task-pipeline-skill 1.32.0 → 1.37.0

package/CHANGELOG.md

@@ -1,5 +1,258 @@
 # Changelog
 
+## v1.37.0 — the audit, and the four things it found the pipeline could not say
+
+One release, four modules, and an audit that put four questions to this pipeline and
+answered them with measurements rather than opinion:
+
+- **99 shipped REQ, 99 of them at `Human: never`** — nothing has ever been confirmed by
+  a person, and the exposure line has been saying so on every run.
+- **`copywriting` appeared 0 times in the bundle and `sheleg-design` once**, as a name in
+  a README list.
+- **The review loop ran ten rounds, ten, eight, four, three** against a stated ceiling of
+  two stage re-entries — because a review round was named in no cap at all.
+- **Nothing ever printed which pipeline, which module, or which iteration was running.**
+  The run checklist existed and was marked *"copy it, tick it"*.
+
+Guards: 188 → **210**, property checks 8. Every one watched failing against a planted
+defect, and three of the probes were wrong before their guards were.
+
+### The lesson that stopped dying in the repository that learned it
+
+`retrospective.md` has said *"open an issue upstream"* since v1.9.0 and named no
+repository, no trigger and no authorization — an instruction on rung 1 that every reader
+took for done. So a defect in **the skill** — a gate that loops, a doctrine promising
+what nothing enforces, a rule firing on the wrong shape — was rediscovered independently
+in every project that ran the pipeline and fixed in none of them.
+
+**Opt-in, per project, off by default**, `pipeline.json` → `retro.publish`:
+
+```json
+"retro": { "publish": { "repo": "…", "label": "retro-insight", "redact": "strict" } }
+```
+
+Absent, nothing is published and nothing is asked. Opening an issue in another
+repository is an **outward act**, and an outward act taken from a generic flag is one
+nobody authorized — the same floor deploy authorization uses.
+
+**The body is printed in full before it is sent, and the printed string and the sent
+string are one string.** Redacting after the print, or printing a tidier version of what
+actually goes out, is the false-success shape this bundle names outright: a mechanism
+reporting on itself instead of on what it did.
+
+**Five numbered redaction rules**, because *insight only* is not a specification. No host
+paths — only paths inside task-pipeline itself. No host identifiers: repository,
+organisation, branch, commit, tag, issue. No code, no config values, no data, not even
+redacted. No names of any kind. And the title states the **class**, not the incident.
+When in doubt the rule is subtraction: an insight that survives losing a detail is still
+an insight, and a detail that leaks cannot be recalled from an index.
+
+**Seven guards, and one of them was broken by the fence above.** The check that makes the
+doctrine's own worked issue obey its own rules was silent against three separate plants —
+an absolute path, a commit id, a foreign repository slug — because the fence scan matched
+` ``` ` followed by a newline, and the ```json block one paragraph up made every
+subsequent fence pair with the wrong delimiter. Five fence scans across four modules had
+the same bug; all are language-tolerant now, and the earlier modules' probes were re-run
+to prove the change broke nothing (R-003: sweep the detector's siblings).
+
+### What it does, how it sounds, how it looks
+
+The audit measured this one rather than argued it: **`copywriting` appeared zero times
+in the whole bundle, and `sheleg-design` once — as a name in a list in the README.**
+Meanwhile the companion matrix named six super-ux surfaces while super-ux shipped eight
+skills and fifteen commands. So a run designed a flow, then wrote its interface strings
+by taste and picked its visual values at the keyboard, and every gate in the pipeline
+reported green over both.
+
+**Stage 3 now runs three tracks, and none substitutes for another:**
+
+| Track | Answers | Owner |
+|---|---|---|
+| UX | what the interface must **do** | super-ux — the WHY→UI→scenario chain |
+| COPY | how it **sounds** | `copywriting`, against the brand pack |
+| VISUAL | how it **looks** | `sheleg-design` — tokens, themes, rhythm, motion |
+
+Each carries its boundary in both directions, because a track that over-reaches is
+routed around. The copy track takes interface strings, errors, empty states, the
+landing, the user-facing changelog — and explicitly **not** commit messages, PR text,
+code comments or a developer README. The visual track takes the visual layer and
+explicitly **not** a purely structural change, which is the UX track's.
+
+**A refusal is a sentence, never a silence.** *"as is"* ends the visual track and
+*"draft"* ends the copy track; either is the operator's call and costs nothing. But it
+is recorded in the brief and said in the close-out, because a track skipped in silence
+and a track that ran are identical afterwards — the `⊘` rule one layer up.
+
+**`sheleg-design` joins the matrix and the preflight**, and super-ux's row finally names
+its copy half.
