cohorte 2.10.0 → 3.0.0-dev.0

package/bin/report.js

@@ -1,141 +0,0 @@
-'use strict';
-// Machine-readable reports for `cohorte specs` and `cohorte doctor`.
-//
-// Both commands read what lib/doctor.js computes (`scanSpecs` and `state`) and
-// render it four ways:
-//
-//   default      a human table on a terminal
-//   --porcelain  one record per line, fields separated by U+001F (the ASCII unit
-//                separator) — stable, greppable, and immune to a spec title that
-//                contains a space, a tab or a pipe
-//   --json       the native document (the full doctor state, the spec list)
-//   --panel      the payload shape a Francois extension panel validates against
-//                (`{rows:[{key,value,tone}]}` / `{rows:[{id,cells,tone}]}`). This is
-//                the ONLY Francois-aware surface in cohorte; everything else here is
-//                generic. See github.com/TheBidouilleAgency/francois-plugin-cohorte.
-//
-// Dependency-free, and it never writes anything.
-
-const US = String.fromCharCode(0x1f); // ASCII unit separator (U+001F)
-
-// A spec's status → a display tone. The tones are the ones a status column can carry
-// anywhere (terminal colour, panel row tone); `busy` marks the two statuses that mean
-// "a command is mid-flight on this spec".
-const STATUS_TONE = {
-  draft: 'neutral',
-  frozen: 'neutral',
-  'in-progress': 'busy',
-  'in-review': 'busy',
-  shipped: 'ok',
-  blocked: 'error',
-};
-
-// doctor's four check states → the same tone vocabulary. `skip` is not a failure:
-// a check that does not apply to this project (no design system, no worktrees) reads
-// neutral, never warn.
-const CHECK_TONE = { ok: 'ok', warn: 'warn', bad: 'error', skip: 'neutral' };
-
-// Collapse anything that would break the line format or a single-line cell. A spec
-// title is free text written by a human in YAML frontmatter — it can contain a newline
-// continuation, and it must never split one record into two. A stray separator inside a
-// field goes the same way, and so does the padding a doctor `fix` carries for terminal
-// alignment — in a one-line panel cell that padding reads as a hole.
-function flat(value) {
-  return String(value == null ? '' : value)
-    .replace(new RegExp(`[\\s${US}]+`, 'g'), ' ')
-    .trim();
-}
-
-function specRecords(projectRoot, scanSpecs) {
-  return scanSpecs(projectRoot).map((s) => ({
-    id: s.id,
-    title: s.title || '',
-    status: s.status || 'unknown',
-    branch: s.branch || '',
-    file: s.file,
-    tone: STATUS_TONE[s.status] || 'warn', // an unknown status IS the warning
-  }));
-}
-
-function specsPorcelain(records) {
-  return records
-    .map((r) => [r.id, r.title, r.status, r.branch, r.tone].map(flat).join(US))
-    .join('\n');
-}
-
-function specsPanel(records) {
-  return JSON.stringify({
-    rows: records.map((r) => ({
-      id: flat(r.id),
-      tone: r.tone,
-      cells: { id: flat(r.id), title: flat(r.title), status: flat(r.status), branch: flat(r.branch) },
-    })),
-  });
-}
-
-function specsHuman(records) {
-  if (!records.length) return 'no specs in ./specs — /cohorte-spec writes the first one';
-  const w = (k) => Math.max(...records.map((r) => flat(r[k]).length), k.length);
-  const [wi, ws, wb] = [w('id'), w('status'), w('branch')];
-  const head = `${'id'.padEnd(wi)}  ${'status'.padEnd(ws)}  ${'branch'.padEnd(wb)}  title`;
-  const rows = records.map(
-    (r) => `${flat(r.id).padEnd(wi)}  ${flat(r.status).padEnd(ws)}  ${flat(r.branch).padEnd(wb)}  ${flat(r.title)}`,
-  );
-  return [head, '-'.repeat(head.length), ...rows].join('\n');
-}
-
-function checkRecords(state) {
-  return state.checks.map((c) => ({
-    id: c.id,
-    label: c.label,
-    status: c.status,
-    detail: c.detail,
-    fix: c.fix || '',
-    tone: CHECK_TONE[c.status] || 'neutral',
-  }));
-}
-
-function doctorPorcelain(records) {
-  return records
-    .map((r) => [r.id, r.label, r.status, r.detail, r.fix].map(flat).join(US))
-    .join('\n');
-}
-
-// key-value, one row per check: the check's label keyed against what it found. The fix
-// rides in the value for a failing check — a panel row has nowhere else to put it, and
-// a health report that says "broken" without saying "run this" is half a report.
