cohorte 1.5.0 → 2.0.0

package/scripts/remove-feature.sh.template

@@ -1,8 +1,8 @@
 #!/usr/bin/env bash
 #
 # remove-feature.sh — tear down a feature's isolated worktree. Rendered from a
-# template by /init-pipeline (double-underscore tokens from PIPELINE.md §isolation —
-# spelled out here so /doctor's unrendered-token check never trips on this comment).
+# template by /cohorte-init-pipeline (double-underscore tokens from PIPELINE.md §isolation —
+# spelled out here so /cohorte-doctor's unrendered-token check never trips on this comment).
 #
 # Usage:  scripts/remove-feature.sh <feature_id> [--drop-db]
 #

package/scripts/test-dashboard.mjs

@@ -2,8 +2,8 @@
 // Tests for the dashboard's server modules (dashboard/server/*.js).
 //
 // These are shipped runtime code with real logic and zero coverage until now:
-// a hand-rolled YAML parser that every /doctor check is derived from, a metrics
-// aggregator, the JS port of /doctor, an Obsidian board parser, the fleet
+// a hand-rolled YAML parser that every /cohorte-doctor check is derived from, a metrics
+// aggregator, the JS port of /cohorte-doctor, an Obsidian board parser, the fleet
 // registry, and an HTTP layer whose guards are the dashboard's only defence
 // against a web page driving the local agent.
 //
@@ -127,7 +127,7 @@ console.log("usage.js — the collector bridge");
 }
 
 // ── doctor.js ────────────────────────────────────────────────────────────────
-console.log("doctor.js — the /doctor port");
+console.log("doctor.js — the /cohorte-doctor port");
 {
   const spec = (fm) => `---\n${fm}\n---\n\n# x\n`;
   const d = scratch();
@@ -136,13 +136,13 @@ console.log("doctor.js — the /doctor port");
   writeFileSync(join(d, "specs", "b.md"), spec("feature_id: b\nstatus: shipped   # done"));
   writeFileSync(join(d, "specs", "c.md"), "no front-matter at all");
   writeFileSync(join(d, "specs", "_template.md"), spec("status: draft"));
-  // /audit writes this file by design and it has no front-matter. Scanning it as a
-  // spec made /doctor warn about a file cohorte itself had just created — it fired in
-  // every project that had ever run /audit.
+  // /cohorte-audit writes this file by design and it has no front-matter. Scanning it as a
+  // spec made /cohorte-doctor warn about a file cohorte itself had just created — it fired in
+  // every project that had ever run /cohorte-audit.
   writeFileSync(join(d, "specs", "refactor-backlog.md"), "# Refactor Backlog\n\n## backend\n- [ ] x\n");
   const specs = scanSpecs(d);
   eq("_template.md is excluded", specs.length, 3);
-  eq("the /audit backlog is not scanned as a spec",
+  eq("the /cohorte-audit backlog is not scanned as a spec",
     specs.some(s => s.file === "refactor-backlog.md"), false);
   eq("front-matter fields are read", specs.find(s => s.id === "a").title, "A");
   eq("a trailing comment is stripped from status", specs.find(s => s.id === "b").status, "shipped");
@@ -201,6 +201,21 @@ console.log("doctor.js — the /doctor port");
   eq("retrieval wired in .mcp.json ⇒ ok", by(s.checks, "retrieval").status, "ok");
   eq("workflows + profile-reader ⇒ ok", by(s.checks, "workflows").status, "ok");
 
+  // Local artifacts: a versioned preflight stamp is what made the phase gate ask on
+  // every review dispatch forever, so its absence from .gitignore is a hard failure.
+  check("no .gitignore ⇒ local artifacts flagged bad (the stamp is the breaking one)",
+    by(s.checks, "artifacts").status === "bad"
+      && /preflight\.ok/.test(by(s.checks, "artifacts").detail),
+    by(s.checks, "artifacts").detail);
+  writeFileSync(join(d, ".gitignore"),
+    "node_modules/\n.claude/preflight.ok\n.claude/pipeline-metrics.jsonl\nspecs/reports/\n");
+  s = await state({ projectRoot: d, globalDir: g, cliVersion: "9.9.9" });
+  eq("all local artifacts gitignored ⇒ ok", by(s.checks, "artifacts").status, "ok");
+  writeFileSync(join(d, ".gitignore"), "node_modules/\n.claude/\nspecs/reports/\n");
+  s = await state({ projectRoot: d, globalDir: g, cliVersion: "9.9.9" });
+  eq("a `.claude/` directory rule covers the files inside it",
+    by(s.checks, "artifacts").status, "ok");
+
   // …and each check must actually FAIL when its precondition breaks.
   writeFileSync(join(d, ".claude", "gate-config.json"),
     JSON.stringify({ ...gate, preflight: { enabled: false } }));
@@ -368,6 +383,18 @@ console.log("index.js — HTTP guards");
   const badCmd = await post({ action: "claude", command: "/evil", project: proj });
   eq("a non-whitelisted slash command is rejected", badCmd.status, 400);
 
