task-pipeline-skill 1.31.0 → 1.33.0

package/CHANGELOG.md

@@ -1,5 +1,120 @@
 # Changelog
 
+## v1.33.0 — the number, the list, and the command that shows them with no task running
+
+Three modules shipped as one, because they are one capability: the index, the list it
+produces, and the command that prints them when nothing else is running.
+
+**Exposure is a vector with its components named, never a probability.** The request that
+started this asked for *"the probability of an error"*. It is not computable from these
+inputs, and a number dressed as one is the class this repository has spent its history
+removing — so the guard rejects a `%` on that line outright:
+
+```
+exposure: 99 unverified · never checked · 10 releases carry one
+    REQ-001  references/setup.md — the entry audit: when it runs …   v1.10.0
+    …
+    and 91 more — the full list is `/task-pipeline checkup`
+```
+
+**`never checked`, not `0 days`.** When no row has ever been confirmed — this repo's
+exact state — a zero would read as *checked today*, the precise inversion this pipeline
+exists to prevent. The literal is required by its own guard.
+
+**A single score was refused on purpose.** One number invites a threshold, and a
+threshold here is a target on `never`, which `verification.md` says may never have one.
+The components are one line; a reader can hold three.
+
+**`/task-pipeline checkup` runs with no task in flight**, which is the whole point:
+accumulated unconfirmed work is invisible precisely because nobody is running a pipeline,
+so a check living only inside a run can never say *stop, fourteen things are
+unconfirmed*. It reads four files this pipeline already keeps and writes nothing unless
+asked — and then only board rows whose `Source` names the checkup, printed before they
+are added.
+
+**And `continuity.md` finally names the file it always demanded.** It has required each
+iteration to re-measure the work-list since the beginning, and said *"next up is X"* is
+a claim no gate reads. The board is that list; the claim now cites a `B-NNN`, which can
+be checked, rather than a description, which cannot.
+
+**Two defects in the new guard, both self-inflicted and both instructive.** Its needle
+looked for *"never a percentage"* while the doctrine it guards says *"no percentage,
+ever"* — guard and prose written an hour apart, already disagreeing. And the `%` check
+searched for a literal that its own line necessarily contains, so it matched **itself**
+and passed a planted percentage. A detector that matches itself first is checking the
+wrong thing.
+
+Guards: 185 → **188**, property checks 8.
+
+## v1.32.0 — the column a machine may not fill
+
+Stage 8 already performs the verification trio, reads the CI verdict and opens the
+rendered page. All of it **per run**, none of it accumulating — so *"which features has
+nobody confirmed since they shipped?"* had no artifact to be asked of.
+
+`docs/superpowers/verification.md` is one row per shipped REQ, and its point is a single
+column: **`Human` — a date, or the literal `never`.** Nothing else. *"soon"*, *"mostly"*
+and *"looks fine"* are how a column stops being answerable, and this is the one thing in
+the pipeline a machine may not write on your behalf.
+
+**`never` is a fact, not a failure.** The count has no floor, no direction, and may
+never be given a target — the moment `never` becomes something to avoid writing, the
+column starts lying and the pipeline loses its only signal about the world outside its
+own checks. One of the new checks is a **property check** proving that filling the
+column does not fail the build: a gate that punishes an honest answer guarantees there
+will not be one.
+
+**It keys to the brief, not to the coverage table**, and that was a measurement rather
+than a preference. Ten acceptance files here carry their first REQ-bearing table in
+nearly as many shapes, because `acceptance.md` fixes it in prose — the same drift the
+carry-over ledger reached with six header shapes. Eight of nine briefs carry
+machine-readable `| REQ-NNN |` rows; the ninth was this programme's own brief, fixed the
+day it was measured. That the coverage table has no template is a real finding with a
+real cost, and it is on the board rather than fixed here.
+
+Both directions, because they are different failures: a shipped REQ that entered no
+ledger, and a ledger row about a requirement no brief carries.
+
+**Seeded truthfully: 103 rows, every one `never`.** Thirty-one versions shipped, and not
+one recorded instance of a person confirming a shipped requirement afterwards. That is
+not a new problem — it is the first time it can be stated.
+
+**Review round: N1's lesson carried forward by its wrong half.** The Human check
+scanned *every* cell for a date or `never`, so a bare date sitting in the Note column
+satisfied a row whose Human read *"soon"* — precisely the prose the guard exists to
+reject. N1 concluded *"the header names the candidate columns and the match happens
+inside them"*, not *"never look at columns"*; this file is templated and has exactly one
+shape, so the column is located by name and read alone.
+
+**A file that states one truth twice, and drifted for two modules.** `artifacts.md`
+carries an ASCII layout tree *and* the tables that name the same files — and the tree
+never gained `backlog.md` (shipped in v1.31.0) or `verification.md` (this release), both
+named in tables a hundred lines above it. A reader found it; nothing compared them. The
+tree is now computed against those tables.
+
+The seeded ledger also truncated its `What` column at 72 characters, leaving unterminated
+code spans, while the template it follows says *"copied from the brief, not re-worded"* —
+sixty-seven of a hundred and three rows landing at exactly 72 is a script's fingerprint,
+not an editor's. Reseeded in full: 26 to 246 characters, none at 72.
+
+**The ledger recorded unbuilt features as shipped and verified.** The seed took every
+REQ from every brief — including this programme's own, whose REQ-004/008/009/010 belong
+to modules that do not exist yet, and whose N2 rows were stamped with N1's version. In
+the file whose entire purpose is *what actually shipped*. Reseeded: **99 rows**, four
+omitted as not yet built, each module stamped with its own release.
+
+**And the count is printed.** It was computed and dropped on the floor for a release — a
+measurement nobody surfaces is the same silence as no measurement:
+
+```
+verification: 99 shipped REQ · 99 never confirmed by a person  (disclosure — no floor, no target)
+```
+
+Ninety-nine shipped requirements, not one confirmed by a person. That is the answer to a
+question this repository could not previously ask.
+
+Guards: 175 → **185**, property checks 4 → 8.
+
 ## v1.31.0 — the board, and the pointer that was never the one dangling
 
