cohorte 2.2.0 → 2.4.0

package/CHANGELOG.md

@@ -7,6 +7,93 @@ short, user-facing, most recent first. One `## <version> — <YYYY-MM-DD>` secti
 > They are history and are deliberately not rewritten — every command gained a `cohorte-` prefix
 > in 2.0.0.
 
+## 2.4.0 — 2026-08-13
+
+- **The pipeline froze *what* to build, never *how much*.** A spec pins the contract and the
+  acceptance criteria, so the feature was right — but nothing ever asked an implementer whether the
+  helper it was about to write already existed three files over, whether the stdlib shipped it, or
+  whether the abstraction it was wrapping had exactly one caller. The diff came out correct and
+  fatter than it needed to be, and every extra line was then paid twice: once at build, once again at
+  `/cohorte-review`, whose cost is linear in the diff it reads.
+
+  Implementers now walk a **minimality ladder** before inventing anything: does it need to exist at
+  all → already in this repo → stdlib/framework → native platform feature → an already-installed
+  dependency → a few inline lines → only then the minimum the contract requires. It governs the
+  **how**, never the **what** — a contract field, an acceptance criterion, a test, a validation or an
+  authz check is out of its reach, by construction. It is bounded to **one lookup per candidate**, so
+  it costs a symbol search and not an exploration, and a shortcut kept on purpose surfaces in the
+  handoff's `## TODO / not done` with its ceiling and its upgrade trigger, instead of rotting in a
+  comment.
+
+  The `review` agent gains the matching axis — over-engineering, tagged `delete:` / `stdlib:` /
+  `native:` / `yagni:` / `shrink:`, always naming the cheaper replacement. It is deliberately the
+  weakest thing in the report: **5 findings max, MEDIUM ceiling, never a CRITICAL, never a REVISE,
+  never a BLOCK**. A diff whose only findings are `complexity` ships, and they park in the backlog
+  like any other nit. Tests, fixtures and anything the contract mandates are out of bounds — coverage
+  is not bloat. In audit mode the axis widens to the whole target (10 per domain, biggest cut first,
+  closing with `net: -N lines, -M deps possible.`), and `/cohorte-audit` files them under a new
+  `complexity` backlog tag: the cheapest wins in the file, since deleting code needs no new test.
+
+  Doctrine adapted from [ponytail](https://github.com/dietrichgebert/ponytail) (MIT) — the decision
+  ladder and the finding tags are theirs; the subordination to the frozen contract and the
+  can't-block severity ceiling are what make them safe inside a gated pipeline.
+
+  Run `/cohorte-update-pipeline` to re-render your surface agents — the ladder lives in the
+  implementer template, so it only reaches your agents through a reconcile.
+
+## 2.3.0 — 2026-08-12
+
+- **A bug fix had to pretend to be a feature.** The only way into the pipeline was
+  `/cohorte-spec` — a section-by-section interview whose critical part is a frozen §5 contract, with
+  a ~300-line budget. For a `500` on an empty cart that is more work than the fix, so in practice you
+  left the pipeline and patched by hand: no frozen intent, no review, no trace.
+
+  `/cohorte-patch` is the bug-fix entry point. A **triage, not an interview** — repro, expected
+  behaviour, what must not change — it locates the cause itself and freezes
+  `specs/patch-<slug>.md` (`kind: patch`, ~60 lines). The **§4 regression test replaces §5 CONTRACT**
+  as the thing the diff is checked against.
+
+  Then nothing downstream is special-cased: a patch spec *is* a spec, so `/cohorte-build` →
+  `/cohorte-review` → `/cohorte-fix` → `/cohorte-ship` consume it unchanged, one `/clear` between
+  each — four short sessions instead of one thread re-sending its own triage history at input price
+  every turn. Only three places read `kind: patch`: build §1.6/§2 (judge the repro + test, author no
+  contract when §5 is `none`), the `review` agent (scope creep becomes a first-class finding), and
+  ship (branch off `vcs.patch_branch_prefix`, `patch` bump by default, `fix(<scope>)` commit).
+
+  A patch may span **several surfaces** — one bug, one repro, one spec. The single hard escalation:
+  a fix needing **new** contract surface area is a feature wearing a bug's clothes, and it is routed
+  to `/cohorte-spec` rather than letting two surfaces invent a shape independently.
+
+- **Telemetry is gone — all of it.** The opt-in usage pings that shipped through 2.2.0 are removed
+  wholesale: the `telemetry-send.sh` sender, the per-phase pings in the six funnel commands, the
+  consent question in `/cohorte-init-pipeline`, the `telemetry:` block in the config template, the
+  `/cohorte-doctor` consent check, the collector contract in `SCHEMA.md`. Cohorte now sends nothing,
+  anywhere.
+
+  **Upgrading removes what is already on disk.** Copy-over never deletes, so an existing install
+  would otherwise keep an executable that still POSTs to the collector — all three installers
+  (`install.sh`, `install.ps1`, `npx cohorte`) now scrub it, and CI asserts its absence. And
+  `/cohorte-update-pipeline` deletes the leftover `telemetry:` block from
+  `~/.claude/cohorte.config.yaml`: nothing reads it any more, and an `enabled: true` left sitting in
+  a file you may open reads as though data were still leaving the machine.
+
+  The OpenTelemetry tip (Claude Code's own metrics export, a collector you point at yourself) is
+  gone from `SCHEMA.md` §Measuring cost and the token-economy guide too. `/cost` and
+  `pipeline-metrics.jsonl` remain — both entirely local.
+
+  `validate-core.mjs` gained a ratchet: any mention of telemetry or a usage ping under
+  `core/{commands,agents,templates,workflows}` now fails CI, so it cannot creep back in by copying an
+  old command file. The single exemption is `/cohorte-update-pipeline` — the command that *deletes*
+  the leftovers has to name them — and it is itself checked for never naming a ping, a sender or a
+  consent flow.
+
+- **Kanban:** `/cohorte-patch` with no argument offers the **Ideas** column, `[patch]`-titled cards
+  first, and titles its own card `[patch] <title>` (join key `#patch-<slug>`). The `[<kind>]` prefix
+  stays a human convention — nothing parses it.
+
+- **Profile:** new optional `vcs.patch_branch_prefix` (default `fix/`); `/cohorte-update-pipeline`
+  tops it up, and a profile without it falls back to the same default.
+
 ## 2.2.0 — 2026-08-12
 
