@gobing-ai/spur 0.3.42 → 0.3.44

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
     },
     "plugins": [
         {
-            "version": "0.3.42",
+            "version": "0.3.44",
             "name": "sp",
             "source": "./plugins/sp",
             "description": "Spur - my harness toolkits"

package/config/templates/AGENTS.md

@@ -69,6 +69,11 @@ All product development work goes through the harness by default.
    auto`, a name, parallel/headless execution, direct `spur agent run`, and engine-driven workflow
    `agent.run` remain subprocess surfaces.
 
+**Task lookup fast path:** Given a WBS, do not search `docs/tasks*` or guess `--folder`. Use
+`spur task show <wbs> --json` for task metadata and content; its response also includes `filePath`.
+Use `spur task path <wbs> --json` only when a filesystem consumer needs the absolute path. Both
+commands resolve across configured task folders. Reuse the first `show` response within the run.
+
 **Platform fallback:** Platforms without slash commands and/or subagents still use the harness.
 Install the plugin through Superskill for the target platform, then use skills `sp:spur-dev`,
 `sp:spur-cli`, `sp:code-verification` (and related) plus the `spur` CLI. Do not invent a parallel

package/config/workflows/idea-pipeline.yaml

@@ -10,7 +10,7 @@
 # Shape: start -> discovery -> idea-eval -> feature-create -> ac-generate -> feature-check
 #          -> system-design (conditional: needs_design signal)
 #          -> design-approval (taste HITL gate; not auto-clicked by --auto)
-#          -> decompose -> batch-create -> handoff
+#          -> decompose -> batch-create -> handoff-finalize -> handoff
 #        (idea-eval rejection -> cancelled)
 #        (feature-check failure routes back to ac-generate; batch-create failure to decompose).
 #
@@ -128,20 +128,36 @@ states:
   - id: feature-create
     description: >
       Create a feature via spur feature create, or select an existing feature id.
-      The agent writes the feature id to .spur/run/${vars.__runId}-idea-feature-id.txt for subsequent
-      states to read. Prefer the enhanced idea from .spur/run/${vars.__runId}-idea-eval-report.md as
+      The agent writes the feature id to .spur/run/${vars.__runId}-idea-feature-id.txt and body-only
+      intent artifacts .spur/run/${vars.__runId}-idea-goal.md / -idea-scope.md. Goal carries
+      concise intent only; Scope carries explicit in/out boundaries — task breakdowns and
+      checklists never enter Goal. Shell actions then persist both sections through
+      `spur feature update --section Goal|Scope --from-file ...`; a missing/empty artifact
+      stops the state. Prefer the enhanced idea from .spur/run/${vars.__runId}-idea-eval-report.md as
       context; do not overwrite vars.idea.
     onEnter:
       - kind: agent.run
         options:
           agent: ${vars.agent}
-          input: "Create a feature for the idea: ${vars.idea}. Read .spur/run/${vars.__runId}-idea-eval-report.md if present for the enhanced idea and scores. Use 'spur feature create \"<name>\" --json' to create it. Write the feature id to .spur/run/${vars.__runId}-idea-feature-id.txt. If an existing feature is appropriate, use its id instead."
+          input: "Create a feature for the idea: ${vars.idea}. Read .spur/run/${vars.__runId}-idea-eval-report.md if present for the enhanced idea and scores. Use 'spur feature create \"<name>\" --json' to create it. Write the feature id to .spur/run/${vars.__runId}-idea-feature-id.txt. If an existing feature is appropriate, use its id instead. Also write two body-only intent artifacts: .spur/run/${vars.__runId}-idea-goal.md with concise Goal intent only (a short statement of what the feature achieves; never task breakdowns, checklists, or how-to steps), and .spur/run/${vars.__runId}-idea-scope.md with explicit in-scope and out-of-scope boundary bullets."
           expectFile: .spur/run/${vars.__runId}-idea-feature-id.txt
           timeoutMs: ${vars.stepTimeoutMs}
       - kind: file.read.into-var
         options:
           path: .spur/run/${vars.__runId}-idea-feature-id.txt
           var: featureId
+      - kind: shell
+        options:
+          command: >-
+            mkdir -p .spur/run &&
+            test -s .spur/run/$__runId-idea-goal.md &&
+            $spurBin feature update "$featureId" --section Goal --from-file .spur/run/$__runId-idea-goal.md
+      - kind: shell
+        options:
+          command: >-
+            mkdir -p .spur/run &&
+            test -s .spur/run/$__runId-idea-scope.md &&
+            $spurBin feature update "$featureId" --section Scope --from-file .spur/run/$__runId-idea-scope.md
 
