@sylad/cadence 0.27.0 → 0.28.0

package/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "cadence",
       "description": "Session start and close rituals driven by a versioned plan (raf), and deliveries proven by their effect. Needs the cadence CLI (npm i -g @sylad/cadence).",
-      "version": "0.27.0",
+      "version": "0.28.0",
       "source": "./",
       "author": {
         "name": "Sylvain Ladoire"
@@ -17,7 +17,7 @@
     {
       "name": "cadence-hud",
       "description": "A status band above the Claude Code prompt: context, 5 h / 7 d quota windows, cost per model, agents of the session and the running cadence orchestrate waves. Works without the cadence CLI, except the per-project plan progress, which needs `cadence` on the PATH.",
-      "version": "0.4.2",
+      "version": "0.4.3",
       "source": "./plugins/cadence-hud",
       "author": {
         "name": "Sylvain Ladoire"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cadence",
   "description": "A repo-native working method: session start and close rituals driven by a versioned plan (raf), deliveries proven by their effect, and three reviewer agents (UX, code, QA).",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "author": { "name": "Sylvain Ladoire" },
   "homepage": "https://github.com/Sylad/cadence",
   "repository": "https://github.com/Sylad/cadence",

package/README.md

@@ -24,7 +24,7 @@ Code prompt that shows the session's context, quota, cost and the orchestrate wa
 
 ## What's new
 
-**0.27.0**: a compliant review of `cadence orchestrate` settles the open sub-tasks that commits of the lot cite (`feat(L3/t2): …`, comma lists included), closed in the same plan commit as the verdict or, on a read-only plan, returned as `[sous-tâche clore]` proposals, so `raf done` no longer refuses a lot over sub-tasks whose work is done; on a foreign-format plan the ids are read as the plan reads them (L82); the test suite stays green with two full suites running in parallel (L150). **0.26.0**: `cadence orchestrate` raises the floor of a lot's budget from 200 k to 450 k tokens, enough to pay a write pass, its review, one fix pass and the short review that follows, so a lot of 0.5 or 1 day is no longer handed back at its second or third pass; a `--continue` wave draws fewer lots as a result (L128). **0.25.0**: the project line of the plans' progress in the `cadence-hud` band names the lots in progress after their count, three at most then `…` (L153, `cadence-hud` 0.4.2); the progress follows the folder the session was launched from, so a `cd` into a sub-project no longer shrinks the band, and the session context keeps the `session.start` folder (L154). **0.24.0**: `cadence orchestrate --drop <project:lot>` and `--stop-after-current` steer a live wave from another terminal, `--resume --drop` removes a lot before replaying a stopped wave (L79); the final table of a wave says « livrable jusqu'à <sha> » for a ready lot stacked under a lot handed back, with `git push origin <sha>:main && cadence deliver --sha <sha>` (L76); a version commit (version fields, `CHANGELOG.md`, the README's « What's new ») no longer asks for a new code review (L72). **0.23.0**: the progress bar of each project in the `cadence-hud` band is coloured by the share of lots done, red below 33 %, orange below 66 %, green beyond (L152, `cadence-hud` 0.4.1); `cadence deliver` under a wave lock refuses only when a lot of the wave still works in that very repository, a linked worktree included (L127). **0.22.0**: `cadence orchestrate --continue` draws the next ready lot of the plan itself, in the declared priority, until the budget, the time window or a question stops it (L147); `cadence session context` prints the context of the session, which the `cadence-hud` band publishes, and the `lead` skill chains lots without the human while it stays under 60 % (L148); the band shows the progress of each project's plan, and `cadence lead tour --json` gains `progress` (L149, `cadence-hud` 0.4.0); the final review of a lot is always played, the lot's own budget bounding the writing passes only, with 65 k tokens reserved for it (L145); the cause « tests rouges après … » names the pass whose tests were red (L151). **0.21.0**: `cadence orchestrate --status` and `cadence lead tour` print the free session slots, which the `lead` skill reads (L141); `orchestrate.effort` sets the effort level of each pass of a wave (L137); `docs.sync` makes `raf check`, `lead tour` and the review brief report a document that does not follow the code (L143); `docs.articles` opens, after a green `cadence deliver`, a lot `Article <project> à rafraîchir` in the neighbouring repository (L144). **0.20.0**: `cadence-hud` no longer misleads once the work is over: `/hud cmd` lists the background commands it counts (id, tool, origin, age, name), any other argument answers `argument inconnu` instead of hiding the band, commands with no end seen for an hour or no record go to a grey `N cmd sans fin vue`, a finished subagent takes its commands with it, two races that left a `1 cmd` counted forever are closed, and a finished wave shows grey without its budget then disappears after 30 minutes (L142); the `qa-reviewer` and `ux-reviewer` agents are read-only for real, their frontmatter listing Read, Grep, Glob, Bash and the Playwright tools (L140). **0.19.1**: `cadence-hud`'s `N cmd` counter goes back down when a Monitor expires, when the background commands a subagent started end with it, and at session start or plugin reload (L135); its `tool.call` and `prompt.submit` guard hooks carry a `.catch` on registration, which clears the `claude plugin validate` warning (L136). **0.19.0**: `cadence orchestrate` lifts a repository's lock and `pre-push` guard as soon as every lot of the wave that touches it is finished, so `cadence deliver` works there while the wave continues elsewhere (L132); a review that leaves a repository dirty hands back that lot only, suspends the lots still queued in that repository and keeps the other repositories running, its verdict reported instead of lost (L133); `cadence session close` re-run without a `session start` keeps the window since the last opening (L131); `cadence-hud` draws the lot rows of a wave in aligned columns on every surface (L134). **0.18.0**: `cadence session next` prints what it records (issue #6); `cadence session close` covers the period since the last `session start` (or the last close) and says so in its title, `--since` still wins (issue #7). **0.17.0**: `cadence-hud` shows an `N cmd` segment next to the agents, the background commands of the session (Bash run in the background and Monitor, subagents' included), tracked from the tool results and ended by the task's notification or `TaskStop`. **0.16.0**: a lot can declare **neighbouring repositories** (`repos:` key of the lot, `{ path, cite }` for a repository shared between projects): `cadence orchestrate` refuses, locks and guards them, gives them to every session as `--add-dir`, and `raf commits`, `raf show` and the review verdict read the commits that cite the lot there too. **0.15.0**: `hook.autostart` in `cadence.yaml` (`warn` by default, `refuse` or `start`): a pre-commit hook that refuses, or starts in the same commit, a lot still todo that the commit cites; `cadence session start|close --all [--depth n]`, one section per project under a folder. **0.14.0**: `cadence lead tour`, the lead's morning table of every project in a folder, printed by a program (one line per project: lots in progress, gaps, last notes, next ready lot, repository) in place of one subagent per project; the `lead` skill calls it. **0.13.1**: `cadence-hud` takes back the segments that fit once a big one has dropped (reset times, then the per-model consumption, now short: `opus 1.2M sonnet 800k`); `CADENCE_HUD_AMBIGUOUS=1` for a terminal that draws `▰ ▱ ⚙ │ ↻` in one cell. **0.13.0**: `cadence orchestrate --status --watch` (a wave's table redrawn in the terminal, which
+**0.28.0**: `orchestrate.precheck: local` runs the « deliverable already present? » pre-check of `cadence orchestrate` on the local model (`claude-local`, Ollama), off the Anthropic quota, Sonnet staying the default and the fallback (L146); the `qa-reviewer` agent walks only the pages a lot touched, with a **Scope** line in its report (L123); the sub-tasks a review closes are also read in a lot's neighbouring repositories (L156) and a commit's sub-task list is read with the plan's left guard (L155); an unstable test is fixed (L90). **0.27.1**: `cadence orchestrate` no longer leaves a session's child processes alive: a dev server started in its own process group, or orphaned by a shell that exits (`nohup srv &`), is killed with the session through its process tree and its `CADENCE_SESSION` mark, a tmux server, `screen`, `gpg-agent` or `dirmngr` started on demand being spared; a session that exits with code 0 while a descendant holds its output open is no longer reported as « délai dépassé » (L83); the `ux-reviewer` and `qa-reviewer` agents carry the briefs' Playwright rule outside `cadence orchestrate` (L84). **0.27.0**: a compliant review of `cadence orchestrate` settles the open sub-tasks that commits of the lot cite (`feat(L3/t2): …`, comma lists included), closed in the same plan commit as the verdict or, on a read-only plan, returned as `[sous-tâche clore]` proposals, so `raf done` no