@sylad/cadence 0.9.0 → 0.10.0

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
     {
       "name": "cadence",
       "description": "Session start and close rituals driven by a versioned plan (raf), and deliveries proven by their effect. Needs the cadence CLI (npm i -g @sylad/cadence).",
-      "version": "0.9.0",
+      "version": "0.10.0",
       "source": "./",
       "author": { "name": "Sylvain Ladoire" }
     }

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cadence",
   "description": "A repo-native working method: session start and close rituals driven by a versioned plan (raf), deliveries proven by their effect, and three reviewer agents (UX, code, QA).",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "author": { "name": "Sylvain Ladoire" },
   "homepage": "https://github.com/Sylad/cadence",
   "repository": "https://github.com/Sylad/cadence",

package/README.md

@@ -558,7 +558,7 @@ no journal entry, nothing written.
 ```sh
 cadence verify                # one pass, one line per check, then a one-line summary
 cadence verify --retry 60     # retry each failing check for up to 60 s (deliver's 300 s is not applied)
-cadence verify --sha 6b0d9aa  # the sha that replaces ${SHA} / ${SHORT} (default: last delivery, else HEAD)
+cadence verify --sha 6b0d9aa  # the sha that replaces ${SHA} / ${SHORT} (default: see below)
 ```
 
 ```
@@ -570,6 +570,22 @@ verify : 1 effet rouge sur 2 vérifications
 Exit code: **0** every check green · **1** at least one red effect · **2** nothing
 to verify or invalid configuration.
 
+**Which sha is expected.** By default `${SHA}` / `${SHORT}` is the last recorded
+delivery (else `HEAD`). One case differs: a project with `ci: none` (the default) and
+**neither** deploy commands (`deliver.deploy`) nor a delivery script — a host that
+builds every push, like Cloudflare Pages — delivers by pushing, and every push counts,
+plan-maintenance commits included. The expected sha is then the head of the tracked
+upstream branch (`origin/<branch>`, as last fetched — `verify` does no network git),
+**provided that upstream is the remote's production branch**: read without network from
+`refs/remotes/origin/HEAD` (set by `git clone` or `git remote set-head origin <branch>`);
+when that reference does not exist locally (repository created with `git init` + push),
+`main` then `master` are taken as the production branch. A work branch pushed with `-u`
+is not published by such a host, so it keeps the default rule. A project with `ci: github`
+or a `ci.command` and no deploy also keeps the last delivery. When local `HEAD` is ahead
+of the upstream, the report says so first — `2 commit(s) non poussé(s) — l'effet vérifié
+est celui de origin/main` — so a red there reads "waiting for a push", not "broken
+effect". `session start` uses the same rule; `--sha` always wins.
+
 Time limits differ from deliver's. `verify` runs all the checks **in parallel**,
 each try with the whole 120 s limit (a `url` request gives up after 20 s; a slow
 check is killed at its limit, "délai dépassé", and takes nothing from the others); results are printed in the order
@@ -635,6 +651,15 @@ you with the findings. A small lot (`estimate` ≤ 0.5 or `quickwin`) gets one s
 usability (code only when the lot is not `visible`). Failing tests (reported red, or red when
 `orchestrate.test` is run) go straight to a correction.
 
+**A lot that already has commits** (a spec commit, an interrupted wave, a lot committed by hand, a lot sent back after a
+review) still starts with the implementation session: its brief tells it to read the lot, its notes and its open
+sub-tasks, which carry the findings of any earlier review. If that session ends without a new commit on a lot that
+already has commits, the wave goes on to the review (warning `implement sans nouveau commit`) instead of handing the
+lot back; with no commit on the lot at all it is handed back as `implement sans commit`. The same goes for a
+correction pass: a `fix` session that adds no commit to a lot that already has work commits goes on to a fresh review
+(warning `fix sans nouveau commit : revue lancée sur les commits du lot`), the pass still counted — the cap of two
+correction passes stays the guard against a loop; with no commit on the lot it is handed back as `fix sans commit`.
+
 **Compliant with minor findings**: the minors are not left for a follow-up lot. One **minors pass** runs
 before concluding: a new Sonnet session with its own brief (`fix-minors.md`) fixes the minors that are right
 and lists in `choix`, with the reason, the ones it rejects (it never stops to ask); it does not count among the
@@ -646,7 +671,7 @@ committed, a short re-review of that commit runs instead): `ready`, verdict reco
 the untreated minors returned as proposals. Same when the budget is exhausted right after a compliant
 review with minors: it concludes on that review instead of staying suspended.
