@sylad/cadence 1.25.1 → 1.26.0

package/.claude-plugin/marketplace.json

@@ -8,7 +8,7 @@
     {
       "name": "cadence",
       "description": "Session start and close rituals driven by a versioned plan (raf), and deliveries proven by their effect. Needs the cadence CLI (npm i -g @sylad/cadence).",
-      "version": "1.25.1",
+      "version": "1.26.0",
       "source": "./",
       "author": {
         "name": "Sylvain Ladoire"

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "cadence",
   "description": "A repo-native working method: session start and close rituals driven by a versioned plan (raf), deliveries proven by their effect, and three reviewer agents (UX, code, QA).",
-  "version": "1.25.1",
+  "version": "1.26.0",
   "author": { "name": "Sylvain Ladoire" },
   "homepage": "https://github.com/Sylad/cadence",
   "repository": "https://github.com/Sylad/cadence",

package/README.md

@@ -52,7 +52,7 @@ Details: [docs/skills.md](docs/skills.md) and [docs/cadence-hud.md](docs/cadence
 - [docs/deliver.md](docs/deliver.md): wait for the CI, deploy, verify the effect.
 - [docs/spec.md](docs/spec.md): screen and back-end sheets.
 - [docs/ref.md](docs/ref.md): reference documents (specs, norms, mock-ups) and the coverage of their elements by the lots.
-- [docs/lead.md](docs/lead.md): the lead workflow.
+- [docs/lead.md](docs/lead.md): the lead workflow, and the `livreur` agent that delivers a ready lot for it.
 - [docs/overview.md](docs/overview.md): the longer introduction and the map of every page.
 - [docs/fonctionnement.md](docs/fonctionnement.md): how it all works, in four figures.
 - [docs/stabilite.md](docs/stabilite.md): what is guaranteed from 1.0.0.

