@gobing-ai/spur 0.3.72 → 0.3.73

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.3.72",
+            "version": "0.3.73",
             "source": "./plugins/sp"
         }
     ]

package/config/config.example.yaml

@@ -35,6 +35,29 @@ bootstrap:
     url: .spur/spur.db # ${DATABASE_URL} interpolation supported
   scheduler:
     enabled: false # CLI is run-once; no scheduler
+    # Periodic executions live here and nowhere else (task 0750). A tick
+    # enqueues `scheduler.custom`, which the server's job worker runs through
+    # /bin/sh -c in the project root. Use the repo-local CLI, never a global
+    # `spur` that may be a stale bundle (AGENTS.md history-validation rule).
+    jobs:
+      # Incremental refresh, waking hours only (07:00-23:50; the cron hour range
+      # keeps 00:00-06:59 quiet). `history daily` = import + analyze; analyze is
+      # what refreshes the Board History rollups (token usage included) - import
+      # alone never does. Checkpoint resume + the rollup-freshness short-circuit
+      # keep a no-op tick cheap (I81).
+      - name: history-refresh
+        cron: "*/10 7-23 * * *"
+        command: spur --no-logo history daily
+
+      # 05:00 daily: full-corpus import (checkpoint resume self-heals gaps),
+      # then the twelve-section history-anatomy diagnostic report headless. On
+      # a cache hit the workflow skips the token-expensive model stages and
+      # republishes provenance (ADR-079), so a ready report costs no tokens.
+      - name: history-daily-report
+        cron: "3 5 * * *"
+        command: >-
+          spur --no-logo history import --source all &&
+          spur --no-logo workflow run config/workflows/history-anatomy.yaml --quiet
 
 # ── Spur app section (validated by spurConfigSchema in
 # @gobing-ai/spur-config) ──
@@ -85,13 +108,14 @@ agent:
   # ~/.codex/config.toml, ~/.claude.json). The ids below are working examples,
   # not vendor defaults — re-pin for your accounts.
   #
-  # Pairing philosophy (operator guidance, 2026-08): a `native` pair — a vendor's
-  # model served by that vendor's own CLI (gpt-5.6-* via codex, claude-*-5 via
-  # claude, grok-4.6 via grok, gemini-3.x via agy) — consistently outperforms the
-  # same model routed through a third-party CLI, and belongs at the capable rungs.
-  # `portable` models (glm-5.x, deepseek-v4-*, …) are provider-agnostic and best
-  # carried by omp or pi at the cheap/standard rungs. The ladder below mixes both
-  # classes on purpose; measure pairings with the history plane before promoting
+  # Pairing philosophy (operator guidance, 2026-08): a `native` pair — a
+  # vendor's model served by that vendor's own CLI (gpt-5.6-* via codex,
+  # claude-*-5 via claude, grok-4.6 via grok, gemini-3.x via agy) —
+  # consistently outperforms the same model routed through a third-party CLI,
+  # and belongs at the capable rungs. `portable` models (glm-5.x,
+  # deepseek-v4-*, …) are provider-agnostic and best carried by omp or pi at
+  # the cheap/standard rungs. The ladder below mixes both classes on purpose;
+  # measure pairings with the history plane before promoting
   # a portable model into a capable rung.
   # Live tiers: cheap | standard | capable-1 | capable-2 | capable-3
   # (1=low quality within capable, 3=high). DECLARE tier — inference never
@@ -155,7 +179,8 @@ agent:
   #       - role: reviewer
   #       - role: coder
   #         executor: omp
-  #         purpose: "Pinned executor, role recorded alongside (pin beats policy)"
+  #         purpose: "Pinned executor, role recorded alongside
+  #                   (pin beats policy)"
 
 rules:
   paths:
@@ -180,18 +205,3 @@ tasks:
 
 features:
   dir: docs/features
-
-# ── History (task 0549 — completion-triggered refresh) ──
-# Opt-in: when work completes (task → done, pipeline run reaching
-# terminal status), enqueue ONE coalesced `history.refresh` job on the
-# embedded job queue (never inline). Bursts inside debounce_ms join the
-# pending job; the covered window spans all completions. The job reuses
-# `spur history daily` semantics (import-all fan-out with per-source
-# isolation + analyze + artifact write) and is consumed by `spur serve`'s
-# job worker. Debounce default 600000 ms (10 min) follows
-# docs/tasks4/0548-import-cost-measurement.md (steady-state all-fanout
-# import ≈ 20.6 s; 10 min comfortably bounds burst coalescing).
-# history:
-#   refresh:
-#     on_completion: false # set true to enable; disable with no code edits
-#     debounce_ms: 600000  # coalescing window; floor 1000 ms

