cohorte 2.1.0 → 2.2.0

package/core/commands/cohorte-doctor.md

@@ -12,8 +12,17 @@ fix only with the human's go-ahead (or hand them the command).
 
 ## Checks, in order
 
-1. **Core & pointer.** A core exists (`~/.claude/pipeline/VERSION` global, and/or
-   `.claude/pipeline/VERSION` bundled); `.claude/pipeline.json` names a mode + `core_version`
+0. **Runtime.** Say which coding agent you are running as and what it can enforce — every check
+   below is read through it. **You already know which one**: the Runtime preamble at the top of
+   this file names it. Read `<core>/pipeline/runtimes.json` for the details — a map of every
+   runtime installed against this core, since they share one core. Report one line:
+   `runtime: <label> · scope <global|project> · hooks <yes|no> · workflows <yes|no>`,
+   and name the other installed runtimes if there are any (they share `<state>` and `<config>`, so
+   a board or a gate config wired from one is seen by all — that is intended, and worth stating).
+   File absent ⇒ a core installed before the adapter existed ⇒ ⚠️, fix by re-running the installer.
+   A runtime without hooks makes check 3's gate **advisory** — say so there rather than
+   reporting a false ✅.
+1. **Core & pointer.** A core exists (`<core>/pipeline/VERSION`); `<state>/pipeline.json` names a mode + `core_version`
    coherent with the VERSION file. A **global**-mode pointer lagging the VERSION file is ⚠️, not ❌:
    nothing bumped that field before 1.2.5, so the core itself is fine and only the pointer is stale
    ⇒ fix by running `/cohorte-update-pipeline` (§3 syncs it now), or by editing the one field. Compare
@@ -21,40 +30,57 @@ fix only with the human's go-ahead (or hand them the command).
    commands' step files are present — `templates/steps/init-pipeline/` non-empty (a router whose
    `templates/steps/<cmd>/` dir is missing is a partial/stale install ⇒
    re-run install/update). **Shipped scripts present and executable** in `<core>/pipeline/scripts/`:
-   `kanban-move.sh`, `telemetry-send.sh`, `preflight.sh`, `loop.sh`, `loop-detach.sh`,
+   `kanban-move.sh`, `telemetry-send.sh`, `preflight.sh`,
    `new-feature.sh.template`, `remove-feature.sh.template` — ❌ any missing one.
-   `loop-detach.sh` absent is what silently turns `/cohorte-loop` back into a foreground run
-   that dies at the 600 s tool ceiling, so name it explicitly rather than folding it into
-   "some script is missing". Every caller chains these with `|| true`, so an absent script is a **silent**
+   Every caller chains these with `|| true`, so an absent script is a **silent**
    no-op (no kanban card moves, no telemetry ping, no error anywhere) — this check is the only thing
    that sees it. Also flag ❌ a `VERSION` **newer than** the other `pipeline/` files (compare mtimes):
    a version bumped without a full re-copy is a half-done update ⇒ re-run install/update.
 2. **Profile.** `PIPELINE.md` exists and its `yaml pipeline-profile` block parses. Every
-   `surfaces[].agent` has its `.claude/agents/<agent>.md` and every agent file has its `surfaces[]`
+   `surfaces[].agent` has its `<agents>/<agent>.md` and every agent file has its `surfaces[]`
    entry — **no orphans either way** (SCHEMA.md rule). Each rendered agent's frontmatter `tools`
    matches its surface's `tools` (incl. `DesignSync` iff `uses_design`, retrieval MCP tools iff
    `retrieval.provider` ≠ `none`). **Model pins:** each rendered agent's frontmatter `model` matches
    its `surfaces[].model` — ❌ if missing, mismatched, or a literal `<SURFACE_MODEL>` placeholder
    (all three silently fall back to inheriting the lead session's model — often Opus — on every
    dispatch); ⚠️ any `inherit` with the note that it bills at the lead's tier. The generic agents
-   (`review.md`, `release.md`, `profile-reader.md` — repo or `~/.claude/agents/`) must
-   each carry their `model:` line too (sonnet/haiku/haiku). **Command pins:** every mechanical command file
-   (`build`, `review`, `fix`, `loop`, `ship`, `audit`, `refactor`, `doctor`, `align-ds`,
-   `update-pipeline` — in `.claude/commands/` or `~/.claude/commands/`) carries `model: sonnet` in
+   (`review.md`, `release.md`, `profile-reader.md` in `<agents>/`) must
+   each carry their `model:` line too (sonnet/haiku/haiku).
+<!-- cohorte:if runtime:claude -->
+   **Command pins:** every mechanical command file
+   (`build`, `review`, `fix`, `ship`, `audit`, `refactor`, `doctor`, `align-ds`,
+   `update-pipeline` — in `<commands>/`) carries `model: sonnet` in
    its frontmatter — ⚠️ if missing (the lead's orchestration turn then bills at the session model,
    e.g. Opus/Fable). `brainstorm`, `spec`, and `init-pipeline` are intentionally unpinned
    (interactive — they inherit the session model).
-3. **Hooks & gate.** `.claude/gate-config.json` exists and mirrors the profile's `gate` block
-   (regenerate if drifted). The PreToolUse gate hook is registered **once** for the install mode
-   (bundled: repo `settings.json`; global: `~/.claude/settings.json` — flag double registration,
-   it double-prompts) **with a matcher covering both `Bash` and `Task`** — a `Bash`-only matcher
-   leaves the preflight phase gate dead (the 1.3.0–1.3.1 regression). Hook files exist at the
-   registered paths.
+<!-- cohorte:endif -->
+
+3. **Hooks & gate.** `<state>/gate-config.json` exists and mirrors the profile's `gate` block
+   (regenerate if drifted).
+<!-- cohorte:if hooks -->
+   The gate hook is registered **once** in the config file the Runtime preamble names — flag a
+   double registration, it double-prompts — and its `command` points at a `gate.py` that exists.
+   Check the **matcher** actually covers what it must: on Claude Code that means both `Bash` and
+   `Task`, since the preflight phase gate keys off `Task` dispatches and a `Bash`-only matcher
+   leaves it silently dead (the 1.3.0–1.3.1 regression). Prove the wiring end to end rather than
+   trusting the file: `python3 <core>/hooks/gate.py --check "<a pattern from the ask list>"` must
+   return a non-`allow` verdict. If the Runtime preamble said this runtime has **no confirmation
+   tier**, state it here too: every `ask` pattern behaves as a `deny`, which is safe but stricter
+   than the profile reads, and a human who expects a prompt will read the refusal as a bug.
+<!-- cohorte:endif -->
+<!-- cohorte:if !hooks -->
+   This runtime has **no blocking hook**, so the gate is **advisory**: it only fires when the agent
+   calls it. Say that in one line rather than reporting ✅ — the enforcement property genuinely is
+   weaker here, and a human who thinks otherwise will approve less carefully. Verify what CAN be
+   verified: `<core>/hooks/gate.py` exists and `python3 <core>/hooks/gate.py --check "git push"`
+   returns a verdict line (a non-`allow` on a gated pattern proves config + script are wired). ❌ if
+   the script is missing or errors; ℹ️ "advisory (this runtime has no hooks)" otherwise.
+<!-- cohorte:endif -->
    Then the **preflight stamp is local, never versioned**: `git ls-files --error-unmatch
-   .claude/preflight.ok` must miss, and `.gitignore` must cover it. A tracked stamp is a ❌ (not a
+   <state>/preflight.ok` must miss, and `.gitignore` must cover it. A tracked stamp is a ❌ (not a
    ⚠️) — it records the tree it verified, the commit that carries it moves HEAD past that tree, and
    the committed copy lands in every clone and new worktree; the gate then blocks clean trees and
-   greens unchecked ones. fix: `git rm --cached .claude/preflight.ok` + add it to `.gitignore`.
+   greens unchecked ones. fix: `git rm --cached <state>/preflight.ok` + add it to `.gitignore`.
 4. **Retrieval** (if `retrieval.provider` ≠ `none`). Run the SCHEMA.md §Code retrieval health
    check: CLI resolvable from PATH, `.mcp.json` entry present in PATH-proof launcher form,
    `.serena/` gitignored, server actually connects.
@@ -70,7 +96,7 @@ fix only with the human's go-ahead (or hand them the command).
    When ≥2 slots are live, print the parallel-feature table (feature · worktree · ports · db ·
    branch behind main by N commits) — a worktree far behind main means its next review will diff
    against stale code ⇒ suggest rebasing it.
