@gobing-ai/spur 0.3.69 → 0.3.70

package/config/workflows/task-pipeline.yaml

@@ -218,6 +218,25 @@ states:
               echo "FAIL" > "$SIZE_FILE";
             fi &&
             exit 0
+      # 0726 R2: task evidence precheck — deterministic live-data
+      # evidence-channel proof before implement dispatch. Writes PASS/FAIL to
+      # .spur/run/<wbs>-precheck-evidence.status. Always exit 0 (soft action);
+      # the precheck→implement guard reads the file, so a missing checker
+      # fails closed (writes FAIL, never PASS).
+      - kind: shell
+        options:
+          command: >-
+            EVID_FILE=".spur/run/$wbs-precheck-evidence.status" &&
+            mkdir -p .spur/run &&
+            if [ -f plugins/sp/scripts/task-evidence-precheck.ts ]; then
+            bun plugins/sp/scripts/task-evidence-precheck.ts "$wbs"
+            --spur-bin "$spurBin";
+            else
+              echo "task-evidence-precheck failed closed —" >&2 &&
+              echo "plugins/sp/scripts/task-evidence-precheck.ts absent." >&2 &&
+              echo "FAIL" > "$EVID_FILE";
+            fi &&
+            exit 0
 
   - id: implement
     description: >
@@ -536,7 +555,17 @@ states:
           priority: ${vars.taskPriority}
           compareExecutorWith: implement
           timeoutMs: ${vars.stepTimeoutMs}
-          answerFile: .spur/run/${vars.wbs}-verify-answer.txt
+          expectFile: .spur/run/${vars.wbs}-verify-answer.txt
+      # 0726 R3: hard lint gate over the verifier-owned answer — shape and
+      # evidence-row identity, before the verdict derivation reads it.
+      # Hard action: a malformed answer halts the sequence here instead of
+      # poisoning the verdict parse downstream.
+      - kind: shell
+        options:
+          command: >-
+            bun plugins/sp/scripts/verify-answer-lint.ts "$wbs"
+            --answer ".spur/run/$wbs-verify-answer.txt"
+            --spur-bin "$spurBin"
       - kind: shell
         options:
           command: "$spurBin task verdict $wbs --from-answer .spur/run/$wbs-verify-answer.txt"
@@ -679,11 +708,11 @@ transitions:
   # ── precheck: size PASS + task check → implement; else → failed ──
   - from: precheck
     to: implement
-    description: Deterministic size and task checks are green — begin implementation.
+    description: Deterministic size, evidence, and task checks are green — begin implementation.
     guard:
       kind: shell
       options:
-        command: 'test "$(cat .spur/run/$wbs-precheck-size.status 2>/dev/null)" = PASS && $spurBin task check $wbs'
+        command: 'test "$(cat .spur/run/$wbs-precheck-size.status 2>/dev/null)" = PASS && test "$(cat .spur/run/$wbs-precheck-evidence.status 2>/dev/null)" = PASS && $spurBin task check $wbs'
   - from: precheck
     to: failed
     description: Size and/or task check failed — stop before implement.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.3.69",
+    "version": "0.3.70",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",
@@ -53,14 +53,14 @@
     },
     "devDependencies": {
         "@commander-js/extra-typings": "^14.0.0",
-        "@gobing-ai/ts-db": "^0.4.48",
-        "@gobing-ai/ts-ai-runner": "^0.4.48",
-        "@gobing-ai/ts-dual-workflow-engine": "^0.4.48",
-        "@gobing-ai/ts-infra": "^0.4.48",
-        "@gobing-ai/ts-llm-jsonl-importer": "^0.4.48",
-        "@gobing-ai/ts-rule-engine": "^0.4.48",
-        "@gobing-ai/ts-runtime": "^0.4.48",
-        "@gobing-ai/ts-utils": "^0.4.48",
+        "@gobing-ai/ts-db": "^0.4.49",
+        "@gobing-ai/ts-ai-runner": "^0.4.49",
+        "@gobing-ai/ts-dual-workflow-engine": "^0.4.49",
+        "@gobing-ai/ts-infra": "^0.4.49",
+        "@gobing-ai/ts-llm-jsonl-importer": "^0.4.49",
+        "@gobing-ai/ts-rule-engine": "^0.4.49",
+        "@gobing-ai/ts-runtime": "^0.4.49",
+        "@gobing-ai/ts-utils": "^0.4.49",
         "@types/bun": "1.3.14",
         "@types/figlet": "^1.7.0",
         "@types/node-notifier": "8.0.5",

package/plugins/sp/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "sp",
-    "version": "0.3.69",
+    "version": "0.3.70",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics.",
     "extensions": {
         "pi": ["./hooks/pi/guard-extension.ts"]

package/plugins/sp/scripts/task-evidence-precheck.ts

@@ -0,0 +1,181 @@
+#!/usr/bin/env bun
+/**
+ * task-evidence-precheck — deterministic evidence-channel precheck (R2, task 0726).
