@sylad/cadence 1.17.0 → 1.17.1

package/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "cadence",
       "description": "Session start and close rituals driven by a versioned plan (raf), and deliveries proven by their effect. Needs the cadence CLI (npm i -g @sylad/cadence).",
-      "version": "1.17.0",
+      "version": "1.17.1",
       "source": "./",
       "author": {
         "name": "Sylvain Ladoire"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cadence",
   "description": "A repo-native working method: session start and close rituals driven by a versioned plan (raf), deliveries proven by their effect, and three reviewer agents (UX, code, QA).",
-  "version": "1.17.0",
+  "version": "1.17.1",
   "author": { "name": "Sylvain Ladoire" },
   "homepage": "https://github.com/Sylad/cadence",
   "repository": "https://github.com/Sylad/cadence",

package/dist/cli.js

@@ -2,7 +2,7 @@ import { existsSync, mkdirSync, readFileSync, realpathSync, writeFileSync } from
 import { execFileSync } from 'node:child_process';
 import { basename, dirname, join, posix, relative, resolve } from 'node:path';
 import { parseArgs } from 'node:util';
-import { defaultPlan, PLAN_DEFAULT, PLAN_LEGACY, readDocsConfig, readHookConfig, readNewsConfig, readOrchestrateConfig, readPerfConfig, readPlanConfig, readSessionConfig } from './config.js';
+import { defaultPlan, PLAN_DEFAULT, PLAN_LEGACY, readDocsConfig, readHookConfig, readNewsConfig, readOrchestrateConfig, readPerfConfig, readPlanConfig, readSessionConfig, readVerifyConfig } from './config.js';
 import { repoSections, repoShas, resolveLotRepos } from './repos.js';
 import { audit, exemptPlanOnly, gateProgress, gateText, gateWaiting, hypothesesOf, ownFiles, isPlanOnly, lotWork, nextUp, planCommits, unreviewedWork, workByLot } from './audit.js';
 import { short } from './check.js';
@@ -745,7 +745,7 @@ function dispatch(argv, io) {
             const articles = readDocsConfig(configPath).articles;
             // Sans public: d'un lot visible, le site reprend le titre de sa Nouveauté la plus récente.
             const publicTitle = (lot) => lot.public ?? (lot.visible ? loadEntries(newsDir).find((e) => e.lots.includes(lot.id))?.title : undefined);
-            const ctx = { root, state: sharedStateDir(root), plan, config, today, dryRun: !!values['dry-run'], sha: values.sha, duringWave: !!orchestrating, args: rest, articles, publicTitle, out: io.out, err: io.err };
+            const ctx = { root, state: sharedStateDir(root), plan, config, today, dryRun: !!values['dry-run'], sha: values.sha, duringWave: !!orchestrating, waveId: orchestrating?.wave, planCommit: readPlanConfig(configPath, root)?.commit, args: rest, articles, publicTitle, out: io.out, err: io.err };
             return deliver(ctx, realDeps(root));
         }
         case 'verify': {
@@ -1304,7 +1304,7 @@ function specReseal(args, reason, porteur, ctx, io) {
     if (tracked) {
         try {
             // Les fichiers de plan.onWrite (L346) partent avec la note : la commande a tourné à l'écriture du plan.
-            const withPlan = [planRel, ...(produced.length ? dirtyPaths(repo, produced) : [])];
+            const withPlan = [planRel, ...dirtyPaths(repo, produced)];
             git(repo, ['add', '--', ...withPlan]);
             git(repo, ['commit', '-q', '-m', planCommitMessage(readPlanConfig(join(repo, 'cadence.yaml'), repo)?.commit, { lot: cite, action: PLAN_ACTIONS.resealed(norm) }), '--', ...withPlan]);
         }
@@ -1481,7 +1481,7 @@ async function verifyGateCommand(values, io) {
     const sha = resolveCommit(top, values.sha);
     if (!sha)
         throw new RafError(`verify --gate : --sha ${values.sha} : commit introuvable dans ${top}`);
-    return verifyGate({ repo: top, sha, config: readOrchestrateConfig(configPath), out: io.out });
+    return verifyGate({ repo: top, sha, config: readOrchestrateConfig(configPath), verify: readVerifyConfig(configPath), out: io.out });
 }
 /** `session start|close --all [--depth n]` : la commande jouée dans chaque projet sous le dossier courant, une section par projet. */
 async function sessionAll(rest, values, io) {

package/dist/config-set.js

@@ -232,7 +232,7 @@ export function configSet(parent, key, valueText, opts, today) {
                 plan.setStatus(id, 'doing', today);
                 plan.save();
             }
-            const sha = commitPaths(dir, ['cadence.yaml', planRel, ...(produced.length ? dirtyPaths(dir, produced) : [])], `chore${id ? `(${id})` : ''}: cadence.yaml — ${key} = ${shown}`);
+            const sha = commitPaths(dir, ['cadence.yaml', planRel, ...dirtyPaths(dir, produced)], `chore${id ? `(${id})` : ''}: cadence.yaml — ${key} = ${shown}`);
             done++;
             lines.push(`✓ ${name} · ${id || 'lot de config'} · ${key} = ${shown} · commit ${sha}`);
         }

package/dist/config.js

@@ -312,6 +312,31 @@ export function readSessionConfig(file) {
 }
 const EFFORTS = ['default', 'low', 'medium', 'high', 'xhigh', 'max'];
 export const EFFORT_STEPS = ['precheck', 'spec', 'maquette', 'fiche', 'accept', 'implement', 'fix', 'review', 'ux'];
+/** Clé `verify:` de cadence.yaml. Absente : `{}`. */
+export function readVerifyConfig(file) {
+    if (!existsSync(file))
+        return {};
+    let raw;
+    try {
+        raw = parse(readFileSync(file, 'utf8'));
+    }
+    catch (e) {
+        throw new RafError(`${file} illisible : ${e.message.split('\n')[0]}`);
+    }
+    const v = raw?.verify;
+    if (v == null)
+        return {};
+    if (!isObject(v))
+        throw new RafError(`${file} : verify doit être un objet { inPlace }`);
+    for (const k of Object.keys(v))
+        if (k !== 'inPlace')
+            throw new RafError(`${file} : verify.${k} inconnu (attendu : inPlace)`);
+    if (v.inPlace == null)
+        return {};
+    if (typeof v.inPlace !== 'boolean')
+        throw new RafError(`${file} : verify.inPlace : true ou false attendu`);
+    return { inPlace: v.inPlace };
+}
 const REVIEW_KEYS = ['threshold', 'light', 'full'];
 const ORCH_KEYS = ['start', 'verdict', 'test', 'testReplay', 'build', 'worktreeDeps', 'accept', 'maquette', 'maquetteReviews', 'fiche', 'ux', 'precheck', 'prodAccess', 'worktrees', 'testGate', 'spec', 'review', 'escalation', 'effort', 'permissionMode', 'addDirs', 'timeouts'];
 /** Clé `orchestrate:` de cadence.yaml. Absente : les défauts (auto, 45 min d'implémentation, 25 min de revue). */

