@gobing-ai/spur 0.3.69 → 0.3.71

package/plugins/sp/scripts/verify-answer-lint.ts

@@ -0,0 +1,395 @@
+#!/usr/bin/env bun
+/**
+ * verify-answer-lint — deterministic pre-verdict answer lint (0726 R3).
+ *
+ * Runs AFTER the verify agent exits and BEFORE `spur task verdict --from-answer`.
+ * The verifier owns the answer file (`.spur/run/<wbs>-verify-answer.txt`): it creates
+ * it with `Verdict: PARTIAL`, appends one complete requirement/AC row at a time, and
+ * only replaces the first verdict line once every row is certified. Because the file
+ * is now append-progress instead of a single captured blob, malformed rows can reach
+ * the verdict step — this lint rejects each invalid class with a row-level message:
+ *
+ *   - missing, duplicate, or unknown requirement IDs (vs the task's Requirements)
+ *   - AC IDs that do not exactly match the task's AC checklist label or a linked
+ *     feature scenario title
+ *   - status / evidence-type values the verdict parser would drop
+ *   - empty evidence
+ *
+ * Compound evidence types (`test + command`) stay valid — normalization mirrors
+ * `packages/app/src/services/task-verdict.ts` exactly, so anything this lint accepts
+ * is also accepted by `spur task verdict --from-answer` (and vice versa).
+ *
+ * Exits non-zero on any finding, with bounded diagnostics (first 10). Writes nothing.
+ *
+ * Ships with the plugin to arbitrary projects; node-builtin only — no workspace imports.
+ *
+ * Usage:
+ *   bun plugins/sp/scripts/verify-answer-lint.ts <wbs> --answer <path> [--spur-bin <path>]
+ *
+ * Env: SPUR_BIN
+ */
+
+import { execFileSync } from 'node:child_process';
+import { existsSync, readFileSync } from 'node:fs';
+import { fileURLToPath } from 'node:url';
+
+// ─── CLI (same spur-bin chain as task-evidence-precheck.ts) ─────────────────
+
+function usage(): never {
+    console.error('Usage: bun plugins/sp/scripts/verify-answer-lint.ts <wbs> --answer <path> [--spur-bin <path>]');
+    process.exit(1);
+}
+
+function defaultSpurBin(): string {
+    if (process.env.SPUR_BIN) return process.env.SPUR_BIN;
+    const local = fileURLToPath(new URL('../../../apps/cli/src/index.ts', import.meta.url));
+    if (existsSync(local)) return `bun ${local}`;
+    return 'spur';
+}
+
+function parseArgs(argv: string[]): { wbs: string; answer: string; spurBin: string } {
+    let spurBin = defaultSpurBin();
+    let wbs = '';
+    let answer = '';
+    let i = 0;
+    while (i < argv.length) {
+        const arg = argv[i];
+        if (arg === '--spur-bin') {
+            spurBin = argv[i + 1] ?? defaultSpurBin();
+            i += 2;
+        } else if (arg === '--answer') {
+            answer = argv[i + 1] ?? '';
+            i += 2;
+        } else if (!arg.startsWith('--')) {
+            wbs = arg;
+            i++;
+        } else {
+            i++;
+        }
+    }
+    if (!wbs || !answer) usage();
+    return { wbs, answer, spurBin };
+}
+
+function runSpur(spurBin: string, args: string[]): string {
+    const [file = 'spur', ...lead] = spurBin.split(/\s+/).filter(Boolean);
+    return execFileSync(file, [...lead, ...args], {
+        encoding: 'utf-8',
+        stdio: ['pipe', 'pipe', 'pipe'],
+    });
+}
+
+// ─── Answer parsing — mirrors packages/app/src/services/task-verdict.ts ─────
+
+interface ReqRow {
+    id: string;
+    status: string;
+    evidence: string;
+    line: number;
+}
+interface AcRow {
+    id: string;
+    status: string;
+    evidenceType: string;
+    evidence: string;
+    line: number;
+}
+
+function splitTableCells(line: string): string[] {
+    return line
+        .split(/(?<!\\)\|/)
+        .map((c) => c.replace(/\\\|/g, '|').trim())
+        .filter(Boolean);
+}
+
+function normalizeReqStatus(raw: string): string | null {
+    if (/\bMET\b/.test(raw)) return 'MET';
+    if (/\bPARTIAL\b/.test(raw)) return 'PARTIAL';
+    if (/\bUNMET\b/.test(raw)) return 'UNMET';
+    return null;
+}
+
+function normalizeAcStatus(raw: string): string | null {
+    if (/\bMET\b/.test(raw)) return 'MET';
+    if (/\bPARTIAL\b/.test(raw)) return 'PARTIAL';
+    if (/\bUNMET\b/.test(raw)) return 'UNMET';
+    if (/\bN\/A\b/.test(raw) || /\bNA\b/.test(raw)) return 'N/A';
+    return null;
+}
+
+function normalizeEvidenceTypeToken(normalized: string): string | null {
+    if (normalized === 'test') return 'test';
+    if (normalized === 'command') return 'command';
+    if (
+        normalized === 'static-ref' ||
+        normalized === 'static' ||
+        normalized === 'doc' ||
+        normalized === 'docs' ||
+        normalized === 'documentation'
+    ) {
+        return 'static-ref';
+    }
+    if (normalized === 'manual-review' || normalized === 'manual') return 'manual-review';
+    if (normalized === 'llm-judge' || normalized === 'judge') return 'llm-judge';
+    if (normalized === 'n/a' || normalized === 'na') return 'n/a';
+    return null;
+}
+
+const EVIDENCE_TYPE_PRECEDENCE = ['test', 'command', 'static-ref', 'manual-review', 'llm-judge', 'n/a'] as const;
+
+function normalizeEvidenceType(raw: string): string | null {
+    const normalized = raw.toLowerCase().trim();
+    const single = normalizeEvidenceTypeToken(normalized);
+    if (single !== null) return single;
+    const parts = normalized.split(/[+,/]/).filter((p) => p.trim());