 The carry-over ledger has always offered `backlog` as a home for a deferred row — a

package/CONTRIBUTING.md

@@ -386,7 +386,26 @@ different cell per file and pass open rows in silence. Reading by name was the f
 design and it was wrong for the same reason.
 *(guard: `with no board id` and `names no Source`)*
 
-**45. Every invariant above names the guard that enforces it, and that guard exists.**This list claims to be *what the validator enforces*; it was eight guards behind when
+**45. Every shipped REQ has a verification row, and `Human` is a date or `never`.**
+`docs/superpowers/verification.md` records the one thing no check can decide — whether a
+person looked after it shipped. Both directions: a shipped REQ with no row, and a row
+whose REQ is in no brief. It keys to the brief because eight of nine briefs carry
+machine-readable REQ rows while ten acceptance files carry their coverage table in nearly
+as many shapes. **The `never` count has no floor and may never be given a target**; a
+property check proves that filling the column does not fail the build, because a gate
+that punishes an honest answer will not receive one.
+*(guard: `either a date or the literal` and `is in no brief's REQ table`)*
+
+**46. Exposure prints as a named vector and never as a probability.** The request that
+produced it asked for `P(defect)`; it is not computable from these inputs, and a single
+score invites a threshold, which is a target on `never` — the one thing the verification
+ledger says may never have one. A `%` on that line fails the build. Where no row has ever
+been confirmed the line prints the literal `never checked`, because `0 days` reads as
+*checked today*. The doctrine carries both rules where a reader proposing a percentage
+will find them.
+*(guard: `may never take` and `carry it where the next reader looks`)*
+
+**47. Every invariant above names the guard that enforces it, and that guard exists.**This list claims to be *what the validator enforces*; it was eight guards behind when
 an audit measured it. A claim of enforcement is now checked like any other claim.
 *(guard: `whose message does not appear in`)* — and a cited literal must lie inside
 a **single** string in `test/validate.py`: the check reads that file as text, so a

package/README.md

@@ -130,6 +130,8 @@ until it is installed.
 | any loop | [`loop-guard.md`](plugins/task-pipeline/skills/task-pipeline/references/loop-guard.md) — churn detection, caps, the break protocol |
 | run-wide pacing | [`continuity.md`](plugins/task-pipeline/skills/task-pipeline/references/continuity.md) — the loop mode (`run.loop`, default off, never collapses a manual gate) and the context budget (fires on a harness signal, never on an estimate) |
 | the board between runs | [`backlog.md`](plugins/task-pipeline/skills/task-pipeline/references/backlog.md) — the work-list that outlives a run: seeded at stage 0 or picked up, priority **computed** from three stated inputs rather than assigned, and the seam where the carry-over ledger's `backlog` pointer finally resolves |
+| what a human confirmed | [`verification.md`](plugins/task-pipeline/skills/task-pipeline/references/verification.md) — one row per shipped REQ and the one column a machine may not fill: the date somebody **looked**, or `never`. No floor, no target — `never` is a fact, and a count driven down is a column that has started lying |
+| how much is unconfirmed | [`exposure.md`](plugins/task-pipeline/skills/task-pipeline/references/exposure.md) — the unconfirmed count as a **vector with its components named**, never a percentage: `P(defect)` is not computable from these inputs and a single score invites a threshold, which is a target on `never`. Plus the check-list, oldest first, and the `/task-pipeline checkup` mode that prints it with no task in flight |
 | 0 + 9 + any settled decision | [`documentation.md`](plugins/task-pipeline/skills/task-pipeline/references/documentation.md) — the inventory, registers and ids, SSOT, the Doc Loop, supersede semantics, the propagation matrix, intent vs as-built |
 | 3 + 4 · every spec and plan | the self-review reads its rules back — is every named check real, does anything contradict a locked decision or a rejected option, and what does this cost now versus at design time. Answers land as a committed `## Self-review` of computed numbers |
 | 6–10 + any check you write | [`gates.md`](plugins/task-pipeline/skills/task-pipeline/references/gates.md) — the three axes, the promotion ladder, gate anatomy, the probe recipe, ratchet floors |

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.31.0 |
+| **Version** | 1.33.0 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/cursor/rules/task-pipeline.mdc

@@ -174,6 +174,11 @@ Seed a **carry-over ledger** next to the brief, append-only. Anything deferred,
 dropped, or left half-done goes in the moment it's said — including implementer
 concerns and non-blocking review findings. **Deferred out loud is forgotten.**
 
+Read **the verification ledger** — `docs/superpowers/verification.md` — and quote how
+many rows sit at `never`: that is the project's standing exposure, and stage 0 is where
+it is cheapest to look. `never` is a fact, not a failure; the count has no floor and may
+never be given a target.
+
 Read **the board** — `docs/superpowers/backlog.md`, the project's work-list *between*
 runs — and quote its open count in the brief; seed it from the template when absent. Its
 priority is **computed, never assigned**: `prio = sev × blast + age_bonus`, with the
@@ -341,6 +346,10 @@ not authorize an outward, irreversible action — stage 7 stops and asks.
     per project, not per run**. Every gate above is good at *this* run and blind
     across runs: the same class of failure gets caught, fixed and forgotten five
     times and nothing notices it is the same one. So, in this order —
+    **0a. Every REQ this run shipped has a verification row**, and every row names a
+    REQ some brief carries — both directions, because a shipped feature that entered no
+    ledger and a ledger row about nothing are different failures.
+
     **0. Resolve the ledger onto the board first.** Every carry-over row still
     `open`, `unresolved`, or homed `backlog` leaves with a `B-NNN` id on
     `docs/superpowers/backlog.md`, and the ledger row is updated to name it — both

