@sylad/cadence 0.8.0 → 0.10.0

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
     {
       "name": "cadence",
       "description": "Session start and close rituals driven by a versioned plan (raf), and deliveries proven by their effect. Needs the cadence CLI (npm i -g @sylad/cadence).",
-      "version": "0.8.0",
+      "version": "0.10.0",
       "source": "./",
       "author": { "name": "Sylvain Ladoire" }
     }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cadence",
   "description": "A repo-native working method: session start and close rituals driven by a versioned plan (raf), deliveries proven by their effect, and three reviewer agents (UX, code, QA).",
-  "version": "0.8.0",
+  "version": "0.10.0",
   "author": { "name": "Sylvain Ladoire" },
   "homepage": "https://github.com/Sylad/cadence",
   "repository": "https://github.com/Sylad/cadence",

package/README.md

@@ -65,7 +65,9 @@ raf gantt                         # docs/plan/gantt.html
 | Command | Effect |
 |---|---|
 | `raf init [--project name] [--prefix L] [--no-hook]` | create the plan and install the hook |
-| `raf add "title" [--estimate d] [--quickwin] [--visible] [--after L2,L4] [--parent L3]` | add a lot or a sub-task, print its id |
+| `raf add "title" [--estimate d] [--quickwin] [--visible] [--public "title"] [--after L2,L4] [--parent L3]` | add a lot or a sub-task, print its id (`--public`: the lot's title in the public's words, written as `public:` right after `title:`) |
+| `raf add "title" --every <days>` · `raf did <id> ["text"]` | recurring lot: `every` (days) and `last` (last time done) fields; the lot stays `todo`, `raf now` and `session start` list it under « Récurrent » with « dû depuis N j » / « prochain dans N j »; `raf did` resets the count (spec: `docs/superpowers/specs/2026-10-04-L11-tache-recurrente.md`) |
+| `raf public <id> "title"` · `raf public <id> --clear` | set, replace or remove the public title of a lot |
 | `raf start <id>` · `raf done <id> [--force]` · `raf drop <id> [--reason text]` | dated transitions (`done` refuses open sub-tasks unless `--force`) |
 | `raf note <id> "text"` | dated note — keep decisions next to the work |
 | `raf commits <id>` | the commits counted for a lot (the set the code review gate uses), one `<sha> <subject>` per line, oldest first |
@@ -139,6 +141,7 @@ plan:
   lots: taches                  # root key holding the list (default: lots)
   fields:                       # raf field: key in the file (a list = first one present)
     title: titre
+    public: titre_public        # the lot's title for the public; read when it is text, else ignored
     status: etat
     estimate: effort
     created: cree_le
@@ -154,7 +157,7 @@ plan:
   estimates: { S: 0.5, M: 1, L: 3 }   # their effort labels, in working days
 ```
 
-- Fields: `id`, `title`, `status`, `estimate`, `quickwin`, `visible`, `after`, `created`, `started`,
+- Fields: `id`, `title`, `status`, `estimate`, `quickwin`, `visible`, `public`, `every`, `last`, `after`, `created`, `started`,
   `finished`, `notes`, `parent`; one left out is read under its own name. A timestamp counts for
   its day; a note written as plain text is one note.
 - `parent`: an entry `B33/t1-fusion` whose parent is `B33` becomes the sub-task `t1-fusion` of `B33`.
@@ -382,6 +385,48 @@ session:
   close: ./scripts/evening.sh "$CADENCE_SINCE"
 ```
 
+```yaml
+session:
+  clean: [ "~/projects/tmp/*", "tmp/*", "test-output-*" ]   # working files to propose for removal at close
+  cleanDays: 7                                              # older than this many days (default 7)
+```
+
+`cadence session close` then lists, under "Nettoyage proposé", the entries matching these
+patterns (`*` stands for part of a name and never crosses a `/`; `~` is the home folder, a
+relative pattern starts at the repo root) that were not modified for more than `cleanDays`
+days, oldest first — a folder's age is that of the most recent entry it contains, at any depth,
+and an entry's age runs from the later of its modification time and its status-change time (ctime):
+what `tar xf`, `cp -a` or `rsync -a` just brought in with an old modification time is not old.
