mandrel 2.59.0 → 2.61.0

package/.agents/scripts/lib/config-resolver.js

@@ -1,25 +1,7 @@
 /**
- * Unified Configuration Resolver — facade (Epic #1720 Story #1739).
- *
- * Resolution chain: `<project-root>/.agentrc.local.json` (optional) →
- * `.agentrc.json` → built-in defaults. Object keys deep-merge; absent local
- * file is a no-op.
- * `.env` is loaded lazily once per resolved root via `loadEnv`.
- *
- * Post-reshape, `.agentrc.json` declares four top-level blocks:
- * `project`, `github`, `planning`, `delivery`. The resolver runs the
- * full-document AJV gate (`AGENTRC_SCHEMA`) on load and returns a wrapper
- * carrying each block plus a `raw`/`source` metadata pair.
- *
- * Hard cutover (Epic #2880, Story #2947): both the input-side and
- * output-side legacy shapes are gone. Legacy `agentSettings.*` /
- * `orchestration.*` input documents are rejected by the AJV schema
- * (`additionalProperties: false` at the top level), and the previously
- * synthesized `agentSettings` / `orchestration` output pointers have been
- * deleted from the resolver wrapper. Every internal call site reads the
- * canonical `project` / `github` / `planning` / `delivery` blocks
- * directly; consumers upgrade in lockstep with the framework bump
- * (see `.agents/rules/git-conventions-reference.md#contract-cutovers-—-no-shim-layer`).
+ * Configuration resolver facade: `.agentrc.local.json` deep-merges over
+ * `.agentrc.json` over built-in defaults, validated against `AGENTRC_SCHEMA`
+ * on load. `.env` loads lazily once per resolved root.
  */
 
 import fs from 'node:fs';
@@ -45,9 +27,8 @@ export {
 } from './config/limits.js';
 export { getPaths } from './config/paths.js';
 export {
-  CODING_GUARDRAILS_DEFAULTS,
+  CODING_GUARDRAILS,
   getQuality,
-  resolveCodingGuardrails,
   resolveMaintainabilityCrap,
   resolveQuality,
 } from './config/quality.js';
@@ -62,6 +43,7 @@ export { resolveListValue } from './config/shared.js';
 export { validateOrchestrationConfig } from './config/validate-orchestration.js';
 export {
   defaultNodeModulesStrategy,
+  getWorktreeIsolation,
   WORKTREE_ISOLATION_DEFAULTS,
 } from './config/worktree-isolation.js';
 export { PROJECT_ROOT } from './project-root.js';
@@ -94,10 +76,8 @@ function applyCommandsDefaults(project) {
 }
 
 /**
- * Enrich `delivery.worktreeIsolation` so an omitted field resolves to
- * WORKTREE_ISOLATION_DEFAULTS. Critical for `enabled`/`root` —
- * `Boolean(undefined) === false` previously disabled worktrees silently
- * when the operator omitted the block.
+ * Omitted `worktreeIsolation` fields resolve to defaults — otherwise an
+ * absent `enabled` reads as false and silently disables worktrees.
  */
 function applyDeliveryDefaults(rawDelivery) {
   const delivery = { ...(rawDelivery ?? {}) };
@@ -110,10 +90,6 @@ function applyDeliveryDefaults(rawDelivery) {
   return delivery;
 }
 
-/**
- * Apply framework defaults for the four top-level blocks. Pure (no
- * mutation) — returns a fresh object.
- */
 /**
  * Deep-merge plain objects for the `.agentrc.local.json` overlay. Arrays and
  * scalars from `override` replace the base value at that key.
@@ -173,9 +149,6 @@ const ZERO_CONFIG_RAW = Object.freeze({
 
