@gobing-ai/spur 0.3.67 → 0.3.69

package/plugins/sp/scripts/task-size-precheck.ts

@@ -1,24 +1,23 @@
 #!/usr/bin/env bun
 /**
- * task-size-precheck — pipeline size precheck guard (R2, task 0454) plus the
- * size-vs-executor-capability gate (R3, task 0487).
+ * task-size-precheck — pipeline size precheck guard (R2, task 0454; count-only
+ * since task 0723).
  *
  * Shells `spur task show <wbs> --json`, evaluates R-item count and Plan
- * checklist count against limits, writes PASS/FAIL to status file. With
- * `--executor`, also shells `spur agent doctor <exec> --json` and blocks a large
- * task routed to a sub-`capable-1` executor.
+ * checklist count against limits, writes PASS/FAIL to status file. No executor
+ * or doctor involvement: executor liveness/routing/capabilities are attested
+ * fail-closed at the `agent.run` dispatch boundary, not predicted here.
  *
- * Always exits 0 (soft check, like doctor). The precheck→implement guard in
- * task-pipeline.yaml reads the status file.
+ * Always exits 0 (soft action). The precheck→implement guard in
+ * task-pipeline.yaml reads the status file; a missing or failing checker writes
+ * FAIL, so readiness fails closed.
  *
  * Ships with the plugin to arbitrary projects, so it stays node-builtin-only —
- * no workspace imports. The capability tier therefore comes from the CLI rather
- * than from `getExecutorTier` directly; `spur agent doctor --json` exposes it as
- * `capabilityTier` precisely so the inference regex is not duplicated here.
+ * no workspace imports.
  *
  * Usage:
  *   bun plugins/sp/scripts/task-size-precheck.ts <wbs> [--spur-bin <path>]
- *     [--max-reqs <n>] [--max-plan-items <n>] [--executor <name>]
+ *     [--max-reqs <n>] [--max-plan-items <n>]
  *
  * Env: SPUR_BIN, MAX_IMPLEMENT_REQS, MAX_IMPLEMENT_PLAN_ITEMS
  */
@@ -27,7 +26,6 @@ import { execFileSync } from 'node:child_process';
 import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { STAGE_FLOOR_TIER, TIER_ORDER } from './stage-registry-adapter';
 
 // ─── Regex (sync with packages/app/src/services/task-size-precheck.ts) ───────
 
@@ -37,32 +35,11 @@ const R_ITEM_RE = /^\s*-\s*\[[ xX]\]\s*(\*\*)?R\d+\./m;
 /** Matches checklist items under the Plan section. */
 const CHECKLIST_ITEM_RE = /^\s*-\s*\[[ xX]\]/m;
 
-/**
- * Large-task thresholds for the capability gate (R3, task 0487) — the DEFAULT
- * caps, not the overridable `--max-*` limits. Raising the caps says "I accept a
- * big task"; it does not make a flash-tier model able to finish one inside
- * `implementTimeoutMs`.
- */
-const LARGE_TASK_REQS = 5;
-const LARGE_TASK_PLAN_ITEMS = 8;
-
-/**
- * Capability tiers strong enough for a large task (R3, task 0487). The floor is
- * the `review` stage's Layer-1 tier — `reviewer` per `references/roles.md`,
- * read via the stage-registry adapter (0538 R4: no tier literal here; roles.md
- * is the pointer). Tiers at or above the floor pass. An unreachable roles.md
- * degrades to the pre-reconcile band — fail-closed for a safety gate.
- */
-const CAPABLE_TIERS: ReadonlySet<string> = (() => {
-    const floor = STAGE_FLOOR_TIER.get('review') ?? 'capable-1';
-    return new Set(TIER_ORDER.slice(Math.max(0, TIER_ORDER.indexOf(floor))));
-})();
-
 // ─── CLI ─────────────────────────────────────────────────────────────────────
 
 function usage(): never {
     console.error(
-        'Usage: bun plugins/sp/scripts/task-size-precheck.ts <wbs> [--spur-bin <path>] [--max-reqs <n>] [--max-plan-items <n>] [--executor <name>]',
+        'Usage: bun plugins/sp/scripts/task-size-precheck.ts <wbs> [--spur-bin <path>] [--max-reqs <n>] [--max-plan-items <n>]',
     );
     process.exit(1);
 }
@@ -87,13 +64,14 @@ function parseArgs(argv: string[]): {
     spurBin: string;
     maxReqs: number;
     maxPlanItems: number;
-    executor: string;
 } {
     let spurBin = defaultSpurBin();
     let wbs = '';
-    let maxReqs = Number(process.env.MAX_IMPLEMENT_REQS) || 5;
-    let maxPlanItems = Number(process.env.MAX_IMPLEMENT_PLAN_ITEMS) || 8;
-    let executor = '';
+    // Doubled deterministic ceiling (0723 operator decision): 10 R-items / 16
+    // Plan items — keep in sync with DEFAULT_TASK_SIZE_LIMITS in
+    // packages/app/src/services/task-size-precheck.ts (asserted by test).
+    let maxReqs = Number(process.env.MAX_IMPLEMENT_REQS) || 10;
+    let maxPlanItems = Number(process.env.MAX_IMPLEMENT_PLAN_ITEMS) || 16;
 
