@gobing-ai/spur 0.3.90 → 0.3.92

package/config/workflows/task-pipeline.yaml

@@ -6,13 +6,18 @@
 # through the normal `spur task update <wbs> <status>` verb so the lifecycle guards
 # (0055) apply identically. Run linkage is written to `task_run_links` (kind=pipeline).
 #
-# Shape: precheck → implement → test[→test-fix↔test-recheck] → review → approve(HITL)
+# Shape: precheck → implement[→escalate] → test[→test-fix↔test-recheck] → review → approve(HITL)
 #        → verify → record → done
 #        (precheck failure short-circuits to `failed`; approve routes to `failed` on
 #        operator rejection or `cancelled` on operator cancel — R1, bug-750).
 #        `test` is the project quality gate (shell + bounded /sp:dev-fixall), not
 #        /sp:dev-unit (coverage gap-fill; router C3/C5).
 #
+# F96 residual sweep (0950): precheck captures the resume-safe base commit; verify
+# scans and folds residuals between the verdict and the proof bind (blocking leftovers
+# downgrade PASS → PARTIAL and take the existing remediation edge); done settles
+# deferrals; failed renders the recovery report. No new state, edge, or model query.
+#
 # Vars (passed as a JSON object via `--vars`):
 #   wbs                       — task WBS (required)
 #   profile                   — "auto" skips HITL approve (R4)
@@ -21,6 +26,7 @@
 #   implementTimeoutMs        — implement agent.run budget (ms)
 #   qualityGateCmd            — project gate (default: bun run spur-check)
 #   qualityGateMaxFixAttempts — max /sp:dev-fixall hops after a red gate (default: 2)
+#   maxEscalations            — max operator-question pauses per implement chain (default: 2)
 #
 # Seeded by `spur init`. agent.run inputs are pure slash commands (ADR-043).
 
@@ -90,6 +96,10 @@ vars:
     # Answer captured by the approve gate's hitl.confirm (R1): "yes" | "no" | "cancel".
     # Empty by default; only meaningful once the approve state has been entered.
     __hitlAnswer: ""
+    # Operator answer captured by the escalate hop's hitl.input (0933). Empty by
+    # default; set by `spur workflow continue --answer-text` after the pause and read
+    # by the escalate→implement / escalate→failed guards. Non-empty = answered.
+    __hitlInput: ""
     # Proof-state bracket (task 0612, ADR-071; restructured by task 0703). `proofDigest` is the
     # canonical capture taken at quality-gate ENTRY — immediately before the evidence-producing
     # final chain (quality → review → verify) — and re-captured at `test-recheck` when bounded
@@ -134,6 +144,14 @@ vars:
     # Max /sp:dev-fixall attempts after a red quality-gate probe/recheck (bounded; no thrash).
     # Attempt counter: .spur/run/<wbs>-test-fix-attempt. Default 2 = two fixall hops before failed.
     qualityGateMaxFixAttempts: "2"
+    # Max operator-question pauses (0933) before the implement chain routes to failed.
+    # Escalation counter: .spur/run/<wbs>-escalation-count. Default 2 = two answered
+    # questions; a third pause routes to failed with a report note.
+    maxEscalations: "2"
+    # Runtime-written, 0933: the escalate hop's file.read.into-var fills this from
+    # .spur/run/<wbs>-question.md; the hitl.input prompt below references it. Declared
+    # here (empty) so the static var-reference validator sees the template source.
+    escalationQuestion: ""
     # Post-implement auto-format. Overridable like qualityGateCmd so a non-Bun seeded
     # project can point it at its own formatter; invoked best-effort (a missing or
     # failing formatter must never abort a run — the quality gate is the real gate).
@@ -156,6 +174,12 @@ vars:
     # (default) = on; set to "off" to bypass:
     # `--vars '{"implementScopeGuard":"off"}'`.
     implementScopeGuard: ""
+    # 0931 R5: parallel batches defer the per-task feature sync so a task branch never
+    # touches feature files or docs/features/INDEX.md. When "true", the record step's
+    # post-record shell appends a deferral note and skips the sync; the parallel batch
+    # orchestrator runs the sync + `spur feature refresh` once per touched feature on the
+    # base ref after integration. Sequential/inline keep the default "false" (unchanged).
+    deferFeatureSync: "false"
 
