task-pipeline-skill 1.94.1 → 1.95.0

package/CHANGELOG.md

@@ -1,3 +1,43 @@
+## v1.95.0 — 2026-10-13
+
+Source candidate; not published.
+
+Guards: 438 → **439**; property checks 15 → **15**.
+
+The default stage list keeps every full gate and routes each stage to its own
+procedure before work on entry or resume. Custom profiles keep their own stages
+and doctrine. The split preserves the original stage text and reduces the measured
+entry reading component; it does not claim a native-host or billed-token result.
+Scenario artifacts remain mandatory for user-facing work, while an equivalent
+provider or the documented inline fallback can supply them without installing a
+specific companion plugin. The new route refusal and relocated source checks keep
+these obligations addressable after the split.
+
+Checkpoint recovery now follows the selected project profile's declared stage order,
+including custom names and nonconsecutive ids. Malformed or changed profiles refuse
+instead of silently injecting default stages into a saved workflow. Run-local profile
+binding survives record/retry; relocated ledgers can name their project root explicitly.
+This is an offline-tested payload correction, not a live Observatory acceptance claim.
+
+Owner release preparation now records an unpublished local annotated tag before the
+complete suite, binds its exact source/context/evidence, and publishes only the
+verified annotation to one destination. The existing release hook recognizes
+explicit tag-destination refspecs. Mechanical evidence does not confer external
+authority, native interception or successful registry publication.
+
+Test runners use one safely opened family scratch lock across TMPDIR settings and
+owners, matching their shared fixed scratch paths. The lock now stays held while a
+plant's Bash or its synchronously writing child is alive, even if the runner itself is
+killed; an interrupted runner signals and drains its own process groups before it
+closes its copy, and on macOS a group of exited-but-unreaped members no longer aborts
+that cancellation. An interrupted run no longer leaves its repository snapshot in
+TMPDIR. Existing older runner versions, deliberately detached descendants and direct
+plant invocation remain outside that mechanism.
+
+The owner-gate helpers' seam headers declare `diverges: none` with their extraction
+scope on a separate line, so the umbrella's shared-copy check reads them as identical
+to the other members' copies.
+
 ## v1.94.1 — 2026-10-13
 
 Records the missing retrospective declarations that stopped the v1.94.0 release

package/CONTRIBUTING.md

@@ -51,6 +51,38 @@ To try your change in a real agent:
 node bin/task-pipeline.js --force   # the same, through the npm installer
 ```
 
+## Owner release admission
+
+For this repository's release, the unpublished annotated candidate tag must exist
+locally on the accepted commit **before** the complete suite runs. A green untagged
+run is insufficient: inspect whether release-stamp checks actually looked.
+`pipeline.json` stage7 and standing instruction R-010 in `docs/evidence/retro.md`
+use this same order; R-004 requires the next operation to depend on gate success.
+
+In a standalone full clone of the owning source repository, use the owner-only
+`scripts/release_candidate.py`. Set `candidate_tag` to the chosen unpublished
+version and `actual_project_root` to the same-source project holding the real
+current run context. These are operator/run inputs, not generated approval:
+
+```bash
+python3 scripts/release_candidate.py prepare --tag "$candidate_tag" --context-root "$actual_project_root" &&
+python3 scripts/release_candidate.py check --tag "$candidate_tag" &&
+python3 scripts/release_candidate.py publish --tag "$candidate_tag"
+```
+
+`prepare` creates and binds the owned local annotation; `check` runs the fixed
+`npm run test:all` with that tag visible and retains its exact evidence.
+`publish` requires faithful bound context, the existing release hook, unchanged
+source/tag/evidence and the verified single destination/ref. The helper does not
+verify external authorization or create a ledger. Without faithful context,
+prepare/check remain usable and publication refuses. Never move a published tag;
+changed or ambiguous state requires read-only reconciliation before another action.
+
+Its PUBLISHED state confirms the tag's remote object and peel, not successful npm
+publication. Watch every release job and verify the published payload separately.
+The helper and private Git-directory receipts belong to the owner checkout and
+are not a plugin API or part of the installed skill.
+
 ## Repository layout
 
 | Path | What it is |

package/HOW-IT-WORKS.md

@@ -65,9 +65,10 @@ because it rots the moment the vendor ships a new one.
 
 **Companions.** `super-ux`, `copywriting`, `sheleg-design`, `graphify`, the wiki.
 The detection block prints once. A missing companion states its fallback and
-**does not block** — the single exception being the stage-3 UX track on
-user-facing work, where shipping without it is a decision someone has to make out
-loud.
+**does not block on installation**. For user-facing work, stage 3 requires a valid
+scenario artifact under the [provider rule](plugins/task-pipeline/skills/task-pipeline/references/companion-skills.md).
+Unavailable checks are named as NOT_RUN; a fallback is not evidence that a missing
+tool ran.
 
 ---
 

package/README.md

@@ -167,9 +167,9 @@ ledgers, so the link is the repository's rather than the package's.
 The doctrine each stage runs on ships inside the skill. Nothing to install for it,
 nothing to resolve at preflight, no version skew with someone else's repo, and
 **no stage blocks on an install** — stage 1 falls back to web search, the wiki and
-the code graph are recommendations. The one exception is deliberate and named: on a
-user-facing task the stage-3 UX track requires super-ux, and the spec gate stops
-until it is installed.
