lint: vendored task-runner.dot ship_check exit code is pipe-masked (CMD-001, --strict red)

[bkrabach]

Observable behavior

The vendored pipeline .github/capsule-pipeline/task-runner.dot does not lint clean: the repo's own linter reports a CMD-001 finding on the ship_check gate, and --strict mode exits non-zero. The two sibling pipelines in the same directory lint clean.

Reproduction

$ uv run --project modules/pipeline-runner dot-runner lint .github/capsule-pipeline/task-runner.dot
WARNING: [CMD-001] [ship_check] Tool node 'ship_check' tool_command ends in a pipe to
'grep' without pipefail: the gate's exit code is 'grep's (always 0 on success)...
dot-runner lint: .github/capsule-pipeline/task-runner.dot: 1 warning(s)
$ echo $?
0
$ uv run --project modules/pipeline-runner dot-runner lint --strict .github/capsule-pipeline/task-runner.dot; echo $?
1
$ uv run --project modules/pipeline-runner dot-runner lint --strict .github/capsule-pipeline/capsule.dot; echo $?
0
$ uv run --project modules/pipeline-runner dot-runner lint --strict .github/capsule-pipeline/feature-capsule.dot; echo $?
0

Verified at c86c196; the file is unchanged at current main.

Expected vs actual

• Expected: every vendored pipeline in .github/capsule-pipeline/ lints clean under --strict (exit 0), so the repo's own lanes hold the standard the linter teaches.
• Actual: task-runner.dot exits 1 under --strict with the CMD-001 finding above.

Notes for scoping

• Honest caveat: the flagged command's pipe is mid-chain and the final grep -q . is a real predicate — a live false-SUCCESS has not been demonstrated. The crisp, machine-checkable defect is the --strict exit 1.
• This file is vendored from its source repo, where the same finding exists; fixing it here is fine, and a port-back to the source copy is a reasonable follow-up outside this issue's scope.
• Deliberately not prescribing which end to fix (the graph's command vs the lint rule's judgment): the acceptance is behavior-bound — dot-runner lint --strict .github/capsule-pipeline/task-runner.dot exits 0, without weakening the evidence the ship_check gate actually checks.

[github-actions]

Specify stage: the automated pipeline couldn't produce a verified work plan for this yet.

What happened: the pipeline ran, but did not converge on a proven
work capsule within its iteration budget.

What this does NOT mean: this is not a judgment of your report.

What happens next: a maintainer will personally review this issue
and follow up.

Technical postmortem (for maintainers)

(no postmortem report was written)

Workflow run: https://github.com/microsoft/amplifier-bundle-dot-runner/actions/runs/33314987898

[bkrabach]

Maintainer postmortem (supplied by hand — the pipeline's own was empty)

The auto-comment above says (no postmortem report was written). That is itself a finding, not a mystery. Here is what the run evidence actually shows.

Terminal cause: wall clock, not reasoning

dot-runner: status=fail
Pipeline exceeded max duration of 19800000ms

19,800,000 ms = 5.5 h. The run was killed mid-critique in iteration 1, having completed 2 of the 6 budgeted iterations. Node timeline from logs/trace.jsonl:

it	node	dur
0	orient	9m47s
0	rival	50m43s
0	author	86m46s
0	mutate / mutate_b / void	17m39s / 16m44s / 22m10s
0	critique	16m07s → ITERATE
1	author	28m14s
1	mutate	13m50s → fail (freshness floor)
1	diagnose → author → mutate → mutate_b → void	7m44s / 5m00s / 3m42s / 31m38s / 9m45s
1	critique	28m22s → ITERATE (killed here)

Iteration 0 alone cost 3 h 40 m. max_iterations=6 was never reachable inside a 5.5 h ceiling. Since 5.5 h already sits just under GitHub's 6 h job cap, "raise the ceiling" is not the fix — per-node budgets, narrower node scope, or a resumable stage split is.