 states:
     - id: precheck
@@ -189,6 +213,12 @@ states:
             options:
                 command: >-
                     mkdir -p .spur/run; S=plugins/sp/scripts/task-evidence-precheck.ts; [ -f "$S" ] || S="$(superskill script path sp task-evidence-precheck.ts 2>/dev/null)"; if [ -f "$S" ]; then bun "$S" "$wbs" --spur-bin "$spurBin"; else echo "task-evidence-precheck failed closed — checker not found in plugins/sp/scripts/ nor staged — run 'superskill install sp'." >&2; echo "FAIL" > ".spur/run/$wbs-precheck-evidence.status"; fi; exit 0
+          # (e) F96 R1 (0950): capture the run's base commit once — a resumed or re-entered run
+          # keeps its original base so residual scans stay anchored to the same diff.
+          - kind: shell
+            options:
+                command: >-
+                    mkdir -p .spur/run; [ -f ".spur/run/$wbs-base.sha" ] || git rev-parse HEAD > ".spur/run/$wbs-base.sha"; exit 0
           # (e) route-reason lookup and routes log; proportional-routing tests locate it
           # (0759 R1/R5 run-scoped artifact; 0804 R8 run-id safety — one line, no in-scalar `#`).
           - kind: shell
@@ -222,6 +252,20 @@ states:
           that command DRIVES this pipeline, so calling it here recurses.
           --mode implement is the single-step implement entry.
       onEnter:
+          # 0933 R27 (guard-lines compression): the transcript append lives HERE, on
+          # (re-)entry, not in the escalate→implement guard. On first entry there is no
+          # pending question (no-op); on a resume entry the guard already confirmed a
+          # non-empty $__hitlInput and a fresh question file, so this shell records the
+          # Q/A pair (## Q<n>/## A<n>, R3) and consumes the question file before the
+          # agent.run re-dispatches — which also disarms the implement→escalate edge.
+          - kind: shell
+            options:
+                command: >-
+                    test -n "$__hitlInput" -a -s .spur/run/$wbs-question.md || exit 0;
+                    qn="$(cat .spur/run/$wbs-escalation-count 2>/dev/null || echo 0)";
+                    printf '## Q%s\n%s\n\n## A%s\n%s\n' "$qn" "$(cat .spur/run/$wbs-question.md 2>/dev/null)" "$qn" "$__hitlInput" >> .spur/run/$wbs-escalation.md;
+                    rm -f .spur/run/$wbs-question.md;
+                    exit 0
           - kind: agent.run
             options:
                 agent: ${vars.implementAgent}
@@ -232,13 +276,23 @@ states:
                 # resumes the implement session instead of re-reading the task cold.
                 session: reuse
                 # lives in /sp:dev-run --mode implement → sp:code-implementation, not YAML prose.
-                input: /sp:dev-run --mode implement ${vars.wbs} --auto
+                # 0933 R28: --escalation-file names the Q/A transcript the implement
+                # agent appends to when pausing and reads back on re-dispatch; absent
+                # on a first attempt means "no prior escalations".
+                input: /sp:dev-run --mode implement ${vars.wbs} --auto --escalation-file .spur/run/${vars.wbs}-escalation.md
                 timeoutMs: ${vars.implementTimeoutMs}
                 # R3 (task 0424): empty-implement no-op guard — the agent.run action
                 # fails the step when exit 0 produced zero non-corpus file changes, so
                 # a silent no-op routes the run to `failed` here instead of drifting
                 # into test/review and being caught a full pass later.
                 requireDiff: true
+                # 0933 R26: escalation contract — the agent.run option names the QUESTION
+                # file (the pause signal, deleted pre-dispatch for freshness); a paused
+                # attempt (agent wrote its question there and exited 0) succeeds with
+                # data.escalated=true and skips requireDiff for THAT attempt only. The
+                # Q/A transcript (.spur/run/<wbs>-escalation.md) is separate: it reaches
+                # the agent via --escalation-file in the input below.
+                escalationFile: .spur/run/${vars.wbs}-question.md
                 # 0706 R6: this stage mutates the working tree unattended under the
                 # auto profile, so it declares minimum execution-capability
                 # requirements. Dispatch fails closed (before spawn) when the
@@ -273,6 +327,39 @@ states:
             options:
                 command: "$formatCmd ; exit 0"
 
+    # ── escalate hop (operator-question pause, 0933) ──────────────────────────
+    # The implement agent paused on an operator question: it wrote
+    # .spur/run/<wbs>-question.md and exited 0 (agent.run reported
+    # data.escalated=true, skipping requireDiff for that attempt). This hop bounds
+    # the asks (counter), surfaces the question verbatim through the HITL responder
+    # (the run pauses here), and — after `spur workflow continue --answer-text <a>`
+    # delivers __hitlInput — resumes implement with the Q/A transcript
+    # (.spur/run/<wbs>-escalation.md) named in the implement input via
+    # --escalation-file. The transcript append + question-file consumption happen in
+    # the escalate→implement guard so a stale question can never re-trigger the hop
+    # after the answered attempt.
+    - id: escalate
+      description: >-
+          Operator-question pause (0933): the implement agent asked a question
+          headlessly; surface it to the operator and resume implement with the answer.
+      onEnter:
+          # Bounded asks: increment the per-task escalation counter before pausing.
+          - kind: shell
+            options:
+                command: >-
+                    mkdir -p .spur/run; n="$(cat .spur/run/$wbs-escalation-count 2>/dev/null || echo 0)"; echo $((n + 1)) > .spur/run/$wbs-escalation-count; exit 0
+          # The agent's question, verbatim, becomes the pause prompt.
+          - kind: file.read.into-var
+            options:
+                file: .spur/run/${vars.wbs}-question.md
+                var: escalationQuestion
+          # Pause for the operator (responder pause:true stops the run after this
+          # onEnter; `spur workflow continue --answer-text <answer>` writes
+          # __hitlInput and re-evaluates the escalate guards).
+          - kind: hitl.input
+            options:
+                prompt: "${vars.escalationQuestion}"
+
     # ── test hop (quality gate + bounded auto-fix) ─────────────────────────────
     # NOT /sp:dev-unit. That command (sp:code-testing) *extends/generates* tests toward
     # a coverage target; it is not the project quality gate. Coverage gap-fill remains
@@ -358,6 +445,14 @@ states:
             options:
                 command: >-
                     mkdir -p .spur/run; A=".spur/run/$wbs-test-fix-attempt"; n=$(cat "$A" 2>/dev/null || echo 0); printf '%s\n' "$((n + 1))" > "$A"; [ ! -f ".spur/run/$wbs-verdict.json" ] || { echo '--- verify verdict (remediation input, task 0703 R4) ---'; cat ".spur/run/$wbs-verdict.json"; } >> ".spur/run/$wbs-test-gate.log"; exit 0
+          # (d) F96 R3 (0950): hand the residual list to the remediation loop — dev-fixall
+          # treats residual items as fix targets and may defer P3/markers to
+          # residual-deferrals.json (see dev-fixall.md). Fold already merged the anchors
+          # into <wbs>-test-gate.findings; this carries the structured artifact too.
+          - kind: shell
+            options:
+                command: >-
+                    [ ! -f ".spur/run/$wbs-residuals.json" ] || { echo '--- residual artifact (F96 fix targets; deferrals go to residual-deferrals.json, P3/markers only) ---'; cat ".spur/run/$wbs-residuals.json"; } >> ".spur/run/$wbs-test-gate.log"; exit 0
           # R3 (0482): project the extracted gate anchors into a var so the dispatch input
           # can NAME the failing file:line, not merely point at a log. A vars template cannot
           # run a shell, so the read is an action, not an inline `$(cat ...)` substitution.
@@ -464,6 +559,8 @@ states:
           - kind: hitl.confirm
             options:
                 prompt: "Approve task ${vars.wbs} to proceed to verification?"
+                decision:
+                    mode: never
 
