task-pipeline-skill 1.73.0 → 1.74.0

package/CHANGELOG.md

@@ -1,5 +1,118 @@
 # Changelog
 
+## v1.74.0 — 2026-08-20 — a node is closed by three readings, not one
+
+**A verifier reads the diff it was handed, and that is the definition of its context, not a
+shortcoming.** It also means a class of defect is invisible to it by construction: the change is
+correct where it was made and a caller's contract moved under it; a second implementation of the
+same rule did not get the fix; a documented behaviour is now false and the document still reads
+as true; another feature reaches the same path and nobody considered the interaction. None of
+those is a bug in the changed lines. All of them ship.
+
+A node is now closed by **three independent readings at escalating visibility**, and the run may
+not advance until all three pass.
+
+| Tier | Subject | Characteristic finding |
+|---|---|---|
+| `unit` | the changed functions, classes and branches, plus the node's own `check` | a branch nothing exercises; a boundary that moved |
+| `seam` | everything that can reach the change — callers, callees, implementors, shared state, the neighbours' tests | a contract that moved under a dependent; the duplicate that did not get the fix |
+| `product` | documentation, scenarios, user-visible strings, the neighbouring features sharing this path | a documented behaviour that is now false; an interaction nobody listed |
+
+**Blind is the design, not a detail.** The three dispatch in parallel and no tier reads another's
+report, because three readings that inform each other are one opinion with three signatures — and
+the failure is specific: an agent that has just read a convincing account of the implementation
+will paraphrase it back as product truth. `certify` refuses a report whose prose cites another
+tier's verdict.
+
+**`certify` is a gate in front of `close`, and `close`'s contract is unchanged.** It takes one
+report per tier, requires all three to pass, and assembles the same seven-key verdict `close`
+already consumed — then runs that verdict through `close`'s own `verdict_violations` before
+writing it, so a certification cannot hand the run a verdict its consumer refuses. No field is
+used for something it does not mean: `confirms` → `done`, `not_examined` → `not_verified`, a
+`risk` finding → a blocker with `can_continue_around: true`.
+
+**Two rules give a pass its meaning.** A tier cannot pass on an empty `scope` — a report naming
+nothing it read is a rubber stamp, and three rubber stamps cost three times one verifier while
+reading as three times the assurance, which is strictly worse than what they replaced. And a tier
+cannot pass while carrying a `breaks` finding. There are two severities and no third, because a
+certification that admits a maybe admits everything.
+
+**The fix cycle records itself.** A failing round leaves the node open and writes its round number,
+this round's three verdicts and the whole history onto the node — on failure too, because a failing
+round that wrote nothing would erase the only evidence that a node is churning. Every `breaks`
+finding carries the `check` that will prove its fix, so it becomes a node the next round can close.
+At the ceiling (`--ceiling`, default 3) the gate **measures rather than stops**: it names the tier
+that has failed *every* round, because the same tier failing three times is a planning defect
+wearing a verification failure's clothes, and different tiers each round is churn across levels.
+
+### The verification of this change, and what it caught in itself
+
+`test/certify_mutations.py` disables each of the gate's sixteen rules in a copy of the tree and
+requires a fixture whose name begins `certify:` to notice. **16 of 16 noticed.** It is wired into
+`test:all`, and it exists because the first two attempts at this pass were both wrong:
+
+* The first reported **11 of 11 killed** and proved nothing — every mutant had died of the same
+  unrelated fixture, because the copy has no `.git` and one pre-existing case checks the commit
+  stamp. A mutant is killed only by a `certify:` fixture now.
+* Fixing that reported **0 of 16** and explained why: the twenty new fixtures had been inserted
+  **below** `graph_test.py`'s `if failures: sys.exit(1)`, so any earlier failure skipped all of
+  them. Locally everything was green and they ran; in CI, on the run where they mattered, they
+  would not have. The block moved above the summary, and the mutation pass now asserts its own
+  control — that exactly twenty ran and none was red — before reporting a single result.
+
+149 graph fixtures, 20 of them new. `references/certification.md` is the doctrine; the three
+agents ship beside `verifier.md`, which now points at them.
+
+### The first live dispatch, and what it caught
+
+The fixtures prove the **gate**. Whether the shipped agent prose yields a usable report is a live
+dispatch, so one was run: all three tiers against `sheleg-design@f88c14b`, a strict reduced-motion
+check that had shipped green through a single verdict hours earlier.
+
+All three returned a well-formed eight-key report. **Two returned `fail`, with five `breaks`
+findings between them.** The unit tier ran the node's check in an isolated worktree at the
+certified commit, ran its own negative control, and put a cross-level observation in
+`not_examined` rather than claiming it — which is the instruction that keeps the levels apart.
+
+What the independence bought, stated as measurements rather than as a claim about the design:
+
+* the **seam** tier instrumented the gate's `check()` calls and found the ratchet prices the
+  *exception* rather than the rule — collapsing the four durations the requirement names as its
+  first remediation dropped the count by 4 against its floor and turned the suite red on the
+  stricter answer
+* the **product** tier planted a defect and watched it pass: a duration whose token name carries
+  no duration word was outside the walk entirely, and thirteen such tokens across ten layers were
+  clean by habit rather than by the check
+* **both outer tiers independently** found a propagation-matrix row still stating the obligation
+  the change had replaced — two blind readings converging is the signal that they are reading
+  different things
+
+None of the five is a bug in the changed lines, which is the class this gate was built for. They
+are fixed in `sheleg-design@874ba17`; four further findings are filed there as decisions rather
+than repairs. The one about the author is filed too: every ratchet floor set that day sits below
+its true count, because the sequence was measure, keep editing, restate.
+
+Guards: 412 → **412**, and the flatness is the honest number — written in that exact shape
+because the guard reads it:  this release adds no validator
+negative, because every rule it adds lives in `scripts/graph.py` rather than in `validate.py`, and
+`.github/workflows/validate.yml` plants defects for the second. The certification's own negative
+control is `npm run test:certify` — **16 mutations, 16 noticed** — wired into `test:all` beside
+the 14 property checks. A guard count that rose here would be a number borrowed from a suite that
+never ran.
+
+**The shape of that line is load-bearing, and this is the second time it has bitten.** The
+v1.39.0 entry wrote the count with no colon, the pattern missed, and `npm test` was green over
+a number it had never read. This release first wrote it with the bold around the whole phrase
+instead of around the second number, and the same guard went silent again. The readable shape is
+`Guards: N → **M**`, and the negative test that plants a stale count is the only reason either
+miss was caught.
+
+**Neither wrong form is reproduced here, and that is deliberate.** Writing the bad example with
+real digits makes it a second readable count in this section — which is exactly what happened on
+the first attempt: the plant removed the real count, the narrative about the mistake still
+matched, and the guard stayed silent over a section that no longer stated anything. A document
+that quotes a form as an example is indistinguishable from the form itself.
+
 ## v1.73.0 — 2026-08-20 — the registry could not see the templates, the scripts, or its own registers
 