 function applyDefaults(raw) {
   const project = applyCommandsDefaults({ ...(raw.project ?? {}) });
-  // Default docsContextFiles list — same five files the framework has
-  // always shipped, preserved here so zero-config callers and configs
-  // that omit the list both get the canonical mandatory-reads set.
   if (project.docsContextFiles == null) {
     project.docsContextFiles = [
       'architecture.md',
@@ -193,29 +166,15 @@ function applyDefaults(raw) {
     github: applyGithubDefaults(raw.github),
     planning: raw.planning ?? {},
     delivery: applyDeliveryDefaults(raw.delivery),
-    // `qa` is an optional top-level block (agentrc.schema.json
-    // `#/$defs/qa`). It needs no default-layering — the harness resolver
-    // (`resolveQaContract`) owns normalization and required-field
-    // enforcement — it only needs to survive the reshape so
-    // `/qa-run` Step 0 can read it off the resolved wrapper.
+    // Passed through as authored; `resolveQaContract` owns normalization.
     ...(raw.qa !== undefined ? { qa: raw.qa } : {}),
   };
 }
 
 /**
- * Load + validate `.agentrc.json` and return the resolved wrapper.
- *
- * Returned shape:
- *   {
- *     project, github, planning, delivery,  // post-reshape canonical blocks
- *     qa,                                    // optional QA-harness block (present iff authored)
- *     raw, source,
- *   }
- *
- * Error policy:
- *   - File missing (ENOENT) → fall through to built-in defaults (zero-config).
- *   - File present but malformed JSON → throw immediately.
- *   - Schema validation failure → throw with a single-line error list.
+ * Returns `{ project, github, planning, delivery, qa?, raw, source }`. A
+ * missing file falls back to defaults; malformed JSON or a schema failure
+ * throws.
  *
  * @param {{ bustCache?: boolean, cwd?: string, validate?: boolean, ctx?: object }} [opts]
  */

package/.agents/scripts/lib/config-schema-shared.js

@@ -19,10 +19,7 @@ export const SHELL_INJECTION_RE = new RegExp(SHELL_INJECTION_PATTERN_STRING);
  */
 export const SHELL_INJECTION_RE_STRICT = /[&|;`<>()$]/;
 
-// Re-export the canonical baseline schema registry (Story #1888). The
-// registry implementation lives in `baseline-schema-registry.js`; this
-// re-export keeps `config-schema-shared.js` as the canonical import surface
-// for downstream consumers and the mirror-drift test.
+// Canonical import surface for the baseline schema registry.
 export {
   BASELINE_ENVELOPE_FILE,
   BASELINE_KIND_SCHEMA_FILES,

package/.agents/scripts/lib/config-settings-schema-delivery.js

@@ -1,23 +1,13 @@
 /* node:coverage ignore file -- AJV schema declaration (data-as-code); MI < 70 is inherent to large flat schema literals, no business logic to test */
 
-// ---------------------------------------------------------------------------
-// delivery.* sub-schemas — extracted from config-settings-schema.js to keep
-// the aggregate AGENTRC_SCHEMA module under the maintainability floor. These
-// are pure declarative AJV fragments referenced by DELIVERY_SCHEMA; moving
-// them here does not change validation semantics (the resolved schema is
-// byte-for-byte equivalent in effect).
-// ---------------------------------------------------------------------------
+// delivery.* sub-schemas of AGENTRC_SCHEMA.
 
 import { ACCEPTANCE_EVAL_DEFAULTS } from './config/acceptance-eval.js';
 import { CI_DELIVERY_DEFAULTS } from './config/ci.js';
 import { DELIVERY_ROUTING_DEFAULTS } from './config/delivery-routing.js';
-import { LIMITS_DEFAULTS } from './config/limits.js';
 import { DEFAULT_CODE_REVIEW } from './config/runners.js';
 import { WORKTREE_ISOLATION_DEFAULTS } from './config/worktree-isolation.js';
 import { SHELL_INJECTION_PATTERN_STRING } from './config-schema-shared.js';
-// `delivery.quality` and `delivery.codeReview` sub-schemas live in a
-// further-split module (refs #3457) so each schema file stays above the
-// maintainability floor.
 import {
   CODE_REVIEW_SCHEMA,
   QUALITY_SCHEMA,
@@ -30,27 +20,14 @@ const SAFE_STRING = {
 