     - id: verify
       description: >
@@ -528,6 +625,16 @@ states:
           - kind: shell
             options:
                 command: "$spurBin task verdict $wbs --from-answer .spur/run/$wbs-verify-answer.txt"
+          # (d) F96 R2 (0950): residual-scan.ts owns the sweep; shell only resolves it.
+          # ONE hard action (scan+fold): a scanner crash fails verify closed — the
+          # verify→failed catch-all routes a missing/malformed verdict. Runs AFTER
+          # `task verdict` and BEFORE the jq bind so a blocking residual turns PASS
+          # into PARTIAL (fold rewrites the verdict artifact) and takes the existing
+          # verify→test-fix edge while attempts remain.
+          - kind: shell
+            options:
+                command: >-
+                    S=plugins/sp/scripts/residual-scan.ts; [ -f "$S" ] || S="$(superskill script path sp residual-scan.mjs 2>/dev/null)"; if [ ! -f "$S" ]; then echo "residual-scan failed closed — scanner not found in plugins/sp/scripts/ nor staged — run 'superskill install sp'" >&2; exit 1; fi; case "$S" in *.mjs) RUNNER=node ;; *) RUNNER=bun ;; esac; "$RUNNER" "$S" scan "$wbs" --spur-bin "$spurBin" && "$RUNNER" "$S" fold "$wbs" --spur-bin "$spurBin"
           # (e) one jq mutation binds the verdict to the proof digest (0703 R3; runId 0730 §B.2 /
           # 0757 R4; definitionDigest 0759 R5; honest review stamp 0785 R4; soft action + hard guard).
           - kind: shell
@@ -582,10 +689,16 @@ states:
           # (d) feature-sync-bounded.ts owns the sync; shell adds the orphan note and fallbacks
           # (0411 retry-suppression; 0328 / ADR-0322). Best-effort `exit 0` — feature status sync is a
           # follow-up, not a completion gate; `record → done` runs `spur task check`.
+          # 0931 R5: with deferFeatureSync "true" (parallel mode) the deferral note lands in the
+          # task report and the sync is skipped entirely, so task branches never touch feature
+          # corpus files; the batch orchestrator performs the deferred sync on the base ref.
+          # The sync itself is owned by record-feature-sync.ts (ADR-115: the guard plus the old
+          # inline chain cannot share one shell); resolution follows the standard in-repo-first,
+          # superskill-staged fallback used by every pipeline checker.
           - kind: shell
             options:
                 command: >-
-                    FID=$($spurBin task show $wbs --json 2>/dev/null | jq -r '.feature_id // .frontmatter.feature_id // empty' 2>/dev/null); if [ -z "$FID" ]; then echo "Orphan task $wbs — no feature_id linked — proposal: consider linking to a parent feature." >> ".spur/run/$wbs-report.txt"; elif [ -f plugins/sp/scripts/feature-sync-bounded.ts ]; then bun plugins/sp/scripts/feature-sync-bounded.ts "$FID" --spur-bin "$spurBin" --json; elif M="$(superskill script path sp feature-sync-bounded.mjs 2>/dev/null)" && [ -f "$M" ]; then node "$M" "$FID" --spur-bin "$spurBin" --json; else $spurBin feature sync "$FID" --json; fi; exit 0
+                    S=plugins/sp/scripts/record-feature-sync.ts; [ -f "$S" ] || S="$(superskill script path sp record-feature-sync.mjs 2>/dev/null)"; [ "$deferFeatureSync" = "true" ] && echo "feature sync deferred to batch integration" >> ".spur/run/$wbs-report.txt" || if [ -f "$S" ]; then bun "$S" --spur-bin "$spurBin"; else echo "feature sync skipped — record-feature-sync not found in plugins/sp/scripts/ nor staged" >> ".spur/run/$wbs-report.txt"; fi; exit 0
 
