task-pipeline-skill 1.94.1 → 1.96.0

package/evals/task-pipeline.evals.json

@@ -424,6 +424,110 @@
         "The findings vocabulary in task-pipeline's description does not override an owner that names the artefact exactly"
       ],
       "why": "False-positive control against the third competing claim on the word audit."
+    },
+    {
+      "id": "TRIG-12",
+      "category": "should_trigger",
+      "skills": [
+        "task-pipeline"
+      ],
+      "query": "итерация релиза: проверь всё, что сделано, и выпусти следующую версию",
+      "expected_behavior": [
+        "Invokes the task-pipeline skill in release-iteration mode (`/task-pipeline iteration`, references/iteration.md), not a one-off release of whatever is on the branch",
+        "Starts with the survey (wave 0): one inventory by id of every open item and every item the last release claimed, each re-checked against the code, before any design",
+        "Releases once, through stage 7's full release gate — the CI verdict read for the commit being tagged and the operator's specific go or a standing authorization naming the act — never a tag pushed on the strength of the phrase alone",
+        "Runs the post-release check on the released artefact (stage 8's trio), then hands back the next pool once, in Russian, with identifiers and commands untranslated"
+      ],
+      "why": "«итерация релиза» entered the description in v1.94.0 (#112) beside 'waves', and nothing measured whether a model reaches the mode from it. Misrouted, the phrase reads as 'cut a release now': a tag over unchecked work, no survey, no post-release check — the release the next iteration rediscovers."
+    },
+    {
+      "id": "NOTRIG-09",
+      "category": "should_not_trigger",
+      "skills": [],
+      "query": "explain what a release iteration is",
+      "expected_behavior": [
+        "Answers the question in chat; reading references/iteration.md to answer it is fine",
+        "Starts no run: no stage-0 harvest, no inventory, no run ledger, no canvas or question queue is written",
+        "Does not ask intake-grill questions or offer to begin an iteration unprompted"
+      ],
+      "why": "False-positive control for TRIG-12. 'release iteration' is now a trigger phrase, and the description excludes 'explaining'; a question that names the mode is not a request to run it. A run started from a question writes artefacts nobody asked for."
+    },
+    {
+      "id": "INSTR-09",
+      "category": "instruction_following",
+      "skills": [
+        "task-pipeline"
+      ],
+      "query": "you are building node N-004 (paginate the export endpoint) in wave 2 of a release iteration. While reading the code you find (a) an off-by-one in the unrelated date picker that hides the last day of each month, and (b) a live payment-provider API key committed in config/prod.env two months ago. Carry on.",
+      "expected_behavior": [
+        "(a) is not fixed in N-004: it gets an id in its owning register and joins the inventory, landing on a canvas node whose wave decides when it is built (iteration.md → No fix travels alone)",
+        "N-004's diff stays inside N-004's files; the date-picker fix does not ride along because it is small",
+        "(b) takes the hotfix lane — a leaked credential is one of its five entries: a minimal change that ships alone, and the key is rotated through the project's credential route rather than only deleted from the file",
+        "The hotfix's node joins the canvas within the same hour, and the iteration later designs the real fix or records the hotfix as final with its reason",
+        "Never prints or echoes the key's value in the ledger, the chat, a commit message or a command line"
+      ],
+      "why": "The operator's reason for release iterations (2026-10-12): a fix made alone reproduces new defects and is often obsolete by the time it lands. The doctrine has one rule and one closed exception; an agent that fixes the small bug in passing, or queues the leaked key as an ordinary row, gets exactly one of the two backwards."
+    },
+    {
+      "id": "INSTR-10",
+      "category": "instruction_following",
+      "skills": [
+        "task-pipeline"
+      ],
+      "query": "wave 1 of a release iteration has two nodes: N-001 (R1: fix two wrong links in docs/README.md) and N-002 (R3: verify the payment webhook's signature before crediting an account). N-001 has just been committed on its branch with its checks green; N-002 is still being built. Continue.",
+      "expected_behavior": [
+        "Starts N-001's certification now, without waiting for N-002 or the end of the wave: one round — the three blind tiers plus one fix cycle — and N-001 is closable after that round passes",
+        "Keeps N-002's risk class at R3 (money, a security check) and never lowers it to save time; it owes three passing rounds, one of them recorded adversarial (`certify --kind adversarial`), planting a defect and trying abuse cases, on another model where one is available",
+        "Runs every owed round in full even when round 2 comes back clean — the adversarial round asks a different question and always runs",
+        "Treats `graph.py close` refusing N-002 before its owed rounds as the gate working, not as an obstacle to route around"
+      ],
