task-pipeline-skill 1.97.1 → 1.99.0

package/plugins/task-pipeline/skills/task-pipeline/pipeline.schema.json

@@ -160,13 +160,20 @@
         "finish": {
           "type": "object",
           "additionalProperties": false,
-          "description": "The iteration's budget at its finish line. Absent, the defaults hold: 3 rounds and 2 releases. A round is every exit check once plus one independent reading over the scope; only new blocking findings count. Reaching either budget before done — a blocker open, or the second clean round still owed — stops the iteration and hands it back; no round runs past it without the operator's go, given with the numbers. Doctrine: references/finish-line.md; verdict: scripts/waves.py finish.",
+          "description": "The iteration's budget at its finish line. Absent, the defaults hold: 3 rounds and 2 releases. A round is every exit check once plus one independent reading over the scope; only new blocking findings count. Reaching either budget before done — a blocker open, or a clean round still owed — stops the iteration and hands it back; no round runs past it without the operator's go, given with the numbers. Doctrine: references/finish-line.md; verdict: scripts/waves.py finish.",
           "properties": {
             "maxRounds": {
               "type": "integer",
-              "minimum": 2,
+              "minimum": 1,
               "default": 3,
-              "description": "Finish-line rounds per iteration, at least 2: done needs two consecutive rounds with no new blocking finding. Rotating the audit axis happens inside this budget and never adds a round."
+              "description": "Finish-line rounds per iteration, at least cleanRounds: done needs that many consecutive rounds with no new blocking finding. Rotating the audit axis happens inside this budget and never adds a round."
+            },
+            "cleanRounds": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 2,
+              "default": 1,
+              "description": "Consecutive rounds with no new blocking finding that end the iteration: 1, or 2 when it carries an R3 or flagship node (since 1.98.0; two for every iteration was the default before). Passed to waves.py finish as --clean-rounds."
             },
             "maxReleases": {
               "type": "integer",
@@ -229,7 +236,7 @@
           "minLength": 1,
           "pattern": "\\S",
           "not": {"pattern": "[\\r\\n]"},
-          "description": "Optional single-line source locator (for example docs/DECISIONS.md:42) for the specific standing authorization covering the tag and its publication. The locator is not authorization: read the source and verify its authority, currentness and scope at stage 7. Absent: inspect existing recorded authority before asking; do not infer a grant from checks approval, loop mode or this field's mere presence (references/deploy-targets.md)."
+          "description": "Optional single-line source locator (for example docs/DECISIONS.md:42) for the standing authorization covering the tag and its publication. A locator, not a grant: how it is read and verified lives in references/deploy-targets.md, When the release waits for an approval."
         },
         "approval": {
           "enum": [

package/plugins/task-pipeline/skills/task-pipeline/references/acceptance.md

@@ -20,7 +20,7 @@ requirement.** It is what turns the pipeline from a funnel into a circle.
 - The retrospective — the run's last act
 - A `verified by` name is a claim until it resolves
 - A seam is not a deliverable, and REQ rows are written against deliverables
-- GATE (manual)
+- GATE (auto)
 - When the answer is "something's missing"
 - A project of several repositories
 
@@ -329,7 +329,7 @@ client write on the other — the table says so under `unlooked` rather than sho
 green rows. Two green halves reporting a working whole is exactly the shape this file
 spends its length refusing.
 
-## GATE (manual)
+## GATE (auto)
 
 > **Acceptance policy `AP-1` · owner: the operator of the project running this pipeline ·
 > in force since 2026-08-20 · supersedes: the unversioned ladder that stood before it.**

package/plugins/task-pipeline/skills/task-pipeline/references/brainstorm.md

@@ -22,7 +22,7 @@ approved design — not at code.
 - UI detection — a required output
 - The approved design is a set of decisions — record them
 - User paths are a design output, not a spec detail
-- GATE (manual)
+- GATE (auto)
 - Rationalizations
 
 ## The hard gate
@@ -139,9 +139,9 @@ Feed them into [`spec.md`](spec.md)'s UX track — super-ux turns them into flow
 screens and traced scenarios. **Do not draft scenario IDs here**; that is the
 chain's job, and two sources for one scenario is worse than one.
 
