task-pipeline-skill 1.37.0 → 1.38.0

package/CHANGELOG.md

@@ -1,5 +1,130 @@
 # Changelog
 
+## v1.38.0 — the wall came down, and a green started meaning something
+
+An audit of this skill measured nineteen problems and asked one question of all of them:
+*why can an agent that follows every rule here still report work it did not do?* The
+answers were not in the doctrine. They were in how much of it there is, how it is
+delivered, and what nobody checks.
+
+### The wall
+
+`commands/task-pipeline.md` — the first text an agent reads when the skill fires — was
+**one paragraph of 1281 words carrying 25 obligations, with a 4115-character line**.
+Twenty-five duties in one breath: which of them an agent obeys is a function of position,
+not importance.
+
+Same doctrine, eight headed sections, nothing removed:
+
+```
+paragraphs        5  ->  34
+longest paragraph 1281 words  ->  295
+longest line      4115 chars  ->  261
+```
+
+### The trigger surface said nothing about two of the three modes
+
+`setup` and `checkup` appeared in **no browsable surface** — not the skill description,
+not the command description, neither manifest. `checkup` exists specifically to be run
+when nothing else is; the only way to learn it existed was to open the file you open by
+running the thing it replaces.
+
+The description was also at **1015 of its 1024-character ceiling**, with ~40% spent on
+mechanism prose that cannot affect routing. Cut, both modes named, and it now sits at
+956 with room to grow. Both manifests described the product as it stood at v1.30 — seven
+releases of capability absent from the only text a marketplace shows.
+
+**The plan proposed separate command files for the two modes and the doctrine refused
+it.** `exposure.md` says *a mode of the command, not a new command, because a second
+command costs every surface a command touches*. The doctrine is older than the plan and
+it won.
+
+### `test/probe.py` — R-001's retirement condition, three years of releases late
+
+The standing instruction R-001 has said since 2026-08-03: *prove the plant landed in the
+text the check actually parses.* Its retirement condition, written at birth, was **"a
+probe harness exists that asserts the plant changed the parsed text"**. It was never
+built, and three probes failed in a single day for want of it.
+
+Three assertions per plant, and the third is the one hand-rolled probes keep missing:
+
+1. the substitution **landed** — `replace` matching nothing raises nothing;
+2. the exit code is **non-zero** — never a `FAIL` line on stdout;
+3. **the guard that fired is the guard under test**, named up front rather than
+   recognised afterwards. A plant that trips some *other* check has proved that other
+   check works.
+
+The harness self-tests its own failure branches (`npm run test:probe`), because a
+harness whose failure path has never executed is exactly what it exists to stop. **On its
+first use it caught two of this release's own guards being too loose** — one accepted any
+three reader states rather than requiring the load-bearing one, and one matched
+`none found` against a coincidental sentence in another paragraph.
+
+### The independent reader is now dispatched by a stage, and read by its output
+
+R-005 requires an independent reader on any change that adds or widens a check. Four pull
+requests of almost nothing but check work were opened in one day; the review app reported
+**`skipping`** on every one, and twenty-two guards merged on author probes alone. Nothing
+was violated. Nothing read the reviewer's output either.
+
+Stage 7 now dispatches the reader — a subagent it can watch, a bot whose **verdict** it
+then reads, or a person — and records exactly one of three states beside the gate:
+
+```
+reader: 6 findings, 4 confirmed
+reader: none found
+reader: NO READER — <why>
+```
+
+The third is printed, never omitted. *A reader was requested* and *a reader reported* are
+different facts that look identical in a transcript.
+
+### `learned.md` rule 22 — an operation that changed nothing reports like one that changed everything
+
+Four incidents in two programmes, each invisible until something downstream failed: an
+import that never landed, a doctrine phrase worded differently, a `gh` call refused behind
+`>/dev/null`, and a test piped to `head` so `$?` belonged to `head`. **Assert the effect,
+not the call.**
+
+### The retro's uncapped narrative stopped being read in full
+
+The doctrine said stage 0 reads three sections of `docs/superpowers/retro.md` in full
+because *"all three are bounded by construction, which is why the cap is not
+negotiable."* Measured, that claim was false:
+
+```
+Standing instructions   ~ 1 394 tok   capped at ten rows
+Run stamps              ~ 1 842 tok   one line per run
+Recent log              ~10 937 tok   narrative — capped by nothing   ← 74% of the file
+```
+
+An uncapped section inside a source that **binds** the run is precisely what makes the
+capped part get skimmed. The log is now **queried by the task's nouns**, like the
+archive; the instructions and the stamps are still read in full, because they are the
+part that is actually bounded.
+
+**Stage-0 reading floor: ~47 750 → ~36 950 tokens** from that one change.
+
+**And the audit that found this over-claimed in the same paragraph.** Its own table said
+`stages.md` was *"read in full at stage 0"*; grepping the obligation returns only the
+retro. The report now says *the gates a run must satisfy*, which is weaker and true.
+
+### The preflight now says what has not been measured
+
+It reported companion availability in careful detail and this skill's own evidence not at
+all — while `evals/RESULTS.md` recorded **one self-observed run by the author and zero
+blind runs on zero models**. A skill silent about its own evidence is read as tested, by
+the bundle that demands evidence of everyone else. The line prints while no blind run is
+recorded and disappears when one is; it is a state of the evidence, not a warning.
+
+The suite itself was frozen at the v1.9 feature set — **zero cases** touching the board,
+the verification ledger, the exposure line, the progress rail, `checkup`, `setup`,
+`copywriting` or `sheleg-design`. Now **21 cases**, including the two no-task modes,
+the three stage-3 tracks, the progress rail and run ledger, the dispatched reader, and a
+question that must **not** trigger the pipeline at all.
+
+Guards: 210 → **218**, property checks 8.
+
 ## v1.37.0 — the audit, and the four things it found the pipeline could not say
 