longer refuses a lot over sub-tasks whose work is done; on a foreign-format plan the ids are read as the plan reads them (L82); the test suite stays green with two full suites running in parallel (L150). **0.26.0**: `cadence orchestrate` raises the floor of a lot's budget from 200 k to 450 k tokens, enough to pay a write pass, its review, one fix pass and the short review that follows, so a lot of 0.5 or 1 day is no longer handed back at its second or third pass; a `--continue` wave draws fewer lots as a result (L128). **0.25.0**: the project line of the plans' progress in the `cadence-hud` band names the lots in progress after their count, three at most then `…` (L153, `cadence-hud` 0.4.2); the progress follows the folder the session was launched from, so a `cd` into a sub-project no longer shrinks the band, and the session context keeps the `session.start` folder (L154). **0.24.0**: `cadence orchestrate --drop <project:lot>` and `--stop-after-current` steer a live wave from another terminal, `--resume --drop` removes a lot before replaying a stopped wave (L79); the final table of a wave says « livrable jusqu'à <sha> » for a ready lot stacked under a lot handed back, with `git push origin <sha>:main && cadence deliver --sha <sha>` (L76); a version commit (version fields, `CHANGELOG.md`, the README's « What's new ») no longer asks for a new code review (L72). **0.23.0**: the progress bar of each project in the `cadence-hud` band is coloured by the share of lots done, red below 33 %, orange below 66 %, green beyond (L152, `cadence-hud` 0.4.1); `cadence deliver` under a wave lock refuses only when a lot of the wave still works in that very repository, a linked worktree included (L127). **0.22.0**: `cadence orchestrate --continue` draws the next ready lot of the plan itself, in the declared priority, until the budget, the time window or a question stops it (L147); `cadence session context` prints the context of the session, which the `cadence-hud` band publishes, and the `lead` skill chains lots without the human while it stays under 60 % (L148); the band shows the progress of each project's plan, and `cadence lead tour --json` gains `progress` (L149, `cadence-hud` 0.4.0); the final review of a lot is always played, the lot's own budget bounding the writing passes only, with 65 k tokens reserved for it (L145); the cause « tests rouges après … » names the pass whose tests were red (L151). **0.21.0**: `cadence orchestrate --status` and `cadence lead tour` print the free session slots, which the `lead` skill reads (L141); `orchestrate.effort` sets the effort level of each pass of a wave (L137); `docs.sync` makes `raf check`, `lead tour` and the review brief report a document that does not follow the code (L143); `docs.articles` opens, after a green `cadence deliver`, a lot `Article <project> à rafraîchir` in the neighbouring repository (L144). **0.20.0**: `cadence-hud` no longer misleads once the work is over: `/hud cmd` lists the background commands it counts (id, tool, origin, age, name), any other argument answers `argument inconnu` instead of hiding the band, commands with no end seen for an hour or no record go to a grey `N cmd sans fin vue`, a finished subagent takes its commands with it, two races that left a `1 cmd` counted forever are closed, and a finished wave shows grey without its budget then disappears after 30 minutes (L142); the `qa-reviewer` and `ux-reviewer` agents are read-only for real, their frontmatter listing Read, Grep, Glob, Bash and the Playwright tools (L140). **0.19.1**: `cadence-hud`'s `N cmd` counter goes back down when a Monitor expires, when the background commands a subagent started end with it, and at session start or plugin reload (L135); its `tool.call` and `prompt.submit` guard hooks carry a `.catch` on registration, which clears the `claude plugin validate` warning (L136). **0.19.0**: `cadence orchestrate` lifts a repository's lock and `pre-push` guard as soon as every lot of the wave that touches it is finished, so `cadence deliver` works there while the wave continues elsewhere (L132); a review that leaves a repository dirty hands back that lot only, suspends the lots still queued in that repository and keeps the other repositories running, its verdict reported instead of lost (L133); `cadence session close` re-run without a `session start` keeps the window since the last opening (L131); `cadence-hud` draws the lot rows of a wave in aligned columns on every surface (L134). **0.18.0**: `cadence session next` prints what it records (issue #6); `cadence session close` covers the period since the last `session start` (or the last close) and says so in its title, `--since` still wins (issue #7). **0.17.0**: `cadence-hud` shows an `N cmd` segment next to the agents, the background commands of the session (Bash run in the background and Monitor, subagents' included), tracked from the tool results and ended by the task's notification or `TaskStop`. **0.16.0**: a lot can declare **neighbouring repositories** (`repos:` key of the lot, `{ path, cite }` for a repository shared between projects): `cadence orchestrate` refuses, locks and guards them, gives them to every session as `--add-dir`, and `raf commits`, `raf show` and the review verdict read the commits that cite the lot there too. **0.15.0**: `hook.autostart` in `cadence.yaml` (`warn` by default, `refuse` or `start`): a pre-commit hook that refuses, or starts in the same commit, a lot still todo that the commit cites; `cadence session start|close --all [--depth n]`, one section per project under a folder. **0.14.0**: `cadence lead tour`, the lead's morning table of every project in a folder, printed by a program (one line per project: lots in progress, gaps, last notes, next ready lot, repository) in place of one subagent per project; the `lead` skill calls it. **0.13.1**: `cadence-hud` takes back the segments that fit once a big one has dropped (reset times, then the per-model consumption, now short: `opus 1.2M sonnet 800k`); `CADENCE_HUD_AMBIGUOUS=1` for a terminal that draws `▰ ▱ ⚙ │ ↻` in one cell. **0.13.0**: `cadence orchestrate --status --watch` (a wave's table redrawn in the terminal, which
 stops with the wave) and the lead skill that names the wave and follows its journal; lot ids with `/`
 (sub-tasks of a read-only plan) accepted by `orchestrate`; `cadence-hud`'s first line measured in
 terminal cells and kept to ASCII; `publish.yml` on the v5 actions. **0.12.0**: the `cadence-hud` plugin (a status band above the Claude Code prompt),
@@ -406,7 +406,7 @@ No gate and no command here: the QA review comes **after** a delivery, and
 page shows or what it is served (screen, API, data source, configuration of
 either) — in practice every delivery except docs-, plan- or tests-only ones: a
 backend-only lot can empty a page without touching a screen, and the agent then
-starts with the pages that call the changed endpoints. The `qa-reviewer` agent
+walks the pages that call the changed endpoints. It also walks the pages that consume the services the lot changed; when the diff changes no route and no screen, or cannot be linked to pages, it walks every page and says so. The `qa-reviewer` agent
 opens each page of the running app in a real browser and judges it from the
 user's side. A page can be empty while everything else is green — no code
 changed, a data source went down upstream, the unit tests replace the network,
@@ -925,7 +925,8 @@ older `claude` is refused at launch unless every pass is `default`). Defaults: `
 `implement` and `fix` medium, `review` high (`review-small` follows `review`), `ux` high. A project overrides any of them
 in `cadence.yaml`; the levels are `low`, `medium`, `high`, `xhigh`, `max`, and `default` sends no `--effort` (the
 level of the session, as before this key). The format-retry session (`--resume`) keeps the level of its pass, and
-`--dry-run` shows the flag in each command line.
+`--dry-run` shows the flag in each command line, except for a `precheck: local` session: `claude-local` is launched
+without `--effort` (see below), so `effort.precheck` has no effect on it and the `precheck (local)` line does not show it.
 
 ```yaml
 orchestrate:
@@ -944,6 +945,20 @@ with proofs), `partiel` or `non`: on `oui` no implementation session is opened a
 implementation brief and a warning; on `non` — or an unreadable report, which only adds a warning — the wave goes on. A
 lot that already has commits is never pre-checked (resuming it is legitimate). `orchestrate.precheck: false` turns it off.
 
+`orchestrate.precheck: local` (L146) runs the pre-check on the local model of the dev machine instead of Sonnet: the
+orchestrator launches `claude-local` with the same brief, the `precheck-reader` prompt and tools, no quota used and nothing counted in the
+lot's budget (the step shows `local` as its model). `claude-local` is **not shipped with cadence**: it is a personal wrapper (a script on the `PATH`, `qwen3-coder:30b` by default) around
+`claude` pointed at Ollama. `CADENCE_CLAUDE_LOCAL_BIN` names another binary, which must take the prompt as its **first argument**
+and add itself `-p`, `--bare`, `--strict-mcp-config` and `--model` (cadence passes none of them), then accept `--output-format`,
+`--json-schema`, `--tools`, `--session-id`, `--permission-mode`, `--add-dir` and `--disallowedTools`. A bare `claude` does not fit.
