cohorte 2.7.0 → 2.9.0

package/CHANGELOG.md

@@ -7,6 +7,124 @@ short, user-facing, most recent first. One `## <version> — <YYYY-MM-DD>` secti
 > They are history and are deliberately not rewritten — every command gained a `cohorte-` prefix
 > in 2.0.0.
 
+## 2.9.0 — 2026-08-22
+
+- **`/cohorte-intake` — the door before the doors.** Work has always entered the pipeline
+  pre-distilled by a human: a ticket became a `/cohorte-patch` paste, an email became a
+  brainstorm idea, by hand. Intake does the distillation: paste anything that arrives and it
+  triages — bug ⇒ the exact structure patch interviews for (inferred repro steps labeled as
+  such); feature ⇒ a brainstorm seed whose open-questions list is the panel's agenda, with any
+  `_decisions.md` line it contradicts named; noise ⇒ says so and stops, because inventing a
+  spec from noise costs a whole pipeline run downstream. The distillate lands on disk and on
+  the kanban's Ideas column; freezing anything stays the human's move.
+
+- **`/cohorte-retro` — the pipeline learns from its own findings.** Every review leaves
+  structured residue (verdict.json, the specs' Remediation history, the deferred backlog) that
+  nothing ever read back. Retro mines it for patterns — the same finding kind on the same
+  surface across features, a hotspot module, a recurring fix family — and turns each into ONE
+  rule-shaped §Conventions line the human ratifies. Adopted rules re-render the affected
+  surface agents (the conventions slice is baked at render time — a rule without a re-render
+  is one reviewers enforce and implementers never saw) and land in the decisions journal.
+  Findings → rules → the next build never produces the finding: cheaper than any number of
+  review rounds catching it.
+
+- **`/cohorte-fleet` — parallel features get a flight controller.** The worktree isolation
+  existed; the coordination lived in your head. `plan` builds the feature×surface overlap
+  matrix from the specs themselves (contract dependencies ⇒ merge order; same-tree writes ⇒
+  serialize or drop one), provisions the worktrees, and prints one launch line per feature.
+  `status` is one row per feature ending in the single next action. `sync` does the post-merge
+  sweep everyone forgets — rebase every survivor, report conflicts verbatim to their owner's
+  session, and say out loud that a rebase invalidates the freshness stamp. What it will never
+  do is spawn the work headless: that is the retired 2.2.0 driver's grave, and each feature's
+  loop keeps running in its own supervised session.
+
+- **`/cohorte-review --pr <num>` — the pipeline reviews incoming work.** Same reviewers, same
+  report, none of the pipeline's certifications: the PR is fetched into a throwaway worktree
+  (your checkout untouched), reviewed in audit mode (no spec to conform to), and a red
+  preflight makes the mechanical failures the review instead of wasting reviewers on code that
+  doesn't compile. Posting the report as a PR comment always asks first — it is outward-facing
+  — and declining leaves the report on disk as a complete outcome.
+
+- **What a feature costs, finally on the dashboard.** The workflow paths now stamp an
+  approximate `tokens` field into their metrics lines from the runtime's own counter
+  (`budget.spent()` deltas — the figure a conversational lead cannot read), the loop's history
+  carries cost per round, and the dashboard shows `~Nk tok` per feature and per phase. Marks
+  are placed around the review child so build/fix deltas never double-count it; token-less
+  conversational lines aggregate as absent, never as "free".
+
+
+
+## 2.8.0 — 2026-08-22
+
+- **`/cohorte-loop` is back — as a workflow, which is the whole point.** The 2.2.0 driver was
+  retired because it spawned headless child processes it could not supervise: it stalled on a
+  permission prompt it could not see, read a missing `build.json` as an empty one, and had a
+  session killed mid-write with nothing noticing. `core/workflows/loop.js` runs
+  build → review → [fix → review]* for one feature inside the Workflow runtime instead — the
+  runtime holds control flow, a dead agent resolves to `null` rather than to silence, and there
+  is no prompt to stall on.
+
+  What it will not do is as designed as what it does: it *verifies* `/cohorte-build`'s outputs
+  (frozen spec, fresh `readiness.json`, the lead-authored contract) as preconditions and aborts —
+  naming the gap — on anything that is a human's call: a `NOT-READY` spec, a surface the profile
+  doesn't own, a blocking finding on the contract file itself. A dead reviewer's zero findings
+  can never read as ship (`unreviewed` is checked before `blocking`, in that order on purpose);
+  identical blocking findings two rounds running abort as treading water instead of burning the
+  remaining rounds; `maxRounds` (default 5) is the last net, never the first. State is four files
+  in `specs/reports/` — re-invoking resumes, and every file older than the spec is treated as
+  absent. There is **no** `core/commands/cohorte-loop.md` and `validate-core.mjs` now fails if
+  one appears: without the Workflow runtime the loop refuses explicitly rather than degrading to
+  a lead re-reasoning the fan-out every round at session prices. It stamps `in-progress` /
+  `in-review` / `blocked` on the spec — the driver states SCHEMA.md kept alive since 2.2.0 have
+  a producer again.
