task-pipeline-skill 1.93.3 → 1.94.1

package/plugins/task-pipeline/skills/task-pipeline/references/stages.md

@@ -4,8 +4,9 @@ For each stage: what it does, what to invoke, artifacts, and the **GATE** that
 must pass before advancing. Each gate is tagged with its **type** — `auto` (the
 orchestrator verifies the check itself, pass/fail), `judgment` (a named judge
 rules where no complete deterministic check exists — [`gates.md`](gates.md) →
-*The judgment gate*) or `manual` (wait for the
-operator's explicit go). These stages (0 intake + 1→10) are the plugin's
+*The judgment gate*) or `manual` (requires the operator's explicit go, including a
+specific standing authorization naming the act, cited with its source and scope;
+otherwise wait). These stages (0 intake + 1→10) are the plugin's
 **example** flow, encoded in `pipeline.example.json` against the universal contract
 `pipeline.schema.json`; a host project replaces it with its own
 stages/agents/types (see SKILL.md → *Bring your own skills*).
@@ -108,7 +109,10 @@ never that the work was skipped quietly.
   read **in full** — ten standing rows and ten stamps, both bounded **by a cap**, and they bind this
   run; stamp each instruction as it fires. Its *Recent log* is **queried** by the
   task's nouns, not read: uncapped narrative inside a binding source is what makes the
-  capped part get skimmed, [`retrospective.md`](retrospective.md)), the **knowledge wiki** if one is
+  capped part get skimmed, [`retrospective.md`](retrospective.md)), **lessons from other
+  projects** (source 7b, [`knowledge-sources.md`](knowledge-sources.md): `scripts/lessons.py
+  query` over the local index, then a shared store where the session lists one — each
+  layer's state printed in the source ledger), the **knowledge wiki** if one is
   installed
   ([obsidian-wiki](https://github.com/ar9av/obsidian-wiki) — recommended,
   never required), and any **other repo or hosted doc system the project names as
@@ -180,8 +184,10 @@ never that the work was skipped quietly.
   names the target and the preconditions.
 - **The run mode is settled here too** ([`continuity.md`](continuity.md)): does
   the run advance item-by-item with no check-in between items, and on what
-  interval? Read `pipeline.json` → `run.loop` first — a recorded mode is the
-  answer and is not re-asked; **absent, it is off**. It buys pacing, never
+  interval? Exactly three sources arm it: `pipeline.json` → `run.loop` (read
+  first — a recorded mode is the answer and is not re-asked), the operator's answer
+  here, or a standing instruction the host already carries. The ledger names which, once:
+  `loop: armed by <source:line>`. **Absent all three, it is off.** It buys pacing, never
   authorization: no loop mode collapses a `manual` gate or an outward act. The
   same file carries the other half of pacing — the context budget, which fires
   only on a harness signal or the operator's word, never on an estimate.
@@ -251,7 +257,10 @@ never that the work was skipped quietly.
   own churn detection mechanical and reads the `touch:` lines, and
   [`progress.md`](progress.md) derives the rail and the iteration counter from the
   `stage:` and `iter:` lines. The header goes out before the interview because a run
-  that announces its position only at the end announced it to nobody.
+  that announces its position only at the end announced it to nobody. A new ledger starts a new
+  run's memory state: a previous run's "memory unavailable" marker is honoured only while
+  its own ledger line is in the ledger, so a reseeded ledger — even the same day — is nudged
+  again, and the stale marker is cleared at the next `stage_checkpoint.py record`.
 - **The board is read, or seeded.** `<artifacts>/backlog.md` ([`backlog.md`](backlog.md)) — its **open count is quoted in the brief**, measured by a command at the top of the run rather than inherited from the last run's report. Absent ⇒ seeded from the template and said so; an empty board and no board are the same thing to work on, and only one of them can be appended to.
 
