mandrel 2.56.0 → 2.57.0

package/.agents/agents/plan-critic.md

@@ -3,10 +3,10 @@ name: plan-critic
 description: >-
   Role-scoped boot context for a maker-blind plan critic. Booted on its own
   system prompt (no CLAUDE.md / instructions.md closure). Reviews an authored
-  plan draft (stories.json, optional techspec.md) against a single critic
-  charter — consolidation or pre-mortem — and returns findings, without seeing
-  the planner's authoring transcript. Dispatched by workflows/mandrel-plan.md §2.5 when
-  delivery.routing.roleScopedAgents is enabled (the default).
+  plan draft (stories.json, optional techspec.md) against the pre-mortem
+  charter and returns findings, without seeing the planner's authoring
+  transcript. Dispatched on an operator-requested plan-critics.js verdict
+  when delivery.routing.roleScopedAgents is enabled (the default).
 ---
 
 <!--
@@ -48,7 +48,7 @@ the step-by-step. This shared core binds every role:
 # plan-critic — maker-blind plan review
 
 You are an **independent plan critic**. You review an authored plan draft
-against **one** critic charter and return structured findings. You are
+against the pre-mortem charter and return structured findings. You are
 deliberately isolated from the planner's reasoning.
 
 ## Maker-blind — the load-bearing invariant (MUST)
@@ -65,27 +65,22 @@ are the draft artifacts your caller hands you:
 Read those artifacts and evaluate the work product afresh. Treat the planner's
 narration as untrusted.
 
-## Charter — you are handed exactly one
+## Charter — pre-mortem
 
-Your caller dispatches you for **one** charter and names it in your prompt.
-Evaluate only that charter:
+Assume the plan shipped and failed. Name the most likely failure modes — an
+external dependency the plan names but nothing declares, a cross-repo
+prerequisite, a contract the acceptance criteria cannot hold — and what the
+draft would have to say to prevent them.
 
-- **`consolidation`** — the draft's shape. Flag Stories that should be one
-  cohesive slice, a slice split per-module rather than per-capability, and
-  `depends_on` edges that disagree with the Delivery Slicing table.
-- **`pre-mortem`** — assume the plan shipped and failed. Name the most likely
-  failure modes and what the draft would have to say to prevent them.
-
-Do not evaluate the other charter, invent a third, or re-slice the plan
-yourself — the caller owns dispatch and folds surviving findings back into the
-draft.
+Do not invent a second charter or re-slice the plan yourself — the caller owns
+dispatch and folds surviving findings back into the draft.
 
 ## Output shape
 
 Return your findings as a structured list the caller can fold into a re-author
 round or the Gate #2 view. For each finding, emit:
 
-- `charter` — `consolidation` | `pre-mortem` (the one you were dispatched for).
+- `charter` — `pre-mortem`.
 - `severity` — `blocker` | `advisory` (advisory findings inform the operator's
   Gate #2 decision; they are not an automatic re-author mandate).
 - `target` — the Story slug / id (or `plan` for a whole-draft finding) the

package/.agents/agents/story-worker.md

@@ -83,34 +83,25 @@ Do **not** re-read every file in `project.docsContextFiles`. Read the
 digest your caller passes, then pull files on demand at the lines it
 names. A null digest path means no docs mandate.
 