     - id: done
       description: >
@@ -593,6 +706,13 @@ states:
           guard runs `spur task check` before certifying; a genuinely non-compliant
           task routes to `failed` instead of a silent bad `done`.
       onEnter:
+          # (d) F96 R4 (0950): residual-scan.ts owns the settle; shell only resolves it.
+          # Soft best-effort (exit 0) — runs after certification and must never change
+          # the outcome; failure prints the re-run command.
+          - kind: shell
+            options:
+                command: >-
+                    S=plugins/sp/scripts/residual-scan.ts; [ -f "$S" ] || S="$(superskill script path sp residual-scan.mjs 2>/dev/null)"; if [ -f "$S" ]; then case "$S" in *.mjs) RUNNER=node ;; *) RUNNER=bun ;; esac; "$RUNNER" "$S" settle "$wbs" --spur-bin "$spurBin" || echo "residual-settle failed — re-run: residual-scan settle $wbs" >&2; else echo "residual-scan not staged — settle skipped — re-run: residual-scan settle $wbs" >&2; fi; exit 0
           # (c) command.gate owns the done transition with classified transient retry.
           - kind: command.gate
             options:
@@ -618,7 +738,28 @@ states:
     - id: failed
       description: >
           Terminal — precheck, quality-gate exhaustion, verify non-PASS, record check
-          failure, or operator rejection; reported, not advanced.
+          failure, or operator rejection; reported, not advanced. Also receives an
+          escalation-bound pause or an operator give-up (0933).
+      onEnter:
+          # 0933 R30 (guard-lines compression): the escalation-bound report note lives
+          # here as a conditional — no-op unless the run reached failed with a pending
+          # question at (or above) the ask bound (bound pause or final give-up). The
+          # unanswered question itself is appended to the task report (report.txt, R2).
+          - kind: shell
+            options:
+                command: >-
+                    n="$(cat .spur/run/$wbs-escalation-count 2>/dev/null || echo 0)";
+                    test "$n" -ge "$maxEscalations" -a -s .spur/run/$wbs-question.md || exit 0;
+                    printf '\n## Escalation bound reached\n\nThe implement step asked an operator question %s times (bound %s) and ended without a resumable answer. Unanswered question:\n\n' "$n" "$maxEscalations" >> .spur/run/$wbs-report.txt;
+                    cat .spur/run/$wbs-question.md >> .spur/run/$wbs-report.txt;
+                    exit 0
+          # (d) F96 R5 (0950): residual-scan.ts owns the report; shell only resolves it.
+          # Soft (exit 0): a run that exhausts its fix budget on residuals leaves the
+          # report + recovery line while the task stays `wip`.
+          - kind: shell
+            options:
+                command: >-
+                    S=plugins/sp/scripts/residual-scan.ts; [ -f "$S" ] || S="$(superskill script path sp residual-scan.mjs 2>/dev/null)"; if [ -f "$S" ]; then case "$S" in *.mjs) RUNNER=node ;; *) RUNNER=bun ;; esac; "$RUNNER" "$S" report "$wbs" --spur-bin "$spurBin" || echo "residual-report failed — re-run: residual-scan report $wbs" >&2; else echo "residual-scan not staged — report skipped — re-run: residual-scan report $wbs" >&2; fi; exit 0
 
     - id: cancelled
       description: Terminal — pipeline cancelled by operator at the approval gate (R1).
@@ -642,12 +783,54 @@ transitions:
       guard:
           kind: always
 
+    # ── implement routing: escalation first (0933 R26/R30), then the linear body ──
+    # Declaration order matters: the escalation bound is checked FIRST — a paused
+    # attempt that already exhausted its maxEscalations asks routes to failed (with a
+    # report note appended in the same guard) instead of asking forever; then the
+    # question-presence hop; then the normal always edge. The bound guard requires a
+    # fresh question file so a COMPLETED implement after max asks still routes to test.
+    - from: implement
+      to: failed
+      description: Escalation bound exhausted — the agent paused again after maxEscalations operator answers.
+      # 0933 R30 (guard-lines compression): thin predicate; the report note is written
+      # by the failed state's onEnter when it observes a bound-exhausted pause.
+      guard:
+          kind: shell
+          options:
+              command: >-
+                  n="$(cat .spur/run/$wbs-escalation-count 2>/dev/null || echo 0)";
+                  test "$n" -ge "$maxEscalations" -a -s .spur/run/$wbs-question.md
+    - from: implement
+      to: escalate
+      description: Implement agent paused on an operator question (non-empty question file) — pause for an answer.
+      guard:
+          kind: shell
+          options:
+              command: 'test -s .spur/run/$wbs-question.md'
     # ── linear body ──
     - from: implement
       to: test
       description: Implementation done — quality-gate probe.
       guard:
           kind: always
+    # escalate branching (0933 R27): an answered pause resumes implement — the transcript
+    # append and question consumption happen in implement's onEnter (guards stay thin
+    # under ADR-115 guard-lines caps); an empty answer is an operator give-up → failed
+    # (question + transcript preserved as evidence).
+    - from: escalate
+      to: implement
+      description: Operator answered — re-enter implement, which records the Q/A transcript and consumes the question.
+      guard:
+          kind: shell
+          options:
+              command: 'test -n "$__hitlInput"'
+    - from: escalate
+      to: failed
+      description: Empty operator answer — give-up routes to failed (question + transcript preserved as evidence).
+      guard:
+          kind: shell
+          options:
+              command: 'test -z "$__hitlInput"'
     # Soft probe branching (declaration order: PASS first, then FAIL, then defense).
     - from: test
       to: verify

