task-pipeline-skill 1.72.0 → 1.73.0

package/CHANGELOG.md

@@ -1,5 +1,68 @@
 # Changelog
 
+## v1.73.0 — 2026-08-20 — the registry could not see the templates, the scripts, or its own registers
+
+
+**The claim registry had the class for this exact incident and it fired on nothing.** Three
+shipped surfaces said *34 reference files* over a directory of 35 — `scripts/graph.py`'s
+`doctrine` docstring and `templates/run.md` twice — and `npm test` printed
+`reference files: dormant (truth 35)`. Two holes, either of which was enough: the pattern
+knew only the word order ``N files under `references/` ``, and the corpus was eight named
+files plus `references/**`, so `templates/` and `scripts/` were never opened. The class now
+reads any phrasing of the count, the corpus reads the templates and the shipped script, and
+the class is armed at three agreeing sites instead of dormant.
+
+**And it never read this repository's own registers.** `docs/DOCMAP.md` names decisions,
+open questions, the board, the ledger and the retro as the registers, and its propagation
+matrix sends *a number stated in a living document* to this registry — which could not see
+any of them. `docs/OPEN_QUESTIONS.md` said *the 250 guards* against a workflow defining 390,
+in a phrasing the guard class already knew. Bringing them in refused 26 statements and every
+one was narration, so a number inside a **dated item** is a record and exempt; on the board
+the discriminator is the State cell rather than the date, because every row names the day it
+was filed and B-001 — open — was stating its description budget and its reference-file count
+as facts about now.
+
+**Fourteen consecutive releases carry no run stamp**, `v1.60.1` through `v1.72.0`, and the
+retro's honest-gap section named only `v1.16.0`–`v1.23.0`. Its *Measured, not recalled*
+receipt could not produce the measurement: it grepped `docs/superpowers/retro.md`, removed at
+v1.53.0, and grepped for a tag's own commit when a stamp names the commit the *run* ended on.
+Rewritten as a tag-range walk that reads the archive too, and a guard now requires every
+release after the newest stamp to be named in that section.
+
+Also: `## Unreleased` is where the guard count lives between a tag and the next bump (B-104);
+`Environment` is a required cell on every verification row with the vocabulary read out of
+the shipped template (B-099's other half); the graph schema states its three node rules
+behind `$ref`s and the checker follows them (B-079, proved by moving them, not by a fixture);
+an open board row's `file:N-M` must quote the phrase it points at, which caught five stale
+citations and then caught this change's own edits four more times; the acceptance ladder is
+policy **`AP-1`** with an owner and an in-force date, and `gates.md`'s *the framework fixes
+no stage count* is scoped to the pipeline's shape; `read:` and `gate:` are reported
+**unattested** instead of claimed *never agent-written*, because the ledger is the file the
+agent appends to at every stage; `validate.yml` no longer re-validates a SHA on its own tag
+push; and every documented `npm` equation is compared against `package.json` — `CLAUDE.md`
+had `npm test` as `validate.py` alone, dropping 129 graph cases.
+
+**What the suite found that no reading did.** This change broke **thirteen** existing
+plants and `npm run test:all` named every one: the two verification-header probes spell
+the whole header and it gained a column; two CHANGELOG probes scoped themselves to
+`^## v` and the count now lives in `## Unreleased`; **seven** graph-schema probes walk
+`node.allOf` inline and the rules moved behind `$ref`. All thirteen were repaired by
+deriving the guard's own scope rather than restating it, which is what `learned.md`'s
+*sweep the class* asks for — and the sweep needed two rounds: six schema probes were
+repaired together and the seventh surfaced on the next full run, having died on
+`KeyError: 'if'` where the others had died on their own asserts. A class fixed in six of
+seven places is the shape standing instruction R-003 exists for.
+
+One of the twelve was sharper than the rest, and it was self-inflicted twice over: the
+honesty note explaining that `OQ-0002` no longer restates a total put an ISO date in the
+row, which made the row a dated record and **disarmed the register plant** — green over
+exactly the stale total it had been written to catch. `OQ-####` now uses its `Status`
+cell, the discriminator the board already uses, and the register plant sits on an open
+board row where no prose edit beside it can turn it off.
+
+Guards: 390 → **412** · property checks 9 → **14**
+
+
 ## v1.72.0 — a node says how it will be closed
 