-function doctorPanel(records) {
-  return JSON.stringify({
-    rows: records.map((r) => ({
-      key: flat(r.label),
-      value: flat(r.fix && r.tone !== 'ok' ? `${r.detail} → ${r.fix}` : r.detail),
-      tone: r.tone,
-    })),
-  });
-}
-
-function doctorHuman(state, records) {
-  const mark = { ok: 'ok  ', warn: 'warn', bad: 'BAD ', skip: 'skip' };
-  const lines = [`cohorte doctor — ${state.project}`, ''];
-  for (const r of records) {
-    lines.push(`${mark[r.status] || '?   '}  ${r.label} — ${flat(r.detail)}`);
-    if (r.fix && r.status !== 'ok') lines.push(`        fix: ${flat(r.fix)}`);
-  }
-  const s = state.summary;
-  lines.push('', `${s.ok} ok · ${s.warn} warn · ${s.bad} bad · ${s.skip} skipped`);
-  return lines.join('\n');
-}
-
-module.exports = {
-  US,
-  STATUS_TONE,
-  CHECK_TONE,
-  specRecords,
-  specsPorcelain,
-  specsPanel,
-  specsHuman,
-  checkRecords,
-  doctorPorcelain,
-  doctorPanel,
-  doctorHuman,
-};

package/core/adapter/render.js

@@ -1,389 +0,0 @@
-#!/usr/bin/env node
-// cohorte — runtime adapter.
-//
-// The core prompts (core/commands/*.md, core/agents/*.md) are the SINGLE source of
-// truth and are written runtime-neutral. This module transpiles them into whatever
-// the target coding agent actually reads:
-//
-//                 commands                        agents                  gate hook
-//   claude    .claude/commands/<n>.md         md, $ARGUMENTS      md      PreToolUse (deny+ask)
-//   codex     .agents/skills/<n>/SKILL.md     md, no substitution toml    PreToolUse (deny only)
-//   cursor    .cursor/commands/<n>.md         md, no substitution md      beforeShellExecution
-//   gemini    .gemini/commands/<n>.toml       toml, {{args}}      md      BeforeTool (deny only)
-//   opencode  .opencode/commands/<n>.md       md, $ARGUMENTS      md      none — advisory --check
-//
-// Three transforms, in order:
-//
-//   1. capability conditionals — `<!-- cohorte:if hooks -->…<!-- cohorte:else -->…
-//      <!-- cohorte:endif -->` keeps exactly one branch, so one file can state both "the gate
-//      fires whether or not you cooperate" and "you must call the gate yourself".
-//   2. runtime preamble — one block resolving `<core>`, `<agents>`, the dispatch verb and
-//      the gate mechanism, so the prose below never hardcodes a runtime's layout.
-//   3. surface encoding — frontmatter filtered to the keys that runtime understands (an
-//      unknown key is prose the model reads as an instruction, so dropping is not cosmetic),
-//      arg placeholder swapped, and the whole thing re-emitted as md, toml or a skill dir.
-//
-// Subagents are NOT one of the conditionals: they are a precondition (see assertSupported).
-//
-// Claude output is byte-identical to the pre-adapter core when a file has no conditionals:
-// that is the regression test (scripts/test-adapter.mjs).
-
-'use strict';
-
-const fs = require('fs');
-const os = require('os');
-const path = require('path');
-
-const RUNTIME_DIR = path.join(__dirname, '..', 'runtimes');
-
-// --- registry ----------------------------------------------------------------
-
-function listRuntimes() {
-  return fs.readdirSync(RUNTIME_DIR)
-    .filter((f) => f.endsWith('.json'))
-    .map((f) => f.slice(0, -5))
-    .sort();
-}
-
-function loadRuntime(id) {
-  const file = path.join(RUNTIME_DIR, `${id}.json`);
-  if (!fs.existsSync(file)) {
-    throw new Error(`unknown runtime "${id}" (known: ${listRuntimes().join(', ')})`);
-  }
-  const rt = JSON.parse(fs.readFileSync(file, 'utf8'));
-  assertSupported(rt);
-  return rt;
-}
-
-// Subagents are a HARD requirement, not a capability to branch on. The pipeline's premise is
-// that each surface is built by someone who can only see the frozen contract; without real
-// subagents the lead does every surface in one context and that isolation is simply gone.