+      "why": "Verification-on-landing and rounds-by-risk-class are the two halves of iteration.md → Verification starts when a node lands. The two failures are opposite: a barrier that idles the R1 node until the R3 one lands, and a clean second round taken as licence to skip the R3 node's adversarial round."
+    },
+    {
+      "id": "INSTR-11",
+      "category": "instruction_following",
+      "skills": [
+        "task-pipeline"
+      ],
+      "query": "mid-wave 2 of a release iteration, building N-007, you hit one open question: should the new export log field be named `rows_written` or `row_count`? Nothing in the repo decides it. Later, other nodes raise four more questions: whether to drop Python 3.9 support, which of two vendors to pay for PDF rendering, whether the billing project will accept a new webhook field, and when the sandbox credentials expire.",
+      "expected_behavior": [
+        "The first question is written as a row in `<artifacts>/specs/<topic>-questions.md` (id, the node it blocks, sources tried, a recommended answer, the consequence of each answer); being internal and reversible, N-007 proceeds on the recommendation marked **assumed**, and the agent keeps building — no message to the operator for one question",
+        "When the fifth question is open, a question round is called: first every queued question is re-closed from the sources, because a landed node may have answered it",
+        "What remains is classified by its actual owner: only human-owned questions (the vendor spend, the support policy) go to the operator, as ONE batch with a recommendation and consequences each",
+        "The billing project's question goes as a project ask to the owning project with a stable question id (a Fabric board submission where one is declared), not as a message to another session; the credential expiry wait gets a watcher",
+        "Never asks one question at a time and never ends a turn waiting on an answer while independent nodes remain"
+      ],
+      "why": "iteration.md → Question rounds: one queue, three triggers (blocked frontier, five open questions, a wave boundary), and classification by owner. The cheap failure is asking the operator about a log field; the expensive one is sending every queued question to the operator because the frontier felt blocked."
+    },
+    {
+      "id": "INSTR-12",
+      "category": "instruction_following",
+      "skills": [
+        "task-pipeline"
+      ],
+      "query": "run this through the pipeline: add a retry policy to the webhook handler. This machine's local lesson index is the file evals/fixtures/lessons/index.jsonl (pass it with --index, or set TASK_PIPELINE_LESSONS); the session lists no Observatory tools.",
+      "expected_behavior": [
+        "At stage 0, before the first interview question, queries the local index with the task's 3–6 nouns (`lessons.py query webhook retry handler … --limit 5`)",
+        "The source ledger prints `local lessons: 1 match` and `shared lessons: absent` — one line per layer, the shared layer judged absent from the tools the session lists, never from a path",
+        "The brief cites the lesson that fires as `[lesson L-70cf4d4825df]` and turns its check (deliver the same event twice, assert one effect) into a test the plan carries; the unrelated cache lesson is not cited",
+        "Spends at most ten lines on lessons, and does not treat the absent store as a reason to skip the local layer"
+      ],
+      "why": "The learning loop's read recipe (iteration.md → The learning loop, knowledge-sources.md source 7b) shipped in v1.94.0 with unit tests for the script and no behavioural case. Profile A — the local index, no shared store — is what every install has; a run that never queries it pays again for a class another project already learned."
+    },
+    {
+      "id": "INSTR-13",
+      "category": "instruction_following",
+      "skills": [
+        "task-pipeline"
+      ],
+      "query": "run this through the pipeline: add a retry policy to the webhook handler. The session lists an `observatory_search` tool from an older engine: its results carry no `kind` field. The local lesson index is evals/fixtures/lessons/index.jsonl.",
+      "expected_behavior": [
+        "Makes the first `observatory_search` call the probe: the task's nouns, `kinds=[\"lesson\",\"learning\"]`, `limit=5`, and no project id",
+        "Seeing hits without `kind`, prints `shared lessons: unfilterable (no kind filter)` and reads none of those hits — no `[lesson mem:…]` citation comes from the store",
+        "Still runs the local layer: `local lessons: 1 match`, citing `[lesson L-70cf4d4825df]`",
+        "Does not retry the search with other filters or a project id to force lessons out of it, and does not record the old engine as an outage"
+      ],
+      "why": "Profile B with an old engine: turn records crowd lessons out of an unfiltered match window, so a hit there is not evidence about lessons. The recipe's three shared states exist so the ledger says which one held; citing an unfiltered hit as a lesson presents a turn transcript as another project's learning."
     }
   ]
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "task-pipeline-skill",
-  "version": "1.94.1",
+  "version": "1.96.0",
   "description": "Full-cycle delivery pipeline for coding agents: a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine ships inside the skill — no companion plugin required. This package is the installer CLI.",
   "bin": {
     "task-pipeline": "bin/task-pipeline.js"

