task-pipeline-skill 1.33.0 → 1.38.0

package/CHANGELOG.md

@@ -1,5 +1,337 @@
 # Changelog
 
+## v1.38.0 — the wall came down, and a green started meaning something
+
+An audit of this skill measured nineteen problems and asked one question of all of them:
+*why can an agent that follows every rule here still report work it did not do?* The
+answers were not in the doctrine. They were in how much of it there is, how it is
+delivered, and what nobody checks.
+
+### The wall
+
+`commands/task-pipeline.md` — the first text an agent reads when the skill fires — was
+**one paragraph of 1281 words carrying 25 obligations, with a 4115-character line**.
+Twenty-five duties in one breath: which of them an agent obeys is a function of position,
+not importance.
+
+Same doctrine, eight headed sections, nothing removed:
+
+```
+paragraphs        5  ->  34
+longest paragraph 1281 words  ->  295
+longest line      4115 chars  ->  261
+```
+
+### The trigger surface said nothing about two of the three modes
+
+`setup` and `checkup` appeared in **no browsable surface** — not the skill description,
+not the command description, neither manifest. `checkup` exists specifically to be run
+when nothing else is; the only way to learn it existed was to open the file you open by
+running the thing it replaces.
+
+The description was also at **1015 of its 1024-character ceiling**, with ~40% spent on
+mechanism prose that cannot affect routing. Cut, both modes named, and it now sits at
+956 with room to grow. Both manifests described the product as it stood at v1.30 — seven
+releases of capability absent from the only text a marketplace shows.
+
+**The plan proposed separate command files for the two modes and the doctrine refused
+it.** `exposure.md` says *a mode of the command, not a new command, because a second
+command costs every surface a command touches*. The doctrine is older than the plan and
+it won.
+
+### `test/probe.py` — R-001's retirement condition, three years of releases late
+
+The standing instruction R-001 has said since 2026-08-03: *prove the plant landed in the
+text the check actually parses.* Its retirement condition, written at birth, was **"a
+probe harness exists that asserts the plant changed the parsed text"**. It was never
+built, and three probes failed in a single day for want of it.
+
+Three assertions per plant, and the third is the one hand-rolled probes keep missing:
+
+1. the substitution **landed** — `replace` matching nothing raises nothing;
+2. the exit code is **non-zero** — never a `FAIL` line on stdout;
+3. **the guard that fired is the guard under test**, named up front rather than
+   recognised afterwards. A plant that trips some *other* check has proved that other
+   check works.
+
+The harness self-tests its own failure branches (`npm run test:probe`), because a
+harness whose failure path has never executed is exactly what it exists to stop. **On its
+first use it caught two of this release's own guards being too loose** — one accepted any
+three reader states rather than requiring the load-bearing one, and one matched
+`none found` against a coincidental sentence in another paragraph.
+
+### The independent reader is now dispatched by a stage, and read by its output
+
+R-005 requires an independent reader on any change that adds or widens a check. Four pull
+requests of almost nothing but check work were opened in one day; the review app reported
+**`skipping`** on every one, and twenty-two guards merged on author probes alone. Nothing
+was violated. Nothing read the reviewer's output either.
+
+Stage 7 now dispatches the reader — a subagent it can watch, a bot whose **verdict** it
+then reads, or a person — and records exactly one of three states beside the gate:
+
+```
+reader: 6 findings, 4 confirmed
+reader: none found
+reader: NO READER — <why>
+```
+
+The third is printed, never omitted. *A reader was requested* and *a reader reported* are
+different facts that look identical in a transcript.
+
+### `learned.md` rule 22 — an operation that changed nothing reports like one that changed everything
+
+Four incidents in two programmes, each invisible until something downstream failed: an
+import that never landed, a doctrine phrase worded differently, a `gh` call refused behind
+`>/dev/null`, and a test piped to `head` so `$?` belonged to `head`. **Assert the effect,
+not the call.**
+
+### The retro's uncapped narrative stopped being read in full
+
+The doctrine said stage 0 reads three sections of `docs/superpowers/retro.md` in full
+because *"all three are bounded by construction, which is why the cap is not
+negotiable."* Measured, that claim was false:
+
+```
+Standing instructions   ~ 1 394 tok   capped at ten rows
+Run stamps              ~ 1 842 tok   one line per run