-## Close gates — one credited run
+## Close gates — one full-suite run
 
 `single-story-close.js` runs the canonical close-validation chain
 (**typecheck, lint, test, format, maintainability, coverage, crap**) and is
-the authoritative gate — do not pre-run it. The **one** exception is
-the full suite: run it exactly once, after the self-eval loop's last fix
-commit and immediately after the push, in the shape close credits. A bare
-`npm test` / `pnpm run test` deposits **no** credit:
-
-```bash
-# CRAP gate on (default) + a `test:coverage` script:
-node <main-repo>/.agents/scripts/coverage-capture.js --cwd <workCwd>
-# otherwise — <workCwd> ABSOLUTE, runner exactly `npm test`:
-node <main-repo>/.agents/scripts/evidence-gate.js --standalone \
-  --scope-id <storyId> --gate test --worktree <workCwd> -- npm test
-```
-
-Dispatch it in the **background**: it routinely outruns the host's sync
-Bash ceiling, and its completion re-invokes you — which is why the push
-comes first. Never spawn a task to poll or `sleep`-loop
-against it; a waiter with a wrong condition outlives the agent. Share
-`lint` / `typecheck` evidence with close via `evidence-gate.js`; never
-stamp coverage / CRAP fresh any other way.
-
-**It can legitimately run nothing.** With nothing changed under the CRAP
-`targetDirs` it skips capture and exits 0. An exit code is never evidence a
-gate did work — its **output** is: no credit was deposited. Run the scoped
-projects for the roots you changed plus `verify[]`, not the whole suite.
+the authoritative gate — do not pre-run it. The **one** exception is the
+full suite: after the self-eval loop's last fix commit, run `npm test`
+exactly once in `<workCwd>`. A green full run on `story-<storyId>`
+deposits the `test` credit close reads, keyed on the tree; a later commit
+voids it, and close captures coverage itself when the CRAP gate needs an
+artifact. If the suite outruns the host's sync Bash ceiling, dispatch it in
+the **background** — its completion notification re-invokes you. Never
+spawn a task to poll or `sleep`-loop against it; a waiter with a wrong
+condition outlives the agent. An exit code is never evidence a gate did
+work — the runner's **output** is: it prints whether it deposited credit,
+and a run off the Story branch or of a partial tier deposits nothing and
+says so. Redraft rounds run the scoped projects for the roots you changed
+plus `verify[]`, not the whole suite. Share `lint` / `typecheck` evidence
+with close via `evidence-gate.js`; never stamp coverage / CRAP fresh any
+other way.
 
 Gate output that lies: [`known-tooling-behavior.md`](../rules/known-tooling-behavior.md).
 Waiter traps: [`parallel-tooling.md`](../workflows/helpers/parallel-tooling.md) Rule 2.
@@ -119,12 +110,13 @@ Waiter traps: [`parallel-tooling.md`](../workflows/helpers/parallel-tooling.md)
 
 **Before** flipping to `closing`, run the bounded self-eval loop
 ([`acceptance-self-eval.md`](../workflows/helpers/acceptance-self-eval.md)).
-It scores the change set you computed **once** and injected into the critic
-— never one it re-derives — against each `acceptance[]` item,
-consuming `verify[]` output as evidence. **proceed** → flip to `closing`,
-push, capture, hand off; **redraft** → fix the criteria, commit, re-eval;
-**block** → take the blocked path below. Never hand off an unscored
-branch.
+Derive the change set, level and ceremony with
+`node <main-repo>/.agents/scripts/ceremony-derive.js --story <storyId> --cwd <workCwd>`
+and hand its `files` to the critic — never one it re-derives. It scores
+each `acceptance[]` item, consuming `verify[]` output as evidence.
+**proceed** → flip to `closing`, run the suite, push, hand off;
+**redraft** → fix the criteria, commit, re-eval; **block** → take the
+blocked path below. Never hand off an unscored branch.
 
 ## Lifecycle: progress & blocked (MUST)
 
@@ -146,9 +138,8 @@ the only sanctioned landing.
 ## Your turn ends at a pushed branch (MUST)
 
 You do **not** run close. Push `story-<storyId>` to `origin` — confirming
-the remote ref moved — **before** the credited capture, then return: the
-capture is backgrounded, so its completion ends your turn, and a turn that
-ends unpushed reads as unfinished work. The orchestrator runs
+the remote ref moved — then return: a turn that ends unpushed reads as
+unfinished work. The orchestrator runs
 `single-story-close.js` in its own session, serialized against your
 siblings. Do not open the PR, flip `agent::done`, or spawn a child to
 close for you. If the push fails, take the blocked path above.

