@gobing-ai/spur 0.3.92 → 0.3.93

package/config/workflows/task-pipeline.yaml

@@ -486,8 +486,8 @@ states:
     - id: test-recheck
       description: >
           Soft recheck after fixall with bounded SQLite-lock retry. Writes PASS|FAIL (always exit 0). Transitions
-          branch to review (PASS), another test-fix (FAIL and under max attempts),
-          or the pipeline `failed` state (FAIL and attempts exhausted) — never a
+          branch to `triage` (PASS — the 0943 lane router), `test-fail-triage` (FAIL — the 0943
+          failure-class router), or the pipeline `failed` state (corrupt status) — never a
           raw lifecycle abort that skips the terminal `failed` state.
       onEnter:
           # R4 (0703, ADR-071): bounded remediation mutated the tree by design, so the fresh evidence
@@ -510,6 +510,99 @@ states:
                 command: >-
                     mkdir -p .spur/run; if [ -f plugins/sp/scripts/quality-gate.ts ]; then bun plugins/sp/scripts/quality-gate.ts recheck; elif Q="$(superskill script path sp quality-gate.mjs 2>/dev/null)" && [ -f "$Q" ]; then node "$Q" recheck; else echo "quality gate failed closed — quality-gate script not found — run 'superskill install sp'" >&2; printf 'FAIL\n' > ".spur/run/$wbs-test-gate.status"; fi; exit 0
 
+    - id: triage
+      description: >-
+          Deterministic lane router between a green gate and the review/verify fork (0943 R1).
+          Writes the diffstat evidence file, honors a caller-set `mode` (never overridden), pins
+          the safety lane on sensitive paths or >400 changed lines without a model call (R2c),
+          otherwise consults `decide task-triage` (low → fast lane; anything else stays empty →
+          standard review path), and appends the triage route reason to
+          .spur/memory/task-pipeline-routes.log (R5). The `decide` action itself runs
+          unconditionally (the engine has no onEnter conditionals); its result is consulted only
+          when neither a caller mode nor the deterministic guard resolved the lane. The resolved
+          lane lands in the `mode` var for the triage → verify/review guards.
+      onEnter:
+          # (a) diffstat producer: task-diffstat.ts owns git reading and sensitive-path
+          # classification; shell only resolves it and fails closed (writes sensitive:true,
+          # which the pre-guard below maps to the safety lane).
+          - kind: shell
+            options:
+                command: >-
+                    mkdir -p .spur/run; if [ -f plugins/sp/scripts/task-diffstat.ts ]; then bun plugins/sp/scripts/task-diffstat.ts --spur-bin "$spurBin"; elif D="$(superskill script path sp task-diffstat.mjs 2>/dev/null)" && [ -f "$D" ]; then node "$D"; else echo "task-diffstat failed closed — task-diffstat script not found — run 'superskill install sp'" >&2; printf '{"files":0,"insertions":0,"deletions":0,"paths":[],"sensitive":true}\n' > ".spur/run/$wbs-diffstat.json"; fi; exit 0
+          # (b)+(c) lane pre-guard BEFORE decide: a caller-set mode is projected verbatim (R2b);
+          # a sensitive path or >400 changed lines pins safety (R2c) and the decide result below
+          # is never consulted. A missing/malformed diffstat row (producer crashed or never ran,
+          # disk error) pins safety HERE: an empty mode file would let the low decide row project
+          # the fast lane downstream, so the "never to fast" fail-safe is enforced at the guard,
+          # not by the projection (the full-suite gate run exposed this fail-open path).
+          - kind: shell
+            options:
+                command: >-
+                    mkdir -p .spur/run; if [ -n "$mode" ]; then printf '%s\n' "$mode" > ".spur/run/$wbs-mode.txt"; exit 0; fi; DF=".spur/run/$wbs-diffstat.json"; if ! jq -e 'type == "object"' "$DF" >/dev/null 2>&1; then printf 'safety\n' > ".spur/run/$wbs-mode.txt"; exit 0; fi; jq -r 'if .sensitive == true or ((.insertions // 0) + (.deletions // 0)) > 400 then "safety" else empty end' "$DF" 2>/dev/null > ".spur/run/$wbs-mode.txt"; exit 0
+          # (d) lane decision — degrades to the standard default whenever workflow.decideDecisionMaker
+          # is off (R4), so with the flag off this state is pure shell: no model call is made.
+          - kind: decide
+            options:
+                id: task-triage
+                method: choice
+                question: >-
+                    The quality gate is green. Which verification lane does this diff deserve —
+                    low (small, contained diff — fast lane), standard, or high caution?
+                choices: [low, standard, high]
+                default: standard
+                evidence:
+                    - .spur/run/${vars.wbs}-diffstat.json
+                    - ${vars.taskSpecPath}
+                resultFile: .spur/run/${vars.wbs}-triage.decision
+          # (d) project the decision: low → fast lane; anything else (standard/high, degraded
+          # default, missing row) leaves the mode empty → standard review path. A non-empty mode
+          # file (caller-set or deterministic-high) is never overridden.