+
+**The new guard found a live defect on the clean tree before it found anything else.**
+It compares the matrix's *"needed for stage N"* cell against what that stage actually
+says, and reported that `chrome-devtools` had been pointed at **stages 5–6 since the day
+it was added, with stage 5 never naming it**. Fixed here: stage 5 now checks a rendered
+surface per task, while the implementer that wrote it is still dispatched.
+
+**And a probe found a hole in its own guard.** Removing `copywriting` from stage 3 left
+the check silent, because it reads matrix **row names** and the copy half lives inside
+super-ux's own cell — precisely where it had been invisible all along. A second, narrow
+check now covers the three tracks by name. It is narrow on purpose: generalising the
+sub-skill mapping would demand stage 3 name `/brand-lint` and `ux-audit` too, and a
+check that over-reaches is switched off by the third person who hits it.
+
+### The loop that had no ceiling, the exemption nobody measured
+
+Three findings from the same audit, all of them gates behaving as prose.
+
+**The review loop was capped by nothing.** `build.md` caps the stage-5 fix loop at five
+rounds per task and `loop-guard.md` caps stage re-entries at two — and a review round is
+neither, so nothing counted them. The run stamps say what that cost: **ten rounds, ten,
+eight, four, three**, in one programme.
+
+**A flat cap would have been the wrong fix**, and this is the part worth keeping. Every
+one of those runs recorded *"none from my probes"* beside its count — the reader was
+still finding real defects on round nine. Stopping at two would have shipped them. So
+the cap is a **decision point**: default 3 rounds per artifact (`pipeline.json` →
+`run.review.maxRounds`), and at the cap the run stops reviewing and prints the pair
+`audit.md` already defines, per round:
+
+```
+review cap reached — 3 rounds — artifact: test/validate.py
+  round 1: 12 new · 0 self-inflicted
+  round 2:  5 new · 1 self-inflicted
+  round 3:  1 new · 3 self-inflicted
+```
+
+Self-inflicted ≥ new and the axis is exhausted; new still ahead and continuing is the
+operator's call, made with numbers rather than fatigue. Rounds are counted from the run
+ledger's `touch:` pass numbers, never from memory. Every finding left open at the cap
+leaves as a board row with its evidence, never as a shrug.
+
+**The pipeline ran eleven stages over a typo because nothing measured the exemption.**
+The boundary — a one-line fix, a mechanical rename — existed in prose and depended on an
+agent remembering it. Stage 0 now runs a three-question triage with something behind each
+question, and **proposes** the short path: stages 1–4 marked `⊘` with the triage answer
+as the reason. Propose, never take: the answer goes in the brief and silence takes the
+full flow, the same floor deploy authorization uses. The glyph is what makes it safe —
+a skipped stage is printed on the rail *with its reason*, and a skip nobody can see is
+indistinguishable from a stage never entered.
+
+**`exposure.md`'s worked example disagreed with its own output, in both directions at
+once.** It taught `31 releases since the last human confirmation` while the code printed
+`releases carry one`, and it hardcoded `99` — a live count that drifts. The example now
+carries no digits at all, and a guard computes the format's vocabulary **from the print
+statement** and requires the doctrine to show it.
+
+**Six new guards, each watched failing.** Two of them found their own author first: the
+short-path check was scoped to a paragraph while the bullet it reads carries a fenced
+block, so it stopped three lines short of the glyph and passed in silence — and its
+replacement matched the fence's own backtick and accused the clean tree. A detector that
+finds itself before it finds anything else is checking the wrong thing, twice in one
+module.
+
+### A run that says which pipeline it is on, and where in it
+
+An audit of this pipeline asked four questions of it. The first was *does the agent
+understand the plan it is executing?* — and the honest answer was that nothing in eleven
+stages ever printed which pipeline, which module, or which iteration was running. The
+run checklist existed and was marked *"copy it, tick it"*: an instruction with no gate
+behind it, which is the same failure it was written to prevent, one level up.
+
+**The run prints where it is, at two boundaries and only two** — task start and
+iteration close ([`references/progress.md`](plugins/task-pipeline/skills/task-pipeline/references/progress.md)):
+
+```
+task-pipeline v1.34.0 · pipeline-audit · module P1 «the progress print» (1 of 4)
+  0 ✓  1 ✓  2 ✓  3 ▶  4 ·  5 ·  6 ·  7 ·  8 ·  9 · 10 ·
+  ███████░░░░░░░░░░░░░░░░░░░  gates 3/11 · now 3 Spec · manual
+  board B-028 · carry-over 0 rows · exposure 99 never · unlooked 0
+```
+
+An iteration is already defined as *one item taken to its gate*, not one agent turn.
+Printing per turn would put a bar above every tool call and teach the operator to skip
+the block that matters.
+