 - **The pipeline was Claude Code or nothing.** The doctrine — frozen spec, stateless surfaces, a

package/README.md

@@ -256,6 +256,7 @@ it in `.claude/pipeline/VERSION` and bundled repos in their committed `pipeline.
 | `/cohorte-init-pipeline`     | Detect stack → interview → generate the profile + agents. Run once per project.       |
 | `/cohorte-brainstorm`        | Interactive persona panel that pressure-tests a feature idea.                         |
 | `/cohorte-spec`              | Freeze the feature spec + contract into `specs/<id>.md` (UI features also get a standalone design brief at `specs/design/<id>.md`). Also applies review returns. |
+| `/cohorte-patch [bug]`       | Bug-fix entry: triage a bug and freeze a ~60-line patch spec (`specs/patch-<slug>.md`) whose regression test replaces the contract. Then the normal `/cohorte-build → review → ship`. |
 | `/cohorte-build <id>`        | Readiness gate on the frozen spec, then the lead authors the contract and dispatches one implementer per surface in parallel. |
 | `/cohorte-review <id>`       | Read-only review agents (one per touched surface, parallel) audit the diff vs the spec; out-of-scope findings go to the refactor backlog. |
 | `/cohorte-fix <id>`          | Apply a review report: remediation into the spec, re-dispatch only the surfaces with findings. |
@@ -344,15 +345,13 @@ The essentials:
 
 Details: `profile/SCHEMA.md` §Workflows.
 
-## Privacy — opt-in telemetry
+## Privacy
 
-Cohorte can send **anonymous** usage pings (core version, OS, phase name, duration, per-surface
-result counts, and a *hash* of the feature id — never repo names, paths, code, or IPs). It is
-**strictly opt-in**: `/cohorte-init-pipeline` asks once per machine, the default is No, and both answers are
-recorded so you're never re-asked. Withdraw anytime (`telemetry.enabled: false` in
-`~/.claude/cohorte.config.yaml`); erase your history anytime (`/cohorte-doctor` prints your `install_id`,
-the collector's `DELETE /v1/install/<id>` drops it). Full spec + GDPR details:
-`profile/SCHEMA.md` §Telemetry (including the collector API contract).
+Cohorte sends nothing, anywhere. There is no telemetry, no usage pings, no collector — the
+opt-in stats that shipped through 2.2.0 were removed in 2.3.0, sender included. Everything the
+pipeline records (`pipeline-metrics.jsonl`, `specs/reports/`) stays in your repo, and the only
+network calls are the ones you can see: `git`, `gh`, and whatever MCP providers you wired
+yourself.
 
 ## License
 
@@ -380,7 +379,7 @@ profile/
   PIPELINE.template.md  # the profile skeleton /cohorte-init-pipeline fills
   SCHEMA.md             # field reference
   cohorte.config.template.yaml   # seeds ~/.claude/cohorte.config.yaml (kanban)
-scripts/                # worktree-isolation templates + shipped preflight/kanban/telemetry scripts
+scripts/                # worktree-isolation templates + the shipped preflight/kanban scripts
 dashboard/              # local web cockpit (npx … dashboard) — see dashboard/README.md
   server/               # dependency-free node runtime (serves the built app + JSON/stream API)
   app/                  # Vite + React source (built to dashboard/dist/ at publish time)

package/bin/cli.js

@@ -237,10 +237,10 @@ function copyCore() {
   // write where this runtime does not look.
   resolveTemplateConditionals(pipelineDir);
   // Copy the *.template files AND the shipped executables (kanban-move.sh,
-  // telemetry-send.sh). Until 1.2.4 this loop took only `.template`, so every
+  // preflight.sh). Until 1.2.4 this loop took only `.template`, so every
   // `npx cohorte install/update` produced a core missing both scripts — and since
   // every caller chains them with `|| true`, the result was silent: no kanban card
-  // moves, no telemetry pings, no error. The shell installers named them explicitly
+  // moves, no error. The shell installers named them explicitly
   // and this port drifted. The rule below needs no list to keep in sync: a `<x>.sh`
   // with an `<x>.sh.template` sibling is rendered per-project by /cohorte-init-pipeline, so
   // only the template ships; every other `.sh` is a shipped executable.
@@ -255,6 +255,12 @@ function copyCore() {
       try { fs.chmodSync(target, 0o755); } catch { /* optional */ }
     }
   }
+  // 2.3.0 removed telemetry. The copy loop above is by-rule, so it simply stops shipping the
+  // sender — but copy-over never deletes, and an existing install would keep an executable
+  // that still POSTs to the collector. Scrub it. The dead `telemetry:` block in the user's
+  // config is not this installer's to parse: /cohorte-update-pipeline deletes it, where an
+  // agent can edit the YAML surgically (SCHEMA.md §Reconcile step 5).
+  fs.rmSync(path.join(pipelineDir, 'scripts', 'telemetry-send.sh'), { force: true });
   // The per-surface implementer template is rendered per SURFACE later, by
   // /cohorte-init-pipeline inside the target repo — but its runtime shape (frontmatter keys,
   // capability branches, the preamble) is fixed here, at install time. Run it through the

package/core/adapter/render.js

@@ -196,7 +196,7 @@ function stateDir(runtime) {
   return runtime.id === 'claude' ? '.claude' : '.cohorte';
 }
 
