task-pipeline-skill 1.93.3 → 1.95.0

package/CHANGELOG.md

@@ -1,3 +1,148 @@
+## v1.95.0 — 2026-10-13
+
+Source candidate; not published.
+
+Guards: 438 → **439**; property checks 15 → **15**.
+
+The default stage list keeps every full gate and routes each stage to its own
+procedure before work on entry or resume. Custom profiles keep their own stages
+and doctrine. The split preserves the original stage text and reduces the measured
+entry reading component; it does not claim a native-host or billed-token result.
+Scenario artifacts remain mandatory for user-facing work, while an equivalent
+provider or the documented inline fallback can supply them without installing a
+specific companion plugin. The new route refusal and relocated source checks keep
+these obligations addressable after the split.
+
+Checkpoint recovery now follows the selected project profile's declared stage order,
+including custom names and nonconsecutive ids. Malformed or changed profiles refuse
+instead of silently injecting default stages into a saved workflow. Run-local profile
+binding survives record/retry; relocated ledgers can name their project root explicitly.
+This is an offline-tested payload correction, not a live Observatory acceptance claim.
+
+Owner release preparation now records an unpublished local annotated tag before the
+complete suite, binds its exact source/context/evidence, and publishes only the
+verified annotation to one destination. The existing release hook recognizes
+explicit tag-destination refspecs. Mechanical evidence does not confer external
+authority, native interception or successful registry publication.
+
+Test runners use one safely opened family scratch lock across TMPDIR settings and
+owners, matching their shared fixed scratch paths. The lock now stays held while a
+plant's Bash or its synchronously writing child is alive, even if the runner itself is
+killed; an interrupted runner signals and drains its own process groups before it
+closes its copy, and on macOS a group of exited-but-unreaped members no longer aborts
+that cancellation. An interrupted run no longer leaves its repository snapshot in
+TMPDIR. Existing older runner versions, deliberately detached descendants and direct
+plant invocation remain outside that mechanism.
+
+The owner-gate helpers' seam headers declare `diverges: none` with their extraction
+scope on a separate line, so the umbrella's shared-copy check reads them as identical
+to the other members' copies.
+
+## v1.94.1 — 2026-10-13
+
+Records the missing retrospective declarations that stopped the v1.94.0 release
+before publication. The accepted release-iteration payload is unchanged; the
+version metadata advances so the failed tag remains immutable. Local-tag
+structural validation reads both declarations before another release attempt.
+
+## v1.94.0 — 2026-10-13
+
+Guards: 438 → **438**; property checks 15 → **15**. The owner validator and
+focused regression suites gain coverage; the counted negative-file corpus is unchanged.
+
+The accepted feature now also rejects loss of node identity or evidence during
+inventory synchronization. Waiting nodes retain typed wait IDs and watcher
+locators, cannot certify or close while waiting, and report the runnable frontier
+with distinct exit states. Release authority is recorded separately from a locator;
+source policies and scoped grants are carried into execution packets. Local regression
+and history checks cover these boundaries. Native Observatory/Fabric handoff
+execution remains unverified in this release receipt.
+
+**The release iteration — the loop around the waves** (`references/iteration.md`). The
+project moves in whole releases: survey, module dossiers integrated into one canvas,
+question rounds in batches, a parallel build, verification as each node lands, one release
+verified as released, the next pool handed back. A finding made mid-iteration joins the
+inventory; a closed hotfix lane of five entries is the only exception.
+
+- **Trigger.** "release iteration" / "итерация релиза" reaches the mode beside "waves" /
+  "волнами"; `/task-pipeline iteration` is listed in the command, and the Cursor rule's
+  wave paragraph names the loop.
+- **Risk classes R1–R3** on each node (`graph.schema.json` and `graph.py validate` accept
+  `risk`; any other value is refused). A round is the three blind tiers plus one fix cycle;
+  the first is always the full three; R1 owes one passing round, R2 two, R3 three, one of
+  them recorded adversarial. A wave's stage 7 integrates without tagging; the release's stage-7 gate and
+  stage 8's trio run once, at steps 10 and 11.
+- **Lessons across projects.** lesson/1 (`templates/lesson.schema.json`) and
+  `scripts/lessons.py`: a retro entry with a `**Lesson:**` line becomes a lesson in a local
+  index every install has (`~/.sshlg-skills/lessons/index.jsonl` where the family's directory
+  exists — hosted there as task-pipeline's by the family: sshlg-skills B-181 and its
+  `state-json.md` section *Other members' files under `~/.sshlg-skills/`* (#209);
+  `~/.task-pipeline/lessons/index.jsonl` otherwise, moved there once, aloud, if the family's
+  directory appears later; `$TASK_PIPELINE_LESSONS` or `--index` move it). Source 7b
