@gobing-ai/spur 0.3.93 → 0.3.94

package/plugins/sp/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "sp",
-    "version": "0.3.93",
+    "version": "0.3.94",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics.",
     "extensions": {
         "pi": ["./hooks/pi/guard-extension.ts"]

package/plugins/sp/scripts/inline-run-setup.mjs

@@ -30,6 +30,8 @@ function usage() {
   console.error("       bun plugins/sp/scripts/inline-run-setup.ts --fingerprint --task-file <path> [--feature-file <path>] [--spur-bin <path>]");
   console.error("       bun plugins/sp/scripts/inline-run-setup.ts --action --run-id <id> --node <state> --kind <kind> " + "--status <done|failed> --ok <true|false> --duration-ms <n> [--spur-bin <path>]");
   console.error("       bun plugins/sp/scripts/inline-run-setup.ts --close --run-id <id> --status <done|failed|paused> [--reason <terminal-reason>] [--spur-bin <path>]");
+  console.error("       bun plugins/sp/scripts/inline-run-setup.ts --persist-out --from <worktree-path> [--spur-bin <path>]");
+  console.error("       terminal-reason is a closed enum (0937 R2): done, paused-operator, failed-check, failed-agent, " + "failed-timeout, failed-guard, cancelled, interrupted, retry-exhausted");
   console.error("       bun plugins/sp/scripts/inline-run-setup.ts --decide --run-id <id> --node <state> --options-json <file> [--spur-bin <path>]");
   process.exit(2);
 }
@@ -171,7 +173,7 @@ function runRecordLogPath(runDir, runId) {
     return legacyLogPath;
   return markdownPath;
 }
-function appendTraceFailureLine(runId, detail) {
+function appendRunLogLine(runId, detail) {
   try {
     const runDir = join(process.cwd(), ".spur", "run");
     if (!existsSync(runDir))
@@ -185,7 +187,7 @@ function appendTraceFailureLine(runId, detail) {
 async function runTraceMode(input) {
   const operation = input.close ? "run.close" : "action.finish";
   const fail = (error) => {
-    appendTraceFailureLine(input.runId, `trace-emission-failed operation=${operation} run=${input.runId}${input.node === "" ? "" : ` node=${input.node}`}${input.kind === "" ? "" : ` kind=${input.kind}`}: ${error}`);
+    appendRunLogLine(input.runId, `trace-emission-failed operation=${operation} run=${input.runId}${input.node === "" ? "" : ` node=${input.node}`}${input.kind === "" ? "" : ` kind=${input.kind}`}: ${error}`);
     process.stdout.write(`${JSON.stringify({ ok: false, runId: input.runId, error })}
 `);
     return input.close ? 1 : 0;
@@ -197,7 +199,7 @@ async function runTraceMode(input) {
     projectDb = await app.openInlineRunProjectDb(process.cwd());
     const writer = app.createWorkflowActionTraceWriter(projectDb.adapter, (failure) => {
       const detail = failure;
-      appendTraceFailureLine(input.runId, `trace-emission-failed operation=${detail.operation ?? operation} run=${input.runId}: ${detail.error ?? "unknown error"}`);
+      appendRunLogLine(input.runId, `trace-emission-failed operation=${detail.operation ?? operation} run=${input.runId}: ${detail.error ?? "unknown error"}`);
     });
     const result = input.close ? await writer.closeRun(input.runId, input.status, undefined, input.reason) : await writer.recordAction({
       runId: input.runId,
@@ -211,13 +213,20 @@ async function runTraceMode(input) {
       const failure = result.failure;
       return fail(failure.error ?? "unknown trace emission failure");
     }
+    if (input.close && input.status === "done" && result.actionRows === 0) {
+      const error = `run ${input.runId} closed done with zero action_runs rows`;
+      appendRunLogLine(input.runId, `trace-close-failed run=${input.runId}: ${error}`);
+      process.stdout.write(`${JSON.stringify({ ok: false, runId: input.runId, error, code: "NO_ACTION_ROWS", actionRows: 0 })}
+`);
+      return 1;
+    }
     process.stdout.write(`${JSON.stringify({ ...result, runId: input.runId })}
 `);
     return 0;
   } catch (error) {
     if (input.close && error.name === "RunRowNotFoundError") {
       const message = error instanceof Error ? error.message : String(error);
-      appendTraceFailureLine(input.runId, `trace-close-failed run=${input.runId}: ${message}`);
+      appendRunLogLine(input.runId, `trace-close-failed run=${input.runId}: ${message}`);
       process.stdout.write(`${JSON.stringify({ ok: false, runId: input.runId, error: message, code: "RUN_NOT_FOUND" })}
 `);
       return 1;
@@ -251,6 +260,7 @@ async function runDecideMode(input) {
     return decideFailed(outcome.error ?? "decide failed without an error message");
   process.stdout.write(`${JSON.stringify({ ok: true, runId: input.runId, node: input.node, ...outcome })}
 `);
+  appendRunLogLine(input.runId, `decide node=${input.node} value=${outcome.value ?? ""} source=${outcome.source ?? "default"} reason=${outcome.reason ?? ""}`);
   return await runTraceMode({
     runId: input.runId,
     close: false,
@@ -262,6 +272,21 @@ async function runDecideMode(input) {
     spurBin: input.spurBin
   });
 }
+async function runPersistOutMode(input) {
+  try {
+    const { entry } = resolveAppEntry(input.spurBin);
+    const app = await import(entry);
+    const result = await app.persistWorktreeRuns({ fromWorkdir: input.from, toWorkdir: process.cwd() });
+    process.stdout.write(`${JSON.stringify({ ok: true, persisted: result.persisted, skipped: result.skipped })}
+`);
+    return 0;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    process.stdout.write(`${JSON.stringify({ ok: false, error: message })}
+`);
+    return 1;
+  }
+}
 async function main() {
   if (!process.versions.bun) {
     const child = spawnSync("bun", [fileURLToPath(import.meta.url), ...process.argv.slice(2)], {
@@ -279,6 +304,8 @@ async function main() {
   let action = false;
   let close = false;
   let decide = false;
+  let persistOut = false;
+  let from = "";
   let optionsJson = "";
   let node = "";
   let kind = "";
@@ -305,6 +332,10 @@ async function main() {
       close = true;
     else if (argv[i] === "--decide")
       decide = true;
+    else if (argv[i] === "--persist-out")
+      persistOut = true;
+    else if (argv[i] === "--from")
+      from = argv[++i] ?? "";
     else if (argv[i] === "--options-json")
       optionsJson = argv[++i] ?? "";
     else if (argv[i] === "--node")
@@ -336,6 +367,13 @@ async function main() {
       refuseUnsafeRunId(runId);
     process.exit(await runDecideMode({ runId, node, optionsFile: optionsJson, spurBin }));
   }
+  if (persistOut) {
+    if (fingerprint || decide || action || close || runId !== "" || file !== "" || taskFile !== "")
+      usage();
+    if (from.trim() === "")
+      usage();
+    process.exit(await runPersistOutMode({ from, spurBin }));
+  }
   if (action || close) {
     if (action && close)
       usage();

