task-pipeline-skill 1.29.0 → 1.30.0

package/CHANGELOG.md

@@ -1,5 +1,149 @@
 # Changelog
 
+## v1.30.0 — the cap that would have measured the wrong axis
+
+The audit's last finding was that `references/learned.md` has no retirement rule while
+`retro.md` caps its standing instructions at ten. Four measurements, each with a
+differently-shaped command — the rotation axis shipped one release ago, turned on the
+backlog that proposed it:
+
+| The belief | The command | Result |
+|---|---|---|
+| rules accumulate | table rows per tag: 15 → 18 → 21 → 21 | **flat for four releases** |
+| growth *is* rules | words per section, v1.23.0 → HEAD | **+223, every word in the binding map** |
+| the long incidents duplicate the retro | each incident's distinctive tokens against the whole retro corpus | **zero hits** — they are other projects' events, held nowhere else here |
+
+A cap of N would have squeezed the axis that had not moved in four releases. A word
+budget would have cut the incidents, which are the only record of those events anywhere
+in this repository. **The finding was right that something was missing and wrong about
+what.**
+
+**Why the retro is capped and this file is not**, now written down where the proposal
+keeps arriving: a cap belongs to a file you must *finish reading*. The retro's standing
+instructions are read in full at stage 0 — bounded by construction, or the last one is
+never reached. `learned.md` is entered by citation from twenty-three surfaces and its
+binding map is that entrance. **A file you enter through an index needs its index to be
+right, not its length to be short.**
+
+**Two triggers retire a rule, and neither is a count:** the conditions can no longer
+occur in any project the skill runs on, or the rule is **subsumed** — a merge, where the
+absorbing rule names the absorbed one and every binding-map row is repointed in the same
+change. Explicitly *not* "it became a check": that trigger is right for a standing
+instruction, whose job is to be read until the machine takes over, but here the rule is
+the **reason** the check exists, and a check whose reason was deleted is the next thing
+somebody removes as noise.
+
+Numbers are never reused and never closed up, so a departure shows as a **gap**, and a
+gap the `### Retired` log does not name now fails the build. The log exists while empty
+and says so — an absent log and an empty one are indistinguishable from outside, and
+only one of them means nothing has been retired.
+
+And the file's **shape** is now printed beside the validator's verdict — rules,
+incidents, incident words, binding rows — as a disclosure: computed, no floor, no
+direction, **never a target**. Growth becomes visible without becoming a lever.
+
+**The review found a guard that could not catch the thing it was built for.** Deleting
+the **highest-numbered** rule shrinks `max()` with it, so no gap ever opens — reproduced
+by deleting rule 21 and getting a clean pass. My own probe had planted in the middle of
+the list, which is the shape the author imagines. The mark now comes from the file
+(`Numbers issued so far: N`, the one number this file states about itself), and the log
+match is anchored to each line's leading number, because a bare digit anywhere in the
+body — *"subsumed by 9"* — masked a genuine deletion of rule 9.
+
+The disclosure was also wrong before it was right: one write-up covers two rules
+(*"4 and 5 · Probes"*), so it printed 18 where the file has 19 write-ups covering 20
+rules. It now says **rules with an incident**, because a label that does not say what
+it counts is a number nobody can check.
+
+**Swept the same class one level out.** The cold-retirement guard's corpus was a
+hand-written list of seven files. Made **discovered** instead — any shipped surface that
+states the condition must state both units — and it immediately found **thirteen**,
+including `README.md`, the Cursor rule, `gates.md` and `learned.md` itself. A narration
+of the old wording is exempt by the repository's existing convention: a double-quoted
+span is a citation, and rule 21's incident is left as it happened.
+
+**The class turned out to be the module.** Three guards in this file held
+hand-written corpora; all three had missed a shipped surface, and each miss was found
+by a reader or by a sweep rather than by the guard. All three are now **discovered**:
+the cold trigger (7 listed → 13 found), the disclosure verdicts (5 listed → README's
+worked `GATE 10` block found), and the claim registry (widened in v1.29.0 after the
+same shape). *Nobody notices a corpus that is too small, because everything inside it
+passes.*
+
+**A high-water mark the same change can lower is not one.** A reader found the residual
+hole and named why a file-only validator cannot see it: the evidence is in the previous
