task-pipeline-skill 1.85.2 → 1.86.3

package/plugins/task-pipeline/skills/task-pipeline/graph.schema.json

@@ -95,6 +95,56 @@
           ],
           "description": "`blocked` is waiting on an edge; `parked` is the verifier's deliberate *«this is a blocker, continue around it»*. The two are different facts and collapsing them loses the one a person needs."
         },
+        "claim": {
+          "type": [
+            "object",
+            "null"
+          ],
+          "default": null,
+          "additionalProperties": false,
+          "description": "The live execution grant when this node is `running` — WHO (session/attempt), not the role in `owner`. It is the identity that lets two `next` runs race N-001 and only one win, and the fence that stops a lost holder from clobbering the run that reclaimed its node. The full contract, and the acquire/start/renew/release/recover verbs that write it, are `execution-attempt.schema.json` (PF-01). A `running` node carries one; every other status carries `null`.",
+          "required": [
+            "owner",
+            "attempt",
+            "revision",
+            "fence",
+            "expiry",
+            "state"
+          ],
+          "properties": {
+            "owner": {
+              "type": "string",
+              "minLength": 1
+            },
+            "attempt": {
+              "type": "integer",
+              "minimum": 1
+            },
+            "revision": {
+              "type": "integer",
+              "minimum": 0
+            },
+            "fence": {
+              "type": "integer",
+              "minimum": 1
+            },
+            "expiry": {
+              "type": "string",
+              "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(\\.[0-9]+)?Z$"
+            },
+            "state": {
+              "enum": [
+                "ready",
+                "claimed",
+                "completed"
+              ]
+            },
+            "installed_at": {
+              "type": "string",
+              "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}(\\.[0-9]+)?Z$"
+            }
+          }
+        },
         "blocked_by": {
           "type": "array",
           "items": {
@@ -228,6 +278,94 @@
               }
             }
           }
+        },
+        "proof": {
+          "type": [
+            "object",
+            "null"
+          ],
+          "default": null,
+          "additionalProperties": true,
+          "description": "The proof identity `close` recorded (FIX-PF-02.01): the commit and tree the verdict was TESTED against, plus optional base/packet/attempt/graph_revision/checks. `close` writes it only after confirming the verdict's `tested.head` equals the current HEAD, so a node called done carries WHAT WAS PROVEN and against which tree — not merely the HEAD that happened to be checked out when the verdict landed. `head: \"unavailable\"` outside a checkout (canon 9a).",
+          "properties": {
+            "head": {
+              "type": "string"
+            },
+            "tree": {
+              "type": "string"
+            },
+            "graph_revision": {
+              "type": "string"
+            },
+            "base": {
+              "type": "string"
+            },
+            "packet": {
+              "type": "string"
+            },
+            "attempt": {
+              "type": "string"
+            },
+            "checks": {
+              "type": "array",
+              "items": {
+                "type": "string"
+              }
+            }
+          }
+        },
+        "exception": {
+          "type": [
+            "object",
+            "null"
+          ],
+          "default": null,
+          "additionalProperties": false,
+          "required": [
+            "reason",
+            "by",
+            "at"
+          ],
+          "properties": {
+            "reason": {
+              "type": "string",
+              "minLength": 1
+            },
+            "by": {
+              "type": "string",
+              "minLength": 1
+            },
+            "at": {
+              "type": "string"
+            }
+          },
+          "description": "An AUTHORIZED EXCEPTION (FIX-PF-03.02): the operator's recorded decision that this node ships without/despite certification — reason + identity + the tree it was granted at. Its own disposition: it never turns anything into a PASS, and a failed certification stays visible beside it."
