mandrel 2.58.0 → 2.60.0

package/.agents/scripts/file-ci-gap.js

@@ -35,7 +35,11 @@ import {
   INTAKE_VERDICTS,
   REFUSED_VERDICT,
 } from './lib/orchestration/ci-gap-intake.js';
-import { readCiDigest } from './lib/orchestration/ci-rerun-guard.js';
+import {
+  RERUN_ALLOWANCE_VERDICTS,
+  readCiDigest,
+  recordRerunAllowance,
+} from './lib/orchestration/ci-rerun-guard.js';
 import {
   STATE_LABELS,
   transitionTicketState,
@@ -55,7 +59,7 @@ const USAGE = {
     ],
     [
       '--verdict <verdict>',
-      `One of ${INTAKE_VERDICTS.join(' | ')}. "${REFUSED_VERDICT}" is refused: it routes to Option 1, fix at source.`,
+      `One of ${INTAKE_VERDICTS.join(' | ')}. "${REFUSED_VERDICT}" is refused: it routes to Option 1, fix at source. ${RERUN_ALLOWANCE_VERDICTS.join(' / ')} also record the one-rerun allowance on the CI digest.`,
     ],
     [
       '--owner <bucket>',
@@ -138,7 +142,12 @@ function liveIntakePorts({ provider, searchRepo, cwd, logger }) {
  * @param {object} opts
  * @returns {string}
  */
-export function renderFrictionComment({ verdict, result, digest }) {
+export function renderFrictionComment({
+  verdict,
+  result,
+  digest,
+  rerunAllowance = null,
+}) {
   const target = result.issue?.url ?? result.issue?.number ?? '(not filed)';
   const lines = [
     `### CI gap filed — verdict \`${verdict}\``,
@@ -158,14 +167,31 @@ export function renderFrictionComment({ verdict, result, digest }) {
       `- **Routing:** deferred from \`${result.routing.deferredFrom}\` (${result.routing.deferralReason}) — filed locally instead.`,
     );
   }
-  lines.push(
-    '',
-    'This verdict does **not** license a re-run of the failed job. Graduate the',
-    'intake issue with `/mandrel-plan <issue number>` to turn it into a Story.',
-  );
+  lines.push('', renderRerunLine(rerunAllowance), GRADUATE_LINE);
   return lines.join('\n');
 }
 
+/** The graduation instruction every filing carries, verdict-independent. */
+const GRADUATE_LINE =
+  'Graduate the intake issue with `/mandrel-plan <issue number>` to turn it into a Story.';
+
+/**
+ * What this filing says about rerunning the failed job (Story #5343). An
+ * allowance is stated with its head SHA and its one-shot bound, because the
+ * comment is where an operator reads whether the rerun they are about to do
+ * is the sanctioned one.
+ *
+ * @param {{ headSha: string } | null} rerunAllowance
+ * @returns {string}
+ */
+function renderRerunLine(rerunAllowance) {
+  return rerunAllowance
+    ? 'This verdict is environmental and proven, so **one** rerun of the failed ' +
+        `job is now admitted on head \`${rerunAllowance.headSha}\` — and one only. ` +
+        'A second red after it is real and routes to Option 1.'
+    : 'This verdict does **not** license a re-run of the failed job.';
+}
+
 /**
  * File the CI-gap intake issue for one Story, post the `friction` comment,
  * and optionally flip the Story to `agent::blocked`.
@@ -198,7 +224,12 @@ export async function runFileCiGap({
     throw new Error('--story <id> is required (a positive issue number).');
   }
   const resolved = config ?? resolveConfig();
-  const ciDigest = digest ?? readCiDigest({ storyId: sid, tempRoot, cwd });
+  // The digest's temp root, resolved exactly as `pr-watch-with-update.js`
+  // resolves it when it WRITES the digest — the CLI never passed one, so the
+  // default read crashed on `undefined` before it could find the file.
+  const digestRoot = tempRoot ?? resolved?.project?.paths?.tempRoot ?? 'temp';
+  const ciDigest =
+    digest ?? readCiDigest({ storyId: sid, tempRoot: digestRoot, cwd });
   if (!ciDigest) {
     throw new Error(
       `no CI digest for Story #${sid}. The digest is written by \`pr-watch-with-update.js --story ${sid}\` on the first red; without it there is no run link or failure signature to file.`,
@@ -237,9 +268,26 @@ export async function runFileCiGap({
     now,
   });
 
