task-pipeline-skill 1.10.1 → 1.10.2

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # Changelog
 
+## v1.10.2 — 2026-08-03
+
+### Fixed — the list of invariants was eight guards behind, and now checks itself
+
+A fifth audit pass, on two axes never used before: **the consumer's view** (unpack the
+published package and run its installer in an isolated HOME — clean install works, the
+refuse-on-plugin path fires, all 58 files present) and **one class swept end to end**:
+every claim of enforcement against the guard that supposedly makes it true.
+
+The doc map's six *Checked by* cells all resolved. `CONTRIBUTING.md` did not.
+It states plainly that its invariants are *"what the validator enforces"*, and it had
+sixteen while the validator enforced eight more concepts it had never heard of —
+adoption, the exclusion clause, the opt-out, the input map, portability, the routing
+template, the README-reach rule and the seeded-template Contents rule.
+
+**The previous round fixed this class in one instance and not as a class.** The reach
+guard shipped last release covers *references → README and manifest*; nothing covered
+*guard → CONTRIBUTING*. `references/learned.md` rule 6 — sweep the class, not the
+finding — applied to the sweep itself.
+
+So the list is now **self-verifying**: invariants 17–24 name the new guards, and every
+invariant that cites a guard cites a **literal this validator actually prints**. A
+claim of enforcement is checked like any other claim. One discovered constraint is
+stated with it: a cited literal must lie inside a *single* string in `test/validate.py`,
+because the check reads that file as text — a quote straddling a line-continuation is
+a citation nothing can find, which is how the first three citations failed.
+
 ## v1.10.1 — 2026-08-03
 
 ### Fixed — four surfaces that never heard about the last two releases

package/CONTRIBUTING.md

@@ -142,6 +142,40 @@ omitted row reads as "does not apply".
 **16. The evaluation suite covers all five dimensions** and `evals/run.py` accepts
 it. Running it is a human step; the suite existing is not.
 
+**17. Both adoption walkthroughs ship, with the ratchet-baseline step.** Greenfield
+is the easy half and the one that gets written; brownfield is where a repository
+actually is. *(guard: `adoption without it is a tutorial for the repository nobody has`)*
+
+**18. The description states its exclusions, and the opt-out is exercised by an eval.**
+Default-on without a release valve is a trap, and an escape hatch nobody tests is not
+one. *(guard: `no eval exercises the opt-out phrase`)*
+
+**19. The stage/artifact relation is mapped in both directions.** What each stage
+writes, and what it reads and from where. *(guard: `must be mapped in BOTH directions`)*
+
+**20. Every workflow decision has a home inside the bundle.** The manifest in
+`references/portability.md` names it, and no row may point outside.
+*(guard: `manifest names`)*
+
+**21. The routing default ships as a file.** It is a workflow decision, so it travels
+with the bundle instead of being hand-installed into an operator's config.
+*(guard: `must ship as a file rather than be hand-installed`)*
+
+**22. Every reference reaches the README map and the manifest.** Reachability from
+`SKILL.md` proves an agent can *find* a file, not that a reader was *told* about it.
+*(guard: `is named nowhere in README.md`)*
+
+**23. A seeded template over 100 lines carries its own Contents.** A host project
+reads those files, and a partial read shows whichever sections come first.
+*(guard: `needs the same partial-read protection references get`)*
+
+**24. Every invariant above names the guard that enforces it, and that guard exists.**
+This list claims to be *what the validator enforces*; it was eight guards behind when
+an audit measured it. A claim of enforcement is now checked like any other claim.
+*(guard: `whose message does not appear in`)* — and a cited literal must lie inside
+a **single** string in `test/validate.py`: the check reads that file as text, so a
+quote straddling a line-continuation is a citation nothing can find.
+
 ## Adding or changing doctrine
 
 - **Change one idea per PR.** These files are read by agents under load; a PR that

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.10.1 |
+| **Version** | 1.10.2 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored (15 evals, 5 categories). **Never executed** — see [`evals/RESULTS.md`](evals/RESULTS.md) |
@@ -38,7 +38,7 @@ apply.
    instruction surface, and every one is linked directly from `SKILL.md`.
 2. Read `templates/docgate.sh` before seeding it; it is the only shipped script a
    host project will run on its own repository.
-3. Run `npm run test:all` — 61 guards, each with a negative self-test that plants a
+3. Run `npm run test:all` — 62 guards, each with a negative self-test that plants a
    defect and requires rejection.
 4. Run `python3 evals/run.py` for the behavioural protocol, and read
    `evals/RESULTS.md` for what has actually been observed.
@@ -54,7 +54,7 @@ apply.
 - **Versions are pinned by git tag** and mirrored into `sshlg-skills`'s catalogue.
   Rollback is `git checkout v<previous>` or pinning the previous plugin version;
   the previous version is never deleted.
-- **Behavioural evidence is missing, not merely thin.** 61 structural guards prove
+- **Behavioural evidence is missing, not merely thin.** 62 structural guards prove
   the skill is well-formed. Until `evals/RESULTS.md` carries a dated run, nothing in
   this repository proves it *behaves* — triggers correctly, stays quiet on a
   question, or performs the steps it documents.

package/evals/RESULTS.md

@@ -37,9 +37,9 @@ or it belongs in a check.
 | Dated runs recorded | **0** | 2026-08-03 |
 
 The bottom two numbers are the honest state of this skill's behavioural evidence.
-Everything else in this repository is proven by 61 structural guards that check the
+Everything else in this repository is proven by 62 structural guards that check the
 *form*; these are the only checks that would speak to the *behaviour*, and they have
-not been run yet. Printed here so "61 of 61 green" is never read as "the skill is
+not been run yet. Printed here so "62 of 62 green" is never read as "the skill is
 known to work".
 
 ## Runs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.10.1",
+  "version": "1.10.2",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/manual gates, a frozen requirement spine that must close with evidence, a loop guard that breaks churn, one provider-agnostic model confirmed up front, and an optional super-ux UX track for user-facing work.",
-  "version": "1.10.1",
+  "version": "1.10.2",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"