+Without such a binary every local check fails and is replayed on Sonnet: keep `true`. Sonnet stays the safety net: a local session with no result (Ollama
+down, timeout, no structured report) or an unreadable report is replayed on Sonnet with a warning, and a local `oui` — the
+only answer that hands the lot back without an implementation — is confirmed by Sonnet before it counts. A local `partiel`
+or `non` is taken as is. The default stays `true` (Sonnet): switch to `local` only after comparing verdicts and durations
+against Sonnet on a few lots, and go back to `true` the first time the local model gets a `partiel` wrong. `--dry-run`
+prints the step as `precheck (local)` with its `claude-local` arguments. Those arguments carry neither `--model` nor `--effort` nor `--agents`: `effort.precheck` applies only to the Sonnet
+session (the fallback, or the confirmation of a local `oui`).
+
 The `precheck-reader` agent does not set `omitClaudeMd` (Claude Code 2.1.271), on purpose: measured on a project with a
 297-line `CLAUDE.md` (haiku, `--agents` + `--agent`, same prompt, with and without the flag), the session context is
 identical (22 779 tokens, the project `CLAUDE.md` still answered when asked) — the flag only applies to an agent run as a
@@ -970,7 +985,7 @@ committed, a short re-review of that commit runs instead): `ready`, verdict reco
 the untreated minors returned as proposals. Same when the budget is exhausted right after a compliant
 review with minors: it concludes on that review instead of staying suspended.
 
-**Sub-tasks covered by commits (L82)**: when the review concludes compliant, the open sub-tasks of the lot that a work commit of the lot cites (`feat(L3/t2): …`; a commit that cites only the lot covers none) are closed in the same plan commit as the verdict, with the warning `sous-tâches closes : L3/t2 (sha)`, so `raf done` does not refuse the lot over finished work. A read-only plan is never written: each such sub-task is returned as a proposal `[sous-tâche clore] L3/t2 — couverte par <sha>`, for you to close with the project's tool. On a plan in a foreign format (read-only, `cadence.yaml` `plan:`), sub-task ids are read as the plan reads them: `B53/t4-ux1` covers `t4-ux1` only, not `t4`, and a list such as `feat(B53/t4-ux1,t5)` covers each of its sub-tasks. A non-compliant review closes nothing.
+**Sub-tasks covered by commits (L82)**: when the review concludes compliant, the open sub-tasks of the lot that a work commit of the lot cites (`feat(L3/t2): …`, in the project or in one of the lot's neighbouring repositories; a commit that cites only the lot covers none) are closed in the same plan commit as the verdict, with the warning `sous-tâches closes : L3/t2 (sha)`, so `raf done` does not refuse the lot over finished work. A read-only plan is never written: each such sub-task is returned as a proposal `[sous-tâche clore] L3/t2 — couverte par <sha>`, for you to close with the project's tool. On a plan in a foreign format (read-only, `cadence.yaml` `plan:`), sub-task ids are read as the plan reads them: `B53/t4-ux1` covers `t4-ux1` only, not `t4`, and a list such as `feat(B53/t4-ux1,t5)` covers each of its sub-tasks. The lot id is not read inside another id (`fix(E-A2/t3,t4, A2/t1)` covers `A2/t1` only for lot `A2`), and a list may repeat the lot id (`fix(L1/t1, L1/t2,t3)` covers `t1`, `t2` and `t3`). A non-compliant review closes nothing.
 
 **Choices, not questions**: the author brief tells the session to decide minor interpretation questions itself and to list them under `choix` in its report; the reviewer receives that list to re-read, and the final table prints each one (`choix fait : …`). A session stops with a question only on a real blocker: a decision that changes the scope or the architecture or is costly to undo, AND that the plan, its notes and CLAUDE.md do not settle; everything else is a choice.
 
@@ -1111,6 +1126,23 @@ kept apart, session ids, commits, verdicts), the JSON output of every session an
 cut (Ctrl-C, WSL closed) `--resume` replays an interrupted step entirely in a new session whose brief
 lists the commits already present; finished steps are never replayed.
 
+When a session ends — success, error, time limit (`timeouts`) or interruption of the wave — nothing it started
+survives it: besides its process group, the tree of its descendants is tracked while it runs and killed with it, and
+every session carries a `CADENCE_SESSION=<id>` mark in its environment that all its descendants inherit, even those
+re-parented to init (`nohup srv &` or `setsid srv &` from a shell that exits at once): at the end — as soon as the session's root process exits, not when its output closes, so a descendant holding stdout open cannot turn a session that exited with code 0 into a "time limit" failure — every process
+bearing the mark is killed (read from `/proc/<pid>/environ`, or, where there is no `/proc`, from `ps -axEww` on macOS — `-E` is the BSD option that prints the environment, `-e` only means "all processes" there — and `ps axeww` with procps on Linux).
+
+Limits of the mark, stated rather than hidden: it is read from the process environment, so a descendant that
+dropped it (`env -i`, `env -u CADENCE_SESSION`) is only reached by the tree tracking, and only if it was seen under
+the session between two samples (every 200 ms); a process whose environment is unreadable (another user) is never
+found; a process started through a daemon that already ran before the session (`docker compose up -d` talks to the
+Docker daemon, which owns the containers) is out of reach. **Shared daemons are spared**: a tmux server, `screen`,
+`gpg-agent` or `dirmngr` started on demand by a session carries its mark and would pass it to clients and panes opened
+later from elsewhere, so killing by mark would kill the lead's own tmux panes; those daemons (only when they carry the mark: the lead's own tmux, where cadence itself may run, does not, and spares nothing), and everything that
+descends from them, are left alone (a dev server started inside a tmux pane therefore survives its session). Not in
+that list, because their name does not tell them from an ordinary client: the ssh master (`ControlPersist`), the
+Gradle daemon (java) and pm2 (node) — they are killed if they carry the mark.
+
 Briefs are the templates of `templates/orchestrate/` (`implement.md` is the `lead` skill's standard
 brief; `--dry-run` writes the rendered ones). The `implement` brief of a `visible` lot also carries the
 News instruction (`cadence news new <lot>`, factual user-side text, a screenshot in `docs/nouveautes/captures/` or
@@ -1120,7 +1152,7 @@ News instruction (`cadence news new <lot>`, factual user-side text, a screenshot
 orchestrate:
   test: npm test                         # run by the orchestrator after a work step (optional)
   build: npm run build                   # run after the tests; both results go to the reviewer, who does not redo them (optional)
-  precheck: true                         # default: before the first implementation of a lot with no commit, a read-only Sonnet session checks whether the deliverable is already in the repository (see below); false skips it
+  precheck: true                         # default: before the first implementation of a lot with no commit, a read-only Sonnet session checks whether the deliverable is already in the repository (see below); false skips it, local runs it on claude-local (Ollama) with Sonnet as fallback
   effort: { review: xhigh }              # effort level per pass (see « Effort level per pass »): precheck, implement, fix, review, ux
   ux: http://localhost:4200              # a URL, a launch command, or { command, url, timeout? } — for the UX review (see below)
   permissionMode: auto                   # default
@@ -1252,7 +1284,7 @@ repository with `cadence skills install` (to `.claude/skills/cadence-*` and
   `raf add --parent` sub-tasks, and a one-line verdict for `raf ux`. It never
   edits code. Read-only for real: its `tools:` list is `Read, Grep, Glob, Bash` and the
   Playwright tools (`mcp__playwright`, and `mcp__plugin_playwright_playwright` when the
-  browser comes from the Playwright plugin) — no `Edit`, no `Write`.
+  browser comes from the Playwright plugin) — no `Edit`, no `Write`. Outside a wave it gives its captures a relative file name only, which the Playwright MCP writes under `.playwright-mcp/` (the same rule as the wave's briefs); `qa-reviewer` follows it too.
 - **code-reviewer** (agent): any stack; given a repository and a lot id, it reads
   the diff itself from the commits that cite the lot — not the author's summary —
   and the project's CLAUDE.md, when there is one, for its conventions; findings grounded in a
@@ -1263,12 +1295,14 @@ repository with `cadence skills install` (to `.claude/skills/cadence-*` and
   runs a build whose output is used live, and never edits code. A README or usage
   documentation that does not follow the lot's change is a *major* finding.