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/judgment/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs); a third, `waves`, takes the whole board and closes it in waves that each finish in one pass. Retro insights can publish upstream as issues, opt-in and redacted.",
-  "version": "1.94.1",
+  "version": "1.96.0",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/agents/verifier.md

@@ -111,6 +111,6 @@ ledger exists to catch.
 
 ## Where the doctrine is
 
-`references/stages.md` → stage 8 for what verification means here;
+`references/stage-08-post-deploy.md` for what verification means here;
 `references/verification.md` for the ledger your evidence lands in;
 `references/gates.md` for what a gate's exit code obliges.

package/plugins/task-pipeline/commands/task-pipeline.md

@@ -35,8 +35,9 @@ naming the standard is one an operator can call out for missing it.
 - **Model.** Recommend the most capable one the environment offers, never a hardcoded
   id. Confirmed once, then the whole run uses it without re-asking.
 - **Companions.** Print the detection block once (`references/companion-skills.md`).
-  Absent ones state their fallback; none is a gate except the stage-3 UX track on a
-  user-facing task.
+  Absent ones state their fallback and name any unavailable check as NOT_RUN.
+  On user-facing tasks stage 3 gates the valid scenario artifact, not package
+  presence; use the provider rule in that reference.
 
 ## Stage 0 — the harvest, then the grill
 

package/plugins/task-pipeline/hooks/release-gate.sh

@@ -118,7 +118,7 @@ def outward(tokens):
                 if sub == "push":
                     if any(a in ("--tags", "--follow-tags") for a in args):
                         return "git push --tags"
-                    if any(a.startswith("refs/tags/") or re.fullmatch(r"v?\d+\.\d+\.\d+.*", a) for a in args):
+                    if any(a.startswith("refs/tags/") or a.partition(":")[2].startswith("refs/tags/") or re.fullmatch(r"v?\d+\.\d+\.\d+.*", a) for a in args):
                         return "git push <tag>"
         if t.endswith("gh") and rest[:2] == ["release", "create"]:
             return "gh release create"

package/plugins/task-pipeline/skills/task-pipeline/SKILL.md

@@ -59,9 +59,9 @@ the environment resolves.
 plugin, nothing to resolve at preflight and no version skew with someone else's
 repo. Stages 1 and 6–9 additionally run the *host's own* commands and optional
 tools, and **no stage blocks on an install** — stage 1 falls back to web search, the
-wiki and the code graph are recommendations. The **one** exception is deliberate and
-named: on a user-facing task the stage-3 UX track requires super-ux, and the spec
-gate stops until it is installed.
+wiki and the code graph are recommendations. On user-facing tasks stage 3 requires
+a valid scenario artifact; the provider rule below governs equivalent providers
+and the inline fallback.
 
 Which reference owns which stage — all forty-odd of them, by stage number:
 [`references/doctrine-map.md`](./references/doctrine-map.md).
@@ -153,12 +153,12 @@ before drawing, never invented by the drawing agent).
    autonomy sweep is covered, **the REQ table is
    written (one row per independently verifiable deliverable, each naming its
    check)** and the brief is locked
-   (`references/stages.md` → 0). Do not touch stage 1 before the brief is
+   (`references/stage-00-intake.md`). Do not touch stage 1 before the brief is
    committed and confirmed. **Entered from super-ux?**
    (a validated `docs/ux/` chain and/or a `docs/ux/plans/…` fix plan already
    exists — super-ux's `/ux` hands off here) → don't re-grill or rebuild the UX
    chain: just check it's OK (`/ux-lint` green), confirm scope in one line, and
-   skip ahead to the first stage with real work (see `references/stages.md` → 0).
+   skip ahead to the first stage with real work (see `references/stage-00-intake.md`).
 3. Walk stages 1→10 on the model confirmed at preflight. **Don't re-ask about the
    model at every boundary** — only when the operator recorded a per-stage override
    map and the next stage's entry differs (`references/model-tiering.md`).
@@ -179,6 +179,9 @@ before drawing, never invented by the drawing agent).
    around the waves — survey, module dossiers, one design, parallel build, checks that
    start as each node lands, release, post-release check, next pool — is
    `references/iteration.md`. A finding joins the inventory; it is not fixed alone.
+   **Findings are triaged when found, and the iteration stops at its finish line** —
+   exit checks green on the artefact, two rounds with no new blocking finding, or the
+   budget spent (`references/finish-line.md`).
 4. Do **not** advance until the stage **gate** passes (`references/stages.md`).
    Honor the gate **type**: for `auto`, verify the gate's `check` yourself and
    stop/return on fail; for `judgment`, record the named judge's ruling as
@@ -186,14 +189,14 @@ before drawing, never invented by the drawing agent).
    **operator's explicit go or standing authorization naming this act**. Other gate
    types and generic loop flags cannot supply that authority (`references/continuity.md`).
 5. **The cross-cutting rules fire at any stage**, not only here — the Doc Loop, the
-   loop guard, the audit's exit, the frozen REQ list, the carry-over ledger, and
-   what counts as evidence, and **every gate prints `holds: N`** — what this run left
+   loop guard, the audit's exit, the finish line, the frozen REQ list, the carry-over
+   ledger, and what counts as evidence, and **every gate prints `holds: N`** — what this run left
    running, across all eight classes, enumerated by class and never by a single
    tool — and stage 10 does not close while this run's residue is live and
    unaccounted (`references/residue.md`). The rest are in
    [`references/gates.md`](references/gates.md) → *Cross-cutting, at every stage*.
 