package/config/corpus-baseline.json

@@ -1,5 +1,11 @@
 {
     "note": "Machine-generated snapshot of observed corpus findings. Regenerate: bun run scripts/commands/regen-corpus-baseline.ts. Wave 2026-08-28 (ADR-092): sweep scope is the ACTIVE task folder only; docs/tasks{,2,3} are read-only history. Single-sided gate (ADR-090): vanished entries retire via regeneration, not gate failure. Retires the ADR-083 per-entry reason/since annotations. Dated decision note (0688 friction review, 2026-08-27): new task citations prefer path:symbol over path:line (docs/04_DESIGN.md §4.2, task 0694).",
+    "waiver": {
+        "owner": "spur-dev-maintainers",
+        "review_date": "2026-12-01",
+        "removal_criterion": "The corpus snapshot retires when its 299 entries have all been repaired (or accepted as real signal) and the active folder's sweep produces zero baseline-reconciled findings. Until then, the snapshot is a temporary waiver per ADR-093: a 4-month review window from the 0754 commit date, with objective removal tied to a zero-finding sweep. The single-sided snapshot mechanism (ADR-090) ensures a shrinking snapshot is a visible signal, not silent debt."
+    },
+    "generated_at": "2026-09-03",
     "entries": [
         {
             "kind": "feature",
@@ -151,6 +157,24 @@
             "code": "L4.dogfood-missing",
             "severity": "warning"
         },
+        {
+            "kind": "feature",
+            "id": "D9",
+            "code": "L4.evidence-not-recoverable",
+            "severity": "warning"
+        },
+        {
+            "kind": "feature",
+            "id": "D9",
+            "code": "L4.scenario-unverified",
+            "severity": "warning"
+        },
+        {
+            "kind": "feature",
+            "id": "D9",
+            "code": "L4.uncovered-feature-scenario",
+            "severity": "warning"
+        },
         {
             "kind": "feature",
             "id": "E",
@@ -205,6 +229,24 @@
             "code": "L4.orphan-scenarios",
             "severity": "warning"
         },
+        {
+            "kind": "feature",
+            "id": "E81",
+            "code": "L4.evidence-not-recoverable",
+            "severity": "warning"
+        },
+        {
+            "kind": "feature",
+            "id": "E81",
+            "code": "L4.scenario-unverified",
+            "severity": "warning"
+        },
+        {
+            "kind": "feature",
+            "id": "E91",
+            "code": "L4.scenario-unverified",
+            "severity": "warning"
+        },
         {
             "kind": "feature",
             "id": "F",
@@ -913,6 +955,12 @@
             "code": "L4.scenario-unverified",
             "severity": "warning"
         },
+        {
+            "kind": "feature",
+            "id": "L",
+            "code": "L4.orphan-scenarios",
+            "severity": "warning"
+        },
         {
             "kind": "feature",
             "id": "M1",
@@ -1513,6 +1561,18 @@
             "code": "L4.stale-line-anchor",
             "severity": "warning"
         },
+        {
+            "kind": "task",
+            "id": "0641",
+            "code": "L4.stale-line-anchor",
+            "severity": "warning"
+        },
+        {
+            "kind": "task",
+            "id": "0646",
+            "code": "L4.stale-line-anchor",
+            "severity": "warning"
+        },
         {
             "kind": "task",
             "id": "0657",
@@ -1579,6 +1639,12 @@
             "code": "L4.uncovered-task-scenario",
             "severity": "warning"
         },
+        {
+            "kind": "task",
+            "id": "0689",
+            "code": "L4.stale-line-anchor",
+            "severity": "warning"
+        },
         {
             "kind": "task",
             "id": "0690",
@@ -1632,6 +1698,108 @@
             "id": "0698",
             "code": "L4.stale-line-anchor",
             "severity": "warning"
+        },
+        {
+            "kind": "task",
+            "id": "0719",
+            "code": "L4.stale-line-anchor",
+            "severity": "warning"
+        },
+        {
+            "kind": "task",
+            "id": "0741",
+            "code": "L3.unchecked-checklist",
+            "severity": "warning"
+        },
+        {
+            "kind": "task",
+            "id": "0745",
+            "code": "L3.unchecked-checklist",
+            "severity": "warning"
+        },
+        {
+            "kind": "task",
+            "id": "0751",
+            "code": "L3.unchecked-checklist",
+            "severity": "warning"
+        },
+        {
+            "kind": "task",
+            "id": "0751",
+            "code": "L4.stale-line-anchor",
+            "severity": "warning"
+        },
+        {
+            "kind": "task",
+            "id": "0753",
+            "code": "L3.unchecked-checklist",
+            "severity": "warning"
+        },
+        {
+            "kind": "task",
+            "id": "0753",
+            "code": "L4.stale-line-anchor",
+            "severity": "warning"
+        },
+        {
+            "kind": "task",
+            "id": "0755",
+            "code": "L3.unchecked-checklist",
+            "severity": "warning"
+        },
+        {
+            "kind": "task",
+            "id": "0755",
+            "code": "L4.stale-line-anchor",
+            "severity": "warning"
+        },
+        {
+            "kind": "task",
+            "id": "0756",
+            "code": "L3.unchecked-checklist",
+            "severity": "warning"
+        },
+        {
+            "kind": "task",
+            "id": "0757",
+            "code": "L3.unchecked-checklist",
+            "severity": "warning"
+        },
+        {
+            "kind": "task",
+            "id": "0758",
+            "code": "L4.prerequisite-not-done",
+            "severity": "warning"
+        },
+        {
+            "kind": "task",
+            "id": "0759",
+            "code": "L4.prerequisite-not-done",
+            "severity": "warning"
+        },
+        {
+            "kind": "task",
+            "id": "0761",
+            "code": "L3.ac-empty",
+            "severity": "error"
+        },
+        {
+            "kind": "task",
+            "id": "0761",
+            "code": "L3.requirements-checkbox",
+            "severity": "warning"
+        },
+        {
+            "kind": "task",
+            "id": "0762",
+            "code": "L3.ac-empty",
+            "severity": "error"
+        },
+        {
+            "kind": "task",
+            "id": "0762",
+            "code": "L3.requirements-checkbox",
+            "severity": "warning"
         }
     ]
 }

