mandrel 2.7.0 → 2.8.0

package/.agents/workflows/audit-dependencies.md

@@ -4,40 +4,39 @@ description: Audit `package.json` for unused, outdated, and major-version-stale
 
 # Dependency Update Audit
 
-## Role
-
-DevOps Engineer & Security Researcher
-
-## Context & Objective
-
-Manage the lifecycle of project dependencies. Your goal is to identify outdated,
-vulnerable, or bloated packages and suggest a safe upgrade path that maintains
-system stability.
-
-## Scope (Story / plan-run mode)
-
-When this lens is invoked from `/deliver` close lenses (or a plan-run audit), the
-following block is populated with the Story (or plan-run) change-set file list.
-Otherwise — for any manual `/audit-<dimension>` invocation — the block
-renders the literal substitution token and you MUST treat it as **no
-scope filter — run the lens codebase-wide** exactly as you would have
-before this section existed.
+You are a DevOps Engineer & Security Researcher managing the dependency
+lifecycle — outdated, vulnerable, or bloated packages and a safe upgrade path.
+The shared lens machinery — read-only constraint, scope interpretation, report
+envelope + finding-block skeleton, severity scale, self-cross-check, and
+execution strategy — lives in
+[`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
+`{{auditOutputDir}}/audit-dependencies-results.md`. Dimension values:
+`Security Fix | Removal | Engine Drift | Major Upgrade | Supply-chain`. The
+report adds a **Health Summary**, an **Upgrade Batches** section, and a
+**Recommended Removals/Replacements** list.
+
+> **Version-free titles (mandatory).** A finding title MUST NOT embed a concrete
+> version number — write ``### `package.json` — lodash unused``, not ``… —
+> lodash@4.17.20 unused``. Periodic re-runs re-detect the same issue at a
+> drifted version; a version-free title keeps the finding's fingerprint stable
+> so `audit-to-stories` dedupes it against the existing Story instead of filing
+> a fresh duplicate on every bump.
+
+## Scope
+
+Interpret this lens's change-set fence per the core's Scope interpretation:
 
 ```text
 {{changedFiles}}
 ```
 
-- If the block above contains a newline-delimited list of file paths,
-  restrict your analysis to those files (and their direct dependencies
-  when the lens explicitly calls for cross-file reasoning).
-- If the block above renders as the literal string `{{changedFiles}}`
-  (i.e. no substitution was supplied), ignore this section entirely and
-  proceed with the full codebase-wide scan defined in the remaining
-  steps.
+## Execution strategy
 
-## Step 1: Inventory, Staleness & Unused Detection
+Run this lens as a single `subagent_type: auditor` dispatch returning the report
+path + Executive Summary; sequential inline execution is the fallback (see the
+core's Execution strategy).
 
-> Apply [`helpers/parallel-tooling.md`](helpers/parallel-tooling.md) when batching the scans below — independent reads belong in one turn, long shells run via `run_in_background` + `Monitor`.
+## Step 1: Inventory, Staleness & Unused Detection
 
 Run each probe as a concrete, machine-readable command so the Health Summary
 counts are **exact** rather than eyeballed:
@@ -81,9 +80,8 @@ production code" standard.
    `npm audit --json --omit=dev` (production-reachable only). An advisory
    present in the full run but absent from the `--omit=dev` run is
    **dev-only**; one present in both is **production-reachable**.
-2. **Severity rubric.** Grade each advisory on the shared
-   [`Critical | High | Medium | Low` scale](helpers/audit-severity-scale.md)
-   as a function of the advisory's own CVSS band, its reachability
+2. **Severity rubric.** Grade each advisory on the shared severity scale as a
+   function of the advisory's own CVSS band, its reachability
    (production-reachable escalates; dev-only caps at Medium), and its
    dependency position (a direct dependency whose version you control is more
    actionable than a deep transitive one).
@@ -96,12 +94,12 @@ production code" standard.
 
