task-pipeline-skill 1.95.0 → 1.97.1

package/plugins/task-pipeline/.claude-plugin/plugin.json

@@ -3,7 +3,7 @@
   "name": "task-pipeline",
   "displayName": "Task Pipeline",
   "description": "Runs a substantial task through a mandatory built-in intake grill, then 10 gated stages (docs, brainstorm+decompose, spec, plan, subagent build, tests, lint/deploy, post-deploy, docs/wiki, acceptance). Every stage's doctrine is built into the skill — no companion plugin required — with typed auto/judgment/manual gates, a frozen requirement spine that closes with evidence, a work board and a verification ledger that outlive a run, an exposure line naming what shipped unconfirmed, a progress rail computed from the project's own config, a loop guard whose review ceiling measures rather than stops, and stage-3 tracks for what a product does, how it sounds and how it looks. Two modes need no task: `checkup` (what is unverified) and `setup` (audit existing docs); a third, `waves`, takes the whole board and closes it in waves that each finish in one pass. Retro insights can publish upstream as issues, opt-in and redacted.",
-  "version": "1.95.0",
+  "version": "1.97.1",
   "author": {
     "name": "ssheleg",
     "url": "https://x.com/sshlg93"

package/plugins/task-pipeline/skills/task-pipeline/SKILL.md

@@ -179,6 +179,9 @@ before drawing, never invented by the drawing agent).
    around the waves — survey, module dossiers, one design, parallel build, checks that
    start as each node lands, release, post-release check, next pool — is
    `references/iteration.md`. A finding joins the inventory; it is not fixed alone.
+   **Findings are triaged when found, and the iteration stops at its finish line** —
+   exit checks green on the artefact, two rounds with no new blocking finding, or the
+   budget spent (`references/finish-line.md`).
 4. Do **not** advance until the stage **gate** passes (`references/stages.md`).
    Honor the gate **type**: for `auto`, verify the gate's `check` yourself and
    stop/return on fail; for `judgment`, record the named judge's ruling as
@@ -186,8 +189,8 @@ before drawing, never invented by the drawing agent).
    **operator's explicit go or standing authorization naming this act**. Other gate
    types and generic loop flags cannot supply that authority (`references/continuity.md`).
 5. **The cross-cutting rules fire at any stage**, not only here — the Doc Loop, the
-   loop guard, the audit's exit, the frozen REQ list, the carry-over ledger, and
-   what counts as evidence, and **every gate prints `holds: N`** — what this run left
+   loop guard, the audit's exit, the finish line, the frozen REQ list, the carry-over
+   ledger, and what counts as evidence, and **every gate prints `holds: N`** — what this run left
    running, across all eight classes, enumerated by class and never by a single
    tool — and stage 10 does not close while this run's residue is live and
    unaccounted (`references/residue.md`). The rest are in

package/plugins/task-pipeline/skills/task-pipeline/pipeline.example.json

@@ -178,6 +178,10 @@
       "queue": "module-map",
       "arm": "after-decomposition",
       "command": "/loop"
+    },
+    "finish": {
+      "maxRounds": 3,
+      "maxReleases": 2
     }
   },
   "release": {

package/plugins/task-pipeline/skills/task-pipeline/pipeline.schema.json

@@ -156,6 +156,25 @@
               "description": "Rounds per artifact before the run stops reviewing and measures. Counted from the run ledger's `touch:` pass numbers, never from memory; a round that finds nothing ends the loop by definition and is not counted."
             }
           }
+        },
+        "finish": {
+          "type": "object",
+          "additionalProperties": false,
+          "description": "The iteration's budget at its finish line. Absent, the defaults hold: 3 rounds and 2 releases. A round is every exit check once plus one independent reading over the scope; only new blocking findings count. Reaching either budget before done — a blocker open, or the second clean round still owed — stops the iteration and hands it back; no round runs past it without the operator's go, given with the numbers. Doctrine: references/finish-line.md; verdict: scripts/waves.py finish.",
+          "properties": {
+            "maxRounds": {
+              "type": "integer",
+              "minimum": 2,
+              "default": 3,
+              "description": "Finish-line rounds per iteration, at least 2: done needs two consecutive rounds with no new blocking finding. Rotating the audit axis happens inside this budget and never adds a round."
+            },
+            "maxReleases": {
+              "type": "integer",
+              "minimum": 1,
+              "default": 2,
+              "description": "Releases per iteration, the first included; every corrective release after a post-release failure counts against it."
+            }
+          }
         }
       }
     },

package/plugins/task-pipeline/skills/task-pipeline/references/audit.md

@@ -344,7 +344,8 @@ construction**:
 findings, and findings caused by the previous pass's own fixes. When the second
 overtakes the first, the axis is exhausted — **rotate it, don't push harder.** Both
 counts go in the ledger; an audit that reports only "found N" cannot see its own
-exhaustion.
+exhaustion. **Rotation happens inside the round budget**: a new axis is the next round's
+reading, never an extra round ([`finish-line.md`](finish-line.md) → *Rounds and the stop*).
 
 ### 3. What can't be fixed now becomes a ratchet, never a TODO
 
@@ -380,7 +381,9 @@ explaining why; a ratchet nobody prints is a TODO with a better name.
   produce findings and fixes rather than a feature, and the exit criterion above is
   the stage-10 gate.
 - **Never as an eighth "look again" pass.** If the last two passes found mostly
-  self-inflicted findings, the answer is rule 2, not another pass.
+  self-inflicted findings, the answer is rule 2, not another pass — and rule 2's rotation
+  spends the iteration's round budget rather than extending it
+  ([`finish-line.md`](finish-line.md)).
 
