cohorte 1.6.0 → 2.0.0

package/scripts/test-gate.mjs

@@ -231,6 +231,64 @@ console.log("gate.py — preflight phase gate");
     run(task("review"), { projectDir: noblock }).decision === null);
 }
 
+// ── the content digest (2.0.0): freshness keyed on code, not on HEAD ─────────
+// Before this, the stamp recorded the HEAD sha — backwards on both sides. The
+// reviewed tree is normally DIRTY, so committing already-verified code made the
+// gate ask on a clean tree (and a committed stamp made it ask forever), while an
+// implementer's edit between preflight and dispatch invalidated nothing.
+console.log("gate.py — preflight content digest");
+{
+  const pf = { enabled: true, agents: ["review"], max_age_minutes: 30 };
+  const d = scratch(); writeConfig(d, { ...GATE_CFG, preflight: pf });
+  gitRepo(d, "main");
+  mkdirSync(join(d, "specs", "reports"), { recursive: true });
+  writeFileSync(join(d, "specs", "s.md"), "spec\n");
+  writeFileSync(join(d, "src.txt"), "code v1\n");     // uncommitted feature work
+  const git = (...a) => execFileSync("git", a, { cwd: d, stdio: "ignore" });
+  const at = { projectDir: d };
+  const runPreflight = () =>
+    spawnSync("sh", [join(root, "scripts", "preflight.sh"), join(d, "specs", "reports", "r.txt"), "true"],
+      { cwd: d, encoding: "utf8" });
+
+  const pre = runPreflight();
+  const raw = execFileSync("cat", [join(d, ".claude", "preflight.ok")], { encoding: "utf8" }).trim();
+  check("preflight.sh stamps three fields (epoch, sha, digest)",
+    raw.split(/\s+/).length === 3, `${pre.status}: ${raw}`);
+  check("fresh stamp on a dirty tree ⇒ passes", run(task("review"), at).decision === null);
+
+  // The regression that started this: commit the very code the preflight verified.
+  git("add", "-A"); git("commit", "-qm", "wip");
+  const afterCommit = run(task("review"), at);
+  check("committing the verified code ⇒ still passes (HEAD moved, code did not)",
+    afterCommit.decision === null, `got ${afterCommit.decision} — ${afterCommit.reason}`);
+
+  // The pipeline's own writes must never invalidate its own stamp.
+  writeFileSync(join(d, "specs", "s.md"), "spec + DoD ticks\n");
+  writeFileSync(join(d, "specs", "reports", "r2.txt"), "report\n");
+  writeFileSync(join(d, ".claude", "pipeline-metrics.jsonl"), "{}\n");
+  check("spec ticks, report buffer and metrics writes ⇒ still passes",
+    run(task("review"), at).decision === null);
+
+  // …and a real edit must.
+  writeFileSync(join(d, "src.txt"), "code v2\n");
+  const edited = run(task("review"), at);
+  check("an uncommitted code edit ⇒ ask", edited.decision === "ask", edited.decision);
+  check("…and the reason says the code changed", /code changed/.test(edited.reason || ""));
+
+  // A brand-new untracked source file is a code change too (the sha never saw these).
+  writeFileSync(join(d, "src.txt"), "code v1\n");
+  writeFileSync(join(d, "extra.txt"), "new surface\n");
+  check("a new untracked source file ⇒ ask", run(task("review"), at).decision === "ask");
+  rmSync(join(d, "extra.txt"));
+  check("reverting to the verified content ⇒ passes again",
+    run(task("review"), at).decision === null);
+
+  // The hook must never touch the caller's index — it computes in a throwaway one.
+  const status = execFileSync("git", ["status", "--porcelain"], { cwd: d, encoding: "utf8" });
+  check("the gate leaves the real index untouched (nothing staged)",
+    !/^[MARCD]/m.test(status), status.trim());
+}
+
 // ── worktree awareness (the 1.3.3 known_heads fix) ───────────────────────────
 console.log("gate.py — worktree awareness");
 {