+commit. Deleting rule 21 *and* editing the mark to 20 makes both numbers agree and no
+gap opens. The check now reads the mark at `HEAD` through git — and where git cannot
+answer, it **prints** the skip as an `unlooked` disclosure rather than going quiet,
+because a check that falls silent outside a checkout reads exactly like a check that
+passed. That assertion is a property, not a rejection, so it lives outside the negative
+suite: the suite requires each of its tests to watch a guard *reject* something, and it
+reported the mismatch itself.
+
+**A citation naming two guards was checked as zero.** The extractor matched a single
+backtick span followed by `)*`, so invariant 43 — the one this release added, naming
+two — contributed nothing to the checked set and sat silently exempt from the invariant
+that every citation must resolve. Found by a reader, on the invariant whose subject is
+exactly that. Every literal inside a `*(guard: …)*` parenthetical is now checked, and
+one branch that had shipped unprobed (a rule numbered above the mark) now has its plant.
+
+The two discovered corpora also collapsed into one `_discover_md(skip, predicate)` —
+second occurrence of the walk, and this file's own rule promotes a class at the second,
+not the third.
+
+**A check that only worked in the window its own test used.** The cross-commit
+comparison read the mark at `HEAD` — identical to the working tree on a *committed*
+checkout, which is what CI runs. It fired only in the local pre-commit window, and the
+self-test exercised exactly that window. A reader committed the coordinated edit and
+watched it pass. The mark is now compared against **every value this file's history has
+held**, and the test commits its plant.
+
+Two more from the same round: emptying the rules table wholesale made the list falsy and
+skipped the entire check (`rules 0`, PASS), and `docs/superpowers/plans/` was missing
+from the frozen-record exclusions its two siblings carry.
+
+**CI caught what the local gate could not see.** Renaming the skip's message left the
+property check grepping for the old string — and that step lives only in the workflow,
+because it asserts something *is printed* rather than watching a guard reject. The local
+runner had no way to run it, so `npm run test:all` was green while CI failed on a string
+this same change had renamed. `test/negatives.py` now runs property checks too: a step
+that exists only in CI is a step the author's gate is blind to.
+
+**Both directions, on the guard about both directions.** The check found gaps the log
+did not name, and never the reverse: a number *listed as retired* whose row is still in
+the table — the log naming the wrong rule, or a retired rule quietly back. A gap has one
+side and so does a resurrection; only the second pass sees it. This is `learned.md`'s own
+rule 2 applied to the guard that guards `learned.md`.
+
+**And the number the exclusion moved.** Adding `docs/superpowers/plans/` to the frozen
+records took the discovered corpus from fourteen to thirteen, and two documents kept the
+old number — so the corpus's own size is now a claim-registry class, computed from the
+walk. The registry's evaluation moved below the walks that feed it: declared early,
+computed late.
+
+The local runner also learned to treat property checks as their own category — selected
+by `-k`, shown by `--list`, and reported under their own heading rather than as *"the
+validator accepted a planted defect"*, which is false for a check that plants nothing.
+Its verdict now names what ran: `PASS: all 0 guards` over an empty selection is the
+refused measurement this repository has a rule about.
+
+**A probe that could no longer fail for its own reason.** The anchor test planted a log
+line whose *body* held the digit it was about — and the high-water mark lives in that
+same section, so a bare-digit scan picked up `21`, tripped a different check, and the
+test failed either way. It could not tell a working anchor from a regressed one, which a
+reader demonstrated by reverting the anchor. The mark is now stripped before the log is
+parsed (it was never a log entry), the plant uses a number that is not a live row, and
+reverting the anchor makes the test pass again — which is what "this test measures that"
+means.
+
+Two more of the same family: the rule-row regex existed twice, byte-identical, one for
+the registry and one for the disclosure — rule 8's class inside the file that enforces
+it, now one pattern with two readers. And property checks got the floor the negative
+suite has had for releases: rename the only one and the category empties in silence,
+which is the failure property checks were added to close, one level up.
+
+Guards: 144 → **156**, plus 1 property check now covered locally.
+
 ## v1.29.0 — a sixth axis, and three summaries that each read as complete
 
