cohorte 1.6.0 → 2.0.0

package/core/commands/{update-pipeline.md → cohorte-update-pipeline.md}

@@ -1,6 +1,6 @@
 ---
 model: sonnet
-description: Refresh the pipeline core (global ~/.claude, or a repo's bundled .claude) to the latest published cohorte version, then reconcile this repo's generated files to it — /init-pipeline stays one-time.
+description: Refresh the pipeline core (global ~/.claude, or a repo's bundled .claude) to the latest published cohorte version, then reconcile this repo's generated files to it — /cohorte-init-pipeline stays one-time.
 argument-hint: [path-to-local-checkout]
 ---
 
@@ -8,7 +8,7 @@ You are the **pipeline updater**. Refresh the installed pipeline core to the lat
 repo. The installer's `--update` mode never touches generated files: `PIPELINE.md`, rendered surface agents,
 `gate-config.json`, `settings.json`, and the filled `~/.claude/cohorte.config.yaml` are all preserved.
 YOU then bring those generated files up to the new core yourself (§3.5) — additively, never clobbering
-the human's choices — so `/init-pipeline` never needs re-running for an upgrade.
+the human's choices — so `/cohorte-init-pipeline` never needs re-running for an upgrade.
 
 ## 1. Detect the install scope + current version
 
@@ -57,7 +57,7 @@ differs from the core you just installed, rewrite that one field (leave every ot
 and tell the human to commit it. In **bundled** mode the installer already did it; in **global** mode
 **nothing does** — the installer refreshes one shared core and cannot know which repos point at it,
 so before 1.2.5 the field simply drifted forever (a repo on a current core still claiming `1.0.0`).
-`/doctor` check 1 requires the pointer to be coherent with the VERSION file, so a drifted field reads
+`/cohorte-doctor` check 1 requires the pointer to be coherent with the VERSION file, so a drifted field reads
 as a broken install when nothing is broken.
 
 Then print **What's new**: read the installed `<core>/pipeline/CHANGELOG.md` and show the entries
@@ -82,9 +82,14 @@ health check** (SCHEMA.md §Code retrieval: CLI resolvable from PATH, `.mcp.json
 upgrading a bare `serena` entry to the PATH-proof launcher form, `.serena/` gitignored, server
 actually connected) and repair whatever fails — wiring that worked at
 init can rot (PATH changes, uninstalls, hand-edits). Report what was reconciled; if nothing was
-missing, say so. This is why `/init-pipeline` never needs re-running for a core upgrade.
+missing, say so. This is why `/cohorte-init-pipeline` never needs re-running for a core upgrade.
 
-Three of the §Reconcile steps matter specifically here:
+Four of the §Reconcile steps matter specifically here:
+
+- **Local-artifact hygiene** (§Reconcile step 8): gitignore + untrack the pipeline's runtime files
+  (`.claude/preflight.ok`, `.claude/pipeline-metrics.jsonl`, `specs/reports/`). A tracked
+  `preflight.ok` — what every pre-2.0.0 install ends up with once a release agent stages `.claude/` —
+  makes the phase gate ask on every single review dispatch, so fix it here and say so.
 
 - **Spec-template top-up** (§Reconcile step 7): `specs/_template.md` was seeded at install and never
   refreshed since, so add the front-matter fields the current `templates/spec.template.md` has and the
@@ -111,7 +116,7 @@ Three of the §Reconcile steps matter specifically here:
 - **Restart / reload the Claude Code session** so it picks up updated commands, agents, and any
   newly-registered MCP server.
 - **Other repos using the global core:** their core is already fresh, but reconcile is per-repo — run
-  `/update-pipeline` inside each (it will skip the already-done core update and just reconcile).
+  `/cohorte-update-pipeline` inside each (it will skip the already-done core update and just reconcile).
 - **Commit** the reconciled files (`PIPELINE.md`, `.claude/`, `.mcp.json` if added) so teammates get them.
 - The kanban config is global and user-scoped
   (`~/.claude/cohorte.config.yaml`) — never committed. The core update never touches it; only the

package/core/hooks/gate.py

@@ -6,7 +6,7 @@ inspecting the FULL command string so chained forms like
 `cd apps/api && node ace migration:run` are caught — something prefix-based
 permission rules in settings.json miss.
 
-Patterns come from `.claude/gate-config.json` (generated by /init-pipeline from
+Patterns come from `.claude/gate-config.json` (generated by /cohorte-init-pipeline from
 the PIPELINE.md `gate` block):
 
     { "deny": ["node ace migration:fresh", ...],
@@ -16,7 +16,7 @@ A pattern matches a command segment when the segment *contains* the pattern
 (after normalizing whitespace). `deny` wins over `ask`. If the config is missing
 or unreadable, the hook stays silent (exit 0) and lets settings.json decide.
 