+ *
+ * Parses the task content for an exact `evidence-channel:` declaration and proves the
+ * declared live-data channel exists in the local spur database before implementation
+ * begins. Currently exactly one channel is allowlisted:
+ *
+ *   evidence-channel: history_tool_call.args_raw[pi]
+ *
+ * …satisfied only when the fixed query
+ *
+ *   SELECT COUNT(*) FROM history_tool_call WHERE args_raw IS NOT NULL AND source = 'pi'
+ *
+ * returns a positive count on `<cwd>/.spur/spur.db` — i.e. a live non-dry-run pi import
+ * has already preserved tool-call `args_raw` (0722 R1). Unknown declarations, a missing
+ * database, a missing table, and a zero count all fail closed.
+ *
+ * A task without any `evidence-channel:` declaration passes without opening SQLite —
+ * the check only gates tasks that declare a live-data evidence channel.
+ *
+ * Always exits 0 (soft action). Both precheck→implement guards in task-pipeline.yaml
+ * read the status file; a missing or failing checker writes FAIL, so readiness fails
+ * closed.
+ *
+ * Ships with the plugin to arbitrary projects; node-builtin + bun:sqlite only —
+ * no workspace imports.
+ *
+ * Usage:
+ *   bun plugins/sp/scripts/task-evidence-precheck.ts <wbs> [--spur-bin <path>]
+ *
+ * Env: SPUR_BIN
+ */
+
+import { Database } from 'bun:sqlite';
+import { execFileSync } from 'node:child_process';
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+/** Exact task-content declaration that activates the live-evidence gate (0726 R2). */
+const DECLARATION_PREFIX = 'evidence-channel:';
+
+/** The only allowlisted live-data channel (0726 R2). */
+const EVIDENCE_CHANNEL = 'history_tool_call.args_raw[pi]';
+
+/** Declaration text as it must appear in the task body. */
+const DECLARATION = `${DECLARATION_PREFIX} ${EVIDENCE_CHANNEL}`;
+
+/** The only live-data query this precheck is allowed to run — fixed, never task-authored. */
+const EVIDENCE_QUERY = "SELECT COUNT(*) AS n FROM history_tool_call WHERE args_raw IS NOT NULL AND source = 'pi'";
+
+// ─── CLI (same spur-bin chain as task-size-precheck.ts) ─────────────────────
+
+function usage(): never {
+    console.error('Usage: bun plugins/sp/scripts/task-evidence-precheck.ts <wbs> [--spur-bin <path>]');
+    process.exit(1);
+}
+
+function defaultSpurBin(): string {
+    if (process.env.SPUR_BIN) return process.env.SPUR_BIN;
+    const local = fileURLToPath(new URL('../../../apps/cli/src/index.ts', import.meta.url));
+    if (existsSync(local)) return `bun ${local}`;
+    return 'spur';
+}
+
+function parseArgs(argv: string[]): { wbs: string; spurBin: string } {
+    let spurBin = defaultSpurBin();
+    let wbs = '';
+    let i = 0;
+    while (i < argv.length) {
+        const arg = argv[i];
+        if (arg === '--spur-bin') {
+            spurBin = argv[i + 1] ?? defaultSpurBin();
+            i += 2;
+        } else if (!arg.startsWith('--')) {
+            wbs = arg;
+            i++;
+        } else {
+            i++;
+        }
+    }
+    if (!wbs) usage();
+    return { wbs, spurBin };
+}
+
+/**
+ * Split a multi-token `spurBin` (`<runtime> <mainModule>`) the same way
+ * `runSpurJson` does in feature-sync-bounded.ts — execFileSync's first arg is
+ * one executable path, not a shell command line.
