the change set, level and ceremony with
+`node <main-repo>/.agents/scripts/ceremony-derive.js --story <storyId> --cwd <workCwd>`
+and hand its `files` to the critic — never one it re-derives. It scores
+each `acceptance[]` item, consuming `verify[]` output as evidence.
+**proceed** → flip to `closing`, run the suite, push, hand off;
+**redraft** → fix the criteria, commit, re-eval; **block** → take the
+blocked path below. Never hand off an unscored branch.
 
 ## Lifecycle: progress & blocked (MUST)
 
@@ -146,9 +138,8 @@ the only sanctioned landing.
 ## Your turn ends at a pushed branch (MUST)
 
 You do **not** run close. Push `story-<storyId>` to `origin` — confirming
-the remote ref moved — **before** the credited capture, then return: the
-capture is backgrounded, so its completion ends your turn, and a turn that
-ends unpushed reads as unfinished work. The orchestrator runs
+the remote ref moved — then return: a turn that ends unpushed reads as
+unfinished work. The orchestrator runs
 `single-story-close.js` in its own session, serialized against your
 siblings. Do not open the PR, flip `agent::done`, or spawn a child to
 close for you. If the push fails, take the blocked path above.

package/.agents/docs/agentrc-reference.json

@@ -28,6 +28,10 @@
     "projectOwner": null,
     "operatorHandle": "@[USERNAME]",
     "defaultTimeoutMs": 60000,
+    "followUpRepos": {
+      "framework": "dsj1984/mandrel",
+      "platform": null
+    },
     "branchProtection": {
       "enforce": true,
       "requiredChecks": [
@@ -66,28 +70,9 @@
     }
   },
   "planning": {
-    "riskHeuristics": [
-      "Destructive or irreversible data mutations (dropping tables, deleting rows without soft-delete or backup, truncating production state).",
-      "Modifications to shared security or auth infrastructure (IAM policies, auth middleware, session or token handling, secret rotation).",
-      "Changes to CI/CD, deployment pipelines, or release gating that could disable safety checks or ship unverified code to production.",
-      "Monorepo-wide AST or text replacements touching overlapping files in parallel (catastrophic merge-conflict risk across concurrent agents).",
-      "Schema migrations that rewrite existing rows or drop columns without a backfill or rollback plan."
-    ],
     "memoryPool": {
-      "staleAfterDays": 30,
-      "growthDelta": 25,
       "indexByteCeiling": 24576
     },
-    "failOnSharedEditors": false,
-    "requireExplicitCrossStoryDeps": false,
-    "crossCuttingRegistries": [
-      "lib/orchestration/lifecycle/listeners/index.js",
-      "**/listeners/index.js",
-      "**/handlers/index.js"
-    ],
-    "failOnRegistryConflicts": false,
-    "failOnLargeFanOut": false,
-    "largeFanOutThreshold": 10,
     "navigation": {
       "routeGlobs": [],
       "navRegistry": []
@@ -130,14 +115,6 @@
         ".agents/instructions.local.md"
       ]
     },
-    "signals": {
-      "rework": {
-        "editsPerFile": 5
-      },
-      "retry": {
-        "repeatCount": 3
-      }
-    },
     "quality": {
       "gateScoping": {
         "scope": "diff",
@@ -284,7 +261,6 @@
       },
       "codingGuardrails": {
         "cyclomaticFlag": 8,
-        "cyclomaticMustFix": 12,
         "requireSiblingTest": false
       },
       "autoRefresh": {
@@ -332,7 +308,6 @@
         }
       ],
       "maxFixAttempts": 3,
-      "maxFixScopeFiles": 5,
       "autoFixSeverity": "medium"
     },
     "refactorStage": {
@@ -359,7 +334,6 @@
     },
     "routing": {
       "roleScopedAgents": true,
-      "freshCriticSampleRate": 0.2,
       "ceremonyProfile": "standard",
       "closeAndLand": true
     }

