@sylad/cadence 0.27.1 → 1.0.0

package/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "cadence",
       "description": "Session start and close rituals driven by a versioned plan (raf), and deliveries proven by their effect. Needs the cadence CLI (npm i -g @sylad/cadence).",
-      "version": "0.27.1",
+      "version": "1.0.0",
       "source": "./",
       "author": {
         "name": "Sylvain Ladoire"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cadence",
   "description": "A repo-native working method: session start and close rituals driven by a versioned plan (raf), deliveries proven by their effect, and three reviewer agents (UX, code, QA).",
-  "version": "0.27.1",
+  "version": "1.0.0",
   "author": { "name": "Sylvain Ladoire" },
   "homepage": "https://github.com/Sylad/cadence",
   "repository": "https://github.com/Sylad/cadence",

package/README.md

@@ -24,7 +24,7 @@ Code prompt that shows the session's context, quota, cost and the orchestrate wa
 
 ## What's new
 
-**0.27.1**: `cadence orchestrate` no longer leaves a session's child processes alive: a dev server started in its own process group, or orphaned by a shell that exits (`nohup srv &`), is killed with the session through its process tree and its `CADENCE_SESSION` mark, a tmux server, `screen`, `gpg-agent` or `dirmngr` started on demand being spared; a session that exits with code 0 while a descendant holds its output open is no longer reported as « délai dépassé » (L83); the `ux-reviewer` and `qa-reviewer` agents carry the briefs' Playwright rule outside `cadence orchestrate` (L84). **0.27.0**: a compliant review of `cadence orchestrate` settles the open sub-tasks that commits of the lot cite (`feat(L3/t2): …`, comma lists included), closed in the same plan commit as the verdict or, on a read-only plan, returned as `[sous-tâche clore]` proposals, so `raf done` no longer refuses a lot over sub-tasks whose work is done; on a foreign-format plan the ids are read as the plan reads them (L82); the test suite stays green with two full suites running in parallel (L150). **0.26.0**: `cadence orchestrate` raises the floor of a lot's budget from 200 k to 450 k tokens, enough to pay a write pass, its review, one fix pass and the short review that follows, so a lot of 0.5 or 1 day is no longer handed back at its second or third pass; a `--continue` wave draws fewer lots as a result (L128). **0.25.0**: the project line of the plans' progress in the `cadence-hud` band names the lots in progress after their count, three at most then `…` (L153, `cadence-hud` 0.4.2); the progress follows the folder the session was launched from, so a `cd` into a sub-project no longer shrinks the band, and the session context keeps the `session.start` folder (L154). **0.24.0**: `cadence orchestrate --drop <project:lot>` and `--stop-after-current` steer a live wave from another terminal, `--resume --drop` removes a lot before replaying a stopped wave (L79); the final table of a wave says « livrable jusqu'à <sha> » for a ready lot stacked under a lot handed back, with `git push origin <sha>:main && cadence deliver --sha <sha>` (L76); a version commit (version fields, `CHANGELOG.md`, the README's « What's new ») no longer asks for a new code review (L72). **0.23.0**: the progress bar of each project in the `cadence-hud` band is coloured by the share of lots done, red below 33 %, orange below 66 %, green beyond (L152, `cadence-hud` 0.4.1); `cadence deliver` under a wave lock refuses only when a lot of the wave still works in that very repository, a linked worktree included (L127). **0.22.0**: `cadence orchestrate --continue` draws the next ready lot of the plan itself, in the declared priority, until the budget, the time window or a question stops it (L147); `cadence session context` prints the context of the session, which the `cadence-hud` band publishes, and the `lead` skill chains lots without the human while it stays under 60 % (L148); the band shows the progress of each project's plan, and `cadence lead tour --json` gains `progress` (L149, `cadence-hud` 0.4.0); the final review of a lot is always played, the lot's own budget bounding the writing passes only, with 65 k tokens reserved for it (L145); the cause « tests rouges après … » names the pass whose tests were red (L151). **0.21.0**: `cadence orchestrate --status` and `cadence lead tour` print the free session slots, which the `lead` skill reads (L141); `orchestrate.effort` sets the effort level of each pass of a wave (L137); `docs.sync` makes `raf check`, `lead tour` and the review brief report a document that does not follow the code (L143); `docs.articles` opens, after a green `cadence deliver`, a lot `Article <project> à rafraîchir` in the neighbouring repository (L144). **0.20.0**: `cadence-hud` no longer misleads once the work is over: `/hud cmd` lists the background commands it counts (id, tool, origin, age, name), any other argument answers `argument inconnu` instead of hiding the band, commands with no end seen for an hour or no record go to a grey `N cmd sans fin vue`, a finished subagent takes its commands with it, two races that left a `1 cmd` counted forever are closed, and a finished wave shows grey without its budget then disappears after 30 minutes (L142); the `qa-reviewer` and `ux-reviewer` agents are read-only for real, their frontmatter listing Read, Grep, Glob, Bash and the Playwright tools (L140). **0.19.1**: `cadence-hud`'s `N cmd` counter goes back down when a Monitor expires, when the background commands a subagent started end with it, and at session start or plugin reload (L135); its `tool.call` and `prompt.submit` guard hooks carry a `.catch` on registration, which clears the `claude plugin validate` warning (L136). **0.19.0**: `cadence orchestrate` lifts a repository's lock and `pre-push` guard as soon as every lot of the wave that touches it is finished, so `cadence deliver` works there while the wave continues elsewhere (L132); a review that leaves a repository dirty hands back that lot only, suspends the lots still queued in that repository and keeps the other repositories running, its verdict reported instead of lost (L133); `cadence session close` re-run without a `session start` keeps the window since the last opening (L131); `cadence-hud` draws the lot rows of a wave in aligned columns on every surface (L134). **0.18.0**: `cadence session next` prints what it records (issue #6); `cadence session close` covers the period since the last `session start` (or the last close) and says so in its title, `--since` still wins (issue #7). **0.17.0**: `cadence-hud` shows an `N cmd` segment next to the agents, the background commands of the session (Bash run in the background and Monitor, subagents' included), tracked from the tool results and ended by the task's notification or `TaskStop`. **0.16.0**: a lot can declare **neighbouring repositories** (`repos:` key of the lot, `{ path, cite }` for a repository shared between projects): `cadence orchestrate` refuses, locks and guards them, gives them to every session as `--add-dir`, and `raf commits`, `raf show` and the review verdict read the commits that cite the lot there too. **0.15.0**: `hook.autostart` in `cadence.yaml` (`warn` by default, `refuse` or `start`): a pre-commit hook that refuses, or starts in the same commit, a lot still todo that the commit cites; `cadence session start|close --all [--depth n]`, one section per project under a folder. **0.14.0**: `cadence lead tour`, the lead's morning table of every project in a folder, printed by a program (one line per project: lots in progress, gaps, last notes, next ready lot, repository) in place of one subagent per project; the `lead` skill calls it. **0.13.1**: `cadence-hud` takes back the segments that fit once a big one has dropped (reset times, then the per-model consumption, now short: `opus 1.2M sonnet 800k`); `CADENCE_HUD_AMBIGUOUS=1` for a terminal that draws `▰ ▱ ⚙ │ ↻` in one cell. **0.13.0**: `cadence orchestrate --status --watch` (a wave's table redrawn in the terminal, which
