cohorte 2.6.0 → 2.8.0

package/scripts/test-gate.mjs

@@ -112,6 +112,12 @@ console.log("gate.py — Bash command gating");
     run(bash("node   ace    migration:run"), at()).decision === "ask");
   check("deny wins over ask on the same segment",
     run(bash("node ace migration:fresh"), at()).decision === "deny");
+  // Deny must win ACROSS segments too: with segment-order scanning, the benign ask
+  // surfaced first and the human's one confirm ran the hard-denied command behind it.
+  check("deny in a LATER segment wins over an earlier ask segment",
+    run(bash("node ace migration:run && node ace migration:fresh"), at()).decision === "deny");
+  check("deny in a later segment wins over an earlier branch-gated ask",
+    run(bash("git commit -m x && node ace db:wipe"), at()).decision === "deny");
   // Matching is substring-on-the-whole-pattern, so a partial overlap is NOT a
   // match — `migration:run` alone does not trigger `node ace migration:run`.
   check("a partial overlap of a pattern does not gate",

package/scripts/test-metrics.mjs

@@ -144,8 +144,8 @@ check('…and keeps its own spend', retired && retired.tokens.output, 90);
 // opus-5 $5 in / $25 out per MTok; 5m cache write 1.25x input, cache read 0.1x input.
 //   m1  100*5 + 1000*25 + 1000*6.25 + 10000*0.5 = 36750
 //   m3  500*25                                   = 12500
-//   s1  sonnet-5 2000*15                         = 30000   (subagent)
-check('cost sums the cache tiers at their own rates', Number(build.cost.total.toFixed(6)), 0.07925);
+//   s1  sonnet-5 2000*10                         = 20000   (subagent, $2/$10 since 2026-08)
+check('cost sums the cache tiers at their own rates', Number(build.cost.total.toFixed(6)), 0.06925);
 check('the unpriced list stays empty for known models', build.unpriced, []);
 
 const detail = out.runs.find((r) => r.command === '/cohorte-build');

package/scripts/test-workflows.mjs

@@ -49,13 +49,17 @@ const finding = (over = {}) => ({
 });
 
 // Run one workflow script with a `reply(prompt, opts) => value` stub in place of
-// every agent call. Returns { result, calls }.
-async function run(script, reply, args = { feature: "feat-x" }) {
+// every agent call, and an optional `wf(name, args)` stub in place of nested
+// workflow() calls (loop.js runs the review workflow as a child). Returns
+// { result, calls, prompts } — prompts keyed by label, for byte-identity asserts.
+async function run(script, reply, args = { feature: "feat-x" }, wf) {
   const text = readFileSync(join(root, "core/workflows", script), "utf8")
     .replace(/^export const meta/m, "const meta");
   const calls = [];
+  const prompts = {};
   const agent = async (prompt, opts = {}) => {
     calls.push(opts.label || "(unlabelled)");
+    prompts[opts.label || "(unlabelled)"] = prompt;
     return reply(prompt, opts, calls);
   };
   // Mirrors the runtime's contract: a thunk that throws resolves to null, the
@@ -76,8 +80,9 @@ async function run(script, reply, args = { feature: "feat-x" }) {
     "agent", "parallel", "pipeline", "phase", "log", "args", "budget", "workflow", text);
   const result = await fn(
     agent, parallel, pipeline, () => {}, () => {}, args,
-    { total: null, spent: () => 0, remaining: () => Infinity }, async () => {});
-  return { result, calls };
+    { total: null, spent: () => 0, remaining: () => Infinity },
+    wf || (async () => {}));
+  return { result, calls, prompts };
 }
 
 // A reply table keyed by label prefix; the first matching prefix wins.
@@ -156,7 +161,7 @@ console.log("review.js");
     problem: "p", fix: "f", outOfScope: "predates this feature; diff never touched it",
   }];
   let stagePrompt = "";
-  const { result } = await run("review.js", (prompt, opts) => {
+  const { result, calls } = await run("review.js", (prompt, opts) => {
     const label = opts.label || "";
     if (label.startsWith("review:")) return { verdict: "SHIP", findings: [], deferred };
     if (label === "stage-report") { stagePrompt = prompt; return "done"; }
@@ -172,7 +177,8 @@ console.log("review.js");
     /refactor-backlog\.md/.test(stagePrompt) && /deferred:feat-x/.test(stagePrompt),
     stagePrompt.slice(0, 200));
   check("deferred are never cross-checked (no verify agent spawned)",
-    !/verify:/.test(String(result.criticals)) && result.refutedByCrossCheck === 0);
+    !calls.some(c => c.startsWith("verify:")) && result.refutedByCrossCheck === 0,
+    calls.join(","));
 }
 {
   const { result } = await run("review.js", replier([
@@ -344,6 +350,380 @@ console.log("audit.js / refactor.js");
     result.skipped && result.skipped.backend === 2, JSON.stringify(result));
 }
 
