novahiz 0.9.9 → 0.11.0

package/CHANGELOG.md

@@ -5,6 +5,109 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
 ## [Unreleased]
 
+## [0.11.0] - 2026-10-22
+
+### Changed
+
+- **`npm install -g novahiz` is the whole install instruction** - the installer
+  now has two modes and two moments. `--core` is the local half: home, skills,
+  plugin, agent, commands, config, catalog. No network, no `sudo`, so it is safe
+  from a postinstall, a CI job or an agent with no terminal. `--extras` is the
+  network/system half (providers and toolchain, global MCP servers, docs index
+  seed, Obsidian vault, npm refresh) and is replayed at the first real `novahiz`
+  call. Without a flag the installer still does everything in one pass, so
+  `novahiz-install` keeps its historical behaviour.
+- **The first `novahiz` run finishes the setup** - npm 11.16+ blocks install
+  scripts unless `allowScripts` covers the package, and a global install has no
+  `package.json` to record that approval in. `bin/novahiz.mjs` therefore runs
+  `--core` when no manifest exists, then `--extras` in the same invocation, and
+  clears `extrasPending`. `NOVAHIZ_NO_EXTRAS=1` and `NOVAHIZ_AUTOINSTALL=0`
+  remain the opt-outs.
+- **Linux and macOS compatibility** - `which()` and `commandExists()` scan
+  `PATH` (plus `PATHEXT` on Windows) instead of spawning `which`/`where`, which
+  Debian minimal and Alpine do not ship. The opencode `shell` setting follows
+  `$SHELL` on macOS/Linux (zsh by default on macOS) instead of hardcoding
+  `bash`, and keeps the `pwsh`/`powershell` probe on Windows. CI gains an
+  `install` job that runs the core installer and the resulting CLI on ubuntu,
+  macos and windows.
+- **Nothing privileged is executed any more** - the core toolchain bootstrap no
+  longer spawns `sudo apt-get install` or `sh -c "curl … | sh"`. Both are
+  printed as the exact manual command (`manual core python - run: …`), so a CI
+  job or an agent can no longer hang on a password prompt. `brew` and `winget`
+  (structured argv, no privilege escalation) stay executable.
+
+### Removed
+
+- **Four redundant entry points** - `install/bootstrap.mjs`,
+  `install/install.sh`, `install/install.ps1` and `bin/veille-mensuelle.ps1`,
+  together with the `novahiz-bootstrap` bin and the `bootstrap` / `bootstrap:dry`
+  scripts. `novahiz-install` is the single installer; `npm run setup:core` and
+  `npm run setup:extras` cover the two modes.
+
+### Fixed
+
+- **`novahiz --version` printed the usage** - the `command === undefined` branch
+  ran before the `--version` flag check.
+
+## [0.10.0] - 2026-10-22
+
+### Fixed
+
+- **The gate and the injected block now agree on the pipeline** - `R6-Novahiz`
+  required plan/clarify/analyse/implement/converge on every workflow prompt,
+  while the roadmap loop only enforced `kind: "skill"`. A lite or Flutter task
+  could therefore announce nothing (or five skills) and be blocked for seven.
+  `R6` is removed and every non-optional roadmap step that carries
+  `requireSkills` is enforced, whatever its kind (`skill`, `edit`, `verify`,
+  `advisory`). `R10-security` is removed too: the audit roadmap already names
+  `novahiz-security`. `R11-accessibility` is narrowed to `design-ui`. The
+  catalogue now holds 13 rules instead of 15.
+- **A trivial follow-up no longer disarms the gate** - the plugin kept the
+  classification in memory only. `continue` / `ok`, or a plugin restart, fell
+  back to `general/trivial` and the gate allowed every edit with `missing: []`.
+  The last non-trivial classification is now persisted in the `sessions` table
+  (schema v3 adds the `prompt` and `tier` columns), `classify --session`
+  returns the effective classification, and the gate CLI reads that state from
+  the database when categories and prompt are empty.
+- **`doctor` reports a schema mismatch** - the schema check hardcoded
+  `ok: true`; it now compares `PRAGMA user_version` with `SCHEMA_VERSION`.
+- **The gate no longer blocks provably read-only shell commands** -
+  `git status`, `git log`, `git diff`, `ls`, `Get-Content` and their
+  equivalents are exempt (`src/readonly.ts`). The gate used to ask for the
+  design skills before it would let an agent read a file.