-// The user-level config (kanban boards, shared vault, telemetry consent). One file per
+// The user-level config (kanban boards, shared vault). One file per
 // human, not per project or per runtime; the shipped scripts probe the same two paths.
 function configPath(runtime) {
   return runtime.id === 'claude' ? '~/.claude/cohorte.config.yaml' : '~/.cohorte/cohorte.config.yaml';
@@ -213,7 +213,7 @@ function preamble(runtime, paths, projectRoot, { kind = 'command' } = {}) {
   L.push(`> - \`<core>\` = \`${core}\` — the pipeline's shared assets (\`pipeline/scripts/\`, \`pipeline/SCHEMA.md\`, \`templates/\`). Every \`<core>/…\` path below resolves there, and nowhere else.`);
   L.push(`> - \`<state>\` = \`${stateDir(runtime)}/\` in **this repo** — what the pipeline generates for this project (\`gate-config.json\`, \`preflight.ok\`, \`pipeline-metrics.jsonl\`, \`pipeline.json\`). Always project-relative, even when \`<core>\` is global.`);
   L.push(`> - \`<memory>\` = \`${runtime.memory}\` — this runtime's project-instructions file at the repo root, loaded into every session here. Where the doctrine says to reference or extend it, that is the file.`);
-  L.push(`> - \`<config>\` = \`${configPath(runtime)}\` — your user-level config (kanban boards, shared vault, telemetry consent). One per human, never committed.`);
+  L.push(`> - \`<config>\` = \`${configPath(runtime)}\` — your user-level config (kanban boards, shared vault). One per human, never committed.`);
 
   L.push(`> - \`<agents>\` = \`${agentsDir}\` — real subagents. Dispatch: ${runtime.agent.dispatch}.`);
 

package/core/agents/implementer.template.md

@@ -59,6 +59,33 @@ them over Grep/Glob + whole-file Reads**: locate code by symbol, read only the d
 and trace references before changing any shared shape. Fall back to Grep/Read only when the retrieval
 tools are unavailable or come up empty.
 
+## How you choose what to write — the minimality ladder
+
+The spec froze the **what**; this ladder governs only the **how**. It never licenses you to skip a
+contract field, an acceptance criterion, a test, a validation, an authz check or an accessibility
+attribute — those are the *what*, and they are not yours to trim.
+
+Before writing any helper, utility, wrapper, abstraction or new dependency, walk down and stop at the
+first hit:
+
+1. **Does it need to exist at all?** An abstraction with one implementation, a config nobody sets, a
+   layer with one caller — don't write it. The second caller is when it earns its keep.
+2. **Is it already in this repo?** One retrieval/Grep lookup by symbol name, not a survey — you are
+   checking, not exploring. Reuse beats re-implementing, and it keeps the convention.
+3. **Is it in the standard library / framework?** Name it and use it.
+4. **Is it a native platform feature?** (CSS, the HTTP layer, the DB, the runtime.) Prefer it over code.
+5. **Is it in a dependency already installed?** Use that one. Adding a dependency for what tiers 3–5
+   already ship is a finding at review.
+6. **Can it be a few lines inline?** Then it doesn't need a file, a class, or a name.
+7. Only then: the **minimum implementation that satisfies the contract** — no speculative options, no
+   "we'll probably need" parameters, no premature generalisation.
+
+Bound the cost: this is at most **one lookup per candidate**, and it applies to code you are inventing —
+never to code the contract dictates. If a step would cost more searching than writing, write it.
+
+Something you deliberately kept simple with a known ceiling goes in your handoff `## TODO / not done`
+with its limit and what would trigger the upgrade — not in a comment, and not silently.
+
 ## How you work — strict TDD (red → green → refactor)
 
 <!-- <SURFACE_TDD_STEP1> is a LEAD-IN paragraph, not a numbered item: it is filled only for a

package/core/agents/release.md

@@ -28,7 +28,9 @@ committing, pushing, and opening the PR. You do **not** write features.
 ## Your inputs
 
 1. The spec path `specs/<id>.md` (title, goal, contract — for the PR body).
-2. `feature_id` and the branch `<vcs.feature_branch_prefix><id>`.
+2. `feature_id` and the branch — the lead passes it literally in the dispatch; use that, don't
+   re-derive it (a `kind: patch` spec branches off `vcs.patch_branch_prefix`, not
+   `feature_branch_prefix`).
 3. If `PIPELINE.md` §`release_notes.enabled`, the already-written note at
    `<release_notes.dir>/<release_notes.filename>` — stage it with everything else.
 
