cohorte 1.3.3 → 1.4.0

package/core/workflows/refactor.js

@@ -29,13 +29,72 @@ export const meta = {
 // /refactor handles it with less overhead than a workflow run.
 const MIN_ITEMS = 5
 
+// The Workflow runtime hands `args` to a script verbatim, so a caller that passes a
+// JSON-ENCODED STRING instead of a real object gets that string back here. The old
+// `typeof args === 'string' ? args.trim()` then took the whole blob as the value — which
+// is how a report landed on disk named `specs/reports/{"feature": "x"}.md`, and how
+// maxRounds/smoke were silently dropped on the same run. Parse it back into the object
+// it was meant to be; a bare slug stays valid shorthand.
+const ARGS = (() => {
+  if (typeof args === 'string') {
+    const t = args.trim()
+    if (t.startsWith('{')) {
+      try { const o = JSON.parse(t); if (o && typeof o === 'object' && !Array.isArray(o)) return o } catch {}
+    }
+    return { feature: t, target: t }
+  }
+  return args && typeof args === 'object' ? args : {}
+})()
+
 const wanted = (() => {
-  const d = args && args.domains
+  const d = ARGS.domains
   if (!d || d === 'all') return 'all'
   return Array.isArray(d) ? d : [String(d)]
 })()
 
-const PROFILE = { type: 'object', additionalProperties: true }
+// The profile-reader returns through a StructuredOutput tool call, and a haiku agent
+// intermittently nests the whole profile as a JSON *string* under a single wrapper field
+// ({"output": "{\"surfaces\": …}"}) instead of putting the profile's keys at the top level.
+// The schema here used to be {type:'object', additionalProperties:true} — no declared
+// properties, no required keys — so that wrapper validated cleanly and every field then read
+// as undefined: `surfaces` fell back to [], parallel([]) dispatched zero agents, the
+// dead-agent guard had no surfaces to find missing, and the run reported a verdict having
+// done nothing. On the surface it is indistinguishable from a clean run with an empty diff.
+// Declaring the shape gives the tool layer something to validate and the agent something to
+// aim at; unwrapProfile() salvages a wrapped return that still gets through; and the
+// zero-surface abort below makes the silent-success path impossible either way.
+// See also the structured-output section of core/agents/profile-reader.md.
+const PROFILE = {
+  type: 'object', additionalProperties: true,
+  properties: {
+    error: { type: 'string', description: 'set ONLY when PIPELINE.md is missing or unparseable' },
+    surfaces: {
+      type: 'array',
+      description: "one entry per surface, at the TOP LEVEL of this object — never a JSON string",
+      items: {
+        type: 'object', required: ['key'], additionalProperties: true,
+        properties: { key: { type: 'string' }, path: { type: 'string' }, agent: { type: 'string' } },
+      },
+    },
+  },
+}
+
+// Salvage a profile handed back as JSON text rather than as an object — either the whole
+// return, or nested under a single wrapper field. Anything already shaped like a profile
+// (has `surfaces`, or is the documented `{error}` failure shape) passes through untouched.
+const unwrapProfile = p => {
+  if (typeof p === 'string') { try { return JSON.parse(p) } catch { return null } }
+  if (!p || typeof p !== 'object') return null
+  if (Array.isArray(p.surfaces) || p.error) return p
+  for (const v of Object.values(p)) {
+    if (typeof v !== 'string') continue
+    try {
+      const inner = JSON.parse(v)
+      if (inner && typeof inner === 'object' && !Array.isArray(inner)) return inner
+    } catch {}
+  }
+  return p
+}
 
 const OPEN = {
   type: 'object', required: ['domains'], additionalProperties: false,
@@ -65,14 +124,20 @@ const VERIFY = {
 
 // ── Phase 0 — profile ────────────────────────────────────────────────────────
 phase('Profile')
-const profile = await agent(
+const profile = unwrapProfile(await agent(
   'Return this project\'s PIPELINE.md `yaml pipeline-profile` block as JSON, per your instructions.',
   { agentType: 'profile-reader', label: 'profile', schema: PROFILE, effort: 'low' },
-)
+))
 if (!profile || profile.error) {
   return { error: `profile unreadable: ${(profile && profile.error) || 'profile-reader returned nothing'}` }
 }
 const surfaces = Array.isArray(profile.surfaces) ? profile.surfaces : []
+// A profile with no surfaces cannot do this workflow's work, and every later
+// guard compares against `surfaces` — an empty list makes them all vacuously
+// pass. Fail loudly here instead of finishing with nothing done.
+if (!surfaces.length) {
+  return { error: 'profile has no surfaces — nothing would be refactored. the `yaml pipeline-profile` block in PIPELINE.md is empty or unparseable, or the profile-reader mis-returned; run /doctor' }
+}
 const byKey = Object.fromEntries(surfaces.map(s => [s.key, s]))
 const contractPath = (profile.contract && profile.contract.path) || ''
 const base = (profile.vcs && profile.vcs.default_branch) || 'main'
@@ -87,7 +152,10 @@ const backlog = await agent(
   `Requested domains: ${wanted === 'all' ? 'all' : wanted.join(', ')} — return only those (all ⇒ every domain with open items).`,
   { model: 'haiku', label: 'read-backlog', schema: OPEN, effort: 'low' },
 )
-const open = ((backlog && backlog.domains) || []).filter(d => d.items.length)
+// A dead reader is not "the backlog is empty" — reporting it as such sends the
+// human to re-run /audit on a backlog that is already there.
+if (!backlog) return { error: 'the backlog-reading agent died — nothing was read; re-run the refactor workflow' }
+const open = (backlog.domains || []).filter(d => d.items.length)
 if (!open.length) return { error: 'no open backlog items for the requested domains — run /audit (or the audit workflow) first' }
 
