task-pipeline-skill 1.92.0 → 1.93.3

package/CHANGELOG.md

@@ -1,3 +1,150 @@
+## v1.93.3 — the wave-2 evidence declares its dead commits; a retried handoff stays one offer
+
+A re-certification reading of v1.93.2 and an independent observer found six things.
+
+- **The v1.93.2 evidence rewrite passed the documentation gate by de-backticking.** Six
+  pre-squash SHAs of PR #109 (`941bed8`, `36cfc1c`, `ffa42ab`, `933cf63`, `340556e`,
+  `7357522`) were left as plain text beside a branch that no longer exists; `docgate.sh`
+  only resolves backticked SHAs, so it read none of them. They are backticked again and
+  listed in a `docgate:known-dead` marker in `docs/evidence/retro.md`, with the reason and
+  the way to reach them: `git fetch origin pull/109/head` (all six are ancestors of that
+  ref). The deleted branch name is gone. The make-skill commit `60ca8e2` in row R09 and
+  B-120 is declared there too: it is make-skill's commit, not this repository's. A fresh
+  clone still cannot resolve the seven; the gate now passes because they are declared.
+- **A retried handoff no longer replaces itself (R11).** `stage_checkpoint.py handoff` put
+  the ledger's whole length in the idempotency key, so a `gate:` line from
+  `hooks/gate-observer.sh` or a `record --unavailable` line between two retries made the
+  retry a new offer, and Observatory replaces an unaccepted older offer with a new one.
+  The key now counts only memory events (checkpoint, refused, handoff offered), so
+  unrelated appends leave it alone and a recorded offer still moves it.
+  `test/stage_checkpoint_test.py` pins both; `references/continuity.md` Part 3 says it.
+- **Declared task sources have a mechanism and a test (R13).**
+  `scripts/backlog_sources.py` reads `docs/backlog-sources.json` (the Fabric workspace's
+  `knowledge/backlog.md` contract), prints the sources a wave-0 harvest reads, refuses a
+  manifest the harvest could not follow (exit 1) and reports a discovered source the
+  manifest does not list (exit 3). `test/backlog_sources_test.py` builds fixture
+  repositories: 19 malformed manifests, a symlinked source, the finding and the no-manifest
+  case. The script accepted all 22 manifests in the operator's checkouts.
+- **The release approval mode has a test (R16).** `test/release_approval_test.py` pins
+  the schema's `checks | reviewers` enum (six other values refused under `jsonschema`),
+  the example's value and the doctrine section in `references/deploy-targets.md`. No
+  script reads the mode, because the agent reads it at stage 7, so the test pins the
+  schema, the example and the doctrine.
+- **CI runs every suite of the `npm test` equation.** The validate job's explicit list
+  lacked `memory_nudge_test.py`, which `npm test` has run since v1.93.0. It now runs that
+  suite and the two new ones.
+- **Recorded late, from v1.93.0:** the eight `negatives` shards report as one status,
+  *Negative self-tests*, and the ruleset on `main` requires it beside `validate` and
+  *House skill audit*, so a red shard blocks a merge.
+- **Correction to v1.93.2's entry:** it says the SHAs "now name the squash commit". They
+  were still unresolvable, and only the gate stopped seeing them. This entry fixes that.
+
+Guards: 438 → **438**; property checks 15 → **15**. No plant changed; two suites were added
+to `npm test` and `test:all`.
+
+## v1.93.2 — v1.93.0's payload, with evidence a clone can follow
+
+`v1.93.1` published nothing either: its release suite reached the documentation gate
+(`npm run test:docs`, run by `release.yml` and not by the PR's checks) and refused 17
+commit references in `docs/evidence/` — the wave-2 branch SHAs became unreachable when
+PR #109 was squash-merged as `8260042`, and five CI run ids in backticks read as SHAs.
+They now name the squash commit and the runs as plain numbers (corrected in v1.93.3: the six SHAs
+were de-backticked, not resolved). Same payload; this is
+the third tag for it, and `docgate.sh` passed locally before this one was pushed.
+
+Guards: 438 → **438**; property checks 15 → **15**. No check changed.
+
+## v1.93.1 — v1.93.0's payload, released with its stamp declaration
+
+`v1.93.0` published nothing: `release.yml` ran the suite on the tag's own tree and
+`validate.py` refused it, because `docs/evidence/retro.md` → *Releases that carry no
+stamp* did not name it — the check working as written (the same shape as `v1.91.1`).
+The tag cannot be removed, so this release ships the same payload with that declaration.
+Everything below under v1.93.0 is what 1.93.1 contains.
+
+Guards: 438 → **438**; property checks 15 → **15**. No check changed.
+
+## v1.93.0 — the negative self-tests leave the workflow; temp state leaves with the run
+
+Integration wave 2 of the family's waves run (R07–R16), one release. The headline is
+the workflow: `.github/workflows/validate.yml` was **507,836 of GitHub's 512,000 bytes**,
+and past that limit a workflow does not go red — it creates no runs and `gh pr checks`
+says *no checks reported*. 448 of its 464 steps were plants and property checks, run one
+after another in one job for 90–111 minutes (runs 38127381666, 38112068258,
+38104711459).
+
+- **Every plant is a file (R08, #91).** The 433 negative self-tests and 15 property checks
+  moved verbatim into `test/negatives/NNN-<slug>.sh`: line 1 the shebang, line 2
+  `# name: <the step's name>`, then the step's `run` value exactly as GitHub parsed it —
+  checked byte for byte against the YAML on the commit that moved them. The directory is
+  the only list. `validate.yml` fell to 12,181 bytes.
+- **CI shards them.** A `negatives` job runs `python3 test/negatives.py --shard N/8` on an
+  eight-value matrix, fail-fast off; each shard is its own runner, so the fixed
+  `/tmp/<name>-copy` scratch names still never meet. `--shard I/N` takes every Nth check
+  by position, so a red shard is the same set of checks on a maintainer's machine.
+  `--list` and `-k` work as before and with `--shard`.
+- **The runner reads the directory, and refuses what it cannot read.** A file with no
+  `# name:` header, a name that is neither kind, a bad file name, a duplicate number or
+  name — each one stops the run before it starts, and `test/validate.py` fails on the
+  same list, because a check the loader drops is a guard nobody proves while every count
+  stays green. MIN_EXPECTED and MIN_PROPS count the directory, before any shard.
+- **The runner runs `bash -e`, what GitHub ran.** A `run:` block with no `shell:` is
+  `bash -e {0}`; the local runner used plain `bash -c`, and it is now the thing CI runs.
+- **Scratch copies are judged and removed inside each worker.** They were swept only
+  after the whole pool returned, so one local run held every copy at once — 433 copies of
+  the tree with its `.git`, ~6 GB, measured filling a disk with 4 GB free.
