cohorte 2.6.0 → 2.8.0

package/CHANGELOG.md

@@ -7,6 +7,116 @@ short, user-facing, most recent first. One `## <version> — <YYYY-MM-DD>` secti
 > They are history and are deliberately not rewritten — every command gained a `cohorte-` prefix
 > in 2.0.0.
 
+## 2.8.0 — 2026-08-22
+
+- **`/cohorte-loop` is back — as a workflow, which is the whole point.** The 2.2.0 driver was
+  retired because it spawned headless child processes it could not supervise: it stalled on a
+  permission prompt it could not see, read a missing `build.json` as an empty one, and had a
+  session killed mid-write with nothing noticing. `core/workflows/loop.js` runs
+  build → review → [fix → review]* for one feature inside the Workflow runtime instead — the
+  runtime holds control flow, a dead agent resolves to `null` rather than to silence, and there
+  is no prompt to stall on.
+
+  What it will not do is as designed as what it does: it *verifies* `/cohorte-build`'s outputs
+  (frozen spec, fresh `readiness.json`, the lead-authored contract) as preconditions and aborts —
+  naming the gap — on anything that is a human's call: a `NOT-READY` spec, a surface the profile
+  doesn't own, a blocking finding on the contract file itself. A dead reviewer's zero findings
+  can never read as ship (`unreviewed` is checked before `blocking`, in that order on purpose);
+  identical blocking findings two rounds running abort as treading water instead of burning the
+  remaining rounds; `maxRounds` (default 5) is the last net, never the first. State is four files
+  in `specs/reports/` — re-invoking resumes, and every file older than the spec is treated as
+  absent. There is **no** `core/commands/cohorte-loop.md` and `validate-core.mjs` now fails if
+  one appears: without the Workflow runtime the loop refuses explicitly rather than degrading to
+  a lead re-reasoning the fan-out every round at session prices. It stamps `in-progress` /
+  `in-review` / `blocked` on the spec — the driver states SCHEMA.md kept alive since 2.2.0 have
+  a producer again.
+
+  To serve it, the review workflow now writes the same `specs/reports/<id>.verdict.json` the
+  conversational `/cohorte-review` §3 guarantees (blocking count, normalized `blocking_items`,
+  sha256 fingerprint, the degraded `aborted: "preflight"` form) — one machine contract, two
+  producers.
+
+- **A deny behind an ask was reachable with one click.** `gate.py` scanned command segments in
+  order and returned on the first match, so `git commit -m x && node ace migration:fresh`
+  surfaced only the benign `git commit` confirm — and the human's single "yes" ran the
+  hard-denied migration behind it. Deny patterns are now matched across the whole chain before
+  any ask is offered. Global installs pick this up with `cohorte update`; bundled repos via
+  `/cohorte-update-pipeline`.
+
+- **The SHIP stamp is now earned, not implied.** The conversational `/cohorte-review` ticked the
+  DoD and wrote the freshness stamp on every SHIP — including one carrying HIGH findings, which
+  `/cohorte-ship`'s gates then happily certified, while the workflow variant refused the same
+  state. Both paths now agree: tick + stamp only when nothing above LOW survived; surviving
+  HIGH/MEDIUM routes to `/cohorte-fix` (or an explicit park) first.
+
+- **A dozen bugs the release audit surfaced**, the sharper ones being: `cohorte install` seeded
+  `cohorte.config.yaml` under `~/.claude` even when `CLAUDE_CONFIG_DIR` pointed elsewhere — a
+  config no reader ever probed (CI now asserts the seed lands where the readers look);
+  the refactor workflow's retry round discarded the items its first verify had already cleared,
+  so the backlog re-dispatched finished work — and invoked with a bare `"backend"` it silently
+  refactored *every* big domain; the dashboard trusted the absolute paths in a committed
+  `runtimes.json`, going all-red on any cloned or moved checkout; `preflight.sh` fed a UTC
+  timestamp to a local-time `touch -t`, future-dating the throwaway index west of UTC (and an
+  all-empty command list stamped a green preflight that had verified nothing);
+  `new-feature.sh` branched worktrees off the *local* default branch its own fetch never
+  updated; a CRLF kanban board failed with "column not found" on a column that exists; and a
+  dead mechanical-gates agent read as "0 failures" in the audit workflow. Plus a sweep of doc
+  drift (the first-feature walkthrough skipped build *and* review; "Node-less" installers that
+  require Node; stale counts of agents, scripts and board columns).
