@gobing-ai/spur 0.3.91 → 0.3.93

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.3.91",
+            "version": "0.3.93",
             "source": "./plugins/sp"
         }
     ]

package/config/pipeline-budgets.json

@@ -36,10 +36,10 @@
             "decision": null
         },
         "history-anatomy": {
-            "modelQueries": 4,
+            "modelQueries": 3,
             "wallClockMs": null,
             "tokenCostUsd": null,
-            "source": "Coverage entry (0826 R2): the live definition's model-query count (extractResolvedWorkflowFacts, 2026-09-11). No real-run measurement yet: wall-clock and cost are unenforced until measured, never 0.",
+            "source": "Coverage entry (0826 R2): the live definition's model-query count (extractResolvedWorkflowFacts, 2026-09-11). No real-run measurement yet: wall-clock and cost are unenforced until measured, never 0. 0920 recount 2026-09-23: 4 -> 3 — the resolve-scope model hop was removed; scope/window validation is deterministic in the history-anatomy-cache paths command.",
             "decision": null
         },
         "wayfinder-resolution": {
@@ -48,13 +48,6 @@
             "tokenCostUsd": null,
             "source": "Coverage entry (0826 R2): the live definition's model-query count (extractResolvedWorkflowFacts, 2026-09-11). No real-run measurement yet: wall-clock and cost are unenforced until measured, never 0.",
             "decision": null
-        },
-        "decision-routing-example": {
-            "modelQueries": 0,
-            "wallClockMs": null,
-            "tokenCostUsd": null,
-            "source": "Coverage entry (0911): authoring example (config/workflows/decision-routing-example.yaml) enumerating `decision:` modes. Measured 0 model queries — the producer is a shell action, so the example runs with no provider (live count via loadQueryCounts, 2026-09-20). Not a pipeline humans run; wall-clock and cost unenforced, never 0.",
-            "decision": null
         }
     }
 }

package/config/plugin-scripts.json

@@ -36,6 +36,11 @@
             "contract": "standard",
             "twin": "idea-handoff.mjs"
         },
+        {
+            "rel": "wrapup-drift-probe.ts",
+            "contract": "standard",
+            "twin": "wrapup-drift-probe.mjs"
+        },
         {
             "rel": "wrapup-steps.ts",
             "contract": "standard",
@@ -48,7 +53,13 @@
         },
         {
             "rel": "inline-run-setup.ts",
-            "contract": "repo-only"
+            "contract": "standard",
+            "twin": "inline-run-setup.mjs"
+        },
+        {
+            "rel": "feature-verification-steps.ts",
+            "contract": "standard",
+            "twin": "feature-verification-steps.mjs"
         },
         {
             "rel": "idea-coverage-check.ts",
@@ -63,11 +74,21 @@
             "contract": "standard",
             "twin": "pr-reviewing.mjs"
         },
+        {
+            "rel": "record-feature-sync.ts",
+            "contract": "standard",
+            "twin": "record-feature-sync.mjs"
+        },
         {
             "rel": "quality-gate.ts",
             "contract": "standard",
             "twin": "quality-gate.mjs"
         },
+        {
+            "rel": "residual-scan.ts",
+            "contract": "standard",
+            "twin": "residual-scan.mjs"
+        },
         {
             "rel": "script-contract-check.ts",
             "contract": "repo-only"
@@ -80,6 +101,11 @@
             "rel": "surface-drift-inventory.ts",
             "contract": "repo-only"
         },
+        {
+            "rel": "task-diffstat.ts",
+            "contract": "standard",
+            "twin": "task-diffstat.mjs"
+        },
         {
             "rel": "task-evidence-precheck.ts",
             "contract": "repo-only"

package/config/templates/AGENTS.md

@@ -95,6 +95,10 @@ It owns document responsibilities and maintenance; `00` owns architectural choic
 `01` product scope, and root `DESIGN.md` UI/UX. Use **`sp:doc-evolve`** for drift,
 sync and contract checks. Follow host/operator precedence.
 
