Add taskflow lint gate for result quality

Introduce taskflow artifact linting to improve process/result stability.\n\nChanges:\n- add scripts/codex_task_lint.sh to taskflow kit templates\n  - mode=scaffold: verifies artifact set + unresolved template tokens\n  - mode=complete: additionally fails on placeholder-style unfinished content\n- install codex_task_lint.sh via taskflow installer and manage it in .gitignore block\n- add coverage in scripts/test_kits.sh:\n  - scaffold lint must pass after task generation\n  - complete lint must fail on unfinished scaffold artifacts\n- document lint usage in kit README and top-level quality gate summary\n\nValidation:\n- scripts/test_kits.sh passes end-to-end locally.

Author: nakazanie-ton

README.md

@@ -41,6 +41,7 @@ Coverage includes:
 - syntax checks for shell/python sources
 - installer `.gitignore` resilience and idempotency
 - config validation failure checks for bootstrap/taskflow JSON
+- taskflow lint checks (`scaffold` pass, `complete` fail-on-placeholders)
 - CLI applicability (`codex_session.sh`)
 - Codex App applicability (`codex_verify_session.sh`, `codex_task.sh`)
 - AGENTS/Skills applicability (startup contract and checklist state)

kits/codex-taskflow-kit/README.md

@@ -35,6 +35,7 @@ Strict mode defaults are enabled:
 ## What it installs
 
 - `scripts/codex_task.sh`
+- `scripts/codex_task_lint.sh`
 - `.codex_taskflow/config.json`
 - `.codex_taskflow/taskflow_engine.py`
 - `.codex_taskflow/templates/*.md`
@@ -51,6 +52,13 @@ Each task creates:
 - `work/taskflow/<task_id>/50_handoff.md`
 - `work/taskflow/<task_id>/taskflow.json`
 
