@gobing-ai/spur 0.3.73 → 0.3.74

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.3.73",
+            "version": "0.3.74",
             "source": "./plugins/sp"
         }
     ]

package/config/config.example.yaml

@@ -130,10 +130,21 @@ agent:
     #   agent: omp
     #   model: minimax/MiniMax-M3
     #   tier: cheap
-    - name: omp
-      agent: omp
-      model: opencode/deepseek-v4-flash
-      tier: standard
+    - name: pi-dsv4-flash-volc
+      agent: pi
+    #   tier: standard
+      executionCapabilities:
+        version: 1
+        axes:
+          fsRead:
+            state: available
+            provenance: native-known
+          fsWrite:
+            state: available
+            provenance: native-known
+          processSpawn:
+            state: available
+            provenance: native-known
     # - name: omp-zai
     #   agent: omp
     #   model: zai/glm-5.2

package/config/pipeline-budgets.json

@@ -1,7 +1,7 @@
 {
     "schemaVersion": 1,
     "generatedAt": "2026-08-20T00:00:00.000Z",
-    "note": "Per-pipeline model-query + wall-clock cost budgets (task 0607 R3). modelQueries anchors the frozen config/workflow-composition-baseline.json list (the SSOT, two-sided checked). wallClockMs is a gross-regression ceiling anchored to measured real-run data (R5): the gate compares the median-of-sane terminal-run wall-clock against it. A null budget is unenforced until measured — never treated as 0. Raising a numeric budget requires a fresh recorded decision in the same commit (config/pipeline-budgets.json vs git HEAD); the check-pipeline-budgets gate fails a silent raise by name.",
+    "note": "Per-pipeline model-query + wall-clock cost budgets (task 0607 R3). modelQueries anchors the live workflow definitions' query lists — the SSOT, extracted by extractResolvedWorkflowFacts and guarded by composition-baseline.test.ts (0775 retired the snapshot this file previously anchored to). wallClockMs is a gross-regression ceiling anchored to measured real-run data (R5): the gate compares the median-of-sane terminal-run wall-clock against it. A null budget is unenforced until measured — never treated as 0. Raising a numeric budget requires a fresh recorded decision in the same commit (config/pipeline-budgets.json vs git HEAD); the check-pipeline-budgets gate fails a silent raise by name.",
     "budgets": {
         "task-pipeline": {
             "modelQueries": 4,
@@ -28,18 +28,18 @@
             "modelQueries": 2,
             "wallClockMs": null,
             "tokenCostUsd": null,
-            "source": "No fixture (0607 option a) and only dry/short runs recorded in history (max 1s, n=4) — wall-clock budget unenforced until a real docs-pipeline run exists. Query budget 2 matches the live SSOT list ['draft','verify'] in config/workflow-composition-baseline.json (added by task 0704; 0607 R3 recorded 1, which is stale against the SSOT). 0754 R6: FIX, not raise — the value was wrong against the SSOT, the workflow's declared query count did not change.",
+            "source": "No fixture (0607 option a) and only dry/short runs recorded in history (max 1s, n=4) — wall-clock budget unenforced until a real docs-pipeline run exists. Query budget 2 matches the live workflow definition's query list ['draft','verify'] (added by task 0704; 0607 R3 recorded 1, which is stale against the definition). 0754 R6: FIX, not raise — the value was wrong against the definition, the workflow's declared query count did not change.",
             "decision": {
                 "date": "2026-09-03",
                 "wbs": "0754",
-                "note": "align docs-pipeline.modelQueries to the live baseline SSOT ['draft','verify']; not a measured-cost raise — the workflow's declared query count was already 2 (added by 0704); the budget was the stale side, not the workflow. Per D8 Decision 11."
+                "note": "align docs-pipeline.modelQueries to the live workflow definition's query list ['draft','verify']; not a measured-cost raise — the workflow's declared query count was already 2 (added by 0704); the budget was the stale side, not the workflow. Per D8 Decision 11."
             }
         },
         "pr-review": {
             "modelQueries": 0,
             "wallClockMs": null,
             "tokenCostUsd": null,
-            "source": "Zero-query pipeline (baseline modelQueries []); query budget trivially 0 — the gate handles an empty list (0607 R3). No real full run recorded; wall-clock unenforced.",
+            "source": "Zero-query pipeline (the live definition declares no model queries); query budget trivially 0 — the gate handles an empty list (0607 R3). No real full run recorded; wall-clock unenforced.",
             "decision": null
         }
     }

