task-pipeline-skill 1.93.2 → 1.94.1

package/plugins/task-pipeline/skills/task-pipeline/references/waves.md

@@ -54,7 +54,7 @@ on real agents, tasks and users rather than on the first guess.
 | 2 Brainstorm + decompose | once: the canvas extends the module map ([`decomposition.md`](decomposition.md)), and the work graph carries each node's wave |
 | 3 Spec | once: the canvas is the committed target-state spec; a wave's dossier may deepen a section, never contradict it |
 | 4 Plan | once: every wave's nodes, its exit criteria and the question batch. Re-cut at each wave boundary, as a recorded revision |
-| 5–8 Build → post-deploy | per wave, then the close pass |
+| 5–8 Build → post-deploy | per wave, then the close pass. A wave's stage 7 integrates to the main branch **without tagging**; the release's tag, its approval mode and its go are stage 7's full gate, run once at the release ([`iteration.md`](iteration.md) → *The cycle*, step 10), and stage 8's trio follows on what was released (step 11) |
 | 9 Docs + wiki · 10 Acceptance | once, to close the release, over everything the waves shipped |
 
 **One planning gate, not three prompts.** The manual gates of stages 0, 2 and 3 are
@@ -72,37 +72,51 @@ product has users, walk their real path in the built app on a fresh profile with
 disposable data. A finding is a fact with a receipt, never an impression.
 
 **A declared source list outranks discovery.** Where the repository carries
-`docs/backlog-sources.json` — the contract is owned by the Fabric workspace's
-`knowledge/backlog.md` — the harvest reads exactly the sources it lists, as the board,
+`docs/backlog-sources.json` — its shape is
+[`templates/backlog-sources.schema.json`](../templates/backlog-sources.schema.json)
+([`backlog.md`](backlog.md) → *A declared source list*) — the harvest reads exactly the
+sources it lists, as the board,
 with the id, title and status columns it names. Status changes land only in those owning
 files, under a lease. A new source joins the manifest in the same change. A generated
 view of them, such as a published common backlog, is never edited. A source of open
 work the manifest does not list is reported as a finding, not silently added.
+`scripts/backlog_sources.py --root . [--found <path> ...]` reads the manifest first: it
+prints the sources the harvest reads, refuses a manifest the harvest could not follow
+(exit 1, every reason named) and reports each `--found` source it does not list (exit 3).
+No manifest is discovery, said aloud (exit 0).
 
 **One machine-readable inventory, nothing outside it.** A single committed file,
-`<artifacts>/specs/YYYY-MM-DD-<topic>-inventory.json`, one entry per open item:
-
-| Field | Carries |
-|---|---|
-| `id` | the item's id in its owning register; an item without one gets one there, in the same change |
-| `source` | where it was found, as `file:line` |
-| `status` | as measured, not as the register last said |
-| `area` | the part of the system it touches |
-| `node` | the canvas node it lands on |
-| `wave` | the wave that closes it, or the release it is carried to |
-| `release` | this release, or `program` |
-
-`blocked_by`, `closable_in_one_pass` and `notes` are worth carrying beside them.
+`<artifacts>/specs/YYYY-MM-DD-<topic>-inventory.json`, one item per open item. Its shape is
+[`templates/inventory.schema.json`](../templates/inventory.schema.json) (inventory/1): every
+item carries its `id` in the owning register, `title`, `area`, `kind`, `severity`, the
+`evidence` that is its receipt and a `proposed_fix`; `status` is as measured, not as the
+register last said; `module`, `node`, `wave` and `release` are written by the script below,
+never by hand. `scripts/waves.py merge <dir>` builds it from the survey outputs and refuses
+an item without evidence or an id seen twice.
 
 **Verify each open item against the code before trusting it.** A stale item is closed
 in its owning register with the receipt that shows it done; duplicates are clustered,
 both ids kept. A register that says *open* about shipped work is the commonest thing a
 survey finds.
 