 const big = open.filter(d => d.items.length >= MIN_ITEMS)
@@ -167,12 +235,16 @@ results.push(...restResults.filter(Boolean))
 // ── Phase 5 — tick the cleared items ─────────────────────────────────────────
 phase('Tick')
 const clearedAll = results.flatMap(r => r.cleared)
+let tickedOk = true
 if (clearedAll.length) {
-  await agent(
+  const ticked = await agent(
     'In specs/refactor-backlog.md flip EXACTLY these open `- [ ]` item lines to `- [x]` (match verbatim, ' +
     'leave every other line untouched), then return the single word done:\n' + clearedAll.join('\n'),
     { model: 'haiku', label: 'tick-backlog', effort: 'low' },
   )
+  // Reporting items as cleared while the backlog still shows them open means the
+  // next /refactor re-dispatches work that is already done.
+  tickedOk = ticked != null && /done/i.test(String(ticked))
 }
 
 return {
@@ -181,7 +253,11 @@ return {
   }])),
   skippedSmall: Object.fromEntries(small.map(d => [d.key, d.items.length])),
   stillOpen: results.flatMap(r => r.remaining.map(line => `[${r.key}] ${line}`)).slice(0, 15),
-  next: results.some(r => r.remaining.length || !r.gatesGreen)
-    ? 'items remain — finish them with the conversational /refactor <domain>'
-    : 'all dispatched domains clean — optionally close with one final /audit',
+  backlogTicked: tickedOk,
+  next: !tickedOk
+    ? `${clearedAll.length} item(s) were cleared in code but NOT ticked off specs/refactor-backlog.md ` +
+      '(the ticking agent died) — tick them by hand, or the next /refactor re-dispatches finished work'
+    : results.some(r => r.remaining.length || !r.gatesGreen)
+      ? 'items remain — finish them with the conversational /refactor <domain>'
+      : 'all dispatched domains clean — optionally close with one final /audit',
 }

package/core/workflows/review.js

@@ -26,10 +26,73 @@ export const meta = {
   ],
 }
 
-const feature = typeof args === 'string' ? args.trim() : args && args.feature
+// The Workflow runtime hands `args` to a script verbatim, so a caller that passes a
+// JSON-ENCODED STRING instead of a real object gets that string back here. The old
+// `typeof args === 'string' ? args.trim()` then took the whole blob as the value — which
+// is how a report landed on disk named `specs/reports/{"feature": "x"}.md`, and how
+// maxRounds/smoke were silently dropped on the same run. Parse it back into the object
+// it was meant to be; a bare slug stays valid shorthand.
+const ARGS = (() => {
+  if (typeof args === 'string') {
+    const t = args.trim()
+    if (t.startsWith('{')) {
+      try { const o = JSON.parse(t); if (o && typeof o === 'object' && !Array.isArray(o)) return o } catch {}
+    }
+    return { feature: t, target: t }
+  }
+  return args && typeof args === 'object' ? args : {}
+})()
+const isSlug = s => typeof s === 'string' && /^[A-Za-z0-9._-]+$/.test(s)
+const feature = ARGS.feature
 if (!feature) throw new Error('cohorte-review needs args = {feature: "<feature_id>"}')
+if (!isSlug(feature)) {
+  throw new Error(`cohorte-review got a feature id that is not a slug: ${JSON.stringify(feature)}. ` +
+    'Pass args as a real object, e.g. {feature: "titlebar-project-switcher"} — not a JSON string.')
+}
 
