@sylad/cadence 0.2.0 → 0.6.0

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
     {
       "name": "cadence",
       "description": "Session start and close rituals driven by a versioned plan (raf), and deliveries proven by their effect. Needs the cadence CLI (npm i -g @sylad/cadence).",
-      "version": "0.2.0",
+      "version": "0.6.0",
       "source": "./",
       "author": { "name": "Sylvain Ladoire" }
     }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cadence",
-  "description": "A repo-native working method: session start and close rituals driven by a versioned plan (raf), deliveries proven by their effect, and a UX reviewer agent.",
-  "version": "0.2.0",
+  "description": "A repo-native working method: session start and close rituals driven by a versioned plan (raf), deliveries proven by their effect, and three reviewer agents (UX, code, QA).",
+  "version": "0.6.0",
   "author": { "name": "Sylvain Ladoire" },
   "homepage": "https://github.com/Sylad/cadence",
   "repository": "https://github.com/Sylad/cadence",

package/README.md

@@ -11,9 +11,13 @@ Four tools:
 - **session**: the facts to start and to close a work session;
 - **deliver**: wait for the CI of the pushed commit, deploy, then **verify the effect**.
 
-And three [Claude Code](https://claude.com/claude-code) skills that turn them
-into rituals — `session-start`, `session-close`, `deliver` — plus a `ux-reviewer`
-agent: no user-facing change is done before its usability review.
+And four [Claude Code](https://claude.com/claude-code) skills that turn them
+into rituals — `session-start`, `session-close`, `deliver`, and `lead` to pilot
+several projects through subagents — plus three reviewer agents: `ux-reviewer`
+(no user-facing change is done before its usability review) and `code-reviewer`
+(no lot with commits is done before its code review), each behind an opt-in
+gate, and `qa-reviewer`, which walks the delivered app in a real browser and
+reports a page left empty or in error.
 
 ## raf
 
@@ -49,6 +53,7 @@ raf gantt                         # docs/plan/gantt.html
 | `raf add "title" [--estimate d] [--quickwin] [--visible] [--after L2,L4] [--parent L3]` | add a lot or a sub-task, print its id |
 | `raf start <id>` · `raf done <id> [--force]` · `raf drop <id> [--reason text]` | dated transitions (`done` refuses open sub-tasks unless `--force`) |
 | `raf note <id> "text"` | dated note — keep decisions next to the work |
+| `raf commits <id>` | the commits counted for a lot (the set the code review gate uses), one `<sha> <subject>` per line, oldest first |
 | `raf now` | what to do next |
 | `raf list [--status s]` | flat list |
 | `raf check [--since date] [--idle 7]` | since the plan's adoption date by default: commits without a lot (commits touching only the plan are exempt), unknown ids, `todo` lots that already have commits, idle lots, `done` lots with open sub-tasks, bad or circular dependencies |
@@ -65,6 +70,7 @@ version: 1
 project: my-app
 prefix: L
 since: 2026-09-28     # commits before this date are not audited
+ignore: ['^chore\(batch\):']   # optional: subjects of automated commits, neither audited nor counted for a lot
 lots:
   - id: L1
     title: Monthly dedup on merge
@@ -81,6 +87,57 @@ lots:
       - { id: t1, title: write the migration, status: done }
 ```
 
+### A plan elsewhere, or in another format
+
+`cadence.yaml`, at the repository root, can say where the plan is. The short form keeps raf's own
+format, and the plan stays writable:
+
+```yaml
+plan: planning/todo.yaml
+```
+
+A project that already keeps its plan with its own tool is read **without migrating it**: describe
+the file, and `raf now`, `raf list`, `raf commits`, `raf check`, `raf gantt` and
+`cadence session start|close` work on it. Such a plan is **read-only** —
+`raf add|start|done|note|ux|review` refuse and leave the file to the project's tool, and the two
+review gates do not apply to it (a `uxSince` or `reviewSince` written in it is ignored).
