@gobing-ai/spur 0.4.1 → 0.4.3

package/plugins/sp/lib/quality-gate.generated.d.mts

@@ -10,18 +10,6 @@ export declare const LOCKED_PATTERN: RegExp;
 export declare const FINDINGS_PATTERN: RegExp;
 export declare const COVERAGE_ROW_PATTERN: RegExp;
 export declare const RECEIPT_SCHEMA_VERSION: 'check-receipt/v1';
-export declare const GATE_LOCK_DIR_ENV: string;
-export declare const GATE_LOCK_POLL_MS_ENV: string;
-export declare const GATE_LOCK_OFF_ENV: string;
-export declare const GATE_LOCK_TOKEN_ENV: string;
-export declare const GATE_LOCK_POLL_MS_DEFAULT: number;
-export declare const GATE_LOCK_MKDIR_HOLD_MS_ENV: string;
-export declare interface GateLock {
-    release(): void;
-    queueWaitMs: number;
-    token: string;
-}
-export declare function acquireGateLock(env: QualityGateEnv, logLine?: (line: string) => void): GateLock;
 export declare interface QualityGateEnv {
     wbs: string;
     qualityGateCmd?: string;

package/plugins/sp/lib/quality-gate.generated.mjs

@@ -17,7 +17,7 @@ var __export = (target, all) => {
 var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
-// node_modules/.bun/@gobing-ai+ts-utils@0.5.21/node_modules/@gobing-ai/ts-utils/dist/errors.js
+// node_modules/.bun/@gobing-ai+ts-utils@0.5.24/node_modules/@gobing-ai/ts-utils/dist/errors.js
 var ErrorCode;
 var init_errors = __esm(() => {
   ErrorCode = {
@@ -28,7 +28,7 @@ var init_errors = __esm(() => {
   };
 });
 
-// node_modules/.bun/@gobing-ai+ts-utils@0.5.21/node_modules/@gobing-ai/ts-utils/dist/api-response.js
+// node_modules/.bun/@gobing-ai+ts-utils@0.5.24/node_modules/@gobing-ai/ts-utils/dist/api-response.js
 var API_ERROR_CODES, ERROR_CODE_TO_HTTP, CLIENT_SAFE_CODES;
 var init_api_response = __esm(() => {
   init_errors();
@@ -51,28 +51,18 @@ var init_api_response = __esm(() => {
   CLIENT_SAFE_CODES = new Set([ErrorCode.NotFound, ErrorCode.Validation, ErrorCode.Conflict]);
 });
 
-// node_modules/.bun/@gobing-ai+ts-utils@0.5.21/node_modules/@gobing-ai/ts-utils/dist/cursor.js
+// node_modules/.bun/@gobing-ai+ts-utils@0.5.24/node_modules/@gobing-ai/ts-utils/dist/cursor.js
 var init_cursor = () => {};
 
-// node_modules/.bun/@gobing-ai+ts-utils@0.5.21/node_modules/@gobing-ai/ts-utils/dist/env.js
-function getEnvVar(name, fallback) {
-  const raw = process.env[name];
-  return raw === undefined ? fallback : raw;
-}
+// node_modules/.bun/@gobing-ai+ts-utils@0.5.24/node_modules/@gobing-ai/ts-utils/dist/env.js
 function getEnvVars() {
   return process.env;
 }
-function setEnvVar(name, value) {
-  if (value === undefined)
-    delete process.env[name];
-  else
-    process.env[name] = value;
-}
 
-// node_modules/.bun/@gobing-ai+ts-utils@0.5.21/node_modules/@gobing-ai/ts-utils/dist/event-severity.js
+// node_modules/.bun/@gobing-ai+ts-utils@0.5.24/node_modules/@gobing-ai/ts-utils/dist/event-severity.js
 var init_event_severity = () => {};
 
-// node_modules/.bun/@gobing-ai+ts-utils@0.5.21/node_modules/@gobing-ai/ts-utils/dist/index.js
+// node_modules/.bun/@gobing-ai+ts-utils@0.5.24/node_modules/@gobing-ai/ts-utils/dist/index.js
 var init_dist = __esm(() => {
   init_api_response();
   init_cursor();
@@ -23896,7 +23886,7 @@ var init_dist2 = __esm(() => {
   $visitAsync = visit.visitAsync;
 });
 