+For new `docs/plans/` working records and `docs/design/` non-UI satellites, use the
+`sp:spur-dev` plan/design templates and document-authoring reference. Preserve legacy files' history
+and headings when revising them; `sp:spur-doctor` can propose safe upgrades.
+
 ### Doc map
 
 | File | Owns | Update when |

package/config/templates/docs/02_ROADMAP.md

@@ -16,6 +16,8 @@ sync: [T5, T6]
 
 Phase goals, order, dependencies and exits only. Detailed feature state belongs in the
 feature tool's index; task progress belongs in task records (constitution §6.3).
+Detailed proposals and investigations may live in dated `docs/plans/` working records;
+link accepted phase changes here without copying the plan.
 
 ## Phase 0 — Foundation
 

package/config/templates/docs/03_ARCHITECTURE.md

@@ -31,4 +31,6 @@ _(Describe the primary data path: input → processing → output. Name the seam
 <!--
 Describes the CURRENT architecture only. Future/accepted designs go in sections explicitly
 titled "(accepted design — ADR-NNN; not yet built)". Keep command/schema detail in 04 satellites and task delivery receipts in task records.
--->
+Use the `sp:spur-dev` design template for a new non-UI satellite; link it instead of copying its
+contract here.
+-->

package/config/templates/docs/04_DESIGN.md

@@ -16,6 +16,8 @@ sync: [T3, T9]
 
 Non-UI contract index (constitution §6.5). Keep signatures, schemas, defaults, errors
 and boundary behavior in the owning `docs/design/<slug>.md` satellite.
+Start a new satellite from the `sp:spur-dev` design template; distinguish proposed from current
+behavior and preserve existing headings when revising one.
 
 ## UI/UX boundary & DESIGN.md
 

package/config/templates/docs/99_PROJECT_CONSTITUTION.md

@@ -3,7 +3,7 @@ name: Project Constitution
 doc: 99_PROJECT_CONSTITUTION
 owns: PROCESS — how the key files are maintained
 authority: authoritative-on-process
-version: 1.7.0
+version: 1.8.0
 created_at: {{init-date}}
 updated_at: {{init-date}}
 edit_rules: 99 §6.8
@@ -70,11 +70,15 @@ size, approval, task count, or completion alone does not qualify it for an ADR (
 ### 4.2 Working layers (outside the authority chain)
 
 - Dated `docs/plans/` and `docs/reports/` files hold proposals, investigations, audits and evidence.
-  They record work; accepted conclusions take effect only in their proper owner.
+  They record work; accepted conclusions take effect only in their proper owner. New plan files use
+  ordinary Markdown with concise frontmatter and purpose, evidence, recommendation, and follow-up
+  as applicable; the `sp:spur-dev` plan template is a starting point, not a rigid schema.
 - Configured task folders hold requirements, implementation plans, results and verification,
   maintained through the task tool. Resolve their paths through that tool.
 - Existing project context or learning storage holds reusable lessons (§8).
 - `docs/design/` and `docs/features/` are governed detail layers (§4.5), not scratch storage.
+  New non-UI design satellites use the `sp:spur-dev` design template; revisions preserve existing
+  meaning and references.
 
 Preserve historical evidence and its dates. It may be linked for provenance, but current
 contracts must be understandable without treating an old plan or report as governing policy.
@@ -90,6 +94,8 @@ Use `authoritative` for `00`, `authoritative-on-scope` for `01`,
 `owns` must match §4.1 in meaning. Bump the minor version for substantive edits and refresh
 `updated_at` when content changes. Do not touch unrelated documents just to update a date.
 Keep one metadata block. Root entry/UI files may use their established native format.
+Plans and design satellites use lighter frontmatter for identity, truthful status and dates;
+legacy files without it remain valid and readable. Do not infer historical status from a template.
 
