@sylad/cadence 0.7.0 → 0.9.0

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
     {
       "name": "cadence",
       "description": "Session start and close rituals driven by a versioned plan (raf), and deliveries proven by their effect. Needs the cadence CLI (npm i -g @sylad/cadence).",
-      "version": "0.7.0",
+      "version": "0.9.0",
       "source": "./",
       "author": { "name": "Sylvain Ladoire" }
     }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cadence",
   "description": "A repo-native working method: session start and close rituals driven by a versioned plan (raf), deliveries proven by their effect, and three reviewer agents (UX, code, QA).",
-  "version": "0.7.0",
+  "version": "0.9.0",
   "author": { "name": "Sylvain Ladoire" },
   "homepage": "https://github.com/Sylad/cadence",
   "repository": "https://github.com/Sylad/cadence",

package/README.md

@@ -27,13 +27,19 @@ reports a page left empty or in error.
   `fix: L3/t1 …`. The link is **computed from `git log`**, never stored, so
   committing never dirties the plan. The id is read as a whole word: `XL3`,
   `L3x` and `L3.4` do not cite `L3`, while `L3.` at the end of a sentence does.
+  When the subject has a scope that cites lots (`feat(L3): …`,
+  `chore(L31,L32): …`), **the scope alone decides**: a passing mention
+  (`page équipe (L27)`), a range (`L28–L31`, `L45 à L48`) or the body does not
+  count. Without a scope citing a lot, the whole message is read as before.
 - `raf check` audits drift between the plan and the history.
 - Plan upkeep needs no lot. A commit is plan upkeep when **every file it
-  touches is a plan file**: the plan itself, its Gantt page, or a file the
+  touches is a plan file**: the plan itself, its Gantt page (only at its default place, `gantt.html` next to the plan — written elsewhere with `raf gantt -o`, declare it under `plan.files`), the `plan:` key of the config file in use (`cadence.yaml`, or
+  the `--config` file; a change to `deliver:`/`session:` is work), or a file the
   project lists under `plan.files` in `cadence.yaml` (a page it generates from
   the plan, a journal). Such a commit is never a "commit without a lot", and it
   does not count as work on the lots it cites: it is absent from `raf commits`,
-  does not start a `todo` lot and does not make a code review stale. The files
+  does not start a `todo` lot, does not make a code review stale, and
+  `cadence deliver` does not announce the lots it cites as delivered. The files
   decide, never the subject: a `chore(plan): …` commit that touches a source
   file is a commit like any other.
 - `raf gantt` writes a single self-contained HTML page (no server, no CDN).
@@ -59,7 +65,9 @@ raf gantt                         # docs/plan/gantt.html
 | Command | Effect |
 |---|---|
 | `raf init [--project name] [--prefix L] [--no-hook]` | create the plan and install the hook |
-| `raf add "title" [--estimate d] [--quickwin] [--visible] [--after L2,L4] [--parent L3]` | add a lot or a sub-task, print its id |
+| `raf add "title" [--estimate d] [--quickwin] [--visible] [--public "title"] [--after L2,L4] [--parent L3]` | add a lot or a sub-task, print its id (`--public`: the lot's title in the public's words, written as `public:` right after `title:`) |
+| `raf add "title" --every <days>` · `raf did <id> ["text"]` | recurring lot: `every` (days) and `last` (last time done) fields; the lot stays `todo`, `raf now` and `session start` list it under « Récurrent » with « dû depuis N j » / « prochain dans N j »; `raf did` resets the count (spec: `docs/superpowers/specs/2026-10-04-L11-tache-recurrente.md`) |
+| `raf public <id> "title"` · `raf public <id> --clear` | set, replace or remove the public title of a lot |
 | `raf start <id>` · `raf done <id> [--force]` · `raf drop <id> [--reason text]` | dated transitions (`done` refuses open sub-tasks unless `--force`) |
 | `raf note <id> "text"` | dated note — keep decisions next to the work |
 | `raf commits <id>` | the commits counted for a lot (the set the code review gate uses), one `<sha> <subject>` per line, oldest first |
@@ -133,6 +141,7 @@ plan:
   lots: taches                  # root key holding the list (default: lots)
   fields:                       # raf field: key in the file (a list = first one present)
     title: titre
+    public: titre_public        # the lot's title for the public; read when it is text, else ignored
     status: etat
     estimate: effort
     created: cree_le
@@ -148,7 +157,7 @@ plan:
   estimates: { S: 0.5, M: 1, L: 3 }   # their effort labels, in working days
 ```
 
-- Fields: `id`, `title`, `status`, `estimate`, `quickwin`, `visible`, `after`, `created`, `started`,
+- Fields: `id`, `title`, `status`, `estimate`, `quickwin`, `visible`, `public`, `every`, `last`, `after`, `created`, `started`,
   `finished`, `notes`, `parent`; one left out is read under its own name. A timestamp counts for
   its day; a note written as plain text is one note.
 - `parent`: an entry `B33/t1-fusion` whose parent is `B33` becomes the sub-task `t1-fusion` of `B33`.
@@ -376,6 +385,48 @@ session:
   close: ./scripts/evening.sh "$CADENCE_SINCE"
 ```
 
