@gobing-ai/spur 0.3.60 → 0.3.61

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.3.60",
+            "version": "0.3.61",
             "source": "./plugins/sp"
         }
     ]

package/config/config.example.yaml

@@ -4,11 +4,11 @@
 # Copy / adapt into a project as `.spur/config.yaml`.
 
 $schema: "@gobing-ai/spur/schemas/spur-config.schema.json"
-# Config schema version (string). Current recommended: "1.1".
+# Config schema version (string). Current recommended: "1.2".
 # "1" remains accepted; there is no hard migrator yet. Prefer "1.1" for
 # new projects so editors and operators know the file targets the ADR-033
 # + planning shape.
-version: "1.1"
+version: "1.2"
 name: my-project
 
 # ── Portable bootstrap (consumed by @gobing-ai/ts-infra

package/config/config.global.yaml

@@ -18,6 +18,10 @@
 
 $schema: "@gobing-ai/spur/schemas/spur-config.schema.json"
 
+# Inert label (task 0649 R6 ruling): nothing branches on `version` today.
+# Reunified at "1.2" across every shipped artifact (init stamp, JSON Schema).
+version: "1.2"
+
 agent:
     # `default` is the role used for `--agent auto` when the caller declares
     # nothing (task 0542 R2 — the value domain moved from executor names to
@@ -124,10 +128,10 @@ agent:
 # `workflows.paths` is deliberately NOT set here. Its values are search paths
 # resolved against a project's own root (0639 classifies it project-relative), so
 # a machine-wide value would point every project at a directory that mostly does
-# not exist. The global workflow tree is already reachable without it: the
-# lifecycle adapter resolves bundled → project `.spur/workflows/` →
-# `~/.config/spur/workflows/` on its own (make-lifecycle-adapter.ts:44).
-# Set it per project when a project keeps workflows somewhere non-standard.
-# workflows:
-#     paths:
-#         - .spur/workflows/
+# not exist. The key is present (the A4 goal names it among the shipped global
+# defaults) but empty: `workflow list` falls back to default `.spur/workflows/`
+# discovery, and the lifecycle adapter resolves bundled → project
+# `.spur/workflows/` on its own (make-lifecycle-adapter.ts:24, two tiers since
+# task 0648). Set paths per project when a project keeps workflows somewhere
+# non-standard.
+workflows: {}