@@ -37,7 +39,9 @@ committing, pushing, and opening the PR. You do **not** write features.
 1. Sanity-check: `git status`, `git diff --stat`. Confirm you're on the feature branch (not the default
    branch). Confirm no `.env`/secret files staged.
 2. Stage the feature changes and write **conventional commit(s)**: `feat(<scope>): …` / `fix(<scope>): …`,
-   body summarizing what shipped, referencing `feature_id`. Scope from the domain. End the commit body with:
+   body summarizing what shipped, referencing `feature_id`. Scope from the domain. A spec whose
+   front-matter carries `kind: patch` is a bug fix — `fix(<scope>): …`, and the body states the
+   symptom it stops, not the code it changed. End the commit body with:
    `Co-Authored-By: Claude <noreply@anthropic.com>`
 3. `git push -u origin <branch>` (plain push, no force).
 4. Open the PR against `vcs.default_branch`:

package/core/agents/review.md

@@ -47,6 +47,13 @@ be precise and self-contained.
 1. **Spec conformance (highest priority).** Does the implementation match the frozen contract exactly —
    every endpoint/interface (method, path, auth, request/response shape, status codes, error cases) and
    every acceptance criterion? Any deviation is a finding. Cross-surface calls must match the contract.
+   **On a `kind: patch` spec** (front-matter) the contract is usually `none` and this check reads
+   differently: the diff must (a) contain the §4 regression test, asserting what §4 says it asserts,
+   (b) actually address the §1 repro through the §3 cause — a fix that suppresses the symptom
+   elsewhere is a finding, not a fix — and (c) stay inside §7 Out of scope. **Scope creep is a
+   first-class finding on a patch**: a correct, tidy improvement the spec did not ask for still
+   widens the blast radius of a change that is shipping fast, so report it rather than waving it
+   through. Genuinely-good-but-out-of-scope work is a **deferred** finding, exactly as elsewhere.
 2. **Correctness.** Logic bugs, unhandled errors, validation gaps, auth holes, data exposure.
 3. **Security.** Authz on every entry point, input validation, no secret/PII leakage, no injection.
    A security vulnerability ⇒ verdict **BLOCK**.
@@ -56,6 +63,20 @@ be precise and self-contained.
    additive `sm:/md:/lg:`, no fixed widths that break on mobile. (You can't render; judge from the code.)
 7. **TDD coverage.** Each surface's tests cover its slice of the contract (statuses, validation, auth,
    behavior). Flag untested contract surface.
+8. **Over-engineering (lowest priority, never blocking).** Code the diff *added* that didn't need to
+   exist. Tag each one and always name the replacement — a finding with no cheaper alternative is an
+   opinion, not a finding:
+   - `delete:` dead code, unused flexibility, a speculative feature nothing calls. Replacement: nothing.
+   - `stdlib:` hand-rolled thing the standard library or framework ships. Name the function.
+   - `native:` a dependency or code doing what the platform already does. Name the feature.
+   - `yagni:` abstraction with one implementation, config nobody sets, layer with one caller.
+   - `shrink:` same behaviour, materially fewer lines. Name the shorter form.
+
+   **Hard limits on this axis.** It is capped at **5 findings**, biggest cut first, and its severity
+   ceiling is **MEDIUM** — it can never produce CRITICAL, never REVISE, never BLOCK. Test code,
+   fixtures and anything the contract or an acceptance criterion mandates are **out of bounds**:
+   coverage is not bloat, and "simpler" is never a reason to drop a spec'd behaviour. Deduplication
+   that would cross a surface boundary is out of bounds too — that's an architecture call, not a review one.
 
 ## Language checks (apply only those matching the surfaces under review)
 
@@ -82,10 +103,19 @@ entry point / module with **no test**), and the lint/format/type debt staged at
 dispatch names (`specs/reports/audit-gates.txt`). Emit a **prioritized refactor backlog grouped by
 domain** (same finding-line shape) instead of a SHIP/REVISE/BLOCK verdict.
 
+In audit mode the over-engineering axis (§8) widens: there is no diff, so the whole target is in
+scope and the 5-finding cap lifts to **10 per domain**, ranked biggest cut first. Hunt the usual
+shapes — deps the stdlib or platform already ships, single-implementation interfaces, factories with
+one product, wrappers that only delegate, dead flags and config, hand-rolled stdlib. Close the
+audit-mode report with one line: `net: -<N> lines, -<M> deps possible.` (`0`/`0` is a valid answer —
+say it rather than inventing cuts).
+
 ## Severity & verdict
 
 - **CRITICAL** — spec violation or correctness bug that must be fixed ⇒ verdict **REVISE**.
 - **HIGH / MEDIUM / LOW** — quality/convention issues; note them.
+- **Over-engineering (§8) caps at MEDIUM** and never drives the verdict — a diff whose only findings
+  are `complexity` ships. It is a cleanup signal, not a gate.
 - Any **security vulnerability** ⇒ verdict **BLOCK**.
 - No CRITICAL and no security issue ⇒ verdict **SHIP**.
 
@@ -110,7 +140,7 @@ they are **never lost and never cost a fix loop**.
 ## Your return — the REVIEW REPORT, exactly this shape
 
 Every finding must be **self-sufficient for a stateless agent**: `file:line` · severity ·
-`spec-violation | quality | security` · one concrete suggested fix — it gets appended verbatim to the
+`spec-violation | quality | security | complexity` · one concrete suggested fix — it gets appended verbatim to the
 spec's `## Remediation`. Your final message **is** the report. **The shape is capped:** at most
 **20 findings**, ONE line each, **zero code excerpts** (the diff and the source are on disk — a
 `file:line` is enough for a stateless fixer). More than 20? Keep every CRITICAL/HIGH/security
@@ -133,12 +163,13 @@ Verdict: <SHIP | REVISE | BLOCK>
 