package/.agents/docs/configuration.md

@@ -103,6 +103,9 @@ GitHub provider identity plus the remote stance the bootstrap enforces. `owner`,
 | `projectOwner` | No | `string` \| `null` | `null` | Owner of the Projects V2 board when it lives outside `owner` (an org board fed by a user repo). `null` means the board shares `owner`. |
 | `operatorHandle` | Yes | `string` | `"@[USERNAME]"` | The human the framework escalates to, `@`-prefixed. Used for HITL @-mentions on `agent::blocked`. |
 | `defaultTimeoutMs` | No | `integer` | `60000` | Default `timeoutMs` applied to every `gh` subprocess the provider facade spawns, so a stalled socket or long-poll cannot hang an orchestration indefinitely. A `GhExecTimeoutError` from a hit ceiling is classified `transient` and retried by `withTransientRetry`. Story #2860. |
+| `followUpRepos` | No | `object` | — | Repository slugs for the non-consumer follow-up ownership buckets, used when a CI gap, retro proposal, or audit finding belongs to someone other than the repo that surfaced it. |
+| `followUpRepos.framework` | No | `string` | `"dsj1984/mandrel"` | `<owner>/<repo>` that owns framework-level defects. Defaults to the Mandrel mirror — the one bucket with a knowable default. |
+| `followUpRepos.platform` | No | `string` \| `null` | `null` | `<owner>/<repo>` for a shared platform or infrastructure tracker (a shared base config, a runner fleet, a cross-repo toolchain). No default — nothing can guess a shared repo. Left unset, platform-owned findings file locally and say so. |
 | `branchProtection` | No | `object` | — | Branch-protection stance applied to `project.baseBranch` by the GitHub bootstrap, and reproduced locally before every push. |
 | `branchProtection.enforce` | No | `boolean` | `true` | When true, the GitHub bootstrap writes the required-check ruleset. False leaves the remote stance alone. |
 | `branchProtection.requiredChecks[]` | No | `array<object>` | `[{"name":"lint","cmd":["npm","run","lint"]},{"name":"test","cmd":["npm","test"]},{"name":"baselines","cmd":["node",".agents/scripts/check-baselines.js"]}]` | Checks that must pass before a Story PR merges. Each entry carries both the remote context name and the local argv. Each item has: name, cmd. |
@@ -119,31 +122,19 @@ GitHub provider identity plus the remote stance the bootstrap enforces. `owner`,
 
 ### `planning` (optional)
 
-Inputs to `/mandrel-plan`: risk escalation heuristics, ceremony-lite routing, the memory-hygiene advisory thresholds, and the cross-Story conflict-finding severity gates.
+Inputs to `/mandrel-plan`: the memory-hygiene advisory ceiling and the opt-in navigability reachability gate.
 
 | Key | Required | Type | Default | Description |
 | --- | --- | --- | --- | --- |
-| `riskHeuristics` | No | `string[]` or `{ append?, prepend? }` | `["Destructive or irreversible data mutations (dropping tables, deleting rows without soft-delete or backup, truncating production state).","Modifications to shared security or auth infrastructure (IAM policies, auth middleware, session or token handling, secret rotation).","Changes to CI/CD, deployment pipelines, or release gating that could disable safety checks or ship unverified code to production.","Monorepo-wide AST or text replacements touching overlapping files in parallel (catastrophic merge-conflict risk across concurrent agents).","Schema migrations that rewrite existing rows or drop columns without a backfill or rollback plan."]` | Prose heuristics the planner escalates a Story against. A plain array replaces the framework list; the `{ append, prepend }` extender form deep-merges with it. |
-| `complexityGate` | No | `object` | — | Shape-derived ceremony-lite complexity routing. A lite claim is validated against the authored Story shape at persist and re-derived from the Story body at dispatch; conservative (full on any doubt). Never relaxes the Story-ticket / PR-to-main / repo-gates / security-baseline non-negotiables. |
-| `complexityGate.enabled` | No | `boolean` | — | Master switch. When false, lite routing is disabled everywhere: persist refuses lite claims and dispatch always takes the sub-agent path. Default true. |
-| `complexityGate.maxArtifacts` | No | `integer` | — | Enumerated-artifact threshold reported by the plan-context complexity signals. An input signal for the planner verdict — carries no routing authority. Default 1. |
-| `memoryPool` | No | `object` | — | Thresholds for the memory-hygiene advisory `/mandrel-plan` surfaces at Gate #1. Advisory only: it recommends `/memory-consolidate` and never gates, reroutes, or mutates the memory pool. |
-| `memoryPool.staleAfterDays` | No | `integer` | `30` | Recommend a consolidation pass once the pool's stamp is older than this many days. Default 30. |
-| `memoryPool.growthDelta` | No | `integer` | `25` | Recommend a consolidation pass once this many entries have been written since the last one. Measured against the entry count the last pass stamped, so a stamp predating that field leaves growth unmeasured and only the age threshold applies. Default 25. |
-| `memoryPool.indexByteCeiling` | No | `integer` | `24576` | Recommend a consolidation pass once the pool's `MEMORY.md` index exceeds this many bytes. Independent of the age and growth thresholds: the harness truncates the index it loads into each session at its own byte cap, so an oversized index is a loss already happening — every entry listed after the cut is invisible — rather than a hygiene forecast. Default 24576, the harness cap itself. |
-| `failOnSharedEditors` | No | `boolean` | `false` | When true, upgrade shared-editor conflict findings to hard errors (default false — advisory soft findings only). |
-| `requireExplicitCrossStoryDeps` | No | `boolean` | `false` | When true, upgrade implicit cross-Story dependency findings to hard errors (default false — advisory soft findings only). |
-| `crossCuttingRegistries` | No | `string[]` or `{ append?, prepend? }` | `["lib/orchestration/lifecycle/listeners/index.js","**/listeners/index.js","**/handlers/index.js"]` | Registry path patterns whose concurrent edits across Stories are flagged as conflicts. Defaults to the framework listener/handler index patterns when omitted. |
-| `failOnRegistryConflicts` | No | `boolean` | `false` | When true, upgrade cross-cutting registry conflict findings to hard errors (default false). |
-| `failOnLargeFanOut` | No | `boolean` | `false` | When true, upgrade fan-out-warning findings (delete blast radius) to hard errors (default false — soft advisory). |
-| `largeFanOutThreshold` | No | `integer` | `10` | Call-site count above which a Story that deletes a module emits a fan-out-warning. Counts base-branch references to the deleted path basename. Soft by default; does not size or reject Stories. Default 10. |
+| `memoryPool` | No | `object` | — | Threshold for the memory-hygiene advisory `/mandrel-plan` surfaces at Gate #1. Advisory only: it recommends `/memory-consolidate` and never gates, reroutes, or mutates the memory pool. |
+| `memoryPool.indexByteCeiling` | No | `integer` | `24576` | Recommend a consolidation pass once the pool's `MEMORY.md` index exceeds this many bytes. The harness truncates the index it loads into each session at its own byte cap, so an oversized index is a loss already happening — every entry listed after the cut is invisible — rather than a hygiene forecast. Default 24576, the harness cap itself. |
 | `navigation` | No | `object` | — | Opt-in navigability reachability gate. Absent or empty routeGlobs is a silent no-op. |
 | `navigation.routeGlobs` | No | `array<string>` | `[]` | Glob patterns (e.g. pages/**, app/**/route.ts) marking paths that add a user-facing route. |
 | `navigation.navRegistry` | No | `array<string>` | `[]` | Tokens identifying the nav-registry SSOT a route-adding Story is expected to reference. |
 
