@gobing-ai/spur 0.3.86 → 0.3.88

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.3.86",
+            "version": "0.3.88",
             "source": "./plugins/sp"
         }
     ]

package/config/config.example.yaml

@@ -133,9 +133,18 @@ agent:
     # A disabled profile stays visible to `spur agent doctor` but never routes
     # (no role, team, stage, or explicit selection). Flip back to enabled by
     # removing the line or setting disabled: false.
+    # Quota refresh is external: schedule `spur agent usage` (cron/launchd) to
+    # capture provider usage and record quota-owned availability observations.
+    # spur serve never runs it (B6 0892; docs/design/session-pinned-dispatch.md §3.4).
+    # A bare `true` is operator-owned (only humans write booleans). Automatic
+    # writers (quota/probe checks) emit the ownership object instead; an
+    # operator-owned disable is never auto-re-enabled (B6 0890).
     # - name: retired-profile
     #   agent: omp
     #   disabled: true
+    # - name: quota-limited
+    #   agent: omp
+    #   disabled: { owner: quota, since: 2026-02-14T09:30:00.000Z, reason: agent.quota.exhausted quota-limited }
     - name: pi-dsv4-flash-volc
       agent: pi
     #   tier: standard

package/config/plugin-scripts.json

@@ -50,6 +50,10 @@
             "rel": "inline-run-setup.ts",
             "contract": "repo-only"
         },
+        {
+            "rel": "idea-coverage-check.ts",
+            "contract": "repo-only"
+        },
         {
             "rel": "inline-pipeline-parity-check.ts",
             "contract": "repo-only"

package/config/rules/strict/runtime-boundaries.yaml

@@ -58,6 +58,7 @@ rules:
             - "packages/app/src/services/token-ledger-watcher.ts" # node:fs watch() live watcher
             - "packages/app/src/services/project-registry.ts" # atomic projects.json persistence
             - "packages/app/src/services/slash-commands-service.ts" # synchronous ~/.config/spur/slash_commands.json persistence (mirrors project-registry.ts)
+            - "packages/app/src/services/agent-usage-producer.ts" # atomic agent-usage snapshot write (tmp + rename, mirrors project-registry.ts; task 0892 R1)
             - "packages/app/src/services/history-service.ts" # versioned analyze artifact + bounded-errors sidecar + latest.json symlink pointer (task 0474); ts-runtime FileSystem seam has no symlink, so the pointer uses node:fs directly (mirrors project-registry.ts persistence exemption)
             - "packages/app/src/observability/workflow-run-log-sink.ts" # sync FD append for mid-run tail-able all-in-one run log (task 0426 / feature D2); append() is sync from the observability bus
             - "apps/cli/src/commands/workflow.ts" # FD byte-window tail of the mid-run run log for `workflow trace --follow` streaming (task 0428 / feature D2); readSync at offset over the observability sink's FDs

package/config/templates/feature/default.md

@@ -23,6 +23,8 @@ updated_at: "{{ CREATED_AT }}"
 ## Acceptance Criteria
 
 ```gherkin
+# Keep the Feature: line (feature check L3.ac-bdd-error without it). Each Scenario: title is the
+# identity key tasks reference verbatim ("- [ ] AC1 — <title>"); number R1, R2, …; never rename after tasks link.
 Feature: {{ NAME }}
 
   Scenario: Basic acceptance

package/config/templates/task/brainstorm.md

@@ -23,11 +23,11 @@ updated_at: "{{ CREATED_AT }}"
 
 ### Requirements
 
-<!-- Constraints the eventual direction must satisfy, if known. -->
+<!-- One R-item per line, exactly `- [ ] R1. <text>` (checkbox + `R<n>.`); `spur task check` flags any other form. Constraints the eventual direction must satisfy, if known. -->
 
 ### Acceptance Criteria
 
-<!-- Decision criteria or success checks for the brainstorm output. Keep empty if not applicable. -->
+<!-- Number items AC1, AC2, … (never R<n> — that is the Requirements namespace): `- [ ] AC1 — <feature scenario title without its R-number>` bullets or `Scenario: AC1 — <title>` blocks; add `(req: R<n>)` to bind a task requirement; task-only checks go in prose below, or set `ac_altitude: task-local`. Keep empty if not applicable. -->
 
 ### Q&A
 

package/config/templates/task/feature-impl.md

@@ -23,11 +23,11 @@ updated_at: "{{ CREATED_AT }}"
 
 ### Requirements
 
-<!-- R-numbered list derived from the linked feature or refined task scope. -->
+<!-- One R-item per line, exactly `- [ ] R1. <text>` (checkbox + `R<n>.`); `spur task check` flags any other form. Derive from the linked feature or refined task scope. -->
 
 ### Acceptance Criteria
 
-<!-- Copy or derive real scenarios from the linked feature. Do not leave placeholder AC here. -->
+<!-- Number items AC1, AC2, … (never R<n> — that is the Requirements namespace): `- [ ] AC1 — <feature scenario title without its R-number>` bullets or `Scenario: AC1 — <title>` blocks; add `(req: R<n>)` to bind a task requirement; task-only checks go in prose below, or set `ac_altitude: task-local`. Do not leave placeholder AC here. -->
 
 ### Q&A
 

package/config/templates/task/issue.md

@@ -23,11 +23,11 @@ updated_at: "{{ CREATED_AT }}"
 
 ### Requirements
 
-<!-- R-numbered expectations for the fix. Include repro/expected behavior if it helps traceability. -->
