mandrel 2.6.0 → 2.8.0

package/docs/CHANGELOG.md

@@ -2,6 +2,24 @@
 
 All notable changes to this project will be documented in this file.
 
+## [2.8.0](https://github.com/dsj1984/mandrel/compare/mandrel-v2.7.0...mandrel-v2.8.0) (2026-07-21)
+
+
+### Changed
+
+* **audit:** extract a shared audit-lens-core and dispatch lenses through a role-scoped auditor ([#4665](https://github.com/dsj1984/mandrel/issues/4665)) ([#4674](https://github.com/dsj1984/mandrel/issues/4674)) ([c7b0e13](https://github.com/dsj1984/mandrel/commit/c7b0e138465bd14eef08470cc756c7ea3c35e78d))
+* **qa:** extract shared qa-core helper and cut the stale draft-bundle path (refs [#4666](https://github.com/dsj1984/mandrel/issues/4666)) ([#4669](https://github.com/dsj1984/mandrel/issues/4669)) ([dca7412](https://github.com/dsj1984/mandrel/commit/dca74128b419cd96deaaa4b214223d82f5a16415))
+* **skills:** enforce capsule-first discipline and fix git-skill rule conflicts (refs [#4667](https://github.com/dsj1984/mandrel/issues/4667)) ([#4673](https://github.com/dsj1984/mandrel/issues/4673)) ([4a3a142](https://github.com/dsj1984/mandrel/commit/4a3a1428873f0d3f0fc084dc77b7d591576f0eee))
+* **workflows:** wire role-scoped story-worker dispatch and slim the delivery workflow cluster (refs [#4663](https://github.com/dsj1984/mandrel/issues/4663)) ([#4670](https://github.com/dsj1984/mandrel/issues/4670)) ([42e65f0](https://github.com/dsj1984/mandrel/commit/42e65f0a2483a924aa0a1268b4ec26ea6f5b53bb))
+
+## [2.7.0](https://github.com/dsj1984/mandrel/compare/mandrel-v2.6.0...mandrel-v2.7.0) (2026-07-21)
+
+
+### Fixed
+
+* **feedback-loop:** repair the graduator idempotency probe — an HTML-comment-wrapped search query never matches, so every rollup re-files ([#4657](https://github.com/dsj1984/mandrel/issues/4657)) ([#4661](https://github.com/dsj1984/mandrel/issues/4661)) ([9bb9d3a](https://github.com/dsj1984/mandrel/commit/9bb9d3ad674dafb11bcd2fbce771a81b79e8cd51))
+* **retro:** generalize post-land recovery marking and gate merge-wait-exhausted on real budget exhaustion (refs [#4654](https://github.com/dsj1984/mandrel/issues/4654)) ([#4658](https://github.com/dsj1984/mandrel/issues/4658)) ([54c45ae](https://github.com/dsj1984/mandrel/commit/54c45ae4f522688e018c092da0137cc6562e0c73))
+
 ## [2.6.0](https://github.com/dsj1984/mandrel/compare/mandrel-v2.5.0...mandrel-v2.6.0) (2026-07-20)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mandrel",
-  "version": "2.6.0",
+  "version": "2.8.0",
   "description": "Claude Code-first opinionated workflow framework: instructions, skills, rules, and SDLC workflows that govern AI coding assistants.",
   "files": [
     ".agents/",

