cohorte 2.10.1 → 3.0.0-dev.0

package/core/commands/cohorte-build.md

@@ -1,219 +0,0 @@
----
-model: sonnet
-description: Author the contract from the frozen spec, then dispatch one implementer agent per surface in parallel.
-argument-hint: <feature_id>
----
-
-You are the **lead**. Build feature **$ARGUMENTS** from its frozen spec.
-
-> Read `PIPELINE.md` §`pipeline-profile` first: the `surfaces` list (how many implementers to
-> dispatch + their agent names), `contract` (mechanism + path), and the `design` flag. _Skip the
-> re-read if it's already in your context this session and unmodified since._
->
-> **Kanban** (SCHEMA.md §Kanban): once §1 confirms the frozen spec, run
-> `<core>/pipeline/scripts/kanban-move.sh auto $ARGUMENTS building`. `auto` resolves the board from the config itself and
-> exits 0 with a `kanban: <reason>` line when there is none — so **never decide "no board is
-> configured" without running it**. That inference, not a missing board, is what used to freeze
-> cards mid-pipeline.
-
-## 1. Load & check
-
-- Check the spec front-matter FIRST — `grep '^status:' specs/$ARGUMENTS.md` (or Read with a ~15-line
-  limit) — before any full read. Buildable statuses are `frozen`, `in-review` and `in-progress`
-  (SCHEMA.md §Spec status). `blocked` means a previous round gave up here: say so, and route by the
-  spec's `## Remediation` — open items ⇒ `/cohorte-fix`, none ⇒
-  continue this build. Anything else (`draft`, missing, `shipped`) ⇒ stop and tell the human to run
-  `/cohorte-spec` first. Only then read the body, selectively: front-matter, §5 contract, the surface
-  task sections, and `## Remediation` (fall back to a full read if the spec doesn't follow the
-  template's headings).
-- **`kind: patch` in the front-matter ⇒ this is a bug fix** frozen by `/cohorte-patch`, and it is
-  built by this command like any other spec, with two differences called out where they apply: §1.6
-  judges it against its regression test instead of a contract, and §2 authors no contract unless §5
-  carries a delta. Everything else — surface mapping, parallel dispatch, roll call, metrics — is
-  identical, and `kind` absent means feature, so nothing changes for existing specs.
-- **Route check** — if `## Remediation` has open `- [ ]` items and none requires a contract change,
-  stop and tell the human to run `/cohorte-fix $ARGUMENTS` instead: it re-dispatches only the surfaces with
-  findings. A full build with open items is only right when the contract change ripples into clean
-  surfaces (the case `/cohorte-fix` §1 falls back here for).
-- **Design gate** — only if `design.enabled` and the feature has UI (some surface `uses_design`): if the
-  spec front-matter `design_files` is empty, ask the human for the feature's design **links** and store
-  them in `design_files`, then continue. Each entry is a full self-contained link of the form
-  `https://claude.ai/design/p/<projectId>?file=<file>` — it carries its own project (the `/p/<projectId>`
-  path segment) and page (the `?file=` query), so nothing needs a stored project id and the reference
-  survives a design-system rebuild (a new DS ⇒ just paste the new links, no profile change). _Legacy bare
-  file names still resolve against the optional `design.design_project` fallback, but new specs use links._
-  Skip if the feature is backend-only / no UI.
-- If this is a fix loop (`## Remediation` has unchecked items), map each open item to a surface by its
-  `file:line` path — each agent gets ONLY its own surface's items, inlined in its dispatch (§3).
-
-## 1.5 Reconcile surfaces — auto-grow / specialize agents
-
-Map every area the spec touches (§5 contract + each surface's tasks + touched paths) onto the
-`surfaces[]` in `PIPELINE.md`. Two triggers add an agent — handle them BEFORE authoring the contract:
-
-- **Unowned area → new agent.** If the spec introduces work in a tree that falls under NO existing
-  `surfaces[].path` (a genuinely new thing — a new service, a new app, a new top-level area), that work
-  has no owner. Auto-detect it and propose a new surface for it.
-- **Bottleneck area → specialize.** If one existing surface carries a large, cleanly-separable chunk of
-  this feature (e.g. a whole new feature-module) that would dominate build time, propose splitting that
-  chunk into its own specialized surface. Use the heuristic in SCHEMA.md §Specialization — only when the
-  boundary is clean; skip when tangled or tiny.
-
-For each surface to add: infer its `key`, `path`, `label`, `agent`, `tools`, `model`, `*_cmd`s, and
-`uses_design` (mirror a sibling surface), show the human a one-line proposal, and on go-ahead **render it now** per
-SCHEMA.md §"Rendering / reconciling a surface agent" — write the `surfaces[]` entry + §Conventions/§Testing
-stanza into `PIPELINE.md`, render `<agents>/<agent>.md` from the implementer template, applying the
-shared-code rule (shared trees get a single-owner surface; cross-slice shapes go through the contract).
-This is the automatic path: you don't send the human back to `/cohorte-init-pipeline`. If nothing new is needed,
-say so and continue. Dispatch (§3) then covers the reconciled surface list.
-
-**Adding or splitting a surface is an architectural decision** — append ONE line for it to
-`specs/_decisions.md` §Live (SCHEMA.md §Decisions; create from `<core>/templates/decisions.template.md`
-if absent), area `surfaces`, e.g.
-`- <date> · surfaces · <key> owns <path>, single owner of <what> — because <the boundary reason> · $ARGUMENTS`.
-One `>>` in the Bash call you're already making. Nothing added ⇒ nothing to append.
