npm - mandrel - Versions diffs - 2.57.0 → 2.59.0 - Mend

mandrel 2.57.0 → 2.59.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (58) hide show

package/.agents/scripts/lib/orchestration/plan-text-hygiene.js CHANGED Viewed

@@ -1,6 +1,7 @@
 /**
- * plan-text-hygiene.js — the `open-question` lint over draft Story bodies
- * (Story #4599; narrowed to one lint by Story #5312).
+ * plan-text-hygiene.js — the advisory draft-Story lints: `open-question`
+ * over body prose (Story #4599; narrowed to one lint by Story #5312) and
+ * `pinned-identifier` over `acceptance[]` (Story #5323).
  *
  * A Story is executed by a non-interactive sub-agent, so an operator-directed
  * open question persisted into its body ("Flag if…", "TBD", "confirm with the
@@ -12,6 +13,11 @@
  * lints with the critic gate that surfaced them: both scored prose shape the
  * authoring model already judges, and neither ever changed a persisted body.
  *
+ * `pinned-identifier` is the one lint that scores the **binding** half of the
+ * ticket; its classifier lives in
+ * [`pinned-identifier-lint.js`](pinned-identifier-lint.js), which shares no
+ * vocabulary with the prose heuristic here.
+ *
  * Advisory by contract: findings are deterministic text for the dry-run's
  * warning list. They never gate persist and spawn nothing.
  *
@@ -24,6 +30,7 @@
  */
 import { parse } from '../story-body/story-body.js';
+import { findPinnedIdentifiers } from './pinned-identifier-lint.js';
 /** Truncation length for the `evidence` excerpt on each finding. */
 const EVIDENCE_MAX_CHARS = 160;
@@ -41,7 +48,7 @@ const OPEN_QUESTION_MARKERS = [
 /**
  * @typedef {Object} TextHygieneFinding
- * @property {'open-question'} kind
+ * @property {'open-question'|'pinned-identifier'} kind
  * @property {string} slug - The draft Story's slug ('' when absent).
  * @property {string} evidence - Excerpt of the offending text.
  * @property {string} message - Human-readable, re-author-actionable text.
@@ -123,7 +130,7 @@ function findOpenQuestions(prose, slug) {
 }
 /**
- * Evaluate the open-question lint over a draft Story array.
+ * Evaluate the advisory lints over a draft Story array.
  *
  * @param {{ draftStories?: Array<object>|null }} args - The draft
  *   `stories.json` array (raw Story objects with top-level `slug` /
@@ -146,7 +153,10 @@ export function evaluateTextHygiene({ draftStories = null } = {}) {
     }
     const goal = typeof body.goal === 'string' ? body.goal : '';
     const spec = typeof body.spec === 'string' ? body.spec : '';
-    findings.push(...findOpenQuestions([goal, spec].join('\n'), slug));
+    findings.push(
+      ...findOpenQuestions([goal, spec].join('\n'), slug),
+      ...findPinnedIdentifiers(story, body, slug, excerpt),
+    );
   }
   return { findings };
 }

package/.agents/scripts/lib/orchestration/review-base-ref.js ADDED Viewed

@@ -0,0 +1,138 @@
+/**
+ * lib/orchestration/review-base-ref.js — the base ref a Story-scope review is
+ * allowed to measure against (Story #5325).
+ *
+ * ## The defect this closes
+ *
+ * A close runs base-sync and the Story-scope review against what everyone
+ * called "the base branch" — but the two meant different refs. Base-sync
+ * fetches and merges `origin/<base>`; the review passed the **bare** branch
+ * name, which git resolves to the LOCAL `refs/heads/<base>`, i.e. to whatever
+ * that ref last fast-forwarded to. On a checkout whose local base is behind
+ * its remote, the review's `<base>...<head>` diff therefore contains every
+ * commit the local ref is missing — other people's landed work, scored as if
+ * this Story had written it. Those findings gate the land, and the operator's
+ * only exit is a `review-block-overridden` on blockers that were never real.