package/dist/deliver.js

@@ -1,11 +1,12 @@
 import { execFileSync, spawn } from 'node:child_process';
 import { readFileSync, rmSync, writeFileSync } from 'node:fs';
 import { constants } from 'node:os';
-import { join } from 'node:path';
+import { join, relative } from 'node:path';
 import { parse } from 'yaml';
 import { onTermination, readProcs, SIGNAL_GRACE_MS, SIGNAL_PENDING_MS, TreeTracker } from './proc.js';
 import { isPlanOnly } from './audit.js';
-import { headSha, isAncestor, onRemote, readCommits, repoStatus, resolveCommit } from './git.js';
+import { commitPaths, dirtyPaths, headSha, isAncestor, onRemote, readCommits, repoStatus, resolveCommit } from './git.js';
+import { PLAN_ACTIONS, planCommitMessage } from './plan-commit.js';
 import { citedRefs } from './link.js';
 import { describeArticle, openArticleLots } from './articles.js';
 import { RafError } from './plan.js';
@@ -535,8 +536,9 @@ function deliveredLots(ctx, ids, prev, sha) {
 }
 /**
  * Livraison verte (L144) : les lots livrés dont le titre est public changent ce que les articles externes racontent, on ouvre
- * donc le lot qui les rafraîchit. Le plan est écrit mais pas commité (deliver ne commite jamais) ; une erreur ici ne défait pas
- * une livraison déjà faite.
+ * donc le lot qui les rafraîchit. Hors vague le plan est écrit mais pas commité ; pendant une vague (L388) il est commité avec les fichiers que produit `plan.onWrite`, avec
+ * le gabarit `plan.commit`, pour ne pas laisser le plan modifié dans l'arbre où une session de la vague travaille — sauf si le plan ou ces fichiers l'étaient
+ * déjà avant l'écriture (le lead y a des modifications que ce commit emporterait). Une erreur ici ne défait pas une livraison déjà faite.
  */
 function refreshArticles(ctx, ids, sha) {
     if (!ctx.plan || !ctx.articles?.length || !ids.length)
@@ -544,6 +546,9 @@ function refreshArticles(ctx, ids, sha) {
     try {
         // Relu : le script du projet a pu fermer des lots ou commiter le plan depuis le départ de la livraison, save() ne doit pas l'écraser.
         const plan = ctx.plan.reloaded();
+        const planFile = relative(ctx.root, plan.path);
+        const held = [planFile, ...plan.produced];
+        const wasDirty = dirtyPaths(ctx.root, held).length > 0;
         const wanted = new Set(ids);
         const r = openArticleLots({
             plan,
@@ -558,10 +563,24 @@ function refreshArticles(ctx, ids, sha) {
             ctx.err(`deliver : ${w}`);
         if (r.opened.length || r.noted.length)
             plan.save();
+        const touched = [...r.opened, ...r.noted];
+        let state = 'plan modifié, à commiter';
+        if (touched.length && ctx.duringWave && wasDirty) {
+            state = 'plan déjà modifié avant la livraison, non commité : à commiter avec vos modifications';
+        }
+        else if (touched.length && ctx.duringWave) {
+            const message = planCommitMessage(ctx.planCommit, { lot: touched.join(', '), action: r.opened.length ? PLAN_ACTIONS.articleOpened : PLAN_ACTIONS.articleNoted, wave: ctx.waveId });
+            try {
+                state = `plan commité ${commitPaths(ctx.root, [planFile, ...dirtyPaths(ctx.root, plan.produced)], message)}`;
+            }
+            catch (e) {
+                state = `commit du plan refusé (${e.message}), plan modifié, à commiter`;
+            }
+        }
         for (const id of r.opened)
-            ctx.out(`article à rafraîchir : ${id} « ${plan.lot(id).title} » ouvert (plan modifié, à commiter) — à jouer dans une vague ordinaire`);
+            ctx.out(`article à rafraîchir : ${id} « ${plan.lot(id).title} » ouvert (${state}) — à jouer dans une vague ordinaire`);
         for (const id of r.noted)
-            ctx.out(`article à rafraîchir : ${id} déjà ouvert, titres livrés ajoutés en note (plan modifié, à commiter)`);
+            ctx.out(`article à rafraîchir : ${id} déjà ouvert, titres livrés ajoutés en note (${state})`);
         for (const m of r.manual)
             ctx.out(`article à rafraîchir : ${m}`);
     }

package/dist/git.js

@@ -241,8 +241,10 @@ export function addedTimes(dir) {
     }
     return times;
 }
-/** Chemins parmi `paths` (relatifs à la racine) que git voit modifiés, stagés ou non suivis. */
+/** Chemins parmi `paths` (relatifs à la racine) que git voit modifiés, stagés ou non suivis. Liste vide → rien (sans pathspec, git listerait tout l'arbre). */
 export function dirtyPaths(root, paths) {
+    if (paths.length === 0)
+        return [];
     const out = git(root, ['-c', 'core.quotepath=off', 'status', '--porcelain', '-z', '--', ...paths]);
     return out.split('\0').filter(Boolean).map((l) => l.slice(3));
 }