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.31.0",
+  "version": "1.33.0",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/manual gates, a frozen requirement spine that must close with evidence, a loop guard that breaks churn, one provider-agnostic model confirmed up front, and an optional super-ux UX track for user-facing work.",
-  "version": "1.31.0",
+  "version": "1.33.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/commands/task-pipeline.md

@@ -30,7 +30,7 @@ grill's **domain awareness** (challenge terms against `CONTEXT.md`, sharpen fuzz
 language, ADRs for hard-to-reverse calls) and covering the **autonomy sweep** (what
 would otherwise stop stages 1→10: docs sources incl. doc repos, the wiki and the code graph, branch/tracker
 policy, test and lint commands, deploy target and authorization, log locations, docs/wiki/graph targets, and for UI tasks whether the design is done visually in Figma or text-only, whether the Figma MCP is connected, and — if it isn't — whether to ship text-only or stop and connect it, since the UX chain degrades on its own and never blocks; **and with Figma on, the design destination: which team/org by name and which file** — the recorded one, a URL the operator gives, or creation in that named team explicitly authorized, written into the project's canonical record before the first frame, because a destination decided at drawing time is how a project ends up with three design files and no way to tell which is real. **Never create while a recorded file resolves; if it doesn't resolve, stop and ask — never create a replacement**) —
-until the brief is locked — including the **REQ table**, the request as an addressable list where every row names how it is verified — so the rest runs autonomously and the final stage can account for all of it. The list is frozen: adding is free, removing needs the operator's agreement. Anything deferred goes into the carry-over ledger the moment it's said, and **the board** (`docs/superpowers/backlog.md`, `references/backlog.md`) — the work-list between runs — is read at stage 0 with its open count quoted in the brief, or seeded when absent. For any user-facing task, recommend/use
+until the brief is locked — including the **REQ table**, the request as an addressable list where every row names how it is verified — so the rest runs autonomously and the final stage can account for all of it. The list is frozen: adding is free, removing needs the operator's agreement. Anything deferred goes into the carry-over ledger the moment it's said, and **the board** (`docs/superpowers/backlog.md`, `references/backlog.md`) — the work-list between runs — is read at stage 0 with its open count quoted in the brief, or seeded when absent; **the verification ledger** (`docs/superpowers/verification.md`, `references/verification.md`) is read at stage 0 for how many rows sit at `never`, written at stage 8 with one row per shipped REQ, and required at stage 10 in both directions. For any user-facing task, recommend/use
 **super-ux**. **If the brief describes a platform rather than a change**, stage 2 also cuts it into modules (`references/decomposition.md`) — module map committed, walking skeleton first, every REQ in exactly one module — and stages 3→10 then run per module, one brick at a time. **If any loop starts undoing an earlier pass** (same file edited twice for the same reason, a closed finding returning, a third entry into one stage), stop and run the loop guard (`references/loop-guard.md`): name both shapes, escalate to the layer that owns the conflict, re-plan the check as an ordered list, then go item by item. **The closing stage opens with the ladder walk** (`references/audit.md`): the REQ table finds what was named and lost, but a comparison needs two sides and an absence has one — so walk each REQ bottom-up through its rungs (decision → spec section → contract *and its failure behavior* → task → change → executed test → surface/docs), check the seam at each step, order findings by seam rather than by file, and turn every absence into a new REQ row **before** the coverage table is written. A green from a check nobody has watched fail against a planted defect is not evidence; a finding class seen twice becomes a script rather than a third ledger row; and every ledger row still `open`, `unresolved` or homed `backlog` leaves stage 10 with a board id and the board's priorities are re-derived (`references/backlog.md`); the carry-over ledger's counts are printed beside every gate verdict, so "green" never reads as "verified". If a searching pass starts finding mostly what the previous pass's own fixes broke, the axis is exhausted — rotate it, don't look harder. **The docs stage closes three artifacts, not two:** module docs, the wiki, **and the code graph** (`/graphify . --update` where `graphify-out/` exists — `references/knowledge-graph.md`), because the graph is what the next run's harvest queries first and a stale one is a false premise carrying the authority of a machine. Then check the graph against the docs: a hub `graphify god-nodes` reports that no document names is an undocumented seam; an edge the docs deny is a leak in the code or a lie in the docs; a doc naming a module the graph no longer has is stale. Doc-side findings are fixed there, absences become REQ rows in the closing stage. **In a project of several repositories, stage 10 closes on the parent too:** a parent records each submodule as a pointer to one commit, and moving the submodule does not move the pointer — so the work can be committed, pushed and green while a clone of the parent still gets the commit before it. Neither repo looks wrong alone, which is why it survives every check that runs inside one. Require `git submodule status` with no line starting `+`, and every repo clean and pushed (`git -C <repo> status --porcelain`, `git -C <repo> log @{u}..HEAD`). The fix is two commands and the second gets forgotten: push the submodule, then `git add <submodule> && git commit`. **The run's last act is the retrospective** (`references/retrospective.md` → `docs/superpowers/retro.md`, one file per project): **stamp the run first** (its commit is what makes the cold-retirement trigger computable), **then prune** — every standing instruction against its three retirement triggers (it became a check; the paths/commands it names are gone; it hasn't fired in five run stamps, or in sixty days — the calendar is the unit that still moves when the stamp counter has stopped), the list held to a hard cap of ten, every deletion logged as one line and never silent — then, only if the run diverged, write the entry: symptom with evidence, the stage it surfaced at, the stage that *owned* it, the root cause, the fix by grade (mechanical check > standing instruction > note that expires in two runs), and the check that catches it next time. Stage 0 reads those standing instructions in full, so the prune is a gate criterion, not a good intention: a rule nobody reads to the end is worse than no rule, because everyone believes it is covered. Honor every stage gate by its type (`auto` = verify yourself;
 `manual` = wait for explicit go). Confirm the **model once at preflight** —
 recommend the most capable one the environment offers, never a hardcoded id — then
@@ -44,6 +44,17 @@ Idempotent entry — inspect state first, never restart blindly:
 - Otherwise, begin at stage 0 (intake grill). If no task is given above, the
   grill's first question asks the operator for the task in one line.
 
