fix(skills): канон адресации num/ref/uuid вместо internal id (task:1221) + парная review через субагента + деплой-гейт

mappa-task-work v1.5.0:
- entity_get/task_get: uuid | task:NNN | bare num (голое число = num, канон 1221)
- Phase 3.5: self-assigned impl-таска создаёт парную review; ревью через субагента (review_subagent/review-kit-pi-method), не сам
- Phase 3.6: деплой-гейт (close → review → follow-up done → deploy, через .admin)

mappa-brainstorm-promote v1.10.0:
- brainstorm_id = num | ref | uuid; PATCH /brainstorm/:id num|ref|uuid
- 'bare numbers → 400' убрано (этап A task:1221 задеплоен)

mappa-knowledge v1.5.2:
- wiki_update: num/ref/uuid вместо internal id; addressing slug → num/ref/uuid

mappa-delegation v1.4.0:
- деплой-гейт (target .admin, ранбуки/секреты служебные)
- уведомление всех затронутых проектов письмом (кроме себя)

skills/mappa-brainstorm-promote/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: mappa-brainstorm-promote
 author: ours
-version: 1.9.0
+version: 1.10.0
 description: >
   Finalize a brainstorm buffer (mappa type=brainstorm, status=buffer): two
   paths. (1) Promote a matured buffer — read → target → brainstorm_promote
@@ -108,10 +108,11 @@ brainstorm entity in mappa (type=brainstorm, status=buffer)
 
 1. **Find the buffer in mappa.** `mcp__mappa__entity_search(type='brainstorm',
    project=<project>, q=<topic>)` → in the results brainstorm:N (ref). Read the
-   full buffer: `mcp__mappa__entity_get(key)` — key = uuid or full ref
-   `brainstorm:N` (task:1067; bare numbers → 400) — body = running record
-   (frontmatter + rounds). The response carries the internal `id` for
-   `brainstorm_promote`.
+   full buffer: `mcp__mappa__entity_get(key)` — key = uuid, full ref
+   `brainstorm:N`, or bare num (канон адресации task:1221: голое число = num;
+   этап A задеплоен) — body = running record (frontmatter + rounds).
+   Адресация буфера — по num/ref/uuid, internal id наружу не используем
+   (выпилится в этапе B, task:1221).
 
    If the buffer is not in mappa — create a brainstorm entity via
    `mcp__mappa__brainstorm_create` (or HTTP `POST /entities` type=brainstorm,
@@ -143,7 +144,7 @@ brainstorm entity in mappa (type=brainstorm, status=buffer)
 
 5. **Content promotion (always via `brainstorm_promote`, decision 7):**
 
-   `mcp__mappa__brainstorm_promote(project=<target>, brainstorm_id=<internal id>)`
+   `mcp__mappa__brainstorm_promote(project=<target>, brainstorm_id=<num | ref brainstorm:N | uuid>)`
 
    - Atomically: buffer → wiki page (slug from the buffer, body preserved,
      parent_of buffer→wiki edges and refs→buffer) + buffer → `archive` +
@@ -151,12 +152,12 @@ brainstorm entity in mappa (type=brainstorm, status=buffer)
    - **Frontmatter-summary (wiki:2661):** make sure the buffer body has
      `summary:` as one line in the frontmatter — `wiki.search` cards read it.
      If missing — append via `mcp__mappa__brainstorm_update` (PATCH
-     /brainstorm/:id, title/body/status, optimistic version+409) before the
-     promotion.
+     /brainstorm/:id, title/body/status, optimistic version+409; id = num |
+     ref | uuid) before the promotion.
    - Re-promoting an archived buffer → error (one-shot, idempotent via
-     status). Cross-check `brainstorm_id` (internal) from step 1.
+     status). Cross-check `brainstorm_id` (num/ref) from step 1.
    - If `brainstorm_promote` failed (version conflict, 409) → retry with the
-     fresh internal id; on a stable failure — abort before creating tasks.
+     fresh num/ref; on a stable failure — abort before creating tasks.
 