 ## Step 3: Supply-chain scoped mode (lockfile-delta)
 
-When the `## Scope` block above resolved to a change-set file list **and that
-list contains a lockfile** (`package-lock.json`, `pnpm-lock.yaml`, or
-`yarn.lock`), run this lens as a **supply-chain delta pass** instead of a
-whole-manifest re-scan. The close-time question is not "what is stale across
-the whole repo" — it is "what just entered the dependency tree, and is it
-safe". Diff the lockfile against the base branch and analyse only the delta:
+When the change-set fence resolved to a file list **and that list contains a
+lockfile** (`package-lock.json`, `pnpm-lock.yaml`, or `yarn.lock`), run this
+lens as a **supply-chain delta pass** instead of a whole-manifest re-scan. The
+close-time question is not "what is stale across the whole repo" — it is "what
+just entered the dependency tree, and is it safe". Diff the lockfile against the
+base branch and analyse only the delta:
 
 1. **Enumerate the delta.** Run `git diff <base>...HEAD -- <lockfile>` and
    list every **added** package and every **version-bumped** package the
@@ -118,89 +116,27 @@ safe". Diff the lockfile against the base branch and analyse only the delta:
    (single-character edits, dropped scopes, hyphen/underscore swaps) that
    suggests a typosquat, and flag it.
 
-## Step 4: Output Requirements
-
-Generate and save a highly structured Markdown audit report to
-`{{auditOutputDir}}/audit-dependencies-results.md`, using the exact template
-below.
+## Report additions
 
-> Grade every finding's severity on the shared
-> [`Critical | High | Medium | Low` scale](helpers/audit-severity-scale.md).
->
-> **Version-free titles (mandatory).** A finding title MUST NOT embed a
-> concrete version number — write ``### `package.json` — lodash unused``, not
-> ``… — lodash@4.17.20 unused``. Periodic re-runs of this lens re-detect the
-> same issue at a drifted version; a version-free title keeps the finding's
-> fingerprint stable so `audit-to-stories` dedupes it against the existing
-> Story instead of filing a fresh duplicate on every bump.
+Beyond the shared skeleton, emit these lens-specific report sections:
 
 ```markdown
-# Dependency Audit Report
-
 ## Health Summary
 
 - **Outdated Packages:** [exact count from `npm outdated --json`]
 - **Unused Dependencies:** [exact count from `npx knip --production` / `depcheck`]
 - **Vulnerabilities:** [Critical: #, High: #, Mod: #] (production-reachable / dev-only split)
 - **Node-engine drift:** [None | describe the mismatch across engines / .nvmrc / CI matrix]
-
-## Detailed Findings
-
-[For every production-reachable Critical/High advisory, unused dependency, or
-Node-engine drift, use the strict structure below. Lead each title with the
-manifest the dependency lives in, and keep the title version-free:]
-
-### `path/to/package.json` — [Package name — issue, no version]
-
-- **Dimension:** [Security Fix | Removal | Engine Drift | Major Upgrade | Supply-chain]
-- **Impact:** [Critical | High | Medium | Low]
-- **Location:** `path/to/package.json:line`
-- **Current State:** [Current vs target, the reachability verdict (production-reachable | dev-only), and the reason for the change]
-- **Recommendation & Rationale:** [How to remediate and the breaking changes to watch for]
-- **Acceptance signal:** [the command or observable that proves this finding is remediated — e.g. `npm audit --omit=dev` reporting zero for this advisory, or `npx knip --production` no longer listing the package]
-- **Agent Prompt:**
-  `[A copy-pasteable, highly specific prompt to execute this update independently (e.g., npm install package@latest)]`
-
-### Dev-only advisories (aggregate)
-
-- **Dimension:** Security Fix
-- **Impact:** [Low | Medium]
-- **Location:** `package-lock.json`
-- **Current State:** [N dev-only advisories with no production reachability; not release-gating]
-- **Recommendation & Rationale:** [Batch-remediate on the next dependency-maintenance pass — do not block the release on these]
-- **Acceptance signal:** `npm audit --json` dev-only advisory count returns to zero.
-
-## Upgrade Batches
-
-Group the safe upgrade path into batches so a maintainer can act on them as
-discrete units. Each batch carries its own acceptance signal:
-
-- **Batch: patch + minor bumps** — every non-breaking `npm outdated` entry
-  whose `wanted` satisfies the declared range, grouped into ONE batch.
-  - **Acceptance signal:** `npm outdated` reports no remaining patch/minor
-    drift and the test suite passes after the bump.
-- **Batch: `<package>` major upgrade** — one batch **per** major bump (each
-  crosses a breaking boundary and lands independently).
-  - **Acceptance signal:** `<package>` at the new major with its migration
-    notes applied and the test suite green.
-
-## Recommended Removals/Replacements
-
-- Remove `[unused-package]` — no production import per `npx knip --production`.
-- Replace `[heavy-library]` with `[light-library]` or native `[browser-api]`.
 ```
 
