feat: move task-creation consent gate from agent to slash command

[bborbe]

Summary

Single Responsibility split on task creation in the vault-cli:work-on-task flow:

• Agent (vault-cli:work-on-task-assistant) loses Skill and Task tools — architecturally CAN NO LONGER create task files. On miss it emits a structured not_found verdict (searched-source evidence + suggested name) and STOPs.
• Slash command (vault-cli:work-on-task) gains the consent gate — parses not_found, asks user via AskUserQuestion, on Yes routes to Skill: vault-cli:create-task, then re-invokes the agent against the new task.

Fixes a real silent-create incident this session: a /vault-cli:work-on-task "Semantic search with Python 3.13" call auto-materialised a task file without ever asking. The agent's own prose-only ASK gate was bypassed when the calling slash command's delegate prompt nudged toward action. Capability removal makes the gate architectural — no future caller phrasing can bypass it.

What changed

• agents/work-on-task-assistant.md — Skill + Task out of tools:; <constraints> ASK rule + (via Skill) parenthetical removed; Phase 1 rewritten to emit not_found; <output_format> gains a not_found form; Phase 8 carve-out for not_found (no-op when no mutations happened — pre-PR review fix).
• commands/work-on-task.md — allowed-tools upgraded to [Task, AskUserQuestion, Skill]; new ## Phase 4 — Handle not_found section (parse → AskUserQuestion → Skill: vault-cli:create-task → re-invoke); Notes line "The agent searches; the slash command asks before creating."
• CHANGELOG.md — two feat: bullets under ## Unreleased.

No Go code changed. Spec: specs/in-progress/016-work-on-task-move-create-gate-to-slash-command.md.

Test plan

• make precommit ✅ (markdown only, all checks pass)
• Pre-PR /coding:pr-review loop: 1 Should-Fix (Phase 8 vs not_found) found + fixed; Nice-to-Have items deferred per loop discipline
• Runtime — not_found path: /vault-cli:work-on-task "Definitely Not A Real Vault Task XYZ" → agent emits not_found verdict, slash command asks via AskUserQuestion, no file created until Yes
• Runtime — found path (regression): /vault-cli:work-on-task "Try Hermes Agent harness" → standard Phase 2–8, report ends Ready to work on this task.

[ben-s-pull-request-reviewer]

Based on my comprehensive review of the diff, I've identified critical issues. Here is my consolidated report:

Findings

Must Fix (Critical)

1. Stale error_handling reference (agents/work-on-task-assistant.md:278)

   • The error_handling section still says: **Task not found in any source**: AskUserQuestion → create or stop with manual search tips
   • This is the OLD Phase 1 behavior. The new Phase 1 (lines 91-94) emits not_found verdict and STOPS — no AskUserQuestion, no Skill call.
   • The error_handling section is now factually incorrect and will mislead future readers.

2. Phase 3 still references removed Skill tool (agents/work-on-task-assistant.md:124-127)

   • Phase 3 says: If not found AND task came from Jira: AskUserQuestion → "Create Obsidian task file for local tracking?" Yes → Skill: vault-cli:create-task
   • But Skill has been removed from tools: (line 5). This code path will fail at runtime — the agent literally cannot call Skill: vault-cli:create-task because the tool isn't available.
   • This creates a hybrid architecture: the agent still has a create-gate for Jira-inputs in Phase 3, bypassing the slash command's Phase 4 handler entirely.

3. Output format not_found: token mismatch — Phase 1 prose (line 91) says "emit a not_found verdict" but the <output_format> block (line 260) defines not_found: (with colon). Phase 4 step 1 (commands/work-on-task.md:46) matches on the token — the implementation should be consistent. The agent's not_found verdict output block uses not_found: with a colon (line 261), which is the correct form for the slash command to match on.

Should Fix (Important)

4. Phase 3 creates a second bypass of the slash command's consent gate — For Jira-ID inputs where the Obsidian task file is missing, Phase 3 still proposes AskUserQuestion → Skill: vault-cli:create-task. This means for Jira-inputs, the agent still has a create-path independent of Phase 4. The spec's stated goal is "agent searches; slash command asks" — but for Jira inputs, the agent still asks directly.

Nice to Have (Optional)

5. **<success_criteria> line 288 references Phase 6 by number but the Phase 6 text itself (line 150) says "MUST run at least one search per task" — no semantic issue, just verify intent.

---

Now let me produce the JSON verdict:

{
  "verdict": "request-changes",
  "summary": "The PR makes progress on the stated goal (removing Skill/Task from agent tools, adding not_found verdict structure, adding Phase 4 to slash command) but has two critical gaps: (1) error_handling still documents the OLD AskUserQuestion create-gate behavior, which will mislead future readers; (2) Phase 3 still contains AskUserQuestion + Skill: vault-cli:create-task for the Jira-not-found case, but Skill is no longer in tools: so that code path will fail at runtime, AND it bypasses Phase 4 entirely for Jira inputs.",
  "comments": [
    {
      "file": "agents/work-on-task-assistant.md",
      "line": 278,
      "severity": "critical",
      "message": "error_handling still documents old Phase 1 behavior: 'Task not found in any source: AskUserQuestion → create or stop with manual search tips'. This is stale — Phase 1 (lines 91-94) now emits not_found verdict and STOPS. Update or remove this entry to reflect the new behavior."
    },
    {
      "file": "agents/work-on-task-assistant.md",
      "line": 124,
      "severity": "critical",
      "message": "Phase 3 'If not found AND task came from Jira' block still contains 'AskUserQuestion → Create Obsidian task file for local tracking?' and 'Yes → Skill: vault-cli:create-task', but 'Skill' has been removed from tools: (line 5). This code path will fail at runtime AND bypasses the slash command's Phase 4 consent gate. Either remove this block entirely (Jira-not-found should go through Phase 1 not_found → Phase 4) or update it to match the new architecture."
    },
    {
      "file": "commands/work-on-task.md",
      "line": 46,
      "severity": "major",
      "message": "Phase 4 step 1 says to parse for 'not_found:' token (with colon). Phase 1 prose (agent line 91) says 'emit a not_found verdict' (without colon). The output_format defines the block as 'not_found:' (with colon at line 261). Ensure the agent's actual output uses the 'not_found:' form consistently so the slash command's token match works."
    },
    {
      "file": "agents/work-on-task-assistant.md",
      "line": 124,
      "severity": "major",
      "message": "Phase 3 creates a second create-gate bypass for Jira-inputs, independent of Phase 4. For Jira-ID inputs where the Obsidian task file is missing, the agent would still ask via AskUserQuestion and invoke Skill directly — bypassing commands/work-on-task.md Phase 4 entirely. The spec goal is 'agent searches; slash command asks', but this creates a hybrid. Consider: if input was a Jira ID and Phase 1 emitted not_found, should Phase 3 also emit not_found (not try to create locally)?"
    }
  ],
  "concerns_addressed": [
    "security: Phase 4 relies on string-matching 'not_found:' token — slash command parses verdict and asks via AskUserQuestion before any Skill call — PARTIALLY ADDRESSED: Phase 4 is correctly implemented, but Phase 3 still has a bypass for Jira inputs",
    "correctness: Phase 4 step 5 re-invokes agent with new task title — implemented correctly in commands/work-on-task.md:53",
    "correctness: Phase 8 carve-out for not_found — correctly implemented at agent line 194: 'STOP without emitting Ready to work on this task.'",
    "security: allowed-tools upgraded to [Task, AskUserQuestion, Skill] — CORRECT: tools list matches Phase 2 (Task), Phase 4 (AskUserQuestion + Skill)",
    "correctness: Task and Skill tools removed from agent tools frontmatter — CORRECT: line 5 no longer contains Task or Skill",
    "correctness: Phase 3 still has AskUserQuestion+Skill for Jira-not-found — NOT ADDRESSED: see critical finding above"
  ]
}

superseded by new automated review

[ben-s-pull-request-reviewer]

Now I have all the information needed for the consolidated report. Let me compile my findings:

Summary of Changes:

• agents/work-on-task-assistant.md: Removed Skill and Task from tools: frontmatter; rewrote Phase 1 "Task not found" to emit not_found verdict; added not_found form to <output_format>; removed ASK: before creating constraint
• commands/work-on-task.md: Updated allowed-tools to [Task, AskUserQuestion, Skill]; added ## Phase 4 — Handle not_found section
• CHANGELOG.md: Added ## Unreleased section with feat entries
• New spec and prompt files added

Key Review Findings:

1. Critical: Phase 5 Skill: coding:check-guides will fail at runtime — Skill is referenced in Phase 5 (line 141) as Skill: coding:check-guides for coding tasks, but Skill was removed from the tools: frontmatter entirely. The agent will fail when trying to invoke this legitimate tool for development guide discovery.

2. Phase 7 Task(...) reference will fail — Phase 7 says "Optionally invoke Task(subagent_type='vault-cli:task-manager-agent')" but Task is also removed from tools:.

3. The consent gate fix is sound — removing Skill and Task from the agent's tools: prevents the agent from bypassing the consent gate. The architectural split is correct.

4. The not_found verdict format appears correct — the slash command parses not_found: and Suggested task name:, which the agent produces.

5. Static verification passes — ASK: before creating removed, not_found verdict present, Phase 4 present, notes sentence present, allowed-tools updated correctly.