+ *
+ * ## Contract
+ *
+ * One resolution, at the review phase boundary, threaded into the change-set
+ * enumeration, the provider review and the local lens pass — so both arms of
+ * the review agree about what changed and neither can inherit local drift.
+ *
+ * Resolution **fails safe rather than falling back**. Base-sync normally
+ * guarantees the remote ref is present, but a `--skip-sync` close or a
+ * remote-less checkout can reach the review with no `origin/<base>` at all.
+ * Reviewing the local ref anyway is the defect, so an unresolvable base
+ * produces a degradation record — carried on the review's existing
+ * `degraded` / `degradations[]` envelope — and no findings whatsoever.
+ */
+import { gitSpawn } from '../git-utils.js';
+import { degradationEnvelope } from './review-providers/degraded-gates.js';
+/**
+ * The remote-tracking spelling of a base branch — `main` → `origin/main`.
+ * Already-qualified input passes through, so a caller naming `origin/main`
+ * is not double-prefixed.
+ *
+ * @param {unknown} baseBranch
+ * @returns {string|null} the remote-tracking ref, or `null` when unnameable.
+ */
+export function remoteBaseRef(baseBranch) {
+  const base = typeof baseBranch === 'string' ? baseBranch.trim() : '';
+  if (base.length === 0) return null;
+  return base.startsWith('origin/') ? base : `origin/${base}`;
+}
+/**
+ * Resolve the base ref base-sync merged from, **verified present** in this
+ * clone. See the module header for why there is no local-ref fallback.
+ *
+ * @param {{
+ *   baseBranch: string,
+ *   cwd?: string,
+ *   gitSpawnFn?: typeof gitSpawn,
+ * }} args
+ * @returns {{ ref: string|null, resolved: boolean, remoteRef: string|null }}
+ *   `ref` is non-null only when `resolved`; `remoteRef` is the ref that was
+ *   probed, for the caller's degradation surface.
+ */
+export function resolveSharedBaseRef({
+  baseBranch,
+  cwd = process.cwd(),
+  gitSpawnFn = gitSpawn,
+} = {}) {
+  const remoteRef = remoteBaseRef(baseBranch);
+  if (remoteRef === null) {
+    return { ref: null, resolved: false, remoteRef: null };
+  }
+  try {
+    const probe = gitSpawnFn(
+      cwd,
+      'rev-parse',
+      '--verify',
+      '--quiet',
+      `${remoteRef}^{commit}`,
+    );
+    if (probe?.status === 0) {
+      return { ref: remoteRef, resolved: true, remoteRef };
+    }
+  } catch {
+    // A spawn failure and a missing ref are the same answer here: the shared
+    // base cannot be vouched for.
+  }
+  return { ref: null, resolved: false, remoteRef };
+}
+/**
+ * The review outcome for a close that cannot establish the shared base.
+ *
+ * Shaped as the same envelope a completed review returns — an all-zero
+ * severity tally, nothing posted, and the `degraded` / `degradations[]` pair
+ * the close and the rendered comment already read — so the surfaces reading
+ * it cannot mistake "no findings" for "reviewed and clean". Reported, not
+ * blocking, matching the posture of every other degraded review gate.