+  // Both directions, because testing only the rejection missed a real bug: 2.0.0 prefixed
+  // every command, the error message was updated to say `/cohorte-audit`, but the allowlist
+  // regex still matched the bare names — so the server accepted the one command that no
+  // longer exists and rejected the only one the UI can send. A rejection-only test is blind
+  // to an allowlist that drifts away from the client.
+  const staleCmd = await post({ action: "claude", command: "/audit", project: proj });
+  eq("the pre-2.0.0 unprefixed command is rejected", staleCmd.status, 400);
+
+  const goodCmd = await post({ action: "claude", command: "/cohorte-audit", project: proj });
+  check("a prefixed whitelisted command passes the allowlist",
+    goodCmd.status !== 400 || !/unsupported command/.test((await goodCmd.json()).error || ""));
+
   eq("a missing hashed asset 404s (never index.html)",
     (await fetch(`${base}/assets/index-DEADBEEF.js`)).status, 404);
   eq("a malformed percent-escape is a 400, not a 500",

package/scripts/test-gate.mjs

@@ -231,6 +231,64 @@ console.log("gate.py — preflight phase gate");
     run(task("review"), { projectDir: noblock }).decision === null);
 }
 
+// ── the content digest (2.0.0): freshness keyed on code, not on HEAD ─────────
+// Before this, the stamp recorded the HEAD sha — backwards on both sides. The
+// reviewed tree is normally DIRTY, so committing already-verified code made the
+// gate ask on a clean tree (and a committed stamp made it ask forever), while an
+// implementer's edit between preflight and dispatch invalidated nothing.
+console.log("gate.py — preflight content digest");
+{
+  const pf = { enabled: true, agents: ["review"], max_age_minutes: 30 };
+  const d = scratch(); writeConfig(d, { ...GATE_CFG, preflight: pf });
+  gitRepo(d, "main");
+  mkdirSync(join(d, "specs", "reports"), { recursive: true });
+  writeFileSync(join(d, "specs", "s.md"), "spec\n");
+  writeFileSync(join(d, "src.txt"), "code v1\n");     // uncommitted feature work
+  const git = (...a) => execFileSync("git", a, { cwd: d, stdio: "ignore" });
+  const at = { projectDir: d };
+  const runPreflight = () =>
+    spawnSync("sh", [join(root, "scripts", "preflight.sh"), join(d, "specs", "reports", "r.txt"), "true"],
+      { cwd: d, encoding: "utf8" });
+
+  const pre = runPreflight();
+  const raw = execFileSync("cat", [join(d, ".claude", "preflight.ok")], { encoding: "utf8" }).trim();
+  check("preflight.sh stamps three fields (epoch, sha, digest)",
+    raw.split(/\s+/).length === 3, `${pre.status}: ${raw}`);
+  check("fresh stamp on a dirty tree ⇒ passes", run(task("review"), at).decision === null);
+
+  // The regression that started this: commit the very code the preflight verified.
+  git("add", "-A"); git("commit", "-qm", "wip");
+  const afterCommit = run(task("review"), at);
+  check("committing the verified code ⇒ still passes (HEAD moved, code did not)",
+    afterCommit.decision === null, `got ${afterCommit.decision} — ${afterCommit.reason}`);
+
+  // The pipeline's own writes must never invalidate its own stamp.
+  writeFileSync(join(d, "specs", "s.md"), "spec + DoD ticks\n");
+  writeFileSync(join(d, "specs", "reports", "r2.txt"), "report\n");
+  writeFileSync(join(d, ".claude", "pipeline-metrics.jsonl"), "{}\n");
+  check("spec ticks, report buffer and metrics writes ⇒ still passes",
+    run(task("review"), at).decision === null);
+
+  // …and a real edit must.
+  writeFileSync(join(d, "src.txt"), "code v2\n");
+  const edited = run(task("review"), at);
+  check("an uncommitted code edit ⇒ ask", edited.decision === "ask", edited.decision);
+  check("…and the reason says the code changed", /code changed/.test(edited.reason || ""));
+
+  // A brand-new untracked source file is a code change too (the sha never saw these).
+  writeFileSync(join(d, "src.txt"), "code v1\n");
+  writeFileSync(join(d, "extra.txt"), "new surface\n");
+  check("a new untracked source file ⇒ ask", run(task("review"), at).decision === "ask");
+  rmSync(join(d, "extra.txt"));
+  check("reverting to the verified content ⇒ passes again",
+    run(task("review"), at).decision === null);
+
+  // The hook must never touch the caller's index — it computes in a throwaway one.
+  const status = execFileSync("git", ["status", "--porcelain"], { cwd: d, encoding: "utf8" });
+  check("the gate leaves the real index untouched (nothing staged)",
+    !/^[MARCD]/m.test(status), status.trim());
+}
+
 // ── worktree awareness (the 1.3.3 known_heads fix) ───────────────────────────
 console.log("gate.py — worktree awareness");
 {

