cohorte 1.5.0 → 2.0.0

package/core/commands/{review.md → cohorte-review.md}

@@ -13,7 +13,7 @@ You are the **lead**. Dispatch the review for feature **$ARGUMENTS**.
 >
 > **Workflow variant** (opt-in — SCHEMA.md §Workflows): on Claude Code ≥ 2.1.154 with workflows
 > enabled, the human can ask to "run the review workflow" (`<core>/workflows/review.js`) instead.
-> This conversational path stays the default and the fallback; `/doctor` shows which is available.
+> This conversational path stays the default and the fallback; `/cohorte-doctor` shows which is available.
 
 ## 0. Deterministic pre-flight — no agents while red
 
@@ -27,7 +27,7 @@ with `test -x`); note the epoch (`date +%s`) in the same call — §3's metrics
 ```
 
 - **Non-zero exit** ⇒ the script already printed the raw last-40 lines. **STOP: relay them verbatim
-  and spawn NO agent** — a compiler/test failure needs `/fix` (or the human), not a review that
+  and spawn NO agent** — a compiler/test failure needs `/cohorte-fix` (or the human), not a review that
   rediscovers it at agent prices. This abort is the whole point of the step. Before stopping, write
   the **aborted verdict** (§3's contract, degraded form) so an automated driver gets a diagnosis
   rather than silence:
@@ -58,7 +58,7 @@ with `test -x`); note the epoch (`date +%s`) in the same call — §3's metrics
 ## 2. Dispatch review agents — one per touched surface, IN PARALLEL
 
 Spawn ONE `review` agent per surface that has changed files, in a **single message** (one Task call
-each, like `/build`) so they run concurrently — NEVER serially: review wall-clock must be the
+each, like `/cohorte-build`) so they run concurrently — NEVER serially: review wall-clock must be the
 slowest surface, not the sum. A diff touching a single surface ⇒ a single reviewer.
 
 **Small-diff fast path (re-reviews only):** if a surface's staged diff is tiny (≤2 files and ≤~40
@@ -86,22 +86,39 @@ metrics line needs it.
 
 ## 3. Merge & relay the verdict
 
-Merge the returned reports into **one** REVIEW REPORT (same template): findings concatenated and
+**Roll call FIRST — a dead reviewer is not a clean surface.** Every surface you dispatched in §2 must
+come back with a REVIEW REPORT. A reviewer that died (rate limit, transport error, exhausted context)
+returns **nothing**, and zero findings from a dead reviewer is byte-identical to zero findings from a
+genuinely clean one — which is how "every reviewer crashed" reads as the strongest possible verdict
+from no evidence at all (SCHEMA.md §Dead agents). So:
+
+- **Retry a silent surface ONCE**, byte-identical dispatch. Most deaths are transient, and the staged
+  diff is already on disk — the retry costs one agent, not a re-review.
+- **Silent twice ⇒ that surface is `unreviewed`.** Name it in the report under
+  `## NOT reviewed (no verdict on these)`, list it in the verdict JSON's `unreviewed`, and **refuse to
+  score `SHIP`** — the merged verdict is at least `REVISE`. Absence of evidence is not evidence of
+  absence, and it must never reach `/cohorte-ship` or tick a DoD box.
+- **Never re-review the other surfaces** to compensate: their reports are valid and already on disk.
+
+Then merge the returned reports into **one** REVIEW REPORT (same template): findings concatenated and
 re-ordered by severity, counts summed, duplicates collapsed, verdict = the worst returned
-(`BLOCK` > `REVISE` > `SHIP`). Append ONE metrics line for the batch to `pipeline-metrics.jsonl`
-(main-checkout path + rules in `/build` §4): `{"ts":"<ISO>","feature":"$ARGUMENTS","phase":"review","seconds":<wall-clock>,"surfaces":{"<key>":"<verdict>:<finding count>",…}}`.
-In the same Bash call, chain the opt-in usage ping (`/build` §4, `phase: "review"`, results = the
+(`BLOCK` > `REVISE` > `SHIP`). The `## Deferred` sections merge the same way (dedupe by
+`file` + problem) and stay **out of the severity table and out of the verdict** — see §3.5, which
+routes them. Append ONE metrics line for the batch to the **main checkout's**
+`$(dirname "$(git rev-parse --git-common-dir)")/.claude/pipeline-metrics.jsonl` (rules in
+`/cohorte-build` §4; never a bare relative path — from a worktree that strands the lines): `{"ts":"<ISO>","feature":"$ARGUMENTS","phase":"review","seconds":<wall-clock>,"surfaces":{"<key>":"<verdict>:<finding count>",…}}`.
+In the same Bash call, chain the opt-in usage ping (`/cohorte-build` §4, `phase: "review"`, results = the
 merged verdict + total finding count, e.g. `"REVISE:3"`).
 **Stage the full report to `specs/reports/$ARGUMENTS.md`** (overwrite) — a gitignored buffer so a
-`/fix` after a `/clear` can still read the findings; the `specs/reports/` subfolder is skipped by the
+`/cohorte-fix` after a `/clear` can still read the findings; the `specs/reports/` subfolder is skipped by the
 non-recursive `specs/*.md` glob, so it's never mistaken for a spec (no phantom card, no bogus stage).
 **Write the machine-readable verdict** to `specs/reports/$ARGUMENTS.verdict.json` (overwrite) — on
 **every** run, including the small-diff fast path of §2 and a `SHIP`. This file is the ONLY contract
-between the pipeline and an automated driver (`/loop`), which parses no prose:
+between the pipeline and an automated driver (`/cohorte-loop`), which parses no prose:
 