package/config/rules/strict/runtime-boundaries.yaml

@@ -74,5 +74,5 @@ rules:
             # Synchronous template & workflow resolvers:
             - "apps/cli/src/commands/task.ts" # sync loadTemplateContent/Bodies callbacks
             - "apps/cli/src/workflow/make-lifecycle-adapter.ts" # sync resolveWorkflowPath lookup
-            - "packages/app/src/services/workflow-service.ts" # sync workflow-composition-baseline.json lookup (walk-up) for the validate composition advisory (task 0614); sync read inside the synchronous validate path
+            - "packages/app/src/services/workflow-service.ts" # composition advisory source (0775: facts extracted from the live definition inside the synchronous validate path; the baseline snapshot sync read was retired)
             - "apps/cli/src/release-ops.ts" # sync manifest/workspace reads + Bun.write rewrites inside the git release flow (task 0617); mirrors task.ts sync-template exemption

package/config/templates/AGENTS.md

@@ -74,6 +74,11 @@ All product development work goes through the harness by default.
 Use `spur task path <wbs> --json` only when a filesystem consumer needs the absolute path. Both
 commands resolve across configured task folders. Reuse the first `show` response within the run.
 
+**Corpus checks (constitution T10/T11):** checker-policy changes require one explicit unsuppressed
+audit, recording/reconciling essential failures without waivers. Ordinary commit prep checks changed
+task/feature documents and their required linked evidence, not the whole corpus. Do not regenerate
+an acceptance baseline or insert audits into routine batch/wrapup loops.
+
 **Platform fallback:** Platforms without slash commands and/or subagents still use the harness.
 Install the plugin through Superskill for the target platform, then use skills `sp:spur-dev`,
 `sp:spur-cli`, `sp:code-verification` (and related) plus the `spur` CLI. Do not invent a parallel

package/config/templates/docs/99_PROJECT_CONSTITUTION.md

@@ -200,6 +200,8 @@ names the docs that must be touched **in the same commit / same change**:
 | T7 | The doc map or process changes | this file → re-sync `AGENTS.md` (§4.4) → propagate to sibling projects |
 | T8 | A multi-wave batch is planned | schedule "doc sync" as an **explicit work item** — same-commit discipline does not survive on memory alone |
 | T9 | A design or feature item is added/changed | the satellite **first** (`docs/design/<slug>.md` or `docs/features/<id>_<slug>.md`), **then** its index row in `04`/`05` — same change (§4.5 rule 5) |
+| T10 | Corpus checker policy changes | Run one explicit unsuppressed audit plus focused rule tests; record/reconcile exposed essential failures without waivers. |
+| T11 | Ordinary task/feature commit prep | Check changed documents and their required linked evidence, not the whole corpus. Never regenerate an acceptance baseline or add routine audit callers. |
 
