@gobing-ai/spur 0.3.67 → 0.3.69

package/config/workflows/docs-pipeline.yaml

@@ -10,12 +10,13 @@
 #     /sp:dev-run --mode implement + sp:code-implementation, not YAML prose)
 #   - requireDiff fails silent no-op drafts
 #   - HITL answer routing is exhaustive (yes/no/cancel)
-#   - record → done is fail-closed on `spur task check`
+#   - verify measures the deliverable read-only (answer file + `spur task verdict` + proof
+#     digest bracket) — record → done is fail-closed on measured PASS, never on a stub
 
 "$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
 kind: state-machine
 name: docs-pipeline
-description: "Docs-only execution pipeline (precheck -> draft -> docs-review -> record -> done)"
+description: "Docs-only execution pipeline (precheck -> draft -> docs-review -> record -> verify -> done)"
 iterationBound: 12
 initialState: precheck
 terminalStates:
@@ -29,8 +30,16 @@ vars:
   wbs: "0000"
   profile: "standard"
   spurBin: "spur"
-  agent: "omp"
+  agent: "auto"
   stepTimeoutMs: "1800000"
+  # Proof-state bracket (task 0704, mirroring task-pipeline 0612/0703). `proofDigest` is the
+  # canonical capture at verify entry; `proofDigestNow` is the live re-capture compared against
+  # it by the `verify → done` guard so verifier-time mutation fails closed (R4/R5).
+  proofDigest: ""
+  proofDigestNow: ""
+  # `taskSpecPath` carries the task file path because `docs/tasks*` is excluded from the digest's
+  # git-tree half (task 0704 R4); resolved per-run by the verify state's taskpath shell step.
+  taskSpecPath: ""
   __hitlAnswer: ""
 
 states:
@@ -110,27 +119,78 @@ states:
           command: "$spurBin task record $wbs --solution-from-diff --transition testing"
 
