mandrel 2.60.0 → 2.62.0

package/.agents/scripts/update-duplication-baseline.js

@@ -1,49 +1,11 @@
 /**
- * update-duplication-baseline.js — manual refresh CLI for the
- * code-duplication (DRY) baseline (Story #3664).
- *
- * Story #4944: this CLI is now a thin wrapper around
- * `refreshBaseline({ kind: 'duplication' })` from
- * `.agents/scripts/lib/baselines/refresh-service.js`, completing the Epic
- * #2173 migration — duplication was the last kind still assembling its own
- * writer call via the legacy `buildWriterScopeArgs` path. Scope resolution,
- * prior-envelope reading, epsilon damping, envelope assembly, and
- * persistence all flow through the unified service.
- *
- * The migration is what makes this CLI's documented surface true. Before it,
- * `--full-scope` was advertised and parsed by nobody, and the no-flag default
- * was a full rewrite rather than the diff-scoped refresh the usage text
- * described.
- *
- * Surface:
- *
- *   - `--baseline <path>`: write somewhere other than the configured
- *     `delivery.quality.gates.duplication.baselinePath`.
- *   - `--diff-scope <ref>`: scope the refresh to files changed between
- *     `<ref>` and HEAD. Out-of-scope rows are preserved verbatim from the
- *     prior on-disk baseline.
- *   - `--full-scope`: regenerate every row (no out-of-scope merge).
- *   - With no scope flag: scope is derived from `git diff --name-only
- *     origin/main..HEAD` (the service's default `baseRef..headRef`), matching
- *     `update-crap-baseline.js` / `update-maintainability-baseline.js` /
- *     `update-coverage-baseline.js`.
- *
- * **Scope is a write-side filter here, not a scan-side one.** jscpd detects
- * clones pairwise, so the scan always covers the whole target tree even in
- * diff mode — see `buildDefaultDuplicationScorer` in the refresh service for
- * why narrowing the scan would drop clones between a changed file and an
- * unchanged one. What a scope flag narrows is which rows the refresh is
- * allowed to rewrite.
- *
- * Exits non-zero only when the scanner itself crashes. An empty result (no
- * detected clones) still writes an envelope with `rows: []` so downstream
- * `check-baselines` can tell "intentional empty baseline" apart from "no
- * baseline yet".
+ * Refresh the duplication baseline via `refreshBaseline({ kind:
+ * 'duplication' })`. Scope is a write-side filter only: clone detection is
+ * pairwise, so the scan always covers the whole tree. No clones still writes
+ * `rows: []`, so an intentional empty baseline differs from a missing one.
  */
 
-// Fail-fast if the framework's runtime deps are not installed — must be the
-// first import so the check runs before any third-party-importing sibling
-// module is evaluated (Story #3432).
+// Must be the first import: fails fast before any third-party import loads.
 import './lib/runtime-deps/ensure-installed.js';
 import path from 'node:path';
 import { parseDiffScopeFlag } from './lib/baselines/diff-scope-cli.js';
@@ -53,12 +15,7 @@ import { getBaselineEpsilon } from './lib/config/quality.js';
 import { getQuality, resolveConfig } from './lib/config-resolver.js';
 import { Logger } from './lib/Logger.js';
 
-/**
- * Usage block for `--help`. This CLI *writes* on invocation, so the help
- * branch must short-circuit before `main` runs rather than inside it —
- * `runAsCli` answers help first, which makes "a usage probe never mutates a
- * baseline" structural instead of a check `main` has to remember.
- */
+/** `runAsCli` answers `--help` before `main`, so a usage probe never writes. */
 const USAGE = {
   invocation:
     'node .agents/scripts/update-duplication-baseline.js [--baseline <path>] [--full-scope | --diff-scope <ref>]',
@@ -85,10 +42,6 @@ const USAGE = {
 };
 
 /**
- * Parse `--baseline <path>` — the one flag this CLI does not share with its
- * siblings. The scope flags are parsed by the shared helpers so their
- * contract stays identical across the four update CLIs.
- *
  * @param {string[]} argv
  * @returns {{ baselinePath: string | undefined }}
  */
@@ -104,8 +57,6 @@ function parseCliArgs(argv = process.argv.slice(2)) {
 }
 
