task-pipeline-skill 1.60.1 → 1.62.0

package/CHANGELOG.md

@@ -1,5 +1,71 @@
 # Changelog
 
+## v1.62.0 — a board row that says work exists names where it lives
+
+**`open` claims nothing exists. `parked` claims something does — and now has to say
+where.** B-58: a row read as ready-to-merge for two days while its artifacts had already
+been deleted. It said *"built and parked … held at `scratchpad/b29-exposure/`"*, a
+session-scoped temp directory, and when a run finally went to land it nothing on disk, in
+git history, in a stash or in a dangling object held any of it. **A board cannot tell a
+claim about a filesystem from a claim about a repository**, and that row was the first
+kind while reading like the second.
+
+The status cell of a parked row now carries a branch or a commit, and two rules gate it:
+an open row may not home its work in a per-session directory, and a `parked` status
+without a ref is refused.
+
+**A prose detector was written first and thrown away.** Matching *"parked"*, *"is built"*,
+*"ready to merge"* in the description cell fired on **three rows out of 187 and every one
+was false** — two closed rows narrating this incident and the row that asked for the rule.
+A check whose every current hit is wrong teaches evasion; what ships reads the status
+cell, which is never prose, and both rules measured **zero** across 191 rows including the
+templates.
+
+The first draft of the guard read `cells[-2]`, which is the status in an eight-column
+board and the *Home* column in the ten-column template — so the parked rule examined the
+wrong cell and reported nothing, fifty lines below the comment explaining why positional
+reads fail on this corpus. It is position-free now, and the plant that was silently
+passing is the one that proved it.
+
+Guards: 347 → **349**. Property checks: 9 → 9.
+
+## v1.61.0 — the command that was built, parked, and lost
+
+**The exposure command lands, two days after it was declared built.** B-43 recorded
+`templates/exposure.sh` and its fixtures as finished and parked in a session scratchpad,
+blocked only on a concurrent release. The scratchpad was cleaned; nothing on disk, in git
+history, in a stash or in a dangling object held any of it. **The row described work that
+no longer existed**, and nothing would have said so until someone went to merge it.
+
+So it is rebuilt, and this time the validator asserts it: a seeded shell script must
+exist, must carry a shebang, and must still be named by the doctrine that tells a project
+to copy it. All three watched failing.
+
+`exposure.sh` turns [`verification.md`](plugins/task-pipeline/skills/task-pipeline/references/verification.md)
+into the line and the check-list `references/exposure.md` specifies, so a host project
+gets the number without an agent in the room. **It exits 0 whatever the number is** — a
+threshold here would be a target on `never`, and the cheapest way to satisfy such a
+target is a date nobody earned.
+
+Three of its fourteen fixtures caught real defects in the first draft, all of them lying
+in the reassuring direction:
+
+- `$(grep -c "" f || echo 0)` prints **two** zeroes when nothing matches — grep prints its
+  own 0 and exits 1, so the fallback runs as well. The variable became `"0\n0"`, every
+  numeric test after it died with *integer expression expected*, and the script fell over
+  precisely in the case that means "everything is confirmed".
+- BSD `sort` exits with *Illegal byte sequence* on the non-ASCII `What` column under a
+  UTF-8 locale. The error went to stderr, the check-list came out **empty**, and the
+  count above it still said 126 unverified. A list that silently empties is worse than no
+  list.
+- Byte-wise `substr` cut a Cyrillic letter in half. Truncation is by whole words now, which
+  cannot land inside a character.
+
+Guards: 344 → **347**. Property checks: 9 → 9. Three new plants: the seeded script
+disappearing, the doctrine that stops naming it, and a percentage reaching the exposure
+line — the last because the doctrine says *no percentage, ever*, and a later hand adding
+`(N%)` would be adding it to look helpful.
+
 ## v1.60.1 — the gate can see an invariant it breaks elsewhere
 
 **This gate can now see an invariant it breaks one repository away.** The family umbrella

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.60.1 |
+| **Version** | 1.62.0 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki, and **one of two browser channels** — `playwright` (CLI or MCP) or `chrome-devtools` (MCP); either satisfies the browser step and neither is required. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.60.1",
+  "version": "1.62.0",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs). Retro insights can publish upstream as issues, opt-in and redacted.",
-  "version": "1.60.1",
+  "version": "1.62.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/skills/task-pipeline/references/adoption.md