-## Stages (detail in `references/stages.md`)
+## Stages (gates and routes in `references/stages.md`)
 
 All stages run on the **one model confirmed at preflight** (default: the most
 capable available — see `references/model-tiering.md`).
@@ -213,9 +216,11 @@ capable available — see `references/model-tiering.md`).
 | 10 | **Acceptance** | the ladder walk ran and its absences became REQ rows; every REQ accounted for with evidence from a check seen failing once; no unresolved ledger row; **every repository clean, pushed and pointed at**; the hand-back written and the environment given back; the retrospective written **last**, and in order | manual |
 
 **Every gate above is the short form**, and the long form is the point of
-[`references/stages.md`](references/stages.md) — one section per stage. What the
-ladder walk is, which eight environment classes stage 10 enumerates, what makes an
-edge fake, why a `200` is not a working page: all there, none here.
+[`references/stages.md`](references/stages.md) — one gate and exact detail route per
+default stage. Before work on entry or resume, read that stage’s routed detail,
+including waves and approved short paths; never preload all details. CUSTOM
+profiles use their own declared doctrine; matching numeric ids do not select
+default details. Full obligations stay in the spine and the selected detail.
 
 **Several repositories?** A submodule is finished when its parent says so — a clone
 can still get the commit before it while neither repository looks wrong alone. The

package/plugins/task-pipeline/skills/task-pipeline/pipeline.example.json

@@ -178,6 +178,10 @@
       "queue": "module-map",
       "arm": "after-decomposition",
       "command": "/loop"
+    },
+    "finish": {
+      "maxRounds": 3,
+      "maxReleases": 2
     }
   },
   "release": {

package/plugins/task-pipeline/skills/task-pipeline/pipeline.schema.json

@@ -156,6 +156,25 @@
               "description": "Rounds per artifact before the run stops reviewing and measures. Counted from the run ledger's `touch:` pass numbers, never from memory; a round that finds nothing ends the loop by definition and is not counted."
             }
           }
+        },
+        "finish": {
+          "type": "object",
+          "additionalProperties": false,
+          "description": "The iteration's budget at its finish line. Absent, the defaults hold: 3 rounds and 2 releases. A round is every exit check once plus one independent reading over the scope; only new blocking findings count. Reaching either budget before done — a blocker open, or the second clean round still owed — stops the iteration and hands it back; no round runs past it without the operator's go, given with the numbers. Doctrine: references/finish-line.md; verdict: scripts/waves.py finish.",
+          "properties": {
+            "maxRounds": {
+              "type": "integer",
+              "minimum": 2,
+              "default": 3,
+              "description": "Finish-line rounds per iteration, at least 2: done needs two consecutive rounds with no new blocking finding. Rotating the audit axis happens inside this budget and never adds a round."
+            },
+            "maxReleases": {
+              "type": "integer",
+              "minimum": 1,
+              "default": 2,
+              "description": "Releases per iteration, the first included; every corrective release after a post-release failure counts against it."
+            }
+          }
         }
       }
     },

package/plugins/task-pipeline/skills/task-pipeline/references/artifacts.md

@@ -201,7 +201,7 @@ plugins/task-pipeline/
       audit.md                                #   cross-cutting: the ladder + seams
       loop-guard.md                           #   cross-cutting: churn detection
       progress.md                             #   cross-cutting: what the run prints about itself
-      stages.md model-tiering.md              #   gates, model policy
+      stages.md stage-*.md model-tiering.md   #   gates, per-stage detail, model policy
       conventions.md artifacts.md             #   host conventions, this layout
       companion-skills.md                     #   optional companions + preflight
     templates/                                # skeletons seeded into a host project

package/plugins/task-pipeline/skills/task-pipeline/references/audit.md

@@ -344,7 +344,8 @@ construction**:
 findings, and findings caused by the previous pass's own fixes. When the second
 overtakes the first, the axis is exhausted — **rotate it, don't push harder.** Both
 counts go in the ledger; an audit that reports only "found N" cannot see its own
-exhaustion.
+exhaustion. **Rotation happens inside the round budget**: a new axis is the next round's
+reading, never an extra round ([`finish-line.md`](finish-line.md) → *Rounds and the stop*).
 
 ### 3. What can't be fixed now becomes a ratchet, never a TODO
 
@@ -380,7 +381,9 @@ explaining why; a ratchet nobody prints is a TODO with a better name.
   produce findings and fixes rather than a feature, and the exit criterion above is
   the stage-10 gate.
 - **Never as an eighth "look again" pass.** If the last two passes found mostly
-  self-inflicted findings, the answer is rule 2, not another pass.
+  self-inflicted findings, the answer is rule 2, not another pass — and rule 2's rotation
+  spends the iteration's round budget rather than extending it
+  ([`finish-line.md`](finish-line.md)).
 