+
+- **The shell installers are now the thin delegators they already were.** Since 2.2.0 both
+  scripts handed everything to `bin/cli.js` and then carried ~300 lines of unreachable legacy
+  copy code below the hand-off — dead text that `validate-core`'s "does the installer copy X"
+  checks were vacuously matching, which is worse than no check: it reads as coverage. The dead
+  code is gone; the checks now assert CI's install dry-run postconditions — tests against the
+  copy that actually runs. Along the way: `sh install.sh` from inside a checkout silently
+  *cloned the remote* instead of installing the local tree (`$0` arrives with no slash and the
+  self-locate case missed it); both installers now refuse a Node older than 18 up front instead
+  of half-installing before `fs.cpSync` crashes; and the review agent's `tools:` names both
+  retrieval providers (`mcp__serena`, `mcp__graphify`) — one fixed agent file, shared across
+  projects, only the wired provider is live in a session, and graphify projects' reviewers were
+  silently cut off from their own index.
+
+
+## 2.7.0 — 2026-08-22
+
+- **The metrics panel billed Sonnet 5 fifty percent over.** `prices.json` carried $3/$15 because
+  that was the rate scheduled to take effect on 2026-09-01. It never will: Anthropic made the
+  $2/$10 introductory rate the standard one. Every run costed since the entry was written reads
+  high, and the further back a run is, the more confidently wrong the number looks.
+
+  Sonnet 5 is now $2/$10, and the file says in prose why the increase must not be reinstated —
+  the next person to "correct" this back will at least have to argue with a comment first. Sonnet
+  4.6 and earlier stay at $3/$15: same tier, different price, and the longest-prefix lookup keeps
+  them apart on its own.
+
+- **A concurrency ceiling that moved while the comments stood still.** `audit.js` described the
+  runtime as capping concurrent agents at "~16". It is 20, it is named
+  (`CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS`), and raising it raises the ceiling without changing this
+  script — the queue belongs to the runtime, and a queued domain was never a lost one. Comments
+  only; no dispatch logic moved.
+
+- **The design brief was the one step the pipeline handed back to you.** `/cohorte-spec` freezes a
+  brief to `specs/design/<feature_id>.md` and then said, in effect, paste this somewhere else. With
+  `design.inline: true` it can instead hand that file to `/design`, which reads the codebase,
+  matches the existing UI style, and returns editable artboards without leaving the session.
+
+  The flag is off by default and degrades rather than fails: an unmet floor falls back to the
+  paste-it-yourself path with a note, never an error. It needs `provider: claude-design`, the new
+  `inline_design` runtime capability (Claude Code only), and a CLI ≥ 2.1.234 — a **higher floor than
+  workflows' 2.1.154**, which is why `/cohorte-doctor` grew a separate check `8b` instead of raising
+  the existing one. Raising the shared floor would have made every install between the two versions
+  read as broken while its workflows ran fine.
+
+  Understand what inline does and does not change: it changes who does the pasting. The brief is
+  still written to disk first and is still what `/cohorte-build` reads — artboards are an aid to the
+  human, not an input to the pipeline. And `/design` is a research preview that **does not save them
+  for you**, so check 8b says so on every run, including the runs where everything passes. An
+  artboard nobody exported dies with the session, and there is no way to notice afterwards.
+
+- This release adds a runtime capability, a profile flag, and a command section: run
+  `/cohorte-update-pipeline` after updating.
+
 ## 2.6.0 — 2026-08-14
 
 - **Two ways to type the same command, and one of them silently doesn't work.** The docs wrote

package/README.md

@@ -229,8 +229,8 @@ those actions.
   ✅/⚠️/❌ checklist (each failure with its fix), the **Surfaces ↔ agents** map from `PIPELINE.md`,
   and one board: a **Kanban** if the project has a linked Obsidian board (columns + cards from the
   vault, with clickable PR links + live open/merged/closed status and a ship-date-sorted Shipped
-  column, via `gh`), otherwise a **Specs board** from `specs/*.md` (by `draft · frozen · in-review ·
-  shipped`). The Kanban supersedes the Specs board when both would apply.
+  column, via `gh`), otherwise a **Specs board** from `specs/*.md` (by `draft · frozen · in-progress ·
+  in-review · blocked · shipped`). The Kanban supersedes the Specs board when both would apply.
