@gobing-ai/spur 0.3.63 → 0.3.65

package/plugins/sp/commands/dev-runall.md

@@ -18,7 +18,7 @@ Wraps the **sp:spur-dev** skill.
 | `--mode` `<sequential\|parallel>` | Batch execution order. | sequential |
 | `--keep-going` | Continue past per-task failures. | off |
 | `--auto` | Skip objective HITL gates. | off |
-| `--agent` `<inline\|auto\|name>` | Who runs each task's pipeline stages. Interactive sequential omit/`inline` uses the host-session driver — host-controlled; **omit**'s eligible `agent.run` stages may use a native subagent (task 0508); explicit `--agent inline` is the zero-dispatch carve-out (every stage executes in the invoking session). `auto`, a name, parallel mode, and headless invocation use subprocesses. | omit |
+| `--agent` `<inline\|auto\|name>` | Who runs each task's pipeline stages. Interactive sequential omit/`inline` uses the host-session driver with unified inline semantics (task 0687 — see below)). `auto`, a name, parallel mode, and headless invocation use subprocesses. | omit |
 | `--json` | Emit structured JSON. | off |
 | `--wrap` | Run the wrap hop per task. The `--agent` selector is preserved into each `/sp:dev-wrap <wbs>` handoff when supplied; omission remains omission. | off |
 | `--next` | Chain-to-completion via the next-router. | off |
@@ -81,6 +81,6 @@ full distinction.
 
 ## Implementation
 
-- Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface). Interactive sequential omit/`inline` keeps the orchestrator in the host session through the [inline pipeline driver](../skills/spur-dev/references/inline-pipeline-driver.md); **omitted** `--agent`'s eligible `agent.run` stages may dispatch once to a native subagent with host fallback (task 0508); explicit `--agent inline` is the zero-dispatch carve-out. `--agent auto`, a name, or parallel mode retains the isolated per-task workflow boundary.
+- Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface). Interactive sequential omit/`inline` keeps the orchestrator in the host session through the [inline pipeline driver](../skills/spur-dev/references/inline-pipeline-driver.md); the resolved selector applies uniformly — eligible `agent.run` stages dispatch once to a native subagent with host fallback (0508). `--agent auto`, a name, or parallel mode retains the isolated per-task workflow boundary.
 - Interactive sequential omit/inline: `Skill(skill="sp:spur-dev", args="runall-inline $ARGUMENTS")`.
 - Explicit executor or parallel mode: `Skill(skill="sp:spur-dev", args="runall $ARGUMENTS")` → `sp:super-planner` agent.

package/plugins/sp/commands/dev-wrap.md

@@ -14,7 +14,7 @@ Wraps the **wrapup-pipeline.yaml** workflow.
 | Flag | Description | Default |
 | --- | --- | --- |
 | `<wbs>` | Task WBS to wrap. | required |
-| `--agent` `<inline\|auto\|name>` | Who runs the wrap's model-bearing steps. Wrap is workflow-backed (headless): `omit` resolves to `agent.default` (objective trigger 3 — durable auditable run record required); explicit `--agent inline` is rejected with the stable special error — a headless workflow surface cannot host a session; `auto` tier-resolves an executor; a name pins that executor into `vars.agent`. | agent.default |
+| `--agent` `<inline\|auto\|name>` | Who runs the wrap's model-bearing steps. Wrap is workflow-backed (headless): `omit` and `--agent inline` resolve identically per task 0687 — tier substitution under objective trigger 3 (durable auditable run record required) with a warning naming the substituted executor; `auto` tier-resolves an executor; a name pins that executor into `vars.agent`. | inline |
 | `--auto` | Skip objective HITL gates. | off |
 | `--merge` | Merge the wrap branch. | off |
 | `--dry-run` | Render the wrap without writing. | off |
@@ -32,13 +32,13 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 - Resolve the executor **before** launching the workflow:
   - `--agent <name>` → pass the name unchanged into `vars.agent`.
   - `--agent auto` → tier-resolve a concrete executor first, then merge it into `vars.agent`.
-  - omit → resolve to `agent.default`; explicit `--agent inline` → rejected with the stable special error (headless surface — no dispatch, no `agent.default` fallback).
+  - omit and explicit `--agent inline` resolve identically (task 0687): tier substitution plus one warning naming the resolved executor (headless surface).
 - Emit a pre-dispatch notice naming the override before `spur workflow run`, exactly:
-  `execution surface: subprocess`, `reason: trigger 3 — durable auditable run record required`, `requested agent: inline|auto|<name>` (explicit `inline` rejects before dispatch — no executor resolves), `executor: agent.default|<resolved-name>`.
+  `execution surface: subprocess`, `reason: trigger 3 — durable auditable run record required`, `requested agent: inline|auto|<name>` (explicit `inline` substitutes tier resolution and warns), `executor: <substituted-name>|<resolved-name>`.
 - The wrap workflow still creates its durable run record (task_run_links / trace) — the notice reports the override, it does not change the workflow.
 
 ```bash
-AGENT=… # resolved above: agent.default for omitted, tier-resolved for auto, unchanged for <name>; explicit inline errors (headless)
+AGENT=… # omit≡inline → tier-substituted executor + warning; auto tier-resolved; <name> unchanged
 echo "execution surface: subprocess; reason: trigger 3 — durable auditable run record required; requested agent: <inline|auto|name>; executor: $AGENT"
 VARS=$(jq -nc --arg tasks "[\"$WBS\"]" --arg agent "$AGENT" --arg profile "$PROFILE" --arg merge "$MERGE" \
   '{tasks:$tasks, agent:$agent, profile:$profile, merge:$merge}')
@@ -46,5 +46,4 @@ spur workflow run wrapup-pipeline.yaml --vars "$VARS" [--dry-run]
 ```
 
