@gobing-ai/spur 0.3.28 → 0.3.29

package/config/rules/strict/runtime-boundaries.yaml

@@ -60,6 +60,7 @@ rules:
             - "packages/app/src/services/token-ledger-service.ts" # FD byte-window log tailing
             - "packages/app/src/services/token-ledger-watcher.ts" # node:fs watch() live watcher
             - "packages/app/src/services/project-registry.ts" # atomic projects.json persistence
+            - "packages/app/src/observability/run-output-sink.ts" # sync FD append for mid-run tail-able artifact (task 0414 R2); observe() is sync from the lifecycle relay
             - "apps/web/src/modules/discover.ts" # Vite/Astro module scanner fallback under bun test
 
             # Synchronous bootstrap & path resolution:

package/config/rules/typescript/no-syscall-emulation-in-boundary-mock.yaml

@@ -0,0 +1,57 @@
+$schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
+# Forbid mocking the syscall under test where the mock emulates it (task 0415 R4).
+#
+# WHY: `sp:test-driven-development` SKILL.md:164 already states the rule — "Mock
+# what crosses a process/IO boundary; never mock the code under test." This rule
+# enforces the narrow, mechanically detectable case: a test that mocks a
+# subprocess/syscall boundary (Bun.spawnSync / node:child_process) AND whose mock
+# handler emulates the syscall output (stat / mtime / %m) that the code under test
+# consumes. The 0411 defect is the canonical fixture: the verdict-mtime tests
+# mocked `Bun.spawnSync` INCLUDING the `stat -f %m` call, so the BSD-only stat
+# syntax silently returned nothing on Linux while 57 tests stayed green — the mock
+# replaced the very portability the tests were supposed to verify.
+#
+# SCOPE / discriminator: mocking the subprocess boundary to control *subprocess
+# responses* (e.g. feature-sync-bounded.test.ts intercepting `show`/`list`/`sync`
+# commands) is legitimate and NOT flagged — the boundary mock returns canned
+# responses, it does not re-implement the syscall the code under test calls. The
+# rule fires only when the mock handler itself references `stat`/`%m`/`birthtime`
+# (emulating the syscall) within a bounded window after the mock installation.
+#
+# FIX: use real files + real statSync/utimesSync (the 0411 remediation), or mock a
+# higher-level seam the code under test does NOT depend on for the behavior under
+# test. If a legit syscall-emulating mock is unavoidable, waive with a stated
+# reason in the test.
+include:
+  - "apps/**/tests/**/*.test.ts"
+  - "apps/**/tests/**/*.test.tsx"
+  - "packages/**/tests/**/*.test.ts"
+  - "packages/**/tests/**/*.test.tsx"
+  - "plugins/**/tests/**/*.test.ts"
+  - "plugins/**/tests/**/*.test.tsx"
+exclude:
+  - "**/node_modules/**"
+  - "**/dist/**"
+
+rules:
+  - id: no-syscall-emulation-in-boundary-mock
+    description: >
+      A test that mocks a subprocess/syscall boundary (Bun.spawnSync assignment,
+      spyOn(Bun,'spawnSync'), or mock.module('node:child_process')) MUST NOT have
+      the mock handler emulate the syscall output the code under test consumes
+      (stat / `-f %m` / birthtime / mtime-derived fingerprints). That mocks the
+      code under test, not the boundary: platform-specific syscall syntax (e.g.
+      BSD-only `stat -f %m`) silently no-ops on Linux while the test stays green —
+      the 0411 verdict-mtime defect. Prefer real files + real statSync/utimesSync
+      (the 0411 remediation) or mock a higher-level seam. Control of *subprocess
+      responses* (show/list/sync commands) is fine — only syscall emulation is
+      forbidden. sp:test-driven-development SKILL.md:164.
+    severity: warning
+    evaluator:
+      type: rg
+      config:
+        # Correlation in one bounded window: a boundary-mock installation followed
+        # (within ~700 chars) by stat/mtime syscall emulation. The window keeps
+        # legit subprocess-response mocks (which never mention stat/%m) quiet.
+        multiline: true
+        pattern: "(?:Bun\\.spawnSync\\s*=|spyOn\\(\\s*Bun\\s*,\\s*['\"]spawnSync['\"]\\s*\\)|mock\\.module\\(\\s*['\"]node:child_process['\"]\\s*\\))[\\s\\S]{0,700}?(?:cmd\\.includes\\(\\s*['\"]stat|stat\\s+-[fc]|%m|birthtime)"

package/config/templates/AGENTS.md

@@ -63,6 +63,9 @@ All product development work goes through the harness by default.
    multi-noun corpus → `sp:expert-spur`; review → `sp:super-reviewer`; docs process → `sp:doc-evolve`.
 5. **Keep tool ownership explicit** — project lifecycle/corpus/gates → Spur; plugin installation and
    capability lifecycle → Superskill. Do not hand-maintain per-platform adapters Superskill generates.
+6. **Run dev skills inline by default** — direct model-bearing `/sp:dev-*` commands execute in the
+   current coding-agent session. `--subprocess` or a named dispatch-surface trigger uses
+   `spur agent run`; direct `spur agent run` and workflow `agent.run` remain subprocess surfaces.
 