+ */
+function runSpur(spurBin: string, args: string[]): string {
+    const [file = 'spur', ...lead] = spurBin.split(/\s+/).filter(Boolean);
+    return execFileSync(file, [...lead, ...args], {
+        encoding: 'utf-8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+    });
+}
+
+function writeStatus(wbs: string, status: 'PASS' | 'FAIL'): void {
+    const statusDir = join(process.cwd(), '.spur', 'run');
+    if (!existsSync(statusDir)) mkdirSync(statusDir, { recursive: true });
+    writeFileSync(join(statusDir, `${wbs}-precheck-evidence.status`), `${status}\n`);
+}
+
+function fail(wbs: string, reasons: string[]): void {
+    writeStatus(wbs, 'FAIL');
+    console.error(`task-evidence-precheck: FAIL`);
+    for (const r of reasons) {
+        console.error(`  ${r}`);
+    }
+    process.exit(0);
+}
+
+function main(): void {
+    const { wbs, spurBin } = parseArgs(process.argv.slice(2));
+
+    let taskContent: string;
+    try {
+        const result = runSpur(spurBin, ['task', 'show', wbs, '--json']);
+        const task = JSON.parse(result);
+        taskContent = task.content ?? task.body ?? '';
+    } catch {
+        fail(wbs, [`could not fetch task ${wbs} via ${spurBin} — evidence channel unverifiable`]);
+    }
+
+    // Collect every declaration token. A repeated exact declaration still gates the
+    // single fixed query; any non-allowlisted token is an unknown declaration.
+    const declarations: string[] = [];
+    for (const match of taskContent.matchAll(/evidence-channel:\s*(\S+)/g)) {
+        declarations.push(match[1] ?? '');
+    }
+    const unknown = declarations.filter((d) => d !== EVIDENCE_CHANNEL);
+    if (unknown.length > 0) {
+        fail(wbs, [
+            `unknown evidence-channel declaration(s): ${unknown.join(', ')}`,
+            `allowlisted declaration: ${DECLARATION}`,
+        ]);
+    }
+    if (declarations.length === 0) {
+        writeStatus(wbs, 'PASS');
+        console.error(`task-evidence-precheck: PASS — no evidence-channel declaration; live-data gate not active`);
+        process.exit(0);
+    }
+
+    const dbPath = join(process.cwd(), '.spur', 'spur.db');
+    if (!existsSync(dbPath)) {
+        fail(wbs, [`spur database not found at ${dbPath} — run a real history import first`]);
+    }
+
+    let count: number;
+    try {
+        const db = new Database(dbPath, { readonly: true });
+        try {
+            const row = db.query(EVIDENCE_QUERY).get() as { n: number } | undefined;
+            count = row?.n ?? 0;
+        } finally {
+            db.close();
+        }
+    } catch (e) {
+        fail(wbs, [
+            `evidence query failed on ${dbPath}: ${e instanceof Error ? e.message : String(e)}`,
+            'history_tool_call table missing or unreadable — run a real history import first',
+        ]);
+    }
+
+    if (!(count > 0)) {
+        fail(wbs, [
+            `0 live pi rows with args_raw (query: ${EVIDENCE_QUERY})`,
+            'run a non-dry-run pi history import with a safe importer before implementing',
+        ]);
+    }
+
+    writeStatus(wbs, 'PASS');
+    console.error(
+        `task-evidence-precheck: PASS — ${count} live pi history_tool_call row(s) with args_raw (declaration: ${DECLARATION})`,
+    );
+    process.exit(0);
+}
+
+main();

package/plugins/sp/scripts/verify-answer-lint.ts

@@ -0,0 +1,386 @@
+#!/usr/bin/env bun
+/**
+ * verify-answer-lint — deterministic pre-verdict answer lint (0726 R3).
