@gobing-ai/spur 0.3.52 → 0.3.53

package/.claude-plugin/marketplace.json

@@ -6,7 +6,7 @@
     },
     "plugins": [
         {
-            "version": "0.3.52",
+            "version": "0.3.53",
             "name": "sp",
             "source": "./plugins/sp",
             "description": "Spur - my harness toolkits"

package/config/corpus-baseline.json

@@ -239,14 +239,6 @@
             "reason": "BDD step-order advisory (\"When\" after \"Then\") — see note § L3.ac-bdd-warning.",
             "since": "2026-08-17"
         },
-        {
-            "kind": "feature",
-            "id": "I",
-            "code": "L4.orphan-scenarios",
-            "severity": "warning",
-            "reason": "Feature AC scenarios have no linked task (orphan scenarios) — see note § L4.orphan-scenarios.",
-            "since": "2026-08-17"
-        },
         {
             "kind": "feature",
             "id": "I1",
@@ -271,6 +263,14 @@
             "reason": "Linked task lacks a PASS verdict with MET requirement — verification pending, see note § L4.scenario-unverified.",
             "since": "2026-08-17"
         },
+        {
+            "kind": "feature",
+            "id": "I",
+            "code": "L4.uncovered-feature-scenario",
+            "severity": "warning",
+            "reason": "Feature I (sp plugin) ownership scenarios (\"Plugin work has one active root\", \"Runtime execution remains separate\", \"Legacy H does not receive new work\") are planning/ownership assertions not covered by any linked task AC. Task 0600 links feature I (superskill-entrypoint alignment) but its AC do not route ownership; the link changed the report from L4.orphan-scenarios to uncovered-feature-scenario (DD-09). Cover by a future feature-I ownership task.",
+            "since": "2026-08-19"
+        },
         {
             "kind": "feature",
             "id": "J",

package/config/workflows/task-pipeline2.yaml

@@ -0,0 +1,778 @@
+# Task execution pipeline 2 — rival pipeline (feature I6, task 0596): task-pipeline.yaml
+# plus a residual-sweep stage. NOT promoted — task-pipeline.yaml stays the default.
+#
+# Delta from task-pipeline.yaml:
+#   1. `verify` PASS now routes to `residual-sweep` (operator's manual fallback, wired
+#      into the FSM) before `record`/commit — it no longer depends on the operator
+#      remembering to type the prompt.
+#   2. The two-layer plan (Layer 1 = stages; Layer 2 = the active stage's onEnter steps)
+#      is sourced from `workflow run --dry-run` + the parsed definition and rendered by
+#      the inline driver (see inline-pipeline-driver.md § Two-layer plan) — zero engine
+#      change, consumption-only.
+#
+# Orchestration is configuration (ADR-022 / §3.2): this is YAML over the existing
+# dual-workflow engine — zero new engine code. The pipeline NEVER touches files
+# directly — `record` writes via `spur task update --section`, and status moves go
+# through the normal `spur task update <wbs> <status>` verb so the lifecycle guards
+# (0055) apply identically. Run linkage is written to `task_run_links` (kind=pipeline).
+#
+# Shape: precheck → implement → test[→test-fix↔test-recheck] → review → approve(HITL)
+#        → verify → record → done
+#        (precheck failure short-circuits to `failed`; approve routes to `failed` on
+#        operator rejection or `cancelled` on operator cancel — R1, bug-750).
+#        `test` is the project quality gate (shell + bounded /sp:dev-fixall), not
+#        /sp:dev-unit (coverage gap-fill; router C3/C5).
+#
+# Vars (passed as a JSON object via `--vars`):
+#   wbs                       — task WBS (required)
+#   profile                   — "auto" skips HITL approve (R4)
+#   agent / spurBin           — executor + spur binary (CLI overrides spurBin)
+#   stepTimeoutMs             — agent.run budget for review/verify/test-fix (ms)
+#   implementTimeoutMs        — implement agent.run budget (ms)
+#   qualityGateCmd            — project gate (default: bun run autofix && bun run spur-check)
+#   qualityGateMaxFixAttempts — max /sp:dev-fixall hops after a red gate (default: 2)
+#
+# Seeded by `spur init`. agent.run inputs are pure slash commands (ADR-043).
+
+"$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
+kind: state-machine
+name: task-pipeline2
+description: "Rival task pipeline: precheck → implement → quality-gate (test/fix/recheck) → review → approve → verify → residual-sweep → record → done"
+# Task entity lifecycle (owned by task-lifecycle.yaml):
+#   normal: backlog → todo → wip → testing → done
+#   blocked is bidirectional with todo/wip/testing; done may reopen to wip.
+#   any non-terminal state may transition to cancelled.
+# Guards:
+#   wip → testing:  spur task check <wbs>
+#   testing → done: spur task check <wbs> --strict-core, then PASS-verdict provenance
+# Invalid: todo → testing, todo → done, and wip → done.
+# Pipeline states below are orchestration states, not task statuses.
+iterationBound: 20
+initialState: precheck
+terminalStates:
+  - done
+  - failed
+  - cancelled
+failureStates:
+  - failed
+  - cancelled
+vars:
+  wbs: "0000"
+  profile: "standard"
+  # PATH-independent spur invocation for shell guards/actions. The CLI overrides this
+  # at run start (resolveSpurBin); the literal default is a safe fallback so direct/dry
+  # runs and `workflow validate` resolve the template. (See AGENTS.md / ADR-026.)
+  spurBin: "spur"
+  # Agent the pipeline's agent.run steps invoke. Override per run with
+  # `--vars '{"agent":"claude"}'`. Pinned (not left to the AiRunner's <default>
+  # selection) so a broken/misconfigured agent on the box can't silently capture the run.
+  agent: "omp"
+  # Implement-only executor override (R1, task 0454). Resolves to this YAML literal
+  # unless overridden. The `--agent` flag (execution-batch.md §3.2) forwards into BOTH
+  # `agent` and `implementAgent`, so a pinned `--agent X` reaches implement too. To
+  # pin ONLY implement while other hops keep the default, pass
+  # `--vars '{"implementAgent":"omp-zai"}'`.
+  implementAgent: "omp"
+  # Step-level timeout for agentic hops (review / verify / test-fix) in ms.
+  # Soft quality-gate shells are unbounded by this var (host shell only).