package/plugins/sp/scripts/inline-run-setup.ts

@@ -34,6 +34,7 @@
  *   bun plugins/sp/scripts/inline-run-setup.ts --decide --run-id <id> --node <state> --options-json <file> [--spur-bin <path>]
  *       --status <done|failed> --ok <true|false> --duration-ms <n> [--spur-bin <path>]
  *   bun plugins/sp/scripts/inline-run-setup.ts --close --run-id <id> --status <done|failed|paused> [--reason <terminal-reason>] [--spur-bin <path>]
+ *   bun plugins/sp/scripts/inline-run-setup.ts --persist-out --from <worktree-path> [--spur-bin <path>]
  *
  * The `--fingerprint` mode prints the engine's proof-input digest for the given spec files and
  * creates nothing (task 0862 R5).
@@ -51,6 +52,14 @@
  * decision is still `ok: true` — the run continues — so exit 0 covers every model-level
  * outcome; only an invalid options schema exits 1 (fail closed).
  *
+ * The `--persist-out --from <worktree-path>` mode (task 0975 R1) is the WT-4a step a
+ * `--worktree` run executes BEFORE teardown: it copies the worktree's run provenance — the
+ * `runs`/`action_runs`/`phase_runs`/`transition_runs`/`workflow_states` rows and the two-file
+ * run records — into THIS tree's project DB and `.spur/run/` (cwd = the invoking tree).
+ * Idempotent; collisions are reported as `skipped[{id,reason}]`, never overwrites. Exit 0 =
+ * persisted (possibly with skips); exit 1 = fail closed — the driver routes to WT-5 and
+ * retains the worktree; usage errors exit 2.
+ *
  * Exit 2 is reserved for usage errors.
  *
  * Env: SPUR_BIN
@@ -102,6 +111,13 @@ function usage(): never {
     console.error(
         '       bun plugins/sp/scripts/inline-run-setup.ts --close --run-id <id> --status <done|failed|paused> [--reason <terminal-reason>] [--spur-bin <path>]',
     );
+    console.error(
+        '       bun plugins/sp/scripts/inline-run-setup.ts --persist-out --from <worktree-path> [--spur-bin <path>]',
+    );
+    console.error(
+        '       terminal-reason is a closed enum (0937 R2): done, paused-operator, failed-check, failed-agent, ' +
+            'failed-timeout, failed-guard, cancelled, interrupted, retry-exhausted',
+    );
     console.error(
         '       bun plugins/sp/scripts/inline-run-setup.ts --decide --run-id <id> --node <state> --options-json <file> [--spur-bin <path>]',
     );
@@ -371,7 +387,7 @@ function runRecordLogPath(runDir: string, runId: string): string {
  * exit immediately after), and never throws: an unwritable log must not wedge the run
  * (ADR-117 R3).
  */
-function appendTraceFailureLine(runId: string, detail: string): void {
+function appendRunLogLine(runId: string, detail: string): void {
     try {
         const runDir = join(process.cwd(), '.spur', 'run');
         if (!existsSync(runDir)) mkdirSync(runDir, { recursive: true });
@@ -393,7 +409,7 @@ function appendTraceFailureLine(runId: string, detail: string): void {
 async function runTraceMode(input: TraceModeInput): Promise<number> {
     const operation = input.close ? 'run.close' : 'action.finish';
     const fail = (error: string): number => {
-        appendTraceFailureLine(
+        appendRunLogLine(
             input.runId,
             `trace-emission-failed operation=${operation} run=${input.runId}` +
                 `${input.node === '' ? '' : ` node=${input.node}`}${input.kind === '' ? '' : ` kind=${input.kind}`}: ${error}`,
@@ -420,7 +436,7 @@ async function runTraceMode(input: TraceModeInput): Promise<number> {
         projectDb = await app.openInlineRunProjectDb(process.cwd());
         const writer = app.createWorkflowActionTraceWriter(projectDb.adapter, (failure: unknown) => {
             const detail = failure as { operation?: string; error?: string };
-            appendTraceFailureLine(
+            appendRunLogLine(
                 input.runId,
                 `trace-emission-failed operation=${detail.operation ?? operation} run=${input.runId}: ${detail.error ?? 'unknown error'}`,
             );
@@ -443,6 +459,18 @@ async function runTraceMode(input: TraceModeInput): Promise<number> {
             const failure = result.failure as { error?: string };
             return fail(failure.error ?? 'unknown trace emission failure');
         }
+        if (input.close && input.status === 'done' && result.actionRows === 0) {
+            // A run finalized `done` with ZERO recorded action rows is a bookkeeping defect
+            // (task 0975 R2): the row is already terminal — closeRun ran above — but the
+            // driver must surface this instead of reporting a clean close, and must never
+            // backfill rows. Exit 1 with the named code; the run record carries the finding.
+            const error = `run ${input.runId} closed done with zero action_runs rows`;
+            appendRunLogLine(input.runId, `trace-close-failed run=${input.runId}: ${error}`);
+            process.stdout.write(
+                `${JSON.stringify({ ok: false, runId: input.runId, error, code: 'NO_ACTION_ROWS', actionRows: 0 })}\n`,
+            );
+            return 1;
+        }
         process.stdout.write(`${JSON.stringify({ ...result, runId: input.runId })}\n`);
         return 0;
     } catch (error) {
@@ -450,7 +478,7 @@ async function runTraceMode(input: TraceModeInput): Promise<number> {
             // The run row must exist before --close can mark it terminal (R6); a missing row
             // is a loud correctness failure, not a best-effort emission failure (finding #4).
             const message = error instanceof Error ? error.message : String(error);
-            appendTraceFailureLine(input.runId, `trace-close-failed run=${input.runId}: ${message}`);
+            appendRunLogLine(input.runId, `trace-close-failed run=${input.runId}: ${message}`);
             process.stdout.write(
                 `${JSON.stringify({ ok: false, runId: input.runId, error: message, code: 'RUN_NOT_FOUND' })}\n`,
             );
@@ -485,6 +513,7 @@ async function runDecideMode(input: {
         value?: string;
         degraded?: boolean;
         reason?: string;
+        source?: 'model' | 'default';
         backend?: string | null;
         confidence?: number | null;
         resultFile?: string;
@@ -525,6 +554,12 @@ async function runDecideMode(input: {
     }
     if (!outcome.ok) return decideFailed(outcome.error ?? 'decide failed without an error message');
     process.stdout.write(`${JSON.stringify({ ok: true, runId: input.runId, node: input.node, ...outcome })}\n`);
+    // 0976 R2: the run log names the decision's provenance, so a declared-default fallback is
+    // never read as a model decision. Best-effort through the same run-log appender.
+    appendRunLogLine(
+        input.runId,
+        `decide node=${input.node} value=${outcome.value ?? ''} source=${outcome.source ?? 'default'} reason=${outcome.reason ?? ''}`,
+    );
     // Trace row is best-effort, exactly like --action: an emission failure never wedges the run.
     return await runTraceMode({
         runId: input.runId,
@@ -538,6 +573,33 @@ async function runDecideMode(input: {
     });
 }
 
