@gobing-ai/spur 0.3.84 → 0.3.86

package/config/workflows/docs-pipeline.yaml

@@ -1,350 +0,0 @@
-# Docs-only task pipeline — one run per documentation/design-doc deliverable.
-#
-# Sibling of task-pipeline.yaml for tasks whose output is a document, not product
-# code. Keeps docs deliverables out of the full quality gate and routes them
-# through an explicit docs-review HITL gate.
-#
-# Reliability (aligned with task-pipeline / ADR-043):
-#   - Soft precheck (task check + status file) so red precheck → failed via transitions
-#   - draft agent.run is a pure slash command (docs discipline lives in
-#     /sp:dev-run --mode implement + sp:code-implementation, not YAML prose)
-#   - requireDiff fails silent no-op drafts
-#   - HITL answer routing is exhaustive (yes/no/cancel)
-#   - verify measures the deliverable read-only (answer file + `spur task verdict` + proof
-#     digest bracket); recording happens only AFTER measured PASS (0769 ordering:
-#     precheck → draft → docs-review → verify → record → done) and `record → done` is
-#     fail-closed on the captured record result + re-asserted verdict — never on a stub
-
-"$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
-version: "2"
-kind: state-machine
-name: docs-pipeline
-description: "Docs-only execution pipeline (precheck -> draft -> docs-review -> verify -> record -> done)"
-iterationBound: 12
-initialState: precheck
-terminalStates:
-  - done
-  - failed
-  - cancelled
-failureStates:
-  - failed
-  - cancelled
-vars:
-  wbs: "0000"
-  profile: "standard"
-  spurBin: "spur"
-  agent: "auto"
-  stepTimeoutMs: "1800000"
-  # Proof-state bracket (task 0704, mirroring task-pipeline 0612/0703). `proofDigest` is the
-  # canonical capture at verify entry; `proofDigestNow` is the live re-capture compared against
-  # it by the `verify → record` guard so verifier-time mutation fails closed (R4/R5).
-  proofDigest: ""
-  proofDigestNow: ""
-  # `taskSpecPath` carries the task file path because `docs/tasks*` is excluded from the digest's
-  # git-tree half (task 0704 R4); resolved per-run by the verify state's taskpath shell step.
-  taskSpecPath: ""
-  # 0785 R2: linked feature spec path, resolved at verify entry. Empty (orphan task) means the
-  # feature spec is legitimately omitted from the digest inputs (empty-string compatibility);
-  # a declared feature whose path fails to resolve fails closed.
-  featureSpecPath: ""
-  __hitlAnswer: ""
-  # R8 (0366): injected by WorkflowAppService.run(); run-scopes every temporary capture.
-  __runId: ""
-
-states:
-  - id: precheck
-    description: >
-      Soft precheck: task check + agent doctor, each owned by a deterministic `command.gate`
-      (D5-J, ADR-069). Both gates run `softFail: true`, so a red probe records FAIL and lets
-      the transitions route to `failed` instead of aborting the run — the shipped action
-      schema exposes no `onError`, so soft mode is what preserves that routing.
-      The canonical `.spur/run/$__runId-docs-precheck.status` is the AND of the two gate files.
-      (0769: temporary captures are run-scoped — `.spur/run/<runId>-docs-*` — so concurrent
-      runs on one task never share or clobber a capture.)
-    onEnter:
-      - kind: command.gate
-        options:
-          id: docs-precheck-task
-          executable: "${vars.spurBin}"
-          args: ["task", "check", "${vars.wbs}"]
-          resultFile: .spur/run/${vars.__runId}-docs-precheck-task.status
-          softFail: true
-          timeoutMs: 120000
-      - kind: command.gate
-        options:
-          id: docs-precheck-agent
-          executable: "${vars.spurBin}"
-          args: ["agent", "doctor", "${vars.agent}"]
-          resultFile: .spur/run/${vars.__runId}-docs-precheck-agent.status
-          softFail: true
-          timeoutMs: 120000
-      - kind: shell
-        options:
-          command: >-
-            if test "$(cat .spur/run/$__runId-docs-precheck-task.status 2>/dev/null)" = PASS &&
-               test "$(cat .spur/run/$__runId-docs-precheck-agent.status 2>/dev/null)" = PASS;
-            then printf 'PASS\n' > ".spur/run/$__runId-docs-precheck.status";
-            else printf 'FAIL\n' > ".spur/run/$__runId-docs-precheck.status"; fi
-      - kind: note
-        options:
-          message: "Docs pipeline start for task ${vars.wbs}."