+
+An entry is proposed only if it could be measured entirely. Never proposed:
+
+- a git repository, a folder that contains one at any depth, and anything under a `.git` folder;
+- a git directory without a `.git` entry — a bare repository (`git init --bare`, `git clone
+  --mirror`, `backup.git/`), a `--separate-git-dir`, a worktree's admin folder —, recognised by
+  its content as git does (`HEAD` with `objects` and `refs`, or `HEAD` with `commondir`): neither
+  it, nor anything inside it, nor a folder that contains one;
+- anything `git` tracks, in any repository that has a `.git` entry above it. One limit, stated
+  plainly: a bare repository driven with an external work tree (`git --git-dir=~/.dotfiles
+  --work-tree=~`) leaves no `.git` beside the files, so its tracked files cannot be recognised and
+  can be proposed — never point a pattern at such a work tree;
+- a name starting with `.` unless the pattern itself starts that name with `.` (as in the
+  shell, `tmp/*` does not match `tmp/.env`; `tmp/.cache-*` does);
+- anything reached through a symbolic link matched by a `*` segment: unlike the shell, the walk
+  never descends into such a link (`tmp/*/*` lists nothing behind `tmp/link → ../outside`), and a
+  folder's age never looks behind a link; the link itself can be proposed, as a link — removing it
+  leaves its target alone. Only segments written in full *before* the first `*` follow a link, as
+  `cd` would (`~/shared/*` with `~/shared` a link lists the target's entries); once a `*` has been
+  crossed no link is followed any more, even on a segment written in full (`tmp/*/out/*` with
+  `tmp/run1/out → /elsewhere` lists nothing behind `out`);
+- anything that could not be read entirely: a folder that cannot be listed — nor anything
+  inside it, even named in full —, an entry that cannot be examined or vanished during the
+  walk, an entry under a `.git` that `git` could not answer for. These are listed apart,
+  under "Nettoyage : N élément(s) illisible(s), jamais proposé(s)";
+- the repository itself, or a folder that contains it.
+
+The command deletes nothing, never fails on the cleanup and does not change the exit code: the
+`session-close` skill shows the list and removes the entries only after the human agrees.
+
 The commands get `CADENCE_SINCE` (the `--since` in effect) and `CADENCE_TODAY`. They
 add facts and decide nothing: a failing command is reported and changes neither
 the exit code nor the verdict.
@@ -430,7 +475,14 @@ cadence deliver              # 0 delivered and verified · 1 a step failed · 2
   signal from the terminal: cadence gives the whole followed set, not just the
   command, up to 2 seconds to finish (a script's `trap`, git removing its
   `index.lock`), carries on the moment none of it is alive, and kills what is
-  left after the 2 seconds, a background child that ignores Ctrl-C included.
+  left after the 2 seconds, a background child that ignores Ctrl-C included. If
+  the command was never listed (process list unreadable from the start), the
+  grace lasts as long as the command itself is alive, and what remains after
+  2 seconds is killed through the same fallback (the command itself only). The
+  same fallback applies when the process list fails while the command runs and
+  is still failing when the kill comes (the last listing is not trusted after
+  1 second): only the command is killed, its descendants survive, and cadence
+  says so once on stderr.
   A delay overrun and `SIGTERM` give no grace: a script's own `trap` does not
   get to finish there. The lock is held until the followed set is empty: when
   cadence dies of the signal it dies after the tree, and its stale lock, which
@@ -442,6 +494,12 @@ cadence deliver              # 0 delivered and verified · 1 a step failed · 2
   a background process still running when the command returns normally (it is
   neither waited for nor killed), and everything if cadence itself is killed
   with `SIGKILL` (`kill -9`, the OOM killer).
+  Where the process list cannot be read (no `/proc` and `ps` failing), cadence
+  can only kill the root command (`sh`): it leads no group of its own, since it
+  is deliberately kept in cadence's group, so its descendants are not killed and
+  survive it. A list that fails for more than a second is no longer
+  trusted (a followed pid may have been recycled): nothing is signalled from it.
+  cadence says so once on stderr when the list is unavailable.
 - Commands run in cadence's own process group and session, attached to the
   terminal: `ssh`, `sudo` or `pinentry` can prompt on `/dev/tty`, and Ctrl-C or
   closing the terminal stops the running command together with cadence (within
@@ -500,7 +558,7 @@ no journal entry, nothing written.