 ```json
 { "id": "$ARGUMENTS", "phase": "review", "ts": "<ISO>", "verdict": "REVISE",
-  "findings": 7, "blocking": 2, "security": 1,
+  "findings": 7, "blocking": 2, "security": 1, "deferred": 3, "unreviewed": [],
   "severity": {"CRITICAL": 1, "HIGH": 2, "MEDIUM": 3, "LOW": 1},
   "surfaces": {"backend": {"verdict":"BLOCK","findings":4,"blocking":2}},
   "blocking_items": ["backend|apps/api/src/routes/order.ts|missing authz on post"],
@@ -121,32 +138,65 @@ between the pipeline and an automated driver (`/loop`), which parses no prose:
   `printf '%s\n' "<item>" … | LC_ALL=C sort | sha256sum | cut -c1-16` (`shasum -a 256` where there
   is no `sha256sum`). Empty list ⇒ `""`. A driver comparing two consecutive fingerprints detects a
   fix loop that is treading water.
+- **`deferred`** — the count of merged `## Deferred` items §3.5 parked in the backlog. Informational:
+  it never enters `blocking`, so it can never cost a driver an iteration.
+- **`unreviewed`** — the surface keys whose reviewer died twice, `[]` on a complete run. It is
+  **separate from `blocking` on purpose**: `blocking` counts real findings (CRITICAL + security), and
+  faking a number there to force a driver's hand would corrupt the one field the whole contract rests
+  on. A non-empty `unreviewed` means "this run does not cover everything" — a driver treats it as no
+  usable verdict, never as clean, whatever `blocking` says.
+
+## 3.5 Route the deferred findings — the backlog, not the fix loop
+
+Do this on **every** run, before the verdict branch below, and whatever the verdict — a deferred
+finding that is only routed on a `SHIP` is a deferred finding lost on every other verdict, which is
+exactly the leak this step closes. Append each merged `## Deferred` item to
+**`specs/refactor-backlog.md`**, under the `## <domain>` heading of the surface that owns its
+`file:line` (create the file and/or heading if absent — same grouping `/cohorte-audit` writes, so
+`/cohorte-refactor <domain>` picks them up with no extra plumbing):
+
+```
+- [ ] <SEVERITY> · <file:line> · <quality|security|rule> · <concrete fix> · deferred:$ARGUMENTS
+```
+
+- **Never into the spec's `## Remediation`** — that list is what `/cohorte-fix` re-dispatches and what `/cohorte-loop`
+  waits on, so a deferred item there would re-trigger the very loop it was deferred out of.
+- **Dedupe before appending:** `grep -F` the backlog for the item's `<file>` + the first words of its
+  problem; already there (from a prior round or an `/cohorte-audit`) ⇒ skip it, don't stack duplicates round
+  after round.
+- Append with `>>` in ONE Bash call; never read the whole backlog into context to rewrite it (it grows
+  with every audit the repo has ever run).
+- Report it as **one line** in chat: `deferred: <n> parked in specs/refactor-backlog.md (<domains>)`.
 
 In chat print ONLY: the verdict, the severity-count table, a one-line digest of each CRITICAL/security
 finding, and `Full report: specs/reports/$ARGUMENTS.md` — never echo the findings body into chat (it
 would sit in this session's history, re-sent every turn). Then:
 