+ *
+ * Runs AFTER the verify agent exits and BEFORE `spur task verdict --from-answer`.
+ * The verifier owns the answer file (`.spur/run/<wbs>-verify-answer.txt`): it creates
+ * it with `Verdict: PARTIAL`, appends one complete requirement/AC row at a time, and
+ * only replaces the first verdict line once every row is certified. Because the file
+ * is now append-progress instead of a single captured blob, malformed rows can reach
+ * the verdict step — this lint rejects each invalid class with a row-level message:
+ *
+ *   - missing, duplicate, or unknown requirement IDs (vs the task's Requirements)
+ *   - AC IDs that do not exactly match the task's AC checklist label or a linked
+ *     feature scenario title
+ *   - status / evidence-type values the verdict parser would drop
+ *   - empty evidence
+ *
+ * Compound evidence types (`test + command`) stay valid — normalization mirrors
+ * `packages/app/src/services/task-verdict.ts` exactly, so anything this lint accepts
+ * is also accepted by `spur task verdict --from-answer` (and vice versa).
+ *
+ * Exits non-zero on any finding, with bounded diagnostics (first 10). Writes nothing.
+ *
+ * Ships with the plugin to arbitrary projects; node-builtin only — no workspace imports.
+ *
+ * Usage:
+ *   bun plugins/sp/scripts/verify-answer-lint.ts <wbs> --answer <path> [--spur-bin <path>]
+ *
+ * Env: SPUR_BIN
+ */
+
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+// ─── CLI (same spur-bin chain as task-evidence-precheck.ts) ─────────────────
+
+function usage(): never {
+    console.error('Usage: bun plugins/sp/scripts/verify-answer-lint.ts <wbs> --answer <path> [--spur-bin <path>]');
+    process.exit(1);
+}
+
+function defaultSpurBin(): string {
+    if (process.env.SPUR_BIN) return process.env.SPUR_BIN;
+    const local = fileURLToPath(new URL('../../../apps/cli/src/index.ts', import.meta.url));
+    if (existsSync(local)) return `bun ${local}`;
+    return 'spur';
+}
+
+function parseArgs(argv: string[]): { wbs: string; answer: string; spurBin: string } {
+    let spurBin = defaultSpurBin();
+    let wbs = '';
+    let answer = '';
+    let i = 0;
+    while (i < argv.length) {
+        const arg = argv[i];
+        if (arg === '--spur-bin') {
+            spurBin = argv[i + 1] ?? defaultSpurBin();
+            i += 2;
+        } else if (arg === '--answer') {
+            answer = argv[i + 1] ?? '';
+            i += 2;
+        } else if (!arg.startsWith('--')) {
+            wbs = arg;
+            i++;
+        } else {
+            i++;
+        }
+    }
+    if (!wbs || !answer) usage();
+    return { wbs, answer, spurBin };
+}
+
+function runSpur(spurBin: string, args: string[]): string {
+    const [file = 'spur', ...lead] = spurBin.split(/\s+/).filter(Boolean);
+    return execFileSync(file, [...lead, ...args], {
+        encoding: 'utf-8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+    });
+}
+
+// ─── Answer parsing — mirrors packages/app/src/services/task-verdict.ts ─────
+
+interface ReqRow {
+    id: string;
+    status: string;
+    evidence: string;
+    line: number;
+}
+interface AcRow {
+    id: string;
+    status: string;
+    evidenceType: string;
+    evidence: string;
+    line: number;
+}
+
+function splitTableCells(line: string): string[] {
+    return line
+        .split(/(?<!\\)\|/)
+        .map((c) => c.replace(/\\\|/g, '|').trim())
+        .filter(Boolean);
+}
+
+function normalizeReqStatus(raw: string): string | null {
+    if (/\bMET\b/.test(raw)) return 'MET';
+    if (/\bPARTIAL\b/.test(raw)) return 'PARTIAL';