package/config/corpus-baseline.json

@@ -447,6 +447,102 @@
             "reason": "Accepted backlog: L4.orphan-scenarios",
             "since": "2026-08-19"
         },
+        {
+            "kind": "feature",
+            "id": "B1",
+            "code": "L4.dogfood-missing",
+            "severity": "warning",
+            "reason": "Feature remains verifying; direct linked tasks touch self-referential workflow infrastructure, but no dogfood report exists. Accepted as pre-A4 corpus debt only; the strict feature completion gate still requires real dogfood evidence.",
+            "since": "2026-08-24"
+        },
+        {
+            "kind": "feature",
+            "id": "B3",
+            "code": "L4.dogfood-missing",
+            "severity": "warning",
+            "reason": "Feature remains verifying; direct linked tasks touch self-referential workflow infrastructure, but no dogfood report exists. Accepted as pre-A4 corpus debt only; the strict feature completion gate still requires real dogfood evidence.",
+            "since": "2026-08-24"
+        },
+        {
+            "kind": "feature",
+            "id": "E5",
+            "code": "L4.dogfood-missing",
+            "severity": "warning",
+            "reason": "Feature remains verifying; direct linked tasks touch self-referential workflow infrastructure, but no dogfood report exists. Accepted as pre-A4 corpus debt only; the strict feature completion gate still requires real dogfood evidence.",
+            "since": "2026-08-24"
+        },
+        {
+            "kind": "feature",
+            "id": "F",
+            "code": "L4.dogfood-missing",
+            "severity": "warning",
+            "reason": "Feature remains verifying; direct linked tasks touch self-referential workflow infrastructure, but no dogfood report exists. Accepted as pre-A4 corpus debt only; the strict feature completion gate still requires real dogfood evidence.",
+            "since": "2026-08-24"
+        },
+        {
+            "kind": "feature",
+            "id": "F31",
+            "code": "L4.dogfood-missing",
+            "severity": "warning",
+            "reason": "Feature remains verifying; direct linked tasks touch self-referential workflow infrastructure, but no dogfood report exists. Accepted as pre-A4 corpus debt only; the strict feature completion gate still requires real dogfood evidence.",
+            "since": "2026-08-24"
+        },
+        {
+            "kind": "feature",
+            "id": "F82",
+            "code": "L4.dogfood-missing",
+            "severity": "warning",
+            "reason": "Feature remains verifying; direct linked tasks touch self-referential workflow infrastructure, but no dogfood report exists. Accepted as pre-A4 corpus debt only; the strict feature completion gate still requires real dogfood evidence.",
+            "since": "2026-08-24"
+        },
+        {
+            "kind": "feature",
+            "id": "G4",
+            "code": "L4.dogfood-missing",
+            "severity": "warning",
+            "reason": "Feature remains verifying; direct linked tasks touch self-referential workflow infrastructure, but no dogfood report exists. Accepted as pre-A4 corpus debt only; the strict feature completion gate still requires real dogfood evidence.",
+            "since": "2026-08-24"
+        },
+        {
+            "kind": "feature",
+            "id": "H11",
+            "code": "L4.dogfood-missing",
+            "severity": "warning",
+            "reason": "Feature remains verifying; direct linked tasks touch self-referential workflow infrastructure, but no dogfood report exists. Accepted as pre-A4 corpus debt only; the strict feature completion gate still requires real dogfood evidence.",
+            "since": "2026-08-24"
+        },
+        {
+            "kind": "feature",
+            "id": "I",
+            "code": "L4.dogfood-missing",
+            "severity": "warning",
+            "reason": "Feature remains verifying; direct linked tasks touch self-referential workflow infrastructure, but no dogfood report exists. Accepted as pre-A4 corpus debt only; the strict feature completion gate still requires real dogfood evidence.",
+            "since": "2026-08-24"
+        },
+        {
+            "kind": "feature",
+            "id": "I4",
+            "code": "L4.dogfood-missing",
+            "severity": "warning",
+            "reason": "Feature remains verifying; direct linked tasks touch self-referential workflow infrastructure, but no dogfood report exists. Accepted as pre-A4 corpus debt only; the strict feature completion gate still requires real dogfood evidence.",
+            "since": "2026-08-24"
+        },
+        {
+            "kind": "feature",
+            "id": "I5",
+            "code": "L4.dogfood-missing",
+            "severity": "warning",
+            "reason": "Feature remains verifying; direct linked tasks touch self-referential workflow infrastructure, but no dogfood report exists. Accepted as pre-A4 corpus debt only; the strict feature completion gate still requires real dogfood evidence.",
+            "since": "2026-08-24"
+        },
+        {
+            "kind": "feature",
+            "id": "J",
+            "code": "L4.dogfood-missing",
+            "severity": "warning",
+            "reason": "Feature remains verifying; direct linked tasks touch self-referential workflow infrastructure, but no dogfood report exists. Accepted as pre-A4 corpus debt only; the strict feature completion gate still requires real dogfood evidence.",
+            "since": "2026-08-24"
+        },
         {
             "kind": "task",
             "id": "0001",
@@ -12213,14 +12309,6 @@
             "reason": "Accumulated anchor drift, surfaced for the first time by task 0583's content-matching rule. The cited lines resolve and are in bounds, but no longer name the requirement row's subject — a later task edited the file and pushed the anchor onto unrelated code. Spot-verified true positives (an import block cited for a component's hooks; a severity-parsing block cited for `runL4Rollup`). Repairing 1,300+ historical citations is its own campaign; the rule ships at warning severity until then (0583 R6).",
             "since": "2026-08-18"
         },
-        {
-            "kind": "task",
-            "id": "0416",
-            "code": "L4.stale-line-anchor",
-            "severity": "warning",
-            "reason": "Anchor written with an incomplete path; qualification migration (task 0583) owns the mechanical repair — see note § L4.stale-line-anchor.",
-            "since": "2026-08-17"
-        },
         {
             "kind": "task",
             "id": "0416",

package/config/workflow-composition-baseline.json

@@ -719,7 +719,7 @@
                 },
                 "collect:onEnter:1": {
                     "kind": "shell",
-                    "invocation": "$spurBin workflow validate .spur/workflows/wayfinder-resolution.yaml > .spur/run/wayfinder/$wbs-workflow-check.txt",
+                    "invocation": "$spurBin workflow validate wayfinder-resolution.yaml > .spur/run/wayfinder/$wbs-workflow-check.txt",
                     "stateEffect": "read",
                     "evidenceEffect": "write",
                     "disposition": "SIMPLE"

