@gobing-ai/spur 0.3.60 → 0.3.62

package/plugins/sp/commands/dev-find-issue.md

@@ -1,37 +1,32 @@
 ---
-description: "Render the session-forensics report from imported history data (8 CLI-derivable sections plus 6 model-authored), identify bottlenecks and behavioral anti-patterns, and optionally create a structured fix task behind --create-task. Triggers: post-mortem, performance analysis, session review, find issues, identify bottlenecks"
+description: "Generate the daily or ad-hoc history-anatomy diagnostic report over already-imported history: the eleven-section report contract, closed finding taxonomy, cache branch, bounded correction, and atomic publication. Triggers: find issues, post-mortem, performance analysis, session review, history-anatomy, run the daily report, ad-hoc diagnosis"
 role: reviewer
-argument-hint: "[<topic>] [--sessions <glob>] [--source <auto|pi|claude|codex|gemini|opencode|antigravity|openclaw|omp|grok|agy|all>] [--feature <id>] [--template <meta|issue|standard>] [--priority <P0|P1|P2|P3>] [--severity <S0|S1|S2>] [--category <list>] [--since <iso>] [--until <iso>] [--top <n>] [--min-cost <duration>] [--strict-topic] [--create-task] [--agent <inline|auto|name>] [--json]"
-allowed-tools: ["Bash", "Read", "Write", "Grep", "Glob", "Skill"]
+argument-hint: "[<focus>] [--mode <daily|ad-hoc>] [--date <YYYY-MM-DD>] [--since <RFC3339>] [--until <RFC3339>] [--recompute] [--agent <inline|auto|name>] [--output <path>]"
+allowed-tools: ["Bash", "Read", "Skill"]
 ---
 
 # Dev Find Issue
 
-Wraps the **sp:issue-finding** skill — report-first session forensics over the history data plane.
-The CLI renders the 8 derivable report sections (`spur history report --mode forensics`); the skill
-identifies bottlenecks, proposes fixes, and — only with `--create-task` — generates a structured
-task file via `spur task create`.
+Wraps the **sp:history-anatomy** skill — the independent owner of diagnostic interpretation over
+already-imported history. The skill resolves the mode contract (daily is the default and uses the
+current local calendar day; ad-hoc requires a focus plus two ordered bounds), owns the report
+contract (eleven sections, closed finding taxonomy, evidence rules, recurrence ledger), and
+exposes the `enrich` and `validate` operations the `history-anatomy.yaml` workflow invokes.
+Publication is atomic and gated behind both the deterministic structure gate and independent
+evidence validation. This command never triggers an import.
 