package/scripts/test-loop.mjs

@@ -0,0 +1,269 @@
+#!/usr/bin/env node
+// Behavioural tests for scripts/loop.sh — the autonomous /cohorte-review ⇄ /cohorte-fix driver.
+//
+// The driver is pure shell around two JSON files it does not write, so it is
+// testable end-to-end by putting a FAKE `claude` on PATH that produces those files
+// per phase. What is pinned here cannot be seen by any structural check:
+//
+//   · exit 4 — /cohorte-build's readiness gate said NOT-READY, so no pass count helps
+//   · exit 0/3 leave the right TERMINAL status in the spec's front-matter, which is
+//     what makes an interrupted loop resumable (SCHEMA.md §Spec status)
+//   · the front-matter stamps are written with awk on every platform — a `sed -i`
+//     would pass on GNU and corrupt every spec on BSD/macOS
+//   · --resume continues at the recorded pass instead of re-paying passes 1..n-1
+//   · a spec with no front-matter still runs (the stamps are a silent no-op)
+//
+//   node scripts/test-loop.mjs
+
+import { mkdtempSync, writeFileSync, readFileSync, mkdirSync, chmodSync, existsSync } from "node:fs";
+import { execFileSync, spawnSync } from "node:child_process";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { fileURLToPath } from "node:url";
+
+const root = fileURLToPath(new URL("..", import.meta.url));
+const LOOP = join(root, "scripts/loop.sh");
+
+let failures = 0;
+const check = (name, cond, detail = "") => {
+  if (cond) console.log(`  ✓ ${name}`);
+  else { failures++; console.error(`  ✗ ${name}${detail ? ` — ${detail}` : ""}`); }
+};
+
+const FM = `---
+feature_id: feat-x
+title: Feat X
+status: frozen # draft → frozen → in-progress → in-review → shipped · blocked
+branch: feature/feat-x
+---
+
+# Feat X
+`;
+
+// A fake `claude`: reads the phase out of the `-p "/<cmd> <id>"` argument and
+// writes whatever the scenario says that phase produces. `$PHASES` is a
+// newline-separated script of `<cmd>:<what to write>` steps, consumed in order,
+// so a scenario can make pass 1 and pass 2 differ.
+const FAKE_CLAUDE = `#!/usr/bin/env bash
+set -u
+prompt=""
+while [ $# -gt 0 ]; do
+  case "$1" in -p) prompt="$2"; shift 2 ;; *) shift ;; esac
+done
+cmd="\${prompt%% *}"
+# The driver must dispatch the PREFIXED command (2.0.0) — an unprefixed /build would be
+# shadowed by Claude Code's own built-in and never reach the pipeline, so fail loudly
+# rather than let a regression pass by being lenient here.
+case "$cmd" in
+  /cohorte-*) ;;
+  *) echo "fake claude: expected a /cohorte-* command, got '$cmd'" >&2; exit 9 ;;
+esac
+cmd="\${cmd#/cohorte-}"          # scenarios are keyed on the PHASE, which stays unprefixed
+n=0; [ -f "$SCEN_DIR/count" ] && n=$(cat "$SCEN_DIR/count")
+n=$((n + 1)); echo "$n" >"$SCEN_DIR/count"
+step=$(sed -n "\${n}p" "$SCEN_DIR/phases")
+echo "fake claude: phase=$cmd step=$step"
+want="\${step%%:*}"; do_what="\${step#*:}"
+[ "$want" = "$cmd" ] || { echo "fake claude: expected /$want, got /$cmd" >&2; exit 9; }
+mkdir -p specs/reports
+case "$do_what" in
+  notready)
+    printf '{"id":"feat-x","phase":"readiness","ts":"t","verdict":"NOT-READY","gaps":["contract|POST /o|no success shape"],"surfaces":["backend"]}' \\
+      >specs/reports/feat-x.readiness.json ;;
+  ready)
+    printf '{"id":"feat-x","phase":"readiness","ts":"t","verdict":"READY","gaps":[],"surfaces":["backend"]}' \\
+      >specs/reports/feat-x.readiness.json ;;
