@gobing-ai/spur 0.3.63 → 0.3.64

package/config/workflows/history-anatomy.yaml

@@ -131,12 +131,12 @@ states:
         options:
           command: >-
             mkdir -p .spur/run;
-            . .spur/run/$__runId-paths.env;
+            . .spur/run/$__runId-paths.txt;
             $spurBin history analyze --out .spur/run/$__runId-history-anatomy-current.json --since "$HA_SINCE" --until "$HA_UNTIL" --json
       - kind: shell
         options:
           command: >-
-            . .spur/run/$__runId-paths.env;
+            . .spur/run/$__runId-paths.txt;
             $spurBin history analyze --out .spur/run/$__runId-history-anatomy-baseline.json --since "$HA_BASELINE_SINCE" --until "$HA_BASELINE_UNTIL" --json 2>/dev/null || true
 
   - id: cache-probe

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.3.63",
+    "version": "0.3.64",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",
@@ -53,14 +53,14 @@
     },
     "devDependencies": {
         "@commander-js/extra-typings": "^14.0.0",
-        "@gobing-ai/ts-db": "^0.4.43",
-        "@gobing-ai/ts-ai-runner": "^0.4.43",
-        "@gobing-ai/ts-dual-workflow-engine": "^0.4.43",
-        "@gobing-ai/ts-infra": "^0.4.43",
-        "@gobing-ai/ts-llm-jsonl-importer": "^0.4.43",
-        "@gobing-ai/ts-rule-engine": "^0.4.43",
-        "@gobing-ai/ts-runtime": "^0.4.43",
-        "@gobing-ai/ts-utils": "^0.4.43",
+        "@gobing-ai/ts-db": "^0.4.45",
+        "@gobing-ai/ts-ai-runner": "^0.4.45",
+        "@gobing-ai/ts-dual-workflow-engine": "^0.4.45",
+        "@gobing-ai/ts-infra": "^0.4.45",
+        "@gobing-ai/ts-llm-jsonl-importer": "^0.4.45",
+        "@gobing-ai/ts-rule-engine": "^0.4.45",
+        "@gobing-ai/ts-runtime": "^0.4.45",
+        "@gobing-ai/ts-utils": "^0.4.45",
         "@types/bun": "1.3.14",
         "@types/figlet": "^1.7.0",
         "@types/node-notifier": "8.0.5",

package/plugins/sp/README.md

@@ -135,7 +135,7 @@ list this README is checked against.
 | `dev-simplify`      | Simplify recently-changed code for clarity without changing behavior — incremental, test-after-each, revert on regression                                                                         |
 | `dev-arch`          | Survey a codebase (or module tree) for shallow modules and deepening opportunities — emit a ranked MARKDOWN candidate report that feeds the planning half; never auto-refactors                   |
 | `dev-reverse`       | Reverse-engineer a codebase — analyze unfamiliar repos, generate HLD/architecture docs, audit quality/security, and produce onboarding documentation                                              |
-| `dev-gitmsg`        | Generate conventional commit message(s) from staged changes via per-file summarization, optionally commit                                                                                         |
+| `dev-gitmsg`        | Generate conventional commit message(s) from the current change set via one bounded diff capture, optionally commit                                                                                         |
 | `dev-gtd`           | Get things done — quality gate (auto-fix) → conventional commit → push → gh verify in one flow; optional act CI simulation via `--act`                                                          |
 | `dev-changelog`     | Generate changelog from git commits                                                                                                                                                               |
 
@@ -173,7 +173,7 @@ and verification (`sp:code-verification`) — plus a CLI facade (`sp:spur-cli`,
 `spur` noun) and standalone technique skills (`sp:next-router`, `sp:test-driven-development`, `sp:brainstorm`,
 `sp:wayfinder`, `sp:sys-debugging`, `sp:code-review`, `sp:code-simplification`, `sp:code-improvement`,
 `sp:parallel-execution`, `sp:branch-workflow`, `sp:doc-evolve`, `sp:dogfood-testing`,
-`sp:daily-summary`, `sp:reverse-engineering`, `sp:issue-finding`, `sp:conflict-finding`, `sp:indexed-context`). See
+`sp:daily-summary`, `sp:reverse-engineering`, `sp:issue-finding`, `sp:conflict-finding`, `sp:indexed-context`, `sp:redesign-web-ui`). See
 [skills/spur-dev/SKILL.md](skills/spur-dev/SKILL.md)'s Step routing table for which skill owns which
 pipeline step.
 
@@ -181,7 +181,7 @@ pipeline step.