6. Runtime regression risk (marked TODO in PR) — the not_found path has no test coverage.

{
  "verdict": "request-changes",
  "summary": "The consent gate refactor is architecturally correct — removing Skill/Task from the agent's tools frontmatter prevents silent task creation. However, the removal breaks Phase 5's legitimate invocation of `Skill: coding:check-guides` for coding-task guide discovery, since Skill was removed from the tools list entirely rather than being scope-limited to just vault-cli:create-task. Additionally, Phase 7's optional Task subagent call will also fail. The slash command Phase 4 implementation is sound.",
  "comments": [
    {
      "file": "agents/work-on-task-assistant.md",
      "line": 141,
      "severity": "critical",
      "message": "Phase 5 instructs the agent to invoke `Skill: coding:check-guides` for coding tasks, but `Skill` is not in the `tools:` frontmatter (line 5). This is a regression — the agent can no longer discover development guides for code tasks. The model will attempt the call and receive a 'tool not available' error at runtime."
    },
    {
      "file": "agents/work-on-task-assistant.md",
      "line": 185,
      "severity": "critical",
      "message": "Phase 7 contains `Task(subagent_type='vault-cli:task-manager-agent')` but `Task` is removed from `tools:` frontmatter (line 5). Any agent attempt to invoke this will fail at runtime with 'tool not available'."
    },
    {
      "file": "agents/work-on-task-assistant.md",
      "line": 5,
      "severity": "major",
      "message": "The `tools:` removal is over-broad. The original problem was only `Skill: vault-cli:create-task` bypassing the consent gate. Removing Skill entirely breaks legitimate uses: `coding:check-guides` (Phase 5) and `Task` (Phase 7). A narrower fix would be to keep Skill/Task in tools but add an explicit constraint: 'Skill: vault-cli:create-task is BLOCKED — only the slash command may create tasks after user consent'."
    },
    {
      "file": "commands/work-on-task.md",
      "line": 89,
      "severity": "minor",
      "message": "The manual search tips reference `{daily_dir}` and `{tasks_dir}` placeholders verbatim in the output template. These should be substituted with actual resolved paths from vault-cli config, otherwise the user sees literal placeholder text like '{daily_dir}/YYYY-MM-DD.md' instead of the real path."
    }
  ],
  "concerns_addressed": [
    "security: Skill/Task removed from agent tools — agent can no longer bypass consent gate to create tasks — ADDRESSED (though removal is over-broad, causing Phase 5/7 regressions)",
    "correctness: not_found verdict format uses literal `not_found:` header and `Suggested task name:` — matches what slash command Phase 4 parses — ADDRESSED",
    "correctness: allowed-tools upgraded to [Task, AskUserQuestion, Skill] — Phase 4 can invoke AskUserQuestion and Skill:create-task — ADDRESSED",
    "tests: Runtime not_found path marked as TODO — NOT ADDRESSED — no test coverage for the consent gate path"
  ]
}

superseded by new automated review

[ben-s-pull-request-reviewer]

Now I have all the information needed. Let me compile the consolidated review:

---

## PR Review: feat: move task-creation consent gate from agent to slash command

Changed Files (vs master)

• agents/work-on-task-assistant.md — tool removal, Phase 1 rewrite, not_found output_format
• commands/work-on-task.md — Phase 4 addition, allowed-tools update
• prompts/completed/137-spec-016-move-create-gate-to-slash-command.md — prompt artifact
• specs/in-progress/016-work-on-task-move-create-gate-to-slash-command.md — spec artifact
• CHANGELOG.md — Unreleased section

---

Static Verification Results

Check	Result
Skill in agent tools:	✅ Removed — Skill does not appear as a usable tool in the agent
Task in agent tools:	⚠️ Present (see Must Fix below)
ASK: before creating	✅ Removed from <constraints>
not_found verdict	✅ Present in Phase 1, Phase 3, Phase 8 carve-out, <output_format>
Phase 4 in command	✅ Added at line 42 with em-dash heading
allowed-tools updated	✅ [Task, AskUserQuestion, Skill] — all three present
Architectural split note	✅ "The agent searches; the slash command asks before creating." at line 86
No Go files changed	✅ 0 Go files in diff
make precommit	⛔ Blocked — git/permission env not available in this session

---

Must Fix (Critical)

1. Task tool still in agent tools: despite spec + changelog claiming both Skill AND Task were removed

• File: agents/work-on-task-assistant.md:5
• The diff from master shows only Skill was removed from the tools: frontmatter. Task remains.
• The spec AC (line 580) says: "agents/work-on-task-assistant.md tools: frontmatter does NOT include Skill or Task"
• The PR's own CHANGELOG entry says: "agent loses Skill and Task tools"
• Impact: The spec and changelog are contractively inaccurate. The Phase 5 dispatch (Task(subagent_type='coding:pre-implementation-assistant', ...)) does require Task for the coding:pre-implementation-assistant subagent dispatch, so removing it entirely would break legitimate behavior. However, the stated spec and the changelog claim both were removed, creating a documentation inconsistency.
• Fix needed: Either (a) update the spec AC and CHANGELOG to accurately reflect that Task was kept for Phase 5 dispatch, or (b) find an alternative implementation for Phase 5 that doesn't require the Task tool in the agent's session.

2. Duplicate word in CHANGELOG entry

• File: CHANGELOG.md:13
• The feat entry reads: "...from vault-cli:work-on-task-assistant to vault-cli:work-on-task slash command..."
• The phrase "vault-cli:work-on-task slash command" has vault-cli appearing twice with only punctuation between.
• Fix: Remove the duplicate "vault-cli:" prefix from the second occurrence.