-const PROFILE = { type: 'object', additionalProperties: true }
+// The profile-reader returns through a StructuredOutput tool call, and a haiku agent
+// intermittently nests the whole profile as a JSON *string* under a single wrapper field
+// ({"output": "{\"surfaces\": …}"}) instead of putting the profile's keys at the top level.
+// The schema here used to be {type:'object', additionalProperties:true} — no declared
+// properties, no required keys — so that wrapper validated cleanly and every field then read
+// as undefined: `surfaces` fell back to [], parallel([]) dispatched zero agents, the
+// dead-agent guard had no surfaces to find missing, and the run reported a verdict having
+// done nothing. On the surface it is indistinguishable from a clean run with an empty diff.
+// Declaring the shape gives the tool layer something to validate and the agent something to
+// aim at; unwrapProfile() salvages a wrapped return that still gets through; and the
+// zero-surface abort below makes the silent-success path impossible either way.
+// See also the structured-output section of core/agents/profile-reader.md.
+const PROFILE = {
+  type: 'object', additionalProperties: true,
+  properties: {
+    error: { type: 'string', description: 'set ONLY when PIPELINE.md is missing or unparseable' },
+    surfaces: {
+      type: 'array',
+      description: "one entry per surface, at the TOP LEVEL of this object — never a JSON string",
+      items: {
+        type: 'object', required: ['key'], additionalProperties: true,
+        properties: { key: { type: 'string' }, path: { type: 'string' }, agent: { type: 'string' } },
+      },
+    },
+  },
+}
+
+// Salvage a profile handed back as JSON text rather than as an object — either the whole
+// return, or nested under a single wrapper field. Anything already shaped like a profile
+// (has `surfaces`, or is the documented `{error}` failure shape) passes through untouched.
+const unwrapProfile = p => {
+  if (typeof p === 'string') { try { return JSON.parse(p) } catch { return null } }
+  if (!p || typeof p !== 'object') return null
+  if (Array.isArray(p.surfaces) || p.error) return p
+  for (const v of Object.values(p)) {
+    if (typeof v !== 'string') continue
+    try {
+      const inner = JSON.parse(v)
+      if (inner && typeof inner === 'object' && !Array.isArray(inner)) return inner
+    } catch {}
+  }
+  return p
+}
 
 const PREFLIGHT = {
   type: 'object', required: ['pass'], additionalProperties: false,
@@ -88,16 +151,22 @@ const VERDICT = {
 
 // ── Phase 0 — profile ────────────────────────────────────────────────────────
 phase('Profile')
-const profile = await agent(
+const profile = unwrapProfile(await agent(
   'Return this project\'s PIPELINE.md `yaml pipeline-profile` block as JSON, per your instructions.',
   { agentType: 'profile-reader', label: 'profile', schema: PROFILE, effort: 'low' },
-)
+))
 if (!profile || profile.error) {
   return { verdict: 'ABORTED', reason: `profile unreadable: ${(profile && profile.error) || 'profile-reader returned nothing'}` }
 }
 const cmds = profile.commands || {}
 const base = (profile.vcs && profile.vcs.default_branch) || 'main'
 const surfaces = Array.isArray(profile.surfaces) ? profile.surfaces : []
+// A profile with no surfaces cannot do this workflow's work, and every later
+// guard compares against `surfaces` — an empty list makes them all vacuously
+// pass. Fail loudly here instead of finishing with nothing done.
+if (!surfaces.length) {
+  return { verdict: 'ABORTED', reason: 'profile has no surfaces — nothing would be reviewed. the `yaml pipeline-profile` block in PIPELINE.md is empty or unparseable, or the profile-reader mis-returned; run /doctor' }
+}
 const quiet = (q, full) => (q && !String(q).startsWith('<') ? q : full ? `${full} 2>&1 | tail -40` : '')
 const checks = [cmds.typecheck, quiet(cmds.lint_quiet, cmds.lint), quiet(cmds.test_quiet, cmds.test)]
   .filter(c => c && !String(c).startsWith('<'))
@@ -132,7 +201,17 @@ const staged = await agent(
   '4. Return the touched surfaces with their staged diff path and changed-file list. No changed paths at all ⇒ return an empty surfaces array.',
   { model: 'haiku', label: 'stage-diff', schema: STAGE, effort: 'low' },
 )
-const touched = (staged && staged.surfaces) || []
+// A DEAD staging agent returns null, which is not the same fact as "the diff is
+// empty" — conflating them handed back verdict SHIP ("nothing to review") for a
+// feature nobody had looked at. Distinguish them.
+if (!staged) {
+  return {
+    verdict: 'ABORTED',
+    reason: 'the diff-staging agent died — no reviewer was spawned and nothing was reviewed',
+    next: `re-run the review workflow, or /review ${feature} conversationally`,
+  }
+}
+const touched = staged.surfaces || []
 if (!touched.length) return { verdict: 'SHIP', reason: `no diff against ${base} — nothing to review`, findings: 0 }
 log(`Touched surfaces: ${touched.map(s => s.key).join(', ')}`)
 
@@ -172,14 +251,27 @@ const reviewed = await pipeline(
 )
 
 const results = reviewed.filter(Boolean)
+// A reviewer that DIED returns null — and a dead reviewer produces zero findings,
+// which is byte-identical to a clean surface. Left unchecked, "every reviewer
+// crashed" scores SHIP: the strongest possible verdict from the weakest possible
+// evidence. Name the unreviewed surfaces and refuse to certify them.
+const unreviewed = touched.filter(s => !results.some(r => r.key === s.key)).map(s => s.key)
+if (unreviewed.length) log(`Reviewer died on: ${unreviewed.join(', ')} — those surfaces are NOT reviewed`)
 const kept = results.flatMap(r => r.kept.map(f => ({ ...f, surface: r.key })))
 const refuted = results.flatMap(r => r.refuted.map(f => ({ ...f, surface: r.key })))
 const counts = { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0 }
 for (const f of kept) counts[f.severity] = (counts[f.severity] || 0) + 1
 // Verdict from the findings that SURVIVED the cross-check (a refuted CRITICAL
-// must not force a fix loop): security ⇒ BLOCK, CRITICAL ⇒ REVISE, else SHIP.
+// must not force a fix loop): security ⇒ BLOCK, CRITICAL ⇒ REVISE, else SHIP —
+// but never SHIP while a surface went unreviewed (absence of evidence, not
+// evidence of absence).
 const verdict = kept.some(f => f.kind === 'security') ? 'BLOCK'
-  : kept.some(f => f.severity === 'CRITICAL') ? 'REVISE' : 'SHIP'
+  : kept.some(f => f.severity === 'CRITICAL') ? 'REVISE'
+    : unreviewed.length ? 'REVISE' : 'SHIP'
+// Only a SHIP whose leftovers are all LOW is a clean bill of health. The
+// conversational /review routes any surviving CRITICAL/HIGH/security to /fix, so
+// this path must not answer "/ship" on a SHIP that still carries HIGH findings.
+const clean = verdict === 'SHIP' && kept.every(f => f.severity === 'LOW')
 