+// ── review.js — the machine verdict contract the loop reduces on ─────────────
+console.log("review.js verdict contract");
+{
+  const { result } = await run("review.js", replier([
+    ["preflight", { pass: false, tail: "boom" }], ...BASE_REVIEW,
+  ]));
+  check("red preflight ⇒ aborted: 'preflight' (what a driver branches on)",
+    result.aborted === "preflight", JSON.stringify(result.aborted));
+}
+{
+  // The empty-diff SHIP certified nothing (no review, no stamp) — its `next` must not
+  // read as "run /cohorte-ship", which would point a driver at a gate that refuses.
+  const { result } = await run("review.js", replier([
+    ["stage-diff", { surfaces: [] }], ...BASE_REVIEW,
+  ]));
+  check("empty-diff SHIP ⇒ next warns nothing was reviewed, never '/cohorte-ship'",
+    result.verdict === "SHIP" && !String(result.next).startsWith("/cohorte-ship") && /no review|nothing to ship/i.test(result.next),
+    result.next);
+}
+{
+  // blocking = CRITICAL + security counted once; blocking_items = identity, not wording:
+  // surface | file WITHOUT :line | first 8 words of the problem, lowercased, collapsed.
+  const crit = finding({ severity: "CRITICAL", file: "apps/api/a.ts:41",
+    problem: "Missing auth-check on POST /orders endpoint here now" });
+  let stagePrompt = "";
+  const { result } = await run("review.js", (prompt, opts) => {
+    const label = opts.label || "";
+    if (label.startsWith("verify:")) return { refuted: false, reason: "holds" };
+    if (label.startsWith("review:backend")) return { verdict: "REVISE", findings: [crit] };
+    if (label.startsWith("review:")) return { verdict: "SHIP", findings: [] };
+    if (label === "stage-report") { stagePrompt = prompt; return "done"; }
+    return replier(BASE_REVIEW)(prompt, opts);
+  });
+  check("blocking counts CRITICAL+security, each once", result.blocking === 1, `got ${result.blocking}`);
+  check("blockingItems: surface|file-no-line|8-word normalized problem",
+    (result.blockingItems || [])[0] === "backend|apps/api/a.ts|missing auth check on post orders endpoint here",
+    JSON.stringify(result.blockingItems));
+  check("verdict.json is staged, fingerprint computed in Bash (sha256), never by hand",
+    /verdict\.json/.test(stagePrompt) && /sha256sum/.test(stagePrompt), stagePrompt.slice(0, 200));
+}
+{
+  // The cross-check exists so a refuted CRITICAL cannot force a fix loop — and so an
+  // unrefuted one still does. Both directions, plus security ⇒ BLOCK.
+  const crit = finding({ severity: "CRITICAL" });
+  const withVerify = refuted => (prompt, opts) => {
+    const label = opts.label || "";
+    if (label.startsWith("verify:")) return { refuted, reason: refuted ? "a guard covers it" : "holds" };
+    if (label.startsWith("review:backend")) return { verdict: "REVISE", findings: [crit] };
+    if (label.startsWith("review:")) return { verdict: "SHIP", findings: [] };
+    return replier(BASE_REVIEW)(prompt, opts);
+  };
+  const kept = await run("review.js", withVerify(false));
+  check("unrefuted CRITICAL ⇒ REVISE, cross-check ran",
+    kept.result.verdict === "REVISE" && kept.calls.some(c => c.startsWith("verify:")),
+    JSON.stringify([kept.result.verdict, kept.result.blocking]));
+  const refutedRun = await run("review.js", withVerify(true));
+  check("refuted CRITICAL ⇒ SHIP, not a fix loop",
+    refutedRun.result.verdict === "SHIP" && refutedRun.result.refutedByCrossCheck === 1 && refutedRun.result.blocking === 0,
+    JSON.stringify([refutedRun.result.verdict, refutedRun.result.refutedByCrossCheck]));
+  const sec = await run("review.js", (prompt, opts) => {
+    const label = opts.label || "";
+    if (label.startsWith("verify:")) return { refuted: false, reason: "holds" };
+    if (label.startsWith("review:backend")) return { verdict: "REVISE", findings: [finding({ severity: "HIGH", kind: "security" })] };
+    if (label.startsWith("review:")) return { verdict: "SHIP", findings: [] };
+    return replier(BASE_REVIEW)(prompt, opts);
+  });
+  check("surviving security finding ⇒ BLOCK, counted blocking",
+    sec.result.verdict === "BLOCK" && sec.result.blocking === 1,
+    JSON.stringify([sec.result.verdict, sec.result.blocking]));
+  // A dead cross-check verifier must KEEP the finding (a real CRITICAL must not die
+  // on a transport error), never silently drop it.
+  const deadVerify = await run("review.js", (prompt, opts) => {
+    const label = opts.label || "";
+    if (label.startsWith("verify:")) return null;
+    if (label.startsWith("review:backend")) return { verdict: "REVISE", findings: [crit] };
+    if (label.startsWith("review:")) return { verdict: "SHIP", findings: [] };
