cohorte 2.2.0 → 2.3.0

package/CHANGELOG.md

@@ -7,6 +7,59 @@ short, user-facing, most recent first. One `## <version> — <YYYY-MM-DD>` secti
 > They are history and are deliberately not rewritten — every command gained a `cohorte-` prefix
 > in 2.0.0.
 
+## 2.3.0 — 2026-08-12
+
+- **A bug fix had to pretend to be a feature.** The only way into the pipeline was
+  `/cohorte-spec` — a section-by-section interview whose critical part is a frozen §5 contract, with
+  a ~300-line budget. For a `500` on an empty cart that is more work than the fix, so in practice you
+  left the pipeline and patched by hand: no frozen intent, no review, no trace.
+
+  `/cohorte-patch` is the bug-fix entry point. A **triage, not an interview** — repro, expected
+  behaviour, what must not change — it locates the cause itself and freezes
+  `specs/patch-<slug>.md` (`kind: patch`, ~60 lines). The **§4 regression test replaces §5 CONTRACT**
+  as the thing the diff is checked against.
+
+  Then nothing downstream is special-cased: a patch spec *is* a spec, so `/cohorte-build` →
+  `/cohorte-review` → `/cohorte-fix` → `/cohorte-ship` consume it unchanged, one `/clear` between
+  each — four short sessions instead of one thread re-sending its own triage history at input price
+  every turn. Only three places read `kind: patch`: build §1.6/§2 (judge the repro + test, author no
+  contract when §5 is `none`), the `review` agent (scope creep becomes a first-class finding), and
+  ship (branch off `vcs.patch_branch_prefix`, `patch` bump by default, `fix(<scope>)` commit).
+
+  A patch may span **several surfaces** — one bug, one repro, one spec. The single hard escalation:
+  a fix needing **new** contract surface area is a feature wearing a bug's clothes, and it is routed
+  to `/cohorte-spec` rather than letting two surfaces invent a shape independently.
+
+- **Telemetry is gone — all of it.** The opt-in usage pings that shipped through 2.2.0 are removed
+  wholesale: the `telemetry-send.sh` sender, the per-phase pings in the six funnel commands, the
+  consent question in `/cohorte-init-pipeline`, the `telemetry:` block in the config template, the
+  `/cohorte-doctor` consent check, the collector contract in `SCHEMA.md`. Cohorte now sends nothing,
+  anywhere.
+
+  **Upgrading removes what is already on disk.** Copy-over never deletes, so an existing install
+  would otherwise keep an executable that still POSTs to the collector — all three installers
+  (`install.sh`, `install.ps1`, `npx cohorte`) now scrub it, and CI asserts its absence. And
+  `/cohorte-update-pipeline` deletes the leftover `telemetry:` block from
+  `~/.claude/cohorte.config.yaml`: nothing reads it any more, and an `enabled: true` left sitting in
+  a file you may open reads as though data were still leaving the machine.
+
+  The OpenTelemetry tip (Claude Code's own metrics export, a collector you point at yourself) is
+  gone from `SCHEMA.md` §Measuring cost and the token-economy guide too. `/cost` and
+  `pipeline-metrics.jsonl` remain — both entirely local.
+
+  `validate-core.mjs` gained a ratchet: any mention of telemetry or a usage ping under
+  `core/{commands,agents,templates,workflows}` now fails CI, so it cannot creep back in by copying an
+  old command file. The single exemption is `/cohorte-update-pipeline` — the command that *deletes*
+  the leftovers has to name them — and it is itself checked for never naming a ping, a sender or a
+  consent flow.
+
+- **Kanban:** `/cohorte-patch` with no argument offers the **Ideas** column, `[patch]`-titled cards
+  first, and titles its own card `[patch] <title>` (join key `#patch-<slug>`). The `[<kind>]` prefix
+  stays a human convention — nothing parses it.
+
+- **Profile:** new optional `vcs.patch_branch_prefix` (default `fix/`); `/cohorte-update-pipeline`
+  tops it up, and a profile without it falls back to the same default.
+
 ## 2.2.0 — 2026-08-12
 
 - **The pipeline was Claude Code or nothing.** The doctrine — frozen spec, stateless surfaces, a

package/README.md

@@ -256,6 +256,7 @@ it in `.claude/pipeline/VERSION` and bundled repos in their committed `pipeline.
 | `/cohorte-init-pipeline`     | Detect stack → interview → generate the profile + agents. Run once per project.       |
 | `/cohorte-brainstorm`        | Interactive persona panel that pressure-tests a feature idea.                         |
 | `/cohorte-spec`              | Freeze the feature spec + contract into `specs/<id>.md` (UI features also get a standalone design brief at `specs/design/<id>.md`). Also applies review returns. |
+| `/cohorte-patch [bug]`       | Bug-fix entry: triage a bug and freeze a ~60-line patch spec (`specs/patch-<slug>.md`) whose regression test replaces the contract. Then the normal `/cohorte-build → review → ship`. |
 | `/cohorte-build <id>`        | Readiness gate on the frozen spec, then the lead authors the contract and dispatches one implementer per surface in parallel. |
 | `/cohorte-review <id>`       | Read-only review agents (one per touched surface, parallel) audit the diff vs the spec; out-of-scope findings go to the refactor backlog. |
 | `/cohorte-fix <id>`          | Apply a review report: remediation into the spec, re-dispatch only the surfaces with findings. |
@@ -344,15 +345,13 @@ The essentials:
 
 Details: `profile/SCHEMA.md` §Workflows.
 
-## Privacy — opt-in telemetry
+## Privacy
 
-Cohorte can send **anonymous** usage pings (core version, OS, phase name, duration, per-surface
-result counts, and a *hash* of the feature id — never repo names, paths, code, or IPs). It is
-**strictly opt-in**: `/cohorte-init-pipeline` asks once per machine, the default is No, and both answers are
-recorded so you're never re-asked. Withdraw anytime (`telemetry.enabled: false` in
-`~/.claude/cohorte.config.yaml`); erase your history anytime (`/cohorte-doctor` prints your `install_id`,
-the collector's `DELETE /v1/install/<id>` drops it). Full spec + GDPR details:
-`profile/SCHEMA.md` §Telemetry (including the collector API contract).
+Cohorte sends nothing, anywhere. There is no telemetry, no usage pings, no collector — the
+opt-in stats that shipped through 2.2.0 were removed in 2.3.0, sender included. Everything the
+pipeline records (`pipeline-metrics.jsonl`, `specs/reports/`) stays in your repo, and the only
+network calls are the ones you can see: `git`, `gh`, and whatever MCP providers you wired
+yourself.
 
 ## License
 
@@ -380,7 +379,7 @@ profile/
   PIPELINE.template.md  # the profile skeleton /cohorte-init-pipeline fills
   SCHEMA.md             # field reference
   cohorte.config.template.yaml   # seeds ~/.claude/cohorte.config.yaml (kanban)
-scripts/                # worktree-isolation templates + shipped preflight/kanban/telemetry scripts
+scripts/                # worktree-isolation templates + the shipped preflight/kanban scripts
 dashboard/              # local web cockpit (npx … dashboard) — see dashboard/README.md
   server/               # dependency-free node runtime (serves the built app + JSON/stream API)
   app/                  # Vite + React source (built to dashboard/dist/ at publish time)

package/bin/cli.js

@@ -237,10 +237,10 @@ function copyCore() {
   // write where this runtime does not look.
   resolveTemplateConditionals(pipelineDir);
   // Copy the *.template files AND the shipped executables (kanban-move.sh,
-  // telemetry-send.sh). Until 1.2.4 this loop took only `.template`, so every
+  // preflight.sh). Until 1.2.4 this loop took only `.template`, so every
   // `npx cohorte install/update` produced a core missing both scripts — and since
   // every caller chains them with `|| true`, the result was silent: no kanban card
-  // moves, no telemetry pings, no error. The shell installers named them explicitly
+  // moves, no error. The shell installers named them explicitly
   // and this port drifted. The rule below needs no list to keep in sync: a `<x>.sh`
   // with an `<x>.sh.template` sibling is rendered per-project by /cohorte-init-pipeline, so
   // only the template ships; every other `.sh` is a shipped executable.
@@ -255,6 +255,12 @@ function copyCore() {
       try { fs.chmodSync(target, 0o755); } catch { /* optional */ }
     }
   }
+  // 2.3.0 removed telemetry. The copy loop above is by-rule, so it simply stops shipping the
+  // sender — but copy-over never deletes, and an existing install would keep an executable
+  // that still POSTs to the collector. Scrub it. The dead `telemetry:` block in the user's
+  // config is not this installer's to parse: /cohorte-update-pipeline deletes it, where an
+  // agent can edit the YAML surgically (SCHEMA.md §Reconcile step 5).
+  fs.rmSync(path.join(pipelineDir, 'scripts', 'telemetry-send.sh'), { force: true });
   // The per-surface implementer template is rendered per SURFACE later, by
   // /cohorte-init-pipeline inside the target repo — but its runtime shape (frontmatter keys,
   // capability branches, the preamble) is fixed here, at install time. Run it through the

package/core/adapter/render.js

@@ -196,7 +196,7 @@ function stateDir(runtime) {
   return runtime.id === 'claude' ? '.claude' : '.cohorte';
 }
 
