cohorte 1.0.0 → 1.1.0

package/dashboard/server/metrics.js

@@ -0,0 +1,94 @@
+'use strict';
+// Read a project's `.claude/pipeline-metrics.jsonl` (one line per phase batch, appended by
+// /build, /review, /fix and /smoke) and aggregate it per feature: wall-clock per phase, fix
+// rounds, and per-surface results. Dependency-free; a missing file is simply "no data yet".
+//
+// Two line formats coexist in the file:
+//   new    {"ts","feature","phase","seconds",surfaces:{"<key>":"ok|error"|"<verdict>:<count>"}}
+//   legacy {"ts","feature","phase","surface","seconds","result"}  — one line PER surface;
+//          legacy lines are grouped by ts+feature+phase into one batch (wall-clock = max).
+
+const fs = require('fs');
+const path = require('path');
+
+const PHASES = ['build', 'review', 'fix', 'smoke'];
+
+// Parse the raw JSONL into normalized batches ({ts, feature, phase, seconds, surfaces}),
+// skipping malformed lines. Legacy per-surface lines are folded into their batch.
+function parseBatches(raw) {
+  const batches = [];
+  const legacy = new Map(); // "ts|feature|phase" → batch (legacy lines share the key)
+  for (const line of raw.split(/\r?\n/)) {
+    if (!line.trim()) continue;
+    let e;
+    try { e = JSON.parse(line); } catch { continue; }
+    if (!e || typeof e !== 'object' || !e.feature || !e.phase) continue;
+    const seconds = Number(e.seconds) || 0;
+    if (e.surfaces && typeof e.surfaces === 'object') {
+      batches.push({ ts: e.ts || '', feature: String(e.feature), phase: String(e.phase), seconds, surfaces: e.surfaces });
+    } else if (e.surface) {
+      const key = `${e.ts}|${e.feature}|${e.phase}`;
+      let b = legacy.get(key);
+      if (!b) {
+        b = { ts: e.ts || '', feature: String(e.feature), phase: String(e.phase), seconds: 0, surfaces: {} };
+        legacy.set(key, b);
+        batches.push(b);
+      }
+      b.surfaces[String(e.surface)] = e.result == null ? '' : String(e.result);
+      b.seconds = Math.max(b.seconds, seconds); // batch wall-clock = the slowest surface
+    }
+    // lines with neither `surfaces` nor `surface` are malformed → skipped
+  }
+  return batches;
+}
+
+// A surface result string counts as a failure when it is "error" or a BLOCK/REVISE verdict
+// (verdict lines look like "REVISE:2"), or a non-ok/pass word.
+function isFailure(result) {
+  const head = String(result).split(':')[0].trim().toLowerCase();
+  return head !== '' && head !== 'ok' && head !== 'ship' && head !== 'pass';
+}
+
+// Aggregate batches per feature (newest feature first).
+function aggregate(batches) {
+  const byFeature = new Map();
+  for (const b of batches) {
+    let f = byFeature.get(b.feature);
+    if (!f) {
+      f = {
+        feature: b.feature,
+        firstTs: b.ts, lastTs: b.ts,
+        totalSeconds: 0,
+        fixRounds: 0,
+        phases: {}, // phase → { seconds, rounds }
+        surfaces: {}, // surface → { phase → latest result }, plus failure count
+      };
+      byFeature.set(b.feature, f);
+    }
+    if (b.ts && (!f.firstTs || b.ts < f.firstTs)) f.firstTs = b.ts;
+    if (b.ts && b.ts > f.lastTs) f.lastTs = b.ts;
+    f.totalSeconds += b.seconds;
+    const ph = f.phases[b.phase] || (f.phases[b.phase] = { seconds: 0, rounds: 0 });
+    ph.seconds += b.seconds;
+    ph.rounds += 1;
+    if (b.phase === 'fix') f.fixRounds += 1;
+    for (const [key, result] of Object.entries(b.surfaces)) {
+      const s = f.surfaces[key] || (f.surfaces[key] = { results: {}, failures: 0 });
+      s.results[b.phase] = result; // batches are appended in order → last write is the latest
+      if (isFailure(result)) s.failures += 1;
+    }
+  }
+  return [...byFeature.values()].sort((a, b) => (b.lastTs || '').localeCompare(a.lastTs || ''));
+}
+
+function metrics({ projectRoot }) {
+  const file = path.join(projectRoot, '.claude', 'pipeline-metrics.jsonl');
+  let raw;
+  try { raw = fs.readFileSync(file, 'utf8'); }
+  catch { return { present: false, phases: PHASES, features: [], batches: 0 }; }
+
+  const batches = parseBatches(raw);
+  return { present: true, phases: PHASES, features: aggregate(batches), batches: batches.length };
+}
+
+module.exports = { metrics };

