task-pipeline-skill 1.28.0 → 1.30.0

package/CHANGELOG.md

@@ -1,5 +1,211 @@
 # Changelog
 
+## v1.30.0 — the cap that would have measured the wrong axis
+
+The audit's last finding was that `references/learned.md` has no retirement rule while
+`retro.md` caps its standing instructions at ten. Four measurements, each with a
+differently-shaped command — the rotation axis shipped one release ago, turned on the
+backlog that proposed it:
+
+| The belief | The command | Result |
+|---|---|---|
+| rules accumulate | table rows per tag: 15 → 18 → 21 → 21 | **flat for four releases** |
+| growth *is* rules | words per section, v1.23.0 → HEAD | **+223, every word in the binding map** |
+| the long incidents duplicate the retro | each incident's distinctive tokens against the whole retro corpus | **zero hits** — they are other projects' events, held nowhere else here |
+
+A cap of N would have squeezed the axis that had not moved in four releases. A word
+budget would have cut the incidents, which are the only record of those events anywhere
+in this repository. **The finding was right that something was missing and wrong about
+what.**
+
+**Why the retro is capped and this file is not**, now written down where the proposal
+keeps arriving: a cap belongs to a file you must *finish reading*. The retro's standing
+instructions are read in full at stage 0 — bounded by construction, or the last one is
+never reached. `learned.md` is entered by citation from twenty-three surfaces and its
+binding map is that entrance. **A file you enter through an index needs its index to be
+right, not its length to be short.**
+
+**Two triggers retire a rule, and neither is a count:** the conditions can no longer
+occur in any project the skill runs on, or the rule is **subsumed** — a merge, where the
+absorbing rule names the absorbed one and every binding-map row is repointed in the same
+change. Explicitly *not* "it became a check": that trigger is right for a standing
+instruction, whose job is to be read until the machine takes over, but here the rule is
+the **reason** the check exists, and a check whose reason was deleted is the next thing
+somebody removes as noise.
+
+Numbers are never reused and never closed up, so a departure shows as a **gap**, and a
+gap the `### Retired` log does not name now fails the build. The log exists while empty
+and says so — an absent log and an empty one are indistinguishable from outside, and
+only one of them means nothing has been retired.
+
+And the file's **shape** is now printed beside the validator's verdict — rules,
+incidents, incident words, binding rows — as a disclosure: computed, no floor, no
+direction, **never a target**. Growth becomes visible without becoming a lever.
+
+**The review found a guard that could not catch the thing it was built for.** Deleting
+the **highest-numbered** rule shrinks `max()` with it, so no gap ever opens — reproduced
+by deleting rule 21 and getting a clean pass. My own probe had planted in the middle of
+the list, which is the shape the author imagines. The mark now comes from the file
+(`Numbers issued so far: N`, the one number this file states about itself), and the log
+match is anchored to each line's leading number, because a bare digit anywhere in the
+body — *"subsumed by 9"* — masked a genuine deletion of rule 9.
+
+The disclosure was also wrong before it was right: one write-up covers two rules
+(*"4 and 5 · Probes"*), so it printed 18 where the file has 19 write-ups covering 20
+rules. It now says **rules with an incident**, because a label that does not say what
+it counts is a number nobody can check.
+
+**Swept the same class one level out.** The cold-retirement guard's corpus was a
+hand-written list of seven files. Made **discovered** instead — any shipped surface that
+states the condition must state both units — and it immediately found **thirteen**,
+including `README.md`, the Cursor rule, `gates.md` and `learned.md` itself. A narration
+of the old wording is exempt by the repository's existing convention: a double-quoted
+span is a citation, and rule 21's incident is left as it happened.
+
+**The class turned out to be the module.** Three guards in this file held
+hand-written corpora; all three had missed a shipped surface, and each miss was found
+by a reader or by a sweep rather than by the guard. All three are now **discovered**:
+the cold trigger (7 listed → 13 found), the disclosure verdicts (5 listed → README's
+worked `GATE 10` block found), and the claim registry (widened in v1.29.0 after the
+same shape). *Nobody notices a corpus that is too small, because everything inside it
+passes.*
+
+**A high-water mark the same change can lower is not one.** A reader found the residual
+hole and named why a file-only validator cannot see it: the evidence is in the previous
+commit. Deleting rule 21 *and* editing the mark to 20 makes both numbers agree and no
+gap opens. The check now reads the mark at `HEAD` through git — and where git cannot
+answer, it **prints** the skip as an `unlooked` disclosure rather than going quiet,
+because a check that falls silent outside a checkout reads exactly like a check that
+passed. That assertion is a property, not a rejection, so it lives outside the negative
+suite: the suite requires each of its tests to watch a guard *reject* something, and it
+reported the mismatch itself.
+
+**A citation naming two guards was checked as zero.** The extractor matched a single
+backtick span followed by `)*`, so invariant 43 — the one this release added, naming
+two — contributed nothing to the checked set and sat silently exempt from the invariant
+that every citation must resolve. Found by a reader, on the invariant whose subject is
+exactly that. Every literal inside a `*(guard: …)*` parenthetical is now checked, and
+one branch that had shipped unprobed (a rule numbered above the mark) now has its plant.
+
+The two discovered corpora also collapsed into one `_discover_md(skip, predicate)` —
+second occurrence of the walk, and this file's own rule promotes a class at the second,
+not the third.
+
+**A check that only worked in the window its own test used.** The cross-commit
+comparison read the mark at `HEAD` — identical to the working tree on a *committed*
+checkout, which is what CI runs. It fired only in the local pre-commit window, and the
+self-test exercised exactly that window. A reader committed the coordinated edit and
+watched it pass. The mark is now compared against **every value this file's history has
+held**, and the test commits its plant.
+
+Two more from the same round: emptying the rules table wholesale made the list falsy and
+skipped the entire check (`rules 0`, PASS), and `docs/superpowers/plans/` was missing
+from the frozen-record exclusions its two siblings carry.
+
+**CI caught what the local gate could not see.** Renaming the skip's message left the