package/dist/orchestrate/cycle.js

@@ -148,7 +148,7 @@ async function commitPlan(c, message, root = c.lot.repo, before = new Map()) {
     const ownFile = planOwnFile(c, repo);
     // Les fichiers de plan.onWrite (L346) entrent même non suivis : le premier plan publié n'est pas encore au dépôt.
     const produced = c.loadPlan().produced;
-    const dirty = [...new Set([...trackedPaths(await snapshot(repo, { remote: false })), ...(produced.length ? dirtyPaths(repo, produced) : [])])];
+    const dirty = [...new Set([...trackedPaths(await snapshot(repo, { remote: false })), ...dirtyPaths(repo, produced)])];
     if (dirty.length === 0)
         return null;
     const foreign = dirty.filter((f) => !ownFile(f));

package/dist/orchestrate/worktree.js

@@ -1,6 +1,6 @@
 import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { existsSync, lstatSync, mkdirSync, readdirSync, rmSync, symlinkSync, realpathSync } from 'node:fs';
+import { cpSync, existsSync, lstatSync, mkdirSync, readdirSync, rmSync, symlinkSync, realpathSync } from 'node:fs';
 import { basename, dirname, isAbsolute, join, relative, sep } from 'node:path';
 import { lotSlug } from './state.js';
 import { cadenceHome, liveWaves } from './registry.js';
@@ -123,16 +123,52 @@ export function mirrorNodeModules(repo, dir, name, links) {
  * fichier ignoré le plus haut ; son parent doit exister dans le worktree (sinon rien où le relier). Rend les liens créés.
  */
 export function linkIgnored(repo, dir) {
-    const ignored = git(repo, 'ls-files', '--others', '--ignored', '--exclude-standard', '--directory').split('\n').map((f) => f.replace(/\/$/, '')).filter((f) => f && !f.startsWith('.cadence') && !f.split('/').some((p) => OUTPUT_DIRS.has(p)));
-    return linkNames(repo, dir, ignored);
+    return linkNames(repo, dir, ignoredDeps(repo));
+}
+/** Les dossiers et fichiers ignorés du dépôt vivant les plus hauts, hors `.cadence` et sorties de build : ce que les worktrees relient et que `verify --gate` copie. */
+export function ignoredDeps(repo) {
+    return git(repo, 'ls-files', '--others', '--ignored', '--exclude-standard', '--directory').split('\n').map((f) => f.replace(/\/$/, '')).filter((f) => f && !f.startsWith('.cadence') && !f.split('/').some((p) => OUTPUT_DIRS.has(p)));
 }
 /**
- * Relie dans le worktree `dir` les dépendances que le dépôt vivant déclare (`orchestrate.worktreeDeps`, L348), par leur chemin relatif. Celles qui n'existent pas
- * dans le dépôt vivant ne sont pas liées et sont rendues dans `missing`. Rend aussi les liens créés.
+ * Copie dans le worktree `dir` ces dépendances du dépôt vivant (L389), au lieu de les y relier : un outil qui refuse de charger un `node_modules` lié depuis
+ * un autre arbre (Astro : « Could not load … ») les trouve chez lui. Les liens relatifs du dossier qui restent dans le dépôt (espaces de travail) sont
+ * copiés tels quels : ils pointent dans la copie. Ceux qui en sortent (`file:../voisin`, `link:`) pointeraient dans le vide depuis `dir` : ils sont refaits
+ * vers leur cible vivante. Rend les chemins copiés ; un chemin dont le parent n'existe pas dans le worktree est passé.
  */
-export function linkDeclared(repo, dir, names) {
-    const present = names.filter((n) => lstatSync(join(repo, n), { throwIfNoEntry: false }));
-    return { links: linkNames(repo, dir, present), missing: names.filter((n) => !present.includes(n)) };
+export function copyDeps(repo, dir, names) {
+    const copied = [];
+    for (const name of names) {
+        const to = join(dir, name);
+        if (existsSync(to) || !existsSync(dirname(to)))
+            continue;
+        cpSync(join(repo, name), to, { recursive: true, verbatimSymlinks: true });
+        relinkOutside(realpathSync(repo), join(repo, name), to);
+        copied.push(name);
+    }
+    return copied;
+}
+/** Dans la copie `to` de `live`, refait vers leur cible vivante les liens relatifs dont la cible sort du dépôt `repoReal`. */
+function relinkOutside(repoReal, live, to) {
+    for (const e of readdirSync(live, { withFileTypes: true })) {
+        const liveEntry = join(live, e.name);
+        const copy = join(to, e.name);
+        if (e.isSymbolicLink()) {
+            let real;
+            try {
+                real = realpathSync(liveEntry);
+            }
+            catch {
+                continue; // lien mort : recopié tel quel
+            }
+            if (relative(repoReal, real).startsWith('..')) {
+                rmSync(copy);
+                symlinkSync(real, copy);
+            }
+        }
+        else if (e.isDirectory()) {
+            relinkOutside(repoReal, liveEntry, copy);
+        }
+    }
 }
 function linkNames(repo, dir, names) {
     const links = [];

package/dist/plan-commit.js

@@ -20,6 +20,9 @@ export const PLAN_ACTIONS = {
     done: 'terminé',
     reviewRecorded: 'revue de code enregistrée',
     reviewNoted: 'revue de code notée',
+    /** `cadence deliver` pendant une vague (L388) : le lot de l'article ouvert, ou ses titres ajoutés en note. */
+    articleOpened: 'article à rafraîchir ouvert',
+    articleNoted: 'article à rafraîchir : titres livrés notés',
     /** `spec green` (L366) : jamais la liste des tests rescellés, elle va dans le corps du commit (header-max-length de commitlint). */
     specGreen: 'acceptation verte, vert: true posé par cadence spec green',
     resealed: (norm) => `test d'acceptation rescellé (${norm})`,

