task-pipeline-skill 1.93.2 → 1.93.3

package/CHANGELOG.md

@@ -1,10 +1,55 @@
+## v1.93.3 — the wave-2 evidence declares its dead commits; a retried handoff stays one offer
+
+A re-certification reading of v1.93.2 and an independent observer found six things.
+
+- **The v1.93.2 evidence rewrite passed the documentation gate by de-backticking.** Six
+  pre-squash SHAs of PR #109 (`941bed8`, `36cfc1c`, `ffa42ab`, `933cf63`, `340556e`,
+  `7357522`) were left as plain text beside a branch that no longer exists; `docgate.sh`
+  only resolves backticked SHAs, so it read none of them. They are backticked again and
+  listed in a `docgate:known-dead` marker in `docs/evidence/retro.md`, with the reason and
+  the way to reach them: `git fetch origin pull/109/head` (all six are ancestors of that
+  ref). The deleted branch name is gone. The make-skill commit `60ca8e2` in row R09 and
+  B-120 is declared there too: it is make-skill's commit, not this repository's. A fresh
+  clone still cannot resolve the seven; the gate now passes because they are declared.
+- **A retried handoff no longer replaces itself (R11).** `stage_checkpoint.py handoff` put
+  the ledger's whole length in the idempotency key, so a `gate:` line from
+  `hooks/gate-observer.sh` or a `record --unavailable` line between two retries made the
+  retry a new offer, and Observatory replaces an unaccepted older offer with a new one.
+  The key now counts only memory events (checkpoint, refused, handoff offered), so
+  unrelated appends leave it alone and a recorded offer still moves it.
+  `test/stage_checkpoint_test.py` pins both; `references/continuity.md` Part 3 says it.
+- **Declared task sources have a mechanism and a test (R13).**
+  `scripts/backlog_sources.py` reads `docs/backlog-sources.json` (the Fabric workspace's
+  `knowledge/backlog.md` contract), prints the sources a wave-0 harvest reads, refuses a
+  manifest the harvest could not follow (exit 1) and reports a discovered source the
+  manifest does not list (exit 3). `test/backlog_sources_test.py` builds fixture
+  repositories: 19 malformed manifests, a symlinked source, the finding and the no-manifest
+  case. The script accepted all 22 manifests in the operator's checkouts.
+- **The release approval mode has a test (R16).** `test/release_approval_test.py` pins
+  the schema's `checks | reviewers` enum (six other values refused under `jsonschema`),
+  the example's value and the doctrine section in `references/deploy-targets.md`. No
+  script reads the mode, because the agent reads it at stage 7, so the test pins the
+  schema, the example and the doctrine.
+- **CI runs every suite of the `npm test` equation.** The validate job's explicit list
+  lacked `memory_nudge_test.py`, which `npm test` has run since v1.93.0. It now runs that
+  suite and the two new ones.
+- **Recorded late, from v1.93.0:** the eight `negatives` shards report as one status,
+  *Negative self-tests*, and the ruleset on `main` requires it beside `validate` and
+  *House skill audit*, so a red shard blocks a merge.
+- **Correction to v1.93.2's entry:** it says the SHAs "now name the squash commit". They
+  were still unresolvable, and only the gate stopped seeing them. This entry fixes that.
+
+Guards: 438 → **438**; property checks 15 → **15**. No plant changed; two suites were added
+to `npm test` and `test:all`.
+
 ## v1.93.2 — v1.93.0's payload, with evidence a clone can follow
 
 `v1.93.1` published nothing either: its release suite reached the documentation gate
 (`npm run test:docs`, run by `release.yml` and not by the PR's checks) and refused 17
 commit references in `docs/evidence/` — the wave-2 branch SHAs became unreachable when
 PR #109 was squash-merged as `8260042`, and five CI run ids in backticks read as SHAs.
-They now name the squash commit and the runs as plain numbers. Same payload; this is
+They now name the squash commit and the runs as plain numbers (corrected in v1.93.3: the six SHAs
+were de-backticked, not resolved). Same payload; this is
 the third tag for it, and `docgate.sh` passed locally before this one was pushed.
 