+**1.0.0**: the first major release, a stable contract: the commands and options, the keys of `cadence.yaml`, the plan file and the names of the skills and agents follow semantic versioning, and the README's *Stability* section lists what is guaranteed and what is not (L164). **0.28.0**: `orchestrate.precheck: local` runs the « deliverable already present? » pre-check of `cadence orchestrate` on the local model (`claude-local`, Ollama), off the Anthropic quota, Sonnet staying the default and the fallback (L146); the `qa-reviewer` agent walks only the pages a lot touched, with a **Scope** line in its report (L123); the sub-tasks a review closes are also read in a lot's neighbouring repositories (L156) and a commit's sub-task list is read with the plan's left guard (L155); an unstable test is fixed (L90). **0.27.1**: `cadence orchestrate` no longer leaves a session's child processes alive: a dev server started in its own process group, or orphaned by a shell that exits (`nohup srv &`), is killed with the session through its process tree and its `CADENCE_SESSION` mark, a tmux server, `screen`, `gpg-agent` or `dirmngr` started on demand being spared; a session that exits with code 0 while a descendant holds its output open is no longer reported as « délai dépassé » (L83); the `ux-reviewer` and `qa-reviewer` agents carry the briefs' Playwright rule outside `cadence orchestrate` (L84). **0.27.0**: a compliant review of `cadence orchestrate` settles the open sub-tasks that commits of the lot cite (`feat(L3/t2): …`, comma lists included), closed in the same plan commit as the verdict or, on a read-only plan, returned as `[sous-tâche clore]` proposals, so `raf done` no longer refuses a lot over sub-tasks whose work is done; on a foreign-format plan the ids are read as the plan reads them (L82); the test suite stays green with two full suites running in parallel (L150). **0.26.0**: `cadence orchestrate` raises the floor of a lot's budget from 200 k to 450 k tokens, enough to pay a write pass, its review, one fix pass and the short review that follows, so a lot of 0.5 or 1 day is no longer handed back at its second or third pass; a `--continue` wave draws fewer lots as a result (L128). **0.25.0**: the project line of the plans' progress in the `cadence-hud` band names the lots in progress after their count, three at most then `…` (L153, `cadence-hud` 0.4.2); the progress follows the folder the session was launched from, so a `cd` into a sub-project no longer shrinks the band, and the session context keeps the `session.start` folder (L154). **0.24.0**: `cadence orchestrate --drop <project:lot>` and `--stop-after-current` steer a live wave from another terminal, `--resume --drop` removes a lot before replaying a stopped wave (L79); the final table of a wave says « livrable jusqu'à <sha> » for a ready lot stacked under a lot handed back, with `git push origin <sha>:main && cadence deliver --sha <sha>` (L76); a version commit (version fields, `CHANGELOG.md`, the README's « What's new ») no longer asks for a new code review (L72). **0.23.0**: the progress bar of each project in the `cadence-hud` band is coloured by the share of lots done, red below 33 %, orange below 66 %, green beyond (L152, `cadence-hud` 0.4.1); `cadence deliver` under a wave lock refuses only when a lot of the wave still works in that very repository, a linked worktree included (L127). **0.22.0**: `cadence orchestrate --continue` draws the next ready lot of the plan itself, in the declared priority, until the budget, the time window or a question stops it (L147); `cadence session context` prints the context of the session, which the `cadence-hud` band publishes, and the `lead` skill chains lots without the human while it stays under 60 % (L148); the band shows the progress of each project's plan, and `cadence lead tour --json` gains `progress` (L149, `cadence-hud` 0.4.0); the final review of a lot is always played, the lot's own budget bounding the writing passes only, with 65 k tokens reserved for it (L145); the cause « tests rouges après … » names the pass whose tests were red (L151). **0.21.0**: `cadence orchestrate --status` and `cadence lead tour` print the free session slots, which the `lead` skill reads (L141); `orchestrate.effort` sets the effort level of each pass of a wave (L137); `docs.sync` makes `raf check`, `lead tour` and the review brief report a document that does not follow the code (L143); `docs.articles` opens, after a green `cadence deliver`, a lot `Article <project> à rafraîchir` in the neighbouring repository (L144). **0.20.0**: `cadence-hud` no longer misleads once the work is over: `/hud cmd` lists the background commands it counts (id, tool, origin, age, name), any other argument answers `argument inconnu` instead of hiding the band, commands with no end seen for an hour or no record go to a grey `N cmd sans fin vue`, a finished subagent takes its commands with it, two races that left a `1 cmd` counted forever are closed, and a finished wave shows grey without its budget then disappears after 30 minutes (L142); the `qa-reviewer` and `ux-reviewer` agents are read-only for real, their frontmatter listing Read, Grep, Glob, Bash and the Playwright tools (L140). **0.19.1**: `cadence-hud`'s `N cmd` counter goes back down when a Monitor expires, when the background commands a subagent started end with it, and at session start or plugin reload (L135); its `tool.call` and `prompt.submit` guard hooks carry a `.catch` on registration, which clears the `claude plugin validate` warning (L136). **0.19.0**: `cadence orchestrate` lifts a repository's lock and `pre-push` guard as soon as every lot of the wave that touches it is finished, so `cadence deliver` works there while the wave continues elsewhere (L132); a review that leaves a repository dirty hands back that lot only, suspends the lots still queued in that repository and keeps the other repositories running, its verdict reported instead of lost (L133); `cadence session close` re-run without a `session start` keeps the window since the last opening (L131); `cadence-hud` draws the lot rows of a wave in aligned columns on every surface (L134). **0.18.0**: `cadence session next` prints what it records (issue #6); `cadence session close` covers the period since the last `session start` (or the last close) and says so in its title, `--since` still wins (issue #7). **0.17.0**: `cadence-hud` shows an `N cmd` segment next to the agents, the background commands of the session (Bash run in the background and Monitor, subagents' included), tracked from the tool results and ended by the task's notification or `TaskStop`. **0.16.0**: a lot can declare **neighbouring repositories** (`repos:` key of the lot, `{ path, cite }` for a repository shared between projects): `cadence orchestrate` refuses, locks and guards them, gives them to every session as `--add-dir`, and `raf commits`, `raf show` and the review verdict read the commits that cite the lot there too. **0.15.0**: `hook.autostart` in `cadence.yaml` (`warn` by default, `refuse` or `start`): a pre-commit hook that refuses, or starts in the same commit, a lot still todo that the commit cites; `cadence session start|close --all [--depth n]`, one section per project under a folder. **0.14.0**: `cadence lead tour`, the lead's morning table of every project in a folder, printed by a program (one line per project: lots in progress, gaps, last notes, next ready lot, repository) in place of one subagent per project; the `lead` skill calls it. **0.13.1**: `cadence-hud` takes back the segments that fit once a big one has dropped (reset times, then the per-model consumption, now short: `opus 1.2M sonnet 800k`); `CADENCE_HUD_AMBIGUOUS=1` for a terminal that draws `▰ ▱ ⚙ │ ↻` in one cell. **0.13.0**: `cadence orchestrate --status --watch` (a wave's table redrawn in the terminal, which
 stops with the wave) and the lead skill that names the wave and follows its journal; lot ids with `/`
 (sub-tasks of a read-only plan) accepted by `orchestrate`; `cadence-hud`'s first line measured in
 terminal cells and kept to ASCII; `publish.yml` on the v5 actions. **0.12.0**: the `cadence-hud` plugin (a status band above the Claude Code prompt),
@@ -406,7 +406,7 @@ No gate and no command here: the QA review comes **after** a delivery, and
 page shows or what it is served (screen, API, data source, configuration of
 either) — in practice every delivery except docs-, plan- or tests-only ones: a
 backend-only lot can empty a page without touching a screen, and the agent then
-starts with the pages that call the changed endpoints. The `qa-reviewer` agent
+walks the pages that call the changed endpoints. It also walks the pages that consume the services the lot changed; when the diff changes no route and no screen, or cannot be linked to pages, it walks every page and says so. The `qa-reviewer` agent
 opens each page of the running app in a real browser and judges it from the
 user's side. A page can be empty while everything else is green — no code
 changed, a data source went down upstream, the unit tests replace the network,
@@ -925,7 +925,8 @@ older `claude` is refused at launch unless every pass is `default`). Defaults: `
 `implement` and `fix` medium, `review` high (`review-small` follows `review`), `ux` high. A project overrides any of them
 in `cadence.yaml`; the levels are `low`, `medium`, `high`, `xhigh`, `max`, and `default` sends no `--effort` (the
 level of the session, as before this key). The format-retry session (`--resume`) keeps the level of its pass, and
-`--dry-run` shows the flag in each command line.
+`--dry-run` shows the flag in each command line, except for a `precheck: local` session: `claude-local` is launched
+without `--effort` (see below), so `effort.precheck` has no effect on it and the `precheck (local)` line does not show it.
 
 ```yaml
 orchestrate:
@@ -944,6 +945,20 @@ with proofs), `partiel` or `non`: on `oui` no implementation session is opened a
 implementation brief and a warning; on `non` — or an unreadable report, which only adds a warning — the wave goes on. A
 lot that already has commits is never pre-checked (resuming it is legitimate). `orchestrate.precheck: false` turns it off.