+the code graph are recommendations. On user-facing tasks the stage-3 UX gate
+requires a valid scenario artifact. The preferred provider, an equivalent provider
+and the inline fallback satisfy the same [provider contract](plugins/task-pipeline/skills/task-pipeline/references/companion-skills.md).
 
 | Stage | Built-in doctrine |
 |---|---|
@@ -634,8 +634,8 @@ must say so.
 ### Held to Anthropic's own Skill authoring guidance
 
 Audited against the four Agent Skills pages. Most of it already held — `name`
-13/64 chars, `description` 887/1024 chars, `SKILL.md` 270/500 lines, all 41 references
-linked **directly** from `SKILL.md`, and the bundle far under the 30 MB ceiling. What
+13/64 chars, `description` 887/1024 chars, `SKILL.md` 272/500 lines, all 52 references
+reachable from `SKILL.md` through explicit reference routes, and the bundle far under the 30 MB ceiling. What
 did not, now does:
 
 - **Every reference over 100 lines carries a `## Contents` list**, and the list is
@@ -971,7 +971,7 @@ skill. Four optional companions make individual stages better:
 
 | Companion | For | Required? |
 |---|---|---|
-| [super-ux](https://github.com/ssheleg/super-ux) | the stage-3 UX track | only for user-facing tasks |
+| [super-ux](https://github.com/ssheleg/super-ux) | the stage-3 UX track | preferred provider; valid scenario artifact required for user-facing tasks |
 | context7 (MCP) | stage-1 docs study | recommended — web-search fallback |
 | [obsidian-wiki](https://github.com/ar9av/obsidian-wiki) | stage-0 harvest + stage-9 sync | recommended — never a gate |
 | [graphify](https://github.com/Graphify-Labs/graphify) | stage-0 reach queries + stage-9 refresh + the graph↔docs divergence check | recommended — never a gate |
@@ -987,7 +987,18 @@ recommendation, so you arm the whole run in one exchange. Detail:
 | File | What's in it |
 |---|---|
 | [`SKILL.md`](plugins/task-pipeline/skills/task-pipeline/SKILL.md) | the orchestrator: how to run, the stage table, the model decision |
-| [`references/stages.md`](plugins/task-pipeline/skills/task-pipeline/references/stages.md) | per-stage detail and the exact gate criteria |
+| [`references/stages.md`](plugins/task-pipeline/skills/task-pipeline/references/stages.md) | complete gate criteria and exact per-stage detail routes |
+| [`references/stage-00-intake.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-00-intake.md) | stage 0 procedure, read on entry or resume |
+| [`references/stage-01-docs-study.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-01-docs-study.md) | stage 1 procedure, read on entry or resume |
+| [`references/stage-02-brainstorm.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-02-brainstorm.md) | stage 2 procedure, read on entry or resume |
+| [`references/stage-03-spec.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-03-spec.md) | stage 3 procedure, read on entry or resume |
+| [`references/stage-04-plan.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-04-plan.md) | stage 4 procedure, read on entry or resume |
+| [`references/stage-05-dev.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-05-dev.md) | stage 5 procedure, read on entry or resume |
+| [`references/stage-06-tests.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-06-tests.md) | stage 6 procedure, read on entry or resume |
+| [`references/stage-07-lint-deploy.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-07-lint-deploy.md) | stage 7 procedure, read on entry or resume |
+| [`references/stage-08-post-deploy.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-08-post-deploy.md) | stage 8 procedure, read on entry or resume |
+| [`references/stage-09-docs-wiki.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-09-docs-wiki.md) | stage 9 procedure, read on entry or resume |
+| [`references/stage-10-acceptance.md`](plugins/task-pipeline/skills/task-pipeline/references/stage-10-acceptance.md) | stage 10 procedure, read on entry or resume |
 | [`references/doctrine-map.md`](plugins/task-pipeline/skills/task-pipeline/references/doctrine-map.md) | which reference owns which stage — the map SKILL.md used to carry inline |
 | [`references/artifacts.md`](plugins/task-pipeline/skills/task-pipeline/references/artifacts.md) | the canonical document layout each stage writes to |
 | [`references/conventions.md`](plugins/task-pipeline/skills/task-pipeline/references/conventions.md) | how stages 6–10 read the host project's `CLAUDE.md`, and how the documentation regime is detected |

package/SKILL-CARD.md

@@ -12,9 +12,9 @@ harmless.
