mandrel 2.59.0 → 2.60.0

package/lib/cli/update.js

@@ -16,7 +16,9 @@
  *      materialized `.agents/` state (Story #4065). When already on newest AND
  *      no drift: nothing to do (true no-op). When already on newest BUT drift
  *      detected: skip npm-update/migrations, run sync + sync-commands to heal.
- *   3. install        — bump the dependency (lockfile bump left STAGED).
+ *   3. install        — bump the dependency (manifest + lockfile rewritten on
+ *      disk; whether the package manager also stages them is reported, never
+ *      assumed — see § No git mutation).
  *      The package manager is auto-detected from the lockfile in the project
  *      root: `pnpm-lock.yaml` ⇒ `pnpm add -D …` (with `-w` at a
  *      `pnpm-workspace.yaml` root), `yarn.lock` ⇒ `yarn add -D …`, otherwise
@@ -56,10 +58,29 @@
  *
  * ## No git mutation
  *
- * The npm dependency bump rewrites `package.json` / `package-lock.json` in the
- * working tree but the orchestrator performs **no** `git add` / `git commit`:
- * the lockfile bump is left staged-on-disk for the operator to review and
- * commit. This module never shells out to git.
+ * The dependency bump rewrites `package.json` / the lockfile in the working
+ * tree but the orchestrator performs **no** `git add` / `git commit`. This
+ * module **reads git state to report it; never mutates it** (Story #5339).
+ *
+ * The final success line used to assert "the lockfile bump is staged for
+ * review" unconditionally. That is only ever true where `npm install` happens
+ * to stage; the `pnpm add` / `yarn add` seams stage nothing, so on a pnpm
+ * consumer the operator was told to review an empty index while the manifest,
+ * the lockfile and every re-materialized `.agents/` path sat unstaged — an
+ * invitation to commit a half-upgrade. The orchestrator now probes the real
+ * index through the injectable `gitStatus` seam — two read-only calls, a
+ * pathspec-anchored `git status --porcelain` plus `git ls-files .agents` — and
+ * prints one of three truthful lines: staged, not staged (with the exact
+ * `git add` command), or a neutral "review the working tree" line when git is
+ * unavailable or the probe fails. A failed probe never fails the update: the
+ * run still exits 0.
+ *
+ * **Staged means both halves** (Story #5364): the index differs from HEAD
+ * *and* the worktree agrees with the index. Reading only the index reported a
+ * manifest pair the operator staged *before* running the command as staged
+ * afterwards, even though the install had since rewritten both files on disk —
+ * the exact false claim this report exists to remove. The drift-heal path
+ * reports the re-materialized payload the same way.
  *
  * ## `--dry-run`
  *
@@ -99,6 +120,16 @@
  *                             sole post-install execution path. See § Re-exec of
  *                             post-install phases.
  *   - `surfaceChangelog`    — emits the target changelog section
+ *   - `gitStatus`           — read-only git probe backing the staging report;
+ *                             receives `({ cwd, lockfile })` and returns
+ *                             `{ ok, stagedManifest, stagedLockfile,
+ *                             stagedPayload, tracksAgents }` (Story #5339,
+ *                             #5364). Never mutates the repository.
+ *   - `detectLockfile`      — resolves the lockfile name the staging report
+ *                             names — and the probe's pathspec uses — from the
+ *                             uncoerced package-manager probe, so a bun
+ *                             consumer is named its real lockfile; receives
+ *                             `(cwd)`
  *   - `write` / `writeErr`  — stdout / stderr sinks
  *   - `exit`                — process.exit replacement
  *   - `cwd`                 — process.cwd() replacement (used to resolve the
@@ -374,6 +405,26 @@ function repairInstallCommand(packageManager) {
  * @returns {{ packageManager: 'pnpm' | 'yarn' | 'npm', workspaceRoot: boolean }}
  */
 export function detectPackageManager(cwd = process.cwd(), fs = nodeFs) {
+  const result = probePackageManager(cwd, fs);
+  // Coerce `bun` → `npm` because this orchestrator's install-command builder
+  // only handles pnpm / yarn / npm today.
+  const packageManager =
+    result.packageManager === 'bun' ? 'npm' : result.packageManager;
+  return { packageManager, workspaceRoot: result.workspaceRoot };
+}
+
+/**
+ * The raw, **uncoerced** package-manager probe. `detectPackageManager` above
+ * flattens `bun` to `npm` for the install-command builder's benefit; the
+ * staging report must not inherit that flattening, or a bun consumer is told
+ * to stage a `package-lock.json` its tree does not have (Story #5364). Reading
+ * the probe before the coercion is the whole fix.
+ *
+ * @param {string} cwd - Project root to probe.
+ * @param {typeof nodeFs} [fs]
+ * @returns {{ packageManager: 'pnpm'|'yarn'|'bun'|'npm', workspaceRoot: boolean }}
+ */
+function probePackageManager(cwd, fs = nodeFs) {
   const exists = (p) => {
     try {
       return fs.existsSync(p);
@@ -381,12 +432,7 @@ export function detectPackageManager(cwd = process.cwd(), fs = nodeFs) {
       return false;
     }
   };
-  const result = detectPackageManagerWithWorkspace(cwd, exists);
-  // Coerce `bun` → `npm` because this orchestrator's install-command builder
-  // only handles pnpm / yarn / npm today.
-  const packageManager =
-    result.packageManager === 'bun' ? 'npm' : result.packageManager;
-  return { packageManager, workspaceRoot: result.workspaceRoot };
+  return detectPackageManagerWithWorkspace(cwd, exists);
 }
 
