@gobing-ai/spur 0.3.72 → 0.3.74

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.3.72",
+            "version": "0.3.74",
             "source": "./plugins/sp"
         }
     ]

package/config/config.example.yaml

@@ -35,6 +35,29 @@ bootstrap:
     url: .spur/spur.db # ${DATABASE_URL} interpolation supported
   scheduler:
     enabled: false # CLI is run-once; no scheduler
+    # Periodic executions live here and nowhere else (task 0750). A tick
+    # enqueues `scheduler.custom`, which the server's job worker runs through
+    # /bin/sh -c in the project root. Use the repo-local CLI, never a global
+    # `spur` that may be a stale bundle (AGENTS.md history-validation rule).
+    jobs:
+      # Incremental refresh, waking hours only (07:00-23:50; the cron hour range
+      # keeps 00:00-06:59 quiet). `history daily` = import + analyze; analyze is
+      # what refreshes the Board History rollups (token usage included) - import
+      # alone never does. Checkpoint resume + the rollup-freshness short-circuit
+      # keep a no-op tick cheap (I81).
+      - name: history-refresh
+        cron: "*/10 7-23 * * *"
+        command: spur --no-logo history daily
+
+      # 05:00 daily: full-corpus import (checkpoint resume self-heals gaps),
+      # then the twelve-section history-anatomy diagnostic report headless. On
+      # a cache hit the workflow skips the token-expensive model stages and
+      # republishes provenance (ADR-079), so a ready report costs no tokens.
+      - name: history-daily-report
+        cron: "3 5 * * *"
+        command: >-
+          spur --no-logo history import --source all &&
+          spur --no-logo workflow run config/workflows/history-anatomy.yaml --quiet
 
 # ── Spur app section (validated by spurConfigSchema in
 # @gobing-ai/spur-config) ──
@@ -85,13 +108,14 @@ agent:
   # ~/.codex/config.toml, ~/.claude.json). The ids below are working examples,
   # not vendor defaults — re-pin for your accounts.
   #
-  # Pairing philosophy (operator guidance, 2026-08): a `native` pair — a vendor's
-  # model served by that vendor's own CLI (gpt-5.6-* via codex, claude-*-5 via
-  # claude, grok-4.6 via grok, gemini-3.x via agy) — consistently outperforms the
-  # same model routed through a third-party CLI, and belongs at the capable rungs.
-  # `portable` models (glm-5.x, deepseek-v4-*, …) are provider-agnostic and best
-  # carried by omp or pi at the cheap/standard rungs. The ladder below mixes both
-  # classes on purpose; measure pairings with the history plane before promoting
+  # Pairing philosophy (operator guidance, 2026-08): a `native` pair — a
+  # vendor's model served by that vendor's own CLI (gpt-5.6-* via codex,
+  # claude-*-5 via claude, grok-4.6 via grok, gemini-3.x via agy) —
+  # consistently outperforms the same model routed through a third-party CLI,
+  # and belongs at the capable rungs. `portable` models (glm-5.x,
+  # deepseek-v4-*, …) are provider-agnostic and best carried by omp or pi at
+  # the cheap/standard rungs. The ladder below mixes both classes on purpose;
+  # measure pairings with the history plane before promoting
   # a portable model into a capable rung.
   # Live tiers: cheap | standard | capable-1 | capable-2 | capable-3
   # (1=low quality within capable, 3=high). DECLARE tier — inference never
@@ -106,10 +130,21 @@ agent:
     #   agent: omp
     #   model: minimax/MiniMax-M3
     #   tier: cheap
-    - name: omp
-      agent: omp
-      model: opencode/deepseek-v4-flash
-      tier: standard
+    - name: pi-dsv4-flash-volc
+      agent: pi
+    #   tier: standard
+      executionCapabilities:
+        version: 1
+        axes:
+          fsRead:
+            state: available
+            provenance: native-known
+          fsWrite:
+            state: available
+            provenance: native-known
+          processSpawn:
+            state: available
+            provenance: native-known
     # - name: omp-zai
     #   agent: omp
     #   model: zai/glm-5.2
@@ -155,7 +190,8 @@ agent:
   #       - role: reviewer
   #       - role: coder
   #         executor: omp
-  #         purpose: "Pinned executor, role recorded alongside (pin beats policy)"
+  #         purpose: "Pinned executor, role recorded alongside
+  #                   (pin beats policy)"
 
 rules:
   paths:
@@ -180,18 +216,3 @@ tasks:
 
