@gobing-ai/spur 0.3.69 → 0.3.71

package/config/workflows/idea-pipeline.yaml

@@ -99,13 +99,14 @@ states:
       boolean signal written to .spur/run/${vars.__runId}-idea-needs-design.json — this determines
       whether the system-design state runs. As its terminal artifact for the idea path,
       brainstorm also emits the idea-evaluation report to .spur/run/${vars.__runId}-idea-eval-report.md
-      (template: plugins/sp/skills/spur-dev/references/idea-evaluation.md).
+      (template: the `sp:spur-dev` skill's `idea-evaluation` reference — named by skill, not by
+      repo path, because `spur init` never scaffolds `plugins/sp/` into a seeded project).
       expectFile fails a silent no-op discovery (no eval report).
     onEnter:
       - kind: agent.run
         options:
           agent: ${vars.planningAgent}
-          input: "Run sp:brainstorm for the idea: ${vars.idea}. The skill owns the approach-generation, design summary, and `needs_design` signal criteria; emit .spur/run/${vars.__runId}-idea-needs-design.json ({\"needs_design\": true|false}) and the design summary per the skill's `Design Approval Gate` and `The needs_design signal` sections. Also emit the idea-evaluation report to .spur/run/${vars.__runId}-idea-eval-report.md per plugins/sp/skills/spur-dev/references/idea-evaluation.md (urgency/necessity 0–5, premises, pros/cons, alternatives, enhanced idea, recommendation). At the END of the report, append a provenance footer block of the exact form: `---\\nrun_id: ${vars.__runId}\\ngenerated_at: <RFC3339 timestamp>\\n---` (omit the footer only if run_id is empty)."
+          input: "Run sp:brainstorm for the idea: ${vars.idea}. The skill owns the approach-generation, design summary, and `needs_design` signal criteria; emit .spur/run/${vars.__runId}-idea-needs-design.json ({\"needs_design\": true|false}) and the design summary per the skill's `Design Approval Gate` and `The needs_design signal` sections. Also emit the idea-evaluation report to .spur/run/${vars.__runId}-idea-eval-report.md per the `sp:spur-dev` skill's `idea-evaluation` reference (urgency/necessity 0–5, premises, pros/cons, alternatives, enhanced idea, recommendation). At the END of the report, append a provenance footer block of the exact form: `---\\nrun_id: ${vars.__runId}\\ngenerated_at: <RFC3339 timestamp>\\n---` (omit the footer only if run_id is empty)."
           # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
           role: planner
           expectFile: .spur/run/${vars.__runId}-idea-eval-report.md
@@ -298,7 +299,7 @@ states:
       - kind: agent.run
         options:
           agent: ${vars.planningAgent}
-          input: "Run sp:spec-decomposition for feature ${vars.featureId}. Read the brainstorm artifact, feature AC, and design doc. SIZING FIRST, before any JSON: apply the skill's `Default to NOT decomposing` rubric to the whole unit of work — if it scores 0-2 the correct output is a ONE-entry batch, not many. Scenario count is not task count: merge scenarios that one task delivers (same file surface, same subsystem, or unreadable apart in review), and list every scenario a task covers in its background. Merging never costs AC coverage — one task may carry several scenarios. Do not emit one entry per scenario or per requirement by reflex. Then produce a task-batch JSON array at .spur/run/${vars.__runId}-idea-task-batch.json, validated against apps/cli/schemas/task-batch.schema.json. Schema-permitted fields per entry: `name`, `background`, `requirements`, `feature_id`, `parent_wbs`, `priority`, `tags`, `template` — schema validation rejects anything else. Acceptance Criteria, Design, and Plan sections are filled in by the per-task refine step after batch-create, NOT at decompose time. Validate locally against the schema before emitting. Also emit the private task-order sidecar at .spur/run/${vars.__runId}-idea-task-order.json: a JSON array (one entry per batch item) of `{ name: <exact batch item name>, depends_on_names: [<batch item names>] }` declaring ordering/dependencies between the batch items; use `[]` when no ordering exists. Every `name` and every dependency must match exactly one batch item `name` — it is private workflow data, not part of task-batch.schema.json."
+          input: "Run sp:spec-decomposition for feature ${vars.featureId}. Read the brainstorm artifact, feature AC, and design doc. SIZING FIRST, before any JSON: apply the skill's `Default to NOT decomposing` rubric to the whole unit of work — if it scores 0-2 the correct output is a ONE-entry batch, not many. Scenario count is not task count: merge scenarios that one task delivers (same file surface, same subsystem, or unreadable apart in review), and list every scenario a task covers in its background. Merging never costs AC coverage — one task may carry several scenarios. Do not emit one entry per scenario or per requirement by reflex. Then produce a task-batch JSON array at .spur/run/${vars.__runId}-idea-task-batch.json, validated against task-batch.schema.json. Schema-permitted fields per entry: `name`, `background`, `requirements`, `feature_id`, `parent_wbs`, `priority`, `tags`, `template` — schema validation rejects anything else. Acceptance Criteria, Design, and Plan sections are filled in by the per-task refine step after batch-create, NOT at decompose time. Validate locally against the schema before emitting. Also emit the private task-order sidecar at .spur/run/${vars.__runId}-idea-task-order.json: a JSON array (one entry per batch item) of `{ name: <exact batch item name>, depends_on_names: [<batch item names>] }` declaring ordering/dependencies between the batch items; use `[]` when no ordering exists. Every `name` and every dependency must match exactly one batch item `name` — it is private workflow data, not part of task-batch.schema.json."
           # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
           role: planner
           expectFile: .spur/run/${vars.__runId}-idea-task-batch.json