+  of the harvest reads it by the task's nouns, then a shared store whose search filters by
+  kind. Writing to Observatory works today through `observatory_record`. The redaction list
+  binds every lesson; on the estate it relaxes rule 2 for the evidence commit and a
+  pseudonymous project key only.
+- **Wave tooling.** `scripts/waves.py` (merge, assign, count, validate, sync-graph) with
+  inventory/1 (`templates/inventory.schema.json`), and the canvas, question-queue, dossier
+  and backlog-sources templates. waves.md links the schemas instead of a field table and
+  no longer sends public readers to a private repository; the shipped
+  `backlog-sources.schema.json` is the rule, the Fabric contract its provenance.
+- **Continuity.** The loop is armed by `run.loop`, the preflight answer or a standing
+  instruction the host carries, cited as `loop: armed by <source>`; a watcher may merge,
+  release a lease, rebase or notify where a standing instruction names the act; waits that
+  outlive the session go on a durable trigger; at the compaction signal the next task is
+  written down, not started.
+- New suites in `npm test`: `lessons_test.py`, `waves_test.py`, `continuity_doc_test.py`;
+  eval INSTR-08 (wave 0).
+- **Rounds owed are enforced.** `graph.py close` refuses a node with a `risk` until its
+  class's rounds have passed — passing rounds, read from the certification history; a
+  failed round counts for nothing (R1 one, R2 two, R3 three, one of them a passing round
+  recorded with `certify --kind adversarial`); `certify` prints `round N: k of M owed passing
+  rounds — not closable yet`. certification.md
+  gains *Rounds owed by risk class*, and the churn doctrine exempts owed rounds from "a clean
+  round ends the loop".
+- `waves.py sync-graph` judges a re-cut as a whole, so a chain moved up a wave is never
+  refused halfway. `backlog_sources.py` refuses unknown keys and applies every source rule
+  to every source, and the shipped schema where `jsonschema` is installed.
+- `lessons.py emit-observatory` sends the commit as `commit:` + 12 hex (the store's redactor
+  keeps that form and removes a 40-hex SHA) and revises a recorded lesson instead of minting
+  a second; a git that does not answer in time is its own refusal.
+- `waves.py sync-graph` also writes each plan node's `risk` onto its work-graph node (a
+  `risk` revision; lowering a class needs `--lower-why`), so the rounds `close` enforces
+  apply to every planned node, not only to a hand-edited graph.
+- `lessons.py` reads stdin as UTF-8 and prints machine output as ASCII-escaped JSON, so a
+  non-UTF-8 locale loses nothing a lesson carries. `rebuild` reports unreadable sources
+  and preserves the prior index. A complete scan can replace a corrupt index after
+  keeping its backup (`python3 test/lessons_test.py`).
+- Every lessons-index operation runs under one lock (the index directory's `.lock`, plus the
+  standalone directory's on the default path). A file that cannot be READ is a refusal that
+  names it and writes nothing; one that cannot be PARSED — the family index or the
+  standalone one alike — is kept as `.corrupt-<date>` and never makes a command exit 1. Lines
+  in a newer index format are skipped, counted and kept on write. When both index files
+  exist they are merged once: only lessons the family index lacks are copied, its own copy
+  wins, newer-format lines are carried across, and the old file becomes `.migrated`.
+- `emit-observatory --tool observatory_lesson` emits the engine's lesson-kind arguments
+  (the lesson's own fields, plus `origin{projectId, commit}` — the engine's inputSchema); the agent
+  picks it where the session lists that tool, `observatory_record` otherwise.
+- `waves.py` refuses a plan whose risk, wave, closes or release value it does not know.
+- **Memory unavailable, said once per run.** `stage_checkpoint.py record --unavailable
+  "<why>" --for-run` appends one `unavailable for this run` line and leaves a marker in
+  `.task-pipeline/memory.json` keyed to the run's topic and start date (the module-map field
+  may change mid-run; a ledger with no `Run:` line is refused, exit 2); `hooks/memory-nudge.sh`
+  and `stage_checkpoint.py state` honour it only while that run's ledger still carries the
+  marker's own line — a ledger reseeded at stage 0, even the same day, does not — and any
+  later `record --answer` clears it. The first nudge of a run names the Observatory engine.
+- **Plain and npm installs deliver all three skills.** `./install.sh` and
+  `npx task-pipeline-skill` now install `task-pipeline`, `evidence-docs` and
+  `project-audit` into `~/.claude/skills/<name>`, plus the command; every source is
+  verified present before anything is copied. **`--force` now overwrites all three skill
+  directories and the command**, not the task-pipeline skill alone. The closing notice
+  names the role agents and every hook a plain copy cannot carry, and the plugin command.
+  **A partial earlier install is refused as mixed versions** (some of the three skills
+  present, others not), nothing written, until `--force` brings all three to one version.
+- Suite `test/install_test.sh` (both installers, fresh `HOME`) joins `npm test`.
+
 ## v1.93.3 — the wave-2 evidence declares its dead commits; a retried handoff stays one offer
 