   - id: ac-generate
     description: >
@@ -177,7 +193,7 @@ states:
         options:
           command: >-
             if test -s .spur/run/$__runId-idea-ac-content.md; then
-              $spurBin feature update $featureId --section "Acceptance Criteria" --from-file .spur/run/$__runId-idea-ac-content.md && date -u +%Y-%m-%dT%H:%M:%SZ > .spur/run/$__runId-idea-ac-done.txt;
+              $spurBin feature update "$featureId" --section "Acceptance Criteria" --from-file .spur/run/$__runId-idea-ac-content.md && date -u +%Y-%m-%dT%H:%M:%SZ > .spur/run/$__runId-idea-ac-done.txt;
             else
               exit 0;
             fi
@@ -206,13 +222,33 @@ states:
       Dispatch sp:sys-architecture to produce the system design. This state runs
       only when needs_design=true (design=auto signal path). The agent creates ADR
       entries, architecture updates, and design satellites through constitution rules.
-      The design-approval state follows (taste gate).
+      A run-scoped design-review artifact (.spur/run/${vars.__runId}-idea-design-review.md)
+      with fixed headings `## Proposed design`, `## Operator feedback`, and `## Reconciliation`
+      carries operator rejection feedback back into this state: on the first pass the agent
+      fills `## Proposed design`; on retry (operator feedback present) it revises the design,
+      records the reconciliation, and updates invalidated Acceptance Criteria through
+      `spur feature update` before design can exit. The design-approval state follows (taste gate).
     onEnter:
+      - kind: shell
+        options:
+          command: >-
+            mkdir -p .spur/run &&
+            REVIEW=".spur/run/$__runId-idea-design-review.md" &&
+            test -f "$REVIEW" || printf '## Proposed design\n\n## Operator feedback\n\n## Reconciliation\n' > "$REVIEW"
       - kind: agent.run
         options:
           agent: ${vars.agent}
-          input: "Run sp:sys-architecture for feature ${vars.featureId}. Read the brainstorm artifact and feature AC. Produce ADR entries, architecture updates, and design satellites (docs/design/<slug>.md) following the constitution edit rules. Do not write task or feature corpus files directly."
+          input: "Run sp:sys-architecture for feature ${vars.featureId}. Read the brainstorm artifact, feature AC, and .spur/run/${vars.__runId}-idea-design-review.md. Produce ADR entries, architecture updates, and design satellites (docs/design/<slug>.md) following the constitution edit rules. Do not write task or feature corpus files directly. Design-review contract (.spur/run/${vars.__runId}-idea-design-review.md, fixed headings `## Proposed design`, `## Operator feedback`, `## Reconciliation`): on the first pass write the proposed design summary under `## Proposed design` and leave `## Operator feedback` empty; on retry with operator feedback present, revise the design/ADR artifacts, document the changes under `## Reconciliation`, and when the feedback invalidates an Acceptance Criteria scenario write the revised AC section body to a file and persist it via `$spurBin feature update \"$featureId\" --section \"Acceptance Criteria\" --from-file <file>` — never edit feature corpus files directly."
+          expectFile: .spur/run/${vars.__runId}-idea-design-review.md
           timeoutMs: ${vars.stepTimeoutMs}
+      # expectFile proves existence only, and the onEnter skeleton pre-creates the file — so an
+      # agent no-op would still pass it (0515 P3-2). Fail closed: the `## Proposed design` section
+      # must carry non-whitespace content before design can exit to approval/decompose.
+      - kind: shell
+        options:
+          command: >-
+            REVIEW=".spur/run/$__runId-idea-design-review.md" &&
+            awk '/^## Proposed design/{f=1; next} /^## Operator feedback/{f=0} f' "$REVIEW" | grep -q '[^[:space:]]'
 
   - id: design-approval
     description: >
@@ -226,6 +262,11 @@ states:
       agent passes. The onEnter shell increments a reject counter; the `no`
       edge to system-design is capped at 1 revise, after which the run
       terminates as `failed` naming this gate.
+
+      Rejection must carry operator feedback: before answering `no`, the operator
+      records the concrete issue(s) in the run-scoped design-review artifact
+      (.spur/run/${vars.__runId}-idea-design-review.md) under `## Operator feedback` —
+      the revision pass reads it to reconcile invalidated AC before re-approval.
     pause: true
     onEnter:
       - kind: shell
@@ -233,23 +274,45 @@ states:
           command: 'mkdir -p .spur/run && count=$(cat .spur/run/$__runId-idea-design-reject-count 2>/dev/null || echo 0); echo $((count + 1)) > .spur/run/$__runId-idea-design-reject-count'
       - kind: hitl.confirm
         options:
-          prompt: "Review the system design for feature ${vars.featureId}. Approve to proceed to decomposition?"
+          prompt: "Review the system design for feature ${vars.featureId}. Approve to proceed to decomposition? To reject, first record your feedback in .spur/run/${vars.__runId}-idea-design-review.md under the `## Operator feedback` heading, then answer no."
 
