@gobing-ai/spur 0.3.73 → 0.3.75

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.3.73",
+            "version": "0.3.75",
             "source": "./plugins/sp"
         }
     ]

package/config/config.example.yaml

@@ -130,10 +130,21 @@ agent:
     #   agent: omp
     #   model: minimax/MiniMax-M3
     #   tier: cheap
-    - name: omp
-      agent: omp
-      model: opencode/deepseek-v4-flash
-      tier: standard
+    - name: pi-dsv4-flash-volc
+      agent: pi
+    #   tier: standard
+      executionCapabilities:
+        version: 1
+        axes:
+          fsRead:
+            state: available
+            provenance: native-known
+          fsWrite:
+            state: available
+            provenance: native-known
+          processSpawn:
+            state: available
+            provenance: native-known
     # - name: omp-zai
     #   agent: omp
     #   model: zai/glm-5.2

package/config/pipeline-budgets.json

@@ -1,7 +1,7 @@
 {
     "schemaVersion": 1,
     "generatedAt": "2026-08-20T00:00:00.000Z",
-    "note": "Per-pipeline model-query + wall-clock cost budgets (task 0607 R3). modelQueries anchors the frozen config/workflow-composition-baseline.json list (the SSOT, two-sided checked). wallClockMs is a gross-regression ceiling anchored to measured real-run data (R5): the gate compares the median-of-sane terminal-run wall-clock against it. A null budget is unenforced until measured — never treated as 0. Raising a numeric budget requires a fresh recorded decision in the same commit (config/pipeline-budgets.json vs git HEAD); the check-pipeline-budgets gate fails a silent raise by name.",
+    "note": "Per-pipeline model-query + wall-clock cost budgets (task 0607 R3). modelQueries anchors the live workflow definitions' query lists — the SSOT, extracted by extractResolvedWorkflowFacts and guarded by composition-baseline.test.ts (0775 retired the snapshot this file previously anchored to). wallClockMs is a gross-regression ceiling anchored to measured real-run data (R5): the gate compares the median-of-sane terminal-run wall-clock against it. A null budget is unenforced until measured — never treated as 0. Raising a numeric budget requires a fresh recorded decision in the same commit (config/pipeline-budgets.json vs git HEAD); the check-pipeline-budgets gate fails a silent raise by name.",
     "budgets": {
         "task-pipeline": {
             "modelQueries": 4,
@@ -28,18 +28,18 @@
             "modelQueries": 2,
             "wallClockMs": null,
             "tokenCostUsd": null,
-            "source": "No fixture (0607 option a) and only dry/short runs recorded in history (max 1s, n=4) — wall-clock budget unenforced until a real docs-pipeline run exists. Query budget 2 matches the live SSOT list ['draft','verify'] in config/workflow-composition-baseline.json (added by task 0704; 0607 R3 recorded 1, which is stale against the SSOT). 0754 R6: FIX, not raise — the value was wrong against the SSOT, the workflow's declared query count did not change.",
+            "source": "No fixture (0607 option a) and only dry/short runs recorded in history (max 1s, n=4) — wall-clock budget unenforced until a real docs-pipeline run exists. Query budget 2 matches the live workflow definition's query list ['draft','verify'] (added by task 0704; 0607 R3 recorded 1, which is stale against the definition). 0754 R6: FIX, not raise — the value was wrong against the definition, the workflow's declared query count did not change.",
             "decision": {
                 "date": "2026-09-03",
                 "wbs": "0754",
-                "note": "align docs-pipeline.modelQueries to the live baseline SSOT ['draft','verify']; not a measured-cost raise — the workflow's declared query count was already 2 (added by 0704); the budget was the stale side, not the workflow. Per D8 Decision 11."
+                "note": "align docs-pipeline.modelQueries to the live workflow definition's query list ['draft','verify']; not a measured-cost raise — the workflow's declared query count was already 2 (added by 0704); the budget was the stale side, not the workflow. Per D8 Decision 11."
             }
         },
         "pr-review": {
             "modelQueries": 0,
             "wallClockMs": null,
             "tokenCostUsd": null,
-            "source": "Zero-query pipeline (baseline modelQueries []); query budget trivially 0 — the gate handles an empty list (0607 R3). No real full run recorded; wall-clock unenforced.",
+            "source": "Zero-query pipeline (the live definition declares no model queries); query budget trivially 0 — the gate handles an empty list (0607 R3). No real full run recorded; wall-clock unenforced.",
             "decision": null
         }
     }

