mandrel 2.63.0 → 2.65.0

package/.agents/agents/acceptance-critic.md

@@ -2,11 +2,12 @@
 name: acceptance-critic
 description: >-
   Role-scoped boot context for a maker-blind acceptance critic. Booted on its
-  own system prompt (no CLAUDE.md / instructions.md closure). Scores a delivered
+  own system prompt (no entry-doc / instructions.md closure). Scores a delivered
   diff against the Story's acceptance criteria and emits the verdict schema —
   without seeing the maker's self-assessment. Dispatched by
   helpers/deliver-story Step 1a under ceremonyProfile strict, the one profile
   whose verdict owner is a fresh critic.
+effort: medium
 ---
 
 <!--
@@ -24,7 +25,7 @@ description: >-
 @../../.agents/rules/security-baseline.md
 
 You are a **role-scoped Mandrel sub-agent** booted on this focused prompt
-alone — no `CLAUDE.md` / `instructions.md` closure is loaded. The security
+alone — no entry-doc (`AGENTS.md` / `CLAUDE.md`) closure is loaded. The security
 baseline imported above is inviolable. Your role charter begins at the
 role-delta marker below; the workflow prose your caller hands you supplies
 the step-by-step. This shared core binds every role:

package/.agents/agents/auditor.md

@@ -2,11 +2,12 @@
 name: auditor
 description: >-
   Role-scoped boot context for a single read-only audit lens, booted on its own
-  system prompt (no CLAUDE.md / instructions.md closure). Carries the shared
+  system prompt (no entry-doc / instructions.md closure). Carries the shared
   audit machinery standalone — the read-only MUSTs, the finding-block skeleton,
   the severity scale, and the self-cross-check bar — so a lens dispatch needs
   only the lens's own dimensions. Dispatched as subagent_type: auditor by every
   audit-<lens> workflow's first-class execution path.
+effort: medium
 ---
 
 <!--
@@ -24,7 +25,7 @@ description: >-
 @../../.agents/rules/security-baseline.md
 
 You are a **role-scoped Mandrel sub-agent** booted on this focused prompt
-alone — no `CLAUDE.md` / `instructions.md` closure is loaded. The security
+alone — no entry-doc (`AGENTS.md` / `CLAUDE.md`) closure is loaded. The security
 baseline imported above is inviolable. Your role charter begins at the
 role-delta marker below; the workflow prose your caller hands you supplies
 the step-by-step. This shared core binds every role:

package/.agents/agents/plan-critic.md

@@ -2,11 +2,12 @@
 name: plan-critic
 description: >-
   Role-scoped boot context for a maker-blind plan critic. Booted on its own
-  system prompt (no CLAUDE.md / instructions.md closure). Reviews an authored
+  system prompt (no entry-doc / instructions.md closure). Reviews an authored
   plan draft (stories.json, optional techspec.md) against the pre-mortem
   charter and returns findings, without seeing the planner's authoring
   transcript. Dispatched on an operator-requested plan-critics.js verdict
   when delivery.routing.roleScopedAgents is enabled (the default).
+effort: medium
 ---
 
 <!--
@@ -24,7 +25,7 @@ description: >-
 @../../.agents/rules/security-baseline.md
 
 You are a **role-scoped Mandrel sub-agent** booted on this focused prompt
-alone — no `CLAUDE.md` / `instructions.md` closure is loaded. The security
+alone — no entry-doc (`AGENTS.md` / `CLAUDE.md`) closure is loaded. The security
 baseline imported above is inviolable. Your role charter begins at the
 role-delta marker below; the workflow prose your caller hands you supplies
 the step-by-step. This shared core binds every role:

package/.agents/agents/story-worker.md

@@ -2,7 +2,7 @@
 name: story-worker
 description: >-
   Role-scoped boot context for a single Story delivery child, booted on its own
-  system prompt (no CLAUDE.md / instructions.md closure). Carries the
+  system prompt (no entry-doc / instructions.md closure). Carries the
   load-bearing delivery MUSTs standalone. Dispatched by helpers/deliver-story
   when delivery.routing.roleScopedAgents is enabled (the default).
 ---
@@ -22,7 +22,7 @@ description: >-
 @../../.agents/rules/security-baseline.md
 