   - id: decompose
     description: >
       Dispatch sp:spec-decomposition with the brainstorm artifact, feature AC, and
       design doc as input. The agent produces a task-batch JSON file at
-      .spur/run/${vars.__runId}-idea-task-batch.json, validated against task-batch.schema.json.
+      .spur/run/${vars.__runId}-idea-task-batch.json, validated against task-batch.schema.json,
+      plus the private task-order sidecar .spur/run/${vars.__runId}-idea-task-order.json
+      (a JSON array of { name, depends_on_names[] }; `[]` when no ordering exists).
+      A post-agent shell action validates the sidecar shape before decomposition
+      can exit — missing or ambiguous title-to-WBS resolution fails before handoff.
     onEnter:
       - kind: shell
         options:
-          command: 'mkdir -p .spur/run && count=$(cat .spur/run/$__runId-idea-decompose-retry-count 2>/dev/null || echo 0); echo $((count + 1)) > .spur/run/$__runId-idea-decompose-retry-count; rm -f .spur/run/$__runId-idea-task-batch.json .spur/run/$__runId-idea-batch-create.done .spur/run/$__runId-idea-batch-create.failed'
+          command: 'mkdir -p .spur/run && count=$(cat .spur/run/$__runId-idea-decompose-retry-count 2>/dev/null || echo 0); echo $((count + 1)) > .spur/run/$__runId-idea-decompose-retry-count; rm -f .spur/run/$__runId-idea-task-batch.json .spur/run/$__runId-idea-task-order.json .spur/run/$__runId-idea-batch-create.done .spur/run/$__runId-idea-batch-create.failed .spur/run/$__runId-idea-batch-create-result.json .spur/run/$__runId-idea-handoff.md'
       - kind: agent.run
         options:
           agent: ${vars.agent}
-          input: "Run sp:spec-decomposition for feature ${vars.featureId}. Read the brainstorm artifact, feature AC, and design doc. SIZING FIRST, before any JSON: apply the skill's `Default to NOT decomposing` rubric to the whole unit of work — if it scores 0-2 the correct output is a ONE-entry batch, not many. Scenario count is not task count: merge scenarios that one task delivers (same file surface, same subsystem, or unreadable apart in review), and list every scenario a task covers in its background. Merging never costs AC coverage — one task may carry several scenarios. Do not emit one entry per scenario or per requirement by reflex. Then produce a task-batch JSON array at .spur/run/${vars.__runId}-idea-task-batch.json, validated against apps/cli/schemas/task-batch.schema.json. Schema-permitted fields per entry: `name`, `background`, `requirements`, `feature_id`, `parent_wbs`, `priority`, `tags`, `template` — schema validation rejects anything else. Acceptance Criteria, Design, and Plan sections are filled in by the per-task refine step after batch-create, NOT at decompose time. Validate locally against the schema before emitting."
+          input: "Run sp:spec-decomposition for feature ${vars.featureId}. Read the brainstorm artifact, feature AC, and design doc. SIZING FIRST, before any JSON: apply the skill's `Default to NOT decomposing` rubric to the whole unit of work — if it scores 0-2 the correct output is a ONE-entry batch, not many. Scenario count is not task count: merge scenarios that one task delivers (same file surface, same subsystem, or unreadable apart in review), and list every scenario a task covers in its background. Merging never costs AC coverage — one task may carry several scenarios. Do not emit one entry per scenario or per requirement by reflex. Then produce a task-batch JSON array at .spur/run/${vars.__runId}-idea-task-batch.json, validated against apps/cli/schemas/task-batch.schema.json. Schema-permitted fields per entry: `name`, `background`, `requirements`, `feature_id`, `parent_wbs`, `priority`, `tags`, `template` — schema validation rejects anything else. Acceptance Criteria, Design, and Plan sections are filled in by the per-task refine step after batch-create, NOT at decompose time. Validate locally against the schema before emitting. Also emit the private task-order sidecar at .spur/run/${vars.__runId}-idea-task-order.json: a JSON array (one entry per batch item) of `{ name: <exact batch item name>, depends_on_names: [<batch item names>] }` declaring ordering/dependencies between the batch items; use `[]` when no ordering exists. Every `name` and every dependency must match exactly one batch item `name` — it is private workflow data, not part of task-batch.schema.json."
           expectFile: .spur/run/${vars.__runId}-idea-task-batch.json
           timeoutMs: ${vars.stepTimeoutMs}
+      # R1 (0518): the task-order sidecar is the ordering contract for handoff-finalize.
+      # Validate it fails closed: sidecar must be an array, batch names unique, sidecar names
+      # unique, every sidecar name/dependency must refer to exactly one batch name, and — the
+      # converse (F2, 0518 verify) — every batch name must appear in the sidecar, so a partial
+      # sidecar can never silently skip `task deps` for an unlisted item (`[]` is valid).
+      - kind: shell
+        options:
+          command: >-
+            BATCH=".spur/run/$__runId-idea-task-batch.json" &&
+            ORDER=".spur/run/$__runId-idea-task-order.json" &&
+            jq -e --slurpfile b "$BATCH" '
+              (type == "array") and
+              (($b[0] | map(.name) | length) == ($b[0] | map(.name) | unique | length)) and
+              ((map(.name) | length) == (map(.name) | unique | length)) and
+              ((map(.name) - ($b[0] | map(.name))) | length == 0) and
+              ((($b[0] | map(.name)) - map(.name)) | length == 0) and
+              (((map(.depends_on_names // []) | flatten | unique) - ($b[0] | map(.name))) | length == 0)
+            ' "$ORDER" >/dev/null
 