+  clean)
+    printf '{"id":"feat-x","phase":"review","ts":"t","verdict":"SHIP","findings":2,"blocking":0,"deferred":2,"unreviewed":[],"fingerprint":""}' \\
+      >specs/reports/feat-x.verdict.json ;;
+  deadreviewer)
+    printf '{"id":"feat-x","phase":"review","ts":"t","verdict":"REVISE","findings":0,"blocking":0,"deferred":0,"unreviewed":["backend"],"fingerprint":""}' \\
+      >specs/reports/feat-x.verdict.json ;;
+  deadimplementer)
+    printf '{"id":"feat-x","phase":"readiness","ts":"t","verdict":"READY","gaps":[],"surfaces":["backend"]}' \\
+      >specs/reports/feat-x.readiness.json
+    printf '{"id":"feat-x","phase":"build","ts":"t","surfaces":{"backend":"dead","frontend":"ok"},"dead":["backend"]}' \\
+      >specs/reports/feat-x.build.json ;;
+  blocking)
+    printf '{"id":"feat-x","phase":"review","ts":"t","verdict":"REVISE","findings":3,"blocking":2,"deferred":1,"fingerprint":"aaaa1111bbbb2222"}' \\
+      >specs/reports/feat-x.verdict.json ;;
+  noop) : ;;
+esac
+exit 0
+`;
+
+// One scratch repo per scenario: a git checkout (loop.sh cds to its toplevel), a
+// spec, the fake claude on PATH, and the phase script it plays out.
+function scenario(phases, { frontmatter = FM } = {}) {
+  const dir = mkdtempSync(join(tmpdir(), "cohorte-loop-"));
+  const git = (...a) => execFileSync("git", ["-C", dir, ...a], { stdio: "ignore" });
+  git("init", "-q");
+  git("config", "user.email", "t@t.t");
+  git("config", "user.name", "t");
+  mkdirSync(join(dir, "specs/reports"), { recursive: true });
+  writeFileSync(join(dir, "specs/feat-x.md"), frontmatter);
+  git("add", "-A");
+  git("commit", "-qm", "init");
+
+  const bin = join(dir, "bin");
+  mkdirSync(bin);
+  writeFileSync(join(dir, "phases"), phases.join("\n") + "\n");
+  writeFileSync(join(bin, "claude"), FAKE_CLAUDE);
+  chmodSync(join(bin, "claude"), 0o755);
+  return { dir, bin };
+}
+
+function runLoop({ dir, bin }, args) {
+  const r = spawnSync("bash", [LOOP, ...args], {
+    cwd: dir,
+    encoding: "utf8",
+    env: {
+      ...process.env,
+      PATH: `${bin}:${process.env.PATH}`,
+      SCEN_DIR: dir,
+      CLAUDE_FLAGS: "--permission-mode acceptEdits",
+      GIT_AUTHOR_NAME: "t", GIT_AUTHOR_EMAIL: "t@t.t",
+      GIT_COMMITTER_NAME: "t", GIT_COMMITTER_EMAIL: "t@t.t",
+    },
+  });
+  const spec = readFileSync(join(dir, "specs/feat-x.md"), "utf8");
+  const fm = k => {
+    const m = spec.match(new RegExp(`^${k}:\\s*([^#\\n]*)`, "m"));
+    return m ? m[1].trim() : null;
+  };
+  return { code: r.status, out: `${r.stdout}${r.stderr}`, spec, fm };
+}
+
+console.log("loop.sh — readiness gate");
+{
+  const s = scenario(["build:notready"]);
+  const r = runLoop(s, ["feat-x"]);
+  check("NOT-READY ⇒ exit 4, not 2", r.code === 4, `got ${r.code}: ${r.out.trim().split("\n").pop()}`);
+  check("NOT-READY ⇒ says the spec is not implementable",
+    /not implementable/i.test(r.out), r.out.trim().split("\n").pop());
+  check("NOT-READY ⇒ points at /cohorte-spec", /\/cohorte-spec feat-x/.test(r.out));
+  check("NOT-READY ⇒ spec left blocked", r.fm("status") === "blocked", r.fm("status"));
+  check("NOT-READY ⇒ no review ran (the gate is the point)", !/phase=review/.test(r.out));
+  check("NOT-READY ⇒ the build stamp is NOT written",
+    !existsSync(join(s.dir, "specs/reports/feat-x.built")));
+}
+
+console.log("loop.sh — clean run");
+{