+- **Every check that read the workflow reads the directory**, through the runner's own
+  loader: the guard and property counts, the newest CHANGELOG section's counts, the
+  floors, `sed -i`, scratch-directory reuse, a scratch dir wiped by a step that does not
+  own it, the plant-landed assertion, and the anchor census (`test/anchors.py`). The
+  plant-landed check used to skip a name with `)` inside its parentheses; it reads every
+  one now. The ten plants whose payload was the workflow text were re-pointed to the
+  check files and assert on the value the re-pointed guard reads; the YAML plant breaks
+  the first plain step name that is still in the workflow.
+- **New guards, each with its plant:** a `Negative self-test` or `Property check` written
+  inline in the workflow again; a shard matrix that does not list every slice the
+  runner cuts; a check file the loader cannot read. The workflow-size guard had no
+  plant while the file sat 4 KB under the limit — it has one now.
+- **Temp state leaves with the run (R07).** `tp-b80` in `test/validate.py`, the
+  `tp-stage-ckpt` trees and 15 test files with bare `mkdtemp` clean up after
+  themselves; one machine's TMPDIR held 15,146 `tp-b80-*` trees. A new validator check
+  refuses a test file under `test/` — the check files included — that calls `mkdtemp(`,
+  `mkstemp(` or keeps a `NamedTemporaryFile(..., delete=False)` and carries no cleanup.
+  It is per file, so a file with one cleanup and two leaks passes; writing it found two
+  such leaks in `test/validate.py` itself — the graph-coverage tree and the installers'
+  fake HOME, ~1.8 MB per validator run and so per plant — and both are fixed.
+- **Budget (R09).** The description is 890 of 1024 chars (909 before; ≤ 900 was the
+  target, B-154 in the family board), and the `SKILL.md` body 4646 of the 4750-token
+  working limit (4736 before; B-120 asked for 100 spare, and 104 are). The Optional-bridge
+  paragraph is trimmed to a pointer (its full text was already in
+  `references/companion-skills.md`); the kernel-precedence rule stays
+  in `SKILL.md`, which `fix-tp-03.01` pins.
+- **Execution packets carry a namespaced id (R14):** `task-pipeline/execution-packet/1`.
+  Fabric's former packet used the bare `execution-packet/1` until it renamed its format
+  `session-handoff/1`; `packet.py`, `context_packets.py` and the schema still read the bare
+  id: 19 live packets in one consumer repository carry it (B-135), so it is refused only
+  after they are migrated.
+- **Wave mode reads declared task sources (R13).** Where a repository declares them in
+  `docs/backlog-sources.json`, the harvest reads exactly those, updates status only in
+  the owning files and never edits a generated view.
+- **The release stage reads the approval mode (R16).** `pipeline.json` `release.approval`
+  is `checks` (tag, watch, report) or `reviewers` (the direct link to the run that is
+  actually waiting); absent, it is read from the organisation or the environment, never
+  assumed.
+- **Fabric's pipeline adapter is a pinned contract (R15).** `test/fixtures/
+  fabric-pipeline-contract.json` pins `passioncode-ai/fabric` main `5bf15e5c`, and
+  `fix-pf-06.01` checks the gate types and the example config against it with no Fabric
+  checkout.
+- **Continuity through Observatory (R11).** `stage_checkpoint.py` gains `handoff` and
+  `accept`; `hooks/memory-nudge.sh` reminds once per returned gate that wrote no memory
+  event.
+- **Ledgers (R10).** The verification headers say *released*; this repository's merged
+  branches are gone.
+
+Guards: 433 → **438**; property checks 15 → **15**. The five new plants are files in
+`test/negatives/` (449–453); every guard's plant was run on this tree, and the CI wall
+clock per shard is in `docs/evidence/verification.md`.
+
 ## v1.92.0 — wave mode: the whole board, closed in its final form; the grill asks one batch
 
 The operator's standard approach, decided on 2026-10-11 and codified here: when the request

package/CONTRIBUTING.md

@@ -27,9 +27,13 @@ npm run test:negatives    # python3 test/negatives.py
 npm run test:all          # both, in order
 ```
 
-The corruptions live in [`.github/workflows/validate.yml`](.github/workflows/validate.yml)
-and `test/negatives.py` reads them from there — never duplicated, because a second
-copy of a corruption is a second thing to drift. The runner also tells a **broken
+The corruptions live in [`test/negatives/`](test/negatives/), one file per check —
+`#!/usr/bin/env bash`, then `# name: Negative self-test (<what is planted>)`, then
+the script, run from the repository root. `test/negatives.py` reads that directory
+and nothing else, so it is the only list; CI runs it in eight shards
+(`--shard N/8`, the `negatives` job in `validate.yml`). Until v1.93.0 every plant was
+an inline workflow step, and the workflow reached 507,836 of GitHub's 512,000 bytes —
+past the limit a workflow creates no runs rather than going red. The runner also tells a **broken
 test** from a **guard that didn't fire**: if a planted defect changed nothing, the
 validator passing means the test proved nothing, and it is reported as `BROKEN`
 rather than as a failure of the guard.
@@ -37,7 +41,7 @@ rather than as a failure of the guard.
 **Corrupt files in python, never with `sed -i`.** BSD sed needs an argument GNU sed
 refuses, and `0,/re/` does not exist on BSD at all — there it edits nothing
 silently, and the test reads as a guard that failed. The validator rejects `sed -i`
-in the workflow for exactly this reason: a self-test that only runs on CI cannot be
+in a check file for exactly this reason: a self-test that only runs on CI cannot be
 used while you are writing the guard, which is the moment it is worth most.
 
 To try your change in a real agent:
@@ -616,8 +620,10 @@ pass over an empty set is a refused measurement.
   `pipeline.example.json`, the command, the Cursor rule and the README before you
   commit. The validator catches much of this — do not rely on it to think for you.
 - **A new guard needs a negative self-test.** If you teach `test/validate.py` a new
-  rule, add a step to `.github/workflows/validate.yml` that corrupts a copy and
-  asserts the validator fails, then watch it with `npm run test:negatives`. A guard
+  rule, add the next-numbered file to `test/negatives/` that corrupts a copy and
+  asserts the validator fails, then watch it with
+  `python3 test/negatives.py -k <words from its name>`. Never a step inline in the
+  workflow: the validator refuses one, because it would run on CI only. A guard
   nobody proved can fail is decoration. **Check the base is green first** — if the
   repo already fails your new rule, the self-test passes for the wrong reason and
   proves nothing.

package/HOW-IT-WORKS.md

@@ -242,7 +242,8 @@ This is the part most pipelines skip, and it is the reason this one is trustwort
 rather than merely tidy.
 
 **Every guard is proven against a planted defect.** `npm run test:all` breaks the
-thing each of the **309** checks is about, and requires that check to reject it. A
+thing each check is about, and requires that check to reject it — one file per
+check in `test/negatives/`, eight shards on CI. A
 guard that has never been watched failing is not a guard; it is a comment.