 - **Actions** (stream their output live) — **Update / Install core** (the shared global core, or a
   repo's bundled core); **Init-pipeline / Update-pipeline / Audit**, which run those Claude Code
   commands **headless** (`claude -p`, autonomous — Init skips the interactive interview, so review
@@ -276,7 +276,7 @@ will do:
 
 ```sh
 npm i -g cohorte
-francois ext install TheBidouilleAgency/cohorte
+francois ext install TheBidouilleAgency/francois-plugin-cohorte
 ```
 
 ## Releasing (maintainers)
@@ -365,15 +365,17 @@ Rules that make it safe:
 
 ### Workflows — deterministic multi-agent runs (opt-in)
 
-Four phases also ship as **workflow scripts** for the Claude Code Workflow runtime — the same
-fan-out the commands orchestrate, but driven by a deterministic script instead of the lead reasoning
-it out turn by turn:
+Four **workflow scripts** ship for the Claude Code Workflow runtime — the same fan-out the
+commands orchestrate, but driven by a deterministic script instead of the lead reasoning it out
+turn by turn. Three are opt-in variants of their same-named commands; the fourth, `loop.js`,
+exists **only** as a workflow:
 
 | Script                  | What it runs                                                                              |
 | ----------------------- | ----------------------------------------------------------------------------------------- |
 | `workflows/review.js`   | Preflight gate (aborts while red — zero agents), one reviewer per touched surface, adversarial cross-check of CRITICAL/security findings, merged verdict only. |
 | `workflows/audit.js`    | One auditor per domain (every surface + shared) concurrently, prioritized `specs/refactor-backlog.md`. |
 | `workflows/refactor.js` | Big domains only: `shared` first and alone, then parallel surface implementers, per-domain verify + one retry. |
+| `workflows/loop.js`     | `/cohorte-loop` — build → review → [fix → review]* for one feature, unattended and resumable; exits on zero blocking findings, treading water, maxRounds, or anything that needs a human (contract change, unreviewed surface). No conversational fallback, on purpose. |
 
 The essentials:
 
@@ -413,15 +415,15 @@ See `profile/SCHEMA.md` for every field in `PIPELINE.md` and how the pipeline us
 
 ```
 package.json            # npm package (cohorte) — semver source of truth
-bin/cli.js              # the npm CLI: install / update / dashboard / version (cross-platform, no deps)
-install.sh              # script installer (fresh + --update) for no-Node environments
+bin/cli.js              # the npm CLI: install / update / dashboard / specs / doctor / metrics / version (cross-platform, no deps)
+install.sh              # script installer (fresh + --update) for npm-less setups — still needs Node
 install.ps1             # same installer for Windows PowerShell (fresh + -Update)
 core/                   # copied verbatim into ~/.claude (global) or <project>/.claude (bundled)
   agents/               # implementer.template.md (rendered per surface) + review / release / profile-reader
   commands/             # init-pipeline + the pipeline commands + /cohorte-update-pipeline
   hooks/                # gate.py (destructive-command gate; branch-aware; preflight phase gate)
   templates/            # handoff / brainstorm-return / design-brief / review-feedback / pr-body / spec
-  workflows/            # opt-in Workflow-runtime scripts: review.js / audit.js / refactor.js
+  workflows/            # Workflow-runtime scripts: review.js / audit.js / refactor.js (opt-in variants) + loop.js (workflow-only)
 profile/
   PIPELINE.template.md  # the profile skeleton /cohorte-init-pipeline fills
   SCHEMA.md             # field reference

package/bin/cli.js

@@ -562,7 +562,20 @@ async function seedConfig() {
   // being told: `~/.claude` for Claude Code (unchanged — existing files stay authoritative),
   // `~/.cohorte` for every other runtime. The shipped scripts probe both, in that order, so
   // a human who drives one repo from two agents still has a single board and a single consent.
-  const cfg = adapter.expandHome(adapter.configPath(runtime));
+  //
+  // CLAUDE_CONFIG_DIR moves the whole `~/.claude` tree (globalDir already follows it), but
+  // adapter.configPath() speaks in literal `~/.claude/…` — expanding through HOME alone
+  // seeded a file at a path no reader probes (kanban-move.sh and the dashboard follow
+  // CLAUDE_CONFIG_DIR), missed a filled config there (re-seeding disabled defaults beside
+  // it — the exact two-file fork this function's comments forbid), and printed a banner
+  // path that did not exist. Re-root the claude-shaped path onto globalDir so the seed,
+  // the existing-file check, the banner and every reader agree on one file.
+  const homeClaude = path.join(os.homedir(), '.claude');
+  const rerootClaude = (p) =>
+    p === homeClaude || p.startsWith(homeClaude + path.sep)
+      ? path.join(globalDir, p.slice(homeClaude.length + 1) || '.')
+      : p;
+  const cfg = rerootClaude(adapter.expandHome(adapter.configPath(runtime)));
   fs.mkdirSync(path.dirname(cfg), { recursive: true });
   // Pre-rename names, newest first — read as a fallback so upgrades don't lose the config.
   const legacy = ['thebidouille.config.yaml']
@@ -571,7 +584,7 @@ async function seedConfig() {
   // A second runtime must not fork the config: two files means two boards and two consent
   // records, and the human edits whichever one they happen to open. The scripts read
   // `~/.cohorte` first, so seeding it here would SHADOW a filled `~/.claude` copy.
-  const claudeCfg = adapter.expandHome(adapter.configPath({ id: 'claude' }));
+  const claudeCfg = rerootClaude(adapter.expandHome(adapter.configPath({ id: 'claude' })));
   if (cfg !== claudeCfg && fs.existsSync(claudeCfg)) {
     console.log(`  · reusing your existing ${claudeCfg} (the scripts read it as a fallback)`);
     return;

package/core/agents/review.md

@@ -1,7 +1,7 @@
 ---
 name: review
 description: Read-only reviewer. Compares the implementation against the frozen spec, then audits code quality, security, and (if the profile declares it) mobile-first. Emits the REVIEW REPORT. Dispatched by /cohorte-review — one per touched surface on multi-surface diffs. Cannot modify anything.