 ## 6. Edit principles per file
 

package/config/workflows/basic.yaml

@@ -6,6 +6,8 @@
 # Reliability (aligned with task-pipeline / ADR-043):
 #   - check is a soft probe (status file + always exit 0) so red gates route to fix
 #     via transitions, not a raw lifecycle abort that skips the failed terminal
+#   - qualityGateCmd is TRUSTED CONFIG ONLY — executed via `sh -c` so compound
+#     commands (`&&`, `||`) preserve their exit status; never interpolated task data
 #   - fix is pure slash /sp:dev-fixall against the same qualityGateCmd (single-sourced)
 #   - qualityGateMaxFixAttempts bounds the fix loop; exhausted → failed (fail-closed)
 #   - Bun package scripts only for gate surface (no alternate package-manager CLIs)
@@ -13,7 +15,8 @@
 "$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
 name: basic
 kind: state-machine
-description: The canonical implement-check-fix-until-pass loop
+description: The canonical implement-check-fix-until-pass loop (example definition; override qualityGateCmd per project)
+version: "1"
 iterationBound: 8
 initialState: implement
 terminalStates:
@@ -57,7 +60,7 @@ states:
             mkdir -p .spur/run &&
             STATUS_FILE=".spur/run/$__runId-basic-gate.status" &&
             set +e &&
-            ( $qualityGateCmd ); gate_rc=$?; set -e &&
+            sh -c "$qualityGateCmd"; gate_rc=$?; set -e &&
             if [ "$gate_rc" -eq 0 ]; then
               printf 'PASS\n' > "$STATUS_FILE";
             else

package/config/workflows/docs-pipeline.yaml

@@ -11,12 +11,15 @@
 #   - requireDiff fails silent no-op drafts
 #   - HITL answer routing is exhaustive (yes/no/cancel)
 #   - verify measures the deliverable read-only (answer file + `spur task verdict` + proof
-#     digest bracket) — record → done is fail-closed on measured PASS, never on a stub
+#     digest bracket); recording happens only AFTER measured PASS (0769 ordering:
+#     precheck → draft → docs-review → verify → record → done) and `record → done` is
+#     fail-closed on the captured record result + re-asserted verdict — never on a stub
 
 "$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
+version: "1"
 kind: state-machine
 name: docs-pipeline
-description: "Docs-only execution pipeline (precheck -> draft -> docs-review -> record -> verify -> done)"
+description: "Docs-only execution pipeline (precheck -> draft -> docs-review -> verify -> record -> done)"
 iterationBound: 12
 initialState: precheck
 terminalStates:
@@ -34,13 +37,15 @@ vars:
   stepTimeoutMs: "1800000"
   # Proof-state bracket (task 0704, mirroring task-pipeline 0612/0703). `proofDigest` is the
   # canonical capture at verify entry; `proofDigestNow` is the live re-capture compared against
-  # it by the `verify → done` guard so verifier-time mutation fails closed (R4/R5).
+  # it by the `verify → record` guard so verifier-time mutation fails closed (R4/R5).
   proofDigest: ""
   proofDigestNow: ""
   # `taskSpecPath` carries the task file path because `docs/tasks*` is excluded from the digest's
   # git-tree half (task 0704 R4); resolved per-run by the verify state's taskpath shell step.
   taskSpecPath: ""
   __hitlAnswer: ""
+  # R8 (0366): injected by WorkflowAppService.run(); run-scopes every temporary capture.
+  __runId: ""
 
 states:
   - id: precheck
@@ -49,14 +54,16 @@ states:
       (D5-J, ADR-069). Both gates run `softFail: true`, so a red probe records FAIL and lets
       the transitions route to `failed` instead of aborting the run — the shipped action
       schema exposes no `onError`, so soft mode is what preserves that routing.
-      The canonical `.spur/run/$wbs-docs-precheck.status` is the AND of the two gate files.
+      The canonical `.spur/run/$__runId-docs-precheck.status` is the AND of the two gate files.
+      (0769: temporary captures are run-scoped — `.spur/run/<runId>-docs-*` — so concurrent
+      runs on one task never share or clobber a capture.)
     onEnter:
       - kind: command.gate
         options:
           id: docs-precheck-task
           executable: "${vars.spurBin}"
           args: ["task", "check", "${vars.wbs}"]
-          resultFile: .spur/run/${vars.wbs}-docs-precheck-task.status
+          resultFile: .spur/run/${vars.__runId}-docs-precheck-task.status
           softFail: true
           timeoutMs: 120000
       - kind: command.gate
@@ -64,16 +71,16 @@ states:
           id: docs-precheck-agent
           executable: "${vars.spurBin}"
           args: ["agent", "doctor", "${vars.agent}"]
-          resultFile: .spur/run/${vars.wbs}-docs-precheck-agent.status
+          resultFile: .spur/run/${vars.__runId}-docs-precheck-agent.status
           softFail: true
           timeoutMs: 120000
       - kind: shell
         options:
           command: >-
-            if test "$(cat .spur/run/$wbs-docs-precheck-task.status 2>/dev/null)" = PASS &&
-               test "$(cat .spur/run/$wbs-docs-precheck-agent.status 2>/dev/null)" = PASS;
-            then printf 'PASS\n' > ".spur/run/$wbs-docs-precheck.status";
-            else printf 'FAIL\n' > ".spur/run/$wbs-docs-precheck.status"; fi
+            if test "$(cat .spur/run/$__runId-docs-precheck-task.status 2>/dev/null)" = PASS &&
+               test "$(cat .spur/run/$__runId-docs-precheck-agent.status 2>/dev/null)" = PASS;
+            then printf 'PASS\n' > ".spur/run/$__runId-docs-precheck.status";
+            else printf 'FAIL\n' > ".spur/run/$__runId-docs-precheck.status"; fi
       - kind: note
         options:
           message: "Docs pipeline start for task ${vars.wbs}."
@@ -108,36 +115,21 @@ states:
         options:
           prompt: "Approve docs-only deliverable for task ${vars.wbs}?"
 