-## GATE (manual)
+## GATE (auto)
 
-The operator approves the design, **the UI verdict is recorded**, and — where that verdict is *yes* — **the paths, the states and the error paths are named** (above) rather than deferred to the spec. **Every REQ in the brief is answered by the design** — a requirement the design doesn't address
+The design is approved (the operator's go, or the standing authorization recorded in the brief; `auto` by default since 1.98.0), **the UI verdict is recorded**, and — where that verdict is *yes* — **the paths, the states and the error paths are named** (above) rather than deferred to the spec. **Every REQ in the brief is answered by the design** — a requirement the design doesn't address
 is either covered now or explicitly dropped by the operator, with the drop written
 into the carry-over ledger. For a platform, the module map
 ([`decomposition.md`](decomposition.md)) is committed and approved as part of this

package/plugins/task-pipeline/skills/task-pipeline/references/build.md

@@ -176,7 +176,7 @@ overall.
 - **The final whole-branch review.** If the run is on a tier below the most capable
   one available, say so and offer to run this one review there; if the operator
   declines or the tier doesn't exist, run it on the confirmed model and note it.
-- **Fix-loop rounds 4–5.** One tier above the implementer that got stuck, when the
+- **Fix-loop round 3.** One tier above the implementer that got stuck, when the
   environment has one and the override map or the operator allows it; otherwise
   say so and rely on fresh eyes alone.
 
@@ -233,6 +233,21 @@ Record the implementer's agent identity: fix rounds 1–3 resume it.
 > commit range, a one-line test summary, and your concerns. Ask before starting
 > if anything in the brief is ambiguous — questions are cheaper than rework.
 
+**Command hygiene** — put this in every background dispatch, whether it goes to an
+implementer, a reviewer or a verifier:
+
+> Avoid commands that the harness holds for permission. Do not write `cd X;` compounds: use
+> absolute paths or `git -C`. Do not write `rm -rf $VAR`: use a literal path or `"${VAR:?}"`.
+> Do not edit repository files with inline heredocs: use the editor tool or a script file.
+> If a command has not returned in about 5 minutes and no process is running, rephrase it.
+
+*A lesson of release iteration 1 (2026-10-13): background agents stopped silently. Each was
+waiting on a command the harness held for a permission no one could see. The triggers were a
+`cd X; python3 - <<EOF` compound and `rm -rf $HOME` with HOME overridden. Source: the
+iteration's run record, which is private, and
+[task-pipeline#125](https://github.com/ssheleg/task-pipeline/pull/125), which carries the
+rule.*
+
 ### 4.1a Decisions settled inside a task — and who may write them down
 
 The report above already asks for *"decisions you made"*, and stage 5 settles more
@@ -407,7 +422,7 @@ may say what the reviewer actually saw, and a syntax lint recorded as a blind
 review is refused by `certify` by name.
 
 **The boundary with certification:** this review closes a **prose-plan task** —
-one reviewer, the five-round cap of §4.5. A **work-graph node** is closed by the
+one reviewer, the three-round cap of §4.5. A **work-graph node** is closed by the
 three blind tiers and `graph.py certify` instead
 ([`certification.md`](certification.md), ceiling 3); the artifact the queue is —
 plan or graph — decides which protocol closes the work, never whichever is
@@ -444,7 +459,7 @@ Two routes leave before the loop starts:
   without asking.
 
 Everything else loops. One round = one fix dispatch + one scoped re-review.
-**Five rounds maximum per task.**
+**Three rounds maximum per task**, then the open findings become blocker rows and the run moves on.
 
 **The loop guard runs alongside the counter** ([`loop-guard.md`](loop-guard.md)):
 log every repeat touch (`touch: <file> — round N — reason: <finding id>`) and trip
@@ -453,13 +468,13 @@ the same reason, or when a finding already ADDRESSED reappears. A tripped guard
 not another round: stop, name the two shapes, escalate to the layer that owns the
 conflict, then re-check in a planned order.
 