-**Assign nodes and waves with a committed script, not by hand.** A deterministic script
-reads the inventory and a short wave table and writes `node`, `wave` and `release` onto
-every entry, then prints the counts per wave and per node. A re-cut is then a diff to a
-table and a re-run, which a reviewer can read; seven hundred hand-edited rows are not.
+**Assign nodes and waves with a committed script, not by hand.** `scripts/waves.py assign
+--modules <modules.json> --plan <plan.json> --write` reads two short tables — module → item
+ids, and the plan's nodes with their `wave` and the items each `closes` — writes `module`,
+`node`, `wave` and `release` onto every item, and prints the counts. `waves.py validate`
+exits 1 when an item lands on no module or an open item on no node: either the canvas has a
+gap or the item is closed with its receipt or carried (`status: carried`, `release:
+program`). An incomplete `assign --write` prints the gaps but preserves the prior file;
+preview and repair the tables before retrying. Plan ids and effective `graph_id` targets
+must be unique. `waves.py sync-graph` writes the plan's waves and risk classes onto the
+work graph with graph.py's lock and revision log — one `wave` or `risk` revision per
+change, a lowered risk only with `--lower-why` — and judges the re-cut as
+a whole with graph.py's order rule, so moving a chain up a wave is never refused halfway.
+A missing graph target refuses before any write; `--only-present` explicitly opts into a
+plan spanning several graphs. A re-cut is then a diff to a table
+and a re-run, which a reviewer can read; seven hundred hand-edited rows are not. The canvas,
+the question queue and each dossier start from [`templates/canvas.md`](../templates/canvas.md),
+[`templates/questions.md`](../templates/questions.md) and
+[`templates/dossier.md`](../templates/dossier.md).
 
 ## The questions — closed from sources, then one batch
 
@@ -117,13 +131,16 @@ answer and the consequence of each answer, ordered so prerequisite decisions com
 ([`grill.md`](grill.md)). A go that leaves a question unanswered takes the
 recommendation, recorded as **assumed** in the decisions table, and every wave that
 depends on an assumption names it — so a different answer later re-plans exactly those
-waves and no others. After planning, a question is asked only at a wave boundary, in the
-hand-back's DECISIONS WAITING ([`progress.md`](progress.md)).
+waves and no others. After planning, a question is asked only in a question round
+([`iteration.md`](iteration.md) → *Question rounds*): a wave boundary, a blocked frontier
+or five open questions calls one, and its batch lands in the hand-back's DECISIONS
+WAITING ([`progress.md`](progress.md)). Never one question at a time.
 
-**An outward or irreversible act is never assumed.** Publishing, tagging, deploying
-without a specific standing authorization, sending to a person, spending money,
-deleting data: each waits for the operator's explicit go, asked with a verified direct
-link. A recommendation is not an authorization.
+**An outward or irreversible act is never assumed.** Publishing, tagging, deploying,
+sending to a person, spending money or deleting data needs authorization naming that act.
+Cite a specific standing authorization within its scope; otherwise ask for the operator's
+explicit go with the relevant verified direct link. A recommendation or generic loop mode
+is not authorization ([`continuity.md`](continuity.md) → *The limit, before the capability*).
 
 ## The canvas — the target state over the current logic
 
@@ -165,21 +182,39 @@ marked `needs-operator`, out of every wave until it is unblocked.
 
 Each wave runs stages 5–8 as [`stages.md`](stages.md) states them, then the close pass.
 Between waves the run does not ask whether to continue: it takes the next wave
-([`continuity.md`](continuity.md)). A genuine ambiguity parks its node `needs-operator`
-and the wave goes on with the nodes it does not block; the run stops only when the whole
-frontier is blocked. When the board is empty, it says so once.
+([`continuity.md`](continuity.md)). An unresolved ambiguity parks its node with its
+actual owner and reason; only a human-owned question is `needs-operator`. Project
+asks follow [`iteration.md`](iteration.md), and the wave continues on independent
+nodes. A frontier blocked by CI, review
+or another external wait goes on watchers, with the waits and their next actions recorded
+([`continuity.md`](continuity.md) → *Waits outlive turns*); it is not completion or a new
+request for permission. An unresolved human gate stops its dependent work. When the board
+is empty, the run says so once. `graph.py next --wave N` returns 6 when only recorded
+watched waits hold that wave, following prerequisite leaves across wave boundaries.
+Keep their watchers armed; `wait` records their locators and `resume --wait-id`
+refuses stale events. Exit 4 retains mixed or unclassified barriers: read the reasons
+before choosing the next action. Neither code is proof of completion or authority
+([`work-graph.md`](work-graph.md) → *Watched external waits*).
 
 Research, the audit and the blind readings run in parallel agents; builds stay sequential
 wherever two of them share a seam ([`planning.md`](planning.md) → file ownership).
 