+
+  To serve it, the review workflow now writes the same `specs/reports/<id>.verdict.json` the
+  conversational `/cohorte-review` §3 guarantees (blocking count, normalized `blocking_items`,
+  sha256 fingerprint, the degraded `aborted: "preflight"` form) — one machine contract, two
+  producers.
+
+- **A deny behind an ask was reachable with one click.** `gate.py` scanned command segments in
+  order and returned on the first match, so `git commit -m x && node ace migration:fresh`
+  surfaced only the benign `git commit` confirm — and the human's single "yes" ran the
+  hard-denied migration behind it. Deny patterns are now matched across the whole chain before
+  any ask is offered. Global installs pick this up with `cohorte update`; bundled repos via
+  `/cohorte-update-pipeline`.
+
+- **The SHIP stamp is now earned, not implied.** The conversational `/cohorte-review` ticked the
+  DoD and wrote the freshness stamp on every SHIP — including one carrying HIGH findings, which
+  `/cohorte-ship`'s gates then happily certified, while the workflow variant refused the same
+  state. Both paths now agree: tick + stamp only when nothing above LOW survived; surviving
+  HIGH/MEDIUM routes to `/cohorte-fix` (or an explicit park) first.
+
+- **A dozen bugs the release audit surfaced**, the sharper ones being: `cohorte install` seeded
+  `cohorte.config.yaml` under `~/.claude` even when `CLAUDE_CONFIG_DIR` pointed elsewhere — a
+  config no reader ever probed (CI now asserts the seed lands where the readers look);
+  the refactor workflow's retry round discarded the items its first verify had already cleared,
+  so the backlog re-dispatched finished work — and invoked with a bare `"backend"` it silently
+  refactored *every* big domain; the dashboard trusted the absolute paths in a committed
+  `runtimes.json`, going all-red on any cloned or moved checkout; `preflight.sh` fed a UTC
+  timestamp to a local-time `touch -t`, future-dating the throwaway index west of UTC (and an
+  all-empty command list stamped a green preflight that had verified nothing);
+  `new-feature.sh` branched worktrees off the *local* default branch its own fetch never
+  updated; a CRLF kanban board failed with "column not found" on a column that exists; and a
+  dead mechanical-gates agent read as "0 failures" in the audit workflow. Plus a sweep of doc
+  drift (the first-feature walkthrough skipped build *and* review; "Node-less" installers that
+  require Node; stale counts of agents, scripts and board columns).
+
+- **The shell installers are now the thin delegators they already were.** Since 2.2.0 both
+  scripts handed everything to `bin/cli.js` and then carried ~300 lines of unreachable legacy
+  copy code below the hand-off — dead text that `validate-core`'s "does the installer copy X"
+  checks were vacuously matching, which is worse than no check: it reads as coverage. The dead
+  code is gone; the checks now assert CI's install dry-run postconditions — tests against the
+  copy that actually runs. Along the way: `sh install.sh` from inside a checkout silently
+  *cloned the remote* instead of installing the local tree (`$0` arrives with no slash and the
+  self-locate case missed it); both installers now refuse a Node older than 18 up front instead
+  of half-installing before `fs.cpSync` crashes; and the review agent's `tools:` names both
+  retrieval providers (`mcp__serena`, `mcp__graphify`) — one fixed agent file, shared across
+  projects, only the wired provider is live in a session, and graphify projects' reviewers were
+  silently cut off from their own index.
+
+
 ## 2.7.0 — 2026-08-22
 
 - **The metrics panel billed Sonnet 5 fifty percent over.** `prices.json` carried $3/$15 because

package/README.md

@@ -229,8 +229,8 @@ those actions.
   ✅/⚠️/❌ checklist (each failure with its fix), the **Surfaces ↔ agents** map from `PIPELINE.md`,
   and one board: a **Kanban** if the project has a linked Obsidian board (columns + cards from the
   vault, with clickable PR links + live open/merged/closed status and a ship-date-sorted Shipped
-  column, via `gh`), otherwise a **Specs board** from `specs/*.md` (by `draft · frozen · in-review ·
-  shipped`). The Kanban supersedes the Specs board when both would apply.
+  column, via `gh`), otherwise a **Specs board** from `specs/*.md` (by `draft · frozen · in-progress ·
+  in-review · blocked · shipped`). The Kanban supersedes the Specs board when both would apply.