 ### 4.4 AGENTS.md synchronization
 
@@ -194,6 +200,8 @@ Keep the index short. Satellites own non-UI signatures, schemas, defaults, error
 and boundary behavior. Verify against registrations/contracts; prefer generated artifacts to
 manual copies. UI rules belong in root `DESIGN.md`; architectural rationale belongs in `00`/`03`.
 Separate proposed from current behavior. A completed task adds no delivery receipt here.
+Use the design template to structure new satellites around boundaries, contracts, invariants and
+compatibility. Preserve stable headings and historical claims when revising old ones.
 
 ### 6.6 `docs/05_FEATURES.md` + `docs/features/<feature-id>_<slug>.md`
 

package/config/workflow-candidates.json

@@ -1,7 +1,72 @@
 {
     "schemaVersion": 1,
     "note": "Workflow graph-change promotion candidates (task 0873, feature D62; ADR-076 amendment). A candidate is shadow-run against recorded real-run inputs and is promoted into the canonical definition or deleted by its named deadline — never left as a standing parallel <name>2.yaml. `verdict` is null while pending and is filled by `bun scripts/spur-dev.ts promotion evaluate <id>`; `promotion check` (spur-check-feature) fails any candidate still present past its deadline, any unreferenced parallel definition in config/workflows/, and (0877 R8) any retired definition with real (non-dry) terminal runs lacking a recorded decision in `retirements[]`.",
-    "candidates": [],
+    "candidates": [
+        {
+            "id": "task-pipeline-triage-lanes",
+            "canonical": "task-pipeline",
+            "deadline": "2026-11-24",
+            "createdAt": "2026-09-25",
+            "rationale": "0943 (feature D64): task-pipeline work routes by triage lane and failure class instead of static graphs. Between a green gate and the review/verify fork a deterministic `triage` state writes the diffstat (plugins/sp/scripts/task-diffstat.ts, numstat + untracked scan against the precheck-anchored run base), honors a caller-set mode verbatim (never overridden), pins the safety lane on sensitive paths (drizzle/, packages/config/, server auth basenames, *secret*, .github/, plugins/sp/hooks/, *.sql) or >400 changed lines with NO model call, otherwise consults `decide task-triage` (low → fast lane skips review; standard/high → review), and appends the route reason to .spur/memory/task-pipeline-routes.log (R5). On a red gate, `decide failure-class` routes retryable → test-recheck (attempt counted, qualityGateMaxFixAttempts still bounds), fix → test-fix, stop → failed(failed-check); missing/corrupt decision fails closed. Projected basis: the 0938 baseline (docs/reports/2026-09-workflow-cost-baseline.md) measured task-pipeline wall median 7983s over 1 real terminal run with agent.run median 0; the fast lane saves the review agent.run + wall on triage-low diffs, and retryable classification saves fixall hops (and their gate re-runs) on transient failures. Measurement gap honestly named: with workflow.decideDecisionMaker off (R4) triage degrades to standard lanes (diffstat-guard-sensitive/large still forced safety — pure shell, no model), so benefit only materializes with the flag on; per-lane route counts are observable post-merge in .spur/memory/task-pipeline-routes.log. Measured-benefit status: projected from 0938, NOT shadow-run-confirmed — plan step 5 (recorded-input shadow runs) is DEFERRED out of the 0943 session and tracked by this candidate's deadline; `promotion evaluate` runs post-merge. If it does not beat the baseline, it is reverted (ADR-076).",
+            "measurement": {
+                "workflow": "task-pipeline"
+            },
+            "delta": {
+                "agentRunCount": 0,
+                "baselineAgentRunCount": 0,
+                "note": "Structural graph agent.run count unchanged (no new model state); fast-lane runs save the existing review agent.run (1 fewer on triage-low diffs), retryable classification can save fixall fix hops. baselineAgentRunCount = 0938 task-pipeline agentRunCountMedian."
+            },
+            "verdict": null
+        },
+        {
+            "id": "check-dedup-task-pipeline",
+            "canonical": "task-pipeline",
+            "deadline": "2026-11-24",
+            "createdAt": "2026-09-25",
+            "rationale": "0940 (feature D64): the comprehensive check runs once at the quality boundary — no-progress rechecks skip the full gate to the probe path (check.skipped-no-progress) and review confirms the check receipt (check.reused) instead of re-running tests/lint. Projected basis: the 0938 baseline (docs/reports/2026-09-workflow-cost-baseline.md) measured task-pipeline wall median 7983s over 1 real terminal run with agent.run median 0; per-state rows cover only `record` (visits=0) — no test-recheck/review state-level wall deltas exist yet, so the benefit is projected as wall time (full-gate vs probe cost on no-progress loops, plus removed review-stage re-runs), not agent.run count. Measured-benefit status: projected from 0938, NOT shadow-run-confirmed; `promotion evaluate` runs post-merge against recorded runs. If it does not beat the baseline, it is reverted (ADR-076).",
+            "measurement": {
+                "workflow": "task-pipeline"
+            },
+            "delta": {
+                "agentRunCount": 0,
+                "baselineAgentRunCount": 0,
+                "note": "No agent.run delta by design: check dedup removes full-gate wall time on no-progress rechecks and model-stage re-runs, not model hops. baselineAgentRunCount = 0938 task-pipeline agentRunCountMedian."
+            },
