cohorte 2.2.0 → 2.4.0

package/core/commands/cohorte-ship.md

@@ -31,7 +31,10 @@ You are the **lead**. Ship feature **$ARGUMENTS**. This is the outward-facing ga
   §`Acceptance criteria / DoD`; if any item is still `- [ ]`, list the open ones and ask the human to
   confirm shipping anyway (they may be deferred on purpose — e.g. a UI item on a backend-only feature).
   All `- [x]` ⇒ proceed silently.
-- Show `git status` + `git diff --stat`; confirm the branch is `<feature_branch_prefix>$ARGUMENTS`.
+- Show `git status` + `git diff --stat`; confirm the branch is `<prefix>$ARGUMENTS`, where `<prefix>`
+  is `vcs.patch_branch_prefix` (falling back to `fix/` on a profile that predates the key) when the
+  spec front-matter carries `kind: patch`, and `vcs.feature_branch_prefix` otherwise. Resolve it once
+  here and pass the **literal** branch to §3's dispatch — the release agent must not re-derive it.
 - **Ask the human to confirm** they want to commit, push, and open the PR. Wait for yes.
 - After the yes: `<core>/pipeline/scripts/kanban-move.sh auto $ARGUMENTS ship`. Report what it
   printed — `moved #…` or `kanban: <reason>` — never a guess about which happened.
@@ -57,6 +60,9 @@ See SCHEMA.md §Release notes.
   `release_notes.forbid_levels` (a `0.x` repo forbidding `major` declares the rupture `minor`).
 - **Ambiguous between two defensible levels?** State your reading in one line and **ask the human to
   pick** before writing. A wrong bump becomes a published version number.
+- A `kind: patch` spec is a `patch` bump by default — that is what the level means. It is a default,
+  not a rule: a bug fix that changes documented behaviour is still a `minor`, and one that removes it
+  is still breaking. Say which you chose when it isn't `patch`.
 - The body describes what changed **for the user**, from the spec §1/§2 — no client names, no internal
   paths, no exploitable attack vector, no file lists.
 - If the feature genuinely must move no version, use `release_notes.empty_cmd` instead. Prefer that to
@@ -73,7 +79,7 @@ See SCHEMA.md §Release notes.
 
 Spawn one agent (`subagent_type: release`, or the equivalent dispatch for this runtime):
 "Release feature `$ARGUMENTS` on branch
-`<feature_branch_prefix>$ARGUMENTS`. Read `PIPELINE.md` §vcs first. Spec: `specs/$ARGUMENTS.md` (already
+`<the branch §1 resolved>`. Read `PIPELINE.md` §vcs first. Spec: `specs/$ARGUMENTS.md` (already
 `status: shipped` — stage it). Write conventional commit(s), push (no force), open the PR (use `gh` if
 `host: github` + available; else emit the compare URL + drafted PR body from `<core>/templates/pr-body.md`).
 Stage **all** the feature's changes including `specs/$ARGUMENTS.md` and, if `release_notes.enabled`, the
@@ -101,13 +107,6 @@ with a **grep for `#$ARGUMENTS`** on the board it named (with surrounding headin
 `grep -B20 '#$ARGUMENTS' | grep '^##'`, or an offset-limited Read around the match): exactly one card,
 under the `shipped` heading — never re-read the whole board into context.
 
-**Telemetry — the usage ping that closes the funnel.** Chain it onto the verify call above
-(`/cohorte-build` §4's shared form, `<phase>` = `ship`, `<seconds>` = `0` — the release agent's duration is
-not the pipeline's, `<results>` = `pr` when a PR was created / `compare` when only a compare URL was
-emitted). Fire it **after** the release agent reports success, never on an aborted ship — a `ship`
-event must mean the feature actually left the pipeline. No board ⇒ still ping, in its own `|| true`
-call. Silent no-op without consent; never ask about consent here.
-
 ## 5. After the PR — CI gate + teardown
 
 - If `host: github` and `gh` is available, watch the PR's checks (`gh pr checks <url> --watch`) and

package/core/commands/cohorte-spec.md

@@ -51,12 +51,7 @@ Detect the mode from the pasted content:
    it. This is just so the human isn't surprised when `/cohorte-build` proposes a new agent.
 5. When the human validates, **freeze**: write `specs/<id>.md` (`status: frozen`, front-matter filled).
    Create the file — do not ask the human to. **Postcondition:** `grep -q '^status: frozen' specs/<id>.md`
-   — if it fails the freeze didn't land; fix it before pointing the human at `/cohorte-build`. Chain the
-   opt-in usage ping onto the postcondition's Bash call (`/cohorte-build` §4's shared form, `<phase>` =
-   `spec`, `<seconds>` = `0` — interactive time, not pipeline wall-clock, `<results>` = `frozen`).
-   Ping only on a **landed** freeze, so the funnel counts specs that exist, not attempts. Mode B does
-   not ping — it re-enters an already-counted spec, and `/cohorte-fix` covers that loop. Silent no-op without
-   consent; never ask about consent here.
+   — if it fails the freeze didn't land; fix it before pointing the human at `/cohorte-build`.
 5b. **Record the transverse decisions — the journal, not a summary.** Walk what the interview settled
    and keep ONLY the decisions that **outlive this feature**: a rule the next spec would otherwise
    re-litigate or contradict (auth model, id/naming scheme, where a kind of state lives, an error

package/core/commands/cohorte-update-pipeline.md

@@ -98,10 +98,11 @@ Four of the §Reconcile steps matter specifically here:
 