+
+```yaml
+plan:
+  path: docs/plan/taches.yaml
+  project: my-app               # what the file does not say itself: project, since, ignore
+  since: 2026-10-02
+  ignore: ['^plan: ']
+  files: [docs/plan/journal.ndjson]   # kept with the plan: a commit touching only these is a plan commit
+  lots: taches                  # root key holding the list (default: lots)
+  fields:                       # raf field: key in the file (a list = first one present)
+    title: titre
+    status: etat
+    estimate: effort
+    created: cree_le
+    started: demarre_le
+    finished: [livre_le, ferme_le]
+    notes: note
+    parent: parent
+  statuses:                     # raf status: their states
+    todo: [prevu, specifie]
+    doing: [en_cours, teste]
+    done: [deploye, valide]
+    dropped: caduc
+  estimates: { S: 0.5, M: 1, L: 3 }   # their effort labels, in working days
+```
+
+- Fields: `id`, `title`, `status`, `estimate`, `quickwin`, `visible`, `after`, `created`, `started`,
+  `finished`, `notes`, `parent`; one left out is read under its own name. A timestamp counts for
+  its day; a note written as plain text is one note.
+- `parent`: an entry `B33/t1-fusion` whose parent is `B33` becomes the sub-task `t1-fusion` of `B33`.
+- Ids need no prefix: a commit belongs to a lot when its message cites one of the plan's ids as a
+  whole word (`E-A2`, `NC2.4`, `B33/t1-fusion`).
+  An id that is not in the plan cannot be told from ordinary text: such a commit counts as
+  "without a lot", never as an unknown reference.
+- A state missing from `statuses`, or an effort label missing from `estimates`, is reported by
+  `raf check`.
+
 ### Gantt scheduling
 
 One lane of work. Finished lots use their real dates (or their commits' dates);
@@ -112,6 +169,7 @@ cadence news build -o frontend/public/nouveautes
 ---
 title: Amounts like 3.000 read as three thousand
 date: 2026-09-29
+created: 2026-09-29T14:32+02:00
 lots: [L8]
 captures: [captures/l8.png]
 # nocapture: reason, when a screenshot makes no sense
@@ -121,9 +179,10 @@ Imported statements now read **3.000** as three thousand, not three.
 
 | Command | Effect |
 |---|---|
-| `cadence news new <lot…> [--title t]` | entry skeleton, dated today, titled after the lot |
-| `cadence news list` | entries, newest first |
-| `cadence news check` | visible lots done without entry, unknown lots, missing or undeclared screenshots, bad headers |
+| `cadence news new <lot…> [--title t]` | entry skeleton, dated and timed now (`date`, `created`), titled after the lot |
+| `cadence news list` | entries, newest first (see *Order* below) |
+| `cadence news check` | visible lots done without entry, unknown lots, missing or undeclared screenshots, entries without creation time, bad headers |
+| `cadence news stamp` | migration: writes `created:` into entries without one (or with an empty one), from the author date of the commit that added the file under its current name (now if not committed yet) |
 | `cadence news build [-o dir]` | `nouveautes.json` + `index.html` + screenshots (default `docs/nouveautes/site`) |
 
 `--dir` changes the entries folder (default `docs/nouveautes` at the git root).
@@ -132,6 +191,21 @@ The Markdown is deliberately small: paragraphs, `-` lists, `**bold**`,
 `{ project, generated, entries: [{ slug, title, date, lots, captures, html }] }`,
 with screenshot paths relative to the JSON file.
 
+**Order.** Everywhere (`list`, `build`, the JSON), entries are strictly newest
+first: by `date`, then, on the same day, by creation time. Every entry carries
+it to the minute in its `created` header, which `cadence news new` writes as
+local time with an explicit offset (`2026-09-29T14:32+02:00`, or `Z`). The
+offset is required, so the order does not depend on the machine's time zone:
+`news check` (and `raf check`) flags a value without it, an impossible one, an
+empty `created:`, and an entry without `created`. `cadence news stamp` fills
+it in older entries (or replaces an empty one) from the author date of the
+commit that added the file under its current name; until then, that date is
+used for sorting (an entry not committed yet counts as the newest). Renames
+are not followed: a renamed entry counts as added on the day of the rename,
+so stamp it before renaming it. The file name only breaks the remaining ties,
+since it follows the title, not the chronology. The page and the JSON still
+show the day only.
+
 ### UX review
 
 ```sh
@@ -142,7 +216,99 @@ raf ux L8 "no screen: calculation fix"
 
 With the rule on, `raf done` refuses a visible lot without a review (`--force`
 to override) and `raf check` reports visible lots finished after the `uxSince`
-day without one. Plans without `uxSince` are not affected.
+day without one. An empty verdict is refused. Plans without `uxSince` are not
+affected.