+**`/task-pipeline checkup`** — **runs with no task in flight, and that is the point.**
+Accumulated unconfirmed work is invisible precisely because nobody is running a pipeline,
+so a check living only inside a run can never say *"stop, fourteen things are
+unconfirmed."* It takes no brief, opens no grill, and writes nothing on its own. Four
+sections, each read from a file this pipeline already keeps: the **exposure** line with
+its check-list oldest-first, the **board**'s open rows by computed priority, the
+carry-over ledgers' unresolved count, and the code graph's staleness where one exists.
+Where you ask it to file what it found, it appends board rows whose `Source` names the
+checkup and its date — printing what it would add first, never silently. Doctrine:
+`references/exposure.md`.
+
 **`/task-pipeline setup`** — the entry audit instead of a feature. Runs seven passes
 over the documentation this project already has, reports findings as `file:line` + the
 minimal fix ordered by seam, and hands back a fix plan the pipeline can run. Offered

package/plugins/task-pipeline/skills/task-pipeline/SKILL.md

@@ -69,6 +69,8 @@ gate stops until it is installed.
 | any repeating loop | [`references/loop-guard.md`](references/loop-guard.md) |
 | run-wide · how a run keeps going (the loop mode + the context budget) | [`references/continuity.md`](references/continuity.md) |
 | run-wide · the work-list **between** runs, and how its priority is computed | [`references/backlog.md`](references/backlog.md) |
+| run-wide · whether a **human** ever confirmed what shipped, and when | [`references/verification.md`](references/verification.md) |
+| run-wide · how much unconfirmed work has piled up, and what to look at first | [`references/exposure.md`](references/exposure.md) |
 
 **Optional bridge.** If the operator already runs an equivalent skill set (e.g.
 `superpowers:brainstorming` / `writing-plans` / `subagent-driven-development` /

package/plugins/task-pipeline/skills/task-pipeline/references/acceptance.md

@@ -205,10 +205,15 @@ GATE 10 acceptance: PASS — 14/14 REQ verified
 
 All of:
 
-1. **The ladder walk ran** ([`audit.md`](audit.md)) — every REQ's rungs checked
+1. **Every shipped REQ has a verification row, and every row names a REQ its own run
+   carries** ([`verification.md`](verification.md)) — both directions, because a shipped
+   feature that entered no ledger and a ledger row about nothing are different failures.
+   The row's `Human` is a date or the literal `never`; `never` is a **fact** and its
+   count has no floor, no direction and never a target.
+2. **The ladder walk ran** ([`audit.md`](audit.md)) — every REQ's rungs checked
    bottom-up, findings ordered by seam, absences turned into REQ rows **before**
    the table was written, and the two pass counts recorded.
-2. **Every check this gate leans on has been seen failing** at least once against a
+3. **Every check this gate leans on has been seen failing** at least once against a
    planted defect (`audit.md` → *Exit criterion*; the procedure, with the commands,
    is [`gates.md`](gates.md) → *Probing*). An unproven check's green is not
    evidence. That includes **the documentation gate** the project's doc map names
@@ -216,12 +221,12 @@ All of:
    is *proven*, and its **ratchet counts are printed beside this verdict**. A
    documentation gate is the easiest one in a run to inherit unproven, because it
    was green the first time anyone looked at it.
-3. **Every REQ has a status** — none `unknown`, none blank.
-4. **Every `verified` carries evidence** of the kind above.
-5. **Every `partial` names what's missing** and where it's tracked.
-6. **Every `deferred` / `dropped` has the operator's agreement** recorded (in the
+4. **Every REQ has a status** — none `unknown`, none blank.
+5. **Every `verified` carries evidence** of the kind above.
+6. **Every `partial` names what's missing** and where it's tracked.
+7. **Every `deferred` / `dropped` has the operator's agreement** recorded (in the
    ledger or here) and, for `deferred`, a tracker entry.
-7. **No carry-over row is left `unresolved`** — every one has a home, and the
+8. **No carry-over row is left `unresolved`** — every one has a home, and the
    ledger's counts are printed with this verdict, not just filed.
 7a. **Both disclosures are printed** ([`gates.md`](gates.md) → *Disclosures*):
    `abstained` — every REQ closing `partial`, every `unknown`, every ⚠️ *cannot verify
@@ -230,11 +235,11 @@ All of:
    a movement either way wants one sentence. A run reporting `abstained: 0` is claiming
    it knew everything, which is a stronger statement than any run this stage has ever
    seen close honestly.
-8. **Every repository is closed, the parent included** — `git submodule status`
+9. **Every repository is closed, the parent included** — `git submodule status`
    shows no `+`, and each repo is clean and pushed. A submodule is finished when
    its parent points at it.
-9. **The operator answers the closing question** and signs off.
-10. **The retrospective is written** ([`retrospective.md`](retrospective.md)) — **in
+10. **The operator answers the closing question** and signs off.
+11. **The retrospective is written** ([`retrospective.md`](retrospective.md)) — **in
     order**: the run is stamped with its commit first, **then** the prune runs before
     anything is added (standing instructions checked against their retirement triggers,
     the list at or under its cap of ten, every deletion logged), **then** a run that

package/plugins/task-pipeline/skills/task-pipeline/references/artifacts.md

@@ -25,6 +25,8 @@ docs/
     NNNN-<slug>.md                    # the OTHER permitted decision home — one project uses ONE
   superpowers/
     retro.md                          # stage 10's last act — ONE per project, not per run
+    backlog.md                        # the work-list BETWEEN runs — read at 0, resolved at 10
+    verification.md                   # one row per shipped REQ; `Human` is a date or `never`
     retro/YYYY-QN.md                  # the archive: rotated entries + retirements, queried not read
     specs/
       YYYY-MM-DD-<topic>-brief.md     # stage 0 — locked intake brief (grill output)
@@ -76,7 +78,7 @@ whatever the context happens to hold.
 
