@gobing-ai/spur 0.3.85 → 0.3.87

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.3.85",
+            "version": "0.3.87",
             "source": "./plugins/sp"
         }
     ]

package/config/pipeline-budgets.json

@@ -28,17 +28,6 @@
             "source": "Post-merge count (0607 R2: doc-sync + learning-capture consolidated, 2 -> 1). Real-run reading (R5): median 253s, max-sane 2319s (n=44). Budget = 60 min ceiling.",
             "decision": null
         },
-        "docs-pipeline": {
-            "modelQueries": 2,
-            "wallClockMs": null,
-            "tokenCostUsd": null,
-            "source": "No fixture (0607 option a) and only dry/short runs recorded in history (max 1s, n=4) — wall-clock budget unenforced until a real docs-pipeline run exists. Query budget 2 matches the live workflow definition's query list ['draft','verify'] (added by task 0704; 0607 R3 recorded 1, which is stale against the definition). 0754 R6: FIX, not raise — the value was wrong against the definition, the workflow's declared query count did not change.",
-            "decision": {
-                "date": "2026-09-03",
-                "wbs": "0754",
-                "note": "align docs-pipeline.modelQueries to the live workflow definition's query list ['draft','verify']; not a measured-cost raise — the workflow's declared query count was already 2 (added by 0704); the budget was the stale side, not the workflow. Per D8 Decision 11."
-            }
-        },
         "pr-review": {
             "modelQueries": 0,
             "wallClockMs": null,
@@ -53,26 +42,12 @@
             "source": "Coverage entry (0826 R2): the live definition's model-query count (extractResolvedWorkflowFacts, 2026-09-11). No real-run measurement yet: wall-clock and cost are unenforced until measured, never 0.",
             "decision": null
         },
-        "feature-dev": {
-            "modelQueries": 2,
-            "wallClockMs": null,
-            "tokenCostUsd": null,
-            "source": "Coverage entry (0826 R2): the live definition's model-query count (extractResolvedWorkflowFacts, 2026-09-11). No real-run measurement yet: wall-clock and cost are unenforced until measured, never 0.",
-            "decision": null
-        },
         "wayfinder-resolution": {
             "modelQueries": 2,
             "wallClockMs": null,
             "tokenCostUsd": null,
             "source": "Coverage entry (0826 R2): the live definition's model-query count (extractResolvedWorkflowFacts, 2026-09-11). No real-run measurement yet: wall-clock and cost are unenforced until measured, never 0.",
             "decision": null
-        },
-        "basic": {
-            "modelQueries": 1,
-            "wallClockMs": null,
-            "tokenCostUsd": null,
-            "source": "Coverage entry (0826 R2): the live definition's model-query count (extractResolvedWorkflowFacts, 2026-09-11). No real-run measurement yet: wall-clock and cost are unenforced until measured, never 0.",
-            "decision": null
         }
     }
 }

package/config/plugin-scripts.json

@@ -26,11 +26,6 @@
             "contract": "standard",
             "twin": "dogfood-testing/validate-report.mjs"
         },
-        {
-            "rel": "feature-dev-precheck.ts",
-            "contract": "standard",
-            "twin": "feature-dev-precheck.mjs"
-        },
         {
             "rel": "feature-sync-bounded.ts",
             "contract": "standard",
@@ -55,6 +50,10 @@
             "rel": "inline-run-setup.ts",
             "contract": "repo-only"
         },
+        {
+            "rel": "idea-coverage-check.ts",
+            "contract": "repo-only"
+        },
         {
             "rel": "inline-pipeline-parity-check.ts",
             "contract": "repo-only"