+- **French UI prompts are no longer fail-open** - `ajoute` / `ajouter` now
+  score as lite and `implémente` as full, so a French additive request reaches
+  the pipeline instead of falling through to trivial. `design-ui` recognises
+  `bouton`, `écran`, `connexion`, `formulaire`, `menu`, `champ`, `icône`,
+  `carte`, `modal`, `header`, `sidebar` and their English forms. Numeric
+  micro-changes (`ajoute 8px de marge`) stay trivial, and debug words
+  (`bug`, `error`, `crash`, ...) subtract from `design-ui` so
+  `fix the login bug` stays in `debug` instead of dragging the design pipeline
+  into a fix.
+
+### Changed
+
+- The gate CLI falls back to the persisted session state when the caller
+  passes no categories and no prompt, instead of letting the decision rest on
+  an empty classification.
+- The plugin asks `classify --session` and, for a trivial continuation,
+  inherits the previous task's prompt so the tier does not drop back to
+  trivial mid-task.
+
+### Added
+
+- **Session state persistence** - `src/session.ts` stores the categories, tier
+  and prompt of the last non-trivial task, with a TTL that keeps a stale
+  session from being mistaken for a continuation.
+- **A read-only allowlist for the gate** - `src/readonly.ts` lists the shell
+  commands the gate can prove do not write.
+- **The `novahiz-capture` skill** - reliable screenshot capture for the
+  physical Playwright browser, when a plain capture comes back stale, blank
+  or cropped.
+- **Three test files** - `tests/session-state.test.ts`, `tests/readonly.test.ts`
+  and `tests/gate-alignment.test.ts` pin the session state, the read-only
+  exemption and the alignment between the classifier and the gate.
+
 ## [0.9.9] - 2026-10-16
 
 ### Changed

package/README.md

@@ -4,7 +4,7 @@
 
 17 catégories, 94 skills, 13 gate rules, 8 MCP providers — tout déterministe, tout local, tout JSON.
 
-> **Version 0.9.0** — publiée sur npm (`npm install -g --allow-scripts=novahiz novahiz` installe et configure tout : core, plugin, agent, skills packs et Playwright MCP). `CHANGELOG.md` et `scripts/` sont dans le tarball.
+> **Version 0.11.0** — `npm install -g novahiz` pose le CLI, et le premier `novahiz` lancé termine l'installation (core puis extras). `CHANGELOG.md` et `scripts/` sont dans le tarball.
 
 ```
 ┌──────────────────────────────────────────────────────────────────────────┐
@@ -41,28 +41,33 @@
 
 ## Démarrage rapide
 
-### Option 1 — En une ligne (recommandé)
+### Option 1 — npm (recommandé)
 
 ```bash
-npm install -g --allow-scripts=novahiz novahiz
+npm install -g novahiz
+novahiz doctor
 ```
 
-Une commande, tout est en place : CLI, core (skills, plugin, agent, commands), skills packs et Playwright MCP.
+`npm install -g` pose le CLI. Le premier `novahiz` lancé termine le reste, en deux passes : le **core** (skills, plugin, agent, commands, config, catalogue — local, sans réseau ni sudo), puis les **extras** (providers et toolchain, MCP globaux dont Playwright, vault Obsidian, rafraîchissement npm). Une seule fois.
 
-**Pourquoi ce drapeau ?** npm 11.16+ ne considère plus les scripts de lifecycle (`postinstall`) comme autorisés tant qu'ils ne figurent pas dans `allowScripts`, et une installation globale n'a pas de `package.json` où l'inscrire : npm affiche alors `npm warn allow-scripts novahiz (...)`, et selon la version il saute le script — auquel cas `novahiz-install` n'a jamais tourné et rien n'est configuré. Le drapeau autorise explicitement ce paquet. Replis :
+**Pourquoi au premier lancement et pas dans le postinstall ?** npm 11.16+ ne lance un script de lifecycle que si le paquet y est explicitement autorisé, et une installation globale n'a pas de `package.json` où l'inscrire : npm avertit (`npm warn allow-scripts novahiz`) et saute le script. Le CLI fait donc le même travail à son premier appel, ce qui fonctionne quelle que soit la version de npm. Pour que tout se passe pendant le `npm install` :
 
 ```bash
-# valeur permanente : `npm install -g novahiz` marche ensuite sans drapeau
-npm config set allow-scripts=novahiz --location=user
-
-# paquet déjà installé sans configuration : une commande suffit
-novahiz-install --yes
+npm install -g --allow-scripts=novahiz novahiz
 ```
 
-npm antérieur à 11.16 exécute les scripts par défaut : `npm install -g novahiz` suffit. Et si le blocage a eu lieu quand même, le premier `novahiz` lancé termine l'installation lui-même (désactivable avec `NOVAHIZ_AUTOINSTALL=0`).