 ```sh
 cadence verify                # one pass, one line per check, then a one-line summary
 cadence verify --retry 60     # retry each failing check for up to 60 s (deliver's 300 s is not applied)
-cadence verify --sha 6b0d9aa  # the sha that replaces ${SHA} / ${SHORT} (default: last delivery, else HEAD)
+cadence verify --sha 6b0d9aa  # the sha that replaces ${SHA} / ${SHORT} (default: see below)
 ```
 
 ```
@@ -512,6 +570,22 @@ verify : 1 effet rouge sur 2 vérifications
 Exit code: **0** every check green · **1** at least one red effect · **2** nothing
 to verify or invalid configuration.
 
+**Which sha is expected.** By default `${SHA}` / `${SHORT}` is the last recorded
+delivery (else `HEAD`). One case differs: a project with `ci: none` (the default) and
+**neither** deploy commands (`deliver.deploy`) nor a delivery script — a host that
+builds every push, like Cloudflare Pages — delivers by pushing, and every push counts,
+plan-maintenance commits included. The expected sha is then the head of the tracked
+upstream branch (`origin/<branch>`, as last fetched — `verify` does no network git),
+**provided that upstream is the remote's production branch**: read without network from
+`refs/remotes/origin/HEAD` (set by `git clone` or `git remote set-head origin <branch>`);
+when that reference does not exist locally (repository created with `git init` + push),
+`main` then `master` are taken as the production branch. A work branch pushed with `-u`
+is not published by such a host, so it keeps the default rule. A project with `ci: github`
+or a `ci.command` and no deploy also keeps the last delivery. When local `HEAD` is ahead
+of the upstream, the report says so first — `2 commit(s) non poussé(s) — l'effet vérifié
+est celui de origin/main` — so a red there reads "waiting for a push", not "broken
+effect". `session start` uses the same rule; `--sha` always wins.
+
 Time limits differ from deliver's. `verify` runs all the checks **in parallel**,
 each try with the whole 120 s limit (a `url` request gives up after 20 s; a slow
 check is killed at its limit, "délai dépassé", and takes nothing from the others); results are printed in the order
@@ -545,6 +619,114 @@ the others: it never changes the exit code, and an unreachable network shows up
 as red lines ("erreur réseau") without blocking the session. No section for a
 project without `deliver.verify`.
 
+## orchestrate
+
+`cadence orchestrate` is a program above `/lead`, not a conversation: for each lot you choose, it runs
+a **fresh** `claude -p` session per step with a short brief, reads the result, writes the state in
+files and moves on. The lead session keeps only the decision (which lots), the final table and the
+questions. Nothing is resumed: a correction is a new session, never the author's reopened. The one
+exception is a **formatting retry** (below).
+
+```sh
+cadence orchestrate finance-tracker:L41 ol-companion:L22 cadence:L18@haiku
+cadence orchestrate L18                      # from inside a project
+cadence orchestrate … --budget 1.5M          # 1500000, 1.5M, 800k; default 2M
+cadence orchestrate … --dry-run              # preconditions + the plan of the wave; nothing is started
+cadence orchestrate --status [<wave>]        # the table, read back from the state (default: the last wave)
+cadence orchestrate --resume [<wave>] [--budget 1M] [--answer ol-companion:L22 "reply"]
+```
+
+You choose the lots; the order is the order given (one queue per repository, two repositories at most
+at the same time). `@haiku|@sonnet|@opus` sets the model of the implementation and corrections of that
+lot (default Sonnet; reviews are always Opus; Haiku only when you write it, for a mechanical lot). Run it
+in the background and read `--status`: it prints one line per transition and the final table.
+
+**Cycle of a lot**: preconditions (clean tracked files, lot `todo` or `doing`, dependencies met) →
+`raf start` (committed alone) → implementation → **UX review** if the lot is `visible` and the app is
+declared → **code review**, which always comes last (a UX fix changes code) → compliant (no blocking, no
+major finding) → `raf review` is recorded by the orchestrator with the sha the review read, then
+"ready to deliver". Not compliant → a correction in a new session, then a new review (the UX review of a
+visible lot is replayed too, the code having changed), **two passes at most**, then the lot goes back to
+you with the findings. A small lot (`estimate` ≤ 0.5 or `quickwin`) gets one single Opus pass for code and
+usability (code only when the lot is not `visible`). Failing tests (reported red, or red when
+`orchestrate.test` is run) go straight to a correction.