package/config/workflows/wayfinder-resolution.yaml

@@ -64,13 +64,11 @@ states:
       - kind: shell
         options:
           command: "mkdir -p .spur/run/wayfinder && $spurBin task show $wbs --json > .spur/run/wayfinder/$wbs-input.json"
-      # `.spur/workflows/` is the runtime read path in every layout — a symlink to
-      # config/workflows/ inside the Spur monorepo, a real directory in a seeded
-      # project. The previous `config/workflows/…` literal only resolved in the
-      # monorepo and hard-failed `collect` anywhere else.
+      # `wayfinder-resolution.yaml` uses the project→bundled resolver (tasks 0648/0650):
+      # a bare name falls back to the bundled tree; an explicit project path wins.
       - kind: shell
         options:
-          command: "$spurBin workflow validate .spur/workflows/wayfinder-resolution.yaml > .spur/run/wayfinder/$wbs-workflow-check.txt"
+          command: "$spurBin workflow validate wayfinder-resolution.yaml > .spur/run/wayfinder/$wbs-workflow-check.txt"
       - kind: shell
         options:
           command: "$spurBin task check $wbs > .spur/run/wayfinder/$wbs-precheck.txt"
@@ -112,7 +110,7 @@ states:
     onEnter:
       - kind: shell
         options:
-          command: 'rm -f .spur/run/wayfinder/$wbs-resolution-verdict.txt'
+          command: "rm -f .spur/run/wayfinder/$wbs-resolution-verdict.txt"
       - kind: agent.run
         options:
           agent: ${vars.agent}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.3.60",
+    "version": "0.3.61",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",

package/plugins/README.md

@@ -228,7 +228,7 @@ graph TB
     subgraph "Corpus Layer"
         CORPUS["docs/tasks/ + docs/features/<br/>Markdown planning corpus"]
         RULES[".spur/rules/<br/>YAML constraint rules"]
-        WFS[".spur/workflows/<br/>YAML workflow definitions"]
+        WFS["bundled workflows tree<br/>YAML workflow definitions"]
     end
 
     %% Command → Skill delegations
@@ -309,7 +309,7 @@ Tier 3 — Execution Layer (spur CLI + Guard Scripts)
 
 1. User types `/sp:dev-run 0090`
 2. **Command** delegates to `sp:spur-dev` skill (execution half)
-3. **Skill** reads the task, loads `.spur/workflows/task-pipeline.yaml`, and runs `spur workflow run` with HITL surfacing
+3. **Skill** reads the task, loads `task-pipeline.yaml`, and runs `spur workflow run` with HITL surfacing
 4. **CLI** executes the workflow engine (`@gobing-ai/ts-dual-workflow-engine`), pauses at HITL gates, persists run state
 5. Result: task driven through implement → check → fix → verify lifecycle
 
@@ -351,8 +351,9 @@ The **workflow** and **rule** engines have their own lifecycles (author → vali
 
 ## Workflow Pipelines
 
-The plugin ships workflow YAMLs under `.spur/workflows/`.
-Each pipeline owns one lifecycle phase:
+The plugin references workflow YAMLs by bare name; the CLI resolves them through the
+bundled tree (two-tier model, task 0648/0650) — a project-local override wins when
+present, otherwise the bundled copy is used. Each pipeline owns one lifecycle phase:
 
 | Workflow                 | Phase                             | Entry command                     | Status        |
 | ------------------------ | --------------------------------- | --------------------------------- | ------------- |

package/plugins/sp/README.md

@@ -509,7 +509,7 @@ graph TB
     subgraph "Corpus layer"
         CORPUS["docs/tasks/ + docs/features/<br/>markdown planning corpus"]
         RULES[".spur/rules/<br/>YAML constraint rules"]
-        WFS[".spur/workflows/<br/>YAML workflow definitions"]
+        WFS["bundled workflows tree<br/>YAML workflow definitions"]
     end
 