 
 ```
 plugins/sp/
-├── skills/                          # Domain knowledge + workflow docs (28 skills)
+├── skills/                          # Domain knowledge + workflow docs (31 skills)
 │   ├── brainstorm/                  # Structured ideation workflow
 │   │   ├── agents/openai.yaml
 │   │   ├── examples/ideation-example.md
@@ -239,6 +239,8 @@ plugins/sp/
 │   │   └── references/{authority-resolution.md, comparison-protocol.md, finding-contract.md, remediation-routing.md}
 │   ├── next-feature/                # Prompt-first feature frontier prioritizer (backs /sp:dev-find-next)
 │   │   └── references/{signal-derivation.md, ranking-rubric.md, proposal-contract.md, handoff-routing.md}
+│   ├── redesign-web-ui/             # Existing-UI visual upgrade past generic AI defaults
+│   │   └── references/{audit-checklist, upgrade-techniques}.md
 │   ├── history-anatomy/             # Diagnostic interpretation owner over already-imported history (backs /sp:dev-find-issue)
 │   │   └── references/{modes.md, report-contract.md, operations.md}
 │   ├── sys-architecture/            # Architecture / ADR judgment competency
@@ -319,6 +321,7 @@ surface or run one workflow. All skills target the same five core platforms: `cl
 | `pr-reviewing`              | 1.0   | GitHub Codex PR review — PR prepare/reuse, `@codex review` request with per-HEAD dedupe, bounded polling, findings normalization, validated fix + re-review; spine SSOT `pr-review.yaml` + `scripts/pr-reviewing.ts`; backs `/sp:dev-pr-review`     |
 | `indexed-context`           | 1.0   | Cross-agent project context — anatomy/learnings/pitfalls/buglog/memory in `.spur/context/`; hook-tracked token-ledger; graceful degradation on agents without hooks                                                                        |
 | `history-anatomy`           | 1.0   | Diagnostic interpretation owner over already-imported history — daily/ad-hoc mode contract, closed finding taxonomy, twelve-section report contract, `enrich`/`validate` rubrics; no workflow launch, no JSONL fallback, no corpus mutation                                                                   |
+| `redesign-web-ui`           | 1.0   | Existing-UI visual upgrade — audit generic AI fingerprints, apply in-stack polish against `DESIGN.md` / live tokens, verify behavior and viewports; does not migrate frameworks                                                                                                                            |
 
 #### Bounded coexistence and retirement gate — `sp:issue-finding` (HA-S1 0661)
 

package/plugins/sp/agents/expert-spur.md

@@ -45,10 +45,24 @@ guide and conventions before acting.
 - **Traceability audits** — verify every task links to a feature, every scenario maps to a task.
 - **Section-editing campaigns** — update the same section across multiple tasks.
 - **Rule-catalog work** — author, fine-tune, validate, or harden constraint rules across the catalog.
-- **Workflow work** — author, validate, dry-run, or refactor one or more workflows.
-  When authoring or refactoring, read the composition-measures section in
-  `sp:spur-cli` `references/workflows.md` and apply the advisory's fix-path map — findings are
-  advisory only; never block a run or edit an executing pipeline over them.
+- **Workflow work** — decide fit, author, validate, dry-run, tune, or refactor one or more workflows.
+  Read `sp:spur-cli` `references/workflows/workflow-fit-and-tuning.md` before authoring or
+  refactoring, and apply it in this order:
+  - **Fit first.** A process earns a `spur workflow` only when it replays, branches on a
+    machine-checkable predicate, **and** needs a durable per-run record. Fewer than three → recommend
+    a descriptive procedure or checklist and stop. Author the mode gate only after fit clears.
+  - **Simplicity is the budget, and it is measured.** `shell` commands at or under 5 non-comment
+    units, `agent.run` inputs referencing a slash command rather than carrying a raw prompt, guards
+    a single predicate. Over budget → pick a recorded owner from
+    `docs/design/workflow-shell-ownership.md`; never reformat to dodge the measure.
+  - **Latency and observability are authoring decisions.** Minimize `agent.run` node count first;
+    soft status-file probe over repeated probing; guards ordered cheapest-discriminating-first;
+    `iterationBound` from a latency budget; states named for outcomes; `failureStates` declared.
+  - **Refactor in a named direction** — promote (prose → workflow), demote (workflow → prose),
+    or optimize in place. Back an optimization with a before/after `spur workflow trace` pair,
+    never with a feel.
+  - Composition-advisory findings (`workflow validate --json` → `composition`) are advisory only;
+    never block a run or edit an executing pipeline over them.
 - **Corpus health checks** — run `check`/`validate` across a batch and report findings.
 
 For a single operation, use the `spur` CLI directly. For the planning/execution lifecycle, use
@@ -72,12 +86,14 @@ Invoke `sp:spur-cli` for verb guidance and per-noun conventions:
 - [ ] Run the corpus-wide sweep after batch edits: `spur task check --corpus --json` (fails on structural errors outside `config/corpus-baseline.json`).
 - [ ] Use `spur task update --section --from-file` for all task section edits.
 - [ ] Run the noun's scoped `refresh` after batch operations where one exists (`spur task refresh`, `spur feature refresh --feature <id>` or `--all`).
+- [ ] Run the workflow fit gate before authoring any new workflow, and recommend a descriptive procedure when it does not clear all three parts.
 
 ### Never
 
 - [ ] Never edit corpus files directly — always through CLI verbs.
 - [ ] Never reimplement verb logic or validation — the CLI owns it.
 - [ ] Never drive the planning/execution lifecycle through this agent — use `sp:spur-dev`.
+- [ ] Never author a workflow whose every node is a raw-prompt `agent.run` — that is a descriptive procedure paying a process spawn per step.
