@gobing-ai/spur 0.3.73 → 0.3.74

package/config/workflows/idea-pipeline.yaml

@@ -14,6 +14,13 @@
 #        (idea-eval rejection -> cancelled)
 #        (feature-check failure routes back to ac-generate; batch-create failure to decompose).
 #
+# Evidence instead of ceremony (task 0769): the feature check is MEASURED exactly once at
+# each author/revise boundary — `idea-ac-check` at the end of ac-generate, `idea-design-check`
+# at the end of system-design — by a deterministic `command.gate` writing a run-scoped
+# PASS/FAIL result file. Transition guards only CONSUME the recorded result (run-scoped path,
+# no CLI re-run per guard); a gate re-runs only after a relevant write (revision pass) or on
+# the next boundary.
+#
 # Vars (passed as a JSON object via `--vars`):
 #   idea     — the idea text (required), e.g. --vars '{"idea":"add a --dry-run flag to dev-wrap"}'
 #   profile  — set --vars '{"profile":"auto"}' to skip objective HITL gates (feature-check, batch-create)
@@ -39,6 +46,7 @@
 # Seeded by `spur init`; adapt the agent.run inputs to your project's command set.
 
 "$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
+version: "1"
 kind: state-machine
 name: idea-pipeline
 description: "Idea to feature + AC + task batch: discovery, idea-eval, feature-create, ac-generate, feature-check, system-design, decompose, batch-create, handoff"
@@ -169,11 +177,11 @@ states:
       --from-file`. The agent authors R-numbered Gherkin scenarios tied to the
       design summary into a captured file; the shell step verifies the file is
       non-empty, writes it through the CLI, and writes a completion sentinel
-      (.spur/run/${vars.__runId}-idea-ac-done.txt). AC quality checking lives in the transition
-      guards (`spur feature check`), NOT in this action chain — a failing
-      check must route through the capped retry loop, not fail the run (the engine's
-      default onError policy is `fail`, so an in-action check failure would kill the
-      run before the retry edges are ever evaluated).
+      (.spur/run/${vars.__runId}-idea-ac-done.txt). AC quality is MEASURED once at this
+      boundary by the deterministic `idea-ac-check` command.gate below (task 0769): a failing
+      check records FAIL and routes through the capped retry loop via guards that consume the
+      recorded result — it never fails the run (the engine's default onError policy is `fail`,
+      so an in-action check failure would kill the run before the retry edges are evaluated).
     onEnter:
       - kind: shell
         options:
@@ -192,8 +200,8 @@ states:
       # old `test -s … && …` chain exited 1 on empty content — killing the run under
       # the default `fail` policy before the capped retry edges were ever evaluated,
       # contradicting this state's own contract. Empty now falls through with exit 0
-      # so `spur feature check` in the guards routes it back here (cap: 3). A failing
-      # CLI *write* still exits non-zero and aborts — that one is not retryable.
+      # so the recorded FAIL routes it back here (cap: 3). A failing CLI *write* still
+      # exits non-zero and aborts — that one is not retryable.
       - kind: shell
         options:
           command: >-
@@ -202,20 +210,31 @@ states:
             else
               exit 0;
             fi
+      # 0769: ONE measured check at the AC author/revise boundary. `softFail: true` keeps a
+      # FAIL routable (retry loop / failed) instead of aborting; sibling guards consume the
+      # recorded result from the run-scoped status file and never re-run the CLI.
+      - kind: command.gate
+        options:
+          id: idea-ac-check
+          executable: "${vars.spurBin}"
+          args: ["feature", "check", "${vars.featureId}"]
+          resultFile: .spur/run/${vars.__runId}-idea-ac-check.status
+          softFail: true
+          timeoutMs: 120000
 