 - **Global config seed** (§Reconcile step 5): if `<config>` is absent, seed it
   from the template so the kanban + shared-vault config has a home. Never clobber an existing filled
-  file. Report what was seeded. If the existing file has NO `telemetry:` block with a `consent_date`
-  (pre-telemetry install), top up the block from the template and ask the ONE opt-in consent
-  question defined in `templates/steps/init-pipeline/02-interview-gaps.md` §Telemetry — record the
-  answer either way so it is never re-asked. Consent is strictly opt-in; "No" is the default.
+  file. Report what was seeded. Then **scrub the retired `telemetry:` block** if the existing file
+  still has one (every install seeded before 2.3.0 does) — one targeted Edit deleting the block and
+  its comment header, nothing else touched. That capability was removed in 2.3.0, sender included,
+  so the block is dead config: nothing reads it, and an `enabled: true` left sitting in a file the
+  human may open reads as though data were still leaving the machine. Say you removed it.
 - **Kanban sync** (§Reconcile step 6): resolve this project's board with
   `<core>/pipeline/scripts/kanban-move.sh --check` — it prints either the board path or the exact
   missing link. **Not linked** → offer to link/create a board (confirm the vault + `<folder>/Tasks.md`,

package/core/templates/patch.template.md

@@ -0,0 +1,86 @@
+---
+feature_id: patch-<slug>
+kind: patch # a bug fix, not a feature — /cohorte-build skips contract authoring, /cohorte-ship commits `fix(…)`
+title: <one line: the bug, from the user's side>
+status: draft # draft → frozen → in-progress → in-review → shipped · blocked (see SCHEMA.md §Spec status)
+severity: <critical | major | minor> # drives nothing mechanical; it is what the human triages on
+branch: <patch_branch_prefix><feature_id>
+created: <YYYY-MM-DD>
+reviewed_base: # merge-base sha at the last SHIP verdict — freshness-gate anchor (written by /cohorte-review)
+reviewed_digest: # sha256 (16 hex) of the reviewed source diff vs reviewed_base, specs excluded — /cohorte-ship re-checks
+design_files: [] # omit unless the fix is itself visual
+---
+
+# <one line: the bug, from the user's side>
+
+## 1. Symptom & repro
+
+> What the user sees, and the shortest deterministic path to see it. A repro nobody can run is a
+> hypothesis, not a bug — say so here rather than pretending otherwise.
+
+- **Observed:** …
+- **Expected:** …
+- **Repro:** 1. … 2. … 3. …
+- **Since / trigger:** <version, commit, or "unknown">
+
+## 2. Impact
+
+> Who is affected, how often, and whether there is a workaround. This is what justifies the patch
+> jumping the feature queue — one or two lines.
+
+## 3. Cause
+
+> Confirmed or hypothesis — label which. Name the `file:line` if you have it. If the cause is
+> unknown at freeze, say so: the implementer's first job is then to find it, and the review will
+> check that the stated cause matches the diff.
+
+## 4. Regression test (red first)
+
+> The heart of a patch spec — it replaces §5 CONTRACT as the thing the diff is checked against.
+> Name the test file and what it asserts. It must fail on the current code and pass after the fix.
+
+- **Test:** `<path/to/test>` · asserts: …
+- **Fails today because:** …
+
+## 5. Contract delta
+
+> Usually `none`. A fix that *changes* an existing contract entry describes the change here and
+> `/cohorte-build` propagates it to every surface that names it. A fix that needs **new** contract
+> surface area is not a patch — stop and run `/cohorte-spec` instead.
+
+`none`
+
+## 6. Surface tasks
+
+> One `###` subsection per surface the fix touches — a patch may legitimately span several (an
+> unvalidated field on the API *and* the form that sends it). Each TDD: the §4 test first.
+
+### <surface.key>
+
+- …
+
+## 7. Out of scope
+
+> The adjacent things this patch deliberately does NOT fix. This is the section that keeps a bug fix
+> from turning into a refactor — the reviewer reads it before flagging what you left alone. Real but
+> out-of-scope findings belong in `specs/refactor-backlog.md`, not in this diff.
+
+- …
+
+## 9. Acceptance criteria / DoD
+
+> §9, not §8 — the number is load-bearing, so don't renumber it. `review.md` and
+> `implementer.template.md` both name "contract §5, acceptance §9" verbatim, so a patch spec pins
+> those two sections to the feature spec's numbers and just has no §8 (the feature spec has no §7 —
+> a gap in the sequence is normal here).
+
+- [ ] The §4 regression test exists, and failed before the fix
+- [ ] Each touched surface's tests (TDD) green
+- [ ] `PIPELINE.md` commands.lint · typecheck · test green
+- [ ] The repro in §1 no longer reproduces
+- [ ] Nothing outside §6's surfaces changed
+
+## Remediation
+
+> Filled by `/cohorte-fix` from a REVIEW REPORT; empty otherwise. Each item:
+> `[ ] <SEVERITY> · <file:line> · <spec-violation|quality|security> · <concrete fix>`

package/core/templates/steps/init-pipeline/02-interview-gaps.md

@@ -53,13 +53,3 @@ Prefer sensible defaults from Phase 1 as the first (Recommended) option in each
 > The **kanban** link is user-scoped (it points at a personal vault, so it never goes in the committed
 > `PIPELINE.md`), but IS wired here because it is per-project — see Phase 4.
 