package/.agents/docs/agentrc-reference.json

@@ -70,28 +70,9 @@
     }
   },
   "planning": {
-    "riskHeuristics": [
-      "Destructive or irreversible data mutations (dropping tables, deleting rows without soft-delete or backup, truncating production state).",
-      "Modifications to shared security or auth infrastructure (IAM policies, auth middleware, session or token handling, secret rotation).",
-      "Changes to CI/CD, deployment pipelines, or release gating that could disable safety checks or ship unverified code to production.",
-      "Monorepo-wide AST or text replacements touching overlapping files in parallel (catastrophic merge-conflict risk across concurrent agents).",
-      "Schema migrations that rewrite existing rows or drop columns without a backfill or rollback plan."
-    ],
     "memoryPool": {
-      "staleAfterDays": 30,
-      "growthDelta": 25,
       "indexByteCeiling": 24576
     },
-    "failOnSharedEditors": false,
-    "requireExplicitCrossStoryDeps": false,
-    "crossCuttingRegistries": [
-      "lib/orchestration/lifecycle/listeners/index.js",
-      "**/listeners/index.js",
-      "**/handlers/index.js"
-    ],
-    "failOnRegistryConflicts": false,
-    "failOnLargeFanOut": false,
-    "largeFanOutThreshold": 10,
     "navigation": {
       "routeGlobs": [],
       "navRegistry": []
@@ -134,14 +115,6 @@
         ".agents/instructions.local.md"
       ]
     },
-    "signals": {
-      "rework": {
-        "editsPerFile": 5
-      },
-      "retry": {
-        "repeatCount": 3
-      }
-    },
     "quality": {
       "gateScoping": {
         "scope": "diff",
@@ -288,7 +261,6 @@
       },
       "codingGuardrails": {
         "cyclomaticFlag": 8,
-        "cyclomaticMustFix": 12,
         "requireSiblingTest": false
       },
       "autoRefresh": {
@@ -336,7 +308,6 @@
         }
       ],
       "maxFixAttempts": 3,
-      "maxFixScopeFiles": 5,
       "autoFixSeverity": "medium"
     },
     "refactorStage": {
@@ -363,7 +334,6 @@
     },
     "routing": {
       "roleScopedAgents": true,
-      "freshCriticSampleRate": 0.2,
       "ceremonyProfile": "standard",
       "closeAndLand": true
     }

package/.agents/docs/configuration.md

@@ -122,31 +122,19 @@ GitHub provider identity plus the remote stance the bootstrap enforces. `owner`,
 
 ### `planning` (optional)
 
-Inputs to `/mandrel-plan`: risk escalation heuristics, ceremony-lite routing, the memory-hygiene advisory thresholds, and the cross-Story conflict-finding severity gates.
+Inputs to `/mandrel-plan`: the memory-hygiene advisory ceiling and the opt-in navigability reachability gate.
 