+            "verdict": null
+        },
+        {
+            "id": "wrapup-drift-probe",
+            "canonical": "wrapup-pipeline",
+            "deadline": "2026-11-24",
+            "createdAt": "2026-09-25",
+            "rationale": "0944 (feature D64): a deterministic probe (plugins/sp/scripts/wrapup-drift-probe.ts) runs only when the caller leaves wrapup mode empty and projects mode=fast when no changed path matches a doc-owned surface (AGENTS.md doc map + docs/99_PROJECT_CONSTITUTION.md ownership table) and every task's Solution change map parsed — clean wraps then skip doc-sync via the existing fast edge (fast:drift-probe-clean), any doubt stays on the safety path. Projected basis: doc-sync costs exactly 1 agent.run per wrapup (wrapup-pipeline declares one model query; 0938 baseline docs/reports/2026-09-workflow-cost-baseline.json has 0 recorded wrapup runs — agentRunCountMedian null — so the 1 is structural, never a measured median). Measurement gap honestly named: skipping doc-sync also skips learnings capture (0607 R2 merge), so clean wraps lose per-task learnings rows; measured post-promotion by comparing .spur/memory/wrapup-routes.log fast:drift-probe-clean counts against captured <runId>-wrapup-learnings.md files. For 0946 (measurement-only confirmation): the 0938 snapshot carries per-state rows in states[] but history-anatomy has zero of them (0 recorded runs — only task-pipeline/record exists), and cache hit/miss disposition lives in the history-anatomy provenance stamp (0659/0660, history-anatomy-cache.ts), not in real-run-cost.ts; terminalReasonMix exists per workflow but history-anatomy's is empty. Measured-benefit status: projected from structure + 0938, NOT shadow-run-confirmed; `promotion evaluate` runs post-merge. If it does not beat the baseline, it is reverted (ADR-076).",
+            "measurement": {
+                "workflow": "wrapup-pipeline"
+            },
+            "delta": {
+                "agentRunCount": 0,
+                "baselineAgentRunCount": 1,
+                "note": "Clean wrap skips the single doc-sync agent.run (1 -> 0 for those wraps). baselineAgentRunCount = 1 structural doc-sync agent.run per wrapup run (wrapup-pipeline declares one model query — config/pipeline-budgets.json); the 0938 snapshot records 0 wrapup runs (agentRunCountMedian null), so no measured median exists yet."
+            },
+            "verdict": null
+        },
+        {
+            "id": "idea-pipeline-guard-legibility",
+            "canonical": "idea-pipeline",
+            "deadline": "2026-11-24",
+            "createdAt": "2026-09-25",
+            "rationale": "0945 (feature D64): the four idea-pipeline route guards (ac-generate/feature-check → system-design|decompose) read derived fact files (.spur/run/<runId>-idea-design-route.txt, <runId>-idea-ac-ready.status) written by one deterministic shell action at the end of both ac-generate and feature-check onEnter, instead of re-deriving design×needs_design and dual status reads inline — guards drop from 4-5 logical commands with (warn) markers to 3 predicates with no warn (ADR-115), and routing is proven identical by the executed truth-table test (idea-pipeline-routing.test.ts: the frozen pre-refactor guards are the oracle across profile × __hitlAnswer × design × needs_design × ac × coverage, 3456 cells, plus the guard-parity fixture refreshed per the 0874→0887 protocol). Projected basis: 0938 terminal-reason coverage for idea-pipeline is 100% classified for new runs (all nine failure-state edges declare terminalReason under 0937), so route outcomes stay measurable per terminalReason; this is projected from structure, NOT shadow-run-confirmed — promotion evaluate fills the verdict post-merge, and a losing candidate reverts (ADR-076).",
+            "measurement": {
+                "workflow": "idea-pipeline"
+            },
+            "verdict": null,
+            "delta": {
+                "agentRunCount": 6,
+                "baselineAgentRunCount": 6,
+                "note": "No agent.run delta by design: legibility derives the route facts in shell, model hops are unchanged (composition baseline modelQueries=6 in config/pipeline-budgets.json holds). baselineAgentRunCount = 0938 idea-pipeline agentRunCountMedian."
+            }
+        }
+    ],
     "retirements": [
         {
             "name": "planning-pipeline",
@@ -14,6 +79,12 @@
             "recordedBy": "ADR-076 (commit 017ac7a30)",
             "date": "2026-08-20",
             "rationale": "Standing parallel definition deleted with the D5-N fixture promotion bar; 5 real terminal runs retained in history."
+        },
+        {
+            "name": "decision-routing-example",
+            "recordedBy": "0946 (D64)",
+            "date": "2026-09-25",
+            "rationale": "Example-only authoring sample (0911 D7, retained-as-example 0921) retired per the mechanical catalogue rule (D64 design §10): zero real runs in the 0938 window (2026-06-01, run-record plane) and no live caller — only the plugin README catalogue row, a 0-query budget coverage entry and design/help doc mentions. YAML deleted; README row, budget entry and doc mentions removed; the decision-policy regression fixture moved to packages/app/tests/services/fixtures/decision-routing-example.yaml (workflow-service.test.ts decision-policy block). Its exit also dropped `hitl.select` from the live action union, so the inline-pipeline-parity-check DOCUMENTED set and driver mirror dropped it (parity contract). No run history deleted; 0 real terminal runs retained in history."
         }
     ]
 }

