cohorte 1.6.0 → 2.0.1

package/core/commands/{brainstorm.md → cohorte-brainstorm.md}

@@ -15,7 +15,7 @@ at Finish, when a board is configured.
 > decision. The panel argues about the idea, not about settled ground: a persona that proposes
 > something a live line already decided must be told so by another persona, and an idea that genuinely
 > needs to overturn one must say which line, out loud, so the human decides it here rather than
-> discovering the contradiction at `/spec`.
+> discovering the contradiction at `/cohorte-spec`.
 >
 > Template paths below (`.claude/templates/…`) resolve to `~/.claude/templates/…` when the core is
 > installed globally — read whichever exists.
@@ -47,8 +47,8 @@ screens, risks, and what's explicitly out.
 
 When the human is satisfied, produce the **brainstorm return** by filling
 `.claude/templates/brainstorm-return.md` and **staging it to
-`specs/reports/<feature_id>-brainstorm.md`** (the gitignored buffer dir — `/spec` reads it from there
-when invoked with no paste). In chat print only a 3-line summary + the path. Tell them to run `/spec`
+`specs/reports/<feature_id>-brainstorm.md`** (the gitignored buffer dir — `/cohorte-spec` reads it from there
+when invoked with no paste). In chat print only a 3-line summary + the path. Tell them to run `/cohorte-spec`
 — **recommend a `/clear` first**, the return is staged on disk (pasting it remains a fallback).
 
 **Kanban:** settle the `feature_id` (kebab-case slug) the return carries — it is the card's join key
@@ -56,7 +56,7 @@ downstream. If a board is configured, **move** the card into the **Brainstorm**
 `#<feature_id>` (per §Kanban): the picked Ideas card if the human chose one, else a new card. No-op if
 no board.
 
-**Telemetry:** chain the opt-in usage ping onto that same Bash call — `/build` §4's shared form,
+**Telemetry:** chain the opt-in usage ping onto that same Bash call — `/cohorte-build` §4's shared form,
 `<phase>` = `brainstorm`, `<seconds>` = `0` (this phase is human thinking time, not pipeline
 wall-clock — the funnel signal is the event, not its duration), `<results>` = `""`. No board ⇒ still
 ping, in its own `|| true` call. Silent no-op without consent; never ask about consent here.

package/core/commands/{build.md → cohorte-build.md}

@@ -17,16 +17,16 @@ You are the **lead**. Build feature **$ARGUMENTS** from its frozen spec.
 
 - Check the spec front-matter FIRST — `grep '^status:' specs/$ARGUMENTS.md` (or Read with a ~15-line
   limit) — before any full read. Buildable statuses are `frozen`, `in-review` and `in-progress` (the
-  last one means a `/drive` is or was driving this spec — SCHEMA.md §Spec status). `blocked` means a
-  loop gave up here: say so, and route by the spec's `## Remediation` — open items ⇒ `/fix`, none ⇒
+  last one means a `/cohorte-loop` is or was driving this spec — SCHEMA.md §Spec status). `blocked` means a
+  loop gave up here: say so, and route by the spec's `## Remediation` — open items ⇒ `/cohorte-fix`, none ⇒
   continue this build. Anything else (`draft`, missing, `shipped`) ⇒ stop and tell the human to run
-  `/spec` first. Only then read the body, selectively: front-matter, §5 contract, the surface
+  `/cohorte-spec` first. Only then read the body, selectively: front-matter, §5 contract, the surface
   task sections, and `## Remediation` (fall back to a full read if the spec doesn't follow the
   template's headings).
 - **Route check** — if `## Remediation` has open `- [ ]` items and none requires a contract change,
-  stop and tell the human to run `/fix $ARGUMENTS` instead: it re-dispatches only the surfaces with
+  stop and tell the human to run `/cohorte-fix $ARGUMENTS` instead: it re-dispatches only the surfaces with
   findings. A full build with open items is only right when the contract change ripples into clean
-  surfaces (the case `/fix` §1 falls back here for).
+  surfaces (the case `/cohorte-fix` §1 falls back here for).
 - **Design gate** — only if `design.enabled` and the feature has UI (some surface `uses_design`): if the
   spec front-matter `design_files` is empty, ask the human for the feature's design **links** and store
   them in `design_files`, then continue. Each entry is a full self-contained link of the form
@@ -56,7 +56,7 @@ For each surface to add: infer its `key`, `path`, `label`, `agent`, `tools`, `mo
 SCHEMA.md §"Rendering / reconciling a surface agent" — write the `surfaces[]` entry + §Conventions/§Testing
 stanza into `PIPELINE.md`, render `.claude/agents/<agent>.md` from the implementer template, applying the
 shared-code rule (shared trees get a single-owner surface; cross-slice shapes go through the contract).
-This is the automatic path: you don't send the human back to `/init-pipeline`. If nothing new is needed,
+This is the automatic path: you don't send the human back to `/cohorte-init-pipeline`. If nothing new is needed,
 say so and continue. Dispatch (§3) then covers the reconciled surface list.
 
 **Adding or splitting a surface is an architectural decision** — append ONE line for it to
@@ -70,7 +70,7 @@ One `>>` in the Bash call you're already making. Nothing added ⇒ nothing to ap
 **Zero extra agents: you already hold the spec, the profile and the reconciled surface list.** The
 whole point is that a bancal spec costs one verdict here instead of N implementers discovering it in
 parallel. Judge the frozen contract on **implementability only** — never on whether the feature is a
-good idea (that was `/brainstorm`), never by re-reading files you don't already need:
+good idea (that was `/cohorte-brainstorm`), never by re-reading files you don't already need:
 
 1. **Contract completeness** (§5) — every endpoint/interface has method+path (or signature), auth,
    request fields with types + validation, the success shape, and its error cases. A missing
@@ -89,8 +89,8 @@ good idea (that was `/brainstorm`), never by re-reading files you don't already
    (this is §1's gate restated as a verdict, so an automated driver sees the same fact).
 
