task-pipeline-skill 1.101.0 → 1.102.0

package/CHANGELOG.md

@@ -1,3 +1,66 @@
+## v1.102.0 (2026-10-24)
+
+Guards: 530 → **531**; property checks 15 → **15**. Negative 550 is new; the release impact
+checks are `test/release_impact_test.py` (47 cases), wired into `npm test` and `test:all`.
+
+- **B-155:** `_is_dated_record()` read a section as dated when its heading and the first two
+  blocks under it carried an ISO date; under `## Closed` the second block is the newest closed
+  item, so one dated item exempted every number in the section and negative 442 stopped firing.
+  The section stamp is now the heading and the one block beneath it. Negative 550 plants a
+  dated first Closed item beside a skewed fixture count and must fail.
+
+**Every release in a project with users owes a release impact card** (operator, 2026-10-24):
+before a release harms anyone, it says who it touches and how, how it is watched, what tells
+someone it went wrong, and the way back.
+
+- **`references/release-impact.md`** and **`templates/release-impact.md`**: the card
+  (`release-impact/1`) is owed at stage 7 before any outward act (tag, publish, deploy) when
+  `pipeline.json` → `release.users` is `external` or `internal`; absent is unknown and treated as
+  `external`; `none` owes no card and prints `users: none` beside the stage 7 verdict. Four
+  sections, each answered or `n/a: <reason>`: who is affected and how (segments, changes,
+  breakage, rollout, timing), tracking (signals, baseline, where, watch window), alerting
+  (condition, receiver, whether it was ever seen firing), rollback or hotfix (procedure, time,
+  data reversibility, kill switch, hotfix path, decision trigger). Worked examples for a package
+  release and for a web or mobile product.
+- **`scripts/release_impact.py check`** refuses a missing, empty or duplicated section, `n/a`
+  without a reason, a `TODO`, tracking without a watch window, alerting that does not say
+  whether it ever fired, a rollback without a decision trigger, tracking, alerting or rollback
+  answered `n/a` on a release with users, and a card whose `users:` disagrees with the project;
+  no card where one is owed is NOT_RUN (exit 3). `--outcome` checks stage 8's record.
+- **Stages:** the stage 7 GATE in `references/stages.md` owes the card; stage 8 watches its
+  signals for the window, records the outcome and acts on the decision trigger per the card.
+  `pipeline.schema.json` declares `release.users`; this repository's own `pipeline.json` says
+  `external`.
+
+## v1.101.2 (2026-10-24)
+
+**Not tagged.** Its candidate failed the tagged documentation gate: the B-150 closure cited
+the two fw07 branch heads by SHA, and after the branches were deleted a clone cannot follow
+them. The citation now names the pull request refs; everything below ships in v1.102.0.
+
+Guards: 530 → **530**; property checks 15 → **15**. No negative was added.
+
+- **The family member gate** (sshlg-skills B-108, B-109): `test/family_gate.py`, a byte-for-byte
+  copy of the hub's `member-gate/family_gate.py` with its `# shared-mechanism: family-gate` and
+  `# diverges: none` declaration, runs with `--self-test` from
+  `test/audit_regressions/family_gate_member.py` (the board parses; `release.yml` keeps the
+  tag-ancestry check).
+- **B-156:** `test/lessons_test.py` cleanup tolerates a file git's background maintenance
+  already removed (`_rm()`), the race that failed the v1.101.1 release run's first attempt.
+- **B-150 closed:** the two kept fw07 branches were deleted; their heads stay reachable as
+  `refs/pull/123/head` and `refs/pull/124/head`.
+
+## v1.101.1 (2026-10-23)
+
+Guards: 530 → **530**; property checks 15 → **15**. No negative was added: the new checks are
+two cases in `test/release_gate_test.py` (65 to 67).
+
+- **B-153:** when the release gate's python3 decision fails, its fallback refused any command
+  that spelled `tag`, `push`, `release` or `publish` anywhere, so reading
+  `.git/sshlg-release-candidates/` was refused as an outward act (2026-10-22). It now matches the
+  command shapes (`git … tag|push`, `gh … release`, `npm … publish`); every outward act it
+  refused before is still refused. Filed as B-152, an id v1.91.1 had already used.
+
 ## v1.101.0 (2026-10-22)
 
 Guards: 530 → **530**; property checks 15 → **15**. No negative was added: the new checks are

package/README.md

@@ -187,6 +187,7 @@ and the inline fallback satisfy the same [provider contract](plugins/task-pipeli
 | 5–6 TDD | [`tdd.md`](plugins/task-pipeline/skills/task-pipeline/references/tdd.md) — the iron law, red/green/refactor, the suite gate |
 | 5, 6, 8 The browser | [`browser.md`](plugins/task-pipeline/skills/task-pipeline/references/browser.md) — the ref model both channels share, the four commands the look is made of, sessions, and the three different things *"tested in a browser"* means |
 | 3, 6 The design review | [`design-review.md`](plugins/task-pipeline/skills/task-pipeline/references/design-review.md): the `design-tester` agent walks the ten-portrait test panel through the changed scenarios over the Figma frames or mockups before build and in the recorded browser after it, judges every step on a fixed checklist, and closes everything it started (`scripts/design_gate.py`, `scripts/resource_guard.py`) |
+| 7, 8 Release impact | [`release-impact.md`](plugins/task-pipeline/skills/task-pipeline/references/release-impact.md): a release in a project with users owes a card before the tag, the publish or the deploy (who is affected and how, the tracking and its watch window, the alerting and whether it ever fired, the rollback or hotfix and its decision trigger), and stage 8 watches it and acts on the trigger (`scripts/release_impact.py`) |
 | 10 Acceptance | [`acceptance.md`](plugins/task-pipeline/skills/task-pipeline/references/acceptance.md) — REQ coverage table, evidence rules, the closing question |
 | 10 + any audit | [`audit.md`](plugins/task-pipeline/skills/task-pipeline/references/audit.md) — the L0→L7 ladder and its seams, axis rotation, ratchets, proven checks |
 | any loop | [`loop-guard.md`](plugins/task-pipeline/skills/task-pipeline/references/loop-guard.md) — churn detection, caps, the break protocol |
@@ -642,7 +643,7 @@ must say so.
 ### Held to Anthropic's own Skill authoring guidance
 
