task-pipeline-skill 1.79.1 → 1.80.0

package/plugins/task-pipeline/skills/task-pipeline/references/companion-skills.md

@@ -58,6 +58,10 @@ better, plus one that is required only for user-facing work.
 | **playwright** (CLI — `playwright-cli open`, `snapshot`, `click`, `type`, and the two this pipeline actually asks for: `console` and `requests`; or MCP — `browser_navigate`, `browser_snapshot`, `browser_click`, `browser_console_messages`, `browser_network_requests`) | **stages 5–6 on any project with a web front end**, and **stage 8** on a deployed target — the same job as the row below: open the surface, snapshot it, read the console and the network log. Its own difference is **the channel a look arrives on**: the CLI is a shell command, so it does not put a tool schema in the context window the way an MCP channel does — that is upstream's own comparison and it is *CLI against MCP*, which makes it a claim about this row's own two halves before it is a claim about the row below. Both channels default to an **accessibility-tree snapshot rather than pixels**, so the ordinary look costs a page of text and no vision model; `screenshot` exists in both and costs one when you ask for it | **Recommended** — never a gate; absent → say the surface was verified **by reading the diff** and treat that as the weaker claim it is | CLI: `npm install -D @playwright/cli@latest` → `npx playwright-cli --help` (or `npm i -g` for the global binary; `playwright-cli install --skills` adds its agent skills, `--global` to the home directory). MCP: `claude mcp add playwright npx @playwright/mcp@latest` |
 | **chrome-devtools** (MCP — `list_pages`, `navigate_page`, `take_snapshot`, `take_screenshot`, `evaluate_script`, `list_console_messages`, `list_network_requests`, `lighthouse_audit`, `performance_start_trace`, `take_heapsnapshot`) | **stages 5–6 on any project with a web front end** — verify the **rendered** surface rather than the diff: computed layout, console errors, failed requests. **Stage 8** on a deployed web target: load the page and read what the browser did, not what the deploy said. Its own difference is **reach past the page**: a Lighthouse category (`lighthouse_audit`, which `seo-aeo-audit` builds on) and a heap snapshot have no equivalent in the row above. A performance trace has one — `playwright-cli tracing-start` records one — but only this row's arrives with `performance_analyze_insight` over it | **Recommended** — never a gate; absent → say the surface was verified **by reading the diff** and treat that as the weaker claim it is | `/plugin install chrome-devtools-mcp@claude-plugins-official` (or connect the MCP server directly) |
 | **[agent-sync](https://github.com/ssheleg/agent-sync)** (`/agent-sync`, **≥ 1.3.0** — `finish` did not exist before it, so an older install turns the stage-10 close-out into a command that is not there) | **guarded registers** — a lease before writing one, `reserve` before minting an id, `reconcile`/`record` for intent vs as-built, and `finish` for the stage-10 multi-repository close-out ([`documentation.md`](documentation.md)) | **Recommended** — never a gate. Absent → the run is **`ungated`** and must say so out loud; the discipline still applies, only the arbitration is missing | `npx sshlg-skills install` |
+| **sheleg-dev** (`stripe-billing`, `crypto-payments`, `error-tracking`, `ad-tracking`, `google-signin`, `google-auth`, `frontend-performance`) | **stage 5 when the task wires money, tracking, sign-in or page speed** — the seams a generated integration gets wrong in ways no screen shows: the webhook is the payment, a thank-you-page event cannot know the charge cleared, a duplicated `event_id` counts revenue twice | **Recommended** — never a gate; absent → the integration ships on the host's own doctrine and the close-out names the seam nobody checked | `/plugin marketplace add ssheleg/sheleg-dev` → `/plugin install sheleg-dev@sheleg-dev` |
+| **agent-stack** (`agent-orchestrator`, `agent-evals`, `agent-interop`, `agent-harness`) | **stage 5 when the thing being BUILT is an agent system** — the orchestrator's loop, evals that say whether it got better, the protocols it speaks (MCP/A2A), the wallet under LLM resale. Not for coordinating the agents editing this repository (that is agent-sync, above) | **Recommended** — never a gate; absent → the agent layer ships unevaluated and the close-out says so | `/plugin marketplace add ssheleg/agent-stack` → `/plugin install agent-stack@agent-stack` |
+| **telegram-dev** (`telegram-bots`, `telegram-userbots`, `telegram-miniapps`) | **stage 5 when Telegram is the platform, not the transport** — `update_id` as the only idempotency key, a session file that is a logged-in person, a Mini App authenticated by one signed query string | **Recommended** — never a gate; absent → the surface ships on the Bot API docs alone and the close-out names the dedup and auth seams unverified | `/plugin marketplace add ssheleg/telegram-dev` → `/plugin install telegram-dev@telegram-dev` |
+| **seo-aeo-audit** (`/seo-aeo-audit`) | **stage 8 when a logged-out reader or a crawler will see the shipped surface** — the check that a machine will find it; the design-time rule lives with the host, this is the audit after | **Recommended** — never a gate; absent → visibility ships undesigned and unaudited, said in those words | `/plugin marketplace add ssheleg/seo-aeo-audit` → `/plugin install seo-aeo-audit@seo-aeo-audit` |
 | ~~superpowers~~ | — | **Not a dependency.** Stages 2/4/5/6 run on the built-in doctrine above. See *Optional bridge* | — |
 | ~~grill-me / grilling~~ | — | **Not a dependency.** The stage-0 grill is built in (`references/grill.md`) | — |
 