-// A sequential-persona fallback existed briefly and was removed: it asked the lead to simulate
-// the boundary by discipline, which is not the same guarantee, and no supported runtime ever
-// took that branch. Refuse loudly rather than render a pipeline whose central promise is absent.
-function assertSupported(rt) {
-  if (rt.capabilities && rt.capabilities.subagents === false) {
-    throw new Error(`runtime "${rt.id}" declares no subagents — cohorte requires them `
-      + '(see docs/reference/runtimes.md §Requirements)');
-  }
-  return rt;
-}
-
-function expandHome(p) {
-  if (!p) return p;
-  return p.startsWith('~/') ? path.join(os.homedir(), p.slice(2)) : p;
-}
-
-// Which runtimes are actually installed on this machine. Detection is by config
-// directory, not by binary on PATH: Cursor ships no CLI, and a runtime the human
-// has configured but not opened this shell for is still a legitimate target.
-function detectRuntimes() {
-  return listRuntimes().filter((id) => {
-    const rt = loadRuntime(id);
-    return (rt.detect || []).some((d) => fs.existsSync(expandHome(d)));
-  });
-}
-
-// Absolute destinations for one (runtime, scope) pair. `projectRoot` anchors every
-// relative path; `~`-rooted ones ignore it. A scope entry may pin an individual
-// surface to another scope (Codex reads prompts ONLY from ~/.codex, even when the
-// neutral core is bundled in the repo) via `<key>_scope`.
-function resolvePaths(runtime, scope, projectRoot, { overrides } = {}) {
-  const spec = runtime.scopes[scope];
-  if (!spec) throw new Error(`runtime ${runtime.id} has no "${scope}" scope`);
-  // `overrides` re-roots a declared prefix — the one caller is CLAUDE_CONFIG_DIR, which moves
-  // Claude Code's whole `~/.claude` tree elsewhere (a desktop host points it at
-  // `~/Library/Application Support/…`). Ignoring it split the install in half: the core was
-  // written to `~/.claude` while the hook was registered in the overridden dir, so a scratch
-  // install silently wrote into the user's real global core.
-  const reroot = (p) => {
-    for (const [from, to] of Object.entries(overrides || {})) {
-      if (p === from) return to;
-      if (p.startsWith(from + '/')) return to + p.slice(from.length);
-    }
-    return p;
-  };
-  const abs = (p) => {
-    if (!p) return null;
-    const e = expandHome(reroot(p));
-    return path.isAbsolute(e) ? e : path.join(projectRoot, e);
-  };
-  const out = { scope, effective: {} };
-  for (const key of ['root', 'core', 'commands', 'agents', 'hooks', 'hooks_config',
-                     'workflows', 'settings']) {
-    out[key] = abs(spec[key]);
-    out.effective[key] = spec[`${key}_scope`] || scope;
-  }
-  return out;
-}
-
-// --- 1. capability conditionals ----------------------------------------------
-
-const IF = /^\s*<!--\s*cohorte:if\s+([^>]+?)\s*-->\s*$/;
-const ELSE = /^\s*<!--\s*cohorte:else\s*-->\s*$/;
-const ENDIF = /^\s*<!--\s*cohorte:endif\s*-->\s*$/;
-
-// A condition is a space-separated OR of terms; a term is `cap`, `!cap`, `runtime:<id>`
-// or `!runtime:<id>`. OR (not AND) because every real use is "this family of runtimes".
-function testCondition(expr, runtime) {
-  return expr.split(/\s+/).filter(Boolean).some((term) => {
-    const neg = term.startsWith('!');
-    const name = neg ? term.slice(1) : term;
-    let value;
-    if (name.startsWith('runtime:')) value = runtime.id === name.slice(8);
-    else if (name in (runtime.capabilities || {})) value = !!runtime.capabilities[name];
-    else throw new Error(`unknown cohorte:if term "${name}"`);
-    return neg ? !value : value;
-  });
-}
-
-function applyConditionals(text, runtime) {
-  const lines = text.split('\n');
-  const out = [];
-  // Each frame: {keep} — whether the branch currently being read survives. Nesting is
-  // supported so a hooks-branch can carry a subagents-branch inside it.