 Once both axes are exhausted, the next finding of a known class should be caught by
 a script — and if it cannot be, **that is the finding: write the check.**

package/plugins/task-pipeline/skills/task-pipeline/references/browser.md

@@ -12,7 +12,9 @@ which is how a run says *I checked the browser* and means *I ran the unit tests*
 > **Every command and flag below was read from the tool's own `--help`**, not from a
 > vendor page. Where the two disagreed, `--help` won and the page was wrong — see
 > *Rationalizations*. Re-derive before quoting:
-> `npx @playwright/cli@latest --help` and `npx @playwright/mcp@latest --help`.
+> `npx @playwright/cli@latest --help` and `npx @playwright/mcp@latest --help`. The
+> `--browser webkit` flag on both was last read from `@playwright/cli` 0.1.22 (`open
+> --help`) and `@playwright/mcp` 0.0.83 on 2026-10-16.
 >
 > **Use the scoped name with `npx`.** `npx playwright-cli --help` fails outside a project
 > that has already installed it (`could not determine executable to run`), and the bare
@@ -23,6 +25,7 @@ which is how a run says *I checked the browser* and means *I ran the unit tests*
 
 ## Contents
 
+- Engine order — WebKit (Safari) first
 - The one model: a tree, and a ref
 - The look, as commands you can run
 - Sessions, and why an agent needs them
@@ -35,6 +38,35 @@ which is how a run says *I checked the browser* and means *I ran the unit tests*
 - What the channel can reach — the part a recommendation owes you
 - Rationalizations
 
+## Engine order — WebKit (Safari) first
+
+**Check a rendered surface in WebKit first** (`DEC-0007`). The channel is how a look
+arrives; the engine is what renders it, and the two are separate choices:
+
+| Need | WebKit route — the default |
+|---|---|
+| A real browser | Safari itself, through `safaridriver` (WebDriver; enable it once with `sudo safaridriver --enable`) |
+| Automation, the look | Playwright's `webkit`: `playwright-cli open --browser webkit <url>`, the MCP started with `--browser webkit`, a `webkit` project in `playwright.config.*`. Install the engine with `playwright-cli install-browser webkit` or `npx playwright install webkit` |
+| Debugging | Safari Web Inspector |
+| A page for a person, on macOS | `open -a Safari <url>` — never bare `open <url>`, which hands the page to the system default browser, and the default may be another browser |
+| An automation library (browser-use and the like) | its WebKit or Safari backend, where it has one |
+
+Name the engine every time. Without `--browser`, the CLI falls back to a Chromium-family
+browser (read from its own bundle, 0.1.22, not from `--help`) — so a recipe that leaves
+the flag off has chosen Chromium without saying so. Playwright's `webkit` is the engine,
+not Safari itself: a question about Safari's own behaviour goes to `safaridriver`.
+
+**Chromium is a stated fallback, never the default.** Use it only when the task needs
+Chrome itself — a Chrome-only API, Lighthouse, a CDP performance trace, a heap snapshot,
+the `chrome-devtools` MCP — and say which and why in the verdict. Prefer the Chrome Dev
+build for that. When you launch your own Chrome or Chromium for a UI run, give it a
+temporary profile (never the user's), record what you started, and close every process
+you started before you finish ([`residue.md`](residue.md)).
+
+**A surface checked only in Chromium is reported as exactly that** — *"checked in
+Chromium (`chrome-devtools`, for `lighthouse_audit`)"*, never *"tested in a browser"*.
+The engine is part of the claim, the same way the command is.
+
 ## The one model: a tree, and a ref
 
 **Both channels drive the page through its accessibility tree, not its pixels.** You ask
@@ -68,14 +100,15 @@ The pipeline asks for the same four things every time: **open it, snapshot it, r
 console, read the network.** In the CLI that is literally four commands:
 
 ```bash
-playwright-cli open http://localhost:3000/checkout
+playwright-cli open --browser webkit http://localhost:3000/checkout
 playwright-cli snapshot
 playwright-cli console warning     # min-level: only warnings and errors
 playwright-cli requests            # then: request <n> for headers, body, response
 ```
 
 The MCP is the same four moves under different names: `browser_navigate`,
-`browser_snapshot`, `browser_console_messages`, `browser_network_requests`.
+`browser_snapshot`, `browser_console_messages`, `browser_network_requests` — on WebKit
+when the server was started with `--browser webkit`.
 
 **Quote what you read, not that you looked.** *"Console clean, all requests fine"* is a
 claim. *"`console warning` → empty; `requests` → no status ≥ 400"* is the same claim with
@@ -87,8 +120,9 @@ resources by default and says so in its own footer (*"N static request(s) not sh
 appears without the flag — so *no status ≥ 400* is a safe claim and *14 requests* is not.
 
 `chrome-devtools` takes the identical four moves — `navigate_page`, `take_snapshot`,
-`list_console_messages`, `list_network_requests` — which is why the matrix ranks neither:
-the look is the same look.
+`list_console_messages`, `list_network_requests` — but only in Chrome. The moves are the
+same look; the engine is not, so for the look it is the **stated Chromium exception**,
+reached for when the question needs Chrome (*Engine order*, above).
 
 ## Sessions, and why an agent needs them
 
@@ -130,17 +164,17 @@ commonest way a run reports a green it does not have.
 |---|---|---|---|
 | **The look** | an agent driving a page: open, snapshot, console, network | that this surface renders, right now, and what the browser said while it did | the **functional look**, stage 6 — recommended, never a gate. Its **visual half** is a gate on a `flagship`, `product` or `ad` surface — *The visual half*, below |
 | **The spec suite** | `playwright test` — the **test runner** | that the assertions someone wrote still hold, on the paths someone thought to write | the **suite** half of the stage-6 gate, counted with every other test |
-| **The library** | `require('playwright')` — `chromium`/`firefox`/`webkit`, `devices`, `request`, `selectors` | whatever your own script asserts; it is an automation API, not a test framework | wherever the project already runs it |
+| **The library** | `require('playwright')` — `webkit`/`chromium`/`firefox`, `devices`, `request`, `selectors` | whatever your own script asserts; it is an automation API, not a test framework | wherever the project already runs it |
 
-The library and the runner are **separate APIs** — a script built on `chromium.launch()`
+The library and the runner are **separate APIs** — a script built on `webkit.launch()`
 has no `expect`, no fixtures, no reporter, and no retry. Choosing the library where a
 runner was wanted is how a project ends up with a bespoke half-runner nobody trusts.
 
