cohorte 1.3.3 → 1.3.4

package/core/workflows/cycle.js

@@ -1,8 +1,10 @@
 // cohorte — the FULL dev cycle as one deterministic workflow (opt-in):
-// contract → build → [preflight → smoke ∥ review(+cross-check) → fix]* → done.
+// contract → build → [preflight → review(+cross-check) (∥ smoke if opted in) → fix]* → done.
 //
-// Invoke with args = {feature: "<feature_id>", maxRounds?: 3} in the feature's
-// checkout (main checkout on the feature branch, or its worktree).
+// Invoke with args = {feature: "<feature_id>", maxRounds?: 5, smoke?: true} in the
+// feature's checkout (main checkout on the feature branch, or its worktree).
+// Smoke is OFF by default — running the app every round is the human's call
+// (/cycle <id> smoke, or standalone /smoke before /ship).
 //
 // The contract with the human: a workflow can NEVER ask a question mid-run, so
 // everything decisional is moved to the edges —
@@ -24,8 +26,9 @@
 // keeps its human confirmation. A SHIP exit ticks the DoD + stamps the
 // freshness gate, so `/ship <id>` right after is a straight shot.
 //
-// Loop economics: smoke and review run CONCURRENTLY each round (both observe,
-// neither edits); fix rounds re-dispatch only the surfaces owning findings;
+// Loop economics: when smoke is opted in it runs CONCURRENTLY with review each
+// round (both observe, neither edits); fix rounds re-dispatch only the surfaces
+// owning findings;
 // the loop is bounded by maxRounds AND by the session token budget if one is
 // set. Disk state stays pipeline-coherent: reports staged to specs/reports/,
 // unresolved findings appended to the spec's ## Remediation — a conversational
@@ -33,14 +36,14 @@
 
 export const meta = {
   name: 'cohorte-cycle',
-  description: 'Full cohorte dev cycle: contract, parallel build, then bounded smoke∥review→fix rounds; deferred questions in the output, never mid-run',
-  whenToUse: 'Only when the human explicitly asks to run the full dev-cycle workflow on a FROZEN spec. args = {feature: "<feature_id>", maxRounds?: 3}.',
+  description: 'Full cohorte dev cycle: contract, parallel build, then bounded review→fix rounds (smoke opt-in via args.smoke); deferred questions in the output, never mid-run',
+  whenToUse: 'Only when the human explicitly asks to run the full dev-cycle workflow on a FROZEN spec. args = {feature: "<feature_id>", maxRounds?: 5, smoke?: true}.',
   phases: [
     { title: 'Profile', detail: 'PIPELINE.md → JSON via profile-reader', model: 'haiku' },
     { title: 'Ready', detail: 'spec frozen + self-sufficient, or abort with the gaps', model: 'haiku' },
     { title: 'Contract', detail: 'author the frozen contract from spec §5' },
     { title: 'Build', detail: 'one implementer per surface, parallel' },
-    { title: 'Verify', detail: 'per round: preflight → smoke ∥ review + cross-check' },
+    { title: 'Verify', detail: 'per round: preflight → review + cross-check (∥ smoke if opted in)' },
     { title: 'Fix', detail: 'per round: re-dispatch only the surfaces with findings' },
     { title: 'Close', detail: 'reports, Remediation/DoD, freshness stamp, metrics', model: 'haiku' },
   ],
@@ -48,8 +51,12 @@ export const meta = {
 
 const feature = typeof args === 'string' ? args.trim() : args && args.feature
 if (!feature) throw new Error('cohorte-cycle needs args = {feature: "<feature_id>"}')
-// Runaway protection, not a target — the loop's real exit is 0 findings + PASS.
+// Runaway protection, not a target — the loop's real exit is 0 findings (+ PASS if smoking).
 const MAX_ROUNDS = Math.max(1, (args && args.maxRounds) || 5)
+// Smoke is the human's call: booting infra every round is expensive, and lib-only
+// projects have nothing to smoke. Off ⇒ the cycle verifies by review alone, the
+// runtime-flow DoD boxes stay unticked, and /smoke remains available standalone.
+const SMOKE_ON = !!(args && args.smoke)
 
 const questions = []        // every deferred human decision ends up here — emitted at the END
 const contractChanges = []  // contract re-authorings the loop performed (info, not questions)
@@ -211,7 +218,9 @@ let verdict = null
 let smokePass = false
 let smokeFails = []      // last round's smoke failures — Close reports the real count
 let open = []            // findings still open, each {severity,file,line,kind,problem,fix,src}
+let unreviewed = []      // surfaces whose reviewer died this round — they carry NO verdict
 let rounds = 0
+let fixRounds = 0        // fix dispatches performed — the close step's `fix` usage ping needs it
 let preflightRed = false // did the LAST round end on a red preflight (open/verdict then stale)?
 
 // ── Phases 4/5 — bounded verify → fix rounds ────────────────────────────────
@@ -226,10 +235,21 @@ while (rounds < MAX_ROUNDS && (!budget.total || budget.remaining() > 30000)) {
   if (preflightRed) {
     const tail = (pre && pre.tail) || ''
     const hit = new Set(surfaces.filter(s => tail.includes(String(s.path))).map(s => s.key))
-    const targets = hit.size ? [...hit] : built.map(b => b.key)
+    const targets = (hit.size ? [...hit] : built.map(b => b.key)).filter(k => byKey[k])
+    // No target = nobody to dispatch, so the next round finds the same red gates
+    // and spins again: the loop would burn every remaining round doing literally
+    // nothing, then report a stale verdict. Stop and say why instead.
+    if (!targets.length) {
+      questions.push(
+        'the mechanical gates are RED but no surface owns the failure (nothing in the tail matches a ' +
+        `surface path, and no implementer survived the build) — fix it by hand, then rerun /cycle ${feature}. ` +
+        `Failure tail:\n${tail.slice(-1500)}`)
+      break
+    }
     log(`Preflight red — mechanical fix round on: ${targets.join(', ')}`)
     phase('Fix')
-    await parallel(targets.filter(k => byKey[k]).map(k => () => agent(
+    fixRounds++
+    await parallel(targets.map(k => () => agent(
       `Fix loop for feature \`${feature}\` on your surface (**${k}**). Read \`PIPELINE.md\` first. ` +
       `Contract: \`${contractFile || 'spec §5'}\` (read-only). Touch only \`${byKey[k].path}\`. ` +
       'The mechanical gates (typecheck/lint/tests) are RED. Raw failure tail below — fix exactly ' +
@@ -248,12 +268,15 @@ while (rounds < MAX_ROUNDS && (!budget.total || budget.remaining() > 30000)) {
     '4. Return the touched surfaces (empty array if no diff).',
     { model: 'haiku', label: 'stage-diff', phase: 'Verify', schema: STAGE, effort: 'low' },
   )
-  const touched = (staged && staged.surfaces) || []
+  // "The staging agent died" and "there is genuinely no diff" are different facts;
+  // conflating them diagnosed a dead agent as a wrong branch.
+  if (!staged) { questions.push('the diff-staging agent died — nothing could be reviewed this round; rerun the cycle'); break }
+  const touched = staged.surfaces || []
   if (!touched.length) { questions.push(`no diff against ${base} after build — wrong branch/checkout?`); break }
 
-  // 4c. smoke ∥ review(+cross-check) — both observe, neither edits: run together
+  // 4c. review(+cross-check), ∥ smoke only when the human opted in — both observe, neither edits
   const [smoke, reviewed] = await parallel([
-    () => agent(
+    () => !SMOKE_ON ? Promise.resolve(null) : agent(
       'Smoke-test one feature, per your agent instructions (bring it up, exercise the contract + §8 UI ' +
       'flows, stage the full SMOKE REPORT, tear down; return the capped shape — pass + max 10 one-line ' +
       `failures with a file hint when you have one). — Variable slots: feature ${feature} · spec: ` +
@@ -287,21 +310,39 @@ while (rounds < MAX_ROUNDS && (!budget.total || budget.remaining() > 30000)) {
 
   smokePass = !!(smoke && smoke.pass)
   smokeFails = (smoke && smoke.failures) || []
-  open = (reviewed || []).filter(Boolean).flatMap(r => r.kept.map(f => ({ ...f, src: r.key })))
+  const reviewedOk = (reviewed || []).filter(Boolean)
+  // A reviewer that DIED returns null, and a dead reviewer yields zero findings —
+  // byte-identical to a clean surface. Unchecked, "every reviewer crashed" scores
+  // SHIP and this loop exits SHIP-READY, ticking the DoD and stamping the freshness
+  // gate over code nobody read. Track the surfaces that carry no verdict.
+  unreviewed = touched.filter(s => !reviewedOk.some(r => r.key === s.key)).map(s => s.key)
+  open = reviewedOk.flatMap(r => r.kept.map(f => ({ ...f, src: r.key })))
   verdict = open.some(f => f.kind === 'security') ? 'BLOCK'
-    : open.length ? 'REVISE' : 'SHIP'
-  log(`Round ${rounds}: review ${verdict} (${open.length} finding(s)) · smoke ${smokePass ? 'PASS' : `FAIL:${smokeFails.length}`}`)
+    : (open.length || unreviewed.length) ? 'REVISE' : 'SHIP'
+  log(`Round ${rounds}: review ${verdict} (${open.length} finding(s)` +
+    `${unreviewed.length ? `, ${unreviewed.length} surface(s) UNREVIEWED: ${unreviewed.join(', ')}` : ''}) · ` +
+    `smoke ${!SMOKE_ON ? 'SKIPPED' : smokePass ? 'PASS' : `FAIL:${smokeFails.length}`}`)
 
-  // The loop's contract is ZERO open findings + PASS — a SHIP verdict alone
-  // (which older revisions granted despite HIGH/MEDIUM leftovers) is not enough.
-  if (!open.length && smokePass) break
+  // The loop's contract is ZERO open findings on FULLY reviewed surfaces + a smoke
+  // PASS when smoking — a SHIP verdict alone (which older revisions granted despite
+  // HIGH/MEDIUM leftovers) is not enough. Smoke off ⇒ review alone decides, at the
+  // human's explicit risk.
+  if (!open.length && !unreviewed.length && (smokePass || !SMOKE_ON)) break
   if (rounds >= MAX_ROUNDS) break
+  // Nothing to fix, but a reviewer died: spend the next round re-reviewing rather
+  // than dispatching a fix round with no items (which would fall through to the
+  // "findings map to no surface" abort and end the run on a misleading question).
+  if (!open.length && !smokeFails.length && unreviewed.length) {
+    log(`No findings, but ${unreviewed.join(', ')} went unreviewed — retrying the review round`)
+    continue
+  }
 
   // 5. fix round. Contract-impacting findings stay INSIDE the loop: a
   //    lead-equivalent agent re-authors spec §5 + the contract file (implementers
   //    still never touch it — same division of labor as conversational /fix §1),
   //    and the surfaces it names re-dispatch against the updated shapes.
   phase('Fix')
+  fixRounds++
   const contractFindings = contractFile
     ? open.filter(f => String(f.file).startsWith(String(contract.path))) : []
   let rippleSurfaces = []
@@ -316,10 +357,21 @@ while (rounds < MAX_ROUNDS && (!budget.total || budget.remaining() > 30000)) {
       `(surfaces: ${surfaces.map(s => s.key).join(', ')}; when in doubt list them all).`,
       { label: 'contract-fix', phase: 'Fix' },
     )
-    const [what, keys] = String(cf || '').split('||').map(x => x && x.trim())
-    contractChanges.push(what || 'contract re-authored (agent gave no summary)')
-    rippleSurfaces = (keys ? keys.split(',').map(k => k.trim()) : surfaces.map(s => s.key))
-      .filter(k => byKey[k])
+    // A DEAD contract agent (agent() ⇒ null) must not be reported as a successful
+    // re-authoring: doing so both fabricates a `contractChanges` entry and hands
+    // every consuming surface a CRITICAL "the contract was RE-AUTHORED — realign"
+    // item pointing at a file nobody touched. Same failure shape as a dead
+    // reviewer scoring SHIP.
+    if (cf == null) {
+      questions.push(
+        `the contract needed a change (${contractFindings.length} finding(s) under ${contract.path}) but the ` +
+        `contract agent died — the contract is UNCHANGED; re-run /fix ${feature} or author it yourself`)
+    } else {
+      const [what, keys] = String(cf).split('||').map(x => x && x.trim())
+      contractChanges.push(what || 'contract re-authored (agent gave no summary)')
+      rippleSurfaces = (keys ? keys.split(',').map(k => k.trim()) : surfaces.map(s => s.key))
+        .filter(k => byKey[k])
+    }
   }
 
   //    Group the remaining findings by owning surface; smoke failures ride with
@@ -329,9 +381,22 @@ while (rounds < MAX_ROUNDS && (!budget.total || budget.remaining() > 30000)) {
     (perSurface[k] = perSurface[k] || []).push(
       `- [ ] CRITICAL · ${contractFile} · spec-violation · the contract was RE-AUTHORED this round (${contractChanges[contractChanges.length - 1]}) — re-read it and realign your surface's implementation + tests`)
   }
+  // A finding whose file sits under no surface path AND whose reporting surface
+  // is not a live key has no owner: it stays in `open` (so the loop can never
+  // exit clean) while nobody is ever dispatched to fix it — a guaranteed burn to
+  // the round cap. Surface them instead of dropping them silently.
+  const orphaned = []
   for (const f of open.filter(f => !contractFindings.includes(f))) {
     const k = surfaceOf(f.file) || f.src
     if (byKey[k]) (perSurface[k] = perSurface[k] || []).push(itemLine(f))
+    else orphaned.push(f)
+  }
+  if (orphaned.length) {
+    questions.push(
+      `${orphaned.length} finding(s) map to no surface and were never dispatched — fix them by hand ` +
+      `or give their tree a surface in PIPELINE.md: ` +
+      orphaned.slice(0, 5).map(f => `${f.file}:${f.line}`).join(', ') +
+      (orphaned.length > 5 ? `, +${orphaned.length - 5} more` : ''))
   }
   const fallbackKey = Object.keys(perSurface).sort((a, b) => perSurface[b].length - perSurface[a].length)[0]
     || (built[0] && built[0].key)
@@ -350,58 +415,99 @@ while (rounds < MAX_ROUNDS && (!budget.total || budget.remaining() > 30000)) {
     { agentType: byKey[k].agent, label: `fix:${k}`, phase: 'Fix' })))
 }
 
+const smokeOk = !SMOKE_ON || smokePass
+const smokeLabel = !SMOKE_ON ? 'SKIPPED' : smokePass ? 'PASS' : 'FAIL'
 if (preflightRed) {
   questions.push('the last round ended on a RED preflight — the reported verdict/findings are from the previous round and may already be fixed; rerun /review after the mechanical fixes land')
 }
-if (rounds >= MAX_ROUNDS && !(verdict === 'SHIP' && smokePass)) {
+// Only meaningful when the last round actually reviewed: after a preflight-red
+// round `unreviewed` still holds the PREVIOUS round's value, and preflightRed's
+// own question already says the reported state is one round stale.
+if (unreviewed.length && !preflightRed) {
+  questions.push(`no reviewer completed on: ${unreviewed.join(', ')} — those surfaces are NOT reviewed (the verdict covers the others only); rerun /review ${feature}`)
+}
+if (rounds >= MAX_ROUNDS && !(verdict === 'SHIP' && smokeOk)) {
   questions.push(`round cap (${MAX_ROUNDS}) reached with ${open.length} finding(s) open — rerun the cycle (maxRounds higher) or continue with /fix ${feature} + /review`)
 }
-if (budget.total && budget.remaining() <= 30000 && !(verdict === 'SHIP' && smokePass)) {
+if (budget.total && budget.remaining() <= 30000 && !(verdict === 'SHIP' && smokeOk)) {
   questions.push('token budget nearly spent — cycle stopped early; rerun the cycle or continue conversationally')
 }
 
 // ── Phase 6 — close: reports, spec bookkeeping, freshness stamp, metrics ────
 phase('Close')
-const success = verdict === 'SHIP' && smokePass
+const success = verdict === 'SHIP' && smokeOk && !unreviewed.length
 const findingLine = f => `- **[${f.severity}]** \`${f.file}:${f.line}\` · ${f.kind} · ${f.problem} → **Fix:** ${f.fix}`
 const reportBody = [
   '# REVIEW REPORT', `feature_id: ${feature} · merged by cohorte-cycle workflow (round ${rounds})`, '',
-  `Verdict: ${verdict || 'NOT-REACHED'} · smoke: ${smokePass ? 'PASS' : 'FAIL'}`, '', '## Findings', '',
+  `Verdict: ${verdict || 'NOT-REACHED'} · smoke: ${smokeLabel}`, '', '## Findings', '',
   open.length ? open.map(findingLine).join('\n') : 'None.',
+  ...(unreviewed.length ? ['', '## NOT reviewed (reviewer died — no verdict on these)', '',
+    unreviewed.map(k => `- \`${k}\` — rerun /review ${feature}`).join('\n')] : []),
 ].join('\n')
-await agent(
+// Per-surface results for the metrics line. `surfaces` means SURFACES: putting the
+// run summary (rounds/verdict/smoke) in there made the dashboard render them as
+// three phantom surface rows and score `rounds:"1"` as a failed surface.
+const surfaceResults = built.map(b => `"${b.key}":"${
+  unreviewed.includes(b.key) ? 'error' : `${verdict || 'none'}:${open.filter(f => f.src === b.key).length}`}"`).join(',')
+const closed = await agent(
   `Close a cohorte cycle run for feature ${feature}, mechanically:\n` +
   `1. Write EXACTLY this to specs/reports/${feature}.md (overwrite):\n<<<REPORT\n${reportBody}\nREPORT\n` +
   (success
     ? `2. In specs/${feature}.md tick the DoD boxes the cycle verified (spec conformance + copy language — ` +
-      'review SHIP; tests/lint/typecheck — green preflight; runtime flows — smoke PASS); leave anything ' +
+      'review SHIP; tests/lint/typecheck — green preflight; ' +
+      (SMOKE_ON ? 'runtime flows — smoke PASS' : 'runtime flows — LEAVE UNTICKED, smoke was skipped this run') +
+      '); leave anything ' +
       'unverified unticked. 3. Stamp the freshness gate in the spec front-matter, exactly as /review §3 ' +
       `does: BASE=$(git merge-base ${base} HEAD); reviewed_base: $BASE; reviewed_digest: ` +
       `$(git diff $BASE -- . ':(exclude)specs/' | sha256sum | cut -c1-16).\n` :
     `2. Append the open findings to specs/${feature}.md \`## Remediation\` under a subheading ` +
       `\`### cohorte-cycle round ${rounds}\`, one \`- [ ]\` line each (so a conversational /fix picks them ` +
       'up):\n' + (open.map(itemLine).join('\n') || '(none — see questions in the workflow result)') + '\n' +
-      `Set the front-matter status: in-review.\n`) +
+      `3. Set the front-matter status: in-review.\n`) +
   `4. Append ONE metrics line to $(dirname "$(git rev-parse --git-common-dir)")/.claude/pipeline-metrics.jsonl: ` +
-  `{"ts":"<ISO now>","feature":"${feature}","phase":"cycle","seconds":0,"surfaces":{"rounds":"${rounds}","verdict":"${verdict || 'none'}:${open.length}","smoke":"${smokePass ? 'PASS' : 'FAIL'}"}}\n` +
-  '5. Chain the opt-in usage pings (all funnel phases this run executed, 0 seconds each): ' +
-  `<core>/pipeline/scripts/telemetry-send.sh build "${feature}" 0 "${built.map(() => 'ok').join(',') || 'error'}" || true; ` +
-  `<core>/pipeline/scripts/telemetry-send.sh smoke "${feature}" 0 "${smokePass ? 'PASS' : 'FAIL:' + smokeFails.length}" || true; ` +
+  `{"ts":"<ISO now>","feature":"${feature}","phase":"cycle","seconds":0,"rounds":${rounds},"smoke":"${smokeLabel}","surfaces":{${surfaceResults}}}\n` +
+  '5. Chain the opt-in usage pings (all funnel phases this run executed, 0 seconds each; ' +
+  '<core> = .claude if .claude/pipeline/scripts/telemetry-send.sh exists, else ~/.claude — script on neither ⇒ skip the pings): ' +
+  // One result per DECLARED surface, not per survivor: `built` holds only the
+  // implementers that returned, so mapping over it reported 2-of-3 as "ok,ok" and
+  // the dead one vanished from the funnel entirely.
+  `<core>/pipeline/scripts/telemetry-send.sh build "${feature}" 0 "${
+    surfaces.map(s => (built.some(b => b.key === s.key) ? 'ok' : 'error')).join(',') || 'error'}" || true; ` +
+  (SMOKE_ON ? `<core>/pipeline/scripts/telemetry-send.sh smoke "${feature}" 0 "${smokePass ? 'PASS' : 'FAIL:' + smokeFails.length}" || true; ` : '') +
+  (fixRounds ? `<core>/pipeline/scripts/telemetry-send.sh fix "${feature}" 0 "rounds:${fixRounds}" || true; ` : '') +
   `<core>/pipeline/scripts/telemetry-send.sh review "${feature}" 0 "${verdict || 'none'}:${open.length}" || true\n` +
   'Return the single word: done.',
   { model: 'haiku', label: 'close', effort: 'low' },
 )
 
+// The close agent is what actually writes the report, ticks the DoD, stamps the
+// freshness gate and appends the metrics. If it died, NONE of that is on disk —
+// and "SHIP-READY · /ship is a straight shot" would be a claim about a stamp that
+// was never written (/ship's freshness gate skips silently when the fields are
+// absent, so the human would ship on it).
+const closeOk = closed != null && /done/i.test(String(closed))
+if (!closeOk) {
+  questions.push(
+    'the close agent died — the report, DoD ticks, freshness stamp and metrics were NEVER written. ' +
+    'The verdict above is real, but nothing landed on disk: rerun the cycle, or run /review ' +
+    `${feature} to re-stamp before /ship.`)
+}
+
 return {
-  outcome: success ? 'SHIP-READY' : 'STOPPED',
+  outcome: success && closeOk ? 'SHIP-READY' : 'STOPPED',
   rounds,
   verdict: verdict || 'not reached',
-  smoke: smokePass ? 'PASS' : 'FAIL',
+  smoke: smokeLabel,
   contractChanges,   // re-authorings the loop performed itself — review them in the diff
+  unreviewedSurfaces: unreviewed,   // reviewers that died — these carry NO verdict
   openFindings: open.slice(0, 10).map(f => `[${f.severity}] ${f.file}:${f.line} — ${f.problem}`),
   questions,         // everything deferred to you — empty when /brainstorm + /spec did their job
-  report: `specs/reports/${feature}.md`,
-  next: success
-    ? `/ship ${feature} — DoD ticked + freshness stamped, ship is a straight shot (human confirm stays)`
+  report: closeOk ? `specs/reports/${feature}.md` : '(NOT written — the close agent died)',
+  next: !closeOk
+    ? `nothing was written to disk (close agent died) — rerun the cycle, or /review ${feature} to re-stamp`
+    : success
+    ? (SMOKE_ON
+      ? `/ship ${feature} — DoD ticked + freshness stamped, ship is a straight shot (human confirm stays)`
+      : `/ship ${feature} — or /smoke ${feature} first: the cycle skipped it (opt-in), nobody has RUN this code; the runtime DoD boxes are unticked`)
     : `answer the questions, then rerun the cycle — or continue with /fix ${feature} + /review (Remediation is up to date)`,
 }

package/core/workflows/refactor.js

@@ -87,7 +87,10 @@ const backlog = await agent(
   `Requested domains: ${wanted === 'all' ? 'all' : wanted.join(', ')} — return only those (all ⇒ every domain with open items).`,
   { model: 'haiku', label: 'read-backlog', schema: OPEN, effort: 'low' },
 )
-const open = ((backlog && backlog.domains) || []).filter(d => d.items.length)
+// A dead reader is not "the backlog is empty" — reporting it as such sends the
+// human to re-run /audit on a backlog that is already there.
+if (!backlog) return { error: 'the backlog-reading agent died — nothing was read; re-run the refactor workflow' }
+const open = (backlog.domains || []).filter(d => d.items.length)
 if (!open.length) return { error: 'no open backlog items for the requested domains — run /audit (or the audit workflow) first' }
 
 const big = open.filter(d => d.items.length >= MIN_ITEMS)
@@ -167,12 +170,16 @@ results.push(...restResults.filter(Boolean))
 // ── Phase 5 — tick the cleared items ─────────────────────────────────────────
 phase('Tick')
 const clearedAll = results.flatMap(r => r.cleared)
+let tickedOk = true
 if (clearedAll.length) {
-  await agent(
+  const ticked = await agent(
     'In specs/refactor-backlog.md flip EXACTLY these open `- [ ]` item lines to `- [x]` (match verbatim, ' +
     'leave every other line untouched), then return the single word done:\n' + clearedAll.join('\n'),
     { model: 'haiku', label: 'tick-backlog', effort: 'low' },
   )
+  // Reporting items as cleared while the backlog still shows them open means the
+  // next /refactor re-dispatches work that is already done.
+  tickedOk = ticked != null && /done/i.test(String(ticked))
 }
 
 return {
@@ -181,7 +188,11 @@ return {
   }])),
   skippedSmall: Object.fromEntries(small.map(d => [d.key, d.items.length])),
   stillOpen: results.flatMap(r => r.remaining.map(line => `[${r.key}] ${line}`)).slice(0, 15),
-  next: results.some(r => r.remaining.length || !r.gatesGreen)
-    ? 'items remain — finish them with the conversational /refactor <domain>'
-    : 'all dispatched domains clean — optionally close with one final /audit',
+  backlogTicked: tickedOk,
+  next: !tickedOk
+    ? `${clearedAll.length} item(s) were cleared in code but NOT ticked off specs/refactor-backlog.md ` +
+      '(the ticking agent died) — tick them by hand, or the next /refactor re-dispatches finished work'
+    : results.some(r => r.remaining.length || !r.gatesGreen)
+      ? 'items remain — finish them with the conversational /refactor <domain>'
+      : 'all dispatched domains clean — optionally close with one final /audit',
 }

package/core/workflows/review.js

@@ -132,7 +132,17 @@ const staged = await agent(
   '4. Return the touched surfaces with their staged diff path and changed-file list. No changed paths at all ⇒ return an empty surfaces array.',
   { model: 'haiku', label: 'stage-diff', schema: STAGE, effort: 'low' },
 )
-const touched = (staged && staged.surfaces) || []
+// A DEAD staging agent returns null, which is not the same fact as "the diff is
+// empty" — conflating them handed back verdict SHIP ("nothing to review") for a
+// feature nobody had looked at. Distinguish them.
+if (!staged) {
+  return {
+    verdict: 'ABORTED',
+    reason: 'the diff-staging agent died — no reviewer was spawned and nothing was reviewed',
+    next: `re-run the review workflow, or /review ${feature} conversationally`,
+  }
+}
+const touched = staged.surfaces || []
 if (!touched.length) return { verdict: 'SHIP', reason: `no diff against ${base} — nothing to review`, findings: 0 }
 log(`Touched surfaces: ${touched.map(s => s.key).join(', ')}`)
 
@@ -172,14 +182,27 @@ const reviewed = await pipeline(
 )
 
 const results = reviewed.filter(Boolean)
+// A reviewer that DIED returns null — and a dead reviewer produces zero findings,
+// which is byte-identical to a clean surface. Left unchecked, "every reviewer
+// crashed" scores SHIP: the strongest possible verdict from the weakest possible
+// evidence. Name the unreviewed surfaces and refuse to certify them.
+const unreviewed = touched.filter(s => !results.some(r => r.key === s.key)).map(s => s.key)
+if (unreviewed.length) log(`Reviewer died on: ${unreviewed.join(', ')} — those surfaces are NOT reviewed`)
 const kept = results.flatMap(r => r.kept.map(f => ({ ...f, surface: r.key })))
 const refuted = results.flatMap(r => r.refuted.map(f => ({ ...f, surface: r.key })))
 const counts = { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0 }
 for (const f of kept) counts[f.severity] = (counts[f.severity] || 0) + 1
 // Verdict from the findings that SURVIVED the cross-check (a refuted CRITICAL
-// must not force a fix loop): security ⇒ BLOCK, CRITICAL ⇒ REVISE, else SHIP.
+// must not force a fix loop): security ⇒ BLOCK, CRITICAL ⇒ REVISE, else SHIP —
+// but never SHIP while a surface went unreviewed (absence of evidence, not
+// evidence of absence).
 const verdict = kept.some(f => f.kind === 'security') ? 'BLOCK'
-  : kept.some(f => f.severity === 'CRITICAL') ? 'REVISE' : 'SHIP'
+  : kept.some(f => f.severity === 'CRITICAL') ? 'REVISE'
+    : unreviewed.length ? 'REVISE' : 'SHIP'
+// Only a SHIP whose leftovers are all LOW is a clean bill of health. The
+// conversational /review routes any surviving CRITICAL/HIGH/security to /fix, so
+// this path must not answer "/ship" on a SHIP that still carries HIGH findings.
+const clean = verdict === 'SHIP' && kept.every(f => f.severity === 'LOW')
 
 // ── Phase 5 — stage the merged report; only the verdict leaves the workflow ──
 phase('Merge')
@@ -191,25 +214,54 @@ const reportBody = [
   ...['CRITICAL', 'HIGH', 'MEDIUM', 'LOW'].map(s => `| ${s} | ${counts[s] || 0} |`), '',
   `Verdict: ${verdict}`, '', '## Findings', '',
   kept.length ? kept.map(findingLine).join('\n') : 'None.',
+  ...(unreviewed.length ? ['', '## NOT reviewed (reviewer died — no verdict on these)', '',
+    unreviewed.map(k => `- \`${k}\` — re-run /review ${feature} (or the review workflow)`).join('\n')] : []),
   ...(refuted.length ? ['', '## Refuted by cross-check (no action needed)', '',
     refuted.map(f => `- ${f.file}:${f.line} · ${f.problem} — refuted: ${f.reason}`).join('\n')] : []),
 ].join('\n')
-await agent(
+const staging = await agent(
   `Stage a cohorte review report and its metrics, mechanically:\n` +
   `1. Write EXACTLY this content to specs/reports/${feature}.md (overwrite):\n<<<REPORT\n${reportBody}\nREPORT\n` +
   `2. Append one line to $(dirname "$(git rev-parse --git-common-dir)")/.claude/pipeline-metrics.jsonl: ` +
   `{"ts":"<ISO now>","feature":"${feature}","phase":"review","seconds":0,"surfaces":{${results.map(r => `"${r.key}":"${verdict}:${r.kept.length}"`).join(',')}}}\n` +
-  `3. Chain the opt-in usage ping: <core>/pipeline/scripts/telemetry-send.sh review "${feature}" 0 "${verdict}:${kept.length}" || true\n` +
+  `3. Chain the opt-in usage ping: <core>/pipeline/scripts/telemetry-send.sh review "${feature}" 0 "${verdict}:${kept.length}" || true ` +
+  '(<core> = .claude if .claude/pipeline/scripts/telemetry-send.sh exists, else ~/.claude; script on neither ⇒ skip the ping).\n' +
+  // Stamp + tick only when nothing above LOW survived: the conversational /review
+  // keeps the stamp only for LOW findings, and a SHIP verdict here can still carry
+  // HIGH/MEDIUM ones — certifying those for /ship would ship known defects. A dead
+  // reviewer already forced the verdict off SHIP, so `clean` covers that too.
+  (clean
+    ? `4. Stamp the freshness gate in specs/${feature}.md's front-matter, exactly as the conversational /review §3 does ` +
+      `(so /ship can prove the reviewed code is what ships): BASE=$(git merge-base ${base} HEAD); set reviewed_base: $BASE and ` +
+      `reviewed_digest: $(git diff $BASE -- . ':(exclude)specs/' | sha256sum | cut -c1-16). ` +
+      '5. Tick the spec DoD boxes this run verified (spec conformance + copy language — review SHIP; tests/lint/typecheck — green preflight); leave the rest unticked.\n'
+    : '') +
   'Return the single word: done.',
   { model: 'haiku', label: 'stage-report', effort: 'low' },
 )
 
+// The staging agent writes the report, the metrics line, and (when clean) the
+// freshness stamp + DoD ticks. If it died, none of that is on disk — returning
+// `report: <path>` and "/ship" would point the human at a file that does not
+// exist and certify a stamp that was never written.
+const staged_ok = staging != null && /done/i.test(String(staging))
+
 return {
   verdict,
   counts,
   refutedByCrossCheck: refuted.length,
+  reportStaged: staged_ok,
+  unreviewedSurfaces: unreviewed,   // reviewers that died — these carry NO verdict
   criticals: kept.filter(f => f.severity === 'CRITICAL' || f.kind === 'security')
     .map(f => `[${f.surface}] ${f.file}:${f.line} — ${f.problem}`),
-  report: `specs/reports/${feature}.md`,
-  next: verdict === 'SHIP' ? `/ship ${feature} (after DoD ticks)` : `/fix ${feature}`,
+  report: staged_ok ? `specs/reports/${feature}.md` : '(NOT written — the staging agent died)',
+  next: !staged_ok
+    ? `the report/metrics/freshness stamp were NEVER written (staging agent died) — the verdict above is real, but nothing is on disk: re-run the review workflow, or /review ${feature}`
+    : unreviewed.length
+      ? `re-run the review — no reviewer completed on: ${unreviewed.join(', ')}`
+      : clean
+        ? `/ship ${feature} (DoD ticked + freshness stamped)`
+        : verdict === 'SHIP'
+        ? `/fix ${feature} — SHIP verdict, but ${kept.length} finding(s) above LOW survived; park them in specs/refactor-backlog.md instead if you deliberately defer them`
+        : `/fix ${feature}`,
 }

package/dashboard/README.md

@@ -28,23 +28,40 @@ dashboard/
 | `yaml.js` | minimal block-YAML subset parser (for the `pipeline-profile` block + the config) |
 | `fleet.js` | tracked-project registry (`~/.claude/cohorte-dashboard.json`) + folder browse |
 | `kanban.js` | linked Obsidian board → columns/cards; PR enrichment + ship-date sort via `gh` |
+| `metrics.js` | `.claude/pipeline-metrics.jsonl` → per-feature phase/surface aggregate |
 
 ## API
 
 Read: `GET /api/versions`, `/api/state?project=`, `/api/fleet`, `/api/browse?dir=`,
-`/api/kanban?project=`. Mutate: `POST /api/projects` (add) · `DELETE /api/projects` (remove);
+`/api/kanban?project=`, `/api/metrics?project=`. Mutate: `POST /api/projects` (add) ·
+`DELETE /api/projects` (remove);
 `POST /api/action` — `{action:'install'|'update', scope, project}` (spawns the CLI),
 `{action:'reset', project, purgeSpecs}` (backup+wipe+reinstall), or
-`{action:'claude', command:'/init-pipeline'|'/update-pipeline', project}` (headless `claude -p`).
+`{action:'claude', command:'/init-pipeline'|'/update-pipeline'|'/audit', project}` (headless
+`claude -p`).
 Action responses stream chunked plain text ending in `__EXIT__ <code>`; the client reads the
 `ReadableStream` (`app/src/api.js` `streamAction`).
 
 ## Security
 
 Binds `127.0.0.1` by default — the action endpoints **execute code**. `--host=ADDR` opts into
-exposing it (prints a warning). CORS is not enabled: the frontend is same-origin (served by the
-agent). If a hosted-frontend model is ever added, lock CORS to the exact frontend origin (never `*`),
-or any site could drive the local agent.
+exposing it (prints a warning).
+
+Loopback binding is **not** a boundary against a browser: any page the user visits can fire
+requests at `127.0.0.1`, and DNS rebinding can make the responses readable. `guardBrowser()` in
+`index.js` closes both on every `/api/` route, without a token round-trip:
+
+- **Host must be a loopback origin** — kills rebinding (an attacker domain resolving to
+  `127.0.0.1` still sends its own `Host`). Skipped when the user bound a non-loopback host.
+- **State-changing methods must send `content-type: application/json`** — that header triggers a
+  CORS preflight this server never answers, so a browser cannot deliver it cross-origin; forms
+  can only send urlencoded/multipart/text.
+
+CORS response headers are never set, so a cross-origin page can fire a GET but cannot read it. If
+a hosted-frontend model is ever added, lock CORS to the exact frontend origin (never `*`).
+
+`runReset()` additionally refuses a project whose `.claude` resolves to the shared global core —
+the endpoint's whole promise is that `~/.claude` is never touched, and nothing else enforced it.
 
 ## Dev loop
 

package/dashboard/dist/assets/index-AFQnlfjO.css

@@ -0,0 +1 @@
+:root{--bg: #0e0f13;--panel: #16181f;--panel-2: #1c1f28;--border: #262a35;--text: #e6e8ee;--muted: #8b90a0;--accent: #6ea8fe;--ok: #3fb950;--warn: #d9a441;--bad: #f85149;--dev: #a371f7;--mono: ui-monospace, "JetBrains Mono", "SF Mono", Menlo, Consolas, monospace}*{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--text);font-family:var(--mono);font-size:14px}.app{min-height:100vh}.topbar{display:flex;align-items:center;justify-content:space-between;padding:12px 20px;border-bottom:1px solid var(--border);position:sticky;top:0;z-index:20;background:#0e0f13e6;-webkit-backdrop-filter:blur(6px);backdrop-filter:blur(6px)}.brand{font-weight:600;letter-spacing:.2px;display:flex;align-items:center;gap:8px}.dot{width:9px;height:9px;border-radius:50%;background:var(--accent);box-shadow:0 0 10px var(--accent)}.muted{color:var(--muted)}.small{font-size:12px}.grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));align-items:start;gap:16px;padding:20px;max-width:1100px;margin:0 auto}@media(max-width:720px){.grid{grid-template-columns:1fr}}.panel{background:var(--panel);border:1px solid var(--border);border-radius:12px;padding:16px 18px}.panel h2{margin:0 0 12px;font-size:13px;text-transform:uppercase;letter-spacing:1px;color:var(--muted)}.panel.placeholder{opacity:.7}.panel.error{grid-column:1 / -1;border-color:var(--bad);color:var(--bad)}.panel-head{display:flex;align-items:center;justify-content:space-between;margin-bottom:12px}.panel-head h2{margin:0}.badge{font-size:11px;padding:3px 9px;border-radius:999px;border:1px solid var(--border);white-space:nowrap}.badge.ok{color:var(--ok);border-color:color-mix(in srgb,var(--ok) 40%,transparent);background:color-mix(in srgb,var(--ok) 12%,transparent)}.badge.warn{color:var(--warn);border-color:color-mix(in srgb,var(--warn) 40%,transparent);background:color-mix(in srgb,var(--warn) 12%,transparent)}.badge.bad{color:var(--bad);border-color:color-mix(in srgb,var(--bad) 40%,transparent);background:color-mix(in srgb,var(--bad) 12%,transparent)}.badge.dev{color:var(--dev);border-color:color-mix(in srgb,var(--dev) 40%,transparent);background:color-mix(in srgb,var(--dev) 12%,transparent)}.badge.neutral{color:var(--muted)}.rows{display:flex;flex-direction:column;gap:2px}.row{display:flex;justify-content:space-between;gap:12px;padding:6px 0;border-bottom:1px dashed var(--border)}.row:last-child{border-bottom:none}.row-label{color:var(--muted)}.row-value{text-align:right}.row-value.strong{font-weight:600}.row-value.mono{font-family:var(--mono);font-size:12px}.actions{display:flex;align-items:center;gap:10px;margin-top:16px}.fresh-hint{margin:14px 0 0;padding-top:12px;border-top:1px dashed var(--border)}.fresh-hint strong{color:var(--accent)}button{font-family:var(--mono);font-size:13px;padding:7px 12px;border-radius:8px;border:1px solid var(--border);background:var(--panel-2);color:var(--text);cursor:pointer}button:disabled{opacity:.4;cursor:not-allowed}button.primary{background:color-mix(in srgb,var(--accent) 22%,var(--panel-2));border-color:color-mix(in srgb,var(--accent) 40%,transparent)}button.ghost{background:transparent}button:not(:disabled):hover{border-color:var(--accent)}.span2{grid-column:span 2}@media(max-width:720px){.span2{grid-column:1 / -1}}.summary{display:flex;gap:6px;flex-wrap:wrap}.checks{list-style:none;margin:0;padding:0;display:flex;flex-direction:column}.check{display:flex;gap:10px;padding:9px 0;border-bottom:1px solid var(--border)}.check:last-child{border-bottom:none}.check.skip{opacity:.55}.check-icon{flex:none;width:20px;height:20px;border-radius:6px;display:grid;place-items:center;font-size:12px;font-weight:700;margin-top:1px}.check-icon.ok{color:var(--ok);background:color-mix(in srgb,var(--ok) 15%,transparent)}.check-icon.warn{color:var(--warn);background:color-mix(in srgb,var(--warn) 15%,transparent)}.check-icon.bad{color:var(--bad);background:color-mix(in srgb,var(--bad) 15%,transparent)}.check-icon.skip{color:var(--muted);background:var(--panel-2)}.check-body{flex:1;min-width:0}.check-line{display:flex;gap:10px;justify-content:space-between;flex-wrap:wrap}.check-label{font-weight:600}.check-detail{color:var(--muted);text-align:right}.check-fix{margin-top:4px;font-size:12px;color:var(--muted)}.check-fix code{color:var(--accent);background:var(--panel-2);padding:1px 6px;border-radius:5px}.surfaces{display:flex;flex-direction:column;gap:10px}.surface{border:1px solid var(--border);border-radius:9px;padding:10px 12px;background:var(--panel-2)}.surface-top{display:flex;align-items:center;gap:8px}.surface-key{font-weight:600}.surface-meta{display:flex;justify-content:space-between;gap:10px;margin-top:4px;font-size:12px}.surface-tools{display:flex;flex-wrap:wrap;gap:4px;margin-top:8px}.tool{font-size:11px;color:var(--muted);border:1px solid var(--border);border-radius:5px;padding:1px 6px}.chip{font-size:11px;padding:1px 8px;border-radius:999px;border:1px solid var(--border)}.chip.design{color:var(--dev);border-color:color-mix(in srgb,var(--dev) 40%,transparent)}.chip.model-sonnet{color:var(--accent)}.chip.model-haiku{color:var(--ok)}.chip.model-inherit{color:var(--warn)}.fleet{max-width:1100px;margin:0 auto;padding:20px}.core-banner{display:flex;align-items:center;justify-content:space-between;gap:16px;flex-wrap:wrap;background:linear-gradient(180deg,var(--panel-2),var(--panel));border:1px solid var(--border);border-radius:12px;padding:14px 18px;margin-bottom:20px}.cb-left{display:flex;align-items:center;gap:12px;flex-wrap:wrap}.cb-title{text-transform:uppercase;letter-spacing:1px;font-size:12px;color:var(--muted)}.cb-version{font-weight:600;font-size:15px}.cb-actions{display:flex;gap:8px}.fleet-head{display:flex;align-items:center;justify-content:space-between;gap:16px;margin-bottom:14px;flex-wrap:wrap}.fleet-head h2{margin:0;font-size:14px;display:flex;align-items:center;gap:8px}.add-wrap{flex:1;max-width:560px}.add-form{display:flex;gap:8px}.path-input{flex:1;font-family:var(--mono);font-size:13px;padding:7px 12px;background:var(--panel);color:var(--text);border:1px solid var(--border);border-radius:8px}.path-input:focus{outline:none;border-color:var(--accent)}.path-input.invalid{border-color:var(--bad)}.add-error{margin-top:6px;font-size:12px;color:var(--bad);word-break:break-word}.fleet-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(300px,1fr));gap:14px}.project-card{background:var(--panel);border:1px solid var(--border);border-radius:12px;padding:14px 16px;cursor:pointer;transition:border-color .12s,transform .12s}.project-card:hover{border-color:var(--accent);transform:translateY(-1px)}.project-card.gone{opacity:.6;cursor:default}.pc-head{display:flex;align-items:center;justify-content:space-between}.pc-name{font-weight:600}.pc-path{margin:2px 0 10px}.pc-badges{display:flex;gap:6px;flex-wrap:wrap;margin-bottom:10px}.pc-health{display:flex;align-items:center;gap:5px}.pc-counts{margin-left:auto}.icon-btn{border:none;background:transparent;color:var(--muted);padding:2px 6px;border-radius:6px;font-size:13px}.icon-btn:hover{color:var(--bad);background:var(--panel-2)}.pill{font-size:11px;min-width:20px;text-align:center;padding:1px 7px;border-radius:999px;font-weight:600}.pill.ok{color:var(--ok);background:color-mix(in srgb,var(--ok) 14%,transparent)}.pill.warn{color:var(--warn);background:color-mix(in srgb,var(--warn) 14%,transparent)}.pill.bad{color:var(--bad);background:color-mix(in srgb,var(--bad) 14%,transparent)}.pill.neutral{color:var(--muted);background:var(--panel-2)}.detail-crumb{grid-column:1 / -1;margin-bottom:-4px;display:flex;align-items:center;justify-content:space-between;gap:12px;flex-wrap:wrap}.detail-tools{display:flex;gap:8px;flex-wrap:wrap}.tool-btn{font-size:12px;padding:5px 10px;border:1px solid color-mix(in srgb,var(--accent) 35%,var(--border));color:var(--accent);background:transparent}.tool-btn:hover{border-color:var(--accent);background:color-mix(in srgb,var(--accent) 10%,transparent)}.confirm-text p{margin:0 0 8px;font-size:13px;line-height:1.6}.confirm-text code{background:var(--panel-2);padding:1px 5px;border-radius:4px;color:var(--accent)}.warn-line{color:var(--warn)!important;background:color-mix(in srgb,var(--warn) 10%,transparent);border-radius:8px;padding:8px 10px}.warn-line code{color:var(--text)!important}.danger-ghost{background:transparent;border:1px solid color-mix(in srgb,var(--bad) 40%,var(--border));color:var(--bad);font-size:12px;padding:5px 10px}.danger-ghost:hover{background:color-mix(in srgb,var(--bad) 12%,transparent);border-color:var(--bad)}button.danger{background:color-mix(in srgb,var(--bad) 20%,var(--panel-2));border-color:color-mix(in srgb,var(--bad) 45%,transparent);color:#ffd7d3}button.danger:hover{border-color:var(--bad)}.reset-list{margin:8px 0;padding-left:18px;font-size:13px;line-height:1.7}.reset-list code{color:var(--accent)}.reset-note{font-size:12.5px;color:var(--muted);background:var(--panel-2);border-radius:8px;padding:10px 12px}.reset-note code{color:var(--text)}.reset-check{display:flex;align-items:center;gap:8px;margin:12px 0 0;font-size:13px}.reset-check code{color:var(--accent)}.board-scroll{max-height:500px;overflow:auto}.board{display:grid;grid-template-columns:repeat(4,1fr);gap:10px}.col{background:var(--bg);border:1px solid var(--border);border-radius:9px;padding:8px;min-width:140px}.col-head{display:flex;justify-content:space-between;font-size:11px;text-transform:uppercase;letter-spacing:.6px;color:var(--muted);padding:2px 4px 8px;position:sticky;top:0;background:var(--bg);z-index:1}.col-shipped{opacity:.85}.col-other{border-color:color-mix(in srgb,var(--warn) 40%,var(--border))}.spec-card{background:var(--panel-2);border:1px solid var(--border);border-radius:7px;padding:8px 9px;margin-bottom:7px}.spec-card.bad{border-color:color-mix(in srgb,var(--warn) 45%,transparent)}.spec-title{font-size:13px;font-weight:600}.spec-meta,.spec-branch{margin-top:3px}@media(max-width:640px){.board{grid-template-columns:repeat(2,1fr)}}.kanban-board{display:flex;gap:10px}.kanban-col{flex:0 0 210px;background:var(--bg);border:1px solid var(--border);border-radius:9px;padding:8px}.kanban-col.empty{opacity:.5}.kanban-card{background:var(--panel-2);border:1px solid var(--border);border-radius:7px;padding:8px 9px;margin-bottom:7px}.kanban-card.done{opacity:.6}.kanban-card.done .kc-text{text-decoration:line-through}.kc-text{font-size:12.5px;line-height:1.4}.kc-tags{display:flex;flex-wrap:wrap;gap:4px;margin-top:6px}.kc-tag{font-size:10px;color:var(--accent);background:color-mix(in srgb,var(--accent) 12%,transparent);border-radius:4px;padding:1px 5px}.kc-pr{font-size:10px;border-radius:4px;padding:1px 5px;text-decoration:none;border:1px solid var(--border);color:var(--muted)}a.kc-pr:hover{filter:brightness(1.25)}.kc-pr.state-open{color:var(--ok);border-color:color-mix(in srgb,var(--ok) 40%,transparent);background:color-mix(in srgb,var(--ok) 12%,transparent)}.kc-pr.state-merged{color:var(--dev);border-color:color-mix(in srgb,var(--dev) 40%,transparent);background:color-mix(in srgb,var(--dev) 12%,transparent)}.kc-pr.state-closed{color:var(--bad);border-color:color-mix(in srgb,var(--bad) 40%,transparent);background:color-mix(in srgb,var(--bad) 12%,transparent)}.kc-pr.draft{color:var(--muted);border-color:var(--border);background:var(--panel-2)}.kc-pr.flat{border-style:dashed;cursor:default}.kc-status{font-size:10px;margin-top:5px;color:var(--muted);text-transform:capitalize}.kc-status.state-open{color:var(--ok)}.kc-status.state-merged{color:var(--dev)}.kc-status.state-closed{color:var(--bad)}.metrics-list{display:flex;flex-direction:column;gap:12px}.metric-feature{background:var(--bg);border:1px solid var(--border);border-radius:9px;padding:10px 12px}.mf-head{display:flex;align-items:center;justify-content:space-between;gap:10px;flex-wrap:wrap;margin-bottom:8px}.mf-name{font-weight:600}.mf-badges{display:flex;gap:6px;flex-wrap:wrap}.phase-bars{display:flex;flex-direction:column;gap:4px}.phase-row{display:grid;grid-template-columns:56px 1fr 90px;align-items:center;gap:10px}.phase-label{color:var(--muted);font-size:12px}.phase-track{height:12px;border-radius:4px;background:var(--panel-2);overflow:hidden}.phase-fill{display:block;height:100%;min-width:2px;border-radius:4px;background:color-mix(in srgb,var(--accent) 65%,var(--panel-2))}.phase-value{text-align:right;white-space:nowrap}.surface-table{width:100%;border-collapse:collapse;margin-top:10px;font-size:12px}.surface-table th{text-align:left;color:var(--muted);font-weight:400;text-transform:uppercase;letter-spacing:.6px;font-size:10px;padding:4px 8px 6px 0;border-bottom:1px dashed var(--border)}.surface-table td{padding:5px 8px 5px 0;border-bottom:1px dashed var(--border)}.surface-table tr:last-child td{border-bottom:none}.st-key{font-weight:600}.modal-backdrop{position:fixed;top:0;right:0;bottom:0;left:0;background:#0009;display:grid;place-items:center;z-index:50;padding:20px}.modal{background:var(--panel);border:1px solid var(--border);border-radius:12px;width:min(720px,100%);max-height:80vh;display:flex;flex-direction:column;padding:18px}.modal-head{display:flex;align-items:center;justify-content:space-between;margin-bottom:12px}.modal-head h3{margin:0;font-size:15px}.modal-actions{display:flex;gap:8px;margin-top:14px}.cmd{background:#000;color:var(--accent);padding:10px 12px;border-radius:8px;font-size:13px;overflow-x:auto}.run-log{background:#000;color:#d6d9e0;padding:12px;border-radius:8px;font-size:12.5px;line-height:1.5;overflow:auto;white-space:pre-wrap;word-break:break-word;flex:1;min-height:200px;max-height:55vh;margin:0}.picker{max-height:74vh}.picker-path{background:var(--panel-2);border:1px solid var(--border);border-radius:7px;padding:7px 10px;margin-bottom:10px;word-break:break-all}.picker-list{flex:1;overflow:auto;border:1px solid var(--border);border-radius:8px;padding:6px;min-height:220px;max-height:48vh}.picker-row{display:flex;align-items:center;gap:8px;width:100%;text-align:left;background:transparent;border:none;border-radius:6px;padding:7px 9px;color:var(--text);font-size:13px}.picker-row:hover{background:var(--panel-2);border-color:transparent}.picker-row.up{color:var(--muted)}.picker-icon{color:var(--muted);width:14px;flex:none}.picker-name{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.picker-row .badge.small{font-size:10px;padding:0 6px;margin-left:auto}.picker-empty{padding:12px}.add-form .ghost[type=button]{white-space:nowrap}