-The hook fires for EVERY agent in the session — the lead, /build's implementers,
+The hook fires for EVERY agent in the session — the lead, /cohorte-build's implementers,
 and subagents spawned by the Workflow runtime alike. Workflow subagents run in
 acceptEdits regardless of the session's permission mode (their Write/Edit calls
 are auto-approved), but acceptEdits does NOT auto-approve Bash or Task, so this
@@ -31,7 +31,10 @@ Two extra duties beyond Bash patterns:
   listed subagent_type (default review) requires a fresh
   `.claude/preflight.ok` stamp, written by pipeline/scripts/preflight.sh when
   typecheck+lint+tests are green. Stale/missing stamp => "ask" — dispatching
-  reviewers onto code that doesn't compile burns their whole run.
+  reviewers onto code that doesn't compile burns their whole run. Freshness is
+  a content digest (see tree_digest), not the HEAD sha: the reviewed tree is
+  normally dirty, so a commit must not invalidate a stamp and an uncommitted
+  edit must. The stamp is local and gitignored — never versioned.
 
 Protocol: reads the PreToolUse payload on stdin; emits a JSON permissionDecision
 of "deny" or "ask" on a match; otherwise exits 0 silently.
@@ -40,8 +43,10 @@ of "deny" or "ask" on a match; otherwise exits 0 silently.
 import json
 import os
 import re
+import shutil
 import subprocess
 import sys
+import tempfile
 import time
 
 SPLIT = re.compile(r"&&|\|\||[;|\n]")
@@ -129,6 +134,84 @@ def known_heads(cwd: str):
     return heads
 
 
+def worktree_dirs(cwd: str):
+    """`cwd` plus every linked worktree path — the checkouts a stamp may describe."""
+    dirs = [cwd]
+    try:
+        out = subprocess.run(
+            ["git", "worktree", "list", "--porcelain"],
+            cwd=cwd, capture_output=True, text=True, timeout=3,
+        )
+        if out.returncode == 0:
+            for line in out.stdout.splitlines():
+                if line.startswith("worktree "):
+                    p = line.split(" ", 1)[1].strip()
+                    if p and p not in dirs:
+                        dirs.append(p)
+    except Exception:
+        pass
+    return dirs
+
+
+def tree_digest(cwd: str):
+    """The digest pipeline/scripts/preflight.sh stamps for the checkout at `cwd`: the git
+    tree id of the working tree, computed in a throwaway index (`.claude` and `specs`
+    excluded — the pipeline writes those itself). Content-addressed, so a commit of the
+    same code keeps the stamp valid and any real edit invalidates it. Must stay identical
+    to the shell side. Returns None when git can't answer, and the caller falls back."""
+    tmp = None
+    try:
+        idx = subprocess.run(
+            ["git", "rev-parse", "--absolute-git-dir"],
+            cwd=cwd, capture_output=True, text=True, timeout=3,
+        )
+        if idx.returncode != 0:
+            return None
+        real_index = os.path.join(idx.stdout.strip(), "index")
+        fd, tmp = tempfile.mkstemp(prefix="cohorte-idx-")
+        os.close(fd)
+        # Seed from the real index to keep its stat cache — `add` then re-hashes only
+        # what changed instead of the whole tree on every dispatch.
+        if os.path.exists(real_index):
+            shutil.copyfile(real_index, tmp)
+        else:
+            os.unlink(tmp)  # a 0-byte index is a corrupt index — let git create it
+        env = dict(os.environ, GIT_INDEX_FILE=tmp)
+        # Drop the excluded paths outright — an `add` exclude only stops them being
+        # *updated*, so already-tracked ones would still shift the tree id.
+        subprocess.run(
+            ["git", "rm", "--cached", "-r", "-q", "--ignore-unmatch", "--", ".claude", "specs"],
+            cwd=cwd, capture_output=True, timeout=10, env=env,
+        )
+        add = subprocess.run(
+            ["git", "add", "-A", "--", ".", ":(exclude).claude", ":(exclude)specs"],
+            cwd=cwd, capture_output=True, timeout=30, env=env,
+        )
+        if add.returncode != 0:
+            return None
+        out = subprocess.run(
+            ["git", "write-tree"], cwd=cwd, capture_output=True, text=True, timeout=10, env=env,
+        )
+        if out.returncode != 0:
+            return None
+        return out.stdout.strip() or None
+    except Exception:
+        return None
+    finally:
+        for p in ((tmp, tmp + ".lock") if tmp else ()):
+            try:
+                os.unlink(p)
+            except Exception:
+                pass
+
+
+def known_digests(cwd: str):
+    """Every checkout's current digest. The preflight may have run in a feature worktree
+    while the Task dispatch fires from the main checkout (or vice versa) — same reason
+    known_heads() spans worktrees."""
+    return {d for d in (tree_digest(p) for p in worktree_dirs(cwd)) if d}
+
+
 def check_preflight(payload: dict, cfg: dict) -> int:
     """Phase gate on Task dispatches: review agents need a green preflight stamp."""
     pf = cfg.get("preflight") or {}
@@ -149,17 +232,29 @@ def check_preflight(payload: dict, cfg: dict) -> int:
         why = "no preflight stamp found"
     if raw is not None:
         try:
-            epoch_s, _, sha = raw.partition(" ")
+            fields = raw.split()
+            epoch_s = fields[0]
+            sha = fields[1] if len(fields) > 1 else ""
+            digest = fields[2] if len(fields) > 2 else ""
             age_min = (time.time() - float(epoch_s)) / 60
             max_age = float(pf.get("max_age_minutes", 30) or 30)
+            cwd = session_cwd(payload)
             if age_min > max_age:
                 why = f"the preflight stamp is {age_min:.0f} min old (max {max_age:.0f})"
+            elif digest not in ("", "none"):
+                # 2.0.0+ stamp: key off the verified CONTENT, not HEAD. A commit that
+                # doesn't touch code keeps the stamp valid; an edit that never reaches a
+                # commit invalidates it — both of which the sha comparison got backwards.
+                digests = known_digests(cwd)
+                if digests and digest not in digests:
+                    why = "the code changed since the preflight ran"
             else:
-                heads = known_heads(session_cwd(payload))
+                # Pre-2.0.0 stamp (no digest) — fall back to the HEAD comparison.
+                heads = known_heads(cwd)
                 if heads and sha not in ("", "none") and sha not in heads:
                     why = "HEAD moved since the preflight ran"
         except Exception:
-            why = "the preflight stamp is unreadable (expected `<epoch> <sha>`)"
+            why = "the preflight stamp is unreadable (expected `<epoch> <sha> <digest>`)"
     if why is None:
         return 0
     # Same rule as the Bash gate: unattended runs have nobody to answer an "ask".