-
-## 1.6 Readiness verdict — the gate before N dispatches
-
-**Zero extra agents: you already hold the spec, the profile and the reconciled surface list.** The
-whole point is that a bancal spec costs one verdict here instead of N implementers discovering it in
-parallel. Judge the frozen contract on **implementability only** — never on whether the feature is a
-good idea (that was `/cohorte-brainstorm`), never by re-reading files you don't already need:
-
-1. **Contract completeness** (§5) — every endpoint/interface has method+path (or signature), auth,
-   request fields with types + validation, the success shape, and its error cases. A missing
-   **request or success shape** ⇒ `NOT-READY` (an implementer would invent it, and the other surface
-   would invent a different one). A missing **error case** ⇒ `RESERVATIONS`.
-   **On a `kind: patch` spec this check is replaced, not skipped** — a patch has no contract to be
-   complete, so judge §1 Symptom & repro + §4 Regression test instead: no stated expected behaviour,
-   or a §4 that names no test and no reason the fix would be verifiable ⇒ `NOT-READY` (an implementer
-   would fix whatever it guessed the bug was, and nothing would catch a wrong guess). A repro
-   explicitly frozen as a hypothesis, or a cause left to the implementer to find, is
-   `RESERVATIONS` — normal for a patch, never a blocker. Then judge §5 as above **only** if it
-   carries a delta rather than `none`.
-2. **Surface coverage** — every §6 task maps to a surface in the reconciled list, and every contract
-   entry has an owner **on each side it names** (producer and consumer). A contract entry no surface
-   owns ⇒ `NOT-READY`.
-3. **Dependencies exist** — for the modules, packages, tables, env vars and shared helpers the spec
-   names as *pre-existing*: verify them in ONE Bash call (`test -f` / `grep -l` / a package-manifest
-   grep, output redirected — never a file read per name). Named as pre-existing but absent, and not
-   listed as created by this feature ⇒ `NOT-READY`.
-4. **Residual ambiguity** (§10) — an open question a surface would have to *guess* at: blocks a
-   contract decision ⇒ `NOT-READY`; merely narrows an implementation choice ⇒ `RESERVATIONS`.
-5. **Design gate** — a `uses_design` surface in scope with `design_files` still empty ⇒ `NOT-READY`
-   (this is §1's gate restated as a verdict, so an automated driver sees the same fact).
-
-Write the machine-readable verdict to `specs/reports/$ARGUMENTS.readiness.json` (overwrite,
-`mkdir -p specs/reports` first — the same gitignored buffer dir `/cohorte-review` stages into, which may not
-exist yet on a first build) — on **every** build, including `READY`. It is the only channel between
-this gate and any automated driver, which parses no prose:
-
-```json
-{ "id": "$ARGUMENTS", "phase": "readiness", "ts": "<ISO>", "verdict": "RESERVATIONS",
-  "gaps": ["contract|POST /orders|no 409 case for a duplicate id"],
-  "surfaces": ["backend", "frontend"] }
-```
-
-- **`gaps`** — one normalized string per gap, `<check>|<where>|<what is missing>`: `<check>` is
-  `contract` · `coverage` · `dependency` · `ambiguity` · `design` — plus `repro` on a `kind: patch`
-  spec, for a gap check 1 raised against §1/§4; `<where>` is the contract entry,
-  surface key or dependency name (no `:line` — it shifts on every edit); `<what>` is the gap, not the
-  fix. `READY` ⇒ `[]`.
-- **`NOT-READY` ⇒ STOP: author no contract and spawn NO agent.** Print the gaps and send the human to
-  `/cohorte-spec $ARGUMENTS` to patch the contract, then re-run `/cohorte-build`. This abort is the whole point of the
-  step — a spec that cannot be built does not get cheaper by being built N times in parallel.
-- **`RESERVATIONS` ⇒ continue.** It never blocks (a gate that stalls a sound build on a missing error
-  case would cost more human round-trips than it saves): inline each gap verbatim into the dispatch of
-  the surface it affects, as an explicit assumption the agent must implement *and* flag in its handoff,
-  and relay the list to the human in one line each.
-- **`READY` ⇒ continue silently** — one line, no restatement.
-
-## 2. Author the contract (lead-only — the single sync channel)
-
-_Skipped entirely on a `kind: patch` spec whose §5 Contract delta is `none`_ — which is the usual
-case: a bug fix corrects behaviour behind a shape that already exists, and re-authoring that shape
-would put the contract file in the diff for nothing. Say you skipped it and why, in one line. A patch
-whose §5 **does** carry a delta is authored exactly as below, from the delta, against the existing
-file — never rewritten from scratch. (A patch needing *new* contract surface area never reaches here:
-`/cohorte-patch` §3 routes it to `/cohorte-spec`.) When you skip, still run `date +%s` on its own —
-the skipped postcondition is where §4's wall-clock start comes from, and a build with no start epoch
-writes a metrics line with no duration.
-
-_Only if `contract.enabled`._ From §5 of the spec, write/update the feature's contract file at
-`<contract.path>/$ARGUMENTS.<contract.ext>` in the profile's `mechanism` (e.g. Zod v4 schemas + inferred
-types for `shared-types-zod`). Export it from `contract.index` if set. This is the ONLY file the agents
-share; they import it read-only and must not edit it. If `contract.enabled` is false, the spec prose is
-the sync channel — say so and skip, but still run `date +%s` on its own (same as the patch skip
-above: §4's wall-clock start comes from here, and a build with no start epoch writes a metrics
-line with no duration). **Postcondition (if `contract.enabled`):**
-`test -f <contract.path>/$ARGUMENTS.<contract.ext> && date +%s` — the contract file must exist before
-you dispatch §3, or the stateless agents have nothing to build against (the epoch output is §4's
-wall-clock start — no separate timing call).
