feat(verb): pin-closure — the transitive closure of a pin advance, iterated to a fixed point

AGENTS.md

@@ -1,26 +1,26 @@
 # AGENTS.md — plugin-task
 
 Standalone plugin repo for the generic declarative TASK runner (`kind:task`,
-`command:task`, `verb:task`) plus five generic maintenance verbs
+`command:task`, `verb:task`) plus six generic maintenance verbs
 (`verb:git-submodules`, `verb:file-parity`, `verb:splice-region`,
-`verb:module-pins`, `verb:prune`). The Go module lives at `candy/plugin-task/` (module path
+`verb:module-pins`, `verb:pin-closure`, `verb:prune`). The Go module lives at `candy/plugin-task/` (module path
 `github.com/opencharly/plugin-task/candy/plugin-task`); the root `charly.yml`
 declares `discover: candy` so the repo is a project and its candy is scanned.
 
 Canonical files:
 
 - `candy/plugin-task/charly.yml` — the `plugin-task:` candy entity (`plugin:`
   block, `plan:` checks).
-- `candy/plugin-task/plugin.go` — `NewProvider`/`NewMeta` and the seven
+- `candy/plugin-task/plugin.go` — `NewProvider`/`NewMeta` and the nine
   capability declarations.
 - `candy/plugin-task/grammar.go`, `graph.go`, `runner.go`, `incremental.go`,
   `verbs.go`, `cli.go` — the task engine, dependency graph, incremental
-  semantics, the five maintenance verbs, and the CLI.
+  semantics, the six maintenance verbs, and the CLI.
 - `candy/plugin-task/schema/task.cue` + `params/cue_types_gen.go` — the
   self-contained schema and its generated types.
 - `candy/plugin-task/cmd/serve/main.go` — the out-of-process serve shim.
 - `scripts/gate-task.sh` — the repo's own gate helper: builds a real charly binary
-  with this candy compiled in and drives `command:task` + the five maintenance
+  with this candy compiled in and drives `command:task` + the six maintenance
   verbs live.
 - `scripts/check-coherence.sh` — the control that charly's own `sdk`/`spec` pins
   lead this module's requires. Called by `gate-task.sh` (before its build) and by
@@ -59,7 +59,7 @@ when one is authored, add it here.
   `plugin:` block, CUE schema).
 - `scripts/gate-task.sh` at the repo root — the live gate: it clones charly at
   `CHARLY_REF` (default `main`), builds a binary with this candy compiled in, and
-  drives `command:task` plus the five maintenance verbs against real git fixtures.
+  drives `command:task` plus the six maintenance verbs against real git fixtures.
   It is the ONLY live execution of those verbs, so it must keep running.
 - CI runs two jobs besides the Go gates: `coherence` on every PR (seconds — the
   same `scripts/check-coherence.sh` control the gate runs, so the vintage-coherence
@@ -78,7 +78,7 @@ when one is authored, add it here.
 - The task body is the base-schema `#Task`, validated host-side against
   `#TaskValue`; keep the engine reusing `kit.RunPlan` + `checkkit.VerbResolver`
   over `kit.ShellExecutor{}` — there is no second execution engine.
-- The five maintenance verbs stay domain-neutral and parameterized by the repo's
+- The six maintenance verbs stay domain-neutral and parameterized by the repo's
   own data; never bake an org, repo, or distro name into the plugin.
 
 ## Landing

README.md

@@ -17,11 +17,12 @@ compiled into charly.
 | `verb:file-parity` | `file-parity:` verb step | check / sync that paired files are byte-identical |
 | `verb:splice-region` | `splice-region:` verb step | splice a marked region from a fragment into a target |
 | `verb:module-pins` | `module-pins:` verb step | adopt a source go.mod's require pins across every module a glob matches, then tidy |
+| `verb:pin-closure` | `pin-closure:` verb step | resolve the TRANSITIVE CLOSURE of a pin advance: compile the composed set, classify every failing module BUMP (a published version already carries the fix) or EDIT (it does not), and iterate to a fixed point |
 | `verb:prune` | `prune:` verb step | garbage-collect MERGED-UPSTREAM session worktrees + branches across the project root and every submodule (a dry run by default) |
 
 ## Generic maintenance verbs
 
-The five maintenance verbs replace repository shell scripts. Each is **domain-neutral**
+The six maintenance verbs replace repository shell scripts. Each is **domain-neutral**
 and parameterized by the repo's OWN data (paths, pairs, pins) carried in its authored
 input, so the plugin stays reusable by any repository — no org name, repo name, or
 distro list is baked in. They are host-native: like the task engine they act on the

candy/plugin-task/charly.yml

@@ -42,6 +42,7 @@ plugin-task:
                 - verb:file-parity
                 - verb:splice-region
                 - verb:module-pins
+                - verb:pin-closure
                 - verb:prune
             primary:
                 task: task
@@ -51,8 +52,8 @@ plugin-task:
               context:
                 - build
               command: "test -f plugin.go && test -f schema/task.cue && test -f params/cue_types_gen.go && echo 'plugin.go schema/task.cue params/cue_types_gen.go all present'"
-            - check: the provider source declares all eight capabilities (the three task classes individually + the five maintenance verbs) — a deterministic probe that fails if a capability is dropped
+            - check: the provider source declares all nine capabilities (the three task classes individually + the six maintenance verbs) — a deterministic probe that fails if a capability is dropped
               id: task-capabilities-declared
               context:
                 - build
-              command: "grep -q 'Class: \"kind\", Word: \"task\"' plugin.go && grep -q 'Class: \"command\", Word: \"task\"' plugin.go && grep -q 'Class: \"verb\", Word: \"task\"' plugin.go && grep -q 'Word: \"git-submodules\"' plugin.go && grep -q 'Word: \"file-parity\"' plugin.go && grep -q 'Word: \"splice-region\"' plugin.go && grep -q 'Word: \"module-pins\"' plugin.go && grep -q 'Word: \"prune\"' plugin.go && echo 'kind/command/verb:task + five maintenance verbs declared'"
+              command: "grep -q 'Class: \"kind\", Word: \"task\"' plugin.go && grep -q 'Class: \"command\", Word: \"task\"' plugin.go && grep -q 'Class: \"verb\", Word: \"task\"' plugin.go && grep -q 'Word: \"git-submodules\"' plugin.go && grep -q 'Word: \"file-parity\"' plugin.go && grep -q 'Word: \"splice-region\"' plugin.go && grep -q 'Word: \"module-pins\"' plugin.go && grep -q 'Word: \"pin-closure\"' plugin.go && grep -q 'Word: \"prune\"' plugin.go && echo 'kind/command/verb:task + six maintenance verbs declared'"