+Variantes :
+
+```bash
+NOVAHIZ_NO_EXTRAS=1 novahiz doctor     # core seulement, aucun accès réseau
+NOVAHIZ_AUTOINSTALL=0 novahiz doctor   # ni core ni extras
+novahiz-install --extras               # rejouer les extras plus tard
+```
 
 > Piège : `npm install -g --allow-scripts=novahiz` **sans** le nom du paquet installe le dossier courant et échoue avec `ENOENT: package.json`. Le nom du paquet est obligatoire : `npm install -g --allow-scripts=novahiz novahiz`.
 
+> Linux et macOS : les commandes système qui demandent `sudo` ou qui exécutent un script téléchargé ne sont jamais lancées. L'installeur affiche la ligne exacte (`sudo apt-get install -y python3`, `brew install uv`, …) et vous décidez. C'est ce qui rend l'installation utilisable sans terminal interactif.
+
 > Linux : le serveur Playwright MCP s'exécute sous WebKit (règle maison : Chromium interdit). WebKit exige ses dépendances système : si le navigateur ne démarre pas, `npx playwright install-deps webkit` (sudo requis sur Debian/Ubuntu).
 
 Puis vérifiez :
@@ -125,12 +130,10 @@ flowchart TD
     C --> D[R13 : prompt design-ui ou fichier style ?<br/>exiger humanizer + ui-slop + ui-craft]
     C --> F[R3 : le prompt était Supabase ?<br/>exiger novahiz-supabase + postgres]
     C --> G[R4 : le prompt était navigateur ?<br/>exiger novahiz-browser]
-    C --> H[R6 : prompt de workflow ?<br/>exiger plan/clarify/analyse/implement/converge]
     
-    D --> I{Application de la roadmap}
+    D --> I{Application de la roadmap<br/>étapes non optionnelles}
     F --> I
     G --> I
-    H --> I
     
     I --> J{Détection de placeholder<br/>tokens TODO / FIXME / placeholder}
     
@@ -160,18 +163,20 @@ flowchart TD
 |-------|------------------|-------|
 | R3-supabase | Un chemin Supabase ou un prompt Supabase | novahiz-supabase, novahiz-postgres |
 | R4-playwright | Une catégorie prompt navigateur, ou un chemin de test navigateur (`**/*.spec.ts`, `**/e2e/**`, `**/playwright/**`, …) | novahiz-browser |
-| R6-Novahiz | Un prompt dans une catégorie de workflow | novahiz-plan, -clarify, -analyse, -implement, -converge |
 | R7-assessment | Un prompt d'assessment | novahiz-assess-intake, -research, -define, -shape, -decide |
 | R8-docs | Une édition sous `novahiz-docs/**/*.md` | novahiz-docs |
 | R9-code-review | Un prompt de review ou un fichier de code en review | novahiz-code-review |
-| R10-security | Un prompt d'audit ou de sécurité | novahiz-security |
-| R11-accessibility | Un prompt design-ui ou audit | novahiz-wcag-audit |
+| R11-accessibility | Un prompt design-ui | novahiz-wcag-audit |
 | R12-web-extract | Un prompt de recherche | novahiz-web-extract |
 | R13-design-craft | Un prompt design-ui ou un fichier style (css/scss/less/html) | novahiz-humanizer, ui-slop-remover, ui-craft-rules |
 | R14-impeccable | Un prompt design-ui ou un fichier style (css/scss/less/html) | impeccable |
 
 `novahiz-humanizer` et `ui-slop-remover` ne sont exigées que sur les tâches de design frontend (R13) ; `impeccable` se charge de la même façon (R14) pour garder les playbooks shape, critique, audit, harden et polish accessibles, et la roadmap design-ui porte une étape de vérification `impeccable detect` déterministe avant ship. `novahiz init` et `novahiz doctor` affichent les fichiers de contexte `PRODUCT.md` / `DESIGN.md` d'impeccable en lignes advisory.