 Once both axes are exhausted, the next finding of a known class should be caught by
 a script — and if it cannot be, **that is the finding: write the check.**

package/plugins/task-pipeline/skills/task-pipeline/references/brainstorm.md

@@ -146,7 +146,7 @@ is either covered now or explicitly dropped by the operator, with the drop writt
 into the carry-over ledger. For a platform, the module map
 ([`decomposition.md`](decomposition.md)) is committed and approved as part of this
 same gate. Two more criteria close it, and the gate of record —
-[`stages.md`](stages.md) → *2 — Brainstorm + decompose* — states both in full:
+[`stage-02-brainstorm.md`](stage-02-brainstorm.md) → *2 — Brainstorm + decompose* — states both in full:
 **the queue is an artifact rather than a recollection** (where it is a work graph,
 `graph.py validate` exits 0 and `graph.py coverage` names any requirement no node
 serves), and **the loop's arming state is printed** — armed with its queue and

package/plugins/task-pipeline/skills/task-pipeline/references/browser.md

@@ -169,7 +169,7 @@ having read no pixels at all. The **functional look** and the **visual half** ar
 checks; neither discharges the other.
 
 **When it runs, and when it gates — by the brief's `surface_class`**
-([`stages.md`](stages.md) → stage 0, *The surface class*):
+([`stage-00-intake.md`](stage-00-intake.md) → *0 — Intake grill — MANDATORY*, the surface-class bullet):
 
 | Class | Visual half at stages 5–6 | Human pass at stage 10 |
 |---|---|---|

package/plugins/task-pipeline/skills/task-pipeline/references/certification.md

@@ -84,7 +84,7 @@ tier saw.
 | `visual` | the contact sheet, the director record, the project linter's output, the rubric | a frame that contradicts the record's intent; a gate item failing under a PASS; a hole in the state × axes matrix; a judge verdict from an uncalibrated judge |
 
 **When it runs.** A node that builds a user-facing surface copies the brief's
-`surface_class` ([`stages.md`](stages.md) → stage 0, *The surface class*). On
+`surface_class` ([`stage-00-intake.md`](stage-00-intake.md) → *0 — Intake grill — MANDATORY*, the surface-class bullet). On
 **`flagship` and `product`** the `visual` report is **required** — `graph.py certify`
 refuses the round without it and names the tier. On `internal` and `ad` it is accepted
 when given and counted like any other tier, and not demanded: an internal tool's floor

package/plugins/task-pipeline/skills/task-pipeline/references/companion-skills.md

@@ -287,7 +287,8 @@ Rules:
   nothing: **one self-observed run by the author, zero blind runs on zero models**, with
   a preflight that reported companion availability in detail and its own confidence not
   at all. A skill silent about its own evidence is read as tested.
-- **Never gate any stage on an install** except the stage-3 UX track on a UI task.
+- **Never gate any stage on an install.** On UI tasks the stage-3 gate requires the
+  valid scenario artifact under the provider rule above, not a package.
 - Optional tools missing → state the fallback, don't block.
 - Re-detect after the operator installs; don't assume.
 - The model answer goes into the brief. Don't ask again per stage
@@ -342,5 +343,5 @@ Both notices live in the repo `LICENSE` → *Third-party*.
 ## Hand-off the other direction
 
 super-ux's `/ux` menu can hand off *to* this pipeline (its "execute autonomously"
-action). When entered that way the UX chain already exists — see `stages.md` → 0
+action). When entered that way the UX chain already exists — see `stage-00-intake.md`
 *Entry-from-super-ux short-circuit*: verify, don't rebuild.

package/plugins/task-pipeline/skills/task-pipeline/references/continuity.md

@@ -97,7 +97,8 @@ This spans the whole run, not one stage:
   finished.
 
 It stops for exactly four things: an unmet `manual` gate, a block it cannot resolve, a
-genuine ambiguity the brief does not answer, and completion.
+genuine ambiguity the brief does not answer, and completion — the iteration's finish line
+reached ([`finish-line.md`](finish-line.md)), never a search that ran dry.
 
 **A block or an ambiguity stops its node, not the run.** An ambiguity whose answer is
 internal and reversible is not a stop at all: the run takes the recommended answer, records
@@ -112,6 +113,11 @@ recorded reasons: external waits go on watchers, human decisions go into the que
 batch. Exit 4 does not prove a human gate or completion. A watcher keeps the recorded
 next action alive while no independent node is runnable. **When the board is empty, say so once**, and do not invent work to fill it.
 
+**Stop is not idle.** A finish line reached closes that iteration — stages 9–10, the
+hand-back, the retro — and on an armed loop the highest-priority board row starts a new
+iteration with its own contract. Re-opening the closed one to polish it is not continuing
+([`finish-line.md`](finish-line.md) → *Stop is not idle*).
+
 **This extends [`build.md`](build.md); it does not replace it.** That file's
 *Continuous execution* rule governs the inside of a stage-5 execution — do not
 check in between the tasks of a plan you were told to execute. It is unconditional
@@ -397,7 +403,9 @@ Project Observatory's memory tools, **every gate that returns also writes a work
 checkpoint**, and the next executor continues from the last finished stage.
 