 ## Argument Flags
 
-| Flag                                                                                                 | Description                                                                                                                   | Default    |
-| ---------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------- | ---------- |
-| `[<topic>]`                                                                                          | Narrow the analysis to a topic.                                                                                               | omitted    |
-| `--sessions` `<glob>`                                                                                | Session log glob (fallback input).                                                                                            | recent     |
-| `--source` `<auto\|pi\|claude\|codex\|gemini\|opencode\|antigravity\|openclaw\|omp\|grok\|agy\|all>` | Agent source to scan (CLI vocabulary; `all` fans out, `auto` resolves at runtime).                                            | auto       |
-| `--feature` `<id>`                                                                                   | Attach the generated task to a feature.                                                                                       | omitted    |
-| `--template` `<meta\|issue\|standard>`                                                               | Task template shape (`--create-task` only); `issue` is the explicit single-finding override, `standard` the generic override. | meta       |
-| `--priority` `<P0\|P1\|P2\|P3>`                                                                      | Filter / assign task priority.                                                                                                | P2         |
-| `--severity` `<S0\|S1\|S2>`                                                                          | Filter / assign severity.                                                                                                     | all        |
-| `--category` `<list>`                                                                                | Comma list of categories to keep.                                                                                             | all        |
-| `--since` `<iso>`                                                                                    | Start of the scan window.                                                                                                     | configured |
-| `--until` `<iso>`                                                                                    | End of the scan window.                                                                                                       | now        |
-| `--top` `<n>`                                                                                        | Limit to top N findings.                                                                                                      | omitted    |
-| `--min-cost` `<duration>`                                                                            | Minimum wasted duration to report.                                                                                            | omitted    |
-| `--strict-topic`                                                                                     | Drop findings off-topic.                                                                                                      | off        |
-| `--create-task`                                                                                      | Generate a fix task for findings.                                                                                             | off        |
-| `--agent` `<inline\|auto\|name>`                                                                     | Who runs the model-bearing analysis.                                                                                          | omit       |
-| `--json`                                                                                             | Emit structured JSON.                                                                                                         | off        |
+| Flag                                   | Description                                                                                        | Default  |
+| -------------------------------------- | -------------------------------------------------------------------------------------------------- | -------- |
+| `[<focus>]`                            | Ad-hoc focus string (required in `--mode ad-hoc`; rejected in daily).                              | omitted  |
+| `--mode` `<daily\|ad-hoc>`             | Report mode. Daily uses the current local calendar day.                                            | daily    |
+| `--date` `<YYYY-MM-DD>`                | Selects that local calendar day (daily; DST-aware).                                                | today    |
+| `--since` `<RFC3339>`                  | Inclusive lower bound (ad-hoc; required).                                                          | omitted  |
+| `--until` `<RFC3339>`                  | Inclusive upper bound (ad-hoc; required).                                                          | omitted  |
+| `--recompute`                          | Force the full analyze/render/enrich/validate path; records disposition forced-recompute.          | off      |
+| `--agent` `<inline\|auto\|name>`       | Execution surface selector.                                                                        | inline   |
+| `--output` `<path>`                    | Explicit report output path (ad-hoc; default writes to the run directory).                         | run dir  |
 
 For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag-glossary.md).
 
@@ -39,31 +34,15 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 ```
 /sp:dev-find-issue
-/sp:dev-find-issue "test-loop spinning"
-/sp:dev-find-issue --sessions "~/.omp/agent/sessions/-xprojects-spur-new/2026-07-29T*"
-/sp:dev-find-issue "L3 guard format discovery" --feature H51 --priority P1 --severity S1
-/sp:dev-find-issue --category test-loop,guard --min-cost 30m
-/sp:dev-find-issue --source claude --since 2026-07-28 --create-task --json
+/sp:dev-find-issue --date 2026-08-24
+/sp:dev-find-issue --mode ad-hoc --since 2026-08-01T00:00:00Z --until 2026-08-15T00:00:00Z "focus"
+/sp:dev-find-issue --recompute
 ```
 
-**Report-first (task 0556).** Default output is the markdown report to stdout; no task file is
-written. Task creation moved behind `--create-task`. `--use-history` and `--no-task` are removed:
-the history data plane is now the primary source (no flag needed), and the old report-only behavior
-is the new default. Raw JSONL remains a fallback under the three conditions documented in
-`sp:issue-finding`.
-
-**Data-plane preflight.** Forensics read the imported history plane as-is. If findings come back
-empty or stale, run `/sp:dev-history-load` (on-demand cumulative `spur history import` + analyze,
-checkpoint resume — task 0567) before re-running forensics; it owns the interactive preflight, while
-`spur history daily` owns the periodic cadence.
-
-**See also:** skill `sp:issue-finding` (SSOT), `/sp:dev-runall`, `/sp:dev-dogfood`,
-`sp:daily-summary`, `sp:reverse-engineering`.
-
 ## Implementation
 
-Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface), then invoke the issue-finding skill, forwarding all arguments:
+Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
 