 - **Actions** (stream their output live) — **Update / Install core** (the shared global core, or a
   repo's bundled core); **Init-pipeline / Update-pipeline / Audit**, which run those Claude Code
   commands **headless** (`claude -p`, autonomous — Init skips the interactive interview, so review
@@ -276,7 +276,7 @@ will do:
 
 ```sh
 npm i -g cohorte
-francois ext install TheBidouilleAgency/cohorte
+francois ext install TheBidouilleAgency/francois-plugin-cohorte
 ```
 
 ## Releasing (maintainers)
@@ -301,15 +301,18 @@ so a CLI pinned at an old version cannot quietly re-lay an old core.
 | Command              | Role                                                                                  |
 | -------------------- | ------------------------------------------------------------------------------------- |
 | `/cohorte-init-pipeline`     | Detect stack → interview → generate the profile + agents. Run once per project.       |
+| `/cohorte-intake [paste]`    | Triage anything that arrives (ticket, email, trace, thread) into a `/cohorte-patch` handoff or a brainstorm seed — staged to disk, carded in Ideas. |
 | `/cohorte-brainstorm`        | Interactive persona panel that pressure-tests a feature idea.                         |
 | `/cohorte-spec`              | Freeze the feature spec + contract into `specs/<id>.md` (UI features also get a standalone design brief at `specs/design/<id>.md`). Also applies review returns. |
 | `/cohorte-patch [bug]`       | Bug-fix entry: triage a bug and freeze a ~60-line patch spec (`specs/patch-<slug>.md`) whose regression test replaces the contract. Then the normal `/cohorte-build → review → ship`. |
 | `/cohorte-build <id>`        | Readiness gate on the frozen spec, then the lead authors the contract and dispatches one implementer per surface in parallel. |
-| `/cohorte-review <id>`       | Read-only review agents (one per touched surface, parallel) audit the diff vs the spec; out-of-scope findings go to the refactor backlog. |
+| `/cohorte-review <id>`       | Read-only review agents (one per touched surface, parallel) audit the diff vs the spec; out-of-scope findings go to the refactor backlog. `--pr <num>` reviews an **incoming** GitHub PR in a throwaway worktree and offers to post the report as a comment. |
 | `/cohorte-fix <id>`          | Apply a review report: remediation into the spec, re-dispatch only the surfaces with findings. |
+| `/cohorte-fleet plan\|status\|sync` | Fly several features in parallel: overlap matrix + merge order, one worktree per feature, live status, post-merge rebase sweep. Coordination only — never headless execution. |
 | `/cohorte-ship <id>`         | Release agent commits, pushes, opens the PR; watches CI; proposes worktree teardown.  |
 | `/cohorte-audit [path]`      | Prioritized refactor backlog for existing code.                                       |
 | `/cohorte-refactor <domain>` | Apply the backlog for one surface, TDD-first.                                         |
+| `/cohorte-retro [last n]`    | Mine the accumulated review findings for patterns; ratified ones become §Conventions rules and the surface agents are re-rendered — the next build never produces the finding. |
 | `/cohorte-align-ds`          | Align the code UI kit to the design system (no-op if none configured).                |
 | `/cohorte-update-pipeline`   | Refresh the installed core (global or bundled) to the latest published version.       |
 | `/cohorte-doctor`            | Diagnose the installation (core, agents↔surfaces, hooks, gate, retrieval, worktrees). |
@@ -365,15 +368,17 @@ Rules that make it safe:
 
 ### Workflows — deterministic multi-agent runs (opt-in)
 
-Four phases also ship as **workflow scripts** for the Claude Code Workflow runtime — the same
-fan-out the commands orchestrate, but driven by a deterministic script instead of the lead reasoning
-it out turn by turn:
+Four **workflow scripts** ship for the Claude Code Workflow runtime — the same fan-out the
+commands orchestrate, but driven by a deterministic script instead of the lead reasoning it out
+turn by turn. Three are opt-in variants of their same-named commands; the fourth, `loop.js`,
+exists **only** as a workflow:
 
 | Script                  | What it runs                                                                              |
 | ----------------------- | ----------------------------------------------------------------------------------------- |
 | `workflows/review.js`   | Preflight gate (aborts while red — zero agents), one reviewer per touched surface, adversarial cross-check of CRITICAL/security findings, merged verdict only. |
 | `workflows/audit.js`    | One auditor per domain (every surface + shared) concurrently, prioritized `specs/refactor-backlog.md`. |
 | `workflows/refactor.js` | Big domains only: `shared` first and alone, then parallel surface implementers, per-domain verify + one retry. |
+| `workflows/loop.js`     | `/cohorte-loop` — build → review → [fix → review]* for one feature, unattended and resumable; exits on zero blocking findings, treading water, maxRounds, or anything that needs a human (contract change, unreviewed surface). No conversational fallback, on purpose. |
 