-
-## 3. Dispatch one implementer per surface — IN PARALLEL
-
-Spawn every surface's agent in a **single message** (one dispatch each) so they run concurrently —
-NEVER serially: build wall-clock must be the slowest surface, not the sum. Use
-the reconciled `surfaces` list from §1.5 (existing + any just-rendered). Give EACH only what a stateless
-agent needs — re-supply everything every time, as **exact file paths** (spec, contract, the surface's
-tree), never "find the relevant files". Keep the dispatch prompt **byte-identical across dispatches
-and fix loops** except the two variable slots, which sit at the END of the prompt so every repeat hits
-the prompt-cache prefix. Never paste a diff into a dispatch — the agent computes its own, scoped to its
-tree. For each surface in `surfaces`:
-
-> `subagent_type: <surface.agent>` — "Implement the **<surface.key>** surface for feature `$ARGUMENTS`.
-> Read `PIPELINE.md` first. Spec: `specs/$ARGUMENTS.md`. Contract: `<contract.path>/$ARGUMENTS.<ext>`
-> (import read-only). Work test-first. Touch only `<surface.path>`. Need the current state of your
-> tree? Compute it yourself: `git diff <default_branch> -- <surface.path>`. Return the handoff in the
-> format your agent instructions define. Design files: <the spec's `design_files` links — each
-> `https://claude.ai/design/p/<projectId>?file=<file>` carries its own project + page, fetch read-only
-> via `DesignSync get_file`, build mobile-first · or `none` (non-design surface, or a fix loop whose
-> open items are all non-visual)>. Open Remediation items for YOUR surface (self-contained — fix
-> exactly these, reading only the files they name; `none` ⇒ first build, implement the spec's tasks
-> for your surface): <the surface's open `- [ ]` lines verbatim, or `none`>. Readiness gaps for YOUR
-> surface (§1.6 `RESERVATIONS` — the spec is silent here: implement the stated assumption and flag what
-> you assumed in your handoff): <that surface's `gaps` entries verbatim, or `none`>."
-
-## 3.5 Roll call — account for EVERY dispatch before integrating
-
-A surface's work can die: a rate limit mid-run, a transport error after retries, context exhausted.
-When it does, it returns **nothing** — and nothing is byte-identical to "a clean surface with nothing
-to report". Silence is not a green light; treat it as the failure it is (SCHEMA.md §Dead agents).
-
-- **Roll call.** Every surface handled in §3 must come back with a handoff in the format its
-  agent instructions define. Missing, empty, or truncated mid-sentence ⇒ that surface is **dead**.
-- **Never infer success from silence,** and never speak for a dead agent — you did not see its work.
-- **Retry that surface ONCE, alone.** Re-dispatch it with the byte-identical §3 prompt. The other
-  surfaces' work is already on disk and untouched, so this costs one agent, not a rebuild — and most
-  deaths are transient. Never retry a surface that *did* answer.
-- **Died twice ⇒ stop guessing and look.** Run that surface's own quiet commands
-  (`<surface>.typecheck_cmd`, `lint_quiet_cmd`, `test_quiet_cmd`) with output redirected to
-  `specs/reports/$ARGUMENTS.<key>.deadcheck.txt`, then grep it — never into your context. Report the
-  three results plus which of the spec's tasks for that surface actually landed, checked against the
-  tree, not against a handoff you never got. Say plainly that the surface is **unverified**.
-
-## 4. Integrate
-
-When all return, flag any contract mismatch or failing test from the handoffs; otherwise print one
-status line per surface (`<key> · tests pass/fail · <n> TODOs`) — do not restate handoff content.
-A dead surface (§3.5) prints `<key> · DEAD — unverified` and **the batch is never reported as ok**.
-Append **ONE line for the batch** to the **main checkout's** `<state>/pipeline-metrics.jsonl` —
-NOT the worktree's, which dies at teardown while metrics must accumulate across features. Resolve
-it from anywhere: `$(dirname "$(git rev-parse --git-common-dir)")/<state>/pipeline-metrics.jsonl`
-(in the main checkout this resolves to itself). Create it if absent; it must be gitignored.
-Compute the elapsed time in the same Bash call
-(`echo "{...\"seconds\":$(($(date +%s)-<start epoch from §2>)),...}" >> …`):
-`{"ts":"<ISO date>","feature":"$ARGUMENTS","phase":"build","seconds":<wall-clock>,"surfaces":{"<key>":"ok|error|dead",…}}`
-— **write this line even when a surface died.** An incomplete batch is exactly the batch worth having
-in the record; skipping the append to "wait until it's complete" silently deletes the evidence that
-anything went wrong. In the same call write the machine-readable batch result to
-`specs/reports/$ARGUMENTS.build.json` (overwrite) — the channel an automated driver reads, since it
-never sees your chat:
-`{"id":"$ARGUMENTS","phase":"build","ts":"<ISO>","surfaces":{"<key>":"ok|error|dead",…},"dead":["<key>",…]}`
-— this is the evidence SCHEMA.md §Specialization asks for before splitting a surface.
-Then tell the human: exercise the feature by hand if it's worth it, then run `/cohorte-review $ARGUMENTS` —
-unless a surface is dead, in which case say so first and let them decide whether to re-run `/cohorte-build`
-(a dead surface has no findings, so `/cohorte-fix` has nothing to re-dispatch).
-Do not run the app or migrations yourself here — building is not running.
-**Recommend a `/clear` now** — the spec, contract and diff are all on
-disk, and the lead's history is re-sent at input price on every turn it survives.

package/core/commands/cohorte-doctor.md

@@ -1,194 +0,0 @@
----
-model: sonnet
-description: Diagnose the pipeline installation — core version, pointer, agents↔surfaces, hooks, gate, retrieval, design, isolation — and print the exact fix for each failure.
----
-
-You are the **pipeline doctor**. Check every piece of wiring the pipeline depends on and report a
-✅/⚠️/❌ checklist, each failure with its **exact fix command**. Diagnose read-only first; apply a
-fix only with the human's go-ahead (or hand them the command).
-
-> Wiring that worked at init rots: PATH changes, uninstalls, hand-edits, half-done updates. This is
-> the one place that verifies it all.