-  - id: record
-    description: >
-      Record the docs-only outcome into the task file. The task record verb backfills
-      Solution from the diff and moves the task to testing; the done gate still runs
-      the normal task matrix check before completion.
-    onEnter:
-      - kind: shell
-        options:
-          command: "$spurBin task record $wbs --solution-from-diff --transition testing"
-
-  - id: done
-    description: Terminal — docs deliverable measured, reviewed, and recorded.
-    onEnter:
-      # R1 (0704): no synthetic verdict writer. The verdict artifact is produced by measured
-      # verification in `verify` and registered there; done only performs the guarded
-      # transition. Override path remains: --force-done --reason.
-      - kind: shell
-        options:
-          command: "$spurBin task update $wbs done --no-lifecycle"
-      - kind: note
-        options:
-          message: "Docs pipeline complete for task ${vars.wbs}."
   - id: verify
     description: >
       Read-only measured verification (task 0704, R2/R4/R7): dispatch /sp:dev-verify --fix none
       with an answer file, derive the ONE standard verdict via `spur task verdict`, register the
       standard verify-verdict artifact, and bracket the verifier with proof-input digest capture/compare so any
       task-spec or document mutation during certification fails closed (R4). No docs assurance
-      subclass — PASS semantics are identical to task-pipeline (R7).
+      subclass — PASS semantics are identical to task-pipeline (R7). 0769: verification now
+      PRECEDES recording; the `verify → record` guard compares the proof bracket, and the
+      verdict artifact keeps its `.spur/run/<wbs>-verdict.json` compatibility path with
+      runId + definitionDigest stamped through the existing proof/run-artifact contract.
     onEnter:
+      # 0769: clear any stale current-run answer before the fresh-session verifier writes it.
+      - kind: shell
+        options:
+          command: "mkdir -p .spur/run && rm -f .spur/run/$__runId-docs-verify-answer.txt"
       # R4 (0703 R6 precedent): resolve the task-spec path BEFORE capture. `docs/tasks*` is
       # excluded from the digest's git-tree half, so the spec is folded in via `taskFile`.
       - kind: shell
@@ -147,15 +139,15 @@ states:
           # wbs exits non-zero with a named message. The resolved path folds
           # into the proof digest via `taskFile:` below; a silent miss would
           # degrade the docs-pipeline proof to tree-only (same hazard 0751 R2
-          # removed from task-pipeline).
+          # removed from task-pipeline). (0769: run-scoped capture path.)
           command: >-
             set -e;
             task_path="$($spurBin task path $wbs --json | jq -r '.path // .filePath // empty')";
             if [ -z "$task_path" ]; then echo "docs-pipeline: task path did not resolve for wbs $wbs" >&2; exit 1; fi;
-            printf '%s' "$task_path" > ".spur/run/$wbs-docs-taskpath.txt"
+            printf '%s' "$task_path" > ".spur/run/$__runId-docs-taskpath.txt"
       - kind: file.read.into-var
         options:
-          path: .spur/run/${vars.wbs}-docs-taskpath.txt
+          path: .spur/run/${vars.__runId}-docs-taskpath.txt
           var: taskSpecPath
       # R4: canonical capture BEFORE the verifier runs. Same fingerprint input as the
       # re-capture below so the bracket compares like for like.
@@ -174,19 +166,19 @@ states:
           input: /sp:dev-verify ${vars.wbs} --auto --fix none --focus all
           role: reviewer
           timeoutMs: ${vars.stepTimeoutMs}
-          answerFile: .spur/run/${vars.wbs}-verify-answer.txt
+          answerFile: .spur/run/${vars.__runId}-docs-verify-answer.txt
       - kind: shell
         options:
-          command: "$spurBin task verdict $wbs --from-answer .spur/run/$wbs-verify-answer.txt"
-      # R7: stamp the proof block into the standard verdict artifact, then register it.
-      # Soft action + hard guard: a missing/malformed stamp fails the `verify -> done`
+          command: "$spurBin task verdict $wbs --from-answer .spur/run/$__runId-docs-verify-answer.txt"
+      # R7: stamp the proof block + run identity into the standard verdict artifact, then register
+      # it. Soft action + hard guard: a missing/malformed stamp fails the `verify -> record`
       # guard below, not this step.
       - kind: shell
         options:
           command: >-
             V=".spur/run/$wbs-verdict.json";
             if [ -f "$V" ] && [ -n "$proofDigest" ]; then
-              jq --arg d "$proofDigest" '. + {proof: {digest: $d, capturePoint: "docs-verify-entry"}}' "$V" > "$V.tmp" && mv "$V.tmp" "$V";
+              jq --arg d "$proofDigest" --arg r "$__runId" '. + {proof: {digest: $d, capturePoint: "docs-verify-entry", runId: $r}}' "$V" > "$V.tmp" && mv "$V.tmp" "$V";
             fi;
             exit 0
       - kind: run.artifact
@@ -202,6 +194,37 @@ states:
           input: /sp:dev-verify ${vars.wbs} --auto --fix none --focus all
           timeoutMs: ${vars.stepTimeoutMs}
 
