@gobing-ai/spur 0.3.76 → 0.3.77

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.3.76",
+            "version": "0.3.77",
             "source": "./plugins/sp"
         }
     ]

package/config/plugin-scripts.json

@@ -36,6 +36,10 @@
             "contract": "standard",
             "twin": "history-anatomy-cache.mjs"
         },
+        {
+            "rel": "inline-run-setup.ts",
+            "contract": "repo-only"
+        },
         {
             "rel": "inline-pipeline-parity-check.ts",
             "contract": "repo-only"

package/config/rules/strict/runtime-boundaries.yaml

@@ -71,6 +71,7 @@ rules:
             - "packages/config/src/loader.ts" # sync resolveConfigFile() / schema specifier lookup
             - "packages/config/src/executor-update.ts" # atomic single-entry config update (task 0797): O_EXCL lock, fsync'd tmp+rename commit, lstat symlink refusal, mode preservation — ts-runtime FileSystem seam has no lstat/fsync/chmod/O_EXCL
             - "packages/app/src/services/project-start.ts" # sync CLI binary path checks before daemon spawn
+            - "apps/cli/src/commands/serve.ts" # sync resolveServeCwd() directory validation before server startup (task 0805 R2); mirrors task.ts sync-template exemption
 
             # Synchronous template & workflow resolvers:
             - "apps/cli/src/commands/task.ts" # sync loadTemplateContent/Bodies callbacks