 | Key | Required | Type | Default | Description |
 | --- | --- | --- | --- | --- |
-| `riskHeuristics` | No | `string[]` or `{ append?, prepend? }` | `["Destructive or irreversible data mutations (dropping tables, deleting rows without soft-delete or backup, truncating production state).","Modifications to shared security or auth infrastructure (IAM policies, auth middleware, session or token handling, secret rotation).","Changes to CI/CD, deployment pipelines, or release gating that could disable safety checks or ship unverified code to production.","Monorepo-wide AST or text replacements touching overlapping files in parallel (catastrophic merge-conflict risk across concurrent agents).","Schema migrations that rewrite existing rows or drop columns without a backfill or rollback plan."]` | Prose heuristics the planner escalates a Story against. A plain array replaces the framework list; the `{ append, prepend }` extender form deep-merges with it. |
-| `complexityGate` | No | `object` | — | Shape-derived ceremony-lite complexity routing. A lite claim is validated against the authored Story shape at persist and re-derived from the Story body at dispatch; conservative (full on any doubt). Never relaxes the Story-ticket / PR-to-main / repo-gates / security-baseline non-negotiables. |
-| `complexityGate.enabled` | No | `boolean` | — | Master switch. When false, lite routing is disabled everywhere: persist refuses lite claims and dispatch always takes the sub-agent path. Default true. |
-| `complexityGate.maxArtifacts` | No | `integer` | — | Enumerated-artifact threshold reported by the plan-context complexity signals. An input signal for the planner verdict — carries no routing authority. Default 1. |
-| `memoryPool` | No | `object` | — | Thresholds for the memory-hygiene advisory `/mandrel-plan` surfaces at Gate #1. Advisory only: it recommends `/memory-consolidate` and never gates, reroutes, or mutates the memory pool. |
-| `memoryPool.staleAfterDays` | No | `integer` | `30` | Recommend a consolidation pass once the pool's stamp is older than this many days. Default 30. |
-| `memoryPool.growthDelta` | No | `integer` | `25` | Recommend a consolidation pass once this many entries have been written since the last one. Measured against the entry count the last pass stamped, so a stamp predating that field leaves growth unmeasured and only the age threshold applies. Default 25. |
-| `memoryPool.indexByteCeiling` | No | `integer` | `24576` | Recommend a consolidation pass once the pool's `MEMORY.md` index exceeds this many bytes. Independent of the age and growth thresholds: the harness truncates the index it loads into each session at its own byte cap, so an oversized index is a loss already happening — every entry listed after the cut is invisible — rather than a hygiene forecast. Default 24576, the harness cap itself. |
-| `failOnSharedEditors` | No | `boolean` | `false` | When true, upgrade shared-editor conflict findings to hard errors (default false — advisory soft findings only). |
-| `requireExplicitCrossStoryDeps` | No | `boolean` | `false` | When true, upgrade implicit cross-Story dependency findings to hard errors (default false — advisory soft findings only). |
-| `crossCuttingRegistries` | No | `string[]` or `{ append?, prepend? }` | `["lib/orchestration/lifecycle/listeners/index.js","**/listeners/index.js","**/handlers/index.js"]` | Registry path patterns whose concurrent edits across Stories are flagged as conflicts. Defaults to the framework listener/handler index patterns when omitted. |
-| `failOnRegistryConflicts` | No | `boolean` | `false` | When true, upgrade cross-cutting registry conflict findings to hard errors (default false). |
-| `failOnLargeFanOut` | No | `boolean` | `false` | When true, upgrade fan-out-warning findings (delete blast radius) to hard errors (default false — soft advisory). |
-| `largeFanOutThreshold` | No | `integer` | `10` | Call-site count above which a Story that deletes a module emits a fan-out-warning. Counts base-branch references to the deleted path basename. Soft by default; does not size or reject Stories. Default 10. |
+| `memoryPool` | No | `object` | — | Threshold for the memory-hygiene advisory `/mandrel-plan` surfaces at Gate #1. Advisory only: it recommends `/memory-consolidate` and never gates, reroutes, or mutates the memory pool. |
+| `memoryPool.indexByteCeiling` | No | `integer` | `24576` | Recommend a consolidation pass once the pool's `MEMORY.md` index exceeds this many bytes. The harness truncates the index it loads into each session at its own byte cap, so an oversized index is a loss already happening — every entry listed after the cut is invisible — rather than a hygiene forecast. Default 24576, the harness cap itself. |
 | `navigation` | No | `object` | — | Opt-in navigability reachability gate. Absent or empty routeGlobs is a silent no-op. |
 | `navigation.routeGlobs` | No | `array<string>` | `[]` | Glob patterns (e.g. pages/**, app/**/route.ts) marking paths that add a user-facing route. |
 | `navigation.navRegistry` | No | `array<string>` | `[]` | Tokens identifying the nav-registry SSOT a route-adding Story is expected to reference. |
 
 ### `delivery` (optional)
 
-Everything `/mandrel-deliver` and `single-story-close` consume: execution timeouts, worktree isolation, runner concurrency, docs freshness, signals, quality gates, merge/CI watch, review ceremony, and the feedback loop.
+Everything `/mandrel-deliver` and `single-story-close` consume: execution timeouts, worktree isolation, runner concurrency, docs freshness, quality gates, merge/CI watch, review ceremony, and the feedback loop.
 
