task-pipeline-skill 1.92.0 → 1.93.2

package/CHANGELOG.md

@@ -1,3 +1,105 @@
+## v1.93.2 — v1.93.0's payload, with evidence a clone can follow
+
+`v1.93.1` published nothing either: its release suite reached the documentation gate
+(`npm run test:docs`, run by `release.yml` and not by the PR's checks) and refused 17
+commit references in `docs/evidence/` — the wave-2 branch SHAs became unreachable when
+PR #109 was squash-merged as `8260042`, and five CI run ids in backticks read as SHAs.
+They now name the squash commit and the runs as plain numbers. Same payload; this is
+the third tag for it, and `docgate.sh` passed locally before this one was pushed.
+
+Guards: 438 → **438**; property checks 15 → **15**. No check changed.
+
+## v1.93.1 — v1.93.0's payload, released with its stamp declaration
+
+`v1.93.0` published nothing: `release.yml` ran the suite on the tag's own tree and
+`validate.py` refused it, because `docs/evidence/retro.md` → *Releases that carry no
+stamp* did not name it — the check working as written (the same shape as `v1.91.1`).
+The tag cannot be removed, so this release ships the same payload with that declaration.
+Everything below under v1.93.0 is what 1.93.1 contains.
+
+Guards: 438 → **438**; property checks 15 → **15**. No check changed.
+
+## v1.93.0 — the negative self-tests leave the workflow; temp state leaves with the run
+
+Integration wave 2 of the family's waves run (R07–R16), one release. The headline is
+the workflow: `.github/workflows/validate.yml` was **507,836 of GitHub's 512,000 bytes**,
+and past that limit a workflow does not go red — it creates no runs and `gh pr checks`
+says *no checks reported*. 448 of its 464 steps were plants and property checks, run one
+after another in one job for 90–111 minutes (runs 38127381666, 38112068258,
+38104711459).
+
+- **Every plant is a file (R08, #91).** The 433 negative self-tests and 15 property checks
+  moved verbatim into `test/negatives/NNN-<slug>.sh`: line 1 the shebang, line 2
+  `# name: <the step's name>`, then the step's `run` value exactly as GitHub parsed it —
+  checked byte for byte against the YAML on the commit that moved them. The directory is
+  the only list. `validate.yml` fell to 12,181 bytes.
+- **CI shards them.** A `negatives` job runs `python3 test/negatives.py --shard N/8` on an
+  eight-value matrix, fail-fast off; each shard is its own runner, so the fixed
+  `/tmp/<name>-copy` scratch names still never meet. `--shard I/N` takes every Nth check
+  by position, so a red shard is the same set of checks on a maintainer's machine.
+  `--list` and `-k` work as before and with `--shard`.
+- **The runner reads the directory, and refuses what it cannot read.** A file with no
+  `# name:` header, a name that is neither kind, a bad file name, a duplicate number or
+  name — each one stops the run before it starts, and `test/validate.py` fails on the
+  same list, because a check the loader drops is a guard nobody proves while every count
+  stays green. MIN_EXPECTED and MIN_PROPS count the directory, before any shard.
+- **The runner runs `bash -e`, what GitHub ran.** A `run:` block with no `shell:` is
+  `bash -e {0}`; the local runner used plain `bash -c`, and it is now the thing CI runs.
+- **Scratch copies are judged and removed inside each worker.** They were swept only
+  after the whole pool returned, so one local run held every copy at once — 433 copies of
+  the tree with its `.git`, ~6 GB, measured filling a disk with 4 GB free.
+- **Every check that read the workflow reads the directory**, through the runner's own
+  loader: the guard and property counts, the newest CHANGELOG section's counts, the
+  floors, `sed -i`, scratch-directory reuse, a scratch dir wiped by a step that does not
+  own it, the plant-landed assertion, and the anchor census (`test/anchors.py`). The
+  plant-landed check used to skip a name with `)` inside its parentheses; it reads every
+  one now. The ten plants whose payload was the workflow text were re-pointed to the
+  check files and assert on the value the re-pointed guard reads; the YAML plant breaks
+  the first plain step name that is still in the workflow.
+- **New guards, each with its plant:** a `Negative self-test` or `Property check` written
+  inline in the workflow again; a shard matrix that does not list every slice the
+  runner cuts; a check file the loader cannot read. The workflow-size guard had no
+  plant while the file sat 4 KB under the limit — it has one now.
+- **Temp state leaves with the run (R07).** `tp-b80` in `test/validate.py`, the
+  `tp-stage-ckpt` trees and 15 test files with bare `mkdtemp` clean up after
+  themselves; one machine's TMPDIR held 15,146 `tp-b80-*` trees. A new validator check
+  refuses a test file under `test/` — the check files included — that calls `mkdtemp(`,
+  `mkstemp(` or keeps a `NamedTemporaryFile(..., delete=False)` and carries no cleanup.
+  It is per file, so a file with one cleanup and two leaks passes; writing it found two
+  such leaks in `test/validate.py` itself — the graph-coverage tree and the installers'
+  fake HOME, ~1.8 MB per validator run and so per plant — and both are fixed.
