cohorte 1.5.0 → 2.0.0

package/scripts/validate-core.mjs

@@ -22,12 +22,28 @@ const frontmatter = (text) => {
 // Mechanical commands must pin model: sonnet (otherwise the lead's
 // orchestration turn silently bills at the session model — Opus/Fable).
 // Interactive commands must stay unpinned (they inherit on purpose).
-const PINNED = ["build", "review", "fix", "ship", "audit",
-  "refactor", "doctor", "align-ds", "update-pipeline"];
-const UNPINNED = ["brainstorm", "spec", "init-pipeline"];
+const PINNED = ["cohorte-build", "cohorte-review", "cohorte-fix", "cohorte-ship",
+  "cohorte-audit", "cohorte-refactor", "cohorte-doctor", "cohorte-align-ds",
+  "cohorte-update-pipeline", "cohorte-loop"];
+const UNPINNED = ["cohorte-brainstorm", "cohorte-spec", "cohorte-init-pipeline"];
+
+// Every command must carry the `cohorte-` prefix. This replaces the old RESERVED
+// blocklist, which chased collisions one name at a time and always lagged: a command
+// that collides with a Claude Code built-in is not overridden, it is SHADOWED — the
+// built-in answers the slash, our file is never read, and the session confidently
+// reports on a run that never happened. `/loop` did exactly that (Claude Code's own
+// `/loop` runs a prompt on an interval) and went unnoticed until a user found the
+// driver had never started; `/doctor` sat on a watchlist waiting to do the same.
+// A blocklist can only forbid the collisions we already know about. The prefix makes
+// the whole class unreachable, so this check is structural, not a list to maintain.
+const PREFIX = "cohorte-";
 
 for (const f of readdirSync(join(root, "core/commands"))) {
   const path = `core/commands/${f}`;
+  if (!f.startsWith(PREFIX))
+    fail(path, `command name lacks the \`${PREFIX}\` prefix — an unprefixed command can be ` +
+      `SHADOWED by a Claude Code built-in of the same name (the built-in answers the slash ` +
+      `and this file is never read); rename it to ${PREFIX}${f}`);
   const fm = frontmatter(read(path));
   if (!fm) { fail(path, "missing or malformed YAML frontmatter"); continue; }
   if (!/^description:\s*\S/m.test(fm)) fail(path, "frontmatter lacks a description");
@@ -115,16 +131,20 @@ if (!existsSync(steps) || readdirSync(steps).length === 0)
 
 // ── telemetry coverage ──────────────────────────────────────────────────────
 // The funnel is only readable if every one of its stages pings — a single missing
-// one silently truncates it (that is how /review and /fix went unreported
+// one silently truncates it (that is how /cohorte-review and /cohorte-fix went unreported
 // until 1.2.3). The phase list here must match SCHEMA.md §Telemetry's table.
+// These are telemetry PHASE names, not command names — they stay unprefixed even though
+// the commands that emit them are now `/cohorte-*`. The phase is a wire field allowlisted
+// in telemetry-send.sh and keyed on by the collector's existing dataset; prefixing it would
+// orphan every ping ever sent. Command file = PREFIX + phase.
 const FUNNEL = ["brainstorm", "spec", "build", "review", "fix", "ship"];
 for (const c of FUNNEL)
-  if (!/usage ping/i.test(read(`core/commands/${c}.md`)))
-    fail(`core/commands/${c}.md`, "funnel command with no usage ping — breaks the telemetry funnel");
+  if (!/usage ping/i.test(read(`core/commands/${PREFIX}${c}.md`)))
+    fail(`core/commands/${PREFIX}${c}.md`, "funnel command with no usage ping — breaks the telemetry funnel");
 // …and nothing outside the funnel may ping (consent text scopes it to the funnel).
 for (const f of readdirSync(join(root, "core/commands"))) {
-  const c = f.replace(/\.md$/, "");
-  // `telemetry-send.sh` + an argument = a call site; the bare filename (e.g. /doctor
+  const c = f.replace(/\.md$/, "").replace(new RegExp(`^${PREFIX}`), "");
+  // `telemetry-send.sh` + an argument = a call site; the bare filename (e.g. /cohorte-doctor
   // listing the scripts it checks for) is a mention, not a ping.
   if (!FUNNEL.includes(c) && /telemetry-send\.sh +\S|usage ping/i.test(read(`core/commands/${f}`)))
     fail(`core/commands/${f}`, "non-funnel command pings telemetry — outside the consented scope");
@@ -139,7 +159,7 @@ for (const f of readdirSync(join(root, "core/commands"))) {
 // scratch HOME and asserts the same postconditions instead. Both are needed: this
 // check catches a forgotten name, that one catches a drifted rule.
 // A `<name>.sh` with a `<name>.sh.template` sibling is a locally-rendered artifact
-// (this repo dogfoods its own /init-pipeline), not a core asset — skip those.
+// (this repo dogfoods its own /cohorte-init-pipeline), not a core asset — skip those.
 const installers = { "install.sh": read("install.sh"), "install.ps1": read("install.ps1") };
 const shipped = readdirSync(join(root, "scripts"));
 for (const f of shipped.filter((f) => f.endsWith(".sh") && !shipped.includes(`${f}.template`)))
@@ -203,6 +223,23 @@ for (const f of workflowNames) {
     fail("dashboard/server/doctor.js", `checkWorkflows() does not list ${f}`);
 }
 