+    if (/\bUNMET\b/.test(raw)) return 'UNMET';
+    return null;
+}
+
+function normalizeAcStatus(raw: string): string | null {
+    if (/\bMET\b/.test(raw)) return 'MET';
+    if (/\bPARTIAL\b/.test(raw)) return 'PARTIAL';
+    if (/\bUNMET\b/.test(raw)) return 'UNMET';
+    if (/\bN\/A\b/.test(raw) || /\bNA\b/.test(raw)) return 'N/A';
+    return null;
+}
+
+function normalizeEvidenceTypeToken(normalized: string): string | null {
+    if (normalized === 'test') return 'test';
+    if (normalized === 'command') return 'command';
+    if (
+        normalized === 'static-ref' ||
+        normalized === 'static' ||
+        normalized === 'doc' ||
+        normalized === 'docs' ||
+        normalized === 'documentation'
+    ) {
+        return 'static-ref';
+    }
+    if (normalized === 'manual-review' || normalized === 'manual') return 'manual-review';
+    if (normalized === 'llm-judge' || normalized === 'judge') return 'llm-judge';
+    if (normalized === 'n/a' || normalized === 'na') return 'n/a';
+    return null;
+}
+
+const EVIDENCE_TYPE_PRECEDENCE = ['test', 'command', 'static-ref', 'manual-review', 'llm-judge', 'n/a'] as const;
+
+function normalizeEvidenceType(raw: string): string | null {
+    const normalized = raw.toLowerCase().trim();
+    const single = normalizeEvidenceTypeToken(normalized);
+    if (single !== null) return single;
+    const parts = normalized.split(/[+,/]/).filter((p) => p.trim());
+    const tokens = parts.map((part) => normalizeEvidenceTypeToken(part.trim())).filter((t) => t !== null);
+    if (tokens.length < 2 || tokens.length !== parts.length) return null;
+    return EVIDENCE_TYPE_PRECEDENCE.find((candidate) => tokens.includes(candidate)) ?? null;
+}
+
+interface AnswerTables {
+    verdict: { value: string; line: number } | null;
+    reqs: ReqRow[];
+    acs: AcRow[];
+}
+
+function parseAnswer(text: string): AnswerTables {
+    const out: AnswerTables = { verdict: null, reqs: [], acs: [] };
+    const lines = text.split('\n');
+    let reqTable = false;
+    let acTable = false;
+
+    for (let i = 0; i < lines.length; i++) {
+        const trimmed = lines[i]?.trim() ?? '';
+        const lineNo = i + 1;
+
+        // A markdown heading closes whichever table is open (mirrors the verdict parser).
+        if ((reqTable || acTable) && /^#{1,6}\s/.test(trimmed)) {
+            reqTable = false;
+            acTable = false;
+            continue;
+        }
+        if (!trimmed.startsWith('|')) continue;
+        const cells = splitTableCells(trimmed);
+        if (/^[-:]+$/.test(cells[0] ?? '')) continue;
+
+        const h0 = (cells[0] ?? '').toLowerCase();
+        const h1 = (cells[1] ?? '').toLowerCase();
+
+        // Requirement header: `| Req | Status | Evidence |` (id-like first cell + status column).
+        if (!reqTable && !acTable && cells.length >= 2) {
+            const idLike = h0.includes('req') || h0 === 'requirement' || h0 === 'r#' || h0 === 'r' || /^r\d+$/.test(h0);
+            if (idLike && (h1.includes('status') || h1 === 'verdict')) {
+                reqTable = true;
+                continue;
+            }
+            if (
+                (h0 === 'ac' || h0.includes('acceptance')) &&
+                h1.includes('status') &&
+                (cells[2] ?? '').toLowerCase().includes('evidence')
+            ) {
+                acTable = true;
+                continue;
+            }
+        }
+
+        if (reqTable && cells.length >= 2) {
+            // An AC header following the requirement table closes it (mirrors the parser).