 // ── Phase 5 — stage the merged report; only the verdict leaves the workflow ──
 phase('Merge')
@@ -191,25 +283,54 @@ const reportBody = [
   ...['CRITICAL', 'HIGH', 'MEDIUM', 'LOW'].map(s => `| ${s} | ${counts[s] || 0} |`), '',
   `Verdict: ${verdict}`, '', '## Findings', '',
   kept.length ? kept.map(findingLine).join('\n') : 'None.',
+  ...(unreviewed.length ? ['', '## NOT reviewed (reviewer died — no verdict on these)', '',
+    unreviewed.map(k => `- \`${k}\` — re-run /review ${feature} (or the review workflow)`).join('\n')] : []),
   ...(refuted.length ? ['', '## Refuted by cross-check (no action needed)', '',
     refuted.map(f => `- ${f.file}:${f.line} · ${f.problem} — refuted: ${f.reason}`).join('\n')] : []),
 ].join('\n')
-await agent(
+const staging = await agent(
   `Stage a cohorte review report and its metrics, mechanically:\n` +
   `1. Write EXACTLY this content to specs/reports/${feature}.md (overwrite):\n<<<REPORT\n${reportBody}\nREPORT\n` +
   `2. Append one line to $(dirname "$(git rev-parse --git-common-dir)")/.claude/pipeline-metrics.jsonl: ` +
   `{"ts":"<ISO now>","feature":"${feature}","phase":"review","seconds":0,"surfaces":{${results.map(r => `"${r.key}":"${verdict}:${r.kept.length}"`).join(',')}}}\n` +
-  `3. Chain the opt-in usage ping: <core>/pipeline/scripts/telemetry-send.sh review "${feature}" 0 "${verdict}:${kept.length}" || true\n` +
+  `3. Chain the opt-in usage ping: <core>/pipeline/scripts/telemetry-send.sh review "${feature}" 0 "${verdict}:${kept.length}" || true ` +
+  '(<core> = .claude if .claude/pipeline/scripts/telemetry-send.sh exists, else ~/.claude; script on neither ⇒ skip the ping).\n' +
+  // Stamp + tick only when nothing above LOW survived: the conversational /review
+  // keeps the stamp only for LOW findings, and a SHIP verdict here can still carry
+  // HIGH/MEDIUM ones — certifying those for /ship would ship known defects. A dead
+  // reviewer already forced the verdict off SHIP, so `clean` covers that too.
+  (clean
+    ? `4. Stamp the freshness gate in specs/${feature}.md's front-matter, exactly as the conversational /review §3 does ` +
+      `(so /ship can prove the reviewed code is what ships): BASE=$(git merge-base ${base} HEAD); set reviewed_base: $BASE and ` +
+      `reviewed_digest: $(git diff $BASE -- . ':(exclude)specs/' | sha256sum | cut -c1-16). ` +
+      '5. Tick the spec DoD boxes this run verified (spec conformance + copy language — review SHIP; tests/lint/typecheck — green preflight); leave the rest unticked.\n'
+    : '') +
   'Return the single word: done.',
   { model: 'haiku', label: 'stage-report', effort: 'low' },
 )
 
+// The staging agent writes the report, the metrics line, and (when clean) the
+// freshness stamp + DoD ticks. If it died, none of that is on disk — returning
+// `report: <path>` and "/ship" would point the human at a file that does not
+// exist and certify a stamp that was never written.
+const staged_ok = staging != null && /done/i.test(String(staging))
+
 return {
   verdict,
   counts,
   refutedByCrossCheck: refuted.length,
+  reportStaged: staged_ok,
+  unreviewedSurfaces: unreviewed,   // reviewers that died — these carry NO verdict
   criticals: kept.filter(f => f.severity === 'CRITICAL' || f.kind === 'security')
     .map(f => `[${f.surface}] ${f.file}:${f.line} — ${f.problem}`),
-  report: `specs/reports/${feature}.md`,
-  next: verdict === 'SHIP' ? `/ship ${feature} (after DoD ticks)` : `/fix ${feature}`,
+  report: staged_ok ? `specs/reports/${feature}.md` : '(NOT written — the staging agent died)',
+  next: !staged_ok
+    ? `the report/metrics/freshness stamp were NEVER written (staging agent died) — the verdict above is real, but nothing is on disk: re-run the review workflow, or /review ${feature}`
+    : unreviewed.length
+      ? `re-run the review — no reviewer completed on: ${unreviewed.join(', ')}`
+      : clean
+        ? `/ship ${feature} (DoD ticked + freshness stamped)`
+        : verdict === 'SHIP'
+        ? `/fix ${feature} — SHIP verdict, but ${kept.length} finding(s) above LOW survived; park them in specs/refactor-backlog.md instead if you deliberately defer them`
+        : `/fix ${feature}`,
 }

