task-pipeline-skill 1.90.2 → 1.91.2

package/CHANGELOG.md

@@ -1,3 +1,52 @@
+## v1.91.2 — v1.91.1's payload, released with its no-stamp declaration
+
+`release.yml` refused the `v1.91.1` tag's own tree: the release carried no run stamp and was
+not named in `## Releases that carry no stamp`. Nothing was published under it. This
+release is the same payload with the declaration in `docs/evidence/retro.md`. What v1.91.1
+ships is described in its section below.
+
+## v1.91.1 — the gates read the current run only, and a broken python3 stops only releases
+
+- **The release gate read every run in the ledger.** `.task-pipeline/run.md` is
+  append-only, and a project that reuses it holds earlier runs above the current one.
+  The gate took the FIRST `stage: … tests … verdict pass` in the whole file, so a
+  previous release's pass admitted `git tag` while this run's tests were still PENDING
+  (reported 2026-10-11 from a live ledger: the 0.2.0 pass would have released 0.4.0).
+  Both gates now read only what follows the last `Run:` header — the line
+  `templates/run.md` writes once per run; a ledger with no header is one run.
+- **The build gate had the same leak.** A previous run that had entered dev silenced
+  the ask for a new run still in planning. Same scoping, same fixture shape.
+- **A failed python3 no longer blocks every command.** With the disk full, python3
+  could not start, and the gate refused `ls` in any project with a run in flight. A
+  shell pre-filter now lets a command through when it carries none of
+  `tag`/`push`/`release`/`publish`; anything that could release still fails closed.
+
+Four fixtures in `test/release_gate_test.py`, each watched failing before its fix.
+
+## v1.91.0 — the description says «баг», and a lightweight tag is refused before release
+
+v1.90.0 added `bug` to the description so "fix this bug" routes here by name. The Russian
+word stayed out, so «почини баг в оплате» reached the pipeline only through the umbrella's
+prompt hook, never through the skill's own description. «баг» now stands beside «фикс».
+This is the one-word change of the unmerged PR #102, redone on current `main` because that
+branch carried a version that v1.90.1 has since taken. To pay for it, the trigger quoted as
+'full cycle, the full cycle' is now 'the full cycle': the umbrella routes on that phrase,
+and the shorter one is inside it. 908 → 901 of 1024 chars, 69 under the 970 working
+limit, where the umbrella counts a skill within 60 of that limit as crowding it.
+
+- **`release.yml` refuses a lightweight tag.** `git describe` and `git submodule status`
+  see annotated tags only. On 2026-10-09 four family members were cut with lightweight
+  tags, and the umbrella read each one as its previous release. A step right after the
+  tag checkout now runs `git cat-file -t` on the tag and stops with a remedy unless it is
+  a tag object. Nothing has been published by the time it runs. It is the same step the
+  umbrella's own `release.yml` has run since its B-93.
+- **`test/project_audit_test.py` closes what it opens.** Four reads left their file handle
+  to the garbage collector, and `python3 -W always` printed a `ResourceWarning` for each.
+  They now read inside `with`, and the same run prints none.
+
+Guards: 430 → **430**. The validator is unchanged. The new release step is a workflow
+check, and a lightweight tag planted in a scratch repository was watched failing it.
+
 ## v1.90.2 — release evidence survives squash integration
 
 The host-portability payload from v1.90.1 is unchanged. Its release stopped at the

package/README.md

@@ -587,7 +587,7 @@ must say so.
 ### Held to Anthropic's own Skill authoring guidance
 
 Audited against the four Agent Skills pages. Most of it already held — `name`
-13/64 chars, `description` 908/1024 chars, `SKILL.md` 278/500 lines, all 39 references
+13/64 chars, `description` 901/1024 chars, `SKILL.md` 278/500 lines, all 39 references
 linked **directly** from `SKILL.md`, and the bundle far under the 30 MB ceiling. What
 did not, now does:
 

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.90.2 |
+| **Version** | 1.91.2 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki, and **one of two browser channels** — `playwright` (CLI or MCP) or `chrome-devtools` (MCP); either satisfies the browser step and neither is required. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.90.2",
+  "version": "1.91.2",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/judgment/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs). Retro insights can publish upstream as issues, opt-in and redacted.",
-  "version": "1.90.2",
+  "version": "1.91.2",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/hooks/build-gate.sh

@@ -54,6 +54,12 @@ try:
 except Exception:
     raise SystemExit(0)
 