+  # Raised 600s → 1800s (task 0398 R4 / H6 dogfood). Override:
+  # `--vars '{"stepTimeoutMs":"120000"}'`. 30 min is headroom, not a licence to
+  # run unbounded — if a hop still hits this wall, STOP and record it.
+  stepTimeoutMs: "1800000"
+  # Timeout for the `implement` step specifically (R2a). Implementation is the
+  # heaviest agent.run step (full read/write/test-probe loop) and has timed out
+  # at the 600s default in five consecutive dogfood runs (bugs 742/744/746/748),
+  # a 100% failure rate at that budget. 30 min gives real headroom; STOP and
+  # record honestly rather than raising it further without operator sign-off.
+  implementTimeoutMs: "1800000"
+  # Answer captured by the approve gate's hitl.confirm (R1): "yes" | "no" | "cancel".
+  # Empty by default; only meaningful once the approve state has been entered.
+  __hitlAnswer: ""
+  # Residual-sweep prompt subject (R4). The operator's verbatim fallback prompt is
+  # templated over this noun phrase so both forms stay verbatim. Single-task default
+  # "current task"; a feature batch overrides it via `--vars`:
+  #   --vars '{"residualSweepTarget":"these tasks for current feature"}'
+  residualSweepTarget: "current task"
+  # Project quality gate for the `test` hop (probe + fixall + recheck). Override per project
+  # with the same package-manager surface (this monorepo is Bun-only):
+  # `--vars '{"qualityGateCmd":"bun run lint && bun run test"}'`. Soft probe, hard recheck,
+  # and the fixall slash input all use this same var so the command stays single-sourced.
+  # TRUSTED CONFIG ONLY — this string is executed via `sh -c` (see test/test-recheck). Never
+  # interpolate untrusted operator/LLM input into qualityGateCmd (task 0436 SECUA residual).
+  qualityGateCmd: "bun run format && bun run spur-check"
+  # Cheap red-detector run before the full gate on **recheck only**; empty ⇒ no probe
+  # (full gate every recheck — the pre-0587 behavior). A project overriding qualityGateCmd
+  # should override this too. TRUSTED CONFIG ONLY — executed via `sh -c` (same surface as
+  # qualityGateCmd). Invariant: `review` is only ever entered through a full green
+  # qualityGateCmd — only the full gate writes PASS to <wbs>-test-gate.status.
+  gateProbeCmd: "bun run lint"
+  # Max /sp:dev-fixall attempts after a red quality-gate probe/recheck (bounded; no thrash).
+  # Attempt counter: .spur/run/<wbs>-test-fix-attempt. Default 2 = two fixall hops before failed.
+  qualityGateMaxFixAttempts: "2"
+  # Post-implement auto-format. Overridable like qualityGateCmd so a non-Bun seeded
+  # project can point it at its own formatter; invoked best-effort (a missing or
+  # failing formatter must never abort a run — the quality gate is the real gate).
+  formatCmd: "bun run format"
+  # Bounded `file:line` anchors extracted from the failing quality-gate log by the
+  # `test` / `test-recheck` hops (deduped, max 20, space-separated on one line).
+  # `test-fix` reads `.spur/run/<wbs>-test-gate.findings` into this var and names the
+  # anchors directly in the /sp:dev-fixall input, so the fix agent starts AT the failing
+  # file:line instead of re-deriving it from a fresh gate run (0482 R3).
+  gateFindings: ""
+  # Max R-items in ## Requirements before size precheck fails (R2, task 0454).
+  # Override with `--vars '{"maxImplementReqs":"12"}'`.
+  maxImplementReqs: "5"
+  # Max checklist items under ## Plan before size precheck fails (R2, task 0454).
+  # Override with `--vars '{"maxImplementPlanItems":"15"}'`.
+  maxImplementPlanItems: "8"
+  # Diff-scope guard on the implement hop (R1, task 0487). When the target task
+  # body backticks at least one path, non-corpus changes outside those paths
+  # fail the step by name. New files beside a declared file are allowed. Empty
+  # (default) = on; set to "off" to bypass:
+  # `--vars '{"implementScopeGuard":"off"}'`.
+  implementScopeGuard: ""
+
+states:
+  - id: precheck
+    description: >
+      Pre-flight: soft agent doctor + transition guards for doctor PASS and
+      `spur task check <wbs>`. Failures route to the `failed` terminal state
+      (not a raw lifecycle abort mid-enter).
+    onEnter:
+      # Soft doctor — write status and always exit 0 so transitions can branch to
+      # `failed` cleanly (same pattern as the quality-gate soft probe).
+      #
+      # R2 (0487): probe BOTH resolved executors ($agent and $implementAgent) and
+      # FAIL on `authenticated: unauthenticated`. Previously only $agent was probed
+      # and auth was informational, so a run whose implement executor had no
+      # provider key sailed through precheck into a guaranteed implement failure
+      # (runs e8cb00e7 / b16bfbf4: "auth: no … API key not found for provider
+      # 'volc'" → precheck ✓). `unknown` auth keeps the old soft behavior — some
+      # agents expose no auth-status verb. `spur agent doctor` CLI exit-code
+      # semantics are deliberately untouched; the gate lives here.
+      # R4 (0487): one divergence line when the two executors differ (legitimate
+      # when only implementAgent is pinned, but it must be visible in the log).
+      # R2 (0503): omp/pi env-key probe misses are soft because the CLI process
+      # cannot see relay-owned credentials; explicit non-omp auth failures remain hard.