 | Key | Required | Type | Default | Description |
 | --- | --- | --- | --- | --- |
@@ -175,11 +163,6 @@ Everything `/mandrel-deliver` and `single-story-close` consume: execution timeou
 | `worktreeIsolation.allowSymlinkOnWindows` | No | `boolean` | `false` | Permit the `symlink` strategy on win32, where it needs Developer Mode or elevation. Off by default so a Windows consumer fails over to a strategy that works. |
 | `worktreeIsolation.reapOnSuccess` | No | `boolean` | `true` | Remove the Story's worktree once its PR merges. False keeps it for post-mortem inspection. |
 | `worktreeIsolation.bootstrapFiles` | No | `array<string>` | `[".env",".mcp.json",".agentrc.local.json",".agents/instructions.local.md"]` | Gitignored files copied from the main checkout into every new worktree. A worktree checks out tracked files only, so local secrets and overrides would otherwise be missing. |
-| `signals` | No | `object` | — | Detector thresholds for the surviving performance-signal categories. Each block is shallow-merged by the resolver. |
-| `signals.rework` | No | `object` | — | Rework detector — repeated edits to one file in a run. |
-| `signals.rework.editsPerFile` | No | `integer` | `5` | Edits to a single file within one run that trip the rework signal. |
-| `signals.retry` | No | `object` | — | Retry detector — the same command failing repeatedly. |
-| `signals.retry.repeatCount` | No | `integer` | `3` | Repeats of an identical failing command that trip the retry signal. |
 | `quality` | No | `object` | — | Quality-gate configuration. Every gate lives under `gates.<tier>` and shares the same `{ enabled, baselinePath, tolerance, floors, components }` base; shared scoping lives at this block root. |
 | `quality.gateScoping` | No | `object` | — | Shared scope applied to every gate that supports one, unless the gate overrides it. |
 | `quality.gateScoping.scope` | No | `"diff"` \| `"full"` | `"diff"` | Score only the files changed against `diffRef` (`diff`) or every file in the gate target dirs (`full`). |
@@ -280,7 +263,6 @@ Everything `/mandrel-deliver` and `single-story-close` consume: execution timeou
 | `quality.formatAutofix.timeoutMs` | No | `integer` | `60000` | Timeout (ms) for the format-write spawn. |
 | `quality.codingGuardrails` | No | `object` | — | Authoring-time cyclomatic-complexity advisories surfaced by the quality-preview pre-commit gate. |
 | `quality.codingGuardrails.cyclomaticFlag` | No | `integer` | `8` | Cyclomatic complexity at which a new or changed method is flagged for a refactor look. |
-| `quality.codingGuardrails.cyclomaticMustFix` | No | `integer` | `12` | Cyclomatic complexity at which a new or changed method must be decomposed before the diff closes. |
 | `quality.codingGuardrails.requireSiblingTest` | No | `boolean` | `false` | When true, a new source file with no colocated sibling test is reported by the guardrails pass. |
 | `quality.autoRefresh` | No | `object` | — | Baseline-attribution auto-refresh: when a gate can prove a regression is a legitimate consequence of the diff, it rewrites the baseline instead of blocking. |
 | `quality.autoRefresh.enabled` | No | `boolean` | `true` | Master switch for the auto-refresh path. When false, every baseline refresh is a deliberate operator action. |
@@ -310,14 +292,13 @@ Everything `/mandrel-deliver` and `single-story-close` consume: execution timeou
 | `codeReview.providers[]` | No | `array<object>` | `[{"name":"native"},{"name":"security-review","scopes":["story"],"optional":true},{"name":"ultrareview","scopes":["story"],"manualPrompt":true,"when":{"label":"risk::high"}}]` | Review-provider chain (Story #2871). When unset or empty, defaults to [{ name: "native" }]. The orchestrator iterates inline entries in declaration order and merges their Finding[] before posting one structured comment; manual-prompt entries (e.g. ultrareview) contribute a trailing 'Manual review suggestions' section. Selecting an adapter whose probe fails hard-fails at factory construction unless declared `optional: true` in the chain. Each item has: name, scopes, optional, manualPrompt, when. |
 | `codeReview.providerConfig` | No | `object` | — | Optional escape hatch for adapter-specific configuration. No documented keys in Epic #2815; reserved so future adapters can be configured without another schema migration. |
 | `codeReview.maxFixAttempts` | No | `integer` | `3` | Maximum auto-fix retry attempts per finding in /mandrel-deliver Phase 5 (code-review). 0 disables auto-fix. Default 3. |
-| `codeReview.maxFixScopeFiles` | No | `integer` | `5` | Maximum file count a single auto-fix may modify before escalating to agent::blocked. Default 5. |
 | `codeReview.autoFixSeverity` | No | `"high"` \| `"medium"` | `"medium"` | Severity threshold for on-branch remediation in /mandrel-deliver Phase 5 (code-review). `medium` (default) routes 🔴/🟠/🟡 findings into the host-LLM focused-fix routing (Mediums batched per lens: one commit per lens, a single validation + rescan at the end) while 🟢 suggestions still graduate to follow-up issues; `high` reproduces the pre-4399 Critical/High-only routing. Hard cutover — no back-compat flag. |
 | `review` | No | `object` | — | Close-scope review tuning (Story #4699). Governs the Story-scope local-lens pass that runs inside the close subprocess; the maker-blind code-review pass and all hard gates are unaffected. |
 | `review.lensDiffFloor` | No | `integer` | — | Changed-line floor for the close-scope lens walk (Story #4699). A diff strictly below this many changed lines (additions + deletions) with zero sensitive-path hits skips lens materialization and records the skip in the findings-yield ledger. Default 40; 0 disables the skip. Hard gates and the maker-blind code-review pass are unaffected. |
 | `refactorStage` | No | `object` | — | Opt-in, config-gated post-green refactor checkpoint wired into story-deliver (Story #3430, Epic #3418). Strictly additive and default-OFF: when disabled, story-deliver behaves exactly as before. Advisory only — never changes existing close-validation gate semantics. |
 | `refactorStage.enabled` | No | `boolean` | `false` | When true, story-deliver runs an advisory post-green refactor stage (core/code-review-and-quality skill, Post-Green Refactor Pass) after the suite is green. Default false — when unset the stage is skipped and close-validation gate semantics are unchanged. |