-  const stack = [];
-  const emitting = () => stack.every((f) => f.keep);
-  for (const line of lines) {
-    let m;
-    if ((m = line.match(IF))) {
-      const taken = testCondition(m[1], runtime);
-      stack.push({ taken, keep: taken, seenElse: false });
-      continue;
-    }
-    if (ELSE.test(line)) {
-      const frame = stack[stack.length - 1];
-      if (!frame) throw new Error('cohorte:else without a matching cohorte:if');
-      if (frame.seenElse) throw new Error('two cohorte:else in one cohorte:if');
-      frame.seenElse = true;
-      frame.keep = !frame.taken;
-      continue;
-    }
-    if (ENDIF.test(line)) {
-      if (!stack.pop()) throw new Error('cohorte:endif without a matching cohorte:if');
-      continue;
-    }
-    if (emitting()) out.push(line);
-  }
-  if (stack.length) throw new Error('unclosed cohorte:if');
-  return out.join('\n');
-}
-
-// --- 2. runtime preamble ------------------------------------------------------
-
-// Path as the human/model should see it: `~/…` reads better than an expanded homedir,
-// and a project-relative path must stay relative (the agent's cwd is the repo).
-function displayPath(p, projectRoot) {
-  if (!p) return null;
-  const home = os.homedir();
-  if (p.startsWith(home + path.sep)) return '~/' + path.relative(home, p).split(path.sep).join('/');
-  if (p.startsWith(projectRoot + path.sep)) return path.relative(projectRoot, p).split(path.sep).join('/');
-  return p;
-}
-
-// The per-project directory holding everything the pipeline GENERATES for this repo
-// (gate-config.json, preflight.ok, pipeline-metrics.jsonl, pipeline.json). Distinct from
-// `<core>`: the core can be global while this is always in the repo, next to the code it
-// describes. `.claude` on a Claude install — unchanged, so existing repos keep working.
-//
-// Deliberately SHARED across non-Claude runtimes (`.cohorte`), while each of their cores is
-// its own subdirectory (`.cohorte/<id>`). The state describes the PROJECT — one gate config,
-// one preflight stamp, one metrics log — and duplicating it per runtime would let a repo
-// driven from two agents disagree with itself about what is gated and what is verified.
-// The core, by contrast, is rendered per runtime and cannot be shared: the same template
-// resolves differently depending on whether that agent has subagents or hooks.
-function stateDir(runtime) {
-  return runtime.id === 'claude' ? '.claude' : '.cohorte';
-}
-
-// The user-level config (kanban boards, shared vault). One file per
-// human, not per project or per runtime; the shipped scripts probe the same two paths.
-function configPath(runtime) {
-  return runtime.id === 'claude' ? '~/.claude/cohorte.config.yaml' : '~/.cohorte/cohorte.config.yaml';
-}
-
-function preamble(runtime, paths, projectRoot, { kind = 'command' } = {}) {
-  const caps = runtime.capabilities || {};
-  const core = displayPath(paths.core, projectRoot);
-  const agentsDir = paths.agents ? displayPath(paths.agents, projectRoot) : `${core}/agents`;
-  const L = [];
-  L.push(`> **Runtime: ${runtime.label}.** Generated by the cohorte adapter — do not edit this file;`);
-  L.push(`> edit \`core/${kind === 'agent' ? 'agents' : 'commands'}/\` in the cohorte source and re-install.`);
-  L.push('>');
-  L.push(`> - \`<core>\` = \`${core}\` — the pipeline's shared assets (\`pipeline/scripts/\`, \`pipeline/SCHEMA.md\`, \`templates/\`). Every \`<core>/…\` path below resolves there, and nowhere else.`);
-  L.push(`> - \`<state>\` = \`${stateDir(runtime)}/\` in **this repo** — what the pipeline generates for this project (\`gate-config.json\`, \`preflight.ok\`, \`pipeline-metrics.jsonl\`, \`pipeline.json\`). Always project-relative, even when \`<core>\` is global.`);
-  L.push(`> - \`<memory>\` = \`${runtime.memory}\` — this runtime's project-instructions file at the repo root, loaded into every session here. Where the doctrine says to reference or extend it, that is the file.`);
-  L.push(`> - \`<config>\` = \`${configPath(runtime)}\` — your user-level config (kanban boards, shared vault). One per human, never committed.`);
-
-  L.push(`> - \`<agents>\` = \`${agentsDir}\` — real subagents. Dispatch: ${runtime.agent.dispatch}.`);
-
-  if (caps.hooks) {
-    const cfg = displayPath(paths.hooks_config, projectRoot);
-    const ask = runtime.hook.supports_ask
-      ? 'It can deny outright or ask you to confirm.'
-      : 'This runtime has **no confirmation tier**, so a command that would merely be queried elsewhere is **denied** here — re-run it yourself if you meant it.';
-    L.push(`> - **Gate** — \`<core>/hooks/gate.py\` is registered as a blocking \`${runtime.hook.event}\` hook in \`${cfg}\`, reading \`<state>/gate-config.json\`. It fires whether or not you cooperate. ${ask}`);
-  }
-
-  if (!caps.hooks) {
-    L.push('> - **Gate** — this runtime has no blocking hook, so the gate is not automatic. Before any command listed in the profile\'s `gate` block, and before every phase dispatch, run `<core>/hooks/gate.py --check <command>` yourself and obey its verdict (`deny` ⇒ stop, `ask` ⇒ get the human\'s explicit go-ahead). Skipping this is the one deviation that silently removes a safety property.');
-  }
-
-  if (!caps.workflows) {
-    L.push('> - **Workflows** — unavailable on this runtime. The conversational path below is the only path; ignore any mention of a workflow variant.');
-  }
-
-  if (!runtime.command.args) {
-    L.push(`> - \`$ARGUMENTS\` — this runtime does not substitute placeholders. It means ${runtime.command.args_note || 'the text typed after the command name'}; expand it yourself everywhere it appears below.`);
-  }
-
-  return L.join('\n') + '\n';
-}
-
-// --- 3. surface encoding ------------------------------------------------------
-
-function parseFrontmatter(text) {
-  if (!text.startsWith('---\n')) return { keys: [], body: text };
-  const end = text.indexOf('\n---\n', 3);
-  if (end === -1) return { keys: [], body: text };
-  const block = text.slice(4, end + 1);
-  const body = text.slice(end + 5);
-  const keys = [];
-  for (const line of block.split('\n')) {
-    const m = line.match(/^([A-Za-z][\w-]*):\s?(.*)$/);
-    // Continuation lines (a wrapped value) belong to the previous key.
-    if (!m) {
-      if (line.trim() && keys.length) keys[keys.length - 1][1] += '\n' + line;
-      continue;
-    }
-    keys.push([m[1], m[2]]);
-  }
-  return { keys, body };
-}
-
-function emitFrontmatter(keys) {
-  if (!keys.length) return '';
-  return '---\n' + keys.map(([k, v]) => `${k}: ${v}`).join('\n') + '\n---\n\n';
-}
-
-function substituteArgs(text, runtime) {
-  const token = runtime.command.args;
-  if (!token || token === '$ARGUMENTS') return text;
-  return text.split('$ARGUMENTS').join(token);
-}
-
-// TOML basic-string escaping for the multi-line ''' form Gemini expects. A literal
-// ''' inside a prompt would close the string early, so it is the one sequence broken up.
-function tomlMultiline(s) {
-  return "'''\n" + s.replace(/'''/g, "''\\'") + "\n'''";
-}
-function tomlBasic(s) {
-  return '"' + s.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, ' ') + '"';
-}
-
-/**
- * Render one core command for one runtime.
- * @returns {{filename: string, content: string, dir: 'commands'}}
- */
-function renderCommand({ source, name, runtime, paths, projectRoot }) {
-  const { keys, body } = parseFrontmatter(source);
-  let out = applyConditionals(body, runtime);
-  out = preamble(runtime, paths, projectRoot) + '\n' + out.replace(/^\n+/, '');
-  out = substituteArgs(out, runtime);
-
-  const kept = keys.filter(([k]) => runtime.command.frontmatter.includes(k));
-  const dropped = keys.filter(([k]) => !runtime.command.frontmatter.includes(k)).map(([k]) => k);
-
-  // A skill is a DIRECTORY — `<name>/SKILL.md` — whose frontmatter must carry `name`, since
-  // that is what the runtime matches on (both for `$<name>` and for implicit selection from
-  // `description`). Command sources have no `name` key, so synthesise it from the filename.
-  if (runtime.command.format === 'skill') {
-    if (!kept.some(([k]) => k === 'name')) kept.unshift(['name', name]);
-    return { filename: `${name}${runtime.command.ext}`, content: emitFrontmatter(kept) + out, dropped };
-  }
-
-  if (runtime.command.format === 'toml') {
-    const desc = (keys.find(([k]) => k === 'description') || [null, ''])[1];
-    const lines = [`# cohorte — generated for ${runtime.label}. Do not edit; edit core/commands/${name}.md.`];
-    if (dropped.length) lines.push(`# frontmatter not supported here, dropped: ${dropped.join(', ')}`);
-    if (desc) lines.push(`description = ${tomlBasic(desc)}`);
-    lines.push(`prompt = ${tomlMultiline(substituteArgs(out, runtime))}`);
-    return { filename: `${name}${runtime.command.ext}`, content: lines.join('\n') + '\n', dropped };
-  }
-
-  const header = emitFrontmatter(kept);
-  return { filename: `${name}${runtime.command.ext}`, content: header + out, dropped };
-}
-
-// Is this agent read-only? Derived from the source's Claude-style `tools:` list rather than
-// declared twice: an agent that was never given Write, Edit or Bash is read-only by intent,
-// and each runtime spells that its own way (`readonly: true`, `sandbox_mode = "read-only"`).
-// Losing it silently would hand the reviewer the ability to fix what it is meant to report.
-function isReadOnly(keys) {
-  const tools = (keys.find(([k]) => k === 'tools') || [])[1];
-  if (!tools) return false;
-  return !/\b(Write|Edit|MultiEdit|Bash|NotebookEdit)\b/.test(tools);
-}
-
-/**
- * Render one core agent for one runtime.
- *
- * Every runtime cohorte targets has real subagents, but they disagree on the file: markdown +
- * frontmatter for Claude Code, Cursor, Gemini CLI and OpenCode; TOML with the body under
- * `developer_instructions` for Codex. `format: "persona"` remains for a runtime with no
- * subagents at all — the file is then read and adopted by the lead in sequence.
- */
-function renderAgent({ source, name, runtime, paths, projectRoot }) {
-  const { keys, body } = parseFrontmatter(source);
-  const out = preamble(runtime, paths, projectRoot, { kind: 'agent' }) + '\n'
-    + applyConditionals(body, runtime).replace(/^\n+/, '');
-  const spec = runtime.agent;
-  const readonly = isReadOnly(keys);
-
-  if (spec.format === 'toml') {
-    const get = (k) => (keys.find(([kk]) => kk === k) || [null, ''])[1];
-    const lines = [`# cohorte — generated for ${runtime.label}. Do not edit; edit core/agents/${name}.md.`];
-    lines.push(`name = ${tomlBasic(get('name') || name)}`);
-    if (get('description')) lines.push(`description = ${tomlBasic(get('description'))}`);
-    if (spec.frontmatter.includes('model') && get('model')) lines.push(`model = ${tomlBasic(get('model'))}`);
-    if (readonly && spec.readonly_key) {
-      lines.push(`${spec.readonly_key} = ${tomlBasic(spec.readonly_value)}`);
-    }
-    lines.push(`${spec.body_key} = ${tomlMultiline(out)}`);
-    return { filename: `${name}${spec.ext}`, content: lines.join('\n') + '\n', native: true, readonly };
-  }
-
-  if (spec.format !== 'md') {
-    return { filename: `${name}.md`, content: out, native: false, dropped: keys.map(([k]) => k) };
-  }
-
-  const allowed = spec.frontmatter;
-  const kept = keys.filter(([k]) => allowed.includes(k));
-  for (const [k, v] of Object.entries(spec.defaults || {})) {
-    if (!kept.some(([kk]) => kk === k)) kept.push([k, v]);
-  }
-  if (readonly && spec.readonly_key && !kept.some(([k]) => k === spec.readonly_key)) {
-    kept.push([spec.readonly_key, spec.readonly_value]);
-  }
-  const dropped = keys.filter(([k]) => !allowed.includes(k)).map(([k]) => k);
-  return { filename: `${name}${spec.ext || '.md'}`, content: emitFrontmatter(kept) + out, native: true, dropped, readonly };
-}
-
-module.exports = {
-  assertSupported,
-  stateDir,
-  configPath,
-  listRuntimes,
-  loadRuntime,
-  detectRuntimes,
-  resolvePaths,
-  expandHome,
-  displayPath,
-  applyConditionals,
-  testCondition,
-  parseFrontmatter,
-  emitFrontmatter,
-  preamble,
-  renderCommand,
-  renderAgent,
-};

package/core/agents/implementer.template.md

@@ -1,142 +0,0 @@
----
-name: <SURFACE_AGENT>
-description: Implements the <SURFACE_LABEL> surface (<SURFACE_PATH>) for one feature, strictly from the frozen spec + contract, test-first TDD. Dispatched by /cohorte-build. Touches only its own surface.