 /**
- * Parse `--full-scope` (boolean opt-out flag).
- *
  * @param {string[]} argv
  * @returns {boolean}
  */
@@ -114,12 +65,8 @@ function parseFullScopeFlag(argv = []) {
 }
 
 /**
- * Resolve the duplication gate block from the merged quality config. The
- * flattened legacy bag does not expose a `duplication` accessor (the kind
- * post-dates the bag), so read it off the resolved `gates` map directly.
- *
- * @param {object} config resolved config
- * @returns {object} the duplication gate block (possibly empty)
+ * @param {object} config
+ * @returns {object}
  */
 function resolveDuplicationGate(config) {
   const gates = getQuality(config).gates ?? {};
@@ -127,14 +74,8 @@ function resolveDuplicationGate(config) {
 }
 
 /**
- * Resolve the mutually-exclusive scope selection from argv.
- *
- * Split out of `main` deliberately: nothing in this file is reachable from a
- * test (the CLI is only ever spawned with `--help`, which `runAsCli`
- * short-circuits), so every function here scores CRAP at zero coverage —
- * `c² + c`. A single `main` carrying all the branching lands at c=8 → 72,
- * well over the 30 ceiling. Small single-purpose helpers keep each row far
- * below it without hiding any logic.
+ * Split out of `main` because nothing here is covered by tests, so CRAP is
+ * `c² + c`; small helpers keep each row under the ceiling.
  *
  * @param {string[]} argv
  * @returns {{ fullScope: boolean, diffScopeRef: string | null }}
@@ -152,13 +93,9 @@ function resolveScopeSelection(argv) {
 }
 
 /**
- * Resolve the absolute path the refreshed envelope is written to:
- * `--baseline <path>` wins, then the configured gate path, then the
- * framework default.
- *
  * @param {string[]} argv
- * @param {object} gate resolved duplication gate block
- * @returns {string} absolute path
+ * @param {object} gate
+ * @returns {string}
  */
 function resolveAbsBaselinePath(argv, gate) {
   const baselinePath =
@@ -171,9 +108,6 @@ function resolveAbsBaselinePath(argv, gate) {
 }
 
 /**
- * Announce which scope the refresh resolved to, so an operator reading the
- * log can tell a narrowed refresh from a full rewrite without re-deriving it.
- *
  * @param {{ fullScope: boolean, diffScopeRef: string | null }} selection
  */
 function logScopeDecision({ fullScope, diffScopeRef }) {
@@ -189,14 +123,8 @@ function logScopeDecision({ fullScope, diffScopeRef }) {
 }
 
 /**
- * Assemble the `refreshBaseline` option bag for the resolved selection.
- *
- * No `scorer` is injected — the service resolves the canonical default
- * duplication scorer, which reads `gates.duplication.targetDirs` /
- * `ignoreGlobs` off the same resolved config this CLI reads.
- *
  * @param {{ fullScope: boolean, diffScopeRef: string | null, absBaselinePath: string, epsilon: number }} args
- * @returns {object} options for `refreshBaseline`
+ * @returns {object}
  */
 function buildRefreshOpts({
   fullScope,
@@ -212,14 +140,10 @@ function buildRefreshOpts({
   if (fullScope) {
     refreshOpts.fullScope = true;
   } else if (diffScopeRef) {
-    // The CLI's documented `--diff-scope <ref>` semantics are `<ref>...HEAD`
-    // (three-dot). The service derives via two-dot `baseRef..headRef`; pass
-    // the ref as `baseRef` so the derivation runs through the same execFile
-    // seam the sibling CLIs use.
+    // The service derives two-dot `baseRef..headRef`, like the sibling CLIs.
     refreshOpts.baseRef = diffScopeRef;
   }
-  // No flag → scopeFiles=null + fullScope=false → service derives the diff
-  // via `origin/main..HEAD` (its default baseRef/headRef).
+  // No flag: the service derives the diff from `origin/main..HEAD`.
   return refreshOpts;
 }
 