+**Verification does not wait for the wave.** A node is certified as soon as it lands, in
+the number of rounds its risk class sets, and a seam is checked once the last node on it
+lands ([`iteration.md`](iteration.md) → *Verification starts when a node lands*). The
+close pass below then re-measures what those rounds already proved.
+
 ## The close pass, after every wave
 
 In this order, inside the wave rather than after it:
 
 1. **Verify.** Every node the wave closes is certified ([`certification.md`](certification.md)),
+   most of it already, as each node landed,
    and [`audit.md`](audit.md)'s exit is re-measured over what the wave touched.
 2. **Finish and fix — one fix round**, inside [`loop-guard.md`](loop-guard.md)'s caps.
-   Every finding is fixed in the wave or parked with a board row and its reason; nothing
+   Findings against this wave's nodes are fixed here or parked with a board row and reason.
+   Findings elsewhere join the inventory for a planned node; only the closed hotfix lane
+   bypasses that design ([`iteration.md`](iteration.md) → *No fix travels alone*). Nothing
    is dropped silently.
 3. **Document** — the Doc Loop and the stage-9 propagation matrix
    ([`documentation.md`](documentation.md)), scoped to the wave: scenarios, decisions,
@@ -193,6 +228,9 @@ In this order, inside the wave rather than after it:
 
 ## A board bigger than one release
 
+**The loop around the waves — release, post-release check, next pool, and the next
+iteration — is [`iteration.md`](iteration.md).**
+
 **It becomes a program.** The release takes the first waves; the rest stays on the
 canvas by node, `release: program`, never dropped. The next release resumes from the
 canvas: it re-measures the inventory rather than re-running wave 0 from nothing, and its
@@ -200,11 +238,17 @@ waves are cut from the nodes still open.
 
 ## What stays human
 
-Sign-ins, consents, payments, sending to people, and every outward or irreversible act.
-The mode removes *"shall I continue?"* between waves and *"what did you mean?"* where a
-source already says; it never removes a person from a decision that is theirs. A
-`manual` gate still waits for its go ([`continuity.md`](continuity.md) → *The limit,
-before the capability*).
+Sign-ins, consents, operator payments and typed secrets remain human. Record the
+required action and continue independent work; a release or loop grant cannot
+perform these actions for the person.
+
+Other outward or irreversible acts, including sending to people, require explicit
+authority. A specific standing authorization naming the act counts within its
+recorded source and scope ([`continuity.md`](continuity.md) → *The limit, before the
+capability*). A generic instruction to continue does not. A `manual` gate waits
+without such authority. The mode removes *"shall I continue?"* between waves and
+*"what did you mean?"* where a source already says; it never removes a person from
+a decision that is theirs.
 
 ## The graph carries the wave
 
@@ -229,5 +273,5 @@ said to be checked by hand.
 | "Ask each question as it comes up" | Each one is a human round. Close it from the sources, or put it in the batch |
 | "The board is too big to inventory" | The inventory is the plan. Without it the waves are cut from memory |
 | "Re-cutting waves makes the pipeline dynamic" | A re-cut is a committed revision and a canvas edit. The static-graph decision in [`planning.md`](planning.md) holds |
-| "The recommendation is obviously right, so assume the deploy go" | An outward act is never assumed. Ask for the specific go once, in the batch |
+| "The recommendation is obviously right, so assume the deploy go" | An outward act is never assumed. Cite the standing authorization naming it, or ask for the specific go once, in the batch |
 | "Wave 3 can stub what wave 5 will build properly" | Only at a declared contract, with wave 5 named as the stub's removal |

