@gobing-ai/spur 0.3.53 → 0.3.55

package/config/workflows/docs-pipeline.yaml

@@ -36,23 +36,35 @@ vars:
 states:
   - id: precheck
     description: >
-      Soft precheck: task check + agent doctor. Status files always exit 0 so
-      failures route to `failed` via transitions (not a raw lifecycle abort).
+      Soft precheck: task check + agent doctor, each owned by a deterministic `command.gate`
+      (D5-J, ADR-069). Both gates run `softFail: true`, so a red probe records FAIL and lets
+      the transitions route to `failed` instead of aborting the run — the shipped action
+      schema exposes no `onError`, so soft mode is what preserves that routing.
+      The canonical `.spur/run/$wbs-docs-precheck.status` is the AND of the two gate files.
     onEnter:
+      - kind: command.gate
+        options:
+          id: docs-precheck-task
+          executable: "${vars.spurBin}"
+          args: ["task", "check", "${vars.wbs}"]
+          resultFile: .spur/run/${vars.wbs}-docs-precheck-task.status
+          softFail: true
+          timeoutMs: 120000
+      - kind: command.gate
+        options:
+          id: docs-precheck-agent
+          executable: "${vars.spurBin}"
+          args: ["agent", "doctor", "${vars.agent}"]
+          resultFile: .spur/run/${vars.wbs}-docs-precheck-agent.status
+          softFail: true
+          timeoutMs: 120000
       - kind: shell
         options:
           command: >-
-            mkdir -p .spur/run &&
-            set +e &&
-            $spurBin task check $wbs; check_rc=$?;
-            $spurBin agent doctor $agent; doctor_rc=$?;
-            set -e &&
-            if [ "$check_rc" -eq 0 ] && [ "$doctor_rc" -eq 0 ]; then
-              printf 'PASS\n' > ".spur/run/$wbs-docs-precheck.status";
-            else
-              printf 'FAIL\n' > ".spur/run/$wbs-docs-precheck.status";
-            fi &&
-            exit 0
+            if test "$(cat .spur/run/$wbs-docs-precheck-task.status 2>/dev/null)" = PASS &&
+               test "$(cat .spur/run/$wbs-docs-precheck-agent.status 2>/dev/null)" = PASS;
+            then printf 'PASS\n' > ".spur/run/$wbs-docs-precheck.status";
+            else printf 'FAIL\n' > ".spur/run/$wbs-docs-precheck.status"; fi
       - kind: note
         options:
           message: "Docs pipeline start for task ${vars.wbs}."
@@ -109,6 +121,10 @@ states:
             mkdir -p .spur/run &&
             printf '%s\n' "{\"wbs\":\"$wbs\",\"verdict\":\"PASS\",\"source\":\"docs-pipeline\",\"requirements\":[{\"id\":\"docs-deliverable\",\"status\":\"MET\",\"evidence\":\"docs-pipeline record step\"}],\"acceptanceCriteria\":[],\"checks\":[{\"name\":\"docs-only\",\"status\":\"pass\",\"evidence\":\"docs-pipeline\"}]}"
             > ".spur/run/$wbs-verdict.json"
+      - kind: run.artifact
+        options:
+          path: .spur/run/${vars.wbs}-verdict.json
+          artifactKind: verify-verdict
       - kind: shell
         options:
           command: "$spurBin task update $wbs done --no-lifecycle"

package/config/workflows/feature-dev.yaml

@@ -48,6 +48,11 @@ vars:
   profile: "standard"
   spurBin: "spur"
   stepTimeoutMs: "1800000"
+  # Integration review (D5-P, feature R11). Advisory by default: a pending, timed-out, or
+  # quota-unavailable review must never block a locally-verified feature. Set
+  # requireCleanReview=true to opt into a hard gate for a branch that must ship clean.
+  baseBranch: ""
+  requireCleanReview: "false"
   # Injected by WorkflowAppService.run(); scopes .spur/run artifacts per run (0425 R4).
   __runId: ""
 
@@ -136,6 +141,35 @@ states:
       AC, traceability, and that all linked tasks are done. A clean strict check is the only
       proof the feature is shippable.
 
