The two incidents

Incident 1 - two planning steps skipped

A /grill-me interview session produced a design brief and created one bead to carry the campaign. Creating that one bead is correct under the workflow. The defect was that the bead's role was not explicit: its rich content made it look like an implementation issue of the kind the later /to-issues stage produces.

The next day a new session took that appearance at face value. It treated the design brief as a substitute for a PRP (product requirements prompt: the approved plan a campaign enters on), skipped both /create-prp and /to-issues, and ran /generate-spec. The skip was never put to a person as a question.

The brief itself said /create-prp consumes this brief. Nothing may be dispatched AFK until the resulting PRP is approved. That sentence was text inside the loop it was meant to police, and text can be weighed and set aside.

The route actually taken

Intended: /grill-me → brief plus one campaign bead → continue decision → /create-prp → PRP approval → /to-issues → slice review → /generate-spec → spec approval → /implement.

Taken: /grill-me → brief plus a campaign bead of unclear role → the session infers that the PRP and the decomposition already exist → /generate-spec.

Root cause

No machine-readable record of workflow stage existed, so the stage was inferred from how the artifacts looked. A bead that is detailed enough looks finished, whatever happened before it.

Containment

The child beads created out of sequence were closed without implementation and their identifiers retired, and the specs generated for them were declared non-authoritative. The design brief was reviewed, approved and linked to the campaign, and the campaign stayed open with /create-prp as its next step. The generated specs were never approved, no implementation began, and no unattended run was dispatched.

What changed

Every node now carries its step as recorded state, pipeline.stage, written only by the transition script; a campaign or a task enters only through a recorded door; and leaving a step runs that step's deterministic checks. A skipped step is now a refusal rather than a silent gap. See entry doors and the single writer.

Incident 2 - the wrong document reviewed

About a week later, a careful session took the same campaign's PRP through a revision and a document review. Five things went wrong.

1. The review ran against the wrong document. It consumed an archived, non-authoritative spec, one of the artifacts Incident 1 had invalidated, and then reasoned onward from child specs that no longer counted. The fact that they no longer counted was recorded in a working document, not on the artifacts themselves, so the files stayed readable and indistinguishable from live ones.
2. A slice that had been cut survived into the PRP. One vertical slice had been dropped when the scope was reduced. Nothing checked the downstream artifact against that decision, so it persisted.
3. Settled decisions were raised again. The brief's resolved-decisions block is prose. Nothing binds a downstream stage to it, so questions already closed were reopened.
4. A single-source conflict was fixed by syncing two documents. The brief and the PRP held the same fact in conflicting forms. The session reconciled them by correcting both instead of retiring one, which leaves the fact with two homes that can disagree again.
5. The manifest and the documentation disagreed about the stage list. The documentation described a /generate-design stage that the pipeline manifest did not declare.

The defect underneath

The lifecycle joining the brief and the PRP was contradictory. The pipeline said create-prp consumes the brief, and also that generate-spec reads the brief as background. Both documents stayed live, both had to be maintained, and a conflict had two homes.

What changed

The lab decided that the PRP supersedes the brief outright, and that /generate-spec reads the PRP only. That removes a document from maintenance instead of adding a rule. The stage-list disagreement was closed by declaring generate-design in the manifest, where it now sits ahead of the entry stage, declared but not enforced. The broader mechanism, in which a producer retires the artifact it replaces and a change upstream invalidates only the approvals that depend on it, is designed and not yet built: see supersession and rewind and what is not built.

The enforcement layer, as it stood at the time

Both incidents happened while an ordering engine already existed in the repository. These facts were verified by searching the code at the time, and they are why "we have a state machine" was no defence.

• The transition script, pipeline-transition.sh, implemented seven verbs: handoff, init, entry-context, status, propose, complete, waive.
• Only handoff, init and entry-context had callers. propose, complete and status had none, and waive was mentioned in documentation but never called.
• So pipeline.stage was written once, at init, and never advanced. Every campaign was permanently recorded at its entry stage, which made the field misleading rather than merely incomplete.
• The manifest declared four stages, and two of them, to-issues and implement, declared no checks at all.
• The script described itself as the single writer of pipeline.*, but a direct metadata write through the tracker was not blocked.
• Permission prompts were not a reliable record of a person's approval, so an answered prompt proved nothing about who approved.

The ordering engine was built, argument-validated and tested at the entry boundary, and unreachable past the first stage.

The classification rule

If a harness property would have made the failure impossible, it is a process defect, whichever agent committed it.

The second incident's own first analysis put four of its five failures down to execution and one to process. Applying the rule reclassifies all four:

Only the frequency of these failures was down to execution; each had a missing harness property behind it. The first incident could be read as one session guessing badly. The second cannot: a careful session, on a campaign that had already been through an incident review, reproduced the same class of failure by trusting an artifact's appearance rather than a checked property. A workflow whose correctness depends on every agent being careful has no correctness property at all. A skill is text evaluated inside the loop it would need to police, which is why the rebuild moved ordering out of skills and into a deterministic harness.