   - id: feature-check
     description: >
-      HITL gate: runs spur feature check <id>. Deliberately NOT --strict: before
+      HITL gate over the recorded `idea-ac-check` result (measured at the ac-generate
+      boundary — this gate never re-runs the CLI). Deliberately NOT --strict: before
       decompose/batch-create a feature has scenarios but zero linked tasks, which
       emits L4.orphan-scenarios at severity `warning`; --strict would elevate that
       to a failure, making the success edges unreachable and looping ac-generate
       into `failed`. Malformed AC still blocks via the error-severity L3 BDD
-      checks. Strict coverage belongs at the shippable gate, not here. The check
-      is objective
-      (schema/AC validation) and auto-routable — under profile=auto the transition
-      guards route directly from ac-generate to the appropriate next state, so this
-      state is only entered in interactive mode. On failure, the retry cap routes
-      back to ac-generate (≤3 retries) or escalates to failed.
+      checks. Strict coverage belongs at the shippable gate, not here. The recorded
+      result is objective (schema/AC validation) and auto-routable — under profile=auto
+      the transition guards route directly from ac-generate to the appropriate next
+      state, so this state is only entered in interactive mode. On failure, the retry
+      cap routes back to ac-generate (≤3 retries) or escalates to failed.
     pause: true
     onEnter:
       - kind: hitl.confirm
@@ -232,7 +251,9 @@ states:
       carries operator rejection feedback back into this state: on the first pass the agent
       fills `## Proposed design`; on retry (operator feedback present) it revises the design,
       records the reconciliation, and updates invalidated Acceptance Criteria through
-      `spur feature update` before design can exit. The design-approval state follows (taste gate).
+      `spur feature update` before design can exit. Design quality is then MEASURED once at
+      this boundary by the deterministic `idea-design-check` command.gate (task 0769). The
+      design-approval state follows (taste gate).
     onEnter:
       - kind: shell
         options:
@@ -256,6 +277,17 @@ states:
           command: >-
             REVIEW=".spur/run/$__runId-idea-design-review.md" &&
             awk '/^## Proposed design/{f=1; next} /^## Operator feedback/{f=0} f' "$REVIEW" | grep -q '[^[:space:]]'
+      # 0769: ONE measured check at the design author/revise boundary — after this pass's
+      # design writes (including AC reconciliation). softFail keeps FAIL routable; sibling
+      # guards consume the recorded result and never re-run the CLI.
+      - kind: command.gate
+        options:
+          id: idea-design-check
+          executable: "${vars.spurBin}"
+          args: ["feature", "check", "${vars.featureId}"]
+          resultFile: .spur/run/${vars.__runId}-idea-design-check.status
+          softFail: true
+          timeoutMs: 120000
 
   - id: design-approval
     description: >
@@ -299,7 +331,7 @@ states:
       - kind: agent.run
         options:
           agent: ${vars.planningAgent}
-          input: "Run sp:spec-decomposition for feature ${vars.featureId}. Read the brainstorm artifact, feature AC, and design doc. SIZING FIRST, before any JSON: apply the skill's `Default to NOT decomposing` rubric to the whole unit of work — if it scores 0-2 the correct output is a ONE-entry batch, not many. Scenario count is not task count: merge scenarios that one task delivers (same file surface, same subsystem, or unreadable apart in review), and list every scenario a task covers in its background. Merging never costs AC coverage — one task may carry several scenarios. Do not emit one entry per scenario or per requirement by reflex. Then produce a task-batch JSON array at .spur/run/${vars.__runId}-idea-task-batch.json, validated against task-batch.schema.json. Schema-permitted fields per entry: `name`, `background`, `requirements`, `feature_id`, `parent_wbs`, `priority`, `tags`, `template` — schema validation rejects anything else. Acceptance Criteria, Design, and Plan sections are filled in by the per-task refine step after batch-create, NOT at decompose time. Validate locally against the schema before emitting. Also emit the private task-order sidecar at .spur/run/${vars.__runId}-idea-task-order.json: a JSON array (one entry per batch item) of `{ name: <exact batch item name>, depends_on_names: [<batch item names>] }` declaring ordering/dependencies between the batch items; use `[]` when no ordering exists. Every `name` and every dependency must match exactly one batch item `name` — it is private workflow data, not part of task-batch.schema.json."
+          input: "Run sp:spec-decomposition for feature ${vars.featureId}. Read the brainstorm artifact, feature AC, and design doc. SIZING FIRST, before any JSON: apply the skill's `Default to NOT decomposing` rubric to the whole unit of work — if it scores 0-2 the correct output is a ONE-entry batch, not many. Scenario count is not task count: merge scenarios that one task delivers (same file surface, same subsystem, or unreadable apart in review), and list every scenario a task covers in its background. Merging never costs AC coverage — one task may carry several scenarios. Do not emit one entry per scenario or per requirement by reflex. Then produce a task-batch JSON array at .spur/run/${vars.__runId}-idea-task-batch.json, validated against task-batch.schema.json. Schema-permitted fields per entry: `name`, `background`, `requirements`, `design`, `plan`, `acceptance_criteria`, `feature_id`, `parent_wbs`, `priority`, `tags`, `template` — schema validation rejects anything else. `design`, `plan`, and `acceptance_criteria` are supported batch fields and normal default planning fills them from your analysis; the per-task refine step after batch-create still deepens them when a task needs more detail. Validate locally against the schema before emitting. Also emit the private task-order sidecar at .spur/run/${vars.__runId}-idea-task-order.json: a JSON array (one entry per batch item) of `{ name: <exact batch item name>, depends_on_names: [<batch item names>] }` declaring ordering/dependencies between the batch items; use `[]` when no ordering exists. Every `name` and every dependency must match exactly one batch item `name` — it is private workflow data, not part of task-batch.schema.json."
           # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
           role: planner
           expectFile: .spur/run/${vars.__runId}-idea-task-batch.json
@@ -545,9 +577,10 @@ transitions:
 
