task-pipeline-skill 1.97.1 → 1.99.0

package/plugins/task-pipeline/skills/task-pipeline/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: task-pipeline
-description: "Use when work changes the repository — feature, fix, bug, refactor, migration, integration, rewrite, adoption or hardening; фича, фикс, баг, рефактор, миграция, интеграция, доработать, починить, внедрить, перевести — or a finding that lands in it: audit/аудит, bug hunt/проверь ошибки, production check/проверь прод, PR review/ревью PR — or on 'run this through the pipeline'/'прогони по конвейеру', 'the full cycle'/'полный цикл', /task-pipeline. Runs a substantial task through gated stages: intake grill, docs, brainstorm, spec, plan, build, tests, deploy, post-deploy, docs/wiki, acceptance. 'waves'/'волнами'/'release iteration'/'итерация релиза' closes the board; 'checkup'/'чекап' lists unconfirmed releases; 'setup' audits docs. Not for: answering a question, explaining, a typo, a one-line edit, a rename, recon that lands nothing — say 'no pipeline'/'без пайплайна' to opt out."
+description: "Use when work changes the repository: feature, fix, bug, refactor, migration, integration, audit, PR review; фича, фикс, баг, рефактор, миграция, интеграция, аудит. Runs a substantial task through gated stages, intake grill to docs/wiki and acceptance; a small change takes a short path. 'waves'/'волнами' closes the board. Not for questions or one-line edits; 'без пайплайна' opts out."
 license: MIT
 compatibility: "Doctrine runs on any agent. The bundled scripts need python3; the run needs git. Missing either degrades, never blocks — the graph verbs and seeded gates go unused, and the run says so."
 ---
@@ -8,234 +8,171 @@ compatibility: "Doctrine runs on any agent. The bundled scripts need python3; th
 # task-pipeline
 