-- **Telemetry** (optional, machine-scoped — SKIP entirely if `<config>` already
-  has a `telemetry:` block with a `consent_date`, i.e. the human already answered on this machine).
-  Ask ONE opt-in question, stating exactly: _"Share anonymous usage stats with the cohorte project?
-  One ping per pipeline phase, `/cohorte-brainstorm` through `/cohorte-ship`: core version, OS, phase name, duration,
-  per-surface result counts, and a hash of the feature id — never repo names, paths, code, or IPs.
-  Setup and maintenance commands never ping. Off by default; withdraw anytime
-  (`telemetry.enabled: false`); erase your history anytime (SCHEMA.md §Telemetry). Default: No."_
-  On **yes**: in the global config set `telemetry.enabled: true`, mint `install_id` (`uuidgen`,
-  lowercase), set `consent_date` (ISO date). On **no**: set `enabled: false` + `consent_date` (so
-  no future command re-asks). Never touch `endpoint` — it ships with the template.

package/core/templates/steps/init-pipeline/04-write-render.md

@@ -27,8 +27,8 @@
    per-surface `test_cmd`/`lint_cmd`/`typecheck_cmd`/`build_cmd` **and their `*_quiet_cmd`
    variants** and repo-wide `commands.*` equivalents as `Bash(<cmd>:*)` rules, plus read-only git —
    `Bash(git status:*)`, `Bash(git diff:*)`, `Bash(git log:*)`, `Bash(git rev-parse:*)` — plus the
-   shipped pipeline scripts (`Bash(<core>/pipeline/scripts/:*)` — preflight, kanban-move,
-   telemetry-send; a prefix rule matches a command *starting* with that path, so a `bash <path>`
+   shipped pipeline scripts (`Bash(<core>/pipeline/scripts/:*)` — preflight, kanban-move;
+   a prefix rule matches a command *starting* with that path, so a `bash <path>`
    invocation would need its own entry), and the
    retrieval provider's MCP tools when wired (e.g. `mcp__serena`). Never allowlist anything matching
    a `gate.ask`/`gate.deny` pattern. Mention the human can widen it later with

package/core/workflows/review.js

@@ -125,7 +125,7 @@ const FINDING = {
   properties: {
     severity: { enum: ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW'] },
     file: { type: 'string' }, line: { type: 'integer' },
-    kind: { enum: ['spec-violation', 'quality', 'security'] },
+    kind: { enum: ['spec-violation', 'quality', 'security', 'complexity'] },
     problem: { type: 'string', description: 'one line, no code excerpts' },
     fix: { type: 'string', description: 'one concrete change, one line' },
   },
@@ -141,7 +141,7 @@ const DEFERRED = {
   properties: {
     severity: { enum: ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW'] },
     file: { type: 'string' }, line: { type: 'integer' },
-    kind: { enum: ['quality', 'security', 'rule'] },
+    kind: { enum: ['quality', 'security', 'rule', 'complexity'] },
     problem: { type: 'string', description: 'one line, no code excerpts' },
     fix: { type: 'string', description: 'one concrete change, one line' },
     outOfScope: { type: 'string', description: 'one line: why this feature does not own it' },
@@ -323,12 +323,10 @@ const staging = await agent(
   `1. Write EXACTLY this content to specs/reports/${feature}.md (overwrite):\n<<<REPORT\n${reportBody}\nREPORT\n` +
   `2. Append one line to $(dirname "$(git rev-parse --git-common-dir)")/.claude/pipeline-metrics.jsonl: ` +
   `{"ts":"<ISO now>","feature":"${feature}","phase":"review","seconds":0,"surfaces":{${results.map(r => `"${r.key}":"${verdict}:${r.kept.length}"`).join(',')}}}\n` +
-  `3. Chain the opt-in usage ping: <core>/pipeline/scripts/telemetry-send.sh review "${feature}" 0 "${verdict}:${kept.length}" || true ` +
-  '(<core> = .claude if .claude/pipeline/scripts/telemetry-send.sh exists, else ~/.claude; script on neither ⇒ skip the ping).\n' +
   // Deferred findings must land in the backlog on EVERY verdict — parked only on a
   // SHIP is parked nowhere the rest of the time, which is the leak this closes.
   (deferredAll.length
-    ? `3b. Route the deferred findings to specs/refactor-backlog.md (create it if absent): for each line below, ` +
+    ? `3. Route the deferred findings to specs/refactor-backlog.md (create it if absent): for each line below, ` +
       `append it under the \`## <domain>\` heading named in its prefix (create that heading if absent) — with \`>>\`, ` +
       `never by rewriting the file, and skip any whose file path + first words already appear there (grep -F first, ` +
       `they may be left from a prior round or an /cohorte-audit):\n` +