 

package/README.md

@@ -154,6 +154,7 @@ until it is installed.
 | 3 Spec | [`spec.md`](plugins/task-pipeline/skills/task-pipeline/references/spec.md) — UX-track order, locked contracts, global constraints, self-review |
 | 4 Plan | [`planning.md`](plugins/task-pipeline/skills/task-pipeline/references/planning.md) — zero-context tasks, parallel groups, no placeholders |
 | the queue | [`work-graph.md`](plugins/task-pipeline/skills/task-pipeline/references/work-graph.md) — a script walks the graph so the model never reads it: 400 nodes and 4 print the same 27-byte frontier |
+| closing a node | [`certification.md`](plugins/task-pipeline/skills/task-pipeline/references/certification.md) — three blind readings at escalating visibility (the changed code, what reaches it, the product around it), all three required to pass; a failing round records itself and the node stays open |
 | 5 Build | [`build.md`](plugins/task-pipeline/skills/task-pipeline/references/build.md) + [`review.md`](plugins/task-pipeline/skills/task-pipeline/references/review.md) — isolation, ledger, subagent loop, review rubric, fix loop |
 | 5–6 TDD | [`tdd.md`](plugins/task-pipeline/skills/task-pipeline/references/tdd.md) — the iron law, red/green/refactor, the suite gate |
 | 5, 6, 8 The browser | [`browser.md`](plugins/task-pipeline/skills/task-pipeline/references/browser.md) — the ref model both channels share, the four commands the look is made of, sessions, and the three different things *"tested in a browser"* means |

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.73.0 |
+| **Version** | 1.74.0 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki, and **one of two browser channels** — `playwright` (CLI or MCP) or `chrome-devtools` (MCP); either satisfies the browser step and neither is required. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/package.json

@@ -1,19 +1,20 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.73.0",
+  "version": "1.74.0",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"
   },
   "scripts": {
     "test": "python3 test/validate.py && python3 test/graph_test.py",
-    "test:all": "python3 test/validate.py && python3 test/graph_test.py && python3 test/negatives.py && npm run test:exposure && npm run test:probe && npm run test:hooks && npm run test:artifacts && npm run test:docs",
+    "test:all": "python3 test/validate.py && python3 test/graph_test.py && python3 test/negatives.py && npm run test:certify && npm run test:exposure && npm run test:probe && npm run test:hooks && npm run test:artifacts && npm run test:docs",
     "test:negatives": "python3 test/negatives.py",
     "test:exposure": "python3 test/exposure_test.py",
     "test:probe": "python3 test/probe.py --self-test",
     "test:hooks": "python3 test/release_gate_test.py",
     "test:artifacts": "python3 test/artifact_root_test.py && python3 test/migrate_artifacts_test.py",
-    "test:docs": "bash plugins/task-pipeline/skills/task-pipeline/templates/docgate.sh"
+    "test:docs": "bash plugins/task-pipeline/skills/task-pipeline/templates/docgate.sh",
+    "test:certify": "python3 test/certify_mutations.py"
   },
   "files": [
     "bin",

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs). Retro insights can publish upstream as issues, opt-in and redacted.",
-  "version": "1.73.0",
+  "version": "1.74.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/agents/verifier-product.md

@@ -0,0 +1,96 @@
+---
+name: verifier-product
+description: Tier 3 of a three-tier certification. Reads the documentation, the scenarios and the neighbouring features, and reports whether the change leaves any documented or user-facing behaviour false, and whether it collides with another feature that shares the path. Returns an eight-key tier report. Use as one of three blind readings when a task-pipeline node claims to be finished. Not for line-level correctness, which is the unit tier, and not for call graphs, which is the seam tier.
+model: inherit
+tools: Read, Grep, Glob, Bash
+---
+
+# Product tier — what the product now says, and whether it is still true
+
+You are the **furthest** of three readings. One agent has the diff and one has the
+call graph; you will see neither report and neither will see yours. Blind is the
+point, and at this distance it matters most: an agent that has just read a
+convincing account of the implementation will paraphrase it back as product truth.
+
+Your subject is **behaviour and what claims it.** Documentation, scenarios, the
+changelog, ADRs, the runbook, the strings a user reads, and the other features that
+share this path. You may open code to confirm a behaviour — but code is your
+evidence, never your scope. If your report describes functions, you have written a
+third unit-tier report and the level the user built this gate for went unread.
+
+## Read the claims before you judge the change
+
+1. **The requirement, in the words the product uses.** The node's `serves` is the
+   standard; the product's own wording of it is the thing that must still hold.
+2. **The documents that describe this behaviour.** `docs/`, `README`, the
+   changelog, `CONTEXT.md`, ADRs, the runbook. Where `docs/ux/scenarios.md` exists
+   it is the source of truth for user-facing behaviour — `super-ux` owns it, and a
+   change to user-facing behaviour is supposed to update it in the same change.
+3. **The strings a person sees.** An error message, an empty state, a label, an
+   email. A behaviour change that leaves the old wording in place is a lie shipped
+   in the product's own voice.
+4. **The neighbouring features that share this path.** Not the callers — the
+   *features*. Two flows that both end at this behaviour, a report that counts
+   these events, an export, a webhook, an admin screen, a metric on a dashboard.
+5. **The interaction the change creates.** What is now possible that was not, and
+   what does the rest of the product do when it happens? A new state usually has to
+   be handled in three places nobody listed: a list view, a filter, and a total.
+
+## The six things that are true at this level and invisible below it
+
+- **A documented behaviour is now false.** The commonest, and the cheapest to fix
+  in the same change.
+- **A scenario no longer holds** — the steps still describe the old path.
+- **A user-visible change nobody wrote down.** It shipped, and support will find it.
+- **A second feature reaches the same behaviour** and was not considered.
+- **A number the product reports moves** — a count, a total, a metric — because the
+  set it counts changed.
+- **A migration or a mixed state.** Data written before the change, in-flight
+  requests, a cached response, a client on the old version.
+
+## `breaks` or `risk`
+
+- **`breaks`** — the product now claims something untrue, or a documented behaviour
+  or scenario is contradicted, or another feature is broken by the interaction.
+  Carries a `check` that will prove the fix. *"Documentation ships in the same
+  change as the code; in the next ticket it never ships at all."*
+- **`risk`** — a claim you cannot resolve without the operator, a metric that
+  probably moves, a mixed-state window that probably closes on its own. It ships,
+  named, and reaches the closing verdict as a blocker the run can continue around.
+
+## The report — all eight keys, and `[]` is an answer
+
+```json
+{
+  "node": "N-007",
+  "tier": "product",
+  "verdict": "fail",
+  "scope":        ["docs/ux/scenarios.md:S-04 — the checkout decline flow",
+                   "README.md:120-140 — 'a declined card raises PaymentError'",
+                   "the two features that reach this behaviour: checkout, and the retry job",
+                   "the admin Payments list, which filters on state"],
+  "confirms":     ["scenario S-04's steps still describe what the product does"],
+  "findings":     [{ "what": "the README documents an exception the product no longer raises",
+                     "where": "README.md:131", "severity": "breaks",
+                     "fix": "state the return value, and note the version it changed in",
+                     "check": "judgement — the README's payment section read against the new return path" }],
+  "evidence":     ["read docs/ux/scenarios.md:S-04 — steps unchanged by this behaviour",
+                   "grep -rn 'PaymentError' docs README.md → 2 hits, both in the payment section"],
+  "not_examined": ["whether the finance export counts declines, which needs the operator"]
+}
+```
+
+**A `check` may be a judgement here, and it is written as one** — named, not dressed
+as an exit code. `references/gates.md` says which is which; recording a judgement as
+a command is how a document acquires proof it never had.
+
+## Three ways this goes wrong
+
+| Temptation | Why it is wrong |
+|---|---|
+| «The implementation is sound» | Not your level, and you are the agent least equipped to say it. Two readings already covered the code with context you do not have |
+| «No docs mention this» | Then your `scope` names the searches that found none, and *nothing documents a user-facing behaviour* is itself a finding |
+| «Docs can follow in the next ticket» | In the next ticket they never ship. A behaviour change with no document is `breaks` at this tier, and the fix is one paragraph |
+
+Doctrine: `references/certification.md`. What proof a document owes:
+`references/documentation.md`. Scenarios: `super-ux`, `docs/ux/scenarios.md`.

package/plugins/task-pipeline/agents/verifier-seam.md

@@ -0,0 +1,98 @@
+---
+name: verifier-seam
+description: Tier 2 of a three-tier certification. Reads everything that can REACH the change — callers, callees, implementors, shared state, config, and the neighbours' tests — and reports whether a contract moved under something that depends on it. Returns an eight-key tier report. Use as one of three blind readings when a task-pipeline node claims to be finished. Not for re-reading the diff, which is the unit tier, and not for documentation, which is the product tier.
+model: inherit
+tools: Read, Grep, Glob, Bash
+---
+
+# Seam tier — what depends on the change, and did not change with it
+
+You are the **middle** of three readings. One agent is reading the diff itself and
+another is reading the product around it; you will never see either report, and
+they will never see yours. Blind is the point — three readings that inform each
+other are one opinion with three signatures.
+
+Your subject is **the seam**: everything that can reach the changed code, and
+everything the changed code can reach. Not the hunks. If your `scope` is mostly
+the same lines the diff shows, you have re-run the unit tier and the middle level
+went unread — which is the level the user's whole reason for this gate lives at.
+
+## Find the neighbours before you judge anything
+
+You cannot report on dependents you never enumerated, so enumerate first and put
+the enumeration in `scope`:
+
+1. **Callers.** Grep the changed symbols across the repository, including tests,
+   scripts and configuration. A call site in a fixture is a call site.
+2. **Callees.** What the change now calls that it did not before, and what it
+   stopped calling. A dropped call is invisible in a diff read forwards.
+3. **Implementors and subclasses.** If the change touched an interface, a base
+   class, a protocol or a duck-typed contract, every implementation is a dependent.
+4. **Shared state.** A module-level constant, a cache, a global, a database column,
+   a file on disk, an environment variable, a lock. Two readers of one mutable
+   thing are a seam even with no call between them.
+5. **The neighbours' tests.** A test that exercises a caller is your evidence that
+   the caller still works — or your finding that nothing covers it.
+6. **A second implementation of the same rule.** The duplicate that did *not* get
+   the fix is the single most common thing this tier exists to catch.
+
+Where a code graph exists (`graphify-out/graph.json`), it answers *reach* directly
+and grep cannot — `references/knowledge-graph.md`.
+
+## The seven contracts that move without anybody noticing
+
+- **Signature** — an argument added, reordered, renamed, or made required
+- **Return shape** — a field added or dropped, a list becoming a generator, `None`
+  becoming an empty list, a dict becoming an object
+- **Errors** — a new exception a caller does not catch, or an exception replaced by
+  a return value the caller reads as success
+- **Nullability** — something that could not be absent now can
+- **Ordering and timing** — a sort dropped, a call moved before or after another,
+  an operation that used to be atomic
+- **Units and encoding** — seconds to milliseconds, cents to units, bytes to a
+  string, a naive datetime to an aware one
+- **Idempotence and side effects** — a function that could be called twice and now
+  cannot, or a write that used to happen once
+
+For each one you find, name the **dependent** in `where`, not the change. The
+change is the unit tier's subject; the thing that will break is yours.
+
+## `breaks` or `risk`
+
+- **`breaks`** — a dependent is now wrong, or a contract moved under one and
+  nothing updated it. Carries a `check` that will prove the fix, because the
+  finding becomes a node the next round has to close.
+- **`risk`** — a dependent that is *probably* fine and nothing proves it: a caller
+  with no test, a duplicate implementation that happens to agree today. It ships,
+  and it reaches the closing verdict as a blocker the run can continue around.
+
+## The report — all eight keys, and `[]` is an answer
+
+```json
+{
+  "node": "N-007",
+  "tier": "seam",
+  "verdict": "fail",
+  "scope":        ["3 callers of charge(): api/checkout.py:44, jobs/retry.py:19, tests/test_api.py:120",
+                   "1 other implementation of the decline rule: legacy/billing.py:301",
+                   "shared: PAYMENT_STATES in src/pay/states.py, read by both"],
+  "confirms":     ["both live callers already treat Declined as a value, so the new return path is handled"],
+  "findings":     [{ "what": "legacy/billing.py still raises on a decline, so the two paths disagree",
+                     "where": "legacy/billing.py:301", "severity": "breaks",
+                     "fix": "route legacy through charge() or apply the same rule",
+                     "check": "pytest tests/test_legacy_decline.py -q" }],
+  "evidence":     ["grep -rn 'charge(' → 3 call sites, listed in scope",
+                   "pytest tests/test_api.py -q → 12 passed"],
+  "not_examined": ["the retry job's integration test, which needs a broker this box has no access to"]
+}
+```
+
+## Three ways this goes wrong
+
+| Temptation | Why it is wrong |
+|---|---|
+| «The diff looks correct» | You were not asked about the diff. Another agent has it, with more context than you, and your saying so leaves the seam unread |
+| «Nothing calls it» | Then say so in `scope` with the search you ran, including tests and config. *Nothing calls it* is a finding when something should |
+| «The callers' tests pass» | Which callers, and did any test exercise the path that moved? A suite that never reached the seam proves the suite ran |
+
+Doctrine: `references/certification.md`. Reach: `references/knowledge-graph.md`.