   # ── ac-generate: auto-skip (profile=auto) OR enter feature-check HITL gate (interactive) ──
   # Declaration order: auto-skip guards tried FIRST (same pattern as task-pipeline review→verify
-  # and design-gen→handoff). Under profile=auto, the feature check runs as a transition guard and
-  # routes directly to the appropriate next state. Under interactive, the always fallback enters
-  # the feature-check state whose onEnter hitl.confirm pauses for operator confirmation.
+  # and design-gen→handoff). Under profile=auto, the recorded `idea-ac-check` result routes
+  # directly to the appropriate next state — guards never re-run the CLI (task 0769). Under
+  # interactive, the always fallback enters the feature-check state whose onEnter hitl.confirm
+  # pauses for operator confirmation.
   #
   # Auto-skip 1: pass + design route → system-design (design=auto + needs_design != false)
   - from: ac-generate
@@ -556,7 +589,7 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "$profile" = auto && $spurBin feature check "$featureId" && test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" != false'
+        command: 'test "$profile" = auto && test "$(cat .spur/run/$__runId-idea-ac-check.status 2>/dev/null)" = PASS && test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" != false'
   # Auto-skip 2: pass + skip-design route → decompose
   - from: ac-generate
     to: decompose
@@ -564,7 +597,7 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "$profile" = auto && $spurBin feature check "$featureId" && (test "$design" = skip || (test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" = false))'
+        command: 'test "$profile" = auto && test "$(cat .spur/run/$__runId-idea-ac-check.status 2>/dev/null)" = PASS && (test "$design" = skip || (test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" = false))'
   # Auto-skip 3: check failed, retry < 3 → loop back to ac-generate (self-loop)
   - from: ac-generate
     to: ac-generate
@@ -572,7 +605,7 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "$profile" = auto && ! $spurBin feature check "$featureId" && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -lt 3'
+        command: 'test "$profile" = auto && test "$(cat .spur/run/$__runId-idea-ac-check.status 2>/dev/null)" != PASS && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -lt 3'
   # Auto-skip 4: check failed, retry cap reached → escalate to failed
   - from: ac-generate
     to: failed
@@ -580,7 +613,7 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "$profile" = auto && ! $spurBin feature check "$featureId" && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -ge 3'
+        command: 'test "$profile" = auto && test "$(cat .spur/run/$__runId-idea-ac-check.status 2>/dev/null)" != PASS && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -ge 3'
   # Interactive fallback: enter feature-check HITL gate
   - from: ac-generate
     to: feature-check
@@ -596,28 +629,28 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "$__hitlAnswer" = yes && $spurBin feature check "$featureId" && test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" != false'
+        command: 'test "$__hitlAnswer" = yes && test "$(cat .spur/run/$__runId-idea-ac-check.status 2>/dev/null)" = PASS && test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" != false'
   - from: feature-check
     to: decompose
     description: Feature check passed, skip-design route — go directly to decompose.
     guard:
       kind: shell
       options:
-        command: 'test "$__hitlAnswer" = yes && $spurBin feature check "$featureId" && (test "$design" = skip || (test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" = false))'
+        command: 'test "$__hitlAnswer" = yes && test "$(cat .spur/run/$__runId-idea-ac-check.status 2>/dev/null)" = PASS && (test "$design" = skip || (test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" = false))'
   - from: feature-check
     to: ac-generate
     description: "Feature check failed — revise AC (retry cap: 3)."
     guard:
       kind: shell
       options:
-        command: '(test "$__hitlAnswer" = no || ! $spurBin feature check "$featureId") && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -lt 3'
+        command: '(test "$__hitlAnswer" = no || test "$(cat .spur/run/$__runId-idea-ac-check.status 2>/dev/null)" != PASS) && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -lt 3'
   - from: feature-check
     to: failed
     description: Feature check failed after 3 retries — escalate to failed.
     guard:
       kind: shell
       options:
-        command: '(test "$__hitlAnswer" = no || ! $spurBin feature check "$featureId") && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -ge 3'
+        command: '(test "$__hitlAnswer" = no || test "$(cat .spur/run/$__runId-idea-ac-check.status 2>/dev/null)" != PASS) && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -ge 3'
   - from: feature-check
     to: cancelled
     description: Operator cancelled the feature-check gate.
@@ -630,11 +663,11 @@ transitions:
   # Declaration order: auto-skip guard tried FIRST (like task-pipeline's review->verify pattern).
   - from: system-design
     to: decompose
-    description: profile=auto AND design_approved=true AND feature check passes — skip design approval gate.
+    description: profile=auto AND design_approved=true AND recorded design check passes — skip design approval gate.
     guard:
       kind: shell
       options:
-        command: 'test "$profile" = auto && test "$design_approved" = true && $spurBin feature check "$featureId"'
+        command: 'test "$profile" = auto && test "$design_approved" = true && test "$(cat .spur/run/$__runId-idea-design-check.status 2>/dev/null)" = PASS'
   - from: system-design
     to: design-approval
     description: System design done — gate on design approval.
@@ -644,18 +677,18 @@ transitions:
   # ── design-approval -> decompose (after operator approval), AC-failure -> feature-check ──
   - from: design-approval
     to: decompose
-    description: Design approved and feature check passes — proceed to decomposition.
+    description: Design approved and recorded design check passes — proceed to decomposition.
     guard:
       kind: shell
       options:
-        command: 'test "$__hitlAnswer" = yes && $spurBin feature check "$featureId"'
+        command: 'test "$__hitlAnswer" = yes && test "$(cat .spur/run/$__runId-idea-design-check.status 2>/dev/null)" = PASS'
   - from: design-approval
     to: feature-check
-    description: "Design approved but feature check fails — route back through the AC gate (revise AC, retry cap: 3)."
+    description: "Design approved but recorded design check fails — route back through the AC gate (revise AC, retry cap: 3)."
     guard:
       kind: shell
       options:
-        command: 'test "$__hitlAnswer" = yes && ! $spurBin feature check "$featureId"'
+        command: 'test "$__hitlAnswer" = yes && test "$(cat .spur/run/$__runId-idea-design-check.status 2>/dev/null)" != PASS'
   - from: design-approval
     to: system-design
     description: "Design rejected - revise system design (cap: 1 revise)."