 
+Le pipeline (plan, clarify, analyse, implement, converge) n'est plus une règle : il vient des étapes non optionnelles de la roadmap de la catégorie principale, quel que soit leur `kind` (`skill`, `edit`, `verify`, `advisory`). Une seule source de vérité, donc le bloc affiché et le gate ne peuvent plus diverger sur ce point.
+
+Les commandes shell prouvées en lecture seule (`git status`, `git log`, `git diff`, `ls`, `Get-ChildItem`, `Get-Content`, `rg`, `Select-String`, …) sont exemptées avant toute règle ou roadmap. Dès qu'une commande chaîne, redirige, substitue ou porte un flag d'écriture, l'exemption tombe et le gate s'applique normalement.
+
 ### Gate reload
 
 Un blocage n'est jamais une impasse. Le refus embarque une recette GATE RELOAD : charger chaque skill nommée via le loader, puis rejouer l'appel exact une fois — aucun outil alternatif, aucune écriture shell, aucun contournement d'édition. Si les mêmes skills sont de nouveau signalées manquantes, le chargement n'a pas été enregistré : exécuter `novahiz doctor`, signaler honnêtement, et s'arrêter. La seule dérogation sanctionnée est `NOVAHIZ_GATE=off` (voir Configuration), déclarée à voix haute.

package/adapters/opencode/agent/novahiz.md

@@ -2,6 +2,7 @@
 description: Novahiz primary agent. Classifies the request, loads the required skills, then works under the Novahiz gate.
 mode: primary
 temperature: 0.2
+color: "#22c55e"
 # opencode denies `question` by default. The built-in build and plan agents
 # re-allow it; a custom agent inherits the denial unless it asks. Without this
 # block the pipeline cannot ask a clarifying question or validate a plan.

package/adapters/opencode/novahiz-plugin.ts

@@ -1633,7 +1633,7 @@ async function setup(ctx: Context): Promise<Cleanup> {
       // P0-B: the prompt travels on stdin. On argv it allowed option
       // injection (--home), broke past the Windows 32k limit, and was
       // readable in the process list.
-      const result = await run(["classify", "--stdin"], classifyText);
+      const result = await run(["classify", "--stdin", "--session", sessionID], classifyText);
       if (result.status !== 0) {
         classifyFailedBySession.set(sessionID, `classify exit ${result.status}`);
         await log("warn", `Classify failed (exit ${result.status}), gate tool calls refused for this session: ${result.stderr.trim().slice(0, 200)}`);
@@ -1645,6 +1645,7 @@ async function setup(ctx: Context): Promise<Cleanup> {
         requiredSkills?: string[];
         enforcedSkills?: string[];
         providers?: string[];
+        continuedFrom?: string;
         roadmaps?: { id: string; steps: { label: string; kind: string; requireSkills?: string[] }[] }[];
       };
       try {
@@ -1666,7 +1667,11 @@ async function setup(ctx: Context): Promise<Cleanup> {
       categoriesBySession.set(sessionID, categories);
       // P1-4: the gate takes the last prompt as its tier seed via --prompt even
       // when memory auto is off — set unconditionally, not inside MEMORY_AUTO.
-      lastPromptBySession.set(sessionID, text.slice(0, 300));
+      // A trivial follow-up ("continue") inherits the previous task's prompt:
+      // using the literal "continue" here would retier the session as trivial
+      // and skip the roadmap the classify call just restored.