 
+`orchestrate.precheck: local` (L146) runs the pre-check on the local model of the dev machine instead of Sonnet: the
+orchestrator launches `claude-local` with the same brief, the `precheck-reader` prompt and tools, no quota used and nothing counted in the
+lot's budget (the step shows `local` as its model). `claude-local` is **not shipped with cadence**: it is a personal wrapper (a script on the `PATH`, `qwen3-coder:30b` by default) around
+`claude` pointed at Ollama. `CADENCE_CLAUDE_LOCAL_BIN` names another binary, which must take the prompt as its **first argument**
+and add itself `-p`, `--bare`, `--strict-mcp-config` and `--model` (cadence passes none of them), then accept `--output-format`,
+`--json-schema`, `--tools`, `--session-id`, `--permission-mode`, `--add-dir` and `--disallowedTools`. A bare `claude` does not fit.
+Without such a binary every local check fails and is replayed on Sonnet: keep `true`. Sonnet stays the safety net: a local session with no result (Ollama
+down, timeout, no structured report) or an unreadable report is replayed on Sonnet with a warning, and a local `oui` — the
+only answer that hands the lot back without an implementation — is confirmed by Sonnet before it counts. A local `partiel`
+or `non` is taken as is. The default stays `true` (Sonnet): switch to `local` only after comparing verdicts and durations
+against Sonnet on a few lots, and go back to `true` the first time the local model gets a `partiel` wrong. `--dry-run`
+prints the step as `precheck (local)` with its `claude-local` arguments. Those arguments carry neither `--model` nor `--effort` nor `--agents`: `effort.precheck` applies only to the Sonnet
+session (the fallback, or the confirmation of a local `oui`).
+
 The `precheck-reader` agent does not set `omitClaudeMd` (Claude Code 2.1.271), on purpose: measured on a project with a
 297-line `CLAUDE.md` (haiku, `--agents` + `--agent`, same prompt, with and without the flag), the session context is
 identical (22 779 tokens, the project `CLAUDE.md` still answered when asked) — the flag only applies to an agent run as a
@@ -970,7 +985,7 @@ committed, a short re-review of that commit runs instead): `ready`, verdict reco
 the untreated minors returned as proposals. Same when the budget is exhausted right after a compliant
 review with minors: it concludes on that review instead of staying suspended.
 
-**Sub-tasks covered by commits (L82)**: when the review concludes compliant, the open sub-tasks of the lot that a work commit of the lot cites (`feat(L3/t2): …`; a commit that cites only the lot covers none) are closed in the same plan commit as the verdict, with the warning `sous-tâches closes : L3/t2 (sha)`, so `raf done` does not refuse the lot over finished work. A read-only plan is never written: each such sub-task is returned as a proposal `[sous-tâche clore] L3/t2 — couverte par <sha>`, for you to close with the project's tool. On a plan in a foreign format (read-only, `cadence.yaml` `plan:`), sub-task ids are read as the plan reads them: `B53/t4-ux1` covers `t4-ux1` only, not `t4`, and a list such as `feat(B53/t4-ux1,t5)` covers each of its sub-tasks. A non-compliant review closes nothing.
+**Sub-tasks covered by commits (L82)**: when the review concludes compliant, the open sub-tasks of the lot that a work commit of the lot cites (`feat(L3/t2): …`, in the project or in one of the lot's neighbouring repositories; a commit that cites only the lot covers none) are closed in the same plan commit as the verdict, with the warning `sous-tâches closes : L3/t2 (sha)`, so `raf done` does not refuse the lot over finished work. A read-only plan is never written: each such sub-task is returned as a proposal `[sous-tâche clore] L3/t2 — couverte par <sha>`, for you to close with the project's tool. On a plan in a foreign format (read-only, `cadence.yaml` `plan:`), sub-task ids are read as the plan reads them: `B53/t4-ux1` covers `t4-ux1` only, not `t4`, and a list such as `feat(B53/t4-ux1,t5)` covers each of its sub-tasks. The lot id is not read inside another id (`fix(E-A2/t3,t4, A2/t1)` covers `A2/t1` only for lot `A2`), and a list may repeat the lot id (`fix(L1/t1, L1/t2,t3)` covers `t1`, `t2` and `t3`). A non-compliant review closes nothing.
 
 **Choices, not questions**: the author brief tells the session to decide minor interpretation questions itself and to list them under `choix` in its report; the reviewer receives that list to re-read, and the final table prints each one (`choix fait : …`). A session stops with a question only on a real blocker: a decision that changes the scope or the architecture or is costly to undo, AND that the plan, its notes and CLAUDE.md do not settle; everything else is a choice.
 
@@ -1068,8 +1083,7 @@ a time (above); `Agent`, `git push`, `cadence deliver`, `raf done|review|ux` are
 temporary `pre-push` hook, installed for the duration of the wave and removed at its end (or, for a repository, as soon as all the lots that touch it are finished), refuses any push
 from a session (`CADENCE_ORCHESTRATED` is in their environment; a repository that already has another
 `pre-push` hook is refused before anything starts — `pushurl` is never touched); after every session the
-upstream ref and `git ls-remote` are compared with the "before", and a review that changed `HEAD` or the
-tree (screenshots left at the root, a commit) is an incident of that lot only: the lot is handed back to the lead, the lots of the other repositories carry on while the lots still queued behind it in the same repository are suspended (resumable, nothing started on a dirty tree), and a verdict the review had already produced is reported in the outcome and the lot's warnings (never recorded in the plan). A push or a removed guard hook still stops the wave. `raf done|ux|review` and `cadence deliver` refuse when
+upstream ref and `git ls-remote` are compared with the "before", and a read-only step that left only UNTRACKED files (screenshots written at the root by a script with a relative path) is not an incident: the files are moved to `.cadence/runs/<wave>/<project>--<lot>/stray/` (kept in their tree; for a neighbour repository, under `stray/<its relative path, `/` replaced by `_`>/`, e.g. `stray/.._gitops/`), a warning naming them goes to the lot's warnings and the wave log, the verdict is kept and the lot continues (L162; a move that is impossible, or an untracked file that vanished during the step, stays an incident); a review that changed `HEAD` or a tracked file (a commit, a modified file) is an incident of that lot only: the lot is handed back to the lead, the lots of the other repositories carry on while the lots still queued behind it in the same repository are suspended (resumable, nothing started on a dirty tree), and a verdict the review had already produced is reported in the outcome and the lot's warnings (never recorded in the plan). A push or a removed guard hook still stops the wave. `raf done|ux|review` and `cadence deliver` refuse when
 `CADENCE_ORCHESTRATED` is set.
 
 **Budget**: the wave counts input + cache writes + output tokens (default 2 M); cache reads are kept and
@@ -1137,7 +1151,7 @@ News instruction (`cadence news new <lot>`, factual user-side text, a screenshot
 orchestrate:
   test: npm test                         # run by the orchestrator after a work step (optional)
   build: npm run build                   # run after the tests; both results go to the reviewer, who does not redo them (optional)
-  precheck: true                         # default: before the first implementation of a lot with no commit, a read-only Sonnet session checks whether the deliverable is already in the repository (see below); false skips it
+  precheck: true                         # default: before the first implementation of a lot with no commit, a read-only Sonnet session checks whether the deliverable is already in the repository (see below); false skips it, local runs it on claude-local (Ollama) with Sonnet as fallback
   effort: { review: xhigh }              # effort level per pass (see « Effort level per pass »): precheck, implement, fix, review, ux
   ux: http://localhost:4200              # a URL, a launch command, or { command, url, timeout? } — for the UX review (see below)
   permissionMode: auto                   # default
@@ -1280,12 +1294,14 @@ repository with `cadence skills install` (to `.claude/skills/cadence-*` and
   runs a build whose output is used live, and never edits code. A README or usage
   documentation that does not follow the lot's change is a *major* finding.
 - **qa-reviewer** (agent): any web app (read-only like `ux-reviewer`: same tool list, no `Edit`, no `Write`); given a repository and a base URL (and
-  optionally a lot id, to start with the pages it touched — for a backend-only
-  lot, those that call the changed endpoints), it opens each page of
+  optionally a lot id, to walk only the pages it touched — those that call the
+  changed endpoints, those of the screens it changed, the pages that consume the services the lot changed,
+  and the home page; a backend-only lot stays in scope, and when the lot changes no route
+  and no screen, or the endpoints cannot be mapped to pages, every page is walked; the others are named « Not walked »), it opens each page of
   the project's expectations file in a real browser at 1440 and 390 px and
   measures: expected content present and non-empty, no error or missing-data
   message, every API call answered 2xx with a non-empty body, no console error,
-  no broken content image. Findings are defects (a line of the expectations
+  no broken content image. It reads the page as text first and takes a capture only for a gap. Findings are defects (a line of the expectations
   broken, or a universal check failing with a visible effect, with or without an
   expectations file), suspects (it looks like missing or wrong data and no
   expectation settles it) or noise (a console error or a failed request with no
@@ -1358,13 +1374,15 @@ A version exists in three places and is published in two; a release does all of
    in that commit, not before the review. A commit that touches any other file
    — or another field of a manifest, or a dependency in `package-lock.json` — is work like any other and has
    to be reviewed.