+Lint helper:
+
+```bash
+bash scripts/codex_task_lint.sh --latest --mode scaffold
+bash scripts/codex_task_lint.sh --latest --mode complete
+```
+
 ## Install Into Any Repo
 
 ```bash

kits/codex-taskflow-kit/bin/install.sh

@@ -90,7 +90,7 @@ ensure_gitignore_block() {
   local end_marker="# <<< codex-taskflow-kit (local-only)"
   local tmp_file
   local source_file="$gitignore_file"
-  local managed_regex='^(\.codex_taskflow/|scripts/codex_task\.sh|work/taskflow/)$'
+  local managed_regex='^(\.codex_taskflow/|scripts/codex_task\.sh|scripts/codex_task_lint\.sh|work/taskflow/)$'
 
   if [[ ! -f "$gitignore_file" ]]; then
     if [[ "$DRY_RUN" -eq 1 ]]; then
@@ -114,6 +114,7 @@ ensure_gitignore_block() {
     printf "\n%s\n" "$start_marker"
     printf "%s\n" ".codex_taskflow/"
     printf "%s\n" "scripts/codex_task.sh"
+    printf "%s\n" "scripts/codex_task_lint.sh"
     printf "%s\n" "work/taskflow/"
     printf "%s\n" "$end_marker"
   } >> "$tmp_file"
@@ -162,6 +163,7 @@ copy_file() {
 
 FILES=(
   "scripts/codex_task.sh"
+  "scripts/codex_task_lint.sh"
   ".codex_taskflow/config.json"
   ".codex_taskflow/taskflow_engine.py"
   ".codex_taskflow/templates/intake.md"
@@ -183,6 +185,7 @@ if [[ "$DRY_RUN" -eq 1 ]]; then
 else
   chmod +x \
     "$TARGET/scripts/codex_task.sh" \
+    "$TARGET/scripts/codex_task_lint.sh" \
     "$TARGET/.codex_taskflow/taskflow_engine.py"
 fi
 

kits/codex-taskflow-kit/templates/scripts/codex_task_lint.sh

@@ -0,0 +1,116 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+WORK_DIR="$ROOT_DIR/work/taskflow"
+TASK_DIR=""
+MODE="scaffold"
+
+usage() {
+  cat <<'USAGE'
+Usage:
+  bash scripts/codex_task_lint.sh [--task-dir <path> | --latest] [--mode scaffold|complete]
+
+Modes:
+  scaffold  Validate generated taskflow structure and unresolved template tokens.
+  complete  Validate scaffold checks plus unresolved placeholders in handoff content.
+USAGE
+}
+
+fail() {
+  echo "[taskflow-lint] ERROR: $1" >&2
+  exit 1
+}
+
+resolve_task_dir() {
+  local latest
+
+  if [[ -n "$TASK_DIR" ]]; then
+    [[ -d "$TASK_DIR" ]] || fail "task directory not found: $TASK_DIR"
+    TASK_DIR="$(cd "$TASK_DIR" && pwd)"
+    return
+  fi
+
+  [[ -d "$WORK_DIR" ]] || fail "taskflow work directory not found: $WORK_DIR"
+  latest="$(find "$WORK_DIR" -mindepth 1 -maxdepth 1 -type d | sort | tail -n 1)"
+  [[ -n "$latest" ]] || fail "no taskflow directories found under: $WORK_DIR"
+  TASK_DIR="$latest"
+}
+
+check_required_files() {
+  local required=(
+    "$TASK_DIR/00_intake.md"
+    "$TASK_DIR/10_scope.md"
+    "$TASK_DIR/20_plan.md"
+    "$TASK_DIR/30_execution_log.md"
+    "$TASK_DIR/40_verification.md"
+    "$TASK_DIR/50_handoff.md"
+    "$TASK_DIR/taskflow.json"
+  )
+  local file
+
+  for file in "${required[@]}"; do
+    [[ -s "$file" ]] || fail "required file missing or empty: $file"
+  done
+}
+
+check_unresolved_tokens() {
+  local file
+  for file in "$TASK_DIR"/*.md; do
+    if grep -Eq '\{\{[A-Z0-9_]+\}\}' "$file"; then
+      fail "unresolved template token detected: $file"
+    fi
+  done
+}
+
+check_complete_mode() {
+  local file
+  local placeholder_pattern='^-[[:space:]]*$|^1\.[[:space:]]*$|TODO: add task details|^-[[:space:]]*(Decision|Why|Tradeoff|Symptom|Observed behavior|Expected behavior|Time|Risk tolerance|Non-functional requirements|Components/files likely affected|Dependencies/external systems|Command|Result):[[:space:]]*$'
+
+  for file in "$TASK_DIR"/*.md; do
+    if grep -Eq "$placeholder_pattern" "$file"; then
+      fail "placeholder-style content remains in complete mode: $file"
+    fi
+  done
+}
+
+while (( $# > 0 )); do
+  case "$1" in
+    --task-dir)
+      shift
+      TASK_DIR="${1:-}"
+      ;;
+    --latest)
+      TASK_DIR=""
+      ;;
+    --mode)
+      shift
+      MODE="${1:-}"
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      fail "unknown argument: $1"
+      ;;
+  esac
+  shift || true
+done
+
+case "$MODE" in
+  scaffold|complete) ;;
+  *)
+    fail "--mode must be scaffold or complete"
+    ;;
+esac
+
+resolve_task_dir
+check_required_files
+check_unresolved_tokens
+
+if [[ "$MODE" == "complete" ]]; then
+  check_complete_mode
+fi
+
+echo "[taskflow-lint] PASS mode=$MODE task_dir=$TASK_DIR"

scripts/test_kits.sh

@@ -212,6 +212,7 @@ run_surface_smoke_checks() {
   assert_file "$target_repo/scripts/codex_session.sh"
   assert_file "$target_repo/scripts/codex_verify_session.sh"
   assert_file "$target_repo/scripts/codex_task.sh"
+  assert_file "$target_repo/scripts/codex_task_lint.sh"
 
   # Bootstrap output control surface.
   (
@@ -251,6 +252,22 @@ EOF
   task_json="$(echo "$task_json" | tr -d '\r')"
   assert_file "$task_json"
 
+  (
+    cd "$target_repo"
+    bash scripts/codex_task_lint.sh --latest --mode scaffold >"$target_repo/taskflow-lint-scaffold.out"
+  )
+  assert_grep 'PASS mode=scaffold' "$target_repo/taskflow-lint-scaffold.out" "taskflow scaffold lint did not pass"
+
+  set +e
+  (
+    cd "$target_repo"
+    bash scripts/codex_task_lint.sh --latest --mode complete >"$target_repo/taskflow-lint-complete.out" 2>"$target_repo/taskflow-lint-complete.err"
+  )
+  local lint_complete_status=$?
+  set -e
+  [[ "$lint_complete_status" -ne 0 ]] || fail "taskflow complete lint unexpectedly passed on scaffold artifacts"
+  assert_grep 'placeholder-style content remains in complete mode' "$target_repo/taskflow-lint-complete.err" "taskflow complete lint missing expected failure signal"
+
   # Agent Skills surface: AGENTS startup contract + generated startup order + PASS checklist.
   cat >"$target_repo/AGENTS.md" <<'EOF'
 # AGENTS