-// The user-level config (kanban boards, shared vault, telemetry consent). One file per
+// The user-level config (kanban boards, shared vault). One file per
 // human, not per project or per runtime; the shipped scripts probe the same two paths.
 function configPath(runtime) {
   return runtime.id === 'claude' ? '~/.claude/cohorte.config.yaml' : '~/.cohorte/cohorte.config.yaml';
@@ -213,7 +213,7 @@ function preamble(runtime, paths, projectRoot, { kind = 'command' } = {}) {
   L.push(`> - \`<core>\` = \`${core}\` — the pipeline's shared assets (\`pipeline/scripts/\`, \`pipeline/SCHEMA.md\`, \`templates/\`). Every \`<core>/…\` path below resolves there, and nowhere else.`);
   L.push(`> - \`<state>\` = \`${stateDir(runtime)}/\` in **this repo** — what the pipeline generates for this project (\`gate-config.json\`, \`preflight.ok\`, \`pipeline-metrics.jsonl\`, \`pipeline.json\`). Always project-relative, even when \`<core>\` is global.`);
   L.push(`> - \`<memory>\` = \`${runtime.memory}\` — this runtime's project-instructions file at the repo root, loaded into every session here. Where the doctrine says to reference or extend it, that is the file.`);
-  L.push(`> - \`<config>\` = \`${configPath(runtime)}\` — your user-level config (kanban boards, shared vault, telemetry consent). One per human, never committed.`);
+  L.push(`> - \`<config>\` = \`${configPath(runtime)}\` — your user-level config (kanban boards, shared vault). One per human, never committed.`);
 
   L.push(`> - \`<agents>\` = \`${agentsDir}\` — real subagents. Dispatch: ${runtime.agent.dispatch}.`);
 

package/core/agents/release.md

@@ -28,7 +28,9 @@ committing, pushing, and opening the PR. You do **not** write features.
 ## Your inputs
 
 1. The spec path `specs/<id>.md` (title, goal, contract — for the PR body).
-2. `feature_id` and the branch `<vcs.feature_branch_prefix><id>`.
+2. `feature_id` and the branch — the lead passes it literally in the dispatch; use that, don't
+   re-derive it (a `kind: patch` spec branches off `vcs.patch_branch_prefix`, not
+   `feature_branch_prefix`).
 3. If `PIPELINE.md` §`release_notes.enabled`, the already-written note at
    `<release_notes.dir>/<release_notes.filename>` — stage it with everything else.
 
@@ -37,7 +39,9 @@ committing, pushing, and opening the PR. You do **not** write features.
 1. Sanity-check: `git status`, `git diff --stat`. Confirm you're on the feature branch (not the default
    branch). Confirm no `.env`/secret files staged.
 2. Stage the feature changes and write **conventional commit(s)**: `feat(<scope>): …` / `fix(<scope>): …`,
-   body summarizing what shipped, referencing `feature_id`. Scope from the domain. End the commit body with:
+   body summarizing what shipped, referencing `feature_id`. Scope from the domain. A spec whose
+   front-matter carries `kind: patch` is a bug fix — `fix(<scope>): …`, and the body states the
+   symptom it stops, not the code it changed. End the commit body with:
    `Co-Authored-By: Claude <noreply@anthropic.com>`
 3. `git push -u origin <branch>` (plain push, no force).
 4. Open the PR against `vcs.default_branch`:

package/core/agents/review.md

@@ -47,6 +47,13 @@ be precise and self-contained.
 1. **Spec conformance (highest priority).** Does the implementation match the frozen contract exactly —
    every endpoint/interface (method, path, auth, request/response shape, status codes, error cases) and
    every acceptance criterion? Any deviation is a finding. Cross-surface calls must match the contract.
+   **On a `kind: patch` spec** (front-matter) the contract is usually `none` and this check reads
+   differently: the diff must (a) contain the §4 regression test, asserting what §4 says it asserts,
+   (b) actually address the §1 repro through the §3 cause — a fix that suppresses the symptom
+   elsewhere is a finding, not a fix — and (c) stay inside §7 Out of scope. **Scope creep is a
+   first-class finding on a patch**: a correct, tidy improvement the spec did not ask for still
+   widens the blast radius of a change that is shipping fast, so report it rather than waving it
+   through. Genuinely-good-but-out-of-scope work is a **deferred** finding, exactly as elsewhere.
 2. **Correctness.** Logic bugs, unhandled errors, validation gaps, auth holes, data exposure.
 3. **Security.** Authz on every entry point, input validation, no secret/PII leakage, no injection.
    A security vulnerability ⇒ verdict **BLOCK**.

package/core/commands/cohorte-brainstorm.md

@@ -64,8 +64,3 @@ downstream. Then, in this order:
 2. `<core>/pipeline/scripts/kanban-move.sh auto <feature_id> brainstorm --title "<human title>"` —
    which moves the (now tagged) card, or creates one under `--title` if the human typed a fresh
    idea. Read its output: `moved #…` or `kanban: <reason>`. Never assume either.
-
-**Telemetry:** chain the opt-in usage ping onto that same Bash call — `/cohorte-build` §4's shared form,
-`<phase>` = `brainstorm`, `<seconds>` = `0` (this phase is human thinking time, not pipeline
-wall-clock — the funnel signal is the event, not its duration), `<results>` = `""`. No board ⇒ still
-ping, in its own `|| true` call. Silent no-op without consent; never ask about consent here.