+```yaml
+session:
+  clean: [ "~/projects/tmp/*", "tmp/*", "test-output-*" ]   # working files to propose for removal at close
+  cleanDays: 7                                              # older than this many days (default 7)
+```
+
+`cadence session close` then lists, under "Nettoyage proposé", the entries matching these
+patterns (`*` stands for part of a name and never crosses a `/`; `~` is the home folder, a
+relative pattern starts at the repo root) that were not modified for more than `cleanDays`
+days, oldest first — a folder's age is that of the most recent entry it contains, at any depth,
+and an entry's age runs from the later of its modification time and its status-change time (ctime):
+what `tar xf`, `cp -a` or `rsync -a` just brought in with an old modification time is not old.
+
+An entry is proposed only if it could be measured entirely. Never proposed:
+
+- a git repository, a folder that contains one at any depth, and anything under a `.git` folder;
+- a git directory without a `.git` entry — a bare repository (`git init --bare`, `git clone
+  --mirror`, `backup.git/`), a `--separate-git-dir`, a worktree's admin folder —, recognised by
+  its content as git does (`HEAD` with `objects` and `refs`, or `HEAD` with `commondir`): neither
+  it, nor anything inside it, nor a folder that contains one;
+- anything `git` tracks, in any repository that has a `.git` entry above it. One limit, stated
+  plainly: a bare repository driven with an external work tree (`git --git-dir=~/.dotfiles
+  --work-tree=~`) leaves no `.git` beside the files, so its tracked files cannot be recognised and
+  can be proposed — never point a pattern at such a work tree;
+- a name starting with `.` unless the pattern itself starts that name with `.` (as in the
+  shell, `tmp/*` does not match `tmp/.env`; `tmp/.cache-*` does);
+- anything reached through a symbolic link matched by a `*` segment: unlike the shell, the walk
+  never descends into such a link (`tmp/*/*` lists nothing behind `tmp/link → ../outside`), and a
+  folder's age never looks behind a link; the link itself can be proposed, as a link — removing it
+  leaves its target alone. Only segments written in full *before* the first `*` follow a link, as
+  `cd` would (`~/shared/*` with `~/shared` a link lists the target's entries); once a `*` has been
+  crossed no link is followed any more, even on a segment written in full (`tmp/*/out/*` with
+  `tmp/run1/out → /elsewhere` lists nothing behind `out`);
+- anything that could not be read entirely: a folder that cannot be listed — nor anything
+  inside it, even named in full —, an entry that cannot be examined or vanished during the
+  walk, an entry under a `.git` that `git` could not answer for. These are listed apart,
+  under "Nettoyage : N élément(s) illisible(s), jamais proposé(s)";
+- the repository itself, or a folder that contains it.
+
+The command deletes nothing, never fails on the cleanup and does not change the exit code: the
+`session-close` skill shows the list and removes the entries only after the human agrees.
+
 The commands get `CADENCE_SINCE` (the `--since` in effect) and `CADENCE_TODAY`. They
 add facts and decide nothing: a failing command is reported and changes neither
 the exit code nor the verdict.
@@ -411,7 +462,48 @@ cadence deliver              # 0 delivered and verified · 1 a step failed · 2
   process died is removed with a warning); with `ci: github`, `gh` installed and
   logged in.
 - Every command is killed when it exceeds its budget (CI, `deployTimeout`, what is
-  left of `verifyTimeout`) and reported as "délai dépassé".
+  left of `verifyTimeout`) and reported as "délai dépassé". Killed means the
+  whole tree, followed while the command runs: every 200 ms cadence lists the
+  command's descendants and remembers each process it has seen with its start
+  time, so a process whose parent exits (re-parented to init — a background
+  child of a script, `sh`'s fork for each command) stays known. To kill, cadence
+  takes every remembered process still alive with the same start time (never a
+  recycled pid) plus all its current descendants, stops each one first
+  (`SIGSTOP`, the tree is re-read until nothing new appears), then kills them
+  (`SIGKILL`). This happens on a delay overrun, and at once when cadence
+  receives `SIGTERM`. On Ctrl-C or a hangup the tree has already received the
+  signal from the terminal: cadence gives the whole followed set, not just the
+  command, up to 2 seconds to finish (a script's `trap`, git removing its
+  `index.lock`), carries on the moment none of it is alive, and kills what is
+  left after the 2 seconds, a background child that ignores Ctrl-C included. If
+  the command was never listed (process list unreadable from the start), the
+  grace lasts as long as the command itself is alive, and what remains after
+  2 seconds is killed through the same fallback (the command itself only). The
+  same fallback applies when the process list fails while the command runs and
+  is still failing when the kill comes (the last listing is not trusted after
+  1 second): only the command is killed, its descendants survive, and cadence
+  says so once on stderr.
+  A delay overrun and `SIGTERM` give no grace: a script's own `trap` does not
+  get to finish there. The lock is held until the followed set is empty: when
+  cadence dies of the signal it dies after the tree, and its stale lock, which
+  the next delivery removes, leaves nothing of the first delivery running.
+  What can still outlive cadence and run concurrently with the next delivery:
+  a process that leaves the tree before cadence first sees it (a daemon's
+  double fork, `setsid`, `nohup … &` from a shell that exits, all within less
+  than 200 ms), a process of another user that cadence may not signal (`sudo`),
+  a background process still running when the command returns normally (it is
+  neither waited for nor killed), and everything if cadence itself is killed
+  with `SIGKILL` (`kill -9`, the OOM killer).
+  Where the process list cannot be read (no `/proc` and `ps` failing), cadence
+  can only kill the root command (`sh`): it leads no group of its own, since it
+  is deliberately kept in cadence's group, so its descendants are not killed and
+  survive it. A list that fails for more than a second is no longer
+  trusted (a followed pid may have been recycled): nothing is signalled from it.
+  cadence says so once on stderr when the list is unavailable.
+- Commands run in cadence's own process group and session, attached to the
+  terminal: `ssh`, `sudo` or `pinentry` can prompt on `/dev/tty`, and Ctrl-C or
+  closing the terminal stops the running command together with cadence (within
+  the limits above).
 - **CI** `github`: polls `gh run list --commit <sha>` every 15 s; no run after
   5 minutes is a failure (you probably pushed another commit than the one you
   deliver); every run must end `success`, `skipped` or `neutral`. `gh` errors
@@ -422,7 +514,9 @@ cadence deliver              # 0 delivered and verified · 1 a step failed · 2
   listed, so you can `raf done` those whose effect you have seen. With a
   read-only plan, only the lots that were in progress when the delivery started
   are listed: an id quoted in a message for context (a finished lot, a
-  reservation number that looks like one) is not a delivered lot.
+  reservation number that looks like one) is not a delivered lot. Plan upkeep
+  commits (see "Plan upkeep needs no lot") are skipped in that list: they cite
+  lots without delivering anything.
 