package/install.ps1

@@ -172,8 +172,10 @@ cohorte needs Node >= 18 to install.
         Copy-Item (Join-Path $src 'profile\cohorte.config.template.yaml') (Join-Path $dest 'pipeline') -Force
         Copy-Item (Join-Path $src 'scripts\*.template')           (Join-Path $dest 'pipeline\scripts') -Force
         Copy-Item (Join-Path $src 'scripts\kanban-move.sh')       (Join-Path $dest 'pipeline\scripts') -Force
-        Copy-Item (Join-Path $src 'scripts\telemetry-send.sh')    (Join-Path $dest 'pipeline\scripts') -Force
         Copy-Item (Join-Path $src 'scripts\preflight.sh')         (Join-Path $dest 'pipeline\scripts') -Force
+        # 2.3.0 removed telemetry; copy-over never deletes, so scrub the sender from existing
+        # installs. The dead `telemetry:` config block is deleted by /cohorte-update-pipeline.
+        Remove-Item (Join-Path $dest 'pipeline\scripts\telemetry-send.sh') -Force -ErrorAction SilentlyContinue
         Copy-Item (Join-Path $src 'core\agents\implementer.template.md') (Join-Path $dest 'pipeline') -Force
         if (Test-Path (Join-Path $src 'CHANGELOG.md')) { Copy-Item (Join-Path $src 'CHANGELOG.md') (Join-Path $dest 'pipeline') -Force }
         [System.IO.File]::WriteAllText((Join-Path $dest 'pipeline\VERSION'), "$ver`n", [System.Text.UTF8Encoding]::new($false))

package/install.sh

@@ -126,10 +126,14 @@ copy_core() {
   cp "$src/profile/cohorte.config.template.yaml" "$dest/pipeline/"
   cp "$src"/scripts/*.template           "$dest/pipeline/scripts/"
   cp "$src/scripts/kanban-move.sh"       "$dest/pipeline/scripts/"
-  cp "$src/scripts/telemetry-send.sh"    "$dest/pipeline/scripts/"
   cp "$src/scripts/preflight.sh"         "$dest/pipeline/scripts/"
-  chmod +x "$dest/pipeline/scripts/kanban-move.sh" "$dest/pipeline/scripts/telemetry-send.sh" \
+  chmod +x "$dest/pipeline/scripts/kanban-move.sh" \
            "$dest/pipeline/scripts/preflight.sh" 2>/dev/null || true
+  # 2.3.0 removed telemetry. Copy-over never deletes, so an existing install would keep an
+  # executable that still POSTs to the collector — scrub the script itself. The dead
+  # `telemetry:` block in the user's config is not this installer's to parse; the interactive
+  # /cohorte-update-pipeline deletes it (SCHEMA.md §Reconcile step 5).
+  rm -f "$dest/pipeline/scripts/telemetry-send.sh"
   cp "$src/core/agents/implementer.template.md" "$dest/pipeline/"
   [ -f "$src/CHANGELOG.md" ] && cp "$src/CHANGELOG.md" "$dest/pipeline/"
   printf '%s\n' "$ver" > "$dest/pipeline/VERSION"

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "cohorte",
-  "version": "2.2.0",
-  "description": "Portable, stack-agnostic multi-agent development pipeline for Claude Code, Codex CLI, Cursor, Gemini CLI and OpenCode \u2014 install the core, run /cohorte-init-pipeline, and it adapts to your project's stack.",
+  "version": "2.4.0",
+  "description": "Portable, stack-agnostic multi-agent development pipeline for Claude Code, Codex CLI, Cursor, Gemini CLI and OpenCode — install the core, run /cohorte-init-pipeline, and it adapts to your project's stack.",
   "bin": {
     "cohorte": "bin/cli.js"
   },

package/profile/PIPELINE.template.md

@@ -25,6 +25,7 @@ vcs:
   remote: <owner/repo>                        # e.g. acme/webapp
   default_branch: <main>
   feature_branch_prefix: feature/            # branch = <prefix><feature_id>
+  patch_branch_prefix: fix/                  # same, for /cohorte-patch specs (kind: patch)
 
 # ── repo shape ──────────────────────────────────────────────────────────────
 repo:

package/profile/SCHEMA.md

@@ -16,6 +16,7 @@ generic pipeline uses it, so a stateless agent can read/regenerate the profile c
 | `vcs.remote`                         | string       | release                           | `owner/repo` for the PR/compare URL.                          |
 | `vcs.default_branch`                 | string       | build, review, release            | Base branch for diffs + PRs.                                  |
 | `vcs.feature_branch_prefix`          | string       | ship, isolation script            | `feature/` → branch `feature/<id>`.                           |
+| `vcs.patch_branch_prefix`            | string       | ship                              | Same, for a `kind: patch` spec: `fix/` → branch `fix/patch-<slug>`. Optional — a profile that predates it falls back to `fix/`. |
 | `repo.layout`                        | enum         | build, audit                      | `monorepo` (many surfaces) or `single`.                       |
 | `repo.workspace_tool`                | enum         | audit                             | `turborepo`/`nx`/`none`.                                      |
 | `retrieval.provider`                 | enum         | init, update-pipeline, implementer | `serena` (default) / `graphify` / `none` — see §Code retrieval. |
@@ -190,11 +191,6 @@ to log it. For what's EXPENSIVE, use Claude Code's own accounting:
   over the last 24 h / 7 d (e.g. _"Top subagents: frontend 7 %, backend 4 % · Top skills: /cohorte-build 1 %,
   /cohorte-review 1 %"_). That IS the per-phase ledger — approximate (share-of-total, machine-local, not exact
   tokens). Read it to see which surface/command actually dominates the bill before you tune a `model` tier.
-- **OpenTelemetry** (exact numbers + dashboards) — add an `env` block to `this runtime's settings file`:
-  `{"env":{"CLAUDE_CODE_ENABLE_TELEMETRY":"1","OTEL_METRICS_EXPORTER":"otlp","OTEL_EXPORTER_OTLP_PROTOCOL":"http/protobuf","OTEL_EXPORTER_OTLP_ENDPOINT":"http://localhost:4318"}}`
-  and point it at a collector. Metrics `claude_code.token.usage` + `claude_code.cost.usage` carry
-  `session.id` + model + type (input/output/cacheRead). Subagent tokens roll into the session total;
-  per-subagent attribution needs traces (`CLAUDE_CODE_ENHANCED_TELEMETRY_BETA=1`, beta).
 