-tools: Read, Grep, Glob, mcp__serena
+tools: Read, Grep, Glob, mcp__serena, mcp__graphify
 model: sonnet
 ---
 
@@ -40,7 +40,9 @@ be precise and self-contained.
   a default.
 - If `retrieval.provider` in `PIPELINE.md` is not `none`, its MCP tools are in your toolset —
   prefer them over Grep/Glob + whole-file Reads: locate code by symbol, read only the definitions
-  you need. Fall back to Grep/Read when they are unavailable or come up empty.
+  you need. Fall back to Grep/Read when they are unavailable or come up empty. (Your `tools:`
+  list names every provider this agent file is shared across — only the one the project actually
+  wired is live in your session; the others simply are not there.)
 
 ## What you check, in order
 

package/core/commands/cohorte-build.md

@@ -143,7 +143,9 @@ _Only if `contract.enabled`._ From §5 of the spec, write/update the feature's c
 `<contract.path>/$ARGUMENTS.<contract.ext>` in the profile's `mechanism` (e.g. Zod v4 schemas + inferred
 types for `shared-types-zod`). Export it from `contract.index` if set. This is the ONLY file the agents
 share; they import it read-only and must not edit it. If `contract.enabled` is false, the spec prose is
-the sync channel — say so and skip. **Postcondition (if `contract.enabled`):**
+the sync channel — say so and skip, but still run `date +%s` on its own (same as the patch skip
+above: §4's wall-clock start comes from here, and a build with no start epoch writes a metrics
+line with no duration). **Postcondition (if `contract.enabled`):**
 `test -f <contract.path>/$ARGUMENTS.<contract.ext> && date +%s` — the contract file must exist before
 you dispatch §3, or the stateless agents have nothing to build against (the epoch output is §4's
 wall-clock start — no separate timing call).

package/core/commands/cohorte-doctor.md

@@ -85,7 +85,7 @@ fix only with the human's go-ahead (or hand them the command).
    check: CLI resolvable from PATH, `.mcp.json` entry present in PATH-proof launcher form,
    `.serena/` gitignored, server actually connects.
 5. **Design** (if `design.enabled`). `snapshot_dir` exists and is committed; `ui_kit_path` +
-   `tokens_path` exist; if `provider: claude-design`, `DesignSync` responds (`list_projects`) and
+   `tokens_path` exist; if `provider: claude-design`, `DesignSync` responds (`list_files` on the `design_system_project`) and
    `design_system_project` is reachable. Recall: spec `design_files` are full
    `…/design/p/<projectId>?file=<file>` links that carry their own project + page; `design_project` is
    only a legacy fallback for old bare-filename specs (default `none`).
@@ -110,9 +110,14 @@ fix only with the human's go-ahead (or hand them the command).
    stay the default, so failures here are ⚠️ at most, never ❌). Report which path this machine will
    take and why:
    - **Claude Code version** ≥ 2.1.154 (`claude --version 2>/dev/null | head -1`) — older or no CLI
-     on PATH ⇒ conversational only.
-   - **Scripts present:** `<core>/workflows/review.js` + `audit.js` + `refactor.js` —
-     missing on a current core ⇒ half-done install, re-run install/update.
+     on PATH ⇒ conversational only. This is the **workflow** floor and the only one that gates this
+     check; do NOT raise it to match a newer feature's floor, or every install between the two
+     versions reads as broken while its workflows run fine. When `design.inline` is on, report the
+     design floor (≥ 2.1.234) as its own line under check 8b — separate prerequisite, separate verdict.
+   - **Scripts present:** `<core>/workflows/review.js` + `audit.js` + `refactor.js` + `loop.js` —
+     missing on a current core ⇒ half-done install, re-run install/update. (`/cohorte-loop` is
+     **workflow-only** — no command file exists on purpose; without this runtime it refuses
+     rather than degrading to a conversational loop.)
    - **Phase-0 agent present:** `<agents>/profile-reader.md` — the workflows abort without it.
    - **Workflows enabled in this session** — the `Workflow` tool is in your own toolset right now;
      absent ⇒ disabled for this session (a setting or an old client), conversational path.
@@ -121,6 +126,24 @@ fix only with the human's go-ahead (or hand them the command).
    End the check with ONE summary line, e.g.
    `workflows: available (opt-in — ask to "run the review workflow")` or
    `workflows: unavailable (<first failing prerequisite>) — conversational commands (the default)`.
+<!-- cohorte:if inline_design -->
+8b. **Inline design** (`design.inline: true` — the `/design` artboard step between spec and build).