+property check grepping for the old string — and that step lives only in the workflow,
+because it asserts something *is printed* rather than watching a guard reject. The local
+runner had no way to run it, so `npm run test:all` was green while CI failed on a string
+this same change had renamed. `test/negatives.py` now runs property checks too: a step
+that exists only in CI is a step the author's gate is blind to.
+
+**Both directions, on the guard about both directions.** The check found gaps the log
+did not name, and never the reverse: a number *listed as retired* whose row is still in
+the table — the log naming the wrong rule, or a retired rule quietly back. A gap has one
+side and so does a resurrection; only the second pass sees it. This is `learned.md`'s own
+rule 2 applied to the guard that guards `learned.md`.
+
+**And the number the exclusion moved.** Adding `docs/superpowers/plans/` to the frozen
+records took the discovered corpus from fourteen to thirteen, and two documents kept the
+old number — so the corpus's own size is now a claim-registry class, computed from the
+walk. The registry's evaluation moved below the walks that feed it: declared early,
+computed late.
+
+The local runner also learned to treat property checks as their own category — selected
+by `-k`, shown by `--list`, and reported under their own heading rather than as *"the
+validator accepted a planted defect"*, which is false for a check that plants nothing.
+Its verdict now names what ran: `PASS: all 0 guards` over an empty selection is the
+refused measurement this repository has a rule about.
+
+**A probe that could no longer fail for its own reason.** The anchor test planted a log
+line whose *body* held the digit it was about — and the high-water mark lives in that
+same section, so a bare-digit scan picked up `21`, tripped a different check, and the
+test failed either way. It could not tell a working anchor from a regressed one, which a
+reader demonstrated by reverting the anchor. The mark is now stripped before the log is
+parsed (it was never a log entry), the plant uses a number that is not a live row, and
+reverting the anchor makes the test pass again — which is what "this test measures that"
+means.
+
+Two more of the same family: the rule-row regex existed twice, byte-identical, one for
+the registry and one for the disclosure — rule 8's class inside the file that enforces
+it, now one pattern with two readers. And property checks got the floor the negative
+suite has had for releases: rename the only one and the category empties in silence,
+which is the failure property checks were added to close, one level up.
+
+Guards: 144 → **156**, plus 1 property check now covered locally.
+
+## v1.29.0 — a sixth axis, and three summaries that each read as complete
+
+**Re-derivation** joins the rotation axes in `references/audit.md`: take a number the
+audit already produced and produce it again with a command of a **different shape**,
+then print both. Not a second opinion — a second route. Re-running the same command is
+a spell-check of the first run; only a differently-shaped question can come back
+disagreeing. The exit criterion is **the pair printed**, never "verified", never
+"matches": a re-derivation reported as agreement is a claim about a measurement nobody
+can see.
+
+It earns its place from this repository's own record. Four applications, two of which
+refuted something already written down as fact: the version invariant called *four-way*
+over five surfaces (`CONTRIBUTING.md:74`), and a graph shrink read as legitimate
+tightening at 864→839 and as erosion at 839→798 — **same procedure, opposite answers**,
+which is the whole argument for the axis in one line.
+
+**The enumeration had already drifted, and nothing could see it.** Measured before
+writing a word of doctrine: `audit.md` defined five axes, the Cursor rule summarised
+four, `README.md` three. Each reads as complete on its own, because a list of three
+orthogonal things is a convincing list of three orthogonal things. The Cursor rule now
+carries all six (it is self-contained by contract and cannot point anywhere); README
+stops enumerating and names the file that defines them — deleting a restatement is how
+every count this repository got wrong has been fixed.
+
+A guard now derives the axis keys from `audit.md` **at check time** and requires any
+paragraph naming three or more of them to name all of them. Its first run accused
+`stages.md` of enumerating three axes whose three hits were 595 lines apart and meant
+different things; scoped to the file, the predicate was measuring vocabulary rather
+than enumeration. The unit is the paragraph, and the guard says so in its own comment.
+
+**Found by the false positive:** `gates.md` was titled *the two axes* over a file with
+Axis A, B and C, and four surfaces repeated the two. README's prose named two and never
+mentioned degrees of freedom at all — the axis about how much latitude an instruction
+leaves, which is the one that gets skipped. All five sites corrected, and the count is
+now computed from the `## Axis` headings by a claim-registry class, alongside a second
+class for the rotation axes. The two are separated by the qualifier, because *axes* is
+polysemous in this corpus and a guard that conflates them reports drift that is not
+there.
+
+**Review round.** Four findings, none from the probes. The guard re-read thirty
+surfaces already cached; the flattening idiom had been hand-rolled three times, each
+commenting on the earlier ones, and is now `_flatten()`; the spec claimed a guard that
+did not exist. And the Cursor rule's **own** Gates section still said *"two axes"* with
+no Axis C — introduced by this PR, fifty lines below an edit it made. Nothing could see
+it: the claim registry's corpus held neither the Cursor rule nor the command file.
+Both are in it now, and the count moved 6 → 7 the moment they were.
+
+A second round found the same I/O class at two more call sites. Re-deriving its size
+with a differently-shaped command — an instrumented run rather than a grep of the
+source — put it at **25 reads of `audit.md` and 668 `.md` opens per run**, against an
+estimate of "3+". The two named sites are fixed; the rest is carry-over row 12 with the
+number attached, because a class measured and then left unmentioned is the TODO this
+repository refuses to keep.
+
+A third round found the sibling of the idiom the second round found — the
+paragraph-split, hand-rolled at four sites — now `_paragraphs()`, whose docstring says
+what the unit costs. And it found that the new **rotation axes** claim class was
+permanently dormant and had **never been watched failing**: dormant is green by design
+here, which is exactly why a dormant class still needs its plant. It has one now.
+
+Guards: 136 → **144**.
+
 ## v1.28.0
 
