task-pipeline-skill 1.76.0 → 1.77.0

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## v1.77.0 — a mention is not a declaration
+
+The release-gap check counted every `vX.Y.Z` token in `## Releases that carry no stamp` as a
+declaration that the release carries no stamp. So one sentence explaining a *stamped* release
+— the words "the figure was already false at the `v1.76.0` tag" — exempted that release from
+the check, and the negative self-test that exists to catch exactly this read as accepted for
+the same reason: it too was reading the section's prose.
+
+Declarations are bold now, which is the convention every entry in that section already
+followed. Prose about a release can no longer excuse it.
+
+Two plants cover it. The new one leaves the trailing release in the section in the same
+words and removes only its bold — a mention where a declaration was — and requires the
+refusal; watched firing in a standalone clone of 122 tags, and printing SKIP with its reason
+in a submodule checkout, where no tags are visible and the check it probes cannot look.
+
+Also: the README no longer presents `npm test` as runnable from a package that ships no
+`test/` directory, and `test/residue.py` tags each workspace with the process group that made
+it, so a scan of the shared `$TMPDIR` stops reporting another session's trees — and an
+earlier run's deliberately kept evidence — as this run's leak.
+
+Guards: 412 → **413**. `test/negatives.py`'s floor moved with it, in this change, because a
+floor below the count cannot notice losing the difference.
+
+## v1.76.1 — the number the published README had never checked
+
+The README's validator line said **all 23 references** and the tree it shipped
+held **36**. Not drift: the count was already wrong at the `v1.76.0` tag, so npm
+has been serving a false figure since that release, while a checkout of the
+umbrella — whose pin points at the branch tip — has been serving the true one.
+One version string, two documents, and the difference was a fact about the skill.
+
+Found by comparing trees rather than version strings, which is the only way this
+class is visible: `npm view` answered `1.76.0` for both.
+
+    published README   all 23 references
+    references in the tarball's own tree   36
+
+Nothing else changed. The tag exists so the published document stops lying.
+
+Guards: 412 → **412**. Flat, and stating it is not decoration: the claim registry
+reads the topmost section for this number, and a section that omits it reports the
+class as *dormant* — which is how a release with no live count silently disarmed the
+two plants that probe it. Omitting the line is a change to the guard suite's own
+coverage, so it is written even when the number does not move.
+
 ## v1.76.0 — the audit that starts cold
 
 **`project-audit` ships as this plugin's third skill.** `references/audit.md` has

package/README.md

@@ -559,7 +559,7 @@ must say so.
 ### Held to Anthropic's own Skill authoring guidance
 
 Audited against the four Agent Skills pages. Most of it already held — `name`
-13/64 chars, `description` inside 1024, `SKILL.md` 334/500 lines, all 23 references
+13/64 chars, `description` inside 1024, `SKILL.md` 334/500 lines, all 36 references
 linked **directly** from `SKILL.md`, 436 KB against a 30 MB ceiling. What did not,
 now does:
 
@@ -928,6 +928,10 @@ surface, and the surfaces that must never drift apart). Security reports:
 [SECURITY.md](SECURITY.md). Everyone participating is expected to follow the
 [Code of Conduct](CODE_OF_CONDUCT.md).
 
+<!-- commands-run-in: a clone -->
+These run **in a clone of this repository**. The published npm package ships no
+`test/` directory, so from an install they are names, not commands.
+
 ```bash
 npm test        # python3 test/validate.py — the structural validator
 ```

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.76.0 |
+| **Version** | 1.77.0 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki, and **one of two browser channels** — `playwright` (CLI or MCP) or `chrome-devtools` (MCP); either satisfies the browser step and neither is required. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.76.0",
+  "version": "1.77.0",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs). Retro insights can publish upstream as issues, opt-in and redacted.",
-  "version": "1.76.0",
+  "version": "1.77.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"