+  - id: record
+    description: >
+      Record the docs-only outcome AFTER measured verification (task 0769 ordering:
+      draft/approval → verify → record → done — the pre-verification record could write
+      UNKNOWN/old Testing evidence). The verdict is already derived and proof-bracketed in
+      `verify`; `verify → record` only opens on measured PASS with an intact bracket. The
+      task record verb backfills Solution from the diff and moves the task to testing; its
+      result is captured to a run-scoped status file so a record denial reaches `failed`
+      (record → failed) and is never converted to success by an exit 0.
+    onEnter:
+      - kind: shell
+        options:
+          command: >-
+            if $spurBin task record $wbs --solution-from-diff --transition testing; then
+              printf 'PASS\n' > ".spur/run/$__runId-docs-record.status";
+            else
+              printf 'FAIL\n' > ".spur/run/$__runId-docs-record.status";
+            fi
+
+  - id: done
+    description: Terminal — docs deliverable measured, reviewed, and recorded.
+    onEnter:
+      # R1 (0704): no synthetic verdict writer. The verdict artifact is produced by measured
+      # verification in `verify` and registered there; done only performs the guarded
+      # transition. Override path remains: --force-done --reason.
+      - kind: shell
+        options:
+          command: "$spurBin task update $wbs done --no-lifecycle"
+      - kind: note
+        options:
+          message: "Docs pipeline complete for task ${vars.wbs}."
   - id: failed
     description: Terminal — docs pipeline failed or was rejected.
 