package/plugins/task-pipeline/skills/task-pipeline/references/work-graph.md

@@ -41,6 +41,7 @@ turn of every loop.
 | `nodes[].blocked_by` | what must PRODUCE first. The frontier obeys a satisfaction predicate, and only `done` satisfies — a PARKED producer blocks its consumer, because a park is a decision not to produce, not a production. `next` names each held consumer with the park's reason; a valid alternative producer is an explicit, versioned edge change, never an implicit unblock |
 | `nodes[].touches` | what it **mutates**. Two runnable nodes writing one file is the false parallelism [`planning.md`](planning.md) refuses — *distinct is not the same as independent, and the check is what they touch, never what they are called* |
 | `nodes[].check` | **how this node will be closed** — one command, or the named judgement where no command can decide it. Required on every node except a `parked` one. The certification's `unit` tier runs it and reports its output as the evidence row ([`certification.md`](certification.md) — three blind tiers close a node, not one reader); before this field existed that instruction pointed at an absence, leaving a verifier the two things it forbids — invent a check, or run everything (B-080) |
+| `nodes[].risk` | wave mode or a release iteration: the node's risk class, `R1`, `R2` or `R3` ([`iteration.md`](iteration.md) → *Verification starts when a node lands*): how many passing certification rounds the node owes — one, two, or three with one adversarial ([`certification.md`](certification.md) → *Rounds owed by risk class*). `validate` refuses any other value, because a class nobody recognises owes no known number of rounds, and `close` refuses the node until its rounds are done |
 | `nodes[].wave` | wave mode only ([`waves.md`](waves.md)): the pass of stages 5–8 that closes the node, from 1. **An earlier wave may not wait on a later one** — `validate` refuses the edge, because a wave holds only what closes in its own pass |
 | `nodes[].evidence` | required when `status` is `done`. A node called done by assertion is what evidence exists to prevent |
 | `nodes[].parked_reason` | required when `status` is `parked`. A park with no reason is indistinguishable, a week later, from work quietly dropped |
@@ -55,22 +56,62 @@ conditional on the code, never merely sequenced after it.**
 | Verb | Prints | Codes |
 |---|---|---|
 | `validate` | every violation, in a stable order | `0` clean · `1` any |
-| `next` | the frontier, ordered by how much each node unblocks — **and nothing else**. `--wave N` narrows it to one wave, and `3` then means *this wave is done* | `0` printed · `3` all done · `4` nothing runnable · `1` with `--wave`, a wave no node is in |
+| `next` | the frontier, ordered by how much each node unblocks — **and nothing else**. `--wave N` narrows it to one wave, and `3` then means *this wave is done* | `0` printed · `3` all terminal · `4` nothing runnable with another barrier · `6` only recorded watched waits hold remaining dependency leaves · `1` with `--wave`, a wave no node is in |
 | `coverage` | each requirement with the nodes serving it | `0` covered · `1` a gap, named |
 | `goal` | the release goal | `0` · `3` unstated |
 | `add` | the id it allocated | `0` · `1` refused |
 | `park` | the id and the reason | `0` · `1` refused |
+| `wait` | the node and new wait identity; records kind, watcher locator and reason, never executes the locator | `0` recorded · `1` refused · `2` usage |
+| `resume` | the node and resolved wait identity; returns to pending and archives the wait in revisions | `0` resolved · `1` stale identity or refused · `2` usage |
 | `wave` | wave mode's re-cut: the node, its old and new wave, and the reason, which enters the revision log. Refuses a move that would leave an earlier wave waiting on a later one, and a `done` node | `0` · `1` refused |
-| `certify` | the round, and on a failure every `breaks` finding with its fix and its check | `0` every owed tier passed — three, or four with `visual` on a flagship or product node · `1` a tier failed, a required one is missing, or a report is malformed |
-| `close` | the goal, the new frontier count, and what was not verified | `0` · `1` refused **or the verdict stops the run** |
+| `certify` | the round — with a risk class, `round N: k of M owed passing rounds — not closable yet` or `k of M owed passing rounds — closable`; `--kind adversarial` records an adversarial round — and on a failure every `breaks` finding with its fix and its check | `0` every owed tier passed — three, or four with `visual` on a flagship or product node · `1` a tier failed, a required one is missing, or a report is malformed |
+| `close` | the goal, the new frontier count, and what was not verified | `0` · `1` refused — including a node whose risk class owes rounds not yet passed — **or the verdict stops the run** |
 | `producer` | what produced this proof — actor, model, runtime, skill, config, commit, trace | `0` |
 | `doctrine` | how many of the bundle's reference files this run opened | `0` |