@@ -127,6 +131,23 @@ Pipeline companions (stage doctrine is built in — nothing to install for it):
                            claude mcp add playwright npx @playwright/mcp@latest
                          (running without it — see the line below; without BOTH,
                           the surface is verified by reading the diff)
+  ✗ sheleg-dev         — this task wires money, tracking, sign-in or page speed;
+                         it owns the seams no screen shows (the webhook IS the
+                         payment, a thank-you event cannot know the charge cleared):
+                           /plugin marketplace add ssheleg/sheleg-dev
+                           /plugin install sheleg-dev@sheleg-dev
+  ✗ agent-stack        — the thing being BUILT here is an agent system; it owns
+                         the loop, the evals, the protocols and the wallet:
+                           /plugin marketplace add ssheleg/agent-stack
+                           /plugin install agent-stack@agent-stack
+  ✗ telegram-dev       — Telegram is this task's platform, not its transport;
+                         it owns update dedup, session files and Mini App auth:
+                           /plugin marketplace add ssheleg/telegram-dev
+                           /plugin install telegram-dev@telegram-dev
+  ✗ seo-aeo-audit      — a logged-out reader will see the shipped surface;
+                         stage 8 can audit what a machine will find:
+                           /plugin marketplace add ssheleg/seo-aeo-audit
+                           /plugin install seo-aeo-audit@seo-aeo-audit
   ✗ chrome-devtools    — recommended when this project has a web front end:
                          stages 5-6 check the RENDERED surface instead of the
                          diff, stage 8 reads what the browser did after a deploy.
@@ -204,14 +225,24 @@ Rules:
   the MCP and then *continues text-only on its own*, so without a recorded answer
   the run silently narrows from "designed" to "described". The sweep row is
   `3 Design surface` ([`grill.md`](grill.md) → *The autonomy sweep*).
+- **The four domain companions print only when stage-0's own reading warrants
+  them** — sheleg-dev when the task wires money, tracking, sign-in or speed;
+  agent-stack when the thing being built is an agent system; telegram-dev when
+  Telegram is the platform; seo-aeo-audit when a logged-out reader will see the
+  surface. A block that offers all four on a CSV parser teaches the operator to
+  stop reading the block.
 - **agent-sync**: detect via a resolving `/agent-sync` or a `.claude/agent-sync.json`
   in the project. Present → take a lease before writing a guarded register and
   reserve ids before minting them. Absent → print the line **once**, continue, and
   **record the run as `ungated`** — never describe the project as protected
   ([`documentation.md`](documentation.md) → *Registers are shared state*).
-- **The behaviour line prints whenever `evals/RESULTS.md` records no blind run**, and
+- **The behaviour line prints whenever the eval ledger records no blind run**, and
   disappears the moment one is recorded — it is a state of the evidence, not a warning
-  and not a ratchet. This bundle asks every project it touches for evidence rather than
+  and not a ratchet. The ledger is `evals/RESULTS.md` **in this skill's own
+  repository** (github.com/ssheleg/task-pipeline) — it does not ship in the bundle,
+  so an installed copy that cannot resolve it prints the line with `unknown` in
+  place of the counts rather than dropping it: an unreadable ledger and a clean one
+  are different facts. This bundle asks every project it touches for evidence rather than
   assertion, and until 2026-08-10 it made the opposite claim about itself by saying
   nothing: **one self-observed run by the author, zero blind runs on zero models**, with
   a preflight that reported companion availability in detail and its own confidence not

package/plugins/task-pipeline/skills/task-pipeline/references/documentation.md

@@ -80,8 +80,8 @@ under every link checker, because the checker resolves from the file's home. →
 planted defect before its pass means anything — and the plant must be proven to have
 landed in the text the check actually parses. **A model used as a judge is the same
 object**: until it has been seen disagreeing with a human label on a case known to be
-bad, its pass is an opinion with a number attached. → [`gates.md`](gates.md) →
-*Probing*; [`learned.md`](learned.md) rules 4 and 5; [`tdd.md`](tdd.md) → *When the
+bad, its pass is an opinion with a number attached. → [`probing.md`](probing.md) →
+*Probing — plant, run, restore*; [`learned.md`](learned.md) rules 4 and 5; [`tdd.md`](tdd.md) → *When the
 thing under test is an agent*.
 
 **6. A check proves its scope and nothing beyond it.** Every gate carries what it does

package/plugins/task-pipeline/skills/task-pipeline/references/exposure.md

@@ -82,9 +82,13 @@ invisible *precisely because nobody is running a pipeline*; a check that only ex
 inside a run can never say *"stop, fourteen things are unconfirmed."* So it takes no
 brief, opens no grill, and writes nothing on its own.
 
-It prints four sections, each read from a file this pipeline already keeps: the exposure
-line and its check-list, the board's open rows by computed priority, the carry-over
-ledgers' unresolved count, and the code graph's staleness where one exists.
+It prints one section per source, each read from a file this pipeline already keeps: the
+exposure line and its check-list, the board's open rows by computed priority, the
+carry-over ledgers' unresolved count, the code graph's staleness where one exists — and
+**abandoned runs**: any run ledger whose last `event:` line is `session-end` short of
+acceptance ([`progress.md`](progress.md) → *The run's own lifecycle*). Before that
+last one, a ledger that simply stopped was indistinguishable from a run still in
+progress, which is exactly the invisibility this mode exists to end.
 
 **Where the operator asks it to file findings**, it appends board rows whose `Source`
 names the checkup and its date — so a row a machine created is distinguishable from one a

package/plugins/task-pipeline/skills/task-pipeline/references/gates.md

@@ -30,13 +30,9 @@ elsewhere and is not restated here:
 - False success — when a mechanism reports a win it never checked
 - Anatomy of a project gate
 - Writing the check itself
-- Probing — plant, run, restore
-- A probe rots, and every way it rots reports green
 - A ratchet prices the rule, not the exception
 - Run the whole suite locally before you push the tag
-- The neighbour probe — plant the evidence outside the subject
 - A ratchet's matcher is itself a check, and it needs a near-miss
-- A green probe is evidence only if the mutation is known to have landed
 - The false-positive budget
 - Ratchets
 - The result is the goal; the check is how you know
@@ -107,6 +103,15 @@ Gate assignment is the operator's call and the framework fixes none — so shipp
 reclassified stage list would contradict the sentence above it. The type exists; the
 project chooses where it applies.
 
+**The rubric steers the builder before it judges the work.** A judgment gate's
+criteria are read twice — by the judge at the gate, and earlier by whoever builds
+toward it — and the second reading is absorbed as direction: Anthropic reports
+agents converging on one aesthetic because a rubric's adjective ("museum
+quality") was obeyed as a target rather than weighed as a bar (read 2026-08-30).
+So write criteria as the direction you want taken, not only as the bar to clear;
+the words will be obeyed either way, and a rubric written carelessly is an
+instruction issued accidentally.
+
 | Rationalization | Why it is wrong |
 |---|---|
 | *"The reviewer approved it, so the gate passed."* | It did — as a judgement. Type it as one, or the table claims a machine agreed |
@@ -191,7 +196,10 @@ Four preconditions. Skipping any of them turns a run into a claim.
    added to an already-red base passes for the wrong reason and proves nothing.
 2. **The check has been probed.** Green from a check nobody has watched fail is
    worth nothing. If you did not plant the defect, you do not know what the green
-   means.
+   means. How to plant, what a probe owes, and every way one rots is
+   [`probing.md`](probing.md) — the harness is `test/probe.py`
+   (`npm run test:probe`), and hand-rolling a fourth copy of its loop is how
+   three probes in one day proved the wrong guard.
 3. **You have read its scope header** and know what it does **not** cover. A gate
    is evidence for exactly the surface it walks; quoting it beyond that is how
    "the gate is green" becomes a false statement made in good faith.
@@ -338,89 +346,6 @@ exit 0
 
 ---
 
-## Probing — plant, run, restore
-
-The law is [`audit.md`](audit.md)'s exit criterion. The procedure is this, and it is
-not optional for a check you intend to trust:
-
-```bash
-cp -R . /tmp/probe && cd /tmp/probe
-python3 - <<'PY'                       # plant IN PYTHON, never sed -i
-p = "docs/DECISIONS.md"
-s = open(p).read().replace("DEC-0001", "DEC-9999", 1)
-open(p, "w").write(s)
-PY
-bash scripts/check-docs.sh; echo "planted -> exit=$?"   # MUST be non-zero
-cd - && bash scripts/check-docs.sh; echo "clean -> exit=$?"  # MUST be 0
-```
-
-**Assert on `$?`, not on a `FAIL` line in the output.** A line on stdout is a
-decoration; the exit code is what CI reads.
-
-**Doubt the probe before you doubt the check.** On the project this comes from,
-**four of five** silent probes were the probe's fault: one added a *definition*
-where the check looks for an unresolved *reference*; one edited a string whose
-whitespace did not match; one hit the first prose mention instead of the table row;
-one flipped a row whose cell was already empty, so nothing was planted. A silent
-check is a claim about two things, and the probe is the one to doubt first — prove
-your edit landed in the text the check actually parses.
-
-**Three assertions, and the third is the one hand-rolled probes keep missing.** A
-plant that trips some *other* check has proved that other check works. Three probes
-in one day passed that way: one removed 1 of 3 identical lines and left the shape
-intact; one decremented a number inside an **already-released** section; one deleted
-the shouted spelling of a phrase and left the lowercase one. Each landed somewhere
-real and demonstrated nothing about the guard it was written for. So:
-
-1. **the substitution landed** — `replace` matching nothing returns the string
-   unchanged and raises nothing;
-2. **the exit code is non-zero** — not a `FAIL` line on stdout;
-3. **the message that fired belongs to the guard under test** — named up front, not
-   recognised afterwards.
-
-`test/probe.py` does all three (`npm run test:probe` self-tests the harness, including
-its own failure branches, because a harness whose failure path has never executed is
-the thing it exists to stop). Declare the plant as `Plant(label, path, old, new,
-expect=<the guard's own words>)` rather than hand-rolling a fourth copy of the loop.
-
-**Record the probe.** One line per section, in the change that ships the check.
-Otherwise the next reader has to redo it to know whether it was ever done.
-
----
-
-## A probe rots, and every way it rots reports green
-
-The three assertions above prove a probe works **today**. They say nothing about the
-day after, and a probe is uniquely exposed: the thing it guards is the thing that moves
-it. Four rotted in one release on 2026-08-22, and none of them failed loudly — two
-reported `caught`, two reported nothing at all.
-
-**1. The anchor is a literal the guarded thing moves.** A probe pinned to *"the bundle
-is N reference files"* stops landing the day a reference file is added — on the release
-that changes the very number it guards. Same for a version, a count word, a phrase a
-release rewrites. **Derive the anchor**: read whatever the text currently says and make
-*that* wrong. A probe that computes `wrong = stated - 1` never needs maintaining.
-
-**2. The precondition is inherited from the tree rather than created.** This is the
-subtle one, because it is triggered by the system working correctly. A probe that
-narrows a declared gap to expose *releases after the newest run stamp* has nothing to
-expose the moment a release writes an honest stamp — the newest release is now the
-newest stamp. A probe requiring an `## Unreleased` section has none the moment a release
-absorbs it. **Both landed. Both proved nothing.** A probe must construct the state it
-needs: remove the stamp, write the section, then plant the defect.
-
-**3. The document quotes the form the probe removes.** Covered as
-[`documentation.md`](documentation.md) canon 2's second half, and it belongs here too
-because the probe is where it surfaces: prose describing the wrong shape *with real
-values in it* is a second instance of the shape. The probe deletes the real one, the
-narrative still matches, the guard is silent.
-
-**How to see it before CI does.** Ask one question per probe: *what does this probe
-LOOK FOR, and who is allowed to change it?* Where the answer is "the thing it guards",
-it is rotting already. A repository-wide sweep is one grep — a two-digit literal inside
-a needle, an `assert` or a `replace` — and the triage is: the number a probe **writes**
-is correct, the number it **looks for** is the defect.
-
 ## A ratchet prices the rule, not the exception
 
 A floor that counts assertions is a floor that can be lowered by improving the code, if
@@ -477,61 +402,11 @@ the tag-ancestry check, the version-sync check and the run-stamp check have no e
 opportunity to fire. Locally, run them the way the release does — against the tree you are
 about to tag, with the suite the release claims.
 
-## The neighbour probe — plant the evidence outside the subject
-
-A probe proves a guard rejects **the phrasing its author had in mind**. That is less than
-it looks, and the gap has one shape: **a check answered by text that is not its subject.**
-
-Measured on one project in one session, six times, each found by a reader planting a
-defect and watching `PASS`:
-
-| The check's subject | The text that answered it instead |
-|---|---|
-| stage 2 names the loop's arming | *"it **arms** the UX track"*, present since an earlier release |
-| the section states the authorization floor | the same phrase in a Rationalizations row, and in a section written twenty-nine releases before |
-| the run stamps have a cap | the **standing instructions'** `max 10`, in the same table cell — and, once the check was narrowed past it, the same cap moved to the other side of the `·` |
-| a section read in full stays capped | rows under **one** heading, while a second heading in the same file held forty more |
-
-Every one of those guards had a probe. Every probe fired. The probes and the guards were
-written in the same hour from the same reading, so they shared the same blind spot.
-
-**So a guard that reads a scoped span owes a second probe, and it plants in two places at
-once:**
-
-1. **break the subject** — remove the thing the guard is about;
-2. **plant the guard's own evidence next door** — in a sibling section, an adjacent table
-   cell, a rationalizations row, the other side of a separator;
-3. require the guard to **still fail**.
-
-A guard that passes step 3 is reading its subject. A guard that goes green is reading the
-neighbourhood, and the ordinary probe cannot tell the difference — which is why this one
-is separate rather than a stricter version of it.
-
-**Step 2 means the literal the predicate matches *today*, read out of the guard.** The
-first three neighbour probes written against this section got that wrong on their first
-run: one planted the needles of two **retired** predicates, which proves the guards that
-used to exist were neighbour-answerable and says nothing about the one that does. A
-neighbour probe keyed to a needle the guard no longer reads is the same defect it was
-written to catch, one level up.
-
-**A probe that only deletes is not a neighbour probe.** It may still be a correct probe —
-but if it relies on copies that already sit next door, it must **assert they are there**.
-Otherwise a later edit removes them and the probe quietly becomes a delete-only test that
-still passes, having stopped testing the thing it is named for.
-
-**Positional narrowing is not scoping.** Three of the six were "fixed" by cutting the
-search down to a row, then to everything after a phrase, and fell each time to text that
-was still inside the cut. Scope by *what the span is about*: split to the cell, then to
-the item, then match on flattened text so an emphasis marker cannot hide the boundary.
-
-**And state the span in the guard.** One line above the predicate — *what it reads, and
-where that ends*. It costs nothing and it is the only part of a check a later reader can
-disagree with before the defect arrives.
-
 ## A ratchet's matcher is itself a check, and it needs a near-miss
 
-Reported from another project through `retro.publish`, and it is the neighbour probe's
-own class arrived at independently — which is the strongest evidence either has.
+Reported from another project through `retro.publish`, and it is the neighbour
+probe's own class ([`probing.md`](probing.md) → *The neighbour probe*) arrived at
+independently — which is the strongest evidence either has.
 
 A run built a ratchet to hold a coverage debt: a list of units with no test, a guard that
 fails when the list grows, a count printed at the gate. Exactly the shape
@@ -558,49 +433,6 @@ the reason.** In the reporting project the corrected count was *identical* to th
 and the composition was not: rows credited falsely came back in as rows genuinely paid off
 went out. A single number with no delta reads as a run where nothing happened.
 
-## A green probe is evidence only if the mutation is known to have landed
-
-Also reported from another project, three times in one day, each caught only because the
-result was too good:
-
-1. a scripted substitution missed on indentation — the file was unchanged and the probe
-   measured nothing;
-2. an assertion written against a bare identifier kept matching the **import line** after
-   the field it guarded was deleted;
-3. a file-extension alternation matched the longer extension as though it were the
-   shorter, reporting nine live files as missing.
-
-In all three the observable was identical to success. *"See it fail once"* has an unstated
-precondition — **that the thing you changed is the thing the check reads** — and a planted
-defect that did not land produces the same green as a check that cannot fail.
-
-**So a probe that mutates an existing file asserts its plant landed, in the same breath as
-planting it.** A probe that writes a whole file has no such question: the file exists or
-the command failed. This repository measured itself while writing this section and got the
-number wrong three times. A hand-rolled classifier said *206 of 206 already carry it*.
-The guard written from the rule said **22 did not** — and was itself too narrow, matching
-one spelling of the assertion, so six probes that already had it in lower case were
-called defective. A sweep then "fixed" those six and **corrupted five**, splitting live
-statements. The true figure was **16**, and it took the guard, a compile check and a
-restore from git to find it.
-
-Two things are worth keeping from that. **The check corrected the measurement that
-motivated it** — which is the argument for writing checks rather than counting by hand.
-And **a check keyed to one spelling of a rule is the class two sections above**: it
-reported as defective the probes that obeyed the rule in different words. **Every**
-mutating probe carries the assertion now — the figure is deliberately not
-written here. A first draft said *201*, which was true of the branch point and false in
-the same commit, because the twelve probes added for this release are themselves mutating
-probes. The guard computes it; a number in prose beside a check that can count is the
-class this bundle calls restating instead of computing. Probes that write a whole file
-need none: the file exists or the command
-failed.
-
-**Prefer an assertion that names the construct over one that names a substring of it.** A
-guard written against a bare identifier survives the deletion of everything it guarded,
-because the identifier still appears in an import. That is case 2 above and it is the same
-class as the section before this one, one level down.
-
 ## The false-positive budget
 
 Run a new heuristic over the **real corpus** before shipping it and count the false
@@ -772,7 +604,7 @@ of is deleted in the next refactor by someone who assumed it was dead.
 
 ## Cross-cutting, at every stage
 
-5. Cross-cutting, every stage: **when anything is settled — scope, a contract, a
+**When anything is settled — scope, a contract, a
    name, a policy, a vocabulary — run the Doc Loop
    (`references/documentation.md`) before the run moves on**: reserve the id,
    record it, resolve the question it answers, propagate by the matrix, commit

package/plugins/task-pipeline/skills/task-pipeline/references/model-tiering.md

@@ -63,3 +63,16 @@ and no silent downgrade to a cheaper tier.
 The recommendation is a **reminder, not a block**. If the recommended tier isn't
 available, keep the current model, state plainly which one is in use, and run. The
 pipeline never stalls on a model it can't get.
+
+## A harness clause encodes a model's weakness — stress-test it per generation
+
+Every fixed control in this pipeline — a cap, a mandatory checkpoint, a fix-loop
+ceiling — encodes an assumption about what the confirmed model cannot yet do
+reliably, and those assumptions expire: Anthropic reports removing an entire
+construct from its own long-running harness when a newer model generation stopped
+needing it (*Harness design for long-running agents*,
+anthropic.com/engineering, read 2026-08-30). So when the confirmed tier moves a
+generation, re-test the clauses that exist to compensate the old one instead of
+carrying them as doctrine — a control the model has outgrown is not free, it is a
+stop nobody can name the reason for. The retro's cold-retirement trigger is the
+same rule applied to standing instructions; this is it applied to the harness.

package/plugins/task-pipeline/skills/task-pipeline/references/portability.md

@@ -63,6 +63,7 @@ a row pointing outside the bundle is the defect this file exists to catch.
 | The retro: prune, cap, commits, archive | `references/retrospective.md` |
 | Rules earned by failure | `references/learned.md` |
 | **The routing default and its boundary** | `templates/routing-rule.md` |
+| **Probing** — plant, run, restore; how a probe rots; the neighbour probe; the landed-mutation rule | `references/probing.md` |
 | The seeded doc map, registers and gate | `templates/docmap.md`, `templates/decisions.md`, `templates/open-questions.md`, `templates/docgate.sh` |
 | Which agent-introduced defects are found, and that the agent fixes them rather than the script | `templates/hygiene.sh`, `references/build.md` |
 | What a stage-3/4 self-review must read back, and that its trace is computed numbers | `references/spec.md`, `references/planning.md`, `references/learned.md` |

package/plugins/task-pipeline/skills/task-pipeline/references/probing.md

@@ -0,0 +1,202 @@
+# Probing — how a check is proven before it is trusted
+
+The authoring doctrine for **probes**: planting a defect, watching the guard
+refuse it, and keeping that proof alive after the release that ships it. It
+lived inside [`gates.md`](gates.md) until 2026-08-31 and moved here whole —
+one home, routed from the gate doctrine it proves. The law it serves is
+[`audit.md`](audit.md)'s exit criterion: **a green from a check nobody has
+watched fail is not evidence.**
+
+## Contents
+
+- Probing — plant, run, restore
+- A probe rots, and every way it rots reports green
+- The neighbour probe — plant the evidence outside the subject
+- A green probe is evidence only if the mutation is known to have landed
+- Rationalizations
+
+## Probing — plant, run, restore
+
+The law is [`audit.md`](audit.md)'s exit criterion. The procedure is this, and it is
+not optional for a check you intend to trust:
+
+```bash
+cp -R . /tmp/probe && cd /tmp/probe
+python3 - <<'PY'                       # plant IN PYTHON, never sed -i
+p = "docs/DECISIONS.md"
+s = open(p).read().replace("DEC-0001", "DEC-9999", 1)
+open(p, "w").write(s)
+PY
+bash scripts/check-docs.sh; echo "planted -> exit=$?"   # MUST be non-zero
+cd - && bash scripts/check-docs.sh; echo "clean -> exit=$?"  # MUST be 0
+```
+
+**Assert on `$?`, not on a `FAIL` line in the output.** A line on stdout is a
+decoration; the exit code is what CI reads.
+
+**Doubt the probe before you doubt the check.** On the project this comes from,
+**four of five** silent probes were the probe's fault: one added a *definition*
+where the check looks for an unresolved *reference*; one edited a string whose
+whitespace did not match; one hit the first prose mention instead of the table row;
+one flipped a row whose cell was already empty, so nothing was planted. A silent
+check is a claim about two things, and the probe is the one to doubt first — prove
+your edit landed in the text the check actually parses.
+
+**Three assertions, and the third is the one hand-rolled probes keep missing.** A
+plant that trips some *other* check has proved that other check works. Three probes
+in one day passed that way: one removed 1 of 3 identical lines and left the shape
+intact; one decremented a number inside an **already-released** section; one deleted
+the shouted spelling of a phrase and left the lowercase one. Each landed somewhere
+real and demonstrated nothing about the guard it was written for. So:
+
+1. **the substitution landed** — `replace` matching nothing returns the string
+   unchanged and raises nothing;
+2. **the exit code is non-zero** — not a `FAIL` line on stdout;
+3. **the message that fired belongs to the guard under test** — named up front, not
+   recognised afterwards.
+
+`test/probe.py` does all three (`npm run test:probe` self-tests the harness, including
+its own failure branches, because a harness whose failure path has never executed is
+the thing it exists to stop). Declare the plant as `Plant(label, path, old, new,
+expect=<the guard's own words>)` rather than hand-rolling a fourth copy of the loop.
+
+**Record the probe.** One line per section, in the change that ships the check.
+Otherwise the next reader has to redo it to know whether it was ever done.
+
+---
+
+## A probe rots, and every way it rots reports green
+
+The three assertions above prove a probe works **today**. They say nothing about the
+day after, and a probe is uniquely exposed: the thing it guards is the thing that moves
+it. Four rotted in one release on 2026-08-22, and none of them failed loudly — two
+reported `caught`, two reported nothing at all.
+
+**1. The anchor is a literal the guarded thing moves.** A probe pinned to *"the bundle
+is N reference files"* stops landing the day a reference file is added — on the release
+that changes the very number it guards. Same for a version, a count word, a phrase a
+release rewrites. **Derive the anchor**: read whatever the text currently says and make
+*that* wrong. A probe that computes `wrong = stated - 1` never needs maintaining.
+
+**2. The precondition is inherited from the tree rather than created.** This is the
+subtle one, because it is triggered by the system working correctly. A probe that
+narrows a declared gap to expose *releases after the newest run stamp* has nothing to
+expose the moment a release writes an honest stamp — the newest release is now the
+newest stamp. A probe requiring an `## Unreleased` section has none the moment a release
+absorbs it. **Both landed. Both proved nothing.** A probe must construct the state it
+needs: remove the stamp, write the section, then plant the defect.
+
+**3. The document quotes the form the probe removes.** Covered as
+[`documentation.md`](documentation.md) canon 2's second half, and it belongs here too
+because the probe is where it surfaces: prose describing the wrong shape *with real
+values in it* is a second instance of the shape. The probe deletes the real one, the
+narrative still matches, the guard is silent.
+
+**How to see it before CI does.** Ask one question per probe: *what does this probe
+LOOK FOR, and who is allowed to change it?* Where the answer is "the thing it guards",
+it is rotting already. A repository-wide sweep is one grep — a two-digit literal inside
+a needle, an `assert` or a `replace` — and the triage is: the number a probe **writes**
+is correct, the number it **looks for** is the defect.
+
+## The neighbour probe — plant the evidence outside the subject
+
+A probe proves a guard rejects **the phrasing its author had in mind**. That is less than