+    const tokens = parts.map((part) => normalizeEvidenceTypeToken(part.trim())).filter((t) => t !== null);
+    if (tokens.length < 2 || tokens.length !== parts.length) return null;
+    return EVIDENCE_TYPE_PRECEDENCE.find((candidate) => tokens.includes(candidate)) ?? null;
+}
+
+interface AnswerTables {
+    verdict: { value: string; line: number } | null;
+    reqs: ReqRow[];
+    acs: AcRow[];
+}
+
+function parseAnswer(text: string): AnswerTables {
+    const out: AnswerTables = { verdict: null, reqs: [], acs: [] };
+    const lines = text.split('\n');
+    let reqTable = false;
+    let acTable = false;
+
+    for (let i = 0; i < lines.length; i++) {
+        const trimmed = lines[i]?.trim() ?? '';
+        const lineNo = i + 1;
+
+        // A markdown heading closes whichever table is open (mirrors the verdict parser).
+        if ((reqTable || acTable) && /^#{1,6}\s/.test(trimmed)) {
+            reqTable = false;
+            acTable = false;
+            continue;
+        }
+        if (!trimmed.startsWith('|')) continue;
+        const cells = splitTableCells(trimmed);
+        if (/^[-:]+$/.test(cells[0] ?? '')) continue;
+
+        const h0 = (cells[0] ?? '').toLowerCase();
+        const h1 = (cells[1] ?? '').toLowerCase();
+
+        // Requirement header: `| Req | Status | Evidence |` (id-like first cell + status column).
+        if (!reqTable && !acTable && cells.length >= 2) {
+            const idLike = h0.includes('req') || h0 === 'requirement' || h0 === 'r#' || h0 === 'r' || /^r\d+$/.test(h0);
+            if (idLike && (h1.includes('status') || h1 === 'verdict')) {
+                reqTable = true;
+                continue;
+            }
+            if (
+                (h0 === 'ac' || h0.includes('acceptance')) &&
+                h1.includes('status') &&
+                (cells[2] ?? '').toLowerCase().includes('evidence')
+            ) {
+                acTable = true;
+                continue;
+            }
+        }
+
+        if (reqTable && cells.length >= 2) {
+            // An AC header following the requirement table closes it (mirrors the parser).
+            if ((h0 === 'ac' || h0.includes('acceptance')) && h1.includes('status')) {
+                reqTable = false;
+                acTable = true;
+                continue;
+            }
+            out.reqs.push({
+                id: cells[0] ?? '',
+                status: (cells[1] ?? '').toUpperCase(),
+                evidence: cells[2] ?? '',
+                line: lineNo,
+            });
+            continue;
+        }
+        if (acTable && cells.length >= 3) {
+            out.acs.push({
+                id: cells[0] ?? '',
+                status: cells[1] ?? '',
+                evidenceType: cells[2] ?? '',
+                evidence: cells[3] ?? '',
+                line: lineNo,
+            });
+        }
+    }
+
+    const verdictMatches = [...text.matchAll(/^\s*Verdict:\s*(\S+)\s*$/gim)];
+    if (verdictMatches.length === 1) {
+        out.verdict = {
+            value: verdictMatches[0]?.[1] ?? '',
+            line: text.slice(0, verdictMatches[0]?.index ?? 0).split('\n').length,
+        };
+    }
+    return out;
+}
+
+// ─── Task-side identity extraction ───────────────────────────────────────────
+
+function sectionBetween(text: string, heading: string): string {
+    const marker = new RegExp(`^#{1,6}\\s+${heading}\\s*$`, 'im');
+    const match = marker.exec(text);
+    if (!match || match.index === undefined) return '';
+    const rest = text.slice(match.index);
+    const lineEnd = rest.indexOf('\n');
+    const afterHeading = lineEnd === -1 ? '' : rest.slice(lineEnd + 1);
+    const next = afterHeading.search(/^#{1,6}\s/m);
+    return next === -1 ? afterHeading : afterHeading.slice(0, next);
+}
+
+function extractRequirementIds(taskContent: string): string[] {
+    const section = sectionBetween(taskContent, 'Requirements');
+    const ids = new Set<string>();
+    // Corpus forms: bold-wrapped (`**R1. Title.**`, bare `**R1**`); right after a list
+    // marker with optional checkbox (`- [ ] R1.` — the dominant corpus form, `- R1. Title.`,
+    // `- R1:`) or a bare checkbox with the marker omitted (`[x] R1.`); line-start (`R1:`).
+    // The marker and the checkbox are never both optional — that would match bare prose
+    // (`R1 is …`) and fabricate declarations. Sub-IDs (`R1.1`) match in every form.
+    for (const m of section.matchAll(/\*\*(R\d+(?:\.\d+)*)\b/g)) ids.add(m[1] ?? '');
+    for (const m of section.matchAll(/^(?:[-*]\s+(?:\[[ xX]\]\s+)?|\[[ xX]\]\s+)(R\d+(?:\.\d+)*)/gm))
+        ids.add(m[1] ?? '');
+    for (const m of section.matchAll(/^(R\d+(?:\.\d+)*)\s*[.:]/gm)) ids.add(m[1] ?? '');
+    return [...ids];
+}
+
+function extractAcIdentities(taskContent: string, featureContent: string | null): string[] {
+    const identities = new Set<string>();
+    const section = sectionBetween(taskContent, 'Acceptance Criteria');
+    // Checkbox labels (`- [x] AC1 (R1): …`, 0726) and plain bullets (`- AC1: Given …`,
+    // 0713/0727) both yield the label text up to `:` plus its leading token.
+    for (const m of section.matchAll(/^[-*]\s+(?:\[[ xX]\]\s+)?(.+?)\s*(?::|$)/gm)) {
+        const label = (m[1] ?? '').trim();
+        if (!label) continue;
+        identities.add(label);
+        const leading = label.split(/\s+/)[0] ?? '';