@@ -223,8 +246,8 @@ transitions:
       kind: always
 
   - from: draft
-    to: record
-    description: profile=auto — skip the docs-review HITL gate.
+    to: verify
+    description: "profile=auto — skip the docs-review HITL gate; verify measures BEFORE record (0769: a pre-verification record could write UNKNOWN/old Testing evidence)."
     guard:
       kind: shell
       options:
@@ -236,8 +259,8 @@ transitions:
       kind: always
 
   - from: docs-review
-    to: record
-    description: Docs approved — record results.
+    to: verify
+    description: "Docs approved — measure the deliverable (0769: verification precedes recording)."
     guard:
       kind: shell
       options:
@@ -257,16 +280,11 @@ transitions:
       options:
         command: 'test "$__hitlAnswer" = cancel'
 
-  - from: record
-    to: verify
-    description: Recorded — measure the deliverable (R2). Structural task-check gates remain
-      at precheck, record (wip→testing), and done (verdict-artifact guard, R3).
-    guard:
-      kind: always
-
   - from: verify
-    to: done
-    description: Measured PASS with the proof bracket intact (R4/R5).
+    to: record
+    description: Measured PASS with the proof bracket intact (R4/R5) — record only verified
+      outcomes (0769). Structural task-check gates remain at precheck, record (wip→testing),
+      and done (verdict-artifact guard, R3).
     guard:
       kind: shell
       options:
@@ -284,6 +302,25 @@ transitions:
   - from: verify
     to: failed
     description: Non-PASS verdict, missing/malformed answer, or digest mismatch (R5) — the run
-      reaches failed and no PASS artifact is certified.
+      reaches failed and nothing is recorded.
+    guard:
+      kind: always
+
+  - from: record
+    to: done
+    description: Recorded from a verified outcome; the persisted verdict/bracket is re-asserted
+      so a failed `task record` (captured FAIL) never converts to done (0769).
+    guard:
+      kind: shell
+      options:
+        command: >-
+          test "$(cat .spur/run/$__runId-docs-record.status 2>/dev/null)" = PASS &&
+          test -f ".spur/run/$wbs-verdict.json" &&
+          test "$(jq -r '.verdict // empty' .spur/run/$wbs-verdict.json 2>/dev/null)" = PASS &&
+          test -n "$proofDigest" &&
+          test "$(jq -r '.proof.digest // empty' .spur/run/$wbs-verdict.json 2>/dev/null)" = "$proofDigest"
+  - from: record
+    to: failed
+    description: "Task record denied or errored (captured status not PASS) — the record denial reaches failed; the done guard above never converts it to success."
     guard:
       kind: always

package/config/workflows/feature-dev.yaml

@@ -9,6 +9,7 @@
 "$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
 kind: state-machine
 name: feature-dev
+version: "1"
 description: >
   End-to-end FEATURE development loop: precheck → brainstorm → plan (decompose) →
   execute-tasks → feature-verify → done. Drives a whole feature (one description → a
@@ -143,18 +144,22 @@ states:
 
   - id: integration-review
     description: >
-      Advisory integration review (D5-P, feature R11). Spends one Codex review
-      on the current HEAD after the local gates and before wrap merge/cleanup.
+      Advisory integration review (D5-P, feature R11), upgraded by 0770 to a
+      truthful collect: ONE Codex review request per HEAD, then exactly ONE
+      `pr-reviewing.ts collect --head <captured-head>` against that same HEAD —
+      no wait loop, no polling. The request verdict (`REQUESTED` /
+      `ALREADY_REQUESTED` / `ALREADY_REVIEWED`) describes request state only;
+      it is NEVER clean evidence. The ONLY clean evidence is the collected
+      status (CLEAN / FINDINGS / PENDING) persisted run-scoped at
+      .spur/run/<runId>-integration-review-collect.status. A missing head SHA,
+      an invalid collect result, or head drift records collect FAIL.
 