     let i = 0;
     while (i < argv.length) {
@@ -102,13 +80,10 @@ function parseArgs(argv: string[]): {
             spurBin = argv[i + 1] ?? defaultSpurBin();
             i += 2;
         } else if (arg === '--max-reqs') {
-            maxReqs = Number(argv[i + 1]) || 5;
+            maxReqs = Number(argv[i + 1]) || 10;
             i += 2;
         } else if (arg === '--max-plan-items') {
-            maxPlanItems = Number(argv[i + 1]) || 8;
-            i += 2;
-        } else if (arg === '--executor') {
-            executor = argv[i + 1] ?? '';
+            maxPlanItems = Number(argv[i + 1]) || 16;
             i += 2;
         } else if (!arg.startsWith('--')) {
             wbs = arg;
@@ -119,7 +94,7 @@ function parseArgs(argv: string[]): {
     }
 
     if (!wbs) usage();
-    return { wbs, spurBin, maxReqs, maxPlanItems, executor };
+    return { wbs, spurBin, maxReqs, maxPlanItems };
 }
 
 /**
@@ -135,29 +110,8 @@ function runSpur(spurBin: string, args: string[]): string {
     });
 }
 
-/**
- * Capability tier of `executor` per `spur agent doctor <exec> --json`.
- * Unknown executor, unreadable doctor output, or an undeclared-and-uninferrable
- * tier all read as `standard` — conservative: a false block is one flag away,
- * a false pass costs a 30-minute timed-out implement.
- */
-function resolveCapabilityTier(spurBin: string, executor: string): { tier: string; resolvedName: string } {
-    try {
-        const out = runSpur(spurBin, ['agent', 'doctor', executor, '--json']);
-        const row = JSON.parse(out)?.agents?.[0];
-        const tier = row?.capabilityTier;
-        // R1 (0622 F2/F4 residue): `doctor <role>` resolves the role to its cheapest
-        // eligible executor (`coder` → `omp`); surface the resolved executor name in
-        // the block message, not the role the caller passed in.
-        const resolvedName = typeof row?.agent === 'string' && row.agent.length > 0 ? row.agent : executor;
-        return { tier: typeof tier === 'string' && tier ? tier : 'standard', resolvedName };
-    } catch {
-        return { tier: 'standard', resolvedName: executor };
-    }
-}
-
 function main(): void {
-    const { wbs, spurBin, maxReqs, maxPlanItems, executor } = parseArgs(process.argv.slice(2));
+    const { wbs, spurBin, maxReqs, maxPlanItems } = parseArgs(process.argv.slice(2));
 
     // Fetch task content via spur
     let taskContent: string;
@@ -166,7 +120,7 @@ function main(): void {
         const task = JSON.parse(result);
         taskContent = task.content ?? task.body ?? '';
     } catch {
-        // If spur fails, write FAIL and exit 0 (soft, like doctor)
+        // If spur fails, write FAIL and exit 0 — the status file carries the verdict
         const statusDir = join(process.cwd(), '.spur', 'run');
         if (!existsSync(statusDir)) mkdirSync(statusDir, { recursive: true });
         writeFileSync(join(statusDir, `${wbs}-precheck-size.status`), 'FAIL\n');
@@ -187,18 +141,6 @@ function main(): void {
     const planItemCount = planBody.match(new RegExp(CHECKLIST_ITEM_RE.source, 'gm'))?.length ?? 0;
 
     const reasons: string[] = [];
-    // R3 (0487): a large task on a sub-capable executor blocks even when the caller
-    // raised the caps — the caps are an acceptance of size, not a capability grant.
-    if (executor && (reqCount > LARGE_TASK_REQS || planItemCount > LARGE_TASK_PLAN_ITEMS)) {
-        const { tier, resolvedName } = resolveCapabilityTier(spurBin, executor);
-        if (!CAPABLE_TIERS.has(tier)) {
-            reasons.push(
-                `Task size (${reqCount} R-items / ${planItemCount} Plan items) requires a capable executor, ` +
-                    `but ${resolvedName} is tier ${tier}. ` +
-                    `Pass \`--agent <capable>\` or \`--vars '{"implementAgent":"<capable>"}'\`, or split the task.`,
-            );
-        }
-    }
     if (reqCount > maxReqs) {
         reasons.push(
             `Task has ${reqCount} R-items (max ${maxReqs}). ` +

package/plugins/sp/skills/session-review/SKILL.md

@@ -46,6 +46,9 @@ cross-agent windows, recurrence, trends, or quantitative performance forensics.
   name the confirmation needed.
 - State `not available` when compaction or missing output removed evidence. Never reconstruct it from
   memory or claim a verification that did not run.
+- Derive timing only from timestamps and tool-call records visible in the active session. Use
+  non-overlapping stages whose durations sum to elapsed time; render unavailable duration or call
+  counts as `n/a` instead of estimating them.
 