 **Lead context discipline — the silent bill.** The lead session's conversation history is re-sent as
 input on EVERY turn; a session that spans spec→build→review→fix without clearing re-pays the
@@ -246,6 +242,25 @@ built-in autonomous driver (`/cohorte-loop`) was retired in 2.2.0, and the human
 them, and because anything automating the cycle from outside needs somewhere to record "a round is
 under way" and "a round gave up". Every reader still routes on them; nothing produces them.
 
+**`kind` — feature (default) or `patch`.** Orthogonal to `status`, and the only other front-matter
+field commands route on. `/cohorte-patch` freezes `specs/patch-<slug>.md` with `kind: patch` from
+`templates/patch.template.md`: a ~60-line bug spec whose §4 **regression test** replaces §5 CONTRACT
+as the thing the diff is checked against. It moves through the same states and the same commands —
+`/cohorte-build` → `/cohorte-review` → `/cohorte-fix`* → `/cohorte-ship` — which is the whole design:
+a patch is a spec, so nothing downstream is special-cased beyond three lines.
+
+| what reads `kind: patch` | what it does differently |
+| --- | --- |
+| `/cohorte-build` §1.6 | judges §1 repro + §4 regression test instead of contract completeness; gap check `repro` |
+| `/cohorte-build` §2 | authors no contract when §5 Contract delta is `none` (the usual case) |
+| `/cohorte-ship` §1/§2b/§3 | branches off `vcs.patch_branch_prefix`; a `patch` bump by default; `fix(<scope>)` commit |
+
+A patch may span **several surfaces** — one bug, one repro, one spec. What it may never do is add
+**new** contract surface area: two surfaces agreeing on a shape that doesn't exist yet is what §5 is
+for, so `/cohorte-patch` routes that to `/cohorte-spec` instead. Changing an *existing* contract entry
+is a legitimate delta. The patch template keeps contract on **§5** and acceptance on **§9** — the two
+numbers `review.md` and `implementer.template.md` name verbatim — and simply has no §8.
+
 Corollaries worth knowing:
 
 - A spec with no front-matter makes every stamp a **silent no-op** — the state is bookkeeping, and the
@@ -477,7 +492,13 @@ files automatically. It works because every generated artifact is a **determinis
    rots (PATH changes, uninstalls, hand-edits) — and repair whatever fails.
 5. **Global config seed.** If `<config>` is absent, seed it from the template
    (`profile/cohorte.config.template.yaml`) so the kanban + shared-vault config has a home. Never
-   clobber an existing filled file; report what was seeded.
+   clobber an existing filled file; report what was seeded. Then **scrub the retired `telemetry:`
+   block** if the file still carries one (every install seeded before 2.3.0 does): delete the block
+   and its comment header, leaving the rest byte-identical. It is dead config — the sender is gone
+   and nothing reads it — but a `telemetry.enabled: true` sitting in a file the human may open reads
+   as "this is still sending", which is the one thing it must not imply. This is the single
+   exception to "never rewrite the config": a targeted deletion of a block the core no longer
+   defines, never a re-seed.
 6. **Kanban sync.** Run the §Kanban reconcile: link/create the project's board if configured, verify
    its columns, and backfill/sync cards from `specs/*.md`. See §Kanban.
 7. **Spec-template top-up.** `specs/_template.md` is seeded once at install and then **never**
@@ -621,6 +642,7 @@ Ideas — so `/cohorte-brainstorm` appends the tag to the picked line before its
 | `/cohorte-brainstorm` picks it up               | `brainstorm`    |
 | `/cohorte-spec` opens (draft)                   | `spec`          |
 | `/cohorte-spec` freezes (`status: frozen`)      | `ready`         |
+| `/cohorte-patch` triages / freezes              | `spec` → `ready` (card titled `[patch] <title>`, tag `#patch-<slug>`) |
 | `/cohorte-build`                                | `building`      |
 | `/cohorte-review`                               | `review`        |
 | `/cohorte-fix`                                  | `fix`           |
@@ -642,60 +664,3 @@ added vs. moved vs. already-correct.
 per configured column in pipeline order, and the closing `%% kanban:settings %%` block
 (`{"kanban-plugin":"board","list-collapse":[false,…]}` with one `false` per column).
 