+   A research preview, so every failure here is ⚠️, never ❌: the design brief still exists on disk
+   at `specs/design/<feature_id>.md` and can be carried to the design tool by hand, which is what
+   every install did before this flag. Report:
+   - **Claude Code version** ≥ 2.1.234 — `/design` ships as a skill and is simply absent below it.
+     Older CLI ⇒ say so and name `npm i -g cohorte@latest`'s sibling, `claude update`.
+   - **The `/design` skill resolves in this session** — absent ⇒ the preview is off for this account
+     or plan (Pro/Max/Team/Enterprise are the eligible ones), not a cohorte defect.
+   - **`design.enabled` is true and `provider` is `claude-design`** — `inline` on top of a `figma` or
+     `none` provider is a profile contradiction; name it and point at `/cohorte-update-pipeline`.
+   - **Artboards are not persisted for you.** State it every run, unconditionally, even when all
+     three checks pass: the preview hands designs to the build step but does not save them, so an
+     artboard nobody exported dies with the session. This is the single thing most likely to lose
+     work, and it is not detectable after the fact.
+   One summary line: `inline design: available (preview — export artboards yourself)` or
+   `inline design: unavailable (<first failing prerequisite>) — design brief on disk, carry it over by hand`.
+<!-- cohorte:endif -->
 <!-- cohorte:else -->
 8. **Preflight wiring.** `<core>/pipeline/scripts/preflight.sh` is executable and
    `gate-config.json` carries the `preflight` block — mismatch ⇒ regenerate from the profile.

package/core/commands/cohorte-fix.md

@@ -31,8 +31,8 @@ that change the *contract*; `/cohorte-fix` is for everything else.
   re-author the contract file yourself now (lead-only, per `/cohorte-build` §2) — agents never edit it. If
   the contract change ripples into surfaces *without* findings, fall back to full `/cohorte-build` instead
   and say so.
-- **Note the epoch** (`date +%s`) in the first Bash call you make here — §3's metrics line and usage
-  ping both carry `seconds`, and there is no separate timing call.
+- **Note the epoch** (`date +%s`) in the first Bash call you make here — §3's metrics line carries
+  `seconds`, and there is no separate timing call.
 
 ## 2. Scope the re-dispatch — only surfaces with findings
 
@@ -42,10 +42,11 @@ that change the *contract*; `/cohorte-fix` is for everything else.
   to the most relevant surface — say which.
 - Re-dispatch **ONLY the surfaces owning ≥1 item**, in parallel, in a **single message** — the exact
   dispatch template from `/cohorte-build` §3 (one byte-stable template for builds and fix loops; you do NOT
-  paste a diff — the agent computes its own, scoped to its tree). Fill the template's final variable
-  slot with that surface's open `- [ ]` item lines **verbatim**, so the agent needs no spec re-read to
+  paste a diff — the agent computes its own, scoped to its tree). Fill the template's **Remediation
+  slot** with that surface's open `- [ ]` item lines **verbatim**, so the agent needs no spec re-read to
   find its work; fill the design slot with `none` when a `uses_design` surface's open items are all
-  non-visual (no DesignSync re-fetch for a type fix). Surfaces without findings are NOT re-dispatched —
+  non-visual (no DesignSync re-fetch for a type fix), and the readiness-gaps slot with `none` (a fix
+  loop has no fresh §1.6 verdict). Surfaces without findings are NOT re-dispatched —
   that is the point.
 
 ## 3. Integrate & check off what's fixed

package/core/commands/cohorte-review.md

@@ -136,9 +136,11 @@ between the pipeline and any automated driver, which parses no prose:
 
 - **`blocking` = CRITICAL findings + `security` findings, deduplicated** (a finding that is both
   counts once). That is exactly the agent's existing verdict rule restated as a number, so
-  `blocking == 0` ⟺ `verdict == SHIP`. HIGH/MEDIUM/LOW quality findings are **not** blocking —
-  they follow the `deferred:<id>` backlog route below, and must never cost a driver an iteration.
-- **`blocking_items`** — one normalized string per blocking finding, `<surface>|<file>|<problem>`:
+  `blocking == 0` ⟺ `verdict == SHIP`. HIGH/MEDIUM/LOW quality findings are **not** blocking and
+  must never cost a driver an iteration — a *human* routes them in the verdict branch below
+  (a `/cohorte-fix` pass, or a deliberate park in the backlog); a driver ignores them.