+        },
+        "dispatch_packet": {
+          "type": [
+            "object",
+            "null"
+          ],
+          "default": null,
+          "additionalProperties": false,
+          "required": [
+            "address",
+            "sha256"
+          ],
+          "properties": {
+            "address": {
+              "type": "string",
+              "minLength": 1
+            },
+            "sha256": {
+              "type": "string",
+              "pattern": "^[0-9a-f]{64}$"
+            },
+            "base": {
+              "type": "string"
+            }
+          },
+          "description": "The IMMUTABLE dispatch packet this node was built from (FIX-PF-05.01): address + digest of the compiled packet (REQ refs, constraints, interfaces, artifact digests, base, scope, budget, profile, skill lock — no ephemeral secret). Links the node to the exact context it ran under, so a graph in a git-ignored workspace still points at a durable, content-addressed packet."
         }
       },
       "allOf": [
@@ -239,6 +377,9 @@
         },
         {
           "$ref": "#/definitions/rule_parked_needs_reason"
+        },
+        {
+          "$ref": "#/definitions/rule_running_needs_claim"
         }
       ]
     },
@@ -280,9 +421,11 @@
           "enum": [
             "add",
             "park",
-            "close"
+            "close",
+            "invalidate",
+            "waive"
           ],
-          "description": "Which mutation made this entry. `close` joined the two on 2026-08-17 with T-5 — and it was caught by a probe rather than by the fixture asserting *the graph after a close still validates*, because `violations()` never reaches an enum. The same disagreement B-084 records, one field over."
+          "description": "Which mutation made this entry. `close` joined the two on 2026-08-17 with T-5 — and it was caught by a probe rather than by the fixture asserting *the graph after a close still validates*, because `violations()` never reaches an enum. The same disagreement B-084 records, one field over. `invalidate` joined with PF-02.02: a REQ/interface/brief change supersedes a node and resets its downstream proofs."
         },
         "node": {
           "type": "string",
@@ -294,6 +437,10 @@
           "minLength": 1,
           "pattern": "\\S",
           "description": "The reason, written for a person reading it later. The non-whitespace pattern is required for the same reason `parked_reason` needs one: `minLength: 1` counts a space."
+        },
+        "precondition": {
+          "type": "string",
+          "description": "The tree the mutation was made against — the proven HEAD for a `close` (FIX-PF-02.01). A revision then carries a VERSION, so a brief/REQ/interface change that moves the tree is a visibly different precondition, which is what invalidates a proof taken before it."
         }
       }
     },
@@ -378,6 +525,29 @@
           }
         }
       }
+    },
+    "rule_running_needs_claim": {
+      "description": "PF-01: a `running` node carries a live grant, or two `next` runs both dispatch it and a lost holder orphans it forever. The grant is an identity (session/attempt), not the ROLE in `owner`, and it is fenced and expiring — the full contract is `execution-attempt.schema.json`. Referenced from `node.allOf`, same shape as done-needs-evidence.",
+      "if": {
+        "properties": {
+          "status": {
+            "const": "running"
+          }
+        },
+        "required": [
+          "status"
+        ]
+      },
+      "then": {
+        "required": [
+          "claim"
+        ],
+        "properties": {
+          "claim": {
+            "type": "object"
+          }
+        }
+      }
     }
   }
 }

package/plugins/task-pipeline/skills/task-pipeline/pipeline.schema.json

@@ -32,6 +32,55 @@
     },
     "retro": {
       "$ref": "#/definitions/retro"
+    },
+    "must_understand": {
+      "type": "array",
+      "items": {
+        "type": "string",
+        "minLength": 1
+      },
+      "description": "Must-understand extension names (FIX-PF-06.01). A consumer (an importer, an adapter — e.g. Fabric's taskPipeline adapter) that does not recognise an entry here REFUSES the whole config rather than importing what it understood: the fields named are load-bearing, and a silently-omitted constraint is the one failure mode an interop layer must not have. Unknown fields NOT named here may be carried verbatim as extensions. On profile COMPILATION (FIX-TP-03.02) the runtime executes exactly the profile's declared stages and gates — no default stage numbers injected — but an entry here it does not recognise BLOCKS the compile rather than running with the capability silently absent."
+    },
+    "kernel": {
+      "type": "object",
+      "additionalProperties": true,
+      "required": [
+        "scope",
+        "evidence",
+        "deps",
+        "resume"
+      ],
+      "description": "The INVARIANT contract every pipeline carries regardless of how many stages its profile has (FIX-TP-03.01). The `stages` array is the replaceable PROFILE; the kernel is not — a minimal three-stage profile still declares all four kernel fields, and no kernel field is tied to a stage number.",
+      "properties": {
+        "scope": {
+          "type": [
+            "string",
+            "object"
+          ],
+          "description": "What a unit of work may change — the edit boundary."
+        },
+        "evidence": {
+          "type": [
+            "string",
+            "object"
+          ],
+          "description": "How a claim carries its receipt (file:line, a command + output, a test name)."
+        },
+        "deps": {
+          "type": [
+            "string",
+            "object"
+          ],
+          "description": "What each unit reads and what must precede it."
+        },
+        "resume": {
+          "type": [
+            "string",
+            "object"
+          ],
+          "description": "The resume point that survives context loss."
+        }
+      }
     }
   },
   "definitions": {
@@ -200,7 +249,7 @@
             "check"
           ],
           "additionalProperties": true,
-          "description": "Condition that must pass before advancing to the next stage.",
+          "description": "Condition that must pass before advancing to the next stage. A consumer that meets a gate type outside the enum (or one it cannot execute) REJECTS the config naming the gate — an unknown gate silently omitted is a pipeline that advances ungated (FIX-PF-06.01).",
           "properties": {
             "type": {
               "enum": [

package/plugins/task-pipeline/skills/task-pipeline/references/acceptance.md

@@ -453,3 +453,10 @@ git add <submodule> && git commit -m "chore: bump <name> submodule — <why>"
 Moved out of `SKILL.md` on 2026-08-16: the body was 6685 tokens against a
 < 5000 budget, and stage-10 close-out is what this file is for.
 
+
+
+**Handoff is repository-backed.** Apply `artifacts.md` → *Durable handoff across
+agents and repositories*: reports, task context and next steps must be tracked,
+with verified remote refs where push is authorized. A local preview or clean but
+unpushed worktree is not delivery. Check a fresh checkout, not the author’s paths.
+

package/plugins/task-pipeline/skills/task-pipeline/references/artifacts.md

@@ -11,6 +11,7 @@ shape.
 - Stage → input map — where each stage's information comes from
 - Stage → artifact map
 - This repo (task-pipeline itself), for reference
+- Durable handoff across agents and repositories
 
 ## In the host project
 
@@ -221,3 +222,25 @@ README.md  CHANGELOG.md  LICENSE  CLAUDE.md
 CONTRIBUTING.md  SECURITY.md  CODE_OF_CONDUCT.md
 <artifacts>/{specs,plans}/               # this repo's own design history
 ```
+
+## Durable handoff across agents and repositories
+
+Persist reports, plans, decisions and executor context in the owning repository,
+including work that stops at planning. An app preview or ignored scratch directory
+may be a working copy, never the only copy a successor needs. Before removing the
+build scratch directory, promote the durable task inputs, outputs and unresolved
+work into the artifact root; Git cannot recover files that were never tracked.
+
+Give the successor one tracked entry point with the objective, accepted decisions,
+completed and open task IDs, module/contracts context, evidence and next task.
+Use relative artifact paths; source references name repository and commit. For
+multiple repositories, one central index names each remote, branch, commit and
+handoff path. Keep task packets bounded and refresh their hashes after relocation.
+
+Before the handoff, commit task-owned changes and push the working branches when
+the operator has authorized it, including standing authorization. Verify each
+remote ref equals the recorded commit and open the entry from a fresh checkout.
+Report missing access as a delivery blocker, never as a successful push. Preserve
+unrelated edits and explicit local-only instructions. Exclude secrets, caches and
+foreign dependency trees. A pushed planning branch is not a release or deployment;
+production submodule pins change only through the normal integration process.

