cohorte 2.10.0 → 3.0.0-dev.0

package/README.md

@@ -13,6 +13,13 @@
 
 </div>
 
+> **V3 migration status:** the V3 runtime-independent pipeline is under active migration. V2 sources are retained
+> under [`legacy/v2`](legacy/v2); V3 builds are immutable, snapshot-pinned and can be exercised offline with the
+> fake runtime. See [`docs/v3`](docs/v3/PLAN.md) for the implementation plan and release gates.
+
+For maintainers, see the [maintenance and release guide](docs/guide/maintainers.md) for the architecture, test
+matrix, troubleshooting, PR workflow and npm/GitHub release procedure.
+
 A **portable, stack-agnostic multi-agent pipeline** for your coding agent — Claude Code, Codex CLI,
 Cursor, Gemini CLI or OpenCode. Install it once globally, then one command per project
 (`/cohorte-init-pipeline`) adapts it to that project's stack.

package/assets/manifest.json

@@ -0,0 +1,193 @@
+{
+  "manifestVersion": 1,
+  "cohorteVersion": "3.0.0-dev.0",
+  "algorithm": "sha256",
+  "treeSha256": "6858783a1463d0926c2c0487c6542ec35a52ee0a6bc2b4e11ffe5614b5b826fc",
+  "files": [
+    {
+      "path": "migrations/config/README.md",
+      "size": 800,
+      "sha256": "0581614159274a708a345fd274b354bbeb6890cc506c14ee79aebc9ea7bf75dc"
+    },
+    {
+      "path": "migrations/state/0001_init.sql",
+      "size": 12500,
+      "sha256": "68fc178ae3ab37546f92a198612705c73757294a7ded00f838e1b14364b0885d"
+    },
+    {
+      "path": "prompts/README.md",
+      "size": 743,
+      "sha256": "f1cd0d36eb65f1a3fdfd86d4b4fbef94d01cb1c64c9b69777d3e3efe5fb0d8bf"
+    },
+    {
+      "path": "prompts/agents/fixer.md",
+      "size": 437,
+      "sha256": "05bf785d6572519c65510aad3cd6681b80c3b39a601c1f06ad16ac6c69fe1576"
+    },
+    {
+      "path": "prompts/agents/implementer.md",
+      "size": 572,
+      "sha256": "61818393d6374a269a2855ceef550aa098aa91f2c2f3c7bb240a0907db270c55"
+    },
+    {
+      "path": "prompts/agents/reviewer.md",
+      "size": 476,
+      "sha256": "8d3bc1626687ac0b57b0e9c0e6fcb417eedfe03483597894c1f807e47877cea1"
+    },
+    {
+      "path": "prompts/agents/security-reviewer.md",
+      "size": 376,
+      "sha256": "081771595c2fcb4a7dfe61c484849efa30f39e33cb3ebe28120a0dc0d552562c"
+    },
+    {
+      "path": "prompts/phases/build.md",
+      "size": 286,
+      "sha256": "11eb5fe4c016808d8a2ea51ad0f1aeb25a463bce51efba1b8c517ff817fb905b"
+    },
+    {
+      "path": "prompts/phases/review.md",