+- **`blocking_items`** — one normalized string per **distinct** blocking finding (deduplicated —
+  two findings sharing surface, file and problem head are one identity), `<surface>|<file>|<problem>`:
   the file path **without the `:line`** (a fix that inserts lines shifts every line below it — a
   line-bearing identity would change every pass and the drift detection would never fire), and the
   **problem**, not the fix, cut to its first 8 words, lowercased, every run of non-alphanumerics
@@ -181,25 +183,33 @@ In chat print ONLY: the verdict, the severity-count table, a one-line digest of
 finding, and `Full report: specs/reports/$ARGUMENTS.md` — never echo the findings body into chat (it
 would sit in this session's history, re-sent every turn). Then:
 
-- **SHIP** → only reachable with `unreviewed` empty (the roll call above forbids it otherwise). A SHIP
-  verdict *is* the pipeline's statement that the feature meets its Definition of
-  Done, so **tick the DoD**: in `specs/$ARGUMENTS.md` §`Acceptance criteria / DoD`, flip each `- [ ]`
-  → `- [x]` for the criteria the pipeline has actually verified — spec conformance + `ui_language`
-  copy (this review), tests · lint · typecheck (a green `/cohorte-build`), mobile-first as far as the code
-  shows it (this review). **Leave `- [ ]` (and say which) any item no stage actually verified** —
-  nothing in the pipeline *runs* the feature, so any criterion that needs the app up (runtime flows,
-  a visual check against the design) stays open unless the human says they exercised it by hand and
-  it held. Ticking is the lead's job
-  (the reviewer is read-only). **Then stamp the freshness gate** so `/cohorte-ship` can refuse to ship code
-  edited after this verdict: compute `BASE=$(git merge-base <default_branch> HEAD)` and write into the
-  spec front-matter `reviewed_base: $BASE` plus
-  `reviewed_digest: $(git diff $BASE -- . ':(exclude)specs/' | sha256sum | cut -c1-16)` — the fingerprint
-  of exactly the source you just reviewed (specs excluded, so DoD ticks + the ship status flip don't
-  trip it). Then tell the human they can `/cohorte-ship` — **recommend a `/clear` first**, the handoff is
-  fully on disk. **SHIP with leftover LOW findings** (or LOW+MEDIUM at the human's call) does NOT
-  force a fix cycle for nits: park them through §3.5's exact route (the backlog, under their surface's
-  domain heading, tagged `deferred:$ARGUMENTS` — never as open `## Remediation` items, which would
-  re-trigger the fix loop), keep the SHIP verdict and the freshness stamp, and let the human ship.
+- **SHIP** → only reachable with `unreviewed` empty (the roll call above forbids it otherwise).
+  **Split on what survived — the DoD tick and the freshness stamp are earned by a clean bill, not
+  by the verdict alone** (the workflow variant enforces the same rule; certifying surviving
+  HIGH/MEDIUM findings for `/cohorte-ship` would ship known defects):
+  - **Nothing above LOW survived** — the clean bill. **Tick the DoD**: in `specs/$ARGUMENTS.md`
+    §`Acceptance criteria / DoD`, flip each `- [ ]` → `- [x]` for the criteria the pipeline has
+    actually verified — spec conformance + `ui_language` copy (this review), tests · lint ·
+    typecheck (a green `/cohorte-build`), mobile-first as far as the code shows it (this review).
+    **Leave `- [ ]` (and say which) any item no stage actually verified** — nothing in the pipeline
+    *runs* the feature, so any criterion that needs the app up (runtime flows, a visual check
+    against the design) stays open unless the human says they exercised it by hand and it held.
+    Ticking is the lead's job (the reviewer is read-only). **Then stamp the freshness gate** so
+    `/cohorte-ship` can refuse to ship code edited after this verdict: compute
+    `BASE=$(git merge-base <default_branch> HEAD)` and write into the spec front-matter
+    `reviewed_base: $BASE` plus `reviewed_digest: $(git diff $BASE -- . ':(exclude)specs/' | sha256sum | cut -c1-16)`
+    (`shasum -a 256` then the first 16 hex chars where there is no `sha256sum` — macOS) — the
+    fingerprint of exactly the source you just reviewed (specs excluded, so DoD ticks + the ship
+    status flip don't trip it). Park the leftover LOWs through §3.5's exact route (the backlog,
+    under their surface's domain heading, tagged `deferred:$ARGUMENTS` — never as open
+    `## Remediation` items, which would re-trigger the fix loop). Then tell the human they can
+    `/cohorte-ship` — **recommend a `/clear` first**, the handoff is fully on disk.
+  - **HIGH or MEDIUM findings survived** — the verdict stays SHIP (they are not blocking), but
+    **no DoD tick and no freshness stamp**. Route them: `/cohorte-fix $ARGUMENTS` for what should
+    be fixed now; MEDIUMs the human *explicitly* chooses to live with go through §3.5's park
+    instead — and once everything left is LOW, apply the clean-bill branch above (tick, stamp,
+    ship). The stamp is the pipeline certifying what ships; it is never written over known
+    HIGH/MEDIUM defects.
 - **REVISE / BLOCK**, or any CRITICAL/HIGH/security finding → tell the human to run
   **`/cohorte-fix $ARGUMENTS`** — it appends the report to the spec's `## Remediation` and re-dispatches ONLY
   the surfaces with findings. The full path (`/cohorte-spec` Mode B then `/cohorte-build`) remains for findings that

package/core/commands/cohorte-ship.md

@@ -23,7 +23,8 @@ You are the **lead**. Ship feature **$ARGUMENTS**. This is the outward-facing ga
   verdict was REVISE/BLOCK, stop and say so.