 features:
   dir: docs/features
-
-# ── History (task 0549 — completion-triggered refresh) ──
-# Opt-in: when work completes (task → done, pipeline run reaching
-# terminal status), enqueue ONE coalesced `history.refresh` job on the
-# embedded job queue (never inline). Bursts inside debounce_ms join the
-# pending job; the covered window spans all completions. The job reuses
-# `spur history daily` semantics (import-all fan-out with per-source
-# isolation + analyze + artifact write) and is consumed by `spur serve`'s
-# job worker. Debounce default 600000 ms (10 min) follows
-# docs/tasks4/0548-import-cost-measurement.md (steady-state all-fanout
-# import ≈ 20.6 s; 10 min comfortably bounds burst coalescing).
-# history:
-#   refresh:
-#     on_completion: false # set true to enable; disable with no code edits
-#     debounce_ms: 600000  # coalescing window; floor 1000 ms

package/config/pipeline-budgets.json

@@ -1,7 +1,7 @@
 {
     "schemaVersion": 1,
     "generatedAt": "2026-08-20T00:00:00.000Z",
-    "note": "Per-pipeline model-query + wall-clock cost budgets (task 0607 R3). modelQueries anchors the frozen config/workflow-composition-baseline.json list (the SSOT, two-sided checked). wallClockMs is a gross-regression ceiling anchored to measured real-run data (R5): the gate compares the median-of-sane terminal-run wall-clock against it. A null budget is unenforced until measured — never treated as 0. Raising a numeric budget requires a fresh recorded decision in the same commit (config/pipeline-budgets.json vs git HEAD); the check-pipeline-budgets gate fails a silent raise by name.",
+    "note": "Per-pipeline model-query + wall-clock cost budgets (task 0607 R3). modelQueries anchors the live workflow definitions' query lists — the SSOT, extracted by extractResolvedWorkflowFacts and guarded by composition-baseline.test.ts (0775 retired the snapshot this file previously anchored to). wallClockMs is a gross-regression ceiling anchored to measured real-run data (R5): the gate compares the median-of-sane terminal-run wall-clock against it. A null budget is unenforced until measured — never treated as 0. Raising a numeric budget requires a fresh recorded decision in the same commit (config/pipeline-budgets.json vs git HEAD); the check-pipeline-budgets gate fails a silent raise by name.",
     "budgets": {
         "task-pipeline": {
             "modelQueries": 4,
@@ -25,17 +25,21 @@
             "decision": null
         },
         "docs-pipeline": {
-            "modelQueries": 1,
+            "modelQueries": 2,
             "wallClockMs": null,
             "tokenCostUsd": null,
-            "source": "No fixture (0607 option a) and only dry/short runs recorded in history (max 1s, n=4) — wall-clock budget unenforced until a real docs-pipeline run exists. Query budget 1 is enforced.",
-            "decision": null
+            "source": "No fixture (0607 option a) and only dry/short runs recorded in history (max 1s, n=4) — wall-clock budget unenforced until a real docs-pipeline run exists. Query budget 2 matches the live workflow definition's query list ['draft','verify'] (added by task 0704; 0607 R3 recorded 1, which is stale against the definition). 0754 R6: FIX, not raise — the value was wrong against the definition, the workflow's declared query count did not change.",
+            "decision": {
+                "date": "2026-09-03",
+                "wbs": "0754",
+                "note": "align docs-pipeline.modelQueries to the live workflow definition's query list ['draft','verify']; not a measured-cost raise — the workflow's declared query count was already 2 (added by 0704); the budget was the stale side, not the workflow. Per D8 Decision 11."
+            }
         },
         "pr-review": {
             "modelQueries": 0,
             "wallClockMs": null,
             "tokenCostUsd": null,
-            "source": "Zero-query pipeline (baseline modelQueries []); query budget trivially 0 — the gate handles an empty list (0607 R3). No real full run recorded; wall-clock unenforced.",
+            "source": "Zero-query pipeline (the live definition declares no model queries); query budget trivially 0 — the gate handles an empty list (0607 R3). No real full run recorded; wall-clock unenforced.",
             "decision": null
         }
     }

package/config/plugin-scripts.json

@@ -36,6 +36,10 @@
             "contract": "standard",
             "twin": "history-anatomy-cache.mjs"
         },
+        {
+            "rel": "inline-pipeline-parity-check.ts",
+            "contract": "repo-only"
+        },
         {
             "rel": "pr-reviewing.ts",
             "contract": "standard",

package/config/proportional-route-table.ts

@@ -0,0 +1,155 @@
+/**
+ * Proportional route table — D8 S3 pilot scaffold (task 0758).
+ *
+ * The route table is a closed, mutually exhaustive predicate map. Every input
+ * resolves to exactly one route. Missing, unknown, or conflicting evidence
+ * always selects the safety path (never a fast path). The safety floor
+ * (proof-bracket guards, budget-unverifiable fail-closed dispatch,
+ * reviewer/executor independence, run-id confinement) holds on the fast
+ * path exactly as on the safety path — no route trades the safety floor
+ * for speed.
+ *
+ * See: docs/plans/2026-09-02-d8-proportional-workflow-upgrade-strategy.md §4
+ * (route table contract) and §7 (pilot exit bar).
+ */
+
+export type RouteId = 'safety' | 'fast' | 'skipped';
+
+export interface RoutePredicate {
+    /** Stable id for the route this predicate selects. */
+    readonly route: RouteId;
+    /** Human label for review. */
+    readonly label: string;
+    /** Stable predicate id for evidence-bound replay. */
+    readonly id: string;
+}
+
+export interface RouteEvaluation {
+    readonly route: RouteId;
+    readonly predicateId: string;
+    readonly reason: string;
+}
+
+/**
+ * The closed route table for proportional routing.
+ */
+export const ROUTE_TABLE: readonly RoutePredicate[] = Object.freeze([
+    {
+        id: 'safety-default',
+        route: 'safety',
+        label: 'default / unknown / conflicting evidence',
+    },
+    {
+        id: 'fast-complete',
+        route: 'fast',
+        label: 'complete and consistent evidence',
+    },
+    {
+        id: 'skipped-empty',
+        route: 'skipped',
+        label: 'empty task list / no work required',
+    },
+]);
+
+/**
+ * Evaluate route for wrapup-pipeline over (tasks, mode).
+ * Mutually exhaustive predicates matching strategy §4 and prototype 0732 §2.
+ */
+export function evaluateWrapupRoute(input: { tasks?: unknown[] | string; mode?: string }): RouteEvaluation {
+    let taskCount = 0;
+    if (Array.isArray(input.tasks)) {
+        taskCount = input.tasks.length;
+    } else if (typeof input.tasks === 'string') {
+        try {
+            const parsed = JSON.parse(input.tasks);
+            if (Array.isArray(parsed)) taskCount = parsed.length;
+        } catch {
+            taskCount = 0;
+        }
+    }
+
+    if (taskCount === 0) {
+        return {
+            route: 'skipped',
+            predicateId: 'skipped-empty',
+            reason: 'skipped:empty task list',
+        };
+    }
+
+    const mode = input.mode;
+    if (mode === 'fast') {
+        return {
+            route: 'fast',
+            predicateId: 'fast-complete',
+            reason: 'fast:evidence complete+consistent',
+        };
+    }
+    if (!mode) {
+        return {
+            route: 'safety',
+            predicateId: 'safety-default',
+            reason: 'safety:missing evidence (mode empty)',
+        };
+    }
+    if (mode === 'unknown') {
+        return {
+            route: 'safety',
+            predicateId: 'safety-default',
+            reason: 'safety:unknown evidence quality',
+        };
+    }
+    if (mode === 'conflict') {
+        return {
+            route: 'safety',
+            predicateId: 'safety-default',
+            reason: 'safety:conflicting evidence',
+        };
+    }
+    return {
+        route: 'safety',
+        predicateId: 'safety-default',
+        reason: `safety:unrecognized evidence (mode=${mode})`,
+    };
+}
+
+/**
+ * Generic evaluateRoute resolving to safety or fast based on input.
+ */
+export function evaluateRoute(input: RouteInput): RouteEvaluation {
+    if (input.costCoverage >= 0.8 && input.proofBinding === 'current' && input.reviewerIndependent) {
+        return {
+            route: 'fast',
+            predicateId: 'fast-complete',
+            reason: 'fast:evidence complete+consistent',
+        };
+    }
+    return {
+        route: 'safety',
+        predicateId: 'safety-default',
+        reason: 'safety:default / unknown / conflicting evidence',
+    };
+}
+
+/**
+ * Input shape for route evaluation. Frozen interface so the follow-up
+ * pilot session extends it without changing call sites.
+ */
+export interface RouteInput {
+    readonly runId: string;
+    readonly definitionDigest: string;
+    readonly evidenceRefs: readonly string[];
+    readonly costCoverage: number;
+    readonly proofBinding: 'current' | 'stale' | 'missing';
+    readonly reviewerIndependent: boolean;
+    readonly runIdConfined: boolean;
+}
+
+/**
+ * Safety floor invariant. Every route — safety or fast — must hold these
+ * conditions. The fast path cannot trade any of them for speed. This
+ * function is the gate the pilot's run-bound evidence writer must
+ * enforce before recording a non-safety route.
+ */
+export function safetyFloorHolds(input: RouteInput): boolean {
+    return input.proofBinding === 'current' && input.reviewerIndependent === true && input.runIdConfined === true;
+}