 
 ## Output Format
 

package/plugins/sp/commands/dev-find-issue.md

@@ -25,7 +25,7 @@ evidence validation. This command never triggers an import.
 | `--since` `<RFC3339>`                  | Inclusive lower bound (ad-hoc; required).                                                          | omitted  |
 | `--until` `<RFC3339>`                  | Inclusive upper bound (ad-hoc; required).                                                          | omitted  |
 | `--recompute`                          | Force the full analyze/render/enrich/validate path; records disposition forced-recompute.          | off      |
-| `--agent` `<auto\|name>`               | Execution surface selector. This target is engine-driven (headless): omit resolves through the executor precedence chain to `agent.default`, then the workflow literal. Explicit `--agent inline` is rejected with the stable special error (exit 2). | omitted  |
+| `--agent` `<auto\|name>`               | Execution surface selector. This target is engine-driven (headless). Per task 0687, omit and explicit `--agent inline` resolve identically — tier resolution with one warning naming the substituted executor; there is deliberately **no** host-session inline driver for `history-anatomy.yaml` (mechanism (b)). A name pins the executor. | omitted  |
 | `--output` `<path>`                    | Explicit report output path (ad-hoc; default writes to the run directory).                         | run dir  |
 
 For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag-glossary.md).

package/plugins/sp/commands/dev-gitmsg.md

@@ -1,7 +1,7 @@
 ---
-description: Generate conventional commit message(s) from staged changes via per-file summarization, optionally commit
+description: Generate conventional commit message(s) from the current change set via one bounded diff capture, optionally commit
 role: scribe
-argument-hint: "[--commit] [--squash] [--scope <path>]"
+argument-hint: "[--commit] [--squash] [--all] [--scope <path>]"
 allowed-tools: ["Bash", "Read"]
 ---
 
@@ -13,17 +13,23 @@ Implements an inline procedure — see [dev-operations.md](../skills/spur-dev/re
 
 | Flag | Description | Default |
 | --- | --- | --- |
-| `--commit` | Stage and commit with the generated message. | off |
-| `--squash` | Squash staged changes into one commit. | off |
-| `--scope` `<path>` | Scope the diff to a path. | all staged changes |
+| `--commit` | Commit the change set — one commit per concern. | off |
+| `--squash` | Collapse every concern into one message and one commit; implies `--commit`. | off |
+| `--all` | Widen the change set past the index to every change in the tree — unstaged **and untracked**. | off |
+| `--scope` `<path>` | Path filter on the change set; always wins over change-set auto-discovery. | the whole change set |
 
 For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag-glossary.md).
 
 ## Usage
 
-/sp:dev-gitmsg [--commit] [--squash] [--scope <path>]
+/sp:dev-gitmsg [--commit] [--squash] [--all] [--scope <path>]
 
 ## Implementation
 
 Follow the inline procedure in [dev-operations.md](../skills/spur-dev/references/dev-operations.md#9-gitmsg) (gitmsg).
 
+One diff capture per run — `-U0`, lockfiles excluded, 60 KB cap — is the token contract; never re-read
+the diff wider. Neither `--commit` nor `--squash` → messages only. `--commit` → one commit per concern, split automatically,
+so the operator is never asked to re-stage and re-run. `--squash` → one commit for everything.
+An empty index widens to the whole tree only on a message-only run, and says so; a committing run
+stops there and prints the exact `--all` re-run line instead of guessing.

package/plugins/sp/commands/dev-gtd.md

@@ -62,25 +62,14 @@ The real GitHub CI runner passes. **Do not** modify the build infrastructure to
 Then stop the run (this stage failed). The operator can proceed by re-running without `--act`.
 
 **3 — Generate a conventional commit message.** Follow the gitmsg procedure (the same one
-`/sp:dev-gitmsg` runs). Run `git diff --cached --stat` (add `-- <path>` when `--scope` is given) for
-the outline; if it is empty, stage the intended changes first and report "no staged changes" if
-nothing was meant to be committed. Capture the full diff to a temp file
-(`TEMP_FILE="/tmp/gitdiff_$(date +%s)"; git diff --cached > "$TEMP_FILE" 2>&1`). Read it and write
-**one sentence per changed file** — what changed and why. Group the per-file sentences by concern;
-for each group derive its commit type (`feat` · `fix` · `refactor` · `docs` · `chore` · `perf` ·
-`test` · `style`), scope (affected module/package, or the `--scope` value), and message:
-
-```
-<type>(<scope>): <summary>
-
-<body — optional bullets from the group's per-file sentences>
-```
-
-Summary: imperative mood, ≤72 chars, lowercase first word, no period. Body only when the change is
-non-obvious. Resolve groups: one group → emit its message; multiple groups → emit one message per
-group plus a split recommendation (stage per concern, re-run); under this all-in-one flow, prefer a
-single combined message (dominant type/scope, per-file bullets) so the push is atomic. Delete the
-temp file (`rm "$TEMP_FILE"`) — no `/tmp` diff residue.
+`/sp:dev-gitmsg` runs) — see
+[dev-operations.md](../skills/spur-dev/references/dev-operations.md#9-gitmsg): one bounded diff
+capture, concern grouping, conventional `<type>(<scope>): <summary>` formatting. Two deviations
+belong to this flow: read the change set with `--all` semantics (this stage commits everything the
+gate just proved green, not only what happens to be staged), and resolve multiple concerns to a
+**single combined message** (dominant type/scope, one body bullet per concern) so the push is
+atomic. `--scope <path>` bounds the capture as usual. If the change set is empty, report
+"no changes to commit" and stop.