 The executor resolution is described in the bullets above; the snippet's `AGENT` variable carries
-the resolved name (`agent.default` for omitted `--agent`; explicit `--agent inline` is rejected
-before dispatch).
+the resolved name (omit ≡ explicit `inline`; both tier-substitute with a warning).

package/plugins/sp/commands/dev-wrapall.md

@@ -16,7 +16,7 @@ Wraps the **wrapup-pipeline.yaml** workflow.
 | `--since` `<iso-date>` | Wrap tasks completed since a date. | configured |
 | `--feature` `<id>` | Wrap tasks in a feature. | omitted |
 | `--status` `<s>` | Only wrap tasks in a status. | done |
-| `--agent` `<inline\|auto\|name>` | Who runs the wrap's model-bearing steps. Wrap is workflow-backed (headless): `omit` resolves to `agent.default` (objective trigger 3 — durable auditable run record required); explicit `--agent inline` is rejected with the stable special error — a headless workflow surface cannot host a session; `auto` tier-resolves an executor; a name pins that executor into `vars.agent`. | agent.default |
+| `--agent` `<inline\|auto\|name>` | Who runs the wrap's model-bearing steps. Wrap is workflow-backed (headless): `omit` and `--agent inline` resolve identically per task 0687 — tier substitution under objective trigger 3 (durable auditable run record required) with a warning naming the substituted executor; `auto` tier-resolves an executor; a name pins that executor into `vars.agent`. | inline |
 | `--auto` | Skip objective HITL gates. | off |
 | `--merge` | Merge wrap branches. | off |
 | `--dry-run` | Render wraps without writing. | off |
@@ -34,13 +34,13 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 - Resolve the executor **before** launching the workflow:
   - `--agent <name>` → pass the name unchanged into `vars.agent`.
   - `--agent auto` → tier-resolve a concrete executor first, then merge it into `vars.agent`.
-  - omit → resolve to `agent.default`; explicit `--agent inline` → rejected with the stable special error (headless surface — no dispatch, no `agent.default` fallback).
+  - omit and explicit `--agent inline` resolve identically (task 0687): tier substitution plus one warning naming the resolved executor (headless surface).
 - Emit a pre-dispatch notice naming the override before `spur workflow run`, exactly:
-  `execution surface: subprocess`, `reason: trigger 3 — durable auditable run record required`, `requested agent: inline|auto|<name>` (explicit `inline` rejects before dispatch — no executor resolves), `executor: agent.default|<resolved-name>`.
+  `execution surface: subprocess`, `reason: trigger 3 — durable auditable run record required`, `requested agent: inline|auto|<name>` (explicit `inline` substitutes tier resolution and warns), `executor: <substituted-name>|<resolved-name>`.
 - The wrap workflow still creates its durable run record — the notice reports the override, it does not change the workflow.
 
 ```bash
-AGENT=… # resolved above: agent.default for omitted, tier-resolved for auto, unchanged for <name>; explicit inline errors (headless)
+AGENT=… # omit≡inline → tier-substituted executor + warning; auto tier-resolved; <name> unchanged
 echo "execution surface: subprocess; reason: trigger 3 — durable auditable run record required; requested agent: <inline|auto|name>; executor: $AGENT"
 VARS=$(jq -nc --arg tasks "$TASKS" --arg feature "$FEATURE" --arg agent "$AGENT" --arg profile "$PROFILE" --arg merge "$MERGE" \
   '{tasks:$tasks, feature:$feature, agent:$agent, profile:$profile, merge:$merge}')
@@ -48,6 +48,4 @@ spur workflow run wrapup-pipeline.yaml --vars "$VARS" [--dry-run]
 ```
 
 The executor resolution is described in the bullets above; the snippet's `AGENT` variable carries
-the resolved name (`agent.default` for omitted `--agent`; explicit `--agent inline` is rejected
-before dispatch).
-
+the resolved name (omit ≡ explicit `inline`; both tier-substitute with a warning).

package/plugins/sp/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "sp",
-    "version": "0.3.63",
+    "version": "0.3.65",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics.",
     "extensions": {
         "pi": ["./hooks/pi/guard-extension.ts"]

package/plugins/sp/references/environment-lens.md

@@ -9,7 +9,8 @@ shipped or invoked by anything in this plugin.)
 Neither report projection restates the table below; each links here as its category table
 (task 0686 / feature I9; accepted design `docs/design/environment-improvement-lens.md`,
 ADR-084/085). There is deliberately no `/sp:dev-retro` command, no CLI change, and no protocol
-bump behind this mapping.
+bump behind this mapping. `sp:session-review` consumes only the placement rule for supported
+live-session proposals; it adds no category projection or imported-history analysis owner (ADR-089).
 