+Recent log              ~10 937 tok   narrative — capped by nothing   ← 74% of the file
+```
+
+An uncapped section inside a source that **binds** the run is precisely what makes the
+capped part get skimmed. The log is now **queried by the task's nouns**, like the
+archive; the instructions and the stamps are still read in full, because they are the
+part that is actually bounded.
+
+**Stage-0 reading floor: ~47 750 → ~36 950 tokens** from that one change.
+
+**And the audit that found this over-claimed in the same paragraph.** Its own table said
+`stages.md` was *"read in full at stage 0"*; grepping the obligation returns only the
+retro. The report now says *the gates a run must satisfy*, which is weaker and true.
+
+### The preflight now says what has not been measured
+
+It reported companion availability in careful detail and this skill's own evidence not at
+all — while `evals/RESULTS.md` recorded **one self-observed run by the author and zero
+blind runs on zero models**. A skill silent about its own evidence is read as tested, by
+the bundle that demands evidence of everyone else. The line prints while no blind run is
+recorded and disappears when one is; it is a state of the evidence, not a warning.
+
+The suite itself was frozen at the v1.9 feature set — **zero cases** touching the board,
+the verification ledger, the exposure line, the progress rail, `checkup`, `setup`,
+`copywriting` or `sheleg-design`. Now **21 cases**, including the two no-task modes,
+the three stage-3 tracks, the progress rail and run ledger, the dispatched reader, and a
+question that must **not** trigger the pipeline at all.
+
+Guards: 210 → **218**, property checks 8.
+
+## v1.37.0 — the audit, and the four things it found the pipeline could not say
+
+One release, four modules, and an audit that put four questions to this pipeline and
+answered them with measurements rather than opinion:
+
+- **99 shipped REQ, 99 of them at `Human: never`** — nothing has ever been confirmed by
+  a person, and the exposure line has been saying so on every run.
+- **`copywriting` appeared 0 times in the bundle and `sheleg-design` once**, as a name in
+  a README list.
+- **The review loop ran ten rounds, ten, eight, four, three** against a stated ceiling of
+  two stage re-entries — because a review round was named in no cap at all.
+- **Nothing ever printed which pipeline, which module, or which iteration was running.**
+  The run checklist existed and was marked *"copy it, tick it"*.
+
+Guards: 188 → **210**, property checks 8. Every one watched failing against a planted
+defect, and three of the probes were wrong before their guards were.
+
+### The lesson that stopped dying in the repository that learned it
+
+`retrospective.md` has said *"open an issue upstream"* since v1.9.0 and named no
+repository, no trigger and no authorization — an instruction on rung 1 that every reader
+took for done. So a defect in **the skill** — a gate that loops, a doctrine promising
+what nothing enforces, a rule firing on the wrong shape — was rediscovered independently
+in every project that ran the pipeline and fixed in none of them.
+
+**Opt-in, per project, off by default**, `pipeline.json` → `retro.publish`:
+
+```json
+"retro": { "publish": { "repo": "…", "label": "retro-insight", "redact": "strict" } }
+```
+
+Absent, nothing is published and nothing is asked. Opening an issue in another
+repository is an **outward act**, and an outward act taken from a generic flag is one
+nobody authorized — the same floor deploy authorization uses.
+
+**The body is printed in full before it is sent, and the printed string and the sent
+string are one string.** Redacting after the print, or printing a tidier version of what
+actually goes out, is the false-success shape this bundle names outright: a mechanism
+reporting on itself instead of on what it did.
+
+**Five numbered redaction rules**, because *insight only* is not a specification. No host
+paths — only paths inside task-pipeline itself. No host identifiers: repository,
+organisation, branch, commit, tag, issue. No code, no config values, no data, not even
+redacted. No names of any kind. And the title states the **class**, not the incident.
+When in doubt the rule is subtraction: an insight that survives losing a detail is still
+an insight, and a detail that leaks cannot be recalled from an index.
+
+**Seven guards, and one of them was broken by the fence above.** The check that makes the
+doctrine's own worked issue obey its own rules was silent against three separate plants —
+an absolute path, a commit id, a foreign repository slug — because the fence scan matched
+` ``` ` followed by a newline, and the ```json block one paragraph up made every
+subsequent fence pair with the wrong delimiter. Five fence scans across four modules had