 
 **The neighbour probe.** A check has a *subject* — the rule it is about — and

package/README.md

@@ -200,6 +200,8 @@ until it is installed.
 | 3 + 4 · every spec and plan | the self-review reads its rules back — is every named check real, does anything contradict a locked decision or a rejected option, and what does this cost now versus at design time. Answers land as a committed `## Self-review` of computed numbers |
 | 6–10 + any check you write | [`gates.md`](plugins/task-pipeline/skills/task-pipeline/references/gates.md) — the three axes, the promotion ladder, gate anatomy, the probe recipe, ratchet floors |
 | any agent-time enforcement | [`hooks.md`](plugins/task-pipeline/skills/task-pipeline/references/hooks.md) — the `PreToolUse` contract, the fail-open hazard, the Claude-Code-only limit |
+| 7 · the tag | [`deploy-targets.md`](plugins/task-pipeline/skills/task-pipeline/references/deploy-targets.md) → *When the release waits for an approval* — `pipeline.json` → `release.approval`: `checks` (tag, watch the run selected by the tag, report) or `reviewers` (the direct link to the run that is `waiting`) |
+| between stages | [`continuity.md`](plugins/task-pipeline/skills/task-pipeline/references/continuity.md) Part 3 — workflow memory through Observatory, a planned handoff (`stage_checkpoint.py handoff` / `accept`), and `hooks/memory-nudge.sh`, which reminds once when a gate returned with no memory line after it |
 
 **Ported, not depended on.** Stage 0 is adapted from
 [Matt Pocock's `grilling` / `grill-with-docs`](https://github.com/mattpocock/skills)
@@ -612,7 +614,7 @@ must say so.
 ### Held to Anthropic's own Skill authoring guidance
 
 Audited against the four Agent Skills pages. Most of it already held — `name`
-13/64 chars, `description` 909/1024 chars, `SKILL.md` 277/500 lines, all 40 references
+13/64 chars, `description` 890/1024 chars, `SKILL.md` 268/500 lines, all 40 references
 linked **directly** from `SKILL.md`, and the bundle far under the 30 MB ceiling. What
 did not, now does:
 

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.92.0 |
+| **Version** | 1.93.3 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki, and **one of two browser channels** — `playwright` (CLI or MCP) or `chrome-devtools` (MCP); either satisfies the browser step and neither is required. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.92.0",
+  "version": "1.93.3",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"
   },
   "scripts": {
-    "test": "python3 test/validate.py && python3 test/graph_test.py && python3 test/project_audit_test.py && python3 test/packet_schema_test.py && python3 test/browser_claims_test.py && python3 test/visual_gate_test.py && python3 test/stage_checkpoint_test.py && npm run test:audit-regressions",
-    "test:all": "python3 test/validate.py && python3 test/graph_test.py && python3 test/project_audit_test.py && python3 test/packet_schema_test.py && python3 test/browser_claims_test.py && python3 test/visual_gate_test.py && python3 test/stage_checkpoint_test.py && python3 test/negatives.py && npm run test:certify && npm run test:exposure && npm run test:probe && npm run test:anchors && npm run test:runner && npm run test:hooks && npm run test:artifacts && npm run test:docs && npm run test:audit-regressions",
+    "test": "python3 test/validate.py && python3 test/graph_test.py && python3 test/project_audit_test.py && python3 test/packet_schema_test.py && python3 test/browser_claims_test.py && python3 test/visual_gate_test.py && python3 test/stage_checkpoint_test.py && python3 test/backlog_sources_test.py && python3 test/release_approval_test.py && python3 test/memory_nudge_test.py && npm run test:audit-regressions",
+    "test:all": "python3 test/validate.py && python3 test/graph_test.py && python3 test/project_audit_test.py && python3 test/packet_schema_test.py && python3 test/browser_claims_test.py && python3 test/visual_gate_test.py && python3 test/stage_checkpoint_test.py && python3 test/backlog_sources_test.py && python3 test/release_approval_test.py && python3 test/memory_nudge_test.py && python3 test/negatives.py && npm run test:certify && npm run test:exposure && npm run test:probe && npm run test:anchors && npm run test:runner && npm run test:hooks && npm run test:artifacts && npm run test:docs && npm run test:audit-regressions",
     "test:negatives": "python3 test/negatives.py",
     "test:exposure": "python3 test/exposure_test.py",
     "test:probe": "python3 test/probe.py --self-test",

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/judgment/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs); a third, `waves`, takes the whole board and closes it in waves that each finish in one pass. Retro insights can publish upstream as issues, opt-in and redacted.",
-  "version": "1.92.0",
+  "version": "1.93.3",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/hooks/hooks.json

@@ -37,6 +37,17 @@
             "timeout": 20
           }
         ]
+      },
+      {
+        "matcher": "Bash|Edit|Write|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "shell": "bash",
+            "command": "\"${CLAUDE_PLUGIN_ROOT}/hooks/memory-nudge.sh\"",
+            "timeout": 20
+          }
+        ]
       }
     ],
     "PostToolUseFailure": [

package/plugins/task-pipeline/hooks/memory-nudge.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+# PostToolUse — a stage gate returned and no workflow-memory line follows it.
+#
+# The checkpoint doctrine (references/continuity.md, Part 3) asked every returned gate to
+# write an Observatory checkpoint, or to record that memory is unavailable. It was a step
+# the agent had to remember, and the measured adoption was one write in 293 sessions over
+# fourteen days (sshlg-skills waves, 2026-10-11). This hook reminds at the moment it
+# matters: once per stage line, as context the model reads, and never again for the same
+# line. It decides nothing and blocks nothing.
+#
+# Silent everywhere else: no ledger means exit 0 after one file test.
+set -uo pipefail
+ledger="${CLAUDE_PROJECT_DIR:-$PWD}/.task-pipeline/run.md"
+[ -f "$ledger" ] || exit 0
+python3 - "$ledger" <<'PY' 2>/dev/null || true
+import hashlib, json, os, re, sys
+ledger = sys.argv[1]
+try:
+    lines = open(ledger, encoding="utf-8").read().splitlines()
+except OSError:
+    sys.exit(0)
+last_stage = last_mem = -1
+for i, l in enumerate(lines):
+    if re.match(r"^stage:\s*\S+\s", l):
+        last_stage = i
+    elif l.startswith("event: memory"):
+        last_mem = i
+if last_stage < 0 or last_mem > last_stage:
+    sys.exit(0)
+line = lines[last_stage]
+mark = os.path.join(os.path.dirname(ledger), ".memory-nudged")
+key = hashlib.sha256(line.encode()).hexdigest()[:16]
+try:
+    if open(mark).read().strip() == key:
+        sys.exit(0)
+except OSError:
+    pass
+try:
+    open(mark, "w").write(key + "\n")
+except OSError:
+    pass
+sid = re.match(r"^stage:\s*(\S+)", line).group(1)
+msg = (f"task-pipeline: stage {sid}'s gate returned and no workflow-memory line follows it. "
+       "With Observatory's tools: `scripts/stage_checkpoint.py emit` → observatory_checkpoint_write "
+       "→ `stage_checkpoint.py record --answer -`. Without them: "
+       "`stage_checkpoint.py record --unavailable \"<why>\"`. (references/continuity.md, Part 3)")
+print(json.dumps({"hookSpecificOutput": {"hookEventName": "PostToolUse", "additionalContext": msg}}))
+PY
+exit 0

package/plugins/task-pipeline/skills/evidence-docs/references/hooks.md

@@ -218,7 +218,9 @@ Since v1.50.0 the plugin carries hooks of its own. `hooks/release-gate.sh`
 (`PreToolUse` on `Bash`) refuses an **outward, irreversible act** — `git tag`, a
 tag push, `gh release create`, `npm publish` — while the run says the suite has not
 passed. `hooks/gate-observer.sh` (`PostToolUse` and `PostToolUseFailure`) records
-what the declared gate command actually did.