+  // Story #5343 — a proven-environmental verdict earns the one same-SHA
+  // rerun the watcher's guard will admit. Recorded on the digest, keyed to
+  // the head SHA the red was observed on, and never on a dry run.
+  const rerunAllowance = dryRun
+    ? null
+    : recordRerunAllowance({
+        storyId: sid,
+        verdict,
+        tempRoot: digestRoot,
+        cwd,
+      });
+
   const actions = { commented: false, blocked: false };
   if (!dryRun && ticketing) {
-    const body = renderFrictionComment({ verdict, result, digest: ciDigest });
+    const body = renderFrictionComment({
+      verdict,
+      result,
+      digest: ciDigest,
+      rerunAllowance,
+    });
     try {
       await upsertStructuredComment(ticketing, sid, 'friction', body);
       actions.commented = true;
@@ -258,7 +306,7 @@ export async function runFileCiGap({
     }
   }
 
-  return { storyId: sid, verdict, ...result, actions };
+  return { storyId: sid, verdict, ...result, actions, rerunAllowance };
 }
 
 /**

package/.agents/scripts/install-matrix-assert.js

@@ -59,17 +59,62 @@ import path from 'node:path';
  * `.agents/runtime-deps.json` and provided by the consumer's install of
  * `mandrel` (npm hoists them into node_modules), but they MUST NOT
  * appear in the consumer's *declared* package.json dependencies. Kept in sync
- * with `.agents/runtime-deps.json` `dependencies` keys.
+ * with `.agents/runtime-deps.json` `dependencies` keys — the whole set, so
+ * this list documents the closure; {@link SHAREABLE_RUNTIME_DEPS} carries the
+ * policy about which of them a consumer may also declare.
  */
 const FRAMEWORK_RUNTIME_DEPS = [
+  '@babel/parser',
   'ajv',
   'ajv-formats',
+  'babel-runtime',
+  'escomplex-plugin-metrics-module',
+  'escomplex-plugin-syntax-babylon',
   'js-yaml',
   'minimatch',
   'picomatch',
-  'typhonjs-escomplex',
+  'typhonjs-ast-walker',
+  'typhonjs-escomplex-commons',
 ];
 
+/**
+ * Runtime dependencies the framework declares but does **not** claim
+ * exclusively, so a consumer declaring one is not evidence of a mutated
+ * manifest.
+ *
+ * This check exists to catch a consumer's `package.json` being written into
+ * with framework-internal packages. That inference only holds for packages
+ * nobody else would plausibly declare. `@babel/parser` and `babel-runtime`
+ * fail that test completely: a repository with its own Babel pipeline, AST
+ * tooling or legacy transpile output declares them for its own reasons, and
+ * failing `manifest-clean` for that would be a false positive on an ordinary
+ * consumer rather than a caught mutation.
+ *
+ * Kept as an explicit list rather than a heuristic: adding a widely-used
+ * package to the framework's runtime closure should be a deliberate decision
+ * to stop policing it, recorded here.
+ */
+const SHAREABLE_RUNTIME_DEPS = ['@babel/parser', 'babel-runtime'];
+
+/**
+ * Is this framework dependency's presence in a consumer manifest evidence of a
+ * mutated manifest?
+ *
+ * Only for packages the framework claims exclusively. A shareable one is
+ * declared by ordinary repositories for their own reasons.
+ *
+ * @param {string} dep
+ * @param {Record<string, string>} declared Consumer's merged declared deps.
+ * @returns {boolean}
+ */
+function isLeak(dep, declared) {
+  if (!(dep in declared)) return false;
+  return !SHAREABLE_RUNTIME_DEPS.includes(dep);
+}
+
+/** Exported for the manifest-mirror drift assertion. */
+export { FRAMEWORK_RUNTIME_DEPS, SHAREABLE_RUNTIME_DEPS };
+
 /** The verdict marker `mandrel doctor` prints when every check passes. */
 const DOCTOR_READY_MARKER = '✅  Ready';
 