 **B-080 closed, and with it the last of four requirements this pack's own manifesto named

package/CONTRIBUTING.md

@@ -531,6 +531,67 @@ the two homes are compared directly: whatever the verifier is told to read off t
 must be a property the schema declares.
 *(guard: `node declares no` and `rule that can fire` and `off the node, and`)*
 
+**57. The claim registry reads every surface that states a number, including the ones this
+repository writes about itself.** Its corpus was eight named files plus `references/**`, so
+`templates/` and `scripts/` were invisible — three shipped surfaces said "34 reference files"
+over a directory of 35 while the class printed `dormant` — and so were the registers
+`docs/DOCMAP.md` names, where `docs/OPEN_QUESTIONS.md` said "the 250 guards" against a
+workflow defining 390. The corpus now covers both, and a class recognises every phrasing of
+its count rather than one word order. A number inside a **dated item** in a register is a
+record and exempt; on the board the discriminator is the **State** cell, because every row
+names the day it was filed and an open row is a claim about now.
+*(guard: `reference files` and `— derive the number or delete it`)*
+
+**58. Every documented `npm` command means what `package.json` runs.** `CLAUDE.md` glossed
+`npm test` as `python3 test/validate.py`, dropping `graph_test.py` and its 129 cases — the
+suite-outside-the-run class stated the other way round — and called `npm run test:all` "both"
+where it runs eight scripts. An equation is compared against the script body after one level
+of `npm run` resolution, and a bare `npm run X` in a document about this repository must be a
+script that exists. Portable doctrine under `plugins/` and `cursor/` is out of scope: it names
+a host project's commands.
+*(guard: `is glossed as` and `declares no such script`)*
+
+**59. A release either carries a run stamp or is recorded as a gap, and the guard-count claim
+has a home before the bump.** Fourteen consecutive releases had no stamp while the retro named
+only `v1.16.0`–`v1.23.0`, and the receipt that was supposed to prove it grepped a path removed
+at v1.53.0 for a tag's own commit — a stamp names the commit the *run* ended on. Scoped to the
+trailing stretch: 84 of 117 tags predate the register and backfilling is forbidden. Separately,
+the count guard reads the topmost `## ` section, so `## Unreleased` is where the number lives
+between a tag and the next bump, and it must sit above every version heading.
+*(guard: `release(s) after the newest run stamp` and `section sits below a released version`)*
+
+**60. A `file:line` range in an open board row quotes the phrase it points at.** Five
+citations resolved to real lines and pointed at other text; a line number is the most fragile
+address a document carries, because every edit above it moves it and nothing notices. Closed
+rows are records and are left alone; single-line citations cannot be quoted and are disclosed
+as unanchored rather than failed.
+*(guard: `quotes no phrase from it`)*
+
+**61. Every evidence row records the environment it ran in, and a claim of provenance the
+format cannot check is marked unattested instead.** `Observed at` said which tree a check saw
+and nothing said where it ran, so a preview smoke test and a production one entered the record
+in the same shape — in a pack whose own `learned.md` records a suite green on every author's
+machine and 1039 failures on a clean runner. And `read:`/`gate:` were declared *hook-written,
+never agent-written* while both land in the file the agent appends to at every stage: no writer
+field, no provenance check, so the count is reported `unattested` and the claim is not made.
+*(guard: `has no `Environment` cell` and `prints a count and never says`)*
+
+**62. The acceptance ladder is a versioned policy with an owner, and `gates.md`'s
+fixes-nothing sentence is scoped to the pipeline's shape.** Both rules stood unscoped side by
+side for seventy releases — *the framework fixes no stage count and no gate assignment* beside
+twelve fixed criteria — so a reader could take either as the whole rule, and a table accepted
+under v1.20 doctrine was indistinguishable from one accepted under v1.70. The block carries
+`AP-1`, an owner and an in-force date; an amendment moves the version and lands with a decision
+row.
+*(guard: `the acceptance policy carries no` and `stands unscoped beside`)*
+
+**63. A heading may not declare a bound nothing enforces.** The retro's *Recent log* read
+*entries from the last five run stamps* over 25 entries reaching back nine days, borrowing the
+stamp section's wording without its cap — filed twice as B-060 and B-069 and disclosed by the
+file about itself. Checked in the live retro and in `templates/retro.md`, which seeded the
+false bound into every host project.
+*(guard: `declares the bound` and `and nothing enforces it`)*
+
 ## Adding or changing doctrine
 