package/config/rules/strict/runtime-boundaries.yaml

@@ -74,5 +74,5 @@ rules:
             # Synchronous template & workflow resolvers:
             - "apps/cli/src/commands/task.ts" # sync loadTemplateContent/Bodies callbacks
             - "apps/cli/src/workflow/make-lifecycle-adapter.ts" # sync resolveWorkflowPath lookup
-            - "packages/app/src/services/workflow-service.ts" # sync workflow-composition-baseline.json lookup (walk-up) for the validate composition advisory (task 0614); sync read inside the synchronous validate path
+            - "packages/app/src/services/workflow-service.ts" # composition advisory source (0775: facts extracted from the live definition inside the synchronous validate path; the baseline snapshot sync read was retired)
             - "apps/cli/src/release-ops.ts" # sync manifest/workspace reads + Bun.write rewrites inside the git release flow (task 0617); mirrors task.ts sync-template exemption

package/config/templates/AGENTS.md

@@ -74,6 +74,11 @@ All product development work goes through the harness by default.
 Use `spur task path <wbs> --json` only when a filesystem consumer needs the absolute path. Both
 commands resolve across configured task folders. Reuse the first `show` response within the run.
 
+**Corpus checks (constitution T10/T11):** checker-policy changes require one explicit unsuppressed
+audit, recording/reconciling essential failures without waivers. Ordinary commit prep checks changed
+task/feature documents and their required linked evidence, not the whole corpus. Do not regenerate
+an acceptance baseline or insert audits into routine batch/wrapup loops.
+
 **Platform fallback:** Platforms without slash commands and/or subagents still use the harness.
 Install the plugin through Superskill for the target platform, then use skills `sp:spur-dev`,
 `sp:spur-cli`, `sp:code-verification` (and related) plus the `spur` CLI. Do not invent a parallel

package/config/templates/docs/99_PROJECT_CONSTITUTION.md

@@ -200,6 +200,8 @@ names the docs that must be touched **in the same commit / same change**:
 | T7 | The doc map or process changes | this file → re-sync `AGENTS.md` (§4.4) → propagate to sibling projects |
 | T8 | A multi-wave batch is planned | schedule "doc sync" as an **explicit work item** — same-commit discipline does not survive on memory alone |
 | T9 | A design or feature item is added/changed | the satellite **first** (`docs/design/<slug>.md` or `docs/features/<id>_<slug>.md`), **then** its index row in `04`/`05` — same change (§4.5 rule 5) |
+| T10 | Corpus checker policy changes | Run one explicit unsuppressed audit plus focused rule tests; record/reconcile exposed essential failures without waivers. |
+| T11 | Ordinary task/feature commit prep | Check changed documents and their required linked evidence, not the whole corpus. Never regenerate an acceptance baseline or add routine audit callers. |
 
 ## 6. Edit principles per file
 

package/config/workflows/basic.yaml

@@ -6,6 +6,8 @@
 # Reliability (aligned with task-pipeline / ADR-043):
 #   - check is a soft probe (status file + always exit 0) so red gates route to fix
 #     via transitions, not a raw lifecycle abort that skips the failed terminal
+#   - qualityGateCmd is TRUSTED CONFIG ONLY — executed via `sh -c` so compound
+#     commands (`&&`, `||`) preserve their exit status; never interpolated task data
 #   - fix is pure slash /sp:dev-fixall against the same qualityGateCmd (single-sourced)
 #   - qualityGateMaxFixAttempts bounds the fix loop; exhausted → failed (fail-closed)
 #   - Bun package scripts only for gate surface (no alternate package-manager CLIs)
@@ -13,7 +15,8 @@
 "$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
 name: basic
 kind: state-machine
-description: The canonical implement-check-fix-until-pass loop
+description: The canonical implement-check-fix-until-pass loop (example definition; override qualityGateCmd per project)
+version: "1"
 iterationBound: 8
 initialState: implement
 terminalStates:
@@ -57,7 +60,7 @@ states:
             mkdir -p .spur/run &&
             STATUS_FILE=".spur/run/$__runId-basic-gate.status" &&
             set +e &&
-            ( $qualityGateCmd ); gate_rc=$?; set -e &&
+            sh -c "$qualityGateCmd"; gate_rc=$?; set -e &&
             if [ "$gate_rc" -eq 0 ]; then
               printf 'PASS\n' > "$STATUS_FILE";
             else