package/scripts/test-loop.mjs

@@ -1,11 +1,11 @@
 #!/usr/bin/env node
-// Behavioural tests for scripts/loop.sh — the autonomous /review ⇄ /fix driver.
+// Behavioural tests for scripts/loop.sh — the autonomous /cohorte-review ⇄ /cohorte-fix driver.
 //
 // The driver is pure shell around two JSON files it does not write, so it is
 // testable end-to-end by putting a FAKE `claude` on PATH that produces those files
 // per phase. What is pinned here cannot be seen by any structural check:
 //
-//   · exit 4 — /build's readiness gate said NOT-READY, so no pass count helps
+//   · exit 4 — /cohorte-build's readiness gate said NOT-READY, so no pass count helps
 //   · exit 0/3 leave the right TERMINAL status in the spec's front-matter, which is
 //     what makes an interrupted loop resumable (SCHEMA.md §Spec status)
 //   · the front-matter stamps are written with awk on every platform — a `sed -i`
@@ -50,7 +50,15 @@ prompt=""
 while [ $# -gt 0 ]; do
   case "$1" in -p) prompt="$2"; shift 2 ;; *) shift ;; esac
 done
-cmd="\${prompt%% *}"; cmd="\${cmd#/}"
+cmd="\${prompt%% *}"
+# The driver must dispatch the PREFIXED command (2.0.0) — an unprefixed /build would be
+# shadowed by Claude Code's own built-in and never reach the pipeline, so fail loudly
+# rather than let a regression pass by being lenient here.
+case "$cmd" in
+  /cohorte-*) ;;
+  *) echo "fake claude: expected a /cohorte-* command, got '$cmd'" >&2; exit 9 ;;
+esac
+cmd="\${cmd#/cohorte-}"          # scenarios are keyed on the PHASE, which stays unprefixed
 n=0; [ -f "$SCEN_DIR/count" ] && n=$(cat "$SCEN_DIR/count")
 n=$((n + 1)); echo "$n" >"$SCEN_DIR/count"
 step=$(sed -n "\${n}p" "$SCEN_DIR/phases")
@@ -133,7 +141,7 @@ console.log("loop.sh — readiness gate");
   check("NOT-READY ⇒ exit 4, not 2", r.code === 4, `got ${r.code}: ${r.out.trim().split("\n").pop()}`);
   check("NOT-READY ⇒ says the spec is not implementable",
     /not implementable/i.test(r.out), r.out.trim().split("\n").pop());
-  check("NOT-READY ⇒ points at /spec", /\/spec feat-x/.test(r.out));
+  check("NOT-READY ⇒ points at /cohorte-spec", /\/cohorte-spec feat-x/.test(r.out));
   check("NOT-READY ⇒ spec left blocked", r.fm("status") === "blocked", r.fm("status"));
   check("NOT-READY ⇒ no review ran (the gate is the point)", !/phase=review/.test(r.out));
   check("NOT-READY ⇒ the build stamp is NOT written",
@@ -145,7 +153,7 @@ console.log("loop.sh — clean run");
   const s = scenario(["build:ready", "review:clean"]);
   const r = runLoop(s, ["feat-x"]);
   check("clean ⇒ exit 0", r.code === 0, `got ${r.code}: ${r.out}`);
-  check("clean ⇒ status in-review (ready to /ship)", r.fm("status") === "in-review", r.fm("status"));
+  check("clean ⇒ status in-review (ready to /cohorte-ship)", r.fm("status") === "in-review", r.fm("status"));
   check("clean ⇒ loop state cleared", r.fm("loop_pass") === "0" && r.fm("loop_phase") === "done",
     `${r.fm("loop_pass")}/${r.fm("loop_phase")}`);
   check("clean ⇒ the deferred count is named, not dropped",
@@ -156,7 +164,7 @@ console.log("loop.sh — clean run");
 
 console.log("loop.sh — a dead subagent is never a clean result");
 {
-  // A dead implementer: /build finishes fine having built one surface of two. Reviewing
+  // A dead implementer: /cohorte-build finishes fine having built one surface of two. Reviewing
   // that would spend N reviewers auditing a half-built feature and report its holes as
   // findings to fix — the wrong diagnosis at the wrong price.
   const s = scenario(["build:deadimplementer"]);
@@ -170,7 +178,7 @@ console.log("loop.sh — a dead subagent is never a clean result");
 {
   // THE dangerous one: blocking == 0 because the only reviewer that could have found
   // something never answered. Exiting 0 here would report "clean" about unread code and
-  // send the human to /ship.
+  // send the human to /cohorte-ship.
   const s = scenario(["build:ready", "review:deadreviewer"]);
   const r = runLoop(s, ["feat-x"]);
   check("dead reviewer + blocking 0 ⇒ NOT exit 0", r.code !== 0, `got ${r.code}: ${r.out}`);
@@ -223,5 +231,39 @@ console.log("loop.sh — a spec with no front-matter still runs");
     !existsSync(join(s.dir, "specs/feat-x.md.loop.tmp")));
 }
 