 - **Freshness gate** — the reviewed code must be exactly what ships. If the spec front-matter carries
   `reviewed_base` + `reviewed_digest`, recompute
-  `git diff <reviewed_base> -- . ':(exclude)specs/' | sha256sum | cut -c1-16` and compare to
+  `git diff <reviewed_base> -- . ':(exclude)specs/' | sha256sum | cut -c1-16` (`shasum -a 256`
+  then the first 16 hex chars where there is no `sha256sum` — macOS) and compare to
   `reviewed_digest`. **Match** ⇒ source unchanged since the SHIP verdict, proceed. **Mismatch** ⇒ source
   (or the contract) was edited after review — the verdict is **stale**: stop and tell the human to re-run
   `/cohorte-review $ARGUMENTS` before shipping. Missing fields (spec predates the gate) ⇒ skip, don't block.

package/core/commands/cohorte-spec.md

@@ -91,7 +91,7 @@ Detect the mode from the pasted content:
    `specs/reports/<id>.md`, where `/cohorte-review` stages its last report. Identify `feature_id` from its
    header; open `specs/<id>.md`.
 2. Append each finding to the spec's **`## Remediation`**, one per line:
-   `- [ ] <severity> · <file:line> · <spec-violation|quality|security> · <concrete fix>`
+   `- [ ] <severity> · <file:line> · <spec-violation|quality|security|complexity> · <concrete fix>`
    (Keep prior items; add the new round under a dated/numbered subheading.)
 3. If a finding implies the **contract** must change, update §5 and flag it so the lead re-authors the
    contract file.

package/core/hooks/gate.py

@@ -454,13 +454,19 @@ def check_bash(payload: dict, cfg: dict) -> int:
             branch_cache[directory] = branch is None or branch == default
         return branch_cache[directory]
 
-    for raw in SPLIT.split(command):
-        seg = norm(raw)
-        if not seg:
-            continue
+    segments = [s for s in (norm(raw) for raw in SPLIT.split(command)) if s]
+
+    # Deny wins over ask across the WHOLE chain, not just in segment order. Scanning
+    # segment-by-segment returned on the first match, so `git commit -m x && node ace
+    # migration:fresh` surfaced only the benign `git commit` ask — and the human's one
+    # confirmation ran the hard-denied command behind it. Scan every segment for deny
+    # patterns first; only a fully deny-free chain gets an ask.
+    for seg in segments:
         for pat in deny:
             if norm(pat) in seg:
                 return decide("deny", f"`{pat}` is forbidden by the project's PIPELINE.md gate.")
+
+    for seg in segments:
         for pat in ask:
             if norm(pat) in seg:
                 return decide(ask_decision,

package/core/runtimes/claude.json

@@ -58,6 +58,7 @@
     "subagents": true,
     "hooks": true,
     "workflows": true,
+    "inline_design": true,
     "mcp": true,
     "tool_restriction": true
   },

package/core/runtimes/codex.json

@@ -74,6 +74,7 @@
     "subagents": true,
     "hooks": true,
     "workflows": false,
+    "inline_design": false,
     "mcp": true,
     "tool_restriction": true
   },

package/core/runtimes/cursor.json

@@ -67,6 +67,7 @@
     "subagents": true,
     "hooks": true,
     "workflows": false,
+    "inline_design": false,
     "mcp": true,
     "tool_restriction": true
   },

package/core/runtimes/gemini.json

@@ -67,6 +67,7 @@
     "subagents": true,
     "hooks": true,
     "workflows": false,
+    "inline_design": false,
     "mcp": true,
     "tool_restriction": false
   },

package/core/runtimes/opencode.json

@@ -63,6 +63,7 @@
     "subagents": true,
     "hooks": false,
     "workflows": false,
+    "inline_design": false,
     "mcp": true,
     "tool_restriction": false
   },

package/core/templates/design-brief.md

@@ -1,8 +1,17 @@
 # DESIGN BRIEF — <feature title> (`<feature_id>`)
 
-> The "spec return". Paste into the design tool (see `PIPELINE.md` §design). This is §8 of the frozen
-> spec, standalone — `/cohorte-spec` writes it to `specs/design/<feature_id>.md` on freeze. Omit entirely if
-> the project has no UI.
+> The "spec return". This is §8 of the frozen spec, standalone — `/cohorte-spec` writes it to
+> `specs/design/<feature_id>.md` on freeze. Omit entirely if the project has no UI.
+>
+> **Getting it into the design tool.** By default: paste it there yourself (see `PIPELINE.md` §design).