+          - kind: shell
+            options:
+                command: >-
+                    MF=".spur/run/$wbs-mode.txt"; [ -s "$MF" ] && exit 0; jq -r 'if .value == "low" then "fast" else empty end' ".spur/run/$wbs-triage.decision" 2>/dev/null > "$MF"; exit 0
+          # R5: append the triage route reason in the shared routes-log format.
+          - kind: shell
+            options:
+                command: >-
+                    m="$(cat ".spur/run/$wbs-mode.txt")"; RUN_ID="$__runId"; [ -n "$RUN_ID" ] || RUN_ID="pipeline-$wbs"; mkdir -p .spur/memory; printf '%s %s %s\n' "$RUN_ID" "$wbs" "$(jq -rn --arg m "$m" --arg c "$mode" 'if $c != "" then ($c + ":caller-set") else {"fast":"fast:triage low lane","safety":"safety:triage deterministic-high","":"safety:triage standard lane"}[$m] // "safety:triage unrecognized mode" end')" >> .spur/memory/task-pipeline-routes.log
+          # (d) the resolved lane becomes the `mode` var for the triage → verify/review guards.
+          - kind: file.read.into-var
+            options:
+                path: .spur/run/${vars.wbs}-mode.txt
+                var: mode
+
+    - id: test-fail-triage
+      description: >-
+          Deterministic failure-class router on a red gate (0943 R3). The engine has no onEnter
+          conditionals, so the FAIL branch from `test`/`test-recheck` lands here as its own
+          deterministic state (the sanctioned alternative), while the green branch goes to
+          `triage`. `decide failure-class` reads the bounded gate findings and routes: retryable
+          → test-recheck (the attempt is counted on entry, so qualityGateMaxFixAttempts still
+          bounds the loop), fix → test-fix (the repair hop, as before), stop → failed with
+          terminalReason failed-check. A missing/corrupt decision fails closed to failed-check.
+      onEnter:
+          - kind: decide
+            options:
+                id: failure-class
+                method: choice
+                question: >-
+                    The quality gate failed. Is the failure retryable (transient or environmental
+                    — just re-run the gate), fixable by the repair agent, or should the run stop
+                    here?
+                choices: [retryable, fix, stop]
+                default: fix
+                evidence:
+                    - .spur/run/${vars.wbs}-test-gate.findings
+                resultFile: .spur/run/${vars.wbs}-failure-class.decision
+          # A retryable classification still counts an attempt so the existing
+          # qualityGateMaxFixAttempts cap bounds the recheck loop (0943 R3; the cap edge reads
+          # the same counter the fixall path uses).
+          - kind: shell
+            options:
+                command: >-
+                    A=".spur/run/$wbs-test-fix-attempt"; [ "$(jq -r '.value // ""' ".spur/run/$wbs-failure-class.decision" 2>/dev/null)" = retryable ] && { n="$(cat "$A" 2>/dev/null || echo 0)"; printf '%s\n' "$((n + 1))" > "$A"; }; exit 0
+
     - id: review
       description: Three-dimensional code review via /sp:dev-review (functional requirements traceability + SECUA framework (Security, Efficiency, Correctness, Usability, Architecture) + architecture depth), findings written to `## Review`.
       onEnter:
@@ -779,6 +872,7 @@ transitions:
                   test "$size_status" = PASS && test "$evidence_status" = PASS && $spurBin task check $wbs
     - from: precheck
       to: failed
+      terminalReason: failed-check
       description: Size and/or task check failed — stop before implement.
       guard:
           kind: always
@@ -791,6 +885,7 @@ transitions:
     # fresh question file so a COMPLETED implement after max asks still routes to test.
     - from: implement
       to: failed
+      terminalReason: retry-exhausted
       description: Escalation bound exhausted — the agent paused again after maxEscalations operator answers.
       # 0933 R30 (guard-lines compression): thin predicate; the report note is written
       # by the failed state's onEnter when it observes a bound-exhausted pause.
@@ -826,38 +921,36 @@ transitions:
               command: 'test -n "$__hitlInput"'
     - from: escalate
       to: failed
+      terminalReason: cancelled
       description: Empty operator answer — give-up routes to failed (question + transcript preserved as evidence).
       guard:
           kind: shell
           options:
               command: 'test -z "$__hitlInput"'
-    # Soft probe branching (declaration order: PASS first, then FAIL, then defense).
+    # Soft probe branching (declaration order: PASS → triage, FAIL → test-fail-triage, defense).
+    # 0943 R1/R3: the four former gate-PASS edges (test/test-recheck → verify/review, split on
+    # `$mode`) are replaced by the deterministic `triage` lane producer; a red gate lands in
+    # `test-fail-triage` where `decide failure-class` routes the failure instead of a static fixall.
     - from: test
-      to: verify
-      description: Quality gate already green and mode is fast — proportional fast path bypasses review.