+      const effectivePrompt = parsed.continuedFrom ?? text;
+      lastPromptBySession.set(sessionID, effectivePrompt.slice(0, 300));
       const primary = parsed.primary ?? categories[0] ?? null;
       const enforced = parsed.enforcedSkills ?? [];
       const required = parsed.requiredSkills ?? [];
@@ -1677,6 +1682,9 @@ async function setup(ctx: Context): Promise<Cleanup> {
         "[Novahiz enforcement]",
         `Categories detected: ${categories.join(", ") || "none"}${primary ? ` (primary: ${primary})` : ""}`
       ];
+      if (parsed.continuedFrom) {
+        lines.push(`Continuing the previous task: ${parsed.continuedFrom.slice(0, 160)}`);
+      }
       if (rewrite.sourceLanguage !== "en") {
         lines.push(`User language: ${rewrite.sourceLanguage} — respond in this language, not English.`);
       }
@@ -1699,7 +1707,7 @@ async function setup(ctx: Context): Promise<Cleanup> {
           await log("warn", "Ledger state is invalid JSON, enforcement injected without the task summary");
         }
       }
-      lines.push("The gate blocks edit/write/patch/apply_patch/bash/shell until the required skills are loaded via skill({id:\"...\"}).");
+      lines.push("The gate blocks edit/write/patch/apply_patch/bash/shell until the required skills are loaded via skill({id:\"...\"}). Read-only shell commands (status/log/diff/ls/Get-Content/...) are exempt.");
       lines.push("The gate is content-aware: novahiz-humanizer, ui-slop-remover and ui-craft-rules are required only on frontend design tasks (R13), and impeccable on the same design selectors (R14).");
       lines.push("Config edited = opencode restart required (config read at import).");
       lines.push("Memory lives in project-memory/ under the project root (cwd): index.json + fixed-size slots (8000 chars / 200 lines) with compact → archive → new-slot rotation. Use the MCP memory_* tools: memory_search to find relevant slots first, then memory_get to read, memory_write to append, memory_update to correct, memory_archive to retire.");

package/bin/novahiz.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { existsSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import { spawnSync } from "node:child_process";
@@ -21,40 +21,66 @@ const here = dirname(fileURLToPath(import.meta.url));
 const root = join(here, "..");
 const underNodeModules = root.replace(/\\/g, "/").toLowerCase().includes("/node_modules/");
 const dist = join(root, "dist", "cli.js");
-const src = join(root, "src", "cli.ts");
+const src = join(root, "src", "cli.ts"); console.error("DEBUG", JSON.stringify({underNodeModules, root, auto: process.env.NOVAHIZ_AUTOINSTALL, noextras: process.env.NOVAHIZ_NO_EXTRAS}));
 
 // npm 11.16+ blocks install scripts unless `allowScripts` covers them, and a
 // global install (`npm install -g`) has no package.json to record that
 // approval in — so the postinstall can be skipped silently and the machine is
-// left half configured. Finishing the job here means the package works
-// whether or not npm let the lifecycle script through: the first real `novahiz`
-// run installs the core (skills, plugin, agent, MCP), then behaves normally.
-// Opt out with NOVAHIZ_AUTOINSTALL=0. Only a package installed from npm is
-// touched; a repo checkout keeps its explicit `novahiz-install`.
+// left half configured. The first real `novahiz` run therefore finishes the
+// job, in two passes:
+//   1. no install manifest -> install the core (skills, plugin, agent, config);
+//   2. manifest says extrasPending -> run the network/system extras once
+//      (providers, global MCP servers, Obsidian vault, npm refresh).
+// Opt out with NOVAHIZ_AUTOINSTALL=0 (both passes) or NOVAHIZ_NO_EXTRAS=1
+// (extras only). A repo checkout keeps its explicit `novahiz-install`.
+function readManifest(path) {
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    return parsed && typeof parsed === "object" ? parsed : null;
+  } catch {
+    return null;
+  }
+}
+
 if (underNodeModules && process.env.NOVAHIZ_AUTOINSTALL !== "0") {
   const args = process.argv.slice(2);
   const infoOnly = args.length > 0 && args.every((arg) => ["-v", "-V", "--version", "--help", "-h"].includes(arg));
   const home = process.env.NOVAHIZ_HOME ? resolve(process.env.NOVAHIZ_HOME) : join(homedir(), ".config", "novahiz");
-  if (!infoOnly && !existsSync(join(home, ".novahiz-install.json"))) {
-    process.stderr.write(
-      "novahiz: npm skipped the postinstall script (allow-scripts), so the setup has not run yet.\n" +
-        "novahiz: installing now — re-run it any time with `novahiz-install`.\n"
-    );
-    const setup = spawnSync(process.execPath, [join(root, "install", "install.mjs"), "--yes"], {
+  const manifestPath = join(home, ".novahiz-install.json");
+  const manifest = readManifest(manifestPath);
+  const installer = join(root, "install", "install.mjs");
+  const runInstaller = (mode, reason) => {
+    process.stderr.write(`novahiz: ${reason}\n`);
+    const setup = spawnSync(process.execPath, [installer, "--yes", mode], {
       stdio: "inherit",
       cwd: root,
       env: process.env
     });
     if (setup.status !== 0) {
-      process.stderr.write("novahiz: automatic setup did not complete; run `novahiz-install` to see why.\n");
+      process.stderr.write(`novahiz: setup (${mode}) did not complete; re-run it with \`novahiz-install ${mode}\`.\n`);
+    }
+    return setup.status === 0;
+  };
+  if (!infoOnly && manifest === null) {
+    const coreOk = runInstaller("--core", "first run - installing the core (the npm postinstall was skipped or did not finish).");
+    // Meme lancement, deux passes : le premier appel doit tout laisser pret, pas
+    // seulement le core. Les extras restent optionnels via NOVAHIZ_NO_EXTRAS=1.