-      D8 decision D1 (0753 R3): the nested `spur workflow run pr-review.yaml`
-      was refused by the SPUR_WORKFLOW_RUN_ACTIVE child guard and the refusal
-      was masked by `softFail: true`. The non-spawning replacement invokes
-      `pr-reviewing.ts request` directly — the same per-HEAD dedupe-or-request
-      logic `config/workflows/pr-review.yaml` uses internally — and writes its
-      own PASS/FAIL status. `ALREADY_REVIEWED` / `ALREADY_REQUESTED` / `REQUESTED`
-      all count as PASS (review is initiated for this HEAD); only a request
-      error counts as FAIL. `softFail` is gone: a real failure now records FAIL
-      loudly. `requireCleanReview=true` still turns that FAIL into a blocking edge.
+      D8 decision D1 (0753 R3): invoking `pr-reviewing.ts request` directly —
+      the same per-HEAD dedupe-or-request logic `config/workflows/pr-review.yaml`
+      uses internally. Request FAIL records FAIL in
+      .spur/run/<runId>-integration-review.status, loudly (no softFail).
+      `requireCleanReview=true` turns a non-clean COLLECTED verdict (including
+      collect FAIL) into the blocking edge declared first below.
     onEnter:
       - kind: shell
         options:
@@ -162,20 +167,33 @@ states:
             mkdir -p .spur/run &&
             STATUS_FILE=".spur/run/$__runId-integration-review.status" &&
             REQUEST_JSON=".spur/run/$__runId-integration-review.json" &&
+            COLLECT_JSON=".spur/run/$__runId-integration-review-collect.json" &&
+            COLLECT_STATUS=".spur/run/$__runId-integration-review-collect.status" &&
             PR_REQUEST_STATUS=".spur/run/$__runId-integration-review-pr-request.status" &&
             set +e &&
             bun "$(superskill script path sp pr-reviewing.ts)" request --base "$baseBranch" --json
             --status-file "$PR_REQUEST_STATUS" > "$REQUEST_JSON" 2>&1;
-            rc=$?; set -e &&
-            if [ "$rc" -eq 0 ]; then
+            request_rc=$?; set -e &&
+            if [ "$request_rc" -eq 0 ]; then
               printf 'PASS\n' > "$STATUS_FILE";
             else
               printf 'FAIL\n' > "$STATUS_FILE";
             fi &&
+            HEAD_SHA=$(jq -r '.head // empty' "$REQUEST_JSON" 2>/dev/null || true) &&
+            if [ -z "$HEAD_SHA" ]; then
+              echo "integration-review: request result carried no head SHA — collect not run, recorded FAIL" >&2;
+              printf 'FAIL\n' > "$COLLECT_STATUS";
+            else
+              set +e &&
+              bun "$(superskill script path sp pr-reviewing.ts)" collect --head "$HEAD_SHA" --json
+              --status-file "$COLLECT_STATUS" > "$COLLECT_JSON" 2>&1;
+              collect_rc=$?; set -e &&
+              echo "integration-review: collect rc=$collect_rc status=$(cat "$COLLECT_STATUS" 2>/dev/null || echo missing) — verdict captured to $COLLECT_JSON" >&2;
+            fi;
             exit 0
       - kind: note
         options:
-          message: "Integration review for feature ${vars.featureId} recorded at .spur/run/${vars.__runId}-integration-review.status (advisory unless requireCleanReview=true)."
+          message: "Integration review for feature ${vars.featureId}: request verdict at .spur/run/${vars.__runId}-integration-review.status (request state only — REQUESTED/ALREADY_* are NEVER clean evidence); collected verdict at .spur/run/${vars.__runId}-integration-review-collect.status (CLEAN/FINDINGS/PENDING — the only clean evidence). Advisory unless requireCleanReview=true."
 