 const EXECUTION_SCHEMA = {
   type: 'object',
-  description: 'Wall-clock bounds on the subprocesses delivery spawns.',
+  description: 'Serialization of the full-suite spawns delivery drives.',
   properties: {
-    timeoutMs: {
-      type: 'integer',
-      minimum: 1,
-      description:
-        'Per-command timeout (ms) for the long-running spawns delivery drives — the close-validation chain and the gate CLIs.',
-      default: LIMITS_DEFAULTS.executionTimeoutMs,
-    },
     fullSuiteLock: {
       type: 'boolean',
       description:
         'Serialize full-suite spawns (`npm test` / `npm run test:coverage`) behind a host-level advisory lock, so two concurrent deliveries on one checkout do not run two suites against the same cores. Best-effort: a wait that expires spawns anyway, so the lock can never fail a delivery. Set false — or export `MANDREL_FULL_SUITE_LOCK=0` for one invocation — to disable.',
       default: true,
     },
-    requireCreditedCapture: {
-      type: 'boolean',
-      description:
-        'Refuse a full-suite coverage capture that no committed stamp covers, instead of paying for it. Default false — the run is announced (a warning naming the crediting invocation, emitted before the spawn) and then executed, which is the pre-existing behaviour. Set true when the whole-suite cost is large enough that a close should stop at zero seconds rather than absorb it silently.',
-      default: false,
-    },
   },
   additionalProperties: false,
 };
@@ -71,11 +48,6 @@ const DOCS_FRESHNESS_SCHEMA = {
   additionalProperties: false,
 };
 
-/**
- * `delivery.deliverRunner` — bounded-concurrency knob for the epic-deliver
- * fan-out. Flattened post-reshape — no `runners.` wrapper, no `enabled`
- * field (operators dial concurrency directly).
- */
 const DELIVER_RUNNER_SCHEMA = {
   type: 'object',
   description: 'Bounded-concurrency knob for the /mandrel-deliver fan-out.',
@@ -85,9 +57,7 @@ const DELIVER_RUNNER_SCHEMA = {
       minimum: 1,
       description:
         'Maximum ready Stories dispatched by /mandrel-deliver at once. Default 3. Moderate by design — keeps host-quota consumption predictable while allowing a small ready-set fan-out. Set 1 for strictly sequential delivery; raise further on hosts with adequate parallel-agent quota. See deliver.md for the sequencing model and throughput tradeoff.',
-      // getRunners() resolves this from its own DEFAULT_DELIVER_RUNNER
-      // constant, not from this annotation; the parity suite asserts the two
-      // agree.
+      // Runtime reads DEFAULT_DELIVER_RUNNER; a parity test keeps them equal.
       default: 3,
     },
     footprintGuard: {
@@ -101,9 +71,6 @@ const DELIVER_RUNNER_SCHEMA = {
   additionalProperties: false,
 };
 
-/**
- * `delivery.worktreeIsolation` — per-Story git worktree provisioning.
- */
 const WORKTREE_ISOLATION_SCHEMA = {
   type: 'object',
   description:
@@ -127,9 +94,7 @@ const WORKTREE_ISOLATION_SCHEMA = {
       enum: ['per-worktree', 'clone', 'symlink', 'pnpm-store'],
       description:
         'How each worktree gets its dependencies. `clone` copy-on-writes the main checkout tree (fast, cross-platform); `per-worktree` runs a full install; `symlink` links the shared tree (POSIX only unless `allowSymlinkOnWindows`); `pnpm-store` re-links from the pnpm content store.',
-      // Pinned to the cross-platform documented default. The runtime constant
-      // is evaluated at import time and resolves to `per-worktree` on win32,
-      // so it must not be imported here.
+      // Not imported: the runtime constant is `per-worktree` on win32.
       default: 'clone',
     },
     primeFromPath: {
@@ -160,7 +125,6 @@ const WORKTREE_ISOLATION_SCHEMA = {
     },
   },
   additionalProperties: false,
-  // `root` is required only when isolation is explicitly enabled.
   allOf: [
     {
       if: {
@@ -173,42 +137,10 @@ const WORKTREE_ISOLATION_SCHEMA = {
   ],
 };
 