 ## 1 — Docs study
@@ -304,8 +313,11 @@ never that the work was skipped quietly.
   can name is a node the seam and product tiers cannot scope, so `touches` and `serves` are
   what make the two outer readings possible at all.
 - **The queue exists here, so the loop arms here** ([`continuity.md`](continuity.md) →
-  *Part 1a*). Where `run.loop.arm` is `after-decomposition` and the map holds more than
-  one module, arm the mode at the close of this stage and print one line: the mode, and
+  *Part 1a*). Where the loop is armed — `run.loop` with `arm: after-decomposition`, the
+  operator's preflight answer, or a standing instruction the host carries (which arms here
+  unless it says otherwise) — and the map holds more than one module, arm the mode at the
+  close of this stage, cite the source as `loop: armed by <source:line>`, and print one
+  line: the mode, and
   either the job id and its cancel command (`interval`) or the delay chosen and why
   (`dynamic`). Arming collapses no gate and authorizes no outward act; it decides only
   that the run does not stop to ask *"shall I take the next one?"*. Single-module work
@@ -589,7 +601,12 @@ never that the work was skipped quietly.
   `partial` ships only with the operator's explicit acceptance. A gap is cheapest to
   close before it ships, and the operator is already present at this gate. **The
   carry-over count is printed beside this verdict.** Deploy is outward → explicit
-  operator go — unless the operator already authorised releases. **Before the tag, read
+  operator go, or a specific standing authorization naming that act, cited with its source
+  and scope. Authorization to release does not silently authorize a separate deploy. If
+  `release.authorized_by` is present, read that source and verify its authority,
+  currentness and scope for the tag and publication; the locator is not authorization.
+  If absent, inspect existing recorded authority before asking for a missing grant.
+  **Before the tag, read
   the release's approval mode** (`pipeline.json` → `release.approval`; then
   [`deploy-targets.md`](deploy-targets.md) → *When the release waits for an approval*):
   `checks` — push the tag, watch the run selected by the tag, report; `reviewers` — the
@@ -790,7 +807,11 @@ never that the work was skipped quietly.
   commit that retired it**), then **write an entry only if
   the run diverged** (symptom · the stage it surfaced at · the stage that *owned* it
   · root cause · fix, mechanical before instruction before expiring note · the check
-  that catches it next time). Every run stamps and prunes; a retro left empty after
+  that catches it next time). An entry whose class would be true in another project
+  carries a `**Lesson:**` line, and **`scripts/lessons.py add --retro <retro> --entry
+  <anchor>` puts it in the local lesson index** — and, where the session lists a shared
+  store, `emit-observatory` → the tool → `record` ([`iteration.md`](iteration.md) → *The
+  learning loop*). Every run stamps and prunes; a retro left empty after
   a messy run is the failure the file exists to stop. Stage 0 reads the standing
   instructions in full next time, which is why the cap is not negotiable.
 - **GATE (manual):** the ladder walk ran and its absences became REQ rows before
@@ -814,7 +835,10 @@ never that the work was skipped quietly.
   the same archive, and both counts print beside the verdict** (the stamp table is read
   in full at stage 0, so *one line per run* is a slope the prune has to stop), the run
   stamped with its commit, every SHA in either file resolvable, and the
-  counts printed beside this verdict**; **where `pipeline.json` → `retro.publish` is
+  counts printed beside this verdict**; **every entry with a `**Lesson:**` line is in the
+  local index (`lessons.py add` printed its id) or its refusal is printed, and the shared
+  store's state is one ledger line** (`recorded`, `store refused — <code>`, or `shared
+  lessons: absent`); **where `pipeline.json` → `retro.publish` is
   set, the skill-level insight is published as an issue on the skill's repository —
   its body printed in full first, the printed string and the sent string being one
   string, and the five redaction rules applied

package/plugins/task-pipeline/skills/task-pipeline/references/waves.md

@@ -54,7 +54,7 @@ on real agents, tasks and users rather than on the first guess.
 | 2 Brainstorm + decompose | once: the canvas extends the module map ([`decomposition.md`](decomposition.md)), and the work graph carries each node's wave |
 | 3 Spec | once: the canvas is the committed target-state spec; a wave's dossier may deepen a section, never contradict it |
 | 4 Plan | once: every wave's nodes, its exit criteria and the question batch. Re-cut at each wave boundary, as a recorded revision |
-| 5–8 Build → post-deploy | per wave, then the close pass |
+| 5–8 Build → post-deploy | per wave, then the close pass. A wave's stage 7 integrates to the main branch **without tagging**; the release's tag, its approval mode and its go are stage 7's full gate, run once at the release ([`iteration.md`](iteration.md) → *The cycle*, step 10), and stage 8's trio follows on what was released (step 11) |
 | 9 Docs + wiki · 10 Acceptance | once, to close the release, over everything the waves shipped |
 
 **One planning gate, not three prompts.** The manual gates of stages 0, 2 and 3 are
@@ -72,8 +72,10 @@ product has users, walk their real path in the built app on a fresh profile with
 disposable data. A finding is a fact with a receipt, never an impression.
 
 **A declared source list outranks discovery.** Where the repository carries
-`docs/backlog-sources.json` — the contract is owned by the Fabric workspace's
-`knowledge/backlog.md` — the harvest reads exactly the sources it lists, as the board,
+`docs/backlog-sources.json` — its shape is
+[`templates/backlog-sources.schema.json`](../templates/backlog-sources.schema.json)
+([`backlog.md`](backlog.md) → *A declared source list*) — the harvest reads exactly the
+sources it lists, as the board,
 with the id, title and status columns it names. Status changes land only in those owning
 files, under a lease. A new source joins the manifest in the same change. A generated
 view of them, such as a published common backlog, is never edited. A source of open
@@ -84,29 +86,37 @@ prints the sources the harvest reads, refuses a manifest the harvest could not f
 No manifest is discovery, said aloud (exit 0).
 