-## Constraint
-
-This is a **read-only** evaluation. Do not run `npm install` or `npm update`
-unless explicitly requested by the user after reviewing this report.
-
-## Self-cross-check (mandatory — filter false positives before you finalize)
-
-Before you write the report artifact from the previous step, run the shared
-adversarial self-cross-check over your Detailed Findings — see
-[`helpers/audit-self-check.md`](helpers/audit-self-check.md). It defines the
-per-finding evidence bar, the exclusion list, and the final re-open-and-drop
-pass whose `kept <k> / dropped <d>` counts you record in the Executive
-Summary, so the sequential single-pass path filters unverified findings just as
-the orchestrated path's adversarial reviewer does.
+- **Dev-only advisories (aggregate)** — one Detailed Findings entry collapsing
+  all dev-only advisories: Dimension `Security Fix`, Impact `Low | Medium`,
+  Location `package-lock.json`, Acceptance signal
+  ``npm audit --json`` dev-only advisory count returns to zero.
+- **Upgrade Batches** — group the safe upgrade path into discrete batches, each
+  with its own acceptance signal: one batch of all non-breaking patch/minor
+  bumps (`wanted` within range), and one batch **per** major bump (each crosses
+  a breaking boundary and lands independently).
+- **Recommended Removals/Replacements** — remove unused packages (per
+  `npx knip --production`); replace heavy libraries with lighter or native
+  alternatives.

package/.agents/workflows/audit-devops.md

@@ -4,41 +4,31 @@ description: Audit CI/CD workflows, container images, infrastructure-as-code, an
 
 # DevOps Infrastructure Audit
 
-## Role
+You are a Principal DevOps Engineer & Infrastructure Architect auditing this
+repo's DevOps infrastructure, DX tooling, and CI/CD pipelines for
+inefficiencies, security risks, and modernization opportunities. The shared lens
+machinery — read-only constraint, scope interpretation, report envelope +
+finding-block skeleton, severity scale, self-cross-check, and execution
+strategy — lives in
+[`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
+`{{auditOutputDir}}/audit-devops-results.md`. The report adds a **Proposed
+Implementation Roadmap** section (a logical, phased plan).
 
-Principal DevOps Engineer & Infrastructure Architect
+## Scope
 
-## Context & Objective
-
-You are performing a comprehensive, read-only audit of this repository's DevOps
-infrastructure, developer experience (DX) tooling, and CI/CD pipelines. Your
-goal is to identify inefficiencies, security risks, and areas for modernization
-without making any immediate changes.
-
-## Scope (Story / plan-run mode)
-
-When this lens is invoked from `/deliver` close lenses (or a plan-run audit), the
-following block is populated with the Story (or plan-run) change-set file list.
-Otherwise — for any manual `/audit-<dimension>` invocation — the block
-renders the literal substitution token and you MUST treat it as **no
-scope filter — run the lens codebase-wide** exactly as you would have
-before this section existed.
+Interpret this lens's change-set fence per the core's Scope interpretation:
 
 ```text
 {{changedFiles}}
 ```
 
-- If the block above contains a newline-delimited list of file paths,
-  restrict your analysis to those files (and their direct dependencies
-  when the lens explicitly calls for cross-file reasoning).
-- If the block above renders as the literal string `{{changedFiles}}`
-  (i.e. no substitution was supplied), ignore this section entirely and
-  proceed with the full codebase-wide scan defined in the remaining
-  steps.
+## Execution strategy
 
-## Step 1: Detection Battery (Read-Only, Tool-First)
+Run this lens as a single `subagent_type: auditor` dispatch returning the report
+path + Executive Summary; sequential inline execution is the fallback (see the
+core's Execution strategy).
 