 
 **4 — Commit.** Stage all intended changes (`git add`) and commit with the resolved message
 (`git commit -m "$MESSAGE"`). When `--dry-run`, print the message and the copy-paste `git commit` /

package/plugins/sp/commands/dev-idea.md

@@ -20,7 +20,7 @@ contract below maps to that workflow's transitions.
 | `--approve-taste` | With `--auto`: set idea_approved + design_approved so idea-eval / design-approval do not pause. | off |
 | `--idea-approved` | Compatibility alias for idea_approved=true (subset of --approve-taste). | off |
 | `--design-approved` | Compatibility alias for design_approved=true (subset of --approve-taste). | off |
-| `--agent` `<auto\|name>` | Who runs the model-bearing ideation. The pipeline's `agent.run` stages are headless — they always dispatch a subprocess, so `--agent inline` is rejected there with the stable special error (exit 2). Use `omit` (resolves to `agent.default`), `auto` (tier-resolves an executor), or a name (pins that executor). | agent.default |
+| `--agent` `<auto\|name>` | Who runs the model-bearing ideation. The pipeline's `agent.run` stages are headless — they always dispatch a subprocess. Omission and explicit `--agent inline` resolve identically per task 0687: tier substitution plus one warning naming the substituted executor; `auto` (tier-resolves an executor); a name (pins that executor). | inline |
 
 For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag-glossary.md).
 

package/plugins/sp/commands/dev-plan.md

@@ -16,7 +16,7 @@ Wraps the **sp:spur-dev** skill.
 | `"<description>"` | Feature description to plan. | required |
 | `--feature` `<id>` | Attach to an existing feature. | omitted |
 | `--parent` `<feature-id>` | Create under a parent feature. | omitted |
-| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing planning. The planning pipeline's `agent.run` stages are headless — they always dispatch a subprocess. Explicit `--agent inline` is rejected there with the stable special error (exit 2): a headless surface cannot host a session — no dispatch, no `agent.default` fallback. Use `omit` (resolves to `agent.default`), `auto` (tier-resolves an executor), or a name (pins that executor). | agent.default |
+| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing planning. The planning pipeline's `agent.run` stages are headless — they always dispatch a subprocess. `inline` — also what omission resolves to since task 0687 — substitutes tier resolution there with one warning naming the resolved executor; `auto` (tier-resolves an executor); a name (pins that executor). | inline |
 | `--skip-design` | Omit the system-design hop. | off |
 | `--auto` | Skip objective HITL gates. | off |
 | `--approve-taste` | With --auto: skip design-approval pause. | off |

package/plugins/sp/commands/dev-run.md

@@ -15,7 +15,7 @@ Wraps the **sp:spur-dev** and **sp:code-implementation** skills.
 | --- | --- | --- |
 | `<wbs>` | Task WBS to run. | required |
 | `--mode` `<full\|implement>` | Full pipeline or single implement step. | full |
-| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing stages. In an interactive session, omit/`inline` keeps the controller in the host session (non-subprocess) — **omit**'s eligible full-mode `agent.run` stages may dispatch once to a native subagent, with host fallback (task 0508); explicit `--agent inline` is the zero-dispatch carve-out (every stage executes in the invoking session, never a native subagent). `auto` or a name keeps subprocess dispatch. | omit |
+| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing stages. omit and explicit `--agent inline` resolve identically (task 0687): eligible stages dispatch once to a native subagent with host-session fallback (0508 eligibility); otherwise every stage executes in the invoking session. `auto` or a name keeps subprocess dispatch.. | omit |
 | `--auto` | Skip objective HITL confirmations. | off |
 | `--next` | Chain-to-completion via the next-router. | off |
 | `--wrap` | Run the wrap hop after the main step. The `--agent` selector is preserved into the `/sp:dev-wrap <wbs>` handoff when supplied; omission remains omission. The wrap hop is workflow-backed and reports its trigger-3 subprocess override. | off |
@@ -39,7 +39,7 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 **Flags:**
 
-- `--auto` | `--agent <inline|auto|name>` — Skip objective HITL confirmations (taste/irreversible gates still pause). `--agent` names who does the model-bearing work. Interactive omit/`inline` keeps the controller and implement-only stages in this session; full mode reads `task-pipeline.yaml` as the SSOT and interprets its actions/guards through the inline driver, where **omitted** `--agent`'s eligible `agent.run` stages may dispatch once to a native subagent and otherwise run in the host (task 0508); explicit `--agent inline` is the zero-dispatch carve-out — every stage executes in the invoking session. It records `stage <id> executed inline in session <session-id>` or `stage <id> executed via subagent <agent-id> (host session <session-id>)` in the run log. `auto` or a name is merged into `vars.agent` and `vars.implementAgent` and keeps the existing subprocess workflow. Headless `spur workflow run` / `spur agent run` is unchanged. See the [execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
+- `--auto` | `--agent <inline|auto|name>` — Skip objective HITL confirmations (taste/irreversible gates still pause). `--agent` names who does the model-bearing work. Interactive omit/`inline` keeps the controller and implement-only stages in this session; full mode reads `task-pipeline.yaml` as the SSOT and interprets its actions/guards through the inline driver, whose eligible `agent.run` stages dispatch once to a native subagent and otherwise run in the host (0508 eligibility — task 0687 resolved-inline) It records `stage <id> executed inline in session <session-id>` or `stage <id> executed via subagent <agent-id> (host session <session-id>)` in the run log. `auto` or a name is merged into `vars.agent` and `vars.implementAgent` and keeps the existing subprocess workflow. Headless `spur workflow run` / `spur agent run` is unchanged. See the [execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
 
 `--worktree` `[<name>]` (run the task's pipeline in an isolated git worktree — FF-merge onto the
 base ref on full success, retain intact on any failure/halt/non-FF; bare form creates a fresh tree,

package/plugins/sp/commands/dev-runall.md

@@ -18,7 +18,7 @@ Wraps the **sp:spur-dev** skill.