+  - id: integration-review
+    description: >
+      Advisory integration review (D5-P, feature R11). Runs `config/workflows/pr-review.yaml`
+      ONCE for this feature/branch HEAD, after the local gates and before wrap merge/cleanup.
+      Current-HEAD dedup stays inside pr-review (`mode: full`), so a re-entry on the same HEAD
+      is a no-op there rather than a second quota spend here.
+
+      The gate is `softFail: true`, so `pending`, a wait timeout, a missing pr-review
+      definition, or an unavailable review quota records FAIL and still reaches `done`.
+      Only `requireCleanReview=true` turns that FAIL into a blocking edge. Findings are
+      collected by pr-review itself and re-enter the affected local gates on the next run.
+    onEnter:
+      - kind: command.gate
+        options:
+          id: feature-integration-review
+          executable: "${vars.spurBin}"
+          args:
+            - workflow
+            - run
+            - .spur/workflows/pr-review.yaml
+            - --vars
+            - '{"mode":"full","baseBranch":"${vars.baseBranch}"}'
+          resultFile: .spur/run/${vars.__runId}-integration-review.status
+          softFail: true
+          timeoutMs: 1800000
+      - kind: note
+        options:
+          message: "Integration review for feature ${vars.featureId} recorded at .spur/run/${vars.__runId}-integration-review.status (advisory unless requireCleanReview=true)."
+
   - id: done
     description: Terminal — feature planned, all tasks executed, and the feature verified.
     # Checkpoint write: record session state for resume (Phase 4, task 0171 R3)
@@ -195,12 +229,30 @@ transitions:
   # ── feature-verify gate: strict check certifies done, else fail ──
   # Declaration order: the pass guard is tried FIRST.
   - from: feature-verify
-    to: done
-    description: Strict feature check passed — the feature is complete.
+    to: integration-review
+    description: Strict feature check passed — spend one integration review on this stable HEAD.
     guard:
       kind: shell
       options:
         command: "$spurBin feature check $featureId --strict"
+
+  - from: integration-review
+    to: failed
+    description: >
+      Review came back FAIL and this branch opted into a hard gate
+      (requireCleanReview=true). Ordered before the advisory edge so the strict
+      policy wins when both would match.
+    guard:
+      kind: shell
+      options:
+        command: 'test "$requireCleanReview" = true && test "$(cat .spur/run/$__runId-integration-review.status 2>/dev/null)" = FAIL'
+  - from: integration-review
+    to: done
+    description: >
+      Review clean, pending, unavailable, or advisory — the feature is complete. A
+      non-clean advisory review never blocks a locally-verified feature (feature R11).
+    guard:
+      kind: always
   - from: feature-verify
     to: failed
     description: Strict feature check failed — block before done; investigate incomplete tasks or AC.

package/config/workflows/idea-pipeline.yaml

@@ -379,9 +379,20 @@ states:
       # flipping the recommendation to runall — violating R3's any-fail=>refineall invariant.
       # Each `jq -c … >> "$CHECKS"` appends under `|| exit 1`, and a row-count assertion
       # (CHECKS lines == WBS count) gates the recommendation computation.
+      # D5-O (R4): the deterministic writer owns finalization wherever it exists.
+      # `idea-handoff-cli.ts` calls the tested `finalizeIdeaHandoff` capability and
+      # implements this exact contract (equal-length/unique-name zip, `spur task deps`,
+      # `spur feature refresh`, per-task check with a row-count assertion, and a single
+      # recommended next command). `spur init` never scaffolds `packages/`, so seeded
+      # projects fall through to the portable shell program below — the same
+      # monorepo-writer/shell-fallback split the wrap-up metrics hop uses (0604 Q&A).
       - kind: shell
         options:
           command: >-
+            if [ -f packages/app/src/workflow/idea-handoff-cli.ts ]; then
+              bun packages/app/src/workflow/idea-handoff-cli.ts;
+              exit $?;
+            fi;
             BATCH=".spur/run/$__runId-idea-task-batch.json" &&
             RESULT=".spur/run/$__runId-idea-batch-create-result.json" &&
             ORDER=".spur/run/$__runId-idea-task-order.json" &&
@@ -452,6 +463,10 @@ states:
       - kind: note
         options:
           message: "Idea pipeline handoff. Feature: ${vars.featureId}. See .spur/run/${vars.__runId}-idea-handoff.md for the created task list and recommended next command."
+      - kind: run.artifact
+        options:
+          path: .spur/run/${vars.__runId}-idea-handoff.md
+          artifactKind: idea-handoff
       # Checkpoint write: record session state for resume (Phase 4, task 0171 R3)
       - kind: shell
         options:

package/config/workflows/task-pipeline.yaml

@@ -78,6 +78,15 @@ vars:
   # Answer captured by the approve gate's hitl.confirm (R1): "yes" | "no" | "cancel".
   # Empty by default; only meaningful once the approve state has been entered.
   __hitlAnswer: ""
+  # Proof-state bracket (task 0612, ADR-071). `proofDigest` is captured at verify-exit, once the
+  # verdict artifact exists; `proofDigestNow` is the re-capture compared against it immediately
+  # before `record`. A mismatch means a proof input changed after the verdict was established, so
+  # the run routes to `failed` instead of crossing the completion boundary. `taskSpecPath` carries
+  # the task file path because `docs/tasks*` is excluded from the digest's git-tree half — spec
+  # content is folded in explicitly or a task-file edit would go undetected.
+  proofDigest: ""
+  proofDigestNow: ""
+  taskSpecPath: ""
   # Project quality gate for the `test` hop (probe + fixall + recheck). Override per project
   # with the same package-manager surface (this monorepo is Bun-only):
   # `--vars '{"qualityGateCmd":"bun run lint && bun run test"}'`. Soft probe, hard recheck,
@@ -124,72 +133,33 @@ states:
       `spur task check <wbs>`. Failures route to the `failed` terminal state
       (not a raw lifecycle abort mid-enter).
     onEnter:
-      # Soft doctor — write status and always exit 0 so transitions can branch to
-      # `failed` cleanly (same pattern as the quality-gate soft probe).
+      # Pre-launch executor doctor probe (task 0608 / D6 R4–R5). The auth classifier —
+      # per-agent-family classification (omp/pi env-key misses soft, explicit auth
+      # failures hard) plus the executor-divergence line — now lives in the
+      # `doctor.probe` built-in action kind (`packages/app/src/workflow/actions/doctor-probe.ts`)
+      # instead of this shell program; that is the ownership-surface landing for the
+      # task-pipeline precheck doctor probe (option c, least-privilege built-in).
       #
-      # R2 (0487): probe BOTH resolved executors ($agent and $implementAgent) and
-      # FAIL on `authenticated: unauthenticated`. Previously only $agent was probed
-      # and auth was informational, so a run whose implement executor had no
-      # provider key sailed through precheck into a guaranteed implement failure
-      # (runs e8cb00e7 / b16bfbf4: "auth: no … API key not found for provider
-      # 'volc'" → precheck ✓). `unknown` auth keeps the old soft behavior — some
-      # agents expose no auth-status verb. `spur agent doctor` CLI exit-code
-      # semantics are deliberately untouched; the gate lives here.
-      # R4 (0487): one divergence line when the two executors differ (legitimate
-      # when only implementAgent is pinned, but it must be visible in the log).
-      # R2 (0503): omp/pi env-key probe misses are soft because the CLI process
-      # cannot see relay-owned credentials; explicit non-omp auth failures remain hard.
-      - kind: shell
+      # Semantics preserved from the replaced shell (behavior parity is covered by
+      # `packages/app/tests/workflow/actions/doctor-probe.test.ts`):
+      #   R2 (0487): probe BOTH resolved executors ($agent and $implementAgent) and
+      #   FAIL on `authenticated: unauthenticated`. Previously only $agent was probed
+      #   and auth was informational, so a run whose implement executor had no
+      #   provider key sailed through precheck into a guaranteed implement failure
+      #   (runs e8cb00e7 / b16bfbf4). `unknown` auth keeps the old soft behavior —
+      #   some agents expose no auth-status verb. `spur agent doctor` CLI exit-code
+      #   semantics are deliberately untouched; the gate lives here.
+      #   R4 (0487): one divergence line when the two executors differ.
+      #   R2 (0503): omp/pi env-key probe misses are soft because the CLI process
+      #   cannot see relay-owned credentials; explicit non-omp auth failures remain hard.
+      # Soft probe: writes PASS/FAIL to the status file and always succeeds so the
+      # transition guards below route on the token (never a raw lifecycle abort).
+      - kind: doctor.probe
         options:
-          command: >-
-            mkdir -p .spur/run &&
-            DOCTOR_FILE=".spur/run/$wbs-precheck-doctor.status" &&
-            classifyDoctorProbe() {
-              PROBE_DETAIL="$1";
-              PROBE_AGENT="$2";
-              case "$PROBE_AGENT" in
-                omp|omp-*|pi|pi-*)
-                  if printf '%s' "$PROBE_DETAIL" | grep -Eiq 'API key not found for provider|no probe registered'; then
-                    printf 'env-miss\n';
-                    return;
-                  fi;;
-              esac;
-              if printf '%s' "$PROBE_DETAIL" | grep -Eiq 'invalid (API )?key|unauthori[sz]ed|forbidden|authentication failed|credential(s)? rejected'; then
-                printf 'auth-fail\n';
-              else
-                printf 'unknown\n';
-              fi;
-            } &&
-            STATUS=PASS;
-            if [ -n "$implementAgent" ] && [ "$implementAgent" != "$agent" ]; then
-              echo "precheck: agent=$agent implementAgent=$implementAgent (executors diverge)";
-              EXECS="$agent $implementAgent";
-            else
-              EXECS="$agent";
-            fi;
-            for EXE in $EXECS; do
-              OUT=$($spurBin agent doctor "$EXE" --json 2>&1) || {
-                echo "precheck: FAIL - doctor exited non-zero for $EXE";
-                echo "$OUT";
-                STATUS=FAIL;
-                continue;
-              };
-              AUTH=$(printf '%s' "$OUT" | jq -r '.agents[0].authenticated // "unknown"' 2>/dev/null || echo unknown);
-              DETAIL=$(printf '%s' "$OUT" | jq -r '.agents[0].modelStatus.detail // ""' 2>/dev/null || echo "");
-              PROBE=$(classifyDoctorProbe "$DETAIL" "$EXE");
-              echo "precheck: $EXE auth=$AUTH probe=$PROBE $DETAIL";
-              if [ "$AUTH" = unauthenticated ]; then
-                case "$EXE:$PROBE" in
-                  omp*:env-miss|pi*:env-miss|omp*:unknown|pi*:unknown)
-                    echo "precheck: SOFT - executor $EXE auth probe cannot see agent-owned credentials";;
-                  *)
-                    echo "precheck: FAIL - executor $EXE is unauthenticated; fix agent.default or pass --vars '{\"agent\":\"<authenticated-executor>\"}' ($spurBin agent doctor $EXE --json); $DETAIL";
-                    STATUS=FAIL;;
-                esac;
-              fi;
-            done;
-            echo "$STATUS" > "$DOCTOR_FILE";
-            exit 0
+          resultFile: ".spur/run/${vars.wbs}-precheck-doctor.status"
+          spurBin: "${vars.spurBin}"
+          agent: "${vars.agent}"
+          implementAgent: "${vars.implementAgent}"
       # R6 (0487): pre-launch hygiene WARNING (never a block) — starting a task on
       # a tree already dirty with another task's implementation is how 0485's diff
       # got swept into 0486's run. Corpus dirs are excluded: the pipeline writes
@@ -245,9 +215,14 @@ states:
           command: >-
             SIZE_FILE=".spur/run/$wbs-precheck-size.status" &&
             mkdir -p .spur/run &&
+            if [ -f plugins/sp/scripts/task-size-precheck.ts ]; then
             bun plugins/sp/scripts/task-size-precheck.ts "$wbs"
             --spur-bin "$spurBin" --max-reqs "$maxImplementReqs" --max-plan-items "$maxImplementPlanItems"
-            --executor "$implementAgent" &&
+            --executor "$implementAgent";
+            else
+              echo "task-size-precheck skipped — plugins/sp/scripts/task-size-precheck.ts not present in project." >&2 &&
+              echo "PASS" > "$SIZE_FILE";
+            fi &&
             exit 0
 