     CMD -->|"Skill(sp:spur-dev, ...)"| SKILL_DEV
@@ -557,7 +557,7 @@ graph TB
 
 1. User types `/sp:dev-run 0090`.
 2. **Command** delegates to `sp:spur-dev` skill (execution half).
-3. **Skill** reads the task, loads `.spur/workflows/task-pipeline.yaml`, and runs
+3. **Skill** reads the task, loads `task-pipeline.yaml`, and runs
    `spur workflow run` with HITL surfacing.
 4. **CLI** executes the workflow engine (`@gobing-ai/ts-dual-workflow-engine`), pauses at HITL gates,
    persists run state.
@@ -575,7 +575,7 @@ graph TB
 
 ### Workflow pipelines
 
-The plugin ships workflow YAMLs under `.spur/workflows/`. Each
+The plugin references workflow YAMLs by bare name; the CLI resolves them through the bundled tree (two-tier model, task 0648/0650) — project-local overrides win when present. Each
 pipeline owns one lifecycle phase:
 
 | Workflow                    | Phase                             | Entry command                     |

package/plugins/sp/agents/super-planner.md

@@ -78,7 +78,7 @@ You own the spaces **between** task runs:
 - **Preflight (Step 2.5 / 3.0)** - before each pipeline launch, evaluate TABLE A STOP rows
   (`batch-preflight.ts` or equivalent). Skip A2/A7/A8/A9; still **launch `task-pipeline.yaml`** for
   ready WBS (never substitute a `dev-next` loop for the happy path).
-- **Run each ready task** through `.spur/workflows/task-pipeline.yaml` via `spur workflow run --async`
+- **Run each ready task** through `task-pipeline.yaml` via `spur workflow run --async`
   (Step 3). The command/script layer polls `spur workflow trace` to terminal state - polling is
   transport, not planner reasoning (R3: the poll loop must not live in this agent's body; the planner
   inspects the terminal verdict, not the poll iterations). Follow the

package/plugins/sp/commands/dev-pr-review.md

@@ -31,7 +31,7 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 - Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
 - Delegate everything: `Skill(skill="sp:pr-reviewing", args="$ARGUMENTS")`. The skill owns mode
-  routing, finding triage, fix, and rules authoring; `.spur/workflows/pr-review.yaml` is the SSOT
+  routing, finding triage, fix, and rules authoring; `pr-review.yaml` is the SSOT
   for the review spine's state order and guards; the staged `pr-reviewing.ts` is the
   deterministic git/gh core every spine step shells out to.
 - The external review goes through the GitHub PR and an `@codex review` comment only — never local

package/plugins/sp/commands/dev-wrap.md

@@ -28,7 +28,7 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 ## Implementation
 
 - Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
-- Wrap stays **workflow-backed** — `spur workflow run .spur/workflows/wrapup-pipeline.yaml` is the only implementation; there is no inline wrap driver.
+- Wrap stays **workflow-backed** — `spur workflow run wrapup-pipeline.yaml` is the only implementation; there is no inline wrap driver.
 - Resolve the executor **before** launching the workflow:
   - `--agent <name>` → pass the name unchanged into `vars.agent`.
   - `--agent auto` → tier-resolve a concrete executor first, then merge it into `vars.agent`.
@@ -42,7 +42,7 @@ AGENT=… # resolved above: agent.default for omitted, tier-resolved for auto, u
 echo "execution surface: subprocess; reason: trigger 3 — durable auditable run record required; requested agent: <inline|auto|name>; executor: $AGENT"
 VARS=$(jq -nc --arg tasks "[\"$WBS\"]" --arg agent "$AGENT" --arg profile "$PROFILE" --arg merge "$MERGE" \
   '{tasks:$tasks, agent:$agent, profile:$profile, merge:$merge}')
-spur workflow run .spur/workflows/wrapup-pipeline.yaml --vars "$VARS" [--dry-run]
+spur workflow run wrapup-pipeline.yaml --vars "$VARS" [--dry-run]
 ```
 
 The executor resolution is described in the bullets above; the snippet's `AGENT` variable carries

package/plugins/sp/commands/dev-wrapall.md

@@ -30,7 +30,7 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 ## Implementation
 
 - Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
-- Wrap stays **workflow-backed** — `spur workflow run .spur/workflows/wrapup-pipeline.yaml` is the only implementation; there is no inline wrap driver.
+- Wrap stays **workflow-backed** — `spur workflow run wrapup-pipeline.yaml` is the only implementation; there is no inline wrap driver.
 - Resolve the executor **before** launching the workflow:
   - `--agent <name>` → pass the name unchanged into `vars.agent`.
   - `--agent auto` → tier-resolve a concrete executor first, then merge it into `vars.agent`.
@@ -44,7 +44,7 @@ AGENT=… # resolved above: agent.default for omitted, tier-resolved for auto, u
 echo "execution surface: subprocess; reason: trigger 3 — durable auditable run record required; requested agent: <inline|auto|name>; executor: $AGENT"
 VARS=$(jq -nc --arg tasks "$TASKS" --arg feature "$FEATURE" --arg agent "$AGENT" --arg profile "$PROFILE" --arg merge "$MERGE" \
   '{tasks:$tasks, feature:$feature, agent:$agent, profile:$profile, merge:$merge}')
-spur workflow run .spur/workflows/wrapup-pipeline.yaml --vars "$VARS" [--dry-run]
+spur workflow run wrapup-pipeline.yaml --vars "$VARS" [--dry-run]
 ```
 