package/config/workflows/task-pipeline.yaml

@@ -270,12 +270,20 @@ states:
           # WorkflowAppService.run(); the wbs fallback keeps a driver-less invocation from writing to
           # a bare "-route-reason.txt". The log line carries the run id for the same reason — an
           # unattributed append is log scraping, which R5 explicitly rejects as evidence.
+          # 0804 R8: the run id must be a single safe filename component before it
+          # becomes REASON_FILE — unresolved interpolation ($ { } vars.), path
+          # separators and dot traversal are a failed action (nonzero, no artifact).
+          # NOTE: no `#` comments inside the folded scalar — `>-` joins all same-indent
+          # lines into ONE shell line, so an in-scalar `#` comments out the rest of the
+          # command (the original R8 draft broke exactly this way; the case statement
+          # must stay one line).
           - kind: shell
             options:
                 command: >-
                     mkdir -p .spur/run .spur/memory &&
                     RUN_ID="$__runId" &&
                     if [ -z "$RUN_ID" ]; then RUN_ID="pipeline-$wbs"; fi &&
+                    case "$RUN_ID" in *'$'*|*'{'*|*'}'*|*vars.*|*/*|*'\'*|*..*) echo "route-reason: refusing unsafe run id: $RUN_ID" >&2; exit 1 ;; *) : ;; esac &&
                     REASON_FILE=".spur/run/$RUN_ID-route-reason.txt" &&
                     if [ "$mode" = "fast" ]; then
                       echo "fast:evidence complete+consistent" > "$REASON_FILE";
@@ -335,7 +343,7 @@ states:
                       RETRY_OUTPUT=$("$@" 2>&1); RETRY_RC=$?;
                       printf '%s\n' "$RETRY_OUTPUT";
                       if [ "$RETRY_RC" -eq 0 ]; then return 0; fi;
-                      if ! printf '%s' "$RETRY_OUTPUT" | grep -Eq 'ENOENT|EBUSY|ENOTEMPTY|database is locked'; then return "$RETRY_RC"; fi;
+                      if ! printf '%s' "$RETRY_OUTPUT" | grep -Eq 'ENOENT|EBUSY|ENOTEMPTY|database is locked|SQLite database .*is busy|SQLITE_BUSY'; then return "$RETRY_RC"; fi;
                       sleep 2;
                       RETRY_SECOND_OUTPUT=$("$@" 2>&1); RETRY_RC=$?;
                       printf '%s\n' "$RETRY_SECOND_OUTPUT";
@@ -431,7 +439,7 @@ states:
                       ATTEMPT_LOG="$LOG_FILE.attempt-$gate_attempt";
                       sh -c "$qualityGateCmd" > "$ATTEMPT_LOG" 2>&1; gate_rc=$?;
                       gate_locked=0;
-                      grep -q 'SQLiteError: database is locked' "$ATTEMPT_LOG" && gate_locked=1;
+                      grep -Eq 'SQLiteError: database is locked|SQLite database .*is busy|SQLITE_BUSY' "$ATTEMPT_LOG" && gate_locked=1;
                       cat "$ATTEMPT_LOG" >> "$LOG_FILE";
                       rm -f "$ATTEMPT_LOG";
                       if [ "$gate_rc" -eq 0 ] || [ "$gate_locked" -ne 1 ] || [ "$gate_attempt" -ge 5 ]; then break; fi;
@@ -547,7 +555,7 @@ states:
                         ATTEMPT_LOG="$LOG_FILE.attempt-$gate_attempt";
                         sh -c "$qualityGateCmd" > "$ATTEMPT_LOG" 2>&1; gate_rc=$?;
                         gate_locked=0;
-                        grep -q 'SQLiteError: database is locked' "$ATTEMPT_LOG" && gate_locked=1;
+                        grep -Eq 'SQLiteError: database is locked|SQLite database .*is busy|SQLITE_BUSY' "$ATTEMPT_LOG" && gate_locked=1;
                         cat "$ATTEMPT_LOG" >> "$LOG_FILE";
                         rm -f "$ATTEMPT_LOG";
                         if [ "$gate_rc" -eq 0 ] || [ "$gate_locked" -ne 1 ] || [ "$gate_attempt" -ge 5 ]; then break; fi;
@@ -747,7 +755,7 @@ states:
                       RETRY_OUTPUT=$("$@" 2>&1); RETRY_RC=$?;
                       printf '%s\n' "$RETRY_OUTPUT";
                       if [ "$RETRY_RC" -eq 0 ]; then return 0; fi;
-                      if ! printf '%s' "$RETRY_OUTPUT" | grep -Eq 'ENOENT|EBUSY|ENOTEMPTY|database is locked'; then return "$RETRY_RC"; fi;
+                      if ! printf '%s' "$RETRY_OUTPUT" | grep -Eq 'ENOENT|EBUSY|ENOTEMPTY|database is locked|SQLite database .*is busy|SQLITE_BUSY'; then return "$RETRY_RC"; fi;
                       sleep 2;
                       RETRY_SECOND_OUTPUT=$("$@" 2>&1); RETRY_RC=$?;
                       printf '%s\n' "$RETRY_SECOND_OUTPUT";
@@ -794,7 +802,7 @@ states:
                       RETRY_OUTPUT=$("$@" 2>&1); RETRY_RC=$?;
                       printf '%s\n' "$RETRY_OUTPUT";
                       if [ "$RETRY_RC" -eq 0 ]; then return 0; fi;
-                      if ! printf '%s' "$RETRY_OUTPUT" | grep -Eq 'ENOENT|EBUSY|ENOTEMPTY|database is locked'; then return "$RETRY_RC"; fi;
+                      if ! printf '%s' "$RETRY_OUTPUT" | grep -Eq 'ENOENT|EBUSY|ENOTEMPTY|database is locked|SQLite database .*is busy|SQLITE_BUSY'; then return "$RETRY_RC"; fi;
                       sleep 2;
                       RETRY_SECOND_OUTPUT=$("$@" 2>&1); RETRY_RC=$?;
                       printf '%s\n' "$RETRY_SECOND_OUTPUT";
@@ -1016,8 +1024,13 @@ transitions:
       guard:
           kind: shell
           options:
+              # 0804 R6: `--as done` projects the check onto the done target so open
+              # Plan/AC checkboxes fail HERE — before the done action runs — mirroring
+              # the CLI's own target-aware `--no-lifecycle` backstop (F92 R3). No `#`
+              # comments inside the folded scalar: `>-` joins same-indent lines into
+              # one shell line.
               command: >-
-                  $spurBin task check $wbs &&
+                  $spurBin task check $wbs --as done &&
                   test "$(jq -r .verdict .spur/run/$wbs-verdict.json 2>/dev/null)" = PASS &&
                   test "$(jq -r '.proof.digest // ""' .spur/run/$wbs-verdict.json 2>/dev/null)" = "$proofDigest"
     - from: record