+
+**A lot that already has commits** (a spec commit, an interrupted wave, a lot committed by hand, a lot sent back after a
+review) still starts with the implementation session: its brief tells it to read the lot, its notes and its open
+sub-tasks, which carry the findings of any earlier review. If that session ends without a new commit on a lot that
+already has commits, the wave goes on to the review (warning `implement sans nouveau commit`) instead of handing the
+lot back; with no commit on the lot at all it is handed back as `implement sans commit`. The same goes for a
+correction pass: a `fix` session that adds no commit to a lot that already has work commits goes on to a fresh review
+(warning `fix sans nouveau commit : revue lancée sur les commits du lot`), the pass still counted — the cap of two
+correction passes stays the guard against a loop; with no commit on the lot it is handed back as `fix sans commit`.
+
+**Compliant with minor findings**: the minors are not left for a follow-up lot. One **minors pass** runs
+before concluding: a new Sonnet session with its own brief (`fix-minors.md`) fixes the minors that are right
+and lists in `choix`, with the reason, the ones it rejects (it never stops to ask); it does not count among the
+two defect passes. A short code re-review follows (for a visible lot, after the UX review replayed), and
+concludes even when it finds new minors, which are returned to you as proposals (no second minors pass).
+When the pass makes no commit (every minor judged wrong) and HEAD has not moved since the compliant review,
+the lot concludes on that original review (if HEAD moved, e.g. a resume after a cut-off session that had
+committed, a short re-review of that commit runs instead): `ready`, verdict recorded with the sha that review read (`… + passe des mineurs sans commit`),
+the untreated minors returned as proposals. Same when the budget is exhausted right after a compliant
+review with minors: it concludes on that review instead of staying suspended.
+
+**Choices, not questions**: the author brief tells the session to decide minor interpretation questions itself and to list them under `choix` in its report; the reviewer receives that list to re-read, and the final table prints each one (`choix fait : …`). A session stops with a question only on a real blocker: a decision that changes the scope or the architecture or is costly to undo, AND that the plan, its notes and CLAUDE.md do not settle; everything else is a choice.
+
+**What stays with you**: choosing the lots, the questions raised (`--resume --answer`), re-verifying
+after the wave (`git log`, tests, `raf check`), `raf done`, **`raf ux`** (the orchestrator reports the UX
+verdict and screenshots, it does not record it), the push and the deliveries, one project at a time.
+
+**Guards, imposed by the code**: at most two sessions, one per repository (a lock in the repository's
+shared state, `orchestrate.lock`, which also makes `cadence deliver` refuse that repository) and one wave
+per folder; `Agent`, `git push`, `cadence deliver`, `raf done|review|ux` are denied to the sessions; a
+temporary `pre-push` hook, installed for the duration of the wave and removed at its end, refuses any push
+from a session (`CADENCE_ORCHESTRATED` is in their environment; a repository that already has another
+`pre-push` hook is refused before anything starts — `pushurl` is never touched); after every session the
+upstream ref and `git ls-remote` are compared with the "before", and a review that changed `HEAD` or the
+tree is an incident that stops the wave. `raf done|ux|review` and `cadence deliver` refuse when
+`CADENCE_ORCHESTRATED` is set.
+
+**Budget**: the wave counts input + cache writes + output tokens (default 2 M); cache reads are kept and
+shown apart. When the budget (or the usage limit) is reached no new session starts, the running ones
+finish, the wave is *suspended* (exit code 3) and `--resume --budget …` continues. A session that returns
+nothing readable, times out (45 min for work, 25 for a review) or fails is not retried; the lot is handed
+back with the cause. Exit codes: 0 every lot ready · 1 at least one lot handed back (question, failure,
+review still not compliant after two passes) · 2 refused before acting · 3 wave suspended.