 |---|---|
 | **Purpose** | Runs a substantial task through ten gated delivery stages — intake grill, docs study, brainstorm, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs+registers, acceptance — refusing to advance until each gate passes |
 | **Owner** | ssheleg ([github.com/ssheleg/task-pipeline](https://github.com/ssheleg/task-pipeline)) |
-| **Version** | 1.94.1 |
+| **Version** | 1.95.0 |
 | **Surface** | Claude Code (filesystem skill + plugin) and the vercel `skills` CLI. **Not** uploaded to the Skills API; custom Skills do not sync across surfaces |
-| **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki, and **one of two browser channels** — `playwright` (CLI or MCP) or `chrome-devtools` (MCP); either satisfies the browser step and neither is required. Every stage's doctrine ships in-repo; the one conditional requirement is super-ux for the stage-3 UX track on a user-facing task |
+| **Dependencies** | None required. Optional: `context7` (MCP), `figma` (MCP), super-ux, agent-sync, graphify, obsidian-wiki, and **one of two browser channels** — `playwright` (CLI or MCP) or `chrome-devtools` (MCP); either satisfies the browser step and neither is required. Every stage's doctrine ships in-repo; user-facing stage 3 requires a valid scenario artifact; super-ux is preferred, with equivalent-provider and inline-fallback paths under the provider contract |
 | **Evaluation status** | Suite authored, 5 categories. One recorded run, **self-observed by the author**; **zero blind runs on zero of three models** — the split, and the numbers, live in [`evals/RESULTS.md`](evals/RESULTS.md) and are computed by `evals/run.py` |
 
 ## Risk-tier disclosure

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.94.1",
+  "version": "1.95.0",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/judgment/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs); a third, `waves`, takes the whole board and closes it in waves that each finish in one pass. Retro insights can publish upstream as issues, opt-in and redacted.",
-  "version": "1.94.1",
+  "version": "1.95.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/agents/verifier.md

@@ -111,6 +111,6 @@ ledger exists to catch.
 
 ## Where the doctrine is
 
-`references/stages.md` → stage 8 for what verification means here;
+`references/stage-08-post-deploy.md` for what verification means here;
 `references/verification.md` for the ledger your evidence lands in;
 `references/gates.md` for what a gate's exit code obliges.

package/plugins/task-pipeline/commands/task-pipeline.md

@@ -35,8 +35,9 @@ naming the standard is one an operator can call out for missing it.
 - **Model.** Recommend the most capable one the environment offers, never a hardcoded
   id. Confirmed once, then the whole run uses it without re-asking.
 - **Companions.** Print the detection block once (`references/companion-skills.md`).
-  Absent ones state their fallback; none is a gate except the stage-3 UX track on a
-  user-facing task.
+  Absent ones state their fallback and name any unavailable check as NOT_RUN.
+  On user-facing tasks stage 3 gates the valid scenario artifact, not package
+  presence; use the provider rule in that reference.
 
 ## Stage 0 — the harvest, then the grill
 

package/plugins/task-pipeline/hooks/release-gate.sh

@@ -118,7 +118,7 @@ def outward(tokens):
                 if sub == "push":
                     if any(a in ("--tags", "--follow-tags") for a in args):
                         return "git push --tags"
-                    if any(a.startswith("refs/tags/") or re.fullmatch(r"v?\d+\.\d+\.\d+.*", a) for a in args):
+                    if any(a.startswith("refs/tags/") or a.partition(":")[2].startswith("refs/tags/") or re.fullmatch(r"v?\d+\.\d+\.\d+.*", a) for a in args):
                         return "git push <tag>"
         if t.endswith("gh") and rest[:2] == ["release", "create"]:
             return "gh release create"

package/plugins/task-pipeline/skills/task-pipeline/SKILL.md

@@ -59,9 +59,9 @@ the environment resolves.
 plugin, nothing to resolve at preflight and no version skew with someone else's
 repo. Stages 1 and 6–9 additionally run the *host's own* commands and optional
 tools, and **no stage blocks on an install** — stage 1 falls back to web search, the
-wiki and the code graph are recommendations. The **one** exception is deliberate and
-named: on a user-facing task the stage-3 UX track requires super-ux, and the spec
-gate stops until it is installed.
+wiki and the code graph are recommendations. On user-facing tasks stage 3 requires
+a valid scenario artifact; the provider rule below governs equivalent providers
+and the inline fallback.
 
 Which reference owns which stage — all forty-odd of them, by stage number:
 [`references/doctrine-map.md`](./references/doctrine-map.md).
@@ -153,12 +153,12 @@ before drawing, never invented by the drawing agent).
    autonomy sweep is covered, **the REQ table is
    written (one row per independently verifiable deliverable, each naming its
    check)** and the brief is locked
-   (`references/stages.md` → 0). Do not touch stage 1 before the brief is
+   (`references/stage-00-intake.md`). Do not touch stage 1 before the brief is
    committed and confirmed. **Entered from super-ux?**
    (a validated `docs/ux/` chain and/or a `docs/ux/plans/…` fix plan already
    exists — super-ux's `/ux` hands off here) → don't re-grill or rebuild the UX
    chain: just check it's OK (`/ux-lint` green), confirm scope in one line, and
-   skip ahead to the first stage with real work (see `references/stages.md` → 0).
+   skip ahead to the first stage with real work (see `references/stage-00-intake.md`).
 3. Walk stages 1→10 on the model confirmed at preflight. **Don't re-ask about the
    model at every boundary** — only when the operator recorded a per-stage override
    map and the next stage's entry differs (`references/model-tiering.md`).
@@ -193,7 +193,7 @@ before drawing, never invented by the drawing agent).
    unaccounted (`references/residue.md`). The rest are in
    [`references/gates.md`](references/gates.md) → *Cross-cutting, at every stage*.
 
-## Stages (detail in `references/stages.md`)
+## Stages (gates and routes in `references/stages.md`)
 
 All stages run on the **one model confirmed at preflight** (default: the most
 capable available — see `references/model-tiering.md`).