package/agents/livreur.md

@@ -0,0 +1,69 @@
+---
+name: livreur
+description: Delivery agent of the lead. For ONE ready lot and one sha given by the lead, runs the chain `cadence verify --gate --sha`, UX verdict according to `lead.ux`, `raf done` and its plan commit, push of the sha alone, `cadence deliver --dry-run` then `cadence deliver`, and hands back one line (« L84 livré 3d6edf4, QA à lancer <url> ») or one question (a line that starts with « Question »). Launches no agent, asks the human nothing, never launches the qa-reviewer (the lead does, after the line). Called by the lead, one delivery at a time per repository.
+tools: Read, Grep, Glob, Bash
+---
+
+You deliver one ready lot for the lead. You write no code: you run the delivery commands in order and hand back one line.
+
+## The brief
+
+You deliver ONE lot per launch: the lot of the brief, at the sha of the brief, never a second lot, and you never work out the « livrable jusqu'à » sha yourself (the lead gives it). The brief carries: the absolute project folder, the lot id, the sha to deliver, the value of `lead.ux` (`lead` or `human`), the base URL of the delivered app (the lead reads it in the `deliver` configuration of `cadence.yaml`), and, for a visible lot with `lead.ux: lead`, the report of the `ux-reviewer` and the absolute folder of its captures. Work in the project folder.
+
+You launch no agent and ask the human nothing: when something is ambiguous, you stop and hand it back to the lead as a question (see Questions).
+
+## Before any command
+
+Check the brief and the sha first. If one check fails, launch neither verify, nor `raf done`, nor a push, nor deliver: hand back a question that names what is missing or what is closed.
+
+1. Complete brief: project folder, lot id, sha, `lead.ux` value. Otherwise `Question : brief incomplet : <champ> absent`. The base URL is not judged here: whether the delivery needs it depends on `origin/main`, read only after the fetch (check 4). The report and the captures of the `ux-reviewer` are not judged here either: whether the lot needs them is known once `raf show` says it is visible, and their absence is a doubt on the UX verdict (see The UX verdict), not an incomplete brief.
+2. The lot (`raf show <lot>`): a lot unknown to the plan gives `Question : raf show refusée au sha <sha> : <message de la commande>`. A lot already done is not answered yet: `raf done` comes before the push and the deliver, so a done lot may be a delivery that stopped after it; check 7 weighs both proofs first.
+3. Run `git fetch origin main` (if `git fetch origin main` fails, hand back the « étape refusée » question of Questions; read `origin/main` only after it).
+4. The QA decision: `git diff --name-only origin/main..<sha>`, the whole interval that the delivery pushes and deploys, not the last commit alone (an earlier commit of the lot may change a page or an API). Read it here, right after the fetch and before the gate, `raf done` and the push: after `git push origin <sha>:main`, `origin/main` is the sha and the interval is empty. When the list holds docs, the plan or tests only, over the whole interval: no QA is due, the line will end with « pas de QA à lancer ». As soon as one file of the interval touches a page or an API: a QA pass is due and the line carries the base URL of the brief; a brief without the base URL then gives `Question : brief incomplet : URL de base absente`, before any action. Keep the decision for the line.
+5. The sha is an ancestor of the local HEAD: `git merge-base --is-ancestor <sha> HEAD`. Otherwise `Question : sha <sha> non livrable : pas un ancêtre de HEAD`.
+6. No commit between `origin/main` and the sha cites a lot other than the lot of the brief that is not done (ready but not yet done counts too): `git log origin/main..<sha>` and `raf show` of each lot cited. A commit that cites no lot, or the plan alone, passes. Otherwise `Question : sha <sha> non livrable : commit du lot <autre> non prêt dessous`.
+7. The sha is not already delivered. « Already delivered » means exactly: the sha is an ancestor of `origin/main` AND present in the delivery log of `cadence deliver` (`deliveries.log`, one line « day sha » in `<git rev-parse --git-common-dir>/cadence/`; compare the full sha or its prefix).
+   - Both proofs: `Question : <lot> déjà clos ou sha <sha> déjà livré (origin/main et journal)`: nothing left to do.
+   - Lot done and neither proof: say what is measured, never « déjà livré »: `Question : <lot> clos mais sha <sha> ni dans origin/main ni au journal : push et livraison restent à faire`; rerun nothing (`raf done` is already done, the push and the deliver are the lead's call).
+   - Only one of the two: say which proof is missing and rerun nothing: neither `raf done` nor `cadence deliver`. `Question : sha <sha> non livrable : dans origin/main sans le journal` (pushed, never delivered) or `Question : sha <sha> non livrable : au journal sans être dans origin/main`. The log keeps the sha declared by the delivery script (`CADENCE_DEPLOYED_FILE`) when it declares one, so a successful delivery that declared another commit shows as « pushed, never delivered »: that too is a question, nothing rerun.