+ *
+ * @param {{
+ *   storyId: number|string,
+ *   baseBranch: string,
+ *   remoteRef: string|null,
+ *   progress: (tag: string, msg: string) => void,
+ *   progressTag?: string,
+ * }} args
+ * @returns {object}
+ */
+export function unresolvedBaseReviewOutcome({
+  storyId,
+  baseBranch,
+  remoteRef,
+  progress,
+  progressTag = 'REVIEW',
+}) {
+  const surface = remoteRef ?? `origin/${baseBranch}`;
+  progress(
+    progressTag,
+    `⚠️ Story-scope review for Story #${storyId} did not run: cannot resolve ` +
+      `${surface}, the base ref base-sync merges from. Diffing the local ` +
+      `${baseBranch} instead would score commits this Story never made, so no ` +
+      'findings are raised. Fetch the base ref (or re-run without ' +
+      '--skip-sync) to restore the review.',
+  );
+  return {
+    halted: false,
+    skipped: true,
+    severity: { critical: 0, high: 0, medium: 0, suggestion: 0 },
+    posted: false,
+    postedCommentId: null,
+    ...degradationEnvelope([
+      {
+        tool: 'story-scope-review',
+        gate: 'base-ref-resolution',
+        surface,
+        reason: 'remote-base-ref-unresolved',
+      },
+    ]),
+    crossRefPosted: false,
+  };
+}

package/.agents/scripts/lib/orchestration/single-story-close/phases/code-review.js CHANGED Viewed

@@ -25,9 +25,21 @@
  * shares a single invocation pattern (Story #3653). Review depth needs no
  * input here: it is derived from this Story's own diff inside `runCodeReview`
  * (Story #4542).
+ *
+ * Story #5325 — this phase boundary is where the base ref is resolved, once.
+ * The resolved ref threads into `runStoryReviewCore`, which hands it to both
+ * the change-set enumeration (and through it the provider review) and the
+ * local lens pass, so one resolution corrects both arms. It resolves to
+ * `origin/<baseBranch>` — the ref base-sync merged from — rather than the bare
+ * branch name git would resolve to the local `refs/heads/<baseBranch>`, whose
+ * drift would otherwise be scored as this Story's own change.
  */
 import { parsePrNumberFromUrl } from '../../../github-url.js';
+import {
+  resolveSharedBaseRef,
+  unresolvedBaseReviewOutcome,
+} from '../../review-base-ref.js';
 import { degradationEnvelope } from '../../review-providers/degraded-gates.js';
 import { runStoryReviewCore } from '../../story-close/phases/review-core.js';
 import { postStructuredComment } from '../../ticketing/state.js';
@@ -78,23 +90,25 @@ export function buildStoryReviewCrossRefBody({
 async function invokeStoryReviewCore({
   storyId,
   storyBranch,
-  baseBranch,
+  baseRef,
   prNumber,
   provider,
   runCodeReviewFn,
   runLocalLensReviewFn,
   appendFindingsYieldFn,
+  gitSpawnFn,
   progress,
 }) {
   return runStoryReviewCore({
     storyId,
-    baseRef: baseBranch,
+    baseRef,
     headRef: storyBranch,
     commentTargetId: prNumber,
     provider,
     progress,
     progressTag: 'REVIEW',
     runCodeReviewFn,
+    gitSpawnFn,
     // Forward the seams only when the caller injects them; otherwise
     // `runStoryReviewCore` uses its defaults. `undefined` deep-merges to
     // the default via the destructuring default there.
@@ -153,6 +167,9 @@ async function postStoryReviewCrossRef({
  * Failure modes:
  *   - When `prNumber` is null (couldn't parse), the review is skipped
  *     and the function returns `{ halted: false, skipped: true }`.
+ *   - When `origin/<baseBranch>` cannot be resolved, the review is skipped,
+ *     a `base-ref-resolution` degradation is recorded on the returned
+ *     envelope, and no findings are raised (Story #5325).
  *   - When the runner throws, the close fails non-zero (the throw
  *     propagates) — a Story-scope review failure is not silently
  *     ignored.