package/install.ps1

@@ -143,6 +143,7 @@ try {
         Copy-Item (Join-Path $src 'profile\SCHEMA.md')            (Join-Path $dest 'pipeline') -Force
         Copy-Item (Join-Path $src 'profile\cohorte.config.template.yaml') (Join-Path $dest 'pipeline') -Force
         Copy-Item (Join-Path $src 'scripts\*.template')           (Join-Path $dest 'pipeline\scripts') -Force
+        Copy-Item (Join-Path $src 'scripts\kanban-move.sh')       (Join-Path $dest 'pipeline\scripts') -Force
         Copy-Item (Join-Path $src 'core\agents\implementer.template.md') (Join-Path $dest 'pipeline') -Force
         if (Test-Path (Join-Path $src 'CHANGELOG.md')) { Copy-Item (Join-Path $src 'CHANGELOG.md') (Join-Path $dest 'pipeline') -Force }
         [System.IO.File]::WriteAllText((Join-Path $dest 'pipeline\VERSION'), "$ver`n", [System.Text.UTF8Encoding]::new($false))
@@ -179,7 +180,8 @@ try {
     function Copy-FixedAgents {
         New-Item -ItemType Directory -Force -Path (Join-Path $dest 'agents') | Out-Null
         Copy-Item (Join-Path $src 'core\agents\review.md'),
-                  (Join-Path $src 'core\agents\release.md') (Join-Path $dest 'agents') -Force
+                  (Join-Path $src 'core\agents\release.md'),
+                  (Join-Path $src 'core\agents\smoke.md') (Join-Path $dest 'agents') -Force
         # 0.1.19 split the bi-mode questionnaire-researcher into research-agent + questionnaire-architect;
         # copy-over never deletes, so scrub the retired agent lest a dead subagent_type linger.
         Remove-Item -LiteralPath (Join-Path $dest 'agents\questionnaire-researcher.md') -Force -ErrorAction SilentlyContinue

package/install.sh

@@ -85,6 +85,8 @@ copy_core() {
   cp "$src/profile/SCHEMA.md"            "$dest/pipeline/"
   cp "$src/profile/cohorte.config.template.yaml" "$dest/pipeline/"
   cp "$src"/scripts/*.template           "$dest/pipeline/scripts/"
+  cp "$src/scripts/kanban-move.sh"       "$dest/pipeline/scripts/"
+  chmod +x "$dest/pipeline/scripts/kanban-move.sh" 2>/dev/null || true
   cp "$src/core/agents/implementer.template.md" "$dest/pipeline/"
   [ -f "$src/CHANGELOG.md" ] && cp "$src/CHANGELOG.md" "$dest/pipeline/"
   printf '%s\n' "$ver" > "$dest/pipeline/VERSION"
@@ -125,6 +127,7 @@ PY
 copy_fixed_agents() {
   mkdir -p "$dest/agents"
   cp "$src/core/agents/review.md" "$src/core/agents/release.md" \
+     "$src/core/agents/smoke.md" \
      "$dest/agents/"
   # 0.1.19 split the bi-mode questionnaire-researcher into research-agent + questionnaire-architect;
   # copy-over never deletes, so scrub the retired agent lest a dead subagent_type linger.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cohorte",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Portable, stack-agnostic multi-agent development pipeline for Claude Code — install the core, run /init-pipeline, and it adapts to your project's stack.",
   "bin": {
     "cohorte": "bin/cli.js"

package/profile/PIPELINE.template.md

@@ -69,7 +69,10 @@ surfaces:
     label: frontend (React/TanStack)
     agent: frontend
     tools: [Read, Write, Edit, Bash, Grep, Glob, DesignSync, mcp__serena]
-    model: inherit                            # this surface makes real design decisions ⇒ worth the lead's model
+    model: sonnet                             # default even for design surfaces — designs + contract are
+                                              #   frozen inputs the agent applies; `inherit` (bills at the
+                                              #   lead's tier, often Opus) ONLY if this surface must make
+                                              #   novel design decisions
     test_cmd: pnpm --filter web test
     lint_cmd: pnpm --filter web lint
     format_cmd: pnpm --filter web format

package/profile/SCHEMA.md

@@ -155,16 +155,16 @@ the frozen contract as the only cross-surface channel**. So specialization means
 