 The minimal library shape, for reading a script that already exists:
 
 ```js
-const { chromium } = require('playwright');
-const browser = await chromium.launch();
+const { webkit } = require('playwright');
+const browser = await webkit.launch();
 const page = await browser.newPage();
 await page.goto('http://example.com');
 await browser.close();
@@ -186,7 +220,8 @@ the close-out — the same rule as every other refusal in the pipeline.
 
 1. **Deterministic.** The project linter — `python3 scripts/visual_gate.py lint <dir>`,
    which runs sheleg-design's `--lint` where it is installed and answers **NOT_RUN (exit 3)**
-   where it is not — plus axe or Lighthouse, the token check, the type checker. An S1
+   where it is not — plus axe or Lighthouse (the stated Chromium exception), the token
+   check, the type checker. An S1
    finding blocks, whatever anyone says about the picture later. **With Figma on, the
    token check includes the drift probe**: `python3 scripts/visual_gate.py tokens
    --figma <variables.json> --css <tokens.css>` compares the variable names exported
@@ -266,7 +301,7 @@ and neither needs a password in a transcript.
 
 ```bash
 mkdir -p .auth                                  # state-save does not create it
-playwright-cli open https://app.example.com/login
+playwright-cli open --browser webkit https://app.example.com/login
 #  … sign in by hand, or drive the form …
 playwright-cli state-save .auth/state.json      # cookies + localStorage
 playwright-cli state-load .auth/state.json      # every later look starts signed in
@@ -387,4 +422,6 @@ On a CI box, headed is the failure you will spend an hour on.
 | *"The tool list is in the docs."* | The page listed tools this version does not ship, and omitted that tracing, video and PDF need `--caps`. Ask the server: 24 tools default, 42 with all caps. |
 | *"It's behind a login, so the look isn't possible."* | `state-save` / `state-load`, or `--storage-state`. Auth is a solved step, not an exemption. |
 | *"No browser channel is installed, so the step doesn't apply."* | The step still applies; the claim weakens. Say *verified by reading the diff* and let the close-out record it as the weaker claim it is. |
+| *"Tested in a browser."* | Which engine? A look taken only in Chromium is reported as *checked in Chromium*, with the reason Chrome was needed. WebKit is the default (*Engine order*). |
+| *"I opened it with `open <url>`."* | That is the system default browser, which may not be Safari. `open -a Safari <url>` for a person; `--browser webkit` for automation. |
 | *"I closed the browser."* | `list` is the evidence. The command you typed is not the state you left ([`residue.md`](residue.md)). |

package/plugins/task-pipeline/skills/task-pipeline/references/companion-skills.md

@@ -27,6 +27,10 @@ one must never look alike.
 > **`DEC-0006`** scopes that to the functional look: the **visual half** is a gate on a
 > `flagship`, `product` or `ad` surface, and its absent tool reads NOT_RUN and stops to
 > ask rather than passing ([`browser.md`](browser.md) → *The visual half*).
+> **`DEC-0007`** ranks the **engine**, not the channel's quality: WebKit (Safari) first,
+> Chromium a stated exception. `playwright` reaches WebKit and `chrome-devtools` does
+> not, so `playwright` on WebKit is the default look and `chrome-devtools` is reached for
+> when the question needs Chrome ([`browser.md`](browser.md) → *Engine order*).
 
