@gobing-ai/spur 0.3.67 → 0.3.69

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.3.67",
+            "version": "0.3.69",
             "source": "./plugins/sp"
         }
     ]

package/config/corpus-baseline.json

@@ -67,12 +67,6 @@
             "code": "L4.dogfood-missing",
             "severity": "warning"
         },
-        {
-            "kind": "feature",
-            "id": "A6",
-            "code": "L4.scenario-unverified",
-            "severity": "warning"
-        },
         {
             "kind": "feature",
             "id": "B1",
@@ -1653,50 +1647,8 @@
         },
         {
             "kind": "task",
-            "id": "0703",
-            "code": "L4.gate-language",
-            "severity": "warning"
-        },
-        {
-            "kind": "task",
-            "id": "0704",
-            "code": "L4.prerequisite-not-done",
-            "severity": "warning"
-        },
-        {
-            "kind": "task",
-            "id": "0706",
-            "code": "L4.gate-language",
-            "severity": "warning"
-        },
-        {
-            "kind": "task",
-            "id": "0707",
-            "code": "L4.prerequisite-not-done",
-            "severity": "warning"
-        },
-        {
-            "kind": "task",
-            "id": "0708",
-            "code": "L4.prerequisite-not-done",
-            "severity": "warning"
-        },
-        {
-            "kind": "task",
-            "id": "0709",
-            "code": "L4.prerequisite-not-done",
-            "severity": "warning"
-        },
-        {
-            "kind": "task",
-            "id": "0710",
-            "code": "L4.prerequisite-not-done",
-            "severity": "warning"
-        },
-        {
-            "kind": "task",
-            "id": "0712",
-            "code": "L4.prerequisite-not-done",
+            "id": "0719",
+            "code": "L4.stale-line-anchor",
             "severity": "warning"
         }
     ]

package/config/templates/docs/99_PROJECT_CONSTITUTION.md

@@ -61,10 +61,10 @@ Tools are bound by **role**; roles are permanent, bindings evolve. This table is
 project-variable section besides Lessons — update the binding when the toolchain migrates.
 
 | Role | Current binding | Notes |
-|------|-----------------|-------|
-| Spec lifecycle — tasks | _(project tool — e.g. `spur task` or a task CLI)_ | Task files are tool-owned; edit through the tool, never the Write tool |
-| Spec lifecycle — features | _(project tool — e.g. `spur feature` or a feature CLI)_ | Same tool-owned rule |
-| Delivery harness | _(project harness — e.g. `spur`)_ | Quality gates are self-hosted through it where possible |
+| ------ | ----------------- | ------- |
+| Spec lifecycle — tasks | *(project tool — e.g. `spur task` or a task CLI)* | Task files are tool-owned; edit through the tool, never the Write tool |
+| Spec lifecycle — features | *(project tool — e.g. `spur feature` or a feature CLI)* | Same tool-owned rule |
+| Delivery harness | *(project harness — e.g. `spur`)* | Quality gates are self-hosted through it where possible |
 | Agent-facing wrappers | per-project plugin dir (e.g. `plugins/sp/`) | **Fat Skills, thin others:** skills are the SSOT for agent-facing behavior and may be arbitrarily rich; slash commands and subagents are thin wrappers of skills (every agent supports skills; command/subagent support varies) |
 
 ## 4. Common file layout
@@ -75,7 +75,7 @@ Each project's `AGENTS.md` embeds an instantiated copy of this table (§4.4). A
 **one** doc; other docs link to it, never restate it.
 
 | Doc | Owns the question | Authority | Read / edit when |
-|-----|-------------------|-----------|------------------|
+| ----- | ------------------- | ----------- | ------------------ |
 | `docs/00_ADR.md` | **WHY** — which cross-cutting decision was made, and the one-line reason | **Authoritative** (wins all content) | Read before any structural change; add a dated entry before diverging from a decision |
 | `docs/01_PRD.md` | **WHAT** — product vision, users, scope (in / out / deferred) | **Authoritative on scope** | Read before adding a command/feature; edit when scope changes |
 | `docs/02_ROADMAP.md` | **WHEN** — phases, current vs deferred, sequencing | Derived | Read to place work in a phase; edit when phase status changes |
@@ -97,7 +97,7 @@ Each project's `AGENTS.md` embeds an instantiated copy of this table (§4.4). A
 ### 4.2 Working layers (outside the authority chain)
 
 | Location | Purpose | Rules |
-|----------|---------|-------|
+| ---------- | --------- | ------- |
 | `docs/plans/YYYY-MM-DD-<topic>.md` | Dated working documents: research, triage, design discussions, decision records-in-progress | They **record**, they do not **govern**. Once concluded, immutable except dated correction sections. Decisions they reach must be promoted into `00`–`05` to take effect |
 | `docs/tasks/` | Task files | Tool-owned (§3). Never edited with raw file writes |
 | other `docs/` folders | Optional scratch (analysis, refactor notes, ...) | Nothing in the authority chain may depend on them |
@@ -190,7 +190,7 @@ it. Each trigger below has a stable ID (referenced by doc frontmatter `sync:` li
 names the docs that must be touched **in the same commit / same change**:
 