+<!-- One R-item per line, exactly `- [ ] R1. <text>` (checkbox + `R<n>.`); `spur task check` flags any other form. Include repro/expected behavior if it helps traceability. -->
 
 ### Acceptance Criteria
 
-<!-- Given/When/Then regression scenario or checklist proving the bug is fixed. -->
+<!-- Number items AC1, AC2, … (never R<n> — that is the Requirements namespace): `- [ ] AC1 — <feature scenario title without its R-number>` bullets or `Scenario: AC1 — <title>` blocks; add `(req: R<n>)` to bind a task requirement; task-only checks go in prose below, or set `ac_altitude: task-local`. Use a regression scenario proving the bug is fixed. -->
 
 ### Q&A
 

package/config/templates/task/meta.md

@@ -23,11 +23,11 @@ updated_at: "{{ CREATED_AT }}"
 
 ### Requirements
 
-<!-- R-numbered expectations for the process/docs/chore outcome. Keep empty if not applicable. -->
+<!-- One R-item per line, exactly `- [ ] R1. <text>` (checkbox + `R<n>.`); `spur task check` flags any other form. Keep empty if not applicable. -->
 
 ### Acceptance Criteria
 
-<!-- Lightweight checklist or Given/When/Then if there is an observable completion condition. -->
+<!-- Number items AC1, AC2, … (never R<n> — that is the Requirements namespace): `- [ ] AC1 — <feature scenario title without its R-number>` bullets or `Scenario: AC1 — <title>` blocks; add `(req: R<n>)` to bind a task requirement; task-only checks go in prose below, or set `ac_altitude: task-local`. Keep empty if not applicable. -->
 
 ### Q&A
 

package/config/templates/task/review.md

@@ -33,11 +33,11 @@ in the reviewed PR/commit/diff). Fix in priority order (P1 → P2 → …); re-r
 
 ### Requirements
 
-<!-- R-numbered fix requirements derived from the findings. Fill after triage/refinement. -->
+<!-- One R-item per line, exactly `- [ ] R1. <text>` (checkbox + `R<n>.`); `spur task check` flags any other form. Fill after triage/refinement from the findings. -->
 
 ### Acceptance Criteria
 
-<!-- Checks that prove the findings were addressed. Keep empty until the review task becomes executable work. -->
+<!-- Number items AC1, AC2, … (never R<n> — that is the Requirements namespace): `- [ ] AC1 — <feature scenario title without its R-number>` bullets or `Scenario: AC1 — <title>` blocks; add `(req: R<n>)` to bind a task requirement; task-only checks go in prose below, or set `ac_altitude: task-local`. Keep empty until the review task becomes executable work. -->
 
 ### Q&A
 

package/config/templates/task/standard.md

@@ -23,11 +23,11 @@ updated_at: "{{ CREATED_AT }}"
 
 ### Requirements
 
-<!-- R-numbered list of what must be true when this task is complete. Keep empty until requirements are known. -->
+<!-- One R-item per line, exactly `- [ ] R1. <text>` (checkbox + `R<n>.`); `spur task check` flags any other form. Keep empty until requirements are known. -->
 
 ### Acceptance Criteria
 
-<!-- Given/When/Then scenarios or a checklist derived from Requirements. Keep empty if this task has no objective AC yet. -->
+<!-- Number items AC1, AC2, … (never R<n> — that is the Requirements namespace): `- [ ] AC1 — <feature scenario title without its R-number>` bullets or `Scenario: AC1 — <title>` blocks; add `(req: R<n>)` to bind a task requirement; task-only checks go in prose below, or set `ac_altitude: task-local`. Keep empty if this task has no objective AC yet. -->
 
 ### Q&A
 

package/config/workflow-candidates.json

@@ -1,41 +1,19 @@
 {
     "schemaVersion": 1,
-    "note": "Workflow graph-change promotion candidates (task 0873, feature D62; ADR-076 amendment). A candidate is shadow-run against recorded real-run inputs and is promoted into the canonical definition or deleted by its named deadline — never left as a standing parallel <name>2.yaml. `verdict` is null while pending and is filled by `bun scripts/spur-dev.ts promotion evaluate <id>`; `promotion check` (spur-check-feature) fails any candidate still present past its deadline and any unreferenced parallel definition in config/workflows/.",
-    "candidates": [
+    "note": "Workflow graph-change promotion candidates (task 0873, feature D62; ADR-076 amendment). A candidate is shadow-run against recorded real-run inputs and is promoted into the canonical definition or deleted by its named deadline — never left as a standing parallel <name>2.yaml. `verdict` is null while pending and is filled by `bun scripts/spur-dev.ts promotion evaluate <id>`; `promotion check` (spur-check-feature) fails any candidate still present past its deadline, any unreferenced parallel definition in config/workflows/, and (0877 R8) any retired definition with real (non-dry) terminal runs lacking a recorded decision in `retirements[]`.",
+    "candidates": [],
+    "retirements": [
         {
-            "id": "wrapup-contract-violation-pilot-routing",
-            "canonical": "wrapup-pipeline",
-            "deadline": "2026-10-17",
-            "createdAt": "2026-09-17",