-// node_modules/.bun/@gobing-ai+ts-db@0.5.21+3862528db3f84042/node_modules/@gobing-ai/ts-db/dist/schema/common.js
+// node_modules/.bun/@gobing-ai+ts-db@0.5.24+685def093374c416/node_modules/@gobing-ai/ts-db/dist/schema/common.js
 function nowTimestamp() {
   return Date.now();
 }
@@ -23925,7 +23915,7 @@ var init_common3 = __esm(() => {
   appendOnlyColumns = buildAppendOnlyColumns();
 });
 
-// node_modules/.bun/@gobing-ai+ts-db@0.5.21+3862528db3f84042/node_modules/@gobing-ai/ts-db/dist/schema/drizzle-internals.js
+// node_modules/.bun/@gobing-ai+ts-db@0.5.24+685def093374c416/node_modules/@gobing-ai/ts-db/dist/schema/drizzle-internals.js
 function sqlExpressionToText(value) {
   if (typeof value !== "object" || value === null || !("queryChunks" in value)) {
     return;
@@ -23948,7 +23938,7 @@ function getDrizzleTableName(table3) {
   return String(table3[nameSym]);
 }
 
-// node_modules/.bun/@gobing-ai+ts-db@0.5.21+3862528db3f84042/node_modules/@gobing-ai/ts-db/dist/schema/ddl.js
+// node_modules/.bun/@gobing-ai+ts-db@0.5.24+685def093374c416/node_modules/@gobing-ai/ts-db/dist/schema/ddl.js
 function quoteIdent(name) {
   return `"${name.replace(/"/g, '""')}"`;
 }
@@ -24320,7 +24310,7 @@ var init_drizzle_zod = __esm(() => {
   };
 });
 
-// node_modules/.bun/@gobing-ai+ts-db@0.5.21+3862528db3f84042/node_modules/@gobing-ai/ts-db/dist/schema/define-table.js
+// node_modules/.bun/@gobing-ai+ts-db@0.5.24+685def093374c416/node_modules/@gobing-ai/ts-db/dist/schema/define-table.js
 function defineTable(name, columns2) {
   const table3 = sqliteTable(name, columns2);
   let insert2;
@@ -24354,7 +24344,7 @@ var init_define_table = __esm(() => {
   init_ddl();
 });
 
-// node_modules/.bun/@gobing-ai+ts-db@0.5.21+3862528db3f84042/node_modules/@gobing-ai/ts-db/dist/schema/index.js
+// node_modules/.bun/@gobing-ai+ts-db@0.5.24+685def093374c416/node_modules/@gobing-ai/ts-db/dist/schema/index.js
 var init_schema = __esm(() => {
   init_sqlite_core();
   init_define_table();
@@ -24372,16 +24362,14 @@ import {
   mkdirSync,
   mkdtempSync,
   openSync,
-  readdirSync,
   readFileSync,
-  rmdirSync,
   rmSync,
   statSync,
   unlinkSync,
   writeFileSync
 } from "node:fs";
-import { homedir, tmpdir } from "node:os";
-import { dirname, join, resolve } from "node:path";
+import { tmpdir } from "node:os";
+import { join, resolve } from "node:path";
 
 // packages/app/src/workflow/composition-baseline.ts
 function canonicalJsonStringify(obj) {
@@ -24450,6 +24438,7 @@ function isRfc3339Timestamp(value) {
 var ALL_FINDING_CODES = [
   "L1.markdown-parse",
   "L1.schema-validation",
+  "L1.wbs-collision",
   "L2.missing-required-section",
   "L2.forbidden-section",
   "L2.disallowed-section",
@@ -24477,6 +24466,7 @@ var ALL_FINDING_CODES = [
   "L4.design-placeholder",
   "L4.feature-not-found",
   "L4.feature-terminal",
+  "L4.feature-deprecated",
   "L4.missing-feature-id",
   "L4.parent-not-found",
   "L4.dependency-not-found",
@@ -24926,8 +24916,8 @@ var POST_WATERMARK_TABLES = [
   "history_daily_stats",
   "history_board_source_daily"
 ];
-// node_modules/.bun/@gobing-ai+ts-llm-jsonl-importer@0.5.21+f66f1d7f0d37c145/node_modules/@gobing-ai/ts-llm-jsonl-importer/dist/schema-sql.js
-var HISTORY_IMPORT_SCHEMA_VERSION = "0.5.21";
+// node_modules/.bun/@gobing-ai+ts-llm-jsonl-importer@0.5.24+f66f1d7f0d37c145/node_modules/@gobing-ai/ts-llm-jsonl-importer/dist/schema-sql.js
+var HISTORY_IMPORT_SCHEMA_VERSION = "0.5.24";
 var HISTORY_IMPORT_SCHEMA_SQL = `
 CREATE TABLE IF NOT EXISTS history_import_checkpoint (
     source TEXT NOT NULL,
@@ -25054,13 +25044,13 @@ CREATE INDEX IF NOT EXISTS idx_history_skill_call_invocation_kind
     ON history_skill_call(invocation_kind);
 `.trim();
 