 The essentials:
 
@@ -413,15 +418,15 @@ See `profile/SCHEMA.md` for every field in `PIPELINE.md` and how the pipeline us
 
 ```
 package.json            # npm package (cohorte) — semver source of truth
-bin/cli.js              # the npm CLI: install / update / dashboard / version (cross-platform, no deps)
-install.sh              # script installer (fresh + --update) for no-Node environments
+bin/cli.js              # the npm CLI: install / update / dashboard / specs / doctor / metrics / version (cross-platform, no deps)
+install.sh              # script installer (fresh + --update) for npm-less setups — still needs Node
 install.ps1             # same installer for Windows PowerShell (fresh + -Update)
 core/                   # copied verbatim into ~/.claude (global) or <project>/.claude (bundled)
   agents/               # implementer.template.md (rendered per surface) + review / release / profile-reader
   commands/             # init-pipeline + the pipeline commands + /cohorte-update-pipeline
   hooks/                # gate.py (destructive-command gate; branch-aware; preflight phase gate)
   templates/            # handoff / brainstorm-return / design-brief / review-feedback / pr-body / spec
-  workflows/            # opt-in Workflow-runtime scripts: review.js / audit.js / refactor.js
+  workflows/            # Workflow-runtime scripts: review.js / audit.js / refactor.js (opt-in variants) + loop.js (workflow-only)
 profile/
   PIPELINE.template.md  # the profile skeleton /cohorte-init-pipeline fills
   SCHEMA.md             # field reference

package/bin/cli.js

@@ -562,7 +562,20 @@ async function seedConfig() {
   // being told: `~/.claude` for Claude Code (unchanged — existing files stay authoritative),
   // `~/.cohorte` for every other runtime. The shipped scripts probe both, in that order, so
   // a human who drives one repo from two agents still has a single board and a single consent.
-  const cfg = adapter.expandHome(adapter.configPath(runtime));
+  //
+  // CLAUDE_CONFIG_DIR moves the whole `~/.claude` tree (globalDir already follows it), but
+  // adapter.configPath() speaks in literal `~/.claude/…` — expanding through HOME alone
+  // seeded a file at a path no reader probes (kanban-move.sh and the dashboard follow
+  // CLAUDE_CONFIG_DIR), missed a filled config there (re-seeding disabled defaults beside
+  // it — the exact two-file fork this function's comments forbid), and printed a banner
+  // path that did not exist. Re-root the claude-shaped path onto globalDir so the seed,
+  // the existing-file check, the banner and every reader agree on one file.
+  const homeClaude = path.join(os.homedir(), '.claude');
+  const rerootClaude = (p) =>
+    p === homeClaude || p.startsWith(homeClaude + path.sep)
+      ? path.join(globalDir, p.slice(homeClaude.length + 1) || '.')
+      : p;
+  const cfg = rerootClaude(adapter.expandHome(adapter.configPath(runtime)));
   fs.mkdirSync(path.dirname(cfg), { recursive: true });
   // Pre-rename names, newest first — read as a fallback so upgrades don't lose the config.
   const legacy = ['thebidouille.config.yaml']
@@ -571,7 +584,7 @@ async function seedConfig() {
   // A second runtime must not fork the config: two files means two boards and two consent
   // records, and the human edits whichever one they happen to open. The scripts read
   // `~/.cohorte` first, so seeding it here would SHADOW a filled `~/.claude` copy.
-  const claudeCfg = adapter.expandHome(adapter.configPath({ id: 'claude' }));
+  const claudeCfg = rerootClaude(adapter.expandHome(adapter.configPath({ id: 'claude' })));
   if (cfg !== claudeCfg && fs.existsSync(claudeCfg)) {
     console.log(`  · reusing your existing ${claudeCfg} (the scripts read it as a fallback)`);
     return;

package/core/agents/review.md

@@ -1,7 +1,7 @@
 ---
 name: review
 description: Read-only reviewer. Compares the implementation against the frozen spec, then audits code quality, security, and (if the profile declares it) mobile-first. Emits the REVIEW REPORT. Dispatched by /cohorte-review — one per touched surface on multi-surface diffs. Cannot modify anything.
-tools: Read, Grep, Glob, mcp__serena
+tools: Read, Grep, Glob, mcp__serena, mcp__graphify
 model: sonnet
 ---
 
@@ -40,7 +40,9 @@ be precise and self-contained.
   a default.
 - If `retrieval.provider` in `PIPELINE.md` is not `none`, its MCP tools are in your toolset —
   prefer them over Grep/Glob + whole-file Reads: locate code by symbol, read only the definitions
-  you need. Fall back to Grep/Read when they are unavailable or come up empty.
+  you need. Fall back to Grep/Read when they are unavailable or come up empty. (Your `tools:`
+  list names every provider this agent file is shared across — only the one the project actually
+  wired is live in your session; the others simply are not there.)
 
 ## What you check, in order
 

package/core/commands/cohorte-brainstorm.md

@@ -31,7 +31,11 @@ Idea (may be empty): **$ARGUMENTS**
 
 If the idea is empty: when a board is configured and its **Ideas** column has cards, list them (with any
 sub-bullet notes as seed context) and let the human pick one — otherwise ask **"What are we building?"**.