package/config/workflows/docs-pipeline.yaml

@@ -11,12 +11,15 @@
 #   - requireDiff fails silent no-op drafts
 #   - HITL answer routing is exhaustive (yes/no/cancel)
 #   - verify measures the deliverable read-only (answer file + `spur task verdict` + proof
-#     digest bracket) — record → done is fail-closed on measured PASS, never on a stub
+#     digest bracket); recording happens only AFTER measured PASS (0769 ordering:
+#     precheck → draft → docs-review → verify → record → done) and `record → done` is
+#     fail-closed on the captured record result + re-asserted verdict — never on a stub
 
 "$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
+version: "2"
 kind: state-machine
 name: docs-pipeline
-description: "Docs-only execution pipeline (precheck -> draft -> docs-review -> record -> verify -> done)"
+description: "Docs-only execution pipeline (precheck -> draft -> docs-review -> verify -> record -> done)"
 iterationBound: 12
 initialState: precheck
 terminalStates:
@@ -34,13 +37,19 @@ vars:
   stepTimeoutMs: "1800000"
   # Proof-state bracket (task 0704, mirroring task-pipeline 0612/0703). `proofDigest` is the
   # canonical capture at verify entry; `proofDigestNow` is the live re-capture compared against
-  # it by the `verify → done` guard so verifier-time mutation fails closed (R4/R5).
+  # it by the `verify → record` guard so verifier-time mutation fails closed (R4/R5).
   proofDigest: ""
   proofDigestNow: ""
   # `taskSpecPath` carries the task file path because `docs/tasks*` is excluded from the digest's
   # git-tree half (task 0704 R4); resolved per-run by the verify state's taskpath shell step.
   taskSpecPath: ""
+  # 0785 R2: linked feature spec path, resolved at verify entry. Empty (orphan task) means the
+  # feature spec is legitimately omitted from the digest inputs (empty-string compatibility);
+  # a declared feature whose path fails to resolve fails closed.
+  featureSpecPath: ""
   __hitlAnswer: ""
+  # R8 (0366): injected by WorkflowAppService.run(); run-scopes every temporary capture.
+  __runId: ""
 
