task-pipeline-skill 1.62.0 → 1.64.0

package/CHANGELOG.md

@@ -1,5 +1,75 @@
 # Changelog
 
+## v1.64.0 — the exposure line reported a clean bill on ledgers it could not read
+
+**The exposure command reported a clean bill on ledgers it could not read.** Shipped two
+releases ago keyed on POSITION — `NF >= 7`, status in field 7. Run against the family
+umbrella's four-column ledger it found **four rows out of 298**, because those four happen
+to contain a `|` inside inline code and so crossed the field count by accident, and from
+them printed:
+
+```
+exposure: 0 unverified · never checked · 125 releases carry one
+         every shipped row carries a human confirmation
+```
+
+The most reassuring sentence available, derived from punctuation, in the one tool whose
+stated purpose is to stop silent greens. Its own two halves contradict each other and the
+fixtures did not notice.
+
+**The status column is now found by name, per section, and the order matters.**
+`sheleg-design` carries both `Last verified` (a date and the thing watched) and `Status`
+(which holds `**green**`); preferring `status` read the gate instead of the person and
+reported 174 confirmations. Preference is `Human`, then `Last verified`, then
+`Status`/`State`. **`Verified by`, `Confirmed` and `How it is checked` are deliberately not
+status names** — five members hold shell commands under those headers, and a column of
+commands read as a column of statuses is how `python3 test/validate.py` became a status
+nobody could parse.
+
+Three further corrections, each of which was hiding a real row:
+
+- **Bold is stripped before matching.** These ledgers write `**never**`, not `never`.
+- **A shrug is not a clean bill.** A status that is neither a date nor a known word gets
+  its own count and its own list, and no clean bill prints over it.
+- **Only a `Human` column licenses the word "human".** The umbrella's ledger defines
+  `verified` as *a person **or** a command*, so a confirmation drawn from `Status` now says
+  which column it came from.
+
+Measured across the family afterwards: `task-pipeline` **126 unverified**, `sheleg-design`
+1, and `seo-aeo-audit`, `super-ux` and `agent-sync` **dormant — no status column at all**,
+which is the truth their shapes support and not a zero.
+
+Fixtures 14 → **18**, the four new ones named for the exact silent green.
+
+Guards: 349 → **349**. No new plant: every one of these is a behaviour of the seeded
+script, which the fixtures exercise directly by running it.
+
+## v1.63.0 — the row you are about to work is a claim, and it has a date
+
+**A board row states the world at its `Source` date and says nothing about now.** Three
+rows expired inside one day on 2026-08-16 — one recorded a script and thirteen green
+fixtures as *built and parked* when every artifact had been deleted, one named six files
+belonging to another repository where a sweep found eleven, one said the graphs were
+frozen at a date nine days old when every one had been rebuilt. None was wrong when
+written. Each was caught only because the cycle that picked it up happened to measure
+first; nothing required it.
+
+`references/knowledge-sources.md` gains the rule beside *Carried-in claims*, which covers
+the sibling case of what a run inherits about itself: **re-derive the row's checkable
+claims before acting on them, and correct the row in the same run.** Most name something a
+command settles — a file, a count, a commit, a version, a green suite. What no command can
+settle is acted on as an assumption, out loud.
+
+It also names the sharper half, which is arithmetic rather than prose: **a row's derived
+columns decay and nothing notices, because the number still looks like a number.** A rank
+computed from an age term is wrong the moment the age moves. If a board computes a
+priority, something must recompute it — a promise in the header that it happens at stage 10
+is not a mechanism.
+
+Guards: 349 → **349**. No new plant, and the reason is measured rather than asserted:
+across the seven open rows the family carries, the checkable claims total **two file paths
+and one count**. A gate over that corpus would pass everything and read like coverage.
+
 ## v1.62.0 — a board row that says work exists names where it lives
 
 **`open` claims nothing exists. `parked` claims something does — and now has to say

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.62.0 |
+| **Version** | 1.64.0 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki, and **one of two browser channels** — `playwright` (CLI or MCP) or `chrome-devtools` (MCP); either satisfies the browser step and neither is required. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.62.0",
+  "version": "1.64.0",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs). Retro insights can publish upstream as issues, opt-in and redacted.",
-  "version": "1.62.0",
+  "version": "1.64.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/skills/task-pipeline/references/knowledge-sources.md

@@ -18,6 +18,7 @@ that goes stale when the answer changes.
 - How to harvest — retrieval, not reading
 - Record it — the source ledger
 - The harvest is a convergence, so it needs a check across its sources
+- The row you are about to work is a claim, and it has a date
 - The source is not the copy you have
 - Carried-in claims — measured or recalled
 - Phase 2 — validate the answers against the harvest
@@ -210,6 +211,36 @@ a check whose silence is indistinguishable from not having run is not evidence.
 found here is a stage-9 obligation — the ledger's row is what stage 9 goes back and
 fixes.
 
