cohorte 1.2.2 → 1.2.4

package/CHANGELOG.md

@@ -3,6 +3,52 @@
 Entries are shown by `/update-pipeline` ("What's new") after a core refresh. Keep them short,
 user-facing, most recent first. One `## <version> — <YYYY-MM-DD>` section per release.
 
+## 1.2.4 — 2026-07-29
+
+> **If you installed with `npx cohorte`, this is the release that makes 1.2.3 actually
+> reach you.** Re-run `npx cohorte@latest update --global` (or `update` for a bundled core).
+
+- **`npx cohorte install/update` shipped a core missing two scripts.** `bin/cli.js` — the
+  port of `install.sh` that `npx` actually runs — copied only `scripts/*.template`, never
+  `kanban-move.sh` or `telemetry-send.sh`. Since every caller chains them with `|| true`,
+  the result was silent on every npx-installed machine: no kanban card moves, no telemetry
+  pings, no error anywhere. The shell installers named both files explicitly and this port
+  drifted from them. It now copies by a rule that needs no list to keep in sync.
+- The same port never copied `CHANGELOG.md` into the core either, so `/doctor` and
+  `/update-pipeline`'s "What's new" had nothing to read on npx installs. Fixed.
+- CI now dry-runs `bin/cli.js` into a scratch dir and asserts the same postconditions as
+  the `install.sh` dry-run. 1.2.3's guard only grepped the two shell installers — it would
+  have passed this bug, because the port copies by rule rather than by name.
+
+## 1.2.3 — 2026-07-29
+
+- **Telemetry now covers the whole funnel.** Only `/build` was actually pinging; `/smoke`,
+  `/review` and `/fix` wrote their metrics line but never sent one, so consenting installs
+  reported a quarter of their pipeline. Those three are fixed, and `/brainstorm`, `/spec`
+  (on a landed freeze) and `/ship` join them — the seven stages of `idea → PR` now report,
+  so it's finally possible to see *where* features stall. Setup and maintenance commands
+  (`/doctor`, `/init-pipeline`, `/update-pipeline`, `/audit`, `/refactor`, `/align-ds`)
+  deliberately never ping: the collected set stays inside what the consent text describes.
+  Same data categories as before, same purpose — nothing new about you is sent, so your
+  existing consent stands and nothing re-asks. The full table is in SCHEMA.md §Telemetry.
+- `telemetry-send.sh` now allowlists the phase name client-side — a typo in a command file
+  used to sail through and land a phantom phase in the dataset.
+- `/fix` never defined a wall-clock start, so the `seconds` in its metrics line was
+  undefined. It now notes the epoch like `/build` and `/review` do.
+- **`/doctor` catches a half-copied core.** New check: `pipeline/scripts/` must hold every
+  shipped script, and `VERSION` must not be newer than its siblings. Callers chain these
+  scripts with `|| true`, so a missing one was invisible — no kanban move, no telemetry
+  ping, no error. If you saw either go quiet, this is why: re-run the installer.
+- CI now fails if an installer forgets to copy a `scripts/*.sh`, and the dry-run install
+  asserts the scripts land executable — the root cause above, caught before release
+  rather than on someone's machine.
+- The npm tarball no longer ships `scripts/new-feature.sh` + `scripts/remove-feature.sh`
+  — cohorte's *own* rendered isolation scripts, with this repo's ports and paths baked
+  in. They claimed in their header to be excluded but never were (an explicit `files`
+  whitelist wins over `.npmignore`). Only the `*.sh.template` files ship, as intended.
+- Fixed `validate-core.mjs` crashing on Windows (`C:\C:\…` path), so the guard above
+  actually runs locally too.
+
 ## 1.2.2 — 2026-07-29
 