-/**
- * `delivery.mergeWatch` — knobs consumed by the close-and-land merge wait
- * listener (Story #2896, Epic #2880) and by the close-and-land merge wait
- * (`single-story-close/phases/confirm-merge.js`). `intervalSeconds` is the
- * poll cadence between `gh pr view` probes after the arm.
- *
- * The two budgets are deliberately separate axes (Story #4543):
- *
- *   - `maxWaitSeconds` bounds **one invocation** of the merge wait. Its
- *     default (300s) fits inside a single host tool invocation, whose
- *     ceiling is ~10 minutes; the gates that run before the wait already
- *     consume minutes of that. Expiry is NOT a block — the wait returns a
- *     resumable `pending` terminal with no label mutation. A headless caller
- *     with no such ceiling raises it to keep land-in-one-block semantics.
- *   - `maxBudgetSeconds` bounds the **cumulative** wait across resumes,
- *     anchored at the PR's `createdAt` so re-entering the wait does not
- *     restart the clock. Exhausting *this* is the genuine give-up condition
- *     that classifies and blocks.
- *
- * `updateAttempts` caps how many times the wait will bring a
- * behind-the-base PR up to date before giving the branch up as unwinnable,
- * rather than waiting out the budget behind a base it could have merged.
- * All keys default in the consumer when omitted (30s / 300s / 3600s / 3).
- *
- * `mode` selects the close-time merge posture (Story #4698). Default `sync`
- * keeps the in-close foreground wait unchanged. `async` caps the per-invocation
- * wait to a short probe window (~60s: catches instant merges and instantly-red
- * required checks) and then returns the resumable `pending` terminal, so a
- * slow-CI consumer no longer burns ~5 minutes of the host tool slot on a merge
- * that lands after the wait would have expired anyway — the worker launches the
- * `pending` envelope's `nextCommand` in the background instead.
- */
 const MERGE_WATCH_SCHEMA = {
   type: 'object',
   description:
-    "Knobs consumed by the close-and-land merge wait (Story #4543; defaults in `lib/orchestration/merge-poll.js`). `mode` (Story #4698) selects the close-time merge posture. `intervalSeconds` is the poll cadence between `gh pr view` probes after the arm. `maxWaitSeconds` bounds ONE invocation of the merge wait and its expiry returns a resumable `pending` terminal with no label mutation; `maxBudgetSeconds` bounds the CUMULATIVE wait across resumes (anchored at the PR's createdAt, so a resume does not restart the clock) and exhausting it is the genuine give-up that classifies and blocks. `updateAttempts` caps the bounded update of a behind-the-base PR.",
+    "Knobs consumed by the close-and-land merge wait (Story #4543). `mode` (Story #4698) selects the close-time merge posture. `maxWaitSeconds` bounds ONE invocation of the merge wait and its expiry returns a resumable `pending` terminal with no label mutation; `maxBudgetSeconds` bounds the CUMULATIVE wait across resumes (anchored at the PR's createdAt, so a resume does not restart the clock) and exhausting it is the genuine give-up that classifies and blocks. The 30s poll cadence and the cap of 3 behind-the-base updates are fixed.",
   properties: {
     mode: {
       type: 'string',
@@ -216,12 +148,6 @@ const MERGE_WATCH_SCHEMA = {
       description:
         'Close-time merge-wait posture (Story #4698). `sync` (default) keeps the in-close foreground merge wait unchanged. `async` caps the per-invocation wait to a short ~60s probe window — long enough to catch an instant merge and, via the head-anchored required-check predicate, an instantly-red required check — then returns the resumable `pending` terminal (exit 3) with a `nextCommand`. Opt in when slow CI makes the foreground wait routinely expire: the worker launches `nextCommand` in the background instead of burning the host tool slot polling. `maxBudgetSeconds` (the cumulative give-up) is unchanged.',
     },
-    intervalSeconds: {
-      type: 'integer',
-      minimum: 1,
-      description: 'Seconds between merge-wait polls. Default 30.',
-      default: 30,
-    },
     maxWaitSeconds: {
       type: 'integer',
       minimum: 1,
@@ -235,35 +161,14 @@ const MERGE_WATCH_SCHEMA = {
         "Cumulative wall-clock budget (seconds) across merge-wait resumes, anchored at the PR's createdAt. Default 3600 (60 minutes). Exhausting this classifies the block and transitions the Story to agent::blocked.",
       default: 3600,
     },
-    updateAttempts: {
-      type: 'integer',
-      minimum: 0,
-      description:
-        'Maximum times the merge wait will bring a behind-the-base PR up to date before giving up on the branch. Default 3. Set 0 to disable the update.',
-    },
   },
   additionalProperties: false,
 };
 