   - id: implement
@@ -486,6 +461,27 @@ states:
       - kind: shell
         options:
           command: "$spurBin task verdict $wbs --from-answer .spur/run/$wbs-verify-answer.txt"
+      # Proof-state capture (task 0612, ADR-071). Placement is load-bearing: AFTER the verdict
+      # artifact exists, never before `verify`. `/sp:dev-verify --fix all` writes to the tree by
+      # design when it repairs a row, so an earlier capture would fire on verify's own legitimate
+      # repairs instead of on a violation.
+      - kind: shell
+        options:
+          command: '$spurBin task path $wbs --json 2>/dev/null | jq -r ".path // empty" > ".spur/run/$wbs-taskpath.txt" || true; exit 0'
+      - kind: file.read.into-var
+        options:
+          path: .spur/run/${vars.wbs}-taskpath.txt
+          var: taskSpecPath
+      - kind: proof.fingerprint
+        options:
+          var: proofDigest
+          taskFile: ${vars.taskSpecPath}
+      # R3: the evidence must NAME the digest, not just assert proof validity in prose. Stamp it
+      # into the verdict artifact's checks[] so the document that aggregates quality, review, and
+      # verification results carries the value `record`'s compare then proves unchanged.
+      - kind: shell
+        options:
+          command: 'V=".spur/run/$wbs-verdict.json"; if [ -f "$V" ] && [ -n "$proofDigest" ]; then jq --arg d "$proofDigest" ".checks += [{\"name\":\"proof-input-digest\",\"status\":\"pass\",\"evidence\":\$d}]" "$V" > "$V.tmp" && mv "$V.tmp" "$V"; fi; exit 0'
 