 - The reference collector moved to its own (private) deployment repo; the public repo keeps

package/bin/cli.js

@@ -102,13 +102,31 @@ function copyCore() {
   for (const f of ['PIPELINE.template.md', 'SCHEMA.md', 'cohorte.config.template.yaml']) {
     fs.copyFileSync(path.join(src, 'profile', f), path.join(pipelineDir, f));
   }
-  for (const f of fs.readdirSync(path.join(src, 'scripts'))) {
-    if (f.endsWith('.template')) {
-      fs.copyFileSync(path.join(src, 'scripts', f), path.join(pipelineDir, 'scripts', f));
+  // Copy the *.template files AND the shipped executables (kanban-move.sh,
+  // telemetry-send.sh). Until 1.2.4 this loop took only `.template`, so every
+  // `npx cohorte install/update` produced a core missing both scripts — and since
+  // every caller chains them with `|| true`, the result was silent: no kanban card
+  // moves, no telemetry pings, no error. The shell installers named them explicitly
+  // and this port drifted. The rule below needs no list to keep in sync: a `<x>.sh`
+  // with an `<x>.sh.template` sibling is rendered per-project by /init-pipeline, so
+  // only the template ships; every other `.sh` is a shipped executable.
+  const scriptFiles = fs.readdirSync(path.join(src, 'scripts'));
+  for (const f of scriptFiles) {
+    const isTemplate = f.endsWith('.template');
+    const isShipped = f.endsWith('.sh') && !scriptFiles.includes(`${f}.template`);
+    if (!isTemplate && !isShipped) continue;
+    const target = path.join(pipelineDir, 'scripts', f);
+    fs.copyFileSync(path.join(src, 'scripts', f), target);
+    if (isShipped && process.platform !== 'win32') {
+      try { fs.chmodSync(target, 0o755); } catch { /* optional */ }
     }
   }
   fs.copyFileSync(path.join(src, 'core', 'agents', 'implementer.template.md'),
                   path.join(pipelineDir, 'implementer.template.md'));
+  // /doctor reads this to tell the human what they're missing; the shell installers
+  // have always copied it, this port never did.
+  const changelog = path.join(src, 'CHANGELOG.md');
+  if (fs.existsSync(changelog)) fs.copyFileSync(changelog, path.join(pipelineDir, 'CHANGELOG.md'));
   fs.writeFileSync(path.join(pipelineDir, 'VERSION'), VERSION + '\n');
   if (process.platform !== 'win32') {
     try { fs.chmodSync(path.join(dest, 'hooks', 'gate.py'), 0o755); } catch { /* optional */ }

package/core/commands/brainstorm.md

@@ -49,3 +49,8 @@ when invoked with no paste). In chat print only a 3-line summary + the path. Tel
 downstream. If a board is configured, **move** the card into the **Brainstorm** column tagged
 `#<feature_id>` (per §Kanban): the picked Ideas card if the human chose one, else a new card. No-op if
 no board.
+
+**Telemetry:** chain the opt-in usage ping onto that same Bash call — `/build` §4's shared form,
+`<phase>` = `brainstorm`, `<seconds>` = `0` (this phase is human thinking time, not pipeline
+wall-clock — the funnel signal is the event, not its duration), `<results>` = `""`. No board ⇒ still
+ping, in its own `|| true` call. Silent no-op without consent; never ask about consent here.

package/core/commands/build.md

@@ -101,10 +101,13 @@ Compute the elapsed time in the same Bash call
 (`echo "{...\"seconds\":$(($(date +%s)-<start epoch from §2>)),...}" >> …`):
 `{"ts":"<ISO date>","feature":"$ARGUMENTS","phase":"build","seconds":<wall-clock>,"surfaces":{"<key>":"ok|error",…}}`
 — this is the evidence SCHEMA.md §Specialization asks for before splitting a surface. In the same
-Bash call, chain the opt-in usage ping:
-`<core>/pipeline/scripts/telemetry-send.sh build "$ARGUMENTS" <seconds> "<ok,ok|error,…>" || true`
-(`<core>` = `~/.claude` global / `.claude` bundled) — a silent no-op unless the human explicitly
-consented (SCHEMA.md §Telemetry); never ask about consent here.
+Bash call, chain the opt-in usage ping — **the shared form every phase command reuses**:
+`<core>/pipeline/scripts/telemetry-send.sh <phase> "$ARGUMENTS" <seconds> "<results>" || true`
+(`<core>` = `~/.claude` global / `.claude` bundled; here `<phase>` = `build`, `<results>` =
+`<ok,ok|error,…>`) — a silent no-op unless the human explicitly consented (SCHEMA.md §Telemetry);
+never ask about consent here. `/review`, `/fix` and `/smoke` chain the same line with their own
+phase + results. The `|| true` swallows a **missing** script too, so a half-copied core goes
+silent rather than loud — `/doctor` check 1 is what catches that.
 Then tell the human: run `/smoke $ARGUMENTS` to exercise the feature end-to-end (or test by hand),
 then `/review $ARGUMENTS`. Do not run the app or migrations yourself here — `/smoke` is the
 sanctioned path for that. **Recommend a `/clear` now** — the spec, contract and diff are all on