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.3.76",
+    "version": "0.3.77",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",

package/plugins/sp/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "sp",
-    "version": "0.3.76",
+    "version": "0.3.77",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics.",
     "extensions": {
         "pi": ["./hooks/pi/guard-extension.ts"]

package/plugins/sp/scripts/inline-run-setup.ts

@@ -0,0 +1,198 @@
+#!/usr/bin/env bun
+/**
+ * inline-run-setup — authoritative inline full-pipeline run identity (task 0804 R1).
+ *
+ * Unlike the subprocess path (`spur workflow run`), the interactive inline driver
+ * allocated a run id but never persisted an authoritative `runs` row, so bound
+ * `run.artifact` registration (0785 R3) correctly refused every inline record. This
+ * script is the thin delegate the driver now runs at Run setup: it resolves the spur
+ * repo checkout from the SPUR_BIN chain, imports the real app service
+ * (`createOrAttachInlineRun` / `openInlineRunProjectDb` from packages/app), and lets it
+ * resolve the SAME project-or-bundled definition the engine would launch, compute the
+ * canonical definition digest with the exported hash machinery, and create-or-attach the
+ * run row through the existing engine persistence adapter.
+ *
+ * The script itself contains NO direct SQL, NO second hasher and NO persistence policy —
+ * every rule lives in packages/app (0804 D1). On a bundle-only install there is no repo
+ * checkout to import the app service from, so the setup fails closed with actionable
+ * remediation guidance (point SPUR_BIN at a repo checkout); it never falls back to an
+ * unbound run (0804 R1 failure policy).
+ *
+ * Outcome JSON is written to `.spur/run/<run-id>-inline-setup.json` so the driver can
+ * seed the inline var overlay (`__runId`, `__definitionDigest`) that proof capture and
+ * bound registration verify against. Exit 0 = authoritative identity ready (created or
+ * idempotently attached); exit 1 = fail closed, the driver must stop.
+ *
+ * Repo-only script (ADR-065): it imports the app workspace source, so it runs under bun
+ * against a monorepo checkout only — the same posture as task-size-precheck.ts and
+ * task-evidence-precheck.ts.
+ *
+ * Usage:
+ *   bun plugins/sp/scripts/inline-run-setup.ts --run-id <id> --file <definition> [--spur-bin <path>]
+ *
+ * Env: SPUR_BIN
+ */
+
+import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+/** Outcome document written to `.spur/run/<run-id>-inline-setup.json`. */
+interface SetupOutcome {
+    readonly ok: boolean;
+    readonly runId: string;
+    readonly attached?: boolean;
+    readonly definitionDigest?: string;
+    readonly workflowName?: string;
+    readonly workflowVersion?: string | null;
+    readonly resolvedPath?: string;
+    readonly layer?: string;
+    readonly workdir?: string;
+    readonly status?: string;
+    readonly error?: string;
+}
+
+function usage(): never {
+    console.error(
+        'Usage: bun plugins/sp/scripts/inline-run-setup.ts --run-id <id> --file <definition> [--spur-bin <path>]',
+    );
+    process.exit(1);
+}
+
+/**
+ * The run id becomes a filename under `.spur/run/` (`<run-id>-inline-setup.json`), so it must be a
+ * single safe filename component before anything is written — the same guard class the
+ * task-pipeline.yaml route-reason action applies to `$__runId` (task 0804 R8). The allowlist
+ * refuses path separators, dot traversal (leading `.`), unresolved interpolation (`$`/`{`/`}`) and
+ * every other shell/unspecified metachar; valid UUID/timestamp-slug ids pass.
+ */
+const SAFE_RUN_ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/;
+
+function refuseUnsafeRunId(runId: string): never {
+    // Refuse BEFORE any outcome write: an unsafe id must never reach
+    // `.spur/run/<run-id>-inline-setup.json` (no traversal, no unintended file).
+    console.error(`inline-run-setup: refusing unsafe run id: ${runId}`);
+    console.error(
+        '  The run id must be a single safe filename component (alphanumeric/._-, no leading dot, ' +
+            'no path separators, interpolation or traversal; same class as the task-pipeline ' +
+            'route-reason guard, task 0804 R8). Allocate a fresh run id (uuid or timestamp slug) and retry.',
+    );
+    process.exit(1);
+}
+
+/**
+ * Resolve the spur repo checkout the same way the other prechecks resolve the CLI
+ * (--spur-bin > SPUR_BIN > monorepo-local CLI entry > PATH `spur`), then derive the repo
+ * root from the resolved main module. `bun <repo>/apps/cli/src/index.ts` → repo root is
+ * three levels up. A bundle-only install (`spur` on PATH, a bundled `spur.js`, or a spur
+ * binary without the app workspace) has no app entry to import — the caller fails that
+ * closed with remediation guidance.
+ */
+function resolveAppEntry(
+    spurBin: string,