+/**
+ * `--persist-out --from <worktree-path>` (task 0975 R1): resolve the app through the shared
+ * chain and copy the worktree's inline-run provenance into THIS tree. No persistence policy
+ * lives here — the app's `persistWorktreeRuns` (→ domain `transferRunTables`) owns the DB
+ * transfer, the idempotence and the conflict skips. Success prints
+ * `{ok:true,persisted:<n>,skipped:[…]}` and exits 0; any failure prints `{ok:false,error}`
+ * and exits 1 (the driver routes to WT-5 and retains the worktree).
+ */
+async function runPersistOutMode(input: { from: string; spurBin: string }): Promise<number> {
+    try {
+        const { entry } = resolveAppEntry(input.spurBin);
+        const app = (await import(entry)) as {
+            persistWorktreeRuns: (i: {
+                fromWorkdir: string;
+                toWorkdir: string;
+            }) => Promise<{ ok: true; persisted: number; skipped: ReadonlyArray<{ id: string; reason: string }> }>;
+        };
+        const result = await app.persistWorktreeRuns({ fromWorkdir: input.from, toWorkdir: process.cwd() });
+        process.stdout.write(`${JSON.stringify({ ok: true, persisted: result.persisted, skipped: result.skipped })}\n`);
+        return 0;
+    } catch (error) {
+        const message = error instanceof Error ? error.message : String(error);
+        process.stdout.write(`${JSON.stringify({ ok: false, error: message })}\n`);
+        return 1;
+    }
+}
+
 async function main(): Promise<void> {
     // The portable Node twin has no workspace imports; SQLite still uses Spur's existing Bun runtime.
     if (!process.versions.bun) {
@@ -555,6 +617,8 @@ async function main(): Promise<void> {
     let action = false;
     let close = false;
     let decide = false;
+    let persistOut = false;
+    let from = '';
     let optionsJson = '';
     let node = '';
     let kind = '';
@@ -573,6 +637,8 @@ async function main(): Promise<void> {
         else if (argv[i] === '--action') action = true;
         else if (argv[i] === '--close') close = true;
         else if (argv[i] === '--decide') decide = true;
+        else if (argv[i] === '--persist-out') persistOut = true;
+        else if (argv[i] === '--from') from = argv[++i] ?? '';
         else if (argv[i] === '--options-json') optionsJson = argv[++i] ?? '';
         else if (argv[i] === '--node') node = argv[++i] ?? '';
         else if (argv[i] === '--kind') kind = argv[++i] ?? '';
@@ -603,6 +669,14 @@ async function main(): Promise<void> {
         process.exit(await runDecideMode({ runId, node, optionsFile: optionsJson, spurBin }));
     }
 