 - **qa-reviewer** (agent): any web app (read-only like `ux-reviewer`: same tool list, no `Edit`, no `Write`); given a repository and a base URL (and
-  optionally a lot id, to start with the pages it touched — for a backend-only
-  lot, those that call the changed endpoints), it opens each page of
+  optionally a lot id, to walk only the pages it touched — those that call the
+  changed endpoints, those of the screens it changed, the pages that consume the services the lot changed,
+  and the home page; a backend-only lot stays in scope, and when the lot changes no route
+  and no screen, or the endpoints cannot be mapped to pages, every page is walked; the others are named « Not walked »), it opens each page of
   the project's expectations file in a real browser at 1440 and 390 px and
   measures: expected content present and non-empty, no error or missing-data
   message, every API call answered 2xx with a non-empty body, no console error,
-  no broken content image. Findings are defects (a line of the expectations
+  no broken content image. It reads the page as text first and takes a capture only for a gap. Findings are defects (a line of the expectations
   broken, or a universal check failing with a visible effect, with or without an
   expectations file), suspects (it looks like missing or wrong data and no
   expectation settles it) or noise (a console error or a failed request with no

package/agents/qa-reviewer.md

@@ -15,9 +15,7 @@ that a defect. You do: a players page with no players is a defect, whatever the
 ## Inputs
 
 The absolute path of the repository and the base URL of the app — deployed, or a local server the
-caller started. Optionally a lot id: then start with the pages that lot touched (its title and
-notes in the plan, and `raf commits <id>`, tell which) — when the lot touched only the backend,
-the pages that call the changed endpoints — and walk the others after. If the path or the URL is
+caller started. Optionally a lot id: then walk only the pages that lot touched, as « Scope of a lot » below says. If the path or the URL is
 missing, or the URL does not answer, say so and stop.
 
 ## Method
@@ -46,6 +44,11 @@ missing, or the URL does not answer, say so and stop.
    and **390 px** wide. Walk within the bounded pass below. Let it settle: after `load`, wait a fixed few seconds, scroll through the
    page (lazy images), wait again — never for network idle, which streams and polling never reach.
    Then measure:
+   - read the page as text first: its rendered text and structure (`innerText`, or the
+     accessibility snapshot), the counts of the selectors named by the expectations, the responses
+     you listened to. Compare that text with the expectations, and take a capture only for a gap —
+     a `shows:` line unmet, a `never:` text found, a failed call — as evidence of that gap: a page
+     that matches its expectations gets none;
    - browser state, once before the first page, in a profile already used (a persistent context, not a fresh one — a `userDataDir` reserved for QA and kept between passes, never the user's own browser profile): compare the bundle the page loaded (its script URL) with the one `index.html` references, re-read without cache — a returning visitor still holds the old one, so a difference is stated in the report — then clear the cache and measure;
    - the expected content is present and non-empty — name the selector or the text found and its
      count (`.player-card` ×14), not "the list looks fine";
@@ -76,7 +79,7 @@ missing, or the URL does not answer, say so and stop.
 5. **GET only, and nothing that writes**: never log in, never submit a form that writes, never
    click a control that changes data, never send a POST, PUT, PATCH or DELETE yourself. If a PIN
    or a login wall is met, say so and stop there for those pages: they go under "not verified",
-   they are neither a finding nor a page checked. GET only is not "without effect": a probe on an asset name that does not exist was cached for 4 hours by the CDN and then served to real visitors. Request only URLs the app itself uses, or add a cache-busting query parameter.
+   they are neither a finding nor a page checked. GET only is not "without effect": a probe on an asset name that does not exist is cached by a CDN and then served to real visitors. Request only URLs the app itself uses, or add a cache-busting query parameter.
 6. **Classify** what you see:
    - *defect* — a line of the expectations is broken, or a universal check fails with a visible
      effect on the page: an error message shown, a failed API call whose content is missing on
@@ -96,6 +99,32 @@ missing, or the URL does not answer, say so and stop.
    false, or an error is shown to the user), *major* (secondary content missing or wrong, a section
    silently dropped after a failed or empty API call, a broken content image), *minor* (noise). A broken line of the expectations with no visible loss on the page (the content is on screen by another path) is *minor* too.
 
+## Scope of a lot
+
+With a lot id, walk only the pages the lot touched — the cost of a pass is the pages walked, and
+a delivery rarely changes them all:
+
+- the pages that call the changed endpoints (`raf commits <id>` and the diff tell which routes
+  changed; the `api:` lines of the expectations, and the calls you see a page make, tell which
+  pages use them);
+- the pages of the screens the lot changed (its title and notes in the plan, and
+  the components in its commits, name them);
+- the home page.
+
+A backend-only lot is kept in scope: it can empty a page without touching a screen, and the pages
+that call its endpoints are exactly the ones to walk. It also touches the pages that consume the
+services the lot changed — grep for their callers, from the changed service up to the endpoint
+that uses it, and walk the pages of those endpoints. If a backend lot changes no route (a service, a
+data source or a configuration changed under routes that keep their path) and no screen, the scope
+cannot come from the routes: the fallback is mandatory: walk every page and say so in the report.
+If you cannot link the diff to any page, or a backend part of it in a lot that also changes
+screens (a shared helper, a utility, a data source), the fallback is mandatory too: walk every page
+and say so in the report. A lot that changes only screens keeps the reduced scope:
+the pages of those screens, plus the home page. If you cannot tell which pages a changed
+endpoint feeds, walk every page and say so — a scope you cannot establish reduces nothing. Pages
+outside the scope are named under « Not walked », never counted as checked. Without a lot id,
+walk every page.
+
 ## Bounded pass
 
 The pass has a time budget: the one the caller names, otherwise 15 minutes. You keep the count
@@ -117,6 +146,7 @@ from the first page.
 
 A short report:
 
+- **Scope**, one line: the lot id (or "none: every page"), the pages walked of pages in the expectations (or routes discovered), a « Not walked » list naming each page not walked and why, and the captures taken — the figures to compare from one pass to the next.
 - **Pages checked N/N**, with the base URL and the date and time of the run, and the two widths. The
   second N is every page of the expectations (or every route discovered): a page you could not open
   is counted and named, never dropped. A page counts as checked when both widths were measured; a
@@ -135,7 +165,7 @@ A short report:
   (/players shows no player)", "no expectations file: 13 pages walked, 1 defect, 8 suspects, draft
   returned". It is the last line of the report.
 
-Captures and temporary files go in a temporary directory outside the repository, or in the one
+Give screenshots and snapshots a relative file name only (e.g. `page-home.png`), never an absolute path: the Playwright MCP writes them under `.playwright-mcp/` (list them in the report if git does not ignore that folder), or in the wave's output directory outside the repository when a wave launched it. Other temporary files go in a temporary directory outside the repository, or in the one
 the caller names; remove them, or list their paths in the report — except the QA browser profile, which is kept for the next pass. The working tree is left as you
 found it.
 

package/agents/ux-reviewer.md

@@ -17,7 +17,7 @@ identity (colours, density, tone) is a constraint, not something to "fix".
 
 1. **Look before judging.** Capture the screen with the browser tool available (Playwright or
    equivalent) at **1440 px** and **390 px** wide, in its main states: empty, loaded, error, loading,
-   and the key interaction. Look at every capture. Store them in the project's temporary folder.
+   and the key interaction. Look at every capture. Give screenshots and snapshots a relative file name only (e.g. `page-home.png`), never an absolute path: the Playwright MCP writes them under `.playwright-mcp/` (list them in the report if git does not ignore that folder), or in the wave's output directory outside the repository when a wave launched it. Anything else you create goes in a temporary directory outside the repository, removed afterwards.
 2. **Walk the main task** a real user comes for (find, read, compare, act, undo) and count the steps.
 3. **Check, and measure where a number exists:**
    - Nielsen's 10 heuristics — especially visibility of system status, match with the user's words,

package/dist/audit.js

@@ -192,14 +192,15 @@ export function lotWork(plan, root, lotId) {
 /**
  * Sous-tâches encore ouvertes d'un lot que citent ses commits de travail (`feat(L3/t2)`), avec le plus récent des commits qui
  * les citent (L82) : le travail est fait, il ne reste que le plan à tenir. Un commit qui ne cite que le lot ne couvre rien.
+ * `neighbourWork` : les commits du lot dans ses dépôts voisins (`repoWork`, L62), lus après ceux du projet (L156).
  */
-export function coveredTasks(plan, root, lotId) {
+export function coveredTasks(plan, root, lotId, neighbourWork = []) {
     const lot = plan.lots().find((l) => l.id === lotId);
     if (!lot)
         return [];
     const open = new Set(lot.tasks.filter((t) => isOpen(t.status)).map((t) => t.id));
     const found = new Map();
-    for (const c of lotWork(plan, root, lotId)) {
+    for (const c of [...lotWork(plan, root, lotId), ...neighbourWork]) {
         const cited = citedRefs(c, plan.refs).filter((r) => r.lot === lotId && r.task);
         // `fix(L3/t1,t2)` : le motif des références ne lit que la première sous-tâche d'une liste à virgule.
         // Même texte que citedRefs : la portée quand elle cite des lots, sinon le message entier (le corps ne compte pas à côté d'une portée).