+      to: triage
+      description: Quality gate green — route the lane deterministically (triage, 0943 R1).
       guard:
           kind: shell
           options:
               command: >-
                   gate_status="$(cat .spur/run/$wbs-test-gate.status 2>/dev/null)";
-                  test "$gate_status" = PASS && test "$mode" = fast
+                  test "$gate_status" = PASS
     - from: test
-      to: review
-      description: Quality gate already green and safety mode — proceed to review.
-      guard:
-          kind: shell
-          options:
-              command: >-
-                  gate_status="$(cat .spur/run/$wbs-test-gate.status 2>/dev/null)";
-                  test "$gate_status" = PASS && test "$mode" != fast
-    - from: test
-      to: test-fix
-      description: Quality gate red — start bounded fixall loop.
+      to: test-fail-triage
+      description: Quality gate red — classify the failure before the repair hop (0943 R3).
       guard:
           kind: shell
           options:
               command: 'test "$(cat .spur/run/$wbs-test-gate.status 2>/dev/null)" = FAIL'
-    # Defense: missing/corrupt status — treat as FAIL path, not silent PASS.
+    # 0943 review P3#2: the former `test → test-fix` FAIL edge is removed — it was dead (the
+    # identical guard on test → test-fail-triage fires first) and a silent spec-bypass trap:
+    # restoring it would skip failure-class on every red gate. The always-defense below keeps
+    # pre-0943 corrupt-status behavior (fixall then recheck).
     - from: test
       to: test-fix
       description: Probe status missing/corrupt — attempt fixall then recheck.
@@ -868,51 +961,95 @@ transitions:
       description: Fixall finished — soft recheck the same quality gate.
       guard:
           kind: always
-    # Recheck branching (PASS first; under-max FAIL → fixall again; exhausted → failed).
+    # Recheck branching (PASS → triage; red → test-fail-triage; defense). The two former
+    # static FAIL edges (under-max → test-fix, exhausted → failed retry-exhausted) moved into
+    # test-fail-triage's decision routing (0943 R3).
     - from: test-recheck
-      to: verify
-      description: Quality gate green after fixall and mode is fast — proportional fast path bypasses review.
+      to: triage
+      description: Quality gate green after fixall — route the lane deterministically (triage, 0943 R1).
       guard:
           kind: shell
           options:
               command: >-
                   gate_status="$(cat .spur/run/$wbs-test-gate.status 2>/dev/null)";
-                  test "$gate_status" = PASS && test "$mode" = fast
+                  test "$gate_status" = PASS
     - from: test-recheck
-      to: review
-      description: Quality gate green after fixall and safety mode — proceed to review.
+      to: test-fail-triage
+      description: Still red after fixall — classify the failure (0943 R3).
       guard:
           kind: shell
           options:
               command: >-
                   gate_status="$(cat .spur/run/$wbs-test-gate.status 2>/dev/null)";
-                  test "$gate_status" = PASS && test "$mode" != fast
+                  test "$gate_status" = FAIL
+    # Defense: corrupt recheck status — failed, not review.
     - from: test-recheck
-      to: test-fix
-      description: Still red and under qualityGateMaxFixAttempts — another fixall hop.
-      # (warn) 5 commands: named gate status + fix attempts (legibility, 0874).
+      to: failed
+      terminalReason: failed-check
+      description: Recheck status missing/corrupt — stop at failed.
+      guard:
+          kind: always
+    # ── triage routing (0943 R1/R2): the lane producer replaced the four gate-PASS edges.
+    # mode=fast → verify; anything else (standard/high, deterministic-high, degraded default,
+    # caller-set non-fast) → review. Together the two guards are exhaustive, so triage never hangs.
+    - from: triage
+      to: verify
+      description: Triage resolved the fast lane (caller-set fast or task-triage low) — skip review.
+      guard:
+          kind: shell
+          options:
+              command: 'test "$mode" = fast'
+    - from: triage
+      to: review
+      description: Triage resolved a review lane (standard/high, deterministic-high, or caller-set) — review.
+      guard:
+          kind: shell
+          options:
+              command: 'test "$mode" != fast'
+    # ── failure-class routing (0943 R3): stop first (never mislabeled by the cap), then the
+    # attempt cap (bounds BOTH lanes — retryable counted on entry, fix as before), then the
+    # decision lanes, then the fail-closed defense. Declaration order matters.
+    - from: test-fail-triage
+      to: failed
+      terminalReason: failed-check
+      description: Failure class stop — the run terminates at failed, never bypassed.
       guard:
           kind: shell
           options:
               command: >-
-                  gate_status="$(cat .spur/run/$wbs-test-gate.status 2>/dev/null)";
-                  fix_attempts="$(cat .spur/run/$wbs-test-fix-attempt 2>/dev/null || echo 0)";
-                  test "$gate_status" = FAIL && test "$fix_attempts" -lt "$qualityGateMaxFixAttempts"
-    - from: test-recheck
+                  jq -e '.value == "stop"' ".spur/run/$wbs-failure-class.decision" >/dev/null 2>&1
+    - from: test-fail-triage
       to: failed
-      description: Still red after max fixall attempts — stop at failed (not silent abort).
