cohorte 2.1.0 → 2.3.0

package/scripts/test-adapter.mjs

@@ -0,0 +1,368 @@
+#!/usr/bin/env node
+// Behavioural tests for the runtime adapter — core/adapter/render.js + core/runtimes/*.json.
+//
+// The adapter is where a single set of source prompts becomes N runtime-specific ones. Its
+// failure mode is silent and expensive: a dropped conditional ships a Claude-only instruction
+// to a runtime that cannot follow it, a leaked marker turns doctrine into visible noise, and a
+// wrong frontmatter key is read by the model as prose. None of that raises an error anywhere —
+// it just makes the pipeline quietly wrong on four runtimes out of five.
+//
+//   node scripts/test-adapter.mjs
+
+import { readFileSync, readdirSync, mkdtempSync, mkdirSync, rmSync, existsSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createRequire } from "node:module";
+
+const root = fileURLToPath(new URL("..", import.meta.url));
+const require = createRequire(import.meta.url);
+const adapter = require(join(root, "core", "adapter", "render.js"));
+
+let failures = 0;
+const check = (name, cond, detail = "") => {
+  if (cond) console.log(`  ✓ ${name}`);
+  else { failures++; console.error(`  ✗ ${name}${detail ? ` — ${detail}` : ""}`); }
+};
+const group = (name) => console.log(name);
+const throws = (fn) => { try { fn(); return false; } catch { return true; } };
+
+const RUNTIMES = adapter.listRuntimes();
+const tmps = [];
+
+// ---------------------------------------------------------------- registry ---
+group("registry — every runtime declares what the renderer reads");
+
+check("at least the five supported runtimes ship", RUNTIMES.length >= 5, RUNTIMES.join(","));
+for (const id of RUNTIMES) {
+  const rt = adapter.loadRuntime(id);
+  const ok = rt.id === id
+    && typeof rt.label === "string"
+    && rt.scopes && rt.scopes.global && rt.scopes.project
+    && rt.command && ["md", "toml", "skill"].includes(rt.command.format)
+    && Array.isArray(rt.command.frontmatter)
+    && rt.capabilities && typeof rt.capabilities.subagents === "boolean"
+                       && typeof rt.capabilities.hooks === "boolean"
+                       && typeof rt.capabilities.workflows === "boolean"
+                       && typeof rt.capabilities.tool_restriction === "boolean";
+  check(`${id}: complete and well-typed`, ok);
+}
+check("unknown runtime is an error, not a silent default",
+  throws(() => adapter.loadRuntime("nope")));
+
+// A runtime that claims a capability it cannot back is the one mistake the whole design rests
+// on: every `cohorte:if` branch trusts these booleans literally, and an over-claim ships the
+// strict doctrine to a runtime that cannot enforce it. Pinned against the vendor docs — see
+// each runtime's `docs` field; revisit these three lines whenever one of them is re-read.
+const withCap = (c) => RUNTIMES.filter((id) => adapter.loadRuntime(id).capabilities[c]).sort().join();
+check("hooks claimed everywhere but OpenCode (plugins are not a blocking hook)",
+  withCap("hooks") === "claude,codex,cursor,gemini", withCap("hooks"));
+check("only Claude Code claims workflows", withCap("workflows") === "claude");
+// Not a capability to branch on: a HARD requirement. The pipeline's isolation guarantee is the
+// subagent boundary, so a runtime without them cannot be supported — and must be refused loudly
+// rather than rendered into a pipeline whose central promise is silently absent.
+check("every target runtime has real subagents",
+  withCap("subagents") === RUNTIMES.slice().sort().join(), withCap("subagents"));
+check("a runtime declaring no subagents is refused, not degraded",
+  throws(() => adapter.assertSupported({ id: "x", capabilities: { subagents: false } })));
+check("…and one that has them passes the same guard",
+  !throws(() => adapter.assertSupported({ id: "x", capabilities: { subagents: true } })));
+
+// A hook runtime must declare how to talk to it, and a no-ask runtime must be flagged: gate.py
+// escalates ask→deny there, and getting this backwards silently lets a gated command run.
+for (const id of RUNTIMES) {
+  const rt = adapter.loadRuntime(id);
+  if (!rt.capabilities.hooks) { check(`${id}: declares no hook contract`, !rt.hook); continue; }
+  check(`${id}: hook contract is complete`, !!rt.hook && !!rt.hook.event
+    && ["claude", "cursor", "gemini"].includes(rt.hook.format)
+    && typeof rt.hook.supports_ask === "boolean"
+    && !!rt.scopes.project.hooks_config);
+}
+check("the ask tier is claimed only where the runtime honours it",
+  RUNTIMES.filter((id) => (adapter.loadRuntime(id).hook || {}).supports_ask).sort().join()
+    === "claude,cursor");
+
+// ------------------------------------------------------------ conditionals ---
+group("conditionals — the branch that survives is the branch that is true");
+
+// Synthetic capability sets, not real runtimes: the branch logic must stay correct however the
+// vendors' feature matrix moves, and a unit test of the parser should not depend on which
+// runtimes happen to ship today.
+const rich = { id: "rich", capabilities: { subagents: true, hooks: true, workflows: true, tool_restriction: true } };
+const bare = { id: "bare", capabilities: { subagents: false, hooks: false, workflows: false, tool_restriction: false } };
+
+const basic = ["<!-- cohorte:if hooks -->", "H", "<!-- cohorte:else -->", "NOH", "<!-- cohorte:endif -->"].join("\n");
+check("if/else keeps the taken branch", adapter.applyConditionals(basic, rich).trim() === "H");
+check("if/else keeps the else branch", adapter.applyConditionals(basic, bare).trim() === "NOH");
+
+const neg = ["<!-- cohorte:if !hooks -->", "ADVISORY", "<!-- cohorte:endif -->"].join("\n");
+check("negation works", adapter.applyConditionals(neg, bare).trim() === "ADVISORY"
+  && adapter.applyConditionals(neg, rich).trim() === "");
+
+const byId = ["<!-- cohorte:if runtime:claude -->", "CC", "<!-- cohorte:endif -->"].join("\n");
+check("runtime:<id> targets one runtime",
+  adapter.applyConditionals(byId, adapter.loadRuntime("claude")).trim() === "CC"
+  && adapter.applyConditionals(byId, adapter.loadRuntime("cursor")).trim() === "");
+
+const or = ["<!-- cohorte:if hooks workflows -->", "X", "<!-- cohorte:endif -->"].join("\n");
+check("a multi-term condition is an OR", adapter.applyConditionals(or, rich).trim() === "X");
+
+const nested = [
+  "<!-- cohorte:if subagents -->", "A",
+  "<!-- cohorte:if hooks -->", "B", "<!-- cohorte:else -->", "C", "<!-- cohorte:endif -->",
+  "<!-- cohorte:endif -->",
+].join("\n");
+check("nesting resolves inner branches inside a taken outer one",
+  adapter.applyConditionals(nested, rich).trim().split("\n").join() === "A,B");
+check("a dropped outer branch drops its inner branches whole",
+  adapter.applyConditionals(nested, bare).trim() === "");
+
+check("an unknown capability is an error, not a silently-false branch",
+  throws(() => adapter.applyConditionals("<!-- cohorte:if telepathy -->\nx\n<!-- cohorte:endif -->", rich)));
+check("an unclosed if is an error", throws(() => adapter.applyConditionals("<!-- cohorte:if hooks -->\nx", rich)));
+check("a stray endif is an error", throws(() => adapter.applyConditionals("<!-- cohorte:endif -->", rich)));
+check("two elses in one if is an error", throws(() => adapter.applyConditionals(
+  ["<!-- cohorte:if hooks -->", "<!-- cohorte:else -->", "<!-- cohorte:else -->", "<!-- cohorte:endif -->"].join("\n"), rich)));
+
+// Every marker in the real source must be resolvable for EVERY runtime — an unknown term in
+// a command nobody rendered yet would surface as an install-time crash for one runtime only.
+group("source prompts — every marker resolves for every runtime");
+const sources = [
+  ...readdirSync(join(root, "core", "commands")).map((f) => ["commands", f]),
+  ...readdirSync(join(root, "core", "agents")).map((f) => ["agents", f]),
+].filter(([, f]) => f.endsWith(".md"));
+for (const id of RUNTIMES) {
+  const rt = adapter.loadRuntime(id);
+  let bad = null;
+  for (const [dir, f] of sources) {
+    const src = readFileSync(join(root, "core", dir, f), "utf8");
+    try { adapter.applyConditionals(adapter.parseFrontmatter(src).body, rt); }
+    catch (e) { bad = `${dir}/${f}: ${e.message}`; break; }
+  }
+  check(`${id}: all ${sources.length} source files render`, !bad, bad || "");
+}
+
+// ------------------------------------------------------------ full install ---
+group("install — what each runtime actually gets on disk");
+
+const home = mkdtempSync(join(tmpdir(), "cohorte-home-"));
+const proj = mkdtempSync(join(tmpdir(), "cohorte-proj-"));
+tmps.push(home, proj);
+spawnSync("git", ["init", "-q", "."], { cwd: proj });
+const run = spawnSync(process.execPath, [join(root, "bin", "cli.js"), "install",
+  `--runtime=${RUNTIMES.join(",")}`], {
+  cwd: proj, env: { ...process.env, HOME: home, CLAUDE_CONFIG_DIR: "" }, encoding: "utf8",
+});
+check("the installer exits clean for every runtime at once", run.status === 0,
+  (run.stderr || "").slice(0, 400));
+
+for (const id of RUNTIMES) {
+  const rt = adapter.loadRuntime(id);
+  // resolvePaths reads ~ from the real homedir, so re-point it at the sandbox.
+  const p = adapter.resolvePaths(rt, "project", proj);
+  const fix = (s) => s && s.replace(process.env.HOME, home);
+  const cmdDir = fix(p.commands);
+  const buildFile = join(cmdDir, `cohorte-build${rt.command.ext}`);
+  check(`${id}: commands landed in ${rt.scopes.project.commands}`, existsSync(buildFile));
+  if (!existsSync(buildFile)) continue;
+  const build = readFileSync(buildFile, "utf8");
+
+  check(`${id}: no unresolved marker leaked into the output`, !/cohorte:(if|else|endif)/.test(build));
+  check(`${id}: the runtime preamble is present`, build.includes(`**Runtime: ${rt.label}.**`));
+
+  // Parallel dispatch is the doctrine on every runtime now; the sequential-persona fallback was
+  // removed in 2.2.0 along with any suggestion that a lead can simulate the boundary by hand.
+  check(`${id}: dispatches surfaces in parallel`, build.includes("IN PARALLEL"));
+  check(`${id}: no trace of the removed persona fallback`,
+    !build.includes("ONE PERSONA AT A TIME") && !build.includes("adopt it verbatim"));
+
+  // A path the runtime does not have is a path the model will fail to read, silently.
+  if (id !== "claude") {
+    check(`${id}: no hardcoded .claude path left in the prose`,
+      !/(?<![\w/.-])~?\/?\.claude\//.test(build), (build.match(/.{0,60}\.claude\/.{0,40}/) || [""])[0]);
+  }
+
+  // The preamble must describe the gate the way it actually works here — a blocking hook that
+  // fires regardless, or an advisory check the agent has to call. Getting this backwards is the
+  // worst single error the adapter can make: it tells the model a safety property holds when it
+  // does not.
+  if (rt.capabilities.hooks) {
+    check(`${id}: the gate is described as a blocking ${rt.hook.event} hook`,
+      build.includes("is registered as a blocking") && build.includes(rt.hook.event));
+    check(`${id}: the missing confirmation tier is stated`,
+      build.includes("no confirmation tier") === !rt.hook.supports_ask);
+  } else {
+    check(`${id}: the gate is described as an explicit check`, build.includes("gate.py --check"));
+  }
+
+  // Frontmatter the runtime does not understand is prose the model reads as instruction.
+  if (rt.command.format === "md" || rt.command.format === "skill") {
+    const fm = adapter.parseFrontmatter(build).keys.map(([k]) => k);
+    check(`${id}: only supported frontmatter keys survive`,
+      fm.every((k) => rt.command.frontmatter.includes(k)), fm.join(","));
+    if (rt.command.format === "skill") {
+      // A skill is matched on its frontmatter `name`, both for explicit invocation and for
+      // implicit selection. Without it the file installs and is simply never reachable.
+      check(`${id}: the skill carries the name it is invoked by`,
+        fm.includes("name") && /^name: cohorte-build$/m.test(build));
+      check(`${id}: skills are repo-scoped, so a clone gets the commands`,
+        rt.scopes.project.commands.startsWith(".agents/"));
+    }
+  } else {
+    check(`${id}: emitted as ${rt.command.format}, not markdown frontmatter`,
+      !build.startsWith("---\n") && /^description = "/m.test(build) && /^prompt = '''/m.test(build));
+  }
+
+  // Placeholder substitution: a token the runtime never expands must be explained, not left
+  // to look like it works.
+  if (rt.command.args && rt.command.args !== "$ARGUMENTS") {
+    check(`${id}: $ARGUMENTS rewritten to ${rt.command.args}`,
+      build.includes(rt.command.args) && !build.includes("$ARGUMENTS"));
+  } else if (!rt.command.args) {
+    check(`${id}: the unsubstituted placeholder is explained in the preamble`,
+      build.includes("does not substitute placeholders"));
+  }
+
+  for (const excluded of rt.exclude_commands || []) {
+    check(`${id}: ${excluded} is not installed (it cannot run here)`,
+      !existsSync(join(cmdDir, `${excluded}${rt.command.ext}`)));
+  }
+
+  const agentsDir = fix(p.agents) || join(fix(p.core), "agents");
+  const reviewFile = join(agentsDir, `review${rt.agent.ext || ".md"}`);
+  check(`${id}: the review agent exists as ${rt.agent.format}`, existsSync(reviewFile));
+  if (existsSync(reviewFile)) {
+    const review = readFileSync(reviewFile, "utf8");
+    // The reviewer must never be able to fix what it reports. Where the runtime can enforce
+    // that, the rendered file must carry the restriction; where it cannot, the body must say
+    // so — a reviewer that silently gains write access destroys the fix loop's evidence.
+    if (rt.agent.readonly_key) {
+      check(`${id}: the reviewer is pinned read-only (${rt.agent.readonly_key})`,
+        review.includes(rt.agent.readonly_key) && review.includes(rt.agent.readonly_value));
+    } else if (rt.capabilities.tool_restriction) {
+      // Claude expresses it as the absence of write tools in the `tools:` list.
+      check(`${id}: the reviewer's tool list carries no write tool`,
+        /^tools:.*$/m.test(review) && !/^tools:.*(Write|Edit|Bash)/m.test(review));
+    } else {
+      check(`${id}: the reviewer is told read-only is on it`,
+        review.includes("read-only **by discipline**") || review.includes("read-only by discipline"));
+    }
+    // An Anthropic model alias in another vendor's agent file either errors or is ignored.
+    check(`${id}: no Anthropic model alias leaked into the agent file`,
+      id === "claude" || !/^\s*model\s*[:=]/m.test(review), (review.match(/^.*model.*$/m) || [""])[0]);
+  }
+  // Every non-Claude runtime shares one `.cohorte` core, so this registry must ACCUMULATE.
+  // A single-record file let each install erase the previous runtime's entry.
+  const rtJson = join(fix(p.core), "pipeline", "runtimes.json");
+  check(`${id}: survives in runtimes.json after the other installs`, existsSync(rtJson)
+    && !!JSON.parse(readFileSync(rtJson, "utf8"))[id]);
+  check(`${id}: the gate script ships with the core`, existsSync(join(fix(p.core), "hooks", "gate.py")));
+  check(`${id}: workflows ship only where a workflow engine exists`,
+    existsSync(join(fix(p.core), "workflows")) === rt.capabilities.workflows);
+
+  // Templates are resolved in place at install time, so a shared core would let the LAST
+  // runtime installed decide what every other one reads. Each core is its own directory
+  // precisely to prevent that; assert the resolution actually matches this runtime.
+  const step = join(fix(p.core), "templates", "steps", "init-pipeline", "04-write-render.md");
+  if (existsSync(step)) {
+    const text = readFileSync(step, "utf8");
+    check(`${id}: templates carry no unresolved marker`, !/cohorte:(if|else|endif)/.test(text));
+    check(`${id}: the settings/hook step matches this runtime`,
+      text.includes("Write `.claude/settings.json`") === rt.capabilities.hooks);
+  }
+}
+
+// The project state — gate config, preflight stamp, metrics — describes the repo, not the
+// agent driving it, and must NOT fork per runtime.
+group("state — one project, one gate config");
+const stateDirs = new Set(RUNTIMES.map((id) => adapter.stateDir(adapter.loadRuntime(id))));
+check("every non-Claude runtime shares one state dir", stateDirs.size === 2
+  && stateDirs.has(".claude") && stateDirs.has(".cohorte"));
+check("but each keeps its own rendered core",
+  new Set(RUNTIMES.map((id) => adapter.loadRuntime(id).scopes.project.core)).size === RUNTIMES.length);
+
+// A config dir with a space in it is not exotic: a desktop host puts CLAUDE_CONFIG_DIR under
+// `~/Library/Application Support/…`. An unquoted path there splits in the shell, python reports
+// `can't open file '/Users/x/Library/Application'`, and EVERY tool call in the session fails —
+// including the ones the human would need to undo it. Assert the registration is quoted, per
+// runtime, and that the installer still recognises its own entry (or a re-install duplicates it).
+group("hook registration — paths with spaces");
+{
+  const spacedHome = mkdtempSync(join(tmpdir(), "cohorte home-"));
+  const spacedProj = mkdtempSync(join(tmpdir(), "cohorte proj-"));
+  tmps.push(spacedHome, spacedProj);
+  spawnSync("git", ["init", "-q", "."], { cwd: spacedProj });
+  const env = { ...process.env, HOME: spacedHome, CLAUDE_CONFIG_DIR: join(spacedHome, ".claude") };
+  const args = [join(root, "bin", "cli.js"), "install", `--runtime=${RUNTIMES.join(",")}`];
+  const first = spawnSync(process.execPath, args, { cwd: spacedProj, env, encoding: "utf8" });
+  check("installs into a path containing a space", first.status === 0,
+    (first.stderr || "").slice(0, 300));
+  // Claude registers its hook only on a GLOBAL install — project-scope settings.json is
+  // /cohorte-init-pipeline's job — so exercise that scope too.
+  const gargs = [join(root, "bin", "cli.js"), "install", "--global", "--runtime=claude"];
+  spawnSync(process.execPath, gargs, { cwd: spacedProj, env, encoding: "utf8" });
+  // Re-install BOTH: the reconcile must match its own quoted entry, or every run stacks another.
+  spawnSync(process.execPath, args, { cwd: spacedProj, env, encoding: "utf8" });
+  spawnSync(process.execPath, gargs, { cwd: spacedProj, env, encoding: "utf8" });
+
+  for (const id of RUNTIMES) {
+    const rt = adapter.loadRuntime(id);
+    if (!rt.capabilities.hooks) continue;
+    const cfgSpec = (id === "claude" ? rt.scopes.global : rt.scopes.project).hooks_config;
+    const cfgPath = cfgSpec.startsWith("~/")
+      ? join(spacedHome, cfgSpec.slice(2)) : join(spacedProj, cfgSpec);
+    if (!existsSync(cfgPath)) { check(`${id}: hook config written`, false, cfgPath); continue; }
+    const hooks = JSON.parse(readFileSync(cfgPath, "utf8")).hooks || {};
+    const entries = hooks[rt.hook.event] || [];
+    const cmds = entries.flatMap(e => e.command ? [e.command] : (e.hooks || []).map(h => h.command));
+    const ours = cmds.filter(c => /gate\.py/.test(c));
+    check(`${id}: the gate path is quoted`, ours.length > 0 && ours.every(c => /"[^"]*gate\.py"/.test(c)),
+      ours.join(" | "));
+    check(`${id}: re-installing does not stack a second registration`, ours.length === 1,
+      `${ours.length} entries`);
+  }
+}
+
+// CLAUDE_CONFIG_DIR moves Claude Code's whole tree — a desktop host points it at
+// `~/Library/Application Support/…`. The registry declares those paths as `~/.claude`, and
+// resolving them from the homedir instead of the override split the install in half: the core
+// went to the REAL `~/.claude` while the hook was registered in the override. A scratch install
+// therefore wrote into the user's actual global core, silently.
+group("CLAUDE_CONFIG_DIR is honoured, not half-honoured");
+{
+  const home = mkdtempSync(join(tmpdir(), "cohorte-home-"));
+  const cfg = mkdtempSync(join(tmpdir(), "cohorte-cfg-"));   // deliberately NOT under home
+  const proj = mkdtempSync(join(tmpdir(), "cohorte-proj-"));
+  tmps.push(home, cfg, proj);
+  spawnSync("git", ["init", "-q", "."], { cwd: proj });
+  const r = spawnSync(process.execPath,
+    [join(root, "bin", "cli.js"), "install", "--global", "--runtime=claude"],
+    { cwd: proj, env: { ...process.env, HOME: home, CLAUDE_CONFIG_DIR: cfg }, encoding: "utf8" });
+
+  check("the global install succeeds under an overridden config dir", r.status === 0,
+    (r.stderr || "").slice(0, 300));
+  check("the core lands in the override", existsSync(join(cfg, "pipeline", "VERSION")));
+  check("the commands land in the override", existsSync(join(cfg, "commands", "cohorte-build.md")));
+  check("the hook is registered in the override", existsSync(join(cfg, "settings.json")));
+  check("nothing is written to the home default",
+    !existsSync(join(home, ".claude", "pipeline", "VERSION")));
+}
+
+// Claude Code must not regress: it is the runtime everyone is already on.
+group("no regression — the Claude install keeps its shape");
+check("commands still in .claude/commands", existsSync(join(proj, ".claude", "commands", "cohorte-build.md")));
+check("agents still in .claude/agents", existsSync(join(proj, ".claude", "agents", "review.md")));
+check("the model pin survives the render",
+  /^model: sonnet$/m.test(readFileSync(join(proj, ".claude", "commands", "cohorte-build.md"), "utf8")));
+check("the subagent name survives the render",
+  /^name: review$/m.test(readFileSync(join(proj, ".claude", "agents", "review.md"), "utf8")));
+// 2.2.0 retired /cohorte-loop. Copy-over never deletes, so the scrub is the only thing standing
+// between an upgrade and a decoy command the model can still fire — assert it on the layout that
+// actually had one installed.
+check("the retired /cohorte-loop is not installed",
+  !existsSync(join(proj, ".claude", "commands", "cohorte-loop.md")));
+
+for (const d of tmps) rmSync(d, { recursive: true, force: true });
+console.log(failures ? `\ntest-adapter: ${failures} FAILED` : "\ntest-adapter: OK");
+process.exit(failures ? 1 : 0);

package/scripts/test-dashboard.mjs

@@ -402,6 +402,76 @@ console.log("index.js — HTTP guards");
   eq("an unknown API route 404s", (await fetch(`${base}/api/nope`)).status, 404);
 }
 
+// ── runtime.js + a non-Claude layout ────────────────────────────────────────
+// Every path-dependent check used to assume `.claude/`. On a repo driven from Cursor that
+// reported a healthy install as three ❌ and a ⚠️ — no core, no rendered agent, artifacts not
+// ignored, hook not registered — and every one was wrong. A false red is worse than no check:
+// it sends a human fixing something that is not broken.
+console.log("doctor.js — a non-Claude runtime layout");
+{
+  const d = scratch();
+  const g = join(d, "global-claude");
+  mkdirSync(g, { recursive: true });
+
+  const core = join(d, ".cohorte", "cursor");
+  mkdirSync(join(core, "pipeline"), { recursive: true });
+  writeFileSync(join(core, "pipeline", "VERSION"), "9.9.9\n");
+  writeFileSync(join(core, "pipeline", "runtimes.json"), JSON.stringify({
+    cursor: {
+      label: "Cursor", scope: "project", core_version: "9.9.9",
+      capabilities: { subagents: true, hooks: true, workflows: false, tool_restriction: true },
+      paths: {
+        core, commands: join(d, ".cursor", "commands"), agents: join(d, ".cursor", "agents"),
+        hooks_config: join(d, ".cursor", "hooks.json"), state: ".cohorte",
+      },
+    },
+  }));
+  mkdirSync(join(d, ".cursor", "agents"), { recursive: true });
+  writeFileSync(join(d, ".cursor", "agents", "api.md"), "---\nname: api\n---\n");
+  writeFileSync(join(d, ".cursor", "hooks.json"), JSON.stringify({
+    version: 1,
+    hooks: { beforeShellExecution: [{ command: `python3 ${core}/hooks/gate.py --runtime cursor` }] },
+  }));
+  mkdirSync(join(d, ".cohorte"), { recursive: true });
+  const gate = { deny: ["rm -rf /"], ask: [], ask_on_default_branch: [], default_branch: "main" };
+  writeFileSync(join(d, ".cohorte", "gate-config.json"),
+    JSON.stringify({ ...gate, preflight: { enabled: false } }));
+  writeFileSync(join(d, ".gitignore"),
+    ".cohorte/preflight.ok\n.cohorte/pipeline-metrics.jsonl\nspecs/reports/\n");
+  writeFileSync(join(d, "PIPELINE.md"), [
+    "```yaml pipeline-profile", "name: demo",
+    "surfaces:", "  - key: api", "    path: src/api", "    agent: api",
+    "gate:", "  deny:", "    - rm -rf /", "  default_branch: main",
+    "  preflight:", "    enabled: false", "```",
+  ].join("\n"));
+
+  const s = await state({ projectRoot: d, globalDir: g, cliVersion: "9.9.9" });
+  const pick = id => s.checks.find(c => c.id === id) || {};
+  const st = id => pick(id).status;
+  const dt = id => pick(id).detail;
+
+  eq("the runtime is discovered from runtimes.json", s.runtimes.map(r => r.id), ["cursor"]);
+  check("the core in .cohorte/<id>/ counts as installed", st("core") === "ok", dt("core"));
+  check("agents are looked for in .cursor/agents", st("agents") === "ok", dt("agents"));
+  check("gate-config is read from .cohorte, not .claude", st("gate") === "ok", dt("gate"));
+  check("artifact paths are named against the right state dir",
+    st("artifacts") === "ok" && !/\.claude/.test(dt("artifacts")), dt("artifacts"));
+  // Cursor's registration is a flat {command} under beforeShellExecution — read with Claude's
+  // matcher-group shape it looks absent, which is exactly the false red this guards.
+  check("the Cursor hook envelope is recognised", st("hooks") === "ok", dt("hooks"));
+  check("workflows are skipped, not reported missing",
+    st("workflows") === "skip" && /Cursor/.test(dt("workflows")), dt("workflows"));
+  check("nothing is reported broken on a healthy non-Claude install",
+    s.summary.bad === 0 && s.summary.warn === 0, JSON.stringify(s.summary));
+
+  // The metrics sink follows `<state>` too.
+  writeFileSync(join(d, ".cohorte", "pipeline-metrics.jsonl"),
+    JSON.stringify({ ts: "2026-01-01T00:00:00Z", feature: "f", phase: "build", seconds: 10,
+      surfaces: { api: "ok" } }) + "\n");
+  check("metrics are read from the runtime's state dir",
+    metrics({ projectRoot: d, globalDir: g }).batches === 1);
+}
+
 for (const d of tmps) { try { rmSync(d, { recursive: true, force: true }); } catch { /* best effort */ } }
 console.log("");
 if (failures) { console.error(`test-dashboard: ${failures} failure(s)`); process.exit(1); }

package/scripts/test-gate.mjs

@@ -353,6 +353,68 @@ console.log("gate.py — worktree awareness");
   }
 }
 
+// ---------------------------------------------------------------------------
+// Runtime dialects. Four runtimes host this hook and none of them agree on the
+// envelope. A verdict emitted in the wrong shape is read as "allow" by every one of
+// them — the gate would look installed, print JSON, and block nothing. Two of them
+// also have no confirmation tier, where an honest `ask` must become a `deny` rather
+// than fall through.
+console.log("gate.py — runtime dialects");
+{
+  const d = scratch();
+  gitRepo(d, "main");
+  writeConfig(d, {
+    deny: ["rm -rf /"], ask: ["git push"], ask_on_default_branch: [],
+    default_branch: "main", preflight: { enabled: true, agents: ["review"] },
+  });
+  const raw = (payload, ...args) => {
+    const r = spawnSync(python, [GATE, ...args], {
+      input: JSON.stringify(payload), encoding: "utf8",
+      env: { ...process.env, CLAUDE_PROJECT_DIR: d },
+    });
+    let json = null;
+    try { json = JSON.parse((r.stdout || "").trim()); } catch { /* no verdict */ }
+    return { json, status: r.status };
+  };
+  const push = { tool_name: "Bash", tool_input: { command: "git push" }, cwd: d };
+
+  const cc = raw(push, "--runtime", "claude");
+  check("claude: ask stays an ask, in the PreToolUse envelope",
+    cc.json?.hookSpecificOutput?.permissionDecision === "ask");
+  check("no --runtime flag behaves exactly as claude (pre-adapter registrations)",
+    raw(push).json?.hookSpecificOutput?.permissionDecision === "ask");
+
+  const cx = raw(push, "--runtime", "codex");
+  check("codex: ask escalates to deny (its `ask` is parsed but never honoured)",
+    cx.json?.hookSpecificOutput?.permissionDecision === "deny");
+  check("…and the reason says why it was refused rather than queried",
+    /no confirmation tier/.test(cx.json?.hookSpecificOutput?.permissionDecisionReason || ""));
+
+  // Cursor sends the command at the top level and names no tool.
+  const cu = raw({ hook_event_name: "beforeShellExecution", command: "git push", cwd: d },
+    "--runtime", "cursor");
+  check("cursor: its own envelope, and the top-level command is found",
+    cu.json?.permission === "ask" && typeof cu.json?.user_message === "string");
+  const cuDeny = raw({ hook_event_name: "beforeShellExecution", command: "rm -rf /", cwd: d },
+    "--runtime", "cursor");
+  check("cursor: a deny also exits 2 (its documented blocking code)",
+    cuDeny.json?.permission === "deny" && cuDeny.status === 2);
+
+  const ge = raw({ tool_name: "run_shell_command", tool_input: { command: "rm -rf /" }, cwd: d },
+    "--runtime", "gemini");
+  check("gemini: BeforeTool envelope, and run_shell_command is recognised as the shell",
+    ge.json?.decision === "deny" && typeof ge.json?.reason === "string");
+
+  // Gemini exposes each subagent as a tool of its own name, so the phase gate has to fire
+  // on `tool_name: review` — not only on Claude's `Task` + subagent_type shape.
+  const geDispatch = raw({ tool_name: "review", tool_input: {}, cwd: d }, "--runtime", "gemini");
+  check("gemini: a subagent-as-tool dispatch still hits the preflight phase gate",
+    geDispatch.json?.decision === "deny"
+      && /preflight/i.test(geDispatch.json?.reason || ""));
+  check("an unrelated tool is never gated on any runtime",
+    raw({ tool_name: "read_file", tool_input: {}, cwd: d }, "--runtime", "gemini").json === null);
+}
+
 for (const d of tmps) { try { rmSync(d, { recursive: true, force: true }); } catch { /* best effort */ } }
 
 console.log("");

package/scripts/validate-core.mjs

@@ -24,8 +24,8 @@ const frontmatter = (text) => {
 // Interactive commands must stay unpinned (they inherit on purpose).
 const PINNED = ["cohorte-build", "cohorte-review", "cohorte-fix", "cohorte-ship",
   "cohorte-audit", "cohorte-refactor", "cohorte-doctor", "cohorte-align-ds",
-  "cohorte-update-pipeline", "cohorte-loop"];
-const UNPINNED = ["cohorte-brainstorm", "cohorte-spec", "cohorte-init-pipeline"];
+  "cohorte-update-pipeline"];
+const UNPINNED = ["cohorte-brainstorm", "cohorte-spec", "cohorte-init-pipeline", "cohorte-patch"];
 
 // Every command must carry the `cohorte-` prefix. This replaces the old RESERVED
 // blocklist, which chased collisions one name at a time and always lagged: a command
@@ -129,26 +129,28 @@ const steps = join(root, "core/templates/steps/init-pipeline");
 if (!existsSync(steps) || readdirSync(steps).length === 0)
   fail("core/templates/steps/init-pipeline", "router step files missing/empty");
 
-// ── telemetry coverage ──────────────────────────────────────────────────────
-// The funnel is only readable if every one of its stages pings — a single missing
-// one silently truncates it (that is how /cohorte-review and /cohorte-fix went unreported
-// until 1.2.3). The phase list here must match SCHEMA.md §Telemetry's table.
-// These are telemetry PHASE names, not command names — they stay unprefixed even though
-// the commands that emit them are now `/cohorte-*`. The phase is a wire field allowlisted
-// in telemetry-send.sh and keyed on by the collector's existing dataset; prefixing it would
-// orphan every ping ever sent. Command file = PREFIX + phase.
-const FUNNEL = ["brainstorm", "spec", "build", "review", "fix", "ship"];
-for (const c of FUNNEL)
-  if (!/usage ping/i.test(read(`core/commands/${PREFIX}${c}.md`)))
-    fail(`core/commands/${PREFIX}${c}.md`, "funnel command with no usage ping — breaks the telemetry funnel");
-// …and nothing outside the funnel may ping (consent text scopes it to the funnel).
-for (const f of readdirSync(join(root, "core/commands"))) {
-  const c = f.replace(/\.md$/, "").replace(new RegExp(`^${PREFIX}`), "");
-  // `telemetry-send.sh` + an argument = a call site; the bare filename (e.g. /cohorte-doctor
-  // listing the scripts it checks for) is a mention, not a ping.
-  if (!FUNNEL.includes(c) && /telemetry-send\.sh +\S|usage ping/i.test(read(`core/commands/${f}`)))
-    fail(`core/commands/${f}`, "non-funnel command pings telemetry — outside the consented scope");
-}
+// ── no telemetry ────────────────────────────────────────────────────────────
+// Telemetry was removed wholesale in 2.3.0: the shipped `telemetry-send.sh`, the
+// per-phase pings, the consent question, the `telemetry:` config block, the collector
+// endpoint. This check is the ratchet — it fails if any of it creeps back into the
+// core, which is easy to do by copying an old command file that still chains a ping.
+// Deliberately broad: the whole point is that there is nothing left to send with.
+const NO_TELEMETRY = /telemetry|usage ping/i;
+// One exemption, and it is the opposite of a regression: /cohorte-update-pipeline is what
+// DELETES the leftover `telemetry:` block from configs seeded before 2.3.0, so it is the one
+// file that must still name the thing. Narrow on purpose — a filename, not a pattern.
+const TELEMETRY_SCRUBBER = "core/commands/cohorte-update-pipeline.md";
+const walk = (dir) => readdirSync(join(root, dir), { withFileTypes: true }).flatMap((e) =>
+  e.isDirectory() ? walk(`${dir}/${e.name}`) : [`${dir}/${e.name}`]);
+for (const dir of ["core/commands", "core/agents", "core/templates", "core/workflows"])
+  for (const rel of walk(dir)) {
+    if (!/\.(md|js)$/.test(rel) || rel === TELEMETRY_SCRUBBER) continue;
+    if (NO_TELEMETRY.test(read(rel)))
+      fail(rel, "mentions telemetry — it was removed in 2.3.0; nothing may ping or ask for consent");
+  }
+// …and the exempt file may only REMOVE it: naming a send/ping/consent path there is still a bug.
+if (/usage ping|telemetry-send|consent/i.test(read(TELEMETRY_SCRUBBER)))
+  fail(TELEMETRY_SCRUBBER, "may reference the retired telemetry block only to delete it — no ping, sender or consent flow");
 
 // ── kanban call sites ───────────────────────────────────────────────────────
 // Every pipeline stage moves a card, and a stage that only *describes* the move
@@ -158,7 +160,7 @@ for (const f of readdirSync(join(root, "core/commands"))) {
 // having opened neither the config nor PIPELINE.md, and a merged feature's card
 // stayed in "Ready to build". `kanban-move.sh auto` moved resolution into the
 // script; this keeps it there. Prose is not a call site — the literal invocation is.
-const KANBAN_STAGES = ["brainstorm", "spec", "build", "review", "fix", "ship"];
+const KANBAN_STAGES = ["brainstorm", "spec", "build", "review", "fix", "ship", "patch"];
 for (const c of KANBAN_STAGES) {
   const path = `core/commands/${PREFIX}${c}.md`;
   const text = read(path);
@@ -174,7 +176,7 @@ for (const c of KANBAN_STAGES) {
 // ── shipped scripts ─────────────────────────────────────────────────────────
 // Every scripts/*.sh must be copied by BOTH shell installers. Callers chain these
 // with `|| true`, so one an installer forgets is a silent no-op forever — no kanban
-// card moves, no telemetry ping, no error. CI is the only place this is loud.
+// card moves, no error. CI is the only place this is loud.
 // The third installer, bin/cli.js (what `npx cohorte` runs), copies by rule rather
 // than by name, so grepping for filenames can't see it — ci.yml dry-runs it into a
 // scratch HOME and asserts the same postconditions instead. Both are needed: this