package/dist/verify-gate.js

@@ -1,12 +1,12 @@
 import { spawn } from 'node:child_process';
-import { lstatSync, mkdtempSync, rmSync, unlinkSync } from 'node:fs';
+import { lstatSync, mkdtempSync, rmSync } from 'node:fs';
 import { availableParallelism, tmpdir } from 'node:os';
-import { join } from 'node:path';
+import { basename, join } from 'node:path';
 import { onTermination } from './proc.js';
 import { failedTests, hasUnnamedFailure, unloadedSuites } from './orchestrate/baseline.js';
 import { configuredCap } from './orchestrate/command.js';
 import { replayRed, TEST_WORKERS_ENV, testWorkersFrom } from './orchestrate/workers.js';
-import { git, gitFailure, linkDeclared, linkIgnored } from './orchestrate/worktree.js';
+import { copyDeps, git, gitFailure, ignoredDeps, linkIgnored } from './orchestrate/worktree.js';
 /** Délai de chaque commande de la porte : celui du rejeu de la ligne de base de la vague. */
 const GATE_TIMEOUT_MS = 30 * 60_000;
 /** Lignes de la fin de la sortie montrées quand aucun test n'est identifiable dans une sortie rouge. */
@@ -48,10 +48,26 @@ function sh(cmd, cwd, timeoutMs, group, env) {
         });
     });
 }
+/** Pourquoi l'arbre principal ne peut pas porter la porte au sha : non propre ou à un autre commit ; null s'il le peut. */
+function mainTreeObstacle(repo, sha) {
+    try {
+        const head = git(repo, 'rev-parse', 'HEAD');
+        if (head !== sha)
+            return `l'arbre principal est à ${head.slice(0, 7)}, pas au sha demandé`;
+        if (git(repo, 'status', '--porcelain'))
+            return 'l\'arbre principal a des modifications non validées ou des fichiers non suivis';
+        return null;
+    }
+    catch (e) {
+        return `l'état de l'arbre principal est illisible (${gitFailure(e)})`;
+    }
+}
 /**
  * `cadence verify --gate` (L348) : la porte du projet (`orchestrate.build`, puis `orchestrate.test`, dans l'ordre de la vague : les tests lisent ce que le build produit)
- * rejouée au `sha` dans un worktree jetable, hors du dépôt, dont les dépendances non suivies sont reliées depuis le dépôt vivant (`orchestrate.worktreeDeps`,
- * sinon les dossiers ignorés de tout niveau, comme les worktrees de vague). Les deux commandes sont rejouées même si la première est rouge : le compte rendu est entier.
+ * rejouée au `sha` (L389) dans l'arbre principal quand il est propre et à ce sha (les outils qui refusent un `node_modules` venu d'un autre arbre y tournent chez eux) ;
+ * sinon dans un worktree jetable, hors du dépôt, dont les dépendances non suivies sont copiées depuis le dépôt vivant (`orchestrate.worktreeDeps`,
+ * sinon les `node_modules` de tout niveau ; les autres dossiers ignorés sont reliés, comme dans les worktrees de vague). `verify.inPlace` impose l'un (`true`, refus si l'arbre n'est pas propre au sha) ou l'autre (`false`).
+ * La première ligne de la sortie dit où la porte a tourné ; en place, l'arbre est relu à la fin et, s'il a bougé, le verdict est dit non probant (code 2). Les deux commandes sont rejouées même si la première est rouge : le compte rendu est entier.
  * Chaque commande reçoit `CADENCE_TEST_WORKERS` comme dans la porte d'une vague (L350, L387) : la valeur de l'environnement de l'appelant si c'est un entier positif, sinon cœurs ÷ plafond de sessions (`CADENCE_MAX_SESSIONS`, 2 par défaut) ;
  * sans elle le rejeu `--maxWorkers=$CADENCE_TEST_WORKERS` de `orchestrate.testReplay` sortirait en erreur et ne prouverait rien.
  * Le worktree est retiré dans tous les cas. 0 vert, 1 rouge (avec les tests en échec), 2 rien à rejouer ou worktree impossible.
@@ -69,15 +85,38 @@ export async function verifyGate(ctx) {
         out('verify --gate : ni orchestrate.test ni orchestrate.build déclarés dans cadence.yaml — rien à rejouer');
         return 2;
     }
+    const obstacle = mainTreeObstacle(repo, sha);
+    const mode = ctx.verify?.inPlace;
+    if (mode === true && obstacle) {
+        out(`verify --gate : verify.inPlace demande l'arbre principal, mais ${obstacle} — rien n'est joué`);
+        return 2;
+    }
+    const inPlace = mode === true || (mode === undefined && obstacle === null);
+    if (inPlace) {
+        out(`verify --gate ${short} : porte jouée dans l'arbre principal ${repo} (propre, au sha)`);
+        const group = {};
+        const forget = onTermination(() => {
+            if (group.pgid !== undefined)
+                killGroup(group.pgid);
+        });
+        try {
+            const code = await runSteps(steps, repo, ctx, group, env, short);
+            // Une vague intègre ses lots par fast-forward dans cet arbre : s'il a bougé pendant la porte, les commandes ont lu un mélange de commits.
+            const moved = mainTreeObstacle(repo, sha);
+            if (moved === null)
+                return code;
+            out(`verify --gate ${short} : verdict non probant — ${moved} à la fin de la porte (un lot a pu être intégré pendant qu'elle tournait, ou une commande a écrit hors des dossiers ignorés) ; la rejouer`);
+            return 2;
+        }
+        finally {
+            forget();
+        }
+    }
     const dir = mkdtempSync(join(tmpdir(), 'cadence-verify-'));
-    const links = [];
     const group = {};
     const cleanup = () => {
         if (group.pgid !== undefined)
             killGroup(group.pgid);
-        for (const k of links)
-            if (lstatSync(k, { throwIfNoEntry: false })?.isSymbolicLink())
-                unlinkSync(k);
         try {
             git(repo, 'worktree', 'remove', '--force', dir);
         }
@@ -101,69 +140,81 @@ export async function verifyGate(ctx) {
             out(`verify --gate : worktree de ${short} impossible — ${gitFailure(e)}`);
             return 2;
         }
+        let copied;
         if (config.worktreeDeps) {
-            const linked = linkDeclared(repo, dir, config.worktreeDeps);
-            links.push(...linked.links);
-            if (linked.missing.length)
-                out(`dépendances déclarées absentes de l'arbre principal, non liées : ${linked.missing.join(', ')}`);
+            const present = config.worktreeDeps.filter((n) => lstatSync(join(repo, n), { throwIfNoEntry: false }));
+            copied = copyDeps(repo, dir, present);
+            const missing = config.worktreeDeps.filter((n) => !present.includes(n));
+            if (missing.length)
+                out(`dépendances déclarées absentes de l'arbre principal, non copiées : ${missing.join(', ')}`);
         }
         else {
-            links.push(...linkIgnored(repo, dir));
-        }
-        let red = 0;
-        for (const step of steps) {
-            const r = await sh(step.cmd, dir, ctx.timeoutMs ?? GATE_TIMEOUT_MS, group, env);
-            if (r.code === 0) {
-                out(`✓ ${step.name} (${step.cmd})`);
-                continue;
-            }
-            const tests = step.name === 'tests';