-7. **Telemetry** (consent hygiene — read `~/.claude/cohorte.config.yaml` §`telemetry`). Report the
+7. **Telemetry** (consent hygiene — read `<config>` §`telemetry`). Report the
    status in one line: `disabled` / `enabled since <consent_date> · install_id <id> · endpoint <url>`
    (the install_id is the human's GDPR erasure key — see SCHEMA.md §Telemetry). Flag ❌ any
    incoherent state: `enabled: true` with no `install_id` or no `consent_date` (sending without
@@ -85,6 +111,7 @@ fix only with the human's go-ahead (or hand them the command).
    other key whose board file exists (a **rename** orphaned the link — re-key it via
    `/cohorte-update-pipeline`), and an entry whose board file no longer exists at
    `vault_path`-relative `board` (moved or renamed in the vault).
+<!-- cohorte:if workflows -->
 8. **Workflows** (the opt-in execution path — SCHEMA.md §Workflows; the conversational commands
    stay the default, so failures here are ⚠️ at most, never ❌). Report which path this machine will
    take and why:
@@ -92,8 +119,7 @@ fix only with the human's go-ahead (or hand them the command).
      on PATH ⇒ conversational only.
    - **Scripts present:** `<core>/workflows/review.js` + `audit.js` + `refactor.js` —
      missing on a current core ⇒ half-done install, re-run install/update.
-   - **Phase-0 agent present:** `<agents dir>/profile-reader.md` (repo `.claude/agents/` bundled or
-     `~/.claude/agents/` global) — the workflows abort without it.
+   - **Phase-0 agent present:** `<agents>/profile-reader.md` — the workflows abort without it.
    - **Workflows enabled in this session** — the `Workflow` tool is in your own toolset right now;
      absent ⇒ disabled for this session (a setting or an old client), conversational path.
    - **Preflight wiring** (used by both paths): `pipeline/scripts/preflight.sh` executable and
@@ -101,15 +127,20 @@ fix only with the human's go-ahead (or hand them the command).
    End the check with ONE summary line, e.g.
    `workflows: available (opt-in — ask to "run the review workflow")` or
    `workflows: unavailable (<first failing prerequisite>) — conversational commands (the default)`.
+<!-- cohorte:else -->
+8. **Preflight wiring.** `<core>/pipeline/scripts/preflight.sh` is executable and
+   `gate-config.json` carries the `preflight` block — mismatch ⇒ regenerate from the profile.
+   (The workflow execution path does not exist on this runtime; the conversational commands are
+   the only path, which is also the default everywhere else. Not a defect — state it and move on.)
+<!-- cohorte:endif -->
 9. **Specs & metrics.** Every `specs/*.md` front-matter `status` is a valid stage — one of
-   `draft · frozen · in-progress · in-review · shipped · blocked` (SCHEMA.md §Spec status; the last two
-   are written by the `/cohorte-loop` driver, so flagging them would report the pipeline's own state as a
-   defect) — excluding
+   `draft · frozen · in-progress · in-review · shipped · blocked` (SCHEMA.md §Spec status) — excluding
    `_`-prefixed files (the spec template and `specs/_decisions.md`, the decision journal) and
    `specs/refactor-backlog.md`, which `/cohorte-audit` writes as a backlog, not a
-   spec, and which has no front-matter to check. A spec left `in-progress`/`blocked` with
-   `loop_pass` > 0 is a loop that never finished ⇒ say so and name `/cohorte-loop <id> --resume`. `shipped` specs
-   with a live worktree flagged (see 6). `.claude/pipeline-metrics.jsonl` and `specs/reports/` (the
+   spec, and which has no front-matter to check. A spec left `in-progress` or `blocked` is a round
+   that never finished ⇒ say so and route it: open `## Remediation` items ⇒ `/cohorte-fix`, none ⇒
+   `/cohorte-build`. `shipped` specs
+   with a live worktree flagged (see 6). `<state>/pipeline-metrics.jsonl` and `specs/reports/` (the
    `/cohorte-review` report buffer that lets a `/cohorte-fix` survive a `/clear`) are gitignored. Metrics
    belong to the **main checkout** — a `pipeline-metrics.jsonl` inside a live feature worktree is a
    stale-core sign (its lines die at teardown) ⇒ suggest appending its lines to the main checkout's

package/core/commands/cohorte-fix.md

@@ -12,8 +12,7 @@ that change the *contract*; `/cohorte-fix` is for everything else.
 > _Skip the re-read if it's already in your context this session and unmodified since._
 >
 > **Kanban** (SCHEMA.md §Kanban): on ingest, run
-> `<core>/pipeline/scripts/kanban-move.sh auto $ARGUMENTS fix` (`<core>` = `.claude` bundled /
-> `~/.claude` global — probe with `test -x`); the card returns to **Review** when `/cohorte-review`
+> `<core>/pipeline/scripts/kanban-move.sh auto $ARGUMENTS fix`; the card returns to **Review** when `/cohorte-review`
 > re-runs. `auto` resolves the board from the config itself and exits 0 with a `kanban: <reason>`
 > line when there is none — so **never decide "no board is configured" without running it**.
 
@@ -71,7 +70,7 @@ When the agents return:
   needs those checkboxes).
 - Print one status line per surface (`<key> · items fixed <n>/<m> · tests pass/fail`) — do not restate
   handoff content — and append ONE metrics line for the batch to the **main checkout's**
-  `$(dirname "$(git rev-parse --git-common-dir)")/.claude/pipeline-metrics.jsonl` (never a bare
+  `$(dirname "$(git rev-parse --git-common-dir)")/<state>/pipeline-metrics.jsonl` (never a bare
   relative path: from a feature worktree that writes a stray sink whose lines die at teardown)
   (rules in `/cohorte-build` §4, `phase: "fix"`), chaining the opt-in usage ping in the same Bash call
   (results = items fixed over items found across surfaces, e.g. `"5/6"`).

package/core/commands/cohorte-init-pipeline.md

@@ -9,13 +9,12 @@ agents. Interactive — confirm inferences with the human.
 
 > **Bootstrap (applies to every step):**
 >
-> **Where the core lives (bundled vs global).** The stack-agnostic source files (`pipeline/`,
-> `templates/`) live in EITHER this repo's `.claude/` (per-project install) OR `~/.claude/`
-> (global install). **Resolve every source path below as: prefer `.claude/<path>`; if it isn't
-> there, use `~/.claude/<path>`.** Detect the mode once at the start (`.claude/pipeline/VERSION`
-> present ⇒ `bundled`; else `~/.claude/pipeline/VERSION` ⇒ `global`) and remember it — Phase 4
-> branches on it. **Everything you GENERATE is always written into THIS repo** (`PIPELINE.md` at the
-> root, agents/config under this repo's `.claude/`), never into `~/.claude/`.
+> **Where the core lives (bundled vs global).** `<core>` above already names it — the adapter
+> resolved the scope at install time, so nothing here probes. Read it once to learn WHICH mode you
+> are in (`<core>` inside this repo ⇒ `bundled`; `<core>` under your home ⇒ `global`) and remember
+> it — Phase 4 branches on it. **Everything you GENERATE is always written into THIS repo**
+> (`PIPELINE.md` at the root, agents under `<agents>/`, config under `<state>/`), never into the
+> global core.
 >
 > Work in phases. Do not write any file until Phase 4.
 
@@ -29,4 +28,4 @@ agents. Interactive — confirm inferences with the human.
 | 04 | `04-write-render` | Write files & render surface agents | after go-ahead |
 | 05 | `05-report` | Print install mode, files, mapping | always |
 
-**Before running a step, read its file** in `.claude/templates/steps/init-pipeline/` (resolves to `~/.claude/templates/steps/init-pipeline/` when the core is installed globally — read whichever exists). This table is a map, not the instructions.
+**Before running a step, read its file** in `<core>/templates/steps/init-pipeline/`. This table is a map, not the instructions.

package/core/commands/cohorte-refactor.md

@@ -8,10 +8,12 @@ You are the **lead**. Refactor domain **$ARGUMENTS** to match `PIPELINE.md`, usi
 
 > Read `PIPELINE.md` §`surfaces` (map the domain → a surface + its agent + commands) and §`contract`.
 >
+<!-- cohorte:if workflows -->
 > **Workflow variant** (opt-in — SCHEMA.md §Workflows): for BIG domains (many open backlog items
 > across several surfaces), on Claude Code ≥ 2.1.154 with workflows enabled, the human can ask to
 > "run the refactor workflow" (`<core>/workflows/refactor.js`). For a handful of items this
 > conversational path is cheaper — and it stays the default and the fallback.
+<!-- cohorte:endif -->
 
 ## 1. Gather
 
@@ -22,11 +24,12 @@ You are the **lead**. Refactor domain **$ARGUMENTS** to match `PIPELINE.md`, usi
 
 ## 2. Dispatch the surface's implementer agent — TDD-first, stateless
 
-Spawn the matching `<surface.agent>` with the template below. Keep it **byte-identical across loop
+Spawn the matching `<surface.agent>` with the template below (as `subagent_type: <surface.agent>`).
+Keep it **byte-identical across loop
 rounds** (only the final items slot varies — it sits at the end so repeats hit the prompt cache), and
 never paste a diff — the agent computes its own, scoped to its tree:
 
-> `subagent_type: <surface.agent>` — "Refactor pass on your surface (no feature spec). Read
+> "Refactor pass on your surface (no feature spec). Read
 > `PIPELINE.md` first. **Add the missing tests FIRST** (pin current behavior / cover the entry
 > points), watch them pass, **then** refactor to clear each item. Preserve current public behavior
 > unless an item marks it a bug. Migrations stay additive. Need the current state of your tree?

package/core/commands/cohorte-review.md

@@ -10,20 +10,21 @@ You are the **lead**. Dispatch the review for feature **$ARGUMENTS**.
 > _Skip the re-read if it's already in your context this session and unmodified since._
 >
 > **Kanban** (SCHEMA.md §Kanban): run
-> `<core>/pipeline/scripts/kanban-move.sh auto $ARGUMENTS review` (`<core>` = `.claude` bundled /
-> `~/.claude` global — probe with `test -x`). `auto` resolves the board from the config itself and
+> `<core>/pipeline/scripts/kanban-move.sh auto $ARGUMENTS review`. `auto` resolves the board from the config itself and
 > exits 0 with a `kanban: <reason>` line when there is none — so **never decide "no board is
 > configured" without running it**.
 >
+<!-- cohorte:if workflows -->
 > **Workflow variant** (opt-in — SCHEMA.md §Workflows): on Claude Code ≥ 2.1.154 with workflows
 > enabled, the human can ask to "run the review workflow" (`<core>/workflows/review.js`) instead.
 > This conversational path stays the default and the fallback; `/cohorte-doctor` shows which is available.
+<!-- cohorte:endif -->
 
 ## 0. Deterministic pre-flight — no agents while red
 
 Run the profile's mechanical gates in ONE Bash call via the shipped script
-(`<core>/pipeline/scripts/preflight.sh`, `<core>` = `.claude` bundled / `~/.claude` global — probe
-with `test -x`); note the epoch (`date +%s`) in the same call — §3's metrics line needs it:
+(`<core>/pipeline/scripts/preflight.sh`); note the epoch (`date +%s`) in the same call — §3's
+metrics line needs it:
 
 ```
 <core>/pipeline/scripts/preflight.sh specs/reports/$ARGUMENTS.preflight.txt \
@@ -37,8 +38,14 @@ with `test -x`); note the epoch (`date +%s`) in the same call — §3's metrics
   rather than silence:
   `{"id":"$ARGUMENTS","phase":"review","ts":"<ISO>","aborted":"preflight","verdict":"BLOCK","blocking":null}`
   → `specs/reports/$ARGUMENTS.verdict.json`. One `printf`, in the same Bash call.
-- **Zero exit** ⇒ it stamped `.claude/preflight.ok`, which the gate hook checks before letting
+<!-- cohorte:if hooks -->
+- **Zero exit** ⇒ it stamped `<state>/preflight.ok`, which the gate hook checks before letting
   `review` dispatches through (SCHEMA.md §Preflight). Continue.
+<!-- cohorte:else -->
+- **Zero exit** ⇒ it stamped `<state>/preflight.ok`. Nothing enforces that stamp on this runtime, so
+  §2 does not start until you have seen this line: a review of red code is the one failure mode this
+  step exists to prevent, and here only you can prevent it (SCHEMA.md §Preflight). Continue.
+<!-- cohorte:endif -->
 - Script absent (older core) ⇒ run the three commands yourself, each redirected into
   `specs/reports/$ARGUMENTS.preflight.txt`, aborting on the first failure the same way.
 
@@ -61,7 +68,7 @@ with `test -x`); note the epoch (`date +%s`) in the same call — §3's metrics
 
 ## 2. Dispatch review agents — one per touched surface, IN PARALLEL
 
-Spawn ONE `review` agent per surface that has changed files, in a **single message** (one Task call
+Spawn ONE `review` agent per surface that has changed files, in a **single message** (one dispatch
 each, like `/cohorte-build`) so they run concurrently — NEVER serially: review wall-clock must be the
 slowest surface, not the sum. A diff touching a single surface ⇒ a single reviewer.
 
@@ -70,12 +77,12 @@ changed lines), touches no contract file, and every open finding it addresses is
 LOW/MEDIUM, skip the dispatch: verify the hunks yourself against the open Remediation items (did the
 prescribed fixes land? — NOT a de-novo audit) and write the same REVIEW REPORT into the §3 flow.
 First-round reviews, contract changes, and security findings always get a full reviewer. For each
-dispatched surface:
+reviewed surface:
 
 Keep the dispatch prompt **byte-identical across features and rounds** except the variable block,
 which sits at the END so every repeat hits the prompt-cache prefix:
 
-> `subagent_type: review` — "Review one feature surface against its frozen spec. Read `PIPELINE.md`
+> `subagent_type: review` (or this runtime's equivalent) — "Review one feature surface against its frozen spec. Read `PIPELINE.md`
 > first (flags + the §Conventions/§Testing slice for your scope). Check spec conformance first, then
 > correctness, security, conventions, RBAC/mobile-first _if the profile enables them_, and TDD
 > coverage. Your dispatch names a staged diff file — read it FIRST; open a full source file only when
@@ -109,7 +116,7 @@ re-ordered by severity, counts summed, duplicates collapsed, verdict = the worst
 (`BLOCK` > `REVISE` > `SHIP`). The `## Deferred` sections merge the same way (dedupe by
 `file` + problem) and stay **out of the severity table and out of the verdict** — see §3.5, which
 routes them. Append ONE metrics line for the batch to the **main checkout's**
-`$(dirname "$(git rev-parse --git-common-dir)")/.claude/pipeline-metrics.jsonl` (rules in
+`$(dirname "$(git rev-parse --git-common-dir)")/<state>/pipeline-metrics.jsonl` (rules in
 `/cohorte-build` §4; never a bare relative path — from a worktree that strands the lines): `{"ts":"<ISO>","feature":"$ARGUMENTS","phase":"review","seconds":<wall-clock>,"surfaces":{"<key>":"<verdict>:<finding count>",…}}`.
 In the same Bash call, chain the opt-in usage ping (`/cohorte-build` §4, `phase: "review"`, results = the
 merged verdict + total finding count, e.g. `"REVISE:3"`).
@@ -118,7 +125,7 @@ merged verdict + total finding count, e.g. `"REVISE:3"`).
 non-recursive `specs/*.md` glob, so it's never mistaken for a spec (no phantom card, no bogus stage).
 **Write the machine-readable verdict** to `specs/reports/$ARGUMENTS.verdict.json` (overwrite) — on
 **every** run, including the small-diff fast path of §2 and a `SHIP`. This file is the ONLY contract
-between the pipeline and an automated driver (`/cohorte-loop`), which parses no prose:
+between the pipeline and any automated driver, which parses no prose:
 