 | `--mode` `<sequential\|parallel>` | Batch execution order. | sequential |
 | `--keep-going` | Continue past per-task failures. | off |
 | `--auto` | Skip objective HITL gates. | off |
-| `--agent` `<inline\|auto\|name>` | Who runs each task's pipeline stages. Interactive sequential omit/`inline` uses the host-session driver — host-controlled; **omit**'s eligible `agent.run` stages may use a native subagent (task 0508); explicit `--agent inline` is the zero-dispatch carve-out (every stage executes in the invoking session). `auto`, a name, parallel mode, and headless invocation use subprocesses. | omit |
+| `--agent` `<inline\|auto\|name>` | Who runs each task's pipeline stages. Interactive sequential omit/`inline` uses the host-session driver with unified inline semantics (task 0687 — see below)). `auto`, a name, parallel mode, and headless invocation use subprocesses. | omit |
 | `--json` | Emit structured JSON. | off |
 | `--wrap` | Run the wrap hop per task. The `--agent` selector is preserved into each `/sp:dev-wrap <wbs>` handoff when supplied; omission remains omission. | off |
 | `--next` | Chain-to-completion via the next-router. | off |
@@ -81,6 +81,6 @@ full distinction.
 
 ## Implementation
 
-- Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface). Interactive sequential omit/`inline` keeps the orchestrator in the host session through the [inline pipeline driver](../skills/spur-dev/references/inline-pipeline-driver.md); **omitted** `--agent`'s eligible `agent.run` stages may dispatch once to a native subagent with host fallback (task 0508); explicit `--agent inline` is the zero-dispatch carve-out. `--agent auto`, a name, or parallel mode retains the isolated per-task workflow boundary.
+- Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface). Interactive sequential omit/`inline` keeps the orchestrator in the host session through the [inline pipeline driver](../skills/spur-dev/references/inline-pipeline-driver.md); the resolved selector applies uniformly — eligible `agent.run` stages dispatch once to a native subagent with host fallback (0508). `--agent auto`, a name, or parallel mode retains the isolated per-task workflow boundary.
 - Interactive sequential omit/inline: `Skill(skill="sp:spur-dev", args="runall-inline $ARGUMENTS")`.
 - Explicit executor or parallel mode: `Skill(skill="sp:spur-dev", args="runall $ARGUMENTS")` → `sp:super-planner` agent.

package/plugins/sp/commands/dev-wrap.md

@@ -14,7 +14,7 @@ Wraps the **wrapup-pipeline.yaml** workflow.
 | Flag | Description | Default |
 | --- | --- | --- |
 | `<wbs>` | Task WBS to wrap. | required |
-| `--agent` `<inline\|auto\|name>` | Who runs the wrap's model-bearing steps. Wrap is workflow-backed (headless): `omit` resolves to `agent.default` (objective trigger 3 — durable auditable run record required); explicit `--agent inline` is rejected with the stable special error — a headless workflow surface cannot host a session; `auto` tier-resolves an executor; a name pins that executor into `vars.agent`. | agent.default |
+| `--agent` `<inline\|auto\|name>` | Who runs the wrap's model-bearing steps. Wrap is workflow-backed (headless): `omit` and `--agent inline` resolve identically per task 0687 — tier substitution under objective trigger 3 (durable auditable run record required) with a warning naming the substituted executor; `auto` tier-resolves an executor; a name pins that executor into `vars.agent`. | inline |
 | `--auto` | Skip objective HITL gates. | off |
 | `--merge` | Merge the wrap branch. | off |
 | `--dry-run` | Render the wrap without writing. | off |
@@ -32,13 +32,13 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 - Resolve the executor **before** launching the workflow:
   - `--agent <name>` → pass the name unchanged into `vars.agent`.
   - `--agent auto` → tier-resolve a concrete executor first, then merge it into `vars.agent`.
-  - omit → resolve to `agent.default`; explicit `--agent inline` → rejected with the stable special error (headless surface — no dispatch, no `agent.default` fallback).
+  - omit and explicit `--agent inline` resolve identically (task 0687): tier substitution plus one warning naming the resolved executor (headless surface).
 - Emit a pre-dispatch notice naming the override before `spur workflow run`, exactly:
-  `execution surface: subprocess`, `reason: trigger 3 — durable auditable run record required`, `requested agent: inline|auto|<name>` (explicit `inline` rejects before dispatch — no executor resolves), `executor: agent.default|<resolved-name>`.
+  `execution surface: subprocess`, `reason: trigger 3 — durable auditable run record required`, `requested agent: inline|auto|<name>` (explicit `inline` substitutes tier resolution and warns), `executor: <substituted-name>|<resolved-name>`.
 - The wrap workflow still creates its durable run record (task_run_links / trace) — the notice reports the override, it does not change the workflow.