@@ -239,7 +163,7 @@ async function main() {
     buildRefreshOpts({
       ...selection,
       absBaselinePath,
-      epsilon: getBaselineEpsilon('duplication', config),
+      epsilon: getBaselineEpsilon('duplication'),
     }),
   );
 

package/.agents/scripts/update-maintainability-baseline.js

@@ -1,44 +1,10 @@
 /**
- * update-maintainability-baseline.js — manual refresh CLI for the
- * maintainability baseline.
- *
- * Story #2202 / Task #2215 (Epic #2173): this CLI is now a thin wrapper
- * around `refreshBaseline({ kind: 'maintainability' })` from
- * `.agents/scripts/lib/baselines/refresh-service.js`. All scoring, scope
- * resolution, envelope assembly, and persistence flows through the unified
- * service.
- *
- * Story #4293: the CLI no longer injects a bespoke maintainability scorer.
- * It now lets `refreshBaseline` resolve the canonical default scorer
- * (`buildDefaultMaintainabilityScorer`) the same way `update-crap-baseline.js`
- * and `update-coverage-baseline.js` route through their canonical defaults.
- * The previously-injected `buildMaintainabilityScorer` was a stale copy of the
- * canonical scorer that never received the `ignoreGlobs` fix on its diff-scope
- * branch, so an ignored-but-changed file (e.g. one matched by
- * `config-settings-schema*.js` or a consumer's `seed.mjs`) leaked into `rows`
- * and dragged `rollup["*"].min` below the maintainability floor. The canonical
- * default scorer applies the ignore filter on BOTH the full-scope walk and the
- * diff-scope branch, eliminating the divergence at the source.
- *
- * Surface:
- *
- *   - `--diff-scope <ref>` (or `--diff-scope=<ref>`): explicitly scope the
- *     refresh to files changed between `<ref>` and HEAD. Out-of-scope rows
- *     are preserved byte-for-byte from the prior on-disk baseline.
- *   - With no flag: scope is derived from `git diff --name-only
- *     origin/main..HEAD` (the service's default `baseRef..headRef`).
- *     Operators wanting a full rewrite must pass `--full-scope` (added by
- *     Task #2214; see that Task's notes for the cut-over).
- *
- * Full-scope refreshes (`scope.mode === 'full'`) walk every configured
- * target directory; diff/explicit refreshes score only the files the
- * service hands in. Both paths drop `ignoreGlobs`-listed files via the
- * canonical default scorer.
+ * Refresh the maintainability baseline via `refreshBaseline({ kind:
+ * 'maintainability' })`. No scorer is injected: the service's default applies
+ * `ignoreGlobs` on both the full walk and the diff-scope branch.
  */
 
-// Fail-fast if the framework's runtime deps are not installed — must be the
-// first import so the check runs before any third-party-importing sibling
-// module is evaluated (Story #3432).
+// Must be the first import: fails fast before any third-party import loads.
 import './lib/runtime-deps/ensure-installed.js';
 import path from 'node:path';
 import { parseDiffScopeFlag } from './lib/baselines/diff-scope-cli.js';
@@ -48,12 +14,7 @@ import { getBaselineEpsilon } from './lib/config/quality.js';
 import { getBaselines, resolveConfig } from './lib/config-resolver.js';
 import { Logger } from './lib/Logger.js';
 
-/**
- * Usage block for `--help` (Story #4872). This CLI *writes* on invocation, so
- * the help branch must short-circuit before `main` runs rather than inside it —
- * `runAsCli` answers help first, which makes "a usage probe never mutates a
- * baseline" structural instead of a check `main` has to remember.
- */
+/** `runAsCli` answers `--help` before `main`, so a usage probe never writes. */
 const USAGE = {
   invocation:
     'node .agents/scripts/update-maintainability-baseline.js [--full-scope | --diff-scope <ref>]',
@@ -72,8 +33,6 @@ const USAGE = {
 };
 