-- **SHIP** → a SHIP verdict *is* the pipeline's statement that the feature meets its Definition of
+- **SHIP** → only reachable with `unreviewed` empty (the roll call above forbids it otherwise). A SHIP
+  verdict *is* the pipeline's statement that the feature meets its Definition of
   Done, so **tick the DoD**: in `specs/$ARGUMENTS.md` §`Acceptance criteria / DoD`, flip each `- [ ]`
   → `- [x]` for the criteria the pipeline has actually verified — spec conformance + `ui_language`
-  copy (this review), tests · lint · typecheck (a green `/build`), mobile-first as far as the code
+  copy (this review), tests · lint · typecheck (a green `/cohorte-build`), mobile-first as far as the code
   shows it (this review). **Leave `- [ ]` (and say which) any item no stage actually verified** —
   nothing in the pipeline *runs* the feature, so any criterion that needs the app up (runtime flows,
   a visual check against the design) stays open unless the human says they exercised it by hand and
   it held. Ticking is the lead's job
-  (the reviewer is read-only). **Then stamp the freshness gate** so `/ship` can refuse to ship code
+  (the reviewer is read-only). **Then stamp the freshness gate** so `/cohorte-ship` can refuse to ship code
   edited after this verdict: compute `BASE=$(git merge-base <default_branch> HEAD)` and write into the
   spec front-matter `reviewed_base: $BASE` plus
   `reviewed_digest: $(git diff $BASE -- . ':(exclude)specs/' | sha256sum | cut -c1-16)` — the fingerprint
   of exactly the source you just reviewed (specs excluded, so DoD ticks + the ship status flip don't
-  trip it). Then tell the human they can `/ship` — **recommend a `/clear` first**, the handoff is
+  trip it). Then tell the human they can `/cohorte-ship` — **recommend a `/clear` first**, the handoff is
   fully on disk. **SHIP with leftover LOW findings** (or LOW+MEDIUM at the human's call) does NOT
-  force a fix cycle for nits: park them in `specs/refactor-backlog.md` tagged `deferred:<id>` (NOT as
-  open `## Remediation` items, which would re-trigger the fix loop), keep the SHIP verdict and the
-  freshness stamp, and let the human ship.
+  force a fix cycle for nits: park them through §3.5's exact route (the backlog, under their surface's
+  domain heading, tagged `deferred:$ARGUMENTS` — never as open `## Remediation` items, which would
+  re-trigger the fix loop), keep the SHIP verdict and the freshness stamp, and let the human ship.
 - **REVISE / BLOCK**, or any CRITICAL/HIGH/security finding → tell the human to run
-  **`/fix $ARGUMENTS`** — it appends the report to the spec's `## Remediation` and re-dispatches ONLY
-  the surfaces with findings. The full path (`/spec` Mode B then `/build`) remains for findings that
+  **`/cohorte-fix $ARGUMENTS`** — it appends the report to the spec's `## Remediation` and re-dispatches ONLY
+  the surfaces with findings. (If they'd rather automate the rounds, the autonomous driver is
+  `disable-model-invocation: true` on purpose: **you cannot start it, they must type it**. Name the
+  exact line for them to type rather than attempting it — an attempt that silently fails reads as a
+  loop that is running when nothing is.) The full path (`/cohorte-spec` Mode B then `/cohorte-build`) remains for findings that
   change the contract in ways that ripple into clean surfaces. _The report is staged to
-  `specs/reports/$ARGUMENTS.md`, so you can `/clear` before `/fix` — it reads the findings back from
+  `specs/reports/$ARGUMENTS.md`, so you can `/clear` before `/cohorte-fix` — it reads the findings back from
   disk._

package/core/commands/{ship.md → cohorte-ship.md}

@@ -15,15 +15,15 @@ You are the **lead**. Ship feature **$ARGUMENTS**. This is the outward-facing ga
 
 ## 1. Pre-flight (confirm before doing anything irreversible)
 
-- Confirm the latest `/review` returned **SHIP** (no CRITICAL, no security). If not reviewed, or the
+- Confirm the latest `/cohorte-review` returned **SHIP** (no CRITICAL, no security). If not reviewed, or the
   verdict was REVISE/BLOCK, stop and say so.
 - **Freshness gate** — the reviewed code must be exactly what ships. If the spec front-matter carries
   `reviewed_base` + `reviewed_digest`, recompute
   `git diff <reviewed_base> -- . ':(exclude)specs/' | sha256sum | cut -c1-16` and compare to
   `reviewed_digest`. **Match** ⇒ source unchanged since the SHIP verdict, proceed. **Mismatch** ⇒ source
   (or the contract) was edited after review — the verdict is **stale**: stop and tell the human to re-run
-  `/review $ARGUMENTS` before shipping. Missing fields (spec predates the gate) ⇒ skip, don't block.
-- **DoD gate (verify, don't tick — `/review` owns the ticking).** Read `specs/$ARGUMENTS.md`
+  `/cohorte-review $ARGUMENTS` before shipping. Missing fields (spec predates the gate) ⇒ skip, don't block.
+- **DoD gate (verify, don't tick — `/cohorte-review` owns the ticking).** Read `specs/$ARGUMENTS.md`
   §`Acceptance criteria / DoD`; if any item is still `- [ ]`, list the open ones and ask the human to
   confirm shipping anyway (they may be deferred on purpose — e.g. a UI item on a backend-only feature).
   All `- [x]` ⇒ proceed silently.
@@ -61,7 +61,7 @@ or an offset-limited Read around the match): exactly one card, under the `shippe
 re-read the whole board into context. No board ⇒ skip silently.
 
 **Telemetry — the usage ping that closes the funnel.** Chain it onto the verify call above
-(`/build` §4's shared form, `<phase>` = `ship`, `<seconds>` = `0` — the release agent's duration is
+(`/cohorte-build` §4's shared form, `<phase>` = `ship`, `<seconds>` = `0` — the release agent's duration is
 not the pipeline's, `<results>` = `pr` when a PR was created / `compare` when only a compare URL was
 emitted). Fire it **after** the release agent reports success, never on an aborted ship — a `ship`
 event must mean the feature actually left the pipeline. No board ⇒ still ping, in its own `|| true`
@@ -70,7 +70,7 @@ call. Silent no-op without consent; never ask about consent here.
 ## 5. After the PR — CI gate + teardown
 