 Write the machine-readable verdict to `specs/reports/$ARGUMENTS.readiness.json` (overwrite,
-`mkdir -p specs/reports` first — the same gitignored buffer dir `/review` stages into, which may not
-exist yet on a first build) — on **every** build, including `READY`. It is the only channel between this gate and a driver (`/drive`),
+`mkdir -p specs/reports` first — the same gitignored buffer dir `/cohorte-review` stages into, which may not
+exist yet on a first build) — on **every** build, including `READY`. It is the only channel between this gate and a driver (`/cohorte-loop`),
 which parses no prose:
 
 ```json
@@ -104,7 +104,7 @@ which parses no prose:
   surface key or dependency name (no `:line` — it shifts on every edit); `<what>` is the gap, not the
   fix. `READY` ⇒ `[]`.
 - **`NOT-READY` ⇒ STOP: author no contract and spawn NO agent.** Print the gaps and send the human to
-  `/spec $ARGUMENTS` to patch the contract, then re-run `/build`. This abort is the whole point of the
+  `/cohorte-spec $ARGUMENTS` to patch the contract, then re-run `/cohorte-build`. This abort is the whole point of the
   step — a spec that cannot be built does not get cheaper by being built N times in parallel.
 - **`RESERVATIONS` ⇒ continue.** It never blocks (a gate that stalls a sound build on a missing error
   case would cost more human round-trips than it saves): inline each gap verbatim into the dispatch of
@@ -188,12 +188,12 @@ Bash call, chain the opt-in usage ping — **the shared form every phase command
 `<core>/pipeline/scripts/telemetry-send.sh <phase> "$ARGUMENTS" <seconds> "<results>" || true`
 (`<core>` = `~/.claude` global / `.claude` bundled; here `<phase>` = `build`, `<results>` =
 `<ok,ok|error,…>`) — a silent no-op unless the human explicitly consented (SCHEMA.md §Telemetry);
-never ask about consent here. `/review` and `/fix` chain the same line with their own
+never ask about consent here. `/cohorte-review` and `/cohorte-fix` chain the same line with their own
 phase + results. The `|| true` swallows a **missing** script too, so a half-copied core goes
-silent rather than loud — `/doctor` check 1 is what catches that.
-Then tell the human: exercise the feature by hand if it's worth it, then run `/review $ARGUMENTS` —
-unless a surface is dead, in which case say so first and let them decide whether to re-run `/build`
-(a dead surface has no findings, so `/fix` has nothing to re-dispatch).
+silent rather than loud — `/cohorte-doctor` check 1 is what catches that.
+Then tell the human: exercise the feature by hand if it's worth it, then run `/cohorte-review $ARGUMENTS` —
+unless a surface is dead, in which case say so first and let them decide whether to re-run `/cohorte-build`
+(a dead surface has no findings, so `/cohorte-fix` has nothing to re-dispatch).
 Do not run the app or migrations yourself here — building is not running.
 **Recommend a `/clear` now** — the spec, contract and diff are all on
 disk, and the lead's history is re-sent at input price on every turn it survives.

package/core/commands/{doctor.md → cohorte-doctor.md}

@@ -16,13 +16,16 @@ fix only with the human's go-ahead (or hand them the command).
    `.claude/pipeline/VERSION` bundled); `.claude/pipeline.json` names a mode + `core_version`
    coherent with the VERSION file. A **global**-mode pointer lagging the VERSION file is ⚠️, not ❌:
    nothing bumped that field before 1.2.5, so the core itself is fine and only the pointer is stale
-   ⇒ fix by running `/update-pipeline` (§3 syncs it now), or by editing the one field. Compare
-   against `npm view cohorte version` — behind ⇒ suggest `/update-pipeline`. Read `pipeline/CHANGELOG.md` for what they're missing. The router
+   ⇒ fix by running `/cohorte-update-pipeline` (§3 syncs it now), or by editing the one field. Compare
+   against `npm view cohorte version` — behind ⇒ suggest `/cohorte-update-pipeline`. Read `pipeline/CHANGELOG.md` for what they're missing. The router
    commands' step files are present — `templates/steps/init-pipeline/` non-empty (a router whose
    `templates/steps/<cmd>/` dir is missing is a partial/stale install ⇒
    re-run install/update). **Shipped scripts present and executable** in `<core>/pipeline/scripts/`:
-   `kanban-move.sh`, `telemetry-send.sh`, `preflight.sh`, `loop.sh`, `new-feature.sh.template`,
-   `remove-feature.sh.template` — ❌ any missing one. Every caller chains these with `|| true`, so an absent script is a **silent**
+   `kanban-move.sh`, `telemetry-send.sh`, `preflight.sh`, `loop.sh`, `loop-detach.sh`,
+   `new-feature.sh.template`, `remove-feature.sh.template` — ❌ any missing one.
+   `loop-detach.sh` absent is what silently turns `/cohorte-loop` back into a foreground run
+   that dies at the 600 s tool ceiling, so name it explicitly rather than folding it into
+   "some script is missing". Every caller chains these with `|| true`, so an absent script is a **silent**
    no-op (no kanban card moves, no telemetry ping, no error anywhere) — this check is the only thing
    that sees it. Also flag ❌ a `VERSION` **newer than** the other `pipeline/` files (compare mtimes):
    a version bumped without a full re-copy is a half-done update ⇒ re-run install/update.
@@ -47,6 +50,11 @@ fix only with the human's go-ahead (or hand them the command).
    it double-prompts) **with a matcher covering both `Bash` and `Task`** — a `Bash`-only matcher
    leaves the preflight phase gate dead (the 1.3.0–1.3.1 regression). Hook files exist at the
    registered paths.
+   Then the **preflight stamp is local, never versioned**: `git ls-files --error-unmatch
+   .claude/preflight.ok` must miss, and `.gitignore` must cover it. A tracked stamp is a ❌ (not a
+   ⚠️) — it records the tree it verified, the commit that carries it moves HEAD past that tree, and
+   the committed copy lands in every clone and new worktree; the gate then blocks clean trees and
+   greens unchecked ones. fix: `git rm --cached .claude/preflight.ok` + add it to `.gitignore`.
 4. **Retrieval** (if `retrieval.provider` ≠ `none`). Run the SCHEMA.md §Code retrieval health
    check: CLI resolvable from PATH, `.mcp.json` entry present in PATH-proof launcher form,
    `.serena/` gitignored, server actually connects.
@@ -67,7 +75,7 @@ fix only with the human's go-ahead (or hand them the command).
    (the install_id is the human's GDPR erasure key — see SCHEMA.md §Telemetry). Flag ❌ any
    incoherent state: `enabled: true` with no `install_id` or no `consent_date` (sending without
    recorded consent — fix: set `enabled: false` until the consent question is re-run), or a
-   `telemetry:` block missing entirely on a current core (top up via `/update-pipeline`).
+   `telemetry:` block missing entirely on a current core (top up via `/cohorte-update-pipeline`).
 8. **Workflows** (the opt-in execution path — SCHEMA.md §Workflows; the conversational commands
    stay the default, so failures here are ⚠️ at most, never ❌). Report which path this machine will
    take and why:
@@ -86,14 +94,14 @@ fix only with the human's go-ahead (or hand them the command).
    `workflows: unavailable (<first failing prerequisite>) — conversational commands (the default)`.
 9. **Specs & metrics.** Every `specs/*.md` front-matter `status` is a valid stage — one of
    `draft · frozen · in-progress · in-review · shipped · blocked` (SCHEMA.md §Spec status; the last two
-   are written by the `/drive` driver, so flagging them would report the pipeline's own state as a
+   are written by the `/cohorte-loop` driver, so flagging them would report the pipeline's own state as a
    defect) — excluding
    `_`-prefixed files (the spec template and `specs/_decisions.md`, the decision journal) and
-   `specs/refactor-backlog.md`, which `/audit` writes as a backlog, not a
+   `specs/refactor-backlog.md`, which `/cohorte-audit` writes as a backlog, not a
    spec, and which has no front-matter to check. A spec left `in-progress`/`blocked` with
-   `loop_pass` > 0 is a loop that never finished ⇒ say so and name `/drive <id> --resume`. `shipped` specs
+   `loop_pass` > 0 is a loop that never finished ⇒ say so and name `/cohorte-loop <id> --resume`. `shipped` specs
    with a live worktree flagged (see 6). `.claude/pipeline-metrics.jsonl` and `specs/reports/` (the