package/core/templates/brainstorm-return.md

@@ -1,6 +1,6 @@
 # BRAINSTORM RETURN — <feature title>
 
-> Paste this into `/spec`.
+> Paste this into `/cohorte-spec`.
 
 **One-liner:** <what we're building, in one sentence>
 
@@ -24,13 +24,13 @@
 
 - **Data:** <entities / fields touched>
 - **Screens:** <key screens/flows — mobile-first if the project has UI>
-- **Interface (rough):** <endpoints / methods we'll need — refined into the contract in /spec>
+- **Interface (rough):** <endpoints / methods we'll need — refined into the contract in /cohorte-spec>
 
 ## Risks & open questions
 
 - <risk / unknown>
-- <open question for /spec to resolve>
+- <open question for /cohorte-spec to resolve>
 
 ## Panel dissent (what was contested)
 
-<the strongest disagreement the panel surfaced — so /spec doesn't paper over it>
+<the strongest disagreement the panel surfaced — so /cohorte-spec doesn't paper over it>

package/core/templates/decisions.template.md

@@ -5,7 +5,7 @@
 > built* (surfaces, commands, conventions); this file says *what was decided and why*.
 >
 > **Append-only. One line per decision. No prose blocks, no code.** The bound is the point: this file
-> is read by `/spec`, `/brainstorm` and `/audit` — the deciding stages — and by **nothing else**.
+> is read by `/cohorte-spec`, `/cohorte-brainstorm` and `/cohorte-audit` — the deciding stages — and by **nothing else**.
 > Implementers and reviewers never read it: they work from the frozen contract, which already tells
 > them what to do; handing them the rationale too would cost `surfaces × dispatches` tokens per
 > feature for a fact they cannot act on.

package/core/templates/design-brief.md

@@ -1,7 +1,7 @@
 # DESIGN BRIEF — <feature title> (`<feature_id>`)
 
 > The "spec return". Paste into the design tool (see `PIPELINE.md` §design). This is §8 of the frozen
-> spec, standalone — `/spec` writes it to `specs/design/<feature_id>.md` on freeze. Omit entirely if
+> spec, standalone — `/cohorte-spec` writes it to `specs/design/<feature_id>.md` on freeze. Omit entirely if
 > the project has no UI.
 