@@ -157,7 +202,7 @@ export function checkManifestClean({ consumer, packageName, fs = nodeFs }) {
     ...(manifest.peerDependencies ?? {}),
   };
 
-  const leaked = FRAMEWORK_RUNTIME_DEPS.filter((dep) => dep in declared);
+  const leaked = FRAMEWORK_RUNTIME_DEPS.filter((dep) => isLeak(dep, declared));
   if (leaked.length > 0) {
     return {
       ok: false,

package/.agents/scripts/lib/audit-to-stories/seed-from-findings.js

@@ -9,7 +9,7 @@
  *   - Problem Statement (aggregated severity profile)
  *   - Recommended Direction (rollup of recommendations by dimension)
  *   - Key Assumptions (carries the source-report links forward)
- *   - MVP Scope (the proposed Stories, one bullet per group)
+ *   - MVP Scope (the findings themselves, flat — Story #5332)
  *   - Key Files (explicit file paths so `/mandrel-plan` authoring has concrete
  *     anchors)
  *   - Not Doing (out-of-scope items by convention)
@@ -19,7 +19,6 @@
 
 import { SEVERITIES } from '../findings/severity.js';
 import { auditLabelFooterForFindings } from './audit-label-taxonomy.js';
-import { formatEpicGrouping } from './epic-grouping-directive.js';
 import {
   renderFingerprintFooter,
   renderSemanticKeyFooter,
@@ -93,35 +92,56 @@ function formatRecommendedDirection(findings) {
   return lines.join('\n');
 }
 
-function formatMVPScope(groups) {
+/**
+ * The findings, flat (Story #5332).
+ *
+ * This section used to render one numbered bullet per `groupFindings` group
+ * under a `## Grouping` directive — a partition the seed had already decided
+ * before the planner read a word of it, and at a grain (`groupFindings`'s) the
+ * planner's cohesion judgment never got to review. The measured result was a
+ * sweep of 44 findings arriving as 18 Stories. The seed now states what was
+ * found and lets N reach the planner undecided; container grouping is Gate
+ * #3's call at persist, where N is known.
+ *
+ * @param {object[]} findings
+ * @returns {string}
+ */
+function formatFindingsList(findings) {
+  return findings
+    .map((f) => {
+      const label = DIMENSION_LABEL[f.dimension] ?? f.dimension;
+      const file = f.files?.[0] ? ` (\`${f.files[0]}\`)` : '';
+      const severity = f.severity ? `${f.severity} · ` : '';
+      return `- **${f.title}** — ${severity}${label}${file}`;
+    })
+    .join('\n');
+}
+
+/**
+ * The machine-readable dedup identity, one footer set per group.
+ *
+ * Deliberately **not** folded into one footer over the whole sweep, and
+ * deliberately not attached to a visible bullet. Each group's fingerprint and
+ * location-based semantic-key footers are the identity the next sweep matches
+ * on (Story #4626), and the `audit::*` labels are the reason it ever looks at
+ * the issue at all — an indexed sweep answers exact lookups from the labelled
+ * pool without reaching the provider, so a Story missing the labels is
+ * invisible however good its fingerprints (Story #5307). They are HTML
+ * comments, so they carry no partition to the planner's eye while staying
+ * byte-identical to what the standalone-Stories path emits.
+ *
+ * @param {object[]} groups
+ * @returns {string}
+ */
+function formatDedupFooters(groups) {
   return groups
-    .map((g, idx) => {
-      const dims = g.dimensions.join(' / ');
-      const file = g.files[0] ? ` (\`${g.files[0]}\`)` : '';
-      // Carry each group's fingerprint (and location-based semantic-key)
-      // footer into the seed so a Story authored from it via `/mandrel-plan` inherits
-      // the dedup identity — without this the recommended `/mandrel-plan --seed-file`
-      // path is invisible to the next sweep's dedup (Story #4626). The footers
-      // are HTML comments, so they never render in the visible one-pager but
-      // stay machine-readable for the dedup probe.
+    .map((g) => {
       const findings = Array.isArray(g.findings) ? g.findings : [];
-      const footers = [
+      return [
         renderFingerprintFooter(findings),
         renderSemanticKeyFooter(findings),
-        // ...and the `audit::*` labels the dedup corpus is listed by.
-        //
-        // Without them a Story the chained planning path files is absent from
-        // the pool an indexed sweep matches against, and with an index in play
-        // the exact lookup is answered from that pool without ever reaching
-        // the provider — so the fingerprint footer above cannot rescue it. The
-        // two footers are therefore a pair: one carries the identity, the
-        // other carries the reason the next sweep ever looks at this issue
-        // (Story #5307).
         auditLabelFooterForFindings(findings),
-      ]
-        .map((f) => `   ${f}`)
-        .join('\n');
-      return `${idx + 1}. **${g.title}** — ${dims}${file}\n${footers}`;
+      ].join('\n');
     })
     .join('\n');
 }
@@ -165,10 +185,10 @@ export function buildPlanSeedMarkdown({ groups, findings, sourceReports }) {
   }
   const problem = formatProblemStatement(findings);
   const direction = formatRecommendedDirection(findings);
-  const scope = formatMVPScope(groups);
+  const scope = formatFindingsList(findings);
   const files = formatKeyFiles(groups);
   const assumptions = formatKeyAssumptions(sourceReports);
-  const grouping = formatEpicGrouping(groups);
+  const dedupFooters = formatDedupFooters(groups);
 