+what the declared gate command actually did. `hooks/memory-nudge.sh` (`PostToolUse` on `Bash|Edit|Write|MultiEdit`) reminds,
+once per returned gate, that no workflow-memory line follows it
+([`continuity.md`](https://github.com/ssheleg/task-pipeline/blob/main/plugins/task-pipeline/skills/task-pipeline/references/continuity.md), Part 3).
 
 **Two lessons from v1.50.0, both shipped as defects and both fixed in v1.51.0.**
 

package/plugins/task-pipeline/skills/task-pipeline/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: task-pipeline
-description: "Use when work changes the repository — feature, fix, bug, refactor, migration, integration, rewrite, adoption or hardening; фича, фикс, баг, рефактор, миграция, интеграция, доработать, починить, внедрить, перевести — or when the output is a finding that lands in it: audit/аудит, bug hunt/проверь ошибки, production check/проверь прод, PR review/ревью PR — or on 'run this through the pipeline' / 'прогони по конвейеру', 'the full cycle' / 'полный цикл', /task-pipeline. Runs a substantial task through gated stages: intake grill, docs, brainstorm, spec, plan, build, tests, deploy, post-deploy, docs/wiki, acceptance. 'waves' / 'волнами' closes the whole board; 'checkup' / 'чекап' lists unconfirmed releases; 'setup' audits docs. Not for: answering a question, explaining code, a typo, a one-line edit, a mechanical rename, reconnaissance that lands nothing — say 'no pipeline' / 'без пайплайна' to opt out."
+description: "Use when work changes the repository — feature, fix, bug, refactor, migration, integration, rewrite, adoption or hardening; фича, фикс, баг, рефактор, миграция, интеграция, доработать, починить, внедрить, перевести — or a finding that lands in it: audit/аудит, bug hunt/проверь ошибки, production check/проверь прод, PR review/ревью PR — or on 'run this through the pipeline' / 'прогони по конвейеру', 'the full cycle' / 'полный цикл', /task-pipeline. Runs a substantial task through gated stages: intake grill, docs, brainstorm, spec, plan, build, tests, deploy, post-deploy, docs/wiki, acceptance. 'waves' / 'волнами' closes the whole board; 'checkup' / 'чекап' lists unconfirmed releases; 'setup' audits docs. Not for: answering a question, explaining code, a typo, a one-line edit, a mechanical rename, reconnaissance that lands nothing — say 'no pipeline' / 'без пайплайна' to opt out."
 license: MIT
 compatibility: "Doctrine runs on any agent. The bundled scripts need python3; the run needs git. Missing either degrades, never blocks — the graph verbs and seeded gates go unused, and the run says so."
 ---
@@ -66,16 +66,7 @@ gate stops until it is installed.
 Which reference owns which stage — all forty-odd of them, by stage number:
 [`references/doctrine-map.md`](./references/doctrine-map.md).
 
-**Optional bridge.** An equivalent skill set the operator already runs can be mapped
-onto stages 2/4/5/6 in `pipeline.json` → `skills[]`. That is a **substitution, never a
-requirement**. And the precedence is explicit, because two layers could seem to
-disagree: on a CUSTOM profile the **kernel wins** — scope, evidence, deps and
-resume are owed by every unit of work — while `references/stages.md` is the
-**default profile's** normative gate set, governing the stages that profile
-actually selects, not imposing its stage numbers on a profile that dropped
-them. The built-in doctrine is normative for the default profile; the kernel is
-normative for all. Nothing detects, recommends or waits for an external
-provider.
+**Precedence:** on a CUSTOM profile the **kernel wins** — scope, evidence, deps and resume are owed by every unit of work; `references/stages.md` is the **default profile's** normative gate set; the kernel is normative for all. Another skill set on stages 2/4/5/6: `references/companion-skills.md`.
 
 **super-ux — the preferred provider for ANY user-facing task.** The moment a task
 implies an interface (web / mobile / CLI / TUI), the WHY→UI→scenario chain runs

package/plugins/task-pipeline/skills/task-pipeline/execution-packet.example.json

@@ -1,5 +1,5 @@
 {
-  "schema_version": "execution-packet/1",
+  "schema_version": "task-pipeline/execution-packet/1",
   "id": "FIX-EX-01.01",
   "parent_id": "FIX-EX-01",
   "module": "example-module",

package/plugins/task-pipeline/skills/task-pipeline/execution-packet.schema.json

@@ -18,8 +18,8 @@
   "properties": {
     "schema_version": {
       "type": "string",
-      "pattern": "^execution-packet/[0-9]+$",
-      "description": "Contract version, `execution-packet/<major>`. A consumer that does not know the major REJECTS the packet — an unknown mandatory version is not a warning."
+      "pattern": "^(task-pipeline/)?execution-packet/[0-9]+$",
+      "description": "Contract version, `task-pipeline/execution-packet/<major>` (namespaced since 1.93.0 so Fabric's former packet id cannot be mistaken for it; the bare `execution-packet/<major>` is still read until live packets are migrated, backlog B-135). A consumer that does not know the major REJECTS the packet — an unknown mandatory version is not a warning."
     },
     "id": {
       "type": "string",

package/plugins/task-pipeline/skills/task-pipeline/pipeline.example.json

@@ -183,6 +183,7 @@
   "release": {
     "enabled": true,
     "trigger": "tag",
+    "approval": "checks",
     "steps": [
       "create a GitHub release from the matching CHANGELOG section",
       "npm publish (task-pipeline-skill) — a second job in the same workflow, armed per repository by the PUBLISH_NPMJS variable (NPM_TOKEN granular automation token, or trusted publishing via OIDC); unarmed it falls back to a human 2FA step"

package/plugins/task-pipeline/skills/task-pipeline/pipeline.schema.json

@@ -204,6 +204,13 @@
         "_goal_note": {
           "type": "string",
           "description": "Free prose beside `goal`."
+        },
+        "approval": {
+          "enum": [
+            "checks",
+            "reviewers"
+          ],
+          "description": "Who admits a release: `checks` — a guard (tag on main, CI green on that commit) and no reviewers, so the run tags, watches and reports; `reviewers` — an environment with required reviewers, so the run reports the direct link to the run that is actually `waiting`. Absent: read the organisation's declaration or the environment's protection rules; never assume `checks` (references/deploy-targets.md)."