-> Apply [`helpers/parallel-tooling.md`](helpers/parallel-tooling.md) when batching the scan below — independent reads belong in one turn, long shells run via `run_in_background` + `Monitor`.
+## Step 1: Detection Battery (Read-Only, Tool-First)
 
 Do **not** audit CI/CD from memory. Run the deterministic battery below first
 and let its output ground every finding. Each tool is **presence-gated**: when
@@ -142,60 +132,3 @@ environment protection rules / required reviewers on the production
 environment, absent rollback or canary strategy, and publish steps that run
 without provenance / SLSA attestation. Cite the `gh run list` history for the
 release workflow's reliability.
-
-## Step 3: Output Requirements
-
-Generate and save a highly structured Markdown audit report to
-`{{auditOutputDir}}/audit-devops-results.md`, using the exact template below.
-
-> Grade every finding's severity on the shared
-> [`Critical | High | Medium | Low` scale](helpers/audit-severity-scale.md).
-
-```markdown
-# DevOps Infrastructure Audit Report
-
-## Executive Summary
-
-[Provide a brief 2–3 sentence overview of the current infrastructure state and
-highlight the most critical overarching themes from the findings.]
-
-## Detailed Findings
-
-[For every gap identified, use the following strict structure. Lead each title
-with the primary file the finding lives in:]
-
-### `path/to/primary-file.ext` — [Short title of the issue]
-
-- **Dimension:** [e.g., Security & Compliance]
-- **Impact:** [Critical | High | Medium | Low]
-- **Location:** `path/to/primary-file.ext:line`
-- **Current State:** [What is currently configured in the codebase]
-- **Recommendation & Rationale:** [The specific fix and why it improves the
-  system]
-- **Acceptance signal:** [the command or observable that proves this finding is remediated — e.g. a green CI run, a hardened config lint, or a re-run of this lens]
-- **Agent Prompt:**
-  `[A copy-pasteable, highly specific prompt to execute this fix independently]`
-
-## Proposed Implementation Roadmap
-
-[Organize the recommended changes into a logical, phased approach — e.g., Phase
-1: Critical Security & Fixing Broken Builds, Phase 2: Performance Optimizations,
-Phase 3: Modernization / Tech Debt.]
-```
-
----
-
-## Constraint
-
-Do NOT execute any code modifications, edit files, create branches, or install
-packages. This is strictly a read-only analysis. Output the report and stop.
-
-## Self-cross-check (mandatory — filter false positives before you finalize)
-
-Before you write the report artifact from the previous step, run the shared
-adversarial self-cross-check over your Detailed Findings — see
-[`helpers/audit-self-check.md`](helpers/audit-self-check.md). It defines the
-per-finding evidence bar, the exclusion list, and the final re-open-and-drop
-pass whose `kept <k> / dropped <d>` counts you record in the Executive
-Summary, so the sequential single-pass path filters unverified findings just as
-the orchestrated path's adversarial reviewer does.

package/.agents/workflows/audit-documentation.md

@@ -4,21 +4,21 @@ description: Audit the repository's main documentation for staleness, semantic d
 
 # Documentation Staleness & Completeness Audit
 
-## Role
-
-Staff Engineer & Documentation Steward
-
-## Context & Objective
-
-You are auditing the repository's primary prose documentation to verify it
-is **up to date and complete**. Prose docs rot silently: commands get
-renamed, scripts move, described workflows change shape, and
-version/topology claims go stale. The deterministic gates
-(`check-doc-links.js`, `check-lifecycle-doc-drift.js`,
-`validate-docs-freshness.js`) catch broken links, drift against generators,
-and per-delivery freshness — they cannot tell whether the prose still
-describes how the code actually behaves. That semantic verification is this
-lens's job.
+You are a Staff Engineer & Documentation Steward verifying the repository's prose
+documentation is **up to date and complete**. Prose rots silently: commands get
+renamed, scripts move, workflows change shape, version/topology claims go stale.
+The deterministic gates (`check-doc-links.js`, `check-lifecycle-doc-drift.js`,
+`validate-docs-freshness.js`) catch broken links, generator drift, and
+per-delivery freshness — they cannot tell whether the prose still describes how
+the code actually behaves. That semantic verification is this lens's job. The
+shared lens machinery — read-only constraint, scope interpretation, report
+envelope + finding-block skeleton, severity scale, self-cross-check, and
+execution strategy — lives in
+[`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
+`{{auditOutputDir}}/audit-documentation-results.md`. Each finding carries a
+**Category:** (`Broken Instruction | Stale Description | Missing Coverage |
+Generator Drift | Link Integrity | History Bloat | Contradiction | Authority
+Drift`); the report adds a **Target Set Coverage** table.
 
 ## Target set (config-driven union)
 
@@ -47,40 +47,32 @@ generator", not "edit the doc". Auto-generated changelog files
 (`docs/CHANGELOG.md`, release-please-owned) are likewise excluded from
 semantic review beyond Step 1's deterministic checks.
 