package/config/workflows/pr-review.yaml

@@ -31,6 +31,7 @@
 #   __runId          — injected by WorkflowAppService.run(); scopes .spur/run artifacts.
 
 "$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
+version: "1"
 name: pr-review
 kind: state-machine
 description: GitHub Codex PR-review spine — preflight → hygiene → precheck → push → ensure-pr → request → wait → collect
@@ -51,6 +52,10 @@ vars:
   waitIntervalSec: "30"
   preReviewCmd: ""
   __runId: ""
+  # Runtime-set by file.read.into-var (0771): the request record's requestedAt|head,
+  # extracted once by `request` and read per state — no repeated JSON parsing in shell.
+  prSince: ""
+  prHead: ""
 
 states:
   - id: preflight
@@ -155,42 +160,60 @@ states:
             --status-file "$STATUS_FILE" > ".spur/run/$__runId-pr-request.json";
             rc=$?; set -e &&
             if [ ! -f "$STATUS_FILE" ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi &&
+            [ -f ".spur/run/$__runId-pr-request.json" ] &&
+            bun -e 'const fs=require("node:fs");const r=JSON.parse(fs.readFileSync(process.argv[1],"utf8"));fs.writeFileSync(process.argv[2],(r.requestedAt ?? "")+"\n");fs.writeFileSync(process.argv[3],(r.head ?? "")+"\n")' ".spur/run/$__runId-pr-request.json" ".spur/run/$__runId-pr-since.txt" ".spur/run/$__runId-pr-head.txt";
             exit 0
 