@@ -213,9 +213,11 @@ capable available — see `references/model-tiering.md`).
 | 10 | **Acceptance** | the ladder walk ran and its absences became REQ rows; every REQ accounted for with evidence from a check seen failing once; no unresolved ledger row; **every repository clean, pushed and pointed at**; the hand-back written and the environment given back; the retrospective written **last**, and in order | manual |
 
 **Every gate above is the short form**, and the long form is the point of
-[`references/stages.md`](references/stages.md) — one section per stage. What the
-ladder walk is, which eight environment classes stage 10 enumerates, what makes an
-edge fake, why a `200` is not a working page: all there, none here.
+[`references/stages.md`](references/stages.md) — one gate and exact detail route per
+default stage. Before work on entry or resume, read that stage’s routed detail,
+including waves and approved short paths; never preload all details. CUSTOM
+profiles use their own declared doctrine; matching numeric ids do not select
+default details. Full obligations stay in the spine and the selected detail.
 
 **Several repositories?** A submodule is finished when its parent says so — a clone
 can still get the commit before it while neither repository looks wrong alone. The

package/plugins/task-pipeline/skills/task-pipeline/references/artifacts.md

@@ -201,7 +201,7 @@ plugins/task-pipeline/
       audit.md                                #   cross-cutting: the ladder + seams
       loop-guard.md                           #   cross-cutting: churn detection
       progress.md                             #   cross-cutting: what the run prints about itself
-      stages.md model-tiering.md              #   gates, model policy
+      stages.md stage-*.md model-tiering.md   #   gates, per-stage detail, model policy
       conventions.md artifacts.md             #   host conventions, this layout
       companion-skills.md                     #   optional companions + preflight
     templates/                                # skeletons seeded into a host project

package/plugins/task-pipeline/skills/task-pipeline/references/brainstorm.md

@@ -146,7 +146,7 @@ is either covered now or explicitly dropped by the operator, with the drop writt
 into the carry-over ledger. For a platform, the module map
 ([`decomposition.md`](decomposition.md)) is committed and approved as part of this
 same gate. Two more criteria close it, and the gate of record —
-[`stages.md`](stages.md) → *2 — Brainstorm + decompose* — states both in full:
+[`stage-02-brainstorm.md`](stage-02-brainstorm.md) → *2 — Brainstorm + decompose* — states both in full:
 **the queue is an artifact rather than a recollection** (where it is a work graph,
 `graph.py validate` exits 0 and `graph.py coverage` names any requirement no node
 serves), and **the loop's arming state is printed** — armed with its queue and

package/plugins/task-pipeline/skills/task-pipeline/references/browser.md

@@ -169,7 +169,7 @@ having read no pixels at all. The **functional look** and the **visual half** ar
 checks; neither discharges the other.
 
 **When it runs, and when it gates — by the brief's `surface_class`**
-([`stages.md`](stages.md) → stage 0, *The surface class*):
+([`stage-00-intake.md`](stage-00-intake.md) → *0 — Intake grill — MANDATORY*, the surface-class bullet):
 
 | Class | Visual half at stages 5–6 | Human pass at stage 10 |
 |---|---|---|

package/plugins/task-pipeline/skills/task-pipeline/references/certification.md

@@ -84,7 +84,7 @@ tier saw.
 | `visual` | the contact sheet, the director record, the project linter's output, the rubric | a frame that contradicts the record's intent; a gate item failing under a PASS; a hole in the state × axes matrix; a judge verdict from an uncalibrated judge |
 
 **When it runs.** A node that builds a user-facing surface copies the brief's
-`surface_class` ([`stages.md`](stages.md) → stage 0, *The surface class*). On
+`surface_class` ([`stage-00-intake.md`](stage-00-intake.md) → *0 — Intake grill — MANDATORY*, the surface-class bullet). On
 **`flagship` and `product`** the `visual` report is **required** — `graph.py certify`
 refuses the round without it and names the tier. On `internal` and `ad` it is accepted
 when given and counted like any other tier, and not demanded: an internal tool's floor

package/plugins/task-pipeline/skills/task-pipeline/references/companion-skills.md

@@ -287,7 +287,8 @@ Rules:
   nothing: **one self-observed run by the author, zero blind runs on zero models**, with
   a preflight that reported companion availability in detail and its own confidence not
   at all. A skill silent about its own evidence is read as tested.
-- **Never gate any stage on an install** except the stage-3 UX track on a UI task.
+- **Never gate any stage on an install.** On UI tasks the stage-3 gate requires the
+  valid scenario artifact under the provider rule above, not a package.
 - Optional tools missing → state the fallback, don't block.
 - Re-detect after the operator installs; don't assume.
 - The model answer goes into the brief. Don't ask again per stage
@@ -342,5 +343,5 @@ Both notices live in the repo `LICENSE` → *Third-party*.
 ## Hand-off the other direction
 
 super-ux's `/ux` menu can hand off *to* this pipeline (its "execute autonomously"
-action). When entered that way the UX chain already exists — see `stages.md` → 0
+action). When entered that way the UX chain already exists — see `stage-00-intake.md`
 *Entry-from-super-ux short-circuit*: verify, don't rebuild.

package/plugins/task-pipeline/skills/task-pipeline/references/continuity.md

@@ -397,7 +397,9 @@ Project Observatory's memory tools, **every gate that returns also writes a work
 checkpoint**, and the next executor continues from the last finished stage.