 **One machine-readable inventory, nothing outside it.** A single committed file,
-`<artifacts>/specs/YYYY-MM-DD-<topic>-inventory.json`, one entry per open item:
-
-| Field | Carries |
-|---|---|
-| `id` | the item's id in its owning register; an item without one gets one there, in the same change |
-| `source` | where it was found, as `file:line` |
-| `status` | as measured, not as the register last said |
-| `area` | the part of the system it touches |
-| `node` | the canvas node it lands on |
-| `wave` | the wave that closes it, or the release it is carried to |
-| `release` | this release, or `program` |
-
-`blocked_by`, `closable_in_one_pass` and `notes` are worth carrying beside them.
+`<artifacts>/specs/YYYY-MM-DD-<topic>-inventory.json`, one item per open item. Its shape is
+[`templates/inventory.schema.json`](../templates/inventory.schema.json) (inventory/1): every
+item carries its `id` in the owning register, `title`, `area`, `kind`, `severity`, the
+`evidence` that is its receipt and a `proposed_fix`; `status` is as measured, not as the
+register last said; `module`, `node`, `wave` and `release` are written by the script below,
+never by hand. `scripts/waves.py merge <dir>` builds it from the survey outputs and refuses
+an item without evidence or an id seen twice.
 
 **Verify each open item against the code before trusting it.** A stale item is closed
 in its owning register with the receipt that shows it done; duplicates are clustered,
 both ids kept. A register that says *open* about shipped work is the commonest thing a
 survey finds.
 
-**Assign nodes and waves with a committed script, not by hand.** A deterministic script
-reads the inventory and a short wave table and writes `node`, `wave` and `release` onto
-every entry, then prints the counts per wave and per node. A re-cut is then a diff to a
-table and a re-run, which a reviewer can read; seven hundred hand-edited rows are not.
+**Assign nodes and waves with a committed script, not by hand.** `scripts/waves.py assign
+--modules <modules.json> --plan <plan.json> --write` reads two short tables — module → item
+ids, and the plan's nodes with their `wave` and the items each `closes` — writes `module`,
+`node`, `wave` and `release` onto every item, and prints the counts. `waves.py validate`
+exits 1 when an item lands on no module or an open item on no node: either the canvas has a
+gap or the item is closed with its receipt or carried (`status: carried`, `release:
+program`). An incomplete `assign --write` prints the gaps but preserves the prior file;
+preview and repair the tables before retrying. Plan ids and effective `graph_id` targets
+must be unique. `waves.py sync-graph` writes the plan's waves and risk classes onto the
+work graph with graph.py's lock and revision log — one `wave` or `risk` revision per
+change, a lowered risk only with `--lower-why` — and judges the re-cut as
+a whole with graph.py's order rule, so moving a chain up a wave is never refused halfway.
+A missing graph target refuses before any write; `--only-present` explicitly opts into a
+plan spanning several graphs. A re-cut is then a diff to a table
+and a re-run, which a reviewer can read; seven hundred hand-edited rows are not. The canvas,
+the question queue and each dossier start from [`templates/canvas.md`](../templates/canvas.md),
+[`templates/questions.md`](../templates/questions.md) and
+[`templates/dossier.md`](../templates/dossier.md).
 
 ## The questions — closed from sources, then one batch
 
@@ -121,13 +131,16 @@ answer and the consequence of each answer, ordered so prerequisite decisions com
 ([`grill.md`](grill.md)). A go that leaves a question unanswered takes the
 recommendation, recorded as **assumed** in the decisions table, and every wave that
 depends on an assumption names it — so a different answer later re-plans exactly those
-waves and no others. After planning, a question is asked only at a wave boundary, in the
-hand-back's DECISIONS WAITING ([`progress.md`](progress.md)).
+waves and no others. After planning, a question is asked only in a question round
+([`iteration.md`](iteration.md) → *Question rounds*): a wave boundary, a blocked frontier
+or five open questions calls one, and its batch lands in the hand-back's DECISIONS
+WAITING ([`progress.md`](progress.md)). Never one question at a time.
 
-**An outward or irreversible act is never assumed.** Publishing, tagging, deploying
-without a specific standing authorization, sending to a person, spending money,
-deleting data: each waits for the operator's explicit go, asked with a verified direct
-link. A recommendation is not an authorization.
+**An outward or irreversible act is never assumed.** Publishing, tagging, deploying,
+sending to a person, spending money or deleting data needs authorization naming that act.
+Cite a specific standing authorization within its scope; otherwise ask for the operator's
+explicit go with the relevant verified direct link. A recommendation or generic loop mode
+is not authorization ([`continuity.md`](continuity.md) → *The limit, before the capability*).
 
 ## The canvas — the target state over the current logic
 
@@ -169,21 +182,39 @@ marked `needs-operator`, out of every wave until it is unblocked.
 