package/config/rules/boundary/env-var-hygiene.yaml

@@ -0,0 +1,41 @@
+$schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
+# Environment-variable hygiene — env access funnels through the config gateway (task 0902).
+#
+# Contract:
+# - `@gobing-ai/ts-utils` (`packages/utils/src/env.ts` in ts-libs) is the single
+#   implementation source; `packages/config/src/index.ts` re-exports `getEnvVar` /
+#   `getEnvVars` / `setEnvVar` / `removeEnvVar` / `getAppOptions` as the app-side funnel,
+#   and NO file in this repo touches `process.env` directly — packages/config included.
+#   Env flows into the app as typed config or injected `env` records (ADR-027). Runtime
+#   options belong in `.spur/config.yaml` `bootstrap.options` via `getAppOptions`;
+#   dev-only knobs belong in consts.
+# - Plugin scripts/hooks import the same functions from `@gobing-ai/ts-utils`; the
+#   `superskill script convert` `.mjs` twins bundle them in (self-contained on any
+#   install target).
+# - `apps/web` uses `import.meta.env` (Vite browser plane) — not process env, never matches.
+# - Which variables exist and who consumes them is documented in `.env.example`.
+#   (The former per-var lease table moved there; the rule now enforces the funnel,
+#   not a file-by-var inventory.)
+#
+# Scope: apps/**, packages/**, scripts/**, plugins/sp/** — src AND tests. No exclusions:
+# even the gateway package itself is free of direct access.
+include:
+  - "apps/**/src/**/*.{ts,tsx}"
+  - "apps/**/tests/**/*.{ts,tsx}"
+  - "packages/**/src/**/*.{ts,tsx}"
+  - "packages/**/tests/**/*.{ts,tsx}"
+  - "scripts/**/*.ts"
+  - "plugins/sp/**/*.ts"
+rules:
+  - id: env-var-hygiene
+    description: >
+      No direct `process.env` or `Bun.env` access outside the packages/config gateway.
+      Read via `getEnvVar` (single var, undefined-only fallback), seed/compose via
+      `getEnvVars()` (live record — also the sanctioned form for setting/deleting
+      parent→child contract markers), or take an injected `env` record parameter.
+      Aliasing (`const env = process.env`) is caught too — it must touch `process.env`.
+    severity: error
+    evaluator:
+      type: rg
+      config:
+        pattern: "process\\.env|\\bBun\\.env\\b"