 A re-certification reading of v1.93.2 and an independent observer found six things.

package/CONTRIBUTING.md

@@ -51,6 +51,38 @@ To try your change in a real agent:
 node bin/task-pipeline.js --force   # the same, through the npm installer
 ```
 
+## Owner release admission
+
+For this repository's release, the unpublished annotated candidate tag must exist
+locally on the accepted commit **before** the complete suite runs. A green untagged
+run is insufficient: inspect whether release-stamp checks actually looked.
+`pipeline.json` stage7 and standing instruction R-010 in `docs/evidence/retro.md`
+use this same order; R-004 requires the next operation to depend on gate success.
+
+In a standalone full clone of the owning source repository, use the owner-only
+`scripts/release_candidate.py`. Set `candidate_tag` to the chosen unpublished
+version and `actual_project_root` to the same-source project holding the real
+current run context. These are operator/run inputs, not generated approval:
+
+```bash
+python3 scripts/release_candidate.py prepare --tag "$candidate_tag" --context-root "$actual_project_root" &&
+python3 scripts/release_candidate.py check --tag "$candidate_tag" &&
+python3 scripts/release_candidate.py publish --tag "$candidate_tag"
+```
+
+`prepare` creates and binds the owned local annotation; `check` runs the fixed
+`npm run test:all` with that tag visible and retains its exact evidence.
+`publish` requires faithful bound context, the existing release hook, unchanged
+source/tag/evidence and the verified single destination/ref. The helper does not
+verify external authorization or create a ledger. Without faithful context,
+prepare/check remain usable and publication refuses. Never move a published tag;
+changed or ambiguous state requires read-only reconciliation before another action.
+
+Its PUBLISHED state confirms the tag's remote object and peel, not successful npm
+publication. Watch every release job and verify the published payload separately.
+The helper and private Git-directory receipts belong to the owner checkout and
+are not a plugin API or part of the installed skill.
+
 ## Repository layout
 
 | Path | What it is |

package/HOW-IT-WORKS.md

@@ -65,9 +65,10 @@ because it rots the moment the vendor ships a new one.
 
 **Companions.** `super-ux`, `copywriting`, `sheleg-design`, `graphify`, the wiki.
 The detection block prints once. A missing companion states its fallback and
-**does not block** — the single exception being the stage-3 UX track on
-user-facing work, where shipping without it is a decision someone has to make out
-loud.
+**does not block on installation**. For user-facing work, stage 3 requires a valid
+scenario artifact under the [provider rule](plugins/task-pipeline/skills/task-pipeline/references/companion-skills.md).
+Unavailable checks are named as NOT_RUN; a fallback is not evidence that a missing
+tool ran.
 
 ---
 

package/README.md

@@ -167,9 +167,9 @@ ledgers, so the link is the repository's rather than the package's.
 The doctrine each stage runs on ships inside the skill. Nothing to install for it,
 nothing to resolve at preflight, no version skew with someone else's repo, and
 **no stage blocks on an install** — stage 1 falls back to web search, the wiki and
-the code graph are recommendations. The one exception is deliberate and named: on a
-user-facing task the stage-3 UX track requires super-ux, and the spec gate stops
-until it is installed.
+the code graph are recommendations. On user-facing tasks the stage-3 UX gate
+requires a valid scenario artifact. The preferred provider, an equivalent provider
+and the inline fallback satisfy the same [provider contract](plugins/task-pipeline/skills/task-pipeline/references/companion-skills.md).
 
 | Stage | Built-in doctrine |
 |---|---|
@@ -201,7 +201,7 @@ until it is installed.
 | 6–10 + any check you write | [`gates.md`](plugins/task-pipeline/skills/task-pipeline/references/gates.md) — the three axes, the promotion ladder, gate anatomy, the probe recipe, ratchet floors |
 | any agent-time enforcement | [`hooks.md`](plugins/task-pipeline/skills/task-pipeline/references/hooks.md) — the `PreToolUse` contract, the fail-open hazard, the Claude-Code-only limit |
 | 7 · the tag | [`deploy-targets.md`](plugins/task-pipeline/skills/task-pipeline/references/deploy-targets.md) → *When the release waits for an approval* — `pipeline.json` → `release.approval`: `checks` (tag, watch the run selected by the tag, report) or `reviewers` (the direct link to the run that is `waiting`) |
-| between stages | [`continuity.md`](plugins/task-pipeline/skills/task-pipeline/references/continuity.md) Part 3 — workflow memory through Observatory, a planned handoff (`stage_checkpoint.py handoff` / `accept`), and `hooks/memory-nudge.sh`, which reminds once when a gate returned with no memory line after it |
+| between stages | [`continuity.md`](plugins/task-pipeline/skills/task-pipeline/references/continuity.md) Part 3 — workflow memory through Observatory, a planned handoff (`stage_checkpoint.py handoff` / `accept`), and `hooks/memory-nudge.sh`, which reminds once when a gate returned with no memory line after it — unless the run recorded memory unavailable with `--for-run` |
 
 **Ported, not depended on.** Stage 0 is adapted from
 [Matt Pocock's `grilling` / `grill-with-docs`](https://github.com/mattpocock/skills)
@@ -471,6 +471,26 @@ close pass verifies, runs one fix round, updates the docs, re-measures the inven
 and re-cuts what is left. The run takes the next wave without asking; a board too big
 for one release becomes a program, carried on the canvas, never dropped.
 
+**The project moves in releases, not fix by fix**
+([`iteration.md`](plugins/task-pipeline/skills/task-pipeline/references/iteration.md)).
+A finding joins the inventory; only a closed five-entry hotfix lane ships alone. Each
+iteration runs in this order:
+- the survey;
+- module dossiers written in parallel, laid onto one canvas until a pass changes nothing;
+- questions asked in rounds, never one at a time, while agents keep working;
+- a parallel build, each node checked the moment it lands: one round of three blind
+  readings for every node, and two or three passing rounds by its risk class (R2, R3 — one
+  of the three recorded adversarial);
+- one release, checked as released;
+- the next pool, handed to you grouped by module.
+
+Lessons carry over. Every install reads the project's retrospective, and keeps a local
+index of every project's lessons on the machine (`scripts/lessons.py`), which stage 0
+queries by the task's nouns. Where the session lists Project Observatory, agents also write
+their lessons there — that works today. Reading them back from the store needs an engine
+whose search filters by kind; until the session's engine has it, the ledger says
+`shared lessons: unfilterable` and only the local index is read.
+
 ### Loop guard — churn is detected, not endured
 
 Any repeating pass can start undoing the previous one: two shapes alternating, the
@@ -614,8 +634,8 @@ must say so.
 ### Held to Anthropic's own Skill authoring guidance
 
 Audited against the four Agent Skills pages. Most of it already held — `name`
-13/64 chars, `description` 890/1024 chars, `SKILL.md` 268/500 lines, all 40 references
-linked **directly** from `SKILL.md`, and the bundle far under the 30 MB ceiling. What
+13/64 chars, `description` 887/1024 chars, `SKILL.md` 272/500 lines, all 52 references
+reachable from `SKILL.md` through explicit reference routes, and the bundle far under the 30 MB ceiling. What
 did not, now does:
 
 - **Every reference over 100 lines carries a `## Contents` list**, and the list is
@@ -874,8 +894,8 @@ npx github:ssheleg/task-pipeline          # straight from GitHub
 npx task-pipeline-skill                   # from the npm registry
 ```
 (package is `task-pipeline-skill` — the unscoped `task-pipeline` name is taken
-on npm; installs the same skill + `/task-pipeline` command into `~/.claude`,
-idempotent, `--force` to overwrite)
+on npm; installs the same three skills + `/task-pipeline` command into `~/.claude` as
+the plain-skill path below, idempotent, `--force` to overwrite)
 