 ### Eight ways to say "I don't know", and no way to count them

package/CONTRIBUTING.md

@@ -329,7 +329,52 @@ guess. This repository had eight vocabularies for declining to claim and, until
 zero counters.
 *(guard: `a worked GATE verdict omits `)*
 
-**39. Every invariant above names the guard that enforces it, and that guard exists.**This list claims to be *what the validator enforces*; it was eight guards behind when
+**39. A surface that enumerates the rotation axes enumerates all of them.** The axes
+live once, in `references/audit.md`; the Cursor rule summarises them because it is
+self-contained by contract and can point nowhere. Measured on 2026-08-09: the
+definition held five, the Cursor rule four, README three — and each read as complete,
+because a list of three orthogonal things is a convincing list of three orthogonal
+things. The keys are derived from `audit.md` at check time, never hand-listed, and the
+unit is the **paragraph**: scoped to the file, the first version of this guard reported
+`stages.md` for three hits 595 lines apart that meant three different things. Either
+name every axis or stop enumerating and name the file.
+*(guard: `enumerates the rotation axes but names`)*
+
+**40. Counts of "axes" are computed, and the two kinds are kept apart.** `gates.md` is
+built on three of its own (context, enforcement, degrees of freedom) and `audit.md`
+rotates between six; the word is polysemous in this corpus. `gates.md` was titled *"the
+two axes"* over a file with Axis A, B and C, and four surfaces repeated it — including
+README's prose, which never mentioned degrees of freedom at all. Both counts are now
+claim-registry classes, separated by the qualifier, so a guard cannot report drift
+between two things that were never the same list.
+*(guard: `gates.md's own axes`)*
+
+**41. A rule leaves `learned.md` only on a logged line, and the log exists while
+empty.** Numbers are never reused and never closed up, so a departure shows as a gap in
+the table; a gap the `### Retired` log does not name is a rule that vanished with its
+incident, and the next run re-learns it at full price. The log is present and says
+*none yet*, because an absent log and an empty one look identical from outside.
+*(guard: `named in no line of`)*
+
+**42. `learned.md` has no cap, and the reason is written down where the cap keeps being
+proposed.** A cap belongs to a file read *in full* every run — that is the retro's
+standing instructions. This one is entered by citation from twenty-three surfaces.
+Measured before deciding: rules flat at 21 across four releases while the file grew, and
+every word of the growth in the binding map. Its shape prints beside the verdict as a
+**disclosure** — computed, no floor, no direction, never a target.
+*(guard: `learned.md — rules `)*
+
+**43. A guard's corpus is discovered, not hand-listed.** Three in `test/validate.py`
+held written lists, and all three had missed a shipped surface: the cold trigger named
+seven files where thirteen state the condition, the disclosure check named five where
+`README.md` also prints a worked verdict, and the claim registry excluded the Cursor
+rule and the command. Every miss was found by a reader or a sweep, never by the guard —
+**nobody notices a corpus that is too small, because everything inside it passes.**
+Exclusions are allowed and must each carry a reason in the code: a changelog narrates
+old formats, `docs/superpowers/specs/` are point-in-time records.
+*(guard: `a worked GATE verdict omits ` and `states the cold-retirement condition as` — both now run over corpora walked from disk, so a new surface joins by existing)*
+
+**44. Every invariant above names the guard that enforces it, and that guard exists.**This list claims to be *what the validator enforces*; it was eight guards behind when
 an audit measured it. A claim of enforcement is now checked like any other claim.
 *(guard: `whose message does not appear in`)* — and a cited literal must lie inside
 a **single** string in `test/validate.py`: the check reads that file as text, so a