@@ -208,7 +209,7 @@ export function coveredTasks(plan, root, lotId) {
         const scope = scopeOf(c.subject);
         const text = scope !== null && plan.refs(scope).length > 0 ? scope : `${c.subject}\n${c.body}`;
         const element = '[\\w-]+(?:\\.[\\w-]+)*';
-        const listed = cited.length > 0 ? [...text.matchAll(new RegExp(`(?<![\\w/])${escapeRe(lotId)}/(${element}(?:\\s*,\\s*${element})*)`, 'g'))].flatMap((m) => m[1].split(/\s*,\s*/)).flatMap((e) => plan.refs(`${lotId}/${e}`).filter((r) => r.lot === lotId && r.task).map((r) => r.task)) : [];
+        const listed = cited.length > 0 ? [...text.matchAll(new RegExp(`(?<![\\w/.-])${escapeRe(lotId)}/(${element}(?:\\s*,\\s*(?:${escapeRe(lotId)}/)?${element})*)`, 'g'))].flatMap((m) => m[1].split(/\s*,\s*/)).map((e) => (e.startsWith(`${lotId}/`) ? e.slice(lotId.length + 1) : e)).flatMap((e) => plan.refs(`${lotId}/${e}`).filter((r) => r.lot === lotId && r.task).map((r) => r.task)) : [];
         for (const task of [...cited.map((r) => r.task), ...listed])
             if (open.has(task) && !found.has(task))
                 found.set(task, c.sha);

package/dist/config.js

@@ -226,7 +226,7 @@ const REVIEW_KEYS = ['threshold', 'light', 'full'];
 const ORCH_KEYS = ['start', 'verdict', 'test', 'build', 'ux', 'precheck', 'review', 'effort', 'permissionMode', 'addDirs', 'timeouts'];
 /** Clé `orchestrate:` de cadence.yaml. Absente : les défauts (auto, 45 min d'implémentation, 25 min de revue). */
 export function readOrchestrateConfig(file) {
-    const config = { precheck: true, review: { threshold: 0.25, light: 'sonnet', full: 'opus' }, effort: { precheck: 'low', implement: 'medium', fix: 'medium', review: 'high', ux: 'high' }, permissionMode: 'auto', addDirs: [], timeouts: { work: 45 * 60_000, review: 25 * 60_000 } };
+    const config = { precheck: true, precheckLocal: false, review: { threshold: 0.25, light: 'sonnet', full: 'opus' }, effort: { precheck: 'low', implement: 'medium', fix: 'medium', review: 'high', ux: 'high' }, permissionMode: 'auto', addDirs: [], timeouts: { work: 45 * 60_000, review: 25 * 60_000 } };
     if (!existsSync(file))
         return config;
     let raw;
@@ -261,9 +261,10 @@ export function readOrchestrateConfig(file) {
         config[k] = o[k].trim();
     }
     if (o.precheck != null) {
-        if (typeof o.precheck !== 'boolean')
-            throw bad('precheck : true ou false attendu');
-        config.precheck = o.precheck;
+        if (typeof o.precheck !== 'boolean' && o.precheck !== 'local')
+            throw bad('precheck : true, false ou local attendu');
+        config.precheck = o.precheck !== false;
+        config.precheckLocal = o.precheck === 'local';
     }
     if (o.review != null) {
         if (!isObject(o.review))

package/dist/orchestrate/command.js

@@ -15,7 +15,7 @@ import { loadTemplates, newsText, objective, renderBrief } from './briefs.js';
 import { candidates, parsePriority, parseUntil, readPriority, stopReason } from './continue.js';
 import { Budget, DROPPED, MAX_PASSES, countInterrupted, handBackDroppedQuestions, needsPrecheck } from './cycle.js';
 import { canInstallPrePush, installPrePush, removePrePush, snapshot } from './guard.js';
-import { buildArgs, killSessions, mcpServersFor, readAgents, realClaude } from './launch.js';
+import { buildArgs, buildLocalArgs, killSessions, mcpServersFor, readAgents, realClaude } from './launch.js';
 import { activeLock, REPO_LOCK, releaseLock, takeLock } from './lock.js';
 import { runPool } from './pool.js';
 import { schemaFor } from './schemas.js';
@@ -292,7 +292,7 @@ function dryRun(lots, io, deps, budget, id) {
         }
         const steps = [{ kind: 'implement', model: l.model }];
         if (needsPrecheck(env.config, env.loadPlan(), l.repo, l.lot, l.repos))
-            steps.unshift({ kind: 'precheck', model: 'sonnet' });
+            steps.unshift({ kind: 'precheck', model: env.config.precheckLocal ? 'local' : 'sonnet' });
         const { light, full } = env.config.review;
         if (l.small)
             steps.push({ kind: l.visible ? 'review-small' : 'review', model: l.light ? light : full });
@@ -312,8 +312,9 @@ function dryRun(lots, io, deps, budget, id) {
             const brief = renderBrief(s.kind, vars, deps.templatesDir);
             writeFileSync(file, brief);
             const playwright = !!mcpServersFor(s.kind, l.visible, '', l.small).playwright;
-            const args = buildArgs({ kind: s.kind, sessionId: '<uuid>', brief: '<brief>', model: s.model, effort: env.config.effort[s.kind === 'review-small' ? 'review' : s.kind], schema: schemaFor(s.kind), agent: s.kind === 'implement' ? undefined : s.kind === 'ux' ? 'ux-reviewer' : s.kind === 'precheck' ? 'precheck-reader' : 'code-reviewer', cwd: l.repo, wave: id, permissionMode: env.config.permissionMode, addDirs: [...env.config.addDirs, ...(playwright && s.kind === 'implement' ? [pwDir] : []), ...neighbourDirs(l)], timeoutMs: 0, mcpConfig: '<mcp>', playwright }, agents).map((a) => (a.startsWith('{') ? '<json>' : a));
-            io.out(`  ${s.kind} : claude ${args.join(' ')}`);
+            const local = s.model === 'local';
+            const args = (local ? buildLocalArgs : buildArgs)({ kind: s.kind, sessionId: '<uuid>', brief: '<brief>', model: s.model === 'local' ? 'sonnet' : s.model, local, effort: env.config.effort[s.kind === 'review-small' ? 'review' : s.kind], schema: schemaFor(s.kind), agent: s.kind === 'implement' ? undefined : s.kind === 'ux' ? 'ux-reviewer' : s.kind === 'precheck' ? 'precheck-reader' : 'code-reviewer', cwd: l.repo, wave: id, permissionMode: env.config.permissionMode, addDirs: [...env.config.addDirs, ...(playwright && s.kind === 'implement' ? [pwDir] : []), ...neighbourDirs(l)], timeoutMs: 0, mcpConfig: '<mcp>', playwright }, agents).map((a) => (a.startsWith('{') ? '<json>' : a));
+            io.out(`  ${s.kind} : ${local ? 'claude-local' : 'claude'} ${args.join(' ')}`);
             io.out(`    brief : ${file}`);
             const servers = Object.keys(mcpServersFor(s.kind, l.visible, '', l.small));
             io.out(`    mcp : ${servers.length ? `${servers.join(', ')} (captures dans le dossier de la vague : <vague>/${lotSlug(l.project, l.lot)}/playwright)` : 'aucun'}`);
@@ -1020,7 +1021,7 @@ export function realOrchestrateDeps(env) {
     // Lues ici, une fois : ni les sessions ni les commandes du projet ne reçoivent les variables de relance.
     env = withoutLaunchVars({ ...env });
     return {
-        claude: realClaude(bin, env),
+        claude: realClaude(bin, env, env.CADENCE_CLAUDE_LOCAL_BIN || 'claude-local'),
         claudeInfo: () => {
             try {
                 const version = execFileSync(bin, ['--version'], { env, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 20_000 }).trim();

package/dist/orchestrate/cycle.js

@@ -39,8 +39,8 @@ export class Budget {
  * session (`--session-id`). Une étape déjà comptée (`tokens`) ne l'est jamais deux fois. Vrai quand quelque chose a été compté.