package/plugins/task-pipeline/skills/task-pipeline/references/audit.md

@@ -43,6 +43,12 @@ audit. That skill discovers what the project is, probes it, reads the production
 evidence a repository cannot hold, and hands phase 4 back here — so the method
 below stays the one place it is written.
 
+Its findings keep their axes apart: a defect proven by reproduction stands with
+incidence UNKNOWN — UNKNOWN ≠ 0, and absent telemetry lowers exposure claims,
+never technical truth. `templates/finding-evidence.json` is the minimal evidence
+schema (mechanism / reproduction / exposure / incidence / impact uncertainty,
+observations apart from assumptions, scope and time recorded).
+
 `loop-guard.md` governs loops that *change* things — the fix loop, a re-entered
 stage. Its trip means a decision is being re-litigated at the wrong altitude. This
 file governs loops that *look* for things. Its trip means the axis is exhausted,

package/plugins/task-pipeline/skills/task-pipeline/references/backlog.md

@@ -90,7 +90,14 @@ So:
   somebody else pick this up?"*, which is the only question the board is answering.
 - **The ref is checkable and that is the point.** `git rev-parse` either resolves it or it
   does not, so a row that has quietly expired can be found before somebody plans around
-  it.
+it.
+
+An audit row is an entry point, not a complete execution handoff. Before an
+independent agent takes it, attach the context closure, implementation decisions,
+input revisions, dependencies and result contract from
+[Execution packets](planning.md#execution-packets). Keep priority separate from dispatch
+readiness, and account for every finding without turning every finding into an
+isolated task that ignores shared module/interface changes.
 
 **A prose detector was tried first and discarded.** Matching *"parked"*, *"is built"*,
 *"ready to merge"* in the description cell fired on **three rows out of 187 and all three

package/plugins/task-pipeline/skills/task-pipeline/references/browser.md

@@ -147,6 +147,14 @@ await browser.close();
 console error nobody asserted on is precisely what the look is for. This is `DEC-0004`
 and it is the reason both halves exist.
 
+**The claims are a contract, not prose** (PXS-05.01): `templates/browser-claims.json`
+links each REQ/scenario id to the STATE it was verified in and the KIND of check
+(this table's own look/suite/library split), and `python3 test/browser_claims_test.py`
+validates a filled copy with stdlib only — a visual PASS needs its artifact, captured
+in the claim's own state (the initial screenshot closes nothing about opened/error);
+a suite PASS closes no look claim; a toggle owes its full cycle; no browser channel
+is NOT_RUN with the reason.
+
 ## Getting past a login, and past a backend
 
 A surface behind auth is the usual reason a run skips the look. Both channels solve it,

package/plugins/task-pipeline/skills/task-pipeline/references/build.md

@@ -374,6 +374,38 @@ satisfied**, and code quality. The implementer's self-review never substitutes f
 it. Rubric, inputs, prompt templates and how to build the diff package:
 [`review.md`](review.md).
 
+**The dispatch packet is compiled and IMMUTABLE.** Before a node is built, its
+context is compiled into one packet — the REQ references, the global
+constraints, the interfaces, the artifact digests, the base revision, the
+scope, the budget, the run profile and the skill lock — every ref bound
+(address + digest) or the compilation is refused; a missing required ref is a
+refusal, not a default. **No ephemeral secret rides inside**: a packet outlives
+the session that built it, so a value that must expire is referenced by the
+NAME of its store, never carried by value. `scripts/context_packets.py
+compile-dispatch` builds it and the node records its address + digest
+(`dispatch_packet`), so a build in a git-ignored workspace still points at the
+durable context it ran under.
+
+**The result is typed, tied and comparable.** An attempt's result records its
+TYPED outputs (name + kind + address + digest), the `packet_digest` of the
+immutable packet it answered, and `consumed` — the predecessor outputs it read,
+by name + digest. Freshness is then a comparison, never a feeling: when a
+predecessor re-runs and an output digest changes, `scripts/packet.py`'s
+`consumed_stale` names every result that read the old bytes, and those nodes
+rebuild at a new revision. And the packet rule applies to the answer as to the
+question: **no credential rides in a result** — an output whose name reads as
+one is refused by `validate-result`.
+
+**An authorized exception is its own disposition — never a fake PASS.** Where
+the operator decides a node ships without (or despite) certification, that is
+recorded with `graph.py waive --node … --reason … --by …`: an `exception`
+object carrying the reason and the IDENTITY that signed it. The failed
+certification stays visible beside it, the node is never marked certified, and
+`close` stamps the exception into the evidence — a reader later sees a
+decision, not a green. And reviewer EXPOSURE is stated honestly: a tier report
+may say what the reviewer actually saw, and a syntax lint recorded as a blind
+review is refused by `certify` by name.
+
 **The boundary with certification:** this review closes a **prose-plan task** —
 one reviewer, the five-round cap of §4.5. A **work-graph node** is closed by the
 three blind tiers and `graph.py certify` instead

package/plugins/task-pipeline/skills/task-pipeline/references/companion-skills.md

@@ -6,7 +6,18 @@ fallback path, no version skew, and no failure mode where a stage can't run beca
 something isn't installed.
 
 What remains is a short list of **optional** companions that make individual stages
-better, plus one that is required only for user-facing work.
+better, plus one whose ARTIFACT is required for user-facing work.
+
+**The provider rule — a gate checks artifacts and their quality, never package
+presence.** For every row below, three ways satisfy the same contract: the
+**preferred family provider**, an **alternative provider producing the same
+artifact contract** (a third-party design workflow whose output records tokens,
+states and decisions IS designed — judged on the result), or the **inline
+fallback** (write the artifact by hand against the contract). What a gate
+refuses is the missing ARTIFACT, not the missing package — and when a tool is
+absent, the run writes down WHICH check was therefore not done ("scenario lint
+NOT_RUN: /ux-lint unavailable"), because a silently skipped check and a passed
+one must never look alike.
 
 
 > **Decision `DEC-0004`** — two browser channels ranked by nothing, one detection rule,
@@ -49,8 +60,8 @@ better, plus one that is required only for user-facing work.
 
 | Skill / tool | Needed for | Required? | Install |
 |---|---|---|---|
-| **super-ux** (`ux-foundation`, `ux-flows`, `ux-scenarios`, `ux-audit`, `/ux`, `/ux-lint` — **and the copy half**: `copywriting`, `brand-voice`, `/brand-init`, `/copy`, `/brand-lint`, plus `/vision`) | stage 3 — the **UX track** *and* the **COPY track**. This row named six surfaces until 2026-08-10 while super-ux shipped eight skills and fifteen commands: the whole brand-and-copy half was invisible to this pipeline, so a run built scenarios and screens and then wrote the interface strings by taste | **Required for any user-facing task** | `/plugin marketplace add ssheleg/super-ux` → `/plugin install super-ux@super-ux` (or `npx skills add ssheleg/super-ux`) |
-| **sheleg-design** (`/sheleg-design`) | stage 3 — the **VISUAL track**: tokens and themes, typography and rhythm, motion and how it degrades to rest, the visual language a brand is recognised by. It answers *how it looks*, which no other companion here answers — `super-ux` decides what the interface must do, `copywriting` how it sounds. Before 2026-08-10 this skill appeared once in the whole bundle, as a name in a list | **Recommended** on any task with a visual surface; never a gate. Absent → the run says the visual layer shipped **undesigned**, which is the honest name for picking values at the keyboard | `/plugin marketplace add ssheleg/sheleg-design` → `/plugin install sheleg-design@sheleg-design-skill` |