+  const s = scenario(["build:ready", "review:clean"]);
+  const r = runLoop(s, ["feat-x"]);
+  check("clean ⇒ exit 0", r.code === 0, `got ${r.code}: ${r.out}`);
+  check("clean ⇒ status in-review (ready to /cohorte-ship)", r.fm("status") === "in-review", r.fm("status"));
+  check("clean ⇒ loop state cleared", r.fm("loop_pass") === "0" && r.fm("loop_phase") === "done",
+    `${r.fm("loop_pass")}/${r.fm("loop_phase")}`);
+  check("clean ⇒ the deferred count is named, not dropped",
+    /2 deferred finding\(s\) parked/.test(r.out), r.out.trim().split("\n").pop());
+  check("clean ⇒ the status comment survives the awk rewrite",
+    /^status: in-review # draft/m.test(r.spec), r.spec.split("\n")[3]);
+}
+
+console.log("loop.sh — a dead subagent is never a clean result");
+{
+  // A dead implementer: /cohorte-build finishes fine having built one surface of two. Reviewing
+  // that would spend N reviewers auditing a half-built feature and report its holes as
+  // findings to fix — the wrong diagnosis at the wrong price.
+  const s = scenario(["build:deadimplementer"]);
+  const r = runLoop(s, ["feat-x"]);
+  check("dead implementer ⇒ exit 2, not a review pass", r.code === 2, `got ${r.code}: ${r.out}`);
+  check("dead implementer ⇒ no reviewer was spawned", !/phase=review/.test(r.out));
+  check("dead implementer ⇒ names the cause", /implementer died/.test(r.out),
+    r.out.trim().split("\n").pop());
+  check("dead implementer ⇒ spec left blocked", r.fm("status") === "blocked", r.fm("status"));
+}
+{
+  // THE dangerous one: blocking == 0 because the only reviewer that could have found
+  // something never answered. Exiting 0 here would report "clean" about unread code and
+  // send the human to /cohorte-ship.
+  const s = scenario(["build:ready", "review:deadreviewer"]);
+  const r = runLoop(s, ["feat-x"]);
+  check("dead reviewer + blocking 0 ⇒ NOT exit 0", r.code !== 0, `got ${r.code}: ${r.out}`);
+  check("dead reviewer ⇒ exit 2 (no usable verdict)", r.code === 2, `got ${r.code}`);
+  check("dead reviewer ⇒ names the unreviewed surface", /reviewer died/.test(r.out),
+    r.out.trim().split("\n").pop());
+  check("dead reviewer ⇒ never says clean", !/✓ clean/.test(r.out));
+  check("dead reviewer ⇒ spec is NOT left in-review", r.fm("status") === "blocked", r.fm("status"));
+}
+
+console.log("loop.sh — non-convergent + resume");
+{
+  const s = scenario(["build:ready", "review:blocking", "fix:noop", "review:blocking"]);
+  const r = runLoop(s, ["feat-x", "--max=4"]);
+  check("same fingerprint twice ⇒ exit 3", r.code === 3, `got ${r.code}: ${r.out}`);
+  check("non-convergent ⇒ status blocked", r.fm("status") === "blocked", r.fm("status"));
+  check("non-convergent ⇒ the pass it reached is recorded (resume anchor)",
+    r.fm("loop_pass") === "2", r.fm("loop_pass"));
+  check("non-convergent ⇒ the phase is recorded", r.fm("loop_phase") === "review", r.fm("loop_phase"));
+
+  // Resume: the recorded pass is where it picks up — passes 1..n-1 are not re-paid.
+  writeFileSync(join(s.dir, "count"), "0");
+  writeFileSync(join(s.dir, "phases"), "review:clean\n");
+  const r2 = runLoop(s, ["feat-x", "--max=4", "--resume"]);
+  check("--resume ⇒ announces the pass it continues from",
+    /resuming at review pass 2/.test(r2.out), r2.out.trim().split("\n")[0]);
+  check("--resume ⇒ skips the build (the stamp is there)", !/phase=build/.test(r2.out));