-
-  - id: draft
-    description: >
-      Author or update the documentation deliverable for task ${vars.wbs}. Pure slash
-      implement hop (ADR-043). Docs-only scope is owned by the implement competency when
-      the task template/background is documentation — not by YAML essays.
-    onEnter:
-      - kind: agent.run
-        options:
-          agent: ${vars.agent}
-          # Pure slash only (ADR-043). Do not bolt docs-only prose onto the input line.
-          # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
-          role: coder
-          input: /sp:dev-run --mode implement ${vars.wbs} --auto
-          timeoutMs: ${vars.stepTimeoutMs}
-          # Fail a silent no-op draft (same empty-implement class as task-pipeline R3).
-          requireDiff: true
-      - kind: shell
-        options:
-          command: "$spurBin task update $wbs wip --no-lifecycle"
-
-  - id: docs-review
-    description: >
-      Human documentation review gate. Under profile=auto this state is skipped; in
-      interactive mode it pauses for explicit approval before recording completion.
-    pause: true
-    onEnter:
-      - kind: hitl.confirm
-        options:
-          prompt: "Approve docs-only deliverable for task ${vars.wbs}?"
-
-  - id: verify
-    description: >
-      Read-only measured verification (task 0704, R2/R4/R7): dispatch /sp:dev-verify --fix none
-      with an answer file, derive the ONE standard verdict via `spur task verdict`, register the
-      standard verify-verdict artifact, and bracket the verifier with proof-input digest capture/compare so any
-      task-spec or document mutation during certification fails closed (R4). No docs assurance
-      subclass — PASS semantics are identical to task-pipeline (R7). 0769: verification now
-      PRECEDES recording; the `verify → record` guard compares the proof bracket, and the
-      verdict artifact keeps its `.spur/run/<wbs>-verdict.json` compatibility path with
-      runId + definitionDigest stamped through the existing proof/run-artifact contract.
-    onEnter:
-      # 0769: clear any stale current-run answer before the fresh-session verifier writes it.
-      - kind: shell
-        options:
-          command: "mkdir -p .spur/run && rm -f .spur/run/$__runId-docs-verify-answer.txt"
-      # R4 (0703 R6 precedent): resolve the task-spec path BEFORE capture. `docs/tasks*` is
-      # excluded from the digest's git-tree half, so the spec is folded in via `taskFile`.
-      - kind: shell
-        options:
-          # (e) 0825: 6 lines — fail-closed lookup feeds the verdict/digest file names
-          # (0760 R1); a silent miss would degrade the proof to tree-only.
-          command: >-
-            set -e;
-            task_path="$($spurBin task path $wbs --json | jq -r '.path // .filePath // empty')";
-            if [ -z "$task_path" ]; then echo "docs-pipeline: task path did not resolve for wbs $wbs" >&2; exit 1; fi;
-            printf '%s' "$task_path" > ".spur/run/$__runId-docs-taskpath.txt"
-      - kind: file.read.into-var
-        options:
-          path: .spur/run/${vars.__runId}-docs-taskpath.txt
-          var: taskSpecPath
-      # 0785 R2: resolve the linked feature spec path so the digest covers it too. An orphan task
-      # (no feature_id) resolves to empty — legitimately omitted via empty-string compatibility;
-      # a declared feature whose spec path does not resolve fails closed instead of silently
-      # folding a stale spec into the proof.
-      - kind: shell
-        options:
-          # (e) 0825: 9 lines — per-check rc capture (task show/feature show/jq) keeps an
-          # orphan task and a broken linked feature distinguishable (0785 R2 contract).