+    return replier(BASE_REVIEW)(prompt, opts);
+  });
+  check("dead verifier ⇒ the CRITICAL is kept, verdict REVISE",
+    deadVerify.result.verdict === "REVISE" && deadVerify.result.blocking === 1,
+    JSON.stringify([deadVerify.result.verdict, deadVerify.result.blocking]));
+}
+
+// ── refactor.js — args scoping + the retry round's cleared accumulation ──────
+console.log("refactor.js retry & args");
+{
+  // Bare-string shorthand names a DOMAIN — it must never widen to 'all' (that
+  // dispatched code-editing implementers on every big domain).
+  let backlogPrompt = "";
+  await run("refactor.js", (prompt, opts) => {
+    const label = opts.label || "";
+    if (label === "profile") return PROFILE;
+    if (label === "read-backlog") { backlogPrompt = prompt; return { domains: [] }; }
+    return "ok";
+  }, "backend");
+  check("bare-string args scope to that domain, not 'all'",
+    /Requested domains: backend/.test(backlogPrompt) && !/Requested domains: all/.test(backlogPrompt),
+    backlogPrompt.slice(-140));
+}
+{
+  // The re-verify covers only the retried items; round 1's verified clears must
+  // survive the merge or the backlog un-ticks finished work.
+  const items = ["- [ ] a", "- [ ] b", "- [ ] c", "- [ ] d", "- [ ] e"];
+  let tickPrompt = "";
+  const { result } = await run("refactor.js", (prompt, opts) => {
+    const label = opts.label || "";
+    if (label === "profile") return PROFILE;
+    if (label === "read-backlog") return { domains: [{ key: "backend", items }] };
+    if (label === "verify:backend") return { cleared: items.slice(0, 3), remaining: items.slice(3), gatesGreen: true };
+    if (label === "reverify:backend") return { cleared: items.slice(3), remaining: [], gatesGreen: true };
+    if (label === "tick-backlog") { tickPrompt = prompt; return "done"; }
+    return "handoff";
+  }, { domains: "all" });
+  check("retry round keeps round-1 clears (5/5, not 2/5)",
+    result.domains.backend.cleared === 5 && result.domains.backend.remaining === 0,
+    JSON.stringify(result.domains));
+  check("all five cleared items reach the ticker", items.every(i => tickPrompt.includes(i)),
+    tickPrompt.slice(0, 160));
+}
+{
+  // A dead re-verifier loses only the retry round's claim: round 1's clears stay
+  // cleared, the retried items stay open — never reset to all-five-open.
+  const items = ["- [ ] a", "- [ ] b", "- [ ] c", "- [ ] d", "- [ ] e"];
+  const { result } = await run("refactor.js", (prompt, opts) => {
+    const label = opts.label || "";
+    if (label === "profile") return PROFILE;
+    if (label === "read-backlog") return { domains: [{ key: "backend", items }] };
+    if (label === "verify:backend") return { cleared: items.slice(0, 3), remaining: items.slice(3), gatesGreen: true };
+    if (label === "reverify:backend") return null;
+    if (label === "tick-backlog") return "done";
+    return "handoff";
+  }, { domains: "all" });
+  check("dead re-verifier ⇒ round-1 clears kept, retried items open",
+    result.domains.backend.cleared === 3 && result.domains.backend.remaining === 2,
+    JSON.stringify(result.domains));
+}
+{
+  // Gates red with everything cleared: the retry must NOT re-open verified items —
+  // with a dead re-verifier the same lines once sat in `cleared` AND `remaining`
+  // (ticked off the backlog while reported open).
+  const items = ["- [ ] a", "- [ ] b", "- [ ] c", "- [ ] d", "- [ ] e"];
+  const { result } = await run("refactor.js", (prompt, opts) => {
+    const label = opts.label || "";
+    if (label === "profile") return PROFILE;
+    if (label === "read-backlog") return { domains: [{ key: "backend", items }] };
+    if (label === "verify:backend") return { cleared: items, remaining: [], gatesGreen: false, failures: "lint red" };
+    if (label === "reverify:backend") return null;
+    if (label === "tick-backlog") return "done";
+    return "handoff";
+  }, { domains: "all" });
+  check("gates-red + all cleared + dead re-verifier ⇒ no cleared/remaining overlap",
+    result.domains.backend.cleared === 5 && result.domains.backend.remaining === 0,
+    JSON.stringify(result.domains));
+}
+
+// ── loop.js — build → review → [fix → review]*, unattended ──────────────────
+// The reducer's facts come from stubs, but the DECISIONS under test (freshness,
+// precondition gates, exit ordering, treading water) all live in script code —
+// which is exactly why they live there and not in an agent prompt.
+console.log("loop.js");
+
+const loopFacts = (over = {}) => ({
+  now: { epoch: 1000000, iso: "2026-08-22T00:00:00Z" },
+  spec: { exists: true, status: "frozen", kind: "", mtimeEpoch: 500, designFiles: [] },