-/**
- * `delivery.epicAudit` was removed on v2 (Story-only delivery — no
- * epic-audit runner). Remediation policy lives on `delivery.codeReview`
- * (`CODE_REVIEW_SCHEMA` imported from the quality schema module).
- */
-
-// Epic #4478 (M7-B) — role-scoped-agent kill-switch.
-// Stage 6 dropped `delivery.routing.singleDelivery` (v1 epic route switch).
-// `delivery.routing.roleScopedAgents` (default true via getDeliveryRouting)
-// flips converted delivery spawns onto their `.claude/agents/<role>.md` boot
-// context; false falls back to `subagent_type: general-purpose` (the instant
-// per-consumer revert + the escape for hosts that ignore `.claude/agents/`).
-// Story #5313 retired `delivery.routing.freshCriticSampleRate` (the
-// maker-checker sampling floor): the standard profile now routes purely off
-// the derived change level.
 const ROUTING_SCHEMA = {
   type: 'object',
   description:
-    'v2 delivery-spawn routing: role-scoped boot contexts and the ceremony profile. The v1 singleDelivery epic-route kill-switch was removed in Stage 6; the freshCriticSampleRate sampling floor was retired in Story #5313.',
+    'v2 delivery-spawn routing: role-scoped boot contexts and the ceremony profile. The v1 singleDelivery epic-route kill-switch was removed in Stage 6; the freshCriticSampleRate sampling floor was retired in Story #5313 and the derived-level ceremony routing in Story #5343.',
   properties: {
     roleScopedAgents: {
       type: 'boolean',
@@ -275,7 +180,7 @@ const ROUTING_SCHEMA = {
       type: 'string',
       enum: ['minimal', 'standard', 'strict'],
       description:
-        'Acceptance-ceremony depth. minimal = always inline critic; strict = always fresh-context critic; standard (default) = routed off the change level derived from the Story diff: high or underivable → fresh, low → inline.',
+        'Acceptance-ceremony depth — who authors the Story acceptance verdict. minimal and standard (default) = the inline self-eval, whatever the diff touches; strict = a fresh-context maker-blind critic. Review depth is a separate decision and still derives `deep` for any sensitive path (review-depth.js).',
       default: DELIVERY_ROUTING_DEFAULTS.ceremonyProfile,
     },
     closeAndLand: {
@@ -288,61 +193,11 @@ const ROUTING_SCHEMA = {
   additionalProperties: false,
 };
 