package/config/templates/feature/default.md

@@ -23,6 +23,8 @@ updated_at: "{{ CREATED_AT }}"
 ## Acceptance Criteria
 
 ```gherkin
+# Keep the Feature: line (feature check L3.ac-bdd-error without it). Each Scenario: title is the
+# identity key tasks reference verbatim ("- [ ] AC1 — <title>"); number R1, R2, …; never rename after tasks link.
 Feature: {{ NAME }}
 
   Scenario: Basic acceptance

package/config/templates/task/brainstorm.md

@@ -23,11 +23,11 @@ updated_at: "{{ CREATED_AT }}"
 
 ### Requirements
 
-<!-- Constraints the eventual direction must satisfy, if known. -->
+<!-- One R-item per line, exactly `- [ ] R1. <text>` (checkbox + `R<n>.`); `spur task check` flags any other form. Constraints the eventual direction must satisfy, if known. -->
 
 ### Acceptance Criteria
 
-<!-- Decision criteria or success checks for the brainstorm output. Keep empty if not applicable. -->
+<!-- Number items AC1, AC2, … (never R<n> — that is the Requirements namespace): `- [ ] AC1 — <feature scenario title without its R-number>` bullets or `Scenario: AC1 — <title>` blocks; add `(req: R<n>)` to bind a task requirement; task-only checks go in prose below, or set `ac_altitude: task-local`. Keep empty if not applicable. -->
 
 ### Q&A
 

package/config/templates/task/feature-impl.md

@@ -23,11 +23,11 @@ updated_at: "{{ CREATED_AT }}"
 
 ### Requirements
 
-<!-- R-numbered list derived from the linked feature or refined task scope. -->
+<!-- One R-item per line, exactly `- [ ] R1. <text>` (checkbox + `R<n>.`); `spur task check` flags any other form. Derive from the linked feature or refined task scope. -->
 
 ### Acceptance Criteria
 
-<!-- Copy or derive real scenarios from the linked feature. Do not leave placeholder AC here. -->
+<!-- Number items AC1, AC2, … (never R<n> — that is the Requirements namespace): `- [ ] AC1 — <feature scenario title without its R-number>` bullets or `Scenario: AC1 — <title>` blocks; add `(req: R<n>)` to bind a task requirement; task-only checks go in prose below, or set `ac_altitude: task-local`. Do not leave placeholder AC here. -->
 
 ### Q&A
 

package/config/templates/task/issue.md

@@ -23,11 +23,11 @@ updated_at: "{{ CREATED_AT }}"
 
 ### Requirements
 
-<!-- R-numbered expectations for the fix. Include repro/expected behavior if it helps traceability. -->
+<!-- One R-item per line, exactly `- [ ] R1. <text>` (checkbox + `R<n>.`); `spur task check` flags any other form. Include repro/expected behavior if it helps traceability. -->
 
 ### Acceptance Criteria
 
-<!-- Given/When/Then regression scenario or checklist proving the bug is fixed. -->
+<!-- Number items AC1, AC2, … (never R<n> — that is the Requirements namespace): `- [ ] AC1 — <feature scenario title without its R-number>` bullets or `Scenario: AC1 — <title>` blocks; add `(req: R<n>)` to bind a task requirement; task-only checks go in prose below, or set `ac_altitude: task-local`. Use a regression scenario proving the bug is fixed. -->
 
 ### Q&A
 

package/config/templates/task/meta.md

@@ -23,11 +23,11 @@ updated_at: "{{ CREATED_AT }}"
 
 ### Requirements
 
-<!-- R-numbered expectations for the process/docs/chore outcome. Keep empty if not applicable. -->
+<!-- One R-item per line, exactly `- [ ] R1. <text>` (checkbox + `R<n>.`); `spur task check` flags any other form. Keep empty if not applicable. -->
 
 ### Acceptance Criteria
 
-<!-- Lightweight checklist or Given/When/Then if there is an observable completion condition. -->
+<!-- Number items AC1, AC2, … (never R<n> — that is the Requirements namespace): `- [ ] AC1 — <feature scenario title without its R-number>` bullets or `Scenario: AC1 — <title>` blocks; add `(req: R<n>)` to bind a task requirement; task-only checks go in prose below, or set `ac_altitude: task-local`. Keep empty if not applicable. -->
 
 ### Q&A
 

package/config/templates/task/review.md

@@ -33,11 +33,11 @@ in the reviewed PR/commit/diff). Fix in priority order (P1 → P2 → …); re-r
 
 ### Requirements
 
-<!-- R-numbered fix requirements derived from the findings. Fill after triage/refinement. -->
+<!-- One R-item per line, exactly `- [ ] R1. <text>` (checkbox + `R<n>.`); `spur task check` flags any other form. Fill after triage/refinement from the findings. -->
 
 ### Acceptance Criteria
 
-<!-- Checks that prove the findings were addressed. Keep empty until the review task becomes executable work. -->
+<!-- Number items AC1, AC2, … (never R<n> — that is the Requirements namespace): `- [ ] AC1 — <feature scenario title without its R-number>` bullets or `Scenario: AC1 — <title>` blocks; add `(req: R<n>)` to bind a task requirement; task-only checks go in prose below, or set `ac_altitude: task-local`. Keep empty until the review task becomes executable work. -->
 
 ### Q&A
 

package/config/templates/task/standard.md

@@ -23,11 +23,11 @@ updated_at: "{{ CREATED_AT }}"
 
 ### Requirements
 
-<!-- R-numbered list of what must be true when this task is complete. Keep empty until requirements are known. -->
+<!-- One R-item per line, exactly `- [ ] R1. <text>` (checkbox + `R<n>.`); `spur task check` flags any other form. Keep empty until requirements are known. -->
 
 ### Acceptance Criteria
 
-<!-- Given/When/Then scenarios or a checklist derived from Requirements. Keep empty if this task has no objective AC yet. -->
+<!-- Number items AC1, AC2, … (never R<n> — that is the Requirements namespace): `- [ ] AC1 — <feature scenario title without its R-number>` bullets or `Scenario: AC1 — <title>` blocks; add `(req: R<n>)` to bind a task requirement; task-only checks go in prose below, or set `ac_altitude: task-local`. Keep empty if this task has no objective AC yet. -->
 
 ### Q&A
 

package/config/transition-shims.json

@@ -1,5 +1,5 @@
 {
-    "note": "Transition-shim manifest (task 0541, feature B2). Each entry records one compatibility path marked @transition-shim(<id>) in source. Every field is required. The gate (bun run transition-shim-check, inside `spur-check`) is two-sided: an unregistered marker fails, and a listed entry whose marker is gone fails. Emptying this file is the definition of the transition being complete (docs/04_DESIGN.md §2.5). Removal conditions must be objectively checkable against the repository, not 'when convenient'. Shims are registered by the tasks that create them (0536/0537/0538/0542).",