+  readiness: { exists: true, mtimeEpoch: 600, verdict: "READY", gaps: [], surfaces: ["backend", "frontend"] },
+  contractFile: { exists: true },
+  build: { exists: false },
+  loop: { exists: false },
+  ...over,
+});
+const FRESH_BUILD = { exists: true, mtimeEpoch: 600, dead: [] };
+const loopReply = (facts, over = {}) => (prompt, opts) => {
+  const label = opts.label || "";
+  if (label === "profile") return over.profile || PROFILE;
+  if (label === "preconditions") return facts;
+  if (label.startsWith("state:") || label === "close") return "done 1000001";
+  if (label.startsWith("ingest:")) return "ingest" in over ? over.ingest
+    : { items: [{ line: "- [ ] CRITICAL · apps/api/a.ts:3 · quality · f", file: "apps/api/a.ts" }] };
+  if (label.startsWith("tick:")) return "done";
+  if (label.startsWith("build") || label.startsWith("fix")) {
+    return "impl" in over ? over.impl : "handoff\n## Remediation addressed\n- apps/api/a.ts:3 — fixed";
+  }
+  return "ok";
+};
+const reviewOf = over => ({
+  verdict: "REVISE", blocking: 1, blockingItems: ["backend|apps/api/a.ts|p"],
+  unreviewedSurfaces: [], deferred: 0, ...over,
+});
+const SHIP_CLEAN = { verdict: "SHIP", blocking: 0, blockingItems: [], unreviewedSurfaces: [], deferred: 0, next: "/cohorte-ship feat-x (DoD ticked + freshness stamped)" };
+
+{
+  // THE ordering regression: a dead reviewer's zero findings must not read as ship.
+  // unreviewed is checked BEFORE blocking — the other way round ships unread code.
+  const wf = async () => reviewOf({ blocking: 0, unreviewedSurfaces: ["backend"] });
+  const { result } = await run("loop.js", loopReply(loopFacts({ build: FRESH_BUILD })), { feature: "feat-x" }, wf);
+  check("unreviewed + blocking 0 ⇒ abort/unreviewed, NOT ship",
+    result.outcome === "abort" && result.reason === "unreviewed", JSON.stringify([result.outcome, result.reason]));
+}
+{
+  // Same blocking identity two consecutive rounds ⇒ treading water at round 2,
+  // not burned down to maxRounds.
+  const wf = async () => reviewOf();
+  const { result, calls } = await run("loop.js", loopReply(loopFacts({ build: FRESH_BUILD })), { feature: "feat-x" }, wf);
+  check("identical fingerprint twice ⇒ abort/treading-water", result.reason === "treading-water", result.reason);
+  check("…at round 2, not maxRounds", result.rounds === 2, `rounds ${result.rounds}`);
+  check("…after exactly one fix round", calls.filter(c => c.startsWith("fix:")).length === 1,
+    calls.filter(c => c.startsWith("fix")).join(","));
+}
+{
+  // NOT-READY is the one outcome more passes cannot fix — and a precondition that
+  // aborts AFTER spawning has not aborted: only profile + preconditions may run.
+  const facts = loopFacts({ readiness: { exists: true, mtimeEpoch: 600, verdict: "NOT-READY", gaps: ["contract|POST /x|no shape"], surfaces: ["backend"] } });
+  const { result, calls } = await run("loop.js", loopReply(facts), { feature: "feat-x" }, async () => SHIP_CLEAN);
+  check("NOT-READY ⇒ abort/precondition with the gaps verbatim",
+    result.reason === "precondition" && (result.gaps || []).length === 1, JSON.stringify(result));
+  check("NOT-READY ⇒ zero dispatches (profile + facts only)",
+    calls.join(",") === "profile,preconditions", calls.join(","));
+}
+{
+  // readiness older than the spec describes a spec that no longer exists ⇒ absent.
+  const facts = loopFacts({ readiness: { exists: true, mtimeEpoch: 400, verdict: "READY", gaps: [], surfaces: ["backend"] } });
+  const { result, calls } = await run("loop.js", loopReply(facts), { feature: "feat-x" }, async () => SHIP_CLEAN);
+  check("stale readiness.json ⇒ treated as absent ⇒ abort/precondition",
+    result.reason === "precondition" && /older than the spec/.test(result.detail), JSON.stringify(result.detail));
+  check("stale readiness ⇒ zero dispatches", calls.join(",") === "profile,preconditions", calls.join(","));
+}
+{
+  // A blocking finding on the contract file is /cohorte-fix §1's lead-only step.
+  const CPROFILE = { ...PROFILE, contract: { enabled: true, path: "packages/shared/src", ext: "ts", mechanism: "shared-types-zod" } };
+  const wf = async () => reviewOf({ blockingItems: ["backend|packages/shared/src/feat-x.ts|response shape wrong"] });
+  const { result, calls } = await run("loop.js",
+    loopReply(loopFacts({ build: FRESH_BUILD }), { profile: CPROFILE }), { feature: "feat-x" }, wf);
+  check("blocking finding on the contract file ⇒ abort/contract-change",
+    result.reason === "contract-change", result.reason);
+  check("contract-change ⇒ no fix round dispatched", !calls.some(c => c.startsWith("fix")), calls.join(","));
+}
+{
