Certificate #004: todo-issue-sync 1.0

Certificate of Conformance #004. The first unit pulled by real demand rather than a re-certification sweep: an autonomous agent asked for a gauge, and this skill is the answer. It reconciles a maintained task list against live issue state, so a stale item cannot sit unnoticed. It is also the certificate whose defect record the line refused to round up.

​

The card

The check script is deterministic; the skill prose is consumed by whatever agent loads it, so the unit binds no model at runtime and lapses on a consuming-model swap.

​

Bill of materials

• skills/todo-issue-sync/SKILL.md, sha256 28915c337ecb68e30066de1bbcdfc517ff6e1f19e8b4759c1de68415cde16777
• skills/todo-issue-sync/check-todo-sync.py, sha256 b081d744f7075ae781ae44687fe53f30ceb4ce7e00a9c50e03e6b247d85ff2f5
• Fixture suite: 12 files across six scenario directories (five planted-defect, one conforming), each pairing a task-list file with an issue-state file. Every fixture is content-hashed into the certificate on disk; the per-file hashes live there so a reader can recompute the whole BOM.
• Part: none. The check script and fixtures are bespoke; the issue CLI is a runtime dependency, not a registry part.
• Model: one binding in the assembling and certifying role, recorded in the certificate. No runtime model binding.

​

Evidence

• Eval: the skill-validator gate battery, 5 of 5 PASS (verdict PASS_WITH_WARNINGS, 1 advisory). The advisory is a known false positive: the validator’s placeholder check trips on this unit’s own subject-matter vocabulary, which is noise stamped into the artifact, not a defect. The fixture self-test also passed: five planted-defect fixtures each rejected for its planted reason, one conforming fixture accepted, and all three fail-closed paths red.
• Proof of work: the validator report and the self-test output, plus per-fixture acceptance runs pasted verbatim into the delivery PR.
• Judge: none. The judge harness is not built yet (a published gap). The probabilistic layer was manual: a second agent’s independent review, plus Sivart’s own procedure-match confirmation on the demand issue.
• Traces: the demand and confirmation issue (#126) and the production retro (WO-A9).

​

Provenance

• Work order: WO-A9, issue #126, demand-pulled.
• Assembling agent: a worker session on the production run.
• Trial runs: none required. A skill’s gauge is its planted-defect fixture suite, run in both directions. The first production runs belong to Sivart’s own loop, per her acceptance on the demand issue.

​

Liability

• Owner of record: Sivart, the factory’s autonomous agent.
• Escalation: the consuming loop (Sivart’s scheduled run or main session) opens an issue on the factory’s public repository, and the operator of record takes the call.
• Recall: kill switch. Sivart’s loop stops invoking the skill and falls back to the documented hand-run audit; the certificate is marked recalled; root cause is found by Five Whys; the die is fixed upstream (the check script, the fixture suite, or a stale source contract); the Verify gates re-run and the certificate re-issues.

​

Expiry

• Re-certify by: on dependency change. Per the skill family gauge there is no calendar interval; the certificate lapses when a dependency moves.
• Triggers: a change to the source workflow contract this skill encodes verbatim; a change to the skill validator (the gauge); an issue-list output-shape change; a consuming-model swap; or 3 production failures.

​

The defect, published

This is the certificate the line most wanted to round up, and did not. The production run reported clean: every gate green on first attempt, no rework loop. Then an independent code review of the delivery PR, after the unit was already certified, found three real defects the gate stack had passed green. All three were confirmed and fixed the same shift, before merge. The certificate was regenerated so its BOM hashes matched the fixed files, and the evidence was re-run. First-pass yield was not clean, and the record says so. The three escapes:

1. A placeholder-skip applied to every section, not the one it was documented for. A malformed placeholder-like item in the wrong section was silently dropped before the relevant check ran, so the tool reported conforming instead of flagging the orphan. Root cause: the fixture suite had never planted a placeholder-like line outside the documented section, so the over-broad skip had no red test to trip it. A gauge gap, not a code typo: the die (the fixtures) was incomplete. A new fixture now pins it.
2. An unrecognized-state branch had zero coverage, yet the certificate claimed both fail-closed paths were exercised. Root cause: the coverage claim outran the test; the evidence sentence was written to the design intent, not to what the self-test actually ran. Fixed by adding the missing self-test case and correcting the certificate to name all three fail-closed paths honestly.
3. A regex prefix group that was a no-op the comment implied was load-bearing. Behaviorally harmless, but a false signal in the die. Simplified to what it does, and the comment rewritten.

These were gauge-and-honesty escapes, not runtime failures in production; the skill had not yet run in Sivart’s loop. They are counted here so the line’s yield numbers stay true. The original production-run record was left exactly as written, and the defect record was appended below it rather than replacing it. That is the discipline: you do not get to rewrite the run once the review finds what the gates missed.

​

Self-audit