 /**
@@ -434,10 +480,292 @@ export function resolveInstallCmd(
   return `npm install ${PACKAGE_NAME}@${target}`;
 }
 
+/**
+ * The lockfile each supported package manager writes. The staging report names
+ * the detected one so the `git add` hint is copy-pasteable in the consumer's
+ * real tree rather than always saying `package-lock.json` (Story #5339).
+ */
+const LOCKFILE_BY_PACKAGE_MANAGER = {
+  pnpm: 'pnpm-lock.yaml',
+  yarn: 'yarn.lock',
+  bun: 'bun.lockb',
+  npm: 'package-lock.json',
+};
+
+/** The manifest the dependency bump rewrites alongside the lockfile. */
+const MANIFEST_FILENAME = 'package.json';
+
+/** The materialized payload directory the sync phase rewrites. */
+const AGENTS_DIR = '.agents';
+
+/**
+ * Default `detectLockfile` seam: resolve the lockfile name for the staging
+ * report from the **uncoerced** package-manager probe (`pnpm-lock.yaml` /
+ * `yarn.lock` / `bun.lockb` / `package-lock.json`). Reading
+ * `probePackageManager` rather than `detectPackageManager` is deliberate: the
+ * latter flattens `bun` to `npm` so the install-command builder has a command
+ * to emit, and inheriting that here would name a lockfile the consumer's tree
+ * does not carry (Story #5364). A directory with no recognizable toolchain
+ * still resolves to `npm`, so the report always names a concrete file.
+ *
+ * @param {string} cwd - Consumer project root.
+ * @param {typeof nodeFs} [fs]
+ * @returns {string}
+ */
+export function defaultDetectLockfile(cwd, fs = nodeFs) {
+  const { packageManager } = probePackageManager(cwd, fs);
+  return LOCKFILE_BY_PACKAGE_MANAGER[packageManager] ?? 'package-lock.json';
+}
+
+/** The line printed when the probe cannot report the index at all. */
+const NEUTRAL_STAGING_LINE =
+  'Review the working tree and commit the bump (git not available to report staging state).';
+
+/** What the probe reports when it cannot read the index at all. */
+const DEGRADED_GIT_STATE = Object.freeze({
+  ok: false,
+  stagedManifest: false,
+  stagedLockfile: false,
+  stagedPayload: false,
+  tracksAgents: false,
+});
+
+/** True when a `spawnSync` result is a clean, non-throwing exit. */
+const spawnOk = (result) =>
+  Boolean(result) && !result.error && result.status === 0;
+
+/**
+ * The path one `git status --porcelain` v1 record reports as **staged**, or
+ * `null` when that record is not staged (or carries no path).
+ *
+ * Staged means both halves of the contract (Story #5364): the index differs
+ * from HEAD *and* the worktree agrees with the index. Porcelain v1 states that
+ * as `XY<space>path` — `X` the index column, `Y` the worktree column — so a
+ * path the operator staged before the install and the install then rewrote on
+ * disk reports `MM` and is correctly NOT staged. `?` in the index column is an
+ * untracked file, which is never staged.
+ *
+ * A rename carries `orig -> new`; the post-rename path is the one the operator
+ * stages. Porcelain quotes paths containing unusual bytes, so the quoting is
+ * stripped.
+ *
+ * @param {string} record
+ * @returns {string | null}
+ */
+function stagedPathFromPorcelain(record) {
+  if (record.length < 4 || record[1] !== ' ') return null;
+  if (record[0] === ' ' || record[0] === '?') return null;
+  const raw = record.slice(3).trim();
+  const arrow = raw.lastIndexOf(' -> ');
+  const pathPart = arrow === -1 ? raw : raw.slice(arrow + 4);
+  const path =
+    pathPart.startsWith('"') && pathPart.endsWith('"')
+      ? pathPart.slice(1, -1)
+      : pathPart;
+  return path.length > 0 ? path : null;
+}
+
+/**
+ * Which slot of the probe state one staged path fills, or `null` for a path
+ * that fills none.
+ *
+ * The payload test is anchored on a path separator, so a sibling like
+ * `my.agents/` never matches, and it runs first: a `package.json` *inside*
+ * `.agents/` is payload, never the consumer's root manifest. The manifest and
+ * lockfile tests tolerate one leading prefix because git reports porcelain
+ * paths relative to the repository root, which need not be the probe root —
+ * safe only because the caller's pathspec already anchored the query there, so