+): { entry: string; repoRoot: string } | { entry: null; repoRoot: null; chain: string } {
+    let candidates: string[] = [];
+    if (spurBin !== '') {
+        candidates = [spurBin];
+    } else {
+        // scripts/ -> plugins/sp/ -> <repo>/apps/cli/src/index.ts (fileURLToPath — raw
+        // pathname breaks on %-encoded paths, e.g. spaces in the checkout directory).
+        candidates = [fileURLToPath(new URL('../../../apps/cli/src/index.ts', import.meta.url))];
+    }
+    for (const candidate of candidates) {
+        const tokens = candidate.split(/\s+/).filter(Boolean);
+        // The main module is the last path-like token (tolerates `bun <path>` /
+        // `bun run <path>` lead tokens). Only a TypeScript source entry proves a repo
+        // checkout; a bundled `spur.js` or a bare `spur` binary does not.
+        const mainModule = [...tokens].reverse().find((t) => t.endsWith('.ts'));
+        if (mainModule === undefined || !existsSync(mainModule)) continue;
+        // <repo>/apps/cli/src/index.ts → repo root; then require the app package source.
+        const srcDir = dirname(mainModule);
+        const repoRoot = resolve(srcDir, '..', '..', '..');
+        const appEntry = join(repoRoot, 'packages', 'app', 'src', 'index.ts');
+        if (existsSync(appEntry)) return { entry: appEntry, repoRoot };
+        return { entry: null, repoRoot: null, chain: `${candidate} (no ${appEntry})` };
+    }
+    return { entry: null, repoRoot: null, chain: spurBin === '' ? 'PATH spur (bundle-only install)' : spurBin };
+}
+
+function writeOutcome(runId: string, outcome: SetupOutcome): void {
+    const runDir = join(process.cwd(), '.spur', 'run');
+    if (!existsSync(runDir)) mkdirSync(runDir, { recursive: true });
+    writeFileSync(join(runDir, `${runId}-inline-setup.json`), `${JSON.stringify(outcome, null, 4)}\n`);
+}
+
+async function main(): Promise<void> {
+    let runId = '';
+    let file = '';
+    let spurBin = process.env.SPUR_BIN ?? '';
+    const argv = process.argv.slice(2);
+    for (let i = 0; i < argv.length; i++) {
+        if (argv[i] === '--run-id') runId = argv[++i] ?? '';
+        else if (argv[i] === '--file') file = argv[++i] ?? '';
+        else if (argv[i] === '--spur-bin') spurBin = argv[++i] ?? spurBin;
+    }
+    if (runId.trim() === '' || file.trim() === '') usage();
+    if (!SAFE_RUN_ID_RE.test(runId)) refuseUnsafeRunId(runId);
+
+    const { entry, repoRoot, chain } = resolveAppEntry(spurBin);
+    if (entry === null || repoRoot === null) {
+        const outcome: SetupOutcome = {
+            ok: false,
+            runId,
+            error:
+                `inline run setup failed closed: no monorepo checkout of spur is reachable via ${chain}. ` +
+                'The authoritative run identity must be persisted by the app service ' +
+                '(packages/app/src/services/inline-run-setup.ts); a bundle-only install cannot do this. ' +
+                'Remediation: point SPUR_BIN at a repo checkout, e.g. ' +
+                'SPUR_BIN="bun /path/to/spur/apps/cli/src/index.ts". The pipeline must not run unbound.',
+        };
+        writeOutcome(runId, outcome);
+        console.error(`inline-run-setup: FAIL for run ${runId}`);
+        console.error(`  ${outcome.error}`);
+        process.exit(1);
+    }
+
+    // Dynamic import by absolute path: the app source graph resolves its own workspace
+    // dependencies from the repo checkout, never from this plugin script's location.
+    const app = (await import(entry)) as {
+        createOrAttachInlineRun: (input: {
+            workdir: string;
+            getDb: () => Promise<unknown>;
+            file: string;
+            runId: string;
+        }) => Promise<SetupOutcome & { ok: boolean }>;
+        openInlineRunProjectDb: (workdir: string) => Promise<{ adapter: unknown; close: () => void }>;
+    };
+
+    const workdir = process.cwd();
+    const projectDb = await app.openInlineRunProjectDb(workdir);
+    let exitCode = 0;
+    try {
+        const result = await app.createOrAttachInlineRun({
+            workdir,
+            getDb: async () => projectDb.adapter,
+            file,
+            runId,
+        });
+        writeOutcome(runId, result);
+        if (!result.ok) {
+            console.error(`inline-run-setup: FAIL for run ${runId}`);
+            console.error(`  ${result.error}`);
+            exitCode = 1;
+        } else {
+            console.error(
+                `inline-run-setup: ${result.attached ? 'attached' : 'created'} run ${runId} ` +
+                    `(${result.workflowName}, layer ${result.layer}, digest ${result.definitionDigest}, status ${result.status})`,
+            );
+        }
+    } finally {
+        projectDb.close();
+    }
+    process.exit(exitCode);
+}
+
+main().catch((e: unknown) => {
+    console.error(`inline-run-setup: FAIL — ${e instanceof Error ? e.message : String(e)}`);
+    process.exit(1);
+});