 | `claim` | **external mode** — arbitrate one runnable node to a single owner through the durable coordinator (`scripts/execution_authority.py`); prints the grant. `next` says what COULD run, `claim` says who MAY | `0` won · `5` lost the race · `4` not runnable · `1` authority unavailable — **and `1` means no work starts** (fail-closed) |
 | `release` | give back a hold this run owns, matching its fence; a mismatch is a no-op, never a way to steal a live node | `0` released · `5` not held at that fence · `1` authority unavailable |
-| `recover` | **external mode** — reclaim an EXPIRED node for a new owner, minting a higher fence; a still-live claim is not recoverable (that is stealing a working node) | `0` recovered · `5` still live · `1` authority unavailable |
+| `recover` | **external mode** — reclaim an EXPIRED node for a new owner, minting a higher fence; a still-live claim is not recoverable (that is stealing a working node) | `0` recovered · `5` still live · `4` recorded wait unresolved · `1` invalid graph or authority unavailable |
 | `complete` | **external mode** — record completion from the CURRENT fence-holder only; a late/superseded worker (stale fence) is refused, and the current holder completing twice is idempotent | `0` completed · `5` not the current holder · `1` authority unavailable |
 | `waive` | record an AUTHORIZED EXCEPTION — reason + identity, its own disposition: the node is never marked certified, a failed certification stays visible, and `close` stamps the exception into the evidence | `0` waived · `1` refused (no reason, no identity, unknown node) |
-| `invalidate` | a REQ/interface/brief change supersedes one node: a superseding revision is recorded, and the node plus every `done` DESCENDANT resets to pending with its evidence/proof/certification cleared — a proof certified against a contract that moved is a proof about a tree that no longer exists. Unrelated nodes keep their proofs; invalidation flows downstream only | `0` invalidated · `1` refused (no `--why`, unknown node, or the write would break the graph) |
+| `invalidate` | a REQ/interface/brief change supersedes one node: a superseding revision is recorded, and the node plus every non-parked DESCENDANT resets to pending with its evidence/proof/certification cleared — a proof certified against a contract that moved is a proof about a tree that no longer exists. Unrelated nodes keep their proofs; invalidation flows downstream only | `0` invalidated · `1` refused (no `--why`, unknown node, or the write would break the graph) |
+
+### Watched external waits
+
+A node waiting on CI, review, a peer, release, time or a lease uses `status: waiting`
+and `waiting_on: {id, kind, watcher}`. The closed `kind` vocabulary is `ci`, `review`,
+`peer`, `release`, `time`, `lease`; `watcher` is a nonblank single-line durable
+trigger locator. The generated 32-hex identity distinguishes repeated waits even
+when the locator is reused. Runtime validation and the schema reject unknown
+statuses, malformed waits and live wait metadata on another status.
+
+```bash
+python3 scripts/graph.py wait N-001 --kind ci --watcher '<durable trigger locator>' --why 'candidate checks pending'
+python3 scripts/graph.py resume N-001 --wait-id '<identity returned by wait>' --why 'exact candidate checks resolved'
+```
+
+These transitions take the same exclusive graph lock as other mutations. `wait`
+accepts only pending/blocked nodes without a recorded execution claim; `resume`
+requires the current identity. Running, terminal and already-waiting nodes refuse
+a new wait. The prior record survives resume, park and invalidation in revisions.
+Close and certification refuse an unresolved wait; resume does not imply success
+or completion. It only allows the existing dependency and verification rules to
+consider the node again.
+
+`next` excludes waits from runnable stdout; external `claim` and `recover` therefore refuse
+one. Exit **6** means every remaining dependency leaf is a recorded wait, including
+leaves outside `--wave`. Wait identity/locator diagnostics go to stderr. A ready
+sibling still returns 0; a running, parked dependency or unclassified barrier keeps
+4. Exit 3 retains its existing all-terminal meaning, including intentionally parked
+nodes; it is not proof every requirement was delivered.
+
+Recording a locator does not start a watcher, prove it is alive, or authorize its
+action. Arm the actual watcher through the host and retain its receipt as described
+in [`continuity.md`](continuity.md). Human-only actions retain their boundary;
+resuming a graph node cannot grant approval. Graph-local state and the separate
+SQLite execution authority are not one transaction: this command refuses recorded
+graph claims but cannot discover an unrecorded external grant. In external mode,
+the coordinator must stop/release that grant before recording the wait and prevent
+concurrent dispatch. No cross-store fencing guarantee is claimed here.
 