   - id: batch-create
     description: >
@@ -269,21 +332,116 @@ states:
     description: >
       Executes task batch creation exactly once per decomposition attempt. The
       side effect lives in onEnter and records a sentinel; transition guards only
-      inspect sentinel/retry state.
+      inspect sentinel/retry state. The `--json` result is captured atomically in
+      .spur/run/${vars.__runId}-idea-batch-create-result.json (temp file + mv); the done
+      sentinel is written only after the JSON parses and `created == (.wbs | length)`,
+      so handoff-finalize can zip batch names to the returned WBS list. Any failure
+      (CLI error or malformed result) writes the failed sentinel, preserving the
+      existing retry behavior.
     onEnter:
       - kind: shell
         options:
-          command: 'if test -f .spur/run/$__runId-idea-batch-create.done; then exit 0; fi; rm -f .spur/run/$__runId-idea-batch-create.failed; if $spurBin task batch-create --file .spur/run/$__runId-idea-task-batch.json; then date -u +%Y-%m-%dT%H:%M:%SZ > .spur/run/$__runId-idea-batch-create.done; else date -u +%Y-%m-%dT%H:%M:%SZ > .spur/run/$__runId-idea-batch-create.failed; fi'
+          command: >-
+            if test -f .spur/run/$__runId-idea-batch-create.done; then exit 0; fi;
+            rm -f .spur/run/$__runId-idea-batch-create.failed .spur/run/$__runId-idea-batch-create-result.json .spur/run/$__runId-idea-batch-create-result.json.tmp;
+            if $spurBin task batch-create --file .spur/run/$__runId-idea-task-batch.json --json > .spur/run/$__runId-idea-batch-create-result.json.tmp && jq -e ".created == (.wbs | length)" .spur/run/$__runId-idea-batch-create-result.json.tmp >/dev/null 2>&1; then
+              mv .spur/run/$__runId-idea-batch-create-result.json.tmp .spur/run/$__runId-idea-batch-create-result.json &&
+              date -u +%Y-%m-%dT%H:%M:%SZ > .spur/run/$__runId-idea-batch-create.done;
+            else
+              rm -f .spur/run/$__runId-idea-batch-create-result.json.tmp;
+              date -u +%Y-%m-%dT%H:%M:%SZ > .spur/run/$__runId-idea-batch-create.failed;
+            fi
+
+  - id: handoff-finalize
+    description: >
+      Post-create finalization (0518): zip batch item names to the created WBS
+      values from the captured batch-create result (equal-length/unique-name
+      checks), apply every non-empty depends_on_names list through
+      `spur task deps`, refresh the feature roster, check every created task, and
+      write the run-scoped handoff report
+      (.spur/run/${vars.__runId}-idea-handoff.md) with exactly one next command.
+      A mapping or CLI error fails the run before terminal handoff; an unready
+      task is a successful planning outcome recorded as a refineall recommendation.
+    onEnter:
+      # F1 (0518 verify): the per-task check loop fails closed. A stderr-only (non-JSON)
+      # `task check --json` exception would otherwise drop that task from the JSONL results
+      # without failing the run (the loop's exit status is its last body command), silently
+      # flipping the recommendation to runall — violating R3's any-fail=>refineall invariant.
+      # Each `jq -c … >> "$CHECKS"` appends under `|| exit 1`, and a row-count assertion
+      # (CHECKS lines == WBS count) gates the recommendation computation.
+      - kind: shell
+        options:
+          command: >-
+            BATCH=".spur/run/$__runId-idea-task-batch.json" &&
+            RESULT=".spur/run/$__runId-idea-batch-create-result.json" &&
+            ORDER=".spur/run/$__runId-idea-task-order.json" &&
+            REPORT=".spur/run/$__runId-idea-handoff.md" &&
+            DEPMAP=".spur/run/$__runId-idea-dep-map.tsv" &&
+            CHECKS=".spur/run/$__runId-idea-check-results.jsonl" &&
+            rm -f "$DEPMAP" "$CHECKS" &&
+            jq -e --slurpfile b "$BATCH" '(.wbs | length) == ($b[0] | length) and (($b[0] | map(.name) | unique | length) == ($b[0] | length))' "$RESULT" >/dev/null &&
+            jq -r --slurpfile b "$BATCH" --slurpfile r "$RESULT" --slurpfile o "$ORDER" '
+              ($b[0] | map(.name)) as $names | ($r[0].wbs) as $wbs |
+              $o[0] | .[] |
+              (.name as $n | $names | index($n)) as $i |
+              (if $i == null or $wbs[$i] == null then "MISSING" else $wbs[$i] end) as $own |
+              ((.depends_on_names // []) | map(. as $dep | $names | index($dep) as $d | if $d == null then "MISSING" else $wbs[$d] end) | join(" ")) as $deps |
+              [.name, $own, $deps] | @tsv
+            ' "$ORDER" > "$DEPMAP" &&
+            while IFS="$(printf '\t')" read -r name own deps; do
+              test "$own" != MISSING || exit 1;
+              if test -n "$deps"; then
+                for d in $deps; do test "$d" != MISSING || exit 1; done;
+                $spurBin task deps "$own" set $deps --json >/dev/null || exit 1;
+              fi;
+            done < "$DEPMAP" &&
+            $spurBin feature refresh --feature "$featureId" --json >/dev/null &&
+            WBS_LIST=$(jq -r '.wbs | join(" ")' "$RESULT") &&
+            for wbs in $WBS_LIST; do
+              TMP=".spur/run/$__runId-idea-check-$wbs.tmp";
+              if $spurBin task check "$wbs" --json > "$TMP" 2>&1; then P=true; else P=false; fi;
+              jq -c --arg w "$wbs" --argjson p "$P" 'if (type == "array" and length > 0) then {wbs: $w, pass: $p, status: (.[0].status // "unknown")} else {wbs: $w, pass: $p, status: "missing"} end' "$TMP" >> "$CHECKS" || exit 1;
+              rm -f "$TMP";
+            done &&
+            CHECK_ROWS=$(wc -l < "$CHECKS" | tr -d ' ') &&
+            WBS_COUNT=$(printf '%s\n' $WBS_LIST | wc -l | tr -d ' ') &&
+            test "$CHECK_ROWS" = "$WBS_COUNT" &&
+            NEXT=$(jq -r --arg feature "$featureId" --slurpfile c "$CHECKS" 'if ($c | any(.[]; .pass == false)) then "/sp:dev-refineall --feature \($feature) --auto --depth ready" else "/sp:dev-runall --feature \($feature) --auto" end' "$RESULT") &&
+            {
+              echo "# Idea pipeline handoff report";
+              echo;
+              echo "Feature: $featureId";
+              echo "Run ID: $__runId";
+              echo;
+              echo "## Created tasks";
+              printf '%s\n' $WBS_LIST | sed 's/^/  - /';
+              echo;
+              echo "## Per-task readiness (spur task check)";
+              echo;
+              echo "| WBS | Outcome |";
+              echo "|-----|---------|";
+              while IFS= read -r line; do
+                w=$(printf '%s' "$line" | jq -r '.wbs');
+                o=$(printf '%s' "$line" | jq -r 'if .pass then "PASS" else "FAIL" end');
+                printf '| %s | %s |\n' "$w" "$o";
+              done < "$CHECKS";
+              echo;
+              echo "## Next command";
+              echo;
+              echo "$NEXT";
+            } > "$REPORT"
 