 ## Contents
 
@@ -70,8 +74,8 @@ one must never look alike.
 | **Figma** (MCP) | stage 3 UX track, when the project designs visually — super-ux mirrors each `SCR-` screen/state into a frame | Optional, **UI + Figma-on only**. Absent → super-ux degrades to text-only *by itself and never blocks*, so shipping a UI feature with no mockups becomes a silent scope call — which is why the stage-0 sweep decides it | connect the Figma MCP server (`/mcp`, or your claude.ai connectors) |
 | **[obsidian-wiki](https://github.com/ar9av/obsidian-wiki)** (`wiki-query`, `wiki-update`) | **stage 0 harvest** (query what's already known) **+ stage 9 sync** | **Recommended** — never a gate; absent → harvest runs on repo docs alone | `pip install obsidian-wiki` → `obsidian-wiki setup --vault /path/to/your/vault` |
 | **[graphify](https://github.com/Graphify-Labs/graphify)** (`/graphify`, `graphify query`, `graphify affected`, `graphify god-nodes`) | **stage 0 harvest** (reach: what calls this, what breaks if it moves) **+ stage 9 refresh + the graph↔docs divergence check** ([`knowledge-graph.md`](knowledge-graph.md)) | **Recommended** — never a gate; absent → the harvest greps instead, and the divergence axis is unavailable | `uv tool install graphifyy` → `graphify install` → `/graphify .` |
-| **playwright** (CLI — `playwright-cli open`, `snapshot`, `click`, `type`, and the two this pipeline actually asks for: `console` and `requests`; or MCP — `browser_navigate`, `browser_snapshot`, `browser_click`, `browser_console_messages`, `browser_network_requests`) | **stages 5–6 on any project with a web front end**, and **stage 8** on a deployed target — the same job as the row below: open the surface, snapshot it, read the console and the network log. Its own difference is **the channel a look arrives on**: the CLI is a shell command, so it does not put a tool schema in the context window the way an MCP channel does — that is upstream's own comparison and it is *CLI against MCP*, which makes it a claim about this row's own two halves before it is a claim about the row below. Both channels default to an **accessibility-tree snapshot rather than pixels**, so the ordinary look costs a page of text and no vision model; `screenshot` exists in both and costs one when you ask for it | **Recommended** — never a gate; absent → say the surface was verified **by reading the diff** and treat that as the weaker claim it is | CLI: `npm install -D @playwright/cli@latest` → `npx playwright-cli --help` (or `npm i -g` for the global binary; `playwright-cli install --skills` adds its agent skills, `--global` to the home directory). MCP: `claude mcp add playwright npx @playwright/mcp@latest` |
-| **chrome-devtools** (MCP — `list_pages`, `navigate_page`, `take_snapshot`, `take_screenshot`, `evaluate_script`, `list_console_messages`, `list_network_requests`, `lighthouse_audit`, `performance_start_trace`, `take_heapsnapshot`) | **stages 5–6 on any project with a web front end** — verify the **rendered** surface rather than the diff: computed layout, console errors, failed requests. **Stage 8** on a deployed web target: load the page and read what the browser did, not what the deploy said. Its own difference is **reach past the page**: a Lighthouse category (`lighthouse_audit`, which `seo-aeo-audit` builds on) and a heap snapshot have no equivalent in the row above. A performance trace has one — `playwright-cli tracing-start` records one — but only this row's arrives with `performance_analyze_insight` over it | **Recommended** — never a gate; absent → say the surface was verified **by reading the diff** and treat that as the weaker claim it is | `/plugin install chrome-devtools-mcp@claude-plugins-official` (or connect the MCP server directly) |
+| **playwright** (CLI — `playwright-cli open`, `snapshot`, `click`, `type`, and the two this pipeline actually asks for: `console` and `requests`; or MCP — `browser_navigate`, `browser_snapshot`, `browser_click`, `browser_console_messages`, `browser_network_requests`) | **The default route — WebKit first** (`DEC-0007`): `playwright-cli open --browser webkit`, or the MCP started with `--browser webkit`; on macOS, Safari itself through `safaridriver` and Safari Web Inspector to debug ([`browser.md`](browser.md) → *Engine order*). **Stages 5–6 on any project with a web front end**, and **stage 8** on a deployed target — the same job as the row below: open the surface, snapshot it, read the console and the network log. Its own difference is **the channel a look arrives on**: the CLI is a shell command, so it does not put a tool schema in the context window the way an MCP channel does — that is upstream's own comparison and it is *CLI against MCP*, which makes it a claim about this row's own two halves before it is a claim about the row below. Both channels default to an **accessibility-tree snapshot rather than pixels**, so the ordinary look costs a page of text and no vision model; `screenshot` exists in both and costs one when you ask for it | **Recommended** — never a gate; absent → say the surface was verified **by reading the diff** and treat that as the weaker claim it is | CLI: `npm install -D @playwright/cli@latest` → `npx playwright-cli --help` (or `npm i -g` for the global binary; `playwright-cli install --skills` adds its agent skills, `--global` to the home directory), then `playwright-cli install-browser webkit`. MCP: `claude mcp add playwright -- npx @playwright/mcp@latest --browser webkit` |
+| **chrome-devtools** (MCP — `list_pages`, `navigate_page`, `take_snapshot`, `take_screenshot`, `evaluate_script`, `list_console_messages`, `list_network_requests`, `lighthouse_audit`, `performance_start_trace`, `take_heapsnapshot`) | **The stated Chromium exception** — it drives Chrome only, so it is reached for when the question needs Chrome, said with the reason, and a look taken only here is reported as *checked in Chromium*. **Stages 5–6 on any project with a web front end** — verify the **rendered** surface rather than the diff: computed layout, console errors, failed requests. **Stage 8** on a deployed web target: load the page and read what the browser did, not what the deploy said. Its own difference is **reach past the page**: a Lighthouse category (`lighthouse_audit`, which `seo-aeo-audit` builds on) and a heap snapshot have no equivalent in the row above. A performance trace has one — `playwright-cli tracing-start` records one — but only this row's arrives with `performance_analyze_insight` over it | **Recommended** — never a gate; absent → say the surface was verified **by reading the diff** and treat that as the weaker claim it is | `/plugin install chrome-devtools-mcp@claude-plugins-official` (or connect the MCP server directly) |
 | **[agent-sync](https://github.com/ssheleg/agent-sync)** (`/agent-sync`, **≥ 1.3.0** — `finish` did not exist before it, so an older install turns the stage-10 close-out into a command that is not there) | **guarded registers** — a lease before writing one, `reserve` before minting an id, `reconcile`/`record` for intent vs as-built, and `finish` for the stage-10 multi-repository close-out ([`documentation.md`](documentation.md)) | **Recommended** — never a gate. Absent → the run is **`ungated`** and must say so out loud; the discipline still applies, only the arbitration is missing | `npx sshlg-skills install` |
 | **sheleg-dev** (`stripe-billing`, `crypto-payments`, `error-tracking`, `ad-tracking`, `google-signin`, `google-auth`, `frontend-performance`) | **stage 5 when the task wires money, tracking, sign-in or page speed** — the seams a generated integration gets wrong in ways no screen shows: the webhook is the payment, a thank-you-page event cannot know the charge cleared, a duplicated `event_id` counts revenue twice | **Recommended** — never a gate; absent → the integration ships on the host's own doctrine and the close-out names the seam nobody checked | `/plugin marketplace add ssheleg/sheleg-dev` → `/plugin install sheleg-dev@sheleg-dev` |
 | **agent-stack** (`agent-orchestrator`, `agent-evals`, `agent-interop`, `agent-harness`) | **stage 5 when the thing being BUILT is an agent system** — the orchestrator's loop, evals that say whether it got better, the protocols it speaks (MCP/A2A), the wallet under LLM resale. Not for coordinating the agents editing this repository (that is agent-sync, above) | **Recommended** — never a gate; absent → the agent layer ships unevaluated and the close-out says so | `/plugin marketplace add ssheleg/agent-stack` → `/plugin install agent-stack@agent-stack` |
@@ -94,11 +98,11 @@ required; an absent one is a check recorded as NOT_RUN with its reason.
 | `review-animations`, `improve-animations` | reviews motion against its intent: timing, easing, interruption, reduced-motion fallback | stage 6, on a surface with motion; findings as triples |
 | `mobile-native` | the mobile-web surface: viewport, safe areas, touch targets, keyboard-up states | stages 5–6, mobile-web frames of the matrix |
 | `animate-expo` | React Native and Expo motion, built and reviewed on the platform's own primitives | stage 5, an RN or Expo surface |
-| `webapp-testing`, `chrome-devtools` (`take_screenshot`, `lighthouse_audit`) | the frames of the matrix at each viewport and theme, and a Lighthouse pass as the deterministic floor | stage 6, the capture and the floor; stage 8 on a deployed target |
+| `playwright-cli open --browser webkit` + `screenshot`, `webapp-testing`; `chrome-devtools` (`lighthouse_audit`, the stated Chromium exception) | the frames of the matrix at each viewport and theme, captured in WebKit first, and a Lighthouse pass as the deterministic floor | stage 6, the capture and the floor; stage 8 on a deployed target |
 | `accessibility-review`, `a11y-debugging` | accessibility review of the rendered surface and debugging what it finds | stage 6, beside axe or Lighthouse |
 | XCUITest `performAccessibilityAudit` | the iOS platform's own accessibility audit, run in UI tests | stage 6, a native iOS surface |
 | Compose `enableAccessibilityChecks` | Android's accessibility checks in Compose UI tests | stage 6, a native Android surface |
-| Playwright `toHaveScreenshot` | screenshot regression against the approved baseline, per state and theme | stage 6 (regression), and the nightly or release baseline after |
+| Playwright `toHaveScreenshot` | screenshot regression against the approved baseline, per state and theme — the `webkit` project first | stage 6 (regression), and the nightly or release baseline after |
 | axe-core | the deterministic accessibility floor of a web surface | stage 6, first in the cheap-first order |
 | `figma-code-connect` (Figma's public plugin skill) | maps a design-system component in the file to its code component, so `get_design_context` hands the agent the real import instead of approximated markup | stage 5, **offered** for a core component the file draws and nothing maps — publishes to the file, so it needs a go ([`build.md`](build.md) → *Code Connect, kept*) |
 