         }
       }
     },

package/plugins/task-pipeline/skills/task-pipeline/references/continuity.md

@@ -318,6 +318,12 @@ right costs nothing extra and pays twice.
 
 ## Part 3 — workflow memory at the stage boundary
 
+Which of the five handoff mechanisms carries what — the Git record, Observatory's lease
+and checkpoint, a host's launch context, the inbound queue — and the order a successor
+reads them in, has one home:
+[sshlg-skills `docs/working-rules/handoff-layers.md`](https://github.com/ssheleg/sshlg-skills/blob/main/docs/working-rules/handoff-layers.md).
+This part is the checkpoint and lease half of it.
+
 The ledger survives a compaction. It does not survive a quota that ran out on another
 account, or a run picked up by a different agent on another machine. When the host has
 Project Observatory's memory tools, **every gate that returns also writes a workflow
@@ -328,6 +334,8 @@ checkpoint**, and the next executor continues from the last finished stage.
 - **The constraints.** Give the brief's restrictive rules once, as `--constraint`. They are carried to every later boundary, and a successor reads them first.
 - **Keys.** Pass keys by name, as `--credential PROJECT/ENV/NAME`, never as a value.
 - **Without the tools.** `stage_checkpoint.py record --unavailable "<why>"` appends one `event: memory — unavailable` line, and the run continues exactly as before. Missing memory is a state the ledger names, not a failure.
+- **A planned change of executor** — a quota running out, a route moving the work to another model or account. `stage_checkpoint.py handoff --to-provider <p> [--to-model <m>] --reason limit|plan_route|operator` prints `observatory_handoff_create`'s arguments; `record --answer -` keeps the offer as one ledger line, and the lease stays with this run until the successor accepts. The successor runs `stage_checkpoint.py accept --handoff-id <id>` → `observatory_handoff_accept` → `record --answer -` **before its first write**, and obeys the constraints the answer carries first. `LeaseLost` is then left for the race nobody planned. A retried offer keeps its idempotency key until a memory event (a checkpoint, a refusal, a recorded offer — never `unavailable`) is appended, so a `gate:` or `stage:` line between retries does not turn it into a new offer that replaces the unaccepted one.
+- **The reminder.** `hooks/memory-nudge.sh` (PostToolUse) reads the ledger after each tool call and, once per `stage:` line with no `event: memory` line after it, puts one sentence in front of the model naming the two commands above. It decides nothing and blocks nothing; adoption measured before it was one write in 293 sessions.
 - **A refusal.** `LeaseLost` means another executor holds the workflow now. The script drops the token. Read the workflow (`observatory_checkpoint_latest` with `stage_checkpoint.py state`'s id) before doing anything else. A stale writer stops after one refusal.
 - **The lease token.** It lives in `.task-pipeline/memory.json` (mode 0600, git-ignored) and never in the ledger, a reply or a commit.
 - **What this is not.** Not a second ledger and not the narrative. The checkpoint is the work's state for the next executor. The wiki and the ledger keep everything else.

package/plugins/task-pipeline/skills/task-pipeline/references/deploy-targets.md

@@ -163,6 +163,37 @@ gh run view <run-id> --log-failed     # only the failed step's log
 or failed deploy is the most common way a run reports success while nothing
 shipped — and it is exactly what the stage-8 gate is for.
 
+### When the release waits for an approval
+
+**Read the project's approval mode before tagging, and do not guess it.** It is one of
+two, and each owes the operator something different.
+
+- **`checks`** — a guard admits the release, with no person on the path. For example,
+  `release-guard` checks that the tag is on main and that CI on that commit is green,
+  and the `release` environment has no reviewers. PassionCode products declare this in
+  `passioncode-ai/.github` `release-signing/products.json` (`"approval": "checks"`).
+  Push the tag, watch the run selected **by the tag you pushed**, and report what was
+  published, or the guard's refusal and its cause. A refusal is fixed at its cause,
+  never worked around. Send no approval request: there is nobody to send it to.
+- **`reviewers`** — the run stops at an environment with required reviewers. Find that
+  run by the tag, and confirm its status is `waiting` before saying anything:
+
+  ```bash
+  gh run list -w release.yml --json url,status,headBranch -L 5
+  ```
+
+  Then hand the operator the **direct link** to that run, where they press *Review
+  deployments*, together with the tag and the jobs that are waiting. A request without
+  the link is incomplete, and so is a link to a run that is not waiting.
+
+The mode comes from, in order:
+1. `pipeline.json` → `release.approval`;
+2. an organisation declaration such as the file above;
+3. the environment's own protection rules
+   (`gh api repos/<owner>/<repo>/environments/release`).
+
+A run that cannot establish the mode says so. It does not assume `checks`.
+
 ## Other platforms, quick verbs
 
 | Platform | Deploy | Verify |

package/plugins/task-pipeline/skills/task-pipeline/references/hooks.md

@@ -218,7 +218,9 @@ Since v1.50.0 the plugin carries hooks of its own. `hooks/release-gate.sh`
 (`PreToolUse` on `Bash`) refuses an **outward, irreversible act** — `git tag`, a
 tag push, `gh release create`, `npm publish` — while the run says the suite has not
 passed. `hooks/gate-observer.sh` (`PostToolUse` and `PostToolUseFailure`) records
-what the declared gate command actually did.
+what the declared gate command actually did. `hooks/memory-nudge.sh` (`PostToolUse` on `Bash|Edit|Write|MultiEdit`) reminds,
+once per returned gate, that no workflow-memory line follows it
+([`continuity.md`](continuity.md), Part 3).
 
 **Two lessons from v1.50.0, both shipped as defects and both fixed in v1.51.0.**
 

package/plugins/task-pipeline/skills/task-pipeline/references/knowledge-sources.md

@@ -42,6 +42,7 @@ makes the grill's answers *checkable* instead of merely confident.
 
 | # | Source | How to find it | What it's good for |
 |---|---|---|---|
+| 0 | **A host's launch context** | a session started by Fabric or Fabric Dashboards (`session-handoff/1`): the brief arrives appended to the system prompt, the task as the first prompt, and `context.md` is the cited context pack | the request in the words the operator gave the host — taken as the request, not re-asked; the context pack is a harvest source like any other and is cited by its section |
 | 1 | **The code** | the repo you're in | what actually runs — the tiebreaker |
 | 2 | **The code graph** | `graphify-out/graph.json` — see below | *reach*: what calls this, what breaks if it moves, what every change passes through |
 | 3 | **Host agent docs** | `CLAUDE.md`, `AGENTS.md`, `.cursor/rules/` | conventions, commands, deploy path, house rules |

package/plugins/task-pipeline/skills/task-pipeline/references/stages.md

@@ -589,7 +589,11 @@ never that the work was skipped quietly.