 states:
   - id: precheck
@@ -49,14 +58,16 @@ states:
       (D5-J, ADR-069). Both gates run `softFail: true`, so a red probe records FAIL and lets
       the transitions route to `failed` instead of aborting the run — the shipped action
       schema exposes no `onError`, so soft mode is what preserves that routing.
-      The canonical `.spur/run/$wbs-docs-precheck.status` is the AND of the two gate files.
+      The canonical `.spur/run/$__runId-docs-precheck.status` is the AND of the two gate files.
+      (0769: temporary captures are run-scoped — `.spur/run/<runId>-docs-*` — so concurrent
+      runs on one task never share or clobber a capture.)
     onEnter:
       - kind: command.gate
         options:
           id: docs-precheck-task
           executable: "${vars.spurBin}"
           args: ["task", "check", "${vars.wbs}"]
-          resultFile: .spur/run/${vars.wbs}-docs-precheck-task.status
+          resultFile: .spur/run/${vars.__runId}-docs-precheck-task.status
           softFail: true
           timeoutMs: 120000
       - kind: command.gate
@@ -64,16 +75,16 @@ states:
           id: docs-precheck-agent
           executable: "${vars.spurBin}"
           args: ["agent", "doctor", "${vars.agent}"]
-          resultFile: .spur/run/${vars.wbs}-docs-precheck-agent.status
+          resultFile: .spur/run/${vars.__runId}-docs-precheck-agent.status
           softFail: true
           timeoutMs: 120000
       - kind: shell
         options:
           command: >-
-            if test "$(cat .spur/run/$wbs-docs-precheck-task.status 2>/dev/null)" = PASS &&
-               test "$(cat .spur/run/$wbs-docs-precheck-agent.status 2>/dev/null)" = PASS;
-            then printf 'PASS\n' > ".spur/run/$wbs-docs-precheck.status";
-            else printf 'FAIL\n' > ".spur/run/$wbs-docs-precheck.status"; fi
+            if test "$(cat .spur/run/$__runId-docs-precheck-task.status 2>/dev/null)" = PASS &&
+               test "$(cat .spur/run/$__runId-docs-precheck-agent.status 2>/dev/null)" = PASS;
+            then printf 'PASS\n' > ".spur/run/$__runId-docs-precheck.status";
+            else printf 'FAIL\n' > ".spur/run/$__runId-docs-precheck.status"; fi
       - kind: note
         options:
           message: "Docs pipeline start for task ${vars.wbs}."
@@ -108,36 +119,21 @@ states:
         options:
           prompt: "Approve docs-only deliverable for task ${vars.wbs}?"
 