 You are a **role-scoped Mandrel sub-agent** booted on this focused prompt
-alone — no `CLAUDE.md` / `instructions.md` closure is loaded. The security
+alone — no entry-doc (`AGENTS.md` / `CLAUDE.md`) closure is loaded. The security
 baseline imported above is inviolable. Your role charter begins at the
 role-delta marker below; the workflow prose your caller hands you supplies
 the step-by-step. This shared core binds every role:

package/.agents/audit-checklists/quality.md

@@ -21,3 +21,6 @@ Self-check your change against this lens's concerns before you ship:
 - [ ] Unwired Seams — Coverage Without a Caller (mandatory).
 - [ ] A produced-but-never-consumed artifact
 - [ ] An optional field nothing populates
+- [ ] Property-Based Coverage — Invariants Tested Only by Examples.
+- [ ] Toolchain by ecosystem, never one library.
+- [ ] Name the property.

package/.agents/docs/agentrc-reference.json

@@ -223,17 +223,9 @@
           "name": "native"
         },
         {
-          "name": "security-review",
+          "name": "code-review",
           "scopes": ["story"],
           "optional": true
-        },
-        {
-          "name": "ultrareview",
-          "scopes": ["story"],
-          "manualPrompt": true,
-          "when": {
-            "label": "risk::high"
-          }
         }
       ],
       "autoFixSeverity": "medium"