-          command: >-
-            set -e;
-            FID="$($spurBin task show $wbs --json 2>/dev/null | jq -r '.feature_id // .frontmatter.feature_id // empty' 2>/dev/null)";
-            FPATH_OUT="";
-            if [ -n "$FID" ]; then
-              FPATH_OUT="$($spurBin feature show "$FID" --json | jq -r '.filePath // .path // empty')";
-              if [ -z "$FPATH_OUT" ]; then echo "docs-pipeline: feature $FID linked to task $wbs but its spec path did not resolve" >&2; exit 1; fi;
-            fi;
-            printf '%s' "$FPATH_OUT" > ".spur/run/$__runId-docs-featurepath.txt"
-      - kind: file.read.into-var
-        options:
-          path: .spur/run/${vars.__runId}-docs-featurepath.txt
-          var: featureSpecPath
-      # R4: canonical capture BEFORE the verifier runs. Same fingerprint input as the
-      # re-capture below so the bracket compares like for like.
-      - kind: proof.fingerprint
-        options:
-          var: proofDigest
-          taskFile: ${vars.taskSpecPath}
-          featureFile: ${vars.featureSpecPath}
-          input: /sp:dev-verify ${vars.wbs} --auto --fix none --focus all
-          timeoutMs: ${vars.stepTimeoutMs}
-      - kind: agent.run
-        options:
-          agent: ${vars.agent}
-          # Observe-only (ADR-071 precedent): the verifier certifies, it never repairs.
-          # 0710 R2: verify runs in a fresh session — never inherits the implement hop's session.
-          freshSession: true
-          input: /sp:dev-verify ${vars.wbs} --auto --fix none --focus all
-          role: reviewer
-          timeoutMs: ${vars.stepTimeoutMs}
-          answerFile: .spur/run/${vars.__runId}-docs-verify-answer.txt
-          expectFile: .spur/run/${vars.__runId}-docs-verify-answer.txt
-      - kind: shell
-        options:
-          command: "$spurBin task verdict $wbs --from-answer .spur/run/$__runId-docs-verify-answer.txt"
-      # R7: stamp the proof block + run identity into the standard verdict artifact, then register
-      # it. Soft action + hard guard: a missing/malformed stamp fails the `verify -> record`
-      # guard below, not this step.
-      - kind: shell
-        options:
-          # (e) 0825: 6 lines — stamp shell freezes the docs proof digest for the closing
-          # guard; the record→done guard compares against this stamp.
-          command: >-
-            V=".spur/run/$wbs-verdict.json";
-            if [ -f "$V" ] && [ -n "$proofDigest" ]; then
-              jq --arg d "$proofDigest" --arg r "$__runId" '. + {proof: {digest: $d, capturePoint: "docs-verify-entry", runId: $r}}' "$V" > "$V.tmp" && mv "$V.tmp" "$V";
-            fi;
-            exit 0
-      - kind: run.artifact
-        options:
-          path: .spur/run/${vars.wbs}-verdict.json
-          artifactKind: verify-verdict
-      # R4: re-capture AFTER the verifier. No `expect` here — an action-level abort would
-      # bypass the `failed` state; the `verify -> done` guard compares instead (R5).
-      - kind: proof.fingerprint
-        options:
-          var: proofDigestNow
-          taskFile: ${vars.taskSpecPath}
-          featureFile: ${vars.featureSpecPath}
-          input: /sp:dev-verify ${vars.wbs} --auto --fix none --focus all
-          timeoutMs: ${vars.stepTimeoutMs}
-
-  - id: record
-    description: >
-      Record the docs-only outcome AFTER measured verification (task 0769 ordering:
-      draft/approval → verify → record → done — the pre-verification record could write
-      UNKNOWN/old Testing evidence). The verdict is already derived and proof-bracketed in
-      `verify`; `verify → record` only opens on measured PASS with an intact bracket. The
-      task record verb backfills Solution from the diff and moves the task to testing; its
-      result is captured to a run-scoped status file so a record denial reaches `failed`
-      (record → failed) and is never converted to success by an exit 0.
-    onEnter:
-      - kind: shell
-        options:
-          command: >-
-            if $spurBin task record $wbs --solution-from-diff --transition testing; then
-              printf 'PASS\n' > ".spur/run/$__runId-docs-record.status";
-            else
-              printf 'FAIL\n' > ".spur/run/$__runId-docs-record.status";
-            fi
-
-  - id: done
-    description: Terminal — docs deliverable measured, reviewed, and recorded.
-    onEnter:
-      # R1 (0704): no synthetic verdict writer. The verdict artifact is produced by measured
-      # verification in `verify` and registered there; done only performs the guarded
-      # transition. Override path remains: --force-done --reason.