+**The rail is computed from the project's own `pipeline.json` and carries no stage count
+of its own.** The eleven above are this plugin's *example* flow; a host replaces them. A
+bar reading `gates 5/11` in a project with six stages is a summary confidently wrong
+about the thing it summarises, printed in the one place a run is trusted at a glance.
+
+**Every number on the block is borrowed, and the block computes nothing.** `board` comes
+from the backlog, `carry-over` from the ledger, `exposure` from the verification file,
+`unlooked` from the gate's own disclosure. If the block disagrees with a gate verdict,
+the block is wrong — that direction, always, because the gate looked and the block
+quoted. A progress line that computed its own counts would be the fourth copy of the
+truth, and this repository already knows what happens to those.
+
+**A glyph is read from the verdict its gate wrote, never from memory.** `✓` means the
+gate passed, not that the stage was walked — a rail is a summary, and a summary is the
+easiest artefact in a run to write from recollection. `⊘` may never be silent: a skipped
+stage with no recorded reason is indistinguishable from a stage never entered, and the
+two mean opposite things.
+
+**`.task-pipeline/run.md` is finally written.** `loop-guard.md` has named it since the
+day it shipped, calls its own churn detection *mechanical*, and reads `touch:` lines from
+it — and **no run had ever created it**. The detector had no input; the guard sat on
+rung 1 while every reader took it for rung 3. It is now seeded at stage 0 from
+[`templates/run.md`](plugins/task-pipeline/skills/task-pipeline/templates/run.md), named
+in that stage's gate, and serves two readers: the guard reads the touches, the progress
+block reads the stage verdicts and counts the `iter:` lines. The counter is a `grep -c`,
+not a number the agent is carrying — after a compaction the agent's count is gone and
+the file's is not.
+
+**Five new guards, each watched failing against a planted defect.** The header block's
+field set compared **both ways** between its two copies; every glyph a rail prints
+present in the legend; the computed-rail promise stated where a reader meets it; and the
+ledger's line shapes compared declared-vs-shown **and** against the files that read them.
+The first version of the fourth probe removed one of three `touch:` lines from the worked
+log, left the shape shown, and read the guard's correct silence as a broken guard — R-001
+again, and the reason it is a standing instruction.
+
+## v1.33.0 — the number, the list, and the command that shows them with no task running
+
+Three modules shipped as one, because they are one capability: the index, the list it
+produces, and the command that prints them when nothing else is running.
+
+**Exposure is a vector with its components named, never a probability.** The request that
+started this asked for *"the probability of an error"*. It is not computable from these
+inputs, and a number dressed as one is the class this repository has spent its history
+removing — so the guard rejects a `%` on that line outright:
+
+```
+exposure: 99 unverified · never checked · 10 releases carry one
+    REQ-001  references/setup.md — the entry audit: when it runs …   v1.10.0
+    …
+    and 91 more — the full list is `/task-pipeline checkup`
+```
+
+**`never checked`, not `0 days`.** When no row has ever been confirmed — this repo's
+exact state — a zero would read as *checked today*, the precise inversion this pipeline
+exists to prevent. The literal is required by its own guard.
+
+**A single score was refused on purpose.** One number invites a threshold, and a
+threshold here is a target on `never`, which `verification.md` says may never have one.
+The components are one line; a reader can hold three.
+
+**`/task-pipeline checkup` runs with no task in flight**, which is the whole point:
+accumulated unconfirmed work is invisible precisely because nobody is running a pipeline,
+so a check living only inside a run can never say *stop, fourteen things are
+unconfirmed*. It reads four files this pipeline already keeps and writes nothing unless
+asked — and then only board rows whose `Source` names the checkup, printed before they
+are added.
+
+**And `continuity.md` finally names the file it always demanded.** It has required each
+iteration to re-measure the work-list since the beginning, and said *"next up is X"* is
+a claim no gate reads. The board is that list; the claim now cites a `B-NNN`, which can
+be checked, rather than a description, which cannot.
+
+**Two defects in the new guard, both self-inflicted and both instructive.** Its needle
+looked for *"never a percentage"* while the doctrine it guards says *"no percentage,
+ever"* — guard and prose written an hour apart, already disagreeing. And the `%` check
+searched for a literal that its own line necessarily contains, so it matched **itself**
+and passed a planted percentage. A detector that matches itself first is checking the
+wrong thing.
+
+Guards: 185 → **188**, property checks 8.
+
 ## v1.32.0 — the column a machine may not fill
 