+    // Worktree provenance persist-out (task 0975 R1): mutually exclusive with every other
+    // mode; requires the source worktree path. Runs with cwd = the invoking tree.
+    if (persistOut) {
+        if (fingerprint || decide || action || close || runId !== '' || file !== '' || taskFile !== '') usage();
+        if (from.trim() === '') usage();
+        process.exit(await runPersistOutMode({ from, spurBin }));
+    }
+
     if (action || close) {
         if (action && close) usage();
         if (runId.trim() === '' || status.trim() === '') usage();

package/plugins/sp/scripts/quality-gate.mjs

@@ -154,6 +154,9 @@ function lightScope(changedFiles, exists = existsSync) {
   }
   return { files, workspaces: [...workspaces].sort(), tests: [...tests].sort() };
 }
+function shQuote(arg) {
+  return /^[\w./@+-]+$/.test(arg) ? arg : `'${arg.replace(/'/g, `'\\''`)}'`;
+}
 function workspaceHasTypecheck(workspace) {
   try {
     const pkg = JSON.parse(readFileSync(join(workspace, "package.json"), "utf8"));
@@ -165,11 +168,11 @@ function workspaceHasTypecheck(workspace) {
 function planLightChecks(scope, hasTypecheck = workspaceHasTypecheck) {
   const plans = [];
   if (scope.files.length > 0) {
-    plans.push({ id: "format-lint:changed", cmd: `bunx biome check ${scope.files.join(" ")}` });
+    plans.push({ id: "format-lint:changed", cmd: `bunx biome check ${scope.files.map(shQuote).join(" ")}` });
   }
   for (const workspace of scope.workspaces) {
     if (hasTypecheck(workspace)) {
-      plans.push({ id: `typecheck:${workspace}`, cmd: `cd ${workspace} && bun run typecheck` });
+      plans.push({ id: `typecheck:${workspace}`, cmd: `cd ${shQuote(workspace)} && bun run typecheck` });
     }
   }
   const testsByWorkspace = new Map;
@@ -180,7 +183,10 @@ function planLightChecks(scope, hasTypecheck = workspaceHasTypecheck) {
     testsByWorkspace.set(workspace, paths);
   }
   for (const [workspace, paths] of testsByWorkspace) {
-    plans.push({ id: `test:${workspace}`, cmd: `cd ${workspace} && bun test ${paths.join(" ")}` });
+    plans.push({
+      id: `test:${workspace}`,
+      cmd: `cd ${shQuote(workspace)} && bun test ${paths.map(shQuote).join(" ")}`
+    });
   }
   return plans;
 }
@@ -376,7 +382,7 @@ function runQualityGate(mode, env, options = {}) {
   appendFileSync(abs(logFile), `proof-digest: ${env.proofDigest ?? ""}
 `);
   let receiptFile;
-  if (mode === "run") {
+  if (!noProgressSkip) {
     if ((env.proofDigest ?? "").length > 0) {
       receiptFile = join(runDir, `${env.wbs}-check-receipt.json`);
       const receipt = buildReceipt({
@@ -439,6 +445,7 @@ function main(argv, env = getEnvVars(), options = {}) {
 export {
   workspaceHasTypecheck,
   tailLines,
+  shQuote,
   scanCoverageShortfalls,
   runShellCommand,
   runQualityGate,

package/plugins/sp/scripts/quality-gate.ts

@@ -26,8 +26,8 @@
  * output matches a SQLite busy/locked error; the delay defaults to 10 seconds and is
  * overridable via `SPUR_QUALITY_GATE_RETRY_DELAY_MS` (tests).
  *
- * Check receipts (task 0939, ADR-124): `run` writes `.spur/run/<wbs>-check-receipt.json`
- * (`check-receipt/v1`) when `proofDigest` is set; without a digest no receipt is written and the
+ * Check receipts (task 0939, ADR-124): `run` and `recheck` write `.spur/run/<wbs>-check-receipt.json`
+ * (`check-receipt/v1`) when `proofDigest` is set (a no-progress skip keeps the receipt it matched); without a digest no receipt is written and the
  * log says why. The gate executes `qualityGateCmd` as one unit, so the full-tier receipt carries
  * a single `test` row for the whole `bun run spur-check` chain (lint | typecheck | test-pre-check
  * | test | test-post-check). `light` accumulates: a sub-check already PASS in a light receipt at
@@ -335,6 +335,15 @@ export function lightScope(changedFiles: string[], exists: (p: string) => boolea
     return { files, workspaces: [...workspaces].sort(), tests: [...tests].sort() };
 }
 
+/**
+ * Quote one argument for `sh -c`. Changed-file names come from the working tree (untracked files
+ * included), so an unquoted `x$(cmd).ts` would run `cmd` and a space would split the argument.
+ * Plain paths pass through unchanged to keep receipts readable.
+ */
+export function shQuote(arg: string): string {
+    return /^[\w./@+-]+$/.test(arg) ? arg : `'${arg.replace(/'/g, `'\\''`)}'`;
+}
+
 export interface LightCheckPlan {
     id: string;
     cmd: string;
@@ -364,11 +373,11 @@ export function planLightChecks(
 ): LightCheckPlan[] {
     const plans: LightCheckPlan[] = [];
     if (scope.files.length > 0) {
-        plans.push({ id: 'format-lint:changed', cmd: `bunx biome check ${scope.files.join(' ')}` });
+        plans.push({ id: 'format-lint:changed', cmd: `bunx biome check ${scope.files.map(shQuote).join(' ')}` });
     }
     for (const workspace of scope.workspaces) {
         if (hasTypecheck(workspace)) {
-            plans.push({ id: `typecheck:${workspace}`, cmd: `cd ${workspace} && bun run typecheck` });
+            plans.push({ id: `typecheck:${workspace}`, cmd: `cd ${shQuote(workspace)} && bun run typecheck` });
         }
     }
     const testsByWorkspace = new Map<string, string[]>();
@@ -379,7 +388,10 @@ export function planLightChecks(
         testsByWorkspace.set(workspace, paths);
     }
     for (const [workspace, paths] of testsByWorkspace) {
-        plans.push({ id: `test:${workspace}`, cmd: `cd ${workspace} && bun test ${paths.join(' ')}` });
+        plans.push({
+            id: `test:${workspace}`,
+            cmd: `cd ${shQuote(workspace)} && bun test ${paths.map(shQuote).join(' ')}`,
+        });
     }
     return plans;
 }
@@ -622,9 +634,12 @@ export function runQualityGate(
     writeFileSync(abs(statusFile), `${status}\n`);
     appendFileSync(abs(logFile), `proof-digest: ${env.proofDigest ?? ''}\n`);
 