 ## Findings
 
-- **[<SEVERITY>]** `<file>:<line>` · <spec-violation|quality|security> · <problem> → **Fix:** <concrete change>
-(order by severity; "None." if none; max 20 lines, one per finding, no code excerpts)
+- **[<SEVERITY>]** `<file>:<line>` · <spec-violation|quality|security|complexity> · <problem> → **Fix:** <concrete change>
+(order by severity; "None." if none; max 20 lines, one per finding, no code excerpts.
+ `complexity` lines carry their §8 tag in the problem — `yagni: <what>` — and cap at 5)
 
 ## Deferred
 
-- **[<SEVERITY>]** `<file>:<line>` · <quality|security> · <problem> → **Fix:** <concrete change> · out of scope: <why this feature does not own it>
+- **[<SEVERITY>]** `<file>:<line>` · <quality|security|complexity> · <problem> → **Fix:** <concrete change> · out of scope: <why this feature does not own it>
 (real but out of this feature's scope — see §Deferred; worst first; "None." if none; max 10 lines)
 
 ## Notes

package/core/commands/cohorte-audit.md

@@ -32,8 +32,9 @@ bulk never sits in your history, then grep it for the `file:line` of every failu
 
 Dispatch `review` (read-only; static prompt first, variable slot last — prompt-cache prefix):
 "Audit a target against `PIPELINE.md` (no spec — **audit mode**). Check conventions (§Conventions
-per surface), TDD coverage (untested entry points / modules per surface), and — if the profile
-enables them — mobile-first + design-system usage. Mechanical findings from the gates: read
+per surface), TDD coverage (untested entry points / modules per surface), over-engineering (§8,
+widened per your audit-mode rules — ranked biggest cut first, closing `net:` line), and — if the
+profile enables them — mobile-first + design-system usage. Mechanical findings from the gates: read
 `specs/reports/audit-gates.txt`. Emit a prioritized refactor backlog (capped finding-line format
 from your instructions), grouped by domain (one group per surface + shared). — Target: `$ARGUMENTS`
 (default: whole repo)."
@@ -42,7 +43,11 @@ from your instructions), grouped by domain (one group per surface + shared). —
 
 Merge mechanical + convention findings into one prioritized backlog and **write
 `specs/refactor-backlog.md`**, grouped by domain, each item:
-`- [ ] <SEVERITY> · <file:line> · <rule|tdd|lint|format|type|security> · <concrete fix>`
+`- [ ] <SEVERITY> · <file:line> · <rule|tdd|lint|format|type|security|complexity> · <concrete fix>`
+
+`complexity` items are the over-engineering cuts, ranked biggest first inside their domain — they are
+the cheapest wins in the backlog (deleting code needs no new tests) but they never outrank a
+security, correctness or `tdd` item.
 
 **Carry over the deferred items** before overwriting: `grep -n 'deferred:' specs/refactor-backlog.md`
 and re-emit every **open** (`- [ ]`) match verbatim under its domain, tag included. Those lines were

package/core/commands/cohorte-brainstorm.md

@@ -64,8 +64,3 @@ downstream. Then, in this order:
 2. `<core>/pipeline/scripts/kanban-move.sh auto <feature_id> brainstorm --title "<human title>"` —
    which moves the (now tagged) card, or creates one under `--title` if the human typed a fresh
    idea. Read its output: `moved #…` or `kanban: <reason>`. Never assume either.
-
-**Telemetry:** chain the opt-in usage ping onto that same Bash call — `/cohorte-build` §4's shared form,
-`<phase>` = `brainstorm`, `<seconds>` = `0` (this phase is human thinking time, not pipeline
-wall-clock — the funnel signal is the event, not its duration), `<results>` = `""`. No board ⇒ still
-ping, in its own `|| true` call. Silent no-op without consent; never ask about consent here.