 ```
-Skill(skill="sp:issue-finding", args="$ARGUMENTS")
+Skill(skill="sp:history-anatomy", args="$ARGUMENTS")
 ```

package/plugins/sp/commands/dev-pr-review.md

@@ -31,7 +31,7 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 - Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
 - Delegate everything: `Skill(skill="sp:pr-reviewing", args="$ARGUMENTS")`. The skill owns mode
-  routing, finding triage, fix, and rules authoring; `.spur/workflows/pr-review.yaml` is the SSOT
+  routing, finding triage, fix, and rules authoring; `pr-review.yaml` is the SSOT
   for the review spine's state order and guards; the staged `pr-reviewing.ts` is the
   deterministic git/gh core every spine step shells out to.
 - The external review goes through the GitHub PR and an `@codex review` comment only — never local

package/plugins/sp/commands/dev-run.md

@@ -1,7 +1,7 @@
 ---
 description: Run a task — full pipeline (precheck→implement→test→review→approve→verify→record→done) or single-step (implement)
 role: coder
-argument-hint: "<wbs> [--mode <full|implement>] [--agent <inline|auto|name>] [--auto] [--next] [--wrap] [--continue]"
+argument-hint: "<wbs> [--mode <full|implement>] [--agent <inline|auto|name>] [--auto] [--next] [--wrap] [--continue] [--worktree [<name>]]"
 allowed-tools: ["Bash", "Read", "Write", "Edit", "Skill"]
 ---
 
@@ -20,12 +20,13 @@ Wraps the **sp:spur-dev** and **sp:code-implementation** skills.
 | `--next` | Chain-to-completion via the next-router. | off |
 | `--wrap` | Run the wrap hop after the main step. The `--agent` selector is preserved into the `/sp:dev-wrap <wbs>` handoff when supplied; omission remains omission. The wrap hop is workflow-backed and reports its trigger-3 subprocess override. | off |
 | `--continue` | Resume an interrupted task from its checkpoint. | off |
+| `--worktree` `[<name>]` | Run the task pipeline in an isolated git worktree; FF-merge on success, retain on failure. Bare `--worktree` creates a fresh tree; `--worktree <name>` adopts an existing worktree by name/path/branch. Full mode only. | off |
 
 For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag-glossary.md).
 
 ## Usage
 
-/sp:dev-run <wbs> [--mode <full|implement>] [--agent <inline|auto|name>] [--auto] [--next] [--wrap] [--continue]
+/sp:dev-run <wbs> [--mode <full|implement>] [--agent <inline|auto|name>] [--auto] [--next] [--wrap] [--continue] [--worktree [<name>]]
 
 ## Implementation
 
@@ -40,12 +41,30 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 - `--auto` | `--agent <inline|auto|name>` — Skip objective HITL confirmations (taste/irreversible gates still pause). `--agent` names who does the model-bearing work. Interactive omit/`inline` keeps the controller and implement-only stages in this session; full mode reads `task-pipeline.yaml` as the SSOT and interprets its actions/guards through the inline driver, where **omitted** `--agent`'s eligible `agent.run` stages may dispatch once to a native subagent and otherwise run in the host (task 0508); explicit `--agent inline` is the zero-dispatch carve-out — every stage executes in the invoking session. It records `stage <id> executed inline in session <session-id>` or `stage <id> executed via subagent <agent-id> (host session <session-id>)` in the run log. `auto` or a name is merged into `vars.agent` and `vars.implementAgent` and keeps the existing subprocess workflow. Headless `spur workflow run` / `spur agent run` is unchanged. See the [execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
 
