task-pipeline-skill 1.16.0 → 1.16.2

package/CHANGELOG.md

@@ -1,5 +1,66 @@
 # Changelog
 
+## v1.16.2 — 2026-08-06
+
+### Added — a CI run is checked by reading it, not by assuming it
+
+The bundle offered a place (`conventions.md`: *"CI: the workflow run."*) and a claim
+(`release.verify`: *"CI green on the tagged commit"*) with no method between them.
+Both are satisfiable by believing them, which is the class `gates.md` named in
+v1.14.0: **an actor's own reply is not evidence about the world**, and the test —
+*what does it print when it did not look?*
+
+The occasion was v1.15.0's own release. `validate` was `completed/failure` on a push
+to `main` and on the release tag. The failure was **correct**: the repository's own
+*Every v\* tag must be contained in main* guard, firing on a tag that was not yet an
+ancestor — precisely the defect v1.6.1 built it for. The guard worked, and **nothing
+obliged anyone to read it**. A guard nobody reads is a fail-open hook with extra
+steps; it surfaced only because the run happened to poll the API.
+
+- **`conventions.md` gains *The CI verdict***: the commands (`gh run list … --json
+  databaseId,name,status,conclusion,headSha`, then `gh run view … --log-failed`), an
+  **unauthenticated fallback** on the `check-runs` API, and **three states** —
+  concluded, in progress (*"it was still running when I looked"* is a report, not a
+  verdict), and **no run found**, said out loud, because a project without CI is a
+  legitimate state and not a green one.
+- **Read the log, not just the verdict.** A conclusion says *that* it failed; only the
+  log said *what* — the guard's name, the orphan tag and the one-line fix. A bare "CI
+  failed" hands the next reader a search the log had already finished.
+- **Two paths because one credential died.** `gh`'s token expired mid-run that night,
+  and `gh auth status` reported it invalid from a **cached** verdict while `gh api
+  user` succeeded. The doctrine names the live call, never the status command.
+- **Bound at stages 7, 8 and 9** — every stage of this flow that pushes. The incident
+  hit at the merge and again at the docs push; binding stage 8 alone would have caught
+  neither. The gates cite `conventions.md`; a guard rejects a second copy of the
+  commands.
+- **It reports, it does not block** — the shape stage 8 already used for deploy logs.
+  Blocking would make a project *without* CI cheaper to ship from than one with it.
+
+### Fixed — the negatives floor may no longer lag its own workflow
+
+`MIN_EXPECTED` is a number in a living document, so rule 8 binds it: it must **equal**
+the workflow's count, not merely sit below it. Its own comment records the first lag
+(20 while the workflow carried 34); v1.15.0 was the second — four canon self-tests
+landed and the floor stayed at 104 while the file carried 108. A floor below the count
+cannot notice losing the difference, which is the entire job. Now guarded, and the
+guard was watched rejecting a lowered floor.
+
+## v1.16.1 — 2026-08-06
+
+### Fixed — frontmatter that a regex called valid and a YAML parser silently dropped
+
+`evidence-docs`'s description contained *"read as true: a decision record"*. A
+colon-space inside a plain YAML scalar makes the value a nested mapping, so the official
+plugin validator reported the skill **loads with empty metadata — every frontmatter field
+silently dropped**, which for a skill means it never triggers. v1.16.0 published in that
+state.
+
+The guard that was supposed to catch it checked the frontmatter with a regular
+expression and passed: a check proving less than it claims, shipped in the release that
+publishes canon 6. It now rejects a plain scalar carrying a colon-space, across **every**
+`SKILL.md` in the plugin rather than only the new one — the class, not the instance.
+Guards 112 → 113.
+
 ## v1.16.0 — 2026-08-06
 
 ### Added — `evidence-docs`: a second skill in this plugin, and the router row it fills

package/CONTRIBUTING.md

@@ -235,7 +235,21 @@ commands and all three signal states — with a state missing, a graph that coul
 be measured prints like a fresh one.
 *(guard: `never requires it — a run passes intake quoting a`)*
 