 The executor resolution is described in the bullets above; the snippet's `AGENT` variable carries

package/plugins/sp/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "sp",
-    "version": "0.3.60",
+    "version": "0.3.61",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics.",
     "extensions": {
         "pi": ["./hooks/pi/guard-extension.ts"]

package/plugins/sp/references/roles.md

@@ -10,8 +10,9 @@ see_also:
 # Roles — the Layer-1 role-to-tier table
 
 The executor-selection contract is two layers. **Layer 1 (this file)** projects *role → tier*;
-its SSOT is `DEFAULT_AGENT_ROLES` in `packages/config/src/index.ts` (task 0572 / ADR-061) — this
-file is the agent/human-facing view plus the plugin-owned command→role mapping. **Layer 2** maps
+its SSOT is `agent.roles` in `config/config.global.yaml` (task 0647 / ADR-078) — this file is the
+agent/human-facing view plus the plugin-owned command→role mapping. `DEFAULT_AGENT_ROLES` in
+`packages/config/src/index.ts` is the no-filesystem fallback and must remain identical. **Layer 2** maps
 *tier → executor* and is owned by the operator in `.spur/config.yaml`. This file never names an
 executor, a model, or a vendor — it declares only what tier a role's work needs, and the
 operator's config decides which executor serves that tier.
@@ -38,9 +39,10 @@ collapse, named as people so they stay addressable in `--agent`.
 