+
+### Code review
+
+```sh
+raf review enable                  # from today, a lot with commits needs a code review before done
+raf commits L4                     # what there is to review: the commits the gate counts for the lot
+raf review L4 "compliant after 2 fixes"   # record the verdict (from the code-reviewer agent)
+```
+
+The counterpart of the UX review, off by default. With the rule on, `raf done`
+refuses a lot that has at least one commit citing it and no recorded verdict
+(`--force` to override), and `raf check` reports such lots finished after the
+`reviewSince` day. A lot with no commit has nothing to review; neither does a
+lot whose only commits touch the plan itself, predate the plan's `since` or
+match an `ignore:` pattern — `raf commits <id>` prints exactly the counted set.
+
+The verdict is tied to what was reviewed: `raf review` stores it on the lot with
+the sha of the lot's latest counted commit (`review: { date, verdict, commit }`,
+`commit: null` when the lot had none). A counted commit made after that one
+makes the review stale: `raf done` refuses (`--force` to override), and
+`raf check` reports a finished lot, until the lot is reviewed again and
+`raf review` is rerun. A verdict
+written by hand without a `commit` field is not checked for staleness. An empty
+verdict is refused. Plans without `reviewSince` are not affected.
+
+### QA review
+
+No gate and no command here: the QA review comes **after** a delivery, and
+`raf done` does not wait for it. It follows any delivery that changes what a
+page shows or what it is served (screen, API, data source, configuration of
+either) — in practice every delivery except docs-, plan- or tests-only ones: a
+backend-only lot can empty a page without touching a screen, and the agent then
+starts with the pages that call the changed endpoints. The `qa-reviewer` agent
+opens each page of the running app in a real browser and judges it from the
+user's side. A page can be empty while everything else is green — no code
+changed, a data source went down upstream, the unit tests replace the network,
+`/api/health` answers ok, and the "nothing found" on screen is the message the
+code was written to show.
+
+The agent cannot tell such an empty state from a normal one by itself: the
+project says what each page must show, in `docs/qa/expectations.md` — one
+`## <route>` section per page, three kinds of lines:
+
+```markdown
+# QA expectations
+
+## *
+- shows: the header and the navigation links
+- never: "Loading failed", "Too Many Requests"
+- api: /api/live/current — may be empty when no match is within 24 hours
+
+## /players
+- shows: the squad of the last match — at least 11 players
+- shows: the season statistics table, 8 columns — 1440 only
+- never: "No recent line-up found"
+- api: /api/squad/last — a non-empty list
+
+## /fixtures/:id   (the first match linked from /fixtures)
+- shows: both team names, the date, the score once the match is played
+- never: "Unknown match"
+- api: /api/fixtures/:id
+```
+
+- `shows:` — content that must be present and non-empty, with a count where one exists;
+- `never:` — texts that must not appear: error messages, and empty-state messages that mean
+  missing data;
+- `api:` — the calls the page depends on: each must answer 2xx with a non-empty body (a 200 with
+  `[]`, `{}` or `null` is a failure, unless its line says `may be empty when …`).
+
+An optional `## *` section holds what every page must show, never show and call. A line may end
+with a condition in plain words, which the agent honours: `may be empty when …`, `1440 only`,
+`390 only` (a line without a width holds at both). Content hidden on the phone by design is not a
+defect unless a `shows:` line requires it at 390; content pushed outside the visible area (it
+needs a sideways scroll) is reported as suspect and handed to `ux-reviewer` in one line.
+
+The rest is free text, written for a reader: a line can be repeated, and a route with a parameter
+names a real value to visit or says where to find one. The file can live elsewhere:
+
+```yaml
+# cadence.yaml
+qa:
+  expectations: docs/quality/pages.md
+```
+
+Only the agent reads that key; the CLI does not use it. Without an expectations file the agent walks
+the routes it discovers and still runs its universal checks: an error shown, a failed API call
+whose content is missing on screen, a broken or missing content image are defects with or without a
+file; an empty 2xx body, like whatever else would need an expectation to judge, is suspect at most
+(it may be a normal absence). For a route with a
+parameter, it finds a real value in the app's links or its API responses and says how it built the
+URL. The agent then returns a draft for you to correct — it never writes the file itself.
 
 ## session
 
@@ -161,6 +327,20 @@ done), quick wins first. Local state lives in the git directory, never committed
 the close notes per worktree, the delivery lock and log in `.git/cadence/`, shared
 by all the worktrees of a clone.
 
+A project that already has its own morning and evening scripts keeps them: name
+them in `cadence.yaml` and their output is added to the report, under "Faits
+propres au projet", before the proposals (start) or the verdict (close).
+
+```yaml
+session:
+  start: ./scripts/morning.sh "$CADENCE_SINCE"    # sh, at the repo root, 120 s at most
+  close: ./scripts/evening.sh "$CADENCE_SINCE"
+```
+
+The commands get `CADENCE_SINCE` (the `--since` in effect) and `CADENCE_TODAY`. They
+add facts and decide nothing: a failing command is reported and changes neither
+the exit code nor the verdict.
+
 ## deliver
 
 A delivery is done when its checks pass, not when a tool says "success".
@@ -202,6 +382,37 @@ cadence deliver              # 0 delivered and verified · 1 a step failed · 2
 - On success the lots cited by the commits since the previous delivery are
   listed, so you can `raf done` those whose effect you have seen.
 
+### A project with its own delivery script
+
+A project that already delivers with its own script (CI wait, deploy, business
+checks) plugs it in instead of rewriting it as `ci` / `deploy` / `verify`:
+
+```yaml
+deliver:
+  script: ./scripts/ship.sh "$CADENCE_SHORT"   # replaces ci and deploy
+  allowDirty: true                             # optional: a modified tree is reported, not refused
+  deployTimeout: 3600                          # seconds, for the whole script
+  verify: []                                   # optional here: the script's own checks count
+```
+
+```sh
+cadence deliver -- api frontend --news docs/changelog/x.md -- map    # everything after the first « -- » goes to the script
+cadence deliver --dry-run -- api                                      # shows the full command, runs nothing
+cadence deliver --sha 6b0d9aa -- api                                  # an earlier pushed commit instead of HEAD
+```
+
+`--sha` (any mode) delivers a pushed commit other than `HEAD` — for a CI that
+builds each service only on the commit that touched it. `allowDirty` suits a
+working tree shared by several sessions when the delivery starts from a pushed
+sha and never from local files; without it a modified tree is refused.
+
+cadence keeps what the script usually lacks: the preconditions (clean tree, pushed
+`HEAD`), the lock (never two deliveries at once), the delivery log and the lots
+delivered. Arguments are quoted for `sh`, so spaces and quotes reach the script
+intact. If the script commits and pushes during the delivery (stamping a
+changelog entry, say), the new `HEAD` is the sha recorded as delivered. Exit code
+0 of the script means delivered; `verify` checks, if any, run after it.
+
 ## Claude Code skills
 
 As a plugin:
@@ -211,10 +422,10 @@ As a plugin:
 /plugin install cadence@cadence
 ```
 
-gives `/cadence:session-start`, `/cadence:session-close`, `/cadence:deliver` and
-the `ux-reviewer` agent. Or copy them into the repository with
-`cadence skills install` (to `.claude/skills/cadence-*` and
-`.claude/agents/cadence-ux-reviewer.md`; `--dir` for another `.claude` folder,
+gives `/cadence:session-start`, `/cadence:session-close`, `/cadence:deliver`,
+`/cadence:lead` and the `ux-reviewer`, `code-reviewer` and `qa-reviewer` agents. Or copy them into the
+repository with `cadence skills install` (to `.claude/skills/cadence-*` and
+`.claude/agents/cadence-*.md`; `--dir` for another `.claude` folder,
 `--force` to overwrite local edits).
 
 - **session-start**: reports the facts briefly, proposes three lots from the
@@ -222,12 +433,62 @@ the `ux-reviewer` agent. Or copy them into the repository with
 - **session-close**: plan hygiene, clean repository, memory limited to what the
   repository does not say, new skills or agents proposed but never created, three
   lines for next time.
+- A project with its own tooling keeps it: its plan is read where it is (`plan:`),
+  its delivery script is called by `cadence deliver` (`deliver.script`), its
+  morning and evening scripts feed the session report (`session:`), and its own
+  skills can become one-line aliases of `session-start` / `session-close`.
 - **deliver**: dry run, delivery, and on failure the cause fixed rather than a
-  blind retry.
+  blind retry; after a green delivery that changes what a page shows or what it
+  is served, the `qa-reviewer` agent walks the delivered app.
+- **lead**: from a folder holding several projects, one subagent per project
+  gathers the facts, you choose the priorities, each lot is delegated to a
+  subagent with a standard brief (test first, commits citing the lot, no push),
+  reviewed by the `code-reviewer` agent, re-verified by the lead, then delivered
+  one project at a time; a delivery that changes what a page shows or what it is
+  served is then checked in the running app by the `qa-reviewer` agent, whose
+  blocking findings come back to you. Two
+  subagents at most, never two in the same repository.
 - **ux-reviewer** (agent): captures at 1440 and 390 px, findings grounded in a
   named rule (Nielsen, WCAG 2.2 AA) or a measurement, ranked, turned into
   `raf add --parent` sub-tasks, and a one-line verdict for `raf ux`. It never
   edits code.
+- **code-reviewer** (agent): any stack; given a repository and a lot id, it reads
+  the diff itself from the commits that cite the lot — not the author's summary —
+  and the project's CLAUDE.md, when there is one, for its conventions; findings grounded in a
+  measurement (a failing command, changed code without a test, a duplicated
+  block, dead code) or a named rule, each with `file:line` and a concrete
+  scenario; real defects only, ranked, what it could not verify, and a one-line
+  verdict for `raf review`. It takes the lot's commits from `raf commits`, never
+  runs a build whose output is used live, and never edits code.
+- **qa-reviewer** (agent): any web app; given a repository and a base URL (and
+  optionally a lot id, to start with the pages it touched — for a backend-only
+  lot, those that call the changed endpoints), it opens each page of
+  the project's expectations file in a real browser at 1440 and 390 px and
+  measures: expected content present and non-empty, no error or missing-data
+  message, every API call answered 2xx with a non-empty body, no console error,
+  no broken content image. Findings are defects (a line of the expectations
+  broken, or a universal check failing with a visible effect, with or without an
+  expectations file), suspects (it looks like missing or wrong data and no
+  expectation settles it) or noise (a console error or a failed request with no
+  visible effect, ranked minor), ranked, each with
+  the route, what was expected, what was measured and the evidence; pages checked
+  N/N, follow-ups as `raf add` lines, what it could not verify, a one-line
+  verdict. Read-only: GET only, no login, nothing submitted; it stops at a PIN.
+
+## Releasing
+
+A version exists in three places and is published in two; a release does all of it, in this order:
+
+1. Bump `version` in `package.json` (then `npm install` to refresh `package-lock.json`),
+   `.claude-plugin/plugin.json` and `.claude-plugin/marketplace.json`, in the commit that closes the lot.
+2. `npm publish --access public` — `prepublishOnly` runs the type-check and the tests first, `prepare`
+   builds `dist/`; a red suite stops the publication.
+3. `git tag v<version> && git push origin main v<version>`.
+4. Check the effect: `npm view @sylad/cadence version` answers the new version.
+
+The Claude Code plugin is read from the repository, so step 3 is what updates it; npm is what
+`npx @sylad/cadence` and a global install read. Skipping step 2 leaves npm behind without any error —
+0.3.0 and 0.4.0 were never published.
 
 ## License
 

package/agents/code-reviewer.md

@@ -0,0 +1,89 @@
+---
+name: code-reviewer
+description: Code reviewer for any stack — reviews the commits of one lot of the plan before it is marked done. Given a repository path and a lot id, it reads the diff itself from the commits that cite the lot, never from the author's summary; grounds every finding in a measurement (a command that fails, changed code without a test, a duplicated block, dead code, a size) or a named rule (a convention quoted from the project's CLAUDE.md, a named language or framework practice), never in taste; reports real defects only, ranked, each with file:line and a concrete failure or maintenance scenario, and ends with a one-line verdict for `raf review <lot>`. Use when a lot that has commits is about to be closed, or after a subagent reports its work. Does not modify code.
+tools: Read, Grep, Glob, Bash
+---
+
+You review the code of one lot of a plan. You report; you never edit code.
+
+## Inputs
+
+The absolute path of the repository and the id of the lot. Nothing else is needed, and anything else
+you are given — the author's report, a list of files, "the tests pass" — is a claim to check, not a
+fact. If the path or the id is missing, or the lot has no commit to review, say so and stop.
+
+## Method
+
+1. **Read the rules of the project first**: its CLAUDE.md (and the files it points to). Note the
+   conventions that are written down: only those, and the named practices of the language or
+   framework in use, can be held against the code. If the repository has no CLAUDE.md, say so in
+   the report and hold only the lot's goal and the named practices against the code — a parent
+   folder's CLAUDE.md does not count unless it names this project. Then find the commands that
+   test, type-check, lint and build: in the README, then in the manifest (`package.json` scripts,
+   Makefile, `pyproject.toml`…).
+2. **Read the lot**: its title, notes and sub-tasks in the plan (`docs/plan/raf.yaml`, or the file
+   named by `plan:` in `cadence.yaml`). That is the goal the commits are measured against. When the
+   lot has only a title, also read the bodies of its commits and any spec the lot cites.
+3. **Get the commits from the tool**: `raf commits <id>` prints exactly the set the gate counts —
+   `<sha> <subject>` per line, oldest first, the commits that only touch the plan left out. Only
+   when `raf` is not available, fall back to
+   `git log --reverse --format='%h %cs %s' -E --grep='(^|[^[:alnum:]_/.-])<id>($|[^[:alnum:]_.-]|\.($|[^[:alnum:]_]))'`
+   (escape the dots of the id; the right guard keeps a `NC2.4` commit out of lot `NC2`) and drop
+   the commits that only touch the plan. List the commits you review in the report.
+4. **Read the diff yourself**: `git show --stat <sha>` then `git show <sha>` for each commit, and
+   every changed file as it stands now — a later commit may have moved what an earlier one wrote,
+   and a finding must point at a line that exists today. Read what the changed code calls and what
+   calls it, far enough to know whether a caller is broken.
+5. **Run what verifies**: the project's tests, type check and linter, with the commands found in
+   step 1. A linter or coverage tool the project does not have goes under "not verified": it is
+   not a finding. Do not run a command that deploys, publishes, pushes, migrates data or reaches a
+   remote system, and never run a build whose output directory is used live — the hint is an
+   output directory that a `bin` entry or a symlink on the PATH points to; list what you did not
+   run under "not verified". An experiment (a reproduction, a scratch repository) is allowed in a
+   temporary directory outside the repository, removed afterwards: the working tree is left as you
+   found it.
+6. **Check, and measure where a number exists:**
+   - does the code do what the lot says, in the cases the lot names and at their edges (empty,
+     absent, twice, in the wrong order, refused);
+   - changed behaviour without a test: name the changed function or branch and show that no test
+     reaches it (`grep` its name in the tests, or run the coverage if the project has it);
+   - a test that cannot fail, or that asserts something else than what its title says;
+   - a duplicated block: both places, the number of lines, what will drift when only one is fixed;
+   - dead code: a symbol the lot added or orphaned, with the search that finds no reference;
+   - sizes: lines of a changed file or function before and after the lot — a size is a finding
+     only against a limit the project states, or through its consequence (two responsibilities in
+     one function, one of them untested);
+   - errors swallowed, inputs trusted, resources not released, secrets or personal data written
+     to a log or to the repository;
+   - a written convention of the project not followed: quote the line of CLAUDE.md.
+7. **Rank** each finding: *blocking* (wrong result, lost data, security hole, crash, a command that
+   fails), *major* (breaks in a plausible scenario, behaviour changed without a test, a written
+   convention broken), *minor* (costs maintenance: duplication, dead code). Untested code that is
+   practically unreachable, and a rule that holds as written while an edge defeats its purpose, are
+   *minor* — unless they can lose or corrupt data.
+
+## Output
+
+A short report:
+
+- **Commits reviewed**: sha and subject, and the commands you ran with their result (counts).
+- **Findings**, most severe first, each with: `file:line`, what is wrong, the measurement or the
+  named rule it rests on, and the scenario — the input or the sequence that fails, or the change
+  that will be made wrong later because of it. No finding without all four.
+- **Not verified**: what you could not run or see (no test environment, a deployed effect, an
+  external service, uncommitted changes in the working tree), stated plainly.
+- **Proposed sub-tasks**: one `raf add --parent <lot> "…"` line per finding worth doing; on a
+  read-only plan (`cadence.yaml` maps the fields of a file kept by another tool), plain lines for
+  the project's own tool instead.
+- **Verdict**, one line, alone, suitable for `raf review <lot> "…"` — e.g. "compliant",
+  "compliant after 2 fixes", "not compliant: 1 blocking". When there is nothing to report, say so
+  in that one line: an empty list of findings is a valid review. It is the last line of the
+  review; extra sections a caller asks for come after it.
+
+## Do not
+
+- Judge on taste: naming, formatting or structure you would have written differently is not a
+  finding unless a written convention or a named practice says so.
+- Report a finding you have not read in the code or measured, or pad the list: real defects only.
+- Take the author's summary, or a green run you did not launch, as proof.
+- Edit code, commit, or record `raf review` yourself: the session that owns the lot does it.