package/.agents/workflows/helpers/audit-dual-path.md

@@ -1,59 +0,0 @@
-# Audit lens execution strategy (dual-path)
-
-> **Single source for the dual-path preamble (Story #4625).** Every lens whose
-> `## Execution strategy (dual-path)` section points here shares this exact
-> contract. Read `audit-<lens>` and
-> `.claude/workflows/audit-<lens>.workflow.js` below as this lens's own name.
-
-A lens that references this helper runs along one of two execution paths. Both
-emit the **identical** report contract (the lens's Output Requirements step);
-downstream consumers (`audit-to-stories`) are agnostic to which path produced
-it.
-
-- **Orchestrated (dynamic-workflow) path.** When Claude Code's
-  [dynamic workflows](https://code.claude.com/docs/en/workflows) are
-  available, the saved project workflow
-  `.claude/workflows/audit-<lens>.workflow.js` fans the lens's dimensions out
-  as parallel read-only subagents, runs an **adversarial cross-check** stage
-  (an independent agent reviews each dimension's findings and drops false
-  positives before they enter the report), then synthesises the report. The
-  orchestrator derives its per-dimension prompts from the *lens* markdown at
-  run time — the lens stays the single source of truth; the script does not
-  fork a second copy of the spec.
-- **Sequential (single-pass) path.** When dynamic workflows are unavailable,
-  follow the lens's Steps turn-by-turn exactly as before. This is the default
-  fallback and changes nothing about the existing behaviour.
-
-**Strategy selection** is computed by
-[`lib/dynamic-workflow/capability.js`](../../scripts/lib/dynamic-workflow/capability.js)
-(`selectAuditStrategy`). The orchestrated path is chosen only when the runtime
-is Claude Code, `disableWorkflows` is not set (settings.json **or**
-`CLAUDE_CODE_DISABLE_WORKFLOWS`), and the Claude Code version meets the
-research-preview floor (`>= 2.1.154`). Any other runtime, a disabled setting,
-or an older version degrades gracefully to the sequential path.
-
-> **Capability degradation, not a contract shim.** This dual path is **not**
-> covered by the No-Shim / hard-cutover rule in
-> [`git-conventions.md`](../../rules/git-conventions.md). That rule forbids
-> running two shapes of the *same contract* side by side. Here there is **one**
-> report contract; only the *execution strategy* is selected from a runtime
-> capability — the same pattern the protocol already endorses for live-docs
-> fallback in [`instructions.md` §1.C/§1.D](../../instructions.md). The full
-> capability-degradation rationale lives in the
-> [`capability.js`](../../scripts/lib/dynamic-workflow/capability.js) module
-> docstring; the orchestrated-run evidence and per-lens cost/precision gate
-> verdicts live in [`docs/roadmap.md`](../../../docs/roadmap.md) (Part 3 —
-> Dynamic-Workflow Orchestration).
-
-**Forcing a path (for testing).** Set `MANDREL_AUDIT_STRATEGY=sequential` to
-verify the fallback path with the feature notionally disabled, or
-`MANDREL_AUDIT_STRATEGY=orchestrated` to pin the dynamic path. To exercise the
-real disable signals instead, set `CLAUDE_CODE_DISABLE_WORKFLOWS=1` (env) or
-`disableWorkflows: true` in `.claude/settings.json` and re-run the lens — both
-degrade to the sequential path.
-
-> **Read-only on both paths.** The lens is read-only (see its Constraint). The
-> orchestrated subagents run in `acceptEdits` and inherit the session tool
-> allowlist, but the workflow script grants the analysis agents only
-> read/search tools (`Read`, `Grep`, `Glob`) — no write/edit/shell-mutation
-> tools. The single write in an orchestrated run is the final report artifact.