package/plugins/sp/scripts/verify-answer-lint.ts

@@ -257,29 +257,124 @@ function extractRequirementIds(taskContent: string): string[] {
     return [...ids];
 }
 
-function extractAcIdentities(taskContent: string, featureContent: string | null): string[] {
-    const identities = new Set<string>();
+// ─── Canonical AC identity resolution (task 0804 R4) ─────────────────────────
+
+/**
+ * Strip the tolerated AC-id wrappers (bracket tags, `Scenario:` prefix) until
+ * fixpoint — the shared first step of `normalizeAcTitle` and the `AC-N` alias
+ * path in `resolveAcIdentity`.
+ */
+function stripAcWrappers(title: string): string {
+    let out = title.trim();
+    let prev: string;
+    do {
+        prev = out;
+        out = out
+            .replace(/^\[[^\]]*\]\s*/, '')
+            .replace(/\s*\[[^\]]*\]\s*$/, '')
+            .replace(/^Scenario:\s*/i, '')
+            .trim();
+    } while (out !== prev);
+    return out;
+}
+
+/**
+ * Normalize an AC identity to its canonical key, mirroring the documented
+ * matching behavior of feature-check `rowMatchesScenario` + ac-style-guide
+ * "Four accepted id forms" (exact/bare title, `Scenario:` prefix, bracket
+ * tags, `AC-N` ordinal) without importing that private matcher or adopting
+ * its permissive trailing-Gherkin fallback (0804 R4). Comparison is
+ * case/quote/whitespace-insensitive. A paraphrase normalizes differently
+ * and still fails.
+ */
+function normalizeAcTitle(title: string): string {
+    return stripAcWrappers(title)
+        .replace(/^R\d+\s*[:\-—]?\s*/, '')
+        .toLowerCase()
+        .replace(/[ʼ‘’“”]/g, '')
+        .replace(/\s+/g, ' ')
+        .trim();
+}
+
+/**
+ * Declared AC identities keyed by canonical normalized title, plus the two
+ * AC-N ordinal sources (task scenario list and linked-feature scenario list).
+ * A checklist-declared spelling always wins over the positional alias.
+ */
+interface AcIdentityIndex {
+    /** normalized canonical title → a declared spelling (label, token, or title). */
+    readonly byTitle: Map<string, string>;
+    /** AC-N → task scenario title at that 1-based ordinal. */
+    readonly taskScenarios: string[];
+    /** AC-N → feature scenario title at that 1-based ordinal. */
+    readonly featureScenarios: string[];
+}
+
+function buildAcIdentityIndex(taskContent: string, featureContent: string | null): AcIdentityIndex {
+    const byTitle = new Map<string, string>();
+    // Not named `declare`: Bun's TS transpiler treats a call to an identifier
+    // named `declare` as an ambient-declaration modifier and drops it.
+    const declareIdentity = (spelling: string): void => {
+        const key = normalizeAcTitle(spelling);
+        if (key !== '' && !byTitle.has(key)) byTitle.set(key, spelling);
+    };
     const section = sectionBetween(taskContent, 'Acceptance Criteria');
-    // Checkbox labels (`- [x] AC1 (R1): …`, 0726) and plain bullets (`- AC1: Given …`,
-    // 0713/0727) both yield the label text up to `:` plus its leading token.
     for (const m of section.matchAll(/^[-*]\s+(?:\[[ xX]\]\s+)?(.+?)\s*(?::|$)/gm)) {
         const label = (m[1] ?? '').trim();
         if (!label) continue;
-        identities.add(label);
+        declareIdentity(label);
         const leading = label.split(/\s+/)[0] ?? '';