-            "rationale": "ADR-118 pilot graph change shipped by task 0871 (doc-sync contract-violation routing to the shell-only repair state). Registered by task 0876 to take the promotion decision on its first real-run measurement (R4/R5): wrapup-pipeline run fadca099-25a7-4884-a4ae-923cd0239775 (done, state-machine, definition sha256:cad7ad8b..., v4, created 2026-09-17T15:14:46Z, 14h28m after 0871 landed at 00:46:46Z - the only post-landing terminal non-dry wrapup run) routed doc-sync->learnings-append on the default edge: the doc-sync agent.run exited clean (exitCode 0) and produced its declared expectFile capture (.spur/run/fadca099-...-wrapup-learnings.md), so data.outcome was success, ContractViolationGuardRunner passed:false (packages/app/src/workflow/guards/contract-violation.ts:26), zero workflow.agent.contract-violation system_events, zero failed actions (executor-failure path not taken), no repair status file. Measured absence on real traffic - never fabricated. The change projects delta.agentRunCount=1 (unchanged): the repair edge adds no model hop (repair is a shell that records the miss; ADR-118 forbids re-dispatch), so the ADR-076 cost bar cannot reward it; its justification is ADR-118 routing correctness, evidenced here by the measured absence on the first real run. Disposition (resolve delete, or hold as the pattern-spread precedent for 0873's gate) belongs to the D62 owner before the deadline.",
-            "measurement": {
-                "workflow": "wrapup-pipeline",
-                "runIds": ["fadca099-25a7-4884-a4ae-923cd0239775"]
-            },
-            "delta": {
-                "agentRunCount": 1
-            },
-            "verdict": {
-                "decision": "delete",
-                "evaluatedAt": "2026-09-17T15:33:27.274Z",
-                "agentRunCount": {
-                    "runs": 1,
-                    "mean": 1,
-                    "median": 1,
-                    "min": 1,
-                    "max": 1
-                },
-                "agentRunDurationMs": {
-                    "runs": 1,
-                    "mean": 505937,
-                    "median": 505937,
-                    "min": 505937,
-                    "max": 505937
-                },
-                "candidateAgentRunCount": 1,
-                "canonicalAgentRunCount": 1,
-                "reason": "candidate projects 1 agent.run action(s), not fewer than the canonical wrapup-pipeline count of 1 (1 real run(s), median 1 agent.run action(s)/run, median 505937 ms/run) — ADR-076 rejected a graph adding a model hop"
-            }
+            "name": "planning-pipeline",
+            "recordedBy": "0872 (ADR-072/075 composition-baseline pass 2dc86579a)",
+            "date": "2026-08-19",
+            "rationale": "Planning pipeline superseded by the task-pipeline planning stages; 3 real terminal runs retained in history."
+        },
+        {
+            "name": "task-pipeline2",
+            "recordedBy": "ADR-076 (commit 017ac7a30)",
+            "date": "2026-08-20",
+            "rationale": "Standing parallel definition deleted with the D5-N fixture promotion bar; 5 real terminal runs retained in history."
         }
     ]
 }

package/config/workflows/feature-lifecycle.yaml

@@ -37,6 +37,12 @@ states:
     description: >
       Feature verification work (DD-13). Makes verification derivable —
       listable, event-triggerable, assignable.
+    onEnter:
+      # Caller wiring (task 0880, ADR-119): entering verification RUNS the
+      # feature-scoped pass instead of only passively reading its status file.
+      - kind: shell
+        options:
+          command: '$spurBin workflow run feature-verification.yaml --vars "{\"featureId\":\"$featureId\"}"'
   - id: blocked
     description: Impediment; work suspended.
   - id: done

package/config/workflows/feature-verification.yaml

@@ -3,10 +3,11 @@
 # Owns a lifecycle boundary no per-task graph owns: the repo-wide checks whose
 # invariant spans the repository rather than a single task's diff — corpus
 # consistency, contract baselines, dependency/schema drift, the frozen History
-# surface, and the repo-wide test set. They run once per feature against a
-# settled tree, deliberately the slow pass, and `feature-lifecycle`'s
-# verifying→done guard refuses to complete the feature until this pass records
-# PASS (ADR-119 consequence: a feature is not done until it passes).
+# surface, and the repo-wide test set. They run once per feature, deliberately
+# the slow pass; `feature-lifecycle`'s verifying entry invokes this workflow (task
+# 0880 caller wiring), and its verifying→done guard refuses to complete the
+# feature until this pass records PASS (ADR-119 consequence: a feature is not
+# done until it passes).
 #
 # Run: spur workflow run feature-verification.yaml --vars '{"featureId":"D62"}'
 #
@@ -22,7 +23,7 @@
 kind: state-machine
 name: feature-verification
 version: "1"
-description: "Feature-scoped verification pass (ADR-119): runs the repo-wide check set once per feature against a settled tree and records PASS/FAIL."
+description: "Feature-scoped verification pass (ADR-119): runs the repo-wide check set once per feature and records PASS/FAIL. Invoked by feature-lifecycle's verifying entry."
 iterationBound: 2
 initialState: verify
 terminalStates:

package/config/workflows/idea-pipeline.yaml

@@ -94,10 +94,17 @@ states:
           agent: "${vars.agent}"
           role: planner
           resolvedAgentVar: planningAgent
+          # B7 R1 (0894): also pin the role once — __executor.planner feeds stage
+          # dispatch so no later idea stage re-walks the doctor ladder.