+// ── the sleep inhibitor must never be able to fail the run ───────────────────
+// loop.sh re-execs itself under caffeinate/systemd-inhibit to hold a power assertion.
+// `exec` replaces the shell, so an inhibitor that EXISTS but is refused makes its own
+// failure the driver's exit code and the run never starts. CI found this the hard way:
+// GitHub's Linux runners ship systemd-inhibit and answer "Failed to inhibit: Access
+// denied", which turned all 24 loop tests red at once.
+console.log("loop.sh — the sleep inhibitor is best-effort, never fatal");
+{
+  const s = scenario(["build:ready", "review:clean"]);
+  // Both inhibitors present on PATH and both failing — the CI shape.
+  writeFileSync(join(s.bin, "systemd-inhibit"),
+    '#!/bin/sh\necho "Failed to inhibit: Access denied" >&2\nexit 1\n');
+  chmodSync(join(s.bin, "systemd-inhibit"), 0o755);
+  writeFileSync(join(s.bin, "caffeinate"), "#!/bin/sh\nexit 127\n");
+  chmodSync(join(s.bin, "caffeinate"), 0o755);
+  const r = runLoop(s, ["feat-x"]);
+  check("a refused inhibitor ⇒ the run still completes clean", r.code === 0,
+    `got ${r.code}: ${r.out.trim().split("\n").pop()}`);
+  check("a refused inhibitor ⇒ its error never reaches the driver's output",
+    !/Access denied/.test(r.out), r.out.trim().split("\n").pop());
+
+  // A WORKING inhibitor must still be used (or the probe would have disabled the feature).
+  const s2 = scenario(["build:ready", "review:clean"]);
+  writeFileSync(join(s2.bin, "systemd-inhibit"),
+    '#!/bin/sh\nwhile [ $# -gt 0 ]; do case "$1" in --*) shift ;; *) break ;; esac; done\n'
+    + 'echo "INHIBIT-HELD" >&2\nexec "$@"\n');
+  chmodSync(join(s2.bin, "systemd-inhibit"), 0o755);
+  writeFileSync(join(s2.bin, "caffeinate"), "#!/bin/sh\nexit 127\n");
+  chmodSync(join(s2.bin, "caffeinate"), 0o755);
+  const r2 = runLoop(s2, ["feat-x"]);
+  check("a usable inhibitor is still exec'd (the probe didn't kill the feature)",
+    /INHIBIT-HELD/.test(r2.out) && r2.code === 0, `${r2.code}: ${r2.out.trim().split("\n").pop()}`);
+}
+
 if (failures) { console.error(`\ntest-loop: ${failures} failure(s)`); process.exit(1); }
 console.log("\ntest-loop: OK");

package/scripts/test-metrics.mjs

@@ -59,7 +59,7 @@ const usageOpus = {
 };
 