+  // Dead build implementers: retried ONCE, byte-identical, then abort — never "ok".
+  const { result, calls, prompts } = await run("loop.js",
+    loopReply(loopFacts(), { impl: null }), { feature: "feat-x" }, async () => SHIP_CLEAN);
+  check("dead implementers ⇒ abort/dead-implementers", result.reason === "dead-implementers", result.reason);
+  check("each dead surface retried exactly once",
+    calls.filter(c => c === "build:backend").length === 1 && calls.filter(c => c === "build-retry:backend").length === 1,
+    calls.join(","));
+  check("the retry is byte-identical to the dispatch",
+    prompts["build:backend"] === prompts["build-retry:backend"]);
+}
+{
+  // Deferred findings never cost a round: 9 deferred + 0 blocking ships in one.
+  const wf = async () => ({ ...SHIP_CLEAN, deferred: 9 });
+  const { result } = await run("loop.js", loopReply(loopFacts({ build: FRESH_BUILD })), { feature: "feat-x" }, wf);
+  check("deferred 9 + blocking 0 ⇒ ship in one round",
+    result.outcome === "ship" && result.rounds === 1 && result.deferred === 9, JSON.stringify(result));
+}
+{
+  // The degraded preflight verdict has no unreviewed/blocking keys — the reducer
+  // must branch on `aborted`, not crash on a missing field.
+  const wf = async () => ({ verdict: "ABORTED", aborted: "preflight", reason: "preflight red" });
+  const { result } = await run("loop.js", loopReply(loopFacts({ build: FRESH_BUILD })), { feature: "feat-x" }, wf);
+  check("child preflight abort ⇒ abort/preflight (no crash on the degraded shape)",
+    result.outcome === "abort" && result.reason === "preflight", JSON.stringify([result.outcome, result.reason]));
+}
+{
+  // A fresh build.json with no dead surfaces means the work is on disk — entering
+  // after a conversational /cohorte-build must not rebuild it.
+  const { result, calls } = await run("loop.js",
+    loopReply(loopFacts({ build: FRESH_BUILD })), { feature: "feat-x" }, async () => SHIP_CLEAN);
+  check("fresh build.json ⇒ build phase skipped", !calls.some(c => c.startsWith("build")), calls.join(","));
+  check("…and the run still ships", result.outcome === "ship", result.outcome);
+  // …and a STALE build.json builds: the work on disk predates the spec.
+  const stale = await run("loop.js",
+    loopReply(loopFacts({ build: { exists: true, mtimeEpoch: 400, dead: [] } })), { feature: "feat-x" }, async () => SHIP_CLEAN);
+  check("stale build.json ⇒ build phase runs", stale.calls.some(c => c.startsWith("build:")), stale.calls.join(","));
+}
+{
+  // Resume: an unfinished, fresh loop.json restores round + the treading-water key,
+  // so a run killed mid-round costs a re-review, not a restart.
+  const prev = JSON.stringify({ id: "feat-x", round: 3, lastItems: ["backend|apps/api/a.ts|p"], history: [{ round: 1, blocking: 3 }, { round: 2, blocking: 1 }] });
+  const facts = loopFacts({ build: FRESH_BUILD, loop: { exists: true, mtimeEpoch: 700, raw: prev } });
+  const wf = async () => reviewOf();
+  const { result, calls } = await run("loop.js", loopReply(facts), { feature: "feat-x" }, wf);
+  check("resume: same items as the resumed round ⇒ treading-water immediately",
+    result.reason === "treading-water" && !calls.some(c => c.startsWith("fix")), JSON.stringify([result.reason, result.rounds]));
+  check("resume: history carries the prior rounds", result.rounds === 3, `rounds ${result.rounds}`);
+  // A FINISHED loop.json (outcome set) must not resume — fresh run from round 1.
+  const done = JSON.stringify({ id: "feat-x", round: 4, outcome: "abort", lastItems: ["backend|apps/api/a.ts|p"], history: [] });
+  const r2 = await run("loop.js",
+    loopReply(loopFacts({ build: FRESH_BUILD, loop: { exists: true, mtimeEpoch: 700, raw: done } })),
+    { feature: "feat-x" }, wf);
+  check("a finished loop.json does not resume (round 1, fix dispatched)",
+    r2.calls.some(c => c.startsWith("fix:")), r2.calls.join(","));
+}
+{
+  // The loop EDITS the spec as it runs (status stamps, Remediation appends), so on
+  // resume the spec's mtime is NEWER than readiness.json — freshness must be measured
+  // against the baseline stored in loop.json, or the loop's own footprint aborts its
+  // own resume with "readiness is older than the spec".
+  const prev = JSON.stringify({ id: "feat-x", round: 2, specMtime: 500, lastItems: ["backend|apps/api/old.ts|p"], history: [{ round: 1, blocking: 3 }] });
+  const facts = loopFacts({
+    spec: { exists: true, status: "in-progress", kind: "", mtimeEpoch: 900, designFiles: [] },
+    build: FRESH_BUILD,
+    loop: { exists: true, mtimeEpoch: 700, raw: prev },
+  });