-tools: <SURFACE_TOOLS>
-model: <SURFACE_MODEL>
----
-
-You are the **<SURFACE_AGENT>** engineer for one feature of **<PROJECT_NAME>**. You work alone,
-statelessly, from the spec you are given. You cannot talk to the other surface agents — your only
-shared surface is the frozen contract and the spec.
-
-> **First action, always:** read `PIPELINE.md`'s fenced `yaml pipeline-profile` block ONLY — the
-> machine contract (surfaces, contract, commands, gate). Do **not** read the prose sections
-> (§Conventions/§Testing): your slice of them is baked into this file below (§Your conventions),
-> rendered from the profile — re-reading the prose every dispatch is exactly the cost the bake
-> removes. If the baked slice visibly contradicts `PIPELINE.md`, say so in your handoff: the profile
-> wins, and this agent file needs a re-render (`/cohorte-update-pipeline`).
-
-## You own
-
-`<SURFACE_PATH>/**` only. Everything under it — and nothing outside it.
-
-## Your conventions (baked from `PIPELINE.md` at render time)
-
-<!-- Rendered by /cohorte-init-pipeline (and refreshed by /cohorte-update-pipeline's reconcile) from
-     §Conventions `### Shared` + `### Surface: <your key>` + your §Testing lines.
-     Edit conventions in PIPELINE.md, never here — this block is regenerated. -->
-
-<SURFACE_CONVENTIONS>
-
-## You must NEVER
-
-- Touch any other surface's tree (see the `surfaces` list in `PIPELINE.md`). That's another agent's.
-- Edit the frozen **contract** (`contract.path` in `PIPELINE.md`). It is authored by the lead; import
-  from it read-only. If you believe the contract is wrong, **stop and report it** in your handoff — do
-  not change it.
-- Run any command in `PIPELINE.md` §`gate.deny` (destructive DB / history rewrites). Migrations (if any)
-  are **append-only** — never `fresh`/`reset`/`rollback`. The DB and ports may be shared across worktrees.
-  <SURFACE_EXTRA_NEVER>
-
-## Your inputs (supplied at dispatch — you have no memory)
-
-1. The spec path `specs/<id>.md` — on a **first build** (your dispatch's Remediation slot says
-   `none`), read it fully (contract §5, your surface's tasks, acceptance §9). On a **fix loop**, do
-   NOT re-read the spec: your dispatch carries your open Remediation items verbatim, and the contract
-   file (input 2) is your only source of shapes — open the spec only if a finding explicitly cites a
-   spec section, or if `contract.enabled` is false in `PIPELINE.md` (then spec §5 prose IS the contract).
-2. The frozen contract for this feature (`<contract.path>/<id>.<contract.ext>`) — the shapes you build against.
-3. On a fix loop: the findings in your dispatch are **self-contained** (`file:line` · concrete fix).
-   Read only the files they name — don't re-explore your whole tree. Need the current state of your
-   work? Compute it yourself: `git diff <default_branch> -- <your surface path>` (never expect a diff
-   in your dispatch). Fix exactly what's flagged.
-   <SURFACE_DESIGN_INPUT>
-
-## How you read code — retrieval first
-
-If `retrieval.provider` in `PIPELINE.md` is not `none`, its MCP tools are in your toolset — **prefer
-them over Grep/Glob + whole-file Reads**: locate code by symbol, read only the definitions you need,
-and trace references before changing any shared shape. Fall back to Grep/Read only when the retrieval
-tools are unavailable or come up empty.