-## Scope (Story / plan-run mode)
+## Scope (deviant — intersect with the target set)
 
-When this lens is invoked from `/deliver` close lenses (or a plan-run audit), the
-following block is populated with the Story (or plan-run) change-set file list.
-Otherwise — for any manual `/audit-<dimension>` invocation — the block
-renders the literal substitution token and you MUST treat it as **no
-scope filter — run the lens codebase-wide** exactly as you would have
-before this section existed.
+This lens deviates from the shared change-set fence: it intersects the fence
+with the config-driven target set above.
 
 ```text
 {{changedFiles}}
 ```
 
-- If the block above contains a newline-delimited list of file paths,
-  restrict your analysis to the intersection of the target-set union and
-  those files — plus any target-set doc whose claims describe code in the
-  change set (a renamed script invalidates every doc that references it).
-- If the block above renders as the literal string `{{changedFiles}}`
-  (i.e. no substitution was supplied), ignore this section entirely and
-  proceed with the full target-set audit defined in the remaining steps.
+- If the block contains a newline-delimited list of file paths, restrict the
+  audit to the intersection of the target-set union and those files — plus any
+  target-set doc whose claims describe code in the change set (a renamed script
+  invalidates every doc that references it).
+- If the block renders as the literal string `{{changedFiles}}` (no
+  substitution supplied), audit the full target-set union.
 
-## Execution strategy (dual-path)
+## Execution strategy
 
-This lens runs along one of two execution paths (orchestrated dynamic-workflow
-or sequential single-pass). Both emit the **identical** Step 3 report contract;
-downstream consumers (`audit-to-stories`) are agnostic to which path produced
-it. See [`helpers/audit-dual-path.md`](helpers/audit-dual-path.md) for strategy
-selection, the forcing flags, and the read-only guarantee — read `audit-<lens>`
-there as this lens's name.
+This is a **heavyweight lens**: dispatch it as a single `subagent_type: auditor`
+call, or fan its per-doc / per-dimension verification out across parallel
+`auditor` subagents (parallel-tooling Rule 3) and merge under the
+self-cross-check. Sequential inline execution is the fallback (see the core's
+Execution strategy).
 
 ## Step 1: Deterministic Signal First
 
-> Apply [`helpers/parallel-tooling.md`](helpers/parallel-tooling.md) when batching the scan below — independent reads belong in one turn, long shells run via `run_in_background` + `Monitor`.
-
 Run the existing deterministic checkers before any semantic reading — they
 are cheap, exact, and de-duplicate the easy findings:
 
@@ -195,48 +187,6 @@ escalation **after** assigning the base severity from the Step 2 guidance, and
 name the doc's tier in the finding's Current State so the escalation is
 auditable.
 
-## Step 3: Output Requirements
-
-Generate and save a highly structured Markdown audit report to
-`{{auditOutputDir}}/audit-documentation-results.md`, using the exact
-template below.
-
-> Grade every finding's severity on the shared
-> [`Critical | High | Medium | Low` scale](helpers/audit-severity-scale.md).
-
-```markdown
-# Documentation Audit Report
-
-## Executive Summary
-
-[Overview of documentation health (High/Medium/Low confidence that the docs
-match the code), the deterministic-gate verdicts, and primary drift themes.]
-
-## Target Set Coverage
-
-| Doc    | Source                                                                | Verdict                         |
-| ------ | --------------------------------------------------------------------- | ------------------------------- |
-| [path] | [docsContextFiles · docsFreshness · anchor · --paths] | [Current · Drifted · Excluded (generated)] |
-
-## Detailed Findings
-
-[For every gap identified, use the following strict structure. Lead each title
-with the primary doc the finding lives in:]
-
-### `path/to/primary-doc.md` — [Short title of the issue]
-
-- **Category:** [Broken Instruction | Stale Description | Missing Coverage | Generator Drift | Link Integrity | History Bloat | Contradiction | Authority Drift]
-- **Impact:** [Critical | High | Medium | Low] — for a Context Economy finding, this is the base severity **after** any read-tier escalation (Step 2.5); state the doc's tier in Current State.
-- **Location:** `path/to/primary-doc.md:line`
-- **Current State:** [The doc, the exact claim, and what the code actually
-  does — cite file paths and lines on both sides]
-- **Recommendation & Rationale:** [The specific doc edit (or generator
-  rerun) and why it restores accuracy]
-- **Acceptance signal:** [the command or observable that proves this finding is remediated — e.g. `npm run docs:check` passing, the corrected claim now matching the code, or a re-run of this lens]
-- **Agent Prompt:**
-  `[A copy-pasteable, highly specific prompt to execute this doc fix independently]`
-```
-
 ## Periodic full-scope sweep
 