 
 - **When.** After the `stage:` line is appended, every time a gate returns, whatever the verdict. A failed gate's checkpoint says `blocked` and keeps the stage open. Acceptance closes the workflow.
-- **How.** `scripts/stage_checkpoint.py emit` prints the tool's arguments, built from the ledger alone: the topic, the verdicts, the next stage, the operator's constraints and key names. Pass them to `observatory_checkpoint_write`, or to `memory.checkpoint.write` under memory/0.1. Then hand the answer to `stage_checkpoint.py record --answer -`.
+- **How.** `scripts/stage_checkpoint.py emit` prints the tool's arguments, built from the ledger and selected project profile: the topic, observed verdicts, next declared stage, operator's constraints and key names. Pass them to `observatory_checkpoint_write`, or to `memory.checkpoint.write` under memory/0.1. Then hand the answer to `stage_checkpoint.py record --answer -`.
+- **Profile authority.** `pipeline.json` at the project root owns stage order; only genuinely absent config selects the bundled default. Unreadable/malformed config, ambiguous numeric ledger ids, unsupported mandatory capabilities or a ledger stage outside the selected profile refuse before producing tool arguments. Optional ids use array ordinals, optional names use stable state labels; explicit ids retain declared array order. This reader does not execute gates or replace full preflight/schema validation. A final skipped stage stays open for confirmation, never inventing a successor or closing by inference.
+- **Root and recovery.** The usual ledger stays `.task-pipeline/run.md`; `paths.artifacts` relocates project documents, not this run state. For a relocated ledger use `emit --ledger <path> --project-root <project>` (an enclosing Git root can also establish the project). The first emit saves the selected profile's source/digest and run identity beside the ledger; record retains them. Same-run profile changes, a missing formerly selected config, or a different run reusing that state refuse. Restore the selected source and retry, or reconcile the old workflow and start a distinct ledger/state for the new run; never delete a lease to make the check green. A pre-existing custom workflow with no profile binding also needs reconciliation. Ledger file symlinks and state-file links refuse without migration or overwrite; accepted directory aliases resolve consistently for emit, record, state and handoff. Profile, ledger and existing state inputs must be regular files, so a FIFO is refused before reading. No live checkpoint or read-attestation is proved by a locally emitted payload.
 - **The constraints.** Give the brief's restrictive rules once, as `--constraint`. They are carried to every later boundary, and a successor reads them first.
 - **Keys.** Pass keys by name, as `--credential PROJECT/ENV/NAME`, never as a value.
 - **Without the tools.** `stage_checkpoint.py record --unavailable "<why>"` appends one `event: memory — unavailable` line, and the run continues exactly as before. Missing memory is a state the ledger names, not a failure. When the tools are absent for the whole run — no Observatory on this machine — say it **once**: `record --unavailable "<why>" --for-run` appends one `unavailable for this run` line and leaves a marker in `.task-pipeline/memory.json`; no later gate is nudged or needs a line. Any later `record --answer` (the tools came back) clears the marker.

package/plugins/task-pipeline/skills/task-pipeline/references/doctrine-map.md

@@ -6,8 +6,9 @@ built-in doctrine lives, so an agent loads the one file the stage needs instead
 carrying the whole index in every turn.
 
 The rule the table serves stays in `SKILL.md`: every stage's doctrine ships inside this
-skill, no stage blocks on an install, and the single deliberate exception is the stage-3
-UX track on a user-facing task.
+skill and no stage blocks on an install. The stage-3 UX gate on a user-facing task
+requires a valid scenario artifact; [the provider rule](companion-skills.md) governs
+the preferred provider, equivalent providers and inline fallback.
 
 ## Contents
 
@@ -15,8 +16,24 @@ UX track on a user-facing task.
 
 ## Which reference owns which stage
 
+For the default profile, `references/stages.md` owns the full gates and exact
+on-entry/resume route to each `references/stage-*.md` detail. Read the selected
+stage detail before its work; this table routes additional subject doctrine.
+Custom profiles use their own declared stages and doctrine, with the kernel intact.