 ## Canonical categories and projections
 
@@ -58,7 +59,8 @@ create` handoff, manual edit), which remain explicit human gates.
 ## Keep / drop boundary
 
 Kept here because both live reports consume it: the seven names above, their projections, and
-this placement rule. Dropped (each needs its own operator decision): installing or invoking the
+this placement rule. The active-session reviewer may apply the placement rule without copying the
+table. Dropped (each needs its own operator decision): installing or invoking the
 out-of-tree retro practice, a standalone retro command, `CODING_STANDARDS.md` as a file, runtime
 parsing of this markdown by validators, automatic remediation of environment findings, and
 folding the lens into wrap-up learnings or `.spur/context/` memory.

package/plugins/sp/references/roles.md

@@ -58,7 +58,7 @@ roles:
     stages: [implement, test, wrap]
   - id: reviewer
     tier: capable-1
-    commands: [dev-verify, dev-verifyall, dev-review, dev-pr-review, dev-dogfood, rule-scan, dev-find-conflict, dev-find-issue]
+    commands: [dev-verify, dev-verifyall, dev-review, dev-review-session, dev-pr-review, dev-dogfood, rule-scan, dev-find-conflict, dev-find-issue]
     stages: [verify, review, dogfood]
   - id: planner
     tier: capable-2
@@ -81,9 +81,11 @@ must not sit below the highest `min_tier` among its folded stages.
   simplification, fix-everything sweeps, reverse engineering, wrap-up, and the end-to-end
   delivery flow (`dev-gtd`). Folds `implement`, `test`, `wrap`.
 - **`reviewer` (capable-1).** Verification and analysis: per-task verify/review, batch verify,
-  dogfooding, anti-pattern scanning (`rule-scan`), and the two audit commands (`dev-find-conflict`,
-  `dev-find-issue`) — those analyse rather than transcribe, which is why they sit here and not
-  under `scribe`. `dev-find-issue` now routes through the `sp:history-anatomy` skill (mode contract + report contract). Folds `verify`, `review`, `dogfood`.
+  dogfooding, anti-pattern scanning (`rule-scan`), immediate session review, and the two audit
+  commands (`dev-find-conflict`, `dev-find-issue`) — those analyse rather than transcribe, which is
+  why they sit here and not under `scribe`. `dev-find-issue` routes through `sp:history-anatomy`;
+  `dev-review-session` routes through `sp:session-review` in the active host context. Folds
+  `verify`, `review`, `dogfood`.
 - **`planner` (capable-2).** The planning half: feature planning, requirement refinement (single
   and batch), brainstorm, idea intake, batch run/parallel orchestration, next-step routing,
   architecture survey, feature-frontier prioritization, and feature-tree restructure. Folds `plan`,
@@ -96,7 +98,8 @@ same stage logic: `dev-refineall` folds `refine` → planner; `dev-find-next` is
 frontier work → planner; `dev-feature-change` is planning-half corpus surgery on the feature tree →
 planner; `dev-gtd` is the execution/delivery flow → coder; `dev-find-conflict` and `dev-find-issue`
 are audits/analysis → reviewer (same reasoning as `rule-scan`). Later additions: `dev-pr-review` is review orchestration —
-driving the external PR review and triaging its findings folds the `review` stage → reviewer.
+driving the external PR review and triaging its findings folds the `review` stage → reviewer;
+`dev-review-session` performs evidence-backed review over the active conversation → reviewer.
 
 **Consistency is a test, not a convention.** `plugins/sp/tests/roles.test.ts` parses this YAML and
 asserts the tier-distinctness, command closure, stage-floor, and boundary invariants against the

package/plugins/sp/scripts/history-anatomy-cache.mjs

@@ -404,8 +404,9 @@ function dayBounds(tz, ymd) {
   };
 }
 function resolvePaths(opts) {
-  const pluginRoot = opts.helper.replace(/\/scripts\/[^/]+$/, "");
-  const skill = `${pluginRoot}/skills/history-anatomy`;
+  const m = opts.helper.match(/\/scripts\/(?:([^/]+)\/)?[^/]+$/);
+  const pluginRoot = m ? opts.helper.slice(0, m.index) : opts.helper;
+  const skill = `${pluginRoot}/skills/${m?.[1] ? `${m[1]}-history-anatomy` : "history-anatomy"}`;
   const tz = opts.tz ?? Intl.DateTimeFormat().resolvedOptions().timeZone ?? "UTC";
   const date = opts.date !== undefined && opts.date !== "" ? opts.date : localDay(tz, opts.now ?? new Date);
   const target = opts.output !== undefined && opts.output !== "" ? opts.output : `${opts.reportDir}/${date}-history-anatomy.md`;

package/plugins/sp/scripts/history-anatomy-cache.ts

@@ -563,8 +563,13 @@ export function resolvePaths(opts: {
     since?: string;
     until?: string;
 }): string {
-    const pluginRoot = opts.helper.replace(/\/scripts\/[^/]+$/, '');
-    const skill = `${pluginRoot}/skills/history-anatomy`;
+    // Layouts: monorepo `<root>/scripts/<file>` → skill `<root>/skills/history-anatomy`;
+    // superskill-installed `<root>/scripts/<plugin>/<file>` → skill `<root>/skills/<plugin>-history-anatomy`.
+    // (0660 dogfood 2026-08-26: the single-segment strip left HA_SKILL bogus on installed layouts,
+    // silently degrading probe contract/skill digests to "not available".)
+    const m = opts.helper.match(/\/scripts\/(?:([^/]+)\/)?[^/]+$/);
+    const pluginRoot = m ? opts.helper.slice(0, m.index) : opts.helper;
+    const skill = `${pluginRoot}/skills/${m?.[1] ? `${m[1]}-history-anatomy` : 'history-anatomy'}`;
     const tz = opts.tz ?? Intl.DateTimeFormat().resolvedOptions().timeZone ?? 'UTC';
     const date = opts.date !== undefined && opts.date !== '' ? opts.date : localDay(tz, opts.now ?? new Date());
     const target =