 Guards: 438 → **438**; property checks 15 → **15**. No check changed.

package/SKILL-CARD.md

@@ -12,7 +12,7 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.93.2 |
+| **Version** | 1.93.3 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
 | **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki, and **one of two browser channels** — `playwright` (CLI or MCP) or `chrome-devtools` (MCP); either satisfies the browser step and neither is required. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.93.2",
+  "version": "1.93.3",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"
   },
   "scripts": {
-    "test": "python3 test/validate.py && python3 test/graph_test.py && python3 test/project_audit_test.py && python3 test/packet_schema_test.py && python3 test/browser_claims_test.py && python3 test/visual_gate_test.py && python3 test/stage_checkpoint_test.py && python3 test/memory_nudge_test.py && npm run test:audit-regressions",
-    "test:all": "python3 test/validate.py && python3 test/graph_test.py && python3 test/project_audit_test.py && python3 test/packet_schema_test.py && python3 test/browser_claims_test.py && python3 test/visual_gate_test.py && python3 test/stage_checkpoint_test.py && python3 test/memory_nudge_test.py && python3 test/negatives.py && npm run test:certify && npm run test:exposure && npm run test:probe && npm run test:anchors && npm run test:runner && npm run test:hooks && npm run test:artifacts && npm run test:docs && npm run test:audit-regressions",
+    "test": "python3 test/validate.py && python3 test/graph_test.py && python3 test/project_audit_test.py && python3 test/packet_schema_test.py && python3 test/browser_claims_test.py && python3 test/visual_gate_test.py && python3 test/stage_checkpoint_test.py && python3 test/backlog_sources_test.py && python3 test/release_approval_test.py && python3 test/memory_nudge_test.py && npm run test:audit-regressions",
+    "test:all": "python3 test/validate.py && python3 test/graph_test.py && python3 test/project_audit_test.py && python3 test/packet_schema_test.py && python3 test/browser_claims_test.py && python3 test/visual_gate_test.py && python3 test/stage_checkpoint_test.py && python3 test/backlog_sources_test.py && python3 test/release_approval_test.py && python3 test/memory_nudge_test.py && python3 test/negatives.py && npm run test:certify && npm run test:exposure && npm run test:probe && npm run test:anchors && npm run test:runner && npm run test:hooks && npm run test:artifacts && npm run test:docs && npm run test:audit-regressions",
     "test:negatives": "python3 test/negatives.py",
     "test:exposure": "python3 test/exposure_test.py",
     "test:probe": "python3 test/probe.py --self-test",

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/judgment/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs); a third, `waves`, takes the whole board and closes it in waves that each finish in one pass. Retro insights can publish upstream as issues, opt-in and redacted.",
-  "version": "1.93.2",
+  "version": "1.93.3",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/skills/task-pipeline/references/continuity.md

@@ -334,7 +334,7 @@ checkpoint**, and the next executor continues from the last finished stage.
 - **The constraints.** Give the brief's restrictive rules once, as `--constraint`. They are carried to every later boundary, and a successor reads them first.
 - **Keys.** Pass keys by name, as `--credential PROJECT/ENV/NAME`, never as a value.
 - **Without the tools.** `stage_checkpoint.py record --unavailable "<why>"` appends one `event: memory — unavailable` line, and the run continues exactly as before. Missing memory is a state the ledger names, not a failure.
-- **A planned change of executor** — a quota running out, a route moving the work to another model or account. `stage_checkpoint.py handoff --to-provider <p> [--to-model <m>] --reason limit|plan_route|operator` prints `observatory_handoff_create`'s arguments; `record --answer -` keeps the offer as one ledger line, and the lease stays with this run until the successor accepts. The successor runs `stage_checkpoint.py accept --handoff-id <id>` → `observatory_handoff_accept` → `record --answer -` **before its first write**, and obeys the constraints the answer carries first. `LeaseLost` is then left for the race nobody planned.
+- **A planned change of executor** — a quota running out, a route moving the work to another model or account. `stage_checkpoint.py handoff --to-provider <p> [--to-model <m>] --reason limit|plan_route|operator` prints `observatory_handoff_create`'s arguments; `record --answer -` keeps the offer as one ledger line, and the lease stays with this run until the successor accepts. The successor runs `stage_checkpoint.py accept --handoff-id <id>` → `observatory_handoff_accept` → `record --answer -` **before its first write**, and obeys the constraints the answer carries first. `LeaseLost` is then left for the race nobody planned. A retried offer keeps its idempotency key until a memory event (a checkpoint, a refusal, a recorded offer — never `unavailable`) is appended, so a `gate:` or `stage:` line between retries does not turn it into a new offer that replaces the unaccepted one.
 - **The reminder.** `hooks/memory-nudge.sh` (PostToolUse) reads the ledger after each tool call and, once per `stage:` line with no `event: memory` line after it, puts one sentence in front of the model naming the two commands above. It decides nothing and blocks nothing; adoption measured before it was one write in 293 sessions.
 - **A refusal.** `LeaseLost` means another executor holds the workflow now. The script drops the token. Read the workflow (`observatory_checkpoint_latest` with `stage_checkpoint.py state`'s id) before doing anything else. A stale writer stops after one refusal.
 - **The lease token.** It lives in `.task-pipeline/memory.json` (mode 0600, git-ignored) and never in the ledger, a reply or a commit.