 | Stage | Reads | From where |
 |---|---|---|
-| **0 Harvest** | the project's own knowledge about this task | code · the code graph (`graphify-out/`) · `CLAUDE.md`/`AGENTS.md` · `CONTEXT.md`/`docs/adr/` · `docs/` + `docs/ux/` · past briefs and carry-over ledgers · **the board** (`docs/superpowers/backlog.md`, open count quoted in the brief) · the retro's standing instructions **in full** · the wiki · any doc repo or hosted system the project names |
+| **0 Harvest** | the project's own knowledge about this task | code · the code graph (`graphify-out/`) · `CLAUDE.md`/`AGENTS.md` · `CONTEXT.md`/`docs/adr/` · `docs/` + `docs/ux/` · past briefs and carry-over ledgers · **the board** (`docs/superpowers/backlog.md`, open count quoted in the brief) · **the verification ledger** (`docs/superpowers/verification.md`, how many rows sit at `never`) · the retro's standing instructions **in full** · the wiki · any doc repo or hosted system the project names |
 | **0 Inventory (1b)** | the documentation regime | `docs/DOCMAP.md` — registers, single homes, propagation matrix, gate commands, ratchet floors. Absent ⇒ seeded ([`adoption.md`](adoption.md)) |
 | **0 Reconcile (1c)** | intent vs as-built | git (how it *should* be) against the run record (how it *turned out*) |
 | **0 Grill** | the operator | the interview — every answer checked against the harvest, which is what makes it checkable rather than confident |
@@ -100,6 +102,7 @@ that has not read them is running the pipeline's defaults, not this project's.
 |---|---|---|---|
 | `CLAUDE.md` / `AGENTS.md` | commands, deploy path, house rules, which docs exist and where | 0 | 6–10 |
 | `docs/DOCMAP.md` | the decision home, each fact's single home, the propagation matrix, the gate and its ratchet floors | 0 (1b) | 9 |
+| `docs/superpowers/verification.md` | one row per shipped REQ, and the one column a machine may not fill: the date a **human** confirmed it, or `never` ([`verification.md`](verification.md)) | 0 | written at 8, required at 10 |
 | `docs/superpowers/backlog.md` | the project's work-list **between** runs — ids, the three priority inputs, state. Mutable; rows leave only into its *Closed* list ([`backlog.md`](backlog.md)) | 0 | re-derived at every iteration's end; resolved at 10 |
 | `docs/superpowers/retro.md` | standing instructions — the rules no check can decide. Capped at ten, **read in full**, stamped the moment one fires | 0 | pruned at 10 |
 | `specs/<topic>-brief.md` → *Autonomy* | every pre-resolved decision; stages 1→10 **answer from it instead of asking** | 0 | 1–10 |
@@ -125,6 +128,7 @@ them is a finding, not a tie-break ([`knowledge-sources.md`](knowledge-sources.m
 | 0 Inventory | `docs/DOCMAP.md` + the registers + `scripts/check-docs.sh` — seeded **only when absent**, and the seeding is the register's first entry ([`documentation.md`](documentation.md)) | every later stage; **stage 9** walks the matrix, **stage 10** proves the gate |
 | 0 Grill (domain) | `CONTEXT.md`, `docs/adr/NNNN-<slug>.md` — created **lazily**, only when a term resolves or a decision qualifies. Where `docs/adr/` **is** the register, entries carry the register's field set | stages 2–4 + the repo |
 | any stage | a register entry per settled thing, via the **Doc Loop** — recorded, resolved, propagated, committed with its id | the next run's harvest |
+| 8 Verification row | `docs/superpowers/verification.md` — one row per REQ the run shipped, written right after the deploy verification; `Human` starts at `never` ([`verification.md`](verification.md)) | stage 10 requires it; stage 0 of every later run reads it |
 | 10 Board resolution | `docs/superpowers/backlog.md` — every unresolved ledger row — homed `backlog` or still `open` — arrives with a real id, and the ledger row is updated to name it; priority re-derived ([`backlog.md`](backlog.md)) | the next run's harvest, and every loop iteration |
 | 10 Retro rotation | `docs/superpowers/retro/YYYY-QN.md` — entries older than five stamps, plus every retirement, each with its commit | queried by a later run's harvest |
 | 2 Decompose | `specs/<topic>-modules.md` — module map, build order, contracts, per-module status (platforms only) | stages 3–10, every module's run |

package/plugins/task-pipeline/skills/task-pipeline/references/continuity.md

@@ -129,9 +129,16 @@ works a stale board for as long as the loop runs. One command, at the top of the
 iteration, recorded ([`knowledge-sources.md`](knowledge-sources.md) → *Carried-in
 claims*; [`learned.md`](learned.md) rule 16).
 
+**The work-list is `docs/superpowers/backlog.md`** ([`backlog.md`](backlog.md)), and the
+other half of the same measurement is the exposure line ([`exposure.md`](exposure.md)).
+Counted at the top of the iteration, re-derived at the bottom — `age` moves on its own,
+so the re-derivation is the only moment the board stops being stale.
+
 This is also where a loop's report goes wrong most quietly. *"Next up is X"* at the
 end of an iteration is a claim about the board, and it is the one sentence in the
-whole cycle that no gate reads. It cites the measurement or it is not written.
+whole cycle that no gate reads. It cites the measurement or it is not written — **a
+`B-NNN`, not a description**: *"next up: B-014"* can be checked against the file,
+*"next up: the export fix"* cannot.
 