   - id: record
     description: >
@@ -496,6 +492,15 @@ states:
       retry-suppression) if `feature_id` is present, or appends an orphan link proposal
       to the run report if absent (task 0328 / ADR-0322).
     onEnter:
+      # Proof-state compare (task 0612, ADR-071) — FIRST action in the state, so it runs before any
+      # record write. Re-captures the digest and asserts it equals the value taken at verify-exit.
+      # A mismatch means a proof input changed after the verdict was established; the default `fail`
+      # policy halts the sequence and routes the run to `failed` rather than crossing into `record`.
+      - kind: proof.fingerprint
+        options:
+          var: proofDigestNow
+          taskFile: ${vars.taskSpecPath}
+          expect: ${vars.proofDigest}
       - kind: shell
         options:
           command: >-
@@ -558,6 +563,13 @@ states:
               return "$RETRY_RC";
             };
             retry_transient $spurBin task update "$wbs" done --no-lifecycle
+      # D5-L: the verify verdict is this pipeline's proof of completion, so its ownership
+      # belongs to a deterministic primitive rather than an untracked file on disk.
+      # `run.artifact` records path + kind + runId only — never the body (ADR-069).
+      - kind: run.artifact
+        options:
+          path: .spur/run/${vars.wbs}-verdict.json
+          artifactKind: verify-verdict
       - kind: note
         options:
           message: "Pipeline complete for task ${vars.wbs} (done gate cleared)."

package/config/workflows/wrapup-pipeline.yaml

@@ -7,7 +7,7 @@
 # apply identically. Branch cleanup is an irreversible HITL gate — it always pauses,
 # even under --auto (Iron Law #6: irreversible action -> surface to human).
 #
-# Shape: start -> task-resolve -> doc-sync -> learning-capture -> metrics-record
+# Shape: start -> task-resolve -> doc-sync -> metrics-record
 #          -> feature-transition (conditional: if vars.feature set)
 #          -> branch-cleanup (conditional: if vars.merge=true)
 #          -> done
@@ -25,8 +25,10 @@
 # Reliability (aligned with task-pipeline / ADR-043):
 #   - Prefer pure slash commands when a command exists; free-form inputs remain only
 #     where capture artifacts (answerFile) have no dedicated slash surface yet.
-#   - learning-capture / metrics-record use expectFile + soft append (empty capture
-#     does not abort wrap-up after prior steps already landed).
+#   - doc-sync / metrics-record use expectFile + soft append (empty capture
+#     does not abort wrap-up after prior steps already landed). The doc-sync hop is a
+#     single model query that both repairs doc drift (sp:doc-evolve) and captures
+#     working learnings (task 0607 R2 — one query answers both; count 2 -> 1).
 #   - feature-transition is a soft shell (always exit 0) so a blocked feature sync
 #     does not abort wrap-up after learnings/metrics already landed.
 #   - branch-cleanup HITL is exhaustive (yes/no/cancel → done; missing answer defense).
@@ -35,7 +37,7 @@
 "$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
 kind: state-machine
 name: wrapup-pipeline
-description: "Post-execution wrap-up: doc-sync, learning-capture, metrics, feature-transition, branch-cleanup"
+description: "Post-execution wrap-up: doc-sync (doc drift + learning capture), metrics, feature-transition, branch-cleanup"
 iterationBound: 10
 initialState: start
 terminalStates:
@@ -73,28 +75,24 @@ states:
 