 Coarse first, specialize on evidence: start with one `frontend` / `backend` surface each; split only a
 surface that's proven slow and cleanly separable. The evidence lives in
-`.claude/pipeline-metrics.jsonl` (gitignored) — one JSONL line per dispatched agent
-(`ts`/`feature`/`phase`/`surface`/`seconds`/`result`), appended by `/build`, `/review`, `/fix` and
-`/smoke`. Read it before proposing a split: split the surface that actually dominates wall-clock,
+`.claude/pipeline-metrics.jsonl` (gitignored) — one JSONL line per phase batch
+(`ts`/`feature`/`phase`/`seconds`/`surfaces:{key: result}`), appended by `/build`, `/review`, `/fix`
+and `/smoke`. Read it before proposing a split: split the surface that actually dominates wall-clock,
 not the one that feels big.
 
 ## Measuring cost — what's slow vs what's expensive
 
-`pipeline-metrics.jsonl` records **wall-clock seconds** per dispatch (§Specialization) — it tells you what's
-SLOW. It deliberately does NOT record tokens: the lead can't reliably read a subagent's token count to log
-it. For what's EXPENSIVE, use Claude Code's own accounting:
+`pipeline-metrics.jsonl` records **wall-clock seconds** per phase batch (§Specialization) — it tells you
+what's SLOW. It deliberately does NOT record tokens: the lead can't reliably read a subagent's token count
+to log it. For what's EXPENSIVE, use Claude Code's own accounting:
 
 - **`/cost`** (built-in, zero setup) — reports per-**subagent** and per-**slash-command** share of your usage
   over the last 24 h / 7 d (e.g. _"Top subagents: frontend 7 %, backend 4 % · Top skills: /build 1 %,
@@ -176,6 +176,14 @@ it. For what's EXPENSIVE, use Claude Code's own accounting:
   `session.id` + model + type (input/output/cacheRead). Subagent tokens roll into the session total;
   per-subagent attribution needs traces (`CLAUDE_CODE_ENHANCED_TELEMETRY_BETA=1`, beta).
 
+**Lead context discipline — the silent bill.** The lead session's conversation history is re-sent as
+input on EVERY turn; a session that spans spec→build→smoke→review→fix without clearing re-pays the
+accumulated spec walk-through, handoffs, and reports on each turn. The pipeline is built so this is
+never necessary: every phase handoff (spec, contract, diff, staged reports) lives on disk, so `/clear`
+at each phase boundary is always safe — each command's closing line recommends it. Corollaries the
+commands enforce: never paste a diff into a dispatch (agents compute their own, scoped); never echo a
+staged report or design brief into chat; redirect bulky command output to a file and grep it.
+
 ## Rendering / reconciling a surface agent (shared procedure)
 
 Both `/init-pipeline` (initial render) and `/build` (auto-reconcile when a spec needs a new agent) use
@@ -196,16 +204,18 @@ this exact procedure so a surface is always defined the same way. To add surface
    ones empty unless `uses_design`). For a `uses_design` surface, fill them **link-based** (never with a
    stored `design_project` id — that goes stale on a DS rebuild):
    - `<SURFACE_DESIGN_INPUT>` — a 4th input bullet: _"The **feature design** — the pages this feature
-     touches, listed in the spec front-matter `design_files` as full links
-     (`https://claude.ai/design/p/<projectId>?file=<file>`). For each, extract the `<projectId>` (the
+     touches, listed in your dispatch's design slot as full links
+     (`https://claude.ai/design/p/<projectId>?file=<file>`); a slot saying `none` means a fix loop with
+     no visual work — skip DesignSync entirely. For each link, extract the `<projectId>` (the
      `/p/…` segment) and `<file>` (the `?file=` query) from the URL and read it read-only via `DesignSync
      get_file(<projectId>, <file>)`; `list_files(<projectId>)` to catch linked pages (shared nav/modals)
      this feature also changes. The link is self-contained — no stored project id. Build with the code UI
      kit (the `design_system_project`'s materialization: `@/components/ui/*` + tokens); read a primitive
      via `get_file` only if it's missing/stale in code. Mobile-first."_
-   - `<SURFACE_TDD_STEP1>` — _"**Pull the feature design first:** `DesignSync get_file(<projectId>,
-     <file>)` for each `design_files` link and translate each into the code design system
-     (`@/components/ui/*`, `cn()` + CVA), mobile-first — never ad-hoc CSS. Then:"_
+   - `<SURFACE_TDD_STEP1>` — _"**Pull the feature design first** (skip if your dispatch's design slot
+     says `none`): `DesignSync get_file(<projectId>, <file>)` for each link in the slot and translate
+     each into the code design system (`@/components/ui/*`, `cn()` + CVA), mobile-first — never ad-hoc
+     CSS. Then:"_
 3. **Add a §Conventions + §Testing stanza** for `S` in `PIPELINE.md` (mirror a sibling surface; keep it
    rule-shaped). If `S` is a shared-code surface, its convention is "single owner of shared X; slices
    consume, never redefine."
@@ -270,11 +280,16 @@ Once shipped, `/ship` appends the **PR number** to the card — `- [ ] <title> #
 The bare `#<num>` is what the dashboard renders as a clickable link to the GitHub PR, so `/ship` always
 writes it when a PR was actually created.
 