   return [
     '# Idea Seed: Audit Remediation',
@@ -187,16 +207,14 @@ export function buildPlanSeedMarkdown({ groups, findings, sourceReports }) {
     '',
     '## MVP Scope',
     '',
-    scope || '_(no proposed stories)_',
+    scope || '_(no findings)_',
+    '',
+    dedupFooters,
     '',
     '## Key Files',
     '',
     files,
     '',
-    '## Grouping',
-    '',
-    grouping,
-    '',
     '## Not Doing',
     '',
     '- Findings with severity below the operator-selected threshold.',

package/.agents/scripts/lib/baselines/crap-preview-incremental.js

@@ -6,7 +6,7 @@
  * so the Story's opt-in wiring lands as new code, not a same-file expansion
  * of the pre-existing preview runner.
  */
-import { getChangedFiles } from '../changed-files.js';
+import { getChangedFiles, resolveChangedFilesRef } from '../changed-files.js';
 
 /**
  * Resolve the `incremental` option `scanAndScore` (`crap-utils.js`) expects,
@@ -14,6 +14,10 @@ import { getChangedFiles } from '../changed-files.js';
  * not be resolved — a resolution failure falls back to full-scope rather
  * than silently relaxing the gate.
  *
+ * The join's ref comes from `resolveChangedFilesRef` (Story #5365), the same
+ * rule capture applies: the `--changed-since` ref the preview was handed wins
+ * over a configured `baseRef`, so one hook invocation cannot resolve two.
+ *
  * Gated by `incrementalCoverage.baselineJoin` alone (Story #5173). It MUST
  * NOT consult `skipWhenUnchanged`: the join loosens what the gate demands,
  * while the skip only decides whether a capture runs, so a consumer that took
@@ -36,7 +40,7 @@ export function resolveCrapPreviewIncremental({
   getChangedFilesImpl = getChangedFiles,
 }) {
   if (crap.incrementalCoverage?.baselineJoin !== true) return null;
-  const baseRef = crap.incrementalCoverage.baseRef || diffRef || 'main';
+  const baseRef = resolveChangedFilesRef({ crap, ref: diffRef });
   try {
     const touchedFiles = new Set(getChangedFilesImpl({ ref: baseRef, cwd }));
     return { touchedFiles, baselineRows };