-        if (leading && leading !== label) identities.add(leading);
+        if (leading && leading !== label) declareIdentity(leading);
     }
-    for (const m of section.matchAll(/^[ \t]*Scenario:\s*(.+)\s*$/gm)) {
-        const title = (m[1] ?? '').trim();
-        if (title) identities.add(title);
-    }
-    if (featureContent !== null) {
-        for (const m of featureContent.matchAll(/^[ \t]*Scenario:\s*(.+)\s*$/gm)) {
-            const title = (m[1] ?? '').trim();
-            if (title) identities.add(title);
+    const scenarioTitles = (content: string): string[] =>
+        [...content.matchAll(/^[ \t]*Scenario:\s*(.+)\s*$/gm)].map((m) => (m[1] ?? '').trim()).filter((t) => t !== '');
+    const taskScenarios = scenarioTitles(sectionBetween(taskContent, 'Acceptance Criteria'));
+    const featureScenarios = featureContent !== null ? scenarioTitles(featureContent) : [];
+    for (const title of [...taskScenarios, ...featureScenarios]) declareIdentity(title);
+    return { byTitle, taskScenarios, featureScenarios };
+}
+
+/** Resolution outcome for one AC row id. */
+type AcIdentityResolution = { ok: true; canonical: string } | { ok: false; error: string };
+
+/**
+ * Resolve an answer-file AC row id to one canonical task identity (0804 R4):
+ * exact/declared title forms first, then the documented `AC-N` positional
+ * alias — accepted only against a real scenario ordinal, and refused with an
+ * actionable diagnostic when task and feature ordinals disagree. Undeclared
+ * `ACn` tokens, paraphrases and invented ordinals never resolve.
+ */
+function resolveAcIdentity(rowId: string, index: AcIdentityIndex): AcIdentityResolution {
+    const canonical = index.byTitle.get(normalizeAcTitle(rowId));
+    if (canonical !== undefined) return { ok: true, canonical };
+    // Strip the tolerated wrappers, then try the documented `AC-N` alias.
+    const stripped = stripAcWrappers(rowId);
+    const ordinal = /^AC-(\d+)$/i.exec(stripped);
+    if (ordinal !== null) {
+        const n = Number(ordinal[1]);
+        const taskTitle = index.taskScenarios[n - 1];
+        const featureTitle = index.featureScenarios[n - 1];
+        const candidates = [...new Set([taskTitle, featureTitle].filter((t): t is string => t !== undefined))];
+        if (candidates.length === 0) {
+            return {
+                ok: false,
+                error:
+                    `AC id "${rowId}" uses the AC-${n} positional alias but no scenario exists at that ordinal ` +
+                    '(task scenario list and linked-feature scenario list) — cite the exact scenario title or checklist label',
+            };
+        }
+        if (candidates.length > 1) {
+            return {
+                ok: false,
+                error:
+                    `AC id "${rowId}" is ambiguous: task AC #${n} ("${taskTitle}") and feature scenario #${n} ` +
+                    `("${featureTitle}") are different scenarios with different ordering — cite the exact title`,
+            };
         }
+        const resolved = index.byTitle.get(normalizeAcTitle(candidates[0] ?? ''));
+        if (resolved !== undefined) return { ok: true, canonical: resolved };
     }
-    return [...identities];
+    return { ok: false, error: '' };
 }
 