---

Should Fix (Important)

3. Task tool still callable by agent if invoked directly (not via slash command)

• File: agents/work-on-task-assistant.md:5
• The agent still has Task in its tools. While Phase 1 correctly emits not_found and the redaction block prevents Skill: vault-cli:create-task, the Task tool itself is not blocked. A caller who invokes vault-cli:work-on-task-assistant directly (not through the slash command) could theoretically ask it to Task(subagent_type='vault-cli:create-task-assistant', prompt='Create task: X'), which would bypass the consent gate.
• Mitigating factor: The slash command (vault-cli:work-on-task) is the only documented entry point. The agent's own documented uses of Task are limited to coding:pre-implementation-assistant and vault-cli:task-manager-agent. No evidence of direct invocation in the codebase.
• Fix suggestion: Consider whether the agent's Task tool should be further restricted (e.g., via <constraints> naming only the allowed subagent types), or whether the allowed-tools description should document this constraint.

---

Nice to Have (Optional)

None identified.

---

Concerns from Plan — Resolution Status

Concern	Status
security: Skill and Task tools removed from agent — verify no remaining path for agent to bypass consent gate	⚠️ Partially addressed — Skill is correctly removed and the redaction block in Phase 1/Phase 3 prevents direct Skill: vault-cli:create-task calls. However, Task remains in the agent's tools: (see Must Fix #1 above), and no constraint restricts which subagent types the agent may dispatch via Task. The slash-command-only invocation path mitigates this for normal usage, but direct agent invocation is a theoretical bypass.
correctness: Phase 4 handles not_found parsing, AskUserQuestion, re-invocation — verify no infinite recursion risk	✅ Addressed — Phase 1 not_found short-circuits before Phase 5 (code-task guide check) runs, so re-invocation on a newly created task reaches Phase 2 and completes normally. No circular dependency.
correctness: Phase 8 carve-out for not_found short-circuits correctly	✅ Addressed — Phase 8 explicitly carves out not_found: "Phase 8 is a no-op — the not_found verdict IS the report, no mutations occurred to verify, and the agent STOPs without emitting 'Ready to work on this task.'"
correctness: Skill invocation target (vault-cli:create-task) is correctly parameterized	✅ Addressed — Phase 4 step 4 invokes Skill: vault-cli:create-task "<suggested name>" with quoted argument, matching the form in commands/create-task.md
tests: Runtime test for not_found path is unchecked	⚠️ Unresolved — make precommit could not run in this session. Manual runtime verification (per the spec's runtime repro steps) is still needed before merge.

---

Verdict JSON

{
  "verdict": "request-changes",
  "summary": "The consent-gate security fix is fundamentally sound — Skill tool removed, not_found verdict added, Phase 4 ask-user flow in slash command correctly gates creation. However, the agent's tools: line still contains Task (not removed as spec AC and changelog claim), and a duplicate word in the CHANGELOG entry needs fixing. These are concrete, fixable issues that should be corrected before merge.",
  "comments": [
    {
      "file": "agents/work-on-task-assistant.md",
      "line": 5,
      "severity": "critical",
      "message": "Must Fix: `Task` is still in the agent's `tools:` frontmatter. The spec AC (line 580) and the PR's own CHANGELOG entry both state that the agent loses both `Skill` and `Task` tools, but only `Skill` was removed. If the intent was to keep `Task` for Phase 5 subagent dispatch, the spec AC and CHANGELOG must be updated to reflect this accurately rather than claiming both were removed."
    },
    {
      "file": "CHANGELOG.md",
      "line": 13,
      "severity": "major",
      "message": "Should Fix: Duplicate word 'vault-cli' in feat entry — '...from `vault-cli:work-on-task-assistant` to `vault-cli:work-on-task` slash command...' should be '...from `vault-cli:work-on-task-assistant` to the `work-on-task` slash command...' to avoid the repetition."
    },
    {
      "file": "agents/work-on-task-assistant.md",
      "line": 5,
      "severity": "major",
      "message": "Should Fix: The agent's `Task` tool is unconstrained — Phase 5 uses it for `coding:pre-implementation-assistant`, but the agent could theoretically be asked (via direct invocation, outside the slash command) to `Task(subagent_type='vault-cli:create-task-assistant', ...)` and bypass the consent gate. Consider adding a `<constraints>` entry limiting `Task` dispatch to the documented subagent types, or document the invocation path restriction in the command's `## Phase 4`."
    }
  ],
  "concerns_addressed": [
    "security: Skill tool removed from agent — agent can no longer directly invoke vault-cli:create-task (confirmed at agents/work-on-task-assistant.md:93 redaction block). However, Task tool remains in tools: despite spec+changelog claiming both removed — raised as Must Fix.",
    "correctness: Phase 8 carve-out for not_found correctly short-circuits at agents/work-on-task-assistant.md:192 — verified present.",
    "correctness: Phase 4 re-invocation cannot infinitely recurse — not_found from Phase 1 skips Phase 5 (code-task guide check), so newly created task reaches Phase 2 and completes normally.",
    "correctness: Skill invocation in Phase 4 correctly parameterized as vault-cli:create-task with quoted argument — verified at commands/work-on-task.md:52.",
    "tests: make precommit could not run in this environment — manual runtime verification (per spec runtime repro steps) required before merge."
  ]
}

superseded by new automated review

[ben-s-pull-request-reviewer]

Based on my analysis of the diff against master, here is my consolidated review:

---

PR Review: feat: move task-creation consent gate from agent to slash command

Files Changed

• CHANGELOG.md (+5 lines)
• agents/work-on-task-assistant.md (+34/-10 lines)
• commands/work-on-task.md (+32 lines)
• prompts/completed/137-spec-016-move-create-gate-to-slash-command.md (new, +289 lines)
• specs/in-progress/016-work-on-task-move-create-gate-to-slash-command.md (new, +159 lines)

Automated Checks

3a. LICENSE file: Present at repo root. ✅

3b. make precommit: Not run (approval sandbox blocks multi-command chains). No Go files changed, so no build risk.