 
 ```bash
-AGENT=… # resolved above: agent.default for omitted, tier-resolved for auto, unchanged for <name>; explicit inline errors (headless)
+AGENT=… # omit≡inline → tier-substituted executor + warning; auto tier-resolved; <name> unchanged
 echo "execution surface: subprocess; reason: trigger 3 — durable auditable run record required; requested agent: <inline|auto|name>; executor: $AGENT"
 VARS=$(jq -nc --arg tasks "[\"$WBS\"]" --arg agent "$AGENT" --arg profile "$PROFILE" --arg merge "$MERGE" \
   '{tasks:$tasks, agent:$agent, profile:$profile, merge:$merge}')
@@ -46,5 +46,4 @@ spur workflow run wrapup-pipeline.yaml --vars "$VARS" [--dry-run]
 ```
 
 The executor resolution is described in the bullets above; the snippet's `AGENT` variable carries
-the resolved name (`agent.default` for omitted `--agent`; explicit `--agent inline` is rejected
-before dispatch).
+the resolved name (omit ≡ explicit `inline`; both tier-substitute with a warning).

package/plugins/sp/commands/dev-wrapall.md

@@ -16,7 +16,7 @@ Wraps the **wrapup-pipeline.yaml** workflow.
 | `--since` `<iso-date>` | Wrap tasks completed since a date. | configured |
 | `--feature` `<id>` | Wrap tasks in a feature. | omitted |
 | `--status` `<s>` | Only wrap tasks in a status. | done |
-| `--agent` `<inline\|auto\|name>` | Who runs the wrap's model-bearing steps. Wrap is workflow-backed (headless): `omit` resolves to `agent.default` (objective trigger 3 — durable auditable run record required); explicit `--agent inline` is rejected with the stable special error — a headless workflow surface cannot host a session; `auto` tier-resolves an executor; a name pins that executor into `vars.agent`. | agent.default |
+| `--agent` `<inline\|auto\|name>` | Who runs the wrap's model-bearing steps. Wrap is workflow-backed (headless): `omit` and `--agent inline` resolve identically per task 0687 — tier substitution under objective trigger 3 (durable auditable run record required) with a warning naming the substituted executor; `auto` tier-resolves an executor; a name pins that executor into `vars.agent`. | inline |
 | `--auto` | Skip objective HITL gates. | off |
 | `--merge` | Merge wrap branches. | off |
 | `--dry-run` | Render wraps without writing. | off |
@@ -34,13 +34,13 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 - Resolve the executor **before** launching the workflow:
   - `--agent <name>` → pass the name unchanged into `vars.agent`.
   - `--agent auto` → tier-resolve a concrete executor first, then merge it into `vars.agent`.
-  - omit → resolve to `agent.default`; explicit `--agent inline` → rejected with the stable special error (headless surface — no dispatch, no `agent.default` fallback).
+  - omit and explicit `--agent inline` resolve identically (task 0687): tier substitution plus one warning naming the resolved executor (headless surface).
 - Emit a pre-dispatch notice naming the override before `spur workflow run`, exactly:
-  `execution surface: subprocess`, `reason: trigger 3 — durable auditable run record required`, `requested agent: inline|auto|<name>` (explicit `inline` rejects before dispatch — no executor resolves), `executor: agent.default|<resolved-name>`.
+  `execution surface: subprocess`, `reason: trigger 3 — durable auditable run record required`, `requested agent: inline|auto|<name>` (explicit `inline` substitutes tier resolution and warns), `executor: <substituted-name>|<resolved-name>`.
 - The wrap workflow still creates its durable run record — the notice reports the override, it does not change the workflow.
 
 ```bash
-AGENT=… # resolved above: agent.default for omitted, tier-resolved for auto, unchanged for <name>; explicit inline errors (headless)
+AGENT=… # omit≡inline → tier-substituted executor + warning; auto tier-resolved; <name> unchanged
 echo "execution surface: subprocess; reason: trigger 3 — durable auditable run record required; requested agent: <inline|auto|name>; executor: $AGENT"
 VARS=$(jq -nc --arg tasks "$TASKS" --arg feature "$FEATURE" --arg agent "$AGENT" --arg profile "$PROFILE" --arg merge "$MERGE" \
   '{tasks:$tasks, feature:$feature, agent:$agent, profile:$profile, merge:$merge}')
@@ -48,6 +48,4 @@ spur workflow run wrapup-pipeline.yaml --vars "$VARS" [--dry-run]
 ```
 
 The executor resolution is described in the bullets above; the snippet's `AGENT` variable carries
-the resolved name (`agent.default` for omitted `--agent`; explicit `--agent inline` is rejected
-before dispatch).
-
+the resolved name (omit ≡ explicit `inline`; both tier-substitute with a warning).