@@ -170,6 +187,7 @@ async function postStoryReviewCrossRef({
  *   runCodeReviewFn: Function,
  *   runLocalLensReviewFn?: Function,
  *   appendFindingsYieldFn?: Function,
+ *   gitSpawnFn?: Function,
  *   progress: (tag: string, msg: string) => void,
  * }} args
  * @returns {Promise<{
@@ -185,7 +203,7 @@ async function postStoryReviewCrossRef({
  * }>}
  */
 export async function runStoryScopeReview({
-  cwd: _cwd,
+  cwd,
   storyId,
   storyBranch,
   baseBranch,
@@ -195,6 +213,7 @@ export async function runStoryScopeReview({
   runCodeReviewFn,
   runLocalLensReviewFn,
   appendFindingsYieldFn,
+  gitSpawnFn,
   progress,
 }) {
   if (prNumber == null) {
@@ -205,20 +224,33 @@ export async function runStoryScopeReview({
     return { halted: false, skipped: true };
   }
+  // One resolution per close, at the phase boundary: `baseRef` threads from
+  // here into the change set, the provider review and the local lens pass.
+  const base = resolveSharedBaseRef({ baseBranch, cwd, gitSpawnFn });
+  if (!base.resolved) {
+    return unresolvedBaseReviewOutcome({
+      storyId,
+      baseBranch,
+      remoteRef: base.remoteRef,
+      progress,
+    });
+  }
   progress(
     'REVIEW',
-    `Running Story-scope code review for Story #${storyId} (${baseBranch}...${storyBranch}) → PR #${prNumber}...`,
+    `Running Story-scope code review for Story #${storyId} (${base.ref}...${storyBranch}) → PR #${prNumber}...`,
   );
   const result = await invokeStoryReviewCore({
     storyId,
     storyBranch,
-    baseBranch,
+    baseRef: base.ref,
     prNumber,
     provider,
     runCodeReviewFn,
     runLocalLensReviewFn,
     appendFindingsYieldFn,
+    gitSpawnFn,
     progress,
   });

package/.agents/scripts/lib/orchestration/single-story-close/runner.js CHANGED Viewed

@@ -7,7 +7,7 @@ import {
 import { runCloseValidation } from '../../close-validation/runner.js';
 import { getCiDelivery } from '../../config/ci.js';
 import { resolveConfig } from '../../config-resolver.js';
-import { getStoryBranch, gitSync } from '../../git-utils.js';
+import { getStoryBranch, gitSpawn, gitSync } from '../../git-utils.js';
 import { Logger } from '../../Logger.js';
 import { emitTerminalFriction } from '../../observability/runtime-friction.js';
 import { emitTerseResult } from '../../observability/terse-result.js';
@@ -318,6 +318,11 @@ async function openAndReviewPr({
     prNumber,
     provider,
     runCodeReviewFn: injectedRunCodeReview ?? runCodeReviewDefault,
+    // The runner owns the git seam it hands its phases (same as `gitSync` to
+    // `pushStoryBranch`). The review needs it to resolve `origin/<base>` —
+    // the ref base-sync merged from — before it will score anything
+    // (Story #5325).
+    gitSpawnFn: gitSpawn,
     progress,
   });
   if (reviewOutcome.halted) {

package/.agents/scripts/lib/orchestration/ticket-validator-conflicts.js CHANGED Viewed

@@ -8,13 +8,12 @@ import { computeStoryReachability } from './story-reachability.js';
  * `collectStoryAssumptionEntries` (Story #3302) and the sizing gate's
  * `resolveStoryBody` (Story #4271).
  *
- * The decomposer emits `body` as the canonical serialized **string**, but
- * the conflict passes (`indexConsumers`, `computeMissingBddScaffoldFindings`,
- * and the producer path scan in `collectStoryProducerPaths`) historically
- * read `story.body` only when it was already an object — so on the
- * production string shape the `implicit-cross-story-dep` and
- * `missing-bdd-scaffold` findings emitted nothing. Parsing the body once at the entry point and
- * threading the normalized Story through every pass restores parity.
+ * The decomposer emits `body` as the canonical serialized **string**, but the
+ * conflict passes (the producer path scan in `collectStoryProducerPaths`, and
+ * the two substring-match advisories Story #5332 retired) historically read
+ * `story.body` only when it was already an object — so on the production
+ * string shape they emitted nothing. Parsing the body once at the entry point
+ * and threading the normalized Story through every pass restores parity.