 // ─── Main ────────────────────────────────────────────────────────────────────
@@ -341,7 +436,7 @@ function main(): void {
     }
 
     const reqIds = extractRequirementIds(taskContent);
-    const acIdentities = extractAcIdentities(taskContent, featureContent);
+    const acIndex = buildAcIdentityIndex(taskContent, featureContent);
 
     // Requirement rows: completeness, no unknowns, no duplicates, valid status, non-empty evidence.
     const seenReq = new Set<string>();
@@ -358,19 +453,31 @@ function main(): void {
         if (!seenReq.has(id)) add(`missing requirement row for "${id}"`);
     }
 
-    // AC rows: identity must exactly match a checklist label/token or a scenario title;
-    // status and evidence type must normalize; evidence non-empty. AC completeness is the
-    // verifier's authoring contract, not a lint rejection class (0726 R3).
-    const seenAc = new Set<string>();
+    // AC rows: identity must resolve to ONE canonical task AC identity — a
+    // checklist label/token or a scenario title in any ac-style-guide form
+    // (exact/bare title, `Scenario:` prefix, bracket tags, declared AC-N
+    // alias; 0804 R4). Alias-equivalent spellings of the same identity are
+    // duplicates even when the raw strings differ. Status and evidence type
+    // must normalize; evidence non-empty. AC completeness is the verifier's
+    // authoring contract, not a lint rejection class (0726 R3).
+    const seenAc = new Map<string, string>(); // canonical key → first raw row id
     for (const row of tables.acs) {
-        if (!acIdentities.includes(row.id)) {
+        const resolution = resolveAcIdentity(row.id, acIndex);
+        const canonicalKey = resolution.ok ? normalizeAcTitle(resolution.canonical) : null;
+        if (!resolution.ok) {
+            if (resolution.error !== '') add(`line ${row.line}: ${resolution.error}`);
+            else
+                add(
+                    `line ${row.line}: AC ID "${row.id.slice(0, 60)}" matches no task AC checklist label or scenario title ` +
+                        '(accepted forms: exact title, bare title, `Scenario:` prefix, bracket tags, declared AC-N alias)',
+                );
+        } else if (canonicalKey !== null && seenAc.has(canonicalKey)) {
+            const first = seenAc.get(canonicalKey) ?? '';
             add(
-                `line ${row.line}: AC ID "${row.id.slice(0, 60)}" matches no task AC checklist label or scenario title`,
+                `line ${row.line}: duplicate AC row "${row.id.slice(0, 60)}" — alias-equivalent to "${first.slice(0, 60)}"`,
             );
-        } else if (seenAc.has(row.id)) {
-            add(`line ${row.line}: duplicate AC row "${row.id.slice(0, 60)}"`);
         }
-        seenAc.add(row.id);
+        if (canonicalKey !== null && !seenAc.has(canonicalKey)) seenAc.set(canonicalKey, row.id);
         if (normalizeAcStatus(row.status) === null)
             add(`line ${row.line}: invalid AC status "${row.status}" (MET | PARTIAL | UNMET | N/A)`);
         if (normalizeEvidenceType(row.evidenceType) === null)
@@ -396,4 +503,5 @@ function main(): void {
     process.exit(0);
 }
 