package/config/rules/strict/runtime-boundaries.yaml

@@ -74,5 +74,5 @@ rules:
             # Synchronous template & workflow resolvers:
             - "apps/cli/src/commands/task.ts" # sync loadTemplateContent/Bodies callbacks
             - "apps/cli/src/workflow/make-lifecycle-adapter.ts" # sync resolveWorkflowPath lookup
-            - "packages/app/src/services/workflow-service.ts" # sync workflow-composition-baseline.json lookup (walk-up) for the validate composition advisory (task 0614); sync read inside the synchronous validate path
+            - "packages/app/src/services/workflow-service.ts" # composition advisory source (0775: facts extracted from the live definition inside the synchronous validate path; the baseline snapshot sync read was retired)
             - "apps/cli/src/release-ops.ts" # sync manifest/workspace reads + Bun.write rewrites inside the git release flow (task 0617); mirrors task.ts sync-template exemption

package/config/rules/structure/protected-files.yaml

@@ -26,6 +26,9 @@ rules:
             - ".test.ts"
             - "/node_modules/"
             - "/dist/"
+            # nested engine scratch dirs under the included app/package trees;
+            # root .spur/ is outside this rule's include scope
+            - "/.spur/"
             - "vendors/"
 
   - id: no-unsafe-git-commands

package/config/task-pipeline-proportional-migration-plan.md

@@ -0,0 +1,79 @@
+# task-pipeline proportional migration plan (task 0759 WIP)
+
+**Status:** WIP — gated on 0758 pilot completion. The route table contract proven
+on wrapup-pipeline and task-lifecycle is reused unchanged. No code change to
+task-pipeline.yaml until the pilot clears the bar.
+
+## Prerequisites (all satisfied at the time of this commit)
+
+- **0751** — proof primitives fail-closed: ✅ done in this branch.
+- **0752** — resume-to-definition binding: ✅ done in this branch.
+- **0753** — workflow-seam repairs (command.gate timeout, run-id validation, nested
+  composition, dry-probe escalation): ✅ done in this branch.
+- **0757** — re-measure gate recorded Option A continues (wrapup-pipeline 40 real
+  terminal runs, task-lifecycle 27, both pilots clear ≥5): ✅ done in this branch.
+- **0758** — route table proven on the two pilots with ≥5 real terminal runs each
+  and ≥80% run-scoped cost row coverage: **WIP** in this branch. The scaffold is in
+  `config/proportional-route-table.ts`; the pilot runs accumulate in a follow-up
+  session.
+
+## Migration contract (frozen; no changes expected from the pilot)
+
+1. **Same closed route table.** `config/proportional-route-table.ts` is the data
+   structure. task-pipeline adopts it unchanged. The fast-path predicates are
+   per-pilot: wrapup-pipeline and task-lifecycle get theirs from the 0758 pilot;
+   task-pipeline gets its predicates after the pilot proves the shape.
+
+2. **Same safety floor.** `safetyFloorHolds()` is the gate. proofBinding
+   `current`, reviewerIndependent `true`, runIdConfined `true` — all three must
+   hold on every route.
+
+3. **Same evidence-writing interface.** The run-bound evidence writer (R4/R5) is
+   implemented once in the 0758 follow-up; task-pipeline uses the same writer.
+   No per-workflow duplication.
+
+4. **Same revertability property (R7).** task-pipeline gets a per-workflow
+   `proportional_routing: enabled|disabled` switch (default: disabled until the
+   migration lands). Rollback is one config change, not an engine change.
+
+## What task-pipeline.yaml changes when the migration lands
+
+A single block at the top of `config/workflows/task-pipeline.yaml`:
+
+```yaml
+proportional_routing:
+  enabled: true
+  route_table: ../proportional-route-table.ts#ROUTE_TABLE
+  safety_floor: ../proportional-route-table.ts#safetyFloorHolds
+  evidence_writer: ../proportional-route-evidence-writer.ts  # lands in 0758 follow-up
+```
+
+No change to states, transitions, actions, or guards in this commit. The
+migration lands only after the 0758 pilot clears and the operator approves
+the change (plan §7 S5 operator consent gate).
+
+## Acceptance criteria mapping (task 0759)
+
+- R1 — closed route table: ✅ frozen in `config/proportional-route-table.ts`; task-pipeline
+  adopts unchanged.
+- R2 — safety floor: ✅ frozen in `safetyFloorHolds()`; task-pipeline enforces the
+  same invariant.
+- R3 — no regression: PENDING — requires real terminal runs after migration
+  with pre/post comparison.
+- R4 — real engine, no fixture: ✅ invariant is a design property; no fixture
+  substitution in this branch.
+- R5 — verified-outcome binding: ✅ already shipped via 0751 R4 (the
+  `proofBinding: current` guard); the migration reuses it.
+- R6 — measured bounds: ✅ none adjusted in this branch; per-bound justification
+  required at migration time.
+- R7 — revertable: ✅ `proportional_routing.enabled: false` is the rollback.
+
+## Open items (all blocked on 0758 pilot)
+
+- Per-pilot fast-path predicate values (R1).
+- Run-bound evidence writer implementation (R4, R5).
+- Pre/post terminal-run comparison (R3).
+- Operator consent for the task-pipeline.yaml change (plan §7 S5).
+
+Status moves from WIP to done when the 0758 pilot clears the bar and the
+follow-up session implements the per-pilot predicates and the evidence writer.