 ### `delivery` (optional)
 
-Everything `/mandrel-deliver` and `single-story-close` consume: execution timeouts, worktree isolation, runner concurrency, docs freshness, signals, quality gates, merge/CI watch, review ceremony, and the feedback loop.
+Everything `/mandrel-deliver` and `single-story-close` consume: execution timeouts, worktree isolation, runner concurrency, docs freshness, quality gates, merge/CI watch, review ceremony, and the feedback loop.
 
 | Key | Required | Type | Default | Description |
 | --- | --- | --- | --- | --- |
@@ -172,11 +163,6 @@ Everything `/mandrel-deliver` and `single-story-close` consume: execution timeou
 | `worktreeIsolation.allowSymlinkOnWindows` | No | `boolean` | `false` | Permit the `symlink` strategy on win32, where it needs Developer Mode or elevation. Off by default so a Windows consumer fails over to a strategy that works. |
 | `worktreeIsolation.reapOnSuccess` | No | `boolean` | `true` | Remove the Story's worktree once its PR merges. False keeps it for post-mortem inspection. |
 | `worktreeIsolation.bootstrapFiles` | No | `array<string>` | `[".env",".mcp.json",".agentrc.local.json",".agents/instructions.local.md"]` | Gitignored files copied from the main checkout into every new worktree. A worktree checks out tracked files only, so local secrets and overrides would otherwise be missing. |
-| `signals` | No | `object` | — | Detector thresholds for the surviving performance-signal categories. Each block is shallow-merged by the resolver. |
-| `signals.rework` | No | `object` | — | Rework detector — repeated edits to one file in a run. |
-| `signals.rework.editsPerFile` | No | `integer` | `5` | Edits to a single file within one run that trip the rework signal. |
-| `signals.retry` | No | `object` | — | Retry detector — the same command failing repeatedly. |
-| `signals.retry.repeatCount` | No | `integer` | `3` | Repeats of an identical failing command that trip the retry signal. |
 | `quality` | No | `object` | — | Quality-gate configuration. Every gate lives under `gates.<tier>` and shares the same `{ enabled, baselinePath, tolerance, floors, components }` base; shared scoping lives at this block root. |
 | `quality.gateScoping` | No | `object` | — | Shared scope applied to every gate that supports one, unless the gate overrides it. |
 | `quality.gateScoping.scope` | No | `"diff"` \| `"full"` | `"diff"` | Score only the files changed against `diffRef` (`diff`) or every file in the gate target dirs (`full`). |
@@ -277,7 +263,6 @@ Everything `/mandrel-deliver` and `single-story-close` consume: execution timeou
 | `quality.formatAutofix.timeoutMs` | No | `integer` | `60000` | Timeout (ms) for the format-write spawn. |
 | `quality.codingGuardrails` | No | `object` | — | Authoring-time cyclomatic-complexity advisories surfaced by the quality-preview pre-commit gate. |
 | `quality.codingGuardrails.cyclomaticFlag` | No | `integer` | `8` | Cyclomatic complexity at which a new or changed method is flagged for a refactor look. |
-| `quality.codingGuardrails.cyclomaticMustFix` | No | `integer` | `12` | Cyclomatic complexity at which a new or changed method must be decomposed before the diff closes. |
 | `quality.codingGuardrails.requireSiblingTest` | No | `boolean` | `false` | When true, a new source file with no colocated sibling test is reported by the guardrails pass. |
 | `quality.autoRefresh` | No | `object` | — | Baseline-attribution auto-refresh: when a gate can prove a regression is a legitimate consequence of the diff, it rewrites the baseline instead of blocking. |
 | `quality.autoRefresh.enabled` | No | `boolean` | `true` | Master switch for the auto-refresh path. When false, every baseline refresh is a deliberate operator action. |
@@ -307,14 +292,13 @@ Everything `/mandrel-deliver` and `single-story-close` consume: execution timeou
 | `codeReview.providers[]` | No | `array<object>` | `[{"name":"native"},{"name":"security-review","scopes":["story"],"optional":true},{"name":"ultrareview","scopes":["story"],"manualPrompt":true,"when":{"label":"risk::high"}}]` | Review-provider chain (Story #2871). When unset or empty, defaults to [{ name: "native" }]. The orchestrator iterates inline entries in declaration order and merges their Finding[] before posting one structured comment; manual-prompt entries (e.g. ultrareview) contribute a trailing 'Manual review suggestions' section. Selecting an adapter whose probe fails hard-fails at factory construction unless declared `optional: true` in the chain. Each item has: name, scopes, optional, manualPrompt, when. |