 One release, four modules, and an audit that put four questions to this pipeline and

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.37.0 |
+| **Version** | 1.38.0 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/evals/task-pipeline.evals.json

@@ -220,6 +220,93 @@
         "Does the work directly"
       ],
       "why": "The opt-out phrase is the release valve that makes default-on acceptable. If it does not work, the boundary is a trap rather than a default."
+    },
+    {
+      "id": "TRIG-05",
+      "category": "should_trigger",
+      "skills": [
+        "task-pipeline"
+      ],
+      "query": "что у нас накопилось непроверенного?",
+      "expected_behavior": [
+        "Recognises this as the checkup mode and runs `/task-pipeline checkup`",
+        "Does NOT open a grill, does not write a brief, and does not start a run",
+        "Reports the exposure line with its named components, the board's open rows by computed priority, the carry-over ledgers' unresolved count, and the graph's staleness",
+        "Never renders the exposure figure as a percentage or a probability"
+      ],
+      "why": "checkup exists precisely for the moment no task is running, and before v1.38.0 it was named in no browsable surface. If a model cannot reach it from a natural request, it may as well not ship."
+    },
+    {
+      "id": "TRIG-06",
+      "category": "should_trigger",
+      "skills": [
+        "task-pipeline"
+      ],
+      "query": "проверь документацию проекта перед тем как что-то строить",
+      "expected_behavior": [
+        "Recognises this as the setup mode and runs `/task-pipeline setup`",
+        "Runs the documentation passes and reports findings as file:line plus the minimal fix, ordered by seam",
+        "Hands back a fix plan rather than starting to fix things inline"
+      ],
+      "why": "The entry audit is the one mode that runs BEFORE building on existing docs. Same discoverability risk as checkup."
+    },
+    {
+      "id": "INSTR-05",
+      "category": "instruction_following",
+      "skills": [
+        "task-pipeline"
+      ],
+      "query": "run this through the pipeline: add CSV export to the reports page",
+      "expected_behavior": [
+        "Flags the task as user-facing and arms the stage-3 UX track",
+        "Names all THREE tracks at stage 3 — what it does (super-ux), how it sounds (copywriting, against the brand pack), how it looks (sheleg-design)",
+        "Where a track is declined, records the refusal out loud in the brief rather than skipping it silently",
+        "Does not write interface strings by taste with no mention of the copy track"
+      ],
+      "why": "copywriting appeared zero times in the bundle and sheleg-design once until v1.36.0. The failure this catches is silent: a flow gets designed and its strings get invented."
+    },
+    {
+      "id": "INSTR-06",
+      "category": "instruction_following",
+      "skills": [
+        "task-pipeline"
+      ],
+      "query": "run this through the pipeline: fix the retry backoff in the queue worker",
+      "expected_behavior": [
+        "Prints a progress header at task start naming the skill, the version, the topic and the stage rail",
+        "Derives the rail from the project's own pipeline config rather than assuming eleven stages",
+        "Prints a one-line progress update at each iteration close, citing a board id rather than a description",
+        "Seeds .task-pipeline/run.md at stage 0 and appends a stage verdict line when a gate returns"
+      ],
+      "why": "Before v1.34.0 nothing printed the run's position and the run ledger was written by no run at all, while the churn detector claimed its own detection was mechanical."
+    },
+    {
+      "id": "INSTR-07",
+      "category": "instruction_following",
+      "skills": [
+        "task-pipeline"
+      ],
+      "query": "run this through the pipeline: harden the auth middleware, and review it properly",
+      "expected_behavior": [
+        "Dispatches an independent reader at stage 7 rather than assuming a bot will read it",
+        "Records one of exactly three states beside the gate verdict: findings, none found, or NO READER with a reason",
+        "Stops reviewing at the declared round cap and prints new findings against self-inflicted ones per round, instead of looping",
+        "Never reports the review as done on the basis that a reader was requested"
+      ],
+      "why": "Four PRs of check work merged on a review app's `skipping` with nobody noticing. A requested reader and a reader that reported are different facts that look identical afterwards."
+    },
+    {
+      "id": "NOTRIG-05",
+      "category": "should_not_trigger",
+      "skills": [
+        "task-pipeline"
+      ],
+      "query": "какой командой у вас гоняются тесты?",
+      "expected_behavior": [
+        "Answers the question directly from the repo's own files",
+        "Does NOT invoke task-pipeline, does not open a grill and does not write a brief"
+      ],
+      "why": "Answering a question is on the skill's own not-for list. The description carries that boundary and nothing has ever measured whether a model honours it."
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.37.0",
+  "version": "1.38.0",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"
@@ -8,7 +8,8 @@
   "scripts": {
     "test": "python3 test/validate.py",
     "test:negatives": "python3 test/negatives.py",
-    "test:all": "python3 test/validate.py && python3 test/negatives.py"
+    "test:probe": "python3 test/probe.py --self-test",
+    "test:all": "python3 test/validate.py && python3 test/negatives.py && npm run test:probe"
   },
   "files": [
     "bin",

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
-  "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/manual gates, a frozen requirement spine that must close with evidence, a loop guard that breaks churn, one provider-agnostic model confirmed up front, and an optional super-ux UX track for user-facing work.",
-  "version": "1.37.0",
+  "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs). Retro insights can publish upstream as issues, opt-in and redacted.",
+  "version": "1.38.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/commands/task-pipeline.md