package/config/workflows/feature-lifecycle.yaml

@@ -40,9 +40,17 @@ states:
     onEnter:
       # Caller wiring (task 0880, ADR-119): entering verification RUNS the
       # feature-scoped pass instead of only passively reading its status file.
+      # 0948 R1: pass BOTH vars the inner workflow needs. `--vars` was documented as
+      # replace-not-merge and a partial override silently blanked `spurBin`; the engine
+      # merges declared defaults today (0948 R2), but the caller stays explicit so the
+      # nested run is self-sufficient under either semantic.
       - kind: shell
         options:
-          command: '$spurBin workflow run feature-verification.yaml --vars "{\"featureId\":\"$featureId\"}"'
+          # Pass featureId and spurBin together. A partial --vars map used to be
+          # applied as a replacement, so the inner run lost spurBin and loadModule
+          # fell into source mode (0948 R1). The nested JSON is shell-expanded:
+          # $spurBin inside the double quotes keeps a multi-word invocation intact.
+          command: '$spurBin workflow run feature-verification.yaml --vars "{\"featureId\":\"$featureId\",\"spurBin\":\"$spurBin\"}"'
   - id: blocked
     description: Impediment; work suspended.
   - id: done
@@ -68,13 +76,14 @@ transitions:
   - from: verifying
     to: done
     description: >
-      Feature verified — complete. Requires the feature-scoped verification pass
-      (ADR-119) to have recorded PASS, then strict check (AC validated,
-      traceability clean).
+      Feature verified — complete. The strict check at the done boundary also
+      validates the bound verification receipt (D63 task 0915): current, PASS,
+      matching feature identity and verifier contract, digest-chained to the
+      checked inputs. Stale/missing/failed evidence denies the hop.
     guard:
       kind: shell
       options:
-        command: 'test "$(cat .spur/run/$featureId-feature-verification.status 2>/dev/null)" = PASS && $spurBin feature check $featureId --strict --as done'
+        command: '$spurBin feature check $featureId --strict --as done'
 