 | ID | When this happens | Touch (same change) |
-|----|-------------------|---------------------|
+| ---- | ------------------- | --------------------- |
 | T1 | New cross-cutting decision, or reversal of one | `00` **first** (dated entry), then `03` mechanism, `01` if scope shifts |
 | T2 | A code change would contradict an existing ADR | **Stop.** Add the superseding/amending ADR entry first — never silently diverge |
 | T3 | Command, flag, config key, env var, schema, or DTO added/changed | `04` + the `AGENTS.md` surface block |
@@ -361,6 +361,11 @@ with raw file writes.
 5. Surfaces that are decided-but-unbuilt are flagged as planned with their ADR pointer, and
    marked "do not invoke as if they exist".
 6. Re-synced whenever this file changes the map or process (§4.4).
+7. Deterministic size ceiling: repo-root `AGENTS.md` and `config/templates/AGENTS.md` stay at or
+   below **20480 UTF-8 bytes** (20 KiB), enforced by
+   `apps/cli/tests/agents-md-portable-alignment.test.ts` (task 0705). This byte gate guards the
+   platform load limit and is separate from rule 4's approximate instruction budget. Over
+   ceiling: cut or move content per rules 2–3, or compact via `sp:doc-evolve`.
 
 ### 6.8 This file (`99`)
 
@@ -420,35 +425,35 @@ if it recurs, a new rule in §6.
 
 ### Lessons for `docs/00_ADR.md`
 
-_(empty — add lessons as the project evolves)_
+*(empty — add lessons as the project evolves)*
 
 ### Lessons for `docs/01_PRD.md`
 
-_(empty — add lessons as the project evolves)_
+*(empty — add lessons as the project evolves)*
 
 ### Lessons for `docs/02_ROADMAP.md`
 
-_(empty — add lessons as the project evolves)_
+*(empty — add lessons as the project evolves)*
 
 ### Lessons for `docs/03_ARCHITECTURE.md`
 
-_(empty — add lessons as the project evolves)_
+*(empty — add lessons as the project evolves)*
 
 ### Lessons for `docs/04_DESIGN.md`
 
-_(empty — add lessons as the project evolves)_
+*(empty — add lessons as the project evolves)*
 
 ### Lessons for `docs/05_FEATURES.md`
 
-_(empty — add lessons as the project evolves)_
+*(empty — add lessons as the project evolves)*
 
 ### Lessons for `AGENTS.md`
 
-_(empty — add lessons as the project evolves)_
+*(empty — add lessons as the project evolves)*
 
 ### Lessons for this file (`99`)
 
-_(empty — add lessons as the project evolves)_
+*(empty — add lessons as the project evolves)*
 
 ## 9. Bootstrapping a new project
 
@@ -470,4 +475,4 @@ Checklist to instantiate this structure in a fresh repo:
    gate, conventions. Symlink `CLAUDE.md` (and equivalents) to it.
 9. Wire the §3 tools (spec lifecycle, harness) per their own docs.
 10. First-session rule for any agent: read `AGENTS.md` → this file → `00`/`01` before touching
-    anything.
+    anything.