-   `/review` report buffer that lets a `/fix` survive a `/clear`) are gitignored. Metrics
+   `/cohorte-review` report buffer that lets a `/cohorte-fix` survive a `/clear`) are gitignored. Metrics
    belong to the **main checkout** — a `pipeline-metrics.jsonl` inside a live feature worktree is a
    stale-core sign (its lines die at teardown) ⇒ suggest appending its lines to the main checkout's
    file and deleting the stray.

package/core/commands/{fix.md → cohorte-fix.md}

@@ -5,29 +5,29 @@ argument-hint: <feature_id> [paste REVIEW REPORT]
 ---
 
 You are the **lead**. Run the fix loop for feature **$ARGUMENTS** — the scoped, cheap path after a
-`REVISE`/`BLOCK` verdict. The full `/spec` (Mode B) + `/build` path still exists for review returns
-that change the *contract*; `/fix` is for everything else.
+`REVISE`/`BLOCK` verdict. The full `/cohorte-spec` (Mode B) + `/cohorte-build` path still exists for review returns
+that change the *contract*; `/cohorte-fix` is for everything else.
 
 > Read `PIPELINE.md` §`pipeline-profile` first: `surfaces` (paths + agent names) and `contract`.
 > _Skip the re-read if it's already in your context this session and unmodified since._
 >
 > **Kanban** (SCHEMA.md §Kanban): move card `#$ARGUMENTS` → **Fix** on ingest (it returns to **Review**
-> when `/review` re-runs). No-op silently if no board.
+> when `/cohorte-review` re-runs). No-op silently if no board.
 
 ## 1. Ingest the report
 
 - The report is either pasted after the feature id (a REVIEW REPORT, or failures the human hit by
-  hand), this session's last `/review` REVIEW REPORT, or — if the context was cleared — read from
-  `specs/reports/<id>.md`, where `/review` stages its last report for exactly this reason.
+  hand), this session's last `/cohorte-review` REVIEW REPORT, or — if the context was cleared — read from
+  `specs/reports/<id>.md`, where `/cohorte-review` stages its last report for exactly this reason.
   If you have none of these, ask for it and wait.
-- Append each finding to `specs/<id>.md` **`## Remediation`** (same format as `/spec` Mode B, under a
+- Append each finding to `specs/<id>.md` **`## Remediation`** (same format as `/cohorte-spec` Mode B, under a
   dated/numbered subheading): `- [ ] <severity> · <file:line> · <type> · <concrete fix>`. Set
   `status: in-review`. Don't pull the whole spec into context for this: grep the line numbers of the
   front-matter `status:` and the `## Remediation` heading, then Read only those regions (offset/limit)
   before editing.
 - **Contract check:** if any finding implies the frozen contract must change, update spec §5 and
-  re-author the contract file yourself now (lead-only, per `/build` §2) — agents never edit it. If
-  the contract change ripples into surfaces *without* findings, fall back to full `/build` instead
+  re-author the contract file yourself now (lead-only, per `/cohorte-build` §2) — agents never edit it. If
+  the contract change ripples into surfaces *without* findings, fall back to full `/cohorte-build` instead
   and say so.
 - **Note the epoch** (`date +%s`) in the first Bash call you make here — §3's metrics line and usage
   ping both carry `seconds`, and there is no separate timing call.
@@ -39,7 +39,7 @@ that change the *contract*; `/fix` is for everything else.
   re-dispatch them. Items outside every surface path (contract file, root config) are yours or go
   to the most relevant surface — say which.
 - Re-dispatch **ONLY the surfaces owning ≥1 item**, in parallel, in a **single message** — the exact
-  dispatch template from `/build` §3 (one byte-stable template for builds and fix loops; you do NOT
+  dispatch template from `/cohorte-build` §3 (one byte-stable template for builds and fix loops; you do NOT
   paste a diff — the agent computes its own, scoped to its tree). Fill the template's final variable
   slot with that surface's open `- [ ]` item lines **verbatim**, so the agent needs no spec re-read to
   find its work; fill the design slot with `none` when a `uses_design` surface's open items are all
@@ -59,7 +59,7 @@ When the agents return:
   (by `file:line`). For every Remediation item an agent reports fixed, flip its `- [ ]` → `- [x]` in
   `specs/<id>.md` and append a terse ` — fixed: <what/where>` note (the convention prior rounds already
   use). Leave genuinely-unaddressed items `- [ ]` so the next loop still sees them. This keeps the
-  checkbox state honest and stops a later `/fix` from re-dispatching already-fixed items (§2). Ticking
+  checkbox state honest and stops a later `/cohorte-fix` from re-dispatching already-fixed items (§2). Ticking
   here is the lead's job — surface agents own only their tree, never the spec.
 - **Collapse fully-resolved rounds (keep the spec bounded).** When a whole dated Remediation round is now
   entirely `- [x]`, replace its item lines with a single summary line (`- <date> — <N> findings, all
@@ -67,10 +67,12 @@ When the agents return:
   re-reads each loop. Keep any round with ≥1 still-open `- [ ]` item fully expanded (§2's skip logic
   needs those checkboxes).
 - Print one status line per surface (`<key> · items fixed <n>/<m> · tests pass/fail`) — do not restate
-  handoff content — and append ONE metrics line for the batch to `pipeline-metrics.jsonl`
-  (see `/build` §4, `phase: "fix"`), chaining the opt-in usage ping in the same Bash call
+  handoff content — and append ONE metrics line for the batch to the **main checkout's**
+  `$(dirname "$(git rev-parse --git-common-dir)")/.claude/pipeline-metrics.jsonl` (never a bare
+  relative path: from a feature worktree that writes a stray sink whose lines die at teardown)
+  (rules in `/cohorte-build` §4, `phase: "fix"`), chaining the opt-in usage ping in the same Bash call
   (results = items fixed over items found across surfaces, e.g. `"5/6"`).
-- Tell the human: re-test by hand if the failures were runtime ones, and `/review $ARGUMENTS` for the
+- Tell the human: re-test by hand if the failures were runtime ones, and `/cohorte-review $ARGUMENTS` for the
   re-verdict — the re-review is what *verifies* the ticked items actually hold (a regression simply
   reappears as a new finding in the next round). **Recommend a `/clear`** — all state (spec,
   checkboxes, staged report) is on disk, and the lead's history is re-sent at input price every turn.

package/core/commands/{init-pipeline.md → cohorte-init-pipeline.md}

@@ -1,6 +1,6 @@
 ---
 description: Detect this project's stack, interview the gaps, and generate PIPELINE.md + render the agents so the portable pipeline fits this repo.
-argument-hint: (none) — one-time per project; afterwards /update-pipeline keeps everything current
+argument-hint: (none) — one-time per project; afterwards /cohorte-update-pipeline keeps everything current
 ---
 
 You are the **pipeline installer**. Your job: turn the generic pipeline into one tailored to **this**

package/core/commands/cohorte-loop.md

@@ -0,0 +1,110 @@
+---
+model: sonnet
+description: Autonomous /cohorte-build → /cohorte-review → /cohorte-fix → /cohorte-review loop for one feature, until no blocking finding remains.
+argument-hint: <feature_id> [--max=N] [--no-build] [--rebuild] [--resume]
+allowed-tools: Bash(bash ~/.claude/pipeline/scripts/loop-detach.sh:*), Bash(bash .claude/pipeline/scripts/loop-detach.sh:*), Bash(test:*), Read(specs/reports/**)
+disable-model-invocation: true
+---
+
+You are the **launcher**, not the loop. Run the driver for **$ARGUMENTS** and relay three lines.
+
+> **The driver's name has moved twice.** It was `/loop`, which Claude Code's own built-in `/loop`
+> (run a prompt on a recurring interval) silently **shadowed** — typing `/loop <id>` started the
+> interval runner with the feature id as its prompt, so the driver never ran and the session
+> reported a loop that did not exist. 1.6.0 renamed it `/drive` to escape that. 2.0.0 prefixed
+> every command with `cohorte-`, which makes shadowing impossible by construction, so the accurate
+> name is back: **`/cohorte-loop`**. The shipped script keeps its `loop.sh` name throughout.
+>
+> This command exists because a slash command cannot `/clear` itself. Every phase of the loop runs
+> as a **separate `claude -p` child session** with its own fresh context, driven by a bash script —