 **Goal:** <one line — what the user accomplishes>

package/core/templates/spec.template.md

@@ -4,10 +4,10 @@ title: <Feature title>
 status: draft # draft → frozen → in-progress → in-review → shipped · blocked (see SCHEMA.md §Spec status)
 branch: <feature_branch_prefix><slug>
 created: <YYYY-MM-DD>
-loop_pass: 0 # /drive bookkeeping — the review pass it is on; 0 = no loop running. Written by the driver, not by hand
-loop_phase: # /drive bookkeeping — build | review | fix | done. With loop_pass, this is what `--resume` reads back
-reviewed_base: # merge-base sha at the last SHIP verdict — freshness-gate anchor (written by /review)
-reviewed_digest: # sha256 (16 hex) of the reviewed source diff vs reviewed_base, specs excluded — /ship re-checks
+loop_pass: 0 # /cohorte-loop bookkeeping — the review pass it is on; 0 = no loop running. Written by the driver, not by hand
+loop_phase: # /cohorte-loop bookkeeping — build | review | fix | done. With loop_pass, this is what `--resume` reads back
+reviewed_base: # merge-base sha at the last SHIP verdict — freshness-gate anchor (written by /cohorte-review)
+reviewed_digest: # sha256 (16 hex) of the reviewed source diff vs reviewed_base, specs excluded — /cohorte-ship re-checks
 design_files: [] # design page links — full URLs of the form https://claude.ai/design/p/<projectId>?file=<file> (each carries its own project + page); blank until designed; omit if no UI
 ---
 
@@ -47,7 +47,7 @@ design_files: [] # design page links — full URLs of the form https://claude.ai
 
 <repeat per endpoint/interface>
 
-### Contract types — lead authors `<contract.path>/<slug>.<ext>` before /build
+### Contract types — lead authors `<contract.path>/<slug>.<ext>` before /cohorte-build
 
 - `<slug>...Request` / `<slug>...Response` / `<slug>Base` … (sketch the schemas here)
 
@@ -55,7 +55,7 @@ design_files: [] # design page links — full URLs of the form https://claude.ai
 
 > One `###` subsection per surface in `PIPELINE.md` §surfaces (e.g. backend, frontend), each TDD.
 > Surfaces are subsections of §6, never top-level sections — §8 and §9 are referenced by number
-> across the whole pipeline (`/build` implements "§8 flows", `/review` checks "§9 acceptance"), so a
+> across the whole pipeline (`/cohorte-build` implements "§8 flows", `/cohorte-review` checks "§9 acceptance"), so a
 > third surface must not become a §8 of its own.
 
 ### <surface.key>
@@ -85,5 +85,5 @@ design_files: [] # design page links — full URLs of the form https://claude.ai
 
 ## Remediation
 
-> Filled by `/spec` in review-return mode; empty otherwise. Each item:
+> Filled by `/cohorte-spec` in review-return mode; empty otherwise. Each item:
 > `[ ] <SEVERITY> · <file:line> · <spec-violation|quality|security> · <concrete fix>`

package/core/templates/steps/init-pipeline/01-detect-stack.md

@@ -1,4 +1,4 @@
-# /init-pipeline · 01 Detect the stack
+# /cohorte-init-pipeline · 01 Detect the stack
 
 ### Phase 1 — Detect the stack (read-only, no questions yet)
 

package/core/templates/steps/init-pipeline/02-interview-gaps.md

@@ -1,4 +1,4 @@
-# /init-pipeline · 02 Interview the gaps
+# /cohorte-init-pipeline · 02 Interview the gaps
 