+ * a staged `packages/app/package.json` never reaches this function at all
+ * (Story #5364).
+ *
+ * @param {string} path
+ * @param {string} lockfile
+ * @returns {'stagedPayload' | 'stagedManifest' | 'stagedLockfile' | null}
+ */
+function stagedSlotFor(path, lockfile) {
+  if (path === AGENTS_DIR || /(^|\/)\.agents\//.test(path))
+    return 'stagedPayload';
+  const isRootFile = (name) => path === name || path.endsWith(`/${name}`);
+  if (isRootFile(MANIFEST_FILENAME)) return 'stagedManifest';
+  return isRootFile(lockfile) ? 'stagedLockfile' : null;
+}
+
+/**
+ * Default `gitStatus` seam: probe the consumer repository's real index state.
+ *
+ * **Two** read-only plumbing calls, no mutation of any kind (§ No git
+ * mutation):
+ *   - `git status --porcelain -- package.json <lockfile> .agents` — one read
+ *     that answers every branch the report chooses between. The pathspecs are
+ *     resolved relative to `cwd`, which anchors the query at the probe root:
+ *     a nested workspace manifest is simply not in the output. Both status
+ *     columns come back, so "staged" can mean index-differs-**and**-worktree-
+ *     clean rather than the index alone.
+ *   - `git ls-files .agents` — whether the consumer *tracks* the materialized
+ *     payload, which decides whether the `git add` hint names it.
+ *
+ * Any failure — git absent, not a repository, a non-zero exit, a throw from the
+ * spawn boundary — degrades to `{ ok: false }` so the caller prints the neutral
+ * line and the update still exits 0. The probe never throws.
+ *
+ * Security (security-baseline § Output & Rendering): every argv segment here is
+ * a fixed vector or a lockfile name drawn from `LOCKFILE_BY_PACKAGE_MANAGER`,
+ * never operator input, and no shell is used.
+ *
+ * @param {{
+ *   cwd?: string,
+ *   lockfile?: string,
+ *   spawnSync?: typeof spawnSync,
+ * }} [opts]
+ * @returns {{
+ *   ok: boolean,
+ *   stagedManifest: boolean,
+ *   stagedLockfile: boolean,
+ *   stagedPayload: boolean,
+ *   tracksAgents: boolean,
+ * }}
+ */
+export function defaultGitStatus({
+  cwd = process.cwd(),
+  lockfile = LOCKFILE_BY_PACKAGE_MANAGER.npm,
+  spawnSync: spawn = spawnSync,
+} = {}) {
+  const run = (args) => spawn('git', args, { cwd, encoding: 'utf8' });
+  try {
+    const status = run([
+      'status',
+      '--porcelain',
+      '--',
+      MANIFEST_FILENAME,
+      lockfile,
+      AGENTS_DIR,
+    ]);
+    if (!spawnOk(status)) return DEGRADED_GIT_STATE;
+    const agents = run(['ls-files', AGENTS_DIR]);
+    const state = {
+      ...DEGRADED_GIT_STATE,
+      ok: true,
+      tracksAgents: spawnOk(agents) && String(agents.stdout).trim().length > 0,
+    };
+    for (const record of String(status.stdout).split('\n')) {
+      const path = stagedPathFromPorcelain(record);
+      const slot = path && stagedSlotFor(path, lockfile);
+      if (slot) state[slot] = true;
+    }
+    return state;
+  } catch {
+    return DEGRADED_GIT_STATE;
+  }
+}
+
+/**
+ * Render the one truthful staging line a successful run closes with
+ * (Story #5339, corrected by Story #5364).
+ *
+ * `scope: 'bump'` (the full upgrade) reports the manifest + lockfile pair:
+ *
+ *   - **staged** — both are staged, so "staged for review" is a fact.
+ *   - **not staged** — anything else: the line says so and prints the exact
+ *     `git add` command, naming `.agents/` too when the consumer tracks that
+ *     tree (the sync re-materialized it, and an operator who stages only the
+ *     manifest pair silently drops that diff).
+ *
+ * `scope: 'payload'` (the drift heal, which bumps no dependency) reports the
+ * re-materialized `.agents/` tree instead, and returns `''` when the consumer
+ * does not track it — there is then nothing to stage and nothing to say.
+ *
+ * Either scope degrades to a line that claims nothing about the index when the
+ * probe could not report.
+ *
+ * Pure: takes the probe result and the resolved lockfile name, touches no fs.
+ *
+ * @param {{
+ *   ok?: boolean,
+ *   stagedManifest?: boolean,
+ *   stagedLockfile?: boolean,