+## The row you are about to work is a claim, and it has a date
+
+*Carried-in claims* below covers what **this run** inherited. This covers what an **earlier
+run wrote down** — a board row, which reads like a finding because it was one, on the day
+it was filed.
+
+Three rows expired inside a single day on 2026-08-16, and each was caught only because the
+cycle that picked it up happened to measure before building:
+
+- one recorded a script and thirteen green fixtures as *built and parked*; every artifact
+  had been deleted, and the row had read as ready-to-merge for two days;
+- one named six files belonging to another repository; a sweep found **eleven**;
+- one said the graphs were frozen at a date nine days old; every one had been rebuilt.
+
+None of the three was wrong when written. **A row states the world at its `Source` date and
+says nothing about now**, and the run that acts on it is the first reader in a position to
+tell the difference.
+
+**So: re-derive the row's checkable claims before acting on them, and correct the row in
+the same run.** Most claims name something a command can settle — a file, a count, a
+commit, a version, a green suite. What a command cannot settle stays as written and is
+acted on as an assumption, out loud.
+
+**The row's own derived columns decay too, and that one is pure arithmetic.** A rank
+computed from an age term is wrong the moment the age moves, and nothing notices because
+the number still looks like a number. This repository's own board carried a constant age
+for eleven days — the four oldest rows sat at the bottom of a ranking whose stated purpose
+was to raise them. If a board computes a priority, something must recompute it; a promise
+in the header that it happens at stage 10 is not a mechanism.
+
 ## The source is not the copy you have
 
 `learned.md` rule 17. The harvest reads the project's own files, and one property of them is

package/plugins/task-pipeline/skills/task-pipeline/templates/exposure.sh

@@ -47,43 +47,122 @@ fi
 TMP=$(mktemp -d 2>/dev/null || mktemp -d -t exposure)
 trap 'rm -rf "$TMP"' EXIT
 
-# ---------- the ledger's rows ----------
-# A row is a table line whose first cell is a REQ id. The header and the |---| separator
-# are excluded by that shape rather than by counting lines, because a ledger grows
-# sections and a line offset stops being true on the first one added.
+# ---------- the ledger's rows, resolved BY HEADER ----------
+# The first draft keyed on position — `NF >= 7`, status in field 7 — and on a ledger with
+# four columns it did not report a shape mismatch. It found FOUR rows out of 298, because
+# those four happened to contain a `|` inside inline code and so crossed the field count by
+# accident, then printed **"0 unverified · every shipped row carries a human confirmation"**.
+# The most reassuring sentence available, derived from punctuation. In a tool whose whole
+# purpose is to stop silent greens.
+#
+# So the status column is found by NAME, per section, and a ledger with no such column is
+# DORMANT rather than clean. Three shapes exist in this family already — `Human`, `Status`,
+# `Watched` — and a fourth will arrive without asking.
 awk -F'|' '
-  NF >= 7 && $2 ~ /^[[:space:]]*[A-Za-z][A-Za-z0-9-]*-?[0-9]*[[:space:]]*$/ &&
-  $2 !~ /^[[:space:]]*REQ[[:space:]]*$/ { print }
-' "$LEDGER" > "$TMP/rows" 2>/dev/null
-
-# `$(grep -c … || echo 0)` prints TWO zeroes when there are no matches: grep prints its
-# 0 and exits 1, so the fallback runs too and the variable becomes "0\n0" — which then
-# fails `[ "$ROWS" -eq 0 ]` with *integer expression expected* and takes the rest of the
-# script with it. The fallback belongs OUTSIDE the substitution.
+  function trim(s) { gsub(/^[ \t]+|[ \t]+$/, "", s); return s }
+  function lower(s) { return tolower(s) }
+  # A header is a row whose first cell names the id column. Everything after it, until the
+  # next header, is read with THAT header shape.
+  {
+    if (NF < 3) next
+    c1 = lower(trim($2))
+    if (c1 == "req" || c1 == "id" || c1 == "#") {
+      nf = NF; scol = 0; sname = ""
+      for (i = 2; i < NF; i++) {
+        n = lower(trim($i))
+        # `human` is the specific one and wins outright; the others are accepted so a
+        # differently-shaped ledger is read rather than declared unreadable.
+        # ORDER MATTERS, and getting it wrong reads the gate instead of the person.
+        # `sheleg-design`'"'"'s ledger carries BOTH `Last verified` (a date and what was
+        # watched) and `Status` (which holds `**green**`); preferring `status` reported
+        # 174 confirmed rows from the column that says the suite passed.
+        if (n == "human") { scol = i; sname = n; break }
+        if (n == "last verified" && sname != "human") { scol = i; sname = n }
+        if (scol == 0 && (n == "status" || n == "state")) { scol = i; sname = n }
+        # `Verified by`, `Confirmed` and `How it is checked` name the EVIDENCE, not the
+        # state — five members hold shell commands there. A column of commands read as a
+        # column of statuses is how `python3 test/validate.py` became an unreadable status.
+      }
+      next
+    }
+    if (nf == 0) next                      # rows before any header
+    if (trim($2) ~ /^[-: ]+$/) next        # the |---| separator
+    if (NF != nf) next                     # a row of another shape
+    if (scol == 0) { headerless++; next }  # counted, so the caller can say so
+    print trim($2) "\t" trim($(scol)) "\t" trim($3) "\t" (nf > 5 ? trim($5) : "")
+  }
+  END { print "##HEADERLESS " headerless+0 > "/dev/stderr"
+        print "##COLUMN " (sname == "" ? "-" : sname) > "/dev/stderr" }
+' "$LEDGER" > "$TMP/rows" 2>"$TMP/meta"
+
 ROWS=$(grep -c '' "$TMP/rows" 2>/dev/null) || ROWS=0
+HEADERLESS=$(sed -n 's/^##HEADERLESS //p' "$TMP/meta" 2>/dev/null)
+HEADERLESS=${HEADERLESS:-0}
+SCOL=$(sed -n 's/^##COLUMN //p' "$TMP/meta" 2>/dev/null)
+SCOL=${SCOL:--}
+
 if [ "$ROWS" -eq 0 ]; then
+  if [ "$HEADERLESS" -gt 0 ]; then
+    # THE CASE THAT WAS SILENTLY GREEN. Rows exist and none can be read, which is the one
+    # answer that must never be spelled "0 unverified".
+      echo "dormant: exposure — $LEDGER has $HEADERLESS row(s) but no column named Human,"
+    echo "         Last verified, Status or State. Columns like Verified by or How it is"
+    echo "         checked name the EVIDENCE, not the state, and are deliberately not read."
+    echo "         Nothing here can say whether anybody looked, so this reports no number."
+    exit 0
+  fi
   echo "dormant: exposure — $LEDGER has no REQ rows yet"
   exit 0
 fi
+if [ "$HEADERLESS" -gt 0 ]; then
+  echo "note:    $HEADERLESS row(s) sit under a header with no status column and are not counted"
+fi
 