-## Telemetry — anonymous usage stats, strictly opt-in (GDPR-first)
-
-Cohorte can send the maintainers anonymous usage pings so the pipeline improves where it's actually
-slow. **Nothing is ever sent without explicit consent**: `/cohorte-init-pipeline` (and `/cohorte-update-pipeline` on
-pre-telemetry installs) ask ONE question, once per machine, default **No**, and record the answer in
-`<config>` §`telemetry` (`enabled`, `install_id`, `consent_date`). The sender —
-`pipeline/scripts/telemetry-send.sh` — is a silent no-op unless `enabled: true` AND `install_id` AND
-`endpoint` are all set, times out at 2s, and never fails the pipeline. Callers chain it with
-`|| true`, so a **missing** script is equally silent: `/cohorte-doctor` check 1 verifies `pipeline/scripts/`
-is fully populated.
-
-**Which commands ping** — the six that make up the feature funnel, and only those. The point is to
-see where features stall, so every stage of `idea → PR` reports and nothing else does:
-
-| phase | fired when | `seconds` | `results` |
-| --- | --- | --- | --- |
-| `brainstorm` | the return is staged | `0` | — |
-| `spec` | a freeze lands (Mode A only) | `0` | `frozen` |
-| `build` | after the batch metrics line | wall-clock | `ok,ok` / `error` |
-| `review` | after the merged verdict | wall-clock | `<verdict>:<count>` |
-| `fix` | after the batch metrics line | wall-clock | `<fixed>/<found>` |
-| `ship` | the release agent succeeded | `0` | `pr` / `compare` |
-
-> Workflow-variant runs (`review.js`) report `seconds: 0` for their phases — only the
-> conversational commands measure wall-clock. `results` is a free-text summary field, so both
-> forms are valid — but read the `fix` column knowing which path produced it.
-
-`seconds: 0` marks a phase whose duration is human thinking time, not pipeline wall-clock — the
-funnel signal there is the event, not how long it took. `/cohorte-doctor`, `/cohorte-audit`, `/cohorte-refactor`,
-`/cohorte-align-ds`, `/cohorte-init-pipeline` and `/cohorte-update-pipeline` **never** ping: they sit outside the funnel, and
-keeping them out is what holds the collected set to what the consent text describes.
-
-**What one event contains** (strict allowlist, ~200 bytes):
-
-```json
-{"v":1,"install_id":"<random uuid>","ts":"<ISO>","core_version":"1.2.0","os":"Darwin",
- "event":"phase","phase":"build","feature_hash":"<sha256[..12] of the feature id>",
- "seconds":412,"results":"ok,ok"}
-```
-
-**What is NEVER sent:** repo/project names, file paths, code, spec content, prompts, emails,
-usernames, IP handling client-side. The feature id is hashed (12 hex chars) so cross-feature counts
-work without revealing what is being built.
-
-**GDPR rights, concretely:**
-
-- **Consent** — opt-in only, recorded with a date; "No" is also recorded so nothing re-asks.
-- **Withdrawal** — set `telemetry.enabled: false` in `<config>`; effective on
-  the next phase, no restart.
-- **Erasure** — `/cohorte-doctor` prints your `install_id`; send
-  `curl -X DELETE <endpoint-origin>/v1/install/<install_id>` and the collector drops every event
-  for that id (the deployed collector implements this and stores no IPs).
-- **Access/portability** — events are keyed by your `install_id`; ask the operator for an export.
-
-**Collector contract** (any implementation must honor it):
-`POST /v1/events` (one JSON event, allowlisted fields) · `DELETE /v1/install/<id>` (erasure) ·
-`GET /healthz`. Operators must not retain IP-bearing access logs for the ingest vhost.

package/profile/cohorte.config.template.yaml

@@ -10,22 +10,6 @@
 
 enabled: true                 # cfg:enabled — master switch; false disables every capability below
 
-# ── telemetry (anonymous usage stats — OPT-IN, GDPR-first) ──────────────────
-# Strictly opt-in: nothing is ever sent unless YOU said yes to the consent question
-# (/cohorte-init-pipeline or /cohorte-update-pipeline ask once per machine; they record your answer here).
-# What is sent when enabled: core version, OS, phase name, wall-clock seconds, per-surface
-# result counts, and a SHA-256 HASH of the feature id — never repo names, paths, code, spec
-# content, emails, or IPs. One ping per pipeline phase, /cohorte-brainstorm through /cohorte-ship; setup and
-# maintenance commands (/cohorte-doctor, /cohorte-init-pipeline, /cohorte-update-pipeline, /cohorte-audit, /cohorte-refactor,
-# /cohorte-align-ds) never ping. Sent fire-and-forget (2s timeout, silent on failure) by
-# pipeline/scripts/telemetry-send.sh. Withdraw anytime: set enabled: false. Erase your history:
-# see SCHEMA.md §Telemetry (DELETE by install_id).
-telemetry:
-  enabled: false              # cfg:telemetry_enabled — true ONLY via explicit consent
-  install_id: ""              # cfg:telemetry_install_id — random UUID minted at consent; the erasure key
-  consent_date: ""            # cfg:telemetry_consent_date — ISO date the human said yes
-  endpoint: "https://telemetry.cohorte.thebidouille.fr/v1/events"  # cfg:telemetry_endpoint — collector URL; empty = off even if enabled
-
 # ── obsidian ──────────────────────────────────────────────────────────────────
 # Local vault used by the kanban mirror — defined here ONCE so no capability ever duplicates
 # the path. Absolute path to the folder you open in Obsidian.

