task-pipeline-skill 1.47.0 → 1.47.1

package/CHANGELOG.md

@@ -1,5 +1,46 @@
 # Changelog
 
+## v1.47.1 — the fixes a reader found, which three releases shipped without
+
+v1.46.0 was tagged and published from a commit that carried this branch's doctrine and
+none of the three commits answering the reviewer. The defects below were already found
+and already fixed when the release went out; this is them arriving.
+
+**`docs/DOCMAP.md` forbade the register shipping beside it.** It said, in as many words,
+that no `docs/DECISIONS.md` is created here deliberately — and the release shipped that
+file. The old rule was right about the risk and wrong about the mechanism: `OQ-####`
+closes with `Resolved→DEC-####`, and a CHANGELOG version heading cannot be that target,
+because two decisions in one release collapse to a single pointer. SSOT is kept by
+direction now — the reason lives in `DECISIONS.md`, the CHANGELOG points at the id. The
+reversal is `DEC-0003`, because a register that appears without a decision is exactly
+the fork the old rule feared.
+
+**`HOW-IT-WORKS.md` called itself the version it was written under.** Its first line
+promises a rewrite every release and names the banner as the freshness signal; the
+banner read 1.45.0 while every other surface read 1.46.0. Corrected, and the two
+releases that landed from another session are named for what they were, so the gap in
+the version history is explained rather than silent.
+
+**An absolute rule keeps every keyword while an appended clause reverses it.** This
+release found that class, guarded it on stage 10's criterion 13, and left `residue.md`'s
+two absolute rules on plain substring presence — *"never released by this run, unless it
+has clearly expired"* passed. Sweeping the fix to its siblings then produced the reason
+to sweep it structurally: the second copy of the carve-out pattern had its escaping
+doubled, so it matched a literal backslash and walked past every inversion while looking
+correct. One home now — `_EXCEPTION_MARKER` and the `_carve_out` helper that reads it —
+with two call sites.
+
+**A probe demanded a dependency the harness disclaims.** `res8` required PyYAML to be
+installed; the guard it tests degrades honestly without it. `test:all` was red on any
+machine lacking it. Three branches now: the guard fired, the guard said it could not
+look, or neither — and only the third is an error.
+
+Also: the owner-row check went through `_row_cells` instead of a hand-rolled regex, as
+that helper's own docstring asks; and a reflow that fixed a 157-character line had
+orphaned two words onto a five-character one.
+
+Guards: 291 → **294**.
+
 ## v1.47.0 — a green suite that cannot speak for an agent
 
 The suite gate at stage 6 assumes the thing under test is deterministic: run it twice,

package/HOW-IT-WORKS.md

@@ -5,7 +5,7 @@ explains the machine — what routes a request into it, what each stage refuses
 let past, and what makes any claim it prints believable. The README sells it and
 tells you how to install it; this file tells you how it thinks.
 
-> **Version 1.45.0.** The "What changed" section at the bottom carries the last
+> **Version 1.47.1.** The "What changed" section at the bottom carries the last
 > few releases. Everything above it describes the pipeline as it is *now*, not as
 > it was designed.
 
@@ -238,7 +238,7 @@ This is the part most pipelines skip, and it is the reason this one is trustwort
 rather than merely tidy.
 
 **Every guard is proven against a planted defect.** `npm run test:all` breaks the
-thing each of the **291** checks is about, and requires that check to reject it. A
+thing each of the **294** checks is about, and requires that check to reject it. A
 guard that has never been watched failing is not a guard; it is a comment.
 
 **The neighbour probe.** A check has a *subject* — the rule it is about — and
@@ -291,7 +291,28 @@ a run diverges  →  retro entry  →  retro.publish  →  upstream issue
 
 ## What changed, by version
 
-### v1.45.0 — what a run leaves running, what "done" costs to say, what a check is for
+### v1.47.1 — the fixes a reader found, which three releases shipped without
+Three releases went out from another session while this branch was reviewed, and
+each carried the same defects forward: the doc map forbidding the decisions register
+shipping beside it, this file naming a version two releases stale, two absolute rules
+invertible by an appended clause, a probe demanding PyYAML the harness disclaims, and
+a probe that stopped reproducing its own hazard when its target string was quoted —
+which leaves `main`'s own suite red. Every one was found and fixed before the first
+of those releases; this is them arriving.
+
+### v1.47.0 / v1.46.0 — shipped from another session
+A green suite that cannot speak for an agent; and this branch's residue, completion
+honesty, proportionate verification and improvement-iteration doctrine, which reached
+main through the merge commit rather than through this branch's own release.
+
+v1.46.0 was tagged from a commit carrying this branch's doctrine and none of the
+three commits answering its reviewer. The doc map forbade the decisions register
+shipping beside it; this file called itself the version it was written under; two
+absolute rules were guarded by substring alone and inverted by an appended clause;
+and a probe demanded PyYAML the harness disclaims. All four were found and fixed
+before the release went out, and arrived after it.
+
+### v1.46.0 — what a run leaves running, what "done" costs to say, what a check is for
 Four rules the pipeline had been following by disposition rather than by doctrine.
 **Residue**: eight classes of thing a run leaves running or leaves behind, enumerated
 by class and never by one tool — the case that produced it was a task inventory
@@ -304,6 +325,12 @@ the deliverable is the working result and the check is how you know — scaled t
 issue resolves when behaviour changed and its close names the address; unworked ones
 accumulate visibly rather than being triaged into silence. Guards: 275 → 291.
 
+### v1.45.1 / v1.45.0 — shipped from another session while this branch was paused
+The reference routing existed three times over and was cut to one home; the guard
+count the self-test plants into was restored. Neither is this branch's work — they
+are here because they hold the version numbers this branch was originally built
+under, which is why it ships as 1.46.0.
+
 ### v1.44.0 — six lessons from other projects, and the guards that hold them
 Six issues published by runs in other repositories were worked into doctrine:
 seam testing at stage 6, `verified by` names that must resolve, a probe's green

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.47.0 |
+| **Version** | 1.47.1 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.47.0",
+  "version": "1.47.1",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs). Retro insights can publish upstream as issues, opt-in and redacted.",
-  "version": "1.47.0",
+  "version": "1.47.1",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"