-      - kind: shell
-        options:
-          command: "$spurBin task update $wbs done --no-lifecycle"
-      - kind: note
-        options:
-          message: "Docs pipeline complete for task ${vars.wbs}."
-  - id: failed
-    description: Terminal — docs pipeline failed or was rejected.
-
-  - id: cancelled
-    description: Terminal — docs pipeline cancelled by operator.
-
-transitions:
-  - from: precheck
-    to: draft
-    description: Precheck PASS — begin docs draft.
-    guard:
-      kind: shell
-      options:
-        command: 'test "$(cat .spur/run/$__runId-docs-precheck.status 2>/dev/null)" = PASS'
-  - from: precheck
-    to: failed
-    description: Precheck FAIL — stop before draft.
-    guard:
-      kind: always
-
-  - from: draft
-    to: verify
-    description: "profile=auto — skip the docs-review HITL gate; verify measures BEFORE record (0769: a pre-verification record could write UNKNOWN/old Testing evidence)."
-    guard:
-      kind: shell
-      options:
-        command: 'test "$profile" = auto'
-  - from: draft
-    to: docs-review
-    description: Interactive — enter docs-review.
-    guard:
-      kind: always
-
-  - from: docs-review
-    to: verify
-    description: "Docs approved — measure the deliverable (0769: verification precedes recording)."
-    guard:
-      kind: shell
-      options:
-        command: 'test "$__hitlAnswer" = yes'
-  - from: docs-review
-    to: failed
-    description: Docs rejected — stop for revision.
-    guard:
-      kind: shell
-      options:
-        command: 'test "$__hitlAnswer" = no'
-  - from: docs-review
-    to: cancelled
-    description: Operator cancelled docs review.
-    guard:
-      kind: shell
-      options:
-        command: 'test "$__hitlAnswer" = cancel'
-
-  - from: verify
-    to: record
-    description: Measured PASS with the proof bracket intact (R4/R5) — record only verified
-      outcomes (0769). Structural task-check gates remain at precheck, record (wip→testing),
-      and done (verdict-artifact guard, R3).
-    guard:
-      kind: shell
-      options:
-        # (e) 0825: 8-line operand ladder condensed to one jq select — same file, same
-        # digest-locked PASS semantics (0769 R4/R5); empty/malformed still fail closed.
-        command: >-
-          test -n "$proofDigest" &&
-          test -n "$proofDigestNow" &&
-          test "$proofDigestNow" = "$proofDigest" &&
-          test "$(jq -r --arg d "$proofDigest" 'select(.proof.digest == $d) | .verdict // empty' ".spur/run/$wbs-verdict.json" 2>/dev/null)" = PASS
-  - from: verify
-    to: failed
-    description: Non-PASS verdict, missing/malformed answer, or digest mismatch (R5) — the run
-      reaches failed and nothing is recorded.
-    guard:
-      kind: always
-
-  - from: record
-    to: done
-    description: Recorded from a verified outcome; the persisted verdict/bracket is re-asserted
-      so a failed `task record` (captured FAIL) never converts to done (0769).
-    guard:
-      kind: shell
-      options:
-        # (e) 0825: 5-line guard — captured record PASS + digest-locked persisted verdict
-        # must both hold before done; a failed `task record` never converts to success.
-        command: >-
-          test "$(cat .spur/run/$__runId-docs-record.status 2>/dev/null)" = PASS &&
-          test -f ".spur/run/$wbs-verdict.json" &&
-          test "$(jq -r '.verdict // empty' .spur/run/$wbs-verdict.json 2>/dev/null)" = PASS &&
-          test -n "$proofDigest" &&
-          test "$(jq -r '.proof.digest // empty' .spur/run/$wbs-verdict.json 2>/dev/null)" = "$proofDigest"
-  - from: record
-    to: failed
-    description: "Task record denied or errored (captured status not PASS) — the record denial reaches failed; the done guard above never converts it to success."
-    guard:
-      kind: always

package/config/workflows/feature-dev.yaml

@@ -1,288 +0,0 @@
-# Feature development loop — existing-feature reuse: precheck → execute-tasks →
-# feature-verify → integration-review → done.