package/core/commands/cohorte-build.md

@@ -26,6 +26,11 @@ You are the **lead**. Build feature **$ARGUMENTS** from its frozen spec.
   `/cohorte-spec` first. Only then read the body, selectively: front-matter, §5 contract, the surface
   task sections, and `## Remediation` (fall back to a full read if the spec doesn't follow the
   template's headings).
+- **`kind: patch` in the front-matter ⇒ this is a bug fix** frozen by `/cohorte-patch`, and it is
+  built by this command like any other spec, with two differences called out where they apply: §1.6
+  judges it against its regression test instead of a contract, and §2 authors no contract unless §5
+  carries a delta. Everything else — surface mapping, parallel dispatch, roll call, metrics — is
+  identical, and `kind` absent means feature, so nothing changes for existing specs.
 - **Route check** — if `## Remediation` has open `- [ ]` items and none requires a contract change,
   stop and tell the human to run `/cohorte-fix $ARGUMENTS` instead: it re-dispatches only the surfaces with
   findings. A full build with open items is only right when the contract change ripples into clean
@@ -79,6 +84,13 @@ good idea (that was `/cohorte-brainstorm`), never by re-reading files you don't
    request fields with types + validation, the success shape, and its error cases. A missing
    **request or success shape** ⇒ `NOT-READY` (an implementer would invent it, and the other surface
    would invent a different one). A missing **error case** ⇒ `RESERVATIONS`.
+   **On a `kind: patch` spec this check is replaced, not skipped** — a patch has no contract to be
+   complete, so judge §1 Symptom & repro + §4 Regression test instead: no stated expected behaviour,
+   or a §4 that names no test and no reason the fix would be verifiable ⇒ `NOT-READY` (an implementer
+   would fix whatever it guessed the bug was, and nothing would catch a wrong guess). A repro
+   explicitly frozen as a hypothesis, or a cause left to the implementer to find, is
+   `RESERVATIONS` — normal for a patch, never a blocker. Then judge §5 as above **only** if it
+   carries a delta rather than `none`.
 2. **Surface coverage** — every §6 task maps to a surface in the reconciled list, and every contract
    entry has an owner **on each side it names** (producer and consumer). A contract entry no surface
    owns ⇒ `NOT-READY`.
@@ -103,7 +115,8 @@ this gate and any automated driver, which parses no prose:
 ```
 
 - **`gaps`** — one normalized string per gap, `<check>|<where>|<what is missing>`: `<check>` is
-  `contract` · `coverage` · `dependency` · `ambiguity` · `design`; `<where>` is the contract entry,
+  `contract` · `coverage` · `dependency` · `ambiguity` · `design` — plus `repro` on a `kind: patch`
+  spec, for a gap check 1 raised against §1/§4; `<where>` is the contract entry,
   surface key or dependency name (no `:line` — it shifts on every edit); `<what>` is the gap, not the
   fix. `READY` ⇒ `[]`.
 - **`NOT-READY` ⇒ STOP: author no contract and spawn NO agent.** Print the gaps and send the human to
@@ -117,6 +130,15 @@ this gate and any automated driver, which parses no prose:
 
 ## 2. Author the contract (lead-only — the single sync channel)
 
+_Skipped entirely on a `kind: patch` spec whose §5 Contract delta is `none`_ — which is the usual
+case: a bug fix corrects behaviour behind a shape that already exists, and re-authoring that shape
+would put the contract file in the diff for nothing. Say you skipped it and why, in one line. A patch
+whose §5 **does** carry a delta is authored exactly as below, from the delta, against the existing
+file — never rewritten from scratch. (A patch needing *new* contract surface area never reaches here:
+`/cohorte-patch` §3 routes it to `/cohorte-spec`.) When you skip, still run `date +%s` on its own —
+the skipped postcondition is where §4's wall-clock start comes from, and a build with no start epoch
+writes a metrics line with no duration.
+
 _Only if `contract.enabled`._ From §5 of the spec, write/update the feature's contract file at
 `<contract.path>/$ARGUMENTS.<contract.ext>` in the profile's `mechanism` (e.g. Zod v4 schemas + inferred
 types for `shared-types-zod`). Export it from `contract.index` if set. This is the ONLY file the agents
@@ -186,12 +208,7 @@ anything went wrong. In the same call write the machine-readable batch result to
 `specs/reports/$ARGUMENTS.build.json` (overwrite) — the channel an automated driver reads, since it
 never sees your chat:
 `{"id":"$ARGUMENTS","phase":"build","ts":"<ISO>","surfaces":{"<key>":"ok|error|dead",…},"dead":["<key>",…]}`
-— this is the evidence SCHEMA.md §Specialization asks for before splitting a surface. In the same
-Bash call, chain the opt-in usage ping — **the shared form every phase command reuses**:
-`<core>/pipeline/scripts/telemetry-send.sh <phase> "$ARGUMENTS" <seconds> "<results>" || true` — a silent no-op unless the human explicitly consented (SCHEMA.md §Telemetry);
-never ask about consent here. `/cohorte-review` and `/cohorte-fix` chain the same line with their own
-phase + results. The `|| true` swallows a **missing** script too, so a half-copied core goes
-silent rather than loud — `/cohorte-doctor` check 1 is what catches that.
+— this is the evidence SCHEMA.md §Specialization asks for before splitting a surface.
 Then tell the human: exercise the feature by hand if it's worth it, then run `/cohorte-review $ARGUMENTS` —
 unless a surface is dead, in which case say so first and let them decide whether to re-run `/cohorte-build`
 (a dead surface has no findings, so `/cohorte-fix` has nothing to re-dispatch).

package/core/commands/cohorte-doctor.md

@@ -30,10 +30,10 @@ fix only with the human's go-ahead (or hand them the command).
    commands' step files are present — `templates/steps/init-pipeline/` non-empty (a router whose
    `templates/steps/<cmd>/` dir is missing is a partial/stale install ⇒
    re-run install/update). **Shipped scripts present and executable** in `<core>/pipeline/scripts/`:
-   `kanban-move.sh`, `telemetry-send.sh`, `preflight.sh`,
+   `kanban-move.sh`, `preflight.sh`,
    `new-feature.sh.template`, `remove-feature.sh.template` — ❌ any missing one.
    Every caller chains these with `|| true`, so an absent script is a **silent**
-   no-op (no kanban card moves, no telemetry ping, no error anywhere) — this check is the only thing
+   no-op (no kanban card moves, no error anywhere) — this check is the only thing
    that sees it. Also flag ❌ a `VERSION` **newer than** the other `pipeline/` files (compare mtimes):
    a version bumped without a full re-copy is a half-done update ⇒ re-run install/update.
 2. **Profile.** `PIPELINE.md` exists and its `yaml pipeline-profile` block parses. Every
@@ -51,7 +51,7 @@ fix only with the human's go-ahead (or hand them the command).
    (`build`, `review`, `fix`, `ship`, `audit`, `refactor`, `doctor`, `align-ds`,
    `update-pipeline` — in `<commands>/`) carries `model: sonnet` in
    its frontmatter — ⚠️ if missing (the lead's orchestration turn then bills at the session model,
-   e.g. Opus/Fable). `brainstorm`, `spec`, and `init-pipeline` are intentionally unpinned
+   e.g. Opus/Fable). `brainstorm`, `spec`, `patch`, and `init-pipeline` are intentionally unpinned
    (interactive — they inherit the session model).
 <!-- cohorte:endif -->
 
@@ -96,13 +96,7 @@ fix only with the human's go-ahead (or hand them the command).
    When ≥2 slots are live, print the parallel-feature table (feature · worktree · ports · db ·
    branch behind main by N commits) — a worktree far behind main means its next review will diff
    against stale code ⇒ suggest rebasing it.
-7. **Telemetry** (consent hygiene — read `<config>` §`telemetry`). Report the
-   status in one line: `disabled` / `enabled since <consent_date> · install_id <id> · endpoint <url>`
-   (the install_id is the human's GDPR erasure key — see SCHEMA.md §Telemetry). Flag ❌ any
-   incoherent state: `enabled: true` with no `install_id` or no `consent_date` (sending without
-   recorded consent — fix: set `enabled: false` until the consent question is re-run), or a
-   `telemetry:` block missing entirely on a current core (top up via `/cohorte-update-pipeline`).
-7b. **Kanban** (the board mirror — SCHEMA.md §Kanban). Run
+7. **Kanban** (the board mirror — SCHEMA.md §Kanban). Run
    `<core>/pipeline/scripts/kanban-move.sh --check` and report its one line verbatim: the resolved
    board path, or the exact link that is missing. A board mirror is optional, so "not configured" is
    ℹ️, never ❌ — but it must be **stated**, because the whole class of bug here is a card that

package/core/commands/cohorte-fix.md

@@ -72,8 +72,7 @@ When the agents return:
   handoff content — and append ONE metrics line for the batch to the **main checkout's**
   `$(dirname "$(git rev-parse --git-common-dir)")/<state>/pipeline-metrics.jsonl` (never a bare
   relative path: from a feature worktree that writes a stray sink whose lines die at teardown)
-  (rules in `/cohorte-build` §4, `phase: "fix"`), chaining the opt-in usage ping in the same Bash call
-  (results = items fixed over items found across surfaces, e.g. `"5/6"`).
+  (rules in `/cohorte-build` §4, `phase: "fix"`).
 - Tell the human: re-test by hand if the failures were runtime ones, and `/cohorte-review $ARGUMENTS` for the
   re-verdict — the re-review is what *verifies* the ticked items actually hold (a regression simply