package/.agents/docs/configuration.md

@@ -229,12 +229,12 @@ Everything `/mandrel-deliver` and `single-story-close` consume: worktree isolati
 | `quality.navigability.routeGlobs` | No | `array<string>` | `[]` | Glob patterns (pages/**, app/**/route.ts) marking paths that add a user-facing route — the route-tree SSOT the navigability lens enumerates and the route-added routing predicate matches against. |
 | `quality.navigability.navRegistry` | No | `array<string>` | `[]` | Tokens identifying the nav-registry SSOT the navigability lens checks every route resolves a nav door against. |
 | `quality.navigability.journeySuite` | No | `string` | — | Path or command for the per-persona journey suite /mandrel-deliver's per-Story ceremony runs. |
-| `mergeWatch` | No | `object` | — | Knobs consumed by the close-and-land merge wait (Story #4543). `mode` (Story #4698) selects the close-time merge posture. `maxWaitSeconds` bounds ONE invocation of the merge wait and its expiry returns a resumable `pending` terminal with no label mutation; `maxBudgetSeconds` bounds the CUMULATIVE wait across resumes (anchored at the PR's createdAt, so a resume does not restart the clock) and exhausting it is the genuine give-up that classifies and blocks. The 30s poll cadence and the cap of 3 behind-the-base updates are fixed. |
+| `mergeWatch` | No | `object` | — | Knobs consumed by the close-and-land merge wait (Story #4543). `mode` (Story #4698) selects the close-time merge posture. `maxWaitSeconds` bounds ONE invocation of the merge wait and its expiry returns a resumable `pending` terminal with no label mutation; `maxBudgetSeconds` bounds the CUMULATIVE wait across resumes (anchored at the PR's createdAt, so a resume does not restart the clock) and exhausting it is the genuine give-up that classifies and blocks. The poll cadence is internal (at most 30s while checks run, at most 10s once they are green and the PR is unmerged); it and the cap of 3 behind-the-base updates are not configurable. |
 | `mergeWatch.mode` | No | `"sync"` \| `"async"` | — | Close-time merge-wait posture (Story #4698). `sync` (default) keeps the in-close foreground merge wait unchanged. `async` caps the per-invocation wait to a short ~60s probe window — long enough to catch an instant merge and, via the head-anchored required-check predicate, an instantly-red required check — then returns the resumable `pending` terminal (exit 3) with a `nextCommand`. Opt in when slow CI makes the foreground wait routinely expire: the worker launches `nextCommand` in the background instead of burning the host tool slot polling. `maxBudgetSeconds` (the cumulative give-up) is unchanged. |
 | `mergeWatch.maxWaitSeconds` | No | `integer` | — | Per-invocation merge-wait bound (seconds). Default 300 (5 minutes) — chosen to fit inside a single host tool invocation (~10 min ceiling) alongside the close gates that precede the wait. Expiry yields `pending` (exit 3), never a block. Headless callers with no host ceiling raise this to land in one block. |
 | `mergeWatch.maxBudgetSeconds` | No | `integer` | `3600` | Cumulative wall-clock budget (seconds) across merge-wait resumes, anchored at the PR's createdAt. Default 3600 (60 minutes). Exhausting this classifies the block and transitions the Story to agent::blocked. |
 | `codeReview` | No | `object` | — | Review-provider chain and on-branch remediation threshold for the /mandrel-deliver code-review ceremony. |
-| `codeReview.providers[]` | No | `array<object>` | `[{"name":"native"},{"name":"security-review","scopes":["story"],"optional":true},{"name":"ultrareview","scopes":["story"],"manualPrompt":true,"when":{"label":"risk::high"}}]` | Review-provider chain (Story #2871). When unset or empty, defaults to [{ name: "native" }]. The orchestrator iterates inline entries in declaration order and merges their Finding[] before posting one structured comment; manual-prompt entries (e.g. ultrareview) contribute a trailing 'Manual review suggestions' section. Selecting an adapter whose probe fails hard-fails at factory construction unless declared `optional: true` in the chain. Each item has: name, scopes, optional, manualPrompt, when. |
+| `codeReview.providers[]` | No | `array<object>` | `[{"name":"native"},{"name":"code-review","scopes":["story"],"optional":true}]` | Review-provider chain (Story #2871). When unset or empty, falls back to this default: `native` (scoped lint + MI) then an optional story-scoped `code-review` — a low-effort `claude --print` bug review whose every finding is critical and halts close before auto-merge; hosts without the `claude` CLI skip it. `security-review` and `ultrareview` are opt-in. The orchestrator iterates inline entries in declaration order and merges their Finding[] before posting one structured comment; manual-prompt entries (e.g. ultrareview) contribute a trailing 'Manual review suggestions' section. Selecting an adapter whose probe fails hard-fails at factory construction unless declared `optional: true` in the chain. Each item has: name, scopes, optional, manualPrompt, when. |
 | `codeReview.autoFixSeverity` | No | `"high"` \| `"medium"` | `"medium"` | Severity threshold for on-branch remediation in /mandrel-deliver Phase 5 (code-review). `medium` (default) routes 🔴/🟠/🟡 findings into the host-LLM focused-fix routing (Mediums batched per lens: one commit per lens, a single validation + rescan at the end) while 🟢 suggestions still graduate to follow-up issues; `high` reproduces the pre-4399 Critical/High-only routing. Hard cutover — no back-compat flag. |
 | `refactorStage` | No | `object` | — | Opt-in, config-gated post-green refactor checkpoint wired into story-deliver (Story #3430, Epic #3418). Strictly additive and default-OFF: when disabled, story-deliver behaves exactly as before. Advisory only — never changes existing close-validation gate semantics. |
 | `refactorStage.enabled` | No | `boolean` | `false` | When true, story-deliver runs an advisory post-green refactor stage (core/code-review-and-quality skill, Post-Green Refactor Pass) after the suite is green. Default false — when unset the stage is skipped and close-validation gate semantics are unchanged. |
@@ -248,7 +248,7 @@ Everything `/mandrel-deliver` and `single-story-close` consume: worktree isolati
 | `ci.advisoryAllowlist` | No | `array<string>` | `[]` | Story #5096. Check-run names exempt from blockOnAdvisoryFailure — a red run whose name matches exactly never blocks arming. Matching is exact; an unnamed run can never match and always blocks. |
 | `ci.rerunAdvisory` | No | `integer` | `0` | Story #5266. How many times close may re-run a failed advisory workflow run before blocking on it, per close invocation. Default 0: close spends no CI minutes and issues no GitHub mutation on an advisory red unless asked. At n > 0 the failed run(s) are re-run within that allowance and the merge wait re-polls inside its existing budget, landing or blocking on the re-run verdict. Overridden per invocation by --rerun-advisory <n>. |
 | `routing` | No | `object` | — | v2 delivery-spawn routing: role-scoped boot contexts and the ceremony profile. The v1 singleDelivery epic-route kill-switch was removed in Stage 6; the freshCriticSampleRate sampling floor was retired in Story #5313 and the derived-level ceremony routing in Story #5343. |
-| `routing.roleScopedAgents` | No | `boolean` | `true` | Epic #4478 (M7-B). Kill-switch for the role-scoped boot contexts. When true (default), a converted delivery spawn (`story-worker`, `acceptance-critic`) boots on its own `.claude/agents/<role>.md` system prompt instead of re-paying the full CLAUDE.md @-import closure. When false, every converted spawn falls back to `subagent_type: general-purpose` — the instant, code-rollback-free per-consumer revert, and the universal escape for hosts that ignore `.claude/agents/`. The fallback is the full-closure agent that ran before M7-B, so flipping it off never drops a gate. |
+| `routing.roleScopedAgents` | No | `boolean` | `true` | Epic #4478 (M7-B). Kill-switch for the role-scoped boot contexts. When true (default), a converted delivery spawn (`story-worker`, `acceptance-critic`) boots on its own `.claude/agents/<role>.md` system prompt instead of re-paying the full entry-doc (AGENTS.md or CLAUDE.md) @-import closure. When false, every converted spawn falls back to `subagent_type: general-purpose` — the instant, code-rollback-free per-consumer revert, and the universal escape for hosts that ignore `.claude/agents/`. The fallback is the full-closure agent that ran before M7-B, so flipping it off never drops a gate. |
 | `routing.ceremonyProfile` | No | `"minimal"` \| `"standard"` \| `"strict"` | `"standard"` | Acceptance-ceremony depth — who authors the Story acceptance verdict. minimal and standard (default) = the inline self-eval, whatever the diff touches; strict = a fresh-context maker-blind critic. Review depth is a separate decision and still derives `deep` for any sensitive path (review-depth.js). |
 | `routing.closeAndLand` | No | `boolean` | `true` | When true (default), single-story-close lands through merge in one close. Opt out per-run with --no-wait-merge. |
 