 **Re-derivation** joins the rotation axes in `references/audit.md`: take a number the

package/CONTRIBUTING.md

@@ -349,7 +349,32 @@ claim-registry classes, separated by the qualifier, so a guard cannot report dri
 between two things that were never the same list.
 *(guard: `gates.md's own axes`)*
 
-**41. Every invariant above names the guard that enforces it, and that guard exists.**This list claims to be *what the validator enforces*; it was eight guards behind when
+**41. A rule leaves `learned.md` only on a logged line, and the log exists while
+empty.** Numbers are never reused and never closed up, so a departure shows as a gap in
+the table; a gap the `### Retired` log does not name is a rule that vanished with its
+incident, and the next run re-learns it at full price. The log is present and says
+*none yet*, because an absent log and an empty one look identical from outside.
+*(guard: `named in no line of`)*
+
+**42. `learned.md` has no cap, and the reason is written down where the cap keeps being
+proposed.** A cap belongs to a file read *in full* every run — that is the retro's
+standing instructions. This one is entered by citation from twenty-three surfaces.
+Measured before deciding: rules flat at 21 across four releases while the file grew, and
+every word of the growth in the binding map. Its shape prints beside the verdict as a
+**disclosure** — computed, no floor, no direction, never a target.
+*(guard: `learned.md — rules `)*
+
+**43. A guard's corpus is discovered, not hand-listed.** Three in `test/validate.py`
+held written lists, and all three had missed a shipped surface: the cold trigger named
+seven files where thirteen state the condition, the disclosure check named five where
+`README.md` also prints a worked verdict, and the claim registry excluded the Cursor
+rule and the command. Every miss was found by a reader or a sweep, never by the guard —
+**nobody notices a corpus that is too small, because everything inside it passes.**
+Exclusions are allowed and must each carry a reason in the code: a changelog narrates
+old formats, `docs/superpowers/specs/` are point-in-time records.
+*(guard: `a worked GATE verdict omits ` and `states the cold-retirement condition as` — both now run over corpora walked from disk, so a new surface joins by existing)*
+
+**44. Every invariant above names the guard that enforces it, and that guard exists.**This list claims to be *what the validator enforces*; it was eight guards behind when
 an audit measured it. A claim of enforcement is now checked like any other claim.
 *(guard: `whose message does not appear in`)* — and a cited literal must lie inside
 a **single** string in `test/validate.py`: the check reads that file as text, so a

package/README.md

@@ -576,8 +576,10 @@ The last act of stage 10 is therefore a **retrospective**, written to
 `docs/superpowers/retro.md` — **one file per project, not per run**
 ([`retrospective.md`](plugins/task-pipeline/skills/task-pipeline/references/retrospective.md)).
 Every run **stamps and prunes** — in that order, because one retirement trigger
-counts firings across the last five run stamps and a prune ahead of the stamp reads a
-counter its own stage writes afterwards. Only a run that *diverged* writes an entry:
+counts firings across the last five run stamps **or sixty days**, whichever comes
+first, and a prune ahead of the stamp reads a counter its own stage writes afterwards.
+The calendar is the unit that keeps moving when the stamp counter has stopped, which is
+exactly when a stale rule matters most. Only a run that *diverged* writes an entry:
 symptom with evidence, the stage it surfaced at, the stage that **owned** it, the
 root cause, the fix, and the check that catches it the first time from now on.
 
@@ -593,7 +595,7 @@ root cause, the fix, and the check that catches it the first time from now on.
 Every standing
 instruction is checked against three retirement triggers — *it became a check* ·
 *every path or command it names is gone* · *it has not fired in the last five run
-stamps* — and the list is held to a **hard cap of ten**. At eleven, the oldest
+stamps, or in sixty days* — and the list is held to a **hard cap of ten**. At eleven, the oldest
 never-fired rule goes; "but they all matter" is exactly the state in which the list
 stopped being read, and the ninth stale rule is what discredits the two that are
 load-bearing.
@@ -606,6 +608,7 @@ visible where it happened:
 ```
 GATE 10 acceptance: PASS — 14/14 REQ verified
   carry-over: 0 unresolved · retro: 7 standing (was 9) · retired 3 · added 1
+  abstained: 1 (1 cannot-verify) · unlooked: 0
 ```
 
 Stage 0 reads those standing instructions **in full** on the next run — which is

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.29.0 |
+| **Version** | 1.30.0 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/cursor/rules/task-pipeline.mdc