@@ -1,62 +1,173 @@
 ---
-description: Run a task through task-pipeline — an intake grill that expands the request, then docs → brainstorm → spec → plan → build → tests → deploy → post-deploy → docs/wiki → acceptance.
-argument-hint: "<one-line task description>"
+description: "Run a task through task-pipeline's gated stages (intake grill → docs → brainstorm → spec → plan → build → tests → deploy → post-deploy → docs/wiki → acceptance). Also: `setup` — audit the docs you already have; `checkup` — what has shipped unverified, with no task running."
+argument-hint: "<one-line task> | setup | checkup"
 ---
-Use the `task-pipeline` skill to run the task below through all gated stages —
-**stage 0 intake grill** → docs study → brainstorm → spec → plan → subagent
-build → tests → lint/deploy → post-deploy → docs/wiki → **acceptance**. **Every stage's doctrine is
-built into the skill** (`references/{knowledge-sources,knowledge-graph,grill,brainstorm,decomposition,spec,planning,build,review,tdd,acceptance,retrospective,loop-guard}.md`)
-— no companion plugin is required for any of them. **Stage 0 opens with the
-knowledge harvest, before the first question** (`references/knowledge-sources.md`):
-pull what the project already knows about this task from the code, **the code graph**
-if one is built ([graphify](https://github.com/Graphify-Labs/graphify) —
-`references/knowledge-graph.md`; recommended, never required; detect
-`graphify-out/graph.json`; it answers *reach* — what calls this, what breaks if it
-moves — which grep cannot), `CLAUDE.md`,
-`CONTEXT.md`/ADRs, `docs/` + `docs/ux/`, past pipeline briefs, **the retro's standing
-instructions** (`docs/superpowers/retro.md` — read in full, they bind this run;
-`references/retrospective.md`), the **knowledge wiki**
-if one is installed ([obsidian-wiki](https://github.com/ar9av/obsidian-wiki) —
-recommended, never required; detect `~/.obsidian-wiki/config`) and any **other repo
-or hosted doc system the project names as its docs**, then write the **source
-ledger** into the brief. The **intake grill is
-mandatory** (`references/grill.md`): interview the
-operator one question at a time (with a recommended answer each, exploring the
-codebase before asking) until every decision branch is resolved, **validating every
-answer against the harvested sources** — the operator outranks any document, but
-only out loud, and a doc the run proves stale is logged for the stage-9 update —
-applying the
-grill's **domain awareness** (challenge terms against `CONTEXT.md`, sharpen fuzzy
-language, ADRs for hard-to-reverse calls) and covering the **autonomy sweep** (what
-would otherwise stop stages 1→10: docs sources incl. doc repos, the wiki and the code graph, branch/tracker
-policy, test and lint commands, deploy target and authorization, log locations, docs/wiki/graph targets, and for UI tasks whether the design is done visually in Figma or text-only, whether the Figma MCP is connected, and — if it isn't — whether to ship text-only or stop and connect it, since the UX chain degrades on its own and never blocks; **and with Figma on, the design destination: which team/org by name and which file** — the recorded one, a URL the operator gives, or creation in that named team explicitly authorized, written into the project's canonical record before the first frame, because a destination decided at drawing time is how a project ends up with three design files and no way to tell which is real. **Never create while a recorded file resolves; if it doesn't resolve, stop and ask — never create a replacement**) —
-until the brief is locked — including the **REQ table**, the request as an addressable list where every row names how it is verified — so the rest runs autonomously and the final stage can account for all of it. The list is frozen: adding is free, removing needs the operator's agreement. Anything deferred goes into the carry-over ledger the moment it's said, and **the board** (`docs/superpowers/backlog.md`, `references/backlog.md`) — the work-list between runs — is read at stage 0 with its open count quoted in the brief, or seeded when absent; **the verification ledger** (`docs/superpowers/verification.md`, `references/verification.md`) is read at stage 0 for how many rows sit at `never`, written at stage 8 with one row per shipped REQ, and required at stage 10 in both directions. For any user-facing task, recommend/use
-**super-ux**. **If the brief describes a platform rather than a change**, stage 2 also cuts it into modules (`references/decomposition.md`) — module map committed, walking skeleton first, every REQ in exactly one module — and stages 3→10 then run per module, one brick at a time. **If any loop starts undoing an earlier pass** (same file edited twice for the same reason, a closed finding returning, a third entry into one stage), stop and run the loop guard (`references/loop-guard.md`): name both shapes, escalate to the layer that owns the conflict, re-plan the check as an ordered list, then go item by item. **The closing stage opens with the ladder walk** (`references/audit.md`): the REQ table finds what was named and lost, but a comparison needs two sides and an absence has one — so walk each REQ bottom-up through its rungs (decision → spec section → contract *and its failure behavior* → task → change → executed test → surface/docs), check the seam at each step, order findings by seam rather than by file, and turn every absence into a new REQ row **before** the coverage table is written. A green from a check nobody has watched fail against a planted defect is not evidence; a finding class seen twice becomes a script rather than a third ledger row; and every ledger row still `open`, `unresolved` or homed `backlog` leaves stage 10 with a board id and the board's priorities are re-derived (`references/backlog.md`); the carry-over ledger's counts are printed beside every gate verdict, so "green" never reads as "verified". If a searching pass starts finding mostly what the previous pass's own fixes broke, the axis is exhausted — rotate it, don't look harder. **The docs stage closes three artifacts, not two:** module docs, the wiki, **and the code graph** (`/graphify . --update` where `graphify-out/` exists — `references/knowledge-graph.md`), because the graph is what the next run's harvest queries first and a stale one is a false premise carrying the authority of a machine. Then check the graph against the docs: a hub `graphify god-nodes` reports that no document names is an undocumented seam; an edge the docs deny is a leak in the code or a lie in the docs; a doc naming a module the graph no longer has is stale. Doc-side findings are fixed there, absences become REQ rows in the closing stage. **In a project of several repositories, stage 10 closes on the parent too:** a parent records each submodule as a pointer to one commit, and moving the submodule does not move the pointer — so the work can be committed, pushed and green while a clone of the parent still gets the commit before it. Neither repo looks wrong alone, which is why it survives every check that runs inside one. Require `git submodule status` with no line starting `+`, and every repo clean and pushed (`git -C <repo> status --porcelain`, `git -C <repo> log @{u}..HEAD`). The fix is two commands and the second gets forgotten: push the submodule, then `git add <submodule> && git commit`. **The run's last act is the retrospective** (`references/retrospective.md` → `docs/superpowers/retro.md`, one file per project): **stamp the run first** (its commit is what makes the cold-retirement trigger computable), **then prune** — every standing instruction against its three retirement triggers (it became a check; the paths/commands it names are gone; it hasn't fired in five run stamps, or in sixty days — the calendar is the unit that still moves when the stamp counter has stopped), the list held to a hard cap of ten, every deletion logged as one line and never silent — then, only if the run diverged, write the entry: symptom with evidence, the stage it surfaced at, the stage that *owned* it, the root cause, the fix by grade (mechanical check > standing instruction > note that expires in two runs), and the check that catches it next time. Stage 0 reads those standing instructions in full, so the prune is a gate criterion, not a good intention: a rule nobody reads to the end is worse than no rule, because everyone believes it is covered. Honor every stage gate by its type (`auto` = verify yourself;
-`manual` = wait for explicit go). Confirm the **model once at preflight** —
-recommend the most capable one the environment offers, never a hardcoded id — then
-run the whole pipeline on it without re-asking.
+Run the task below through `task-pipeline`'s gated stages. **Every stage's doctrine
+ships inside the skill** — no companion plugin is required for any of it. The
+reference files are indexed in `SKILL.md`; this page is the run order, not the index.
 