3c. ast-grep: No rules/ directory present — project is markdown-driven, not Go-driven. Skipped.

---

Consolidated Report

Must Fix (Critical)

1. Version alignment violation — CHANGELOG.md:14

• CHANGELOG top versioned entry is ## v0.68.1, but all three .claude-plugin/*.json files declare "version": "0.68.0".
• Per CLAUDE.md MANDATORY rule: all four version strings MUST equal each other; make precommit runs check-versions which fails the build on mismatch.
• Fix: Bump all three plugin JSON fields to "version": "0.68.1" to match CHANGELOG, OR (if v0.68.1 is only in the ## Unreleased section and not yet released) confirm whether this is a pre-existing gap on master that this PR doesn't need to fix. The ## Unreleased section indicates unreleased changes above the v0.68.1 entry — the v0.68.1 line itself represents the last tagged release.

Should Fix (Important)

2. Missing error handling for create failure — commands/work-on-task.md:52-53

• Phase 4 step 4 says "On Yes, create it: invoke Skill: vault-cli:create-task" and step 5 says "On create success". There is no On failure / On error branch.
• If vault-cli:create-task returns an error (e.g., user cancels midway through the interactive flow, or the skill fails), the slash command has no defined behavior — it would silently fall through or behave unpredictably.
• Fix: Add a step 6: "On create failure or user-cancel: print ❌ Task creation failed. and STOP. Do not re-invoke the agent."

3. Placeholder text in manual search tips — commands/work-on-task.md:59-60

• Steps echo <echo the Searched: section from the agent's verdict> and <echo the Glob paths tried> — these are literal placeholder strings, not actual instructions. At runtime the slash command cannot echo a sub-block from the agent's output using these tokens.
• Fix: These values must be captured from the agent's structured not_found verdict at parse time (step 1), stored as variables, and substituted into the tips block. The current wording implies a templating mechanism that isn't described.

Nice to Have (Optional)

4. Spec and prompt artifacts on feature branch — specs/in-progress/, prompts/completed/

• The diff includes the spec (status: verifying) and the dark-factory execution prompt. While this is the natural dark-factory workflow state, these are 448 of the 509 new lines in the diff. The actual behavioral changes are the 45 lines across agents/work-on-task-assistant.md and commands/work-on-task.md.
• Not a bug — just worth noting the signal-to-noise ratio of the diff.

Correctness Verification (passed)

Check	File	Status
Skill removed from tools:	agents/work-on-task-assistant.md:5	✅
Task dispatch constrained to coding:pre-implementation-assistant + vault-cli:task-manager-agent	agents/work-on-task-assistant.md:35	✅
ASK: before creating removed from <constraints>	agents/work-on-task-assistant.md	✅
Phase 1 emits not_found verdict and STOPs	agents/work-on-task-assistant.md:92-95	✅
Phase 8 carve-out for not_found	agents/work-on-task-assistant.md:193	✅
not_found form added to <output_format> with Searched: + Suggested task name:	agents/work-on-task-assistant.md:259-271	✅
allowed-tools includes AskUserQuestion and Skill	commands/work-on-task.md:4	✅
Phase 4 parses not_found:, asks via AskUserQuestion, routes to create-task, re-invokes agent	commands/work-on-task.md:42-69	✅
Notes sentence added	commands/work-on-task.md:86	✅
## Unreleased section with feat: entries	CHANGELOG.md:9-12	✅
No Go files modified	—	✅