+      - kind: shell
+        options:
+          command: >-
+            mkdir -p .spur/run &&
+            DOCTOR_FILE=".spur/run/$wbs-precheck-doctor.status" &&
+            classifyDoctorProbe() {
+              PROBE_DETAIL="$1";
+              PROBE_AGENT="$2";
+              case "$PROBE_AGENT" in
+                omp|omp-*|pi|pi-*)
+                  if printf '%s' "$PROBE_DETAIL" | grep -Eiq 'API key not found for provider|no probe registered'; then
+                    printf 'env-miss\n';
+                    return;
+                  fi;;
+              esac;
+              if printf '%s' "$PROBE_DETAIL" | grep -Eiq 'invalid (API )?key|unauthori[sz]ed|forbidden|authentication failed|credential(s)? rejected'; then
+                printf 'auth-fail\n';
+              else
+                printf 'unknown\n';
+              fi;
+            } &&
+            STATUS=PASS;
+            if [ -n "$implementAgent" ] && [ "$implementAgent" != "$agent" ]; then
+              echo "precheck: agent=$agent implementAgent=$implementAgent (executors diverge)";
+              EXECS="$agent $implementAgent";
+            else
+              EXECS="$agent";
+            fi;
+            for EXE in $EXECS; do
+              OUT=$($spurBin agent doctor "$EXE" --json 2>&1) || {
+                echo "precheck: FAIL - doctor exited non-zero for $EXE";
+                echo "$OUT";
+                STATUS=FAIL;
+                continue;
+              };
+              AUTH=$(printf '%s' "$OUT" | jq -r '.agents[0].authenticated // "unknown"' 2>/dev/null || echo unknown);
+              DETAIL=$(printf '%s' "$OUT" | jq -r '.agents[0].modelStatus.detail // ""' 2>/dev/null || echo "");
+              PROBE=$(classifyDoctorProbe "$DETAIL" "$EXE");
+              echo "precheck: $EXE auth=$AUTH probe=$PROBE $DETAIL";
+              if [ "$AUTH" = unauthenticated ]; then
+                case "$EXE:$PROBE" in
+                  omp*:env-miss|pi*:env-miss|omp*:unknown|pi*:unknown)
+                    echo "precheck: SOFT - executor $EXE auth probe cannot see agent-owned credentials";;
+                  *)
+                    echo "precheck: FAIL - executor $EXE is unauthenticated; fix agent.default or pass --vars '{\"agent\":\"<authenticated-executor>\"}' ($spurBin agent doctor $EXE --json); $DETAIL";
+                    STATUS=FAIL;;
+                esac;
+              fi;
+            done;
+            echo "$STATUS" > "$DOCTOR_FILE";
+            exit 0
+      # R6 (0487): pre-launch hygiene WARNING (never a block) — starting a task on
+      # a tree already dirty with another task's implementation is how 0485's diff
+      # got swept into 0486's run. Corpus dirs are excluded: the pipeline writes
+      # those itself.
+      # R1 (0511): task-corpus dirt gets its own advisory NOTE — docs/tasks* is
+      # excluded from the non-corpus warning, so pre-existing task-corpus edits are
+      # invisible at launch yet can be accidentally staged with the current task
+      # later. Advisory only (never a block): the pipeline legitimately updates
+      # task files, so corpus dirt is launch-time visibility, not a lifecycle guard.
+      - kind: shell
+        options:
+          command: >-
+            DIRTY=$(git status --porcelain -- . ':(exclude)docs/tasks*' ':(exclude)docs/features' 2>/dev/null);
+            if [ -n "$DIRTY" ]; then
+              echo "precheck: WARNING - working tree has uncommitted non-corpus changes; commit or stash before starting a new task:";
+              echo "$DIRTY";
+            fi;
+            CORPUS_DIRTY=$(git status --porcelain -- ':(glob)docs/tasks*/**' 2>/dev/null);
+            if [ -n "$CORPUS_DIRTY" ]; then
+              echo "precheck: NOTE - task corpus has uncommitted changes; review before staging with this task:";
+              echo "$CORPUS_DIRTY";
+            fi;
+            exit 0
+      - kind: note
+        options:
+          # R4 task_run_links linkage (kind=pipeline) is written by a WorkflowService
+          # hook at run start — see the 0062 follow-up note; there is no link-writing
+          # CLI verb to call from a shell step, so it cannot live in pure YAML.
+          message: "Pipeline start for task ${vars.wbs}."
+      # R1 (0453): auto-profile precheck reopens a done feature before task check.
+      # Under profile=auto, resolve feature_id, sync (preferred) or update to active.
+      # Under non-auto, leave R4 message to guide the operator.
+      - kind: shell
+        options:
+          command: >-
+            if [ "$profile" = auto ]; then
+              FID=$($spurBin task show $wbs --json 2>/dev/null |
+              jq -r '.feature_id // .frontmatter.feature_id // empty' 2>/dev/null);
+              if [ -n "$FID" ]; then
+                $spurBin feature sync "$FID" --force --json 2>/dev/null ||
+                $spurBin feature update "$FID" active 2>/dev/null || true;
+              fi;
+            fi;
+            exit 0
+      # R2 (0454): task size precheck — evaluate R-item and Plan-item counts.
+      # Writes PASS/FAIL to .spur/run/<wbs>-precheck-size.status. Always exit 0
+      # (soft check, like doctor). The precheck→implement guard reads the file.
+      # R3 (0487): `--executor` adds the size-vs-capability gate — a task past the
+      # DEFAULT caps routed to a sub-`capable-1` executor blocks here instead of
+      # burning the full implementTimeoutMs and exiting 3 (run ca130182).
+      - kind: shell
+        options:
+          command: >-
+            SIZE_FILE=".spur/run/$wbs-precheck-size.status" &&
+            mkdir -p .spur/run &&
+            bun plugins/sp/scripts/task-size-precheck.ts "$wbs"
+            --spur-bin "$spurBin" --max-reqs "$maxImplementReqs" --max-plan-items "$maxImplementPlanItems"
+            --executor "$implementAgent" &&
+            exit 0
+
+  - id: implement
+    description: >
+      Run agent-driven implementation via /sp:dev-run --mode implement, THEN move the
+      task to `wip` via the normal verb. The lifecycle transition fires AFTER the
+      implement agent.run succeeds — onEnter runs in declaration order and the default
+      'fail' policy halts the sequence (routing the run to `failed`) if the agent.run
+      fails or times out, so a halted implement never leaves the task at `wip` with an
+      empty Solution (the F3 half-state). The `--no-lifecycle` flag is correct here: the
+      pipeline owns this transition; the FSM guard would otherwise re-run `spur task
+      check`, which is precheck's job.
+      NOTE: this step must NOT call /sp:dev-run in full mode (the default) —
+      that command DRIVES this pipeline, so calling it here recurses.
+      --mode implement is the single-step implement entry.
+    onEnter:
+      - kind: agent.run
+        options:
+          agent: ${vars.implementAgent}
+          # Pure slash command only (ADR-043). Anti-recursion / implement discipline
+          # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
+          role: coder
+          # lives in /sp:dev-run --mode implement → sp:code-implementation, not YAML prose.