-2. `git tag v<version> && git push origin main v<version>` — the tag starts `.github/workflows/publish.yml`,
+2. Run the plugin evaluation, `npm run eval:plugin` (billed, see [Evaluating the plugin](#evaluating-the-plugin-before-a-release)),
+   on that version commit; a case below the threshold stops the release until you have read it in the report.
+3. `git tag v<version> && git push origin main v<version>` — the tag starts `.github/workflows/publish.yml`,
    which publishes to npm through Trusted Publishing (OIDC, no token stored anywhere): it checks the tag
    matches `package.json`, `.claude-plugin/plugin.json` and `.claude-plugin/marketplace.json` and that `CHANGELOG.md` has a `## [x.y.z]` section for it (no section, no publication), then `npm publish --provenance`, where `prepublishOnly` runs the type-check and the
    tests and `prepare` builds `dist/`; a red suite stops the publication; then it creates the GitHub release with that CHANGELOG section as its text. The trusted publisher is declared
    once on npmjs.com (package settings → Trusted Publisher → GitHub Actions, `Sylad/cadence`, `publish.yml`).
-3. Watch the run: `gh run watch` (or `gh run list --workflow publish.yml`).
-4. Check the effect: `npm view @sylad/cadence version` answers the new version.
+4. Watch the run: `gh run watch` (or `gh run list --workflow publish.yml`).
+5. Check the effect: `npm view @sylad/cadence version` answers the new version.
    A run is safe to re-run, and two runs for one tag queue instead of racing (`concurrency` per ref, never cancelling the one that publishes):
    a version already on npm skips `npm publish`, and a GitHub release that is missing is created (`--verify-tag`)
    while an existing one is left alone. If the package is on npm but the release is still missing, re-run the job;
@@ -1373,7 +1391,61 @@ A version exists in three places and is published in two; a release does all of
 The Claude Code plugin is read from the repository, so pushing `main` is what updates it; npm is what
 `npx @sylad/cadence` and a global install read, and only the tag publishes there. A missing tag, or a red
 publish run, leaves npm behind without any other error — 0.3.0 and 0.4.0 were never published — hence
-step 4.
+step 5.
+
+### Evaluating the plugin (before a release)
+
+`evals/` holds an evaluation suite for the plugin itself, run by `claude plugin eval` (Claude Code 2.1.263 and later). Each case is
+a folder with a `prompt.md` and `graders/*.md`, and replays a trap found by hand: `raf-done-sans-revue` (`raf done` refused on a lot whose
+commits have no code review, with no `--force` to get round it), `deliver-sha` (`git push origin <sha>:main` then
+`cadence deliver --sha <sha>` for a pushed commit that is not `HEAD`), `orchestrate-id-avec-slash` (`maritime-atlas:Q4/accueil-4-ux12@haiku`
+keeps its `/`) and `livrer-sh-sans-bloc` (a `./livrer.sh` without a `deliver:` block in `cadence.yaml` is not
+run by `cadence deliver`). Every case also runs a **baseline without the plugin**, so the report gives the score of each arm and the
+difference: a trap the baseline already avoids proves nothing about the plugin. The cases are read-only questions (tools `Read`, `Glob`, `Grep`,
+`Skill`, no scaffold script), each graded by a regular expression and by a model-judged criterion.
+
+```sh
+npm run eval:plugin              # claude plugin eval . --max-cost-usd 5 --no-publish; 4 cases × 3 runs × 2 arms = 24 runs
+claude plugin eval . --case deliver-sha --runs 1 --trust-plugin --no-publish --max-cost-usd 1    # one case, one run (the first run asks to trust the plugin)
+```
+
+**Every run is billed** (a full `claude` session on your own credential, plus the judge): the suite is run at the release, once the
+version commit is ready, never in `npm test`, in `prepublishOnly` or in CI, and `--max-cost-usd 5` aborts a runaway. A case below
+the threshold (1.0 by default, `--threshold`) makes the command exit 1: read the case in the report before deciding it is the plugin
+and not the wording of the case. `npm test` only checks that the
+files are well formed (`test/plugin-evals.test.ts`); `evals/` is not part of the npm package.
+
+## Stability
+
+From 1.0.0 cadence follows [semantic versioning](https://semver.org): what is listed under
+*Guaranteed* only changes incompatibly in a major version; a minor or a patch never breaks it.
+
+**Guaranteed**
+
+- **Commands and options** of `raf` and `cadence` (`cadence raf …` is `raf …`): `init`, `add`, `start`, `done`, `drop`,
+  `note`, `did`, `public`, `ux`, `review`, `commits`, `show`, `list`, `now`, `ignore`, `check`, `gantt`, `hook`;
+  `cadence news`, `session` (`start`, `close`, `next`, `context`), `lead tour`, `deliver`, `verify`, `orchestrate`,
+  `skills`; their options and exit codes as this README documents them. A new command or option is a minor change.
+- **The keys of `cadence.yaml`**: `plan`, `news`, `hook`, `session`, `deliver`, `orchestrate`, `docs`, `qa`, `priority`
+  and the keys each of them takes. A key is not renamed nor removed, nor does its meaning change; a new key is a minor change.
+- **The plan file** (`docs/plan/raf.yaml`): `project`, `prefix`, `since`, `ignore`, `lots` (with their
+  fields, `tasks`, `notes`, `repos`) and `acknowledged`, and the plan formats `plan:` in `cadence.yaml` can read.
+  The `version` key is kept in the file but ignored (`src/plan.ts` does not read it): it is not a schema version.
+- **The names of the skills** (`session-start`, `session-close`, `deliver`, `lead`) **and of the agents**
+  (`ux-reviewer`, `code-reviewer`, `qa-reviewer`).
+
+**Not guaranteed** (may change in any release)
+
+- The **text of the outputs**: wording, layout, order of the lines and columns of every report, table and message
+  (the `--json` outputs and the exit codes are part of the commands above). In a `--json` output a new field is a
+  minor change, so consumers must tolerate unknown fields; removing or renaming a field is a major change.
+- The **`precheck-reader`** agent: internal to `cadence orchestrate`, not meant to be called by hand.
+- The **`cadence-hud` band**: its segments, colours and layout; it is versioned on its own.
+- The **wave journals** under `.cadence/runs` and the files `cadence orchestrate` keeps there.
+- The wording of the briefs and of the instructions inside the skills and the agents.
+
+There is no schema version and no migration: a file written by an earlier release keeps working, and a key a
+release adds is optional.
 
 ## License
 

package/agents/qa-reviewer.md

@@ -15,9 +15,7 @@ that a defect. You do: a players page with no players is a defect, whatever the
 ## Inputs
 
 The absolute path of the repository and the base URL of the app — deployed, or a local server the
-caller started. Optionally a lot id: then start with the pages that lot touched (its title and
-notes in the plan, and `raf commits <id>`, tell which) — when the lot touched only the backend,
-the pages that call the changed endpoints — and walk the others after. If the path or the URL is
+caller started. Optionally a lot id: then walk only the pages that lot touched, as « Scope of a lot » below says. If the path or the URL is
 missing, or the URL does not answer, say so and stop.
 
 ## Method
@@ -46,6 +44,11 @@ missing, or the URL does not answer, say so and stop.
    and **390 px** wide. Walk within the bounded pass below. Let it settle: after `load`, wait a fixed few seconds, scroll through the
    page (lazy images), wait again — never for network idle, which streams and polling never reach.