 
-**Choices, not questions**: the author brief tells the session to decide minor interpretation questions itself and to list them under `choix` in its report; the reviewer receives that list to re-read, and the final table prints each one (`choix fait : …`). A session stops with a question only on a real blocker (scope, architecture, costly to undo, not settled by the plan or CLAUDE.md).
+**Choices, not questions**: the author brief tells the session to decide minor interpretation questions itself and to list them under `choix` in its report; the reviewer receives that list to re-read, and the final table prints each one (`choix fait : …`). A session stops with a question only on a real blocker: a decision that changes the scope or the architecture or is costly to undo, AND that the plan, its notes and CLAUDE.md do not settle; everything else is a choice.
 
 **What stays with you**: choosing the lots, the questions raised (`--resume --answer`), re-verifying
 after the wave (`git log`, tests, `raf check`), `raf done`, **`raf ux`** (the orchestrator reports the UX

package/dist/cli.js

@@ -6,9 +6,9 @@ import { audit, exemptPlanOnly, isPlanOnly, lotWork, nextUp, planCommits, unrevi
 import { short } from './check.js';
 import { isDay, toDay } from './dates.js';
 import { deliver, parseDeliverConfig, realDeps } from './deliver.js';
-import { effectLines, realCheckDeps, verifyCommand } from './verify.js';
+import { defaultTarget, effectLines, realCheckDeps, verifyCommand } from './verify.js';
 import { ganttData, renderGantt } from './gantt.js';
-import { gitRoot, headSha, readCommits, resolveCommit } from './git.js';
+import { gitRoot, readCommits, resolveCommit } from './git.js';
 import { installHook } from './hook.js';
 import { citedRefs, linkCommits } from './link.js';
 import { buildNews, loadEntries, newEntry, newsData, newsIssues, stampEntries } from './news.js';
@@ -19,7 +19,7 @@ import { AGENTS_DIR, installAgents, installSkills, SKILLS_DIR } from './skills.j
 import { orchestrate, realOrchestrateDeps } from './orchestrate/command.js';
 import { activeLock, REPO_LOCK } from './orchestrate/lock.js';
 import { sessionClose, sessionStart } from './session.js';
-import { clearNext, lastDelivery, readNext, sharedStateDir, stateDir, writeNext } from './state.js';
+import { clearNext, readNext, sharedStateDir, stateDir, writeNext } from './state.js';
 const HELP = `raf — plan « reste à faire » versionné dans le dépôt, relié aux commits
 
   raf init [--project nom] [--prefix L] [--no-hook]
@@ -310,10 +310,10 @@ function dispatch(argv, io) {
             if (!Number.isFinite(retry) || retry < 0)
                 throw new RafError(`--retry invalide : ${values.retry} (secondes, 0 ou plus)`);
             const config = parseDeliverConfig(readFileSync(configPath, 'utf8'), configPath);
-            const sha = values.sha ? (resolveCommit(root, values.sha) ?? '') : (lastDelivery(sharedStateDir(root)) ?? headSha(root) ?? '');
-            if (values.sha && !sha)
+            const target = values.sha ? { sha: resolveCommit(root, values.sha) ?? '', note: null } : defaultTarget(root, config);
+            if (values.sha && !target.sha)
                 throw new RafError(`--sha ${values.sha} : commit introuvable`);
-            return verifyCommand({ config, sha, retry, out: io.out }, realCheckDeps(root));
+            return verifyCommand({ config, sha: target.sha, note: target.note, retry, out: io.out }, realCheckDeps(root));
         }
         case 'skills': {
             if (rest[0] !== 'install')
@@ -516,8 +516,8 @@ function morningEffects(configPath, root) {
         const config = parseDeliverConfig(text, configPath);
         if (config.verify.length === 0)
             return null;
-        const sha = lastDelivery(sharedStateDir(root)) ?? headSha(root) ?? '';
-        return effectLines(config, sha, realCheckDeps(root, { quiet: true }));
+        const target = defaultTarget(root, config);
+        return effectLines(config, target.sha, realCheckDeps(root, { quiet: true }), target.note);
     }
     catch (e) {
         return [`✗ ${e.message}`];

package/dist/git.js

@@ -88,6 +88,35 @@ export function repoStatus(cwd) {
         ahead,
     };
 }
+/** Branche amont suivie (« origin/main ») et son sha tel que connu localement (sans réseau), null sans amont. */
+export function upstreamHead(cwd) {
+    const ref = tryGit(cwd, ['rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{u}']);
+    const sha = ref ? tryGit(cwd, ['rev-parse', '--verify', '-q', '@{u}']) : null;
+    return ref && sha ? { ref, sha } : null;
+}
+/**
+ * L'amont suivi est-il la branche de production du dépôt distant ? Lu sans réseau : `refs/remotes/<remote>/HEAD`
+ * (origin/HEAD, posé par clone ou `git remote set-head`). Absent (dépôt créé par init + push) : repli sur les
+ * noms usuels, main puis master.