 - If `host: github` and `gh` is available, watch the PR's checks (`gh pr checks <url> --watch`) and
-  report the result — the human merges only on green. A red check ⇒ back to `/fix $ARGUMENTS`.
+  report the result — the human merges only on green. A red check ⇒ back to `/cohorte-fix $ARGUMENTS`.
 - Once the human confirms the PR is **merged**: if `isolation.enabled`, propose the teardown —
   `scripts/remove-feature.sh $ARGUMENTS` (add `--drop-db` to also drop the feature db; kept by
   default). It removes the worktree, deletes the merged branch, frees the slot. Never run it before

package/core/commands/{spec.md → cohorte-spec.md}

@@ -13,6 +13,10 @@ You run the **spec** step in the main thread — interactive, with the human. Pa
 > Template paths below (`.claude/templates/…`) resolve to `~/.claude/templates/…` when the core is
 > installed globally — read whichever exists.
 >
+> **Decision journal** (SCHEMA.md §Decisions): read `specs/_decisions.md` §Live if it exists — one
+> line per standing decision, so it is cheap. It is the ONLY place the project's transverse rules
+> live; a spec that contradicts one silently un-decides it. Absent ⇒ nothing to honour yet.
+>
 > **Kanban** (SCHEMA.md §Kanban): when the spec opens, move card `#<feature_id>` → **Spec**; on freeze
 > (`status: frozen`, Mode A) → **Ready to build**. No-op silently if no board is configured.
 
@@ -21,7 +25,7 @@ Detect the mode from the pasted content:
 ## Mode A — new spec (input is a brainstorm return, or empty)
 
 1. If empty, look for a staged brainstorm return first — `specs/reports/*-brainstorm.md` (where
-   `/brainstorm` stages its output); one match ⇒ read it and confirm, several ⇒ ask which. None ⇒
+   `/cohorte-brainstorm` stages its output); one match ⇒ read it and confirm, several ⇒ ask which. None ⇒
    ask the human to paste the return (or describe the feature) and wait.
 2. Derive a `feature_id` (kebab-case slug). Confirm it.
 2b. **Size budget — a spec is a contract, not a novel.** Target ≤ ~300 lines; hard-think at 500.
@@ -43,44 +47,60 @@ Detect the mode from the pasted content:
    non-design surfaces never re-read the full brief on every dispatch).
 4b. **New-surface heads-up.** If the feature clearly introduces an area no existing `surfaces[].path`
    owns (a new service/app/top-level module), note it in the spec (a line in the relevant task section:
-   `> needs new surface: <proposed key/path>`). Don't render agents here — `/build` §1.5 auto-reconciles
-   it. This is just so the human isn't surprised when `/build` proposes a new agent.
+   `> needs new surface: <proposed key/path>`). Don't render agents here — `/cohorte-build` §1.5 auto-reconciles
+   it. This is just so the human isn't surprised when `/cohorte-build` proposes a new agent.
 5. When the human validates, **freeze**: write `specs/<id>.md` (`status: frozen`, front-matter filled).
    Create the file — do not ask the human to. **Postcondition:** `grep -q '^status: frozen' specs/<id>.md`
-   — if it fails the freeze didn't land; fix it before pointing the human at `/build`. Chain the
-   opt-in usage ping onto the postcondition's Bash call (`/build` §4's shared form, `<phase>` =
+   — if it fails the freeze didn't land; fix it before pointing the human at `/cohorte-build`. Chain the
+   opt-in usage ping onto the postcondition's Bash call (`/cohorte-build` §4's shared form, `<phase>` =
    `spec`, `<seconds>` = `0` — interactive time, not pipeline wall-clock, `<results>` = `frozen`).
    Ping only on a **landed** freeze, so the funnel counts specs that exist, not attempts. Mode B does
-   not ping — it re-enters an already-counted spec, and `/fix` covers that loop. Silent no-op without
+   not ping — it re-enters an already-counted spec, and `/cohorte-fix` covers that loop. Silent no-op without
    consent; never ask about consent here.
+5b. **Record the transverse decisions — the journal, not a summary.** Walk what the interview settled
+   and keep ONLY the decisions that **outlive this feature**: a rule the next spec would otherwise
+   re-litigate or contradict (auth model, id/naming scheme, where a kind of state lives, an error
+   convention, a deliberate non-goal that binds future features). Typical yield: **0–3 lines**; zero
+   is a normal, healthy outcome for a feature that decided nothing new — never invent lines to fill
+   the section. Append them to `specs/_decisions.md` §Live (create the file from
+   `.claude/templates/decisions.template.md` on first use), each exactly:
+   `- <YYYY-MM-DD> · <area> · <decision> — because <reason> · <feature_id>`
+   - **Never** duplicate what §5, `PIPELINE.md` §Conventions or the code already states — the journal
+     carries the *non-obvious rule*, not the feature's content. A line that restates a spec section is
+     a line every future `/cohorte-spec` pays for and learns nothing from.
+   - **Contradicting an existing line** is allowed but never silent: tell the human which line this
+     feature overrides, get their go-ahead, then append the new line with
+     `· supersedes <YYYY-MM-DD> <area>` and move the old one to `## Superseded`.
+   - Append with one `>>` Bash call, not a full-file rewrite (the file is append-only, and reading it
+     back to re-write it is the one way to make a bounded file expensive).
 6. Author the **design brief** — `specs/design/<id>.md`, rendered via
    `.claude/templates/design-brief.md` (resolves to `~/.claude/templates/…` on a global install).
    _Only if `design.enabled` / the feature has UI; skip entirely for a backend-only feature._
    - **Write it to `specs/design/<id>.md`** (the authored artifact, versioned with the spec; spec §8
      holds the summary + pointer). Create the file — do not ask the human to. Keep it in the
      `specs/design/` subfolder, **not** `specs/<id>....md`: the `specs/*.md` glob that drives the
-     kanban backfill and `/doctor` is non-recursive, so a brief in the subfolder never gets mistaken
+     kanban backfill and `/cohorte-doctor` is non-recursive, so a brief in the subfolder never gets mistaken
      for a spec (no phantom card, no bogus stage). Overwrite it on every freeze.
    - Print ONLY the path + a one-line summary — never echo the brief into chat (it would sit in this
      session's history; echo it only if the human asks). Tell the human: copy it from
      `specs/design/<id>.md` into the design tool (if any — typically a fresh design project for this
-     feature), then run `/build <id>` and hand its design gate the resulting page link(s) — a full
+     feature), then run `/cohorte-build <id>` and hand its design gate the resulting page link(s) — a full
      `https://claude.ai/design/p/<projectId>?file=<file>` link carries its own project + page, no
      profile change needed. (They can also paste the links into the spec's `design_files` themselves.)
-     **Recommend a `/clear` before `/build`** — the frozen spec + `specs/design/<id>.md` are the whole
+     **Recommend a `/clear` before `/cohorte-build`** — the frozen spec + `specs/design/<id>.md` are the whole
      handoff.
 