 5b. **Closing an already-completed buffer (no promotion).** When the work is
    already done and no wiki page is needed (legacy-promoted, resolved by the
@@ -257,7 +258,7 @@ brainstorm entity in mappa (type=brainstorm, status=buffer)
   with the error text; don't create a buffer by guess.
 - Target project doesn't exist in mappa → abort before promotion.
 - `brainstorm_promote` failed (409 version / stable refusal) → retry with the
-  fresh internal id; on a repeated failure — abort before creating tasks. The
+  fresh num/ref; on a repeated failure — abort before creating tasks. The
   buffer stays in buffer — retried later.
 - Buffer already `archive` (repeated call) → abort: promotion is one-shot,
   idempotence via status (decision 7).

skills/mappa-delegation/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: mappa-delegation
 author: ours
-version: 1.3.0
+version: 1.4.0
 description: >
   The cycle of delegating a task to another agent/project: pre-flight gate →
   body template → dry-run preview → confirm → covering letter to the
@@ -176,6 +176,17 @@ If the task is implementation — create the paired `<slug>-review`
 (status=blocked, blocker=`#n` — the impl task number). Skip for: pointer
 tasks, ops tasks, research tasks, any non-impl.
 
+**Deploy gate (operator rule 2026-08-26):** if the task requires deploy — its
+target is `.admin` (secrets/runbooks are service-use, other agents must NOT
+look into them), not the app repo. Deploy is possible ONLY after: impl close →
+paired review done → all follow-up tasks closed. Admin gets the task + a
+covering letter.
+
+**Notifying affected projects (operator rule 2026-08-26):** every delegation /
+promotion notifies the project agents — the covering letter goes to ALL
+affected projects, except yourself (self-copy doesn't count as notifying
+others). Task on a board doesn't ping a live session; the letter is the ping.
+
 **`weight` of the review task — inherit from the impl task, but never below
 `needs-claude`** (set explicitly at `tasks_create`):
 

skills/mappa-knowledge/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: mappa-knowledge
 author: ours
-version: 1.5.1
+version: 1.5.2
 description: >
   The cycle of working with a project's knowledge in Mappa (Karpathy LLM Wiki,
   channel = mappa entities): ingest → query → lint + a graph layer for
@@ -86,10 +86,11 @@ write `summary:` — ONE essence line in the page frontmatter (`---\ntitle: …\
 card is poorer — snippet fallback only). Don't insert duplicate info into the
 body: the summary is compiled once, in the frontmatter.
 
-**Refs and ids (#1037/#1028).** The public surface carries the per-type ref by
+**Refs and ids (#1037/#1028, канон task:1221).** The public surface carries the per-type ref by
 full name as the first field: `ref: "wiki:3"` (decision 20, convention #1028),
-`num` next, the global `id` — internal (last). `wiki_update` needs the
-internal `id` — from the `wiki_get`/`entity_search` response. In prose —
+`num` next, the global `id` — internal (last). `wiki_update` takes the
+`num` | `ref wiki:N` | uuid (этап A task:1221 задеплоен: голое число = num;
+internal id наружу не используем — выпилится в этапе B). In prose —
 slug/name first, ref as anchor: "the spec `concepts/session-live-ingest`
 (wiki:2604)". In page bodies — wikilinks by slug (`[[concepts/foo]]`,
 decision 4) or per-type refs by full names (`[[task:N]]`/`[[inbox:N]]`).
@@ -171,9 +172,9 @@ Question form → tool:
 | incoming — «кто ссылается на X», «backlinks», "what links to X" | `graph_backlinks({id})` |
 | health — «сироты», «битые ссылки», «здоровье вики», "orphan pages" | `graph_stats()` + `graph_backlinks(id)` |
 
-**Addressing: slug → internal id.** Resolve `id` via `wiki_get`/`entity_search`
-(the last response field; `ref`/`num` — for display). Graph responses carry
-per-type refs by full names (`task:N`/`inbox:N`/`wiki:N`, convention #1028) —
+**Addressing: slug → num/ref/uuid.** Resolve the key via `wiki_get`/`entity_search`
+(ref/num/uuid — публичная адресация, канон task:1221; internal id не используем). Graph
+responses carry per-type refs by full names (`task:N`/`inbox:N`/`wiki:N`, convention #1028) —
 reference them, not ids. An empty `path` = the link genuinely doesn't exist —
 say so; don't invent a chain from textual proximity.
 