 const lines = [
-  user(0, '<command-message>build</command-message>\n<command-name>/build</command-name>'),
+  user(0, '<command-message>build</command-message>\n<command-name>/cohorte-build</command-name>'),
   // Case 1: one response, three lines, identical usage on each. Only one should be billed.
   assistant('m1', 5, 'claude-opus-5', usageOpus, [{ type: 'thinking', thinking: '...' }]),
   assistant('m1', 5, 'claude-opus-5', usageOpus, [{ type: 'text', text: 'hello' }]),
@@ -74,26 +74,34 @@ const lines = [
   assistant('m4', 605, 'claude-opus-5', { input_tokens: 0, output_tokens: 40 }),
   // Case 6: a command named inside ordinary prose. The harness emits no <command-name>
   // for this, but it is the way commands actually get invoked in practice.
-  user(1200, 'move on branding-ramp and /review'),
+  user(1200, 'move on branding-ramp and /cohorte-review'),
   assistant('m5', 1205, 'claude-opus-5', { input_tokens: 0, output_tokens: 60 }),
-  // Case 7: a short steer continues the /review rather than opening an anonymous run.
+  // Case 7: a short steer continues the /cohorte-review rather than opening an anonymous run.
   user(1260, 'continue'),
   assistant('m6', 1265, 'claude-opus-5', { input_tokens: 0, output_tokens: 70 }),
   // Case 8: a slash token that is not a command must not invent one.
   user(1800, 'look at the /usr/local/share directory and report what you find there'),
   assistant('m7', 1805, 'claude-opus-5', { input_tokens: 0, output_tokens: 10 }),
   // Case 9: a long prompt that merely DISCUSSES a command is not an invocation of it.
-  // Without the length gate, writing about /review bills the conversation to /review —
+  // Without the length gate, writing about /cohorte-review bills the conversation to /cohorte-review —
   // which is what happened in cohorte's own repo while the pipeline was being designed.
-  user(2400, 'I want to talk through how /review behaves when a surface has no findings at '
+  user(2400, 'I want to talk through how /cohorte-review behaves when a surface has no findings at '
     + 'all, because the verdict logic there is what produced the false green we saw last week '
     + 'and I am not convinced the fix covers the case where every reviewer dies at once.'),
   assistant('m8', 2405, 'claude-opus-5', { input_tokens: 0, output_tokens: 20 }),
+  // Case 10: a RETIRED command name still attributes to itself. 2.0.0 prefixed every
+  // command, so months of existing transcripts say `/build` — and the collector reads its
+  // known names off the shipped core, where `build.md` no longer exists. Without the
+  // retired list every one of those runs silently reclassifies to (chat), rewriting spend
+  // history and inflating the catch-all. This is the largest instance of that bug class,
+  // so it gets pinned rather than trusted to a comment.
+  user(3000, '/build branding-ramp'),
+  assistant('m9', 3005, 'claude-opus-5', { input_tokens: 0, output_tokens: 90 }),
 ];
 fs.writeFileSync(path.join(projectDir, `${SESSION}.jsonl`),
   lines.map((l) => JSON.stringify(l)).join('\n') + '\n');
 
-// Case 3: subagent spend, linked back to /build by the Task tool_use id.
+// Case 3: subagent spend, linked back to /cohorte-build by the Task tool_use id.
 const agentDir = path.join(projectDir, SESSION, 'subagents');
 fs.writeFileSync(path.join(agentDir, 'agent-a1.meta.json'),
   JSON.stringify({ agentType: 'core', description: 'Build core surface', toolUseId: 'toolu_A', spawnDepth: 1 }));
@@ -109,13 +117,14 @@ if (run.status !== 0) {
   process.exit(1);
 }
 const out = JSON.parse(run.stdout);
-const build = out.commands.find((c) => c.command === '/build');
+const build = out.commands.find((c) => c.command === '/cohorte-build');
 const chat = out.commands.find((c) => c.command === '(chat)');
-const review = out.commands.find((c) => c.command === '/review');
+const retired = out.commands.find((c) => c.command === '/build');
+const review = out.commands.find((c) => c.command === '/cohorte-review');
 
 console.log('test-metrics');
-check('the mid-command task-notification did not split the run', out.totals.runs, 5);
-check('/build is one run, not three', build.runs, 1);
+check('the mid-command task-notification did not split the run', out.totals.runs, 6);
+check('/cohorte-build is one run, not three', build.runs, 1);
 check('duplicate lines of one response are billed once', build.tokens.output, 1000 + 500 + 2000);
 check('the <synthetic> message contributed no tokens', build.tokens.output < 999999, true);
 check('cache-write tokens are kept on their own tier', build.tokens.cacheWrite5m, 1000);
@@ -128,6 +137,9 @@ check('the continued turn counts toward the command it continued', review.tokens
 check('a non-command slash token does not invent a command', chat.tokens.output, 40 + 10 + 20);
 check('a long prompt that discusses a command is not counted as running it',
   review.runs, 1);
+check('a retired unprefixed command stays attributed to itself, not (chat)',
+  retired && retired.runs, 1);
+check('…and keeps its own spend', retired && retired.tokens.output, 90);
 