 | `codeReview.providerConfig` | No | `object` | — | Optional escape hatch for adapter-specific configuration. No documented keys in Epic #2815; reserved so future adapters can be configured without another schema migration. |
 | `codeReview.maxFixAttempts` | No | `integer` | `3` | Maximum auto-fix retry attempts per finding in /mandrel-deliver Phase 5 (code-review). 0 disables auto-fix. Default 3. |
-| `codeReview.maxFixScopeFiles` | No | `integer` | `5` | Maximum file count a single auto-fix may modify before escalating to agent::blocked. Default 5. |
 | `codeReview.autoFixSeverity` | No | `"high"` \| `"medium"` | `"medium"` | Severity threshold for on-branch remediation in /mandrel-deliver Phase 5 (code-review). `medium` (default) routes 🔴/🟠/🟡 findings into the host-LLM focused-fix routing (Mediums batched per lens: one commit per lens, a single validation + rescan at the end) while 🟢 suggestions still graduate to follow-up issues; `high` reproduces the pre-4399 Critical/High-only routing. Hard cutover — no back-compat flag. |
 | `review` | No | `object` | — | Close-scope review tuning (Story #4699). Governs the Story-scope local-lens pass that runs inside the close subprocess; the maker-blind code-review pass and all hard gates are unaffected. |
 | `review.lensDiffFloor` | No | `integer` | — | Changed-line floor for the close-scope lens walk (Story #4699). A diff strictly below this many changed lines (additions + deletions) with zero sensitive-path hits skips lens materialization and records the skip in the findings-yield ledger. Default 40; 0 disables the skip. Hard gates and the maker-blind code-review pass are unaffected. |
 | `refactorStage` | No | `object` | — | Opt-in, config-gated post-green refactor checkpoint wired into story-deliver (Story #3430, Epic #3418). Strictly additive and default-OFF: when disabled, story-deliver behaves exactly as before. Advisory only — never changes existing close-validation gate semantics. |
 | `refactorStage.enabled` | No | `boolean` | `false` | When true, story-deliver runs an advisory post-green refactor stage (core/code-review-and-quality skill, Post-Green Refactor Pass) after the suite is green. Default false — when unset the stage is skipped and close-validation gate semantics are unchanged. |
-| `acceptanceEval` | No | `object` | — | Story #3819. Bounded per-Story acceptance self-eval loop. After the implementation commits land and before the Story-implementation phase flips to `closing`, an independent (fresh-context) critic pass scores the caller-injected change set against each inline `acceptance[]` item, redrafts the unmet items, and re-evaluates — capped at `maxRounds` redraft rounds, then escalates to `agent::blocked` when criteria remain unmet. There is no `enabled` flag: the loop is a hard cutover (always on). |
-| `acceptanceEval.maxRounds` | No | `integer` | `2` | Maximum number of redraft rounds before escalation. Default 2; clamped into [1, hard ceiling] by lib/config/acceptance-eval.js so the cap can never be disabled (maxRounds: 0 clamps up to 1). |
+| `acceptanceEval` | No | `object` | — | Story #3819. Bounded per-Story acceptance self-eval loop. After the implementation commits land and before the Story-implementation phase flips to `closing`, an independent (fresh-context) critic pass scores the caller-injected change set against each inline `acceptance[]` item, redrafts the unmet items, and re-evaluates — capped at `maxRounds` redraft rounds (0 = scored once, no redraft), then escalates to `agent::blocked` when criteria remain unmet. There is no `enabled` flag: the scoring pass is a hard cutover (always on). |
+| `acceptanceEval.maxRounds` | No | `integer` | `2` | Maximum number of redraft rounds before escalation. Default 2; 0 means the verdict is scored once with no redraft round (Story #5313 dropped the hard ceiling and the floor-of-one clamp). |
 | `feedbackLoop` | No | `object` | — | Opt-out toggles for the close-time auto-file graduators. All default to auto-filing on. |
