task-pipeline-skill 1.10.0 → 1.10.1

package/CHANGELOG.md

@@ -1,5 +1,35 @@
 # Changelog
 
+## v1.10.1 — 2026-08-03
+
+### Fixed — four surfaces that never heard about the last two releases
+
+A fourth audit pass, on a fourth axis: **the claims of the last three releases,
+checked against the tree.** All four findings are the same shape — a file shipped and
+the surfaces that tell a reader it exists were never walked. Reachability from
+`SKILL.md` was green throughout, because that check proves an agent can *find* a file,
+not that anybody was *told* about it.
+
+- **The Cursor rule was two releases behind** — and it is the surface that travels,
+  copied into foreign projects and required to be self-contained. It knew the
+  documentation track and nothing about adoption, the entry audit, portability, the
+  routing boundary or the opt-out phrase: an agent reading it in another repository
+  had no idea when the pipeline applies. Measured `0` for each. Now current.
+- **The README's documentation map** listed `adoption.md` and named neither
+  `setup.md` nor `portability.md` — and had never named `learned.md` at all.
+- **The portability manifest covered 14 of 26 references.** It claims *every workflow
+  decision*, and the twelve stage doctrines — spec, build, planning, review,
+  acceptance, brainstorm, decomposition, tdd, conventions, companion-skills,
+  knowledge-graph, model-tiering — had no row. The guard could not see it: it checked
+  that every listed path resolves, which is the direction that cannot find an absence.
+- **Two seeded templates over 100 lines had no `## Contents`** — the doc map (eight
+  sections) and the brief (nine). The rule was scoped to `references/` while the files
+  a host project actually reads were outside it.
+
+**Two new guards, and they are the point.** Every reference must appear in the README
+map *and* in the manifest; every seeded template over 100 lines carries its own
+Contents. Both check the direction that finds absences, and both were watched failing.
+
 ## v1.10.0 — 2026-08-03
 
 ### Added — the entry audit, and a boundary that keeps the workflow portable

package/README.md

@@ -777,6 +777,9 @@ recommendation, so you arm the whole run in one exchange. Detail:
 | [`references/model-tiering.md`](plugins/task-pipeline/skills/task-pipeline/references/model-tiering.md) | model policy, the `/model` reminder, overrides |
 | [`templates/`](plugins/task-pipeline/skills/task-pipeline/templates/README.md) | brief, carry-over ledger, `CONTEXT.md` and ADR skeletons, the doc map, both registers, the retro and its archive, the seeded `docgate.sh`, a worked hook |
 | [`references/adoption.md`](plugins/task-pipeline/skills/task-pipeline/references/adoption.md) | the first run in a project: greenfield seeding, and the brownfield walkthrough |
+| [`references/setup.md`](plugins/task-pipeline/skills/task-pipeline/references/setup.md) | the entry audit: seven passes over the docs a project already has, offered once, output as a fix plan |
+| [`references/portability.md`](plugins/task-pipeline/skills/task-pipeline/references/portability.md) | the manifest of workflow decisions and their homes in the bundle, and the boundary against a project's own answers |
+| [`references/learned.md`](plugins/task-pipeline/skills/task-pipeline/references/learned.md) | fifteen rules earned by failure on a real multi-repository build, each with its incident, its check and its exit criterion |
 | [`SKILL-CARD.md`](SKILL-CARD.md) | the registry entry and risk-tier disclosure a reviewer needs before deploying it |
 | [`evals/`](evals/RESULTS.md) | the behavioural evaluation suite, its protocol, and what has actually been observed |
 | [`CHANGELOG.md`](CHANGELOG.md) | every release, with the reasoning behind it |

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.10.0 |
+| **Version** | 1.10.1 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored (15 evals, 5 categories). **Never executed** — see [`evals/RESULTS.md`](evals/RESULTS.md) |
@@ -38,7 +38,7 @@ apply.
    instruction surface, and every one is linked directly from `SKILL.md`.
 2. Read `templates/docgate.sh` before seeding it; it is the only shipped script a
    host project will run on its own repository.
-3. Run `npm run test:all` — 59 guards, each with a negative self-test that plants a
+3. Run `npm run test:all` — 61 guards, each with a negative self-test that plants a
    defect and requires rejection.
 4. Run `python3 evals/run.py` for the behavioural protocol, and read
    `evals/RESULTS.md` for what has actually been observed.
@@ -54,7 +54,7 @@ apply.
 - **Versions are pinned by git tag** and mirrored into `sshlg-skills`'s catalogue.
   Rollback is `git checkout v<previous>` or pinning the previous plugin version;
   the previous version is never deleted.
-- **Behavioural evidence is missing, not merely thin.** 59 structural guards prove
+- **Behavioural evidence is missing, not merely thin.** 61 structural guards prove
   the skill is well-formed. Until `evals/RESULTS.md` carries a dated run, nothing in
   this repository proves it *behaves* — triggers correctly, stays quiet on a
   question, or performs the steps it documents.