   `partial` ships only with the operator's explicit acceptance. A gap is cheapest to
   close before it ships, and the operator is already present at this gate. **The
   carry-over count is printed beside this verdict.** Deploy is outward → explicit
-  operator go. Respect deploy-from-main rules if the project mandates them. **Before
+  operator go — unless the operator already authorised releases. **Before the tag, read
+  the release's approval mode** (`pipeline.json` → `release.approval`; then
+  [`deploy-targets.md`](deploy-targets.md) → *When the release waits for an approval*):
+  `checks` — push the tag, watch the run selected by the tag, report; `reviewers` — the
+  direct link to the run that is actually `waiting`, never a request without it. Respect deploy-from-main rules if the project mandates them. **Before
   tagging, the CI verdict for what was just pushed is READ, not assumed**
   ([`conventions.md`](conventions.md) → *The CI verdict*) — a tag on a commit whose
   run nobody read is how a red `main` ships.

package/plugins/task-pipeline/skills/task-pipeline/references/waves.md

@@ -71,6 +71,18 @@ findings, and its proposed rows join the inventory like any other source. Where
 product has users, walk their real path in the built app on a fresh profile with
 disposable data. A finding is a fact with a receipt, never an impression.
 
+**A declared source list outranks discovery.** Where the repository carries
+`docs/backlog-sources.json` — the contract is owned by the Fabric workspace's
+`knowledge/backlog.md` — the harvest reads exactly the sources it lists, as the board,
+with the id, title and status columns it names. Status changes land only in those owning
+files, under a lease. A new source joins the manifest in the same change. A generated
+view of them, such as a published common backlog, is never edited. A source of open
+work the manifest does not list is reported as a finding, not silently added.
+`scripts/backlog_sources.py --root . [--found <path> ...]` reads the manifest first: it
+prints the sources the harvest reads, refuses a manifest the harvest could not follow
+(exit 1, every reason named) and reports each `--found` source it does not list (exit 3).
+No manifest is discovery, said aloud (exit 0).
+
 **One machine-readable inventory, nothing outside it.** A single committed file,
 `<artifacts>/specs/YYYY-MM-DD-<topic>-inventory.json`, one entry per open item:
 

package/plugins/task-pipeline/skills/task-pipeline/scripts/backlog_sources.py

@@ -0,0 +1,171 @@
+#!/usr/bin/env python3
+"""The declared task sources a wave-0 harvest reads (`references/waves.md`, R13) — stdlib only.
+
+Where a repository carries `docs/backlog-sources.json`, the harvest reads exactly the sources
+it lists, with the id, title and status columns each one names, and a source of open work the
+manifest does not list is a finding, not a silent addition. This script is the mechanical half
+of that sentence: it reads the manifest, refuses one the harvest could not follow, and prints
+the list the harvest works from.
+
+    backlog_sources.py [--root DIR] [--found PATH ...]
+
+The contract is not this file's: it is owned by the Fabric workspace's `knowledge/backlog.md`
+(section *Source contract*; read at fabric-workspace d49b6f58, 2026-10-08), and its collector
+there is the authority. This checker refuses what that contract states in prose, with one
+deliberate widening: `repository` may be any `https://github.com/<owner>/<repo>`, because this
+skill runs outside one organisation.
+
+- `schema` is 1; `repository` is a canonical GitHub URL; `sources` holds 1–100 entries.
+- Each `path` is relative, inside the repository, with no hidden, `.` or `..` segment and no
+  symlink on the way; it exists as a regular file — `.md`, or `.json` for `json-tasks`.
+- `goal` is one of the five anchors; `kind` is `tasks` (the default) or `context`.
+- A `tasks` source is `table`, `checklist` or `json-tasks`. A table names non-empty
+  `idColumn` and `titleColumn` and exactly one of `statusColumn` or `defaultStatus: "open"`.
+- `excludeIds` is a unique list of strings; `idPattern` is a literal prefix, optionally with
+  `[0-9]+` or `\\d+`, anchored at both ends. Two identical declarations are refused.
+
+Output, on success: one JSON object — `repository`, `tasks` (each declaration as given, the
+fields the harvest reads), `context` (paths), `undeclared` (each `--found` path the manifest
+does not list, as `file:line`-free repository paths).
+
+Exit codes: 0 the manifest is readable and nothing undeclared was found, or there is no
+manifest (discovery then, as `references/knowledge-sources.md` describes — printed, not
+silent); 1 the manifest is malformed, every reason printed; 3 the manifest is fine and a
+`--found` source is not in it — the finding the doctrine asks for.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import pathlib
+import re
+import sys
+
+MANIFEST = "docs/backlog-sources.json"
+GOALS = ("agent-workplace", "workflow-control", "interoperability", "reliable-work", "shared-context")
+FORMATS = ("table", "checklist", "json-tasks")
+REPOSITORY = re.compile(r"^https://github\.com/[A-Za-z0-9][A-Za-z0-9-]{0,38}/\.?[A-Za-z0-9][A-Za-z0-9._-]{0,99}$")
+ID_PATTERN = re.compile(r"^\^[A-Za-z0-9._/-]+(?:\[0-9\]\+|\\d\+)?\$$")
+UNSAFE = re.compile(r"[\\\x00-\x1f\x7f?#%:]")
+
+
+def _safe(path: object) -> bool:
+    if not isinstance(path, str) or not path or len(path) > 700 or UNSAFE.search(path):
+        return False
+    if path.startswith("/"):
+        return False
+    return all(seg and seg not in (".", "..") and not seg.startswith(".") for seg in path.split("/"))
+
+
+def _regular(root: pathlib.Path, path: str) -> bool:
+    """The file exists and nothing on the way to it is a symlink."""
+    cur = root
+    for seg in path.split("/"):
+        cur = cur / seg
+        if cur.is_symlink():
+            return False
+    return cur.is_file()
+
+
+def _nonempty(v: object) -> bool:
+    return isinstance(v, str) and bool(v.strip())
+
+
+def check(root: pathlib.Path, found: list[str]) -> tuple[int, dict | None, list[str]]:
+    """(exit code, the harvest list or None, reasons)."""