+| **super-ux** (`ux-foundation`, `ux-flows`, `ux-scenarios`, `ux-audit`, `/ux`, `/ux-lint` — **and the copy half**: `copywriting`, `brand-voice`, `/brand-init`, `/copy`, `/brand-lint`, plus `/vision`) | stage 3 — the **UX track** *and* the **COPY track**. This row named six surfaces until 2026-08-10 while super-ux shipped eight skills and fifteen commands: the whole brand-and-copy half was invisible to this pipeline, so a run built scenarios and screens and then wrote the interface strings by taste | **Artifact required for any user-facing task** — the scenarios, not the package: an equivalent scenario set from another provider or the inline fallback passes the same gate | `/plugin marketplace add ssheleg/super-ux` → `/plugin install super-ux@super-ux` (or `npx skills add ssheleg/super-ux`) |
+| **sheleg-design** (`/sheleg-design`) | stage 3 — the **VISUAL track**: tokens and themes, typography and rhythm, motion and how it degrades to rest, the visual language a brand is recognised by. It answers *how it looks*, which no other companion here answers — `super-ux` decides what the interface must do, `copywriting` how it sounds. Before 2026-08-10 this skill appeared once in the whole bundle, as a name in a list | **Recommended** on any task with a visual surface; never a gate. Absent → judge the visual layer by its RESULT: a third-party design workflow that recorded tokens, states and decisions is designed; only a layer with no design evidence at all ships **undesigned**, which is the honest name for picking values at the keyboard | `/plugin marketplace add ssheleg/sheleg-design` → `/plugin install sheleg-design@sheleg-design-skill` |
 | **context7** (MCP — call tools fully qualified: `context7:resolve-library-id`, `context7:query-docs`) | stage 1 docs study | Recommended (web-search fallback) | connect the context7 MCP server |
 | **Figma** (MCP) | stage 3 UX track, when the project designs visually — super-ux mirrors each `SCR-` screen/state into a frame | Optional, **UI + Figma-on only**. Absent → super-ux degrades to text-only *by itself and never blocks*, so shipping a UI feature with no mockups becomes a silent scope call — which is why the stage-0 sweep decides it | connect the Figma MCP server (`/mcp`, or your claude.ai connectors) |
 | **[obsidian-wiki](https://github.com/ar9av/obsidian-wiki)** (`wiki-query`, `wiki-update`) | **stage 0 harvest** (query what's already known) **+ stage 9 sync** | **Recommended** — never a gate; absent → harvest runs on repo docs alone | `pip install obsidian-wiki` → `obsidian-wiki setup --vault /path/to/your/vault` |

package/plugins/task-pipeline/skills/task-pipeline/references/decomposition.md

@@ -5,8 +5,8 @@ brief describes more than one deliverable, more than one surface, or a system
 rather than a change — must be cut into modules first, and then built one brick at
 a time, each brick carrying its own documentation, spec, plan, build and gates.
 
-This runs at the end of **stage 2**, on the approved design, before any spec is
-written. It is skipped — explicitly, in writing — when the work is a single module.
+Module mapping runs at the end of **stage 2**, before the spec; a single-module change skips that map explicitly.
+Stage-4 leaf sizing still applies when work is handed to independent agents; skipping the map does not skip task sizing.
 
 ## Contents
 
@@ -15,6 +15,7 @@ written. It is skipped — explicitly, in writing — when the work is a single
 - The module map — the artifact
 - GATE (part of stage 2, manual)
 - The program loop — one brick at a time
+- Executor-sized tasks and context
 - Program done
 
 ## When it applies
@@ -140,6 +141,86 @@ Rules for the loop:
   loop guard ([`loop-guard.md`](loop-guard.md)) — stop, name the oscillation, and
   fix the layer that owns it instead of iterating.
 
+## Executor-sized tasks and context
+
+The module map is not an execution queue. At stage 4, split each change into
+small, reviewable outcomes before handing it to another agent. Keep the original
+finding or feature as the parent; only its leaf tasks enter the dispatch queue.
+Do not mark the parent done because its plan exists.
+
+### Cut by outcome, with its proof
+
+One leaf owns one observable behavior, invariant, or artifact contract. Include
+the focused regression and necessary documentation with that outcome; do not
+create separate "write tests" and "write docs" jobs by ritual. Split when a leaf
+requires another independent decision, another resource owner, an unrelated
+failure mechanism, or more primary context than its declared budget permits.
+Do not split a transaction across tasks merely to reach a target task count.
+
+For example, "fix the updater" is a parent. A leaf can make `--dry-run` return
+an operation plan without mutation, proved by unchanged fixture bytes and no
+mutating child calls. Atomic generation switching and replacement verification
+are separate outcomes with their own prerequisites and tests.
+
+Before dispatch, the planner records for every leaf:
+
+- parent requirement/finding and module/interface owner;
+- the concrete change, why it is needed, and the observable expected result;
+- decisions already made, alternatives rejected, and explicit exclusions;
+- exact existing edit targets and proposed create targets; historical evidence,
+  migrations and ADRs remain read-only unless their own contract permits edits;
+- inputs, required predecessor outputs, and data/control/resource edge reasons;
+- ordered implementation steps and a focused positive and negative acceptance;
+- primary context manifest, source/context digests, outputs and rollback;
+- one integration owner and the claim/capability checks from
+  [`planning.md`](planning.md) → Execution packets.
+
+### Resolve material choices before implementation
+
+An implementation leaf is not ready while product behavior, public interface,
+data ownership, authorization, dependency policy, or failure semantics remain
+undecided. Create a bounded decision task instead: one precise question, named
+sources or experiment, time/context budget, required decision record, and the
+criterion that resolves it. Its consumers wait for that record and receive a
+new packet revision. Do not fill uncertainty with invented certainty.
+
+Routine local implementation choices can remain with the executor. A plan need
+not prescribe every variable name. New evidence that invalidates a recorded
+decision returns to its owner with the smallest counterexample; the executor
+does not silently redesign adjacent modules or restart the whole interview.
+
+### Budget what the executor actually reads
+
+Primary context contains the leaf brief, applicable module/interface decisions,
+acceptance, and the relevant source ranges. The full audit, other modules,
+alternative designs and historical discussion belong in an indexed appendix.
+Keep every required reference resolvable and digest-bound, but do not inject
+the entire reference closure into every prompt. Read deeper source on demand
+when needed to verify the local change.
+
+Set a primary-context budget for the chosen host before materialization. Record
+the tokenizer/model when measuring tokens; a byte or character count is a byte
+or character count, never a token measurement. If the materialized primary
+context exceeds the budget, split the outcome or move truly optional material
+to the appendix. Never truncate constraints, acceptance, error behavior or
+dependency outputs to make a packet fit. No universal task duration, file count
+or token limit establishes quality; use project defaults and report exceptions.
+
+### Cold-start and completion checks
+
+A fresh executor must be able to answer "what changes, where, why, under which
+decision, and how success is observed" from the primary packet without reading
+the planner's conversation. Validate this before dispatch; reading an ID or a
+title alone is not the test. Recheck hashes and materialize predecessor outputs
+after they exist. Planned input placeholders never count as satisfied inputs.
+
+Review the leaf's actual candidate code and evidence. Then check the parent's
+acceptance across its leaves so a collection of individually green tasks cannot
+drop an end-to-end requirement. Parent close requires current child receipts,
+cross-seam checks where applicable, and the integration result. Plan completeness,
+dispatch readiness, implemented behavior and released availability are separate
+states.
+
 ## Program done
 
 The program is finished when every row is `done` or `deferred` with an agreed home,

package/plugins/task-pipeline/skills/task-pipeline/references/doctrine-map.md

@@ -0,0 +1,53 @@
+# The doctrine map — which reference owns which stage
+
+Split out of `SKILL.md` on 2026-09-10, when its body measured 5429 tokens against the
+house budget of 5000. Nothing here is new: it is the table that says where each stage's
+built-in doctrine lives, so an agent loads the one file the stage needs instead of
+carrying the whole index in every turn.
+
+The rule the table serves stays in `SKILL.md`: every stage's doctrine ships inside this
+skill, no stage blocks on an install, and the single deliberate exception is the stage-3
+UX track on a user-facing task.
+
+## Contents
+
+- [Which reference owns which stage](#which-reference-owns-which-stage)
+
+## Which reference owns which stage
+
+| Stage | Built-in doctrine |
+|---|---|
+| 0, 9 · The documentation system | `references/documentation.md` |
+| any stage · The canons, and where each is enforced | [`evidence-docs`](../../evidence-docs/SKILL.md) — the sibling skill in this plugin |
+| 6–10 · Gates | `references/gates.md` |
+| 7–8 · Deploy targets | `references/deploy-targets.md` |
+| any stage · Hooks | `references/hooks.md` |
+| 0 Knowledge harvest (pre-grill) | `references/knowledge-sources.md` |
+| 0, 9 The code graph (graphify — recommended, never required) | `references/knowledge-graph.md` |
+| 0 Intake grill | `references/grill.md` |
+| 2 Brainstorm | `references/brainstorm.md` |
+| 2 Decompose (platforms only) | `references/decomposition.md` |
+| 3 Spec | `references/spec.md` |
+| 4 Plan | `references/planning.md` |
+| the queue the loop walks | `references/work-graph.md` |
+| 5–8 · how a **work-graph node** is CLOSED — three blind readings at three distances, all three required (ceiling 3); a **prose-plan task** closes through `review.md` instead — one reviewer, five-round cap | `references/certification.md` |
+| 5 Build (worktree, subagents, fix loop) | `references/build.md` + `references/review.md` |
+| 5–6 TDD + suite gate | `references/tdd.md` |
+| 5, 6, 8 The browser — the look, the spec suite, and the difference | `references/browser.md` |
+| 10 Acceptance (REQ close-out) | `references/acceptance.md` |
+| 10 Retrospective (the run's last act) | `references/retrospective.md` |
+| 10 + any audit (what's *missing*) | `references/audit.md` |
+| **first run in a project** (new or existing) | `references/adoption.md` |
+| **first run · the entry audit** (offered once) | `references/setup.md` |
+| **what travels with the bundle vs stays in a project** | `references/portability.md` |
+| any repeating loop | `references/loop-guard.md` |
+| run-wide · what the run **leaves running and leaves behind** — every gate, and stage 10 | `references/residue.md` |
+| run-wide · what the run **prints about itself** — the rail, the iteration line | `references/progress.md` |
+| run-wide · how a run keeps going (the loop mode + the context budget) | `references/continuity.md` |
+| run-wide · the work-list **between** runs, and the order it comes off | `references/backlog.md` + `references/prioritisation.md` |
+| run-wide · whether a **human** ever confirmed what shipped, and when | `references/verification.md` |
+| run-wide · how much unconfirmed work has piled up, and what to look at first | `references/exposure.md` |
+| any stage · Where each artifact belongs | `references/artifacts.md` |
+| preflight · Companion skills and their fallbacks | `references/companion-skills.md` |
+| 6–10 · How the host project's CLAUDE.md is read | `references/conventions.md` |
+| preflight · Model map, ids and the override | `references/model-tiering.md` |

package/plugins/task-pipeline/skills/task-pipeline/references/documentation.md

@@ -110,6 +110,9 @@ files read` and *the recorder was never installed* are opposite facts, and a `0`
 the first while meaning the second — the most reassuring answer available, derived from
 an instrument nobody switched on. So the unmeasured case prints a word, and the word says
 why it cannot be a number.
+The same refusal covers findings: a defect proven by reproduction records
+incidence UNKNOWN — a word, never a zero — and stays a defect;
+`templates/finding-evidence.json` is the minimal schema that keeps the axes apart.
 
 The rule is written down because it arrived three times under three names before anyone
 named it: `references/knowledge-graph.md` → *State zero out loud* (a fresh graph must