-      # (warn) 5 commands: named gate status + fix attempts (legibility, 0874).
+      terminalReason: retry-exhausted
+      description: Attempt cap reached — qualityGateMaxFixAttempts bounds the retryable recheck and fix lanes alike.
+      # (warn) 5 commands: named fix attempts (legibility, 0874).
       guard:
           kind: shell
           options:
               command: >-
-                  gate_status="$(cat .spur/run/$wbs-test-gate.status 2>/dev/null)";
                   fix_attempts="$(cat .spur/run/$wbs-test-fix-attempt 2>/dev/null || echo 0)";
-                  test "$gate_status" = FAIL && test "$fix_attempts" -ge "$qualityGateMaxFixAttempts"
-    # Defense: corrupt recheck status — failed, not review.
-    - from: test-recheck
+                  test "$fix_attempts" -ge "$qualityGateMaxFixAttempts"
+    - from: test-fail-triage
+      to: test-recheck
+      description: Failure class retryable and under the cap — re-run the gate without fixall; the attempt was counted on entry.
+      guard:
+          kind: shell
+          options:
+              command: >-
+                  jq -e '.value == "retryable"' ".spur/run/$wbs-failure-class.decision" >/dev/null 2>&1
+    - from: test-fail-triage
+      to: test-fix
+      description: Failure class fix and under the cap — the bounded repair hop, as before.
+      guard:
+          kind: shell
+          options:
+              command: >-
+                  jq -e '.value == "fix"' ".spur/run/$wbs-failure-class.decision" >/dev/null 2>&1
+    # Defense: missing/corrupt failure-class decision — fail closed instead of silently repairing.
+    - from: test-fail-triage
       to: failed
-      description: Recheck status missing/corrupt — stop at failed.
+      terminalReason: failed-check
+      description: Failure-class decision missing/corrupt — stop at failed.
       guard:
           kind: always
     # ── review → approve, OR skip the HITL gate entirely when profile=auto (R4) ──
@@ -947,6 +1084,7 @@ transitions:
               command: 'test "$__hitlAnswer" = yes'
     - from: approve
       to: failed
+      terminalReason: cancelled
       description: Operator rejected at the approval gate — report and stop.
       guard:
           kind: shell
@@ -954,6 +1092,7 @@ transitions:
               command: 'test "$__hitlAnswer" = no'
     - from: approve
       to: cancelled
+      terminalReason: cancelled
       description: Operator cancelled at the approval gate.
       guard:
           kind: shell
@@ -1002,6 +1141,7 @@ transitions:
                   test "$(cat .spur/run/$wbs-test-fix-attempt 2>/dev/null || echo 0)" -lt "$qualityGateMaxFixAttempts"
     - from: verify
       to: failed
+      terminalReason: retry-exhausted
       description: >-
           Non-PASS with the fix budget exhausted, or a PASS/missing/malformed verdict whose proof
           block is absent or mismatched (task 0703 R5) — block before done; defense catch-all so the
@@ -1031,6 +1171,7 @@ transitions:
                   test "$verdict" = PASS && test "$proof_digest" = "$proofDigest"
     - from: record
       to: failed
+      terminalReason: failed-check
       description: Task check failed or proof evidence missing/malformed/mismatched — block before done.
       guard:
           kind: always

package/config/workflows/wayfinder-resolution.yaml

@@ -209,6 +209,7 @@ transitions:
         command: 'test "$(cat .spur/run/$__runId-wayfinder-precheck.status 2>/dev/null)" = PASS'
   - from: precheck
     to: failed
+    terminalReason: failed-check
     description: "Precheck FAIL — stop before delegation."
     guard:
       kind: always
@@ -221,6 +222,7 @@ transitions:
         command: 'test -s .spur/run/$__runId-wayfinder-answer.md'
   - from: investigate
     to: failed
+    terminalReason: failed-agent
     description: "Empty answer capture — investigate produced nothing to verify; stop rather than certify hollow evidence."
     guard:
       kind: shell
@@ -254,6 +256,7 @@ transitions:
         command: 'test "$__hitlAnswer" = yes'
   - from: approve
     to: cancelled
+    terminalReason: cancelled
     description: "Operator cancelled the research resolution."
     guard:
       kind: shell
@@ -261,6 +264,7 @@ transitions:
         command: 'test "$__hitlAnswer" = cancel'
   - from: approve
     to: failed
+    terminalReason: cancelled
     description: "Operator rejected the research resolution."
     guard:
       kind: shell
@@ -275,6 +279,7 @@ transitions:
         command: 'test "$(cat .spur/run/$__runId-wayfinder-final.status 2>/dev/null)" = PASS && test "$(cat .spur/run/$__runId-wayfinder-status.txt 2>/dev/null)" = done'
   - from: record
     to: failed
+    terminalReason: failed-check
     description: "Recording failed, was denied, or the task never reached done — stop without claiming completion."