 **Moving the paperwork off the legacy directory name — optional, always:**
 ```bash
@@ -902,9 +922,21 @@ Rules. The rule is self-contained (no external links), so it works copied anywhe
 git clone https://github.com/ssheleg/task-pipeline
 cd task-pipeline && ./install.sh
 ```
-(copies the skill into `~/.claude/skills/task-pipeline` and the `/task-pipeline`
-command into `~/.claude/commands/`; idempotent — rerun skips existing installs,
-`./install.sh --force` overwrites)
+(copies the plugin's three skills — `task-pipeline`, `evidence-docs`, `project-audit` —
+into `~/.claude/skills/<name>` and the `/task-pipeline` command into
+`~/.claude/commands/`; idempotent — rerun skips existing installs, `./install.sh --force`
+overwrites. **What it cannot carry, and says so at the end of the run:** the role agents
+(`plugins/task-pipeline/agents/`, which then run on the main thread) and the hooks
+(`build-gate`, `gate-observer`, `memory-nudge`, `release-gate`, `run-lifecycle`, so the
+gates are held by the doctrine and the run ledger rather than by the harness). Both
+arrive only with the plugin above. Both installers refuse while the plugin is installed,
+because a plain copy would shadow it.)
+
+**Optional companion — Project Observatory.** Workflow checkpoints, planned handoffs
+between executors and the shared lesson store come from a separately installed public
+engine, [passioncode-ai/project-observatory-dashboard](https://github.com/passioncode-ai/project-observatory-dashboard)
+(its README: *Install*, *MCP*). Without it every one of those degrades to one ledger line
+and the run continues.
 
 ### Updating
 
@@ -929,8 +961,8 @@ the same Claude Code install yields a duplicate, shadowing skill.
 | Claude Code (plugin) | `claude plugin marketplace update task-pipeline` → `claude plugin update task-pipeline@task-pipeline` → restart |
 | Any agent (skills CLI) | `npx skills update task-pipeline --global --yes`; to add: repeated `--agent <name>` (never `claude-code` when the plugin is installed) |
 | Cursor | skills CLI (above) with `--agent cursor`, or re-copy the `.mdc` per project |
-| npm | `npx task-pipeline-skill@latest` / `npx github:ssheleg/task-pipeline` (ephemeral — always latest) |
-| Plain skill | `git pull && ./install.sh --force` |
+| npm | `npx task-pipeline-skill@latest --force` / `npx github:ssheleg/task-pipeline --force` — `--force` brings all three skills and the command to that version; without it an existing install is skipped, and a partial one is refused as mixed versions |
+| Plain skill | `git pull && ./install.sh --force` (all three skills and the command) |
 