-#
-# 0782 (feature D6): the caller supplies a featureId whose AC are already accepted and whose
-# task roster already exists. This definition REUSES them — the brainstorm/plan states and
-# their edges are deleted, so no model hop ever re-plans or re-decomposes an existing feature
-# (explicit planning stays at /sp:dev-plan and /sp:dev-idea, outside this consumer).
-#
-# Reliability (aligned with task-pipeline / ADR-043):
-#   - Soft precheck (feature identity + roster structural contract) → failed via transitions,
-#     never a raw lifecycle abort. The doctor probe is gone: the precheck now performs the
-#     essential feature/roster validation itself; task execution owns executor availability.
-#   - Every agent.run input is a pure slash command (no free-form pipeline essays)
-#   - featureId must be supplied by the caller (workflow vars are not agent-mutated)
-#   - feature-verify runs `feature check --as done --json` EXACTLY ONCE (0782 R3): the shell
-#     captures the exit code and JSON result, writes the decision to a .status sibling, and
-#     the guards only read that status — no sibling guard re-runs the check.
-#   - A nonempty all-terminal roster routes straight to feature-verify with zero execution
-#     model calls (0782 R2).
-
-"$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
-kind: state-machine
-name: feature-dev
-version: "3"
-description: >
-  Existing-feature execution loop: precheck → execute-tasks → feature-verify → done.
-  Drives a WHOLE feature whose accepted AC and task roster already exist — the caller
-  supplies featureId, this loop reuses the roster and runs it to verified completion.
-  For planning a NEW feature use /sp:dev-plan / /sp:dev-idea; for one deliverable use
-  task-pipeline.yaml directly.
-
-  The engine has no native for-each over a dynamic task list, so execution DELEGATES the
-  fan-out: the precheck resolves the linked roster via `spur feature show` + `spur task
-  list --feature` (captured once under .spur/run/<runId>-feature-dev-{feature,roster}.json),
-  validates the essential structural contract (identity, roster shape, duplicate/mismatched
-  identities, refinement-blocking statuses), and freezes the sorted todo WBS list into
-  .spur/run/<runId>-feature-dev-tasks.txt. The execute-tasks step reads that frozen list
-  into a var (file.read.into-var) and dispatches ONE pure-slash /sp:dev-runall --tasks run
-  with it — the child never re-enumerates membership (0782 R2).
-
-  Shape: precheck → execute-tasks[-auto](delegated frozen batch) → feature-verify →
-  integration-review → done
-         (precheck failure, a non-PASS completion check, or a blocking review short-circuits
-         to `failed`; a nonempty all-terminal roster skips execution entirely).
-
-  Vars (passed as a JSON object via `--vars`):
-    featureId — the existing feature ID this loop drives (required), e.g. `--vars '{"featureId":"B3"}'`
-    agent     — agent the agent.run steps invoke; override `--vars '{"agent":"claude"}'`
-    profile   — `auto` selects execute-tasks-auto (`/sp:dev-runall --tasks … --auto`); otherwise
-                interactive execute-tasks (no --auto, per-task HITL remains)
-    featureTaskIds — frozen todo WBS list projected from the roster file at run time; declared
-                empty so template resolution cannot throw before the read lands (0782 design)
-    spurBin   — PATH-independent spur invocation (CLI overrides at run start; literal fallback)
-    stepTimeoutMs — agent.run budget (ms) for the runall dispatch
-
-  Reliability (ADR-043): every agent.run input is a pure slash command. featureId must be
-  supplied by the caller (workflow vars cannot be mutated by the agent). profile is wired
-  via two execute hops (templates cannot branch a single input string).
-iterationBound: 20
-initialState: precheck
-terminalStates:
-  - done
-  - failed
-failureStates:
-  - failed
-vars:
-  featureId: ""
-  agent: "auto"
-  profile: "standard"
-  featureTaskIds: ""
-  spurBin: "spur"
-  stepTimeoutMs: "1800000"
-  # Integration review (D5-P, feature R11). Advisory by default: a pending, timed-out, or
-  # quota-unavailable review must never block a locally-verified feature. Set
-  # requireCleanReview=true to opt into a hard gate for a branch that must ship clean.
-  baseBranch: ""
-  requireCleanReview: "false"
-  # Injected by WorkflowAppService.run(); scopes .spur/run artifacts per run (0425 R4).