     guard:
       kind: always

package/config/workflows/wrapup-pipeline.yaml

@@ -75,7 +75,7 @@
 "$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
 kind: state-machine
 name: wrapup-pipeline
-version: "4"
+version: "5"
 description: "Post-execution wrap-up: doc-sync (doc drift + learning capture), metrics, feature-transition, branch-cleanup"
 iterationBound: 10
 initialState: start
@@ -128,7 +128,10 @@ states:
       missing or corrupted capture refuses progression. A validated empty list
       -> skipped; length > 0 && mode == fast -> fast-path (metrics-record,
       bypassing doc-sync); missing/unknown/conflict -> doc-sync (safety-path).
-      Writes bounded machine-readable reason to reasonFile.
+      Writes bounded machine-readable reason to reasonFile. When the caller leaves
+      mode empty, a deterministic drift probe (0944) projects mode=fast only when
+      no changed path matches a doc-owned surface and every task's Solution
+      change map parsed — any doubt stays on the safety path.
     onEnter:
       - kind: note
         options:
@@ -148,21 +151,53 @@ states:
               echo "wrapup-steps failed closed — script not found — run 'superskill install sp'" >&2;
               printf 'FAIL\n' > ".spur/run/$__runId-wrapup-resolve.status";
             fi
-      # (e) route-reason writer: one jq table lookup over the mode var over the
-      # validated capture; workflow-local routing glue (0824). Runs AFTER validation
-      # and reads ONLY .spur/run/<runId>-wrapup-tasks.json — never raw vars.tasks
-      # (0783 R2/R5). A FAIL resolve exits without writing: the failed reason written
-      # by validation stands, and the skip reason can never mask it. A missing or
-      # corrupted capture fails the jq lookup (no skipped claim can be invented);
-      # the failed defense edge owns the run.
+      # (0944 R1-R3) deterministic drift probe — runs ONLY when the caller left mode
+      # empty (a caller-set mode is projected verbatim and the probe never runs). It
+      # writes <runId>-drift-probe.json {clean,reasons,paths} and projects the wrapup
+      # mode by writing <runId>-mode.txt: caller mode verbatim, `fast` when the probe
+      # is clean, empty when dirty (the probe script fails safe on any lookup or parse
+      # problem; a missing script writes a dirty probe + empty mode here). The next
+      # action reads the mode file into vars.mode via file.read.into-var.
       - kind: shell
         options:
           command: >-
-            mkdir -p .spur/run .spur/memory; RUN_ID="$__runId"; case "$RUN_ID" in '') echo "task-resolve: __runId is empty — refusing to write a route reason" >&2; exit 1 ;; esac;
-            REASON_FILE=".spur/run/$RUN_ID-route-reason.txt"; case "$(cat ".spur/run/$RUN_ID-wrapup-resolve.status" 2>/dev/null)" in FAIL) exit 0 ;; esac;
-            N=$(jq length ".spur/run/$RUN_ID-wrapup-tasks.json" 2>/dev/null);
-            jq -rn --arg m "$mode" --arg n "$N" 'if $n == "0" then "skipped:empty task list" else {"fast":"fast:evidence complete+consistent","":"safety:missing evidence (mode empty)","unknown":"safety:unknown evidence quality","conflict":"safety:conflicting evidence"}[$m] // "safety:unrecognized evidence (mode=\($m))" end' > "$REASON_FILE";
-            printf '%s %s\n' "$RUN_ID" "$(cat "$REASON_FILE")" >> .spur/memory/wrapup-routes.log
+            if [ -n "$mode" ]; then
+              printf '%s\n' "$mode" > ".spur/run/$__runId-mode.txt";
+            elif [ -f plugins/sp/scripts/wrapup-drift-probe.ts ]; then
+              bun plugins/sp/scripts/wrapup-drift-probe.ts;
+            elif W="$(superskill script path sp wrapup-drift-probe.mjs 2>/dev/null)" && [ -f "$W" ]; then
+              node "$W";
+            else
+              printf '{"clean":false,"reasons":["probe script not found"],"paths":[]}' > ".spur/run/$__runId-drift-probe.json";
+              printf '\n' > ".spur/run/$__runId-mode.txt";
+            fi
+      - kind: file.read.into-var
+        options:
+          path: .spur/run/${vars.__runId}-mode.txt
+          var: mode
+      # (e) route-reason writer: one table lookup over the projected mode var over
+      # the validated capture and the drift probe verdict; workflow-local routing
+      # glue (0824, moved behind the wrapup-steps locator in 0944 to stay inside the
+      # ADR-115 shell caps). Runs AFTER the probe/projection so the reason reflects
+      # the projected mode. Reads ONLY .spur/run/<runId>-wrapup-tasks.json and the
+      # probe verdict — never raw vars.tasks (0783 R2/R5). A FAIL resolve exits
+      # without writing: the failed reason written by validation stands, and the
+      # skip reason can never mask it. A clean probe yields `fast:drift-probe-clean`
+      # (0944); mode `safety` claims `safety:operator-forced doc-sync`; a missing or
+      # corrupted capture fails the lookup (no skipped or clean claim can be
+      # invented); the failed defense edge owns the run.