 ## Mode B — review return (input is a REVIEW REPORT)
 
 1. Read the report — pasted as input, or (whenever nothing is pasted) read from
-   `specs/reports/<id>.md`, where `/review` stages its last report. Identify `feature_id` from its
+   `specs/reports/<id>.md`, where `/cohorte-review` stages its last report. Identify `feature_id` from its
    header; open `specs/<id>.md`.
 2. Append each finding to the spec's **`## Remediation`**, one per line:
    `- [ ] <severity> · <file:line> · <spec-violation|quality|security> · <concrete fix>`
    (Keep prior items; add the new round under a dated/numbered subheading.)
 3. If a finding implies the **contract** must change, update §5 and flag it so the lead re-authors the
    contract file.
-4. Set `status: in-review`. Tell the human to run `/build <id>` to re-dispatch fresh agents.
-   **Recommend a `/clear` before `/build`** — the spec is the whole handoff.
+4. Set `status: in-review`. Tell the human to run `/cohorte-build <id>` to re-dispatch fresh agents.
+   **Recommend a `/clear` before `/cohorte-build`** — the spec is the whole handoff.
 
 In both modes the spec is the single source of truth; agents are stateless and read only it + the diff.

package/core/commands/{update-pipeline.md → cohorte-update-pipeline.md}

@@ -1,6 +1,6 @@
 ---
 model: sonnet
-description: Refresh the pipeline core (global ~/.claude, or a repo's bundled .claude) to the latest published cohorte version, then reconcile this repo's generated files to it — /init-pipeline stays one-time.
+description: Refresh the pipeline core (global ~/.claude, or a repo's bundled .claude) to the latest published cohorte version, then reconcile this repo's generated files to it — /cohorte-init-pipeline stays one-time.
 argument-hint: [path-to-local-checkout]
 ---
 
@@ -8,7 +8,7 @@ You are the **pipeline updater**. Refresh the installed pipeline core to the lat
 repo. The installer's `--update` mode never touches generated files: `PIPELINE.md`, rendered surface agents,
 `gate-config.json`, `settings.json`, and the filled `~/.claude/cohorte.config.yaml` are all preserved.
 YOU then bring those generated files up to the new core yourself (§3.5) — additively, never clobbering
-the human's choices — so `/init-pipeline` never needs re-running for an upgrade.
+the human's choices — so `/cohorte-init-pipeline` never needs re-running for an upgrade.
 
 ## 1. Detect the install scope + current version
 
@@ -57,7 +57,7 @@ differs from the core you just installed, rewrite that one field (leave every ot
 and tell the human to commit it. In **bundled** mode the installer already did it; in **global** mode
 **nothing does** — the installer refreshes one shared core and cannot know which repos point at it,
 so before 1.2.5 the field simply drifted forever (a repo on a current core still claiming `1.0.0`).
-`/doctor` check 1 requires the pointer to be coherent with the VERSION file, so a drifted field reads
+`/cohorte-doctor` check 1 requires the pointer to be coherent with the VERSION file, so a drifted field reads
 as a broken install when nothing is broken.
 
 Then print **What's new**: read the installed `<core>/pipeline/CHANGELOG.md` and show the entries
@@ -82,9 +82,19 @@ health check** (SCHEMA.md §Code retrieval: CLI resolvable from PATH, `.mcp.json
 upgrading a bare `serena` entry to the PATH-proof launcher form, `.serena/` gitignored, server
 actually connected) and repair whatever fails — wiring that worked at
 init can rot (PATH changes, uninstalls, hand-edits). Report what was reconciled; if nothing was
-missing, say so. This is why `/init-pipeline` never needs re-running for a core upgrade.
+missing, say so. This is why `/cohorte-init-pipeline` never needs re-running for a core upgrade.
 