+
 | Stage | Built-in doctrine |
 |---|---|
+| 0 · Stage procedure | `references/stage-00-intake.md` |
+| 1 · Stage procedure | `references/stage-01-docs-study.md` |
+| 2 · Stage procedure | `references/stage-02-brainstorm.md` |
+| 3 · Stage procedure | `references/stage-03-spec.md` |
+| 4 · Stage procedure | `references/stage-04-plan.md` |
+| 5 · Stage procedure | `references/stage-05-dev.md` |
+| 6 · Stage procedure | `references/stage-06-tests.md` |
+| 7 · Stage procedure | `references/stage-07-lint-deploy.md` |
+| 8 · Stage procedure | `references/stage-08-post-deploy.md` |
+| 9 · Stage procedure | `references/stage-09-docs-wiki.md` |
+| 10 · Stage procedure | `references/stage-10-acceptance.md` |
 | 0, 9 · The documentation system | `references/documentation.md` |
 | any stage · The canons, and where each is enforced | [`evidence-docs`](../../evidence-docs/SKILL.md) — the sibling skill in this plugin |
 | 6–10 · Gates | `references/gates.md` |

package/plugins/task-pipeline/skills/task-pipeline/references/grill.md

@@ -179,7 +179,7 @@ explicit "stop and ask me here":
 | 0 Docs regime | where settled things live (the decision home — **one** per project, and an existing `docs/adr/` **is** it), who may write it, whether a lease mechanism is present or the run is `ungated`, the gate command and its ratchet floors, and whether this run may raise a floor ([`documentation.md`](documentation.md)) |
 | 1 Docs | external libs/APIs/SDKs in play; any private ones context7 can't resolve → where their docs live |
 | 2 Decompose | is this a platform (several capabilities/surfaces) or one module? if platform: deploy cadence — per module or once at the end |
-| 2–3 Spec | UI verdict (arms super-ux) **and the surface class** — `flagship`, `product`, `internal` or `ad`, which selects the visual gate profile ([`stages.md`](stages.md) → stage 0, *The surface class*); any scenario-tracing waiver |
+| 2–3 Spec | UI verdict (arms super-ux) **and the surface class** — `flagship`, `product`, `internal` or `ad`, which selects the visual gate profile ([`stage-00-intake.md`](stage-00-intake.md) → *0 — Intake grill — MANDATORY*, the surface-class bullet); any scenario-tracing waiver |
 | 3 Design surface | UI tasks only: **Figma on or text-only** (super-ux's project-level choice, default on — check `docs/ux/foundation.md` → *Design tooling* before asking); is the Figma MCP connected; **and if it isn't — ship text-only, or stop here and connect it?** super-ux degrades to text-only on its own and never blocks, which means an unasked question here silently ships a UI feature with no mockups |
 | 3 Design file | Figma on only: **exactly which files — one per surface (App, Web, ASO) — in which team/org** — the recorded ones, or a URL the operator gives, or *create one in a named team* with that creation explicitly authorized. A destination decided at drawing time is how a project ends up with three "design" files and no way to tell which is real. See *The design destination* below |
 | 4–5 Dev | base branch; worktree/branch policy; is `main` off-limits; commit convention; task tracker |

package/plugins/task-pipeline/skills/task-pipeline/references/portability.md

@@ -39,8 +39,19 @@ a row pointing outside the bundle is the defect this file exists to catch.
 
 | Workflow decision | Home |
 |---|---|
+| 0 · Stage procedure | `references/stage-00-intake.md` |
+| 1 · Stage procedure | `references/stage-01-docs-study.md` |
+| 2 · Stage procedure | `references/stage-02-brainstorm.md` |
+| 3 · Stage procedure | `references/stage-03-spec.md` |
+| 4 · Stage procedure | `references/stage-04-plan.md` |
+| 5 · Stage procedure | `references/stage-05-dev.md` |
+| 6 · Stage procedure | `references/stage-06-tests.md` |
+| 7 · Stage procedure | `references/stage-07-lint-deploy.md` |
+| 8 · Stage procedure | `references/stage-08-post-deploy.md` |
+| 9 · Stage procedure | `references/stage-09-docs-wiki.md` |
+| 10 · Stage procedure | `references/stage-10-acceptance.md` |
 | The stage list, ids, names, gate types | `pipeline.example.json` |
-| Per-stage criteria, freedom levels, the run checklist | `references/stages.md` |
+| Full gates, freedom levels, the run checklist and exact stage-detail routes | `references/stages.md` |
 | Which reference owns which stage (the doctrine map) | `references/doctrine-map.md` |
 | What the intake grill asks, and the autonomy sweep | `references/grill.md` |
 | **The escalation boundary** — what an agent may settle alone | `references/grill.md` |

package/plugins/task-pipeline/skills/task-pipeline/references/spec.md

@@ -28,9 +28,12 @@ spec*.
 
 ## UX track (user-facing tasks only)
 
-Runs on **super-ux** — the one companion this pipeline recommends by name
-([`companion-skills.md`](companion-skills.md)). If it isn't installed on a UI task,
-give the install line and stop; don't improvise a half-chain.
+Apply [the artifact-provider contract](companion-skills.md): super-ux is the
+preferred provider; equivalent artifacts or the inline fallback remain valid.
+Missing or invalid scenario artifacts stop the gate, regardless of provider.
+Record each unavailable check by name as NOT_RUN; do not claim a linter ran.
+The following chain describes the super-ux provider when available. Other
+providers owe the same scenario quality and traces, not these package commands.
 
 0. **The design destination is already decided — read it, don't re-open it.** When
    Figma is on, the stage-0 brief names the team/org and the files — one per surface
@@ -94,8 +97,7 @@ green over both.
   not checkable; a record is. The track writes a **director record** in the product's
   repository, beside `docs/ux/`: `docs/design/<surface>/director-record.md`, a header
   line `surface_class: <class>` and one `## <Field>` heading per field. Which fields are
-  owed is the brief's `surface_class` ([`stages.md`](stages.md) → stage 0, *The surface
-  class*):
+  owed is the brief's `surface_class` ([`stage-00-intake.md`](stage-00-intake.md) → *0 — Intake grill — MANDATORY*, the surface-class bullet):
 
   | Class | Fields the record owes |
   |---|---|

package/plugins/task-pipeline/skills/task-pipeline/references/stage-00-intake.md

@@ -0,0 +1,158 @@
+# Stage 0 detail
+
+The full gate and freedom level remain in [stages.md](stages.md).