+> so the diff, the N review reports and the N contracts never accumulate in YOUR history, which is
+> re-sent at input price on every turn. Running the loop conversationally here would cost more than
+> the loop saves.
+
+## 1. Launch — detached, then poll
+
+The driver runs for **hours**, which rules out running it as one foreground Bash call: a single
+call is capped at 600 s, and a backgrounded one is not detached — the child stays in this session's
+process group, so a Claude Code restart, crash or laptop sleep kills `loop.sh` and every `claude -p`
+child with it, mid-write. `loop-detach.sh` puts the driver in its own `screen` session so it
+survives all of that, and `loop.sh` re-execs itself under `caffeinate` so idle sleep cannot abort
+its in-flight requests either.
+
+Launch — returns immediately:
+
+```
+test -f .claude/pipeline/scripts/loop-detach.sh \
+  && bash .claude/pipeline/scripts/loop-detach.sh start $ARGUMENTS \
+  || bash ~/.claude/pipeline/scripts/loop-detach.sh start $ARGUMENTS
+```
+
+Then poll. Each call blocks up to ~9 min (inside the tool ceiling) and prints the **status file** —
+one line per phase, plus `__EXIT__ <code>` when the run is over:
+
+```
+bash ~/.claude/pipeline/scripts/loop-detach.sh wait <feature_id>
+```
+
+**Repeat `wait` until you see `__EXIT__ <code>`.** A `__RUNNING__` line means the driver is still
+working and nothing is wrong — call `wait` again. Never conclude anything from a `__RUNNING__`;
+the run has not finished and you have no verdict to report. If the human says to stop waiting,
+tell them the run continues detached and how to follow it (`screen -r cohorte-<id>`) — do not
+kill it unless they ask.
+
+Pass `$ARGUMENTS` through untouched — `loop.sh` owns its own flag parsing (`--max=N`,
+`--no-build`, `--rebuild`, `--resume`) and exits 64 on anything it doesn't know. Don't validate flags
+yourself, don't rewrite them, don't add any.
+
+**One lid-close caveat to pass on** if the human is walking away from a laptop: `caffeinate` holds
+off *idle* sleep, but no userspace assertion can prevent lid-close sleep. Lid open, or clamshell
+mode (AC + external display + external input).
+
+**Resume is the human's call, not yours.** The loop records its position in the spec's front-matter
+(`status: in-progress` · `loop_pass` · `loop_phase` — SCHEMA.md §Spec status), so a run killed by a
+dead session, a ceiling or a `blocked` exit can continue with `--resume` instead of re-paying the
+passes it already made. If the human types `/cohorte-loop <id>` on a spec whose front-matter says
+`status: in-progress` or `blocked` with `loop_pass` > 1, say so in one line and ask whether to resume
+or restart — never silently add the flag, and never silently restart from pass 1.
+
+**Never read `specs/reports/<id>.loop.log`.** It holds the full transcript of every child session —
+the entire diff, every review report, every fix handoff. Pulling it into this session re-imports
+exactly the context the loop was built to keep out, and it is the one mistake that turns this
+command into the most expensive one in the pipeline. Point the human at the path instead; they can
+open it in an editor for free. The same goes for the per-surface `.diff` and `.preflight.txt` files.
+
+`<id>.loop.status` is the **other** file and is safe: it is the driver's stdout, one line per phase.
+`wait` already prints it, so you never need to Read it yourself. Two files, one letter apart —
+`.log` is the expensive one.
+
+## 2. Report — three lines, from the exit code
+
+`wait` prints one line per phase, one closing line, and `__EXIT__ <code>`; that is your raw
+material, and that code is the exit code the table below is keyed on. For exit
+**1** or **3** only, also Read `specs/reports/<id>.verdict.json` (small, structured, safe) to name
+the remaining findings — never the markdown report, which is the findings body in full. For exit
+**4**, Read `specs/reports/<id>.readiness.json` instead (also small) and relay its `gaps`. On any
+other exit the closing line already carries the deferred count, so read nothing.
+
+| exit | meaning | what to say |
+| ---- | ------- | ----------- |
+| `0` | clean | no blocking findings left; the human can `/cohorte-ship <id>` |
+| `1` | ceiling hit | the fix was progressing but ran out of passes ⇒ re-run with a higher `--max` |
+| `2` | no usable verdict | `/cohorte-review` produced nothing, or aborted on a red preflight — the closing line says which; point at `specs/reports/<id>.preflight.txt` |
+| `3` | non-convergent | the same blocking findings survived a fix pass; a higher `--max` will NOT help — the human needs to look at them (list them from the verdict) |
+| `4` | not implementable | `/cohorte-build`'s readiness gate returned `NOT-READY` — the frozen spec cannot be built and **no agent ran**; Read `specs/reports/<id>.readiness.json` (small, structured) and relay its `gaps`, then point at `/cohorte-spec <id>`. More passes cannot fix this |
+| `64` | usage | relay the script's own message verbatim |
+
+Then print exactly three lines and nothing else — plus a fourth **only when the verdict carries
+`deferred` > 0** (findings that were real but out of this feature's scope, parked in the backlog by
+`/cohorte-review` §3.5; they are not blocking and never cost a pass, but they are not nothing either):
+
+```
+outcome:    <one clause — clean / ceiling / no verdict / non-convergent / not implementable / usage>
+iterations: <n> review pass(es)<, m fix pass(es) committed>
+remaining:  <blocking count + one short phrase per blocking item, or "none">
+deferred:   <n> parked in specs/refactor-backlog.md — /cohorte-refactor <domain> when you want them
+```
+
+Add at most one follow-up sentence: the next command to run. Never restate a finding's fix, never
+summarize the log, never open the diff. Each fix pass is already committed
+(`loop(<id>): fix pass <i>`) — say so on a non-zero exit, since those commits are the way back.

package/core/commands/{refactor.md → cohorte-refactor.md}

@@ -4,7 +4,7 @@ description: Apply the refactor backlog for one or more domains via the surface
 argument-hint: <domain…> (one or more surface keys, "shared", or "all")
 ---
 
-You are the **lead**. Refactor domain **$ARGUMENTS** to match `PIPELINE.md`, using the `/audit` backlog.
+You are the **lead**. Refactor domain **$ARGUMENTS** to match `PIPELINE.md`, using the `/cohorte-audit` backlog.
 
 > Read `PIPELINE.md` §`surfaces` (map the domain → a surface + its agent + commands) and §`contract`.
 >
@@ -50,7 +50,7 @@ slices import it, so refactor it alone, first.
 After each agent returns: its surface's `test_quiet_cmd`/`lint_quiet_cmd` (else the `tail -40`
 fallback — SCHEMA.md §Output discipline), `commands.typecheck`, `commands.format --check` (redirect
 output to a file and grep it — don't print gate output into your context). Then verify each backlog item cleared by checking its `file:line` directly — do NOT re-run
-`/audit` per round (that repeats the repo-wide gates + a review dispatch you don't need); one optional
-final `/audit` once ALL dispatched domains are clean is enough. Check cleared items off in
+`/cohorte-audit` per round (that repeats the repo-wide gates + a review dispatch you don't need); one optional
+final `/cohorte-audit` once ALL dispatched domains are clean is enough. Check cleared items off in
 `specs/refactor-backlog.md`. Loop until each dispatched domain is clean. Verification is per-domain
 even when the dispatch was parallel — one failing surface loops alone, the others don't redo work.

package/core/commands/{review.md → cohorte-review.md}

@@ -13,7 +13,7 @@ You are the **lead**. Dispatch the review for feature **$ARGUMENTS**.
 >
 > **Workflow variant** (opt-in — SCHEMA.md §Workflows): on Claude Code ≥ 2.1.154 with workflows
 > enabled, the human can ask to "run the review workflow" (`<core>/workflows/review.js`) instead.
-> This conversational path stays the default and the fallback; `/doctor` shows which is available.
+> This conversational path stays the default and the fallback; `/cohorte-doctor` shows which is available.
 
 ## 0. Deterministic pre-flight — no agents while red
 
@@ -27,7 +27,7 @@ with `test -x`); note the epoch (`date +%s`) in the same call — §3's metrics
 ```
 