@@ -82,7 +82,8 @@ Usually the map and the gate; often the register already exists in some shape.
 ```bash
 cp <skill>/templates/docmap.md   docs/DOCMAP.md          # only if absent
 cp <skill>/templates/docgate.sh  scripts/check-docs.sh   # only if absent
-chmod +x scripts/check-docs.sh
+cp <skill>/templates/exposure.sh scripts/exposure.sh     # only if absent
+chmod +x scripts/check-docs.sh scripts/exposure.sh
 ```
 
 **Seeding never overwrites.** An existing brief, register or map is the project's

package/plugins/task-pipeline/skills/task-pipeline/references/backlog.md

@@ -18,6 +18,7 @@ exactly one seam, and that seam already existed as a dangling pointer.
 
 - The seam the ledger left open
 - Seeded or picked up
+- A row that says work exists names where it lives
 - Priority is computed, not assigned
 - What a loop iteration does with it
 - Rationalizations
@@ -60,6 +61,42 @@ work on, and only one of them can be appended to.
 at the top of the run, not from what the last run's report said — the previous run is
 precisely what invalidated that number ([`learned.md`](learned.md) rule 16).
 
+## A row that says work exists names where it lives
+
+**`open` claims nothing exists yet. `parked` claims something does — and then has to say
+where.** The status cell of a parked row carries a branch or a commit:
+
+```
+| B-043 | The exposure command … | 2026-08-14 run | 1 | 0 | 1 | 1.0 | parked — feat/exposure |
+| B-044 | The migration script … | 2026-08-15 run | 2 | 0 | 2 | 1.5 | parked — a1b2c3d |
+```
+
+The rule exists because a row read as ready-to-merge for two days while its artifacts had
+already been deleted. It said *"built and parked … held at `scratchpad/b29-exposure/`"* —
+a session-scoped temp directory. When a run finally went to land it, nothing on disk, in
+git history, in a stash or in a dangling object held any of it. **A board cannot tell a
+claim about a filesystem from a claim about a repository**, and that row was the first
+kind while reading like the second.
+
+So:
+
+- **A scratchpad, `/tmp`, or any per-session directory is not a home.** Work that lives
+  only there is not parked, it is unwritten — say `open` and describe what is wanted, not
+  what supposedly exists.
+- **Uncommitted work in a working tree is not parked either.** Another agent's checkout,
+  a stash, an unpushed branch on one machine: none of them survives the question *"can
+  somebody else pick this up?"*, which is the only question the board is answering.
+- **The ref is checkable and that is the point.** `git rev-parse` either resolves it or it
+  does not, so a row that has quietly expired can be found before somebody plans around
+  it.
+
+**A prose detector was tried first and discarded.** Matching *"parked"*, *"is built"*,
+*"ready to merge"* in the description cell fired on **three rows out of 187 and all three
+were false** — two closed rows narrating this very incident and the row that asked for
+this rule. A check whose every current hit is wrong teaches evasion, and this repository
+throws that shape away rather than tuning it. What is gated is the **status cell**, which
+is never prose.
+
 ## Priority is computed, not assigned
 
 ```

package/plugins/task-pipeline/skills/task-pipeline/references/exposure.md

@@ -15,6 +15,7 @@ list `/task-pipeline checkup` hands an operator.
 - The components, each named
 - The check-list, and how it is ordered
 - `/task-pipeline checkup`
+- The seeded script
 - What the loop does with it
 - Rationalizations
 
@@ -89,6 +90,29 @@ ledgers' unresolved count, and the code graph's staleness where one exists.
 names the checkup and its date — so a row a machine created is distinguishable from one a
 run surfaced. It prints what it would add first. Never silently.
 
+## The seeded script
+
+[`../templates/exposure.sh`](../templates/exposure.sh) computes the line and the
+check-list from the two files above, so a project gets the number without an agent in the
+room. Seed it the way the gate is seeded:
+
+```bash
+cp <skill>/templates/exposure.sh  scripts/exposure.sh    # only if absent
+chmod +x scripts/exposure.sh
+```
+
+**It exits 0 whatever the number is, and that is load-bearing.** A threshold here would
+be a target on `never`, and this file has already said that column may never have one —
+the moment *"unverified must be under ten"* exists, the cheapest way to satisfy it is a
+date nobody earned. Exit 1 means the ledger is present and unreadable, which is a
+different fact and deserves a different code.
+
+Two of its behaviours exist because the alternative lies in the reassuring direction. A
+project with no ledger prints `dormant:` rather than a clean zero, and a check-list that
+cannot be built is a failure rather than an empty section under a non-zero count — the
+first draft's `sort` died on a non-ASCII `What` column, printed its error to stderr, and
+left a confident number above nothing at all.
+
 ## What the loop does with it
 
 [`continuity.md`](continuity.md) has always required each iteration to re-measure the

package/plugins/task-pipeline/skills/task-pipeline/templates/README.md

@@ -20,6 +20,7 @@ from `super-ux`.
 | `decisions.md` | `docs/DECISIONS.md` — the decision register | 0 seeds it, the Doc Loop appends |
 | `open-questions.md` | `docs/OPEN_QUESTIONS.md` | 0 seeds it, the Doc Loop resolves rows |
 | `docgate.sh` | `scripts/check-docs.sh` | 0 seeds it · 9 runs it · 10 proves it |
+| `exposure.sh` | `scripts/exposure.sh` | 0 reads it · 10 recomputes it · `checkup` prints it |
 | `hygiene.sh` | `scripts/check-hygiene.sh` | 0 seeds it · **5 runs it after every task** · 6 and 9 run it · 10 proves it |
 | `stage-coverage.sh` | `scripts/stage-coverage.sh` | 0 seeds it · **10 runs it before the coverage table** — every stage the flow declares must carry a verdict, or the flow stops declaring one it merges |
 | `hooks.example.json` | the project's `.claude/settings.json` | 0 — offered, never installed silently |

package/plugins/task-pipeline/skills/task-pipeline/templates/backlog.md

@@ -14,6 +14,7 @@
 | B-001 | `export.ts` has no size guard on the write path | `2026-07-28-export` / 5 Review | S | 2 | 1 | 12 | **2** | open | — |
 | B-002 | XLSX export path | `2026-07-28-export` / 5 Dev | M | 1 | 2 | 12 | 2 | open | LIN-483 |
 | B-003 | REQ-007 bulk export | `2026-07-28-export` / 2 Brainstorm | L | 1 | 1 | 12 | 1 | dropped | operator 2026-07-28 |
+| B-004 | Retry/backoff on the upload path | `2026-07-28-export` / 5 Dev | M | 2 | 2 | 4 | **4** | parked — feat/upload-retry | — |
 
 ## Columns
 

package/plugins/task-pipeline/skills/task-pipeline/templates/exposure.sh

@@ -0,0 +1,187 @@
+#!/usr/bin/env bash
+# exposure.sh — how much unverified work has piled up in <project>, and what to look at.
+#
+# Seeded by task-pipeline (references/exposure.md). IT IS YOURS NOW.
+#
+# SCOPE: reads the verification ledger and the git tag list. It does NOT know whether a
+#   confirmation was any good, whether a `pass` in the Auto column was watched failing,
+#   or anything about code. Read this header before quoting a number from here.
+#
+# IT IS A MEASUREMENT, NOT A GATE, AND THAT IS LOAD-BEARING. It exits 0 whatever the
+#   number is. A threshold here would be a target on `never`, and the ledger's own
+#   doctrine says that column may never have one — the moment "unverified must be under
+#   ten" exists, the cheapest way to satisfy it is to write a date nobody earned.
+#   Exit 1 is reserved for "the ledger is here and I could not read it".
+#
+# NO PERCENTAGE, EVER. The request that produced this asked for "the probability of an
+#   error". That is not computable from these inputs, and a number wearing a
+#   measurement's clothes is the failure this whole pipeline exists to remove. What
+#   prints is a vector with its components named, and a guard below refuses a `%`.
+#
+# PORTABLE to macOS bash 3.2: no grep -P, no readarray, no mapfile, no date -d.
+#
+# DORMANT, NOT SILENT: a project with no ledger yet prints why and exits 0. Dormant is
+#   visible so it is not forgotten, and green so a freshly seeded project is not red.
+
+set -u
+
+DOCS_DIR=${DOCS_DIR:-docs}
+# The artifact root is RESOLVED, not assumed — renamed `superpowers` → `evidence` on
+# 2026-08-13, and every gate that hardcoded the old name went dormant in migrated
+# projects, which reads exactly like having nothing to check.
+if [ -z "${EVIDENCE_DIR:-}" ]; then
+  if [ -d "$DOCS_DIR/evidence" ]; then EVIDENCE_DIR="$DOCS_DIR/evidence"
+  elif [ -d "$DOCS_DIR/superpowers" ]; then EVIDENCE_DIR="$DOCS_DIR/superpowers"
+  else EVIDENCE_DIR="$DOCS_DIR/evidence"
+  fi
+fi
+LEDGER=${LEDGER:-$EVIDENCE_DIR/verification.md}
+BOARD=${BOARD:-$EVIDENCE_DIR/backlog.md}
+LIST_MAX=${LIST_MAX:-8}
+
+if [ ! -f "$LEDGER" ]; then
+  echo "dormant: exposure — no $LEDGER yet, so nothing has been shipped-and-unconfirmed"
+  exit 0
+fi
+
+TMP=$(mktemp -d 2>/dev/null || mktemp -d -t exposure)
+trap 'rm -rf "$TMP"' EXIT
+
+# ---------- the ledger's rows ----------
+# A row is a table line whose first cell is a REQ id. The header and the |---| separator
+# are excluded by that shape rather than by counting lines, because a ledger grows
+# sections and a line offset stops being true on the first one added.
+awk -F'|' '
+  NF >= 7 && $2 ~ /^[[:space:]]*[A-Za-z][A-Za-z0-9-]*-?[0-9]*[[:space:]]*$/ &&
+  $2 !~ /^[[:space:]]*REQ[[:space:]]*$/ { print }
+' "$LEDGER" > "$TMP/rows" 2>/dev/null
+
+# `$(grep -c … || echo 0)` prints TWO zeroes when there are no matches: grep prints its
+# 0 and exits 1, so the fallback runs too and the variable becomes "0\n0" — which then
+# fails `[ "$ROWS" -eq 0 ]` with *integer expression expected* and takes the rest of the
+# script with it. The fallback belongs OUTSIDE the substitution.
+ROWS=$(grep -c '' "$TMP/rows" 2>/dev/null) || ROWS=0
+if [ "$ROWS" -eq 0 ]; then
+  echo "dormant: exposure — $LEDGER has no REQ rows yet"
+  exit 0
+fi
+
+# Column order is the template's: REQ | What | Run | Shipped in | Auto | Human | Note.
+# With awk -F'|' on a leading-pipe line those are $2..$8.
+
+awk -F'|' '{ h=$7; gsub(/^[ \t]+|[ \t]+$/, "", h); if (h == "never") print }' \
+  "$TMP/rows" > "$TMP/unverified"
+UNVERIFIED=$(grep -c '' "$TMP/unverified" 2>/dev/null) || UNVERIFIED=0
+
+# ---------- since: a date, or the literal `never checked` ----------
+# ZERO WOULD BE A LIE IN THE DANGEROUS DIRECTION. "0 days" reads as *checked today*,
+# which is the exact opposite of "nobody has ever looked", so the two cases print
+# different words rather than different numbers.
+awk -F'|' '{ h=$7; gsub(/^[ \t]+|[ \t]+$/, "", h);
+             if (h ~ /^[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]$/) print h }' \
+  "$TMP/rows" | sort > "$TMP/dates"
+NEWEST=$(tail -1 "$TMP/dates" 2>/dev/null)
+
+if [ -z "$NEWEST" ]; then
+  SINCE="never checked"
+else
+  # Portable day arithmetic: BSD date and GNU date disagree on every flag that matters,
+  # so ask python, which both platforms have and which will not silently return today.
+  DAYS=$(python3 - "$NEWEST" <<'PY' 2>/dev/null
+import datetime, sys
+try:
+    d = datetime.date.fromisoformat(sys.argv[1])
+except ValueError:
+    sys.exit(1)
+print((datetime.date.today() - d).days)
+PY
+)
+  if [ -z "${DAYS:-}" ]; then
+    echo "FAIL: exposure — $LEDGER has a Human date this script cannot parse: $NEWEST"
+    exit 1
+  fi
+  SINCE="$DAYS days since the last human confirmation"
+fi
+
+# ---------- releases: what has gone out on top of it ----------
+# Tags, not commits: a release is what an operator feels. Counted since the newest