+ *   stagedPayload?: boolean,
+ *   tracksAgents?: boolean,
+ * }} gitState - The `gitStatus` seam's return value.
+ * @param {string} lockfile - The detected lockfile name.
+ * @param {{ scope?: 'bump' | 'payload' }} [opts]
+ * @returns {string} A single sentence-run with no trailing newline, or `''`
+ *   when there is nothing to report.
+ */
+export function formatStagingReport(
+  gitState,
+  lockfile,
+  { scope = 'bump' } = {},
+) {
+  const {
+    ok = false,
+    stagedManifest = false,
+    stagedLockfile = false,
+    stagedPayload = false,
+    tracksAgents = false,
+  } = gitState ?? {};
+
+  if (!ok) return NEUTRAL_STAGING_LINE;
+
+  if (scope === 'payload') {
+    if (!tracksAgents) return '';
+    return stagedPayload
+      ? `The re-materialized ${AGENTS_DIR}/ payload is staged for review.`
+      : `The re-materialized ${AGENTS_DIR}/ payload is NOT staged. Review and stage it: git add ${AGENTS_DIR}/`;
+  }
+
+  if (stagedManifest && stagedLockfile) {
+    return `The dependency bump is staged for review (${MANIFEST_FILENAME}, ${lockfile}).`;
+  }
+
+  const targets = [MANIFEST_FILENAME, lockfile];
+  let note = '';
+  if (tracksAgents) {
+    targets.push(`${AGENTS_DIR}/`);
+    note = ` ${AGENTS_DIR}/ is tracked here, so stage the re-materialized payload too.`;
+  }
+  return `The dependency bump is NOT staged.${note} Review and stage it: git add ${targets.join(' ')}`;
+}
+
+/**
+ * Resolve the staging line for a success surface, absorbing any failure in
+ * either seam. Reporting the index is a courtesy on top of completed work: a
+ * probe that throws (git missing, a seam raising) must degrade to the neutral
+ * line, never turn a successful run into a crash.
+ *
+ * The lockfile is resolved first because the probe's pathspec names it — that
+ * is what anchors the query at the probe root.
+ *
+ * @param {{
+ *   gitStatus: (opts: { cwd: string, lockfile: string }) => object,
+ *   detectLockfile: (cwd: string) => string,
+ *   projectRoot: string,
+ *   scope?: 'bump' | 'payload',
+ * }} deps
+ * @returns {string}
+ */
+function resolveStagingReport({
+  gitStatus,
+  detectLockfile,
+  projectRoot,
+  scope = 'bump',
+}) {
+  try {
+    const lockfile = detectLockfile(projectRoot);
+    return formatStagingReport(
+      gitStatus({ cwd: projectRoot, lockfile }),
+      lockfile,
+      { scope },
+    );
+  } catch {
+    return NEUTRAL_STAGING_LINE;
+  }
+}
+
 /**
  * Default `npmUpdate` seam: install the resolved target version. The install
- * rewrites `package.json` / the lockfile on disk (left staged for the
- * operator); this performs no git mutation.
+ * rewrites `package.json` / the lockfile on disk for the operator to review;
+ * this performs no git mutation. Whether the package manager also staged them
+ * is reported by the staging probe, never assumed (Story #5339).
  *
  * The package manager is auto-detected from `cwd`'s lockfile (Story #3575) so
  * the bump lands in the operator's real lockfile rather than running
@@ -1119,6 +1447,8 @@ async function executePlan({
  *   checkDrift?: () => (boolean | Promise<boolean>),
  *   spawnPhase?: (phase: string, args: string[], opts: { binPath: string, cwd: string, write: (s: string) => void, writeErr: (s: string) => void }) => Promise<{ ok: boolean, stdout: string, stderr: string }> | { ok: boolean, stdout: string, stderr: string },
  *   surfaceChangelog?: (version: string) => unknown | Promise<unknown>,
+ *   gitStatus?: (opts: { cwd: string }) => { ok: boolean, staged?: string[], unstaged?: string[], tracksAgents?: boolean },
+ *   detectLockfile?: (cwd: string) => string,
  *   write?: (s: string) => void,
  *   writeErr?: (s: string) => void,
  *   exit?: (code: number) => void,
@@ -1142,6 +1472,8 @@ export async function runUpdate({
   checkDrift,
   spawnPhase,
   surfaceChangelog,
+  gitStatus = defaultGitStatus,
+  detectLockfile = defaultDetectLockfile,
   write = (s) => process.stdout.write(s),
   writeErr = (s) => process.stderr.write(s),
   exit = (code) => process.exit(code),
@@ -1245,8 +1577,19 @@ export async function runUpdate({
   });
 