  *
  * `collectStoryAssumptionEntries` already parses string bodies itself, so a
  * normalized object body round-trips through it unchanged. The returned Story
@@ -76,16 +75,20 @@ function normalizeStoryBody(story) {
  * @property {string}          path        Producer path written by ≥2 Stories.
  * @property {string[]}        storySlugs  Story slugs in the conflict cluster.
  *
- * @typedef {object} ImplicitCrossStoryDepFinding
- * @property {'implicit-cross-story-dep'} kind
- * @property {'hard'|'soft'}   severity
- * @property {string}          path        Path consumed without a depends_on link.
- * @property {{ storySlug: string, taskSlug: string }} producer
- * @property {{ storySlug: string, taskSlug: string, sourceField: 'acceptance'|'verify' }} consumer
- *
- * @typedef {SharedEditorFinding | ImplicitCrossStoryDepFinding} ConflictFinding
+ * @typedef {SharedEditorFinding} ConflictFinding
  */
+/**
+ * Story #5332 retired the `implicit-cross-story-dep` and
+ * `missing-bdd-scaffold` findings, leaving `shared-editor` as the one
+ * conflict kind. Both matched a producer path as a **substring** of a
+ * consumer's `acceptance[]` / `verify[]` text — the noise-prone shape the
+ * planning-diet ADR (`20260912-5312`) itself calls out — and both had been
+ * unreachable on the real payload for most of their life (see
+ * {@link computeAssembledConflictFindings}). What they nudged for, ordering a
+ * consumer after its producer, the same-wave collision refusal now enforces
+ * on declarations rather than guesses at from prose.
 /**
  * Every conflict class is advisory (`'soft'`) since Story #5312: the
  * `planning.failOnSharedEditors` / `requireExplicitCrossStoryDeps` /
@@ -160,46 +163,6 @@ function indexProducers(stories) {
   return producers;
 }
-/**
- * Build the consumers index — `Array<{path, storySlug, taskSlug, sourceField}>`.
- *
- * For each Task, scan `body.acceptance` and `body.verify` joined text for
- * literal substring occurrences of any known producer path. Only producer
- * paths are matched (intersect-then-test), so free-text path-like tokens
- * that no one writes never produce false positives.
- *
- * A Story is not its own consumer — entries whose producer is the same
- * Story are skipped to keep the surface focused on cross-Story signal.
- */
-function indexConsumers(stories, producers) {
-  const consumers = [];
-  if (producers.size === 0) return consumers;
-  const producerPaths = Array.from(producers.keys()).sort(
-    (a, b) => b.length - a.length,
-  );
-  for (const story of stories) {
-    const body = story.body;
-    if (!body || typeof body !== 'object') continue;
-    for (const sourceField of ['acceptance', 'verify']) {
-      const items = Array.isArray(body[sourceField]) ? body[sourceField] : [];
-      if (items.length === 0) continue;
-      const joined = items.map((it) => String(it ?? '')).join('\n');
-      for (const path of producerPaths) {
-        if (!joined.includes(path)) continue;
-        const producerEntries = producers.get(path) ?? [];
-        if (producerEntries.some((p) => p.taskSlug === story.slug)) continue;
-        consumers.push({
-          path,
-          storySlug: storySlugOf(story),
-          taskSlug: story.slug,
-          sourceField,
-        });
-      }
-    }
-  }
-  return consumers;
-}
 function inSameWave(reach, slugA, slugB) {
   if (slugA === slugB) return false;
   const a = reach.get(slugA);
@@ -240,133 +203,6 @@ function computeSharedEditorFindings(producers, reach, severity) {
   return findings;
 }
-/**
- * Emit one `implicit-cross-story-dep` finding per consumer entry whose
- * producer Story is not transitively reachable from the consumer Story.
