mandrel 2.67.0 → 2.69.0

package/docs/CHANGELOG.md

@@ -15,6 +15,39 @@ All notable changes to this project will be documented in this file.
 -->
 <!-- markdownlint-disable-file MD004 MD012 MD037 -->
 
+## [2.69.0](https://github.com/dsj1984/mandrel/compare/mandrel-v2.68.0...mandrel-v2.69.0) (2026-09-27)
+
+
+### Added
+
+* **audit:** ship /audit-security as a slash command (refs [#5498](https://github.com/dsj1984/mandrel/issues/5498)) ([#5499](https://github.com/dsj1984/mandrel/issues/5499)) ([7df7649](https://github.com/dsj1984/mandrel/commit/7df76496cfc35f636d117961bb7042b5aa662ec6))
+
+## [2.68.0](https://github.com/dsj1984/mandrel/compare/mandrel-v2.67.0...mandrel-v2.68.0) (2026-09-26)
+
+
+### Added
+
+* baselines: add an insert-only `--seat-missing` refresh and have the story-worker seat rows for methods its diff adds before push ([#5486](https://github.com/dsj1984/mandrel/issues/5486)) ([#5492](https://github.com/dsj1984/mandrel/issues/5492)) ([325d7bb](https://github.com/dsj1984/mandrel/commit/325d7bbbc0bb08bb6fe3f05287d959f2b42d4da2))
+* close-validation: fail cheap gates before coverage capture and report lock expiry / timeout honestly ([#5471](https://github.com/dsj1984/mandrel/issues/5471)) ([#5474](https://github.com/dsj1984/mandrel/issues/5474)) ([ece115d](https://github.com/dsj1984/mandrel/commit/ece115d7961566c21de45f79f44b3957389e7623))
+* coverage-capture: after a base-sync, re-measure only main's delta instead of re-running the whole suite ([#5487](https://github.com/dsj1984/mandrel/issues/5487)) ([#5496](https://github.com/dsj1984/mandrel/issues/5496)) ([03694a4](https://github.com/dsj1984/mandrel/commit/03694a4bfa970ba122c1f508a7ed4b1271ccb222))
+* coverage-capture: opt-in `affected` scope that runs a consumer-owned scoped coverage script ([#5472](https://github.com/dsj1984/mandrel/issues/5472)) ([#5483](https://github.com/dsj1984/mandrel/issues/5483)) ([50bf942](https://github.com/dsj1984/mandrel/commit/50bf9424d38e776270cfaf19935dd265bb950625))
+* coverage-capture: spend the suite timeout on tests, queue on the full-suite lock, and make the cap configurable ([#5485](https://github.com/dsj1984/mandrel/issues/5485)) ([#5493](https://github.com/dsj1984/mandrel/issues/5493)) ([6a5bc69](https://github.com/dsj1984/mandrel/commit/6a5bc6929138e70ca66a9aea0e4354dcf5319ed7))
+* deliver: compute the Story-scope review at worker push time, keyed on the diff digest, so close posts a held result and a CRITICAL is fixed before hand-off ([#5480](https://github.com/dsj1984/mandrel/issues/5480)) ([#5490](https://github.com/dsj1984/mandrel/issues/5490)) ([c43b6bf](https://github.com/dsj1984/mandrel/commit/c43b6bf3beca4aeb0dc6350f3fe1f5c9cdcda250))
+* deliver: make the worker's one credited run the coverage capture close will otherwise re-pay, and let doctor name the credit gaps ([#5477](https://github.com/dsj1984/mandrel/issues/5477)) ([#5482](https://github.com/dsj1984/mandrel/issues/5482)) ([67e8d06](https://github.com/dsj1984/mandrel/commit/67e8d0687a6254f8ff8ab9957867c69588642aad))
+* deliver: warn in the beat envelope when a Story's footprint overlaps another session's in-flight Story ([#5488](https://github.com/dsj1984/mandrel/issues/5488)) ([#5491](https://github.com/dsj1984/mandrel/issues/5491)) ([be68220](https://github.com/dsj1984/mandrel/commit/be682205dc5959e12819bd2f2463c352449acd09))
+
+
+### Fixed
+
+* close: in async merge-watch mode return `pending` after one probe instead of burning the 60s window ([#5479](https://github.com/dsj1984/mandrel/issues/5479)) ([#5484](https://github.com/dsj1984/mandrel/issues/5484)) ([440b8bf](https://github.com/dsj1984/mandrel/commit/440b8bf70ed53d973c635662a12791a1d9f51953))
+* **close:** bound the full-suite lock wait by the suite's kill bound (refs [#5478](https://github.com/dsj1984/mandrel/issues/5478)) ([#5481](https://github.com/dsj1984/mandrel/issues/5481)) ([c7b7719](https://github.com/dsj1984/mandrel/commit/c7b7719bf50f7bc557c1979505ebab6a6851345b))
+* coverage-capture: a red capture must never leave an artifact a later pr… ([#5494](https://github.com/dsj1984/mandrel/issues/5494)) ([#5495](https://github.com/dsj1984/mandrel/issues/5495)) ([fa72738](https://github.com/dsj1984/mandrel/commit/fa72738d486626e892b5fd89e0350f745d925cfc))
+
+
+### Performance
+
+* close: run the Story-scope code review concurrently with the validation gates ([#5473](https://github.com/dsj1984/mandrel/issues/5473)) ([#5476](https://github.com/dsj1984/mandrel/issues/5476)) ([e098205](https://github.com/dsj1984/mandrel/commit/e09820592d70ba600df288c4e4b5ae1abd5b9aa1))
+
 ## [2.67.0](https://github.com/dsj1984/mandrel/compare/mandrel-v2.66.0...mandrel-v2.67.0) (2026-09-26)
 
