CAST v1.4.0

Second-pass hardening: a fresh four-track review of v1.3.0 found 40 issues — including two hard blockers introduced by 1.3.0 itself — and all are fixed here. Headlines: fresh adoptions validate again (the 120-char description cap), backend/CLI projects can actually run the pipelines (the UI opt-out deadlock), the retrospective template now installs, the Docs Writer queue has producers, the Deferred lifecycle is defined end-to-end, and the release workflow self-heals. The IMPROVEMENTS.md tracking file was removed at release since every item was resolved.

Fixed (1.3.0 regressions)

• Every fresh adoption failed Phase 6 validation. The 1.3.0 trigger-first agent descriptions run 170–261 characters, but validation check 5 still capped them at 120. The cap is now 300.
• The backend/CLI ui opt-out deadlocked the pipelines. /agent-code Pre-Flight unconditionally required ui-milestone-{N}.md while /agent-plan correctly skipped producing it — each skill sent you to the other. The UI spec is now required only when the ui agent is installed, and CEO_REVIEW.md's UI input/section accept "N/A — no ui agent installed".
• templates/MILESTONE_RETROSPECTIVE.md was never installed — it had no disposition row, so adoption plans omitted the 1.3.0 headline template. Row added; the Phase 5 skeleton count corrected (eleven, not eight).
• The adoption resume path defeated itself twice: Phase 1 archived any prior adoption-plan.md — including the interrupted-run ledger that execution 5.1 resumes from (unchecked ledgers are now preserved as resume candidates); and a run that died after the version stamp (5.8) hit the equal-version "already at " stop rule on re-run (the stop now requires a completed prior run: report present and ledger fully checked).
• Compression damage from the 1.3.0 boilerplate pass: security/performance/docs-writer Model Configs mandated "checklist/profiling/documentation sections" that no longer exist (now cite the sections that do); refactor's "introduce no new abstractions" contradicted its own extract-shared-logic Authority (now scoped to the flagged Issue).

Added

• Docs Writer queue producers. The 1.3.0 drain checkpoints fired on a permanently empty queue — no agent was ever told to enqueue. The eight producer agents (architect, product, ui, coder, performance, debugger, reviewer, refactor) and PIPELINE_LOOP.md Steps 1/3 now instruct appending - <agent> | docs | <note> entries for documentation-worthy changes.
• A complete Deferred lifecycle. Deferred is an open held state (previously "terminal" in BUGS.md and "stays open" everywhere else, simultaneously). Terminal states are Closed / Won't Fix / Duplicate / Cannot Reproduce; "Not a Bug" triage maps to Won't Fix with rationale. Product re-triages Deferred bugs at /agent-code milestone completion and at /agent-plan Stage 1; Deferred Critical/High bugs block release until re-triaged. Task Status enums gained Deferred; Task Selection skips Complete and Deferred tasks; milestones complete when every task is Complete or Deferred ("Complete with Deferrals", with Known Issues listing) — previously a milestone with one deferred task could never complete.
• Retrospective metric sources. validator.md gained a source-mapping table (tasks ← Summary table, violations/conflicts ← AGENT_STATE, revision counts ← Revision History tables, actual duration ← STANDUP session dates, estimated effort ← the milestone definition) and the template's fields now cite those sources — no more unsourceable "planned duration".
• release.yml self-healing and hardening: a run that pushed the tag but failed to publish the Release is now repaired on the next push (tag kept, Release created); a workflow-level concurrency group closes the concurrent-push race; the notes extraction refuses to publish if the top CHANGELOG heading doesn't match the released version; the two accepted divergences from the manual checklist (push-head tagging, unconditional --latest) are documented in the workflow and the release policy.
• CI: five hardened/new checks — payload READMEs (agents/skills) linted against the canonical roster; the roster-description check fails on empty extraction and is row-scoped (was silently green for folded YAML and swapped descriptions); the example structural check derives instance→template pairs from filenames and fails on unmapped or missing wrap-up artifacts; a reverse token lint (payload → README table, with a per-use allowlist); the claude-code CLI pinned.
• Adoption-skill coverage: unattended pre-1.0 upgrades no longer dead-end (downgraded-Delete TODOs count as recorded for validation check 3); non-interactive dry runs waive the Phase 1 confirmation gate; validation greps exclude the cast-init payload itself (no more false positives on project-local skill installs); the version stamp is itself validated (exactly one line, matching metadata.version); the fast path substitutes [MAX_LOOP_COUNT] and the Last-updated date; the rollback recipe actually undoes git mv/git rm (git restore --source=HEAD --staged --worktree); monorepo discovery sweeps workspace members for nested .claude//CLAUDE.md; preserved customizations get a defined home (## Project Customizations (preserved) + AGENT_STATE decision-log row).