package/plugins/task-pipeline/skills/task-pipeline/references/waves.md

@@ -78,6 +78,10 @@ with the id, title and status columns it names. Status changes land only in thos
 files, under a lease. A new source joins the manifest in the same change. A generated
 view of them, such as a published common backlog, is never edited. A source of open
 work the manifest does not list is reported as a finding, not silently added.
+`scripts/backlog_sources.py --root . [--found <path> ...]` reads the manifest first: it
+prints the sources the harvest reads, refuses a manifest the harvest could not follow
+(exit 1, every reason named) and reports each `--found` source it does not list (exit 3).
+No manifest is discovery, said aloud (exit 0).
 
 **One machine-readable inventory, nothing outside it.** A single committed file,
 `<artifacts>/specs/YYYY-MM-DD-<topic>-inventory.json`, one entry per open item:

package/plugins/task-pipeline/skills/task-pipeline/scripts/backlog_sources.py

@@ -0,0 +1,171 @@
+#!/usr/bin/env python3
+"""The declared task sources a wave-0 harvest reads (`references/waves.md`, R13) — stdlib only.
+
+Where a repository carries `docs/backlog-sources.json`, the harvest reads exactly the sources
+it lists, with the id, title and status columns each one names, and a source of open work the
+manifest does not list is a finding, not a silent addition. This script is the mechanical half
+of that sentence: it reads the manifest, refuses one the harvest could not follow, and prints
+the list the harvest works from.
+
+    backlog_sources.py [--root DIR] [--found PATH ...]
+
+The contract is not this file's: it is owned by the Fabric workspace's `knowledge/backlog.md`
+(section *Source contract*; read at fabric-workspace d49b6f58, 2026-10-08), and its collector
+there is the authority. This checker refuses what that contract states in prose, with one
+deliberate widening: `repository` may be any `https://github.com/<owner>/<repo>`, because this
+skill runs outside one organisation.
+
+- `schema` is 1; `repository` is a canonical GitHub URL; `sources` holds 1–100 entries.
+- Each `path` is relative, inside the repository, with no hidden, `.` or `..` segment and no
+  symlink on the way; it exists as a regular file — `.md`, or `.json` for `json-tasks`.
+- `goal` is one of the five anchors; `kind` is `tasks` (the default) or `context`.
+- A `tasks` source is `table`, `checklist` or `json-tasks`. A table names non-empty
+  `idColumn` and `titleColumn` and exactly one of `statusColumn` or `defaultStatus: "open"`.
+- `excludeIds` is a unique list of strings; `idPattern` is a literal prefix, optionally with
+  `[0-9]+` or `\\d+`, anchored at both ends. Two identical declarations are refused.
+
+Output, on success: one JSON object — `repository`, `tasks` (each declaration as given, the
+fields the harvest reads), `context` (paths), `undeclared` (each `--found` path the manifest
+does not list, as `file:line`-free repository paths).
+
+Exit codes: 0 the manifest is readable and nothing undeclared was found, or there is no
+manifest (discovery then, as `references/knowledge-sources.md` describes — printed, not
+silent); 1 the manifest is malformed, every reason printed; 3 the manifest is fine and a
+`--found` source is not in it — the finding the doctrine asks for.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import pathlib
+import re
+import sys
+
+MANIFEST = "docs/backlog-sources.json"
+GOALS = ("agent-workplace", "workflow-control", "interoperability", "reliable-work", "shared-context")
+FORMATS = ("table", "checklist", "json-tasks")
+REPOSITORY = re.compile(r"^https://github\.com/[A-Za-z0-9][A-Za-z0-9-]{0,38}/\.?[A-Za-z0-9][A-Za-z0-9._-]{0,99}$")
+ID_PATTERN = re.compile(r"^\^[A-Za-z0-9._/-]+(?:\[0-9\]\+|\\d\+)?\$$")
+UNSAFE = re.compile(r"[\\\x00-\x1f\x7f?#%:]")
+
+
+def _safe(path: object) -> bool:
+    if not isinstance(path, str) or not path or len(path) > 700 or UNSAFE.search(path):
+        return False
+    if path.startswith("/"):
+        return False
+    return all(seg and seg not in (".", "..") and not seg.startswith(".") for seg in path.split("/"))
+
+
+def _regular(root: pathlib.Path, path: str) -> bool:
+    """The file exists and nothing on the way to it is a symlink."""
+    cur = root
+    for seg in path.split("/"):
+        cur = cur / seg
+        if cur.is_symlink():
+            return False
+    return cur.is_file()
+
+
+def _nonempty(v: object) -> bool:
+    return isinstance(v, str) and bool(v.strip())
+
+
+def check(root: pathlib.Path, found: list[str]) -> tuple[int, dict | None, list[str]]:
+    """(exit code, the harvest list or None, reasons)."""
+    mf = root / MANIFEST
+    if not mf.exists():
+        return 0, None, [f"no {MANIFEST} — the harvest discovers its sources"]
+    try:
+        doc = json.loads(mf.read_text(encoding="utf-8"))
+    except (OSError, ValueError) as exc:
+        return 1, None, [f"{MANIFEST}: not readable JSON ({type(exc).__name__})"]
+    if not isinstance(doc, dict):
+        return 1, None, [f"{MANIFEST}: not an object"]
+    errs: list[str] = []
+    if doc.get("schema") != 1:
+        errs.append(f"{MANIFEST}: `schema` is {doc.get('schema')!r}, not 1")
+    if not REPOSITORY.match(str(doc.get("repository") or "")):
+        errs.append(f"{MANIFEST}: `repository` {doc.get('repository')!r} is not a canonical "
+                    "https://github.com/<owner>/<repo> URL")
+    sources = doc.get("sources")
+    if not isinstance(sources, list) or not 1 <= len(sources) <= 100:
+        errs.append(f"{MANIFEST}: `sources` must list 1–100 entries — a context-only "
+                    "repository still declares one")
+        sources = sources if isinstance(sources, list) else []
+    tasks, context, seen = [], [], set()
+    for i, s in enumerate(sources):
+        where = f"{MANIFEST}: sources[{i}]"
+        if not isinstance(s, dict):
+            errs.append(f"{where}: not an object")
+            continue
+        path, kind, fmt = s.get("path"), s.get("kind", "tasks"), s.get("format")
+        where = f"{where} ({path})"
+        if kind not in ("tasks", "context"):
+            errs.append(f"{where}: `kind` {kind!r} is neither tasks nor context")
+        if s.get("goal") not in GOALS:
+            errs.append(f"{where}: `goal` {s.get('goal')!r} is not one of {', '.join(GOALS)}")
+        ext = ".json" if (kind == "tasks" and fmt == "json-tasks") else ".md"
+        if not _safe(path) or not str(path).endswith(ext):
+            errs.append(f"{where}: `path` must be a relative {ext} path with no hidden, `.` "
+                        "or `..` segment")
+        elif not _regular(root, path):
+            errs.append(f"{where}: the declared source is missing, or reached through a symlink")
+        if kind == "tasks":
+            if fmt not in FORMATS:
+                errs.append(f"{where}: `format` {fmt!r} is not one of {', '.join(FORMATS)} — "
+                            "an unsupported source is migrated or declared as context")
+            if fmt == "table":
+                has_status, has_default = "statusColumn" in s, "defaultStatus" in s
+                if not (_nonempty(s.get("idColumn")) and _nonempty(s.get("titleColumn"))):
+                    errs.append(f"{where}: a table names non-empty `idColumn` and `titleColumn`")
+                if has_status == has_default or (has_status and not _nonempty(s.get("statusColumn"))) \
+                        or (has_default and s.get("defaultStatus") != "open"):
+                    errs.append(f"{where}: a table names exactly one of a non-empty "
+                                "`statusColumn` or `defaultStatus: \"open\"`")
+            ex = s.get("excludeIds")
+            if ex is not None and (not isinstance(ex, list) or not all(_nonempty(x) for x in ex)
+                                   or len(set(ex)) != len(ex)):
+                errs.append(f"{where}: `excludeIds` is a unique list of stable ids")
+            if "idPattern" in s and not ID_PATTERN.match(str(s.get("idPattern"))):
+                errs.append(f"{where}: `idPattern` {s.get('idPattern')!r} is not a literal "
+                            "prefix with an optional [0-9]+, anchored at both ends")
+        key = json.dumps([path, s.get("heading", ""), s.get("idPattern", ""), fmt or "",
+                          s.get("idColumn", ""), s.get("titleColumn", ""),
+                          s.get("statusColumn", ""), s.get("excludeIds", [])])
+        if key in seen:
+            errs.append(f"{where}: a duplicate declaration")
+        seen.add(key)
+        if kind == "tasks":
+            tasks.append({k: s[k] for k in ("path", "format", "heading", "idColumn", "titleColumn",
+                                             "statusColumn", "defaultStatus", "idPattern",
+                                             "excludeIds") if k in s})
+        elif isinstance(path, str):
+            context.append(path)
+    if errs:
+        return 1, None, errs
+    declared = {t["path"] for t in tasks} | set(context)
+    undeclared = sorted({f.strip().lstrip("./") for f in found if f.strip()} - declared)
+    out = {"repository": doc["repository"], "tasks": tasks, "context": context,
+           "undeclared": undeclared}
+    return (3 if undeclared else 0), out, [f"finding: {u} holds open work and is not declared "
+                                           f"in {MANIFEST}" for u in undeclared]
+
+
+def main(argv: list[str]) -> int:
+    p = argparse.ArgumentParser(prog="backlog_sources.py",
+                                description="The declared task sources a wave-0 harvest reads.")
+    p.add_argument("--root", default=".", help="the repository root (default: .)")
+    p.add_argument("--found", nargs="*", default=[],
+                   help="sources of open work discovery found, as repository paths")
+    a = p.parse_args(argv)
+    code, out, notes = check(pathlib.Path(a.root), a.found)
+    for n in notes:
+        print(f"backlog-sources: {n}", file=sys.stderr)
+    if out is not None:
+        print(json.dumps(out, ensure_ascii=False))
+    return code
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/plugins/task-pipeline/skills/task-pipeline/scripts/stage_checkpoint.py