   # Rework: verifying → active (mandatory History entry)
   - from: verifying

package/config/workflows/feature-verification.yaml

@@ -1,29 +1,34 @@
-# Feature-scoped verification pass (ADR-119, feature D62, task 0872).
+# Feature-scoped verification pass (ADR-119, feature D62, task 0872; D63 task
+# 0915 remediation folds the evidence contract into a workflow-owned script).
 #
 # Owns a lifecycle boundary no per-task graph owns: the repo-wide checks whose
-# invariant spans the repository rather than a single task's diff — corpus
-# consistency, contract baselines, dependency/schema drift, the frozen History
-# surface, and the repo-wide test set. They run once per feature, deliberately
-# the slow pass; `feature-lifecycle`'s verifying entry invokes this workflow (task
-# 0880 caller wiring), and its verifying→done guard refuses to complete the
-# feature until this pass records PASS (ADR-119 consequence: a feature is not
-# done until it passes).
+# invariant spans the repository rather than a single task's diff. They run
+# once per feature, deliberately the slow pass; `feature-lifecycle`'s verifying
+# entry invokes this workflow (task 0880 caller wiring), and its verifying→done
+# guard refuses to complete the feature until this pass records PASS (ADR-119
+# consequence: a feature is not done until it passes).
 #
-# Run: spur workflow run feature-verification.yaml --vars '{"featureId":"D62"}'
+# Run: spur workflow run feature-verification.yaml --vars '{"featureId":"D63"}'
 #
-# Shape: verify -> done | failed. The shell action writes the verdict to
-# `.spur/run/<featureId>-feature-verification.status` and always exits 0; the
-# transition guard reads the status so a missing, corrupt or FAIL verdict routes
-# to `failed` (fail-closed), never a silent PASS.
+# Shape: verify -> done | failed. The onEnter step runs the standard script
+# `feature-verification-steps.ts` (no public CLI verb, D63 task 0915): it
+# resolves this very definition for the verifier identity (name, source path,
+# layer, definition digest), records the RUNNING receipt (run-scoped +
+# feature-latest copies), registers the run-scoped receipt as a run artifact,
+# runs the configured verification command via the safe launch splitter, and
+# completes the receipt PASS/FAIL with the after-pass proof-input digest. A
+# changed tree during the pass records FAIL.
 #
 # Reliability (aligned with task-pipeline / ADR-043): no agent.run nodes; the
-# verification command is a trusted config var executed via `sh -c` (same
-# surface as task-pipeline's qualityGateCmd — never interpolate untrusted input).
+# verification command comes from `vars.verificationCmd` below and is never
+# interpolated through a shell. The always-exit-0 onEnter means missing,
+# corrupt or FAIL evidence routes to `failed` via the guard (fail-closed),
+# never a silent PASS; infrastructure errors exit nonzero and surface.
 "$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
 kind: state-machine
 name: feature-verification
 version: "1"
-description: "Feature-scoped verification pass (ADR-119): runs the repo-wide check set once per feature and records PASS/FAIL. Invoked by feature-lifecycle's verifying entry."
+description: "Feature-scoped verification pass (ADR-119): runs the repo-wide check set once per feature and records a bound PASS/FAIL evidence receipt. Invoked by feature-lifecycle's verifying entry."
 iterationBound: 2
 initialState: verify
 terminalStates:
@@ -35,37 +40,41 @@ vars:
   featureId: "X"
   spurBin: "spur"
   verificationCmd: "bun run spur-check-feature"
+  __runId: ""
 