 | `feedbackLoop.auditResultsAutoFile` | No | `boolean` | `true` | When true (default), the close-time audit-results graduator auto-files non-blocking audit-results findings as follow-up issues routed by source classification. Set to false to suppress auto-filing; findings remain accessible in the structured comments on the Story. |
 | `feedbackLoop.retroProposals` | No | `boolean` | `true` | When true (default), the retro auto-files its actionable routed proposals as meta::<framework-gap\|consumer-improvement> + friction::<category> issues via the graduator pre-parsed-findings seam, and the rendered retro sections list the filed issue numbers instead of paste-ready gh command stanzas. Set to false to fall back to the command stanzas. |
@@ -332,10 +316,9 @@ Everything `/mandrel-deliver` and `single-story-close` consume: execution timeou
 | `ci.blockOnAdvisoryFailure` | No | `boolean` | `true` | Story #5096. When true (default), delivery refuses to arm — and disarms — GitHub native auto-merge while a non-required (advisory) check is genuinely red on the PR head and GitHub reports the PR mergeable anyway (mergeStateStatus=UNSTABLE). `--auto` waits on REQUIRED contexts only, so without this a red advisory quality gate merges unattended. Set false to restore the pre-#5096 behaviour verbatim. |
 | `ci.advisoryAllowlist` | No | `array<string>` | `[]` | Story #5096. Check-run names exempt from blockOnAdvisoryFailure — a red run whose name matches exactly never blocks arming. Matching is exact; an unnamed run can never match and always blocks. |
 | `ci.rerunAdvisory` | No | `integer` | `0` | Story #5266. How many times close may re-run a failed advisory workflow run before blocking on it, per close invocation. Default 0: close spends no CI minutes and issues no GitHub mutation on an advisory red unless asked. At n > 0 the failed run(s) are re-run within that allowance and the merge wait re-polls inside its existing budget, landing or blocking on the re-run verdict. Overridden per invocation by --rerun-advisory <n>. |
-| `routing` | No | `object` | — | v2 delivery-spawn routing: role-scoped boot contexts and maker-checker sampling. The v1 singleDelivery epic-route kill-switch was removed in Stage 6. |
+| `routing` | No | `object` | — | v2 delivery-spawn routing: role-scoped boot contexts and the ceremony profile. The v1 singleDelivery epic-route kill-switch was removed in Stage 6; the freshCriticSampleRate sampling floor was retired in Story #5313. |
 | `routing.roleScopedAgents` | No | `boolean` | `true` | Epic #4478 (M7-B). Kill-switch for the role-scoped boot contexts. When true (default), a converted delivery spawn (`story-worker`, `acceptance-critic`) boots on its own `.claude/agents/<role>.md` system prompt instead of re-paying the full CLAUDE.md @-import closure. When false, every converted spawn falls back to `subagent_type: general-purpose` — the instant, code-rollback-free per-consumer revert, and the universal escape for hosts that ignore `.claude/agents/`. The fallback is the full-closure agent that ran before M7-B, so flipping it off never drops a gate. |
-| `routing.freshCriticSampleRate` | No | `number` | `0.2` | Epic #4478 (M7-B, Part 2). Maker-checker sampling floor. Under the standard profile, a change set touching no sensitive path routes its acceptance clusters down the contract-identical inline critic path, but this fraction of them is still forced through a fresh-context critic so a low derived level never means zero independent checking. Clamped to [0, 1]; 0 disables the floor, 1 forces every cluster fresh. Consumed by resolveCeremonyForRisk (lib/orchestration/ceremony-routing.js). |
-| `routing.ceremonyProfile` | No | `"minimal"` \| `"standard"` \| `"strict"` | `"standard"` | Acceptance-ceremony depth. minimal = always inline critic; strict = always fresh-context critic; standard (default) = routed off the change level derived from the Story diff, with the maker-checker sampling floor. |
+| `routing.ceremonyProfile` | No | `"minimal"` \| `"standard"` \| `"strict"` | `"standard"` | Acceptance-ceremony depth. minimal = always inline critic; strict = always fresh-context critic; standard (default) = routed off the change level derived from the Story diff: high or underivable → fresh, low → inline. |
 | `routing.closeAndLand` | No | `boolean` | `true` | When true (default), single-story-close lands through merge in one close. Opt out per-run with --no-wait-merge. |
 