 Self-contained orchestrator. Runs a task through **gated stages**, each carrying its
-own built-in doctrine — no companion plugin required. Keeps the main thread
-disciplined: no stage advances until its gate passes; the whole run uses one model,
-confirmed before it starts.
-
-**Grill first, then run autonomously.** Stage 0 is **mandatory**, but it is a
-GAP CHECK before it is an interview: the brief is built from the request, the
-files and the harvest first, and a question is asked only for a **material
-unknown** the sources cannot answer. A complete brief yields ZERO intake
-questions; what the request or the project already decided is recorded, never
-re-negotiated. The interview, where gaps remain, is ONE batch ordered by dependency
-and sweeps stages 1→10 for anything that would stop the run later — then locks the
-answers into a brief. Autonomy is bought there or not at all; every MATERIAL
-question skipped at stage 0 comes back as an interruption at stage 6.
-
-**Config contract: [`pipeline.schema.json`](pipeline.schema.json).** A pipeline is
-a machine-readable config — an ordered list of stages, each with `skills[]` (the
-skills/agents that run it) and a `gate {type, check}`. The schema is the universal
-contract; it imposes **no** specific stages, skills, or gate assignments.
-[`pipeline.example.json`](pipeline.example.json) is a **copy-and-rewrite example**
-that encodes this plugin's own default flow (stage 0 intake + the 1→10 stages
-tabled below) and an optional, toggleable `release` block.
-
-**Two layers, and only one is replaceable.** The **KERNEL** is what every
-pipeline must carry no matter how few stages it has — for every unit of work:
-its **scope** (what it may change), its **evidence** (a claim carries its
-receipt), its **deps** (what it reads and what must precede it), and a
-**resume** point (it survives context loss). The kernel is invariant. The
-**PROFILE** is the STAGE LIST — how many stages, their names, their skills,
-their gates — and a project **replaces the profile wholesale** (any number of
-stages, its own skills/agents, its own gate types; see *Bring your own
-skills*). **The stage numbers belong to the SELECTED profile, never to the
-kernel:** a minimal three-stage profile has no "stage 7", and a rule keyed on a
-global stage number is a rule about the default profile, not about every
-pipeline. What a custom profile may drop is stages; what it may not drop is a
-kernel field. Each gate has a **type**: `auto` (the
-orchestrator verifies the `check` itself, pass/fail), `judgment` (no complete
-deterministic check exists — a named judge rules, and the ruling is recorded as
-judgement, never as a measurement; `references/gates.md` → *The judgment gate*)
-or `manual` (an explicit go, including specific standing authorization); which stages are manual is the
-operator's call. In the
-example's `skills[]`, `task-pipeline:<name>` denotes this skill's own built-in
-doctrine (`references/<name>.md`) and `host:<name>` denotes the host project's own
-command for that job (`references/conventions.md`); everything else is a real skill
-the environment resolves.
-
-## Prerequisites — none required
-
-**Every stage's doctrine ships inside this skill.** There is no required companion
-plugin, nothing to resolve at preflight and no version skew with someone else's
-repo. Stages 1 and 6–9 additionally run the *host's own* commands and optional
-tools, and **no stage blocks on an install** — stage 1 falls back to web search, the
-wiki and the code graph are recommendations. On user-facing tasks stage 3 requires
-a valid scenario artifact; the provider rule below governs equivalent providers
-and the inline fallback.
-
-Which reference owns which stage — all forty-odd of them, by stage number:
-[`references/doctrine-map.md`](./references/doctrine-map.md).
-
-**Precedence:** on a CUSTOM profile the **kernel wins** — scope, evidence, deps and resume are owed by every unit of work; `references/stages.md` is the **default profile's** normative gate set; the kernel is normative for all. Another skill set on stages 2/4/5/6: `references/companion-skills.md`.
-
-**super-ux — the preferred provider for ANY user-facing task.** The moment a task
-implies an interface (web / mobile / CLI / TUI), the WHY→UI→scenario chain runs
-through `/ux` and its linter, which belongs in the host's CI so UX drift cannot
-merge. **But the stage-3 gate checks the ARTIFACT, not the package**: valid
-scenarios covering the change — produced by super-ux, by an alternative provider
-honouring the same contract, or written inline against
-`references/companion-skills.md`'s fallback — pass the gate. What stops the gate
-is the ABSENCE of any scenario artifact: then create one (super-ux is the
-preferred way, the inline fallback is the floor), and a missing tool is reported
-as the NAMED check that was not done, never as a failed task.
-
-**The grill is built in and mandatory** (`references/grill.md`). No "clear enough task"
-exemption and no stage 1 without a committed, operator-confirmed brief. It produces the
-**REQ spine** — the request as an addressable list, each row naming how it is verified —
-which stages 3–5 trace to, stage 4 set-compares against, and **stage 10 accounts for
-every one of**, turning the pipeline from a funnel into a circle.
-
-**Harvest before you ask** (`references/knowledge-sources.md`). Stage 0 opens by
-pulling what the project already knows about *this* task, writes the source ledger
-into the brief, and then interviews **against** it — so the operator outranks any
-document, **but only out loud**, and an override is a recorded decision rather than
-an undetected divergence. That ledger is also stage 9's work list. Which sources,
-and the two ways the retro is read — standing instructions in full because they
-bind this run, the log queried because nothing caps it — are in
-`references/knowledge-sources.md` and `references/retrospective.md`.
-
-**Three artifacts close a run, not two — and they are a convergence, not a sequence.**
-Stage 9 syncs the docs, the wiki **and the code graph**; none consumes another, and the
-**graph↔docs divergence check is the gate over their convergence** — the only thing
-comparing two of the three against each other, so it is not optional where a graph
-exists. A stale graph is a false premise **carrying the authority of a machine**
-(`references/knowledge-graph.md`, `references/audit.md`).
-
-**Documentation is a deliverable, and it has a gate** (`references/documentation.md`).
-Stage 0 answers the four questions that make docs a *system* into `docs/DOCMAP.md`;
-from then the **Doc Loop** fires whenever anything is settled, at **any** stage rather
-than only at stage 9, the stage-9 sweep walks the **propagation matrix** — the harvest
-ledger names what you *read*, the matrix names what you *owe* — and *"docs in sync"*
-becomes a command with an exit code.
+own built-in doctrine; no companion plugin is required. No stage advances until its
+gate passes, and the whole run uses one model, confirmed before it starts.
+
+**Proportional, then autonomous.** Stage 0 is a **gap check** before it is an
+interview: the brief is built from the request, the files and the harvest, and a
+question is asked only for a **material unknown** the sources cannot answer. A
+complete brief yields ZERO intake questions; what the request or the project already
+decided is recorded, never re-negotiated. When the change is also small (R1 risk, at most five
+files, no public contract, no user-facing change, no deploy), the run **takes the short
+path by default** and says so in one line: brief in the run ledger, build with tests,
+one verification, docs and handoff, a retro entry only for a new lesson
+([`references/stage-00-intake.md`](references/stage-00-intake.md) → Phase 1d, which
+also names the triggers that bring a skipped stage back). Anything larger runs the
+full flow, with the interview, where gaps remain, as ONE batch that pre-resolves
+stages 1→10: every MATERIAL question skipped at stage 0 comes back as an interruption
+later.
+
+**Config contract: [`pipeline.schema.json`](pipeline.schema.json).** A pipeline is an
+ordered list of stages, each with `skills[]` and a `gate {type, check}`; the schema
+imposes no stages, skills or gate assignments.
+[`pipeline.example.json`](pipeline.example.json) is the copy-and-rewrite example of
+this plugin's default flow (stage 0 plus the 1→10 stages below) and an optional
+`release` block.
+
+**Two layers, and only one is replaceable.** The **KERNEL** is what every unit of
+work carries in any pipeline: its **scope**, its **evidence**, its **deps** and a
+**resume** point. The kernel is invariant. The **PROFILE** is the stage list, and a
+project replaces it wholesale. **The stage numbers belong to the SELECTED profile,
+never to the kernel:** a minimal three-stage profile has no "stage 7", and a rule
+keyed on a global stage number is a rule about the default profile. A custom profile
+may drop stages, never a kernel field. Each gate has a **type**: `auto` (the orchestrator verifies the
+`check`), `judgment` (a named judge rules, recorded as judgement, never as a
+measurement; `references/gates.md` → *The judgment gate*) or `manual` (an explicit go).
+**The
+default profile's gates are `auto`; a gate is `manual` only where the operator's
+`pipeline.json` says so, and a standing operator authorization naming the act counts
+as the go.** In `skills[]`, `task-pipeline:<name>` is this skill's own doctrine
+(`references/<name>.md`) and `host:<name>` the host project's own command
+(`references/conventions.md`).
+
+## Prerequisites: none required
+
+Every stage's doctrine ships inside this skill, and **no stage blocks on an install**:
+stage 1 falls back to web search, the wiki and the code graph are recommendations.
+Which reference owns which stage:
+[`references/doctrine-map.md`](./references/doctrine-map.md). **Precedence:** on a
+CUSTOM profile the **kernel wins**; `references/stages.md` is the **default
+profile's** normative gate set; the kernel is normative for all; another skill set on stages 2/4/5/6 is
+`references/companion-skills.md`.
+
+**super-ux is the preferred provider for ANY user-facing task**, and **the stage-3
+gate checks the ARTIFACT, not the package**: valid scenarios covering the change, from
+super-ux, an equivalent provider or the inline fallback in
+`references/companion-skills.md`, pass. The ABSENCE of any scenario artifact stops the
+gate; a missing tool is reported as the NAMED check that was not done, never as a
+failed task.
+
+**The grill is built in** (`references/grill.md`) and produces the **REQ spine**: the
+request as an addressable list, each row naming how it is verified, which stages 3–5
+trace to and **stage 10 accounts for every one of**. **Harvest before you ask**
+(`references/knowledge-sources.md`): stage 0 pulls what the project already knows,
+writes the source ledger, and checks every answer against it; the operator outranks a
+document **but only out loud**.
+
+**Three artifacts close a run and they converge:** stage 9 syncs the docs, the wiki
+and the code graph, and the graph↔docs divergence check is the gate over them where a
+graph exists (`references/knowledge-graph.md`). **Documentation is a deliverable with a
+gate** (`references/documentation.md`): `docs/DOCMAP.md`, the Doc Loop at any stage,
+the propagation matrix at stage 9, and *"docs in sync"* as a command with an exit code.
 
 **The run teaches the next run, and the list stays short**
-(`references/retrospective.md`). Every gate is good at *this* run and blind across
-runs, so one class of failure can be caught, fixed and forgotten five times with
-nothing noticing it is the same one. Stage 10's last act, **in this order and the
-order is load-bearing**: stamp the run, then prune, then write the entry — a
-retirement trigger counts firings across the last five stamps, so a prune placed
-ahead of the stamp reads a counter its own stage has not written yet. The cap, the
-triggers and what an entry must carry are in `references/retrospective.md`; why
-the order cannot be swapped is `references/learned.md` rule 21.
-
-Stage 0 reads those standing instructions in full, which is why the prune is a gate
-criterion: a rule nobody reads to the end is worse than no rule, because everyone
-believes it is covered.
-
-**At stage 0, read [grill.md](references/grill.md)** for domain awareness
-(`CONTEXT.md` / ADRs; write resolved terms back), the autonomy sweep (pre-resolve
-stages 1→10), and the Figma design destination (file and team per surface, settled
-before drawing, never invented by the drawing agent).
+(`references/retrospective.md`). Stage 10's last act, **in this order and the order is
+load-bearing**: stamp the run, then prune, then write the entry (`references/learned.md`
+rule 21). The floor stage 0 reads in full (standing instructions plus run stamps) has
+a **byte budget**: `scripts/retro_budget.py check` prints its bytes and bytes/4 tokens
+at stage 0, and gate 10 fails over budget until `migrate` moves the narrative to the
+archive, verbatim and hash-proved.
 