-# Column order is the template's: REQ | What | Run | Shipped in | Auto | Human | Note.
-# With awk -F'|' on a leading-pipe line those are $2..$8.
-
-awk -F'|' '{ h=$7; gsub(/^[ \t]+|[ \t]+$/, "", h); if (h == "never") print }' \
+# Unconfirmed is a small closed vocabulary, and the empty cell is in it: a blank status is
+# the commonest way a row means "nobody has said", and reading it as confirmed inverts the
+# file's purpose.
+# NORMALISED first: these ledgers write `**never**`, not `never`. Bold hid three real
+# unverified rows in one member and seven in another, and both reported zero.
+awk -F'\t' '{ s=tolower($2); gsub(/[*`]/, "", s); gsub(/^[ \t]+|[ \t]+$/, "", s);
+              if (s=="never" || s=="" || s=="-" || s=="no" || s=="unverified" ||
+                  s=="pending" || s=="none") print }' \
   "$TMP/rows" > "$TMP/unverified"
 UNVERIFIED=$(grep -c '' "$TMP/unverified" 2>/dev/null) || UNVERIFIED=0
 
+# A THIRD BUCKET, because two are not enough. A status that is neither a known
+# unconfirmed word nor a date is UNREADABLE — `last tuesday`, `soon`, `ask Ben`. Counting
+# it as confirmed is how a shrug becomes a clean bill, which the fixture for this line
+# caught the moment it was written.
+awk -F'\t' '{ s=tolower($2); gsub(/[*`]/, "", s); gsub(/^[ \t]+|[ \t]+$/, "", s);
+               if (s=="never" || s=="" || s=="-" || s=="no" || s=="unverified" ||
+                   s=="pending" || s=="none") next;
+               if ($2 ~ /[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]/) next;
+               if (s=="pass" || s=="yes" || s=="verified" || s=="ok" || s=="observed" ||
+                   s=="confirmed" || s=="green") next;
+               print }' "$TMP/rows" > "$TMP/unreadable"
+UNREADABLE=$(grep -c '' "$TMP/unreadable" 2>/dev/null) || UNREADABLE=0
+
 # ---------- since: a date, or the literal `never checked` ----------
 # ZERO WOULD BE A LIE IN THE DANGEROUS DIRECTION. "0 days" reads as *checked today*,
 # which is the exact opposite of "nobody has ever looked", so the two cases print
 # different words rather than different numbers.
-awk -F'|' '{ h=$7; gsub(/^[ \t]+|[ \t]+$/, "", h);
-             if (h ~ /^[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]$/) print h }' \
+awk -F'\t' '{ if ($2 ~ /[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]/) {
+                   match($2, /[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]/);
+                   print substr($2, RSTART, RLENGTH) } }' \
   "$TMP/rows" | sort > "$TMP/dates"
 NEWEST=$(tail -1 "$TMP/dates" 2>/dev/null)
 