+          input: /sp:dev-run --mode implement ${vars.wbs} --auto
+          timeoutMs: ${vars.implementTimeoutMs}
+          # R3 (task 0424): empty-implement no-op guard — the agent.run action
+          # fails the step when exit 0 produced zero non-corpus file changes, so
+          # a silent no-op routes the run to `failed` here instead of drifting
+          # into test/review and being caught a full pass later.
+          requireDiff: true
+      - kind: shell
+        options:
+          command: >-
+            retry_transient() {
+              RETRY_OUTPUT=$("$@" 2>&1); RETRY_RC=$?;
+              printf '%s\n' "$RETRY_OUTPUT";
+              if [ "$RETRY_RC" -eq 0 ]; then return 0; fi;
+              if ! printf '%s' "$RETRY_OUTPUT" | grep -Eq 'ENOENT|EBUSY|ENOTEMPTY|database is locked'; then return "$RETRY_RC"; fi;
+              sleep 2;
+              RETRY_SECOND_OUTPUT=$("$@" 2>&1); RETRY_RC=$?;
+              printf '%s\n' "$RETRY_SECOND_OUTPUT";
+              if [ "$RETRY_RC" -ne 0 ] && printf '%s\n%s' "$RETRY_OUTPUT" "$RETRY_SECOND_OUTPUT" | grep -Eq 'ENOENT|EBUSY|ENOTEMPTY'; then
+                echo "node_modules link/dependency broken — run bun install and retry";
+              fi;
+              return "$RETRY_RC";
+            };
+            retry_transient $spurBin task update "$wbs" wip --no-lifecycle
+      # Post-implement cleanup: auto-format any unformatted output the agent produced.
+      # The agent may leave files that don't pass `biome check`, which then fails
+      # `bun run lint` downstream. Running format here is cheap (< 1 s) and prevents
+      # the test stage from tripping on a purely mechanical formatting defect (dogfood
+      # bug-733 — omp left agent-run.test.ts unformatted, causing a spurious lint gate
+      # failure that the ## Testing section mis-attributed to "pre-existing gaps").
+      # Best-effort: `; exit 0` (not `&&`) so a missing/failing formatter in a seeded
+      # non-Bun project cannot abort a run mid-implement. Formatting is a convenience;
+      # `${vars.qualityGateCmd}` at `test` is the gate that actually decides.
+      - kind: shell
+        options:
+          command: "$formatCmd ; exit 0"
+
+  # ── test hop (quality gate + bounded auto-fix) ─────────────────────────────
+  # NOT /sp:dev-unit. That command (sp:code-testing) *extends/generates* tests toward
+  # a coverage target; it is not the project quality gate. Coverage gap-fill remains
+  # available via router C3/C5 (`/sp:dev-unit`) or inside implement — not this hop.
+  #
+  # Shape (engine has no per-action "run next only if previous failed" without
+  # `onError`, and Spur's action schema does not expose `onError`):
+  #   test         — soft probe: qualityGateCmd → PASS|FAIL status; always exit 0
+  #                  (green path: one gate run → review; no fixall/recheck tax)
+  #   test-fix     — increment attempt + pure slash /sp:dev-fixall (≤ max attempts)
+  #   test-recheck — soft recheck → review | test-fix | failed (never silent lifecycle abort)
+  - id: test
+    description: >
+      Soft quality-gate probe (single logical gate on the green path; bounded retries only
+      for SQLite lock contention). Runs
+      `${vars.qualityGateCmd}`, records PASS|FAIL under
+      `.spur/run/<wbs>-test-gate.status`, resets the fix attempt counter, always exit 0.
+    onEnter:
+      - kind: shell
+        options:
+          command: >-
+            mkdir -p .spur/run &&
+            STATUS_FILE=".spur/run/$wbs-test-gate.status" &&
+            LOG_FILE=".spur/run/$wbs-test-gate.log" &&
+            ATTEMPT_FILE=".spur/run/$wbs-test-fix-attempt" &&
+            echo 0 > "$ATTEMPT_FILE" &&
+            : > "$LOG_FILE" &&
+            gate_attempt=1;
+            while [ "$gate_attempt" -le 5 ]; do
+              ATTEMPT_LOG="$LOG_FILE.attempt-$gate_attempt";
+              sh -c "$qualityGateCmd" > "$ATTEMPT_LOG" 2>&1; gate_rc=$?;
+              gate_locked=0;
+              grep -q 'SQLiteError: database is locked' "$ATTEMPT_LOG" && gate_locked=1;
+              cat "$ATTEMPT_LOG" >> "$LOG_FILE";
+              rm -f "$ATTEMPT_LOG";
+              if [ "$gate_rc" -eq 0 ] || [ "$gate_locked" -ne 1 ] || [ "$gate_attempt" -ge 5 ]; then break; fi;
+              printf 'quality gate: database is locked; retrying (%s/5) in 10s\n' "$gate_attempt" | tee -a "$LOG_FILE";
+              sleep 10;
+              gate_attempt=$((gate_attempt + 1));
+            done &&
+            cat "$LOG_FILE" &&
+            FINDINGS_FILE=".spur/run/$wbs-test-gate.findings" &&
+            set +e; grep -oE '[A-Za-z0-9_./-]+\.[A-Za-z]+:[0-9]+' "$LOG_FILE" | sort -u | head -20 | tr '\n' ' ' > "$FINDINGS_FILE"; set -e &&
+            if [ "$gate_rc" -eq 0 ]; then
+              printf 'PASS\n' > "$STATUS_FILE";
+            else
+              printf 'FAIL\n' > "$STATUS_FILE";
+            fi &&
+            exit 0
+
+  - id: test-fix
+    description: >
+      Bounded auto-fix hop when the quality gate is red. Increments
+      `.spur/run/<wbs>-test-fix-attempt`, then pure slash (ADR-043)
+      `/sp:dev-fixall` against `${vars.qualityGateCmd}`.
+    onEnter:
+      - kind: shell
+        options:
+          command: >-
+            mkdir -p .spur/run &&
+            ATTEMPT_FILE=".spur/run/$wbs-test-fix-attempt" &&
+            n=$(cat "$ATTEMPT_FILE" 2>/dev/null || echo 0) &&
+            printf '%s\n' "$((n + 1))" > "$ATTEMPT_FILE"
+      # R3 (0482): project the extracted gate anchors into a var so the dispatch input
+      # can NAME the failing file:line, not merely point at a log. A vars template cannot
+      # run a shell, so the read is an action, not an inline `$(cat ...)` substitution.
