@sylad/cadence 0.2.0 → 0.5.0

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
     {
       "name": "cadence",
       "description": "Session start and close rituals driven by a versioned plan (raf), and deliveries proven by their effect. Needs the cadence CLI (npm i -g @sylad/cadence).",
-      "version": "0.2.0",
+      "version": "0.5.0",
       "source": "./",
       "author": { "name": "Sylvain Ladoire" }
     }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cadence",
-  "description": "A repo-native working method: session start and close rituals driven by a versioned plan (raf), deliveries proven by their effect, and a UX reviewer agent.",
-  "version": "0.2.0",
+  "description": "A repo-native working method: session start and close rituals driven by a versioned plan (raf), deliveries proven by their effect, and two reviewer agents (UX, code).",
+  "version": "0.5.0",
   "author": { "name": "Sylvain Ladoire" },
   "homepage": "https://github.com/Sylad/cadence",
   "repository": "https://github.com/Sylad/cadence",

package/README.md

@@ -11,9 +11,11 @@ Four tools:
 - **session**: the facts to start and to close a work session;
 - **deliver**: wait for the CI of the pushed commit, deploy, then **verify the effect**.
 
-And three [Claude Code](https://claude.com/claude-code) skills that turn them
-into rituals — `session-start`, `session-close`, `deliver` — plus a `ux-reviewer`
-agent: no user-facing change is done before its usability review.
+And four [Claude Code](https://claude.com/claude-code) skills that turn them
+into rituals — `session-start`, `session-close`, `deliver`, and `lead` to pilot
+several projects through subagents — plus two reviewer agents, each behind an
+opt-in gate: `ux-reviewer` (no user-facing change is done before its usability
+review) and `code-reviewer` (no lot with commits is done before its code review).
 
 ## raf
 
@@ -49,6 +51,7 @@ raf gantt                         # docs/plan/gantt.html
 | `raf add "title" [--estimate d] [--quickwin] [--visible] [--after L2,L4] [--parent L3]` | add a lot or a sub-task, print its id |
 | `raf start <id>` · `raf done <id> [--force]` · `raf drop <id> [--reason text]` | dated transitions (`done` refuses open sub-tasks unless `--force`) |
 | `raf note <id> "text"` | dated note — keep decisions next to the work |
+| `raf commits <id>` | the commits counted for a lot (the set the code review gate uses), one `<sha> <subject>` per line, oldest first |
 | `raf now` | what to do next |
 | `raf list [--status s]` | flat list |
 | `raf check [--since date] [--idle 7]` | since the plan's adoption date by default: commits without a lot (commits touching only the plan are exempt), unknown ids, `todo` lots that already have commits, idle lots, `done` lots with open sub-tasks, bad or circular dependencies |
@@ -65,6 +68,7 @@ version: 1
 project: my-app
 prefix: L
 since: 2026-09-28     # commits before this date are not audited
+ignore: ['^chore\(batch\):']   # optional: subjects of automated commits, neither audited nor counted for a lot
 lots:
   - id: L1
     title: Monthly dedup on merge
@@ -81,6 +85,57 @@ lots:
       - { id: t1, title: write the migration, status: done }
 ```
 
+### A plan elsewhere, or in another format
+
+`cadence.yaml`, at the repository root, can say where the plan is. The short form keeps raf's own
+format, and the plan stays writable:
+
+```yaml
+plan: planning/todo.yaml
+```
+
+A project that already keeps its plan with its own tool is read **without migrating it**: describe
+the file, and `raf now`, `raf list`, `raf commits`, `raf check`, `raf gantt` and
+`cadence session start|close` work on it. Such a plan is **read-only** —
+`raf add|start|done|note|ux|review` refuse and leave the file to the project's tool, and the two
+review gates do not apply to it (a `uxSince` or `reviewSince` written in it is ignored).