package/README.md

@@ -131,7 +131,7 @@ until it is installed.
 | run-wide pacing | [`continuity.md`](plugins/task-pipeline/skills/task-pipeline/references/continuity.md) — the loop mode (`run.loop`, default off, never collapses a manual gate) and the context budget (fires on a harness signal, never on an estimate) |
 | 0 + 9 + any settled decision | [`documentation.md`](plugins/task-pipeline/skills/task-pipeline/references/documentation.md) — the inventory, registers and ids, SSOT, the Doc Loop, supersede semantics, the propagation matrix, intent vs as-built |
 | 3 + 4 · every spec and plan | the self-review reads its rules back — is every named check real, does anything contradict a locked decision or a rejected option, and what does this cost now versus at design time. Answers land as a committed `## Self-review` of computed numbers |
-| 6–10 + any check you write | [`gates.md`](plugins/task-pipeline/skills/task-pipeline/references/gates.md) — the two axes, the promotion ladder, gate anatomy, the probe recipe, ratchet floors |
+| 6–10 + any check you write | [`gates.md`](plugins/task-pipeline/skills/task-pipeline/references/gates.md) — the three axes, the promotion ladder, gate anatomy, the probe recipe, ratchet floors |
 | any agent-time enforcement | [`hooks.md`](plugins/task-pipeline/skills/task-pipeline/references/hooks.md) — the `PreToolUse` contract, the fail-open hazard, the Claude-Code-only limit |
 
 **Ported, not depended on.** Stage 0 is adapted from
@@ -431,8 +431,9 @@ Three rules keep the audit from becoming another loop:
   Measured over seven passes on a production repository, by pass six the audit was
   mostly repairing its own previous pass — while the finding count still looked
   healthy. So count both numbers every pass (new findings vs. self-inflicted ones);
-  when the second overtakes the first, **rotate the axis** — seams down one
-  deliverable, then invariants across deliverables, then one class swept end to end.
+  when the second overtakes the first, **rotate the axis**. The axes are orthogonal
+  by construction and there is one list of them, in `references/audit.md` — this line
+  used to restate three of the five that existed, and read as complete while doing it.
 - **A class that repeats twice becomes a gate, not a note.** Once is an incident;
   twice is a category, and a category belongs in lint or CI where nobody has to
   remember it. The third instance in a ledger is how a mechanical defect becomes
@@ -482,12 +483,17 @@ teaches everyone on day one that the gate is noise.
 
 ### Gates and hooks — how a rule becomes something that can say no
 
-Two axes, deliberately not conflated. **The stage gate type** (`auto` = verify it
+Three axes, deliberately not conflated. **The stage gate type** (`auto` = verify it
 yourself; `manual` = wait for an explicit go) is about this pipeline. **The
 enforcement mechanism** is a ladder a rule climbs: a doctrine line → a review
 question → a script check (promote here once the class has occurred *twice*) → a CI
 step → a hook. A rule may sit on several rungs; what it may never do is *pretend* to
-be on a higher one.
+be on a higher one. **Degrees of freedom** is the third and the one that gets
+skipped: how much latitude the *instruction* leaves — an open field where many
+routes reach a good answer, a narrow bridge where the guardrails are the wording.
+Over-constraining costs as much as under-constraining and is harder to see, because
+an agent following the letter past the point where the letter fits still reports
+success.
 