package/scripts/validate-core.mjs

@@ -25,7 +25,7 @@ const frontmatter = (text) => {
 const PINNED = ["cohorte-build", "cohorte-review", "cohorte-fix", "cohorte-ship",
   "cohorte-audit", "cohorte-refactor", "cohorte-doctor", "cohorte-align-ds",
   "cohorte-update-pipeline"];
-const UNPINNED = ["cohorte-brainstorm", "cohorte-spec", "cohorte-init-pipeline"];
+const UNPINNED = ["cohorte-brainstorm", "cohorte-spec", "cohorte-init-pipeline", "cohorte-patch"];
 
 // Every command must carry the `cohorte-` prefix. This replaces the old RESERVED
 // blocklist, which chased collisions one name at a time and always lagged: a command
@@ -129,26 +129,28 @@ const steps = join(root, "core/templates/steps/init-pipeline");
 if (!existsSync(steps) || readdirSync(steps).length === 0)
   fail("core/templates/steps/init-pipeline", "router step files missing/empty");
 
-// ── telemetry coverage ──────────────────────────────────────────────────────
-// The funnel is only readable if every one of its stages pings — a single missing
-// one silently truncates it (that is how /cohorte-review and /cohorte-fix went unreported
-// until 1.2.3). The phase list here must match SCHEMA.md §Telemetry's table.
-// These are telemetry PHASE names, not command names — they stay unprefixed even though
-// the commands that emit them are now `/cohorte-*`. The phase is a wire field allowlisted
-// in telemetry-send.sh and keyed on by the collector's existing dataset; prefixing it would
-// orphan every ping ever sent. Command file = PREFIX + phase.
-const FUNNEL = ["brainstorm", "spec", "build", "review", "fix", "ship"];
-for (const c of FUNNEL)
-  if (!/usage ping/i.test(read(`core/commands/${PREFIX}${c}.md`)))
-    fail(`core/commands/${PREFIX}${c}.md`, "funnel command with no usage ping — breaks the telemetry funnel");
-// …and nothing outside the funnel may ping (consent text scopes it to the funnel).
-for (const f of readdirSync(join(root, "core/commands"))) {
-  const c = f.replace(/\.md$/, "").replace(new RegExp(`^${PREFIX}`), "");
-  // `telemetry-send.sh` + an argument = a call site; the bare filename (e.g. /cohorte-doctor
-  // listing the scripts it checks for) is a mention, not a ping.
-  if (!FUNNEL.includes(c) && /telemetry-send\.sh +\S|usage ping/i.test(read(`core/commands/${f}`)))
-    fail(`core/commands/${f}`, "non-funnel command pings telemetry — outside the consented scope");
-}
+// ── no telemetry ────────────────────────────────────────────────────────────
+// Telemetry was removed wholesale in 2.3.0: the shipped `telemetry-send.sh`, the
+// per-phase pings, the consent question, the `telemetry:` config block, the collector
+// endpoint. This check is the ratchet — it fails if any of it creeps back into the
+// core, which is easy to do by copying an old command file that still chains a ping.
+// Deliberately broad: the whole point is that there is nothing left to send with.
+const NO_TELEMETRY = /telemetry|usage ping/i;
+// One exemption, and it is the opposite of a regression: /cohorte-update-pipeline is what
+// DELETES the leftover `telemetry:` block from configs seeded before 2.3.0, so it is the one
+// file that must still name the thing. Narrow on purpose — a filename, not a pattern.
+const TELEMETRY_SCRUBBER = "core/commands/cohorte-update-pipeline.md";
+const walk = (dir) => readdirSync(join(root, dir), { withFileTypes: true }).flatMap((e) =>
+  e.isDirectory() ? walk(`${dir}/${e.name}`) : [`${dir}/${e.name}`]);
+for (const dir of ["core/commands", "core/agents", "core/templates", "core/workflows"])
+  for (const rel of walk(dir)) {
+    if (!/\.(md|js)$/.test(rel) || rel === TELEMETRY_SCRUBBER) continue;
+    if (NO_TELEMETRY.test(read(rel)))
+      fail(rel, "mentions telemetry — it was removed in 2.3.0; nothing may ping or ask for consent");
+  }
+// …and the exempt file may only REMOVE it: naming a send/ping/consent path there is still a bug.
+if (/usage ping|telemetry-send|consent/i.test(read(TELEMETRY_SCRUBBER)))
+  fail(TELEMETRY_SCRUBBER, "may reference the retired telemetry block only to delete it — no ping, sender or consent flow");
 
 // ── kanban call sites ───────────────────────────────────────────────────────
 // Every pipeline stage moves a card, and a stage that only *describes* the move
@@ -158,7 +160,7 @@ for (const f of readdirSync(join(root, "core/commands"))) {
 // having opened neither the config nor PIPELINE.md, and a merged feature's card
 // stayed in "Ready to build". `kanban-move.sh auto` moved resolution into the
 // script; this keeps it there. Prose is not a call site — the literal invocation is.
-const KANBAN_STAGES = ["brainstorm", "spec", "build", "review", "fix", "ship"];
+const KANBAN_STAGES = ["brainstorm", "spec", "build", "review", "fix", "ship", "patch"];
 for (const c of KANBAN_STAGES) {
   const path = `core/commands/${PREFIX}${c}.md`;
   const text = read(path);
@@ -174,7 +176,7 @@ for (const c of KANBAN_STAGES) {
 // ── shipped scripts ─────────────────────────────────────────────────────────
 // Every scripts/*.sh must be copied by BOTH shell installers. Callers chain these
 // with `|| true`, so one an installer forgets is a silent no-op forever — no kanban
-// card moves, no telemetry ping, no error. CI is the only place this is loud.
+// card moves, no error. CI is the only place this is loud.
 // The third installer, bin/cli.js (what `npx cohorte` runs), copies by rule rather
 // than by name, so grepping for filenames can't see it — ci.yml dry-runs it into a
 // scratch HOME and asserts the same postconditions instead. Both are needed: this