-**31. The evidence-docs navigator indexes the canons and never copies them.**
+**31. A CI run's verdict is read, never assumed — and every stage that pushes says so.**
+`references/conventions.md` → *The CI verdict* keeps the commands, the unauthenticated
+fallback and all three states; stages 7, 8 and 9 cite it rather than carrying a second
+copy. A workflow run that nobody reads is the fail-open hook with extra steps: this
+repo's own `validate` was red on a push to `main` and on a release tag, the guard that
+failed was correct, and nothing obliged anyone to look.
+*(guard: `never names it — the run it triggers is closed on an unread verdict`)*
+
+**32. The negatives floor equals the workflow's count.**
+`MIN_EXPECTED` is a number in a living document (rule 8). Below the count it cannot
+notice losing the difference — it lagged at 20 against 34 once, and at 104 against 108
+in v1.15.0.
+*(guard: `a floor below the count is a floor that cannot`)*
+
+**33. The evidence-docs navigator indexes the canons and never copies them.**
 `skills/evidence-docs/SKILL.md` is a second skill in the same plugin: the ten canons as
 a one-line index, a pointer to their one home, and a table of where to go next. The
 guard holds the index to the doctrine's own list, requires the pointer, and resolves
@@ -243,8 +257,7 @@ every relative link **from the navigator's directory** — it sits one level ove
 everything it names, which is canon 4 in the file that publishes canon 4.
 *(guard: `index that has drifted from its doctrine`)*
 
-**32. Every invariant above names the guard that enforces it, and that guard exists.**
-This list claims to be *what the validator enforces*; it was eight guards behind when
+**34. Every invariant above names the guard that enforces it, and that guard exists.**This list claims to be *what the validator enforces*; it was eight guards behind when
 an audit measured it. A claim of enforcement is now checked like any other claim.
 *(guard: `whose message does not appear in`)* — and a cited literal must lie inside
 a **single** string in `test/validate.py`: the check reads that file as text, so a

package/README.md

@@ -66,7 +66,7 @@ Every gate is **typed**: `auto` — the orchestrator verifies it itself, pass/fa
 | 5 | Dev | tasks DONE (three review verdicts each), TDD green per task | auto |
 | 6 | Tests | full suite green, new code covered | auto |
 | 7 | Lint + deploy | lint clean + suite green before deploy | manual |
-| 8 | Post-deploy | clean boot / honest degradation | auto |
+| 8 | Post-deploy | clean boot / honest degradation, **and the CI verdict read rather than assumed** | auto |
 | 9 | Docs + wiki | the propagation matrix walked and the documentation gate green with its ratchets printed; every stale source-ledger row updated; docs + wiki synced; the code graph refreshed and checked against the docs | auto |
 | 10 | **Acceptance** | every REQ accounted for with evidence; every check leaned on seen failing once; operator signs off; the retro written — pruned before anything was added, every lesson carrying its commit | manual |
 
@@ -213,6 +213,27 @@ obsidian-wiki setup --vault /path/to/your/vault
 It is a **recommendation, never a gate** — no stage blocks on a missing wiki, and
 nothing asks twice in one run.
 
+### The CI verdict — read the run, never assume it
+
+A push either triggered a workflow run or it did not, and either way the run's own
+reply is the only evidence. *"CI is green"* written without a command behind it prints
+the same whether it looked or not.
+
+This repository learned it the direct way: `validate` was `completed/failure` on a push
+to `main` and on a release tag, the guard that failed was **correct** — a tag that was
+not yet an ancestor of `main` — and nothing obliged anyone to read it. A guard nobody
+reads is a fail-open hook with extra steps.
+
+So stages 7, 8 and 9 — every stage of the flow that pushes — require the verdict to be
+**read and quoted**: the conclusion with its run id, the failing step's log on anything
+but success, and one of three states, including **`no run found`** said out loud,
+because a project without CI is a legitimate state and not a green one. Two command
+paths, authenticated and not, because a dead token must not end the check. It reports;
+it does not block.
+
+Method: [`conventions.md`](plugins/task-pipeline/skills/task-pipeline/references/conventions.md)
+→ *The CI verdict*.
+
 ### The code graph — reach, and a second opinion on your docs
 