 // opus-5 $5 in / $25 out per MTok; 5m cache write 1.25x input, cache read 0.1x input.
 //   m1  100*5 + 1000*25 + 1000*6.25 + 10000*0.5 = 36750
@@ -136,7 +148,7 @@ check('a long prompt that discusses a command is not counted as running it',
 check('cost sums the cache tiers at their own rates', Number(build.cost.total.toFixed(6)), 0.07925);
 check('the unpriced list stays empty for known models', build.unpriced, []);
 
-const detail = out.runs.find((r) => r.command === '/build');
+const detail = out.runs.find((r) => r.command === '/cohorte-build');
 check('per-run detail carries the subagent', detail.agents.map((a) => a.type), ['core']);
 
 fs.rmSync(tmp, { recursive: true, force: true });

package/scripts/test-workflows.mjs

@@ -105,7 +105,7 @@ console.log("review.js");
   ]));
   check("clean run ⇒ SHIP", result.verdict === "SHIP", `got ${result.verdict}`);
   check("clean run ⇒ no unreviewed surfaces", (result.unreviewedSurfaces || []).length === 0);
-  check("clean run ⇒ next is /ship", String(result.next).startsWith("/ship"), result.next);
+  check("clean run ⇒ next is /cohorte-ship", String(result.next).startsWith("/cohorte-ship"), result.next);
 }
 {
   // THE regression: every reviewer dies ⇒ zero findings ⇒ must NOT read as SHIP.
@@ -132,19 +132,19 @@ console.log("review.js");
 }
 {
   // A SHIP carrying HIGH findings is a real verdict, but it is not "go ship it":
-  // the conversational /review routes any surviving HIGH to /fix.
+  // the conversational /cohorte-review routes any surviving HIGH to /cohorte-fix.
   const { result } = await run("review.js", replier([
     ["review:", { verdict: "SHIP", findings: [finding()] }], ...BASE_REVIEW,
   ]));
   check("SHIP + HIGH findings ⇒ verdict still SHIP", result.verdict === "SHIP");
-  check("SHIP + HIGH findings ⇒ next routes to /fix, not /ship",
-    String(result.next).startsWith("/fix"), result.next);
+  check("SHIP + HIGH findings ⇒ next routes to /cohorte-fix, not /cohorte-ship",
+    String(result.next).startsWith("/cohorte-fix"), result.next);
 }
 {
   const { result } = await run("review.js", replier([
     ["review:", { verdict: "SHIP", findings: [finding({ severity: "LOW" })] }], ...BASE_REVIEW,
   ]));
-  check("SHIP + only LOW ⇒ next is /ship", String(result.next).startsWith("/ship"), result.next);
+  check("SHIP + only LOW ⇒ next is /cohorte-ship", String(result.next).startsWith("/cohorte-ship"), result.next);
 }
 {
   // Deferred findings are real but out of the feature's scope: they must be
@@ -163,8 +163,8 @@ console.log("review.js");
     return replier(BASE_REVIEW)(prompt, opts);
   });
   check("deferred-only ⇒ verdict still SHIP", result.verdict === "SHIP", `got ${result.verdict}`);
-  check("deferred-only ⇒ next is /ship (not a fix loop)",
-    String(result.next).startsWith("/ship"), result.next);
+  check("deferred-only ⇒ next is /cohorte-ship (not a fix loop)",
+    String(result.next).startsWith("/cohorte-ship"), result.next);
   check("deferred are counted (both surfaces)", result.deferred === 2, `got ${result.deferred}`);
   check("deferred stay out of the severity counts",
     Object.values(result.counts).every(n => n === 0), JSON.stringify(result.counts));

package/scripts/validate-core.mjs

@@ -22,27 +22,28 @@ const frontmatter = (text) => {
 // Mechanical commands must pin model: sonnet (otherwise the lead's
 // orchestration turn silently bills at the session model — Opus/Fable).
 // Interactive commands must stay unpinned (they inherit on purpose).
-const PINNED = ["build", "review", "fix", "ship", "audit",
-  "refactor", "doctor", "align-ds", "update-pipeline", "drive"];
-const UNPINNED = ["brainstorm", "spec", "init-pipeline"];
+const PINNED = ["cohorte-build", "cohorte-review", "cohorte-fix", "cohorte-ship",
+  "cohorte-audit", "cohorte-refactor", "cohorte-doctor", "cohorte-align-ds",
+  "cohorte-update-pipeline", "cohorte-loop"];
+const UNPINNED = ["cohorte-brainstorm", "cohorte-spec", "cohorte-init-pipeline"];
 