+    "note": "Transition-shim manifest (task 0541, feature B2). Each entry records one compatibility path marked @transition-shim(<id>) in source. Every field is required. The gate (bun run transition-shim-check, in the feature-scoped `spur-check-feature` pass since task 0872) is two-sided: an unregistered marker fails, and a listed entry whose marker is gone fails. Emptying this file is the definition of the transition being complete (docs/04_DESIGN.md §2.5). Removal conditions must be objectively checkable against the repository, not 'when convenient'. Shims are registered by the tasks that create them (0536/0537/0538/0542).",
     "entries": [
         {
             "id": "agent-bare-binary-name",

package/config/workflow-candidates.json

@@ -0,0 +1,19 @@
+{
+    "schemaVersion": 1,
+    "note": "Workflow graph-change promotion candidates (task 0873, feature D62; ADR-076 amendment). A candidate is shadow-run against recorded real-run inputs and is promoted into the canonical definition or deleted by its named deadline — never left as a standing parallel <name>2.yaml. `verdict` is null while pending and is filled by `bun scripts/spur-dev.ts promotion evaluate <id>`; `promotion check` (spur-check-feature) fails any candidate still present past its deadline, any unreferenced parallel definition in config/workflows/, and (0877 R8) any retired definition with real (non-dry) terminal runs lacking a recorded decision in `retirements[]`.",
+    "candidates": [],
+    "retirements": [
+        {
+            "name": "planning-pipeline",
+            "recordedBy": "0872 (ADR-072/075 composition-baseline pass 2dc86579a)",
+            "date": "2026-08-19",
+            "rationale": "Planning pipeline superseded by the task-pipeline planning stages; 3 real terminal runs retained in history."
+        },
+        {
+            "name": "task-pipeline2",
+            "recordedBy": "ADR-076 (commit 017ac7a30)",
+            "date": "2026-08-20",
+            "rationale": "Standing parallel definition deleted with the D5-N fixture promotion bar; 5 real terminal runs retained in history."
+        }
+    ]
+}

package/config/workflows/feature-lifecycle.yaml

@@ -37,6 +37,12 @@ states:
     description: >
       Feature verification work (DD-13). Makes verification derivable —
       listable, event-triggerable, assignable.
+    onEnter:
+      # Caller wiring (task 0880, ADR-119): entering verification RUNS the
+      # feature-scoped pass instead of only passively reading its status file.
+      - kind: shell
+        options:
+          command: '$spurBin workflow run feature-verification.yaml --vars "{\"featureId\":\"$featureId\"}"'
   - id: blocked
     description: Impediment; work suspended.
   - id: done
@@ -62,11 +68,13 @@ transitions:
   - from: verifying
     to: done
     description: >
-      Feature verified — complete. Runs strict check (AC validated, traceability clean).
+      Feature verified — complete. Requires the feature-scoped verification pass
+      (ADR-119) to have recorded PASS, then strict check (AC validated,
+      traceability clean).
     guard:
       kind: shell
       options:
-        command: '$spurBin feature check $featureId --strict --as done'
+        command: 'test "$(cat .spur/run/$featureId-feature-verification.status 2>/dev/null)" = PASS && $spurBin feature check $featureId --strict --as done'
 
   # Rework: verifying → active (mandatory History entry)
   - from: verifying

package/config/workflows/feature-verification.yaml

@@ -0,0 +1,71 @@
+# Feature-scoped verification pass (ADR-119, feature D62, task 0872).
+#
+# Owns a lifecycle boundary no per-task graph owns: the repo-wide checks whose
+# invariant spans the repository rather than a single task's diff — corpus
+# consistency, contract baselines, dependency/schema drift, the frozen History
+# surface, and the repo-wide test set. They run once per feature, deliberately
+# the slow pass; `feature-lifecycle`'s verifying entry invokes this workflow (task
+# 0880 caller wiring), and its verifying→done guard refuses to complete the
+# feature until this pass records PASS (ADR-119 consequence: a feature is not
+# done until it passes).
+#
+# Run: spur workflow run feature-verification.yaml --vars '{"featureId":"D62"}'
+#
+# Shape: verify -> done | failed. The shell action writes the verdict to
+# `.spur/run/<featureId>-feature-verification.status` and always exits 0; the
+# transition guard reads the status so a missing, corrupt or FAIL verdict routes
+# to `failed` (fail-closed), never a silent PASS.
+#
+# Reliability (aligned with task-pipeline / ADR-043): no agent.run nodes; the
+# verification command is a trusted config var executed via `sh -c` (same
+# surface as task-pipeline's qualityGateCmd — never interpolate untrusted input).
+"$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
+kind: state-machine
+name: feature-verification
+version: "1"
+description: "Feature-scoped verification pass (ADR-119): runs the repo-wide check set once per feature and records PASS/FAIL. Invoked by feature-lifecycle's verifying entry."
+iterationBound: 2
+initialState: verify
+terminalStates:
+  - done
+  - failed
+failureStates:
+  - failed
+vars:
+  featureId: "X"
+  spurBin: "spur"
+  verificationCmd: "bun run spur-check-feature"
+
+states:
+  - id: verify
+    description: >
+      Run the repo-wide check set, record the verdict, always exit 0.
+    onEnter:
+      - kind: shell
+        options:
+          command: >-
+            mkdir -p .spur/run;
+            sh -c "$verificationCmd" > ".spur/run/$featureId-feature-verification.log" 2>&1
+            && printf 'PASS\n' > ".spur/run/$featureId-feature-verification.status"
+            || printf 'FAIL\n' > ".spur/run/$featureId-feature-verification.status";
+            exit 0
+
+  - id: done
+    description: Terminal — repo-wide checks passed.
+
+  - id: failed
+    description: Terminal — repo-wide checks failed or the verdict is missing/corrupt.
+
+transitions:
+  - from: verify
+    to: done
+    description: Repo-wide checks passed — the feature-scoped verification pass records PASS.
+    guard:
+      kind: shell
+      options:
+        command: 'test "$(cat .spur/run/$featureId-feature-verification.status 2>/dev/null)" = PASS'
+  - from: verify
+    to: failed
+    description: Repo-wide checks failed (or the verdict is missing/corrupt) — stop at failed.
+    guard:
+      kind: always