 /**
- * Parse `--full-scope` (boolean opt-out flag).
- *
  * @param {string[]} argv
  * @returns {boolean}
  */
@@ -97,7 +56,7 @@ async function main() {
   const absBaselinePath = path.isAbsolute(baselinePath)
     ? baselinePath
     : path.resolve(process.cwd(), baselinePath);
-  const epsilon = getBaselineEpsilon('maintainability', config);
+  const epsilon = getBaselineEpsilon('maintainability');
 
   Logger.info('[Maintainability] Updating baseline...');
   if (fullScope) {
@@ -110,14 +69,6 @@ async function main() {
     );
   }
 
-  // Task #2214 (Epic #2173, AC-2): flag-omission now defaults to
-  // diff-scope. The pre-migration default was a full regenerate; operators
-  // wanting that behaviour must now pass `--full-scope` explicitly. This is
-  // a deliberate breaking CLI behaviour change — see docs/CHANGELOG.md.
-  //
-  // Story #4293: no `scorer` is injected — the service resolves the canonical
-  // default maintainability scorer, which applies `ignoreGlobs` on both the
-  // full-scope walk and the diff-scope branch.
   const refreshOpts = {
     kind: 'maintainability',
     writePath: absBaselinePath,
@@ -126,15 +77,10 @@ async function main() {
   if (fullScope) {
     refreshOpts.fullScope = true;
   } else if (diffScopeRef) {
-    // The CLI's documented `--diff-scope <ref>` semantics are
-    // `<ref>...HEAD` (three-dot). The service derives via two-dot
-    // `baseRef..headRef`; pass the ref as `baseRef` so the service's
-    // diff-derivation does the heavy lifting through the same execFile
-    // seam that auto-refresh uses.
+    // The service derives two-dot `baseRef..headRef`, like auto-refresh.
     refreshOpts.baseRef = diffScopeRef;
   }
-  // No flag → scopeFiles=null + fullScope=false → service derives the
-  // diff via `origin/main..HEAD` (its default baseRef/headRef).
+  // No flag: the service derives the diff from `origin/main..HEAD`.
 
   const result = await refreshBaseline(refreshOpts);
 

package/.agents/scripts/update-ticket-state.js

@@ -80,13 +80,7 @@ if (
     Logger.info(
       `[State-Sync] Transitioning ticket #${ticketId} to ${state}...`,
     );
-    // Story #4545 — no second cascade here. `transitionTicketState` already
-    // fires the upward cascade on every transition (bulk.js registers
-    // `cascadeParentState` as transition.js's cascade runner, and the DONE
-    // branch delegates to `cascadeCompletion`), so the explicit call this
-    // used to make re-walked the same parents and re-spent the same API
-    // calls a second time on every done transition — under a Story-only
-    // model where no orchestration parent exists to find.
+    // No explicit cascade: `transitionTicketState` already runs it.
     await transitionTicketState(provider, ticketId, state);
 
     // Optional secondary label removal alongside the state transition

package/.agents/scripts/validate-skills.js

@@ -1,30 +1,12 @@
 #!/usr/bin/env node
 // .agents/scripts/validate-skills.js
 //
-// Walk `SKILL.md` under both skills roots — the package payload
-// (`.agents/skills/{core,stack}/`) and the consumer-writable local zone
-// (`.agents/local/skills/{core,stack}/`, Story #5135) — via the shared parser
-// helper, validate each frontmatter block against
-// `.agents/schemas/skill.schema.json`, enforce Policy Capsule presence
-// (5–12 bullets), and verify membership in each root's own manifest when it
-// exists. A consumer-authored skill is held to exactly the same bar as a
-// shipped one; the roots are validated separately because each carries its
-// own index (the shipped manifest is a payload file and must stay
-// payload-only — see generate-skills-index.js). All findings are batched into a single
-// human-readable report; the process exits non-zero when any finding is
-// surfaced.
 //
-// CLI surface:
-//
-//   node validate-skills.js [--root <dir>]
-//
-//   --root <dir>   Use <dir> as the repo root (defaults to the project
-//                  root containing `.agents/skills`). Useful for tests
-//                  staging fixture trees outside the real repo.
-//
-// Honors AGENT_LOG_LEVEL via the shared `Logger`. The findings report is
-// written to stdout when any finding is present, so callers can capture
-// it for ticket comments or CI logs.
+// Validate every `SKILL.md` in the payload and local skills roots: schema
+// frontmatter, a 5–12 bullet Policy Capsule, and membership in that root's
+// own index (the shipped index is a payload file and stays payload-only).
+// Local skills meet the same bar. Findings are batched; any finding exits
+// non-zero. `--root <dir>` overrides the repo root (for fixtures).
 