   - id: doc-sync
     description: >
-      Project-level doc drift repair for the batch (04_DESIGN, 03_ARCHITECTURE,
-      00_ADR, docs/design/*). No dedicated slash command yet — free-form skill
-      pointer until a /sp:doc-evolve command exists (ADR-043 residual).
+      ONE model query that both repairs project-level doc drift for the batch
+      (04_DESIGN, 03_ARCHITECTURE, 00_ADR, docs/design/*) and captures working
+      learnings (task 0607 R2: two adjacent agent.run hops merged, count 2 -> 1;
+      no operator-decision pause or verdict boundary sits between them). No dedicated
+      slash command yet — free-form skill pointer until a /sp:doc-evolve command
+      exists (ADR-043 residual). Capture+shell decoupling preserved: expectFile gates
+      a non-empty capture before the append; append is best-effort soft (empty capture
+      skips without aborting wrap-up).
     onEnter:
       - kind: agent.run
         options:
           agent: ${vars.agent}
-          input: 'Skill(skill="sp:doc-evolve", args="wrapup tasks=${vars.tasks}"). Repair drift in docs/00_ADR.md, docs/03_ARCHITECTURE.md, docs/04_DESIGN.md, docs/design/* per constitution edit rules. Do not write task/feature corpus.'
-          # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
-          role: coder
-          timeoutMs: ${vars.stepTimeoutMs}
-
-  - id: learning-capture
-    description: >
-      Append working learnings to .spur/memory/learnings.md. Capture+shell decoupling:
-      expectFile gates non-empty capture before append; append is best-effort soft
-      (empty capture skips without aborting wrap-up).
-    onEnter:
-      - kind: agent.run
-        options:
-          agent: ${vars.agent}
-          input: "Extract working learnings from tasks ${vars.tasks}. Output raw markdown (no fences) grouped by date and task WBS: conventions, errors fixed, patterns, gotchas. Captured to .spur/run/wrapup-learnings.md."
+          input: >-
+            First run Skill(skill="sp:doc-evolve", args="wrapup tasks=${vars.tasks}") to repair drift in
+            docs/00_ADR.md, docs/03_ARCHITECTURE.md, docs/04_DESIGN.md, docs/design/* per constitution edit
+            rules; do not write task/feature corpus. THEN extract working learnings from tasks ${vars.tasks} —
+            conventions, errors fixed, patterns, gotchas, grouped by date and task WBS — as raw markdown
+            (no fences) and END your final message with that markdown (it is captured to .spur/run/wrapup-learnings.md).
           # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
           role: coder
           answerFile: .spur/run/wrapup-learnings.md
@@ -114,27 +112,29 @@ states:
 
   - id: metrics-record
     description: >
-      Append one JSONL row per task to .spur/memory/wrapup-metrics.jsonl. Soft append
-      (empty capture does not abort wrap-up after learnings already landed).
+      Append one JSONL row per task to .spur/memory/wrapup-metrics.jsonl deterministically.
     onEnter:
-      - kind: agent.run
-        options:
-          agent: ${vars.agent}
-          input: "For each task in ${vars.tasks}, output one JSONL line (no fences) with fields: wbs, feature_id, status, verdict, timestamp. Captured to .spur/run/wrapup-metrics.jsonl."
-          # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
-          role: scribe
-          answerFile: .spur/run/wrapup-metrics.jsonl
-          expectFile: .spur/run/wrapup-metrics.jsonl
-          timeoutMs: ${vars.stepTimeoutMs}
       - kind: shell
         options:
           command: >-
             mkdir -p .spur/memory &&
-            if test -s .spur/run/wrapup-metrics.jsonl; then
-              cat .spur/run/wrapup-metrics.jsonl >> .spur/memory/wrapup-metrics.jsonl;
-            else
-              echo "wrapup: metrics capture missing or empty at $PWD/.spur/run/wrapup-metrics.jsonl - append skipped" >&2;
-            fi &&
+            printf '%s' "$tasks" | jq -r '(if type == "string" then (try fromjson catch .) else . end) | if type == "array" then .[] else empty end' |
+            while IFS= read -r wbs; do
+              if [ -n "$wbs" ]; then
+                task_json=$($spurBin task show "$wbs" --json 2>/dev/null || true);
+                if [ -n "$task_json" ]; then
+                  feat=$(printf '%s' "$task_json" | jq -r '.frontmatter.feature_id // .feature_id // empty' 2>/dev/null || true);
+                  stat=$(printf '%s' "$task_json" | jq -r '.frontmatter.status // .status // "unknown"' 2>/dev/null || true);
+                  verdict="UNKNOWN";
+                  if [ -f ".spur/run/$wbs-verdict.json" ]; then
+                    v=$(jq -r '.verdict // "UNKNOWN"' ".spur/run/$wbs-verdict.json" 2>/dev/null || true);
+                    if [ -n "$v" ]; then verdict="$v"; fi;
+                  fi;
+                  ts=$(date -u +"%Y-%m-%dT%H:%M:%SZ");
+                  printf '{"wbs":"%s","feature_id":"%s","status":"%s","verdict":"%s","timestamp":"%s"}\n' "$wbs" "$feat" "$stat" "$verdict" "$ts" >> .spur/memory/wrapup-metrics.jsonl;
+                fi;
+              fi;
+            done &&
             exit 0
 
   - id: feature-transition
@@ -226,15 +226,10 @@ transitions:
     guard:
       kind: always
 