 The skill ships the anatomy of a gate that cannot lie — non-zero exit on any
 failure, the verdict block last with nothing after it, a scope header saying what it
@@ -570,8 +576,10 @@ The last act of stage 10 is therefore a **retrospective**, written to
 `docs/superpowers/retro.md` — **one file per project, not per run**
 ([`retrospective.md`](plugins/task-pipeline/skills/task-pipeline/references/retrospective.md)).
 Every run **stamps and prunes** — in that order, because one retirement trigger
-counts firings across the last five run stamps and a prune ahead of the stamp reads a
-counter its own stage writes afterwards. Only a run that *diverged* writes an entry:
+counts firings across the last five run stamps **or sixty days**, whichever comes
+first, and a prune ahead of the stamp reads a counter its own stage writes afterwards.
+The calendar is the unit that keeps moving when the stamp counter has stopped, which is
+exactly when a stale rule matters most. Only a run that *diverged* writes an entry:
 symptom with evidence, the stage it surfaced at, the stage that **owned** it, the
 root cause, the fix, and the check that catches it the first time from now on.
 
@@ -587,7 +595,7 @@ root cause, the fix, and the check that catches it the first time from now on.
 Every standing
 instruction is checked against three retirement triggers — *it became a check* ·
 *every path or command it names is gone* · *it has not fired in the last five run
-stamps* — and the list is held to a **hard cap of ten**. At eleven, the oldest
+stamps, or in sixty days* — and the list is held to a **hard cap of ten**. At eleven, the oldest
 never-fired rule goes; "but they all matter" is exactly the state in which the list
 stopped being read, and the ninth stale rule is what discredits the two that are
 load-bearing.
@@ -600,6 +608,7 @@ visible where it happened:
 ```
 GATE 10 acceptance: PASS — 14/14 REQ verified
   carry-over: 0 unresolved · retro: 7 standing (was 9) · retired 3 · added 1
+  abstained: 1 (1 cannot-verify) · unlooked: 0
 ```
 
 Stage 0 reads those standing instructions **in full** on the next run — which is
@@ -810,7 +819,7 @@ recommendation, so you arm the whole run in one exchange. Detail:
 | [`references/artifacts.md`](plugins/task-pipeline/skills/task-pipeline/references/artifacts.md) | the canonical document layout each stage writes to |
 | [`references/conventions.md`](plugins/task-pipeline/skills/task-pipeline/references/conventions.md) | how stages 6–10 read the host project's `CLAUDE.md`, and how the documentation regime is detected |
 | [`references/documentation.md`](plugins/task-pipeline/skills/task-pipeline/references/documentation.md) | the doc system: the inventory, registers and ids, SSOT, the Doc Loop, supersede semantics, the propagation matrix, intent vs as-built |
-| [`references/gates.md`](plugins/task-pipeline/skills/task-pipeline/references/gates.md) | the two axes, the promotion ladder, gate anatomy, the probe recipe, ratchet floors, where a gate runs |
+| [`references/gates.md`](plugins/task-pipeline/skills/task-pipeline/references/gates.md) | the three axes, the promotion ladder, gate anatomy, the probe recipe, ratchet floors, where a gate runs |
 | [`references/deploy-targets.md`](plugins/task-pipeline/skills/task-pipeline/references/deploy-targets.md) | stages 7–8: writing the runbook when there is none, the template, per-platform deploy and log verbs, the verification trio |
 | [`references/hooks.md`](plugins/task-pipeline/skills/task-pipeline/references/hooks.md) | the `PreToolUse` contract, the fail-open hazard, placement, and the Claude-Code-only limit |
 | [`references/knowledge-graph.md`](plugins/task-pipeline/skills/task-pipeline/references/knowledge-graph.md) | the code graph: install line, stage-0 reach queries, the stage-9 refresh, the graph↔docs divergence check |

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.28.0 |
+| **Version** | 1.30.0 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/cursor/rules/task-pipeline.mdc

@@ -336,9 +336,11 @@ not authorize an outward, irreversible action — stage 7 stops and asks.
     times and nothing notices it is the same one. So, in this order —
     **1. Stamp the run first** — date, topic, commit, verdict, counts. It costs one
     line and it is the only thing that makes the next step computable: one retirement
-    trigger counts firings across the last five run stamps, so a prune placed ahead of
-    the stamp reads a counter its own stage writes afterwards and can never run on real
-    data.
+    trigger counts firings across the last five run stamps **or sixty days**, whichever
+    comes first, so a prune placed ahead of the stamp reads a counter its own stage
+    writes afterwards and can never run on real data. The calendar unit exists because
+    the stamp counter only moves when this pipeline runs — ten consecutive releases of
+    this repository carry no stamp at all.
     **2. Then prune.** Check every standing instruction against three
     retirement triggers: it became a check (a test, a lint rule, a gate, a hook →
     delete it; the check is the memory, and keeping both means it is read twice and
@@ -404,7 +406,11 @@ its own previous pass while the finding count still looked healthy. So:
   to end (every error path, every count, every status vocabulary), then — where a
   code graph exists — **the graph against the docs**, the only axis that finds an
   absence without reading for it (a hub no document names, an edge the docs deny, a
-  doc naming a module the graph no longer has).
+  doc naming a module the graph no longer has), then **false success** (not "is this
+  check correct" but "what does this mechanism print when it did not look?"), then
+  **re-derivation** — a number the audit already produced, produced again by a
+  command of a *different shape*, with **both printed**; agreement asserted instead
+  of a pair printed is not a re-derivation.
 - **Audit bottom-up.** A missing artefact at a low rung makes everything above it
   meaningless; top-down you polish a surface for a contract that doesn't exist.
 - **A class that repeats twice becomes a check, not a note.** Once is an incident;
@@ -453,7 +459,7 @@ you *read*; the matrix names the documents you *owe*. The document nobody read i
 exactly the document nobody updated. At stage 9, walk the matrix for every change
 type the run produced, then run the documentation gate and print its ratchet counts.
 
-## Gates: two axes, and how to build one that cannot lie
+## Gates: three axes, and how to build one that cannot lie
 
 **Axis A — the stage gate type.** `auto` = verify the check yourself and stop on
 fail; `manual` = wait for an explicit operator go. An auto gate never substitutes
@@ -465,6 +471,17 @@ script check (promote here once the class has occurred **twice**) → CI step
 A rule may sit on several rungs; what it may never do is *pretend* to be on a higher
 one — that is the same failure as a gate that prints `FAIL` and exits `0`.
 
+**Axis C — degrees of freedom**, and it is the one that gets skipped. Axis B says how
+hard a rule bites; this says how much latitude the *instruction* leaves. **high** —
+prose direction, no prescribed sequence, for steps where many routes reach a good
+answer. **medium** — a named order with room inside each step. **low** — run exactly
+this, in this order, for a step that is fragile, irreversible, or must be identical
+every time. Match the level to how fragile the step is, not to how important it feels:
+an open field versus a narrow bridge. **Over-constraining costs as much as
+under-constraining and is harder to see** — a high-freedom step written as low freedom
+produces an agent that follows the letter past the point where the letter stopped
+fitting, and reports success, because it did what it was told.
+
 **Before you run any check:** the base is green (or its known-red baseline is
 recorded); the check has been probed; you have read its scope header and know what
 it does **not** cover; you have read its ratchet floors.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.28.0",
+  "version": "1.30.0",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/manual gates, a frozen requirement spine that must close with evidence, a loop guard that breaks churn, one provider-agnostic model confirmed up front, and an optional super-ux UX track for user-facing work.",
-  "version": "1.28.0",
+  "version": "1.30.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/skills/task-pipeline/SKILL.md

@@ -335,7 +335,7 @@ automation is on — `pipeline.schema.json` is the only contract.
 - `references/acceptance.md` — the built-in stage-10 close-out: REQ coverage, evidence, sign-off
 - `references/retrospective.md` — stage 10's last act: the project retro (`docs/superpowers/retro.md`), the three grades of fix, the mandatory prune and its cap of ten
 - `references/documentation.md` — cross-cutting: the doc inventory, registers and ids, SSOT, the Doc Loop, supersede semantics, the propagation matrix, intent vs as-built
-- `references/gates.md` — cross-cutting: the two axes, the promotion ladder, gate anatomy, the probe recipe, ratchet floors, where a gate runs
+- `references/gates.md` — cross-cutting: the three axes, the promotion ladder, gate anatomy, the probe recipe, ratchet floors, where a gate runs
 - `references/deploy-targets.md` — stages 7–8: writing the runbook when there is none, the template, per-platform deploy and log verbs, and the verification trio
 - `references/hooks.md` — agent-time enforcement: the PreToolUse contract, the fail-open hazard, placement, and the Claude-Code-only limit
 - `references/audit.md` — cross-cutting: the L0→L7 ladder and its seams (what was never written), axis rotation, ratchets, proven checks