-// Names Claude Code itself claims. A core command that collides is not overridden —
-// it is SHADOWED: the built-in answers the slash, our command file is never read, and
-// the session confidently reports on a run that never happened. That is what `/loop`
-// did (Claude Code's own `/loop` runs a prompt on an interval), invisible until a user
-// noticed the driver had never started. `/loop` is here so the 1.6.0 rename to
-// `/drive` can never be quietly reverted.
-// Watchlist, not yet enforced because the collision is unproven: `doctor` (Claude Code
-// has its own `/doctor`) — if a typed `/doctor` ever stops reaching the pipeline's, add
-// it here and rename.
-const RESERVED = ["loop", "clear", "compact", "cost", "help", "config",
-  "init", "run", "schedule", "simplify", "review-pr"];
+// Every command must carry the `cohorte-` prefix. This replaces the old RESERVED
+// blocklist, which chased collisions one name at a time and always lagged: a command
+// that collides with a Claude Code built-in is not overridden, it is SHADOWED — the
+// built-in answers the slash, our file is never read, and the session confidently
+// reports on a run that never happened. `/loop` did exactly that (Claude Code's own
+// `/loop` runs a prompt on an interval) and went unnoticed until a user found the
+// driver had never started; `/doctor` sat on a watchlist waiting to do the same.
+// A blocklist can only forbid the collisions we already know about. The prefix makes
+// the whole class unreachable, so this check is structural, not a list to maintain.
+const PREFIX = "cohorte-";
 
 for (const f of readdirSync(join(root, "core/commands"))) {
   const path = `core/commands/${f}`;
-  if (RESERVED.includes(f.replace(/\.md$/, "")))
-    fail(path, `command name collides with a Claude Code built-in — it would be SHADOWED ` +
-      `(the built-in answers the slash and this file is never read); rename it`);
+  if (!f.startsWith(PREFIX))
+    fail(path, `command name lacks the \`${PREFIX}\` prefix — an unprefixed command can be ` +
+      `SHADOWED by a Claude Code built-in of the same name (the built-in answers the slash ` +
+      `and this file is never read); rename it to ${PREFIX}${f}`);
   const fm = frontmatter(read(path));
   if (!fm) { fail(path, "missing or malformed YAML frontmatter"); continue; }
   if (!/^description:\s*\S/m.test(fm)) fail(path, "frontmatter lacks a description");
@@ -130,16 +131,20 @@ if (!existsSync(steps) || readdirSync(steps).length === 0)
 