+
+## Contents
+
+- 0 — Intake grill — MANDATORY
+
+## 0 — Intake grill — MANDATORY
+- **Stage 0 is not optional and not skippable.** There is no "small enough task"
+  exemption, no "the request was already clear" exemption, no starting stage 1
+  "while the operator thinks". The only sanctioned bypass is the
+  entry-from-super-ux short-circuit below, and even that still requires a scope
+  confirmation and a record of what was adopted vs skipped. A run that reaches
+  stage 1 without a committed, operator-confirmed brief is a **failed run** —
+  stop and go back.
+- **Entry-from-super-ux short-circuit (check FIRST).** task-pipeline is often
+  launched *from* super-ux — its `/ux` action menu offers "execute autonomously
+  via the task-pipeline plugin" once the UX chain (and often a
+  `docs/ux/plans/…` fix plan) is already built. Before grilling, detect that:
+  if `docs/ux/` already holds a validated chain (foundation → flows → screens →
+  scenarios) and/or a fresh fix plan, **do not re-run the grill or the stage-3
+  UX track from scratch.** Instead: (1) run a quick check — `/ux-lint`
+  (`docs/ux/lint.py`) green, chain present, plan (if any) readable; (2) confirm
+  the scope with the operator in ONE line; (3) skip to the first stage that
+  still has real work (usually stage 4 Plan if a UX fix plan already exists, or
+  stage 3 Spec to formalize it). Record what was adopted vs skipped. If the
+  check finds drift/gaps, fall back to the normal flow for the missing parts
+  only.
+- **What (normal entry):** the operator's one-line task is almost never enough to
+  run autonomously. Before anything else, **grill the operator** to expand that
+  one line into a complete, unambiguous brief — resolve every decision branch
+  up front so stages 1→10 need no further human input beyond the manual gates.
+  This is input expansion, not design: turn "make me feature X" into locked
+  answers for scope, users, constraints, data, edge cases, done-criteria.
+- **Phase 1 — harvest the knowledge sources FIRST**
+  ([`knowledge-sources.md`](knowledge-sources.md)). Before the first question:
+  query what the project already knows about this task — code, **the code graph**
+  when one is built ([`knowledge-graph.md`](knowledge-graph.md): `graphify query` /
+  `affected` / `god-nodes` answer *reach*, which is what grep cannot), `CLAUDE.md`,
+  `CONTEXT.md`/ADRs, `docs/` + `docs/ux/`, past pipeline briefs and carry-over
+  ledgers, **the retro's standing instructions and run stamps** (`<artifacts>/retro.md`,
+  read **in full** — ten standing rows and ten stamps, both bounded **by a cap**, and they bind this
+  run; stamp each instruction as it fires. Its *Recent log* is **queried** by the
+  task's nouns, not read: uncapped narrative inside a binding source is what makes the
+  capped part get skimmed, [`retrospective.md`](retrospective.md)), **lessons from other
+  projects** (source 7b, [`knowledge-sources.md`](knowledge-sources.md): `scripts/lessons.py
+  query` over the local index, then a shared store where the session lists one — each
+  layer's state printed in the source ledger), the **knowledge wiki** if one is
+  installed
+  ([obsidian-wiki](https://github.com/ar9av/obsidian-wiki) — recommended,
+  never required), and any **other repo or hosted doc system the project names as
+  its docs**. Write the **source ledger** into the brief (a row per source, or an
+  explicit "none found"; **the graph's row carries its measured lag — commits and
+  days behind `HEAD`, the signal that measured it, and `⚠ not trusted for reach
+  until refreshed` on anything but `current`**
+  ([`knowledge-graph.md`](knowledge-graph.md) → *Measure the lag*; a build date is
+  the graph's own reply about itself, not a measurement of it). It is retrieval
+  scoped by the task's own nouns, not a read of everything — and it is what makes
+  phase 2's answers checkable instead of merely confident.
+- **Phase 1b — the documentation inventory**
+  ([`documentation.md`](documentation.md)). Four questions, answered before the
+  interview and written to `docs/DOCMAP.md` (seeded from
+  [`../templates/docmap.md`](../templates/docmap.md), **only when absent**): where
+  do settled things live, what is each fact's single home, what does a change of
+  type X oblige, and what proves it. A project with no answers gets them seeded —
+  registers, the matrix and `scripts/check-docs.sh` — and the seeding is itself
+  recorded as the register's first entry. **One decision home per project:** an
+  existing `docs/adr/` *is* the register and is recorded as such, never duplicated.
+  The gate is seeded so that it exits `0` on its own seeds; a project that starts
+  red learns on day one that the gate is noise.
+- **Phase 1b+ — offer the entry audit, once** ([`setup.md`](setup.md)). When
+  `docs/DOCMAP.md` is absent or its regime line predates the project's last release,
+  ask whether to audit the documentation that already exists **before** building on
+  it. Record the answer — including a refusal — in the brief's autonomy sweep and
+  never ask again. `audit.md`'s ladder runs at the *end* over the change; this runs
+  at the *start* over what is already there.
+- **Phase 1c — reconcile intent against as-built.** Git says how it *should* be;
+  the run record says how it *turned out*. Read both for the area you are about to
+  touch and resolve every divergence — the document is stale, the record is wrong,
+  or they genuinely disagree and that is a decision. There is no fourth option, and
+  starting on an unresolved divergence means building against a system that does
+  not exist.