package/plugins/task-pipeline/agents/verifier-unit.md

@@ -0,0 +1,86 @@
+---
+name: verifier-unit
+description: Tier 1 of a three-tier certification. Reads only the code that changed — the functions, classes and branches in the diff — runs the node's own check, and reports whether the change does what was asked and breaks nothing inside its own unit. Returns an eight-key tier report. Use as one of three blind readings when a task-pipeline node claims to be finished. Not for reviewing style, and not for looking at callers — that is the seam tier.
+model: inherit
+tools: Read, Grep, Glob, Bash
+---
+
+# Unit tier — the code that changed, and nothing else
+
+You are the **closest** of three readings. Two other agents are reading the same
+node one and two levels out, and you will never see their reports. That is
+deliberate: three readings that inform each other are one opinion with three
+signatures, and the disagreement between blind readings is the instrument.
+
+Your subject is **the diff and the unit it lands in.** The functions, methods,
+classes and branches that changed, plus whatever in the same file or module the
+change reads and writes. If you find yourself opening a caller in another module
+to decide something, stop — that finding belongs to the seam tier and reporting it
+as yours costs the certification a level.
+
+## What you actually do
+
+1. **Read the node's `serves`.** The REQ or goal clause is the standard. Not what
+   the diff does — what was asked.
+2. **Run the node's `check`.** One command, or the named judgement where no
+   command decides it. Its output is your first `evidence` row. Not `npm test`
+   when the node named something narrower.
+3. **Read every changed hunk against the requirement**, and then read the parts of
+   the unit the hunk touches but the diff does not show — the other branches of the
+   same function, the sibling method that shares the field, the error path.
+4. **Look for the five things that break a unit from inside:**
+   - a branch the change added that nothing exercises
+   - an error or empty path the change routes into differently than before
+   - a boundary the change moved (off-by-one, inclusive/exclusive, first/last)
+   - state the change mutates that another method in the same class assumes
+   - a value the change computes twice, so the two can disagree
+5. **Say what you read.** `scope` is a list of what you actually opened, with
+   `file:line` ranges. A pass on an empty `scope` is refused by
+   `graph.py certify` by name, as a rubber stamp — and it is right to.
+
+## `breaks` or `risk`, and the line is not taste
+
+- **`breaks`** — the node is not done. The requirement is unmet, or the change is
+  wrong on a path a caller can reach. Every `breaks` finding carries a `check`:
+  the command or judgement that will prove the fix, because the finding becomes a
+  node the next round has to close.
+- **`risk`** — found, judged survivable, and named. It ships, and it appears in the
+  closing verdict as a blocker the run can continue around. Use it for the thing
+  you would say in review and would not block on.
+
+There is no third value, because a certification that admits a maybe admits
+everything.
+
+## The report — all eight keys, and `[]` is an answer
+
+```json
+{
+  "node": "N-007",
+  "tier": "unit",
+  "verdict": "pass",
+  "scope":        ["src/pay/charge.py:88-140 — charge() and its three branches",
+                   "src/pay/charge.py:210-232 — _retry, which charge() now calls"],
+  "confirms":     ["a declined card returns Declined instead of raising, which REQ-004 asked for"],
+  "findings":     [{ "what": "…", "where": "src/pay/charge.py:131",
+                     "severity": "breaks", "fix": "…", "check": "…" }],
+  "evidence":     ["pytest tests/test_charge.py::test_declined -q → 1 passed",
+                   "read charge() at src/pay/charge.py:88-140"],
+  "not_examined": ["the retry backoff constants, which no test in this unit covers"]
+}
+```
+
+`not_examined` is the field that keeps a pass honest: it is what you saw and could
+not check. It flows into the closing verdict as `not_verified`, which is what
+*present and unchecked* means one level up. An empty list is a valid answer and
+silence is not.
+
+## Three ways this goes wrong
+
+| Temptation | Why it is wrong |
+|---|---|
+| «The suite is green, so it is done» | The node serves a requirement, not a suite. A green run that never exercised the requirement proves the run happened |
+| «This caller looks wrong too» | Not your level. Say it in `not_examined` if you must, and let the seam tier find it with the context to judge it |
+| «Nothing to report, pass» | Then `scope` says what you read and `confirms` says what is now true. A pass that names neither is the one thing this tier cannot return |
+
+Doctrine: `references/certification.md`. The node's own contract:
+`references/work-graph.md`.

package/plugins/task-pipeline/agents/verifier.md

@@ -7,6 +7,15 @@ tools: Read, Grep, Glob, Bash
 
 # Verifier — accept the work, or say precisely what is missing
 
+> **A node is normally closed by three readings, not by this one.**
+> `verifier-unit`, `verifier-seam` and `verifier-product` each report at a
+> different distance, `graph.py certify` requires all three to pass and assembles
+> the verdict below from them — because a change can be correct where it was made
+> and wrong one level out, and a single context cannot see both. Doctrine:
+> `references/certification.md`. This agent remains for the case `certify` does not
+> cover: a verdict already in flight, or a hand-written one fed to
+> `close --verdict` directly. Reach for the three tiers first.
+
 You close **one node**. You do not fix, you do not implement, and you do not
 review style. You answer four questions about work that claims to be finished, and
 your answer moves the graph.

package/plugins/task-pipeline/skills/task-pipeline/SKILL.md

@@ -59,6 +59,7 @@ gate stops until it is installed.
 | 3 Spec | `references/spec.md` |
 | 4 Plan | `references/planning.md` |
 | the queue the loop walks | `references/work-graph.md` |
+| 5–8 · how a node is CLOSED — three blind readings at three distances, all three required | `references/certification.md` |
 | 5 Build (worktree, subagents, fix loop) | `references/build.md` + `references/review.md` |
 | 5–6 TDD + suite gate | `references/tdd.md` |
 | 5, 6, 8 The browser — the look, the spec suite, and the difference | `references/browser.md` |

package/plugins/task-pipeline/skills/task-pipeline/graph.schema.json

@@ -117,7 +117,7 @@
           "not": {
             "pattern": "[\\n\\r]"
           },
-          "description": "**How this node will be closed** \u2014 the command a verifier runs, or the named judgement that stands in where no command can (`references/gates.md`'s third gate type: name the judge, record the verdict AS judgement). Its output becomes the node's `evidence` row.\n\nRequired on every node except a `parked` one, and that is the whole point of the field: `agents/verifier.md` tells the verifier to run *the check this node names*, so a node with none leaves it the two options that same paragraph forbids \u2014 invent a check, or run everything. Shipped doctrine read a field the schema did not have (B-080); the field the doctrine reads now exists.\n\nOne string, never a list, because the requirement it serves is singular throughout \u2014 one input, one job, one output, one owner, **one** completion test. A node needing two unrelated checks is a node doing two jobs, and the answer is to split it rather than to widen this field. One gate made of two commands is `a && b`, which is still one gate.\n\nA `parked` node is exempt because it is the one node nobody will close, and a placeholder there \u2014 *n/a, parked* \u2014 is the confidence-without-correctness this schema refuses everywhere else. The field survives a park: `park` sets the status and never removes what the node said it would run."
+          "description": "**How this node will be closed** — the command a verifier runs, or the named judgement that stands in where no command can (`references/gates.md`'s third gate type: name the judge, record the verdict AS judgement). Its output becomes the node's `evidence` row.\n\nRequired on every node except a `parked` one, and that is the whole point of the field: `agents/verifier.md` tells the verifier to run *the check this node names*, so a node with none leaves it the two options that same paragraph forbids — invent a check, or run everything. Shipped doctrine read a field the schema did not have (B-080); the field the doctrine reads now exists.\n\nOne string, never a list, because the requirement it serves is singular throughout — one input, one job, one output, one owner, **one** completion test. A node needing two unrelated checks is a node doing two jobs, and the answer is to split it rather than to widen this field. One gate made of two commands is `a && b`, which is still one gate.\n\nA `parked` node is exempt because it is the one node nobody will close, and a placeholder there — *n/a, parked* — is the confidence-without-correctness this schema refuses everywhere else. The field survives a park: `park` sets the status and never removes what the node said it would run."
         },
         "evidence": {
           "type": [
@@ -145,6 +145,89 @@
             "pattern": "\\S"
           },
           "description": "What this node MUTATES — paths, register names, remote resource ids. `references/planning.md` states the rule the frontier needs: *distinct is not the same as independent, and the check is what they touch, never what they are called.* That rule lived in the markdown plan, and the graph replaced the plan as the thing deciding what runs next — so `next` could hand two agents two runnable nodes that write the same file, with nothing able to report it.\\n\\nOptional, and its absence is DISCLOSED rather than treated as «touches nothing»: `next` prints how many frontier nodes declared no targets, because a quiet run and a checked one must not look alike."
+        },
+        "certification": {
+          "type": "object",
+          "description": "What the three-tier certification recorded for this node. Written by `graph.py certify` on every round, pass or fail: a failing round that wrote nothing would erase the only evidence that a node is churning, which is the number the loop-guard ceiling reads.",
+          "additionalProperties": false,
+          "required": [
+            "round",
+            "tiers",
+            "at",
+            "history"
+          ],
+          "properties": {
+            "round": {
+              "type": "integer",
+              "minimum": 1
+            },
+            "tiers": {
+              "type": "object",
+              "additionalProperties": false,
+              "required": [
+                "unit",
+                "seam",
+                "product"
+              ],
+              "properties": {
+                "unit": {
+                  "enum": [
+                    "pass",
+                    "fail"
+                  ]
+                },
+                "seam": {
+                  "enum": [
+                    "pass",
+                    "fail"
+                  ]
+                },
+                "product": {
+                  "enum": [
+                    "pass",
+                    "fail"
+                  ]
+                }
+              }
+            },
+            "at": {
+              "type": "string",
+              "minLength": 1
+            },
+            "history": {
+              "type": "array",
+              "minItems": 1,
+              "items": {
+                "type": "object",
+                "additionalProperties": false,
+                "required": [
+                  "unit",
+                  "seam",
+                  "product"
+                ],
+                "properties": {
+                  "unit": {
+                    "enum": [
+                      "pass",
+                      "fail"
+                    ]
+                  },
+                  "seam": {
+                    "enum": [
+                      "pass",
+                      "fail"
+                    ]
+                  },
+                  "product": {
+                    "enum": [
+                      "pass",
+                      "fail"
+                    ]
+                  }
+                }
+              }
+            }
+          }
         }
       },
       "allOf": [

package/plugins/task-pipeline/skills/task-pipeline/references/certification.md

@@ -0,0 +1,146 @@
+# Certification — three readings at three distances, and all three must pass
+
+A node is not closed by one agent's opinion. It is closed by **three independent
+readings at escalating visibility**, and the run may not advance until all three
+pass.
+
+## Contents
+
+- Why one verifier is not enough, stated as the failure it produces
+- The three tiers
+- Blind, and it is the whole design
+- A pass has to mean something, so two rules have teeth
+- The report, and where each field lands
+- The commands
+- The fix cycle, and its ceiling
+- What this costs, said out loud
+- Rationalizations
+
+## Why one verifier is not enough, stated as the failure it produces
+
+A verifier reads the diff it was handed. That is not a shortcoming of the agent; it
+is the definition of its context. And it means a whole class of defect is invisible
+to it by construction:
+
+- the change is correct where it was made, and a **caller's contract moved** under it
+- a **second implementation of the same rule** did not get the fix
+- a **documented behaviour** is now false, and the document still reads as true
+- **another feature** reaches the same path and nobody considered the interaction
+
+None of these is a bug in the changed lines. All of them ship. Each is found by
+looking one level further out than the change — which is a different reading, not a
+longer one, because the context that finds it is the context that excludes the diff.
+
+## The three tiers
+
+| Tier | Subject | Characteristic finding |
+|---|---|---|
+| `unit` | the changed functions, classes and branches, plus the node's own `check` | a branch nothing exercises; a boundary that moved |
+| `seam` | everything that can reach the change — callers, callees, implementors, shared state, the neighbours' tests | a contract that moved under a dependent; the duplicate that did not get the fix |
+| `product` | documentation, scenarios, user-visible strings, and the neighbouring features that share this path | a documented behaviour that is now false; an interaction nobody listed |
+
+Agents: [`../../../agents/verifier-unit.md`](../../../agents/verifier-unit.md),
+[`verifier-seam.md`](../../../agents/verifier-seam.md),
+[`verifier-product.md`](../../../agents/verifier-product.md).
+
+## Blind, and it is the whole design
+
+**The three run in parallel and no tier reads another's report.** Three readings
+that inform each other are one opinion with three signatures — and the failure mode
+is specific: an agent that has just read a convincing account of the implementation
+will paraphrase it back as product truth. The disagreement between blind readings is
+the instrument, so `graph.py certify` refuses a report whose prose cites another
+tier's verdict.
+
+Dispatch all three in one message so they run concurrently. Give each the node id,
+its `serves`, and the diff — nothing else, and never another tier's output.
+
+## A pass has to mean something, so two rules have teeth
+
+**A tier cannot pass on an empty `scope`.** `scope` is what the tier actually
+opened, with `file:line`. A report that names nothing it read is a rubber stamp, and
+three rubber stamps cost three times one verifier while reading as three times the
+assurance — strictly worse than the single verdict it replaced. `certify` refuses it
+by name.
+
+**A tier cannot pass while carrying a `breaks` finding.** There are two severities
+and no third, because a certification that admits a maybe admits everything:
+
+- **`breaks`** — the node is not done. Carries a `check`: the command or judgement
+  that will prove the fix, for the same reason `replan.add` does. The finding
+  becomes a node the next round has to close, and handing that node the absence is
+  how the defect returns one round later.
+- **`risk`** — found, judged survivable, and named. It ships, and it reaches the
+  closing verdict as a blocker with `can_continue_around: true`, which is exactly
+  what a named survivable finding is.
+
+## The report, and where each field lands
+
+Eight keys, all required, `[]` a valid answer and silence not one. On a pass
+`certify` assembles the canonical seven-key verdict that
+[`work-graph.md`](work-graph.md) already specifies, and no field is used for
+something it does not mean:
+
+| Tier field | Becomes | Because |
+|---|---|---|
+| `confirms` | `done` | asked for, and now true |
+| `not_examined` | `not_verified` | present, and no check touched it |
+| `findings` at `risk` | `blockers`, `can_continue_around: true` | found, judged survivable, named |
+| `evidence` | `evidence`, prefixed with the tier | the command and what it printed |
+
+`certify` runs the assembled verdict through the same `verdict_violations` gate
+`close` will apply, so a certification cannot hand the run a verdict its own
+consumer refuses.
+
+## The commands
+
+```bash
+# three reports in, one verdict out — exits 1 if any tier failed
+graph.py certify --node N-007 \
+    --tier unit.json --tier seam.json --tier product.json
+
+# unchanged, and still the only thing that moves the graph
+graph.py close --verdict .task-pipeline/verdict-N-007.json
+```
+
+## The fix cycle, and its ceiling
+
+A failing round **records itself and leaves the node open.** `certification` on the
+node carries the round number, this round's three verdicts and the history of every
+round — written on failure too, because a failing round that wrote nothing would
+erase the only evidence that a node is churning.
+
+The cycle is: `certify` → fail → the `breaks` findings become nodes (each already
+carrying its `check`) → fix → `certify` again, round `N+1`. Same three tiers, same
+blind dispatch. A tier that passed in an earlier round is **re-run**, because the
+fix is a new change and the level it passed on is not the level it now faces.
+
+**At the ceiling the gate measures rather than stops** —
+[`loop-guard.md`](loop-guard.md). `--ceiling` defaults to 3. At or over it, `certify`
+still runs and still reports the tiers; what it adds is the name of the tier that
+has failed **every** round. A run spinning on one level needs the operator to see
+*which* level:
+
+- the same tier every round → the level is being misread, or the node is the wrong
+  shape. Not one fix away. Re-plan the node, do not attempt round four.
+- different tiers each round → churn across levels. Usually one requirement that
+  was never decided, surfacing at whichever distance looks at it.
+
+## What this costs, said out loud
+
+Three agents per node instead of one. That is the price of the visibility, and it is
+paid per node rather than per run. The three are dispatched in parallel, so the
+wall-clock cost is roughly one reading; the token cost is three. A node whose
+`check` is mechanical and whose blast radius is genuinely nil still pays it — and a
+tier with nothing to find says so in `scope` and `not_examined` rather than being
+skipped, because **a skipped level and a clean level are indistinguishable
+afterwards**, and only one of them is evidence.
+
+## Rationalizations
+
+| Temptation | Why it is wrong |
+|---|---|
+| «All three would say the same thing» | Then all three say it, at a cost you already know, and the run has three signatures instead of one guess about what the other two would have found |
+| «The seam tier can read the unit report first — it saves tokens» | It saves tokens by removing the second opinion. The reports are cheap; the independence is the product |
+| «Tier 3 passed last round, skip it» | The fix is a new change. A tier's pass is about the tree it read, and that tree moved |
+| «Round 4 will get it» | Read the ceiling's output. The same tier failing three times is a planning defect wearing a verification failure's clothes |

package/plugins/task-pipeline/skills/task-pipeline/references/portability.md

@@ -71,6 +71,7 @@ a row pointing outside the bundle is the defect this file exists to catch.
 | What a spec must lock, the UX-track order, the module dossier | `references/spec.md` |
 | The zero-context plan format, parallel groups, set equality | `references/planning.md` |
 | The work graph: its fields, the verbs and their exit codes, and the three invariants a schema cannot state | `references/work-graph.md`, `scripts/graph.py`, `graph.schema.json` |
+| How a node is CLOSED: three blind readings at escalating visibility, all three required, and the round ledger the ceiling reads | `references/certification.md`, `agents/verifier-{unit,seam,product}.md`, `scripts/graph.py certify` |
 | Workspace isolation, the subagent loop, who may write the register | `references/build.md` |
 | The review rubric, diff packages, the three verdicts | `references/review.md` |
 | **False success** — the class, its known shapes and its two rules | `references/gates.md` |

package/plugins/task-pipeline/skills/task-pipeline/references/stages.md

@@ -273,6 +273,12 @@ never that the work was skipped quietly.
   `next` refuses to walk one. The reason to prefer it over a prose plan is measured, not
   aesthetic: a 400-node graph and a 4-node graph produce the same 27-byte frontier, so the
   cost of knowing what is next does not grow with the programme.
+- **And the check is what THREE readings will run, not one**
+  ([`certification.md`](certification.md)). A node is closed by `unit`, `seam` and `product`
+  reports, dispatched blind and in parallel, and `certify` refuses the close until all three
+  pass. That is a planning fact, not only a verification one: a node whose blast radius nobody
+  can name is a node the seam and product tiers cannot scope, so `touches` and `serves` are
+  what make the two outer readings possible at all.
 - **The queue exists here, so the loop arms here** ([`continuity.md`](continuity.md) →
   *Part 1a*). Where `run.loop.arm` is `after-decomposition` and the map holds more than
   one module, arm the mode at the close of this stage and print one line: the mode, and

package/plugins/task-pipeline/skills/task-pipeline/references/work-graph.md

@@ -59,6 +59,7 @@ conditional on the code, never merely sequenced after it.**
 | `goal` | the release goal | `0` · `3` unstated |
 | `add` | the id it allocated | `0` · `1` refused |
 | `park` | the id and the reason | `0` · `1` refused |
+| `certify` | the round, and on a failure every `breaks` finding with its fix and its check | `0` all three tiers passed · `1` a tier failed, or a report is malformed |
 | `close` | the goal, the new frontier count, and what was not verified | `0` · `1` refused **or the verdict stops the run** |
 | `producer` | what produced this proof — actor, model, runtime, skill, config, commit, trace | `0` |
 | `doctrine` | how many of the bundle's reference files this run opened | `0` |
@@ -77,6 +78,8 @@ A **`parked`** node is the single exemption: it is the one node nobody will clos
 *n/a — parked* in that field is confidence without correctness. `park` never removes what
 the node said it would run.
 
+**A node is closed by three readings, not one.** `certify` takes one tier report from each of `unit`, `seam` and `product` — dispatched blind and in parallel — requires all three to pass, and assembles the seven-key verdict `close` consumes. `close`'s contract is unchanged; what changed is that the verdict is now built from three readings at different distances instead of written from one, because a change can be correct where it was made and wrong one level out. A failing round records itself and leaves the node open. Doctrine: [`certification.md`](certification.md).
+
 **`close` stamps the commit; the verifier never supplies it.** A verdict written after the
 tree moved is evidence about a different tree, and an agent cannot name the wrong commit if
 it is never the one naming one.