-            const names = tests ? failedTests(r.output) : [];
-            const unloaded = tests ? unloadedSuites(r.output) : [];
-            // `orchestrate.testReplay` comme la porte d'une vague (L354, L387) : un rouge nommé est rejoué seul avant d'être compté ; vert au rejeu, il est instable sous charge.
-            // Un échec que la sortie ne rattache à aucun test, ou un fichier qui ne se charge pas, n'est jamais rejoué.
-            const replayable = tests && config.testReplay && names.length > 0 && unloaded.length === 0 && !hasUnnamedFailure(r.output);
-            const replays = [];
-            const { red: still, unstable } = replayable
-                ? await replayRed(async (c) => {
-                    const p = await sh(c, dir, ctx.timeoutMs ?? GATE_TIMEOUT_MS, group, env);
-                    replays.push(p.code);
-                    return p;
-                }, config.testReplay, names, r.output)
-                : { red: names, unstable: [] };
-            if (replayable && still.length === 0) {
-                out(`✓ ${step.name} (${step.cmd}) — ${unstable.length} test(s) rouge(s) sous charge, verts rejoués seuls (instables sous charge) :`);
-                for (const n of unstable)
-                    out(`  - ${n}`);
-                continue;
-            }
-            red++;
-            out(`✗ ${step.name} (${step.cmd}) — code ${r.code}`);
-            for (const n of still)
-                out(`  - ${n}`);
-            for (const n of unloaded)
-                out(`  - ${n} (ne se charge pas)`);
-            // Un rejeu a eu lieu : dire lequel, pour qu'un rejeu en échec pour une autre raison qu'un vrai rouge (commande cassée, aucun test exécuté) ne passe pas pour une confirmation du rouge.
-            if (replays.length)
-                out(`  rejeu seul (orchestrate.testReplay) : ${replays.length} rejeu(x), dernier code ${replays[replays.length - 1]} — ${names.length - still.length} test(s) confirmé(s) vert(s) sur ${names.length} ; un rejeu en échec ou sans test exécuté ne prouve rien`);
-            if (unstable.length) {
-                out(`  ${unstable.length} autre(s) test(s) rouge(s) sous charge, verts rejoués seuls (instables sous charge) :`);
-                for (const n of unstable)
-                    out(`    - ${n}`);
-            }
-            if (still.length + unloaded.length === 0 || hasUnnamedFailure(r.output, true)) {
-                if (still.length + unloaded.length)
-                    out('  (au moins un échec que la sortie ne rattache à aucun test)');
-                if (r.output.trim())
-                    for (const l of r.output.trimEnd().split('\n').slice(-TAIL_LINES))
-                        out(`  | ${l}`);
-            }
+            const deps = ignoredDeps(repo);
+            // Seuls les node_modules sont copiés : le reste (.venv, données, .env) reste relié, comme dans un worktree de vague, sans rien dupliquer dans /tmp.
+            copied = copyDeps(repo, dir, deps.filter((n) => basename(n) === 'node_modules'));
+            linkIgnored(repo, dir);
         }
-        out(red === 0 ? `verify --gate ${short} : vert` : `verify --gate ${short} : rouge (${red} étape${red > 1 ? 's' : ''} sur ${steps.length})`);
-        return red === 0 ? 0 : 1;
+        const why = mode === false ? 'verify.inPlace: false' : obstacle;
+        out(`verify --gate ${short} : porte jouée dans une copie jetable ${dir} (${why}) ; dépendances copiées : ${copied.length ? copied.join(', ') : 'aucune'}`);
+        return await runSteps(steps, dir, ctx, group, env, short);
     }
     finally {
         forget();
         cleanup();
     }
 }
+/** Les étapes de la porte jouées dans `cwd` ; le compte rendu et le code de sortie (0 vert, 1 rouge). */
+async function runSteps(steps, cwd, ctx, group, env, short) {
+    const { config, out } = ctx;
+    let red = 0;
+    for (const step of steps) {
+        const r = await sh(step.cmd, cwd, ctx.timeoutMs ?? GATE_TIMEOUT_MS, group, env);
+        if (r.code === 0) {
+            out(`✓ ${step.name} (${step.cmd})`);
+            continue;
+        }
+        const tests = step.name === 'tests';
+        const names = tests ? failedTests(r.output) : [];
+        const unloaded = tests ? unloadedSuites(r.output) : [];
+        // `orchestrate.testReplay` comme la porte d'une vague (L354, L387) : un rouge nommé est rejoué seul avant d'être compté ; vert au rejeu, il est instable sous charge.
+        // Un échec que la sortie ne rattache à aucun test, ou un fichier qui ne se charge pas, n'est jamais rejoué.
+        const replayable = tests && config.testReplay && names.length > 0 && unloaded.length === 0 && !hasUnnamedFailure(r.output);
+        const replays = [];
+        const { red: still, unstable } = replayable
+            ? await replayRed(async (c) => {
+                const p = await sh(c, cwd, ctx.timeoutMs ?? GATE_TIMEOUT_MS, group, env);
+                replays.push(p.code);
+                return p;
+            }, config.testReplay, names, r.output)
+            : { red: names, unstable: [] };
+        if (replayable && still.length === 0) {
+            out(`✓ ${step.name} (${step.cmd}) — ${unstable.length} test(s) rouge(s) sous charge, verts rejoués seuls (instables sous charge) :`);
+            for (const n of unstable)
+                out(`  - ${n}`);
+            continue;
+        }
+        red++;
+        out(`✗ ${step.name} (${step.cmd}) — code ${r.code}`);
+        for (const n of still)
+            out(`  - ${n}`);
+        for (const n of unloaded)
+            out(`  - ${n} (ne se charge pas)`);
+        // Un rejeu a eu lieu : dire lequel, pour qu'un rejeu en échec pour une autre raison qu'un vrai rouge (commande cassée, aucun test exécuté) ne passe pas pour une confirmation du rouge.
+        if (replays.length)
+            out(`  rejeu seul (orchestrate.testReplay) : ${replays.length} rejeu(x), dernier code ${replays[replays.length - 1]} — ${names.length - still.length} test(s) confirmé(s) vert(s) sur ${names.length} ; un rejeu en échec ou sans test exécuté ne prouve rien`);
+        if (unstable.length) {
+            out(`  ${unstable.length} autre(s) test(s) rouge(s) sous charge, verts rejoués seuls (instables sous charge) :`);
+            for (const n of unstable)
+                out(`    - ${n}`);
+        }
+        if (still.length + unloaded.length === 0 || hasUnnamedFailure(r.output, true)) {
+            if (still.length + unloaded.length)
+                out('  (au moins un échec que la sortie ne rattache à aucun test)');
+            if (r.output.trim())
+                for (const l of r.output.trimEnd().split('\n').slice(-TAIL_LINES))
+                    out(`  | ${l}`);
+        }
+    }
+    out(red === 0 ? `verify --gate ${short} : vert` : `verify --gate ${short} : rouge (${red} étape${red > 1 ? 's' : ''} sur ${steps.length})`);
+    return red === 0 ? 0 : 1;
+}