-Two of the §Reconcile steps matter specifically here:
+Four of the §Reconcile steps matter specifically here:
+
+- **Local-artifact hygiene** (§Reconcile step 8): gitignore + untrack the pipeline's runtime files
+  (`.claude/preflight.ok`, `.claude/pipeline-metrics.jsonl`, `specs/reports/`). A tracked
+  `preflight.ok` — what every pre-2.0.0 install ends up with once a release agent stages `.claude/` —
+  makes the phase gate ask on every single review dispatch, so fix it here and say so.
+
+- **Spec-template top-up** (§Reconcile step 7): `specs/_template.md` was seeded at install and never
+  refreshed since, so add the front-matter fields the current `templates/spec.template.md` has and the
+  repo's copy lacks (1.6 added `loop_pass`/`loop_phase` and two states to the `status:` comment) —
+  front-matter only, never the body.
 
 - **Global config seed** (§Reconcile step 5): if `~/.claude/cohorte.config.yaml` is absent, seed it
   from the template so the kanban + shared-vault config has a home. Never clobber an existing filled
@@ -106,7 +116,7 @@ Two of the §Reconcile steps matter specifically here:
 - **Restart / reload the Claude Code session** so it picks up updated commands, agents, and any
   newly-registered MCP server.
 - **Other repos using the global core:** their core is already fresh, but reconcile is per-repo — run
-  `/update-pipeline` inside each (it will skip the already-done core update and just reconcile).
+  `/cohorte-update-pipeline` inside each (it will skip the already-done core update and just reconcile).
 - **Commit** the reconciled files (`PIPELINE.md`, `.claude/`, `.mcp.json` if added) so teammates get them.
 - The kanban config is global and user-scoped
   (`~/.claude/cohorte.config.yaml`) — never committed. The core update never touches it; only the

package/core/hooks/gate.py

@@ -6,7 +6,7 @@ inspecting the FULL command string so chained forms like
 `cd apps/api && node ace migration:run` are caught — something prefix-based
 permission rules in settings.json miss.
 
-Patterns come from `.claude/gate-config.json` (generated by /init-pipeline from
+Patterns come from `.claude/gate-config.json` (generated by /cohorte-init-pipeline from
 the PIPELINE.md `gate` block):
 
     { "deny": ["node ace migration:fresh", ...],
@@ -16,7 +16,7 @@ A pattern matches a command segment when the segment *contains* the pattern
 (after normalizing whitespace). `deny` wins over `ask`. If the config is missing
 or unreadable, the hook stays silent (exit 0) and lets settings.json decide.
 
-The hook fires for EVERY agent in the session — the lead, /build's implementers,
+The hook fires for EVERY agent in the session — the lead, /cohorte-build's implementers,
 and subagents spawned by the Workflow runtime alike. Workflow subagents run in
 acceptEdits regardless of the session's permission mode (their Write/Edit calls
 are auto-approved), but acceptEdits does NOT auto-approve Bash or Task, so this
@@ -31,7 +31,10 @@ Two extra duties beyond Bash patterns:
   listed subagent_type (default review) requires a fresh
   `.claude/preflight.ok` stamp, written by pipeline/scripts/preflight.sh when
   typecheck+lint+tests are green. Stale/missing stamp => "ask" — dispatching
-  reviewers onto code that doesn't compile burns their whole run.
+  reviewers onto code that doesn't compile burns their whole run. Freshness is
+  a content digest (see tree_digest), not the HEAD sha: the reviewed tree is
+  normally dirty, so a commit must not invalidate a stamp and an uncommitted
+  edit must. The stamp is local and gitignored — never versioned.
 
 Protocol: reads the PreToolUse payload on stdin; emits a JSON permissionDecision
 of "deny" or "ask" on a match; otherwise exits 0 silently.
@@ -40,8 +43,10 @@ of "deny" or "ask" on a match; otherwise exits 0 silently.
 import json
 import os
 import re
+import shutil
 import subprocess
 import sys
+import tempfile
 import time
 
 SPLIT = re.compile(r"&&|\|\||[;|\n]")
@@ -129,6 +134,84 @@ def known_heads(cwd: str):
     return heads
 