package/plugins/sp/skills/dogfood-testing/SKILL.md

@@ -48,7 +48,7 @@ testee (a /sp:... command, Skill(...), or shell CLI invocation)
 The command forwards these via `$ARGUMENTS`:
 
 | Argument | Description | Default |
-|----------|-------------|---------|
+| ---------- | ------------- | --------- |
 | `testee` | What to exercise — a slash command, agent skill, or CLI invocation (positional, required). Quote it if it contains flags. | (required) |
 | `--agent <name\|auto>` | **Testee-scoped** agent: the agent the **testee** runs under, forwarded into the testee invocation. The driver (this skill) always runs in the current session. **Omit it** to forward nothing — the testee runs under its own default. See [§Testee-scoped agent](#testee-scoped-agent). | (omitted → forward nothing) |
 | `--max-retry <n>` | Fix attempts per failed step. The **default is `2`** (fix mode): apply `Edit`/`Write` fixes to the working tree, up to 2 attempts per step. This flag is **mandatory** for two independent mutation sources: (a) pipeline-driving testees and (b) testees carrying a mutating `--fix` mode (`--fix all` / `--fix blockers-first`). Pass `--max-retry 0` for **observe-only**, or `--max-retry N` to acknowledge fix-mode mutation risk. For a mutating-`--fix` testee, `--max-retry 0` bounds the **driver only** — the testee still mutates the tree. | `2` unless the testee is pipeline-driving or carries a mutating `--fix` mode |
@@ -239,6 +239,7 @@ Full section contract, frontmatter, Cost shape, and footer:
 **[report-template.md](references/report-template.md)**.
 
 **Sinks** (composable):
+
 - **Always-on report files** → live + `docs/dogfood/YYYY-MM-DD-<testee-slug>-dogfood.md` (see Phase 1).
 - `--save` → no-op for delivery; still print/document the report path (back-compat).
 - `--task` → file findings as a review task (`spur task create --template review`), writing the
@@ -276,6 +277,7 @@ which always launches a fresh agent subprocess.
 - Producing a structured findings report (and optionally a fix task) from a real run.
 
 Do **not** use this skill for:
+
 - Requirements-traceability verdicts — use `sp:code-verification` (`/sp:dev-verify`).
 - SECU code review of a diff — use `sp:code-verification` (`/sp:dev-review`).
 - Running a task through the fix pipeline — use `sp:spur-dev` (`/sp:dev-run`).
@@ -606,3 +608,22 @@ Findings (P1+P2):
 A report missing any of the six headings, the on-disk live ledger, dual paths, terminal `status`,
 the Cost block, or this footer does not satisfy the dogfood contract on this platform, regardless
 of `Skill()` availability.
+
+## Engine-driven testees under a sandboxed session
+
+A subprocess executor dies at startup, not at model time, when `.claude/settings.json` denies
+it its state directory (`~/.pi`, `~/.grok`, `~/.gemini`, `~/.codex`, `~/.cache`) or local
+socket binding. Signals: `EPERM: operation not permitted`, `FS_PERMISSION_DENIED`,
+`bind: operation not permitted`. Two affordances must be granted and the session restarted:
+`sandbox.filesystem.allowWrite` covering the executor home dirs, and
+`sandbox.network.allowLocalBinding`. Caveat: `spur agent doctor` reports `usable: true` from
+configuration alone — it never probes a real dispatch, so `usable` means *configured*, not
+*proven runnable under this sandbox*.
+
+Related operator-local trap (spur task 0689): adding a `permissions.allow` `write_file(**)` entry
+to an executor's own settings (e.g. `~/.gemini/antigravity-cli/settings.json`) is an **operator-
+local unblock, not the shipped fix**. It is per-machine and untracked, and it **masks shim
+regressions in local end-to-end runs**: a broken headless dispatch looks green on the patched
+machine while failing on every other machine and in CI. The fix belongs in the executor shim
+(print-mode permission affordance); keep the allow entry, if at all, as a documented convenience
+and never as the reason a run passes.

package/plugins/sp/skills/history-anatomy/references/report-contract.md

@@ -175,6 +175,14 @@ proposal-only: no applied change, no diff, and no command the report claims to h
 The final section lists, for every finding, the artifact anchor(s) and any cited `file:line`,
 so a reader can verify the report's claims against the evidence plane.
 