 **`next` is ordered by what each node unblocks, transitively, and the number is computed.**
 A `priority` field is something somebody typed once and nobody revisits; this one moves when
@@ -95,6 +136,14 @@ it is never the one naming one.
 **A stop closes its node and refuses the next step.** `replan.possible: false` says the run
 cannot continue *around* what it found — not that the work just verified did not happen.
 
+**A mutation needs a working file lock.** The lock covers loading, checking and
+replacing the graph. If `fcntl` is unavailable or opening/acquiring the lock fails,
+the command exits 1 before writing; it no longer warns and continues unlocked.
+Read-only verbs remain available on those platforms. An atomic file replacement
+alone cannot prevent concurrent writers from losing each other's updates. This
+is a local graph-file guarantee, not a transaction with the separate execution
+claim store.
+
 ## The three things a schema cannot state
 
 The split is where the format actually puts it, which is not where the first draft drew it.

package/plugins/task-pipeline/skills/task-pipeline/scripts/backlog_sources.py

@@ -0,0 +1,212 @@
+#!/usr/bin/env python3
+"""The declared task sources a wave-0 harvest reads (`references/waves.md`, R13) — stdlib only.
+
+Where a repository carries `docs/backlog-sources.json`, the harvest reads exactly the sources
+it lists, with the id, title and status columns each one names, and a source of open work the
+manifest does not list is a finding, not a silent addition. This script is the mechanical half
+of that sentence: it reads the manifest, refuses one the harvest could not follow, and prints
+the list the harvest works from.
+
+    backlog_sources.py [--root DIR] [--found PATH ...]
+
+The rule a user of this skill reads is the shipped schema template,
+`templates/backlog-sources.schema.json` (backlog-sources/1), with `references/backlog.md` →
+*A declared source list*; this checker enforces it, plus the two rules a schema cannot state
+(a regular file reached through no symlink, no duplicate declaration). The Fabric workspace's
+`knowledge/backlog.md` (section *Source contract*; read at fabric-workspace d49b6f58,
+2026-10-08) is its provenance: the template is compatible with it, with one deliberate
+widening — `repository` may be any `https://github.com/<owner>/<repo>`, because this skill runs
+outside one organisation.
+
+- `schema` is 1; `repository` is a canonical GitHub URL; `sources` holds 1–100 entries.
+- Each `path` is relative, inside the repository, with no hidden, `.` or `..` segment and no
+  symlink on the way; it exists as a regular file — `.md`, or `.json` for `json-tasks`.
+- `goal` is one of the five anchors; `kind` is `tasks` (the default) or `context`.
+- A `tasks` source is `table`, `checklist` or `json-tasks`. A table names non-empty
+  `idColumn` and `titleColumn` and exactly one of `statusColumn` or `defaultStatus: "open"`.
+- `excludeIds` is a unique list of strings; `idPattern` is a literal prefix, optionally with
+  `[0-9]+` or `\\d+`, anchored at both ends. Two identical declarations are refused.
+- A key the schema does not name is refused, at the top and on a source; `heading` is a
+  string; `idColumn`, `titleColumn`, `statusColumn`, `defaultStatus`, `excludeIds` and
+  `idPattern` are checked on every
+  source, whatever its kind. Where `jsonschema` is installed the shipped schema is applied too.
+
+Output, on success: one JSON object — `repository`, `tasks` (each declaration as given, the
+fields the harvest reads), `context` (paths), `undeclared` (each `--found` path the manifest
+does not list, as `file:line`-free repository paths).
+
+Exit codes: 0 the manifest is readable and nothing undeclared was found, or there is no
+manifest (discovery then, as `references/knowledge-sources.md` describes — printed, not
+silent); 1 the manifest is malformed, every reason printed; 3 the manifest is fine and a
+`--found` source is not in it — the finding the doctrine asks for.
+"""
+from __future__ import annotations
+
+import argparse
+import json
+import pathlib
+import re
+import sys
+
+MANIFEST = "docs/backlog-sources.json"
+SCHEMA = pathlib.Path(__file__).resolve().parents[1] / "templates" / "backlog-sources.schema.json"
+TOP_KEYS = ("schema", "repository", "sources")
+SOURCE_KEYS = ("path", "goal", "kind", "format", "heading", "idColumn", "titleColumn",
+               "statusColumn", "defaultStatus", "idPattern", "excludeIds")
+GOALS = ("agent-workplace", "workflow-control", "interoperability", "reliable-work", "shared-context")