   - id: done
-    description: Terminal — docs deliverable reviewed and recorded.
+    description: Terminal — docs deliverable measured, reviewed, and recorded.
     onEnter:
-      # Done gate requires a PASS verdict artifact (no silent no-artifact allow).
-      # Docs-only pipelines do not run /sp:dev-verify; write a docs-only PASS stub
-      # then transition. Override path remains: --force-done --reason.
+      # R1 (0704): no synthetic verdict writer. The verdict artifact is produced by measured
+      # verification in `verify` and registered there; done only performs the guarded
+      # transition. Override path remains: --force-done --reason.
       - kind: shell
         options:
-          command: >
-            mkdir -p .spur/run &&
-            printf '%s\n' "{\"wbs\":\"$wbs\",\"verdict\":\"PASS\",\"source\":\"docs-pipeline\",\"requirements\":[{\"id\":\"docs-deliverable\",\"status\":\"MET\",\"evidence\":\"docs-pipeline record step\"}],\"acceptanceCriteria\":[],\"checks\":[{\"name\":\"docs-only\",\"status\":\"pass\",\"evidence\":\"docs-pipeline\"}]}"
-            > ".spur/run/$wbs-verdict.json"
+          command: "$spurBin task update $wbs done --no-lifecycle"
+      - kind: note
+        options:
+          message: "Docs pipeline complete for task ${vars.wbs}."
+  - id: verify
+    description: >
+      Read-only measured verification (task 0704, R2/R4/R7): dispatch /sp:dev-verify --fix none
+      with an answer file, derive the ONE standard verdict via `spur task verdict`, register the
+      standard verify-verdict artifact, and bracket the verifier with proof-input digest capture/compare so any
+      task-spec or document mutation during certification fails closed (R4). No docs assurance
+      subclass — PASS semantics are identical to task-pipeline (R7).
+    onEnter:
+      # R4 (0703 R6 precedent): resolve the task-spec path BEFORE capture. `docs/tasks*` is
+      # excluded from the digest's git-tree half, so the spec is folded in via `taskFile`.
+      - kind: shell
+        options:
+          command: '$spurBin task path $wbs --json 2>/dev/null | jq -r ".path // .filePath // empty" > ".spur/run/$wbs-docs-taskpath.txt" || true; exit 0'
+      - kind: file.read.into-var
+        options:
+          path: .spur/run/${vars.wbs}-docs-taskpath.txt
+          var: taskSpecPath
+      # R4: canonical capture BEFORE the verifier runs. Same fingerprint input as the
+      # re-capture below so the bracket compares like for like.
+      - kind: proof.fingerprint
+        options:
+          var: proofDigest
+          taskFile: ${vars.taskSpecPath}
+          input: /sp:dev-verify ${vars.wbs} --auto --fix none --focus all
+          timeoutMs: ${vars.stepTimeoutMs}
+      - kind: agent.run
+        options:
+          agent: ${vars.agent}
+          # Observe-only (ADR-071 precedent): the verifier certifies, it never repairs.
+          # 0710 R2: verify runs in a fresh session — never inherits the implement hop's session.
+          freshSession: true
+          input: /sp:dev-verify ${vars.wbs} --auto --fix none --focus all
+          role: reviewer
+          timeoutMs: ${vars.stepTimeoutMs}
+          answerFile: .spur/run/${vars.wbs}-verify-answer.txt
+      - kind: shell
+        options:
+          command: "$spurBin task verdict $wbs --from-answer .spur/run/$wbs-verify-answer.txt"
+      # R7: stamp the proof block into the standard verdict artifact, then register it.
+      # Soft action + hard guard: a missing/malformed stamp fails the `verify -> done`
+      # guard below, not this step.
+      - kind: shell
+        options:
+          command: >-
+            V=".spur/run/$wbs-verdict.json";
+            if [ -f "$V" ] && [ -n "$proofDigest" ]; then
+              jq --arg d "$proofDigest" '. + {proof: {digest: $d, capturePoint: "docs-verify-entry"}}' "$V" > "$V.tmp" && mv "$V.tmp" "$V";
+            fi;
+            exit 0
       - kind: run.artifact
         options:
           path: .spur/run/${vars.wbs}-verdict.json
           artifactKind: verify-verdict
-      - kind: shell
+      # R4: re-capture AFTER the verifier. No `expect` here — an action-level abort would
+      # bypass the `failed` state; the `verify -> done` guard compares instead (R5).
+      - kind: proof.fingerprint
         options:
-          command: "$spurBin task update $wbs done --no-lifecycle"
-      - kind: note
-        options:
-          message: "Docs pipeline complete for task ${vars.wbs}."
+          var: proofDigestNow
+          taskFile: ${vars.taskSpecPath}
+          input: /sp:dev-verify ${vars.wbs} --auto --fix none --focus all
+          timeoutMs: ${vars.stepTimeoutMs}
 
   - id: failed
     description: Terminal — docs pipeline failed or was rejected.
@@ -188,16 +248,32 @@ transitions:
         command: 'test "$__hitlAnswer" = cancel'
 
   - from: record
+    to: verify
+    description: Recorded — measure the deliverable (R2). Structural task-check gates remain
+      at precheck, record (wip→testing), and done (verdict-artifact guard, R3).
+    guard:
+      kind: always
+
+  - from: verify
     to: done
-    description: Task check passed — certify done.
+    description: Measured PASS with the proof bracket intact (R4/R5).
     guard:
       kind: shell
       options:
-        command: "$spurBin task check $wbs"
-  - from: record
+        # Hardened (0703 P2 carry): every operand is required non-empty (`test -n`) so a
+        # missing file or empty var fails closed instead of empty-equals-empty passing.
+        command: >-
+          test -n "$proofDigest" &&
+          test -n "$proofDigestNow" &&
+          test "$proofDigestNow" = "$proofDigest" &&
+          test -f ".spur/run/$wbs-verdict.json" &&
+          test -n "$(jq -r '.verdict // empty' .spur/run/$wbs-verdict.json 2>/dev/null)" &&
+          test "$(jq -r '.verdict // empty' .spur/run/$wbs-verdict.json 2>/dev/null)" = PASS &&
+          test -n "$(jq -r '.proof.digest // empty' .spur/run/$wbs-verdict.json 2>/dev/null)" &&
+          test "$(jq -r '.proof.digest // empty' .spur/run/$wbs-verdict.json 2>/dev/null)" = "$proofDigest"
+  - from: verify
     to: failed
-    description: Task check failed — block before done.
+    description: Non-PASS verdict, missing/malformed answer, or digest mismatch (R5) — the run
+      reaches failed and no PASS artifact is certified.
     guard:
-      kind: shell
-      options:
-        command: '! $spurBin task check $wbs'
+      kind: always