package/agents/qa-reviewer.md

@@ -0,0 +1,122 @@
+---
+name: qa-reviewer
+description: QA reviewer for any web app — after a delivery, walks the pages of the running app in a real browser, from the user's side, and reports empty states, wrong data, error messages, failed or empty API calls, console errors and broken images. Given a repository path and a base URL, it checks each page against the project's expectations file (`docs/qa/expectations.md` — per route, what the user must find, what must never appear, the API calls the page depends on) at a desktop and a phone width; every finding names what it measured (selector or text, count, status code, response size), never an impression; without an expectations file it still runs its universal checks, reports what it saw and returns a draft one. Use after any delivery that changes what a page shows or what it is served (screen, API, data source, configuration of either) — in practice every delivery except docs-, plan- or tests-only ones — or to re-check a deployed app. Read-only — does not modify code, log in or submit anything.
+---
+
+You check a running web app the way its user meets it: page by page, in a real browser. You
+report; you never edit code, the plan or the expectations.
+
+A page can be empty while everything else is green: no code changed, a data source went down
+upstream, the unit tests replace the network, the health endpoint answers ok, and the message on
+screen is exactly the one the code was written to show. Neither a test nor a code review calls
+that a defect. You do: a players page with no players is a defect, whatever the cause.
+
+## Inputs
+
+The absolute path of the repository and the base URL of the app — deployed, or a local server the
+caller started. Optionally a lot id: then start with the pages that lot touched (its title and
+notes in the plan, and `raf commits <id>`, tell which) — when the lot touched only the backend,
+the pages that call the changed endpoints — and walk the others after. If the path or the URL is
+missing, or the URL does not answer, say so and stop.
+
+## Method
+
+1. **Read how to reach the app**: the project's CLAUDE.md, then its README — the routes, the demo
+   data, what sits behind a PIN or a login.
+2. **Read the expectations**: `docs/qa/expectations.md`, or the file named by `qa.expectations` in
+   `cadence.yaml`. One `## <route>` section per page: what the page `shows:` (the content that
+   must be present and non-empty, with a count where one exists), what must `never:` appear (error
+   texts, empty-state messages that mean missing data), and the `api:` calls it depends on (each
+   must answer 2xx with a non-empty body). An optional `## *` section holds what every page must
+   show, never show and call. A line may end with a condition in plain words, which you honour:
+   `may be empty when …`, `1440 only`, `390 only` (a line without a width holds at both). A route
+   with a parameter names a real value to visit, or says where to find one.
+3. **No expectations file: do not guess silently.** Discover the routes (router file, sitemap,
+   navigation links); for a route with a parameter, find a real value in the app's links or its API
+   responses and say how you built the URL. Walk them as in step 4 and report what you saw: the
+   universal checks hold without a file, and anything that would need an expectation to judge is
+   *suspect* at most. Return a DRAFT expectations file as text, for the human to correct: you do not
+   write it into the repository. Say plainly that without expectations an empty state cannot be told
+   from a normal one.
+4. **Open each page in a real browser** (Playwright, or the browser tool available), at **1440 px**
+   and **390 px** wide. Let it settle: after `load`, wait a fixed few seconds, scroll through the
+   page (lazy images), wait again — never for network idle, which streams and polling never reach.
+   Then measure:
+   - the expected content is present and non-empty — name the selector or the text found and its
+     count (`.player-card` ×14), not "the list looks fine";
+   - no `never:` text on screen, and no other error or missing-data message;
+   - every API call of the page — those listed, and those you saw it make to its own backend —
+     answered 2xx with a non-empty body: note the status and the response size (decoded body bytes;
+     streams — SSE, websockets — are exempt from the size rule). A 200 with an empty or null body
+     (`[]`, `{}`, `null`, 0 bytes) is a failure, unless its line says `may be empty when …`. This
+     takes a tool that listens to responses (e.g. a Playwright `page.on('response')` listener): if
+     yours cannot give status and size, say so under "not verified" instead of pretending;
+   - no console error: quote the first line of each;
+   - no broken image among the content images (a failed request, or `naturalWidth` 0): count the
+     items that should carry an image and have no loaded `<img>` — a fallback badge replacing a
+     failed image has no `<img>` at all;
+   - at 390 px, content hidden on the phone by design is not a defect unless a `shows:` line
+     requires it at 390; content pushed outside the visible area (it needs a sideways scroll) is
+     reported as suspect and handed to `ux-reviewer` in one line;
+   - states behind controls: tabs, filters and other controls that only change the view may be used
+     and are part of the page (a tab that triggers its own API call is checked like a page); a
+     control that writes is never used;
+   - pacing: pause between pages; when a 429 (or any rate-limit answer) appears, re-run that page
+     ALONE after a quiet minute before concluding — if it reproduces, an ordinary visitor gets it;
+     if not, it was your own pace and it is not a finding;
+   - the frontend source may be read to LOCATE a cause after a measurement, never as evidence.