-    // 0939 R2: only `run` writes the full-tier receipt, and only with a digest to bind it to.
+    // 0939 R2: the gate writes the full-tier receipt only with a digest to bind it to. 0976 R1:
+    // `recheck` persists the receipt it evaluated too, so a second recheck at the same digest can
+    // take the no-progress skip. A skip leaves the FAIL receipt it matched untouched — a skip never
+    // rewrites a receipt, so it can never launder FAIL into PASS.
     let receiptFile: string | undefined;
-    if (mode === 'run') {
+    if (!noProgressSkip) {
         if ((env.proofDigest ?? '').length > 0) {
             receiptFile = join(runDir, `${env.wbs}-check-receipt.json`);
             const receipt = buildReceipt({

package/plugins/sp/scripts/residual-scan.mjs

@@ -17,7 +17,7 @@ function getEnvVars() {
 var RESIDUAL_SCAN_USAGE = "usage: residual-scan.ts <scan|fold|settle|report> <wbs> [--spur-bin <bin>] [--root <dir>] [--tmp-dir <dir>]";
 var MARKER_PATTERN = /TODO|FIXME|XXX|HACK/;
 var PRIORITY_PATTERN = /^P[1-4]/;
-var NONE_FINDING = /^(none|\u2014)$/i;
+var NONE_FINDING = /^(none( found)?|no (findings?|issues?)( found)?|\u2014)\s*(\(.*\))?\.?$/i;
 var DISPOSITION_HEADER = /^(Disposition|Action|Status|Resolution|Fixed)$/i;
 var RESOLVED_DISPOSITION = /^(FIXED|RESOLVED|DONE)\b/i;
 var DEFERRED_DISPOSITION = /^DEFER(RED)?\b/i;

package/plugins/sp/scripts/residual-scan.ts

@@ -64,7 +64,8 @@ export interface ScanOptions {
 
 const MARKER_PATTERN = /TODO|FIXME|XXX|HACK/;
 const PRIORITY_PATTERN = /^P[1-4]/;
-const NONE_FINDING = /^(none|—)$/i;
+// Placeholder "no finding" cells, optionally with a trailing "(…)" note; "None of X…" is a real finding.
+const NONE_FINDING = /^(none( found)?|no (findings?|issues?)( found)?|—)\s*(\(.*\))?\.?$/i;
 const DISPOSITION_HEADER = /^(Disposition|Action|Status|Resolution|Fixed)$/i;
 const RESOLVED_DISPOSITION = /^(FIXED|RESOLVED|DONE)\b/i;
 const DEFERRED_DISPOSITION = /^DEFER(RED)?\b/i;

package/plugins/sp/skills/session-review/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: session-review
-description: "Review the active coding-agent session: separate resolved from open issues with evidence, propose bounded improvements. With --triage, apply pure-doc / 1–2-line fixes inline and file the rest as one task. Triggers: review this session, wrap-up, triage findings."
+description: "Review the active coding-agent session: separate resolved from open issues with evidence, propose bounded improvements. With --triage, apply pure-doc / 1–2-line fixes inline and file the rest as one or more tasks. Triggers: review this session, wrap-up, triage findings."
 license: Apache-2.0
 version: 1.1.0
 metadata:
@@ -31,7 +31,7 @@ cross-agent windows, recurrence, trends, or quantitative performance forensics.
 | Argument | Description | Default |
 | --- | --- | --- |
 | `[focus]` | Question or operation to emphasize. It changes ordering, not evidence collection. | full active session |
-| `--triage` | Opt into bounded remediation after the report: apply direct fixes (pure docs / one-to-two-line fixes) inline, then file all remaining actionable findings as exactly one new task via the CLI-gated corpus surface. | off (report-only) |
+| `--triage` | Opt into bounded remediation after the report: apply direct fixes (pure docs / one-to-two-line fixes) inline, then file all remaining actionable findings as one or more implement-ready tasks via the CLI-gated corpus surface. | off (report-only) |
 