+  const { result } = await run("loop.js", loopReply(facts), { feature: "feat-x" }, async () => SHIP_CLEAN);
+  check("resume survives the loop's own spec writes (baseline mtime, not current)",
+    result.outcome === "ship", JSON.stringify([result.outcome, result.reason, result.detail]));
+  check("resume keeps only rounds before the resumed one (no double count)",
+    result.rounds === 2, `rounds ${result.rounds}`);
+}
+{
+  // A real verdict whose report never landed on disk: the fix round would ingest the
+  // PREVIOUS round's report. Resumable give-up, never a fix round on stale findings.
+  const wf = async () => reviewOf({ reportStaged: false });
+  const { result, calls } = await run("loop.js", loopReply(loopFacts({ build: FRESH_BUILD })), { feature: "feat-x" }, wf);
+  check("blocking verdict + unstaged report ⇒ abort/report-not-staged, no fix round",
+    result.reason === "report-not-staged" && !calls.some(c => c.startsWith("fix")),
+    JSON.stringify([result.reason, calls.filter(c => c.startsWith("fix"))]));
+}
+{
+  // Ordinary surface code can live UNDER contract.path (a `shared` surface at the
+  // contract package) — only the feature's contract FILE is the lead-only abort.
+  const CPROFILE = { ...PROFILE, contract: { enabled: true, path: "packages/shared/src", ext: "ts", mechanism: "shared-types-zod" } };
+  const wf = async () => reviewOf({ blockingItems: ["backend|packages/shared/src/utils.ts|helper broken"] });
+  const { result, calls } = await run("loop.js",
+    loopReply(loopFacts({ build: FRESH_BUILD }), { profile: CPROFILE }), { feature: "feat-x" }, wf);
+  check("a finding elsewhere under contract.path is NOT contract-change",
+    result.reason !== "contract-change" && calls.some(c => c.startsWith("fix:")),
+    JSON.stringify([result.reason, calls.filter(c => c.startsWith("fix"))]));
+}
+{
+  // A dead fix implementer still gets its metrics line — an incomplete batch is the
+  // batch worth recording — written BEFORE the abort.
+  const wf = async () => reviewOf();
+  const { result, prompts } = await run("loop.js",
+    loopReply(loopFacts({ build: FRESH_BUILD }), { impl: null }), { feature: "feat-x" }, wf);
+  check("dead fix implementer ⇒ abort, with the fix metrics written first (\"dead\")",
+    result.reason === "dead-implementers" && /"backend":"dead"/.test(prompts["state:fixed-1"] || ""),
+    JSON.stringify([result.reason, (prompts["state:fixed-1"] || "").slice(-120)]));
+}
+{
+  // maxRounds is the last net: distinct findings each round burn down to it.
+  let n = 0;
+  const wf = async () => reviewOf({ blockingItems: [`backend|apps/api/f${++n}.ts|p`] });
+  const { result } = await run("loop.js", loopReply(loopFacts({ build: FRESH_BUILD })),
+    { feature: "feat-x", maxRounds: 2 }, wf);
+  check("maxRounds reached with distinct findings ⇒ abort/max-rounds at that round",
+    result.reason === "max-rounds" && result.rounds === 2, JSON.stringify([result.reason, result.rounds]));
+}
+{
+  // A ship with surviving HIGH/MEDIUM has NO freshness stamp — the loop must relay
+  // review's routing (which says /cohorte-fix), not print "/cohorte-ship".
+  const wf = async () => ({ ...SHIP_CLEAN, next: "/cohorte-fix feat-x — SHIP verdict, but 2 finding(s) above LOW survived; park them in specs/refactor-backlog.md instead if you deliberately defer them" });
+  const { result } = await run("loop.js", loopReply(loopFacts({ build: FRESH_BUILD })), { feature: "feat-x" }, wf);
+  check("ship with HIGH leftovers ⇒ next relays review's /cohorte-fix routing",
+    String(result.next).startsWith("/cohorte-fix"), result.next);
+}
+{
+  // Dead ingest = no Remediation items were appended; dispatching blind would
+  // re-build surfaces with no instructions. Abort, resumable at this round.
+  const wf = async () => reviewOf();
+  const { result } = await run("loop.js",
+    loopReply(loopFacts({ build: FRESH_BUILD }), { ingest: null }), { feature: "feat-x" }, wf);
+  check("dead ingest agent ⇒ abort/ingest-died, items never invented",
+    result.reason === "ingest-died", result.reason);
+}
+{
+  // workflow() unavailable (no runtime / review.js not installed) ⇒ explicit refusal,
+  // never a conversational fallback.
+  const wf = async () => { throw new Error("unknown workflow: cohorte-review"); };
+  const { result } = await run("loop.js", loopReply(loopFacts({ build: FRESH_BUILD })), { feature: "feat-x" }, wf);
+  check("review workflow unavailable ⇒ abort/review-workflow-unavailable",
+    result.reason === "review-workflow-unavailable", result.reason);
+}
+
 console.log("");
 if (failures) { console.error(`test-workflows: ${failures} failure(s)`); process.exit(1); }
 console.log("test-workflows: OK");