+      - kind: shell
+        options:
+          command: >-
+            mkdir -p .spur/run .spur/memory &&
+            if [ -f plugins/sp/scripts/wrapup-steps.ts ]; then
+              bun plugins/sp/scripts/wrapup-steps.ts route-reason;
+            elif W="$(superskill script path sp wrapup-steps.mjs 2>/dev/null)" && [ -f "$W" ]; then
+              node "$W" route-reason;
+            else
+              echo "wrapup-steps failed closed — script not found — run 'superskill install sp'" >&2;
+              printf 'FAIL\n' > ".spur/run/$__runId-wrapup-resolve.status";
+            fi
 
   - id: doc-sync
     description: >
@@ -367,6 +402,7 @@ transitions:
   # ── task-resolve: validation fail + proportional route table (0758 R1-R4, 0770) ──
   - from: task-resolve
     to: failed
+    terminalReason: failed-check
     description: >
       Validation FAIL (0770): malformed wrap input, a non-string/empty entry, an
       unresolved or non-completed task, or an empty __runId. Declared before the
@@ -402,6 +438,7 @@ transitions:
         command: 'test "$(jq length .spur/run/$__runId-wrapup-tasks.json 2>/dev/null || echo -1)" -gt 0 && test "$mode" != fast'
   - from: task-resolve
     to: failed
+    terminalReason: failed-check
     description: >
       Defense (0770) — no PASS/FAIL resolve status (shell crashed or never ran):
       route to `failed` rather than claiming a skip.
@@ -429,6 +466,7 @@ transitions:
       kind: action-ok
   - from: doc-sync
     to: failed
+    terminalReason: failed-check
     description: >
       Executor failure (non-zero exit, signal, or dispatch error) — keep the
       existing fail semantics; a contract violation never falls through here
@@ -458,6 +496,7 @@ transitions:
   # the metrics status PASS so a missing status can never claim success.
   - from: metrics-record
     to: failed
+    terminalReason: failed-check
     description: >
       Metrics capture failed for at least one task — a missing metrics row is
       recorded as failure, never silently omitted as success (0770).
@@ -490,6 +529,7 @@ transitions:
   # ── feature-transition: fail edge, then branch-cleanup (if merge) or done ──
   - from: feature-transition
     to: failed
+    terminalReason: failed-check
     description: >
       Required synchronization failed (0770): non-zero sync exit, an invalid
       sync result, or a failed feature gate. The failed status carries the
@@ -507,6 +547,7 @@ transitions:
         command: 'test "$(cat .spur/run/$__runId-wrapup-sync.status 2>/dev/null)" = PASS'
   - from: feature-verify
     to: failed
+    terminalReason: failed-check
     description: >
       Post-wrapup feature check failed (0915 F1): the bound receipt no longer
       validates against the current feature contract. Already-written

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.3.92",
+    "version": "0.3.93",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",
@@ -53,14 +53,14 @@
     },
     "devDependencies": {
         "@commander-js/extra-typings": "^14.0.0",
-        "@gobing-ai/ts-db": "^0.5.5",
-        "@gobing-ai/ts-ai-runner": "^0.5.5",
-        "@gobing-ai/ts-dual-workflow-engine": "^0.5.5",
-        "@gobing-ai/ts-infra": "^0.5.5",
-        "@gobing-ai/ts-llm-jsonl-importer": "^0.5.5",
-        "@gobing-ai/ts-rule-engine": "^0.5.5",
-        "@gobing-ai/ts-runtime": "^0.5.5",
-        "@gobing-ai/ts-utils": "^0.5.5",
+        "@gobing-ai/ts-db": "^0.5.7",
+        "@gobing-ai/ts-ai-runner": "^0.5.7",
+        "@gobing-ai/ts-dual-workflow-engine": "^0.5.7",
+        "@gobing-ai/ts-infra": "^0.5.7",
+        "@gobing-ai/ts-llm-jsonl-importer": "^0.5.7",
+        "@gobing-ai/ts-rule-engine": "^0.5.7",
+        "@gobing-ai/ts-runtime": "^0.5.7",
+        "@gobing-ai/ts-utils": "^0.5.7",
         "@types/bun": "1.3.14",
         "@types/figlet": "^1.7.0",
         "@types/node-notifier": "8.0.5",

package/plugins/sp/README.md

@@ -186,7 +186,7 @@ pipeline step.