@@ -386,15 +386,16 @@ then skips `npm ci` and junctions/symlinks the donor's `node_modules`.
 
 #### `delivery.codeReview` — provider chain
 
-`providers[]` is iterated in declaration order (unset/empty →
-`[{ name: "native" }]`). Beyond the field list in the generated table: `scopes`
+`providers[]` is iterated in declaration order (unset/empty → `native` plus
+an optional story-scoped `code-review`, the low-effort `claude --print` bug
+review whose every finding is critical and halts close). Beyond the field list in the generated table: `scopes`
 defaults to both `story` and `epic`; `when` is a label predicate (`when.label`
 / `when.labelAny`) that silently skips the entry when false; `manualPrompt`
 entries contribute a one-line suggestion and do **not** affect severity counts
 or the `halted` gate. **Cross-runtime contract:** manual-prompt providers emit
 Markdown only and MUST NEVER throw under any host; inline providers that shell
-out to a host-specific binary (e.g. `security-review` →
-`claude --print /security-review`) SHOULD be declared `optional: true` so
+out to a host-specific binary (e.g. `code-review` / `security-review` →
+`claude --print`) SHOULD be declared `optional: true` so
 non-Claude consumers can pin the same `.agents/` version unmodified. The fix
 budget (`maxFixAttempts` / `maxFixScopeFiles`) uses the same values for every
 Story in a run — there is no per-Story override.

package/.agents/schemas/agentrc.schema.json

@@ -1180,7 +1180,7 @@
         },
         "mergeWatch": {
           "type": "object",
-          "description": "Knobs consumed by the close-and-land merge wait (Story #4543). `mode` (Story #4698) selects the close-time merge posture. `maxWaitSeconds` bounds ONE invocation of the merge wait and its expiry returns a resumable `pending` terminal with no label mutation; `maxBudgetSeconds` bounds the CUMULATIVE wait across resumes (anchored at the PR's createdAt, so a resume does not restart the clock) and exhausting it is the genuine give-up that classifies and blocks. The 30s poll cadence and the cap of 3 behind-the-base updates are fixed.",
+          "description": "Knobs consumed by the close-and-land merge wait (Story #4543). `mode` (Story #4698) selects the close-time merge posture. `maxWaitSeconds` bounds ONE invocation of the merge wait and its expiry returns a resumable `pending` terminal with no label mutation; `maxBudgetSeconds` bounds the CUMULATIVE wait across resumes (anchored at the PR's createdAt, so a resume does not restart the clock) and exhausting it is the genuine give-up that classifies and blocks. The poll cadence is internal (at most 30s while checks run, at most 10s once they are green and the PR is unmerged); it and the cap of 3 behind-the-base updates are not configurable.",
           "properties": {
             "mode": {
               "type": "string",
@@ -1215,11 +1215,12 @@
                     "type": "string",
                     "enum": [
                       "native",
+                      "code-review",
                       "codex",
                       "security-review",
                       "ultrareview"
                     ],
-                    "description": "Registered provider key. Inline: native, codex, security-review. Manual-prompt: ultrareview."
+                    "description": "Registered provider key. Inline: native, code-review, codex, security-review. Manual-prompt: ultrareview."
                   },
                   "scopes": {
                     "type": "array",
@@ -1263,23 +1264,15 @@
                 },
                 "additionalProperties": false
               },
-              "description": "Review-provider chain (Story #2871). When unset or empty, defaults to [{ name: \"native\" }]. The orchestrator iterates inline entries in declaration order and merges their Finding[] before posting one structured comment; manual-prompt entries (e.g. ultrareview) contribute a trailing 'Manual review suggestions' section. Selecting an adapter whose probe fails hard-fails at factory construction unless declared `optional: true` in the chain.",
+              "description": "Review-provider chain (Story #2871). When unset or empty, falls back to this default: `native` (scoped lint + MI) then an optional story-scoped `code-review` — a low-effort `claude --print` bug review whose every finding is critical and halts close before auto-merge; hosts without the `claude` CLI skip it. `security-review` and `ultrareview` are opt-in. The orchestrator iterates inline entries in declaration order and merges their Finding[] before posting one structured comment; manual-prompt entries (e.g. ultrareview) contribute a trailing 'Manual review suggestions' section. Selecting an adapter whose probe fails hard-fails at factory construction unless declared `optional: true` in the chain.",
               "default": [
                 {
                   "name": "native"
                 },
                 {
-                  "name": "security-review",
+                  "name": "code-review",
                   "scopes": ["story"],
                   "optional": true
-                },
-                {
-                  "name": "ultrareview",
-                  "scopes": ["story"],
-                  "manualPrompt": true,
-                  "when": {
-                    "label": "risk::high"
-                  }
                 }
               ]
             },
@@ -1367,7 +1360,7 @@
           "properties": {
             "roleScopedAgents": {
               "type": "boolean",
-              "description": "Epic #4478 (M7-B). Kill-switch for the role-scoped boot contexts. When true (default), a converted delivery spawn (`story-worker`, `acceptance-critic`) boots on its own `.claude/agents/<role>.md` system prompt instead of re-paying the full CLAUDE.md @-import closure. When false, every converted spawn falls back to `subagent_type: general-purpose` — the instant, code-rollback-free per-consumer revert, and the universal escape for hosts that ignore `.claude/agents/`. The fallback is the full-closure agent that ran before M7-B, so flipping it off never drops a gate.",
+              "description": "Epic #4478 (M7-B). Kill-switch for the role-scoped boot contexts. When true (default), a converted delivery spawn (`story-worker`, `acceptance-critic`) boots on its own `.claude/agents/<role>.md` system prompt instead of re-paying the full entry-doc (AGENTS.md or CLAUDE.md) @-import closure. When false, every converted spawn falls back to `subagent_type: general-purpose` — the instant, code-rollback-free per-consumer revert, and the universal escape for hosts that ignore `.claude/agents/`. The fallback is the full-closure agent that ran before M7-B, so flipping it off never drops a gate.",
               "default": true
             },
             "ceremonyProfile": {