package/config/workflows/wayfinder-resolution.yaml

@@ -163,6 +163,8 @@ states:
       - kind: hitl.confirm
         options:
           prompt: "Approve research resolution for task ${vars.wbs}?"
+          decision:
+            mode: never
 
   - id: record
     description: >

package/config/workflows/wrapup-pipeline.yaml

@@ -15,6 +15,7 @@
 #
 # Shape: start -> task-resolve -> doc-sync -> learnings-append -> metrics-record
 #          -> feature-transition (conditional: if vars.feature set)
+#          -> feature-verify (post-transition feature check gate, 0915 F1)
 #          -> branch-cleanup (conditional: if vars.merge=true)
 #          -> done
 #        doc-sync routes a contract violation to `repair` (cheap, no
@@ -295,6 +296,30 @@ states:
               printf 'FAIL\n' > ".spur/run/$__runId-wrapup-sync.status";
             fi
 
+  - id: feature-verify
+    description: >
+      Post-feature-transition verification hop (D63 task 0915, review finding
+      F1): wrapup's doc-sync and the feature transition mutate the corpus AFTER
+      the feature-scoped verification pass ran. The proof digest deliberately
+      excludes docs/tasks*/docs/features* (shared evidence, concurrent writers),
+      so the bound receipt stays valid — but the feature's completion boundary
+      must still observe the post-wrapup state. This hop re-runs the feature
+      check gate (`featureGateCmd`). When the configured command is the done-
+      boundary variant (`feature check --as done`), it validates the bound
+      evidence receipt (feature identity, verifier definition digest, terminal
+      recording run, artifact registration, checked-input digest) against the
+      current feature contract; a plain gate command observes the post-wrapup
+      corpus state but does not enforce the receipt (0915 re-review P3). A FAIL
+      fails the wrapup loudly instead of letting a stale PASS ride; only a
+      verified gate writes PASS (0783 R4).
+    onEnter:
+      - kind: shell
+        options:
+          command: >-
+            sh -c "$featureGateCmd" &&
+            printf 'PASS\n' > ".spur/run/$__runId-wrapup-feature-verify.status" ||
+            printf 'FAIL\n' > ".spur/run/$__runId-wrapup-feature-verify.status"
+
   - id: branch-cleanup
     description: >
       Irreversible-operation HITL gate, consent-only (0770). If vars.merge=true,
@@ -308,6 +333,8 @@ states:
       - kind: hitl.confirm
         options:
           prompt: "Branch cleanup for the validated task list (.spur/run/${vars.__runId}-wrapup-tasks.json). This is IRREVERSIBLE (merge or delete). Confirm to proceed?"
+          decision:
+            mode: never
 
   - id: done
     description: >
@@ -472,19 +499,36 @@ transitions:
       options:
         command: 'test "$(cat .spur/run/$__runId-wrapup-sync.status 2>/dev/null)" = FAIL'
   - from: feature-transition
+    to: feature-verify
+    description: Sync PASS — re-run the feature check gate against the post-wrapup state.
+    guard:
+      kind: shell
+      options:
+        command: 'test "$(cat .spur/run/$__runId-wrapup-sync.status 2>/dev/null)" = PASS'
+  - from: feature-verify
+    to: failed
+    description: >
+      Post-wrapup feature check failed (0915 F1): the bound receipt no longer
+      validates against the current feature contract. Already-written
+      learnings/metrics stay on disk.
+    guard:
+      kind: shell
+      options:
+        command: 'test "$(cat .spur/run/$__runId-wrapup-feature-verify.status 2>/dev/null)" = FAIL'
+  - from: feature-verify
     to: branch-cleanup
-    description: Sync PASS — merge is requested.
+    description: Post-wrapup feature check PASS — merge is requested.
     guard:
       kind: shell
       options:
-        command: 'test "$(cat .spur/run/$__runId-wrapup-sync.status 2>/dev/null)" = PASS && test "$merge" = true'
-  - from: feature-transition
+        command: 'test "$(cat .spur/run/$__runId-wrapup-feature-verify.status 2>/dev/null)" = PASS && test "$merge" = true'
+  - from: feature-verify
     to: done
-    description: Sync PASS — no merge requested.
+    description: Post-wrapup feature check PASS — no merge requested.
     guard:
       kind: shell
       options:
-        command: 'test "$(cat .spur/run/$__runId-wrapup-sync.status 2>/dev/null)" = PASS && test "$merge" != true'
+        command: 'test "$(cat .spur/run/$__runId-wrapup-feature-verify.status 2>/dev/null)" = PASS && test "$merge" != true'
 
   # ── branch-cleanup: HITL exhaustive routing (yes / no / cancel → done) ──
   # No irreversible git op is wired yet; confirmation is recorded, then wrap

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.3.90",
+    "version": "0.3.92",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",
@@ -53,14 +53,14 @@
     },
     "devDependencies": {
         "@commander-js/extra-typings": "^14.0.0",
-        "@gobing-ai/ts-db": "^0.5.0",
-        "@gobing-ai/ts-ai-runner": "^0.5.0",
-        "@gobing-ai/ts-dual-workflow-engine": "^0.5.0",
-        "@gobing-ai/ts-infra": "^0.5.0",
-        "@gobing-ai/ts-llm-jsonl-importer": "^0.5.0",
-        "@gobing-ai/ts-rule-engine": "^0.5.0",
-        "@gobing-ai/ts-runtime": "^0.5.0",
-        "@gobing-ai/ts-utils": "^0.5.0",
+        "@gobing-ai/ts-db": "^0.5.5",
+        "@gobing-ai/ts-ai-runner": "^0.5.5",
+        "@gobing-ai/ts-dual-workflow-engine": "^0.5.5",
+        "@gobing-ai/ts-infra": "^0.5.5",
+        "@gobing-ai/ts-llm-jsonl-importer": "^0.5.5",
+        "@gobing-ai/ts-rule-engine": "^0.5.5",
+        "@gobing-ai/ts-runtime": "^0.5.5",
+        "@gobing-ai/ts-utils": "^0.5.5",
         "@types/bun": "1.3.14",
         "@types/figlet": "^1.7.0",
         "@types/node-notifier": "8.0.5",

package/plugins/sp/README.md

@@ -629,6 +629,7 @@ pipeline owns one lifecycle phase:
 | `idea-pipeline.yaml`        | Idea/planning → feature + tasks   | `/sp:dev-idea`, `/sp:dev-plan`    |
 | `wrapup-pipeline.yaml`      | Post-execution wrap-up            | `/sp:dev-wrap`, `/sp:dev-wrapall` |
 | `wayfinder-resolution.yaml` | Wayfinder ticket resolution loop  | `spur workflow run` (free-form)   |
+| `decision-routing-example.yaml` | DecisionMaker routing example (never / evidence / omitted modes, defer → operator pause) | `spur workflow run` (authoring sample) |
 
 ### Lifecycle operations
 

package/plugins/sp/agents/expert-spur.md

@@ -1,7 +1,7 @@
 ---
 name: expert-spur
-description: |
-  Use PROACTIVELY for "create tasks for this feature", "update all task statuses", "audit task traceability", "create a feature with acceptance criteria", "harden the rule catalog", "author a batch of workflows", "compose a workflow", "tune a rule", "apply accepted doctor proposals", "evaluate spur artifact health", "reflect over history findings", or "expert-spur". Multi-step corpus work across `spur task`, `feature`, `rule`, `workflow`, and agent specs: batch creation, status sweeps, section campaigns, traceability audits, rule hardening, workflow authoring/refactoring, composition and tuning (sp:spur-composer), and evaluation/reflection proposal passes (sp:spur-doctor). For one deterministic operation, run the CLI directly. Recurring evolution loops and multi-agent coordination belong to sp:super-planner — never this agent.
+description: |-
+  Use PROACTIVELY for "create tasks for this feature", "update all task statuses", "audit task traceability", or "expert-spur". Runs multi-step corpus campaigns across tasks, features, rules, workflows, and agent specs: creation, status/section updates, audits, and hardening. Uses sp:spur-composer for workflow composition, rule tuning, and accepted proposals; sp:spur-doctor for artifact evaluation and history reflection. Run single operations via CLI; recurring loops and multi-agent coordination belong to sp:super-planner.
 
   <example>
   Context: Batch task status update across a feature.