 - **Non-zero exit** ⇒ the script already printed the raw last-40 lines. **STOP: relay them verbatim
-  and spawn NO agent** — a compiler/test failure needs `/fix` (or the human), not a review that
+  and spawn NO agent** — a compiler/test failure needs `/cohorte-fix` (or the human), not a review that
   rediscovers it at agent prices. This abort is the whole point of the step. Before stopping, write
   the **aborted verdict** (§3's contract, degraded form) so an automated driver gets a diagnosis
   rather than silence:
@@ -58,7 +58,7 @@ with `test -x`); note the epoch (`date +%s`) in the same call — §3's metrics
 ## 2. Dispatch review agents — one per touched surface, IN PARALLEL
 
 Spawn ONE `review` agent per surface that has changed files, in a **single message** (one Task call
-each, like `/build`) so they run concurrently — NEVER serially: review wall-clock must be the
+each, like `/cohorte-build`) so they run concurrently — NEVER serially: review wall-clock must be the
 slowest surface, not the sum. A diff touching a single surface ⇒ a single reviewer.
 
 **Small-diff fast path (re-reviews only):** if a surface's staged diff is tiny (≤2 files and ≤~40
@@ -97,23 +97,24 @@ from no evidence at all (SCHEMA.md §Dead agents). So:
 - **Silent twice ⇒ that surface is `unreviewed`.** Name it in the report under
   `## NOT reviewed (no verdict on these)`, list it in the verdict JSON's `unreviewed`, and **refuse to
   score `SHIP`** — the merged verdict is at least `REVISE`. Absence of evidence is not evidence of
-  absence, and it must never reach `/ship` or tick a DoD box.
+  absence, and it must never reach `/cohorte-ship` or tick a DoD box.
 - **Never re-review the other surfaces** to compensate: their reports are valid and already on disk.
 