 A grep finds a **name**. A graph finds **reach**: what actually calls this, what

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.16.0 |
+| **Version** | 1.16.2 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored (15 evals, 5 categories). **Never executed** — see [`evals/RESULTS.md`](evals/RESULTS.md) |

package/cursor/rules/task-pipeline.mdc

@@ -243,7 +243,17 @@ not authorize an outward, irreversible action — stage 7 stops and asks.
    outward → explicit user go, or the specific standing authorization recorded in
    the stage-0 brief.
 8. **Post-deploy** (auto) — tail logs / health-check; clean boot or an honest
-   degradation report (never silent success).
+   degradation report (never silent success). **Read the CI verdict, never assume
+   it** — `gh run list --branch <b> --limit 1 --json databaseId,name,status,conclusion,headSha`,
+   then `gh run view <id> --log-failed` on anything but success (unauthenticated
+   fallback: `curl -s https://api.github.com/repos/<owner>/<repo>/commits/<sha>/check-runs`).
+   Quote the conclusion with its run id, quote the failing step, and state one of
+   three states: concluded / in progress (wait and re-read — "it was still running"
+   is a report, not a verdict) / **no run found**, said out loud, because a project
+   without CI is a legitimate state and not a green one. Probe credentials with a
+   live call, never `gh auth status`, which answers from cache. This binds every
+   stage that pushes — 7, 8 and 9 — not just this one. It reports; it does not
+   block.
 9. **Docs + wiki** (auto) — **the phase-1 source ledger is the work list**: every
     source the harvest read gets updated if this run changed or disproved it. Module
     docs and runbooks in the SAME change; the knowledge wiki via `wiki-update` when

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.16.0",
+  "version": "1.16.2",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/manual gates, a frozen requirement spine that must close with evidence, a loop guard that breaks churn, one provider-agnostic model confirmed up front, and an optional super-ux UX track for user-facing work.",
-  "version": "1.16.0",
+  "version": "1.16.2",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/skills/evidence-docs/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: evidence-docs
-description: Applies the ten canons of evidence-backed documentation — what makes a claim documentation rather than an assertion — and routes to the doctrine that enforces each one. Use when writing or reviewing anything that will be read as true: a decision record, a README, an acceptance report, a runbook, a changelog entry, an audit finding, or any claim that something was verified. Also use when a project needs a documentation gate, a decision register, a propagation matrix, or a retrospective that outlives its author. Not for drafts, chat answers, commit messages or code comments.
+description: Applies the ten canons of evidence-backed documentation — what makes a claim documentation rather than an assertion — and routes to the doctrine that enforces each one. Use when writing or reviewing anything that will be read as true — a decision record, a README, an acceptance report, a runbook, a changelog entry, an audit finding, or any claim that something was verified. Also use when a project needs a documentation gate, a decision register, a propagation matrix, or a retrospective that outlives its author. Not for drafts, chat answers, commit messages or code comments.
 ---
 