+Every row MUST name the artifact path in backticks — the deterministic structure gate's
+`evidence-claim-without-anchor` check matches `` `[^`]+\.(md|ts|json)` `` or a
+`path:line` — never a bare `current`/`baseline` label. Write each anchor as:
+
+```text
+`telemetry:history-analyze:duration-coverage-gap` | `.spur/run/<runId>-history-anatomy-current.json` — `#/warnings/0`, `#/derived/timeDecomposition`, `#/stepSupport`
+```
+
 ## Truthfulness invariants
 
 - `not available` is the true rendering for an unsupported dimension, never a masked gap.

package/plugins/sp/skills/next-router/SKILL.md

@@ -42,12 +42,12 @@ silently (that is a HITL stop).
 ## Inputs
 
 | Input | Semantics |
-|-------|-----------|
+| ------- | ----------- |
 | `target` | Task WBS (digits), task `.md` path, or feature id (`^[A-Z][1-9]*$`). Required for dispatch; omit → stop **U1** (usage). |
 | `--dry-run` | Print the resolved plan (**P1**) and do not dispatch. |
 | `--once` | Strip `--next` from the shaped child argv so only the current step runs; no router re-entry. |
 | `--auto` | Forward into dispatched children that support it. **Never** breaks multi-candidate HITL ties. |
-| `--agent <inline\|auto\|name>` | Execution-surface selector forwarded into the dispatched child when that child documents `--agent`. Router defaults to omit semantics: Omit forwards nothing, and the dispatched child applies its own default (host session, 0508 eligibility). Explicit `--agent inline` is the zero-dispatch carve-out, forwarded as-is; escalation triggers reject `inline` (no override). |
+| `--agent <inline\|auto\|name>` | Execution-surface selector forwarded into the dispatched child when that child documents `--agent`. Router defaults to omit semantics: Omit forwards nothing, and the dispatched child applies its own default (`inline`, task 0687 — native-subagent-first with host fallback). Explicit `--agent inline` is forwarded as-is and resolves identically; escalation triggers take precedence over `inline`. |
 | `--full` | When the primary route is `dev-run … --next`, substitute `dev-run <wbs> --mode full` (no `--next`). No effect on non-run routes → warning **W-FULL**. |
 
 ## Protocol (deterministic)
@@ -126,7 +126,7 @@ but redundant. See the glossary entry for the disambiguation in full.
 **[references/messages.md](references/messages.md)** (exact templates, prefixed `dev-next:`). The router fires them by id:
 
 | Id | Fires when | Kind |
-|----|-----------|------|
+| ---- | ----------- | ------ |
 | U1 | no target | stop — usage |
 | U2 | target unresolvable | stop |
 | U3 | no route (table miss / cancelled) | stop |
@@ -147,7 +147,7 @@ bypass lifecycle guards (`--no-lifecycle`) to force progress.
 ## Common Rationalizations
 
 | Rationalization | Reality |
-|---|---|
+| --- | --- |
 | "Two candidates are both fine — pick the higher-priority one." | Multi-candidate is a HITL stop (routing-table §4). A silent pick hides a real fork from the operator; print the decision-brief. |
 | "The task is todo, so run the full pipeline to be safe." | Full mode is not the v1 default (non-route). A3 dispatches the `--next` chain link; `--full` exists for the explicit override. |
 | "I can loop dev-next until the task is done." | Step budget is one dispatch per invocation. Self-looping makes token cost unbounded; the operator re-invokes after non-chain dispatches. |

package/plugins/sp/skills/pr-reviewing/SKILL.md

@@ -86,11 +86,10 @@ Parse the first positional argument as the mode; default `full`.
 - `--agent <inline|auto|name>` — names **who performs model-bearing work**, per the
   [inline-default execution-surface contract](../spur-dev/references/cross-cutting.md#inline-default-execution-surface).
   Omit: the current agent is the default owner (eligible model stages may use one native subagent
-  under the shared contract). `inline` keeps all model work in the host session as the hard
-  zero-dispatch guarantee. `auto` resolves the command's declared role; a named executor pins that executor.
+  under the shared contract). `inline` (also what omission resolves to, task 0687) keeps model work in the host session — native-subagent-first with host fallback where eligible `auto` resolves the command's declared role; a named executor pins that executor.
   An alternate executor gets one `spur agent run --agent <value>` dispatch with the selector removed
   from child args; that child owns model work. Current-agent selection stays inline.
-  Headless surfaces reject explicit `inline` with the shared stable error.
+  Headless surfaces substitute tier resolution for `inline` with a warning (task 0687), never refusing.
 - `--agent` describes the model owner only; it is independent of the deterministic git/GitHub spine
   and the workflow/direct route. Run the selected route in that resolved skill context. A separate
   workflow subprocess belongs to the caller's execution surface or an objective trigger (for example,

package/plugins/sp/skills/redesign-web-ui/SKILL.md

@@ -0,0 +1,184 @@
+---
+name: redesign-web-ui
+description: "Upgrade an existing website or app UI past generic AI defaults without rewriting the stack. Triggers: \"redesign this UI\", \"make it look premium\", \"generic AI design\", \"polish this page\", \"restyle the web app\"."
+license: Apache-2.0
+metadata:
+  author: spur
+  version: "1.0"
+  platforms: "claude-code,codex,openclaw,opencode,antigravity"
+  category: execution
+  interactions:
+    - pipeline
+    - reviewer
+  pipeline_steps:
+    - scan
+    - diagnose
+    - plan
+    - apply
+    - verify
+  operations:
+    - redesign
+  openclaw:
+    emoji: "🎨"
+see_also:
+  - sp:code-implementation
+  - sp:code-review
+  - sp:source-driven-development
+---
+
+# redesign-web-ui — existing-UI visual upgrade
+
+This is a **technique** skill: it edits presentation. Specific product copy stays; placeholder copy
+becomes real draft text. Information architecture, routing, and data behavior stay unless the
+operator widens the scope.
+
+## When to use
+
+- Redesign or restyle an existing page, app shell, or component set.
+- Make an existing UI look premium / high-end rather than templated.
+- Strip generic AI design fingerprints (Inter-only type, purple-blue gradients, three equal feature cards).
+- Polish a page that feels unfinished (missing hover, focus, loading, empty, or error states).
+- Restyle a web app in place without a framework migration.
+
+## When not to use
+
+- **Greenfield visual identity with no existing UI** — there is nothing to upgrade; design from the brief.
+- **IA or navigation restructure** — out of scope unless the operator asks.
+- **Stack migration** — swapping CSS frameworks or component libraries.
+- **Non-UI work** — APIs, CLI, schemas, backend.
+- **Inventing legal or compliance surfaces** — privacy pages, terms, cookie banners. Link only
+  destinations the product already has.
+
+## Authority (read before changing tokens)
+
+Resolve visual authority in this order. A lower layer never overrides a higher one. Cite the source
+on every token change.
+
+1. **Repository-root `DESIGN.md`** — if it exists, it is the UI SSOT (palette, type, surfaces, motion,
+   density). Read it. Use its tokens by name.
+2. **Existing theme / CSS variables / Tailwind theme** — the live token file the app already compiles.
+3. **This skill's audit heuristics** — only for axes the two layers above leave free.
+
+`docs/04_DESIGN.md` owns non-UI surfaces (commands, flags, DTOs). It is not this skill's authority.
+
+Framework and CSS API facts (Tailwind v3 vs v4, styled-components APIs, browser features): verify
+with source for the pinned version via `sp:source-driven-development`. Cross-check against docs
+before changing config.
+
+## Pipeline
+
+Run in order. Later steps consume the previous step's artifact. Stop after Diagnose when the
+operator asked only for an audit.
+
+### Step 1 — Scan
+
+Read the target UI and its styling entrypoints. Record, with evidence:
+
+| Field | Evidence |
+|---|---|
+| Framework | manifest / entry file |
+| Styling system | Tailwind v3/v4, CSS modules, vanilla, styled-components, … |
+| Token source | `DESIGN.md`, CSS variables, `tailwind.config`, theme file |
+| Scope | routes, layouts, and shared components that will render the change |
+
+Done when every row has a path (or `none — proceed on heuristics`).
+
+### Step 2 — Diagnose
+
+Walk [references/audit-checklist.md](references/audit-checklist.md). Emit a findings table. Every
+row must cite `path:line`. No finding, no change. Cite the reference row you matched.
+
+```markdown
+| ID | Pattern | Severity | Evidence | In-stack fix |
+|----|---------|----------|----------|--------------|
+| F1  | …       | a11y \| fingerprint \| polish | `file:line` | … |
+```
+
+Severity:
+
+- **a11y** — focus, skip-link, alt, contrast, reduced-motion, keyboard path. Visible focus is required. Fix these.
+- **fingerprint** — generic AI look that fights this product. Fix unless a higher authority specifies it.
+- **polish** — optional quality. Apply when it does not fight the authority or the product type.
+
+Done when every checklist category has been considered and every hit is a table row (or the
+category is marked `none`).
+
+### Step 3 — Plan
+
+Order the findings by the Fix Priority below. State the typefaces, palette, and one signature
+choice, each cited to authority or to a subject-specific reason. Optional motion and layout
+upgrades live in [references/upgrade-techniques.md](references/upgrade-techniques.md) — load that
+file only when a finding needs a technique from it.
+
+The plan should list every **a11y** and **fingerprint** finding. Always cite the token source.
+Done when both are present.
+
+### Step 4 — Apply
+
+Work in the existing styling system. Targeted upgrades, not a rewrite.
+
+Fix Priority:
+
+1. Accessibility
+2. Token alignment to authority
+3. Typography and color fingerprints
+4. Hover, focus, active, loading, empty, error
+5. Layout, spacing, max-width
+6. Generic component cliches
+7. Motion that serves the product (and honors `prefers-reduced-motion`)
+
+Before any new import, read the project's dependency manifest. Before editing Tailwind config,
+validate the installed major version against its docs.
+
+Done when every planned **a11y** and **fingerprint** row is reflected in the diff, or explicitly
+deferred with a one-line reason.
+
+### Step 5 — Verify
+
+Confirm with evidence, not assertion. See **Verification** below.
+
+## Hard constraints
+
+- Keep the current framework and styling library.
+- Preserve existing functionality; a visual change that breaks a flow is a failed run.
+- Keep the diff reviewable — small, targeted edits over a greenfield restyle.
+- Prefer the project's existing icon set, font loader, and image pipeline over new dependencies.
+- Honor `prefers-reduced-motion` for every motion addition.
+
+## Common Rationalizations
+
+| Rationalization | Reality |
+|---|---|
+| "I'll migrate to a nicer component library while I'm here." | Stack change is out of scope. Upgrade what is already compiled. |
+| "DESIGN.md is just a mood board — I'll pick better colors." | Root `DESIGN.md` is authority. Cite its tokens; do not invent a parallel palette. |
+| "A full rewrite is faster than patching these class names." | Rewrites drop states, a11y, and behavior. Patch in place; the audit is the map. |
+| "I'll add stock photos / a new icon library for polish." | New assets and libraries are fingerprints of their own. Use the project's pipeline. |
+| "Legal links and a cookie banner will make it feel finished." | Invented compliance UI is worse than omission. Link only destinations the product already has. |
+| "A screenshot of the happy path is enough." | Verify behavior, shared routes, empty/error/focus, and both viewports when layout changed. |
+
+## Red Flags
+
+- Diff introduces a second CSS framework or a new icon/font package without a dependency-file check.
+- Palette or typeface that contradicts repository-root `DESIGN.md`.
+- Finding with no `path:line` evidence.
+- Custom scroll hijacking or inertia scroll on a product UI.
+- Claimed "done" with no visual verification evidence (or no statement of what could not be verified).
+- Placeholder copy (`Lorem ipsum`, "John Doe", "Acme Corp") left in the shipped UI.
+
+## Verification
+
+After Apply, ensure each box has evidence (command output, screenshot, or `file:line`), not assertion:
+
+- [ ] Every **a11y** and **fingerprint** finding is fixed or deferred with a reason.
+- [ ] Token changes cite `DESIGN.md`, the live theme file, or a subject-specific reason (source named).
+- [ ] Existing tests still pass; new imports exist in the dependency manifest.
+- [ ] Shared layouts/components that consume the changed tokens still render consistently — cross-check each route that shares them.
+- [ ] Browser (or closest substitute): golden path + empty/error/focus; desktop and mobile viewports when layout or spacing changed.
+- [ ] `prefers-reduced-motion` still disables added motion.
+- [ ] Document what could not be verified (no browser tools → say so; do not claim visual QA).
+
+## See also
+
+- **`sp:source-driven-development`** — verify framework/CSS API facts against the pinned version before editing config.
+- **`sp:code-implementation`** — owns feature implementation; this skill owns the visual upgrade pass.
+- **`sp:code-review`** — review the visual diff for regressions and out-of-scope stack changes.