 - **Change one idea per PR.** These files are read by agents under load; a PR that

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.72.0 |
+| **Version** | 1.73.0 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki, and **one of two browser channels** — `playwright` (CLI or MCP) or `chrome-devtools` (MCP); either satisfies the browser step and neither is required. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.72.0",
+  "version": "1.73.0",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs). Retro insights can publish upstream as issues, opt-in and redacted.",
-  "version": "1.72.0",
+  "version": "1.73.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/skills/task-pipeline/graph.schema.json

@@ -149,83 +149,13 @@
       },
       "allOf": [
         {
-          "if": {
-            "properties": {
-              "status": {
-                "not": {
-                  "const": "parked"
-                }
-              }
-            },
-            "required": [
-              "status"
-            ]
-          },
-          "then": {
-            "required": [
-              "check"
-            ],
-            "properties": {
-              "check": {
-                "type": "string",
-                "minLength": 1,
-                "pattern": "\\S"
-              }
-            }
-          }
+          "$ref": "#/definitions/rule_check_unless_parked"
         },
         {
-          "if": {
-            "properties": {
-              "status": {
-                "const": "done"
-              }
-            },
-            "required": [
-              "status"
-            ]
-          },
-          "then": {
-            "required": [
-              "evidence"
-            ],
-            "properties": {
-              "evidence": {
-                "type": "array",
-                "minItems": 1,
-                "items": {
-                  "type": "string",
-                  "minLength": 1,
-                  "pattern": "\\S",
-                  "description": "At least one non-whitespace character. `minLength: 1` alone accepts a single space, which is the one shape where this schema and `graph.py`'s verdict gate disagreed — the gate strips, the schema counted. A cross-check fixture comparing the two found it."
-                }
-              }
-            }
-          }
+          "$ref": "#/definitions/rule_done_needs_evidence"
         },
         {
-          "if": {
-            "properties": {
-              "status": {
-                "const": "parked"
-              }
-            },
-            "required": [
-              "status"
-            ]
-          },
-          "then": {
-            "required": [
-              "parked_reason"
-            ],
-            "properties": {
-              "parked_reason": {
-                "type": "string",
-                "minLength": 1,
-                "pattern": "\\S"
-              }
-            }
-          }
+          "$ref": "#/definitions/rule_parked_needs_reason"
         }
       ]
     },
@@ -283,6 +213,88 @@
           "description": "The reason, written for a person reading it later. The non-whitespace pattern is required for the same reason `parked_reason` needs one: `minLength: 1` counts a space."
         }
       }
+    },
+    "rule_check_unless_parked": {
+      "description": "B-080's rule, factored out of `node.allOf` so it is stated once and referenced. Factoring it exposed B-079: `test/validate.py`'s `_conditionals()` recursed into `allOf` and never followed a `$ref`, so a schema that shares a rule this way read as a schema with NO conditionals and both REQ-006 and REQ-012 were reported missing from a schema that states them. The shipped schema now uses the `$ref` form, so the deref branch is exercised by every run of the gate rather than by one fixture.",
+      "if": {
+        "properties": {
+          "status": {
+            "not": {
+              "const": "parked"
+            }
+          }
+        },
+        "required": [
+          "status"
+        ]
+      },
+      "then": {
+        "required": [
+          "check"
+        ],
+        "properties": {
+          "check": {
+            "type": "string",
+            "minLength": 1,
+            "pattern": "\\S"
+          }
+        }
+      }
+    },
+    "rule_done_needs_evidence": {
+      "description": "REQ-006 as draft-07 states it: `done` implies at least one non-whitespace evidence string. Referenced from `node.allOf`, never inlined, so the rule has one home.",
+      "if": {
+        "properties": {
+          "status": {
+            "const": "done"
+          }
+        },
+        "required": [
+          "status"
+        ]
+      },
+      "then": {
+        "required": [
+          "evidence"
+        ],
+        "properties": {
+          "evidence": {
+            "type": "array",
+            "minItems": 1,
+            "items": {
+              "type": "string",
+              "minLength": 1,
+              "pattern": "\\S",
+              "description": "At least one non-whitespace character. `minLength: 1` alone accepts a single space, which is the one shape where this schema and `graph.py`'s verdict gate disagreed — the gate strips, the schema counted. A cross-check fixture comparing the two found it."
+            }
+          }
+        }
+      }
+    },
+    "rule_parked_needs_reason": {
+      "description": "REQ-012: a parked node names why it is parked. Referenced from `node.allOf`.",
+      "if": {
+        "properties": {
+          "status": {
+            "const": "parked"
+          }
+        },
+        "required": [
+          "status"
+        ]
+      },
+      "then": {
+        "required": [
+          "parked_reason"
+        ],
+        "properties": {
+          "parked_reason": {
+            "type": "string",
+            "minLength": 1,
+            "pattern": "\\S"
+          }
+        }
+      }
     }
   }
 }