+- **Budget (R09).** The description is 890 of 1024 chars (909 before; ≤ 900 was the
+  target, B-154 in the family board), and the `SKILL.md` body 4646 of the 4750-token
+  working limit (4736 before; B-120 asked for 100 spare, and 104 are). The Optional-bridge
+  paragraph is trimmed to a pointer (its full text was already in
+  `references/companion-skills.md`); the kernel-precedence rule stays
+  in `SKILL.md`, which `fix-tp-03.01` pins.
+- **Execution packets carry a namespaced id (R14):** `task-pipeline/execution-packet/1`.
+  Fabric's former packet used the bare `execution-packet/1` until it renamed its format
+  `session-handoff/1`; `packet.py`, `context_packets.py` and the schema still read the bare
+  id: 19 live packets in one consumer repository carry it (B-135), so it is refused only
+  after they are migrated.
+- **Wave mode reads declared task sources (R13).** Where a repository declares them in
+  `docs/backlog-sources.json`, the harvest reads exactly those, updates status only in
+  the owning files and never edits a generated view.
+- **The release stage reads the approval mode (R16).** `pipeline.json` `release.approval`
+  is `checks` (tag, watch, report) or `reviewers` (the direct link to the run that is
+  actually waiting); absent, it is read from the organisation or the environment, never
+  assumed.
+- **Fabric's pipeline adapter is a pinned contract (R15).** `test/fixtures/
+  fabric-pipeline-contract.json` pins `passioncode-ai/fabric` main `5bf15e5c`, and
+  `fix-pf-06.01` checks the gate types and the example config against it with no Fabric
+  checkout.
+- **Continuity through Observatory (R11).** `stage_checkpoint.py` gains `handoff` and
+  `accept`; `hooks/memory-nudge.sh` reminds once per returned gate that wrote no memory
+  event.
+- **Ledgers (R10).** The verification headers say *released*; this repository's merged
+  branches are gone.
+
+Guards: 433 → **438**; property checks 15 → **15**. The five new plants are files in
+`test/negatives/` (449–453); every guard's plant was run on this tree, and the CI wall
+clock per shard is in `docs/evidence/verification.md`.
+
 ## v1.92.0 — wave mode: the whole board, closed in its final form; the grill asks one batch
 
 The operator's standard approach, decided on 2026-10-11 and codified here: when the request

package/CONTRIBUTING.md

@@ -27,9 +27,13 @@ npm run test:negatives    # python3 test/negatives.py
 npm run test:all          # both, in order
 ```
 
-The corruptions live in [`.github/workflows/validate.yml`](.github/workflows/validate.yml)
-and `test/negatives.py` reads them from there — never duplicated, because a second
-copy of a corruption is a second thing to drift. The runner also tells a **broken
+The corruptions live in [`test/negatives/`](test/negatives/), one file per check —
+`#!/usr/bin/env bash`, then `# name: Negative self-test (<what is planted>)`, then
+the script, run from the repository root. `test/negatives.py` reads that directory
+and nothing else, so it is the only list; CI runs it in eight shards
+(`--shard N/8`, the `negatives` job in `validate.yml`). Until v1.93.0 every plant was
+an inline workflow step, and the workflow reached 507,836 of GitHub's 512,000 bytes —
+past the limit a workflow creates no runs rather than going red. The runner also tells a **broken
 test** from a **guard that didn't fire**: if a planted defect changed nothing, the
 validator passing means the test proved nothing, and it is reported as `BROKEN`
 rather than as a failure of the guard.
@@ -37,7 +41,7 @@ rather than as a failure of the guard.
 **Corrupt files in python, never with `sed -i`.** BSD sed needs an argument GNU sed
 refuses, and `0,/re/` does not exist on BSD at all — there it edits nothing
 silently, and the test reads as a guard that failed. The validator rejects `sed -i`
-in the workflow for exactly this reason: a self-test that only runs on CI cannot be
+in a check file for exactly this reason: a self-test that only runs on CI cannot be
 used while you are writing the guard, which is the moment it is worth most.
 
 To try your change in a real agent:
@@ -616,8 +620,10 @@ pass over an empty set is a refused measurement.
   `pipeline.example.json`, the command, the Cursor rule and the README before you
   commit. The validator catches much of this — do not rely on it to think for you.
 - **A new guard needs a negative self-test.** If you teach `test/validate.py` a new
-  rule, add a step to `.github/workflows/validate.yml` that corrupts a copy and
-  asserts the validator fails, then watch it with `npm run test:negatives`. A guard
+  rule, add the next-numbered file to `test/negatives/` that corrupts a copy and
+  asserts the validator fails, then watch it with
+  `python3 test/negatives.py -k <words from its name>`. Never a step inline in the
+  workflow: the validator refuses one, because it would run on CI only. A guard
   nobody proved can fail is decoration. **Check the base is green first** — if the
   repo already fails your new rule, the self-test passes for the wrong reason and
   proves nothing.

package/HOW-IT-WORKS.md

@@ -242,7 +242,8 @@ This is the part most pipelines skip, and it is the reason this one is trustwort
 rather than merely tidy.
 
 **Every guard is proven against a planted defect.** `npm run test:all` breaks the
-thing each of the **309** checks is about, and requires that check to reject it. A
+thing each check is about, and requires that check to reject it — one file per
+check in `test/negatives/`, eight shards on CI. A
 guard that has never been watched failing is not a guard; it is a comment.