 Audited against the four Agent Skills pages. Most of it already held — `name`
-13/64 chars, `description` 386/1024 chars, `SKILL.md` 207/500 lines, all 54 references
+13/64 chars, `description` 386/1024 chars, `SKILL.md` 207/500 lines, all 55 references
 reachable from `SKILL.md` through explicit reference routes, and the bundle far under the 30 MB ceiling. What
 did not, now does:
 

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.101.0 |
+| **Version** | 1.102.0 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki, and **one of two browser channels** — `playwright` (CLI or MCP) or `chrome-devtools` (MCP); either satisfies the browser step and neither is required. The engine is WebKit (Safari) first; `chrome-devtools` is Chrome-only, a stated exception. Every stage's doctrine ships in-repo; user-facing stage 3 requires a valid scenario artifact; super-ux is preferred, with equivalent-provider and inline-fallback paths under the provider contract |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.101.0",
+  "version": "1.102.0",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"
   },
   "scripts": {
-    "test": "python3 test/validate.py && python3 test/graph_test.py && python3 test/project_audit_test.py && python3 test/packet_schema_test.py && python3 test/browser_claims_test.py && python3 test/visual_gate_test.py && python3 test/stage_checkpoint_test.py && python3 test/backlog_sources_test.py && python3 test/release_approval_test.py && python3 test/memory_nudge_test.py && python3 test/lessons_test.py && python3 test/waves_test.py && python3 test/design_gate_test.py && python3 test/continuity_doc_test.py && bash test/install_test.sh && npm run test:audit-regressions",
-    "test:all": "python3 test/validate.py && python3 test/graph_test.py && python3 test/project_audit_test.py && python3 test/packet_schema_test.py && python3 test/browser_claims_test.py && python3 test/visual_gate_test.py && python3 test/stage_checkpoint_test.py && python3 test/backlog_sources_test.py && python3 test/release_approval_test.py && python3 test/memory_nudge_test.py && python3 test/lessons_test.py && python3 test/waves_test.py && python3 test/design_gate_test.py && python3 test/continuity_doc_test.py && bash test/install_test.sh && python3 test/negatives.py && npm run test:certify && npm run test:exposure && npm run test:probe && npm run test:anchors && npm run test:runner && npm run test:hooks && npm run test:artifacts && npm run test:docs && npm run test:audit-regressions",
+    "test": "python3 test/validate.py && python3 test/graph_test.py && python3 test/project_audit_test.py && python3 test/packet_schema_test.py && python3 test/browser_claims_test.py && python3 test/visual_gate_test.py && python3 test/stage_checkpoint_test.py && python3 test/backlog_sources_test.py && python3 test/release_approval_test.py && python3 test/memory_nudge_test.py && python3 test/lessons_test.py && python3 test/waves_test.py && python3 test/design_gate_test.py && python3 test/release_impact_test.py && python3 test/continuity_doc_test.py && bash test/install_test.sh && npm run test:audit-regressions",
+    "test:all": "python3 test/validate.py && python3 test/graph_test.py && python3 test/project_audit_test.py && python3 test/packet_schema_test.py && python3 test/browser_claims_test.py && python3 test/visual_gate_test.py && python3 test/stage_checkpoint_test.py && python3 test/backlog_sources_test.py && python3 test/release_approval_test.py && python3 test/memory_nudge_test.py && python3 test/lessons_test.py && python3 test/waves_test.py && python3 test/design_gate_test.py && python3 test/release_impact_test.py && python3 test/continuity_doc_test.py && bash test/install_test.sh && python3 test/negatives.py && npm run test:certify && npm run test:exposure && npm run test:probe && npm run test:anchors && npm run test:runner && npm run test:hooks && npm run test:artifacts && npm run test:docs && npm run test:audit-regressions",
     "test:negatives": "python3 test/negatives.py",
     "test:exposure": "python3 test/exposure_test.py",
     "test:probe": "python3 test/probe.py --self-test",

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/judgment/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a proportional short path for small changes, a loop guard whose ceilings stop and record a blocker, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs); a third, `waves`, takes the whole board and closes it in waves that each finish in one pass. Retro insights can publish upstream as issues, opt-in and redacted.",
-  "version": "1.101.0",
+  "version": "1.102.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/hooks/release-gate.sh

@@ -252,10 +252,13 @@ status=$?
 if [ $status -ne 0 ] || [ -z "$verdict" ]; then
   [ -f "$ledger" ] || exit 0
   # B-152: without python3 the command cannot be classified, and refusing EVERY
-  # Bash call took the whole session down on a full disk. A word-level pre-filter
-  # keeps fail-closed exactly where it matters: anything that could tag, push,
-  # release or publish is still refused; `ls` is not.
-  if ! printf '%s' "$input" | grep -Eq '(^|[^[:alnum:]_])(tag|tags|push|release|publish)([^[:alnum:]_]|$)'; then
+  # Bash call took the whole session down on a full disk. A pre-filter keeps
+  # fail-closed exactly where it matters: anything that could tag, push, release or
+  # publish is still refused; `ls` is not.
+  # B-153: it matched the WORDS, so `ls .git/sshlg-release-candidates/` was refused
+  # as an outward act. It now matches the command shapes: `git … tag|push`,
+  # `gh … release`, `npm … publish`, each word standing alone as an argument.
+  if ! printf '%s' "$input" | grep -Eq '(^|[^[:alnum:]_./-])(git([[:space:]]+[^[:space:];&|]+)*[[:space:]]+(tag|push)|gh([[:space:]]+[^[:space:];&|]+)*[[:space:]]+release|npm([[:space:]]+[^[:space:];&|]+)*[[:space:]]+publish)([[:space:]"]|$)'; then
     exit 0
   fi
   echo "task-pipeline: the stage-7 gate could not run (python3 missing or failed), and this project has a run in flight ($ledger). Refusing an outward act rather than failing open." >&2