 Context Economy findings accrete slowly — a doc that is lean today grows a
@@ -257,19 +207,22 @@ deduplicates them against existing Issues by fingerprint, and opens
 remediation Stories (or chains into `/plan --seed`) so the Context-Economy
 findings land as actionable, tracked work rather than a report nobody reads.
 
-## Constraint
+## Constraint (lens-specific carve-out)
+
+Run the deterministic checkers in `--check` mode only; the single write is the
+report artifact. Do not edit any documentation or code.
 
-This workflow is **read-only** with respect to the repository: run the
-deterministic checkers in `--check` mode only, and do not edit any
-documentation or code. The single write is the report artifact. Provide the
-analysis and remediation prompts; do not apply changes.
+## Report additions
 
-## Self-cross-check (mandatory — filter false positives before you finalize)
+Beyond the shared skeleton (Executive Summary + Detailed Findings from the
+core), this lens's report carries its own title and a Target Set Coverage table:
 
-Before you write the report artifact from the previous step, run the shared
-adversarial self-cross-check over your Detailed Findings — see
-[`helpers/audit-self-check.md`](helpers/audit-self-check.md). It defines the
-per-finding evidence bar, the exclusion list, and the final re-open-and-drop
-pass whose `kept <k> / dropped <d>` counts you record in the Executive
-Summary, so the sequential single-pass path filters unverified findings just as
-the orchestrated path's adversarial reviewer does.
+```markdown
+# Documentation Audit Report
+
+## Target Set Coverage
+
+| Doc    | Source                                                | Verdict                                    |
+| ------ | ----------------------------------------------------- | ------------------------------------------ |
+| [path] | [docsContextFiles · docsFreshness · anchor · --paths] | [Current · Drifted · Excluded (generated)] |
+```

package/.agents/workflows/audit-navigability.md

@@ -8,6 +8,22 @@ description: >-
 
 # Navigability Audit
 
+You are an Information-Architecture Reviewer & Frontend Navigation Auditor
+evaluating **navigability**: every route a persona is entitled to reach has a
+real navigation door, and every nav door points at a route that exists. The two
+symmetric failure modes are the **orphaned route** (registered but no
+nav-registry entry surfaces it for any persona — only a hardcoded deep-link
+reaches it) and the **dead nav href** (a nav entry points at a route that does
+not exist). This is **mechanism, not content**: the lens reads the consumer's
+configured route tree and nav-registry SSOT and is a **silent no-op when neither
+is configured**. The shared lens machinery — read-only constraint, scope
+interpretation, report envelope + finding-block skeleton, severity scale,
+self-cross-check, and execution strategy — lives in
+[`helpers/audit-lens-core.md`](helpers/audit-lens-core.md). Write the report to
+`{{auditOutputDir}}/audit-navigability-results.md`. Dimension values:
+`Orphaned Route | Dead Nav Href`; extra finding fields **Route / Door:** and
+**Persona(s):** (identifiers only — never full route bodies or persona PII).
+
 ## Applicability
 
 **Web targets only.** Registered with `target: "web"` in
@@ -18,29 +34,6 @@ that has configured this lens's route-tree SSOT always clears the gate. The
 gate only bites where the lens had no route data to read anyway — it converts a
 silent no-op run into no run at all.
 
-## Role
-
-Information-Architecture Reviewer & Frontend Navigation Auditor
-
-## Context & Objective
-
-Evaluate the application's **navigability**: the property that every route a
-persona is entitled to reach has a real navigation door (a menu item, link, or
-button rendered in that persona's authenticated shell), and that every nav door
-points at a route that actually exists. The two failure modes this lens names
-are symmetric:
-
-- **Orphaned route** — a route is registered in the route tree but no
-  nav-registry entry surfaces it for any persona. The feature ships but is
-  unreachable through the product; only a hardcoded deep-link reaches it.
-- **Dead nav href** — a nav-registry entry points at a route (or path) that
-  does not exist in the route tree. The door is rendered but leads nowhere.
-
-This is **mechanism, not content**: the lens reads the consumer's
-configured route tree and nav-registry SSOT (see _Configuration_) and is a
-**silent no-op when neither is configured**. Mandrel ships the slot and the
-wiring; it never ships a specific consumer's route data or nav registry.
-
 ## Whole-route-tree scope (global lens — leak-guard-exempt)
 