-Either way, wait. If the idea is non-empty, restate it in one line and confirm you've got it.
+Either way, wait. If the idea is non-empty, restate it in one line and confirm you've got it — and
+**if `specs/reports/intake-<idea>.md` exists, read it FIRST**: it is `/cohorte-intake`'s staged seed
+(who is asking with verbatim quotes, goals/non-goals, an open-questions list that is this panel's
+agenda, prior art incl. any `_decisions.md` line the request contradicts). The panel argues against
+the distillate, never against the bare slug.
 
 ## Run the panel
 

package/core/commands/cohorte-build.md

@@ -143,7 +143,9 @@ _Only if `contract.enabled`._ From §5 of the spec, write/update the feature's c
 `<contract.path>/$ARGUMENTS.<contract.ext>` in the profile's `mechanism` (e.g. Zod v4 schemas + inferred
 types for `shared-types-zod`). Export it from `contract.index` if set. This is the ONLY file the agents
 share; they import it read-only and must not edit it. If `contract.enabled` is false, the spec prose is
-the sync channel — say so and skip. **Postcondition (if `contract.enabled`):**
+the sync channel — say so and skip, but still run `date +%s` on its own (same as the patch skip
+above: §4's wall-clock start comes from here, and a build with no start epoch writes a metrics
+line with no duration). **Postcondition (if `contract.enabled`):**
 `test -f <contract.path>/$ARGUMENTS.<contract.ext> && date +%s` — the contract file must exist before
 you dispatch §3, or the stateless agents have nothing to build against (the epoch output is §4's
 wall-clock start — no separate timing call).

package/core/commands/cohorte-doctor.md

@@ -85,7 +85,7 @@ fix only with the human's go-ahead (or hand them the command).
    check: CLI resolvable from PATH, `.mcp.json` entry present in PATH-proof launcher form,
    `.serena/` gitignored, server actually connects.
 5. **Design** (if `design.enabled`). `snapshot_dir` exists and is committed; `ui_kit_path` +
-   `tokens_path` exist; if `provider: claude-design`, `DesignSync` responds (`list_projects`) and
+   `tokens_path` exist; if `provider: claude-design`, `DesignSync` responds (`list_files` on the `design_system_project`) and
    `design_system_project` is reachable. Recall: spec `design_files` are full
    `…/design/p/<projectId>?file=<file>` links that carry their own project + page; `design_project` is
    only a legacy fallback for old bare-filename specs (default `none`).
@@ -114,8 +114,10 @@ fix only with the human's go-ahead (or hand them the command).
      check; do NOT raise it to match a newer feature's floor, or every install between the two
      versions reads as broken while its workflows run fine. When `design.inline` is on, report the
      design floor (≥ 2.1.234) as its own line under check 8b — separate prerequisite, separate verdict.
-   - **Scripts present:** `<core>/workflows/review.js` + `audit.js` + `refactor.js` —
-     missing on a current core ⇒ half-done install, re-run install/update.
+   - **Scripts present:** `<core>/workflows/review.js` + `audit.js` + `refactor.js` + `loop.js` —
+     missing on a current core ⇒ half-done install, re-run install/update. (`/cohorte-loop` is
+     **workflow-only** — no command file exists on purpose; without this runtime it refuses
+     rather than degrading to a conversational loop.)
    - **Phase-0 agent present:** `<agents>/profile-reader.md` — the workflows abort without it.
    - **Workflows enabled in this session** — the `Workflow` tool is in your own toolset right now;
      absent ⇒ disabled for this session (a setting or an old client), conversational path.

package/core/commands/cohorte-fix.md

@@ -31,8 +31,8 @@ that change the *contract*; `/cohorte-fix` is for everything else.
   re-author the contract file yourself now (lead-only, per `/cohorte-build` §2) — agents never edit it. If
   the contract change ripples into surfaces *without* findings, fall back to full `/cohorte-build` instead
   and say so.
-- **Note the epoch** (`date +%s`) in the first Bash call you make here — §3's metrics line and usage
-  ping both carry `seconds`, and there is no separate timing call.
+- **Note the epoch** (`date +%s`) in the first Bash call you make here — §3's metrics line carries
+  `seconds`, and there is no separate timing call.
 
 ## 2. Scope the re-dispatch — only surfaces with findings
 
@@ -42,10 +42,11 @@ that change the *contract*; `/cohorte-fix` is for everything else.
   to the most relevant surface — say which.