 Each wave runs stages 5–8 as [`stages.md`](stages.md) states them, then the close pass.
 Between waves the run does not ask whether to continue: it takes the next wave
-([`continuity.md`](continuity.md)). A genuine ambiguity parks its node `needs-operator`
-and the wave goes on with the nodes it does not block; the run stops only when the whole
-frontier is blocked. When the board is empty, it says so once.
+([`continuity.md`](continuity.md)). An unresolved ambiguity parks its node with its
+actual owner and reason; only a human-owned question is `needs-operator`. Project
+asks follow [`iteration.md`](iteration.md), and the wave continues on independent
+nodes. A frontier blocked by CI, review
+or another external wait goes on watchers, with the waits and their next actions recorded
+([`continuity.md`](continuity.md) → *Waits outlive turns*); it is not completion or a new
+request for permission. An unresolved human gate stops its dependent work. When the board
+is empty, the run says so once. `graph.py next --wave N` returns 6 when only recorded
+watched waits hold that wave, following prerequisite leaves across wave boundaries.
+Keep their watchers armed; `wait` records their locators and `resume --wait-id`
+refuses stale events. Exit 4 retains mixed or unclassified barriers: read the reasons
+before choosing the next action. Neither code is proof of completion or authority
+([`work-graph.md`](work-graph.md) → *Watched external waits*).
 
 Research, the audit and the blind readings run in parallel agents; builds stay sequential
 wherever two of them share a seam ([`planning.md`](planning.md) → file ownership).
 
+**Verification does not wait for the wave.** A node is certified as soon as it lands, in
+the number of rounds its risk class sets, and a seam is checked once the last node on it
+lands ([`iteration.md`](iteration.md) → *Verification starts when a node lands*). The
+close pass below then re-measures what those rounds already proved.
+
 ## The close pass, after every wave
 
 In this order, inside the wave rather than after it:
 
 1. **Verify.** Every node the wave closes is certified ([`certification.md`](certification.md)),
+   most of it already, as each node landed,
    and [`audit.md`](audit.md)'s exit is re-measured over what the wave touched.
 2. **Finish and fix — one fix round**, inside [`loop-guard.md`](loop-guard.md)'s caps.
-   Every finding is fixed in the wave or parked with a board row and its reason; nothing
+   Findings against this wave's nodes are fixed here or parked with a board row and reason.
+   Findings elsewhere join the inventory for a planned node; only the closed hotfix lane
+   bypasses that design ([`iteration.md`](iteration.md) → *No fix travels alone*). Nothing
    is dropped silently.
 3. **Document** — the Doc Loop and the stage-9 propagation matrix
    ([`documentation.md`](documentation.md)), scoped to the wave: scenarios, decisions,
@@ -197,6 +228,9 @@ In this order, inside the wave rather than after it:
 
 ## A board bigger than one release
 
+**The loop around the waves — release, post-release check, next pool, and the next
+iteration — is [`iteration.md`](iteration.md).**
+
 **It becomes a program.** The release takes the first waves; the rest stays on the
 canvas by node, `release: program`, never dropped. The next release resumes from the
 canvas: it re-measures the inventory rather than re-running wave 0 from nothing, and its
@@ -204,11 +238,17 @@ waves are cut from the nodes still open.
 
 ## What stays human
 
-Sign-ins, consents, payments, sending to people, and every outward or irreversible act.
-The mode removes *"shall I continue?"* between waves and *"what did you mean?"* where a
-source already says; it never removes a person from a decision that is theirs. A
-`manual` gate still waits for its go ([`continuity.md`](continuity.md) → *The limit,
-before the capability*).
+Sign-ins, consents, operator payments and typed secrets remain human. Record the
+required action and continue independent work; a release or loop grant cannot
+perform these actions for the person.
+
+Other outward or irreversible acts, including sending to people, require explicit
+authority. A specific standing authorization naming the act counts within its
+recorded source and scope ([`continuity.md`](continuity.md) → *The limit, before the
+capability*). A generic instruction to continue does not. A `manual` gate waits
+without such authority. The mode removes *"shall I continue?"* between waves and
+*"what did you mean?"* where a source already says; it never removes a person from
+a decision that is theirs.
 