+   - The lot being done does not change the choice of the message: it is picked from the two proofs, evaluated for a done lot too.
+   - A rerun after a successful delivery never does `raf done` again.
+
+## The chain
+
+In this order; no step is skipped or swapped.
+
+1. `cadence verify --gate --sha <sha>`. Read its exit code without a pipe (never `| tail`, which hides it): run it alone and read `$?`. Exit 0 (green): go on. Exit 1 (red) or 2 (nothing to replay): run neither `raf done`, nor a push, nor `cadence deliver`; hand back `Question : verify --gate rouge au sha <sha> : <tests en échec>` for 1, `Question : verify --gate au sha <sha> : rien à rejouer (code 2)` for 2.
+2. The UX verdict, for a visible lot: `raf ux <lot> "…"` when the case allows it (see The UX verdict).
+3. `raf done <lot>`. It prints a `git add` / `git commit` command: run exactly the `git add` / `git commit` command that `raf done` prints (same paths, same subject). If `raf done` warns « intégration en cours »: commit the plan at once, with no other write in the tree. Do not push the commit of the plan: it stays above `origin/main` for the lead, who pushes it after its own replay (the `pre-push` hook).
+4. `git push origin <sha>:main`: the sha alone, never `HEAD`.
+5. `cadence deliver --dry-run --sha <sha>`, then `cadence deliver --sha <sha>`.
+6. Hand back the line (see The line).
+
+Never `--force`, never `CADENCE_PUSH_UNGATED`, no second attempt after a refusal (`raf done`, `pre-push` hook exit 3, `cadence deliver`): stop and hand back `Question : <étape> refusée au sha <sha> : <message de la commande>`.
+
+## The UX verdict
+
+For a visible lot only, after the green gate and before `raf done`. Whether the lot is visible is read in `raf show <lot>`: a visible lot prints a line `visible : oui` (followed by `screen : …` when it has one) and a line `ux : <verdict>` or `ux : absent`; a lot that prints neither line is not visible, there is no UX verdict to form or to check: go on to `raf done`.
+
+- `lead.ux: lead`: open the captures yourself (read the images of the captures folder, one by one) and read the report of the `ux-reviewer`; do not trust the words of the report. Record `raf ux <lot> "…"` with the last line of the report brought up to date, only when the reviewer has no reservation left and the captures show what the lot promised.
+- At the slightest doubt (a reservation you cannot settle, a capture you cannot read, a layout or wording choice that is a matter of taste, a state the captures do not show): records no `raf ux`, closes nothing, hand back `Question : doute sur le verdict UX de <lot> : <réserve> (captures : <chemin>)`.
+- Report or captures missing from the brief, for a visible lot with `lead.ux: lead` (known once `raf show` prints `visible : oui`): the same doubt, one message only: records no `raf ux`, closes nothing, hand back `Question : doute sur le verdict UX de <lot> : rapport ou captures absents du brief (captures : <chemin reçu, ou aucun>)`. Never « brief incomplet » for them.
+- `lead.ux: human` (or no key): never form the verdict yourself. Read the `ux` line of `raf show <lot>`: `ux : <verdict>` says the human's verdict is recorded, go on; `ux : absent` says none is: close nothing and hand back `Question : verdict UX absent pour <lot> (lead.ux: human)`.
+
+## The line
+
+The last thing you hand back is one line, once the delivery is green. The base URL comes from the brief; never deduce or invent it.
+
+- Delivery that changes a page or an API: `<lot> livré <sha court>, QA à lancer <url>` (for instance `L84 livré 3d6edf4, QA à lancer https://app.example`).
+- Delivery that changes neither a page nor an API: `<lot> livré <sha court>, pas de QA à lancer`. The decision is the one of check 4 (`git diff --name-only origin/main..<sha>`, read after `git fetch origin main` and before the push: after `git push origin <sha>:main` the interval is empty): docs, the plan or tests only over the whole interval, no QA; as soon as one file of the interval touches a page or an API: the line carries the URL.
+
+You never launch the `qa-reviewer`: the lead launches it after your line, with the URL it carries.
+
+## Questions
+
+A question starts with « Question : » and fits in a few lines: the step reached, the sha, the cause and the command to rerun. It says the state of the repository left by that step (for instance « raf done fait, commit du plan non fait »): you leave it as the step reached left it, and do not clean up. A step that fails or is refused (`git fetch origin main`, `raf done`, the commit of the plan, the push, `cadence deliver`) is handed back as `Question : <étape> refusée au sha <sha> : <message de la commande>`.
+
+## Never
+
+Never change code, never `raf review`, never `raf start`, never `raf note`; `raf ux` only in the case of the UX verdict. Never push the plan, never `HEAD`, never `--force`, never `CADENCE_PUSH_UNGATED`. Never `git checkout` or `git switch` to another commit or branch in this repository. Launch no agent. Do not stop to ask the human anything: a question goes in your reply to the lead.