package/core/commands/doctor.md

@@ -18,7 +18,12 @@ fix only with the human's go-ahead (or hand them the command).
    suggest `/update-pipeline`. Read `pipeline/CHANGELOG.md` for what they're missing. The router
    commands' step files are present — `templates/steps/init-pipeline/` non-empty (a router whose
    `templates/steps/<cmd>/` dir is missing is a partial/stale install ⇒
-   re-run install/update).
+   re-run install/update). **Shipped scripts present and executable** in `<core>/pipeline/scripts/`:
+   `kanban-move.sh`, `telemetry-send.sh`, `new-feature.sh.template`, `remove-feature.sh.template`
+   — ❌ any missing one. Every caller chains these with `|| true`, so an absent script is a **silent**
+   no-op (no kanban card moves, no telemetry ping, no error anywhere) — this check is the only thing
+   that sees it. Also flag ❌ a `VERSION` **newer than** the other `pipeline/` files (compare mtimes):
+   a version bumped without a full re-copy is a half-done update ⇒ re-run install/update.
 2. **Profile.** `PIPELINE.md` exists and its `yaml pipeline-profile` block parses. Every
    `surfaces[].agent` has its `.claude/agents/<agent>.md` and every agent file has its `surfaces[]`
    entry — **no orphans either way** (SCHEMA.md rule). Each rendered agent's frontmatter `tools`

package/core/commands/fix.md

@@ -29,6 +29,8 @@ that change the *contract*; `/fix` is for everything else.
   re-author the contract file yourself now (lead-only, per `/build` §2) — agents never edit it. If
   the contract change ripples into surfaces *without* findings, fall back to full `/build` instead
   and say so.
+- **Note the epoch** (`date +%s`) in the first Bash call you make here — §3's metrics line and usage
+  ping both carry `seconds`, and there is no separate timing call.
 
 ## 2. Scope the re-dispatch — only surfaces with findings
 
@@ -61,7 +63,8 @@ When the agents return:
   needs those checkboxes).
 - Print one status line per surface (`<key> · items fixed <n>/<m> · tests pass/fail`) — do not restate
   handoff content — and append ONE metrics line for the batch to `pipeline-metrics.jsonl`
-  (see `/build` §4, `phase: "fix"`).
+  (see `/build` §4, `phase: "fix"`), chaining the opt-in usage ping in the same Bash call
+  (results = items fixed over items found across surfaces, e.g. `"5/6"`).
 - Tell the human: re-run `/smoke` if the failures were runtime ones, and `/review $ARGUMENTS` for the
   re-verdict — the re-review is what *verifies* the ticked items actually hold (a regression simply
   reappears as a new finding in the next round). **Recommend a `/clear`** — all state (spec,

package/core/commands/review.md

@@ -58,6 +58,8 @@ Merge the returned reports into **one** REVIEW REPORT (same template): findings
 re-ordered by severity, counts summed, duplicates collapsed, verdict = the worst returned
 (`BLOCK` > `REVISE` > `SHIP`). Append ONE metrics line for the batch to `pipeline-metrics.jsonl`
 (main-checkout path + rules in `/build` §4): `{"ts":"<ISO>","feature":"$ARGUMENTS","phase":"review","seconds":<wall-clock>,"surfaces":{"<key>":"<verdict>:<finding count>",…}}`.
+In the same Bash call, chain the opt-in usage ping (`/build` §4, `phase: "review"`, results = the
+merged verdict + total finding count, e.g. `"REVISE:3"`).
 **Stage the full report to `specs/reports/$ARGUMENTS.md`** (overwrite) — a gitignored buffer so a
 `/fix` after a `/clear` can still read the findings; the `specs/reports/` subfolder is skipped by the
 non-recursive `specs/*.md` glob, so it's never mistaken for a spec (no phantom card, no bogus stage).

package/core/commands/ship.md

@@ -60,6 +60,13 @@ compare URL was emitted (no PR yet), move the card without a number. Then verify
 or an offset-limited Read around the match): exactly one card, under the `shipped` heading — never
 re-read the whole board into context. No board ⇒ skip silently.
 