+- **Phase 1d — the short-path triage: printed, proposed, never taken silently.** This
+  pipeline's own boundary exempts a typo, a one-line fix and a mechanical rename — and
+  nothing measured that until 2026-08-10, so the exemption depended on an agent
+  remembering it while eleven stages and four manual gates stood in front of a
+  one-paragraph edit. Three questions, each with something behind it:
+
+  ```
+  1. files the request names, resolved        git ls-files -- <paths>       -> N
+  2. any of them a public contract            the surfaces the host's release
+                                              syncs, its schema or config
+                                              contracts, a shipped command,
+                                              its README                    -> yes/no
+  3. behaviour a user or a caller observes changes                          -> yes/no
+  ```
+
+  Few files, no contract, no observable change ⇒ **propose** the short path: stages 1,
+  2, 3 and 4 marked `⊘` with the triage answer as the reason, and 5→10 running
+  unchanged. **Propose, never take.** The answer goes in the brief's autonomy sweep and
+  silence takes the full flow — the same floor deploy authorization uses. The glyph is
+  what makes it safe: a skipped stage is printed on the rail **with its reason**
+  ([`progress.md`](progress.md)), and a skip nobody can see is indistinguishable from a
+  stage that was never entered.
+- **How it runs: [`grill.md`](grill.md)** — the full doctrine, built into this
+  skill (nothing to install). In short: close what the sources can, then ONE batch
+  of the material unknowns, ordered by dependency, a recommended answer with each —
+  one at a time only where answers depend on each other or the operator asks;
+  contradictions reconciled on the spot; **every answer that touches
+  a harvested source is checked against it** — the operator outranks any document,
+  but only out loud, and the losing side is logged for the stage-9 doc update; plus
+  **domain awareness**
+  (challenge terms against `CONTEXT.md`, sharpen fuzzy language, stress-test with
+  concrete scenarios, cross-reference the code, record ADRs for hard-to-reverse
+  calls) and the **autonomy sweep** that pre-resolves every stage-1→10 blocker.
+  Deploy authorization has a hard floor there: a standing go counts only when it
+  names the target and the preconditions.
+- **The run mode is settled here too** ([`continuity.md`](continuity.md)): does
+  the run advance item-by-item with no check-in between items, and on what
+  interval? Exactly three sources arm it: `pipeline.json` → `run.loop` (read
+  first — a recorded mode is the answer and is not re-asked), the operator's answer
+  here, or a standing instruction the host already carries. The ledger names which, once:
+  `loop: armed by <source:line>`. **Absent all three, it is off.** It buys pacing, never
+  authorization: no loop mode collapses a `manual` gate or an outward act. The
+  same file carries the other half of pacing — the context budget, which fires
+  only on a harness signal or the operator's word, never on an estimate.
+- **UI early-detect:** one branch of the grill is always "does this touch a
+  user-facing surface (web/mobile/CLI/TUI)?". If yes → surface **super-ux**
+  now (use it if installed; otherwise give the install line — see SKILL.md
+  *Prerequisites*); this arms the stage-3 UX track. **And the same branch records
+  the surface's class** — the next bullet.
+- **The surface class.** Every user-facing task's brief carries
+  `surface_class: flagship | product | internal | ad`, and the class selects the gate
+  profile the visual layer is held to for the rest of the run:
+
+  | Class | What it is | Director record (stage 3) | Visual half (stages 5–6) | Stage 10 |
+  |---|---|---|---|---|
+  | `flagship` | the surface a product is judged by — landing, onboarding, paywall, a hero screen | the full record | **gate**: full matrix, pairwise across every axis, the full rubric | approved contact sheet |
+  | `product` | an ordinary screen of the product | the short record — Brief, Mode, References, Markers, Open | **gate**: every state and the mandatory pairs; the gate items of the rubric | approved contact sheet |
+  | `internal` | an admin panel, an internal tool, a CLI | none owed | recommended; the project linter is the floor | the functional look |
+  | `ad` | a creative that runs as an advertisement or a store asset | Brief, Mode, References, Markers, ADA (its rubric profile and safe zones), Open | **gate**: the ad profile and the safe zones | approved contact sheet |
+
+  Ask it as one question with a recommended answer read off the request — a landing or a
+  paywall is `flagship` unless the operator says otherwise — and never leave it to stage
+  5: a class decided at build time is decided by whoever wants the build to pass. A
+  work-graph node that builds the surface copies the class as `surface_class`, and
+  `graph.py certify` then owes the fourth, `visual` reading on `flagship` and `product`
+  ([`certification.md`](certification.md) → *The fourth reading*).
+- **Artifact:** lock the resolved decisions into a **task brief** committed at
+  `<artifacts>/specs/YYYY-MM-DD-<topic>-brief.md` (scope, users/UI verdict and,
+  for a user-facing task, `surface_class`, constraints, assumptions, explicitly-deferred items, done-criteria) **plus the
+  autonomy sweep's per-stage answers and the model decision**. Seed it from
+  the skill's `templates/brief.md` skeleton — but only when absent, never
+  overwrite an existing brief. Stages 2–4 build on this brief; stages 5–10 read
+  its autonomy section instead of asking. Where the session produced them, also:
+  an updated `CONTEXT.md` (terms written as they resolved) and any ADRs under
+  `docs/adr/` — see `grill.md` → *Domain awareness*.