- *
- * Multiple producers per path are possible — the finding pins the *first*
- * producer in declaration order (sufficient signal; the operator typically
- * fixes the missing `depends_on` by linking to whichever Story they
- * recognize). Consumers already covered by a transitive dependency to
- * *some* producer are silently allowed even if other producers exist.
- */
-function computeImplicitDepFindings(consumers, producers, reach, severity) {
-  const findings = [];
-  for (const consumer of consumers) {
-    const producerEntries = producers.get(consumer.path) ?? [];
-    if (producerEntries.length === 0) continue;
-    const reachable = reach.get(consumer.storySlug) ?? new Set();
-    const alreadyDependsOnSome = producerEntries.some(
-      (p) => p.storySlug === consumer.storySlug || reachable.has(p.storySlug),
-    );
-    if (alreadyDependsOnSome) continue;
-    const producer = producerEntries[0];
-    findings.push({
-      kind: 'implicit-cross-story-dep',
-      severity,
-      path: consumer.path,
-      producer: {
-        storySlug: producer.storySlug,
-        taskSlug: producer.taskSlug,
-      },
-      consumer: {
-        storySlug: consumer.storySlug,
-        taskSlug: consumer.taskSlug,
-        sourceField: consumer.sourceField,
-      },
-    });
-  }
-  return findings;
-}
-/**
- * Compute `missing-bdd-scaffold` findings (Story #3857).
- *
- * The features-first delivery model requires every `.feature` file a Story
- * verifies against to already exist when that Story runs. When a Story's
- * `verify[]` references a `.feature` path that another Story declares with
- * `assumption: "creates"`, the consumer is correct only if the producer
- * lands in an *earlier* wave — otherwise the consumer's `verify[]` runs
- * against a file that does not yet exist and verification fails mid-delivery.
- *
- * A finding fires for each consumer/producer pair where:
- *   - the path ends in `.feature`,
- *   - a *different* Story declares that path as `assumption: "creates"`, and
- *   - the consumer Story does not transitively `depends_on` the producer
- *     (i.e. they share a wave, or the producer runs later).
- *
- * The finding is advisory (`'soft'`) — it is a nudge to add a `depends_on`
- * link to the wave-0 scaffold Story (or to the producing Story), not a hard
- * block. The remediation is the same shape as `implicit-cross-story-dep`:
- * order the consumer after the producer so the scaffold lands first.
- *
- * @param {object[]} stories
- * @param {Map<string, Set<string>>} reach  Transitive predecessor sets.
- * @param {'soft'|'hard'} severity
- * @returns {object[]} `missing-bdd-scaffold` findings.
- */
-function computeMissingBddScaffoldFindings(stories, reach, severity) {
-  // Index every `.feature` path declared `creates` to its producing Story.
-  // A path may be created by more than one Story (unusual); pin the first in
-  // declaration order, mirroring the implicit-dep finding's single-producer
-  // shape.
-  const featureCreators = new Map(); // path -> storySlug (first creator)
-  for (const story of stories) {
-    const body = story?.body;
-    if (!body || typeof body !== 'object') continue;
-    const changes = Array.isArray(body.changes) ? body.changes : [];
-    for (const change of changes) {
-      if (
-        change === null ||
-        typeof change !== 'object' ||
-        change.assumption !== 'creates' ||
-        typeof change.path !== 'string' ||
-        !change.path.endsWith('.feature')
-      )
-        continue;
-      if (!featureCreators.has(change.path)) {
-        featureCreators.set(change.path, storySlugOf(story));
-      }
-    }
-  }
-  if (featureCreators.size === 0) return [];
-  const creatorPaths = Array.from(featureCreators.keys()).sort(
-    (a, b) => b.length - a.length,
-  );
-  const findings = [];
-  const seen = new Set(); // dedupe `${consumerSlug}::${path}` pairs
-  for (const story of stories) {
-    const body = story?.body;
-    if (!body || typeof body !== 'object') continue;
-    const verifyItems = Array.isArray(body.verify) ? body.verify : [];
-    if (verifyItems.length === 0) continue;
-    const joined = verifyItems.map((it) => String(it ?? '')).join('\n');
-    const consumerSlug = storySlugOf(story);
-    for (const path of creatorPaths) {
-      if (!joined.includes(path)) continue;
-      const producerSlug = featureCreators.get(path);
-      // A Story that creates the file it verifies is fine — no cross-Story gap.