   reappears as a new finding in the next round). **Recommend a `/clear`** — all state (spec,

package/core/commands/cohorte-patch.md

@@ -0,0 +1,113 @@
+---
+description: Triage a bug and freeze a minimal patch spec — the cheap entry into the pipeline for a fix, no brainstorm, no contract.
+argument-hint: [bug description / stack trace / issue text — or empty to pick from the kanban]
+---
+
+You run the **patch triage** in the main thread — interactive, with the human. This is the bug-fix
+entry point: it produces `specs/patch-<slug>.md` and stops. Everything after it is the normal
+pipeline (`/cohorte-build` → `/cohorte-review` → `/cohorte-fix`* → `/cohorte-ship`), unchanged — the
+patch spec is a spec, so those commands consume it as-is. Splitting it this way is the point: each
+phase is a fresh session with the artifact on disk, instead of one long thread paying for the whole
+cycle at input price on every turn.
+
+Bug (may be empty): **$ARGUMENTS**
+
+> Read `PIPELINE.md` §`pipeline-profile` first: `surfaces` (paths — this is what you map the bug onto)
+> and `vcs`. _Skip the re-read if it's already in your context this session and unmodified since._
+> Do NOT read `specs/_decisions.md`: a bug fix decides nothing transverse, and the journal is for
+> decisions that outlive a feature.
+>
+> **Kanban** (SCHEMA.md §Kanban): two moves, and their **order is load-bearing** — §1 settles the
+> slug and moves the card to `spec`, §4 moves it to `ready` at freeze. Both are one call to
+> `<core>/pipeline/scripts/kanban-move.sh auto patch-<slug> <stage> [--title "[patch] <human title>"]`.
+> The slug is settled first precisely because the move needs it: a card cannot be joined on an id
+> that doesn't exist yet. `auto` resolves the board from the config itself and exits 0
+> with a `kanban: <reason>` line when there is none — so **never decide "no board is configured"
+> without running it**. Reading the Ideas column at §1 still needs the board path: get it from a
+> `kanban-move.sh` run, or grep the config for `boards[<PIPELINE name>]`.
+
+## 1. Get the bug
+
+If `$ARGUMENTS` is non-empty, restate it in one line and confirm you've got it.
+
+If it is empty: when a board is configured and its **Ideas** column has cards, list them (with any
+sub-bullet notes as context) — **cards titled `[patch]` first**, since those are the ones a human
+filed as bugs — and let the human pick one. Otherwise ask **"What's broken?"**. Either way, wait.
+
+Then **settle the id, before anything moves.** Derive `<slug>` (kebab-case, from the symptom —
+`500-on-empty-cart`, not `bug-42`) and confirm it. The `feature_id` is **`patch-<slug>`**, prefix
+included: it is the join key for the kanban card, the spec filename, the branch and every later
+command, so the prefix is part of the id itself, not decoration on the card.
+
+**Kanban, in this order:**
+
+1. **If the human picked an Ideas card, tag it FIRST.** Ideas cards are free text with no
+   `#<feature_id>`, and the move script joins on that tag: move before tagging and it finds nothing,
+   creates a second card, and strands the untagged original in Ideas forever. One targeted Edit
+   appending `  #patch-<slug>` to that line, located by `grep -n` — never a full board read.
+2. `<core>/pipeline/scripts/kanban-move.sh auto patch-<slug> spec --title "[patch] <human title>"` —
+   which moves the (now tagged) card, or creates one under `--title` if the human typed a fresh bug.
+   Report what it printed — `moved #…` or `kanban: <reason>` — never a guess about which happened.
+
+## 2. Triage — three questions, not an interview
+
+`/cohorte-spec` walks a template section by section because a feature has to be *designed*. A bug is
+already specified by reality; your job is to pin it down, not to explore it. Ask only what you
+genuinely cannot infer from the input, batched into ONE message:
+
+1. **Repro** — the shortest deterministic path to the symptom. No repro ⇒ ask whether they want you
+   to go find one first (a diagnosis session, no spec) or to freeze it as a hypothesis and let the
+   implementer confirm. Never invent a repro to fill the section.
+2. **Expected behaviour** — often the whole spec. "It should 404, not 500" is a complete contract.
+3. **Blast radius** — what must NOT change. This becomes §7 Out of scope, and it is what stops a fix
+   from becoming a refactor.
+
+Then locate it yourself — do not make the human do it. Use the retrieval provider if one is wired,
+else grep for the symptom's strings/identifiers. Read only the files the trail actually names.
+Report the suspected `file:line` in one line and let them confirm or correct it.
+
+## 3. Map it onto surfaces — as many as it takes
+
+Match the suspected cause and the fix's blast radius against `surfaces[].path`. **A patch is not
+capped at one surface**: a bug that spans an API validator and the form feeding it is one bug with
+one repro, and splitting it into two specs would give each half a contract it doesn't have. List the
+surfaces you're claiming, one line each, with why.
+
+**The one escalation that is not a judgment call:** if the fix needs **new** contract surface area —
+a new endpoint, a new shared type, a new field crossing surfaces — stop. That is a feature wearing a
+bug's clothes, and §5 is the only channel that keeps two surfaces in agreement about a shape that
+doesn't exist yet. Say so plainly and send the human to `/cohorte-spec`. Changing an **existing**
+contract entry is fine: describe the delta in §5 and continue.
+
+## 4. Freeze the patch spec
+
+Write `specs/patch-<slug>.md` from `<core>/templates/patch.template.md` with `status: frozen`, filled
+from §§1–3. **Create the file — do not ask the human to.** Budget: **~60 lines**. A patch spec that
+wants 200 is a feature or a refactor — say which and route it (`/cohorte-spec`, or an item on
+`specs/refactor-backlog.md`).
+
+Two sections carry the weight, and both are cheap to get wrong:
+
+- **§4 Regression test** — name the test file and what it asserts. It replaces §5 as the thing the
+  reviewer checks the diff against, so "add a test" is not enough: say what fails today and why. A
+  patch whose test can only be written after the cause is found says exactly that.
+- **§5/§9 keep the feature spec's numbers** (contract delta, acceptance). `review.md` and
+  `implementer.template.md` name "contract §5, acceptance §9" verbatim — renumbering them here would
+  silently point both agents at the wrong section. The template already does this; don't "fix" it.
+
+**Postcondition:** `grep -q '^status: frozen' specs/patch-<slug>.md` — if it fails the freeze didn't
+land; fix it before pointing the human at `/cohorte-build`. Chain the second kanban move onto that
+same Bash call — `kanban-move.sh auto patch-<slug> ready` (the card is already tagged and on the
+board from §1, so this one needs no `--title`) — and report what it printed: `moved #…` or
+`kanban: <reason>`, never a guess.
+
+## 5. Hand off
+
+Print the spec path, the surfaces, and the branch to cut: `<prefix>patch-<slug>`, where `<prefix>` is
+`vcs.patch_branch_prefix` — falling back to `fix/` on a profile that predates the key. If `isolation.enabled`
+and the fix is big enough to want its own worktree, mention `scripts/new-feature.sh patch-<slug>`;
+most patches don't need it.
+
+Then: `/cohorte-build patch-<slug>` — and **recommend a `/clear` first**. The spec is on disk; the
+lead's triage history is re-sent at input price on every turn it survives, and `/cohorte-build`
+re-reads everything it needs.

package/core/commands/cohorte-review.md

@@ -118,8 +118,6 @@ re-ordered by severity, counts summed, duplicates collapsed, verdict = the worst
 routes them. Append ONE metrics line for the batch to the **main checkout's**
 `$(dirname "$(git rev-parse --git-common-dir)")/<state>/pipeline-metrics.jsonl` (rules in
 `/cohorte-build` §4; never a bare relative path — from a worktree that strands the lines): `{"ts":"<ISO>","feature":"$ARGUMENTS","phase":"review","seconds":<wall-clock>,"surfaces":{"<key>":"<verdict>:<finding count>",…}}`.
-In the same Bash call, chain the opt-in usage ping (`/cohorte-build` §4, `phase: "review"`, results = the
-merged verdict + total finding count, e.g. `"REVISE:3"`).
 **Stage the full report to `specs/reports/$ARGUMENTS.md`** (overwrite) — a gitignored buffer so a
 `/cohorte-fix` after a `/clear` can still read the findings; the `specs/reports/` subfolder is skipped by the
 non-recursive `specs/*.md` glob, so it's never mistaken for a spec (no phantom card, no bogus stage).

package/core/commands/cohorte-ship.md

@@ -31,7 +31,10 @@ You are the **lead**. Ship feature **$ARGUMENTS**. This is the outward-facing ga
   §`Acceptance criteria / DoD`; if any item is still `- [ ]`, list the open ones and ask the human to
   confirm shipping anyway (they may be deferred on purpose — e.g. a UI item on a backend-only feature).
   All `- [x]` ⇒ proceed silently.
-- Show `git status` + `git diff --stat`; confirm the branch is `<feature_branch_prefix>$ARGUMENTS`.
+- Show `git status` + `git diff --stat`; confirm the branch is `<prefix>$ARGUMENTS`, where `<prefix>`
+  is `vcs.patch_branch_prefix` (falling back to `fix/` on a profile that predates the key) when the
+  spec front-matter carries `kind: patch`, and `vcs.feature_branch_prefix` otherwise. Resolve it once
+  here and pass the **literal** branch to §3's dispatch — the release agent must not re-derive it.