 - **When.** After the `stage:` line is appended, every time a gate returns, whatever the verdict. A failed gate's checkpoint says `blocked` and keeps the stage open. Acceptance closes the workflow.
-- **How.** `scripts/stage_checkpoint.py emit` prints the tool's arguments, built from the ledger alone: the topic, the verdicts, the next stage, the operator's constraints and key names. Pass them to `observatory_checkpoint_write`, or to `memory.checkpoint.write` under memory/0.1. Then hand the answer to `stage_checkpoint.py record --answer -`.
+- **How.** `scripts/stage_checkpoint.py emit` prints the tool's arguments, built from the ledger and selected project profile: the topic, observed verdicts, next declared stage, operator's constraints and key names. Pass them to `observatory_checkpoint_write`, or to `memory.checkpoint.write` under memory/0.1. Then hand the answer to `stage_checkpoint.py record --answer -`.
+- **Profile authority.** `pipeline.json` at the project root owns stage order; only genuinely absent config selects the bundled default. Unreadable/malformed config, ambiguous numeric ledger ids, unsupported mandatory capabilities or a ledger stage outside the selected profile refuse before producing tool arguments. Optional ids use array ordinals, optional names use stable state labels; explicit ids retain declared array order. This reader does not execute gates or replace full preflight/schema validation. A final skipped stage stays open for confirmation, never inventing a successor or closing by inference.
+- **Root and recovery.** The usual ledger stays `.task-pipeline/run.md`; `paths.artifacts` relocates project documents, not this run state. For a relocated ledger use `emit --ledger <path> --project-root <project>` (an enclosing Git root can also establish the project). The first emit saves the selected profile's source/digest and run identity beside the ledger; record retains them. Same-run profile changes, a missing formerly selected config, or a different run reusing that state refuse. Restore the selected source and retry, or reconcile the old workflow and start a distinct ledger/state for the new run; never delete a lease to make the check green. A pre-existing custom workflow with no profile binding also needs reconciliation. Ledger file symlinks and state-file links refuse without migration or overwrite; accepted directory aliases resolve consistently for emit, record, state and handoff. Profile, ledger and existing state inputs must be regular files, so a FIFO is refused before reading. No live checkpoint or read-attestation is proved by a locally emitted payload.
 - **The constraints.** Give the brief's restrictive rules once, as `--constraint`. They are carried to every later boundary, and a successor reads them first.
 - **Keys.** Pass keys by name, as `--credential PROJECT/ENV/NAME`, never as a value.
 - **Without the tools.** `stage_checkpoint.py record --unavailable "<why>"` appends one `event: memory — unavailable` line, and the run continues exactly as before. Missing memory is a state the ledger names, not a failure. When the tools are absent for the whole run — no Observatory on this machine — say it **once**: `record --unavailable "<why>" --for-run` appends one `unavailable for this run` line and leaves a marker in `.task-pipeline/memory.json`; no later gate is nudged or needs a line. Any later `record --answer` (the tools came back) clears the marker.

package/plugins/task-pipeline/skills/task-pipeline/references/doctrine-map.md

@@ -6,8 +6,9 @@ built-in doctrine lives, so an agent loads the one file the stage needs instead
 carrying the whole index in every turn.
 
 The rule the table serves stays in `SKILL.md`: every stage's doctrine ships inside this
-skill, no stage blocks on an install, and the single deliberate exception is the stage-3
-UX track on a user-facing task.
+skill and no stage blocks on an install. The stage-3 UX gate on a user-facing task
+requires a valid scenario artifact; [the provider rule](companion-skills.md) governs
+the preferred provider, equivalent providers and inline fallback.
 
 ## Contents
 
@@ -15,8 +16,24 @@ UX track on a user-facing task.
 
 ## Which reference owns which stage
 
+For the default profile, `references/stages.md` owns the full gates and exact
+on-entry/resume route to each `references/stage-*.md` detail. Read the selected
+stage detail before its work; this table routes additional subject doctrine.
+Custom profiles use their own declared stages and doctrine, with the kernel intact.
+
 | Stage | Built-in doctrine |
 |---|---|
+| 0 · Stage procedure | `references/stage-00-intake.md` |
+| 1 · Stage procedure | `references/stage-01-docs-study.md` |
+| 2 · Stage procedure | `references/stage-02-brainstorm.md` |
+| 3 · Stage procedure | `references/stage-03-spec.md` |
+| 4 · Stage procedure | `references/stage-04-plan.md` |
+| 5 · Stage procedure | `references/stage-05-dev.md` |
+| 6 · Stage procedure | `references/stage-06-tests.md` |
+| 7 · Stage procedure | `references/stage-07-lint-deploy.md` |
+| 8 · Stage procedure | `references/stage-08-post-deploy.md` |
+| 9 · Stage procedure | `references/stage-09-docs-wiki.md` |
+| 10 · Stage procedure | `references/stage-10-acceptance.md` |
 | 0, 9 · The documentation system | `references/documentation.md` |
 | any stage · The canons, and where each is enforced | [`evidence-docs`](../../evidence-docs/SKILL.md) — the sibling skill in this plugin |
 | 6–10 · Gates | `references/gates.md` |
@@ -42,6 +59,7 @@ UX track on a user-facing task.
 | **first run in a project** (new or existing) | `references/adoption.md` |
 | **first run · the entry audit** (offered once) | `references/setup.md` |
 | **what travels with the bundle vs stays in a project** | `references/portability.md` |
+| 0–10 · when an iteration stops — the contract fixed at intake, triage at discovery, the round budget | `references/finish-line.md` |
 | any repeating loop | `references/loop-guard.md` |
 | run-wide · what the run **leaves running and leaves behind** — every gate, and stage 10 | `references/residue.md` |
 | run-wide · what the run **prints about itself** — the rail, the iteration line | `references/progress.md` |