package/plugins/sp/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "sp",
-    "version": "0.3.63",
+    "version": "0.3.64",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics.",
     "extensions": {
         "pi": ["./hooks/pi/guard-extension.ts"]

package/plugins/sp/scripts/history-anatomy-cache.mjs

@@ -404,8 +404,9 @@ function dayBounds(tz, ymd) {
   };
 }
 function resolvePaths(opts) {
-  const pluginRoot = opts.helper.replace(/\/scripts\/[^/]+$/, "");
-  const skill = `${pluginRoot}/skills/history-anatomy`;
+  const m = opts.helper.match(/\/scripts\/(?:([^/]+)\/)?[^/]+$/);
+  const pluginRoot = m ? opts.helper.slice(0, m.index) : opts.helper;
+  const skill = `${pluginRoot}/skills/${m?.[1] ? `${m[1]}-history-anatomy` : "history-anatomy"}`;
   const tz = opts.tz ?? Intl.DateTimeFormat().resolvedOptions().timeZone ?? "UTC";
   const date = opts.date !== undefined && opts.date !== "" ? opts.date : localDay(tz, opts.now ?? new Date);
   const target = opts.output !== undefined && opts.output !== "" ? opts.output : `${opts.reportDir}/${date}-history-anatomy.md`;

package/plugins/sp/scripts/history-anatomy-cache.ts

@@ -563,8 +563,13 @@ export function resolvePaths(opts: {
     since?: string;
     until?: string;
 }): string {
-    const pluginRoot = opts.helper.replace(/\/scripts\/[^/]+$/, '');
-    const skill = `${pluginRoot}/skills/history-anatomy`;
+    // Layouts: monorepo `<root>/scripts/<file>` → skill `<root>/skills/history-anatomy`;
+    // superskill-installed `<root>/scripts/<plugin>/<file>` → skill `<root>/skills/<plugin>-history-anatomy`.
+    // (0660 dogfood 2026-08-26: the single-segment strip left HA_SKILL bogus on installed layouts,
+    // silently degrading probe contract/skill digests to "not available".)
+    const m = opts.helper.match(/\/scripts\/(?:([^/]+)\/)?[^/]+$/);
+    const pluginRoot = m ? opts.helper.slice(0, m.index) : opts.helper;
+    const skill = `${pluginRoot}/skills/${m?.[1] ? `${m[1]}-history-anatomy` : 'history-anatomy'}`;
     const tz = opts.tz ?? Intl.DateTimeFormat().resolvedOptions().timeZone ?? 'UTC';
     const date = opts.date !== undefined && opts.date !== '' ? opts.date : localDay(tz, opts.now ?? new Date());
     const target =

package/plugins/sp/skills/dogfood-testing/SKILL.md

@@ -48,7 +48,7 @@ testee (a /sp:... command, Skill(...), or shell CLI invocation)
 The command forwards these via `$ARGUMENTS`:
 
 | Argument | Description | Default |
-|----------|-------------|---------|
+| ---------- | ------------- | --------- |
 | `testee` | What to exercise — a slash command, agent skill, or CLI invocation (positional, required). Quote it if it contains flags. | (required) |
 | `--agent <name\|auto>` | **Testee-scoped** agent: the agent the **testee** runs under, forwarded into the testee invocation. The driver (this skill) always runs in the current session. **Omit it** to forward nothing — the testee runs under its own default. See [§Testee-scoped agent](#testee-scoped-agent). | (omitted → forward nothing) |
 | `--max-retry <n>` | Fix attempts per failed step. The **default is `2`** (fix mode): apply `Edit`/`Write` fixes to the working tree, up to 2 attempts per step. This flag is **mandatory** for two independent mutation sources: (a) pipeline-driving testees and (b) testees carrying a mutating `--fix` mode (`--fix all` / `--fix blockers-first`). Pass `--max-retry 0` for **observe-only**, or `--max-retry N` to acknowledge fix-mode mutation risk. For a mutating-`--fix` testee, `--max-retry 0` bounds the **driver only** — the testee still mutates the tree. | `2` unless the testee is pipeline-driving or carries a mutating `--fix` mode |
@@ -239,6 +239,7 @@ Full section contract, frontmatter, Cost shape, and footer:
 **[report-template.md](references/report-template.md)**.
 
 **Sinks** (composable):
+
 - **Always-on report files** → live + `docs/dogfood/YYYY-MM-DD-<testee-slug>-dogfood.md` (see Phase 1).
 - `--save` → no-op for delivery; still print/document the report path (back-compat).
 - `--task` → file findings as a review task (`spur task create --template review`), writing the
@@ -276,6 +277,7 @@ which always launches a fresh agent subprocess.
 - Producing a structured findings report (and optionally a fix task) from a real run.
 
 Do **not** use this skill for:
+
 - Requirements-traceability verdicts — use `sp:code-verification` (`/sp:dev-verify`).
 - SECU code review of a diff — use `sp:code-verification` (`/sp:dev-review`).
 - Running a task through the fix pipeline — use `sp:spur-dev` (`/sp:dev-run`).
@@ -606,3 +608,14 @@ Findings (P1+P2):
 A report missing any of the six headings, the on-disk live ledger, dual paths, terminal `status`,
 the Cost block, or this footer does not satisfy the dogfood contract on this platform, regardless
 of `Skill()` availability.
+
+## Engine-driven testees under a sandboxed session
+
+A subprocess executor dies at startup, not at model time, when `.claude/settings.json` denies
+it its state directory (`~/.pi`, `~/.grok`, `~/.gemini`, `~/.codex`, `~/.cache`) or local
+socket binding. Signals: `EPERM: operation not permitted`, `FS_PERMISSION_DENIED`,
+`bind: operation not permitted`. Two affordances must be granted and the session restarted:
+`sandbox.filesystem.allowWrite` covering the executor home dirs, and
+`sandbox.network.allowLocalBinding`. Caveat: `spur agent doctor` reports `usable: true` from
+configuration alone — it never probes a real dispatch, so `usable` means *configured*, not
+*proven runnable under this sandbox*.