 - **Ask the human to confirm** they want to commit, push, and open the PR. Wait for yes.
 - After the yes: `<core>/pipeline/scripts/kanban-move.sh auto $ARGUMENTS ship`. Report what it
   printed — `moved #…` or `kanban: <reason>` — never a guess about which happened.
@@ -57,6 +60,9 @@ See SCHEMA.md §Release notes.
   `release_notes.forbid_levels` (a `0.x` repo forbidding `major` declares the rupture `minor`).
 - **Ambiguous between two defensible levels?** State your reading in one line and **ask the human to
   pick** before writing. A wrong bump becomes a published version number.
+- A `kind: patch` spec is a `patch` bump by default — that is what the level means. It is a default,
+  not a rule: a bug fix that changes documented behaviour is still a `minor`, and one that removes it
+  is still breaking. Say which you chose when it isn't `patch`.
 - The body describes what changed **for the user**, from the spec §1/§2 — no client names, no internal
   paths, no exploitable attack vector, no file lists.
 - If the feature genuinely must move no version, use `release_notes.empty_cmd` instead. Prefer that to
@@ -73,7 +79,7 @@ See SCHEMA.md §Release notes.
 
 Spawn one agent (`subagent_type: release`, or the equivalent dispatch for this runtime):
 "Release feature `$ARGUMENTS` on branch
-`<feature_branch_prefix>$ARGUMENTS`. Read `PIPELINE.md` §vcs first. Spec: `specs/$ARGUMENTS.md` (already
+`<the branch §1 resolved>`. Read `PIPELINE.md` §vcs first. Spec: `specs/$ARGUMENTS.md` (already
 `status: shipped` — stage it). Write conventional commit(s), push (no force), open the PR (use `gh` if
 `host: github` + available; else emit the compare URL + drafted PR body from `<core>/templates/pr-body.md`).
 Stage **all** the feature's changes including `specs/$ARGUMENTS.md` and, if `release_notes.enabled`, the
@@ -101,13 +107,6 @@ with a **grep for `#$ARGUMENTS`** on the board it named (with surrounding headin
 `grep -B20 '#$ARGUMENTS' | grep '^##'`, or an offset-limited Read around the match): exactly one card,
 under the `shipped` heading — never re-read the whole board into context.
 
-**Telemetry — the usage ping that closes the funnel.** Chain it onto the verify call above
-(`/cohorte-build` §4's shared form, `<phase>` = `ship`, `<seconds>` = `0` — the release agent's duration is
-not the pipeline's, `<results>` = `pr` when a PR was created / `compare` when only a compare URL was
-emitted). Fire it **after** the release agent reports success, never on an aborted ship — a `ship`
-event must mean the feature actually left the pipeline. No board ⇒ still ping, in its own `|| true`
-call. Silent no-op without consent; never ask about consent here.
-
 ## 5. After the PR — CI gate + teardown
 
 - If `host: github` and `gh` is available, watch the PR's checks (`gh pr checks <url> --watch`) and

package/core/commands/cohorte-spec.md

@@ -51,12 +51,7 @@ Detect the mode from the pasted content:
    it. This is just so the human isn't surprised when `/cohorte-build` proposes a new agent.
 5. When the human validates, **freeze**: write `specs/<id>.md` (`status: frozen`, front-matter filled).
    Create the file — do not ask the human to. **Postcondition:** `grep -q '^status: frozen' specs/<id>.md`
-   — if it fails the freeze didn't land; fix it before pointing the human at `/cohorte-build`. Chain the
-   opt-in usage ping onto the postcondition's Bash call (`/cohorte-build` §4's shared form, `<phase>` =
-   `spec`, `<seconds>` = `0` — interactive time, not pipeline wall-clock, `<results>` = `frozen`).
-   Ping only on a **landed** freeze, so the funnel counts specs that exist, not attempts. Mode B does
-   not ping — it re-enters an already-counted spec, and `/cohorte-fix` covers that loop. Silent no-op without
-   consent; never ask about consent here.
+   — if it fails the freeze didn't land; fix it before pointing the human at `/cohorte-build`.
 5b. **Record the transverse decisions — the journal, not a summary.** Walk what the interview settled
    and keep ONLY the decisions that **outlive this feature**: a rule the next spec would otherwise
    re-litigate or contradict (auth model, id/naming scheme, where a kind of state lives, an error

package/core/commands/cohorte-update-pipeline.md

@@ -98,10 +98,11 @@ Four of the §Reconcile steps matter specifically here:
 
 - **Global config seed** (§Reconcile step 5): if `<config>` is absent, seed it
   from the template so the kanban + shared-vault config has a home. Never clobber an existing filled
-  file. Report what was seeded. If the existing file has NO `telemetry:` block with a `consent_date`
-  (pre-telemetry install), top up the block from the template and ask the ONE opt-in consent
-  question defined in `templates/steps/init-pipeline/02-interview-gaps.md` §Telemetry — record the
-  answer either way so it is never re-asked. Consent is strictly opt-in; "No" is the default.
+  file. Report what was seeded. Then **scrub the retired `telemetry:` block** if the existing file
+  still has one (every install seeded before 2.3.0 does) — one targeted Edit deleting the block and
+  its comment header, nothing else touched. That capability was removed in 2.3.0, sender included,
+  so the block is dead config: nothing reads it, and an `enabled: true` left sitting in a file the
+  human may open reads as though data were still leaving the machine. Say you removed it.
 - **Kanban sync** (§Reconcile step 6): resolve this project's board with
   `<core>/pipeline/scripts/kanban-move.sh --check` — it prints either the board path or the exact
   missing link. **Not linked** → offer to link/create a board (confirm the vault + `<folder>/Tasks.md`,

package/core/templates/patch.template.md

@@ -0,0 +1,86 @@
+---
+feature_id: patch-<slug>
+kind: patch # a bug fix, not a feature — /cohorte-build skips contract authoring, /cohorte-ship commits `fix(…)`
+title: <one line: the bug, from the user's side>
+status: draft # draft → frozen → in-progress → in-review → shipped · blocked (see SCHEMA.md §Spec status)
+severity: <critical | major | minor> # drives nothing mechanical; it is what the human triages on
+branch: <patch_branch_prefix><feature_id>
+created: <YYYY-MM-DD>
+reviewed_base: # merge-base sha at the last SHIP verdict — freshness-gate anchor (written by /cohorte-review)
+reviewed_digest: # sha256 (16 hex) of the reviewed source diff vs reviewed_base, specs excluded — /cohorte-ship re-checks
+design_files: [] # omit unless the fix is itself visual
+---
+
+# <one line: the bug, from the user's side>
+
+## 1. Symptom & repro
+
+> What the user sees, and the shortest deterministic path to see it. A repro nobody can run is a
+> hypothesis, not a bug — say so here rather than pretending otherwise.
+
+- **Observed:** …
+- **Expected:** …
+- **Repro:** 1. … 2. … 3. …
+- **Since / trigger:** <version, commit, or "unknown">
+
+## 2. Impact
+
+> Who is affected, how often, and whether there is a workaround. This is what justifies the patch
+> jumping the feature queue — one or two lines.
+
+## 3. Cause
+
+> Confirmed or hypothesis — label which. Name the `file:line` if you have it. If the cause is
+> unknown at freeze, say so: the implementer's first job is then to find it, and the review will
+> check that the stated cause matches the diff.
+
+## 4. Regression test (red first)
+
+> The heart of a patch spec — it replaces §5 CONTRACT as the thing the diff is checked against.
+> Name the test file and what it asserts. It must fail on the current code and pass after the fix.
+
+- **Test:** `<path/to/test>` · asserts: …
+- **Fails today because:** …
+
+## 5. Contract delta
+
+> Usually `none`. A fix that *changes* an existing contract entry describes the change here and
+> `/cohorte-build` propagates it to every surface that names it. A fix that needs **new** contract
+> surface area is not a patch — stop and run `/cohorte-spec` instead.
+
+`none`
+
+## 6. Surface tasks
+
+> One `###` subsection per surface the fix touches — a patch may legitimately span several (an
+> unvalidated field on the API *and* the form that sends it). Each TDD: the §4 test first.
+
+### <surface.key>
+
+- …
+
+## 7. Out of scope
+
+> The adjacent things this patch deliberately does NOT fix. This is the section that keeps a bug fix
+> from turning into a refactor — the reviewer reads it before flagging what you left alone. Real but
+> out-of-scope findings belong in `specs/refactor-backlog.md`, not in this diff.
+
+- …
+
+## 9. Acceptance criteria / DoD
+
+> §9, not §8 — the number is load-bearing, so don't renumber it. `review.md` and
+> `implementer.template.md` both name "contract §5, acceptance §9" verbatim, so a patch spec pins
+> those two sections to the feature spec's numbers and just has no §8 (the feature spec has no §7 —
+> a gap in the sequence is normal here).
+
+- [ ] The §4 regression test exists, and failed before the fix
+- [ ] Each touched surface's tests (TDD) green
+- [ ] `PIPELINE.md` commands.lint · typecheck · test green
+- [ ] The repro in §1 no longer reproduces
+- [ ] Nothing outside §6's surfaces changed
+
+## Remediation
+
+> Filled by `/cohorte-fix` from a REVIEW REPORT; empty otherwise. Each item:
+> `[ ] <SEVERITY> · <file:line> · <spec-violation|quality|security> · <concrete fix>`

package/core/templates/steps/init-pipeline/02-interview-gaps.md

@@ -53,13 +53,3 @@ Prefer sensible defaults from Phase 1 as the first (Recommended) option in each
 > The **kanban** link is user-scoped (it points at a personal vault, so it never goes in the committed