@@ -253,7 +254,7 @@ page already exists; don't proliferate catalog duplicates.
   work; reading — carve-out.
 - **Answering a relational question by reading one page.** That's the exact
   0%-recall failure — call graph_*.
-- **Slugs/paths into graph tools.** Only internal ids, and only fresh ones (a
+- **Slugs/paths into graph tools.** Only fresh keys (num/ref/uuid, канон task:1221; a
   deleted entity → error).
 - **Dragging the whole wiki into context** to "trace" links by hand — the
   service does it for zero tokens.

skills/mappa-task-work/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: mappa-task-work
 author: ours
-version: 1.4.1
+version: 1.5.0
 description: >
   The central cycle of working with tasks in Mappa: orientation → work
   selection (priority/due) → execution → handover (close + review-umbrella) +
@@ -53,8 +53,8 @@ cross-project overview (→ `using-system-snapshot`).
 | Create a task | `mcp__mappa__task_create(project, slug, title?, description?, status?, priority?, due?)` | **carve-out without a lease**; per-type number (decision 20) |
 | Close a task | `mcp__mappa__task_close(project, id, version)` | **version-based**: conflict → 409 → retry with the fresh version from task_get |
 | Update a task | `mcp__mappa__task_update(project, id, parent?, owner?, status?, reason?, version)` | version-based; 409 → retry |
-| Read a task | `mcp__mappa__entity_get(id)` | key: uuid or full ref `task:NNN` (task:1067); bare number → 400 |
-| Read a task compact | `mcp__mappa__task_get(id)` | key: uuid or `task:NNN`; bare number → 400 |
+| Read a task | `mcp__mappa__entity_get(id)` | key: uuid, full ref `task:NNN`, or bare num (канон task:1221: голое число = num) |
+| Read a task compact | `mcp__mappa__task_get(id)` | key: uuid, `task:NNN`, or bare num |
 | Board list | `mcp__mappa__entity_search(q, type='task', project=<name>, limit)` | all statuses |
 | parent_of tree | `mcp__mappa__graph_tree(root, depth?, fields?, limit?)` | umbrellas/hierarchy |
 | Related entities | `mcp__mappa__graph_neighbors/backlinks(id)` | refs to the task |
@@ -101,7 +101,7 @@ Don't confuse: 🟢 — *done*, not "ready". Ready is ⚪.
 2. **Board** — `entity_search(q, type='task', project=<name>, limit=50)`: sort
    by status (🔴 → 🟡 → ⚪), one line per task — row format from
    `mappa-presentation` (never raw JSON).
-3. If the user named a task — `entity_get(key)` by its ref/uuid (`task:NNN` or uuid; task:1067 — bare numbers rejected).
+3. If the user named a task — `entity_get(key)` by its ref/num/uuid (`task:NNN` / bare num / uuid; канон task:1221 — голое число = num).
 4. Confirm in one sentence: "We're in the middle of X, next step — Y".
 5. Ask whether the plan is right before acting.
 
@@ -154,11 +154,25 @@ Don't confuse: 🟢 — *done*, not "ready". Ready is ⚪.
    the commissioner: `project=<notify>`, `subject="[event: closed] <slug>"`,
    body = the outcome (done, acceptance, references). A live session writes it
    itself. Task 🟢 ≠ commissioner learned.
-5. **Review-umbrella for impl tasks** (canon `mappa-delegation`): if the task
-   is implementation and closed — the paired `<slug>-review` should already
-   have been created at assignment (status=blocked, blocker=impl#); closing the
-   impl unblocks the review. Don't create a review yourself if it didn't exist
-   — that's the assigner's job; mention it in the close-note.
+5. **Review for impl tasks (paired, canon rule 4 AGENTS .workshop).**
+   Every impl task gets a paired review — regardless of the assignment channel:
+   - **Assigned/delegated task** (`mappa-delegation`): the paired `<slug>-review`
+     was created at assignment (status=blocked, blocker=impl#); closing the impl
+     unblocks it — the next session in the target reviews.
+   - **Self-assigned task (your own board, mappa-task-work)**: YOU create the
+     paired `<slug>-review` (status=blocked, blocker=impl#) at the same moment
+     you create the impl task. **Do not review your own work** — run the review
+     through a subagent (`review_subagent` / `review-kit-pi-method`: clean
+     context, non-implementer) after close, then close the review with the
+     findings (or file them as follow-up tasks). If the subagent is unavailable
+     — leave the review task for the next session (blocked until then).
+   - If the impl is already closed — the review is created ready (not blocked).
+6. **Deploy gate (impl requiring deploy).** Deploy is possible ONLY after:
+   close → review (paired, done) → all follow-up tasks closed. Order
+   irreversible. All deploys go strictly through `.admin` (secrets and
+   runbooks are service-use; other agents must NOT look into them — only
+   `secret:<path>` refs). Admin gets a task + covering letter (canon
+   `mappa-delegation`). Never deploy yourself.
 6. Add a summary line to the handoff/wiki if present.
 
 ### Pause / switch / session end