cohorte 1.3.2 → 1.3.3

package/CHANGELOG.md

@@ -3,6 +3,35 @@
 Entries are shown by `/update-pipeline` ("What's new") after a core refresh. Keep them short,
 user-facing, most recent first. One `## <version> — <YYYY-MM-DD>` section per release.
 
+## 1.3.3 — 2026-07-30
+
+> **Re-run `npx cohorte@latest update --global` (or `update`)** — the gate fixes only apply once
+> the installed `hooks/gate.py` is refreshed.
+
+- **The cycle workflow could exit SHIP-READY with open findings.** A round with only HIGH/MEDIUM
+  findings scored `SHIP`, broke the loop, ticked the DoD and stamped the freshness gate — making
+  `/ship` a straight shot over unfixed findings, against the workflow's own "zero open findings"
+  contract. The exit condition is now literally zero open findings + a smoke PASS.
+- **Dead implementers went undetected in the cycle workflow.** `agent()` returns `null` when a
+  subagent dies, but the build fan-out wrapped every result in a truthy object before the check —
+  so the "implementer(s) died" question never fired and build telemetry always said `ok`.
+- **`gate.py` gated worktree commands as if they ran on the default branch.** Branch and HEAD were
+  resolved in `CLAUDE_PROJECT_DIR` (the main checkout, usually on `main`) instead of where the
+  command actually runs — so in a feature worktree, every `ask_on_default_branch` pattern
+  prompted, and the preflight HEAD-moved check compared against the wrong checkout. Git state now
+  resolves at the hook payload's `cwd`.
+- **The preflight phase gate hung headless runs.** The bypassPermissions "nobody can answer an
+  ask ⇒ deny" escalation only covered Bash patterns; a review/smoke Task dispatch with a stale
+  stamp still emitted an unanswerable `ask`. The phase gate now escalates the same way.
+- **`/init-pipeline` bundled installs registered the gate with the dead `Bash`-only matcher** —
+  the exact bug 1.3.2 fixed in the installers lived on in the template — and never dropped an
+  existing registration, so a bundled repo later switched to global ran the gate twice per
+  command. The template now mandates `Bash|Task` and a reconcile.
+- Smaller cycle-workflow fixes: smoke telemetry reports the real failure count (was always 0 —
+  it filtered on a `kind` value that doesn't exist); a run whose last round ends on a red
+  preflight now flags that the reported findings are from the previous round; a malformed
+  preflight stamp says "unreadable" instead of "not found".
+
 ## 1.3.2 — 2026-07-30
 
 > **Re-run `npx cohorte@latest update --global` (or `update`).** This release repairs the gate

package/core/hooks/gate.py

@@ -48,9 +48,12 @@ SPLIT = re.compile(r"&&|\|\||[;|\n]")
 WS = re.compile(r"\s+")
 
 
+def project_root() -> str:
+    return os.environ.get("CLAUDE_PROJECT_DIR", ".")
+
+
 def load_config() -> dict:
-    root = os.environ.get("CLAUDE_PROJECT_DIR", ".")
-    path = os.path.join(root, ".claude", "gate-config.json")
+    path = os.path.join(project_root(), ".claude", "gate-config.json")
     empty = {"deny": [], "ask": [], "ask_on_default_branch": [], "default_branch": "main",
              "preflight": {}}
     try:
@@ -76,13 +79,19 @@ def norm(s: str) -> str:
     return WS.sub(" ", s.strip())
 
 
-def current_branch():
-    """The checked-out branch of CLAUDE_PROJECT_DIR, or None (not a repo / detached / git absent)."""
-    root = os.environ.get("CLAUDE_PROJECT_DIR", ".")
+def session_cwd(payload: dict) -> str:
+    """Where the gated command actually runs. A feature worktree is its own
+    checkout — resolving git state in CLAUDE_PROJECT_DIR (the main checkout)
+    would gate every worktree command as if it ran on the default branch."""
+    return payload.get("cwd") or project_root()
+
+
+def current_branch(cwd: str):
+    """The checked-out branch at `cwd`, or None (not a repo / detached / git absent)."""
     try:
         out = subprocess.run(
             ["git", "rev-parse", "--abbrev-ref", "HEAD"],
-            cwd=root, capture_output=True, text=True, timeout=3,
+            cwd=cwd, capture_output=True, text=True, timeout=3,
         )
         if out.returncode == 0:
             return out.stdout.strip() or None
@@ -91,13 +100,12 @@ def current_branch():
     return None
 
 
-def current_head():
-    """HEAD sha of CLAUDE_PROJECT_DIR, or None."""
-    root = os.environ.get("CLAUDE_PROJECT_DIR", ".")
+def current_head(cwd: str):
+    """HEAD sha at `cwd`, or None."""
     try:
         out = subprocess.run(
             ["git", "rev-parse", "HEAD"],
-            cwd=root, capture_output=True, text=True, timeout=3,
+            cwd=cwd, capture_output=True, text=True, timeout=3,
         )
         if out.returncode == 0:
             return out.stdout.strip() or None
@@ -116,29 +124,37 @@ def check_preflight(payload: dict, cfg: dict) -> int:
     if subagent not in agents:
         return 0
 
-    root = os.environ.get("CLAUDE_PROJECT_DIR", ".")
-    stamp = os.path.join(root, ".claude", "preflight.ok")
+    stamp = os.path.join(project_root(), ".claude", "preflight.ok")
     why = None
     try:
         with open(stamp, "r", encoding="utf-8") as fh:
-            epoch_s, _, sha = fh.read().strip().partition(" ")
-        age_min = (time.time() - float(epoch_s)) / 60
-        max_age = float(pf.get("max_age_minutes", 30) or 30)
-        if age_min > max_age:
-            why = f"the preflight stamp is {age_min:.0f} min old (max {max_age:.0f})"
-        else:
-            head = current_head()
-            if head and sha not in ("", "none") and head != sha:
-                why = "HEAD moved since the preflight ran"
+            raw = fh.read().strip()
     except Exception:
+        raw = None
         why = "no preflight stamp found"
+    if raw is not None:
+        try:
+            epoch_s, _, sha = raw.partition(" ")
+            age_min = (time.time() - float(epoch_s)) / 60
+            max_age = float(pf.get("max_age_minutes", 30) or 30)
+            if age_min > max_age:
+                why = f"the preflight stamp is {age_min:.0f} min old (max {max_age:.0f})"
+            else:
+                head = current_head(session_cwd(payload))
+                if head and sha not in ("", "none") and head != sha:
+                    why = "HEAD moved since the preflight ran"
+        except Exception:
+            why = "the preflight stamp is unreadable (expected `<epoch> <sha>`)"
     if why is None:
         return 0
+    # Same rule as the Bash gate: unattended runs have nobody to answer an "ask".
+    unattended = payload.get("permission_mode") == "bypassPermissions"
     return decide(
-        "ask",
+        "deny" if unattended else "ask",
         f"Phase gate: dispatching `{subagent}` but {why}. Run the deterministic pre-flight first "
         f"(pipeline/scripts/preflight.sh — typecheck + lint + tests) so agents never review red code; "
-        f"or confirm to dispatch anyway (PIPELINE.md gate.preflight).",
+        f"or confirm to dispatch anyway (PIPELINE.md gate.preflight)."
+        + (" (denied outright: unattended run, nobody to confirm)" if unattended else ""),
     )
 
 
@@ -173,7 +189,7 @@ def main() -> int:
     # be conservative and gate. Resolve the branch once, lazily.
     on_default = False
     if branch_gated:
-        branch = current_branch()
+        branch = current_branch(session_cwd(payload))
         on_default = branch is None or branch == default
 
     for raw in SPLIT.split(command):

package/core/templates/steps/init-pipeline/04-write-render.md

@@ -30,8 +30,12 @@
    retrieval provider's MCP tools when wired (e.g. `mcp__serena`). Never allowlist anything matching
    a `gate.ask`/`gate.deny` pattern. Mention the human can widen it later with
    `/fewer-permission-prompts`) + the hooks, **conditioned on the install mode:**
-   - **bundled:** register the PreToolUse `Bash` hook `.claude/hooks/gate.py` and the PostToolUse
-     formatter (detected formatter).
+   - **bundled:** register the PreToolUse hook `.claude/hooks/gate.py` with matcher `Bash|Task`
+     (Task is required — the preflight phase gate keys off Task dispatches; a `Bash`-only matcher
+     leaves it dead) and the PostToolUse formatter (detected formatter). Before adding, drop any
+     existing PreToolUse entry whose command ends in `gate.py` (here AND in `~/.claude/settings.json`
+     if one points at this repo's copy) — exactly one registration must survive, or every gated
+     command prompts twice.
    - **global:** the PreToolUse gate hook is
      already in `~/.claude/settings.json` and reads this repo's `gate-config.json` — do **not** re-register
      it here (double-registration double-prompts). It no-ops where its config is absent, so one

package/core/workflows/cycle.js

@@ -184,7 +184,9 @@ const buildPrompt = s =>
   'your surface): none'
 const handoffs = await parallel(surfaces.map(s => () =>
   agent(buildPrompt(s), { agentType: s.agent, label: `build:${s.key}`, phase: 'Build' })
-    .then(h => ({ key: s.key, handoff: h }))))
+    // agent() resolves to null (never throws) when a subagent dies — wrapping
+    // unconditionally would hide every death from the `dead` check below.
+    .then(h => (h == null ? null : { key: s.key, handoff: h }))))
 const built = handoffs.filter(Boolean)
 const dead = surfaces.filter(s => !built.some(b => b.key === s.key)).map(s => s.key)
 if (dead.length) questions.push(`implementer(s) died during build: ${dead.join(', ')} — inspect and re-run /build if their surface matters`)
@@ -207,8 +209,10 @@ const runPreflight = () => agent(
 
 let verdict = null
 let smokePass = false
+let smokeFails = []      // last round's smoke failures — Close reports the real count
 let open = []            // findings still open, each {severity,file,line,kind,problem,fix,src}
 let rounds = 0
+let preflightRed = false // did the LAST round end on a red preflight (open/verdict then stale)?
 
 // ── Phases 4/5 — bounded verify → fix rounds ────────────────────────────────
 while (rounds < MAX_ROUNDS && (!budget.total || budget.remaining() > 30000)) {
@@ -218,7 +222,8 @@ while (rounds < MAX_ROUNDS && (!budget.total || budget.remaining() > 30000)) {
 
   // 4a. preflight — mechanical red short-circuits straight to a fix round
   const pre = await runPreflight()
-  if (!pre || !pre.pass) {
+  preflightRed = !pre || !pre.pass
+  if (preflightRed) {
     const tail = (pre && pre.tail) || ''
     const hit = new Set(surfaces.filter(s => tail.includes(String(s.path))).map(s => s.key))
     const targets = hit.size ? [...hit] : built.map(b => b.key)
@@ -281,13 +286,15 @@ while (rounds < MAX_ROUNDS && (!budget.total || budget.remaining() > 30000)) {
   ])
 
   smokePass = !!(smoke && smoke.pass)
-  const smokeFails = (smoke && smoke.failures) || []
+  smokeFails = (smoke && smoke.failures) || []
   open = (reviewed || []).filter(Boolean).flatMap(r => r.kept.map(f => ({ ...f, src: r.key })))
   verdict = open.some(f => f.kind === 'security') ? 'BLOCK'
-    : open.some(f => f.severity === 'CRITICAL') ? 'REVISE' : 'SHIP'
+    : open.length ? 'REVISE' : 'SHIP'
   log(`Round ${rounds}: review ${verdict} (${open.length} finding(s)) · smoke ${smokePass ? 'PASS' : `FAIL:${smokeFails.length}`}`)
 
-  if (verdict === 'SHIP' && smokePass) break
+  // The loop's contract is ZERO open findings + PASS — a SHIP verdict alone
+  // (which older revisions granted despite HIGH/MEDIUM leftovers) is not enough.
+  if (!open.length && smokePass) break
   if (rounds >= MAX_ROUNDS) break
 
   // 5. fix round. Contract-impacting findings stay INSIDE the loop: a
@@ -343,6 +350,9 @@ while (rounds < MAX_ROUNDS && (!budget.total || budget.remaining() > 30000)) {
     { agentType: byKey[k].agent, label: `fix:${k}`, phase: 'Fix' })))
 }
 
+if (preflightRed) {
+  questions.push('the last round ended on a RED preflight — the reported verdict/findings are from the previous round and may already be fixed; rerun /review after the mechanical fixes land')
+}
 if (rounds >= MAX_ROUNDS && !(verdict === 'SHIP' && smokePass)) {
   questions.push(`round cap (${MAX_ROUNDS}) reached with ${open.length} finding(s) open — rerun the cycle (maxRounds higher) or continue with /fix ${feature} + /review`)
 }
@@ -376,7 +386,7 @@ await agent(
   `{"ts":"<ISO now>","feature":"${feature}","phase":"cycle","seconds":0,"surfaces":{"rounds":"${rounds}","verdict":"${verdict || 'none'}:${open.length}","smoke":"${smokePass ? 'PASS' : 'FAIL'}"}}\n` +
   '5. Chain the opt-in usage pings (all funnel phases this run executed, 0 seconds each): ' +
   `<core>/pipeline/scripts/telemetry-send.sh build "${feature}" 0 "${built.map(() => 'ok').join(',') || 'error'}" || true; ` +
-  `<core>/pipeline/scripts/telemetry-send.sh smoke "${feature}" 0 "${smokePass ? 'PASS' : 'FAIL:' + open.filter(f => f.kind === 'runtime').length}" || true; ` +
+  `<core>/pipeline/scripts/telemetry-send.sh smoke "${feature}" 0 "${smokePass ? 'PASS' : 'FAIL:' + smokeFails.length}" || true; ` +
   `<core>/pipeline/scripts/telemetry-send.sh review "${feature}" 0 "${verdict || 'none'}:${open.length}" || true\n` +
   'Return the single word: done.',
   { model: 'haiku', label: 'close', effort: 'low' },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cohorte",
-  "version": "1.3.2",
+  "version": "1.3.3",
   "description": "Portable, stack-agnostic multi-agent development pipeline for Claude Code — install the core, run /init-pipeline, and it adapts to your project's stack.",
   "bin": {
     "cohorte": "bin/cli.js"