task-pipeline-skill 1.86.1 → 1.86.3

package/CHANGELOG.md

@@ -1,3 +1,41 @@
+## v1.86.3 — the release declares the stamp it does not carry, eighth time
+
+`v1.86.2` was tagged and refused by its own release workflow: `npm run test:all` against
+the tag's tree found the version named nowhere in `retro.md`'s `## Releases that carry no
+stamp`. Nothing published under it — the tag exists, the release does not, npm never
+served it. The tree had passed `npm test` locally and CI's `validate` job; the release
+runs `test:all`, and `R-010` says to run exactly that against the tree you are about to
+tag. Read that evening, skipped that evening.
+
+The v1.86.2 payload is unchanged. This release adds the declaration for both versions.
+
+## v1.86.2 — the filter this skill exported filtered nothing
+
+Claude Code 2.1.270 started printing `hooks.json: unknown key "if" … ignored` at session
+start for a sibling plugin. The same shape has been in this skill's one shipped template
+since 2026-08-03, and every project that copied it into `.claude/settings.json` got a
+documentation gate that ran on **every** Bash call — a red gate refused `ls`, not commits.
+
+Guards: 429 → **429**, property checks 15 → **15** — the regression for this release is
+`test/audit_regressions/fix-hk-02.py`, run by `npm test`, and NOT a workflow step:
+`validate.yml` sits at 511,941 of GitHub's 512,000 bytes (#91), and a 59-byte headroom holds
+no step. It plants the old shape into a copy and requires the validator to refuse it by name.
+
+- **`"if": "Bash(git commit *)"` sat beside `matcher`, and a matcher group is only
+  `matcher` + `hooks`.** Read out of the 2.1.270 binary's schema: `if` exists on a command
+  handler only. Moved there in `templates/hooks.example.json`; the group's `_note` moved to
+  a top-level `_filter_note` for the same reason, since the block is copied verbatim into a
+  settings file.
+- **`references/hooks.md` said "beside `matcher`" and now says "inside the handler,
+  beside `type` and `command`"** — the worked example too; the evidence-docs mirror was
+  regenerated with `fix-ed-01.01.py --sync`. The dated 2026-08-03 documentation-track plan
+  keeps its wording.
+- **A new validator check refuses any key the hook schema does not know** at either level
+  and requires exactly one handler-level `Bash(git commit *)`; `fix-hk-02.py` plants the
+  pre-v1.86.2 shape back and watches the check fire. `claude plugin validate
+  --strict` passes the defective file, so a repo gate is the only place this fails before a
+  session start.
+
 ## v1.86.1 — the release declares the stamp it does not carry
 
 `v1.86.0` was tagged and refused: the run-stamp gate reads the tag's own tree, a

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.86.1 |
+| **Version** | 1.86.3 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki, and **one of two browser channels** — `playwright` (CLI or MCP) or `chrome-devtools` (MCP); either satisfies the browser step and neither is required. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.86.1",
+  "version": "1.86.3",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/judgment/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs). Retro insights can publish upstream as issues, opt-in and redacted.",
-  "version": "1.86.1",
+  "version": "1.86.3",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/skills/evidence-docs/references/hooks.md

@@ -129,8 +129,13 @@ machine, and the first surprising denial is debugged in the wrong project.
 ```
 
 - a tool-name pattern (`Edit|Write|…`), or `"*"` for every call;
-- for a specific shell command, add `"if": "Bash(git commit *)"` beside
-  `"matcher": "Bash"`.
+- for a specific shell command, add `"if": "Bash(git commit *)"` **inside the
+  handler object**, beside `"type"` and `"command"` — never beside `"matcher"`.
+  A matcher group is only `matcher` + `hooks`; a key Claude Code does not know
+  there is ignored, and from 2.1.270 announced at every session start as
+  `hooks.json: unknown key "if" … ignored`. This skill's own template carried it
+  at group level until v1.86.2, so its gate filtered nothing and ran on every
+  Bash call.
 
 `if` uses **permission-rule syntax** (`Bash(git *)`, `Edit(*.ts)`) and is evaluated
 **only on tool events** — `PreToolUse`, `PostToolUse`, `PostToolUseFailure`,
@@ -177,9 +182,9 @@ the project's `.claude/settings.json`.
 
 ```json
 { "hooks": { "PreToolUse": [
-  { "matcher": "Bash", "if": "Bash(git commit *)",
-    "hooks": [{ "type": "command", "shell": "bash", "timeout": 60,
-      "command": "bash scripts/check-docs.sh >&2 || exit 2" }] } ] } }
+  { "matcher": "Bash",
+    "hooks": [{ "type": "command", "if": "Bash(git commit *)", "shell": "bash",
+      "timeout": 60, "command": "bash scripts/check-docs.sh >&2 || exit 2" }] } ] } }
 ```
 
 `|| exit 2` is the contract, not a flourish: without it the gate's own `exit 1`

package/plugins/task-pipeline/skills/task-pipeline/references/hooks.md

@@ -129,8 +129,13 @@ machine, and the first surprising denial is debugged in the wrong project.
 ```
 
 - a tool-name pattern (`Edit|Write|…`), or `"*"` for every call;
-- for a specific shell command, add `"if": "Bash(git commit *)"` beside
-  `"matcher": "Bash"`.
+- for a specific shell command, add `"if": "Bash(git commit *)"` **inside the
+  handler object**, beside `"type"` and `"command"` — never beside `"matcher"`.
+  A matcher group is only `matcher` + `hooks`; a key Claude Code does not know
+  there is ignored, and from 2.1.270 announced at every session start as
+  `hooks.json: unknown key "if" … ignored`. This skill's own template carried it
+  at group level until v1.86.2, so its gate filtered nothing and ran on every
+  Bash call.
 
 `if` uses **permission-rule syntax** (`Bash(git *)`, `Edit(*.ts)`) and is evaluated
 **only on tool events** — `PreToolUse`, `PostToolUse`, `PostToolUseFailure`,
@@ -177,9 +182,9 @@ the project's `.claude/settings.json`.
 
 ```json
 { "hooks": { "PreToolUse": [
-  { "matcher": "Bash", "if": "Bash(git commit *)",
-    "hooks": [{ "type": "command", "shell": "bash", "timeout": 60,
-      "command": "bash scripts/check-docs.sh >&2 || exit 2" }] } ] } }
+  { "matcher": "Bash",
+    "hooks": [{ "type": "command", "if": "Bash(git commit *)", "shell": "bash",
+      "timeout": 60, "command": "bash scripts/check-docs.sh >&2 || exit 2" }] } ] } }
 ```
 
 `|| exit 2` is the contract, not a flourish: without it the gate's own `exit 1`

package/plugins/task-pipeline/skills/task-pipeline/templates/hooks.example.json

@@ -1,15 +1,15 @@
 {
   "_note": "EXAMPLE — copy this block into the project's .claude/settings.json. Doctrine: references/hooks.md. Hooks exist ONLY in Claude Code; on any other agent the same rule runs as a self-check and the run is recorded 'ungated'. Never describe a project as protected when its agents run elsewhere.",
   "_contract": "A PreToolUse hook blocks in one of two ways: exit 2 with the reason on stderr (stdout is ignored), or exit 0 with {\"hookSpecificOutput\":{\"hookEventName\":\"PreToolUse\",\"permissionDecision\":\"deny\",\"permissionDecisionReason\":\"...\"}} on stdout. ANY OTHER EXIT CODE IS NON-BLOCKING, so a crashing guard fails open and stops guarding without announcing it. That is why the command below ends in '|| exit 2' — the gate's own 'exit 1' would otherwise land in the non-blocking branch and the commit would proceed.",
+  "_filter_note": "Refuse a commit while the documentation gate is red. Matched narrowly: the matcher is free, the script is not. The `if` filter sits ON THE HANDLER, beside `type`/`command` — never beside `matcher`: a matcher group is only `matcher` + `hooks`, and a key Claude Code does not know there is ignored (and reported at session start from 2.1.270). Until v1.86.2 this template carried `if` at group level, so the gate ran on EVERY Bash call in every project that copied it, and a red docs gate refused every shell command rather than the commit.",
   "hooks": {
     "PreToolUse": [
       {
-        "_note": "Refuse a commit while the documentation gate is red. Matched narrowly: the matcher is free, the script is not.",
         "matcher": "Bash",
-        "if": "Bash(git commit *)",
         "hooks": [
           {
             "type": "command",
+            "if": "Bash(git commit *)",
             "shell": "bash",
             "timeout": 60,
             "command": "bash scripts/check-docs.sh >&2 || exit 2"