package/plugins/task-pipeline/skills/task-pipeline/pipeline.example.json

@@ -188,6 +188,7 @@
     "enabled": true,
     "trigger": "tag",
     "approval": "checks",
+    "users": "external",
     "steps": [
       "create a GitHub release from the matching CHANGELOG section",
       "npm publish (task-pipeline-skill) — a second job in the same workflow, armed per repository by the PUBLISH_NPMJS variable (NPM_TOKEN granular automation token, or trusted publishing via OIDC); unarmed it falls back to a human 2FA step"

package/plugins/task-pipeline/skills/task-pipeline/pipeline.schema.json

@@ -310,6 +310,14 @@
           },
           "description": "Optional single-line source locator (for example docs/DECISIONS.md:42) for the standing authorization covering the tag and its publication. A locator, not a grant: how it is read and verified lives in references/deploy-targets.md, When the release waits for an approval."
         },
+        "users": {
+          "enum": [
+            "external",
+            "internal",
+            "none"
+          ],
+          "description": "Who uses what this project releases: `external` (people or systems outside the team install, call or open it), `internal` (only the team or its own agents), `none` (nothing ships to anyone). `external` and `internal` owe a release impact card at stage 7 before any outward act (scripts/release_impact.py check); `none` owes no card and the run prints `users: none` beside the stage 7 verdict. Absent means unknown and is treated as `external` (references/release-impact.md)."
+        },
         "approval": {
           "enum": [
             "checks",

package/plugins/task-pipeline/skills/task-pipeline/references/artifacts.md

@@ -36,6 +36,7 @@ docs/
       YYYY-MM-DD-<topic>-inventory.json # wave mode, stage 0 — every open item by id, verified
       YYYY-MM-DD-<topic>-canvas.md    # wave mode, stages 2–3 — the target state over the current logic
       YYYY-MM-DD-<topic>-design.md    # stage 3 — the spec / module dossier (locks shared contracts)
+      YYYY-MM-DD-<topic>-release-impact.md # stage 7 card (users, tracking, alerting, rollback); 8 adds its outcome
       YYYY-MM-DD-<topic>-acceptance.md # stage 10 — REQ coverage table + evidence
     plans/
       YYYY-MM-DD-<topic>.md           # stage 4 — the implementation plan
@@ -177,6 +178,7 @@ them is a finding, not a tie-break ([`knowledge-sources.md`](knowledge-sources.m
 | 3 Spec | `specs/<topic>-design.md` — module dossier for a decomposed platform (+ links `docs/ux/*` for UI) | stage 4 |
 | 4 Plan | `plans/<topic>.md` | stage 5 |
 | 3 UX track | `docs/ux/{foundation,flows,screens,scenarios}.md` | stages 4–9 + `/ux-lint` |
+| 7 Release impact | `specs/<topic>-release-impact.md`: the card owed before an outward act when the project has users ([`release-impact.md`](release-impact.md)) | stage 8 watches it and writes its `## Outcome`; stage 10 reads it |
 | 8 Post-deploy | log/health notes (in the run, not a committed file) | stage 9 |
 | 9 Docs+wiki | host module docs + wiki pages + the refreshed `graphify-out/graph.json` (`knowledge-graph.md`) | the **next** run's stage-0 harvest |
 

package/plugins/task-pipeline/skills/task-pipeline/references/doctrine-map.md

@@ -38,6 +38,7 @@ Custom profiles use their own declared stages and doctrine, with the kernel inta
 | any stage · The canons, and where each is enforced | [`evidence-docs`](../../evidence-docs/SKILL.md) — the sibling skill in this plugin |
 | 6–10 · Gates | `references/gates.md` |
 | 7–8 · Deploy targets | `references/deploy-targets.md` |
+| 7–8 · Release impact: who a release with users touches, its tracking, alerting and way back, the card owed before the outward act and the watch after it | `references/release-impact.md` |
 | any stage · Hooks | `references/hooks.md` |
 | 0 Knowledge harvest (pre-grill) | `references/knowledge-sources.md` |
 | 0, 9 The code graph (graphify — recommended, never required) | `references/knowledge-graph.md` |

package/plugins/task-pipeline/skills/task-pipeline/references/portability.md

@@ -59,6 +59,7 @@ a row pointing outside the bundle is the defect this file exists to catch.
 | The documentation system, the Doc Loop, supersede semantics | `references/documentation.md` |
 | Gate types, the enforcement ladder, degrees of freedom, probing | `references/gates.md` |
 | Deploy runbook template, per-platform verbs, the verification trio | `references/deploy-targets.md` |
+| **Release impact**: who has users, the card owed before an outward act (affected, tracking, alerting, rollback), the stage 8 watch and its decision trigger | `references/release-impact.md`, `templates/release-impact.md`, `scripts/release_impact.py` |
 | The Claude Code hook contract | `references/hooks.md` |
 | First run in a project: greenfield and brownfield | `references/adoption.md` |
 | The entry audit and what it inspects | `references/setup.md` |

