@gobing-ai/spur 0.3.73 → 0.3.75

package/plugins/sp/agents/expert-spur.md

@@ -46,8 +46,10 @@ CLI nouns for direct use, but they are not this corpus specialist's scope.
 3. Run the noun's read/check/validate path before mutation where available.
 4. Mutate only through `spur`; parse `--json` output when the verb advertises it.
 5. Inspect each result before the next dependent operation; stop on structural or validation failure.
-6. Run the scoped check/validate/refresh path after mutation. After task/feature batch writes, run
-   `spur task check --corpus --json` once.
+6. Run affected-input checks after mutation (constitution T11): after task/feature batch writes,
+   run `spur task check <wbs>` / `spur feature check <id>` for each changed document and its
+   required linked evidence — not a corpus sweep. The explicit unsuppressed audit
+   (`spur task check --corpus --json`) is reserved for checker-policy changes (T10).
 
 Workflow fit, mode selection, simplicity budgets, authoring, and tuning live in the workflow
 references under `plugins/sp/skills/spur-cli/references/workflows/`; load them rather than copying
@@ -59,7 +61,7 @@ their runbook here.
 
 - Use the source-local CLI when working in the Spur repository.
 - Use `spur task update --section --from-file` for task section writes.
-- Keep check-before/write/check-after evidence and the final scoped refresh result.
+- Keep check-before/write/check-after evidence and the final scoped validation result.
 - Preserve declaration order and currently executing runs when changing workflows.
 