 ## Evidence boundary
 
@@ -64,13 +64,15 @@ three buckets — never skip triage and start fixing from the raw findings list.
    - **Note** — pre-existing, environmental, or ownerless observations; report only.
 2. **Apply direct fixes inline** — smallest surgical diff, project style, and re-verify each
    with the targeted check (lint / test / the exact command that exhibited the issue).
-3. **Create exactly one task** for the Task bucket through the CLI-gated corpus surface
-   (`spur task create`, then `spur task update <wbs> --section <s> --from-file` per section).
-   One task, not one per finding: each finding keeps its evidence, a suggested fix direction,
-   and an AC where verifiable. Exclude what direct fixes already resolved — say so in the task
-   Background instead.
+3. **File the Task bucket as one or more tasks** by the shared filing rule in
+   [dev-operations.md § 2. review](../spur-dev/references/dev-operations.md#2-review) (Triage
+   step 3): one task per cohesive unit one agent can implement and verify in one run, under the
+   existing feature that owns the surface (never a new root feature), implement-ready, written
+   only through `spur task create --skip-ready` + `spur task update <wbs> --section <s> --from-file`.
+   Not one task per finding: each finding keeps its evidence, fix direction, and an AC where
+   verifiable. Exclude what direct fixes already resolved — say so in the task Background.
 4. **Report** — add a Triage section: applied fixes (path + one-line what + verification) and
-   the created task WBS. The Resolved/Open tables keep their evidence rules unchanged.
+   each created task WBS. The Resolved/Open tables keep their evidence rules unchanged.
 
 ## Protocol
 
@@ -156,7 +158,7 @@ improvement. Use `None` when the session is complete and no follow-up is justifi
   to imported-history analysis.
 - Report-only by default: do not create or update corpus items or edit files. The single exception
   is `--triage` mode, which permits exactly two mutation classes — direct fixes from the triage
-  bucket, and the one triage task. Anything beyond that stays a proposal.
+  bucket, and the triage tasks. Anything beyond that stays a proposal.
 - Do not turn a single low-impact observation into a new policy. Report it as a candidate until it
   recurs or demonstrates a high-impact contract violation.
 

package/plugins/sp/skills/spur-dev/references/dev-operations.md

@@ -68,7 +68,7 @@ each would be scope creep for one-liner procedures.
 | #   | Operation  | Command             | Backing           | Skill / Verb                                                                       | Arg-hint                                                                                                                                                                                               |
 | --- | ---------- | ------------------- | ----------------- | ---------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | 1   | unit       | `dev-unit`          | `Skill()`         | `sp:code-testing`                                                                  | `<target> [--coverage <pct>] [--agent <inline\|auto\|name>] [--auto]`                                                                                                                                  |
-| 2   | review     | `dev-review`        | `Skill()`         | `sp:code-verification` (`review`) + `sp:functional-review` + `sp:code-improvement` | `[<wbs\|path>] [--agent <inline\|auto\|name>] [--focus <dims>] [--fix (deprecated)]`                                                                                                                   |
+| 2   | review     | `dev-review`        | `Skill()`         | `sp:code-verification` (`review`) + `sp:functional-review` + `sp:code-improvement` | `[<wbs\|path>] [--agent <inline\|auto\|name>] [--focus <dims>] [--triage] [--worktree [<name>]]`                                                                                                       |
 | 3   | verify     | `dev-verify`        | `Skill()`         | `sp:code-verification` (`verify`)                                                  | `<wbs> [--agent <inline\|auto\|name>] [--fix <none\|blockers-first\|all>] [--focus <lens>] [--bdd] [--auto] [--force] [--next] [--skip-shippable]`                                                     |
 | 3a  | verifyall  | `dev-verifyall`     | `Skill()` → agent | `sp:spur-dev` (`verifyall`)                                                        | `--tasks <selector> [--feature <id>] [--agent <inline\|auto\|name>] [--fix <none\|blockers-first\|all>] [--focus <lens>] [--bdd] [--auto] [--force] [--next] [--json] [--skip-shippable] [--worktree [<name>]]` |
 | 4   | run        | `dev-run`           | `Skill()`         | `sp:spur-dev` (`run` / `implement`)                                                | `<wbs> [--mode <full\|implement>] [--agent <inline\|auto\|name>] [--auto] [--next] [--wrap] [--continue] [--worktree [<name>]]`                                                                                              |
@@ -116,7 +116,13 @@ must not be changed without updating the backing skill.
 - **Modes:**
   - **WBS mode (`<wbs>`)**: Runs functional requirements traceability (`sp:functional-review`), SECUA framework (`sp:code-verification`), and architectural depth (`sp:code-improvement`). The three skills return review fragments; the coordinator writes the combined `## Review` (F92 0593 R1).
   - **Path mode (`<path>`)**: Runs advisory SECUA framework (`sp:code-verification`) and architectural depth (`sp:code-improvement`). Performs no task mutation.
-- **Inputs:** `<wbs|path>` (required). Review executes inline (in-session) by default. `--agent <inline|auto|name>` selector accepted (see [SSOT](cross-cutting.md#inline-default-execution-surface)). `--focus <lens>` narrows to one SECUA dimension. Note: `--fix` and `--next` are **deprecated** (no-op with warning; route remediation to `/sp:dev-verify --fix` and progression to `/sp:dev-next`).
+- **Inputs:** `<wbs|path>` (required). Review executes inline (in-session) by default. `--agent <inline|auto|name>` selector accepted (see [SSOT](cross-cutting.md#inline-default-execution-surface)). `--focus <lens>` narrows to one SECUA dimension. `--triage` opts into bounded remediation after the report (below). `--worktree [<name>]` isolates the triage writes (below; requires `--triage`). Note: `--fix` and `--next` are **deprecated** (no-op with warning; route remediation to `--triage` or `/sp:dev-verify --fix` and progression to `/sp:dev-next`). The task pipeline's review stage never passes `--triage` or `--worktree`.
+- **Triage (`--triage`):** runs inline in the invoking session after the merged report — never inside `sp:super-reviewer` or the review skills, which stay report-only. With `--agent <name>`, only the review is delegated; triage still runs inline on the returned findings. Never fix straight from the raw findings list:
+  1. **Bucket every finding exactly once.** **Direct fix** — local, low-risk, obvious root cause: no design choice, no public-surface / schema / dependency change, not a shared write path, verifiable by a targeted check (docs, a guard, a missing throw, a wrong path helper, a stale comment). **Task** — real and actionable but needs design, crosses modules, touches a public surface, or is not verifiable locally; skip it when an existing task already owns it (cite that WBS). **Note** — pre-existing, environmental, or ownerless; report only.
+  2. **Apply direct fixes** — smallest surgical diff in project style, then re-verify each with its targeted check (focused test, lint, or the exact command that exhibited the defect). A fix that grows beyond the bar or fails its check moves to the Task bucket with what was learned; do not leave it half-applied.
+  3. **File the Task bucket as one or more tasks**, one per cohesive unit of work that one agent can implement and verify in one run — split unrelated fixes, merge findings that share a root cause or file set. File under the existing feature that owns the affected surface; if none fits, create a child feature under the closest existing parent — never a new root feature. Write through the CLI-gated corpus surface only (`spur task create --feature <id> --skip-ready`, then `spur task update <wbs> --section <s> --from-file`). Each task must meet the implement-ready bar ([§ 5. refine](#5-refine), `--depth ready`) so it cannot drift: per finding the evidence (`file:line`), the defect, the chosen fix direction with rejected alternatives, file targets, AC, and out-of-scope; promote `backlog → todo` only when `spur task check <wbs> --json` is clean. Name what the direct fixes already resolved in each task's Background.
+  4. **Gate and report.** Run the project gate once after the direct fixes. Report a Triage section: each applied fix (path + one-line what + verification), each filed task (WBS + feature + scope), and the Notes. Never commit or create a branch outside `--worktree`.
+- **Worktree (`--worktree [<name>]`):** omitted → all writes land in the current working tree on the current branch; no branch creation, checkout, or commit (the operator commits). Given → the [execution-batch.md § Worktree isolation](execution-batch.md#worktree-isolation---worktree-name) lifecycle as a run of one: marker `command` = `dev-review`, `selector` = the review target, derived branch/directory slug = the WBS or the path's basename (`sp/review-<slug>-<short-id>`). Admission is "the target resolves" (a known WBS or an existing path) — no `quickReadiness` task-set check. Review and triage both run in the tree; WT-3b commits the fixes and filed tasks. The WT-4 success condition reads as "every direct fix passed its check and the project gate is green"; a failed check or gate takes the WT-5 retention path. Rejected without `--triage` (WT-7) — to review another worktree read-only, pass a path inside it.
 - **Backing:** `sp:functional-review`, `sp:code-verification` (review mode), `sp:code-improvement`.
 - **Behavior:** WBS mode runs functional traceability + SECUA + architecture depth, ranking findings P1–P4, and hands the merged report to the review coordinator, which writes `## Review`. Component skills never write `## Review` in coordinated mode. Path mode runs advisory SECUA + architecture depth with no task mutation.
 - **Delegation:** WBS mode: `sp:functional-review` + `sp:code-verification` (review) + `sp:code-improvement`; Path mode: `sp:code-verification` (review) + `sp:code-improvement`.