@@ -164,11 +168,12 @@ Pipeline companions (stage doctrine is built in — nothing to install for it):
                          (running without it — no reach queries, no graph↔docs
                           divergence check)
   ✗ playwright         — recommended when this project has a web front end.
-                         One of TWO channels that do the same look; either is
-                         enough, and a project that already runs Playwright has
-                         this one for free:
+                         The default look: it reaches WebKit (Safari's engine),
+                         which is checked first; a project that already runs
+                         Playwright has this one for free:
                            npm install -D @playwright/cli@latest   (then npx playwright-cli)
-                           claude mcp add playwright npx @playwright/mcp@latest
+                           playwright-cli install-browser webkit
+                           claude mcp add playwright -- npx @playwright/mcp@latest --browser webkit
                          (running without it — see the line below; without BOTH,
                           the surface is verified by reading the diff)
   ✗ sheleg-dev         — this task wires money, tracking, sign-in or page speed;
@@ -191,9 +196,9 @@ Pipeline companions (stage doctrine is built in — nothing to install for it):
   ✗ chrome-devtools    — recommended when this project has a web front end:
                          stages 5-6 check the RENDERED surface instead of the
                          diff, stage 8 reads what the browser did after a deploy.
-                         The other channel; it alone reaches lighthouse_audit
-                         and heap snapshots, and analyses a trace rather than
-                         only recording one:
+                         The stated Chromium exception: Chrome only, and it
+                         alone reaches lighthouse_audit and heap snapshots, and
+                         analyses a trace rather than only recording one:
                            /plugin install chrome-devtools-mcp@claude-plugins-official
                          (running without it — the surface is verified by reading
                           the diff, and the close-out says so in those words)
@@ -226,7 +231,8 @@ Rules:
   `wiki-query`/`wiki-update`. Present → say `✓ ready` and use it in the harvest.
   Absent → print the two install lines **once** and continue; never ask twice in a
   run and never block a stage on it ([`knowledge-sources.md`](knowledge-sources.md)).
-- **The browser channels — `playwright` and `chrome-devtools`, one rule for both.**
+- **The browser channels — `playwright` and `chrome-devtools`, one rule for both, WebKit
+  first.**
   Flag them only when the project **has a web front end** — an `index.html`, a
   `package.json` naming a browser framework, a `docs/ux/screens.md`, or a deploy target
   that serves pages. **A CLI, a library or a backend service does not flag either** —
@@ -237,18 +243,20 @@ Rules:
   `mcp__chrome-devtools__list_pages` (either one under whatever prefix the host uses).
   Present → `✓ ready`. Absent → print its install lines **once** and continue; neither
   is a gate.
-- **They are two channels for one look, and the run needs one of them, not both.**
-  Both open the page, snapshot it and read the console and the network log, so **stop
-  at the first one that answers** — running the same look twice is a cost with no
-  second fact. Where neither is present, say the surface was verified **by reading the
-  diff**; where both are, the tie-breakers are stated rather than left to taste:
-  **`playwright` when the project already runs it**, or when context budget is tight —
-  its own upstream sells the CLI on not loading large tool schemas and verbose
-  accessibility trees into the model context. **`chrome-devtools` when the question is
-  past the page** — a Lighthouse category or a heap snapshot, neither of which the
-  Playwright channel has, or a performance trace you want *analysed* rather than only
-  recorded. Neither is *the better
-  browser*, and a run that ranks them has invented a fact this matrix does not carry.
+- **They are two channels for one look, and the run needs one of them, not both —
+  on WebKit first** (`DEC-0007`, [`browser.md`](browser.md) → *Engine order*). Both open
+  the page, snapshot it and read the console and the network log, so the look is taken
+  once: **`playwright` with `--browser webkit`** (on macOS, Safari itself through
+  `safaridriver` is the same engine) — running the same look twice is a cost with no
+  second fact. **`chrome-devtools` is the stated Chromium exception**: it drives Chrome
+  only, so it is reached for when the question needs Chrome — a Lighthouse category or a
+  heap snapshot, neither of which the Playwright channel has, a performance trace you
+  want *analysed* rather than only recorded, or a Chrome-only API — and the verdict says
+  which and why. Where only `chrome-devtools` is present, the look is reported as
+  *checked in Chromium*, never as *tested in a browser*; where neither is, say the
+  surface was verified **by reading the diff**. The rank is of the **engine**, not of the
+  tools' quality: neither channel is *the better browser*, and a run that claims one is
+  has invented a fact this matrix does not carry.
 - **graphify**: detect via `graphify-out/graph.json` (built → `✓ ready`, query it in
   the harvest) or a resolving `graphify` binary with no `graphify-out/` (installed,
   not built → offer the one-line `/graphify .`). Absent → print the install lines