package/docs/deliver.md

@@ -143,7 +143,7 @@ cadence deliver              # 0 delivered and verified · 1 a step failed · 2
   commits (see "Plan upkeep needs no lot") are skipped in that list: they cite
   lots without delivering anything.
 - With [`docs.articles`](news.md#an-article-elsewhere-that-follows-the-delivery), a green delivery of lots with a
-  public title also opens the lot `Article <project> à rafraîchir` in the plan.
+  public title also opens the lot `Article <project> à rafraîchir` in the plan (committed, with the files `plan.onWrite` produces, when a wave holds the repository, L388).
 
 ## A project with its own delivery script
 
@@ -280,24 +280,34 @@ project without `deliver.verify`.
 replays the *gate* of the project, `orchestrate.build` then `orchestrate.test` of `cadence.yaml`
 (the order of the wave's gate: the tests read what the build produces), at one commit, for the
 lead's re-verification (« the lead re-verifies itself », skill `lead`). It never touches the shared
-tree, which holds the lots still running.
+tree while it holds uncommitted work (the lots still running): it then replays in a throwaway copy.
 
 ```sh
 cadence verify --gate --sha 6b0d9aa                  # in the project
 cadence verify --gate --sha 6b0d9aa --project app    # from the parent folder, the project `app` (its own git repository)
 ```
 
-It adds a throwaway worktree of the sha under the OS temporary folder (`cadence-verify-…`), links
-the **untracked dependencies** of the main tree into it, runs the commands there, and removes the worktree
-whatever the result. A bare worktree has no `node_modules` or `.venv`: on 26-10 the re-verification of a lot
-in one gave nine red suites that were only missing dependencies. Which dependencies:
+**Where the gate runs (L389).** The first line of the output says it:
+
+- the main tree is **clean and at the sha** (`git status --porcelain` empty, `HEAD` equal to the sha): the gate runs **there**, in the repository itself, with its own `node_modules` and its real paths (`verify --gate 6b0d9aa : porte jouée dans l'arbre principal /path/app (propre, au sha)`). A tool that refuses a `node_modules` linked from another tree (Astro: « Could not load …/node_modules/astro/… »), or a test that reads files by a path relative to the checkout, is red in a copy for reasons that have nothing to do with the sha; on 27-10 avatar-pandora and finance-tracker's ux-demo.spec were both green in the main tree and red in the copy. The commands may write their usual ignored outputs there (`dist`, caches);
+- otherwise (uncommitted changes, untracked files, or another commit checked out: a wave's lots may be working in it): a throwaway worktree of the sha under the OS temporary folder (`cadence-verify-…`), removed whatever the result, where the **`node_modules` of the main tree are copied** (not linked: a copied `node_modules` is a real one for the tools that refuse a link; workspace links, relative, are copied as they are and point inside the copy) and the other ignored folders (`.venv`, data, `.env`) are linked, never copied. The line names the worktree, why the main tree was not used, and the copied dependencies (`… porte jouée dans une copie jetable /tmp/cadence-verify-x (l'arbre principal a des modifications non validées ou des fichiers non suivis) ; dépendances copiées : node_modules`). The copy of a large `node_modules` takes time: this is the price of a gate that does not lie.
+- **The main tree is read again at the end of an in-place gate.** A wave integrates its lots into it by fast-forward and commits the plan there, possibly while the gate runs: if `HEAD` or `git status --porcelain` changed, the output adds `verdict non probant` (a lot may have been integrated meanwhile, or a command wrote outside the ignored folders) and the exit code is 2 whatever the result: replay it.
+
+```yaml
+# cadence.yaml
+verify:
+  inPlace: false   # always the throwaway copy, even when the main tree is clean at the sha
+  # inPlace: true  # the main tree or nothing: not clean at the sha → exit 2, nothing is run
+```
+
+Absent, `verify.inPlace` chooses as above. Which dependencies are copied into the throwaway worktree:
 