+
+**Formatting retry** (the only `--resume` of a session): when a session ends successfully but in plain text,
+without the `structured_output` the schema asks for (the verdict is there, not in the required shape), the
+orchestrator resumes **that same session once** (`claude -p --resume <session-id> --json-schema <same schema>`,
+same model, permission mode and denied tools) with a short prompt that only asks for the report in the required
+format. It applies to every step that has a schema (implementation, correction, reviews). The tokens of the
+retry count in the wave budget and in the step (`formatRetry: true`); if the output is still missing after it,
+the step fails as usual — never a second retry.
+
+State is in `.cadence/runs/<wave>/` of the folder where the command is run (added to `.git/info/exclude`
+when that folder is in a repository): `wave.json`, one `<project>--<lot>.json` per lot (steps, tokens
+kept apart, session ids, commits, verdicts), the JSON output of every session and a `journal.log`. After a
+cut (Ctrl-C, WSL closed) `--resume` replays an interrupted step entirely in a new session whose brief
+lists the commits already present; finished steps are never replayed.
+
+Briefs are the templates of `templates/orchestrate/` (`implement.md` is the `lead` skill's standard
+brief; `--dry-run` writes the rendered ones). A project can declare, in `cadence.yaml`:
+
+```yaml
+orchestrate:
+  test: npm test                         # run by the orchestrator after a work step (optional)
+  ux: http://localhost:4200              # a URL, a launch command, or { url, command } — for the UX review
+  permissionMode: auto                   # default
+  addDirs: [/home/me/projects/tmp]       # extra directories the sessions may use
+  timeouts: { implement: 45, review: 25 }   # minutes
+  # a plan kept by the project's own tool is read-only for raf: the orchestrator calls these instead
+  start: python3 scripts/raf.py start {lot}
+  verdict: python3 scripts/raf.py note {lot} "revue de code : {verdict}"
+```
+
+Without `start`, a read-only plan's `todo` lot is refused (start it with the project's tool); without
+`verdict`, the review verdict stays in the wave's state and you report it. Only the plan's files
+(`plan.path`, `plan.files`) are committed from those commands; anything else dirty stops the lot.
+
 ## Claude Code skills
 
 As a plugin:
@@ -562,7 +744,12 @@ repository with `cadence skills install` (to `.claude/skills/cadence-*` and
 
 - **session-start**: reports the facts briefly, proposes three lots from the
   plan, then waits for your priority — nothing starts before your answer.
-- **session-close**: plan hygiene, clean repository, memory limited to what the
+- **session-close**: plan hygiene, clean repository, a cleanup proposal for stale
+  working files (`session.clean` patterns, older than `session.cleanDays`; never
+  anything git tracks, a git repository or a folder holding one, anything under
+  `.git`, a bare repository or separate git directory or anything inside one,
+  anything behind a symbolic link a `*` matched (only the link itself), a hidden `.xxx` name a `*` would not match, nor anything it could not
+  read entirely — it asks before deleting), memory limited to what the
   repository does not say, new skills or agents proposed but never created, three
   lines for next time.
 - A project with its own tooling keeps it: its plan is read where it is (`plan:`),
@@ -573,9 +760,10 @@ repository with `cadence skills install` (to `.claude/skills/cadence-*` and
   blind retry; after a green delivery that changes what a page shows or what it
   is served, the `qa-reviewer` agent walks the delivered app.
 - **lead**: from a folder holding several projects, one subagent per project
-  gathers the facts, you choose the priorities, each lot is delegated to a
-  subagent with a standard brief (test first, commits citing the lot, no push),
-  reviewed by the `code-reviewer` agent, re-verified by the lead, then delivered
+  gathers the facts, you choose the priorities, the lots are delegated with
+  `cadence orchestrate` (fresh short sessions with a standard brief — test first,
+  commits citing the lot, no push — reviewed by the `code-reviewer` agent, see
+  [orchestrate](#orchestrate)), re-verified by the lead, then delivered
   one project at a time; a delivery that changes what a page shows or what it is
   served is then checked in the running app by the `qa-reviewer` agent, whose
   blocking findings come back to you. Two
@@ -602,7 +790,7 @@ repository with `cadence skills install` (to `.claude/skills/cadence-*` and
   broken, or a universal check failing with a visible effect, with or without an
   expectations file), suspects (it looks like missing or wrong data and no
   expectation settles it) or noise (a console error or a failed request with no
-  visible effect, ranked minor), ranked, each with
+  visible effect, ranked minor) or already planned (an open lot covers it: returned in one line, the lot id and its title), ranked, each with
   the route, what was expected, what was measured and the evidence; pages checked
   N/N, follow-ups as `raf add` lines, what it could not verify, a one-line
   verdict. Read-only: GET only, no login, nothing submitted; it stops at a PIN.