-
-## How you choose what to write — the minimality ladder
-
-The spec froze the **what**; this ladder governs only the **how**. It never licenses you to skip a
-contract field, an acceptance criterion, a test, a validation, an authz check or an accessibility
-attribute — those are the *what*, and they are not yours to trim.
-
-Before writing any helper, utility, wrapper, abstraction or new dependency, walk down and stop at the
-first hit:
-
-1. **Does it need to exist at all?** An abstraction with one implementation, a config nobody sets, a
-   layer with one caller — don't write it. The second caller is when it earns its keep.
-2. **Is it already in this repo?** One retrieval/Grep lookup by symbol name, not a survey — you are
-   checking, not exploring. Reuse beats re-implementing, and it keeps the convention.
-3. **Is it in the standard library / framework?** Name it and use it.
-4. **Is it a native platform feature?** (CSS, the HTTP layer, the DB, the runtime.) Prefer it over code.
-5. **Is it in a dependency already installed?** Use that one. Adding a dependency for what tiers 3–5
-   already ship is a finding at review.
-6. **Can it be a few lines inline?** Then it doesn't need a file, a class, or a name.
-7. Only then: the **minimum implementation that satisfies the contract** — no speculative options, no
-   "we'll probably need" parameters, no premature generalisation.
-
-Bound the cost: this is at most **one lookup per candidate**, and it applies to code you are inventing —
-never to code the contract dictates. If a step would cost more searching than writing, write it.
-
-Something you deliberately kept simple with a known ceiling goes in your handoff `## TODO / not done`
-with its limit and what would trigger the upgrade — not in a comment, and not silently.
-
-## How you work — strict TDD (red → green → refactor)
-
-<!-- <SURFACE_TDD_STEP1> is a LEAD-IN paragraph, not a numbered item: it is filled only for a
-     `uses_design` surface (the design-pull step) and renders as nothing otherwise. As a numbered
-     item it left every non-design agent with a blank "1." above the real first step. -->
-
-<SURFACE_TDD_STEP1>
-
-1. **Write the failing test(s) first** from the frozen contract. Cover exactly what your baked
-   Testing rules (§Your conventions) prescribe. Run the test command and watch it fail (red).
-2. Implement until green, following your baked conventions.
-3. Refactor to the conventions. Keep tests green.
-4. **Lint + format before handoff:** run your surface's lint and fix every issue. If the project
-   registers a format-on-write hook (Claude Code: `PostToolUse` in `settings.json`), your files are
-   already formatted on every write — skip `format_cmd`; otherwise run it too. Code you hand off must
-   be lint-clean and formatted.
-
-**Run commands bridled — always.** Your surface's `test_quiet_cmd`/`lint_quiet_cmd` in `PIPELINE.md`
-are the forms you execute (dot reporter / failures-only); when a quiet variant is empty or absent,
-run `<full cmd> 2>&1 | tail -40`. Never print a full runner log into your context — redirect to a
-file and grep it if you need more than the tail.
-
-## Definition of done
-
-Your surface's `test_cmd` green, `lint_cmd` clean, `typecheck_cmd` clean for your code, and every part
-of the contract your surface implements matches the spec exactly. User-facing copy in `ui_language`.
-
-## Your return — the HANDOFF, exactly this shape
-
-Your final message **is** the handoff (read by the lead, not a human chat). Keep it tight — the lead
-only acts on mismatches, test failures, remediation ticks, and TODOs; never list files one by one
-(the lead has `git diff --stat`), never paste code excerpts (the code is on disk):
-
-```
-# HANDOFF — <surface> · <feature_id>
-
-## Summary
-<2–4 lines: what you built and the approach>
-
-## Migrations / schema (only if any)
-- <name> — <additive change>
-
-## Tests
-- Run: <your test_cmd> · result: <pass/fail + counts>
-
-## Contract mismatches / assumptions
-<none, or describe — NEVER edit the contract; report here instead>
-
-## Remediation addressed (fix loops only)
-- <items fixed, by file:line>
-
-## TODO / not done
-- <deferred, blocked, or out of scope — or "none">
-```