package/config/workflows/feature-dev.yaml

@@ -44,7 +44,7 @@ failureStates:
   - failed
 vars:
   featureId: ""
-  agent: "omp"
+  agent: "auto"
   profile: "standard"
   spurBin: "spur"
   stepTimeoutMs: "1800000"

package/config/workflows/idea-pipeline.yaml

@@ -65,7 +65,8 @@ vars:
   spurBin: "spur"
   # R8 (0366): injected by WorkflowAppService.run(); stamps discovery artifact provenance.
   __runId: ""
-  agent: "omp"
+  agent: "auto"
+  planningAgent: ""
   stepTimeoutMs: "1800000"
 
 states:
@@ -78,20 +79,17 @@ states:
       - kind: note
         options:
           message: "Idea pipeline start for idea: ${vars.idea}"
+      - kind: doctor.probe
+        options:
+          resultFile: ".spur/run/${vars.__runId}-idea-precheck-doctor.status"
+          spurBin: "${vars.spurBin}"
+          agent: "${vars.agent}"
+          role: planner
+          resolvedAgentVar: planningAgent
       - kind: shell
         options:
           command: >-
-            mkdir -p .spur/run &&
-            DOCTOR_FILE=".spur/run/$__runId-idea-precheck-doctor.status" &&
-            set +e &&
-            $spurBin agent doctor $agent; doctor_rc=$?;
-            set -e &&
-            if [ "$doctor_rc" -eq 0 ] && test -n "$idea"; then
-              printf 'PASS\n' > "$DOCTOR_FILE";
-            else
-              printf 'FAIL\n' > "$DOCTOR_FILE";
-            fi &&
-            exit 0
+            test -n "$idea" || printf 'FAIL\n' > ".spur/run/$__runId-idea-precheck-doctor.status"
 