 
 ```
 plugins/sp/
-├── skills/                          # Domain knowledge + workflow docs (38 skills)
+├── skills/                          # Domain knowledge + workflow docs (39 skills)
 │   ├── brainstorm/                  # Structured ideation workflow
 │   │   ├── agents/openai.yaml
 │   │   ├── examples/ideation-example.md
@@ -342,6 +342,7 @@ surface or run one workflow. All skills target the same five core platforms: `cl
 | `session-review`            | 1.1   | Inline review of the active coding-agent session — compact outcomes, evidence-backed resolved/open issue classification, proposal-only improvements, and next actions; no workflow, import, delegation, or mutation                                                                                           |
 | `spur-composer`             | 1.0   | Cross-noun composition — workflow catalog selection, the ephemeral→project→shared ladder, ADR-115 budgets, trace-driven rule tuning; applies accepted `spur-doctor` proposals through `spur` verbs; never judges its own output and never runs a recurring loop                                              |
 | `spur-doctor`               | 1.0   | Cross-noun evaluation — read-only CLI evidence per noun (task/feature/rule/workflow/agent spec), reflection over `history-anatomy` findings through a closed action-class map, and a proposal table; writes nothing; diagnoses artifacts, not runtime environments (`spur agent doctor`'s job)                |
+| `spur-check`                | 1.0   | Two-tier check primitive (ADR-124) — light changed-scope checks during development, the full `bun run spur-check` chain at the quality boundary, and the fingerprint-bound `<wbs>-check-receipt.json` with the `status` reuse rule; composes with `/sp:dev-fixall --gate-log`                                  |
 | `redesign-web-ui`           | 1.0   | Existing-UI visual upgrade — audit generic AI fingerprints, apply in-stack polish against `DESIGN.md` / live tokens, verify behavior and viewports; does not migrate frameworks                                                                                                                            |
 | `taste-refactoring-api`     | 1.0   | API design and refactoring for REST/HTTP, RPC/gRPC, GraphQL, event contracts, and CLI surfaces; compatibility, security, and migration review |
 | `taste-refactoring-ui`      | 1.0   | UI design and refactoring with visual hierarchy, typography, spacing, color, and interaction review |
@@ -512,6 +513,7 @@ hold `SKILL.md` and prompt-side companions only.
 | `scripts/feature-sync-bounded.ts`                    | Bounded retry-suppression wrapper for `spur feature sync` during batch/wrap-up runs — suppresses identical L4-blocked repeats                                                                                                              |
 | `scripts/stage-registry-adapter.ts`                  | dev-next golden-path adapter over the canonical stage registry — TABLE A/B/C resolution bridge for the status-aware facade                                                                                                                |
 | `scripts/task-size-precheck.ts`                      | Pipeline size precheck guard (R2) — evaluates R-item/Plan-count limits to PASS/FAIL                                                                                                              |
+| `scripts/task-diffstat.ts`                           | 0943 triage-lane diffstat producer — numstat + untracked scan vs the run base; writes `<wbs>-diffstat.json` with the sensitive-path flag; fails safe (sensitive)                                                       |
 | `scripts/validate-flag-contracts.ts`                 | Mechanical consistency gate — compares flag claims across command files, flag-glossary, cross-cutting, dev-operations, and ADR; reports disagreements                                                                                    |
 | `*.test.ts`                                          | Unit suites — in `hooks/` for guards, in `tests/<skill>/` per ADR-031 pairing                                                                                                                                                                                                                     |
 
@@ -629,7 +631,10 @@ pipeline owns one lifecycle phase:
 | `idea-pipeline.yaml`        | Idea/planning → feature + tasks   | `/sp:dev-idea`, `/sp:dev-plan`    |
 | `wrapup-pipeline.yaml`      | Post-execution wrap-up            | `/sp:dev-wrap`, `/sp:dev-wrapall` |
 | `wayfinder-resolution.yaml` | Wayfinder ticket resolution loop  | `spur workflow run` (free-form)   |
-| `decision-routing-example.yaml` | DecisionMaker routing example (never / evidence / omitted modes, defer → operator pause) | `spur workflow run` (authoring sample) |
+
+> 0946 (D64): the `decision-routing-example.yaml` authoring sample was retired from the catalogue
+> (zero runs, example-only — `docs/design/workflow-catalogue-refactor.md` §10); the pattern lives on
+> as a test fixture (`packages/app/tests/services/fixtures/decision-routing-example.yaml`).
 
 ### Lifecycle operations
 

package/plugins/sp/commands/dev-run.md

@@ -15,7 +15,7 @@ Wraps the **sp:spur-dev** and **sp:code-implementation** skills.