 ### Prerequisites
 
@@ -939,7 +971,7 @@ skill. Four optional companions make individual stages better:
 
 | Companion | For | Required? |
 |---|---|---|
-| [super-ux](https://github.com/ssheleg/super-ux) | the stage-3 UX track | only for user-facing tasks |
+| [super-ux](https://github.com/ssheleg/super-ux) | the stage-3 UX track | preferred provider; valid scenario artifact required for user-facing tasks |
 | context7 (MCP) | stage-1 docs study | recommended — web-search fallback |
 | [obsidian-wiki](https://github.com/ar9av/obsidian-wiki) | stage-0 harvest + stage-9 sync | recommended — never a gate |
 | [graphify](https://github.com/Graphify-Labs/graphify) | stage-0 reach queries + stage-9 refresh + the graph↔docs divergence check | recommended — never a gate |
@@ -955,7 +987,18 @@ recommendation, so you arm the whole run in one exchange. Detail:
 | File | What's in it |
 |---|---|
 | [`SKILL.md`](plugins/task-pipeline/skills/task-pipeline/SKILL.md) | the orchestrator: how to run, the stage table, the model decision |
-| [`references/stages.md`](plugins/task-pipeline/skills/task-pipeline/references/stages.md) | per-stage detail and the exact gate criteria |
+| [`references/stages.md`](plugins/task-pipeline/skills/task-pipeline/references/stages.md) | complete gate criteria and exact per-stage detail routes |
+| [`references/stage-00-intake.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-00-intake.md) | stage 0 procedure, read on entry or resume |
+| [`references/stage-01-docs-study.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-01-docs-study.md) | stage 1 procedure, read on entry or resume |
+| [`references/stage-02-brainstorm.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-02-brainstorm.md) | stage 2 procedure, read on entry or resume |
+| [`references/stage-03-spec.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-03-spec.md) | stage 3 procedure, read on entry or resume |
+| [`references/stage-04-plan.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-04-plan.md) | stage 4 procedure, read on entry or resume |
+| [`references/stage-05-dev.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-05-dev.md) | stage 5 procedure, read on entry or resume |
+| [`references/stage-06-tests.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-06-tests.md) | stage 6 procedure, read on entry or resume |
+| [`references/stage-07-lint-deploy.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-07-lint-deploy.md) | stage 7 procedure, read on entry or resume |
+| [`references/stage-08-post-deploy.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-08-post-deploy.md) | stage 8 procedure, read on entry or resume |
+| [`references/stage-09-docs-wiki.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-09-docs-wiki.md) | stage 9 procedure, read on entry or resume |
+| [`references/stage-10-acceptance.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-10-acceptance.md) | stage 10 procedure, read on entry or resume |
 | [`references/doctrine-map.md`](plugins/task-pipeline/skills/task-pipeline/references/doctrine-map.md) | which reference owns which stage — the map SKILL.md used to carry inline |
 | [`references/artifacts.md`](plugins/task-pipeline/skills/task-pipeline/references/artifacts.md) | the canonical document layout each stage writes to |
 | [`references/conventions.md`](plugins/task-pipeline/skills/task-pipeline/references/conventions.md) | how stages 6–10 read the host project's `CLAUDE.md`, and how the documentation regime is detected |
@@ -970,6 +1013,7 @@ recommendation, so you arm the whole run in one exchange. Detail:
 | [`templates/`](plugins/task-pipeline/skills/task-pipeline/templates/README.md) | brief, carry-over ledger, `CONTEXT.md` and ADR skeletons, the doc map, both registers, the retro and its archive, the seeded `docgate.sh` and `hygiene.sh`, a worked hook |
 | [`references/adoption.md`](plugins/task-pipeline/skills/task-pipeline/references/adoption.md) | the first run in a project: greenfield seeding, and the brownfield walkthrough |
 | [`references/waves.md`](plugins/task-pipeline/skills/task-pipeline/references/waves.md) | wave mode: the whole board as one inventory, one canvas of the target state, one question batch, then waves that each close in one pass |
+| [`references/iteration.md`](plugins/task-pipeline/skills/task-pipeline/references/iteration.md) | release iteration: the loop around the waves — dossiers, integration until it converges, question rounds, checks as each node lands (R1–R3), one release checked as released, the next pool, the shared lesson store |
 | [`references/setup.md`](plugins/task-pipeline/skills/task-pipeline/references/setup.md) | the entry audit: seven passes over the docs a project already has, offered once, output as a fix plan |
 | [`references/portability.md`](plugins/task-pipeline/skills/task-pipeline/references/portability.md) | the manifest of workflow decisions and their homes in the bundle, and the boundary against a project's own answers |
 | [`references/learned.md`](plugins/task-pipeline/skills/task-pipeline/references/learned.md) | rules earned by failure on a real multi-repository build, each with its incident, its check and its exit criterion — the table is the count, and it grows |

package/SKILL-CARD.md

@@ -12,9 +12,9 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.93.3 |
+| **Version** | 1.95.0 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
-| **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki, and **one of two browser channels** — `playwright` (CLI or MCP) or `chrome-devtools` (MCP); either satisfies the browser step and neither is required. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
+| **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki, and **one of two browser channels** — `playwright` (CLI or MCP) or `chrome-devtools` (MCP); either satisfies the browser step and neither is required. Every stage's doctrine ships in-repo; user-facing stage 3 requires a valid scenario artifact; super-ux is preferred, with equivalent-provider and inline-fallback paths under the provider contract |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |
 