 ### `qa` (optional)

package/.agents/docs/execution-reference.md

@@ -88,7 +88,8 @@ over-ceiling envelope or an over-budget Story count.
 > on planner-context size. Separately, the `ContextEnvelope` SDK this section
 > used to credit with limiting hydrated prompt size had no production caller
 > and was deleted in Story #5005; only its `estimateTokens` helper survived,
-> re-homed in `lib/orchestration/spec-spill.js`.
+> now private to `lib/audit-suite/checklist-threading.js` (Story #5312 deleted
+> `spec-spill.js` with the Spec token budget).
 
 ### Planner-context envelope (`/mandrel-plan`)
 
@@ -120,9 +121,8 @@ over-ceiling envelope or an over-budget Story count.
 
 ### Session-mass capacity (plan-time sizing)
 
-- **`DEFAULT_MODEL_CAPACITY`** (`lib/orchestration/ticket-validator-sizing.js`):
-  absolute authored-token ceilings for plan-time Story sizing (soft 30k /
-  hard 75k). Not operator-configurable via `.agentrc.json`; programmatic
-  override via `opts.modelCapacity` on validateTickets / runPlanPersist only.
+- **Retired (Story #5312).** `DEFAULT_MODEL_CAPACITY` and the plan-time
+  Story sizing ceilings are gone: a Story is as large as the work needs, and
+  nothing at plan time scores its authored mass.
 - **Host runtime**: session billing, quota exhaustion, and operator overrides
   are enforced by your provider (e.g. Claude Code), not by Mandrel scripts.

package/.agents/docs/quality-gates.md

@@ -302,8 +302,9 @@ default and the deep-merge extender form).
 
 ## Cyclomatic ceiling ratchet
 
-`delivery.quality.codingGuardrails.cyclomaticMustFix` (default `12`) is the
-per-function complexity ceiling, enforced by `check-cyclomatic.js`. It is a
+A fixed per-function complexity ceiling of `12` is enforced by
+`check-cyclomatic.js` (`lib/cyclomatic-ceiling.js#CYCLOMATIC_CEILING`; the
+`cyclomaticMustFix` config key was retired in Story #5313). It is a
 **standalone ratchet** — the same slot as `check-arch-cycles.js`,
 `check-dead-exports.js`, and `check-context-budget.js` — not a
 `delivery.quality.gates` kind, so it needs no gate block and no floor.
@@ -330,9 +331,10 @@ The scan reuses `delivery.quality.gates.maintainability.targetDirs` /
 `ignoreGlobs` — both instruments read the same coverage-free escomplex
 surface, so a separate scope declaration could only ever restate it.
 
-`cyclomaticFlag` (default `8`) is the softer half of the pair: it is not
-gated, and names the ceiling `quality:preview` counts new methods against in
-its `new-method count over c=<flag>` column.
+`cyclomaticFlag` (default `8`) is the one advisory knob: it is not gated, and
+names the ceiling `quality:preview` counts new methods against in its
+`new-method count over c=<flag>` column. The preview also lists every scanned
+method at cyclomatic 12 or above as an advisory and exits 0 on it.
 
 ---
 
@@ -825,8 +827,7 @@ correct shape for a gate with no rescoring path of its own.
 ## HITL blocker escalation
 
 `risk::high` is planning/audit metadata only — it never pauses runtime. The
-sole runtime HITL pause point is `agent::blocked`; `planning.riskHeuristics`
-is the rubric for what should escalate. The full model is owned by
+sole runtime HITL pause point is `agent::blocked`. The full model is owned by
 [`.agents/instructions.md`](../instructions.md) § 1.J and
 [`SDLC.md` § HITL model](SDLC.md#hitl-human-in-the-loop-model).
 

package/.agents/instructions.md

@@ -96,8 +96,7 @@ metadata only — no automatic runtime pause. The single runtime pause
 point is **`agent::blocked`**: on an unresolvable blocker or an unsafe
 destructive action without explicit authorization, transition to
 `agent::blocked`, summarize the blocker, and wait for operator resume
-(`agent::executing` or equivalent); escalate per
-`planning.riskHeuristics` in `.agentrc.json`.
+(`agent::executing` or equivalent).
 