package/plugins/sp/skills/history-anatomy/references/report-contract.md

@@ -175,6 +175,14 @@ proposal-only: no applied change, no diff, and no command the report claims to h
 The final section lists, for every finding, the artifact anchor(s) and any cited `file:line`,
 so a reader can verify the report's claims against the evidence plane.
 
+Every row MUST name the artifact path in backticks — the deterministic structure gate's
+`evidence-claim-without-anchor` check matches `` `[^`]+\.(md|ts|json)` `` or a
+`path:line` — never a bare `current`/`baseline` label. Write each anchor as:
+
+```text
+`telemetry:history-analyze:duration-coverage-gap` | `.spur/run/<runId>-history-anatomy-current.json` — `#/warnings/0`, `#/derived/timeDecomposition`, `#/stepSupport`
+```
+
 ## Truthfulness invariants
 
 - `not available` is the true rendering for an unsupported dimension, never a masked gap.

package/plugins/sp/skills/next-router/SKILL.md

@@ -42,12 +42,12 @@ silently (that is a HITL stop).
 ## Inputs
 
 | Input | Semantics |
-|-------|-----------|
+| ------- | ----------- |
 | `target` | Task WBS (digits), task `.md` path, or feature id (`^[A-Z][1-9]*$`). Required for dispatch; omit → stop **U1** (usage). |
 | `--dry-run` | Print the resolved plan (**P1**) and do not dispatch. |
 | `--once` | Strip `--next` from the shaped child argv so only the current step runs; no router re-entry. |
 | `--auto` | Forward into dispatched children that support it. **Never** breaks multi-candidate HITL ties. |
-| `--agent <inline\|auto\|name>` | Execution-surface selector forwarded into the dispatched child when that child documents `--agent`. Router defaults to omit semantics: Omit forwards nothing, and the dispatched child applies its own default (host session, 0508 eligibility). Explicit `--agent inline` is the zero-dispatch carve-out, forwarded as-is; escalation triggers reject `inline` (no override). |
+| `--agent <inline\|auto\|name>` | Execution-surface selector forwarded into the dispatched child when that child documents `--agent`. Router defaults to omit semantics: Omit forwards nothing, and the dispatched child applies its own default (`inline`, task 0687 — native-subagent-first with host fallback). Explicit `--agent inline` is forwarded as-is and resolves identically; escalation triggers take precedence over `inline`. |
 | `--full` | When the primary route is `dev-run … --next`, substitute `dev-run <wbs> --mode full` (no `--next`). No effect on non-run routes → warning **W-FULL**. |
 
 ## Protocol (deterministic)
@@ -126,7 +126,7 @@ but redundant. See the glossary entry for the disambiguation in full.
 **[references/messages.md](references/messages.md)** (exact templates, prefixed `dev-next:`). The router fires them by id:
 
 | Id | Fires when | Kind |
-|----|-----------|------|
+| ---- | ----------- | ------ |
 | U1 | no target | stop — usage |
 | U2 | target unresolvable | stop |
 | U3 | no route (table miss / cancelled) | stop |
@@ -147,7 +147,7 @@ bypass lifecycle guards (`--no-lifecycle`) to force progress.
 ## Common Rationalizations
 
 | Rationalization | Reality |
-|---|---|
+| --- | --- |
 | "Two candidates are both fine — pick the higher-priority one." | Multi-candidate is a HITL stop (routing-table §4). A silent pick hides a real fork from the operator; print the decision-brief. |
 | "The task is todo, so run the full pipeline to be safe." | Full mode is not the v1 default (non-route). A3 dispatches the `--next` chain link; `--full` exists for the explicit override. |
 | "I can loop dev-next until the task is done." | Step budget is one dispatch per invocation. Self-looping makes token cost unbounded; the operator re-invokes after non-chain dispatches. |

package/plugins/sp/skills/pr-reviewing/SKILL.md

@@ -86,11 +86,10 @@ Parse the first positional argument as the mode; default `full`.
 - `--agent <inline|auto|name>` — names **who performs model-bearing work**, per the
   [inline-default execution-surface contract](../spur-dev/references/cross-cutting.md#inline-default-execution-surface).
   Omit: the current agent is the default owner (eligible model stages may use one native subagent
-  under the shared contract). `inline` keeps all model work in the host session as the hard
-  zero-dispatch guarantee. `auto` resolves the command's declared role; a named executor pins that executor.
+  under the shared contract). `inline` (also what omission resolves to, task 0687) keeps model work in the host session — native-subagent-first with host fallback where eligible `auto` resolves the command's declared role; a named executor pins that executor.
   An alternate executor gets one `spur agent run --agent <value>` dispatch with the selector removed
   from child args; that child owns model work. Current-agent selection stays inline.
-  Headless surfaces reject explicit `inline` with the shared stable error.
+  Headless surfaces substitute tier resolution for `inline` with a warning (task 0687), never refusing.
 - `--agent` describes the model owner only; it is independent of the deterministic git/GitHub spine
   and the workflow/direct route. Run the selected route in that resolved skill context. A separate
   workflow subprocess belongs to the caller's execution surface or an objective trigger (for example,