+    if (coreOk && process.env.NOVAHIZ_NO_EXTRAS !== "1") {
+      runInstaller("--extras", "installing the extras (providers, global MCP servers, Obsidian vault). One time only; skip with NOVAHIZ_NO_EXTRAS=1.");
     }
+  } else if (!infoOnly && manifest?.extrasPending === true && process.env.NOVAHIZ_NO_EXTRAS !== "1") {
+    runInstaller("--extras", "finishing the setup installed earlier (providers, global MCP servers, Obsidian vault). One time only; skip with NOVAHIZ_NO_EXTRAS=1.");
   }
 }
 
 let target;
 if (underNodeModules) {
   if (!existsSync(dist)) {
-    process.stderr.write("novahiz: dist/cli.js is missing from the installed package. Reinstall: npm install novahiz\n");
+    process.stderr.write(
+      "novahiz: dist/cli.js is missing from this package copy.\n" +
+        "novahiz: npm blocked the `prepare` script (allow-scripts). Reinstall with:\n" +
+        "novahiz:   npm install -g --allow-scripts=novahiz novahiz\n"
+    );
     process.exit(1);
   }
   target = dist;

package/catalog/categories.json

@@ -756,7 +756,206 @@
       "accessibility",
       "a11y",
       "dashboard",
-      "form",
+      {
+        "term": "form",
+        "weight": 2
+      },
+      {
+        "term": "forms",
+        "weight": 2
+      },
+      {
+        "term": "formulaire",
+        "weight": 2
+      },
+      {
+        "term": "formulaires",
+        "weight": 2
+      },
+      {
+        "term": "bouton",
+        "weight": 2
+      },
+      {
+        "term": "boutons",
+        "weight": 2
+      },
+      {
+        "term": "button",
+        "weight": 2
+      },
+      {
+        "term": "buttons",
+        "weight": 2
+      },
+      {
+        "term": "écran",
+        "weight": 2
+      },
+      {
+        "term": "screen",
+        "weight": 2
+      },
+      {
+        "term": "screens",
+        "weight": 2
+      },
+      {
+        "term": "connexion",
+        "weight": 1
+      },
+      {
+        "term": "login",
+        "weight": 1
+      },
+      {
+        "term": "sign in",
+        "weight": 1
+      },
+      {
+        "term": "signin",
+        "weight": 1
+      },
+      {
+        "term": "sign up",
+        "weight": 1
+      },
+      {
+        "term": "signup",
+        "weight": 1
+      },
+      {
+        "term": "inscription",
+        "weight": 1
+      },
+      {
+        "term": "mot de passe",
+        "weight": 1
+      },
+      {
+        "term": "password",
+        "weight": 1
+      },
+      {
+        "term": "champ",
+        "weight": 1
+      },
+      {
+        "term": "field",
+        "weight": 1
+      },
+      {
+        "term": "input",
+        "weight": 1
+      },
+      {
+        "term": "menu",
+        "weight": 1
+      },
+      {
+        "term": "icône",
+        "weight": 1
+      },
+      {
+        "term": "icon",
+        "weight": 1
+      },
+      {
+        "term": "carte",
+        "weight": 1
+      },
+      {
+        "term": "card",
+        "weight": 1
+      },
+      {
+        "term": "modal",
+        "weight": 1
+      },
+      {
+        "term": "dialog",
+        "weight": 1
+      },
+      {
+        "term": "dialogue",
+        "weight": 1
+      },
+      {
+        "term": "header",
+        "weight": 1
+      },
+      {
+        "term": "footer",
+        "weight": 1
+      },
+      {
+        "term": "sidebar",
+        "weight": 1
+      },
+      {
+        "term": "composant",
+        "weight": 1
+      },
+      {
+        "term": "component",
+        "weight": 1
+      },
+      {
+        "term": "onglet",
+        "weight": 1
+      },
+      {
+        "term": "tab",
+        "weight": 1
+      },
+      {
+        "term": "avatar",
+        "weight": 1
+      },
+      {
+        "term": "badge",
+        "weight": 1
+      },
+      {
+        "term": "tooltip",
+        "weight": 1
+      },
+      {
+        "term": "toast",
+        "weight": 1
+      },
+      {
+        "term": "snackbar",
+        "weight": 1
+      },
+      {