package/config/workflow-composition-baseline.json

@@ -15,10 +15,10 @@
             "boundary": "docs-evolution",
             "disposition": "keep",
             "callers": ["sp:spur-dev", "/sp:dev-run"],
-            "terminalStates": ["done", "failed", "cancelled"],
             "artifacts": ["docs-precheck", "docs-verdict"],
             "failurePolicy": "fail-closed",
-            "modelQueries": ["draft"],
+            "terminalStates": ["done", "failed", "cancelled"],
+            "modelQueries": ["draft", "verify"],
             "actions": {
                 "precheck:onEnter:0": {
                     "kind": "command.gate",
@@ -66,34 +66,63 @@
                 },
                 "done:onEnter:0": {
                     "kind": "shell",
-                    "invocation": "mkdir -p .spur/run && printf '%s\\n' \"{\\\"wbs\\\":\\\"$wbs\\\",\\\"verdict\\\":\\\"PASS\\\",\\\"source\\\":\\\"docs-pipeline\\\",\\\"requirements\\\":[{\\\"id\\\":\\\"docs-deliverable\\\",\\\"status\\\":\\\"MET\\\",\\\"evidence\\\":\\\"docs-pipeline record step\\\"}],\\\"acceptanceCriteria\\\":[],\\\"checks\\\":[{\\\"name\\\":\\\"docs-only\\\",\\\"status\\\":\\\"pass\\\",\\\"evidence\\\":\\\"docs-pipeline\\\"}]}\" > \".spur/run/$wbs-verdict.json\"\n",
+                    "invocation": "$spurBin task update $wbs done --no-lifecycle",
                     "stateEffect": "read",
                     "evidenceEffect": "write"
                 },
                 "done:onEnter:1": {
-                    "kind": "run.artifact",
+                    "kind": "note",
                     "stateEffect": "read",
                     "evidenceEffect": "write"
                 },
-                "done:onEnter:2": {
+                "verify:onEnter:0": {
                     "kind": "shell",
-                    "invocation": "$spurBin task update $wbs done --no-lifecycle",
+                    "invocation": "$spurBin task path $wbs --json 2>/dev/null | jq -r \".path // .filePath // empty\" > \".spur/run/$wbs-docs-taskpath.txt\" || true; exit 0",
                     "stateEffect": "write",
                     "evidenceEffect": "none"
                 },
-                "done:onEnter:3": {
-                    "kind": "note",
-                    "stateEffect": "read",
+                "verify:onEnter:1": {
+                    "kind": "file.read.into-var"
+                },
+                "verify:onEnter:2": {
+                    "kind": "proof.fingerprint",
+                    "invocation": "/sp:dev-verify ${vars.wbs} --auto --fix none --focus all"
+                },
+                "verify:onEnter:3": {
+                    "kind": "agent.run",
+                    "invocation": "/sp:dev-verify ${vars.wbs} --auto --fix none --focus all",
+                    "stateEffect": "write",
+                    "evidenceEffect": "none"
+                },
+                "verify:onEnter:4": {
+                    "kind": "shell",
+                    "invocation": "$spurBin task verdict $wbs --from-answer .spur/run/$wbs-verify-answer.txt",
+                    "stateEffect": "write",
+                    "evidenceEffect": "none"
+                },
+                "verify:onEnter:5": {
+                    "kind": "shell",
+                    "invocation": "V=\".spur/run/$wbs-verdict.json\"; if [ -f \"$V\" ] && [ -n \"$proofDigest\" ]; then\n  jq --arg d \"$proofDigest\" '. + {proof: {digest: $d, capturePoint: \"docs-verify-entry\"}}' \"$V\" > \"$V.tmp\" && mv \"$V.tmp\" \"$V\";\nfi; exit 0",
+                    "stateEffect": "write",
                     "evidenceEffect": "none"
+                },
+                "verify:onEnter:6": {
+                    "kind": "run.artifact",
+                    "stateEffect": "read",
+                    "evidenceEffect": "write"
+                },
+                "verify:onEnter:7": {
+                    "kind": "proof.fingerprint",
+                    "invocation": "/sp:dev-verify ${vars.wbs} --auto --fix none --focus all"
                 }
-            }
+            },
+            "digest": "sha256:2794f4f926ecfcd69c0265214f9fcd69ab84cdd3ed53409a8af77a700fd635cc"
         },
         "idea-pipeline": {
             "definition": "config/workflows/idea-pipeline.yaml",
             "boundary": "idea-decomposition",
             "disposition": "keep",
             "callers": ["sp:spur-dev", "/sp:dev-idea"],
-            "terminalStates": ["handoff", "cancelled", "failed"],
             "artifacts": [
                 "idea-eval-report",
                 "idea-needs-design",
@@ -103,6 +132,7 @@
                 "idea-handoff"
             ],
             "failurePolicy": "fail-closed",