package/.agents/scripts/lib/baselines/kinds/_crap-read.js

@@ -22,7 +22,6 @@
 
 import path from 'node:path';
 import { readBaselineAtRef } from '../../baseline-loader.js';
-import { resolveEscomplexVersion } from '../../crap-utils.js';
 import { loadBaseline } from '../../gates/baseline-store.js';
 import {
   loadFile as loadBaselineFile,
@@ -38,11 +37,6 @@ import {
  * epic-ref callers always know their own path); without one the reader
  * resolves the configured location for the `crap` kind itself.
  *
- * `escomplexVersion` is back-filled from the running scorer exactly as the
- * deleted projection stamped it — the v2 envelope does not carry the field, and
- * `escomplex-mismatch` is a fatal axis, so omitting it would fail every
- * baseline closed on a value that was never on disk.
- *
  * Returns `null` on any read/parse/schema failure; the preview gate maps that
  * to "no baseline" and fails open, as it always did.
  *
@@ -69,7 +63,6 @@ function readCrapBaselineFromTree({ baselinePath, projectRoot } = {}) {
   }
   return {
     kernelVersion: envelope.kernelVersion,
-    escomplexVersion: resolveEscomplexVersion(),
     scoringSemantics: envelope.scoringSemantics ?? null,
     tsTranspilerVersion:
       typeof envelope.tsTranspilerVersion === 'string'
@@ -135,7 +128,6 @@ export function loadCrapBaseline({
   // No-epicRef path delegates to readFromTree which already applies the
   // shape-check + tsTranspilerVersion back-fill, so a tree read returns either
   // a valid envelope or null. Epic-ref path bypasses that helper — shape-check
-  // + back-fill happens here.
   if (!epicRef) return parsed;
   if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
     return null;

package/.agents/scripts/lib/baselines/kinds/crap.js

@@ -53,11 +53,29 @@ export { loadCrapBaseline } from './_crap-read.js';
 const __filename = fileURLToPath(import.meta.url);
 
 /**
- * Resolve the running `typhonjs-escomplex` version by walking up from this
- * module's directory and reading the nearest
- * `node_modules/typhonjs-escomplex/package.json`. Returns `'0.0.0'` when
- * the dependency cannot be found — callers treat that sentinel as
- * "unknown environment" and the writer refuses to persist a baseline.
+ * Package whose resolved version is stamped as the CRAP scorer identity.
+ *
+ * `escomplex-plugin-metrics-module` owns the Halstead and cyclomatic math. The
+ * displaced `typhonjs-escomplex` shell contributed a parser and a plugin bus
+ * and never computed a metric, so stamping it described the shell.
+ */
+const SCORER_PACKAGE = 'escomplex-plugin-metrics-module';
+
+/**
+ * Resolve the running scorer's version by walking up from this module's
+ * directory and reading the nearest `node_modules/<SCORER_PACKAGE>/package.json`.
+ *
+ * The package read is `escomplex-plugin-metrics-module`, which computes the
+ * metrics. It was `typhonjs-escomplex` until Story #5336 replaced that shell's
+ * parse and dispatch layers; reading a package that no longer exists would
+ * yield the sentinel below on every fresh install, and the writer would refuse
+ * to persist a baseline. (Locally it can look fine anyway — the walk-up escapes
+ * a worktree into the parent checkout, whose `node_modules` may still hold the
+ * removed package. CI's fresh clone has no such parent.)
+ *
+ * Returns `'0.0.0'` when the dependency cannot be found — callers treat that
+ * sentinel as "unknown environment" and the writer refuses to persist a
+ * baseline.
  *
  * @returns {string}
  */
@@ -68,7 +86,7 @@ export function kernelVersion() {
     const pkgPath = path.join(
       dir,
       'node_modules',
-      'typhonjs-escomplex',
+      SCORER_PACKAGE,
       'package.json',
     );
     if (fs.existsSync(pkgPath)) {
@@ -695,7 +713,14 @@ export function assessComparisonBasis(compareResult, opts = {}) {
  * transpiler's sourcemap. `startLine` is half the row identity key, so a
  * transpiler change makes the rows incomparable rather than merely stale; see
  * the `ts-transpiler-drift` axis below for the two exemptions that bound it.
- * `escomplexVersion` mismatch has always failed closed.
+ *
+ * There is no `escomplexVersion` axis. One existed, declared `fatal`, and
+ * could not fire in either direction: the v2 envelope does not carry the
+ * field, so the loaded-envelope pass excluded it as vacuous, and the peer pass
+ * back-filled the value from the running scorer before comparing it against
+ * the running scorer. A gate that presents as fatal and cannot fail is worse
+ * than an absent one, so it was removed rather than repaired — `scoringSemantics`
+ * is the axis that actually rejects an incompatible scorer.
  */
 /**
  * The one re-seed recipe every coordinate-invalidating axis ends on. Three
@@ -713,14 +738,6 @@ export const CRAP_COMPAT_AXES = [
   // missing-baseline and kernel-drift checks live in exactly one place;
   // each per-kind table composes them in with its own kind label.
   missingBaselineAxis('CRAP'),
-  {
-    name: 'escomplex-mismatch',
-    severity: 'fatal',
-    check: ({ baseline, runningEscomplexVersion }) =>
-      baseline && baseline.escomplexVersion !== runningEscomplexVersion
-        ? `[CRAP] scorer changed from ${baseline.escomplexVersion} to ${runningEscomplexVersion} — run 'npm run crap:update'`
-        : null,
-  },
   kernelDriftAxis('CRAP'),
   {
     name: 'scoring-semantics-drift',
@@ -874,9 +891,9 @@ export function evaluateBaselineCompatibility(ctx) {
  * predating both questions. The fourth (Story #4969) is about the `method`
  * half — a baseline still carrying ordinal-keyed anonymous rows.
  *
- * `escomplex-mismatch` and `kernel-drift` stay out — the v2 envelope carries
- * no `escomplexVersion`, so that axis would compare `undefined` to `undefined`
- * and pass vacuously, which is worse than not running it.
+ * `kernel-drift` stays out: it is a warn-level axis, and this pass turns a
+ * message into a fail-closed error. (`escomplex-mismatch` was the other
+ * exclusion until it was removed outright — see `CRAP_COMPAT_AXES`.)
  */
 const LOADED_ENVELOPE_AXES = [
   'scoring-semantics-drift',

package/.agents/scripts/lib/changed-files.js

@@ -1,5 +1,35 @@
 import { createGitInterface } from './git-utils.js';
 
+/**
+ * Resolve the ONE git ref a step of the pre-push chain computes its
+ * changed-file set against — the whole rule, stated once (Story #5365).
+ *
+ * **A ref the caller named wins; `crap.incrementalCoverage.baseRef` is the
+ * default for a caller that named none, and `main` the default for neither.**
+ * `.husky/pre-push` captures coverage at `--ref origin/main` and then previews
+ * CRAP at `--changed-since origin/main`, and the preview only reads its own
+ * tree when the artifact under it was captured over the same change set.
+ * Letting the configured value outrank the named ref meant a consumer that set
+ * `baseRef` captured one scope while the preview scored another — precisely
+ * the stale-artifact read the capture-before-preview ordering (Story #5356)
+ * closed. This repository sets no `baseRef`, so that divergence was invisible
+ * locally and only a consumer who configured one would have paid for it.
+ *
+ * Callers that name no ref — the close-validation gate, whose argv carries no
+ * `--ref` — still get the configured value, so the key keeps the meaning it
+ * was added with.
+ *
+ * Every step that derives that change set calls this: both `coverage-capture`
+ * paths and the preview's CRAP baseline join. A new consumer routes through it
+ * rather than reading `baseRef` itself.
+ *
+ * @param {{ crap: object, ref: string | null | undefined }} opts
+ * @returns {string}
+ */
+export function resolveChangedFilesRef({ crap, ref }) {
+  return ref ?? crap?.incrementalCoverage?.baseRef ?? 'main';
+}
+
 /**
  * Parse the stdout from `git diff --name-only` into a normalized file list.
  * Trims whitespace, drops blank lines, and converts backslash separators to

package/.agents/scripts/lib/config/delivery-routing.js

@@ -5,10 +5,11 @@
  * Stage 6 dropped `delivery.routing.singleDelivery` (the v1 epic
  * single-vs-fan-out kill-switch). Story #5313 dropped
  * `delivery.routing.freshCriticSampleRate` (the maker-checker sampling
- * floor): the standard profile now routes purely off the derived change
- * level — high or underivable → fresh critic, low → inline self-eval. v2 has
- * one Story delivery path; routing here is only about spawn boot context and
- * the ceremony profile.
+ * floor), and Story #5343 dropped the derived-level routing that replaced
+ * it: `minimal` and `standard` resolve the inline self-eval as the Story's
+ * verdict owner whatever the diff touches, and `strict` is the one profile
+ * that spawns a fresh-context critic. v2 has one Story delivery path;
+ * routing here is only about spawn boot context and the ceremony profile.
  *
  * `delivery.routing.roleScopedAgents` is the **kill-switch for the role-scoped
  * boot contexts** (Epic #4478, M7-B). It defaults to `true`: a converted spawn