package/plugins/task-pipeline/skills/task-pipeline/references/continuity.md

@@ -97,7 +97,8 @@ This spans the whole run, not one stage:
   finished.
 
 It stops for exactly four things: an unmet `manual` gate, a block it cannot resolve, a
-genuine ambiguity the brief does not answer, and completion.
+genuine ambiguity the brief does not answer, and completion — the iteration's finish line
+reached ([`finish-line.md`](finish-line.md)), never a search that ran dry.
 
 **A block or an ambiguity stops its node, not the run.** An ambiguity whose answer is
 internal and reversible is not a stop at all: the run takes the recommended answer, records
@@ -112,6 +113,11 @@ recorded reasons: external waits go on watchers, human decisions go into the que
 batch. Exit 4 does not prove a human gate or completion. A watcher keeps the recorded
 next action alive while no independent node is runnable. **When the board is empty, say so once**, and do not invent work to fill it.
 
+**Stop is not idle.** A finish line reached closes that iteration — stages 9–10, the
+hand-back, the retro — and on an armed loop the highest-priority board row starts a new
+iteration with its own contract. Re-opening the closed one to polish it is not continuing
+([`finish-line.md`](finish-line.md) → *Stop is not idle*).
+
 **This extends [`build.md`](build.md); it does not replace it.** That file's
 *Continuous execution* rule governs the inside of a stage-5 execution — do not
 check in between the tasks of a plan you were told to execute. It is unconditional

package/plugins/task-pipeline/skills/task-pipeline/references/doctrine-map.md

@@ -59,6 +59,7 @@ Custom profiles use their own declared stages and doctrine, with the kernel inta
 | **first run in a project** (new or existing) | `references/adoption.md` |
 | **first run · the entry audit** (offered once) | `references/setup.md` |
 | **what travels with the bundle vs stays in a project** | `references/portability.md` |
+| 0–10 · when an iteration stops — the contract fixed at intake, triage at discovery, the round budget | `references/finish-line.md` |
 | any repeating loop | `references/loop-guard.md` |
 | run-wide · what the run **leaves running and leaves behind** — every gate, and stage 10 | `references/residue.md` |
 | run-wide · what the run **prints about itself** — the rail, the iteration line | `references/progress.md` |