 > `PIPELINE.md`), but IS wired here because it is per-project — see Phase 4.
 
-- **Telemetry** (optional, machine-scoped — SKIP entirely if `<config>` already
-  has a `telemetry:` block with a `consent_date`, i.e. the human already answered on this machine).
-  Ask ONE opt-in question, stating exactly: _"Share anonymous usage stats with the cohorte project?
-  One ping per pipeline phase, `/cohorte-brainstorm` through `/cohorte-ship`: core version, OS, phase name, duration,
-  per-surface result counts, and a hash of the feature id — never repo names, paths, code, or IPs.
-  Setup and maintenance commands never ping. Off by default; withdraw anytime
-  (`telemetry.enabled: false`); erase your history anytime (SCHEMA.md §Telemetry). Default: No."_
-  On **yes**: in the global config set `telemetry.enabled: true`, mint `install_id` (`uuidgen`,
-  lowercase), set `consent_date` (ISO date). On **no**: set `enabled: false` + `consent_date` (so
-  no future command re-asks). Never touch `endpoint` — it ships with the template.

package/core/templates/steps/init-pipeline/04-write-render.md

@@ -27,8 +27,8 @@
    per-surface `test_cmd`/`lint_cmd`/`typecheck_cmd`/`build_cmd` **and their `*_quiet_cmd`
    variants** and repo-wide `commands.*` equivalents as `Bash(<cmd>:*)` rules, plus read-only git —
    `Bash(git status:*)`, `Bash(git diff:*)`, `Bash(git log:*)`, `Bash(git rev-parse:*)` — plus the
-   shipped pipeline scripts (`Bash(<core>/pipeline/scripts/:*)` — preflight, kanban-move,
-   telemetry-send; a prefix rule matches a command *starting* with that path, so a `bash <path>`
+   shipped pipeline scripts (`Bash(<core>/pipeline/scripts/:*)` — preflight, kanban-move;
+   a prefix rule matches a command *starting* with that path, so a `bash <path>`
    invocation would need its own entry), and the
    retrieval provider's MCP tools when wired (e.g. `mcp__serena`). Never allowlist anything matching
    a `gate.ask`/`gate.deny` pattern. Mention the human can widen it later with

package/core/workflows/review.js

@@ -323,12 +323,10 @@ const staging = await agent(
   `1. Write EXACTLY this content to specs/reports/${feature}.md (overwrite):\n<<<REPORT\n${reportBody}\nREPORT\n` +
   `2. Append one line to $(dirname "$(git rev-parse --git-common-dir)")/.claude/pipeline-metrics.jsonl: ` +
   `{"ts":"<ISO now>","feature":"${feature}","phase":"review","seconds":0,"surfaces":{${results.map(r => `"${r.key}":"${verdict}:${r.kept.length}"`).join(',')}}}\n` +
-  `3. Chain the opt-in usage ping: <core>/pipeline/scripts/telemetry-send.sh review "${feature}" 0 "${verdict}:${kept.length}" || true ` +
-  '(<core> = .claude if .claude/pipeline/scripts/telemetry-send.sh exists, else ~/.claude; script on neither ⇒ skip the ping).\n' +
   // Deferred findings must land in the backlog on EVERY verdict — parked only on a
   // SHIP is parked nowhere the rest of the time, which is the leak this closes.
   (deferredAll.length
-    ? `3b. Route the deferred findings to specs/refactor-backlog.md (create it if absent): for each line below, ` +
+    ? `3. Route the deferred findings to specs/refactor-backlog.md (create it if absent): for each line below, ` +
       `append it under the \`## <domain>\` heading named in its prefix (create that heading if absent) — with \`>>\`, ` +
       `never by rewriting the file, and skip any whose file path + first words already appear there (grep -F first, ` +
       `they may be left from a prior round or an /cohorte-audit):\n` +

package/install.ps1

@@ -172,8 +172,10 @@ cohorte needs Node >= 18 to install.
         Copy-Item (Join-Path $src 'profile\cohorte.config.template.yaml') (Join-Path $dest 'pipeline') -Force
         Copy-Item (Join-Path $src 'scripts\*.template')           (Join-Path $dest 'pipeline\scripts') -Force
         Copy-Item (Join-Path $src 'scripts\kanban-move.sh')       (Join-Path $dest 'pipeline\scripts') -Force
-        Copy-Item (Join-Path $src 'scripts\telemetry-send.sh')    (Join-Path $dest 'pipeline\scripts') -Force
         Copy-Item (Join-Path $src 'scripts\preflight.sh')         (Join-Path $dest 'pipeline\scripts') -Force
+        # 2.3.0 removed telemetry; copy-over never deletes, so scrub the sender from existing
+        # installs. The dead `telemetry:` config block is deleted by /cohorte-update-pipeline.
+        Remove-Item (Join-Path $dest 'pipeline\scripts\telemetry-send.sh') -Force -ErrorAction SilentlyContinue
         Copy-Item (Join-Path $src 'core\agents\implementer.template.md') (Join-Path $dest 'pipeline') -Force
         if (Test-Path (Join-Path $src 'CHANGELOG.md')) { Copy-Item (Join-Path $src 'CHANGELOG.md') (Join-Path $dest 'pipeline') -Force }
         [System.IO.File]::WriteAllText((Join-Path $dest 'pipeline\VERSION'), "$ver`n", [System.Text.UTF8Encoding]::new($false))

package/install.sh

@@ -126,10 +126,14 @@ copy_core() {
   cp "$src/profile/cohorte.config.template.yaml" "$dest/pipeline/"
   cp "$src"/scripts/*.template           "$dest/pipeline/scripts/"
   cp "$src/scripts/kanban-move.sh"       "$dest/pipeline/scripts/"
-  cp "$src/scripts/telemetry-send.sh"    "$dest/pipeline/scripts/"
   cp "$src/scripts/preflight.sh"         "$dest/pipeline/scripts/"
-  chmod +x "$dest/pipeline/scripts/kanban-move.sh" "$dest/pipeline/scripts/telemetry-send.sh" \
+  chmod +x "$dest/pipeline/scripts/kanban-move.sh" \
            "$dest/pipeline/scripts/preflight.sh" 2>/dev/null || true
+  # 2.3.0 removed telemetry. Copy-over never deletes, so an existing install would keep an
+  # executable that still POSTs to the collector — scrub the script itself. The dead
+  # `telemetry:` block in the user's config is not this installer's to parse; the interactive
+  # /cohorte-update-pipeline deletes it (SCHEMA.md §Reconcile step 5).
+  rm -f "$dest/pipeline/scripts/telemetry-send.sh"
   cp "$src/core/agents/implementer.template.md" "$dest/pipeline/"
   [ -f "$src/CHANGELOG.md" ] && cp "$src/CHANGELOG.md" "$dest/pipeline/"
   printf '%s\n' "$ver" > "$dest/pipeline/VERSION"

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "cohorte",
-  "version": "2.2.0",
-  "description": "Portable, stack-agnostic multi-agent development pipeline for Claude Code, Codex CLI, Cursor, Gemini CLI and OpenCode \u2014 install the core, run /cohorte-init-pipeline, and it adapts to your project's stack.",
+  "version": "2.3.0",
+  "description": "Portable, stack-agnostic multi-agent development pipeline for Claude Code, Codex CLI, Cursor, Gemini CLI and OpenCode — install the core, run /cohorte-init-pipeline, and it adapts to your project's stack.",
   "bin": {
     "cohorte": "bin/cli.js"
   },

package/profile/PIPELINE.template.md

@@ -25,6 +25,7 @@ vcs:
   remote: <owner/repo>                        # e.g. acme/webapp
   default_branch: <main>
   feature_branch_prefix: feature/            # branch = <prefix><feature_id>
+  patch_branch_prefix: fix/                  # same, for /cohorte-patch specs (kind: patch)
 
 # ── repo shape ──────────────────────────────────────────────────────────────
 repo:

package/profile/SCHEMA.md

@@ -16,6 +16,7 @@ generic pipeline uses it, so a stateless agent can read/regenerate the profile c
 | `vcs.remote`                         | string       | release                           | `owner/repo` for the PR/compare URL.                          |
 | `vcs.default_branch`                 | string       | build, review, release            | Base branch for diffs + PRs.                                  |
 | `vcs.feature_branch_prefix`          | string       | ship, isolation script            | `feature/` → branch `feature/<id>`.                           |
+| `vcs.patch_branch_prefix`            | string       | ship                              | Same, for a `kind: patch` spec: `fix/` → branch `fix/patch-<slug>`. Optional — a profile that predates it falls back to `fix/`. |
 | `repo.layout`                        | enum         | build, audit                      | `monorepo` (many surfaces) or `single`.                       |
 | `repo.workspace_tool`                | enum         | audit                             | `turborepo`/`nx`/`none`.                                      |
 | `retrieval.provider`                 | enum         | init, update-pipeline, implementer | `serena` (default) / `graphify` / `none` — see §Code retrieval. |
@@ -190,11 +191,6 @@ to log it. For what's EXPENSIVE, use Claude Code's own accounting:
   over the last 24 h / 7 d (e.g. _"Top subagents: frontend 7 %, backend 4 % · Top skills: /cohorte-build 1 %,
   /cohorte-review 1 %"_). That IS the per-phase ledger — approximate (share-of-total, machine-local, not exact
   tokens). Read it to see which surface/command actually dominates the bill before you tune a `model` tier.
-- **OpenTelemetry** (exact numbers + dashboards) — add an `env` block to `this runtime's settings file`:
-  `{"env":{"CLAUDE_CODE_ENABLE_TELEMETRY":"1","OTEL_METRICS_EXPORTER":"otlp","OTEL_EXPORTER_OTLP_PROTOCOL":"http/protobuf","OTEL_EXPORTER_OTLP_ENDPOINT":"http://localhost:4318"}}`
-  and point it at a collector. Metrics `claude_code.token.usage` + `claude_code.cost.usage` carry
-  `session.id` + model + type (input/output/cacheRead). Subagent tokens roll into the session total;
-  per-subagent attribution needs traces (`CLAUDE_CODE_ENHANCED_TELEMETRY_BETA=1`, beta).
 
 **Lead context discipline — the silent bill.** The lead session's conversation history is re-sent as
 input on EVERY turn; a session that spans spec→build→review→fix without clearing re-pays the