  */
 export function countInterrupted(claudeHome, repo, step, budget) {
-    if (!claudeHome || !step.sessionId || step.tokens)
-        return false;
+    if (!claudeHome || !step.sessionId || step.tokens || step.model === 'local')
+        return false; // le modèle local n'a rien pris au quota
     const spent = journalTokens(claudeHome, repo, step.sessionId);
     if (!spent)
         return false;
@@ -293,7 +293,9 @@ function reviewModel(c, kind) {
     return c.lot.light && c.lot.pass === 0 && (kind === 'review' || kind === 'review-small') ? light : full;
 }
 /** Une session : budget et quota vérifiés avant, état écrit avant et après, journal gardé, contrôles du dépôt après. */
-async function session(c, kind) {
+/** Rendu par `session(…, true)` quand l'étape locale n'a rien donné (Ollama éteint, délai, rapport sans structure) : l'appelant se replie sur Sonnet (L146). */
+const LOCAL_FAILED = Symbol('local-failed');
+async function session(c, kind, local = false) {
     const w = c.wave;
     const l = c.lot;
     if (dropped(c))
@@ -305,7 +307,7 @@ async function session(c, kind) {
     // Le budget du lot borne l'écriture, jamais la revue (L145) : une revue est jouée dès que le code est à relire (sauf tests rouges après une écriture, cf. REVIEW_RESERVE), la passe fix réserve son coût.
     if (write && (lotOver(l) || (kind === 'fix' && !fixAffordable(l))))
         return overBudget(c, kind === 'fix' && !lotOver(l));
-    const model = write ? l.model : kind === 'precheck' ? 'sonnet' : reviewModel(c, kind); // le contrôle préalable ne fait que lire : pas d'Opus
+    const model = write ? l.model : local ? 'local' : kind === 'precheck' ? 'sonnet' : reviewModel(c, kind); // le contrôle préalable ne fait que lire : pas d'Opus
     const effort = c.config.effort[kind === 'review-small' ? 'review' : kind];
     const before = await snapshot(l.repo);
     const neighbours = l.repos ?? [];
@@ -335,8 +337,9 @@ async function session(c, kind) {
         kind,
         sessionId,
         brief,
-        model,
+        model: local ? 'sonnet' : model,
         effort,
+        local,
         schema: schemaFor(kind),
         agent: kind === 'ux' ? 'ux-reviewer' : kind === 'precheck' ? 'precheck-reader' : write ? undefined : 'code-reviewer',
         cwd: l.repo,
@@ -359,7 +362,7 @@ async function session(c, kind) {
     step.ended = new Date().toISOString();
     const dir = w.store.lotDir(l.project, l.lot);
     const base = `${n}-${kind}`;
-    if (outcome.kind !== 'ok') {
+    if (outcome.kind !== 'ok' && !local) {
         // Une session en échec, au quota ou tuée au délai a consommé des tokens : ceux de sa sortie, sinon ceux de son journal.
         const spent = outcome.tokens ? { tokens: outcome.tokens, sessionId: outcome.sessionId } : w.claudeHome ? journalTokens(w.claudeHome, l.repo, outcome.sessionId ?? sessionId) : null;
         if (spent) {
@@ -372,6 +375,20 @@ async function session(c, kind) {
                 step.peakContext = peakContext(w.claudeHome, l.repo, spent.sessionId);
         }
     }
+    if (local && outcome.kind !== 'ok') {
+        // Hors quota Anthropic : rien au budget (ni sortie, ni journal), et jamais d'arrêt du lot — Sonnet reprend le contrôle.
+        const cause = outcome.kind === 'failed' ? outcome.cause : outcome.message;
+        writeFileSync(join(dir, `${base}.json`), outcome.kind === 'failed' ? outcome.stdout : '');
+        if (outcome.kind === 'failed')
+            writeFileSync(join(dir, `${base}.err`), outcome.stderr);
+        step.status = 'failed';
+        step.cause = cause;
+        step.report = `${base}.json`;
+        delete step.tokens;
+        l.warnings.push(`contrôle préalable : modèle local sans résultat (${cause.slice(0, 200)}), repli sur Sonnet`);
+        save(c);
+        return LOCAL_FAILED;
+    }
     if (outcome.kind === 'failed') {
         if (outcome.firstStdout !== undefined)
             writeFileSync(join(dir, `${base}.first.json`), outcome.firstStdout);
@@ -399,12 +416,13 @@ async function session(c, kind) {
     writeFileSync(join(dir, `${base}.json`), JSON.stringify({ ...res, structured: res.structured }, null, 2));
     step.report = `${base}.json`;
     step.sessionId = res.sessionId;
-    step.tokens = res.tokens;
+    step.tokens = local ? { ...res.tokens, counted: 0 } : res.tokens; // local : hors quota, hors budget
     if (res.formattingRetry) {
         step.formatRetry = true;
         w.log(`${lotKey(l.project, l.lot)} · session ${n} ${kind} : rapport sans sortie structurée, relance de mise en forme`);
     }
-    w.budget.add(res.tokens);
+    if (!local)
+        w.budget.add(res.tokens);
     w.saveWave();
     if (w.claudeHome)
         step.peakContext = peakContext(w.claudeHome, l.repo, res.sessionId);
@@ -523,18 +541,44 @@ export function needsPrecheck(config, plan, repo, lot, repos = []) {
  */
 async function precheck(c) {
     const l = c.lot;
-    const done = await session(c, 'precheck');
-    if (!done)
-        return;
-    let rep;
-    try {
-        rep = checkShape(done.report, PRECHECK_SCHEMA);
+    let rep = null;
+    let localYes = false;
+    if (c.config.precheckLocal) {
+        // Modèle local (L146) : un échec, un rapport illisible ou un « oui » (qui rendrait le lot sans implémentation) rend la main à Sonnet.
+        const done = await session(c, 'precheck', true);
+        if (!done)
+            return;
+        if (done !== LOCAL_FAILED) {
+            try {
+                rep = checkShape(done.report, PRECHECK_SCHEMA);
+            }
+            catch (e) {
+                l.warnings.push(`contrôle préalable : rapport du modèle local illisible (${e.message}), repli sur Sonnet`);
+            }
+            if (rep?.dejaPresent === 'oui') {
+                localYes = true;
+                rep = null;
+            }
+        }
     }
-    catch (e) {
-        l.warnings.push(`contrôle préalable illisible, implémentation lancée : ${e.message}`);
-        l.next = 'implement';
-        save(c);
-        return;
+    if (!rep) {
+        const done = await session(c, 'precheck');
+        if (!done)
+            return;
+        try {
+            rep = checkShape(done.report, PRECHECK_SCHEMA);
+        }
+        catch (e) {
+            l.warnings.push(`contrôle préalable illisible, implémentation lancée : ${e.message}`);
+            l.next = 'implement';
+            save(c);
+            return;
+        }
+    }
+    if (localYes) {
+        l.warnings.push(rep.dejaPresent === 'oui'
+            ? 'contrôle préalable : « oui » du modèle local, confirmé par Sonnet'
+            : `contrôle préalable : le modèle local a dit « oui », Sonnet dit « ${rep.dejaPresent} » — le local s'est trompé, repasser orchestrate.precheck à true`);
     }
     const proofs = rep.preuves.length ? ` (${rep.preuves.join(' ; ')})` : '';
     // « oui » sans preuve ne se vérifie pas : il vaut « partiel », l'implémentation part avec le constat.
@@ -857,7 +901,7 @@ async function conclude(c, code, minorNote = '') {
     }
     l.constats = [];
     // Sous-tâches ouvertes que des commits du lot citent (L82) : la revue conforme vaut pour elles, sinon `raf done` refuserait le lot.
-    const covered = coveredTasks(plan, l.repo, l.lot);
+    const covered = coveredTasks(plan, l.repo, l.lot, neighbours.flatMap((r) => repoWork(plan, r, l.lot)));
     if (!plan.readonly) {
         plan.recordReview(l.lot, verdict, c.wave.today, newer, neighbours.length ? shas : undefined);
         for (const k of covered)

package/dist/orchestrate/launch.js

@@ -1,8 +1,10 @@
 import { spawn } from 'node:child_process';
+import { randomUUID } from 'node:crypto';
 import { existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { delimiter, join, resolve } from 'node:path';
 import { parse } from 'yaml';
 import { RafError } from '../plan.js';
+import { killMarked, SESSION_MARK_VAR, TreeTracker } from '../proc.js';
 import { isQuotaMessage, lacksStructuredOutput, parseSession, salvageUsage, sumTokens, tokensOf } from './result.js';
 /**
  * Serveurs MCP d'une étape : Playwright pour `ux` et, sur un lot `visible`, pour `implement` et `fix` (fix-minors compris) ;
@@ -58,6 +60,24 @@ export function buildArgs(spec, agents) {
         args.push('--strict-mcp-config', '--mcp-config', spec.mcpConfig);
     return args;
 }
+/**
+ * Arguments de `claude-local` (L146) : le prompt vient en premier, le script ajoute lui-même `--bare`, `--model` et le
+ * serveur Ollama. Le harnais `--bare` ne charge pas `--agents` : le prompt de l'agent est joint au brief et ses outils
+ * passent par `--tools`. Pas de `--effort`, pas de MCP (aucune étape locale n'en charge).