 states:
   - id: verify
     description: >
-      Run the repo-wide check set, record the verdict, always exit 0.
+      Run the repo-wide check set via the standard verification script, which
+      records the bound evidence receipt (verifier identity, checked-input
+      digest, run identity) and the coarse status file, always exit 0 so the
+      transition guard routes missing/corrupt/FAIL to `failed`.
     onEnter:
       - kind: shell
         options:
           command: >-
-            mkdir -p .spur/run;
-            sh -c "$verificationCmd" > ".spur/run/$featureId-feature-verification.log" 2>&1
-            && printf 'PASS\n' > ".spur/run/$featureId-feature-verification.status"
-            || printf 'FAIL\n' > ".spur/run/$featureId-feature-verification.status";
-            exit 0
+            bun plugins/sp/scripts/feature-verification-steps.ts verify
+            --feature-id "$featureId"
+            --run-id "$__runId"
+            --spur-bin "$spurBin"
 
   - id: done
-    description: Terminal — repo-wide checks passed.
+    description: Terminal — repo-wide checks passed and the receipt is bound.
 
   - id: failed
-    description: Terminal — repo-wide checks failed or the verdict is missing/corrupt.
+    description: Terminal — repo-wide checks failed or the evidence is missing/corrupt.
 
 transitions:
   - from: verify
     to: done
-    description: Repo-wide checks passed — the feature-scoped verification pass records PASS.
+    description: Repo-wide checks passed — the script completed the receipt with PASS.
     guard:
       kind: shell
       options:
-        command: 'test "$(cat .spur/run/$featureId-feature-verification.status 2>/dev/null)" = PASS'
+        command: 'test "$(cat .spur/run/$__runId-feature-verification.status 2>/dev/null)" = PASS'
   - from: verify
     to: failed
-    description: Repo-wide checks failed (or the verdict is missing/corrupt) — stop at failed.
+    terminalReason: failed-check
+    description: Repo-wide checks failed (or the evidence is missing/corrupt) — stop at failed.
     guard:
       kind: always

package/config/workflows/history-anatomy.yaml

@@ -11,7 +11,7 @@
 # would exceed the shell composition threshold and be flagged as an owned-capability candidate.
 #
 # Shape:
-#   start -> resolve-scope -> resolve-paths -> analyze -> cache-probe
+#   start -> resolve-paths -> analyze -> cache-probe
 #            (hit  -> refresh-provenance -> publish -> published)
 #            (miss -> render -> enrich -> structure-gate -> validate -> stamp -> publish)
 #            (structure-gate FAIL -> correct (max 2 total) -> structure-gate; exhausted -> failed)
@@ -28,7 +28,7 @@
 #
 # Vars (all must be declared here — the vars: block is the only safe shape; `spur workflow
 # validate` and the skill-structure test enforce it):
-#   mode      — "daily" (default) | "ad-hoc" (validated in resolve-scope)
+#   mode      — "daily" (default) | "ad-hoc" (validated deterministically by the helper `paths` command)
 #   date      — YYYY-MM-DD for --date (daily); empty for ad-hoc
 #   since     — inclusive ISO lower bound (ad-hoc; also normalizes daily via the DST-aware rule)
 #   until     — inclusive ISO upper bound (ad-hoc)
@@ -39,7 +39,7 @@
 #   focus     — ad-hoc focus string (required in ad-hoc mode, rejected in daily)
 #   recompute — "true" forces the full analyze/render/enrich/validate path (cache disposition
 #               forced-recompute)
-#   output    — explicit report output path; default run directory
+#   output    — explicit report output path; default docs/report/<date>-history-anatomy.md
 #   agent     — executor for the agent.run stages (enrich/validate)
 #   spurBin   — PATH-independent spur invocation (overridden by CLI at run start)
 #   __runId   — run-scoped id for explicit artifact paths (allocated in start)
@@ -85,28 +85,22 @@ states:
     description: >
       Allocate the run-scoped id and root. Every analyze/render path in this workflow writes to
       an explicit unique path under this run id — no stage reads the mutable latest.json pointer.
+      The retained identity is `.spur/run/<runId>-history-anatomy-run.id` (0948 R8). The fixed
+      `history-anatomy-run.id` name is only a latest pointer and is overwritten by the next run.
     onEnter:
       - kind: shell
         options:
           command: >-
             mkdir -p .spur/run;
             if [ -z "$__runId" ]; then __runId=$(uuidgen | tr 'A-Z' 'a-z' | cut -c1-8); fi;
-            echo "$__runId" > .spur/run/history-anatomy-run.id
+            echo "$__runId" > ".spur/run/$__runId-history-anatomy-run.id";
+            cp ".spur/run/$__runId-history-anatomy-run.id" .spur/run/history-anatomy-run.id
+          # 0948 R8 retention disposition: `history-anatomy-run.id` is a SINGLE fixed-name
+          # pointer that is overwritten every run — it does not accumulate, so it needs no
+          # reclamation path (unlike the run-record pair and legacy `.log` files, which
+          # `spur workflow clean --logs` owns). It is deliberately NOT a run record and is
+          # exempt from the catalog record-name sweep (see run-record-catalog.test.ts).
 