package/core/commands/cohorte-build.md

@@ -26,6 +26,11 @@ You are the **lead**. Build feature **$ARGUMENTS** from its frozen spec.
   `/cohorte-spec` first. Only then read the body, selectively: front-matter, §5 contract, the surface
   task sections, and `## Remediation` (fall back to a full read if the spec doesn't follow the
   template's headings).
+- **`kind: patch` in the front-matter ⇒ this is a bug fix** frozen by `/cohorte-patch`, and it is
+  built by this command like any other spec, with two differences called out where they apply: §1.6
+  judges it against its regression test instead of a contract, and §2 authors no contract unless §5
+  carries a delta. Everything else — surface mapping, parallel dispatch, roll call, metrics — is
+  identical, and `kind` absent means feature, so nothing changes for existing specs.
 - **Route check** — if `## Remediation` has open `- [ ]` items and none requires a contract change,
   stop and tell the human to run `/cohorte-fix $ARGUMENTS` instead: it re-dispatches only the surfaces with
   findings. A full build with open items is only right when the contract change ripples into clean
@@ -79,6 +84,13 @@ good idea (that was `/cohorte-brainstorm`), never by re-reading files you don't
    request fields with types + validation, the success shape, and its error cases. A missing
    **request or success shape** ⇒ `NOT-READY` (an implementer would invent it, and the other surface
    would invent a different one). A missing **error case** ⇒ `RESERVATIONS`.
+   **On a `kind: patch` spec this check is replaced, not skipped** — a patch has no contract to be
+   complete, so judge §1 Symptom & repro + §4 Regression test instead: no stated expected behaviour,
+   or a §4 that names no test and no reason the fix would be verifiable ⇒ `NOT-READY` (an implementer
+   would fix whatever it guessed the bug was, and nothing would catch a wrong guess). A repro
+   explicitly frozen as a hypothesis, or a cause left to the implementer to find, is
+   `RESERVATIONS` — normal for a patch, never a blocker. Then judge §5 as above **only** if it
+   carries a delta rather than `none`.
 2. **Surface coverage** — every §6 task maps to a surface in the reconciled list, and every contract
    entry has an owner **on each side it names** (producer and consumer). A contract entry no surface
    owns ⇒ `NOT-READY`.
@@ -103,7 +115,8 @@ this gate and any automated driver, which parses no prose:
 ```
 
 - **`gaps`** — one normalized string per gap, `<check>|<where>|<what is missing>`: `<check>` is
-  `contract` · `coverage` · `dependency` · `ambiguity` · `design`; `<where>` is the contract entry,
+  `contract` · `coverage` · `dependency` · `ambiguity` · `design` — plus `repro` on a `kind: patch`
+  spec, for a gap check 1 raised against §1/§4; `<where>` is the contract entry,
   surface key or dependency name (no `:line` — it shifts on every edit); `<what>` is the gap, not the
   fix. `READY` ⇒ `[]`.
 - **`NOT-READY` ⇒ STOP: author no contract and spawn NO agent.** Print the gaps and send the human to
@@ -117,6 +130,15 @@ this gate and any automated driver, which parses no prose:
 
 ## 2. Author the contract (lead-only — the single sync channel)
 
+_Skipped entirely on a `kind: patch` spec whose §5 Contract delta is `none`_ — which is the usual
+case: a bug fix corrects behaviour behind a shape that already exists, and re-authoring that shape
+would put the contract file in the diff for nothing. Say you skipped it and why, in one line. A patch
+whose §5 **does** carry a delta is authored exactly as below, from the delta, against the existing
+file — never rewritten from scratch. (A patch needing *new* contract surface area never reaches here:
+`/cohorte-patch` §3 routes it to `/cohorte-spec`.) When you skip, still run `date +%s` on its own —
+the skipped postcondition is where §4's wall-clock start comes from, and a build with no start epoch
+writes a metrics line with no duration.
+
 _Only if `contract.enabled`._ From §5 of the spec, write/update the feature's contract file at
 `<contract.path>/$ARGUMENTS.<contract.ext>` in the profile's `mechanism` (e.g. Zod v4 schemas + inferred
 types for `shared-types-zod`). Export it from `contract.index` if set. This is the ONLY file the agents
@@ -186,12 +208,7 @@ anything went wrong. In the same call write the machine-readable batch result to
 `specs/reports/$ARGUMENTS.build.json` (overwrite) — the channel an automated driver reads, since it
 never sees your chat:
 `{"id":"$ARGUMENTS","phase":"build","ts":"<ISO>","surfaces":{"<key>":"ok|error|dead",…},"dead":["<key>",…]}`
-— this is the evidence SCHEMA.md §Specialization asks for before splitting a surface. In the same
-Bash call, chain the opt-in usage ping — **the shared form every phase command reuses**:
-`<core>/pipeline/scripts/telemetry-send.sh <phase> "$ARGUMENTS" <seconds> "<results>" || true` — a silent no-op unless the human explicitly consented (SCHEMA.md §Telemetry);
-never ask about consent here. `/cohorte-review` and `/cohorte-fix` chain the same line with their own
-phase + results. The `|| true` swallows a **missing** script too, so a half-copied core goes
-silent rather than loud — `/cohorte-doctor` check 1 is what catches that.
+— this is the evidence SCHEMA.md §Specialization asks for before splitting a surface.
 Then tell the human: exercise the feature by hand if it's worth it, then run `/cohorte-review $ARGUMENTS` —
 unless a surface is dead, in which case say so first and let them decide whether to re-run `/cohorte-build`
 (a dead surface has no findings, so `/cohorte-fix` has nothing to re-dispatch).

package/core/commands/cohorte-doctor.md

@@ -30,10 +30,10 @@ fix only with the human's go-ahead (or hand them the command).
    commands' step files are present — `templates/steps/init-pipeline/` non-empty (a router whose
    `templates/steps/<cmd>/` dir is missing is a partial/stale install ⇒
    re-run install/update). **Shipped scripts present and executable** in `<core>/pipeline/scripts/`:
-   `kanban-move.sh`, `telemetry-send.sh`, `preflight.sh`,
+   `kanban-move.sh`, `preflight.sh`,
    `new-feature.sh.template`, `remove-feature.sh.template` — ❌ any missing one.