-// Story #4356 (Epic #4355) — CI-aware delivery namespace. `watch.*` tunes
-// the merge/CI watch poll loop; `autoMerge` selects the merge posture.
-// Retired: `earlyPr` (Epic early-PR warmup) and `requireChecks` (no
-// AutomergePredicate reader on v2).
-// Story #4890 added `attachWindowMs`: how long the watch keeps re-resolving an
-// EMPTY required-check set before it stops waiting for one. This block is
-// `additionalProperties: false`, so the knob is inert unless it lands here AND
-// in the `.agents/schemas/agentrc.schema.json` mirror.
-// The four `watch.*` defaults below mirror WATCH_DEFAULTS in
-// `pr-watch-with-update.js`. Restated rather than imported: that module is a
-// CLI, and importing it behind a schema declaration would drag its
-// `runAsCli` wiring into every config read. The rewritten parity suite
-// asserts the two agree.
-const CI_WATCH_SCHEMA = {
-  type: 'object',
-  description:
-    'Story #4356 (Epic #4355). Poll-loop tuning for the merge/CI watch. pollIntervalMs is the cadence between check probes; maxPolls caps total probes before the watcher gives up; maxResumes caps how many times the watcher may resume after a transient stall; attachWindowMs bounds the wait for a required context to attach at all.',
-  properties: {
-    pollIntervalMs: {
-      type: 'integer',
-      minimum: 1,
-      description: 'Milliseconds between check probes.',
-      default: 10000,
-    },
-    maxPolls: {
-      type: 'integer',
-      minimum: 1,
-      description:
-        'Total probes before the watcher gives up on one invocation.',
-      default: 180,
-    },
-    maxResumes: {
-      type: 'integer',
-      minimum: 0,
-      description:
-        'How many times the watcher may resume after a transient stall. 0 disables resuming.',
-      default: 3,
-    },
-    attachWindowMs: {
-      type: 'integer',
-      minimum: 1,
-      description:
-        'Story #4890. How long (ms) the watch keeps re-resolving an EMPTY `gh pr checks --required` set before it stops waiting for a required context to attach. A ruleset attaches its contexts asynchronously and the arrival latency is set by the slowest one, so a required context that is an aggregator job gated on every other tier is the last to appear — measured at 16m52s on this repository. Default 1200000 (20 minutes). Raise it for a repository whose contexts arrive later still; exhausting the window is never reported as a red check (the watch exits 2, not-yet-started).',
-      default: 1200000,
-    },
-  },
-  additionalProperties: false,
-};
-
 const CI_DELIVERY_SCHEMA = {
   type: 'object',
   description:
-    'CI-aware delivery namespace (Story #4356, Epic #4355): the merge/CI watch poll loop and the merge posture.',
+    'CI-aware delivery namespace (Story #4356, Epic #4355): the merge posture and the advisory-check policy.',
   properties: {
-    watch: CI_WATCH_SCHEMA,
     autoMerge: {
       type: 'string',
       enum: ['trust-ci', 'strict'],
@@ -374,15 +229,6 @@ const CI_DELIVERY_SCHEMA = {
   additionalProperties: false,
 };
 
-/**
- * `delivery.refactorStage` — opt-in, config-gated post-green refactor
- * checkpoint wired into story-deliver (Story #3430, Epic #3418). Strictly
- * additive and default-OFF: when `enabled` is unset or `false`, story-deliver
- * behaves exactly as before. When `true`, the worker runs an advisory
- * post-green refactor pass (the `core/code-review-and-quality` skill's
- * Post-Green Refactor Pass) after the suite is green. The stage is
- * advisory only — it never changes existing close-validation gate semantics.
- */
 const REFACTOR_STAGE_SCHEMA = {
   type: 'object',
   description:
@@ -398,21 +244,6 @@ const REFACTOR_STAGE_SCHEMA = {
   additionalProperties: false,
 };
 
-/**
- * `delivery.acceptanceEval` — bounded per-Story acceptance self-eval loop
- * (Story #3819). After the implementation commits land and before the
- * Story-implementation phase flips to `closing`, an independent
- * (fresh-context) critic pass scores the caller-injected change set against
- * each inline `acceptance[]` item, redrafts the unmet items, and
- * re-evaluates — capped at `maxRounds` redraft rounds.
- *
- * `maxRounds` is the operator-tunable redraft ceiling (default 2 via
- * `lib/config/acceptance-eval.js`). Story #5313 dropped the hard ceiling and
- * the floor-of-one clamp: `maxRounds: 0` is valid and means one pass scored
- * once with no redraft round. There is intentionally **no** `enabled` flag —
- * the scoring pass is a hard cutover, always on, per
- * `rules/git-conventions.md`.
- */
 const ACCEPTANCE_EVAL_SCHEMA = {
   type: 'object',
   description:
@@ -429,113 +260,24 @@ const ACCEPTANCE_EVAL_SCHEMA = {
   additionalProperties: false,
 };
 