 ### Never
@@ -87,7 +89,8 @@ their runbook here.
 ### Gates
 - pre-check: <result>
 - post-check/validate: <result>
-- refresh/corpus sweep: <result or n/a>
+- scoped validation: <affected task/feature checks + linked evidence, or n/a; explicit T10
+  corpus audit only when checker policy changed>
 ```
 
 ## Platform Notes

package/plugins/sp/commands/dev-idea.md

@@ -46,4 +46,4 @@ vars as subsets of `--approve-taste` (`idea_approved` / `design_approved`). Pref
 - `auto`/name: launch `spur workflow run idea-pipeline.yaml --async`, observe with one `workflow trace --follow`, and only report cancellation as stopped when `workflow cancel --json` returns `killed: true`.
 - `Skill(skill="sp:spur-dev", args="idea $ARGUMENTS")`
 - Stage contract (discovery → idea-eval → feature-create → AC → feature-check → system-design →
-  decompose → batch-create → handoff): `plugins/sp/skills/spur-dev/references/dev-operations.md` § idea.
+  decompose → batch-create → ready-prepare → handoff): `plugins/sp/skills/spur-dev/references/dev-operations.md` § idea.

package/plugins/sp/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "sp",
-    "version": "0.3.73",
+    "version": "0.3.75",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics.",
     "extensions": {
         "pi": ["./hooks/pi/guard-extension.ts"]

package/plugins/sp/scripts/history-anatomy-cache.mjs

@@ -198,6 +198,7 @@ function parseProvenance(reportMarkdown) {
       contractDigest: String(obj.contractDigest ?? ""),
       skillDigest: String(obj.skillDigest ?? ""),
       workflowDigest: String(obj.workflowDigest ?? ""),
+      helperDigest: String(obj.helperDigest ?? ""),
       coverage: coverage.map((c) => ({
         source: String(c.source ?? ""),
         status: String(c.status ?? ""),
@@ -244,6 +245,8 @@ function decideCache(cached, current, opts) {
     reasons.push("logic-changed:skill");
   if (cached.workflowDigest !== current.workflowDigest)
     reasons.push("logic-changed:workflow");
+  if (cached.helperDigest !== current.helperDigest)
+    reasons.push("logic-changed:helper");
   const currentSources = new Set(current.coverage.map((c) => c.source));
   if (cached.coverage.some((c) => !currentSources.has(c.source)))
     reasons.push("coverage-degraded");
@@ -473,6 +476,7 @@ function buildProvenance(opts) {
     contractDigest: logicDigest(opts.contractFile),
     skillDigest: logicDigest(opts.skillDir),
     workflowDigest: logicDigest(opts.workflowFile),
+    helperDigest: logicDigest(opts.helperFile),
     coverage,
     runId: opts.runId,
     currentArtifactPath: opts.artifact,
@@ -503,6 +507,7 @@ var YAML_KEYS = [
   "contractDigest",
   "skillDigest",
   "workflowDigest",
+  "helperDigest",
   "runId",
   "currentArtifactPath",
   "baselineArtifactPath",
@@ -595,7 +600,7 @@ function diffPorcelain(before, now, expects) {
   return [...porcelainPaths(now)].filter((p) => !beforePaths.has(p) && !expects.has(p)).sort();
 }
 var VALID_COMMANDS = "digest, check, paths, assert-clean, probe, stamp, refresh, publish";
-var PROBE_USAGE = "<script> probe --artifact <a.json> --target <report.md> [--baseline <b.json>] [--mode daily|ad-hoc] " + "[--date <YYYY-MM-DD>] [--recompute true] [--out <prov.json>] [--skill-dir <d>] [--contract <f>] [--workflow <f>]";
+var PROBE_USAGE = "<script> probe --artifact <a.json> --target <report.md> [--baseline <b.json>] [--mode daily|ad-hoc] " + "[--date <YYYY-MM-DD>] [--recompute true] [--out <prov.json>] [--skill-dir <d>] [--contract <f>] [--workflow <f>] [--helper <f>]";
 function parseFlags(args) {
   const out = {};
   for (let i = 0;i < args.length; i++) {
@@ -729,6 +734,7 @@ ${result.problems.map((p) => `- ${p}
           skillDir: f["skill-dir"],
           contractFile: f.contract,
           workflowFile: f.workflow,
+          helperFile: f.helper,
           contractVersion: f["contract-version"],
           runId: f["run-id"],
           spurVersion: f["spur-version"]

package/plugins/sp/scripts/history-anatomy-cache.ts

@@ -4,7 +4,8 @@
  *
  * ADR-079 makes cache validity a *derived* fact, not a stored claim: a cached report is reusable
  * only for its model-authored half, and only when a freshly derived semantic digest of the analyze
- * artifact plus the contract/skill/workflow logic digests all match what the cache recorded.
+ * artifact plus the contract/skill/workflow/helper logic digests all match what the cache
+ * recorded (helper digest: task 0771 — the deterministic half is part of cache identity).
  *
  * This script performs deterministic file, hash, and schema work only — no finding, remediation,
  * severity, or ranking logic (that is judgment, owned by the sp:history-anatomy skill). Jobs:
@@ -68,6 +69,8 @@ export interface CacheProvenance {
     contractDigest: string;
     skillDigest: string;
     workflowDigest: string;
+    /** Digest of the executing helper twin itself (0771): a changed deterministic half invalidates. */
+    helperDigest: string;
     coverage: Array<{ source: string; status: string; lastImportedAt: string | null }>;
     // 0660 R7 audit fields. Recorded in the published frontmatter for provenance; deliberately
     // NOT part of the invalidation matrix — a changed run id or executor is not stale evidence.