package/dashboard/README.md

@@ -28,23 +28,40 @@ dashboard/
 | `yaml.js` | minimal block-YAML subset parser (for the `pipeline-profile` block + the config) |
 | `fleet.js` | tracked-project registry (`~/.claude/cohorte-dashboard.json`) + folder browse |
 | `kanban.js` | linked Obsidian board → columns/cards; PR enrichment + ship-date sort via `gh` |
+| `metrics.js` | `.claude/pipeline-metrics.jsonl` → per-feature phase/surface aggregate |
 
 ## API
 
 Read: `GET /api/versions`, `/api/state?project=`, `/api/fleet`, `/api/browse?dir=`,
-`/api/kanban?project=`. Mutate: `POST /api/projects` (add) · `DELETE /api/projects` (remove);
+`/api/kanban?project=`, `/api/metrics?project=`. Mutate: `POST /api/projects` (add) ·
+`DELETE /api/projects` (remove);
 `POST /api/action` — `{action:'install'|'update', scope, project}` (spawns the CLI),
 `{action:'reset', project, purgeSpecs}` (backup+wipe+reinstall), or
-`{action:'claude', command:'/init-pipeline'|'/update-pipeline', project}` (headless `claude -p`).
+`{action:'claude', command:'/init-pipeline'|'/update-pipeline'|'/audit', project}` (headless
+`claude -p`).
 Action responses stream chunked plain text ending in `__EXIT__ <code>`; the client reads the
 `ReadableStream` (`app/src/api.js` `streamAction`).
 
 ## Security
 
 Binds `127.0.0.1` by default — the action endpoints **execute code**. `--host=ADDR` opts into
-exposing it (prints a warning). CORS is not enabled: the frontend is same-origin (served by the
-agent). If a hosted-frontend model is ever added, lock CORS to the exact frontend origin (never `*`),
-or any site could drive the local agent.
+exposing it (prints a warning).
+
+Loopback binding is **not** a boundary against a browser: any page the user visits can fire
+requests at `127.0.0.1`, and DNS rebinding can make the responses readable. `guardBrowser()` in
+`index.js` closes both on every `/api/` route, without a token round-trip:
+
+- **Host must be a loopback origin** — kills rebinding (an attacker domain resolving to
+  `127.0.0.1` still sends its own `Host`). Skipped when the user bound a non-loopback host.
+- **State-changing methods must send `content-type: application/json`** — that header triggers a
+  CORS preflight this server never answers, so a browser cannot deliver it cross-origin; forms
+  can only send urlencoded/multipart/text.
+
+CORS response headers are never set, so a cross-origin page can fire a GET but cannot read it. If
+a hosted-frontend model is ever added, lock CORS to the exact frontend origin (never `*`).
+
+`runReset()` additionally refuses a project whose `.claude` resolves to the shared global core —
+the endpoint's whole promise is that `~/.claude` is never touched, and nothing else enforced it.
 
