scope-disciplinelisted

# Scope Discipline — Close Loops, Don't Open Them ## The failure this prevents A single request balloons into a chain where every step uncovers new work and you chase it immediately, so nothing reaches "done + verified + deployed." This session: RAG → OAuth → directory submission → reviewer key → consent-key validation → CodeQL fixes — six threads, each started before the prior landed. The result feels like motion but lands nothing. (2026 reliability research flags "repetitive actions / no task completion" as the top long-horizon failure trigger — a metacognitive check on this is recommended: arxiv 2509.19783.) ## The rule: one in-flight task, with a parking lot 1. **One task is `in_progress` at a time** (mirror it in the task-state-ledger). 2. When a new issue surfaces mid-task, **do NOT start it.** Write it to a parking lot and keep going. Park, don't pivot. 3. A task is closeable only when **verified** (the `evidence-first-answer` / deployment-gate bar), not when code is written. 4. After closing, pick the next item from the parking lot **or ask the CEO which to take** if priority is ambiguous. ## The parking lot Keep a `## Parking lot` section in the task-state-ledger: ```markdown ## Parking lot (found mid-task — do NOT start until current loop closes) - [security] CodeQL: 2 critical cmd-injection + 1 XSS on main — own PR - [infra] THUMBGATE_REVIEWER_KEY not set on Railway - [docs] /docs/connectors 404, favicon 404 ``` For genuinely independent work, prefer