-  __runId: ""
-
-states:
-  - id: precheck
-    description: >
-      Soft precheck (0782 R1): resolve the supplied feature and its linked task roster via
-      existing CLI reads, then validate the essential structural contract — non-empty
-      featureId/runId, a feature-show JSON whose identity matches, a nonempty array roster
-      with unique non-empty WBS identities and known statuses, no backlog/wip/testing/blocked
-      member (planning/refine/resume handoff), and at least one linked task. Rejects fail
-      closed with an actionable handoff BEFORE any model dispatch; nothing is auto-created
-      or re-planned. Always exit 0 so failures route to `failed` via transitions.
-    onEnter:
-      - kind: shell
-        options:
-          # (d) 0825: the 12-command identity/roster program moved into
-          # plugins/sp/scripts/feature-dev-precheck.ts (§1.1 owner); same messages,
-          # artifacts and soft-fail exit-0 contract, wrapper fails closed.
-          command: >-
-            mkdir -p .spur/run; if [ -f plugins/sp/scripts/feature-dev-precheck.ts ]; then bun plugins/sp/scripts/feature-dev-precheck.ts; elif W="$(superskill script path sp feature-dev-precheck.mjs 2>/dev/null)" && [ -f "$W" ]; then node "$W"; else echo "feature-dev precheck failed closed — feature-dev-precheck script not found — run 'superskill install sp'" >&2; printf 'FAIL\n' > ".spur/run/$__runId-feature-dev-precheck.status"; fi; exit 0
-      - kind: note
-        options:
-          message: "Feature-dev start for existing feature ${vars.featureId} (0782 reuse path): roster resolved under .spur/run/${vars.__runId}-feature-dev-roster.json; frozen todo list at .spur/run/${vars.__runId}-feature-dev-tasks.txt."
-
-  # Two pure-slash execute hops so vars.profile actually controls --auto (ADR-043).
-  # Engine templates cannot branch a single input string on profile; declaration-order
-  # transitions pick the correct hop (auto first, then interactive fallback). Each hop first
-  # reads the FROZEN todo list produced by precheck into featureTaskIds, then dispatches the
-  # explicit list — the runall child never re-enumerates membership (0782 R2).
-  - id: execute-tasks-auto
-    description: >
-      profile=auto — dispatch the frozen todo WBS list via pure slash
-      /sp:dev-runall --tasks <list> --auto (skips per-task HITL inside task-pipeline).
-    onEnter:
-      - kind: file.read.into-var
-        options:
-          path: .spur/run/${vars.__runId}-feature-dev-tasks.txt
-          var: featureTaskIds
-          trim: true
-      - kind: agent.run
-        options:
-          agent: ${vars.agent}
-          input: /sp:dev-runall --tasks ${vars.featureTaskIds} --auto
-          answerFile: .spur/run/${vars.__runId}-feature-dev-runall-answer.txt
-          expectFile: .spur/run/${vars.__runId}-feature-dev-runall-answer.txt
-          # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
-          role: planner
-          timeoutMs: ${vars.stepTimeoutMs}
-
-  - id: execute-tasks
-    description: >
-      Interactive — dispatch the frozen todo WBS list via pure slash
-      /sp:dev-runall --tasks <list> without --auto (per-task HITL approve gates remain
-      available).
-    onEnter:
-      - kind: file.read.into-var
-        options:
-          path: .spur/run/${vars.__runId}-feature-dev-tasks.txt
-          var: featureTaskIds
-          trim: true
-      - kind: agent.run
-        options:
-          agent: ${vars.agent}
-          input: /sp:dev-runall --tasks ${vars.featureTaskIds}
-          answerFile: .spur/run/${vars.__runId}-feature-dev-runall-answer.txt
-          expectFile: .spur/run/${vars.__runId}-feature-dev-runall-answer.txt
-          # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
-          role: planner
-          timeoutMs: ${vars.stepTimeoutMs}
-
-  - id: feature-verify
-    description: >
-      Certify the feature is complete (0782 R3): run `spur feature check --as done --json`
-      EXACTLY ONCE, capture the exit code and JSON result at
-      .spur/run/<runId>-feature-dev-verify.json, and decide PASS/FAIL into the .status
-      sibling. PASS requires exit 0, a nonempty result array, and every returned scope
-      pass === true. The guards below only read the captured status — no sibling guard
-      re-runs the check. No --strict elevation, no whole-corpus scan.