@@ -246,6 +242,25 @@ built-in autonomous driver (`/cohorte-loop`) was retired in 2.2.0, and the human
 them, and because anything automating the cycle from outside needs somewhere to record "a round is
 under way" and "a round gave up". Every reader still routes on them; nothing produces them.
 
+**`kind` — feature (default) or `patch`.** Orthogonal to `status`, and the only other front-matter
+field commands route on. `/cohorte-patch` freezes `specs/patch-<slug>.md` with `kind: patch` from
+`templates/patch.template.md`: a ~60-line bug spec whose §4 **regression test** replaces §5 CONTRACT
+as the thing the diff is checked against. It moves through the same states and the same commands —
+`/cohorte-build` → `/cohorte-review` → `/cohorte-fix`* → `/cohorte-ship` — which is the whole design:
+a patch is a spec, so nothing downstream is special-cased beyond three lines.
+
+| what reads `kind: patch` | what it does differently |
+| --- | --- |
+| `/cohorte-build` §1.6 | judges §1 repro + §4 regression test instead of contract completeness; gap check `repro` |
+| `/cohorte-build` §2 | authors no contract when §5 Contract delta is `none` (the usual case) |
+| `/cohorte-ship` §1/§2b/§3 | branches off `vcs.patch_branch_prefix`; a `patch` bump by default; `fix(<scope>)` commit |
+
+A patch may span **several surfaces** — one bug, one repro, one spec. What it may never do is add
+**new** contract surface area: two surfaces agreeing on a shape that doesn't exist yet is what §5 is
+for, so `/cohorte-patch` routes that to `/cohorte-spec` instead. Changing an *existing* contract entry
+is a legitimate delta. The patch template keeps contract on **§5** and acceptance on **§9** — the two
+numbers `review.md` and `implementer.template.md` name verbatim — and simply has no §8.
+
 Corollaries worth knowing:
 
 - A spec with no front-matter makes every stamp a **silent no-op** — the state is bookkeeping, and the
@@ -477,7 +492,13 @@ files automatically. It works because every generated artifact is a **determinis
    rots (PATH changes, uninstalls, hand-edits) — and repair whatever fails.
 5. **Global config seed.** If `<config>` is absent, seed it from the template
    (`profile/cohorte.config.template.yaml`) so the kanban + shared-vault config has a home. Never
-   clobber an existing filled file; report what was seeded.
+   clobber an existing filled file; report what was seeded. Then **scrub the retired `telemetry:`
+   block** if the file still carries one (every install seeded before 2.3.0 does): delete the block
+   and its comment header, leaving the rest byte-identical. It is dead config — the sender is gone
+   and nothing reads it — but a `telemetry.enabled: true` sitting in a file the human may open reads
+   as "this is still sending", which is the one thing it must not imply. This is the single
+   exception to "never rewrite the config": a targeted deletion of a block the core no longer
+   defines, never a re-seed.
 6. **Kanban sync.** Run the §Kanban reconcile: link/create the project's board if configured, verify
    its columns, and backfill/sync cards from `specs/*.md`. See §Kanban.
 7. **Spec-template top-up.** `specs/_template.md` is seeded once at install and then **never**
@@ -621,6 +642,7 @@ Ideas — so `/cohorte-brainstorm` appends the tag to the picked line before its
 | `/cohorte-brainstorm` picks it up               | `brainstorm`    |
 | `/cohorte-spec` opens (draft)                   | `spec`          |
 | `/cohorte-spec` freezes (`status: frozen`)      | `ready`         |
+| `/cohorte-patch` triages / freezes              | `spec` → `ready` (card titled `[patch] <title>`, tag `#patch-<slug>`) |
 | `/cohorte-build`                                | `building`      |
 | `/cohorte-review`                               | `review`        |
 | `/cohorte-fix`                                  | `fix`           |
@@ -642,60 +664,3 @@ added vs. moved vs. already-correct.
 per configured column in pipeline order, and the closing `%% kanban:settings %%` block
 (`{"kanban-plugin":"board","list-collapse":[false,…]}` with one `false` per column).
 
-## Telemetry — anonymous usage stats, strictly opt-in (GDPR-first)
-
-Cohorte can send the maintainers anonymous usage pings so the pipeline improves where it's actually
-slow. **Nothing is ever sent without explicit consent**: `/cohorte-init-pipeline` (and `/cohorte-update-pipeline` on
-pre-telemetry installs) ask ONE question, once per machine, default **No**, and record the answer in
-`<config>` §`telemetry` (`enabled`, `install_id`, `consent_date`). The sender —
-`pipeline/scripts/telemetry-send.sh` — is a silent no-op unless `enabled: true` AND `install_id` AND
-`endpoint` are all set, times out at 2s, and never fails the pipeline. Callers chain it with
-`|| true`, so a **missing** script is equally silent: `/cohorte-doctor` check 1 verifies `pipeline/scripts/`
-is fully populated.
-
-**Which commands ping** — the six that make up the feature funnel, and only those. The point is to
-see where features stall, so every stage of `idea → PR` reports and nothing else does:
-
-| phase | fired when | `seconds` | `results` |
-| --- | --- | --- | --- |
-| `brainstorm` | the return is staged | `0` | — |
-| `spec` | a freeze lands (Mode A only) | `0` | `frozen` |
-| `build` | after the batch metrics line | wall-clock | `ok,ok` / `error` |
-| `review` | after the merged verdict | wall-clock | `<verdict>:<count>` |
-| `fix` | after the batch metrics line | wall-clock | `<fixed>/<found>` |
-| `ship` | the release agent succeeded | `0` | `pr` / `compare` |
-
-> Workflow-variant runs (`review.js`) report `seconds: 0` for their phases — only the
-> conversational commands measure wall-clock. `results` is a free-text summary field, so both
-> forms are valid — but read the `fix` column knowing which path produced it.
-
-`seconds: 0` marks a phase whose duration is human thinking time, not pipeline wall-clock — the
-funnel signal there is the event, not how long it took. `/cohorte-doctor`, `/cohorte-audit`, `/cohorte-refactor`,
-`/cohorte-align-ds`, `/cohorte-init-pipeline` and `/cohorte-update-pipeline` **never** ping: they sit outside the funnel, and
-keeping them out is what holds the collected set to what the consent text describes.
-
-**What one event contains** (strict allowlist, ~200 bytes):
-
-```json
-{"v":1,"install_id":"<random uuid>","ts":"<ISO>","core_version":"1.2.0","os":"Darwin",
- "event":"phase","phase":"build","feature_hash":"<sha256[..12] of the feature id>",
- "seconds":412,"results":"ok,ok"}
-```
-
-**What is NEVER sent:** repo/project names, file paths, code, spec content, prompts, emails,
-usernames, IP handling client-side. The feature id is hashed (12 hex chars) so cross-feature counts
-work without revealing what is being built.
-
-**GDPR rights, concretely:**
-
-- **Consent** — opt-in only, recorded with a date; "No" is also recorded so nothing re-asks.
-- **Withdrawal** — set `telemetry.enabled: false` in `<config>`; effective on
-  the next phase, no restart.
-- **Erasure** — `/cohorte-doctor` prints your `install_id`; send
-  `curl -X DELETE <endpoint-origin>/v1/install/<install_id>` and the collector drops every event
-  for that id (the deployed collector implements this and stores no IPs).
-- **Access/portability** — events are keyed by your `install_id`; ask the operator for an export.
-
-**Collector contract** (any implementation must honor it):
-`POST /v1/events` (one JSON event, allowlisted fields) · `DELETE /v1/install/<id>` (erasure) ·
-`GET /healthz`. Operators must not retain IP-bearing access logs for the ingest vhost.

package/profile/cohorte.config.template.yaml

@@ -10,22 +10,6 @@
 
 enabled: true                 # cfg:enabled — master switch; false disables every capability below
 
-# ── telemetry (anonymous usage stats — OPT-IN, GDPR-first) ──────────────────
-# Strictly opt-in: nothing is ever sent unless YOU said yes to the consent question
-# (/cohorte-init-pipeline or /cohorte-update-pipeline ask once per machine; they record your answer here).
-# What is sent when enabled: core version, OS, phase name, wall-clock seconds, per-surface
-# result counts, and a SHA-256 HASH of the feature id — never repo names, paths, code, spec
-# content, emails, or IPs. One ping per pipeline phase, /cohorte-brainstorm through /cohorte-ship; setup and
-# maintenance commands (/cohorte-doctor, /cohorte-init-pipeline, /cohorte-update-pipeline, /cohorte-audit, /cohorte-refactor,
-# /cohorte-align-ds) never ping. Sent fire-and-forget (2s timeout, silent on failure) by
-# pipeline/scripts/telemetry-send.sh. Withdraw anytime: set enabled: false. Erase your history:
-# see SCHEMA.md §Telemetry (DELETE by install_id).
-telemetry:
-  enabled: false              # cfg:telemetry_enabled — true ONLY via explicit consent
-  install_id: ""              # cfg:telemetry_install_id — random UUID minted at consent; the erasure key
-  consent_date: ""            # cfg:telemetry_consent_date — ISO date the human said yes
-  endpoint: "https://telemetry.cohorte.thebidouille.fr/v1/events"  # cfg:telemetry_endpoint — collector URL; empty = off even if enabled
-
 # ── obsidian ──────────────────────────────────────────────────────────────────
 # Local vault used by the kanban mirror — defined here ONCE so no capability ever duplicates
 # the path. Absolute path to the folder you open in Obsidian.

package/scripts/validate-core.mjs