package/plugins/task-pipeline/skills/task-pipeline/references/audit.md

@@ -291,6 +291,25 @@ construction**:
    every pass that reads for wrongness. Sweep the change for actions trusted by
    their own reply. Definition and the known shapes: [`gates.md`](gates.md) →
    *False success*.
+6. **Re-derivation** — take a number the audit has already produced and produce it
+   again with a command of a **different shape**, then print both. Not a second
+   opinion: a second *route*. Re-running the same command is a spell-check of the
+   first run; asking a different question that must land on the same number is the
+   only version that can come back disagreeing. The exit criterion is **the pair
+   printed** — never "verified", never "matches". A re-derivation reported as
+   agreement is a claim about a measurement nobody can see.
+
+   ```
+   claimed:    the version invariant is four-way          (CONTRIBUTING.md, prose)
+   re-derived: grep -rl '"version"\|^## v' --include='*.json' --include='*.md' . \
+                 | wc -l                                  -> 5 surfaces
+   verdict:    REFUTED — the sentence and the corpus disagree; the corpus wins
+   ```
+
+   Rotate onto this axis when the reading axes go quiet **and the change carries
+   numbers**: counts in prose, thresholds, "N of M" claims, anything a document
+   asserts about itself. Its yield is not proportional to effort — it is
+   proportional to how long the first number went unchallenged.
 
 **The crossover is measurable, so measure it.** Every pass, count two numbers: new
 findings, and findings caused by the previous pass's own fixes. When the second

package/plugins/task-pipeline/skills/task-pipeline/references/gates.md

@@ -1,4 +1,4 @@
-# Gates — the two axes, and how to build one that cannot lie
+# Gates — the three axes, and how to build one that cannot lie
 
 **One job: turn a rule into something that can say no.** [`audit.md`](audit.md)
 says a class seen twice *belongs in a script*; this file is where that script comes

package/plugins/task-pipeline/skills/task-pipeline/references/learned.md

@@ -20,6 +20,7 @@ to be enforced and is not is the same failure as a gate that prints `FAIL` and e
 - The two that are not in the table, and why
 - The one instruction that would have prevented the most
 - Where these bind in the pipeline
+- What leaves this file, and why there is no cap
 
 ## The table — trigger · check · exit criterion
 
@@ -137,7 +138,7 @@ run's belief about the work-list against the register; the claim only ever appea
 
 **20 · The copy that wins.** A service had **two Dockerfiles**. One was added at the repository root by a run that checked whether a Dockerfile existed by looking where it expected one; `docker/Dockerfile` had been there all along, and `.github/workflows/ci.yml` says `file: docker/Dockerfile`. They disagreed about the port — 8080 at the root, 8000 in `docker/` — and the disagreement surfaced two days later as a **deployed service that answered nothing**, while `docker ps` said `Up` and `systemctl` said `active`. The built one also ran as root and copied the whole context, including `.git` and any `.env`; the hardened one was the one nobody built. Comparing the two files would have found the difference and not the direction. Only the workflow line says which one ships, and it is one grep. The same session hit this three more times: an autonomy sweep row added to the file that ASKS and not the file that RECORDS, twice, caught by a validator that knew to look at both.
 
-**21 · The prune that could not run.** A retrospective's standing-instruction list has a hard cap of ten and three retirement triggers, one of which is *it has not fired in the last five run stamps*. The stage's own instruction was **prune first, then stamp**. So the trigger read a counter the same stage wrote afterwards: on a fresh list it is unreadable, and it stays unreadable for as long as nobody stamps. Measured on a real project: the last retro entry was five days old, stamps per day ran 33, 20, 26, **3, 0** — the zero on a day with 107 commits — and the list sat at exactly **10 of 10**, so every run arrived at a stage that opened with a full list, an unusable trigger and a mandatory deletion. It was not skipped out of laziness. It was skipped because its first step could not be performed, and the cheap step that would have made it performable was queued behind it.
+**21 · The prune that could not run.** A retrospective's standing-instruction list has a hard cap of ten and three retirement triggers, one of which was, at the time of this incident, "it has not fired in the last five run stamps" — it has since gained a second unit, and the incident is left as it happened. The stage's own instruction was **prune first, then stamp**. So the trigger read a counter the same stage wrote afterwards: on a fresh list it is unreadable, and it stays unreadable for as long as nobody stamps. Measured on a real project: the last retro entry was five days old, stamps per day ran 33, 20, 26, **3, 0** — the zero on a day with 107 commits — and the list sat at exactly **10 of 10**, so every run arrived at a stage that opened with a full list, an unusable trigger and a mandatory deletion. It was not skipped out of laziness. It was skipped because its first step could not be performed, and the cheap step that would have made it performable was queued behind it.
 