-    onEnter:
-      - kind: shell
-        options:
-          # (e) 0825: 9 lines — `feature check --as done` runs EXACTLY ONCE per run (0782 R3)
-          # and owns the status write the guards read; split would re-run the check.
-          command: >-
-            mkdir -p .spur/run; rm -f ".spur/run/$__runId-feature-dev-verify.status"; $spurBin feature check "$featureId" --as done --json > ".spur/run/$__runId-feature-dev-verify.json" 2>&1 && jq -e 'type == "array" and length > 0 and all(.[]; .pass == true)' ".spur/run/$__runId-feature-dev-verify.json" > /dev/null 2>&1 && R=PASS || R=FAIL; printf '%s\n' "$R" > ".spur/run/$__runId-feature-dev-verify.status.tmp" && mv -f ".spur/run/$__runId-feature-dev-verify.status.tmp" ".spur/run/$__runId-feature-dev-verify.status"
-      - kind: note
-        options:
-          message: "Feature verification for ${vars.featureId}: decision at .spur/run/${vars.__runId}-feature-dev-verify.status (evidence at .spur/run/${vars.__runId}-feature-dev-verify.json) — exactly one `feature check --as done --json` invocation per run (0782 R3)."
-
-  - id: integration-review
-    description: >
-      Advisory integration review (D5-P, feature R11), upgraded by 0770 to a
-      truthful collect: ONE Codex review request per HEAD, then exactly ONE
-      `pr-reviewing.ts collect --head <captured-head>` against that same HEAD —
-      no wait loop, no polling. The request verdict (`REQUESTED` /
-      `ALREADY_REQUESTED` / `ALREADY_REVIEWED`) describes request state only;
-      it is NEVER clean evidence. The ONLY clean evidence is the collected
-      status (CLEAN / FINDINGS / PENDING) persisted run-scoped at
-      .spur/run/<runId>-integration-review-collect.status. A missing head SHA,
-      an invalid collect result, or head drift records collect FAIL.
-
-      D8 decision D1 (0753 R3): invoking `pr-reviewing.ts request` directly —
-      the same per-HEAD dedupe-or-request logic `config/workflows/pr-review.yaml`
-      uses internally. Request FAIL records FAIL in
-      .spur/run/<runId>-integration-review.status, loudly (no softFail).
-      `requireCleanReview=true` turns a non-clean COLLECTED verdict (including
-      collect FAIL) into the blocking edge declared first below.
-    onEnter:
-      # (e) 0825: one request action + one collect action (same verdicts, same files,
-      # collect gated on the captured head SHA as before) to hold the §1.2 budgets.
-      - kind: shell
-        options:
-          command: >-
-            mkdir -p .spur/run; bun "$(superskill script path sp pr-reviewing.ts)" request --base "$baseBranch" --json --status-file ".spur/run/$__runId-integration-review-pr-request.status" > ".spur/run/$__runId-integration-review.json" 2>&1 && printf 'PASS\n' > ".spur/run/$__runId-integration-review.status" || printf 'FAIL\n' > ".spur/run/$__runId-integration-review.status"; exit 0
-      - kind: shell
-        options:
-          # (e) 0825: 8 lines — collect stays head-locked to the request record and records
-          # its verdict status file; the rc/status echo is the audible soft-fail contract.
-          command: >-
-            if H=$(jq -er '.head // empty | select(. != "")' ".spur/run/$__runId-integration-review.json" 2>/dev/null); then bun "$(superskill script path sp pr-reviewing.ts)" collect --head "$H" --json --status-file ".spur/run/$__runId-integration-review-collect.status" > ".spur/run/$__runId-integration-review-collect.json" 2>&1; rc=$?; echo "integration-review: collect rc=$rc status=$(cat ".spur/run/$__runId-integration-review-collect.status" 2>/dev/null || echo missing) — verdict captured to .spur/run/$__runId-integration-review-collect.json" >&2; else echo "integration-review: request result carried no head SHA — collect not run, recorded FAIL" >&2; printf 'FAIL\n' > ".spur/run/$__runId-integration-review-collect.status"; fi; exit 0
-      - kind: note
-        options:
-          message: "Integration review for feature ${vars.featureId}: request verdict at .spur/run/${vars.__runId}-integration-review.status (request state only — REQUESTED/ALREADY_* are NEVER clean evidence); collected verdict at .spur/run/${vars.__runId}-integration-review-collect.status (CLEAN/FINDINGS/PENDING — the only clean evidence). Advisory unless requireCleanReview=true."