+            "terminalStates": ["handoff", "cancelled", "failed"],
             "modelQueries": ["discovery", "feature-create", "ac-generate", "system-design", "decompose"],
             "actions": {
                 "start:onEnter:0": {
@@ -111,8 +141,13 @@
                     "evidenceEffect": "none"
                 },
                 "start:onEnter:1": {
+                    "kind": "doctor.probe",
+                    "stateEffect": "read",
+                    "evidenceEffect": "write"
+                },
+                "start:onEnter:2": {
                     "kind": "shell",
-                    "invocation": "mkdir -p .spur/run && DOCTOR_FILE=\".spur/run/$__runId-idea-precheck-doctor.status\" && set +e && $spurBin agent doctor $agent; doctor_rc=$?; set -e && if [ \"$doctor_rc\" -eq 0 ] && test -n \"$idea\"; then\n  printf 'PASS\\n' > \"$DOCTOR_FILE\";\nelse\n  printf 'FAIL\\n' > \"$DOCTOR_FILE\";\nfi && exit 0",
+                    "invocation": "test -n \"$idea\" || printf 'FAIL\\n' > \".spur/run/$__runId-idea-precheck-doctor.status\"",
                     "stateEffect": "read",
                     "evidenceEffect": "write",
                     "disposition": "GLUE"
@@ -258,45 +293,41 @@
                     "stateEffect": "write",
                     "evidenceEffect": "write"
                 }
-            }
+            },
+            "digest": "sha256:acc878217ffc7e31d31600b59d5b240588a079638d2eb0caff8c7a78524220b9"
         },
         "task-pipeline": {
             "definition": "config/workflows/task-pipeline.yaml",
             "boundary": "task-execution",
             "disposition": "canonical",
             "callers": ["sp:spur-dev", "sp:super-planner"],
-            "terminalStates": ["done", "failed", "cancelled"],
             "artifacts": ["verify-answer", "verify-verdict", "testing-section", "review-section"],
             "failurePolicy": "fail-closed",
+            "terminalStates": ["done", "failed", "cancelled"],
             "modelQueries": ["implement", "test-fix", "review", "verify"],
             "actions": {
                 "precheck:onEnter:0": {
-                    "kind": "doctor.probe",
-                    "stateEffect": "read",
-                    "evidenceEffect": "write"
-                },
-                "precheck:onEnter:1": {
                     "kind": "shell",
                     "invocation": "DIRTY=$(git status --porcelain -- . ':(exclude)docs/tasks*' ':(exclude)docs/features' 2>/dev/null); if [ -n \"$DIRTY\" ]; then\n  echo \"precheck: WARNING - working tree has uncommitted non-corpus changes; commit or stash before starting a new task:\";\n  echo \"$DIRTY\";\nfi; CORPUS_DIRTY=$(git status --porcelain -- ':(glob)docs/tasks*/**' 2>/dev/null); if [ -n \"$CORPUS_DIRTY\" ]; then\n  echo \"precheck: NOTE - task corpus has uncommitted changes; review before staging with this task:\";\n  echo \"$CORPUS_DIRTY\";\nfi; exit 0",
                     "stateEffect": "read",
                     "evidenceEffect": "none",
                     "disposition": "GLUE"
                 },
-                "precheck:onEnter:2": {
+                "precheck:onEnter:1": {
                     "kind": "note",
                     "stateEffect": "read",
                     "evidenceEffect": "none"
                 },
-                "precheck:onEnter:3": {
+                "precheck:onEnter:2": {
                     "kind": "shell",
-                    "invocation": "if [ \"$profile\" = auto ]; then\n  FID=$($spurBin task show $wbs --json 2>/dev/null |\n  jq -r '.feature_id // .frontmatter.feature_id // empty' 2>/dev/null);\n  if [ -n \"$FID\" ]; then\n    $spurBin feature sync \"$FID\" --force --json 2>/dev/null ||\n    $spurBin feature update \"$FID\" active 2>/dev/null || true;\n  fi;\nfi; exit 0",
+                    "invocation": "if [ \"$profile\" = auto ]; then\n  FID=$($spurBin task show $wbs --json 2>/dev/null |\n  jq -r '.feature_id // .frontmatter.feature_id // empty' 2>/dev/null);\n  if [ -n \"$FID\" ]; then\n    if ! $spurBin feature sync \"$FID\" --force 2>/dev/null; then\n    if ! $spurBin feature update \"$FID\" active 2>/dev/null; then\n    echo \"precheck: FAIL - feature reactivation $FID failed;\" >&2;\n    echo \"precheck: feature sync + feature update both errored\" >&2;\n    exit 1;\n    fi;\n    fi;\n  fi;\nfi; exit 0",
                     "stateEffect": "write",
                     "evidenceEffect": "none",
                     "disposition": "GLUE"
                 },
-                "precheck:onEnter:4": {
+                "precheck:onEnter:3": {
                     "kind": "shell",
-                    "invocation": "SIZE_FILE=\".spur/run/$wbs-precheck-size.status\" && mkdir -p .spur/run && if [ -f plugins/sp/scripts/task-size-precheck.ts ]; then bun plugins/sp/scripts/task-size-precheck.ts \"$wbs\" --spur-bin \"$spurBin\" --max-reqs \"$maxImplementReqs\" --max-plan-items \"$maxImplementPlanItems\" --executor \"$implementAgent\"; else\n  echo \"task-size-precheck skipped — plugins/sp/scripts/task-size-precheck.ts not present in project.\" >&2 &&\n  echo \"PASS\" > \"$SIZE_FILE\";\nfi && exit 0",
+                    "invocation": "SIZE_FILE=\".spur/run/$wbs-precheck-size.status\" && mkdir -p .spur/run && if [ -f plugins/sp/scripts/task-size-precheck.ts ]; then bun plugins/sp/scripts/task-size-precheck.ts \"$wbs\" --spur-bin \"$spurBin\" --max-reqs \"$maxImplementReqs\" --max-plan-items \"$maxImplementPlanItems\"; else\n  echo \"task-size-precheck failed closed — checker script\" >&2 &&\n  echo \"plugins/sp/scripts/task-size-precheck.ts absent.\" >&2 &&\n  echo \"FAIL\" > \"$SIZE_FILE\";\nfi && exit 0",
                     "stateEffect": "read",
                     "evidenceEffect": "write",
                     "disposition": "EXT"
@@ -322,14 +353,33 @@
                 },
                 "test:onEnter:0": {
                     "kind": "shell",
-                    "invocation": "mkdir -p .spur/run && STATUS_FILE=\".spur/run/$wbs-test-gate.status\" && LOG_FILE=\".spur/run/$wbs-test-gate.log\" && ATTEMPT_FILE=\".spur/run/$wbs-test-fix-attempt\" && echo 0 > \"$ATTEMPT_FILE\" && : > \"$LOG_FILE\" && gate_attempt=1; while [ \"$gate_attempt\" -le 5 ]; do\n  ATTEMPT_LOG=\"$LOG_FILE.attempt-$gate_attempt\";\n  sh -c \"$qualityGateCmd\" > \"$ATTEMPT_LOG\" 2>&1; gate_rc=$?;\n  gate_locked=0;\n  grep -q 'SQLiteError: database is locked' \"$ATTEMPT_LOG\" && gate_locked=1;\n  cat \"$ATTEMPT_LOG\" >> \"$LOG_FILE\";\n  rm -f \"$ATTEMPT_LOG\";\n  if [ \"$gate_rc\" -eq 0 ] || [ \"$gate_locked\" -ne 1 ] || [ \"$gate_attempt\" -ge 5 ]; then break; fi;\n  printf 'quality gate: database is locked; retrying (%s/5) in 10s\\n' \"$gate_attempt\" | tee -a \"$LOG_FILE\";\n  sleep 10;\n  gate_attempt=$((gate_attempt + 1));\ndone && cat \"$LOG_FILE\" && FINDINGS_FILE=\".spur/run/$wbs-test-gate.findings\" && set +e; grep -oE '[A-Za-z0-9_./-]+\\.[A-Za-z]+:[0-9]+' \"$LOG_FILE\" | sort -u | head -20 | tr '\\n' ' ' > \"$FINDINGS_FILE\"; set -e && if [ \"$gate_rc\" -eq 0 ]; then\n  printf 'PASS\\n' > \"$STATUS_FILE\";\nelse\n  printf 'FAIL\\n' > \"$STATUS_FILE\";\nfi && exit 0",
+                    "invocation": "$spurBin task path $wbs --json 2>/dev/null | jq -r \".path // .filePath // empty\" > \".spur/run/$wbs-taskpath.txt\" || true; sed -n \"s/^priority:[[:space:]]*//p\" \"$(cat \".spur/run/$wbs-taskpath.txt\" 2>/dev/null)\" 2>/dev/null | head -1 | tr -d \"[:space:]\" | tr \"[:lower:]\" \"[:upper:]\" > \".spur/run/$wbs-priority.txt\"; exit 0",
                     "stateEffect": "write",
                     "evidenceEffect": "write",
                     "disposition": "POLICY"
                 },
+                "test:onEnter:1": {
+                    "kind": "file.read.into-var",
+                    "stateEffect": "read",
+                    "evidenceEffect": "none"
+                },
+                "test:onEnter:2": {
+                    "kind": "file.read.into-var",
+                    "stateEffect": "read",
+                    "evidenceEffect": "none"
+                },
+                "test:onEnter:3": {
+                    "kind": "proof.fingerprint",
+                    "stateEffect": "write",
+                    "evidenceEffect": "write"
+                },
+                "test:onEnter:4": {
+                    "kind": "shell",
+                    "invocation": "mkdir -p .spur/run && STATUS_FILE=\".spur/run/$wbs-test-gate.status\" && LOG_FILE=\".spur/run/$wbs-test-gate.log\" && ATTEMPT_FILE=\".spur/run/$wbs-test-fix-attempt\" && echo 0 > \"$ATTEMPT_FILE\" && : > \"$LOG_FILE\" && gate_attempt=1; while [ \"$gate_attempt\" -le 5 ]; do\n  ATTEMPT_LOG=\"$LOG_FILE.attempt-$gate_attempt\";\n  sh -c \"$qualityGateCmd\" > \"$ATTEMPT_LOG\" 2>&1; gate_rc=$?;\n  gate_locked=0;\n  grep -q 'SQLiteError: database is locked' \"$ATTEMPT_LOG\" && gate_locked=1;\n  cat \"$ATTEMPT_LOG\" >> \"$LOG_FILE\";\n  rm -f \"$ATTEMPT_LOG\";\n  if [ \"$gate_rc\" -eq 0 ] || [ \"$gate_locked\" -ne 1 ] || [ \"$gate_attempt\" -ge 5 ]; then break; fi;\n  printf 'quality gate: database is locked; retrying (%s/5) in 10s\\n' \"$gate_attempt\" | tee -a \"$LOG_FILE\";\n  sleep 10;\n  gate_attempt=$((gate_attempt + 1));\ndone && cat \"$LOG_FILE\" && FINDINGS_FILE=\".spur/run/$wbs-test-gate.findings\" && set +e; grep -oE '[A-Za-z0-9_./-]+\\.[A-Za-z]+:[0-9]+' \"$LOG_FILE\" | sort -u | head -20 | tr '\\n' ' ' > \"$FINDINGS_FILE\"; set -e && if [ \"$gate_rc\" -eq 0 ]; then\n  printf 'PASS\\n' > \"$STATUS_FILE\";\nelse\n  printf 'FAIL\\n' > \"$STATUS_FILE\";\nfi && printf 'proof-digest: %s\\n' \"$proofDigest\" >> \"$LOG_FILE\" && exit 0"
+                },
                 "test-fix:onEnter:0": {
                     "kind": "shell",
-                    "invocation": "mkdir -p .spur/run && ATTEMPT_FILE=\".spur/run/$wbs-test-fix-attempt\" && n=$(cat \"$ATTEMPT_FILE\" 2>/dev/null || echo 0) && printf '%s\\n' \"$((n + 1))\" > \"$ATTEMPT_FILE\"",
+                    "invocation": "mkdir -p .spur/run && ATTEMPT_FILE=\".spur/run/$wbs-test-fix-attempt\" && n=$(cat \"$ATTEMPT_FILE\" 2>/dev/null || echo 0) && printf '%s\\n' \"$((n + 1))\" > \"$ATTEMPT_FILE\" && if [ -f \".spur/run/$wbs-verdict.json\" ]; then\n  { echo '--- verify verdict (remediation input, task 0703 R4) ---';\n    cat \".spur/run/$wbs-verdict.json\";\n  } >> \".spur/run/$wbs-test-gate.log\";\nfi; exit 0",
                     "stateEffect": "write",
                     "evidenceEffect": "write"
                 },
@@ -345,12 +395,17 @@
                     "evidenceEffect": "none"
                 },
                 "test-recheck:onEnter:0": {
-                    "kind": "shell",
-                    "invocation": "mkdir -p .spur/run && STATUS_FILE=\".spur/run/$wbs-test-gate.status\" && LOG_FILE=\".spur/run/$wbs-test-gate.log\" && FINDINGS_FILE=\".spur/run/$wbs-test-gate.findings\" && : > \"$LOG_FILE\" && probe_rc=0; if [ -n \"$gateProbeCmd\" ]; then\n  sh -c \"$gateProbeCmd\" > \"$LOG_FILE.probe\" 2>&1; probe_rc=$?;\n  cat \"$LOG_FILE.probe\" >> \"$LOG_FILE\";\n  rm -f \"$LOG_FILE.probe\";\nfi; if [ \"$probe_rc\" -ne 0 ]; then\n  gate_rc=$probe_rc;\nelse\n  gate_attempt=1;\n  while [ \"$gate_attempt\" -le 5 ]; do\n    ATTEMPT_LOG=\"$LOG_FILE.attempt-$gate_attempt\";\n    sh -c \"$qualityGateCmd\" > \"$ATTEMPT_LOG\" 2>&1; gate_rc=$?;\n    gate_locked=0;\n    grep -q 'SQLiteError: database is locked' \"$ATTEMPT_LOG\" && gate_locked=1;\n    cat \"$ATTEMPT_LOG\" >> \"$LOG_FILE\";\n    rm -f \"$ATTEMPT_LOG\";\n    if [ \"$gate_rc\" -eq 0 ] || [ \"$gate_locked\" -ne 1 ] || [ \"$gate_attempt\" -ge 5 ]; then break; fi;\n    printf 'quality gate: database is locked; retrying (%s/5) in 10s\\n' \"$gate_attempt\" | tee -a \"$LOG_FILE\";\n    sleep 10;\n    gate_attempt=$((gate_attempt + 1));\n  done;\nfi && cat \"$LOG_FILE\" && set +e; grep -oE '[A-Za-z0-9_./-]+\\.[A-Za-z]+:[0-9]+' \"$LOG_FILE\" | sort -u | head -20 | tr '\\n' ' ' > \"$FINDINGS_FILE\"; set -e && if [ \"$gate_rc\" -eq 0 ]; then\n  printf 'PASS\\n' > \"$STATUS_FILE\";\nelse\n  printf 'FAIL\\n' > \"$STATUS_FILE\";\nfi && exit 0",
+                    "kind": "proof.fingerprint",
                     "stateEffect": "write",
                     "evidenceEffect": "write",
                     "disposition": "POLICY"
                 },
+                "test-recheck:onEnter:1": {
+                    "kind": "shell",
+                    "invocation": "mkdir -p .spur/run && STATUS_FILE=\".spur/run/$wbs-test-gate.status\" && LOG_FILE=\".spur/run/$wbs-test-gate.log\" && FINDINGS_FILE=\".spur/run/$wbs-test-gate.findings\" && : > \"$LOG_FILE\" && probe_rc=0; if [ -n \"$gateProbeCmd\" ]; then\n  sh -c \"$gateProbeCmd\" > \"$LOG_FILE.probe\" 2>&1; probe_rc=$?;\n  cat \"$LOG_FILE.probe\" >> \"$LOG_FILE\";\n  rm -f \"$LOG_FILE.probe\";\nfi; if [ \"$probe_rc\" -ne 0 ]; then\n  gate_rc=$probe_rc;\nelse\n  gate_attempt=1;\n  while [ \"$gate_attempt\" -le 5 ]; do\n    ATTEMPT_LOG=\"$LOG_FILE.attempt-$gate_attempt\";\n    sh -c \"$qualityGateCmd\" > \"$ATTEMPT_LOG\" 2>&1; gate_rc=$?;\n    gate_locked=0;\n    grep -q 'SQLiteError: database is locked' \"$ATTEMPT_LOG\" && gate_locked=1;\n    cat \"$ATTEMPT_LOG\" >> \"$LOG_FILE\";\n    rm -f \"$ATTEMPT_LOG\";\n    if [ \"$gate_rc\" -eq 0 ] || [ \"$gate_locked\" -ne 1 ] || [ \"$gate_attempt\" -ge 5 ]; then break; fi;\n    printf 'quality gate: database is locked; retrying (%s/5) in 10s\\n' \"$gate_attempt\" | tee -a \"$LOG_FILE\";\n    sleep 10;\n    gate_attempt=$((gate_attempt + 1));\n  done;\nfi && cat \"$LOG_FILE\" && set +e; grep -oE '[A-Za-z0-9_./-]+\\.[A-Za-z]+:[0-9]+' \"$LOG_FILE\" | sort -u | head -20 | tr '\\n' ' ' > \"$FINDINGS_FILE\"; set -e && if [ \"$gate_rc\" -eq 0 ]; then\n  printf 'PASS\\n' > \"$STATUS_FILE\";\nelse\n  printf 'FAIL\\n' > \"$STATUS_FILE\";\nfi && printf 'proof-digest: %s\\n' \"$proofDigest\" >> \"$LOG_FILE\" && exit 0",
+                    "stateEffect": "write",
+                    "evidenceEffect": "write"
+                },
                 "review:onEnter:0": {
                     "kind": "agent.run",
                     "invocation": "/sp:dev-review ${vars.wbs} --auto",