package/plugins/sp/skills/redesign-web-ui/references/audit-checklist.md

@@ -0,0 +1,121 @@
+# Audit checklist
+
+Lookup for `sp:redesign-web-ui` Diagnose. Every hit becomes a findings-table row with `path:line`
+evidence and an in-stack fix. Severity values (`a11y` / `fingerprint` / `polish`) and when to
+apply each are defined in the skill's Diagnose step.
+
+A category with no hits is recorded as `none`. Do not invent findings to fill the table.
+
+---
+
+## Typography
+
+| Problem | In-stack fix | Severity |
+|---|---|---|
+| Browser default, Inter, Roboto, or Arial as the only face | Pick a display + body pair for *this* product's subject and cite why. Repeating Inter, or swapping Inter for Geist/Outfit/Satoshi with no subject reason, is still a default. | fingerprint |
+| Headlines lack presence | Increase display size, tighten letter-spacing, reduce line-height so titles feel intentional. | fingerprint |
+| Body line length unconstrained | Cap paragraph measure near 65 characters; raise line-height for reading blocks. | polish |
+| Only 400 and 700 weights | Add 500/600 where hierarchy needs a middle step. | polish |
+| Proportional figures in tables, prices, metrics | Tabular nums (`font-variant-numeric: tabular-nums`) or a monospace face for data. | polish |
+| No tracking on display vs. labels | Negative tracking on large headers; slight positive tracking on small labels/small-caps. | polish |
+| All-caps subheaders as the only accent | Sentence case, small-caps, or italic — one treatment, used sparingly. | fingerprint |
+| Orphaned last words in headings | `text-wrap: balance` (headings) or `text-wrap: pretty` (body). | polish |
+
+## Color and surfaces
+
+| Problem | In-stack fix | Severity |
+|---|---|---|
+| Pure `#000` canvas or pure `#fff` only | Off-black / off-white or a tinted dark from the authority palette. | fingerprint |
+| Oversaturated accents | Keep saturation in range with surrounding neutrals; one chromatic accent unless authority specifies more. | fingerprint |
+| Mixing warm and cool gray families | One gray family, tinted with a consistent hue. | fingerprint |
+| Purple/blue "AI gradient" (or cream+serif+terracotta, or acid-green-on-black used as a default) | Neutral bases + the authority accent. Those three looks are legitimate for some briefs; they are fingerprints when chosen without a subject reason. | fingerprint |
+| Generic black `box-shadow` | Tint shadows to the surface hue. | polish |
+| Perfectly even 45° linear fades | Radial, mesh, or a noise overlay — or no gradient. | fingerprint |
+| Conflicting light sources across shadows | One implied light direction. | polish |
+| A single inverted-color band in an otherwise consistent page | Same palette, shifted shade — or a full committed dark/light mode. | fingerprint |
+| Empty flat sections that need presence | Texture, a restrained ambient gradient, or an existing product image. Use the project's image pipeline; do not inject random stock URLs. | polish |
+
+## Layout
+
+| Problem | In-stack fix | Severity |
+|---|---|---|
+| Everything centered and symmetrical | Offset, mixed aspect ratios, or left-aligned headers over centered content — when the content supports it. | fingerprint |
+| Three equal card columns as the feature row | Asymmetric grid, 2-column zig-zag, or a single highlighted module. | fingerprint |
+| `height: 100vh` full-screen sections | `min-height: 100dvh` (mobile browser chrome). | a11y |
+| No max-width on reading/marketing content | Container ~1200–1440px with auto margins. Data-dense dashboards may stay full-bleed. | polish |
+| Uniform radius on every element | Tighter radius on inner controls, softer on outer containers — or sharp, if authority is sharp. | polish |
+| Missing whitespace on marketing pages | Increase spacing until groups read as groups. Dense is correct for data tables. | polish |
+| Card CTAs / feature lists at uneven baselines | Align shared elements (title, price, list start, button) across the row. | polish |
+| Optical vs. mathematical centering (icon-in-circle, play button) | 1–2px optical adjustment. | polish |
+
+Do **not** treat "dashboard has a left sidebar" as a defect. Changing IA is out of scope.
+
+## Interactivity and states
+
+| Problem | In-stack fix | Severity |
+|---|---|---|
+| No hover on pointer-capable buttons/links | Background, border, or 1px translate — 150–250ms. | fingerprint |
+| No active/pressed feedback | `scale(0.98)` or `translateY(1px)`. | polish |
+| Instant transitions (`transition: none` on chrome) | 150–250ms on interactive chrome; leave data-dense tables snappy. | polish |