 # Evidence-backed documentation

package/plugins/task-pipeline/skills/task-pipeline/pipeline.example.json

@@ -133,7 +133,7 @@
       ],
       "gate": {
         "type": "auto",
-        "check": "clean boot confirmed (no error spike, live subsystems healthy), or an honest degradation report with next steps"
+        "check": "clean boot confirmed (no error spike, live subsystems healthy), or an honest degradation report with next steps. THE CI VERDICT IS READ, NEVER ASSUMED (references/conventions.md -> The CI verdict): the run's conclusion for this commit is quoted with its run id, the FAILING STEP'S LOG is quoted on anything but success, and one of three states is stated — concluded / in progress (wait and re-read; 'it was still running' is a report, not a verdict) / NO RUN FOUND, said out loud, because a project without CI is a legitimate state and not a green one. 'CI is green' written without a command behind it prints the same whether it looked or not (references/gates.md -> False success). Two command paths, because a credential problem must not end the check: 'gh run list --branch <b> --limit 1 --json databaseId,name,status,conclusion,headSha' then 'gh run view <id> --log-failed', or unauthenticated 'curl -s https://api.github.com/repos/<owner>/<repo>/commits/<sha>/check-runs'. Probe credentials with a live call, never with 'gh auth status', which answers from cache. It reports, it does not block."
       }
     },
     {
@@ -182,7 +182,7 @@
       "npm publish (task-pipeline-skill) — a second job in the same workflow, armed per repository by the PUBLISH_NPMJS variable (NPM_TOKEN granular automation token, or trusted publishing via OIDC); unarmed it falls back to a human 2FA step"
     ],
     "verify": [
-      "CI green on the tagged commit",
+      "CI green on the tagged commit — READ, not assumed: the run's conclusion quoted with its run id, and the failing step's log quoted on anything but success (references/conventions.md -> The CI verdict)",
       "npx github:ssheleg/task-pipeline#<tag> from a clean cwd installs the skill + command",
       "after npm publish: npm view task-pipeline-skill version == <tag>"
     ]

package/plugins/task-pipeline/skills/task-pipeline/references/conventions.md

@@ -8,6 +8,16 @@ names its doc repos, its knowledge base and its house rules
 Prefer explicit host instructions over detection; if a step's convention can't be
 found, surface it and **ask** rather than guessing.
 
+## Contents
+
+- Lint + test
+- Deploy / release
+- Post-deploy logs
+- The CI verdict — read the run, never assume it
+- Docs + wiki
+- Documentation regime (stage 0, then 9 and 10)
+- Issue tracker (stage 10)
+
 ## Lint + test
 - `CLAUDE.md` usually names the commands. Else detect: `package.json` scripts
   (`npm test` / `npm run lint`), `pyproject.toml` / `ruff` (`ruff check`), `pytest`,
@@ -30,7 +40,61 @@ found, surface it and **ask** rather than guessing.
 
 ## Post-deploy logs
 - Heroku: `heroku logs -a <app>`. Docker / k8s: `docker logs` / `kubectl logs`.
-  CI: the workflow run. Hit the health endpoint if one is defined.
+  Hit the health endpoint if one is defined. **CI: the workflow run — and a run is
+  checked by reading it, below.**
+
+## The CI verdict — read the run, never assume it
+
+A push either triggered a run or it did not, and either way **the run's own reply is
+the only evidence** ([`gates.md`](gates.md) → *False success*). "CI is green" written
+without a command behind it is a sentence that prints the same whether it looked or
+not.
+
+This is not hypothetical. On 2026-08-06 this repository's `validate` was
+`completed/failure` on a push to `main` and on a release tag. The failure was
+**correct** — the *Every v\* tag must be contained in main* guard firing on a tag that
+was not yet an ancestor — and nothing in this bundle obliged anyone to read it. A
+guard nobody reads is a fail-open hook with extra steps.
+
+```bash
+# authenticated
+gh run list --branch <branch> --limit 1 \
+  --json databaseId,name,status,conclusion,headSha
+gh run view <databaseId> --log-failed        # only when conclusion != success
+```
+
+```bash
+# unauthenticated fallback — public repo, no token needed
+curl -s "https://api.github.com/repos/<owner>/<repo>/commits/<sha>/check-runs"
+```
+
+**Two paths on purpose.** A credential problem must not end the check: this repo's
+`gh` token expired mid-run the same night, and `gh auth status` reported it invalid
+from a **cached** verdict while `gh api user` succeeded. Probe credentials with a
+live call, never with the status command.
+
+**Three states, and the third is why this is written down:**
+
+| State | Condition | Record |
+|---|---|---|
+| **concluded** | a run exists for this sha, `status == completed` | the conclusion and run id — and on any non-`success`, the **quoted failing step** |
+| **in progress** | a run exists, not finished | wait and re-read. *"It was still running when I looked"* is a report, not a verdict |
+| **no run found** | no run for this sha | say so out loud — a project without CI is a legitimate state and **not a green one** ([`gates.md`](gates.md) → *Progressive arming*) |
+
+**Read the log, not just the verdict.** A conclusion says *that* it failed; only the
+log says *what*. In the incident above the log named the guard, the orphan tag and the
+one-line fix — a bare "CI failed" would have handed the next reader a search the log
+had already finished. On any non-`success`: read the failing step and quote the line
+that names the failure.
+
+**It reports; it does not block.** Same shape stage 8 already uses for deploy logs — a
+red run the operator has seen and ruled on is a decision, a red run nobody printed is
+the failure. Blocking would also make a project *without* CI cheaper to ship from than
+one with it.
+
+**Promote it when it breaks** ([`gates.md`](gates.md) → *Axis B*): this sits at rung 2,
+a criterion in the stage gates. Promote it to a script the first time a run is observed
+closing a stage with an unread CI verdict.
 