-  - id: record
-    description: >
-      Record the docs-only outcome into the task file. The task record verb backfills
-      Solution from the diff and moves the task to testing; the done gate still runs
-      the normal task matrix check before completion.
-    onEnter:
-      - kind: shell
-        options:
-          command: "$spurBin task record $wbs --solution-from-diff --transition testing"
-
-  - id: done
-    description: Terminal — docs deliverable measured, reviewed, and recorded.
-    onEnter:
-      # R1 (0704): no synthetic verdict writer. The verdict artifact is produced by measured
-      # verification in `verify` and registered there; done only performs the guarded
-      # transition. Override path remains: --force-done --reason.
-      - kind: shell
-        options:
-          command: "$spurBin task update $wbs done --no-lifecycle"
-      - kind: note
-        options:
-          message: "Docs pipeline complete for task ${vars.wbs}."
   - id: verify
     description: >
       Read-only measured verification (task 0704, R2/R4/R7): dispatch /sp:dev-verify --fix none
       with an answer file, derive the ONE standard verdict via `spur task verdict`, register the
       standard verify-verdict artifact, and bracket the verifier with proof-input digest capture/compare so any
       task-spec or document mutation during certification fails closed (R4). No docs assurance
-      subclass — PASS semantics are identical to task-pipeline (R7).
+      subclass — PASS semantics are identical to task-pipeline (R7). 0769: verification now
+      PRECEDES recording; the `verify → record` guard compares the proof bracket, and the
+      verdict artifact keeps its `.spur/run/<wbs>-verdict.json` compatibility path with
+      runId + definitionDigest stamped through the existing proof/run-artifact contract.
     onEnter:
+      # 0769: clear any stale current-run answer before the fresh-session verifier writes it.
+      - kind: shell
+        options:
+          command: "mkdir -p .spur/run && rm -f .spur/run/$__runId-docs-verify-answer.txt"
       # R4 (0703 R6 precedent): resolve the task-spec path BEFORE capture. `docs/tasks*` is
       # excluded from the digest's git-tree half, so the spec is folded in via `taskFile`.
       - kind: shell
@@ -147,22 +143,42 @@ states:
           # wbs exits non-zero with a named message. The resolved path folds
           # into the proof digest via `taskFile:` below; a silent miss would
           # degrade the docs-pipeline proof to tree-only (same hazard 0751 R2
-          # removed from task-pipeline).
+          # removed from task-pipeline). (0769: run-scoped capture path.)
           command: >-
             set -e;
             task_path="$($spurBin task path $wbs --json | jq -r '.path // .filePath // empty')";
             if [ -z "$task_path" ]; then echo "docs-pipeline: task path did not resolve for wbs $wbs" >&2; exit 1; fi;
-            printf '%s' "$task_path" > ".spur/run/$wbs-docs-taskpath.txt"
+            printf '%s' "$task_path" > ".spur/run/$__runId-docs-taskpath.txt"
       - kind: file.read.into-var
         options:
-          path: .spur/run/${vars.wbs}-docs-taskpath.txt
+          path: .spur/run/${vars.__runId}-docs-taskpath.txt
           var: taskSpecPath
+      # 0785 R2: resolve the linked feature spec path so the digest covers it too. An orphan task
+      # (no feature_id) resolves to empty — legitimately omitted via empty-string compatibility;
+      # a declared feature whose spec path does not resolve fails closed instead of silently
+      # folding a stale spec into the proof.
+      - kind: shell
+        options:
+          command: >-
+            set -e;
+            FID="$($spurBin task show $wbs --json 2>/dev/null | jq -r '.feature_id // .frontmatter.feature_id // empty' 2>/dev/null)";
+            FPATH_OUT="";
+            if [ -n "$FID" ]; then
+              FPATH_OUT="$($spurBin feature show "$FID" --json | jq -r '.filePath // .path // empty')";
+              if [ -z "$FPATH_OUT" ]; then echo "docs-pipeline: feature $FID linked to task $wbs but its spec path did not resolve" >&2; exit 1; fi;
+            fi;
+            printf '%s' "$FPATH_OUT" > ".spur/run/$__runId-docs-featurepath.txt"
+      - kind: file.read.into-var
+        options:
+          path: .spur/run/${vars.__runId}-docs-featurepath.txt
+          var: featureSpecPath
       # R4: canonical capture BEFORE the verifier runs. Same fingerprint input as the
       # re-capture below so the bracket compares like for like.
       - kind: proof.fingerprint
         options:
           var: proofDigest
           taskFile: ${vars.taskSpecPath}
+          featureFile: ${vars.featureSpecPath}
           input: /sp:dev-verify ${vars.wbs} --auto --fix none --focus all
           timeoutMs: ${vars.stepTimeoutMs}
       - kind: agent.run
@@ -174,19 +190,19 @@ states:
           input: /sp:dev-verify ${vars.wbs} --auto --fix none --focus all
           role: reviewer
           timeoutMs: ${vars.stepTimeoutMs}
-          answerFile: .spur/run/${vars.wbs}-verify-answer.txt
+          answerFile: .spur/run/${vars.__runId}-docs-verify-answer.txt
       - kind: shell
         options:
-          command: "$spurBin task verdict $wbs --from-answer .spur/run/$wbs-verify-answer.txt"
-      # R7: stamp the proof block into the standard verdict artifact, then register it.
-      # Soft action + hard guard: a missing/malformed stamp fails the `verify -> done`
+          command: "$spurBin task verdict $wbs --from-answer .spur/run/$__runId-docs-verify-answer.txt"
+      # R7: stamp the proof block + run identity into the standard verdict artifact, then register
+      # it. Soft action + hard guard: a missing/malformed stamp fails the `verify -> record`
       # guard below, not this step.
       - kind: shell
         options:
           command: >-
             V=".spur/run/$wbs-verdict.json";
             if [ -f "$V" ] && [ -n "$proofDigest" ]; then
-              jq --arg d "$proofDigest" '. + {proof: {digest: $d, capturePoint: "docs-verify-entry"}}' "$V" > "$V.tmp" && mv "$V.tmp" "$V";
+              jq --arg d "$proofDigest" --arg r "$__runId" '. + {proof: {digest: $d, capturePoint: "docs-verify-entry", runId: $r}}' "$V" > "$V.tmp" && mv "$V.tmp" "$V";
             fi;
             exit 0
       - kind: run.artifact
@@ -199,9 +215,41 @@ states:
         options:
           var: proofDigestNow
           taskFile: ${vars.taskSpecPath}
+          featureFile: ${vars.featureSpecPath}
           input: /sp:dev-verify ${vars.wbs} --auto --fix none --focus all
           timeoutMs: ${vars.stepTimeoutMs}
 