+  check("--resume ⇒ finishes clean from there", r2.code === 0, `got ${r2.code}: ${r2.out}`);
+  check("--resume ⇒ reports the resumed pass count, not 1",
+    /after 2 review pass\(es\)/.test(r2.out), r2.out.trim().split("\n").pop());
+}
+{
+  const s = scenario(["review:clean"]);
+  // A resume anchor past the ceiling is a usage error, not a silent restart at 1.
+  writeFileSync(join(s.dir, "specs/feat-x.md"), FM.replace("branch:", "loop_pass: 9\nbranch:"));
+  const r = runLoop(s, ["feat-x", "--max=3", "--resume"]);
+  check("--resume past --max ⇒ exit 64 with the reason", r.code === 64 && /raise --max/.test(r.out),
+    `${r.code}: ${r.out.trim()}`);
+}
+
+console.log("loop.sh — a spec with no front-matter still runs");
+{
+  const s = scenario(["build:ready", "review:clean"], { frontmatter: "# Feat X\n\nno front-matter\n" });
+  const r = runLoop(s, ["feat-x"]);
+  check("no front-matter ⇒ still exits 0 (stamps are a silent no-op)", r.code === 0,
+    `got ${r.code}: ${r.out}`);
+  check("no front-matter ⇒ the spec is left untouched",
+    r.spec === "# Feat X\n\nno front-matter\n", JSON.stringify(r.spec));
+  check("no front-matter ⇒ no stray temp file",
+    !existsSync(join(s.dir, "specs/feat-x.md.loop.tmp")));
+}
+
+// ── the sleep inhibitor must never be able to fail the run ───────────────────
+// loop.sh re-execs itself under caffeinate/systemd-inhibit to hold a power assertion.
+// `exec` replaces the shell, so an inhibitor that EXISTS but is refused makes its own
+// failure the driver's exit code and the run never starts. CI found this the hard way:
+// GitHub's Linux runners ship systemd-inhibit and answer "Failed to inhibit: Access
+// denied", which turned all 24 loop tests red at once.
+console.log("loop.sh — the sleep inhibitor is best-effort, never fatal");
+{
+  const s = scenario(["build:ready", "review:clean"]);
+  // Both inhibitors present on PATH and both failing — the CI shape.
+  writeFileSync(join(s.bin, "systemd-inhibit"),
+    '#!/bin/sh\necho "Failed to inhibit: Access denied" >&2\nexit 1\n');
+  chmodSync(join(s.bin, "systemd-inhibit"), 0o755);
+  writeFileSync(join(s.bin, "caffeinate"), "#!/bin/sh\nexit 127\n");
+  chmodSync(join(s.bin, "caffeinate"), 0o755);
+  const r = runLoop(s, ["feat-x"]);
+  check("a refused inhibitor ⇒ the run still completes clean", r.code === 0,
+    `got ${r.code}: ${r.out.trim().split("\n").pop()}`);
+  check("a refused inhibitor ⇒ its error never reaches the driver's output",
+    !/Access denied/.test(r.out), r.out.trim().split("\n").pop());
+
+  // A WORKING inhibitor must still be used (or the probe would have disabled the feature).
+  const s2 = scenario(["build:ready", "review:clean"]);
+  writeFileSync(join(s2.bin, "systemd-inhibit"),
+    '#!/bin/sh\nwhile [ $# -gt 0 ]; do case "$1" in --*) shift ;; *) break ;; esac; done\n'
+    + 'echo "INHIBIT-HELD" >&2\nexec "$@"\n');
+  chmodSync(join(s2.bin, "systemd-inhibit"), 0o755);
+  writeFileSync(join(s2.bin, "caffeinate"), "#!/bin/sh\nexit 127\n");
+  chmodSync(join(s2.bin, "caffeinate"), 0o755);
+  const r2 = runLoop(s2, ["feat-x"]);
+  check("a usable inhibitor is still exec'd (the probe didn't kill the feature)",
+    /INHIBIT-HELD/.test(r2.out) && r2.code === 0, `${r2.code}: ${r2.out.trim().split("\n").pop()}`);
+}
+
+if (failures) { console.error(`\ntest-loop: ${failures} failure(s)`); process.exit(1); }
+console.log("\ntest-loop: OK");