 ### A project with its own delivery script
 
@@ -455,6 +549,159 @@ intact. If the script commits and pushes during the delivery (stamping a
 changelog entry, say), the new `HEAD` is the sha recorded as delivered. Exit code
 0 of the script means delivered; `verify` checks, if any, run after it.
 
+### verify: replay the effect checks, outside a delivery
+
+A green delivery says the effect was right *then*. `cadence verify` replays the
+`deliver.verify` checks of `cadence.yaml` at any time — no CI, no deploy, no lock,
+no journal entry, nothing written.
+
+```sh
+cadence verify                # one pass, one line per check, then a one-line summary
+cadence verify --retry 60     # retry each failing check for up to 60 s (deliver's 300 s is not applied)
+cadence verify --sha 6b0d9aa  # the sha that replaces ${SHA} / ${SHORT} (default: last delivery, else HEAD)
+```
+
+```
+✓ GET https://ol.example/api/health → 200
+✗ GET https://ol.example/api/lineup → 200, contient « "starters" » — « "starters" » absent de la réponse
+verify : 1 effet rouge sur 2 vérifications
+```
+
+Exit code: **0** every check green · **1** at least one red effect · **2** nothing
+to verify or invalid configuration.
+
+Time limits differ from deliver's. `verify` runs all the checks **in parallel**,
+each try with the whole 120 s limit (a `url` request gives up after 20 s; a slow
+check is killed at its limit, "délai dépassé", and takes nothing from the others); results are printed in the order
+of `cadence.yaml`. Retries repeat every 10 s (deliver's interval) up to `--retry`
+seconds for each check on its own, so a run lasts at most `--retry` + 120 s.
+deliver, by contrast, runs its checks one after the other, retries each until
+`verifyTimeout` (300 s by default) is spent, and stops at the first check that
+never turns green. The check code is deliver's own (`url` / `status` /
+`contains` / `command`, same messages). A project with
+a delivery script (`deliver.script`) and no `verify` declares no effect checks —
+`verify` says so and exits 2 (its script's own checks stay its business); add
+`deliver.verify` to replay some.
+
+Each `command` check of `verify` (and of `session start`) runs in a process group
+of its own, detached from the terminal (no `/dev/tty`: a check must not prompt).
+At its time limit the whole group is killed, so no child survives it; Ctrl-C,
+`SIGTERM` or a closed terminal is passed on to the running checks before cadence
+exits. As the checks run together, the output of their commands may interleave;
+the result lines come after it, in order.
+
+Make `verify` count: a health endpoint stays green while the data is wrong (a
+lineup served empty for 38 h behind a green `/api/health`). Add a check on the
+content that matters, e.g. `url: …/api/lineup` with `contains: '"starters"'`.
+
+`cadence session start` runs the same checks in parallel (one try each, command
+output muted), each with a 10 s limit, so the whole step takes about 10 s at worst;
+it is not deliver's `verifyTimeout`, and there is no retry. It adds an
+**"Effets en production"** section to the morning report: a single `✓` line when
+everything is green, the red effects and the summary otherwise. It is a fact like
+the others: it never changes the exit code, and an unreachable network shows up
+as red lines ("erreur réseau") without blocking the session. No section for a
+project without `deliver.verify`.
+
+## orchestrate
+
+`cadence orchestrate` is a program above `/lead`, not a conversation: for each lot you choose, it runs
+a **fresh** `claude -p` session per step with a short brief, reads the result, writes the state in
+files and moves on. The lead session keeps only the decision (which lots), the final table and the
+questions. Nothing is resumed: a correction is a new session, never the author's reopened. The one
+exception is a **formatting retry** (below).
+
+```sh
+cadence orchestrate finance-tracker:L41 ol-companion:L22 cadence:L18@haiku
+cadence orchestrate L18                      # from inside a project
+cadence orchestrate … --budget 1.5M          # 1500000, 1.5M, 800k; default 2M
+cadence orchestrate … --dry-run              # preconditions + the plan of the wave; nothing is started
+cadence orchestrate --status [<wave>]        # the table, read back from the state (default: the last wave)
+cadence orchestrate --resume [<wave>] [--budget 1M] [--answer ol-companion:L22 "reply"]
+```
+
+You choose the lots; the order is the order given (one queue per repository, two repositories at most
+at the same time). `@haiku|@sonnet|@opus` sets the model of the implementation and corrections of that
+lot (default Sonnet; reviews are always Opus; Haiku only when you write it, for a mechanical lot). Run it
+in the background and read `--status`: it prints one line per transition and the final table.
+
+**Cycle of a lot**: preconditions (clean tracked files, lot `todo` or `doing`, dependencies met) →
+`raf start` (committed alone) → implementation → **UX review** if the lot is `visible` and the app is
+declared → **code review**, which always comes last (a UX fix changes code) → compliant (no blocking, no
+major finding) → `raf review` is recorded by the orchestrator with the sha the review read, then
+"ready to deliver". Not compliant → a correction in a new session, then a new review (the UX review of a
+visible lot is replayed too, the code having changed), **two passes at most**, then the lot goes back to
+you with the findings. A small lot (`estimate` ≤ 0.5 or `quickwin`) gets one single Opus pass for code and
+usability (code only when the lot is not `visible`). Failing tests (reported red, or red when
+`orchestrate.test` is run) go straight to a correction.
+
+**Compliant with minor findings**: the minors are not left for a follow-up lot. One **minors pass** runs
+before concluding: a new Sonnet session with its own brief (`fix-minors.md`) fixes the minors that are right
+and lists in `choix`, with the reason, the ones it rejects (it never stops to ask); it does not count among the
+two defect passes. A short code re-review follows (for a visible lot, after the UX review replayed), and
+concludes even when it finds new minors, which are returned to you as proposals (no second minors pass).
+When the pass makes no commit (every minor judged wrong) and HEAD has not moved since the compliant review,
+the lot concludes on that original review (if HEAD moved, e.g. a resume after a cut-off session that had
+committed, a short re-review of that commit runs instead): `ready`, verdict recorded with the sha that review read (`… + passe des mineurs sans commit`),
+the untreated minors returned as proposals. Same when the budget is exhausted right after a compliant
+review with minors: it concludes on that review instead of staying suspended.
+
+**Choices, not questions**: the author brief tells the session to decide minor interpretation questions itself and to list them under `choix` in its report; the reviewer receives that list to re-read, and the final table prints each one (`choix fait : …`). A session stops with a question only on a real blocker (scope, architecture, costly to undo, not settled by the plan or CLAUDE.md).
+
+**What stays with you**: choosing the lots, the questions raised (`--resume --answer`), re-verifying
+after the wave (`git log`, tests, `raf check`), `raf done`, **`raf ux`** (the orchestrator reports the UX
+verdict and screenshots, it does not record it), the push and the deliveries, one project at a time.
+
+**Guards, imposed by the code**: at most two sessions, one per repository (a lock in the repository's
+shared state, `orchestrate.lock`, which also makes `cadence deliver` refuse that repository) and one wave
+per folder; `Agent`, `git push`, `cadence deliver`, `raf done|review|ux` are denied to the sessions; a
+temporary `pre-push` hook, installed for the duration of the wave and removed at its end, refuses any push
+from a session (`CADENCE_ORCHESTRATED` is in their environment; a repository that already has another
+`pre-push` hook is refused before anything starts — `pushurl` is never touched); after every session the
+upstream ref and `git ls-remote` are compared with the "before", and a review that changed `HEAD` or the
+tree is an incident that stops the wave. `raf done|ux|review` and `cadence deliver` refuse when
+`CADENCE_ORCHESTRATED` is set.
+
+**Budget**: the wave counts input + cache writes + output tokens (default 2 M); cache reads are kept and
+shown apart. When the budget (or the usage limit) is reached no new session starts, the running ones
+finish, the wave is *suspended* (exit code 3) and `--resume --budget …` continues. A session that returns
+nothing readable, times out (45 min for work, 25 for a review) or fails is not retried; the lot is handed
+back with the cause. Exit codes: 0 every lot ready · 1 at least one lot handed back (question, failure,
+review still not compliant after two passes) · 2 refused before acting · 3 wave suspended.
+
+**Formatting retry** (the only `--resume` of a session): when a session ends successfully but in plain text,
+without the `structured_output` the schema asks for (the verdict is there, not in the required shape), the
+orchestrator resumes **that same session once** (`claude -p --resume <session-id> --json-schema <same schema>`,
+same model, permission mode and denied tools) with a short prompt that only asks for the report in the required
+format. It applies to every step that has a schema (implementation, correction, reviews). The tokens of the
+retry count in the wave budget and in the step (`formatRetry: true`); if the output is still missing after it,
+the step fails as usual — never a second retry.
+
+State is in `.cadence/runs/<wave>/` of the folder where the command is run (added to `.git/info/exclude`
+when that folder is in a repository): `wave.json`, one `<project>--<lot>.json` per lot (steps, tokens
+kept apart, session ids, commits, verdicts), the JSON output of every session and a `journal.log`. After a
+cut (Ctrl-C, WSL closed) `--resume` replays an interrupted step entirely in a new session whose brief
+lists the commits already present; finished steps are never replayed.
+
+Briefs are the templates of `templates/orchestrate/` (`implement.md` is the `lead` skill's standard
+brief; `--dry-run` writes the rendered ones). A project can declare, in `cadence.yaml`:
+
+```yaml
+orchestrate:
+  test: npm test                         # run by the orchestrator after a work step (optional)
+  ux: http://localhost:4200              # a URL, a launch command, or { url, command } — for the UX review
+  permissionMode: auto                   # default
+  addDirs: [/home/me/projects/tmp]       # extra directories the sessions may use
+  timeouts: { implement: 45, review: 25 }   # minutes
+  # a plan kept by the project's own tool is read-only for raf: the orchestrator calls these instead
+  start: python3 scripts/raf.py start {lot}
+  verdict: python3 scripts/raf.py note {lot} "revue de code : {verdict}"
+```
+
+Without `start`, a read-only plan's `todo` lot is refused (start it with the project's tool); without
+`verdict`, the review verdict stays in the wave's state and you report it. Only the plan's files
+(`plan.path`, `plan.files`) are committed from those commands; anything else dirty stops the lot.
+
 ## Claude Code skills
 
 As a plugin:
@@ -472,7 +719,12 @@ repository with `cadence skills install` (to `.claude/skills/cadence-*` and
 
 - **session-start**: reports the facts briefly, proposes three lots from the
   plan, then waits for your priority — nothing starts before your answer.
-- **session-close**: plan hygiene, clean repository, memory limited to what the
+- **session-close**: plan hygiene, clean repository, a cleanup proposal for stale
+  working files (`session.clean` patterns, older than `session.cleanDays`; never
+  anything git tracks, a git repository or a folder holding one, anything under
+  `.git`, a bare repository or separate git directory or anything inside one,
+  anything behind a symbolic link a `*` matched (only the link itself), a hidden `.xxx` name a `*` would not match, nor anything it could not
+  read entirely — it asks before deleting), memory limited to what the
   repository does not say, new skills or agents proposed but never created, three
   lines for next time.
 - A project with its own tooling keeps it: its plan is read where it is (`plan:`),
@@ -483,9 +735,10 @@ repository with `cadence skills install` (to `.claude/skills/cadence-*` and
   blind retry; after a green delivery that changes what a page shows or what it
   is served, the `qa-reviewer` agent walks the delivered app.
 - **lead**: from a folder holding several projects, one subagent per project
-  gathers the facts, you choose the priorities, each lot is delegated to a
-  subagent with a standard brief (test first, commits citing the lot, no push),
-  reviewed by the `code-reviewer` agent, re-verified by the lead, then delivered
+  gathers the facts, you choose the priorities, the lots are delegated with
+  `cadence orchestrate` (fresh short sessions with a standard brief — test first,
+  commits citing the lot, no push — reviewed by the `code-reviewer` agent, see
+  [orchestrate](#orchestrate)), re-verified by the lead, then delivered
   one project at a time; a delivery that changes what a page shows or what it is
   served is then checked in the running app by the `qa-reviewer` agent, whose
   blocking findings come back to you. Two
@@ -512,7 +765,7 @@ repository with `cadence skills install` (to `.claude/skills/cadence-*` and
   broken, or a universal check failing with a visible effect, with or without an
   expectations file), suspects (it looks like missing or wrong data and no
   expectation settles it) or noise (a console error or a failed request with no
-  visible effect, ranked minor), ranked, each with
+  visible effect, ranked minor) or already planned (an open lot covers it: returned in one line, the lot id and its title), ranked, each with
   the route, what was expected, what was measured and the evidence; pages checked
   N/N, follow-ups as `raf add` lines, what it could not verify, a one-line
   verdict. Read-only: GET only, no login, nothing submitted; it stops at a PIN.
@@ -523,14 +776,18 @@ A version exists in three places and is published in two; a release does all of
 
 1. Bump `version` in `package.json` (then `npm install` to refresh `package-lock.json`),
    `.claude-plugin/plugin.json` and `.claude-plugin/marketplace.json`, in the commit that closes the lot.
-2. `npm publish --access public` — `prepublishOnly` runs the type-check and the tests first, `prepare`
-   builds `dist/`; a red suite stops the publication.
-3. `git tag v<version> && git push origin main v<version>`.
+2. `git tag v<version> && git push origin main v<version>` — the tag starts `.github/workflows/publish.yml`,
+   which publishes to npm through Trusted Publishing (OIDC, no token stored anywhere): it checks the tag
+   matches `package.json`, `.claude-plugin/plugin.json` and `.claude-plugin/marketplace.json`, then `npm publish --provenance`, where `prepublishOnly` runs the type-check and the
+   tests and `prepare` builds `dist/`; a red suite stops the publication. The trusted publisher is declared
+   once on npmjs.com (package settings → Trusted Publisher → GitHub Actions, `Sylad/cadence`, `publish.yml`).
+3. Watch the run: `gh run watch` (or `gh run list --workflow publish.yml`).
 4. Check the effect: `npm view @sylad/cadence version` answers the new version.
 
-The Claude Code plugin is read from the repository, so step 3 is what updates it; npm is what
-`npx @sylad/cadence` and a global install read. Skipping step 2 leaves npm behind without any error —
-0.3.0 and 0.4.0 were never published.
+The Claude Code plugin is read from the repository, so pushing `main` is what updates it; npm is what
+`npx @sylad/cadence` and a global install read, and only the tag publishes there. A missing tag, or a red
+publish run, leaves npm behind without any other error — 0.3.0 and 0.4.0 were never published — hence
+step 4.
 
 ## License
 

package/agents/qa-reviewer.md

@@ -23,6 +23,9 @@ missing, or the URL does not answer, say so and stop.
 
 1. **Read how to reach the app**: the project's CLAUDE.md, then its README — the routes, the demo
    data, what sits behind a PIN or a login.
+   Read the open lots of the plan (status `todo` or `doing`) with `raf list --status todo` and
+   `raf list --status doing`, or the project's own tool when the plan is read-only, to know what is
+   already planned.
 2. **Read the expectations**: `docs/qa/expectations.md`, or the file named by `qa.expectations` in
    `cadence.yaml`. One `## <route>` section per page: what the page `shows:` (the content that
    must be present and non-empty, with a count where one exists), what must `never:` appear (error
@@ -42,6 +45,7 @@ missing, or the URL does not answer, say so and stop.
    and **390 px** wide. Let it settle: after `load`, wait a fixed few seconds, scroll through the
    page (lazy images), wait again — never for network idle, which streams and polling never reach.
    Then measure:
+   - browser state, once before the first page, in a profile already used (a persistent context, not a fresh one — a `userDataDir` reserved for QA and kept between passes, never the user's own browser profile): compare the bundle the page loaded (its script URL) with the one `index.html` references, re-read without cache — a returning visitor still holds the old one, so a difference is stated in the report — then clear the cache and measure;
    - the expected content is present and non-empty — name the selector or the text found and its
      count (`.player-card` ×14), not "the list looks fine";
    - no `never:` text on screen, and no other error or missing-data message;
@@ -56,19 +60,22 @@ missing, or the URL does not answer, say so and stop.
      items that should carry an image and have no loaded `<img>` — a fallback badge replacing a
      failed image has no `<img>` at all;
    - at 390 px, content hidden on the phone by design is not a defect unless a `shows:` line
-     requires it at 390; content pushed outside the visible area (it needs a sideways scroll) is
-     reported as suspect and handed to `ux-reviewer` in one line;
+     requires it at 390; content pushed outside the visible area (it needs a sideways scroll) is reported as suspect and handed to `ux-reviewer` in one line;
+   - the layout width is measured, not judged by eye: `document.documentElement.scrollWidth` against `clientWidth` at each width;
    - states behind controls: tabs, filters and other controls that only change the view may be used
      and are part of the page (a tab that triggers its own API call is checked like a page); a
      control that writes is never used;
+   - texts are compared without case (`never:` texts, labels, statuses): "Eliminated" and "ELIMINATED" are the same text;
+   - outbound links (another origin): each has a real `href` (not empty, not `#`) — `rel=noopener` is not required, `target=_blank` implies it since Chrome 88, Firefox 79 and Safari 12.1 — read from the attributes, never requested;
+   - simulated states: a route you intercept to fail or answer empty may be used to see how the page copes; what it shows is never a finding by itself — only what the real app serves is;
    - pacing: pause between pages; when a 429 (or any rate-limit answer) appears, re-run that page
      ALONE after a quiet minute before concluding — if it reproduces, an ordinary visitor gets it;
-     if not, it was your own pace and it is not a finding;
+     if not, it was your own pace and it is not a finding; the quiet minute is spent on `about:blank`, never on the app, whose polling would keep calling its backend;
    - the frontend source may be read to LOCATE a cause after a measurement, never as evidence.
 5. **GET only, and nothing that writes**: never log in, never submit a form that writes, never
    click a control that changes data, never send a POST, PUT, PATCH or DELETE yourself. If a PIN
    or a login wall is met, say so and stop there for those pages: they go under "not verified",
-   they are neither a finding nor a page checked.
+   they are neither a finding nor a page checked. GET only is not "without effect": a probe on an asset name that does not exist was cached for 4 hours by the CDN and then served to real visitors. Request only URLs the app itself uses, or add a cache-busting query parameter.
 6. **Classify** what you see:
    - *defect* — a line of the expectations is broken, or a universal check fails with a visible
      effect on the page: an error message shown, a failed API call whose content is missing on
@@ -81,11 +88,12 @@ missing, or the URL does not answer, say so and stop.
      contradicted by the page's own data ("eliminated" beside a won match), a stale season
      label. Say why, and propose the line of expectations that would settle it;
    - *noise* — a console error or a failed request with no visible effect: reported, ranked minor;
+   - *already planned* — a finding already planned by an open lot is returned in one line — the lot id and its title — not as a new finding and not as a follow-up;
    - *out of scope* — usability and accessibility belong to `ux-reviewer`, code quality to
      `code-reviewer`: one line at most, never a finding.
 7. **Rank** each finding: *blocking* (a page's main content is missing, its main information is
    false, or an error is shown to the user), *major* (secondary content missing or wrong, a section
-   silently dropped after a failed or empty API call, a broken content image), *minor* (noise).
+   silently dropped after a failed or empty API call, a broken content image), *minor* (noise). A broken line of the expectations with no visible loss on the page (the content is on screen by another path) is *minor* too.
 
 ## Output
 
@@ -99,6 +107,7 @@ A short report:
   quote the line of the expectations, or name the universal check, or, for a suspect, give the
   expectation line you propose —, what was measured, and the evidence — status code, response
   size, the text on screen, the capture. No finding without a measurement.
+- **Already planned**: one line per finding already planned by an open lot — the lot id and its title —, kept out of Findings and of Proposed follow-ups.
 - **Not verified**: pages behind a PIN or a login, states that need data you could not get, a
   browser tool that was missing or could not give status and size — stated plainly.
 - **Proposed follow-ups**: one `raf add "…"` line per finding worth doing; on a read-only plan
@@ -109,7 +118,7 @@ A short report:
   returned". It is the last line of the report.
 
 Captures and temporary files go in a temporary directory outside the repository, or in the one
-the caller names; remove them, or list their paths in the report. The working tree is left as you
+the caller names; remove them, or list their paths in the report — except the QA browser profile, which is kept for the next pass. The working tree is left as you
 found it.
 
 ## Do not

package/bin/cadence.js

@@ -13,7 +13,7 @@ const io = {
 
 if (tool === 'raf') {
   process.exitCode = await run(args, io);
-} else if (['news', 'session', 'deliver', 'skills'].includes(tool)) {
+} else if (['news', 'session', 'deliver', 'verify', 'skills', 'orchestrate'].includes(tool)) {
   process.exitCode = await run([tool, ...args], io);
 } else if (tool === '--version' || tool === '-v') {
   const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
@@ -31,6 +31,11 @@ if (tool === 'raf') {
   cadence deliver [--dry-run] [--sha rév] [--config cadence.yaml] [-- arguments du script du projet]
                     CI du sha poussé → déploiement → vérifications de l'effet ;
                     ou le script de livraison du projet (deliver.script), sous verrou et journal
+  cadence verify [--retry secondes] [--sha rév]
+                    rejoue les vérifications d'effet (deliver.verify) hors livraison, une passe, en parallèle ;
+                    code 0 tout vert, 1 un effet rouge, 2 rien à vérifier ; « session start » la lance aussi
+  cadence orchestrate <projet>:<lot>[@modèle]… [--budget 2M] [--dry-run]
+                    une session claude neuve par étape (implémentation, revues, corrections) ; --status, --resume
   cadence skills install [--dir .claude] [--force]
                     installe les skills Claude Code session-start, session-close, deliver et l'agent ux-reviewer`);
   process.exitCode = !tool || ['help', '--help', '-h'].includes(tool) ? 0 : 2;