+
+```yaml
+plan:
+  path: docs/plan/taches.yaml
+  project: my-app               # what the file does not say itself: project, since, ignore
+  since: 2026-10-02
+  ignore: ['^plan: ']
+  files: [docs/plan/journal.ndjson]   # kept with the plan: a commit touching only these is a plan commit
+  lots: taches                  # root key holding the list (default: lots)
+  fields:                       # raf field: key in the file (a list = first one present)
+    title: titre
+    status: etat
+    estimate: effort
+    created: cree_le
+    started: demarre_le
+    finished: [livre_le, ferme_le]
+    notes: note
+    parent: parent
+  statuses:                     # raf status: their states
+    todo: [prevu, specifie]
+    doing: [en_cours, teste]
+    done: [deploye, valide]
+    dropped: caduc
+  estimates: { S: 0.5, M: 1, L: 3 }   # their effort labels, in working days
+```
+
+- Fields: `id`, `title`, `status`, `estimate`, `quickwin`, `visible`, `after`, `created`, `started`,
+  `finished`, `notes`, `parent`; one left out is read under its own name. A timestamp counts for
+  its day; a note written as plain text is one note.
+- `parent`: an entry `B33/t1-fusion` whose parent is `B33` becomes the sub-task `t1-fusion` of `B33`.
+- Ids need no prefix: a commit belongs to a lot when its message cites one of the plan's ids as a
+  whole word (`E-A2`, `NC2.4`, `B33/t1-fusion`).
+  An id that is not in the plan cannot be told from ordinary text: such a commit counts as
+  "without a lot", never as an unknown reference.
+- A state missing from `statuses`, or an effort label missing from `estimates`, is reported by
+  `raf check`.
+
 ### Gantt scheduling
 
 One lane of work. Finished lots use their real dates (or their commits' dates);
@@ -112,6 +167,7 @@ cadence news build -o frontend/public/nouveautes
 ---
 title: Amounts like 3.000 read as three thousand
 date: 2026-09-29
+created: 2026-09-29T14:32+02:00
 lots: [L8]
 captures: [captures/l8.png]
 # nocapture: reason, when a screenshot makes no sense
@@ -121,9 +177,10 @@ Imported statements now read **3.000** as three thousand, not three.
 
 | Command | Effect |
 |---|---|
-| `cadence news new <lot…> [--title t]` | entry skeleton, dated today, titled after the lot |
-| `cadence news list` | entries, newest first |
-| `cadence news check` | visible lots done without entry, unknown lots, missing or undeclared screenshots, bad headers |
+| `cadence news new <lot…> [--title t]` | entry skeleton, dated and timed now (`date`, `created`), titled after the lot |
+| `cadence news list` | entries, newest first (see *Order* below) |
+| `cadence news check` | visible lots done without entry, unknown lots, missing or undeclared screenshots, entries without creation time, bad headers |
+| `cadence news stamp` | migration: writes `created:` into entries without one (or with an empty one), from the author date of the commit that added the file under its current name (now if not committed yet) |
 | `cadence news build [-o dir]` | `nouveautes.json` + `index.html` + screenshots (default `docs/nouveautes/site`) |
 
 `--dir` changes the entries folder (default `docs/nouveautes` at the git root).
@@ -132,6 +189,21 @@ The Markdown is deliberately small: paragraphs, `-` lists, `**bold**`,
 `{ project, generated, entries: [{ slug, title, date, lots, captures, html }] }`,
 with screenshot paths relative to the JSON file.
 
+**Order.** Everywhere (`list`, `build`, the JSON), entries are strictly newest
+first: by `date`, then, on the same day, by creation time. Every entry carries
+it to the minute in its `created` header, which `cadence news new` writes as
+local time with an explicit offset (`2026-09-29T14:32+02:00`, or `Z`). The
+offset is required, so the order does not depend on the machine's time zone:
+`news check` (and `raf check`) flags a value without it, an impossible one, an
+empty `created:`, and an entry without `created`. `cadence news stamp` fills
+it in older entries (or replaces an empty one) from the author date of the
+commit that added the file under its current name; until then, that date is
+used for sorting (an entry not committed yet counts as the newest). Renames
+are not followed: a renamed entry counts as added on the day of the rename,
+so stamp it before renaming it. The file name only breaks the remaining ties,
+since it follows the title, not the chronology. The page and the JSON still
+show the day only.