+    mf = root / MANIFEST
+    if not mf.exists():
+        return 0, None, [f"no {MANIFEST} — the harvest discovers its sources"]
+    try:
+        doc = json.loads(mf.read_text(encoding="utf-8"))
+    except (OSError, ValueError) as exc:
+        return 1, None, [f"{MANIFEST}: not readable JSON ({type(exc).__name__})"]
+    if not isinstance(doc, dict):
+        return 1, None, [f"{MANIFEST}: not an object"]
+    errs: list[str] = []
+    if doc.get("schema") != 1:
+        errs.append(f"{MANIFEST}: `schema` is {doc.get('schema')!r}, not 1")
+    if not REPOSITORY.match(str(doc.get("repository") or "")):
+        errs.append(f"{MANIFEST}: `repository` {doc.get('repository')!r} is not a canonical "
+                    "https://github.com/<owner>/<repo> URL")
+    sources = doc.get("sources")
+    if not isinstance(sources, list) or not 1 <= len(sources) <= 100:
+        errs.append(f"{MANIFEST}: `sources` must list 1–100 entries — a context-only "
+                    "repository still declares one")
+        sources = sources if isinstance(sources, list) else []
+    tasks, context, seen = [], [], set()
+    for i, s in enumerate(sources):
+        where = f"{MANIFEST}: sources[{i}]"
+        if not isinstance(s, dict):
+            errs.append(f"{where}: not an object")
+            continue
+        path, kind, fmt = s.get("path"), s.get("kind", "tasks"), s.get("format")
+        where = f"{where} ({path})"
+        if kind not in ("tasks", "context"):
+            errs.append(f"{where}: `kind` {kind!r} is neither tasks nor context")
+        if s.get("goal") not in GOALS:
+            errs.append(f"{where}: `goal` {s.get('goal')!r} is not one of {', '.join(GOALS)}")
+        ext = ".json" if (kind == "tasks" and fmt == "json-tasks") else ".md"
+        if not _safe(path) or not str(path).endswith(ext):
+            errs.append(f"{where}: `path` must be a relative {ext} path with no hidden, `.` "
+                        "or `..` segment")
+        elif not _regular(root, path):
+            errs.append(f"{where}: the declared source is missing, or reached through a symlink")
+        if kind == "tasks":
+            if fmt not in FORMATS:
+                errs.append(f"{where}: `format` {fmt!r} is not one of {', '.join(FORMATS)} — "
+                            "an unsupported source is migrated or declared as context")
+            if fmt == "table":
+                has_status, has_default = "statusColumn" in s, "defaultStatus" in s
+                if not (_nonempty(s.get("idColumn")) and _nonempty(s.get("titleColumn"))):
+                    errs.append(f"{where}: a table names non-empty `idColumn` and `titleColumn`")
+                if has_status == has_default or (has_status and not _nonempty(s.get("statusColumn"))) \
+                        or (has_default and s.get("defaultStatus") != "open"):
+                    errs.append(f"{where}: a table names exactly one of a non-empty "
+                                "`statusColumn` or `defaultStatus: \"open\"`")
+            ex = s.get("excludeIds")
+            if ex is not None and (not isinstance(ex, list) or not all(_nonempty(x) for x in ex)
+                                   or len(set(ex)) != len(ex)):
+                errs.append(f"{where}: `excludeIds` is a unique list of stable ids")
+            if "idPattern" in s and not ID_PATTERN.match(str(s.get("idPattern"))):
+                errs.append(f"{where}: `idPattern` {s.get('idPattern')!r} is not a literal "
+                            "prefix with an optional [0-9]+, anchored at both ends")
+        key = json.dumps([path, s.get("heading", ""), s.get("idPattern", ""), fmt or "",
+                          s.get("idColumn", ""), s.get("titleColumn", ""),
+                          s.get("statusColumn", ""), s.get("excludeIds", [])])
+        if key in seen:
+            errs.append(f"{where}: a duplicate declaration")
+        seen.add(key)
+        if kind == "tasks":
+            tasks.append({k: s[k] for k in ("path", "format", "heading", "idColumn", "titleColumn",
+                                             "statusColumn", "defaultStatus", "idPattern",
+                                             "excludeIds") if k in s})
+        elif isinstance(path, str):
+            context.append(path)
+    if errs:
+        return 1, None, errs
+    declared = {t["path"] for t in tasks} | set(context)
+    undeclared = sorted({f.strip().lstrip("./") for f in found if f.strip()} - declared)
+    out = {"repository": doc["repository"], "tasks": tasks, "context": context,
+           "undeclared": undeclared}
+    return (3 if undeclared else 0), out, [f"finding: {u} holds open work and is not declared "
+                                           f"in {MANIFEST}" for u in undeclared]
+
+
+def main(argv: list[str]) -> int:
+    p = argparse.ArgumentParser(prog="backlog_sources.py",
+                                description="The declared task sources a wave-0 harvest reads.")
+    p.add_argument("--root", default=".", help="the repository root (default: .)")
+    p.add_argument("--found", nargs="*", default=[],
+                   help="sources of open work discovery found, as repository paths")
+    a = p.parse_args(argv)
+    code, out, notes = check(pathlib.Path(a.root), a.found)
+    for n in notes:
+        print(f"backlog-sources: {n}", file=sys.stderr)
+    if out is not None:
+        print(json.dumps(out, ensure_ascii=False))
+    return code
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/plugins/task-pipeline/skills/task-pipeline/scripts/context_packets.py

@@ -191,7 +191,13 @@ def verify_parents(report, plan):
     return out
 
 
-LEAF_SCHEMA = "execution-packet/1"
+LEAF_SCHEMA = "task-pipeline/execution-packet/1"
+# Fabric's content-addressed packet was also `execution-packet/1` until Fabric renamed its
+# format `session-handoff/1` (fabric-agent-contract R-01). The namespace keeps the two from
+# being read as each other. The bare id is still READ, until no live packet carries it:
+# 19 packets in one consumer repository did on 2026-10-12 (backlog B-135); refusing it
+# before they are migrated would break them.
+LEGACY_LEAF_SCHEMAS = ("execution-packet/1",)
 COLD_READER_QUESTIONS = ("goal", "inputs", "decisions", "scope", "outputs",
                          "acceptance", "guards", "resume")
 SHA_RE_STR = r"^[0-9a-f]{64}$"
@@ -356,7 +362,7 @@ def leaf_readiness(leaf):
     problems = []
     if not isinstance(leaf, dict):
         return ["leaf: not an object"]
-    if leaf.get("schema_version") != LEAF_SCHEMA:
+    if leaf.get("schema_version") not in (LEAF_SCHEMA,) + LEGACY_LEAF_SCHEMAS:
         problems.append("schema_version: missing or unknown — an unversioned "
                         "packet fails readiness")
     answers = {

package/plugins/task-pipeline/skills/task-pipeline/scripts/packet.py

@@ -69,9 +69,11 @@ def problems(packet):
         return ["the packet is not a JSON object"]
 
     version = str(packet.get("schema_version", ""))
-    m = re.match(r"^execution-packet/(\d+)$", version)
+    # Namespaced since 1.93.0 (Fabric's former packet id was the bare one); the bare form
+    # is still read until the live packets carrying it are migrated (backlog B-135).