 ## Triage mode (`--triage`)
 
@@ -91,6 +94,19 @@ three buckets — never skip triage and start fixing from the raw findings list.
 
 State the overall result in one to three sentences, including partial or blocked scope.
 
+### Time breakdown
+
+Summarize elapsed time and, when supported by evidence, productive work, avoidable setup/recovery,
+and operator wait time. Then render non-overlapping stages:
+
+| Stage | Time | Tool calls | Assessment |
+| --- | ---: | ---: | --- |
+
+Format durations as `M:SS` below one hour and `H:MM:SS` at one hour or above (`1:44`, not `1m44s`;
+`0:33`, not `33s`). Include a `Total` row when elapsed time is available. Keep operator approval
+waits separate from execution bottlenecks. Use `n/a` for any value not supported by the active
+session evidence.
+
 ### Resolved issues
 
 | Issue | Root cause | Resolution | Evidence |

package/plugins/sp/skills/spur-dev/references/cross-cutting.md

@@ -96,9 +96,9 @@ surface is already resolved and name the trigger / `operator override`. A comman
 inside that subprocess boundary runs its backing skill in that process; it must not spawn another
 `spur agent run` for the same trigger. This prevents recursive dispatch.
 
-**Pipeline wrappers (`dev-run`, `dev-runall`)** — the orchestrator is a loop; its *stages* do the
+**Pipeline wrappers (`dev-run`, `dev-runall`, `dev-idea`, `dev-plan`)** — the orchestrator is a loop; its *stages* do the
 model-bearing work. Interactive omit/`inline` therefore uses the
-[inline pipeline driver](inline-pipeline-driver.md): it reads `task-pipeline.yaml`, executes each
+[inline pipeline driver](inline-pipeline-driver.md): it reads the selected pipeline YAML, executes each
 `agent.run` input through the backing skill in the host session, and preserves every shell action
 and guard. `auto` or a named executor is merged into per-task `vars.agent` and
 `vars.implementAgent`, and the workflow's `agent.run` steps run under that subprocess executor (see
@@ -122,9 +122,11 @@ leg for eligible stages. Operator
 confirmation actions, `pause: true`, and approve/taste/ask decisions stay host-owned. Each inline
 model stage appends `stage <id> executed inline in session <session-id>` to its run log; a
 subagent-dispatched stage appends `stage <id> executed via subagent <agent-id> (host session
-<session-id>)` instead. `dev-plan` remains a workflow subprocess, as do `dev-run`/`dev-runall` with
-`--agent auto` or a name, parallel batches, and every headless `spur workflow run` / `spur agent
-run`. `dev-run --mode implement` continues to run its single competency in-session under omitted
+<session-id>)` instead. `dev-idea` and `dev-plan` also drive `idea-pipeline.yaml` in the host session,
+with no native subagent unless the operator explicitly requests delegation. `--agent auto` or a
+name, parallel batches, and every headless `spur workflow run` / `spur agent run` use subprocesses;
+dev-command workflow subprocesses launch `--async` so cancellation owns a process group and only
+`killed: true` means a live run stopped. `dev-run --mode implement` continues to run its single competency in-session under omitted
 `--agent` or explicit `--agent inline` (identical values, 0687 R1).
 
 ### Executor precedence chain (R7)
@@ -137,13 +139,14 @@ resolved in this order; first match wins:
 2. **`agent.default`** from `.spur/config.yaml` (project layer, then `~/.config/spur/config.yaml`) —
    `spur workflow run` injects it as the `agent` var when `vars.agent` was not set by the caller.
 3. **YAML literal `agent:` in the pipeline file** — the last-resort fallback declared in the
-   workflow YAML (e.g. `agent: "omp"` in `task-pipeline.yaml`). This fires only when no
+   workflow YAML. Every shipped pipeline declares `agent: "auto"`, so this rung resolves through
+   the role/tier ladder instead of pinning an executor name; it fires only when no
    `agent.default` is configured anywhere.
 
 `--agent auto` tier-resolves an executor (stage `model_policy` → `agent.default` → tier priority)
 **before** merging, so it enters the chain at step 1 already resolved to a concrete name.
 On a headless workflow surface, explicit `--agent inline` substitutes tier resolution with a warning
-(0687 R3) instead of rejecting — it resolves exactly like an omitted flag. Interactive task wrappers
+(0687 R3) instead of rejecting — it resolves exactly like an omitted flag. Interactive pipeline wrappers
 consume both inline resolutions identically (0508 eligibility as generalized by 0687 R2) before this
 chain and use the host driver. Omitting the flag on a headless surface forwards nothing, so the
 spawned step resolves to `agent.default` (step 2) or the YAML literal (step 3).
@@ -193,18 +196,17 @@ explicit process boundary and retain their existing resolution, output, timeout,
 contracts. The interactive task wrapper does not change the YAML or engine; it reads the YAML as
 SSOT and interprets the actions in-session before any workflow subprocess exists. It records inline
 provenance without fabricating an `AgentRunTracedResult`.
-`spur agent run` itself resolves omitted `--agent` to `agent.default`, rejects explicit `--agent
-inline` with the stable special error (a headless surface cannot host a session), and `--agent
-auto` tier-resolves — the unified `--agent` selector on the dev command surface does not change the
-CLI's resolution.
+`spur agent run` resolves omitted or explicit `inline` through tier substitution on its headless
+surface and emits one warning naming the concrete executor; `auto` tier-resolves without the inline
+warning. Interactive dev wrappers consume inline before this boundary, so they never spawn it.
 