   if (plan.action === 'resynced') {
+    // The heal re-materializes `.agents/` and stops — no dependency is bumped,
+    // so the payload IS the diff. A consumer that tracks that tree used to be
+    // told nothing at all about it (Story #5364), the same silent-diff hazard
+    // the staging report exists to close, one branch earlier.
+    const payloadLine = resolveStagingReport({
+      gitStatus,
+      detectLockfile,
+      projectRoot,
+      scope: 'payload',
+    });
     write(
-      `✅  Healed .agents/ drift (v${current}). The materialized payload is now current.\n`,
+      `✅  Healed .agents/ drift (v${current}). The materialized payload is now current.` +
+        `${payloadLine ? ` ${payloadLine}` : ''}\n`,
     );
     return {
       ok: true,
@@ -1270,7 +1613,12 @@ export async function runUpdate({
     };
   }
 
-  write(`✅  Updated to v${target}. The lockfile bump is staged for review.\n`);
+  // Report the real index state rather than asserting one (Story #5339). Both
+  // seams are read-only and failure-tolerant: a probe that cannot answer yields
+  // the neutral line, and the update still reports success with a zero exit.
+  write(
+    `✅  Updated to v${target}. ${resolveStagingReport({ gitStatus, detectLockfile, projectRoot })}\n`,
+  );
   return {
     ok: true,
     action: 'updated',
@@ -1292,8 +1640,8 @@ export async function runUpdate({
  *     a current baseline after the upgrade.
  *   - `npmUpdate` runs the install command — auto-detected from the project
  *     lockfile (`pnpm`/`yarn`/`npm`), or the `--install-cmd` override —
- *     through the shared `runInstallCommand` helper — no git mutation;
- *     lockfile left staged.
+ *     through the shared `runInstallCommand` helper — no git mutation; the
+ *     resulting index state is reported by the staging probe, not asserted.
  *   - `spawnPhase` is wired to `defaultSpawnPhase`, which spawns each
  *     post-install phase (sync, sync-commands, migrate, doctor) as
  *     `node <packageRoot>/bin/mandrel.js …` (Story #4613 — the resolved bin
@@ -1336,6 +1684,8 @@ export async function runUpdate({
  *   cwd?: () => string,
  *   resolveBinScript?: (projectRoot: string) => string,
  *   checkDrift?: () => (boolean | Promise<boolean>),
+ *   gitStatus?: (opts: { cwd: string }) => object,
+ *   detectLockfile?: (cwd: string) => string,
  *   write?: (s: string) => void,
  *   writeErr?: (s: string) => void,
  *   exit?: (code: number) => void,
@@ -1361,6 +1711,8 @@ export default async function run(argv = [], deps = {}) {
     cwd,
     resolveBinScript,
     checkDrift,
+    gitStatus,
+    detectLockfile,
   } = deps;
 