package/plugins/task-pipeline/skills/task-pipeline/references/release-impact.md

@@ -0,0 +1,154 @@
+# Release impact: who a release touches, how it is watched, and the way back
+
+Load this at stage 7, before any outward act of a release (a tag, a publish, a deploy), and at
+stage 8, while the release is watched. Its gate is `scripts/release_impact.py`; its card is
+`templates/release-impact.md`. The rule is the operator's (2026-10-24): whenever a release is
+decided in a project that has users, the release first makes sure the current users are not
+harmed and says how they are affected; and there is always tracking that shows it goes as it
+should, an alert when it does not, and a plan to roll back or ship an urgent fix.
+
+## Contents
+
+- Who has users
+- When the card is owed
+- The card
+- What the checker refuses
+- Stage 8: the watch and the decision
+- Worked example: a skill or package release
+- Worked example: a web or mobile product
+- Companions and single homes
+- Rationalizations
+
+## Who has users
+
+`pipeline.json` → `release.users` says it, once per project:
+
+| Value | Means | The card |
+|---|---|---|
+| `external` | people or systems outside the team install, call or open what ships | owed |
+| `internal` | only the team or the operator's own agents use it | owed (the segments are small, the sections are the same) |
+| `none` | nothing ships to anyone: a scratch repository, a spike, an archive | not owed; the run writes `users: none` beside the stage 7 verdict |
+| absent | **unknown**, treated as `external` for safety | owed, and the run says the value was unknown, asks the operator once and records the answer |
+
+An answer is a property of the project, not of one release. A release that ships nothing to
+anyone in a project with users (a docs-only commit that is never tagged) is not a release here.
+
+## When the card is owed
+
+Stage 7, before the first outward act, whenever `release.users` is not `none`. The card lives
+beside the run's other records: `<artifacts>/specs/YYYY-MM-DD-<topic>-release-impact.md`, seeded
+from `templates/release-impact.md`, one per release (a release iteration writes one for the
+release it cuts, not one per wave). The stage 7 gate is:
+
+```bash
+python3 scripts/release_impact.py check <card.md> --pipeline pipeline.json
+```
+
+Exit 0 is PASS, 1 FAIL, 2 usage or an unreadable input, 3 NOT_RUN (no card where one is owed).
+NOT_RUN stops the release exactly as FAIL does: it is never green.
+
+## The card
+
+Schema `release-impact/1`. A header (`schema`, `release`, `users`) and four sections, each
+**answered** or `n/a: <reason>`. Every line the template marks `TODO` is replaced.
+
+1. **Who is affected and how.** The user segments and a rough count of each; what changes for
+   them (behaviour, data, API or file format compatibility, migrations); whether anything breaks
+   for an existing user, and for whom; the rollout shape (all at once, a staged percentage, a
+   canary, a feature flag); the timing (when, and why then).
+2. **Tracking.** The signals that show the release is going well (metrics, dashboards, logs,
+   error rates, install counts); their current **baseline**, so a change can be read as one;
+   where each is read (a URL, a command, a query); and the **watch window**, how long after the
+   release the signals are watched.
+3. **Alerting.** What fires when it goes wrong (the threshold or condition), who receives it and
+   where; and whether that alert has **ever been seen firing**. An alert nobody has seen fire is
+   written as `never`: it is a hypothesis about an alert, and the card says so rather than
+   letting it read as a tested one.
+4. **Rollback or hotfix.** The exact rollback procedure and how long it takes; whether data
+   changes are reversible (a backup, a down migration) or not, said plainly; any kill switch or
+   flag; the hotfix path; and the **decision trigger**: `roll back if <signal crosses X> within
+   <Y>`. The project's runbook owns the procedure itself
+   ([`deploy-targets.md`](deploy-targets.md) → *Runbook template*, its `Rollback` section):
+   the card links it and adds what is specific to this release, never a second copy.
+
+## What the checker refuses
+
+- No card where one is owed: NOT_RUN. A card for `users: none` is checked if it exists.
+- A header without `schema: release-impact/1`, or a `users:` value outside the three, or a card
+  whose `users:` disagrees with `pipeline.json` (or `--users`).
+- A missing section, a section that appears twice, or an empty one (an HTML comment is empty).
+- `n/a` with no reason, in a section or on any field line: `n/a: <reason>` or nothing.
+- A `TODO` left anywhere in the card.
+- Section 2 without a `Watch window:` value. Tracking cannot be `n/a` on a release with users.
+- Section 3 without a `Seen firing:` line, or answered `n/a`: something must say it went wrong.
+- Section 4 without a `Decision trigger:` that states its condition (`if` or `when`), or
+  answered `n/a`: there is always a way back, even when the way back is a hotfix.
+- At stage 8 (`--outcome`): no `## Outcome` section, or a `Result:` that is not one of `held`,
+  `rolled back`, `hotfixed`, `watching`.
+
+## Stage 8: the watch and the decision
+
+Stage 8 reads the card's signals for its watch window and records what it read in the card's
+`## Outcome` section: the signals with their values against the baseline, whether any alert
+fired, and a `Result:`. When the decision trigger fires, the run rolls back or ships the hotfix
+**per the card**, without a new debate: the trigger was agreed before the release precisely so
+that the moment it fires is not the moment it is argued about. A rollback is itself outward and
+is verified like a deploy ([`deploy-targets.md`](deploy-targets.md) → *The verification trio*).
+
+A watch window longer than the session is a wait: `Result: watching`, the window's end, and the
+watcher that reads the signals then (a scheduled job, a monitor, a named person). With no watcher
+available the card says so; it never claims a watch that nobody runs.
+`python3 scripts/release_impact.py check <card.md> --outcome` gates the record.
+
+## Worked example: a skill or package release
+
+The users are installers. Section 1 names them (`npm` weekly downloads, plugin marketplace
+installs, the operator's own machines) and what changes for them (a renamed command, a new
+required field, a dropped Node version); the rollout is all at once on the tag. Section 2 tracks
+the registry readback (`npm view <pkg> version` equals the tag), a clean-directory install, the
+installed version read back on the operator's machine, and new issues; baseline: open issues
+today; watch window: 72 h. Section 3: a failed install in the release workflow's smoke test and a
+new issue on the repository, received by the maintainer by mail; seen firing: yes, the smoke test
+failed a release once. Section 4: re-pin the previous version in every consumer, `npm deprecate
+<pkg>@<bad>` with a message pointing at the fixed one, then a patch release; minutes; nothing to
+reverse in data; decision trigger: roll back if an install fails or a breaking issue is filed
+within 72 h.
+
+## Worked example: a web or mobile product
+
+Section 1: signed-in customers on the web app (about 12,000 weekly), checkout changes to a new
+payment form; existing saved cards keep working, a stored draft order is migrated; rollout behind
+a flag at 5%, then 50%, then 100% over three days, starting on a Tuesday morning. Section 2:
+checkout conversion, payment error rate and p95 latency on the product dashboard, baselines from
+the last 14 days; the error tracker's release view; watch window: 24 h per step. Section 3: the
+error tracker alerts on a new issue class or an error rate over twice the baseline for 10
+minutes, to the on-call channel; the payment error alert has fired before, the latency one never
+has. Section 4: switch the flag off (seconds); the migration has a down step tested on a staging
+copy; the hotfix path is a patch through the normal pipeline with the flag held at its last good
+step; decision trigger: roll back if payment errors exceed 2% or conversion falls 10% below
+baseline within any step's window. A mobile release adds the store's staged rollout percentage,
+the halt button as the kill switch, and the fact that a shipped binary cannot be recalled: its
+way back is a hotfix build, so its section 4 names the server-side flag that disables the
+feature for builds already installed.
+
+## Companions and single homes
+
+- Wiring the alerts in section 3 for a service: sheleg-dev's `error-tracking` skill (releases
+  tied to commits, the release view the watch reads). Recommended, never required; absent, the
+  card names what fires on the project's own tooling.
+- The rollback procedure: the project's runbook ([`deploy-targets.md`](deploy-targets.md) →
+  *If there is no runbook, write one first*). No runbook means stage 7 writes one first, and the
+  card points at its rollback.
+- The release's authority and approval mode: [`deploy-targets.md`](deploy-targets.md) → *When
+  the release waits for an approval*. The card does not authorise anything; it is owed before
+  the act the authority allows.
+
+## Rationalizations
+
+| The excuse | Why it fails |
+|---|---|
+| "It is a small release, nobody is affected." | Then section 1 says so in one line, with the reason. The card is short when the release is; it is never absent. |
+| "We will notice if it breaks." | Noticing is section 3. If nothing is named that fires, nobody notices until a user writes. |
+| "Rollback is obvious." | Obvious to the person who shipped it, at the moment they shipped it. The trigger and the procedure are written before the release so the person at the incident does not reconstruct them. |
+| "The alert exists, it just never fired." | Then `Seen firing: never`. An alert nobody has seen fire is untested, and the card says that instead of implying the opposite. |
+| "We do not know if there are users." | Unknown is treated as `external`. Ask once and record the answer in `pipeline.json`. |

