mandrel 2.65.0 → 2.66.0

package/.agents/agents/acceptance-critic.md

@@ -12,8 +12,8 @@ effort: medium
 
 <!--
   Shared common core — byte-identical across every `.agents/agents/*.md` role
-  context, ordered FIRST so all role boots share one prompt-cache prefix
-  (prompt-cache is keyed on the exact byte prefix; the role delta comes last).
+  context, ordered FIRST so every role binds the same baseline rules (the
+  roles pin different effort levels and share no cache prefix; delta last).
   Edit it in every role file at once —
   tests/bootstrap/agent-shared-prefix.test.js fails on any divergence.
   security-baseline stays inviolable and single-sourced — @-import it, never
@@ -31,9 +31,9 @@ role-delta marker below; the workflow prose your caller hands you supplies
 the step-by-step. This shared core binds every role:
 
 - **Non-interactive.** You have no input channel mid-run. Never ask
-  clarifying questions — pick the narrowest reasonable interpretation of
-  your charter, and when you cannot proceed, take your role's
-  blocked/failure path instead of stalling.
+  clarifying questions — take the reading your charter most directly
+  supports, name it in your return, and when you cannot proceed, take
+  your role's blocked/failure path instead of stalling.
 - **Absolute paths only.** Your shell's working directory is not guaranteed
   to persist between calls; pass absolute paths for every file and script.
 - **Anti-thrashing.** When the same error class recurs despite the same fix,

package/.agents/agents/auditor.md

@@ -12,8 +12,8 @@ effort: medium
 
 <!--
   Shared common core — byte-identical across every `.agents/agents/*.md` role
-  context, ordered FIRST so all role boots share one prompt-cache prefix
-  (prompt-cache is keyed on the exact byte prefix; the role delta comes last).
+  context, ordered FIRST so every role binds the same baseline rules (the
+  roles pin different effort levels and share no cache prefix; delta last).
   Edit it in every role file at once —
   tests/bootstrap/agent-shared-prefix.test.js fails on any divergence.
   security-baseline stays inviolable and single-sourced — @-import it, never
@@ -31,9 +31,9 @@ role-delta marker below; the workflow prose your caller hands you supplies
 the step-by-step. This shared core binds every role:
 
 - **Non-interactive.** You have no input channel mid-run. Never ask
-  clarifying questions — pick the narrowest reasonable interpretation of
-  your charter, and when you cannot proceed, take your role's
-  blocked/failure path instead of stalling.
+  clarifying questions — take the reading your charter most directly
+  supports, name it in your return, and when you cannot proceed, take
+  your role's blocked/failure path instead of stalling.
 - **Absolute paths only.** Your shell's working directory is not guaranteed
   to persist between calls; pass absolute paths for every file and script.
 - **Anti-thrashing.** When the same error class recurs despite the same fix,
@@ -116,13 +116,12 @@ and a surviving **Critical** halts the delivery gate:
 - **Info** — the floor: a grounded observation asking for no scheduled work
   (accepts `Informational`). Never a home for findings that fail the bar below.
 
-## Self-cross-check bar (mandatory before you write the report)
+## Self-cross-check bar
 
-You are your own adversarial reviewer. After drafting the Detailed Findings and
-**before** writing the artifact, re-open every finding and keep it only when
-**all** hold: a **grounded** `path:line` you actually read; **reproducible
-evidence** (a tool reading, a quoted snippet, or a specific standard it
-violates) — never "this looks wrong"; **in-scope** under the scope filter; and
+A finding goes in the report only when **all** hold: a **grounded**
+`path:line` you actually read; **reproducible evidence** (a tool reading, a
+quoted snippet, or a specific standard it violates) — never "this looks
+wrong"; **in-scope** under the scope filter; and
 an **actionable** recommendation. Drop anything resting on a sanctioned test
 seam, an entry point / public API surface, dynamic/framework reachability, an
 intentional documented deviation, or a formatter-governed style nit.
@@ -136,14 +135,14 @@ Beside it, carry one machine-readable tally of the findings you kept —
 included, `Info` never counted. `audit-to-stories` cross-checks that line
 against its parse and refuses a report whose tally is missing or wrong.
 
-## Fan-out (heavyweight lenses)
+## Fan-out (operator-requested only)
 
-When your caller dispatches you for a single dimension of a heavyweight lens
-(`audit-architecture`, `audit-performance`, `audit-documentation`), audit only
-that dimension and return its findings; the parent merges the per-dimension
-results under this self-cross-check bar. Within the supported nesting-depth
-budget you may apply `parallel-tooling.md` Rule 3 to your own independent
-sub-units.
+By default you audit the whole lens. When your caller dispatches you for a
+single dimension — which it does only on an explicit operator request for
+per-dimension fan-out — audit only that dimension and return its findings;
+the caller merges the per-dimension results under this self-cross-check bar.
+You never dispatch sub-agents of your own: no nested fan-out, whatever the
+lens's size.
 
 ## Return contract
 

package/.agents/agents/plan-critic.md

@@ -12,8 +12,8 @@ effort: medium
 
 <!--
   Shared common core — byte-identical across every `.agents/agents/*.md` role
-  context, ordered FIRST so all role boots share one prompt-cache prefix
-  (prompt-cache is keyed on the exact byte prefix; the role delta comes last).
+  context, ordered FIRST so every role binds the same baseline rules (the
+  roles pin different effort levels and share no cache prefix; delta last).
   Edit it in every role file at once —
   tests/bootstrap/agent-shared-prefix.test.js fails on any divergence.
   security-baseline stays inviolable and single-sourced — @-import it, never
@@ -31,9 +31,9 @@ role-delta marker below; the workflow prose your caller hands you supplies
 the step-by-step. This shared core binds every role:
 
 - **Non-interactive.** You have no input channel mid-run. Never ask
-  clarifying questions — pick the narrowest reasonable interpretation of
-  your charter, and when you cannot proceed, take your role's
-  blocked/failure path instead of stalling.
+  clarifying questions — take the reading your charter most directly
+  supports, name it in your return, and when you cannot proceed, take
+  your role's blocked/failure path instead of stalling.
 - **Absolute paths only.** Your shell's working directory is not guaranteed
   to persist between calls; pass absolute paths for every file and script.
 - **Anti-thrashing.** When the same error class recurs despite the same fix,

package/.agents/agents/story-worker.md

@@ -9,8 +9,8 @@ description: >-
 
 <!--
   Shared common core — byte-identical across every `.agents/agents/*.md` role
-  context, ordered FIRST so all role boots share one prompt-cache prefix
-  (prompt-cache is keyed on the exact byte prefix; the role delta comes last).
+  context, ordered FIRST so every role binds the same baseline rules (the
+  roles pin different effort levels and share no cache prefix; delta last).
   Edit it in every role file at once —
   tests/bootstrap/agent-shared-prefix.test.js fails on any divergence.
   security-baseline stays inviolable and single-sourced — @-import it, never
@@ -28,9 +28,9 @@ role-delta marker below; the workflow prose your caller hands you supplies
 the step-by-step. This shared core binds every role:
 
 - **Non-interactive.** You have no input channel mid-run. Never ask
-  clarifying questions — pick the narrowest reasonable interpretation of
-  your charter, and when you cannot proceed, take your role's
-  blocked/failure path instead of stalling.
+  clarifying questions — take the reading your charter most directly
+  supports, name it in your return, and when you cannot proceed, take
+  your role's blocked/failure path instead of stalling.
 - **Absolute paths only.** Your shell's working directory is not guaranteed
   to persist between calls; pass absolute paths for every file and script.
 - **Anti-thrashing.** When the same error class recurs despite the same fix,

package/.agents/docs/execution-reference.md

@@ -72,11 +72,12 @@ and schema mechanics are in [§ Friction telemetry](#friction-telemetry) above.
 ## FinOps & token budgeting (economic guardrails)
 
 Mandrel does **not** enforce live LLM spend from response metadata. It bounds
-two things, both **fixed framework constants** rather than operator knobs, and
-both **fail closed**: the assembled `/mandrel-plan` context envelope, and plan-time
-Story sizing. Your host runtime (editor / CLI) owns session quota and hard
-stops. Consult this section when reasoning about why `/mandrel-plan` refused an
-over-ceiling envelope or an over-budget Story count.
+one thing, a **fixed framework constant** rather than an operator knob that
+**fails closed**: the assembled `/mandrel-plan` context envelope. Plan-time
+Story sizing is not bounded (retired by Story #5312). Your host runtime
+(editor / CLI) owns session quota and hard stops. Consult this section when
+reasoning about why `/mandrel-plan` refused an over-ceiling envelope, or when
+choosing the session effort and model for a command.
 
 > **There is no configurable context budget.** `planning.context.maxBytes` /
 > `summaryMode` were removed outright in Story #4541, along with the
@@ -126,3 +127,24 @@ over-ceiling envelope or an over-budget Story count.
   nothing at plan time scores its authored mass.
 - **Host runtime**: session billing, quota exhaustion, and operator overrides
   are enforced by your provider (e.g. Claude Code), not by Mandrel scripts.
+
+### Session effort and model
+
+Effort is the operator's dial, set once per session. Pick it deliberately up
+front, because changing effort mid-session invalidates the prompt cache for
+everything that follows.
+
+- **Recommended session effort.** `medium` for `/mandrel-deliver`: Stories
+  are well-scoped by construction, so delivery rarely needs more. `high` for
+  `/mandrel-plan`: a Spec defect costs a redraft or a blocked Story
+  downstream, which is dearer than the planning turn.
+- **Role agents.** `story-worker` declares no effort and inherits the
+  session's (Story #5426). The evaluator roles (`acceptance-critic`,
+  `plan-critic`, `auditor`) pin `medium`.
+- **Where pins live.** Effort and model pins belong only on role agents under
+  `.agents/agents/`, never in workflow or command frontmatter: a command that
+  pinned its own effort would change effort mid-session and break the prompt
+  cache.
+- **Escalation is an operator step.** The Agent tool takes no per-call
+  effort, so no workflow can escalate on its own. Before resuming a blocked
+  Story, raise session effort one step; raise effort before switching models.

package/.agents/instructions.md

@@ -118,7 +118,7 @@ truncates with a note naming what was cut:
 
 ## 3. Core Philosophy
 
-1. **Context First.** **Digest-first reading (Story #4433):** never
+1. **Context First.** **Digest-first reading:** never
    ingest the whole `project.docsContextFiles` set up front — read the
    docs digest and pull files on demand at the section it names. No
    digest (ad hoc task, `docsContextFiles` unset, null `docsDigestPath`)
@@ -127,8 +127,10 @@ truncates with a note naming what was cut:
    present. Always read the current Story's body (`## Spec` +
    `acceptance[]` / `verify[]`); prefer targeted retrieval over broad
    reads.
-2. **Plan First.** For non-trivial tasks (3+ steps or architectural
-   decisions), update the Story's `## Spec` via `/mandrel-plan` before code.
+2. **Plan First.** Planned work carries its plan in the Story's
+   `## Spec`, authored via `/mandrel-plan`; an unplanned prompt takes
+   `/mandrel-deliver`'s light path, which escalates to `/mandrel-plan`
+   when its gate trips.
 3. **Artifacts over Chat.** Write test/build/debug output to log
    files, not into chat.
 4. **Idempotency.** Scripts must be safe to run repeatedly.
@@ -137,16 +139,13 @@ truncates with a note naming what was cut:
 
 ## 4. Execution & Quality Discipline
 
-- **Re-Plan on Failure.** If a strategy fails, STOP and re-plan.
 - **Subagent Strategy.** Each spawn re-pays the full always-loaded
   context — a cost decision. Prefer inline search for small lookups;
   spawn only when the work justifies replicating context. One objective
   per subagent; depth compounds the cost (every nested level re-pays).
-- **Anti-Laziness / No Dead Code.** NEVER use placeholder comments like
-  `// ... existing code ...`; every edit must leave complete, runnable code.
-  Remove unused imports, commented-out code, and dead branches before
+- **No Dead Code.** Every edit leaves complete, runnable code. Remove
+  unused imports, commented-out code, and dead branches before
   finalizing.
-- **Verification.** Include explicit verification steps in every plan.
 
 ---
 
@@ -191,7 +190,6 @@ anything under it.
 `/mandrel-plan` sizes each Story as a **capability slice a frontier model
 delivers and self-verifies in one pass** — a broad footprint is normal
 when the change is cohesive, and no plan-time ceiling scores it; do not
-re-slice it into per-module fragments. On an out-of-scope task: **plan
-first** in numbered cohesive sub-steps, **commit incrementally** per
-sub-step, and **fail fast** — STOP and report if any sub-step fails
-validation.
+re-slice it into per-module fragments. On an out-of-scope task,
+**commit incrementally** per cohesive sub-step, and when a sub-step
+fails validation, stop and apply § 1.I (re-plan or yield).

package/.agents/rules/ci-remediation.md

@@ -137,9 +137,9 @@ run — a blind fix to a suite nobody exercised is how the gap compounds.
 
 `capacity` and `unreproducible-tier` name failures that are proven properties
 of the **environment**: no commit on the branch can move the head SHA to clear
-them, so the no-rerun rule used to strand a correct delivery until a human
-cleared it by hand. Those two verdicts — and only those two — now buy exactly
-one rerun:
+them, so without an allowance the no-rerun rule would strand a correct
+delivery until a human cleared it by hand. Those two verdicts — and only those
+two — buy exactly one rerun:
 
 1. Reach the verdict with its required readings (§ above). A green on re-run is
    never one of those readings.

package/.agents/rules/gherkin-standards.md

@@ -143,8 +143,9 @@ authored:
    widen the regex, updating every call site in the same PR.
 4. **Add a new definition only when no reasonable match exists**, in the
    correct domain directory. Never copy-paste a step implementation to support
-   a paraphrased scenario, and never author new step definitions during
-   scenario authoring — record the missing step as a named gap instead.
+   a paraphrased scenario. A prose-only authoring pass (one whose scope
+   excludes step-definition code) records the missing step as a named gap
+   instead of writing it.
 
 When a step is superseded, mark it deprecated and migrate every call site in
 the same PR; do not leave two near-identical steps live.

package/.agents/rules/git-conventions-reference.md

@@ -15,7 +15,9 @@ Mandrel ships as the `mandrel` npm package, whose consumers pin an
 exact lockfile version; they opt into breaks at upgrade time. Operator policy
 for any contract change (config shape, baseline shape, schema, lifecycle
 payload, ticket label, dispatch artifact, public API of a script) is
-therefore:
+therefore as follows. It governs Mandrel's own framework contracts; a
+consumer's product API keeps the expand–contract rule in
+[`api-conventions.md`](api-conventions.md).
 
 1. **Hard cutovers only.** Contract changes ship as a single in-tree
    migration of every producer and consumer. There is no parallel
@@ -154,10 +156,10 @@ different hazards:
 
 ## Meta Labels (Retrospective Signal Routing)
 
-Two `meta::*` labels route retrospective signals into durable substrates so
+Three `meta::*` labels route retrospective signals into durable substrates so
 the `/mandrel-plan` Phase 0 fetcher (see
 [`prior-feedback-fetcher.js`](../scripts/lib/feedback-loop/prior-feedback-fetcher.js))
-can surface open feedback issues to the planner. Both labels live in
+can surface open feedback issues to the planner. All three live in
 [`label-constants.js`](../scripts/lib/label-constants.js) under the
 `META_LABELS` export — reference them by symbol from scripts rather than
 hard-coding the string.
@@ -180,3 +182,10 @@ project-local automation). The work is scoped to the consumer's
 framework changes. Issues that span both axes should carry both labels —
 `fetchPriorFeedback` dedupes by issue number so a dual-labeled issue
 appears exactly once in the planner context.
+
+### `meta::platform-gap`
+
+Apply this label to a GitHub issue whose fault lies in a shared base
+config, runner fleet, or cross-repo toolchain that neither the framework
+nor the consumer owns — the `--owner platform` bucket of
+[`ci-remediation.md`](ci-remediation.md).

package/.agents/rules/git-conventions.md

@@ -16,9 +16,8 @@ Every Story lands on a dedicated **Story branch** named
 `story-<storyId>`, seeded from `project.baseBranch` (`main` by default),
 isolated in its own worktree at `.worktrees/story-<id>/`. The runtime
 owns both via `single-story-init.js`; agents commit there only. Close
-opens a PR against `main` (squash + required checks). No `epic/<id>`
-integration branch, no `--no-ff` wave merge, no child tickets: commits
-land on `story-<storyId>` directly, the
+opens a PR against `main` (squash + required checks). Commits land on
+`story-<storyId>` directly, the
 subject referencing the Story via `(refs #<storyId>)` — see
 [`.agents/instructions.md` § 5.B](../instructions.md).
 
@@ -38,15 +37,18 @@ subject referencing the Story via `(refs #<storyId>)` — see
 
 ## Push Validation & Reliability (MUSTs)
 
-1. Run the configured validation commands locally **before** `git push`.
+1. Validate locally **before** `git push`. On a Story branch that is the
+   one credited suite run (`deliver-digest.md` § 5); close runs every
+   other gate, so do not pre-run them. Elsewhere, run the configured
+   validation commands.
 2. Do NOT assume a push succeeded unless the output confirms the remote
    ref was updated (`[new branch]`, `[up to date]`, `... -> ...`).
 3. If a `pre-push` hook rejects, fix the cause and create a NEW follow-up
    commit — never amend the rejected commit.
 4. **Never bypass hooks** (`--no-verify`, `--no-gpg-sign`, …) without
-   explicit operator authorization. The one recognized exception — a
-   Biome zero-match failure under a harness-managed worktree path — is a
-   consumer-tooling gap, **not** authorization; see
+   explicit operator authorization. A Biome zero-match failure under a
+   harness-managed worktree path is a known false negative — a
+   consumer-tooling gap, **not** authorization to bypass; see
    [`git-conventions-reference.md` § Push Validation](git-conventions-reference.md).
 
 ## Local checkout hygiene

package/.agents/rules/testing-standards.md

@@ -156,13 +156,14 @@ behaviour (`sets status to completed`, not `works`).
 
 A file that passes alone but fails inside the full `npm test` suite is **test
 pollution** — one test leaks shared state (env vars, temp files, the
-mock-module registry, global singletons) and a later test trips on it. Reach
-for `npm run test:isolate` before manually bisecting: it runs every matching
-file individually under `--test-concurrency=1`, then all together, flags files
-that pass alone but fail in the suite (**flippers**), binary-bisects the
-smallest reproducing subset, and reports any file that exited with leftover
-`process.env` mutations. The fix is almost always missing teardown — wrap the
-mutation in a `t.before` / `t.after` pair, or restore the prior value in
+mock-module registry, global singletons) and a later test trips on it. Run
+every matching file alone, then all together; the files that pass alone but
+fail in the suite (**flippers**) bound the search, and bisecting them finds
+the smallest reproducing subset. Mandrel's own repository automates this as
+`npm run test:isolate`, which also reports leftover `process.env`
+mutations; a consumer uses its runner's equivalent. The fix is almost
+always missing teardown — wrap the mutation in a `t.before` / `t.after`
+pair, or restore the prior value in
 `try` / `finally`.
 