-- **Rounds 1–3:** resume the original implementer with the open findings verbatim —
+- **Rounds 1–2:** resume the original implementer with the open findings verbatim —
   its context is intact. If the harness can't message a live subagent, dispatch a
   fresh one with the brief path, the report path and the findings; the report file
   is the persistent memory either way.
-- **Rounds 4–5:** fresh implementer, one tier up if available, framed as: "a prior
+- **Round 3:** fresh implementer, one tier up if available, framed as: "a prior
   implementer attempted this task N times; you own it now — read the report file
-  for what was tried." A loop that survives three resumes usually means the
+  for what was tried." A loop that survives two resumes usually means the
   implementer can't see its own problem.
 - **Every round:** the implementer fixes, re-runs the tests covering the amended
   code, appends its fix report to the same report file, returns the short contract.
@@ -471,7 +486,7 @@ conflict, then re-check in a planned order.
   breakage joins the open list; out-of-scope observations go to the ledger as
   deferred minors — they never extend the loop.
 - **Ledger, every round:**
-  `Task <N>: fix round <R>/5 (<X> addressed, <Y> open — <one-liners>; commits <a7>..<b7>)`
+  `Task <N>: fix round <R>/3 (<X> addressed, <Y> open — <one-liners>; commits <a7>..<b7>)`
 
 **In a subagent run, never fix findings yourself in the controller session** —
 controller fixes skip review and pollute the context you need for coordination. In a

package/plugins/task-pipeline/skills/task-pipeline/references/certification.md

@@ -2,12 +2,15 @@
 
 A node is not closed by one agent's opinion. It is closed by **three independent
 readings at escalating visibility**, and the run may not advance until all three
-pass.
+pass. **The cost follows the risk** (since 1.98.0): an **R1** node certifies with **one**
+blind tier (`unit` by default; `graph.py certify` accepts any one of the three), and a
+clean round ends a node unless it is **R3 or a flagship surface** (*Rounds owed by risk
+class*, below).
 
 **The boundary: this closes a node of the work graph.** Where the queue is a
 prose plan rather than a graph, a task closes through the per-task review instead
 ([`build.md`](build.md) §4.4 and [`review.md`](review.md) — one reviewer, a
-five-round fix loop with an explicit breaker). Two closure protocols with no
+three-round fix loop with an explicit breaker). Two closure protocols with no
 boundary sentence were how a run picked whichever was cheaper; the artifact the
 queue is — graph or plan — is what decides, not the mood of the closer.
 
@@ -208,14 +211,18 @@ erase the only evidence that a node is churning.
 
 The cycle is: `certify` → fail → the `breaks` findings become nodes (each already
 carrying its `check`) → fix → `certify` again, round `N+1`. Same three tiers, same
-blind dispatch. A tier that passed in an earlier round is **re-run**, because the
-fix is a new change and the level it passed on is not the level it now faces.
-
-**At the ceiling the gate measures rather than stops** —
-[`loop-guard.md`](loop-guard.md). `--ceiling` defaults to 3. At or over it, `certify`
-still runs and still reports the tiers; what it adds is the name of the tier that
-has failed **every** round. A run spinning on one level needs the operator to see
-*which* level:
+blind dispatch. A tier that passed in an earlier round is **re-run** after a fix,
+because the fix is a new change. **It is never re-run on unchanged input:** `certify`
+records the tree each round read and refuses a round of the same kind on the same
+tree, before writing anything. A tier's second answer about a tree it already read is
+its first answer again, and asking twice is the loop.
+
+**At the ceiling the gate STOPS** ([`loop-guard.md`](loop-guard.md), since 1.98.0).
+`--ceiling` defaults to 3 failing rounds. The round that reaches it still reports the
+tiers, names the tier that has failed **every** round, and then **parks the node** with
+the evidence (failing tiers, the first break and its check) as its reason, exit `7`.
+The run records a blocker row with that evidence and moves on to the next node. It
+used to measure only, and a loop that is measured is still a loop:
 