 - `orchestrate.worktreeDeps: [node_modules, .venv, front/node_modules]` in `cadence.yaml`: those paths, relative to the repository
   (no absolute path, no `..`); one that does not exist in the main tree is reported and skipped;
-- absent: the same folders as the worktrees of a wave (the ignored folders of every level, `node_modules`, `.venv`…; build outputs such as `dist` excluded). The
-  workspace links of a `node_modules` are made again towards the worktree, so the code run is the sha's.
+- absent: the `node_modules` of every level are copied; the other ignored folders (`.venv`…, build outputs such as `dist` excluded) are linked, as in the worktrees of a wave. A bare worktree has no `node_modules` or `.venv`: on 26-10 the re-verification of a lot in one gave nine red suites that were only missing dependencies.
 
 ```
+verify --gate 6b0d9aa : porte jouée dans l'arbre principal /path/app (propre, au sha)
 ✓ build (npx tsc --noEmit)
 ✗ tests (npx vitest run) — code 1
   - test/a.test.ts > R3 — …
@@ -309,5 +319,5 @@ tests the output names (the same reading as the wave's baseline) and the test fi
 With `orchestrate.testReplay` declared (`docs/orchestrate.md`, « A red test is replayed alone »), the gate does what a wave does: a red test the output names is **replayed alone, twice at most**, in the same throwaway worktree. Green at a replay it is *unstable under load*: the step prints `✓ tests (…) — N test(s) rouge(s) sous charge, verts rejoués seuls (instables sous charge) :` with the names and does not make the gate red; the tests still red stay listed and the unstable ones follow, under a line of their own. A failure the output ties to no test, or a file that does not load, is never replayed and stays red. When a replay took place and the step stays red, one line says so (`rejeu seul (orchestrate.testReplay) : N rejeu(x), dernier code C — k test(s) confirmé(s) vert(s) sur n`): a replay that fails or runs no test confirms nothing, and the line tells a real red from a replay that could not run. Without `testReplay` nothing is replayed.
 Each command has 30 minutes (then its whole process group is killed, code 124). Ctrl-C, SIGTERM or a hangup received by cadence kills the running command and removes the worktree before cadence dies.
 `--sha` is required (the moving head of a wave is not a sha to re-verify) and `--retry` does not apply. Exit code:
-**0** green · **1** red · **2** nothing to replay (neither `orchestrate.build` nor `orchestrate.test`), unknown sha or a worktree that cannot be made.
+**0** green · **1** red · **2** nothing to replay (neither `orchestrate.build` nor `orchestrate.test`), unknown sha, a worktree that cannot be made, or `verify.inPlace: true` with a main tree not clean at the sha.
 The Node of the `.nvmrc` is not selected here: the commands run with the environment of the caller (`PATH` included). `CADENCE_TEST_WORKERS` is set for the build, the tests and the replays, as a wave does (`docs/orchestrate.md`, L350): the value of the caller's environment when it is a positive integer, otherwise cores ÷ session cap (`CADENCE_MAX_SESSIONS`, 2 by default), so a `testReplay` such as `--maxWorkers=$CADENCE_TEST_WORKERS` works from a plain shell.

package/docs/news.md

@@ -201,8 +201,10 @@ else all the `##` headings. The lot is then played like any other, in an ordinar
 implementer rewrites the article in the neighbouring repository, the review checks it against the note). If a lot
 of that title is still open, it receives a note instead of a duplicate. Two entries with the same name (the same
 project told in two neighbouring repositories) share one lot, which declares both repositories in `repos:`. Internal lots (no public title) open nothing;
-a red delivery opens nothing; `cadence deliver --dry-run` announces the articles. The plan is written but **not
-committed** (`deliver` never commits): the line `article à rafraîchir : L9 …` says so. With a plan kept by another
+a red delivery opens nothing; `cadence deliver --dry-run` announces the articles. Outside a wave the plan is written but **not
+committed**: the line `article à rafraîchir : L9 …` says so. During a wave (`cadence deliver --sha`), the plan is committed with the files that `plan.onWrite` produces from it,
+using the `plan.commit` template (`plan: L9 article à rafraîchir ouvert (orchestrate <wave>)` by default), so no plan change is left in the tree a session
+of the wave works in; if the plan or one of those files already had uncommitted changes (the commit would carry them away), or the commit is refused (a `commit-msg` hook), nothing is committed, it stays written and the line says so. With a plan kept by another
 tool (read-only), the same line carries the instruction to open the lot with that tool. This replaces the manual
 `sync-site-docs` skill.
 

package/docs/orchestrate.md

@@ -845,7 +845,7 @@ orchestrate:
   test: npm test                         # run by the orchestrator after a work step (optional)
   testReplay: npx vitest run --minWorkers=1 --maxWorkers=$CADENCE_TEST_WORKERS {files}   # replay alone of a red test before it counts (L354, see « A red test is replayed alone »; `cadence verify --gate` applies it too, L387, `docs/deliver.md`); `{files}` required; absent: no replay, nothing held for unstable (optional)
   build: npm run build                   # run BEFORE the tests (L333); both results go to the reviewer, who does not redo them (optional)
-  worktreeDeps: [node_modules, .venv]    # untracked dependencies that `cadence verify --gate` links into its throwaway worktree (L348, `docs/deliver.md`); absent: the ignored folders of every level, as the worktrees of a wave (optional)
+  worktreeDeps: [node_modules, .venv]    # untracked dependencies that `cadence verify --gate` copies into its throwaway worktree (L348, L389; the gate runs in the main tree instead when it is clean at the sha, `verify.inPlace`, `docs/deliver.md`); absent: the `node_modules` of every level are copied, the other ignored folders are linked as in the worktrees of a wave (optional)
   precheck: true                         # default: before the first implementation of a lot with no commit whose title cites a finding or an earlier lot, and whose title or `goal:` cites a finding (`constat`, `revue`, `review`, `audit`) or a plan id (an earlier `L<number>`, also followed by a hyphen as in `L12-L15` or `L12-bis`; any other id such as `Q-CAN5`; `project:L<number>`), a read-only Sonnet session checks whether the deliverable is already in the repository (see below); false skips it, local runs it on claude-local (Ollama) with Sonnet as fallback, for every lot with no commit whatever its title (L296); a lot created after the last code commit of the repository is not pre-checked, local or Sonnet, unless it cites a lot that already has commits (L322)
   accept: npx vitest run -c vitest.acceptation.config.ts   # accept step (see « The accept step »): the dedicated command that runs ONLY the acceptance tests of the lot (optional; without it the step is skipped with a warning)
   maquette: true                         # default: UX review of the mockup between spec and accept (see « The mockup review »); false skips it

package/docs/whats-new.md

@@ -4,6 +4,7 @@
 
 ## In two lines
 
+- **1.17.1**: `cadence deliver --sha` during a wave commits the plan it wrote, nothing else; `verify --gate` no longer turns red for reasons of its throwaway copy and says where it ran; the test suite no longer commits into the repository.