-      if (producerSlug === consumerSlug) continue;
-      // Producer already runs in an earlier wave → consumer is correctly
-      // ordered, scaffold lands first, no finding.
-      const reachable = reach.get(consumerSlug) ?? new Set();
-      if (reachable.has(producerSlug)) continue;
-      const key = `${consumerSlug}::${path}`;
-      if (seen.has(key)) continue;
-      seen.add(key);
-      findings.push({
-        kind: 'missing-bdd-scaffold',
-        severity,
-        path,
-        producer: { storySlug: producerSlug },
-        consumer: { storySlug: consumerSlug, sourceField: 'verify' },
-      });
-    }
-  }
-  return findings;
-}
 /**
  * Public entry point. Walks the normalized ticket spec once and returns
  * the structured cross-Story findings array. Every finding is `'soft'`
@@ -384,13 +220,8 @@ export function computeConflictFindings({ stories } = {}) {
   // shape across every conflict pass.
   const storyList = (stories ?? []).map(normalizeStoryBody);
   const producers = indexProducers(storyList);
-  const consumers = indexConsumers(storyList, producers);
   const reach = computeStoryReachability(storyList);
-  return [
-    ...computeSharedEditorFindings(producers, reach, SOFT),
-    ...computeImplicitDepFindings(consumers, producers, reach, SOFT),
-    ...computeMissingBddScaffoldFindings(storyList, reach, SOFT),
-  ];
+  return computeSharedEditorFindings(producers, reach, SOFT);
 }
 /**
@@ -402,11 +233,11 @@ export function computeConflictFindings({ stories } = {}) {
  * persisted. That is not a cosmetic ordering nit: the canonical authoring shape
  * carries `acceptance[]` / `verify[]` at the ticket's **top level**, and it is
  * assembly's `syncContractFieldFromTopLevel` that folds them into the body.
- * `indexConsumers` scans `body.acceptance` / `body.verify` for producer paths —
- * so on the real payload it scanned two empty arrays, and every
- * `implicit-cross-story-dep` and `missing-bdd-scaffold` finding was silently
- * unreachable. Running the passes again over the serialized bodies restores
- * them.
+ * The two retired advisories scanned `body.acceptance` / `body.verify` for
+ * producer paths, so on the real payload they scanned two empty arrays and
+ * were silently unreachable. Running the passes again over the serialized
+ * bodies is what keeps the surviving `shared-editor` pass honest about what
+ * persist actually writes.
  *
  * @param {{ stories: Array<{ slug: string, title: string, body: string, depends_on?: string[] }> }} args
  * @returns {ConflictFinding[]}
@@ -457,13 +288,7 @@ export function conflictFindingKey(finding) {
  * of this list is how readers drift apart, so it is defined exactly once and
  * imported.