@@ -243,6 +246,7 @@ export function parseProvenance(reportMarkdown: string): CacheProvenance | null
             contractDigest: String(obj.contractDigest ?? ''),
             skillDigest: String(obj.skillDigest ?? ''),
             workflowDigest: String(obj.workflowDigest ?? ''),
+            helperDigest: String(obj.helperDigest ?? ''),
             coverage: coverage.map((c) => ({
                 source: String(c.source ?? ''),
                 status: String(c.status ?? ''),
@@ -300,6 +304,7 @@ export function decideCache(
     if (cached.contractDigest !== current.contractDigest) reasons.push('logic-changed:contract');
     if (cached.skillDigest !== current.skillDigest) reasons.push('logic-changed:skill');
     if (cached.workflowDigest !== current.workflowDigest) reasons.push('logic-changed:workflow');
+    if (cached.helperDigest !== current.helperDigest) reasons.push('logic-changed:helper');
 
     // Coverage cannot degrade: the cache must not claim broader coverage than the current
     // analyze covers. If the cached report covered a source the current analyze no longer does,
@@ -601,6 +606,7 @@ export interface ProbeOptions {
     skillDir?: string;
     contractFile?: string;
     workflowFile?: string;
+    helperFile?: string;
     contractVersion?: string;
     runId?: string;
     spurVersion?: string;
@@ -660,6 +666,7 @@ export function buildProvenance(opts: ProbeOptions): CacheProvenance {
         contractDigest: logicDigest(opts.contractFile),
         skillDigest: logicDigest(opts.skillDir),
         workflowDigest: logicDigest(opts.workflowFile),
+        helperDigest: logicDigest(opts.helperFile),
         coverage,
         runId: opts.runId,
         currentArtifactPath: opts.artifact,
@@ -697,6 +704,7 @@ const YAML_KEYS: Array<keyof CacheProvenance> = [
     'contractDigest',
     'skillDigest',
     'workflowDigest',
+    'helperDigest',
     'runId',
     'currentArtifactPath',
     'baselineArtifactPath',
@@ -823,7 +831,7 @@ export function diffPorcelain(before: string, now: string, expects: Set<string>)
 const VALID_COMMANDS = 'digest, check, paths, assert-clean, probe, stamp, refresh, publish';
 const PROBE_USAGE =
     '<script> probe --artifact <a.json> --target <report.md> [--baseline <b.json>] [--mode daily|ad-hoc] ' +
-    '[--date <YYYY-MM-DD>] [--recompute true] [--out <prov.json>] [--skill-dir <d>] [--contract <f>] [--workflow <f>]';
+    '[--date <YYYY-MM-DD>] [--recompute true] [--out <prov.json>] [--skill-dir <d>] [--contract <f>] [--workflow <f>] [--helper <f>]';
 
 /** `--key value` / `--flag` → record. Bare flags become `"true"` so `--recompute` needs no value. */
 function parseFlags(args: string[]): Record<string, string | undefined> {
@@ -956,6 +964,7 @@ export function runCacheCli(argv: string[]): CacheCliResult {
                     skillDir: f['skill-dir'],
                     contractFile: f.contract,
                     workflowFile: f.workflow,
+                    helperFile: f.helper,
                     contractVersion: f['contract-version'],
                     runId: f['run-id'],
                     spurVersion: f['spur-version'],

package/plugins/sp/scripts/pr-reviewing.mjs

@@ -325,7 +325,11 @@ function hasPendingRequest(comments, head, login) {
 }
 function requireExpectedHead(args, pr) {
   const expected = args.flags.get("--head");
-  if (expected && expected !== pr.headRefOid) {
+  if (!expected) {
+    writeStatus(args, "FAIL");
+    fail(args, "--head <sha> is required and must match the reviewed request HEAD", 2);
+  }
+  if (expected !== pr.headRefOid) {
     writeStatus(args, "FAIL");
     fail(args, `PR HEAD moved from ${expected.slice(0, 7)} to ${pr.headRefOid.slice(0, 7)} \u2014 request a new review`, 2);
   }

package/plugins/sp/scripts/pr-reviewing.ts

@@ -519,8 +519,14 @@ function hasPendingRequest(comments: readonly GhIssueComment[], head: string, lo
 }
 
 function requireExpectedHead(args: ParsedArgs, pr: GhPr): void {
+    // 0771: head pinning only protects when the flag actually carries a SHA — an empty or
+    // missing --head must fail loud instead of silently reviewing whatever HEAD is current.
     const expected = args.flags.get('--head');
-    if (expected && expected !== pr.headRefOid) {
+    if (!expected) {
+        writeStatus(args, 'FAIL');
+        fail(args, '--head <sha> is required and must match the reviewed request HEAD', 2);
+    }
+    if (expected !== pr.headRefOid) {
         writeStatus(args, 'FAIL');
         fail(
             args,

package/plugins/sp/scripts/transition-shim-check.ts

@@ -8,11 +8,11 @@
  * so it is a grep target and a review signal, and a manifest entry in
  * `config/transition-shims.json` records who owns it and when it can be removed.
  *
- * The gate is deliberately two-sided, matching `config/corpus-baseline.json`
- * semantics (corpus-check.ts): a marker with no manifest entry FAILS, and a
- * manifest entry whose marker no longer appears in source FAILS. Without the
- * second half the manifest would rot into a permanent suppression list — the
- * exact invisible-debt pattern this gate exists to end.
+ * The gate is deliberately two-sided: a marker with no manifest entry
+ * FAILS, and a manifest entry whose marker no longer appears in source
+ * FAILS. Without the second half the manifest would rot into a permanent
+ * suppression list — the exact invisible-debt pattern this gate exists to
+ * end.
  *
  * Marker convention (docs/04_DESIGN.md §2.5):
  *   // @transition-shim(<id>) — <one line on what this keeps working>
@@ -134,7 +134,7 @@ function scanMarkers(cwd: string, roots: string[]): Map<string, Set<string>> {
     return found;
 }
 
-/** Load the manifest; a missing file degrades to no entries (corpus-check parity). */
+/** Load the manifest; a missing file degrades to no entries (fail-open). */
 function loadManifest(path: string): { entries: ManifestEntry[]; raw: string | null } {
     if (!existsSync(path)) return { entries: [], raw: null };
     const raw = readFileSync(path, 'utf8');

package/plugins/sp/skills/pr-reviewing/SKILL.md

@@ -164,12 +164,15 @@ superskill script contract.
 8. **Collect** — `<script> collect --since "$requestedAt" --head "$requestHead" --json`. Normalize
    only the requested HEAD and request window; then invoke `status` with the same bounds for
    PR/base/CI/local state. Never turn an absent, stale, or moved-HEAD result into `clean`.
+   `--head` is mandatory on wait/collect/status (0771): an empty or missing pin fails loud
+   instead of silently reviewing whatever HEAD is current.
 
 ## Fix mode
 
 Only in `fix` mode:
 
-1. **Collect before editing.** Invoke direct `collect --json` plus `status --json` and require a
+1. **Collect before editing.** Invoke direct `collect --json --head "$(git rev-parse HEAD)"` plus
+   `status --json --head "$(git rev-parse HEAD)"` and require a
    completed result for the current pushed HEAD. If the result is pending, stale, or unavailable,
    report it and stop without source edits. If it is explicitly clean, report no fixes and stop.
 2. **Validate each finding.** Open the referenced code; trace callers/callees; verify the problem

package/plugins/sp/skills/spur-cli/references/self.md

@@ -1,14 +1,14 @@
 ---
 name: spur-cli-self
-description: "spur-cli noun reference for `spur self`: self-management verbs — scaffold (`init`), schema migrations (`migrate`), local web server (`serve`), and status overview (`status`). Each verb mounts the same command builder as its legacy top-level noun, which remains a hidden alias over the identical command."
+description: "spur-cli noun reference for `spur self`: self-management verbs — scaffold (`init`), database maintenance (`maintain`), schema migrations (`migrate`), local web server (`serve`), and status overview (`status`). Each verb mounts the same command builder as its legacy top-level noun, which remains a hidden alias over the identical command."
 see_also:
   - spur-cli
 ---
 
 # spur self - self-management verbs
 
-`spur self` hosts the four self-management verbs. Each verb is the canonical path for a command
-that also remains registered as a legacy top-level **hidden alias** (`spur init`, `spur migrate`,
+`spur self` hosts the self-management verbs. Each verb is the canonical path for a command
+that also remains registered as a legacy top-level **hidden alias** (`spur init`, `spur maintain`, `spur migrate`,
 `spur serve`, `spur status`) so existing scripts, workflow YAML, and habits keep working unchanged.
 Both paths share the same command builder: identical flags, output, and exit codes. The legacy
 top-level forms are omitted from `spur --help`, leaving `self` as the visible surface.
@@ -18,6 +18,7 @@ top-level forms are omitted from `spur --help`, leaving `self` as the visible su
 | Verb | Purpose | Key flags |
 | ---- | ------- | --------- |
 | `init` | Scaffold a new Spur project in the current directory | `--name <name>` `--force` `--minimal` `--json` |
+| `maintain` | Run database maintenance: PRAGMA optimize, WAL truncation, optional VACUUM | `--vacuum` `--json` |
 | `migrate` | Apply CLI-owned schema migrations | `--json` |
 | `serve` | Start the Spur web server (local fallback) | `--port <n>` `--host <addr>` `--no-open` `--cwd <path>` `--json` |
 | `status [path]` | Show project and git status for a Spur project | `--json` |
@@ -43,6 +44,19 @@ Materializes the `.spur/` directory tree with config, docs, rules, and workflow
 (Phase 1.5 / 1.6) run immediately after this verb completes — see **[init.md](init.md)** for the
 probe protocol and rule-glob adaptation procedure.
 
+## `self maintain` - run database maintenance
+
+```bash
+spur self maintain                    # run PRAGMA optimize + wal_checkpoint(TRUNCATE)
+spur self maintain --vacuum           # deep maintenance: VACUUM + optimize + checkpoint
+spur self maintain --json             # machine-readable
+```
+
+Executes SQLite database maintenance operations on `.spur/spur.db`:
+- `PRAGMA optimize;` to refresh query planner statistics in `sqlite_stat1`.
+- `PRAGMA wal_checkpoint(TRUNCATE);` to checkpoint committed WAL frames and truncate WAL to 0 bytes.
+- `--vacuum` runs `VACUUM;` first for page compaction and B-tree defragmentation (requires 2x free disk space).
+
 ## `self migrate` - apply CLI-owned schema migrations
 
 ```bash

package/plugins/sp/skills/spur-cli/references/tasks.md

@@ -51,7 +51,7 @@ re-reading or re-tokenizing the task.
 | `batch-create` | Create many tasks from a validated JSON array | `--file <path>` `--folder` `--json` |
 | `record <wbs>` | Write `Testing` from a verify verdict (deterministic); bare-`## Review` fallback only; optional Solution + transition | `--verdict-file <path>` `--solution-from-diff` `--transition <status>` `--folder` `--json` |
 | `verdict <wbs>` | Derive PASS/PARTIAL/FAIL/UNKNOWN from verify answer text → verdict JSON; see [answer-file shape](tasks/verbs.md#answer-file-shape-what---from-answer-parses) | `--from-answer <path>` `--folder` `--json` |
-| `check [wbs]` | Four-layer validation; the readiness matrix; `--fix` repairs structural findings in place | `--strict` `--as <status>` `--strict-core` `--fix` `--folder` `--json` |
+| `check [wbs]` | Four-layer validation; `--fix` repairs structure; `--corpus` is the explicit unsuppressed audit | `--strict` `--as <status>` `--strict-core` `--fix` `--folder` `--corpus` `--since <ref>` `--json` |
 | `resolve <file-path>` | Map a file path to its owning task WBS | `--strict` `--folder` `--json` |
 | `path <wbs>` | Map a WBS to its absolute task file path (inverse of `resolve`) | `--folder` `--json` |
 | `run-link <wbs>` | Record pipeline run provenance link for task | `--source <src>` `--run-id <id>` `--json` |
@@ -187,7 +187,9 @@ spur task record 0040 --verdict-file .spur/run/0040-verdict.json --solution-from
 - **`--solution-from-diff`** backfills `Solution` from `git diff -U0` hunk headers **only when the
   Solution section is still bare** — a safety net, not an overwrite.
 - **`--transition <status>`** optionally advances the lifecycle after writing (e.g. `testing`).
-  `record` **never transitions to `done`** — the `testing→done` gate stays in the workflow (0108).
+  `--transition done` is a **guarded** completion path: it requires a PASS verdict, auto-walks
+  `wip → testing → done`, and auto-creates the pipeline run-link (0436 R4); a non-PASS verdict to
+  `done` errors instead of transitioning, and the normal done gates still apply (0108).
 
 The verdict shape (`wbs`, `verdict`, `requirements[]`, `checks[]`) and the rendered tables are
 documented in [tasks/verbs.md](tasks/verbs.md).

package/plugins/sp/skills/spur-cli/references/workflows/workflow-fit-and-tuning.md

@@ -140,10 +140,10 @@ reports it. Do not invent a second threshold; author to the one that is frozen (
 | Node count | Every node earns its transition round-trip | A node that always runs immediately after another, with no guard between them, is one node |
 
 **When a node breaches the budget, do not reformat to dodge the measure.** Joining five lines with
-`&&` moves the complexity, not the ownership. Pick an owner from the five recorded options in
+`&&` moves the complexity, not the ownership. Pick one of the four remaining owners from
 `docs/design/workflow-shell-ownership.md`: public `spur` verb (consent-gated), application service,
-least-privilege built-in action kind, workflow-relative external extension, or a recorded
-stays-shell exception with its reason in `config/workflow-composition-baseline.json`.
+least-privilege built-in action kind, or workflow-relative external extension. (0775 retired the
+recorded stays-shell exception along with the suppression snapshot.)
 
 **Advisory posture is binding.** Composition findings never block a run, never change a `validate`
 exit status, and are never a reason to hot-edit an executing pipeline. Surface them; fix on operator
@@ -193,8 +193,8 @@ Steps:
 2. **Return each node's work to its owner** — judgment nodes to the command or skill they should
    have been calling; a genuinely useful shell sequence to one script under its owning surface.
 3. **Rewrite the entry surface as the procedure**, in the order the graph ran.
-4. **Delete the YAML and its `config/workflow-composition-baseline.json` entries** in the same
-   change. A baseline entry whose action no longer exists fails the two-sided check.
+4. **Delete the YAML** in the same change. (0775 retired the composition-baseline entries that
+   used to be deleted alongside it; the live definition is the only artifact left.)
 5. **Record the demotion** and its trigger, so the next author does not re-promote it by reflex.
 
 ### optimize — refine an accepted workflow in place

package/plugins/sp/skills/spur-cli/references/workflows.md

@@ -231,10 +231,10 @@ agent prompts where a first-class surface would own it better?" — nothing more
   raw prompt length only sets the reported severity (<200 low / ≤1000 medium / >1000 high).
 
 **How to run it:** it is not a separate command — `spur workflow validate <file> --json` returns
-`composition: {findings[], suppressed}` on the valid path; human mode prints the advisory to stderr
-with exit 0. Actions with a recorded disposition in
-`config/workflow-composition-baseline.json` (resolved by walking up from the workflow file) are
-counted in `suppressed`, not `findings`.
+`composition: {findings[]}` on the valid path; human mode prints the advisory to stderr
+with exit 0. Findings are derived from the workflow definition itself
+(`extractResolvedWorkflowFacts`, guarded by `composition-baseline.test.ts`); 0775 retired the
+suppression snapshot, so every finding is reported — none are suppressed.
 
 **How to read it, and the fix path per defect class:**
 

package/plugins/sp/skills/spur-dev/SKILL.md

@@ -153,6 +153,23 @@ CLI does.
 
 ## Gotchas
 
+### Bounded execution and recovery (0777)
+
+- During planning/refinement of corpus-scale work, record an execution budget, persisted-artifact
+  paths and requireDiff guidance in the task Design. For classification-only work, declare
+  `mutationPolicy: none`; its task/evidence change is the deliverable, not invented source edits.
+  Preserve partial artifacts at the budget boundary; resume only against the current task contract.
+- Before accepting a child/watcher result, compare its run ID with the dispatched run ID and check
+  current trace state through Spur. If using a run log as evidence, require its mtime to be at least
+  the dispatch time. A mismatch or stale timestamp is not completion evidence. Do not scrape terminals.
+  Bound each watch invocation to 10 minutes or 20 polls, whichever comes first; persist the last
+  confirmed identity/state and report a checkpoint before continuing. A watcher timeout does not
+  cancel the owned run or authorize launching a replacement.
+- Mark superseded scratch with `SUPERSEDED` and a pointer to the authoritative task Design. Never
+  let a scratch instruction override the live task, even when its old run is still readable.
+- Checker-policy changes require one explicit unsuppressed audit (T10); ordinary corpus commit
+  prep checks affected documents and linked evidence (T11), not the corpus. No acceptance snapshots.
+
 1. **Never skip a gate.** A clean `feature check` is the only proof the AC is valid; a
    passing `batch-create` is the only proof the decomposition is well-formed. Skip either and
    you ship corrupted corpus.

package/plugins/sp/skills/spur-dev/references/cross-cutting.md

@@ -652,21 +652,35 @@ Field semantics (enforced by `parseCheckpointMetadata` / `checkpointStaleness`):
   up once retention expires.
 - `source_commit` pins repository HEAD at write time; drift staleness is reported, not hidden.
 - `artifacts` lists referenced run files; a missing artifact makes the checkpoint stale.
-- Writers: write after every HITL gate decision, phase transition, and terminal state; overwrite
-  the same file on resume (`session_id` = `<date>-<wbs-or-feature>`).
+
+**Writer cadence (0784 R4).** There is exactly one canonical writer: the `task-pipeline` done
+state's terminal checkpoint (`status: done`, real HEAD, run id from `$__runId`, and `$wbs`-expanded
+artifact paths). It is a plain `shell` step — checkpoints are working memory, not CLI-gated corpus.
+The `feature-dev`, `wrapup-pipeline`, and `idea-pipeline` pipelines used to echo pseudo-checkpoints
+("checkpoint: <workflow> done ...") that violated the canonical schema; those writers were removed
+in 0784 — the persisted run row is the authoritative terminal record, and a non-canonical echo
+cannot be resumed, routed, or reclaimed safely.
+
+**Engine state vs checkpoint status (0784 R3).** The persisted run row's status is authoritative;
+a checkpoint's `status` is an advisory projection written by consumers. On resume
+(`workflow continue`), a checkpoint associated with the paused run must project a nonterminal
+engine state — `pending`, `running`, or `approved` are accepted; `done`/`failed`/`cancelled`/
+`skipped`, a missing status, or any unknown value refuse the resume with a named reason. The
+engine owns no persisted `paused` checkpoint status.
 
 **Write checkpoints after:**
 
-- Every HITL gate decision (approved/rejected/deferred).
-- Every phase transition in `task-pipeline`, `feature-dev`, `idea-pipeline`, and
-  `wrapup-pipeline`.
-- Every terminal state (`done`, `failed`, `cancelled`, `skipped`).
+- Terminal task completion in `task-pipeline` (the canonical writer above).
+- Any additional consumer-specific checkpoints you genuinely need for local resume; keep the
+  canonical schema — non-canonical files are ignored by routing and cleanup.
 
 **Read checkpoints when:**
 
 - `/sp:dev-run --continue` or `/sp:dev-runall --continue` is used.
 - The operator asks to resume a task or feature.
-- A workflow run is paused and later continued (`spur workflow continue <run-id>`).
+- A workflow run is paused and later continued (`spur workflow continue <run-id>`). Resume
+  validates freshness in the run's recorded launch workdir (0784 R1/R3): artifacts resolve relative
+  to that workdir, and git HEAD is probed there — never in the ambient process cwd.
 
 **Rules:**
 
@@ -678,7 +692,8 @@ Field semantics (enforced by `parseCheckpointMetadata` / `checkpointStaleness`):
 - **Retention.** Terminal checkpoints older than `workflowLogRetentionDays` with no active run are
   reclaimed by `spur workflow clean` (task 0711 R5–R8); non-terminal checkpoints are always kept.
 - **Not a validated corpus.** Checkpoints are working memory. They are overwritten when a session
-  resumes and re-checkpoints. They are NOT authoritative task state — the task file is.
+  resumes and re-checkpoints. They are NOT authoritative task state — the task file and the
+  persisted run row are.
 - **One file per session.** The `session_id` is `<date>-<wbs-or-feature>`. A resumed session
   overwrites the same file.
 - **Operator-readable.** The YAML frontmatter is machine-parseable; the body is free-form markdown

package/plugins/sp/skills/spur-dev/references/dev-operations.md

@@ -341,7 +341,7 @@ must not be changed without updating the backing skill.
   - `--approve-taste` — with `--auto`, skip **all** remaining taste pauses this run (idea-eval + design-approval). Sets `idea_approved=true` and `design_approved=true`.
     Aliases (prefer `--approve-taste`): `--idea-approved` → `idea_approved`; `--design-approved` → `design_approved`. There is **no** `--design` force flag.
 - **Backing:** `idea-pipeline.yaml` through the inline driver for omitted/`inline`, or `spur workflow run idea-pipeline.yaml --async` for `auto`/name.
-- **Behavior:** Builds vars from the table above and drives the idea pipeline. Flow: discovery → **idea-eval** (taste; reject → cancelled) → feature-create → ac-generate → feature-check → system-design (conditional) → design-approval (taste) → decompose → batch-create → handoff. STOPS at handoff — no task execution, no pipeline nesting. Headless runs use one `trace --follow`; cancellation is reported stopped only when `workflow cancel --json` returns `killed: true`.
+- **Behavior:** Builds vars from the table above and drives the idea pipeline. Flow: discovery → **idea-eval** (taste; reject → cancelled) → feature-create → ac-generate → feature-check → system-design (conditional) → design-approval (taste) → decompose → batch-create (`--skip-ready`) → ready-prepare (ready checklist per created task + ready-evidence sidecar, 0788) → handoff. STOPS at handoff — no task execution, no pipeline nesting. Headless runs use one `trace --follow`; cancellation is reported stopped only when `workflow cancel --json` returns `killed: true`.
 - **Delegation:** Host-session inline driver by default; explicit executor selection uses the async workflow worker.
 - **Idea-evaluation gate:** After discovery, operator reviews `.spur/run/idea-eval-report.md` ([idea-evaluation.md](idea-evaluation.md)). Approve continues; reject/cancel → no feature. Under `--auto`, still pauses unless taste pre-cleared (`--approve-taste` / alias). Enhanced idea is a sidecar — `vars.idea` is not overwritten.
 - **Design package (`--skip-design` only):**

package/plugins/sp/skills/spur-dev/references/execution-batch.md

@@ -887,9 +887,9 @@ time. Before launching a full `spur-check-new`:
    `console.*`), spawn processes via `NodeProcessExecutor` (no `Bun.spawnSync`), get a
    `runtime-boundaries` fs-io exemption for sync reads (mirrors `task.ts`), and a non-command helper
    must not live in `apps/cli/src/commands/` (the noun scan treats every file there as a noun).
-3. **Doc/TSDoc edits shift `file:line` anchors** cited by other tasks — `corpus-check` surfaces them
-   as `L4.anchor-subject-mismatch`. Repoint the shifted citations (via `spur task update --section`)
-   in the same commit, and reconcile new/stale baseline entries before the gate run.
+3. **Doc/TSDoc edits shift `file:line` anchors** cited by other tasks — the per-task gate surfaces
+   them as `L4.anchor-subject-mismatch` (0775: the corpus sweep retired; run `spur task check <wbs>`
+   on touched tasks). Repoint the shifted citations (via `spur task update --section`)
 
 ## AC traceability
 

package/plugins/sp/skills/spur-dev/references/gate-checklists.md

@@ -149,7 +149,10 @@ passed, so provenance denied first and Review L3 denied on the retry.
 