 import fs from 'node:fs';
 import path from 'node:path';
@@ -56,9 +38,7 @@ function defaultRepoRoot() {
 }
 
 export function parseArgs(argv) {
-  // `--help` / `-h` is a side-channel signal handled before the shared
-  // parser sees it: the shared parser does not (yet) model help flags as
-  // first-class output, and pre-stripping keeps the legacy parsed shape.
+  // Help is handled before the shared parser, which does not model it.
   if (argv.some((t) => t === '--help' || t === '-h')) {
     return { root: null, help: true };
   }

package/.agents/templates/agent-protocol.md

@@ -65,7 +65,7 @@ sibling-test convention, the per-file Maintainability-Index drop ceiling
 (refactor when > 1.5pt), and the rename = baseline-refresh rule. Verify
 at-keyboard with `npm run quality:preview` (the same diff-scoped MI + CRAP
 preview the `.husky/pre-commit` hook runs) **before** committing. The
-thresholds are tunable via `agentSettings.quality.codingGuardrails` in
-`.agentrc.json` — never fork the helper to change a number.
+thresholds are fixed framework constants — never fork the helper to change
+a number.
 
 ---

package/.agents/templates/docs/audit-sweep-runbook.md

@@ -23,7 +23,7 @@ has to be settled here instead.
 | --- | --- |
 | Cadence | _e.g. weekly, Sunday 02:00_ |
 | Lenses in scope | _e.g. security, clean-code, quality, dependencies_ |
-| Severity floor | _`delivery.auditToStories.severityFloor`, default `high`_ |
+| Severity floor | _`--severity`, default `high`_ |
 | Ledger reviewer | _e.g. @your-handle_ |
 | Story triage owner | _e.g. the on-call maintainer_ |
 
@@ -88,9 +88,8 @@ to every finding.
 `--dry-run` performs zero GitHub writes and skips the ledger write, printing
 only the run summary. Read `totals.create` before you let the sweep file
 anything: a first full-scope run over an un-audited repository can propose more
-Stories than your team can triage in a quarter. Raise `--severity` (or
-`delivery.auditToStories.severityFloor`) until the create count is a batch you
-would actually take on, then go live.
+Stories than your team can triage in a quarter. Raise `--severity` until the
+create count is a batch you would actually take on, then go live.
 
 ## Step 4 — Go live, and persist the ledger
 

package/.agents/workflows/audit-accessibility.md

@@ -9,9 +9,7 @@ conformance** — semantic structure, ARIA correctness, keyboard operability, fo
 labelling, media alternatives, and contrast — grounding every finding in a
 concrete element and the success criterion it violates. Default to **static**
 detection over source; escalate to a **runtime** pass only when a live target is
-configured. The shared lens machinery — read-only constraint, scope
-interpretation, report envelope + finding-block skeleton, severity scale,
-self-cross-check, and execution strategy — lives in
+configured. The shared lens machinery lives in
 [`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
 `{{auditOutputDir}}/audit-accessibility-results.md`. Extra finding fields:
 **WCAG:** (the violated success criterion, e.g. `1.1.1 Non-text Content (A)`)
@@ -55,7 +53,7 @@ the token-adherence note to ux-ui.
 