  */
-export const CONFLICT_KINDS = Object.freeze(
-  new Set([
-    'shared-editor',
-    'implicit-cross-story-dep',
-    'missing-bdd-scaffold',
-  ]),
-);
+export const CONFLICT_KINDS = Object.freeze(new Set(['shared-editor']));
 /**
  * Render a conflict finding as a human-readable line. Every finding is soft
@@ -476,12 +301,6 @@ export function renderHardConflictError(finding) {
     const stories = finding.storySlugs.map((s) => `"${s}"`).join(', ');
     return `Shared-editor conflict: "${finding.path}" is written by ${finding.storySlugs.length} concurrent Stories (${stories}). Add depends_on chains between them or split the edits into a dedicated late-wave wiring Story.`;
   }
-  if (finding.kind === 'implicit-cross-story-dep') {
-    return `Implicit cross-Story dependency: Story "${finding.consumer.storySlug}" references "${finding.path}" (produced by Story "${finding.producer.storySlug}") via body.${finding.consumer.sourceField}, but Story "${finding.consumer.storySlug}" has no depends_on link to Story "${finding.producer.storySlug}". Add depends_on: ["${finding.producer.storySlug}"] to the consumer Story or remove the reference.`;
-  }
-  if (finding.kind === 'missing-bdd-scaffold') {
-    return `Missing BDD scaffold: Story "${finding.consumer.storySlug}" verifies against "${finding.path}" (created by Story "${finding.producer.storySlug}") via body.${finding.consumer.sourceField}, but "${finding.consumer.storySlug}" has no depends_on path to "${finding.producer.storySlug}" — the .feature file is scaffolded in the same wave (or later), so verification runs before the file exists. Add depends_on: ["${finding.producer.storySlug}"] to the consumer Story so the scaffold lands in an earlier wave.`;
-  }
   // Findings from other passes carry their own message — render it rather
   // than a shape-blind generic line, so the soft surface
   // (`surfaceSoftConflictFindings`) stays legible for every kind.
@@ -496,10 +315,7 @@ export const _internal = {
   collectStoryProducerPaths,
   WRITE_IMPLYING_ASSUMPTIONS,
   indexProducers,
-  indexConsumers,
   computeStoryReachability,
   inSameWave,
   computeSharedEditorFindings,
-  computeImplicitDepFindings,
-  computeMissingBddScaffoldFindings,
 };

package/.agents/scripts/lib/orchestration/ticket-validator-sizing.js CHANGED Viewed

@@ -1,7 +1,6 @@
 /**
  * Story authoring guidance — the two prose constants the story-author prompt
- * and the `core/scope-triage` skill both cite, stated once so the surfaces
- * cannot drift.
+ * cites, stated once so no second copy can drift.
  *
  * Story #5312 deleted the numeric sizing model that used to live beside
  * them: `DEFAULT_MODEL_CAPACITY` with its soft / hard session-mass ceilings,
@@ -18,12 +17,16 @@
 /**
  * `DELIVERABLE_GRANULARITY_GUIDANCE` is the **single source of truth** for the
  * deliverable-granularity definition of a Story (Story #3777). It is stated
- * ONCE here and consumed by BOTH the story-author prompt template and the
- * authoring SKILL.
+ * ONCE here and consumed by the story-author prompt template.
+ *
+ * Story #5332 re-anchored the definition off "a single reviewer-sized PR":
+ * that anchor read as a size ceiling and fragmented cohesive sweeps, so the
+ * only stated sizing test is now cohesion — one coherent change with one
+ * reason to exist.
  */
 export const DELIVERABLE_GRANULARITY_GUIDANCE = Object.freeze({
   definition:
-    'A Story is a **capability slice a frontier model delivers and self-verifies in one pass** — a shippable slice a reviewer would accept as a single PR, a capability or user-visible surface, **not a single module or file**. Fold module-level slices into the capability they belong to rather than emitting one Story per module.',
+    'A Story is a **capability slice a frontier model delivers and self-verifies in one pass** — one coherent change with one reason to exist, a capability or user-visible surface, **not a single module or file**. Fold module-level slices into the capability they belong to rather than emitting one Story per module. A remediation sweep over one subsystem is one Story; its stages belong in `## Slicing`, not in sibling tickets.',
   singleConsumerRule:
     '**Single-consumer merge rule.** A Story whose only consumer is one sibling Story should be **merged into that sibling** rather than emitted separately — a single-consumer downstream slice is not its own unit of work.',
   envelopeFloor: