task-pipeline-skill 1.87.0 → 1.87.1

package/CHANGELOG.md

@@ -1,3 +1,31 @@
+## v1.87.1 — the SessionEnd timeout no host gave
+
+Codex 0.157 prints `clamping SessionEnd hook timeout to 3s in …/task-pipeline/…/hooks.json`
+at every session start. `hooks.json` declared 10 s for `run-lifecycle.sh`; Codex clamps a
+SessionEnd handler to 3 s, and Claude Code sizes its SessionEnd wait from the largest
+handler timeout. The script already fitted: it appends one line, and its own header states
+the 1.5-second budget. So the number was the only defect, and a warning on every Codex
+start the only cost.
+
+Guards: 429 → **430**.
+
+- **`hooks/hooks.json` declares `timeout: 3`** for SessionEnd. `test/validate.py` now reads
+  the plugin's OWN hooks file, which it never checked before (only the template), and holds
+  it and `templates/hooks.example.json` to a 3 s SessionEnd cap. The new negative step
+  plants the shipped 10 through `test/plant_sessionend_timeout.py`, which asserts that the
+  plant landed.
+- **`validate.yml` gets room again, 512 419 → 506 050 bytes.** The new step on its own
+  pushed the workflow past GitHub's 512 000-byte limit, where it stays `active` and never
+  runs. The largest inline plant (*a release MENTIONED but not declared*, 7.9 kB) moved
+  verbatim into `test/plant_gap_mention.py`, with the same exit-9 skip. It is watched
+  rejecting its planted defect through `test/negatives.py -k MENTIONED`.
+- **The dormancy guard reads the script a step calls.** Moving that plant took its `SKIP:`
+  branch out of the step text, and `anchors.py` read only the step. So it stopped calling
+  the step skip-capable, and deleting its `# dormant-when:` passed. `test:all` caught this
+  through *a plant that can decline to run and never says when*. `Step.skip_capable` now
+  also follows `python3 test/plant_*.py` into the file. A new `anchors_test.py` case is red
+  without the fix.
+
 ## v1.87.0 — stage 4 stops handing over a plan the next agent cannot execute
 
 The operator's finding, 2026-09-13: **agents change between sessions, and whatever a

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.87.0 |
+| **Version** | 1.87.1 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki, and **one of two browser channels** — `playwright` (CLI or MCP) or `chrome-devtools` (MCP); either satisfies the browser step and neither is required. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.87.0",
+  "version": "1.87.1",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/judgment/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs). Retro insights can publish upstream as issues, opt-in and redacted.",
-  "version": "1.87.0",
+  "version": "1.87.1",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/hooks/hooks.json

@@ -83,7 +83,7 @@
             "type": "command",
             "shell": "bash",
             "command": "\"${CLAUDE_PLUGIN_ROOT}/hooks/run-lifecycle.sh\"",
-            "timeout": 10
+            "timeout": 3
           }
         ]
       }