 | # | Gate layer | Triggers denial when | Remediation |
 |---|------------|----------------------|-------------|
-| 1 | **Strict-core + verdict artifact** (`spur task check <wbs> --strict-core` + `done-transition-guard.ts`) | The strict-core check fails, or `.spur/run/<wbs>-verdict.json` is **missing** or has a non-PASS aggregate. **Missing artifact is a deny** (not a silent allow — closes the 0349 "done without verdict" class). The aggregate is recomputed from requirement/AC rows; the harsher of stored and computed wins. | Re-run `/sp:dev-verify <wbs>` until PASS (writes the artifact), or explicitly override with `spur task update <wbs> done --force-done --reason "<why>"`. Docs-only pipelines write a docs PASS stub under `.spur/run/` before `done` (see `docs-pipeline.yaml`). |
+| 1 | **Strict-core + verdict artifact** (`spur task check <wbs> --strict-core` + `done-transition-guard.ts`) | The strict-core check fails, or `.spur/run/<wbs>-verdict.json` is **missing** or has a non-PASS aggregate. **Missing artifact is a deny** (not a silent allow — closes the 0349 "done without verdict" class). The aggregate is recomputed from requirement/AC rows; the harsher of stored and computed wins. | Re-run `/sp:dev-verify <wbs>` until PASS (writes the artifact), or explicitly override with `spur task update <wbs> done --force-done --reason "<why>"`. Docs-only pipelines (`docs-pipeline.yaml`) meet the same layer: read-only measured verification
+(answer file + `spur task verdict`) writes the standard `.spur/run/<wbs>-verdict.json` artifact
+under proof-input digest bracketing; missing or non-PASS evidence is a refusal, never a synthetic
+PASS stub. |
 | 2 | **Provenance guard** (`lifecycle-adapter.ts`) | No pipeline-kind run link exists for `<wbs>`. | Run `/sp:dev-run <wbs>` through the full pipeline, use `/sp:dev-run <wbs> --mode implement --auto --next` for the explicit step chain, or record the audited bypass with `SPUR_PROVENANCE_OVERRIDE=1`. |
 | 3 | **Review L3** (`task-check.ts`) | `### Review` is empty, placeholder-only, or lacks a populated P1–P4 findings table. | Run `/sp:dev-review <wbs>`; verify cannot write Review because of the Step 10 prohibition above. |
 
@@ -170,7 +173,7 @@ transition to `done`.
 > The verify skill writes this shape automatically — operators only need it when hand-authoring
 > an answer file or debugging an UNKNOWN verdict.
 
-> **Corpus baseline discipline (`corpus-check`).** `corpus-check` sweeps every task/feature and fails on any structural finding outside `config/corpus-baseline.json`. The baseline is two-sided: an unlisted finding fails, **and** a listed entry that no longer reproduces fails. When introducing or tightening finding rules, reconcile the fallout in the same commit (constitution **T10**).
+> **Finding-rule discipline (ADR-108).** When checker policy changes, run focused tests and one explicit unsuppressed `bun run corpus-check` audit; record/reconcile essential failures without waivers (T10). Ordinary corpus commit prep checks changed tasks/features and their required linked evidence, not the corpus (T11). The baseline and regenerators remain deleted; tests are not a substitute for the explicit policy-change audit.
 >
 > **Transition-shim discipline (`transition-shim-check`, task 0541 / ADR-058).** Wired as an early step of `spur-check` / `spur-check-new` (second, after `link-check` and before `lint`) so a shim violation fails in ~0.3 s rather than after the test run. Two-sided against `config/transition-shims.json`: an `@transition-shim(<id>)` marker with no manifest entry fails as a **new unregistered shim**, **and** a listed entry whose marker is gone from source fails as a **stale entry**. Emptying the manifest is the definition of the agent-role transition being complete. A removal condition must be objectively checkable against the repository. Shapes: `docs/04_DESIGN.md` §2.5.
 
@@ -188,4 +191,3 @@ transition to `done`.
 > failure is not yours. This costs seconds and mutates nothing — do **not** `git stash` to get a
 > clean baseline on a shared working tree. Treat any failure that does *not* name a port/listen/`ps`
 > cause as yours until proven otherwise; the count is a moving baseline, not a constant.
-

package/plugins/sp/skills/wayfinder/SKILL.md

@@ -147,7 +147,7 @@ Invoked when a map already exists (operator provides the feature ID). A ticket i
    — no task is claimed, and it does not consume the session's one ticket.
 
 5. **Record the resolution.** Post the answer in the task body, then `spur task update <wbs> done`. Append one line to the map's **## Decisions so far**: `- [<WBS> <title>](path) — <one-line gist of the answer>`.
-6. **Graduate fog into new tickets.** Any fog the answer has made specifiable becomes fresh child tasks (create-then-wire). Clear each graduated patch from **### Not yet specified** so it lives only as its new ticket. Doing half of this — deleting the fog without creating the ticket — destroys the only record the work was ever identified, so `corpus-check` fails the branch (`corpus.ungraduated-fog`) unless the removal is matched by a new/re-parented ticket or a line in **### Out of scope**.
+6. **Graduate fog into new tickets.** Any fog the answer has made specifiable becomes fresh child tasks (create-then-wire). Clear each graduated patch from **### Not yet specified** so it lives only as its new ticket. Doing half of this — deleting the fog without creating the ticket — destroys the only record the work was ever identified; the `corpus.ungraduated-fog` sweep retired in 0775 — enforcement is review-time discipline.
 7. **Rule out mis-scoped tickets.** If the answer reveals a ticket sits beyond the destination, close it and add one line to **### Out of scope** (the gist + why it's out of scope, linking the closed ticket). A scope boundary is not a step on the route — it stays out of **## Decisions so far**.
 8. **Stop after ONE ticket.** Never resolve more than one per session.