 ### Phase 2 — Interview the gaps (AskUserQuestion)
 
@@ -11,7 +11,7 @@ Ask ONLY what you couldn't confidently detect. Batch related questions. Cover:
   cost), `haiku` for purely mechanical surfaces (scaffolding), `inherit` only for surfaces with real
   design decisions worth running on the lead's model.
 - **Specialization (only if Phase 1 flagged a large + cleanly-separable surface)** — offer to split it
-  into specialized sub-surfaces (e.g. `web-checkout`, `web-billing`) so `/build` runs them in parallel,
+  into specialized sub-surfaces (e.g. `web-checkout`, `web-billing`) so `/cohorte-build` runs them in parallel,
   per SCHEMA.md §Specialization. If the human accepts, apply the rules: **shared code (routing, global
   state, DS kit/tokens) becomes its own single-owner surface**, and cross-slice shapes go through the
   contract. Default to NOT splitting when boundaries are tangled or slices are tiny — coarse is fine.
@@ -20,7 +20,7 @@ Ask ONLY what you couldn't confidently detect. Batch related questions. Cover:
   Recommended option: dot/failures-only reporter (`--reporter=dot` vitest/playwright, `--silent`
   jest, `-q` pytest, `--quiet` eslint/ruff — whatever the detected runner supports). These land in
   `test_quiet_cmd`/`lint_quiet_cmd` + `commands.test_quiet`/`lint_quiet` and are what agents and the
-  `/review` pre-flight actually run (SCHEMA.md §Output discipline). If the human declines or
+  `/cohorte-review` pre-flight actually run (SCHEMA.md §Output discipline). If the human declines or
   the runner has no such flag, leave `""` — consumers then fall back to `<cmd> 2>&1 | tail -40`.
 - **Contract** — mechanism (`shared-types-zod` / `openapi` / `protobuf` / `json-schema` / `none`) and
   where feature contracts are authored. If `none`, surfaces sync by the spec prose alone.
@@ -35,11 +35,11 @@ Ask ONLY what you couldn't confidently detect. Batch related questions. Cover:
   main checkout? If worktrees: DB-per-worktree? port bases? compose file?
 - **Gate** — confirm the destructive commands to hard-deny and the ones to confirm-first (seed from the
   detected DB/migration tooling + always git commit/push/merge/rebase/reset).
-- **Personas** — keep the default `/brainstorm` panel, or customize members for this domain?
+- **Personas** — keep the default `/cohorte-brainstorm` panel, or customize members for this domain?
 
 Prefer sensible defaults from Phase 1 as the first (Recommended) option in each question.
 
-- **Kanban** (optional) — mirror this project's pipeline (`/brainstorm`…`/ship`) onto an Obsidian
+- **Kanban** (optional) — mirror this project's pipeline (`/cohorte-brainstorm`…`/cohorte-ship`) onto an Obsidian
   Kanban board? If the human says yes: confirm the shared vault path (`obsidian.vault_path` in
   `~/.claude/cohorte.config.yaml`; ask if empty) and the board's location inside it (default
   `<ProjectName>/Tasks.md`). Phase 4 creates the board and records the link. Default: no.
@@ -50,7 +50,7 @@ Prefer sensible defaults from Phase 1 as the first (Recommended) option in each
 - **Telemetry** (optional, machine-scoped — SKIP entirely if `~/.claude/cohorte.config.yaml` already
   has a `telemetry:` block with a `consent_date`, i.e. the human already answered on this machine).
   Ask ONE opt-in question, stating exactly: _"Share anonymous usage stats with the cohorte project?
-  One ping per pipeline phase, `/brainstorm` through `/ship`: core version, OS, phase name, duration,
+  One ping per pipeline phase, `/cohorte-brainstorm` through `/cohorte-ship`: core version, OS, phase name, duration,
   per-surface result counts, and a hash of the feature id — never repo names, paths, code, or IPs.
   Setup and maintenance commands never ping. Off by default; withdraw anytime
   (`telemetry.enabled: false`); erase your history anytime (SCHEMA.md §Telemetry). Default: No."_

package/core/templates/steps/init-pipeline/03-draft-profile.md

@@ -1,4 +1,4 @@
-# /init-pipeline · 03 Draft the profile
+# /cohorte-init-pipeline · 03 Draft the profile
 
 ### Phase 3 — Draft the profile (show, don't write yet)
 

package/core/templates/steps/init-pipeline/04-write-render.md

@@ -1,4 +1,4 @@
-# /init-pipeline · 04 Write & render
+# /cohorte-init-pipeline · 04 Write & render
 