   - id: handoff
     description: >
-      Terminal — idea pipeline complete. Output: feature id, task WBS list, and
-      the next command to run (/sp:dev-run <first-wbs> or /sp:dev-runall --feature <id> or --tasks feature:<id>).
-      No task execution — the pipeline stops here.
+      Terminal — idea pipeline complete. Ordering applied, roster refreshed, and
+      the handoff report written at .spur/run/${vars.__runId}-idea-handoff.md:
+      feature id, task WBS list, per-task readiness, and exactly one recommended
+      next command (ready-depth refineall when any task is unready, else auto
+      runall). No task execution — the pipeline stops here.
     onEnter:
       - kind: note
         options:
-          message: "Idea pipeline handoff. Feature: ${vars.featureId}. Tasks created. Next: /sp:dev-runall --feature ${vars.featureId}"
+          message: "Idea pipeline handoff. Feature: ${vars.featureId}. See .spur/run/${vars.__runId}-idea-handoff.md for the created task list and recommended next command."
       # Checkpoint write: record session state for resume (Phase 4, task 0171 R3)
       - kind: shell
         options:
@@ -374,7 +532,7 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "$profile" = auto && $spurBin feature check $featureId && test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" != false'
+        command: 'test "$profile" = auto && $spurBin feature check "$featureId" && test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" != false'
   # Auto-skip 2: pass + skip-design route → decompose
   - from: ac-generate
     to: decompose
@@ -382,7 +540,7 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "$profile" = auto && $spurBin feature check $featureId && (test "$design" = skip || (test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" = false))'
+        command: 'test "$profile" = auto && $spurBin feature check "$featureId" && (test "$design" = skip || (test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" = false))'
   # Auto-skip 3: check failed, retry < 3 → loop back to ac-generate (self-loop)
   - from: ac-generate
     to: ac-generate
@@ -390,7 +548,7 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "$profile" = auto && ! $spurBin feature check $featureId && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -lt 3'
+        command: 'test "$profile" = auto && ! $spurBin feature check "$featureId" && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -lt 3'
   # Auto-skip 4: check failed, retry cap reached → escalate to failed
   - from: ac-generate
     to: failed
@@ -398,7 +556,7 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "$profile" = auto && ! $spurBin feature check $featureId && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -ge 3'
+        command: 'test "$profile" = auto && ! $spurBin feature check "$featureId" && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -ge 3'
   # Interactive fallback: enter feature-check HITL gate
   - from: ac-generate
     to: feature-check
@@ -414,28 +572,28 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "$__hitlAnswer" = yes && $spurBin feature check $featureId && test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" != false'
+        command: 'test "$__hitlAnswer" = yes && $spurBin feature check "$featureId" && test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" != false'
   - from: feature-check
     to: decompose
     description: Feature check passed, skip-design route — go directly to decompose.
     guard:
       kind: shell
       options:
-        command: 'test "$__hitlAnswer" = yes && $spurBin feature check $featureId && (test "$design" = skip || (test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" = false))'
+        command: 'test "$__hitlAnswer" = yes && $spurBin feature check "$featureId" && (test "$design" = skip || (test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" = false))'
   - from: feature-check
     to: ac-generate
     description: "Feature check failed — revise AC (retry cap: 3)."
     guard:
       kind: shell
       options:
-        command: '(test "$__hitlAnswer" = no || ! $spurBin feature check $featureId) && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -lt 3'
+        command: '(test "$__hitlAnswer" = no || ! $spurBin feature check "$featureId") && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -lt 3'
   - from: feature-check
     to: failed
     description: Feature check failed after 3 retries — escalate to failed.
     guard:
       kind: shell
       options:
-        command: '(test "$__hitlAnswer" = no || ! $spurBin feature check $featureId) && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -ge 3'
+        command: '(test "$__hitlAnswer" = no || ! $spurBin feature check "$featureId") && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -ge 3'
   - from: feature-check
     to: cancelled
     description: Operator cancelled the feature-check gate.
@@ -448,25 +606,32 @@ transitions:
   # Declaration order: auto-skip guard tried FIRST (like task-pipeline's review->verify pattern).
   - from: system-design
     to: decompose
-    description: profile=auto AND design_approved=true — skip design approval gate.
+    description: profile=auto AND design_approved=true AND feature check passes — skip design approval gate.
     guard:
       kind: shell
       options:
-        command: 'test "$profile" = auto && test "$design_approved" = true'
+        command: 'test "$profile" = auto && test "$design_approved" = true && $spurBin feature check "$featureId"'
   - from: system-design
     to: design-approval
     description: System design done — gate on design approval.
     guard:
       kind: always
 
-  # ── design-approval -> decompose (after operator approval) ──
+  # ── design-approval -> decompose (after operator approval), AC-failure -> feature-check ──
   - from: design-approval
     to: decompose
-    description: Design approved — proceed to decomposition.
+    description: Design approved and feature check passes — proceed to decomposition.
     guard:
       kind: shell
       options:
-        command: 'test "$__hitlAnswer" = yes'
+        command: 'test "$__hitlAnswer" = yes && $spurBin feature check "$featureId"'
+  - from: design-approval
+    to: feature-check
+    description: "Design approved but feature check fails — route back through the AC gate (revise AC, retry cap: 3)."
+    guard:
+      kind: shell
+      options:
+        command: 'test "$__hitlAnswer" = yes && ! $spurBin feature check "$featureId"'
   - from: design-approval
     to: system-design
     description: "Design rejected - revise system design (cap: 1 revise)."
@@ -526,10 +691,10 @@ transitions:
       options:
         command: 'test "$__hitlAnswer" = cancel'
 
-  # ── batch-create-run: success -> handoff, failure -> decompose (retry cap: 3), failure+cap -> failed ──
+  # ── batch-create-run: success -> handoff-finalize, failure -> decompose (retry cap: 3), failure+cap -> failed ──
   - from: batch-create-run
-    to: handoff
-    description: Batch created — handoff.
+    to: handoff-finalize
+    description: Batch created and result captured — apply ordering, refresh roster, write handoff report.
     guard:
       kind: shell
       options:
@@ -548,3 +713,10 @@ transitions:
       kind: shell
       options:
         command: 'test -f .spur/run/$__runId-idea-batch-create.failed && test "$(cat .spur/run/$__runId-idea-decompose-retry-count 2>/dev/null || echo 0)" -ge 3'
+
+  # ── handoff-finalize: -> handoff (terminal) ──
+  - from: handoff-finalize
+    to: handoff
+    description: Ordering applied, roster refreshed, handoff report written — terminal handoff.
+    guard:
+      kind: always

package/config/workflows/task-pipeline.yaml

@@ -188,6 +188,11 @@ states:
       # a tree already dirty with another task's implementation is how 0485's diff
       # got swept into 0486's run. Corpus dirs are excluded: the pipeline writes
       # those itself.
+      # R1 (0511): task-corpus dirt gets its own advisory NOTE — docs/tasks* is
+      # excluded from the non-corpus warning, so pre-existing task-corpus edits are
+      # invisible at launch yet can be accidentally staged with the current task
+      # later. Advisory only (never a block): the pipeline legitimately updates
+      # task files, so corpus dirt is launch-time visibility, not a lifecycle guard.
       - kind: shell
         options:
           command: >-
@@ -196,6 +201,11 @@ states:
               echo "precheck: WARNING - working tree has uncommitted non-corpus changes; commit or stash before starting a new task:";
               echo "$DIRTY";
             fi;
+            CORPUS_DIRTY=$(git status --porcelain -- ':(glob)docs/tasks*/**' 2>/dev/null);
+            if [ -n "$CORPUS_DIRTY" ]; then
+              echo "precheck: NOTE - task corpus has uncommitted changes; review before staging with this task:";
+              echo "$CORPUS_DIRTY";
+            fi;
             exit 0
       - kind: note
         options:
@@ -441,7 +451,7 @@ states:
       - kind: agent.run
         options:
           agent: ${vars.agent}
-          input: /sp:dev-verify ${vars.wbs} --auto --fix all
+          input: /sp:dev-verify ${vars.wbs} --auto --fix all --focus all
           timeoutMs: ${vars.stepTimeoutMs}
           answerFile: .spur/run/${vars.wbs}-verify-answer.txt
       - kind: shell