+# Only the CURRENT run speaks: everything after the last `Run:` header. A previous
+# run that entered dev in a reused, append-only ledger silenced this gate (B-151).
+_lines = text.splitlines()
+_starts = [i for i, l in enumerate(_lines) if l.strip().startswith("Run:")]
+text = "\n".join(_lines[_starts[-1]:] if _starts else _lines)
+
 stage_lines = [l.strip() for l in text.splitlines() if l.strip().startswith("stage:")]
 if not stage_lines:
     raise SystemExit(0)

package/plugins/task-pipeline/hooks/release-gate.sh

@@ -155,6 +155,14 @@ except Exception:
     # gate cannot tell. Fail closed, and say which file to look at.
     print("block\t%s\tthe run ledger could not be read" % act); raise SystemExit(0)
 
+# B-151: the ledger is append-only, and a project that reuses it holds earlier runs
+# above this one. Only the CURRENT run speaks — everything after the last `Run:`
+# header (templates/run.md writes one per run); a ledger with no header is one run.
+# A previous release's `verdict pass` admitted a tag whose own tests were PENDING.
+_lines = text.splitlines()
+_starts = [i for i, l in enumerate(_lines) if l.strip().startswith("Run:")]
+text = "\n".join(_lines[_starts[-1]:] if _starts else _lines)
+
 stage_lines = [l.strip() for l in text.splitlines() if l.strip().startswith("stage:")]
 
 
@@ -243,6 +251,13 @@ status=$?
 # A gate that cannot reach its own decision must not wave the release through.
 if [ $status -ne 0 ] || [ -z "$verdict" ]; then
   [ -f "$ledger" ] || exit 0
+  # B-152: without python3 the command cannot be classified, and refusing EVERY
+  # Bash call took the whole session down on a full disk. A word-level pre-filter
+  # keeps fail-closed exactly where it matters: anything that could tag, push,
+  # release or publish is still refused; `ls` is not.
+  if ! printf '%s' "$input" | grep -Eq '(^|[^[:alnum:]_])(tag|tags|push|release|publish)([^[:alnum:]_]|$)'; then
+    exit 0
+  fi
   echo "task-pipeline: the stage-7 gate could not run (python3 missing or failed), and this project has a run in flight ($ledger). Refusing an outward act rather than failing open." >&2
   exit 2
 fi

package/plugins/task-pipeline/skills/task-pipeline/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: task-pipeline
-description: "Use when work changes the repository — feature, fix, bug, refactor, migration, integration, rewrite, adoption or hardening; фича, фикс, рефактор, миграция, интеграция, доработать, починить, внедрить, перевести — or when the output is a finding that lands in it: audit/аудит, bug hunt/проверь ошибки, production check/проверь прод, PR review/ревью PR — or on 'run this through the pipeline' / 'прогони по конвейеру', 'full cycle, the full cycle' / 'полный цикл', /task-pipeline. Runs a substantial task through an intake grill, docs study, brainstorm, spec, plan, build, tests, deploy, post-deploy, docs/wiki sync and acceptance with explicit gates. 'checkup' / 'чекап' reports unconfirmed releases; 'setup' audits existing docs. Not for: answering a question, explaining code, a typo or a one-line edit, a mechanical rename, reconnaissance that lands nothing — say 'no pipeline' / 'без пайплайна' to opt out."
+description: "Use when work changes the repository — feature, fix, bug, refactor, migration, integration, rewrite, adoption or hardening; фича, фикс, баг, рефактор, миграция, интеграция, доработать, починить, внедрить, перевести — or when the output is a finding that lands in it: audit/аудит, bug hunt/проверь ошибки, production check/проверь прод, PR review/ревью PR — or on 'run this through the pipeline' / 'прогони по конвейеру', 'the full cycle' / 'полный цикл', /task-pipeline. Runs a substantial task through an intake grill, docs study, brainstorm, spec, plan, build, tests, deploy, post-deploy, docs/wiki sync and acceptance with explicit gates. 'checkup' / 'чекап' reports unconfirmed releases; 'setup' audits existing docs. Not for: answering a question, explaining code, a typo or a one-line edit, a mechanical rename, reconnaissance that lands nothing — say 'no pipeline' / 'без пайплайна' to opt out."
 license: MIT
 compatibility: "Doctrine runs on any agent. The bundled scripts need python3; the run needs git. Missing either degrades, never blocks — the graph verbs and seeded gates go unused, and the run says so."
 ---