 if [ -z "$NEWEST" ]; then
-  SINCE="never checked"
+  # THREE FACTS, NOT TWO. "nobody has ever looked", "this shape records no dates" and
+  # "somebody wrote something nobody can read" are different, and the first draft printed
+  # the middle one for the last — a clean bill two lines under a shrug.
+  if [ "$UNREADABLE" -gt 0 ]; then
+    SINCE="never checked ($UNREADABLE status(es) this script cannot read)"
+  elif [ "$UNVERIFIED" -eq 0 ]; then
+    SINCE="no confirmation dates recorded"
+  else
+    SINCE="never checked"
+  fi
 else
   # Portable day arithmetic: BSD date and GNU date disagree on every flag that matters,
   # so ask python, which both platforms have and which will not silently return today.
@@ -97,10 +176,16 @@ print((datetime.date.today() - d).days)
 PY
 )
   if [ -z "${DAYS:-}" ]; then
-    echo "FAIL: exposure — $LEDGER has a Human date this script cannot parse: $NEWEST"
+    echo "FAIL: exposure — $LEDGER has a confirmation date this script cannot parse: $NEWEST"
     exit 1
   fi
-  SINCE="$DAYS days since the last human confirmation"
+  # The same discipline as the clean bill below: only a `Human` column licenses the word
+  # "human". Any other column records that something looked, not that somebody did.
+  if [ "$SCOL" = "human" ]; then
+    SINCE="$DAYS days since the last human confirmation"
+  else
+    SINCE="$DAYS days since the last \`$SCOL\` entry"
+  fi
 fi
 
 # ---------- releases: what has gone out on top of it ----------
@@ -134,18 +219,35 @@ esac
 echo "$LINE"
 
 # ---------- the check-list: a number without it says there is a problem, not where ----------
+# A SHRUG IS NOT A CLEAN BILL. A status that is neither a date nor a known word means
+# somebody wrote something and nobody can act on it; printing "every shipped row is
+# confirmed" over that is the failure this whole file exists to prevent.
+if [ "$UNREADABLE" -gt 0 ]; then
+  echo "         $UNREADABLE row(s) carry a status that is neither a date nor a known word,"
+  echo "         so no clean bill is printed over them:"
+  cut -f1,2 "$TMP/unreadable" | head -"$LIST_MAX" | sed 's/^/           /'
+  if [ "$UNVERIFIED" -eq 0 ]; then exit 0; fi
+fi
+
 if [ "$UNVERIFIED" -eq 0 ]; then
-  echo "         every shipped row carries a human confirmation"
+  # NAME THE COLUMN. `Human` means a person; `Status`, `State` and `Watched` do not
+  # distinguish a person from a command — the umbrella's own ledger says `verified` means
+  # "a person **or a command** looked", so claiming a human confirmation from that column
+  # is a stronger sentence than the data supports.
+  if [ "$SCOL" = "human" ]; then
+    echo "         every shipped row carries a human confirmation"
+  else
+    echo "         every shipped row is confirmed in its \`$SCOL\` column — which does not"
+    echo "         separate a person from a command; only a \`Human\` column does that"
+  fi
   exit 0
 fi
 
 # Oldest first by `Shipped in`, which is the only ordering this repository can defend.
 # Version sort, so v1.9.0 precedes v1.10.0 — a lexical sort puts the newer one first and
 # hands the operator the wrong end of the list.
-awk -F'|' '{ req=$2; ship=$5; what=$3;
-             gsub(/^[ \t]+|[ \t]+$/, "", req);
-             gsub(/^[ \t]+|[ \t]+$/, "", ship);
-             gsub(/^[ \t]+|[ \t]+$/, "", what);
+awk -F'\t' '{ req=$1; what=$3; ship=$4;
+             if (ship == "") ship = "—";
              # Truncated on a WORD boundary, never mid-character: awk counts bytes
              # here, so `substr(what, 1, 56)` cut a Cyrillic letter in half and printed
              # a replacement glyph. Appending whole words cannot land inside one.