 - **1.17.0**: `cadence orchestrate` refuses a repository holding a `.git/index.lock`; `raf docs-ok` works on a plan kept by another tool; `cadence verify --gate` replays a red test alone, like the gate of a wave.
 - **1.16.1**: publishes 1.16.0 (tagged, never published), plus `raf gantt` counting commits without plan commits, one login check per `orchestrate --continue` launch, and a wider `CHANGELOG.md` conflict settled by worktree integration.
 - **1.16.0**: easier arrival for a team already equipped and for a new user: a `docs/with-your-tools.md` page, `raf --version`, no gap after `raf init`, Claude Code login checked before any write, commit counts without plan commits.
@@ -40,6 +41,8 @@ Each is a paragraph in [docs/whats-new.md](whats-new.md) and a full section in [
 
 The long form of « In two lines » above (the README no longer carries a « What's new » section since L326: it links here). The full history, with the date of each version, is in [CHANGELOG.md](../CHANGELOG.md).
 
+**1.17.1**: three corrections that stop a wave from tripping over its own tools. `cadence deliver --sha` run during a wave commits the plan it wrote for the article to refresh (the `plan.commit` template, `docs/news.md`) instead of leaving it modified in the tree a session of the wave works in, which handed that lot back as « dépôt sale après implement » (L388): the commit holds that plan and the files `plan.onWrite` produces, and nothing else, so a draft or a file you were editing is never swept in; outside a wave, or when the plan or those files already had uncommitted changes, nothing changes. `cadence verify --gate` no longer turns red in its throwaway copy for reasons of the copy itself (L389, `docs/deliver.md`): when the main tree is clean and at the sha, the gate runs there; otherwise it runs in a throwaway worktree whose dependencies are copied instead of linked (links leaving the repository are re-pointed at their live target), so a project whose tests refused a linked `node_modules` or read their data from `/tmp` now gets the verdict of the real tree. The first line of the output says where the gate ran, an in-place gate whose main tree moved meanwhile answers « non probant » (exit 2), and the new `verify.inPlace` key of `cadence.yaml` forces the main tree (`true`) or the copy (`false`). Last, the test suite of cadence no longer commits into the real repository (L391): the fake `claude` of a test used to write `a.txt` and commit `feat(?): travail` there, and it now refuses to write or commit outside a temporary folder.
+
 **1.17.0**: fewer stops that were not the lot's fault. `cadence orchestrate` and its `--dry-run` refuse a repository holding a `.git/index.lock` before writing anything (L385, `docs/orchestrate.md`): the message gives the age of the lock, whether a git process is running, and the `rm` command to remove a stale one. A plan commit that fails (stale lock, refusing hook) now puts the plan back as it was even when the lock blocks the index, where the next lot used to be handed back as a « dépôt sale ». `raf docs-ok` no longer refuses a plan kept by another tool (read-only): the acknowledgement of a `docs.sync` gap is written to `.cadence/docs-ok.yaml` (`L12: { date, reason }`, next to the project's `cadence.yaml`), the plan is never touched, and `raf check`, `raf show`, `cadence lead tour` and `cadence orchestrate` read it; the librarian's brief names that file to commit (L386). `cadence verify --gate` applies `orchestrate.testReplay` like the gate of a wave (L387, `docs/deliver.md`): a red test the output names is replayed alone, twice at most, and a test that passes alone is reported as unstable under load instead of turning the gate red. A red step that names no test prints the last 10 lines of its output, prefixed `  | `. The gate and the replay get `CADENCE_TEST_WORKERS` like a wave's gate (the caller's value, else cores ÷ `CADENCE_MAX_SESSIONS`), so `--maxWorkers=$CADENCE_TEST_WORKERS` works from a plain shell, and a red step says that a replay took place and how many tests it confirmed green.
 
 **1.16.1**: 1.16.0 was tagged but never published: a test added with it (R2 of L377) supposed `raf` installed in the `PATH`, found it on the developer's machine and not on the runner, and the publish run went red, a fault of the test and not of the tool (L384); 1.16.1 publishes it as it stands, so everything listed under 1.16.0 below arrives with it. The test suite no longer depends on a `raf` or a `cadence` installed on the machine (L384, `docs/releasing.md`): the test now has its hook run `raf` from the sources, and the suite removes every installed `raf` and `cadence` from the `PATH` of the tests (the other tools stay), so such a test is red on the lead's machine and in the gate, not only at publication. `raf gantt` counts the commits of a lot as `raf commits` does (L381, `docs/raf.md`): plan commits no longer inflate the commit column nor the tooltip of a bar, a lot whose only commit is `plan: L1 démarré` reads 0, and the filter reads the files of the commits in one `git log` call instead of one `git diff-tree` per commit (about 20 s down to 2 s on 2,700 commits for the Gantt page); a test now holds the same count for `cadence session start` and `close`, and the test that held `raf now` to the lots it shows can now fail. With `--continue`, `cadence orchestrate` reads `claude auth status` once per launch instead of again, up to 20 s each, for every candidate lot of every round (L382, `docs/orchestrate.md`), and the message quoted in `docs/quickstart.md` and `docs/orchestrate.md` no longer nests backticks inside backticks, which broke the Markdown rendering. The worktree integration of `cadence orchestrate` also settles a `CHANGELOG.md` conflict where one lot adds a section under `[Unreleased]` (`### Fixed`) with its entry and the other a bare entry (L383, `docs/orchestrate.md`): the bare entry is filed under the section the other side added, one section title and one entry per lot, instead of handing the lot back; with no single section to file it under, the conflict stays by hand.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sylad/cadence",
-  "version": "1.17.0",
+  "version": "1.17.1",
   "description": "A small, repo-native working method: a versioned plan linked to your commits, a changelog with screenshots, session rituals and deliveries proven by their effect.",
   "license": "MIT",
   "author": "Sylvain Ladoire",

package/skills/lead/SKILL.md

@@ -193,7 +193,7 @@ is always recorded by the lead's own `raf ux`, never by a subagent.
 2. **The lead re-verifies itself**: `git log` shows the commits, the test suite and build pass when
    run by the lead, `raf check` is clean. During a wave, or in any tree that is not the lead's own, replay the gate at the lot's last sha with
    `cadence verify --gate --sha <sha> [--project <dir>]` (exit 0 green, 1 red with the failing tests, 2 nothing to replay): a bare
-   `git worktree add` has no `node_modules` or `.venv` and reddens suites that only miss their dependencies. A subagent is green on what it *could* test; say plainly
+   `git worktree add` has no `node_modules` or `.venv` and reddens suites that only miss their dependencies; the gate runs in the main tree when it is clean at the sha and in a throwaway copy with copied dependencies otherwise, and the first line of the output says which. A subagent is green on what it *could* test; say plainly
    what nobody could verify.
 3. Fix or re-delegate what the review found; then record the verdict, `raf review <lot> "…"` with
    the code reviewer's last line brought up to date (and `raf ux <lot> "…"` for a visible lot, with