+**Telemetry — the usage ping that closes the funnel.** Chain it onto the verify call above
+(`/build` §4's shared form, `<phase>` = `ship`, `<seconds>` = `0` — the release agent's duration is
+not the pipeline's, `<results>` = `pr` when a PR was created / `compare` when only a compare URL was
+emitted). Fire it **after** the release agent reports success, never on an aborted ship — a `ship`
+event must mean the feature actually left the pipeline. No board ⇒ still ping, in its own `|| true`
+call. Silent no-op without consent; never ask about consent here.
+
 ## 5. After the PR — CI gate + teardown
 
 - If `host: github` and `gh` is available, watch the PR's checks (`gh pr checks <url> --watch`) and

package/core/commands/smoke.md

@@ -34,7 +34,8 @@ human; that's expected.
 
 - Print the agent's return as-is (verdict + ❌ lines + report path) — it is already minimal.
 - Append ONE metrics line to `pipeline-metrics.jsonl` (main-checkout path + rules in `/build` §4,
-  `phase: "smoke"`).
+  `phase: "smoke"`), chaining the opt-in usage ping in the same Bash call (results = `PASS` or
+  `FAIL:<n>` failing flows).
 - **PASS** → tell the human to run `/review $ARGUMENTS`. **FAIL** → the failures are findings: feed
   them to `/fix $ARGUMENTS`, re-run `/smoke` after. Either way the report is on disk —
   **recommend a `/clear`** before the next command.

package/core/commands/spec.md

@@ -47,7 +47,12 @@ Detect the mode from the pasted content:
    it. This is just so the human isn't surprised when `/build` proposes a new agent.
 5. When the human validates, **freeze**: write `specs/<id>.md` (`status: frozen`, front-matter filled).
    Create the file — do not ask the human to. **Postcondition:** `grep -q '^status: frozen' specs/<id>.md`
-   — if it fails the freeze didn't land; fix it before pointing the human at `/build`.
+   — if it fails the freeze didn't land; fix it before pointing the human at `/build`. Chain the
+   opt-in usage ping onto the postcondition's Bash call (`/build` §4's shared form, `<phase>` =
+   `spec`, `<seconds>` = `0` — interactive time, not pipeline wall-clock, `<results>` = `frozen`).
+   Ping only on a **landed** freeze, so the funnel counts specs that exist, not attempts. Mode B does
+   not ping — it re-enters an already-counted spec, and `/fix` covers that loop. Silent no-op without
+   consent; never ask about consent here.
 6. Author the **design brief** — `specs/design/<id>.md`, rendered via
    `.claude/templates/design-brief.md` (resolves to `~/.claude/templates/…` on a global install).
    _Only if `design.enabled` / the feature has UI; skip entirely for a backend-only feature._

package/core/templates/steps/init-pipeline/02-interview-gaps.md

@@ -43,8 +43,9 @@ Prefer sensible defaults from Phase 1 as the first (Recommended) option in each
 - **Telemetry** (optional, machine-scoped — SKIP entirely if `~/.claude/cohorte.config.yaml` already
   has a `telemetry:` block with a `consent_date`, i.e. the human already answered on this machine).
   Ask ONE opt-in question, stating exactly: _"Share anonymous usage stats with the cohorte project?
-  Sent per pipeline phase: core version, OS, phase name, duration, per-surface result counts, and a
-  hash of the feature id — never repo names, paths, code, or IPs. Off by default; withdraw anytime
+  One ping per pipeline phase, `/brainstorm` through `/ship`: core version, OS, phase name, duration,
+  per-surface result counts, and a hash of the feature id — never repo names, paths, code, or IPs.
+  Setup and maintenance commands never ping. Off by default; withdraw anytime
   (`telemetry.enabled: false`); erase your history anytime (SCHEMA.md §Telemetry). Default: No."_
   On **yes**: in the global config set `telemetry.enabled: true`, mint `install_id` (`uuidgen`,
   lowercase), set `consent_date` (ISO date). On **no**: set `enabled: false` + `consent_date` (so