package/plugins/task-pipeline/skills/task-pipeline/references/acceptance.md

@@ -319,6 +319,29 @@ spends its length refusing.
 
 ## GATE (manual)
 
+> **Acceptance policy `AP-1` · owner: the operator of the project running this pipeline ·
+> in force since 2026-08-20 · supersedes: the unversioned ladder that stood before it.**
+>
+> This block is the policy, and naming it that closes a contradiction that stood in the
+> shipped doctrine. [`gates.md`](gates.md) → *Axis A — the stage gate type* says which stages are
+> manual is the operator's decision and that **the framework fixes no stage count and no
+> gate assignment** — while the ladder below fixes twelve criteria and the statuses they
+> may take. Both were true and neither was scoped, so a reader could take either as the
+> rule.
+>
+> **The scope, stated once:** `gates.md`'s sentence governs the **pipeline's shape** — how
+> many stages a project runs and which of them are `auto`, `judgment` or `manual`, all of
+> it in the project's own `pipeline.json`. `AP-1` governs **what stage 10's manual gate
+> asks when a project runs one.** A project may drop stage 10, or make it `auto` for a
+> class of work, and `AP-1` then does not apply to it; a project that keeps it manual gets
+> these criteria and this vocabulary, not a per-run selection from them.
+>
+> **Changing it is a decision, not an edit.** An amended criterion moves the version to
+> `AP-2` and lands with a row in the project's decision register, because a policy that can
+> be edited silently is the *«recorded in the slot reserved for what a machine
+> established»* failure one level up: an acceptance standard nobody can cite by version is
+> one every run re-negotiates.
+
 All of:
 
 1. **Every shipped REQ has a verification row, and every row names a REQ its own run

package/plugins/task-pipeline/skills/task-pipeline/references/audit.md

@@ -47,12 +47,21 @@ The method most audits use is **horizontal**: compare the documents against each
 other, then do it again. It works, and then it fails in a way that is invisible
 from inside it. Measured over seven passes on a production repository:
 