-| `acceptanceEval` | No | `object` | — | Story #3819. Bounded per-Story acceptance self-eval loop. After the implementation commits land and before the Story-implementation phase flips to `closing`, an independent (fresh-context) critic pass scores the caller-injected change set against each inline `acceptance[]` item, redrafts the unmet items, and re-evaluates — capped at `maxRounds` redraft rounds, then escalates to `agent::blocked` when criteria remain unmet. There is no `enabled` flag: the loop is a hard cutover (always on). |
-| `acceptanceEval.maxRounds` | No | `integer` | `2` | Maximum number of redraft rounds before escalation. Default 2; clamped into [1, hard ceiling] by lib/config/acceptance-eval.js so the cap can never be disabled (maxRounds: 0 clamps up to 1). |
+| `acceptanceEval` | No | `object` | — | Story #3819. Bounded per-Story acceptance self-eval loop. After the implementation commits land and before the Story-implementation phase flips to `closing`, an independent (fresh-context) critic pass scores the caller-injected change set against each inline `acceptance[]` item, redrafts the unmet items, and re-evaluates — capped at `maxRounds` redraft rounds (0 = scored once, no redraft), then escalates to `agent::blocked` when criteria remain unmet. There is no `enabled` flag: the scoring pass is a hard cutover (always on). |
+| `acceptanceEval.maxRounds` | No | `integer` | `2` | Maximum number of redraft rounds before escalation. Default 2; 0 means the verdict is scored once with no redraft round (Story #5313 dropped the hard ceiling and the floor-of-one clamp). |
 | `feedbackLoop` | No | `object` | — | Opt-out toggles for the close-time auto-file graduators. All default to auto-filing on. |
 | `feedbackLoop.auditResultsAutoFile` | No | `boolean` | `true` | When true (default), the close-time audit-results graduator auto-files non-blocking audit-results findings as follow-up issues routed by source classification. Set to false to suppress auto-filing; findings remain accessible in the structured comments on the Story. |
 | `feedbackLoop.retroProposals` | No | `boolean` | `true` | When true (default), the retro auto-files its actionable routed proposals as meta::<framework-gap\|consumer-improvement> + friction::<category> issues via the graduator pre-parsed-findings seam, and the rendered retro sections list the filed issue numbers instead of paste-ready gh command stanzas. Set to false to fall back to the command stanzas. |
@@ -335,10 +316,9 @@ Everything `/mandrel-deliver` and `single-story-close` consume: execution timeou
 | `ci.blockOnAdvisoryFailure` | No | `boolean` | `true` | Story #5096. When true (default), delivery refuses to arm — and disarms — GitHub native auto-merge while a non-required (advisory) check is genuinely red on the PR head and GitHub reports the PR mergeable anyway (mergeStateStatus=UNSTABLE). `--auto` waits on REQUIRED contexts only, so without this a red advisory quality gate merges unattended. Set false to restore the pre-#5096 behaviour verbatim. |
 | `ci.advisoryAllowlist` | No | `array<string>` | `[]` | Story #5096. Check-run names exempt from blockOnAdvisoryFailure — a red run whose name matches exactly never blocks arming. Matching is exact; an unnamed run can never match and always blocks. |
 | `ci.rerunAdvisory` | No | `integer` | `0` | Story #5266. How many times close may re-run a failed advisory workflow run before blocking on it, per close invocation. Default 0: close spends no CI minutes and issues no GitHub mutation on an advisory red unless asked. At n > 0 the failed run(s) are re-run within that allowance and the merge wait re-polls inside its existing budget, landing or blocking on the re-run verdict. Overridden per invocation by --rerun-advisory <n>. |
-| `routing` | No | `object` | — | v2 delivery-spawn routing: role-scoped boot contexts and maker-checker sampling. The v1 singleDelivery epic-route kill-switch was removed in Stage 6. |
+| `routing` | No | `object` | — | v2 delivery-spawn routing: role-scoped boot contexts and the ceremony profile. The v1 singleDelivery epic-route kill-switch was removed in Stage 6; the freshCriticSampleRate sampling floor was retired in Story #5313. |
 | `routing.roleScopedAgents` | No | `boolean` | `true` | Epic #4478 (M7-B). Kill-switch for the role-scoped boot contexts. When true (default), a converted delivery spawn (`story-worker`, `acceptance-critic`) boots on its own `.claude/agents/<role>.md` system prompt instead of re-paying the full CLAUDE.md @-import closure. When false, every converted spawn falls back to `subagent_type: general-purpose` — the instant, code-rollback-free per-consumer revert, and the universal escape for hosts that ignore `.claude/agents/`. The fallback is the full-closure agent that ran before M7-B, so flipping it off never drops a gate. |
-| `routing.freshCriticSampleRate` | No | `number` | `0.2` | Epic #4478 (M7-B, Part 2). Maker-checker sampling floor. Under the standard profile, a change set touching no sensitive path routes its acceptance clusters down the contract-identical inline critic path, but this fraction of them is still forced through a fresh-context critic so a low derived level never means zero independent checking. Clamped to [0, 1]; 0 disables the floor, 1 forces every cluster fresh. Consumed by resolveCeremonyForRisk (lib/orchestration/ceremony-routing.js). |
-| `routing.ceremonyProfile` | No | `"minimal"` \| `"standard"` \| `"strict"` | `"standard"` | Acceptance-ceremony depth. minimal = always inline critic; strict = always fresh-context critic; standard (default) = routed off the change level derived from the Story diff, with the maker-checker sampling floor. |
+| `routing.ceremonyProfile` | No | `"minimal"` \| `"standard"` \| `"strict"` | `"standard"` | Acceptance-ceremony depth. minimal = always inline critic; strict = always fresh-context critic; standard (default) = routed off the change level derived from the Story diff: high or underivable → fresh, low → inline. |
 | `routing.closeAndLand` | No | `boolean` | `true` | When true (default), single-story-close lands through merge in one close. Opt out per-run with --no-wait-merge. |
 
 ### `qa` (optional)

package/.agents/docs/execution-reference.md

@@ -88,7 +88,8 @@ over-ceiling envelope or an over-budget Story count.
 > on planner-context size. Separately, the `ContextEnvelope` SDK this section
 > used to credit with limiting hydrated prompt size had no production caller
 > and was deleted in Story #5005; only its `estimateTokens` helper survived,
-> re-homed in `lib/orchestration/spec-spill.js`.
+> now private to `lib/audit-suite/checklist-threading.js` (Story #5312 deleted
+> `spec-spill.js` with the Spec token budget).
 
 ### Planner-context envelope (`/mandrel-plan`)
 
@@ -120,9 +121,8 @@ over-ceiling envelope or an over-budget Story count.
 
 ### Session-mass capacity (plan-time sizing)
 
-- **`DEFAULT_MODEL_CAPACITY`** (`lib/orchestration/ticket-validator-sizing.js`):
-  absolute authored-token ceilings for plan-time Story sizing (soft 30k /
-  hard 75k). Not operator-configurable via `.agentrc.json`; programmatic
-  override via `opts.modelCapacity` on validateTickets / runPlanPersist only.
+- **Retired (Story #5312).** `DEFAULT_MODEL_CAPACITY` and the plan-time
+  Story sizing ceilings are gone: a Story is as large as the work needs, and
+  nothing at plan time scores its authored mass.
 - **Host runtime**: session billing, quota exhaustion, and operator overrides
   are enforced by your provider (e.g. Claude Code), not by Mandrel scripts.

package/.agents/docs/quality-gates.md

@@ -302,8 +302,9 @@ default and the deep-merge extender form).
 