 
+def worktree_dirs(cwd: str):
+    """`cwd` plus every linked worktree path — the checkouts a stamp may describe."""
+    dirs = [cwd]
+    try:
+        out = subprocess.run(
+            ["git", "worktree", "list", "--porcelain"],
+            cwd=cwd, capture_output=True, text=True, timeout=3,
+        )
+        if out.returncode == 0:
+            for line in out.stdout.splitlines():
+                if line.startswith("worktree "):
+                    p = line.split(" ", 1)[1].strip()
+                    if p and p not in dirs:
+                        dirs.append(p)
+    except Exception:
+        pass
+    return dirs
+
+
+def tree_digest(cwd: str):
+    """The digest pipeline/scripts/preflight.sh stamps for the checkout at `cwd`: the git
+    tree id of the working tree, computed in a throwaway index (`.claude` and `specs`
+    excluded — the pipeline writes those itself). Content-addressed, so a commit of the
+    same code keeps the stamp valid and any real edit invalidates it. Must stay identical
+    to the shell side. Returns None when git can't answer, and the caller falls back."""
+    tmp = None
+    try:
+        idx = subprocess.run(
+            ["git", "rev-parse", "--absolute-git-dir"],
+            cwd=cwd, capture_output=True, text=True, timeout=3,
+        )
+        if idx.returncode != 0:
+            return None
+        real_index = os.path.join(idx.stdout.strip(), "index")
+        fd, tmp = tempfile.mkstemp(prefix="cohorte-idx-")
+        os.close(fd)
+        # Seed from the real index to keep its stat cache — `add` then re-hashes only
+        # what changed instead of the whole tree on every dispatch.
+        if os.path.exists(real_index):
+            shutil.copyfile(real_index, tmp)
+        else:
+            os.unlink(tmp)  # a 0-byte index is a corrupt index — let git create it
+        env = dict(os.environ, GIT_INDEX_FILE=tmp)
+        # Drop the excluded paths outright — an `add` exclude only stops them being
+        # *updated*, so already-tracked ones would still shift the tree id.
+        subprocess.run(
+            ["git", "rm", "--cached", "-r", "-q", "--ignore-unmatch", "--", ".claude", "specs"],
+            cwd=cwd, capture_output=True, timeout=10, env=env,
+        )
+        add = subprocess.run(
+            ["git", "add", "-A", "--", ".", ":(exclude).claude", ":(exclude)specs"],
+            cwd=cwd, capture_output=True, timeout=30, env=env,
+        )
+        if add.returncode != 0:
+            return None
+        out = subprocess.run(
+            ["git", "write-tree"], cwd=cwd, capture_output=True, text=True, timeout=10, env=env,
+        )
+        if out.returncode != 0:
+            return None
+        return out.stdout.strip() or None
+    except Exception:
+        return None
+    finally:
+        for p in ((tmp, tmp + ".lock") if tmp else ()):
+            try:
+                os.unlink(p)
+            except Exception:
+                pass
+
+
+def known_digests(cwd: str):
+    """Every checkout's current digest. The preflight may have run in a feature worktree
+    while the Task dispatch fires from the main checkout (or vice versa) — same reason
+    known_heads() spans worktrees."""
+    return {d for d in (tree_digest(p) for p in worktree_dirs(cwd)) if d}
+
+
 def check_preflight(payload: dict, cfg: dict) -> int:
     """Phase gate on Task dispatches: review agents need a green preflight stamp."""
     pf = cfg.get("preflight") or {}
@@ -149,17 +232,29 @@ def check_preflight(payload: dict, cfg: dict) -> int:
         why = "no preflight stamp found"
     if raw is not None:
         try:
-            epoch_s, _, sha = raw.partition(" ")
+            fields = raw.split()
+            epoch_s = fields[0]
+            sha = fields[1] if len(fields) > 1 else ""
+            digest = fields[2] if len(fields) > 2 else ""
             age_min = (time.time() - float(epoch_s)) / 60
             max_age = float(pf.get("max_age_minutes", 30) or 30)
+            cwd = session_cwd(payload)
             if age_min > max_age:
                 why = f"the preflight stamp is {age_min:.0f} min old (max {max_age:.0f})"
+            elif digest not in ("", "none"):
+                # 2.0.0+ stamp: key off the verified CONTENT, not HEAD. A commit that
+                # doesn't touch code keeps the stamp valid; an edit that never reaches a
+                # commit invalidates it — both of which the sha comparison got backwards.
+                digests = known_digests(cwd)
+                if digests and digest not in digests:
+                    why = "the code changed since the preflight ran"
             else:
-                heads = known_heads(session_cwd(payload))
+                # Pre-2.0.0 stamp (no digest) — fall back to the HEAD comparison.
+                heads = known_heads(cwd)
                 if heads and sha not in ("", "none") and sha not in heads:
                     why = "HEAD moved since the preflight ran"
         except Exception:
-            why = "the preflight stamp is unreadable (expected `<epoch> <sha>`)"
+            why = "the preflight stamp is unreadable (expected `<epoch> <sha> <digest>`)"
     if why is None:
         return 0
     # Same rule as the Bash gate: unattended runs have nobody to answer an "ask".

package/core/templates/brainstorm-return.md

@@ -1,6 +1,6 @@
 # BRAINSTORM RETURN — <feature title>
 
-> Paste this into `/spec`.
+> Paste this into `/cohorte-spec`.
 
 **One-liner:** <what we're building, in one sentence>
 
@@ -24,13 +24,13 @@
 
 - **Data:** <entities / fields touched>
 - **Screens:** <key screens/flows — mobile-first if the project has UI>
-- **Interface (rough):** <endpoints / methods we'll need — refined into the contract in /spec>
+- **Interface (rough):** <endpoints / methods we'll need — refined into the contract in /cohorte-spec>
 
 ## Risks & open questions
 
 - <risk / unknown>
-- <open question for /spec to resolve>
+- <open question for /cohorte-spec to resolve>
 