    Every caller chains these with `|| true`, so an absent script is a **silent**
-   no-op (no kanban card moves, no telemetry ping, no error anywhere) — this check is the only thing
+   no-op (no kanban card moves, no error anywhere) — this check is the only thing
    that sees it. Also flag ❌ a `VERSION` **newer than** the other `pipeline/` files (compare mtimes):
    a version bumped without a full re-copy is a half-done update ⇒ re-run install/update.
 2. **Profile.** `PIPELINE.md` exists and its `yaml pipeline-profile` block parses. Every
@@ -51,7 +51,7 @@ fix only with the human's go-ahead (or hand them the command).
    (`build`, `review`, `fix`, `ship`, `audit`, `refactor`, `doctor`, `align-ds`,
    `update-pipeline` — in `<commands>/`) carries `model: sonnet` in
    its frontmatter — ⚠️ if missing (the lead's orchestration turn then bills at the session model,
-   e.g. Opus/Fable). `brainstorm`, `spec`, and `init-pipeline` are intentionally unpinned
+   e.g. Opus/Fable). `brainstorm`, `spec`, `patch`, and `init-pipeline` are intentionally unpinned
    (interactive — they inherit the session model).
 <!-- cohorte:endif -->
 
@@ -96,13 +96,7 @@ fix only with the human's go-ahead (or hand them the command).
    When ≥2 slots are live, print the parallel-feature table (feature · worktree · ports · db ·
    branch behind main by N commits) — a worktree far behind main means its next review will diff
    against stale code ⇒ suggest rebasing it.
-7. **Telemetry** (consent hygiene — read `<config>` §`telemetry`). Report the
-   status in one line: `disabled` / `enabled since <consent_date> · install_id <id> · endpoint <url>`
-   (the install_id is the human's GDPR erasure key — see SCHEMA.md §Telemetry). Flag ❌ any
-   incoherent state: `enabled: true` with no `install_id` or no `consent_date` (sending without
-   recorded consent — fix: set `enabled: false` until the consent question is re-run), or a
-   `telemetry:` block missing entirely on a current core (top up via `/cohorte-update-pipeline`).
-7b. **Kanban** (the board mirror — SCHEMA.md §Kanban). Run
+7. **Kanban** (the board mirror — SCHEMA.md §Kanban). Run
    `<core>/pipeline/scripts/kanban-move.sh --check` and report its one line verbatim: the resolved
    board path, or the exact link that is missing. A board mirror is optional, so "not configured" is
    ℹ️, never ❌ — but it must be **stated**, because the whole class of bug here is a card that

package/core/commands/cohorte-fix.md

@@ -72,8 +72,7 @@ When the agents return:
   handoff content — and append ONE metrics line for the batch to the **main checkout's**
   `$(dirname "$(git rev-parse --git-common-dir)")/<state>/pipeline-metrics.jsonl` (never a bare
   relative path: from a feature worktree that writes a stray sink whose lines die at teardown)
-  (rules in `/cohorte-build` §4, `phase: "fix"`), chaining the opt-in usage ping in the same Bash call
-  (results = items fixed over items found across surfaces, e.g. `"5/6"`).
+  (rules in `/cohorte-build` §4, `phase: "fix"`).
 - Tell the human: re-test by hand if the failures were runtime ones, and `/cohorte-review $ARGUMENTS` for the
   re-verdict — the re-review is what *verifies* the ticked items actually hold (a regression simply
   reappears as a new finding in the next round). **Recommend a `/clear`** — all state (spec,

package/core/commands/cohorte-patch.md

@@ -0,0 +1,113 @@
+---
+description: Triage a bug and freeze a minimal patch spec — the cheap entry into the pipeline for a fix, no brainstorm, no contract.
+argument-hint: [bug description / stack trace / issue text — or empty to pick from the kanban]
+---
+
+You run the **patch triage** in the main thread — interactive, with the human. This is the bug-fix
+entry point: it produces `specs/patch-<slug>.md` and stops. Everything after it is the normal
+pipeline (`/cohorte-build` → `/cohorte-review` → `/cohorte-fix`* → `/cohorte-ship`), unchanged — the
+patch spec is a spec, so those commands consume it as-is. Splitting it this way is the point: each
+phase is a fresh session with the artifact on disk, instead of one long thread paying for the whole
+cycle at input price on every turn.
+
+Bug (may be empty): **$ARGUMENTS**
+
+> Read `PIPELINE.md` §`pipeline-profile` first: `surfaces` (paths — this is what you map the bug onto)
+> and `vcs`. _Skip the re-read if it's already in your context this session and unmodified since._
+> Do NOT read `specs/_decisions.md`: a bug fix decides nothing transverse, and the journal is for
+> decisions that outlive a feature.
+>
+> **Kanban** (SCHEMA.md §Kanban): two moves, and their **order is load-bearing** — §1 settles the
+> slug and moves the card to `spec`, §4 moves it to `ready` at freeze. Both are one call to
+> `<core>/pipeline/scripts/kanban-move.sh auto patch-<slug> <stage> [--title "[patch] <human title>"]`.
+> The slug is settled first precisely because the move needs it: a card cannot be joined on an id
+> that doesn't exist yet. `auto` resolves the board from the config itself and exits 0
+> with a `kanban: <reason>` line when there is none — so **never decide "no board is configured"
+> without running it**. Reading the Ideas column at §1 still needs the board path: get it from a
+> `kanban-move.sh` run, or grep the config for `boards[<PIPELINE name>]`.
+
+## 1. Get the bug
+
+If `$ARGUMENTS` is non-empty, restate it in one line and confirm you've got it.
+
+If it is empty: when a board is configured and its **Ideas** column has cards, list them (with any
+sub-bullet notes as context) — **cards titled `[patch]` first**, since those are the ones a human
+filed as bugs — and let the human pick one. Otherwise ask **"What's broken?"**. Either way, wait.
+
+Then **settle the id, before anything moves.** Derive `<slug>` (kebab-case, from the symptom —
+`500-on-empty-cart`, not `bug-42`) and confirm it. The `feature_id` is **`patch-<slug>`**, prefix
+included: it is the join key for the kanban card, the spec filename, the branch and every later
+command, so the prefix is part of the id itself, not decoration on the card.
+
+**Kanban, in this order:**
+