package/dist/cli.js

@@ -59,7 +59,7 @@ const HELP = `raf — plan « reste à faire » versionné dans le dépôt, reli
   raf ux <id> "verdict" enregistre la revue d'ergonomie du lot (agent ux-reviewer)
   raf review enable     revue de code obligatoire avant « done » pour les lots qui ont des commits
   raf review <id> "verdict" enregistre la revue de code du lot (agent code-reviewer)
-  raf show <id> [--notes]   le lot : statut, dates, after, titre public, notes datées, commits comptés ; --notes : les notes seules
+  raf show <id> [--notes]   le lot : statut, dates, after, titre public, visible et verdict ux (lot visible), notes datées, commits comptés ; --notes : les notes seules
   raf commits <id>      les commits du lot que compte la porte de revue de code, du plus ancien au plus récent
   raf now               ce qui est en cours, la suite, les derniers terminés
   raf list [--status todo|doing|done|dropped]
@@ -632,8 +632,13 @@ function dispatch(argv, io) {
                 io.out(`after : ${lot.after.join(', ')}`);
             if (lot.public)
                 io.out(`public : ${lot.public}`);
+            // L439 : le livreur lit ici si le lot est visible et s'il porte un verdict UX ; deux lignes stables, absentes d'un lot non visible.
+            if (lot.visible)
+                io.out('visible : oui');
             if (lot.screen)
                 io.out(`screen : ${lot.screen}`);
+            if (lot.visible)
+                io.out(lot.ux ? `ux : ${lot.ux.verdict}` : 'ux : absent');
             if (lot.spec)
                 io.out('spec : true');
             if (lot.uses)