 The same class had already bitten that project twice from the other side, and its roadmap names the
 property exactly: seven rows read `blocked` on producers the dependency board recorded as delivered,
@@ -209,3 +210,71 @@ project buys go in its retro ([`retrospective.md`](retrospective.md) →
 lesson there that would be true in any repository belongs here instead, as an issue
 upstream. A local file that accumulates universal rules is a fork of this one that
 nobody named.
+
+---
+
+## What leaves this file, and why there is no cap
+
+`docs/superpowers/retro.md` caps its standing instructions at **ten** and retires them
+on three triggers. Somebody proposes the same cap here about once a programme. It is
+the wrong instrument, and the reason is worth more than the rule.
+
+**A cap belongs to a file you must finish reading.** The retro's standing instructions
+are read *in full* at stage 0 of every run — bounded by construction, or the last one
+is never reached. This file is never read in full: it is entered by citation from the
+stages, and *Where these bind in the pipeline* is that entrance. **A file you enter
+through an index needs its index to be right, not its length to be short.**
+
+And the cap would have measured the axis that is not moving. Re-derived across releases
+rather than recalled — **measured at each tag**, so these rows are history and cannot
+go stale; the live shape is printed by `npm test` beside its verdict, and this file
+states no number about itself:
+
+| | v1.14.1 | v1.20.0 | v1.23.0 | v1.29.0 |
+|---|---|---|---|---|
+| rules in the table | 15 | 18 | 21 | **21** |
+| words in the file | 2165 | 2987 | 3696 | **3919** |
+
+Rules have been flat for four releases while the file grew — and every word of that
+growth is in the binding map, the section that makes a rule *reachable*. Cutting there
+shortens the index. The largest section by far is the incidents, and those are the only
+record of those events anywhere in this repository — checked by taking each incident's
+distinctive tokens against the whole retro corpus, which returned nothing. They are not
+a compression target; they are the thing the rules are made of.
+
+**Two triggers retire a rule, and neither is a count:**
+
+1. **The conditions cannot occur.** The tool, the layer, or the failure mode it names
+   is gone from every project the skill runs on — not "we have not hit it lately".
+2. **It is subsumed.** Another rule covers it entirely. This is a **merge**, not a
+   delete: the absorbing rule names the absorbed one, and every binding-map row that
+   pointed at the old number is repointed in the same change, or the map now sends a
+   stage to a rule that is not there.
+
+Never *"it became a check"* — that trigger is right for a standing instruction, whose
+whole purpose is to be read until the machine takes over. Here the rule is the reason
+the check exists, and a check whose reason has been deleted is the next thing somebody
+removes as noise.
+
+**Every deletion is logged as one line**, in the same change, the same discipline as
+the retro's prune: the rule's number, its name, which trigger fired, and the commit.
+A rule that vanishes silently takes its incident with it, and the next run re-learns it
+at full price. Numbers are never reused and never closed up — a gap in the table is the
+evidence that something left, and the log below says what.
+
+### Retired
+
+**Numbers issued so far: 21.** This is the high-water mark, and it is the only number
+this file states about itself — deliberately, because the gap that proves a rule left
+cannot be computed from the table alone: **deleting the highest-numbered rule shrinks
+the maximum with it, and no gap ever opens.** That false negative shipped in the first
+draft of this very section's guard and was found by a reader, not by its probe, which
+had planted in the middle of the list.
+
+*None retired yet.* Stated rather than omitted: an empty log and a missing log look
+identical from outside, and only one of them means nothing has been retired. Each
+retirement is one line, starting with the rule's number:
+
+<!-- - **N · Name** — trigger: subsumed by M | conditions gone; `<commit>` -->
+
+---

package/plugins/task-pipeline/skills/task-pipeline/references/retrospective.md

@@ -5,6 +5,13 @@ done. It exists because the pipeline's gates are good at *this* run and blind
 across runs: the same class of failure can be caught, fixed and forgotten five
 times, and nothing in the flow notices it is the same one.
 
+**The cap here is not a general rule about doctrine files.** It applies because these
+instructions are read *in full* every run. [`learned.md`](learned.md) →
+*What leaves this file, and why there is no cap* is the other case: a file entered by
+citation, where the index must be right rather than the length short, and where a rule
+retires on two triggers that are not counts. Proposing this cap for that file is a
+recurring idea, and it is answered there with the measurement rather than an opinion.
+
 **Two artifacts, and the split is the point.** A file that is read *in full* every
 run may not contain anything that grows without limit — otherwise the cap that
 justifies reading it protects one section while the file below it doubles.