-
-  - id: done
-    description: Terminal — the existing feature's roster executed and the feature verified.
-
-  - id: failed
-    description: Terminal — the roster contract was rejected at precheck, a task failed verification, or the feature check did not pass.
-
-transitions:
-  # ── precheck routing (0782 R1/R2) — declaration order matters: the all-terminal
-  # direct-verify edge is tried FIRST so a fully-terminal roster reaches completion
-  # verification with zero execution model calls; then the profile hops; then the
-  # failure fallback. ──
-  - from: precheck
-    to: feature-verify
-    description: Roster PASS and every linked task is already terminal — verify the feature directly, zero execution model calls.
-    guard:
-      kind: shell
-      options:
-        command: 'test "$(cat ".spur/run/$__runId-feature-dev-precheck.status" 2>/dev/null)" = PASS && test -f ".spur/run/$__runId-feature-dev-feature.json" && test ! -s ".spur/run/$__runId-feature-dev-tasks.txt"'
-  - from: precheck
-    to: execute-tasks-auto
-    description: Roster PASS with todo work; profile=auto — batch the frozen list with --auto (no per-task HITL).
-    guard:
-      kind: shell
-      options:
-        command: 'test "$(cat ".spur/run/$__runId-feature-dev-precheck.status" 2>/dev/null)" = PASS && test -s ".spur/run/$__runId-feature-dev-tasks.txt" && test "$profile" = auto'
-  - from: precheck
-    to: execute-tasks
-    description: Roster PASS with todo work; interactive — batch the frozen list without --auto.
-    guard:
-      kind: shell
-      options:
-        command: 'test "$(cat ".spur/run/$__runId-feature-dev-precheck.status" 2>/dev/null)" = PASS && test -s ".spur/run/$__runId-feature-dev-tasks.txt"'
-  - from: precheck
-    to: failed
-    description: Precheck FAIL (missing identity, malformed/empty roster, duplicate identities, or refinement-blocking statuses) — stop before any model dispatch.
-    guard:
-      kind: always
-
-  - from: execute-tasks-auto
-    to: feature-verify
-    description: Auto batch finished — verify the feature.
-    guard:
-      kind: always
-  - from: execute-tasks
-    to: feature-verify
-    description: Interactive batch finished — verify the feature.
-    guard:
-      kind: always
-
-  # ── feature-verify gate: the captured one-shot check decision certifies review, else
-  # fail. Declaration order: the pass guard is tried FIRST. The check itself is NOT
-  # re-run here (0782 R3) — the shell decision file is the only evidence. ──
-  - from: feature-verify
-    to: integration-review
-    description: Captured completion check is PASS — spend one integration review on this stable HEAD.
-    guard:
-      kind: shell
-      options:
-        command: 'test "$(cat ".spur/run/$__runId-feature-dev-verify.status" 2>/dev/null)" = PASS'
-  - from: integration-review
-    to: failed
-    description: >
-      Collected verdict is not CLEAN (FINDINGS / PENDING / collect FAIL or
-      missing) and this branch opted into a hard gate (requireCleanReview=true).
-      Exactly one collect ran against the captured request HEAD — no wait loop —
-      so pending or findings stop the feature here with the actual reason.
-      Ordered before the advisory edge so the strict policy wins when both
-      would match.
-    guard:
-      kind: shell
-      options:
-        command: 'test "$requireCleanReview" = true && test "$(cat .spur/run/$__runId-integration-review-collect.status 2>/dev/null)" != CLEAN'
-  - from: integration-review
-    to: done
-    description: >
-      Collected CLEAN, or advisory mode (requireCleanReview != true) — the
-      feature is complete. A non-clean advisory collect never blocks a
-      locally-verified feature (feature R11); the note above preserves the
-      collected non-clean state in the run record instead of hiding it.
-    guard:
-      kind: always
-  - from: feature-verify
-    to: failed
-    description: Completion check missing, malformed, or non-PASS (or its evidence failed to persist) — block BEFORE integration review; no review is requested (0782 R3).
-    guard:
-      kind: always