+> With `design.inline: true`, `/cohorte-spec` instead offers to hand this file straight to `/design`,
+> which reads the codebase, matches the existing UI style, and returns editable artboards in-session.
+>
+> Inline changes who does the pasting, and nothing else. This file is still written to disk first and
+> is still what `/cohorte-build` reads — the artboards are an aid to the human, not an input to the
+> pipeline, and `/design` is a research preview that does not save them for you. Export anything worth
+> keeping before the session ends. If the design floor is unmet, the flag degrades to the paste-it-
+> yourself path with a note, never to an error: a brief that exists is worth more than a step that ran.
 
 **Goal:** <one line — what the user accomplishes>
 

package/core/workflows/audit.js

@@ -6,7 +6,8 @@
 // Shape (SCHEMA.md §Workflows): profile via profile-reader (phase 0), the
 // mechanical gates staged to disk by one haiku agent, then ONE auditor per
 // domain (each surface + `shared`) running concurrently — the runtime caps
-// concurrency at ~16, extra domains queue — and a merge phase that writes the
+// concurrency at 20 (CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS since 2026-08), extra
+// domains queue — and a merge phase that writes the
 // prioritized specs/refactor-backlog.md. Only the summary comes back.
 
 export const meta = {
@@ -16,7 +17,7 @@ export const meta = {
   phases: [
     { title: 'Profile', detail: 'PIPELINE.md → JSON via profile-reader', model: 'haiku' },
     { title: 'Gates', detail: 'format/lint/typecheck/tests → specs/reports/audit-gates.txt', model: 'haiku' },
-    { title: 'Audit', detail: 'one review-in-audit-mode agent per domain (concurrent, runtime-capped ~16)' },
+    { title: 'Audit', detail: 'one review-in-audit-mode agent per domain (concurrent, runtime-capped 20)' },
     { title: 'Backlog', detail: 'merge + write specs/refactor-backlog.md', model: 'haiku' },
   ],
 }
@@ -156,12 +157,21 @@ const gates = await agent(
   'the file and return each failure as file/line/kind/one-line summary, capped at 40 (set overflow for the rest).',
   { model: 'haiku', label: 'gates', schema: GATES, effort: 'low' },
 )
+// A dead gates agent is NOT "zero mechanical failures" — silence would read as the
+// cleanest possible inventory from a phase that never ran (SCHEMA.md §Dead agents).
+// The domain auditors still run (they read the staged gates file, which then simply
+// isn't there), but the run must say the mechanical sweep is uncovered.
+const gatesCovered = gates != null
 const mech = (gates && gates.failures) || []
-log(`Mechanical failures: ${mech.length}${gates && gates.overflow ? ` (+${gates.overflow} overflow)` : ''}`)
+log(gatesCovered
+  ? `Mechanical failures: ${mech.length}${gates.overflow ? ` (+${gates.overflow} overflow)` : ''}`
+  : 'the gates agent died — mechanical checks NOT covered this run')
 
 // ── Phase 2 — one auditor per domain, concurrent ─────────────────────────────
 // Domains = every surface + `shared` (contract package + anything outside the
-// surface trees). The runtime caps concurrent agents (~16); more domains queue.
+// surface trees). The runtime caps concurrent agents at 20 by default; more domains
+// queue. Raising CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS raises the ceiling, it does not
+// change this script — the queue is the runtime's, and a queued domain is not a lost one.
 phase('Audit')
 const domains = surfaces.map(s => ({ key: s.key, path: s.path }))
   .concat([{ key: 'shared', path: (profile.contract && profile.contract.path) || '(everything outside the surface trees)' }])
@@ -192,6 +202,10 @@ if (deadDomains.length) {
   body.push('', `> ⚠ NOT audited (the auditor died): ${deadDomains.join(', ')} — absence of items below`,
     '> for those domains means "not looked at", not "clean". Re-run the audit for them.')
 }
+if (!gatesCovered) {
+  body.push('', '> ⚠ Mechanical gates NOT run (the gates agent died) — lint/typecheck/test failures',
+    '> are uncounted below. Re-run the audit for the mechanical sweep.')
+}
 let total = 0
 for (const d of perDomain) {
   const items = [...d.items].sort((a, b) => SEV[a.severity] - SEV[b.severity])
@@ -211,7 +225,8 @@ const backlogOk = written != null && /done/i.test(String(written))
 return {
   backlog: backlogOk ? 'specs/refactor-backlog.md' : '(NOT written — the backlog writer died)',
   notAudited: deadDomains,   // absence of findings here means "not looked at"
-  mechanicalFailures: mech.length,
+  mechanicalFailures: gatesCovered ? mech.length : null,  // null = gates agent died, NOT zero
+  gatesCovered,
   domains: Object.fromEntries(perDomain.map(d => [d.key, d.items.length + (d.overflow || 0)])),
   total,
   top: perDomain.flatMap(d => d.items.map(it => ({ ...it, domain: d.key })))