 ## Scope
 
-Interpret this lens's change-set fence per the core's Scope interpretation:
+Per the core's Scope interpretation:
 
 ```text
 {{changedFiles}}
@@ -63,9 +61,8 @@ Interpret this lens's change-set fence per the core's Scope interpretation:
 
 ## Execution strategy
 
-Run this lens as a single `subagent_type: auditor` dispatch returning the report
-path + Executive Summary; sequential inline execution is the fallback (see the
-core's Execution strategy).
+Run this lens as one `subagent_type: auditor` dispatch per the core's
+Execution strategy.
 
 ## Step 0: Discover the frontend surface and config (run first)
 

package/.agents/workflows/audit-adrs.md

@@ -16,9 +16,7 @@ Accepted ADR the tree has outgrown is worse than no ADR at all — it actively
 teaches a wrong contract, and it keeps teaching it until someone supersedes it.
 That is this lens's central target; structural tidiness is the cheap part.
 
-The shared lens machinery — read-only constraint, scope interpretation, report
-envelope + finding-block skeleton, severity scale, self-cross-check, and
-execution strategy — lives in
+The shared lens machinery lives in
 [`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
 `{{auditOutputDir}}/audit-adrs-results.md`. Dimension values:
 `Decision Drift | Supersede-Chain Integrity | Structure & Status Hygiene |
@@ -91,9 +89,8 @@ only; the guard is not weakened for any other lens.
 
 ## Execution strategy
 
-Run this lens as a single `subagent_type: auditor` dispatch returning the report
-path + Executive Summary; sequential inline execution is the fallback (see the
-core's Execution strategy). On a large log, the Decision Drift claim-check
+Run this lens as one `subagent_type: auditor` dispatch per the core's
+Execution strategy. On a large log, the Decision Drift claim-check
 (Step 2.1) is the one dimension worth fanning out per batch of entries under
 parallel-tooling Rule 3 — merge under the shared self-cross-check.
 

package/.agents/workflows/audit-architecture.md

@@ -6,9 +6,7 @@ description: Audit architectural boundaries, module coupling, layering violation
 
 You are a Staff Software Engineer & Architecture Reviewer performing a read-only
 review that prioritizes maintainability and readability without altering
-external APIs or business logic. The shared lens machinery — read-only
-constraint, scope interpretation, report envelope + finding-block skeleton,
-severity scale, self-cross-check, and execution strategy — lives in
+external APIs or business logic. The shared lens machinery lives in
 [`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
 `{{auditOutputDir}}/audit-architecture-results.md`. Each finding carries an
 **Impact:** and a **Category:** (`Quick Win | Structural Change`); the report
@@ -17,7 +15,7 @@ adds a **Triage Summary** (Quick Wins / Structural Changes) and an
 
 ## Scope
 
-Interpret this lens's change-set fence per the core's Scope interpretation:
+Per the core's Scope interpretation:
 
 ```text
 {{changedFiles}}
@@ -183,13 +181,7 @@ Evaluate the gathered context against the following architecture dimensions:
 
    For each finding, name the module/function, identify the trapped logic and
    the I/O it is bound to, and propose the concrete seam (the pure function or
-   port to extract, and where the I/O adapter should call into it). This repo
-   already practices a related seam discipline at the error-handling boundary:
-   [`rules/orchestration-error-handling.md`](../rules/orchestration-error-handling.md)
-   requires orchestration scripts to `throw` rather than `Logger.fatal` so the
-   thin `runAsCli` shell — not the logic — owns the `process.exit` side effect,
-   keeping the wrapped logic exercisable under a stubbed `process.exit`. Cite
-   that precedent where it applies rather than restating it.
+   port to extract, and where the I/O adapter should call into it).
 2. **Automated Architecture Guardrails:** Assess whether the project encodes
    its architectural boundaries as **deterministic, automated checks** rather
    than relying on convention or reviewer memory. When relevant to the

package/.agents/workflows/audit-baselines.md

@@ -10,9 +10,7 @@ repository's **committed baseline surface**: the ratchet artifacts under
 `.agentrc.json`. Those instruments only prevent **regression** — nothing owns
 the loop that burns the measured debt **down** and tightens the floors behind
 it, so a repo can hold a floor it cleared years ago and never notice. This lens
-is that loop's read-only entry point. The shared lens machinery — read-only
-constraint, scope interpretation, report envelope + finding-block skeleton,
-severity scale, self-cross-check, and execution strategy — lives in
+is that loop's read-only entry point. The shared lens machinery lives in
 [`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
 `{{auditOutputDir}}/audit-baselines-results.md`. Dimension values:
 `Dead Instrument | Staleness | Hotspot Cluster | Trend Drift | Tightening Headroom`.
@@ -26,7 +24,7 @@ severity scale, self-cross-check, and execution strategy — lives in
 