 ### K. Precedence & Conflict Resolution
 
@@ -113,8 +112,8 @@ always wins regardless of tier.
 ## 2. FinOps & Token Budgeting (Economic Guardrails)
 
 Mandrel does not enforce live LLM spend; your host owns session quota.
-Fixed framework ceilings (the `/mandrel-plan` context envelope, plan-time Story
-sizing) **fail closed** naming what to trim:
+The one fixed framework ceiling (the `/mandrel-plan` context envelope)
+truncates with a note naming what was cut:
 [`docs/execution-reference.md`](docs/execution-reference.md#finops--token-budgeting-economic-guardrails).
 
 ---
@@ -169,8 +168,8 @@ Do NOT manually update issue descriptions or status fields unless prompted.
 ### B. Ticket hierarchy
 
 The Story is the only executable ticket: `acceptance[]` / `verify[]`
-inline plus the folded Tech Spec in `## Spec` (over-budget Specs fail
-closed — split or tighten; never under `docs/`). Optional `depends_on`
+inline plus the folded Tech Spec in `## Spec` (as long as the work
+needs; never under `docs/`). Optional `depends_on`
 edges order rare multi-Story runs, resolved by `/mandrel-deliver` from
 live state; `plan-run::<id>` is filter metadata. Commit subjects
 reference the Story via `(refs #<storyId>)`. There is no `type::task`.
@@ -194,9 +193,9 @@ anything under it.
 
 `/mandrel-plan` sizes each Story as a **capability slice a frontier model
 delivers and self-verifies in one pass** — a broad footprint is normal
-when the change is cohesive (backstop: `DEFAULT_MODEL_CAPACITY` in
-`ticket-validator-sizing.js`); do not re-slice it into per-module
-fragments. On a `⚠️ COMPLEXITY WARNING` or out-of-scope task: **plan
-first** (numbered cohesive sub-steps in a `<!-- DECOMPOSITION -->`
+when the change is cohesive, and no plan-time ceiling scores it; do not
+re-slice it into per-module fragments. On a `⚠️ COMPLEXITY WARNING` or
+out-of-scope task: **plan first** (numbered cohesive sub-steps in a
+`<!-- DECOMPOSITION -->`
 block), **commit incrementally** per sub-step, and **fail fast** — STOP
 and report if any sub-step fails validation.

package/.agents/rules/ci-remediation.md

@@ -27,13 +27,29 @@ exactly one of two ways, and no others:
    through the fix table in
    [`deliver-story-reference.md` § Step 4](../workflows/helpers/deliver-story-reference.md#step-4--ci-watch--fix-recovery);
    refresh a baseline only when the diff demonstrably can't be covered.
-2. **File a `meta::framework-gap` issue** when the root cause is outside this
+2. **File the CI-gap intake issue** when the root cause is outside this
    delivery's scope — a pre-existing flaky test, a runner/infra weakness, a
-   framework-level environment gap. Open the issue with the `meta::framework-gap`
-   label (see [`git-conventions.md`](git-conventions.md)) carrying **the run
-   link and the failure signature** so a later `/mandrel-plan` Phase 0 sweep can act on
-   it. Remediate this delivery only if the pre-existing defect is genuinely
-   blocking it.
+   framework-level environment gap. One command does it, and it is the only
+   sanctioned filing surface:
+
+   ```bash
+   node .agents/scripts/file-ci-gap.js --story <id> --verdict <verdict> \
+     --owner <consumer|framework|platform> --evidence "<proof reading>" [--block]
+   ```
+
+   It reads the digest for the run link and failure signature, routes the
+   filing to the repository that **owns** the fault, dedups by signature so
+   the Nth occurrence updates the existing ticket, posts the `friction`
+   comment, and (with `--block`) flips the Story. Hand-running `gh issue
+   create` is not the fallback: it files an issue no `/mandrel-plan` pass can
+   graduate, in whichever repo you happen to be standing in. Remediate this
+   delivery only if the pre-existing defect is genuinely blocking it.
+
+   **`--owner` is the judgement call**, and it is yours to make from the
+   evidence: `consumer` for this repository's own code, `framework` for a
+   Mandrel defect, `platform` for a shared base config, runner fleet, or
+   cross-repo toolchain that neither owns. An unconfigured bucket files
+   locally and says so in the issue body — it never pretends to be routed.
 