+`--worktree` `[<name>]` (run the task's pipeline in an isolated git worktree — FF-merge onto the
+base ref on full success, retain intact on any failure/halt/non-FF; bare form creates a fresh tree,
+`<name>` form adopts an existing worktree by name/path/branch). The lifecycle — dirty-tree precheck,
+creation or adoption, crash-safe `.spur/run/` marker, merge-or-retain, `--continue` re-entry — is
+`execution-batch.md` § Worktree isolation applied to a batch of one: marker `command` is `dev-run`
+and `selector` is the `<wbs>`, the derived branch is `sp/run-<wbs>-<short-id>`, and the success
+condition is the task reaching terminal `done` with no failed stage. A failing gate, a non-PASS
+verify verdict, or a HITL pause that ends the run all take the retention path.
+
+**`--worktree` is full-mode only.** `--worktree --mode implement` is **rejected**. `--mode implement`
+*is* the pipeline's implement stage and runs in whatever tree the driver already set up (bug-742);
+giving it a second worktree would split one task's evidence across two trees. Use `--worktree` on the
+full-mode invocation, which carries the implement stage with it.
+
+**`--worktree` corpus visibility.** While the task runs in a worktree, corpus writes (status
+transitions, evidence sections, kanban) land in the worktree copy; your main tree still shows the
+pre-run status until the FF-merge on success. This is expected, not a bug.
+
 **Mode split (load-bearing — bug-742)**
 
 | Mode | What runs | Must not do |
 | --- | --- | --- |
 | `--mode full` (default) | Interactive omit/inline: host-session driver over `task-pipeline.yaml`; explicit/headless executor: workflow subprocess | — |
-| `--mode implement` | Single implement competency via `sp:code-implementation` | Re-launch the full pipeline, `spur workflow run …task-pipeline…`, or `/sp:dev-run` **without** `--mode implement` |
+| `--mode implement` | Single implement competency via `sp:code-implementation` | Re-launch the full pipeline, `spur workflow run …task-pipeline…`, `/sp:dev-run` **without** `--mode implement`, or accept `--worktree` (rejected) |
 
 The pipeline's `implement` step invokes this command **only** as:
 

package/plugins/sp/commands/dev-wrap.md

@@ -28,7 +28,7 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 ## Implementation
 
 - Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
-- Wrap stays **workflow-backed** — `spur workflow run .spur/workflows/wrapup-pipeline.yaml` is the only implementation; there is no inline wrap driver.
+- Wrap stays **workflow-backed** — `spur workflow run wrapup-pipeline.yaml` is the only implementation; there is no inline wrap driver.
 - Resolve the executor **before** launching the workflow:
   - `--agent <name>` → pass the name unchanged into `vars.agent`.
   - `--agent auto` → tier-resolve a concrete executor first, then merge it into `vars.agent`.
@@ -42,7 +42,7 @@ AGENT=… # resolved above: agent.default for omitted, tier-resolved for auto, u
 echo "execution surface: subprocess; reason: trigger 3 — durable auditable run record required; requested agent: <inline|auto|name>; executor: $AGENT"
 VARS=$(jq -nc --arg tasks "[\"$WBS\"]" --arg agent "$AGENT" --arg profile "$PROFILE" --arg merge "$MERGE" \
   '{tasks:$tasks, agent:$agent, profile:$profile, merge:$merge}')
-spur workflow run .spur/workflows/wrapup-pipeline.yaml --vars "$VARS" [--dry-run]
+spur workflow run wrapup-pipeline.yaml --vars "$VARS" [--dry-run]
 ```
 