package/plugins/task-pipeline/skills/task-pipeline/references/stage-07-lint-deploy.md

@@ -13,3 +13,9 @@ The full gate and freedom level remain in [stages.md](stages.md).
   from inference about the project is one nobody can repeat or roll back, and the
   operator is standing at this gate anyway. That reference also carries the CLI
   verbs per target for when the runbook names a platform you have to recall.
+- **Before the tag, the publish or the deploy, write the release impact card** when the
+  project has users (`pipeline.json` → `release.users` is not `none`; absent counts as
+  `external`): seed `templates/release-impact.md` to
+  `<artifacts>/specs/YYYY-MM-DD-<topic>-release-impact.md`, answer its four sections, link
+  the runbook's rollback rather than copy it, and run `python3 scripts/release_impact.py
+  check <card.md> --pipeline pipeline.json` to exit 0 ([`release-impact.md`](release-impact.md)).

package/plugins/task-pipeline/skills/task-pipeline/references/stage-08-post-deploy.md

@@ -28,3 +28,9 @@ The full gate and freedom level remain in [stages.md](stages.md).
   search and answer-engine visibility with `seo-aeo-audit`
   ([`companion-skills.md`](companion-skills.md)) — recommended, never a gate;
   absent, visibility ships unaudited and the close-out says so.
+- **Watch the release impact card** ([`release-impact.md`](release-impact.md) → *Stage 8:
+  the watch and the decision*): read each signal against its baseline for the card's watch
+  window, write the card's `## Outcome`, and run `release_impact.py check <card.md>
+  --outcome`. A decision trigger that fires is acted on per the card, not debated; a window
+  that outlives the session is `Result: watching` with the watcher named, or the absence of
+  one said.

package/plugins/task-pipeline/skills/task-pipeline/references/stages.md

@@ -337,6 +337,14 @@ never that the work was skipped quietly.
   tagging, the CI verdict for what was just pushed is READ, not assumed**
   ([`conventions.md`](conventions.md) → *The CI verdict*) — a tag on a commit whose
   run nobody read is how a red `main` ships.
+- **A release with users owes its impact card before the outward act** (since the
+  operator's rule of 2026-10-24): who is affected and how, the tracking with its watch
+  window, the alerting and whether it was ever seen firing, the rollback or hotfix with its
+  decision trigger. `python3 scripts/release_impact.py check <card.md> --pipeline
+  pipeline.json` exits 0 before the tag, the publish or the deploy; NOT_RUN (no card) stops
+  the release like FAIL. `release.users: none` owes no card and prints `users: none` beside
+  this verdict; absent is unknown and treated as `external`
+  ([`release-impact.md`](release-impact.md)).
 - **The independent reader is dispatched by this stage, and read by its output**
   ([`review.md`](review.md) → *The independent reader*). On any change that adds or
   widens a check, the run dispatches a reader — a subagent it can watch, a bot whose
@@ -364,6 +372,11 @@ never that the work was skipped quietly.
   steps — never silent success. **The CI verdict is one of the reported facts, with
   its run id** — "CI is green" written without a command behind it prints the same
   whether it looked or not ([`gates.md`](gates.md) → *False success*).
+- **Watch the release impact card's signals for its window** and record what they read in
+  the card's `## Outcome` (`Result:` held, rolled back, hotfixed, or watching with its
+  watcher); `release_impact.py check <card.md> --outcome` exits 0. When the card's decision
+  trigger fires, roll back or ship the hotfix **per the card**, then verify that act as a
+  deploy ([`release-impact.md`](release-impact.md) → *Stage 8: the watch and the decision*).
 - **Write the verification row.** One line per REQ this run shipped, into
   `<artifacts>/verification.md` ([`verification.md`](verification.md)) — the run,
   the tag or commit it went out in, what the gate said, and `Human: never` unless the

package/plugins/task-pipeline/skills/task-pipeline/scripts/graph.py

@@ -1597,7 +1597,7 @@ def cmd_producer(graph, args):
 def cmd_doctrine(graph, args):
     """Which doctrine this run actually read — B-061.
 