 ## Cyclomatic ceiling ratchet
 
-`delivery.quality.codingGuardrails.cyclomaticMustFix` (default `12`) is the
-per-function complexity ceiling, enforced by `check-cyclomatic.js`. It is a
+A fixed per-function complexity ceiling of `12` is enforced by
+`check-cyclomatic.js` (`lib/cyclomatic-ceiling.js#CYCLOMATIC_CEILING`; the
+`cyclomaticMustFix` config key was retired in Story #5313). It is a
 **standalone ratchet** — the same slot as `check-arch-cycles.js`,
 `check-dead-exports.js`, and `check-context-budget.js` — not a
 `delivery.quality.gates` kind, so it needs no gate block and no floor.
@@ -330,9 +331,10 @@ The scan reuses `delivery.quality.gates.maintainability.targetDirs` /
 `ignoreGlobs` — both instruments read the same coverage-free escomplex
 surface, so a separate scope declaration could only ever restate it.
 
-`cyclomaticFlag` (default `8`) is the softer half of the pair: it is not
-gated, and names the ceiling `quality:preview` counts new methods against in
-its `new-method count over c=<flag>` column.
+`cyclomaticFlag` (default `8`) is the one advisory knob: it is not gated, and
+names the ceiling `quality:preview` counts new methods against in its
+`new-method count over c=<flag>` column. The preview also lists every scanned
+method at cyclomatic 12 or above as an advisory and exits 0 on it.
 
 ---
 
@@ -825,8 +827,7 @@ correct shape for a gate with no rescoring path of its own.
 ## HITL blocker escalation
 
 `risk::high` is planning/audit metadata only — it never pauses runtime. The
-sole runtime HITL pause point is `agent::blocked`; `planning.riskHeuristics`
-is the rubric for what should escalate. The full model is owned by
+sole runtime HITL pause point is `agent::blocked`. The full model is owned by
 [`.agents/instructions.md`](../instructions.md) § 1.J and
 [`SDLC.md` § HITL model](SDLC.md#hitl-human-in-the-loop-model).
 

package/.agents/instructions.md

@@ -96,8 +96,7 @@ metadata only — no automatic runtime pause. The single runtime pause
 point is **`agent::blocked`**: on an unresolvable blocker or an unsafe
 destructive action without explicit authorization, transition to
 `agent::blocked`, summarize the blocker, and wait for operator resume
-(`agent::executing` or equivalent); escalate per
-`planning.riskHeuristics` in `.agentrc.json`.
+(`agent::executing` or equivalent).
 
 ### K. Precedence & Conflict Resolution
 
@@ -113,8 +112,8 @@ always wins regardless of tier.
 ## 2. FinOps & Token Budgeting (Economic Guardrails)
 
 Mandrel does not enforce live LLM spend; your host owns session quota.
-Fixed framework ceilings (the `/mandrel-plan` context envelope, plan-time Story
-sizing) **fail closed** naming what to trim:
+The one fixed framework ceiling (the `/mandrel-plan` context envelope)
+truncates with a note naming what was cut:
 [`docs/execution-reference.md`](docs/execution-reference.md#finops--token-budgeting-economic-guardrails).
 
 ---
@@ -169,8 +168,8 @@ Do NOT manually update issue descriptions or status fields unless prompted.
 ### B. Ticket hierarchy
 
 The Story is the only executable ticket: `acceptance[]` / `verify[]`
-inline plus the folded Tech Spec in `## Spec` (over-budget Specs fail
-closed — split or tighten; never under `docs/`). Optional `depends_on`
+inline plus the folded Tech Spec in `## Spec` (as long as the work
+needs; never under `docs/`). Optional `depends_on`
 edges order rare multi-Story runs, resolved by `/mandrel-deliver` from
 live state; `plan-run::<id>` is filter metadata. Commit subjects
 reference the Story via `(refs #<storyId>)`. There is no `type::task`.
@@ -194,9 +193,9 @@ anything under it.
 
 `/mandrel-plan` sizes each Story as a **capability slice a frontier model
 delivers and self-verifies in one pass** — a broad footprint is normal
-when the change is cohesive (backstop: `DEFAULT_MODEL_CAPACITY` in
-`ticket-validator-sizing.js`); do not re-slice it into per-module
-fragments. On a `⚠️ COMPLEXITY WARNING` or out-of-scope task: **plan
-first** (numbered cohesive sub-steps in a `<!-- DECOMPOSITION -->`
+when the change is cohesive, and no plan-time ceiling scores it; do not
+re-slice it into per-module fragments. On a `⚠️ COMPLEXITY WARNING` or
+out-of-scope task: **plan first** (numbered cohesive sub-steps in a
+`<!-- DECOMPOSITION -->`
 block), **commit incrementally** per sub-step, and **fail fast** — STOP
 and report if any sub-step fails validation.