 ## The graph carries the wave
 
@@ -233,5 +273,5 @@ said to be checked by hand.
 | "Ask each question as it comes up" | Each one is a human round. Close it from the sources, or put it in the batch |
 | "The board is too big to inventory" | The inventory is the plan. Without it the waves are cut from memory |
 | "Re-cutting waves makes the pipeline dynamic" | A re-cut is a committed revision and a canvas edit. The static-graph decision in [`planning.md`](planning.md) holds |
-| "The recommendation is obviously right, so assume the deploy go" | An outward act is never assumed. Ask for the specific go once, in the batch |
+| "The recommendation is obviously right, so assume the deploy go" | An outward act is never assumed. Cite the standing authorization naming it, or ask for the specific go once, in the batch |
 | "Wave 3 can stub what wave 5 will build properly" | Only at a declared contract, with wave 5 named as the stub's removal |

package/plugins/task-pipeline/skills/task-pipeline/references/work-graph.md

@@ -41,6 +41,7 @@ turn of every loop.
 | `nodes[].blocked_by` | what must PRODUCE first. The frontier obeys a satisfaction predicate, and only `done` satisfies — a PARKED producer blocks its consumer, because a park is a decision not to produce, not a production. `next` names each held consumer with the park's reason; a valid alternative producer is an explicit, versioned edge change, never an implicit unblock |
 | `nodes[].touches` | what it **mutates**. Two runnable nodes writing one file is the false parallelism [`planning.md`](planning.md) refuses — *distinct is not the same as independent, and the check is what they touch, never what they are called* |
 | `nodes[].check` | **how this node will be closed** — one command, or the named judgement where no command can decide it. Required on every node except a `parked` one. The certification's `unit` tier runs it and reports its output as the evidence row ([`certification.md`](certification.md) — three blind tiers close a node, not one reader); before this field existed that instruction pointed at an absence, leaving a verifier the two things it forbids — invent a check, or run everything (B-080) |
+| `nodes[].risk` | wave mode or a release iteration: the node's risk class, `R1`, `R2` or `R3` ([`iteration.md`](iteration.md) → *Verification starts when a node lands*): how many passing certification rounds the node owes — one, two, or three with one adversarial ([`certification.md`](certification.md) → *Rounds owed by risk class*). `validate` refuses any other value, because a class nobody recognises owes no known number of rounds, and `close` refuses the node until its rounds are done |
 | `nodes[].wave` | wave mode only ([`waves.md`](waves.md)): the pass of stages 5–8 that closes the node, from 1. **An earlier wave may not wait on a later one** — `validate` refuses the edge, because a wave holds only what closes in its own pass |
 | `nodes[].evidence` | required when `status` is `done`. A node called done by assertion is what evidence exists to prevent |
 | `nodes[].parked_reason` | required when `status` is `parked`. A park with no reason is indistinguishable, a week later, from work quietly dropped |
@@ -55,22 +56,62 @@ conditional on the code, never merely sequenced after it.**
 | Verb | Prints | Codes |
 |---|---|---|
 | `validate` | every violation, in a stable order | `0` clean · `1` any |
-| `next` | the frontier, ordered by how much each node unblocks — **and nothing else**. `--wave N` narrows it to one wave, and `3` then means *this wave is done* | `0` printed · `3` all done · `4` nothing runnable · `1` with `--wave`, a wave no node is in |
+| `next` | the frontier, ordered by how much each node unblocks — **and nothing else**. `--wave N` narrows it to one wave, and `3` then means *this wave is done* | `0` printed · `3` all terminal · `4` nothing runnable with another barrier · `6` only recorded watched waits hold remaining dependency leaves · `1` with `--wave`, a wave no node is in |
 | `coverage` | each requirement with the nodes serving it | `0` covered · `1` a gap, named |
 | `goal` | the release goal | `0` · `3` unstated |
 | `add` | the id it allocated | `0` · `1` refused |
 | `park` | the id and the reason | `0` · `1` refused |
+| `wait` | the node and new wait identity; records kind, watcher locator and reason, never executes the locator | `0` recorded · `1` refused · `2` usage |
+| `resume` | the node and resolved wait identity; returns to pending and archives the wait in revisions | `0` resolved · `1` stale identity or refused · `2` usage |
 | `wave` | wave mode's re-cut: the node, its old and new wave, and the reason, which enters the revision log. Refuses a move that would leave an earlier wave waiting on a later one, and a `done` node | `0` · `1` refused |
-| `certify` | the round, and on a failure every `breaks` finding with its fix and its check | `0` every owed tier passed — three, or four with `visual` on a flagship or product node · `1` a tier failed, a required one is missing, or a report is malformed |
-| `close` | the goal, the new frontier count, and what was not verified | `0` · `1` refused **or the verdict stops the run** |
+| `certify` | the round — with a risk class, `round N: k of M owed passing rounds — not closable yet` or `k of M owed passing rounds — closable`; `--kind adversarial` records an adversarial round — and on a failure every `breaks` finding with its fix and its check | `0` every owed tier passed — three, or four with `visual` on a flagship or product node · `1` a tier failed, a required one is missing, or a report is malformed |