 
 **The neighbour probe.** A check has a *subject* — the rule it is about — and

package/README.md

@@ -200,6 +200,8 @@ until it is installed.
 | 3 + 4 · every spec and plan | the self-review reads its rules back — is every named check real, does anything contradict a locked decision or a rejected option, and what does this cost now versus at design time. Answers land as a committed `## Self-review` of computed numbers |
 | 6–10 + any check you write | [`gates.md`](plugins/task-pipeline/skills/task-pipeline/references/gates.md) — the three axes, the promotion ladder, gate anatomy, the probe recipe, ratchet floors |
 | any agent-time enforcement | [`hooks.md`](plugins/task-pipeline/skills/task-pipeline/references/hooks.md) — the `PreToolUse` contract, the fail-open hazard, the Claude-Code-only limit |
+| 7 · the tag | [`deploy-targets.md`](plugins/task-pipeline/skills/task-pipeline/references/deploy-targets.md) → *When the release waits for an approval* — `pipeline.json` → `release.approval`: `checks` (tag, watch the run selected by the tag, report) or `reviewers` (the direct link to the run that is `waiting`) |
+| between stages | [`continuity.md`](plugins/task-pipeline/skills/task-pipeline/references/continuity.md) Part 3 — workflow memory through Observatory, a planned handoff (`stage_checkpoint.py handoff` / `accept`), and `hooks/memory-nudge.sh`, which reminds once when a gate returned with no memory line after it |
 
 **Ported, not depended on.** Stage 0 is adapted from
 [Matt Pocock's `grilling` / `grill-with-docs`](https://github.com/mattpocock/skills)
@@ -612,7 +614,7 @@ must say so.
 ### Held to Anthropic's own Skill authoring guidance
 
 Audited against the four Agent Skills pages. Most of it already held — `name`
-13/64 chars, `description` 909/1024 chars, `SKILL.md` 277/500 lines, all 40 references
+13/64 chars, `description` 890/1024 chars, `SKILL.md` 268/500 lines, all 40 references
 linked **directly** from `SKILL.md`, and the bundle far under the 30 MB ceiling. What
 did not, now does:
 

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.92.0 |
+| **Version** | 1.93.2 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki, and **one of two browser channels** — `playwright` (CLI or MCP) or `chrome-devtools` (MCP); either satisfies the browser step and neither is required. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.92.0",
+  "version": "1.93.2",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"
   },
   "scripts": {
-    "test": "python3 test/validate.py && python3 test/graph_test.py && python3 test/project_audit_test.py && python3 test/packet_schema_test.py && python3 test/browser_claims_test.py && python3 test/visual_gate_test.py && python3 test/stage_checkpoint_test.py && npm run test:audit-regressions",
-    "test:all": "python3 test/validate.py && python3 test/graph_test.py && python3 test/project_audit_test.py && python3 test/packet_schema_test.py && python3 test/browser_claims_test.py && python3 test/visual_gate_test.py && python3 test/stage_checkpoint_test.py && python3 test/negatives.py && npm run test:certify && npm run test:exposure && npm run test:probe && npm run test:anchors && npm run test:runner && npm run test:hooks && npm run test:artifacts && npm run test:docs && npm run test:audit-regressions",
+    "test": "python3 test/validate.py && python3 test/graph_test.py && python3 test/project_audit_test.py && python3 test/packet_schema_test.py && python3 test/browser_claims_test.py && python3 test/visual_gate_test.py && python3 test/stage_checkpoint_test.py && python3 test/memory_nudge_test.py && npm run test:audit-regressions",
+    "test:all": "python3 test/validate.py && python3 test/graph_test.py && python3 test/project_audit_test.py && python3 test/packet_schema_test.py && python3 test/browser_claims_test.py && python3 test/visual_gate_test.py && python3 test/stage_checkpoint_test.py && python3 test/memory_nudge_test.py && python3 test/negatives.py && npm run test:certify && npm run test:exposure && npm run test:probe && npm run test:anchors && npm run test:runner && npm run test:hooks && npm run test:artifacts && npm run test:docs && npm run test:audit-regressions",
     "test:negatives": "python3 test/negatives.py",
     "test:exposure": "python3 test/exposure_test.py",
     "test:probe": "python3 test/probe.py --self-test",

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/judgment/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs); a third, `waves`, takes the whole board and closes it in waves that each finish in one pass. Retro insights can publish upstream as issues, opt-in and redacted.",
-  "version": "1.92.0",
+  "version": "1.93.2",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/hooks/hooks.json

@@ -37,6 +37,17 @@
             "timeout": 20
           }
         ]
+      },
+      {
+        "matcher": "Bash|Edit|Write|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "shell": "bash",
+            "command": "\"${CLAUDE_PLUGIN_ROOT}/hooks/memory-nudge.sh\"",
+            "timeout": 20
+          }
+        ]
       }
     ],
     "PostToolUseFailure": [

package/plugins/task-pipeline/hooks/memory-nudge.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# PostToolUse — a stage gate returned and no workflow-memory line follows it.
+#
+# The checkpoint doctrine (references/continuity.md, Part 3) asked every returned gate to
+# write an Observatory checkpoint, or to record that memory is unavailable. It was a step
+# the agent had to remember, and the measured adoption was one write in 293 sessions over
+# fourteen days (sshlg-skills waves, 2026-10-11). This hook reminds at the moment it
+# matters: once per stage line, as context the model reads, and never again for the same
+# line. It decides nothing and blocks nothing.
+#
+# Silent everywhere else: no ledger means exit 0 after one file test.
+set -uo pipefail
+ledger="${CLAUDE_PROJECT_DIR:-$PWD}/.task-pipeline/run.md"
+[ -f "$ledger" ] || exit 0
+python3 - "$ledger" <<'PY' 2>/dev/null || true
+import hashlib, json, os, re, sys
+ledger = sys.argv[1]
+try:
+    lines = open(ledger, encoding="utf-8").read().splitlines()
+except OSError:
+    sys.exit(0)
+last_stage = last_mem = -1
+for i, l in enumerate(lines):
+    if re.match(r"^stage:\s*\S+\s", l):
+        last_stage = i
+    elif l.startswith("event: memory"):
+        last_mem = i
+if last_stage < 0 or last_mem > last_stage:
+    sys.exit(0)
+line = lines[last_stage]
+mark = os.path.join(os.path.dirname(ledger), ".memory-nudged")
+key = hashlib.sha256(line.encode()).hexdigest()[:16]
+try:
+    if open(mark).read().strip() == key:
+        sys.exit(0)
+except OSError:
+    pass
+try:
+    open(mark, "w").write(key + "\n")
+except OSError:
+    pass
+sid = re.match(r"^stage:\s*(\S+)", line).group(1)
+msg = (f"task-pipeline: stage {sid}'s gate returned and no workflow-memory line follows it. "
+       "With Observatory's tools: `scripts/stage_checkpoint.py emit` → observatory_checkpoint_write "
+       "→ `stage_checkpoint.py record --answer -`. Without them: "
+       "`stage_checkpoint.py record --unavailable \"<why>\"`. (references/continuity.md, Part 3)")
+print(json.dumps({"hookSpecificOutput": {"hookEventName": "PostToolUse", "additionalContext": msg}}))
+PY
+exit 0

package/plugins/task-pipeline/skills/evidence-docs/references/hooks.md

@@ -218,7 +218,9 @@ Since v1.50.0 the plugin carries hooks of its own. `hooks/release-gate.sh`
 (`PreToolUse` on `Bash`) refuses an **outward, irreversible act** — `git tag`, a
 tag push, `gh release create`, `npm publish` — while the run says the suite has not
 passed. `hooks/gate-observer.sh` (`PostToolUse` and `PostToolUseFailure`) records
-what the declared gate command actually did.
+what the declared gate command actually did. `hooks/memory-nudge.sh` (`PostToolUse` on `Bash|Edit|Write|MultiEdit`) reminds,
+once per returned gate, that no workflow-memory line follows it
+([`continuity.md`](https://github.com/ssheleg/task-pipeline/blob/main/plugins/task-pipeline/skills/task-pipeline/references/continuity.md), Part 3).
 
 **Two lessons from v1.50.0, both shipped as defects and both fixed in v1.51.0.**
 

package/plugins/task-pipeline/skills/task-pipeline/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: task-pipeline
-description: "Use when work changes the repository — feature, fix, bug, refactor, migration, integration, rewrite, adoption or hardening; фича, фикс, баг, рефактор, миграция, интеграция, доработать, починить, внедрить, перевести — or when the output is a finding that lands in it: audit/аудит, bug hunt/проверь ошибки, production check/проверь прод, PR review/ревью PR — or on 'run this through the pipeline' / 'прогони по конвейеру', 'the full cycle' / 'полный цикл', /task-pipeline. Runs a substantial task through gated stages: intake grill, docs, brainstorm, spec, plan, build, tests, deploy, post-deploy, docs/wiki, acceptance. 'waves' / 'волнами' closes the whole board; 'checkup' / 'чекап' lists unconfirmed releases; 'setup' audits docs. Not for: answering a question, explaining code, a typo, a one-line edit, a mechanical rename, reconnaissance that lands nothing — say 'no pipeline' / 'без пайплайна' to opt out."
+description: "Use when work changes the repository — feature, fix, bug, refactor, migration, integration, rewrite, adoption or hardening; фича, фикс, баг, рефактор, миграция, интеграция, доработать, починить, внедрить, перевести — or a finding that lands in it: audit/аудит, bug hunt/проверь ошибки, production check/проверь прод, PR review/ревью PR — or on 'run this through the pipeline' / 'прогони по конвейеру', 'the full cycle' / 'полный цикл', /task-pipeline. Runs a substantial task through gated stages: intake grill, docs, brainstorm, spec, plan, build, tests, deploy, post-deploy, docs/wiki, acceptance. 'waves' / 'волнами' closes the whole board; 'checkup' / 'чекап' lists unconfirmed releases; 'setup' audits docs. Not for: answering a question, explaining code, a typo, a one-line edit, a mechanical rename, reconnaissance that lands nothing — say 'no pipeline' / 'без пайплайна' to opt out."
 license: MIT
 compatibility: "Doctrine runs on any agent. The bundled scripts need python3; the run needs git. Missing either degrades, never blocks — the graph verbs and seeded gates go unused, and the run says so."