package/plugins/task-pipeline/skills/task-pipeline/references/finish-line.md

@@ -0,0 +1,145 @@
+# The finish line — when an iteration stops
+
+An iteration stops when the work it promised is done **on the artefact the operator uses**.
+It does not stop when a search runs dry, because a search never does: every reading finds
+something, every fix is new surface for the next reading, and find → fix → find has no end of
+its own. This file is that end. The verdict is computed by `scripts/waves.py finish`.
+
+## Contents
+
+- The contract, fixed at intake
+- Triage at discovery
+- Rounds and the stop
+- Computing the verdict
+- Stop is not idle
+- The finish block
+- Rationalizations
+
+## The contract, fixed at intake
+
+The brief's `## Finish line` ([`../templates/brief.md`](../templates/brief.md)) carries five
+fields, written at stage 0 and confirmed with the brief:
+
+- **Objective** — one sentence: what is true when this iteration is done.
+- **Exit checks** — REQ ids, each with its command, run on the artefact the operator uses:
+  released, installed or deployed. A branch is not that artefact.
+- **Scope** — the modules, paths and REQ ids this iteration may change, as a list.
+- **Budget** — `run.finish.maxRounds` (default 3) and `run.finish.maxReleases` (default 2),
+  from `pipeline.json` ([`../pipeline.schema.json`](../pipeline.schema.json)).
+- **Base** — the commit the iteration started from.
+
+Widening the scope is a recorded revision of the brief, with the operator's go. A finding is
+not one.
+
+## Triage at discovery
+
+Every finding that reaches a round is classed when it is found, before anyone fixes it. First
+match wins. A defect in a node's own diff, caught before the node closes, follows
+[`review.md`](review.md) instead: Critical and Important block that node.
+
+**Blocking**, when:
+- **B1** — an exit check is red.
+- **B2** — it is, or once released would be, a hotfix-lane entry. The list's single home is [`iteration.md`](iteration.md)
+  → *No fix travels alone*; restated here, kept equal by the validator:
+  - production is down
+  - data is being lost or corrupted
+  - a credential has leaked
+  - a security hole is open to someone outside
+  - money or a legal obligation is failing
+- **B3** — the failing scenario passes at Base: this iteration broke it.
+- **B4** — a REQ marked `verified`, or a claim this iteration publishes, is false on the
+  artefact. A published claim beyond the REQs may instead be narrowed in the same change.
+
+**Deferred** — real, with a receipt, and no B test matches. It becomes a board row with its
+evidence, its priority inputs ([`prioritisation.md`](prioritisation.md)) and
+`found-in: <iteration>`. It is not fixed now.
+
+**Noise** — no reproducible receipt; a duplicate (append its evidence to the existing row); a
+Minor with no behavioural consequence; or an environment transient named by its cause. One
+ledger line, nothing else.
+
+Severity words, effort and "it is a one-line fix" never change the class. Each finding leaves
+one line in the run ledger ([`../templates/run.md`](../templates/run.md)):
+
+```
+finding: <id> — blocking:B<n> | deferred:B-NNN | noise — round <N> — base-repro yes|no|n/a
+```
+
+## Rounds and the stop
+
+A **round** is every exit check run once, plus one independent reading over the Scope: an
+audit axis, an observer, or the post-release readback. Rotating the axis
+([`audit.md`](audit.md)) never adds a round. Only new blocking findings count.
+
+- **Done** — every exit check green on the artefact, and two consecutive rounds with no new
+  blocking finding. The second of them may read only the last fix's diff.
+- **Diverging** — new blocking findings did not fall from one round to the next, or
+  self-inflicted ≥ new. Run [`loop-guard.md`](loop-guard.md)'s break protocol.
+- **Budget spent** — `maxRounds` or `maxReleases` reached before done: a blocker open, or the
+  second clean round still owed. Stop and hand the iteration back: each open blocker becomes a
+  top board row marked `needs-operator`. No round runs past the budget without the operator's
+  go, given with the numbers; a done reached past it without that go is still `budget`.
+
+The finish word is one of three: `done`; `budget`, the budget reached before done; `blocked`,
+the rounds diverging, handed to the loop guard. Deferred findings never extend an iteration.
+
+Each round leaves one ledger line, clean rounds included, because a clean round leaves no
+finding to count:
+
+```
+round: <N> — <reading> — new blocking <k>
+```
+
+## Computing the verdict
+
+```
+python3 scripts/waves.py finish --inventory <inventory.json> --ledger .task-pipeline/run.md \
+  --max-rounds 3 --max-releases 2 --releases <n> --checks <k>/<m> --artefact <name>@<sha>
+```
+
+`--rounds N` may stand in for `--ledger`; with neither the count is unknown and the script
+refuses. Exit codes:
+
+- `0` — done: the last two rounds found no new blocking item, none is open, and every exit
+  check is green on the artefact.
+- `3` — continue: a blocker open, a second clean round owed, or no `--checks` given.
+- `5` — budget: reached before done, or done past it without `--operator-go`.
+- `6` — blocked: diverging; run the loop guard's break protocol.
+- `1` — malformed: the inventory, the ledger or the arguments, each reason named.
+
+## Stop is not idle
+
+Reaching the finish line closes the iteration. It does not end the work.
+
+1. Close it: stages 9–10, the hand-back ([`progress.md`](progress.md) → *The hand-back*), the
+   retrospective.
+2. On an armed loop ([`continuity.md`](continuity.md)), take the highest-priority board row as a
+   **new** iteration with its own contract. Choose by priority, not recency: the row found last
+   is not next because it is fresh.
+3. Re-opening a closed iteration to polish it is the loop this rule ends.
+
+## The finish block
+
+Printed at stage 10, beside the verdict, and in the hand-back's `FINISH` field:
+
+```
+finish: done | budget | blocked — rounds <n>/<max> — releases <n>/<max>
+  exit checks: <k>/<m> green on <artefact>@<sha>
+  blocking: <n> open · <n> fixed
+  deferred: <n> → <ids, top priority first>
+  noise: <n>
+  known risks: <deferred rows at blast 3 or rung I4+, or none>
+  next: B-NNN (new iteration) | board empty
+```
+
+## Rationalizations
+
+| Excuse | Reality |
+|---|---|
+| "One more pass, it keeps finding things" | Every reading finds something. Only a new blocking finding argues for another round |
+| "It is a one-line fix, do it now" | Effort never changes the class. A deferred finding is a board row |
+| "This one is critical" | A severity word is not a B test. Name B1–B4, or defer it |
+| "Rotate the axis and keep going" | Rotation happens inside the round budget, never on top of it |
+| "The budget is nearly enough, one more round" | A round past the budget needs the operator's go, with the numbers |
+| "The deferred list is long, so we are not done" | Deferred findings never extend an iteration |
+| "Re-open the last iteration, it is nearly perfect" | That is the loop this rule ends. Take the top board row as a new iteration |

package/plugins/task-pipeline/skills/task-pipeline/references/iteration.md

@@ -36,7 +36,8 @@ A fix designed against today's state is the intermediate state that
 seam, and the fix is then paid for twice. The finding gets an id in its owning register
 and lands on a canvas node. Its wave decides when it is built.
 