 The executor resolution is described in the bullets above; the snippet's `AGENT` variable carries

package/plugins/sp/commands/dev-wrapall.md

@@ -30,7 +30,7 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 ## Implementation
 
 - Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
-- Wrap stays **workflow-backed** — `spur workflow run .spur/workflows/wrapup-pipeline.yaml` is the only implementation; there is no inline wrap driver.
+- Wrap stays **workflow-backed** — `spur workflow run wrapup-pipeline.yaml` is the only implementation; there is no inline wrap driver.
 - Resolve the executor **before** launching the workflow:
   - `--agent <name>` → pass the name unchanged into `vars.agent`.
   - `--agent auto` → tier-resolve a concrete executor first, then merge it into `vars.agent`.
@@ -44,7 +44,7 @@ AGENT=… # resolved above: agent.default for omitted, tier-resolved for auto, u
 echo "execution surface: subprocess; reason: trigger 3 — durable auditable run record required; requested agent: <inline|auto|name>; executor: $AGENT"
 VARS=$(jq -nc --arg tasks "$TASKS" --arg feature "$FEATURE" --arg agent "$AGENT" --arg profile "$PROFILE" --arg merge "$MERGE" \
   '{tasks:$tasks, feature:$feature, agent:$agent, profile:$profile, merge:$merge}')
-spur workflow run .spur/workflows/wrapup-pipeline.yaml --vars "$VARS" [--dry-run]
+spur workflow run wrapup-pipeline.yaml --vars "$VARS" [--dry-run]
 ```
 
 The executor resolution is described in the bullets above; the snippet's `AGENT` variable carries

package/plugins/sp/lib/artifact-digest.generated.d.mts

@@ -0,0 +1,7 @@
+/**
+ * GENERATED by scripts/commands/bundle-plugin-lib.ts — do not edit.
+ * Source of truth: packages/domain/src/analytics/artifact-digest.ts (task 0669).
+ */
+export declare const ARTIFACT_ARRAY_CLASSIFICATION: Readonly<Record<string, 'ranked' | 'set'>>;
+export declare const RANKED_ARTIFACT_KEYS: ReadonlySet<string>;
+export declare function semanticArtifactDigest(artifactJson: unknown): string;

package/plugins/sp/lib/artifact-digest.generated.mjs

@@ -0,0 +1,48 @@
+// packages/domain/src/analytics/artifact-digest.ts
+import { createHash } from "node:crypto";
+var ARTIFACT_ARRAY_CLASSIFICATION = {
+  byTool: "ranked",
+  bySession: "ranked",
+  topStepsByTokens: "ranked",
+  topStepsByDuration: "ranked",
+  topSteps: "ranked",
+  bottlenecks: "ranked",
+  coverage: "set",
+  daily: "set",
+  loops: "set",
+  warnings: "set",
+  pairings: "set",
+  ladderSnapshot: "set",
+  stepSupport: "set",
+  phases: "set",
+  tools: "set",
+  skills: "set",
+  sources: "set",
+  models: "set"
+};
+var RANKED_ARTIFACT_KEYS = new Set(Object.entries(ARTIFACT_ARRAY_CLASSIFICATION).filter(([, kind]) => kind === "ranked").map(([key]) => key));
+function canonicalize(value, key) {
+  if (key === "generatedAt" || key === "validatedAt" || key === "baselineArtifactDigest")
+    return null;
+  if (Array.isArray(value)) {
+    const raw = value.map((v) => JSON.stringify(canonicalize(v, "")));
+    return RANKED_ARTIFACT_KEYS.has(key) ? raw : [...raw].sort();
+  }
+  if (value !== null && typeof value === "object") {
+    const out = {};
+    for (const k of Object.keys(value).sort()) {
+      out[k] = canonicalize(value[k], k);
+    }
+    return out;
+  }
+  return value;
+}
+function semanticArtifactDigest(artifactJson) {
+  const material = JSON.stringify(canonicalize(artifactJson, "root"));
+  return createHash("sha256").update(material).digest("hex");
+}
+export {
+  semanticArtifactDigest,
+  RANKED_ARTIFACT_KEYS,
+  ARTIFACT_ARRAY_CLASSIFICATION
+};

package/plugins/sp/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "sp",
-    "version": "0.3.60",
+    "version": "0.3.62",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics.",
     "extensions": {
         "pi": ["./hooks/pi/guard-extension.ts"]

package/plugins/sp/references/roles.md

@@ -10,8 +10,9 @@ see_also:
 # Roles — the Layer-1 role-to-tier table
 
 The executor-selection contract is two layers. **Layer 1 (this file)** projects *role → tier*;
-its SSOT is `DEFAULT_AGENT_ROLES` in `packages/config/src/index.ts` (task 0572 / ADR-061) — this
-file is the agent/human-facing view plus the plugin-owned command→role mapping. **Layer 2** maps
+its SSOT is `agent.roles` in `config/config.global.yaml` (task 0647 / ADR-078) — this file is the
+agent/human-facing view plus the plugin-owned command→role mapping. `DEFAULT_AGENT_ROLES` in
+`packages/config/src/index.ts` is the no-filesystem fallback and must remain identical. **Layer 2** maps
 *tier → executor* and is owned by the operator in `.spur/config.yaml`. This file never names an
 executor, a model, or a vendor — it declares only what tier a role's work needs, and the
 operator's config decides which executor serves that tier.
@@ -38,9 +39,10 @@ collapse, named as people so they stay addressable in `--agent`.
 
 ## The table
 
-<!-- PROJECTION (task 0572 / ADR-061): the tier/stages half of the block below is a generated view
-     of DEFAULT_AGENT_ROLES in packages/config/src/index.ts — edit that constant, not this file.
-     plugins/sp/tests/roles.test.ts (R9) fails the suite on any drift between the two. The
+<!-- PROJECTION (task 0647 / ADR-078): the tier/stages half of the block below is a generated view
+     of agent.roles in config/config.global.yaml — edit that SSOT, not this file.
+     plugins/sp/tests/roles.test.ts (R9) fails the suite on any three-way drift with the
+     DEFAULT_AGENT_ROLES no-filesystem fallback. The
      `commands:` half is plugin data (command frontmatter is its SSOT). -->
 