+            if ((h0 === 'ac' || h0.includes('acceptance')) && h1.includes('status')) {
+                reqTable = false;
+                acTable = true;
+                continue;
+            }
+            out.reqs.push({
+                id: cells[0] ?? '',
+                status: (cells[1] ?? '').toUpperCase(),
+                evidence: cells[2] ?? '',
+                line: lineNo,
+            });
+            continue;
+        }
+        if (acTable && cells.length >= 3) {
+            out.acs.push({
+                id: cells[0] ?? '',
+                status: cells[1] ?? '',
+                evidenceType: cells[2] ?? '',
+                evidence: cells[3] ?? '',
+                line: lineNo,
+            });
+        }
+    }
+
+    const verdictMatches = [...text.matchAll(/^\s*Verdict:\s*(\S+)\s*$/gim)];
+    if (verdictMatches.length === 1) {
+        out.verdict = {
+            value: verdictMatches[0]?.[1] ?? '',
+            line: text.slice(0, verdictMatches[0]?.index ?? 0).split('\n').length,
+        };
+    }
+    return out;
+}
+
+// ─── Task-side identity extraction ───────────────────────────────────────────
+
+function sectionBetween(text: string, heading: string): string {
+    const marker = new RegExp(`^#{1,6}\\s+${heading}\\s*$`, 'im');
+    const match = marker.exec(text);
+    if (!match || match.index === undefined) return '';
+    const rest = text.slice(match.index);
+    const lineEnd = rest.indexOf('\n');
+    const afterHeading = lineEnd === -1 ? '' : rest.slice(lineEnd + 1);
+    const next = afterHeading.search(/^#{1,6}\s/m);
+    return next === -1 ? afterHeading : afterHeading.slice(0, next);
+}
+
+function extractRequirementIds(taskContent: string): string[] {
+    const section = sectionBetween(taskContent, 'Requirements');
+    const ids = new Set<string>();
+    for (const m of section.matchAll(/\*\*(R\d+(?:\.\d+)*)\s*\./g)) ids.add(m[1] ?? '');
+    for (const m of section.matchAll(/\*\*(R\d+(?:\.\d+)*)\*\*/g)) ids.add(m[1] ?? '');
+    return [...ids];
+}
+
+function extractAcIdentities(taskContent: string, featureContent: string | null): string[] {
+    const identities = new Set<string>();
+    const section = sectionBetween(taskContent, 'Acceptance Criteria');
+    for (const m of section.matchAll(/^[-*]\s+\[[ x]\]\s+(.+?)\s*(?::|$)/gm)) {
+        const label = (m[1] ?? '').trim();
+        if (!label) continue;
+        identities.add(label);
+        const leading = label.split(/\s+/)[0] ?? '';
+        if (leading && leading !== label) identities.add(leading);
+    }
+    if (featureContent !== null) {
+        for (const m of featureContent.matchAll(/^[ \t]*Scenario:\s*(.+)\s*$/gm)) {
+            const title = (m[1] ?? '').trim();
+            if (title) identities.add(title);
+        }
+    }
+    return [...identities];
+}
+
+// ─── Main ────────────────────────────────────────────────────────────────────
+
+function main(): void {
+    const { wbs, answer, spurBin } = parseArgs(process.argv.slice(2));
+    const findings: string[] = [];
+    const add = (msg: string): void => {
+        if (findings.length < 10) findings.push(msg);
+    };
+
+    if (!existsSync(answer)) {
+        console.error(`verify-answer-lint: FAIL — answer file not found: ${answer}`);
+        process.exit(1);
+    }
+    const raw = readFileSync(answer, 'utf8');
+    if (!raw.trim()) {
+        console.error(`verify-answer-lint: FAIL — answer file is empty: ${answer}`);
+        process.exit(1);
+    }
+
+    const tables = parseAnswer(raw);
+    if (tables.verdict === null) {
+        add('no `Verdict:` line (expected exactly one `Verdict: PASS|PARTIAL|FAIL` line)');
+    } else if (!/^(PASS|PARTIAL|FAIL)$/i.test(tables.verdict.value)) {
+        add(`line ${tables.verdict.line}: invalid Verdict value "${tables.verdict.value}" (PASS | PARTIAL | FAIL)`);
+    }
+
+    let taskContent = '';
+    let featureId = '';