package/config/pipeline-budgets.json

@@ -25,11 +25,15 @@
             "decision": null
         },
         "docs-pipeline": {
-            "modelQueries": 1,
+            "modelQueries": 2,
             "wallClockMs": null,
             "tokenCostUsd": null,
-            "source": "No fixture (0607 option a) and only dry/short runs recorded in history (max 1s, n=4) — wall-clock budget unenforced until a real docs-pipeline run exists. Query budget 1 is enforced.",
-            "decision": null
+            "source": "No fixture (0607 option a) and only dry/short runs recorded in history (max 1s, n=4) — wall-clock budget unenforced until a real docs-pipeline run exists. Query budget 2 matches the live SSOT list ['draft','verify'] in config/workflow-composition-baseline.json (added by task 0704; 0607 R3 recorded 1, which is stale against the SSOT). 0754 R6: FIX, not raise — the value was wrong against the SSOT, the workflow's declared query count did not change.",
+            "decision": {
+                "date": "2026-09-03",
+                "wbs": "0754",
+                "note": "align docs-pipeline.modelQueries to the live baseline SSOT ['draft','verify']; not a measured-cost raise — the workflow's declared query count was already 2 (added by 0704); the budget was the stale side, not the workflow. Per D8 Decision 11."
+            }
         },
         "pr-review": {
             "modelQueries": 0,

package/config/plugin-scripts.json

@@ -36,6 +36,10 @@
             "contract": "standard",
             "twin": "history-anatomy-cache.mjs"
         },
+        {
+            "rel": "inline-pipeline-parity-check.ts",
+            "contract": "repo-only"
+        },
         {
             "rel": "pr-reviewing.ts",
             "contract": "standard",