-
-## Checks, in order
-
-0. **Runtime.** Say which coding agent you are running as and what it can enforce — every check
-   below is read through it. **You already know which one**: the Runtime preamble at the top of
-   this file names it. Read `<core>/pipeline/runtimes.json` for the details — a map of every
-   runtime installed against this core, since they share one core. Report one line:
-   `runtime: <label> · scope <global|project> · hooks <yes|no> · workflows <yes|no>`,
-   and name the other installed runtimes if there are any (they share `<state>` and `<config>`, so
-   a board or a gate config wired from one is seen by all — that is intended, and worth stating).
-   File absent ⇒ a core installed before the adapter existed ⇒ ⚠️, fix by re-running the installer.
-   A runtime without hooks makes check 3's gate **advisory** — say so there rather than
-   reporting a false ✅.
-1. **Core & pointer.** A core exists (`<core>/pipeline/VERSION`); `<state>/pipeline.json` names a mode + `core_version`
-   coherent with the VERSION file. A **global**-mode pointer lagging the VERSION file is ⚠️, not ❌:
-   nothing bumped that field before 1.2.5, so the core itself is fine and only the pointer is stale
-   ⇒ fix by running `/cohorte-update-pipeline` (§3 syncs it now), or by editing the one field. Compare
-   against `npm view cohorte version` — behind ⇒ suggest `/cohorte-update-pipeline`. Read `pipeline/CHANGELOG.md` for what they're missing. The router
-   commands' step files are present — `templates/steps/init-pipeline/` non-empty (a router whose
-   `templates/steps/<cmd>/` dir is missing is a partial/stale install ⇒
-   re-run install/update). **Shipped scripts present and executable** in `<core>/pipeline/scripts/`:
-   `kanban-move.sh`, `preflight.sh`; the `new-feature.sh.template` and
-   `remove-feature.sh.template` sources must be readable, not executable — ❌ any missing one.
-   Every caller chains these with `|| true`, so an absent script is a **silent**
-   no-op (no kanban card moves, no error anywhere) — this check is the only thing
-   that sees it. Also flag ❌ a `VERSION` **newer than** the other `pipeline/` files (compare mtimes):
-   a version bumped without a full re-copy is a half-done update ⇒ re-run install/update.
-2. **Profile.** `PIPELINE.md` exists and its `yaml pipeline-profile` block parses. Every
-<!-- cohorte:if runtime:codex -->
-   `surfaces[].agent` has a valid `.codex/agents/<agent>.toml` in this project, regardless of
-   core scope. Check `name`, `description`, `developer_instructions` and no unfilled placeholders.
-   Reconcile only this project's agents; never treat unrelated global agents as orphans.
-   Generic `review.toml`, `release.toml`, `profile-reader.toml` live under `<fixed-agents>/`.
-   The read-only generic agents must carry `sandbox_mode = "read-only"`.
-   Missing `model` means inheritance, not an error. Reject Anthropic aliases; compare explicit
-   Codex model pins with the profile when supplied. Claude `tools:` is not a Codex TOML field.
-   Flag project launchers that redefine `CODEX_HOME` just to discover local agents; native
-   project discovery needs no auth symlink. Do not delete global agents without checking ownership.
-<!-- cohorte:else -->
-   `surfaces[].agent` has its `<agents>/<agent>.md` and every agent file has its `surfaces[]`
-   entry — **no orphans either way** (SCHEMA.md rule). Each rendered agent's frontmatter `tools`
-   matches its surface's `tools` (incl. `DesignSync` iff `uses_design`, retrieval MCP tools iff
-   `retrieval.provider` ≠ `none`). **Model pins:** each rendered agent's frontmatter `model` matches
-   its `surfaces[].model` — ❌ if missing, mismatched, or a literal `<SURFACE_MODEL>` placeholder
-   (all three silently fall back to inheriting the lead session's model — often Opus — on every
-   dispatch); ⚠️ any `inherit` with the note that it bills at the lead's tier. The generic agents
-   (`review.md`, `release.md`, `profile-reader.md` in `<agents>/`) must
-   each carry their `model:` line too (sonnet/haiku/haiku).
-<!-- cohorte:endif -->
-<!-- cohorte:if runtime:claude -->
-   **Command pins:** every mechanical command file
-   (`build`, `review`, `fix`, `ship`, `audit`, `refactor`, `doctor`, `align-ds`,
-   `update-pipeline` — in `<commands>/`) carries `model: sonnet` in
-   its frontmatter — ⚠️ if missing (the lead's orchestration turn then bills at the session model,
-   e.g. Opus/Fable). `brainstorm`, `spec`, `patch`, and `init-pipeline` are intentionally unpinned
-   (interactive — they inherit the session model).
-<!-- cohorte:endif -->
-
-3. **Hooks & gate.** `<state>/gate-config.json` exists and mirrors the profile's `gate` block
-   (regenerate if drifted).
-<!-- cohorte:if hooks -->
-   The gate hook is registered **once** in the config file the Runtime preamble names — flag a
-   double registration, it double-prompts — and its `command` points at a `gate.py` that exists.
-   Check the **matcher** actually covers what it must: on Claude Code that means both `Bash` and
-   `Task`, since the preflight phase gate keys off `Task` dispatches and a `Bash`-only matcher
-   leaves it silently dead (the 1.3.0–1.3.1 regression).
-<!-- cohorte:if runtime:codex -->
-   Codex's matcher must cover `Bash` plus `spawn_agent`/`Agent`, and
-   `gate.py` must read `tool_input.agent_type`. With preflight enabled and no fresh stamp,
-   a synthetic `spawn_agent` review payload must be denied. Check client hook enablement/trust
-   separately; a direct script check is not proof the client invoked it.
-<!-- cohorte:endif -->
-   Test the evaluator too: `python3 <core>/hooks/gate.py --check "<a pattern from the ask list>"` must
-   return a non-`allow` verdict. If the Runtime preamble said this runtime has **no confirmation
-   tier**, state it here too: every `ask` pattern behaves as a `deny`, which is safe but stricter
-   than the profile reads, and a human who expects a prompt will read the refusal as a bug.
-<!-- cohorte:endif -->
-<!-- cohorte:if !hooks -->
-   This runtime has **no blocking hook**, so the gate is **advisory**: it only fires when the agent
-   calls it. Say that in one line rather than reporting ✅ — the enforcement property genuinely is
-   weaker here, and a human who thinks otherwise will approve less carefully. Verify what CAN be
-   verified: `<core>/hooks/gate.py` exists and `python3 <core>/hooks/gate.py --check "git push"`
-   returns a verdict line (a non-`allow` on a gated pattern proves config + script are wired). ❌ if
-   the script is missing or errors; ℹ️ "advisory (this runtime has no hooks)" otherwise.
-<!-- cohorte:endif -->
-   Then the **preflight stamp is local, never versioned**: `git ls-files --error-unmatch
-   <state>/preflight.ok` must miss, and `.gitignore` must cover it. A tracked stamp is a ❌ (not a
-   ⚠️) — it records the tree it verified, the commit that carries it moves HEAD past that tree, and
-   the committed copy lands in every clone and new worktree; the gate then blocks clean trees and
-   greens unchecked ones. fix: `git rm --cached <state>/preflight.ok` + add it to `.gitignore`.
-4. **Retrieval** (if `retrieval.provider` ≠ `none`). Run the SCHEMA.md §Code retrieval health
-<!-- cohorte:if runtime:codex -->
-   check: CLI resolvable from PATH, `[mcp_servers.<provider>]` in `.codex/config.toml`,
-   `.serena/` gitignored, and tools actually connected in this session. A standalone
-   `.mcp.json` is not Codex project registration.
-<!-- cohorte:else -->
-   check: CLI resolvable from PATH, `.mcp.json` entry present in PATH-proof launcher form,
-   `.serena/` gitignored, server actually connects.
-<!-- cohorte:endif -->
-5. **Design** (if `design.enabled`). `snapshot_dir` exists and is committed; `ui_kit_path` +
-   `tokens_path` exist; if `provider: claude-design`, `DesignSync` responds (`list_files` on the `design_system_project`) and
-   `design_system_project` is reachable. Recall: spec `design_files` are full
-   `…/design/p/<projectId>?file=<file>` links that carry their own project + page; `design_project` is
-   only a legacy fallback for old bare-filename specs (default `none`).
-6. **Isolation** (if `isolation.enabled`). `scripts/new-feature.sh` + `scripts/remove-feature.sh`
-   rendered (no `__TOKEN__` placeholders left). `.worktrees/slots.tsv` coherent with
-   `git worktree list` — flag **stale slots** (registered but no worktree) and **zombie worktrees**
-   (worktree but no slot / spec already `shipped`) ⇒ suggest `scripts/remove-feature.sh <id>`.
-   When ≥2 slots are live, print the parallel-feature table (feature · worktree · ports · db ·
-   branch behind main by N commits) — a worktree far behind main means its next review will diff
-   against stale code ⇒ suggest rebasing it.
-7. **Kanban** (the board mirror — SCHEMA.md §Kanban). Run
-   `<core>/pipeline/scripts/kanban-move.sh --check` and report its one line verbatim: the resolved
-   board path, or the exact link that is missing. A board mirror is optional, so "not configured" is
-   ℹ️, never ❌ — but it must be **stated**, because the whole class of bug here is a card that
-   quietly stopped moving while every command still reported success. Two states earn a ⚠️ with the
-   fix named: `boards` has no entry for this profile's `name` while it does have an entry for some
-   other key whose board file exists (a **rename** orphaned the link — re-key it via
-   `/cohorte-update-pipeline`), and an entry whose board file no longer exists at
-   `vault_path`-relative `board` (moved or renamed in the vault).
-<!-- cohorte:if workflows -->
-8. **Workflows** (the opt-in execution path — SCHEMA.md §Workflows; the conversational commands
-   stay the default, so failures here are ⚠️ at most, never ❌). Report which path this machine will
-   take and why:
-   - **Claude Code version** ≥ 2.1.154 (`claude --version 2>/dev/null | head -1`) — older or no CLI
-     on PATH ⇒ conversational only. This is the **workflow** floor and the only one that gates this
-     check; do NOT raise it to match a newer feature's floor, or every install between the two
-     versions reads as broken while its workflows run fine. When `design.inline` is on, report the
-     design floor (≥ 2.1.234) as its own line under check 8b — separate prerequisite, separate verdict.
-   - **Scripts present:** `<core>/workflows/review.js` + `audit.js` + `refactor.js` + `loop.js` —
-     missing on a current core ⇒ half-done install, re-run install/update. (`/cohorte-loop` is
-     **workflow-only** — no command file exists on purpose; without this runtime it refuses
-     rather than degrading to a conversational loop.)
-   - **Phase-0 agent present:** `<agents>/profile-reader.md` — the workflows abort without it.
-   - **Workflows enabled in this session** — the `Workflow` tool is in your own toolset right now;
-     absent ⇒ disabled for this session (a setting or an old client), conversational path.
-   - **Preflight wiring** (used by both paths): `pipeline/scripts/preflight.sh` executable and
-     `gate-config.json` carries the `preflight` block — mismatch ⇒ regenerate from the profile.
-   End the check with ONE summary line, e.g.
-   `workflows: available (opt-in — ask to "run the review workflow")` or
-   `workflows: unavailable (<first failing prerequisite>) — conversational commands (the default)`.
-<!-- cohorte:if inline_design -->
-8b. **Inline design** (`design.inline: true` — the `/design` artboard step between spec and build).
-   A research preview, so every failure here is ⚠️, never ❌: the design brief still exists on disk
-   at `specs/design/<feature_id>.md` and can be carried to the design tool by hand, which is what
-   every install did before this flag. Report:
-   - **Claude Code version** ≥ 2.1.234 — `/design` ships as a skill and is simply absent below it.
-     Older CLI ⇒ say so and name `npm i -g cohorte@latest`'s sibling, `claude update`.
-   - **The `/design` skill resolves in this session** — absent ⇒ the preview is off for this account
-     or plan (Pro/Max/Team/Enterprise are the eligible ones), not a cohorte defect.
-   - **`design.enabled` is true and `provider` is `claude-design`** — `inline` on top of a `figma` or
-     `none` provider is a profile contradiction; name it and point at `/cohorte-update-pipeline`.
-   - **Artboards are not persisted for you.** State it every run, unconditionally, even when all
-     three checks pass: the preview hands designs to the build step but does not save them, so an
-     artboard nobody exported dies with the session. This is the single thing most likely to lose
-     work, and it is not detectable after the fact.
-   One summary line: `inline design: available (preview — export artboards yourself)` or
-   `inline design: unavailable (<first failing prerequisite>) — design brief on disk, carry it over by hand`.
-<!-- cohorte:endif -->
-<!-- cohorte:else -->
-8. **Preflight wiring.** `<core>/pipeline/scripts/preflight.sh` is executable and
-   `gate-config.json` carries the `preflight` block — mismatch ⇒ regenerate from the profile.
-   (The workflow execution path does not exist on this runtime; the conversational commands are
-   the only path, which is also the default everywhere else. Not a defect — state it and move on.)
-<!-- cohorte:endif -->
-9. **Specs & metrics.** Every `specs/*.md` front-matter `status` is a valid stage — one of
-   `draft · frozen · in-progress · in-review · shipped · blocked` (SCHEMA.md §Spec status) — excluding
-   `_`-prefixed files (the spec template and `specs/_decisions.md`, the decision journal) and
-   `specs/refactor-backlog.md`, which `/cohorte-audit` writes as a backlog, not a
-   spec, and which has no front-matter to check. A spec left `in-progress` or `blocked` is a round
-   that never finished ⇒ say so and route it: open `## Remediation` items ⇒ `/cohorte-fix`, none ⇒
-   `/cohorte-build`. `shipped` specs
-   with a live worktree flagged (see 6). `<state>/pipeline-metrics.jsonl` and `specs/reports/` (the
-   `/cohorte-review` report buffer that lets a `/cohorte-fix` survive a `/clear`) are gitignored. Metrics
-   belong to the **main checkout** — a `pipeline-metrics.jsonl` inside a live feature worktree is a
-   stale-core sign (its lines die at teardown) ⇒ suggest appending its lines to the main checkout's
-   file and deleting the stray.
-
-## Report
-
-Group by check, one line each: `✅|⚠️|❌ <check> — <one-line detail>`; every ⚠️/❌ followed by
-`   fix: <exact command or edit>`. End with the overall count and, if anything failed, the ordered
-repair sequence. Nothing failing ⇒ say the installation is healthy, and the installed core version.

package/core/commands/cohorte-fix.md

@@ -1,80 +0,0 @@
----
-model: sonnet
-description: Apply a REVIEW REPORT — append it to the spec's Remediation, then re-dispatch ONLY the surfaces that have findings.
-argument-hint: <feature_id> [paste REVIEW REPORT]
----
-
-You are the **lead**. Run the fix loop for feature **$ARGUMENTS** — the scoped, cheap path after a
-`REVISE`/`BLOCK` verdict. The full `/cohorte-spec` (Mode B) + `/cohorte-build` path still exists for review returns
-that change the *contract*; `/cohorte-fix` is for everything else.
-
-> Read `PIPELINE.md` §`pipeline-profile` first: `surfaces` (paths + agent names) and `contract`.
-> _Skip the re-read if it's already in your context this session and unmodified since._
->
-> **Kanban** (SCHEMA.md §Kanban): on ingest, run
-> `<core>/pipeline/scripts/kanban-move.sh auto $ARGUMENTS fix`; the card returns to **Review** when `/cohorte-review`
-> re-runs. `auto` resolves the board from the config itself and exits 0 with a `kanban: <reason>`
-> line when there is none — so **never decide "no board is configured" without running it**.
-
-## 1. Ingest the report
-
-- The report is either pasted after the feature id (a REVIEW REPORT, or failures the human hit by
-  hand), this session's last `/cohorte-review` REVIEW REPORT, or — if the context was cleared — read from
-  `specs/reports/<id>.md`, where `/cohorte-review` stages its last report for exactly this reason.
-  If you have none of these, ask for it and wait.
-- Append each finding to `specs/<id>.md` **`## Remediation`** (same format as `/cohorte-spec` Mode B, under a
-  dated/numbered subheading): `- [ ] <severity> · <file:line> · <type> · <concrete fix>`. Set
-  `status: in-review`. Don't pull the whole spec into context for this: grep the line numbers of the
-  front-matter `status:` and the `## Remediation` heading, then Read only those regions (offset/limit)
-  before editing.
-- **Contract check:** if any finding implies the frozen contract must change, update spec §5 and
-  re-author the contract file yourself now (lead-only, per `/cohorte-build` §2) — agents never edit it. If
-  the contract change ripples into surfaces *without* findings, fall back to full `/cohorte-build` instead
-  and say so.
-- **Note the epoch** (`date +%s`) in the first Bash call you make here — §3's metrics line carries
-  `seconds`, and there is no separate timing call.
-
-## 2. Scope the re-dispatch — only surfaces with findings
-
-- Map every **open** (`- [ ]`) Remediation item to a surface by matching its `file:line` path against
-  `surfaces[].path`. Items already checked `- [x]` (fixed in a prior round) are done — skip them, never
-  re-dispatch them. Items outside every surface path (contract file, root config) are yours or go
-  to the most relevant surface — say which.
-- Re-dispatch **ONLY the surfaces owning ≥1 item**, in parallel, in a **single message** — the exact
-  dispatch template from `/cohorte-build` §3 (one byte-stable template for builds and fix loops; you do NOT
-  paste a diff — the agent computes its own, scoped to its tree). Fill the template's **Remediation
-  slot** with that surface's open `- [ ]` item lines **verbatim**, so the agent needs no spec re-read to
-  find its work; fill the design slot with `none` when a `uses_design` surface's open items are all
-  non-visual (no DesignSync re-fetch for a type fix), and the readiness-gaps slot with `none` (a fix
-  loop has no fresh §1.6 verdict). Surfaces without findings are NOT re-dispatched —
-  that is the point.
-
-## 3. Integrate & check off what's fixed
-
-When the agents return:
-
-- **Roll call first (SCHEMA.md §Dead agents).** A re-dispatched agent that returns nothing has fixed
-  nothing you can verify. Retry that surface ONCE with the byte-identical dispatch; still silent ⇒ leave
-  **every one of its items `- [ ]`** (a dead agent never ticks a box — that would hide an open finding
-  from the next round and from the driver), print `<key> · DEAD — items untouched`, and say the surface
-  is unverified.
-- **Tick the resolved items.** Each handoff's `## Remediation addressed` lists what that agent fixed
-  (by `file:line`). For every Remediation item an agent reports fixed, flip its `- [ ]` → `- [x]` in
-  `specs/<id>.md` and append a terse ` — fixed: <what/where>` note (the convention prior rounds already
-  use). Leave genuinely-unaddressed items `- [ ]` so the next loop still sees them. This keeps the
-  checkbox state honest and stops a later `/cohorte-fix` from re-dispatching already-fixed items (§2). Ticking
-  here is the lead's job — surface agents own only their tree, never the spec.
-- **Collapse fully-resolved rounds (keep the spec bounded).** When a whole dated Remediation round is now
-  entirely `- [x]`, replace its item lines with a single summary line (`- <date> — <N> findings, all
-  fixed`) — the audit fact survives, but the per-item bulk stops growing the spec that every agent
-  re-reads each loop. Keep any round with ≥1 still-open `- [ ]` item fully expanded (§2's skip logic
-  needs those checkboxes).
-- Print one status line per surface (`<key> · items fixed <n>/<m> · tests pass/fail`) — do not restate
-  handoff content — and append ONE metrics line for the batch to the **main checkout's**
-  `$(dirname "$(git rev-parse --git-common-dir)")/<state>/pipeline-metrics.jsonl` (never a bare
-  relative path: from a feature worktree that writes a stray sink whose lines die at teardown)
-  (rules in `/cohorte-build` §4, `phase: "fix"`).
-- Tell the human: re-test by hand if the failures were runtime ones, and `/cohorte-review $ARGUMENTS` for the
-  re-verdict — the re-review is what *verifies* the ticked items actually hold (a regression simply
-  reappears as a new finding in the next round). **Recommend a `/clear`** — all state (spec,
-  checkboxes, staged report) is on disk, and the lead's history is re-sent at input price every turn.

package/core/commands/cohorte-fleet.md

@@ -1,103 +0,0 @@
----
-model: sonnet
-description: Fly several features in parallel — overlap analysis and merge order, one isolated worktree per feature, a live status board, and the post-merge rebase sweep nobody remembers to do.
-argument-hint: plan <id> <id> [...] | status | sync
----
-
-You are the **fleet controller**. Parallel features already work in this pipeline — isolated
-worktrees, per-feature DBs and ports, one session per worktree — but the coordination between
-them is tribal knowledge: which specs collide, which merges first, and who rebases the
-survivors after each ship. This command owns exactly that coordination, and deliberately
-nothing more.
-
-**What this command will never do: spawn the work headless.** The obvious "cool" version —
-fire a loop per worktree from here — is the 2.2.0 driver's grave: child sessions nobody
-supervises, stalling on prompts nobody sees. Each feature's build/review/loop runs in **its own
-worktree's session**, supervised like any other; the fleet plans, watches and rebases. State
-lives in `specs/reports/fleet.json` (the main checkout's gitignored buffer — this repo's
-multi-*feature* flight plan).
-
-> Read `PIPELINE.md` §`pipeline-profile` first: `surfaces` (paths — the overlap analysis keys
-> on them), `contract`, `vcs.default_branch`, and the `isolation` block. _Skip the re-read if
-> already in context and unmodified since._ **`isolation.enabled: false` ⇒ stop at `plan`**:
-> N features in one checkout is a merge-conflict generator with extra steps — name the fix
-> (`/cohorte-init-pipeline` wires isolation) and go no further.
-
-## `plan <id> <id> [...]` — collide, order, provision
-
-1. **Every spec must be `frozen`** (front-matter grep, ~15-line reads — never full specs yet).
-   Anything else (`draft`, `in-review`, missing) ⇒ name it and stop; a fleet of half-frozen
-   specs is N problems flying in formation.
-2. **Overlap analysis** — read each spec's §5 contract entries and §6 surface tasks, then build
-   the matrix *feature × surface*, and flag the two collision classes:
-   - **Contract dependency** — spec B's §5 references shapes spec A introduces ⇒ B ships
-     **after** A, and B's worktree must rebase once A merges (the `sync` mode's job). This is
-     an ordering, not a blocker.
-   - **Same-tree writes** — two specs whose §6 tasks land in the same `surfaces[].path` (worse:
-     the same module). This is where parallel merges bleed; propose either an order (lighter
-     feature first) or — when the overlap is one file both must edit — say plainly that these
-     two should not fly together, and let the human drop one from the fleet.
-3. **Propose the merge order** from those edges (dependencies first, then ascending overlap),
-   show the matrix + order in a compact table, and get the human's go-ahead — the order is a
-   plan they will live with for days.
-4. **Provision worktrees** — for each feature without one: `scripts/new-feature.sh <id>` (the
-   rendered isolation script: worktree + branch + DB + port slot). Relay each script's output
-   line; a script failure stops the plan for that feature, never silently.
-5. **Write `specs/reports/fleet.json`** (overwrite): `{"ts":"<ISO>","order":[...ids in merge
-   order...],"features":{"<id>":{"worktree":"<path>","branch":"<branch>","dependsOn":[...]}}}`.
-6. **Print the launch plan** — one line per feature, in order: the worktree path to open a
-   session in, and the first command to run there (`/cohorte-build <id>`, or "ask for the loop
-   workflow: `{feature: \"<id>\"}`" on a runtime that has it). The human launches them; the
-   fleet does not.
-
-## `status` — one table, no archaeology
-
-Read `fleet.json` (absent ⇒ say `plan` comes first, stop). For each feature, **mechanical reads
-only, redirected — always from THAT feature's worktree**, never the main checkout (each worktree
-carries its own copy of `specs/<id>.md` and `specs/reports/`, and that copy is the one its run
-has been writing): `<worktree>/specs/<id>.md` front-matter `status` · the worktree's
-`specs/reports/<id>.loop.json` (`phase`/`round`/`outcome`) and `<id>.verdict.json`
-(`verdict`/`blocking`) when present · then ONE
-`git -C <worktree> fetch --quiet origin <default_branch> || true` and
-`git -C <worktree> rev-list --count origin/<default_branch>..HEAD` and `..origin/<default_branch>`
-(ahead / **behind** — behind is the number that matters, and against the *remote* ref: the local
-one goes stale the moment a PR merges on the host, which is precisely when status gets asked).
-One row per feature, in merge order:
-
-```
-<id> · <status> · loop: <phase> r<round> | <outcome> · blocking: <n> · ↑<ahead> ↓<behind> · next: <the one action>
-```
-
-`next` is the whole point of the mode: the single action per feature (a command to run in its
-worktree, "waiting on <dep> to merge", "ready to ship — its turn in the order", or "rebase
-needed — run sync"). A worktree registered in `fleet.json` but gone from
-`git worktree list` is reported as such, never silently dropped.
-
-## `sync` — the post-merge sweep
-
-Run after every merge (the human says which feature shipped, or you detect it: spec
-`status: shipped` + branch merged into `<default_branch>`):
-
-1. Drop the shipped feature from `fleet.json` (rewrite, keep order of the rest) — and if its
-   worktree still exists, remind the teardown `/cohorte-ship` proposes:
-   `scripts/remove-feature.sh <id>` (`--drop-db` at the human's call). Never run it unasked.
-2. For each surviving worktree, in merge order — `git -C <worktree> fetch origin
-   <default_branch>` **always**, then decide whether the rebase is THIS session's to run:
-   - **Tree dirty** (`git -C <worktree> status --porcelain` non-empty — the NORMAL mid-flight
-     state: feature work stays uncommitted until `/cohorte-ship`, so `git rebase` would refuse
-     with "unstaged changes" before any conflict even exists) **or a run in flight** (the
-     worktree's `loop.json` has no `outcome`): **do not touch it.** Report the row as
-     `rebase needed — run \`git rebase origin/<default_branch>\` from that worktree's own
-     session` (mutating a branch from outside its session, mid-run, is how work disappears).
-   - **Clean and idle**: rebase it, output redirected to `specs/reports/fleet-sync.txt`. A
-     conflict is reported verbatim and left for its owner (`git rebase --abort` restores) —
-     never resolved, never `--force`-anything from here.
-3. **Say the consequence out loud, per rebased (or rebase-needed) worktree:** the rebase moves
-   every commit, so any `reviewed_base`/`reviewed_digest` in that spec then describes a tree
-   that no longer exists — `/cohorte-ship` will (rightly) refuse until a fresh
-   `/cohorte-review` re-stamps it. A clean rebase is not a re-verdict; the re-review is.
-4. Reprint the `status` table.
-
-In chat, every mode prints its table/plan and nothing else — the matrix evidence and rebase
-logs live in `specs/reports/`. **Recommend a `/clear`** after `plan` (the flight plan is on
-disk; the sessions doing the flying are elsewhere anyway).

package/core/commands/cohorte-init-pipeline.md

@@ -1,31 +0,0 @@
----
-description: Detect this project's stack, interview the gaps, and generate PIPELINE.md + render the agents so the portable pipeline fits this repo.
-argument-hint: (none) — one-time per project; afterwards /cohorte-update-pipeline keeps everything current
----
-
-You are the **pipeline installer**. Your job: turn the generic pipeline into one tailored to **this**
-repo, by producing `PIPELINE.md` (the profile the whole pipeline reads) and rendering the per-surface
-agents. Interactive — confirm inferences with the human.
-
-> **Bootstrap (applies to every step):**
->
-> **Where the core lives (bundled vs global).** `<core>` above already names it — the adapter
-> resolved the scope at install time, so nothing here probes. Read it once to learn WHICH mode you
-> are in (`<core>` inside this repo ⇒ `bundled`; `<core>` under your home ⇒ `global`) and remember
-> it — Phase 4 branches on it. **Everything you GENERATE is always written into THIS repo**
-> (`PIPELINE.md` at the root, agents under `<agents>/`, config under `<state>/`), never into the
-> global core.
->
-> Work in phases. Do not write any file until Phase 4.
-
-## Steps — run in order
-
-| # | Step | Does | When |
-| --- | --- | --- | --- |
-| 01 | `01-detect-stack` | Detect stack, read-only — no questions yet | always |
-| 02 | `02-interview-gaps` | Ask only the gaps you couldn't detect | always |
-| 03 | `03-draft-profile` | Assemble & show the PIPELINE.md draft | always |
-| 04 | `04-write-render` | Write files & render surface agents | after go-ahead |
-| 05 | `05-report` | Print install mode, files, mapping | always |
-
-**Before running a step, read its file** in `<core>/templates/steps/init-pipeline/`. This table is a map, not the instructions.