-| Pass | Findings | …of which the previous pass's own fixes caused |
-|---|---|---|
-| 4 | 12 | 5 |
-| 5 | 17 | 9 |
-| 6 | 13 | 10 |
-| 7 | 19 | 4 |
+| Pass | Findings | …of which the previous pass's own fixes caused | Self-inflicted share |
+|---|---|---|---|
+| 4 | 12 | 5 | 42% |
+| 5 | 17 | 9 | 53% |
+| 6 | 13 | 10 | 77% |
+| 7 | 19 | 4 | 21% — see the note below |
+
+**The trend above is measured over passes four to six, and pass seven is not part of
+it.** 42% → 53% → 77% is the decay this section teaches; the seventh pass fell back to
+4 of 19 and **the record does not say what that pass did differently.** The row stays,
+with the gap named, for two reasons. Deleting a measured row to protect a claim is the
+opposite of what this file asks of every gate it describes — and the vertical pass
+described below cannot be credited for the drop, because it is a separate pass over the
+same repository, not the seventh. Whatever pass seven did, it is unrecorded, and an
+unrecorded cause is what this table has to say about it.
 
 By pass six the audit was **mostly repairing itself**. Not fatigue — arithmetic.
 Each pass edits the corpus the next pass reads, so the newest edits are always the

package/plugins/task-pipeline/skills/task-pipeline/references/gates.md

@@ -58,6 +58,15 @@ not the operator confirming it is what they asked for, and no amount of checking
 makes it one. Which stages are manual is the **operator's** decision, recorded in
 their `pipeline.json`; the framework fixes no stage count and no gate assignment.
 
+**That sentence is about the pipeline's SHAPE, and nothing else.** It says a project
+chooses how many stages it runs and which of them wait for a person. It does not say the
+criteria inside a gate are per-run negotiable: where a project keeps stage 10 manual, what
+that gate asks is [`acceptance.md`](acceptance.md)'s policy **`AP-1`**, which is versioned
+and has an owner. The two rules stood side by side unscoped until 2026-08-20 (`B-091`), and
+a reader could take either as the whole rule — *the framework fixes nothing* and *the ladder
+is fixed* are both in the shipped doctrine, which is how an acceptance standard becomes
+something every run re-argues.
+
 ## The judgment gate — a ruling is not a measurement
 
 Two types were not enough, and the gap was not cosmetic. A reviewer's ruling, a check that

package/plugins/task-pipeline/skills/task-pipeline/references/progress.md

@@ -369,12 +369,18 @@ deduplicated, and always exiting 0 — a hook that can fail a `Read` breaks ever
 every session. `scripts/graph.py doctrine` reports how many of the bundle's reference files
 a run opened and lists the rest.
 
-Why it is hook-written is the same reason as above: a claim about what somebody read,
-written by the party the claim is about, is not evidence. And why the verb prints
+Why a hook appends it is the same reason as above: a claim about what somebody read,
+written by the party the claim is about, is not evidence. **And that is an intent rather
+than a proof, so the verb reports `unattested`:** the ledger is the file the agent appends
+to at every stage and carries no writer field, so nothing in it separates a hook-written
+line from one an agent typed. Saying *never agent-written* was a provenance claim the
+format cannot support — B-014's class, in the mechanism built to close it.
+
+And why the verb prints
 `unmeasured` rather than `0` when there are no such lines is the same reason again — the
 hook being absent and the run reading nothing are **opposite facts** the ledger cannot
 separate, so it claims neither. A `0` there would be the reassuring answer to a question
-nobody asked, over 34 files nobody checked.
+nobody asked, over 35 files nobody checked.
 
 It is a disclosure: no floor, no direction, never a target. The moment the number becomes
 something to raise, a run will open files to raise it.

package/plugins/task-pipeline/skills/task-pipeline/references/retrospective.md

@@ -19,7 +19,7 @@ justifies reading it protects one section while the file below it doubles.
 | Artifact | Parts | How it is read |
 |---|---|---|
 | `docs/evidence/retro.md` — **one per project** | **Standing instructions** (max **10**) · **Run stamps** (max **10**, oldest rotate out) | stage 0, **in full** — both are bounded by a **cap**, which *one line each* never was |
-| the same file's **Recent log** | entries from the last five run stamps — narrative, and capped by nothing | stage 0, **queried** by the task's nouns. It said *in full* until 2026-08-10, when it measured **74%** of the file: an uncapped section inside a binding source is what makes the capped part get skimmed |
+| the same file's **Recent log** | narrative entries, **uncapped by design** — the heading said *entries from the last five run stamps* until 2026-08-20 while the section held 25 going back nine days, a bound in a heading that nothing enforced | stage 0, **queried** by the task's nouns. It said *in full* until 2026-08-10, when it measured **74%** of the file: an uncapped section inside a binding source is what makes the capped part get skimmed |
 | `docs/evidence/retro/YYYY-QN.md` — the archive | every entry and every retirement ever written, append-only | **queried** by the task's nouns; never read end to end |
 
 Seed the archive from [`../templates/retro-archive.md`](../templates/retro-archive.md).

package/plugins/task-pipeline/skills/task-pipeline/scripts/graph.py

@@ -909,13 +909,21 @@ def cmd_producer(graph, args):
 def cmd_doctrine(graph, args):
     """Which doctrine this run actually read — B-061.
 
-    The bundle is 34 reference files. A run reads some subset and nothing recorded which,
+    The bundle is 35 reference files. A run reads some subset and nothing recorded which,
     so **a skipped file and a read one were indistinguishable** — the class every guard in
     this repository exists to catch, left standing over the doctrine itself.
 
-    `read:` lines in the run ledger are written by a hook, never by the agent, for the same
-    reason `gate:` is: a claim about what somebody read, written by the party the claim is
-    about, is not evidence.
+    `read:` lines are written by a hook rather than by the agent, for the same reason `gate:`
+    is: a claim about what somebody read, written by the party the claim is about, is not
+    evidence.
+
+    **And that is an intent, not a proof, so every line here is reported as UNATTESTED.**
+    The ledger is `.task-pipeline/run.md` — the file the agent appends to at every stage —
+    so nothing in it distinguishes a hook-written line from one an agent typed. The doctrine
+    said *hook-written, never agent-written*, which is a provenance claim this script cannot
+    check and no format here carries; B-014's class, committed by the mechanism built to
+    close it. Until the ledger can attest a writer, the honest output is the count plus the
+    word: read as *this is what the ledger says, and the ledger cannot say who wrote it*.
 
     **The one rule that matters here: no `read:` lines means UNMEASURED, never «read
     nothing».** Zero would be the reassuring answer to a question nobody asked, and this
@@ -958,7 +966,10 @@ def cmd_doctrine(graph, args):
         return 0
 
     unread = [r for r in refs if r not in read]
-    print(f"doctrine: {len(read)} of {len(refs)} reference files read")
+    print(f"doctrine: {len(read)} of {len(refs)} reference files read — unattested")
+    print("          unattested: the ledger is the file the agent appends to at every stage, "
+          "so nothing in it proves the hook wrote these lines rather than an agent. The "
+          "count is what the ledger says; who wrote it is not recorded.")
     print("          a disclosure: no floor, no direction, never a target. A run that needs "
           "four files and reads four is not worse than one that reads thirty.")
     for r in unread:

package/plugins/task-pipeline/skills/task-pipeline/templates/retro.md

@@ -31,7 +31,7 @@ has not fired in the last five run stamps, or in the last sixty days. At eleven
 rows, the oldest never-fired
 row goes — the cap is not negotiable, ranking is.
 
-## Recent log — entries from the last five run stamps (newest first)
+## Recent log — narrative entries, uncapped and queried rather than read (newest first)
 
 Older entries and every retirement **move** to `docs/evidence/retro/YYYY-QN.md`
 at the prune. Moving is not deleting: the archive is append-only and holds the

package/plugins/task-pipeline/skills/task-pipeline/templates/run.md

@@ -20,23 +20,35 @@ Run: `<topic>` · started `<YYYY-MM-DD>` · module map: `<path or "none">`
 
 ## `read:` — which doctrine this run actually opened
 
-The bundle is 34 reference files and nothing recorded which of them a run read, so **a
+The bundle is 35 reference files and nothing recorded which of them a run read, so **a
 skipped file and a read one were indistinguishable** — the class every guard in this
 pipeline exists to catch, left standing over the doctrine itself.
 