 ## Dev loop
 

package/dashboard/dist/assets/index-AFQnlfjO.css

@@ -0,0 +1 @@
+:root{--bg: #0e0f13;--panel: #16181f;--panel-2: #1c1f28;--border: #262a35;--text: #e6e8ee;--muted: #8b90a0;--accent: #6ea8fe;--ok: #3fb950;--warn: #d9a441;--bad: #f85149;--dev: #a371f7;--mono: ui-monospace, "JetBrains Mono", "SF Mono", Menlo, Consolas, monospace}*{box-sizing:border-box}body{margin:0;background:var(--bg);color:var(--text);font-family:var(--mono);font-size:14px}.app{min-height:100vh}.topbar{display:flex;align-items:center;justify-content:space-between;padding:12px 20px;border-bottom:1px solid var(--border);position:sticky;top:0;z-index:20;background:#0e0f13e6;-webkit-backdrop-filter:blur(6px);backdrop-filter:blur(6px)}.brand{font-weight:600;letter-spacing:.2px;display:flex;align-items:center;gap:8px}.dot{width:9px;height:9px;border-radius:50%;background:var(--accent);box-shadow:0 0 10px var(--accent)}.muted{color:var(--muted)}.small{font-size:12px}.grid{display:grid;grid-template-columns:repeat(2,minmax(0,1fr));align-items:start;gap:16px;padding:20px;max-width:1100px;margin:0 auto}@media(max-width:720px){.grid{grid-template-columns:1fr}}.panel{background:var(--panel);border:1px solid var(--border);border-radius:12px;padding:16px 18px}.panel h2{margin:0 0 12px;font-size:13px;text-transform:uppercase;letter-spacing:1px;color:var(--muted)}.panel.placeholder{opacity:.7}.panel.error{grid-column:1 / -1;border-color:var(--bad);color:var(--bad)}.panel-head{display:flex;align-items:center;justify-content:space-between;margin-bottom:12px}.panel-head h2{margin:0}.badge{font-size:11px;padding:3px 9px;border-radius:999px;border:1px solid var(--border);white-space:nowrap}.badge.ok{color:var(--ok);border-color:color-mix(in srgb,var(--ok) 40%,transparent);background:color-mix(in srgb,var(--ok) 12%,transparent)}.badge.warn{color:var(--warn);border-color:color-mix(in srgb,var(--warn) 40%,transparent);background:color-mix(in srgb,var(--warn) 12%,transparent)}.badge.bad{color:var(--bad);border-color:color-mix(in srgb,var(--bad) 40%,transparent);background:color-mix(in srgb,var(--bad) 12%,transparent)}.badge.dev{color:var(--dev);border-color:color-mix(in srgb,var(--dev) 40%,transparent);background:color-mix(in srgb,var(--dev) 12%,transparent)}.badge.neutral{color:var(--muted)}.rows{display:flex;flex-direction:column;gap:2px}.row{display:flex;justify-content:space-between;gap:12px;padding:6px 0;border-bottom:1px dashed var(--border)}.row:last-child{border-bottom:none}.row-label{color:var(--muted)}.row-value{text-align:right}.row-value.strong{font-weight:600}.row-value.mono{font-family:var(--mono);font-size:12px}.actions{display:flex;align-items:center;gap:10px;margin-top:16px}.fresh-hint{margin:14px 0 0;padding-top:12px;border-top:1px dashed var(--border)}.fresh-hint strong{color:var(--accent)}button{font-family:var(--mono);font-size:13px;padding:7px 12px;border-radius:8px;border:1px solid var(--border);background:var(--panel-2);color:var(--text);cursor:pointer}button:disabled{opacity:.4;cursor:not-allowed}button.primary{background:color-mix(in srgb,var(--accent) 22%,var(--panel-2));border-color:color-mix(in srgb,var(--accent) 40%,transparent)}button.ghost{background:transparent}button:not(:disabled):hover{border-color:var(--accent)}.span2{grid-column:span 2}@media(max-width:720px){.span2{grid-column:1 / -1}}.summary{display:flex;gap:6px;flex-wrap:wrap}.checks{list-style:none;margin:0;padding:0;display:flex;flex-direction:column}.check{display:flex;gap:10px;padding:9px 0;border-bottom:1px solid var(--border)}.check:last-child{border-bottom:none}.check.skip{opacity:.55}.check-icon{flex:none;width:20px;height:20px;border-radius:6px;display:grid;place-items:center;font-size:12px;font-weight:700;margin-top:1px}.check-icon.ok{color:var(--ok);background:color-mix(in srgb,var(--ok) 15%,transparent)}.check-icon.warn{color:var(--warn);background:color-mix(in srgb,var(--warn) 15%,transparent)}.check-icon.bad{color:var(--bad);background:color-mix(in srgb,var(--bad) 15%,transparent)}.check-icon.skip{color:var(--muted);background:var(--panel-2)}.check-body{flex:1;min-width:0}.check-line{display:flex;gap:10px;justify-content:space-between;flex-wrap:wrap}.check-label{font-weight:600}.check-detail{color:var(--muted);text-align:right}.check-fix{margin-top:4px;font-size:12px;color:var(--muted)}.check-fix code{color:var(--accent);background:var(--panel-2);padding:1px 6px;border-radius:5px}.surfaces{display:flex;flex-direction:column;gap:10px}.surface{border:1px solid var(--border);border-radius:9px;padding:10px 12px;background:var(--panel-2)}.surface-top{display:flex;align-items:center;gap:8px}.surface-key{font-weight:600}.surface-meta{display:flex;justify-content:space-between;gap:10px;margin-top:4px;font-size:12px}.surface-tools{display:flex;flex-wrap:wrap;gap:4px;margin-top:8px}.tool{font-size:11px;color:var(--muted);border:1px