package/plugins/task-pipeline/skills/task-pipeline/scripts/graph.py

@@ -515,6 +515,139 @@ def verdict_violations(v):
     return out
 
 
+# --- certification: three tiers, one node ------------------------------------
+#
+# One verifier reads the diff it was handed. That is the whole limitation this
+# section exists for: a change can be correct where it was made, and wrong one
+# level out — a caller whose contract moved, a module whose invariant the new
+# branch breaks, a documented behaviour nobody re-read. The single verdict cannot
+# see any of it, because the context it was given was the change.
+#
+# So a node is closed by THREE reports at escalating visibility, produced
+# independently and blind to each other:
+#
+#   unit     the code that changed — the functions, classes and branches in the
+#            diff, and the node's own `check`
+#   seam     one level out — callers, callees, shared state, the contracts and
+#            tests of the neighbours the change can reach
+#   product  one level out again — the documentation, the scenarios, how this
+#            behaviour interacts with the rest of the product
+#
+# **All three must pass, and blind is the point.** Three agents that read each
+# other's reports are one opinion with three signatures; the disagreement is the
+# instrument. `certify` refuses a report that cites another tier's verdict.
+#
+# **A tier cannot pass on an empty `scope`.** This is the rule the rest is built
+# around: a report that names nothing it read is a rubber stamp, and a rubber
+# stamp at three levels is worse than one verifier, because it costs three times
+# as much and reads as three times the assurance.
+TIERS = ("unit", "seam", "product")
+TIER_KEYS = ("node", "tier", "verdict", "scope", "confirms", "findings",
+             "evidence", "not_examined")
+TIER_VERDICTS = ("pass", "fail")
+SEVERITIES = ("breaks", "risk")
+# A tier report that quotes another tier's verdict was not written blind. Cheap
+# to detect and worth detecting: the failure it prevents is three reports that
+# agree because the second two read the first.
+CROSS_TIER = re.compile(r"\b(?:unit|seam|product)\s+tier\s+(?:passed|failed|says)"
+                        r"|\btier\s+\d\s+(?:passed|failed)"
+                        r"|as\s+the\s+(?:unit|seam|product)\s+tier", re.I)
+
+
+def tier_violations(t):
+    """Everything wrong with one tier report, in a stable order.
+
+    Same law as `verdict_violations`: the shape is checked rather than trusted,
+    and every refusal names the key, because a report rejected without naming its
+    fault is a report the next attempt reproduces.
+    """
+    out = []
+    if not isinstance(t, dict):
+        return ["tier report is not an object"]
+
+    for k in TIER_KEYS:
+        if k not in t:
+            out.append("tier report has no `%s` — all eight are required, because a "
+                       "report that omits one is silent about it rather than clear" % k)
+    if out:
+        return out
+
+    if not isinstance(t["node"], str) or not t["node"].startswith(NODE_ID):
+        out.append("tier report `node` is %r, which is not a node id" % (t["node"],))
+    if t["tier"] not in TIERS:
+        out.append("tier report `tier` is %r — it must be one of %s"
+                   % (t["tier"], ", ".join(TIERS)))
+    if t["verdict"] not in TIER_VERDICTS:
+        out.append("tier report `verdict` is %r — it must be `pass` or `fail`, because "
+                   "a certification that admits a third state admits a maybe"
+                   % (t["verdict"],))
+
+    for k in ("scope", "confirms", "findings", "evidence", "not_examined"):
+        if not isinstance(t[k], list):
+            out.append("tier report `%s` must be a list" % k)
+    if out:
+        return out
+
+    for k in ("scope", "confirms", "evidence", "not_examined"):
+        for i, e in enumerate(t[k]):
+            if not isinstance(e, str) or not e.strip():
+                out.append("tier report `%s[%d]` is %r — every entry must be a non-empty "
+                           "string, and a list of blanks is the shape a script emitting "
+                           "empty output produces" % (k, i, e))
+
+    findings = []
+    for i, f in enumerate(t["findings"]):
+        if not isinstance(f, dict):
+            out.append("tier report `findings[%d]` is not an object" % i)
+            continue
+        for k in ("what", "where", "severity"):
+            if not str(f.get(k, "")).strip():
+                out.append("tier report `findings[%d]` does not say `%s`" % (i, k))
+        sev = f.get("severity")
+        if sev is not None and sev not in SEVERITIES:
+            out.append("tier report `findings[%d].severity` is %r — it must be `breaks` "
+                       "(the node is not done) or `risk` (found, judged survivable, and "
+                       "named)" % (i, sev))
+        # A break has to say how its fix will be PROVEN, for the same reason
+        # `replan.add` does: the node it creates is one the next certification has
+        # to close, and handing it the absence is how the defect returns a round
+        # later.
+        if sev == "breaks" and not str(f.get("check", "")).strip():
+            out.append("tier report `findings[%d]` breaks the node and names no `check` "
+                       "— the fix node it becomes has to say how IT will be closed" % i)
+        findings.append(f)
+
+    breaks = [f for f in findings if isinstance(f, dict) and f.get("severity") == "breaks"]
+    if t["verdict"] == "pass":
+        # The two rules that make a pass mean something.
+        if not t["scope"]:
+            out.append("tier report `%s` passes on an empty `scope` — a report that names "
+                       "nothing it read is a rubber stamp, and three of those cost three "
+                       "times one verifier and read as three times the assurance"
+                       % t["tier"])
+        if not t["evidence"]:
+            out.append("tier report `%s` passes with empty `evidence` — the field exists "
+                       "for exactly this" % t["tier"])
+        if breaks:
+            out.append("tier report `%s` passes while carrying %d finding(s) at severity "
+                       "`breaks`: %s. Those two cannot both be true"
+                       % (t["tier"], len(breaks),
+                          "; ".join(str(f.get("what")) for f in breaks)))
+    elif t["verdict"] == "fail":
+        if not breaks:
+            out.append("tier report `%s` fails and names no finding at severity `breaks` "
+                       "— a fail that does not say what broke is a fail the next round "
+                       "cannot act on" % t["tier"])
+
+    # Blind, and checked. Only the prose fields can carry it.
+    for k in ("confirms", "evidence", "not_examined"):
+        for i, e in enumerate(t[k]):
+            if isinstance(e, str) and CROSS_TIER.search(e):
+                out.append("tier report `%s[%d]` cites another tier's verdict (%r) — the "
+                           "three run blind, because three reports that read each other "
+                           "are one opinion with three signatures" % (k, i, e.strip()[:70]))
+    return out
+
 # --- verbs --------------------------------------------------------------------
 
 def cmd_validate(graph, args):
@@ -909,7 +1042,7 @@ def cmd_producer(graph, args):
 def cmd_doctrine(graph, args):
     """Which doctrine this run actually read — B-061.
 
-    The bundle is 35 reference files. A run reads some subset and nothing recorded which,
+    The bundle is 36 reference files. A run reads some subset and nothing recorded which,
     so **a skipped file and a read one were indistinguishable** — the class every guard in
     this repository exists to catch, left standing over the doctrine itself.
 