@@ -71,6 +71,10 @@ TOPIC = re.compile(r"^Run:\s*`([^`]+)`")
 # passes a surface took is measured at the boundary rather than remembered at the end.
 REVIEW = re.compile(r"^review:\s*(\d+)\s+—\s+surface\s+(.+?)\s+—\s+rounds\s+(\d+)\s+—\s+(\S+)\s+—\s+\S+\s*$")
 STATUS = {"pass": "done", "skip": "done", "fail": "blocked"}
+# What `handoff` counts for its idempotency key: the memory events this script appended
+# (checkpoint, refused, handoff offered) — never `unavailable`, which records no state change.
+MEMORY_EVENT = re.compile(r"^event:\s*memory\s+—\s")
+MEMORY_UNAVAILABLE = re.compile(r"^event:\s*memory\s+—\s+unavailable\b")
 
 
 def _stages() -> dict[int, str]:
@@ -276,11 +280,15 @@ def handoff(ledger: pathlib.Path, provider: str, model: str | None, reason: str,
                          "(emit → observatory_checkpoint_write → record)")
     to = {"provider": provider, **({"model": model} if model else {})}
     # Observatory digests the whole request, TTL included, so the TTL is in the key (another
-    # TTL is another offer, not an idempotency conflict). So is the ledger's length: once an
-    # offer is recorded the ledger grows, and offering again after it lapsed is a new offer —
-    # the same key would replay the first, expired answer. A retry before recording repeats.
+    # TTL is another offer, not an idempotency conflict). So is the count of memory events the
+    # ledger holds: once an offer (or a checkpoint) is recorded that count grows, and offering
+    # again after it lapsed is a new offer — the same key would replay the first, expired
+    # answer. ONLY memory events count. The whole ledger length did, until 1.93.3: a `gate:`
+    # line from hooks/gate-observer.sh or a `record --unavailable` line between two retries
+    # made the retry a NEW offer, and Observatory replaces an unaccepted older offer with it.
     try:
-        seen = len(ledger.read_text(encoding="utf-8").splitlines())
+        seen = sum(1 for ln in ledger.read_text(encoding="utf-8").splitlines()
+                   if MEMORY_EVENT.match(ln) and not MEMORY_UNAVAILABLE.match(ln))
     except OSError:
         seen = 0
     key = hashlib.sha256(f"{state['workflowId']}\n{json.dumps(to, sort_keys=True)}\n{reason}"