-**Move a card (the core op).** To move card `#<id>` to a stage's column: find the list item carrying
-`#<id>` under its current `## <column>` heading, delete it there, and append it (whole line, tag
-preserved) under the target `## <column>` heading. If no card carries `#<id>` (feature started outside
-the board), create the card in the target column instead of erroring. One card per `#<id>`; if
-duplicates exist, keep the first and drop the rest.
+**Move a card (the core op).** Use the shipped script — it does the whole op outside the agent's
+context (find, dedupe, sub-notes carried along, settings block preserved):
+`<core>/pipeline/scripts/kanban-move.sh <board.md> <id> <column> [--pr <num>] [--title <title>]`
+where `<core>` is `~/.claude` (global install) or `.claude` (bundled) — probe with `test -x`. It
+creates the card in the target column when none exists, keeps the first and drops duplicates, and
+appends ` — PR #<num>` with `--pr`. **Fallback when the script is absent** (older core): do it by
+hand, but never read the whole board into context — it grows with every feature ever tracked:
+`grep -n` for `#<id>` and the `## ` headings to locate lines, then use offset-limited Reads +
+targeted Edits around the matches. Either way: one card per `#<id>`, whole line moved tag-preserved,
+card created in the target column if missing.
 
 **Stage → column**, used both by each pipeline command (to move its card live) and by backfill:
 

package/scripts/kanban-move.sh

@@ -0,0 +1,88 @@
+#!/bin/sh
+# kanban-move.sh — move a feature card on an Obsidian Kanban board without
+# loading the board into an agent's context (SCHEMA.md §Kanban "Move a card").
+#
+#   kanban-move.sh <board.md> <feature-id> <target-column> [--pr <num>] [--title <title>]
+#
+# Behavior (mirrors the documented manual op):
+#   - finds the list item tagged #<feature-id> (plus its indented sub-notes),
+#     removes it from its current column, appends it under `## <target-column>`
+#   - no card yet ⇒ creates `- [ ] <title|id>  #<id>` in the target column
+#   - duplicates ⇒ keeps the first, drops the rest
+#   - --pr N ⇒ ensures the card line ends with ` — PR #N`
+#   - never touches the front-matter or the trailing `%% kanban:settings %%` block
+# Exit codes: 0 ok · 2 usage · 3 board/column not found.
+set -eu
+
+[ $# -ge 3 ] || { echo "usage: kanban-move.sh <board.md> <feature-id> <column> [--pr <num>] [--title <title>]" >&2; exit 2; }
+board="$1"; id="$2"; col="$3"; shift 3
+pr=""; title=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --pr)    pr="$2"; shift 2 ;;
+    --title) title="$2"; shift 2 ;;
+    *) echo "error: unknown flag $1" >&2; exit 2 ;;
+  esac
+done
+[ -f "$board" ] || { echo "error: board not found: $board" >&2; exit 3; }
+
+tmp="${board}.kanban-move.$$"
+ID="$id" COL="$col" PR="$pr" TITLE="${title:-$id}" awk '
+  BEGIN {
+    id = ENVIRON["ID"]; col = tolower(ENVIRON["COL"])
+    pr = ENVIRON["PR"]; title = ENVIRON["TITLE"]
+    n = 0; card = ""; incard = 0; found = 0; colseen = 0
+  }
+  { lines[++n] = $0 }
+  END {
+    # pass 1: extract the FIRST card block tagged #id; mark every block for removal
+    for (i = 1; i <= n; i++) {
+      l = lines[i]
+      if (l ~ /^- \[.\] / && index(l, "#" id) > 0) {
+        # word-boundary check: char after the tag must not extend the id
+        rest = substr(l, index(l, "#" id) + length(id) + 1, 1)
+        if (rest != "" && rest ~ /[A-Za-z0-9_-]/) continue
+        del[i] = 1
+        if (!found) { found = 1; card = l }
+        for (j = i + 1; j <= n && lines[j] ~ /^[ \t]/; j++) {
+          del[j] = 1
+          if (found && card == lines[i]) sub_notes = sub_notes lines[j] "\n"
+        }
+        i = j - 1
+      }
+    }
+    if (!found) card = "- [ ] " title "  #" id
+    if (pr != "" && index(card, "PR #") == 0) card = card " — PR #" pr
+
+    # pass 2: emit, skipping removed blocks; append the card at the end of the
+    # target column (before the next ## heading / settings block / EOF)
+    intarget = 0; placed = 0
+    for (i = 1; i <= n; i++) {
+      if (del[i]) continue
+      l = lines[i]
+      atheading = (l ~ /^## /)
+      atsettings = (l ~ /^%% kanban:settings/)
+      if (intarget && (atheading || atsettings)) {
+        # back up over trailing blank lines already printed is not possible;
+        # instead print card just before this boundary
+        print card
+        if (sub_notes != "") printf "%s", sub_notes
+        print ""
+        intarget = 0; placed = 1
+      }
+      if (atheading) {
+        h = tolower(l); sub(/^## +/, "", h); gsub(/ +$/, "", h)
+        if (h == col) { intarget = 1; colseen = 1 }
+      }
+      print l
+    }
+    if (intarget && !placed) {
+      print card
+      if (sub_notes != "") printf "%s", sub_notes
+      placed = 1
+    }
+    if (!colseen) exit 3
+  }
+' "$board" > "$tmp" || { rc=$?; rm -f "$tmp"; [ "$rc" = 3 ] && echo "error: column \"$col\" not found in $board" >&2; exit "$rc"; }
+mv "$tmp" "$board"
+echo "moved #$id -> $col${pr:+ (PR #$pr)}"