   const cwdFn = typeof cwd === 'function' ? cwd : () => process.cwd();
@@ -1405,6 +1757,13 @@ export default async function run(argv = [], deps = {}) {
         fs,
       }),
     ...(checkDrift ? { checkDrift } : {}),
+    // Story #5339 — the staging probe. Production leaves both undefined so
+    // runUpdate applies the real read-only git seam and the lockfile detection
+    // that mirrors the install seam's; tests stub them for a fake tree.
+    ...(gitStatus ? { gitStatus } : {}),
+    ...(detectLockfile
+      ? { detectLockfile }
+      : { detectLockfile: (dir) => defaultDetectLockfile(dir, fs) }),
     spawnPhase: productionSpawnPhase,
     surfaceChangelog: (target) =>
       defaultSurfaceChangelog(target, {

package/lib/migrations/index.js

@@ -61,6 +61,7 @@ import { retireCodebaseSnapshot } from './steps/2.20.0-retire-codebase-snapshot.
 import { retireLintBaselineCommand } from './steps/2.32.0-retire-lint-baseline-command.js';
 import { retireDeliveryLimitKnobs } from './steps/2.57.0-retire-delivery-limit-knobs.js';
 import { retirePlanningLimitKnobs } from './steps/2.57.0-retire-planning-limit-knobs.js';
+import { retireAuditResultsAutoFile } from './steps/2.60.0-retire-audit-results-autofile.js';
 
 /**
  * Ordered registry of migration steps. MUST stay sorted ascending by
@@ -82,6 +83,7 @@ export const migrations = [
   retireLintBaselineCommand,
   retirePlanningLimitKnobs,
   retireDeliveryLimitKnobs,
+  retireAuditResultsAutoFile,
 ];
 
 /**

package/lib/migrations/steps/2.60.0-retire-audit-results-autofile.js

@@ -0,0 +1,40 @@
+// lib/migrations/steps/2.60.0-retire-audit-results-autofile.js
+/**
+ * Story #5366 — strip the retired `delivery.feedbackLoop.auditResultsAutoFile`
+ * key from a consumer's config.
+ *
+ * The audit-results graduator this toggle switched was deleted two releases
+ * ago, so the key had no runtime reader left: Story #5341's flip of its
+ * default from `true` to `false` changed nothing at all, because nothing read
+ * either value. A toggle with no reader is worse than no toggle — it reads as
+ * a live control, and a consumer that set it was configuring nothing.
+ *
+ * `delivery.feedbackLoop` carries `additionalProperties: false`, so a config
+ * that still sets the key fails AJV validation outright on upgrade rather than
+ * warning. That is what makes this a migration rather than a docs change.
+ *
+ * Both config surfaces are swept: `config-resolver.js` deep-merges
+ * `.agentrc.local.json` over `.agentrc.json` **before** the AJV gate runs, so
+ * a key surviving in the gitignored overlay fails exactly as a base one would.
+ *
+ * Pruning: `pruneDepth: 2` prunes an emptied `feedbackLoop` and then an
+ * emptied `delivery`, both of which are optional. The sibling `retroProposals`
+ * toggle is deliberately untouched — it has a live reader — so a consumer who
+ * set both keeps its block.
+ */
+
+import { createRetireAgentrcKeyStep } from '../helpers/retire-agentrc-key.js';
+
+export const retireAuditResultsAutoFile = createRetireAgentrcKeyStep({
+  version: '2.60.0',
+  description:
+    'strip the retired delivery.feedbackLoop.auditResultsAutoFile key from ' +
+    '.agentrc.json — its graduator was deleted, so the toggle had no ' +
+    'runtime reader (Story #5366)',
+  keys: [
+    {
+      path: ['delivery', 'feedbackLoop', 'auditResultsAutoFile'],
+      pruneDepth: 2,
+    },
+  ],
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mandrel",
-  "version": "2.59.0",
+  "version": "2.60.0",
   "description": "Claude Code-first opinionated workflow framework: instructions, skills, rules, and SDLC workflows that govern AI coding assistants.",
   "files": [
     ".agents/",
@@ -45,6 +45,7 @@
     "maintainability:update": "node .agents/scripts/update-maintainability-baseline.js",
     "maintainability:reanchor": "node .agents/scripts/update-maintainability-baseline.js --full-scope",
     "check:arch": "node .agents/scripts/check-arch-cycles.js",
+    "//resident-context-reports": "check:context-budget and check:workflow-citations are REPORTS, not ratchets (Story #5340, ADR 20260917-5340). check:context-budget still fails when the alwaysLoaded tier exceeds its recorded total plus the committed tolerance; its workflow tier, and check:workflow-citations in full, print and always exit 0. A green run is not evidence the numbers held — read the output.",
     "check:context-budget": "node .agents/scripts/check-context-budget.js",
     "check:cyclomatic": "node .agents/scripts/check-cyclomatic.js",
     "cyclomatic:update": "node .agents/scripts/check-cyclomatic.js --update",