+1. **If the human picked an Ideas card, tag it FIRST.** Ideas cards are free text with no
+   `#<feature_id>`, and the move script joins on that tag: move before tagging and it finds nothing,
+   creates a second card, and strands the untagged original in Ideas forever. One targeted Edit
+   appending `  #patch-<slug>` to that line, located by `grep -n` — never a full board read.
+2. `<core>/pipeline/scripts/kanban-move.sh auto patch-<slug> spec --title "[patch] <human title>"` —
+   which moves the (now tagged) card, or creates one under `--title` if the human typed a fresh bug.
+   Report what it printed — `moved #…` or `kanban: <reason>` — never a guess about which happened.
+
+## 2. Triage — three questions, not an interview
+
+`/cohorte-spec` walks a template section by section because a feature has to be *designed*. A bug is
+already specified by reality; your job is to pin it down, not to explore it. Ask only what you
+genuinely cannot infer from the input, batched into ONE message:
+
+1. **Repro** — the shortest deterministic path to the symptom. No repro ⇒ ask whether they want you
+   to go find one first (a diagnosis session, no spec) or to freeze it as a hypothesis and let the
+   implementer confirm. Never invent a repro to fill the section.
+2. **Expected behaviour** — often the whole spec. "It should 404, not 500" is a complete contract.
+3. **Blast radius** — what must NOT change. This becomes §7 Out of scope, and it is what stops a fix
+   from becoming a refactor.
+
+Then locate it yourself — do not make the human do it. Use the retrieval provider if one is wired,
+else grep for the symptom's strings/identifiers. Read only the files the trail actually names.
+Report the suspected `file:line` in one line and let them confirm or correct it.
+
+## 3. Map it onto surfaces — as many as it takes
+
+Match the suspected cause and the fix's blast radius against `surfaces[].path`. **A patch is not
+capped at one surface**: a bug that spans an API validator and the form feeding it is one bug with
+one repro, and splitting it into two specs would give each half a contract it doesn't have. List the
+surfaces you're claiming, one line each, with why.
+
+**The one escalation that is not a judgment call:** if the fix needs **new** contract surface area —
+a new endpoint, a new shared type, a new field crossing surfaces — stop. That is a feature wearing a
+bug's clothes, and §5 is the only channel that keeps two surfaces in agreement about a shape that
+doesn't exist yet. Say so plainly and send the human to `/cohorte-spec`. Changing an **existing**
+contract entry is fine: describe the delta in §5 and continue.
+
+## 4. Freeze the patch spec
+
+Write `specs/patch-<slug>.md` from `<core>/templates/patch.template.md` with `status: frozen`, filled
+from §§1–3. **Create the file — do not ask the human to.** Budget: **~60 lines**. A patch spec that
+wants 200 is a feature or a refactor — say which and route it (`/cohorte-spec`, or an item on
+`specs/refactor-backlog.md`).
+
+Two sections carry the weight, and both are cheap to get wrong:
+
+- **§4 Regression test** — name the test file and what it asserts. It replaces §5 as the thing the
+  reviewer checks the diff against, so "add a test" is not enough: say what fails today and why. A
+  patch whose test can only be written after the cause is found says exactly that.
+- **§5/§9 keep the feature spec's numbers** (contract delta, acceptance). `review.md` and
+  `implementer.template.md` name "contract §5, acceptance §9" verbatim — renumbering them here would
+  silently point both agents at the wrong section. The template already does this; don't "fix" it.
+
+**Postcondition:** `grep -q '^status: frozen' specs/patch-<slug>.md` — if it fails the freeze didn't
+land; fix it before pointing the human at `/cohorte-build`. Chain the second kanban move onto that
+same Bash call — `kanban-move.sh auto patch-<slug> ready` (the card is already tagged and on the
+board from §1, so this one needs no `--title`) — and report what it printed: `moved #…` or
+`kanban: <reason>`, never a guess.
+
+## 5. Hand off
+
+Print the spec path, the surfaces, and the branch to cut: `<prefix>patch-<slug>`, where `<prefix>` is
+`vcs.patch_branch_prefix` — falling back to `fix/` on a profile that predates the key. If `isolation.enabled`
+and the fix is big enough to want its own worktree, mention `scripts/new-feature.sh patch-<slug>`;
+most patches don't need it.
+
+Then: `/cohorte-build patch-<slug>` — and **recommend a `/clear` first**. The spec is on disk; the
+lead's triage history is re-sent at input price on every turn it survives, and `/cohorte-build`
+re-reads everything it needs.

package/core/commands/cohorte-review.md

@@ -118,8 +118,6 @@ re-ordered by severity, counts summed, duplicates collapsed, verdict = the worst
 routes them. Append ONE metrics line for the batch to the **main checkout's**
 `$(dirname "$(git rev-parse --git-common-dir)")/<state>/pipeline-metrics.jsonl` (rules in
 `/cohorte-build` §4; never a bare relative path — from a worktree that strands the lines): `{"ts":"<ISO>","feature":"$ARGUMENTS","phase":"review","seconds":<wall-clock>,"surfaces":{"<key>":"<verdict>:<finding count>",…}}`.
-In the same Bash call, chain the opt-in usage ping (`/cohorte-build` §4, `phase: "review"`, results = the
-merged verdict + total finding count, e.g. `"REVISE:3"`).
 **Stage the full report to `specs/reports/$ARGUMENTS.md`** (overwrite) — a gitignored buffer so a
 `/cohorte-fix` after a `/clear` can still read the findings; the `specs/reports/` subfolder is skipped by the
 non-recursive `specs/*.md` glob, so it's never mistaken for a spec (no phantom card, no bogus stage).
@@ -167,7 +165,7 @@ exactly the leak this step closes. Append each merged `## Deferred` item to
 `/cohorte-refactor <domain>` picks them up with no extra plumbing):
 
 ```
-- [ ] <SEVERITY> · <file:line> · <quality|security|rule> · <concrete fix> · deferred:$ARGUMENTS
+- [ ] <SEVERITY> · <file:line> · <quality|security|rule|complexity> · <concrete fix> · deferred:$ARGUMENTS
 ```
 
 - **Never into the spec's `## Remediation`** — that list is what `/cohorte-fix` re-dispatches, so a