package/scripts/test-metrics.mjs

@@ -59,7 +59,7 @@ const usageOpus = {
 };
 
 const lines = [
-  user(0, '<command-message>build</command-message>\n<command-name>/build</command-name>'),
+  user(0, '<command-message>build</command-message>\n<command-name>/cohorte-build</command-name>'),
   // Case 1: one response, three lines, identical usage on each. Only one should be billed.
   assistant('m1', 5, 'claude-opus-5', usageOpus, [{ type: 'thinking', thinking: '...' }]),
   assistant('m1', 5, 'claude-opus-5', usageOpus, [{ type: 'text', text: 'hello' }]),
@@ -74,26 +74,34 @@ const lines = [
   assistant('m4', 605, 'claude-opus-5', { input_tokens: 0, output_tokens: 40 }),
   // Case 6: a command named inside ordinary prose. The harness emits no <command-name>
   // for this, but it is the way commands actually get invoked in practice.
-  user(1200, 'move on branding-ramp and /review'),
+  user(1200, 'move on branding-ramp and /cohorte-review'),
   assistant('m5', 1205, 'claude-opus-5', { input_tokens: 0, output_tokens: 60 }),
-  // Case 7: a short steer continues the /review rather than opening an anonymous run.
+  // Case 7: a short steer continues the /cohorte-review rather than opening an anonymous run.
   user(1260, 'continue'),
   assistant('m6', 1265, 'claude-opus-5', { input_tokens: 0, output_tokens: 70 }),
   // Case 8: a slash token that is not a command must not invent one.
   user(1800, 'look at the /usr/local/share directory and report what you find there'),
   assistant('m7', 1805, 'claude-opus-5', { input_tokens: 0, output_tokens: 10 }),
   // Case 9: a long prompt that merely DISCUSSES a command is not an invocation of it.
-  // Without the length gate, writing about /review bills the conversation to /review —
+  // Without the length gate, writing about /cohorte-review bills the conversation to /cohorte-review —
   // which is what happened in cohorte's own repo while the pipeline was being designed.
-  user(2400, 'I want to talk through how /review behaves when a surface has no findings at '
+  user(2400, 'I want to talk through how /cohorte-review behaves when a surface has no findings at '
     + 'all, because the verdict logic there is what produced the false green we saw last week '
     + 'and I am not convinced the fix covers the case where every reviewer dies at once.'),
   assistant('m8', 2405, 'claude-opus-5', { input_tokens: 0, output_tokens: 20 }),
+  // Case 10: a RETIRED command name still attributes to itself. 2.0.0 prefixed every
+  // command, so months of existing transcripts say `/build` — and the collector reads its
+  // known names off the shipped core, where `build.md` no longer exists. Without the
+  // retired list every one of those runs silently reclassifies to (chat), rewriting spend
+  // history and inflating the catch-all. This is the largest instance of that bug class,
+  // so it gets pinned rather than trusted to a comment.
+  user(3000, '/build branding-ramp'),
+  assistant('m9', 3005, 'claude-opus-5', { input_tokens: 0, output_tokens: 90 }),
 ];
 fs.writeFileSync(path.join(projectDir, `${SESSION}.jsonl`),
   lines.map((l) => JSON.stringify(l)).join('\n') + '\n');
 
-// Case 3: subagent spend, linked back to /build by the Task tool_use id.
+// Case 3: subagent spend, linked back to /cohorte-build by the Task tool_use id.
 const agentDir = path.join(projectDir, SESSION, 'subagents');
 fs.writeFileSync(path.join(agentDir, 'agent-a1.meta.json'),
   JSON.stringify({ agentType: 'core', description: 'Build core surface', toolUseId: 'toolu_A', spawnDepth: 1 }));
@@ -109,13 +117,14 @@ if (run.status !== 0) {
   process.exit(1);
 }
 const out = JSON.parse(run.stdout);
-const build = out.commands.find((c) => c.command === '/build');
+const build = out.commands.find((c) => c.command === '/cohorte-build');
 const chat = out.commands.find((c) => c.command === '(chat)');
-const review = out.commands.find((c) => c.command === '/review');
+const retired = out.commands.find((c) => c.command === '/build');
+const review = out.commands.find((c) => c.command === '/cohorte-review');
 
 console.log('test-metrics');
-check('the mid-command task-notification did not split the run', out.totals.runs, 5);
-check('/build is one run, not three', build.runs, 1);
+check('the mid-command task-notification did not split the run', out.totals.runs, 6);
+check('/cohorte-build is one run, not three', build.runs, 1);
 check('duplicate lines of one response are billed once', build.tokens.output, 1000 + 500 + 2000);
 check('the <synthetic> message contributed no tokens', build.tokens.output < 999999, true);
 check('cache-write tokens are kept on their own tier', build.tokens.cacheWrite5m, 1000);
@@ -128,6 +137,9 @@ check('the continued turn counts toward the command it continued', review.tokens
 check('a non-command slash token does not invent a command', chat.tokens.output, 40 + 10 + 20);
 check('a long prompt that discusses a command is not counted as running it',
   review.runs, 1);
+check('a retired unprefixed command stays attributed to itself, not (chat)',
+  retired && retired.runs, 1);
+check('…and keeps its own spend', retired && retired.tokens.output, 90);
 