+| Missing visible focus ring | Visible `:focus-visible` using the authority accent. Keyboard path is required. | a11y |
+| Spinner-only loading | Skeleton that matches the layout shape. | polish |
+| Blank empty states | A composed getting-started / zero-data view with one next action. | polish |
+| Errors via `window.alert()` or no inline message | Inline field/form error in the product voice. | a11y |
+| Buttons that go to `#` | Real href, or a disabled control with a reason. | a11y |
+| No current-page indication in nav | Distinct active style. | a11y |
+| Instant anchor jumps | `scroll-behavior: smooth` on the document, with reduced-motion fallback to instant. | polish |
+| Animating `top` / `left` / `width` / `height` | Animate `transform` and `opacity`. | polish |
+
+## Content
+
+| Problem | In-stack fix | Severity |
+|---|---|---|
+| `Lorem ipsum` or `placeholder` copy | Real draft copy for this product. | fingerprint |
+| "John Doe", "Jane Smith", "Acme Corp", "Nexus", "SmartFlow" | Contextual names. | fingerprint |
+| Fake round metrics (`99.99%`, `$100.00`) | Organic figures, or label them as examples. | fingerprint |
+| AI cliches: Elevate, Seamless, Unleash, Next-Gen, Game-changer, Delve, Tapestry, "In the world of…" | Plain, specific language. | fingerprint |
+| "Oops!" / exclamation-mark success toasts | Direct: "Saved." / "Connection failed. Try again." | fingerprint |
+| Title Case On Every Header | Sentence case, unless the brand guide says otherwise. | polish |
+| Identical dates or avatars on every dummy person | Unique assets per distinct person, or drop the avatars. | fingerprint |
+
+## Component patterns
+
+| Problem | In-stack fix | Severity |
+|---|---|---|
+| Card = border + shadow + white fill on every block | Cards only when elevation encodes hierarchy; otherwise background or spacing. | fingerprint |
+| Always one filled + one ghost button | Text/tertiary action when the second action is low emphasis. | polish |
+| Pill "New"/"Beta" badges as decoration | Square badge, flag, or plain label — or remove. | polish |
+| Accordion FAQ / 3-card testimonial carousel / 3-tower pricing as empty decoration | A layout that matches the actual content. Keep the pattern when it *is* the product's IA. | fingerprint |
+| Modal for a single-field edit | Inline edit or a slide-over. | polish |
+| Footer link farm (4+ columns of unused links) | Primary paths + real legal destinations the product already has. | polish |
+
+## Iconography and media
+
+| Problem | In-stack fix | Severity |
+|---|---|---|
+| Mixed icon sets / mixed stroke widths | Standardize on the set already in the dependency manifest. Do not add Phosphor/Heroicons/Lucide as a second library. | fingerprint |
+| Rocket = Launch, shield = Security, as the only metaphors | Less obvious icons from the *same* set, or text. | polish |
+| Missing favicon | Branded favicon in the project's existing public/asset pipeline. | polish |
+| Random stock "team" photos | Real assets, a consistent illustration style, or no people photos. | fingerprint |
+
+## Code quality (UI)
+
+| Problem | In-stack fix | Severity |
+|---|---|---|
+| Non-semantic soup for nav/main/content | `<nav>`, `<main>`, `<article>`, `<aside>`, `<section>` where they match the role. | a11y |
+| Inline styles mixed into a class-based system | Move the declaration into the project's styling system. | polish |
+| Hardcoded px widths on fluid layouts | `%`, `rem`, `em`, `max-width`, or the system's spacing scale. | polish |
+| Meaningful images with empty or `alt="image"` | Describe the image; decorative images get `alt=""` plus `role="presentation"` if needed. | a11y |
+| `z-index: 9999` and friends | A documented z-scale on the theme. | polish |
+| Missing `<title>`, description, or social meta | Fill from the product name and the page's job. | polish |
+| Import not in the dependency manifest | Use an already-installed package, or stop and ask before adding one. | fingerprint |
+
+## Completeness (product UI, not decoration)
+
+| Problem | In-stack fix | Severity |
+|---|---|---|
+| No skip-to-content link | Visually hidden skip link targeting `<main>`. | a11y |
+| Dead-end views with no way back | A back/close path that uses the existing router. | a11y |
+| No custom 404 | Branded empty-route view with a path home. | polish |
+| Forms without client-side required/format checks | Validate in the existing form library; keep server-side as source of truth. | a11y |
+| Footer legal links that 404 | Point at real routes, or omit. | polish |