@gobing-ai/spur 0.3.74 → 0.3.76

package/plugins/sp/skills/spur-cli/references/tasks.md

@@ -187,7 +187,9 @@ spur task record 0040 --verdict-file .spur/run/0040-verdict.json --solution-from
 - **`--solution-from-diff`** backfills `Solution` from `git diff -U0` hunk headers **only when the
   Solution section is still bare** — a safety net, not an overwrite.
 - **`--transition <status>`** optionally advances the lifecycle after writing (e.g. `testing`).
-  `record` **never transitions to `done`** — the `testing→done` gate stays in the workflow (0108).
+  `--transition done` is a **guarded** completion path: it requires a PASS verdict, auto-walks
+  `wip → testing → done`, and auto-creates the pipeline run-link (0436 R4); a non-PASS verdict to
+  `done` errors instead of transitioning, and the normal done gates still apply (0108).
 
 The verdict shape (`wbs`, `verdict`, `requirements[]`, `checks[]`) and the rendered tables are
 documented in [tasks/verbs.md](tasks/verbs.md).

package/plugins/sp/skills/spur-cli/references/workflows.md

@@ -209,7 +209,7 @@ spur workflow run ./workflows/approval.yaml --steer                # interactive
   are exclusive (exit `2`); `--silent` cannot combine with either (exit `2`).
 - **`--detail <level>`** sets human verbosity: `minimal` (state changes only), `invocation` (default;
   per-step headers), `full` (transitions + correlation). `--verbose` is shorthand for `--detail full`.
-- **`--trace-file`** appends a redacted, schema-versioned JSONL trace under `.spur/runs/workflow/`
+- **`--trace-file`** appends a redacted, schema-versioned JSONL trace under `.spur/workflow/`
   for post-run analysis - independent of human/JSON output.
 - **`--no-log`** opts out of writing the consolidated all-in-one run log (`.spur/run/<RUNID>.log`).
   By default the log is written **and retained** after the run ends; this flag skips it entirely
@@ -280,7 +280,7 @@ not advertise `--json-envelope` because its JSON projection is a kept-raw docume
 | `--silent` | Suppress all routine output; errors still set a non-zero exit status. |
 | `--verbose` | Include transitions and correlation diagnostics in human progress (implies `--detail full`). |
 | `--detail <level>` | Human detail level: `minimal`, `invocation` (default), or `full`. |
-| `--trace-file` | Append a redacted schema-versioned JSONL trace under `.spur/runs/workflow/`. |
+| `--trace-file` | Append a redacted schema-versioned JSONL trace under `.spur/workflow/`. |
 | `--no-log` | Opt out of writing the consolidated `.spur/run/<RUNID>.log` (retained by default; propagates to `--async` workers). |
 | `--steer` | Accept in-process steering commands on stdin at declared action boundaries (sync only; incompatible with `--json`/`--async`). |
 
@@ -335,7 +335,7 @@ redirecting `agent.run` stages (ADR-047).
 - **Run-log reclamation** (0429): removes retained `.spur/run/<RUNID>.log` files whose mtime is older
   than `workflow.logRetentionDays` in `.spur/config.yaml` (default 30 days; integer days, not minutes).
   Age is the only gate; best-effort deletes never abort the rest. Never touches
-  `.spur/runs/workflow/<RUNID>.jsonl` or `*-partial.md`.
+  `.spur/workflow/<RUNID>.jsonl` or `*-partial.md`.
 - **`--logs`** scopes to log reclamation only (skips stale-run finalization). `--dry-run` applies to
   both scopes (lists what would be removed, writes nothing). `--json` returns
   `{ olderThanMinutes, dryRun, cleaned, logs: { retentionDays, dryRun, reclaimed, failures } }` (with

package/plugins/sp/skills/spur-dev/references/cross-cutting.md

@@ -652,21 +652,35 @@ Field semantics (enforced by `parseCheckpointMetadata` / `checkpointStaleness`):
   up once retention expires.
 - `source_commit` pins repository HEAD at write time; drift staleness is reported, not hidden.
 - `artifacts` lists referenced run files; a missing artifact makes the checkpoint stale.
-- Writers: write after every HITL gate decision, phase transition, and terminal state; overwrite
-  the same file on resume (`session_id` = `<date>-<wbs-or-feature>`).
+
+**Writer cadence (0784 R4).** There is exactly one canonical writer: the `task-pipeline` done
+state's terminal checkpoint (`status: done`, real HEAD, run id from `$__runId`, and `$wbs`-expanded
+artifact paths). It is a plain `shell` step — checkpoints are working memory, not CLI-gated corpus.
+The `feature-dev`, `wrapup-pipeline`, and `idea-pipeline` pipelines used to echo pseudo-checkpoints
+("checkpoint: <workflow> done ...") that violated the canonical schema; those writers were removed
+in 0784 — the persisted run row is the authoritative terminal record, and a non-canonical echo
+cannot be resumed, routed, or reclaimed safely.
+
+**Engine state vs checkpoint status (0784 R3).** The persisted run row's status is authoritative;
+a checkpoint's `status` is an advisory projection written by consumers. On resume
+(`workflow continue`), a checkpoint associated with the paused run must project a nonterminal
+engine state — `pending`, `running`, or `approved` are accepted; `done`/`failed`/`cancelled`/
+`skipped`, a missing status, or any unknown value refuse the resume with a named reason. The
+engine owns no persisted `paused` checkpoint status.
 
 **Write checkpoints after:**
 
-- Every HITL gate decision (approved/rejected/deferred).
-- Every phase transition in `task-pipeline`, `feature-dev`, `idea-pipeline`, and
-  `wrapup-pipeline`.
-- Every terminal state (`done`, `failed`, `cancelled`, `skipped`).
+- Terminal task completion in `task-pipeline` (the canonical writer above).
+- Any additional consumer-specific checkpoints you genuinely need for local resume; keep the
+  canonical schema — non-canonical files are ignored by routing and cleanup.
 
 **Read checkpoints when:**
 
 - `/sp:dev-run --continue` or `/sp:dev-runall --continue` is used.
 - The operator asks to resume a task or feature.
-- A workflow run is paused and later continued (`spur workflow continue <run-id>`).
+- A workflow run is paused and later continued (`spur workflow continue <run-id>`). Resume
+  validates freshness in the run's recorded launch workdir (0784 R1/R3): artifacts resolve relative
+  to that workdir, and git HEAD is probed there — never in the ambient process cwd.
 
 **Rules:**
 
@@ -678,7 +692,8 @@ Field semantics (enforced by `parseCheckpointMetadata` / `checkpointStaleness`):
 - **Retention.** Terminal checkpoints older than `workflowLogRetentionDays` with no active run are
   reclaimed by `spur workflow clean` (task 0711 R5–R8); non-terminal checkpoints are always kept.
 - **Not a validated corpus.** Checkpoints are working memory. They are overwritten when a session
-  resumes and re-checkpoints. They are NOT authoritative task state — the task file is.
+  resumes and re-checkpoints. They are NOT authoritative task state — the task file and the
+  persisted run row are.
 - **One file per session.** The `session_id` is `<date>-<wbs-or-feature>`. A resumed session
   overwrites the same file.
 - **Operator-readable.** The YAML frontmatter is machine-parseable; the body is free-form markdown

package/plugins/sp/skills/spur-dev/references/dev-operations.md

@@ -237,11 +237,11 @@ must not be changed without updating the backing skill.
 - **Inputs:**
   - `--feature <id>` **or** `--tasks <selector>` (required — at least one). `--feature` is sugar for `--tasks feature:<id>` (shared selector grammar: explicit WBS list, `feature:<id>`, `ready`, status pseudo-list — [execution-batch.md](execution-batch.md) Step 1). If both are present, `--tasks` wins (one-line note in the report).
   - Shared refine flags (passed through to each per-task refine): `--focus <mode>`, `--description <text>`, `--depth <standard|ready>`, `--agent <inline|auto|name>`, `--auto`.
-  - Batch-only flags: `--keep-going` (continue independents after a failure; default halt), `--status <s>` (filter resolved membership; default **`backlog,todo`** — planning-side fill candidates), `--json` (machine-readable batch report).
+  - Batch-only flags: `--keep-going` (continue independents after a failure; default halt), `--status <s>` (filter resolved membership; default **`backlog` + `todo`** — planning-side fill candidates. The filter is applied in-agent against the frozen set; `spur task list --status` takes exactly one canonical status per call (see `execution-batch.md` Step 1).), `--json` (machine-readable batch report).
 - **Backing:** `sp:spur-dev` skill, `refineall` operation (orchestrates; per-task body is the single-task `refine` operation — never a second refine implementation).
 - **Behavior:**
   1. Resolve + **freeze** the set at kickoff (never re-query membership mid-batch).
-  2. Apply `--status` filter (default `backlog,todo`). Tasks already `done`/`cancelled`/`testing` are excluded unless the operator widens `--status`. Report each exclusion with reason.
+  2. Apply `--status` filter (default `backlog` + `todo`; applied in-agent against the frozen set; `spur task list --status` takes exactly one canonical status per call — see `execution-batch.md` Step 1). Tasks already `done`/`cancelled`/`testing` are excluded unless the operator widens `--status`. Report each exclusion with reason.
   3. Topo-sort by `dependencies[]` (Kahn, WBS-ascending tie-break). Cycle → abort entire batch before any refine. Out-of-set deps: `done` → allow; else → block subtree (same as runall).
   4. For each WBS in order: invoke single-task refine with shared flags **including `--depth`**. Under `--auto` + **`--depth standard`** (default), the per-task **L3 pre-synthesis SKIP gate** still applies. Under **`--depth ready`**, each task runs the implement-ready checklist (no L3-only SKIP).
   5. Failure policy: **stop-the-batch** (default) or `--keep-going` (skip in-batch dependents of a failed refine; continue independents).
@@ -341,7 +341,7 @@ must not be changed without updating the backing skill.
   - `--approve-taste` — with `--auto`, skip **all** remaining taste pauses this run (idea-eval + design-approval). Sets `idea_approved=true` and `design_approved=true`.
     Aliases (prefer `--approve-taste`): `--idea-approved` → `idea_approved`; `--design-approved` → `design_approved`. There is **no** `--design` force flag.
 - **Backing:** `idea-pipeline.yaml` through the inline driver for omitted/`inline`, or `spur workflow run idea-pipeline.yaml --async` for `auto`/name.
-- **Behavior:** Builds vars from the table above and drives the idea pipeline. Flow: discovery → **idea-eval** (taste; reject → cancelled) → feature-create → ac-generate → feature-check → system-design (conditional) → design-approval (taste) → decompose → batch-create → handoff. STOPS at handoff — no task execution, no pipeline nesting. Headless runs use one `trace --follow`; cancellation is reported stopped only when `workflow cancel --json` returns `killed: true`.
+- **Behavior:** Builds vars from the table above and drives the idea pipeline. Flow: discovery → **idea-eval** (taste; reject → cancelled) → feature-create → ac-generate → feature-check → system-design (conditional) → design-approval (taste) → decompose → batch-create (`--skip-ready`) → ready-prepare (ready checklist per created task + ready-evidence sidecar, 0788) → handoff. STOPS at handoff — no task execution, no pipeline nesting. Headless runs use one `trace --follow`; cancellation is reported stopped only when `workflow cancel --json` returns `killed: true`.
 - **Delegation:** Host-session inline driver by default; explicit executor selection uses the async workflow worker.
 - **Idea-evaluation gate:** After discovery, operator reviews `.spur/run/idea-eval-report.md` ([idea-evaluation.md](idea-evaluation.md)). Approve continues; reject/cancel → no feature. Under `--auto`, still pauses unless taste pre-cleared (`--approve-taste` / alias). Enhanced idea is a sidecar — `vars.idea` is not overwritten.
 - **Design package (`--skip-design` only):**