+| `close` | the goal, the new frontier count, and what was not verified | `0` · `1` refused — including a node whose risk class owes rounds not yet passed — **or the verdict stops the run** |
 | `producer` | what produced this proof — actor, model, runtime, skill, config, commit, trace | `0` |
 | `doctrine` | how many of the bundle's reference files this run opened | `0` |
 | `claim` | **external mode** — arbitrate one runnable node to a single owner through the durable coordinator (`scripts/execution_authority.py`); prints the grant. `next` says what COULD run, `claim` says who MAY | `0` won · `5` lost the race · `4` not runnable · `1` authority unavailable — **and `1` means no work starts** (fail-closed) |
 | `release` | give back a hold this run owns, matching its fence; a mismatch is a no-op, never a way to steal a live node | `0` released · `5` not held at that fence · `1` authority unavailable |
-| `recover` | **external mode** — reclaim an EXPIRED node for a new owner, minting a higher fence; a still-live claim is not recoverable (that is stealing a working node) | `0` recovered · `5` still live · `1` authority unavailable |
+| `recover` | **external mode** — reclaim an EXPIRED node for a new owner, minting a higher fence; a still-live claim is not recoverable (that is stealing a working node) | `0` recovered · `5` still live · `4` recorded wait unresolved · `1` invalid graph or authority unavailable |
 | `complete` | **external mode** — record completion from the CURRENT fence-holder only; a late/superseded worker (stale fence) is refused, and the current holder completing twice is idempotent | `0` completed · `5` not the current holder · `1` authority unavailable |
 | `waive` | record an AUTHORIZED EXCEPTION — reason + identity, its own disposition: the node is never marked certified, a failed certification stays visible, and `close` stamps the exception into the evidence | `0` waived · `1` refused (no reason, no identity, unknown node) |
-| `invalidate` | a REQ/interface/brief change supersedes one node: a superseding revision is recorded, and the node plus every `done` DESCENDANT resets to pending with its evidence/proof/certification cleared — a proof certified against a contract that moved is a proof about a tree that no longer exists. Unrelated nodes keep their proofs; invalidation flows downstream only | `0` invalidated · `1` refused (no `--why`, unknown node, or the write would break the graph) |
+| `invalidate` | a REQ/interface/brief change supersedes one node: a superseding revision is recorded, and the node plus every non-parked DESCENDANT resets to pending with its evidence/proof/certification cleared — a proof certified against a contract that moved is a proof about a tree that no longer exists. Unrelated nodes keep their proofs; invalidation flows downstream only | `0` invalidated · `1` refused (no `--why`, unknown node, or the write would break the graph) |
+
+### Watched external waits
+
+A node waiting on CI, review, a peer, release, time or a lease uses `status: waiting`
+and `waiting_on: {id, kind, watcher}`. The closed `kind` vocabulary is `ci`, `review`,
+`peer`, `release`, `time`, `lease`; `watcher` is a nonblank single-line durable
+trigger locator. The generated 32-hex identity distinguishes repeated waits even
+when the locator is reused. Runtime validation and the schema reject unknown
+statuses, malformed waits and live wait metadata on another status.
+
+```bash
+python3 scripts/graph.py wait N-001 --kind ci --watcher '<durable trigger locator>' --why 'candidate checks pending'
+python3 scripts/graph.py resume N-001 --wait-id '<identity returned by wait>' --why 'exact candidate checks resolved'
+```
+
+These transitions take the same exclusive graph lock as other mutations. `wait`
+accepts only pending/blocked nodes without a recorded execution claim; `resume`
+requires the current identity. Running, terminal and already-waiting nodes refuse
+a new wait. The prior record survives resume, park and invalidation in revisions.
+Close and certification refuse an unresolved wait; resume does not imply success
+or completion. It only allows the existing dependency and verification rules to
+consider the node again.
+
+`next` excludes waits from runnable stdout; external `claim` and `recover` therefore refuse
+one. Exit **6** means every remaining dependency leaf is a recorded wait, including
+leaves outside `--wave`. Wait identity/locator diagnostics go to stderr. A ready
+sibling still returns 0; a running, parked dependency or unclassified barrier keeps
+4. Exit 3 retains its existing all-terminal meaning, including intentionally parked
+nodes; it is not proof every requirement was delivered.
+
+Recording a locator does not start a watcher, prove it is alive, or authorize its
+action. Arm the actual watcher through the host and retain its receipt as described
+in [`continuity.md`](continuity.md). Human-only actions retain their boundary;
+resuming a graph node cannot grant approval. Graph-local state and the separate
+SQLite execution authority are not one transaction: this command refuses recorded
+graph claims but cannot discover an unrecorded external grant. In external mode,
+the coordinator must stop/release that grant before recording the wait and prevent
+concurrent dispatch. No cross-store fencing guarantee is claimed here.
 