+
 ### UX review
 
 ```sh
@@ -142,7 +214,32 @@ raf ux L8 "no screen: calculation fix"
 
 With the rule on, `raf done` refuses a visible lot without a review (`--force`
 to override) and `raf check` reports visible lots finished after the `uxSince`
-day without one. Plans without `uxSince` are not affected.
+day without one. An empty verdict is refused. Plans without `uxSince` are not
+affected.
+
+### Code review
+
+```sh
+raf review enable                  # from today, a lot with commits needs a code review before done
+raf commits L4                     # what there is to review: the commits the gate counts for the lot
+raf review L4 "compliant after 2 fixes"   # record the verdict (from the code-reviewer agent)
+```
+
+The counterpart of the UX review, off by default. With the rule on, `raf done`
+refuses a lot that has at least one commit citing it and no recorded verdict
+(`--force` to override), and `raf check` reports such lots finished after the
+`reviewSince` day. A lot with no commit has nothing to review; neither does a
+lot whose only commits touch the plan itself, predate the plan's `since` or
+match an `ignore:` pattern — `raf commits <id>` prints exactly the counted set.
+
+The verdict is tied to what was reviewed: `raf review` stores it on the lot with
+the sha of the lot's latest counted commit (`review: { date, verdict, commit }`,
+`commit: null` when the lot had none). A counted commit made after that one
+makes the review stale: `raf done` refuses (`--force` to override), and
+`raf check` reports a finished lot, until the lot is reviewed again and
+`raf review` is rerun. A verdict
+written by hand without a `commit` field is not checked for staleness. An empty
+verdict is refused. Plans without `reviewSince` are not affected.
 
 ## session
 
@@ -161,6 +258,20 @@ done), quick wins first. Local state lives in the git directory, never committed
 the close notes per worktree, the delivery lock and log in `.git/cadence/`, shared
 by all the worktrees of a clone.
 
+A project that already has its own morning and evening scripts keeps them: name
+them in `cadence.yaml` and their output is added to the report, under "Faits
+propres au projet", before the proposals (start) or the verdict (close).
+
+```yaml
+session:
+  start: ./scripts/morning.sh "$CADENCE_SINCE"    # sh, at the repo root, 120 s at most
+  close: ./scripts/evening.sh "$CADENCE_SINCE"
+```
+
+The commands get `CADENCE_SINCE` (the `--since` in effect) and `CADENCE_TODAY`. They
+add facts and decide nothing: a failing command is reported and changes neither
+the exit code nor the verdict.
+
 ## deliver
 
 A delivery is done when its checks pass, not when a tool says "success".
@@ -202,6 +313,37 @@ cadence deliver              # 0 delivered and verified · 1 a step failed · 2
 - On success the lots cited by the commits since the previous delivery are
   listed, so you can `raf done` those whose effect you have seen.
 
+### A project with its own delivery script
+
+A project that already delivers with its own script (CI wait, deploy, business
+checks) plugs it in instead of rewriting it as `ci` / `deploy` / `verify`:
+
+```yaml
+deliver:
+  script: ./scripts/ship.sh "$CADENCE_SHORT"   # replaces ci and deploy
+  allowDirty: true                             # optional: a modified tree is reported, not refused
+  deployTimeout: 3600                          # seconds, for the whole script
+  verify: []                                   # optional here: the script's own checks count
+```
+
+```sh
+cadence deliver -- api frontend --news docs/changelog/x.md -- map    # everything after the first « -- » goes to the script
+cadence deliver --dry-run -- api                                      # shows the full command, runs nothing
+cadence deliver --sha 6b0d9aa -- api                                  # an earlier pushed commit instead of HEAD
+```
+
+`--sha` (any mode) delivers a pushed commit other than `HEAD` — for a CI that
+builds each service only on the commit that touched it. `allowDirty` suits a
+working tree shared by several sessions when the delivery starts from a pushed
+sha and never from local files; without it a modified tree is refused.
+
+cadence keeps what the script usually lacks: the preconditions (clean tree, pushed
+`HEAD`), the lock (never two deliveries at once), the delivery log and the lots
+delivered. Arguments are quoted for `sh`, so spaces and quotes reach the script
+intact. If the script commits and pushes during the delivery (stamping a
+changelog entry, say), the new `HEAD` is the sha recorded as delivered. Exit code
+0 of the script means delivered; `verify` checks, if any, run after it.
+
 ## Claude Code skills
 
 As a plugin:
@@ -211,10 +353,10 @@ As a plugin:
 /plugin install cadence@cadence
 ```
 
-gives `/cadence:session-start`, `/cadence:session-close`, `/cadence:deliver` and
-the `ux-reviewer` agent. Or copy them into the repository with
-`cadence skills install` (to `.claude/skills/cadence-*` and
-`.claude/agents/cadence-ux-reviewer.md`; `--dir` for another `.claude` folder,
+gives `/cadence:session-start`, `/cadence:session-close`, `/cadence:deliver`,
+`/cadence:lead` and the `ux-reviewer` and `code-reviewer` agents. Or copy them into the
+repository with `cadence skills install` (to `.claude/skills/cadence-*` and
+`.claude/agents/cadence-*.md`; `--dir` for another `.claude` folder,
 `--force` to overwrite local edits).
 
 - **session-start**: reports the facts briefly, proposes three lots from the
@@ -222,12 +364,44 @@ the `ux-reviewer` agent. Or copy them into the repository with
 - **session-close**: plan hygiene, clean repository, memory limited to what the
   repository does not say, new skills or agents proposed but never created, three
   lines for next time.
+- A project with its own tooling keeps it: its plan is read where it is (`plan:`),
+  its delivery script is called by `cadence deliver` (`deliver.script`), its
+  morning and evening scripts feed the session report (`session:`), and its own
+  skills can become one-line aliases of `session-start` / `session-close`.
 - **deliver**: dry run, delivery, and on failure the cause fixed rather than a
   blind retry.
+- **lead**: from a folder holding several projects, one subagent per project
+  gathers the facts, you choose the priorities, each lot is delegated to a
+  subagent with a standard brief (test first, commits citing the lot, no push),
+  reviewed by the `code-reviewer` agent, re-verified by the lead, then delivered
+  one project at a time. Two subagents at most, never two in the same repository.
 - **ux-reviewer** (agent): captures at 1440 and 390 px, findings grounded in a
   named rule (Nielsen, WCAG 2.2 AA) or a measurement, ranked, turned into
   `raf add --parent` sub-tasks, and a one-line verdict for `raf ux`. It never
   edits code.
+- **code-reviewer** (agent): any stack; given a repository and a lot id, it reads
+  the diff itself from the commits that cite the lot — not the author's summary —
+  and the project's CLAUDE.md, when there is one, for its conventions; findings grounded in a
+  measurement (a failing command, changed code without a test, a duplicated
+  block, dead code) or a named rule, each with `file:line` and a concrete
+  scenario; real defects only, ranked, what it could not verify, and a one-line
+  verdict for `raf review`. It takes the lot's commits from `raf commits`, never
+  runs a build whose output is used live, and never edits code.
+
+## Releasing
+
+A version exists in three places and is published in two; a release does all of it, in this order:
+
+1. Bump `version` in `package.json` (then `npm install` to refresh `package-lock.json`),
+   `.claude-plugin/plugin.json` and `.claude-plugin/marketplace.json`, in the commit that closes the lot.
+2. `npm publish --access public` — `prepublishOnly` runs the type-check and the tests first, `prepare`
+   builds `dist/`; a red suite stops the publication.
+3. `git tag v<version> && git push origin main v<version>`.
+4. Check the effect: `npm view @sylad/cadence version` answers the new version.
+
+The Claude Code plugin is read from the repository, so step 3 is what updates it; npm is what
+`npx @sylad/cadence` and a global install read. Skipping step 2 leaves npm behind without any error —
+0.3.0 and 0.4.0 were never published.
 
 ## License
 

package/agents/code-reviewer.md

@@ -0,0 +1,89 @@
+---
+name: code-reviewer
+description: Code reviewer for any stack — reviews the commits of one lot of the plan before it is marked done. Given a repository path and a lot id, it reads the diff itself from the commits that cite the lot, never from the author's summary; grounds every finding in a measurement (a command that fails, changed code without a test, a duplicated block, dead code, a size) or a named rule (a convention quoted from the project's CLAUDE.md, a named language or framework practice), never in taste; reports real defects only, ranked, each with file:line and a concrete failure or maintenance scenario, and ends with a one-line verdict for `raf review <lot>`. Use when a lot that has commits is about to be closed, or after a subagent reports its work. Does not modify code.
+tools: Read, Grep, Glob, Bash
+---
+
+You review the code of one lot of a plan. You report; you never edit code.
+
+## Inputs
+
+The absolute path of the repository and the id of the lot. Nothing else is needed, and anything else
+you are given — the author's report, a list of files, "the tests pass" — is a claim to check, not a
+fact. If the path or the id is missing, or the lot has no commit to review, say so and stop.
+
+## Method
+
+1. **Read the rules of the project first**: its CLAUDE.md (and the files it points to). Note the
+   conventions that are written down: only those, and the named practices of the language or
+   framework in use, can be held against the code. If the repository has no CLAUDE.md, say so in
+   the report and hold only the lot's goal and the named practices against the code — a parent
+   folder's CLAUDE.md does not count unless it names this project. Then find the commands that
+   test, type-check, lint and build: in the README, then in the manifest (`package.json` scripts,
+   Makefile, `pyproject.toml`…).
+2. **Read the lot**: its title, notes and sub-tasks in the plan (`docs/plan/raf.yaml`, or the file
+   named by `plan:` in `cadence.yaml`). That is the goal the commits are measured against. When the
+   lot has only a title, also read the bodies of its commits and any spec the lot cites.
+3. **Get the commits from the tool**: `raf commits <id>` prints exactly the set the gate counts —
+   `<sha> <subject>` per line, oldest first, the commits that only touch the plan left out. Only
+   when `raf` is not available, fall back to
+   `git log --reverse --format='%h %cs %s' -E --grep='(^|[^[:alnum:]_/.-])<id>($|[^[:alnum:]_.-]|\.($|[^[:alnum:]_]))'`
+   (escape the dots of the id; the right guard keeps a `NC2.4` commit out of lot `NC2`) and drop
+   the commits that only touch the plan. List the commits you review in the report.
+4. **Read the diff yourself**: `git show --stat <sha>` then `git show <sha>` for each commit, and
+   every changed file as it stands now — a later commit may have moved what an earlier one wrote,
+   and a finding must point at a line that exists today. Read what the changed code calls and what
+   calls it, far enough to know whether a caller is broken.
+5. **Run what verifies**: the project's tests, type check and linter, with the commands found in
+   step 1. A linter or coverage tool the project does not have goes under "not verified": it is
+   not a finding. Do not run a command that deploys, publishes, pushes, migrates data or reaches a
+   remote system, and never run a build whose output directory is used live — the hint is an
+   output directory that a `bin` entry or a symlink on the PATH points to; list what you did not
+   run under "not verified". An experiment (a reproduction, a scratch repository) is allowed in a
+   temporary directory outside the repository, removed afterwards: the working tree is left as you
+   found it.
+6. **Check, and measure where a number exists:**
+   - does the code do what the lot says, in the cases the lot names and at their edges (empty,
+     absent, twice, in the wrong order, refused);
+   - changed behaviour without a test: name the changed function or branch and show that no test
+     reaches it (`grep` its name in the tests, or run the coverage if the project has it);
+   - a test that cannot fail, or that asserts something else than what its title says;
+   - a duplicated block: both places, the number of lines, what will drift when only one is fixed;
+   - dead code: a symbol the lot added or orphaned, with the search that finds no reference;
+   - sizes: lines of a changed file or function before and after the lot — a size is a finding
+     only against a limit the project states, or through its consequence (two responsibilities in
+     one function, one of them untested);
+   - errors swallowed, inputs trusted, resources not released, secrets or personal data written
+     to a log or to the repository;
+   - a written convention of the project not followed: quote the line of CLAUDE.md.
+7. **Rank** each finding: *blocking* (wrong result, lost data, security hole, crash, a command that
+   fails), *major* (breaks in a plausible scenario, behaviour changed without a test, a written
+   convention broken), *minor* (costs maintenance: duplication, dead code). Untested code that is
+   practically unreachable, and a rule that holds as written while an edge defeats its purpose, are
+   *minor* — unless they can lose or corrupt data.
+
+## Output
+
+A short report:
+
+- **Commits reviewed**: sha and subject, and the commands you ran with their result (counts).
+- **Findings**, most severe first, each with: `file:line`, what is wrong, the measurement or the
+  named rule it rests on, and the scenario — the input or the sequence that fails, or the change
+  that will be made wrong later because of it. No finding without all four.
+- **Not verified**: what you could not run or see (no test environment, a deployed effect, an
+  external service, uncommitted changes in the working tree), stated plainly.
+- **Proposed sub-tasks**: one `raf add --parent <lot> "…"` line per finding worth doing; on a
+  read-only plan (`cadence.yaml` maps the fields of a file kept by another tool), plain lines for
+  the project's own tool instead.
+- **Verdict**, one line, alone, suitable for `raf review <lot> "…"` — e.g. "compliant",
+  "compliant after 2 fixes", "not compliant: 1 blocking". When there is nothing to report, say so
+  in that one line: an empty list of findings is a valid review. It is the last line of the
+  review; extra sections a caller asks for come after it.
+
+## Do not
+
+- Judge on taste: naming, formatting or structure you would have written differently is not a
+  finding unless a written convention or a named practice says so.
+- Report a finding you have not read in the code or measured, or pad the list: real defects only.
+- Take the author's summary, or a green run you did not launch, as proof.
+- Edit code, commit, or record `raf review` yourself: the session that owns the lot does it.

package/bin/cadence.js

@@ -27,8 +27,9 @@ if (tool === 'raf') {
                     faits de reprise : notes de la veille, en cours, fait depuis, écarts, propositions
   cadence session close [--since …]    faits de clôture ; code 1 tant que ce n'est pas fermé
   cadence session next "ligne" …       notes pour la prochaine session (sans argument : efface)
-  cadence deliver [--dry-run] [--config cadence.yaml]
-                    CI du sha poussé → déploiement → vérifications de l'effet
+  cadence deliver [--dry-run] [--sha rév] [--config cadence.yaml] [-- arguments du script du projet]
+                    CI du sha poussé → déploiement → vérifications de l'effet ;
+                    ou le script de livraison du projet (deliver.script), sous verrou et journal
   cadence skills install [--dir .claude] [--force]
                     installe les skills Claude Code session-start, session-close, deliver et l'agent ux-reviewer`);
   process.exitCode = !tool || ['help', '--help', '-h'].includes(tool) ? 0 : 2;

package/dist/audit.js

@@ -4,10 +4,32 @@ import { changedFiles, readCommits } from './git.js';
 import { linkCommits } from './link.js';
 import { loadEntries, newsIssues } from './news.js';
 import { isOpen } from './plan.js';
-/** Un commit qui ne touche que le plan (ou la page Gantt) n'a pas besoin de citer un lot. */
+/** Le plan, sa page Gantt et les fichiers tenus avec lui (cadence.yaml : plan.files). */
+function ownFiles(plan, root) {
+    return new Set([relative(root, plan.path), relative(root, join(dirname(plan.path), 'gantt.html')), ...plan.files]);
+}
+/** Commits du dépôt sans les commits automatiques (motifs `ignore`) : ni audités ni comptés pour un lot. */
+export function planCommits(plan, root, opts = {}) {
+    const { patterns } = plan.ignore;
+    const commits = readCommits(root, opts);
+    return patterns.length ? commits.filter((c) => !patterns.some((re) => re.test(c.subject))) : commits;
+}
+/** Le commit ne touche-t-il que le plan (ou la page Gantt) ? */
+export function isPlanOnly(sha, plan, root) {
+    const own = ownFiles(plan, root);
+    const files = changedFiles(root, sha);
+    return files.length > 0 && files.every((f) => own.has(f));
+}
+/**
+ * N'ont pas besoin de citer un lot : un commit qui ne touche que le plan (ou la page Gantt), et un
+ * commit automatique dont le sujet correspond à un motif `ignore:` du plan.
+ */
 export function exemptPlanOnly(linked, plan, root) {
-    const own = new Set([relative(root, plan.path), relative(root, join(dirname(plan.path), 'gantt.html'))]);
+    const own = ownFiles(plan, root);
+    const { patterns } = plan.ignore;
     const orphans = linked.orphans.filter((c) => {
+        if (patterns.some((re) => re.test(c.subject)))
+            return false;
         const files = changedFiles(root, c.sha);
         return files.length === 0 || !files.every((f) => own.has(f));
     });
@@ -23,10 +45,58 @@ export function auditSince(plan, explicit) {
 /** Écarts entre le plan, l'historique et les Nouveautés — ce que `raf check` affiche. */
 export function audit(plan, root, newsDir, today, opts = {}) {
     const lots = plan.lots();
-    const linked = exemptPlanOnly(linkCommits(lots, readCommits(root, { since: auditSince(plan, opts.since) }), plan.prefix), plan, root);
+    const linked = exemptPlanOnly(linkCommits(lots, planCommits(plan, root, { since: auditSince(plan, opts.since) }), plan.refs), plan, root);
     // L'inactivité se mesure sur tout l'historique, pas seulement la fenêtre --since.
-    const all = linkCommits(lots, readCommits(root), plan.prefix);
-    return [...check(lots, { ...linked, byLot: all.byLot }, today, opts.idle ?? 7), ...newsIssues(lots, loadEntries(newsDir), newsDir), ...uxIssues(plan)];
+    const all = linkCommits(lots, planCommits(plan, root), plan.refs);
+    // Planifier un lot (commit qui ne touche que le plan) n'est pas y travailler : un lot « todo »
+    // cité seulement par de tels commits n'a pas à être démarré. Ni par des commits antérieurs à
+    // l'adoption du plan : citer un identifiant n'engageait alors à rien.
+    for (const l of lots) {
+        const cs = all.byLot.get(l.id);
+        if (l.status === 'todo' && cs)
+            all.byLot.set(l.id, workCommits(plan, root, cs));
+    }
+    // Un plan en lecture seule ne reçoit aucun verdict de raf : les deux portes n'y valent pas, même si
+    // uxSince ou reviewSince y sont écrits à la main — l'écart ne pourrait jamais être levé.
+    const gates = plan.readonly ? [] : [...uxIssues(plan), ...reviewIssues(plan, root, all.byLot)];
+    const issues = [...check(lots, { ...linked, byLot: all.byLot }, today, opts.idle ?? 7), ...newsIssues(lots, loadEntries(newsDir), newsDir), ...gates,
+        ...plan.ignore.invalid.map((src) => ({ message: `ignore : motif invalide « ${src} »` }))];
+    // Un plan en lecture seule se corrige avec l'outil du projet : ne pas conseiller une commande raf qui refuserait.