+      - kind: file.read.into-var
+        options:
+          path: .spur/run/${vars.wbs}-test-gate.findings
+          var: gateFindings
+      - kind: agent.run
+        options:
+          agent: ${vars.agent}
+          # R3 (0482): `--findings` names the failing anchors inline; `--gate-log` remains
+          # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
+          role: coder
+          # the full-context escape hatch when the digest is not enough.
+          input: /sp:dev-fixall "${vars.qualityGateCmd}" --gate-log .spur/run/${vars.wbs}-test-gate.log --findings "${vars.gateFindings}"
+          timeoutMs: ${vars.stepTimeoutMs}
+
+  - id: test-recheck
+    description: >
+      Soft recheck after fixall with bounded SQLite-lock retry. Writes PASS|FAIL (always exit 0). Transitions
+      branch to review (PASS), another test-fix (FAIL and under max attempts),
+      or the pipeline `failed` state (FAIL and attempts exhausted) — never a
+      raw lifecycle abort that skips the terminal `failed` state.
+    onEnter:
+      # 0587 R3: probe-then-full recheck. A red gateProbeCmd records FAIL and skips the full
+      # gate (the measured waste is re-running a 110–140s gate to learn the tree is still red);
+      # a green probe (or empty gateProbeCmd) falls through to the full-gate loop unchanged.
+      # Only the full gate writes PASS, so the `test-recheck → review` guard (reads PASS)
+      # still means a full green qualityGateCmd ran — invariant preserved by construction.
+      - kind: shell
+        options:
+          command: >-
+            mkdir -p .spur/run &&
+            STATUS_FILE=".spur/run/$wbs-test-gate.status" &&
+            LOG_FILE=".spur/run/$wbs-test-gate.log" &&
+            FINDINGS_FILE=".spur/run/$wbs-test-gate.findings" &&
+            : > "$LOG_FILE" &&
+            probe_rc=0;
+            if [ -n "$gateProbeCmd" ]; then
+              sh -c "$gateProbeCmd" > "$LOG_FILE.probe" 2>&1; probe_rc=$?;
+              cat "$LOG_FILE.probe" >> "$LOG_FILE";
+              rm -f "$LOG_FILE.probe";
+            fi;
+            if [ "$probe_rc" -ne 0 ]; then
+              gate_rc=$probe_rc;
+            else
+              gate_attempt=1;
+              while [ "$gate_attempt" -le 5 ]; do
+                ATTEMPT_LOG="$LOG_FILE.attempt-$gate_attempt";
+                sh -c "$qualityGateCmd" > "$ATTEMPT_LOG" 2>&1; gate_rc=$?;
+                gate_locked=0;
+                grep -q 'SQLiteError: database is locked' "$ATTEMPT_LOG" && gate_locked=1;
+                cat "$ATTEMPT_LOG" >> "$LOG_FILE";
+                rm -f "$ATTEMPT_LOG";
+                if [ "$gate_rc" -eq 0 ] || [ "$gate_locked" -ne 1 ] || [ "$gate_attempt" -ge 5 ]; then break; fi;
+                printf 'quality gate: database is locked; retrying (%s/5) in 10s\n' "$gate_attempt" | tee -a "$LOG_FILE";
+                sleep 10;
+                gate_attempt=$((gate_attempt + 1));
+              done;
+            fi &&
+            cat "$LOG_FILE" &&
+            set +e; grep -oE '[A-Za-z0-9_./-]+\.[A-Za-z]+:[0-9]+' "$LOG_FILE" | sort -u | head -20 | tr '\n' ' ' > "$FINDINGS_FILE"; set -e &&
+            if [ "$gate_rc" -eq 0 ]; then
+              printf 'PASS\n' > "$STATUS_FILE";
+            else
+              printf 'FAIL\n' > "$STATUS_FILE";
+            fi &&
+            exit 0
+
+  - id: review
+    description: Three-dimensional code review via /sp:dev-review (functional requirements traceability + SECUA framework (Security, Efficiency, Correctness, Usability, Architecture) + architecture depth), findings written to `## Review`.
+    onEnter:
+      - kind: agent.run
+        options:
+          agent: ${vars.agent}
+          input: /sp:dev-review ${vars.wbs} --auto
+          # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
+          role: reviewer
+          timeoutMs: ${vars.stepTimeoutMs}
+
+  - id: approve
+    description: >
+      Human-in-the-loop approval gate. Under `profile=auto` this state is never entered
+      (review routes around it straight to verify). In interactive mode this state pauses
+      the run for `spur workflow continue` (E3), making approval an explicit operator action.
+      The operator's answer is routed (R1, bug-750): yes -> verify; no -> failed (rejection
+      recorded, not silently approved); cancel -> cancelled (a distinct terminal state).
+    pause: true
+    onEnter:
+      - kind: hitl.confirm
+        options:
+          prompt: "Approve task ${vars.wbs} to proceed to verification?"
+
+  - id: verify
+    description: >
+      Functional verification (BDD + traceability) via /sp:dev-verify. The agent's
+      captured answer is written to `.spur/run/<wbs>-verify-answer.txt` and MUST follow
+      the answer-file schema contract (explicit `Verdict: PASS|PARTIAL|FAIL` line plus
+      `| Req | Status | Evidence |` and `| AC | Status | Evidence Type | Evidence |` tables);
+      a deterministic shell step then derives the verdict and writes the gate artifact
+      `.spur/run/<wbs>-verdict.json` (so the completion gate reads a real verdict, not
+      agent discretion — R9). The verdict is PASS only if the agent both reported PASS
+      AND `spur task check` passes; otherwise FAIL.
+    onEnter:
+      - kind: agent.run
+        options:
+          agent: ${vars.agent}
+          input: /sp:dev-verify ${vars.wbs} --auto --fix all --focus all
+          # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
+          role: reviewer
+          timeoutMs: ${vars.stepTimeoutMs}
+          answerFile: .spur/run/${vars.wbs}-verify-answer.txt
+      - kind: shell
+        options:
+          command: "$spurBin task verdict $wbs --from-answer .spur/run/$wbs-verify-answer.txt"
+
+  - id: residual-sweep
+    description: >
+      Residual sweep (R4) — the operator's manual fallback, wired into the FSM as
+      its own stage (NOT a step inside verify). Decision: the PASS verdict is a
+      TRANSITION guard (`verify -> record`), evaluated only after verify's onEnter
+      finishes — a step inside verify would run before that guard and could not be
+      conditioned on the verdict. A separate stage reached only via the PASS guard
+      is the only way to hold the fixed position (after PASS, before record/commit).