 ## Parked at a manual gate
 

package/plugins/task-pipeline/skills/task-pipeline/references/exposure.md

@@ -0,0 +1,103 @@
+# Exposure — how much unverified work has piled up, and what to look at
+
+**One job: turn the verification ledger into a number somebody can act on, without
+pretending it is a probability.**
+
+[`verification.md`](verification.md) records whether a person ever confirmed each shipped
+REQ. This file turns that record into the line printed beside every verdict, and into the
+list `/task-pipeline checkup` hands an operator.
+
+---
+
+## Contents
+
+- Why it is not a probability
+- The components, each named
+- The check-list, and how it is ordered
+- `/task-pipeline checkup`
+- What the loop does with it
+- Rationalizations
+
+## Why it is not a probability
+
+The request that produced this file asked for *"the probability of an error"*. That is
+not computable from these inputs, and a number presenting itself as `P(defect)` is the
+false-success class this repository has spent its whole history removing: an estimate
+wearing a measurement's clothes.
+
+**So no percentage, ever** — the guard rejects a `%` on the exposure line. What ships is
+a **vector with its components named**, and the reason is not fussiness: a single score
+invites a threshold, and a threshold here is a target on `never`, which is the one thing
+[`verification.md`](verification.md) says may never have one.
+
+It could become a real probability later. `verification.md` is exactly the journal that
+would make calibration possible after enough runs carry both a confirmation date and a
+defect. Until then it is named honestly.
+
+## The components, each named
+
+```
+exposure: 99 unverified · never checked · 31 releases since the last human confirmation
+```
+
+- **unverified** — rows whose `Human` reads `never`.
+- **since** — days since the newest `Human` date. When **no** row has ever been
+  confirmed, this prints the literal **`never checked`**, not `0 days`: zero would read
+  as *checked today*, which is the opposite of the truth and exactly the kind of quiet
+  inversion this pipeline exists to prevent.
+- **releases** — tags cut since that date, or since the first shipped row when there is
+  no date. It is the component an operator feels: *"how much has gone out on top of
+  something nobody looked at."*
+
+Every component is derived from files in the repository. None is estimated.
+
+## The check-list, and how it is ordered
+
+The list is the deliverable — a number without it tells somebody they have a problem and
+not where. Ordered by what the repository can defend:
+
+1. **Oldest first**, by `Shipped in`. The longest-unconfirmed row is the one whose
+   context is most gone, and whose author is least likely to remember it.
+2. **Tie-broken by blast radius** where the board carries a row for it, reusing
+   [`backlog.md`](backlog.md)'s own stated input rather than inventing a weight here.
+
+No third factor. A ranking with an unstated input is the hand-assigned priority the board
+already refuses.
+
+## `/task-pipeline checkup`
+
+A **mode of the command**, like `setup` — not a new command, because a second command
+costs every surface a command touches and this repository has learned what that means.
+
+**It runs with no task in flight, and that is the point.** Accumulated unverified work is
+invisible *precisely because nobody is running a pipeline*; a check that only exists
+inside a run can never say *"stop, fourteen things are unconfirmed."* So it takes no
+brief, opens no grill, and writes nothing on its own.
+
+It prints four sections, each read from a file this pipeline already keeps: the exposure
+line and its check-list, the board's open rows by computed priority, the carry-over
+ledgers' unresolved count, and the code graph's staleness where one exists.
+
+**Where the operator asks it to file findings**, it appends board rows whose `Source`
+names the checkup and its date — so a row a machine created is distinguishable from one a
+run surfaced. It prints what it would add first. Never silently.
+
+## What the loop does with it
+
+[`continuity.md`](continuity.md) has always required each iteration to re-measure the
+work-list, and said that *"next up is X"* is a claim about the board that no gate reads.
+[`backlog.md`](backlog.md) is that board; the exposure line is the other half of the same
+measurement, and both are read at the top of an iteration and re-derived at the bottom.
+
+An iteration that reports what it will do next **cites the file**: `B-014`, not *"the
+export fix"*.
+
+## Rationalizations
+
+| The excuse | What is actually true |
+|---|---|
+| "Give me one number, I'll decide the threshold" | The threshold would be a target on `never`, and the column would start lying within a week. The components are one line; read them. |
+| "A percentage is easier to communicate" | It is easier to communicate because it says more than is known. That is the whole objection. |
+| "The check-list is long, just show the top three" | Then the fourth is never checked and nobody knows it exists. Print it all; the operator can stop reading. |
+| "Checkup duplicates stage 8" | Stage 8 verifies **this run's** deploy. Checkup asks what has accumulated across all of them, which no stage is ever in a position to ask. |
+| "We'll run checkup when something breaks" | After a break you know where to look. The list exists for before. |

package/plugins/task-pipeline/skills/task-pipeline/references/portability.md

@@ -55,6 +55,8 @@ a row pointing outside the bundle is the defect this file exists to catch.
 | **The run mode** — item-by-item pacing, default off, what it never collapses | `references/continuity.md` |
 | **The context budget** — the evidence rule and what a flush actually updates | `references/continuity.md` |
 | **The board** — the work-list between runs, its computed priority, and the ledger seam it resolves | `references/backlog.md` |
+| **The verification ledger** — what shipped, and whether a human ever confirmed it | `references/verification.md` |
+| **Exposure** — the unconfirmed count as a named vector, never a probability, and the `checkup` mode | `references/exposure.md` |
 | The retro: prune, cap, commits, archive | `references/retrospective.md` |
 | Rules earned by failure | `references/learned.md` |
 | **The routing default and its boundary** | `templates/routing-rule.md` |