package/.agents/workflows/helpers/audit-self-check.md

@@ -1,70 +0,0 @@
-# Audit finding self-cross-check (shared)
-
-> **Single source of truth for the sequential-path false-positive guard
-> (Story #4627).** Every non-retired audit lens references this file and runs
-> this pass over its Detailed Findings before finalizing its report. The
-> orchestrated dynamic-workflow path already fans out an independent
-> adversarial reviewer; this pass gives the **sequential single-pass** path —
-> the one consumer runs take, where the npm payload ships no per-lens
-> `*.workflow.js` — the same false-positive filter, so a lens cannot report an
-> unverified finding just because it ran single-pass.
-
-You are your own adversarial reviewer. After you have drafted the Detailed
-Findings but **before** you write the report artifact, re-open every finding
-and hold it to the bar below. This pass is **read-only** — it filters and
-tightens the findings you already have; it never invents new ones.
-
-## Per-finding evidence bar (keep or drop)
-
-Keep a finding only when **all** of the following hold. Drop it otherwise.
-
-- **Grounded location** — it names a concrete `path:line` (or a concrete
-  symbol / config key) that you have actually read, not a hypothetical or a
-  "somewhere in the codebase" claim.
-- **Reproducible evidence** — the problem is backed by an observable: a tool
-  reading (a baseline row, a complexity/MI/duplication number, a failing
-  command), a quoted code snippet, or a specific standard it violates. A
-  finding whose entire basis is "this looks wrong" does not clear the bar.
-- **In-scope** — when a change-set scope filter was supplied (the `Scope`
-  block resolved to a file list), the finding lives in that scope or a direct
-  dependency the lens explicitly reasons across. A finding outside the scope
-  filter is dropped, not reported.
-- **Actionable** — the recommendation is specific enough to execute. Drop
-  vague exhortations ("improve error handling generally") that carry no
-  concrete change.
-
-## Exclusion list (never a finding)
-
-Treat the following as **out of scope by construction** and drop any finding
-that rests on one of them:
-
-- **Sanctioned test seams** — exports consumed only by tests, and other
-  patterns the `test-seams` rule blesses. Never a production defect.
-- **Entry points & public API surface** — CLI mains, `bin/` scripts, declared
-  `exports` / `bin` / `main`, and barrel contracts consumed out-of-tree. A
-  zero in-repo consumer count is not death.
-- **Dynamic / framework reachability** — symbols reached via `import()`,
-  string-keyed dispatch, decorators, lifecycle listeners, or convention-loaded
-  plugin directories. Invisible to static analysis, not dead.
-- **Intentional, documented deviations** — a pattern an in-tree comment, ADR,
-  or config explicitly sanctions. Cite it and drop the finding.
-- **Style-only nits already enforced by a formatter/linter** — do not
-  re-litigate what the committed tooling already governs.
-
-## Final re-open-and-drop pass (mandatory)
-
-1. Walk your Detailed Findings once more, applying the bar and the exclusion
-   list above. Remove every finding that fails.
-2. Count what you kept (`k`) and what you dropped (`d`).
-3. Record the outcome in the report's **Executive Summary** as a single line:
-
-   ```text
-   Self-cross-check: kept <k> / dropped <d>.
-   ```
-
-   When `d > 0`, name the dropped findings (title + the bar/exclusion reason)
-   in one short list under that line, so the filtering is auditable and never
-   silent.
-
-A lens that keeps every finding still records `dropped 0` — the line's absence
-is itself a defect (it means the pass did not run).

package/.agents/workflows/helpers/audit-severity-scale.md

@@ -1,19 +0,0 @@
-# Audit finding severity scale (shared)
-
-> **Single source of truth for the `Severity` axis (Story #4625).** Every audit
-> lens report references this file so the four levels — and the parser that
-> ranks them — never drift per lens.
-
-Every finding grades its severity (labelled `Severity` or `Impact` on a given
-lens) on this ordered scale. `parse-audit-md.js` recognizes every level, and a
-surviving **Critical** finding halts the delivery gate
-(`lib/audit-suite/findings.js#hasSurvivingCritical`).
-
-- **Critical** — an active, exploitable, or data-losing defect that must be
-  fixed before the change can ship (e.g. a leaked secret, an auth bypass, a
-  guaranteed production outage or data-loss path).
-- **High** — a serious correctness, security, or maintainability risk that
-  should be fixed promptly, but does not by itself block the release.
-- **Medium** — a real problem worth scheduling; contained blast radius, or a
-  reasonable workaround exists.
-- **Low** — minor or cosmetic; fix opportunistically.