 Unlike the change-set-scoped lenses, this lens **always evaluates the whole
@@ -52,10 +45,10 @@ a nav href that the change set never touched.
 Because of this, the navigability lens is registered in the **global-lens
 allowlist** (`GLOBAL_LENS_ALLOWLIST` in
 [`lib/audit-suite/selector.js`](../scripts/lib/audit-suite/selector.js)) and is
-**exempt from the cross-epic-leak guard** (`#3362`) that narrows every other
-lens's evidence to the Epic's `changedFiles`. The exemption is scoped to this
-lens only — the guard is **not** weakened for any other lens, and the
-exemption never lets a foreign Epic's change set leak into a scoped lens.
+**exempt from the cross-epic-leak guard** that narrows every other lens's
+evidence to the change set's `changedFiles`. The exemption is scoped to this
+lens only — the guard is **not** weakened for any other lens, and it never lets
+a foreign change set leak into a scoped lens.
 
 ```text
 {{changedFiles}}
@@ -65,6 +58,12 @@ exemption never lets a foreign Epic's change set leak into a scoped lens.
   populated: navigability is evaluated codebase-wide regardless. The block is
   rendered only for envelope-shape parity with the scoped lenses.
 
+## Execution strategy
+
+Run this lens as a single `subagent_type: auditor` dispatch returning the report
+path + Executive Summary; sequential inline execution is the fallback (see the
+core's Execution strategy).
+
 ## Configuration
 
 Read the consumer's navigability config (resolved from `.agentrc.json`):
@@ -141,56 +140,3 @@ hand):
   the tool via `--refs`.
 
 Only a route that clears **all** of these is a genuine orphan worth a finding.
-
-## Step 4: Output Requirements
-
-Generate and save a structured Markdown audit report to
-`{{auditOutputDir}}/audit-navigability-results.md`, using the template below.
-
-> Grade every finding's severity on the shared
-> [`Critical | High | Medium | Low` scale](helpers/audit-severity-scale.md).
-
-```markdown
-# Navigability Audit report
-
-## Executive Summary
-
-[Reachability health (Score 1-10): count of orphaned routes and dead hrefs.]
-
-## Detailed Findings
-
-[For every orphaned route or dead nav href, use the following strict structure.
-Lead each title with the primary file (route module or nav registry) the
-finding lives in:]
-
-### `path/to/nav-registry-or-route.ext` — [Short title of the issue]
-
-- **Dimension:** [Orphaned Route | Dead Nav Href]
-- **Impact:** [Critical | High | Medium | Low]
-- **Location:** `path/to/nav-registry-or-route.ext:line`
-- **Route / Door:** [the route path or nav-door identifier — identifier only]
-- **Persona(s):** [the persona(s) affected]
-- **Current State:** [why the route is unreachable or the href is dead]
-- **Recommendation & Rationale:** [the nav-registry change that restores
-  reachability — add a door for the orphaned route, or fix/remove the dead
-  href]
-- **Acceptance signal:** [the command or observable that proves this finding is remediated — e.g. a re-run of this lens reporting the route reachable]
-- **Agent Prompt:**
-  `[A copy-pasteable, specific prompt to execute the nav-registry fix.]`
-```
-
-## Constraint
-
-This is a **read-only** audit. Provide the critique and the nav-registry fixes,
-but do not modify the route tree or the nav registry. Log route and door
-identifiers only — never full route bodies, source contents, or persona data.
-
-## Self-cross-check (mandatory — filter false positives before you finalize)
-
-Before you write the report artifact from the previous step, run the shared
-adversarial self-cross-check over your Detailed Findings — see
-[`helpers/audit-self-check.md`](helpers/audit-self-check.md). It defines the
-per-finding evidence bar, the exclusion list, and the final re-open-and-drop
-pass whose `kept <k> / dropped <d>` counts you record in the Executive
-Summary, so the sequential single-pass path filters unverified findings just as
-the orchestrated path's adversarial reviewer does.