package/.agents/schemas/audit-rules.schema.json

@@ -2,7 +2,7 @@
   "$schema": "http://json-schema.org/draft-07/schema#",
   "$id": "https://mandrel.dev/schemas/audit-rules.schema.json",
   "title": "AuditRulesManifest",
-  "description": "Schema describing the audit-rules.json manifest read by lib/audit-suite/selector.js and lib/audit-suite/runner.js. The manifest enumerates registered audit workflows and the triggers / substitution keys each one accepts, plus the sensitive-path classes that derive review depth from a change set.",
+  "description": "Schema describing the audit-rules.json manifest read by lib/audit-suite/selector.js and lib/audit-suite/checklist-threading.js. The manifest enumerates registered audit workflows and the triggers / substitution keys each one accepts, plus the sensitive-path classes that derive review depth from a change set.",
   "type": "object",
   "required": ["version", "audits"],
   "additionalProperties": false,

package/.agents/schemas/story-deliver-terminal.schema.json

@@ -204,6 +204,11 @@
       },
       "additionalProperties": false
     },
+    "phaseDurations": {
+      "type": ["object", "null"],
+      "description": "Story #5417 — wall-clock seconds per close phase that ran (wrong-tree-guard, base-sync, close-validation, push, pull-request, code-review, auto-merge, confirm-merge, post-land). Optional and additive; absent or null when no phase was timed.",
+      "additionalProperties": { "type": "number", "minimum": 0 }
+    },
     "timestamp": { "type": "string", "format": "date-time" }
   },
   "allOf": [

package/.agents/scripts/bootstrap.js

@@ -10,7 +10,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import readline from 'node:readline/promises';
 import { fileURLToPath } from 'node:url';
-
+import { stageLegacyEntryDocRemoval } from './lib/bootstrap/agents-md-fold.js';
 import {
   buildManualInstructions,
   COMMIT_SUBJECT,
@@ -1068,7 +1068,13 @@ export async function offerCommitPush(state, deps = {}) {
     return { ok: true, payload: { commitPush: { action: 'declined' } } };
   }
 