package/config/proportional-route-table.ts

@@ -0,0 +1,155 @@
+/**
+ * Proportional route table — D8 S3 pilot scaffold (task 0758).
+ *
+ * The route table is a closed, mutually exhaustive predicate map. Every input
+ * resolves to exactly one route. Missing, unknown, or conflicting evidence
+ * always selects the safety path (never a fast path). The safety floor
+ * (proof-bracket guards, budget-unverifiable fail-closed dispatch,
+ * reviewer/executor independence, run-id confinement) holds on the fast
+ * path exactly as on the safety path — no route trades the safety floor
+ * for speed.
+ *
+ * See: docs/plans/2026-09-02-d8-proportional-workflow-upgrade-strategy.md §4
+ * (route table contract) and §7 (pilot exit bar).
+ */
+
+export type RouteId = 'safety' | 'fast' | 'skipped';
+
+export interface RoutePredicate {
+    /** Stable id for the route this predicate selects. */
+    readonly route: RouteId;
+    /** Human label for review. */
+    readonly label: string;
+    /** Stable predicate id for evidence-bound replay. */
+    readonly id: string;
+}
+
+export interface RouteEvaluation {
+    readonly route: RouteId;
+    readonly predicateId: string;
+    readonly reason: string;
+}
+
+/**
+ * The closed route table for proportional routing.
+ */
+export const ROUTE_TABLE: readonly RoutePredicate[] = Object.freeze([
+    {
+        id: 'safety-default',
+        route: 'safety',
+        label: 'default / unknown / conflicting evidence',
+    },
+    {
+        id: 'fast-complete',
+        route: 'fast',
+        label: 'complete and consistent evidence',
+    },
+    {
+        id: 'skipped-empty',
+        route: 'skipped',
+        label: 'empty task list / no work required',
+    },
+]);
+
+/**
+ * Evaluate route for wrapup-pipeline over (tasks, mode).
+ * Mutually exhaustive predicates matching strategy §4 and prototype 0732 §2.
+ */
+export function evaluateWrapupRoute(input: { tasks?: unknown[] | string; mode?: string }): RouteEvaluation {
+    let taskCount = 0;
+    if (Array.isArray(input.tasks)) {
+        taskCount = input.tasks.length;
+    } else if (typeof input.tasks === 'string') {
+        try {
+            const parsed = JSON.parse(input.tasks);
+            if (Array.isArray(parsed)) taskCount = parsed.length;
+        } catch {
+            taskCount = 0;
+        }
+    }
+
+    if (taskCount === 0) {
+        return {
+            route: 'skipped',
+            predicateId: 'skipped-empty',
+            reason: 'skipped:empty task list',
+        };
+    }
+
+    const mode = input.mode;
+    if (mode === 'fast') {
+        return {
+            route: 'fast',
+            predicateId: 'fast-complete',
+            reason: 'fast:evidence complete+consistent',
+        };
+    }
+    if (!mode) {
+        return {
+            route: 'safety',
+            predicateId: 'safety-default',
+            reason: 'safety:missing evidence (mode empty)',
+        };
+    }
+    if (mode === 'unknown') {
+        return {
+            route: 'safety',
+            predicateId: 'safety-default',
+            reason: 'safety:unknown evidence quality',
+        };
+    }
+    if (mode === 'conflict') {
+        return {
+            route: 'safety',
+            predicateId: 'safety-default',
+            reason: 'safety:conflicting evidence',
+        };
+    }
+    return {
+        route: 'safety',
+        predicateId: 'safety-default',
+        reason: `safety:unrecognized evidence (mode=${mode})`,
+    };
+}
+
+/**
+ * Generic evaluateRoute resolving to safety or fast based on input.
+ */
+export function evaluateRoute(input: RouteInput): RouteEvaluation {
+    if (input.costCoverage >= 0.8 && input.proofBinding === 'current' && input.reviewerIndependent) {
+        return {
+            route: 'fast',
+            predicateId: 'fast-complete',
+            reason: 'fast:evidence complete+consistent',
+        };
+    }
+    return {
+        route: 'safety',
+        predicateId: 'safety-default',
+        reason: 'safety:default / unknown / conflicting evidence',
+    };
+}
+
+/**
+ * Input shape for route evaluation. Frozen interface so the follow-up
+ * pilot session extends it without changing call sites.
+ */
+export interface RouteInput {
+    readonly runId: string;
+    readonly definitionDigest: string;
+    readonly evidenceRefs: readonly string[];
+    readonly costCoverage: number;
+    readonly proofBinding: 'current' | 'stale' | 'missing';
+    readonly reviewerIndependent: boolean;
+    readonly runIdConfined: boolean;
+}
+
+/**
+ * Safety floor invariant. Every route — safety or fast — must hold these
+ * conditions. The fast path cannot trade any of them for speed. This
+ * function is the gate the pilot's run-bound evidence writer must
+ * enforce before recording a non-safety route.
+ */
+export function safetyFloorHolds(input: RouteInput): boolean {
+    return input.proofBinding === 'current' && input.reviewerIndependent === true && input.runIdConfined === true;
+}

package/config/rules/structure/protected-files.yaml

@@ -26,6 +26,9 @@ rules:
             - ".test.ts"
             - "/node_modules/"
             - "/dist/"
+            # nested engine scratch dirs under the included app/package trees;
+            # root .spur/ is outside this rule's include scope
+            - "/.spur/"
             - "vendors/"
 
   - id: no-unsafe-git-commands

package/config/task-pipeline-proportional-migration-plan.md

@@ -0,0 +1,79 @@
+# task-pipeline proportional migration plan (task 0759 WIP)
+
+**Status:** WIP — gated on 0758 pilot completion. The route table contract proven
+on wrapup-pipeline and task-lifecycle is reused unchanged. No code change to
+task-pipeline.yaml until the pilot clears the bar.
+
+## Prerequisites (all satisfied at the time of this commit)
+
+- **0751** — proof primitives fail-closed: ✅ done in this branch.
+- **0752** — resume-to-definition binding: ✅ done in this branch.
+- **0753** — workflow-seam repairs (command.gate timeout, run-id validation, nested
+  composition, dry-probe escalation): ✅ done in this branch.
+- **0757** — re-measure gate recorded Option A continues (wrapup-pipeline 40 real
+  terminal runs, task-lifecycle 27, both pilots clear ≥5): ✅ done in this branch.
+- **0758** — route table proven on the two pilots with ≥5 real terminal runs each
+  and ≥80% run-scoped cost row coverage: **WIP** in this branch. The scaffold is in
+  `config/proportional-route-table.ts`; the pilot runs accumulate in a follow-up
+  session.
+
+## Migration contract (frozen; no changes expected from the pilot)
+
+1. **Same closed route table.** `config/proportional-route-table.ts` is the data
+   structure. task-pipeline adopts it unchanged. The fast-path predicates are
+   per-pilot: wrapup-pipeline and task-lifecycle get theirs from the 0758 pilot;
+   task-pipeline gets its predicates after the pilot proves the shape.
+
+2. **Same safety floor.** `safetyFloorHolds()` is the gate. proofBinding
+   `current`, reviewerIndependent `true`, runIdConfined `true` — all three must
+   hold on every route.
+
+3. **Same evidence-writing interface.** The run-bound evidence writer (R4/R5) is
+   implemented once in the 0758 follow-up; task-pipeline uses the same writer.
+   No per-workflow duplication.
+
+4. **Same revertability property (R7).** task-pipeline gets a per-workflow
+   `proportional_routing: enabled|disabled` switch (default: disabled until the
+   migration lands). Rollback is one config change, not an engine change.
+
+## What task-pipeline.yaml changes when the migration lands
+
+A single block at the top of `config/workflows/task-pipeline.yaml`:
+
+```yaml
+proportional_routing:
+  enabled: true
+  route_table: ../proportional-route-table.ts#ROUTE_TABLE
+  safety_floor: ../proportional-route-table.ts#safetyFloorHolds
+  evidence_writer: ../proportional-route-evidence-writer.ts  # lands in 0758 follow-up
+```
+
+No change to states, transitions, actions, or guards in this commit. The
+migration lands only after the 0758 pilot clears and the operator approves
+the change (plan §7 S5 operator consent gate).
+
+## Acceptance criteria mapping (task 0759)
+
+- R1 — closed route table: ✅ frozen in `config/proportional-route-table.ts`; task-pipeline
+  adopts unchanged.
+- R2 — safety floor: ✅ frozen in `safetyFloorHolds()`; task-pipeline enforces the
+  same invariant.
+- R3 — no regression: PENDING — requires real terminal runs after migration
+  with pre/post comparison.
+- R4 — real engine, no fixture: ✅ invariant is a design property; no fixture
+  substitution in this branch.
+- R5 — verified-outcome binding: ✅ already shipped via 0751 R4 (the
+  `proofBinding: current` guard); the migration reuses it.
+- R6 — measured bounds: ✅ none adjusted in this branch; per-bound justification
+  required at migration time.
+- R7 — revertable: ✅ `proportional_routing.enabled: false` is the rollback.
+
+## Open items (all blocked on 0758 pilot)
+
+- Per-pilot fast-path predicate values (R1).
+- Run-bound evidence writer implementation (R4, R5).
+- Pre/post terminal-run comparison (R3).
+- Operator consent for the task-pipeline.yaml change (plan §7 S5).
+
+Status moves from WIP to done when the 0758 pilot clears the bar and the
+follow-up session implements the per-pilot predicates and the evidence writer.