 ### Inline trade-off
 
 Inline avoids process startup and preserves the host session's context and tools. Relative to
 subprocess dispatch it provides **no isolated workspace**, **no per-stage subprocess action
 record**, **no independent timeout or abort boundary**, and **no tier-selected executor**: the
-executor is the current coding agent. Interactive task pipelines retain a run log, run-link, and
-session provenance through the inline driver. If process isolation or an independently killable
+executor is the current coding agent. Interactive pipelines retain a run log and session provenance
+through the inline driver; task pipelines additionally record a task run-link. If process isolation or an independently killable
 stage is required, select the subprocess path (`--agent auto` or `--agent <name>`).
 
 ## Every write is CLI-gated
@@ -611,22 +613,30 @@ CLI-gated corpus artifact. The `wrapup-pipeline.yaml` `learning-capture` step wr
 ## Session Checkpoint Convention
 
 Long-running pipelines write resumable checkpoints to `.spur/memory/sessions/` so an interrupted
-run can be resumed. The convention is documented here; the actual checkpoint write/read actions
-in pipeline YAMLs are added in Phase 4 (task 0171).
+run can be resumed. The canonical frontmatter schema below is parsed by
+`packages/app/src/workflow/checkpoint-contract.ts` (task 0711): a checkpoint that does not match
+it is ignored by routing/cleanup (safe fallthrough) and never reclaimed.
 
-**Format:** Markdown file with YAML frontmatter:
+**Format:** Markdown file with YAML frontmatter (canonical field set, task 0711):
 
 ```yaml
 ---
+schema_version: 1
 session_id: "2026-07-01-0167"
 workflow: "task-pipeline"
 run_id: "wf_..."
 task_wbs: "0167"
 feature_id: "I"
 phase: "verify"
+status: "running"
 last_gate: "review-approved"
-timestamp: "2026-07-01T18:30:00Z"
+source_commit: "<full 40-hex HEAD at write time>"
+digest: "sha256:..."
+generated_at: "2026-07-01T18:30:00Z"
+updated_at: "2026-07-01T18:30:00Z"
 next_action: "run verification"
+artifacts:
+  - .spur/run/0167-verdict.json
 ---
 
 ## Session Notes
@@ -634,6 +644,17 @@ next_action: "run verification"
 <free-form markdown: what was done, what's pending, any blockers>
 ```
 
+Field semantics (enforced by `parseCheckpointMetadata` / `checkpointStaleness`):
+
+- `schema_version` must be `1`; any other value → ignored.
+- `status` is one of `running|pending|approved|done|failed|cancelled|skipped`. A terminal status
+  (`done|failed|cancelled|skipped`) marks the checkpoint terminal — never resumed, only cleaned
+  up once retention expires.
+- `source_commit` pins repository HEAD at write time; drift staleness is reported, not hidden.
+- `artifacts` lists referenced run files; a missing artifact makes the checkpoint stale.
+- Writers: write after every HITL gate decision, phase transition, and terminal state; overwrite
+  the same file on resume (`session_id` = `<date>-<wbs-or-feature>`).
+
 **Write checkpoints after:**
 
 - Every HITL gate decision (approved/rejected/deferred).
@@ -652,6 +673,10 @@ next_action: "run verification"
 - **Not CLI-gated.** Checkpoint files are written directly by the pipeline's checkpoint action
   (a `shell` step that writes to `.spur/memory/sessions/<session-id>.md`). They do not go through
   `spur task update`.
+- **Canonical schema.** The frontmatter above is the contract (task 0711 R1). Non-canonical or
+  malformed checkpoints are ignored by the router and kept (never silently deleted) by cleanup.
+- **Retention.** Terminal checkpoints older than `workflowLogRetentionDays` with no active run are
+  reclaimed by `spur workflow clean` (task 0711 R5–R8); non-terminal checkpoints are always kept.
 - **Not a validated corpus.** Checkpoints are working memory. They are overwritten when a session
   resumes and re-checkpoints. They are NOT authoritative task state — the task file is.
 - **One file per session.** The `session_id` is `<date>-<wbs-or-feature>`. A resumed session