@@ -336,9 +336,11 @@ not authorize an outward, irreversible action — stage 7 stops and asks.
     times and nothing notices it is the same one. So, in this order —
     **1. Stamp the run first** — date, topic, commit, verdict, counts. It costs one
     line and it is the only thing that makes the next step computable: one retirement
-    trigger counts firings across the last five run stamps, so a prune placed ahead of
-    the stamp reads a counter its own stage writes afterwards and can never run on real
-    data.
+    trigger counts firings across the last five run stamps **or sixty days**, whichever
+    comes first, so a prune placed ahead of the stamp reads a counter its own stage
+    writes afterwards and can never run on real data. The calendar unit exists because
+    the stamp counter only moves when this pipeline runs — ten consecutive releases of
+    this repository carry no stamp at all.
     **2. Then prune.** Check every standing instruction against three
     retirement triggers: it became a check (a test, a lint rule, a gate, a hook →
     delete it; the check is the memory, and keeping both means it is read twice and

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.29.0",
+  "version": "1.30.0",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/manual gates, a frozen requirement spine that must close with evidence, a loop guard that breaks churn, one provider-agnostic model confirmed up front, and an optional super-ux UX track for user-facing work.",
-  "version": "1.29.0",
+  "version": "1.30.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/skills/task-pipeline/references/learned.md

@@ -20,6 +20,7 @@ to be enforced and is not is the same failure as a gate that prints `FAIL` and e
 - The two that are not in the table, and why
 - The one instruction that would have prevented the most
 - Where these bind in the pipeline
+- What leaves this file, and why there is no cap
 
 ## The table — trigger · check · exit criterion
 
@@ -137,7 +138,7 @@ run's belief about the work-list against the register; the claim only ever appea
 
 **20 · The copy that wins.** A service had **two Dockerfiles**. One was added at the repository root by a run that checked whether a Dockerfile existed by looking where it expected one; `docker/Dockerfile` had been there all along, and `.github/workflows/ci.yml` says `file: docker/Dockerfile`. They disagreed about the port — 8080 at the root, 8000 in `docker/` — and the disagreement surfaced two days later as a **deployed service that answered nothing**, while `docker ps` said `Up` and `systemctl` said `active`. The built one also ran as root and copied the whole context, including `.git` and any `.env`; the hardened one was the one nobody built. Comparing the two files would have found the difference and not the direction. Only the workflow line says which one ships, and it is one grep. The same session hit this three more times: an autonomy sweep row added to the file that ASKS and not the file that RECORDS, twice, caught by a validator that knew to look at both.
 
-**21 · The prune that could not run.** A retrospective's standing-instruction list has a hard cap of ten and three retirement triggers, one of which is *it has not fired in the last five run stamps*. The stage's own instruction was **prune first, then stamp**. So the trigger read a counter the same stage wrote afterwards: on a fresh list it is unreadable, and it stays unreadable for as long as nobody stamps. Measured on a real project: the last retro entry was five days old, stamps per day ran 33, 20, 26, **3, 0** — the zero on a day with 107 commits — and the list sat at exactly **10 of 10**, so every run arrived at a stage that opened with a full list, an unusable trigger and a mandatory deletion. It was not skipped out of laziness. It was skipped because its first step could not be performed, and the cheap step that would have made it performable was queued behind it.
+**21 · The prune that could not run.** A retrospective's standing-instruction list has a hard cap of ten and three retirement triggers, one of which was, at the time of this incident, "it has not fired in the last five run stamps" — it has since gained a second unit, and the incident is left as it happened. The stage's own instruction was **prune first, then stamp**. So the trigger read a counter the same stage wrote afterwards: on a fresh list it is unreadable, and it stays unreadable for as long as nobody stamps. Measured on a real project: the last retro entry was five days old, stamps per day ran 33, 20, 26, **3, 0** — the zero on a day with 107 commits — and the list sat at exactly **10 of 10**, so every run arrived at a stage that opened with a full list, an unusable trigger and a mandatory deletion. It was not skipped out of laziness. It was skipped because its first step could not be performed, and the cheap step that would have made it performable was queued behind it.
 