 ## How to run
 
-1. Restate the task in one line. Track each stage from 0 using the host task tool or a prose checklist (for resume). Then run the
-   **companion preflight** (`references/companion-skills.md`): the stage doctrine
-   is built in, so this only checks the *optional* companions (super-ux for UI
-   tasks, context7, wiki-update, graphify) and emits ONE block covering them
-   **and the model decision** (`references/model-tiering.md`): recommend
-   the most capable model available (advice), let the operator confirm or
-   override (the choice — inherited verbatim by plan, stages and subagents), record
-   it. Ask once, here. **The same block carries the run mode**
-   (`references/continuity.md`): read `pipeline.json` → `run.loop`; where it is
-   recorded, arm it **at the point `run.loop.arm` names** — here at preflight, or
-   at stage 2's close for `after-decomposition`, once the queue exists — and when
-   it arms, print the job id and the cancel command; the config is
-   the authorization, so re-asking rebuilds the habit it exists to retire. Where
-   it is **absent, the mode is off**; recommend it in one line and move on.
-   Silence arms nothing, and the mode never collapses a `manual` gate.
-2. **Run stage 0 — always, no exceptions.** It opens with the **knowledge harvest**
-   (`references/knowledge-sources.md`): query the project's own sources — repo docs,
-   ADRs, `docs/ux/`, past briefs, the wiki if installed, any doc repo the project
-   names — for this task's terms, and write the **source ledger** into the brief
-   before question one. Then grill until shared
-   understanding is reached, **each answer checked against the harvest**, the
-   autonomy sweep is covered, **the REQ table is
-   written (one row per independently verifiable deliverable, each naming its
-   check)** and the brief is locked
-   (`references/stage-00-intake.md`). Do not touch stage 1 before the brief is
-   committed and confirmed. **Entered from super-ux?**
-   (a validated `docs/ux/` chain and/or a `docs/ux/plans/…` fix plan already
-   exists — super-ux's `/ux` hands off here) → don't re-grill or rebuild the UX
-   chain: just check it's OK (`/ux-lint` green), confirm scope in one line, and
-   skip ahead to the first stage with real work (see `references/stage-00-intake.md`).
-3. Walk stages 1→10 on the model confirmed at preflight. **Don't re-ask about the
-   model at every boundary** — only when the operator recorded a per-stage override
-   map and the next stage's entry differs (`references/model-tiering.md`).
+1. Restate the task in one line, track each stage from 0 (host task tool or a prose
+   checklist, for resume), then emit the **preflight block** once: the model decision
+   (`references/model-tiering.md`: recommend the most capable model as advice, the
+   operator confirms or overrides, the choice — inherited verbatim by plan, stages and
+   subagents), the run mode (`pipeline.json` → `run.loop`,
+   `references/continuity.md`; absent means off, and the mode never collapses a
+   `manual` gate) and the optional companions: super-ux for UI tasks, context7,
+   wiki-update, graphify (`references/companion-skills.md`).
+2. **Run stage 0.** Harvest, then the gap check, then the proportional decision
+   (`references/stage-00-intake.md`). **Entered from super-ux** (a validated
+   `docs/ux/` chain or a `docs/ux/plans/…` fix plan exists)? Check `/ux-lint` green,
+   confirm scope in one line and skip to the first stage with real work.
+3. Walk the stages on the model confirmed at preflight; don't re-ask it per stage.
    **The SELECTED profile is compiled once, at preflight, and only ITS declared
-   stages and gates run** (FIX-TP-03.02): the numbers "1→10" name the DEFAULT
-   profile, and a custom profile with three stages runs three — no hidden stage
-   0, 7 or 10 is injected because the default profile has one. What a custom
-   profile does NOT escape is the KERNEL (03.01): dropping stages never drops
-   the evidence gate. And an unknown MANDATORY capability blocks the
-   compile — a profile whose `must_understand` names a capability this runtime
-   does not have is refused, never run with the capability silently absent.
-   **Is the brief a platform rather than a change?** Then stage 2 also cuts it into
-   modules (`references/decomposition.md`) and stages 3→10 run **per module** in
-   build order, one brick at a time — stages 0–2 run once, and the module map's
-   status column is the resume point (`references/stages.md` → *The program loop*).
-   **The whole board?** `/task-pipeline waves` (`references/waves.md`): stages
-   0–4 once, 5–8 per wave, 9–10 to close. **The project moves in releases**: the loop
-   around the waves — survey, module dossiers, one design, parallel build, checks that
-   start as each node lands, release, post-release check, next pool — is
-   `references/iteration.md`. A finding joins the inventory; it is not fixed alone.
-   **Findings are triaged when found, and the iteration stops at its finish line** —
-   exit checks green on the artefact, two rounds with no new blocking finding, or the
-   budget spent (`references/finish-line.md`).
-4. Do **not** advance until the stage **gate** passes (`references/stages.md`).
-   Honor the gate **type**: for `auto`, verify the gate's `check` yourself and
-   stop/return on fail; for `judgment`, record the named judge's ruling as
-   judgement, never as a measurement; for `manual`, present the result and cite the
-   **operator's explicit go or standing authorization naming this act**. Other gate
-   types and generic loop flags cannot supply that authority (`references/continuity.md`).
-5. **The cross-cutting rules fire at any stage**, not only here — the Doc Loop, the
-   loop guard, the audit's exit, the finish line, the frozen REQ list, the carry-over
-   ledger, and what counts as evidence, and **every gate prints `holds: N`** — what this run left
-   running, across all eight classes, enumerated by class and never by a single
-   tool — and stage 10 does not close while this run's residue is live and
-   unaccounted (`references/residue.md`). The rest are in
+   stages and gates run**: a custom profile with three stages runs three, and no
+   hidden stage 0, 7 or 10 is injected. What a custom profile does NOT escape is the
+   KERNEL: dropping stages never drops the evidence gate. And an unknown MANDATORY
+   capability blocks the compile: a `must_understand` capability this runtime lacks is
+   refused, never run with the capability silently absent. **A platform rather than a change?** Stage 2 cuts it into modules
+   (`references/decomposition.md`) and stages 3→10 run per module
+   (`references/stages.md` → *The program loop*). **The whole board?**
+   `/task-pipeline waves` (`references/waves.md`). **Releases:**
+   `references/iteration.md`; findings are triaged when found, and the iteration stops
+   at its finish line: exit checks green on the artefact and one round with no new
+   blocking finding (two for an R3 or flagship node), or the budget spent
+   (`references/finish-line.md`).
+4. Do **not** advance until the stage **gate** passes (`references/stages.md`). For
+   `auto`, verify the `check` yourself; for `judgment`, record the ruling as judgement;
+   for `manual`, cite the operator's go or the standing authorization naming this act.
+   **Loops stop:** an R1 node certifies with one blind tier and a clean round ends a
+   node unless it is R3 or flagship; the certification ceiling parks the node with its
+   evidence and moves on; no tier re-runs on unchanged input; the review loop caps at
+   three rounds (`references/certification.md`, `references/loop-guard.md`).
+5. **Cross-cutting rules fire at any stage** (the Doc Loop, the loop guard, the
+   audit's exit, the finish line, the frozen REQ list, the carry-over ledger, and
+   what counts as evidence), and every gate prints `holds: N` across all eight residue
+   classes; stage 10 does not close while this run's residue is live
+   (`references/residue.md`). Their long form is
    [`references/gates.md`](references/gates.md) → *Cross-cutting, at every stage*.
 