 ### Phase 4 — Write & render (after go-ahead)
 
@@ -28,9 +28,9 @@
    `Bash(git status:*)`, `Bash(git diff:*)`, `Bash(git log:*)`, `Bash(git rev-parse:*)` — plus the
    shipped pipeline scripts for BOTH cores (`Bash(.claude/pipeline/scripts/:*)` and
    `Bash(~/.claude/pipeline/scripts/:*)` — preflight, kanban-move, telemetry-send) **plus the
-   `bash`-prefixed form the `/drive` driver uses** (`Bash(bash .claude/pipeline/scripts/loop.sh:*)`
+   `bash`-prefixed form the `/cohorte-loop` driver uses** (`Bash(bash .claude/pipeline/scripts/loop.sh:*)`
    and `Bash(bash ~/.claude/pipeline/scripts/loop.sh:*)`) — those prefix rules match a command
-   *starting* with the path, so `bash <path>` needs its own entry or `/drive` stalls on a permission
+   *starting* with the path, so `bash <path>` needs its own entry or `/cohorte-loop` stalls on a permission
    prompt at every launch, and the
    retrieval provider's MCP tools when wired (e.g. `mcp__serena`). Never allowlist anything matching
    a `gate.ask`/`gate.deny` pattern. Mention the human can widen it later with
@@ -49,7 +49,7 @@
    Preserve any existing custom keys.
 6. **Wire the retrieval provider** (skip if `retrieval.provider: none`):
    - **serena:** if the `serena` CLI is missing, have the human install it (`uv tool install -p 3.13
-     serena-agent`) — or set the provider to `none` if they decline, and say `/update-pipeline` can wire
+     serena-agent`) — or set the provider to `none` if they decline, and say `/cohorte-update-pipeline` can wire
      it later. If the binary exists (e.g. `~/.local/bin/serena`) but `command -v serena` fails,
      recommend the PATH fix (`uv tool update-shell`, or add `~/.local/bin` to the shell profile) for
      CLI use. Then register at **project scope** (committed `.mcp.json`, portable —
@@ -82,19 +82,23 @@
    (or, without npm: curl -fsSL https://raw.githubusercontent.com/TheBidouilleAgency/cohorte/main/install.sh | sh -s -- --global;
    Windows: install.ps1 -Global from the same repo)> " }`.
    In **global** mode also add, near the top of `CLAUDE.md`, a one-liner:
-   `> Pipeline: global core — run the installer above if /brainstorm etc. are missing.`
+   `> Pipeline: global core — run the installer above if /cohorte-brainstorm etc. are missing.`
 10. **CI workflow** (if `vcs.host: github` and no existing workflow already runs the profile's
     checks): with the human's go-ahead, generate `.github/workflows/pipeline-ci.yml` — on
     `pull_request` to `<default_branch>`: checkout, set up the `package_manager` toolchain,
     `commands.install`, then `commands.lint` · `commands.typecheck` · `commands.test` (+ per-surface
     `build_cmd`s that are non-empty). Derive the setup steps from the detected stack — mirror what a
-    sibling workflow does if one exists. `/ship` watches these checks before the merge.
-11. **Metrics sink & report buffer:** add `.claude/pipeline-metrics.jsonl` to `.gitignore` — `/build`,
-    `/review` and `/fix` append per-dispatch evidence there (SCHEMA §Specialization reads it).
-    Also add `specs/reports/` — `/review` stages its last report there so a `/fix` (or
-    `/spec` Mode B) survives a `/clear`; it's a derived buffer, not a versioned artifact.
-12. **Design system:** if `design.enabled` with a snapshot dir, note that `/align-ds` is active; else the
-    `/align-ds` command will no-op with a clear message.
+    sibling workflow does if one exists. `/cohorte-ship` watches these checks before the merge.
+11. **Metrics sink, report buffer & preflight stamp:** add `.claude/pipeline-metrics.jsonl` to
+    `.gitignore` — `/cohorte-build`, `/cohorte-review` and `/cohorte-fix` append per-dispatch evidence
+    there (SCHEMA §Specialization reads it).
+    Also add `specs/reports/` — `/cohorte-review` stages its last report there so a `/cohorte-fix` (or
+    `/cohorte-spec` Mode B) survives a `/clear`; it's a derived buffer, not a versioned artifact.
+    And `.claude/preflight.ok` — a local, per-checkout freshness stamp. Versioning it breaks the phase
+    gate for good (a committed stamp describes the tree *before* its own commit, and it rides into every
+    new worktree as a green nobody earned). If it is already tracked: `git rm --cached .claude/preflight.ok`.
+12. **Design system:** if `design.enabled` with a snapshot dir, note that `/cohorte-align-ds` is active; else the
+    `/cohorte-align-ds` command will no-op with a clear message.
 13. **Kanban** (only if the human opted in at Phase 2): wire it per SCHEMA.md §Kanban, writing into the
     **global** `~/.claude/cohorte.config.yaml` (never into this repo — the board points at a
     personal vault). Create the file from `pipeline/cohorte.config.template.yaml` if absent; set

package/core/templates/steps/init-pipeline/05-report.md

@@ -1,12 +1,12 @@
-# /init-pipeline · 05 Report
+# /cohorte-init-pipeline · 05 Report
 