+it looks, and the gap has one shape: **a check answered by text that is not its subject.**
+
+Measured on one project in one session, six times, each found by a reader planting a
+defect and watching `PASS`:
+
+| The check's subject | The text that answered it instead |
+|---|---|
+| stage 2 names the loop's arming | *"it **arms** the UX track"*, present since an earlier release |
+| the section states the authorization floor | the same phrase in a Rationalizations row, and in a section written twenty-nine releases before |
+| the run stamps have a cap | the **standing instructions'** `max 10`, in the same table cell — and, once the check was narrowed past it, the same cap moved to the other side of the `·` |
+| a section read in full stays capped | rows under **one** heading, while a second heading in the same file held forty more |
+
+Every one of those guards had a probe. Every probe fired. The probes and the guards were
+written in the same hour from the same reading, so they shared the same blind spot.
+
+**So a guard that reads a scoped span owes a second probe, and it plants in two places at
+once:**
+
+1. **break the subject** — remove the thing the guard is about;
+2. **plant the guard's own evidence next door** — in a sibling section, an adjacent table
+   cell, a rationalizations row, the other side of a separator;
+3. require the guard to **still fail**.
+
+A guard that passes step 3 is reading its subject. A guard that goes green is reading the
+neighbourhood, and the ordinary probe cannot tell the difference — which is why this one
+is separate rather than a stricter version of it.
+
+**Step 2 means the literal the predicate matches *today*, read out of the guard.** The
+first three neighbour probes written against this section got that wrong on their first
+run: one planted the needles of two **retired** predicates, which proves the guards that
+used to exist were neighbour-answerable and says nothing about the one that does. A
+neighbour probe keyed to a needle the guard no longer reads is the same defect it was
+written to catch, one level up.
+
+**A probe that only deletes is not a neighbour probe.** It may still be a correct probe —
+but if it relies on copies that already sit next door, it must **assert they are there**.
+Otherwise a later edit removes them and the probe quietly becomes a delete-only test that
+still passes, having stopped testing the thing it is named for.
+
+**Positional narrowing is not scoping.** Three of the six were "fixed" by cutting the
+search down to a row, then to everything after a phrase, and fell each time to text that
+was still inside the cut. Scope by *what the span is about*: split to the cell, then to
+the item, then match on flattened text so an emphasis marker cannot hide the boundary.
+
+**And state the span in the guard.** One line above the predicate — *what it reads, and
+where that ends*. It costs nothing and it is the only part of a check a later reader can
+disagree with before the defect arrives.
+
+## A green probe is evidence only if the mutation is known to have landed
+
+Also reported from another project, three times in one day, each caught only because the
+result was too good:
+
+1. a scripted substitution missed on indentation — the file was unchanged and the probe
+   measured nothing;
+2. an assertion written against a bare identifier kept matching the **import line** after
+   the field it guarded was deleted;
+3. a file-extension alternation matched the longer extension as though it were the
+   shorter, reporting nine live files as missing.
+
+In all three the observable was identical to success. *"See it fail once"* has an unstated
+precondition — **that the thing you changed is the thing the check reads** — and a planted
+defect that did not land produces the same green as a check that cannot fail.
+
+**So a probe that mutates an existing file asserts its plant landed, in the same breath as
+planting it.** A probe that writes a whole file has no such question: the file exists or
+the command failed. This repository measured itself while writing this section and got the
+number wrong three times. A hand-rolled classifier said *206 of 206 already carry it*.
+The guard written from the rule said **22 did not** — and was itself too narrow, matching
+one spelling of the assertion, so six probes that already had it in lower case were
+called defective. A sweep then "fixed" those six and **corrupted five**, splitting live
+statements. The true figure was **16**, and it took the guard, a compile check and a
+restore from git to find it.
+
+Two things are worth keeping from that. **The check corrected the measurement that
+motivated it** — which is the argument for writing checks rather than counting by hand.
+And **a check keyed to one spelling of a rule is *The neighbour probe*'s class, above**: it
+reported as defective the probes that obeyed the rule in different words. **Every**
+mutating probe carries the assertion now — the figure is deliberately not
+written here. A first draft said *201*, which was true of the branch point and false in
+the same commit, because the twelve probes added for this release are themselves mutating
+probes. The guard computes it; a number in prose beside a check that can count is the
+class this bundle calls restating instead of computing. Probes that write a whole file
+need none: the file exists or the command
+failed.
+
+**Prefer an assertion that names the construct over one that names a substring of it.** A
+guard written against a bare identifier survives the deletion of everything it guarded,
+because the identifier still appears in an import. That is case 2 above and it is the same class as
+[`gates.md`](gates.md) → *A ratchet's matcher is itself a check, and it needs a near-miss*, one level down.
+
+## Rationalizations
+
+| Excuse | Reality |
+|---|---|
+| "The check is green, that's evidence" | Only if you have seen it red. An unproven check is a decoration that reports success. |
+| "I probed it when I wrote it" | A probe proves the check works today. The thing it guards is the thing that moves it — re-read the anchor on every release that touches the subject. |
+| "The plant obviously landed, the file is smaller" | `replace` matching nothing returns the string unchanged and raises nothing. Assert the mutation landed, in the same breath as planting it. |
+| "Some guard fired, so the probe passed" | A plant that trips some *other* check has proved that other check works. The message that fired must belong to the guard under test, named up front. |

package/plugins/task-pipeline/skills/task-pipeline/references/progress.md

@@ -63,7 +63,7 @@ changes:
 task-pipeline v1.34.0 · pipeline-audit · module P1 «the progress print» (1 of 4)
   0 ✓  1 ✓  2 ✓  3 ▶  4 ·  5 ·  6 ·  7 ·  8 ·  9 · 10 ·
   ███████░░░░░░░░░░░░░░░░░░░  gates 3/11 · now 3 Spec · manual
-  board B-028 · carry-over 0 rows · exposure 99 never · unlooked 0
+  board B-028 · carry-over 0 rows · exposure N never · unlooked 0
 ```
 
 Four lines, and each one answers a question an operator otherwise has to ask:
@@ -142,7 +142,8 @@ its pair is task start and iteration close. The hand-back shares one and adds th
 end — a rail at task start has nothing to report, and a run that ends without a hand-back
 is the case this section exists for. A reader resolving *"both boundaries"* against the
 other section wrote one at task start, where TASK is the only field with content. The run
-writes a hand-back with **four sections and two lists**. It is a gate criterion **at stage
+writes a hand-back with **the sections and the two counted lists below** — the
+block is the count, and a number restated here said *four* over a block of six. It is a gate criterion **at stage
 10**, not a good intention: this file already carried one instruction with no gate behind
 it (*"copy it, tick it"*), and the v1.37.0 audit found no run had ever obeyed it.
 
@@ -380,7 +381,7 @@ And why the verb prints
 `unmeasured` rather than `0` when there are no such lines is the same reason again — the
 hook being absent and the run reading nothing are **opposite facts** the ledger cannot
 separate, so it claims neither. A `0` there would be the reassuring answer to a question
-nobody asked, over 35 files nobody checked.
+nobody asked, over a directory of reference files nobody checked.
 
 It is a disclosure: no floor, no direction, never a target. The moment the number becomes
 something to raise, a run will open files to raise it.
@@ -416,7 +417,10 @@ written by any run — the detector had no input, and the guard was doctrine wea
 script's clothes. One file serves both readers: the guard reads the `touch:` lines,
 this block reads the verdict rows and the iteration counter.
 
-Three kinds of line, appended, never rewritten:
+Appended, never rewritten. The full set of line shapes is declared under
+`## Lines` in [`../templates/run.md`](../templates/run.md) — the list is the count,
+and a count restated here drifted once already. The three these two readers
+consume:
 
 ```
 stage: 3 Spec — gate manual — verdict pass — 2026-08-10T14:02Z