+## What to read, and when
+
+At entry read **this file only**; its stage table below is the stage index. Each
+stage's detail is read **when that stage starts** (`references/stages.md` routes it,
+one section at a time; never preload all details). The rest loads on its trigger:
+
+| Reference | Read when |
+|---|---|
+| `references/grill.md` | the gap check leaves a material unknown |
+| `references/knowledge-sources.md` | a source needs more than its ledger row: the code graph, the wiki, a lesson store, a carried-in claim, a stale row |
+| `references/companion-skills.md` | a user-facing task (the provider rule), a substituted skill set, or a companion is missing |
+| `references/continuity.md` | `run.loop` is armed, a context-budget signal arrives, or a run resumes |
+| `references/model-tiering.md` | the operator overrides the model, or a stage map differs |
+| `references/gates.md` | you write or change a check, a gate's verdict is disputed, or a judgment gate runs |
+
 ## Stages (gates and routes in `references/stages.md`)
 
-All stages run on the **one model confirmed at preflight** (default: the most
-capable available — see `references/model-tiering.md`).
+All stages run on the **one model confirmed at preflight**.
 
 | # | Stage | Gate | Type |
 |---|---|---|---|
-| 0 | Intake grill — **mandatory** | source ledger written with its `Contradictions:` line; `docs/DOCMAP.md` answered and intent reconciled against as-built; the retro read in full; autonomy sweep covered; UI: `surface_class` recorded; brief locked and confirmed | manual |
+| 0 | Intake grill — **mandatory** | source ledger written with its `Contradictions:` line; `docs/DOCMAP.md` answered and intent reconciled against as-built; the retro floor read in full, its bytes printed; autonomy sweep covered; UI: `surface_class` recorded; brief locked and confirmed | auto |
 | 1 | Docs study | contracts grounded on fetched docs | auto |
-| 2 | Brainstorm + decompose | design approved; UI verdict recorded; every REQ answered; **the queue is an artifact** — a work graph validates and its coverage names no unserved REQ; platform: module map approved | manual |
-| 3 | Spec | committed + reviewed; UI: chain validated, linter green, scenarios and `SCR-` traced; COPY and VISUAL are a parallel layer after UX, and where both ran their convergence check is recorded; VISUAL is checked by its director record | manual |
+| 2 | Brainstorm + decompose | design approved; UI verdict recorded; every REQ answered; **the queue is an artifact** — a work graph validates and its coverage names no unserved REQ; platform: module map approved | auto |
+| 3 | Spec | committed + reviewed; UI: chain validated, linter green, scenarios and `SCR-` traced; COPY and VISUAL are a parallel layer after UX, and where both ran their convergence check is recorded; VISUAL is checked by its director record | auto |
 | 4 | Plan | parallel-ready, DoD per task; **every edge names what it carries** — the fake-edge test run and its `Edges:` count computed; **`scripts/plan_audit.py` clean** — every live node's packet survives a cold reader, and no two unordered nodes edit one file | auto |
 | 5 | Dev | tasks DONE, TDD green per task, branch integrated per the brief; a fanned-out group gets **one convergence check over all its diffs together** before the first worktree lands | auto |
 | 6 | Tests | full suite green, new and changed code covered, every new check probed both ways and asserted on its exit code; **a web surface is checked in a browser, not in the diff** — where a browser channel is connected; absent, the weaker claim is recorded; a gated surface's contact sheet passes | auto |
-| 7 | Lint + deploy | lint clean and suite green before deploy; deploy needs a go, or the brief's specific standing authorization | manual |
+| 7 | Lint + deploy | lint clean and suite green before deploy; deploy needs a go, or the brief's specific standing authorization | auto |
 | 8 | Post-deploy | clean boot or an honest degradation report; **a deployed web target is opened, not curled** — a `200` proves the server answered and nothing else; where no browser channel is connected, the weaker claim is recorded | auto |
 | 9 | Docs + wiki | every stale row of the stage-0 source ledger updated; the propagation matrix walked for every change type this run produced; the documentation gate green with its ratchets printed; docs, wiki and the code graph synced and checked against each other | auto |
-| 10 | **Acceptance** | the ladder walk ran and its absences became REQ rows; every REQ accounted for with evidence from a check seen failing once; no unresolved ledger row; **every repository clean, pushed and pointed at**; the hand-back written and the environment given back; the retrospective written **last**, and in order | manual |
-
-**Every gate above is the short form**, and the long form is the point of
-[`references/stages.md`](references/stages.md) — one gate and exact detail route per
-default stage. Before work on entry or resume, read that stage’s routed detail,
-including waves and approved short paths; never preload all details. CUSTOM
-profiles use their own declared doctrine; matching numeric ids do not select
-default details. Full obligations stay in the spine and the selected detail.
+| 10 | **Acceptance** | the ladder walk ran and its absences became REQ rows; every REQ accounted for with evidence from a check seen failing once; no unresolved ledger row; **every repository clean, pushed and pointed at**; the hand-back written and the environment given back; the retrospective written **last**, in order and within its byte budget | auto |
 
-**Several repositories?** A submodule is finished when its parent says so — a clone
-can still get the commit before it while neither repository looks wrong alone. The
-commands that prove it are in
+**Every gate above is the short form**; the long form is
+[`references/stages.md`](references/stages.md). CUSTOM profiles use their own declared
+doctrine; matching numeric ids do not select default details. **Several
+repositories?** A submodule is finished when its parent says so:
 [`references/acceptance.md`](references/acceptance.md) → *A project of several
 repositories*.
 
-## Model — ask once, at preflight
+## Model: ask once, at preflight
 
-Recommend **the most capable reasoning model available** — a tier resolved at
-runtime, **never a hardcoded id**; stage configs use `default` / `inherit`. The
-block to emit is `references/model-tiering.md` → *Mechanic*, and it is a
-reminder: no such tier means say which one is in use and continue. Record the
-answer in the brief, don't re-ask per stage; stage-5 subagents are pinned to it
-automatically.
+Recommend **the most capable reasoning model available**, a tier resolved at runtime,
+**never a hardcoded id** (`references/model-tiering.md` → *Mechanic*). Record the
+answer in the brief; stage-5 subagents are pinned to it.
 
 ## Degradation
 
@@ -245,31 +182,26 @@ automatically.
 
 ## Bring your own skills
 
-The stages above are the **example** flow. A host project owns its pipeline: copy
-`pipeline.example.json` → `pipeline.json`, define its **own** stages (any count),
-point each `skills[]` at what its environment resolves, set each `gate.type`
-(`auto`/`judgment`/`manual`) to fit its process, and toggle its own `release`
-block. The
-framework ships no fixed stage count and no opinion on which gates are manual —
-`pipeline.schema.json` is the only contract.
+The stages above are the **example** flow. A host copies `pipeline.example.json` →
+`pipeline.json`, defines its own stages (any count), points each `skills[]` at what its
+environment resolves, sets each `gate.type` (`auto`/`judgment`/`manual`) and toggles its
+own `release` block. `pipeline.schema.json` is the only contract.
 
 ## References
 
-Most references are routed from the **Built-in doctrine** table above, keyed by
-the stage that sends you there. The rest are routed by prose: `stages.md` (named
-at every stage of *How to run*), `learned.md` (cited where a rule binds) and
-`probing.md` (from `gates.md`, whose checks it proves). The config contracts sit
-beside this file: `pipeline.schema.json` and `pipeline.example.json`. The
-family's task/context contract sits there too: `execution-packet.schema.json`
-with `execution-packet.example.json` — an immutable, content-addressed packet
-per dispatchable unit of work, validated dependency-free by
-`scripts/packet.py` before anything acts on it (an unknown mandatory version,
-a ref without its digest, or an unbound decision is rejected at the door) —
-and its answer half, `execution-result.schema.json` with
-`execution-result.example.json`: an AttemptGrant that a boolean can never
-substitute for, and a ResultEnvelope whose stale candidate (older revision, or
-a superseded fence) re-plans instead of landing as current
-(`scripts/packet.py validate-result`). The compiler's first stage maps an
-audit report onto parent tasks (`scripts/context_packets.py compile|verify`):
-ids derived from finding ids, never positional; evidence, limits and priority
-kept apart from status; and any row it cannot map blocks the compile.
+Most references are routed from `references/doctrine-map.md` by stage. The rest are
+routed by prose: `stages.md`, `learned.md` (cited where a rule binds) and `probing.md`
+(from `gates.md`). Beside this file: the config contracts, and the family's
+task/context contract, `execution-packet.schema.json` and `execution-result.schema.json`
+with their examples, validated dependency-free by `scripts/packet.py` (an unknown
+mandatory version, a ref without its digest, or an unbound decision is rejected; a stale
+result re-plans instead of landing). `scripts/context_packets.py compile|verify` maps an
+audit report onto parent tasks: ids derived from finding ids, never positional, and any
+row it cannot map blocks the compile.
+
+## Triggers
+
+The description is the short form. The full trigger list it carried until 1.98.0,
+moved here verbatim, still routes to this skill:
+
+"Use when work changes the repository — feature, fix, bug, refactor, migration, integration, rewrite, adoption or hardening; фича, фикс, баг, рефактор, миграция, интеграция, доработать, починить, внедрить, перевести — or a finding that lands in it: audit/аудит, bug hunt/проверь ошибки, production check/проверь прод, PR review/ревью PR — or on 'run this through the pipeline'/'прогони по конвейеру', 'the full cycle'/'полный цикл', /task-pipeline. Runs a substantial task through gated stages: intake grill, docs, brainstorm, spec, plan, build, tests, deploy, post-deploy, docs/wiki, acceptance. 'waves'/'волнами'/'release iteration'/'итерация релиза' closes the board; 'checkup'/'чекап' lists unconfirmed releases; 'setup' audits docs. Not for: answering a question, explaining, a typo, a one-line edit, a rename, recon that lands nothing — say 'no pipeline'/'без пайплайна' to opt out."

package/plugins/task-pipeline/skills/task-pipeline/graph.schema.json

@@ -208,7 +208,7 @@
         },
         "risk": {
           "enum": ["R1", "R2", "R3"],
-          "description": "The node's risk class (`references/iteration.md` → *Verification starts when a node lands*), computed from what it touches and never lowered to save time. It sets how many PASSING certification rounds the node owes (a failed round counts for nothing): R1 one, R2 two, R3 three, one of them recorded adversarial (`certify --kind adversarial`). A round is the three blind tiers plus one fix cycle. Absent outside wave mode or a release iteration. `graph.py close` refuses a node until the rounds its class owes have passed."
+          "description": "The node's risk class (`references/iteration.md` → *Verification starts when a node lands*), computed from what it touches and never lowered to save time. It sets how many PASSING certification rounds the node owes (a failed round counts for nothing): R1 one (with one blind tier), R2 one, R3 two, one of them recorded adversarial (`certify --kind adversarial`); a flagship surface owes two, one adversarial. A round is the blind tiers the class owes (three; one on R1) plus one fix cycle. Absent outside wave mode or a release iteration. `graph.py close` refuses a node until the rounds its class owes have passed."
         },
         "wave": {
           "type": "integer",

package/plugins/task-pipeline/skills/task-pipeline/pipeline.example.json

@@ -17,8 +17,8 @@
         "task-pipeline:grill"
       ],
       "gate": {
-        "type": "manual",
-        "check": "MANDATORY stage — never skipped (only sanctioned bypass: the entry-from-super-ux short-circuit). PHASE 1, before the first question: harvest the knowledge sources (references/knowledge-sources.md) — code, THE CODE GRAPH when one is built (references/knowledge-graph.md: graphify query/affected/god-nodes answer reach, which grep cannot; detect graphify-out/graph.json — recommended, never required), CLAUDE.md/AGENTS.md, CONTEXT.md + docs/adr, docs/ + docs/ux, past pipeline briefs and carry-over ledgers, THE RETRO'S STANDING INSTRUCTIONS (docs/evidence/retro.md — read IN FULL, not queried: they are capped at ten and they BIND this run; stamp each one the moment it fires, since that date is the only evidence behind stage 10's cold-retirement rule — references/retrospective.md), the knowledge wiki when installed (obsidian-wiki — recommended, never required; detect ~/.obsidian-wiki/config), and any other repo or hosted doc system the project names as its docs — queried by this task's own terms, with the SOURCE LEDGER written into the brief (a row per source consulted, or an explicit 'none found'; THE GRAPH'S ROW CARRIES ITS MEASURED LAG — commits and days behind HEAD, the signal it was measured with (built_at_commit exact / mtime approximate / unresolvable), and the marker '⚠ not trusted for reach until refreshed' — that exact string, so one marker is greppable across every ledger — on anything but current. A bare build date does NOT satisfy this: it is the graph's own reply about itself, true and self-reported and silent about whether the graph describes the tree this run is about to change — references/knowledge-graph.md -> Measure the lag, and references/gates.md -> False success for the class). PHASE 2, the grill, built into the skill (references/grill.md) — no companion to install. Per its contract: close what the code/docs answer first, then ONE batch of the material unknowns ordered by dependency, a recommended answer with each (one at a time only where answers depend on each other or the operator asks), contradictions reconciled; EVERY answer that touches a harvested source is validated against that source — the operator outranks any document, but only out loud, and the losing side is logged for the stage-9 doc update; domain awareness applied (terms challenged against CONTEXT.md, ADRs recorded for hard-to-reverse calls). The autonomy sweep is covered — every stage 1-10 has its blockers pre-resolved (docs sources, branch/tracker policy, test + lint commands, deploy target and authorization, log/health locations, docs+wiki targets, and for UI tasks the design surface: Figma on or text-only, is the Figma MCP connected, and if it is not — ship text-only or stop and connect it, since the UX chain degrades on its own and never blocks; plus, with Figma on, the DESIGN DESTINATION — which team/org by name and which file per surface, App / Web / ASO (the recorded one, a URL the operator gives, or creation in that named team with the creation explicitly authorized), written into the project's canonical record before the first frame, and never created while a recorded file resolves — an unreachable recorded file means stop and ask, never make a replacement) or is explicitly marked 'stop and ask here'. UI verdict recorded (arms super-ux), and for a user-facing task its SURFACE CLASS — surface_class: flagship | product | internal | ad — which selects the visual gate profile for stages 3, 6 and 10 (references/stages.md -> The surface class); model decision recorded. All of it locked into a committed task brief the operator confirms before stage 1. The REQ table is written — one row per independently verifiable deliverable, each naming how it is verified — and frozen: adding later is free, removing or narrowing needs the operator's explicit agreement. The carry-over ledger is seeded. PHASE 1b, THE DOCUMENTATION INVENTORY (references/documentation.md): four questions answered into docs/DOCMAP.md before the interview — where settled things live (the DECISION HOME, and there is exactly one per project: an existing docs/adr/ IS the register and is recorded as such, never duplicated), what each fact's single home is, what a change of type X obliges (THE PROPAGATION MATRIX, non-empty, every row naming the check that enforces it or the word 'review' with a one-line reason), and what proves it (the gate command). A project with no answers gets them seeded — registers, matrix and scripts/check-docs.sh from the skill's templates — and the seeding is recorded as the register's first entry; the seeded gate must exit 0 on its own seeds, because a project that starts red teaches everyone on day one that the gate is noise. The regime is recorded. PHASE 1c, RECONCILE: git says how it should be, the run record says how it turned out — read both for the area about to be touched and resolve every divergence (the document is stale, the record is wrong, or they genuinely disagree and that is a decision), because starting on an unresolved divergence means building against a system that does not exist. The retro's in-force sections are read IN FULL and its archive is QUERIED by the task's nouns."
+        "type": "auto",
+        "check": "MANDATORY stage — never skipped (only sanctioned bypass: the entry-from-super-ux short-circuit). PHASE 1, before the first question: harvest the knowledge sources (references/knowledge-sources.md) — code, THE CODE GRAPH when one is built (references/knowledge-graph.md: graphify query/affected/god-nodes answer reach, which grep cannot; detect graphify-out/graph.json — recommended, never required), CLAUDE.md/AGENTS.md, CONTEXT.md + docs/adr, docs/ + docs/ux, past pipeline briefs and carry-over ledgers, THE RETRO'S STANDING INSTRUCTIONS (docs/evidence/retro.md — read IN FULL, not queried: they are capped at ten and they BIND this run; stamp each one the moment it fires, since that date is the only evidence behind stage 10's cold-retirement rule — references/retrospective.md), the knowledge wiki when installed (obsidian-wiki — recommended, never required; detect ~/.obsidian-wiki/config), and any other repo or hosted doc system the project names as its docs — queried by this task's own terms, with the SOURCE LEDGER written into the brief (a row per source consulted, or an explicit 'none found'; THE GRAPH'S ROW CARRIES ITS MEASURED LAG — commits and days behind HEAD, the signal it was measured with (built_at_commit exact / mtime approximate / unresolvable), and the marker '⚠ not trusted for reach until refreshed' — that exact string, so one marker is greppable across every ledger — on anything but current. A bare build date does NOT satisfy this: it is the graph's own reply about itself, true and self-reported and silent about whether the graph describes the tree this run is about to change — references/knowledge-graph.md -> Measure the lag, and references/gates.md -> False success for the class). PHASE 2, the grill, built into the skill (references/grill.md) — no companion to install. Per its contract: close what the code/docs answer first, then ONE batch of the material unknowns ordered by dependency, a recommended answer with each (one at a time only where answers depend on each other or the operator asks), contradictions reconciled; EVERY answer that touches a harvested source is validated against that source — the operator outranks any document, but only out loud, and the losing side is logged for the stage-9 doc update; domain awareness applied (terms challenged against CONTEXT.md, ADRs recorded for hard-to-reverse calls). The autonomy sweep is covered — every stage 1-10 has its blockers pre-resolved (docs sources, branch/tracker policy, test + lint commands, deploy target and authorization, log/health locations, docs+wiki targets, and for UI tasks the design surface: Figma on or text-only, is the Figma MCP connected, and if it is not — ship text-only or stop and connect it, since the UX chain degrades on its own and never blocks; plus, with Figma on, the DESIGN DESTINATION — which team/org by name and which file per surface, App / Web / ASO (the recorded one, a URL the operator gives, or creation in that named team with the creation explicitly authorized), written into the project's canonical record before the first frame, and never created while a recorded file resolves — an unreachable recorded file means stop and ask, never make a replacement) or is explicitly marked 'stop and ask here'. UI verdict recorded (arms super-ux), and for a user-facing task its SURFACE CLASS — surface_class: flagship | product | internal | ad — which selects the visual gate profile for stages 3, 6 and 10 (references/stages.md -> The surface class); model decision recorded. All of it locked into a committed task brief, confirmed before stage 1 by the operator's answer or by the standing authorization recorded in it; a small change (the short-path triage) writes the brief into the run ledger instead and goes straight to stage 5. The REQ table is written — one row per independently verifiable deliverable, each naming how it is verified — and frozen: adding later is free, removing or narrowing needs the operator's explicit agreement. The carry-over ledger is seeded. PHASE 1b, THE DOCUMENTATION INVENTORY (references/documentation.md): four questions answered into docs/DOCMAP.md before the interview — where settled things live (the DECISION HOME, and there is exactly one per project: an existing docs/adr/ IS the register and is recorded as such, never duplicated), what each fact's single home is, what a change of type X obliges (THE PROPAGATION MATRIX, non-empty, every row naming the check that enforces it or the word 'review' with a one-line reason), and what proves it (the gate command). A project with no answers gets them seeded — registers, matrix and scripts/check-docs.sh from the skill's templates — and the seeding is recorded as the register's first entry; the seeded gate must exit 0 on its own seeds, because a project that starts red teaches everyone on day one that the gate is noise. The regime is recorded. PHASE 1c, RECONCILE: git says how it should be, the run record says how it turned out — read both for the area about to be touched and resolve every divergence (the document is stale, the record is wrong, or they genuinely disagree and that is a decision), because starting on an unresolved divergence means building against a system that does not exist. The retro's in-force sections are read IN FULL and its archive is QUERIED by the task's nouns."
       }
     },
     {
@@ -45,8 +45,8 @@
         "task-pipeline:decomposition"
       ],
       "gate": {
-        "type": "manual",
-        "check": "the user approves the design AND the UI verdict is recorded (does the task touch a user-facing surface — web/mobile/CLI/TUI? this arms the stage-3 UX track). Every REQ is answered by the design, or explicitly dropped by the operator into the carry-over ledger. For a platform (several independent capabilities or shippable surfaces): the module map specs/<topic>-modules.md is committed and approved — brick criteria met or excepted in writing, dependency graph acyclic, build order topological with the walking skeleton first, every REQ mapped to exactly one module, cross-module contracts named with their owner. Single-module work records 'single module: <name>' instead — a skipped decomposition is a recorded decision, never an omission. THE LOOP'S ARMING STATE IS PRINTED — armed with its queue and pacing, or not armed with the reason; the queue exists at this stage and a loop armed earlier has nothing to walk."
+        "type": "auto",
+        "check": "the design is approved (the operator's go, or the standing authorization recorded in the brief) AND the UI verdict is recorded (does the task touch a user-facing surface — web/mobile/CLI/TUI? this arms the stage-3 UX track). Every REQ is answered by the design, or explicitly dropped by the operator into the carry-over ledger. For a platform (several independent capabilities or shippable surfaces): the module map specs/<topic>-modules.md is committed and approved — brick criteria met or excepted in writing, dependency graph acyclic, build order topological with the walking skeleton first, every REQ mapped to exactly one module, cross-module contracts named with their owner. Single-module work records 'single module: <name>' instead — a skipped decomposition is a recorded decision, never an omission. THE LOOP'S ARMING STATE IS PRINTED — armed with its queue and pacing, or not armed with the reason; the queue exists at this stage and a loop armed earlier has nothing to walk."
       }
     },
     {
@@ -64,8 +64,8 @@
         "task-pipeline:spec"
       ],
       "gate": {
-        "type": "manual",
-        "check": "UX track ran FIRST for user-facing tasks (/ux -> ux-foundation CJM -> ux-flows screens -> ux-scenarios -> /ux-lint green); spec committed and user-reviewed; every user-facing requirement traces to a scenario ID. Every spec section carries covers: REQ-... and every REQ appears in at least one section. With Figma on: the destination the brief named was used — the canonical record (docs/ux/foundation.md -> Design tooling) names one file per surface (App, Web, ASO), no file was created while a recorded one resolved, and every screens.md frame link's :fileKey is one of the recorded set (a string match, not a judgement — scripts/visual_gate.py filekeys; a key outside the set means the run drew in a file nobody recorded and nobody will open). COPY and VISUAL are a parallel layer after UX: every user-facing string went through the COPY track or the refusal is recorded, the visual layer went through the VISUAL track or the refusal is recorded — and on a flagship, product or ad surface the VISUAL track is checked by its TRACE, not by the fact it ran: the director record at docs/design/<surface>/director-record.md carries the fields its surface_class owes ('scripts/visual_gate.py record <file> --class <surface_class>' exits 0; sheleg-design's own --check-record validator runs where installed and reads NOT_RUN, never PASS, where it is not; 'Mode: declined' with its reason is the refusal and passes), and where both tracks ran their convergence check is recorded - findings with the ruling, or 'Tracks converge: clean'."
+        "type": "auto",
+        "check": "UX track ran FIRST for user-facing tasks (/ux -> ux-foundation CJM -> ux-flows screens -> ux-scenarios -> /ux-lint green); spec committed and reviewed (by the operator, or under the brief's standing authorization by an independent reader); every user-facing requirement traces to a scenario ID. Every spec section carries covers: REQ-... and every REQ appears in at least one section. With Figma on: the destination the brief named was used — the canonical record (docs/ux/foundation.md -> Design tooling) names one file per surface (App, Web, ASO), no file was created while a recorded one resolved, and every screens.md frame link's :fileKey is one of the recorded set (a string match, not a judgement — scripts/visual_gate.py filekeys; a key outside the set means the run drew in a file nobody recorded and nobody will open). COPY and VISUAL are a parallel layer after UX: every user-facing string went through the COPY track or the refusal is recorded, the visual layer went through the VISUAL track or the refusal is recorded — and on a flagship, product or ad surface the VISUAL track is checked by its TRACE, not by the fact it ran: the director record at docs/design/<surface>/director-record.md carries the fields its surface_class owes ('scripts/visual_gate.py record <file> --class <surface_class>' exits 0; sheleg-design's own --check-record validator runs where installed and reads NOT_RUN, never PASS, where it is not; 'Mode: declined' with its reason is the refusal and passes), and where both tracks ran their convergence check is recorded - findings with the ruling, or 'Tracks converge: clean'."
       }
     },
     {
@@ -120,7 +120,7 @@
         "host:deploy"
       ],
       "gate": {
-        "type": "manual",
+        "type": "auto",
         "check": "lint clean and full suite green before deploy; deploy is outward and needs explicit operator go — or the specific standing authorization recorded in the stage-0 brief (named target + named preconditions; a vague 'do everything' is not one). No REQ is still open; a partial ships only with the operator's explicit acceptance."
       }
     },
@@ -166,8 +166,8 @@
         "task-pipeline:retrospective"
       ],
       "gate": {
-        "type": "manual",
-        "check": "Close the circle. FIRST the LADDER WALK (references/audit.md), because the REQ table can only find what was named and lost — a comparison needs two sides and an absence has one: walk each REQ bottom-up through its rungs (decision -> spec section -> contract AND its failure behavior -> plan task -> change -> executed test -> surface/docs), check the seam at each step — and where the VISUAL track ran, the row visual intent (the director record) <-> final render (the APPROVED contact sheet: 'visual_gate.py sheet ... --require-approval' exits 0 on flagship, product or ad), with the review rounds it took copied from the run ledger's review: lines into the acceptance file — order findings BY SEAM not by file, and turn every absence into a new REQ row with its check BEFORE the table is written; findings belonging to a lower layer go back to that layer (spec -> stage 3, plan -> stage 4); record the pass's two counts (new findings vs findings caused by this run's own fixes) so the next pass can tell whether the axis is exhausted. THEN the coverage table: every REQ has a status (verified / partial / deferred / dropped) — none unknown; every verified carries evidence (a passing test name, file:line, a command and its output, or a scenario ID) — 'done' without evidence is downgraded to partial, not upgraded, and a green from a check nobody has watched fail against a planted defect is not evidence at all; every partial names what is missing and where it is tracked; every deferred/dropped has the operator's agreement and, for deferred, a tracker entry; no carry-over row is left unresolved and the ledger's counts are printed beside this verdict, so 'green' never reads as 'verified'; EVERY REPOSITORY IS CLOSED, THE PARENT INCLUDED — a submodule is finished only when its parent points at it, so 'git submodule status' shows no line starting with '+' and every repo is clean and pushed ('git -C <repo> status --porcelain' and 'git -C <repo> log @{u}..HEAD' both empty), because a parent records a submodule as a pointer to one commit and moving the submodule does not move the pointer: neither repo looks wrong alone and the disagreement survives every check that runs inside one; and the operator answers the closing question — here is what you asked for, here is what shipped, here is what is deferred, what is missing? — and signs off. LAST ACT, THE RETROSPECTIVE (references/retrospective.md, written to docs/evidence/retro.md — one file per project, not per run, because every gate in this flow is good at THIS run and blind across runs): STAMP THE RUN FIRST (date, topic, verdict, counts) — the order is load-bearing, not style: the cold-retirement trigger reads the stamp this stage writes, so a prune placed ahead of the stamp can never run on real data; THEN PRUNE — every standing instruction checked against its retirement triggers (it became a check; every path/command/stage it names is gone; it has not fired in the last five run stamps, or in the last sixty days), the list held to its hard cap of ten (at eleven the oldest never-fired row goes — 'they all matter' is the state in which the list stopped being read), and EVERY DELETION LOGGED as one line, never silent; THEN, only if the run diverged, write the entry — symptom with evidence, the stage it surfaced at, the stage that OWNED it, the root cause ('the agent was careless' is not one), the fix by grade (mechanical check > standing instruction with its retire-when written at birth > a note that expires in two runs), and the check that catches it the first time from now on. A retro left empty after a messy run is the failure this file exists to stop, and the retro counts are printed beside this gate's verdict like the carry-over ledger's, so a list that quietly grew back is visible where it happened. EVERY LESSON CARRIES ITS COMMIT: each standing instruction has the SHA that introduced it and the SHA of the run in which it last fired, each log entry and each retirement carries one, the run stamp carries the run's own — a file:line rots at the next edit while 'git show <sha>' reconstructs the whole incident two months later — and every SHA must resolve, which the documentation gate checks with 'git rev-parse --verify'. ROTATION: entries older than the last five run stamps MOVE into docs/evidence/retro/YYYY-QN.md, which is append-only and QUERIED rather than read, so the in-force file stays short enough to be read in full and pruning costs no knowledge. AND THE GATE ITSELF IS PROVEN: every check this close-out leans on — the documentation gate included — has been seen failing once against a planted defect, with the probe recorded, and its ratchet counts are printed beside this verdict (references/gates.md). THE HAND-BACK IS WRITTEN — the request quoted as GIVEN, progress against it, what was solved with evidence, what surfaced unasked, every waiting decision ASKED here with options, and the ambiguity count computed from the four registers; zero prints as zero."
+        "type": "auto",
+        "check": "Close the circle. FIRST the LADDER WALK (references/audit.md), because the REQ table can only find what was named and lost — a comparison needs two sides and an absence has one: walk each REQ bottom-up through its rungs (decision -> spec section -> contract AND its failure behavior -> plan task -> change -> executed test -> surface/docs), check the seam at each step — and where the VISUAL track ran, the row visual intent (the director record) <-> final render (the APPROVED contact sheet: 'visual_gate.py sheet ... --require-approval' exits 0 on flagship, product or ad), with the review rounds it took copied from the run ledger's review: lines into the acceptance file — order findings BY SEAM not by file, and turn every absence into a new REQ row with its check BEFORE the table is written; findings belonging to a lower layer go back to that layer (spec -> stage 3, plan -> stage 4); record the pass's two counts (new findings vs findings caused by this run's own fixes) so the next pass can tell whether the axis is exhausted. THEN the coverage table: every REQ has a status (verified / partial / deferred / dropped) — none unknown; every verified carries evidence (a passing test name, file:line, a command and its output, or a scenario ID) — 'done' without evidence is downgraded to partial, not upgraded, and a green from a check nobody has watched fail against a planted defect is not evidence at all; every partial names what is missing and where it is tracked; every deferred/dropped has the operator's agreement and, for deferred, a tracker entry; no carry-over row is left unresolved and the ledger's counts are printed beside this verdict, so 'green' never reads as 'verified'; EVERY REPOSITORY IS CLOSED, THE PARENT INCLUDED — a submodule is finished only when its parent points at it, so 'git submodule status' shows no line starting with '+' and every repo is clean and pushed ('git -C <repo> status --porcelain' and 'git -C <repo> log @{u}..HEAD' both empty), because a parent records a submodule as a pointer to one commit and moving the submodule does not move the pointer: neither repo looks wrong alone and the disagreement survives every check that runs inside one; and the operator answers the closing question — here is what you asked for, here is what shipped, here is what is deferred, what is missing? — in the hand-back; the operator's sign-off is read from it, never waited for. LAST ACT, THE RETROSPECTIVE (references/retrospective.md, written to docs/evidence/retro.md — one file per project, not per run, because every gate in this flow is good at THIS run and blind across runs): STAMP THE RUN FIRST (date, topic, verdict, counts) — the order is load-bearing, not style: the cold-retirement trigger reads the stamp this stage writes, so a prune placed ahead of the stamp can never run on real data; THEN PRUNE — every standing instruction checked against its retirement triggers (it became a check; every path/command/stage it names is gone; it has not fired in the last five run stamps, or in the last sixty days), the list held to its hard cap of ten (at eleven the oldest never-fired row goes — 'they all matter' is the state in which the list stopped being read), and EVERY DELETION LOGGED as one line, never silent; THEN, only if the run diverged, write the entry — symptom with evidence, the stage it surfaced at, the stage that OWNED it, the root cause ('the agent was careless' is not one), the fix by grade (mechanical check > standing instruction with its retire-when written at birth > a note that expires in two runs), and the check that catches it the first time from now on. A retro left empty after a messy run is the failure this file exists to stop, and the retro counts are printed beside this gate's verdict like the carry-over ledger's, so a list that quietly grew back is visible where it happened. EVERY LESSON CARRIES ITS COMMIT: each standing instruction has the SHA that introduced it and the SHA of the run in which it last fired, each log entry and each retirement carries one, the run stamp carries the run's own — a file:line rots at the next edit while 'git show <sha>' reconstructs the whole incident two months later — and every SHA must resolve, which the documentation gate checks with 'git rev-parse --verify'. ROTATION: entries older than the last five run stamps MOVE into docs/evidence/retro/YYYY-QN.md, which is append-only and QUERIED rather than read, so the in-force file stays short enough to be read in full and pruning costs no knowledge. AND THE GATE ITSELF IS PROVEN: every check this close-out leans on — the documentation gate included — has been seen failing once against a planted defect, with the probe recorded, and its ratchet counts are printed beside this verdict (references/gates.md). THE HAND-BACK IS WRITTEN — the request quoted as GIVEN, progress against it, what was solved with evidence, what surfaced unasked, every waiting decision ASKED here with options, and the ambiguity count computed from the four registers; zero prints as zero."
       }
     }
   ],