 ### Phase 5 — Report
 
 Print: the install mode (bundled core under `.claude/` vs global core in `~/.claude/` + the committed
 `.claude/pipeline.json` pointer), the files written/rendered, the surface→agent mapping, and the
 tailored workflow line, e.g.
-`/brainstorm → /spec → (design) → /build <id> → test → /review → /ship`. Tell the human to sanity-check
-`PIPELINE.md`, commit it, and run `/brainstorm` to start a feature. Note that this was the one-time
-setup: from now on `/update-pipeline` both refreshes the core AND reconciles the generated files
-(SCHEMA.md §Reconcile), and `/build` auto-grows surfaces — re-running `/init-pipeline` is only for deep
+`/cohorte-brainstorm → /cohorte-spec → (design) → /cohorte-build <id> → test → /cohorte-review → /cohorte-ship`. Tell the human to sanity-check
+`PIPELINE.md`, commit it, and run `/cohorte-brainstorm` to start a feature. Note that this was the one-time
+setup: from now on `/cohorte-update-pipeline` both refreshes the core AND reconciles the generated files
+(SCHEMA.md §Reconcile), and `/cohorte-build` auto-grows surfaces — re-running `/cohorte-init-pipeline` is only for deep
 stack changes (package manager, contract mechanism, surface overhaul).

package/core/workflows/audit.js

@@ -1,5 +1,5 @@
-// cohorte — /audit as a deterministic workflow (opt-in; the conversational
-// /audit command remains the default path and the fallback).
+// cohorte — /cohorte-audit as a deterministic workflow (opt-in; the conversational
+// /cohorte-audit command remains the default path and the fallback).
 //
 // Invoke with args = {target: "<path or domain>"} (optional — default whole repo).
 //
@@ -135,7 +135,7 @@ const surfaces = Array.isArray(profile.surfaces) ? profile.surfaces : []
 // guard compares against `surfaces` — an empty list makes them all vacuously
 // pass. Fail loudly here instead of finishing with nothing done.
 if (!surfaces.length) {
-  return { error: 'profile has no surfaces — nothing would be audited. the `yaml pipeline-profile` block in PIPELINE.md is empty or unparseable, or the profile-reader mis-returned; run /doctor' }
+  return { error: 'profile has no surfaces — nothing would be audited. the `yaml pipeline-profile` block in PIPELINE.md is empty or unparseable, or the profile-reader mis-returned; run /cohorte-doctor' }
 }
 const quiet = (q, full) => (q && !String(q).startsWith('<') ? q : full ? `${full} 2>&1 | tail -40` : '')
 const scope = target || 'the whole repo'
@@ -204,7 +204,7 @@ const written = await agent(
   `Write EXACTLY this content to specs/refactor-backlog.md (overwrite), then return the single word done:\n<<<BACKLOG\n${body.join('\n')}\nBACKLOG`,
   { model: 'haiku', label: 'write-backlog', effort: 'low' },
 )
-// Returning `backlog: <path>` when the writer died points /refactor at a file
+// Returning `backlog: <path>` when the writer died points /cohorte-refactor at a file
 // that does not exist (or, worse, at the PREVIOUS run's stale backlog).
 const backlogOk = written != null && /done/i.test(String(written))
 
@@ -220,6 +220,6 @@ return {
   next: !backlogOk
     ? 'the backlog was NEVER written (writer died) — the counts above are real but nothing is on disk; re-run the audit'
     : deadDomains.length
-      ? `re-audit ${deadDomains.join(', ')} (auditor died — not covered), then /refactor <domain>`
-      : 'refactor a domain with /refactor <domain> (or the refactor workflow for big domains)',
+      ? `re-audit ${deadDomains.join(', ')} (auditor died — not covered), then /cohorte-refactor <domain>`
+      : 'refactor a domain with /cohorte-refactor <domain> (or the refactor workflow for big domains)',
 }

package/core/workflows/refactor.js

@@ -1,8 +1,8 @@
-// cohorte — /refactor as a deterministic workflow (opt-in; the conversational
-// /refactor command remains the default path and the fallback).
+// cohorte — /cohorte-refactor as a deterministic workflow (opt-in; the conversational
+// /cohorte-refactor command remains the default path and the fallback).
 //
 // BIG domains only: a domain with just a handful of open backlog items is
-// cheaper through the conversational /refactor — this script skips it and says
+// cheaper through the conversational /cohorte-refactor — this script skips it and says
 // so. Invoke with args = {domains: ["backend", …]} or {domains: "all"}.
 //
 // Shape (SCHEMA.md §Workflows): profile via profile-reader (phase 0), the open
@@ -13,7 +13,7 @@
 
 export const meta = {
   name: 'cohorte-refactor',
-  description: 'Apply the /audit refactor backlog for big domains: shared first, then parallel surface implementers, per-domain verify + one retry',
+  description: 'Apply the /cohorte-audit refactor backlog for big domains: shared first, then parallel surface implementers, per-domain verify + one retry',
   whenToUse: 'Only when the human explicitly asks for the refactor workflow on big domains. args = {domains: ["<surface key>", …] | "all"}.',
   phases: [
     { title: 'Profile', detail: 'PIPELINE.md → JSON via profile-reader', model: 'haiku' },
@@ -26,7 +26,7 @@ export const meta = {
 }
 