+// ── every test suite must run in BOTH workflows ──────────────────────────────
+// publish.yml re-runs the test suites under the comment "same gate as CI", because
+// it has no dependency on the CI workflow's conclusion — a merge whose CI failed
+// would otherwise still ship to npm. That only holds if the two lists agree, and
+// they drift the moment a suite is added to one: test-loop.mjs landed in ci.yml and
+// publish.yml kept publishing without it. Neither list is the source of truth —
+// the directory is.
+const ciYml = existsSync(join(root, ".github/workflows/ci.yml")) ? read(".github/workflows/ci.yml") : "";
+const publishYml = existsSync(join(root, ".github/workflows/publish.yml"))
+  ? read(".github/workflows/publish.yml") : "";
+for (const f of readdirSync(join(root, "scripts")).filter((f) => /^test-.*\.mjs$/.test(f))) {
+  if (ciYml && !ciYml.includes(`scripts/${f}`))
+    fail(".github/workflows/ci.yml", `never runs scripts/${f} — a suite CI does not run is a suite that does not exist`);
+  if (publishYml && !publishYml.includes(`scripts/${f}`))
+    fail(".github/workflows/publish.yml", `never runs scripts/${f} — publish would ship past a failure that gate is meant to catch`);
+}
+
 // ── dashboard: the metrics phase list is duplicated server/client ────────────
 // A phase present in one and not the other parses fine and renders in no column —
 // silently invisible data, which is how a phase batch once went unnoticed.

package/core/commands/loop.md

@@ -1,61 +0,0 @@
----
-model: sonnet
-description: Autonomous /build → /review → /fix → /review loop for one feature, until no blocking finding remains.
-argument-hint: <feature_id> [--max=N] [--no-build] [--rebuild]
-allowed-tools: Bash(bash ~/.claude/pipeline/scripts/loop.sh:*), Bash(bash .claude/pipeline/scripts/loop.sh:*), Bash(test:*), Read(specs/reports/**)
-disable-model-invocation: true
----
-
-You are the **launcher**, not the loop. Run the driver for **$ARGUMENTS** and relay three lines.
-
-> This command exists because a slash command cannot `/clear` itself. Every phase of the loop runs
-> as a **separate `claude -p` child session** with its own fresh context, driven by a bash script —
-> so the diff, the N review reports and the N contracts never accumulate in YOUR history, which is
-> re-sent at input price on every turn. Running the loop conversationally here would cost more than
-> the loop saves.
-
-## 1. Launch
-
-Probe the core, then run the script — ONE Bash call, and let it run to completion:
-
-```
-test -f .claude/pipeline/scripts/loop.sh \
-  && bash .claude/pipeline/scripts/loop.sh $ARGUMENTS \
-  || bash ~/.claude/pipeline/scripts/loop.sh $ARGUMENTS
-```
-
-Pass `$ARGUMENTS` through untouched — the script owns its own flag parsing (`--max=N`,
-`--no-build`, `--rebuild`) and exits 64 on anything it doesn't know. Don't validate flags yourself,
-don't rewrite them, don't add any.
-
-**Never read `specs/reports/<id>.loop.log`.** It holds the full transcript of every child session —
-the entire diff, every review report, every fix handoff. Pulling it into this session re-imports
-exactly the context the loop was built to keep out, and it is the one mistake that turns this
-command into the most expensive one in the pipeline. Point the human at the path instead; they can
-open it in an editor for free. The same goes for the per-surface `.diff` and `.preflight.txt` files.
-
-## 2. Report — three lines, from the exit code
-
-The script prints one line per phase and one closing line; that is your raw material. For exit
-**1** or **3** only, also Read `specs/reports/<id>.verdict.json` (small, structured, safe) to name
-the remaining findings — never the markdown report, which is the findings body in full.
-
-| exit | meaning | what to say |
-| ---- | ------- | ----------- |
-| `0` | clean | no blocking findings left; the human can `/ship <id>` |
-| `1` | ceiling hit | the fix was progressing but ran out of passes ⇒ re-run with a higher `--max` |
-| `2` | no usable verdict | `/review` produced nothing, or aborted on a red preflight — the closing line says which; point at `specs/reports/<id>.preflight.txt` |
-| `3` | non-convergent | the same blocking findings survived a fix pass; a higher `--max` will NOT help — the human needs to look at them (list them from the verdict) |
-| `64` | usage | relay the script's own message verbatim |
-
-Then print exactly three lines and nothing else:
-
-```
-outcome:    <one clause — clean / ceiling / no verdict / non-convergent / usage>
-iterations: <n> review pass(es)<, m fix pass(es) committed>
-remaining:  <blocking count + one short phrase per blocking item, or "none">
-```
-
-Add at most one follow-up sentence: the next command to run. Never restate a finding's fix, never
-summarize the log, never open the diff. Each fix pass is already committed
-(`loop(<id>): fix pass <i>`) — say so on a non-zero exit, since those commits are the way back.