package/plugins/sp/agents/super-planner.md

@@ -86,7 +86,10 @@ You own the spaces **between** task runs:
 - **Parallelize only when requested** by applying `sp:parallel-execution` to a proven-independent
   subset (Step 3 optional path). Serialize when dependency, file-overlap, or budget checks fail.
   Preflight still runs per WBS before fan-out; recovery stays sequential.
-- **Inspect** each terminal state + `.spur/run/<wbs>-verdict.json` (Step 3.3).
+- **Inspect** each terminal state via `spur workflow trace "$RUN" --follow --timeout 600000` (a
+  timeout prints one checkpoint and exits 1; the run continues, never cancelled or relaunched) plus
+  `.spur/run/<wbs>-verdict.json`, accepted only when the trace's `.run.runId` equals the dispatched
+  run and the verdict's mtime ≥ the trace's `.run.startedAt` — otherwise `stale-evidence` (Step 3.3).
 - **One-shot recovery (optional)** - on non-PASS / stuck status, consult next-router **once** for that
   WBS (`recoveryHint` / dry-run plan): print the child command, or dispatch once only when the batch
   was started with `--auto` and cardinality is 1. Never self-loop until done.
@@ -264,7 +267,10 @@ Report using the batch-report template from execution-batch.md §5:
 **Next:** <one-line action>
 ```
 
-Per-task outcome vocabulary: `done` | `failed` | `blocked` | `skipped` | `not-attempted`.
+Per-task outcome vocabulary: `done` | `failed` | `blocked` | `skipped` | `paused` (0933: parked on
+an operator question — escalate hop — or an approval gate; non-terminal, never `done`) |
+`not-attempted`, plus the parallel-only `integration-conflict`
+([execution-batch.md § Parallel isolation](../skills/spur-dev/references/execution-batch.md#parallel-isolation---mode-parallel)).
 Batch verdict: `clean` (all attempted tasks `done`) | `halted` (a failure stopped the batch) |
 `aborted` (cycle or selector error before any run).
 
@@ -272,9 +278,12 @@ With `--json`, emit the same shape as a JSON object for machine consumption.
 
 ## Out of scope (deferred)
 
-- **Parallel execution** - needs git-worktree isolation; v1 is sequential.
-- **Interactive within-step escalation** - waits for the workspace module + inbox module +
-  `spur agent` team mode. You surface blockers only at the batch boundary.
+- **Parallel execution** - `--mode parallel` isolates each task in its own worktree with
+  rebase-and-FF integration; see [execution-batch.md § Parallel isolation](../skills/spur-dev/references/execution-batch.md#parallel-isolation---mode-parallel).
+- **Interactive within-step escalation** — implemented (0933): the pipeline's `escalate` hop
+  pauses on the implement agent's operator question; the operator answers via
+  `spur workflow continue --answer-text` and the run resumes implement with the Q/A transcript
+  (bounded by `maxEscalations`). See [execution-batch.md Step 3](../skills/spur-dev/references/execution-batch.md#step-3--the-driver-loop-r3-r4).
 
 ## Platform Notes
 

package/plugins/sp/commands/dev-dogfood.md

@@ -14,11 +14,11 @@ Wraps the **sp:dogfood-testing** skill.
 | Flag | Description | Default |
 | --- | --- | --- |
 | `<testee>` | Skill / command / CLI to exercise end-to-end. | required |
-| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing dogfood work. | omit |
-| `--max-retry` `<n>` | Max auto-fix retries per stage. | 3 |
+| `--agent` `<inline\|auto\|name>` | **Testee-scoped** agent the testee runs under — forwarded into the testee invocation; the dogfood driver always runs in the current session. | omit (forward nothing) |
+| `--max-retry` `<n>` | Max auto-fix retries per step. `0` = observe-only. Mandatory (as `0` or `N`) for pipeline-driving testees and testees with a mutating `--fix` mode. | 2 |
 | `--save` | Compatibility no-op; saving is now default. Retained until evidenced retirement. | off |
-| `--task` | Record outcomes against a task. | omitted |
-| `--chain-follow` | Follow the testee's chained follow-ups. | off |
+| `--task` | **Creates** a new review-template task for the findings (`spur task create --template review`) — it does not attach to or update the task under test. | off |
+| `--chain-follow` | **Reads existing chained-leg evidence** (verdict artifacts, task-file diffs, review tables) after a chained leg completes, for attribution — it never executes the chained leg itself. Without it the driver stops at the testing boundary. | off |
 | `--full` | Full report verbosity (all sections). | off |
 
 For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag-glossary.md).

package/plugins/sp/commands/dev-fixall.md

@@ -27,9 +27,12 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 ## Implementation
 
-Under the pipeline, the `test-recheck` state runs the full gate immediately after this hop — that is
-the deciding run. When `--gate-log` is set (the pipeline signal), fixall runs **no full gate at
-all**: targeted probes (`bun test <file> --test-name-pattern <test>`) during fix loops, then one
-`bun run lint` before returning. Invoked standalone, it keeps the single confirming run (R4, task
-0483). `qualityGateCmd` itself is unchanged so `test-recheck` still runs the full gate.
+Follow the inline procedure in [dev-operations.md](../skills/spur-dev/references/dev-operations.md#10-fixall) (fixall). Pipeline signal: when `--gate-log` is set (the `test-fix` hop), run no full gate — the `test-recheck` state immediately after is the deciding run (R4, task 0483).
+
+When dispatched from the pipeline's test-fix stage (F96, task 0950), the gate log carries a
+`residual artifact` block (`<wbs>-residuals.json`) and the findings file already
+contains the merged residual anchors: treat those items as fix targets, in order,
+alongside gate anchors. The fixer may write `.spur/run/<wbs>-residual-deferrals.json`
+— one `{id, reason}` entry per item — but only for P3 findings or diff markers it
+cannot fix inside the task; the done stage settles deferrals into follow-up tasks.
 

package/plugins/sp/commands/dev-run.md