+the same bug; all are language-tolerant now, and the earlier modules' probes were re-run
+to prove the change broke nothing (R-003: sweep the detector's siblings).
+
+### What it does, how it sounds, how it looks
+
+The audit measured this one rather than argued it: **`copywriting` appeared zero times
+in the whole bundle, and `sheleg-design` once — as a name in a list in the README.**
+Meanwhile the companion matrix named six super-ux surfaces while super-ux shipped eight
+skills and fifteen commands. So a run designed a flow, then wrote its interface strings
+by taste and picked its visual values at the keyboard, and every gate in the pipeline
+reported green over both.
+
+**Stage 3 now runs three tracks, and none substitutes for another:**
+
+| Track | Answers | Owner |
+|---|---|---|
+| UX | what the interface must **do** | super-ux — the WHY→UI→scenario chain |
+| COPY | how it **sounds** | `copywriting`, against the brand pack |
+| VISUAL | how it **looks** | `sheleg-design` — tokens, themes, rhythm, motion |
+
+Each carries its boundary in both directions, because a track that over-reaches is
+routed around. The copy track takes interface strings, errors, empty states, the
+landing, the user-facing changelog — and explicitly **not** commit messages, PR text,
+code comments or a developer README. The visual track takes the visual layer and
+explicitly **not** a purely structural change, which is the UX track's.
+
+**A refusal is a sentence, never a silence.** *"as is"* ends the visual track and
+*"draft"* ends the copy track; either is the operator's call and costs nothing. But it
+is recorded in the brief and said in the close-out, because a track skipped in silence
+and a track that ran are identical afterwards — the `⊘` rule one layer up.
+
+**`sheleg-design` joins the matrix and the preflight**, and super-ux's row finally names
+its copy half.
+
+**The new guard found a live defect on the clean tree before it found anything else.**
+It compares the matrix's *"needed for stage N"* cell against what that stage actually
+says, and reported that `chrome-devtools` had been pointed at **stages 5–6 since the day
+it was added, with stage 5 never naming it**. Fixed here: stage 5 now checks a rendered
+surface per task, while the implementer that wrote it is still dispatched.
+
+**And a probe found a hole in its own guard.** Removing `copywriting` from stage 3 left
+the check silent, because it reads matrix **row names** and the copy half lives inside
+super-ux's own cell — precisely where it had been invisible all along. A second, narrow
+check now covers the three tracks by name. It is narrow on purpose: generalising the
+sub-skill mapping would demand stage 3 name `/brand-lint` and `ux-audit` too, and a
+check that over-reaches is switched off by the third person who hits it.
+
+### The loop that had no ceiling, the exemption nobody measured
+
+Three findings from the same audit, all of them gates behaving as prose.
+
+**The review loop was capped by nothing.** `build.md` caps the stage-5 fix loop at five
+rounds per task and `loop-guard.md` caps stage re-entries at two — and a review round is
+neither, so nothing counted them. The run stamps say what that cost: **ten rounds, ten,
+eight, four, three**, in one programme.
+
+**A flat cap would have been the wrong fix**, and this is the part worth keeping. Every
+one of those runs recorded *"none from my probes"* beside its count — the reader was
+still finding real defects on round nine. Stopping at two would have shipped them. So
+the cap is a **decision point**: default 3 rounds per artifact (`pipeline.json` →
+`run.review.maxRounds`), and at the cap the run stops reviewing and prints the pair
+`audit.md` already defines, per round:
+
+```
+review cap reached — 3 rounds — artifact: test/validate.py
+  round 1: 12 new · 0 self-inflicted
+  round 2:  5 new · 1 self-inflicted
+  round 3:  1 new · 3 self-inflicted
+```
+
+Self-inflicted ≥ new and the axis is exhausted; new still ahead and continuing is the
+operator's call, made with numbers rather than fatigue. Rounds are counted from the run
+ledger's `touch:` pass numbers, never from memory. Every finding left open at the cap
+leaves as a board row with its evidence, never as a shrug.
+
+**The pipeline ran eleven stages over a typo because nothing measured the exemption.**
+The boundary — a one-line fix, a mechanical rename — existed in prose and depended on an
+agent remembering it. Stage 0 now runs a three-question triage with something behind each
+question, and **proposes** the short path: stages 1–4 marked `⊘` with the triage answer
+as the reason. Propose, never take: the answer goes in the brief and silence takes the
+full flow, the same floor deploy authorization uses. The glyph is what makes it safe —