package/.agents/schemas/model-attribution.schema.json

@@ -1,53 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "$id": "https://github.com/dsj1984/mandrel/blob/main/.agents/schemas/model-attribution.schema.json",
-  "title": "ModelAttribution",
-  "description": "Payload of the <!-- structured:model-attribution --> comment upserted onto a Task ticket at the moment it transitions to agent::executing (Story #2813). One entry per Task. Story- and Epic-level breakdowns are derived at query time from the child Tasks' attribution comments — there is no Story/Epic-scope emission.",
-  "x-mandrel-uncompiled": {
-    "reason": "Deliberate: this document is the SSOT for the shape, but no AJV instance compiles it. The framework does not pull AJV into the structured-comment path — that path uses hand-rolled shape guards — so the runtime gate below mirrors this document by hand. Keep the two in step: an edit here is only real once the validator enforces it. Declared in-file per Story #4938 so a reader is never left inferring authority from the file's mere existence.",
-    "runtimeGate": ".agents/scripts/lib/orchestration/model-attribution.js#validateModelAttributionPayload"
-  },
-  "type": "object",
-  "additionalProperties": false,
-  "required": ["kind", "ticketId", "model", "source", "recordedAt"],
-  "properties": {
-    "kind": { "type": "string", "const": "model-attribution" },
-    "ticketId": {
-      "type": "integer",
-      "minimum": 1,
-      "description": "GitHub Issue number of the Task this attribution is recorded on."
-    },
-    "model": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["id"],
-      "properties": {
-        "id": {
-          "type": "string",
-          "minLength": 1,
-          "description": "Canonical model identifier (e.g. 'claude-opus-4-7', 'claude-sonnet-4-6'), or the sentinel 'unknown' when neither SDK metadata nor a runtime env var supplied an identity."
-        },
-        "family": {
-          "type": "string",
-          "minLength": 1,
-          "description": "Coarse model family label for rollup grouping (e.g. 'Opus', 'Sonnet', 'Haiku'). Optional; derived from the id when present."
-        }
-      }
-    },
-    "source": {
-      "type": "string",
-      "enum": ["sdk-metadata", "env", "unknown"],
-      "description": "Provenance of the model identification, in fallback order: 'sdk-metadata' (resolved from the SDK response), 'env' (resolved from a runtime env var), 'unknown' (neither was available)."
-    },
-    "recordedAt": {
-      "type": "string",
-      "format": "date-time",
-      "description": "ISO-8601 timestamp at which the attribution was recorded."
-    },
-    "sdkMetadata": {
-      "type": "object",
-      "description": "Opaque pass-through fields lifted from the SDK response metadata when available (e.g. response id, usage hints). Never required; never relied upon by the rollup helper.",
-      "additionalProperties": true
-    }
-  }
-}