Precheck matches prose mutations; task-creator links parent goal

[bborbe]

Two rung-1 repairs surfaced by running a full ops teardown ([[Decommission MinIO on Hell]]) end to end.

1. Phase 5.5 precheck matched literals, not prose

v0.111.1 fixed the gating on this precheck — it had been trapped behind the code-task heuristic. With that fixed it ran on the very task named in its own rationale, and still emitted nothing.

The matcher looks for command strings (kubectl, make apply, helm install). Every subtask on that task was an operator-run cluster mutation written in prose:

• "Remove minio and minio-console ingresses"
• "Scale the Tenant to zero"
• "Delete Tenant CR, StatefulSet, services, PVC"

None contains a command string, so the precheck stayed silent and the session's first kubectl delete was denied by the auto-mode classifier.

A literal matcher cannot see work that has not been written as commands yet — which is the normal state of a task at planning time, and exactly when the warning is worth giving. The precheck now also fires on a destructive verb (remove · delete · tear down · scale · …) applied to an infra noun (ingress · namespace · PVC · CRD · DNS record · …).

2. task-creator left the goal link one-way

task-creator writes goals: into the new task's frontmatter and never touches the goal file. But vault-cli task complete ticks the task's checkbox in the goal, and warns when there isn't one:

failed to update goal [[Eliminate MinIO EOL Risk]]:
checkbox not found for task Decommission MinIO on Hell

So every goal-linked task this agent creates hits that warning on completion and needs a hand-patch — and in the meantime the goal's task list silently omits its own tasks, under-reporting its scope.

New step 11b appends - [ ] [[<task title>]] to each parent goal's # Tasks section, idempotently, skipping when there is no parent goal or the goal file is missing. The self-audit checks for it.

Verification

make precommit passes — 8 packages, 0 lint issues, 0 vulnerabilities, license headers valid.

Both changes are agent-instruction edits, so the real exercise is the next task created with a parent goal and the next ops task opened via work-on-task — noted for post-release verification against the installed plugin, not just the marketplace clone.

[ben-s-pull-request-reviewer]

Now I have all the information needed. Let me compile the review.

---

PR Review: Precheck matches prose mutations; task-creator links parent goal

Changed files (3): CHANGELOG.md, agents/task-creator.md, agents/work-on-task-assistant.md

---

Must Fix (Critical)

None.

Should Fix (Important)

None.

Nice to Have (Optional)

• agents/task-creator.md:202 — The audit step checks that a checkbox exists for each goals: entry, but does not verify that the wikilink text in the checkbox ([[{task title}]]) actually resolves to the filename on disk. If a task is renamed without updating the goal file's checkbox link, the audit passes silently and vault-cli task complete will tick the wrong checkbox (or fail to tick any). Consider adding a resolution check: confirm {vault.path}/{goals_dir}/{goal title}.md exists and the wikilink {task title} resolves within it.

• agents/work-on-task-assistant.md:175-178 — The verb list includes apply and deploy, which are also common in non-infrastructure contexts ("apply this fix", "deploy the fix to your machine"). The noun list narrows the context (infra nouns only), so false positives are low in practice — but phrases like "apply the secret to the cluster" would also match the noun secret, making the overlap between verb and noun lists a secondary concern worth monitoring after rollout.

• agents/task-creator.md:185 — The idempotency check ("a checkbox for this task is already present") does not specify whether it is case-sensitive or whitespace-tolerant. A checkbox written with different casing or trailing spaces would bypass the dedup and create a duplicate. Consider normalising both sides (task title + checkbox text) before comparison.

---

Selector Mode Traceability

Concern from Plan	Status
Phase 5.5 precheck may over-trigger on benign prose	Acknowledged — low risk given noun-list specificity; monitored post-merge
Idempotency relies on exact checkbox string match	Acknowledged — consider normalisation in future iteration
Audit does not verify wikilink resolves to real filename	Unresolved — Should Fix candidate; see above

Plan concerns addressed:

• correctness: Phase 5.5 verb+noun over-trigger — addressed by design (noun list constrains scope; output is a warning, not a block)
• correctness: task-creator idempotency — partially addressed; wikilink/title mismatch risk remains
• correctness: goal title wikilink not verified — not addressed in this PR; raised as Nice to Have above

---

Notes

The core changes are well-reasoned and the CHANGELOG entries are exemplary — they name the observed failure mode, the affected version, and the structural root cause. The verb+noun rule is a meaningful improvement over a literal-only matcher for planning-time tasks. No security, concurrency, or data-correctness issues identified.

---

{
  "verdict": "approve",
  "summary": "Two solid bug fixes: the Phase 5.5 permission-mode precheck now catches prose-described mutations in addition to command literals, and the task-creator now bidirectional-links tasks to their parent goals. One Nice-to-have finding: the goal-file checkbox audit does not verify the wikilink title resolves to the actual task filename on disk, so a rename would silently break the checkbox tick.",
  "comments": [
    {
      "file": "agents/task-creator.md",
      "line": 202,
      "severity": "nit",
      "message": "Audit checks a checkbox exists for each goals: entry but does not verify the wikilink text resolves to the real task filename. A rename would pass audit and cause vault-cli task complete to miss the checkbox."
    },
    {
      "file": "agents/work-on-task-assistant.md",
      "line": 175,
      "severity": "nit",
      "message": "Verbs 'apply' and 'deploy' are common in non-infrastructure contexts; noun list constrains scope but overlap between verb and noun lists could produce benign hits like 'apply the secret to the cluster'. Low risk for a warning-level output — monitor post-merge."
    },
    {
      "file": "agents/task-creator.md",
      "line": 185,
      "severity": "nit",
      "message": "Idempotency check ('a checkbox for this task is already present') does not specify case-sensitivity or whitespace handling. Consider normalising both sides before comparison to prevent duplicate checkboxes from trailing-space differences."
    }
  ],
  "concerns_addressed": [
    "correctness: Phase 5.5 verb+noun prose matching — addressed by design; noun list constrains scope, output is a warning not a block",
    "correctness: task-creator idempotency on checkbox match — partially addressed; wikilink/title mismatch risk raised as nit",
    "correctness: goal title wikilink not verified against filename — raised as nit; not addressed in this PR"
  ]
}