package/scripts/validate-core.mjs

@@ -56,13 +56,17 @@ for (const f of readdirSync(join(root, "core/commands"))) {
 }
 
 // ── fixed agents ────────────────────────────────────────────────────────────
-// Every non-template agent needs name/tools/model, and must be shipped by
-// both installers (a new agent that install.sh doesn't copy never reaches
-// a global install — the exact bug that motivated this check).
+// Every non-template agent needs name/tools/model, and every one must be
+// ASSERTED by the ci.yml install dry-run (a new agent the CLI's copy rules miss
+// would otherwise never reach an install and nothing would notice — the exact
+// bug that motivated this check). The old form grepped install.sh/install.ps1
+// for copy commands, but those scripts have been thin delegators to bin/cli.js
+// since 2.2.0 — the text being matched was unreachable dead code, so the check
+// passed vacuously. CI postconditions test the copy that actually runs.
 const AGENT_MODEL = { review: "sonnet", release: "haiku",
   "profile-reader": "haiku" };
-const installSh = read("install.sh");
-const installPs1 = read("install.ps1");
+const ciYmlText = existsSync(join(root, ".github/workflows/ci.yml"))
+  ? read(".github/workflows/ci.yml") : "";
 
 for (const f of readdirSync(join(root, "core/agents"))) {
   const path = `core/agents/${f}`;
@@ -84,10 +88,8 @@ for (const f of readdirSync(join(root, "core/agents"))) {
     fail(path, `frontmatter must pin \`model: ${want}\``);
   if (text.includes("<SURFACE_"))
     fail(path, "unrendered <SURFACE_*> placeholder in a non-template agent");
-  if (!installSh.includes(`core/agents/${f}`))
-    fail("install.sh", `does not copy core/agents/${f} (copy_fixed_agents)`);
-  if (!installPs1.includes(`core\\agents\\${f}`))
-    fail("install.ps1", `does not copy core\\agents\\${f} (Copy-FixedAgents)`);
+  if (ciYmlText && !ciYmlText.includes(`agents/${f}`))
+    fail(".github/workflows/ci.yml", `install dry-run never asserts .claude/agents/${f} — a fixed agent the CLI's copy rules miss would ship silently`);
 }
 
 // ── cross-references ────────────────────────────────────────────────────────
@@ -145,7 +147,9 @@ const walk = (dir) => readdirSync(join(root, dir), { withFileTypes: true }).flat
 for (const dir of ["core/commands", "core/agents", "core/templates", "core/workflows"])
   for (const rel of walk(dir)) {
     if (!/\.(md|js)$/.test(rel) || rel === TELEMETRY_SCRUBBER) continue;
-    if (NO_TELEMETRY.test(read(rel)))
+    // Collapse whitespace first: prose wraps mid-phrase, and "usage\n  ping" sat in a
+    // command file for two releases because this regex only saw one line at a time.
+    if (NO_TELEMETRY.test(read(rel).replace(/\s+/g, " ")))
       fail(rel, "mentions telemetry — it was removed in 2.3.0; nothing may ping or ask for consent");
   }
 // …and the exempt file may only REMOVE it: naming a send/ping/consent path there is still a bug.
@@ -173,22 +177,28 @@ for (const c of KANBAN_STAGES) {
     fail(path, "no instruction to run the resolver before concluding there is no board");
 }
 
-// ── shipped scripts ─────────────────────────────────────────────────────────
-// Every scripts/*.sh must be copied by BOTH shell installers. Callers chain these
-// with `|| true`, so one an installer forgets is a silent no-op forever — no kanban
-// card moves, no error. CI is the only place this is loud.
-// The third installer, bin/cli.js (what the `cohorte` CLI runs), copies by rule rather
-// than by name, so grepping for filenames can't see it — ci.yml dry-runs it into a
-// scratch HOME and asserts the same postconditions instead. Both are needed: this
-// check catches a forgotten name, that one catches a drifted rule.
+// ── shipped scripts + thin installers ───────────────────────────────────────
+// Every shipped scripts/*.sh must be asserted by the ci.yml install dry-run —
+// bin/cli.js copies by rule rather than by name, so only a postcondition on the
+// copy that actually runs can catch a rule that misses a new script. Callers
+// chain these with `|| true`, so a missing one is a silent no-op forever.
 // A `<name>.sh` with a `<name>.sh.template` sibling is a locally-rendered artifact
 // (this repo dogfoods its own /cohorte-init-pipeline), not a core asset — skip those.
-const installers = { "install.sh": read("install.sh"), "install.ps1": read("install.ps1") };
 const shipped = readdirSync(join(root, "scripts"));
 for (const f of shipped.filter((f) => f.endsWith(".sh") && !shipped.includes(`${f}.template`)))
-  for (const [name, src] of Object.entries(installers))
-    if (!src.includes(`scripts/${f}`) && !src.includes(`scripts\\${f}`))
-      fail(name, `never copies scripts/${f} into pipeline/scripts/ (silent no-op at runtime)`);
+  if (ciYmlText && !ciYmlText.includes(`pipeline/scripts/${f}`))
+    fail(".github/workflows/ci.yml", `install dry-run never asserts pipeline/scripts/${f} (a copy rule that misses it is a silent no-op at runtime)`);
+// The shell installers are THIN DELEGATORS to bin/cli.js — their legacy copy-verbatim
+// path was unreachable dead code from 2.2.0 (removed in 2.7.0), and its text was what
+// this file's copy checks used to vacuously match. Pin the shape: both must hand off
+// to the CLI and neither may grow its own copy logic back.
+for (const [name, marker] of [["install.sh", "cp -R \"$src/core"], ["install.ps1", "Copy-Tree"]]) {
+  const text = read(name);
+  if (!text.includes("bin/cli.js") && !text.includes("bin\\cli.js"))
+    fail(name, "no longer delegates to bin/cli.js — the only renderer of runtime-neutral sources");
+  if (text.includes(marker))
+    fail(name, "carries its own core-copy logic again — installs must go through bin/cli.js (no shell renderer exists)");
+}
 