-    The bundle is 54 reference files. A run reads some subset and nothing recorded which,
+    The bundle is 55 reference files. A run reads some subset and nothing recorded which,
     so **a skipped file and a read one were indistinguishable** — the class every guard in
     this repository exists to catch, left standing over the doctrine itself.
 

package/plugins/task-pipeline/skills/task-pipeline/scripts/release_impact.py

@@ -0,0 +1,278 @@
+#!/usr/bin/env python3
+"""The release impact card: who a release touches, how it is watched, and the way back, as a
+command with an exit code. Stdlib only.
+
+    release_impact.py check <card.md> [--users external|internal|none]
+                          [--pipeline pipeline.json] [--outcome] [--json]
+        stage 7, before any outward act: the card (`release-impact/1`) answers its four
+        sections (who is affected and how, tracking, alerting, rollback or hotfix), each
+        answered or `n/a: <reason>`. Tracking names its watch window, alerting says whether it
+        was ever seen firing, and rollback states its decision trigger; none of the three is
+        `n/a` on a release with users. `--outcome` is stage 8: the card also carries its
+        `## Outcome` with a `Result:` of held, rolled back, hotfixed or watching.
+
+Who has users: `--users`, else `pipeline.json` → `release.users`, else the card's own `users:`
+line. Absent everywhere means unknown, treated as `external` and said so. On `none` the card
+is not owed; a card that exists is still checked.
+
+**A check that could not run says NOT_RUN, and NOT_RUN is never PASS.** No card where one is
+owed is NOT_RUN.
+
+Exit codes: 0 PASS · 1 FAIL · 2 usage, or an input that cannot be read · 3 NOT_RUN.
+The doctrine is `references/release-impact.md`.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import re
+import sys
+
+SCHEMA = "release-impact/1"
+USERS = ("external", "internal", "none")
+RESULTS = ("held", "rolled back", "hotfixed", "watching")
+# The four sections, in order, by the words their heading opens with (after an optional number).
+SECTIONS = (
+    ("who", "who is affected"),
+    ("tracking", "tracking"),
+    ("alerting", "alerting"),
+    ("rollback", "rollback"),
+)
+TITLES = {"who": "1. Who is affected and how", "tracking": "2. Tracking",
+          "alerting": "3. Alerting", "rollback": "4. Rollback or hotfix"}
+# Sections the operator's rule never lets be n/a on a release with users.
+NEVER_NA = ("tracking", "alerting", "rollback")
+COMMENT = re.compile(r"<!--.*?-->", re.S)
+HEADING = re.compile(r"^##\s+(.+?)\s*$")
+HEADER = re.compile(r"^(schema|release|users|date)\s*:\s*(.*?)\s*$", re.I)
+# A field line: `- **Label:** value`, `**Label**: value` or `Label: value`.
+FIELD = re.compile(r"^\s*(?:[-*]\s+)?(?:\*\*([^*:]+?)\s*:?\s*\*\*\s*:?|([A-Za-z][A-Za-z /]*?)\s*:)\s*(.*?)\s*$")
+NA = re.compile(r"^n/?a\b\.?\s*[:;,(-]?\s*(.*?)\)?\s*$", re.I)
+
+
+def _usage(msg):
+    print("release_impact: %s" % msg, file=sys.stderr)
+    return 2
+
+
+def read_text(path):
+    with open(path, encoding="utf-8") as fh:
+        return fh.read()
+
+
+def _is_na(value):
+    """(True, reason) when the value is an n/a answer; (False, None) otherwise. A reason is a
+    word of three letters or more, so `n/a`, `n/a:` and `n/a: -` carry none."""
+    m = NA.match(value.strip())
+    if not m:
+        return False, None
+    reason = m.group(1).strip()
+    return True, (reason if re.search(r"[^\W\d_]{3,}", reason) else "")
+
+
+def _section_key(title):
+    t = re.sub(r"^\d+[.)]?\s*", "", title.strip()).lower()
+    for key, opener in SECTIONS:
+        if t.startswith(opener):
+            return key
+    if t.startswith("outcome"):
+        return "outcome"
+    return None
+
+
+def parse(text):
+    """{'header': {...}, 'sections': {key: [body lines]}, 'duplicates': [...], 'todo': [...]}.
+    HTML comments are removed first: guidance in a comment is never an answer."""
+    text = COMMENT.sub("", text)
+    header, sections, dups, todo = {}, {}, [], []
+    cur, infence = None, False
+    for n, line in enumerate(text.splitlines(), 1):
+        if re.match(r"^\s*(```|~~~)", line):
+            infence = not infence
+        if "TODO" in line:
+            todo.append(n)
+        m = None if infence else HEADING.match(line)
+        if m:
+            cur = _section_key(m.group(1))
+            if cur is not None:
+                if cur in sections:
+                    dups.append(cur)
+                sections[cur] = []
+            continue
+        if cur is None:
+            h = HEADER.match(line)
+            if h and h.group(1).lower() not in header:
+                header[h.group(1).lower()] = h.group(2)
+            continue
+        sections[cur].append(line)
+    return {"header": header, "sections": sections, "duplicates": dups, "todo": todo}
+
+
+def fields(lines):
+    """[(label lowercased, value)] for every field-shaped line of a section body."""
+    out = []
+    for line in lines:
+        m = FIELD.match(line)
+        if m:
+            out.append(((m.group(1) or m.group(2)).strip().lower(), m.group(3).strip()))
+    return out
+
+
+def field(lines, label):
+    for k, v in fields(lines):
+        if k == label:
+            return v
+    return None
+
+
+def section_state(lines):
+    """'empty', ('na', reason) or 'answered'."""
+    body = [l.strip() for l in lines if l.strip()]
+    if not body:
+        return "empty", None
+    na, reason = _is_na(re.sub(r"^[-*]\s+", "", body[0]))
+    if na and len(body) == 1:
+        return "na", reason
+    return "answered", None
+
+
+def check(text, users=None, outcome=False):
+    """(verdict, problems, notes, states, users). `users` is the project's value, or None."""
+    doc = parse(text)
+    problems, notes = [], []
+    head = doc["header"]
+    if head.get("schema", "").strip() != SCHEMA:
+        problems.append("the card is not %s: its header has no `schema: %s` line" % (SCHEMA, SCHEMA))
+    card_users = head.get("users", "").strip().lower() or None
+    if card_users and card_users not in USERS:
+        problems.append("users is one of %s, not %r" % (", ".join(USERS), card_users))
+        card_users = None
+    if users and card_users and users != card_users:
+        problems.append("the card says users: %s and the project says %s; one of them is wrong"
+                        % (card_users, users))
+    if not users:
+        users = card_users
+    if not users:
+        users = "external"
+        notes.append("who has users is unknown (no --users, no release.users, no users: line): "
+                     "treated as external; record the answer in pipeline.json")
+    for d in sorted(set(doc["duplicates"])):
+        problems.append("section %r appears twice; the card holds one of each" % TITLES.get(d, d))
+    if doc["todo"]:
+        problems.append("TODO left on line(s) %s: every placeholder is replaced"
+                        % ", ".join(map(str, doc["todo"][:10])))
+    states = {}
+    secs = doc["sections"]
+    for key, _ in SECTIONS:
+        title = TITLES[key]
+        if key not in secs:
+            states[key] = "missing"
+            problems.append("no section %r" % title)
+            continue
+        st, reason = section_state(secs[key])
+        states[key] = st
+        if st == "empty":
+            problems.append("section %r is empty: answer it, or `n/a: <reason>`" % title)
+        elif st == "na":
+            if not reason:
+                problems.append("section %r is n/a with no reason: `n/a: <reason>`" % title)
+            elif key in NEVER_NA and users != "none":
+                problems.append("section %r cannot be n/a on a release with users: there is always "
+                                "tracking, an alert and a way back" % title)
+            else:
+                notes.append("%s: n/a: %s" % (title, reason))
+        # n/a on any field line carries its reason too.
+        for label, value in fields(secs[key]):
+            na, why = _is_na(value) if value else (False, None)
+            if na and not why:
+                problems.append("%s: `%s` is n/a with no reason: `n/a: <reason>`" % (title, label))
+    if states.get("tracking") == "answered":
+        w = field(secs["tracking"], "watch window")
+        if not w or _is_na(w)[0]:
+            problems.append("section %r names no watch window (`Watch window: <how long>`)"
+                            % TITLES["tracking"])
+    if states.get("alerting") == "answered":
+        s = field(secs["alerting"], "seen firing")
+        if not s:
+            problems.append("section %r does not say whether the alert was ever seen firing "
+                            "(`Seen firing: yes (when)` or `never`)" % TITLES["alerting"])
+        elif re.match(r"^never\b", s, re.I):
+            notes.append("the alert has never been seen firing: it is untested")
+    if states.get("rollback") == "answered":
+        t = field(secs["rollback"], "decision trigger")
+        if not t or _is_na(t)[0] or not re.search(r"\b(if|when|если|когда)\b", t, re.I):
+            problems.append("section %r states no decision trigger (`Decision trigger: roll back "
+                            "if <X> within <Y>`)" % TITLES["rollback"])
+    if outcome:
+        if "outcome" not in secs:
+            problems.append("stage 8: no `## Outcome` section recording what the watch read")
+        else:
+            r = (field(secs["outcome"], "result") or "").strip().lower()
+            if not any(r.startswith(x) for x in RESULTS):
+                problems.append("stage 8: `Result:` is one of %s, not %r" % (", ".join(RESULTS), r))
+            elif r.startswith("watching"):
+                notes.append("the watch window is still open: %s" % r)
+    return ("FAIL" if problems else "PASS"), problems, notes, states, users
+
+
+def pipeline_users(path):
+    """release.users from pipeline.json; None when absent. Raises ValueError on bad input."""
+    cfg = json.loads(read_text(path))
+    rel = cfg.get("release") if isinstance(cfg, dict) else None
+    u = rel.get("users") if isinstance(rel, dict) else None
+    if u is not None and u not in USERS:
+        raise ValueError("release.users is one of %s, not %r" % (", ".join(USERS), u))
+    return u
+
+
+def emit(verdict, problems, notes, as_json, extra=None):
+    if as_json:
+        print(json.dumps(dict(verdict=verdict, problems=problems, notes=notes, **(extra or {})), indent=2))
+    else:
+        print("release_impact: %s" % verdict)
+        for p in problems:
+            print("  - %s" % p)
+        for n in notes:
+            print("  note: %s" % n)
+    return {"PASS": 0, "FAIL": 1, "NOT_RUN": 3}[verdict]
+
+
+def main(argv=None):
+    ap = argparse.ArgumentParser(description=__doc__.split("\n")[0])
+    sub = ap.add_subparsers(dest="cmd", required=True)
+    p = sub.add_parser("check")
+    p.add_argument("path")
+    p.add_argument("--users", choices=USERS)
+    p.add_argument("--pipeline", help="read release.users from this pipeline.json (--users wins)")
+    p.add_argument("--outcome", action="store_true", help="stage 8: the card carries its Outcome")
+    p.add_argument("--json", action="store_true")
+    try:
+        a = ap.parse_args(argv)
+    except SystemExit as exc:
+        return 2 if exc.code else 0
+    users = a.users
+    if not users and a.pipeline:
+        try:
+            users = pipeline_users(a.pipeline)
+        except OSError as exc:
+            return _usage("cannot read %s (%s)" % (a.pipeline, exc.strerror or exc))
+        except ValueError as exc:
+            return _usage("%s: %s" % (a.pipeline, exc))
+    if not os.path.exists(a.path):
+        if users == "none":
+            return emit("PASS", [], ["users: none: the card is not owed; write `users: none` "
+                                     "beside the stage 7 verdict"], a.json, {"users": "none"})
+        why = "" if users else " (who has users is unknown: treated as external)"
+        return emit("NOT_RUN", ["no release impact card at %s; one is owed before the outward "
+                                "act%s" % (a.path, why)], [], a.json, {"users": users or "external"})
+    try:
+        text = read_text(a.path)
+    except (OSError, UnicodeDecodeError) as exc:
+        return _usage("cannot read %s (%s)" % (a.path, getattr(exc, "strerror", None) or exc))
+    verdict, probs, notes, states, resolved = check(text, users, a.outcome)
+    return emit(verdict, probs, notes, a.json, {"users": resolved, "sections": states})
+
+
+if __name__ == "__main__":
+    sys.exit(main())