   - id: done
     description: Terminal — feature planned, all tasks executed, and the feature verified.
@@ -246,18 +264,23 @@ transitions:
   - from: integration-review
     to: failed
     description: >
-      Review came back FAIL and this branch opted into a hard gate
-      (requireCleanReview=true). Ordered before the advisory edge so the strict
-      policy wins when both would match.
+      Collected verdict is not CLEAN (FINDINGS / PENDING / collect FAIL or
+      missing) and this branch opted into a hard gate (requireCleanReview=true).
+      Exactly one collect ran against the captured request HEAD — no wait loop —
+      so pending or findings stop the feature here with the actual reason.
+      Ordered before the advisory edge so the strict policy wins when both
+      would match.
     guard:
       kind: shell
       options:
-        command: 'test "$requireCleanReview" = true && test "$(cat .spur/run/$__runId-integration-review.status 2>/dev/null)" = FAIL'
+        command: 'test "$requireCleanReview" = true && test "$(cat .spur/run/$__runId-integration-review-collect.status 2>/dev/null)" != CLEAN'
   - from: integration-review
     to: done
     description: >
-      Review clean, pending, unavailable, or advisory — the feature is complete. A
-      non-clean advisory review never blocks a locally-verified feature (feature R11).
+      Collected CLEAN, or advisory mode (requireCleanReview != true) — the
+      feature is complete. A non-clean advisory collect never blocks a
+      locally-verified feature (feature R11); the note above preserves the
+      collected non-clean state in the run record instead of hiding it.
     guard:
       kind: always
   - from: feature-verify

package/config/workflows/feature-lifecycle.yaml

@@ -9,6 +9,7 @@
 "$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
 kind: state-machine
 name: feature-lifecycle
+version: "1"
 description: >
   Feature lifecycle FSM (design §2.3, §5.1, DD-13). States are the canonical
   FeatureStatus vocabulary; transitions encode the §2.3 graph including the

package/config/workflows/history-anatomy.yaml

@@ -48,6 +48,7 @@
 "$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
 kind: state-machine
 name: history-anatomy
+version: "1"
 description: "Daily/ad-hoc history-anatomy report: cache branch, deterministic analyze/render, skill enrichment, deterministic structure gate, independent evidence validation, bounded correction, atomic publication"
 iterationBound: 20
 initialState: start
@@ -153,7 +154,7 @@ states:
             --baseline .spur/run/$__runId-history-anatomy-baseline.json --target "$HA_TARGET"
             --mode "$mode" --date "$HA_DATE" --recompute "$recompute" --executor "$agent"
             --skill-dir "$HA_SKILL" --contract "$HA_SKILL/references/report-contract.md"
-            --workflow "$workflowFile" --contract-version "$contractVersion" --run-id "$__runId"
+            --workflow "$workflowFile" --helper "$HA_HELPER" --contract-version "$contractVersion" --run-id "$__runId"
             --out .spur/run/$__runId-provenance.json
             > .spur/run/$__runId-cache-disposition.txt
 
@@ -208,6 +209,9 @@ states:
     description: >
       Independent evidence validation via the skill operation sp:history-anatomy validate.
       Publication is reachable only from a PASS here. Same undeclared-write assertion as enrich (0676 R3).
+      The publish guard reads the ANCHORED FINAL LINE (0771): only a validation artifact whose last
+      line is exactly `Verdict: PASS` publishes — a leading PASS under a later FAIL or a
+      `not Verdict: PASS` line can never satisfy it.
     onEnter:
       - kind: shell
         options:
@@ -390,18 +394,18 @@ transitions:
 
   - from: validate
     to: stamp
-    description: Independent validation PASS — stamp provenance, then publish atomically.
+    description: Independent validation PASS (anchored final line, 0771) — stamp provenance, then publish atomically.
     guard:
       kind: shell
       options:
-        command: 'grep -q "Verdict: PASS" .spur/run/$__runId-validation.txt 2>/dev/null'
+        command: 'tail -n 1 .spur/run/$__runId-validation.txt 2>/dev/null | grep -qx "Verdict: PASS"'
   - from: validate
     to: correct
     description: Validation FAIL under the shared two-pass correction cap.
     guard:
       kind: shell
       options:
-        command: '! grep -q "Verdict: PASS" .spur/run/$__runId-validation.txt 2>/dev/null && test "$(cat .spur/run/$__runId-correction-count 2>/dev/null || echo 0)" -lt 2'
+        command: '! tail -n 1 .spur/run/$__runId-validation.txt 2>/dev/null | grep -qx "Verdict: PASS" && test "$(cat .spur/run/$__runId-correction-count 2>/dev/null || echo 0)" -lt 2'
   - from: validate
     to: failed
     description: Validation FAIL with the correction cap exhausted — terminate without publishing.