package/cursor/rules/task-pipeline.mdc

@@ -423,3 +423,45 @@ JTBD, customer journey maps, user stories) → flows + screens → scenarios (th
 source of truth) → run its linter. Otherwise still design that chain, get it
 approved, and trace every user-facing requirement to a scenario before building.
 Install (Cursor/Claude/others): `npx skills add ssheleg/super-ux`.
+
+## Routing — when this applies at all
+
+**Work that CHANGES THE REPOSITORY goes through the pipeline** — a feature, fix,
+refactor, migration, integration, rewrite, adoption or hardening pass, in any
+phrasing. **Not** for a question, an explanation, reading code, a typo or a one-line
+edit. The operator opts out of a qualifying task by saying "без пайплайна" or
+"quick"; when they do, say out loud that the cycle was skipped at their request.
+
+A borderline case is named, not silently chosen: state which route you are taking and
+why, in one line.
+
+**Escalation while running.** Decide alone while the cost of being wrong stays inside
+the repository and is reversible. Escalate a price, a legal posture, a promise to
+somebody outside the team, anything spending money or reputation, and any irreversible
+outward act. The tell is the cost of being wrong, not the size of the change.
+
+## The first run in a project
+
+Two entry conditions, and they are different problems.
+
+**A new project:** stage 0 seeds the doc map, the registers and the documentation
+gate before the first interview question. The gate is green on day one because
+sections with nothing to check yet print `dormant`.
+
+**An existing project:** offer the **entry audit** once — seven passes over the
+documentation that already exists, *before* building on it: one decision home,
+register integrity, propagation, the matrix's checked-by column, declared terms, the
+UX chain, and the gate itself proven against a planted defect. Findings carry
+`file:line`, the minimal fix and the **seam**, ordered by seam rather than by file.
+It ends in a fix plan and **fixes nothing while reading**.
+
+The step that decides whether adoption survives is **baselining the ratchets at
+today**: the propagation floor to the next free id, the residue floor to the measured
+count. A gate that is red on adoption day is switched off on day two. History is
+**not** back-filled — an old decision enters the register the day somebody is about to
+contradict it.
+
+**Portability.** A decision about how the pipeline behaves belongs in the skill; a
+decision about what this project decided belongs in the project. The test for a rule
+you are about to write down: does it name a path, a command or a person? If not, it is
+the pipeline's, and leaving it in one repository is a fork nobody named.

package/evals/RESULTS.md

@@ -37,9 +37,9 @@ or it belongs in a check.
 | Dated runs recorded | **0** | 2026-08-03 |
 
 The bottom two numbers are the honest state of this skill's behavioural evidence.
-Everything else in this repository is proven by 59 structural guards that check the
+Everything else in this repository is proven by 61 structural guards that check the
 *form*; these are the only checks that would speak to the *behaviour*, and they have
-not been run yet. Printed here so "59 of 59 green" is never read as "the skill is
+not been run yet. Printed here so "61 of 61 green" is never read as "the skill is
 known to work".
 
 ## Runs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.10.0",
+  "version": "1.10.1",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/manual gates, a frozen requirement spine that must close with evidence, a loop guard that breaks churn, one provider-agnostic model confirmed up front, and an optional super-ux UX track for user-facing work.",
-  "version": "1.10.0",
+  "version": "1.10.1",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/skills/task-pipeline/references/portability.md

@@ -56,6 +56,18 @@ a row pointing outside the bundle is the defect this file exists to catch.
 | **The routing default and its boundary** | `templates/routing-rule.md` |
 | The seeded doc map, registers and gate | `templates/docmap.md`, `templates/decisions.md`, `templates/open-questions.md`, `templates/docgate.sh` |
 | What a stage reads, and which host files bind it | `references/artifacts.md` |
+| The design conversation, its hard gate, UI detection, user paths | `references/brainstorm.md` |
+| Cutting a platform into modules, brick criteria, build order | `references/decomposition.md` |
+| What a spec must lock, the UX-track order, the module dossier | `references/spec.md` |
+| The zero-context plan format, parallel groups, set equality | `references/planning.md` |
+| Workspace isolation, the subagent loop, who may write the register | `references/build.md` |
+| The review rubric, diff packages, the three verdicts | `references/review.md` |
+| The TDD iron law and the suite gate | `references/tdd.md` |
+| The REQ coverage table, evidence rules, the closing question | `references/acceptance.md` |
+| How the host project's own conventions are read | `references/conventions.md` |
+| Which companions exist, what is required, self-currency | `references/companion-skills.md` |
+| The code graph: queries, refresh, the graph↔docs divergence | `references/knowledge-graph.md` |
+| Model policy — tier not id, ask once at preflight | `references/model-tiering.md` |
 | This boundary | `references/portability.md` |
 
 **The routing rule is the row worth watching.** A skill's `description` raises the

package/plugins/task-pipeline/skills/task-pipeline/templates/brief.md

@@ -9,6 +9,18 @@
 - **UI verdict:** yes / no — does this touch a user-facing surface (web/mobile/CLI/TUI)?
   If yes, the stage-3 super-ux UX track is armed.
 
+## Contents
+
+- Knowledge sources (the phase-1 harvest — written BEFORE the first question)
+- Documentation (the phase-1b inventory — the four questions)
+- Scope
+- Requirements (the REQ spine — every later stage traces to these IDs)
+- Users & context
+- Decisions locked (the grill's output)
+- Autonomy (the sweep — stages 1→10 read this instead of asking)
+- Done-criteria
+- Open assumptions / risks
+
 ## Knowledge sources (the phase-1 harvest — written BEFORE the first question)
 
 What the project already knew about this task, and where it said so. One row per

package/plugins/task-pipeline/skills/task-pipeline/templates/docmap.md

@@ -10,6 +10,17 @@ elsewhere — where another file already says it, this one holds a **pointer lin
 not a copy. A doc map that duplicates `AGENTS.md` is the first violation of the
 rule it publishes.
 
+## Contents
+
+- Regime
+- Registers
+- Single source of truth
+- Propagation matrix
+- Gates
+- Ratchets
+- Terms
+- Navigation
+
 ## Regime
 
 `governed` — established <YYYY-MM-DD> by run `<topic>`, recorded as `DEC-0001`.