+          roles:
+            planner: "${vars.agent}"
       - kind: shell
         options:
           command: >-
-            test -n "$idea" || printf 'FAIL\n' > ".spur/run/$__runId-idea-precheck-doctor.status"
+            mkdir -p .spur/run &&
+            printf '%s\n' "$idea" > ".spur/run/$__runId-idea-input.md" &&
+            awk 'NF' ".spur/run/$__runId-idea-input.md" | grep -q . ||
+            printf 'FAIL\n' > ".spur/run/$__runId-idea-precheck-doctor.status"
 
   - id: discovery
     description: >
@@ -109,14 +116,19 @@ states:
       brainstorm also emits the idea-evaluation report to .spur/run/${vars.__runId}-idea-eval-report.md
       (template: the `sp:spur-dev` skill's `idea-evaluation` reference — named by skill, not by
       repo path, because `spur init` never scaffolds `plugins/sp/` into a seeded project).
+      The operator's verbatim idea argument is persisted at .spur/run/${vars.__runId}-idea-input.md
+      (written by start; the authoritative ask every model-bearing stage reads).
       expectFile fails a silent no-op discovery (no eval report).
     onEnter:
       - kind: agent.run
         options:
           agent: ${vars.planningAgent}
-          input: "Run sp:brainstorm for the idea: ${vars.idea}. The skill owns the approach-generation, design summary, and `needs_design` signal criteria; emit .spur/run/${vars.__runId}-idea-needs-design.json ({\"needs_design\": true|false}) and the design summary per the skill's `Design Approval Gate` and `The needs_design signal` sections. Also emit the idea-evaluation report to .spur/run/${vars.__runId}-idea-eval-report.md per the `sp:spur-dev` skill's `idea-evaluation` reference (urgency/necessity 0–5, premises, pros/cons, alternatives, enhanced idea, recommendation). At the END of the report, append a provenance footer block of the exact form: `---\\nrun_id: ${vars.__runId}\\ngenerated_at: <RFC3339 timestamp>\\n---` (omit the footer only if run_id is empty)."
+          input: "The operator's ask of record is .spur/run/${vars.__runId}-idea-input.md — idea persisted verbatim at start; authoritative, read it first (${vars.idea} is a convenience echo). Run sp:brainstorm. The skill owns the approach-generation, design summary, and `needs_design` signal criteria; emit .spur/run/${vars.__runId}-idea-needs-design.json ({\"needs_design\": true|false}) plus the design summary per its `Design Approval Gate` / `The needs_design signal` sections. Also emit the idea-evaluation report to .spur/run/${vars.__runId}-idea-eval-report.md per the `sp:spur-dev` skill's `idea-evaluation` reference (urgency/necessity 0–5, premises, pros/cons, alternatives, enhanced idea, recommendation, plus mandatory `## Requirement inventory`: numbered I<n> items quoting/paraphrasing idea-input lines; `[unclear: ...]` marks ambiguity, `[deferred: <reason>]` marks out-of-scope). End with this exact footer: `---\\nrun_id: ${vars.__runId}\\ngenerated_at: <RFC3339>\\n---` (omit if run_id is empty)."
           # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
           role: planner
+          # B7 R6 (0894): planner stages declare fresh — the role default is stated
+          # explicitly so the definition is self-documenting.
+          session: fresh
           expectFile: .spur/run/${vars.__runId}-idea-eval-report.md
           timeoutMs: ${vars.stepTimeoutMs}
 
@@ -143,14 +155,18 @@ states:
       checklists never enter Goal. Shell actions then persist both sections through
       `spur feature update --section Goal|Scope --from-file ...`; a missing/empty artifact
       stops the state. Prefer the enhanced idea from .spur/run/${vars.__runId}-idea-eval-report.md as
-      context; do not overwrite vars.idea.
+      context; do not overwrite vars.idea. The operator's verbatim ask of record is
+      .spur/run/${vars.__runId}-idea-input.md (persisted at start; authoritative over any
+      paraphrase).
     onEnter:
       - kind: agent.run
         options:
           agent: ${vars.planningAgent}
-          input: 'Create a feature for the idea: ${vars.idea}. Read .spur/run/${vars.__runId}-idea-eval-report.md if present for the enhanced idea and scores. Use ''spur feature create "<name>" --json'' to create it. Write the feature id to .spur/run/${vars.__runId}-idea-feature-id.txt. If an existing feature is appropriate, use its id instead. Also write two body-only intent artifacts: .spur/run/${vars.__runId}-idea-goal.md with concise Goal intent only (a short statement of what the feature achieves; never task breakdowns, checklists, or how-to steps), and .spur/run/${vars.__runId}-idea-scope.md with explicit in-scope and out-of-scope boundary bullets.'
+          input: 'Create a feature for the idea. The operator''s ask of record is .spur/run/${vars.__runId}-idea-input.md — the idea argument persisted verbatim at start; treat it as the authoritative ask. Read .spur/run/${vars.__runId}-idea-eval-report.md if present for the enhanced idea and scores. Use ''spur feature create "<name>" --json'' to create it; with --json the feature id is returned under the .ref.id envelope (n), not a top-level .id — read it from there. Write the feature id to .spur/run/${vars.__runId}-idea-feature-id.txt. If an existing feature is appropriate, use its id instead. Also write two body-only intent artifacts: .spur/run/${vars.__runId}-idea-goal.md with concise Goal intent only (a short statement of what the feature achieves; never task breakdowns, checklists, or how-to steps), and .spur/run/${vars.__runId}-idea-scope.md with explicit in-scope and out-of-scope boundary bullets.'
           # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
           role: planner
+          # B7 R6 (0894): declared fresh policy (planner default).
+          session: fresh
           expectFile: .spur/run/${vars.__runId}-idea-feature-id.txt
           timeoutMs: ${vars.stepTimeoutMs}
       - kind: file.read.into-var
@@ -182,6 +198,9 @@ states:
       check records FAIL and routes through the capped retry loop via guards that consume the
       recorded result — it never fails the run (the engine's default onError policy is `fail`,
       so an in-action check failure would kill the run before the retry edges are evaluated).
+      Requirement coverage is MEASURED alongside it by the soft idea-coverage-check shell
+      (0887 R4): the recorded coverage status conjuncts into the profile=auto ac-generate
+      guards below so uncovered inventory items route through the same capped retry loop.
     onEnter:
       - kind: shell
         options:
@@ -189,9 +208,11 @@ states:
       - kind: agent.run
         options:
           agent: ${vars.planningAgent}
-          input: "Generate acceptance criteria for feature ${vars.featureId}. Read the feature file and author R-numbered BDD Gherkin scenarios per ac-style-guide.md. Output only the complete Acceptance Criteria section body, including the gherkin code fence, with no surrounding commentary and no section heading."
+          input: "Generate acceptance criteria for feature ${vars.featureId}. The operator's ask of record is .spur/run/${vars.__runId}-idea-input.md — idea persisted verbatim at start; authoritative. Read the feature file and author R-numbered BDD Gherkin scenarios per ac-style-guide.md. Tie every scenario to the `## Requirement inventory` of .spur/run/${vars.__runId}-idea-eval-report.md: under each `Scenario:` heading add a comment `# covers: I1, I3` listing covered ids — every non-`[deferred: ...]` item needs at least one covering scenario. Two `spur task check` rules bind AC text: (1) AC bullets copy scenario titles verbatim — the title is the byte-identical identity key of its bullet; (2) gate-language words (HITL, approval/approved, merged/merge event, content-gate, GATED, capstone standalone) are forbidden in titles, bodies, and enum values (L4.gate-language) — rephrase around them. Output only the Acceptance Criteria section body (gherkin fence included), no commentary, no heading."
           # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
           role: planner
+          # B7 R6 (0894): declared fresh policy (planner default).
+          session: fresh
           answerFile: .spur/run/${vars.__runId}-idea-ac-content.md
           expectFile: .spur/run/${vars.__runId}-idea-ac-content.md
           timeoutMs: ${vars.stepTimeoutMs}
@@ -221,6 +242,24 @@ states:
           resultFile: .spur/run/${vars.__runId}-idea-ac-check.status
           softFail: true
           timeoutMs: 120000
+      # 0887 R4: requirement-inventory ↔ AC coverage, measured once at the same author/revise
+      # boundary. Soft shell (exit 0 always): the checker writes the PASS/FAIL status itself and
+      # the guards below consume the recorded result — never re-run the checker (0769 pattern).
+      # Repo-checkout path first, then the superskill-staged twin (handoff-finalize resolution
+      # shape); neither present fails closed to FAIL so readiness degrades visibly instead of
+      # silently skipping coverage.
+      - kind: shell
+        options:
+          command: >-
+            mkdir -p .spur/run &&
+            S=plugins/sp/scripts/idea-coverage-check.ts &&
+            if [ ! -f "$S" ]; then S="$(superskill script path sp idea-coverage-check.ts 2>/dev/null)"; fi &&
+            if [ -n "$S" ] && [ -f "$S" ]; then
+              bun "$S" --run-id "$__runId" --report ".spur/run/$__runId-idea-eval-report.md" --ac ".spur/run/$__runId-idea-ac-content.md" || printf 'FAIL run=%s checker exited nonzero (bun missing or checker crash)\n' "$__runId" > ".spur/run/$__runId-idea-coverage.reason";
+            else
+              printf 'FAIL run=%s checker not found — run superskill install sp\n' "$__runId" | tee ".spur/run/$__runId-idea-coverage.reason" >&2;
+              printf 'FAIL\n' > ".spur/run/$__runId-idea-coverage.status";
+            fi
 
   - id: feature-check
     description: >
@@ -235,11 +274,14 @@ states:
       the transition guards route directly from ac-generate to the appropriate next
       state, so this state is only entered in interactive mode. On failure, the retry
       cap routes back to ac-generate (≤3 retries) or escalates to failed.
+      Requirement coverage (.spur/run/${vars.__runId}-idea-coverage.status, 0887 R4) is part of
+      the recorded results this gate surfaces: a FAIL there means some inventory items have no
+      covering scenario — answer no to route back to ac-generate for revision if needed.
     pause: true
     onEnter:
       - kind: hitl.confirm
         options:
-          prompt: "Feature check for ${vars.featureId}. Review the AC and confirm to proceed? (Failures route back to ac-generate for revision, capped at 3 retries.)"
+          prompt: "Feature check for ${vars.featureId}. Review the AC and confirm to proceed? Requirement coverage status: $(cat .spur/run/${vars.__runId}-idea-coverage.status 2>/dev/null || echo unknown) — reason: $(cat .spur/run/${vars.__runId}-idea-coverage.reason 2>/dev/null || echo n/a) (.spur/run/${vars.__runId}-idea-coverage.status[.reason]). (Failures route back to ac-generate for revision, capped at 3 retries.)"