-`read:` is **hook-written, never agent-written**, for the same reason `gate:` is: a claim
-about what somebody read, written by the party the claim is about, is not evidence. The
+`read:` is **written by a hook rather than by the agent**, for the same reason `gate:` is: a
+claim about what somebody read, written by the party the claim is about, is not evidence. The
 hook is in `hooks.example.json`, matches `Read`, records the path only
 when it is inside the bundle's `references/`, deduplicates, and **always exits 0** — a hook
 that can fail a `Read` would break every turn in every session.
 
+**That is an intent, not a proof, and the line says so.** This file is the one the agent
+appends to at every stage, so nothing in it distinguishes a hook-written line from one an
+agent typed: there is no writer field, and `scripts/graph.py` has no provenance check
+because the format gives it nothing to check. The doctrine here said *hook-written, never
+agent-written* until 2026-08-20 — a provenance claim in the file whose whole subject is that
+a claim by the interested party is not evidence, which is B-014's class committed by the
+mechanism built to close it. So `doctrine` and the `gate:` reader both report **`unattested`**
+beside their counts, and the two claims that survive are the ones the ledger can support:
+*this line is in the ledger*, and *nobody recorded who wrote it*. Attesting a writer needs a
+field this format does not have; inventing one that an agent can also fill would restate the
+same claim one level down.
+
 `scripts/graph.py doctrine` reads these lines and prints one of three things:
 
 | It prints | When | Why not just a number |
 |---|---|---|
 | `unmeasured — no run ledger` | there is no ledger | nothing to read from |
 | `unmeasured — the ledger carries no read: lines` | the hook is absent, **or** the run opened no doctrine | two opposite facts, and the ledger cannot separate them, so neither is claimed |
-| `N of 34 reference files read`, then each unread one | the hook is installed and fired | the count alone says there is a gap, not where |
+| `N of 35 reference files read — unattested`, then each unread one | the hook is installed and fired | the count alone says there is a gap, not where — and `unattested` says the ledger cannot name who wrote the lines |
 