package/plugins/sp/skills/spur-dev/references/execution-batch.md

@@ -490,16 +490,25 @@ Evidence persistence precedes destructive cleanup: a persistence failure (unread
 disk-full, missing directory) routes to **WT-5** — the worktree and branch are retained so a green
 batch can never destroy its own evidence. Reuse mode retains its operator-owned tree but still
 persists the Step 5 report under the invoking tree; the reused tree's `.spur/run/` remains the live
-copy while that tree lives on.
-
-**Stage records are worktree-local too (0948 R9, E7 Finding 5).** The persisted report and verdict
-JSONs above are the batch's *summary* evidence. Each task's own per-stage run record
-(`.spur/run/<runId>.md` + `.state.json`, plus gate/answer artifacts) is written inside the
-worktree's `.spur/run/` and **is removed with the worktree** in create mode. A merged batch
-therefore leaves no per-stage run record in the invoking tree unless it is copied out. Anything
-auditing "what did this batch actually run?" must copy those records out **before** WT-4 removal —
-the E7 batch lost exactly this evidence this way. The rule is the same one above: copy out first,
-then remove; a copy failure retains the worktree.
+copy while that tree lives on. The per-run provenance — the worktree DB's run/action rows and the
+`.spur/run/<runId>.md` + `.state.json` records — is persisted mechanically by WT-4a's
+`inline-run-setup.ts --persist-out --from <worktree>` call, not by hand.
+
+**Stage records are worktree-local too (0948 R9, E7 Finding 5; persisted by 0975 R1).** Each task's
+own per-stage run record (`.spur/run/<runId>.md` + `.state.json`) and the worktree DB's run rows are
+written inside the worktree and **are removed with it** in create mode — the E7 batch lost exactly
+this evidence. Copying them out is no longer a manual audit-time duty: WT-4a (create-mode block
+below) runs `inline-run-setup.ts --persist-out --from "$WT_PATH"` **before** WT-4b holder cleanup,
+which copies the run/action/phase/transition/workflow-state rows and both record files into the
+invoking tree. The shapes are pinned (task 0975 R1): idempotent on re-persist; success exits 0
+printing `{"ok":true,"persisted":<n>,"skipped":[{"id":<run-id>,"reason":"id-exists"|"external-key-conflict"|"record-conflict:<file>"}]}`
+— an `id-exists` / `external-key-conflict` skip never modifies the pre-existing target rows, a
+`record-conflict:<file>` skip never overwrites a divergent invoking-tree record — and any failure
+exits 1 printing `{"ok":false,"error":<message>}` (a worktree DB run id that is not a single safe
+filename component is rejected before any target write). Any persist-out failure
+routes to **WT-5** — worktree and branch retained — the same copy-out-first contract as the
+verdict persistence above. After a green persist-out, `spur workflow progress --json` in the
+invoking tree shows the merged run `done` with its per-action rows.
 