@@ -613,14 +801,18 @@ A version exists in three places and is published in two; a release does all of
 
 1. Bump `version` in `package.json` (then `npm install` to refresh `package-lock.json`),
    `.claude-plugin/plugin.json` and `.claude-plugin/marketplace.json`, in the commit that closes the lot.
-2. `npm publish --access public` — `prepublishOnly` runs the type-check and the tests first, `prepare`
-   builds `dist/`; a red suite stops the publication.
-3. `git tag v<version> && git push origin main v<version>`.
+2. `git tag v<version> && git push origin main v<version>` — the tag starts `.github/workflows/publish.yml`,
+   which publishes to npm through Trusted Publishing (OIDC, no token stored anywhere): it checks the tag
+   matches `package.json`, `.claude-plugin/plugin.json` and `.claude-plugin/marketplace.json`, then `npm publish --provenance`, where `prepublishOnly` runs the type-check and the
+   tests and `prepare` builds `dist/`; a red suite stops the publication. The trusted publisher is declared
+   once on npmjs.com (package settings → Trusted Publisher → GitHub Actions, `Sylad/cadence`, `publish.yml`).
+3. Watch the run: `gh run watch` (or `gh run list --workflow publish.yml`).
 4. Check the effect: `npm view @sylad/cadence version` answers the new version.
 
-The Claude Code plugin is read from the repository, so step 3 is what updates it; npm is what
-`npx @sylad/cadence` and a global install read. Skipping step 2 leaves npm behind without any error —
-0.3.0 and 0.4.0 were never published.
+The Claude Code plugin is read from the repository, so pushing `main` is what updates it; npm is what
+`npx @sylad/cadence` and a global install read, and only the tag publishes there. A missing tag, or a red
+publish run, leaves npm behind without any other error — 0.3.0 and 0.4.0 were never published — hence
+step 4.
 
 ## License
 

package/agents/qa-reviewer.md

@@ -23,6 +23,9 @@ missing, or the URL does not answer, say so and stop.
 
 1. **Read how to reach the app**: the project's CLAUDE.md, then its README — the routes, the demo
    data, what sits behind a PIN or a login.
+   Read the open lots of the plan (status `todo` or `doing`) with `raf list --status todo` and
+   `raf list --status doing`, or the project's own tool when the plan is read-only, to know what is
+   already planned.
 2. **Read the expectations**: `docs/qa/expectations.md`, or the file named by `qa.expectations` in
    `cadence.yaml`. One `## <route>` section per page: what the page `shows:` (the content that
    must be present and non-empty, with a count where one exists), what must `never:` appear (error
@@ -42,6 +45,7 @@ missing, or the URL does not answer, say so and stop.
    and **390 px** wide. Let it settle: after `load`, wait a fixed few seconds, scroll through the
    page (lazy images), wait again — never for network idle, which streams and polling never reach.
    Then measure:
+   - browser state, once before the first page, in a profile already used (a persistent context, not a fresh one — a `userDataDir` reserved for QA and kept between passes, never the user's own browser profile): compare the bundle the page loaded (its script URL) with the one `index.html` references, re-read without cache — a returning visitor still holds the old one, so a difference is stated in the report — then clear the cache and measure;
    - the expected content is present and non-empty — name the selector or the text found and its
      count (`.player-card` ×14), not "the list looks fine";
    - no `never:` text on screen, and no other error or missing-data message;
@@ -56,19 +60,22 @@ missing, or the URL does not answer, say so and stop.