 **It is a disclosure: no floor, no direction, never a target.** A run that needs four files
 and reads four is not worse than one that reads thirty — and the moment the number becomes
@@ -58,15 +70,17 @@ hand:  <N|10> — task "<quoted>" — done <n> — surfaced <n> — decisions <n
 holds: <stage id> — <n> (<class: what, owner>; … or "none") — enumerated <n>/8 classes, <unlooked: classes not enumerable>
 gate:  <stage id> — command "<cmd>" — exit <N> — <ISO-8601>
 event: <compact|session-end|subagent> — <detail> — <ISO-8601>
-read:  references/<file>.md            # hook-written, deduplicated, one per file opened
+read:  references/<file>.md            # hook-appended, deduped, UNATTESTED (no writer field)
 ```
 
 - **`stage:`** — written when a gate **returns**, not when the stage is entered. The
   rail's `✓` is derived from this line and from nothing else; a glyph set from memory
   is a summary that is confidently wrong exactly when it matters.
-- **`gate:`** — written by `hooks/gate-observer.sh`, never by an agent. It is the
-  only line here that records what a command **did** rather than what somebody
-  concluded: the exit code of the stage's declared `gate.command`, observed. The
+- **`gate:`** — appended by `hooks/gate-observer.sh` rather than by an agent, and
+  **unattested** for the reason `read:` is: this file is agent-written at every stage
+  and carries no writer field, so the line's provenance is an intent the format cannot
+  prove. It is the only line here that records what a command **did** rather than what
+  somebody concluded: the exit code of the stage's declared `gate.command`, observed. The
   `stage:` line above it is the agent's claim, and the release gate requires the
   two to agree — without this, a gate reads a claim written by the party it
   constrains and confirms an assertion with itself. Absent where the project

package/plugins/task-pipeline/skills/task-pipeline/templates/verification.md

@@ -41,6 +41,7 @@ worse than saying nothing.
 ## Contents
 
 - [Staleness — a row is true about the tree it OBSERVED](#staleness--a-row-is-true-about-the-tree-it-observed)
+- [Environment — a proof is only valid where it ran](#environment--a-proof-is-only-valid-where-it-ran)
 - the ledger itself — one row per REQ, appended by stage 8
 - [What `Human` means, and what it does not](#what-human-means-and-what-it-does-not)
 
@@ -71,11 +72,39 @@ one. Four things overtake a row, and naming which one applies is the note's job:
 change in what it covers, a **dependency** change, an **environment** change, and a
 **policy** change — the last being the rule under which the evidence was accepted.
 
-| REQ | What | Run | Shipped in | Observed at | Auto | Human | Note |
-|---|---|---|---|---|---|---|---|
-| REQ-001 | CSV export from a report | `2026-07-28-export` | v1.4.0 | `5f21ac3` | pass | 2026-07-30 | opened the deployed page, exported, opened the file |
-| REQ-004 | XLSX export | `2026-07-28-export` | v1.4.0 | `5f21ac3` | pass | **never** | — |
-| REQ-007 | Export respects active filters | `2026-07-28-export` | v1.4.0 | `5f21ac3` | partial | **never** | CSV path only |
+## Environment — a proof is only valid where it ran
+
+`Observed at` says which tree the check saw. It does not say **where**, and without that a
+smoke test against a preview URL enters the record in a shape indistinguishable from one
+against production, and a suite green on a laptop with accumulated state is
+indistinguishable from one green on a runner that started clean. Those are the two halves
+of the same question, and only one was instrumented.
+
+**`Environment` is a required cell on every row.** Its vocabulary is the project's own,
+declared in the runbook and not invented per row — this file ships with four, and a project
+that deploys differently declares different ones:
+
+| Value | What it means |
+|---|---|
+| `production` | the deployed target real users reach |
+| `preview` | a per-branch or per-PR deployment; proves the build, never the release |
+| `ci` | a clean runner, no accumulated state |
+| `local` | a developer machine, with whatever state it has |
+| `—` | **recorded absence** — a row written before this column existed, or one whose environment nobody recorded. Not a value, and never a default to reach for |
+
+A missing cell is not the same as `—`: the first is a row that forgot the question, and it is
+**refused**. The second is an answer.
+
+**A REQ claiming production behaviour may not be closed on a non-production
+observation.** Stage 8 writes the row and refuses that pairing rather than recording it —
+`pass` in `ci` against a requirement about the deployed product is the exact substitution
+this column exists to make visible.
+
+| REQ | What | Run | Shipped in | Observed at | Environment | Auto | Human | Note |
+|---|---|---|---|---|---|---|---|---|
+| REQ-001 | CSV export from a report | `2026-07-28-export` | v1.4.0 | `5f21ac3` | production | pass | 2026-07-30 | opened the deployed page, exported, opened the file |
+| REQ-004 | XLSX export | `2026-07-28-export` | v1.4.0 | `5f21ac3` | ci | pass | **never** | — |
+| REQ-007 | Export respects active filters | `2026-07-28-export` | v1.4.0 | `5f21ac3` | preview | partial | **never** | CSV path only |
 
 ## Columns
 
@@ -86,6 +115,10 @@ change in what it covers, a **dependency** change, an **environment** change, an
 - **Run** — the brief's topic slug, so the context is one file away.
 - **Shipped in** — the tag or commit that carried it. Where a project does not tag,
   the commit, and the same value every row of that run carries.
+- **Observed at** — the commit the check ran against. `—` where nobody recorded one.
+- **Environment** — where it ran, from the project's declared vocabulary. Required; `—` is
+  the recorded absence and an omitted cell is refused. See *Environment — a proof is only
+  valid where it ran*.
 - **Auto** — what the run's own gate said: `pass` · `partial` · `none`. Copied from the
   coverage table rather than re-derived; where the two disagree the coverage table wins
   and the disagreement is a finding. A coverage verdict of **`review`** — *no check can