 For browser-based changes, pair the cycle with runtime verification via Chrome

package/.agents/runtime-deps.json

@@ -18,6 +18,6 @@
     "chokidar": "^5.0.0",
     "jscpd": "^4.0.0",
     "knip": "^6.17.1",
-    "typescript": ">=5.0.0"
+    "typescript": ">=5.0.0 <7"
   }
 }

package/.agents/scripts/bootstrap.js

@@ -716,6 +716,13 @@ async function detectCreation(answers, skipGithub) {
   return creation;
 }
 
+function projectNameFor(pn, projects) {
+  const match = projects.find((p) => p.value === pn);
+  if (!match) return '(unknown)';
+  const m = /^(.*)\s+\(#\d+\)$/.exec(match.label);
+  return m ? m[1] : match.label;
+}
+
 /**
  * `{ name, number }` for the summary; the picker stores only the number, so
  * an existing project's name is looked up.
@@ -723,20 +730,78 @@ async function detectCreation(answers, skipGithub) {
 function resolveProjectDisplay(answers, skipGithub, projectsList) {
   const pn = answers.projectNumber;
   if (!pn) return { name: '(skip)', number: '(skip)' };
-  if (/^\d+$/.test(pn)) {
-    let name = '(unknown)';
-    if (!skipGithub) {
-      const projects =
-        projectsList ?? safeList(() => listProjects({ owner: answers.owner }));
-      const match = projects.find((p) => p.value === pn);
-      if (match) {
-        const m = /^(.*)\s+\(#\d+\)$/.exec(match.label);
-        name = m ? m[1] : match.label;
-      }
+  if (!/^\d+$/.test(pn)) return { name: pn, number: '(new)' };
+  if (skipGithub) return { name: '(unknown)', number: pn };
+  const projects =
+    projectsList ?? safeList(() => listProjects({ owner: answers.owner }));
+  return { name: projectNameFor(pn, projects), number: pn };
+}
+
+/** Opt-ins default off; dry-run resolves them without prompting. */
+const OPT_INS = Object.freeze([
+  {
+    key: 'withProjectBoard',
+    flag: 'with-project-board',
+    prompt: 'Set up project board fields (Status, custom)?',
+  },
+  {
+    key: 'withIssueForms',
+    flag: 'with-issue-forms',
+    prompt: 'Generate GitHub Issue Form templates?',
+  },
+  {
+    key: 'withQuality',
+    flag: 'with-quality',
+    prompt:
+      'Install local quality gates (pre-commit hook + quality:preview/watch scripts)?',
+  },
+]);
+
+async function resolveOptIns(state) {
+  const optIns = {};
+  for (const { key, flag, prompt } of OPT_INS) {
+    let on = Boolean(state.flags[flag]);
+    if (!state.flags['dry-run'] && !on) {
+      on = await confirmYesNo(prompt, state.interactive, false);
     }
-    return { name, number: pn };
+    optIns[key] = on;
   }
-  return { name: pn, number: '(new)' };
+  return optIns;
+}
+
+async function approveCreation(state, creation) {
+  if (state.flags['dry-run'] || !(creation.newRepo || creation.newProject)) {
+    return true;
+  }
+  return confirmYesNo(
+    'Create the new GitHub repo/project listed above?',
+    state.interactive,
+  );
+}
+
+async function confirmSummary(state, answers, creation, projectsList) {
+  const skipGithub = Boolean(state.flags['skip-github']);
+  const project = resolveProjectDisplay(answers, skipGithub, projectsList);
+  Logger.info(
+    renderAnswerSummary(
+      answers,
+      creation,
+      project,
+      state.gitInitialized,
+      resolveRepoVisibility(state.flags),
+    ),
+  );
+  return confirmYesNo('Is this correct?', state.interactive);
+}
+
+/** Owner repo/project lists, fetched once for pickers and summary. */
+function fetchPickerLists(state, skipGithub) {
+  const owner = resolveOwnerForPicker(state.defaults, state.flags);
+  if (skipGithub || !owner) return { reposList: [], projectsList: [] };
+  return {
+    reposList: safeList(() => listRepos({ owner }).map(bareRepoName)),
+    projectsList: safeList(() => listProjects({ owner })),
+  };
 }
 
 /**
@@ -745,22 +810,16 @@ function resolveProjectDisplay(answers, skipGithub, projectsList) {
  */
 export async function collectAndConfirm(state) {
   const skipGithub = Boolean(state.flags['skip-github']);
-  const owner = resolveOwnerForPicker(state.defaults, state.flags);
-  // Fetched once for pickers and summary, so the name never needs a second call.
-  const reposList =
-    !skipGithub && owner
-      ? safeList(() => listRepos({ owner }).map(bareRepoName))
-      : [];
-  const projectsList =
-    !skipGithub && owner ? safeList(() => listProjects({ owner })) : [];
-
+  const lists = fetchPickerLists(state, skipGithub);
   let silentAccept = state.silentAccept;
   for (;;) {
     const { answers, missing } = await collectAnswers({
-      questions: buildQuestions(state.defaults, state.flags, process.env, {
-        reposList,
-        projectsList,
-      }),
+      questions: buildQuestions(
+        state.defaults,
+        state.flags,
+        process.env,
+        lists,
+      ),
       flags: state.flags,
       interactive: state.interactive,
       assumeYes: state.assumeYes,
@@ -775,78 +834,24 @@ export async function collectAndConfirm(state) {
       );
       return { ok: false, exit: 1 };
     }
-    if (!answers.operatorHandle) answers.operatorHandle = answers.owner;
-    answers.operatorHandle = normalizeHandleAnswer(answers.operatorHandle);
+    answers.operatorHandle = normalizeHandleAnswer(
+      answers.operatorHandle || answers.owner,
+    );
 
     const creation = await detectCreation(answers, skipGithub);
-    const project = resolveProjectDisplay(answers, skipGithub, projectsList);
-    Logger.info(
-      renderAnswerSummary(
-        answers,
-        creation,
-        project,
-        state.gitInitialized,
-        resolveRepoVisibility(state.flags),
-      ),
-    );
-    const correct = await confirmYesNo('Is this correct?', state.interactive);
-    if (!correct) {
+    if (!(await confirmSummary(state, answers, creation, lists.projectsList))) {
       Logger.info('[Bootstrap] Okay — let’s try again.');
       silentAccept = [];
       continue;
     }
-
-    if (!state.flags['dry-run'] && (creation.newRepo || creation.newProject)) {
-      const approved = await confirmYesNo(
-        'Create the new GitHub repo/project listed above?',
-        state.interactive,
-      );
-      if (!approved) {
-        Logger.error(
-          '[Bootstrap] Creation declined — cannot continue without the repo/project. Exiting.',
-        );
-        return { ok: false, exit: 1 };
-      }
-    }
-
-    // Opt-ins default off; dry-run resolves them without prompting.
-    let withProjectBoard = Boolean(state.flags['with-project-board']);
-    if (!state.flags['dry-run'] && !withProjectBoard) {
-      withProjectBoard = await confirmYesNo(
-        'Set up project board fields (Status, custom)?',
-        state.interactive,
-        false,
-      );
-    }
-
-    let withIssueForms = Boolean(state.flags['with-issue-forms']);
-    if (!state.flags['dry-run'] && !withIssueForms) {
-      withIssueForms = await confirmYesNo(
-        'Generate GitHub Issue Form templates?',
-        state.interactive,
-        false,
-      );
-    }
-
-    let withQuality = Boolean(state.flags['with-quality']);
-    if (!state.flags['dry-run'] && !withQuality) {
-      withQuality = await confirmYesNo(
-        'Install local quality gates (pre-commit hook + quality:preview/watch scripts)?',
-        state.interactive,
-        false,
+    if (!(await approveCreation(state, creation))) {
+      Logger.error(
+        '[Bootstrap] Creation declined — cannot continue without the repo/project. Exiting.',
       );
+      return { ok: false, exit: 1 };
     }
-
-    return {
-      ok: true,
-      payload: {
-        answers,
-        creation,
-        withProjectBoard,
-        withIssueForms,
-        withQuality,
-      },
-    };
+    const optIns = await resolveOptIns(state);
+    return { ok: true, payload: { answers, creation, ...optIns } };
   }
 }