 ## Scope
 
-Interpret this lens's change-set fence per the core's Scope interpretation:
+Per the core's Scope interpretation:
 
 ```text
 {{changedFiles}}
@@ -51,9 +49,8 @@ This lens **refines** the core's read-only constraint; it never relaxes it.
 
 ## Execution strategy
 
-Run this lens as a single `subagent_type: auditor` dispatch returning the report
-path + Executive Summary; sequential inline execution is the fallback (see the
-core's Execution strategy).
+Run this lens as one `subagent_type: auditor` dispatch per the core's
+Execution strategy.
 
 ## Step 0: Run the engine (mandatory — measure before you judge)
 
@@ -155,8 +152,8 @@ Two envelope-level reads come **before** any finding:
    The acknowledgment is the kind upper-snaked. It demotes that kind's
    head-vs-base regressions to unchanged **for one run only** — floors stay
    enforced, so a genuine breach is still caught. The durable equivalent is a
-   commit in the compared range whose subject carries the gate's `refreshTag`
-   (default `baseline-refresh:`) **and** whose diff touches that kind's
+   commit in the compared range whose subject carries the fixed refresh tag
+   `baseline-refresh:` **and** whose diff touches that kind's
    baseline file. Confirm both against
    `node .agents/scripts/check-baselines.js --help` before writing the prompt,
    and never invent an acknowledgment for a kind that ships no regeneration

package/.agents/workflows/audit-clean-code.md

@@ -6,9 +6,7 @@ description: Audit code smells, dead code, complexity hotspots, and maintainabil
 
 You are a Principal Software Engineer & Code Quality Lead auditing
 maintainability — code smells, technical debt, and clean-code violations (SOLID,
-DRY, KISS) that hinder long-term velocity. The shared lens machinery — read-only
-constraint, scope interpretation, report envelope + finding-block skeleton,
-severity scale, self-cross-check, and execution strategy — lives in
+DRY, KISS) that hinder long-term velocity. The shared lens machinery lives in
 [`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
 `{{auditOutputDir}}/audit-clean-code-results.md`. The report adds a **Dead Code
 Inventory** table (File / Symbol / Type / Estimated LOC) and a **Technical Debt
@@ -16,7 +14,7 @@ Backlog** section.
 
 ## Scope
 
-Interpret this lens's change-set fence per the core's Scope interpretation:
+Per the core's Scope interpretation:
 
 ```text
 {{changedFiles}}
@@ -24,9 +22,8 @@ Interpret this lens's change-set fence per the core's Scope interpretation:
 
 ## Execution strategy
 
-Run this lens as a single `subagent_type: auditor` dispatch returning the report
-path + Executive Summary; sequential inline execution is the fallback (see the
-core's Execution strategy).
+Run this lens as one `subagent_type: auditor` dispatch per the core's
+Execution strategy.
 
 ## Step 0: Tool-first detection (mandatory — measure before you judge)
 
@@ -46,7 +43,7 @@ run the tools first.
    `check-baselines.js` gate enforces. Treat any per-file MI drop beyond
    `delivery.quality.gates.maintainability.tolerance` (default 0.5pt) as a
    grounded must-fix finding, and any cyclomatic reading over the
-   `codingGuardrails.cyclomaticFlag` (> 8) or the fixed ratchet ceiling
+   advisory flag (> 8) or the fixed ratchet ceiling
    (≥ 12, reported by `quality:preview` as an advisory) as measured, not
    guessed.
 