package/plugins/task-pipeline/skills/task-pipeline/templates/README.md

@@ -27,6 +27,7 @@ from `super-ux`.
 | `hooks.example.json` | the project's `.claude/settings.json` | 0 — offered, never installed silently |
 | `browser-claims.json` | stage 6, beside the look — one row per browser claim | REQ/scenario id + state + kind (look/suite/library); validated by `test/browser_claims_test.py`, stdlib only |
 | `finding-evidence.json` | one record per audit finding, wherever the finding lives | the five-axes evidence schema: mechanism / reproduction / exposure / incidence / impact uncertainty, observations apart from assumptions |
+| `release-impact.md` | `docs/evidence/specs/YYYY-MM-DD-<topic>-release-impact.md`, one per release | 7 writes it before any outward act when the project has users, checked by `scripts/release_impact.py check`; 8 adds its `## Outcome` (`--outcome`) |
 | `routing-rule.md` | the operator's `CLAUDE.md` — **offered by `setup`, never written silently** | 0 / `setup` |
 | `retro.md` | `docs/evidence/retro.md` — **one per project, not per run** | 10 writes (stamp → prune → entry), 0 reads it in full |
 | `retro-archive.md` | `docs/evidence/retro/YYYY-QN.md` | 10 rotates into it, 0 **queries** it |

package/plugins/task-pipeline/skills/task-pipeline/templates/release-impact.md

@@ -0,0 +1,50 @@
+# Release impact: TODO release name or version
+
+schema: release-impact/1
+release: TODO the tag or version this card is for
+users: TODO external | internal | none (the value in pipeline.json, release.users)
+date: TODO YYYY-MM-DD
+
+<!-- Seeded to <artifacts>/specs/YYYY-MM-DD-<topic>-release-impact.md at stage 7, before the
+first outward act. Replace every TODO. A section or a field that does not apply says
+`n/a: <reason>`; a bare `n/a` is refused. Gate:
+python3 scripts/release_impact.py check <this file> --pipeline pipeline.json
+The doctrine is references/release-impact.md in the task-pipeline skill. -->
+
+## 1. Who is affected and how
+
+- **Segments:** TODO who uses what ships, with a rough count of each
+- **What changes:** TODO behaviour, data, API or file format compatibility, migrations
+- **Breaks for existing users:** TODO no, or what breaks and for whom
+- **Rollout:** TODO all at once, staged percentage, canary or feature flag
+- **Timing:** TODO when it goes out, and why then
+
+## 2. Tracking
+
+- **Signals:** TODO the metrics, dashboards, logs or error rates that show it going well
+- **Baseline:** TODO each signal's value now
+- **Where:** TODO the URL, command or query that reads each signal
+- **Watch window:** TODO how long after the release the signals are watched
+
+## 3. Alerting
+
+- **Fires when:** TODO the threshold or condition
+- **Receives:** TODO who gets it, and where
+- **Seen firing:** TODO yes (when), or never
+
+## 4. Rollback or hotfix
+
+- **Rollback:** TODO the exact procedure, or a link to the runbook's rollback section
+- **Time to roll back:** TODO minutes or hours
+- **Data reversible:** TODO yes (backup, down migration), or no and what is lost
+- **Kill switch:** TODO the flag or switch, or n/a: <reason>
+- **Hotfix path:** TODO how an urgent fix ships
+- **Decision trigger:** TODO roll back if <signal crosses X> within <Y>
+
+<!-- Stage 8 adds the section below once the watch window is read; check it with --outcome.
+
+## Outcome
+
+- **Read:** the signals against their baselines, and any alert that fired
+- **Result:** held | rolled back | hotfixed | watching (until <when>, watcher <who or what>)
+-->

package/plugins/task-pipeline/skills/task-pipeline/templates/run.md

@@ -20,7 +20,7 @@ Run: `<topic>` · started `<YYYY-MM-DD>` · module map: `<path or "none">`
 
 ## `read:` — which doctrine this run actually opened
 
-The bundle is 54 reference files and nothing recorded which of them a run read, so **a
+The bundle is 55 reference files and nothing recorded which of them a run read, so **a
 skipped file and a read one were indistinguishable** — the class every guard in this
 pipeline exists to catch, left standing over the doctrine itself.
 
@@ -48,7 +48,7 @@ same claim one level down.
 |---|---|---|
 | `unmeasured — no run ledger` | there is no ledger | nothing to read from |
 | `unmeasured — the ledger carries no read: lines` | the hook is absent, **or** the run opened no doctrine | two opposite facts, and the ledger cannot separate them, so neither is claimed |
-| `N of 54 reference files read — unattested`, then each unread one | the hook is installed and fired | the count alone says there is a gap, not where — and `unattested` says the ledger cannot name who wrote the lines |
+| `N of 55 reference files read — unattested`, then each unread one | the hook is installed and fired | the count alone says there is a gap, not where — and `unattested` says the ledger cannot name who wrote the lines |
 
 **It is a disclosure: no floor, no direction, never a target.** A run that needs four files
 and reads four is not worse than one that reads thirty — and the moment the number becomes