package/plugins/sp/skills/spur-dev/references/dev-operations.md

@@ -74,7 +74,7 @@ each would be scope creep for one-liner procedures.
 | 4   | run        | `dev-run`           | `Skill()`         | `sp:spur-dev` (`run` / `implement`)                                                | `<wbs> [--mode <full\|implement>] [--agent <inline\|auto\|name>] [--auto] [--next] [--wrap] [--continue] [--worktree [<name>]]`                                                                                              |
 | 5   | refine     | `dev-refine`        | `Skill()`         | `sp:spur-dev` (`refine`)                                                           | `<wbs> [--focus <mode>] [--description <text>] [--depth <standard\|ready>] [--agent <inline\|auto\|name>] [--auto] [--next]`                                                                           |
 | 5a  | refineall  | `dev-refineall`     | `Skill()`         | `sp:spur-dev` (`refineall`)                                                        | `--feature <id> \| --tasks <selector> [--focus <mode>] [--description <text>] [--depth <standard\|ready>] [--agent <inline\|auto\|name>] [--auto] [--keep-going] [--status <s>] [--json] [--worktree [<name>]]` |
-| 6   | plan       | `dev-plan`          | `Skill()`         | `sp:spur-dev` (`plan`)                                                             | `"<description>" [--feature <id>] [--parent <feature-id>] [--agent <inline\|auto\|name>] [--skip-design] [--auto] [--approve-taste]`                                                                   |
+| 6   | plan       | `dev-plan`          | `Skill()`         | inline driver (`idea-pipeline`) or async workflow                                  | `"<description>" [--feature <id>] [--parent <feature-id>] [--agent <inline\|auto\|name>] [--skip-design] [--auto] [--approve-taste]`                                                                   |
 | 7   | docs       | _(no thin wrapper)_ | `Skill()`         | `sp:doc-evolve`                                                                    | `"<change description>"`                                                                                                                                                                               |
 | 8   | changelog  | `dev-changelog`     | `inline`          | git log + conventional-commit grouping                                             | `[--since <ref>] [--until <ref>] [--version <ver>]`                                                                                                                                                    |
 | 9   | gitmsg     | `dev-gitmsg`        | `inline`          | bounded diff capture → concern grouping → conventional commit                      | `[--commit] [--squash] [--all] [--scope <path>]`                                                                                                                            |
@@ -85,7 +85,7 @@ each would be scope creep for one-liner procedures.
 | 13a | parallel   | `dev-parallel`      | `Skill()`         | `sp:parallel-execution`                                                            | `--tasks <selector> [--feature <id>] [--mode <fan-out\|review-panel\|investigation>] [--agent <inline\|auto\|name>] [--json]`                                                                          |
 | 14  | wrap       | `dev-wrap`          | `Skill()`         | `spur workflow run` (wrapup-pipeline)                                              | `<wbs> [--agent <inline\|auto\|name>] [--auto] [--merge] [--dry-run]`                                                                                                                                 |
 | 15  | wrapall    | `dev-wrapall`       | `Skill()`         | `spur workflow run` (wrapup-pipeline)                                              | `[--since <iso>] [--feature <id>] [--status <s>] [--agent <inline\|auto\|name>] [--auto] [--merge] [--dry-run]`                                                                                        |
-| 16  | idea       | `dev-idea`          | `Skill()`         | `spur workflow run` (idea-pipeline)                                                | `"<idea>" [--auto] [--skip-design] [--approve-taste] [--agent <inline\|auto\|name>]`                                                                                                                                                  |
+| 16  | idea       | `dev-idea`          | `Skill()`         | inline driver (`idea-pipeline`) or async workflow                                  | `"<idea>" [--auto] [--skip-design] [--approve-taste] [--agent <inline\|auto\|name>]`                                                                                                                                                  |
 
 ## Skill-backed operations
 
@@ -255,7 +255,7 @@ must not be changed without updating the backing skill.
 ### 6. plan
 