+ */
+export function upstreamIsDefaultBranch(cwd, upstreamRef) {
+    // Le remote vient de la config de la branche, pas d'une coupe de `@{u}` au premier « / » : un remote peut contenir un
+    // « / » (gh/origin) et un amont local (branche locale suivie) a pour remote « . » — jamais la branche de production.
+    const branch = tryGit(cwd, ['symbolic-ref', '-q', '--short', 'HEAD']);
+    if (!branch)
+        return false;
+    const remote = tryGit(cwd, ['config', '--get', `branch.${branch}.remote`]);
+    const merge = tryGit(cwd, ['config', '--get', `branch.${branch}.merge`]);
+    if (!remote || remote === '.' || !merge)
+        return false;
+    const upstreamBranch = merge.replace(/^refs\/heads\//, '');
+    if (upstreamRef !== `${remote}/${upstreamBranch}`)
+        return false;
+    const head = tryGit(cwd, ['symbolic-ref', '-q', '--short', `refs/remotes/${remote}/HEAD`]);
+    if (head)
+        return head === upstreamRef;
+    return upstreamBranch === 'main' || upstreamBranch === 'master';
+}
 /** Le commit est-il contenu dans une branche distante connue localement ? */
 export function onRemote(cwd, sha) {
     return (tryGit(cwd, ['branch', '-r', '--contains', sha]) ?? '').length > 0;

package/dist/orchestrate/cycle.js

@@ -454,8 +454,9 @@ async function work(c, kind) {
             stop(c, 'handed-back', 'passe des mineurs sans commit, mais aucune revue conforme gardée');
         return;
     }
-    // Après une réponse du lead, la session peut n'avoir plus rien à commiter : le travail du lot est déjà dans git.
-    const alreadyDone = kind === 'implement' && l.answers.length > 0 && lotWork(plan, l.repo, l.lot).length > 0;
+    // La session peut n'avoir plus rien à commiter (réponse du lead, lot commité avant la vague) : le travail du lot est déjà dans git.
+    // Même règle côté fix (L56) : la passe n'avait rien à ajouter, le lot a déjà ses commits de travail → revue neuve ; la passe reste consommée, MAX_PASSES borne la boucle.
+    const alreadyDone = (kind === 'implement' || kind === 'fix') && lotWork(plan, l.repo, l.lot).length > 0;
     if (commits.length === 0 && !alreadyDone && !headMoved) {
         stop(c, 'handed-back', `${kind} sans commit`);
         return;
@@ -463,7 +464,7 @@ async function work(c, kind) {
     if (headMoved)
         l.warnings.push(`${minorsPass ? 'passe des mineurs' : 'correction'} reprise sans nouveau commit : un commit d'une session précédente est relu par la revue`);
     else if (commits.length === 0)
-        l.warnings.push(`${kind} sans nouveau commit : revue lancée sur les commits déjà faits du lot`);
+        l.warnings.push(kind === 'fix' ? 'fix sans nouveau commit : revue lancée sur les commits du lot' : `${kind} sans nouveau commit : revue lancée sur les commits déjà faits du lot`);
     const red = [];
     if (!rep.tests.vert)
         red.push({ source: 'tests', gravite: 'bloquant', texte: `tests annoncés rouges par la session : ${rep.tests.commande} — ${rep.tests.resultat}` });

package/dist/verify.js

@@ -1,5 +1,7 @@
 import { spawn } from 'node:child_process';
 import { constants } from 'node:os';
+import { headSha, repoStatus, upstreamHead, upstreamIsDefaultBranch } from './git.js';
+import { lastDelivery, sharedStateDir } from './state.js';
 import { onTermination } from './proc.js';
 import { describeCheck, realDeps, retryCheck, TIMED_OUT } from './deliver.js';
 function killGroup(pgid, sig) {
@@ -73,6 +75,28 @@ export function summaryLine(results) {
 export function verifyEnv(sha) {
     return { CADENCE_SHA: sha, CADENCE_SHORT: sha.slice(0, 7), CADENCE_BRANCH: '' };
 }
+/**
+ * Sha attendu par les vérifications (${SHA} / ${SHORT}) et note éventuelle pour le compte rendu.