+      "size": 284,
+      "sha256": "42dcd924272996207aa3a6ef94898596f85f7665c6904e4c690b67d7bd978405"
+    },
+    {
+      "path": "prompts/phases/test.md",
+      "size": 267,
+      "sha256": "7cf4341667ee619a4c7838d449819dc8bb7869058ae68fe9520abad8fc8bdbad"
+    },
+    {
+      "path": "prompts/system.md",
+      "size": 692,
+      "sha256": "d05b7408e95682125dae33318b0ba806daa244975b971d0bca1bd4bc981c1e92"
+    },
+    {
+      "path": "schemas/agent-output.schema.json",
+      "size": 4590,
+      "sha256": "3c0b91b2330d497d952bf47c4295367c99b98e5c53d4c3f6a2dbc7ea09395ed9"
+    },
+    {
+      "path": "schemas/auth-status.schema.json",
+      "size": 1947,
+      "sha256": "828168eba9417877bfd23ecd9060354eb6c12975d7ba43a4af52893f5ca345bd"
+    },
+    {
+      "path": "schemas/command-result.schema.json",
+      "size": 3987,
+      "sha256": "6948a703d8cfbb827850d756710b3d5c989ed1c87518f5b45c5d56bc6534162f"
+    },
+    {
+      "path": "schemas/commands.schema.json",
+      "size": 23292,
+      "sha256": "7e573865f4b201d22cea48327881d46e01fd5d7520374acbd3bd957b836706fd"
+    },
+    {
+      "path": "schemas/config.schema.json",
+      "size": 63320,
+      "sha256": "8f8187f9eadce71291c8221f317d23911542774711023e958871af641867912c"
+    },
+    {
+      "path": "schemas/doctor-report.schema.json",
+      "size": 2074,
+      "sha256": "7f9e2186b6b43c2398c9f6cc55051be5f46c3685218b0648bc1b447a7feecc12"
+    },
+    {
+      "path": "schemas/events.schema.json",
+      "size": 251485,
+      "sha256": "95aa94c7378486b73ed9d2d71abe46b757c7c2174759455cbfe927df36fbf9b7"
+    },
+    {
+      "path": "schemas/fake-script.schema.json",
+      "size": 14080,
+      "sha256": "1a98dd73d99a457ff79ea0648029207a8fb59b15856693c72577abdbf5cbedd7"
+    },
+    {
+      "path": "schemas/inspect.schema.json",
+      "size": 99921,
+      "sha256": "122d7bc2c60fc24db0bfea6baf658470901138c2a62074aab12dd0cd7f1b80f4"
+    },
+    {
+      "path": "schemas/manifest.schema.json",
+      "size": 1651,
+      "sha256": "fb18ed78b25079fb120f6002b8eb5b5963f4fea78a231e0d69f62b16262618eb"
+    },
+    {
+      "path": "schemas/ownership.schema.json",
+      "size": 1253,
+      "sha256": "00110058df20db669cf4f1ad79038b7b91c3b625e0e2469a549b00506694cd4e"
+    },
+    {
+      "path": "schemas/policy-verdict.schema.json",
+      "size": 6630,
+      "sha256": "1edda749d3dcdecb625730c1e55e9fd31e335d08968040db5e090b31e98b57fd"
+    },
+    {
+      "path": "schemas/project-model.schema.json",
+      "size": 17899,
+      "sha256": "195f0d0d735dfb1cef324ff5fe46e527bfee799a058ea8e97bf54d94e60c0163"
+    },
+    {
+      "path": "schemas/project-status.schema.json",
+      "size": 5545,
+      "sha256": "e6abef793f7c29f897e765b34ab79b1d6f3aa48e5cf9686f8c6e78694914811e"
+    },
+    {
+      "path": "schemas/reconcile-plan.schema.json",
+      "size": 3649,
+      "sha256": "c52999f1813c20ed1acafad261b94e5931c4833c2fea2ce6e8963bb832d7fcaa"
+    },
+    {
+      "path": "schemas/run-diff.schema.json",
+      "size": 4051,
+      "sha256": "c4eaaade2682f05357d2887f20cc35649692f8db3e272c2388a4d35f8797bbfd"
+    },
+    {
+      "path": "schemas/run-snapshot-manifest.schema.json",
+      "size": 57820,
+      "sha256": "a3cf53b3b88fefcdacbc15178db8e0d062ee2e0884b4d0fc23c2812ba5c60c6b"
+    },
+    {
+      "path": "schemas/run-state.schema.json",
+      "size": 50948,
+      "sha256": "1d5a0b2d0eacf4e000475a4e162b7e600478b99f435a0f0b4d87c6b68dbe19f1"
+    },
+    {
+      "path": "schemas/runtime-capabilities.schema.json",
+      "size": 33246,
+      "sha256": "0c718764ac6b3417017f3a8106b687da408f906240f2d3ee8587738a1d679ebb"
+    },
+    {
+      "path": "schemas/sandbox-capabilities.schema.json",
+      "size": 2035,
+      "sha256": "e4289a06bb07016d3a7c51cfb97c2a0e7bc2a08c273d038eae1a85231881cb8e"
+    },
+    {
+      "path": "schemas/skill.schema.json",
+      "size": 1751,
+      "sha256": "f3af598c0fe93e658888f8e9834bee7ffdd550abc34fcb71e7799accf75d6040"
+    },
+    {
+      "path": "schemas/spec.schema.json",
+      "size": 4528,
+      "sha256": "1953464cd0b6cbf079715aa9d9608d727d9a4c1192840e21bdf53a8aca989cf2"
+    },
+    {
+      "path": "schemas/tool-catalogue.schema.json",
+      "size": 16580,
+      "sha256": "89a2a4486786126a8dbff3955aa8d4849e9c49e2da7bdc623fd07518a379388f"
+    },
+    {
+      "path": "schemas/trust-record.schema.json",
+      "size": 843,
+      "sha256": "7a0a2bf557d8fec22a7b8acbe5af932e5c96432a76915f6e1a136e47b6a2208d"
+    },
+    {
+      "path": "skills/README.md",
+      "size": 465,
+      "sha256": "2523ecede1932d3175d197f7fb19dc0d1fd7b2d0719d4520e627d5c201a27492"
+    },
+    {
+      "path": "skills/inspect-surface.md",
+      "size": 234,
+      "sha256": "a4bea5894563c243e561bebcf610021756318ff888a524e108c8af5f991a9b87"
+    }
+  ]
+}

package/assets/migrations/config/README.md

@@ -0,0 +1,12 @@
+# migrations/config/
+
+Configuration migrations (DESIGN §14 ".cohorte/", spec §14): numbered scripts that upgrade an older
+`.cohorte/config.yaml` (or the state schema it points at) forward, never in place without a backup. State-store
+migrations live beside the store contract (`@cohorte/persistence`); this directory is for the PROJECT
+CONFIGURATION file itself, run by `cohorte migrate`.
+
+`scripts/embed-assets.ts` copies this whole directory (and its sibling `migrations/` roots, if any are added
+later) into `apps/cli/assets/migrations/**` and records it in `assets/manifest.json` (DESIGN 1.4 step 2).
+
+This directory is empty at G0 on purpose: the config schema has not moved yet, so there is nothing to migrate
+from. The first entry lands with the unit that first breaks config compatibility.

package/assets/migrations/state/0001_init.sql

@@ -0,0 +1,154 @@
+-- Cohorte state store, schema 1 (DESIGN 2.4). FROZEN in Wave 0: a change is a NEW numbered migration.
+-- Every table is STRICT, every JSON column carries CHECK (json_valid(...)), and every table is column-for-column
+-- equal to its record type (packages/persistence/src/records.ts, TABLE_COLUMNS; proved by the DDL parity test).
+-- The migrator runs this file inside one transaction and records it in `migrations` itself.
+
+CREATE TABLE migrations ( id INTEGER PRIMARY KEY, name TEXT NOT NULL, sha256 TEXT NOT NULL, applied_at TEXT NOT NULL,
+  cohorte_version TEXT NOT NULL ) STRICT;
+
+CREATE TABLE meta ( key TEXT PRIMARY KEY, value TEXT NOT NULL ) STRICT, WITHOUT ROWID;
+
+-- profile: NO SQL CHECK. ADR-0018 is provisional: the known profiles are validated in TypeScript (table registry), so a
+-- fourth profile is not a state migration.
+-- The six columns marked (*) are NULL while the run is IDLE: only the HOST can compute them, behind the T04 guards
+-- snapshot.captured, runtime.pin-valid and repo.base-resolved, and it fills them in the T04 transaction together with
+-- pipeline.started. The CLI writes what it knows when it creates the row: profile, table_version, spec, title,
+-- base_branch (the requested one) and pinned_install_dir (NOT NULL: a run belongs to its install from its first byte).
+CREATE TABLE runs ( run_id TEXT PRIMARY KEY, profile TEXT NOT NULL, table_version INTEGER NOT NULL,
+  spec_id TEXT NOT NULL, spec_sha256 TEXT NOT NULL, title TEXT NOT NULL, state TEXT NOT NULL, resume_to TEXT,
+  stop_json TEXT CHECK (stop_json IS NULL OR json_valid(stop_json)),
+  last_error_json TEXT CHECK (last_error_json IS NULL OR json_valid(last_error_json)),
+  last_sequence INTEGER NOT NULL DEFAULT 0, last_hash TEXT NOT NULL DEFAULT '', version INTEGER NOT NULL DEFAULT 0,
+  snapshot_digest TEXT /* (*) */,
+  runtime_pin_json TEXT /* (*) */ CHECK (runtime_pin_json IS NULL OR json_valid(runtime_pin_json)),
+  plan_json TEXT /* (*) */ CHECK (plan_json IS NULL OR json_valid(plan_json)),
+  pinned_install_dir TEXT NOT NULL,
+  base_branch TEXT NOT NULL, base_sha TEXT /* (*) */, integration_branch TEXT /* (*) */, integration_head TEXT,
+  approved_tree_digest TEXT,
+  skip_waivers_json TEXT CHECK (skip_waivers_json IS NULL OR json_valid(skip_waivers_json)),
+  zones_json TEXT /* (*) */ CHECK (zones_json IS NULL OR json_valid(zones_json)),
+  host_id TEXT, host_pid INTEGER, host_start_token TEXT, host_heartbeat_at TEXT,
+  cancel_requested INTEGER NOT NULL DEFAULT 0 CHECK (cancel_requested IN (0, 1)),
+  pause_requested INTEGER NOT NULL DEFAULT 0 CHECK (pause_requested IN (0, 1)),
+  schema_version INTEGER NOT NULL, cohorte_version TEXT NOT NULL,
+  purgeable INTEGER NOT NULL DEFAULT 0 CHECK (purgeable IN (0, 1)),
+  started_at TEXT NOT NULL, updated_at TEXT NOT NULL, ended_at TEXT,
+  CHECK (state IN ('IDLE','CANCELLED','FAILED') OR (snapshot_digest IS NOT NULL AND runtime_pin_json IS NOT NULL
+    AND plan_json IS NOT NULL AND base_sha IS NOT NULL AND integration_branch IS NOT NULL AND zones_json IS NOT NULL))
+) STRICT;
+CREATE INDEX runs_by_state ON runs(state, started_at);
+
+CREATE TABLE events ( run_id TEXT NOT NULL REFERENCES runs(run_id), sequence INTEGER NOT NULL CHECK (sequence >= 1),
+  event_id TEXT NOT NULL UNIQUE, type TEXT NOT NULL, timestamp TEXT NOT NULL, source TEXT NOT NULL,
+  phase_run_id TEXT, agent_id TEXT, causation_id TEXT, severity TEXT NOT NULL, summary TEXT NOT NULL,
+  envelope TEXT NOT NULL CHECK (json_valid(envelope)),          -- the full SEALED envelope, canonical JSON: the hashed unit
+  prev_hash TEXT NOT NULL, hash TEXT NOT NULL,                   -- hash = sha256(prev_hash || '\n' || envelope): local append-only journal (spec 23)
+  PRIMARY KEY (run_id, sequence) ) STRICT, WITHOUT ROWID;
+CREATE INDEX events_by_type ON events(run_id, type, sequence);
+CREATE TRIGGER events_no_update BEFORE UPDATE ON events BEGIN SELECT RAISE(ABORT, 'events are append-only'); END;
+CREATE TRIGGER events_no_delete BEFORE DELETE ON events WHEN (SELECT purgeable FROM runs WHERE run_id = OLD.run_id) = 0
+  BEGIN SELECT RAISE(ABORT, 'events are append-only'); END;
+
+CREATE TABLE transitions ( transition_id TEXT PRIMARY KEY, run_id TEXT NOT NULL REFERENCES runs(run_id),
+  def_id TEXT NOT NULL, table_version INTEGER NOT NULL, from_state TEXT NOT NULL, to_state TEXT NOT NULL,
+  reason TEXT NOT NULL, actor_json TEXT NOT NULL CHECK (json_valid(actor_json)),
+  guards_json TEXT NOT NULL CHECK (json_valid(guards_json)), effects_json TEXT NOT NULL CHECK (json_valid(effects_json)),
+  idempotency_key TEXT NOT NULL, event_id TEXT NOT NULL,
+  UNIQUE (run_id, idempotency_key) ) STRICT;
+
+CREATE TABLE phases ( run_id TEXT NOT NULL REFERENCES runs(run_id), phase_run_id TEXT NOT NULL, state TEXT NOT NULL,
+  iteration INTEGER NOT NULL, status TEXT NOT NULL, outcome TEXT,
+  checks_json TEXT NOT NULL CHECK (json_valid(checks_json)), started_at TEXT, ended_at TEXT,
+  PRIMARY KEY (run_id, phase_run_id) ) STRICT, WITHOUT ROWID;
+
+CREATE TABLE agents ( run_id TEXT NOT NULL REFERENCES runs(run_id), agent_id TEXT NOT NULL, phase_run_id TEXT NOT NULL,
+  role TEXT NOT NULL, surface TEXT, label TEXT NOT NULL, state TEXT NOT NULL,
+  attempt INTEGER NOT NULL, incarnation INTEGER NOT NULL, max_attempts INTEGER NOT NULL, max_incarnations INTEGER NOT NULL,
+  model_json TEXT NOT NULL CHECK (json_valid(model_json)),
+  effective_model_json TEXT CHECK (effective_model_json IS NULL OR json_valid(effective_model_json)),
+  auth_mode TEXT, slot TEXT, context_sha256 TEXT, grants_digest TEXT,
+  usage_json TEXT NOT NULL CHECK (json_valid(usage_json)), summary TEXT,
+  last_error_json TEXT CHECK (last_error_json IS NULL OR json_valid(last_error_json)),
+  pending_approval TEXT, runtime_ref_json TEXT CHECK (runtime_ref_json IS NULL OR json_valid(runtime_ref_json)),