package/.agents/scripts/lib/config/explain.js

@@ -159,11 +159,9 @@ const KEY_MEANINGS = Object.freeze({
   'delivery.routing.roleScopedAgents':
     'Whether delivery spawns boot on role-scoped .claude/agents/<role>.md contexts.',
   'delivery.routing.ceremonyProfile':
-    'Acceptance-ceremony depth: minimal (always inline), standard (derived-level routed), or strict (always fresh).',
+    'Who authors the Story acceptance verdict: minimal and standard = the inline self-eval, strict = a fresh maker-blind critic.',
   'delivery.routing.closeAndLand':
     'When true, single-story-close lands through merge in one close (opt out with --no-wait-merge).',
-  'delivery.feedbackLoop.auditResultsAutoFile':
-    'When true, auto-file non-blocking audit findings as follow-up issues.',
   'delivery.feedbackLoop.retroProposals':
     'When true, auto-file actionable retro proposals as follow-up issues.',
   'delivery.quality.formatAutofix.timeoutMs':

package/.agents/scripts/lib/config/gates/crap-incremental-coverage.schema.js

@@ -53,7 +53,7 @@ export const INCREMENTAL_COVERAGE_SCHEMA = {
       type: 'string',
       minLength: 1,
       description:
-        'Git ref the changed-file set is computed against. Omitted falls back to the gate’s own `--ref` (`main`).',
+        'Default git ref the changed-file set is computed against, for a caller that passes no `--ref`. A `--ref` the caller named wins over this value, so a caller that anchors another gate on the same ref — `.husky/pre-push`, which passes `--ref origin/main` and then previews `--changed-since origin/main` — resolves ONE scope for both steps (Story #5365). Omitted and unpassed, the gate’s own default `main` applies.',
     },
   },
   additionalProperties: false,

package/.agents/scripts/lib/config-resolver.js

@@ -62,6 +62,7 @@ export { resolveListValue } from './config/shared.js';
 export { validateOrchestrationConfig } from './config/validate-orchestration.js';
 export {
   defaultNodeModulesStrategy,
+  getWorktreeIsolation,
   WORKTREE_ISOLATION_DEFAULTS,
 } from './config/worktree-isolation.js';
 export { PROJECT_ROOT } from './project-root.js';

package/.agents/scripts/lib/config-settings-schema-delivery.js

@@ -258,12 +258,12 @@ const MERGE_WATCH_SCHEMA = {
 // context; false falls back to `subagent_type: general-purpose` (the instant
 // per-consumer revert + the escape for hosts that ignore `.claude/agents/`).
 // Story #5313 retired `delivery.routing.freshCriticSampleRate` (the
-// maker-checker sampling floor): the standard profile now routes purely off
-// the derived change level.
+// maker-checker sampling floor). Story #5343 then retired the derived-level
+// routing it left behind: the profile alone decides the verdict owner.
 const ROUTING_SCHEMA = {
   type: 'object',
   description:
-    'v2 delivery-spawn routing: role-scoped boot contexts and the ceremony profile. The v1 singleDelivery epic-route kill-switch was removed in Stage 6; the freshCriticSampleRate sampling floor was retired in Story #5313.',
+    'v2 delivery-spawn routing: role-scoped boot contexts and the ceremony profile. The v1 singleDelivery epic-route kill-switch was removed in Stage 6; the freshCriticSampleRate sampling floor was retired in Story #5313 and the derived-level ceremony routing in Story #5343.',
   properties: {
     roleScopedAgents: {
       type: 'boolean',
@@ -275,7 +275,7 @@ const ROUTING_SCHEMA = {
       type: 'string',
       enum: ['minimal', 'standard', 'strict'],
       description:
-        'Acceptance-ceremony depth. minimal = always inline critic; strict = always fresh-context critic; standard (default) = routed off the change level derived from the Story diff: high or underivable → fresh, low → inline.',
+        'Acceptance-ceremony depth — who authors the Story acceptance verdict. minimal and standard (default) = the inline self-eval, whatever the diff touches; strict = a fresh-context maker-blind critic. Review depth is a separate decision and still derives `deep` for any sensitive path (review-depth.js).',
       default: DELIVERY_ROUTING_DEFAULTS.ceremonyProfile,
     },
     closeAndLand: {
@@ -452,18 +452,31 @@ const REVIEW_SCHEMA = {
 };
 