 
   - id: system-design
     description: >
@@ -264,9 +306,11 @@ states:
       - kind: agent.run
         options:
           agent: ${vars.planningAgent}
-          input: 'Run sp:sys-architecture for feature ${vars.featureId}. Read the brainstorm artifact, feature AC, and .spur/run/${vars.__runId}-idea-design-review.md. Produce ADR entries, architecture updates, and design satellites (docs/design/<slug>.md) following the constitution edit rules. Do not write task or feature corpus files directly. Design-review contract (.spur/run/${vars.__runId}-idea-design-review.md, fixed headings `## Proposed design`, `## Operator feedback`, `## Reconciliation`): on the first pass write the proposed design summary under `## Proposed design` and leave `## Operator feedback` empty; on retry with operator feedback present, revise the design/ADR artifacts, document the changes under `## Reconciliation`, and when the feedback invalidates an Acceptance Criteria scenario write the revised AC section body to a file and persist it via `$spurBin feature update "$featureId" --section "Acceptance Criteria" --from-file <file>` — never edit feature corpus files directly.'
+          input: 'The operator''s ask of record is .spur/run/${vars.__runId}-idea-input.md (idea persisted verbatim at start; authoritative). Run sp:sys-architecture for feature ${vars.featureId}. Read the brainstorm artifact, feature AC, and .spur/run/${vars.__runId}-idea-design-review.md. Produce ADR entries, architecture updates, and design satellites (docs/design/<slug>.md) per the constitution edit rules; never write task or feature corpus files directly. Design-review contract (fixed headings `## Proposed design`, `## Operator feedback`, `## Reconciliation`): first pass — write the proposed summary under `## Proposed design`, leave `## Operator feedback` empty; retry after operator feedback — revise the design/ADR artifacts, document changes under `## Reconciliation`, and when feedback invalidates an Acceptance Criteria scenario write the revised AC section body to a file, persist via `$spurBin feature update "$featureId" --section "Acceptance Criteria" --from-file <file>`.'
           # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
           role: planner
+          # B7 R6 (0894): declared fresh policy (planner default).
+          session: fresh
           expectFile: .spur/run/${vars.__runId}-idea-design-review.md
           timeoutMs: ${vars.stepTimeoutMs}
       # expectFile proves existence only, and the onEnter skeleton pre-creates the file — so an
@@ -331,9 +375,11 @@ states:
       - kind: agent.run
         options:
           agent: ${vars.planningAgent}
-          input: "Run sp:spec-decomposition for feature ${vars.featureId} per skill references/decomposition.md § Idea-pipeline emission: sizing first, then the batch JSON at .spur/run/${vars.__runId}-idea-task-batch.json and the private task-order sidecar at .spur/run/${vars.__runId}-idea-task-order.json."
+          input: "The operator's ask of record is .spur/run/${vars.__runId}-idea-input.md (the idea argument persisted verbatim at start; authoritative). Run sp:spec-decomposition for feature ${vars.featureId} per skill references/decomposition.md § Idea-pipeline emission: sizing first, then the batch JSON at .spur/run/${vars.__runId}-idea-task-batch.json and the private task-order sidecar at .spur/run/${vars.__runId}-idea-task-order.json."
           # Declared Layer-1 role (0538 R2): routing reason beside the agent: pin.
           role: planner
+          # B7 R6 (0894): declared fresh policy (planner default).
+          session: fresh
           expectFile: .spur/run/${vars.__runId}-idea-task-batch.json
           timeoutMs: ${vars.stepTimeoutMs}
       # R1 (0518): the task-order sidecar is the ordering contract for handoff-finalize.
@@ -417,12 +463,16 @@ states:
           agent: ${vars.planningAgent}
           # Declared Layer-1 role (0538 R2), same planner executor as decompose.
           role: planner
+          # B7 R6 (0894): declared fresh policy (planner default).
+          session: fresh
           timeoutMs: ${vars.stepTimeoutMs}
           # (warn) non-slash pointer: the 0788 checklist is per-checkout (digest via the
           # project's own computePlanningDigest), so the bounded prompt pins the skill
           # reference instead of a command; artifacts are gated by answerFile/expectFile.
           input: >-
-            Run the ready-prepare stage for feature ${vars.featureId} per sp:spur-dev
+            The operator's ask of record is .spur/run/${vars.__runId}-idea-input.md (the idea
+            argument persisted verbatim at start; authoritative). Run the ready-prepare stage
+            for feature ${vars.featureId} per sp:spur-dev
             references/planning-workflow.md § Step 5.6 (Ready preparation): read
             .spur/run/${vars.__runId}-idea-batch-create-result.json and write
             .spur/run/${vars.__runId}-idea-ready.json.
@@ -559,57 +609,60 @@ transitions:
 
   # ── ac-generate: auto-skip (profile=auto) OR enter feature-check HITL gate (interactive) ──
   # Declaration order: auto-skip guards tried FIRST (same pattern as task-pipeline review→verify
-  # and design-gen→handoff). Under profile=auto, the recorded `idea-ac-check` result routes
-  # directly to the appropriate next state — guards never re-run the CLI (task 0769). Under
-  # interactive, the always fallback enters the feature-check state whose onEnter hitl.confirm
-  # pauses for operator confirmation.