+      It also makes the per-task sweep free in the `--feature` batch: the batch runs
+      this pipeline once per task, so each task sweeps itself (Q&A: per task, never
+      once per feature). The agent.run prompt is the operator's verbatim fallback,
+      templated over `residualSweepTarget` (single-task vs feature wording).
+    onEnter:
+      - kind: agent.run
+        options:
+          agent: ${vars.agent}
+          # Post-verification completeness judgment (catch what the per-requirement
+          # verdict structurally misses) — folds the `verify` stage, so it takes the
+          # reviewer role (capable-1), matching the operator's strong-model usage.
+          role: reviewer
+          input: "Anything remained in ${vars.residualSweepTarget}? if any, you should get all of them done before we commit all the changes in next step"
+          timeoutMs: ${vars.stepTimeoutMs}
+
+  - id: record
+    description: >
+      Record pipeline results into the task file via `spur task record` —
+      Testing/Review from the verdict, Solution backfilled from git diff as a
+      safety net, optional transition to testing. Post-record step conditionally syncs
+      feature status via the bounded `feature-sync-bounded` wrapper (task 0411
+      retry-suppression) if `feature_id` is present, or appends an orphan link proposal
+      to the run report if absent (task 0328 / ADR-0322).
+    onEnter:
+      - kind: shell
+        options:
+          command: >-
+            retry_transient() {
+              RETRY_OUTPUT=$("$@" 2>&1); RETRY_RC=$?;
+              printf '%s\n' "$RETRY_OUTPUT";
+              if [ "$RETRY_RC" -eq 0 ]; then return 0; fi;
+              if ! printf '%s' "$RETRY_OUTPUT" | grep -Eq 'ENOENT|EBUSY|ENOTEMPTY|database is locked'; then return "$RETRY_RC"; fi;
+              sleep 2;
+              RETRY_SECOND_OUTPUT=$("$@" 2>&1); RETRY_RC=$?;
+              printf '%s\n' "$RETRY_SECOND_OUTPUT";
+              if [ "$RETRY_RC" -ne 0 ] && printf '%s\n%s' "$RETRY_OUTPUT" "$RETRY_SECOND_OUTPUT" | grep -Eq 'ENOENT|EBUSY|ENOTEMPTY'; then
+                echo "node_modules link/dependency broken — run bun install and retry";
+              fi;
+              return "$RETRY_RC";
+            };
+            retry_transient $spurBin task record "$wbs" --solution-from-diff --transition testing
+      # Best-effort, and portable across layouts. `feature-sync-bounded.ts` is a
+      # Spur-monorepo path — `spur init` never scaffolds `plugins/sp/`, so a seeded
+      # project must fall back to the plain `spur feature sync` verb rather than
+      # abort a run that already produced a PASS verdict. Trailing `exit 0` keeps the
+      # whole step advisory for the same reason (feature status sync is a follow-up,
+      # not a completion gate — `record → done` runs `spur task check`).
+      - kind: shell
+        options:
+          command: >-
+            FID=$($spurBin task show $wbs --json 2>/dev/null |
+            jq -r ".feature_id // .frontmatter.feature_id // empty" 2>/dev/null);
+            if [ -n "$FID" ]; then
+              if [ -f plugins/sp/scripts/feature-sync-bounded.ts ]; then
+                bun plugins/sp/scripts/feature-sync-bounded.ts "$FID" --spur-bin "$spurBin" --json;
+              else
+                $spurBin feature sync "$FID" --json;
+              fi;
+            else
+              echo "Orphan task $wbs — no feature_id linked; proposal: consider linking to a parent feature." >> ".spur/run/$wbs-report.txt";
+            fi;
+            exit 0
+
+  - id: done
+    description: >
+      Terminal — task executed, verified, and recorded. The `record → done`
+      guard runs `spur task check` before certifying; a genuinely non-compliant
+      task routes to `failed` instead of a silent bad `done`.
+    onEnter:
+      - kind: shell
+        options:
+          command: >-
+            retry_transient() {
+              RETRY_OUTPUT=$("$@" 2>&1); RETRY_RC=$?;
+              printf '%s\n' "$RETRY_OUTPUT";
+              if [ "$RETRY_RC" -eq 0 ]; then return 0; fi;
+              if ! printf '%s' "$RETRY_OUTPUT" | grep -Eq 'ENOENT|EBUSY|ENOTEMPTY|database is locked'; then return "$RETRY_RC"; fi;
+              sleep 2;
+              RETRY_SECOND_OUTPUT=$("$@" 2>&1); RETRY_RC=$?;
+              printf '%s\n' "$RETRY_SECOND_OUTPUT";
+              if [ "$RETRY_RC" -ne 0 ] && printf '%s\n%s' "$RETRY_OUTPUT" "$RETRY_SECOND_OUTPUT" | grep -Eq 'ENOENT|EBUSY|ENOTEMPTY'; then
+                echo "node_modules link/dependency broken — run bun install and retry";
+              fi;
+              return "$RETRY_RC";
+            };
+            retry_transient $spurBin task update "$wbs" done --no-lifecycle
+      - kind: note
+        options:
+          message: "Pipeline complete for task ${vars.wbs} (done gate cleared)."
+      # Checkpoint write: record session state for resume (Phase 4, task 0171 R3)
+      - kind: shell
+        options:
+          command: 'mkdir -p .spur/memory/sessions && echo "checkpoint: task-pipeline done wbs=$wbs ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)" > .spur/memory/sessions/$wbs-checkpoint.md'
+
+  - id: failed
+    description: >
+      Terminal — precheck, quality-gate exhaustion, verify non-PASS, record check
+      failure, or operator rejection; reported, not advanced.
+
+  - id: cancelled
+    description: Terminal — pipeline cancelled by operator at the approval gate (R1).
+
+transitions:
+  # ── precheck: doctor PASS + task check → implement; else → failed ──
+  - from: precheck
+    to: implement
+    description: Agent doctor PASS and task check green — begin implementation.