-/**
- * `delivery.review` — close-scope review tuning (Story #4699). `lensDiffFloor`
- * is the changed-line floor below which the Story-scope local-lens pass skips
- * lens materialization for a diff with zero sensitive-path hits (default 40
- * via `lib/audit-suite/lens-diff-floor.js`; `0` disables the skip). The
- * maker-blind code-review pass and all hard gates are untouched by the floor.
- */
-const REVIEW_SCHEMA = {
-  type: 'object',
-  description:
-    'Close-scope review tuning (Story #4699). Governs the Story-scope local-lens pass that runs inside the close subprocess; the maker-blind code-review pass and all hard gates are unaffected.',
-  properties: {
-    lensDiffFloor: {
-      type: 'integer',
-      minimum: 0,
-      description:
-        'Changed-line floor for the close-scope lens walk (Story #4699). A diff strictly below this many changed lines (additions + deletions) with zero sensitive-path hits skips lens materialization and records the skip in the findings-yield ledger. Default 40; 0 disables the skip. Hard gates and the maker-blind code-review pass are unaffected.',
-    },
-  },
-  additionalProperties: false,
-};
-
-/**
- * `delivery.feedbackLoop` — opt-out toggles consumed by the Epic finalize
- * listener's auto-file graduators (`lib/feedback-loop/*-graduator.js`, read
- * via `graduator-core.js#makeIsAutoFileEnabled`). All default to `true`
- * (auto-file on); set any to `false` to suppress auto-filing the
- * corresponding non-blocking findings as follow-up issues.
- *
- * `retroProposals` (Story #4418) governs the retro auto-filer: when true
- * (default) the retro's actionable routed proposals are filed as
- * `meta::<framework-gap|consumer-improvement>` + `friction::<category>`
- * issues via the graduator pre-parsed-findings seam, and the rendered retro
- * sections list the filed issue numbers instead of paste-ready `gh` command
- * stanzas; set it to `false` to fall back to the command stanzas.
- *
- * `frictionWindowDays` (Story #4850) bounds the run-scope friction recurrence
- * window by row age. The window deliberately spans every surviving signal
- * stream rather than the triggering run's own Stories — that is what lets a
- * once-per-Story systemic defect reach the ≥ 2 actionable threshold — which
- * left it unbounded in time, so a defect fixed weeks ago kept re-routing. An
- * integer ≥ 1; unset means 30 days.
- */
+// `retroProposals` defaults off: the auto-filer's output was mostly noise.
 const FEEDBACK_LOOP_SCHEMA = {
   type: 'object',
   description:
-    'Opt-out toggles for the close-time auto-file graduators. All default to auto-filing on.',
+    'Opt-in toggle for the close-time retro auto-file graduator. Auto-filing defaults to OFF (Story #5341).',
   properties: {
-    auditResultsAutoFile: {
-      type: 'boolean',
-      description:
-        'When true (default), the close-time audit-results graduator auto-files non-blocking audit-results findings as follow-up issues routed by source classification. Set to false to suppress auto-filing; findings remain accessible in the structured comments on the Story.',
-      default: true,
-    },
     retroProposals: {
       type: 'boolean',
       description:
-        'When true (default), the retro auto-files its actionable routed proposals as meta::<framework-gap|consumer-improvement> + friction::<category> issues via the graduator pre-parsed-findings seam, and the rendered retro sections list the filed issue numbers instead of paste-ready gh command stanzas. Set to false to fall back to the command stanzas.',
-      default: true,
-    },
-    frictionWindowDays: {
-      type: 'integer',
-      minimum: 1,
-      description:
-        "How many days back the run-scope friction recurrence window reaches (Story #4850). The window spans every surviving per-Story signal stream rather than the triggering run's own Stories, so that a defect firing once per Story can reach the actionable threshold; this bounds it by age so a defect fixed weeks ago stops re-routing. Rows older than the bound — and rows carrying no readable timestamp — are excluded and counted on the roll-up step result. Default 30.",
-    },
-  },
-  additionalProperties: false,
-};
-
-/**
- * `delivery.auditToStories` — knobs for the `/audit-to-stories` unattended
- * (`--auto`) sweep (Story #4626). `severityFloor` is the minimum severity a
- * finding must meet to be proposed as a Story on an unattended run (default
- * `high`); `autoComment`, when true (default), lets `--auto` post a
- * "re-detected" comment on an already-open matched Issue instead of silently
- * skipping it.
- */
-const AUDIT_TO_STORIES_SCHEMA = {
-  type: 'object',
-  description:
-    'Knobs for the `/audit-to-stories` unattended (`--auto`) sweep (Story #4626).',
-  properties: {
-    severityFloor: {
-      type: 'string',
-      enum: ['critical', 'high', 'medium', 'low', 'all'],
-      description:
-        'Minimum severity a finding must meet to be proposed as a Story on an unattended `/audit-to-stories --auto` sweep (Story #4626). Default high.',
-    },
-    autoComment: {
-      type: 'boolean',
-      description:
-        'When true (default), `/audit-to-stories --auto` posts a re-detected comment on an already-open matched Issue instead of silently skipping it.',
+        'When true, the retro auto-files its actionable routed proposals as meta::<framework-gap|consumer-improvement> + friction::<category> issues via the graduator pre-parsed-findings seam, and the rendered retro sections list the filed issue numbers instead of paste-ready gh command stanzas. Defaults to false (Story #5341), which renders the command stanzas instead.',
+      default: false,
     },
   },
   additionalProperties: false,
 };
 