 - **Purpose:** Plan a feature from a description — intake → feature create → AC generation → feature check gate → decomposition → batch-create (with **Design by default**).
-- **Inputs:** `"<description>"` (required). `--feature <id>` links to an existing feature. `--parent <feature-id>` nests under a parent. The planning pipeline's `agent.run` stages always dispatch a subprocess; `--agent <inline|auto|name>` selector accepted — `inline` substitutes tier resolution with a warning on this headless surface (task 0687) (see [SSOT](cross-cutting.md#inline-default-execution-surface)). **Design package flags (unified with `/sp:dev-idea`):**
+- **Inputs:** `"<description>"` (required). `--feature <id>` links to an existing feature. `--parent <feature-id>` nests under a parent. Omitted/`inline` drives `idea-pipeline.yaml` in the host session; `auto` or a name launches the async workflow worker. **Design package flags (unified with `/sp:dev-idea`):**
   - **Default:** author task `design` on every batch item + feature satellite when the seam heuristic fires (**ties lean design**). There is **no** `--design` force flag.
   - `--skip-design` — skip feature satellite **and** omit task `design` fields (scaffold only; refine fills later). Sole design opt-out.
   - `--approve-taste` — with `--auto`, pre-clear design-approval taste pause when that gate is used (`design_approved=true`). Alias: `--design-approved`.
@@ -340,9 +340,9 @@ must not be changed without updating the backing skill.
   - `--skip-design` — design package off (system-design + task Design).
   - `--approve-taste` — with `--auto`, skip **all** remaining taste pauses this run (idea-eval + design-approval). Sets `idea_approved=true` and `design_approved=true`.
     Aliases (prefer `--approve-taste`): `--idea-approved` → `idea_approved`; `--design-approved` → `design_approved`. There is **no** `--design` force flag.
-- **Backing:** `spur workflow run idea-pipeline.yaml` — direct workflow invocation.
-- **Behavior:** Builds vars from the table above and invokes the idea pipeline. Flow: discovery → **idea-eval** (taste; reject → cancelled) → feature-create → ac-generate → feature-check → system-design (conditional) → design-approval (taste) → decompose → batch-create → handoff. STOPS at handoff — no task execution, no pipeline nesting.
-- **Delegation:** Direct `spur workflow run idea-pipeline.yaml` (command maps flags → vars, then `Bash`).
+- **Backing:** `idea-pipeline.yaml` through the inline driver for omitted/`inline`, or `spur workflow run idea-pipeline.yaml --async` for `auto`/name.
+- **Behavior:** Builds vars from the table above and drives the idea pipeline. Flow: discovery → **idea-eval** (taste; reject → cancelled) → feature-create → ac-generate → feature-check → system-design (conditional) → design-approval (taste) → decompose → batch-create → handoff. STOPS at handoff — no task execution, no pipeline nesting. Headless runs use one `trace --follow`; cancellation is reported stopped only when `workflow cancel --json` returns `killed: true`.
+- **Delegation:** Host-session inline driver by default; explicit executor selection uses the async workflow worker.
 - **Idea-evaluation gate:** After discovery, operator reviews `.spur/run/idea-eval-report.md` ([idea-evaluation.md](idea-evaluation.md)). Approve continues; reject/cancel → no feature. Under `--auto`, still pauses unless taste pre-cleared (`--approve-taste` / alias). Enhanced idea is a sidecar — `vars.idea` is not overwritten.
 - **Design package (`--skip-design` only):**
 

package/plugins/sp/skills/spur-dev/references/execution-batch.md

@@ -421,6 +421,23 @@ written for a batch with nothing to run. The early-exit report carries zero per-
 terminal action runs. A contract test pins this
 (`plugins/sp/tests/dogfood-testing/execution-batch-contract.test.ts`).
 
+**Evidence persistence (worktree batches — task 0720 R3).** A worktree batch's Step 5 report and
+verdict artifacts live in the worktree's own `.spur/run/` while the batch runs — exactly the tree
+create-mode WT-4 deletes. Before any WT-4 removal, persist them into the **invoking** tree, which
+survives removal:
+
+- Write the emitted batch report to `.spur/run/worktree-<marker-id>-batch-report.md`.
+- Copy each attempted task's `.spur/run/<wbs>-verdict.json` from the worktree to
+  `.spur/run/worktree-<marker-id>-verdicts/<wbs>-verdict.json`.
+- Make the report's per-task verdict references use those persisted invoking-tree paths, not the
+  worktree-local paths that removal deletes.
+
+Evidence persistence precedes destructive cleanup: a persistence failure (unreadable verdict file,
+disk-full, missing directory) routes to **WT-5** — the worktree and branch are retained so a green
+batch can never destroy its own evidence. Reuse mode retains its operator-owned tree but still
+persists the Step 5 report under the invoking tree; the reused tree's `.spur/run/` remains the live
+copy while that tree lives on.
+
 ## Worktree isolation (`--worktree [<name>]`)
 