+FORMATS = ("table", "checklist", "json-tasks")
+REPOSITORY = re.compile(r"^https://github\.com/[A-Za-z0-9][A-Za-z0-9-]{0,38}/\.?[A-Za-z0-9][A-Za-z0-9._-]{0,99}$")
+ID_PATTERN = re.compile(r"^\^[A-Za-z0-9._/-]+(?:\[0-9\]\+|\\d\+)?\$$")
+UNSAFE = re.compile(r"[\\\x00-\x1f\x7f?#%:]")
+
+
+def _safe(path: object) -> bool:
+    if not isinstance(path, str) or not path or len(path) > 700 or UNSAFE.search(path):
+        return False
+    if path.startswith("/"):
+        return False
+    return all(seg and seg not in (".", "..") and not seg.startswith(".") for seg in path.split("/"))
+
+
+def _regular(root: pathlib.Path, path: str) -> bool:
+    """The file exists and nothing on the way to it is a symlink."""
+    cur = root
+    for seg in path.split("/"):
+        cur = cur / seg
+        if cur.is_symlink():
+            return False
+    return cur.is_file()
+
+
+def _nonempty(v: object) -> bool:
+    return isinstance(v, str) and bool(v.strip())
+
+
+def _schema_errors(doc: dict) -> list[str]:
+    """The shipped schema, applied when `jsonschema` is installed — the authority this
+    checker hand-implements. Without the library the hand checks above stand alone, and
+    they cover every rule the schema states."""
+    try:
+        import jsonschema
+        schema = json.loads(SCHEMA.read_text(encoding="utf-8"))
+    except (ImportError, OSError, ValueError):
+        return []
+    out = []
+    for e in sorted(jsonschema.Draft202012Validator(schema).iter_errors(doc), key=lambda e: list(e.path)):
+        where = "/".join(str(p) for p in e.path) or "(top)"
+        out.append(f"{MANIFEST}: schema: {where}: {e.message[:200]}")
+    return out
+
+
+def check(root: pathlib.Path, found: list[str]) -> tuple[int, dict | None, list[str]]:
+    """(exit code, the harvest list or None, reasons)."""
+    mf = root / MANIFEST
+    if not mf.exists():
+        return 0, None, [f"no {MANIFEST} — the harvest discovers its sources"]
+    try:
+        doc = json.loads(mf.read_text(encoding="utf-8"))
+    except (OSError, ValueError) as exc:
+        return 1, None, [f"{MANIFEST}: not readable JSON ({type(exc).__name__})"]
+    if not isinstance(doc, dict):
+        return 1, None, [f"{MANIFEST}: not an object"]
+    errs: list[str] = []
+    errs += [f"{MANIFEST}: unknown key `{k}` — backlog-sources/1 names {', '.join(TOP_KEYS)}"
+             for k in doc if k not in TOP_KEYS]
+    if doc.get("schema") != 1:
+        errs.append(f"{MANIFEST}: `schema` is {doc.get('schema')!r}, not 1")
+    if not REPOSITORY.match(str(doc.get("repository") or "")):
+        errs.append(f"{MANIFEST}: `repository` {doc.get('repository')!r} is not a canonical "
+                    "https://github.com/<owner>/<repo> URL")
+    sources = doc.get("sources")
+    if not isinstance(sources, list) or not 1 <= len(sources) <= 100:
+        errs.append(f"{MANIFEST}: `sources` must list 1–100 entries — a context-only "
+                    "repository still declares one")
+        sources = sources if isinstance(sources, list) else []
+    tasks, context, seen = [], [], set()
+    for i, s in enumerate(sources):
+        where = f"{MANIFEST}: sources[{i}]"
+        if not isinstance(s, dict):
+            errs.append(f"{where}: not an object")
+            continue
+        path, kind, fmt = s.get("path"), s.get("kind", "tasks"), s.get("format")
+        where = f"{where} ({path})"
+        errs += [f"{where}: unknown key `{k}` — a source names only {', '.join(SOURCE_KEYS)}"
+                 for k in s if k not in SOURCE_KEYS]
+        if "heading" in s and not isinstance(s["heading"], str):
+            errs.append(f"{where}: `heading` is not a string")
+        # These hold on EVERY source, whatever its kind or format: the schema says so, and
+        # a rule checked only on a task table is a rule a context source can break.
+        for col in ("idColumn", "titleColumn", "statusColumn"):
+            if col in s and not _nonempty(s.get(col)):
+                errs.append(f"{where}: `{col}` is empty")
+        if "defaultStatus" in s and s.get("defaultStatus") != "open":
+            errs.append(f"{where}: `defaultStatus` may only be \"open\"")
+        ex = s.get("excludeIds")
+        if ex is not None and (not isinstance(ex, list) or not all(_nonempty(x) for x in ex)
+                               or len(set(ex)) != len(ex)):
+            errs.append(f"{where}: `excludeIds` is a unique list of stable ids")
+        if "idPattern" in s and not ID_PATTERN.match(str(s.get("idPattern"))):
+            errs.append(f"{where}: `idPattern` {s.get('idPattern')!r} is not a literal "