 - Re-dispatch **ONLY the surfaces owning ≥1 item**, in parallel, in a **single message** — the exact
   dispatch template from `/cohorte-build` §3 (one byte-stable template for builds and fix loops; you do NOT
-  paste a diff — the agent computes its own, scoped to its tree). Fill the template's final variable
-  slot with that surface's open `- [ ]` item lines **verbatim**, so the agent needs no spec re-read to
+  paste a diff — the agent computes its own, scoped to its tree). Fill the template's **Remediation
+  slot** with that surface's open `- [ ]` item lines **verbatim**, so the agent needs no spec re-read to
   find its work; fill the design slot with `none` when a `uses_design` surface's open items are all
-  non-visual (no DesignSync re-fetch for a type fix). Surfaces without findings are NOT re-dispatched —
+  non-visual (no DesignSync re-fetch for a type fix), and the readiness-gaps slot with `none` (a fix
+  loop has no fresh §1.6 verdict). Surfaces without findings are NOT re-dispatched —
   that is the point.
 
 ## 3. Integrate & check off what's fixed

package/core/commands/cohorte-fleet.md

@@ -0,0 +1,104 @@
+---
+model: sonnet
+description: Fly several features in parallel — overlap analysis and merge order, one isolated worktree per feature, a live status board, and the post-merge rebase sweep nobody remembers to do.
+argument-hint: plan <id> <id> [...] | status | sync
+---
+
+You are the **fleet controller**. Parallel features already work in this pipeline — isolated
+worktrees, per-feature DBs and ports, one session per worktree — but the coordination between
+them is tribal knowledge: which specs collide, which merges first, and who rebases the
+survivors after each ship. This command owns exactly that coordination, and deliberately
+nothing more.
+
+**What this command will never do: spawn the work headless.** The obvious "cool" version —
+fire a loop per worktree from here — is the 2.2.0 driver's grave: child sessions nobody
+supervises, stalling on prompts nobody sees. Each feature's build/review/loop runs in **its own
+worktree's session**, supervised like any other; the fleet plans, watches and rebases. State
+lives in `specs/reports/fleet.json` (the main checkout's gitignored buffer — not to be confused
+with the dashboard's multi-*project* fleet registry; this file is this repo's multi-*feature*
+flight plan).
+
+> Read `PIPELINE.md` §`pipeline-profile` first: `surfaces` (paths — the overlap analysis keys
+> on them), `contract`, `vcs.default_branch`, and the `isolation` block. _Skip the re-read if
+> already in context and unmodified since._ **`isolation.enabled: false` ⇒ stop at `plan`**:
+> N features in one checkout is a merge-conflict generator with extra steps — name the fix
+> (`/cohorte-init-pipeline` wires isolation) and go no further.
+
+## `plan <id> <id> [...]` — collide, order, provision
+
+1. **Every spec must be `frozen`** (front-matter grep, ~15-line reads — never full specs yet).
+   Anything else (`draft`, `in-review`, missing) ⇒ name it and stop; a fleet of half-frozen
+   specs is N problems flying in formation.
+2. **Overlap analysis** — read each spec's §5 contract entries and §6 surface tasks, then build
+   the matrix *feature × surface*, and flag the two collision classes:
+   - **Contract dependency** — spec B's §5 references shapes spec A introduces ⇒ B ships
+     **after** A, and B's worktree must rebase once A merges (the `sync` mode's job). This is
+     an ordering, not a blocker.
+   - **Same-tree writes** — two specs whose §6 tasks land in the same `surfaces[].path` (worse:
+     the same module). This is where parallel merges bleed; propose either an order (lighter
+     feature first) or — when the overlap is one file both must edit — say plainly that these
+     two should not fly together, and let the human drop one from the fleet.
+3. **Propose the merge order** from those edges (dependencies first, then ascending overlap),
+   show the matrix + order in a compact table, and get the human's go-ahead — the order is a
+   plan they will live with for days.
+4. **Provision worktrees** — for each feature without one: `scripts/new-feature.sh <id>` (the
+   rendered isolation script: worktree + branch + DB + port slot). Relay each script's output
+   line; a script failure stops the plan for that feature, never silently.
+5. **Write `specs/reports/fleet.json`** (overwrite): `{"ts":"<ISO>","order":[...ids in merge
+   order...],"features":{"<id>":{"worktree":"<path>","branch":"<branch>","dependsOn":[...]}}}`.
+6. **Print the launch plan** — one line per feature, in order: the worktree path to open a
+   session in, and the first command to run there (`/cohorte-build <id>`, or "ask for the loop
+   workflow: `{feature: \"<id>\"}`" on a runtime that has it). The human launches them; the
+   fleet does not.