-  # ── linear body: doc-sync -> learning-capture -> metrics-record ──
+  # ── linear body: doc-sync -> metrics-record ──
   - from: doc-sync
-    to: learning-capture
-    description: Doc sync complete — capture learnings.
-    guard:
-      kind: always
-  - from: learning-capture
     to: metrics-record
-    description: Learnings captured — record metrics.
+    description: Doc drift repair + learning capture complete — record metrics.
     guard:
       kind: always
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.3.53",
+    "version": "0.3.55",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",
@@ -53,14 +53,14 @@
     },
     "devDependencies": {
         "@commander-js/extra-typings": "^14.0.0",
-        "@gobing-ai/ts-db": "^0.4.38",
-        "@gobing-ai/ts-ai-runner": "^0.4.38",
-        "@gobing-ai/ts-dual-workflow-engine": "^0.4.38",
-        "@gobing-ai/ts-infra": "^0.4.38",
-        "@gobing-ai/ts-llm-jsonl-importer": "^0.4.38",
-        "@gobing-ai/ts-rule-engine": "^0.4.38",
-        "@gobing-ai/ts-runtime": "^0.4.38",
-        "@gobing-ai/ts-utils": "^0.4.38",
+        "@gobing-ai/ts-db": "^0.4.39",
+        "@gobing-ai/ts-ai-runner": "^0.4.39",
+        "@gobing-ai/ts-dual-workflow-engine": "^0.4.39",
+        "@gobing-ai/ts-infra": "^0.4.39",
+        "@gobing-ai/ts-llm-jsonl-importer": "^0.4.39",
+        "@gobing-ai/ts-rule-engine": "^0.4.39",
+        "@gobing-ai/ts-runtime": "^0.4.39",
+        "@gobing-ai/ts-utils": "^0.4.39",
         "@types/bun": "1.3.14",
         "@types/figlet": "^1.7.0",
         "@types/node-notifier": "8.0.5",

package/plugins/README.md

@@ -359,8 +359,8 @@ Each pipeline owns one lifecycle phase:
 | `basic.yaml`             | Generic implement/check/fix       | direct `spur workflow run`        | existing      |
 | `feature-lifecycle.yaml` | Feature status FSM                | `spur feature update`             | existing      |
 | `task-lifecycle.yaml`    | Task status FSM                   | `spur task update`                | existing      |
-| `planning-pipeline.yaml` | Planning/design from known slug   | `/sp:dev-plan`                    | existing      |
 | `task-pipeline.yaml`     | Single-task execution             | `/sp:dev-run`                     | existing      |
+| `idea-pipeline.yaml`     | Idea/planning → feature + tasks   | `/sp:dev-idea`, `/sp:dev-plan`    | existing      |
 | `feature-dev.yaml`       | Feature umbrella execution        | `/sp:dev-runall --feature <id>`   | existing      |
 | `idea-pipeline.yaml`     | Idea to feature + AC + task batch | `/sp:dev-idea`                    | new in 0.2.12 |
 | `wrapup-pipeline.yaml`   | Post-execution wrap-up            | `/sp:dev-wrap`, `/sp:dev-wrapall` | new in 0.2.12 |

package/plugins/sp/README.md

@@ -360,8 +360,8 @@ no per-platform artifacts — only the platform-independent thin wrappers.
 **Thin-wrapper contract** is enforced by `scripts/validate-commands.ts`:
 
 ```bash
-bun plugins/sp/scripts/validate-commands.ts            # validate all 39 commands
-bun plugins/sp/scripts/validate-commands.ts --json     # machine-readable output
+bun run validate-commands            # validate all 39 commands
+bun run validate-commands --json     # machine-readable output
 ```
 
 The validator checks five gates. For **non-`dev-*`** commands: (a) heading whitelist — only
@@ -583,8 +583,8 @@ pipeline owns one lifecycle phase:
 | `basic.yaml`                | Generic implement/check/fix       | direct `spur workflow run`        |
 | `feature-lifecycle.yaml`    | Feature status FSM                | `spur feature update`             |
 | `task-lifecycle.yaml`       | Task status FSM                   | `spur task update`                |
-| `planning-pipeline.yaml`    | Planning/design from known slug   | `/sp:dev-plan`                    |
 | `task-pipeline.yaml`        | Single-task execution             | `/sp:dev-run`                     |
+| `idea-pipeline.yaml`        | Idea/planning → feature + tasks   | `/sp:dev-idea`, `/sp:dev-plan`    |
 | `feature-dev.yaml`          | Feature umbrella execution        | `/sp:dev-runall --feature`        |
 | `idea-pipeline.yaml`        | Idea to feature + AC + task batch | `/sp:dev-idea`                    |
 | `wrapup-pipeline.yaml`      | Post-execution wrap-up            | `/sp:dev-wrap`, `/sp:dev-wrapall` |