    Then measure:
+   - read the page as text first: its rendered text and structure (`innerText`, or the
+     accessibility snapshot), the counts of the selectors named by the expectations, the responses
+     you listened to. Compare that text with the expectations, and take a capture only for a gap —
+     a `shows:` line unmet, a `never:` text found, a failed call — as evidence of that gap: a page
+     that matches its expectations gets none;
    - browser state, once before the first page, in a profile already used (a persistent context, not a fresh one — a `userDataDir` reserved for QA and kept between passes, never the user's own browser profile): compare the bundle the page loaded (its script URL) with the one `index.html` references, re-read without cache — a returning visitor still holds the old one, so a difference is stated in the report — then clear the cache and measure;
    - the expected content is present and non-empty — name the selector or the text found and its
      count (`.player-card` ×14), not "the list looks fine";
@@ -96,6 +99,32 @@ missing, or the URL does not answer, say so and stop.
    false, or an error is shown to the user), *major* (secondary content missing or wrong, a section
    silently dropped after a failed or empty API call, a broken content image), *minor* (noise). A broken line of the expectations with no visible loss on the page (the content is on screen by another path) is *minor* too.
 
+## Scope of a lot
+
+With a lot id, walk only the pages the lot touched — the cost of a pass is the pages walked, and
+a delivery rarely changes them all:
+
+- the pages that call the changed endpoints (`raf commits <id>` and the diff tell which routes
+  changed; the `api:` lines of the expectations, and the calls you see a page make, tell which
+  pages use them);
+- the pages of the screens the lot changed (its title and notes in the plan, and
+  the components in its commits, name them);
+- the home page.
+
+A backend-only lot is kept in scope: it can empty a page without touching a screen, and the pages
+that call its endpoints are exactly the ones to walk. It also touches the pages that consume the
+services the lot changed — grep for their callers, from the changed service up to the endpoint
+that uses it, and walk the pages of those endpoints. If a backend lot changes no route (a service, a
+data source or a configuration changed under routes that keep their path) and no screen, the scope
+cannot come from the routes: the fallback is mandatory: walk every page and say so in the report.
+If you cannot link the diff to any page, or a backend part of it in a lot that also changes
+screens (a shared helper, a utility, a data source), the fallback is mandatory too: walk every page
+and say so in the report. A lot that changes only screens keeps the reduced scope:
+the pages of those screens, plus the home page. If you cannot tell which pages a changed
+endpoint feeds, walk every page and say so — a scope you cannot establish reduces nothing. Pages
+outside the scope are named under « Not walked », never counted as checked. Without a lot id,
+walk every page.
+
 ## Bounded pass
 
 The pass has a time budget: the one the caller names, otherwise 15 minutes. You keep the count
@@ -117,6 +146,7 @@ from the first page.
 
 A short report:
 
+- **Scope**, one line: the lot id (or "none: every page"), the pages walked of pages in the expectations (or routes discovered), a « Not walked » list naming each page not walked and why, and the captures taken — the figures to compare from one pass to the next.
 - **Pages checked N/N**, with the base URL and the date and time of the run, and the two widths. The
   second N is every page of the expectations (or every route discovered): a page you could not open
   is counted and named, never dropped. A page counts as checked when both widths were measured; a

package/dist/audit.js

@@ -192,14 +192,15 @@ export function lotWork(plan, root, lotId) {
 /**
  * Sous-tâches encore ouvertes d'un lot que citent ses commits de travail (`feat(L3/t2)`), avec le plus récent des commits qui
  * les citent (L82) : le travail est fait, il ne reste que le plan à tenir. Un commit qui ne cite que le lot ne couvre rien.
+ * `neighbourWork` : les commits du lot dans ses dépôts voisins (`repoWork`, L62), lus après ceux du projet (L156).
  */
-export function coveredTasks(plan, root, lotId) {
+export function coveredTasks(plan, root, lotId, neighbourWork = []) {
     const lot = plan.lots().find((l) => l.id === lotId);
     if (!lot)
         return [];
     const open = new Set(lot.tasks.filter((t) => isOpen(t.status)).map((t) => t.id));
     const found = new Map();
-    for (const c of lotWork(plan, root, lotId)) {
+    for (const c of [...lotWork(plan, root, lotId), ...neighbourWork]) {
         const cited = citedRefs(c, plan.refs).filter((r) => r.lot === lotId && r.task);
         // `fix(L3/t1,t2)` : le motif des références ne lit que la première sous-tâche d'une liste à virgule.
         // Même texte que citedRefs : la portée quand elle cite des lots, sinon le message entier (le corps ne compte pas à côté d'une portée).
@@ -208,7 +209,7 @@ export function coveredTasks(plan, root, lotId) {
         const scope = scopeOf(c.subject);
         const text = scope !== null && plan.refs(scope).length > 0 ? scope : `${c.subject}\n${c.body}`;
         const element = '[\\w-]+(?:\\.[\\w-]+)*';
-        const listed = cited.length > 0 ? [...text.matchAll(new RegExp(`(?<![\\w/])${escapeRe(lotId)}/(${element}(?:\\s*,\\s*${element})*)`, 'g'))].flatMap((m) => m[1].split(/\s*,\s*/)).flatMap((e) => plan.refs(`${lotId}/${e}`).filter((r) => r.lot === lotId && r.task).map((r) => r.task)) : [];
+        const listed = cited.length > 0 ? [...text.matchAll(new RegExp(`(?<![\\w/.-])${escapeRe(lotId)}/(${element}(?:\\s*,\\s*(?:${escapeRe(lotId)}/)?${element})*)`, 'g'))].flatMap((m) => m[1].split(/\s*,\s*/)).map((e) => (e.startsWith(`${lotId}/`) ? e.slice(lotId.length + 1) : e)).flatMap((e) => plan.refs(`${lotId}/${e}`).filter((r) => r.lot === lotId && r.task).map((r) => r.task)) : [];
         for (const task of [...cited.map((r) => r.task), ...listed])
             if (open.has(task) && !found.has(task))
                 found.set(task, c.sha);

package/dist/config.js

@@ -226,7 +226,7 @@ const REVIEW_KEYS = ['threshold', 'light', 'full'];
 const ORCH_KEYS = ['start', 'verdict', 'test', 'build', 'ux', 'precheck', 'review', 'effort', 'permissionMode', 'addDirs', 'timeouts'];
 /** Clé `orchestrate:` de cadence.yaml. Absente : les défauts (auto, 45 min d'implémentation, 25 min de revue). */
 export function readOrchestrateConfig(file) {
-    const config = { precheck: true, review: { threshold: 0.25, light: 'sonnet', full: 'opus' }, effort: { precheck: 'low', implement: 'medium', fix: 'medium', review: 'high', ux: 'high' }, permissionMode: 'auto', addDirs: [], timeouts: { work: 45 * 60_000, review: 25 * 60_000 } };
+    const config = { precheck: true, precheckLocal: false, review: { threshold: 0.25, light: 'sonnet', full: 'opus' }, effort: { precheck: 'low', implement: 'medium', fix: 'medium', review: 'high', ux: 'high' }, permissionMode: 'auto', addDirs: [], timeouts: { work: 45 * 60_000, review: 25 * 60_000 } };
     if (!existsSync(file))
         return config;
     let raw;
@@ -261,9 +261,10 @@ export function readOrchestrateConfig(file) {
         config[k] = o[k].trim();
     }
     if (o.precheck != null) {
-        if (typeof o.precheck !== 'boolean')
-            throw bad('precheck : true ou false attendu');
-        config.precheck = o.precheck;
+        if (typeof o.precheck !== 'boolean' && o.precheck !== 'local')
+            throw bad('precheck : true, false ou local attendu');
+        config.precheck = o.precheck !== false;
+        config.precheckLocal = o.precheck === 'local';
     }
     if (o.review != null) {
         if (!isObject(o.review))

package/dist/orchestrate/command.js