package/docs/lead.md

@@ -64,7 +64,7 @@ picture, not its source.
    build run by the lead, `raf check` clean. A `visible` lot waits for the human to look at the
    UX reviewer's captures: the lead records `raf ux` on the human's verdict, never on its own — unless the parent folder's `cadence.yaml` says `lead.ux: lead`: then the lead forms the verdict from the reviewer's report and its own look at the captures, and asks the human only at the slightest doubt. Then
    `raf done`.
-6. **Delivery.** Push (for a « livrable jusqu'à <sha> », that sha alone, never HEAD), then
+6. **Delivery.** The lead can hand a ready lot to the `livreur` agent (L439, [`agents/livreur.md`](../agents/livreur.md)): one subagent per lot, one at a time per repository, never during the integration of a lot of the wave (`cadence lead tour` shows it). The brief gives the project folder, the lot, the sha to deliver (« livrable jusqu'à »), the value of `lead.ux`, the base URL of the delivered app and, for a visible lot with `lead.ux: lead`, the `ux-reviewer`'s report and the folder of its captures. The `livreur` checks the brief and the sha first (the sha is an ancestor of HEAD, no commit of a lot that is not done below it, not already in `origin/main`; « already delivered » means in `origin/main` AND in the delivery log `deliveries.log`), then runs `cadence verify --gate --sha`, the UX verdict (`raf ux` only with `lead.ux: lead`, on the captures it opens itself, nothing at the slightest doubt; with `lead.ux: human` it only reads that a verdict is recorded: `raf show <lot>` prints `visible : oui` and `ux : <verdict>` or `ux : absent` for a visible lot), `raf done` and the plan commit that `raf done` prints, `git push origin <sha>:main`, `cadence deliver --dry-run --sha` then `cadence deliver --sha`. It pushes neither the plan commit (the lead pushes it after its own replay) nor `HEAD`, uses neither `--force` nor `CADENCE_PUSH_UNGATED`, and retries nothing after a refusal. It hands back one line, `L84 livré 3d6edf4, QA à lancer <url>` (or `…, pas de QA à lancer` when `git diff --name-only origin/main..<sha>`, read right after `git fetch origin main` and before the gate and the push — after the push the interval is empty — lists docs, the plan or tests only; when it touches a page or an API, a brief without the base URL is refused there, before any action), or one `Question : …` naming the step reached, the sha, the cause and the command to rerun. The lead launches the `qa-reviewer` itself with that URL; `raf review` stays with the lead. Otherwise the lead delivers itself: push (for a « livrable jusqu'à <sha> », that sha alone, never HEAD), then
    `cadence deliver`. Where the project declares a gate, the `pre-push` hook refuses a sha with no green verdict of
    `cadence verify --gate` (L426): the lot's sha has the verdict of the re-check, the plan commit above it (the head of `main`
    after `raf done` and its commit) changes only the plan and takes that verdict (L432); a commit that also touches another file (a release commit, say) has none and gets a full replay with `cadence verify --gate --sha HEAD` before the push;