+    guard:
+      kind: shell
+      options:
+        command: 'test "$(cat .spur/run/$wbs-precheck-doctor.status 2>/dev/null)" = PASS && test "$(cat .spur/run/$wbs-precheck-size.status 2>/dev/null)" = PASS && $spurBin task check $wbs'
+  - from: precheck
+    to: failed
+    description: Doctor FAIL and/or task check failed — stop before implement.
+    guard:
+      kind: always
+
+  # ── linear body ──
+  - from: implement
+    to: test
+    description: Implementation done — quality-gate probe.
+    guard:
+      kind: always
+  # Soft probe branching (declaration order: PASS first, then FAIL, then defense).
+  - from: test
+    to: review
+    description: Quality gate already green — one gate run only; skip fixall/recheck.
+    guard:
+      kind: shell
+      options:
+        command: 'test "$(cat .spur/run/$wbs-test-gate.status 2>/dev/null)" = PASS'
+  - from: test
+    to: test-fix
+    description: Quality gate red — start bounded fixall loop.
+    guard:
+      kind: shell
+      options:
+        command: 'test "$(cat .spur/run/$wbs-test-gate.status 2>/dev/null)" = FAIL'
+  # Defense: missing/corrupt status — treat as FAIL path, not silent PASS.
+  - from: test
+    to: test-fix
+    description: Probe status missing/corrupt — attempt fixall then recheck.
+    guard:
+      kind: always
+  - from: test-fix
+    to: test-recheck
+    description: Fixall finished — soft recheck the same quality gate.
+    guard:
+      kind: always
+  # Recheck branching (PASS first; under-max FAIL → fixall again; exhausted → failed).
+  - from: test-recheck
+    to: review
+    description: Quality gate green after fixall — proceed to review.
+    guard:
+      kind: shell
+      options:
+        command: 'test "$(cat .spur/run/$wbs-test-gate.status 2>/dev/null)" = PASS'
+  - from: test-recheck
+    to: test-fix
+    description: Still red and under qualityGateMaxFixAttempts — another fixall hop.
+    guard:
+      kind: shell
+      options:
+        command: 'test "$(cat .spur/run/$wbs-test-gate.status 2>/dev/null)" = FAIL && test "$(cat .spur/run/$wbs-test-fix-attempt 2>/dev/null || echo 0)" -lt "$qualityGateMaxFixAttempts"'
+  - from: test-recheck
+    to: failed
+    description: Still red after max fixall attempts — stop at failed (not silent abort).
+    guard:
+      kind: shell
+      options:
+        command: 'test "$(cat .spur/run/$wbs-test-gate.status 2>/dev/null)" = FAIL && test "$(cat .spur/run/$wbs-test-fix-attempt 2>/dev/null || echo 0)" -ge "$qualityGateMaxFixAttempts"'
+  # Defense: corrupt recheck status — failed, not review.
+  - from: test-recheck
+    to: failed
+    description: Recheck status missing/corrupt — stop at failed.
+    guard:
+      kind: always
+  # ── review → approve, OR skip the HITL gate entirely when profile=auto (R4) ──
+  # Declaration order matters: the auto-skip guard is tried FIRST, so under
+  # profile=auto the run routes straight to verify and never ENTERS approve
+  # (whose onEnter hitl.confirm would otherwise block). Otherwise fall through
+  # to approve for the human gate.
+  - from: review
+    to: verify
+    description: profile=auto — skip the human approval gate, go straight to verify.
+    guard:
+      kind: shell
+      options:
+        command: 'test "$profile" = auto'
+  - from: review
+    to: approve
+    description: Review done — gate on human approval.
+    guard:
+      kind: always
+
+  # ── approve: HITL gate (reached only when profile != auto). Routed by the
+  # operator's captured answer (R1, bug-750) — three ordered guards, declaration
+  # order matters (yes first, then no, then cancel), mirroring idea-pipeline's
+  # design-approval gate (.spur/workflows/idea-pipeline.yaml:352-366). No
+  # `always` edge remains out of `approve`. ──
+  - from: approve
+    to: verify
+    description: Approved — proceed to verification.
+    guard:
+      kind: shell
+      options:
+        command: 'test "$__hitlAnswer" = yes'
+  - from: approve
+    to: failed
+    description: Operator rejected at the approval gate — report and stop.
+    guard:
+      kind: shell
+      options:
+        command: 'test "$__hitlAnswer" = no'
+  - from: approve
+    to: cancelled
+    description: Operator cancelled at the approval gate.
+    guard:
+      kind: shell
+      options:
+        command: 'test "$__hitlAnswer" = cancel'
+
+  # ── completion gate (the YAML-native replacement for rd3's default-on --postflight-verify) ──
+  # The verify step emits .spur/run/<wbs>-verdict.json. Only `verdict: PASS` clears
+  # the gate to `residual-sweep` (thence `record`); any non-PASS (PARTIAL/FAIL), a
+  # missing file, or malformed JSON routes to `failed`. Declaration order: PASS guard
+  # tried FIRST. The residual sweep therefore runs ONLY on a PASS verdict, before
+  # record/commit — its fixed position is enforced by the FSM, not operator memory.
+  - from: verify
+    to: residual-sweep
+    description: Verification verdict is PASS — sweep residual work before record/commit.
+    guard:
+      kind: shell
+      options:
+        command: 'test "$(jq -r .verdict .spur/run/$wbs-verdict.json 2>/dev/null)" = PASS'
+  - from: verify
+    to: failed
+    description: Verification verdict is not PASS (PARTIAL/FAIL/missing) — block before done.
+    guard:
+      kind: shell
+      options:
+        command: 'test "$(jq -r .verdict .spur/run/$wbs-verdict.json 2>/dev/null)" != PASS'
+  - from: residual-sweep
+    to: record
+    description: Residual sweep done — record results and proceed to done.
+    guard:
+      kind: always
+  # ── done gate: record → done/failed gated on `spur task check` (ADR-026 amendment 2026-06-23) ──
+  # The record step guarantees every done-required section ([Solution, Testing, Review])
+  # has real content (each owned by its pipeline step). This guard is defense-in-depth —
+  # it certifies the matrix before done; a genuinely non-compliant task routes to failed.
+  # Declaration order: pass guard first.
+  - from: record
+    to: done
+    description: Task check passed — certify done.
+    guard:
+      kind: shell
+      options:
+        command: "$spurBin task check $wbs"
+  - from: record
+    to: failed
+    description: Task check failed — block before done; investigate missing sections.