 - the same tier every round → the level is being misread, or the node is the wrong
   shape. Not one fix away. Re-plan the node, do not attempt another failing round. (An R3
@@ -227,30 +234,29 @@ has failed **every** round. A run spinning on one level needs the operator to se
 
 In a release iteration a node carries `risk` (R1–R3, [`work-graph.md`](work-graph.md);
 [`iteration.md`](iteration.md) → *Verification starts when a node lands*), and the class
-decides how many **passing** rounds the node owes before `close` accepts it: **R1 one, R2
-two, R3 three, of which one is adversarial.** A round is the three blind tiers (four on a
-flagship or product surface) plus one fix cycle. `graph.py certify` prints `round N: k of M
-owed passing rounds — not closable yet` until the count is met (`k of M owed passing rounds —
-closable` once it is), and `graph.py close` refuses
-the verdict until then. **Only passing rounds count** — a round passes when every tier
-passes, read from `certification.history` — and, for R3, one of the passing rounds must be
-one recorded with `--kind adversarial`
-(`certification.kinds`, one entry per round). A node with a `risk` and no certification at
-all is refused by `close` too: its class owes at least one round.
+decides how many **passing** rounds the node owes before `close` accepts it: **R1 one
+(with one blind tier), R2 one, R3 two, of which one is adversarial.** A node on a
+**flagship** surface owes two as well, one of them adversarial, whatever its class. A
+round is the blind tiers the class owes (three; four on a flagship or product surface;
+one on R1) plus one fix cycle. `graph.py certify` prints `round N: k of M owed passing
+rounds — not closable yet` until the count is met (`k of M owed passing rounds —
+closable` once it is), and `graph.py close` refuses the verdict until then. **Only
+passing rounds count**, read from `certification.history`, and for R3 or a flagship one
+of them must be recorded with `--kind adversarial` (`certification.kinds`). A node with
+a `risk` and no certification at all is refused by `close` too. R2 owed two blind
+rounds until 1.98.0, and a clean round did not cancel the next: the second reading of
+an unchanged diff found nothing it had not already been asked.
 
 **What a round after a clean round reads.** The node's **whole diff at the new HEAD** — not
-the fix diff alone, and not the previous round's reports. A clean round proves the tree it
-read; the next owed round asks the same three distances again of the whole change as it
-stands, so a defect the first reading accepted has a second chance to be seen from a fresh
-context.
-
-**Owed rounds and the ceiling are different counts.** `--ceiling` measures churn: how many
-rounds a node has *failed*, and which tier keeps failing. An R3 node that owes three rounds
-and passes them is not "at round four" of anything; its owed rounds are the plan, and the
-ceiling's warning is about failing rounds beyond what the class owes. Read the ceiling's
-output only when rounds fail.
-
-**The adversarial round** (one of R3's three, on another model where one is available):
+the fix diff alone, and not the previous round's reports. On an unchanged tree the only
+round that may follow a clean one is the other kind: the adversarial round asks a
+different question of the same change.
+
+**Owed rounds and the ceiling are different counts.** `--ceiling` counts *failing*
+rounds and stops the node at the limit; owed rounds count *passing* ones. An R3 node
+that passes its two is not near any ceiling.
+
+**The adversarial round** (one of R3's two, on another model where one is available):
 1. **Plant defects in the change** — off-by-one in a limit, an inverted check, a dropped
    error path — and require the node's own checks to fail on each. A plant that passes is a
    finding against the check, not against the plant.
@@ -261,19 +267,18 @@ output only when rounds fail.
 3. **Try the abuse cases** a caller outside the trust boundary would: inputs at and past
    every bound, replays, a revoked identity, an out-of-order sequence.
 
-It is a different question, not a stricter reading: on 2026-10-12 one iteration's third
-round on a spend-limits node found three breaks of a money invariant that two blind rounds
-had passed. Record it with `certify --kind adversarial`.
+It is a different question, not a stricter reading: on 2026-10-12 one iteration's
+adversarial round on a spend-limits node found three breaks of a money invariant that two
+blind rounds had passed. That is why R3 keeps it and drops the second blind round. Record it with `certify --kind adversarial`.
 