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.3.42",
+    "version": "0.3.44",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",
@@ -53,14 +53,14 @@
     },
     "devDependencies": {
         "@commander-js/extra-typings": "^14.0.0",
-        "@gobing-ai/ts-db": "^0.4.24",
-        "@gobing-ai/ts-ai-runner": "^0.4.24",
-        "@gobing-ai/ts-dual-workflow-engine": "^0.4.24",
-        "@gobing-ai/ts-infra": "^0.4.24",
-        "@gobing-ai/ts-llm-jsonl-importer": "^0.4.24",
-        "@gobing-ai/ts-rule-engine": "^0.4.24",
-        "@gobing-ai/ts-runtime": "^0.4.24",
-        "@gobing-ai/ts-utils": "^0.4.24",
+        "@gobing-ai/ts-db": "^0.4.27",
+        "@gobing-ai/ts-ai-runner": "^0.4.27",
+        "@gobing-ai/ts-dual-workflow-engine": "^0.4.27",
+        "@gobing-ai/ts-infra": "^0.4.27",
+        "@gobing-ai/ts-llm-jsonl-importer": "^0.4.27",
+        "@gobing-ai/ts-rule-engine": "^0.4.27",
+        "@gobing-ai/ts-runtime": "^0.4.27",
+        "@gobing-ai/ts-utils": "^0.4.27",
         "@types/bun": "1.3.14",
         "@types/figlet": "^1.7.0",
         "@types/node-notifier": "8.0.5",

package/plugins/sp/commands/dev-run.md

@@ -14,10 +14,10 @@ Wraps the **sp:spur-dev** and **sp:code-implementation** skills.
 | --- | --- | --- |
 | `<wbs>` | Task WBS to run. | required |
 | `--mode` `<full\|implement>` | Full pipeline or single implement step. | full |
-| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing stages. In an interactive session, omit/`inline` runs implement mode and full-mode stages in the host session. `auto` or a name keeps subprocess dispatch. | inline |
+| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing stages. In an interactive session, omit/`inline` keeps the controller in the host session (non-subprocess); eligible full-mode `agent.run` stages may dispatch once to a native subagent, with host fallback (task 0508). `auto` or a name keeps subprocess dispatch. | inline |
 | `--auto` | Skip objective HITL confirmations. | off |
 | `--next` | Chain-to-completion via the next-router. | off |
-| `--wrap` | Run the wrap hop after the main step. | off |
+| `--wrap` | Run the wrap hop after the main step. The `--agent` selector is preserved into the `/sp:dev-wrap <wbs>` handoff when supplied; omission remains omission. The wrap hop is workflow-backed and reports its trigger-3 subprocess override. | off |
 | `--continue` | Resume an interrupted task from its checkpoint. | off |
 
 For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag-glossary.md).
@@ -37,7 +37,7 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 **Flags:**
 
-- `--auto` | `--agent <inline|auto|name>` — Skip objective HITL confirmations (taste/irreversible gates still pause). `--agent` names who does the model-bearing work. Interactive omit/`inline` keeps both implement-only and full-mode model stages in this session. Full mode reads `task-pipeline.yaml` as the SSOT and interprets its actions/guards through the inline driver; it records `stage <id> executed inline in session <session-id>` in the run log. `auto` or a name is merged into `vars.agent` and `vars.implementAgent` and keeps the existing subprocess workflow. Headless `spur workflow run` / `spur agent run` is unchanged. See the [execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
+- `--auto` | `--agent <inline|auto|name>` — Skip objective HITL confirmations (taste/irreversible gates still pause). `--agent` names who does the model-bearing work. Interactive omit/`inline` keeps the controller and implement-only stages in this session; full mode reads `task-pipeline.yaml` as the SSOT and interprets its actions/guards through the inline driver, where eligible `agent.run` stages may dispatch once to a native subagent and otherwise run in the host (task 0508). It records `stage <id> executed inline in session <session-id>` or `stage <id> executed via subagent <agent-id> (host session <session-id>)` in the run log. `auto` or a name is merged into `vars.agent` and `vars.implementAgent` and keeps the existing subprocess workflow. Headless `spur workflow run` / `spur agent run` is unchanged. See the [execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
 
 **Mode split (load-bearing — bug-742)**
 

package/plugins/sp/commands/dev-runall.md

@@ -17,9 +17,9 @@ Wraps the **sp:spur-dev** skill.
 | `--mode` `<sequential\|parallel>` | Batch execution order. | sequential |
 | `--keep-going` | Continue past per-task failures. | off |
 | `--auto` | Skip objective HITL gates. | off |
-| `--agent` `<inline\|auto\|name>` | Who runs each task's pipeline stages. Interactive sequential omit/`inline` uses the host-session driver; `auto`, a name, parallel mode, and headless invocation use subprocesses. | inline |
+| `--agent` `<inline\|auto\|name>` | Who runs each task's pipeline stages. Interactive sequential omit/`inline` uses the host-session driver — host-controlled, eligible `agent.run` stages may use a native subagent (task 0508); `auto`, a name, parallel mode, and headless invocation use subprocesses. | inline |
 | `--json` | Emit structured JSON. | off |
-| `--wrap` | Run the wrap hop per task. | off |
+| `--wrap` | Run the wrap hop per task. The `--agent` selector is preserved into each `/sp:dev-wrap <wbs>` handoff when supplied; omission remains omission. | off |
 | `--next` | Chain-to-completion via the next-router. | off |
 | `--continue` | Resume an interrupted batch. | off |
 | `--worktree` `[<name>]` | Run the batch in an isolated git worktree; FF-merge on success, retain on failure. Bare `--worktree` creates a fresh tree; `--worktree <name>` adopts an existing worktree by name/path/branch. | off |
@@ -33,7 +33,12 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 ```
 