-/**
- * `delivery.tempRetention` — auto-purge of spent temp artifacts (Story #4794).
- *
- * `enabled` defaults to `true`: reclaiming a landed Story's gate transcripts
- * and evidence is the behaviour, and the knob exists to turn it off. `classes`
- * lets an operator keep one family while purging the rest; `staleDays` is the
- * age floor for the families no Story id can be recovered from (audit reports,
- * abandoned `plan-<slug>/` dirs).
- */
+// Families with no recoverable Story id (audits, plan dirs) use a fixed
+// 7-day age floor.
 const TEMP_RETENTION_SCHEMA = {
   type: 'object',
   description:
@@ -552,16 +294,6 @@ const TEMP_RETENTION_SCHEMA = {
         'turns it off. When false every purge path is a reported no-op.',
       default: true,
     },
-    staleDays: {
-      type: 'integer',
-      minimum: 1,
-      description:
-        'Age floor (days, default 7) for the families no Story id can be ' +
-        'recovered from — roster-level audit reports and abandoned ' +
-        'plan-<slug>/ dirs. Story-keyed artifacts do not wait for it: they are ' +
-        'purged as soon as their merge is confirmed.',
-      default: 7,
-    },
     classes: {
       type: 'object',
       description:
@@ -604,27 +336,20 @@ const TEMP_RETENTION_SCHEMA = {
 export const DELIVERY_SCHEMA = {
   type: 'object',
   description:
-    'Everything `/mandrel-deliver` and `single-story-close` consume: execution timeouts, worktree isolation, runner concurrency, docs freshness, quality gates, merge/CI watch, review ceremony, and the feedback loop.',
+    'Everything `/mandrel-deliver` and `single-story-close` consume: worktree isolation, runner concurrency, docs freshness, quality gates, merge/CI watch, review ceremony, and the feedback loop.',
   properties: {
     execution: EXECUTION_SCHEMA,
     docsFreshness: DOCS_FRESHNESS_SCHEMA,
     tempRetention: TEMP_RETENTION_SCHEMA,
     deliverRunner: DELIVER_RUNNER_SCHEMA,
     worktreeIsolation: WORKTREE_ISOLATION_SCHEMA,
-    // `quality.gates.crap.incrementalCoverage` (Story #4981) is declared in
-    // `config/gates/crap.schema.js` and reaches AJV validation through this
-    // property — QUALITY_SCHEMA → GATES_SCHEMA → CRAP_GATE. No separate
-    // declaration lives here; this is the composition point that makes the
-    // gate-level schema authoritative for the top-level `.agentrc.json`
-    // surface this module validates.
+    // Gate-level schemas (`config/gates/*.schema.js`) compose in here.
     quality: QUALITY_SCHEMA,
     mergeWatch: MERGE_WATCH_SCHEMA,
     codeReview: CODE_REVIEW_SCHEMA,
-    review: REVIEW_SCHEMA,
     refactorStage: REFACTOR_STAGE_SCHEMA,
     acceptanceEval: ACCEPTANCE_EVAL_SCHEMA,
     feedbackLoop: FEEDBACK_LOOP_SCHEMA,
-    auditToStories: AUDIT_TO_STORIES_SCHEMA,
     ci: CI_DELIVERY_SCHEMA,
     routing: ROUTING_SCHEMA,
   },