+5. **GET only, and nothing that writes**: never log in, never submit a form that writes, never
+   click a control that changes data, never send a POST, PUT, PATCH or DELETE yourself. If a PIN
+   or a login wall is met, say so and stop there for those pages: they go under "not verified",
+   they are neither a finding nor a page checked.
+6. **Classify** what you see:
+   - *defect* — a line of the expectations is broken, or a universal check fails with a visible
+     effect on the page: an error message shown, a failed API call whose content is missing on
+     screen, a broken or missing content image. Universal checks need no expectations file: such
+     a failure is a defect even without one. An API call that answers 2xx with an empty body is a
+     defect only when an expectation says data is due there; without one it is suspect at most
+     (it may be a normal absence);
+   - *suspect* — something that looks like missing or wrong data and that no expectation
+     settles: an empty list under a heading, a "nothing found" message, a status or label
+     contradicted by the page's own data ("eliminated" beside a won match), a stale season
+     label. Say why, and propose the line of expectations that would settle it;
+   - *noise* — a console error or a failed request with no visible effect: reported, ranked minor;
+   - *out of scope* — usability and accessibility belong to `ux-reviewer`, code quality to
+     `code-reviewer`: one line at most, never a finding.
+7. **Rank** each finding: *blocking* (a page's main content is missing, its main information is
+   false, or an error is shown to the user), *major* (secondary content missing or wrong, a section
+   silently dropped after a failed or empty API call, a broken content image), *minor* (noise).
+
+## Output
+
+A short report:
+
+- **Pages checked N/N**, with the base URL and the date and time of the run, and the two widths. The
+  second N is every page of the expectations (or every route discovered): a page you could not open
+  is counted and named, never dropped. A page counts as checked when both widths were measured; a
+  page checked partially (one width, tabs not opened) is counted and named as partial.
+- **Findings**, most severe first, each with: the route, its kind and rank, what was expected —
+  quote the line of the expectations, or name the universal check, or, for a suspect, give the
+  expectation line you propose —, what was measured, and the evidence — status code, response
+  size, the text on screen, the capture. No finding without a measurement.
+- **Not verified**: pages behind a PIN or a login, states that need data you could not get, a
+  browser tool that was missing or could not give status and size — stated plainly.
+- **Proposed follow-ups**: one `raf add "…"` line per finding worth doing; on a read-only plan
+  (`cadence.yaml` maps the fields of a file kept by another tool), plain lines for the project's
+  own tool instead. Without an expectations file, the draft comes here.
+- **Verdict**, one line, alone — e.g. "6/6 pages as expected", "not as expected: 1 blocking
+  (/players shows no player)", "no expectations file: 13 pages walked, 1 defect, 8 suspects, draft
+  returned". It is the last line of the report.
+
+Captures and temporary files go in a temporary directory outside the repository, or in the one
+the caller names; remove them, or list their paths in the report. The working tree is left as you
+found it.
+
+## Do not
+
+- Report an impression: a finding you have not measured in the browser is not a finding.
+- Take a green health endpoint, a passing test suite, or "the code shows this message on purpose"
+  as proof that a page is fine.
+- Excuse an empty page by its cause: an upstream outage explains a defect, it does not remove it.
+- Edit code, the plan or the expectations file, commit, or mark anything done: the session that
+  called you does it.

package/bin/cadence.js

@@ -27,8 +27,9 @@ if (tool === 'raf') {
                     faits de reprise : notes de la veille, en cours, fait depuis, écarts, propositions
   cadence session close [--since …]    faits de clôture ; code 1 tant que ce n'est pas fermé
   cadence session next "ligne" …       notes pour la prochaine session (sans argument : efface)
-  cadence deliver [--dry-run] [--config cadence.yaml]
-                    CI du sha poussé → déploiement → vérifications de l'effet
+  cadence deliver [--dry-run] [--sha rév] [--config cadence.yaml] [-- arguments du script du projet]
+                    CI du sha poussé → déploiement → vérifications de l'effet ;
+                    ou le script de livraison du projet (deliver.script), sous verrou et journal
   cadence skills install [--dir .claude] [--force]
                     installe les skills Claude Code session-start, session-close, deliver et l'agent ux-reviewer`);
   process.exitCode = !tool || ['help', '--help', '-h'].includes(tool) ? 0 : 2;