   - id: wait
     description: >
       Bounded poll for Codex output on the current pushed HEAD. Timeout records TIMEOUT
       and routes to `pending` — never a failure (collect later with /sp:dev-pr-review collect).
+      Reads the request record once at `request` (0771): requestedAt/head land in
+      run-scoped .txt files, projected into prSince/prHead vars via file.read.into-var.
     onEnter:
+      - kind: file.read.into-var
+        options:
+          path: .spur/run/${vars.__runId}-pr-since.txt
+          var: prSince
+      - kind: file.read.into-var
+        options:
+          path: .spur/run/${vars.__runId}-pr-head.txt
+          var: prHead
       - kind: shell
         options:
           command: >-
             mkdir -p .spur/run &&
             STATUS_FILE=".spur/run/$__runId-pr-wait.status" &&
             set +e &&
-            SINCE="$(bun -e 'const fs=require("node:fs");const value=JSON.parse(fs.readFileSync(process.argv[1],"utf8")).requestedAt;process.stdout.write(value ?? "")' ".spur/run/$__runId-pr-request.json")" &&
-            REQUEST_HEAD="$(bun -e 'const fs=require("node:fs");const value=JSON.parse(fs.readFileSync(process.argv[1],"utf8")).head;process.stdout.write(value ?? "")' ".spur/run/$__runId-pr-request.json")" &&
-            bun "$(superskill script path sp pr-reviewing.ts)" wait --since "$SINCE" --head "$REQUEST_HEAD" --timeout "$waitTimeoutSec" --interval "$waitIntervalSec"
+            bun "$(superskill script path sp pr-reviewing.ts)" wait --since "$prSince" --head "$prHead" --timeout "$waitTimeoutSec" --interval "$waitIntervalSec"
             --json --status-file "$STATUS_FILE" > ".spur/run/$__runId-pr-wait.json";
             rc=$?; set -e &&
             if [ ! -f "$STATUS_FILE" ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi &&
             exit 0
 
   - id: collect
-    description: Normalize the latest current-HEAD Codex result and record composite PR/CI status.
+    description: >-
+      Normalize the latest current-HEAD Codex result and record composite PR/CI status.
+      Request record read via file.read.into-var vars (0771, see wait).
     onEnter:
+      - kind: file.read.into-var
+        options:
+          path: .spur/run/${vars.__runId}-pr-since.txt
+          var: prSince
+      - kind: file.read.into-var
+        options:
+          path: .spur/run/${vars.__runId}-pr-head.txt
+          var: prHead
       - kind: shell
         options:
           command: >-
             mkdir -p .spur/run &&
             STATUS_FILE=".spur/run/$__runId-pr-collect.status" &&
             set +e &&
-            SINCE="$(bun -e 'const fs=require("node:fs");const value=JSON.parse(fs.readFileSync(process.argv[1],"utf8")).requestedAt;process.stdout.write(value ?? "")' ".spur/run/$__runId-pr-request.json")" &&
-            REQUEST_HEAD="$(bun -e 'const fs=require("node:fs");const value=JSON.parse(fs.readFileSync(process.argv[1],"utf8")).head;process.stdout.write(value ?? "")' ".spur/run/$__runId-pr-request.json")" &&
-            bun "$(superskill script path sp pr-reviewing.ts)" collect --since "$SINCE" --head "$REQUEST_HEAD" --json
+            bun "$(superskill script path sp pr-reviewing.ts)" collect --since "$prSince" --head "$prHead" --json
             --status-file "$STATUS_FILE" > ".spur/run/$__runId-pr-findings.json";
             collect_rc=$?;
-            bun "$(superskill script path sp pr-reviewing.ts)" status --since "$SINCE" --head "$REQUEST_HEAD" --json > ".spur/run/$__runId-pr-status.json";
+            bun "$(superskill script path sp pr-reviewing.ts)" status --since "$prSince" --head "$prHead" --json > ".spur/run/$__runId-pr-status.json";
             status_rc=$?; set -e &&
             if [ "$collect_rc" -ne 0 ] || [ "$status_rc" -ne 0 ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi &&
             if [ ! -f "$STATUS_FILE" ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi &&

package/config/workflows/task-lifecycle.yaml

@@ -20,6 +20,7 @@
 "$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
 kind: state-machine
 name: task-lifecycle
+version: "1"
 description: >
   Task lifecycle FSM (design §2.3, §5.1). States are the canonical TaskStatus
   vocabulary (DD-01); transitions encode the §2.3 graph; guards invoke