+a skipped stage is printed on the rail *with its reason*, and a skip nobody can see is
+indistinguishable from a stage never entered.
+
+**`exposure.md`'s worked example disagreed with its own output, in both directions at
+once.** It taught `31 releases since the last human confirmation` while the code printed
+`releases carry one`, and it hardcoded `99` — a live count that drifts. The example now
+carries no digits at all, and a guard computes the format's vocabulary **from the print
+statement** and requires the doctrine to show it.
+
+**Six new guards, each watched failing.** Two of them found their own author first: the
+short-path check was scoped to a paragraph while the bullet it reads carries a fenced
+block, so it stopped three lines short of the glyph and passed in silence — and its
+replacement matched the fence's own backtick and accused the clean tree. A detector that
+finds itself before it finds anything else is checking the wrong thing, twice in one
+module.
+
+### A run that says which pipeline it is on, and where in it
+
+An audit of this pipeline asked four questions of it. The first was *does the agent
+understand the plan it is executing?* — and the honest answer was that nothing in eleven
+stages ever printed which pipeline, which module, or which iteration was running. The
+run checklist existed and was marked *"copy it, tick it"*: an instruction with no gate
+behind it, which is the same failure it was written to prevent, one level up.
+
+**The run prints where it is, at two boundaries and only two** — task start and
+iteration close ([`references/progress.md`](plugins/task-pipeline/skills/task-pipeline/references/progress.md)):
+
+```
+task-pipeline v1.34.0 · pipeline-audit · module P1 «the progress print» (1 of 4)
+  0 ✓  1 ✓  2 ✓  3 ▶  4 ·  5 ·  6 ·  7 ·  8 ·  9 · 10 ·
+  ███████░░░░░░░░░░░░░░░░░░░  gates 3/11 · now 3 Spec · manual
+  board B-028 · carry-over 0 rows · exposure 99 never · unlooked 0
+```
+
+An iteration is already defined as *one item taken to its gate*, not one agent turn.
+Printing per turn would put a bar above every tool call and teach the operator to skip
+the block that matters.
+
+**The rail is computed from the project's own `pipeline.json` and carries no stage count
+of its own.** The eleven above are this plugin's *example* flow; a host replaces them. A
+bar reading `gates 5/11` in a project with six stages is a summary confidently wrong
+about the thing it summarises, printed in the one place a run is trusted at a glance.
+
+**Every number on the block is borrowed, and the block computes nothing.** `board` comes
+from the backlog, `carry-over` from the ledger, `exposure` from the verification file,
+`unlooked` from the gate's own disclosure. If the block disagrees with a gate verdict,
+the block is wrong — that direction, always, because the gate looked and the block
+quoted. A progress line that computed its own counts would be the fourth copy of the
+truth, and this repository already knows what happens to those.
+
+**A glyph is read from the verdict its gate wrote, never from memory.** `✓` means the
+gate passed, not that the stage was walked — a rail is a summary, and a summary is the
+easiest artefact in a run to write from recollection. `⊘` may never be silent: a skipped
+stage with no recorded reason is indistinguishable from a stage never entered, and the
+two mean opposite things.
+
+**`.task-pipeline/run.md` is finally written.** `loop-guard.md` has named it since the
+day it shipped, calls its own churn detection *mechanical*, and reads `touch:` lines from
+it — and **no run had ever created it**. The detector had no input; the guard sat on
+rung 1 while every reader took it for rung 3. It is now seeded at stage 0 from
+[`templates/run.md`](plugins/task-pipeline/skills/task-pipeline/templates/run.md), named
+in that stage's gate, and serves two readers: the guard reads the touches, the progress
+block reads the stage verdicts and counts the `iter:` lines. The counter is a `grep -c`,
+not a number the agent is carrying — after a compaction the agent's count is gone and
+the file's is not.
+
+**Five new guards, each watched failing against a planted defect.** The header block's
+field set compared **both ways** between its two copies; every glyph a rail prints
+present in the legend; the computed-rail promise stated where a reader meets it; and the
+ledger's line shapes compared declared-vs-shown **and** against the files that read them.
+The first version of the fourth probe removed one of three `touch:` lines from the worked
+log, left the shape shown, and read the guard's correct silence as a broken guard — R-001
+again, and the reason it is a standing instruction.
+
 ## v1.33.0 — the number, the list, and the command that shows them with no task running
 