 ## Risk-tier disclosure

package/bin/task-pipeline.js

@@ -2,9 +2,11 @@
 /*
  * task-pipeline installer CLI.
  *
- * Installs the task-pipeline skill into ~/.claude/skills/task-pipeline and
- * the /task-pipeline slash command into ~/.claude/commands/ (same layout as
- * install.sh). Idempotent: existing installs are skipped unless --force.
+ * Installs the plugin's three skills (task-pipeline, evidence-docs,
+ * project-audit) into ~/.claude/skills/<name> and the /task-pipeline slash
+ * command into ~/.claude/commands/ (same layout as install.sh), and names the
+ * agents and hooks a plain copy cannot carry. Idempotent: existing installs are
+ * skipped unless --force.
  *
  * Zero dependencies, non-interactive. For other agents (Cursor, Codex, 70+)
  * use: npx skills add ssheleg/task-pipeline
@@ -22,8 +24,10 @@ function usage() {
   console.log(`task-pipeline installer
 
 Usage:
-  npx task-pipeline-skill [--force]   install skill + /task-pipeline command
-                                      into ~/.claude (skip existing unless --force)
+  npx task-pipeline-skill [--force]   install the three skills (task-pipeline,
+                                      evidence-docs, project-audit) + /task-pipeline
+                                      command into ~/.claude (skip existing unless
+                                      --force); agents and hooks need the plugin
   npx task-pipeline-skill --help
 
   npx task-pipeline-skill migrate-artifacts [--dry-run]
@@ -124,30 +128,38 @@ function installOne(label, src, dest, isDir, force) {
 /**
  * Say what this path does NOT install, and what runs instead.
  *
- * `agents/` is a Claude Code plugin capability; `install()` copies the skill directory
- * and the command and nothing else. That is the design — the brief chose plugin agents
- * with honest degradation — and it was silent, which is the part that is not. An
- * operator reading doctrine that names `task-pipeline:verifier` finds a name that
- * resolves to nothing and no explanation anywhere in what they ran.
+ * `agents/` and `hooks/` are Claude Code plugin capabilities; `main()` copies the three
+ * skills and the command and nothing else. That is the design — the brief chose plugin
+ * agents with honest degradation — and it was silent about the hooks, which is the part
+ * that was not. An operator reading doctrine that names `task-pipeline:verifier` or
+ * `hooks/memory-nudge.sh` would find a name that resolves to nothing. The notice lists
+ * the agents' count and every hook by name, says what runs instead, gives the plugin
+ * command, and points at the optional Observatory engine.
  */
 function discloseAgents() {
-  const dir = path.join(ROOT, 'plugins', 'task-pipeline', 'agents');
-  let files = [];
-  try {
-    files = fs.readdirSync(dir).filter((f) => f.endsWith('.md'));
-  } catch (e) {
-    return;               // no agents shipped: nothing to disclose
+  const base = path.join(ROOT, 'plugins', 'task-pipeline');
+  const list = (dir, ext) => {
+    try { return fs.readdirSync(path.join(base, dir)).filter((f) => f.endsWith(ext)).sort(); }
+    catch (e) { return []; }
+  };
+  const agents = list('agents', '.md');
+  const hooks = list('hooks', '.sh').map((f) => f.replace(/\.sh$/, ''));
+  if (!agents.length && !hooks.length) return;
+  const lines = ['', 'Not installed — Claude Code plugin capabilities a plain copy cannot carry:'];
+  if (agents.length) {
+    lines.push(`  - plugins/task-pipeline/agents/ (${agents.length} role agents): every role still runs, on the`,
+               '    main thread instead of in its own context — context and speed, not doctrine.');
   }
-  if (!files.length) return;
-  console.log(
-    `\nNot installed: plugins/task-pipeline/agents/ (${files.length} file(s)).\n` +
-    '  Role agents are a Claude Code plugin capability; this path installs the skill\n' +
-    '  and the command only. Every role still runs — on the main thread instead of in\n' +
-    '  its own context, which costs context and speed, not doctrine.\n' +
-    '  For the agent-backed version, install the plugin:\n' +
-    `    claude plugin marketplace add ${REPO}\n` +
-    '    claude plugin install task-pipeline@task-pipeline'
-  );
+  if (hooks.length) {
+    lines.push(`  - hooks: ${hooks.join(', ')}. Without them the gates`,
+               '    are checked by the doctrine and the run ledger, not by the harness.');
+  }
+  lines.push('  For both, install the plugin instead (then remove these plain copies):',
+             `    claude plugin marketplace add ${REPO}`,
+             '    claude plugin install task-pipeline@task-pipeline',
+             '  Optional companion for checkpoints, handoffs and shared lessons: Project Observatory,',
+             '    https://github.com/passioncode-ai/project-observatory-dashboard (README: Install, MCP).');
+  console.log(lines.join('\n'));
 }
 
 function offerRouters() {
@@ -244,9 +256,15 @@ function main(argv) {
     return 2;
   }
 