 ## Docs + wiki
 - **Start from the stage-0 source ledger** ([`knowledge-sources.md`](knowledge-sources.md)):

package/plugins/task-pipeline/skills/task-pipeline/references/portability.md

@@ -75,6 +75,7 @@ a row pointing outside the bundle is the defect this file exists to catch.
 | Which companions exist, what is required, self-currency | `references/companion-skills.md` |
 | The code graph: queries, refresh, the graph↔docs divergence | `references/knowledge-graph.md` |
 | How the graph's staleness is measured and stated in the ledger | `references/knowledge-graph.md` |
+| How a CI run's verdict is established, and its three states | `references/conventions.md` |
 | Model policy — tier not id, ask once at preflight | `references/model-tiering.md` |
 | This boundary | `references/portability.md` |
 

package/plugins/task-pipeline/skills/task-pipeline/references/stages.md

@@ -345,14 +345,24 @@ never that the work was skipped quietly.
   `partial` ships only with the operator's explicit acceptance. A gap is cheapest to
   close before it ships, and the operator is already present at this gate. **The
   carry-over count is printed beside this verdict.** Deploy is outward → explicit
-  operator go. Respect deploy-from-main rules if the project mandates them.
+  operator go. Respect deploy-from-main rules if the project mandates them. **Before
+  tagging, the CI verdict for what was just pushed is READ, not assumed**
+  ([`conventions.md`](conventions.md) → *The CI verdict*) — a tag on a commit whose
+  run nobody read is how a red `main` ships.
 
 ## 8 — Post-deploy
 - **Freedom: medium** — where the logs live varies; 'clean boot or an honest degradation report' does not ([`gates.md`](gates.md) → *Axis C*).
 - Tail deploy logs / health-check per conventions. Confirm clean boot, no error
   spike, live subsystems healthy.
+- **Read the CI verdict for the deploy's own commit** ([`conventions.md`](conventions.md)
+  → *The CI verdict*): the run's conclusion quoted, the **failing step's log quoted**
+  on anything but `success`, and one of the three states stated — including **`no run
+  found`**, out loud, because a project without CI is a legitimate state and not a
+  green one.
 - **GATE (auto):** clean boot confirmed, or an **honest degradation report** with next
-  steps — never silent success.
+  steps — never silent success. **The CI verdict is one of the reported facts, with
+  its run id** — "CI is green" written without a command behind it prints the same
+  whether it looked or not ([`gates.md`](gates.md) → *False success*).
 
 ## 9 — Docs + wiki
 - **Freedom: low** — the matrix walk and the gate are mechanical; what a doc says is not this stage's call ([`gates.md`](gates.md) → *Axis C*).
@@ -405,7 +415,10 @@ never that the work was skipped quietly.
   written and reconciled**; UI: super-ux layers current + linter green; wiki synced
   (or absent and recommended once); **the code graph
   refreshed where one exists, or the reason it wasn't written into the carry-over
-  ledger** (absent and recommended once is fine); dangling links fixed; **the
+  ledger** (absent and recommended once is fine); dangling links fixed; **the CI
+  verdict read for this stage's own push** ([`conventions.md`](conventions.md) →
+  *The CI verdict*) — this stage pushes like any other and is the one that habitually
+  ends a run, so an unread red here is a red `main` nobody is coming back to; **the
   carry-over count printed beside this verdict**.
 
 ## 10 — Acceptance