-**The hotfix lane is the only exception, and it is closed.** It has five entries:
+**The hotfix lane is the only exception, and it is closed.** This list is its single home;
+[`finish-line.md`](finish-line.md)'s blocking test B2 cites it. It has five entries:
 - production is down;
 - data is being lost or corrupted;
 - a credential has leaked;
@@ -57,12 +58,12 @@ reason. "It is quick" is not one of the five entries.
 | 4 | Question round | answers from the sources, then one batch to the operator | every question is answered, assumed, or blocks a named node |
 | 5 | Plan | the work graph with waves and risk classes — `scripts/waves.py sync-graph` writes each node's `wave` and `risk` from the plan, so `graph.py close` enforces the rounds it owes — and one packet per node | every REQ lands on a node; [`planning.md`](planning.md)'s set comparison holds |
 | 6 | Build | parallel agents, each owning disjoint files | each node is committed on its branch, with its own checks green |
-| 7 | Verify | rounds per node, starting as each node lands | each node passes its risk class's rounds |
+| 7 | Verify | rounds per node, starting as each node lands; each finding triaged at discovery ([`finish-line.md`](finish-line.md)) | each node passes its risk class's rounds |
 | 8 | Seam check | cross-module checks per seam group | every seam the canvas names is exercised end to end |
 | 9 | Docs | stage 9 over everything the release iteration shipped | the doc gate passes and the docs match the code |
 | 10 | Release | versions, tags, pins, changelogs, in dependency order | the published artefacts resolve |
-| 11 | Post-release check | the stage-8 trio on what was released | every item the release claims closed is checked on the released artefact |
-| 12 | Next pool | the re-measured inventory and the proposal | the hand-back is sent |
+| 11 | Post-release check | the stage-8 trio on what was released, read as a finish-line round | every item the release claims closed is checked on the released artefact, and `finish:` is computed |
+| 12 | Next pool | the re-measured inventory and the proposal | the hand-back, with its `finish:` line, is sent |
 | 13 | Retrospective | the project retro, plus the shared lesson store where one exists | written last ([`retrospective.md`](retrospective.md)) |
 
 Steps 1–4 are stages 0–4 run once. Steps 6–8 are stages 5–8 per wave, and a wave's
@@ -218,7 +219,10 @@ actually published, installed or deployed — never on the branch. Each item the
 claims closed is re-checked against the released artefact. For installed packages and
 skills, follow [`deploy-targets.md`](deploy-targets.md) → *The verification trio*: update
 within the authorized rollout and read back each claimed installed channel. A failure goes to the hotfix
-lane if it is one of its five entries. Otherwise it goes to the next pool, with an id.
+lane if it is one of its five entries. Every post-release failure is triaged at the finish
+line ([`finish-line.md`](finish-line.md) → *Triage at discovery*): a blocking one is fixed in
+this release iteration, and the corrective release counts against `run.finish.maxReleases`; a
+deferred one goes to the next pool, with an id.
 
 ## The next pool
 

package/plugins/task-pipeline/skills/task-pipeline/references/loop-guard.md

@@ -101,6 +101,11 @@ review cap reached — 3 rounds — artifact: test/validate.py
 - **New > self-inflicted** — the reader is still paying. Continuing is then the
   operator's call, made with the numbers in hand rather than out of fatigue.
 
+At the level of a whole iteration only new **blocking** findings argue for continuing; a
+deferred or noise finding is paid for on the board, not with another round
+([`finish-line.md`](finish-line.md) → *Rounds and the stop*). The class is read from the
+run ledger's `finding:` lines and the rounds from its `round:` lines, never from memory.
+
 **The pair is the whole point.** A round count alone says how tired everyone is; the
 pair says whether the loop still produces anything. Measured on one file once, the
 guard's shapes and the run's own prose disagreed — one still paying, one exhausted —

package/plugins/task-pipeline/skills/task-pipeline/references/portability.md

@@ -64,6 +64,7 @@ a row pointing outside the bundle is the defect this file exists to catch.
 | The entry audit and what it inspects | `references/setup.md` |
 | The ladder, seams, axis rotation, ratchets | `references/audit.md` |
 | Loop detection and its caps | `references/loop-guard.md` |
+| **The finish line** — when an iteration stops: the contract, triage at discovery, the round budget | `references/finish-line.md` |
 | **What the run prints about itself** — the header block, the rail, the iteration line | `references/progress.md` |
 | **What the run leaves running and leaves behind** — the eight classes, the `holds:` field, the teardown | `references/residue.md` |
 | **The run mode** — item-by-item pacing, default off, what it never collapses | `references/continuity.md` |

package/plugins/task-pipeline/skills/task-pipeline/references/progress.md

@@ -169,6 +169,9 @@ SCOPE       what this claim covers: the commit, the environment, the REQ
 NOT VERIFIED what was built and NOT checked, or could not be. The literal
             `none within the stated scope` is a valid answer; an empty
             field is not
+FINISH      finish: done | budget | blocked — the finish block, as
+            finish-line.md prints it; mid-iteration, the round and
+            the open blocking count
 
 DECISIONS WAITING  <n>   each as a question with options, asked HERE
 AMBIGUITIES        <n>   computed, below
@@ -189,6 +192,11 @@ And `none within the stated scope` is a claim with a subject — it says *nothin
 what SCOPE names is unverified*. Leaving the field empty says nothing at all, which reads
 as the same thing and is not: canon 9a, one artifact over.
 
+**`FINISH` says why the iteration stopped** ([`finish-line.md`](finish-line.md) → *The
+finish block*): `done` with its exit checks green on the artefact, `budget` with each open
+blocker a `needs-operator` board row, or `blocked`. A hand-back that cannot fill it has not
+reached a finish line, and says which round it is in.
+
 **Where there is no brief** — `checkup`, `setup`, a short path — TASK quotes the
 operator's own sentence instead, marked as such. An unquotable TASK is a run that cannot
 say what it was asked, which is worth its own line.