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cohorte",
-  "version": "1.2.2",
+  "version": "1.2.4",
   "description": "Portable, stack-agnostic multi-agent development pipeline for Claude Code — install the core, run /init-pipeline, and it adapts to your project's stack.",
   "bin": {
     "cohorte": "bin/cli.js"
@@ -13,6 +13,8 @@
     "core",
     "profile",
     "scripts",
+    "!scripts/new-feature.sh",
+    "!scripts/remove-feature.sh",
     "dashboard/server",
     "dashboard/dist",
     "dashboard/README.md",

package/profile/SCHEMA.md

@@ -325,9 +325,28 @@ Cohorte can send the maintainers anonymous usage pings so the pipeline improves
 slow. **Nothing is ever sent without explicit consent**: `/init-pipeline` (and `/update-pipeline` on
 pre-telemetry installs) ask ONE question, once per machine, default **No**, and record the answer in
 `~/.claude/cohorte.config.yaml` §`telemetry` (`enabled`, `install_id`, `consent_date`). The sender —
-`pipeline/scripts/telemetry-send.sh`, chained by each phase after its metrics line — is a silent
-no-op unless `enabled: true` AND `install_id` AND `endpoint` are all set, times out at 2s, and never
-fails the pipeline.
+`pipeline/scripts/telemetry-send.sh` — is a silent no-op unless `enabled: true` AND `install_id` AND
+`endpoint` are all set, times out at 2s, and never fails the pipeline. Callers chain it with
+`|| true`, so a **missing** script is equally silent: `/doctor` check 1 verifies `pipeline/scripts/`
+is fully populated.
+
+**Which commands ping** — the seven that make up the feature funnel, and only those. The point is to
+see where features stall, so every stage of `idea → PR` reports and nothing else does:
+
+| phase | fired when | `seconds` | `results` |
+| --- | --- | --- | --- |
+| `brainstorm` | the return is staged | `0` | — |
+| `spec` | a freeze lands (Mode A only) | `0` | `frozen` |
+| `build` | after the batch metrics line | wall-clock | `ok,ok` / `error` |
+| `smoke` | after the verdict | wall-clock | `PASS` / `FAIL:<n>` |
+| `review` | after the merged verdict | wall-clock | `<verdict>:<count>` |
+| `fix` | after the batch metrics line | wall-clock | `<fixed>/<found>` |
+| `ship` | the release agent succeeded | `0` | `pr` / `compare` |
+
+`seconds: 0` marks a phase whose duration is human thinking time, not pipeline wall-clock — the
+funnel signal there is the event, not how long it took. `/doctor`, `/audit`, `/refactor`,
+`/align-ds`, `/init-pipeline` and `/update-pipeline` **never** ping: they sit outside the funnel, and
+keeping them out is what holds the collected set to what the consent text describes.
 
 **What one event contains** (strict allowlist, ~200 bytes):
 

package/profile/cohorte.config.template.yaml

@@ -15,7 +15,9 @@ enabled: true                 # cfg:enabled — master switch; false disables ev
 # (/init-pipeline or /update-pipeline ask once per machine; they record your answer here).
 # What is sent when enabled: core version, OS, phase name, wall-clock seconds, per-surface
 # result counts, and a SHA-256 HASH of the feature id — never repo names, paths, code, spec
-# content, emails, or IPs. Sent fire-and-forget (2s timeout, silent on failure) by
+# content, emails, or IPs. One ping per pipeline phase, /brainstorm through /ship; setup and
+# maintenance commands (/doctor, /init-pipeline, /update-pipeline, /audit, /refactor,
+# /align-ds) never ping. Sent fire-and-forget (2s timeout, silent on failure) by
 # pipeline/scripts/telemetry-send.sh. Withdraw anytime: set enabled: false. Erase your history:
 # see SCHEMA.md §Telemetry (DELETE by install_id).
 telemetry:

package/scripts/telemetry-send.sh

@@ -2,7 +2,8 @@
 # telemetry-send.sh — fire-and-forget anonymous usage ping (SCHEMA.md §Telemetry).
 #
 #   telemetry-send.sh <phase> <feature_id> <seconds> [results]
-#     phase    build|review|fix|smoke
+#     phase    brainstorm|spec|build|smoke|review|fix|ship — the feature funnel, and only it.
+#              Setup/maintenance commands never ping (SCHEMA.md §Telemetry).
 #     feature  the feature id — NEVER sent raw; SHA-256-hashed to 12 hex chars
 #     seconds  batch wall-clock
 #     results  optional compact summary, e.g. "ok,ok" or "REVISE:3"
@@ -35,6 +36,13 @@ install_id="$(tval install_id)"; [ -n "$install_id" ] || exit 0
 phase="${1:-}"; feature="${2:-}"; seconds="${3:-0}"; results="${4:-}"
 [ -n "$phase" ] || exit 0
 
