task-pipeline-skill 1.101.0 → 1.101.1

package/CHANGELOG.md

@@ -1,3 +1,14 @@
+## v1.101.1 (2026-10-23)
+
+Guards: 530 → **530**; property checks 15 → **15**. No negative was added: the new checks are
+two cases in `test/release_gate_test.py` (65 to 67).
+
+- **B-153:** when the release gate's python3 decision fails, its fallback refused any command
+  that spelled `tag`, `push`, `release` or `publish` anywhere, so reading
+  `.git/sshlg-release-candidates/` was refused as an outward act (2026-10-22). It now matches the
+  command shapes (`git … tag|push`, `gh … release`, `npm … publish`); every outward act it
+  refused before is still refused. Filed as B-152, an id v1.91.1 had already used.
+
 ## v1.101.0 (2026-10-22)
 
 Guards: 530 → **530**; property checks 15 → **15**. No negative was added: the new checks are

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.101.0 |
+| **Version** | 1.101.1 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki, and **one of two browser channels** — `playwright` (CLI or MCP) or `chrome-devtools` (MCP); either satisfies the browser step and neither is required. The engine is WebKit (Safari) first; `chrome-devtools` is Chrome-only, a stated exception. Every stage's doctrine ships in-repo; user-facing stage 3 requires a valid scenario artifact; super-ux is preferred, with equivalent-provider and inline-fallback paths under the provider contract |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.101.0",
+  "version": "1.101.1",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/judgment/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a proportional short path for small changes, a loop guard whose ceilings stop and record a blocker, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs); a third, `waves`, takes the whole board and closes it in waves that each finish in one pass. Retro insights can publish upstream as issues, opt-in and redacted.",
-  "version": "1.101.0",
+  "version": "1.101.1",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/hooks/release-gate.sh

@@ -252,10 +252,13 @@ status=$?
 if [ $status -ne 0 ] || [ -z "$verdict" ]; then
   [ -f "$ledger" ] || exit 0
   # B-152: without python3 the command cannot be classified, and refusing EVERY
-  # Bash call took the whole session down on a full disk. A word-level pre-filter
-  # keeps fail-closed exactly where it matters: anything that could tag, push,
-  # release or publish is still refused; `ls` is not.
-  if ! printf '%s' "$input" | grep -Eq '(^|[^[:alnum:]_])(tag|tags|push|release|publish)([^[:alnum:]_]|$)'; then
+  # Bash call took the whole session down on a full disk. A pre-filter keeps
+  # fail-closed exactly where it matters: anything that could tag, push, release or
+  # publish is still refused; `ls` is not.
+  # B-153: it matched the WORDS, so `ls .git/sshlg-release-candidates/` was refused
+  # as an outward act. It now matches the command shapes: `git … tag|push`,
+  # `gh … release`, `npm … publish`, each word standing alone as an argument.
+  if ! printf '%s' "$input" | grep -Eq '(^|[^[:alnum:]_./-])(git([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(tag|push)|gh([[:space:]]+[^[:space:];&|]+)*[[:space:]]+release|npm([[:space:]]+[^[:space:];&|]+)*[[:space:]]+publish)([[:space:]"]|$)'; then
     exit 0
   fi
   echo "task-pipeline: the stage-7 gate could not run (python3 missing or failed), and this project has a run in flight ($ledger). Refusing an outward act rather than failing open." >&2