   - id: discovery
     description: >
@@ -106,7 +104,7 @@ states:
     onEnter:
       - kind: agent.run
         options:
-          agent: ${vars.agent}
+          agent: ${vars.planningAgent}
           input: "Run sp:brainstorm for the idea: ${vars.idea}. The skill owns the approach-generation, design summary, and `needs_design` signal criteria; emit .spur/run/${vars.__runId}-idea-needs-design.json ({\"needs_design\": true|false}) and the design summary per the skill's `Design Approval Gate` and `The needs_design signal` sections. Also emit the idea-evaluation report to .spur/run/${vars.__runId}-idea-eval-report.md per plugins/sp/skills/spur-dev/references/idea-evaluation.md (urgency/necessity 0–5, premises, pros/cons, alternatives, enhanced idea, recommendation). At the END of the report, append a provenance footer block of the exact form: `---\\nrun_id: ${vars.__runId}\\ngenerated_at: <RFC3339 timestamp>\\n---` (omit the footer only if run_id is empty)."
           # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
           role: planner
@@ -140,8 +138,8 @@ states:
     onEnter:
       - kind: agent.run
         options:
-          agent: ${vars.agent}
-          input: "Create a feature for the idea: ${vars.idea}. Read .spur/run/${vars.__runId}-idea-eval-report.md if present for the enhanced idea and scores. Use 'spur feature create \"<name>\" --json' to create it. Write the feature id to .spur/run/${vars.__runId}-idea-feature-id.txt. If an existing feature is appropriate, use its id instead. Also write two body-only intent artifacts: .spur/run/${vars.__runId}-idea-goal.md with concise Goal intent only (a short statement of what the feature achieves; never task breakdowns, checklists, or how-to steps), and .spur/run/${vars.__runId}-idea-scope.md with explicit in-scope and out-of-scope boundary bullets."
+          agent: ${vars.planningAgent}
+          input: 'Create a feature for the idea: ${vars.idea}. Read .spur/run/${vars.__runId}-idea-eval-report.md if present for the enhanced idea and scores. Use ''spur feature create "<name>" --json'' to create it. Write the feature id to .spur/run/${vars.__runId}-idea-feature-id.txt. If an existing feature is appropriate, use its id instead. Also write two body-only intent artifacts: .spur/run/${vars.__runId}-idea-goal.md with concise Goal intent only (a short statement of what the feature achieves; never task breakdowns, checklists, or how-to steps), and .spur/run/${vars.__runId}-idea-scope.md with explicit in-scope and out-of-scope boundary bullets.'
           # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
           role: planner
           expectFile: .spur/run/${vars.__runId}-idea-feature-id.txt
@@ -178,10 +176,10 @@ states:
     onEnter:
       - kind: shell
         options:
-          command: 'mkdir -p .spur/run && count=$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0); echo $((count + 1)) > .spur/run/$__runId-idea-ac-retry-count; rm -f .spur/run/$__runId-idea-ac-content.md .spur/run/$__runId-idea-ac-done.txt'
+          command: "mkdir -p .spur/run && count=$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0); echo $((count + 1)) > .spur/run/$__runId-idea-ac-retry-count; rm -f .spur/run/$__runId-idea-ac-content.md .spur/run/$__runId-idea-ac-done.txt"
       - kind: agent.run
         options:
-          agent: ${vars.agent}
+          agent: ${vars.planningAgent}
           input: "Generate acceptance criteria for feature ${vars.featureId}. Read the feature file and author R-numbered BDD Gherkin scenarios per ac-style-guide.md. Output only the complete Acceptance Criteria section body, including the gherkin code fence, with no surrounding commentary and no section heading."
           # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
           role: planner
@@ -243,8 +241,8 @@ states:
             test -f "$REVIEW" || printf '## Proposed design\n\n## Operator feedback\n\n## Reconciliation\n' > "$REVIEW"
       - kind: agent.run
         options:
-          agent: ${vars.agent}
-          input: "Run sp:sys-architecture for feature ${vars.featureId}. Read the brainstorm artifact, feature AC, and .spur/run/${vars.__runId}-idea-design-review.md. Produce ADR entries, architecture updates, and design satellites (docs/design/<slug>.md) following the constitution edit rules. Do not write task or feature corpus files directly. Design-review contract (.spur/run/${vars.__runId}-idea-design-review.md, fixed headings `## Proposed design`, `## Operator feedback`, `## Reconciliation`): on the first pass write the proposed design summary under `## Proposed design` and leave `## Operator feedback` empty; on retry with operator feedback present, revise the design/ADR artifacts, document the changes under `## Reconciliation`, and when the feedback invalidates an Acceptance Criteria scenario write the revised AC section body to a file and persist it via `$spurBin feature update \"$featureId\" --section \"Acceptance Criteria\" --from-file <file>` — never edit feature corpus files directly."