+ * - Par défaut : la dernière livraison, à défaut la tête (inchangé).
+ * - `ci: none` SANS commande ni script de livraison : la livraison EST le push (Cloudflare Pages construit chaque
+ *   push, plan compris), donc la tête de la branche amont suivie (état local de la référence, aucun réseau) —
+ *   mais seulement si cet amont est la branche de production du dépôt distant : une branche de travail poussée
+ *   avec -u n'est pas publiée, elle garde la règle par défaut. Des commits locaux non poussés ne changent pas
+ *   ce sha mais sont dits dans la note.
+ * - Sans amont : règle par défaut.
+ */
+export function expectedTarget(root, config, last) {
+    const fallback = last ?? headSha(root) ?? '';
+    if (config.script !== undefined || config.deploy.length > 0 || config.ci !== 'none')
+        return { sha: fallback, note: null };
+    const up = upstreamHead(root);
+    if (!up || !upstreamIsDefaultBranch(root, up.ref))
+        return { sha: fallback, note: null };
+    const ahead = repoStatus(root).ahead;
+    return { sha: up.sha, note: ahead > 0 ? `${ahead} commit(s) non poussé(s) — l'effet vérifié est celui de ${up.ref}` : null };
+}
+/** Sha attendu de la reprise et de `cadence verify` sans --sha. */
+export const defaultTarget = (root, config) => expectedTarget(root, config, lastDelivery(sharedStateDir(root)));
 /** Délai de chaque essai d'une vérification de `cadence verify`. */
 export const VERIFY_ATTEMPT_MS = 120_000;
 /** `cadence verify` : 0 tout vert, 1 un effet rouge, 2 rien à vérifier. */
@@ -85,6 +109,8 @@ export async function verifyCommand(ctx, deps) {
             : 'verify : aucune vérification déclarée (deliver.verify)');
         return 2;
     }
+    if (ctx.note)
+        out(ctx.note);
     const results = await replayChecks(config.verify, deps, ctx.sha, verifyEnv(ctx.sha), { retryMs: ctx.retry * 1000, attemptMs: VERIFY_ATTEMPT_MS });
     for (const r of results)
         out(resultLine(r));
@@ -100,15 +126,16 @@ export const MORNING_BUDGET_MS = 10_000;
  * Lignes « Effets en production » du rapport de reprise : un seul essai par vérification, borné. Rien à dire
  * (liste vide) pour un projet sans verify ; ne lève jamais — c'est un fait de plus, pas une condition.
  */
-export async function effectLines(config, sha, deps) {
+export async function effectLines(config, sha, deps, note = null) {
     if (config.verify.length === 0)
         return [];
+    const head = note ? [note] : [];
     try {
         const results = await replayChecks(config.verify, deps, sha, verifyEnv(sha), { retryMs: 0, attemptMs: MORNING_BUDGET_MS });
         const shown = results.filter((r) => r.reason !== null);
-        return shown.length === 0 ? [`✓ ${summaryLine(results)}`] : [...shown.map(resultLine), summaryLine(results)];
+        return shown.length === 0 ? [...head, `✓ ${summaryLine(results)}`] : [...head, ...shown.map(resultLine), summaryLine(results)];
     }
     catch (e) {
-        return [`✗ verify : ${e.message}`];
+        return [...head, `✗ verify : ${e.message}`];
     }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sylad/cadence",
-  "version": "0.9.0",
+  "version": "0.10.0",
   "description": "A small, repo-native working method: a versioned plan linked to your commits, a changelog with screenshots, session rituals and deliveries proven by their effect.",
   "license": "MIT",
   "author": "Sylvain Ladoire",

package/templates/orchestrate/fix-minors.md

@@ -13,6 +13,10 @@ deliver, run `raf done`, `raf ux` or `raf review`. Read the project's CLAUDE.md
 Do not stop to ask. A finding that is wrong, or not worth its change, is not fixed: list it under
 "choix" in your report with the reason — the reviewer re-reads it and the lead sees it. Leave
 "questions" empty. Making no commit at all is a valid outcome when every finding is rejected.