 **Platform fallback:** Platforms without slash commands and/or subagents still use the harness.
 Install the plugin through Superskill for the target platform, then use skills `sp:spur-dev`,

package/config/workflows/feature-lifecycle.yaml

@@ -5,11 +5,13 @@ description: >
   Feature lifecycle FSM (design §2.3, §5.1, DD-13). States are the canonical
   FeatureStatus vocabulary; transitions encode the §2.3 graph including the
   `verifying` status (DD-13). Guards invoke `${vars.spurBin} feature check`
-  at the active→verifying and verifying→done placements. `cancelled` is terminal.
-  Guard commands reference the check verb (0057) — structural validation passes
-  today, behavioral wiring activates as the verb ships. Unconditional transitions
-  use the `always` guard (externally-driven via `requestTransition`, not
-  auto-advance).
+  at the active→verifying and verifying→done placements, passing the edge's
+  target via `--as <status>` (0418) so the one-active-goal rule evaluates the
+  post-transition state and never denies the exit it would relieve.
+  `cancelled` is terminal. Guard commands reference the check verb (0057) —
+  structural validation passes today, behavioral wiring activates as the verb
+  ships. Unconditional transitions use the `always` guard (externally-driven
+  via `requestTransition`, not auto-advance).
 initialState: backlog
 terminalStates:
   - cancelled
@@ -47,7 +49,7 @@ transitions:
     guard:
       kind: shell
       options:
-        command: '${vars.spurBin} feature check ${vars.featureId}'
+        command: '${vars.spurBin} feature check ${vars.featureId} --as verifying'
   - from: verifying
     to: done
     description: >
@@ -55,7 +57,7 @@ transitions:
     guard:
       kind: shell
       options:
-        command: '${vars.spurBin} feature check ${vars.featureId} --strict'
+        command: '${vars.spurBin} feature check ${vars.featureId} --strict --as done'
 
   # Rework: verifying → active (mandatory History entry)
   - from: verifying

package/config/workflows/task-pipeline.yaml

@@ -182,7 +182,8 @@ states:
       Record pipeline results into the task file via `spur task record` —
       Testing/Review from the verdict, Solution backfilled from git diff as a
       safety net, optional transition to testing. Post-record step conditionally syncs
-      feature status if `feature_id` is present, or appends an orphan link proposal
+      feature status via the bounded `feature-sync-bounded` wrapper (task 0411
+      retry-suppression) if `feature_id` is present, or appends an orphan link proposal
       to the run report if absent (task 0328 / ADR-0322).
     onEnter:
       - kind: shell
@@ -190,7 +191,7 @@ states:
           command: "${vars.spurBin} task record ${vars.wbs} --solution-from-diff --transition testing"
       - kind: shell
         options:
-          command: 'FID=$(${vars.spurBin} task show ${vars.wbs} --json 2>/dev/null | jq -r ".feature_id // .frontmatter.feature_id // empty"); if [ -n "$FID" ]; then ${vars.spurBin} feature sync "$FID" --json; else echo "Orphan task ${vars.wbs} — no feature_id linked; proposal: consider linking to a parent feature." >> .spur/run/${vars.wbs}-report.txt; fi'
+          command: 'FID=$(${vars.spurBin} task show ${vars.wbs} --json 2>/dev/null | jq -r ".feature_id // .frontmatter.feature_id // empty"); if [ -n "$FID" ]; then bun plugins/sp/scripts/feature-sync-bounded.ts "$FID" --spur-bin "${vars.spurBin}" --json; else echo "Orphan task ${vars.wbs} — no feature_id linked; proposal: consider linking to a parent feature." >> .spur/run/${vars.wbs}-report.txt; fi'
 
   - id: done
     description: >

package/config/workflows/wrapup-pipeline.yaml

@@ -117,13 +117,14 @@ states:
 
   - id: feature-transition
     description: >
-      If vars.feature is set, derive and sync feature status with linked task states via
-      `spur feature sync` (task 0328 / ADR-0322).
-      Replaces prior unconditional `spur feature advance` with conservative status sync.
+      If vars.feature is set, derive and sync feature status with linked task states via the
+      bounded `feature-sync-bounded` wrapper (task 0328 / ADR-0322, task 0411 retry-suppression).
+      Replaces prior unconditional `spur feature advance` with conservative status sync that
+      suppresses identical blocked retries until relevant inputs change.
     onEnter:
       - kind: shell
         options:
-          command: '${vars.spurBin} feature sync ${vars.feature} --json'
+          command: 'bun plugins/sp/scripts/feature-sync-bounded.ts ${vars.feature} --spur-bin "${vars.spurBin}" --json'
 
   - id: branch-cleanup
     description: >

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.3.28",
+    "version": "0.3.29",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",

package/schemas/spur-config.schema.json

@@ -239,7 +239,7 @@
         },
         "tasks": {
             "type": "object",
-            "description": "Task-folder registration (design §9). Absorbs the legacy docs/.tasks/config.json folders + base_counter concepts. Mirrors @gobing-ai/spur-config tasksConfigSchema (Zod is SSOT).",
+            "description": "Task-folder registration (design §9). Absorbs the legacy docs/.tasks/config.json folders + baseCounter concepts. Mirrors @gobing-ai/spur-config tasksConfigSchema (Zod is SSOT).",
             "properties": {
                 "folders": {
                     "type": "object",