fix(hygiene): the Task validator rejected the repo's own ZetaId and 57% of real usage

[AceHack]

fix(hygiene): the Task validator rejected the repo's own ZetaId and 57% of real usage

TASK_RE in validate-agencysignature-pr-body.ts accepted ticket-shaped ids only. It was
written before this repo retired sequential B-NNNN ids, and it cannot express a ZetaId at
all - 26 chars, Crockford base32, digit-initial, no dash.

Counted over every Task: value in the last 300 commits on main (363 values):

143  passed the old pattern
 12  were bare ZetaIds - the canonical work-item key that
     .claude/rules/workitems-mint-with-zetaid.md mandates
208  were slugs naming the work, or a ZetaId joined to one

So it rejected 57% of established practice, including the repo's own mandated id format.
#10594 wired this validator to CI unchanged, so at the cutover it would have reddened the
majority of correct commits - and a gate that fires mostly on correct work gets switched
off, which is strictly worse than no gate: a disabled check still occupies the slot where
a real one would go. Every Task value I used today would have failed, and so would the
ZetaIds in agent PRs.

The field's job is to NAME the work, so a slug always was a legitimate name and shape was
never the property worth enforcing. What must stay caught is the unfilled template, so
that is now explicit and checked FIRST, independently of shape: PLACEHOLDER_TASK_RE
rejects todo / tbd / xxx / task / placeholder / fixme / n/a / bare dashes / <...>. That
complements the existing PLACEHOLDER_RE rather than duplicating it - that one catches the
angle-bracket skeleton across every required key, while these are the words someone types
when they have not decided yet, none of which contain angle brackets and all of which
would have satisfied the widened shape.

The dashed alternative is case-INSENSITIVE deliberately. The commonest real form is a
ZetaId joined to a slug (081KZZYWBN2087G0R003NAQQAF-exact-cyclotomic-amplitude-carrier,
and the reverse order too); a lowercase-only slug rule left 23 of those still failing,
which my own test caught before commit. A second self-caught regression: dropping the
explicit task-#?\d+ alternative broke task-#12, because # is not alphanumeric.

Verified: replaying all 363 historical values through the new patterns gives 0 failures;
every legacy form (none, Otto-343, task-#12, #99, FOO-12) still passes; all ten
placeholder spellings are rejected; 18 validator unit tests pass; lint-typescript exits 0.

Found by an agent while filing its own PR - it hit the rejection, worked around it with
Task: none, and flagged the regex rather than treating the workaround as the answer.

Agency-Signature-Version: 1
Agent: Otto
Agent-Runtime: Claude Code
Agent-Model: claude-opus-5
Credential-Identity: AceHack via gh
Credential-Mode: shared
Human-Review: pending
Human-Review-Evidence: chat
Action-Mode: autonomous-fail-open
Task: fix-task-regex-rejects-zetaids

Co-authored-by: Claude Opus 5 noreply@anthropic.com

[chatgpt-codex-connector]

Codex usage limits have been reached for code reviews. Please check with the admins of this repo to increase the limits by adding credits.
Credits must be used to enable repository wide code reviews.