 | --- | --- | --- |
 | `<wbs>` | Task WBS to run. | required |
 | `--mode` `<full\|implement>` | Full pipeline or single implement step. | full |
-| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing stages. omit and explicit `--agent inline` resolve identically (task 0687): eligible stages dispatch once to a native subagent with host-session fallback (0508 eligibility); otherwise every stage executes in the invoking session. `auto` or a name keeps subprocess dispatch.. | omit |
+| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing stages. omit and explicit `--agent inline` resolve identically (task 0687): eligible stages dispatch once to a native subagent with host-session fallback (0508 eligibility); otherwise every stage executes in the invoking session. `auto` or a name keeps subprocess dispatch.. The opt-in `fleet` selector (0942) maps the run to `executor: 'fleet'` so `agent.run` stages dispatch through the fleet control plane (ADR-126) instead of a subprocess. | omit |
 | `--auto` | Skip objective HITL confirmations. | off |
 | `--next` | Chain-to-completion via the next-router. | off |
 | `--wrap` | Run the wrap hop after the main step. The `--agent` selector is preserved into the `/sp:dev-wrap <wbs>` handoff when supplied; omission remains omission. The wrap hop is workflow-backed and reports its trigger-3 subprocess override. | off |
@@ -40,7 +40,7 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 **Flags:**
 
-- `--auto` | `--agent <inline|auto|name>` — Skip objective HITL confirmations (taste/irreversible gates still pause). `--agent` names who does the model-bearing work. Interactive omit/`inline` keeps the controller and implement-only stages in this session; full mode reads `task-pipeline.yaml` as the SSOT and interprets its actions/guards through the inline driver, whose eligible `agent.run` stages dispatch once to a native subagent and otherwise run in the host (0508 eligibility — task 0687 resolved-inline) It records `stage <id> executed inline in session <session-id>` or `stage <id> executed via subagent <agent-id> (host session <session-id>)` in the run log. `auto` or a name is merged into `vars.agent` and `vars.implementAgent` and keeps the existing subprocess workflow. Headless `spur workflow run` / `spur agent run` is unchanged. See the [execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
+- `--auto` | `--agent <inline|auto|name>` — Skip objective HITL confirmations (taste/irreversible gates still pause). `--agent` names who does the model-bearing work. Interactive omit/`inline` keeps the controller and implement-only stages in this session; full mode reads `task-pipeline.yaml` as the SSOT and interprets its actions/guards through the inline driver, whose eligible `agent.run` stages dispatch once to a native subagent and otherwise run in the host (0508 eligibility — task 0687 resolved-inline) It records `stage <id> executed inline in session <session-id>` or `stage <id> executed via subagent <agent-id> (host session <session-id>)` in the run log. `auto` or a name is merged into `vars.agent` and `vars.implementAgent` and keeps the existing subprocess workflow; `--agent fleet` maps the run to `vars.executor: 'fleet'` instead (fleet dispatch, 0942). Headless `spur workflow run` / `spur agent run` is unchanged. See the [execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
 - `--escalation-file <path>` (implement step only, 0933) — names the Q/A escalation transcript
   (default `.spur/run/<wbs>-escalation.md`). Absent on a first attempt means "no prior
   escalations". When the implement agent needs an operator decision it appends its question to

package/plugins/sp/commands/dev-runall.md

@@ -18,7 +18,7 @@ Wraps the **sp:spur-dev** skill.
 | `--mode` `<sequential\|parallel>` | Batch execution order. | sequential |
 | `--keep-going` | Continue past per-task failures. | off |
 | `--auto` | Skip objective HITL gates. | off |
-| `--agent` `<inline\|auto\|name>` | Who runs each task's pipeline stages. Interactive sequential omit/`inline` uses the host-session driver with unified inline semantics (task 0687 — see below)). `auto`, a name, parallel mode, and headless invocation use subprocesses. | omit |
+| `--agent` `<inline\|auto\|name>` | Who runs each task's pipeline stages. Interactive sequential omit/`inline` uses the host-session driver with unified inline semantics (task 0687 — see below)). `auto`, a name, parallel mode, and headless invocation use subprocesses. The opt-in `fleet` selector (0942) maps each task run to `executor: 'fleet'` so `agent.run` stages dispatch through the fleet control plane (ADR-126) instead of a subprocess. | omit |
 | `--json` | Emit structured JSON. | off |
 | `--wrap` | Run the wrap hop **once for the batch** over the `done` subset only (Step 6 of execution-batch.md): `vars.feature` is passed only when every frozen task is `done`/`cancelled`; an empty done subset skips the wrap with a reason. The `--agent` selector is preserved into the `/sp:dev-wrap` handoff when supplied; omission remains omission. | off |
 | `--next` | Chain-to-completion via the next-router. | off |
@@ -49,7 +49,7 @@ only after its in-set dependencies are **integrated** onto the base ref), `--kee
 halts on first failure), `--auto`
 (sets `profile=auto` on each per-task run, skipping the HITL approve gate), `--agent <inline|auto|name>`
 (names who runs the pipeline's stages — interactive sequential omit/`inline` uses the host driver;
-`auto` or a name is merged into each per-task `vars.agent` and `vars.implementAgent`; parallel mode
+`auto` or a name is merged into each per-task `vars.agent` and `vars.implementAgent`; `fleet` maps each task run to `executor: 'fleet'` instead (fleet dispatch, 0942); parallel mode
 retains isolated subprocesses, ADR-047), `--json` (emit the
 report as JSON), `--wrap` (trigger
 `wrapup-pipeline.yaml` after the batch completes), `--next`