 Then merge the returned reports into **one** REVIEW REPORT (same template): findings concatenated and
 re-ordered by severity, counts summed, duplicates collapsed, verdict = the worst returned
 (`BLOCK` > `REVISE` > `SHIP`). The `## Deferred` sections merge the same way (dedupe by
 `file` + problem) and stay **out of the severity table and out of the verdict** — see §3.5, which
-routes them. Append ONE metrics line for the batch to `pipeline-metrics.jsonl`
-(main-checkout path + rules in `/build` §4): `{"ts":"<ISO>","feature":"$ARGUMENTS","phase":"review","seconds":<wall-clock>,"surfaces":{"<key>":"<verdict>:<finding count>",…}}`.
-In the same Bash call, chain the opt-in usage ping (`/build` §4, `phase: "review"`, results = the
+routes them. Append ONE metrics line for the batch to the **main checkout's**
+`$(dirname "$(git rev-parse --git-common-dir)")/.claude/pipeline-metrics.jsonl` (rules in
+`/cohorte-build` §4; never a bare relative path — from a worktree that strands the lines): `{"ts":"<ISO>","feature":"$ARGUMENTS","phase":"review","seconds":<wall-clock>,"surfaces":{"<key>":"<verdict>:<finding count>",…}}`.
+In the same Bash call, chain the opt-in usage ping (`/cohorte-build` §4, `phase: "review"`, results = the
 merged verdict + total finding count, e.g. `"REVISE:3"`).
 **Stage the full report to `specs/reports/$ARGUMENTS.md`** (overwrite) — a gitignored buffer so a
-`/fix` after a `/clear` can still read the findings; the `specs/reports/` subfolder is skipped by the
+`/cohorte-fix` after a `/clear` can still read the findings; the `specs/reports/` subfolder is skipped by the
 non-recursive `specs/*.md` glob, so it's never mistaken for a spec (no phantom card, no bogus stage).
 **Write the machine-readable verdict** to `specs/reports/$ARGUMENTS.verdict.json` (overwrite) — on
 **every** run, including the small-diff fast path of §2 and a `SHIP`. This file is the ONLY contract
-between the pipeline and an automated driver (`/drive`), which parses no prose:
+between the pipeline and an automated driver (`/cohorte-loop`), which parses no prose:
 
 ```json
 { "id": "$ARGUMENTS", "phase": "review", "ts": "<ISO>", "verdict": "REVISE",
@@ -151,17 +152,17 @@ Do this on **every** run, before the verdict branch below, and whatever the verd
 finding that is only routed on a `SHIP` is a deferred finding lost on every other verdict, which is
 exactly the leak this step closes. Append each merged `## Deferred` item to
 **`specs/refactor-backlog.md`**, under the `## <domain>` heading of the surface that owns its
-`file:line` (create the file and/or heading if absent — same grouping `/audit` writes, so
-`/refactor <domain>` picks them up with no extra plumbing):
+`file:line` (create the file and/or heading if absent — same grouping `/cohorte-audit` writes, so
+`/cohorte-refactor <domain>` picks them up with no extra plumbing):
 
 ```
 - [ ] <SEVERITY> · <file:line> · <quality|security|rule> · <concrete fix> · deferred:$ARGUMENTS
 ```
 
-- **Never into the spec's `## Remediation`** — that list is what `/fix` re-dispatches and what `/drive`
+- **Never into the spec's `## Remediation`** — that list is what `/cohorte-fix` re-dispatches and what `/cohorte-loop`
   waits on, so a deferred item there would re-trigger the very loop it was deferred out of.
 - **Dedupe before appending:** `grep -F` the backlog for the item's `<file>` + the first words of its
-  problem; already there (from a prior round or an `/audit`) ⇒ skip it, don't stack duplicates round
+  problem; already there (from a prior round or an `/cohorte-audit`) ⇒ skip it, don't stack duplicates round
   after round.
 - Append with `>>` in ONE Bash call; never read the whole backlog into context to rewrite it (it grows
   with every audit the repo has ever run).
@@ -175,27 +176,27 @@ would sit in this session's history, re-sent every turn). Then:
   verdict *is* the pipeline's statement that the feature meets its Definition of
   Done, so **tick the DoD**: in `specs/$ARGUMENTS.md` §`Acceptance criteria / DoD`, flip each `- [ ]`
   → `- [x]` for the criteria the pipeline has actually verified — spec conformance + `ui_language`
-  copy (this review), tests · lint · typecheck (a green `/build`), mobile-first as far as the code
+  copy (this review), tests · lint · typecheck (a green `/cohorte-build`), mobile-first as far as the code
   shows it (this review). **Leave `- [ ]` (and say which) any item no stage actually verified** —
   nothing in the pipeline *runs* the feature, so any criterion that needs the app up (runtime flows,
   a visual check against the design) stays open unless the human says they exercised it by hand and
   it held. Ticking is the lead's job
-  (the reviewer is read-only). **Then stamp the freshness gate** so `/ship` can refuse to ship code
+  (the reviewer is read-only). **Then stamp the freshness gate** so `/cohorte-ship` can refuse to ship code
   edited after this verdict: compute `BASE=$(git merge-base <default_branch> HEAD)` and write into the
   spec front-matter `reviewed_base: $BASE` plus
   `reviewed_digest: $(git diff $BASE -- . ':(exclude)specs/' | sha256sum | cut -c1-16)` — the fingerprint
   of exactly the source you just reviewed (specs excluded, so DoD ticks + the ship status flip don't
-  trip it). Then tell the human they can `/ship` — **recommend a `/clear` first**, the handoff is
+  trip it). Then tell the human they can `/cohorte-ship` — **recommend a `/clear` first**, the handoff is
   fully on disk. **SHIP with leftover LOW findings** (or LOW+MEDIUM at the human's call) does NOT
   force a fix cycle for nits: park them through §3.5's exact route (the backlog, under their surface's
   domain heading, tagged `deferred:$ARGUMENTS` — never as open `## Remediation` items, which would
   re-trigger the fix loop), keep the SHIP verdict and the freshness stamp, and let the human ship.
 - **REVISE / BLOCK**, or any CRITICAL/HIGH/security finding → tell the human to run
-  **`/fix $ARGUMENTS`** — it appends the report to the spec's `## Remediation` and re-dispatches ONLY
+  **`/cohorte-fix $ARGUMENTS`** — it appends the report to the spec's `## Remediation` and re-dispatches ONLY
   the surfaces with findings. (If they'd rather automate the rounds, the autonomous driver is
   `disable-model-invocation: true` on purpose: **you cannot start it, they must type it**. Name the
   exact line for them to type rather than attempting it — an attempt that silently fails reads as a
-  loop that is running when nothing is.) The full path (`/spec` Mode B then `/build`) remains for findings that
+  loop that is running when nothing is.) The full path (`/cohorte-spec` Mode B then `/cohorte-build`) remains for findings that
   change the contract in ways that ripple into clean surfaces. _The report is staged to
-  `specs/reports/$ARGUMENTS.md`, so you can `/clear` before `/fix` — it reads the findings back from
+  `specs/reports/$ARGUMENTS.md`, so you can `/clear` before `/cohorte-fix` — it reads the findings back from
   disk._

package/core/commands/{ship.md → cohorte-ship.md}

@@ -15,15 +15,15 @@ You are the **lead**. Ship feature **$ARGUMENTS**. This is the outward-facing ga
 
 ## 1. Pre-flight (confirm before doing anything irreversible)
 
-- Confirm the latest `/review` returned **SHIP** (no CRITICAL, no security). If not reviewed, or the
+- Confirm the latest `/cohorte-review` returned **SHIP** (no CRITICAL, no security). If not reviewed, or the
   verdict was REVISE/BLOCK, stop and say so.
 - **Freshness gate** — the reviewed code must be exactly what ships. If the spec front-matter carries
   `reviewed_base` + `reviewed_digest`, recompute
   `git diff <reviewed_base> -- . ':(exclude)specs/' | sha256sum | cut -c1-16` and compare to
   `reviewed_digest`. **Match** ⇒ source unchanged since the SHIP verdict, proceed. **Mismatch** ⇒ source
   (or the contract) was edited after review — the verdict is **stale**: stop and tell the human to re-run
-  `/review $ARGUMENTS` before shipping. Missing fields (spec predates the gate) ⇒ skip, don't block.
-- **DoD gate (verify, don't tick — `/review` owns the ticking).** Read `specs/$ARGUMENTS.md`
+  `/cohorte-review $ARGUMENTS` before shipping. Missing fields (spec predates the gate) ⇒ skip, don't block.
+- **DoD gate (verify, don't tick — `/cohorte-review` owns the ticking).** Read `specs/$ARGUMENTS.md`
   §`Acceptance criteria / DoD`; if any item is still `- [ ]`, list the open ones and ask the human to
   confirm shipping anyway (they may be deferred on purpose — e.g. a UI item on a backend-only feature).
   All `- [x]` ⇒ proceed silently.
@@ -61,7 +61,7 @@ or an offset-limited Read around the match): exactly one card, under the `shippe
 re-read the whole board into context. No board ⇒ skip silently.
 
 **Telemetry — the usage ping that closes the funnel.** Chain it onto the verify call above
-(`/build` §4's shared form, `<phase>` = `ship`, `<seconds>` = `0` — the release agent's duration is
+(`/cohorte-build` §4's shared form, `<phase>` = `ship`, `<seconds>` = `0` — the release agent's duration is
 not the pipeline's, `<results>` = `pr` when a PR was created / `compare` when only a compare URL was
 emitted). Fire it **after** the release agent reports success, never on an aborted ship — a `ship`
 event must mean the feature actually left the pipeline. No board ⇒ still ping, in its own `|| true`
@@ -70,7 +70,7 @@ call. Silent no-op without consent; never ask about consent here.
 ## 5. After the PR — CI gate + teardown
 
 - If `host: github` and `gh` is available, watch the PR's checks (`gh pr checks <url> --watch`) and
-  report the result — the human merges only on green. A red check ⇒ back to `/fix $ARGUMENTS`.
+  report the result — the human merges only on green. A red check ⇒ back to `/cohorte-fix $ARGUMENTS`.
 - Once the human confirms the PR is **merged**: if `isolation.enabled`, propose the teardown —
   `scripts/remove-feature.sh $ARGUMENTS` (add `--drop-db` to also drop the feature db; kept by
   default). It removes the worktree, deletes the merged branch, frees the slot. Never run it before

package/core/commands/{spec.md → cohorte-spec.md}

@@ -25,7 +25,7 @@ Detect the mode from the pasted content:
 ## Mode A — new spec (input is a brainstorm return, or empty)
 
 1. If empty, look for a staged brainstorm return first — `specs/reports/*-brainstorm.md` (where
-   `/brainstorm` stages its output); one match ⇒ read it and confirm, several ⇒ ask which. None ⇒
+   `/cohorte-brainstorm` stages its output); one match ⇒ read it and confirm, several ⇒ ask which. None ⇒
    ask the human to paste the return (or describe the feature) and wait.
 2. Derive a `feature_id` (kebab-case slug). Confirm it.
 2b. **Size budget — a spec is a contract, not a novel.** Target ≤ ~300 lines; hard-think at 500.
@@ -47,15 +47,15 @@ Detect the mode from the pasted content:
    non-design surfaces never re-read the full brief on every dispatch).
 4b. **New-surface heads-up.** If the feature clearly introduces an area no existing `surfaces[].path`
    owns (a new service/app/top-level module), note it in the spec (a line in the relevant task section:
-   `> needs new surface: <proposed key/path>`). Don't render agents here — `/build` §1.5 auto-reconciles
-   it. This is just so the human isn't surprised when `/build` proposes a new agent.
+   `> needs new surface: <proposed key/path>`). Don't render agents here — `/cohorte-build` §1.5 auto-reconciles
+   it. This is just so the human isn't surprised when `/cohorte-build` proposes a new agent.
 5. When the human validates, **freeze**: write `specs/<id>.md` (`status: frozen`, front-matter filled).
    Create the file — do not ask the human to. **Postcondition:** `grep -q '^status: frozen' specs/<id>.md`
-   — if it fails the freeze didn't land; fix it before pointing the human at `/build`. Chain the
-   opt-in usage ping onto the postcondition's Bash call (`/build` §4's shared form, `<phase>` =
+   — if it fails the freeze didn't land; fix it before pointing the human at `/cohorte-build`. Chain the
+   opt-in usage ping onto the postcondition's Bash call (`/cohorte-build` §4's shared form, `<phase>` =
    `spec`, `<seconds>` = `0` — interactive time, not pipeline wall-clock, `<results>` = `frozen`).
    Ping only on a **landed** freeze, so the funnel counts specs that exist, not attempts. Mode B does
-   not ping — it re-enters an already-counted spec, and `/fix` covers that loop. Silent no-op without
+   not ping — it re-enters an already-counted spec, and `/cohorte-fix` covers that loop. Silent no-op without
    consent; never ask about consent here.
 5b. **Record the transverse decisions — the journal, not a summary.** Walk what the interview settled
    and keep ONLY the decisions that **outlive this feature**: a rule the next spec would otherwise
@@ -67,7 +67,7 @@ Detect the mode from the pasted content:
    `- <YYYY-MM-DD> · <area> · <decision> — because <reason> · <feature_id>`
    - **Never** duplicate what §5, `PIPELINE.md` §Conventions or the code already states — the journal
      carries the *non-obvious rule*, not the feature's content. A line that restates a spec section is
-     a line every future `/spec` pays for and learns nothing from.
+     a line every future `/cohorte-spec` pays for and learns nothing from.
    - **Contradicting an existing line** is allowed but never silent: tell the human which line this
      feature overrides, get their go-ahead, then append the new line with
      `· supersedes <YYYY-MM-DD> <area>` and move the old one to `## Superseded`.
@@ -79,28 +79,28 @@ Detect the mode from the pasted content:
    - **Write it to `specs/design/<id>.md`** (the authored artifact, versioned with the spec; spec §8
      holds the summary + pointer). Create the file — do not ask the human to. Keep it in the
      `specs/design/` subfolder, **not** `specs/<id>....md`: the `specs/*.md` glob that drives the
-     kanban backfill and `/doctor` is non-recursive, so a brief in the subfolder never gets mistaken
+     kanban backfill and `/cohorte-doctor` is non-recursive, so a brief in the subfolder never gets mistaken
      for a spec (no phantom card, no bogus stage). Overwrite it on every freeze.
    - Print ONLY the path + a one-line summary — never echo the brief into chat (it would sit in this
      session's history; echo it only if the human asks). Tell the human: copy it from
      `specs/design/<id>.md` into the design tool (if any — typically a fresh design project for this
-     feature), then run `/build <id>` and hand its design gate the resulting page link(s) — a full
+     feature), then run `/cohorte-build <id>` and hand its design gate the resulting page link(s) — a full
      `https://claude.ai/design/p/<projectId>?file=<file>` link carries its own project + page, no
      profile change needed. (They can also paste the links into the spec's `design_files` themselves.)
-     **Recommend a `/clear` before `/build`** — the frozen spec + `specs/design/<id>.md` are the whole
+     **Recommend a `/clear` before `/cohorte-build`** — the frozen spec + `specs/design/<id>.md` are the whole
      handoff.
 
 ## Mode B — review return (input is a REVIEW REPORT)
 
 1. Read the report — pasted as input, or (whenever nothing is pasted) read from
-   `specs/reports/<id>.md`, where `/review` stages its last report. Identify `feature_id` from its
+   `specs/reports/<id>.md`, where `/cohorte-review` stages its last report. Identify `feature_id` from its
    header; open `specs/<id>.md`.
 2. Append each finding to the spec's **`## Remediation`**, one per line:
    `- [ ] <severity> · <file:line> · <spec-violation|quality|security> · <concrete fix>`
    (Keep prior items; add the new round under a dated/numbered subheading.)
 3. If a finding implies the **contract** must change, update §5 and flag it so the lead re-authors the
    contract file.
-4. Set `status: in-review`. Tell the human to run `/build <id>` to re-dispatch fresh agents.
-   **Recommend a `/clear` before `/build`** — the spec is the whole handoff.
+4. Set `status: in-review`. Tell the human to run `/cohorte-build <id>` to re-dispatch fresh agents.
+   **Recommend a `/clear` before `/cohorte-build`** — the spec is the whole handoff.
 
 In both modes the spec is the single source of truth; agents are stateless and read only it + the diff.