 Three modules shipped as one, because they are one capability: the index, the list it

package/CONTRIBUTING.md

@@ -411,6 +411,72 @@ an audit measured it. A claim of enforcement is now checked like any other claim
 a **single** string in `test/validate.py`: the check reads that file as text, so a
 quote straddling a line-continuation is a citation nothing can find.
 
+**48. The progress header exists in two files and is compared both ways; the rail is
+computed, never eleven.** `references/progress.md` defines the block and
+`references/stages.md` restates it — learned.md rule 20's shape, and the drift is silent
+because each copy reads complete alone. Both directions, because they are different
+failures: a field in the doctrine and not the stage list is a reader who never meets it;
+a field on the stage list and not in the doctrine is a number with no home. The rail's
+stage set comes from the project's own `pipeline.json`, and the doctrine is required to
+say so — the eleven in `pipeline.example.json` are an example, and a bar reading
+`gates 5/11` in a six-stage project is wrong in the one place a run is read at a glance.
+Every glyph printed is in the legend, one direction and deliberately: a legend row for an
+unused glyph is vocabulary, not a defect.
+*(guard: `one block, two copies, already drifted` and `carries no stage count of its own`
+and `the legend does not define it`)*
+
+**49. The run ledger's line shapes are declared, shown, and read.** `templates/run.md`
+declares three under `## Lines` and works them under `## Log`; the two enumerations are
+compared **both ways**, because a shape declared and never shown is a rule with no
+example and a shape shown and never declared is an example teaching an unowned format.
+Third check: every declared shape is named by `references/progress.md` or
+`references/loop-guard.md` — a ledger shape nothing reads is a shape nothing writes,
+which is exactly what this file was for the whole time `loop-guard.md` called its own
+detection mechanical and no run had created the file.
+*(guard: `declared under` and `shown in` and `a ledger shape with no reader`)*
+
+**50. The review loop has a stated cap, and the cap is one number in two files.** It is
+computed from `references/loop-guard.md`, which owns the caps, and required verbatim in
+the stage that runs the loop; both must name `run.review.maxRounds`, because a default
+nobody can change is a default everybody overrides in their head. The cap is a
+**decision point, not a stop** — at it the run prints new findings against
+self-inflicted ones, per round. A flat ceiling would be the wrong rule: the runs that
+went ten rounds were still finding real defects on round nine.
+*(guard: `no review-round cap` and `the review cap is stated with no config key`)*
+
+**51. The short path is proposed, printed and glyphed; the exposure example is computed
+from its own print.** A stage skipped by the triage is marked with a glyph
+`references/progress.md`'s legend defines — a skip nobody can see is indistinguishable
+from a stage never entered. And the worked exposure line carries **no digits**: its
+vocabulary is derived from the print statement at check time, because the previous
+example disagreed with the code in both directions at once and hardcoded a live count.
+*(guard: `and references/progress.md's legend does not define it`
+and `the worked example carries a digit`)*
+
+**52. A companion the matrix points at a stage is named by that stage, and stage 3's
+three tracks each name their owner.** The matrix's *"needed for"* cell says which stage
+needs a companion; nothing checked the stage had ever heard of it, which is how
+`sheleg-design` reached one mention in the whole bundle and super-ux's copy half reached
+none while the table read complete on its own. On the commit that added it, this guard
+found `chrome-devtools` pointed at stages 5–6 with stage 5 silent since the day it was
+added. A second, deliberately narrow check covers the three stage-3 tracks — UX, COPY,
+VISUAL — each with its owning skill, because the first reads matrix **row names** and
+the copy half lives inside super-ux's own cell, exactly where it was invisible.
+*(guard: `has not heard of it` and `names no owner`)*
+
+**53. Publishing a retro insight is opt-in, enumerated, and its own example obeys its
+own rules.** `retro.publish` is off when absent — opening an issue in another repository
+is an outward act, and a generic flag is not a specific authorization. The redaction
+rules are a **numbered enumeration whose count is computed from the items** and required
+in the sentence that introduces them, because an enumeration counted in prose is the
+class this repository spent six review rounds on. The doctrine's own worked issue body
+is checked against those rules: no absolute path, nothing that reads as a commit, no
+repository slug but the skill's. And the key must exist in `pipeline.schema.json` **and**
+be named by a stage — a step described in the retro's doctrine and in no stage never
+runs.
+*(guard: `does not say` and `rule 1 of the list it is printed beside`
+and `no stage names`)*
+
 ## Adding or changing doctrine
 
 - **Change one idea per PR.** These files are read by agents under load; a PR that

package/README.md

@@ -128,6 +128,7 @@ until it is installed.
 | 10 Acceptance | [`acceptance.md`](plugins/task-pipeline/skills/task-pipeline/references/acceptance.md) — REQ coverage table, evidence rules, the closing question |
 | 10 + any audit | [`audit.md`](plugins/task-pipeline/skills/task-pipeline/references/audit.md) — the L0→L7 ladder and its seams, axis rotation, ratchets, proven checks |
 | any loop | [`loop-guard.md`](plugins/task-pipeline/skills/task-pipeline/references/loop-guard.md) — churn detection, caps, the break protocol |
+| run-wide reporting | [`progress.md`](plugins/task-pipeline/skills/task-pipeline/references/progress.md) — the header block at task start and the one-line iteration close: the stage rail computed from the project's own `pipeline.json`, every number borrowed from the gate that measured it |
 | run-wide pacing | [`continuity.md`](plugins/task-pipeline/skills/task-pipeline/references/continuity.md) — the loop mode (`run.loop`, default off, never collapses a manual gate) and the context budget (fires on a harness signal, never on an estimate) |
 | the board between runs | [`backlog.md`](plugins/task-pipeline/skills/task-pipeline/references/backlog.md) — the work-list that outlives a run: seeded at stage 0 or picked up, priority **computed** from three stated inputs rather than assigned, and the seam where the carry-over ledger's `backlog` pointer finally resolves |
 | what a human confirmed | [`verification.md`](plugins/task-pipeline/skills/task-pipeline/references/verification.md) — one row per shipped REQ and the one column a machine may not fill: the date somebody **looked**, or `never`. No floor, no target — `never` is a fact, and a count driven down is a column that has started lying |
@@ -614,6 +615,17 @@ GATE 10 acceptance: PASS — 14/14 REQ verified
   abstained: 1 (1 cannot-verify) · unlooked: 0
 ```
 
+**And a lesson about the pipeline itself can leave the project.** A defect in the
+*skill* — a gate that loops, a doctrine promising what nothing enforces — was
+rediscovered independently in every repository that ran it and fixed in none. Set
+`retro.publish` in `pipeline.json` and stage 10 opens the insight as an issue on the
+skill's own repository, **printing the whole body first**; the printed string and the
+sent string are one string. Five numbered rules govern what leaves — no host paths, no
+host identifiers, no code or config or data, no names, and a title stating the class
+rather than the incident. **Absent the key, nothing is published and nothing is asked:**
+an issue in someone else's repository is an outward act, and a generic flag is not a
+specific authorization.
+
 Stage 0 reads those standing instructions **in full** on the next run — which is
 the whole reason the cap exists and the prune is a gate criterion instead of a good
 intention. A rule nobody reads to the end is worse than no rule: everyone believes
@@ -633,6 +645,17 @@ The spec stage runs it **before any plan is written**: `/ux` (setup check) →
 stages served, applicable UX patterns — and the plan's UI tasks carry scenario IDs
 in their DoD. Scenarios come before interface.
 
+**Two more tracks run beside it, and they answer different questions.** super-ux
+decides what the interface must *do*; its own `copywriting` decides how it *sounds*
+(every user-facing string, against the brand pack — `/brand-init` before the first
+string, never after); and [sheleg-design](https://github.com/ssheleg/sheleg-design)
+decides how it *looks* (tokens and themes, typography and rhythm, motion and its rest
+state). Until v1.36.0 this stage named only the first, so a run designed a flow and
+then wrote its strings by taste and picked its values at the keyboard, with every gate
+green over both. Either optional track can be declined — *"as is"*, *"draft"* — and
+the refusal is **recorded**, because a track skipped in silence and a track that ran
+are the same thing in a transcript.
+
 ```
 /plugin marketplace add ssheleg/super-ux
 /plugin install super-ux@super-ux

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.33.0 |
+| **Version** | 1.38.0 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/cursor/rules/task-pipeline.mdc

@@ -381,7 +381,14 @@ not authorize an outward, irreversible action — stage 7 stops and asks.
     grade — **mechanical check > standing instruction (with its retire-when written
     at birth) > a note that expires in two runs** — and the check that catches it
     the first time from now on. A lesson true in any repository belongs upstream in
-    the skill's own doctrine, not in one project's file.
+    the skill's own doctrine, not in one project's file — and where the project has
+    opted in (`retro.publish` in its pipeline config, OFF when absent), that lesson
+    is opened as an issue on the skill's own repository. The body is printed in full
+    before it is sent and the printed string is the sent string; five rules govern
+    what may leave — no host paths, no host identifiers, no code or config or data,
+    no names, and a title stating the class rather than the incident. Nothing is
+    published without that opt-in: an issue in someone else's repository is an
+    outward act, and a generic flag is not a specific authorization.
     A retro left empty after a messy run is the failure it exists to stop. Phase 1
     of the next run reads those standing instructions **in full**, which is why the
     cap is not negotiable and the prune is a gate item, not a good intention.
@@ -569,14 +576,32 @@ than the last five run stamps **move** to an append-only archive that is *querie
 by the task's nouns rather than read — which keeps the in-force file short enough to
 read in full, and makes pruning cost no knowledge.
 
-## super-ux for user-facing tasks (recommended)
-
-If the task touches any UI (web/mobile/CLI/TUI), the WHY→UI→scenario chain comes
-BEFORE interface code. If super-ux is available, use it: foundation (personas,
-JTBD, customer journey maps, user stories) → flows + screens → scenarios (the
-source of truth) → run its linter. Otherwise still design that chain, get it
-approved, and trace every user-facing requirement to a scenario before building.
-Install (Cursor/Claude/others): `npx skills add ssheleg/super-ux`.
+## Three tracks for user-facing tasks (stage 3)
+
+Three questions, three owners, and none substitutes for another: what the
+interface must **do**, how it **sounds**, how it **looks**.
+
+1. **UX track — super-ux (recommended).** If the task touches any UI
+   (web/mobile/CLI/TUI), the WHY→UI→scenario chain comes BEFORE interface code:
+   foundation (personas, JTBD, customer journey maps, user stories) → flows +
+   screens → scenarios (the source of truth) → run its linter. Without the skill,
+   still design that chain, get it approved, and trace every user-facing
+   requirement to a scenario before building.
+   Install: `npx skills add ssheleg/super-ux`.
+2. **COPY track — copywriting (super-ux ships it).** Every string a product's
+   user reads goes through it, against the brand pack; no pack means running
+   brand-init BEFORE the first string, not after. Not through it: commit
+   messages, PR text, code comments, developer READMEs, internal docs.
+3. **VISUAL track — sheleg-design (recommended).** Tokens and themes,
+   typography and rhythm, motion and how it degrades to rest, the Figma boundary
+   (tokens as variables, never raw values carried across). Not through it: a
+   purely structural change, text, a backend, an internal script.
+   Install: `npx skills add ssheleg/sheleg-design`.
+
+**A refusal is a sentence, never a silence.** "as is" ends the visual track and
+"draft" ends the copy track; either is the operator's call and costs nothing, but
+it is recorded and said out loud in the close-out. A track skipped silently and a
+track that ran look identical afterwards.
 