-  const staged = stageBootstrapFiles({ projectRoot: cwd, runGit: runGitImpl });
+  const added = stageBootstrapFiles({ projectRoot: cwd, runGit: runGitImpl });
+  // The folded-away CLAUDE.md deletion rides the same commit.
+  const staged = stageLegacyEntryDocRemoval({
+    projectRoot: cwd,
+    runGit: runGitImpl,
+    after: added,
+  });
   if (!staged.ok) {
     Logger.warn(`[Bootstrap] Could not stage the wiring: ${staged.error}`);
     Logger.info(`\n[Bootstrap] ${instructions}`);

package/.agents/scripts/check-context-budget.js

@@ -1,6 +1,6 @@
 /**
  * CLI: ratchet gate for documentation context bytes against
- * `baselines/context-budget.json`. Measures `alwaysLoaded` (the `CLAUDE.md`
+ * `baselines/context-budget.json`. Measures `alwaysLoaded` (the entry-doc
  * `@`-import closure), `mandatoryRead` (`project.docsContextFiles`) and
  * `workflow` (entry points + `mandatoryReads:` closure).
  *

package/.agents/scripts/lib/ITicketingProvider.js

@@ -105,9 +105,7 @@ export class ITicketingProvider {
   }
 
   /**
-   * Resolve a container parent in one call. Returns `null` (never throws) when
-   * there is no parent or the backend cannot answer, so a degraded lookup
-   * never fails a lifecycle edge.
+   * `null` means "no parent"; throws when the lookup cannot answer.
    *
    * @param {number} _number
    * @returns {Promise<object|null>}

package/.agents/scripts/lib/audit-suite/findings.js

@@ -1,27 +1,11 @@
 /**
- * Findings severity histogram and per-component baseline rollup deltas.
+ * The surviving-Critical halting rule and per-component baseline rollup deltas.
  * Deltas are per rollup, not per row: row churn that moves no rollup is noise.
  * Pure, no I/O.
  */
 
 import { groupRows, resolveComponents } from '../baselines/components.js';
 
-/**
- * Non-standard severities are ignored.
- *
- * @param {Array<{ severity?: string }>|null|undefined} findings
- * @returns {{ critical: number, high: number, medium: number, low: number }}
- */
-export function aggregateSummary(findings) {
-  const summary = { critical: 0, high: 0, medium: 0, low: 0 };
-  for (const finding of findings ?? []) {
-    if (Object.hasOwn(summary, finding.severity)) {
-      summary[finding.severity] += 1;
-    }
-  }
-  return summary;
-}
-
 /**
  * The single halting rule: a surviving Critical finding halts delivery. Every
  * consumer routes through this rather than re-deriving `critical > 0`.

package/.agents/scripts/lib/audit-suite/frontmatter.js

@@ -8,8 +8,6 @@
 // biome-ignore-start lint/complexity/useRegexLiterals: typhonjs-escomplex MI workaround
 const FRONTMATTER_RE = new RegExp(String.raw`^---\r?\n([\s\S]*?)\r?\n---\r?\n`);
 const NEWLINE_SPLIT_RE = new RegExp(String.raw`\r?\n`);
-const PARAGRAPH_SPLIT_RE = new RegExp(String.raw`\r?\n\s*\r?\n`);
-const COLLAPSE_WS_RE = new RegExp(String.raw`\s+`, 'g');
 const SENTENCE_RE = new RegExp(String.raw`[^.!?\n]+[.!?]+`, 'g');
 // biome-ignore-end lint/complexity/useRegexLiterals: typhonjs-escomplex MI workaround
 
@@ -42,22 +40,6 @@ export function extractFrontmatter(content) {
   return fm;
 }
 
-/**
- * @param {string} content
- * @returns {string}
- */
-export function firstProseParagraph(content) {
-  const stripped = content.replace(FRONTMATTER_RE, '');
-  for (const block of stripped.split(PARAGRAPH_SPLIT_RE)) {
-    const trimmed = block.trim();
-    if (!trimmed) continue;
-    if (trimmed.startsWith('#')) continue;
-    if (trimmed.startsWith('---')) continue;
-    return trimmed.replace(COLLAPSE_WS_RE, ' ');
-  }
-  return '';
-}
-
 /**
  * @param {string} text
  * @returns {string}
@@ -74,13 +56,3 @@ export function clampSummary(text) {
   }
   return result;
 }
-
-/**
- * @param {string} content
- * @returns {string}
- */
-export function summarizeWorkflow(content) {
-  const fm = extractFrontmatter(content);
-  const candidate = fm.description?.trim() || firstProseParagraph(content);
-  return clampSummary(candidate);
-}

package/.agents/scripts/lib/audit-suite/index.js

@@ -7,16 +7,10 @@ export {
   readAuditRules,
 } from './checklist-threading.js';
 export { buildDispatchChecklist } from './dispatch-checklist.js';
-export {
-  countChangedLines,
-  evaluateLensDiffFloor,
-} from './lens-diff-floor.js';
-export { runAuditSuite } from './runner.js';
 export {
   LENS_TIERS,
   matchesAnyFilePattern,
   matchesFilePattern,
   resolveLensTier,
   selectAudits,
-  selectLocalLenses,
 } from './selector.js';