+    return plan.readonly ? issues.map((i) => ({ ...i, message: i.message.replace(/ — raf start .*$/, '') })) : issues;
+}
+/** Commits qui portent du travail sur un lot : ni antérieurs à l'adoption du plan, ni réduits au plan. */
+function workCommits(plan, root, commits) {
+    const adopted = plan.since;
+    return commits.filter((c) => (!adopted || c.day >= adopted) && !isPlanOnly(c.sha, plan, root));
+}
+/** Commits liés à un lot, du plus récent au plus ancien, avant tout tri : commits de plan et d'avant l'adoption compris. */
+function lotCommits(plan, root, lotId) {
+    return linkCommits(plan.lots(), planCommits(plan, root), plan.refs).byLot.get(lotId) ?? [];
+}
+/** Commits à relire d'un lot, du plus récent au plus ancien — ce que compte la porte de revue de code et que liste `raf commits`. */
+export function lotWork(plan, root, lotId) {
+    return workCommits(plan, root, lotCommits(plan, root, lotId));
+}
+/**
+ * Commits à relire que la revue de code d'un lot ne couvre pas, parmi ses commits liés (du plus récent
+ * au plus ancien) : tous sans verdict ; aucun pour un verdict qui ne dit pas quel commit il a relu
+ * (écrit à la main) ; sinon ceux qui suivent le commit relu — tous quand il n'y en avait aucun, ou
+ * quand il n'est plus parmi ceux du lot (historique réécrit) : la revue ne se rattache alors à rien.
+ */
+function unreviewed(plan, root, review, linked) {
+    if (!review)
+        return workCommits(plan, root, linked);
+    const reviewed = review.commit;
+    if (reviewed === undefined)
+        return [];
+    const at = reviewed === null ? -1 : linked.findIndex((c) => c.sha === reviewed);
+    // Seuls les commits postérieurs sont examinés : un lot relu à son dernier commit ne coûte aucun appel git.
+    return workCommits(plan, root, at < 0 ? linked : linked.slice(0, at));
+}
+/** Nombre de commits d'un lot que sa revue de code ne couvre pas — ce que `raf done` refuse quand la porte est active. */
+export function unreviewedWork(plan, root, lotId) {
+    const lot = plan.lots().find((l) => l.id === lotId);
+    return lot ? unreviewed(plan, root, lot.review, lotCommits(plan, root, lotId)).length : 0;
 }
 /**
  * Lots visibles terminés APRÈS le jour d'activation sans revue UX enregistrée. Le jour même est exclu :
@@ -42,6 +112,26 @@ export function uxIssues(plan) {
         .filter((l) => l.visible && l.status === 'done' && !l.ux && (!l.finished || l.finished > since))
         .map((l) => ({ message: `${l.id} est visible et terminé sans revue UX — raf ux ${l.id} "verdict"` }));
 }
+/**
+ * Lots terminés APRÈS le jour d'activation avec des commits à relire que leur revue de code ne couvre
+ * pas : aucun verdict, ou un verdict antérieur à ces commits. Même règle de date que `uxIssues` ; un
+ * lot sans commit n'a rien à faire relire.
+ */
+export function reviewIssues(plan, root, byLot) {
+    const since = plan.reviewSince;
+    if (!since)
+        return [];
+    return plan
+        .lots()
+        .filter((l) => l.status === 'done' && (!l.finished || l.finished > since))
+        .map((l) => ({ id: l.id, reviewed: !!l.review, commits: unreviewed(plan, root, l.review, byLot.get(l.id) ?? []).length }))
+        .filter((l) => l.commits > 0)
+        .map((l) => ({
+        message: l.reviewed
+            ? `${l.id} est terminé avec ${l.commits} commit(s) postérieur(s) à sa revue de code, à refaire — raf review ${l.id} "verdict"`
+            : `${l.id} est terminé avec ${l.commits} commit(s) sans revue de code — raf review ${l.id} "verdict"`,
+    }));
+}
 /** Ce qui vient ensuite : lots en cours, puis lots prêts (dépendances closes), gains rapides d'abord. */
 export function nextUp(lots) {
     const byId = new Map(lots.map((l) => [l.id, l]));

package/dist/check.js

@@ -1,6 +1,7 @@
 import { diffDays } from './dates.js';
 import { isOpen } from './plan.js';
-const short = (c) => `${c.sha.slice(0, 7)} ${c.subject}`;
+/** Un commit sur une ligne : sha abrégé et sujet. */
+export const short = (c) => `${c.sha.slice(0, 7)} ${c.subject}`;
 export function check(lots, linked, today, idleDays = 7) {
     const issues = [];
     const ids = new Set(lots.map((l) => l.id));