+Minor choices to settle yourself, writing the alternative you did not take:
+a spacing, colour or label value when a measurement or a rule justifies it; the URL of a link (the most general official page if a precise one is not certain);
+a News entry: only if a finding asks for it; a written rule of the project's CLAUDE.md (apply it); who launches the review or UX pass (never the session: the program and the lead do).
+"not my job to touch the plan" is not a question: say it in the report.
 You are one short session of an orchestrated wave: do not launch subagents (the Agent tool is disabled).
 Give your final report as the structured output (commits, tests, build, what you could not verify, choices).
 {{reponse}}

package/templates/orchestrate/fix.md

@@ -10,7 +10,12 @@ Rules: test first; commit each fix as soon as its tests pass, with explicit path
 `git add -A` or `commit -a`), and a message that cites the lot (`fix({{lot}}): …`); run the project's
 full test suite and build before reporting; do not push, deliver, run `raf done`, `raf ux` or
 `raf review`. Read the project's CLAUDE.md first.
-If a finding is wrong, or fixing it needs a decision, stop and report the question instead of guessing.
+If a finding is wrong, say so under "choix" with the reason. Ask (under "questions") only when a fix needs a decision that passes the rule below.
+A question is legitimate only if it names what it would change: the scope of the lot, the architecture, or a costly rollback (data, production, public API);
+otherwise it is a choice: decide, write the alternative you did not take, go on. Minor choices to settle yourself:
+a spacing, colour or label value when a measurement or a rule justifies it; the URL of a link (the most general official page if a precise one is not certain);
+a News entry: only if a finding asks for it; a written rule of the project's CLAUDE.md (apply it); who launches the review or UX pass (never the session: the program and the lead do).
+"not my job to touch the plan" is not a question: say it in the report.
 You are one short session of an orchestrated wave: do not launch subagents (the Agent tool is disabled).
-Give your final report as the structured output (commits, tests, build, what you could not verify, questions).
+Give your final report as the structured output (commits, tests, build, what you could not verify, choices, questions).
 {{reponse}}

package/templates/orchestrate/implement.md

@@ -7,9 +7,14 @@ full test suite and build before reporting; do not push, deliver, run `raf done`
 `raf review`.
 Decide minor interpretation questions yourself (the wording of a message, a name, a default, the
 reading of an ambiguous line of the lot) and list each one under "choix" in your report, with the
-alternative you did not take — the reviewer re-reads them. Stop and ask (under "questions") only on a real blocker:
-a decision that changes the scope or the architecture, is costly to undo, or that the plan, its notes
-and the project's CLAUDE.md do not settle.
+alternative you did not take — the reviewer re-reads them. Stop and ask (under "questions") only on a real blocker.
+A question is legitimate only if it names what it would change: the scope of the lot, the architecture, or a costly rollback (data, production, public API), AND the plan, its notes and the project's CLAUDE.md do not settle it;
+otherwise it is a choice: decide, write the alternative you did not take, go on. Minor choices to settle yourself:
+a spacing, colour or label value when a measurement or a rule justifies it; the URL of a link (the most general official page if a precise one is not certain);
+a News entry for a visible lot (yes, always); a written rule of the project's CLAUDE.md (apply it); who launches the review or UX pass (never the session: the program and the lead do).
+"not my job to touch the plan" is not a question: say it in the report.
+If the lot's commits already cover its open sub-tasks, do not ask whether to continue: make no commit and say so
+in your report (the review that follows re-reads those commits). If they do not cover them all, implement the rest.
 Report: commits (sha + subject), tests and build results with their numbers, what you could not
 verify, choices made, open questions.