+  - id: record
+    description: >
+      Record the docs-only outcome AFTER measured verification (task 0769 ordering:
+      draft/approval → verify → record → done — the pre-verification record could write
+      UNKNOWN/old Testing evidence). The verdict is already derived and proof-bracketed in
+      `verify`; `verify → record` only opens on measured PASS with an intact bracket. The
+      task record verb backfills Solution from the diff and moves the task to testing; its
+      result is captured to a run-scoped status file so a record denial reaches `failed`
+      (record → failed) and is never converted to success by an exit 0.
+    onEnter:
+      - kind: shell
+        options:
+          command: >-
+            if $spurBin task record $wbs --solution-from-diff --transition testing; then
+              printf 'PASS\n' > ".spur/run/$__runId-docs-record.status";
+            else
+              printf 'FAIL\n' > ".spur/run/$__runId-docs-record.status";
+            fi
+
+  - id: done
+    description: Terminal — docs deliverable measured, reviewed, and recorded.
+    onEnter:
+      # R1 (0704): no synthetic verdict writer. The verdict artifact is produced by measured
+      # verification in `verify` and registered there; done only performs the guarded
+      # transition. Override path remains: --force-done --reason.
+      - kind: shell
+        options:
+          command: "$spurBin task update $wbs done --no-lifecycle"
+      - kind: note
+        options:
+          message: "Docs pipeline complete for task ${vars.wbs}."
   - id: failed
     description: Terminal — docs pipeline failed or was rejected.
 
@@ -223,8 +271,8 @@ transitions:
       kind: always
 
   - from: draft
-    to: record
-    description: profile=auto — skip the docs-review HITL gate.
+    to: verify
+    description: "profile=auto — skip the docs-review HITL gate; verify measures BEFORE record (0769: a pre-verification record could write UNKNOWN/old Testing evidence)."
     guard:
       kind: shell
       options:
@@ -236,8 +284,8 @@ transitions:
       kind: always
 
   - from: docs-review
-    to: record
-    description: Docs approved — record results.
+    to: verify
+    description: "Docs approved — measure the deliverable (0769: verification precedes recording)."
     guard:
       kind: shell
       options:
@@ -257,16 +305,11 @@ transitions:
       options:
         command: 'test "$__hitlAnswer" = cancel'
 
-  - from: record
-    to: verify
-    description: Recorded — measure the deliverable (R2). Structural task-check gates remain
-      at precheck, record (wip→testing), and done (verdict-artifact guard, R3).
-    guard:
-      kind: always
-
   - from: verify
-    to: done
-    description: Measured PASS with the proof bracket intact (R4/R5).
+    to: record
+    description: Measured PASS with the proof bracket intact (R4/R5) — record only verified
+      outcomes (0769). Structural task-check gates remain at precheck, record (wip→testing),
+      and done (verdict-artifact guard, R3).
     guard:
       kind: shell
       options:
@@ -284,6 +327,25 @@ transitions:
   - from: verify
     to: failed
     description: Non-PASS verdict, missing/malformed answer, or digest mismatch (R5) — the run
-      reaches failed and no PASS artifact is certified.
+      reaches failed and nothing is recorded.
+    guard:
+      kind: always
+
+  - from: record
+    to: done
+    description: Recorded from a verified outcome; the persisted verdict/bracket is re-asserted
+      so a failed `task record` (captured FAIL) never converts to done (0769).
+    guard:
+      kind: shell
+      options:
+        command: >-
+          test "$(cat .spur/run/$__runId-docs-record.status 2>/dev/null)" = PASS &&
+          test -f ".spur/run/$wbs-verdict.json" &&
+          test "$(jq -r '.verdict // empty' .spur/run/$wbs-verdict.json 2>/dev/null)" = PASS &&
+          test -n "$proofDigest" &&
+          test "$(jq -r '.proof.digest // empty' .spur/run/$wbs-verdict.json 2>/dev/null)" = "$proofDigest"
+  - from: record
+    to: failed
+    description: "Task record denied or errored (captured status not PASS) — the record denial reaches failed; the done guard above never converts it to success."
     guard:
       kind: always