@@ -15,7 +15,7 @@ import { loadTemplates, newsText, objective, renderBrief } from './briefs.js';
 import { candidates, parsePriority, parseUntil, readPriority, stopReason } from './continue.js';
 import { Budget, DROPPED, MAX_PASSES, countInterrupted, handBackDroppedQuestions, needsPrecheck } from './cycle.js';
 import { canInstallPrePush, installPrePush, removePrePush, snapshot } from './guard.js';
-import { buildArgs, killSessions, mcpServersFor, readAgents, realClaude } from './launch.js';
+import { buildArgs, buildLocalArgs, killSessions, mcpServersFor, readAgents, realClaude } from './launch.js';
 import { activeLock, REPO_LOCK, releaseLock, takeLock } from './lock.js';
 import { runPool } from './pool.js';
 import { schemaFor } from './schemas.js';
@@ -292,7 +292,7 @@ function dryRun(lots, io, deps, budget, id) {
         }
         const steps = [{ kind: 'implement', model: l.model }];
         if (needsPrecheck(env.config, env.loadPlan(), l.repo, l.lot, l.repos))
-            steps.unshift({ kind: 'precheck', model: 'sonnet' });
+            steps.unshift({ kind: 'precheck', model: env.config.precheckLocal ? 'local' : 'sonnet' });
         const { light, full } = env.config.review;
         if (l.small)
             steps.push({ kind: l.visible ? 'review-small' : 'review', model: l.light ? light : full });
@@ -312,8 +312,9 @@ function dryRun(lots, io, deps, budget, id) {
             const brief = renderBrief(s.kind, vars, deps.templatesDir);
             writeFileSync(file, brief);
             const playwright = !!mcpServersFor(s.kind, l.visible, '', l.small).playwright;
-            const args = buildArgs({ kind: s.kind, sessionId: '<uuid>', brief: '<brief>', model: s.model, effort: env.config.effort[s.kind === 'review-small' ? 'review' : s.kind], schema: schemaFor(s.kind), agent: s.kind === 'implement' ? undefined : s.kind === 'ux' ? 'ux-reviewer' : s.kind === 'precheck' ? 'precheck-reader' : 'code-reviewer', cwd: l.repo, wave: id, permissionMode: env.config.permissionMode, addDirs: [...env.config.addDirs, ...(playwright && s.kind === 'implement' ? [pwDir] : []), ...neighbourDirs(l)], timeoutMs: 0, mcpConfig: '<mcp>', playwright }, agents).map((a) => (a.startsWith('{') ? '<json>' : a));
-            io.out(`  ${s.kind} : claude ${args.join(' ')}`);
+            const local = s.model === 'local';
+            const args = (local ? buildLocalArgs : buildArgs)({ kind: s.kind, sessionId: '<uuid>', brief: '<brief>', model: s.model === 'local' ? 'sonnet' : s.model, local, effort: env.config.effort[s.kind === 'review-small' ? 'review' : s.kind], schema: schemaFor(s.kind), agent: s.kind === 'implement' ? undefined : s.kind === 'ux' ? 'ux-reviewer' : s.kind === 'precheck' ? 'precheck-reader' : 'code-reviewer', cwd: l.repo, wave: id, permissionMode: env.config.permissionMode, addDirs: [...env.config.addDirs, ...(playwright && s.kind === 'implement' ? [pwDir] : []), ...neighbourDirs(l)], timeoutMs: 0, mcpConfig: '<mcp>', playwright }, agents).map((a) => (a.startsWith('{') ? '<json>' : a));
+            io.out(`  ${s.kind} : ${local ? 'claude-local' : 'claude'} ${args.join(' ')}`);
             io.out(`    brief : ${file}`);
             const servers = Object.keys(mcpServersFor(s.kind, l.visible, '', l.small));
             io.out(`    mcp : ${servers.length ? `${servers.join(', ')} (captures dans le dossier de la vague : <vague>/${lotSlug(l.project, l.lot)}/playwright)` : 'aucun'}`);
@@ -1020,7 +1021,7 @@ export function realOrchestrateDeps(env) {
     // Lues ici, une fois : ni les sessions ni les commandes du projet ne reçoivent les variables de relance.
     env = withoutLaunchVars({ ...env });
     return {
-        claude: realClaude(bin, env),
+        claude: realClaude(bin, env, env.CADENCE_CLAUDE_LOCAL_BIN || 'claude-local'),
         claudeInfo: () => {
             try {
                 const version = execFileSync(bin, ['--version'], { env, encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 20_000 }).trim();

package/dist/orchestrate/cycle.js

@@ -2,7 +2,7 @@ import { execFileSync, spawn } from 'node:child_process';
 import { toolBinOf, withoutLaunchVars } from './snapshot.js';
 import { randomUUID } from 'node:crypto';
 import { dirname, join, relative } from 'node:path';
-import { writeFileSync } from 'node:fs';
+import { copyFileSync, existsSync, mkdirSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { coveredTasks, lotCommits, lotWork } from '../audit.js';
 import { readDocsConfig } from '../config.js';
 import { docSyncBrief, docSyncGaps, filesOf } from '../docsync.js';
@@ -39,8 +39,8 @@ export class Budget {
  * session (`--session-id`). Une étape déjà comptée (`tokens`) ne l'est jamais deux fois. Vrai quand quelque chose a été compté.
  */
 export function countInterrupted(claudeHome, repo, step, budget) {
-    if (!claudeHome || !step.sessionId || step.tokens)
-        return false;
+    if (!claudeHome || !step.sessionId || step.tokens || step.model === 'local')
+        return false; // le modèle local n'a rien pris au quota
     const spent = journalTokens(claudeHome, repo, step.sessionId);
     if (!spent)
         return false;
@@ -293,7 +293,9 @@ function reviewModel(c, kind) {
     return c.lot.light && c.lot.pass === 0 && (kind === 'review' || kind === 'review-small') ? light : full;
 }
 /** Une session : budget et quota vérifiés avant, état écrit avant et après, journal gardé, contrôles du dépôt après. */
-async function session(c, kind) {
+/** Rendu par `session(…, true)` quand l'étape locale n'a rien donné (Ollama éteint, délai, rapport sans structure) : l'appelant se replie sur Sonnet (L146). */
+const LOCAL_FAILED = Symbol('local-failed');
+async function session(c, kind, local = false) {
     const w = c.wave;
     const l = c.lot;
     if (dropped(c))
@@ -305,7 +307,7 @@ async function session(c, kind) {
     // Le budget du lot borne l'écriture, jamais la revue (L145) : une revue est jouée dès que le code est à relire (sauf tests rouges après une écriture, cf. REVIEW_RESERVE), la passe fix réserve son coût.
     if (write && (lotOver(l) || (kind === 'fix' && !fixAffordable(l))))
         return overBudget(c, kind === 'fix' && !lotOver(l));
-    const model = write ? l.model : kind === 'precheck' ? 'sonnet' : reviewModel(c, kind); // le contrôle préalable ne fait que lire : pas d'Opus
+    const model = write ? l.model : local ? 'local' : kind === 'precheck' ? 'sonnet' : reviewModel(c, kind); // le contrôle préalable ne fait que lire : pas d'Opus
     const effort = c.config.effort[kind === 'review-small' ? 'review' : kind];
     const before = await snapshot(l.repo);
     const neighbours = l.repos ?? [];
@@ -335,8 +337,9 @@ async function session(c, kind) {
         kind,
         sessionId,
         brief,
-        model,
+        model: local ? 'sonnet' : model,
         effort,
+        local,
         schema: schemaFor(kind),
         agent: kind === 'ux' ? 'ux-reviewer' : kind === 'precheck' ? 'precheck-reader' : write ? undefined : 'code-reviewer',
         cwd: l.repo,
@@ -359,7 +362,7 @@ async function session(c, kind) {
     step.ended = new Date().toISOString();
     const dir = w.store.lotDir(l.project, l.lot);
     const base = `${n}-${kind}`;
-    if (outcome.kind !== 'ok') {
+    if (outcome.kind !== 'ok' && !local) {
         // Une session en échec, au quota ou tuée au délai a consommé des tokens : ceux de sa sortie, sinon ceux de son journal.
         const spent = outcome.tokens ? { tokens: outcome.tokens, sessionId: outcome.sessionId } : w.claudeHome ? journalTokens(w.claudeHome, l.repo, outcome.sessionId ?? sessionId) : null;
         if (spent) {
@@ -372,6 +375,20 @@ async function session(c, kind) {
                 step.peakContext = peakContext(w.claudeHome, l.repo, spent.sessionId);
         }
     }
+    if (local && outcome.kind !== 'ok') {
+        // Hors quota Anthropic : rien au budget (ni sortie, ni journal), et jamais d'arrêt du lot — Sonnet reprend le contrôle.