 Stage 8 already performs the verification trio, reads the CI verdict and opens the

package/CONTRIBUTING.md

@@ -396,12 +396,87 @@ property check proves that filling the column does not fail the build, because a
 that punishes an honest answer will not receive one.
 *(guard: `either a date or the literal` and `is in no brief's REQ table`)*
 
-**46. Every invariant above names the guard that enforces it, and that guard exists.**This list claims to be *what the validator enforces*; it was eight guards behind when
+**46. Exposure prints as a named vector and never as a probability.** The request that
+produced it asked for `P(defect)`; it is not computable from these inputs, and a single
+score invites a threshold, which is a target on `never` — the one thing the verification
+ledger says may never have one. A `%` on that line fails the build. Where no row has ever
+been confirmed the line prints the literal `never checked`, because `0 days` reads as
+*checked today*. The doctrine carries both rules where a reader proposing a percentage
+will find them.
+*(guard: `may never take` and `carry it where the next reader looks`)*
+
+**47. Every invariant above names the guard that enforces it, and that guard exists.**This list claims to be *what the validator enforces*; it was eight guards behind when
 an audit measured it. A claim of enforcement is now checked like any other claim.
 *(guard: `whose message does not appear in`)* — and a cited literal must lie inside
 a **single** string in `test/validate.py`: the check reads that file as text, so a
 quote straddling a line-continuation is a citation nothing can find.
 
+**48. The progress header exists in two files and is compared both ways; the rail is
+computed, never eleven.** `references/progress.md` defines the block and
+`references/stages.md` restates it — learned.md rule 20's shape, and the drift is silent
+because each copy reads complete alone. Both directions, because they are different
+failures: a field in the doctrine and not the stage list is a reader who never meets it;
+a field on the stage list and not in the doctrine is a number with no home. The rail's
+stage set comes from the project's own `pipeline.json`, and the doctrine is required to
+say so — the eleven in `pipeline.example.json` are an example, and a bar reading
+`gates 5/11` in a six-stage project is wrong in the one place a run is read at a glance.
+Every glyph printed is in the legend, one direction and deliberately: a legend row for an
+unused glyph is vocabulary, not a defect.
+*(guard: `one block, two copies, already drifted` and `carries no stage count of its own`
+and `the legend does not define it`)*
+
+**49. The run ledger's line shapes are declared, shown, and read.** `templates/run.md`
+declares three under `## Lines` and works them under `## Log`; the two enumerations are
+compared **both ways**, because a shape declared and never shown is a rule with no
+example and a shape shown and never declared is an example teaching an unowned format.
+Third check: every declared shape is named by `references/progress.md` or
+`references/loop-guard.md` — a ledger shape nothing reads is a shape nothing writes,
+which is exactly what this file was for the whole time `loop-guard.md` called its own
+detection mechanical and no run had created the file.
+*(guard: `declared under` and `shown in` and `a ledger shape with no reader`)*
+
+**50. The review loop has a stated cap, and the cap is one number in two files.** It is
+computed from `references/loop-guard.md`, which owns the caps, and required verbatim in
+the stage that runs the loop; both must name `run.review.maxRounds`, because a default
+nobody can change is a default everybody overrides in their head. The cap is a
+**decision point, not a stop** — at it the run prints new findings against
+self-inflicted ones, per round. A flat ceiling would be the wrong rule: the runs that
+went ten rounds were still finding real defects on round nine.
+*(guard: `no review-round cap` and `the review cap is stated with no config key`)*
+
+**51. The short path is proposed, printed and glyphed; the exposure example is computed
+from its own print.** A stage skipped by the triage is marked with a glyph
+`references/progress.md`'s legend defines — a skip nobody can see is indistinguishable
+from a stage never entered. And the worked exposure line carries **no digits**: its
+vocabulary is derived from the print statement at check time, because the previous
+example disagreed with the code in both directions at once and hardcoded a live count.
+*(guard: `and references/progress.md's legend does not define it`
+and `the worked example carries a digit`)*
+
+**52. A companion the matrix points at a stage is named by that stage, and stage 3's
+three tracks each name their owner.** The matrix's *"needed for"* cell says which stage
+needs a companion; nothing checked the stage had ever heard of it, which is how
+`sheleg-design` reached one mention in the whole bundle and super-ux's copy half reached
+none while the table read complete on its own. On the commit that added it, this guard
+found `chrome-devtools` pointed at stages 5–6 with stage 5 silent since the day it was
+added. A second, deliberately narrow check covers the three stage-3 tracks — UX, COPY,
+VISUAL — each with its owning skill, because the first reads matrix **row names** and
+the copy half lives inside super-ux's own cell, exactly where it was invisible.
+*(guard: `has not heard of it` and `names no owner`)*
+
+**53. Publishing a retro insight is opt-in, enumerated, and its own example obeys its
+own rules.** `retro.publish` is off when absent — opening an issue in another repository
+is an outward act, and a generic flag is not a specific authorization. The redaction
+rules are a **numbered enumeration whose count is computed from the items** and required
+in the sentence that introduces them, because an enumeration counted in prose is the
+class this repository spent six review rounds on. The doctrine's own worked issue body
+is checked against those rules: no absolute path, nothing that reads as a commit, no
+repository slug but the skill's. And the key must exist in `pipeline.schema.json` **and**
+be named by a stage — a step described in the retro's doctrine and in no stage never
+runs.
+*(guard: `does not say` and `rule 1 of the list it is printed beside`
+and `no stage names`)*
+
 ## Adding or changing doctrine
 