+        if (leading && leading !== label) identities.add(leading);
+    }
+    if (featureContent !== null) {
+        for (const m of featureContent.matchAll(/^[ \t]*Scenario:\s*(.+)\s*$/gm)) {
+            const title = (m[1] ?? '').trim();
+            if (title) identities.add(title);
+        }
+    }
+    return [...identities];
+}
+
+// ─── Main ────────────────────────────────────────────────────────────────────
+
+function main(): void {
+    const { wbs, answer, spurBin } = parseArgs(process.argv.slice(2));
+    const findings: string[] = [];
+    const add = (msg: string): void => {
+        if (findings.length < 10) findings.push(msg);
+    };
+
+    if (!existsSync(answer)) {
+        console.error(`verify-answer-lint: FAIL — answer file not found: ${answer}`);
+        process.exit(1);
+    }
+    const raw = readFileSync(answer, 'utf8');
+    if (!raw.trim()) {
+        console.error(`verify-answer-lint: FAIL — answer file is empty: ${answer}`);
+        process.exit(1);
+    }
+
+    const tables = parseAnswer(raw);
+    if (tables.verdict === null) {
+        add('no `Verdict:` line (expected exactly one `Verdict: PASS|PARTIAL|FAIL` line)');
+    } else if (!/^(PASS|PARTIAL|FAIL)$/i.test(tables.verdict.value)) {
+        add(`line ${tables.verdict.line}: invalid Verdict value "${tables.verdict.value}" (PASS | PARTIAL | FAIL)`);
+    }
+
+    let taskContent = '';
+    let featureId = '';
+    try {
+        const task = JSON.parse(runSpur(spurBin, ['task', 'show', wbs, '--json'])) as {
+            content?: string;
+            body?: string;
+            feature_id?: string;
+            frontmatter?: { feature_id?: string };
+        };
+        taskContent = task.content ?? task.body ?? '';
+        featureId = task.feature_id ?? task.frontmatter?.feature_id ?? '';
+    } catch {
+        console.error(`verify-answer-lint: FAIL — could not fetch task ${wbs} via ${spurBin}`);
+        process.exit(1);
+    }
+    if (!taskContent) {
+        console.error(`verify-answer-lint: FAIL — task ${wbs} returned no content via ${spurBin}`);
+        process.exit(1);
+    }
+
+    let featureContent: string | null = null;
+    if (featureId) {
+        try {
+            const feature = JSON.parse(runSpur(spurBin, ['feature', 'show', featureId, '--json'])) as {
+                content?: string;
+            };
+            featureContent = feature.content ?? '';
+        } catch {
+            featureContent = null; // checklist labels still apply; scenario titles unavailable
+        }
+    }
+
+    const reqIds = extractRequirementIds(taskContent);
+    const acIdentities = extractAcIdentities(taskContent, featureContent);
+
+    // Requirement rows: completeness, no unknowns, no duplicates, valid status, non-empty evidence.
+    const seenReq = new Set<string>();
+    for (const row of tables.reqs) {
+        if (!reqIds.includes(row.id))
+            add(`line ${row.line}: unknown requirement ID "${row.id}" (task declares: ${reqIds.join(', ') || 'none'})`);
+        else if (seenReq.has(row.id)) add(`line ${row.line}: duplicate requirement row "${row.id}"`);
+        seenReq.add(row.id);
+        if (normalizeReqStatus(row.status) === null)
+            add(`line ${row.line}: "${row.id}" invalid status "${row.status}" (MET | PARTIAL | UNMET)`);
+        if (!row.evidence.trim()) add(`line ${row.line}: "${row.id}" has empty evidence`);
+    }
+    for (const id of reqIds) {
+        if (!seenReq.has(id)) add(`missing requirement row for "${id}"`);
+    }
+
+    // AC rows: identity must exactly match a checklist label/token or a scenario title;
+    // status and evidence type must normalize; evidence non-empty. AC completeness is the
+    // verifier's authoring contract, not a lint rejection class (0726 R3).
+    const seenAc = new Set<string>();
+    for (const row of tables.acs) {
+        if (!acIdentities.includes(row.id)) {
+            add(
+                `line ${row.line}: AC ID "${row.id.slice(0, 60)}" matches no task AC checklist label or scenario title`,
+            );
+        } else if (seenAc.has(row.id)) {
+            add(`line ${row.line}: duplicate AC row "${row.id.slice(0, 60)}"`);
+        }
+        seenAc.add(row.id);
+        if (normalizeAcStatus(row.status) === null)
+            add(`line ${row.line}: invalid AC status "${row.status}" (MET | PARTIAL | UNMET | N/A)`);
+        if (normalizeEvidenceType(row.evidenceType) === null)
+            add(
+                `line ${row.line}: invalid evidence type "${row.evidenceType}" (test | command | static-ref | manual-review | llm-judge | n/a, or a + compound)`,
+            );
+        if (!row.evidence.trim()) add(`line ${row.line}: AC "${row.id.slice(0, 40)}" has empty evidence`);
+    }
+
+    if (findings.length > 0) {
+        console.error(
+            `verify-answer-lint: FAIL — ${findings.length}${findings.length >= 10 ? '+' : ''} finding(s) in ${answer}`,
+        );
+        for (const f of findings) console.error(`  ${f}`);
+        process.exit(1);
+    }
+
+    const reqCount = tables.reqs.length;
+    const acCount = tables.acs.length;
+    console.error(
+        `verify-answer-lint: PASS — ${reqCount} requirement row(s), ${acCount} AC row(s), verdict ${tables.verdict?.value ?? '?'}`,
+    );
+    process.exit(0);
+}
+
+main();

package/plugins/sp/skills/code-implementation/SKILL.md

@@ -81,7 +81,7 @@ surfaces is what keeps that gate quiet.
 ## Implement scope: do not run the project quality gate
 
 During implement, the pipeline's `test` hop runs `${vars.qualityGateCmd}` (the full project gate:
-`bun run format && bun run spur-check`) immediately after this step and is the gate that actually
+`bun run spur-check`) immediately after this step and is the gate that actually
 decides pass/fail. Running it inside implement is pure redundancy — it cannot change the outcome and
 only burns wall clock and context budget.
 

package/plugins/sp/skills/code-verification/SKILL.md

@@ -247,9 +247,10 @@ completion gate (`PARTIAL`/`FAIL` route the pipeline to `failed`).
 ### Step 10 — Emit the verdict artifact (the only verify output)
 
 Assemble the evidence and **emit the canonical verdict artifact** — verification writes no task
-section (F92 0593 R1). Under the pipeline, the output is captured as
-`.spur/run/<wbs>-verify-answer.txt`; a deterministic shell step derives
-`.spur/run/<wbs>-verdict.json`, and the `record` step transcribes `## Testing` from it.
+section (F92 0593 R1). Under the pipeline **you** write
+`.spur/run/<wbs>-verify-answer.txt` (0726 R3: host `expectFile`, never captured/overwritten); a
+deterministic shell step lints it and derives `.spur/run/<wbs>-verdict.json`, and `record`
+transcribes `## Testing` from it.
 
 **Standalone** (`/sp:dev-verify` outside the pipeline), write the artifact yourself, then invoke
 the deterministic Testing writer `spur task record` (section authorship never happens here):
@@ -306,14 +307,14 @@ The per-requirement traceability table MUST use `| Req | Status | Evidence |` (e
 The parser is tolerant of these variants (defense-in-depth), but the authoring contract is
 canonical.
 
-**Under the pipeline** (`task-pipeline.yaml`), `agent.run answerFile` captures this whole output to
-`.spur/run/<wbs>-verify-answer.txt`. A deterministic shell step then derives
-`.spur/run/<wbs>-verdict.json` from it plus an independent `spur task check` (R9; the agent
-reporting PASS in prose is necessary but not sufficient — the artifact is never left to the agent's
-discretion). Section transcription follows the Step 10 contract (record → `## Testing`; bare-only
-Review fallback; verify never writes sections).
+Under the pipeline, the verifier owns the answer file `.spur/run/<wbs>-verify-answer.txt` (0726
+R3): `Verdict: PARTIAL` first, append one row at a time, replace the verdict line only when all
+rows are certified — interruptions leave lintable partial rows; retries fill only missing IDs.
+Host: `expectFile` → `verify-answer-lint.ts` → verdict + `spur task check` (R9). Vocabularies,
+rejection classes, and the AC identity rule: `references/verdict-schema.md`. Sections follow the
+Step 10 contract.
 
-**Standalone** (`/sp:dev-verify` outside the pipeline — no answer-file capture exists), write the
+**Standalone** (outside the pipeline — no host lint/derive step), write the answer file and
 artifact yourself; shape and field-by-field contract in
 [references/verdict-schema.md](references/verdict-schema.md):
 

package/plugins/sp/skills/code-verification/references/verdict-schema.md

@@ -106,6 +106,16 @@ For answer files, emit a matching parseable table:
 | Scenario: CLI emits JSON | MET | test | `apps/cli/tests/foo.test.ts:42` |
 ```
 
+**Authoring contract under the pipeline (0726 R3).** The verifier owns the answer file: write
+`Verdict: PARTIAL` first, append one complete row at a time, and replace the first verdict line only
+after every row is certified. `verify-answer-lint.ts` gates the file before `spur task verdict
+--from-answer` and rejects, with row-level diagnostics: missing/duplicate/unknown requirement IDs,
+AC ids that do not exactly match a task AC checklist label (or its leading token, e.g. `AC1`) or a
+linked feature scenario title, invalid status (`MET | PARTIAL | UNMET` for requirements;
+`N/A` additionally allowed for AC), invalid evidence type (`test | command | static-ref |
+manual-review | llm-judge | n/a`, or a `+` compound), and empty evidence. Interrupted runs keep the
+rows that pass the lint and complete only the missing IDs on retry.
+
 ## Checks evidence
 
 Wave C verification can emit the following additive `checks[]` rows:

package/plugins/sp/skills/spec-decomposition/SKILL.md

@@ -57,7 +57,7 @@ granularity knobs (min/target/force-split hours), and parent/umbrella-task conve
 spur task batch-create --file decomposition.json   # bare JSON array; atomic, all-or-nothing
 ```
 
-Validate locally against `apps/cli/schemas/task-batch.schema.json` (runtime SSOT: the Zod
+Validate locally against `task-batch.schema.json` (runtime SSOT: the Zod
 `taskBatchSchema`) before invoking the CLI — a single violation rejects the entire batch. The gate is
 the only proof the decomposition is well-formed; never hand-write task files to bypass it.
 

package/plugins/sp/skills/spur-cli/references/history.md

@@ -22,15 +22,16 @@ live in `packages/app/src/services/history-service.ts` (`FanOutResult`, `DailyRe
 | `analyze` | Aggregate imported rows and write a versioned forensic artifact | `--since <iso>` `--until <iso>` `--source <source>` `--session <id>` `--run <runId>` `--task <wbs>` `--top <n>` `--out <path>` `--json` |
 | `report [path]` | Purely render an existing artifact; default to `latest.json` | `--mode <name>` `--task <wbs>` `--top <n>` `--json` |
 | `daily` | Run import-all → analyze → artifact → 90-day report pruning once | `--since <iso>` `--until <iso>` `--root <path>` `--source-timeout <ms>` `--mode <name>` `--json` |
+| `reset` | Destructively wipe every `history_*` table for a clean re-import; refuses without `--yes` | `--yes` `--json` |
 
 Every JSON-capable verb also advertises `--json-envelope`; use the facade's machine-output contract.
 
 ## `import` - isolated fan-out
 
 ```bash
-bun run apps/cli/src/index.ts history import --source all --dry-run --json
-bun run apps/cli/src/index.ts history import --source codex --mode incremental --json
-bun run apps/cli/src/index.ts history import --source codex --file session.jsonl --mode force-file --json
+spur history import --source all --dry-run --json
+spur history import --source codex --mode incremental --json
+spur history import --source codex --file session.jsonl --mode force-file --json
 ```
 
 - `--source all` and a single source use the same per-source fan-out path. A failed/timed-out source
@@ -38,9 +39,10 @@ bun run apps/cli/src/index.ts history import --source codex --file session.jsonl
 - Modes are `incremental`, `full`, and `force-file`. `--file` with the default `all` source is a
   usage error. `--file --mode full` requires `--dry-run`; use `force-file` for a real single-file
   write.
-- JSON contains `entries`, `warnings`, `exitCode`, and CLI/importer `provenance`. For real-data
-  validation, invoke the source-local CLI and record that provenance; never trust a bare global
-  `spur` that may be stale.
+- JSON contains `entries`, `warnings`, `exitCode`, and CLI/importer `provenance`. Record that
+  provenance for any real-data validation. **When developing Spur itself**, invoke the source-local
+  CLI (`bun run apps/cli/src/index.ts history import …`) instead of a global `spur` that may be a
+  stale published bundle; in every other project the installed `spur` is the CLI.
 - Exit `0` when every source is clean/empty, `2` for a mixed failure or any degraded source, and `1`
   when all sources fail. CLI usage guards also exit `1` on this noun.
 

package/plugins/sp/skills/spur-dev/references/dev-operations.md

@@ -463,8 +463,8 @@ is the procedure. The backing is a combination of git CLI, `spur` CLI, and agent
   6. Run `bun run test`. Collect all failures.
   7. If tests are green, done.
   8. **Test fix loop:** for each failure, diagnose (test bug vs implementation bug), apply the fix, re-run the **failing test only** (`bun test <file> --test-name-pattern "<test>"`). Do NOT re-run the full suite per fix — it is the dominant loop cost (task 0436 R2).
-  9. **Confirming run (at most once).** After all fixes, run `bun run format && bun run lint && bun run test` **at most once** to confirm. If it passes, the hop is done.
-  10. **Pipeline-awareness (R4, task 0483).** When `/sp:dev-fixall` is invoked from the pipeline's `test-fix` hop, `test-recheck` runs the full `${vars.qualityGateCmd}` gate immediately after this hop returns — that is the **deciding** run that writes PASS to `.spur/run/<wbs>-test-gate.status`. Do NOT re-run the full gate beyond the single confirming run in step 9; the deciding run belongs to `test-recheck`. If your confirming run already passed, return immediately — a second or third gate run inside this hop is pure redundancy (0482 ran the gate 3× plus a standalone `bun run test`; all four were followed by `test-recheck` running it a 5th time). If your confirming run failed and you fixed more, re-run the full gate once more within `--max-retry` budget, then return — let `test-recheck` judge.
+  9. **Confirming run — standalone invocation only (at most once).** After all fixes, run `bun run format && bun run lint && bun run test` **at most once** to confirm. If it passes, the hop is done. **Skip this step entirely when `--gate-log` is set** (see step 10) — under the pipeline nothing consumes its verdict.
+  10. **Pipeline-awareness (R4, task 0483; confirming run dropped 2026-08-31).** `--gate-log` is set only by the pipeline's `test-fix` hop, so treat it as the pipeline signal. There, `test-recheck` runs the full `${vars.qualityGateCmd}` gate immediately after this hop returns — that is the **deciding** run, the only one that writes PASS to `.spur/run/<wbs>-test-gate.status`. A confirming run inside this hop decides nothing and costs a second full gate (~105 s here) to answer a question `test-recheck` is about to answer anyway. So under `--gate-log`: **run no full gate at all.** Your self-check is what step 8 already gives you — the failing tests you re-ran individually — plus **one `bun run lint`** (~7 s: Biome + typecheck) to catch type or lint breakage your fixes introduced. Then return and let `test-recheck` judge. `test-recheck` opens with the same cheap `${vars.gateProbeCmd}` probe, so a still-red tree is caught in seconds rather than by a full suite. Historical anti-pattern this replaces: 0482 ran the gate 3× plus a standalone `bun run test`, and `test-recheck` then ran it a 5th time.
   11. Report: list what was fixed (file + one-line summary per fix). If any error could not be resolved, report it explicitly — do not suppress.
 - **Invariants:** Never bypass with `--no-verify`, `--force`, or new `biome-ignore`/`eslint-disable` suppressions. Never skip or `.skip` a test to make the suite green. Fix the root cause, not the symptom. Never claim green on `bun run lint` alone — a formatter-only diff passes `lint` but fails the formatter; run `bun run format` (or assert it produces no diff) before declaring the gate clean. **Never re-run the full gate more than once per confirming pass** (R4) — use targeted probes during the fix loops and let the pipeline's `test-recheck` state be the deciding run.
 - **MANDATORY Exit Condition.** The ONLY way to complete successfully:

package/plugins/sp/skills/spur-dev/references/execution-workflow.md

@@ -46,7 +46,7 @@ one thing and yields, so the **pipeline (not the agent) owns the loop**.
 | Stage | Operation | Defined in |
 | ------- | ----------- | ------------ |
 | `implement` | `/sp:dev-run --mode implement <wbs>` — write the code that satisfies the task; author `## Solution`. | [dev-operations.md §4 run](dev-operations.md) → `sp:code-implementation` |
-| `test` → (`test-fix` ↔ `test-recheck`) → `review` \| `failed` | **Project quality gate** (not `/sp:dev-unit`). Soft shell probe of `${vars.qualityGateCmd}` (default `bun run autofix && bun run spur-check`) — green path pays **one** full gate run. On FAIL: bounded `/sp:dev-fixall` loop (`qualityGateMaxFixAttempts`, default 2) with soft recheck; exhausted attempts route to pipeline `failed`. `/sp:dev-unit` remains **coverage gap-fill** (router C3/C5 / standalone). | [dev-operations.md §10 fixall](dev-operations.md); unit op still §1 |
+| `test` → (`test-fix` ↔ `test-recheck`) → `review` \| `failed` | **Project quality gate** (not `/sp:dev-unit`). Soft shell probe of `${vars.qualityGateCmd}` (default `bun run spur-check`) — green path pays **one** full gate run. On FAIL: bounded `/sp:dev-fixall` loop (`qualityGateMaxFixAttempts`, default 2) with soft recheck; exhausted attempts route to pipeline `failed`. `/sp:dev-unit` remains **coverage gap-fill** (router C3/C5 / standalone). | [dev-operations.md §10 fixall](dev-operations.md); unit op still §1 |
 | `review` | `/sp:dev-review <wbs>` — SECUA-framework review of the diff. | [dev-operations.md §2 review](dev-operations.md) |
 | `verify` | `sp:code-verification` — requirements traceability + verdict. | [dev-operations.md §3 verify](dev-operations.md) |
 
@@ -97,6 +97,7 @@ cache-conservation discipline (`plugins/sp/skills/dogfood-testing/references/mon
 ## Step 2: Pipeline run
 
 > **Pre-launch size-gate pre-check (R1 / 0478).** Before launching `spur workflow run task-pipeline.yaml`, probe the task's `## Plan` checklist item count (`spur task show <wbs> --json`). The default cap is 8 items (`maxImplementPlanItems: 8`). If the plan item count exceeds 8:
+>
 > - Without `--auto`: warn the operator before calling `spur workflow run` and prompt for confirmation or a plan-item override via `--vars '{"maxImplementPlanItems":"<count>"}'`.
 > - With `--auto`: automatically append `"maxImplementPlanItems": "<count>"` to `--vars` and log a single-line notice (e.g. `Notice: task <wbs> has N plan items (>8 default cap); injecting maxImplementPlanItems override`).
 
@@ -313,6 +314,12 @@ the partial work still in the working tree. The failure output names the partial
    [`done-housekeeping.md`](done-housekeeping.md) F6 — it carries the provenance obligations
    (honest `done_reason`, verdict regeneration).
 
+   **Inline path (task 0727).** There is no `<runId>-implement-partial.md` artifact on the inline
+   driver path — it is written only by the subprocess `agent.run` action. The inline equivalent is
+   the dispatch-timeout contract in [`inline-pipeline-driver.md`](inline-pipeline-driver.md):
+   resume from the partial tree, never restart the stage inline; the partial working tree is the
+   recovery input.
+
 **3. Match the executor to the size (task 0487 R3).** Size and executor capability are one
 decision, not two. **≥ 6 requirements or ≥ 9 Plan items → a `reviewer`-role executor (the
 `reviewer` row of [`roles.md`](../../../references/roles.md) declares the floor), or split the

package/plugins/sp/skills/spur-dev/references/gate-checklists.md

@@ -52,7 +52,7 @@ Entered before `spur task batch-create --file <json>` (idea-pipeline `batch-crea
 decomposition gate `/sp:dev-plan` also routes through since D5-K).
 
 - [ ] The batch JSON is a bare array (not an object with a `tasks` key).
-- [ ] Each entry validates locally against `apps/cli/schemas/task-batch.schema.json` (`additionalProperties: false` — no unknown keys).
+- [ ] Each entry validates locally against `task-batch.schema.json` (`additionalProperties: false` — no unknown keys).
 - [ ] Each entry has a non-empty `name` (required).
 - [ ] `feature_id` matches an existing feature (or is intentionally deferred with operator awareness).
 - [ ] `parent_wbs` is set when the task is a child of a decomposition parent.
@@ -72,6 +72,16 @@ Entered before `task-pipeline.yaml` `precheck` state runs `spur task check <wbs>
 - [ ] The `## Plan` section is an ordered checklist (not prose).
 - [ ] The `## Design` section, if present, does not contradict the parent feature's design.
 - [ ] No `TODO`, `TBD`, or `???` placeholders in Requirements, AC, Design, or Plan.
+- [ ] The evidence-channel precheck (0726 R2) status file is consulted by the
+      pipeline guard: `plugins/sp/scripts/task-evidence-precheck.ts` parses the task
+      content for an exact `evidence-channel: history_tool_call.args_raw[pi]`
+      declaration and, when present, counts live pi rows with `args_raw` on
+      `.spur/spur.db` via bun:sqlite. Tasks without a declaration pass without opening
+      SQLite; unknown declarations, a missing database/table, and a zero count write
+      FAIL. Both precheck guard conjuncts (`precheck-size.status` and
+      `precheck-evidence.status`) must read PASS — tasks declaring a live-data
+      evidence channel must import real history (safe importer, non-dry-run) before
+      implementation begins.
 
 ## review gate
 
@@ -90,6 +100,12 @@ Entered before `task-pipeline.yaml` `review` state dispatches `sp:code-verificat
 
 Entered before `task-pipeline.yaml` `verify` state produces a task verdict.
 
+- [ ] The verify answer file (`.spur/run/<wbs>-verify-answer.txt`) is lint-clean before
+      verdict derivation: `plugins/sp/scripts/verify-answer-lint.ts <wbs>` (0726 R3)
+      rejects missing/duplicate/unknown R IDs, AC identities that are not an exact task
+      checklist label or linked-feature scenario title, invalid status/evidence-type
+      values, and empty evidence on any row. A lint failure fails the verify
+      step (fail-closed) before `spur task verdict` runs.
 - [ ] `spur task check <wbs> --strict-core --json` returns PASS.
 - [ ] Every AC scenario has a corresponding verify command that exited 0.
 - [ ] The `## Solution` section is filled (not the placeholder comment).

package/plugins/sp/skills/spur-dev/references/inline-pipeline-driver.md

@@ -41,6 +41,12 @@ command, skill, script, or second workflow.
      the YAML parsed in step 1, shown only for the active state.
    - **Refresh cadence** = stage boundaries only (when the current state changes after a transition),
      never per action.
+   - **Transition reconciliation (task 0727)** = at every stage boundary the host must
+     **mark the finished stage completed and the next stage in_progress** in the host todo list.
+     This reconciliation is **host-owned and execution-surface-independent**: it fires identically
+     whether the stage ran via native subagent, host-inline execution, or the post-dispatch host
+     fallback, so a run can never terminate with earlier stages stuck `in_progress` (task 0726
+     ended 0/11 with precheck and implement still open).
    - **Source of truth** = the CLI projection for layer 1; the YAML parsed in step 1 for layer 2.
      Never hand-copy or hand-derive the state list into the driver, a command, a skill, or a script.
 5. For task execution only, record lifecycle provenance before entering the FSM:
@@ -119,6 +125,19 @@ before the subagent starts, log the reason and use host fallback. If a started s
 leaves invalid artifacts, do **not** replay the stage in the host — follow the YAML error policy so
 partial mutations are not duplicated.
 
+**Timeout boundary (task 0727):** a dispatched subagent is governed by
+**the host platform's subagent limit, not the YAML timeoutMs** — `timeoutMs` stays not-applicable
+for host execution only — and before dispatch the driver must
+**record the governing timeout boundary and its source before dispatch** in the run log
+(e.g. `host timeout <ms> (<platform subagent limit|yaml timeoutMs>)`). If the dispatch reaches that
+boundary, **a dispatch timeout is a started-subagent failure**: the no-replay rule above and the
+stage's declared YAML error policy govern (implement's default `fail` policy routes the run to
+`failed`); it is never a host re-execution. Recovery follows the
+[timed-out implement runbook](execution-workflow.md)'s inline-path equivalent:
+**resume from the partial tree, never restart the stage inline** — no
+`<runId>-implement-partial.md` artifact is written on this path, so the partial working tree
+itself is the recovery input.
+
 **Host-owned interaction:** the host alone executes operator-confirmation actions, owns
 `pause: true`, and surfaces approve/taste/ask decisions. A subagent that discovers missing authority
 or an operator decision returns a blocker; the host pauses at the current state and presents it. The
@@ -129,6 +148,12 @@ subagent form above) to `.spur/run/<run-id>.log`, where `<id>` is the current YA
 log start/failure and the ignored timeout value so an inline run remains auditable without
 fabricating an `AgentRunTracedResult`.
 
+Run-log stamps (task 0727): every appended line is prefixed with an **ISO-8601 UTC** timestamp
+(`YYYY-MM-DDTHH:MM:SSZ`, e.g. `2026-08-31T17:51:11Z`); the exact-template provenance lines above
+keep their exact content after the stamp prefix. This normalization is contractual:
+**bare local-clock stamps are prohibited** — a hand-appended `[stage 12:31]` form mixes timezones
+in one file and makes the run unauditable (task 0726 mixed both forms).
+
 Transition guards are not advisory. Execute the declared guard exactly, in order, with the same
 resolved variables and artifacts. `--no-lifecycle` remains bookkeeping only; the YAML's task checks,
 verdict gate, record step, and done guard all remain authoritative.