package/config/workflows/task-pipeline.yaml

@@ -19,7 +19,7 @@
 #   agent / spurBin           — executor + spur binary (CLI overrides spurBin)
 #   stepTimeoutMs             — agent.run budget for review/verify/test-fix (ms)
 #   implementTimeoutMs        — implement agent.run budget (ms)
-#   qualityGateCmd            — project gate (default: bun run autofix && bun run spur-check)
+#   qualityGateCmd            — project gate (default: bun run spur-check)
 #   qualityGateMaxFixAttempts — max /sp:dev-fixall hops after a red gate (default: 2)
 #
 # Seeded by `spur init`. agent.run inputs are pure slash commands (ADR-043).
@@ -104,7 +104,12 @@ vars:
   # and the fixall slash input all use this same var so the command stays single-sourced.
   # TRUSTED CONFIG ONLY — this string is executed via `sh -c` (see test/test-recheck). Never
   # interpolate untrusted operator/LLM input into qualityGateCmd (task 0436 SECUA residual).
-  qualityGateCmd: "bun run format && bun run spur-check"
+  # NO `format` PREFIX: `implement` already ran `$formatCmd` on its way out, and `test`
+  # captures `proofDigest` (onEnter[3]) BEFORE this command runs (onEnter[4]) — a formatter
+  # inside the gate rewrites the very tree the digest just fingerprinted (ADR-071 proof
+  # window). It was a no-op only because the implement-stage format got there first; that is
+  # an accident, not an invariant. The gate observes, it does not mutate.
+  qualityGateCmd: "bun run spur-check"
   # Cheap red-detector run before the full gate on **recheck only**; empty ⇒ no probe
   # (full gate every recheck — the pre-0587 behavior). A project overriding qualityGateCmd
   # should override this too. TRUSTED CONFIG ONLY — executed via `sh -c` (same surface as
@@ -208,16 +213,41 @@ states:
           command: >-
             SIZE_FILE=".spur/run/$wbs-precheck-size.status" &&
             mkdir -p .spur/run &&
-            if [ -f plugins/sp/scripts/task-size-precheck.ts ]; then
-            bun plugins/sp/scripts/task-size-precheck.ts "$wbs"
+            SIZE_SCRIPT="plugins/sp/scripts/task-size-precheck.ts";
+            [ -f "$SIZE_SCRIPT" ] ||
+            SIZE_SCRIPT="$(superskill script path sp task-size-precheck.ts 2>/dev/null)";
+            if [ -n "$SIZE_SCRIPT" ] && [ -f "$SIZE_SCRIPT" ]; then
+            bun "$SIZE_SCRIPT" "$wbs"
             --spur-bin "$spurBin" --max-reqs "$maxImplementReqs"
             --max-plan-items "$maxImplementPlanItems";
             else
-              echo "task-size-precheck failed closed — checker script" >&2 &&
-              echo "plugins/sp/scripts/task-size-precheck.ts absent." >&2 &&
+              echo "task-size-precheck failed closed — checker not found in" >&2 &&
+              echo "plugins/sp/scripts/ nor staged; run 'superskill install sp'." >&2 &&
               echo "FAIL" > "$SIZE_FILE";
             fi &&
             exit 0
+      # 0726 R2: task evidence precheck — deterministic live-data
+      # evidence-channel proof before implement dispatch. Writes PASS/FAIL to
+      # .spur/run/<wbs>-precheck-evidence.status. Always exit 0 (soft action);
+      # the precheck→implement guard reads the file, so a missing checker
+      # fails closed (writes FAIL, never PASS).
+      - kind: shell
+        options:
+          command: >-
+            EVID_FILE=".spur/run/$wbs-precheck-evidence.status" &&
+            mkdir -p .spur/run &&
+            EVID_SCRIPT="plugins/sp/scripts/task-evidence-precheck.ts";
+            [ -f "$EVID_SCRIPT" ] ||
+            EVID_SCRIPT="$(superskill script path sp task-evidence-precheck.ts 2>/dev/null)";
+            if [ -n "$EVID_SCRIPT" ] && [ -f "$EVID_SCRIPT" ]; then
+            bun "$EVID_SCRIPT" "$wbs"
+            --spur-bin "$spurBin";
+            else
+              echo "task-evidence-precheck failed closed — checker not found" >&2 &&
+              echo "in plugins/sp/scripts/ nor staged; run 'superskill install sp'." >&2 &&
+              echo "FAIL" > "$EVID_FILE";
+            fi &&
+            exit 0
 
   - id: implement
     description: >
@@ -536,7 +566,24 @@ states:
           priority: ${vars.taskPriority}
           compareExecutorWith: implement
           timeoutMs: ${vars.stepTimeoutMs}
-          answerFile: .spur/run/${vars.wbs}-verify-answer.txt
+          expectFile: .spur/run/${vars.wbs}-verify-answer.txt
+      # 0726 R3: hard lint gate over the verifier-owned answer — shape and
+      # evidence-row identity, before the verdict derivation reads it.
+      # Hard action: a malformed answer halts the sequence here instead of
+      # poisoning the verdict parse downstream.
+      - kind: shell
+        options:
+          command: >-
+            LINT_SCRIPT="plugins/sp/scripts/verify-answer-lint.ts";
+            [ -f "$LINT_SCRIPT" ] ||
+            LINT_SCRIPT="$(superskill script path sp verify-answer-lint.ts 2>/dev/null)";
+            if [ -z "$LINT_SCRIPT" ] || [ ! -f "$LINT_SCRIPT" ]; then
+              echo "verify-answer-lint: checker not found in plugins/sp/scripts/ nor staged — run 'superskill install sp'" >&2;
+              exit 1;
+            fi;
+            bun "$LINT_SCRIPT" "$wbs"
+            --answer ".spur/run/$wbs-verify-answer.txt"
+            --spur-bin "$spurBin"
       - kind: shell
         options:
           command: "$spurBin task verdict $wbs --from-answer .spur/run/$wbs-verify-answer.txt"
@@ -614,6 +661,8 @@ states:
             if [ -n "$FID" ]; then
               if [ -f plugins/sp/scripts/feature-sync-bounded.ts ]; then
                 bun plugins/sp/scripts/feature-sync-bounded.ts "$FID" --spur-bin "$spurBin" --json;
+              elif SYNC_MJS="$(superskill script path sp feature-sync-bounded.mjs 2>/dev/null)" && [ -f "$SYNC_MJS" ]; then
+                node "$SYNC_MJS" "$FID" --spur-bin "$spurBin" --json;
               else
                 $spurBin feature sync "$FID" --json;
               fi;
@@ -679,11 +728,11 @@ transitions:
   # ── precheck: size PASS + task check → implement; else → failed ──
   - from: precheck
     to: implement
-    description: Deterministic size and task checks are green — begin implementation.
+    description: Deterministic size, evidence, and task checks are green — begin implementation.
     guard:
       kind: shell
       options:
-        command: 'test "$(cat .spur/run/$wbs-precheck-size.status 2>/dev/null)" = PASS && $spurBin task check $wbs'
+        command: 'test "$(cat .spur/run/$wbs-precheck-size.status 2>/dev/null)" = PASS && test "$(cat .spur/run/$wbs-precheck-evidence.status 2>/dev/null)" = PASS && $spurBin task check $wbs'
   - from: precheck
     to: failed
     description: Size and/or task check failed — stop before implement.

package/config/workflows/wrapup-pipeline.yaml

@@ -54,12 +54,16 @@ vars:
   # Corpus-aware quality gate for the feature-transition hop (R1, task 0625).
   # The per-task gate (`spur-check`) deliberately excludes corpus-check — the only
   # sweep that observes feature-level findings — so a transition that arms one
-  # would go green. A feature transition happens once per feature, so the ~41 s
-  # corpus sweep is paid once here. Soft by design: the gate reports PASS/FAIL
-  # and lets the operator decide; it never hard-fails the wrap-up shell.
+  # would go green. This gate is therefore the CORPUS SWEEP ALONE (~29 s), not
+  # `spur-check-new`: every task in the feature already paid a full `spur-check`
+  # in its own pipeline, and the states that run before this hop (`doc-sync`,
+  # `metrics-record`) write only markdown and task sections, which Biome skips
+  # (`ignoreUnknown: true`). Re-running the ~105 s per-task gate here re-verifies
+  # unchanged code and measures nothing new. Soft by design: the gate reports
+  # PASS/FAIL and lets the operator decide; it never hard-fails the wrap-up shell.
   # TRUSTED CONFIG ONLY — this string is executed via `sh -c` (same surface as
   # task-pipeline's qualityGateCmd). Never interpolate untrusted input into it.
-  featureGateCmd: "bun run spur-check-new"
+  featureGateCmd: "bun run corpus-check"
   __hitlAnswer: ""
 
 states:
@@ -178,6 +182,8 @@ states:
             fi;
             SYNC_OUTPUT=$(if [ -f plugins/sp/scripts/feature-sync-bounded.ts ]; then
               bun plugins/sp/scripts/feature-sync-bounded.ts "$feature" --spur-bin "$spurBin" --json;
+            elif SYNC_MJS="$(superskill script path sp feature-sync-bounded.mjs 2>/dev/null)" && [ -f "$SYNC_MJS" ]; then
+              node "$SYNC_MJS" "$feature" --spur-bin "$spurBin" --json;
             else
               $spurBin feature sync "$feature" --json;
             fi);

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.3.69",
+    "version": "0.3.71",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",
@@ -53,14 +53,14 @@
     },
     "devDependencies": {
         "@commander-js/extra-typings": "^14.0.0",
-        "@gobing-ai/ts-db": "^0.4.48",
-        "@gobing-ai/ts-ai-runner": "^0.4.48",
-        "@gobing-ai/ts-dual-workflow-engine": "^0.4.48",
-        "@gobing-ai/ts-infra": "^0.4.48",
-        "@gobing-ai/ts-llm-jsonl-importer": "^0.4.48",
-        "@gobing-ai/ts-rule-engine": "^0.4.48",
-        "@gobing-ai/ts-runtime": "^0.4.48",
-        "@gobing-ai/ts-utils": "^0.4.48",
+        "@gobing-ai/ts-db": "^0.4.50",
+        "@gobing-ai/ts-ai-runner": "^0.4.50",
+        "@gobing-ai/ts-dual-workflow-engine": "^0.4.50",
+        "@gobing-ai/ts-infra": "^0.4.50",
+        "@gobing-ai/ts-llm-jsonl-importer": "^0.4.50",
+        "@gobing-ai/ts-rule-engine": "^0.4.50",
+        "@gobing-ai/ts-runtime": "^0.4.50",
+        "@gobing-ai/ts-utils": "^0.4.50",
         "@types/bun": "1.3.14",
         "@types/figlet": "^1.7.0",
         "@types/node-notifier": "8.0.5",

package/plugins/sp/commands/dev-fixall.md

@@ -28,7 +28,8 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 ## Implementation
 
 Under the pipeline, the `test-recheck` state runs the full gate immediately after this hop — that is
-the deciding run. Fixall bounds itself to **one confirming gate run** (R4, task 0483); use targeted
-probes (`bun test <file> --test-name-pattern <test>`) during fix loops, never re-run the full gate
-per fix. `qualityGateCmd` itself is unchanged so `test-recheck` still runs the full gate.
+the deciding run. When `--gate-log` is set (the pipeline signal), fixall runs **no full gate at
+all**: targeted probes (`bun test <file> --test-name-pattern <test>`) during fix loops, then one
+`bun run lint` before returning. Invoked standalone, it keeps the single confirming run (R4, task
+0483). `qualityGateCmd` itself is unchanged so `test-recheck` still runs the full gate.
 

package/plugins/sp/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "sp",
-    "version": "0.3.69",
+    "version": "0.3.71",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics.",
     "extensions": {
         "pi": ["./hooks/pi/guard-extension.ts"]

package/plugins/sp/scripts/task-evidence-precheck.ts

@@ -0,0 +1,181 @@
+#!/usr/bin/env bun
+/**
+ * task-evidence-precheck — deterministic evidence-channel precheck (R2, task 0726).
+ *
+ * Parses the task content for an exact `evidence-channel:` declaration and proves the
+ * declared live-data channel exists in the local spur database before implementation
+ * begins. Currently exactly one channel is allowlisted:
+ *
+ *   evidence-channel: history_tool_call.args_raw[pi]
+ *
+ * …satisfied only when the fixed query
+ *
+ *   SELECT COUNT(*) FROM history_tool_call WHERE args_raw IS NOT NULL AND source = 'pi'
+ *
+ * returns a positive count on `<cwd>/.spur/spur.db` — i.e. a live non-dry-run pi import
+ * has already preserved tool-call `args_raw` (0722 R1). Unknown declarations, a missing
+ * database, a missing table, and a zero count all fail closed.
+ *
+ * A task without any `evidence-channel:` declaration passes without opening SQLite —
+ * the check only gates tasks that declare a live-data evidence channel.
+ *
+ * Always exits 0 (soft action). Both precheck→implement guards in task-pipeline.yaml
+ * read the status file; a missing or failing checker writes FAIL, so readiness fails
+ * closed.
+ *
+ * Ships with the plugin to arbitrary projects; node-builtin + bun:sqlite only —
+ * no workspace imports.
+ *
+ * Usage:
+ *   bun plugins/sp/scripts/task-evidence-precheck.ts <wbs> [--spur-bin <path>]
+ *
+ * Env: SPUR_BIN
+ */
+
+import { Database } from 'bun:sqlite';
+import { execFileSync } from 'node:child_process';
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+/** Exact task-content declaration that activates the live-evidence gate (0726 R2). */
+const DECLARATION_PREFIX = 'evidence-channel:';
+
+/** The only allowlisted live-data channel (0726 R2). */
+const EVIDENCE_CHANNEL = 'history_tool_call.args_raw[pi]';
+
+/** Declaration text as it must appear in the task body. */
+const DECLARATION = `${DECLARATION_PREFIX} ${EVIDENCE_CHANNEL}`;
+
+/** The only live-data query this precheck is allowed to run — fixed, never task-authored. */
+const EVIDENCE_QUERY = "SELECT COUNT(*) AS n FROM history_tool_call WHERE args_raw IS NOT NULL AND source = 'pi'";
+
+// ─── CLI (same spur-bin chain as task-size-precheck.ts) ─────────────────────
+
+function usage(): never {
+    console.error('Usage: bun plugins/sp/scripts/task-evidence-precheck.ts <wbs> [--spur-bin <path>]');
+    process.exit(1);
+}
+
+function defaultSpurBin(): string {
+    if (process.env.SPUR_BIN) return process.env.SPUR_BIN;
+    const local = fileURLToPath(new URL('../../../apps/cli/src/index.ts', import.meta.url));
+    if (existsSync(local)) return `bun ${local}`;
+    return 'spur';
+}
+
+function parseArgs(argv: string[]): { wbs: string; spurBin: string } {
+    let spurBin = defaultSpurBin();
+    let wbs = '';
+    let i = 0;
+    while (i < argv.length) {
+        const arg = argv[i];
+        if (arg === '--spur-bin') {
+            spurBin = argv[i + 1] ?? defaultSpurBin();
+            i += 2;
+        } else if (!arg.startsWith('--')) {
+            wbs = arg;
+            i++;
+        } else {
+            i++;
+        }
+    }
+    if (!wbs) usage();
+    return { wbs, spurBin };
+}
+
+/**
+ * Split a multi-token `spurBin` (`<runtime> <mainModule>`) the same way
+ * `runSpurJson` does in feature-sync-bounded.ts — execFileSync's first arg is
+ * one executable path, not a shell command line.
+ */
+function runSpur(spurBin: string, args: string[]): string {
+    const [file = 'spur', ...lead] = spurBin.split(/\s+/).filter(Boolean);
+    return execFileSync(file, [...lead, ...args], {
+        encoding: 'utf-8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+    });
+}
+
+function writeStatus(wbs: string, status: 'PASS' | 'FAIL'): void {
+    const statusDir = join(process.cwd(), '.spur', 'run');
+    if (!existsSync(statusDir)) mkdirSync(statusDir, { recursive: true });
+    writeFileSync(join(statusDir, `${wbs}-precheck-evidence.status`), `${status}\n`);
+}
+
+function fail(wbs: string, reasons: string[]): void {
+    writeStatus(wbs, 'FAIL');
+    console.error(`task-evidence-precheck: FAIL`);
+    for (const r of reasons) {
+        console.error(`  ${r}`);
+    }
+    process.exit(0);
+}
+
+function main(): void {
+    const { wbs, spurBin } = parseArgs(process.argv.slice(2));
+
+    let taskContent: string;
+    try {
+        const result = runSpur(spurBin, ['task', 'show', wbs, '--json']);
+        const task = JSON.parse(result);
+        taskContent = task.content ?? task.body ?? '';
+    } catch {
+        fail(wbs, [`could not fetch task ${wbs} via ${spurBin} — evidence channel unverifiable`]);
+    }
+
+    // Collect every declaration token. A repeated exact declaration still gates the
+    // single fixed query; any non-allowlisted token is an unknown declaration.
+    const declarations: string[] = [];
+    for (const match of taskContent.matchAll(/evidence-channel:\s*(\S+)/g)) {
+        declarations.push(match[1] ?? '');
+    }
+    const unknown = declarations.filter((d) => d !== EVIDENCE_CHANNEL);
+    if (unknown.length > 0) {
+        fail(wbs, [
+            `unknown evidence-channel declaration(s): ${unknown.join(', ')}`,
+            `allowlisted declaration: ${DECLARATION}`,
+        ]);
+    }
+    if (declarations.length === 0) {
+        writeStatus(wbs, 'PASS');
+        console.error(`task-evidence-precheck: PASS — no evidence-channel declaration; live-data gate not active`);
+        process.exit(0);
+    }
+
+    const dbPath = join(process.cwd(), '.spur', 'spur.db');
+    if (!existsSync(dbPath)) {
+        fail(wbs, [`spur database not found at ${dbPath} — run a real history import first`]);
+    }
+
+    let count: number;
+    try {
+        const db = new Database(dbPath, { readonly: true });
+        try {
+            const row = db.query(EVIDENCE_QUERY).get() as { n: number } | undefined;
+            count = row?.n ?? 0;
+        } finally {
+            db.close();
+        }
+    } catch (e) {
+        fail(wbs, [
+            `evidence query failed on ${dbPath}: ${e instanceof Error ? e.message : String(e)}`,
+            'history_tool_call table missing or unreadable — run a real history import first',
+        ]);
+    }
+
+    if (!(count > 0)) {
+        fail(wbs, [
+            `0 live pi rows with args_raw (query: ${EVIDENCE_QUERY})`,
+            'run a non-dry-run pi history import with a safe importer before implementing',
+        ]);
+    }
+
+    writeStatus(wbs, 'PASS');
+    console.error(
+        `task-evidence-precheck: PASS — ${count} live pi history_tool_call row(s) with args_raw (declaration: ${DECLARATION})`,
+    );
+    process.exit(0);
+}
+
+main();