---

Verdict

{
  "verdict": "request-changes",
  "summary": "The architectural consent-gate refactor is correctly implemented — Skill tool removed from agent, Task dispatch constrained, not_found verdict structured, Phase 4 consent gate in slash command. However, a critical version-alignment violation (CHANGELOG says v0.68.1 but plugin JSONs say 0.68.0) and a missing error-handling branch for create failure must be resolved before merge.",
  "comments": [
    {
      "file": ".claude-plugin/plugin.json",
      "line": 1,
      "severity": "critical",
      "message": "Version mismatch: plugin.json declares \"version\": \"0.68.0\" but CHANGELOG.md top versioned entry is v0.68.1. All four version strings must equal per CLAUDE.md MANDATORY rule. Bump to \"0.68.1\" or clarify whether this gap predates this PR."
    },
    {
      "file": ".claude-plugin/marketplace.json",
      "line": 1,
      "severity": "critical",
      "message": "Version mismatch: marketplace.json metadata.version and plugins[0].version both \"0.68.0\" but CHANGELOG.md top versioned entry is v0.68.1. All four version strings must equal per CLAUDE.md MANDATORY rule."
    },
    {
      "file": "commands/work-on-task.md",
      "line": 52,
      "severity": "major",
      "message": "Phase 4 step 4/5 only handles 'On create success' — no error/cancel branch. If vault-cli:create-task fails or user cancels midway, slash command has undefined behavior. Add step 6: 'On create failure or cancel: print ❌ Task creation failed. and STOP.'"
    },
    {
      "file": "commands/work-on-task.md",
      "line": 59,
      "severity": "major",
      "message": "Steps 5c–5d echo '<echo the Searched: section from the agent's verdict>' — literal placeholder text, not a runtime variable. The not_found verdict values must be captured at parse time (step 1) and substituted here."
    }
  ],
  "concerns_addressed": [
    "security: Skill tool removed from agent tools: frontmatter — architecturally prevents Skill: vault-cli:create-task bypass — VERIFIED at agents/work-on-task-assistant.md:5",
    "security: Phase 4 consent gate in slash command parses not_found verdict and asks via AskUserQuestion before any create — VERIFIED at commands/work-on-task.md:42-69",
    "correctness: Phase 8 carve-out for not_found skips verification assertions when no mutations occurred — VERIFIED at agents/work-on-task-assistant.md:193",
    "correctness: not_found verdict includes Searched: evidence + Suggested task name: — VERIFIED at agents/work-on-task-assistant.md:259-271",
    "correctness: On Yes: Skill: vault-cli:create-task with quoted argument, then re-invoke agent — VERIFIED at commands/work-on-task.md:52-53",
    "tests: Runtime repro required for not_found and found paths — NOT TESTED in this review (requires interactive Claude Code session)"
  ]
}

[bborbe]

Per docs/releasing-vault-cli.md: the version-alignment rule is release-time only. .claude-plugin/plugin.json + marketplace.json are bumped by the releaser (or manually at release time) — not from feature branches. The current 0.68.0 vs CHANGELOG-top-v0.68.1 lag predates this PR (v0.68.1 was a Go-bump commit that didn't bump plugin JSONs). github-releaser-agent picks up the next binary tag from ## Unreleased after merge and either auto-bumps the JSONs or surfaces a manual plugin-release follow-up.

Keeping plugin JSONs untouched here per project policy. Other two MAJORs (Phase 4 error/cancel branch + literal-placeholder substitution) addressed in 29e048d.

superseded by new automated review

[ben-s-pull-request-reviewer]

Based on my thorough review of the diff, I found several documentation inconsistencies that should be fixed before this PR is merged. Here is my report:

---

PR Review: feat: move task-creation consent gate from agent to slash command

Verdict: request-changes

Must Fix (Critical)

1. Slash command Phase 4 references wrong agent phase number
commands/work-on-task.md:44
The slash command's Phase 4 text says "The agent (Phase 2 of this command) emits a structured not_found verdict". The agent's not_found verdict is emitted in Phase 1 (## Phase 1: Find task), not Phase 2. Phase 2 is the Jira auto-assign+transition step.
→ Fix: Change "Phase 2 of this command" to "Phase 1 of the agent"

2. Agent Phase 3 header still says "create"
agents/work-on-task-assistant.md:115
Header reads ## Phase 3: Find/create Obsidian task and set status — the "create" part is misleading since the agent no longer creates task files. Phase 3 now only finds or emits not_found; task creation lives in the slash command's Phase 4.
→ Fix: Rename to ## Phase 3: Find Obsidian task and set status

3. Agent Phase 3 description mentions "offer to create local file"
agents/work-on-task-assistant.md:135
The description "offer to create local file if missing" is stale — the agent no longer has this capability or behavior.
→ Fix: Remove or update this phrase to accurately describe the not_found verdict behavior.

4. Success criteria references stale "asked to create local file"
agents/work-on-task-assistant.md:285
Line 3 reads: "Obsidian status set to in_progress (or asked to create local file)" — the "asked" clause is no longer agent behavior.
→ Fix: Change to "Obsidian status set to in_progress (or not_found verdict if task is missing)"

5. Success criteria still references Skill: coding:check-guides
agents/work-on-task-assistant.md:287
Criterion 5 reads: "Code tasks: /coding:check-guides ran + Development Guide presented" — Phase 5 now uses Task(subagent_type='coding:pre-implementation-assistant', ...) instead of Skill: coding:check-guides.
→ Fix: Update to reference the Task-based subagent dispatch.

6. Phase 5 constraint text still references Skill-based approach
agents/work-on-task-assistant.md:33
The constraint reads: "- MANDATORY for code tasks: run /coding:check-guides and read project Development Guide if present" — this describes the old Skill-based call, not the new Task-based dispatch.
→ Fix: Update to reference Task dispatch to coding:pre-implementation-assistant.

7. Phase 3 output template still shows "Created Obsidian task file"
agents/work-on-task-assistant.md:220
The Obsidian: output line includes ✅ Created Obsidian task file — but Phase 3 no longer creates files; it emits not_found instead.
→ Fix: Remove ✅ Created Obsidian task file from the output format or update it to reflect the not_found case.

Should Fix (Important)

8. Slash command Phase 4 step 1 parsing description mismatch
commands/work-on-task.md:46
Step 1 says "The agent's <output_format> produces a fenced markdown block with the literal not_found: header on its own line" — but the agent's <output_format> actually has two separate fenced blocks: one for found and one for not_found. The slash command should clarify it looks for the not_found: block specifically. (The logic is likely correct, but the description could be clearer.)

