@gobing-ai/spur 0.3.69 → 0.3.70

package/plugins/sp/skills/code-verification/SKILL.md

@@ -247,9 +247,10 @@ completion gate (`PARTIAL`/`FAIL` route the pipeline to `failed`).
 ### Step 10 — Emit the verdict artifact (the only verify output)
 
 Assemble the evidence and **emit the canonical verdict artifact** — verification writes no task
-section (F92 0593 R1). Under the pipeline, the output is captured as
-`.spur/run/<wbs>-verify-answer.txt`; a deterministic shell step derives
-`.spur/run/<wbs>-verdict.json`, and the `record` step transcribes `## Testing` from it.
+section (F92 0593 R1). Under the pipeline **you** write
+`.spur/run/<wbs>-verify-answer.txt` (0726 R3: host `expectFile`, never captured/overwritten); a
+deterministic shell step lints it and derives `.spur/run/<wbs>-verdict.json`, and `record`
+transcribes `## Testing` from it.
 
 **Standalone** (`/sp:dev-verify` outside the pipeline), write the artifact yourself, then invoke
 the deterministic Testing writer `spur task record` (section authorship never happens here):
@@ -306,14 +307,14 @@ The per-requirement traceability table MUST use `| Req | Status | Evidence |` (e
 The parser is tolerant of these variants (defense-in-depth), but the authoring contract is
 canonical.
 
-**Under the pipeline** (`task-pipeline.yaml`), `agent.run answerFile` captures this whole output to
-`.spur/run/<wbs>-verify-answer.txt`. A deterministic shell step then derives
-`.spur/run/<wbs>-verdict.json` from it plus an independent `spur task check` (R9; the agent
-reporting PASS in prose is necessary but not sufficient — the artifact is never left to the agent's
-discretion). Section transcription follows the Step 10 contract (record → `## Testing`; bare-only
-Review fallback; verify never writes sections).
+Under the pipeline, the verifier owns the answer file `.spur/run/<wbs>-verify-answer.txt` (0726
+R3): `Verdict: PARTIAL` first, append one row at a time, replace the verdict line only when all
+rows are certified — interruptions leave lintable partial rows; retries fill only missing IDs.
+Host: `expectFile` → `verify-answer-lint.ts` → verdict + `spur task check` (R9). Vocabularies,
+rejection classes, and the AC identity rule: `references/verdict-schema.md`. Sections follow the
+Step 10 contract.
 
-**Standalone** (`/sp:dev-verify` outside the pipeline — no answer-file capture exists), write the
+**Standalone** (outside the pipeline — no host lint/derive step), write the answer file and
 artifact yourself; shape and field-by-field contract in
 [references/verdict-schema.md](references/verdict-schema.md):
 

package/plugins/sp/skills/code-verification/references/verdict-schema.md

@@ -106,6 +106,16 @@ For answer files, emit a matching parseable table:
 | Scenario: CLI emits JSON | MET | test | `apps/cli/tests/foo.test.ts:42` |
 ```
 
+**Authoring contract under the pipeline (0726 R3).** The verifier owns the answer file: write
+`Verdict: PARTIAL` first, append one complete row at a time, and replace the first verdict line only
+after every row is certified. `verify-answer-lint.ts` gates the file before `spur task verdict
+--from-answer` and rejects, with row-level diagnostics: missing/duplicate/unknown requirement IDs,
+AC ids that do not exactly match a task AC checklist label (or its leading token, e.g. `AC1`) or a
+linked feature scenario title, invalid status (`MET | PARTIAL | UNMET` for requirements;
+`N/A` additionally allowed for AC), invalid evidence type (`test | command | static-ref |
+manual-review | llm-judge | n/a`, or a `+` compound), and empty evidence. Interrupted runs keep the
+rows that pass the lint and complete only the missing IDs on retry.
+
 ## Checks evidence
 
 Wave C verification can emit the following additive `checks[]` rows:

package/plugins/sp/skills/spur-cli/references/history.md

@@ -22,6 +22,7 @@ live in `packages/app/src/services/history-service.ts` (`FanOutResult`, `DailyRe
 | `analyze` | Aggregate imported rows and write a versioned forensic artifact | `--since <iso>` `--until <iso>` `--source <source>` `--session <id>` `--run <runId>` `--task <wbs>` `--top <n>` `--out <path>` `--json` |
 | `report [path]` | Purely render an existing artifact; default to `latest.json` | `--mode <name>` `--task <wbs>` `--top <n>` `--json` |
 | `daily` | Run import-all → analyze → artifact → 90-day report pruning once | `--since <iso>` `--until <iso>` `--root <path>` `--source-timeout <ms>` `--mode <name>` `--json` |
+| `reset` | Destructively wipe every `history_*` table for a clean re-import; refuses without `--yes` | `--yes` `--json` |
 
 Every JSON-capable verb also advertises `--json-envelope`; use the facade's machine-output contract.
 

package/plugins/sp/skills/spur-dev/references/gate-checklists.md

@@ -72,6 +72,16 @@ Entered before `task-pipeline.yaml` `precheck` state runs `spur task check <wbs>
 - [ ] The `## Plan` section is an ordered checklist (not prose).
 - [ ] The `## Design` section, if present, does not contradict the parent feature's design.
 - [ ] No `TODO`, `TBD`, or `???` placeholders in Requirements, AC, Design, or Plan.
+- [ ] The evidence-channel precheck (0726 R2) status file is consulted by the
+      pipeline guard: `plugins/sp/scripts/task-evidence-precheck.ts` parses the task
+      content for an exact `evidence-channel: history_tool_call.args_raw[pi]`
+      declaration and, when present, counts live pi rows with `args_raw` on
+      `.spur/spur.db` via bun:sqlite. Tasks without a declaration pass without opening
+      SQLite; unknown declarations, a missing database/table, and a zero count write
+      FAIL. Both precheck guard conjuncts (`precheck-size.status` and
+      `precheck-evidence.status`) must read PASS — tasks declaring a live-data
+      evidence channel must import real history (safe importer, non-dry-run) before
+      implementation begins.
 
 ## review gate
 
@@ -90,6 +100,12 @@ Entered before `task-pipeline.yaml` `review` state dispatches `sp:code-verificat
 
 Entered before `task-pipeline.yaml` `verify` state produces a task verdict.
 
+- [ ] The verify answer file (`.spur/run/<wbs>-verify-answer.txt`) is lint-clean before
+      verdict derivation: `plugins/sp/scripts/verify-answer-lint.ts <wbs>` (0726 R3)
+      rejects missing/duplicate/unknown R IDs, AC identities that are not an exact task
+      checklist label or linked-feature scenario title, invalid status/evidence-type
+      values, and empty evidence on any row. A lint failure fails the verify
+      step (fail-closed) before `spur task verdict` runs.
 - [ ] `spur task check <wbs> --strict-core --json` returns PASS.
 - [ ] Every AC scenario has a corresponding verify command that exited 0.
 - [ ] The `## Solution` section is filled (not the placeholder comment).