 Flags: `--tasks <selector>` (required — explicit WBS list, status pseudo-list, `feature:<id>`,
-or `ready`), `--feature <id>` (sugar for `feature:<id>`), `--mode`
+or `ready`), `--feature <id>` (sugar for `feature:<id>`; when the effective selector is
+feature-derived, `dev-runall` runs `spur feature check <id> --strict --json` **once** before
+resolving tasks — a non-zero strict check aborts the batch with verdict `aborted` and the
+structured findings, before any task pipeline action, task 0510 R2; scoped: `L4.scenario-unverified`
+(the expected pre-run state of any not-yet-run feature) is reported verbatim but does not abort —
+any other strict error aborts), `--mode`
 `<sequential|parallel>` (default `sequential`; `parallel` fans out a proven-independent subset —
 see `execution-batch.md` § Parallel Execution), `--keep-going`
 (batch failure policy — skip a failed task's in-batch dependents, continue independents; default
@@ -75,6 +80,6 @@ full distinction.
 
 ## Implementation
 
-- Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface). Interactive sequential omit/`inline` keeps the orchestrator and each task's model stages in the host session through the [inline pipeline driver](../skills/spur-dev/references/inline-pipeline-driver.md). `--agent auto`, a name, or parallel mode retains the isolated per-task workflow boundary.
+- Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface). Interactive sequential omit/`inline` keeps the orchestrator in the host session through the [inline pipeline driver](../skills/spur-dev/references/inline-pipeline-driver.md); eligible `agent.run` stages may dispatch once to a native subagent with host fallback (task 0508). `--agent auto`, a name, or parallel mode retains the isolated per-task workflow boundary.
 - Interactive sequential omit/inline: `Skill(skill="sp:spur-dev", args="runall-inline $ARGUMENTS")`.
 - Explicit executor or parallel mode: `Skill(skill="sp:spur-dev", args="runall $ARGUMENTS")` → `sp:super-planner` agent.

package/plugins/sp/commands/dev-wrap.md

@@ -1,6 +1,6 @@
 ---
 description: Wrap up a single completed task — learnings, metrics, doc-sync, optional feature transition and branch cleanup
-argument-hint: "<wbs> [--auto] [--merge] [--dry-run]"
+argument-hint: "<wbs> [--agent <inline|auto|name>] [--auto] [--merge] [--dry-run]"
 allowed-tools: ["Bash", "Read", "AskUserQuestion"]
 ---
 
@@ -13,6 +13,7 @@ Wraps the **wrapup-pipeline.yaml** workflow.
 | Flag | Description | Default |
 | --- | --- | --- |
 | `<wbs>` | Task WBS to wrap. | required |
+| `--agent` `<inline\|auto\|name>` | Who runs the wrap's model-bearing steps. Wrap is workflow-backed: omit/`inline` resolves to `agent.default` (objective trigger 3 — durable auditable run record required); `auto` tier-resolves an executor; a name pins that executor into `vars.agent`. | agent.default |
 | `--auto` | Skip objective HITL gates. | off |
 | `--merge` | Merge the wrap branch. | off |
 | `--dry-run` | Render the wrap without writing. | off |
@@ -21,10 +22,27 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 ## Usage
 
-/sp:dev-wrap <wbs> [--auto] [--merge] [--dry-run]
+/sp:dev-wrap <wbs> [--agent <inline|auto|name>] [--auto] [--merge] [--dry-run]
 
 ## Implementation
 
+- Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
+- Wrap stays **workflow-backed** — `spur workflow run .spur/workflows/wrapup-pipeline.yaml` is the only implementation; there is no inline wrap driver.
+- Resolve the executor **before** launching the workflow:
+  - `--agent <name>` → pass the name unchanged into `vars.agent`.
+  - `--agent auto` → tier-resolve a concrete executor first, then merge it into `vars.agent`.
+  - omit/`--agent inline` → resolve to `agent.default` (the documented headless resolution of `inline`).
+- Emit a pre-dispatch notice naming the override before `spur workflow run`, exactly:
+  `execution surface: subprocess`, `reason: trigger 3 — durable auditable run record required`, `requested agent: inline|auto|<name>`, `executor: agent.default|<resolved-name>`.
+- The wrap workflow still creates its durable run record (task_run_links / trace) — the notice reports the override, it does not change the workflow.
+
 ```bash
-spur workflow run .spur/workflows/wrapup-pipeline.yaml --vars '{"tasks":"[\"<wbs>\"]","profile":"interactive|auto","merge":"true|false"}' [--dry-run]
+AGENT=… # resolved above: agent.default for inline/omitted, tier-resolved for auto, unchanged for <name>
+echo "execution surface: subprocess; reason: trigger 3 — durable auditable run record required; requested agent: <inline|auto|name>; executor: $AGENT"
+VARS=$(jq -nc --arg tasks "[\"$WBS\"]" --arg agent "$AGENT" --arg profile "$PROFILE" --arg merge "$MERGE" \
+  '{tasks:$tasks, agent:$agent, profile:$profile, merge:$merge}')
+spur workflow run .spur/workflows/wrapup-pipeline.yaml --vars "$VARS" [--dry-run]
 ```
+
+The executor resolution is described in the bullets above; the snippet's `AGENT` variable carries
+the resolved name (`agent.default` for omit/`inline`).