@@ -41,6 +41,12 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 **Flags:**
 
 - `--auto` | `--agent <inline|auto|name>` — Skip objective HITL confirmations (taste/irreversible gates still pause). `--agent` names who does the model-bearing work. Interactive omit/`inline` keeps the controller and implement-only stages in this session; full mode reads `task-pipeline.yaml` as the SSOT and interprets its actions/guards through the inline driver, whose eligible `agent.run` stages dispatch once to a native subagent and otherwise run in the host (0508 eligibility — task 0687 resolved-inline) It records `stage <id> executed inline in session <session-id>` or `stage <id> executed via subagent <agent-id> (host session <session-id>)` in the run log. `auto` or a name is merged into `vars.agent` and `vars.implementAgent` and keeps the existing subprocess workflow. Headless `spur workflow run` / `spur agent run` is unchanged. See the [execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
+- `--escalation-file <path>` (implement step only, 0933) — names the Q/A escalation transcript
+  (default `.spur/run/<wbs>-escalation.md`). Absent on a first attempt means "no prior
+  escalations". When the implement agent needs an operator decision it appends its question to
+  `.spur/run/<wbs>-question.md` and exits 0 — the pipeline's `escalate` hop surfaces the question,
+  the operator answers via `spur workflow continue --answer-text`, and the guard appends the Q/A
+  pair to this transcript before re-entering implement, where the agent reads it and resumes.
 
 `--worktree` `[<name>]` (run the task's pipeline in an isolated git worktree — FF-merge onto the
 base ref on full success, retain intact on any failure/halt/non-FF; bare form creates a fresh tree,

package/plugins/sp/commands/dev-runall.md

@@ -20,10 +20,11 @@ Wraps the **sp:spur-dev** skill.
 | `--auto` | Skip objective HITL gates. | off |
 | `--agent` `<inline\|auto\|name>` | Who runs each task's pipeline stages. Interactive sequential omit/`inline` uses the host-session driver with unified inline semantics (task 0687 — see below)). `auto`, a name, parallel mode, and headless invocation use subprocesses. | omit |
 | `--json` | Emit structured JSON. | off |
-| `--wrap` | Run the wrap hop per task. The `--agent` selector is preserved into each `/sp:dev-wrap <wbs>` handoff when supplied; omission remains omission. | off |
+| `--wrap` | Run the wrap hop **once for the batch** over the `done` subset only (Step 6 of execution-batch.md): `vars.feature` is passed only when every frozen task is `done`/`cancelled`; an empty done subset skips the wrap with a reason. The `--agent` selector is preserved into the `/sp:dev-wrap` handoff when supplied; omission remains omission. | off |
 | `--next` | Chain-to-completion via the next-router. | off |
 | `--continue` | Resume an interrupted batch. | off |
 | `--worktree` `[<name>]` | Run the batch in an isolated git worktree; FF-merge on success, retain on failure. Bare `--worktree` creates a fresh tree; `--worktree <name>` adopts an existing worktree by name/path/branch. | off |
+| `--concurrency` `<n>` | Parallel-mode worker bound: at most `<n>` task pipelines run at once (task 0931); a dependent starts only after its in-set dependencies are integrated onto the base ref. No-op in sequential mode (ignored). | 2 |
 
 For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag-glossary.md).
 
@@ -41,7 +42,9 @@ structured findings, before any task pipeline action, task 0510 R2; scoped: `L4.
 (the expected pre-run state of any not-yet-run feature) is reported verbatim but does not abort —
 any other strict error aborts), `--mode`
 `<sequential|parallel>` (default `sequential`; `parallel` fans out a proven-independent subset —
-see `execution-batch.md` § Parallel Execution), `--keep-going`
+see `execution-batch.md` § Parallel isolation), `--concurrency <n>`
+(parallel-mode worker bound — at most <n> task pipelines at once, default 2; a dependent task starts
+only after its in-set dependencies are **integrated** onto the base ref), `--keep-going`
 (batch failure policy — skip a failed task's in-batch dependents, continue independents; default
 halts on first failure), `--auto`
 (sets `profile=auto` on each per-task run, skipping the HITL approve gate), `--agent <inline|auto|name>`
@@ -56,9 +59,10 @@ FF-merge onto the base ref on full success, retain intact on any failure/halt/no
 creates a fresh tree, `<name>` form adopts an existing worktree by name/path/branch; see
 `execution-batch.md` § Worktree isolation).
 
-**`--worktree` is sequential-only.** `--worktree --mode parallel` is **rejected**. This flag gives
-the batch *one* worktree for the whole run; per-task worktrees and parallel isolation remain task
-0142 Slice A. Run parallel batches without `--worktree`, or run them sequentially with it.
+**`--worktree` and parallel mode.** `--worktree --mode parallel` is **rejected** — parallel mode
+already isolates each task in its own worktree (see `execution-batch.md` § Parallel isolation), and
+reuse mode (`--worktree <name>`) has no per-task meaning. Run parallel batches without
+`--worktree`, or run them sequentially with it.
 
 **`--worktree` corpus visibility.** While the batch runs in a worktree, corpus writes (task
 statuses, kanban) land in the worktree copy; your main tree still shows pre-run statuses until the
@@ -75,7 +79,9 @@ advancing the feature lifecycle). **was: `--next` deliberately omitted; the old
 **Three orthogonal axes** (do not confuse): `--keep-going`
 = batch failure policy (does a failure halt the batch or skip dependents?);
 `--continue` = resume from
-checkpoint (pick up an interrupted batch); `--next`
+checkpoint against the batch's original frozen identity — persisted plan membership, worktree
+marker, identity-filtered checkpoints as hints (execution-batch.md § Batch continuation, task
+0919); `--next`
 = chain each task to terminal status + batch-once wrap. See `dev-operations.md` § runall for the
 full distinction.