 ## What this costs, said out loud
 
-Three agents per node instead of one — four on a flagship or product surface. That is
-the price of the visibility, and it is paid per node rather than per run. The three are dispatched in parallel, so the
-wall-clock cost is roughly one reading; the token cost is three. A node whose
-`check` is mechanical and whose blast radius is genuinely nil still pays it — and a
-tier with nothing to find says so in `scope` and `not_examined` rather than being
-skipped, because **a skipped level and a clean level are indistinguishable
-afterwards**, and only one of them is evidence.
+Three agents per node instead of one, four on a flagship or product surface, one on R1.
+The tiers are dispatched in parallel, so the wall-clock cost is roughly one reading and
+the token cost is the tier count. Where a tier runs and finds nothing it says so in
+`scope` and `not_examined`, because **a skipped level and a clean level are
+indistinguishable afterwards**. What the class does not owe is not run: an R1 node's
+second and third tiers are not skipped levels, they are levels its risk never reached.
 
 ## Rationalizations
 
@@ -281,5 +286,5 @@ afterwards**, and only one of them is evidence.
 |---|---|
 | «All three would say the same thing» | Then all three say it, at a cost you already know, and the run has three signatures instead of one guess about what the other two would have found |
 | «The seam tier can read the unit report first — it saves tokens» | It saves tokens by removing the second opinion. The reports are cheap; the independence is the product |
-| «Tier 3 passed last round, skip it» | The fix is a new change. A tier's pass is about the tree it read, and that tree moved |
-| «Round 4 will get it» | Read the ceiling's output. The same tier failing three times is a planning defect wearing a verification failure's clothes |
+| «Tier 3 passed last round, skip it» | The fix is a new change. A tier's pass is about the tree it read, and that tree moved. On an unchanged tree the round is refused instead |
+| «Round 4 will get it» | There is no round 4: the ceiling parks the node with its evidence. The same tier failing three times is a planning defect wearing a verification failure's clothes |

package/plugins/task-pipeline/skills/task-pipeline/references/continuity.md

@@ -108,9 +108,12 @@ questions are marked `needs-operator` and made answerable without context
 ([`prioritisation.md`](prioritisation.md) → *5. Where the human goes*); external waits
 get watchers, and project-owned questions go to the owning Project under
 [`iteration.md`](iteration.md)'s board rule. The run continues on every node it does
-not block. When the whole frontier is blocked — `graph.py next` exits `4` — classify the
-recorded reasons: external waits go on watchers, human decisions go into the question
-batch. Exit 4 does not prove a human gate or completion. A watcher keeps the recorded
+not block. When the whole frontier is blocked, `graph.py next` says which kind of block it
+is. Exit `6` means every remaining dependency leaf is a recorded watched wait: keep those
+watchers armed and take independent work ([`work-graph.md`](work-graph.md) → *Watched
+external waits*). Exit `4` means a mixed, unclassified, running or parked barrier remains:
+classify the recorded reasons, put external waits on watchers and human decisions into the
+question batch ([`waves.md`](waves.md)). Neither code proves a human gate or completion. A watcher keeps the recorded
 next action alive while no independent node is runnable. **When the board is empty, say so once**, and do not invent work to fill it.
 