@@ -363,38 +418,27 @@
                     "evidenceEffect": "none"
                 },
                 "verify:onEnter:0": {
-                    "kind": "agent.run",
-                    "invocation": "/sp:dev-verify ${vars.wbs} --auto --fix all --focus all",
+                    "kind": "proof.fingerprint",
                     "stateEffect": "may-write",
                     "evidenceEffect": "write"
                 },
                 "verify:onEnter:1": {
-                    "kind": "shell",
-                    "invocation": "$spurBin task verdict $wbs --from-answer .spur/run/$wbs-verify-answer.txt",
+                    "kind": "agent.run",
+                    "invocation": "/sp:dev-verify ${vars.wbs} --auto --fix none --focus all",
                     "stateEffect": "read",
                     "evidenceEffect": "write"
                 },
                 "verify:onEnter:2": {
                     "kind": "shell",
-                    "invocation": "$spurBin task path $wbs --json 2>/dev/null | jq -r \".path // empty\" > \".spur/run/$wbs-taskpath.txt\" || true; exit 0",
+                    "invocation": "$spurBin task verdict $wbs --from-answer .spur/run/$wbs-verify-answer.txt",
                     "stateEffect": "read",
                     "evidenceEffect": "write"
                 },
                 "verify:onEnter:3": {
-                    "kind": "file.read.into-var",
-                    "stateEffect": "read",
-                    "evidenceEffect": "none"
-                },
-                "verify:onEnter:4": {
-                    "kind": "proof.fingerprint",
-                    "stateEffect": "read",
-                    "evidenceEffect": "none"
-                },
-                "verify:onEnter:5": {
                     "kind": "shell",
-                    "invocation": "V=\".spur/run/$wbs-verdict.json\"; if [ -f \"$V\" ] && [ -n \"$proofDigest\" ]; then jq --arg d \"$proofDigest\" \".checks += [{\\\"name\\\":\\\"proof-input-digest\\\",\\\"status\\\":\\\"pass\\\",\\\"evidence\\\":\\$d}]\" \"$V\" > \"$V.tmp\" && mv \"$V.tmp\" \"$V\"; fi; exit 0",
+                    "invocation": "V=\".spur/run/$wbs-verdict.json\"; if [ -f \"$V\" ] && [ -n \"$proofDigest\" ]; then\n  jq --arg d \"$proofDigest\" --arg g \"$(cat .spur/run/$wbs-test-gate.status 2>/dev/null || echo UNKNOWN)\"\n  '. + {proof: {digest: $d, capturePoint: \"quality-gate-entry\", stages: {\n    qualityGate: {status: $g, digest: $d},\n    review: {status: \"completed\", digest: $d},\n    verification: {status: .verdict, digest: $d}}}}\n    | .checks += [{name: \"proof-input-digest\", status: \"pass\", evidence: $d}]'\n  \"$V\" > \"$V.tmp\" && mv \"$V.tmp\" \"$V\";\nfi; exit 0",
                     "stateEffect": "read",
-                    "evidenceEffect": "write"
+                    "evidenceEffect": "none"
                 },
                 "record:onEnter:0": {
                     "kind": "proof.fingerprint",
@@ -434,20 +478,21 @@
                 },
                 "done:onEnter:3": {
                     "kind": "shell",
-                    "invocation": "mkdir -p .spur/memory/sessions && echo \"checkpoint: task-pipeline done wbs=$wbs ts=$(date -u +%Y-%m-%dT%H:%M:%SZ)\" > .spur/memory/sessions/$wbs-checkpoint.md",
+                    "invocation": "mkdir -p .spur/memory/sessions; CP_TS=\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\"; CP_COMMIT=\"$(git rev-parse HEAD 2>/dev/null || echo unknown)\"; CP_DIGEST=\"$(cut -d= -f2 .spur/run/$wbs-proofdigest.txt 2>/dev/null || echo '')\"; CP_RUN=\"$SPUR_RUN_ID\"; [ -z \"$CP_RUN\" ] && CP_RUN=\"$RUN_ID\"; printf '%s\\n' '---' 'schema_version: 1' \"session_id: $(date -u +%Y-%m-%d)-$wbs\" 'workflow: task-pipeline' \"run_id: $CP_RUN\" \"task_wbs: $wbs\" 'feature_id: \"\"' 'phase: done' 'status: done' 'last_gate: record' \"source_commit: $CP_COMMIT\" \"digest: $CP_DIGEST\" \"generated_at: $CP_TS\" \"updated_at: $CP_TS\" \"next_action: none - task $wbs complete (terminal; advisory only)\" 'artifacts:' '  - .spur/run/$wbs-verdict.json' '  - .spur/run/$wbs-test-gate.log' '---' '' '## Session Notes' '' \"Terminal checkpoint for task $wbs (task-pipeline done).\" 'Advisory only; the task file is authoritative.' > .spur/memory/sessions/$wbs-checkpoint.md; exit 0",
                     "stateEffect": "write",
                     "evidenceEffect": "write"
                 }
-            }
+            },
+            "digest": "sha256:4098c91f865e9879987bb6049be911f021fe6a26843eced1085f631f33f1e47e"
         },
         "wrapup-pipeline": {
             "definition": "config/workflows/wrapup-pipeline.yaml",
             "boundary": "task-wrapup",
             "disposition": "keep",
             "callers": ["sp:spur-dev", "/sp:dev-wrap", "/sp:dev-wrapall"],
-            "terminalStates": ["done", "skipped"],
             "artifacts": ["wrapup-learnings", "wrapup-metrics"],
             "failurePolicy": "fail-closed",
+            "terminalStates": ["done", "skipped"],
             "modelQueries": ["doc-sync"],
             "actions": {
                 "start:onEnter:0": {
@@ -503,14 +548,14 @@
                     "stateEffect": "write",
                     "evidenceEffect": "write"
                 }
-            }
+            },
+            "digest": "sha256:390621dd339709682065e8954f2d1b49a195111c8372ec83e094fe7e2e35927f"
         },
         "pr-review": {
             "definition": "config/workflows/pr-review.yaml",
             "boundary": "pr-review",
             "disposition": "keep",
             "callers": ["sp:spur-dev", "/sp:dev-pr-review"],
-            "terminalStates": ["done", "pending", "failed"],
             "artifacts": [
                 "pr-context",
                 "pr-hygiene",
@@ -522,6 +567,7 @@
                 "pr-status"
             ],
             "failurePolicy": "fail-closed",
+            "terminalStates": ["done", "pending", "failed"],
             "modelQueries": [],
             "actions": {
                 "preflight:onEnter:0": {
@@ -577,16 +623,17 @@
                     "evidenceEffect": "write",
                     "disposition": "EXT"
                 }
-            }
+            },
+            "digest": "sha256:eb3f51877647f25907ed6b660b79e4d22b3c7462ceccacc4fc251eb31bac06f0"
         },
         "basic": {
             "definition": "config/workflows/basic.yaml",
             "boundary": "generic-execution",
             "disposition": "keep",
-            "artifacts": ["fix-attempt-counter", "gate-status"],
             "callers": ["spur workflow run"],
-            "terminalStates": ["done", "failed"],
+            "artifacts": ["fix-attempt-counter", "gate-status"],
             "failurePolicy": "fail-closed",
+            "terminalStates": ["done", "failed"],
             "modelQueries": ["fix"],
             "actions": {
                 "implement:onEnter:0": {
@@ -621,16 +668,17 @@
                     "stateEffect": "read",
                     "evidenceEffect": "none"
                 }
-            }
+            },
+            "digest": "sha256:fb8ab828b9527f225368d20b08e3fc7ca4b92e6e22642a57868da193d5ebef2c"
         },
         "feature-dev": {
             "definition": "config/workflows/feature-dev.yaml",
             "boundary": "feature-umbrella",
             "disposition": "keep",
-            "artifacts": ["feature-checkpoint"],
             "callers": ["/sp:dev-runall --feature"],
-            "terminalStates": ["done", "failed"],
+            "artifacts": ["feature-checkpoint"],
             "failurePolicy": "fail-closed",
+            "terminalStates": ["done", "failed"],
             "modelQueries": ["brainstorm", "plan", "execute-tasks-auto", "execute-tasks"],
             "actions": {
                 "precheck:onEnter:0": {
@@ -686,16 +734,17 @@
                     "evidenceEffect": "write",
                     "disposition": "GLUE"
                 }
-            }
+            },
+            "digest": "sha256:e1fa6b86cb7bcad0f927cf73336996ee8ce0088b6685cebba8c8849e26029529"
         },
         "wayfinder-resolution": {
             "definition": "config/workflows/wayfinder-resolution.yaml",
             "boundary": "wayfinder-resolution",
             "disposition": "keep",
-            "artifacts": ["wayfinder-report", "resolution-status"],
             "callers": ["spur workflow run"],
-            "terminalStates": ["done", "failed", "cancelled"],
+            "artifacts": ["wayfinder-report", "resolution-status"],
             "failurePolicy": "fail-closed",
+            "terminalStates": ["done", "failed", "cancelled"],
             "modelQueries": ["investigate", "verify"],
             "actions": {
                 "precheck:onEnter:0": {
@@ -774,7 +823,8 @@
                     "stateEffect": "read",
                     "evidenceEffect": "none"
                 }
-            }
+            },
+            "digest": "sha256:ef75f70a09b67ea5905ac68aba7c3eec2b805530312ca3173fa4b8ee7275059e"
         }
     }
 }

package/config/workflows/basic.yaml

@@ -24,7 +24,7 @@ failureStates:
 vars:
   # `task` is reserved by the engine runtime — use taskLabel for the free-form label.
   taskLabel: "task"
-  agent: "omp"
+  agent: "auto"
   stepTimeoutMs: "1800000"
   # Override per project: `--vars '{"qualityGateCmd":"bun run lint && bun run test"}'`
   qualityGateCmd: "bun run check"