package/config/templates/AGENTS.md

@@ -74,6 +74,11 @@ All product development work goes through the harness by default.
 Use `spur task path <wbs> --json` only when a filesystem consumer needs the absolute path. Both
 commands resolve across configured task folders. Reuse the first `show` response within the run.
 
+**Corpus checks (constitution T10/T11):** checker-policy changes require one explicit unsuppressed
+audit, recording/reconciling essential failures without waivers. Ordinary commit prep checks changed
+task/feature documents and their required linked evidence, not the whole corpus. Do not regenerate
+an acceptance baseline or insert audits into routine batch/wrapup loops.
+
 **Platform fallback:** Platforms without slash commands and/or subagents still use the harness.
 Install the plugin through Superskill for the target platform, then use skills `sp:spur-dev`,
 `sp:spur-cli`, `sp:code-verification` (and related) plus the `spur` CLI. Do not invent a parallel

package/config/templates/docs/99_PROJECT_CONSTITUTION.md

@@ -200,6 +200,8 @@ names the docs that must be touched **in the same commit / same change**:
 | T7 | The doc map or process changes | this file → re-sync `AGENTS.md` (§4.4) → propagate to sibling projects |
 | T8 | A multi-wave batch is planned | schedule "doc sync" as an **explicit work item** — same-commit discipline does not survive on memory alone |
 | T9 | A design or feature item is added/changed | the satellite **first** (`docs/design/<slug>.md` or `docs/features/<id>_<slug>.md`), **then** its index row in `04`/`05` — same change (§4.5 rule 5) |
+| T10 | Corpus checker policy changes | Run one explicit unsuppressed audit plus focused rule tests; record/reconcile exposed essential failures without waivers. |
+| T11 | Ordinary task/feature commit prep | Check changed documents and their required linked evidence, not the whole corpus. Never regenerate an acceptance baseline or add routine audit callers. |
 
 ## 6. Edit principles per file
 

package/config/workflows/basic.yaml

@@ -6,6 +6,8 @@
 # Reliability (aligned with task-pipeline / ADR-043):
 #   - check is a soft probe (status file + always exit 0) so red gates route to fix
 #     via transitions, not a raw lifecycle abort that skips the failed terminal
+#   - qualityGateCmd is TRUSTED CONFIG ONLY — executed via `sh -c` so compound
+#     commands (`&&`, `||`) preserve their exit status; never interpolated task data
 #   - fix is pure slash /sp:dev-fixall against the same qualityGateCmd (single-sourced)
 #   - qualityGateMaxFixAttempts bounds the fix loop; exhausted → failed (fail-closed)
 #   - Bun package scripts only for gate surface (no alternate package-manager CLIs)
@@ -13,7 +15,8 @@
 "$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
 name: basic
 kind: state-machine
-description: The canonical implement-check-fix-until-pass loop
+description: The canonical implement-check-fix-until-pass loop (example definition; override qualityGateCmd per project)
+version: "1"
 iterationBound: 8
 initialState: implement
 terminalStates:
@@ -57,7 +60,7 @@ states:
             mkdir -p .spur/run &&
             STATUS_FILE=".spur/run/$__runId-basic-gate.status" &&
             set +e &&
-            ( $qualityGateCmd ); gate_rc=$?; set -e &&
+            sh -c "$qualityGateCmd"; gate_rc=$?; set -e &&
             if [ "$gate_rc" -eq 0 ]; then
               printf 'PASS\n' > "$STATUS_FILE";
             else