 ## The table
 
-<!-- PROJECTION (task 0572 / ADR-061): the tier/stages half of the block below is a generated view
-     of DEFAULT_AGENT_ROLES in packages/config/src/index.ts — edit that constant, not this file.
-     plugins/sp/tests/roles.test.ts (R9) fails the suite on any drift between the two. The
+<!-- PROJECTION (task 0647 / ADR-078): the tier/stages half of the block below is a generated view
+     of agent.roles in config/config.global.yaml — edit that SSOT, not this file.
+     plugins/sp/tests/roles.test.ts (R9) fails the suite on any three-way drift with the
+     DEFAULT_AGENT_ROLES no-filesystem fallback. The
      `commands:` half is plugin data (command frontmatter is its SSOT). -->
 
 ```yaml
@@ -98,9 +100,10 @@ driving the external PR review and triaging its findings folds the `review` stag
 
 **Consistency is a test, not a convention.** `plugins/sp/tests/roles.test.ts` parses this YAML and
 asserts the tier-distinctness, command closure, stage-floor, and boundary invariants against the
-real command directory, the real stage registry, and the real operator config — plus parity with
-`DEFAULT_AGENT_ROLES` (R9, 0572): the table above must equal the code SSOT byte-for-byte on
-id/tier/stages. When the table and the registry disagree, fix the table or the registry — never the
-test. When the table and `DEFAULT_AGENT_ROLES` disagree, fix the constant (or regenerate this view).
+real command directory, the real stage registry, and the real operator config — plus three-way parity
+with `config/config.global.yaml` and `DEFAULT_AGENT_ROLES` (R9, 0647): the table above must equal the
+shipped SSOT and no-filesystem fallback on id/tier/stages. When the table and the registry disagree,
+fix the table or the registry — never the test. When the three role tables disagree, fix the shipped
+SSOT first, then regenerate the projections.
 A project may re-tier/re-stage a role at config time via `agent.roles` (closed vocabulary) — that
 override never flows back into this file.

package/plugins/sp/scripts/surface-drift-inventory.ts

@@ -1,9 +1,8 @@
 #!/usr/bin/env bun
 /**
  * surface-drift-inventory — re-runnable drift inventory for `plugins/sp` and
- * the tracked workflow-YAML SSOT tree (`.spur/workflows` symlink target)
- * against the live source-local `spur` CLI
- * (feature I3, task 0539 R1/R2).
+ * the tracked workflow-YAML SSOT tree against the live
+ * source-local `spur` CLI (feature I3, task 0539 R1/R2).
  *
  * Method (mechanical first, prose second — task 0539 Design):
  *   A. Plugin assertions: extract every `spur`-invocation (backticked spans, fenced
@@ -19,7 +18,7 @@
  *      in this repo — recorded unverified.
  *   D. Workflows: `spur workflow validate` (live engine, schema + semantic) and a
  *      `--dry-run` transition walk for all ten definitions; `.spur/workflows`
- *      symlink realpath vs its tracked SSOT target tree.
+ *      symlink is asserted absent (two-tier project→bundled model, task 0650).
  *
  * Output: markdown inventory on stdout-path via `--out`; exit 1 when any
  * CONFIRMED mismatch remains (ok after repair); unverified entries never fail.
@@ -35,7 +34,6 @@ import {
     mkdtempSync,
     readdirSync,
     readFileSync,
-    realpathSync,
     rmSync,
     writeFileSync,
 } from 'node:fs';
@@ -130,6 +128,7 @@ interface Parsed {
 }
 
 const PLACEHOLDER = /^([<[{($#"'`]|…|\.\.\.)/;
+const LEGACY_SELF_ALIASES = new Set(['init', 'migrate', 'serve', 'status']);
 
 /** Normalize an asserted invocation span into nouns / verbs / flags. Null when it asserts nothing. */
 export function parseInvocation(spanRaw: string): Parsed | null {
@@ -259,6 +258,32 @@ export function checkNounVerbFlags(
     const root = surface([]);
     for (const noun of nouns) {
         if (noun === 'help' || /^(foo|bar|baz)$/.test(noun)) continue;
+        if (LEGACY_SELF_ALIASES.has(noun)) {
+            const self = surface(['self']);
+            const command = surface(['self', noun]);
+            const present = self.commands.includes(noun);
+            record(
+                `spur ${noun}`,
+                'help-capture(spur self; hidden root alias)',
+                present ? 'ok' : 'mismatch',
+                present
+                    ? `legacy alias; canonical self/${noun} command is present`
+                    : `canonical self/${noun} command is absent`,
+                occ,
+            );
+            for (const f of flags) {
+                record(
+                    `spur ${noun} ${f}`,
+                    `help-capture(spur self ${noun}; hidden root alias)`,
+                    present && command.flags.includes(f) ? 'ok' : 'mismatch',
+                    command.flags.includes(f)
+                        ? 'flag present on canonical command'
+                        : `flag absent (${command.flags.join(', ')})`,
+                    occ,
+                );
+            }
+            continue;
+        }
         if (!root.commands.includes(noun)) {
             record(
                 `spur ${noun}`,
@@ -315,6 +340,10 @@ export function checkNounVerbFlags(
         }
     }
     for (const verb of verbs) {
+        if (nouns.length === 0 && LEGACY_SELF_ALIASES.has(verb)) {
+            checkNounVerbFlags([verb], [], flags, occ);
+            continue;
+        }
         if (nouns.length === 0 && root.commands.includes(verb)) {
             record(`spur ${verb}`, 'help-capture(root)', 'ok', 'root verb present', occ);
         }
@@ -383,7 +412,10 @@ export function sweepPluginTrees(root: string = PLUGIN_ROOT): void {
                     const cells = line.split('|').map((c) => c.trim());
                     const lastCell = cells[cells.length - 2] ?? line;
                     if (first && first !== 'Verb' && first !== 'spur') {
-                        if (rootCommands.includes(first)) {
+                        const nounCommands = surface([refNoun]).commands;