 ## Routing — when this applies at all
 

package/evals/task-pipeline.evals.json

@@ -220,6 +220,93 @@
         "Does the work directly"
       ],
       "why": "The opt-out phrase is the release valve that makes default-on acceptable. If it does not work, the boundary is a trap rather than a default."
+    },
+    {
+      "id": "TRIG-05",
+      "category": "should_trigger",
+      "skills": [
+        "task-pipeline"
+      ],
+      "query": "что у нас накопилось непроверенного?",
+      "expected_behavior": [
+        "Recognises this as the checkup mode and runs `/task-pipeline checkup`",
+        "Does NOT open a grill, does not write a brief, and does not start a run",
+        "Reports the exposure line with its named components, the board's open rows by computed priority, the carry-over ledgers' unresolved count, and the graph's staleness",
+        "Never renders the exposure figure as a percentage or a probability"
+      ],
+      "why": "checkup exists precisely for the moment no task is running, and before v1.38.0 it was named in no browsable surface. If a model cannot reach it from a natural request, it may as well not ship."
+    },
+    {
+      "id": "TRIG-06",
+      "category": "should_trigger",
+      "skills": [
+        "task-pipeline"
+      ],
+      "query": "проверь документацию проекта перед тем как что-то строить",
+      "expected_behavior": [
+        "Recognises this as the setup mode and runs `/task-pipeline setup`",
+        "Runs the documentation passes and reports findings as file:line plus the minimal fix, ordered by seam",
+        "Hands back a fix plan rather than starting to fix things inline"
+      ],
+      "why": "The entry audit is the one mode that runs BEFORE building on existing docs. Same discoverability risk as checkup."
+    },
+    {
+      "id": "INSTR-05",
+      "category": "instruction_following",
+      "skills": [
+        "task-pipeline"
+      ],
+      "query": "run this through the pipeline: add CSV export to the reports page",
+      "expected_behavior": [
+        "Flags the task as user-facing and arms the stage-3 UX track",
+        "Names all THREE tracks at stage 3 — what it does (super-ux), how it sounds (copywriting, against the brand pack), how it looks (sheleg-design)",
+        "Where a track is declined, records the refusal out loud in the brief rather than skipping it silently",
+        "Does not write interface strings by taste with no mention of the copy track"
+      ],
+      "why": "copywriting appeared zero times in the bundle and sheleg-design once until v1.36.0. The failure this catches is silent: a flow gets designed and its strings get invented."
+    },
+    {
+      "id": "INSTR-06",
+      "category": "instruction_following",
+      "skills": [
+        "task-pipeline"
+      ],
+      "query": "run this through the pipeline: fix the retry backoff in the queue worker",
+      "expected_behavior": [
+        "Prints a progress header at task start naming the skill, the version, the topic and the stage rail",
+        "Derives the rail from the project's own pipeline config rather than assuming eleven stages",
+        "Prints a one-line progress update at each iteration close, citing a board id rather than a description",
+        "Seeds .task-pipeline/run.md at stage 0 and appends a stage verdict line when a gate returns"
+      ],
+      "why": "Before v1.34.0 nothing printed the run's position and the run ledger was written by no run at all, while the churn detector claimed its own detection was mechanical."
+    },
+    {
+      "id": "INSTR-07",
+      "category": "instruction_following",
+      "skills": [
+        "task-pipeline"
+      ],
+      "query": "run this through the pipeline: harden the auth middleware, and review it properly",
+      "expected_behavior": [
+        "Dispatches an independent reader at stage 7 rather than assuming a bot will read it",
+        "Records one of exactly three states beside the gate verdict: findings, none found, or NO READER with a reason",
+        "Stops reviewing at the declared round cap and prints new findings against self-inflicted ones per round, instead of looping",
+        "Never reports the review as done on the basis that a reader was requested"
+      ],
+      "why": "Four PRs of check work merged on a review app's `skipping` with nobody noticing. A requested reader and a reader that reported are different facts that look identical afterwards."
+    },
+    {
+      "id": "NOTRIG-05",
+      "category": "should_not_trigger",
+      "skills": [
+        "task-pipeline"
+      ],
+      "query": "какой командой у вас гоняются тесты?",
+      "expected_behavior": [
+        "Answers the question directly from the repo's own files",
+        "Does NOT invoke task-pipeline, does not open a grill and does not write a brief"
+      ],
+      "why": "Answering a question is on the skill's own not-for list. The description carries that boundary and nothing has ever measured whether a model honours it."
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.33.0",
+  "version": "1.38.0",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"
@@ -8,7 +8,8 @@
   "scripts": {
     "test": "python3 test/validate.py",
     "test:negatives": "python3 test/negatives.py",
-    "test:all": "python3 test/validate.py && python3 test/negatives.py"
+    "test:probe": "python3 test/probe.py --self-test",
+    "test:all": "python3 test/validate.py && python3 test/negatives.py && npm run test:probe"
   },
   "files": [
     "bin",