+    guard:
+      kind: shell
+      options:
+        command: "! $spurBin task check $wbs"

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.3.52",
+    "version": "0.3.53",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",

package/plugins/sp/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "sp",
-    "version": "0.3.52",
+    "version": "0.3.53",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics.",
     "extensions": {
         "pi": ["./hooks/pi/guard-extension.ts"]

package/plugins/sp/skills/spur-dev/references/inline-pipeline-driver.md

@@ -30,7 +30,16 @@ command, skill, script, or second workflow.
    `session` and the Codex key `session_id` (in that order). If neither is available, allocate
    `host-session-<run-id>` and record that fallback in the log; provenance must never be blank or
    guessed from an executor subprocess.
-4. Record lifecycle provenance before entering the FSM:
+4. Render the two-layer plan into the host todo list (task 0596):
+   - **Layer 1** = the pipeline's `states` in declaration order, with the active state marked — the
+     same order `renderRunPlan` / `spur workflow run --dry-run` previews.
+   - **Layer 2** = the active state's `onEnter` actions (`kind` + resolved `input`/`command`), shown
+     only for the active state.
+   - **Refresh cadence** = stage boundaries only (when the current state changes after a transition),
+     never per action.
+   - **Source of truth** = the YAML parsed in step 1 plus the dry-run walk — never hand-copy the
+     state list into the driver, a command, a skill, or a script.
+5. Record lifecycle provenance before entering the FSM:
 
    ```bash
    spur task run-link <wbs> --source inline-full --run-id <run-id> --json

package/spur.js

@@ -75146,7 +75146,8 @@ class TaskService {
       priority: true,
       done_forced: true,
       done_reason: true,
-      ac_numbering: true
+      ac_numbering: true,
+      ac_altitude: true
     };
     if (!(key2 in allowed)) {
       throw new Error(`Field "${key2}" is not settable via update; allowed: ${Object.keys(allowed).join(", ")}.`);
@@ -88006,7 +88007,7 @@ import { createRequire } from "module";
 var CLI_CONFIG = {
   binaryName: "spur",
   binaryLabel: "spur",
-  binaryVersion: "0.3.52",
+  binaryVersion: "0.3.53",
   configDir: ".spur",
   configFile: ".spur/config.yaml",
   databaseFile: ".spur/spur.db"
@@ -100037,7 +100038,7 @@ ${result.content}`);
     "See the gate checklist (spur-dev/references/gate-checklists.md).",
     "Valid section names (no failed write): `spur task sections <wbs> list`."
   ].join(`
-`)).option("--section <name>", "Section name to replace").option("--from-file <path>", "File to read section body from (requires --section)").option("--feature <id>", "Set the feature_id frontmatter field (traceability edge)").option("--priority <p>", "Set the priority frontmatter field (P0\u2013P3)").option("--ac-numbering <mode>", "Set the ac_numbering frontmatter field (task-local) \u2014 opts the task into the Requirements\u2194AC coverage check").option("--no-lifecycle", "Suppress lifecycle workflow run creation (use during pipeline runs to avoid orphaned lifecycle runs)").option("--force-done", "Allow transitioning to `done` even when the verify verdict is not PASS; records an override (task 0292). Waives the verdict only \u2014 the FSM path still applies, so from an earlier status walk the hops first: `todo` \u2192 `wip` \u2192 `testing` \u2192 `done` (each hop runs the structural `spur task check`)").option("--reason <text>", "Rationale for a forced-done override (paired with --force-done; persisted as done_reason)").option("--verdict-dir <path>", "Directory holding <wbs>-verdict.json artifacts (default: .spur/run)").option("--folder <path>", "Custom tasks folder").option("--json", "Output machine-readable JSON").action(async (wbs, status, options) => {
+`)).option("--section <name>", "Section name to replace").option("--from-file <path>", "File to read section body from (requires --section)").option("--feature <id>", "Set the feature_id frontmatter field (traceability edge)").option("--priority <p>", "Set the priority frontmatter field (P0\u2013P3)").option("--ac-numbering <mode>", "Set the ac_numbering frontmatter field (task-local) \u2014 opts the task into the Requirements\u2194AC coverage check").option("--ac-altitude <mode>", "Set the ac_altitude frontmatter field. Valid: `graduating` (default; feature-AC subset rule enforced) or `task-local` (skip the DD-09 subset rule \u2014 task scenarios are intentionally not feature ship criteria). Mirrors the L1 schema enum (packages/domain/src/planning/schema.ts:304).").option("--no-lifecycle", "Suppress lifecycle workflow run creation (use during pipeline runs to avoid orphaned lifecycle runs)").option("--force-done", "Allow transitioning to `done` even when the verify verdict is not PASS; records an override (task 0292). Waives the verdict only \u2014 the FSM path still applies, so from an earlier status walk the hops first: `todo` \u2192 `wip` \u2192 `testing` \u2192 `done` (each hop runs the structural `spur task check`)").option("--reason <text>", "Rationale for a forced-done override (paired with --force-done; persisted as done_reason)").option("--verdict-dir <path>", "Directory holding <wbs>-verdict.json artifacts (default: .spur/run)").option("--folder <path>", "Custom tasks folder").option("--json", "Output machine-readable JSON").action(async (wbs, status, options) => {
     const svc = await makeService2(context4, options.folder, options.lifecycle === false);
     try {
       if (options.section !== undefined) {
@@ -100055,9 +100056,9 @@ ${result.content}`);
           }
           context4.output.write(`Updated section '${options.section}' in task ${result.ref.id}`);
         }
-      } else if (options.feature !== undefined || options.priority !== undefined || options.acNumbering !== undefined) {
-        const key2 = options.feature !== undefined ? "feature_id" : options.priority !== undefined ? "priority" : "ac_numbering";
-        const value2 = options.feature ?? options.priority ?? options.acNumbering ?? "";
+      } else if (options.feature !== undefined || options.priority !== undefined || options.acNumbering !== undefined || options.acAltitude !== undefined) {
+        const key2 = options.feature !== undefined ? "feature_id" : options.priority !== undefined ? "priority" : options.acNumbering !== undefined ? "ac_numbering" : "ac_altitude";
+        const value2 = options.feature ?? options.priority ?? options.acNumbering ?? options.acAltitude ?? "";
         const result = await svc.updateField(wbs, key2, value2);
         if (options.json) {
           context4.output.write(toJson2(result));