 // A domain below this many open items is not "big" — the conversational
-// /refactor handles it with less overhead than a workflow run.
+// /cohorte-refactor handles it with less overhead than a workflow run.
 const MIN_ITEMS = 5
 
 // The Workflow runtime hands `args` to a script verbatim, so a caller that passes a
@@ -136,7 +136,7 @@ const surfaces = Array.isArray(profile.surfaces) ? profile.surfaces : []
 // guard compares against `surfaces` — an empty list makes them all vacuously
 // pass. Fail loudly here instead of finishing with nothing done.
 if (!surfaces.length) {
-  return { error: 'profile has no surfaces — nothing would be refactored. the `yaml pipeline-profile` block in PIPELINE.md is empty or unparseable, or the profile-reader mis-returned; run /doctor' }
+  return { error: 'profile has no surfaces — nothing would be refactored. the `yaml pipeline-profile` block in PIPELINE.md is empty or unparseable, or the profile-reader mis-returned; run /cohorte-doctor' }
 }
 const byKey = Object.fromEntries(surfaces.map(s => [s.key, s]))
 const contractPath = (profile.contract && profile.contract.path) || ''
@@ -153,15 +153,15 @@ const backlog = await agent(
   { model: 'haiku', label: 'read-backlog', schema: OPEN, effort: 'low' },
 )
 // A dead reader is not "the backlog is empty" — reporting it as such sends the
-// human to re-run /audit on a backlog that is already there.
+// human to re-run /cohorte-audit on a backlog that is already there.
 if (!backlog) return { error: 'the backlog-reading agent died — nothing was read; re-run the refactor workflow' }
 const open = (backlog.domains || []).filter(d => d.items.length)
-if (!open.length) return { error: 'no open backlog items for the requested domains — run /audit (or the audit workflow) first' }
+if (!open.length) return { error: 'no open backlog items for the requested domains — run /cohorte-audit (or the audit workflow) first' }
 
 const big = open.filter(d => d.items.length >= MIN_ITEMS)
 const small = open.filter(d => d.items.length < MIN_ITEMS)
-for (const d of small) log(`Skipping ${d.key} (${d.items.length} open item(s) < ${MIN_ITEMS}) — use the conversational /refactor ${d.key}, it's cheaper`)
-if (!big.length) return { skipped: Object.fromEntries(small.map(d => [d.key, d.items.length])), reason: `every requested domain is below the ${MIN_ITEMS}-item workflow threshold — use /refactor` }
+for (const d of small) log(`Skipping ${d.key} (${d.items.length} open item(s) < ${MIN_ITEMS}) — use the conversational /cohorte-refactor ${d.key}, it's cheaper`)
+if (!big.length) return { skipped: Object.fromEntries(small.map(d => [d.key, d.items.length])), reason: `every requested domain is below the ${MIN_ITEMS}-item workflow threshold — use /cohorte-refactor` }
 
 const implementPrompt = d =>
   'Refactor pass on your surface (no feature spec). Read PIPELINE.md first. Add the missing tests ' +
@@ -243,7 +243,7 @@ if (clearedAll.length) {
     { model: 'haiku', label: 'tick-backlog', effort: 'low' },
   )
   // Reporting items as cleared while the backlog still shows them open means the
-  // next /refactor re-dispatches work that is already done.
+  // next /cohorte-refactor re-dispatches work that is already done.
   tickedOk = ticked != null && /done/i.test(String(ticked))
 }
 
@@ -256,8 +256,8 @@ return {
   backlogTicked: tickedOk,
   next: !tickedOk
     ? `${clearedAll.length} item(s) were cleared in code but NOT ticked off specs/refactor-backlog.md ` +
-      '(the ticking agent died) — tick them by hand, or the next /refactor re-dispatches finished work'
+      '(the ticking agent died) — tick them by hand, or the next /cohorte-refactor re-dispatches finished work'
     : results.some(r => r.remaining.length || !r.gatesGreen)
-      ? 'items remain — finish them with the conversational /refactor <domain>'
-      : 'all dispatched domains clean — optionally close with one final /audit',
+      ? 'items remain — finish them with the conversational /cohorte-refactor <domain>'
+      : 'all dispatched domains clean — optionally close with one final /cohorte-audit',
 }