 - **Change one idea per PR.** These files are read by agents under load; a PR that

package/README.md

@@ -128,9 +128,11 @@ until it is installed.
 | 10 Acceptance | [`acceptance.md`](plugins/task-pipeline/skills/task-pipeline/references/acceptance.md) — REQ coverage table, evidence rules, the closing question |
 | 10 + any audit | [`audit.md`](plugins/task-pipeline/skills/task-pipeline/references/audit.md) — the L0→L7 ladder and its seams, axis rotation, ratchets, proven checks |
 | any loop | [`loop-guard.md`](plugins/task-pipeline/skills/task-pipeline/references/loop-guard.md) — churn detection, caps, the break protocol |
+| run-wide reporting | [`progress.md`](plugins/task-pipeline/skills/task-pipeline/references/progress.md) — the header block at task start and the one-line iteration close: the stage rail computed from the project's own `pipeline.json`, every number borrowed from the gate that measured it |
 | run-wide pacing | [`continuity.md`](plugins/task-pipeline/skills/task-pipeline/references/continuity.md) — the loop mode (`run.loop`, default off, never collapses a manual gate) and the context budget (fires on a harness signal, never on an estimate) |
 | the board between runs | [`backlog.md`](plugins/task-pipeline/skills/task-pipeline/references/backlog.md) — the work-list that outlives a run: seeded at stage 0 or picked up, priority **computed** from three stated inputs rather than assigned, and the seam where the carry-over ledger's `backlog` pointer finally resolves |
 | what a human confirmed | [`verification.md`](plugins/task-pipeline/skills/task-pipeline/references/verification.md) — one row per shipped REQ and the one column a machine may not fill: the date somebody **looked**, or `never`. No floor, no target — `never` is a fact, and a count driven down is a column that has started lying |
+| how much is unconfirmed | [`exposure.md`](plugins/task-pipeline/skills/task-pipeline/references/exposure.md) — the unconfirmed count as a **vector with its components named**, never a percentage: `P(defect)` is not computable from these inputs and a single score invites a threshold, which is a target on `never`. Plus the check-list, oldest first, and the `/task-pipeline checkup` mode that prints it with no task in flight |
 | 0 + 9 + any settled decision | [`documentation.md`](plugins/task-pipeline/skills/task-pipeline/references/documentation.md) — the inventory, registers and ids, SSOT, the Doc Loop, supersede semantics, the propagation matrix, intent vs as-built |
 | 3 + 4 · every spec and plan | the self-review reads its rules back — is every named check real, does anything contradict a locked decision or a rejected option, and what does this cost now versus at design time. Answers land as a committed `## Self-review` of computed numbers |
 | 6–10 + any check you write | [`gates.md`](plugins/task-pipeline/skills/task-pipeline/references/gates.md) — the three axes, the promotion ladder, gate anatomy, the probe recipe, ratchet floors |
@@ -613,6 +615,17 @@ GATE 10 acceptance: PASS — 14/14 REQ verified
   abstained: 1 (1 cannot-verify) · unlooked: 0
 ```
 
+**And a lesson about the pipeline itself can leave the project.** A defect in the
+*skill* — a gate that loops, a doctrine promising what nothing enforces — was
+rediscovered independently in every repository that ran it and fixed in none. Set
+`retro.publish` in `pipeline.json` and stage 10 opens the insight as an issue on the
+skill's own repository, **printing the whole body first**; the printed string and the