package/scripts/validate-core.mjs

@@ -0,0 +1,118 @@
+#!/usr/bin/env node
+// Validates the structural invariants of the cohorte core — the things a
+// prose refactor can silently break. Run by CI on every push/PR; run it
+// locally with `node scripts/validate-core.mjs`.
+import { readFileSync, readdirSync, existsSync } from "node:fs";
+import { join } from "node:path";
+
+const root = new URL("..", import.meta.url).pathname;
+const errors = [];
+const fail = (file, msg) => errors.push(`${file}: ${msg}`);
+
+const read = (p) => readFileSync(join(root, p), "utf8");
+const frontmatter = (text) => {
+  const m = text.match(/^---\n([\s\S]*?)\n---\n/);
+  return m ? m[1] : null;
+};
+
+// ── commands ────────────────────────────────────────────────────────────────
+// Mechanical commands must pin model: sonnet (otherwise the lead's
+// orchestration turn silently bills at the session model — Opus/Fable).
+// Interactive commands must stay unpinned (they inherit on purpose).
+const PINNED = ["build", "review", "fix", "smoke", "ship", "audit",
+  "refactor", "doctor", "align-ds", "update-pipeline"];
+const UNPINNED = ["brainstorm", "spec", "init-pipeline"];
+
+for (const f of readdirSync(join(root, "core/commands"))) {
+  const path = `core/commands/${f}`;
+  const fm = frontmatter(read(path));
+  if (!fm) { fail(path, "missing or malformed YAML frontmatter"); continue; }
+  if (!/^description:\s*\S/m.test(fm)) fail(path, "frontmatter lacks a description");
+  const name = f.replace(/\.md$/, "");
+  const pinned = /^model:\s*sonnet\s*$/m.test(fm);
+  if (PINNED.includes(name) && !pinned)
+    fail(path, "mechanical command must carry `model: sonnet` in frontmatter");
+  if (UNPINNED.includes(name) && /^model:/m.test(fm))
+    fail(path, "interactive command must NOT pin a model (inherits the session)");
+}
+
+// ── fixed agents ────────────────────────────────────────────────────────────
+// Every non-template agent needs name/tools/model, and must be shipped by
+// both installers (a new agent that install.sh doesn't copy never reaches
+// a global install — the exact bug that motivated this check).
+const AGENT_MODEL = { review: "sonnet", release: "haiku", smoke: "sonnet" };
+const installSh = read("install.sh");
+const installPs1 = read("install.ps1");
+
+for (const f of readdirSync(join(root, "core/agents"))) {
+  const path = `core/agents/${f}`;
+  const text = read(path);
+  const fm = frontmatter(text);
+  if (!fm) { fail(path, "missing or malformed YAML frontmatter"); continue; }
+  if (f === "implementer.template.md") {
+    for (const ph of ["<SURFACE_AGENT>", "<SURFACE_LABEL>", "<SURFACE_PATH>",
+      "<SURFACE_TOOLS>", "<SURFACE_MODEL>", "<PROJECT_NAME>",
+      "<SURFACE_EXTRA_NEVER>", "<SURFACE_DESIGN_INPUT>", "<SURFACE_TDD_STEP1>"])
+      if (!text.includes(ph)) fail(path, `render placeholder ${ph} disappeared`);
+    continue;
+  }