 ---
@@ -66,16 +66,7 @@ gate stops until it is installed.
 Which reference owns which stage — all forty-odd of them, by stage number:
 [`references/doctrine-map.md`](./references/doctrine-map.md).
 
-**Optional bridge.** An equivalent skill set the operator already runs can be mapped
-onto stages 2/4/5/6 in `pipeline.json` → `skills[]`. That is a **substitution, never a
-requirement**. And the precedence is explicit, because two layers could seem to
-disagree: on a CUSTOM profile the **kernel wins** — scope, evidence, deps and
-resume are owed by every unit of work — while `references/stages.md` is the
-**default profile's** normative gate set, governing the stages that profile
-actually selects, not imposing its stage numbers on a profile that dropped
-them. The built-in doctrine is normative for the default profile; the kernel is
-normative for all. Nothing detects, recommends or waits for an external
-provider.
+**Precedence:** on a CUSTOM profile the **kernel wins** — scope, evidence, deps and resume are owed by every unit of work; `references/stages.md` is the **default profile's** normative gate set; the kernel is normative for all. Another skill set on stages 2/4/5/6: `references/companion-skills.md`.
 
 **super-ux — the preferred provider for ANY user-facing task.** The moment a task
 implies an interface (web / mobile / CLI / TUI), the WHY→UI→scenario chain runs

package/plugins/task-pipeline/skills/task-pipeline/execution-packet.example.json

@@ -1,5 +1,5 @@
 {
-  "schema_version": "execution-packet/1",
+  "schema_version": "task-pipeline/execution-packet/1",
   "id": "FIX-EX-01.01",
   "parent_id": "FIX-EX-01",
   "module": "example-module",

package/plugins/task-pipeline/skills/task-pipeline/execution-packet.schema.json

@@ -18,8 +18,8 @@
   "properties": {
     "schema_version": {
       "type": "string",
-      "pattern": "^execution-packet/[0-9]+$",
-      "description": "Contract version, `execution-packet/<major>`. A consumer that does not know the major REJECTS the packet — an unknown mandatory version is not a warning."
+      "pattern": "^(task-pipeline/)?execution-packet/[0-9]+$",
+      "description": "Contract version, `task-pipeline/execution-packet/<major>` (namespaced since 1.93.0 so Fabric's former packet id cannot be mistaken for it; the bare `execution-packet/<major>` is still read until live packets are migrated, backlog B-135). A consumer that does not know the major REJECTS the packet — an unknown mandatory version is not a warning."
     },
     "id": {
       "type": "string",

package/plugins/task-pipeline/skills/task-pipeline/pipeline.example.json

@@ -183,6 +183,7 @@
   "release": {
     "enabled": true,
     "trigger": "tag",
+    "approval": "checks",
     "steps": [
       "create a GitHub release from the matching CHANGELOG section",
       "npm publish (task-pipeline-skill) — a second job in the same workflow, armed per repository by the PUBLISH_NPMJS variable (NPM_TOKEN granular automation token, or trusted publishing via OIDC); unarmed it falls back to a human 2FA step"

package/plugins/task-pipeline/skills/task-pipeline/pipeline.schema.json

@@ -204,6 +204,13 @@
         "_goal_note": {
           "type": "string",
           "description": "Free prose beside `goal`."
+        },
+        "approval": {
+          "enum": [
+            "checks",
+            "reviewers"
+          ],
+          "description": "Who admits a release: `checks` — a guard (tag on main, CI green on that commit) and no reviewers, so the run tags, watches and reports; `reviewers` — an environment with required reviewers, so the run reports the direct link to the run that is actually `waiting`. Absent: read the organisation's declaration or the environment's protection rules; never assume `checks` (references/deploy-targets.md)."
         }
       }
     },

package/plugins/task-pipeline/skills/task-pipeline/references/continuity.md

@@ -318,6 +318,12 @@ right costs nothing extra and pays twice.
 
 ## Part 3 — workflow memory at the stage boundary
 
+Which of the five handoff mechanisms carries what — the Git record, Observatory's lease
+and checkpoint, a host's launch context, the inbound queue — and the order a successor
+reads them in, has one home:
+[sshlg-skills `docs/working-rules/handoff-layers.md`](https://github.com/ssheleg/sshlg-skills/blob/main/docs/working-rules/handoff-layers.md).
+This part is the checkpoint and lease half of it.
+
 The ledger survives a compaction. It does not survive a quota that ran out on another
 account, or a run picked up by a different agent on another machine. When the host has
 Project Observatory's memory tools, **every gate that returns also writes a workflow
@@ -328,6 +334,8 @@ checkpoint**, and the next executor continues from the last finished stage.
 - **The constraints.** Give the brief's restrictive rules once, as `--constraint`. They are carried to every later boundary, and a successor reads them first.
 - **Keys.** Pass keys by name, as `--credential PROJECT/ENV/NAME`, never as a value.
 - **Without the tools.** `stage_checkpoint.py record --unavailable "<why>"` appends one `event: memory — unavailable` line, and the run continues exactly as before. Missing memory is a state the ledger names, not a failure.
+- **A planned change of executor** — a quota running out, a route moving the work to another model or account. `stage_checkpoint.py handoff --to-provider <p> [--to-model <m>] --reason limit|plan_route|operator` prints `observatory_handoff_create`'s arguments; `record --answer -` keeps the offer as one ledger line, and the lease stays with this run until the successor accepts. The successor runs `stage_checkpoint.py accept --handoff-id <id>` → `observatory_handoff_accept` → `record --answer -` **before its first write**, and obeys the constraints the answer carries first. `LeaseLost` is then left for the race nobody planned.
+- **The reminder.** `hooks/memory-nudge.sh` (PostToolUse) reads the ledger after each tool call and, once per `stage:` line with no `event: memory` line after it, puts one sentence in front of the model naming the two commands above. It decides nothing and blocks nothing; adoption measured before it was one write in 293 sessions.
 - **A refusal.** `LeaseLost` means another executor holds the workflow now. The script drops the token. Read the workflow (`observatory_checkpoint_latest` with `stage_checkpoint.py state`'s id) before doing anything else. A stale writer stops after one refusal.
 - **The lease token.** It lives in `.task-pipeline/memory.json` (mode 0600, git-ignored) and never in the ledger, a reply or a commit.
 - **What this is not.** Not a second ledger and not the narrative. The checkpoint is the work's state for the next executor. The wiki and the ledger keep everything else.

package/plugins/task-pipeline/skills/task-pipeline/references/deploy-targets.md

@@ -163,6 +163,37 @@ gh run view <run-id> --log-failed     # only the failed step's log
 or failed deploy is the most common way a run reports success while nothing
 shipped — and it is exactly what the stage-8 gate is for.
 
+### When the release waits for an approval
+
+**Read the project's approval mode before tagging, and do not guess it.** It is one of
+two, and each owes the operator something different.
+
+- **`checks`** — a guard admits the release, with no person on the path. For example,
+  `release-guard` checks that the tag is on main and that CI on that commit is green,
+  and the `release` environment has no reviewers. PassionCode products declare this in
+  `passioncode-ai/.github` `release-signing/products.json` (`"approval": "checks"`).
+  Push the tag, watch the run selected **by the tag you pushed**, and report what was
+  published, or the guard's refusal and its cause. A refusal is fixed at its cause,
+  never worked around. Send no approval request: there is nobody to send it to.
+- **`reviewers`** — the run stops at an environment with required reviewers. Find that
+  run by the tag, and confirm its status is `waiting` before saying anything:
+
+  ```bash
+  gh run list -w release.yml --json url,status,headBranch -L 5
+  ```
+
+  Then hand the operator the **direct link** to that run, where they press *Review
+  deployments*, together with the tag and the jobs that are waiting. A request without
+  the link is incomplete, and so is a link to a run that is not waiting.
+
+The mode comes from, in order:
+1. `pipeline.json` → `release.approval`;
+2. an organisation declaration such as the file above;
+3. the environment's own protection rules
+   (`gh api repos/<owner>/<repo>/environments/release`).
+
+A run that cannot establish the mode says so. It does not assume `checks`.
+
 ## Other platforms, quick verbs
 
 | Platform | Deploy | Verify |

package/plugins/task-pipeline/skills/task-pipeline/references/hooks.md

@@ -218,7 +218,9 @@ Since v1.50.0 the plugin carries hooks of its own. `hooks/release-gate.sh`
 (`PreToolUse` on `Bash`) refuses an **outward, irreversible act** — `git tag`, a
 tag push, `gh release create`, `npm publish` — while the run says the suite has not
 passed. `hooks/gate-observer.sh` (`PostToolUse` and `PostToolUseFailure`) records
-what the declared gate command actually did.
+what the declared gate command actually did. `hooks/memory-nudge.sh` (`PostToolUse` on `Bash|Edit|Write|MultiEdit`) reminds,
+once per returned gate, that no workflow-memory line follows it
+([`continuity.md`](continuity.md), Part 3).
 
 **Two lessons from v1.50.0, both shipped as defects and both fixed in v1.51.0.**
 

package/plugins/task-pipeline/skills/task-pipeline/references/knowledge-sources.md

@@ -42,6 +42,7 @@ makes the grill's answers *checkable* instead of merely confident.
 
 | # | Source | How to find it | What it's good for |
 |---|---|---|---|
+| 0 | **A host's launch context** | a session started by Fabric or Fabric Dashboards (`session-handoff/1`): the brief arrives appended to the system prompt, the task as the first prompt, and `context.md` is the cited context pack | the request in the words the operator gave the host — taken as the request, not re-asked; the context pack is a harvest source like any other and is cited by its section |
 | 1 | **The code** | the repo you're in | what actually runs — the tiebreaker |
 | 2 | **The code graph** | `graphify-out/graph.json` — see below | *reach*: what calls this, what breaks if it moves, what every change passes through |
 | 3 | **Host agent docs** | `CLAUDE.md`, `AGENTS.md`, `.cursor/rules/` | conventions, commands, deploy path, house rules |

package/plugins/task-pipeline/skills/task-pipeline/references/stages.md

@@ -589,7 +589,11 @@ never that the work was skipped quietly.