 ## Panel dissent (what was contested)
 
-<the strongest disagreement the panel surfaced — so /spec doesn't paper over it>
+<the strongest disagreement the panel surfaced — so /cohorte-spec doesn't paper over it>

package/core/templates/decisions.template.md

@@ -0,0 +1,42 @@
+# Decisions
+
+> The project's **transverse decision journal** — the non-obvious rules a stateless agent would
+> otherwise re-discover or contradict, one feature at a time. `PIPELINE.md` says *how this repo is
+> built* (surfaces, commands, conventions); this file says *what was decided and why*.
+>
+> **Append-only. One line per decision. No prose blocks, no code.** The bound is the point: this file
+> is read by `/cohorte-spec`, `/cohorte-brainstorm` and `/cohorte-audit` — the deciding stages — and by **nothing else**.
+> Implementers and reviewers never read it: they work from the frozen contract, which already tells
+> them what to do; handing them the rationale too would cost `surfaces × dispatches` tokens per
+> feature for a fact they cannot act on.
+>
+> Line shape (≤ ~160 chars, `·`-separated, no wrapping):
+>
+> ```
+> - <YYYY-MM-DD> · <area> · <the decision, imperative> — because <the reason> · <feature_id>
+> ```
+>
+> `<area>` is a short tag, not a path: `auth`, `data`, `api`, `ui`, `deploy`, `naming`, `surfaces`…
+>
+> **Reversing a decision** never edits or deletes a line — append a superseding one and move the old
+> one to `## Superseded`:
+>
+> ```
+> - <YYYY-MM-DD> · <area> · <the new decision> — because <reason> · supersedes <YYYY-MM-DD> <area> · <feature_id>
+> ```
+>
+> **Keep it bounded:** when `## Live` passes ~100 lines, move every superseded line into
+> `## Superseded` (the audit trail survives; the section the deciding stages actually read stays
+> short). Never summarize or merge live lines — a decision either holds or has been superseded.
+>
+> **What does NOT belong here:** anything the code, the tests, `PIPELINE.md` §Conventions or a spec
+> already states; a feature-local choice (that lives in its spec); a task, a TODO or a finding (those
+> are `## Remediation` and `specs/refactor-backlog.md`).
+
+## Live
+
+<!-- newest last -->
+
+## Superseded
+
+<!-- moved here when a line above supersedes them; never deleted -->

package/core/templates/design-brief.md

@@ -1,7 +1,7 @@
 # DESIGN BRIEF — <feature title> (`<feature_id>`)
 
 > The "spec return". Paste into the design tool (see `PIPELINE.md` §design). This is §8 of the frozen
-> spec, standalone — `/spec` writes it to `specs/design/<feature_id>.md` on freeze. Omit entirely if
+> spec, standalone — `/cohorte-spec` writes it to `specs/design/<feature_id>.md` on freeze. Omit entirely if
 > the project has no UI.
 
 **Goal:** <one line — what the user accomplishes>

package/core/templates/spec.template.md

@@ -1,11 +1,13 @@
 ---
 feature_id: <slug>
 title: <Feature title>
-status: draft # draft → frozen → in-review → shipped
+status: draft # draft → frozen → in-progress → in-review → shipped · blocked (see SCHEMA.md §Spec status)
 branch: <feature_branch_prefix><slug>
 created: <YYYY-MM-DD>
-reviewed_base: # merge-base sha at the last SHIP verdict — freshness-gate anchor (written by /review)
-reviewed_digest: # sha256 (16 hex) of the reviewed source diff vs reviewed_base, specs excluded — /ship re-checks
+loop_pass: 0 # /cohorte-loop bookkeeping — the review pass it is on; 0 = no loop running. Written by the driver, not by hand
+loop_phase: # /cohorte-loop bookkeeping — build | review | fix | done. With loop_pass, this is what `--resume` reads back
+reviewed_base: # merge-base sha at the last SHIP verdict — freshness-gate anchor (written by /cohorte-review)
+reviewed_digest: # sha256 (16 hex) of the reviewed source diff vs reviewed_base, specs excluded — /cohorte-ship re-checks
 design_files: [] # design page links — full URLs of the form https://claude.ai/design/p/<projectId>?file=<file> (each carries its own project + page); blank until designed; omit if no UI
 ---
 
@@ -45,7 +47,7 @@ design_files: [] # design page links — full URLs of the form https://claude.ai
 
 <repeat per endpoint/interface>
 
-### Contract types — lead authors `<contract.path>/<slug>.<ext>` before /build
+### Contract types — lead authors `<contract.path>/<slug>.<ext>` before /cohorte-build
 
 - `<slug>...Request` / `<slug>...Response` / `<slug>Base` … (sketch the schemas here)
 
@@ -53,7 +55,7 @@ design_files: [] # design page links — full URLs of the form https://claude.ai
 
 > One `###` subsection per surface in `PIPELINE.md` §surfaces (e.g. backend, frontend), each TDD.
 > Surfaces are subsections of §6, never top-level sections — §8 and §9 are referenced by number
-> across the whole pipeline (`/build` implements "§8 flows", `/review` checks "§9 acceptance"), so a
+> across the whole pipeline (`/cohorte-build` implements "§8 flows", `/cohorte-review` checks "§9 acceptance"), so a
 > third surface must not become a §8 of its own.
 
 ### <surface.key>
@@ -83,5 +85,5 @@ design_files: [] # design page links — full URLs of the form https://claude.ai
 
 ## Remediation
 
-> Filled by `/spec` in review-return mode; empty otherwise. Each item:
+> Filled by `/cohorte-spec` in review-return mode; empty otherwise. Each item:
 > `[ ] <SEVERITY> · <file:line> · <spec-violation|quality|security> · <concrete fix>`

package/core/templates/steps/init-pipeline/01-detect-stack.md

@@ -1,4 +1,4 @@
-# /init-pipeline · 01 Detect the stack
+# /cohorte-init-pipeline · 01 Detect the stack
 
 ### Phase 1 — Detect the stack (read-only, no questions yet)