+                        "prefix with an optional [0-9]+, anchored at both ends")
+        if kind not in ("tasks", "context"):
+            errs.append(f"{where}: `kind` {kind!r} is neither tasks nor context")
+        if s.get("goal") not in GOALS:
+            errs.append(f"{where}: `goal` {s.get('goal')!r} is not one of {', '.join(GOALS)}")
+        ext = ".json" if (kind == "tasks" and fmt == "json-tasks") else ".md"
+        if not _safe(path) or not str(path).endswith(ext):
+            errs.append(f"{where}: `path` must be a relative {ext} path with no hidden, `.` "
+                        "or `..` segment")
+        elif not _regular(root, path):
+            errs.append(f"{where}: the declared source is missing, or reached through a symlink")
+        if kind == "tasks":
+            if fmt not in FORMATS:
+                errs.append(f"{where}: `format` {fmt!r} is not one of {', '.join(FORMATS)} — "
+                            "an unsupported source is migrated or declared as context")
+            if fmt == "table":
+                has_status, has_default = "statusColumn" in s, "defaultStatus" in s
+                if not (_nonempty(s.get("idColumn")) and _nonempty(s.get("titleColumn"))):
+                    errs.append(f"{where}: a table names non-empty `idColumn` and `titleColumn`")
+                if has_status == has_default or (has_status and not _nonempty(s.get("statusColumn"))) \
+                        or (has_default and s.get("defaultStatus") != "open"):
+                    errs.append(f"{where}: a table names exactly one of a non-empty "
+                                "`statusColumn` or `defaultStatus: \"open\"`")
+        key = json.dumps([path, s.get("heading", ""), s.get("idPattern", ""), fmt or "",
+                          s.get("idColumn", ""), s.get("titleColumn", ""),
+                          s.get("statusColumn", ""), s.get("excludeIds", [])])
+        if key in seen:
+            errs.append(f"{where}: a duplicate declaration")
+        seen.add(key)
+        if kind == "tasks":
+            tasks.append({k: s[k] for k in ("path", "format", "heading", "idColumn", "titleColumn",
+                                             "statusColumn", "defaultStatus", "idPattern",
+                                             "excludeIds") if k in s})
+        elif isinstance(path, str):
+            context.append(path)
+    errs += _schema_errors(doc)
+    if errs:
+        return 1, None, list(dict.fromkeys(errs))
+    declared = {t["path"] for t in tasks} | set(context)
+    undeclared = sorted({f.strip().lstrip("./") for f in found if f.strip()} - declared)
+    out = {"repository": doc["repository"], "tasks": tasks, "context": context,
+           "undeclared": undeclared}
+    return (3 if undeclared else 0), out, [f"finding: {u} holds open work and is not declared "
+                                           f"in {MANIFEST}" for u in undeclared]
+
+
+def main(argv: list[str]) -> int:
+    p = argparse.ArgumentParser(prog="backlog_sources.py",
+                                description="The declared task sources a wave-0 harvest reads.")
+    p.add_argument("--root", default=".", help="the repository root (default: .)")
+    p.add_argument("--found", nargs="*", default=[],
+                   help="sources of open work discovery found, as repository paths")
+    a = p.parse_args(argv)
+    code, out, notes = check(pathlib.Path(a.root), a.found)
+    for n in notes:
+        print(f"backlog-sources: {n}", file=sys.stderr)
+    if out is not None:
+        print(json.dumps(out, ensure_ascii=False))
+    return code
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))

package/plugins/task-pipeline/skills/task-pipeline/scripts/context_packets.py

@@ -192,9 +192,9 @@ def verify_parents(report, plan):
 
 
 LEAF_SCHEMA = "task-pipeline/execution-packet/1"
-# Fabric's content-addressed packet was also `execution-packet/1` until Fabric renamed its
-# format `session-handoff/1` (fabric-agent-contract R-01). The namespace keeps the two from
-# being read as each other. The bare id is still READ, until no live packet carries it:
+# The namespace separates this packet from other systems using `execution-packet/1`;
+# it does not depend on a claimed Fabric format rename or deployed version.
+# The bare id is still READ, until no live packet carries it:
 # 19 packets in one consumer repository did on 2026-10-12 (backlog B-135); refusing it
 # before they are migrated would break them.
 LEGACY_LEAF_SCHEMAS = ("execution-packet/1",)