-  - id: resolve-scope
-    description: >
-      Dispatch the skill's mode validation (0658 references/modes.md): daily is the default and
-      rejects focus/since/until/output; ad-hoc requires a non-empty focus plus two ordered
-      inclusive bounds and rejects --date/--recompute. Writes the normalized selector artifact.
-    onEnter:
-      - kind: agent.run
-        options:
-          agent: ${vars.agent}
-          input: "Validate the mode arguments per sp:history-anatomy references/modes.md and write the normalized selector to .spur/run/${vars.__runId}-selector.json. mode=${vars.mode} date=${vars.date} since=${vars.since} until=${vars.until} focus=${vars.focus}. Reject conflicting arguments, naming the offending one; a rejection marks the run failed."
-          # Declared Layer-1 role (0538 R2): mode validation is a reviewer-standard judgment.
-          role: reviewer
-          expectFile: .spur/run/${vars.__runId}-selector.json
-          timeoutMs: ${vars.stepTimeoutMs}
 
   - id: resolve-paths
     description: >
@@ -122,6 +116,7 @@ states:
             h=$(superskill script path sp history-anatomy-cache.mjs);
             node "$h" paths --helper "$h" --report-dir "$reportDir" --date "$date"
             --output "$output" --mode "$mode" --since "$since" --until "$until"
+            --focus "$focus" --recompute "$recompute" --run-id "$__runId"
             --out .spur/run/$__runId-paths.txt
 
   - id: analyze
@@ -338,14 +333,8 @@ states:
 
 transitions:
   - from: start
-    to: resolve-scope
-    description: Scope resolved.
-    guard:
-      kind: always
-
-  - from: resolve-scope
     to: resolve-paths
-    description: Mode valid — resolve helper/skill/target paths once.
+    description: Mode/window grammar validated and paths resolved once (deterministic).
     guard:
       kind: always
 
@@ -402,6 +391,7 @@ transitions:
         command: 'grep -q "^PASS$" .spur/run/$__runId-structure-gate.txt 2>/dev/null'
   - from: structure-gate
     to: failed
+    terminalReason: retry-exhausted
     description: Structure gate FAIL with the correction cap exhausted — never publish a malformed candidate.
     guard:
       kind: shell
@@ -429,6 +419,7 @@ transitions:
         command: '! tail -n 1 .spur/run/$__runId-validation.txt 2>/dev/null | grep -qx "Verdict: PASS" && test "$(cat .spur/run/$__runId-correction-count 2>/dev/null || echo 0)" -lt 2'
   - from: validate
     to: failed
+    terminalReason: retry-exhausted
     description: Validation FAIL with the correction cap exhausted — terminate without publishing.
     guard:
       kind: always