solid var(--border);border-radius:5px;padding:1px 6px}.chip{font-size:11px;padding:1px 8px;border-radius:999px;border:1px solid var(--border)}.chip.design{color:var(--dev);border-color:color-mix(in srgb,var(--dev) 40%,transparent)}.chip.model-sonnet{color:var(--accent)}.chip.model-haiku{color:var(--ok)}.chip.model-inherit{color:var(--warn)}.fleet{max-width:1100px;margin:0 auto;padding:20px}.core-banner{display:flex;align-items:center;justify-content:space-between;gap:16px;flex-wrap:wrap;background:linear-gradient(180deg,var(--panel-2),var(--panel));border:1px solid var(--border);border-radius:12px;padding:14px 18px;margin-bottom:20px}.cb-left{display:flex;align-items:center;gap:12px;flex-wrap:wrap}.cb-title{text-transform:uppercase;letter-spacing:1px;font-size:12px;color:var(--muted)}.cb-version{font-weight:600;font-size:15px}.cb-actions{display:flex;gap:8px}.fleet-head{display:flex;align-items:center;justify-content:space-between;gap:16px;margin-bottom:14px;flex-wrap:wrap}.fleet-head h2{margin:0;font-size:14px;display:flex;align-items:center;gap:8px}.add-wrap{flex:1;max-width:560px}.add-form{display:flex;gap:8px}.path-input{flex:1;font-family:var(--mono);font-size:13px;padding:7px 12px;background:var(--panel);color:var(--text);border:1px solid var(--border);border-radius:8px}.path-input:focus{outline:none;border-color:var(--accent)}.path-input.invalid{border-color:var(--bad)}.add-error{margin-top:6px;font-size:12px;color:var(--bad);word-break:break-word}.fleet-grid{display:grid;grid-template-columns:repeat(auto-fill,minmax(300px,1fr));gap:14px}.project-card{background:var(--panel);border:1px solid var(--border);border-radius:12px;padding:14px 16px;cursor:pointer;transition:border-color .12s,transform .12s}.project-card:hover{border-color:var(--accent);transform:translateY(-1px)}.project-card.gone{opacity:.6;cursor:default}.pc-head{display:flex;align-items:center;justify-content:space-between}.pc-name{font-weight:600}.pc-path{margin:2px 0 10px}.pc-badges{display:flex;gap:6px;flex-wrap:wrap;margin-bottom:10px}.pc-health{display:flex;align-items:center;gap:5px}.pc-counts{margin-left:auto}.icon-btn{border:none;background:transparent;color:var(--muted);padding:2px 6px;border-radius:6px;font-size:13px}.icon-btn:hover{color:var(--bad);background:var(--panel-2)}.pill{font-size:11px;min-width:20px;text-align:center;padding:1px 7px;border-radius:999px;font-weight:600}.pill.ok{color:var(--ok);background:color-mix(in srgb,var(--ok) 14%,transparent)}.pill.warn{color:var(--warn);background:color-mix(in srgb,var(--warn) 14%,transparent)}.pill.bad{color:var(--bad);background:color-mix(in srgb,var(--bad) 14%,transparent)}.pill.neutral{color:var(--muted);background:var(--panel-2)}.detail-crumb{grid-column:1 / -1;margin-bottom:-4px;display:flex;align-items:center;justify-content:space-between;gap:12px;flex-wrap:wrap}.detail-tools{display:flex;gap:8px;flex-wrap:wrap}.tool-btn{font-size:12px;padding:5px 10px;border:1px solid color-mix(in srgb,var(--accent) 35%,var(--border));color:var(--accent);background:transparent}.tool-btn:hover{border-color:var(--accent);background:color-mix(in srgb,var(--accent) 10%,transparent)}.confirm-text p{margin:0 0 8px;font-size:13px;line-height:1.6}.confirm-text code{background:var(--panel-2);padding:1px 5px;border-radius:4px;color:var(--accent)}.warn-line{color:var(--warn)!important;background:color-mix(in srgb,var(--warn) 10%,transparent);border-radius:8px;padding:8px 10px}.warn-line code{color:var(--text)!important}.danger-ghost{background:transparent;border:1px solid color-mix(in srgb,var(--bad) 40%,var(--border));color:var(--bad);font-size:12px;padding:5px 10px}.danger-ghost:hover{background:color-mix(in srgb,var(--bad) 12%,transparent);border-color:var(--bad)}button.danger{background:color-mix(in srgb,var(--bad) 20%,var(--panel-2));border-color:color-mix(in srgb,var(--bad) 45%,transparent);color:#ffd7d3}button.danger:hover{border-color:var(--bad)}.reset-list{margin:8px 0;padding-left:18px;font-size:13px;line-height:1.7}.reset-list code{color:var(--accent)}.reset-note{font-size:12.5px;color:var(--muted);background:var(--panel-2);border-radius:8px;padding:10px 12px}.reset-note code{color:var(--text)}.reset-check{display:flex;align-items:center;gap:8px;margin:12px 0 0;font-size:13px}.reset-check code{color:var(--accent)}.board-scroll{max-height:500px;overflow:auto}.board{display:grid;grid-template-columns:repeat(4,1fr);gap:10px}.col{background:var(--bg);border:1px solid var(--border);border-radius:9px;padding:8px;min-width:140px}.col-head{display:flex;justify-content:space-between;font-size:11px;text-transform:uppercase;letter-spacing:.6px;color:var(--muted);padding:2px 4px 8px;position:sticky;top:0;background:var(--bg);z-index:1}.col-shipped{opacity:.85}.col-other{border-color:color-mix(in