package/plugins/task-pipeline/skills/task-pipeline/references/stages.md

@@ -173,6 +173,9 @@ never that the work was skipped quietly.
   seeded, the model decision is recorded, and the operator confirms the brief. Stop when a
   re-scan surfaces no new branches (don't grill past diminishing returns;
   reversible calls can be deferred with a note). Only then start stage 1.
+- **The verification ledger is read.** `docs/superpowers/verification.md` — the harvest
+  quotes **how many rows sit at `never`**, because that is the project's standing
+  exposure and stage 0 is where it is cheapest to look ([`verification.md`](verification.md)).
 - **The board is read, or seeded.** `docs/superpowers/backlog.md` ([`backlog.md`](backlog.md)) — its **open count is quoted in the brief**, measured by a command at the top of the run rather than inherited from the last run's report. Absent ⇒ seeded from the template and said so; an empty board and no board are the same thing to work on, and only one of them can be appended to.
 
 ## 1 — Docs study
@@ -393,6 +396,12 @@ never that the work was skipped quietly.
   steps — never silent success. **The CI verdict is one of the reported facts, with
   its run id** — "CI is green" written without a command behind it prints the same
   whether it looked or not ([`gates.md`](gates.md) → *False success*).
+- **Write the verification row.** One line per REQ this run shipped, into
+  `docs/superpowers/verification.md` ([`verification.md`](verification.md)) — the run,
+  the tag or commit it went out in, what the gate said, and `Human: never` unless the
+  operator confirmed during the run. The verification above already happened; this is
+  the only step that makes it answerable **later**, and `never` is a fact rather than a
+  failure — the count has no floor and may never be given a target.
 
 ## 9 — Docs + wiki
 - **Freedom: low** — the matrix walk and the gate are mechanical; what a doc says is not this stage's call ([`gates.md`](gates.md) → *Axis C*).
@@ -455,6 +464,9 @@ never that the work was skipped quietly.
 - **Freedom: medium** — the walk and the evidence rule are fixed; whether it is what was asked for is the operator's ([`gates.md`](gates.md) → *Axis C*).
 - **What:** the closing stage — go back to the brief and account for **every**
   requirement. Doctrine: [`acceptance.md`](acceptance.md).
+- **Every REQ this run shipped has a verification row, and every row names a REQ some
+  brief carries.** Both directions: a shipped feature that entered no ledger and a
+  ledger row about nothing are different failures ([`verification.md`](verification.md)).
 - **The ledger's open rows are resolved onto the board.** Every carry-over row still
   `open` leaves with a `B-NNN` id on `docs/superpowers/backlog.md`, and the ledger row
   is updated to name it ([`backlog.md`](backlog.md)). Both directions, because they are

package/plugins/task-pipeline/skills/task-pipeline/references/verification.md

@@ -0,0 +1,89 @@
+# The verification ledger — the column a machine may not fill
+
+**One job: record whether a human ever looked at what shipped, and when.**
+
+Stage 8 already performs the verification trio, reads the CI verdict and opens the
+rendered page ([`stages.md`](stages.md) → *8 — Post-deploy*). All of it is **per run**,
+and none of it accumulates. Ask a project *"which features has nobody confirmed since
+they shipped?"* and before this file the honest answer was: nobody knows, and no
+artifact could be consulted.
+
+**Boundary, so this is not a second coverage table.**
+[`acceptance.md`](acceptance.md)'s table says *an automated check passed at the moment of
+the run*. Three things it does not say, and each is why this file exists:
+
+- whether anybody **looked** after it shipped;
+- whether it still works N releases later;
+- anything at all about previous runs — it is per-run and dies with its run.
+
+---
+
+## Contents
+
+- Why it keys to the brief, not to the coverage table
+- `never` is a fact
+- What stage 8 writes and what stage 10 refuses
+- Rationalizations
+
+## Why it keys to the brief, not to the coverage table
+
+The obvious spine is the coverage table — it already carries one row per REQ with a
+verdict. Measured before building on it: **ten acceptance files in this repository, and
+the first REQ-bearing table differs in nearly every one.** Ladder walks and coverage
+tables share a file with different columns, because `acceptance.md` fixes the shape in
+prose and prose does not hold a shape across ten runs.
+
+The brief's REQ table does: **eight of nine briefs here carry machine-readable
+`| REQ-NNN |` rows**, and the ninth was fixed the day this was measured. So the ledger
+keys to the brief, and the coverage table remains what it always was — the run's own
+verdict, quoted into the `Auto` column and never re-derived.
+
+That the coverage table has no template and has already drifted is a real finding with a
+real cost, and it is on the board rather than fixed here: a run that widens its own scope
+to fix everything it touches finishes nothing.
+
+## `never` is a fact
+
+A `never` is not a defect, not a debt, and **not a number to drive down**. It is what is
+true about the world, written where somebody can act on it.
+
+The moment `never` becomes a thing to avoid writing, the column stops describing
+reality — and this is the pipeline's only signal about the world outside its own checks.
+So the count has **no floor, no direction, and may never be given a target**, exactly
+like the disclosures in [`gates.md`](gates.md). A project with forty `never` rows is not
+failing; it is a project that now knows something it could not previously ask.
+
+## What stage 8 writes and what stage 10 refuses
+
+**A coverage verdict of `review` becomes `none`.** *No check can decide this* is not
+a pass; `Auto` records what a machine established, and there the honest answer is
+nothing. The first seed wrote `pass` for four such rows — in the file whose whole
+purpose is not to do that.
+
+**Stage 8** writes one row per REQ the run shipped, right after the verification it
+already does. `Human` starts at `never` unless the operator confirmed during the run.
+
+**A REQ that spans two modules is stamped with the second, not the first.** Its criterion
+is satisfied when the last part of it exists, and stamping the earlier release claims a
+capability the project did not yet have. Caught by a reader on the first ledger this
+skill ever seeded: one row said a file was named in the maps a release before that file
+existed, and the row directly below it said when the file arrived. Two rows of one
+table, disagreeing about the same date.
+
+**Stage 10** refuses a REQ that shipped and has no row — and, in the other direction, a
+row whose REQ appears in no brief. They are different failures: a shipped feature that
+entered no ledger, and a ledger row about nothing. One direction alone finds one of them
+([`learned.md`](learned.md) rule 2).
+
+**Nothing else writes here.** Not a script, not the release job, and not stage 10 — a
+file that several stages may write is a file whose rows nobody owns.
+
+## Rationalizations
+
+| The excuse | What is actually true |
+|---|---|
+| "The tests passed, that *is* verification" | The tests passed *at the moment of the run*, against the checks somebody thought to write. This column is about the world, and the world is where the checks were not looking. |
+| "I'll fill `Human` in when I get to it" | Then the row says `never`, which is exactly correct until you do. The file is not asking you to lie faster. |
+| "Forty `never` rows looks terrible" | It looks like what it is. The alternative is forty unverified features and no way to name them, which looked fine right up until it didn't. |
+| "Stage 10 can fill it — it runs after the deploy" | Stage 10 is a machine. The single thing this column means is *a person looked*, and a machine writing it deletes the only information in the file. |
+| "We tag rarely, so `Shipped in` is awkward" | Then it carries the commit, and every row of that run carries the same one. What it may not carry is nothing. |