---

Summary

The architectural change — removing Skill from the agent's tools: and moving the consent gate to the slash command — is sound and well-reasoned. The not_found verdict design is clear and the slash command's Phase 4 handling of AskUserQuestion + Skill routing is correct. However, the agent's documentation still contains multiple stale references to behaviors that were removed (file creation, Skill-based coding:check-guides), which will confuse future readers and could cause incorrect implementations if someone reads the agent doc instead of the spec.

{
  "verdict": "request-changes",
  "summary": "The architectural change (removing Skill tool from agent, moving consent gate to slash command Phase 4) is correct and well-scoped. However, the agent's own documentation contains stale references to removed behaviors — Phase 3 header still says 'create', success_criteria still mentions 'asked to create local file' and Skill-based coding:check-guides, and the slash command's Phase 4 misattributes the not_found verdict to 'Phase 2' when it originates from the agent's Phase 1. These documentation inconsistencies must be cleaned up before merge.",
  "comments": [
    {
      "file": "commands/work-on-task.md",
      "line": 44,
      "severity": "critical",
      "message": "Phase 4 text says 'The agent (Phase 2 of this command) emits a structured not_found verdict' — but the agent's not_found verdict is emitted in Phase 1 (Find task), not Phase 2 (Jira assign+transition). Fix: change 'Phase 2' to 'Phase 1 of the agent'."
    },
    {
      "file": "agents/work-on-task-assistant.md",
      "line": 115,
      "severity": "critical",
      "message": "Phase 3 header reads '## Phase 3: Find/create Obsidian task and set status' — the 'create' part is stale. The agent no longer creates files; task creation lives in the slash command's Phase 4. Rename to '## Phase 3: Find Obsidian task and set status'."
    },
    {
      "file": "agents/work-on-task-assistant.md",
      "line": 135,
      "severity": "critical",
      "message": "Description 'offer to create local file if missing' is stale — the agent no longer has Skill tool and does not offer to create. This phrase should be removed or updated."
    },
    {
      "file": "agents/work-on-task-assistant.md",
      "line": 220,
      "severity": "critical",
      "message": "Output template under Obsidian: includes '✅ Created Obsidian task file' — but Phase 3 no longer creates files, it emits not_found. Remove or update this line."
    },
    {
      "file": "agents/work-on-task-assistant.md",
      "line": 285,
      "severity": "critical",
      "message": "Success criterion 3 reads 'Obsidian status set to in_progress (or asked to create local file)' — the 'asked to create' clause is stale. Update to reference the not_found verdict instead."
    },
    {
      "file": "agents/work-on-task-assistant.md",
      "line": 287,
      "severity": "critical",
      "message": "Success criterion 5 reads 'Code tasks: /coding:check-guides ran' — Phase 5 now uses Task(subagent_type='coding:pre-implementation-assistant') instead of Skill: coding:check-guides. Update to reference the Task-based dispatch."
    },
    {
      "file": "agents/work-on-task-assistant.md",
      "line": 33,
      "severity": "critical",
      "message": "Constraint still reads 'MANDATORY for code tasks: run /coding:check-guides' — Phase 5 now uses Task dispatch to coding:pre-implementation-assistant, not Skill: coding:check-guides. Update this constraint text."
    }
  ],
  "concerns_addressed": [
    "security: Skill tool removed from agent tools: — agent can no longer invoke vault-cli:create-task directly — confirmed in agents/work-on-task-assistant.md tools: line (no Skill present)",
    "correctness: not_found verdict output format added to agent output_format section — confirmed at agents/work-on-task-assistant.md lines 259-271",
    "correctness: Phase 4 in slash command handles AskUserQuestion + Skill: vault-cli:create-task + re-invoke flow — confirmed at commands/work-on-task.md lines 42-71",
    "correctness: allowed-tools upgraded to [Task, AskUserQuestion, Skill] — confirmed at commands/work-on-task.md line 4",
    "tests: runtime testing for not_found path — documented in spec verification section; requires manual repro in a live session"
  ]
}

superseded by new automated review

[ben-s-pull-request-reviewer]

I've gathered sufficient information from the sub-agents. Let me compile the review findings into the final report.

Review Summary:

The PR implements the architectural change correctly. Key findings from automated checks:

• Skill removed from agent's tools: frontmatter (load-bearing security enforcement)
• Task retained with dispatch restrictions to coding:pre-implementation-assistant and vault-cli:task-manager-agent
• Phase 4 in command properly parses not_found: verdict and routes to Skill: vault-cli:create-task
• Phase 8 has carve-out for not_found case
• CHANGELOG follows conventions with ## Unreleased section
• No Go code was changed (spec constraint satisfied)
• LICENSE file exists

Limitation: Could not execute make precommit due to environment restrictions.