 ```json
 { "id": "$ARGUMENTS", "phase": "review", "ts": "<ISO>", "verdict": "REVISE",
@@ -163,8 +170,8 @@ exactly the leak this step closes. Append each merged `## Deferred` item to
 - [ ] <SEVERITY> · <file:line> · <quality|security|rule> · <concrete fix> · deferred:$ARGUMENTS
 ```
 
-- **Never into the spec's `## Remediation`** — that list is what `/cohorte-fix` re-dispatches and what `/cohorte-loop`
-  waits on, so a deferred item there would re-trigger the very loop it was deferred out of.
+- **Never into the spec's `## Remediation`** — that list is what `/cohorte-fix` re-dispatches, so a
+  deferred item there would re-trigger the very fix round it was deferred out of.
 - **Dedupe before appending:** `grep -F` the backlog for the item's `<file>` + the first words of its
   problem; already there (from a prior round or an `/cohorte-audit`) ⇒ skip it, don't stack duplicates round
   after round.
@@ -197,10 +204,7 @@ would sit in this session's history, re-sent every turn). Then:
   re-trigger the fix loop), keep the SHIP verdict and the freshness stamp, and let the human ship.
 - **REVISE / BLOCK**, or any CRITICAL/HIGH/security finding → tell the human to run
   **`/cohorte-fix $ARGUMENTS`** — it appends the report to the spec's `## Remediation` and re-dispatches ONLY
-  the surfaces with findings. (If they'd rather automate the rounds, the autonomous driver is
-  `disable-model-invocation: true` on purpose: **you cannot start it, they must type it**. Name the
-  exact line for them to type rather than attempting it — an attempt that silently fails reads as a
-  loop that is running when nothing is.) The full path (`/cohorte-spec` Mode B then `/cohorte-build`) remains for findings that
+  the surfaces with findings. The full path (`/cohorte-spec` Mode B then `/cohorte-build`) remains for findings that
   change the contract in ways that ripple into clean surfaces. _The report is staged to
   `specs/reports/$ARGUMENTS.md`, so you can `/clear` before `/cohorte-fix` — it reads the findings back from
   disk._

package/core/commands/cohorte-ship.md

@@ -12,8 +12,7 @@ You are the **lead**. Ship feature **$ARGUMENTS**. This is the outward-facing ga
 >
 > **Kanban** (SCHEMA.md §Kanban) is mirrored in **explicit steps** below, not as an afterthought:
 > §1 moves the card → **Ship**; §4 moves it → **Shipped** and writes the PR number. Both are one
-> call to `<core>/pipeline/scripts/kanban-move.sh auto …` (`<core>` = `.claude` bundled / `~/.claude`
-> global — probe with `test -x`), which resolves the board from the config itself and exits 0 with a
+> call to `<core>/pipeline/scripts/kanban-move.sh auto …`, which resolves the board from the config itself and exits 0 with a
 > `kanban: <reason>` line when there is none. **Never decide "no board is configured" without running
 > it** — a ship session that inferred that, having opened neither the config nor `PIPELINE.md`, is
 > exactly how a merged feature's card stayed in "Ready to build". Do not skip §4's move either.
@@ -65,17 +64,18 @@ See SCHEMA.md §Release notes.
 - Then say in one line which level you chose and why — this is the human's last chance to correct it
   before it is committed.
 
-> **Why this is its own gate.** The requirement usually lives in the project's `CLAUDE.md`, which this
+> **Why this is its own gate.** The requirement usually lives in the project's `<memory>`, which this
 > flow never reads. Skip it and everything below still "succeeds": commit, push, PR opened, kanban card
 > moved to **Shipped** — and CI red on a job nobody watched. The feature reads as shipped while being
 > unmergeable.
 
 ## 3. Dispatch the `release` agent
 
-Spawn one agent (`subagent_type: release`): "Release feature `$ARGUMENTS` on branch
+Spawn one agent (`subagent_type: release`, or the equivalent dispatch for this runtime):
+"Release feature `$ARGUMENTS` on branch
 `<feature_branch_prefix>$ARGUMENTS`. Read `PIPELINE.md` §vcs first. Spec: `specs/$ARGUMENTS.md` (already
 `status: shipped` — stage it). Write conventional commit(s), push (no force), open the PR (use `gh` if
-`host: github` + available; else emit the compare URL + drafted PR body from `.claude/templates/pr-body.md`).
+`host: github` + available; else emit the compare URL + drafted PR body from `<core>/templates/pr-body.md`).
 Stage **all** the feature's changes including `specs/$ARGUMENTS.md` and, if `release_notes.enabled`, the
 release note at `<release_notes.dir>/<release_notes.filename>` — it is already written, stage it as-is and
 never author or edit one yourself. Never edit source, never force-push, never run migrations."

package/core/commands/cohorte-spec.md

@@ -10,17 +10,13 @@ You run the **spec** step in the main thread — interactive, with the human. Pa
 > Read `PIPELINE.md` first: `contract` (mechanism/path — so §5 names the right schema types),
 > `design.enabled` (whether §8 matters), and §Conventions. Use `specs/_template.md` as the section list.
 >
-> Template paths below (`.claude/templates/…`) resolve to `~/.claude/templates/…` when the core is
-> installed globally — read whichever exists.
->
 > **Decision journal** (SCHEMA.md §Decisions): read `specs/_decisions.md` §Live if it exists — one
 > line per standing decision, so it is cheap. It is the ONLY place the project's transverse rules
 > live; a spec that contradicts one silently un-decides it. Absent ⇒ nothing to honour yet.
 >
 > **Kanban** (SCHEMA.md §Kanban): when the spec opens, run
 > `<core>/pipeline/scripts/kanban-move.sh auto <feature_id> spec --title "<human title>"`; on freeze
-> (`status: frozen`, Mode A), the same call with `ready`. `<core>` = `.claude` bundled / `~/.claude`
-> global — probe with `test -x`. `auto` resolves the board from the config itself and exits 0 with a
+> (`status: frozen`, Mode A), the same call with `ready`. `auto` resolves the board from the config itself and exits 0 with a
 > `kanban: <reason>` line when there is none — so **never decide "no board is configured" without
 > running it**.
 
@@ -67,7 +63,7 @@ Detect the mode from the pasted content:
    convention, a deliberate non-goal that binds future features). Typical yield: **0–3 lines**; zero
    is a normal, healthy outcome for a feature that decided nothing new — never invent lines to fill
    the section. Append them to `specs/_decisions.md` §Live (create the file from
-   `.claude/templates/decisions.template.md` on first use), each exactly:
+   `<core>/templates/decisions.template.md` on first use), each exactly:
    `- <YYYY-MM-DD> · <area> · <decision> — because <reason> · <feature_id>`
    - **Never** duplicate what §5, `PIPELINE.md` §Conventions or the code already states — the journal
      carries the *non-obvious rule*, not the feature's content. A line that restates a spec section is
@@ -78,7 +74,7 @@ Detect the mode from the pasted content:
    - Append with one `>>` Bash call, not a full-file rewrite (the file is append-only, and reading it
      back to re-write it is the one way to make a bounded file expensive).
 6. Author the **design brief** — `specs/design/<id>.md`, rendered via
-   `.claude/templates/design-brief.md` (resolves to `~/.claude/templates/…` on a global install).
+   `<core>/templates/design-brief.md`.
    _Only if `design.enabled` / the feature has UI; skip entirely for a backend-only feature._
    - **Write it to `specs/design/<id>.md`** (the authored artifact, versioned with the spec; spec §8
      holds the summary + pointer). Create the file — do not ask the human to. Keep it in the

package/core/commands/cohorte-update-pipeline.md

@@ -6,14 +6,14 @@ argument-hint: [path-to-local-checkout]
 
 You are the **pipeline updater**. Refresh the installed pipeline core to the latest version of the pipeline
 repo. The installer's `--update` mode never touches generated files: `PIPELINE.md`, rendered surface agents,