package/plugins/task-pipeline/skills/task-pipeline/templates/README.md

@@ -11,6 +11,7 @@ from `super-ux`.
 |---|---|---|
 | `brief.md` | `docs/superpowers/specs/YYYY-MM-DD-<topic>-brief.md` | 0 — intake grill |
 | `carryover.md` | `docs/superpowers/specs/YYYY-MM-DD-<topic>-carryover.md` | 0 seeds, all stages append, 10 reads |
+| `verification.md` | `docs/superpowers/verification.md` | 8 writes a row per shipped REQ, 10 requires it, a human fills `Human` |
 | `backlog.md` | `docs/superpowers/backlog.md` | 0 seeds when absent, any stage appends, 10 resolves and re-derives |
 | `context.md` | `CONTEXT.md` at the repo root (or per context) | 0 — grill, domain awareness |
 | `adr.md` | `docs/adr/NNNN-<slug>.md` | 0 — grill, hard-to-reverse decisions |

package/plugins/task-pipeline/skills/task-pipeline/templates/verification.md

@@ -0,0 +1,55 @@
+# Verification — <project>
+
+> **Append-only.** One row per REQ, written by stage 8 when the change ships. Nobody
+> edits a row except to fill `Human` — and filling it is the one thing in this
+> repository a machine may not do.
+>
+> This is not a second coverage table. The coverage table says *an automated check
+> passed at the moment of the run*. It says nothing about whether anybody **looked**
+> after it shipped, nor whether it still works N releases later, and it dies with its
+> run. This file is the column that outlives it.
+
+| REQ | What | Run | Shipped in | Auto | Human | Note |
+|---|---|---|---|---|---|---|
+| REQ-001 | CSV export from a report | `2026-07-28-export` | v1.4.0 | pass | 2026-07-30 | opened the deployed page, exported, opened the file |
+| REQ-004 | XLSX export | `2026-07-28-export` | v1.4.0 | pass | **never** | — |
+| REQ-007 | Export respects active filters | `2026-07-28-export` | v1.4.0 | partial | **never** | CSV path only |
+
+## Columns
+
+- **REQ** — the id from the run's brief. The brief's REQ table is the spine; a row here
+  whose id is in no brief is a row about nothing.
+- **What** — copied from the brief, not re-worded. *"Check REQ-004"* sends a human to
+  look something up; *"XLSX export"* sends them to the feature.
+- **Run** — the brief's topic slug, so the context is one file away.
+- **Shipped in** — the tag or commit that carried it. Where a project does not tag,
+  the commit, and the same value every row of that run carries.
+- **Auto** — what the run's own gate said: `pass` · `partial` · `none`. Copied from the
+  coverage table rather than re-derived; where the two disagree the coverage table wins
+  and the disagreement is a finding. A coverage verdict of **`review`** — *no check can
+  decide this* — becomes `none`, because this column records what a machine established
+  and there the honest answer is *nothing*.
+- **Human** — a date, or the literal **`never`**. Nothing else. *"soon"*, *"mostly"* and
+  *"looks fine"* are how a column stops being answerable, and this is the only column in
+  the pipeline that a machine may not fill on your behalf.
+- **Note** — what the human actually did. *"opened the deployed page and exported"* is a
+  note; *"checked"* is not, and six weeks later nobody can tell those two apart.
+
+## `never` is a fact, not a failure
+
+A row sitting at `never` is not a defect and not a debt to be paid down before the next
+release. It is **what is true**, printed where somebody can act on it. The moment
+`never` becomes something to avoid writing, this file starts lying and the pipeline
+loses the only signal it has about the world outside its own checks.
+
+That is why nothing here has a floor, a target, or a direction. Count them, print them,
+and let the number be what it is.
+
+## How rows arrive
+
+1. **Stage 8** writes one row per REQ the run shipped, immediately after the deploy
+   verification it already performs — `Human` starts at `never` unless the operator
+   confirmed during the run, in which case the note says what they did.
+2. **A human, later** — fills `Human` with the date they looked, and the note with what
+   they looked at. This is the only edit any row ever receives.
+3. **Nothing else writes here.** Not stage 10, not a script, not a release job.