 The same class had already bitten that project twice from the other side, and its roadmap names the
 property exactly: seven rows read `blocked` on producers the dependency board recorded as delivered,
@@ -209,3 +210,71 @@ project buys go in its retro ([`retrospective.md`](retrospective.md) →
 lesson there that would be true in any repository belongs here instead, as an issue
 upstream. A local file that accumulates universal rules is a fork of this one that
 nobody named.
+
+---
+
+## What leaves this file, and why there is no cap
+
+`docs/superpowers/retro.md` caps its standing instructions at **ten** and retires them
+on three triggers. Somebody proposes the same cap here about once a programme. It is
+the wrong instrument, and the reason is worth more than the rule.
+
+**A cap belongs to a file you must finish reading.** The retro's standing instructions
+are read *in full* at stage 0 of every run — bounded by construction, or the last one
+is never reached. This file is never read in full: it is entered by citation from the
+stages, and *Where these bind in the pipeline* is that entrance. **A file you enter
+through an index needs its index to be right, not its length to be short.**
+
+And the cap would have measured the axis that is not moving. Re-derived across releases
+rather than recalled — **measured at each tag**, so these rows are history and cannot
+go stale; the live shape is printed by `npm test` beside its verdict, and this file
+states no number about itself:
+
+| | v1.14.1 | v1.20.0 | v1.23.0 | v1.29.0 |
+|---|---|---|---|---|
+| rules in the table | 15 | 18 | 21 | **21** |
+| words in the file | 2165 | 2987 | 3696 | **3919** |
+
+Rules have been flat for four releases while the file grew — and every word of that
+growth is in the binding map, the section that makes a rule *reachable*. Cutting there
+shortens the index. The largest section by far is the incidents, and those are the only
+record of those events anywhere in this repository — checked by taking each incident's
+distinctive tokens against the whole retro corpus, which returned nothing. They are not
+a compression target; they are the thing the rules are made of.
+
+**Two triggers retire a rule, and neither is a count:**
+
+1. **The conditions cannot occur.** The tool, the layer, or the failure mode it names
+   is gone from every project the skill runs on — not "we have not hit it lately".
+2. **It is subsumed.** Another rule covers it entirely. This is a **merge**, not a
+   delete: the absorbing rule names the absorbed one, and every binding-map row that
+   pointed at the old number is repointed in the same change, or the map now sends a
+   stage to a rule that is not there.
+
+Never *"it became a check"* — that trigger is right for a standing instruction, whose
+whole purpose is to be read until the machine takes over. Here the rule is the reason
+the check exists, and a check whose reason has been deleted is the next thing somebody
+removes as noise.
+
+**Every deletion is logged as one line**, in the same change, the same discipline as
+the retro's prune: the rule's number, its name, which trigger fired, and the commit.
+A rule that vanishes silently takes its incident with it, and the next run re-learns it
+at full price. Numbers are never reused and never closed up — a gap in the table is the
+evidence that something left, and the log below says what.
+
+### Retired
+
+**Numbers issued so far: 21.** This is the high-water mark, and it is the only number
+this file states about itself — deliberately, because the gap that proves a rule left
+cannot be computed from the table alone: **deleting the highest-numbered rule shrinks
+the maximum with it, and no gap ever opens.** That false negative shipped in the first
+draft of this very section's guard and was found by a reader, not by its probe, which
+had planted in the middle of the list.
+
+*None retired yet.* Stated rather than omitted: an empty log and a missing log look
+identical from outside, and only one of them means nothing has been retired. Each
+retirement is one line, starting with the rule's number:
+
+<!-- - **N · Name** — trigger: subsumed by M | conditions gone; `<commit>` -->
+
+---

package/plugins/task-pipeline/skills/task-pipeline/references/retrospective.md

@@ -5,6 +5,13 @@ done. It exists because the pipeline's gates are good at *this* run and blind
 across runs: the same class of failure can be caught, fixed and forgotten five
 times, and nothing in the flow notices it is the same one.
 
+**The cap here is not a general rule about doctrine files.** It applies because these
+instructions are read *in full* every run. [`learned.md`](learned.md) →
+*What leaves this file, and why there is no cap* is the other case: a file entered by
+citation, where the index must be right rather than the length short, and where a rule
+retires on two triggers that are not counts. Proposing this cap for that file is a
+recurring idea, and it is answered there with the measurement rather than an opinion.
+
 **Two artifacts, and the split is the point.** A file that is read *in full* every
 run may not contain anything that grows without limit — otherwise the cap that
 justifies reading it protects one section while the file below it doubles.