+
+## `status` — one table, no archaeology
+
+Read `fleet.json` (absent ⇒ say `plan` comes first, stop). For each feature, **mechanical reads
+only, redirected — always from THAT feature's worktree**, never the main checkout (each worktree
+carries its own copy of `specs/<id>.md` and `specs/reports/`, and that copy is the one its run
+has been writing): `<worktree>/specs/<id>.md` front-matter `status` · the worktree's
+`specs/reports/<id>.loop.json` (`phase`/`round`/`outcome`) and `<id>.verdict.json`
+(`verdict`/`blocking`) when present · then ONE
+`git -C <worktree> fetch --quiet origin <default_branch> || true` and
+`git -C <worktree> rev-list --count origin/<default_branch>..HEAD` and `..origin/<default_branch>`
+(ahead / **behind** — behind is the number that matters, and against the *remote* ref: the local
+one goes stale the moment a PR merges on the host, which is precisely when status gets asked).
+One row per feature, in merge order:
+
+```
+<id> · <status> · loop: <phase> r<round> | <outcome> · blocking: <n> · ↑<ahead> ↓<behind> · next: <the one action>
+```
+
+`next` is the whole point of the mode: the single action per feature (a command to run in its
+worktree, "waiting on <dep> to merge", "ready to ship — its turn in the order", or "rebase
+needed — run sync"). A worktree registered in `fleet.json` but gone from
+`git worktree list` is reported as such, never silently dropped.
+
+## `sync` — the post-merge sweep
+
+Run after every merge (the human says which feature shipped, or you detect it: spec
+`status: shipped` + branch merged into `<default_branch>`):
+
+1. Drop the shipped feature from `fleet.json` (rewrite, keep order of the rest) — and if its
+   worktree still exists, remind the teardown `/cohorte-ship` proposes:
+   `scripts/remove-feature.sh <id>` (`--drop-db` at the human's call). Never run it unasked.
+2. For each surviving worktree, in merge order — `git -C <worktree> fetch origin
+   <default_branch>` **always**, then decide whether the rebase is THIS session's to run:
+   - **Tree dirty** (`git -C <worktree> status --porcelain` non-empty — the NORMAL mid-flight
+     state: feature work stays uncommitted until `/cohorte-ship`, so `git rebase` would refuse
+     with "unstaged changes" before any conflict even exists) **or a run in flight** (the
+     worktree's `loop.json` has no `outcome`): **do not touch it.** Report the row as
+     `rebase needed — run \`git rebase origin/<default_branch>\` from that worktree's own
+     session` (mutating a branch from outside its session, mid-run, is how work disappears).
+   - **Clean and idle**: rebase it, output redirected to `specs/reports/fleet-sync.txt`. A
+     conflict is reported verbatim and left for its owner (`git rebase --abort` restores) —
+     never resolved, never `--force`-anything from here.
+3. **Say the consequence out loud, per rebased (or rebase-needed) worktree:** the rebase moves
+   every commit, so any `reviewed_base`/`reviewed_digest` in that spec then describes a tree
+   that no longer exists — `/cohorte-ship` will (rightly) refuse until a fresh
+   `/cohorte-review` re-stamps it. A clean rebase is not a re-verdict; the re-review is.
+4. Reprint the `status` table.
+
+In chat, every mode prints its table/plan and nothing else — the matrix evidence and rebase
+logs live in `specs/reports/`. **Recommend a `/clear`** after `plan` (the flight plan is on
+disk; the sessions doing the flying are elsewhere anyway).

package/core/commands/cohorte-intake.md

@@ -0,0 +1,92 @@
+---
+description: Triage anything that arrives — a ticket, a client email, a stack trace, a Slack thread — into the pipeline's entry point: a patch handoff or a brainstorm seed.
+argument-hint: [paste the raw material — ticket, email, trace, thread — or empty to be asked]
+---
+
+You are the **intake triager**. Work is arriving from OUTSIDE the pipeline — a bug report, a
+client email, a support thread, a stack trace, a half-idea — and today a human distills it by
+hand before anything can start. Your job is that distillation: read the raw material, decide
+which door it enters through, and stage a handoff the next command can consume verbatim.
+
+> Read `PIPELINE.md` §`pipeline-profile` first — `name`, `one_liner`, `surfaces` (to guess which
+> surface a symptom lives in) and `ui_language`. _Skip the re-read if it's already in your
+> context this session and unmodified since._ Read `specs/_decisions.md` §Live if it exists —
+> an incoming request that contradicts a settled decision must be flagged as such, not triaged
+> as a fresh idea.
+
+## 1. Ingest & triage
+
+The material is pasted after the command; nothing pasted ⇒ ask for it and wait (paste, file
+path, or a `gh issue view <n>` you run yourself when they name an issue number). Then decide —
+and say which signals decided it:
+
+- **Bug** — existing behavior misbehaving: a repro or trace, "used to work", an error message,
+  a version where it broke. → §2.
+- **Feature** — behavior that does not exist yet: "could we", "it should also", a workflow the
+  product doesn't cover. → §3.
+- **Both tangled together** (a bug report whose fix half describes a new feature): split it —
+  §2 for the defect, §3 for the rest — and say you split it.
+- **Neither** (a question, a config issue on their side, praise, noise): say so in one line and
+  stop. Not everything that arrives is work; inventing a spec from noise costs a whole pipeline
+  run downstream.