 **`next` is ordered by what each node unblocks, transitively, and the number is computed.**
 A `priority` field is something somebody typed once and nobody revisits; this one moves when
@@ -95,6 +136,14 @@ it is never the one naming one.
 **A stop closes its node and refuses the next step.** `replan.possible: false` says the run
 cannot continue *around* what it found — not that the work just verified did not happen.
 
+**A mutation needs a working file lock.** The lock covers loading, checking and
+replacing the graph. If `fcntl` is unavailable or opening/acquiring the lock fails,
+the command exits 1 before writing; it no longer warns and continues unlocked.
+Read-only verbs remain available on those platforms. An atomic file replacement
+alone cannot prevent concurrent writers from losing each other's updates. This
+is a local graph-file guarantee, not a transaction with the separate execution
+claim store.
+
 ## The three things a schema cannot state
 
 The split is where the format actually puts it, which is not where the first draft drew it.

package/plugins/task-pipeline/skills/task-pipeline/scripts/backlog_sources.py

@@ -9,11 +9,14 @@ the list the harvest works from.
 
     backlog_sources.py [--root DIR] [--found PATH ...]
 
-The contract is not this file's: it is owned by the Fabric workspace's `knowledge/backlog.md`
-(section *Source contract*; read at fabric-workspace d49b6f58, 2026-10-08), and its collector
-there is the authority. This checker refuses what that contract states in prose, with one
-deliberate widening: `repository` may be any `https://github.com/<owner>/<repo>`, because this
-skill runs outside one organisation.
+The rule a user of this skill reads is the shipped schema template,
+`templates/backlog-sources.schema.json` (backlog-sources/1), with `references/backlog.md` →
+*A declared source list*; this checker enforces it, plus the two rules a schema cannot state
+(a regular file reached through no symlink, no duplicate declaration). The Fabric workspace's
+`knowledge/backlog.md` (section *Source contract*; read at fabric-workspace d49b6f58,
+2026-10-08) is its provenance: the template is compatible with it, with one deliberate
+widening — `repository` may be any `https://github.com/<owner>/<repo>`, because this skill runs
+outside one organisation.
 
 - `schema` is 1; `repository` is a canonical GitHub URL; `sources` holds 1–100 entries.
 - Each `path` is relative, inside the repository, with no hidden, `.` or `..` segment and no
@@ -23,6 +26,10 @@ skill runs outside one organisation.
   `idColumn` and `titleColumn` and exactly one of `statusColumn` or `defaultStatus: "open"`.
 - `excludeIds` is a unique list of strings; `idPattern` is a literal prefix, optionally with
   `[0-9]+` or `\\d+`, anchored at both ends. Two identical declarations are refused.
+- A key the schema does not name is refused, at the top and on a source; `heading` is a
+  string; `idColumn`, `titleColumn`, `statusColumn`, `defaultStatus`, `excludeIds` and
+  `idPattern` are checked on every
+  source, whatever its kind. Where `jsonschema` is installed the shipped schema is applied too.
 
 Output, on success: one JSON object — `repository`, `tasks` (each declaration as given, the
 fields the harvest reads), `context` (paths), `undeclared` (each `--found` path the manifest
@@ -42,6 +49,10 @@ import re
 import sys
 
 MANIFEST = "docs/backlog-sources.json"
+SCHEMA = pathlib.Path(__file__).resolve().parents[1] / "templates" / "backlog-sources.schema.json"
+TOP_KEYS = ("schema", "repository", "sources")
+SOURCE_KEYS = ("path", "goal", "kind", "format", "heading", "idColumn", "titleColumn",
+               "statusColumn", "defaultStatus", "idPattern", "excludeIds")
 GOALS = ("agent-workplace", "workflow-control", "interoperability", "reliable-work", "shared-context")
 FORMATS = ("table", "checklist", "json-tasks")
 REPOSITORY = re.compile(r"^https://github\.com/[A-Za-z0-9][A-Za-z0-9-]{0,38}/\.?[A-Za-z0-9][A-Za-z0-9._-]{0,99}$")
@@ -71,6 +82,22 @@ def _nonempty(v: object) -> bool:
     return isinstance(v, str) and bool(v.strip())
 