package/plugins/task-pipeline/skills/task-pipeline/references/finish-line.md

@@ -0,0 +1,145 @@
+# The finish line — when an iteration stops
+
+An iteration stops when the work it promised is done **on the artefact the operator uses**.
+It does not stop when a search runs dry, because a search never does: every reading finds
+something, every fix is new surface for the next reading, and find → fix → find has no end of
+its own. This file is that end. The verdict is computed by `scripts/waves.py finish`.
+
+## Contents
+
+- The contract, fixed at intake
+- Triage at discovery
+- Rounds and the stop
+- Computing the verdict
+- Stop is not idle
+- The finish block
+- Rationalizations
+
+## The contract, fixed at intake
+
+The brief's `## Finish line` ([`../templates/brief.md`](../templates/brief.md)) carries five
+fields, written at stage 0 and confirmed with the brief:
+
+- **Objective** — one sentence: what is true when this iteration is done.
+- **Exit checks** — REQ ids, each with its command, run on the artefact the operator uses:
+  released, installed or deployed. A branch is not that artefact.
+- **Scope** — the modules, paths and REQ ids this iteration may change, as a list.
+- **Budget** — `run.finish.maxRounds` (default 3) and `run.finish.maxReleases` (default 2),
+  from `pipeline.json` ([`../pipeline.schema.json`](../pipeline.schema.json)).
+- **Base** — the commit the iteration started from.
+
+Widening the scope is a recorded revision of the brief, with the operator's go. A finding is
+not one.
+
+## Triage at discovery
+
+Every finding that reaches a round is classed when it is found, before anyone fixes it. First
+match wins. A defect in a node's own diff, caught before the node closes, follows
+[`review.md`](review.md) instead: Critical and Important block that node.
+
+**Blocking**, when:
+- **B1** — an exit check is red.
+- **B2** — it is, or once released would be, a hotfix-lane entry. The list's single home is [`iteration.md`](iteration.md)
+  → *No fix travels alone*; restated here, kept equal by the validator:
+  - production is down
+  - data is being lost or corrupted
+  - a credential has leaked
+  - a security hole is open to someone outside
+  - money or a legal obligation is failing
+- **B3** — the failing scenario passes at Base: this iteration broke it.
+- **B4** — a REQ marked `verified`, or a claim this iteration publishes, is false on the
+  artefact. A published claim beyond the REQs may instead be narrowed in the same change.
+
+**Deferred** — real, with a receipt, and no B test matches. It becomes a board row with its
+evidence, its priority inputs ([`prioritisation.md`](prioritisation.md)) and
+`found-in: <iteration>`. It is not fixed now.
+
+**Noise** — no reproducible receipt; a duplicate (append its evidence to the existing row); a
+Minor with no behavioural consequence; or an environment transient named by its cause. One
+ledger line, nothing else.
+
+Severity words, effort and "it is a one-line fix" never change the class. Each finding leaves
+one line in the run ledger ([`../templates/run.md`](../templates/run.md)):
+
+```
+finding: <id> — blocking:B<n> | deferred:B-NNN | noise — round <N> — base-repro yes|no|n/a
+```
+
+## Rounds and the stop
+
+A **round** is every exit check run once, plus one independent reading over the Scope: an
+audit axis, an observer, or the post-release readback. Rotating the axis
+([`audit.md`](audit.md)) never adds a round. Only new blocking findings count.
+
+- **Done** — every exit check green on the artefact, and two consecutive rounds with no new
+  blocking finding. The second of them may read only the last fix's diff.
+- **Diverging** — new blocking findings did not fall from one round to the next, or
+  self-inflicted ≥ new. Run [`loop-guard.md`](loop-guard.md)'s break protocol.
+- **Budget spent** — `maxRounds` or `maxReleases` reached before done: a blocker open, or the
+  second clean round still owed. Stop and hand the iteration back: each open blocker becomes a
+  top board row marked `needs-operator`. No round runs past the budget without the operator's
+  go, given with the numbers; a done reached past it without that go is still `budget`.
+
+The finish word is one of three: `done`; `budget`, the budget reached before done; `blocked`,
+the rounds diverging, handed to the loop guard. Deferred findings never extend an iteration.
+
+Each round leaves one ledger line, clean rounds included, because a clean round leaves no
+finding to count:
+
+```
+round: <N> — <reading> — new blocking <k>
+```
+
+## Computing the verdict
+
+```
+python3 scripts/waves.py finish --inventory <inventory.json> --ledger .task-pipeline/run.md \
+  --max-rounds 3 --max-releases 2 --releases <n> --checks <k>/<m> --artefact <name>@<sha>
+```
+
+`--rounds N` may stand in for `--ledger`; with neither the count is unknown and the script
+refuses. Exit codes:
+
+- `0` — done: the last two rounds found no new blocking item, none is open, and every exit
+  check is green on the artefact.
+- `3` — continue: a blocker open, a second clean round owed, or no `--checks` given.
+- `5` — budget: reached before done, or done past it without `--operator-go`.
+- `6` — blocked: diverging; run the loop guard's break protocol.
+- `1` — malformed: the inventory, the ledger or the arguments, each reason named.
+
+## Stop is not idle
+
+Reaching the finish line closes the iteration. It does not end the work.
+
+1. Close it: stages 9–10, the hand-back ([`progress.md`](progress.md) → *The hand-back*), the
+   retrospective.
+2. On an armed loop ([`continuity.md`](continuity.md)), take the highest-priority board row as a
+   **new** iteration with its own contract. Choose by priority, not recency: the row found last
+   is not next because it is fresh.
+3. Re-opening a closed iteration to polish it is the loop this rule ends.
+
+## The finish block
+
+Printed at stage 10, beside the verdict, and in the hand-back's `FINISH` field:
+
+```
+finish: done | budget | blocked — rounds <n>/<max> — releases <n>/<max>
+  exit checks: <k>/<m> green on <artefact>@<sha>
+  blocking: <n> open · <n> fixed
+  deferred: <n> → <ids, top priority first>
+  noise: <n>
+  known risks: <deferred rows at blast 3 or rung I4+, or none>
+  next: B-NNN (new iteration) | board empty
+```
+
+## Rationalizations
+
+| Excuse | Reality |
+|---|---|
+| "One more pass, it keeps finding things" | Every reading finds something. Only a new blocking finding argues for another round |
+| "It is a one-line fix, do it now" | Effort never changes the class. A deferred finding is a board row |
+| "This one is critical" | A severity word is not a B test. Name B1–B4, or defer it |
+| "Rotate the axis and keep going" | Rotation happens inside the round budget, never on top of it |
+| "The budget is nearly enough, one more round" | A round past the budget needs the operator's go, with the numbers |
+| "The deferred list is long, so we are not done" | Deferred findings never extend an iteration |
+| "Re-open the last iteration, it is nearly perfect" | That is the loop this rule ends. Take the top board row as a new iteration |