 **Stop is not idle.** A finish line reached closes that iteration — stages 9–10, the

package/plugins/task-pipeline/skills/task-pipeline/references/doctrine-map.md

@@ -49,7 +49,7 @@ Custom profiles use their own declared stages and doctrine, with the kernel inta
 | 3 Spec | `references/spec.md` |
 | 4 Plan | `references/planning.md` |
 | the queue the loop walks | `references/work-graph.md` |
-| 5–8 · how a **work-graph node** is CLOSED — three blind readings at three distances, all three required, plus a fourth `visual` reading on a flagship or product surface (ceiling 3); a **prose-plan task** closes through `review.md` instead — one reviewer, five-round cap | `references/certification.md` |
+| 5–8 · how a **work-graph node** is CLOSED — three blind readings at three distances, all three required, plus a fourth `visual` reading on a flagship or product surface (ceiling 3); a **prose-plan task** closes through `review.md` instead — one reviewer, three-round cap | `references/certification.md` |
 | 5 Build (worktree, subagents, fix loop) | `references/build.md` + `references/review.md` |
 | 5–6 TDD + suite gate | `references/tdd.md` |
 | 5, 6, 8 The browser — the look, the spec suite, and the difference | `references/browser.md` |

package/plugins/task-pipeline/skills/task-pipeline/references/finish-line.md

@@ -25,7 +25,8 @@ fields, written at stage 0 and confirmed with the brief:
   released, installed or deployed. A branch is not that artefact.
 - **Scope** — the modules, paths and REQ ids this iteration may change, as a list.
 - **Budget** — `run.finish.maxRounds` (default 3) and `run.finish.maxReleases` (default 2),
-  from `pipeline.json` ([`../pipeline.schema.json`](../pipeline.schema.json)).
+  from `pipeline.json` ([`../pipeline.schema.json`](../pipeline.schema.json)), and
+  `run.finish.cleanRounds`: 1, or 2 when the iteration carries an R3 or flagship node.
 - **Base** — the commit the iteration started from.
 
 Widening the scope is a recorded revision of the brief, with the operator's go. A finding is
@@ -71,12 +72,15 @@ A **round** is every exit check run once, plus one independent reading over the
 audit axis, an observer, or the post-release readback. Rotating the axis
 ([`audit.md`](audit.md)) never adds a round. Only new blocking findings count.
 
-- **Done** — every exit check green on the artefact, and two consecutive rounds with no new
-  blocking finding. The second of them may read only the last fix's diff.
+- **Done** — every exit check green on the artefact, and one round with no new blocking
+  finding; two consecutive ones when the iteration carries an R3 or flagship node, the
+  second of which may read only the last fix's diff. Two for every iteration was the
+  default until 1.98.0, and a clean round that changed nothing bought a second reading
+  of the same tree.
 - **Diverging** — new blocking findings did not fall from one round to the next, or
   self-inflicted ≥ new. Run [`loop-guard.md`](loop-guard.md)'s break protocol.
 - **Budget spent** — `maxRounds` or `maxReleases` reached before done: a blocker open, or the
-  second clean round still owed. Stop and hand the iteration back: each open blocker becomes a
+  clean round still owed. Stop and hand the iteration back: each open blocker becomes a
   top board row marked `needs-operator`. No round runs past the budget without the operator's
   go, given with the numbers; a done reached past it without that go is still `budget`.
 
@@ -94,15 +98,16 @@ round: <N> — <reading> — new blocking <k>
 
 ```
 python3 scripts/waves.py finish --inventory <inventory.json> --ledger .task-pipeline/run.md \
-  --max-rounds 3 --max-releases 2 --releases <n> --checks <k>/<m> --artefact <name>@<sha>
+  --max-rounds 3 --max-releases 2 --releases <n> --checks <k>/<m> --artefact <name>@<sha> \
+  [--clean-rounds 2]
 ```
 
 `--rounds N` may stand in for `--ledger`; with neither the count is unknown and the script
 refuses. Exit codes:
 
-- `0` — done: the last two rounds found no new blocking item, none is open, and every exit
-  check is green on the artefact.
-- `3` — continue: a blocker open, a second clean round owed, or no `--checks` given.
+- `0` — done: the last `--clean-rounds` rounds (1 by default) found no new blocking item,
+  none is open, and every exit check is green on the artefact.
+- `3` — continue: a blocker open, a clean round owed, or no `--checks` given.
 - `5` — budget: reached before done, or done past it without `--operator-go`.
 - `6` — blocked: diverging; run the loop guard's break protocol.
 - `1` — malformed: the inventory, the ledger or the arguments, each reason named.