package/.agents/scripts/lib/audit-suite/selector.js

@@ -45,37 +45,6 @@ export function resolveLensTier(lens) {
   return scope;
 }
 
-/**
- * Local-tier lenses whose `filePatterns` hit the change set (not
- * {@link selectAudits}, which would widen it with keyword matches).
- *
- * @param {{
- *   changedFiles?: string[],
- *   injectedRules?: { audits?: Record<string, object> },
- *   resolveLensTierFn?: typeof resolveLensTier,
- * }} [params]
- * @returns {string[]} The matched local-lens identifiers, in manifest order.
- */
-export function selectLocalLenses({
-  changedFiles,
-  injectedRules,
-  resolveLensTierFn = resolveLensTier,
-} = {}) {
-  const files = Array.isArray(changedFiles) ? changedFiles : [];
-  if (files.length === 0) return [];
-
-  const rules = injectedRules ?? readAuditRulesSync();
-  const selected = [];
-  for (const [lens, entry] of Object.entries(rules.audits ?? {})) {
-    if (resolveLensTierFn(lens) !== 'local') continue;
-    const patterns = entry?.triggers?.filePatterns ?? [];
-    if (matchesAnyFilePattern(patterns, files)) {
-      selected.push(lens);
-    }
-  }
-  return selected;
-}
-
 /**
  * Manifest `sensitivePaths` classes the change set touches (review depth).
  *