-main();
+// CLI entry (guarded so the helpers stay importable for focused tests).
+if (import.meta.main) main();

package/plugins/sp/skills/code-verification/SKILL.md

@@ -117,8 +117,8 @@ assign a per-requirement status:
 | **PARTIAL** | Evidence for part of the requirement only |
 | **UNMET** | No implementation evidence found |
 
-Record the evidence string (repo-relative path `file:line`, e.g. `packages/app/src/services/task-check.ts:42`, command, or test name) per requirement — this is what lands
-in `## Testing`.
+Record the evidence string (repo-relative `file:line`, command, or test name) per requirement —
+this lands in `## Testing`.
 
 **Line-anchor verification (anti-stale-citation rule).** Every `file:line` evidence citation
 written into the Testing table MUST be re-read at the cited lines this run, and the re-read content
@@ -142,6 +142,8 @@ classifies it as external and never raises `L4.stale-line-anchor` for it (R1). D
 that lives in this repo — in-repo evidence MUST use the repo-relative backtick form
 `` `path:line` `` / `` `path:start-end` ``, and citing it in the external form still reports (R2).
 
+**Concrete anchors (0804 R9):** cite existing `file:line`s, never globs — `references/verdict-schema.md`.
+
 ### Step 5 — Acceptance Criteria guard
 
 If the task has a non-empty Acceptance Criteria section, evaluate every checklist item and every

package/plugins/sp/skills/code-verification/references/verdict-schema.md

@@ -110,12 +110,21 @@ For answer files, emit a matching parseable table:
 `Verdict: PARTIAL` first, append one complete row at a time, and replace the first verdict line only
 after every row is certified. `verify-answer-lint.ts` gates the file before `spur task verdict
 --from-answer` and rejects, with row-level diagnostics: missing/duplicate/unknown requirement IDs,
-AC ids that do not exactly match a task AC checklist label (or its leading token, e.g. `AC1`) or a
-linked feature scenario title, invalid status (`MET | PARTIAL | UNMET` for requirements;
+AC ids that do not resolve to one accepted identity — a task AC checklist label or its declared
+`AC-N`/checklist-token alias, or a linked feature scenario title, in the ac-style-guide forms
+(exact/bare title, `Scenario:` prefix, bracket tags, `AC-N`); paraphrases and ambiguous aliases
+fail — invalid status (`MET | PARTIAL | UNMET` for requirements;
 `N/A` additionally allowed for AC), invalid evidence type (`test | command | static-ref |
 manual-review | llm-judge | n/a`, or a `+` compound), and empty evidence. Interrupted runs keep the
 rows that pass the lint and complete only the missing IDs on retry.
 
+**Concrete anchors only (task 0804 R9).** An evidence anchor must be a concrete existing `file:line`
+(or `file:start-end`) path. A glob or directory summary (`src/services/*.ts`, `the retry
+classifiers in task-pipeline.yaml`) is not an anchor: expand it into the specific cited files/ranges
+the run actually verified. Since 0804 R9 the checker ignores complete parsed citation spans before
+scanning for subjects, so a citation's filename (including snake_case paths) can never become a
+false subject — a real absent symbol, nonexistent file, or invalid range still reports.
+
 ## Checks evidence
 
 Wave C verification can emit the following additive `checks[]` rows: