cohorte 1.3.3 → 1.3.4

package/scripts/test-workflows.mjs

@@ -0,0 +1,443 @@
+#!/usr/bin/env node
+// Behavioural tests for core/workflows/*.js.
+//
+// The workflow runtime hands a script an async function body with agent() /
+// parallel() / pipeline() / phase() / log() / args / budget injected. Nothing in
+// a script touches the filesystem, so the whole orchestration is testable by
+// injecting stub agents and asserting the returned verdict object.
+//
+// This exists because of one specific failure mode: agent() resolves to `null`
+// when a subagent dies, and a dead reviewer produces zero findings — which is
+// byte-identical to a clean surface. Both review.js and cycle.js scored that as
+// SHIP, and cycle.js went on to tick the DoD and stamp the freshness gate over
+// code no reviewer had read. A unit test is the only thing that catches it: the
+// structural checks in validate-core.mjs cannot see verdict logic.
+//
+//   node scripts/test-workflows.mjs
+
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = fileURLToPath(new URL("..", import.meta.url));
+const AsyncFunction = Object.getPrototypeOf(async function () {}).constructor;
+
+let failures = 0;
+const check = (name, cond, detail = "") => {
+  if (cond) console.log(`  ✓ ${name}`);
+  else { failures++; console.error(`  ✗ ${name}${detail ? ` — ${detail}` : ""}`); }
+};
+
+const PROFILE = {
+  name: "testproj",
+  vcs: { default_branch: "main" },
+  contract: { enabled: false, path: "packages/shared/src", ext: "ts", mechanism: "none" },
+  commands: { typecheck: "tsc --noEmit", lint_quiet: "lint -q", test_quiet: "test --dot" },
+  surfaces: [
+    { key: "backend", path: "apps/api", agent: "backend", uses_design: false },
+    { key: "frontend", path: "apps/web", agent: "frontend", uses_design: true },
+  ],
+};
+
+const TOUCHED = [
+  { key: "backend", diff: "specs/reports/f.backend.diff", files: ["apps/api/a.ts"] },
+  { key: "frontend", diff: "specs/reports/f.frontend.diff", files: ["apps/web/b.tsx"] },
+];
+
+const finding = (over = {}) => ({
+  severity: "HIGH", file: "apps/api/a.ts", line: 3, kind: "quality",
+  problem: "p", fix: "f", ...over,
+});
+
+// Run one workflow script with a `reply(prompt, opts) => value` stub in place of
+// every agent call. Returns { result, calls }.
+async function run(script, reply, args = { feature: "feat-x" }) {
+  const text = readFileSync(join(root, "core/workflows", script), "utf8")
+    .replace(/^export const meta/m, "const meta");
+  const calls = [];
+  const agent = async (prompt, opts = {}) => {
+    calls.push(opts.label || "(unlabelled)");
+    return reply(prompt, opts, calls);
+  };
+  // Mirrors the runtime's contract: a thunk that throws resolves to null, the
+  // call itself never rejects.
+  const parallel = thunks =>
+    Promise.all(thunks.map(t => Promise.resolve().then(t).catch(() => null)));
+  // Each item runs through every stage independently; a throwing stage drops
+  // that item to null and skips its remaining stages.
+  const pipeline = (items, ...stages) =>
+    Promise.all(items.map(async (item, i) => {
+      let v = item;
+      for (const s of stages) {
+        try { v = await s(v, item, i); } catch { return null; }
+      }
+      return v;
+    }));
+  const fn = new AsyncFunction(
+    "agent", "parallel", "pipeline", "phase", "log", "args", "budget", "workflow", text);
+  const result = await fn(
+    agent, parallel, pipeline, () => {}, () => {}, args,
+    { total: null, spent: () => 0, remaining: () => Infinity }, async () => {});
+  return { result, calls };
+}
+
+// A reply table keyed by label prefix; the first matching prefix wins.
+const replier = table => (prompt, opts) => {
+  const label = opts.label || "";
+  for (const [prefix, value] of table) {
+    if (label === prefix || label.startsWith(prefix)) {
+      return typeof value === "function" ? value(label) : value;
+    }
+  }
+  return "ok";
+};
+
+const BASE_REVIEW = [
+  ["profile", PROFILE],
+  ["preflight", { pass: true }],
+  ["stage-diff", { surfaces: TOUCHED }],
+  ["stage-report", "done"],
+];
+
+const BASE_CYCLE = [
+  ["profile", PROFILE],
+  ["ready", { frozen: true, gaps: [], designLinks: "none" }],
+  ["preflight", { pass: true }],
+  ["stage-diff", { surfaces: TOUCHED }],
+  ["build:", "handoff ok"],
+  ["fix:", "handoff ok"],
+  ["close", "done"],
+];
+
+// ── review.js ────────────────────────────────────────────────────────────────
+console.log("review.js");
+{
+  const { result } = await run("review.js", replier([
+    ["review:", { verdict: "SHIP", findings: [] }], ...BASE_REVIEW,
+  ]));
+  check("clean run ⇒ SHIP", result.verdict === "SHIP", `got ${result.verdict}`);
+  check("clean run ⇒ no unreviewed surfaces", (result.unreviewedSurfaces || []).length === 0);
+  check("clean run ⇒ next is /ship", String(result.next).startsWith("/ship"), result.next);
+}
+{
+  // THE regression: every reviewer dies ⇒ zero findings ⇒ must NOT read as SHIP.
+  const { result } = await run("review.js", replier([
+    ["review:", null], ...BASE_REVIEW,
+  ]));
+  check("all reviewers dead ⇒ not SHIP", result.verdict !== "SHIP", `got ${result.verdict}`);
+  check("all reviewers dead ⇒ both surfaces reported unreviewed",
+    (result.unreviewedSurfaces || []).join(",") === "backend,frontend",
+    JSON.stringify(result.unreviewedSurfaces));
+  check("all reviewers dead ⇒ next says re-run",
+    /re-run the review/.test(result.next), result.next);
+}
+{
+  // One dead reviewer must not be masked by the other surface coming back clean.
+  const { result } = await run("review.js", replier([
+    ["review:backend", null],
+    ["review:", { verdict: "SHIP", findings: [] }],
+    ...BASE_REVIEW,
+  ]));
+  check("one reviewer dead ⇒ not SHIP", result.verdict !== "SHIP", `got ${result.verdict}`);
+  check("one reviewer dead ⇒ names only that surface",
+    (result.unreviewedSurfaces || []).join(",") === "backend", JSON.stringify(result.unreviewedSurfaces));
+}
+{
+  // A SHIP carrying HIGH findings is a real verdict, but it is not "go ship it":
+  // the conversational /review routes any surviving HIGH to /fix.
+  const { result } = await run("review.js", replier([
+    ["review:", { verdict: "SHIP", findings: [finding()] }], ...BASE_REVIEW,
+  ]));
+  check("SHIP + HIGH findings ⇒ verdict still SHIP", result.verdict === "SHIP");
+  check("SHIP + HIGH findings ⇒ next routes to /fix, not /ship",
+    String(result.next).startsWith("/fix"), result.next);
+}
+{
+  const { result } = await run("review.js", replier([
+    ["review:", { verdict: "SHIP", findings: [finding({ severity: "LOW" })] }], ...BASE_REVIEW,
+  ]));
+  check("SHIP + only LOW ⇒ next is /ship", String(result.next).startsWith("/ship"), result.next);
+}
+{
+  const { result } = await run("review.js", replier([
+    ["preflight", { pass: false, tail: "boom" }], ...BASE_REVIEW,
+  ]));
+  check("red preflight ⇒ ABORTED", result.verdict === "ABORTED", `got ${result.verdict}`);
+}
+{
+  const { calls } = await run("review.js", replier([
+    ["preflight", { pass: false, tail: "boom" }], ...BASE_REVIEW,
+  ]));
+  check("red preflight ⇒ zero reviewers spawned",
+    !calls.some(c => c.startsWith("review:")), calls.join(","));
+}
+
+// ── cycle.js ─────────────────────────────────────────────────────────────────
+console.log("cycle.js");
+{
+  const { result } = await run("cycle.js", replier([
+    ["review:", { verdict: "SHIP", findings: [] }], ...BASE_CYCLE,
+  ]));
+  check("clean run, smoke off ⇒ SHIP-READY", result.outcome === "SHIP-READY", `got ${result.outcome}`);
+  check("smoke off ⇒ smoke: SKIPPED", result.smoke === "SKIPPED", result.smoke);
+  check("smoke off ⇒ next warns nobody ran the code",
+    /\/smoke/.test(result.next), result.next);
+  check("clean run ⇒ no questions", (result.questions || []).length === 0, JSON.stringify(result.questions));
+}
+{
+  const { result } = await run("cycle.js", replier([
+    ["smoke", { pass: true, failures: [] }],
+    ["review:", { verdict: "SHIP", findings: [] }], ...BASE_CYCLE,
+  ]), { feature: "feat-x", smoke: true });
+  check("clean run, smoke on ⇒ SHIP-READY", result.outcome === "SHIP-READY", `got ${result.outcome}`);
+  check("smoke on ⇒ smoke: PASS", result.smoke === "PASS", result.smoke);
+  check("smoke on + clean ⇒ next is a straight /ship",
+    /straight shot/.test(result.next), result.next);
+}
+{
+  // THE regression, cycle-side: dead reviewers used to exit SHIP-READY, which
+  // ticks the DoD and stamps the freshness gate.
+  const { result } = await run("cycle.js", replier([
+    ["review:", null], ...BASE_CYCLE,
+  ]), { feature: "feat-x", maxRounds: 2 });
+  check("all reviewers dead ⇒ not SHIP-READY", result.outcome !== "SHIP-READY", `got ${result.outcome}`);
+  check("all reviewers dead ⇒ verdict not SHIP", result.verdict !== "SHIP", result.verdict);
+  check("all reviewers dead ⇒ surfaces reported",
+    (result.unreviewedSurfaces || []).length === 2, JSON.stringify(result.unreviewedSurfaces));
+  check("all reviewers dead ⇒ a question names them",
+    (result.questions || []).some(q => /not reviewed/i.test(q)), JSON.stringify(result.questions));
+}
+{
+  // …and it must retry the review round rather than dispatching an empty fix round.
+  const { calls } = await run("cycle.js", replier([
+    ["review:", null], ...BASE_CYCLE,
+  ]), { feature: "feat-x", maxRounds: 3 });
+  check("dead reviewers ⇒ review retried across rounds",
+    calls.filter(c => c.startsWith("review:")).length > 2,
+    `review calls: ${calls.filter(c => c.startsWith("review:")).length}`);
+  check("dead reviewers ⇒ no empty fix round dispatched",
+    !calls.some(c => c.startsWith("fix:")), calls.join(","));
+}
+{
+  const { result } = await run("cycle.js", replier([
+    ["ready", { frozen: false, gaps: ["status is draft"], designLinks: "none" }], ...BASE_CYCLE,
+  ]));
+  check("unfrozen spec ⇒ NOT-READY", result.outcome === "NOT-READY", `got ${result.outcome}`);
+  check("unfrozen spec ⇒ the gap is in questions",
+    (result.questions || []).some(q => /draft/.test(q)), JSON.stringify(result.questions));
+}
+{
+  const { result } = await run("cycle.js", replier([
+    ["smoke", { pass: false, failures: ["❌ POST /x · expected 201 got 500 · apps/api/a.ts"] }],
+    ["review:", { verdict: "SHIP", findings: [] }], ...BASE_CYCLE,
+  ]), { feature: "feat-x", smoke: true, maxRounds: 1 });
+  check("smoke on + FAIL ⇒ not SHIP-READY", result.outcome !== "SHIP-READY", `got ${result.outcome}`);
+  check("smoke on + FAIL ⇒ smoke: FAIL", result.smoke === "FAIL", result.smoke);
+}
+{
+  // A finding in round 1 that the fix clears must let round 2 exit clean.
+  let round = 0;
+  const { result } = await run("cycle.js", (prompt, opts) => {
+    const l = opts.label || "";
+    if (l.startsWith("review:")) {
+      round++;
+      return round <= 2 ? { verdict: "REVISE", findings: [finding({ severity: "CRITICAL" })] }
+        : { verdict: "SHIP", findings: [] };
+    }
+    if (l.startsWith("verify:")) return { refuted: false, reason: "holds" };
+    return replier(BASE_CYCLE)(prompt, opts);
+  }, { feature: "feat-x", maxRounds: 4 });
+  check("findings then clean ⇒ SHIP-READY", result.outcome === "SHIP-READY", `got ${result.outcome}`);
+  check("findings then clean ⇒ took >1 round", result.rounds > 1, `rounds ${result.rounds}`);
+}
+{
+  // A refuted CRITICAL must not force a fix round.
+  const { result, calls } = await run("cycle.js", (prompt, opts) => {
+    const l = opts.label || "";
+    if (l.startsWith("review:")) return { verdict: "REVISE", findings: [finding({ severity: "CRITICAL" })] };
+    if (l.startsWith("verify:")) return { refuted: true, reason: "guarded upstream" };
+    return replier(BASE_CYCLE)(prompt, opts);
+  }, { feature: "feat-x", maxRounds: 2 });
+  check("cross-check refutes the only CRITICAL ⇒ SHIP-READY",
+    result.outcome === "SHIP-READY", `got ${result.outcome}`);
+  check("refuted finding ⇒ no fix round", !calls.some(c => c.startsWith("fix:")), calls.join(","));
+}
+{
+  const { result } = await run("cycle.js", replier([
+    ["build:", null], ["review:", { verdict: "SHIP", findings: [] }], ...BASE_CYCLE,
+  ]));
+  check("dead implementers ⇒ a question names them",
+    (result.questions || []).some(q => /implementer\(s\) died/.test(q)), JSON.stringify(result.questions));
+}
+{
+  const { result } = await run("cycle.js", replier([
+    ["profile", { error: "PIPELINE.md not found" }], ...BASE_CYCLE,
+  ]));
+  check("unreadable profile ⇒ ABORTED", result.outcome === "ABORTED", `got ${result.outcome}`);
+}
+{
+  // A DEAD contract agent must not be reported as a successful re-authoring, and
+  // must not hand every surface a "the contract was RE-AUTHORED, realign" item
+  // pointing at a file nobody touched.
+  const CONTRACT_PROFILE = {
+    ...PROFILE,
+    contract: { enabled: true, path: "packages/shared/src", ext: "ts", mechanism: "shared-types-zod", index: "" },
+  };
+  const contractFinding = finding({ severity: "CRITICAL", file: "packages/shared/src/feat-x.ts" });
+  const { result, calls } = await run("cycle.js", (prompt, opts) => {
+    const l = opts.label || "";
+    if (l === "profile") return CONTRACT_PROFILE;
+    if (l === "contract-fix") return null;              // the agent dies
+    if (l.startsWith("review:")) return { verdict: "REVISE", findings: [contractFinding] };
+    if (l.startsWith("verify:")) return { refuted: false, reason: "holds" };
+    return replier(BASE_CYCLE)(prompt, opts);
+    // maxRounds ≥ 2: the loop breaks at the cap BEFORE the fix block, so a
+    // 1-round run never reaches the contract path at all (a vacuous test).
+  }, { feature: "feat-x", maxRounds: 2 });
+  check("dead contract agent ⇒ no fabricated contractChanges entry",
+    (result.contractChanges || []).length === 0, JSON.stringify(result.contractChanges));
+  check("dead contract agent ⇒ a question says the contract is UNCHANGED",
+    (result.questions || []).some(q => /contract agent died/.test(q)), JSON.stringify(result.questions));
+  check("dead contract agent ⇒ no surface told to realign against it",
+    !calls.some(c => c.startsWith("fix:")), calls.join(","));
+}
+{
+  // Preflight red with no owning surface used to spin the loop doing nothing
+  // until the round cap, then report a stale verdict.
+  const { result, calls } = await run("cycle.js", replier([
+    ["preflight", { pass: false, tail: "error in vendor/thing.go: boom" }],
+    ["build:", null],                                   // no implementer survives
+    ...BASE_CYCLE,
+  ]), { feature: "feat-x", maxRounds: 5 });
+  check("red preflight with no owning surface ⇒ stops instead of spinning",
+    result.rounds === 1, `burned ${result.rounds} round(s)`);
+  check("…and dispatches no fix agent", !calls.some(c => c.startsWith("fix:")), calls.join(","));
+  check("…and the question carries the failure tail",
+    (result.questions || []).some(q => /no surface owns the failure/.test(q)),
+    JSON.stringify(result.questions));
+}
+{
+  // A finding under no surface path has no owner: it keeps the loop from exiting
+  // clean while nobody is ever dispatched to fix it. Reachable because `touched`
+  // is agent-supplied — the stage-diff agent can name a key the profile lacks.
+  const orphan = finding({ severity: "CRITICAL", file: "tools/thing.sh", line: 9 });
+  const { result } = await run("cycle.js", (prompt, opts) => {
+    const l = opts.label || "";
+    if (l === "stage-diff") return { surfaces: [{ key: "tools", diff: "d", files: ["tools/thing.sh"] }] };
+    if (l.startsWith("review:")) return { verdict: "REVISE", findings: [orphan] };
+    if (l.startsWith("verify:")) return { refuted: false, reason: "holds" };
+    return replier(BASE_CYCLE)(prompt, opts);
+  }, { feature: "feat-x", maxRounds: 3 });
+  check("a finding owned by no surface names the file, not just 'run /fix manually'",
+    (result.questions || []).some(q => /never dispatched/.test(q) && /tools\/thing\.sh:9/.test(q)),
+    JSON.stringify(result.questions));
+}
+
+// ── the dead-agent family, swept across every terminal/staging agent ─────────
+// `agent()` returns null when a subagent dies. Any call whose result is turned
+// into a CLAIM (a verdict, a path, "it is on disk") must distinguish "died" from
+// "succeeded with nothing to say". This block is the sweep.
+console.log("dead-agent sweep");
+{
+  const { result } = await run("review.js", replier([
+    ["stage-diff", null], ...BASE_REVIEW,
+  ]));
+  check("review: dead diff-stager ⇒ ABORTED, not 'SHIP — nothing to review'",
+    result.verdict === "ABORTED", `got ${result.verdict}: ${result.reason}`);
+}
+{
+  const { result } = await run("review.js", replier([
+    ["stage-report", null],
+    ["review:", { verdict: "SHIP", findings: [] }], ...BASE_REVIEW,
+  ]));
+  check("review: dead report-stager ⇒ reportStaged false", result.reportStaged === false);
+  check("review: dead report-stager ⇒ report path not claimed",
+    !/^specs\//.test(String(result.report)), result.report);
+  check("review: dead report-stager ⇒ next says nothing was written",
+    /NEVER written/.test(result.next), result.next);
+}
+{
+  const { result } = await run("cycle.js", replier([
+    ["stage-diff", null], ["review:", { verdict: "SHIP", findings: [] }], ...BASE_CYCLE,
+  ]));
+  check("cycle: dead diff-stager ⇒ diagnosed as such, not 'wrong branch'",
+    (result.questions || []).some(q => /diff-staging agent died/.test(q)),
+    JSON.stringify(result.questions));
+}
+{
+  const { result } = await run("cycle.js", replier([
+    ["close", null], ["review:", { verdict: "SHIP", findings: [] }], ...BASE_CYCLE,
+  ]));
+  check("cycle: dead close agent ⇒ NOT SHIP-READY",
+    result.outcome !== "SHIP-READY", `got ${result.outcome}`);
+  check("cycle: dead close agent ⇒ a question says nothing was written",
+    (result.questions || []).some(q => /NEVER written/.test(q)), JSON.stringify(result.questions));
+  check("cycle: dead close agent ⇒ report path not claimed",
+    !/^specs\//.test(String(result.report)), result.report);
+}
+{
+  const { result } = await run("audit.js", replier([
+    ["profile", PROFILE], ["gates", { failures: [] }],
+    ["audit:backend", null],
+    ["audit:", { items: [] }], ["write-backlog", "done"],
+  ]), {});
+  check("audit: dead auditor ⇒ the domain is listed as NOT audited",
+    (result.notAudited || []).join(",") === "backend", JSON.stringify(result.notAudited));
+  check("audit: dead auditor ⇒ next tells you to re-audit it",
+    /re-audit backend/.test(result.next), result.next);
+}
+{
+  const { result } = await run("audit.js", replier([
+    ["profile", PROFILE], ["gates", { failures: [] }],
+    ["audit:", { items: [] }], ["write-backlog", null],
+  ]), {});
+  check("audit: dead backlog writer ⇒ path not claimed",
+    !/^specs\//.test(String(result.backlog)), result.backlog);
+}
+{
+  const { result } = await run("refactor.js", replier([
+    ["profile", PROFILE], ["read-backlog", null],
+  ]), { domains: "all" });
+  check("refactor: dead backlog reader ⇒ says it died, not 'no open items'",
+    /agent died/.test(String(result.error)), result.error);
+}
+{
+  const items = ["- [ ] a", "- [ ] b", "- [ ] c", "- [ ] d", "- [ ] e"];
+  const { result } = await run("refactor.js", replier([
+    ["profile", PROFILE],
+    ["read-backlog", { domains: [{ key: "backend", items }] }],
+    ["verify:", { cleared: items, remaining: [], gatesGreen: true }],
+    ["reverify:", { cleared: items, remaining: [], gatesGreen: true }],
+    ["tick-backlog", null],
+    ["refactor:", "handoff"],
+  ]), { domains: "all" });
+  check("refactor: dead ticker ⇒ backlogTicked false", result.backlogTicked === false);
+  check("refactor: dead ticker ⇒ next warns the backlog still shows them open",
+    /NOT ticked/.test(result.next), result.next);
+}
+
+// ── audit.js / refactor.js — smoke-level: they must return, not throw ────────
+console.log("audit.js / refactor.js");
+{
+  const { result } = await run("audit.js", replier([
+    ["profile", PROFILE],
+    ["gates", { failures: [] }],
+    ["audit:", { items: [{ severity: "HIGH", file: "apps/api/a.ts", line: 1, kind: "tdd", fix: "add a test" }] }],
+    ["write-backlog", "done"],
+  ]), {});
+  check("audit returns a backlog path", result.backlog === "specs/refactor-backlog.md", JSON.stringify(result));
+  check("audit counts every domain (surfaces + shared)",
+    Object.keys(result.domains || {}).join(",") === "backend,frontend,shared", JSON.stringify(result.domains));
+}
+{
+  const { result } = await run("refactor.js", replier([
+    ["profile", PROFILE],
+    ["read-backlog", { domains: [{ key: "backend", items: ["- [ ] a", "- [ ] b"] }] }],
+  ]), { domains: "all" });
+  check("refactor skips a domain below the item threshold",
+    result.skipped && result.skipped.backend === 2, JSON.stringify(result));
+}
+
+console.log("");
+if (failures) { console.error(`test-workflows: ${failures} failure(s)`); process.exit(1); }
+console.log("test-workflows: OK");

package/scripts/validate-core.mjs

@@ -168,6 +168,11 @@ else for (const f of readdirSync(workflowsDir)) {
     fail(path, "phase 0 must read the profile via the profile-reader agent");
   if (/\bDate\.now\(\)|\bMath\.random\(\)|new Date\(\)/.test(text))
     fail(path, "Date.now()/Math.random()/new Date() are unavailable in workflow scripts");
+  // Prompts hand agents literal `<core>/…` paths; an agent can only resolve that
+  // token if the same script also spells out what <core> means. A bare token +
+  // `|| true` = the command fails silently and the ping/metrics never happen.
+  if (text.includes("<core>/") && !/<core> = /.test(text))
+    fail(path, "uses <core>/ paths in prompts without defining `<core> = …` anywhere");
   try {
     new AsyncFunction("agent", "parallel", "pipeline", "phase", "log", "args",
       "budget", "workflow", text.replace(/^export const meta/m, "const meta"));
@@ -182,6 +187,50 @@ if (!installSh.includes("core/workflows"))
 if (!installPs1.includes("core\\workflows"))
   fail("install.ps1", "does not copy core\\workflows (Copy-Core)");
 
+// A new workflow script must also be KNOWN to the things that check for it, or it
+// ships and nothing notices when an installer stops copying it. cycle.js shipped in
+// 1.3.0 while three call sites still said "review/audit/refactor".
+const workflowNames = existsSync(workflowsDir)
+  ? readdirSync(workflowsDir).filter((f) => f.endsWith(".js"))
+  : [];
+const ci = existsSync(join(root, ".github/workflows/ci.yml")) ? read(".github/workflows/ci.yml") : "";
+const dashDoctor = read("dashboard/server/doctor.js");
+for (const f of workflowNames) {
+  if (!ci.includes(`workflows/${f}`))
+    fail(".github/workflows/ci.yml", `install dry-run never asserts .claude/workflows/${f}`);
+  if (!dashDoctor.includes(`'${f}'`))
+    fail("dashboard/server/doctor.js", `checkWorkflows() does not list ${f}`);
+}
+
+// ── dashboard: the metrics phase list is duplicated server/client ────────────
+// A phase present in one and not the other parses fine and renders in no column —
+// silently invisible data, which is how the cycle batch went unnoticed.
+const phaseList = (text, file) => {
+  const m = text.match(/const PHASES = \[([^\]]*)\]/);
+  if (!m) { fail(file, "no `const PHASES = [...]` found"); return null; }
+  return m[1].split(",").map((s) => s.trim().replace(/^['"]|['"]$/g, "")).filter(Boolean);
+};
+const serverPhases = phaseList(read("dashboard/server/metrics.js"), "dashboard/server/metrics.js");
+const clientPhases = phaseList(read("dashboard/app/src/components/MetricsPanel.jsx"),
+  "dashboard/app/src/components/MetricsPanel.jsx");
+if (serverPhases && clientPhases && serverPhases.join("|") !== clientPhases.join("|"))
+  fail("dashboard/app/src/components/MetricsPanel.jsx",
+    `PHASES drifted from dashboard/server/metrics.js ([${clientPhases}] vs [${serverPhases}])`);
+
+// ── packaging: no build artifacts in the published tarball ──────────────────
+// `.npmignore` is INERT under an explicit package.json `files` allowlist, so its
+// `__pycache__/` rule never fired — a maintainer who had compiled gate.py shipped
+// their machine's bytecode cache. The negations in `files` are what actually work.
+const pkg = JSON.parse(read("package.json"));
+for (const negation of ["!core/hooks/__pycache__", "!**/*.pyc"])
+  if (!(pkg.files || []).includes(negation))
+    fail("package.json", `\`files\` must carry the ${negation} negation (.npmignore cannot do this)`);
+for (const [name, src] of Object.entries(installers))
+  if (!src.includes("__pycache__"))
+    fail(name, "never scrubs hooks/__pycache__ — cp -R would carry it into the user's .claude");
+if (!read("bin/cli.js").includes("__pycache__"))
+  fail("bin/cli.js", "copyCore() never excludes __pycache__ from the hooks copy");
+
 // ── report ──────────────────────────────────────────────────────────────────
 if (errors.length) {
   console.error(`validate-core: ${errors.length} error(s)\n`);

package/dashboard/dist/assets/index-Cj0SpgEY.css

@@ -1 +0,0 @@
-:root{--bg: #0e0f13;--panel: #16181f;--panel-2: #1c1f28;--border: #262a35;--text: #e6e8ee;--muted: #8b90a0;--accent: #6ea8fe;--ok: #3fb950;--warn: #d9a441;--bad: #f85149;--dev: #a371f7;--mono: ui-monospace, "JetBrains Mono", "SF Mono", Menlo, Consolas, monospace}*{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--text);font-family:var(--mono);font-size:14px}.app{min-height:100vh}.topbar{display:flex;align-items:center;justify-content:space-between;padding:12px 20px;border-bottom:1px solid var(--border);position:sticky;top:0;z-index:20;background:#0e0f13e6;-webkit-backdrop-filter:blur(6px);backdrop-filter:blur(6px)}.brand{font-weight:600;letter-spacing:.2px;display:flex;align-items:center;gap:8px}.dot{width:9px;height:9px;border-radius:50%;background:var(--accent);box-shadow:0 0 10px var(--accent)}.muted{color:var(--muted)}.small{font-size:12px}.grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));align-items:start;gap:16px;padding:20px;max-width:1100px;margin:0 auto}@media(max-width:720px){.grid{grid-template-columns:1fr}}.panel{background:var(--panel);border:1px solid var(--border);border-radius:12px;padding:16px 18px}.panel h2{margin:0 0 12px;font-size:13px;text-transform:uppercase;letter-spacing:1px;color:var(--muted)}.panel.placeholder{opacity:.7}.panel.error{grid-column:1 / -1;border-color:var(--bad);color:var(--bad)}.panel-head{display:flex;align-items:center;justify-content:space-between;margin-bottom:12px}.panel-head h2{margin:0}.badge{font-size:11px;padding:3px 9px;border-radius:999px;border:1px solid var(--border);white-space:nowrap}.badge.ok{color:var(--ok);border-color:color-mix(in srgb,var(--ok) 40%,transparent);background:color-mix(in srgb,var(--ok) 12%,transparent)}.badge.warn{color:var(--warn);border-color:color-mix(in srgb,var(--warn) 40%,transparent);background:color-mix(in srgb,var(--warn) 12%,transparent)}.badge.bad{color:var(--bad);border-color:color-mix(in srgb,var(--bad) 40%,transparent);background:color-mix(in srgb,var(--bad) 12%,transparent)}.badge.dev{color:var(--dev);border-color:color-mix(in srgb,var(--dev) 40%,transparent);background:color-mix(in srgb,var(--dev) 12%,transparent)}.badge.neutral{color:var(--muted)}.rows{display:flex;flex-direction:column;gap:2px}.row{display:flex;justify-content:space-between;gap:12px;padding:6px 0;border-bottom:1px dashed var(--border)}.row:last-child{border-bottom:none}.row-label{color:var(--muted)}.row-value{text-align:right}.row-value.strong{font-weight:600}.row-value.mono{font-family:var(--mono);font-size:12px}.actions{display:flex;align-items:center;gap:10px;margin-top:16px}.fresh-hint{margin:14px 0 0;padding-top:12px;border-top:1px dashed var(--border)}.fresh-hint strong{color:var(--accent)}button{font-family:var(--mono);font-size:13px;padding:7px 12px;border-radius:8px;border:1px solid var(--border);background:var(--panel-2);color:var(--text);cursor:pointer}button:disabled{opacity:.4;cursor:not-allowed}button.primary{background:color-mix(in srgb,var(--accent) 22%,var(--panel-2));border-color:color-mix(in srgb,var(--accent) 40%,transparent)}button.ghost{background:transparent}button:not(:disabled):hover{border-color:var(--accent)}.topbar-right{display:flex;align-items:center;gap:12px}.span2{grid-column:span 2}@media(max-width:720px){.span2{grid-column:1 / -1}}.summary{display:flex;gap:6px;flex-wrap:wrap}.checks{list-style:none;margin:0;padding:0;display:flex;flex-direction:column}.check{display:flex;gap:10px;padding:9px 0;border-bottom:1px solid var(--border)}.check:last-child{border-bottom:none}.check.skip{opacity:.55}.check-icon{flex:none;width:20px;height:20px;border-radius:6px;display:grid;place-items:center;font-size:12px;font-weight:700;margin-top:1px}.check-icon.ok{color:var(--ok);background:color-mix(in srgb,var(--ok) 15%,transparent)}.check-icon.warn{color:var(--warn);background:color-mix(in srgb,var(--warn) 15%,transparent)}.check-icon.bad{color:var(--bad);background:color-mix(in srgb,var(--bad) 15%,transparent)}.check-icon.skip{color:var(--muted);background:var(--panel-2)}.check-body{flex:1;min-width:0}.check-line{display:flex;gap:10px;justify-content:space-between;flex-wrap:wrap}.check-label{font-weight:600}.check-detail{color:var(--muted);text-align:right}.check-fix{margin-top:4px;font-size:12px;color:var(--muted)}.check-fix code{color:var(--accent);background:var(--panel-2);padding:1px 6px;border-radius:5px}.surfaces{display:flex;flex-direction:column;gap:10px}.surface{border:1px solid var(--border);border-radius:9px;padding:10px 12px;background:var(--panel-2)}.surface-top{display:flex;align-items:center;gap:8px}.surface-key{font-weight:600}.surface-meta{display:flex;justify-content:space-between;gap:10px;margin-top:4px;font-size:12px}.surface-tools{display:flex;flex-wrap:wrap;gap:4px;margin-top:8px}.tool{font-size:11px;color:var(--muted);border:1px solid var(--border);border-radius:5px;padding:1px 6px}.chip{font-size:11px;padding:1px 8px;border-radius:999px;border:1px solid var(--border)}.chip.design{color:var(--dev);border-color:color-mix(in srgb,var(--dev) 40%,transparent)}.chip.model-sonnet{color:var(--accent)}.chip.model-haiku{color:var(--ok)}.chip.model-inherit{color:var(--warn)}.fleet{max-width:1100px;margin:0 auto;padding:20px}.core-banner{display:flex;align-items:center;justify-content:space-between;gap:16px;flex-wrap:wrap;background:linear-gradient(180deg,var(--panel-2),var(--panel));border:1px solid var(--border);border-radius:12px;padding:14px 18px;margin-bottom:20px}.cb-left{display:flex;align-items:center;gap:12px;flex-wrap:wrap}.cb-title{text-transform:uppercase;letter-spacing:1px;font-size:12px;color:var(--muted)}.cb-version{font-weight:600;font-size:15px}.cb-actions{display:flex;gap:8px}.fleet-head{display:flex;align-items:center;justify-content:space-between;gap:16px;margin-bottom:14px;flex-wrap:wrap}.fleet-head h2{margin:0;font-size:14px;display:flex;align-items:center;gap:8px}.add-wrap{flex:1;max-width:560px}.add-form{display:flex;gap:8px}.path-input{flex:1;font-family:var(--mono);font-size:13px;padding:7px 12px;background:var(--panel);color:var(--text);border:1px solid var(--border);border-radius:8px}.path-input:focus{outline:none;border-color:var(--accent)}.path-input.invalid{border-color:var(--bad)}.add-error{margin-top:6px;font-size:12px;color:var(--bad);word-break:break-word}.fleet-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(300px,1fr));gap:14px}.project-card{background:var(--panel);border:1px solid var(--border);border-radius:12px;padding:14px 16px;cursor:pointer;transition:border-color .12s,transform .12s}.project-card:hover{border-color:var(--accent);transform:translateY(-1px)}.project-card.gone{opacity:.6;cursor:default}.pc-head{display:flex;align-items:center;justify-content:space-between}.pc-name{font-weight:600}.pc-path{margin:2px 0 10px}.pc-badges{display:flex;gap:6px;flex-wrap:wrap;margin-bottom:10px}.pc-health{display:flex;align-items:center;gap:5px}.pc-counts{margin-left:auto}.icon-btn{border:none;background:transparent;color:var(--muted);padding:2px 6px;border-radius:6px;font-size:13px}.icon-btn:hover{color:var(--bad);background:var(--panel-2)}.pill{font-size:11px;min-width:20px;text-align:center;padding:1px 7px;border-radius:999px;font-weight:600}.pill.ok{color:var(--ok);background:color-mix(in srgb,var(--ok) 14%,transparent)}.pill.warn{color:var(--warn);background:color-mix(in srgb,var(--warn) 14%,transparent)}.pill.bad{color:var(--bad);background:color-mix(in srgb,var(--bad) 14%,transparent)}.pill.neutral{color:var(--muted);background:var(--panel-2)}.detail-crumb{grid-column:1 / -1;margin-bottom:-4px;display:flex;align-items:center;justify-content:space-between;gap:12px;flex-wrap:wrap}.detail-tools{display:flex;gap:8px;flex-wrap:wrap}.tool-btn{font-size:12px;padding:5px 10px;border:1px solid color-mix(in srgb,var(--accent) 35%,var(--border));color:var(--accent);background:transparent}.tool-btn:hover{border-color:var(--accent);background:color-mix(in srgb,var(--accent) 10%,transparent)}.confirm-text p{margin:0 0 8px;font-size:13px;line-height:1.6}.confirm-text code{background:var(--panel-2);padding:1px 5px;border-radius:4px;color:var(--accent)}.warn-line{color:var(--warn)!important;background:color-mix(in srgb,var(--warn) 10%,transparent);border-radius:8px;padding:8px 10px}.warn-line code{color:var(--text)!important}.danger-ghost{background:transparent;border:1px solid color-mix(in srgb,var(--bad) 40%,var(--border));color:var(--bad);font-size:12px;padding:5px 10px}.danger-ghost:hover{background:color-mix(in srgb,var(--bad) 12%,transparent);border-color:var(--bad)}button.danger{background:color-mix(in srgb,var(--bad) 20%,var(--panel-2));border-color:color-mix(in srgb,var(--bad) 45%,transparent);color:#ffd7d3}button.danger:hover{border-color:var(--bad)}.reset-list{margin:8px 0;padding-left:18px;font-size:13px;line-height:1.7}.reset-list code{color:var(--accent)}.reset-note{font-size:12.5px;color:var(--muted);background:var(--panel-2);border-radius:8px;padding:10px 12px}.reset-note code{color:var(--text)}.reset-check{display:flex;align-items:center;gap:8px;margin:12px 0 0;font-size:13px}.reset-check code{color:var(--accent)}.board-scroll{max-height:500px;overflow:auto}.board{display:grid;grid-template-columns:repeat(4,1fr);gap:10px}.col{background:var(--bg);border:1px solid var(--border);border-radius:9px;padding:8px;min-width:140px}.col-head{display:flex;justify-content:space-between;font-size:11px;text-transform:uppercase;letter-spacing:.6px;color:var(--muted);padding:2px 4px 8px;position:sticky;top:0;background:var(--bg);z-index:1}.col-shipped{opacity:.85}.col-other{border-color:color-mix(in srgb,var(--warn) 40%,var(--border))}.spec-card{background:var(--panel-2);border:1px solid var(--border);border-radius:7px;padding:8px 9px;margin-bottom:7px}.spec-card.bad{border-color:color-mix(in srgb,var(--warn) 45%,transparent)}.spec-title{font-size:13px;font-weight:600}.spec-meta,.spec-branch{margin-top:3px}@media(max-width:640px){.board{grid-template-columns:repeat(2,1fr)}}.kanban-board{display:flex;gap:10px}.kanban-col{flex:0 0 210px;background:var(--bg);border:1px solid var(--border);border-radius:9px;padding:8px}.kanban-col.empty{opacity:.5}.kanban-card{background:var(--panel-2);border:1px solid var(--border);border-radius:7px;padding:8px 9px;margin-bottom:7px}.kanban-card.done{opacity:.6}.kanban-card.done .kc-text{text-decoration:line-through}.kc-text{font-size:12.5px;line-height:1.4}.kc-tags{display:flex;flex-wrap:wrap;gap:4px;margin-top:6px}.kc-tag{font-size:10px;color:var(--accent);background:color-mix(in srgb,var(--accent) 12%,transparent);border-radius:4px;padding:1px 5px}.kc-pr{font-size:10px;border-radius:4px;padding:1px 5px;text-decoration:none;border:1px solid var(--border);color:var(--muted)}a.kc-pr:hover{filter:brightness(1.25)}.kc-pr.state-open{color:var(--ok);border-color:color-mix(in srgb,var(--ok) 40%,transparent);background:color-mix(in srgb,var(--ok) 12%,transparent)}.kc-pr.state-merged{color:var(--dev);border-color:color-mix(in srgb,var(--dev) 40%,transparent);background:color-mix(in srgb,var(--dev) 12%,transparent)}.kc-pr.state-closed{color:var(--bad);border-color:color-mix(in srgb,var(--bad) 40%,transparent);background:color-mix(in srgb,var(--bad) 12%,transparent)}.kc-pr.draft{color:var(--muted);border-color:var(--border);background:var(--panel-2)}.kc-status{font-size:10px;margin-top:5px;color:var(--muted);text-transform:capitalize}.kc-status.state-open{color:var(--ok)}.kc-status.state-merged{color:var(--dev)}.kc-status.state-closed{color:var(--bad)}.metrics-list{display:flex;flex-direction:column;gap:12px}.metric-feature{background:var(--bg);border:1px solid var(--border);border-radius:9px;padding:10px 12px}.mf-head{display:flex;align-items:center;justify-content:space-between;gap:10px;flex-wrap:wrap;margin-bottom:8px}.mf-name{font-weight:600}.mf-badges{display:flex;gap:6px;flex-wrap:wrap}.phase-bars{display:flex;flex-direction:column;gap:4px}.phase-row{display:grid;grid-template-columns:56px 1fr 90px;align-items:center;gap:10px}.phase-label{color:var(--muted);font-size:12px}.phase-track{height:12px;border-radius:4px;background:var(--panel-2);overflow:hidden}.phase-fill{display:block;height:100%;min-width:2px;border-radius:4px;background:color-mix(in srgb,var(--accent) 65%,var(--panel-2))}.phase-value{text-align:right;white-space:nowrap}.surface-table{width:100%;border-collapse:collapse;margin-top:10px;font-size:12px}.surface-table th{text-align:left;color:var(--muted);font-weight:400;text-transform:uppercase;letter-spacing:.6px;font-size:10px;padding:4px 8px 6px 0;border-bottom:1px dashed var(--border)}.surface-table td{padding:5px 8px 5px 0;border-bottom:1px dashed var(--border)}.surface-table tr:last-child td{border-bottom:none}.st-key{font-weight:600}.modal-backdrop{position:fixed;top:0;right:0;bottom:0;left:0;background:#0009;display:grid;place-items:center;z-index:50;padding:20px}.modal{background:var(--panel);border:1px solid var(--border);border-radius:12px;width:min(720px,100%);max-height:80vh;display:flex;flex-direction:column;padding:18px}.modal-head{display:flex;align-items:center;justify-content:space-between;margin-bottom:12px}.modal-head h3{margin:0;font-size:15px}.modal-actions{display:flex;gap:8px;margin-top:14px}.cmd{background:#000;color:var(--accent);padding:10px 12px;border-radius:8px;font-size:13px;overflow-x:auto}.run-log{background:#000;color:#d6d9e0;padding:12px;border-radius:8px;font-size:12.5px;line-height:1.5;overflow:auto;white-space:pre-wrap;word-break:break-word;flex:1;min-height:200px;max-height:55vh;margin:0}.picker{max-height:74vh}.picker-path{background:var(--panel-2);border:1px solid var(--border);border-radius:7px;padding:7px 10px;margin-bottom:10px;word-break:break-all}.picker-list{flex:1;overflow:auto;border:1px solid var(--border);border-radius:8px;padding:6px;min-height:220px;max-height:48vh}.picker-row{display:flex;align-items:center;gap:8px;width:100%;text-align:left;background:transparent;border:none;border-radius:6px;padding:7px 9px;color:var(--text);font-size:13px}.picker-row:hover{background:var(--panel-2);border-color:transparent}.picker-row.up{color:var(--muted)}.picker-icon{color:var(--muted);width:14px}.picker-row .badge.small{font-size:10px;padding:0 6px;margin-left:auto}.picker-empty{padding:12px}.add-form .ghost[type=button]{white-space:nowrap}