 

package/lib/cli/registry.js

@@ -864,59 +864,166 @@ const MANDREL_TEST_RUNNER = 'run-tests.js';
 const TEST_CREDIT_DEPOSIT_COMMAND =
   'node .agents/scripts/evidence-gate.js --standalone --scope-id <storyId> --gate test --worktree <workCwd> -- npm test';
 
+/** The capture close's `coverage-capture` gate finds fresh, per digest § 5. */
+const COVERAGE_CAPTURE_COMMAND =
+  'node .agents/scripts/coverage-capture.js --cwd <workCwd>';
+
 const TEST_CREDIT_REMEDY = `run the suite through the depositor instead of bare \`npm test\`: ${TEST_CREDIT_DEPOSIT_COMMAND}`;
 
+const PRE_PUSH_REMEDY =
+  'wrap each hook gate in `node .agents/scripts/evidence-gate.js --standalone --scope-id <storyId> --gate <typecheck|lint> -- <command>` so the push deposits the credit close reads';
+
+/** A hook line that runs a typecheck or lint gate. */
+const HOOK_GATE_RE = /\b(typecheck|tsc|lint|eslint|biome)\b/;
+
 /**
  * Read from `package.json`, not `project.commands.test`: the close gate's argv
  * is the literal `npm test`.
  *
  * @param {string} projectRoot
  * @param {typeof fs.readFileSync} readFileImpl
- * @returns {string|null} The trimmed script, or null when there is none.
+ * @returns {Record<string, string>} The `scripts` map, empty when unreadable.
  */
-function readProjectTestScript(projectRoot, readFileImpl) {
+function readProjectScripts(projectRoot, readFileImpl) {
   try {
     const raw = readFileImpl(path.join(projectRoot, 'package.json'), 'utf8');
-    const script = JSON.parse(raw)?.scripts?.test;
-    return typeof script === 'string' && script.trim().length > 0
-      ? script.trim()
-      : null;
+    const scripts = JSON.parse(raw)?.scripts;
+    return scripts && typeof scripts === 'object' ? scripts : {};
   } catch {
-    return null;
+    return {};
   }
 }
 
 /**
- * Does a bare `npm test` reach mandrel's runner and so deposit the close
- * `test` credit? Always `ok: true` — another runner is supported, it just
- * needs the explicit depositor — so the remedy rides a passing verdict and is
- * repeated in `detail`. Detected by name only, never executed.
+ * @param {Record<string, string>} scripts
+ * @param {string} name
+ * @returns {string|null} The trimmed script, or null when there is none.
+ */
+function scriptNamed(scripts, name) {
+  const script = scripts[name];
+  return typeof script === 'string' && script.trim().length > 0
+    ? script.trim()
+    : null;
+}
+
+/**
+ * `delivery.quality.gates.crap.enabled` from `.agentrc.json` overlaid by
+ * `.agentrc.local.json`, defaulting on — the predicate close registers
+ * `coverage-capture` on. Read without `resolveConfig()` (built-ins only).
  *
- * @param {{ projectRoot?: string, readFile?: typeof fs.readFileSync }} [opts]
- * @returns {{ ok: boolean, detail: string, remedy?: string }}
+ * @param {string} projectRoot
+ * @param {typeof fs.readFileSync} readFileImpl
+ * @returns {boolean}
  */
-function runTestCreditPath({ projectRoot, readFile = fs.readFileSync } = {}) {
-  const script = readProjectTestScript(projectRoot ?? process.cwd(), readFile);
+function isCrapEnabled(projectRoot, readFileImpl) {
+  let enabled = true;
+  for (const file of ['.agentrc.json', '.agentrc.local.json']) {
+    const value = readJsonSafe(path.join(projectRoot, file), {
+      readFileSync: readFileImpl,
+    })?.delivery?.quality?.gates?.crap?.enabled;
+    if (typeof value === 'boolean') enabled = value;
+  }
+  return enabled;
+}
+
+/**
+ * Which depositor digest § 5 selects, stated with its exact command.
+ *
+ * @param {{ scripts: Record<string, string>, crapEnabled: boolean }} probe
+ * @returns {{ detail: string, remedy?: string }}
+ */
+function describeCreditedRun({ scripts, crapEnabled }) {
+  if (crapEnabled && scriptNamed(scripts, 'test:coverage') !== null) {
+    return {
+      detail: `the CRAP gate is enabled and \`test:coverage\` exists, so close registers \`coverage-capture\` and the credited run is the coverage capture: \`${COVERAGE_CAPTURE_COMMAND}\` — its fresh stamp lets close's capture skip the suite`,
+    };
+  }
+  const script = scriptNamed(scripts, 'test');
   if (script === null) {
     return {
-      ok: true,
       detail: `no \`test\` script in package.json — close still spawns \`npm test\`, so ${TEST_CREDIT_REMEDY}`,
       remedy: TEST_CREDIT_REMEDY,
     };
   }
   if (script.includes(MANDREL_TEST_RUNNER)) {
     return {
-      ok: true,
       detail: `\`npm test\` → \`${script}\` reaches mandrel's runner — a green full run on a story branch deposits the close \`test\` credit itself`,
     };
   }
   return {
-    ok: true,
     detail: `\`npm test\` → \`${script}\` is this project's own runner and never reaches \`${MANDREL_TEST_RUNNER}\`, so it deposits no close \`test\` credit and prints nothing — ${TEST_CREDIT_REMEDY}`,
     remedy: TEST_CREDIT_REMEDY,
   };
 }
 