+                        if (nounCommands.includes(first)) {
+                            checkNounVerbFlags([refNoun], [first], flagNames(lastCell), occ);
+                        } else if (rootCommands.includes(first) || LEGACY_SELF_ALIASES.has(first)) {
                             checkNounVerbFlags([], [first], flagNames(lastCell), occ);
                         } else {
                             checkNounVerbFlags([refNoun], [first], flagNames(lastCell), occ);
@@ -611,7 +643,7 @@ const JSON_PROBES: string[][] = [
     ['agent', 'list', '--json'],
     ['agent', 'doctor', 'omp', '--json'],
     ['workflow', 'list', '--json'],
-    ['workflow', 'validate', '.spur/workflows/basic.yaml', '--json'],
+    ['workflow', 'validate', 'basic.yaml', '--json'],
     ['status', '--json'],
     ['team', 'status', '--json'],
     ['projects', 'list', '--json'],
@@ -758,18 +790,20 @@ export function sweepWorkflows(opts: { run?: CliRunner; wfDir?: string; link?: s
                 }
             });
     }
+    // Two-tier model (task 0648/0650): `.spur/workflows` is no longer a symlink and
+    // must not exist — the CLI resolves an explicit project path, then bundled fallback. Assert absence.
     const link = opts.link ?? join(REPO_ROOT, '.spur', 'workflows');
-    let status: Row['status'] = 'mismatch';
-    let actual = '';
+    let status: Row['status'] = 'ok';
+    let actual = 'absent (two-tier project→bundled model, task 0650)';
     try {
-        const rp = realpathSync(link);
-        const tracked = realpathSync(wfDir);
-        status = rp === tracked ? 'ok' : 'mismatch';
-        actual = `resolves to ${rel(rp)}${status === 'ok' ? ' (== tracked SSOT target)' : ` — expected ${rel(tracked)}`}`;
+        if (existsSync(link)) {
+            status = 'mismatch';
+            actual = 'still present — should be removed (task 0650 R3)';
+        }
     } catch (e) {
-        actual = `cannot resolve .spur/workflows: ${String(e).slice(0, 120)}`;
+        actual = `exists-check failed: ${String(e).slice(0, 120)}`;
     }
-    record('.spur/workflows symlink', 'symlink-realpath', status, actual, { file: '.spur/workflows', line: 1 });
+    record('.spur/workflows symlink', 'symlink-absent', status, actual, { file: '.spur/workflows', line: 1 });
 }
 
 // ─── Report ─────────────────────────────────────────────────────────────────
@@ -805,7 +839,7 @@ export function render(): string {
     L.push(
         "R1 scope: `plugins/sp/{commands,skills,scripts,hooks}` (tests/ and evals/ are the harness itself; agents/ prose is outside R1's named surface list).",
     );
-    L.push('R2 scope: all workflow YAML via the `.spur/workflows` runtime symlink (tracked SSOT tree).');
+    L.push('R2 scope: all workflow YAML via the bundled tree (two-tier project→bundled model since task 0648/0650).');
     L.push('');
     L.push('## Check methods');
     L.push('');
@@ -825,7 +859,7 @@ export function render(): string {
     L.push(
         '| `workflow-validate` / `workflow-dry-run` | Live engine: schema+semantic validate; `--dry-run` transition walk |',
     );
-    L.push('| `symlink-realpath` | realpath of `.spur/workflows` vs its tracked SSOT target |');
+    L.push('| `symlink-absent` | `.spur/workflows` is asserted absent (two-tier project→bundled model, task 0650) |');
     L.push('');
     for (const [method, list] of byMethod) {
         const mm = list.filter((r) => r.status === 'mismatch').length;

package/plugins/sp/scripts/validate-commands.ts

@@ -281,15 +281,22 @@ function checkTargetResolution(cmd: ParsedCommand, skillsDir: string, root: stri
         }
     }
 
-    // Workflow file refs — patterns like .spur/workflows/<name>.yaml
-    const workflowRefs = [...implSection.matchAll(/\.spur\/workflows\/([^\s)"\]]+\.yaml)/g)];
+    // Workflow file refs — bare names (`spur workflow run <name>.yaml`, two-tier model
+    // 0648/0650) resolve against the bundled workflow-definition asset tree; legacy
+    // `.spur/workflows/<name>.yaml` paths are also caught as unification drift.
+    const wfDir = join(root, 'config', 'workflows');
+    const workflowRefs = [
+        ...[...implSection.matchAll(/\.spur\/workflows\/([^\s)"\]]+\.yaml)/g)],
+        ...[...implSection.matchAll(/spur workflow (?:run|validate) ([a-z0-9-]+\.yaml)/g)],
+    ];
     for (const ref of workflowRefs) {
-        const wfPath = join(root, '.spur', 'workflows', ref[1]);
+        const bare = (ref[1] ?? '').split('/').pop() ?? '';
+        const wfPath = join(wfDir, bare);
         if (!existsSync(wfPath)) {
             violations.push({
                 command: cmd.name,
                 gate: 'c',
-                message: `unresolved workflow file ${ref[0]} (missing ${wfPath})`,
+                message: `unresolved workflow file ${bare} (missing ${wfPath})`,
             });
         }
     }

package/plugins/sp/skills/code-verification/SKILL.md

@@ -521,7 +521,7 @@ Do **not** use this skill for:
   rubric.
 - `plugins/sp/references/roles.md` — the Layer-1 role→tier table; this skill's verify/review modes
   run under the `reviewer` role (0538 R4: this file points at roles.md, it does not restate tiers).
-- `.spur/workflows/task-pipeline.yaml` — the `verify → record` gate that consumes the verdict.
+- `task-pipeline.yaml` — the `verify → record` gate that consumes the verdict.
 - **`sp:spur-dev`** — the execution-half umbrella that drives the pipeline this skill gates.
 - [references/code-improvement.md](references/code-improvement.md) — architecture-improvement lens
   for module depth, seam placement, locality, coupling, and testability.

package/plugins/sp/skills/code-verification/references/verdict-schema.md

@@ -120,7 +120,7 @@ Wave C verification can emit the following additive `checks[]` rows:
 
 ## How the gate reads it
 
-`.spur/workflows/task-pipeline.yaml`, transition `verify → record`:
+`task-pipeline.yaml`, transition `verify → record`:
 