+    try {
+        const task = JSON.parse(runSpur(spurBin, ['task', 'show', wbs, '--json'])) as {
+            content?: string;
+            body?: string;
+            feature_id?: string;
+            frontmatter?: { feature_id?: string };
+        };
+        taskContent = task.content ?? task.body ?? '';
+        featureId = task.feature_id ?? task.frontmatter?.feature_id ?? '';
+    } catch {
+        console.error(`verify-answer-lint: FAIL — could not fetch task ${wbs} via ${spurBin}`);
+        process.exit(1);
+    }
+    if (!taskContent) {
+        console.error(`verify-answer-lint: FAIL — task ${wbs} returned no content via ${spurBin}`);
+        process.exit(1);
+    }
+
+    let featureContent: string | null = null;
+    if (featureId) {
+        try {
+            const feature = JSON.parse(runSpur(spurBin, ['feature', 'show', featureId, '--json'])) as {
+                content?: string;
+            };
+            featureContent = feature.content ?? '';
+        } catch {
+            featureContent = null; // checklist labels still apply; scenario titles unavailable
+        }
+    }
+
+    const reqIds = extractRequirementIds(taskContent);
+    const acIdentities = extractAcIdentities(taskContent, featureContent);
+
+    // Requirement rows: completeness, no unknowns, no duplicates, valid status, non-empty evidence.
+    const seenReq = new Set<string>();
+    for (const row of tables.reqs) {
+        if (!reqIds.includes(row.id))
+            add(`line ${row.line}: unknown requirement ID "${row.id}" (task declares: ${reqIds.join(', ') || 'none'})`);
+        else if (seenReq.has(row.id)) add(`line ${row.line}: duplicate requirement row "${row.id}"`);
+        seenReq.add(row.id);
+        if (normalizeReqStatus(row.status) === null)
+            add(`line ${row.line}: "${row.id}" invalid status "${row.status}" (MET | PARTIAL | UNMET)`);
+        if (!row.evidence.trim()) add(`line ${row.line}: "${row.id}" has empty evidence`);
+    }
+    for (const id of reqIds) {
+        if (!seenReq.has(id)) add(`missing requirement row for "${id}"`);
+    }
+
+    // AC rows: identity must exactly match a checklist label/token or a scenario title;
+    // status and evidence type must normalize; evidence non-empty. AC completeness is the
+    // verifier's authoring contract, not a lint rejection class (0726 R3).
+    const seenAc = new Set<string>();
+    for (const row of tables.acs) {
+        if (!acIdentities.includes(row.id)) {
+            add(
+                `line ${row.line}: AC ID "${row.id.slice(0, 60)}" matches no task AC checklist label or scenario title`,
+            );
+        } else if (seenAc.has(row.id)) {
+            add(`line ${row.line}: duplicate AC row "${row.id.slice(0, 60)}"`);
+        }
+        seenAc.add(row.id);
+        if (normalizeAcStatus(row.status) === null)
+            add(`line ${row.line}: invalid AC status "${row.status}" (MET | PARTIAL | UNMET | N/A)`);
+        if (normalizeEvidenceType(row.evidenceType) === null)
+            add(
+                `line ${row.line}: invalid evidence type "${row.evidenceType}" (test | command | static-ref | manual-review | llm-judge | n/a, or a + compound)`,
+            );
+        if (!row.evidence.trim()) add(`line ${row.line}: AC "${row.id.slice(0, 40)}" has empty evidence`);
+    }
+
+    if (findings.length > 0) {
+        console.error(
+            `verify-answer-lint: FAIL — ${findings.length}${findings.length >= 10 ? '+' : ''} finding(s) in ${answer}`,
+        );
+        for (const f of findings) console.error(`  ${f}`);
+        process.exit(1);
+    }
+
+    const reqCount = tables.reqs.length;
+    const acCount = tables.acs.length;
+    console.error(
+        `verify-answer-lint: PASS — ${reqCount} requirement row(s), ${acCount} AC row(s), verdict ${tables.verdict?.value ?? '?'}`,
+    );
+    process.exit(0);
+}
+
+main();