srgb,var(--warn) 40%,var(--border))}.spec-card{background:var(--panel-2);border:1px solid var(--border);border-radius:7px;padding:8px 9px;margin-bottom:7px}.spec-card.bad{border-color:color-mix(in srgb,var(--warn) 45%,transparent)}.spec-title{font-size:13px;font-weight:600}.spec-meta,.spec-branch{margin-top:3px}@media(max-width:640px){.board{grid-template-columns:repeat(2,1fr)}}.kanban-board{display:flex;gap:10px}.kanban-col{flex:0 0 210px;background:var(--bg);border:1px solid var(--border);border-radius:9px;padding:8px}.kanban-col.empty{opacity:.5}.kanban-card{background:var(--panel-2);border:1px solid var(--border);border-radius:7px;padding:8px 9px;margin-bottom:7px}.kanban-card.done{opacity:.6}.kanban-card.done .kc-text{text-decoration:line-through}.kc-text{font-size:12.5px;line-height:1.4}.kc-tags{display:flex;flex-wrap:wrap;gap:4px;margin-top:6px}.kc-tag{font-size:10px;color:var(--accent);background:color-mix(in srgb,var(--accent) 12%,transparent);border-radius:4px;padding:1px 5px}.kc-pr{font-size:10px;border-radius:4px;padding:1px 5px;text-decoration:none;border:1px solid var(--border);color:var(--muted)}a.kc-pr:hover{filter:brightness(1.25)}.kc-pr.state-open{color:var(--ok);border-color:color-mix(in srgb,var(--ok) 40%,transparent);background:color-mix(in srgb,var(--ok) 12%,transparent)}.kc-pr.state-merged{color:var(--dev);border-color:color-mix(in srgb,var(--dev) 40%,transparent);background:color-mix(in srgb,var(--dev) 12%,transparent)}.kc-pr.state-closed{color:var(--bad);border-color:color-mix(in srgb,var(--bad) 40%,transparent);background:color-mix(in srgb,var(--bad) 12%,transparent)}.kc-pr.draft{color:var(--muted);border-color:var(--border);background:var(--panel-2)}.kc-pr.flat{border-style:dashed;cursor:default}.kc-status{font-size:10px;margin-top:5px;color:var(--muted);text-transform:capitalize}.kc-status.state-open{color:var(--ok)}.kc-status.state-merged{color:var(--dev)}.kc-status.state-closed{color:var(--bad)}.metrics-list{display:flex;flex-direction:column;gap:12px}.metric-feature{background:var(--bg);border:1px solid var(--border);border-radius:9px;padding:10px 12px}.mf-head{display:flex;align-items:center;justify-content:space-between;gap:10px;flex-wrap:wrap;margin-bottom:8px}.mf-name{font-weight:600}.mf-badges{display:flex;gap:6px;flex-wrap:wrap}.phase-bars{display:flex;flex-direction:column;gap:4px}.phase-row{display:grid;grid-template-columns:56px 1fr 90px;align-items:center;gap:10px}.phase-label{color:var(--muted);font-size:12px}.phase-track{height:12px;border-radius:4px;background:var(--panel-2);overflow:hidden}.phase-fill{display:block;height:100%;min-width:2px;border-radius:4px;background:color-mix(in srgb,var(--accent) 65%,var(--panel-2))}.phase-value{text-align:right;white-space:nowrap}.surface-table{width:100%;border-collapse:collapse;margin-top:10px;font-size:12px}.surface-table th{text-align:left;color:var(--muted);font-weight:400;text-transform:uppercase;letter-spacing:.6px;font-size:10px;padding:4px 8px 6px 0;border-bottom:1px dashed var(--border)}.surface-table td{padding:5px 8px 5px 0;border-bottom:1px dashed var(--border)}.surface-table tr:last-child td{border-bottom:none}.st-key{font-weight:600}.modal-backdrop{position:fixed;top:0;right:0;bottom:0;left:0;background:#0009;display:grid;place-items:center;z-index:50;padding:20px}.modal{background:var(--panel);border:1px solid var(--border);border-radius:12px;width:min(720px,100%);max-height:80vh;display:flex;flex-direction:column;padding:18px}.modal-head{display:flex;align-items:center;justify-content:space-between;margin-bottom:12px}.modal-head h3{margin:0;font-size:15px}.modal-actions{display:flex;gap:8px;margin-top:14px}.cmd{background:#000;color:var(--accent);padding:10px 12px;border-radius:8px;font-size:13px;overflow-x:auto}.run-log{background:#000;color:#d6d9e0;padding:12px;border-radius:8px;font-size:12.5px;line-height:1.5;overflow:auto;white-space:pre-wrap;word-break:break-word;flex:1;min-height:200px;max-height:55vh;margin:0}.picker{max-height:74vh}.picker-path{background:var(--panel-2);border:1px solid var(--border);border-radius:7px;padding:7px 10px;margin-bottom:10px;word-break:break-all}.picker-list{flex:1;overflow:auto;border:1px solid var(--border);border-radius:8px;padding:6px;min-height:220px;max-height:48vh}.picker-row{display:flex;align-items:center;gap:8px;width:100%;text-align:left;background:transparent;border:none;border-radius:6px;padding:7px 9px;color:var(--text);font-size:13px}.picker-row:hover{background:var(--panel-2);border-color:transparent}.picker-row.up{color:var(--muted)}.picker-icon{color:var(--muted);width:14px;flex:none}.picker-name{overflow:hidden;text-overflow:ellipsis;white-space:nowrap}.picker-row .badge.small{font-size:10px;padding:0 6px;margin-left:auto}.picker-empty{padding:12px}.add-form .ghost[type=button]{white-space:nowrap}