      items that should carry an image and have no loaded `<img>` — a fallback badge replacing a
      failed image has no `<img>` at all;
    - at 390 px, content hidden on the phone by design is not a defect unless a `shows:` line
-     requires it at 390; content pushed outside the visible area (it needs a sideways scroll) is
-     reported as suspect and handed to `ux-reviewer` in one line;
+     requires it at 390; content pushed outside the visible area (it needs a sideways scroll) is reported as suspect and handed to `ux-reviewer` in one line;
+   - the layout width is measured, not judged by eye: `document.documentElement.scrollWidth` against `clientWidth` at each width;
    - states behind controls: tabs, filters and other controls that only change the view may be used
      and are part of the page (a tab that triggers its own API call is checked like a page); a
      control that writes is never used;
+   - texts are compared without case (`never:` texts, labels, statuses): "Eliminated" and "ELIMINATED" are the same text;
+   - outbound links (another origin): each has a real `href` (not empty, not `#`) — `rel=noopener` is not required, `target=_blank` implies it since Chrome 88, Firefox 79 and Safari 12.1 — read from the attributes, never requested;
+   - simulated states: a route you intercept to fail or answer empty may be used to see how the page copes; what it shows is never a finding by itself — only what the real app serves is;
    - pacing: pause between pages; when a 429 (or any rate-limit answer) appears, re-run that page
      ALONE after a quiet minute before concluding — if it reproduces, an ordinary visitor gets it;
-     if not, it was your own pace and it is not a finding;
+     if not, it was your own pace and it is not a finding; the quiet minute is spent on `about:blank`, never on the app, whose polling would keep calling its backend;
    - the frontend source may be read to LOCATE a cause after a measurement, never as evidence.
 5. **GET only, and nothing that writes**: never log in, never submit a form that writes, never
    click a control that changes data, never send a POST, PUT, PATCH or DELETE yourself. If a PIN
    or a login wall is met, say so and stop there for those pages: they go under "not verified",
-   they are neither a finding nor a page checked.
+   they are neither a finding nor a page checked. GET only is not "without effect": a probe on an asset name that does not exist was cached for 4 hours by the CDN and then served to real visitors. Request only URLs the app itself uses, or add a cache-busting query parameter.
 6. **Classify** what you see:
    - *defect* — a line of the expectations is broken, or a universal check fails with a visible
      effect on the page: an error message shown, a failed API call whose content is missing on
@@ -81,11 +88,12 @@ missing, or the URL does not answer, say so and stop.
      contradicted by the page's own data ("eliminated" beside a won match), a stale season
      label. Say why, and propose the line of expectations that would settle it;
    - *noise* — a console error or a failed request with no visible effect: reported, ranked minor;
+   - *already planned* — a finding already planned by an open lot is returned in one line — the lot id and its title — not as a new finding and not as a follow-up;
    - *out of scope* — usability and accessibility belong to `ux-reviewer`, code quality to
      `code-reviewer`: one line at most, never a finding.
 7. **Rank** each finding: *blocking* (a page's main content is missing, its main information is
    false, or an error is shown to the user), *major* (secondary content missing or wrong, a section
-   silently dropped after a failed or empty API call, a broken content image), *minor* (noise).
+   silently dropped after a failed or empty API call, a broken content image), *minor* (noise). A broken line of the expectations with no visible loss on the page (the content is on screen by another path) is *minor* too.
 
 ## Output
 
@@ -99,6 +107,7 @@ A short report:
   quote the line of the expectations, or name the universal check, or, for a suspect, give the
   expectation line you propose —, what was measured, and the evidence — status code, response
   size, the text on screen, the capture. No finding without a measurement.
+- **Already planned**: one line per finding already planned by an open lot — the lot id and its title —, kept out of Findings and of Proposed follow-ups.
 - **Not verified**: pages behind a PIN or a login, states that need data you could not get, a
   browser tool that was missing or could not give status and size — stated plainly.
 - **Proposed follow-ups**: one `raf add "…"` line per finding worth doing; on a read-only plan
@@ -109,7 +118,7 @@ A short report:
   returned". It is the last line of the report.
 
 Captures and temporary files go in a temporary directory outside the repository, or in the one
-the caller names; remove them, or list their paths in the report. The working tree is left as you
+the caller names; remove them, or list their paths in the report — except the QA browser profile, which is kept for the next pass. The working tree is left as you
 found it.