+ */
+export function buildLocalArgs(spec, agents) {
+    const a = spec.agent ? agents[spec.agent] : undefined;
+    if (spec.agent && !a)
+        throw new RafError(`agent introuvable dans le paquet : ${spec.agent}`);
+    const args = [a ? `${a.prompt}\n\n${spec.brief}` : spec.brief, '--output-format', 'json', '--json-schema', JSON.stringify(spec.schema)];
+    if (a?.tools)
+        args.push('--tools', a.tools.join(','));
+    args.push('--session-id', spec.sessionId, '--permission-mode', spec.permissionMode);
+    for (const d of spec.addDirs)
+        args.push('--add-dir', d);
+    args.push('--disallowedTools', ...DISALLOWED);
+    return args;
+}
 /** Définitions d'agents du paquet (`agents/*.md`) au format de --agents. */
 export function readAgents(dir) {
     const out = {};
@@ -105,9 +125,11 @@ export function buildRetryArgs(spec, sessionId, agents) {
  * s'ajoutent à ceux de la session ; toujours rien après elle, c'est l'échec habituel.
  */
 export async function runSession(spec, deps) {
-    const launch = (args) => deps.claude(args, { cwd: spec.cwd, env: { CADENCE_ORCHESTRATED: spec.wave, ...(spec.nodeBin || spec.toolBin ? { PATH: [spec.toolBin, spec.nodeBin, process.env.PATH ?? ''].filter(Boolean).join(delimiter) } : {}) }, timeoutMs: spec.timeoutMs, onSpawn: deps.onSpawn });
-    const out = await launch(buildArgs(spec, deps.agents));
+    const launch = (args) => deps.claude(args, { local: spec.local, cwd: spec.cwd, env: { CADENCE_ORCHESTRATED: spec.wave, ...(spec.nodeBin || spec.toolBin ? { PATH: [spec.toolBin, spec.nodeBin, process.env.PATH ?? ''].filter(Boolean).join(delimiter) } : {}) }, timeoutMs: spec.timeoutMs, onSpawn: deps.onSpawn });
+    const out = await launch(spec.local ? buildLocalArgs(spec, deps.agents) : buildArgs(spec, deps.agents));
     const first = classify(out);
+    if (spec.local)
+        return first; // pas de relance de mise en forme : l'appelant se replie sur Sonnet
     const missing = first.kind === 'failed' && !out.timedOut && out.code === 0 ? lacksStructuredOutput(out.stdout) : null;
     if (!missing)
         return first;
@@ -147,6 +169,8 @@ function classify(out) {
     return { kind: 'ok', result };
 }
 const live = new Set();
+const trees = new Set();
+const marks = new Set();
 /** Suit un groupe de processus lancé par l'orchestrateur (commande du projet) : tué avec les sessions au signal. */
 export function trackGroup(pid) {
     live.add(pid);
@@ -163,17 +187,33 @@ export function killSessions() {
         }
     }
     live.clear();
+    for (const t of trees)
+        t.kill();
+    trees.clear();
+    for (const m of marks)
+        killMarked(m);
+    marks.clear();
 }
 /** Vrai lanceur : `claude` (ou CADENCE_CLAUDE_BIN) dans son propre groupe de processus, tué en bloc au délai. */
-export function realClaude(bin, base = process.env) {
+export function realClaude(bin, base = process.env, localBin = 'claude-local') {
     return (args, opts) => new Promise((resolve) => {
-        const child = spawn(bin, args, { cwd: opts.cwd, env: { ...base, ...opts.env }, stdio: ['ignore', 'pipe', 'pipe'], detached: true });
+        // Marque héritée par tous les descendants, même orphelins rattachés à init (un shell qui sort aussitôt après
+        // `nohup srv &` échappe à tout relevé de l'arbre) : à la fin de la session, tout ce qui la porte est tué.
+        const mark = randomUUID();
+        marks.add(mark);
+        const child = spawn(opts.local ? localBin : bin, args, { cwd: opts.cwd, env: { ...base, ...opts.env, [SESSION_MARK_VAR]: mark }, stdio: ['ignore', 'pipe', 'pipe'], detached: true });
         const pid = child.pid;
         if (pid === undefined) {
+            marks.delete(mark);
             child.once('error', (e) => resolve({ code: 127, stdout: '', stderr: String(e.message), timedOut: false }));
             return;
         }
         live.add(pid);
+        // Le groupe ne suffit pas : un serveur de dev lancé par la session (setsid, nohup, npm qui se détache) a son propre
+        // groupe et survivait à la session (L83). L'arbre est suivi pendant toute la session ; la marque rattrape ce
+        // qui a quitté l'arbre entre deux relevés.
+        const tree = new TreeTracker(pid);
+        trees.add(tree);
         opts.onSpawn?.(pid);
         const out = [];
         const err = [];
@@ -182,6 +222,8 @@ export function realClaude(bin, base = process.env) {
         let timedOut = false;
         const timer = setTimeout(() => {
             timedOut = true;
+            tree.kill();
+            killMarked(mark);
             try {
                 process.kill(-pid, 'SIGKILL');
             }
@@ -189,16 +231,27 @@ export function realClaude(bin, base = process.env) {
                 // déjà mort
             }
         }, Math.max(1_000, opts.timeoutMs));
-        child.once('close', (code, signal) => {
-            clearTimeout(timer);
-            live.delete(pid);
-            // Un enfant resté dans le groupe ne survit pas à la session.
+        // Aucun descendant ne survit à la session, dans son groupe ou hors de lui. Dès que la racine sort (`exit`), pas
+        // à `close` : un descendant qui tient stdout/stderr ouverts retarderait `close` jusqu'au délai (« délai dépassé »
+        // pour une session pourtant sortie en code 0).
+        const reap = () => {
+            tree.rootExited();
+            tree.kill();
+            trees.delete(tree);
+            killMarked(mark);
             try {
                 process.kill(-pid, 'SIGKILL');
             }
             catch {
                 // groupe vide
             }
+        };
+        child.once('exit', reap);
+        child.once('close', (code, signal) => {
+            clearTimeout(timer);
+            live.delete(pid);
+            reap();
+            marks.delete(mark);
             resolve({ code: code ?? (signal ? 137 : 1), stdout: Buffer.concat(out).toString('utf8'), stderr: Buffer.concat(err).toString('utf8'), timedOut });
         });
     });

package/dist/proc.js

@@ -62,6 +62,21 @@ export function readPsProcs(run = execFileSync) {
     }
     return procs;
 }
+/**
+ * Nom (comm), état, parent et heure de démarrage (champ 22) lus dans `<procRoot>/<pid>/stat` ; null s'il est sorti ou
+ * illisible. Seul lecteur de ce fichier : « pid (comm) état ppid … starttime … », comm peut contenir espaces et parenthèses.
+ */
+export function readStat(procRoot, pid) {
+    try {
+        const stat = readFileSync(`${procRoot}/${pid}/stat`, 'utf8');
+        const close = stat.lastIndexOf(')');
+        const f = stat.slice(close + 2).split(' ');
+        return { name: stat.slice(stat.indexOf('(') + 1, close), state: f[0], ppid: Number(f[1]), start: f[19] };
+    }
+    catch {
+        return null;
+    }
+}
 /** Tous les processus visibles : /proc sous Linux (starttime, champ 22 de stat), `ps` ailleurs (lstart) ; null si illisibles. */
 export function readProcs() {
     const procs = new Map();
@@ -74,15 +89,9 @@ export function readProcs() {
     }
     if (names) {
         for (const n of names) {
-            try {
-                const stat = readFileSync(`/proc/${n}/stat`, 'utf8');
-                // « pid (comm) état ppid … starttime … » — comm peut contenir espaces et parenthèses
-                const f = stat.slice(stat.lastIndexOf(')') + 2).split(' ');
-                procs.set(Number(n), { ppid: Number(f[1]), start: f[19], zombie: f[0] === 'Z' });
-            }
-            catch {
-                // sorti entre-temps
-            }
+            const st = readStat('/proc', Number(n));
+            if (st)
+                procs.set(Number(n), { ppid: st.ppid, start: st.start, zombie: st.state === 'Z' });
         }
     }
     else {
@@ -94,13 +103,10 @@ export function readProcs() {
 export function processStart(pid) {
     if (!Number.isInteger(pid) || pid <= 0)
         return null;
-    try {
-        const stat = readFileSync(`/proc/${pid}/stat`, 'utf8');
-        return stat.slice(stat.lastIndexOf(')') + 2).split(' ')[19] ?? null;
-    }
-    catch {
-        // pas de /proc (macOS) ou processus sorti : ps
-    }
+    const st = readStat('/proc', pid);
+    if (st?.start)
+        return st.start;
+    // pas de /proc (macOS) ou processus sorti : ps
     try {
         const out = execFileSync('ps', ['-p', String(pid), '-o', 'lstart='], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] }).trim();
         return out || null;
@@ -277,3 +283,125 @@ export class TreeTracker {
         }
     }
 }
+/** Variable d'environnement qui marque une session de l'orchestrateur : héritée par tous ses descendants, même orphelins. */
+export const SESSION_MARK_VAR = 'CADENCE_SESSION';
+/**
+ * Démons partagés : lancés à la demande par la première session qui en a besoin, ils portent sa marque et la passent à
+ * tout client ou panneau venu d'ailleurs (serveur tmux, screen, gpg-agent, dirmngr). Ils servent d'autres que la session :
+ * tuer le serveur tmux d'une session tue les panneaux que le lead ouvre ensuite. Épargnés, avec tout ce qui en descend.