Changed

• CEO verdict is a single line — **Verdict**: <APPROVED | APPROVED WITH CONDITIONS | REVISION REQUIRED> replaces the three-checkbox section in which all three verdict strings appeared verbatim in every instance while the skills "keyed on these strings". Both skills parse the line.
• REVISION REQUIRED re-runs Stage 3: architecture-touching revisions re-pass Security + Performance before the CEO re-review, so the CEO never re-reviews against stale findings; Security/Performance gained the CEO revision-request Inputs row the other planning agents got in 1.3.0. /agent-plan's stage triggers are now stated once, identically (Stage 3 starts only after both Architecture and UI complete).
• Validator rescoped, Environment Issues wired: the per-task Process Checklist runs at completion checkpoints or on suspected violations (not as a pre-Product gate nothing invoked); when Tester flags an Environment Issue (now defined in tester.md), the orchestrator invokes Validator mid-loop.
• Per-task validation defined: Product applies the Task Validation Checklist as criteria per task, recording the outcome as task Status plus a STANDUP progress entry; the validation document is milestone-grain only (templates/README's claim that /agent-task uses it was wrong).
• Bug-status ownership reconciled: Duplicate — Bug Gatherer at filing; Cannot Reproduce — Debugger after investigation; BUGS.md's field-ownership table is canonical and both agent files now agree. Tester's residual "suggests a bug" routing got a criterion: out-of-scope defects are filed with Bug Gatherer without interrupting the task; in-scope failures return to Coder.
• Coverage target unified at 80% for new code (tester.md canonical, coder.md consistent; philosophy: acceptance criteria, edge cases, error paths — the 100%/80% contradiction is gone). Release gate wording unified ("no open Critical or High") in release.md's Goals.
• /agent-code opens its STANDUP session heading at Pre-Flight (it wrote entries into no session); STANDUP's worked example now actually conforms to its own grammar. AGENT_STATE guidance clarified everywhere: logs are append-only, current-state cells update in place.
• Token economy: @docs/PRD.md moved to the gated "add once populated" import group (CODE_PATTERNS remains the sole always-on import); /agent-task no longer re-reads CLAUDE.md/CODE_PATTERNS that session imports already loaded. arch-milestone-{N}.md now has a defined contract (instance of ARCH_SYSTEM.md; module/schema templates produce supplementary instances).
• Installed-docs corrections: docs/README's "uncomment the imports" advice replaced with the copy-out-a-bare-@path-line mechanism; subdirectory creation contradiction resolved (pre-created by /cast-init is canonical); TROUBLESHOOTING references in installed docs use the GitHub URL; assorted path-split and ownership wording fixes.
• Example fixture synced to the 1.4.0 shapes: STANDUP rewritten in the canonical grammar with a consistent docs-queue story; new retrospective, UX review, and milestone-validation instances; the CEO review uses the single-line verdict; BUG-002's Deferred story shows the milestone-completion re-triage; example/CLAUDE.md carries the Adopted with CAST v1.4.0 stamp.
• Repo docs: TROUBLESHOOTING.md fully refreshed (conflict priority, import syntax, verdict parsing, resume/upgrade/release-automation entries, UI opt-out entry); README's optional-agents list scoped truthfully, the engineering diagram extended through the task/milestone checkpoints, Quick Start folded into Install, and the placeholder table completed ([TEST_COVERAGE_CMD], [PLATFORM_LIST], [TICK_INTERVAL_MS]).

Migration

• Existing installs: re-run /cast-init (after npx skills update). If you adopted at 1.3.0, this re-run is what delivers the working Phase 6 validation, the retrospective template, and the UI opt-out fix.
• If your project skipped the ui agent (or you want to now): /agent-code no longer demands a UI spec — no workaround files needed.
• Deferred bugs in an existing artifacts/BUGS.md keep their status; the new rule is that Product re-triages them at each milestone completion and Deferred Critical/High block release until re-triaged.
• Hand-written CEO reviews: replace the checkbox Verdict section with the single **Verdict**: <value> line — the skills now parse that line specifically.

---