-  const skillSrc = path.join(ROOT, 'plugins/task-pipeline/skills/task-pipeline');
+  // All three skills the plugin ships: task-pipeline names evidence-docs as its doc
+  // doctrine and runs project-audit as wave 0's sidecar (CHANGELOG, Unreleased).
+  const SKILLS = ['task-pipeline', 'evidence-docs', 'project-audit'];
+  const skillSrcs = SKILLS.map((s) => path.join(ROOT, 'plugins/task-pipeline/skills', s));
   const cmdSrc = path.join(ROOT, 'plugins/task-pipeline/commands/task-pipeline.md');
-  for (const [p, what] of [[skillSrc, 'skill sources'], [cmdSrc, 'command source']]) {
+  // Every source is checked before anything is copied: a skill counts as present only
+  // with its SKILL.md, the same test install.sh makes.
+  for (const [p, what] of [...skillSrcs.map((p) => [path.join(p, 'SKILL.md'), 'skill sources']),
+                           [cmdSrc, 'command source']]) {
     if (!fs.existsSync(p)) {
       console.error(`error: ${what} missing at ${p} — corrupted package?`);
       return 1;
@@ -278,13 +296,26 @@ Rerun with --force if you deliberately want the plain copy instead.`);
     return 3;
   }
 
-  installOne(
-    'task-pipeline skill  ',
-    skillSrc,
-    path.join(claude, 'skills', 'task-pipeline'),
+  // Mixed versions: an earlier install left some of the three skills and not the others.
+  // Installing only the missing ones would pair skills from two releases — refuse, name both
+  // sets, and let --force bring all three to this version (install.sh does the same).
+  if (!force) {
+    const present = SKILLS.filter((s) => fs.existsSync(path.join(claude, 'skills', s)));
+    const absent = SKILLS.filter((s) => !present.includes(s));
+    if (present.length && absent.length) {
+      console.error(`refusing: mixed versions — ${present.join(', ')} already installed, ` +
+                    `${absent.join(', ')} not. Rerun with --force to install all three at this ` +
+                    'version. Nothing was written.');
+      return 4;
+    }
+  }
+  SKILLS.forEach((s, i) => installOne(
+    `${s} skill`.padEnd(22),
+    skillSrcs[i],
+    path.join(claude, 'skills', s),
     true,
     force
-  );
+  ));
   installOne(
     '/task-pipeline command',
     cmdSrc,

package/cursor/rules/task-pipeline.mdc

@@ -8,7 +8,7 @@ alwaysApply: false
 Self-contained rule (Cursor copies this file into projects — no external links).
 Run a substantial task through an up-front **intake grill + 10 gated stages**. No
 stage advances until its **gate** passes. Each gate is `auto` (verify it yourself,
-pass/fail) or `manual` (wait for the user's explicit go).
+pass/fail) or `manual` (the user's explicit go or specific standing authorization naming the act).
 
 **No companion skill is required.** Every rule below is the doctrine itself — the
 grill, the design gate, the plan format, the build loop and TDD. Nothing to
@@ -220,7 +220,12 @@ not authorize an outward, irreversible action — stage 7 stops and asks.
    in one pass (wave 1 the walking skeleton, exit criteria named first); stages 5–8
    run per wave with a close pass after each — verify, one fix round, docs,
    re-measure, re-cut — and 9–10 close the release. No wave builds a shape a later
-   wave undoes.
+   wave undoes. **Around the waves runs the release iteration** ("release iteration" /
+   "итерация релиза"): module dossiers integrated into one canvas, questions in batches,
+   each node verified as it lands in one to three rounds by its risk class (R1–R3), a
+   wave's stage 7 integrated without tagging, one release gated and verified as
+   released, the next pool handed back; a finding made mid-iteration joins the
+   inventory rather than being fixed alone.
 3. **Spec** (manual) — write and commit the design; lock every shared contract
    (types, schemas, signatures, file layout) plus a **Global Constraints** block of
    exact values every later task inherits. Self-review it for placeholders,
@@ -509,9 +514,9 @@ type the run produced, then run the documentation gate and print its ratchet cou
 
 **Axis A — the stage gate type.** `auto` = verify the check yourself and stop on
 fail; `judgment` = a named judge rules where no deterministic check exists, and the
-ruling is recorded as judgement, never as a measurement; `manual` = wait for an
-explicit operator go. Neither of the first two ever substitutes
-for a required manual approval.
+ruling is recorded as judgement, never as a measurement; `manual` = an explicit
+operator go or specific standing authorization naming this act. Cite its source and scope;
+otherwise wait. Neither an auto/judgment result nor a generic loop flag supplies authority.
 