+  # and design-gen→handoff). Under profile=auto, the recorded `idea-ac-check` result and the
+  # recorded requirement-coverage status (0887 R4) route directly to the appropriate next
+  # state — guards never re-run the CLI or the checker (task 0769). Under interactive, the
+  # always fallback enters the feature-check state whose onEnter hitl.confirm pauses for
+  # operator confirmation (coverage is surfaced in that prompt; the operator's answer governs).
   #
-  # Auto-skip 1: pass + design route → system-design (design=auto + needs_design != false)
+  # Auto-skip 1: pass + coverage + design route → system-design (design=auto + needs_design != false)
   - from: ac-generate
     to: system-design
-    description: "profile=auto, check passed, design route — run system design."
-    # (warn) 5 commands (named status capture + 4 conditions): profile gate + captured status + route signal jointly own the
-    # route; guards never re-run the CLI (0769), so there is nothing smaller to extract.
+    description: "profile=auto, check passed, requirements covered, design route — run system design."
+    # (warn) 4 commands: one persistent multi-assignment line captures both statuses; `test -a` folds the
+    # profile/ac and design/needs pairs (same operand semantics); guards never re-run the CLI (0769).
     guard:
       kind: shell
       options:
         command: >-
-          ac_status="$(cat .spur/run/$__runId-idea-ac-check.status 2>/dev/null)";
-          test "$profile" = auto && test "$ac_status" = PASS && test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" != false
-  # Auto-skip 2: pass + skip-design route → decompose
+          ac_status="$(cat .spur/run/$__runId-idea-ac-check.status 2>/dev/null)" cov_status="$(cat .spur/run/$__runId-idea-coverage.status 2>/dev/null)";
+          test "$profile" = auto -a "$ac_status" = PASS && test "$cov_status" = PASS && test "$design" = auto -a "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" != false
+  # Auto-skip 2: pass + coverage + skip-design route → decompose
   - from: ac-generate
     to: decompose
-    description: "profile=auto, check passed, skip-design route — go directly to decompose."
-    # (warn) 5 test segments: same as auto-skip 1 plus the OR'd design=auto/needs_design=false
-    # pair that keeps one captured signal file authoritative for both routes (0769).
+    description: "profile=auto, check passed, requirements covered, skip-design route — go directly to decompose."
+    # (warn) 4 test segments: profile + inlined ac/coverage reads + the OR'd design=skip/(design=auto AND
+    # needs_design=false) pair folded into one `test` (`-a` binds tighter than `-o`), keeping one captured
+    # signal file authoritative for both routes (0769).
     guard:
       kind: shell
       options:
-        command: 'test "$profile" = auto && test "$(cat .spur/run/$__runId-idea-ac-check.status 2>/dev/null)" = PASS && (test "$design" = skip || (test "$design" = auto && test "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" = false))'
-  # Auto-skip 3: check failed, retry < 3 → loop back to ac-generate (self-loop)
+        command: 'test "$profile" = auto && test "$(cat .spur/run/$__runId-idea-ac-check.status 2>/dev/null)" = PASS && test "$(cat .spur/run/$__runId-idea-coverage.status 2>/dev/null)" = PASS && test "$design" = skip -o "$design" = auto -a "$(jq -r .needs_design .spur/run/$__runId-idea-needs-design.json 2>/dev/null)" = false'
+  # Auto-skip 3: check or coverage failed, retry < 3 → loop back to ac-generate (self-loop)
   - from: ac-generate
     to: ac-generate
-    description: "profile=auto, check failed, retry cap not reached — re-run ac-generate."
-    # (warn) 5 commands (named status capture + 4 conditions): profile gate + captured status + captured retry count; the
-    # retry loop is the smallest honest formulation of cap<3 routing (0769).
+    description: "profile=auto, check or coverage failed, retry cap not reached — re-run ac-generate."
+    # (warn) 5 commands: one persistent multi-assignment line captures both statuses and the retry count
+    # (with its 0 fallback); the failed-check pair stays verbatim and the profile gate folds into the retry
+    # test via `test -a`; the retry loop is the smallest honest formulation of cap<3 routing (0769).
     guard:
       kind: shell
       options:
         command: >-
-          ac_status="$(cat .spur/run/$__runId-idea-ac-check.status 2>/dev/null)";
-          test "$profile" = auto && test "$ac_status" != PASS && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -lt 3
-  # Auto-skip 4: check failed, retry cap reached → escalate to failed
+          ac_status="$(cat .spur/run/$__runId-idea-ac-check.status 2>/dev/null)" cov_status="$(cat .spur/run/$__runId-idea-coverage.status 2>/dev/null)" retry="$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)";
+          { test "$ac_status" != PASS || test "$cov_status" != PASS; } && test "$profile" = auto -a "$retry" -lt 3
+  # Auto-skip 4: check or coverage failed, retry cap reached → escalate to failed
   - from: ac-generate
     to: failed
-    description: "profile=auto, check failed after 3 retries — escalate to failed."
-    # (warn) 5 commands (named status capture + 4 conditions): mirror of the retry guard with cap>=3; keeping escalation and
-    # retry as one test-chain pair makes the cap boundary auditable in the diff (0769).
+    description: "profile=auto, check or coverage failed after 3 retries — escalate to failed."