+sent string are one string. Five numbered rules govern what leaves — no host paths, no
+host identifiers, no code or config or data, no names, and a title stating the class
+rather than the incident. **Absent the key, nothing is published and nothing is asked:**
+an issue in someone else's repository is an outward act, and a generic flag is not a
+specific authorization.
+
 Stage 0 reads those standing instructions **in full** on the next run — which is
 the whole reason the cap exists and the prune is a gate criterion instead of a good
 intention. A rule nobody reads to the end is worse than no rule: everyone believes
@@ -632,6 +645,17 @@ The spec stage runs it **before any plan is written**: `/ux` (setup check) →
 stages served, applicable UX patterns — and the plan's UI tasks carry scenario IDs
 in their DoD. Scenarios come before interface.
 
+**Two more tracks run beside it, and they answer different questions.** super-ux
+decides what the interface must *do*; its own `copywriting` decides how it *sounds*
+(every user-facing string, against the brand pack — `/brand-init` before the first
+string, never after); and [sheleg-design](https://github.com/ssheleg/sheleg-design)
+decides how it *looks* (tokens and themes, typography and rhythm, motion and its rest
+state). Until v1.36.0 this stage named only the first, so a run designed a flow and
+then wrote its strings by taste and picked its values at the keyboard, with every gate
+green over both. Either optional track can be declined — *"as is"*, *"draft"* — and
+the refusal is **recorded**, because a track skipped in silence and a track that ran
+are the same thing in a transcript.
+
 ```
 /plugin marketplace add ssheleg/super-ux
 /plugin install super-ux@super-ux

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.32.0 |
+| **Version** | 1.37.0 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/cursor/rules/task-pipeline.mdc

@@ -381,7 +381,14 @@ not authorize an outward, irreversible action — stage 7 stops and asks.
     grade — **mechanical check > standing instruction (with its retire-when written
     at birth) > a note that expires in two runs** — and the check that catches it
     the first time from now on. A lesson true in any repository belongs upstream in
-    the skill's own doctrine, not in one project's file.
+    the skill's own doctrine, not in one project's file — and where the project has
+    opted in (`retro.publish` in its pipeline config, OFF when absent), that lesson
+    is opened as an issue on the skill's own repository. The body is printed in full
+    before it is sent and the printed string is the sent string; five rules govern
+    what may leave — no host paths, no host identifiers, no code or config or data,
+    no names, and a title stating the class rather than the incident. Nothing is
+    published without that opt-in: an issue in someone else's repository is an
+    outward act, and a generic flag is not a specific authorization.
     A retro left empty after a messy run is the failure it exists to stop. Phase 1
     of the next run reads those standing instructions **in full**, which is why the
     cap is not negotiable and the prune is a gate item, not a good intention.
@@ -569,14 +576,32 @@ than the last five run stamps **move** to an append-only archive that is *querie
 by the task's nouns rather than read — which keeps the in-force file short enough to
 read in full, and makes pruning cost no knowledge.
 