 // ── telemetry coverage ──────────────────────────────────────────────────────
 // The funnel is only readable if every one of its stages pings — a single missing
-// one silently truncates it (that is how /review and /fix went unreported
+// one silently truncates it (that is how /cohorte-review and /cohorte-fix went unreported
 // until 1.2.3). The phase list here must match SCHEMA.md §Telemetry's table.
+// These are telemetry PHASE names, not command names — they stay unprefixed even though
+// the commands that emit them are now `/cohorte-*`. The phase is a wire field allowlisted
+// in telemetry-send.sh and keyed on by the collector's existing dataset; prefixing it would
+// orphan every ping ever sent. Command file = PREFIX + phase.
 const FUNNEL = ["brainstorm", "spec", "build", "review", "fix", "ship"];
 for (const c of FUNNEL)
-  if (!/usage ping/i.test(read(`core/commands/${c}.md`)))
-    fail(`core/commands/${c}.md`, "funnel command with no usage ping — breaks the telemetry funnel");
+  if (!/usage ping/i.test(read(`core/commands/${PREFIX}${c}.md`)))
+    fail(`core/commands/${PREFIX}${c}.md`, "funnel command with no usage ping — breaks the telemetry funnel");
 // …and nothing outside the funnel may ping (consent text scopes it to the funnel).
 for (const f of readdirSync(join(root, "core/commands"))) {
-  const c = f.replace(/\.md$/, "");
-  // `telemetry-send.sh` + an argument = a call site; the bare filename (e.g. /doctor
+  const c = f.replace(/\.md$/, "").replace(new RegExp(`^${PREFIX}`), "");
+  // `telemetry-send.sh` + an argument = a call site; the bare filename (e.g. /cohorte-doctor
   // listing the scripts it checks for) is a mention, not a ping.
   if (!FUNNEL.includes(c) && /telemetry-send\.sh +\S|usage ping/i.test(read(`core/commands/${f}`)))
     fail(`core/commands/${f}`, "non-funnel command pings telemetry — outside the consented scope");
@@ -154,7 +159,7 @@ for (const f of readdirSync(join(root, "core/commands"))) {
 // scratch HOME and asserts the same postconditions instead. Both are needed: this
 // check catches a forgotten name, that one catches a drifted rule.
 // A `<name>.sh` with a `<name>.sh.template` sibling is a locally-rendered artifact
-// (this repo dogfoods its own /init-pipeline), not a core asset — skip those.
+// (this repo dogfoods its own /cohorte-init-pipeline), not a core asset — skip those.
 const installers = { "install.sh": read("install.sh"), "install.ps1": read("install.ps1") };
 const shipped = readdirSync(join(root, "scripts"));
 for (const f of shipped.filter((f) => f.endsWith(".sh") && !shipped.includes(`${f}.template`)))
@@ -218,6 +223,23 @@ for (const f of workflowNames) {
     fail("dashboard/server/doctor.js", `checkWorkflows() does not list ${f}`);
 }
 
+// ── every test suite must run in BOTH workflows ──────────────────────────────
+// publish.yml re-runs the test suites under the comment "same gate as CI", because
+// it has no dependency on the CI workflow's conclusion — a merge whose CI failed
+// would otherwise still ship to npm. That only holds if the two lists agree, and
+// they drift the moment a suite is added to one: test-loop.mjs landed in ci.yml and
+// publish.yml kept publishing without it. Neither list is the source of truth —
+// the directory is.
+const ciYml = existsSync(join(root, ".github/workflows/ci.yml")) ? read(".github/workflows/ci.yml") : "";
+const publishYml = existsSync(join(root, ".github/workflows/publish.yml"))
+  ? read(".github/workflows/publish.yml") : "";
+for (const f of readdirSync(join(root, "scripts")).filter((f) => /^test-.*\.mjs$/.test(f))) {
+  if (ciYml && !ciYml.includes(`scripts/${f}`))
+    fail(".github/workflows/ci.yml", `never runs scripts/${f} — a suite CI does not run is a suite that does not exist`);
+  if (publishYml && !publishYml.includes(`scripts/${f}`))
+    fail(".github/workflows/publish.yml", `never runs scripts/${f} — publish would ship past a failure that gate is meant to catch`);
+}
+
 // ── dashboard: the metrics phase list is duplicated server/client ────────────
 // A phase present in one and not the other parses fine and renders in no column —
 // silently invisible data, which is how a phase batch once went unnoticed.