 ```yaml
 guard:

package/plugins/sp/skills/issue-finding/SKILL.md

@@ -233,7 +233,7 @@ Also note **what worked well** so efficient patterns are preserved.
 1. **Fix description** — documentation, skill reference, pipeline comment, hook, etc.
 2. **Target location** — exact file path
    - Skill guidance: `skills/<skill-name>/SKILL.md` or `references/<name>.md`
-   - Pipeline comments: runtime workflow under `.spur/workflows/` (e.g. `task-pipeline.yaml`)
+   - Pipeline comments: runtime workflow resolves by bare name (`task-pipeline.yaml`)
    - CLI reference: `skills/spur-cli/references/tasks/…`
 3. **Proposed content** — text or code block to add
 4. **Expected impact** — estimated time saved per future run

package/plugins/sp/skills/next-router/references/routing-table.md

@@ -212,5 +212,5 @@ A6 → C5/C3 → unit first if verdict says so; else verify.
 - Dev operations map: `plugins/sp/skills/spur-dev/references/dev-operations.md:37-56`
 - `--next` chain on run: `plugins/sp/commands/dev-run.md:104-127`
 - Refine skip-gate sections: `plugins/sp/skills/spur-dev/references/dev-operations.md:114-128`
-- Task lifecycle wip→testing guard: `.spur/workflows/task-lifecycle.yaml:48-54`
+- Task lifecycle wip→testing guard: `task-lifecycle.yaml:48-54`
 - Decision-brief format: `plugins/sp/skills/spur-dev/references/decision-brief.md`

package/plugins/sp/skills/pr-reviewing/SKILL.md

@@ -39,7 +39,7 @@ that review effort happens on the PR, through Codex — not in the local session
 sp:pr-reviewing (this skill — mode routing, triage, fix, rules)
       │  deterministic spine, state order + guards:
       ▼
-.spur/workflows/pr-review.yaml ← workflow SSOT (seeded by spur init; project-tunable)
+pr-review.yaml ← workflow SSOT (seeded by spur init; project-tunable)
       │  every state resolves with `superskill script path` and shells out to:
       ▼
 staged pr-reviewing.ts         ← Bun entrypoint for the tested git/gh core
@@ -280,7 +280,7 @@ or review requests.
 
 ## Additional Resources
 
-- **Workflow SSOT:** `.spur/workflows/pr-review.yaml` (seeded by `spur init`; tune per project —
+- **Workflow SSOT:** `pr-review.yaml` (seeded by `spur init`; tune per project —
   wait budget, `preReviewCmd`, dedupe policy)
 - **Script source:** [scripts/pr-reviewing.ts](../../scripts/pr-reviewing.ts) — subcommand CLI
 - **Tests:** [tests/pr-reviewing.test.ts](../../tests/pr-reviewing.test.ts) — stubbed git/gh suites