package/.agents/scripts/lib/bootstrap/agents-md-fold.js

@@ -0,0 +1,156 @@
+/**
+ * CLAUDE.md → AGENTS.md fold for bootstrap and the update migration: a
+ * surviving CLAUDE.md would shadow AGENTS.md, since the host prefers it.
+ *
+ * @module bootstrap/agents-md-fold
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+
+/** Entry-doc wiring keys idempotence off this exact import path. */
+export const SYSTEM_PROMPT_IMPORT = '@.agents/instructions.md';
+
+export const SYSTEM_PROMPT_BLOCK = `## System Prompt
+
+${SYSTEM_PROMPT_IMPORT}
+`;
+
+/** Install template for a fresh entry doc. */
+export const SYSTEM_PROMPT_ENTRY_DOC = `# Agent Protocols
+
+${SYSTEM_PROMPT_BLOCK}`;
+
+const ENTRY_DOC = 'AGENTS.md';
+export const LEGACY_ENTRY_DOC = 'CLAUDE.md';
+
+const SELF_IMPORT = '@AGENTS.md';
+
+/** @type {readonly string[]} */
+const BOOTSTRAP_REMOVED_PATHS = Object.freeze([LEGACY_ENTRY_DOC]);
+
+/**
+ * @param {string} text
+ * @returns {string}
+ */
+function withTrailingNewline(text) {
+  return text.length === 0 || text.endsWith('\n') ? text : `${text}\n`;
+}
+
+/**
+ * Keep the first system-prompt import line, drop every later one.
+ *
+ * @param {string[]} lines
+ * @returns {string[]}
+ */
+function dedupeImport(lines) {
+  let seen = false;
+  return lines.filter((line) => {
+    if (line.trim() !== SYSTEM_PROMPT_IMPORT) return true;
+    if (seen) return false;
+    seen = true;
+    return true;
+  });
+}
+
+/**
+ * `agents` null means AGENTS.md is absent.
+ *
+ * @param {{ claude: string, agents?: string|null }} input
+ * @returns {string} the resulting AGENTS.md content
+ */
+function foldEntryDocs({ claude, agents = null }) {
+  const claudeBody = claude
+    .split('\n')
+    .filter((line) => line.trim() !== SELF_IMPORT)
+    .join('\n');
+  const combined =
+    typeof agents === 'string'
+      ? `${withTrailingNewline(agents)}\n${claudeBody}`
+      : claudeBody;
+  const lines = dedupeImport(combined.split('\n'));
+  let result = withTrailingNewline(lines.join('\n'));
+  if (!lines.some((line) => line.trim() === SYSTEM_PROMPT_IMPORT)) {
+    result =
+      result.trim().length === 0
+        ? SYSTEM_PROMPT_ENTRY_DOC
+        : `${result}\n${SYSTEM_PROMPT_BLOCK}`;
+  }
+  return result;
+}
+
+/**
+ * Fold a root CLAUDE.md into AGENTS.md on disk and delete CLAUDE.md. No-op
+ * when CLAUDE.md is absent, so a second pass mutates nothing.
+ *
+ * @param {string} projectRoot
+ * @param {typeof fs} [fsImpl]
+ * @returns {{ action: 'folded'|'none', path: string }}
+ */
+export function foldClaudeMdIntoAgentsMd(projectRoot, fsImpl = fs) {
+  const claudePath = path.join(projectRoot, LEGACY_ENTRY_DOC);
+  const agentsPath = path.join(projectRoot, ENTRY_DOC);
+  if (!fsImpl.existsSync(claudePath)) {
+    return { action: 'none', path: agentsPath };
+  }
+  const claude = fsImpl.readFileSync(claudePath, 'utf8');
+  const agents = fsImpl.existsSync(agentsPath)
+    ? fsImpl.readFileSync(agentsPath, 'utf8')
+    : null;
+  fsImpl.writeFileSync(agentsPath, foldEntryDocs({ claude, agents }), 'utf8');
+  fsImpl.rmSync(claudePath, { force: true });
+  return { action: 'folded', path: agentsPath };
+}
+
+/**
+ * Wire the system-prompt import into AGENTS.md, folding a CLAUDE.md in first.
+ * Creates, folds, appends, or no-ops.
+ *
+ * @param {string} projectRoot
+ * @param {typeof fs} [fsImpl]
+ * @returns {{ action: 'created'|'folded'|'appended'|'already-present', path: string }}
+ */
+export function wireEntryDoc(projectRoot, fsImpl = fs) {
+  const folded = foldClaudeMdIntoAgentsMd(projectRoot, fsImpl);
+  const target = folded.path;
+  if (folded.action === 'folded') return folded;
+  if (!fsImpl.existsSync(target)) {
+    fsImpl.writeFileSync(target, SYSTEM_PROMPT_ENTRY_DOC, 'utf8');
+    return { action: 'created', path: target };
+  }
+  const existing = fsImpl.readFileSync(target, 'utf8');
+  if (existing.includes(SYSTEM_PROMPT_IMPORT)) {
+    return { action: 'already-present', path: target };
+  }
+  const separator = existing.length > 0 && !existing.endsWith('\n') ? '\n' : '';
+  fsImpl.writeFileSync(
+    target,
+    `${existing}${separator}\n${SYSTEM_PROMPT_BLOCK}`,
+    'utf8',
+  );
+  return { action: 'appended', path: target };
+}
+
+/**
+ * Stage removal of folded-away entry docs; a failed `after` passes through.
+ *
+ * @param {{ after?: { ok: boolean, error?: string }, projectRoot: string, runGit: (args: string[], cwd: string) => { ok: boolean, stderr?: string }, fsImpl?: typeof fs }} args
+ * @returns {{ ok: boolean, error?: string, removed: string[] }}
+ */
+export function stageLegacyEntryDocRemoval({
+  projectRoot,
+  runGit,
+  fsImpl = fs,
+  after = { ok: true },
+}) {
+  if (!after.ok) return after;
+  const removed = BOOTSTRAP_REMOVED_PATHS.filter(
+    (rel) => !fsImpl.existsSync(path.join(projectRoot, rel)),
+  );
+  if (removed.length === 0) return { ok: true, removed };
+  const result = runGit(
+    ['rm', '--cached', '--ignore-unmatch', '--quiet', '--', ...removed],
+    projectRoot,
+  );
+  return { ok: result.ok, error: result.stderr || 'git rm failed', removed };
+}

package/.agents/scripts/lib/bootstrap/commit-push.js

@@ -19,7 +19,7 @@ import path from 'node:path';
 export const BOOTSTRAP_COMMIT_PATHS = Object.freeze([
   '.agents',
   '.agentrc.json',
-  'CLAUDE.md',
+  'AGENTS.md',
   '.claude/settings.json',
   '.gitignore',
   'package.json',

package/.agents/scripts/lib/bootstrap/manifest.js

@@ -62,10 +62,10 @@ export function buildMutationManifest(ctx = {}) {
   entries.push(
     {
       phaseGroup: PHASE_GROUPS.IDE_WIRING,
-      target: rel('CLAUDE.md'),
+      target: rel('AGENTS.md'),
       action: 'merge',
       detail:
-        'Wire the @.agents/instructions.md system-prompt import so Claude Code hydrates the framework on cold start.',
+        'Wire the @.agents/instructions.md system-prompt import into AGENTS.md (folding any CLAUDE.md into it) so Claude Code hydrates the framework on cold start.',
       reversible: true,
     },
     {