package/core/commands/drive.md

@@ -1,80 +0,0 @@
----
-model: sonnet
-description: Autonomous /build → /review → /fix → /review loop for one feature, until no blocking finding remains.
-argument-hint: <feature_id> [--max=N] [--no-build] [--rebuild] [--resume]
-allowed-tools: Bash(bash ~/.claude/pipeline/scripts/loop.sh:*), Bash(bash .claude/pipeline/scripts/loop.sh:*), Bash(test:*), Read(specs/reports/**)
-disable-model-invocation: true
----
-
-You are the **launcher**, not the loop. Run the driver for **$ARGUMENTS** and relay three lines.
-
-> **This command was `/drive` until 1.6.0.** Claude Code ships its own built-in `/drive` (run a prompt on
-> a recurring interval), which **shadowed** this one: typing `/drive <id>` started the interval runner
-> with the feature id as its prompt, so the driver below never ran and the session reported a loop that
-> did not exist. The shipped script keeps its `loop.sh` name — nothing about a user's install path
-> changes, only what you type.
->
-> This command exists because a slash command cannot `/clear` itself. Every phase of the loop runs
-> as a **separate `claude -p` child session** with its own fresh context, driven by a bash script —
-> so the diff, the N review reports and the N contracts never accumulate in YOUR history, which is
-> re-sent at input price on every turn. Running the loop conversationally here would cost more than
-> the loop saves.
-
-## 1. Launch
-
-Probe the core, then run the script — ONE Bash call, and let it run to completion:
-
-```
-test -f .claude/pipeline/scripts/loop.sh \
-  && bash .claude/pipeline/scripts/loop.sh $ARGUMENTS \
-  || bash ~/.claude/pipeline/scripts/loop.sh $ARGUMENTS
-```
-
-Pass `$ARGUMENTS` through untouched — the script owns its own flag parsing (`--max=N`,
-`--no-build`, `--rebuild`, `--resume`) and exits 64 on anything it doesn't know. Don't validate flags
-yourself, don't rewrite them, don't add any.
-
-**Resume is the human's call, not yours.** The loop records its position in the spec's front-matter
-(`status: in-progress` · `loop_pass` · `loop_phase` — SCHEMA.md §Spec status), so a run killed by a
-dead session, a ceiling or a `blocked` exit can continue with `--resume` instead of re-paying the
-passes it already made. If the human types `/drive <id>` on a spec whose front-matter says
-`status: in-progress` or `blocked` with `loop_pass` > 1, say so in one line and ask whether to resume
-or restart — never silently add the flag, and never silently restart from pass 1.
-
-**Never read `specs/reports/<id>.loop.log`.** It holds the full transcript of every child session —
-the entire diff, every review report, every fix handoff. Pulling it into this session re-imports
-exactly the context the loop was built to keep out, and it is the one mistake that turns this
-command into the most expensive one in the pipeline. Point the human at the path instead; they can
-open it in an editor for free. The same goes for the per-surface `.diff` and `.preflight.txt` files.
-
-## 2. Report — three lines, from the exit code
-
-The script prints one line per phase and one closing line; that is your raw material. For exit
-**1** or **3** only, also Read `specs/reports/<id>.verdict.json` (small, structured, safe) to name
-the remaining findings — never the markdown report, which is the findings body in full. For exit
-**4**, Read `specs/reports/<id>.readiness.json` instead (also small) and relay its `gaps`. On any
-other exit the closing line already carries the deferred count, so read nothing.
-
-| exit | meaning | what to say |
-| ---- | ------- | ----------- |
-| `0` | clean | no blocking findings left; the human can `/ship <id>` |
-| `1` | ceiling hit | the fix was progressing but ran out of passes ⇒ re-run with a higher `--max` |
-| `2` | no usable verdict | `/review` produced nothing, or aborted on a red preflight — the closing line says which; point at `specs/reports/<id>.preflight.txt` |
-| `3` | non-convergent | the same blocking findings survived a fix pass; a higher `--max` will NOT help — the human needs to look at them (list them from the verdict) |
-| `4` | not implementable | `/build`'s readiness gate returned `NOT-READY` — the frozen spec cannot be built and **no agent ran**; Read `specs/reports/<id>.readiness.json` (small, structured) and relay its `gaps`, then point at `/spec <id>`. More passes cannot fix this |
-| `64` | usage | relay the script's own message verbatim |
-
-Then print exactly three lines and nothing else — plus a fourth **only when the verdict carries
-`deferred` > 0** (findings that were real but out of this feature's scope, parked in the backlog by
-`/review` §3.5; they are not blocking and never cost a pass, but they are not nothing either):
-
-```
-outcome:    <one clause — clean / ceiling / no verdict / non-convergent / not implementable / usage>
-iterations: <n> review pass(es)<, m fix pass(es) committed>
-remaining:  <blocking count + one short phrase per blocking item, or "none">
-deferred:   <n> parked in specs/refactor-backlog.md — /refactor <domain> when you want them
-```
-
-Add at most one follow-up sentence: the next command to run. Never restate a finding's fix, never
-summarize the log, never open the diff. Each fix pass is already committed
-(`loop(<id>): fix pass <i>`) — say so on a non-zero exit, since those commits are the way back.