 Task: $ARGUMENTS
 
-Idempotent entry — inspect state first, never restart blindly:
-- If a pipeline TaskList from a previous run already exists for this task,
-  **resume** from the first incomplete stage instead of starting over.
-- Otherwise, begin at stage 0 (intake grill). If no task is given above, the
-  grill's first question asks the operator for the task in one line.
-
-**`/task-pipeline checkup`** — **runs with no task in flight, and that is the point.**
-Accumulated unconfirmed work is invisible precisely because nobody is running a pipeline,
-so a check living only inside a run can never say *"stop, fourteen things are
-unconfirmed."* It takes no brief, opens no grill, and writes nothing on its own. Four
-sections, each read from a file this pipeline already keeps: the **exposure** line with
-its check-list oldest-first, the **board**'s open rows by computed priority, the
-carry-over ledgers' unresolved count, and the code graph's staleness where one exists.
+> **Two other modes.** `setup` audits the documentation this project already has;
+> `checkup` reports what has shipped without a person confirming it, with no task in
+> flight. Both are at the bottom of this page.
+
+**Idempotent entry — inspect state first, never restart blindly.** If a pipeline
+TaskList from a previous run exists for this task, **resume** from the first incomplete
+stage. Otherwise begin at stage 0. With no task given, the grill's first question asks
+for it in one line.
+
+---
+
+## Preflight — settle these once
+
+- **Model.** Recommend the most capable one the environment offers, never a hardcoded
+  id. Confirmed once, then the whole run uses it without re-asking.
+- **Companions.** Print the detection block once (`references/companion-skills.md`).
+  Absent ones state their fallback; none is a gate except the stage-3 UX track on a
+  user-facing task.
+
+## Stage 0 — the harvest, then the grill
+
+**The harvest runs before the first question** (`references/knowledge-sources.md`).
+Pull what the project already knows about *this task*:
+
+- the code, and **the code graph** where one is built — [graphify](https://github.com/Graphify-Labs/graphify),
+  `references/knowledge-graph.md`; recommended, never required; detect
+  `graphify-out/graph.json`. It answers **reach** — what calls this, what breaks if it
+  moves — which grep cannot.
+- `CLAUDE.md`, `CONTEXT.md`/ADRs, `docs/` + `docs/ux/`, past briefs and carry-over ledgers.
+- **the retro's standing instructions and run stamps** — `docs/superpowers/retro.md`,
+  read in full; both are bounded and they bind this run. Its **Recent log** is
+  *queried* by the task's nouns, not read: nothing caps it, and an uncapped section
+  inside a binding source is what makes the capped part get skimmed
+  (`references/retrospective.md`).
+- the **knowledge wiki** if installed ([obsidian-wiki](https://github.com/ar9av/obsidian-wiki);
+  detect `~/.obsidian-wiki/config`), and any other doc system the project names as its docs.
+- **the board** (`docs/superpowers/backlog.md`) — open count quoted in the brief, or
+  seeded when absent. **the verification ledger** (`docs/superpowers/verification.md`) —
+  how many rows sit at `never`.
+
+Write the **source ledger** into the brief: a row per source, or an explicit *none found*.
+
+**Then the grill, and it is mandatory** (`references/grill.md`). One question per turn,
+each with a recommended answer, exploring the codebase before asking, until every
+decision branch is resolved.
+
+- **Validate every answer against the harvested sources.** The operator outranks any
+  document — but only out loud, and a doc the run proves stale is logged for stage 9.
+- **Domain awareness:** challenge terms against `CONTEXT.md`, sharpen fuzzy language,
+  write an ADR for a hard-to-reverse call.
+- **The autonomy sweep** pre-resolves what would otherwise stop stages 1→10: doc
+  sources, wiki and graph, branch and tracker policy, test and lint commands, deploy
+  target and authorization, log locations.
+- **UI tasks add the design surface.** Is the design done visually in Figma or
+  text-only? Is the Figma MCP connected? If not — ship text-only, or stop and connect
+  it? The UX chain degrades on its own and never blocks, so this choice must be
+  recorded rather than discovered.
+- **With Figma on, the destination is named before the first frame:** which team/org,
+  which file — the recorded one, a URL the operator gives, or creation in that named
+  team explicitly authorized. A destination decided at drawing time is how a project
+  ends up with three design files and no way to tell which is real. **Never create
+  while a recorded file resolves; if it does not resolve, stop and ask — never create a
+  replacement.**
+
+**The brief closes on the REQ table** — the request as an addressable list where every
+row names how it is verified. Frozen: adding is free, removing needs the operator.
+Anything deferred enters the carry-over ledger the moment it is said.
+
+## Stages 1→10 — the flow
+
+| | Stage | The thing that must be true to leave it |
+|---|---|---|
+| 1 | Docs study | every contract the design will lock is grounded on fetched docs, not recall |
+| 2 | Brainstorm + decompose | the design is approved and every REQ is answered by it. **A platform is cut into modules** (`references/decomposition.md`) — map committed, walking skeleton first, every REQ in exactly one module; stages 3→10 then run per module |
+| 3 | Spec | contracts locked; user-facing work runs three tracks — what it **does** (super-ux), how it **sounds** (`copywriting`), how it **looks** (`sheleg-design`); a declined track is recorded, never silent |
+| 4 | Plan | the REQ set-comparison holds: brief REQs == union of `Implements:` |