+/**
+ * Does the pre-push hook deposit gate evidence? Read, never executed.
+ *
+ * @param {string} projectRoot
+ * @param {typeof fs.readFileSync} readFileImpl
+ * @returns {{ detail: string, remedy?: string }}
+ */
+function describePrePushHook(projectRoot, readFileImpl) {
+  let hook = null;
+  let hookPath = null;
+  for (const rel of [
+    path.join('.husky', 'pre-push'),
+    path.join('.git', 'hooks', 'pre-push'),
+  ]) {
+    try {
+      hook = readFileImpl(path.join(projectRoot, rel), 'utf8');
+      hookPath = rel.split(path.sep).join('/');
+      break;
+    } catch {
+      // Absent here — try the next hooks location.
+    }
+  }
+  if (hook === null) {
+    return { detail: 'no pre-push hook found, so nothing runs a gate there' };
+  }
+  if (hook.includes('evidence-gate.js')) {
+    return {
+      detail: `\`${hookPath}\` routes its gates through \`evidence-gate.js\`, so the push deposits evidence close can credit`,
+    };
+  }
+  if (HOOK_GATE_RE.test(hook)) {
+    return {
+      detail: `\`${hookPath}\` runs typecheck or lint without \`evidence-gate.js\`, so it deposits nothing and close re-runs them — ${PRE_PUSH_REMEDY}`,
+      remedy: PRE_PUSH_REMEDY,
+    };
+  }
+  return {
+    detail: `\`${hookPath}\` runs no typecheck or lint gate, so close has nothing of it to re-run`,
+  };
+}
+
+/**
+ * Which credited run does digest § 5 select for this project, and does its
+ * pre-push hook deposit the gate evidence close reads? Always `ok: true` —
+ * every shape is supported, some just cost close a re-run — so any remedy
+ * rides a passing verdict and is repeated in `detail`. Detected from files
+ * only; nothing is executed.
+ *
+ * @param {{ projectRoot?: string, readFile?: typeof fs.readFileSync }} [opts]
+ * @returns {{ ok: boolean, detail: string, remedy?: string }}
+ */
+function runTestCreditPath({ projectRoot, readFile = fs.readFileSync } = {}) {
+  const root = projectRoot ?? process.cwd();
+  const parts = [
+    describeCreditedRun({
+      scripts: readProjectScripts(root, readFile),
+      crapEnabled: isCrapEnabled(root, readFile),
+    }),
+    describePrePushHook(root, readFile),
+  ];
+  const remedies = parts.map((p) => p.remedy).filter(Boolean);
+  return {
+    ok: true,
+    detail: parts.map((p) => p.detail).join('; '),
+    ...(remedies.length > 0 ? { remedy: remedies.join('; ') } : {}),
+  };
+}
+
 /** `advisory: true` marks a check whose `run()` never fails. */
 export const registry = [
   {

package/lib/migrations/steps/strip-removed-agentrc-keys.js

@@ -88,11 +88,6 @@ const REMOVED_AGENTRC_KEYS = Object.freeze([
     'BASELINE_REFRESH_TAG',
     'baseline-refresh:',
   ),
-  folded(
-    'delivery.quality.gates.coverage.timeoutMs',
-    'COVERAGE_GATE_DEFAULTS.timeoutMs',
-    600000,
-  ),
   folded(
     'delivery.quality.formatAutofix.timeoutMs',
     'FORMAT_AUTOFIX_TIMEOUT_MS',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mandrel",
-  "version": "2.67.0",
+  "version": "2.69.0",
   "description": "Claude Code-first opinionated workflow framework: instructions, skills, rules, and SDLC workflows that govern AI coding assistants.",
   "files": [
     ".agents/",