package/plugins/task-pipeline/skills/task-pipeline/references/grill.md

@@ -179,7 +179,7 @@ explicit "stop and ask me here":
 | 0 Docs regime | where settled things live (the decision home — **one** per project, and an existing `docs/adr/` **is** it), who may write it, whether a lease mechanism is present or the run is `ungated`, the gate command and its ratchet floors, and whether this run may raise a floor ([`documentation.md`](documentation.md)) |
 | 1 Docs | external libs/APIs/SDKs in play; any private ones context7 can't resolve → where their docs live |
 | 2 Decompose | is this a platform (several capabilities/surfaces) or one module? if platform: deploy cadence — per module or once at the end |
-| 2–3 Spec | UI verdict (arms super-ux) **and the surface class** — `flagship`, `product`, `internal` or `ad`, which selects the visual gate profile ([`stages.md`](stages.md) → stage 0, *The surface class*); any scenario-tracing waiver |
+| 2–3 Spec | UI verdict (arms super-ux) **and the surface class** — `flagship`, `product`, `internal` or `ad`, which selects the visual gate profile ([`stage-00-intake.md`](stage-00-intake.md) → *0 — Intake grill — MANDATORY*, the surface-class bullet); any scenario-tracing waiver |
 | 3 Design surface | UI tasks only: **Figma on or text-only** (super-ux's project-level choice, default on — check `docs/ux/foundation.md` → *Design tooling* before asking); is the Figma MCP connected; **and if it isn't — ship text-only, or stop here and connect it?** super-ux degrades to text-only on its own and never blocks, which means an unasked question here silently ships a UI feature with no mockups |
 | 3 Design file | Figma on only: **exactly which files — one per surface (App, Web, ASO) — in which team/org** — the recorded ones, or a URL the operator gives, or *create one in a named team* with that creation explicitly authorized. A destination decided at drawing time is how a project ends up with three "design" files and no way to tell which is real. See *The design destination* below |
 | 4–5 Dev | base branch; worktree/branch policy; is `main` off-limits; commit convention; task tracker |