 When a batch command (`dev-runall`, `dev-refineall`, `dev-verifyall`) is invoked with
@@ -671,14 +688,52 @@ git checkout "$BASE_REF"
 [ "$(git rev-list --count "$BASE_SHA..$BRANCH")" -gt 0 ] \
   || { echo "halt: branch carries no commits - nothing to merge" >&2; false; }   # -> WT-5
 git merge --ff-only "$BRANCH"          # FF-only: never rebase, merge-commit, or resolve conflicts
-# if FF succeeded:
+# if FF succeeded — WT-4a evidence persistence (Step 5, task 0720 R3) runs FIRST:
+# persist the batch report + verdict artifacts into the invoking tree's .spur/run/
+# before anything below touches the worktree. Persistence failure routes to WT-5.
+#
+# WT-4b — bounded CWD-holder cleanup (task 0720 R1). Resolve the EXACT absolute
+# worktree path; a relative path or a stale entry matches the wrong processes.
+WT_PATH="$(cd "../<worktree-dir>" && pwd)"
+# Holders = processes with any open fd under the worktree tree (lsof +D walks the
+# tree; CWD holders are the common case but +D also catches open-file holders —
+# over-match errs toward removal success; a plain -t <dir> matches only the
+# directory itself). Orphaned `serve` proof daemons (PPID 1) are exactly this
+# class: they defeat `git worktree remove` (ENOTEMPTY), defeat rm -rf, while
+# `git worktree prune` still deregisters the tree. Note +D is a full-tree walk,
+# so the wait loop below bounds ITERATIONS (6 × 1s ticks + walk cost), not
+# wall-clock.
+HOLDERS="$(lsof -t +D "$WT_PATH" 2>/dev/null | sort -u)"
+if [ -n "$HOLDERS" ]; then
+  kill -TERM $HOLDERS 2>/dev/null            # 1) TERM first, all holders (unquoted — word-split PID list)
+  for _ in 1 2 3 4 5 6; do                   # 2) bounded wait: 6 × 1s ticks
+    sleep 1
+    [ -z "$(lsof -t +D "$WT_PATH" 2>/dev/null)" ] && break
+  done
+  SURVIVORS="$(lsof -t +D "$WT_PATH" 2>/dev/null | sort -u)"
+  if [ -n "$SURVIVORS" ]; then
+    kill -KILL $SURVIVORS 2>/dev/null       # 3) KILL only the survivors (unquoted — one arg per PID)
+    sleep 1
+  fi
+fi
+# 4) Re-query: only an EMPTY holder set may proceed to remove/prune/branch delete.
+FINAL="$(lsof -t +D "$WT_PATH" 2>/dev/null | sort -u)"
+if [ -n "$FINAL" ]; then
+  PORTS="$(lsof -nP -a -p "$(echo "$FINAL" | paste -sd, -)" -iTCP -sTCP:LISTEN 2>/dev/null \
+    | awk 'NR>1 {print $9}' | sort -u | paste -sd' ' -)"
+  echo "halt: worktree still held by PID(s): $FINAL ${PORTS:+listening: $PORTS}" >&2
+  exit 1                                     # -> WT-5: retain worktree + branch,
+fi                                           #   NO prune/remove/branch delete
 git worktree remove "../<worktree-dir>"
 git branch -d "$BRANCH"
 # update marker: status = "merged"
 ```
 
-On the zero-commit guard firing, fall through to **WT-5** with the halt cause *"branch carries no
-commits — nothing to merge"*: the worktree and branch are retained, never removed (task 0701 R1).
+On either guard firing — zero-commit branch (task 0701 R1), or surviving CWD holders (task 0720 R1)
+— fall through to **WT-5**: the worktree and branch are retained, never removed. While any holder
+remains, do **not** run `git worktree prune`, `git worktree remove`, or branch deletion. The holder
+halt report names every surviving PID; the listening port is best-effort — a CWD holder may own no
+socket, and `lsof` port discovery failing must not hide the PIDs.
 
 #### Reuse mode — merge, retain
 
@@ -711,14 +766,28 @@ risk losing work); WT-5 retains the worktree and branch whenever FF is impossibl
 Reuse mode is **narrower** than the carve-out (it merges but does not delete the branch), so the
 carve-out text needs no widening.
 
-**Lifecycle-DB disposition (task 0701 R2d).** The worktree has its own `.spur` lifecycle DB, and
-WT-4/WT-5 remove or retain that tree — the DB state does **not** travel with the merge. The
-**committed task file is authoritative**: after a green merge the branch's task files read
-`done`/`testing` while the invoking tree's DB still reports the pre-batch statuses. Re-sync
-explicitly by replaying the recorded terminal transitions in the invoking tree (`spur task update
-<wbs> <status>` per task, then `spur task record <wbs>`), or treat the batch report's per-task
-table as the source of truth. This is a deliberate choice over auto-migrating DB state: the DB is
-per-tree by design and the committed corpus files are the durable record.
+**Lifecycle-DB disposition (task 0701 R2d, amended by 0720).** The worktree has its own `.spur`
+lifecycle DB, and WT-4/WT-5 remove or retain that tree — the DB state does **not** travel with the
+merge. One contract, no alternatives:
+
+- **Committed task files own lifecycle state.** The **committed task file is authoritative**: after
+  a green merge the branch's task files already read `done`/`testing` in the invoking tree; no
+  `spur task update` or `spur task record` replay runs post-merge. Replay is not "one of two
+  options" — it is removed: it writes `updated_at`-only churn and can never restore worktree-only
+  DB rows.
+- **The persisted invoking-tree artifacts own evidence.** The Step 5 batch report at
+  `.spur/run/worktree-<marker-id>-batch-report.md` and the copied verdict JSONs under
+  `.spur/run/worktree-<marker-id>-verdicts/` (written before WT-4 removal) are the batch/verdict
+  record.
+- **Per-worktree lifecycle DB rows intentionally do not travel.** No `task_run_links` import, no
+  cross-database provenance synthesis — the DB is per-tree by design.
+- **No timestamp-only corpus churn.** Post-merge the invoking tree's DB statuses may read stale