+          agent: ${vars.planningAgent}
+          input: 'Run sp:sys-architecture for feature ${vars.featureId}. Read the brainstorm artifact, feature AC, and .spur/run/${vars.__runId}-idea-design-review.md. Produce ADR entries, architecture updates, and design satellites (docs/design/<slug>.md) following the constitution edit rules. Do not write task or feature corpus files directly. Design-review contract (.spur/run/${vars.__runId}-idea-design-review.md, fixed headings `## Proposed design`, `## Operator feedback`, `## Reconciliation`): on the first pass write the proposed design summary under `## Proposed design` and leave `## Operator feedback` empty; on retry with operator feedback present, revise the design/ADR artifacts, document the changes under `## Reconciliation`, and when the feedback invalidates an Acceptance Criteria scenario write the revised AC section body to a file and persist it via `$spurBin feature update "$featureId" --section "Acceptance Criteria" --from-file <file>` — never edit feature corpus files directly.'
           # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
           role: planner
           expectFile: .spur/run/${vars.__runId}-idea-design-review.md
@@ -279,7 +277,7 @@ states:
     onEnter:
       - kind: shell
         options:
-          command: 'mkdir -p .spur/run && count=$(cat .spur/run/$__runId-idea-design-reject-count 2>/dev/null || echo 0); echo $((count + 1)) > .spur/run/$__runId-idea-design-reject-count'
+          command: "mkdir -p .spur/run && count=$(cat .spur/run/$__runId-idea-design-reject-count 2>/dev/null || echo 0); echo $((count + 1)) > .spur/run/$__runId-idea-design-reject-count"
       - kind: hitl.confirm
         options:
           prompt: "Review the system design for feature ${vars.featureId}. Approve to proceed to decomposition? To reject, first record your feedback in .spur/run/${vars.__runId}-idea-design-review.md under the `## Operator feedback` heading, then answer no."
@@ -296,10 +294,10 @@ states:
     onEnter:
       - kind: shell
         options:
-          command: 'mkdir -p .spur/run && count=$(cat .spur/run/$__runId-idea-decompose-retry-count 2>/dev/null || echo 0); echo $((count + 1)) > .spur/run/$__runId-idea-decompose-retry-count; rm -f .spur/run/$__runId-idea-task-batch.json .spur/run/$__runId-idea-task-order.json .spur/run/$__runId-idea-batch-create.done .spur/run/$__runId-idea-batch-create.failed .spur/run/$__runId-idea-batch-create-result.json .spur/run/$__runId-idea-handoff.md'
+          command: "mkdir -p .spur/run && count=$(cat .spur/run/$__runId-idea-decompose-retry-count 2>/dev/null || echo 0); echo $((count + 1)) > .spur/run/$__runId-idea-decompose-retry-count; rm -f .spur/run/$__runId-idea-task-batch.json .spur/run/$__runId-idea-task-order.json .spur/run/$__runId-idea-batch-create.done .spur/run/$__runId-idea-batch-create.failed .spur/run/$__runId-idea-batch-create-result.json .spur/run/$__runId-idea-handoff.md"
       - kind: agent.run
         options:
-          agent: ${vars.agent}
+          agent: ${vars.planningAgent}
           input: "Run sp:spec-decomposition for feature ${vars.featureId}. Read the brainstorm artifact, feature AC, and design doc. SIZING FIRST, before any JSON: apply the skill's `Default to NOT decomposing` rubric to the whole unit of work — if it scores 0-2 the correct output is a ONE-entry batch, not many. Scenario count is not task count: merge scenarios that one task delivers (same file surface, same subsystem, or unreadable apart in review), and list every scenario a task covers in its background. Merging never costs AC coverage — one task may carry several scenarios. Do not emit one entry per scenario or per requirement by reflex. Then produce a task-batch JSON array at .spur/run/${vars.__runId}-idea-task-batch.json, validated against apps/cli/schemas/task-batch.schema.json. Schema-permitted fields per entry: `name`, `background`, `requirements`, `feature_id`, `parent_wbs`, `priority`, `tags`, `template` — schema validation rejects anything else. Acceptance Criteria, Design, and Plan sections are filled in by the per-task refine step after batch-create, NOT at decompose time. Validate locally against the schema before emitting. Also emit the private task-order sidecar at .spur/run/${vars.__runId}-idea-task-order.json: a JSON array (one entry per batch item) of `{ name: <exact batch item name>, depends_on_names: [<batch item names>] }` declaring ordering/dependencies between the batch items; use `[]` when no ordering exists. Every `name` and every dependency must match exactly one batch item `name` — it is private workflow data, not part of task-batch.schema.json."
           # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
           role: planner
@@ -723,7 +721,7 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test -f .spur/run/$__runId-idea-batch-create.done'
+        command: "test -f .spur/run/$__runId-idea-batch-create.done"
   - from: batch-create-run
     to: decompose
     description: "Batch-create failed — revise decomposition (retry cap: 3)."