 ## Step 6 — Batch wrap (`--wrap` / `--next`) (F96 task 0952 R1)
 
@@ -538,7 +547,7 @@ all subsequent tools, agents, task/feature writes, and run artifacts use the con
 tree's cwd. A stale or empty selector, an unsupported mode, or an invalid target creates no tree and
 no marker (WT-2/WT-7), and the required Git safety checks (WT-1) still precede creation.
 
-> **Command wiring (task 0814 R3).** The four worktree-capable commands (`dev-run`, `dev-runall`,
+> **Command wiring (task 0814 R3).** The four task-set worktree commands (`dev-run`, `dev-runall`,
 > `dev-refineall`, `dev-verifyall`) each call `quickReadiness` with their operation (`run`/`refine`/
 > `verify`), the resolved selector/status, and the filtered-set size **before** WT-1/WT-2. The
 > admission outcome gates the tree: an invalid/empty selector, unsupported mode, or a target that
@@ -557,6 +566,13 @@ non-PASS verify verdict, or a HITL pause that ends the run take the WT-5 retenti
 full pipeline is eligible — `--worktree --mode implement` is rejected (WT-7), because that mode is
 the pipeline's implement stage and already runs in the driver's tree.
 
+**Review triage `dev-review` (run of one).** `/sp:dev-review <target> --triage --worktree [<name>]`
+runs this lifecycle around one review-plus-triage pass: WT-1…WT-6 apply unchanged, the marker's
+`command` is `dev-review` and its `selector` is the review target, and the slug is the WBS or the
+path's basename (`sp/review-<slug>-<short-id>`). It skips `quickReadiness` (there is no task set;
+admission is "the target resolves"). WT-4 success reads as "every direct fix passed its check and the
+project gate is green"; anything else takes WT-5. Contract: [dev-operations.md § 2. review](dev-operations.md#2-review).
+
 One flag, two modes (see the glossary entry for the ownership rule). Bare `--worktree` is **create
 mode** (cut a fresh branch + sibling tree). `--worktree <name>` is **reuse mode** (attach to a tree
 that already exists); name resolution (§ WT-2 below) runs before WT-1. The deltas each mode applies
@@ -805,13 +821,23 @@ git checkout "$BASE_REF"
 [ "$(git rev-list --count "$BASE_SHA..$BRANCH")" -gt 0 ] \
   || { echo "halt: branch carries no commits - nothing to merge" >&2; false; }   # -> WT-5
 git merge --ff-only "$BRANCH"          # FF-only: never rebase, merge-commit, or resolve conflicts
-# if FF succeeded — WT-4a evidence persistence (Step 5, task 0720 R3) runs FIRST:
-# persist the batch report + verdict artifacts into the invoking tree's .spur/run/
-# before anything below touches the worktree. Persistence failure routes to WT-5.
+# if FF succeeded — WT-4a evidence persistence runs FIRST (Step 5, task 0720 R3):
+# persist the batch report + verdict artifacts AND the per-run provenance (task
+# 0975 R1) into the invoking tree before anything below touches the worktree.
+# Any persistence failure routes to WT-5 — the worktree and branch are retained.
+WT_PATH="$(cd "../<worktree-dir>" && pwd)"   # hoisted: needed by WT-4a AND WT-4b below
+# WT-4a provenance persist-out (task 0975 R1): copy the worktree DB's run rows plus
+# the .spur/run/<runId>.md + .state.json records into THIS tree. Run from the main
+# tree (cwd = the invoking tree). Idempotent; conflicts are reported, never
+# overwritten. A non-zero exit — including a half-readable worktree — must NOT
+# proceed to WT-4b removal:
+SETUP_SCRIPT="plugins/sp/scripts/inline-run-setup.ts"
+[ -f "$SETUP_SCRIPT" ] || SETUP_SCRIPT="$(superskill script path sp inline-run-setup.mjs 2>/dev/null)"
+bun "$SETUP_SCRIPT" --persist-out --from "$WT_PATH" \
+  || { echo "halt: worktree run-record persist-out failed - worktree retained (WT-5)" >&2; exit 1; }
 #
-# WT-4b — bounded CWD-holder cleanup (task 0720 R1). Resolve the EXACT absolute
-# worktree path; a relative path or a stale entry matches the wrong processes.
-WT_PATH="$(cd "../<worktree-dir>" && pwd)"
+# WT-4b — bounded CWD-holder cleanup (task 0720 R1). $WT_PATH above is the EXACT
+# absolute worktree path; a relative path or a stale entry matches the wrong processes.
 # Holders = processes with any open fd under the worktree tree (lsof +D walks the
 # tree; CWD holders are the common case but +D also catches open-file holders —
 # over-match errs toward removal success; a plain -t <dir> matches only the
@@ -976,6 +1002,8 @@ fallback, because `<name>` was explicit and unambiguous intent.
 - **`--mode implement`** is rejected when combined with `--worktree` on `dev-run` — that mode *is*
   the pipeline's implement stage (bug-742) and runs in whatever tree the driver set up; a second
   worktree would split one task's evidence across two trees.
+- **`dev-review` without `--triage`** is rejected when combined with `--worktree` — a read-only
+  review writes nothing worth isolating; review another worktree by passing a path inside it.
 - **No** create-with-name (`--worktree <name>` never creates; an unresolvable name is an error),
   no `--worktree-keep` variant, no auto-cleanup of stale worktrees or markers from prior runs.