@@ -25,7 +25,7 @@ const frontmatter = (text) => {
 const PINNED = ["cohorte-build", "cohorte-review", "cohorte-fix", "cohorte-ship",
   "cohorte-audit", "cohorte-refactor", "cohorte-doctor", "cohorte-align-ds",
   "cohorte-update-pipeline"];
-const UNPINNED = ["cohorte-brainstorm", "cohorte-spec", "cohorte-init-pipeline"];
+const UNPINNED = ["cohorte-brainstorm", "cohorte-spec", "cohorte-init-pipeline", "cohorte-patch"];
 
 // Every command must carry the `cohorte-` prefix. This replaces the old RESERVED
 // blocklist, which chased collisions one name at a time and always lagged: a command
@@ -129,26 +129,28 @@ const steps = join(root, "core/templates/steps/init-pipeline");
 if (!existsSync(steps) || readdirSync(steps).length === 0)
   fail("core/templates/steps/init-pipeline", "router step files missing/empty");
 
-// ── telemetry coverage ──────────────────────────────────────────────────────
-// The funnel is only readable if every one of its stages pings — a single missing
-// one silently truncates it (that is how /cohorte-review and /cohorte-fix went unreported
-// until 1.2.3). The phase list here must match SCHEMA.md §Telemetry's table.
-// These are telemetry PHASE names, not command names — they stay unprefixed even though
-// the commands that emit them are now `/cohorte-*`. The phase is a wire field allowlisted
-// in telemetry-send.sh and keyed on by the collector's existing dataset; prefixing it would
-// orphan every ping ever sent. Command file = PREFIX + phase.
-const FUNNEL = ["brainstorm", "spec", "build", "review", "fix", "ship"];
-for (const c of FUNNEL)
-  if (!/usage ping/i.test(read(`core/commands/${PREFIX}${c}.md`)))
-    fail(`core/commands/${PREFIX}${c}.md`, "funnel command with no usage ping — breaks the telemetry funnel");
-// …and nothing outside the funnel may ping (consent text scopes it to the funnel).
-for (const f of readdirSync(join(root, "core/commands"))) {
-  const c = f.replace(/\.md$/, "").replace(new RegExp(`^${PREFIX}`), "");
-  // `telemetry-send.sh` + an argument = a call site; the bare filename (e.g. /cohorte-doctor
-  // listing the scripts it checks for) is a mention, not a ping.
-  if (!FUNNEL.includes(c) && /telemetry-send\.sh +\S|usage ping/i.test(read(`core/commands/${f}`)))
-    fail(`core/commands/${f}`, "non-funnel command pings telemetry — outside the consented scope");
-}
+// ── no telemetry ────────────────────────────────────────────────────────────
+// Telemetry was removed wholesale in 2.3.0: the shipped `telemetry-send.sh`, the
+// per-phase pings, the consent question, the `telemetry:` config block, the collector
+// endpoint. This check is the ratchet — it fails if any of it creeps back into the
+// core, which is easy to do by copying an old command file that still chains a ping.
+// Deliberately broad: the whole point is that there is nothing left to send with.
+const NO_TELEMETRY = /telemetry|usage ping/i;
+// One exemption, and it is the opposite of a regression: /cohorte-update-pipeline is what
+// DELETES the leftover `telemetry:` block from configs seeded before 2.3.0, so it is the one
+// file that must still name the thing. Narrow on purpose — a filename, not a pattern.
+const TELEMETRY_SCRUBBER = "core/commands/cohorte-update-pipeline.md";
+const walk = (dir) => readdirSync(join(root, dir), { withFileTypes: true }).flatMap((e) =>
+  e.isDirectory() ? walk(`${dir}/${e.name}`) : [`${dir}/${e.name}`]);
+for (const dir of ["core/commands", "core/agents", "core/templates", "core/workflows"])
+  for (const rel of walk(dir)) {
+    if (!/\.(md|js)$/.test(rel) || rel === TELEMETRY_SCRUBBER) continue;
+    if (NO_TELEMETRY.test(read(rel)))
+      fail(rel, "mentions telemetry — it was removed in 2.3.0; nothing may ping or ask for consent");
+  }
+// …and the exempt file may only REMOVE it: naming a send/ping/consent path there is still a bug.
+if (/usage ping|telemetry-send|consent/i.test(read(TELEMETRY_SCRUBBER)))
+  fail(TELEMETRY_SCRUBBER, "may reference the retired telemetry block only to delete it — no ping, sender or consent flow");
 
 // ── kanban call sites ───────────────────────────────────────────────────────
 // Every pipeline stage moves a card, and a stage that only *describes* the move
@@ -158,7 +160,7 @@ for (const f of readdirSync(join(root, "core/commands"))) {
 // having opened neither the config nor PIPELINE.md, and a merged feature's card
 // stayed in "Ready to build". `kanban-move.sh auto` moved resolution into the
 // script; this keeps it there. Prose is not a call site — the literal invocation is.
-const KANBAN_STAGES = ["brainstorm", "spec", "build", "review", "fix", "ship"];
+const KANBAN_STAGES = ["brainstorm", "spec", "build", "review", "fix", "ship", "patch"];
 for (const c of KANBAN_STAGES) {
   const path = `core/commands/${PREFIX}${c}.md`;
   const text = read(path);
@@ -174,7 +176,7 @@ for (const c of KANBAN_STAGES) {
 // ── shipped scripts ─────────────────────────────────────────────────────────
 // Every scripts/*.sh must be copied by BOTH shell installers. Callers chain these
 // with `|| true`, so one an installer forgets is a silent no-op forever — no kanban
-// card moves, no telemetry ping, no error. CI is the only place this is loud.
+// card moves, no error. CI is the only place this is loud.
 // The third installer, bin/cli.js (what `npx cohorte` runs), copies by rule rather
 // than by name, so grepping for filenames can't see it — ci.yml dry-runs it into a
 // scratch HOME and asserts the same postconditions instead. Both are needed: this

package/scripts/telemetry-send.sh

@@ -1,84 +0,0 @@
-#!/bin/sh
-# telemetry-send.sh — fire-and-forget anonymous usage ping (SCHEMA.md §Telemetry).
-#
-#   telemetry-send.sh <phase> <feature_id> <seconds> [results]
-#     phase    brainstorm|spec|build|review|fix|ship — the feature funnel, and only it.
-#              Setup/maintenance commands never ping (SCHEMA.md §Telemetry).
-#     feature  the feature id — NEVER sent raw; SHA-256-hashed to 12 hex chars
-#     seconds  batch wall-clock
-#     results  optional compact summary, e.g. "ok,ok" or "REVISE:3"
-#
-# GDPR posture (documented in SCHEMA.md §Telemetry):
-#   - STRICTLY opt-in: exits silently unless ~/.claude/cohorte.config.yaml has
-#     telemetry.enabled: true AND a non-empty endpoint AND an install_id
-#     (all three written only by the explicit consent flow).
-#   - Data minimization: no repo names, no paths, no code, no IP handling client-side.
-#   - Never blocks or fails the pipeline: 2s timeout, all errors swallowed, exit 0 always.
-set -u
-
-# Same two-location probe as kanban-move.sh: consent is recorded once per human, in
-# whichever config the runtime that installed the pipeline created.
-cfg=""
-for c in "${CLAUDE_CONFIG_DIR:-$HOME/.claude}/cohorte.config.yaml" \
-         "$HOME/.cohorte/cohorte.config.yaml"; do
-  [ -f "$c" ] && { cfg="$c"; break; }
-done
-[ -n "$cfg" ] || exit 0
-
-# read keys scoped to the `telemetry:` block only
-tval() {
-  awk -v key="$1" '
-    /^telemetry:/       { in_t=1; next }
-    /^[a-zA-Z]/         { in_t=0 }
-    in_t && $1 == key":" {
-      v=$2; gsub(/^"|"$|#.*/,"",v); gsub(/"/,"",v); print v; exit
-    }' "$cfg"
-}
-
-[ "$(tval enabled)" = "true" ] || exit 0
-endpoint="$(tval endpoint)";   [ -n "$endpoint" ]   || exit 0
-install_id="$(tval install_id)"; [ -n "$install_id" ] || exit 0
-
-phase="${1:-}"; feature="${2:-}"; seconds="${3:-0}"; results="${4:-}"
-[ -n "$phase" ] || exit 0
-
-# Allowlist the phase here — the collector accepts any string, so a typo in a command
-# file would silently pollute the dataset with a phantom phase nobody notices.
-case "$phase" in
-  brainstorm|spec|build|review|fix|ship) ;;
-  # `smoke` is a RETIRED phase (removed in 1.5.0) — still accepted so a stale install
-  # pinging it lands in its own bucket instead of being silently dropped.
-  smoke) ;;
-  *) exit 0 ;;
-esac
-
-# The payload is hand-built JSON: a non-numeric seconds or a quote in results
-# would silently produce an invalid document the collector drops.
-case "$seconds" in ''|*[!0-9]*) seconds=0 ;; esac
-results=$(printf '%s' "$results" | tr -d '"\\\n\r' | cut -c1-80)
-
-if command -v shasum >/dev/null 2>&1; then
-  fhash=$(printf '%s' "$feature" | shasum -a 256 | cut -c1-12)
-else
-  fhash=$(printf '%s' "$feature" | sha256sum | cut -c1-12)
-fi
-# The core that shipped THIS script is the one whose version we report. Bundled
-# installs live at <project>/.claude/pipeline/scripts/, where the global VERSION is
-# either absent or a DIFFERENT core — reading only the global path made every
-# bundled repo report an empty core_version.
-here=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd 2>/dev/null) || here=""
-ver=""
-for v in "$here/../VERSION" "${CLAUDE_CONFIG_DIR:-$HOME/.claude}/pipeline/VERSION" \
-         "$HOME/.cohorte/pipeline/VERSION"; do
-  [ -n "$ver" ] && break
-  ver=$(head -1 "$v" 2>/dev/null | tr -d '"\\')
-done
-os=$(uname -s 2>/dev/null || echo unknown)
-ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-
-payload=$(printf '{"v":1,"install_id":"%s","ts":"%s","core_version":"%s","os":"%s","event":"phase","phase":"%s","feature_hash":"%s","seconds":%s,"results":"%s"}' \
-  "$install_id" "$ts" "$ver" "$os" "$phase" "$fhash" "${seconds:-0}" "$results")
-
-curl -s -m 2 -X POST -H 'content-type: application/json' \
-  -d "$payload" "$endpoint" >/dev/null 2>&1 || true
-exit 0