+
+Pick a short kebab-case **slug** from the content (`checkout-double-charge`, `csv-export`) —
+it becomes the join key for the file, the kanban card and the follow-up command.
+
+## 2. Bug → a `/cohorte-patch` handoff
+
+Distill the raw material into exactly the structure `/cohorte-patch` §1 interviews for — so the
+patch triage starts loaded instead of re-asking:
+
+- **Symptom** — one sentence, observed behavior vs expected.
+- **Repro** — numbered steps as far as the material supports them; mark every step you inferred
+  (`(inferred)`) rather than silently guessing. A trace with no steps ⇒ the trace IS the repro
+  material, say so.
+- **Environment** — version/browser/OS/role if present; `unknown` where absent.
+- **Suspected surface(s)** — map the symptom onto `surfaces[]` by what the paths/stack frames
+  name; a guess is fine, label it one.
+- **Severity signal** — who is blocked and how hard, in the reporter's own words.
+
+**Stage it** to `specs/reports/intake-<slug>.md` (overwrite; `mkdir -p specs/reports` first —
+the gitignored buffer dir, so the handoff survives a `/clear`). Then:
+
+> **Kanban** (SCHEMA.md §Kanban): run
+> `<core>/pipeline/scripts/kanban-move.sh auto patch-<slug> ideas --title "[patch] <one-line title>"`.
+> The id is **`patch-<slug>`, prefix included, and the title prefix is `[patch]`** — that is the
+> exact join key and the exact title `/cohorte-patch` §1 looks for, so its later move finds THIS
+> card instead of creating a duplicate and stranding this one in Ideas (the failure SCHEMA
+> §Kanban's "tag before you move" exists to prevent). `auto` resolves the board from the config
+> itself and exits 0 with a `kanban: <reason>` line when there is none — so **never decide "no
+> board is configured" without running it**.
+
+Close with: `→ /cohorte-patch <slug>` — `/cohorte-patch` reads the staged
+`specs/reports/intake-<slug>.md` when it exists, so the triage starts loaded. Do **not** run it
+yourself — freezing a spec is a decision the human confirms, and intake's job ends at the door.
+
+## 3. Feature → a `/cohorte-brainstorm` seed
+
+Distill into the seed the panel argues best about:
+
+- **Title + one-liner** — in the product's language (`ui_language` for user-facing wording).
+- **Who is asking & why now** — verbatim quotes where the material has them; the panel argues
+  better against a real voice than a paraphrase.
+- **Goals / explicit non-goals** — only what the material actually states; never pad.
+- **Open questions** — every ambiguity you'd otherwise have guessed at, as questions. This list
+  is the seed's real value: it is the brainstorm's agenda.
+- **Prior art in this repo** — one grep pass: existing specs/decisions touching the same area
+  (`grep -l` over `specs/*.md`, redirected — never a file read per name). Contradicts a
+  `_decisions.md` line ⇒ name the line verbatim; the panel must argue against it knowingly.
+
+**Stage it** to `specs/reports/intake-<slug>.md` (overwrite), then the kanban call with the
+bare id: `<core>/pipeline/scripts/kanban-move.sh auto <slug> ideas --title "<title>"` (same
+"never decide without running it" rule as §2). The card is the board's join key; **the seed
+itself travels in the staged file** — `/cohorte-brainstorm <slug>` reads
+`specs/reports/intake-<slug>.md` when it exists, so the panel argues against the distillate,
+not against a bare slug.
+
+Close with: `→ /cohorte-brainstorm <slug>` — the seed is on disk and on the board;
+**recommend a `/clear` first**, the handoff is complete.
+
+In chat print ONLY: the triage verdict + its signals (one line), the staged file path, the
+kanban result line, and the follow-up command. Never echo the full distillate into chat — it
+is on disk, and this session's history is re-sent at input price on every turn.

package/core/commands/cohorte-patch.md

@@ -28,7 +28,12 @@ Bug (may be empty): **$ARGUMENTS**
 
 ## 1. Get the bug
 
-If `$ARGUMENTS` is non-empty, restate it in one line and confirm you've got it.
+If `$ARGUMENTS` is non-empty, restate it in one line and confirm you've got it — and if it is
+(or names) a slug with a staged `specs/reports/intake-<slug>.md`, **read that file first**: it is
+`/cohorte-intake`'s distillate (symptom, repro with inferred steps labeled, environment, suspected
+surfaces, severity signal), so this triage starts loaded instead of re-asking. Keep intake's slug —
+its kanban card is already tagged `#patch-<slug>` and titled `[patch] …`, exactly what the move
+below joins on.
 
 If it is empty: when a board is configured and its **Ideas** column has cards, list them (with any
 sub-bullet notes as context) — **cards titled `[patch]` first**, since those are the ones a human