-## super-ux for user-facing tasks (recommended)
-
-If the task touches any UI (web/mobile/CLI/TUI), the WHY→UI→scenario chain comes
-BEFORE interface code. If super-ux is available, use it: foundation (personas,
-JTBD, customer journey maps, user stories) → flows + screens → scenarios (the
-source of truth) → run its linter. Otherwise still design that chain, get it
-approved, and trace every user-facing requirement to a scenario before building.
-Install (Cursor/Claude/others): `npx skills add ssheleg/super-ux`.
+## Three tracks for user-facing tasks (stage 3)
+
+Three questions, three owners, and none substitutes for another: what the
+interface must **do**, how it **sounds**, how it **looks**.
+
+1. **UX track — super-ux (recommended).** If the task touches any UI
+   (web/mobile/CLI/TUI), the WHY→UI→scenario chain comes BEFORE interface code:
+   foundation (personas, JTBD, customer journey maps, user stories) → flows +
+   screens → scenarios (the source of truth) → run its linter. Without the skill,
+   still design that chain, get it approved, and trace every user-facing
+   requirement to a scenario before building.
+   Install: `npx skills add ssheleg/super-ux`.
+2. **COPY track — copywriting (super-ux ships it).** Every string a product's
+   user reads goes through it, against the brand pack; no pack means running
+   brand-init BEFORE the first string, not after. Not through it: commit
+   messages, PR text, code comments, developer READMEs, internal docs.
+3. **VISUAL track — sheleg-design (recommended).** Tokens and themes,
+   typography and rhythm, motion and how it degrades to rest, the Figma boundary
+   (tokens as variables, never raw values carried across). Not through it: a
+   purely structural change, text, a backend, an internal script.
+   Install: `npx skills add ssheleg/sheleg-design`.
+
+**A refusal is a sentence, never a silence.** "as is" ends the visual track and
+"draft" ends the copy track; either is the operator's call and costs nothing, but
+it is recorded and said out loud in the close-out. A track skipped silently and a
+track that ran look identical afterwards.
 
 ## Routing — when this applies at all
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.32.0",
+  "version": "1.37.0",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/manual gates, a frozen requirement spine that must close with evidence, a loop guard that breaks churn, one provider-agnostic model confirmed up front, and an optional super-ux UX track for user-facing work.",
-  "version": "1.32.0",
+  "version": "1.37.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/commands/task-pipeline.md

@@ -44,6 +44,17 @@ Idempotent entry — inspect state first, never restart blindly:
 - Otherwise, begin at stage 0 (intake grill). If no task is given above, the
   grill's first question asks the operator for the task in one line.
 
+**`/task-pipeline checkup`** — **runs with no task in flight, and that is the point.**
+Accumulated unconfirmed work is invisible precisely because nobody is running a pipeline,
+so a check living only inside a run can never say *"stop, fourteen things are
+unconfirmed."* It takes no brief, opens no grill, and writes nothing on its own. Four
+sections, each read from a file this pipeline already keeps: the **exposure** line with
+its check-list oldest-first, the **board**'s open rows by computed priority, the
+carry-over ledgers' unresolved count, and the code graph's staleness where one exists.
+Where you ask it to file what it found, it appends board rows whose `Source` names the
+checkup and its date — printing what it would add first, never silently. Doctrine:
+`references/exposure.md`.
+
 **`/task-pipeline setup`** — the entry audit instead of a feature. Runs seven passes
 over the documentation this project already has, reports findings as `file:line` + the
 minimal fix ordered by seam, and hands back a fix plan the pipeline can run. Offered

package/plugins/task-pipeline/skills/task-pipeline/SKILL.md

@@ -67,9 +67,11 @@ gate stops until it is installed.
 | **first run · the entry audit** (offered once) | [`references/setup.md`](references/setup.md) |
 | **what travels with the bundle vs stays in a project** | [`references/portability.md`](references/portability.md) |
 | any repeating loop | [`references/loop-guard.md`](references/loop-guard.md) |
+| run-wide · what the run **prints about itself** — the rail, the iteration line | [`references/progress.md`](references/progress.md) |
 | run-wide · how a run keeps going (the loop mode + the context budget) | [`references/continuity.md`](references/continuity.md) |
 | run-wide · the work-list **between** runs, and how its priority is computed | [`references/backlog.md`](references/backlog.md) |
 | run-wide · whether a **human** ever confirmed what shipped, and when | [`references/verification.md`](references/verification.md) |
+| run-wide · how much unconfirmed work has piled up, and what to look at first | [`references/exposure.md`](references/exposure.md) |
 
 **Optional bridge.** If the operator already runs an equivalent skill set (e.g.
 `superpowers:brainstorming` / `writing-plans` / `subagent-driven-development` /