package/docs/raf.md

@@ -68,7 +68,7 @@ raf gantt                         # .cadence/gantt.html (next to the plan)
 | `raf note <id> "text"` | dated note — keep decisions next to the work |
 | `raf title <id> "new title"` | replace the title of a lot of any status (`done` included) and add a dated note « titre remplacé : « old title » »; `raf now`, `raf show`, `raf list`, `session start` and the proposals read the new one. Refused on an empty or identical title, an unknown lot or a sub-task |
 | `raf archive [--before date] [--dry-run]` | move the `done` and `dropped` lots (those finished strictly before `--before`, when given; a lot with no `finished:` date stays then) out of the FILE `.cadence/raf.yaml` into `.cadence/archive/<year>.yaml`, the year of their end (L396). **The archive is a storage detail, invisible to every reader**: the loaded plan presents all the lots, active and archived, **in the order they had before the archiving** — each archived lot takes its place by number among the lots of the plan file (just before the first active lot with a greater number), the order of the plan file itself never moves — so `raf show`, `raf list`, `raf commits`, `raf check`, `raf now`, `raf gantt`, `cadence news`, `cadence perf`, `session start`, `lead tour`, `cadence ref coverage`, `cadence deliver`, the post-commit hook and `cadence orchestrate` print exactly what they printed before the archiving — nothing has to « also look in the archive », a lot id is never reused, and a commit or a News entry citing an archived lot is not « inconnu ». What changes is the file: the plan the sessions open stays short (the cadence plan weighed 559 KB, ≈ 150 k tokens) and the briefs of the implementation, the sheets, the code review and the pre-check tell the sessions never to open `.cadence/archive/`. **Writing**: every lot goes back to the file it came from — `raf note`, `raf review`, `raf ux`, `raf title`… on an archived lot rewrite its year file, the plan file is untouched; a lot reopened (`raf todo <id>`, or `status: doing` set by hand in a year file) comes back to the end of the plan file at the next write, so the archive only ever holds `done` and `dropped` lots. **Lossless, whatever fails**: the year files are written before the plan file (should the plan then fail to write, a moved lot is at worst duplicated — which the next load refuses by name — never lost), and any exception during the write (`EACCES` on a read-only file, a full disk, a `plan.onWrite` command that fails) puts the plan, the year files and the declared files back as they were — a year file born of that write disappears — and the error says so (`écriture du plan refusée (EACCES, …) — plan et archive inchangés`). **Guards**: a closed lot with an open gap (what `raf check` signals — code review, UX review, docs.sync, News entry…) stays in the plan with the gap as its printed reason (`L1 reste dans le plan : écart ouvert — L1 est visible et terminé sans entrée Nouveautés …`); a lot named in `after:` by another, or counted by a `gate:`, is archived like any other — the readers see the archive, so the dependency and the count read the same. A same id found in two files (plan and archive, or two years) is a named error that stops every command (`identifiant en double : L1 est dans .cadence/archive/2025.yaml et dans .cadence/raf.yaml`) until one copy is removed by hand — never a silent choice of one copy. `--dry-run` lists without writing; `--before` takes `YYYY-MM-DD`; refused on a read-only plan (its tool keeps its own history) and while the plan is still at the legacy `docs/plan/raf.yaml` (the archive would land under `docs/`, published, and `raf migrate` would not move it: `raf migrate` first, the refusal says so). For `cadence orchestrate`, the year files are plan files like `.cadence/raf.yaml`: a session that commits one has « touché le plan ». Like every plan write, it is not committed: the command to commit the plan and the archive files together, at explicit paths, is printed (`plan.commit` template, action `N lot(s) archivé(s)`); replaying moves nothing twice. The archive files are kept with the plan: touching them is not working on a lot. **The published plan**: a generator run by `plan.onWrite` (below) that reads only the file `.cadence/raf.yaml` publishes a plan without the archived lots; `raf archive` says so on stderr when `plan.onWrite` is declared, the generator must also read `.cadence/archive/*.yaml` (key `lots`, same lot format as the plan) |
-| `raf show <id> [--notes]` | one lot: status, dates, `goal : …` right after the title when the lot has a `goal:` (native key or `plan.fields.goal`, L272: the objective that replaces the title in the `orchestrate` briefs), `after`, public title, `screen` and `spec`, `uses : banc, passerelle` when the lot has `uses:`, dated notes in order, then the counted commits (as `raf commits`, neighbouring repositories included); `--notes` prints the notes alone |
+| `raf show <id> [--notes]` | one lot: status, dates, `goal : …` right after the title when the lot has a `goal:` (native key or `plan.fields.goal`, L272: the objective that replaces the title in the `orchestrate` briefs), `after`, public title, then for a visible lot two stable lines — `visible : oui` (followed by `screen : …` when the lot has one) and `ux : <verdict>` or `ux : absent` (the `raf ux` verdict, L439: what the `livreur` agent reads before closing a visible lot; a lot that is not visible prints neither line), `spec`, `uses : banc, passerelle` when the lot has `uses:`, dated notes in order, then the counted commits (as `raf commits`, neighbouring repositories included); `--notes` prints the notes alone |
 | `raf commits <id>` | the commits counted for a lot (the set the code review gate uses), one `<sha> <subject>` per line, oldest first; a lot that declares `repos:` ([neighbouring repositories](orchestrate.md#a-lot-whose-work-is-in-a-neighbouring-repository)) gets, after them, one `dépôt <path> :` section per neighbour with the commits there that cite the lot and fall within the lot's period (`started` to `finished`) and, when the lot declares a `cite:` for that neighbour, contain that string (`aucun commit du lot`, or `introuvable` for a path that is not there) |
 | `raf now` | what to do next |
 | `raf list [--status s]` | flat list |