+        const cause = outcome.kind === 'failed' ? outcome.cause : outcome.message;
+        writeFileSync(join(dir, `${base}.json`), outcome.kind === 'failed' ? outcome.stdout : '');
+        if (outcome.kind === 'failed')
+            writeFileSync(join(dir, `${base}.err`), outcome.stderr);
+        step.status = 'failed';
+        step.cause = cause;
+        step.report = `${base}.json`;
+        delete step.tokens;
+        l.warnings.push(`contrôle préalable : modèle local sans résultat (${cause.slice(0, 200)}), repli sur Sonnet`);
+        save(c);
+        return LOCAL_FAILED;
+    }
     if (outcome.kind === 'failed') {
         if (outcome.firstStdout !== undefined)
             writeFileSync(join(dir, `${base}.first.json`), outcome.firstStdout);
@@ -399,12 +416,13 @@ async function session(c, kind) {
     writeFileSync(join(dir, `${base}.json`), JSON.stringify({ ...res, structured: res.structured }, null, 2));
     step.report = `${base}.json`;
     step.sessionId = res.sessionId;
-    step.tokens = res.tokens;
+    step.tokens = local ? { ...res.tokens, counted: 0 } : res.tokens; // local : hors quota, hors budget
     if (res.formattingRetry) {
         step.formatRetry = true;
         w.log(`${lotKey(l.project, l.lot)} · session ${n} ${kind} : rapport sans sortie structurée, relance de mise en forme`);
     }
-    w.budget.add(res.tokens);
+    if (!local)
+        w.budget.add(res.tokens);
     w.saveWave();
     if (w.claudeHome)
         step.peakContext = peakContext(w.claudeHome, l.repo, res.sessionId);
@@ -429,20 +447,91 @@ async function session(c, kind) {
             w.saveWave();
             return stop(c, 'failed', `incident : ${w.incident}`);
         }
+        // Étape en lecture seule qui n'a laissé que des fichiers NON SUIVIS (captures d'un script en chemin relatif, L162) : déplacés dans le dossier du lot, avertissement, le verdict est gardé.
+        if (!write && b.head === a.head && b.tracked.join() === a.tracked.join() && b.untracked.join() !== a.untracked.join() && b.untracked.every((f) => a.untracked.includes(f))) {
+            const fresh = a.untracked.filter((f) => !b.untracked.includes(f)).map(unquotePath);
+            const stray = join(dir, 'stray');
+            const to = where ? join(stray, relative(l.repo, path).replace(/[\\/]/g, '_')) : stray;
+            const moved = moveStray(path, fresh, to);
+            if (moved.length) {
+                const text = `${kind} : ${moved.length} fichier(s) non suivi(s) laissé(s)${where} par une étape en lecture seule, déplacé(s) dans ${to} : ${moved.join(', ')}`;
+                c.lot.warnings.push(text);
+                w.log(`${lotKey(l.project, l.lot)} · ${text}`);
+            }
+            if (moved.length === fresh.length)
+                continue;
+            // Déplacement partiel : l'incident ne nomme que ce qui reste dans le dépôt.
+            return handBack(c, kind, res.structured, step, where, path, b, a, fresh.filter((f) => !moved.includes(f)));
+        }
         if (!write && (b.head !== a.head || b.tracked.join() !== a.tracked.join() || b.untracked.join() !== a.untracked.join())) {
-            // Incident du LOT (L133) : la revue a laissé des traces (captures, commit), ni push ni garde supprimée — les lots des autres dépôts continuent.
-            step.status = 'failed';
-            step.cause = `le dépôt${where} a changé pendant une revue`;
-            const traces = [...trackedPaths(a).filter((f) => !trackedPaths(b).includes(f)), ...a.untracked.filter((f) => !b.untracked.includes(f))];
-            (w.dirtyRepos ??= new Map()).set(path, lotKey(l.project, l.lot));
-            const what = traces.length ? ` (${traces.join(', ')})` : b.head !== a.head ? ' (commit)' : '';
-            return stop(c, 'handed-back', `incident : ${kind} de ${lotKey(l.project, l.lot)} a modifié le dépôt${where}${what}${lostVerdict(c, kind, res.structured)}`);
+            return handBack(c, kind, res.structured, step, where, path, b, a);
         }
     }
     step.status = 'ok';
     save(c);
     return { step, report: res.structured, before, after, others };
 }
+/** Incident du LOT (L133) : la revue a laissé des traces (captures, commit), ni push ni garde supprimée — les lots des autres dépôts continuent. */
+function handBack(c, kind, report, step, where, path, b, a, left) {
+    const l = c.lot;
+    const w = c.wave;
+    step.status = 'failed';
+    step.cause = `le dépôt${where} a changé pendant une revue`;
+    const traces = left ?? [...trackedPaths(a).filter((f) => !trackedPaths(b).includes(f)), ...a.untracked.filter((f) => !b.untracked.includes(f))];
+    (w.dirtyRepos ??= new Map()).set(path, lotKey(l.project, l.lot));
+    const what = traces.length ? ` (${traces.join(', ')})` : b.head !== a.head ? ' (commit)' : '';
+    return stop(c, 'handed-back', `incident : ${kind} de ${lotKey(l.project, l.lot)} a modifié le dépôt${where}${what}${lostVerdict(c, kind, report)}`);
+}
+/** Décode un chemin de `git status --porcelain` : entre guillemets, avec les échappements du C-quoting (`\303\251`, `\"`, `\\`, `\t`…). */
+function unquotePath(f) {
+    if (!/^".*"$/s.test(f))
+        return f;
+    const bytes = [];
+    const esc = { a: 7, b: 8, t: 9, n: 10, v: 11, f: 12, r: 13 };
+    const body = f.slice(1, -1);
+    for (let i = 0; i < body.length; i++) {
+        const ch = body[i];
+        if (ch !== '\\') {
+            bytes.push(...Buffer.from(ch));
+            continue;
+        }
+        const oct = /^[0-7]{3}/.exec(body.slice(i + 1));
+        if (oct) {
+            bytes.push(parseInt(oct[0], 8));
+            i += 3;
+        }
+        else {
+            const n = body[++i];
+            bytes.push(...(n in esc ? [esc[n]] : Buffer.from(n)));
+        }
+    }
+    return Buffer.from(bytes).toString('utf8');
+}
+/** Déplace des fichiers non suivis (chemins relatifs au dépôt, décodés) sous `to`, arborescence gardée ; renvoie ceux qui l'ont été (s'arrête au premier échec). */
+function moveStray(repo, files, to) {
+    const moved = [];
+    for (const rel of files) {
+        try {
+            const from = join(repo, rel);
+            let dest = join(to, rel);
+            for (let i = 1; existsSync(dest); i++)
+                dest = join(to, `${rel}.${i}`);
+            mkdirSync(dirname(dest), { recursive: true });
+            try {
+                renameSync(from, dest);
+            }
+            catch {
+                copyFileSync(from, dest); // autre volume
+                rmSync(from);
+            }
+            moved.push(rel);
+        }
+        catch {
+            break;
+        }
+    }
+    return moved;
+}
 /** Verdict d'une revue interrompue par un incident du lot : rapporté au lead plutôt que perdu (L133). Rien n'est enregistré dans le plan. */
 function lostVerdict(c, kind, report) {
     if (kind === 'precheck')
@@ -523,18 +612,44 @@ export function needsPrecheck(config, plan, repo, lot, repos = []) {
  */
 async function precheck(c) {
     const l = c.lot;
-    const done = await session(c, 'precheck');
-    if (!done)
-        return;
-    let rep;
-    try {
-        rep = checkShape(done.report, PRECHECK_SCHEMA);
+    let rep = null;
+    let localYes = false;
+    if (c.config.precheckLocal) {
+        // Modèle local (L146) : un échec, un rapport illisible ou un « oui » (qui rendrait le lot sans implémentation) rend la main à Sonnet.
+        const done = await session(c, 'precheck', true);
+        if (!done)
+            return;
+        if (done !== LOCAL_FAILED) {
+            try {
+                rep = checkShape(done.report, PRECHECK_SCHEMA);
+            }
+            catch (e) {
+                l.warnings.push(`contrôle préalable : rapport du modèle local illisible (${e.message}), repli sur Sonnet`);
+            }
+            if (rep?.dejaPresent === 'oui') {
+                localYes = true;
+                rep = null;
+            }
+        }
     }
-    catch (e) {
-        l.warnings.push(`contrôle préalable illisible, implémentation lancée : ${e.message}`);
-        l.next = 'implement';
-        save(c);
-        return;
+    if (!rep) {
+        const done = await session(c, 'precheck');
+        if (!done)
+            return;
+        try {
+            rep = checkShape(done.report, PRECHECK_SCHEMA);
+        }
+        catch (e) {
+            l.warnings.push(`contrôle préalable illisible, implémentation lancée : ${e.message}`);
+            l.next = 'implement';
+            save(c);
+            return;
+        }
+    }
+    if (localYes) {
+        l.warnings.push(rep.dejaPresent === 'oui'
+            ? 'contrôle préalable : « oui » du modèle local, confirmé par Sonnet'
+            : `contrôle préalable : le modèle local a dit « oui », Sonnet dit « ${rep.dejaPresent} » — le local s'est trompé, repasser orchestrate.precheck à true`);
     }
     const proofs = rep.preuves.length ? ` (${rep.preuves.join(' ; ')})` : '';
     // « oui » sans preuve ne se vérifie pas : il vaut « partiel », l'implémentation part avec le constat.
@@ -857,7 +972,7 @@ async function conclude(c, code, minorNote = '') {
     }
     l.constats = [];
     // Sous-tâches ouvertes que des commits du lot citent (L82) : la revue conforme vaut pour elles, sinon `raf done` refuserait le lot.
-    const covered = coveredTasks(plan, l.repo, l.lot);
+    const covered = coveredTasks(plan, l.repo, l.lot, neighbours.flatMap((r) => repoWork(plan, r, l.lot)));
     if (!plan.readonly) {
         plan.recordReview(l.lot, verdict, c.wave.today, newer, neighbours.length ? shas : undefined);
         for (const k of covered)

package/dist/orchestrate/launch.js

@@ -60,6 +60,24 @@ export function buildArgs(spec, agents) {
         args.push('--strict-mcp-config', '--mcp-config', spec.mcpConfig);
     return args;
 }
+/**
+ * Arguments de `claude-local` (L146) : le prompt vient en premier, le script ajoute lui-même `--bare`, `--model` et le
+ * serveur Ollama. Le harnais `--bare` ne charge pas `--agents` : le prompt de l'agent est joint au brief et ses outils
+ * passent par `--tools`. Pas de `--effort`, pas de MCP (aucune étape locale n'en charge).
+ */
+export function buildLocalArgs(spec, agents) {
+    const a = spec.agent ? agents[spec.agent] : undefined;
+    if (spec.agent && !a)
+        throw new RafError(`agent introuvable dans le paquet : ${spec.agent}`);
+    const args = [a ? `${a.prompt}\n\n${spec.brief}` : spec.brief, '--output-format', 'json', '--json-schema', JSON.stringify(spec.schema)];
+    if (a?.tools)
+        args.push('--tools', a.tools.join(','));
+    args.push('--session-id', spec.sessionId, '--permission-mode', spec.permissionMode);
+    for (const d of spec.addDirs)
+        args.push('--add-dir', d);
+    args.push('--disallowedTools', ...DISALLOWED);
+    return args;
+}
 /** Définitions d'agents du paquet (`agents/*.md`) au format de --agents. */
 export function readAgents(dir) {
     const out = {};
@@ -107,9 +125,11 @@ export function buildRetryArgs(spec, sessionId, agents) {
  * s'ajoutent à ceux de la session ; toujours rien après elle, c'est l'échec habituel.
  */
 export async function runSession(spec, deps) {
-    const launch = (args) => deps.claude(args, { cwd: spec.cwd, env: { CADENCE_ORCHESTRATED: spec.wave, ...(spec.nodeBin || spec.toolBin ? { PATH: [spec.toolBin, spec.nodeBin, process.env.PATH ?? ''].filter(Boolean).join(delimiter) } : {}) }, timeoutMs: spec.timeoutMs, onSpawn: deps.onSpawn });
-    const out = await launch(buildArgs(spec, deps.agents));
+    const launch = (args) => deps.claude(args, { local: spec.local, cwd: spec.cwd, env: { CADENCE_ORCHESTRATED: spec.wave, ...(spec.nodeBin || spec.toolBin ? { PATH: [spec.toolBin, spec.nodeBin, process.env.PATH ?? ''].filter(Boolean).join(delimiter) } : {}) }, timeoutMs: spec.timeoutMs, onSpawn: deps.onSpawn });
+    const out = await launch(spec.local ? buildLocalArgs(spec, deps.agents) : buildArgs(spec, deps.agents));
     const first = classify(out);
+    if (spec.local)
+        return first; // pas de relance de mise en forme : l'appelant se replie sur Sonnet
     const missing = first.kind === 'failed' && !out.timedOut && out.code === 0 ? lacksStructuredOutput(out.stdout) : null;
     if (!missing)
         return first;
@@ -175,13 +195,13 @@ export function killSessions() {
     marks.clear();
 }
 /** Vrai lanceur : `claude` (ou CADENCE_CLAUDE_BIN) dans son propre groupe de processus, tué en bloc au délai. */
-export function realClaude(bin, base = process.env) {
+export function realClaude(bin, base = process.env, localBin = 'claude-local') {
     return (args, opts) => new Promise((resolve) => {
         // Marque héritée par tous les descendants, même orphelins rattachés à init (un shell qui sort aussitôt après
         // `nohup srv &` échappe à tout relevé de l'arbre) : à la fin de la session, tout ce qui la porte est tué.
         const mark = randomUUID();
         marks.add(mark);
-        const child = spawn(bin, args, { cwd: opts.cwd, env: { ...base, ...opts.env, [SESSION_MARK_VAR]: mark }, stdio: ['ignore', 'pipe', 'pipe'], detached: true });
+        const child = spawn(opts.local ? localBin : bin, args, { cwd: opts.cwd, env: { ...base, ...opts.env, [SESSION_MARK_VAR]: mark }, stdio: ['ignore', 'pipe', 'pipe'], detached: true });
         const pid = child.pid;
         if (pid === undefined) {
             marks.delete(mark);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sylad/cadence",
-  "version": "0.27.1",
+  "version": "1.0.0",
   "description": "A small, repo-native working method: a versioned plan linked to your commits, a changelog with screenshots, session rituals and deliveries proven by their effect.",
   "license": "MIT",
   "author": "Sylvain Ladoire",
@@ -26,6 +26,7 @@
     "build": "tsc -p tsconfig.build.json",
     "test": "vitest run",
     "typecheck": "tsc --noEmit",
+    "eval:plugin": "claude plugin eval . --max-cost-usd 5 --no-publish",
     "prepare": "npm run build",
     "prepublishOnly": "npm run typecheck && npm test"
   },

package/skills/deliver/SKILL.md

@@ -57,8 +57,7 @@ Deliver one project at a time: the one the human names, or ask.
 6. After a green delivery that changes what a page shows or what it is served (screen, API, data
    source, configuration of either) — in practice every delivery except docs-, plan- or tests-only
    ones — have the `qa-reviewer` agent walk the delivered app in a real browser, whether the lot
-   is `visible` or not: give it the repository path, the base URL and the lot id. When the lot
-   touched only the backend, the agent starts with the pages that call the changed endpoints. It
+   is `visible` or not: give it the repository path, the base URL and the lot id. With a lot id, the agent walks only the pages the lot touched (the pages that call the changed endpoints, the pages of the changed screens, the pages that consume the services the lot changed, the home page; when the diff changes no route and no screen, or cannot be linked to pages, it walks every page and says so) and names the others under « Not walked »: they are not checked. It
    checks each page against `docs/qa/expectations.md` — what the user must find there — and
    reports a page left empty, an error shown, an API call that failed or came back empty: what
    the checks of `cadence.yaml` do not see. Bring its blocking findings to the human. It is not a

package/skills/lead/SKILL.md

@@ -169,8 +169,7 @@ After a green delivery that changes what a page shows or what it is served (scre
 source, configuration of either) — in practice every delivery except docs-, plan- or tests-only ones
 — have the `qa-reviewer` agent check the delivered app, as a fresh subagent: give it the absolute
 path of the project, the base URL of the delivered app and the lot id. The lot need not be
-`visible`: a backend-only lot can empty a page without changing a screen. When the lot touched only
-the backend, the agent starts with the pages that call the changed endpoints. It walks the pages in
+`visible`: a backend-only lot can empty a page without changing a screen. With a lot id, the agent walks only the pages the lot touched (the pages that call the changed endpoints, the pages of the changed screens, the pages that consume the services the lot changed, the home page; when the diff changes no route and no screen, or cannot be linked to pages, it walks every page and says so) and names the others under « Not walked »: they are not checked. It walks the pages in
 a real browser against the project's expectations (`docs/qa/expectations.md`: per page, what the
 user must find there) and returns measured findings; it reads only, and never logs in. Bring its
 blocking findings back to the human — a page whose main content is missing, or that shows an error,