+  relative to the committed files; that divergence is accepted, not repaired. Do not run
+  `task update`/`task record` to "catch up" the DB, and do not repair churn with
+  `git checkout -- docs/tasks*/`.
+
+This is a deliberate choice over auto-migrating DB state: the committed corpus files are the durable
+record and the persisted run artifacts are the evidence record.
 
 ### WT-5 — Failure path: retain and report (R5)
 

package/plugins/sp/skills/spur-dev/references/inline-pipeline-driver.md

@@ -1,6 +1,6 @@
 ---
 name: inline-pipeline-driver
-description: "Interactive host-session interpreter for task-pipeline.yaml: execute the existing FSM without a workflow agent subprocess while preserving actions, guards, artifacts, and provenance."
+description: "Interactive host-session interpreter for Spur state-machine pipelines: execute the existing FSM without a workflow agent subprocess while preserving actions, guards, artifacts, and provenance."
 see_also:
   - spur-dev
   - execution-workflow
@@ -9,12 +9,13 @@ see_also:
 
 # Inline Pipeline Driver
 
-This driver is the interactive control-inversion path granted by ADR-047. It applies only when an
-interactive `/sp:dev-run --mode full` or sequential `/sp:dev-runall` invocation omits `--agent` (now
-the inline default, 0687 R1) or passes `--agent inline`. A named executor, `--agent auto`, parallel
-batch mode, `spur workflow run`, and `spur agent run` keep the existing subprocess path.
+This driver is the interactive control-inversion path granted by ADR-047. It applies when an
+interactive `/sp:dev-run --mode full`, sequential `/sp:dev-runall`, `/sp:dev-idea`, or
+`/sp:dev-plan` invocation omits `--agent` or passes `--agent inline`. A named executor,
+`--agent auto`, parallel batch mode, `spur workflow run`, and `spur agent run` keep the existing
+subprocess path.
 
-The project runtime definition — `task-pipeline.yaml`, resolved through the two-tier
+The selected project runtime definition — `task-pipeline.yaml` or `idea-pipeline.yaml`, resolved through the two-tier
 project→bundled model (task 0648/0650, never an unbundled runtime path) — remains the sole
 FSM definition. The driver MUST read that file
 at invocation time. It must not copy the state list, actions, guards, or transition order into a
@@ -22,9 +23,9 @@ command, skill, script, or second workflow.
 
 ## Run setup
 
-1. Resolve `<wbs>`, `--auto`, and any explicit `--vars`; read the YAML and overlay its `vars` defaults
-   with those invocation values. An explicit `vars.agent` / `vars.implementAgent` is an executor
-   selection and therefore chooses the subprocess workflow path.
+1. Resolve the command inputs, `--auto`, and any explicit `--vars`; read the selected YAML and overlay
+   its `vars` defaults with those invocation values. An explicit non-inline executor selection
+   chooses the subprocess workflow path.
 2. Allocate a collision-resistant inline run id (`uuidgen`, with a timestamp/pid fallback), create
    `.spur/run/`, and use `.spur/run/<run-id>.log` as the run log.
 3. Resolve the host session id from `.spur/context/.session.json`, accepting the normalized hook key
@@ -42,13 +43,14 @@ command, skill, script, or second workflow.
      never per action.
    - **Source of truth** = the CLI projection for layer 1; the YAML parsed in step 1 for layer 2.
      Never hand-copy or hand-derive the state list into the driver, a command, a skill, or a script.
-5. Record lifecycle provenance before entering the FSM:
+5. For task execution only, record lifecycle provenance before entering the FSM:
 
    ```bash
    spur task run-link <wbs> --source inline-full --run-id <run-id> --json
    ```
 
-   This is required for the normal `testing → done` provenance guard. It is not a guard bypass.
+   This is required for the normal `testing → done` provenance guard. Planning pipelines have no
+   task lifecycle link and skip this task-specific action.
 
 ## YAML interpreter
 
@@ -61,12 +63,15 @@ Action semantics come from the YAML and the workflow action contract:
 - `shell` — run the expanded command in the project working tree with resolved vars exported as
   environment variables. A non-zero result follows the action's existing failure policy.
 - `note` — append the expanded message to the inline run log.
+- `doctor.probe` — run the declared Spur doctor once, persist its status file, and apply any
+  `setVars` result (including a resolved executor) before the next action or state.
 - `file.read.into-var` — read the declared file into the declared run variable before subsequent
   actions/guards.
 - `hitl.confirm` — under `profile=auto`, follow the YAML's auto-skip transition. Otherwise pause,
   surface the prompt, and resume from the same state with the operator's answer.
-- `agent.run` — execute the action's slash command, native-subagent-first (task 0508). Do not call
-  `spur agent run` and do not re-enter `/sp:dev-run --mode full`. Preserve the YAML options: capture
+- `agent.run` — execute the action's input in the host session. Task execution may use the native
+  subagent eligibility below; idea/plan never dispatch a native subagent unless the operator
+  explicitly requested delegation. Do not call `spur agent run` or re-enter a full pipeline. Preserve the YAML options: capture
   `answerFile`; assert `expectFile`; enforce `requireDiff` against a pre-action git snapshot,
   including the task-scope guard; honor declared error policy. `timeoutMs` is recorded as not
   applicable because the host session has no independent kill boundary.