+    m = re.match(r"^(?:task-pipeline/)?execution-packet/(\d+)$", version)
     if not m:
-        out.append(f"schema_version {version!r} is not 'execution-packet/<major>' — "
+        out.append(f"schema_version {version!r} is not 'task-pipeline/execution-packet/<major>' — "
                    "a packet without a mandatory version is unversioned, rejected")
     elif int(m.group(1)) not in KNOWN_MAJORS:
         out.append(f"schema_version major {m.group(1)} is unknown to this consumer "

package/plugins/task-pipeline/skills/task-pipeline/scripts/plan_audit.py

@@ -265,7 +265,7 @@ def _self_test():
             print("FAIL  %s: %s" % (name, e))
 
     def pkt(node, targets=(), full=True):
-        p = {"schema_version": "execution-packet/1", "node": node,
+        p = {"schema_version": "task-pipeline/execution-packet/1", "node": node,
              "intent": "do the thing", "inputs": [{"address": "a", "sha256": "0" * 64}],
              "decision_refs": [{"address": "d", "sha256": "1" * 64}],
              "source_scope": {"edit_targets": list(targets)},

package/plugins/task-pipeline/skills/task-pipeline/scripts/stage_checkpoint.py

@@ -71,6 +71,10 @@ TOPIC = re.compile(r"^Run:\s*`([^`]+)`")
 # passes a surface took is measured at the boundary rather than remembered at the end.
 REVIEW = re.compile(r"^review:\s*(\d+)\s+—\s+surface\s+(.+?)\s+—\s+rounds\s+(\d+)\s+—\s+(\S+)\s+—\s+\S+\s*$")
 STATUS = {"pass": "done", "skip": "done", "fail": "blocked"}
+# What `handoff` counts for its idempotency key: the memory events this script appended
+# (checkpoint, refused, handoff offered) — never `unavailable`, which records no state change.
+MEMORY_EVENT = re.compile(r"^event:\s*memory\s+—\s")
+MEMORY_UNAVAILABLE = re.compile(r"^event:\s*memory\s+—\s+unavailable\b")
 
 
 def _stages() -> dict[int, str]:
@@ -242,7 +246,13 @@ def record(ledger: pathlib.Path, answer_text: str | None, unavailable: str | Non
                 f"{f' (kept as {kept})' if kept else ''} — {_now()}")
         _append(ledger, line)
         return line
-    wid = answer.get("workflowId") or state.get("workflowId")
+    if answer.get("handoffId") and not answer.get("leaseId"):
+        # An offer: the lease stays with this run until the successor accepts.
+        line = f"event: memory — handoff offered {answer['handoffId']} — {_now()}"
+        _append(ledger, line)
+        return line
+    wid = (answer.get("workflowId") or (answer.get("checkpoint") or {}).get("workflowId")
+           or state.get("workflowId"))
     lease = answer.get("leaseId") or state.get("leaseId")
     if not wid:
         raise SystemExit("stage_checkpoint: the answer names no workflowId")
@@ -255,6 +265,53 @@ def record(ledger: pathlib.Path, answer_text: str | None, unavailable: str | Non
     return line
 
 
+def handoff(ledger: pathlib.Path, provider: str, model: str | None, reason: str,
+            ttl: int) -> dict:
+    """`observatory_handoff_create` arguments for a PLANNED change of executor (R11).
+
+    Without this the only way a workflow moved was a refusal: the next executor wrote,
+    got `LeaseLost`, and read the workflow after the fact. A planned move offers it
+    instead — the lease stays with this run until the successor accepts, and the pack
+    the successor receives is assembled by Observatory from the last checkpoint.
+    """
+    state = _load_state(ledger)
+    if not state.get("workflowId"):
+        raise SystemExit("stage_checkpoint: no workflow yet — write a checkpoint first "
+                         "(emit → observatory_checkpoint_write → record)")
+    to = {"provider": provider, **({"model": model} if model else {})}
+    # Observatory digests the whole request, TTL included, so the TTL is in the key (another
+    # TTL is another offer, not an idempotency conflict). So is the count of memory events the
+    # ledger holds: once an offer (or a checkpoint) is recorded that count grows, and offering
+    # again after it lapsed is a new offer — the same key would replay the first, expired
+    # answer. ONLY memory events count. The whole ledger length did, until 1.93.3: a `gate:`
+    # line from hooks/gate-observer.sh or a `record --unavailable` line between two retries
+    # made the retry a NEW offer, and Observatory replaces an unaccepted older offer with it.
+    try:
+        seen = sum(1 for ln in ledger.read_text(encoding="utf-8").splitlines()
+                   if MEMORY_EVENT.match(ln) and not MEMORY_UNAVAILABLE.match(ln))
+    except OSError:
+        seen = 0
+    key = hashlib.sha256(f"{state['workflowId']}\n{json.dumps(to, sort_keys=True)}\n{reason}"
+                         f"\n{ttl}\n{seen}".encode()).hexdigest()[:32]
+    args = {"owner": OWNER, "idempotencyKey": "tp-ho-" + key, "workflowId": state["workflowId"],
+            "to": to, "reason": reason, "offerTtlSeconds": ttl}
+    if state.get("leaseId"):
+        args["leaseId"] = state["leaseId"]
+    return args
+
+
+def accept(ledger: pathlib.Path, handoff_id: str, session: str | None) -> dict:
+    """`observatory_handoff_accept` arguments for the successor, before its first write."""
+    if not handoff_id.startswith("handoff:"):
+        raise SystemExit("stage_checkpoint: a handoff id starts with 'handoff:'")
+    args = {"owner": OWNER,
+            "idempotencyKey": "tp-ac-" + hashlib.sha256(handoff_id.encode()).hexdigest()[:32],
+            "handoffId": handoff_id}
+    if session:
+        args["sessionId"] = session
+    return args
+
+
 def main(argv: list[str]) -> int:
     p = argparse.ArgumentParser(prog="stage_checkpoint.py",
                                 description="A workflow checkpoint at every stage boundary.")
@@ -271,11 +328,29 @@ def main(argv: list[str]) -> int:
     g.add_argument("--unavailable", help="why the tools could not be used")
     s = sub.add_parser("state", help="the workflow this run writes to; never the token")
     s.add_argument("--ledger", default=DEFAULT_LEDGER)
+    h = sub.add_parser("handoff", help="observatory_handoff_create arguments: a PLANNED executor change")
+    h.add_argument("--ledger", default=DEFAULT_LEDGER)
+    h.add_argument("--to-provider", required=True)
+    h.add_argument("--to-model")
+    h.add_argument("--reason", default="plan_route",
+                   choices=["limit", "plan_route", "operator", "crash", "restart"])
+    h.add_argument("--offer-ttl", type=int, default=3600)
+    ac = sub.add_parser("accept", help="observatory_handoff_accept arguments, before the first write")
+    ac.add_argument("--ledger", default=DEFAULT_LEDGER)
+    ac.add_argument("--handoff-id", required=True)
+    ac.add_argument("--session")
     a = p.parse_args(argv)
     ledger = pathlib.Path(a.ledger)
     if a.cmd == "emit":
         print(json.dumps(emit(ledger, a.project, a.constraint, a.credential), ensure_ascii=False))
         return 0
+    if a.cmd == "handoff":
+        print(json.dumps(handoff(ledger, a.to_provider, a.to_model, a.reason, a.offer_ttl),
+                         ensure_ascii=False))
+        return 0
+    if a.cmd == "accept":
+        print(json.dumps(accept(ledger, a.handoff_id, a.session), ensure_ascii=False))
+        return 0
     if a.cmd == "state":
         st = _load_state(ledger)
         print(json.dumps({"workflowId": st.get("workflowId"), "holdsLease": bool(st.get("leaseId")),