+# confirmation date where there is one, and over the whole tag list where there is not —
+# because "no release has ever followed a confirmation" and "no confirmation exists" are
+# the same fact from two directions.
+if git rev-parse --is-inside-work-tree >/dev/null 2>&1; then
+  if [ -z "$NEWEST" ]; then
+    RELEASES=$(git tag --list 'v*' 2>/dev/null | grep -c '') || RELEASES=0
+  else
+    RELEASES=$(git log --tags --simplify-by-decoration --since="$NEWEST" \
+                 --pretty='%d' 2>/dev/null | grep -o 'tag: v[0-9][^,)]*' | sort -u | grep -c '') || RELEASES=0
+  fi
+else
+  RELEASES="?"
+fi
+
+LINE="exposure: $UNVERIFIED unverified · $SINCE · $RELEASES releases carry one"
+
+# ---------- the guard the doctrine names ----------
+# Not decoration: a later hand adding "(N%)" here is exactly how the estimate-wearing-a-
+# measurement's-clothes returns, and it would return looking helpful.
+case "$LINE" in
+  *%*) echo "FAIL: exposure — the line contains a percentage: $LINE"
+       echo "      references/exposure.md: no percentage, ever. A single score invites a"
+       echo "      threshold, and a threshold here is a target on \`never\`."
+       exit 1 ;;
+esac
+
+echo "$LINE"
+
+# ---------- the check-list: a number without it says there is a problem, not where ----------
+if [ "$UNVERIFIED" -eq 0 ]; then
+  echo "         every shipped row carries a human confirmation"
+  exit 0
+fi
+
+# Oldest first by `Shipped in`, which is the only ordering this repository can defend.
+# Version sort, so v1.9.0 precedes v1.10.0 — a lexical sort puts the newer one first and
+# hands the operator the wrong end of the list.
+awk -F'|' '{ req=$2; ship=$5; what=$3;
+             gsub(/^[ \t]+|[ \t]+$/, "", req);
+             gsub(/^[ \t]+|[ \t]+$/, "", ship);
+             gsub(/^[ \t]+|[ \t]+$/, "", what);
+             # Truncated on a WORD boundary, never mid-character: awk counts bytes
+             # here, so `substr(what, 1, 56)` cut a Cyrillic letter in half and printed
+             # a replacement glyph. Appending whole words cannot land inside one.
+             short = ""; n = split(what, w, " ");
+             for (i = 1; i <= n; i++) {
+               if (length(short) + length(w[i]) + 1 > 56) break;
+               short = (short == "" ? w[i] : short " " w[i]);
+             }
+             if (short == "") short = substr(what, 1, 20);
+             printf "%s\t%s\t%s\n", ship, req, short }' \
+  "$TMP/unverified" | LC_ALL=C sort -t"$(printf '\t')" -k1,1V > "$TMP/sorted"
+# LC_ALL=C, and not for speed: the `What` column carries em-dashes and Cyrillic, and BSD
+# sort exits with `Illegal byte sequence` on them under a UTF-8 locale — printing the
+# error to stderr, producing an EMPTY list, and leaving the exposure line above it
+# looking perfectly fine. A check-list that silently becomes empty is worse than no
+# check-list, because the number above it still says there is work.
+# The delimiter is a literal tab: the first draft said `-t.` and version-sorted on
+# nothing.
+
+echo "         oldest first, by the release that shipped it:"
+head -"$LIST_MAX" "$TMP/sorted" | while IFS="$(printf '\t')" read -r ship req what; do
+  # Blast radius from the board where it carries a row, reusing its stated input rather
+  # than inventing a weight here. Absent is printed as absent, never as a default.
+  blast=""
+  if [ -f "$BOARD" ]; then
+    blast=$(grep -m1 "| $req |" "$BOARD" 2>/dev/null | awk -F'|' '{ b=$5; gsub(/^[ \t]+|[ \t]+$/, "", b); print b }')
+  fi
+  if [ -n "$blast" ]; then
+    printf '           %-10s %-12s %s  [blast %s]\n' "$ship" "$req" "$what" "$blast"
+  else
+    printf '           %-10s %-12s %s\n' "$ship" "$req" "$what"
+  fi
+done
+
+REST=$((UNVERIFIED - LIST_MAX))
+if [ "$REST" -gt 0 ]; then
+  echo "           … and $REST more — the full list is \`/task-pipeline checkup\`"
+fi
+exit 0