package/docs/skills.md

@@ -10,7 +10,7 @@ As a plugin:
 ```
 
 gives `/cadence:session-start`, `/cadence:session-close`, `/cadence:deliver`,
-`/cadence:lead`, `/cadence:orchestrate` and the `ux-reviewer`, `code-reviewer` and `qa-reviewer` agents. Or copy them into the
+`/cadence:lead`, `/cadence:orchestrate`, the `ux-reviewer`, `code-reviewer` and `qa-reviewer` agents and the `livreur` delivery agent. Or copy them into the
 repository with `cadence skills install` (to `.claude/skills/cadence-*` and
 `.claude/agents/cadence-*.md`; `--dir` for another `.claude` folder,
 `--force` to overwrite local edits).
@@ -82,6 +82,7 @@ repository with `cadence skills install` (to `.claude/skills/cadence-*` and
   other did not, each with the rendered page and a crop of its zone, and answers `confirme` or `ecarte` with a reason, measuring with
   `cadence ref measure` rather than by eye and never guessing (what it cannot tell is `ecarte`). Its tools are `Read` and `Bash`: it writes nothing and never sees the readings
   ([ref](ref.md#cadence-ref-analyse-documentpdf---sections-3-59---slug-name---model-sonnetopushaiku---model-b-sonnetopushaiku---seuil-30---double)).
+- **livreur** (agent, L439): the lead's delivery agent. Given one ready lot, its sha and the base URL of the app, it checks the sha (ancestor of HEAD, no lot that is not done below it, not already in `origin/main`), then runs `cadence verify --gate --sha`, the UX verdict according to `lead.ux`, `raf done` with the plan commit it prints, `git push origin <sha>:main` and `cadence deliver`, and hands back one line (`L84 livré 3d6edf4, QA à lancer <url>`) or one `Question : …`. Its tools are `Read`, `Grep`, `Glob` and `Bash`: no `Agent`, no `Edit`, no `Write`; it never launches the `qa-reviewer`, `raf review` or a force push ([lead](lead.md)).
 - **qa-reviewer** (agent): any web app (read-only like `ux-reviewer`: same tool list, no `Edit`, no `Write`); given a repository and a base URL (and
   optionally a lot id, to walk only the pages it touched — those that call the
   changed endpoints, those of the screens it changed, the pages that consume the services the lot changed,

package/docs/whats-new.md

@@ -4,6 +4,7 @@
 
 ## In two lines
 
+- **1.26.0**: a new `livreur` agent delivers a ready lot for the lead (gate, UX verdict, `raf done`, push, deliver) and hands back one line; `raf show` prints `visible` and `ux` for a visible lot.
 - **1.25.1**: publishes 1.25.0 (tagged, never published); tests now pass in a fresh clone and `cadence release` replays them in one; the panel of lots shows each project's last delivery.
 - **1.25.0**: the panel of lots shows pending decisions, each lot's cycle and its budget and time overrun; `orchestrate --status` is compact; reviewers answer in 5 lines; `--resume --integrate` waits for a live wave.
 - **1.24.0**: a push whose test gate is not green is refused; a wave counts the sessions the lead declared; a ready lot waits for its wave's integration; the `implement` brief gains « Limits and rules »; `plan.onWrite` errors read clearly.
@@ -52,6 +53,8 @@ Each is a paragraph in [docs/whats-new.md](whats-new.md) and a full section in [
 
 The long form of « In two lines » above (the README no longer carries a « What's new » section since L326: it links here). The full history, with the date of each version, is in [CHANGELOG.md](../CHANGELOG.md).
 
+**1.26.0**: the lead hands the delivery of a ready lot to a subagent. The `livreur` agent (L439, installed by `cadence skills install` like the others) takes one ready lot and one sha given by the lead, and runs `cadence verify --gate --sha`, the UX verdict according to `lead.ux`, `raf done` and the plan commit it prints, `git push origin <sha>:main` and `cadence deliver`, then hands back one line (`L84 livré 3d6edf4, QA à lancer <url>`) or one `Question : …`. It first checks that the sha is an ancestor of HEAD, has no lot that is not done below it and is not already in `origin/main` and in the delivery log; it launches no agent, never the `qa-reviewer` (the lead does, after the line), and the lead launches one `livreur` at a time (`docs/lead.md`). A relaunch on a lot already done weighs both proofs (`origin/main` and `deliveries.log`), so « pushed, never delivered » is no longer masked by « déjà clos ». It reads `git diff --name-only origin/main..<sha>` right after `git fetch origin main`, before the gate and the push, to decide whether a QA pass is due and refuses a brief without the base URL before any action. `raf show <lot>` prints two new stable lines for a visible lot, `visible : oui` (then `screen : …` when the lot has one) and `ux : <verdict>` or `ux : absent` (`docs/raf.md`): that is how the `livreur` knows whether the lot is visible and whether the human's UX verdict is recorded (`lead.ux: human`).
+
 **1.25.1**: publishes 1.25.0 and closes the hole that kept it from reaching npm. The `v1.25.0` tag was pushed but its `publish` workflow failed in `test/hud-cycle`, `test/hud-deliveries` and `test/hud-depense-l414`: vitest read `plugins/cadence-hud/tsconfig.json`, which extends `.claude-plugin/types/tsconfig.json`, a file Claude Code writes when it loads the mod and git does not track, so no local tree could see it fail (L445); the tag is not rewritten, everything 1.25.0 brings (see below) ships in this version. The test suite now passes in a fresh `git clone` (the mod's own typecheck still extends that file). `cadence release` prints, right after the gate replay, a step that replays the version commit in a fresh `git clone --no-hardlinks` (`npm ci`, `npm run typecheck`, `npm test`, the clone removed afterwards), and `.github/workflows/tests.yml` also runs on every push to `main` (L446, `docs/releasing.md`). The panel of lots (`/hud lots`, `docs/cadence-hud.md`) shows, under the lots in progress, the last delivery of each project: its short sha, its age in days, green or red (read from the journal `cadence deliver` writes), and the lots closed since the last green delivery that were not delivered; `cadence lead tour --json` gains `closed`, the closed lots of a project with their closing day (L415).
 
 **1.25.0**: the lead reads less and waits less. The panel of lots (`/hud lots`, `docs/cadence-hud.md`) opens with « ce qui attend une décision » — the questions of the sessions with their `--answer` command, the lots handed back with their cause, the UX verdicts to record and the failed deliveries, each with a command that runs as pasted (L412) — and draws under each lot a wave carries the cycle of the lot as a strip, from `fiche` to `prêt` then `revue posée → clos → livré`, the current stage in bold with its duration and passes (L413). For each lot in progress it shows the tokens consumed over the lot's budget and the elapsed time next to the usual time of a lot of that size, with a `⚠` on an overrun (budget exceeded, or more than 1.5 times the usual time); `cadence perf --json` gains `lotMinutes`, the median wall time per size class (L414). `cadence orchestrate --status` prints a compact table, one line per lot, and `--status [<wave>] --detail <project:lot>` prints the detail of one lot, which cost the lead 5 to 10 k tokens per read (L441); `code-reviewer` and `qa-reviewer` answer in 5 lines at most and write the full report to the file named by a `Report file: <path>` line of the brief (L440). A wave no longer leaves slots idle while it has nothing left to play (L433), `cadence orchestrate --resume --integrate|--replay` waits, for 3 hours at most, for a live wave that holds the repository instead of exiting 2 (L443), and `cadence verify --gate --sha <sha>` reads the gate the wave played when only plan commits sit above the checked commit, instead of replaying it for about 5 minutes (L444); the `pre-push` hook takes the same shortcut for a commit that changes only the plan (L432), and `cadence verify --gate` plays in a throwaway copy while a wave is live on the repository (L431). `raf done` now cites the files `plan.onWrite` really wrote, so the proposed `git add` no longer leaves one out (L436).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sylad/cadence",
-  "version": "1.25.1",
+  "version": "1.26.0",
   "description": "A small, repo-native working method: a versioned plan linked to your commits, a changelog with screenshots, session rituals and deliveries proven by their effect.",
   "license": "MIT",
   "author": "Sylvain Ladoire",

package/skills/lead/SKILL.md

@@ -35,8 +35,16 @@ commands (its CLAUDE.md names them), never with `raf start|done|note|ux|review`.
   the human (a trial at 3 was decided on 2026-10-12); if the slots are the bottleneck, say so and let them decide.
 - **Never two subagents in the same repository at the same time**, and the lead does not commit in a
   repository where a subagent is working.
-- **Deliveries and `raf ux` / `raf review` verdicts are done by the lead, one project at a time** —
-  never by a subagent, never two deliveries in parallel.
+- **Deliveries and `raf ux` / `raf review` verdicts are done by the lead, one project at a time, or by the `livreur` agent it
+  launches** (L439): the delivery and, with `lead.ux: lead`, `raf ux` may be done by the `livreur`; `raf review` stays with the
+  lead. Launch one `livreur` at a time: never two deliveries in parallel, and each `livreur` counts in the cap of subagents. Only another
+  `livreur` or another subagent blocks a new one; the sessions of a running wave do not (a ready lot is delivered while the wave runs,
+  section 2b). Never launch a `livreur` while the wave integrates a lot (`cadence lead tour` shows it): `raf done` would write the plan
+  of the main tree, which that integration refuses as modified. Brief: the absolute project folder, the lot, the sha to deliver
+  (« livrable jusqu'à »), the value of `lead.ux`, the base URL of the delivered app (the `deliver` configuration of `cadence.yaml`),
+  and for a visible lot with `lead.ux: lead` the `ux-reviewer`'s report and the folder of its captures. It hands back one line
+  (`L84 livré 3d6edf4, QA à lancer <url>`) or one `Question : …`; the lead itself launches the `qa-reviewer` with the URL of the line
+  (section 4), then the `livreur` of the next ready lot.
 - A subagent cannot ask the human anything. When it hits an ambiguity it stops and reports; the lead
   brings the question to the human.
 
@@ -179,7 +187,7 @@ reviewer's last line brought up to date. It does so only when the reviewer has n
 what the lot promised. At the **slightest doubt** — a reservation of the reviewer it cannot settle, a capture it cannot read,
 a layout or wording choice that is a matter of taste, a state the captures do not show — it records nothing, brings the
 captures and the question to the human, and the chain goes on with the other lots as for any UX reservation. The verdict
-is always recorded by the lead's own `raf ux`, never by a subagent.
+is recorded by the lead's own `raf ux` or, for a lot it hands over, by the `livreur` on the same criterion (it opens the captures itself and records nothing at the slightest doubt).
 
 ## 3. Check
 
@@ -217,7 +225,7 @@ is always recorded by the lead's own `raf ux`, never by a subagent.
 
 ## 4. Delivery
 
-One project at a time, by the lead: push, then the `deliver` skill (`cadence deliver --dry-run`, then
+One project at a time, by the lead or, for a ready lot it hands over, by the `livreur` agent (« Limits that always apply »): push, then the `deliver` skill (`cadence deliver --dry-run`, then
 `cadence deliver`). Follow the human's standing instructions about confirmation before production.
 
 **The sha pushed needs a green verdict of the gate (L426).** Where the project declares a gate (`orchestrate.test` or