   `partial` ships only with the operator's explicit acceptance. A gap is cheapest to
   close before it ships, and the operator is already present at this gate. **The
   carry-over count is printed beside this verdict.** Deploy is outward → explicit
-  operator go. Respect deploy-from-main rules if the project mandates them. **Before
+  operator go — unless the operator already authorised releases. **Before the tag, read
+  the release's approval mode** (`pipeline.json` → `release.approval`; then
+  [`deploy-targets.md`](deploy-targets.md) → *When the release waits for an approval*):
+  `checks` — push the tag, watch the run selected by the tag, report; `reviewers` — the
+  direct link to the run that is actually `waiting`, never a request without it. Respect deploy-from-main rules if the project mandates them. **Before
   tagging, the CI verdict for what was just pushed is READ, not assumed**
   ([`conventions.md`](conventions.md) → *The CI verdict*) — a tag on a commit whose
   run nobody read is how a red `main` ships.

package/plugins/task-pipeline/skills/task-pipeline/references/waves.md

@@ -71,6 +71,14 @@ findings, and its proposed rows join the inventory like any other source. Where
 product has users, walk their real path in the built app on a fresh profile with
 disposable data. A finding is a fact with a receipt, never an impression.
 
+**A declared source list outranks discovery.** Where the repository carries
+`docs/backlog-sources.json` — the contract is owned by the Fabric workspace's
+`knowledge/backlog.md` — the harvest reads exactly the sources it lists, as the board,
+with the id, title and status columns it names. Status changes land only in those owning
+files, under a lease. A new source joins the manifest in the same change. A generated
+view of them, such as a published common backlog, is never edited. A source of open
+work the manifest does not list is reported as a finding, not silently added.
+
 **One machine-readable inventory, nothing outside it.** A single committed file,
 `<artifacts>/specs/YYYY-MM-DD-<topic>-inventory.json`, one entry per open item:
 

package/plugins/task-pipeline/skills/task-pipeline/scripts/context_packets.py

@@ -191,7 +191,13 @@ def verify_parents(report, plan):
     return out
 
 
-LEAF_SCHEMA = "execution-packet/1"
+LEAF_SCHEMA = "task-pipeline/execution-packet/1"
+# Fabric's content-addressed packet was also `execution-packet/1` until Fabric renamed its
+# format `session-handoff/1` (fabric-agent-contract R-01). The namespace keeps the two from
+# being read as each other. The bare id is still READ, until no live packet carries it:
+# 19 packets in one consumer repository did on 2026-10-12 (backlog B-135); refusing it
+# before they are migrated would break them.
+LEGACY_LEAF_SCHEMAS = ("execution-packet/1",)
 COLD_READER_QUESTIONS = ("goal", "inputs", "decisions", "scope", "outputs",
                          "acceptance", "guards", "resume")
 SHA_RE_STR = r"^[0-9a-f]{64}$"
@@ -356,7 +362,7 @@ def leaf_readiness(leaf):
     problems = []
     if not isinstance(leaf, dict):
         return ["leaf: not an object"]
-    if leaf.get("schema_version") != LEAF_SCHEMA:
+    if leaf.get("schema_version") not in (LEAF_SCHEMA,) + LEGACY_LEAF_SCHEMAS:
         problems.append("schema_version: missing or unknown — an unversioned "
                         "packet fails readiness")
     answers = {

package/plugins/task-pipeline/skills/task-pipeline/scripts/packet.py

@@ -69,9 +69,11 @@ def problems(packet):
         return ["the packet is not a JSON object"]
 
     version = str(packet.get("schema_version", ""))
-    m = re.match(r"^execution-packet/(\d+)$", version)
+    # Namespaced since 1.93.0 (Fabric's former packet id was the bare one); the bare form
+    # is still read until the live packets carrying it are migrated (backlog B-135).
+    m = re.match(r"^(?:task-pipeline/)?execution-packet/(\d+)$", version)
     if not m:
-        out.append(f"schema_version {version!r} is not 'execution-packet/<major>' — "
+        out.append(f"schema_version {version!r} is not 'task-pipeline/execution-packet/<major>' — "
                    "a packet without a mandatory version is unversioned, rejected")
     elif int(m.group(1)) not in KNOWN_MAJORS:
         out.append(f"schema_version major {m.group(1)} is unknown to this consumer "

package/plugins/task-pipeline/skills/task-pipeline/scripts/plan_audit.py

@@ -265,7 +265,7 @@ def _self_test():
             print("FAIL  %s: %s" % (name, e))
 
     def pkt(node, targets=(), full=True):
-        p = {"schema_version": "execution-packet/1", "node": node,
+        p = {"schema_version": "task-pipeline/execution-packet/1", "node": node,
              "intent": "do the thing", "inputs": [{"address": "a", "sha256": "0" * 64}],
              "decision_refs": [{"address": "d", "sha256": "1" * 64}],
              "source_scope": {"edit_targets": list(targets)},

package/plugins/task-pipeline/skills/task-pipeline/scripts/stage_checkpoint.py

@@ -242,7 +242,13 @@ def record(ledger: pathlib.Path, answer_text: str | None, unavailable: str | Non
                 f"{f' (kept as {kept})' if kept else ''} — {_now()}")
         _append(ledger, line)
         return line
-    wid = answer.get("workflowId") or state.get("workflowId")
+    if answer.get("handoffId") and not answer.get("leaseId"):
+        # An offer: the lease stays with this run until the successor accepts.