+    # (warn) 5 commands: mirror of the retry guard with cap>=3; keeping escalation and retry as one
+    # test-chain pair makes the cap boundary auditable in the diff (0769).
     guard:
       kind: shell
       options:
         command: >-
-          ac_status="$(cat .spur/run/$__runId-idea-ac-check.status 2>/dev/null)";
-          test "$profile" = auto && test "$ac_status" != PASS && test "$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)" -ge 3
+          ac_status="$(cat .spur/run/$__runId-idea-ac-check.status 2>/dev/null)" cov_status="$(cat .spur/run/$__runId-idea-coverage.status 2>/dev/null)" retry="$(cat .spur/run/$__runId-idea-ac-retry-count 2>/dev/null || echo 0)";
+          { test "$ac_status" != PASS || test "$cov_status" != PASS; } && test "$profile" = auto -a "$retry" -ge 3
   # Interactive fallback: enter feature-check HITL gate
   - from: ac-generate
     to: feature-check

package/config/workflows/task-pipeline.yaml

@@ -196,6 +196,18 @@ states:
                 command: >-
                     mkdir -p .spur/run .spur/memory; RUN_ID="$__runId"; [ -n "$RUN_ID" ] || RUN_ID="pipeline-$wbs"; case "$RUN_ID" in *'$'*|*'{'*|*'}'*|*vars.*|*/*|*'\'*|*..*) echo "route-reason: refusing unsafe run id: $RUN_ID" >&2; exit 1 ;; esac; REASON_FILE=".spur/run/$RUN_ID-route-reason.txt"; jq -rn --arg m "$mode" '{"fast":"fast:evidence complete+consistent","":"safety:standard verification","unknown":"safety:unknown evidence quality","conflict":"safety:conflicting evidence"}[$m] // "safety:unrecognized evidence (mode=\($m))"' > "$REASON_FILE"; printf '%s %s %s\n' "$RUN_ID" "$wbs" "$(cat "$REASON_FILE")" >> .spur/memory/task-pipeline-routes.log; exit 0
 
+          # (e) B7 R1 (0894): resolve every declared role ONCE at precheck — pins land
+          # in __executor.<role> run vars so stage dispatch performs no doctor call.
+          # Soft probe: failures mark the status file and stages degrade to their own
+          # resolution; nothing here aborts the run.
+          - kind: doctor.probe
+            options:
+                resultFile: ".spur/run/${vars.__runId}-precheck-roles.status"
+                spurBin: "${vars.spurBin}"
+                roles:
+                    coder: "${vars.implementAgent}"
+                    reviewer: "${vars.agent}"
+
     - id: implement
       description: >
           Run agent-driven implementation via /sp:dev-run --mode implement, THEN move the
@@ -216,6 +228,9 @@ states:
                 # Pure slash command only (ADR-043). Anti-recursion / implement discipline
                 # Declared Layer-1 role (0538 R2/0710 R7): routing reason; no executor pin — role routing feeds the distinctness gate.
                 role: coder
+                # B7 R3/R6 (0894): coder stages reuse the role session — the test-fix hop
+                # resumes the implement session instead of re-reading the task cold.
+                session: reuse
                 # lives in /sp:dev-run --mode implement → sp:code-implementation, not YAML prose.
                 input: /sp:dev-run --mode implement ${vars.wbs} --auto
                 timeoutMs: ${vars.implementTimeoutMs}
@@ -356,6 +371,9 @@ states:
                 # R3 (0482): `--findings` names the failing anchors inline; `--gate-log` remains
                 # Declared Layer-1 role (0538 R2/0710 R7): routing reason; no executor pin — role routing feeds the distinctness gate.
                 role: coder
+                # B7 R3/R6 (0894): coder stages reuse the role session — the fix hop
+                # continues the implement session it is repairing.
+                session: reuse
                 # the full-context escape hatch when the digest is not enough.
                 input: /sp:dev-fixall "${vars.qualityGateCmd}" --gate-log .spur/run/${vars.wbs}-test-gate.log --findings "${vars.gateFindings}"
                 timeoutMs: ${vars.stepTimeoutMs}
@@ -417,7 +435,11 @@ states:
                 expectFile: .spur/run/${vars.__runId}-review-answer.txt
                 # Declared Layer-1 role (0538 R2/0710 R7): routing reason; no executor pin — role routing feeds the distinctness gate.
                 role: reviewer
+                # B7 R3/R6 (0894): declared fresh policy (reviewer default) — the action
+                # result records this as declared, not defaulted. `freshSession: true` is
+                # kept as the action-level hard guarantee (0710 R2 structural assertion).
                 freshSession: true
+                session: fresh
                 priority: ${vars.taskPriority}
                 compareExecutorWith: implement
                 timeoutMs: ${vars.stepTimeoutMs}
@@ -477,7 +499,10 @@ states:
                 input: /sp:dev-verify ${vars.wbs} --auto --fix none --focus all
                 # Declared Layer-1 role (0538 R2/0710 R7): routing reason; no executor pin — role routing feeds the distinctness gate.
                 role: reviewer
+                # B7 R3/R6 (0894): declared fresh policy (reviewer default).
+                # `freshSession: true` kept as the action-level hard guarantee (0710 R2).
                 freshSession: true
+                session: fresh
                 priority: ${vars.taskPriority}
                 compareExecutorWith: implement
                 timeoutMs: ${vars.stepTimeoutMs}