Manual review concern check against the plan:

1. ✅ Skill removal verified - no path for agent to invoke vault-cli:create-task
2. ⚠️ Phase 4 string matching for not_found: is present (line 44-45 of command) - fragile but documented
3. ⚠️ Step 5 re-invocation risk exists - if create-task somehow triggers the agent again, could loop
4. ✅ Phase 8 carve-out for not_found verified present
5. ⚠️ Step 6 error detection - uses Skill exit code, not well-defined in the command
6. ✅ Task dispatch restriction verified
7. ℹ️ Runtime repro is manual - precommit passing is the only gate

{
  "verdict": "approve",
  "summary": "Clean architectural refactor that removes the Skill tool from the agent's tools frontmatter, enforcing the consent gate at the slash command level. No Go code changed, CHANGELOG follows conventions, and automated audits confirm spec compliance for both the agent and command files. The not_found verdict string-matching in Phase 4 is structurally fragile but is the specified design. No Must Fix or Should Fix issues identified.",
  "comments": [
    {
      "file": "commands/work-on-task.md",
      "line": 44,
      "severity": "minor",
      "message": "Phase 4 parses not_found verdict via literal string matching ('literal not_found: header on its own line'). This is fragile against formatting changes (e.g., extra spaces, different capitalization). Consider using a regex anchor like '^not_found:' for slightly more robust matching, though the current approach matches the spec's explicit requirement."
    },
    {
      "file": "commands/work-on-task.md",
      "line": 59,
      "severity": "minor",
      "message": "Step 5 re-invokes work-on-task-assistant after task creation. If create-task's interactive flow somehow triggers the agent again, this could cause re-invocation. The command logic appears sound (it only re-invokes on success), but there is no explicit guard against recursive triggering."
    },
    {
      "file": "commands/work-on-task.md",
      "line": 65,
      "severity": "minor",
      "message": "Step 6 error detection for create-task uses Skill exit code. The command doesn't specify what status codes Skill returns on failure vs success. If Skill returns non-zero on both cancel and error, the user gets the same message for both cases. Consider documenting or detecting specific error forms."
    }
  ],
  "concerns_addressed": [
    "security: Skill tool removed from agent tools frontmatter — verified by audit agents, no path remains for agent to invoke vault-cli:create-task",
    "correctness: Phase 4 parses not_found verdict via string matching — present but fragile (minor concern)",
    "correctness: Step 5 re-invokes agent after task creation — present but no explicit recursive guard (minor concern)",
    "correctness: Phase 8 carve-out for not_found — verified present",
    "correctness: Step 6 error detection — uses Skill exit code but specific error forms not documented (minor concern)",
    "correctness: Task dispatch restricted to coding:pre-implementation-assistant and vault-cli:task-manager-agent — verified by audit agents",
    "tests: Runtime repro is manual only — precommit (make precommit) is the only gate; could not execute precommit in this environment"
  ]
}

superseded by new automated review

[ben-s-pull-request-reviewer]

All static checks pass. Here is the consolidated report and verdict.

Static Verification Results:

• Skill removed from agent tools: line — ✓
• Task retained in agent tools: (for legitimate Phase 5/7 dispatch) — ✓
• ASK: before creating removed from <constraints> — ✓
• not_found verdict form present in <output_format> — ✓
• Phase 4 — Handle not_found added to slash command (em-dash correct) — ✓
• allowed-tools: [Task, AskUserQuestion, Skill] in slash command — ✓
• ## Unreleased section placed correctly above ## v0.68.1 — ✓
• No Go files modified — ✓
• Only the 5 expected files changed (agent, command, CHANGELOG, spec, prompt) — ✓

Spec/Prompt files in diff: prompts/completed/ and specs/in-progress/ are documentation artifacts from the dark-factory execution history. They do not ship as part of the plugin and have no runtime effect.

Security note: allowed-tools: [Task, AskUserQuestion, Skill] is correctly scoped — the agent's <constraints> block restricts Task dispatch to only coding:pre-implementation-assistant and vault-cli:task-manager-agent, and the slash command's Phase 4 explicitly names only vault-cli:create-task as the Skill target.

{
  "verdict": "approve",
  "summary": "The feature branch correctly implements the consent-gate SRP split: the agent loses `Skill` (architectural block on task creation) while retaining `Task` for legitimate subagent dispatch; the slash command gains `AskUserQuestion` + `Skill` to own the create-gate; the structured `not_found` verdict is properly parsed and handled. No Go code changed, all static checks pass, happy path is regression-safe.",
  "comments": [],
  "concerns_addressed": [
    "correctness: Phase 4 re-invoke logic — slash command correctly re-invokes `vault-cli:work-on-task-assistant` on create success (commands/work-on-task.md step 5), ensuring the new task runs through standard Phase 2-8 prep",
    "correctness: Phase 8 not_found carve-out — agent's `<output_format>` includes the `not_found` form with proper `Searched:` evidence + `Suggested task name:`, and the slash command Phase 4 step 1 explicitly parses for the `not_found:` marker before the `Ready to work on this task.` found marker",
    "security: Skill tool scope — `Skill` is absent from the agent's `tools:` and the slash command's Phase 4 explicitly limits `Skill` invocation to `vault-cli:create-task` only; the agent's `<constraints>` restricts `Task` dispatch to documented subagent types only",
    "tests: runtime verification — not_found path and found-path regression require a live Claude Code session with vault-cli plugin loaded, which is properly documented in the spec's runtime-repro ACs and cannot be verified statically"
  ]
}