 // opus-5 $5 in / $25 out per MTok; 5m cache write 1.25x input, cache read 0.1x input.
 //   m1  100*5 + 1000*25 + 1000*6.25 + 10000*0.5 = 36750
@@ -136,7 +148,7 @@ check('a long prompt that discusses a command is not counted as running it',
 check('cost sums the cache tiers at their own rates', Number(build.cost.total.toFixed(6)), 0.07925);
 check('the unpriced list stays empty for known models', build.unpriced, []);
 
-const detail = out.runs.find((r) => r.command === '/build');
+const detail = out.runs.find((r) => r.command === '/cohorte-build');
 check('per-run detail carries the subagent', detail.agents.map((a) => a.type), ['core']);
 
 fs.rmSync(tmp, { recursive: true, force: true });

package/scripts/test-workflows.mjs

@@ -105,7 +105,7 @@ console.log("review.js");
   ]));
   check("clean run ⇒ SHIP", result.verdict === "SHIP", `got ${result.verdict}`);
   check("clean run ⇒ no unreviewed surfaces", (result.unreviewedSurfaces || []).length === 0);
-  check("clean run ⇒ next is /ship", String(result.next).startsWith("/ship"), result.next);
+  check("clean run ⇒ next is /cohorte-ship", String(result.next).startsWith("/cohorte-ship"), result.next);
 }
 {
   // THE regression: every reviewer dies ⇒ zero findings ⇒ must NOT read as SHIP.
@@ -132,19 +132,47 @@ console.log("review.js");
 }
 {
   // A SHIP carrying HIGH findings is a real verdict, but it is not "go ship it":
-  // the conversational /review routes any surviving HIGH to /fix.
+  // the conversational /cohorte-review routes any surviving HIGH to /cohorte-fix.
   const { result } = await run("review.js", replier([
     ["review:", { verdict: "SHIP", findings: [finding()] }], ...BASE_REVIEW,
   ]));
   check("SHIP + HIGH findings ⇒ verdict still SHIP", result.verdict === "SHIP");
-  check("SHIP + HIGH findings ⇒ next routes to /fix, not /ship",
-    String(result.next).startsWith("/fix"), result.next);
+  check("SHIP + HIGH findings ⇒ next routes to /cohorte-fix, not /cohorte-ship",
+    String(result.next).startsWith("/cohorte-fix"), result.next);
 }
 {
   const { result } = await run("review.js", replier([
     ["review:", { verdict: "SHIP", findings: [finding({ severity: "LOW" })] }], ...BASE_REVIEW,
   ]));
-  check("SHIP + only LOW ⇒ next is /ship", String(result.next).startsWith("/ship"), result.next);
+  check("SHIP + only LOW ⇒ next is /cohorte-ship", String(result.next).startsWith("/cohorte-ship"), result.next);
+}
+{
+  // Deferred findings are real but out of the feature's scope: they must be
+  // counted and routed to the backlog, yet move NEITHER the verdict nor `clean`.
+  // Both halves matter — a deferred item that blocks costs a fix loop it was
+  // deferred out of, and one that is dropped is the leak the section exists to close.
+  const deferred = [{
+    severity: "HIGH", file: "apps/api/legacy.ts", line: 9, kind: "quality",
+    problem: "p", fix: "f", outOfScope: "predates this feature; diff never touched it",
+  }];
+  let stagePrompt = "";
+  const { result } = await run("review.js", (prompt, opts) => {
+    const label = opts.label || "";
+    if (label.startsWith("review:")) return { verdict: "SHIP", findings: [], deferred };
+    if (label === "stage-report") { stagePrompt = prompt; return "done"; }
+    return replier(BASE_REVIEW)(prompt, opts);
+  });
+  check("deferred-only ⇒ verdict still SHIP", result.verdict === "SHIP", `got ${result.verdict}`);
+  check("deferred-only ⇒ next is /cohorte-ship (not a fix loop)",
+    String(result.next).startsWith("/cohorte-ship"), result.next);
+  check("deferred are counted (both surfaces)", result.deferred === 2, `got ${result.deferred}`);
+  check("deferred stay out of the severity counts",
+    Object.values(result.counts).every(n => n === 0), JSON.stringify(result.counts));
+  check("deferred are routed to the refactor backlog",
+    /refactor-backlog\.md/.test(stagePrompt) && /deferred:feat-x/.test(stagePrompt),
+    stagePrompt.slice(0, 200));
+  check("deferred are never cross-checked (no verify agent spawned)",
+    !/verify:/.test(String(result.criticals)) && result.refutedByCrossCheck === 0);
 }
 {
   const { result } = await run("review.js", replier([