@@ -78,9 +75,8 @@ run the tools first.
    - **Dynamic imports** — symbols reached via `import()`,
      `require(variable)`, or string-keyed dispatch tables: invisible to static
      export-graph analysis, so exclude unless you confirm no dynamic reference.
-   - **Test-only seams** — exports consumed only by tests (the sanctioned
-     `test-seams` pattern): flag as test-only, not dead, and never as a
-     production-dead finding.
+   - **Test-only seams** — exports consumed only by tests: flag as test-only,
+     not dead, and never as a production-dead finding.
    - **Framework/registration hooks** — decorators, lifecycle listeners, and
      files auto-loaded by convention (globbed listener/plugin dirs): reachable
      via the framework, not the import graph.
@@ -98,7 +94,7 @@ Analyze the repository with a focus on:
 - **Logic Complexity:** Apply the cyclomatic / Maintainability-Index ceilings
   from
   [`helpers/code-quality-guardrails.md`](helpers/code-quality-guardrails.md):
-  cyclomatic complexity > 8 (`delivery.quality.codingGuardrails.cyclomaticFlag`)
+  cyclomatic complexity > 8 (the advisory flag)
   is **flag in review** (annotate or split); ≥ 12 is the fixed ratchet
   ceiling `check-cyclomatic.js` enforces on new breaches.
   A per-file MI drop beyond the configured

package/.agents/workflows/audit-data-model.md

@@ -8,10 +8,7 @@ You are a Data Modeler & Database Reliability Engineer analyzing the persistence
 layer — ORM model definitions, the migrations they should produce, and the seed
 data — as a first-class artifact, finding where model, migrations, and runtime
 schema silently disagree, where an assumed invariant is not enforced by a
-constraint, and where a migration is unsafe against a live database. The shared
-lens machinery — read-only constraint, scope interpretation, report envelope +
-finding-block skeleton, severity scale, self-cross-check, and execution
-strategy — lives in
+constraint, and where a migration is unsafe against a live database. The shared lens machinery lives in
 [`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
 `{{auditOutputDir}}/audit-data-model-results.md`. Dimension values:
 `Drift | Constraint Completeness | Migration Hygiene | Type Fidelity |
@@ -45,9 +42,8 @@ this lens inspects exactly that surface.
 
 ## Execution strategy
 
-Run this lens as a single `subagent_type: auditor` dispatch returning the report
-path + Executive Summary; sequential inline execution is the fallback (see the
-core's Execution strategy).
+Run this lens as one `subagent_type: auditor` dispatch per the core's
+Execution strategy.
 
 ## Step 1: Applicability & Persistence-Surface Discovery
 

package/.agents/workflows/audit-dependencies.md

@@ -6,9 +6,7 @@ description: Audit `package.json` for unused, outdated, and major-version-stale
 
 You are a DevOps Engineer & Security Researcher managing the dependency
 lifecycle — outdated, vulnerable, or bloated packages and a safe upgrade path.
-The shared lens machinery — read-only constraint, scope interpretation, report
-envelope + finding-block skeleton, severity scale, self-cross-check, and
-execution strategy — lives in
+The shared lens machinery lives in
 [`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
 `{{auditOutputDir}}/audit-dependencies-results.md`. Dimension values:
 `Security Fix | Removal | Engine Drift | Major Upgrade | Supply-chain`. The
@@ -24,7 +22,7 @@ report adds a **Health Summary**, an **Upgrade Batches** section, and a
 
 ## Scope
 
-Interpret this lens's change-set fence per the core's Scope interpretation:
+Per the core's Scope interpretation:
 
 ```text
 {{changedFiles}}
@@ -32,9 +30,8 @@ Interpret this lens's change-set fence per the core's Scope interpretation:
 
 ## Execution strategy
 
-Run this lens as a single `subagent_type: auditor` dispatch returning the report
-path + Executive Summary; sequential inline execution is the fallback (see the
-core's Execution strategy).
+Run this lens as one `subagent_type: auditor` dispatch per the core's
+Execution strategy.
 
 ## Step 1: Inventory, Staleness & Unused Detection