+        line = f"event: memory — handoff offered {answer['handoffId']} — {_now()}"
+        _append(ledger, line)
+        return line
+    wid = (answer.get("workflowId") or (answer.get("checkpoint") or {}).get("workflowId")
+           or state.get("workflowId"))
     lease = answer.get("leaseId") or state.get("leaseId")
     if not wid:
         raise SystemExit("stage_checkpoint: the answer names no workflowId")
@@ -255,6 +261,49 @@ def record(ledger: pathlib.Path, answer_text: str | None, unavailable: str | Non
     return line
 
 
+def handoff(ledger: pathlib.Path, provider: str, model: str | None, reason: str,
+            ttl: int) -> dict:
+    """`observatory_handoff_create` arguments for a PLANNED change of executor (R11).
+
+    Without this the only way a workflow moved was a refusal: the next executor wrote,
+    got `LeaseLost`, and read the workflow after the fact. A planned move offers it
+    instead — the lease stays with this run until the successor accepts, and the pack
+    the successor receives is assembled by Observatory from the last checkpoint.
+    """
+    state = _load_state(ledger)
+    if not state.get("workflowId"):
+        raise SystemExit("stage_checkpoint: no workflow yet — write a checkpoint first "
+                         "(emit → observatory_checkpoint_write → record)")
+    to = {"provider": provider, **({"model": model} if model else {})}
+    # Observatory digests the whole request, TTL included, so the TTL is in the key (another
+    # TTL is another offer, not an idempotency conflict). So is the ledger's length: once an
+    # offer is recorded the ledger grows, and offering again after it lapsed is a new offer —
+    # the same key would replay the first, expired answer. A retry before recording repeats.
+    try:
+        seen = len(ledger.read_text(encoding="utf-8").splitlines())
+    except OSError:
+        seen = 0
+    key = hashlib.sha256(f"{state['workflowId']}\n{json.dumps(to, sort_keys=True)}\n{reason}"
+                         f"\n{ttl}\n{seen}".encode()).hexdigest()[:32]
+    args = {"owner": OWNER, "idempotencyKey": "tp-ho-" + key, "workflowId": state["workflowId"],
+            "to": to, "reason": reason, "offerTtlSeconds": ttl}
+    if state.get("leaseId"):
+        args["leaseId"] = state["leaseId"]
+    return args
+
+
+def accept(ledger: pathlib.Path, handoff_id: str, session: str | None) -> dict:
+    """`observatory_handoff_accept` arguments for the successor, before its first write."""
+    if not handoff_id.startswith("handoff:"):
+        raise SystemExit("stage_checkpoint: a handoff id starts with 'handoff:'")
+    args = {"owner": OWNER,
+            "idempotencyKey": "tp-ac-" + hashlib.sha256(handoff_id.encode()).hexdigest()[:32],
+            "handoffId": handoff_id}
+    if session:
+        args["sessionId"] = session
+    return args
+
+
 def main(argv: list[str]) -> int:
     p = argparse.ArgumentParser(prog="stage_checkpoint.py",
                                 description="A workflow checkpoint at every stage boundary.")
@@ -271,11 +320,29 @@ def main(argv: list[str]) -> int:
     g.add_argument("--unavailable", help="why the tools could not be used")
     s = sub.add_parser("state", help="the workflow this run writes to; never the token")
     s.add_argument("--ledger", default=DEFAULT_LEDGER)
+    h = sub.add_parser("handoff", help="observatory_handoff_create arguments: a PLANNED executor change")
+    h.add_argument("--ledger", default=DEFAULT_LEDGER)
+    h.add_argument("--to-provider", required=True)
+    h.add_argument("--to-model")
+    h.add_argument("--reason", default="plan_route",
+                   choices=["limit", "plan_route", "operator", "crash", "restart"])
+    h.add_argument("--offer-ttl", type=int, default=3600)
+    ac = sub.add_parser("accept", help="observatory_handoff_accept arguments, before the first write")
+    ac.add_argument("--ledger", default=DEFAULT_LEDGER)
+    ac.add_argument("--handoff-id", required=True)
+    ac.add_argument("--session")
     a = p.parse_args(argv)
     ledger = pathlib.Path(a.ledger)
     if a.cmd == "emit":
         print(json.dumps(emit(ledger, a.project, a.constraint, a.credential), ensure_ascii=False))
         return 0
+    if a.cmd == "handoff":
+        print(json.dumps(handoff(ledger, a.to_provider, a.to_model, a.reason, a.offer_ttl),
+                         ensure_ascii=False))
+        return 0
+    if a.cmd == "accept":
+        print(json.dumps(accept(ledger, a.handoff_id, a.session), ensure_ascii=False))
+        return 0
     if a.cmd == "state":
         st = _load_state(ledger)
         print(json.dumps({"workflowId": st.get("workflowId"), "holdsLease": bool(st.get("leaseId")),