+| 5 | Build | TDD per task, a review after each, findings fixed or parked with a ruling |
+| 6 | Tests | the **full** suite green; a web surface checked in a browser, not in the diff |
+| 7 | Lint + deploy | outward: the authorization is specific, and the CI verdict is **read** before any tag |
+| 8 | Post-deploy | the verification trio, not one of three; a verification row per shipped REQ |
+| 9 | Docs + wiki | **three artifacts, not two** — module docs, the wiki, **and the code graph** |
+| 10 | Acceptance | the ladder walk first, then the table, then the retrospective |
+
+**Honor every gate by its type**: `auto` — verify the check yourself; `manual` — wait
+for an explicit go.
+
+## Cross-cutting — the three that fire at any stage
+
+**The loop guard** (`references/loop-guard.md`). If a pass starts undoing an earlier one
+— the same file edited twice for the same reason, a closed finding returning, a third
+entry into one stage — stop editing. Name both shapes, escalate to the layer that owns
+the conflict, re-plan the check as an ordered list, then go item by item. The review
+loop has its own ceiling, and at it the run **measures** rather than stops.
+
+**The audit's exit** (`references/audit.md`). If a searching pass starts finding mostly
+what the previous pass's own fixes broke, the axis is exhausted — rotate it, do not look
+harder.
+
+**Evidence.** A green from a check nobody has watched fail against a planted defect is
+not evidence. A finding class seen twice becomes a script, not a third ledger row.
+
+## Stage 9 — the graph is the third artifact
+
+Refresh it (`/graphify . --update` where `graphify-out/` exists), then **check it against
+the docs**: a hub `graphify god-nodes` reports that no document names is an undocumented
+seam; an edge the docs deny is a leak in the code or a lie in the docs; a doc naming a
+module the graph no longer has is stale. Doc-side findings are fixed here; absences
+become REQ rows at stage 10.
+
+A stale graph is a false premise **carrying the authority of a machine** — a wrong doc
+gets argued with, a wrong graph gets believed.
+
+## Stage 10 — the close-out, in order
+
+1. **The ladder walk, first.** The REQ table finds what was named and lost; it cannot
+   find what was never named, because a comparison needs two sides and an absence has
+   one. Walk each REQ bottom-up — decision → spec section → contract *and its failure
+   behavior* → task → change → executed test → surface/docs — check the seam at each
+   step, and order findings **by seam, not by file**. Every absence becomes a new REQ
+   row **before** the coverage table is written.
+2. **The table**, one row per REQ, each with evidence.
+3. **The ledgers close.** Every carry-over row still `open`, `unresolved` or homed
+   `backlog` leaves with a board id, and the board's priorities are re-derived. The
+   counts print beside every gate verdict, so *green* never reads as *verified*.
+4. **Several repositories? The parent closes too.** A parent records each submodule as a
+   pointer to one commit, and moving the submodule does not move the pointer — so work
+   can be committed, pushed and green while a clone of the parent still gets the commit
+   before it. Neither repo looks wrong alone. Require `git submodule status` with no
+   line starting `+`, and every repo clean and pushed. The fix is two commands and the
+   second gets forgotten: push the submodule, **then** `git add <submodule> && git commit`.
+5. **The retrospective is the run's last act** (`references/retrospective.md`), in this
+   order: **stamp the run first** (its commit makes the cold trigger computable) → **prune**
+   every standing instruction against its three retirement triggers, list held to ten,
+   every deletion logged → **write an entry only if the run diverged**: symptom with
+   evidence, the stage it surfaced at, the stage that *owned* it, the root cause, the
+   fix by grade, and the check that catches it next time.
+
+Stage 0 reads those standing instructions in full next time, which is why the prune is a
+gate criterion rather than a good intention.
+
+---
+
+## `/task-pipeline checkup`
+
+**Runs with no task in flight, and that is the point.** Accumulated unconfirmed work is
+invisible precisely because nobody is running a pipeline, so a check living only inside a
+run can never say *"stop, fourteen things are unconfirmed."*
+
+It takes no brief, opens no grill, and writes nothing on its own. Four sections, each
+read from a file this pipeline already keeps: the **exposure** line with its check-list
+oldest-first, the **board**'s open rows by computed priority, the carry-over ledgers'
+unresolved count, and the code graph's staleness where one exists.
+
 Where you ask it to file what it found, it appends board rows whose `Source` names the
-checkup and its date — printing what it would add first, never silently. Doctrine:
-`references/exposure.md`.
-
-**`/task-pipeline setup`** — the entry audit instead of a feature. Runs seven passes
-over the documentation this project already has, reports findings as `file:line` + the
-minimal fix ordered by seam, and hands back a fix plan the pipeline can run. Offered
-once at stage 0 when the doc map is absent or stale; run it directly any time.
-Doctrine: `references/setup.md`.
+checkup and its date — printing what it would add first, never silently.
+Doctrine: `references/exposure.md`.
+
+## `/task-pipeline setup`
+
+**The entry audit instead of a feature.** Seven passes over the documentation this
+project already has, findings reported as `file:line` + the minimal fix ordered by seam,
+and a fix plan the pipeline can run. Offered once at stage 0 when the doc map is absent
+or stale; run it directly any time. Doctrine: `references/setup.md`.