 // ── workflow scripts ────────────────────────────────────────────────────────
 // core/workflows/*.js run inside the Claude Code Workflow runtime: an async
@@ -223,12 +233,36 @@ else for (const f of readdirSync(workflowsDir)) {
     fail(path, `does not parse as a workflow body: ${e.message}`);
   }
 }
-// Both shell installers must copy the workflows dir (bin/cli.js copies by rule,
-// covered by the ci.yml dry-run).
-if (!installSh.includes("core/workflows"))
-  fail("install.sh", "does not copy core/workflows (copy_core)");
-if (!installPs1.includes("core\\workflows"))
-  fail("install.ps1", "does not copy core\\workflows (Copy-Core)");
+// Workflow meta.names and command names share one mental namespace — both are the
+// "/cohorte-…" way a human asks for a phase. A meta.name that MATCHES a
+// core/commands/<name>.md is a declared variant pair (same phase, two execution paths —
+// review/audit/refactor, on purpose). A meta.name matching neither a command nor the
+// deliberate command-less list below is a typo'd variant: the human asks for "the
+// review workflow", the lead resolves the name, and a mismatched name runs nothing.
+// cohorte-loop is command-less BY DECISION (SCHEMA.md §Workflows): when the Workflow
+// runtime is unavailable it must refuse explicitly, never degrade to a conversational
+// loop — so a core/commands/cohorte-loop.md appearing later is a regression, not an
+// addition, and the check below this one pins that too.
+const COMMANDLESS = ["cohorte-loop"];
+if (existsSync(workflowsDir)) for (const f of readdirSync(workflowsDir)) {
+  if (!f.endsWith(".js")) continue;
+  const path = `core/workflows/${f}`;
+  const m = read(path).match(/name:\s*'([^']+)'/);
+  if (!m) { fail(path, "meta has no parseable `name: '…'`"); continue; }
+  const name = m[1];
+  if (!name.startsWith(PREFIX))
+    fail(path, `meta.name '${name}' lacks the \`${PREFIX}\` prefix`);
+  else if (!existsSync(join(root, "core/commands", `${name}.md`)) && !COMMANDLESS.includes(name))
+    fail(path, `meta.name '${name}' matches no core/commands/${name}.md and is not in the ` +
+      `deliberate command-less list — a variant pair must share the name exactly, or the ` +
+      `workflow-only decision must be recorded in COMMANDLESS`);
+}
+if (existsSync(join(root, "core/commands/cohorte-loop.md")))
+  fail("core/commands/cohorte-loop.md", "must not exist — /cohorte-loop is workflow-only " +
+    "(no conversational fallback, by decision; see core/workflows/loop.js header)");
+
+// The workflows dir reaching installs is covered per-file by the ci.yml dry-run
+// assertions checked just below (the shell installers delegate to bin/cli.js).
 
 // A new workflow script must also be KNOWN to the things that check for it, or it
 // ships and nothing notices when an installer stops copying it. This check exists
@@ -286,11 +320,10 @@ const pkg = JSON.parse(read("package.json"));
 for (const negation of ["!core/hooks/__pycache__", "!**/*.pyc"])
   if (!(pkg.files || []).includes(negation))
     fail("package.json", `\`files\` must carry the ${negation} negation (.npmignore cannot do this)`);
-for (const [name, src] of Object.entries(installers))
-  if (!src.includes("__pycache__"))
-    fail(name, "never scrubs hooks/__pycache__ — cp -R would carry it into the user's .claude");
 if (!read("bin/cli.js").includes("__pycache__"))
   fail("bin/cli.js", "copyCore() never excludes __pycache__ from the hooks copy");
+if (ciYmlText && !ciYmlText.includes("hooks/__pycache__"))
+  fail(".github/workflows/ci.yml", "install dry-run never asserts hooks/__pycache__ is absent — a compiled cache would ride into the user's .claude unnoticed");
 
 // ── report ──────────────────────────────────────────────────────────────────
 if (errors.length) {