+  const name = f.replace(/\.md$/, "");
+  if (!/^name:\s*\S/m.test(fm)) fail(path, "frontmatter lacks name");
+  if (!/^tools:\s*\S/m.test(fm)) fail(path, "frontmatter lacks tools");
+  const want = AGENT_MODEL[name];
+  if (want && !new RegExp(`^model:\\s*${want}\\s*$`, "m").test(fm))
+    fail(path, `frontmatter must pin \`model: ${want}\``);
+  if (text.includes("<SURFACE_"))
+    fail(path, "unrendered <SURFACE_*> placeholder in a non-template agent");
+  if (!installSh.includes(`core/agents/${f}`))
+    fail("install.sh", `does not copy core/agents/${f} (copy_fixed_agents)`);
+  if (!installPs1.includes(`core\\agents\\${f}`))
+    fail("install.ps1", `does not copy core\\agents\\${f} (Copy-FixedAgents)`);
+}
+
+// ── cross-references ────────────────────────────────────────────────────────
+// Any `.claude/templates/<x>.md` referenced by a command or agent must exist
+// in core/templates (they resolve to the installed copy of exactly that file).
+const allDocs = [];
+for (const dir of ["core/commands", "core/agents", "core/templates"])
+  for (const f of readdirSync(join(root, dir)))
+    if (f.endsWith(".md")) allDocs.push(`${dir}/${f}`);
+
+for (const path of allDocs) {
+  const text = read(path);
+  for (const m of text.matchAll(/\.claude\/templates\/([a-z0-9.-]+\.md)/g)) {
+    if (!existsSync(join(root, "core/templates", m[1])))
+      fail(path, `references .claude/templates/${m[1]} which is not in core/templates/`);
+  }
+  for (const m of text.matchAll(/subagent_type:\s*(?:`|)([a-z-]+)(?:`|)/g)) {
+    const t = m[1];
+    if (["review", "release", "smoke"].includes(t)) continue;
+    if (t.startsWith("<")) continue; // <surface.agent> placeholder
+    if (!existsSync(join(root, "core/agents", `${t}.md`)))
+      fail(path, `dispatches subagent_type ${t} with no core/agents/${t}.md`);
+  }
+}
+
+// ── profile ─────────────────────────────────────────────────────────────────
+for (const p of ["profile/PIPELINE.template.md", "profile/SCHEMA.md",
+  "profile/cohorte.config.template.yaml"])
+  if (!existsSync(join(root, p))) fail(p, "missing");
+
+const tpl = read("profile/PIPELINE.template.md");
+if (/^\s*model:\s*inherit\b/m.test(tpl))
+  fail("profile/PIPELINE.template.md",
+    "a surfaces[] example pins `model: inherit` — examples must default to sonnet " +
+    "(inherit bills at the lead session's model)");
+
+// ── init-pipeline router steps ──────────────────────────────────────────────
+const steps = join(root, "core/templates/steps/init-pipeline");
+if (!existsSync(steps) || readdirSync(steps).length === 0)
+  fail("core/templates/steps/init-pipeline", "router step files missing/empty");
+
+// ── report ──────────────────────────────────────────────────────────────────
+if (errors.length) {
+  console.error(`validate-core: ${errors.length} error(s)\n`);
+  for (const e of errors) console.error("  ✗ " + e);
+  process.exit(1);
+}
+console.log("validate-core: OK");