package/plugins/task-pipeline/skills/task-pipeline/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: task-pipeline
-description: "Runs a substantial task through a full delivery pipeline: an intake grill that expands the request into a locked brief, then docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy check, docs/wiki sync and acceptance — gated stages whose doctrine ships inside this skill (no required companions). Use when work changes the repository — a feature, fix, refactor, migration, integration, rewrite, adoption or hardening; фича, фикс, рефактор, миграция, интеграция, доработать, починить, внедрить — or on 'run this through the pipeline' / 'прогони по конвейеру', 'the full cycle' / 'полный цикл', /task-pipeline. Not for: answering a question, explaining or reading code, a typo or a one-line edit — say 'без пайплайна' / 'quick' to opt out. The grill is mandatory and front-loads every decision, so stages 1→10 run without mid-flight questions; documentation is a deliverable with its own gate; recommends super-ux for user-facing work; confirms one model up front, never a hardcoded id."
+description: "Runs a substantial task through a full delivery pipeline: an intake grill that expands the request into a locked brief, then docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy check, docs/wiki sync and acceptance — gated stages whose doctrine ships inside this skill (no required companions). Use when work changes the repository — a feature, fix, refactor, migration, integration, rewrite, adoption or hardening; фича, фикс, рефактор, миграция, интеграция, доработать, починить, внедрить — or on 'run this through the pipeline' / 'прогони по конвейеру', 'the full cycle' / 'полный цикл', /task-pipeline. Two modes need no task at all: 'checkup' / 'чекап' reports what has shipped without a person confirming it and what to look at first; 'setup' audits the documentation a project already has. Not for: answering a question, explaining or reading code, a typo or a one-line edit — say 'без пайплайна' / 'quick' to opt out."
 license: MIT
 ---
 
@@ -119,10 +119,10 @@ question: pull what the project already knows about this task from the code, the
 ([`references/knowledge-graph.md`](references/knowledge-graph.md) — graphify;
 recommended, never required),
 `CLAUDE.md`, `CONTEXT.md`/ADRs, **the decision register**, `docs/` + `docs/ux/`,
-past pipeline briefs, **the retro's standing instructions, run stamps and recent
-log** — `docs/superpowers/retro.md`, read in full because they *bind* this run and
-are bounded by construction, while the archive under `docs/superpowers/retro/` is
-**queried** by the task's nouns
+past pipeline briefs, **the retro's standing instructions and run stamps** —
+`docs/superpowers/retro.md`, read in full because they *bind* this run and are
+bounded by construction (ten rows; one line per run), while its **recent log** and the
+archive under `docs/superpowers/retro/` are **queried** by the task's nouns
 ([`references/retrospective.md`](references/retrospective.md)) —
 the **knowledge wiki** if one is installed
 ([obsidian-wiki](https://github.com/ar9av/obsidian-wiki) — recommended, never

package/plugins/task-pipeline/skills/task-pipeline/references/companion-skills.md

@@ -122,6 +122,11 @@ Pipeline companions (stage doctrine is built in — nothing to install for it):
 🧠 Model for this run: recommended <top tier available>. You're on <current>.
    /model <id> to switch, or "keep current", or name per-stage overrides.
 
+⚠  This skill's own behaviour is unverified: evals/RESULTS.md records <N> blind
+   run(s) on <M> model(s). Its triggering and its stage compliance are authored,
+   not measured. Nothing here is blocked by that — you are told because a skill
+   that never says so is one you would assume had been tested.
+
 Install the ✗ items you want, answer the model line, then say "continue".
 ```
 
@@ -170,6 +175,13 @@ Rules:
   reserve ids before minting them. Absent → print the line **once**, continue, and
   **record the run as `ungated`** — never describe the project as protected
   ([`documentation.md`](documentation.md) → *Registers are shared state*).
+- **The behaviour line prints whenever `evals/RESULTS.md` records no blind run**, and
+  disappears the moment one is recorded — it is a state of the evidence, not a warning
+  and not a ratchet. This bundle asks every project it touches for evidence rather than
+  assertion, and until 2026-08-10 it made the opposite claim about itself by saying
+  nothing: **one self-observed run by the author, zero blind runs on zero models**, with
+  a preflight that reported companion availability in detail and its own confidence not
+  at all. A skill silent about its own evidence is read as tested.
 - **Never gate any stage on an install** except the stage-3 UX track on a UI task.
 - Optional tools missing → state the fallback, don't block.
 - Re-detect after the operator installs; don't assume.

package/plugins/task-pipeline/skills/task-pipeline/references/gates.md

@@ -272,6 +272,24 @@ one flipped a row whose cell was already empty, so nothing was planted. A silent
 check is a claim about two things, and the probe is the one to doubt first — prove
 your edit landed in the text the check actually parses.
 
+**Three assertions, and the third is the one hand-rolled probes keep missing.** A
+plant that trips some *other* check has proved that other check works. Three probes
+in one day passed that way: one removed 1 of 3 identical lines and left the shape
+intact; one decremented a number inside an **already-released** section; one deleted
+the shouted spelling of a phrase and left the lowercase one. Each landed somewhere
+real and demonstrated nothing about the guard it was written for. So:
+
+1. **the substitution landed** — `replace` matching nothing returns the string
+   unchanged and raises nothing;
+2. **the exit code is non-zero** — not a `FAIL` line on stdout;
+3. **the message that fired belongs to the guard under test** — named up front, not
+   recognised afterwards.
+
+`test/probe.py` does all three (`npm run test:probe` self-tests the harness, including
+its own failure branches, because a harness whose failure path has never executed is
+the thing it exists to stop). Declare the plant as `Plant(label, path, old, new,
+expect=<the guard's own words>)` rather than hand-rolling a fourth copy of the loop.
+
 **Record the probe.** One line per section, in the change that ships the check.
 Otherwise the next reader has to redo it to know whether it was ever done.
 

package/plugins/task-pipeline/skills/task-pipeline/references/knowledge-sources.md

@@ -64,15 +64,20 @@ Rules for the list:
 - **The wiki and the graph are optional; the harvest is not.** With no wiki, no
   graph and no doc repos, the harvest is sources 1 and 3–7 and takes two minutes.
   Skipping it is never the answer.
-- **Source 7 is read in full, not queried.** It is capped at ten instructions
-  precisely so that this is cheap, and it is the one source that *binds* the run
-  rather than informing it.
+- **Source 7 is read in full where it is bounded, and queried where it is not.** The
+  standing instructions (capped at ten) and the run stamps (one line each) are read;
+  the *Recent log* is queried by the task's nouns like the archive. Measured on the
+  file this doctrine was written for, the log was **74% of it** — and it is the one
+  section nothing caps. Source 7 is still the source that *binds* the run rather than
+  informing it; that is why the part which binds must stay cheap enough to read.
 
 ## The retro's standing instructions — an instruction source, not background
 
 `docs/superpowers/retro.md` ([`retrospective.md`](retrospective.md)) is the one
-harvested source that is **read in full rather than queried**: the standing
-instructions are capped at ten precisely so that this is cheap. They are what
+harvested source whose binding part is **read in full rather than queried**: the
+standing instructions are capped at ten precisely so that this is cheap, and the run
+stamps are one line each. Its narrative log is queried, not read — an uncapped section
+inside a source that binds is how the capped part stops being read. They are what
 previous runs of this pipeline got wrong *in this project* — the rules no check
 could decide — and they bind this run.
 

package/plugins/task-pipeline/skills/task-pipeline/references/learned.md

@@ -47,6 +47,7 @@ to be enforced and is not is the same failure as a gate that prints `FAIL` and e
 | 19 | **An empty measurement is a refused measurement** | any command run to establish a fact — a count, a probe, a query, a suite | assert the output is **non-empty and shaped as expected** before reading meaning into it; a command that printed nothing did not answer | the run quotes the output it read, not the conclusion it drew from silence |
 | 20 | **When a thing exists twice, ask which one is used — not whether they agree** | any artifact with a second copy: two build files, a vendored library, a schema and its mirror, doctrine in two documents | find the **consumer** and read what it names; the copies cannot answer this about themselves | the run names the file the build/test/deploy actually reads, quoted from the consumer |
 | 21 | **A step that consumes what a later step produces is a deadlock, not an ordering** | any sequence where a check reads state another step writes — a prune reading stamps, a gate reading a ledger, a report reading counts | trace each input to the step that writes it; if that step is downstream, the check has never run on real data | every check names the step that produces its input, and that step is upstream of it |
+| 22 | **An operation that changes nothing reports the same as one that changed everything** | a substitution whose needle is absent · a command whose output is suppressed at a decision point · an edit issued against a shape the file does not have | assert the effect, not the call: a replacement must report how many times it matched, and a command whose exit code governs the next step is never piped or silenced | four incidents in two programmes, each invisible until something downstream failed — an import that never landed, a doctrine phrase worded differently, a `gh` call refused behind `>/dev/null`, and a test piped to `head` so that `$?` belonged to `head` |
 
 ---
 
@@ -189,6 +190,7 @@ answer would have exposed it in a minute.
 | 0 Inventory · 9 Docs · any register write | 8 (compute), 14 (targets resolve — including every commit SHA in the retro), 15 (identity before a lease) — see [`documentation.md`](documentation.md) |
 | 0 Harvest · any run resuming from a summary | 16 — the work-list and every inherited state claim re-derived before use, [`knowledge-sources.md`](knowledge-sources.md) → *Carried-in claims* |
 | any check you write | 4, 5, 7, 10, 11 — the procedure is [`gates.md`](gates.md) |
+| **every stage** · any edit, any command whose result is read | 22 — a no-op is indistinguishable from success unless the effect is asserted; never suppress the output of a command a decision depends on |
 | 3 Spec · 4 Plan | 2 (both directions), 8 (compute, never restate) |
 | 5 Dev | 9 (generators seed green), 12 (tests create their own state), 13 (local infra) |
 | 6 Tests | 4, 5, 10, 11 — every new check probed both ways, measured, and asserted on its exit code |
@@ -264,7 +266,7 @@ evidence that something left, and the log below says what.
 
 ### Retired
 
-**Numbers issued so far: 21.** This is the high-water mark, and it is the only number
+**Numbers issued so far: 22.** This is the high-water mark, and it is the only number
 this file states about itself — deliberately, because the gap that proves a rule left
 cannot be computed from the table alone: **deleting the highest-numbered rule shrinks
 the maximum with it, and no gap ever opens.** That false negative shipped in the first

package/plugins/task-pipeline/skills/task-pipeline/references/retrospective.md

@@ -18,7 +18,8 @@ justifies reading it protects one section while the file below it doubles.
 
 | Artifact | Parts | How it is read |
 |---|---|---|
-| `docs/superpowers/retro.md` — **one per project** | **Standing instructions** (max **10**) · **Recent log** (entries from the last five run stamps) · **Run stamps** | stage 0, **in full** — all three are bounded by construction |
+| `docs/superpowers/retro.md` — **one per project** | **Standing instructions** (max **10**) · **Run stamps** (one line each) | stage 0, **in full** — both are bounded by construction |
+| the same file's **Recent log** | entries from the last five run stamps — narrative, and capped by nothing | stage 0, **queried** by the task's nouns. It said *in full* until 2026-08-10, when it measured **74%** of the file: an uncapped section inside a binding source is what makes the capped part get skimmed |
 | `docs/superpowers/retro/YYYY-QN.md` — the archive | every entry and every retirement ever written, append-only | **queried** by the task's nouns; never read end to end |
 
 Seed the archive from [`../templates/retro-archive.md`](../templates/retro-archive.md).

package/plugins/task-pipeline/skills/task-pipeline/references/review.md

@@ -16,6 +16,7 @@ install.
 - Reviewer inputs
 - Controller rules
 - The rubric
+- The independent reader — dispatched by a stage, and read by its output
 - Prompt — task review
 - Prompt — scoped re-review
 - Prompt — final whole-branch review
@@ -118,6 +119,61 @@ Review in this order; stop reading the diff only when you've covered all of it.
 Formatting nits that don't change meaning are not findings. Praise is not a
 finding either.
 
+## The independent reader — dispatched by a stage, and read by its output
+
+**One job: stop *"a reader was requested"* from standing in for *"a reader
+reported"*.** Those are different facts and they look identical in a transcript.
+
+The rule this implements has been a standing instruction since 2026-08-08: **a change
+that adds or widens a check gets an independent reader before merge**, because your own
+probes exercise only the shapes you already thought of. Its retirement condition, written
+at birth, was that the reader be *dispatched by a stage rather than by the repository
+happening to run a bot on pull requests*. This section is that stage.
+
+**It happened.** Four pull requests of almost nothing but check work were opened on one
+day; the review application reported **`skipping`** on every one, and twenty-two new
+guards merged with the author's own probes as their only reading. Nothing was violated.
+Nothing read the reviewer's output either.
+
+### Who counts as the reader, in order
+
+1. **A subagent this run dispatches** — the only option whose execution the run can
+   observe end to end. Give it the diff package, the rubric, and the sentence *"the
+   author wrote both the check and its probes; find what neither could see."*
+2. **A review bot on the pull request** — acceptable, and it is a **third party with no
+   contract**: it may skip, rate-limit, or answer about a stale commit. Read its
+   verdict, not the fact that it was triggered.
+3. **A person.**
+
+### The three states, and one of them is not silence
+
+Record exactly one, beside the gate verdict:
+
+```
+reader: 6 findings, 4 confirmed        — read, and it had something
+reader: none found                     — read, and it did not
+reader: NO READER — <why>              — nobody read it
+```
+
+**`NO READER` is a printed state, never an omission.** It carries the same law as
+`dormant` and `skip` ([`gates.md`](gates.md) → *Progressive arming*): a mechanism that
+prints nothing when it looked at nothing is indistinguishable from one that looked and
+found nothing. Where the change added or widened a check, `NO READER` is also carried
+into the close-out as an open requirement rather than a footnote — reporting a gap is
+honest and is not a fix.
+
+### What the reader is asked
+
+Not *"review this."* The dispatch names the blind spot it exists to cover:
+
+- the probes and the checks were written from **one model of the problem** — where does
+  that model not reach?
+- which shapes does the check's **scope** exclude, and is any of them shipped?
+- is there a form of the defect that has **no pair to compare** — a single cell, a lone
+  directive, an absence?
+
+Those three questions come from findings no author-written probe has ever produced here.
+
 ## Prompt — task review
 
 > You are reviewing one task of an implementation plan. Read, in order:

package/plugins/task-pipeline/skills/task-pipeline/references/stages.md

@@ -101,9 +101,11 @@ never that the work was skipped quietly.
   when one is built ([`knowledge-graph.md`](knowledge-graph.md): `graphify query` /
   `affected` / `god-nodes` answer *reach*, which is what grep cannot), `CLAUDE.md`,
   `CONTEXT.md`/ADRs, `docs/` + `docs/ux/`, past pipeline briefs and carry-over
-  ledgers, **the retro's standing instructions** (`docs/superpowers/retro.md`, read
-  **in full** — they are capped at ten and they bind this run; stamp each one as it
-  fires, [`retrospective.md`](retrospective.md)), the **knowledge wiki** if one is
+  ledgers, **the retro's standing instructions and run stamps** (`docs/superpowers/retro.md`,
+  read **in full** — ten rows and one line per run, both bounded, and they bind this
+  run; stamp each instruction as it fires. Its *Recent log* is **queried** by the
+  task's nouns, not read: uncapped narrative inside a binding source is what makes the
+  capped part get skimmed, [`retrospective.md`](retrospective.md)), the **knowledge wiki** if one is
   installed
   ([obsidian-wiki](https://github.com/ar9av/obsidian-wiki) — recommended,
   never required), and any **other repo or hosted doc system the project names as
@@ -456,6 +458,15 @@ never that the work was skipped quietly.
   tagging, the CI verdict for what was just pushed is READ, not assumed**
   ([`conventions.md`](conventions.md) → *The CI verdict*) — a tag on a commit whose
   run nobody read is how a red `main` ships.
+- **The independent reader is dispatched by this stage, and read by its output**
+  ([`review.md`](review.md) → *The independent reader*). On any change that adds or
+  widens a check, the run dispatches a reader — a subagent it can watch, a bot whose
+  **verdict** it then reads, or a person — and records exactly one of three states
+  beside the verdict: `reader: N findings`, `reader: none found`, or `reader: NO READER
+  — <why>`. The third is printed, never omitted; a requested reader and a reading are
+  different facts that look identical afterwards. Four pull requests of check work once
+  merged on a bot's `skipping` with nobody noticing, which is why this is a stage rather
+  than a hope.
 - **The review loop that lives here has a cap, and the cap is a measurement**
   ([`loop-guard.md`](loop-guard.md) → *The review loop*). **3 rounds** per artifact by
   default (`pipeline.json` → `run.review.maxRounds`); at the cap the run stops reviewing