package/scripts/telemetry-send.sh

@@ -1,84 +0,0 @@
-#!/bin/sh
-# telemetry-send.sh — fire-and-forget anonymous usage ping (SCHEMA.md §Telemetry).
-#
-#   telemetry-send.sh <phase> <feature_id> <seconds> [results]
-#     phase    brainstorm|spec|build|review|fix|ship — the feature funnel, and only it.
-#              Setup/maintenance commands never ping (SCHEMA.md §Telemetry).
-#     feature  the feature id — NEVER sent raw; SHA-256-hashed to 12 hex chars
-#     seconds  batch wall-clock
-#     results  optional compact summary, e.g. "ok,ok" or "REVISE:3"
-#
-# GDPR posture (documented in SCHEMA.md §Telemetry):
-#   - STRICTLY opt-in: exits silently unless ~/.claude/cohorte.config.yaml has
-#     telemetry.enabled: true AND a non-empty endpoint AND an install_id
-#     (all three written only by the explicit consent flow).
-#   - Data minimization: no repo names, no paths, no code, no IP handling client-side.
-#   - Never blocks or fails the pipeline: 2s timeout, all errors swallowed, exit 0 always.
-set -u
-
-# Same two-location probe as kanban-move.sh: consent is recorded once per human, in
-# whichever config the runtime that installed the pipeline created.
-cfg=""
-for c in "${CLAUDE_CONFIG_DIR:-$HOME/.claude}/cohorte.config.yaml" \
-         "$HOME/.cohorte/cohorte.config.yaml"; do
-  [ -f "$c" ] && { cfg="$c"; break; }
-done
-[ -n "$cfg" ] || exit 0
-
-# read keys scoped to the `telemetry:` block only
-tval() {
-  awk -v key="$1" '
-    /^telemetry:/       { in_t=1; next }
-    /^[a-zA-Z]/         { in_t=0 }
-    in_t && $1 == key":" {
-      v=$2; gsub(/^"|"$|#.*/,"",v); gsub(/"/,"",v); print v; exit
-    }' "$cfg"
-}
-
-[ "$(tval enabled)" = "true" ] || exit 0
-endpoint="$(tval endpoint)";   [ -n "$endpoint" ]   || exit 0
-install_id="$(tval install_id)"; [ -n "$install_id" ] || exit 0
-
-phase="${1:-}"; feature="${2:-}"; seconds="${3:-0}"; results="${4:-}"
-[ -n "$phase" ] || exit 0
-
-# Allowlist the phase here — the collector accepts any string, so a typo in a command
-# file would silently pollute the dataset with a phantom phase nobody notices.
-case "$phase" in
-  brainstorm|spec|build|review|fix|ship) ;;
-  # `smoke` is a RETIRED phase (removed in 1.5.0) — still accepted so a stale install
-  # pinging it lands in its own bucket instead of being silently dropped.
-  smoke) ;;
-  *) exit 0 ;;
-esac
-
-# The payload is hand-built JSON: a non-numeric seconds or a quote in results
-# would silently produce an invalid document the collector drops.
-case "$seconds" in ''|*[!0-9]*) seconds=0 ;; esac
-results=$(printf '%s' "$results" | tr -d '"\\\n\r' | cut -c1-80)
-
-if command -v shasum >/dev/null 2>&1; then
-  fhash=$(printf '%s' "$feature" | shasum -a 256 | cut -c1-12)
-else
-  fhash=$(printf '%s' "$feature" | sha256sum | cut -c1-12)
-fi
-# The core that shipped THIS script is the one whose version we report. Bundled
-# installs live at <project>/.claude/pipeline/scripts/, where the global VERSION is
-# either absent or a DIFFERENT core — reading only the global path made every
-# bundled repo report an empty core_version.
-here=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd 2>/dev/null) || here=""
-ver=""
-for v in "$here/../VERSION" "${CLAUDE_CONFIG_DIR:-$HOME/.claude}/pipeline/VERSION" \
-         "$HOME/.cohorte/pipeline/VERSION"; do
-  [ -n "$ver" ] && break
-  ver=$(head -1 "$v" 2>/dev/null | tr -d '"\\')
-done
-os=$(uname -s 2>/dev/null || echo unknown)
-ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)
-
-payload=$(printf '{"v":1,"install_id":"%s","ts":"%s","core_version":"%s","os":"%s","event":"phase","phase":"%s","feature_hash":"%s","seconds":%s,"results":"%s"}' \
-  "$install_id" "$ts" "$ver" "$os" "$phase" "$fhash" "${seconds:-0}" "$results")
-
-curl -s -m 2 -X POST -H 'content-type: application/json' \
-  -d "$payload" "$endpoint" >/dev/null 2>&1 || true
-exit 0