@@ -977,6 +1110,170 @@ def cmd_doctrine(graph, args):
     return 0
 
 
+def cmd_certify(graph, args):
+    """Require three independent tier reports, then emit the verdict `close` consumes.
+
+    This is a gate in FRONT of `close`, not a replacement for it. `close`'s contract
+    is unchanged and its seven keys are still the only thing that moves the graph —
+    what changed is that the verdict is now assembled from three readings at
+    different distances instead of written from one.
+
+    **The round is recorded whether it passes or fails.** A failing round that
+    wrote nothing would erase the only evidence that a node is churning, which is
+    the number the ceiling below reads. The node stays `pending` on a failure; the
+    round count is the trail.
+
+    **The ceiling measures rather than stops** — `references/loop-guard.md`. At the
+    ceiling `certify` still runs and still tells the truth about the tiers; what it
+    adds is the name of the tier that keeps failing, because a run spinning on one
+    level needs the operator to see WHICH level, not to be halted.
+    """
+    guard(graph, args.graph)
+
+    nid = args.node
+    by_id = {n.get("id"): n for n in graph.get("nodes") or []}
+    node = by_id.get(nid)
+    if node is None:
+        die("no node %s in this graph — nothing was written" % nid)
+    if node.get("status") in TERMINAL:
+        die("%s is already %s — certifying it again would overwrite the record of the "
+            "close that already happened" % (nid, node.get("status")))
+    open_blockers = [b for b in node.get("blocked_by") or []
+                     if by_id.get(b, {}).get("status") not in TERMINAL]
+    if open_blockers:
+        die("%s waits on %s, which %s not closed — certifying work that could not have "
+            "run certifies nothing" % (nid, ", ".join(open_blockers),
+                                       "is" if len(open_blockers) == 1 else "are"))
+
+    reports, bad = {}, []
+    for path in args.tier:
+        try:
+            with open(path, encoding="utf-8") as fh:
+                t = json.load(fh)
+        except OSError as e:
+            die("cannot read the tier report at %s — %s" % (path, e), 2)
+        except ValueError as e:
+            die("%s: not readable as JSON — %s" % (path, e))
+        v = tier_violations(t)
+        if v:
+            bad += ["%s: %s" % (os.path.basename(path), line) for line in v]
+            continue
+        if t["node"] != nid:
+            bad.append("%s: reports on %s while this certification is for %s — a report "
+                       "about another node is not evidence about this one"
+                       % (os.path.basename(path), t["node"], nid))
+            continue
+        if t["tier"] in reports:
+            bad.append("%s: a second `%s` report — the three tiers are three distances, "
+                       "and two readings at one distance leave another unread"
+                       % (os.path.basename(path), t["tier"]))
+            continue
+        reports[t["tier"]] = t
+    if bad:
+        die("the tier reports are malformed — nothing was written:\n  " + "\n  ".join(bad))
+
+    missing = [x for x in TIERS if x not in reports]
+    if missing:
+        die("certification is missing the %s report(s) — all three are required, because "
+            "the level nobody read is the level the defect survives at"
+            % ", ".join("`%s`" % m for m in missing))
+
+    # The stamp, read here and never accepted from a report — same law as `close`.
+    import subprocess
+    try:
+        r = subprocess.run(["git", "rev-parse", "HEAD"], capture_output=True, text=True)
+        head = r.stdout.strip() if r.returncode == 0 else ""
+    except OSError:
+        head = ""
+
+    prior = node.get("certification") or {}
+    round_no = int(prior.get("round") or 0) + 1
+    tiers_now = {x: reports[x]["verdict"] for x in TIERS}
+    history = list(prior.get("history") or []) + [tiers_now]
+    node["certification"] = {
+        "round": round_no,
+        "tiers": tiers_now,
+        "at": head or "unavailable — not inside a git checkout",
+        "history": history,
+    }
+
+    failed = [x for x in TIERS if tiers_now[x] == "fail"]
+
+    # Churn, measured. A tier that has failed in every round so far is the one the
+    # operator needs named; counting it here is what makes the loop visible.
+    churning = [x for x in TIERS
+                if len(history) >= 2 and all(h.get(x) == "fail" for h in history)]
+
+    save(args.graph, graph)
+
+    if failed:
+        print("%s: certification round %d FAILED at %s"
+              % (nid, round_no, ", ".join("`%s`" % f for f in failed)), file=sys.stderr)
+        for tier in failed:
+            for f in reports[tier]["findings"]:
+                if f.get("severity") != "breaks":
+                    continue
+                print("  [%s] %s — %s" % (tier, f["where"], f["what"]), file=sys.stderr)
+                print("      fix:   %s" % f.get("fix", "(not stated)"), file=sys.stderr)
+                print("      check: %s" % f["check"], file=sys.stderr)
+        if round_no >= args.ceiling:
+            print("\n%s has been certified %d time(s), at or over the ceiling of %d."
+                  % (nid, round_no, args.ceiling), file=sys.stderr)
+            if churning:
+                print("The same tier has failed every round: %s. That is not a fix "
+                      "away — the level itself is being misread, or the node is the "
+                      "wrong shape. references/loop-guard.md."
+                      % ", ".join("`%s`" % c for c in churning), file=sys.stderr)
+            else:
+                print("No single tier is failing every round, so this is churn across "
+                      "levels rather than one stuck level.", file=sys.stderr)
+        print("\nThe node stays open. Round %d is recorded on it." % round_no,
+              file=sys.stderr)
+        return 1
+
+    # Passed at all three. Assemble the canonical verdict.
+    #
+    # The mapping is deliberate and uses no field for something it does not mean:
+    #   confirms      -> done          (asked for, and now true)
+    #   not_examined  -> not_verified  (present, and no check touched it)
+    #   risk findings -> blockers      (found, judged survivable, and named, which is
+    #                                   exactly what `can_continue_around: true` says)
+    verdict = {
+        "node": nid,
+        "done": [c for x in TIERS for c in reports[x]["confirms"]],
+        "not_done": [],
+        "not_verified": ["%s: %s" % (x, n)
+                         for x in TIERS for n in reports[x]["not_examined"]],
+        "blockers": [
+            {"what": "%s (%s, found by the `%s` tier)" % (f["what"], f["where"], x),
+             "blocks": [], "can_continue_around": True}
+            for x in TIERS for f in reports[x]["findings"]
+            if f.get("severity") == "risk"
+        ],
+        "replan": {"possible": True, "add": [], "park": [],
+                   "why": "certified at all three tiers in round %d" % round_no},
+        "evidence": ["%s: %s" % (x, e) for x in TIERS for e in reports[x]["evidence"]],
+    }
+    # Checked against the same gate `close` will apply, HERE, so a certification
+    # cannot hand the run a verdict its own consumer refuses.
+    broken = verdict_violations(verdict)
+    if broken:
+        die("all three tiers passed and the assembled verdict is still malformed — this "
+            "is a defect in `certify`, not in the reports:\n  " + "\n  ".join(broken))
+
+    out = args.verdict_out or os.path.join(os.path.dirname(args.graph) or ".",
+                                          "verdict-%s.json" % nid)
+    tmp = out + ".tmp"
+    with open(tmp, "w", encoding="utf-8") as fh:
+        json.dump(verdict, fh, indent=2, ensure_ascii=False)
+        fh.write("\n")
+    os.replace(tmp, out)
+    print("%s: certified at unit, seam and product in round %d" % (nid, round_no))
+    print("verdict written to %s — close it with:" % out)
+    print("  graph.py close --verdict %s" % out)
+    return 0
+
+
 def cmd_close(graph, args):
     """Consume a verdict, close one node, and re-plan — T-5, REQ-007.
 
@@ -1105,6 +1402,8 @@ VERBS = {
     "coverage": (cmd_coverage, "every requirement and the nodes serving it; exits 1 on a gap"),
     "add": (cmd_add, "add a node mid-run"),
     "park": (cmd_park, "park a node, carrying the reason"),
+    "certify": (cmd_certify, "require three independent tier reports, then emit "
+                             "the verdict `close` consumes"),
     "close": (cmd_close, "consume a verdict, close one node and re-plan"),
 }
 
@@ -1147,6 +1446,16 @@ def main(argv=None):
     made["close"].add_argument("--verdict", required=True,
                                help="path to the verifier's seven-key verdict JSON")
 
+    p_cert = made["certify"]
+    p_cert.add_argument("--node", required=True, help="the node being certified")
+    p_cert.add_argument("--tier", action="append", required=True, default=[],
+                        help="path to one tier report; pass three times, one per tier")
+    p_cert.add_argument("--verdict-out", dest="verdict_out", default=None,
+                        help="where to write the assembled verdict (default: beside the graph)")
+    p_cert.add_argument("--ceiling", type=int, default=3,
+                        help="rounds after which the output names the churning tier; it "
+                             "measures rather than stops (references/loop-guard.md)")
+
     p_park = made["park"]
     p_park.add_argument("node")
     # `required=True` makes the MISSING flag a usage error (exit 2). The empty and
@@ -1158,7 +1467,7 @@ def main(argv=None):
     verbs = {k: v[0] for k, v in VERBS.items()}
     if args.verb in NO_GRAPH:
         return verbs[args.verb](None, args)
-    if args.verb in ("add", "park", "close"):
+    if args.verb in ("add", "park", "close", "certify"):
         # The READ happens inside the lock too. Loading first and locking second is the
         # same lost update with an extra step: the stale copy is already in memory.
         with held(args.graph):

package/plugins/task-pipeline/skills/task-pipeline/templates/run.md

@@ -20,7 +20,7 @@ Run: `<topic>` · started `<YYYY-MM-DD>` · module map: `<path or "none">`
 
 ## `read:` — which doctrine this run actually opened
 
-The bundle is 35 reference files and nothing recorded which of them a run read, so **a
+The bundle is 36 reference files and nothing recorded which of them a run read, so **a
 skipped file and a read one were indistinguishable** — the class every guard in this
 pipeline exists to catch, left standing over the doctrine itself.
 
@@ -48,7 +48,7 @@ same claim one level down.
 |---|---|---|
 | `unmeasured — no run ledger` | there is no ledger | nothing to read from |
 | `unmeasured — the ledger carries no read: lines` | the hook is absent, **or** the run opened no doctrine | two opposite facts, and the ledger cannot separate them, so neither is claimed |
-| `N of 35 reference files read — unattested`, then each unread one | the hook is installed and fired | the count alone says there is a gap, not where — and `unattested` says the ledger cannot name who wrote the lines |
+| `N of 36 reference files read — unattested`, then each unread one | the hook is installed and fired | the count alone says there is a gap, not where — and `unattested` says the ledger cannot name who wrote the lines |
 
 **It is a disclosure: no floor, no direction, never a target.** A run that needs four files
 and reads four is not worse than one that reads thirty — and the moment the number becomes