 ```yaml
@@ -48,7 +50,7 @@ version: 1
 roles:
   - id: scribe
     tier: cheap
-    commands: [dev-gitmsg, dev-handover, dev-daily, dev-history-load, dev-changelog, dev-refresh, rule-add, rule-refine, workflow-add, workflow-refine, spur-init]
+    commands: [dev-gitmsg, dev-handover, dev-daily, dev-changelog, dev-refresh, rule-add, rule-refine, workflow-add, workflow-refine, spur-init]
     stages: [changelog]
   - id: coder
     tier: standard
@@ -81,26 +83,27 @@ must not sit below the highest `min_tier` among its folded stages.
 - **`reviewer` (capable-1).** Verification and analysis: per-task verify/review, batch verify,
   dogfooding, anti-pattern scanning (`rule-scan`), and the two audit commands (`dev-find-conflict`,
   `dev-find-issue`) — those analyse rather than transcribe, which is why they sit here and not
-  under `scribe`. Folds `verify`, `review`, `dogfood`.
+  under `scribe`. `dev-find-issue` now routes through the `sp:history-anatomy` skill (mode contract + report contract). Folds `verify`, `review`, `dogfood`.
 - **`planner` (capable-2).** The planning half: feature planning, requirement refinement (single
   and batch), brainstorm, idea intake, batch run/parallel orchestration, next-step routing,
   architecture survey, feature-frontier prioritization, and feature-tree restructure. Folds `plan`,
   `refine`, `brainstorm`.
 
 **Placement notes (directory closure, task 0535).** The decided four-row table listed 31 commands;
-the live `plugins/sp/commands/` directory has 39. The six additional commands were placed by the
+the live `plugins/sp/commands/` directory has 38 (39 at the time of the mapping; `dev-history-load`
+was removed in HA-S1 0661). The six additional commands were placed by the
 same stage logic: `dev-refineall` folds `refine` → planner; `dev-find-next` is planning-side
 frontier work → planner; `dev-feature-change` is planning-half corpus surgery on the feature tree →
 planner; `dev-gtd` is the execution/delivery flow → coder; `dev-find-conflict` and `dev-find-issue`
-are audits/analysis → reviewer (same reasoning as `rule-scan`). Later additions: `dev-history-load`
-is mechanical load+analyze orchestration → scribe; `dev-pr-review` is review orchestration —
+are audits/analysis → reviewer (same reasoning as `rule-scan`). Later additions: `dev-pr-review` is review orchestration —
 driving the external PR review and triaging its findings folds the `review` stage → reviewer.
 
 **Consistency is a test, not a convention.** `plugins/sp/tests/roles.test.ts` parses this YAML and
 asserts the tier-distinctness, command closure, stage-floor, and boundary invariants against the
-real command directory, the real stage registry, and the real operator config — plus parity with
-`DEFAULT_AGENT_ROLES` (R9, 0572): the table above must equal the code SSOT byte-for-byte on
-id/tier/stages. When the table and the registry disagree, fix the table or the registry — never the
-test. When the table and `DEFAULT_AGENT_ROLES` disagree, fix the constant (or regenerate this view).
+real command directory, the real stage registry, and the real operator config — plus three-way parity
+with `config/config.global.yaml` and `DEFAULT_AGENT_ROLES` (R9, 0647): the table above must equal the
+shipped SSOT and no-filesystem fallback on id/tier/stages. When the table and the registry disagree,
+fix the table or the registry — never the test. When the three role tables disagree, fix the shipped
+SSOT first, then regenerate the projections.
 A project may re-tier/re-stage a role at config time via `agent.roles` (closed vocabulary) — that
 override never flows back into this file.