The non-convergence was substantively honest

Both ITERATE verdicts were earned, not stalling. The iteration-1 critique's blocking finding — that a backslash-escaped \grep defeats CMD-001 while resolving to the identical binary — I verified independently at current main:

'cmd | grep -q .'            -> program='grep'   in filter set: True
'cmd | \grep -q .'           -> program='\grep'  in filter set: False
'cmd | /usr/bin/grep -q .'   -> program='grep'   in filter set: True

$ /bin/sh -c 'echo hi | \grep -q . && echo yes'   ->  yes

_last_pipe_stage_program does token.split("/")[-1], which strips a path prefix but not shell escaping, so \grep never meets _PIPE_FILTER_PROGRAMS. This is a real, general CMD-001 blind spot — it silences the rule on genuinely hazardous token-match greps at the pristine base SHA too, no patch required. The critique also correctly killed the prior round's set -o pipefail; dodge by executing it (dash → set: Illegal option -o pipefail, rc=2) rather than parsing it. That is the behaviour we want from this loop; it simply ran out of clock before it could fold the finding into a gate.

rival.patch (a principled _is_grep_presence_predicate carve-out + 5 regression tests, 66/66 green) survives in the artifact and is a reasonable starting point for a human fix — but note it does not close the \grep hole the critique found.

Two port/workflow findings from this shakedown

1. The .ai/ run evidence is silently never uploaded. .github/workflows/capsule-specify.yml L739-746 lists ${{ github.workspace }}/.ai as an upload path but does not set include-hidden-files: true; actions/upload-artifact@v4 skips dot-paths by default. Result: 91 files uploaded, all from $RUNNER_TEMP, zero from .ai/. The entire convergence record — convergence.jsonl, findings/void-greened.md, capsule/DEFINITION.md, critique.md, the hypothesis patches — is absent from the artifact, which is exactly the evidence a maintainer needs on a non-convergence. One-line fix:

          if-no-files-found: warn
+         include-hidden-files: true

2. A max-duration abort bypasses the postmortem node entirely, so classify lands on kind=failure with no recorded finding and the issue gets the content-free comment above. Wall-clock exhaustion is a predictable terminal state and deserves its own postmortem path — it is the one case where the maintainer is guaranteed to have no in-graph explanation.

Pipeline plumbing was otherwise healthy

• Engine snapshot/provenance: OK — detached to $RUNNER_TEMP/engine-src, base SHA c56e51bbdf7ecdcf126506ca02d54f232d21a9bc, verified no .venv carried in.
• --worker loop-agent resolved; 60 packages built/installed from the detached snapshot (amplifier-agent@66d5896, amplifier-foundation@400bda2).
• Providers mounted: zero Available providers: []; 918 live [PROVIDER] calls spread evenly across all six hours — no stall, no silent hang.
• status.json written for every node across iteration_0/iteration_1; trace.jsonl complete.
• Secret gates all ran: capsule-artifact never-redact scan clean, scrub redacted an openai-key-shaped string in .ai/capsule/DEFINITION.md, residual gate passed → upload allowed.

CAPSULE_PR_TOKEN: not validated by this run

Open capsule PR is gated on classify.kind == 'capsule' and was skipped. The freshly-regenerated token remains untested; the next converging run is still its first real exercise.

Recommendation

Do not re-fire as-is — at ~2.75 h/iteration against a 5.5 h ceiling it will fail identically. Land finding 1 (one line) and finding 2 before the next attempt, and treat the per-iteration cost as the real blocker. Not re-firing, not merging anything; leaving both to the maintainer.

_{Assessed from run 33314987898 evidence + independent verification at current main.}

[bkrabach]

Maintainer seed for re-fire. Prior run 33314987898 caught an alive-void dodge: | \\grep -q . (backslash-escaped program name) defeated CMD-001's _last_pipe_stage_program check — the gate must catch this class of dodge again this round. Also noted for a future lint-rule hardening: CMD-001's program-name extraction should be robust to a backslash-escaped invocation of the same program (this is evidence for that hardening, not a fix requested here). Also seed: the maker's freshness-floor stumble from that run — watch for it recurring. Re-firing now with the default fuse.