 **Axis B — where the rule is actually enforced**, and a rule climbs this ladder
 rather than starting at the top: doctrine line → review question at a named gate →

package/evals/RESULTS.md

@@ -40,7 +40,7 @@ or it belongs in a check.
 
 | Metric | Value | Computed by | As of |
 |---|---|---|---|
-| Evals authored | 47 (three suites: task-pipeline 29, evidence-docs 9, project-audit 9) | `python3 evals/run.py` → `suite: N evals` | 2026-10-11 |
+| Evals authored | 48 (three suites: task-pipeline 30, evidence-docs 9, project-audit 9) | `python3 evals/run.py` → `suite: N evals` | 2026-10-12 |
 | Categories covered | 5 of 5, per suite | the suite's own `category` fields | 2026-08-31 |
 | Dated runs recorded | **4** | `python3 evals/run.py` → `recorded runs: N` | 2026-08-31 |
 | …of those, **blind** | **3** | run headings not marked `self-observed` | 2026-08-31 |

package/evals/task-pipeline.evals.json

@@ -295,6 +295,22 @@
       ],
       "why": "Four PRs of check work merged on a review app's `skipping` with nobody noticing. A requested reader and a reader that reported are different facts that look identical afterwards."
     },
+    {
+      "id": "INSTR-08",
+      "category": "instruction_following",
+      "skills": [
+        "task-pipeline"
+      ],
+      "query": "close the whole board in waves: here is a repo whose docs/evidence/backlog.md has 12 open rows; two of them were already shipped last month",
+      "expected_behavior": [
+        "Builds ONE inventory by id (inventory/1) from every source before any design, and runs `scripts/waves.py validate` on it, so no row lands nowhere",
+        "Verifies each row against the code first: the two shipped rows are closed in the board with the receipt that shows them done, not carried into a wave",
+        "Assigns modules, nodes and waves with `waves.py assign` from two short tables, not by hand, and shows the counts per wave",
+        "Asks the operator in batches (rounds) with a recommendation per question, never one question at a time; never 'shall I continue?' between waves",
+        "Gives each node its own risk class (R1-R3), and starts a node's verification when it lands rather than waiting for the wave"
+      ],
+      "why": "Wave mode had one trigger eval and no instruction case. An agent that reaches the mode but hand-edits the inventory, trusts stale rows or prompts between waves builds the intermediate states the mode exists to refuse."
+    },
     {
       "id": "NOTRIG-05",
       "category": "should_not_trigger",

package/package.json

@@ -1,13 +1,13 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.93.3",
+  "version": "1.95.0",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"
   },
   "scripts": {
-    "test": "python3 test/validate.py && python3 test/graph_test.py && python3 test/project_audit_test.py && python3 test/packet_schema_test.py && python3 test/browser_claims_test.py && python3 test/visual_gate_test.py && python3 test/stage_checkpoint_test.py && python3 test/backlog_sources_test.py && python3 test/release_approval_test.py && python3 test/memory_nudge_test.py && npm run test:audit-regressions",
-    "test:all": "python3 test/validate.py && python3 test/graph_test.py && python3 test/project_audit_test.py && python3 test/packet_schema_test.py && python3 test/browser_claims_test.py && python3 test/visual_gate_test.py && python3 test/stage_checkpoint_test.py && python3 test/backlog_sources_test.py && python3 test/release_approval_test.py && python3 test/memory_nudge_test.py && python3 test/negatives.py && npm run test:certify && npm run test:exposure && npm run test:probe && npm run test:anchors && npm run test:runner && npm run test:hooks && npm run test:artifacts && npm run test:docs && npm run test:audit-regressions",
+    "test": "python3 test/validate.py && python3 test/graph_test.py && python3 test/project_audit_test.py && python3 test/packet_schema_test.py && python3 test/browser_claims_test.py && python3 test/visual_gate_test.py && python3 test/stage_checkpoint_test.py && python3 test/backlog_sources_test.py && python3 test/release_approval_test.py && python3 test/memory_nudge_test.py && python3 test/lessons_test.py && python3 test/waves_test.py && python3 test/continuity_doc_test.py && bash test/install_test.sh && npm run test:audit-regressions",
+    "test:all": "python3 test/validate.py && python3 test/graph_test.py && python3 test/project_audit_test.py && python3 test/packet_schema_test.py && python3 test/browser_claims_test.py && python3 test/visual_gate_test.py && python3 test/stage_checkpoint_test.py && python3 test/backlog_sources_test.py && python3 test/release_approval_test.py && python3 test/memory_nudge_test.py && python3 test/lessons_test.py && python3 test/waves_test.py && python3 test/continuity_doc_test.py && bash test/install_test.sh && python3 test/negatives.py && npm run test:certify && npm run test:exposure && npm run test:probe && npm run test:anchors && npm run test:runner && npm run test:hooks && npm run test:artifacts && npm run test:docs && npm run test:audit-regressions",
     "test:negatives": "python3 test/negatives.py",
     "test:exposure": "python3 test/exposure_test.py",
     "test:probe": "python3 test/probe.py --self-test",

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/judgment/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs); a third, `waves`, takes the whole board and closes it in waves that each finish in one pass. Retro insights can publish upstream as issues, opt-in and redacted.",
-  "version": "1.93.3",
+  "version": "1.95.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"