package/dist/audit.js

@@ -1,12 +1,35 @@
 import { dirname, join, relative } from 'node:path';
 import { check } from './check.js';
-import { changedFiles, readCommits } from './git.js';
+import { parse } from 'yaml';
+import { changedFiles, fileAt, readCommits } from './git.js';
 import { linkCommits } from './link.js';
 import { loadEntries, newsIssues } from './news.js';
+import { isRecurring } from './recurring.js';
 import { isOpen } from './plan.js';
-/** Le plan, sa page Gantt et les fichiers tenus avec lui (cadence.yaml : plan.files). */
+/** Chemin de la configuration lue, relatif à la racine : celui de --config, sinon cadence.yaml. */
+function configRel(plan, root) {
+    return plan.configFile ? relative(root, plan.configFile) : 'cadence.yaml';
+}
+/** Le plan, sa page Gantt, la configuration lue (cadence.yaml) et les fichiers tenus avec lui (plan.files). */
 function ownFiles(plan, root) {
-    return new Set([relative(root, plan.path), relative(root, join(dirname(plan.path), 'gantt.html')), ...plan.files]);
+    return new Set([relative(root, plan.path), relative(root, join(dirname(plan.path), 'gantt.html')), configRel(plan, root), ...plan.files]);
+}
+function withoutPlanKey(text) {
+    if (text === null)
+        return '{}';
+    try {
+        const { plan: _plan, ...rest } = (parse(text) ?? {});
+        return JSON.stringify(rest, (_k, v) => (v && typeof v === 'object' && !Array.isArray(v) ? Object.fromEntries(Object.entries(v).sort(([x], [y]) => x.localeCompare(y))) : v));
+    }
+    catch {
+        return null;
+    }
+}
+/** Le commit ne change de la configuration que la clé `plan:` ? Un fichier illisible avant ou après compte comme du travail. */
+function onlyPlanKeyChanged(root, sha, file) {
+    const before = withoutPlanKey(fileAt(root, `${sha}^`, file));
+    const after = withoutPlanKey(fileAt(root, sha, file));
+    return before !== null && before === after;
 }
 /** Commits du dépôt sans les commits automatiques (motifs `ignore`) : ni audités ni comptés pour un lot. */
 export function planCommits(plan, root, opts = {}) {
@@ -14,28 +37,25 @@ export function planCommits(plan, root, opts = {}) {
     const commits = readCommits(root, opts);
     return patterns.length ? commits.filter((c) => !patterns.some((re) => re.test(c.subject))) : commits;
 }
-/** Commit d'entretien du plan : ne touche-t-il que des fichiers du plan (plan, page Gantt, plan.files) ? */
+/**
+ * Commit d'entretien du plan : TOUS ses fichiers sont des fichiers du plan (le plan, sa page Gantt,
+ * plan.files — son plan publié par exemple — et la configuration lue, mais celle-ci seulement quand la
+ * clé `plan:` est la seule à changer : deliver/session/… sont du travail). Les fichiers décident,
+ * jamais le sujet : « chore(plan): … » qui touche un fichier source est un commit comme un autre.
+ */
 export function isPlanOnly(sha, plan, root) {
     const own = ownFiles(plan, root);
+    const config = configRel(plan, root);
     const files = changedFiles(root, sha);
-    return files.length > 0 && files.every((f) => own.has(f));
+    return files.length > 0 && files.every((f) => own.has(f) && (f !== config || onlyPlanKeyChanged(root, sha, f)));
 }
 /**
- * N'ont pas besoin de citer un lot : un commit d'entretien du plan — TOUS ses fichiers sont des fichiers
- * du plan (le plan, sa page Gantt, ceux que le projet déclare sous plan.files, son plan publié par
- * exemple) — et un commit automatique dont le sujet correspond à un motif `ignore:` du plan.
- * Les fichiers décident, jamais le sujet : « chore(plan): … » qui touche un fichier source est un
- * commit comme un autre.
+ * N'ont pas besoin de citer un lot : un commit d'entretien du plan (cf. isPlanOnly) et un commit
+ * automatique dont le sujet correspond à un motif `ignore:` du plan.
  */
 export function exemptPlanOnly(linked, plan, root) {
-    const own = ownFiles(plan, root);
     const { patterns } = plan.ignore;
-    const orphans = linked.orphans.filter((c) => {
-        if (patterns.some((re) => re.test(c.subject)))
-            return false;
-        const files = changedFiles(root, c.sha);
-        return files.length === 0 || !files.every((f) => own.has(f));
-    });
+    const orphans = linked.orphans.filter((c) => !patterns.some((re) => re.test(c.subject)) && !isPlanOnly(c.sha, plan, root));
     return { ...linked, orphans };
 }
 /** Fenêtre de l'audit : --since, sinon la date d'adoption du plan, sinon 30 jours. */
@@ -73,7 +93,7 @@ function workCommits(plan, root, commits) {
     return commits.filter((c) => (!adopted || c.day >= adopted) && !isPlanOnly(c.sha, plan, root));
 }
 /** Commits liés à un lot, du plus récent au plus ancien, avant tout tri : commits de plan et d'avant l'adoption compris. */
-function lotCommits(plan, root, lotId) {
+export function lotCommits(plan, root, lotId) {
     return linkCommits(plan.lots(), planCommits(plan, root), plan.refs).byLot.get(lotId) ?? [];
 }
 /** Commits à relire d'un lot, du plus récent au plus ancien — ce que compte la porte de revue de code et que liste `raf commits`. */
@@ -136,7 +156,9 @@ export function reviewIssues(plan, root, byLot) {
     }));
 }
 /** Ce qui vient ensuite : lots en cours, puis lots prêts (dépendances closes), gains rapides d'abord. */
-export function nextUp(lots) {
+export function nextUp(all) {
+    // Les lots récurrents ont leur propre section (raf now) : ils ne sont ni « en cours » ni « à suivre ».
+    const lots = all.filter((l) => !isRecurring(l));
     const byId = new Map(lots.map((l) => [l.id, l]));
     const doing = lots.filter((l) => l.status === 'doing');
     const ready = lots

package/dist/check.js

@@ -1,5 +1,6 @@
 import { diffDays } from './dates.js';
 import { isOpen } from './plan.js';
+import { isRecurring } from './recurring.js';
 /** Un commit sur une ligne : sha abrégé et sujet. */
 export const short = (c) => `${c.sha.slice(0, 7)} ${c.subject}`;
 export function check(lots, linked, today, idleDays = 7) {
@@ -12,10 +13,12 @@ export function check(lots, linked, today, idleDays = 7) {
     }
     for (const lot of lots) {
         const commits = linked.byLot.get(lot.id) ?? [];
-        if (lot.status === 'todo' && commits.length > 0) {
+        // Un lot récurrent reste ouvert par construction : ni todo-avec-commits ni idle.
+        const recurring = isRecurring(lot);
+        if (lot.status === 'todo' && !recurring && commits.length > 0) {
             issues.push({ kind: 'todo-with-commits', message: `${lot.id} a ${commits.length} commit(s) mais est encore todo — raf start ${lot.id}` });
         }
-        if (lot.status === 'doing') {
+        if (lot.status === 'doing' && !recurring) {
             const last = commits[0]?.day ?? lot.started;
             if (last && diffDays(last, today) > idleDays) {
                 issues.push({ kind: 'idle', message: `${lot.id} en cours sans commit depuis ${diffDays(last, today)} j (${lot.title})` });