package/plugins/sp/skills/spur-dev/references/gate-checklists.md

@@ -149,7 +149,10 @@ passed, so provenance denied first and Review L3 denied on the retry.
 
 | # | Gate layer | Triggers denial when | Remediation |
 |---|------------|----------------------|-------------|
-| 1 | **Strict-core + verdict artifact** (`spur task check <wbs> --strict-core` + `done-transition-guard.ts`) | The strict-core check fails, or `.spur/run/<wbs>-verdict.json` is **missing** or has a non-PASS aggregate. **Missing artifact is a deny** (not a silent allow — closes the 0349 "done without verdict" class). The aggregate is recomputed from requirement/AC rows; the harsher of stored and computed wins. | Re-run `/sp:dev-verify <wbs>` until PASS (writes the artifact), or explicitly override with `spur task update <wbs> done --force-done --reason "<why>"`. Docs-only pipelines write a docs PASS stub under `.spur/run/` before `done` (see `docs-pipeline.yaml`). |
+| 1 | **Strict-core + verdict artifact** (`spur task check <wbs> --strict-core` + `done-transition-guard.ts`) | The strict-core check fails, or `.spur/run/<wbs>-verdict.json` is **missing** or has a non-PASS aggregate. **Missing artifact is a deny** (not a silent allow — closes the 0349 "done without verdict" class). The aggregate is recomputed from requirement/AC rows; the harsher of stored and computed wins. | Re-run `/sp:dev-verify <wbs>` until PASS (writes the artifact), or explicitly override with `spur task update <wbs> done --force-done --reason "<why>"`. Docs-only pipelines (`docs-pipeline.yaml`) meet the same layer: read-only measured verification
+(answer file + `spur task verdict`) writes the standard `.spur/run/<wbs>-verdict.json` artifact
+under proof-input digest bracketing; missing or non-PASS evidence is a refusal, never a synthetic
+PASS stub. |
 | 2 | **Provenance guard** (`lifecycle-adapter.ts`) | No pipeline-kind run link exists for `<wbs>`. | Run `/sp:dev-run <wbs>` through the full pipeline, use `/sp:dev-run <wbs> --mode implement --auto --next` for the explicit step chain, or record the audited bypass with `SPUR_PROVENANCE_OVERRIDE=1`. |
 | 3 | **Review L3** (`task-check.ts`) | `### Review` is empty, placeholder-only, or lacks a populated P1–P4 findings table. | Run `/sp:dev-review <wbs>`; verify cannot write Review because of the Step 10 prohibition above. |
 

package/schemas/spur-config.schema.json

@@ -165,6 +165,10 @@
                                 "type": "string",
                                 "enum": ["cheap", "standard", "capable-1", "capable-2", "capable-3"],
                                 "description": "Capability tier for stage-registry adaptive model routing (ADR-033, 0343). Live values: cheap | standard | capable-1 | capable-2 | capable-3 (1=low output quality, 3=high within the capable band). A stage starts on the cheapest eligible executor meeting its model_policy min_tier. Bare legacy `capable` is accepted at runtime (zod preprocess \u2192 capable-1) during the deprecation window but is not part of this editor enum."
+                            },
+                            "disabled": {
+                                "type": "boolean",
+                                "description": "Routing kill-switch (111): a disabled profile never serves a role, team, stage, or explicit selection, and doctor inventories it without probing. Omitted = enabled; only true/false accepted (no string/number/null coercion)."
                             }
                         }
                     }