+ * Hors liste, faute de pouvoir les distinguer d'un client ordinaire par leur nom : le maître ssh (ControlPersist), le
+ * démon Gradle (java), pm2 (node) — ils restent tués s'ils portent la marque.
+ */
+const SHARED_DAEMONS = new Set(['tmux', 'screen', 'gpg-agent', 'dirmngr']);
+/** Nom d'un processus (comm ou premier mot de sa commande) : `tmux: server` → `tmux`, `/usr/bin/screen` → `screen`. */
+function isSharedDaemon(name) {
+    const base = name.trim().split(/\s/)[0].replace(/:$/, '');
+    return SHARED_DAEMONS.has((base.split('/').pop() ?? '').toLowerCase());
+}
+/**
+ * Vrai si `pid` ou l'un de ses ancêtres est un démon partagé QUI PORTE LA MARQUE (`info` : nom et parent d'un pid, null
+ * s'il est illisible ; `marked` : pids marqués). Un tmux sans la marque est celui du lead, où cadence tourne peut-être :
+ * il n'épargne rien. La remontée s'arrête à cadence.
+ */
+function underSharedDaemon(pid, info, marked) {
+    for (let cur = pid, depth = 0; cur > 1 && cur !== process.pid && depth < 64; depth++) {
+        const i = info(cur);
+        if (!i)
+            return false;
+        if (marked.has(cur) && isSharedDaemon(i.name))
+            return true;
+        cur = i.ppid;
+    }
+    return false;
+}
+/**
+ * Arguments de `ps` qui listent pid, ppid et commande suivie de l'ENVIRONNEMENT, sans limite de largeur, selon la plateforme.
+ * macOS (ps BSD), page de manuel officielle : « -E  Display the environment as well.  This does not reflect changes
+ * in the environment after process launch. » — alors que « -e  Display information about other users' processes,
+ * including those without controlling terminals. Identical to -A. » : sur macOS, `-e` n'affiche PAS l'environnement.
+ * Linux (procps), man ps : « e  Show the environment after the command. » (lettre sans tiret, style BSD ; avec un
+ * tiret, `-e` y signifie « tous les processus »).
+ */
+export function psEnvArgs(platform = process.platform) {
+    return [platform === 'darwin' ? '-axEww' : 'axeww', '-o', 'pid=,ppid=,command='];
+}
+/**
+ * Pids des processus (hors cadence) dont l'environnement porte `<SESSION_MARK_VAR>=<mark>` : /proc, sinon `ps` (`-E` sur
+ * macOS, `e` sur Linux). Les démons partagés (SHARED_DAEMONS) qui portent la marque, et leurs descendants, n'en font pas partie.
+ */
+export function findMarked(mark, io = {}) {
+    const { procRoot = '/proc', run = execFileSync, platform = process.platform, onUnavailable } = io;
+    const entry = `${SESSION_MARK_VAR}=${mark}`;
+    const found = [];
+    let names = null;
+    try {
+        names = readdirSync(procRoot);
+    }
+    catch {
+        // pas de /proc (macOS) : ps
+    }
+    if (names) {
+        for (const name of names) {
+            const pid = Number(name);
+            if (!Number.isInteger(pid) || pid <= 0 || pid === process.pid)
+                continue;
+            try {
+                if (readFileSync(`${procRoot}/${pid}/environ`, 'utf8').split('\0').includes(entry))
+                    found.push(pid);
+            }
+            catch {
+                // sorti, zombie ou illisible (autre utilisateur)
+            }
+        }
+        const markedSet = new Set(found);
+        return found.filter((pid) => !underSharedDaemon(pid, (p) => readStat(procRoot, p), markedSet));
+    }
+    try {
+        const out = run('ps', psEnvArgs(platform), { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], maxBuffer: 64 * 1024 * 1024 });
+        const table = new Map();
+        const marked = [];
+        for (const line of out.split('\n')) {
+            const m = /^\s*(\d+)\s+(\d+)\s(.*)$/.exec(line);
+            if (!m)
+                continue;
+            const pid = Number(m[1]);
+            table.set(pid, { name: m[3], ppid: Number(m[2]) });
+            // la marque est un mot entier : `s1` ne reconnaît pas `s10` (comme la comparaison exacte des entrées de /proc)
+            if (pid !== process.pid && ` ${m[3]} `.includes(` ${entry} `))
+                marked.push(pid);
+        }
+        const markedSet = new Set(marked);
+        found.push(...marked.filter((pid) => !underSharedDaemon(pid, (p) => table.get(p) ?? null, markedSet)));
+    }
+    catch {
+        // ps absent ou en échec : rien à tuer de plus, mais on le dit
+        onUnavailable?.();
+    }
+    return found;
+}
+function defaultMarkedUnavailable() {
+    process.stderr.write('cadence : processus de la session illisibles (ni /proc ni ps), des orphelins marqués ont pu survivre\n');
+}
+/** Tue (SIGKILL) tout processus marqué de la session, où qu'il soit rattaché ; repasse tant qu'un descendant en crée. */
+export function killMarked(mark, io = {}) {
+    let said = false;
+    const onUnavailable = () => {
+        if (said)
+            return;
+        said = true;
+        (io.onUnavailable ?? defaultMarkedUnavailable)();
+    };
+    for (let pass = 0; pass < 5; pass++) {
+        const pids = findMarked(mark, { ...io, onUnavailable });
+        if (pids.length === 0)
+            return;
+        for (const pid of pids) {
+            try {
+                process.kill(pid, 'SIGKILL');
+            }
+            catch {
+                // déjà mort
+            }
+        }
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sylad/cadence",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "A small, repo-native working method: a versioned plan linked to your commits, a changelog with screenshots, session rituals and deliveries proven by their effect.",
   "license": "MIT",
   "author": "Sylvain Ladoire",

package/skills/deliver/SKILL.md

@@ -57,8 +57,7 @@ Deliver one project at a time: the one the human names, or ask.
 6. After a green delivery that changes what a page shows or what it is served (screen, API, data
    source, configuration of either) — in practice every delivery except docs-, plan- or tests-only
    ones — have the `qa-reviewer` agent walk the delivered app in a real browser, whether the lot
-   is `visible` or not: give it the repository path, the base URL and the lot id. When the lot
-   touched only the backend, the agent starts with the pages that call the changed endpoints. It
+   is `visible` or not: give it the repository path, the base URL and the lot id. With a lot id, the agent walks only the pages the lot touched (the pages that call the changed endpoints, the pages of the changed screens, the pages that consume the services the lot changed, the home page; when the diff changes no route and no screen, or cannot be linked to pages, it walks every page and says so) and names the others under « Not walked »: they are not checked. It
    checks each page against `docs/qa/expectations.md` — what the user must find there — and
    reports a page left empty, an error shown, an API call that failed or came back empty: what
    the checks of `cadence.yaml` do not see. Bring its blocking findings to the human. It is not a

package/skills/lead/SKILL.md

@@ -169,8 +169,7 @@ After a green delivery that changes what a page shows or what it is served (scre
 source, configuration of either) — in practice every delivery except docs-, plan- or tests-only ones
 — have the `qa-reviewer` agent check the delivered app, as a fresh subagent: give it the absolute
 path of the project, the base URL of the delivered app and the lot id. The lot need not be
-`visible`: a backend-only lot can empty a page without changing a screen. When the lot touched only
-the backend, the agent starts with the pages that call the changed endpoints. It walks the pages in
+`visible`: a backend-only lot can empty a page without changing a screen. With a lot id, the agent walks only the pages the lot touched (the pages that call the changed endpoints, the pages of the changed screens, the pages that consume the services the lot changed, the home page; when the diff changes no route and no screen, or cannot be linked to pages, it walks every page and says so) and names the others under « Not walked »: they are not checked. It walks the pages in
 a real browser against the project's expectations (`docs/qa/expectations.md`: per page, what the
 user must find there) and returns measured findings; it reads only, and never logs in. Bring its
 blocking findings back to the human — a page whose main content is missing, or that shows an error,