+  created_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+  PRIMARY KEY (run_id, agent_id) ) STRICT, WITHOUT ROWID;
+
+CREATE TABLE agent_incarnations ( run_id TEXT NOT NULL, agent_id TEXT NOT NULL, incarnation INTEGER NOT NULL,
+  attempt INTEGER NOT NULL, state TEXT NOT NULL, cause TEXT, pid INTEGER, start_token TEXT, host_nonce TEXT,
+  runtime_ref_json TEXT CHECK (runtime_ref_json IS NULL OR json_valid(runtime_ref_json)), stop TEXT, reason TEXT,
+  usage_json TEXT CHECK (usage_json IS NULL OR json_valid(usage_json)), started_at TEXT, ended_at TEXT,
+  PRIMARY KEY (run_id, agent_id, incarnation),
+  FOREIGN KEY (run_id, agent_id) REFERENCES agents(run_id, agent_id) ) STRICT, WITHOUT ROWID;
+
+CREATE TABLE worktrees ( run_id TEXT NOT NULL REFERENCES runs(run_id), slot TEXT NOT NULL, path TEXT NOT NULL, branch TEXT,
+  base_sha TEXT NOT NULL, checkpoint_sha TEXT NOT NULL, last_tree_digest TEXT, lockfile_sha256 TEXT, provision_key TEXT,
+  deps_manifest_sha256 TEXT /* 5.7: digest of the provisioned dependency tree */, holder_agent_id TEXT,
+  state TEXT NOT NULL CHECK (state IN ('intent','ready','held','in-doubt','quarantined','removed')),
+  PRIMARY KEY (run_id, slot) ) STRICT, WITHOUT ROWID;
+
+-- dirty paths since the last Cohorte commit, each with the content hash Cohorte expects (4.4); sha256 NULL = deleted
+CREATE TABLE worktree_ledger ( run_id TEXT NOT NULL, slot TEXT NOT NULL, path TEXT NOT NULL, sha256 TEXT,
+  effect_id TEXT NOT NULL, effect_seq INTEGER NOT NULL,
+  PRIMARY KEY (run_id, slot, path) ) STRICT, WITHOUT ROWID;
+
+CREATE TABLE effects ( effect_id TEXT PRIMARY KEY, run_id TEXT NOT NULL REFERENCES runs(run_id), idempotency_key TEXT NOT NULL,
+  kind TEXT NOT NULL, replay_class TEXT NOT NULL CHECK (replay_class IN ('idempotent','verifiable','at-most-once')),
+  state TEXT NOT NULL CHECK (state IN ('intent','done','failed','in-doubt','compensated')),
+  agent_id TEXT, tool_call_id TEXT, slot TEXT,
+  request_json TEXT NOT NULL CHECK (json_valid(request_json)), verify_json TEXT NOT NULL CHECK (json_valid(verify_json)),
+  pre_state_json TEXT CHECK (pre_state_json IS NULL OR json_valid(pre_state_json)),
+  result_json TEXT CHECK (result_json IS NULL OR json_valid(result_json)),
+  error_json TEXT CHECK (error_json IS NULL OR json_valid(error_json)),
+  consumes_grant TEXT, compensated_by TEXT, fencing_token INTEGER NOT NULL,
+  intent_seq INTEGER NOT NULL, done_seq INTEGER, created_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+  UNIQUE (run_id, idempotency_key) ) STRICT;
+CREATE INDEX effects_open ON effects(run_id, state) WHERE state IN ('intent','in-doubt');
+
+CREATE TABLE approvals ( approval_id TEXT PRIMARY KEY, run_id TEXT NOT NULL REFERENCES runs(run_id), idempotency_key TEXT NOT NULL,
+  kind TEXT NOT NULL, agent_id TEXT, incarnation INTEGER, tool_call_id TEXT,
+  status TEXT NOT NULL CHECK (status IN ('pending','allow-once','allow-for-run','deny','expired','superseded')),
+  request_json TEXT NOT NULL CHECK (json_valid(request_json)),   -- ApprovalRequest incl. the NORMALISED pending call
+  grant_key TEXT NOT NULL,                                       -- sha256(tool | normalised call | pre-state binding): what a decision is valid for (4.5).
+                                                                 --   binding = target beforeSha256 (write/patch) | the slot's content-addressed treeDigest (command): NEVER a commit sha
+  decision_json TEXT CHECK (decision_json IS NULL OR json_valid(decision_json)),
+  command_auth_json TEXT CHECK (command_auth_json IS NULL OR json_valid(command_auth_json)),
+                                                                 -- actor, commandId, answer, note, decidedAt + {scheme,value} of the resolving command (spec 23 "signées/loggées")
+  consumed_by_effect TEXT,                                       -- allow-once: set in the intent transaction of the consuming effect (live call OR host-side replay, 4.5)
+  requested_seq INTEGER NOT NULL, resolved_seq INTEGER, expires_at TEXT, created_at TEXT NOT NULL, resolved_at TEXT,
+  UNIQUE (run_id, idempotency_key) ) STRICT;
+CREATE INDEX approvals_by_grant ON approvals(run_id, grant_key);
+CREATE INDEX approvals_pending ON approvals(run_id, created_at) WHERE status = 'pending';
+
+CREATE TABLE budgets ( run_id TEXT NOT NULL REFERENCES runs(run_id), level TEXT NOT NULL, scope_id TEXT NOT NULL,
+  consumed_json TEXT NOT NULL CHECK (json_valid(consumed_json)), limit_json TEXT NOT NULL CHECK (json_valid(limit_json)),
+  updated_at TEXT NOT NULL,
+  PRIMARY KEY (run_id, level, scope_id) ) STRICT, WITHOUT ROWID;
+
+CREATE TABLE artifacts ( artifact_id TEXT NOT NULL, run_id TEXT NOT NULL REFERENCES runs(run_id), kind TEXT NOT NULL,
+  path TEXT NOT NULL, sha256 TEXT NOT NULL, bytes INTEGER NOT NULL CHECK (bytes >= 0), media_type TEXT, agent_id TEXT,
+  phase_run_id TEXT, created_at TEXT NOT NULL,
+  PRIMARY KEY (run_id, artifact_id) ) STRICT, WITHOUT ROWID;
+
+CREATE TABLE findings ( run_id TEXT NOT NULL REFERENCES runs(run_id), finding_id TEXT NOT NULL, phase_run_id TEXT NOT NULL,
+  agent_id TEXT, severity TEXT NOT NULL, status TEXT NOT NULL,
+  finding_json TEXT NOT NULL CHECK (json_valid(finding_json)), created_at TEXT NOT NULL, updated_at TEXT NOT NULL,
+  PRIMARY KEY (run_id, finding_id) ) STRICT, WITHOUT ROWID;
+
+-- run_id has no foreign key: a project-scoped command names no run, and the inbox is written by non-owner processes.
+CREATE TABLE commands ( command_id TEXT PRIMARY KEY, run_id TEXT, type TEXT NOT NULL, body_sha256 TEXT NOT NULL,
+  envelope_json TEXT NOT NULL CHECK (json_valid(envelope_json)), auth_scheme TEXT, auth_value TEXT,
+  status TEXT NOT NULL CHECK (status IN ('pending','claimed','completed','rejected')), claimed_by TEXT, result_event_id TEXT,
+  created_at TEXT NOT NULL, updated_at TEXT NOT NULL ) STRICT;
+CREATE INDEX commands_pending ON commands(run_id, created_at, command_id) WHERE status = 'pending';
+
+-- overlap decided inside BEGIN IMMEDIATE
+CREATE TABLE locks ( lock_id TEXT PRIMARY KEY, scope TEXT NOT NULL, key TEXT NOT NULL, mode TEXT NOT NULL CHECK (mode IN ('shared','exclusive')),
+  owner_run_id TEXT, owner_host_id TEXT NOT NULL, owner_pid INTEGER NOT NULL, owner_start_token TEXT NOT NULL,
+  fencing_token INTEGER NOT NULL, zones_json TEXT CHECK (zones_json IS NULL OR json_valid(zones_json)),
+  lease_expires_at TEXT NOT NULL, acquired_at TEXT NOT NULL ) STRICT;
+CREATE INDEX locks_by_key ON locks(scope, key);
+
+CREATE TABLE snapshots ( run_id TEXT NOT NULL REFERENCES runs(run_id), at_sequence INTEGER NOT NULL,
+  schema_version INTEGER NOT NULL, cohorte_version TEXT NOT NULL, state_sha256 TEXT NOT NULL,
+  state_json TEXT NOT NULL CHECK (json_valid(state_json)),
+  PRIMARY KEY (run_id, at_sequence) ) STRICT, WITHOUT ROWID;

package/assets/prompts/README.md

@@ -0,0 +1,11 @@
+# prompts/
+
+Embedded agent prompts (spec §8 "inline skills", DESIGN §9 role scope cut: `implementer`, `fixer`, `reviewer`,
+`security-reviewer` in V3.0; `architect`, `verifier`, `brainstormer`, `spec-author`, `tester`, `release-manager`,
+`discoverer`, `reconciler` have their role ids reserved but no prompt yet).
+
+`scripts/embed-assets.ts` copies this whole directory into `apps/cli/assets/prompts/**` and records it in
+`assets/manifest.json` (DESIGN 1.4 step 2). Files here are content, not code: `scripts/check-prompts.ts` (`U4.09`)
+checks them for transition/verdict vocabulary (spec 4.1); nothing under `prompts/**` is executed.
+
+This directory is empty at G0 on purpose — the role prompts land with the units that use them (Wave 2+).

package/assets/prompts/agents/fixer.md

@@ -0,0 +1,7 @@
+# Fixer
+
+Resolve the supplied finding without weakening its reproduction or changing unrelated behavior.
+
+Reproduce the issue first when possible. Trace the smallest cause, implement a focused correction, and add a
+regression test that would fail without it. Re-run the original check and inspect the final diff for accidental scope
+growth. Report if the finding cannot be reproduced or if another dependency prevents a safe correction.

package/assets/prompts/agents/implementer.md

@@ -0,0 +1,12 @@
+# Implementer
+
+Deliver the assigned change for your surface only.
+
+1. Read the task and inspect the relevant code before writing.
+2. Make the smallest coherent implementation that follows local patterns.
+3. Add or update focused tests for observable behavior.
+4. Run the narrow checks first, then the broader checks requested by the task.
+5. Summarize the change with paths, evidence, and known limitations.
+
+Do not edit another surface for convenience. If an interface is missing, record the exact interface needed instead of
+silently inventing a cross-surface contract.

package/assets/prompts/agents/reviewer.md

@@ -0,0 +1,8 @@
+# Reviewer
+
+Inspect the assigned surface against the frozen task and the repository conventions.
+
+Look for functional gaps, unsafe paths, missing validation, data loss, concurrency hazards, and absent regression
+coverage. Every finding must include severity, file and location, observed behavior, why it matters, and a concrete
+reproduction or check. Do not propose cosmetic changes as blockers. If no material issue remains, describe the checks
+that support that conclusion.

package/assets/prompts/agents/security-reviewer.md

@@ -0,0 +1,7 @@
+# Security reviewer
+
+Review only the assigned security surface and its boundary assumptions.
+
+Check path confinement, command arguments, credential handling, process identity, sandbox policy, redaction, and
+fail-closed behavior. Never request or display secrets. Findings must name the attacker-controlled input, the reached
+boundary, the impact, and a safe regression check.

package/assets/prompts/phases/build.md

@@ -0,0 +1,5 @@
+# Build phase guidance
+
+Implement the frozen specification in the owned surface. Inspect the base tree and the surface contract before
+editing. Keep the change isolated to the assigned work area, preserve public protocol shapes, and leave a concise
+result that another host can verify.

package/assets/prompts/phases/review.md

@@ -0,0 +1,5 @@
+# Review phase guidance
+
+Compare the implementation and its evidence with the frozen specification. Inspect every owned surface and record
+findings with reproducible locations. Check that prior findings are addressed and that the integration tree still
+matches the recorded evidence.

package/assets/prompts/phases/test.md

@@ -0,0 +1,5 @@
+# Test phase guidance
+
+Run the exact repository checks recorded for the current task. Preserve command arguments and captured outcomes.
+Separate a product failure from an unavailable environment, and include the relevant output without credentials or
+unbounded logs.

package/assets/prompts/system.md

@@ -0,0 +1,11 @@
+# Cohorte agent context
+
+You work inside one isolated Cohorte work area. The host supplies the current task, allowed paths, available tools,
+and the durable context. Treat those values as authoritative.
+
+Keep changes small, inspect before editing, and preserve unrelated work. Use the repository's existing conventions and
+run the checks named by the task when they are available. Do not read credential stores, private keys, or files
+outside the paths granted to you.
+
+Communicate concrete observations. When a requirement is unclear, report the missing evidence and leave the worktree
+in a recoverable state. A result must describe files changed, checks run, and any remaining uncertainty.