+        "term": "drawer",
+        "weight": 1
+      },
+      {
+        "term": "panneau",
+        "weight": 1
+      },
+      {
+        "term": "panel",
+        "weight": 1
+      },
+      {
+        "term": "accueil",
+        "weight": 1
+      },
+      {
+        "term": "welcome",
+        "weight": 1
+      },
+      {
+        "term": "home",
+        "weight": 1
+      },
+      {
+        "term": "homepage",
+        "weight": 1
+      },
       "onboarding",
       "frontend design",
       "ui component",
@@ -773,7 +972,15 @@
     "negativeKeywords": [
       "migration",
       "rls",
-      "edge function"
+      "edge function",
+      "bug",
+      "error",
+      "crash",
+      "exception",
+      "regression",
+      "stacktrace",
+      "panic",
+      "broken"
     ],
     "defaultSkills": [
       "novahiz-humanizer",

package/catalog/rules.json

@@ -26,30 +26,6 @@
     },
     "require": ["novahiz-browser"]
   },
-  {
-    "id": "R6-Novahiz",
-    "description": "Load Novahiz pipeline skills for any task triggering the workflow.",
-    "when": {
-      "promptCategories": [
-        "code",
-        "debug",
-        "review",
-        "audit",
-        "browser",
-        "design-ui",
-        "database-supabase",
-        "docs-writing",
-        "planning",
-        "devops",
-        "data",
-        "general",
-        "flutter",
-        "expo",
-        "test"
-      ]
-    },
-    "require": ["novahiz-plan", "novahiz-clarify", "novahiz-analyse", "novahiz-implement", "novahiz-converge"]
-  },
   {
     "id": "R7-assessment",
     "description": "Load Idea Assessment pipeline skills.",
@@ -80,21 +56,12 @@
     },
     "require": ["novahiz-code-review"]
   },
-  {
-    "id": "R10-security",
-    "description": "Load novahiz-security on any security audit or hardening task.",
-    "when": {
-      "match": "any",
-      "promptCategories": ["audit"]
-    },
-    "require": ["novahiz-security"]
-  },
   {
     "id": "R11-accessibility",
-    "description": "Load novahiz-wcag-audit on design-ui work and on audit prompts, where accessibility is in scope.",
+    "description": "Load novahiz-wcag-audit on design-ui work, where accessibility is in scope.",
     "when": {
       "match": "any",
-      "promptCategories": ["design-ui", "audit"],
+      "promptCategories": ["design-ui"],
       "pathExcludes": ["**/tests/**", "**/__tests__/**", "**/*.test.*", "**/*.spec.*"]
     },
     "require": ["novahiz-wcag-audit"]

package/dist/classify.js

@@ -58,7 +58,11 @@ function skillsOfCategory(category) {
 function enforcedOfCategory(category) {
     const skills = [];
     for (const step of category.roadmap?.steps ?? []) {
-        if (step.kind !== "skill" || step.optional)
+        // Every non-optional step counts, whatever its kind: `edit:implement` and
+        // `verify:converge` carry skills too. Restricting to kind "skill" made
+        // lite/debug roadmaps advertise nothing while the gate demanded R6's
+        // implement/converge — the block and the gate disagreed.
+        if (step.optional)
             continue;
         for (const skill of step.requireSkills ?? []) {
             if (!skills.includes(skill))

package/dist/cli.js

@@ -121,14 +121,16 @@ async function main(argv) {
         process.env.NOVAHIZ_HOME = resolve(expandHome(parsed.flags.home));
     }
     const command = parsed.positionals[0];
-    if (command === undefined || command === "help" || command === "--help" || command === "-h") {
-        usage();
-        return;
-    }
+    // `--version` sans commande tombe sur `command === undefined` et affichait
+    // l'aide : le test du drapeau doit passer avant celui de la commande.
     if (parsed.flags.version || parsed.flags.v) {
         printVersion();
         return;
     }
+    if (command === undefined || command === "help" || command === "--help" || command === "-h") {
+        usage();
+        return;
+    }
     switch (command) {
         case "init":
             return commandInit(parsed);