-`gate-config.json`, `settings.json`, and the filled `~/.claude/cohorte.config.yaml` are all preserved.
+`gate-config.json`, `settings.json`, and the filled `<config>` are all preserved.
 YOU then bring those generated files up to the new core yourself (§3.5) — additively, never clobbering
 the human's choices — so `/cohorte-init-pipeline` never needs re-running for an upgrade.
 
 ## 1. Detect the install scope + current version
 
-- **Global** install ⇒ `~/.claude/pipeline/VERSION` exists. **Bundled** ⇒ this repo's
-  `.claude/pipeline/VERSION` exists. (Both can exist; prefer the bundled one when running inside such a
+- **Global** install ⇒ `<core>/pipeline/VERSION` exists. **Bundled** ⇒ this repo's
+  `<core>/pipeline/VERSION` exists. (Both can exist; prefer the bundled one when running inside such a
   repo, and update both if the human wants.)
 - **Never migrate a repo between bundled and global mode on your own.** Updating means refreshing the
   core *in its current mode*. Only migrate (e.g. delete a bundled core in favor of the global one) if
@@ -52,7 +52,7 @@ the human's choices — so `/cohorte-init-pipeline` never needs re-running for a
 
 Re-read the VERSION file(s) and print `old → new`. If unchanged, say the core was already up to date.
 
-**Sync the pointer — in BOTH modes.** If this repo has a `.claude/pipeline.json` whose `core_version`
+**Sync the pointer — in BOTH modes.** If this repo has a `<state>/pipeline.json` whose `core_version`
 differs from the core you just installed, rewrite that one field (leave every other field untouched)
 and tell the human to commit it. In **bundled** mode the installer already did it; in **global** mode
 **nothing does** — the installer refreshes one shared core and cannot know which repos point at it,
@@ -87,16 +87,16 @@ missing, say so. This is why `/cohorte-init-pipeline` never needs re-running for
 Four of the §Reconcile steps matter specifically here:
 
 - **Local-artifact hygiene** (§Reconcile step 8): gitignore + untrack the pipeline's runtime files
-  (`.claude/preflight.ok`, `.claude/pipeline-metrics.jsonl`, `specs/reports/`). A tracked
+  (`<state>/preflight.ok`, `<state>/pipeline-metrics.jsonl`, `specs/reports/`). A tracked
   `preflight.ok` — what every pre-2.0.0 install ends up with once a release agent stages `.claude/` —
   makes the phase gate ask on every single review dispatch, so fix it here and say so.
 
 - **Spec-template top-up** (§Reconcile step 7): `specs/_template.md` was seeded at install and never
   refreshed since, so add the front-matter fields the current `templates/spec.template.md` has and the
-  repo's copy lacks (1.6 added `loop_pass`/`loop_phase` and two states to the `status:` comment) —
+  repo's copy lacks — and drop `loop_pass`/`loop_phase`, retired with `/cohorte-loop` in 2.2.0 —
   front-matter only, never the body.
 
-- **Global config seed** (§Reconcile step 5): if `~/.claude/cohorte.config.yaml` is absent, seed it
+- **Global config seed** (§Reconcile step 5): if `<config>` is absent, seed it
   from the template so the kanban + shared-vault config has a home. Never clobber an existing filled
   file. Report what was seeded. If the existing file has NO `telemetry:` block with a `consent_date`
   (pre-telemetry install), top up the block from the template and ask the ONE opt-in consent
@@ -125,5 +125,5 @@ Four of the §Reconcile steps matter specifically here:
   `/cohorte-update-pipeline` inside each (it will skip the already-done core update and just reconcile).
 - **Commit** the reconciled files (`PIPELINE.md`, `.claude/`, `.mcp.json` if added) so teammates get them.
 - The kanban config is global and user-scoped
-  (`~/.claude/cohorte.config.yaml`) — never committed. The core update never touches it; only the
+  (`<config>`) — never committed. The core update never touches it; only the
   reconcile above seeds the file and writes kanban board links (into that global file, not the repo).