 
+def _schema_errors(doc: dict) -> list[str]:
+    """The shipped schema, applied when `jsonschema` is installed — the authority this
+    checker hand-implements. Without the library the hand checks above stand alone, and
+    they cover every rule the schema states."""
+    try:
+        import jsonschema
+        schema = json.loads(SCHEMA.read_text(encoding="utf-8"))
+    except (ImportError, OSError, ValueError):
+        return []
+    out = []
+    for e in sorted(jsonschema.Draft202012Validator(schema).iter_errors(doc), key=lambda e: list(e.path)):
+        where = "/".join(str(p) for p in e.path) or "(top)"
+        out.append(f"{MANIFEST}: schema: {where}: {e.message[:200]}")
+    return out
+
+
 def check(root: pathlib.Path, found: list[str]) -> tuple[int, dict | None, list[str]]:
     """(exit code, the harvest list or None, reasons)."""
     mf = root / MANIFEST
@@ -83,6 +110,8 @@ def check(root: pathlib.Path, found: list[str]) -> tuple[int, dict | None, list[
     if not isinstance(doc, dict):
         return 1, None, [f"{MANIFEST}: not an object"]
     errs: list[str] = []
+    errs += [f"{MANIFEST}: unknown key `{k}` — backlog-sources/1 names {', '.join(TOP_KEYS)}"
+             for k in doc if k not in TOP_KEYS]
     if doc.get("schema") != 1:
         errs.append(f"{MANIFEST}: `schema` is {doc.get('schema')!r}, not 1")
     if not REPOSITORY.match(str(doc.get("repository") or "")):
@@ -101,6 +130,24 @@ def check(root: pathlib.Path, found: list[str]) -> tuple[int, dict | None, list[
             continue
         path, kind, fmt = s.get("path"), s.get("kind", "tasks"), s.get("format")
         where = f"{where} ({path})"
+        errs += [f"{where}: unknown key `{k}` — a source names only {', '.join(SOURCE_KEYS)}"
+                 for k in s if k not in SOURCE_KEYS]
+        if "heading" in s and not isinstance(s["heading"], str):
+            errs.append(f"{where}: `heading` is not a string")
+        # These hold on EVERY source, whatever its kind or format: the schema says so, and
+        # a rule checked only on a task table is a rule a context source can break.
+        for col in ("idColumn", "titleColumn", "statusColumn"):
+            if col in s and not _nonempty(s.get(col)):
+                errs.append(f"{where}: `{col}` is empty")
+        if "defaultStatus" in s and s.get("defaultStatus") != "open":
+            errs.append(f"{where}: `defaultStatus` may only be \"open\"")
+        ex = s.get("excludeIds")
+        if ex is not None and (not isinstance(ex, list) or not all(_nonempty(x) for x in ex)
+                               or len(set(ex)) != len(ex)):
+            errs.append(f"{where}: `excludeIds` is a unique list of stable ids")
+        if "idPattern" in s and not ID_PATTERN.match(str(s.get("idPattern"))):
+            errs.append(f"{where}: `idPattern` {s.get('idPattern')!r} is not a literal "
+                        "prefix with an optional [0-9]+, anchored at both ends")
         if kind not in ("tasks", "context"):
             errs.append(f"{where}: `kind` {kind!r} is neither tasks nor context")
         if s.get("goal") not in GOALS:
@@ -123,13 +170,6 @@ def check(root: pathlib.Path, found: list[str]) -> tuple[int, dict | None, list[
                         or (has_default and s.get("defaultStatus") != "open"):
                     errs.append(f"{where}: a table names exactly one of a non-empty "
                                 "`statusColumn` or `defaultStatus: \"open\"`")
-            ex = s.get("excludeIds")
-            if ex is not None and (not isinstance(ex, list) or not all(_nonempty(x) for x in ex)
-                                   or len(set(ex)) != len(ex)):
-                errs.append(f"{where}: `excludeIds` is a unique list of stable ids")
-            if "idPattern" in s and not ID_PATTERN.match(str(s.get("idPattern"))):
-                errs.append(f"{where}: `idPattern` {s.get('idPattern')!r} is not a literal "
-                            "prefix with an optional [0-9]+, anchored at both ends")
         key = json.dumps([path, s.get("heading", ""), s.get("idPattern", ""), fmt or "",
                           s.get("idColumn", ""), s.get("titleColumn", ""),
                           s.get("statusColumn", ""), s.get("excludeIds", [])])
@@ -142,8 +182,9 @@ def check(root: pathlib.Path, found: list[str]) -> tuple[int, dict | None, list[
                                              "excludeIds") if k in s})
         elif isinstance(path, str):
             context.append(path)
+    errs += _schema_errors(doc)
     if errs:
-        return 1, None, errs
+        return 1, None, list(dict.fromkeys(errs))
     declared = {t["path"] for t in tasks} | set(context)
     undeclared = sorted({f.strip().lstrip("./") for f in found if f.strip()} - declared)
     out = {"repository": doc["repository"], "tasks": tasks, "context": context,

package/plugins/task-pipeline/skills/task-pipeline/scripts/context_packets.py

@@ -192,9 +192,9 @@ def verify_parents(report, plan):
 
 
 LEAF_SCHEMA = "task-pipeline/execution-packet/1"
-# Fabric's content-addressed packet was also `execution-packet/1` until Fabric renamed its
-# format `session-handoff/1` (fabric-agent-contract R-01). The namespace keeps the two from
-# being read as each other. The bare id is still READ, until no live packet carries it:
+# The namespace separates this packet from other systems using `execution-packet/1`;
+# it does not depend on a claimed Fabric format rename or deployed version.
+# The bare id is still READ, until no live packet carries it:
 # 19 packets in one consumer repository did on 2026-10-12 (backlog B-135); refusing it
 # before they are migrated would break them.
 LEGACY_LEAF_SCHEMAS = ("execution-packet/1",)