 
 ## Do not

package/bin/cadence.js

@@ -13,7 +13,7 @@ const io = {
 
 if (tool === 'raf') {
   process.exitCode = await run(args, io);
-} else if (['news', 'session', 'deliver', 'verify', 'skills'].includes(tool)) {
+} else if (['news', 'session', 'deliver', 'verify', 'skills', 'orchestrate'].includes(tool)) {
   process.exitCode = await run([tool, ...args], io);
 } else if (tool === '--version' || tool === '-v') {
   const pkg = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));
@@ -34,6 +34,8 @@ if (tool === 'raf') {
   cadence verify [--retry secondes] [--sha rév]
                     rejoue les vérifications d'effet (deliver.verify) hors livraison, une passe, en parallèle ;
                     code 0 tout vert, 1 un effet rouge, 2 rien à vérifier ; « session start » la lance aussi
+  cadence orchestrate <projet>:<lot>[@modèle]… [--budget 2M] [--dry-run]
+                    une session claude neuve par étape (implémentation, revues, corrections) ; --status, --resume
   cadence skills install [--dir .claude] [--force]
                     installe les skills Claude Code session-start, session-close, deliver et l'agent ux-reviewer`);
   process.exitCode = !tool || ['help', '--help', '-h'].includes(tool) ? 0 : 2;

package/dist/audit.js

@@ -4,6 +4,7 @@ import { parse } from 'yaml';
 import { changedFiles, fileAt, readCommits } from './git.js';
 import { linkCommits } from './link.js';
 import { loadEntries, newsIssues } from './news.js';
+import { isRecurring } from './recurring.js';
 import { isOpen } from './plan.js';
 /** Chemin de la configuration lue, relatif à la racine : celui de --config, sinon cadence.yaml. */
 function configRel(plan, root) {
@@ -92,7 +93,7 @@ function workCommits(plan, root, commits) {
     return commits.filter((c) => (!adopted || c.day >= adopted) && !isPlanOnly(c.sha, plan, root));
 }
 /** Commits liés à un lot, du plus récent au plus ancien, avant tout tri : commits de plan et d'avant l'adoption compris. */
-function lotCommits(plan, root, lotId) {
+export function lotCommits(plan, root, lotId) {
     return linkCommits(plan.lots(), planCommits(plan, root), plan.refs).byLot.get(lotId) ?? [];
 }
 /** Commits à relire d'un lot, du plus récent au plus ancien — ce que compte la porte de revue de code et que liste `raf commits`. */
@@ -155,7 +156,9 @@ export function reviewIssues(plan, root, byLot) {
     }));
 }
 /** Ce qui vient ensuite : lots en cours, puis lots prêts (dépendances closes), gains rapides d'abord. */
-export function nextUp(lots) {
+export function nextUp(all) {
+    // Les lots récurrents ont leur propre section (raf now) : ils ne sont ni « en cours » ni « à suivre ».
+    const lots = all.filter((l) => !isRecurring(l));
     const byId = new Map(lots.map((l) => [l.id, l]));
     const doing = lots.filter((l) => l.status === 'doing');
     const ready = lots

package/dist/check.js

@@ -1,5 +1,6 @@
 import { diffDays } from './dates.js';
 import { isOpen } from './plan.js';
+import { isRecurring } from './recurring.js';
 /** Un commit sur une ligne : sha abrégé et sujet. */
 export const short = (c) => `${c.sha.slice(0, 7)} ${c.subject}`;
 export function check(lots, linked, today, idleDays = 7) {
@@ -12,10 +13,12 @@ export function check(lots, linked, today, idleDays = 7) {
     }
     for (const lot of lots) {
         const commits = linked.byLot.get(lot.id) ?? [];
-        if (lot.status === 'todo' && commits.length > 0) {
+        // Un lot récurrent reste ouvert par construction : ni todo-avec-commits ni idle.
+        const recurring = isRecurring(lot);
+        if (lot.status === 'todo' && !recurring && commits.length > 0) {
             issues.push({ kind: 'todo-with-commits', message: `${lot.id} a ${commits.length} commit(s) mais est encore todo — raf start ${lot.id}` });
         }
-        if (lot.status === 'doing') {
+        if (lot.status === 'doing' && !recurring) {
             const last = commits[0]?.day ?? lot.started;
             if (last && diffDays(last, today) > idleDays) {
                 issues.push({ kind: 'idle', message: `${lot.id} en cours sans commit depuis ${diffDays(last, today)} j (${lot.title})` });