 /**
- * `delivery.feedbackLoop` — opt-out toggles consumed by the Epic finalize
- * listener's auto-file graduators (`lib/feedback-loop/*-graduator.js`, read
- * via `graduator-core.js#makeIsAutoFileEnabled`). All default to `true`
- * (auto-file on); set any to `false` to suppress auto-filing the
- * corresponding non-blocking findings as follow-up issues.
+ * `delivery.feedbackLoop` — the **opt-in** toggle consumed by the retro
+ * auto-file graduator (`lib/feedback-loop/retro-proposals-graduator.js`, read
+ * via `graduator-core.js#makeIsAutoFileEnabled`), plus the friction window.
  *
- * `retroProposals` (Story #4418) governs the retro auto-filer: when true
- * (default) the retro's actionable routed proposals are filed as
+ * `auditResultsAutoFile` used to sit beside `retroProposals` here. Its
+ * graduator was deleted two releases ago, so by Story #5341 — which flipped
+ * its default from `true` to `false` on the measured record of what the
+ * channel produced — there was nothing left to switch either way. Story #5366
+ * removed the key: a toggle with no runtime reader reads as a live control,
+ * and a consumer that set it was configuring nothing. The
+ * `2.60.0-retire-audit-results-autofile` migration strips it from both config
+ * surfaces, because this block is closed to additional properties and a
+ * surviving key is a hard validation failure on upgrade.
+ *
+ * `retroProposals` (Story #4418) governs the retro auto-filer, and defaults to
+ * `false` for the same Story #5341 reasons: Story #5324's roll-up carried 116
+ * signals and filed nothing, and issues #4653, #4833, #4834 and #4836 are
+ * filings that were false or leaked from test fixtures. An auto-filer whose
+ * output is dominated by noise costs triage on every run and buys nothing, so
+ * a consumer that wants it now asks for it. When `true` the
+ * retro's actionable routed proposals are filed as
  * `meta::<framework-gap|consumer-improvement>` + `friction::<category>`
  * issues via the graduator pre-parsed-findings seam, and the rendered retro
  * sections list the filed issue numbers instead of paste-ready `gh` command
- * stanzas; set it to `false` to fall back to the command stanzas.
+ * stanzas; left `false` it renders the command stanzas.
  *
  * `frictionWindowDays` (Story #4850) bounds the run-scope friction recurrence
  * window by row age. The window deliberately spans every surviving signal
@@ -475,19 +488,13 @@ const REVIEW_SCHEMA = {
 const FEEDBACK_LOOP_SCHEMA = {
   type: 'object',
   description:
-    'Opt-out toggles for the close-time auto-file graduators. All default to auto-filing on.',
+    'Opt-in toggle for the close-time retro auto-file graduator, plus the friction recurrence window. Auto-filing defaults to OFF (Story #5341).',
   properties: {
-    auditResultsAutoFile: {
-      type: 'boolean',
-      description:
-        'When true (default), the close-time audit-results graduator auto-files non-blocking audit-results findings as follow-up issues routed by source classification. Set to false to suppress auto-filing; findings remain accessible in the structured comments on the Story.',
-      default: true,
-    },
     retroProposals: {
       type: 'boolean',
       description:
-        'When true (default), the retro auto-files its actionable routed proposals as meta::<framework-gap|consumer-improvement> + friction::<category> issues via the graduator pre-parsed-findings seam, and the rendered retro sections list the filed issue numbers instead of paste-ready gh command stanzas. Set to false to fall back to the command stanzas.',
-      default: true,
+        'When true, the retro auto-files its actionable routed proposals as meta::<framework-gap|consumer-improvement> + friction::<category> issues via the graduator pre-parsed-findings seam, and the rendered retro sections list the filed issue numbers instead of paste-ready gh command stanzas. Defaults to false (Story #5341), which renders the command stanzas instead.',
+      default: false,
     },
     frictionWindowDays: {
       type: 'integer',