task-pipeline-skill 1.20.0 → 1.21.0

package/CHANGELOG.md

@@ -1,5 +1,28 @@
 # Changelog
 
+## v1.21.0
+
+### An empty measurement is a refused measurement — `learned.md` rule 19
+
+Rule 11 says a gate's exit code is part of its output. This is the other half, and in practice the
+louder one: **a command that never ran exits `0` and prints nothing**, and satisfies a run that
+checks neither.
+
+Three sightings in one session, one shape. A `docker run` without `-i` does not attach stdin, so a
+heredoc carrying `ALTER ROLE` stopped at the docker CLI — `psql` read an empty script, did nothing,
+exited `0`, and the step printed "password set". A `grep` pattern written against the wrong output
+format matched nothing, so three consecutive planted-defect runs printed empty strings that read as
+passes. A migration step printed no lines, which looked like a step that had not run and was in fact
+a step that had. Every time, the instrument failed and the failure was indistinguishable from
+success, because both produce nothing.
+
+- `references/learned.md` — rule 19 and incident 19.
+- `references/audit.md` — "Silence is not a reading": non-empty, shaped as expected, and quote the
+  output rather than the conclusion drawn from it.
+- `references/review.md` — the same bar before a finding is closed.
+- `test/validate.py` — a guard, watched failing against two planted defects, asserted on both the
+  exit code and the presence of the expected line.
+
 ## v1.20.0
 
 ### State that accumulates locally is created from nothing everywhere else — `learned.md` rule 18

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.20.0 |
+| **Version** | 1.21.0 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored (15 evals, 5 categories). **Never executed** — see [`evals/RESULTS.md`](evals/RESULTS.md) |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.20.0",
+  "version": "1.21.0",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/manual gates, a frozen requirement spine that must close with evidence, a loop guard that breaks churn, one provider-agnostic model confirmed up front, and an optional super-ux UX track for user-facing work.",
-  "version": "1.20.0",
+  "version": "1.21.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/skills/task-pipeline/references/audit.md

@@ -20,6 +20,7 @@ whose whole job is "audit X" runs nothing else.
 - Why "look again, more carefully" stops working
 - The ladder
 - How one audit pass runs
+- Silence is not a reading
 - Exit criterion — the part usually skipped
 - The three rules that stop this becoming another loop
 - When this runs
@@ -174,6 +175,25 @@ spine*). A finding that contradicts the spec goes back to stage 3; one that
 contradicts the plan goes back to stage 4. Auditing is not a licence to edit
 across layers in place.
 
+## Silence is not a reading
+
+`learned.md` rule 19. The ladder's evidence is commands and their output, and a command that
+printed **nothing** has not answered — it has failed in a way that looks exactly like the answer
+"nothing is wrong". The instrument and the subject fail identically, because both produce an empty
+string.
+
+Before a count, a probe or a diff becomes evidence:
+
+- **The output is non-empty.** An empty result and a broken invocation are the same characters.
+- **It is shaped as expected.** A `grep` whose pattern does not match the real output format returns
+  success and nothing else, which reads as a clean pass through whatever it was pointed at.
+- **Quote what was read, not what was concluded.** "0 findings" is a conclusion; the command and its
+  actual output are the evidence, and only they survive review.
+
+This is rule 11's other half. That one insists the exit code is part of the output; this one insists
+the output is too. A command that never ran exits `0` and prints nothing, and satisfies a run that
+checks neither.
+
 ## Exit criterion — the part usually skipped
 
 A deliverable is **not** audited when somebody has read it. It is audited when:

package/plugins/task-pipeline/skills/task-pipeline/references/learned.md

@@ -43,6 +43,7 @@ to be enforced and is not is the same failure as a gate that prints `FAIL` and e
 | 16 | **A carried-in claim is a recollection** | any run resuming from a summary, a handoff or a compacted context | re-derive the claim from its source before acting on it or reporting it | every state claim the run makes is marked `measured` with the command behind it, or it is not made |
 | 17 | **The copy you are about to edit may not be the copy that ships** | any run editing a repository that has an upstream — a skill, a plugin, a vendored library, a fork | `git rev-list --count HEAD..@{u}` **before the first edit**; non-zero means stop and pull | the run states the count it measured, or it has not started |
 | 18 | **State that accumulates locally is created from nothing everywhere else** | any run whose tests, migrations or fixtures read a database, a cache or a checkout that persists between runs on this machine | run the suite once against a **freshly created** instance of it, not the one that has been here for weeks | the run names the fresh instance it used, or the green is a green from residue |
+| 19 | **An empty measurement is a refused measurement** | any command run to establish a fact — a count, a probe, a query, a suite | assert the output is **non-empty and shaped as expected** before reading meaning into it; a command that printed nothing did not answer | the run quotes the output it read, not the conclusion it drew from silence |
 
 ---
 
@@ -130,6 +131,8 @@ run's belief about the work-list against the register; the claim only ever appea
 
 **18 · Residue.** A service's CI job started an empty database, created the runtime role in it, and ran the suite. Nothing between those two steps applied the schema. The result was **1039 failed, 1339 errors, 4704 × `UndefinedTable`** — every suite that touches a table — and it had been that way for as long as the repository had real tests. It was invisible because it is invisible *locally*: the compose database is migrated once, by hand, and stays migrated, so every author's machine has a schema and the runner's has none. The same day, in the same repository, a second instance: sixteen production tables owned by the **serving** role, because a migration had once been run as whoever was at the keyboard. Neither is a test defect. Both are the difference between state that accumulates and state that is created, and the only thing that tells them apart is running against something new.
 
+**19 · Silence read as assent.** Three failures in one session, all the same shape. A `docker run` without `-i` does not attach stdin, so a heredoc carrying `ALTER ROLE` stopped at the docker CLI; `psql` read an empty script, did nothing, and exited **0** — and the step printed "password set". A `grep` pattern written against the wrong output format matched nothing, so three consecutive planted-defect runs printed empty strings that read as passes. And a migration step printed no lines at all, which looked like a step that had not run and was in fact a step that had. In every case the instrument failed and the failure was **indistinguishable from success**, because both produce nothing. Rule 11 covers the exit code; this covers the other half, which is louder in practice: an exit code of 0 from a command that never ran is the most convincing lie a run can tell itself.
+
 The same class had already bitten that project twice from the other side, and its roadmap names the
 property exactly: seven rows read `blocked` on producers the dependency board recorded as delivered,
 and *"no gate can catch it because it breaks nothing — it only removes work from consideration"*;

package/plugins/task-pipeline/skills/task-pipeline/references/review.md

@@ -195,3 +195,5 @@ Run the final review on the **run's confirmed model** like everything else
 change, so if the run is on a tier below the most capable one available, say so and
 offer to escalate just this dispatch — a recommendation stated out loud, never a
 silent switch (`build.md` → *Models*).
+
+**An empty result is not a clean result** (`learned.md` rule 19). A verification command that printed nothing did not verify anything — the instrument and the subject fail identically, because both produce an empty string. Assert the output is non-empty and shaped as expected before any finding is closed on it, and quote the output rather than the conclusion.