 Infra, transient, and flaky failures are root-cause defects too — a flaky test
 that passes on a rerun is still a bug that will fail a future run. They route
@@ -49,9 +65,9 @@ the two options above. Name the verdict you reached in the `friction` comment.
 | Verdict | Evidence | Routes to |
 | --- | --- | --- |
 | **defect-in-diff** | The failure reproduces on the branch and not on an unmodified `main` | Option 1 — fix at source |
-| **pre-existing** | The same check fails on an unmodified `main` too | Option 2 — file `meta::framework-gap`; remediate here only if it blocks this delivery |
-| **capacity** | Proven exhaustion of a runner resource, not a property of the diff (see below) | Option 2 — file `meta::framework-gap` **and** escalate to the operator |
-| **unreproducible-tier** | The tier cannot be exercised in this sandbox at all, proven by an attempted attach (see below) | Option 2 — file `meta::framework-gap` **and** escalate on first encounter |
+| **pre-existing** | The same check fails on an unmodified `main` too | Option 2 — `file-ci-gap.js --verdict pre-existing`; remediate here only if it blocks this delivery |
+| **capacity** | Proven exhaustion of a runner resource, not a property of the diff (see below) | Option 2 — `file-ci-gap.js --verdict capacity` (`meta::framework-gap` unless `--owner` routes it elsewhere) **and** escalate to the operator |
+| **unreproducible-tier** | The tier cannot be exercised in this sandbox at all, proven by an attempted attach (see below) | Option 2 — `file-ci-gap.js --verdict unreproducible-tier` (`meta::framework-gap` unless `--owner` routes it elsewhere) **and** escalate on first encounter |
 
 Why the verdict set carries these last two is recorded in
 [`docs/decisions.md` ADR 20260906-5160a](../../docs/decisions.md).
@@ -72,10 +88,12 @@ line naming the exhausted limit (an OOM kill, `ENOSPC`, `EMFILE`,
 timeout), plus the fact that the failure is not specific to this diff. Absent
 that reading the verdict is **flaky, not capacity**, and it routes to Option 1.
 
-On a `capacity` verdict: file the `meta::framework-gap` issue with the run link,
-the failure signature, and the resource reading; flip the Story to
-`agent::blocked` with a `friction` comment naming the verdict; and hand back to
-the operator, who owns the runner pool. Do not sit in a retry loop waiting for
+On a `capacity` verdict: run `file-ci-gap.js --verdict capacity --block`, passing
+the resource reading as `--evidence` (the run link and failure signature come
+from the digest). That files the intake issue — `meta::framework-gap`, or
+`meta::platform-gap` when `--owner platform` names a shared runner fleet — posts
+the `friction` comment and flips the Story in one call; then hand back to the
+operator, who owns the runner pool. Do not sit in a retry loop waiting for
 capacity to return.
 
 **Rerunning a failed job to reach green stays forbidden under every verdict,
@@ -106,10 +124,9 @@ both:
   failure in the app under test.
 
 Absent both readings the verdict is unavailable and the failure routes as it did
-before. On the verdict: file the `meta::framework-gap` issue with the run link,
-the failure signature, and the attach attempt; flip the Story to
-`agent::blocked` with a `friction` comment naming the verdict; and hand back to
-the operator, who owns the sandbox. Do not author a fix for a tier you could not
+before. On the verdict: run
+`file-ci-gap.js --verdict unreproducible-tier --block`, passing the failed attach
+as `--evidence`; then hand back to the operator, who owns the sandbox. Do not author a fix for a tier you could not
 run — a blind fix to a suite nobody exercised is how the gap compounds.
 
 ## Verifier
@@ -131,8 +148,9 @@ alongside the failing check-run identity. On green it adjudicates:
 
 - **Same head SHA** → the green came from re-running the failed job. The
   watcher exits non-zero, flips the Story to `agent::blocked` with a
-  `friction` comment, and requires the `meta::framework-gap` issue (run link +
-  failure signature, both already in the digest) before the delivery proceeds.
+  `friction` comment, and requires the CI-gap intake issue
+  (`file-ci-gap.js` — run link and failure signature are already in the
+  digest) before the delivery proceeds.
 - **New head SHA** → fix at source. The digest is retired, auto-merge is
   re-armed, and the delivery continues unobstructed.
 
@@ -153,8 +171,8 @@ operator under **any** of:
 - **Clearly-environmental → escalate immediately.** An unambiguously
   environmental failure outside your control (runner provisioning, a persistent
   registry/network outage, a branch-protection or CI misconfiguration, an
-  expired credential) — file the `meta::framework-gap` issue (with run link +
-  signature) and escalate on the first encounter rather than burning iterations
+  expired credential) — run `file-ci-gap.js --block` and escalate on the
+  first encounter rather than burning iterations
   trying to code around it. A proven-capacity failure is this case: reach the
   `capacity` verdict above and escalate on the first encounter.
 - **Unrunnable tier → escalate immediately.** A tier the sandbox cannot host at