@gobing-ai/spur 0.3.80 → 0.3.82

package/config/rules/typescript/no-leaky-module-mocks.yaml

@@ -33,22 +33,15 @@ include:
   - "packages/**/tests/**/*.test.ts"
   - "packages/**/tests/**/*.test.tsx"
 exclude:
-  - "**/node_modules/**"
-  - "**/dist/**"
-  # Shared full-surface mock helpers are the CORRECT pattern — they ensure every
-  # test file registers the same compatible surface, neutralizing "last mock wins."
-  - "apps/web/tests/test-helpers/rpc-client-mock.ts"
-  # These files use beforeEach restoreMock() atop the shared baseline — the mock.module
-  # call is in a runtime function, not at module scope, and always registers the full surface.
+  # These three files mock.module() first-party modules and keep the mock inside a
+  # runtime function guarded by beforeEach restoreMock() atop the shared full-surface
+  # baseline (apps/web/tests/test-helpers/rpc-client-mock.ts, itself unflagged: it
+  # only documents the surface in comments). Remaining mock.module() hits in the
+  # test suite were verified stale or third-party-only and have been de-listed.
   - "apps/web/tests/modules/task-kanban/board.test.tsx"
-  - "apps/web/tests/modules/task-kanban/components.test.tsx"
   - "apps/web/tests/modules/task-kanban/new-task-panel.test.tsx"
-  - "apps/web/tests/modules/features/components.test.tsx"
   - "apps/web/tests/modules/task-kanban/task-detail.test.tsx"
-  - "apps/web/tests/modules/task-kanban/index.test.tsx"
-  # index.test.tsx no longer mocks useTasks/useTaskParams/TaskDetail; useTasks.test.ts
-  # uses custom listFn (isolated store), not mock.module for first-party modules.
-  - "apps/web/tests/modules/task-kanban/useTasks.test.ts"
+  - "apps/web/tests/modules/projects/WorkView.test.tsx"
 rules:
   - id: no-leaky-mock-module
     description: >

package/config/rules/typescript/no-module-scope-import-calls.yaml

@@ -35,8 +35,6 @@ include:
   - "packages/**/src/**/*.ts"
   - "packages/**/src/**/*.tsx"
 exclude:
-  - "**/node_modules/**"
-  - "**/dist/**"
   - "**/tests/**"
   - "**/*.test.ts"
   - "**/*.test.tsx"

package/config/rules/typescript/no-syscall-emulation-in-boundary-mock.yaml

@@ -29,9 +29,6 @@ include:
   - "packages/**/tests/**/*.test.tsx"
   - "plugins/**/tests/**/*.test.ts"
   - "plugins/**/tests/**/*.test.tsx"
-exclude:
-  - "**/node_modules/**"
-  - "**/dist/**"
 
 rules:
   - id: no-syscall-emulation-in-boundary-mock

package/config/rules/typescript/no-unmocked-module-eval-side-effects.yaml

@@ -34,9 +34,6 @@ include:
   - "apps/**/tests/**/*.test.tsx"
   - "packages/**/tests/**/*.test.ts"
   - "packages/**/tests/**/*.test.tsx"
-exclude:
-  - "**/node_modules/**"
-  - "**/dist/**"
   # All known side-effect modules are resolved. When a new one is discovered,
   # exclude files that already mock the dependency before importing it.
 

package/config/rules/typescript/output-boundaries.yaml

@@ -7,9 +7,6 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 include:
   - "apps/**/src/**/*.ts"
   - "packages/**/src/**/*.ts"
-exclude:
-  - "**/node_modules/**"
-  - "**/dist/**"
 
 rules:
   - id: no-console-output

package/config/rules/typescript/prefer-accessible-role-for-button-queries.yaml

@@ -13,9 +13,6 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 include:
   - "apps/web/tests/**/*.test.ts"
   - "apps/web/tests/**/*.test.tsx"
-exclude:
-  - "**/node_modules/**"
-  - "**/dist/**"
 
 rules:
   - id: prefer-accessible-role-for-button-queries

package/config/rules/ui/ui-import-boundary.yaml

@@ -27,8 +27,6 @@ rules:
             - "apps/web/src/**/*.tsx"
           exclude:
             - "apps/web/src/ui.ts"
-            - "**/tests/**"
-            - "**/node_modules/**"
 
   - id: no-daisyui-class-leak
     description: >
@@ -48,7 +46,5 @@ rules:
     include:
       - "apps/web/src/**/*.tsx"
     exclude:
+      # Sanctioned class-authoring site (Rule B seam).
       - "apps/web/src/components/ui/**"
-      - "apps/web/src/ui.ts"
-      - "**/tests/**"
-      - "**/node_modules/**"

package/config/templates/docs/99_PROJECT_CONSTITUTION.md

@@ -3,7 +3,7 @@ name: Project Constitution
 doc: 99_PROJECT_CONSTITUTION
 owns: PROCESS — how the key files are maintained
 authority: authoritative-on-process
-version: 1.6.0
+version: 1.7.0
 created_at: {{init-date}}
 updated_at: {{init-date}}
 edit_rules: 99 §6.8
@@ -35,10 +35,12 @@ Within project documentation, authority is scoped to the question:
 | Visual and interaction design | Root `DESIGN.md`, when present |
 | Delivery sequence, current mechanisms, non-UI contracts, feature state | `02`–`05`, derived within their respective responsibilities |
 
-Lower numbers win content conflicts within the same subject; `99` governs maintenance across
-all key files. Neither an ADR nor a task can silently change the constitution. An ADR is not
-a universal override for unrelated scope or UI facts. Fix the authoritative statement first,
-then affected projections; never average conflicting statements. Keep document numbers stable.
+The designated subject owner governs; document numbers do not confer authority over another
+owner's subject. `99` governs maintenance across all key files. Neither an ADR nor a task can
+silently change the constitution. Identify the governing statement first; correct it only if
+defective, otherwise repair the conflicting projection. If authoritative statements conflict and
+existing authorization does not resolve them, report the conflict rather than invent a decision.
+Never average conflicting statements. Keep document numbers stable.
 
 ## 3. Shared tools
 
@@ -118,7 +120,7 @@ it does not require touching every key file for each feature or task.
 | T1 | New architectural choice passing §6.1, or reversal | Record `00` before divergence; update affected `03`/`04`; `01` only if scope changes |
 | T2 | Implementation would contradict an existing ADR | Record the decision amendment or superseding ADR before implementing the contradiction |
 | T3 | CLI/API/config/schema/DTO or non-UI behavior changes | Update the owning `04` satellite; index and `AGENTS.md` only if their own facts change |
-| T4 | Feature lifecycle or acceptance changes | Update through the feature tool and refresh its generated projection; `01` only for scope changes |
+| T4 | Feature hierarchy, scope, lifecycle or acceptance changes | Apply §6.6 authorization; update through the feature tool and refresh its generated projection; `01` only for product scope changes |
 | T5 | Phase goal, order, dependency, or exit changes | Update `02`; task completion alone does not trigger a roadmap entry |
 | T6 | Product scope added, removed, or deferred | Update `01`; `02` if sequencing changes |
 | T7 | Authorized change to document responsibilities, authority, or maintenance rules | Update `99`, affected entry/routing instructions, and in-scope init templates |
@@ -141,18 +143,23 @@ Do not append to a key file merely to prove work happened.
 
 ### 6.1 `docs/00_ADR.md`
 
-Admit a decision only if it selects among meaningful alternatives and establishes or changes
+Every entry and amendment MUST select among meaningful alternatives and establish or change
 a lasting architecture boundary or invariant across features/modules: dependency direction,
 persistence ownership, trust model, protocol, runtime or shared execution model. Record the
 choice, context/reason, material tradeoff/consequence, status/date, and a detail pointer.
 
+Entries and amendments MUST remain precise and concise. State the decision and its rationale
+once; link detailed contracts and implementation guidance to their owners. Naming a feature,
+task, technology or technical concern alone does not establish architectural significance.
+
 Single-feature design, public-surface consent, task progress, test results and implementation
 receipts go to their design/task records. Bug fixes that restore an existing contract need no ADR.
 Doc-map and maintenance changes belong in `99`, not an ADR certifying a constitution edit.
 
 - One architectural decision per entry. New choices append; reversals name the superseded ADR.
 - Never renumber, reuse or delete an ADR ID. Preserve original titles/anchors and dates.
-- Corrections to the decision use dated amendments; amendments record a decision delta only.
+- Corrections to the decision use dated amendments stating only what changed and why. Amendments
+  must pass the same admission test; editorial corrections update wording in place without an addendum.
 - Editorial condensation may remove repetition and misplaced detail while preserving the choice,
   rationale, material alternatives, consequences and amendment history. It must not silently
   reverse a decision or present a historical choice as current.
@@ -195,6 +202,26 @@ parallel hand-written status table. Requirements, acceptance and decomposition l
 records; execution evidence lives in task records. Verify status and acceptance against evidence
 before relying on them. Never raw-edit satellites or generated regions.
 
+The project is the logical tree root; its direct children are top-level features, without requiring
+an extra persisted project node. Each top-level feature MUST represent a durable project module,
+product capability or project-wide concern. Its scope and top-level placement MUST be supported
+by an explicit requirement or approval from the operator or designated product owner.
+
+Record the supporting requirement or approval reference in the feature record through its tool.
+Existing explicit authorization is sufficient. Implementation, silence, task approval or an agent's
+recommendation does not establish approval for top-level placement.
+
+Prefer an existing owner. Children decompose their parent's approved scope; sibling boundaries
+must be clear and avoid duplicate ownership. A task, delivery wave, incident, technical detail or
+child-count limit alone does not justify a new top-level feature.
+
+Creating or promoting a top-level feature, materially redefining its scope, or merging or removing
+top-level boundaries requires explicit authorization covering that change. Routine decomposition
+within approved scope needs no repeated approval.
+
+For legacy roots without recorded provenance, report the gap without inventing approval or
+automatically restructuring the tree. Preserve history and references during authorized migration.
+
 ### 6.7 `AGENTS.md`
 
 Keep essential orientation, commands, boundaries and document routing. Verify facts from the
@@ -213,20 +240,54 @@ is not a reason to edit this file or bump its metadata. Keep implementation-spec
 and tool bindings in their owners. Do not automatically promote lessons into constitutional rules.
 Update authorized templates/copies; do not mutate unrelated repositories without authorization.
 
+### 6.9 `DESIGN.md` (root, when present)
+
+Keep shared visual and interaction rules, including accessibility and responsive behavior. Link
+detailed UI references; distinguish current conventions from proposed changes. Preserve required
+accessibility behavior when simplifying. Non-UI contracts belong in `04`; delivery status stays
+in feature/task records. Update this owner when shared UI rules change, not for every screen edit.
+
 ## 7. Drift control
 
-Audit the affected owners, using source/help, manifests, Git diffs, generated indexes and links:
+### 7.1 Detection
+
+During relevant document edits and task wrap-up, check affected owners and their references using
+source/help, manifests, Git diffs, generated indexes and links. A comprehensive audit is a separate
+scope; routine work does not require a repository-wide sweep.
 
 - Responsibility: content belongs to the file's §4.1 row; no competing ledger or rule owner.
 - Reality: current contracts/mechanisms match source; proposed/historical content is labeled.
 - Scope/status: `01` covers capabilities; phase/feature claims have current evidence.
+- Feature structure: top-level boundaries have §6.6 provenance; decomposition stays within approved scope.
 - References: IDs, heading anchors, index pointers and aliases still resolve.
 - Synchronization: apply §5 to changed facts; unchanged owners need no edit.
 - Metadata/templates: contracts and dates match actual edits; portable guidance agrees.
 
-Repair authority first, then affected detail/index/entry files. Record findings and verification
-in the task or a dated report, including unverified claims. Do not claim a repository-wide audit
-from focused checks. An ADR content reversal follows §6.1; editorial cleanup preserves history.
+### 7.2 Automatic repair
+
+Automatically repair confirmed documentation defects when authoritative evidence supports the
+correction, approved meaning is preserved, and the repair falls within authorized work. Examples
+include broken references with a verified destination, duplicate prose, misplaced detail, stale
+factual descriptions, and generated projections refreshed through their owning tools.
+
+Identify the governing owner first. Correct it only if its statement is defective; otherwise repair
+the conflicting projection. Observed implementation is evidence of current behavior, not authorization
+to change accepted scope, decisions or contracts.
+
+Auto-healing MUST NOT invent requirements or approvals, reverse architectural decisions, weaken
+acceptance criteria or gates, fabricate completion evidence, or amend this constitution outside §6.8
+authorization. Apply an already-authorized change without requesting approval again; otherwise report
+the conflict and proposed resolution. An authorized ADR reversal follows §6.1.
+
+Preserve decision history, stable references and unrelated edits. Regenerate tool-owned content
+through its tool. Synchronize affected detail/index/entry files and in-scope templates under §5.
+
+### 7.3 Verification and unresolved findings
+
+After repair, verify affected contracts, links, metadata and template parity with the applicable
+checks. Record findings, verification and unresolved or unverified claims in the task or a dated
+report. Do not claim a repository-wide audit from focused checks. If evidence remains ambiguous
+or a repair fails verification, stop that repair and report the cause; do not declare it healed.
 
 ## 8. Lessons learned per file
 
@@ -243,6 +304,7 @@ this routing rule, not an instruction to append lessons here.
 Seed `00`–`05`, this constitution and `AGENTS.md` through the project initializer. Fill project
 facts from actual requirements and manifests; leave unknowns explicit. Do not pre-accept an
 ADR, invent a completed phase, or create fictitious feature/status rows in a fresh project.
-Use the feature tool for its index. Keep `DESIGN.md` optional; author it when UI work needs a
+Start feature decomposition from approved requirements and apply §6.6 before creating top-level
+features. Use the feature tool for its index. Keep `DESIGN.md` optional; author it when UI work needs a
 shared design language. Preserve existing customized docs and supported entry symlinks.
 Read `AGENTS.md` first, then the owners relevant to the work.

package/config/transition-shims.json

@@ -15,13 +15,6 @@
             "keepsWorking": "a pre-existing agent spec carrying only type (no executor field) still drains: --agent <specId> falls back to the spec's coding-agent type instead of resolving a missing executor",
             "removalCondition": "every spec under .spur/agents/ records an executor field (scan .spur/agents/*.yaml for the key; re-materialize the demo team first)"
         },
-        {
-            "id": "agent-flag-spec-id",
-            "wbs": "0542",
-            "file": "apps/cli/src/commands/agent.ts",
-            "keepsWorking": "a team spec id passed to --agent <spec-id> still addresses the spec and drives the drain path, warned once by warnAgentSpecIdOnce; --spec <id> is the canonical carrier",
-            "removalCondition": "no --agent <spec-id> usage remains in config/workflows/, plugins/sp/, or docs/ (scan for --agent values that match a .spur/agents/ spec id)"
-        },
         {
             "id": "agent-default-executor",
             "wbs": "0542",

package/config/workflows/basic.yaml

@@ -56,6 +56,8 @@ states:
     onEnter:
       - kind: shell
         options:
+          # (e) 0825: 10 lines — soft probe must run the trusted compound gate via `sh -c`
+          # and write the status file the guards read, always exit 0 (0771 R1 contract).
           command: >-
             mkdir -p .spur/run &&
             STATUS_FILE=".spur/run/$__runId-basic-gate.status" &&
@@ -83,6 +85,8 @@ states:
         options:
           agent: ${vars.agent}
           input: /sp:dev-fixall "${vars.qualityGateCmd}"
+          answerFile: .spur/run/${vars.__runId}-basic-fix-answer.txt
+          expectFile: .spur/run/${vars.__runId}-basic-fix-answer.txt
           # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
           role: coder
           timeoutMs: ${vars.stepTimeoutMs}

package/config/workflows/docs-pipeline.yaml

@@ -138,12 +138,8 @@ states:
       # excluded from the digest's git-tree half, so the spec is folded in via `taskFile`.
       - kind: shell
         options:
-          # 0760 R1 (sibling of 0751 R2): task-path lookup fails closed. Drop
-          # `2>/dev/null`, `|| true`, and the forced `exit 0` so an unresolved
-          # wbs exits non-zero with a named message. The resolved path folds
-          # into the proof digest via `taskFile:` below; a silent miss would
-          # degrade the docs-pipeline proof to tree-only (same hazard 0751 R2
-          # removed from task-pipeline). (0769: run-scoped capture path.)
+          # (e) 0825: 6 lines — fail-closed lookup feeds the verdict/digest file names
+          # (0760 R1); a silent miss would degrade the proof to tree-only.
           command: >-
             set -e;
             task_path="$($spurBin task path $wbs --json | jq -r '.path // .filePath // empty')";
@@ -159,6 +155,8 @@ states:
       # folding a stale spec into the proof.
       - kind: shell
         options:
+          # (e) 0825: 9 lines — per-check rc capture (task show/feature show/jq) keeps an
+          # orphan task and a broken linked feature distinguishable (0785 R2 contract).
           command: >-
             set -e;
             FID="$($spurBin task show $wbs --json 2>/dev/null | jq -r '.feature_id // .frontmatter.feature_id // empty' 2>/dev/null)";
@@ -191,6 +189,7 @@ states:
           role: reviewer
           timeoutMs: ${vars.stepTimeoutMs}
           answerFile: .spur/run/${vars.__runId}-docs-verify-answer.txt
+          expectFile: .spur/run/${vars.__runId}-docs-verify-answer.txt
       - kind: shell
         options:
           command: "$spurBin task verdict $wbs --from-answer .spur/run/$__runId-docs-verify-answer.txt"
@@ -199,6 +198,8 @@ states:
       # guard below, not this step.
       - kind: shell
         options:
+          # (e) 0825: 6 lines — stamp shell freezes the docs proof digest for the closing
+          # guard; the record→done guard compares against this stamp.
           command: >-
             V=".spur/run/$wbs-verdict.json";
             if [ -f "$V" ] && [ -n "$proofDigest" ]; then
@@ -263,7 +264,7 @@ transitions:
     guard:
       kind: shell
       options:
-        command: 'test "$(cat .spur/run/$wbs-docs-precheck.status 2>/dev/null)" = PASS'
+        command: 'test "$(cat .spur/run/$__runId-docs-precheck.status 2>/dev/null)" = PASS'
   - from: precheck
     to: failed
     description: Precheck FAIL — stop before draft.
@@ -313,17 +314,13 @@ transitions:
     guard:
       kind: shell
       options:
-        # Hardened (0703 P2 carry): every operand is required non-empty (`test -n`) so a
-        # missing file or empty var fails closed instead of empty-equals-empty passing.
+        # (e) 0825: 8-line operand ladder condensed to one jq select — same file, same
+        # digest-locked PASS semantics (0769 R4/R5); empty/malformed still fail closed.
         command: >-
           test -n "$proofDigest" &&
           test -n "$proofDigestNow" &&
           test "$proofDigestNow" = "$proofDigest" &&
-          test -f ".spur/run/$wbs-verdict.json" &&
-          test -n "$(jq -r '.verdict // empty' .spur/run/$wbs-verdict.json 2>/dev/null)" &&
-          test "$(jq -r '.verdict // empty' .spur/run/$wbs-verdict.json 2>/dev/null)" = PASS &&
-          test -n "$(jq -r '.proof.digest // empty' .spur/run/$wbs-verdict.json 2>/dev/null)" &&
-          test "$(jq -r '.proof.digest // empty' .spur/run/$wbs-verdict.json 2>/dev/null)" = "$proofDigest"
+          test "$(jq -r --arg d "$proofDigest" 'select(.proof.digest == $d) | .verdict // empty' ".spur/run/$wbs-verdict.json" 2>/dev/null)" = PASS
   - from: verify
     to: failed
     description: Non-PASS verdict, missing/malformed answer, or digest mismatch (R5) — the run
@@ -338,6 +335,8 @@ transitions:
     guard:
       kind: shell
       options:
+        # (e) 0825: 5-line guard — captured record PASS + digest-locked persisted verdict
+        # must both hold before done; a failed `task record` never converts to success.
         command: >-
           test "$(cat .spur/run/$__runId-docs-record.status 2>/dev/null)" = PASS &&
           test -f ".spur/run/$wbs-verdict.json" &&

package/config/workflows/feature-dev.yaml

@@ -91,35 +91,11 @@ states:
     onEnter:
       - kind: shell
         options:
+          # (d) 0825: the 12-command identity/roster program moved into
+          # plugins/sp/scripts/feature-dev-precheck.ts (§1.1 owner); same messages,
+          # artifacts and soft-fail exit-0 contract, wrapper fails closed.
           command: >-
-            mkdir -p .spur/run;
-            FEATURE_JSON=".spur/run/$__runId-feature-dev-feature.json";
-            ROSTER_JSON=".spur/run/$__runId-feature-dev-roster.json";
-            TASKS_TXT=".spur/run/$__runId-feature-dev-tasks.txt";
-            PRECHECK_STATUS=".spur/run/$__runId-feature-dev-precheck.status";
-            rm -f "$PRECHECK_STATUS";
-            set +e;
-            test -n "$featureId" && test -n "$__runId";
-            id_rc=$?;
-            if [ "$id_rc" -eq 0 ]; then $spurBin feature show "$featureId" --json > "$FEATURE_JSON" 2>&1; show_rc=$?; else show_rc=1; fi;
-            if [ "$id_rc" -eq 0 ] && [ "$show_rc" -eq 0 ] && jq -e --arg id "$featureId" 'type == "object" and .id == $id' "$FEATURE_JSON" > /dev/null 2>&1; then $spurBin task list --feature "$featureId" --json > "$ROSTER_JSON" 2>&1; list_rc=$?; else list_rc=1; fi;
-            if [ "$id_rc" -ne 0 ] || [ "$show_rc" -ne 0 ] || [ "$list_rc" -ne 0 ]; then
-              echo "feature-dev precheck: missing featureId/runId, unknown feature '$featureId', or unreadable roster (rc $id_rc/$show_rc/$list_rc) — supply an existing planned feature via /sp:dev-plan or /sp:dev-idea; nothing was auto-created or re-planned" >&2;
-              printf 'FAIL\n' > "$PRECHECK_STATUS";
-            elif ! jq -e 'type == "array" and length > 0' "$ROSTER_JSON" > /dev/null 2>&1; then
-              echo "feature-dev precheck: roster at $ROSTER_JSON is malformed, not an array, or empty — plan the feature first via /sp:dev-plan; refusing to replan or run an empty batch" >&2;
-              printf 'FAIL\n' > "$PRECHECK_STATUS";
-            elif ! jq -e 'all(.[]; (.wbs | type == "string" and length > 0)) and ([.[].wbs] | length == (unique | length)) and all(.[]; .status == "todo" or .status == "done" or .status == "cancelled" or .status == "backlog" or .status == "wip" or .status == "testing" or .status == "blocked")' "$ROSTER_JSON" > /dev/null 2>&1; then
-              echo "feature-dev precheck: roster has empty/duplicate/mismatched WBS identities or unknown statuses at $ROSTER_JSON — repair the task corpus; refusing to batch a broken roster" >&2;
-              printf 'FAIL\n' > "$PRECHECK_STATUS";
-            elif [ "$(jq '[.[] | select(.status == "backlog" or .status == "wip" or .status == "testing" or .status == "blocked")] | length' "$ROSTER_JSON")" -gt 0 ]; then
-              echo "feature-dev precheck: linked task(s) are backlog/wip/testing/blocked — refine or resume them through their own task pipelines before batching; refusing to launch overlapping work" >&2;
-              printf 'FAIL\n' > "$PRECHECK_STATUS";
-            else
-              printf '%s' "$(jq -r '[.[] | select(.status == "todo") | .wbs] | sort | join(",")' "$ROSTER_JSON")" > "$TASKS_TXT";
-              printf 'PASS\n' > "$PRECHECK_STATUS";
-            fi;
-            exit 0
+            mkdir -p .spur/run; if [ -f plugins/sp/scripts/feature-dev-precheck.ts ]; then bun plugins/sp/scripts/feature-dev-precheck.ts; elif W="$(superskill script path sp feature-dev-precheck.mjs 2>/dev/null)" && [ -f "$W" ]; then node "$W"; else echo "feature-dev precheck failed closed — feature-dev-precheck script not found — run 'superskill install sp'" >&2; printf 'FAIL\n' > ".spur/run/$__runId-feature-dev-precheck.status"; fi; exit 0
       - kind: note
         options:
           message: "Feature-dev start for existing feature ${vars.featureId} (0782 reuse path): roster resolved under .spur/run/${vars.__runId}-feature-dev-roster.json; frozen todo list at .spur/run/${vars.__runId}-feature-dev-tasks.txt."
@@ -143,6 +119,8 @@ states:
         options:
           agent: ${vars.agent}
           input: /sp:dev-runall --tasks ${vars.featureTaskIds} --auto
+          answerFile: .spur/run/${vars.__runId}-feature-dev-runall-answer.txt
+          expectFile: .spur/run/${vars.__runId}-feature-dev-runall-answer.txt
           # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
           role: planner
           timeoutMs: ${vars.stepTimeoutMs}
@@ -162,6 +140,8 @@ states:
         options:
           agent: ${vars.agent}
           input: /sp:dev-runall --tasks ${vars.featureTaskIds}
+          answerFile: .spur/run/${vars.__runId}-feature-dev-runall-answer.txt
+          expectFile: .spur/run/${vars.__runId}-feature-dev-runall-answer.txt
           # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
           role: planner
           timeoutMs: ${vars.stepTimeoutMs}
@@ -177,17 +157,10 @@ states:
     onEnter:
       - kind: shell
         options:
+          # (e) 0825: 9 lines — `feature check --as done` runs EXACTLY ONCE per run (0782 R3)
+          # and owns the status write the guards read; split would re-run the check.
           command: >-
-            mkdir -p .spur/run;
-            VERIFY_JSON=".spur/run/$__runId-feature-dev-verify.json";
-            VERIFY_STATUS=".spur/run/$__runId-feature-dev-verify.status";
-            VERIFY_TMP=".spur/run/$__runId-feature-dev-verify.status.tmp";
-            rm -f "$VERIFY_STATUS";
-            set +e;
-            $spurBin feature check "$featureId" --as done --json > "$VERIFY_JSON" 2>&1;
-            check_rc=$?;
-            set -e;
-            if [ "$check_rc" -eq 0 ] && jq -e 'type == "array" and length > 0 and all(.[]; .pass == true)' "$VERIFY_JSON" > /dev/null 2>&1; then printf 'PASS\n' > "$VERIFY_TMP" && mv -f "$VERIFY_TMP" "$VERIFY_STATUS"; else printf 'FAIL\n' > "$VERIFY_TMP" && mv -f "$VERIFY_TMP" "$VERIFY_STATUS"; fi
+            mkdir -p .spur/run; rm -f ".spur/run/$__runId-feature-dev-verify.status"; $spurBin feature check "$featureId" --as done --json > ".spur/run/$__runId-feature-dev-verify.json" 2>&1 && jq -e 'type == "array" and length > 0 and all(.[]; .pass == true)' ".spur/run/$__runId-feature-dev-verify.json" > /dev/null 2>&1 && R=PASS || R=FAIL; printf '%s\n' "$R" > ".spur/run/$__runId-feature-dev-verify.status.tmp" && mv -f ".spur/run/$__runId-feature-dev-verify.status.tmp" ".spur/run/$__runId-feature-dev-verify.status"
       - kind: note
         options:
           message: "Feature verification for ${vars.featureId}: decision at .spur/run/${vars.__runId}-feature-dev-verify.status (evidence at .spur/run/${vars.__runId}-feature-dev-verify.json) — exactly one `feature check --as done --json` invocation per run (0782 R3)."
@@ -211,36 +184,18 @@ states:
       `requireCleanReview=true` turns a non-clean COLLECTED verdict (including
       collect FAIL) into the blocking edge declared first below.
     onEnter:
+      # (e) 0825: one request action + one collect action (same verdicts, same files,
+      # collect gated on the captured head SHA as before) to hold the §1.2 budgets.
       - kind: shell
         options:
           command: >-
-            mkdir -p .spur/run &&
-            STATUS_FILE=".spur/run/$__runId-integration-review.status" &&
-            REQUEST_JSON=".spur/run/$__runId-integration-review.json" &&
-            COLLECT_JSON=".spur/run/$__runId-integration-review-collect.json" &&
-            COLLECT_STATUS=".spur/run/$__runId-integration-review-collect.status" &&
-            PR_REQUEST_STATUS=".spur/run/$__runId-integration-review-pr-request.status" &&
-            set +e &&
-            bun "$(superskill script path sp pr-reviewing.ts)" request --base "$baseBranch" --json
-            --status-file "$PR_REQUEST_STATUS" > "$REQUEST_JSON" 2>&1;
-            request_rc=$?; set -e &&
-            if [ "$request_rc" -eq 0 ]; then
-              printf 'PASS\n' > "$STATUS_FILE";
-            else
-              printf 'FAIL\n' > "$STATUS_FILE";
-            fi &&
-            HEAD_SHA=$(jq -r '.head // empty' "$REQUEST_JSON" 2>/dev/null || true) &&
-            if [ -z "$HEAD_SHA" ]; then
-              echo "integration-review: request result carried no head SHA — collect not run, recorded FAIL" >&2;
-              printf 'FAIL\n' > "$COLLECT_STATUS";
-            else
-              set +e &&
-              bun "$(superskill script path sp pr-reviewing.ts)" collect --head "$HEAD_SHA" --json
-              --status-file "$COLLECT_STATUS" > "$COLLECT_JSON" 2>&1;
-              collect_rc=$?; set -e &&
-              echo "integration-review: collect rc=$collect_rc status=$(cat "$COLLECT_STATUS" 2>/dev/null || echo missing) — verdict captured to $COLLECT_JSON" >&2;
-            fi;
-            exit 0
+            mkdir -p .spur/run; bun "$(superskill script path sp pr-reviewing.ts)" request --base "$baseBranch" --json --status-file ".spur/run/$__runId-integration-review-pr-request.status" > ".spur/run/$__runId-integration-review.json" 2>&1 && printf 'PASS\n' > ".spur/run/$__runId-integration-review.status" || printf 'FAIL\n' > ".spur/run/$__runId-integration-review.status"; exit 0
+      - kind: shell
+        options:
+          # (e) 0825: 8 lines — collect stays head-locked to the request record and records
+          # its verdict status file; the rc/status echo is the audible soft-fail contract.
+          command: >-
+            if H=$(jq -er '.head // empty | select(. != "")' ".spur/run/$__runId-integration-review.json" 2>/dev/null); then bun "$(superskill script path sp pr-reviewing.ts)" collect --head "$H" --json --status-file ".spur/run/$__runId-integration-review-collect.status" > ".spur/run/$__runId-integration-review-collect.json" 2>&1; rc=$?; echo "integration-review: collect rc=$rc status=$(cat ".spur/run/$__runId-integration-review-collect.status" 2>/dev/null || echo missing) — verdict captured to .spur/run/$__runId-integration-review-collect.json" >&2; else echo "integration-review: request result carried no head SHA — collect not run, recorded FAIL" >&2; printf 'FAIL\n' > ".spur/run/$__runId-integration-review-collect.status"; fi; exit 0
       - kind: note
         options:
           message: "Integration review for feature ${vars.featureId}: request verdict at .spur/run/${vars.__runId}-integration-review.status (request state only — REQUESTED/ALREADY_* are NEVER clean evidence); collected verdict at .spur/run/${vars.__runId}-integration-review-collect.status (CLEAN/FINDINGS/PENDING — the only clean evidence). Advisory unless requireCleanReview=true."

package/config/workflows/history-anatomy.yaml

@@ -72,7 +72,10 @@ vars:
   agent: "claude"
   spurBin: "spur"
   __runId: ""
-  stepTimeoutMs: "1800000"
+  # 2026-09-12: raised 30m -> 60m. Observed runs on zai/glm-5.3-flash butt against the
+  # 30m ceiling (correct exited at exactly 30m00s; a prior run passed at 29m52s) — the
+  # enrich/validate/correct stages legitimately need >30m for the 60KB candidate report.
+  stepTimeoutMs: "3600000"
   workflowFile: "config/workflows/history-anatomy.yaml"
   contractVersion: "1"
   reportDir: "docs/report"
@@ -225,6 +228,24 @@ states:
           role: reviewer
           expectFile: .spur/run/${vars.__runId}-validation.txt
           timeoutMs: ${vars.stepTimeoutMs}
+      - kind: shell
+        options:
+          # 2026-09-13 verdict-placement normalization: the 0771 guard reads ONLY the
+          # final line, but models sometimes lead with `Verdict: PASS` and close with
+          # prose — a substantive PASS must not die as a format phantom (observed
+          # 2026-09-13 run 94c4d6dc). Moves the verdict line to the end ONLY when
+          # exactly one exact-line verdict exists and it is PASS. Any `Verdict: FAIL`
+          # line anywhere (or multiple/ambiguous verdict lines) suppresses
+          # normalization, so the guard still fails and a real FAIL can never be
+          # laundered into a PASS.
+          command: >-
+            f=.spur/run/$__runId-validation.txt;
+            if [ -f "$f" ] && ! tail -n 1 "$f" | grep -qx 'Verdict: PASS'; then
+              p=$(grep -cx 'Verdict: PASS' "$f"); q=$(grep -cx 'Verdict: FAIL' "$f");
+              if [ "$p" = 1 ] && [ "$q" = 0 ]; then
+                grep -vx 'Verdict: PASS' "$f" > "$f.tmp" && printf 'Verdict: PASS\n' >> "$f.tmp" && mv "$f.tmp" "$f";
+              fi;
+            fi
       - kind: shell
         options:
           command: >-