task-pipeline-skill 1.79.1 → 1.80.0

package/evals/run.py

@@ -17,12 +17,17 @@ What it does:
 
 Zero dependencies, same as the validator.
 """
+import glob
 import json
 import os
 import re
 import sys
 
 ROOT = os.path.dirname(os.path.dirname(os.path.abspath(__file__)))
+# EVERY suite, discovered — the directory held one suite per skill from
+# 2026-08-31 (evidence-docs and project-audit joined task-pipeline), and a
+# runner pinned to one filename would validate a third of what ships.
+SUITES = sorted(glob.glob(os.path.join(ROOT, "evals", "*.evals.json")))
 SUITE = os.path.join(ROOT, "evals", "task-pipeline.evals.json")
 RESULTS = os.path.join(ROOT, "evals", "RESULTS.md")
 
@@ -34,14 +39,12 @@ REQUIRED = ("should_trigger", "should_not_trigger", "ambiguous",
 MIN_EVALS = 3          # Anthropic: "At least three evaluations created"
 
 
-def main(argv):
+def validate_suite(path):
+    """Every gap in one suite, in a stable order. The rules are the same for
+    every skill's suite — a second rule set would drift."""
     errors = []
-    if not os.path.isfile(SUITE):
-        print(f"FAIL: no suite at {os.path.relpath(SUITE, ROOT)}")
-        return 2
-    suite = json.load(open(SUITE, encoding="utf-8"))
+    suite = json.load(open(path, encoding="utf-8"))
     evals = suite.get("evals") or []
-
     seen = set()
     for e in evals:
         where = e.get("id", "<no id>")
@@ -68,6 +71,18 @@ def main(argv):
     for cat in REQUIRED:
         if cat not in covered:
             errors.append(f"no eval covers {cat!r}")
+    return suite, evals, errors
+
+
+def main(argv):
+    if not os.path.isfile(SUITE):
+        print(f"FAIL: no suite at {os.path.relpath(SUITE, ROOT)}")
+        return 2
+    parsed, errors = [], []
+    for _sp in SUITES:
+        _suite, _evals, _errs = validate_suite(_sp)
+        parsed.append((os.path.basename(_sp), _suite, _evals))
+        errors += [f"{os.path.basename(_sp)}: {e}" for e in _errs]
 
     if errors:
         print("FAIL: evaluation suite invalid")
@@ -75,31 +90,42 @@ def main(argv):
             print("  - " + e)
         return 1
 
+    suite = next(s for n, s, ev in parsed if n == "task-pipeline.evals.json")
+    evals = [e for _, _, ev in parsed for e in ev]
     by_cat = {}
     for e in evals:
         by_cat.setdefault(e["category"], []).append(e)
 
     if "--list" in argv:
-        for cat in REQUIRED:
-            for e in by_cat.get(cat, []):
-                print(f"  {e['id']:<10} {cat:<22} {e['query'][:60]}")
-        print(f"\n{len(evals)} evals across {len(by_cat)} categories")
+        for name, _s, ev in parsed:
+            print(f"{name} — {_s.get('skill', '?')}")
+            for cat in REQUIRED:
+                for e in ev:
+                    if e["category"] == cat:
+                        print(f"  {e['id']:<10} {cat:<22} {e['query'][:60]}")
+        print(f"\n{len(evals)} evals across {len(by_cat)} categories, "
+              f"{len(parsed)} suite(s)")
         return 0
 
     print("=" * 72)
-    print("task-pipeline evaluation protocol")
+    print("task-pipeline plugin evaluation protocol (one section per suite)")
     print("=" * 72)
-    print("Run each query in a FRESH session with the skill installed, once per")
+    print("Run each query in a FRESH session with the pack installed, once per")
     print("model in", suite.get("models", []), "— effectiveness varies by model.")
     print("Record every verdict in evals/RESULTS.md with the date and the model.")
     print("A query you did not run is not a pass; leave it blank and say so.\n")
-    for cat in REQUIRED:
-        print(f"\n--- {cat} ---")
-        for e in by_cat.get(cat, []):
-            print(f"\n[{e['id']}] {e['query']}")
-            print(f"    why: {e['why']}")
-            for b in e["expected_behavior"]:
-                print(f"    [ ] {b}")
+    for name, _s, ev in parsed:
+        print(f"\n=== {name} — {_s.get('skill', '?')} ===")
+        for cat in REQUIRED:
+            group = [e for e in ev if e["category"] == cat]
+            if not group:
+                continue
+            print(f"\n--- {cat} ---")
+            for e in group:
+                print(f"\n[{e['id']}] {e['query']}")
+                print(f"    why: {e['why']}")
+                for b in e["expected_behavior"]:
+                    print(f"    [ ] {b}")
 
     print("\n" + "=" * 72)
     if not os.path.isfile(RESULTS):
@@ -118,6 +144,8 @@ def main(argv):
         if not infence:
             outside.append(ln)
     runs = [l for l in outside if re.match(r"^## 20\d{2}-\d{2}-\d{2}\b", l)]
+    print("suites: " + " · ".join(f"{n.replace('.evals.json', '')} {len(ev)}"
+                                    for n, _s, ev in parsed))
     print(f"suite: {len(evals)} evals · recorded runs: {len(runs)}")
     if not runs:
         print("RESULTS.md carries no dated run — the suite is authored and unexecuted.")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.79.1",
+  "version": "1.80.0",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -1,8 +1,9 @@
 {
+  "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
-  "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs). Retro insights can publish upstream as issues, opt-in and redacted.",
-  "version": "1.79.1",
+  "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/judgment/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs). Retro insights can publish upstream as issues, opt-in and redacted.",
+  "version": "1.80.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/commands/task-pipeline.md

@@ -100,7 +100,8 @@ Anything deferred enters the carry-over ledger the moment it is said.
 | 9 | Docs + wiki | **three artifacts, not two** — module docs, the wiki, **and the code graph** |
 | 10 | Acceptance | the ladder walk first, then the table, then the retrospective |
 
-**Honor every gate by its type**: `auto` — verify the check yourself; `manual` — wait
+**Honor every gate by its type**: `auto` — verify the check yourself; `judgment` —
+record the named judge's ruling as judgement, never as a measurement; `manual` — wait
 for an explicit go.
 
 ## Cross-cutting — the three that fire at any stage

package/plugins/task-pipeline/hooks/gate-observer.sh

@@ -73,11 +73,28 @@ if not matches:
 # PostToolUse fires on success; PostToolUseFailure carries the error. Both are
 # wired to this script, and `error` present means the command did not exit 0.
 failed = bool(data.get("error")) or data.get("hook_event_name") == "PostToolUseFailure"
-out = data.get("tool_output") or {}
-if isinstance(out, dict) and out.get("exit_code") is not None:
+# The harness documents the result field as `tool_response`; `tool_output` is the
+# name this script shipped reading, so it stays as a fallback rather than a
+# breaking change. Reading only the wrong name left the exit-code branch dead.
+# The fallback is BY FIELD, not by object: the real Bash `tool_response` is
+# {stdout, stderr, interrupted} with no exit_code, and `resp or legacy` made a
+# legacy exit_code unreachable behind it — found by the R-005 reader, measured,
+# before this shipped. The same reading found `interrupted`: a gate cut short
+# is not a gate that passed, whatever a stale exit_code says, so a failure
+# event or an interruption is never recorded as exit 0.
+out = {}
+interrupted = False
+for cand in (data.get("tool_response"), data.get("tool_output")):
+    if isinstance(cand, dict):
+        interrupted = interrupted or bool(cand.get("interrupted"))
+        if not out and cand.get("exit_code") is not None:
+            out = cand
+if out:
     code = int(out["exit_code"])
 else:
     code = 1 if failed else 0
+if (failed or interrupted) and code == 0:
+    code = 1
 
 stamp = datetime.datetime.now(datetime.timezone.utc).replace(microsecond=0).isoformat().replace("+00:00", "Z")
 

package/plugins/task-pipeline/skills/evidence-docs/SKILL.md

@@ -24,6 +24,7 @@ The full statement of each canon, its rationale and its enforcement live in
 7. **Silence is not a pass** — ask what a mechanism prints when it did not look.
 8. **An estimate is never announced as a measurement** — a rule states its evidence condition.
 9. **What was not checked is printed beside what was.**
+   - **9a. A measured zero and an unmeasured quantity may not print the same** — canon 9 says carry the absence; 9a says refuse the number when nothing measured it.
 10. **The document ships in the change that made it true** — and a correction is appended, never written over.
 
 They are **epistemic**: what makes a claim documentation. The operational layer — what to

package/plugins/task-pipeline/skills/project-audit/SKILL.md

@@ -1,6 +1,7 @@
 ---
 name: project-audit
 description: "Use when someone asks what is actually true of a whole project right now — what is finished, what is half-built, what is broken, and what nobody has looked at. Walks a cold start: discover what the project is, run a registry of probes chosen from that, read production evidence (published artefact against source, CI history, telemetry present or absent), then leave a self-contained HTML report and a JSON sidecar so the next audit can say what moved. Read-only: it proposes board rows and commits nothing. Triggers - 'project audit', 'audit the project', 'codebase audit', 'state of the project', 'what is unfinished', 'project health check', 'аудит проекта', 'проаудируй проект', 'состояние проекта', 'что не доделано', 'аудит кодовой базы'. Not for: auditing one deliverable inside a run (that is the pipeline's own ladder), reviewing a diff, or checking a skill's construction — say 'без диагностики' to opt out."
+compatibility: "The collector (scripts/audit.py) needs python3 and reads committed state, so it needs git. Probes needing gh, npm, network or a browser declare it and report blind when it is absent — degraded, never silent."
 ---
 
 # Project audit — what is true of this project right now
@@ -33,6 +34,7 @@ next audit reads.
 | this skill | the **procedure** — cold start, probes, production, the report | a whole project is the subject |
 | `/skill-audit` (make-skill) | a skill's construction against the standard | the thing audited is a skill or plugin |
 | `/ux-audit` (super-ux) | code against documented scenarios | the question is user-facing behaviour |
+| `/seo-aeo-audit` (seo-aeo-audit) | a public surface's search and answer-engine visibility | the question is whether a machine will find it |
 
 **The method is not restated here.** Phase 4 below hands off to `audit.md` and
 comes back; a second copy of the ladder would be a second rule, and the two
@@ -96,8 +98,11 @@ the same object.
 ### 6. Propose — rows, not edits
 
 **This skill commits nothing.** Findings leave as board rows in the project's
-own vocabulary, priced with the project's own formula —
-`P = blast × (1 + age_runs) / effort` — and the operator accepts them. An audit
+own vocabulary, priced with **the board header's declared formula** — the shipped
+default is `Sev × Blast + age_bonus` (`references/backlog.md`, the pipeline's
+board doctrine) — and the operator accepts them. Effort never ranks inside an
+audit: what a fix costs is the fixer's decision, not the finder's
+(`references/prioritisation.md`). An audit
 that edits while it reads cannot be re-run to check itself.
 
 ## Three verdicts, and why the third one exists

package/plugins/task-pipeline/skills/task-pipeline/SKILL.md

@@ -1,7 +1,8 @@
 ---
 name: task-pipeline
-description: "Use when work changes the repository — feature, fix, refactor, migration, integration, rewrite, adoption or hardening; фича, фикс, рефактор, миграция, интеграция, доработать, починить, внедрить, перевести — or when the output is a finding that lands in it: audit/аудит, bug hunt/проверь ошибки, production check/проверь прод, PR review/ревью PR — or on 'run this through the pipeline' / 'прогони по конвейеру', 'full cycle, the full cycle' / 'полный цикл', /task-pipeline. Runs a substantial task through an intake grill, docs study, brainstorm, spec, plan, build, tests, deploy, post-deploy, docs/wiki sync and acceptance with explicit gates. 'checkup' / 'чекап' reports unconfirmed releases; 'setup' audits existing docs. Not for: answering a question, explaining code, a typo or a one-line edit — say 'без пайплайна' / 'quick' to opt out."
+description: "Use when work changes the repository — feature, fix, refactor, migration, integration, rewrite, adoption or hardening; фича, фикс, рефактор, миграция, интеграция, доработать, починить, внедрить, перевести — or when the output is a finding that lands in it: audit/аудит, bug hunt/проверь ошибки, production check/проверь прод, PR review/ревью PR — or on 'run this through the pipeline' / 'прогони по конвейеру', 'full cycle, the full cycle' / 'полный цикл', /task-pipeline. Runs a substantial task through an intake grill, docs study, brainstorm, spec, plan, build, tests, deploy, post-deploy, docs/wiki sync and acceptance with explicit gates. 'checkup' / 'чекап' reports unconfirmed releases; 'setup' audits existing docs. Not for: answering a question, explaining code, a typo or a one-line edit, a mechanical rename, reconnaissance that lands nothing — say 'без пайплайна' / 'quick' to opt out."
 license: MIT
+compatibility: "Doctrine runs on any agent. The bundled scripts need python3; the run needs git. Missing either degrades, never blocks — the graph verbs and seeded gates go unused, and the run says so."
 ---
 
 # task-pipeline
@@ -27,8 +28,11 @@ that encodes this plugin's own default flow (stage 0 intake + the 1→10 stages
 tabled below) and an optional, toggleable `release` block. Any project replaces it
 wholesale — any number of stages, run by its own skills/agents, with its own gate
 types (see *Bring your own skills*). Each gate has a **type**: `auto` (the
-orchestrator verifies the `check` itself, pass/fail) or `manual` (wait for an
-explicit operator go); which stages are manual is the operator's call. In the
+orchestrator verifies the `check` itself, pass/fail), `judgment` (no complete
+deterministic check exists — a named judge rules, and the ruling is recorded as
+judgement, never as a measurement; `references/gates.md` → *The judgment gate*)
+or `manual` (wait for an explicit operator go); which stages are manual is the
+operator's call. In the
 example's `skills[]`, `task-pipeline:<name>` denotes this skill's own built-in
 doctrine (`references/<name>.md`) and `host:<name>` denotes the host project's own
 command for that job (`references/conventions.md`); everything else is a real skill
@@ -59,7 +63,7 @@ gate stops until it is installed.
 | 3 Spec | `references/spec.md` |
 | 4 Plan | `references/planning.md` |
 | the queue the loop walks | `references/work-graph.md` |
-| 5–8 · how a node is CLOSED — three blind readings at three distances, all three required | `references/certification.md` |
+| 5–8 · how a **work-graph node** is CLOSED — three blind readings at three distances, all three required (ceiling 3); a **prose-plan task** closes through `review.md` instead — one reviewer, five-round cap | `references/certification.md` |
 | 5 Build (worktree, subagents, fix loop) | `references/build.md` + `references/review.md` |
 | 5–6 TDD + suite gate | `references/tdd.md` |
 | 5, 6, 8 The browser — the look, the spec suite, and the difference | `references/browser.md` |
@@ -108,12 +112,11 @@ bind this run, the log queried because nothing caps it — are in
 `references/knowledge-sources.md` and `references/retrospective.md`.
 
 **Three artifacts close a run, not two — and they are a convergence, not a sequence.**
-Stage 9 syncs the docs, the wiki **and the code graph**. None consumes another; all three
-consume the same change, and the **graph↔docs divergence check is the gate over their
-convergence** — the only thing that compares two of the three against each other, which
-is why it is not optional where a graph exists. A stale graph is a false premise
-**carrying the authority of a machine**: a wrong doc gets argued with, a wrong graph gets
-believed (`references/knowledge-graph.md`, `references/audit.md`).
+Stage 9 syncs the docs, the wiki **and the code graph**; none consumes another, and the
+**graph↔docs divergence check is the gate over their convergence** — the only thing
+comparing two of the three against each other, so it is not optional where a graph
+exists. A stale graph is a false premise **carrying the authority of a machine**
+(`references/knowledge-graph.md`, `references/audit.md`).
 
 **Documentation is a deliverable, and it has a gate** (`references/documentation.md`).
 Stage 0 answers the four questions that make docs a *system* into `docs/DOCMAP.md`;
@@ -133,26 +136,14 @@ triggers and what an entry must carry are in `references/retrospective.md`; why
 the order cannot be swapped is `references/learned.md` rule 21.
 
 Stage 0 reads those standing instructions in full, which is why the prune is a gate
-criterion and not a good intention: a rule nobody reads to the end is worse than no
-rule, because everyone believes it is covered.
+criterion: a rule nobody reads to the end is worse than no rule, because everyone
+believes it is covered.
 
-Three things the grill does beyond clarifying the request:
-- **Domain awareness.** It reads the project's own `CONTEXT.md` / `docs/adr/` and
-  holds the operator to them — challenging terms that conflict with the glossary,
-  sharpening overloaded words, stress-testing with concrete scenarios, and
-  flagging where the code contradicts what was just said. Resolved terms are
-  written to `CONTEXT.md` as they land; genuinely hard-to-reverse decisions get an
-  ADR.
-- **The autonomy sweep.** It pre-resolves what would otherwise stop stages 1→10
-  mid-flight (test/lint/deploy commands, branch policy, log locations, docs
-  targets, the model decision, deploy authorization). Autonomy is bought here or
-  not at all — an unasked question is a scheduled interruption.
-- **The design destination**, when the project designs in Figma: *which* file, in
-  which team — a stage-0 decision, never a stage-3 side effect. Left to drawing
-  time the question is answered by whoever is holding the brush, and the answer is
-  usually *create a new file* — which is how a project ends up with three files
-  called some variation of "Design", each with real work in it and no way to tell
-  which one the team opens.
+Three things the grill does beyond clarifying the request, each in full in
+[`references/grill.md`](references/grill.md):
+- **Domain awareness** — it reads the project's `CONTEXT.md` / `docs/adr/` and holds the operator to them, writing resolved terms back as they land.
+- **The autonomy sweep** — it pre-resolves what would otherwise stop stages 1→10 mid-flight. Autonomy is bought here or not at all; an unasked question is a scheduled interruption.
+- **The design destination** with Figma on — *which* file, in which team, decided at stage 0. Left to drawing time it is answered by whoever holds the brush, and the answer is usually *create a new file*.
 
 ## How to run
 
@@ -165,7 +156,9 @@ Three things the grill does beyond clarifying the request:
    the most capable model available, let the operator confirm or override, record
    it. Ask once, here. **The same block carries the run mode**
    (`references/continuity.md`): read `pipeline.json` → `run.loop`; where it is
-   recorded, arm it and print the job id and the cancel command — the config is
+   recorded, arm it **at the point `run.loop.arm` names** — here at preflight, or
+   at stage 2's close for `after-decomposition`, once the queue exists — and when
+   it arms, print the job id and the cancel command; the config is
    the authorization, so re-asking rebuilds the habit it exists to retire. Where
    it is **absent, the mode is off**; recommend it in one line and move on.
    Silence arms nothing, and the mode never collapses a `manual` gate.
@@ -193,9 +186,10 @@ Three things the grill does beyond clarifying the request:
    status column is the resume point (`references/stages.md` → *The program loop*).
 4. Do **not** advance until the stage **gate** passes (`references/stages.md`).
    Honor the gate **type**: for `auto`, verify the gate's `check` yourself and
-   stop/return on fail; for `manual`, present the result and **wait for the
-   operator's explicit "continue"/go** — an auto gate never substitutes for a
-   required manual approval.
+   stop/return on fail; for `judgment`, record the named judge's ruling as
+   judgement, never as a measurement; for `manual`, present the result and
+   **wait for the operator's explicit "continue"/go** — neither of the other
+   two ever substitutes for a required manual approval.
 5. **The cross-cutting rules fire at any stage**, not only here — the Doc Loop, the
    loop guard, the audit's exit, the frozen REQ list, the carry-over ledger, and
    what counts as evidence, and **every gate prints `holds: N`** — what this run left
@@ -217,9 +211,9 @@ capable available — see `references/model-tiering.md`).
 | 3 | Spec | committed + reviewed; UI: chain validated, linter green, scenarios and `SCR-` traced; COPY and VISUAL are a parallel layer after UX, and where both ran their convergence check is recorded | manual |
 | 4 | Plan | parallel-ready, DoD per task; **every edge names what it carries** — the fake-edge test run and its `Edges:` count computed | auto |
 | 5 | Dev | tasks DONE, TDD green per task, branch integrated per the brief; a fanned-out group gets **one convergence check over all its diffs together** before the first worktree lands | auto |
-| 6 | Tests | full suite green, new and changed code covered, every new check probed both ways and asserted on its exit code; **a web surface is checked in a browser, not in the diff** | auto |
+| 6 | Tests | full suite green, new and changed code covered, every new check probed both ways and asserted on its exit code; **a web surface is checked in a browser, not in the diff** — where a browser channel is connected; absent, the weaker claim is recorded | auto |
 | 7 | Lint + deploy | lint clean and suite green before deploy; deploy needs a go, or the brief's specific standing authorization | manual |
-| 8 | Post-deploy | clean boot or an honest degradation report; **a deployed web target is opened, not curled** — a `200` proves the server answered and nothing else | auto |
+| 8 | Post-deploy | clean boot or an honest degradation report; **a deployed web target is opened, not curled** — a `200` proves the server answered and nothing else; where no browser channel is connected, the weaker claim is recorded | auto |
 | 9 | Docs + wiki | every stale row of the stage-0 source ledger updated; the propagation matrix walked for every change type this run produced; the documentation gate green with its ratchets printed; docs, wiki and the code graph synced and checked against each other | auto |
 | 10 | **Acceptance** | the ladder walk ran and its absences became REQ rows; every REQ accounted for with evidence from a check seen failing once; no unresolved ledger row; **every repository clean, pushed and pointed at**; the hand-back written and the environment given back; the retrospective written **last**, and in order | manual |
 
@@ -228,42 +222,41 @@ capable available — see `references/model-tiering.md`).
 ladder walk is, which eight environment classes stage 10 enumerates, what makes an
 edge fake, why a `200` is not a working page: all there, none here.
 
-**Several repositories?** A submodule is finished when its parent says so — the
-work can be committed, pushed and green while a clone of the parent still gets the
-commit before it, and neither repository looks wrong alone. The two commands that
-prove it, and the two-command fix whose second half gets forgotten, are in
+**Several repositories?** A submodule is finished when its parent says so — a clone
+can still get the commit before it while neither repository looks wrong alone. The
+commands that prove it are in
 [`references/acceptance.md`](references/acceptance.md) → *A project of several
 repositories*.
 
 ## Model — ask once, at preflight
 
-Default recommendation: **the most capable reasoning model the environment
-offers** (currently the latest Opus generation — read that as a tier, not a
-string). **Never hardcode a model id**: generations ship, tiers get renamed, and
-the operator may be on another provider entirely — resolve the top tier available
-at runtime. Stage configs use provider-agnostic tokens (`default` / `inherit`).
+Recommend **the most capable reasoning model available** — a tier resolved at
+runtime, **never a hardcoded id**; stage configs use `default` / `inherit`. The
+block to emit is `references/model-tiering.md` → *Mechanic*, and it is a
+reminder: no such tier means say which one is in use and continue. Record the
+answer in the brief, don't re-ask per stage; stage-5 subagents are pinned to it
+automatically.
 
-> 🧠 **Model for this run:** recommended **`<top tier available>`**. You're on
-> `<current>`. `/model <id>` to switch, or "keep current", or name per-stage
-> overrides. *(Reminder only — if that tier isn't available, say which one you're
-> using and continue.)*
+## Degradation
 
-Record the answer in the brief; don't re-ask per stage. Stage-5 subagents are
-pinned to the confirmed model automatically. Detail: `references/model-tiering.md`.
+- **No python3** → the work-graph verbs and the seeded gate scripts cannot run: the queue degrades to a prose plan, the gates to checklists — said out loud, never silently.
+- **No git** → no worktree isolation and no commit-addressed evidence: the run records the weaker claim instead of pretending to the stronger one.
+- **No browser channel** → a web surface is verified by reading the diff, and the close-out records that as the weaker claim it is.
 
 ## Bring your own skills
 
 The stages above are the **example** flow. A host project owns its pipeline: copy
 `pipeline.example.json` → `pipeline.json`, define its **own** stages (any count),
 point each `skills[]` at what its environment resolves, set each `gate.type`
-(`auto`/`manual`) to fit its process, and toggle its own `release` block. The
+(`auto`/`judgment`/`manual`) to fit its process, and toggle its own `release`
+block. The
 framework ships no fixed stage count and no opinion on which gates are manual —
 `pipeline.schema.json` is the only contract.
 
 ## References
 
-Every reference is routed from the **Built-in doctrine** table above, keyed by
-the stage that sends you there — one home for that mapping rather than two. The
-two config contracts sit beside this file: `pipeline.schema.json` (the universal
-stages + release contract) and `pipeline.example.json` (this plugin's default
-flow as config).
+Most references are routed from the **Built-in doctrine** table above, keyed by
+the stage that sends you there. The rest are routed by prose: `stages.md` (named
+at every stage of *How to run*), `learned.md` (cited where a rule binds) and
+`probing.md` (from `gates.md`, whose checks it proves). The config contracts sit
+beside this file: `pipeline.schema.json` and `pipeline.example.json`.

package/plugins/task-pipeline/skills/task-pipeline/pipeline.example.json

@@ -65,7 +65,7 @@
       ],
       "gate": {
         "type": "manual",
-        "check": "UX track ran FIRST for user-facing tasks (/ux -> ux-foundation CJM -> ux-flows screens -> ux-scenarios -> /ux-lint green); spec committed and user-reviewed; every user-facing requirement traces to a scenario ID. Every spec section carries covers: REQ-... and every REQ appears in at least one section. With Figma on: the destination the brief named was used — the canonical record (docs/ux/foundation.md -> Design tooling) holds exactly one file, no file was created while a recorded one resolved, and every screens.md frame link carries that same :fileKey (a string match, not a judgement — a differing key means the run drew in a second file nobody will open)."
+        "check": "UX track ran FIRST for user-facing tasks (/ux -> ux-foundation CJM -> ux-flows screens -> ux-scenarios -> /ux-lint green); spec committed and user-reviewed; every user-facing requirement traces to a scenario ID. Every spec section carries covers: REQ-... and every REQ appears in at least one section. With Figma on: the destination the brief named was used — the canonical record (docs/ux/foundation.md -> Design tooling) holds exactly one file, no file was created while a recorded one resolved, and every screens.md frame link carries that same :fileKey (a string match, not a judgement — a differing key means the run drew in a second file nobody will open). COPY and VISUAL are a parallel layer after UX: every user-facing string went through the COPY track or the refusal is recorded, the visual layer went through the VISUAL track or the refusal is recorded, and where both tracks ran their convergence check is recorded - findings with the ruling, or 'Tracks converge: clean'."
       }
     },
     {

package/plugins/task-pipeline/skills/task-pipeline/references/acceptance.md

@@ -354,7 +354,7 @@ All of:
    the table was written, and the two pass counts recorded.
 3. **Every check this gate leans on has been seen failing** at least once against a
    planted defect (`audit.md` → *Exit criterion*; the procedure, with the commands,
-   is [`gates.md`](gates.md) → *Probing*). An unproven check's green is not
+   is [`probing.md`](probing.md) → *Probing — plant, run, restore*). An unproven check's green is not
    evidence. That includes **the documentation gate** the project's doc map names
    ([`documentation.md`](documentation.md)) — stage 9 ran it, this stage is where it
    is *proven*, and its **ratchet counts are printed beside this verdict**. A

package/plugins/task-pipeline/skills/task-pipeline/references/adoption.md

@@ -80,12 +80,23 @@ being *unrecorded* is the defect, not the choice.
 Usually the map and the gate; often the register already exists in some shape.
 
 ```bash
-cp <skill>/templates/docmap.md   docs/DOCMAP.md          # only if absent
-cp <skill>/templates/docgate.sh  scripts/check-docs.sh   # only if absent
-cp <skill>/templates/exposure.sh scripts/exposure.sh     # only if absent
-chmod +x scripts/check-docs.sh scripts/exposure.sh
+cp <skill>/templates/docmap.md         docs/DOCMAP.md               # only if absent
+cp <skill>/templates/docgate.sh        scripts/check-docs.sh        # only if absent
+cp <skill>/templates/exposure.sh       scripts/exposure.sh          # only if absent
+cp <skill>/templates/hygiene.sh        scripts/check-hygiene.sh     # only if absent
+cp <skill>/templates/stage-coverage.sh scripts/stage-coverage.sh    # only if absent
+cp <skill>/templates/convergence.sh    scripts/check-convergence.sh # only if absent, and only where the project pins components
+chmod +x scripts/check-docs.sh scripts/exposure.sh scripts/check-hygiene.sh \
+         scripts/stage-coverage.sh scripts/check-convergence.sh
 ```
 
+The last three are the scripts the later gates run — stage 5 runs
+`check-hygiene.sh` after every task, stage 10 runs `stage-coverage.sh` before the
+coverage table and `check-convergence.sh` where components are pinned
+([`../templates/README.md`](../templates/README.md) is the full seeding map). A
+fresh host that skips them reaches gates whose commands do not resolve, which
+reads as a broken gate rather than a skipped seeding.
+
 **Seeding never overwrites.** An existing brief, register or map is the project's
 memory; the template is a skeleton.
 

package/plugins/task-pipeline/skills/task-pipeline/references/artifacts.md

@@ -89,8 +89,10 @@ validator). `test/artifact_root_test.py` runs both against one case table and fa
 they disagree — which is why one rule is allowed two implementations here.
 
 **Every** run keeps a **git-ignored** run ledger at `.task-pipeline/run.md`, seeded at
-stage 0 from [`../templates/run.md`](../templates/run.md). Three line shapes: a
-`stage:` verdict when a gate returns, an `iter:` line when an iteration closes, and a
+stage 0 from [`../templates/run.md`](../templates/run.md), whose *Lines* section
+declares every line shape — the list is the count, and a count restated here said
+*three* over a template of eight. Among them: a `stage:` verdict when a gate
+returns, an `iter:` line when an iteration closes, and a
 `touch:` line per file per repeating pass. Two readers depend on it —
 [`loop-guard.md`](loop-guard.md) detects churn from the `touch:` lines after a lost
 context, and [`progress.md`](progress.md) derives the stage rail and the iteration

package/plugins/task-pipeline/skills/task-pipeline/references/brainstorm.md

@@ -142,7 +142,12 @@ The operator approves the design, **the UI verdict is recorded**, and — where
 is either covered now or explicitly dropped by the operator, with the drop written
 into the carry-over ledger. For a platform, the module map
 ([`decomposition.md`](decomposition.md)) is committed and approved as part of this
-same gate. Then, and only then, stage 3 writes it up.
+same gate. Two more criteria close it, and the gate of record —
+[`stages.md`](stages.md) → *2 — Brainstorm + decompose* — states both in full:
+**the queue is an artifact rather than a recollection** (where it is a work graph,
+`graph.py validate` exits 0 and `graph.py coverage` names any requirement no node
+serves), and **the loop's arming state is printed** — armed with its queue and
+pacing, or not armed with the reason. Then, and only then, stage 3 writes it up.
 
 ## Rationalizations
 

package/plugins/task-pipeline/skills/task-pipeline/references/build.md

@@ -374,6 +374,13 @@ satisfied**, and code quality. The implementer's self-review never substitutes f
 it. Rubric, inputs, prompt templates and how to build the diff package:
 [`review.md`](review.md).
 
+**The boundary with certification:** this review closes a **prose-plan task** —
+one reviewer, the five-round cap of §4.5. A **work-graph node** is closed by the
+three blind tiers and `graph.py certify` instead
+([`certification.md`](certification.md), ceiling 3); the artifact the queue is —
+plan or graph — decides which protocol closes the work, never whichever is
+cheaper at the moment of closing.
+
 The REQ verdict is the one the other two can't produce: a task can meet every line
 of its brief and still miss the requirement it was written to deliver. A ❌ there
 enters the fix loop like any Important finding.
@@ -561,7 +568,10 @@ stages 7–9 run against an unintegrated branch.
 
 ## GATE (auto)
 
-All plan tasks DONE with all three review verdicts (spec compliance, REQ satisfied,
+**The hygiene gate green in diff mode after every task** (*The hygiene gate*,
+above) — six checks over what that task changed, no floor, a finding fixed
+in-task or carried over with a reason;
+all plan tasks DONE with all three review verdicts (spec compliance, REQ satisfied,
 code quality); **every group that actually fanned out has run its convergence check
 (§4.2a) before its first worktree was integrated, and logged a line either way** —
 findings with their ruling, or `convergence check clean`; the full test suite green;

package/plugins/task-pipeline/skills/task-pipeline/references/certification.md

@@ -4,6 +4,13 @@ A node is not closed by one agent's opinion. It is closed by **three independent
 readings at escalating visibility**, and the run may not advance until all three
 pass.
 
+**The boundary: this closes a node of the work graph.** Where the queue is a
+prose plan rather than a graph, a task closes through the per-task review instead
+([`build.md`](build.md) §4.4 and [`review.md`](review.md) — one reviewer, a
+five-round fix loop with an explicit breaker). Two closure protocols with no
+boundary sentence were how a run picked whichever was cheaper; the artifact the
+queue is — graph or plan — is what decides, not the mood of the closer.
+
 ## Contents
 
 - Why one verifier is not enough, stated as the failure it produces