package/plugins/sp/agents/super-planner.md

@@ -153,7 +153,7 @@ When you fan out or dispatch a subagent, apply the four disciplines the SSOT
 - [ ] Drive the loop in execution-batch.md - resolve -> freeze -> order -> **preflight** -> run -> inspect
       -> optional recovery -> decide -> report.
 - [ ] **Preflight** each WBS before `workflow run` using
-      `bun plugins/sp/scripts/batch-preflight.ts` (or the pure `preflightTask` helper) with
+      `node "$(superskill script path sp batch-preflight.mjs)"` (or the pure `preflightTask` helper) with
       `spur task show --json` deps. On `action: skip` (A2/A7/A8/A9), do **not** start the pipeline;
       record skip in the batch report with the reason string.
 - [ ] Launch each **ready** per-task pipeline with `--async`. The command/script layer polls

package/plugins/sp/commands/dev-daily.md

@@ -27,4 +27,4 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 ## Implementation
 
-Run the generator per [daily-summary/SKILL.md](../skills/daily-summary/SKILL.md): `bun plugins/sp/scripts/daily-summary/daily-summary.ts $ARGUMENTS`.
+Run the generator per [daily-summary/SKILL.md](../skills/daily-summary/SKILL.md): `node "$(superskill script path sp daily-summary/daily-summary.mjs)" $ARGUMENTS`.

package/plugins/sp/commands/dev-history-load.md

@@ -59,5 +59,5 @@ Run the load-then-analyze sequence per `plugins/sp/scripts/history-load.ts` —
 only after import exits 0, narrowing forwarded to `analyze` only:
 
 ```
-bun plugins/sp/scripts/history-load.ts $ARGUMENTS
+node "$(superskill script path sp history-load.mjs)" $ARGUMENTS
 ```

package/plugins/sp/commands/dev-idea.md

@@ -1,7 +1,7 @@
 ---
 description: Turn a vague idea into a feature with AC and a decomposed task batch — discovery, idea-eval, feature-create, AC, feature-check, system-design, decompose, batch-create (Design by default), handoff
 role: planner
-argument-hint: "\"<idea>\" [--auto] [--skip-design] [--approve-taste]"
+argument-hint: "\"<idea>\" [--auto] [--skip-design] [--approve-taste] [--agent <inline|auto|name>]"
 allowed-tools: ["Bash", "Read", "AskUserQuestion"]
 ---
 
@@ -19,6 +19,7 @@ Wraps the **idea-pipeline.yaml** workflow.
 | `--approve-taste` | With `--auto`: set idea_approved + design_approved so idea-eval / design-approval do not pause. | off |
 | `--idea-approved` | Compatibility alias for idea_approved=true (subset of --approve-taste). | off |
 | `--design-approved` | Compatibility alias for design_approved=true (subset of --approve-taste). | off |
+| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing ideation. The pipeline's `agent.run` stages are headless — they always dispatch a subprocess, so `--agent inline` is rejected there with the stable special error (exit 2). Use `omit` (resolves to `agent.default`), `auto` (tier-resolves an executor), or a name (pins that executor). | agent.default |
 
 For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag-glossary.md).
 
@@ -29,6 +30,7 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
   [--auto]              # skip objective HITL only (feature-check, batch-create)
   [--skip-design]       # design package off (system-design + task Design)
   [--approve-taste]     # with --auto: skip idea-eval + design-approval pauses
+  [--agent <inline|auto|name>]   # who runs the model-bearing ideation (default: agent.default)
 ```
 
 There is **no** `--design` force flag. Design is default-on; only `--skip-design` opts out.
@@ -46,6 +48,12 @@ spur workflow run .spur/workflows/idea-pipeline.yaml --vars '{
   "profile":"interactive|auto",
   "design":"auto|skip",
   "design_approved":"false|true",
-  "idea_approved":"false|true"
+  "idea_approved":"false|true",
+  "agent":"<executor-or-role>"
 }'
 ```
+
+Omit `agent` from `--vars` unless the operator passed `--agent`: an absent var lets `agent.default`
+(a Layer-1 role, resolved to its tier's cheapest usable executor) govern, which is the intended
+routing. Passing `--agent <name>` pins that executor for every `agent.run` stage — the escape hatch
+when the resolved executor is unusable (quota exhaustion, auth failure).