+# Allowlist the phase here — the collector accepts any string, so a typo in a command
+# file would silently pollute the dataset with a phantom phase nobody notices.
+case "$phase" in
+  brainstorm|spec|build|smoke|review|fix|ship) ;;
+  *) exit 0 ;;
+esac
+
 if command -v shasum >/dev/null 2>&1; then
   fhash=$(printf '%s' "$feature" | shasum -a 256 | cut -c1-12)
 else

package/scripts/validate-core.mjs

@@ -4,8 +4,11 @@
 // locally with `node scripts/validate-core.mjs`.
 import { readFileSync, readdirSync, existsSync } from "node:fs";
 import { join } from "node:path";
+import { fileURLToPath } from "node:url";
 
-const root = new URL("..", import.meta.url).pathname;
+// fileURLToPath, not .pathname — on Windows the latter yields "/C:/…", which
+// join() then resolves against the cwd drive ("C:\C:\…") and every read ENOENTs.
+const root = fileURLToPath(new URL("..", import.meta.url));
 const errors = [];
 const fail = (file, msg) => errors.push(`${file}: ${msg}`);
 
@@ -109,6 +112,40 @@ const steps = join(root, "core/templates/steps/init-pipeline");
 if (!existsSync(steps) || readdirSync(steps).length === 0)
   fail("core/templates/steps/init-pipeline", "router step files missing/empty");
 
+// ── telemetry coverage ──────────────────────────────────────────────────────
+// The funnel is only readable if every one of its stages pings — a single missing
+// one silently truncates it (that is how /smoke, /review and /fix went unreported
+// until 1.2.3). The phase list here must match SCHEMA.md §Telemetry's table.
+const FUNNEL = ["brainstorm", "spec", "build", "smoke", "review", "fix", "ship"];
+for (const c of FUNNEL)
+  if (!/usage ping/i.test(read(`core/commands/${c}.md`)))
+    fail(`core/commands/${c}.md`, "funnel command with no usage ping — breaks the telemetry funnel");
+// …and nothing outside the funnel may ping (consent text scopes it to the funnel).
+for (const f of readdirSync(join(root, "core/commands"))) {
+  const c = f.replace(/\.md$/, "");
+  // `telemetry-send.sh` + an argument = a call site; the bare filename (e.g. /doctor
+  // listing the scripts it checks for) is a mention, not a ping.
+  if (!FUNNEL.includes(c) && /telemetry-send\.sh +\S|usage ping/i.test(read(`core/commands/${f}`)))
+    fail(`core/commands/${f}`, "non-funnel command pings telemetry — outside the consented scope");
+}
+
+// ── shipped scripts ─────────────────────────────────────────────────────────
+// Every scripts/*.sh must be copied by BOTH shell installers. Callers chain these
+// with `|| true`, so one an installer forgets is a silent no-op forever — no kanban
+// card moves, no telemetry ping, no error. CI is the only place this is loud.
+// The third installer, bin/cli.js (what `npx cohorte` runs), copies by rule rather
+// than by name, so grepping for filenames can't see it — ci.yml dry-runs it into a
+// scratch HOME and asserts the same postconditions instead. Both are needed: this
+// check catches a forgotten name, that one catches a drifted rule.
+// A `<name>.sh` with a `<name>.sh.template` sibling is a locally-rendered artifact
+// (this repo dogfoods its own /init-pipeline), not a core asset — skip those.
+const installers = { "install.sh": read("install.sh"), "install.ps1": read("install.ps1") };
+const shipped = readdirSync(join(root, "scripts"));
+for (const f of shipped.filter((f) => f.endsWith(".sh") && !shipped.includes(`${f}.template`)))
+  for (const [name, src] of Object.entries(installers))
+    if (!src.includes(`scripts/${f}`) && !src.includes(`scripts\\${f}`))
+      fail(name, `never copies scripts/${f} into pipeline/scripts/ (silent no-op at runtime)`);
+
 // ── report ──────────────────────────────────────────────────────────────────
 if (errors.length) {
   console.error(`validate-core: ${errors.length} error(s)\n`);