-// node_modules/.bun/@gobing-ai+ts-llm-jsonl-importer@0.5.21+f66f1d7f0d37c145/node_modules/@gobing-ai/ts-llm-jsonl-importer/dist/sources.js
+// node_modules/.bun/@gobing-ai+ts-llm-jsonl-importer@0.5.24+f66f1d7f0d37c145/node_modules/@gobing-ai/ts-llm-jsonl-importer/dist/sources.js
 init_zod();
 
-// node_modules/.bun/@gobing-ai+ts-llm-jsonl-importer@0.5.21+f66f1d7f0d37c145/node_modules/@gobing-ai/ts-llm-jsonl-importer/dist/mappers.js
+// node_modules/.bun/@gobing-ai+ts-llm-jsonl-importer@0.5.24+f66f1d7f0d37c145/node_modules/@gobing-ai/ts-llm-jsonl-importer/dist/mappers.js
 init_zod();
 
-// node_modules/.bun/@gobing-ai+ts-llm-jsonl-importer@0.5.21+f66f1d7f0d37c145/node_modules/@gobing-ai/ts-llm-jsonl-importer/dist/hash.js
+// node_modules/.bun/@gobing-ai+ts-llm-jsonl-importer@0.5.24+f66f1d7f0d37c145/node_modules/@gobing-ai/ts-llm-jsonl-importer/dist/hash.js
 import { createHash } from "node:crypto";
 function stableJson(value) {
   if (Array.isArray(value)) {
@@ -25079,7 +25069,7 @@ function sha256Text(text) {
   return createHash("sha256").update(text, "utf8").digest("hex");
 }
 
-// node_modules/.bun/@gobing-ai+ts-llm-jsonl-importer@0.5.21+f66f1d7f0d37c145/node_modules/@gobing-ai/ts-llm-jsonl-importer/dist/capability.js
+// node_modules/.bun/@gobing-ai+ts-llm-jsonl-importer@0.5.24+f66f1d7f0d37c145/node_modules/@gobing-ai/ts-llm-jsonl-importer/dist/capability.js
 function matchCapabilityOrigin(origins, source, canonicalName, observable) {
   let candidates = origins.filter((origin2) => origin2.source === source && origin2.skillName === canonicalName);
   if (candidates.length === 0)
@@ -25344,7 +25334,7 @@ function extractNestedExecCommandLiterals(payloadText) {
   return literals;
 }
 
-// node_modules/.bun/@gobing-ai+ts-llm-jsonl-importer@0.5.21+f66f1d7f0d37c145/node_modules/@gobing-ai/ts-llm-jsonl-importer/dist/redaction.js
+// node_modules/.bun/@gobing-ai+ts-llm-jsonl-importer@0.5.24+f66f1d7f0d37c145/node_modules/@gobing-ai/ts-llm-jsonl-importer/dist/redaction.js
 var DEFAULT_REDACTION_RULES = [
   {
     name: "api-key",
@@ -25386,7 +25376,7 @@ function applyRules(value, rules = DEFAULT_REDACTION_RULES) {
   return rules.reduce((current, rule) => current.replace(rule.pattern, rule.replacement), value);
 }
 
-// node_modules/.bun/@gobing-ai+ts-llm-jsonl-importer@0.5.21+f66f1d7f0d37c145/node_modules/@gobing-ai/ts-llm-jsonl-importer/dist/mappers.js
+// node_modules/.bun/@gobing-ai+ts-llm-jsonl-importer@0.5.24+f66f1d7f0d37c145/node_modules/@gobing-ai/ts-llm-jsonl-importer/dist/mappers.js
 var MESSAGE_MAPPER_KEYS = [
   "_codexUsageCarrier",
   "session_id",
@@ -27492,7 +27482,7 @@ var GROK_SCHEMA = passthroughSchema;
 var GEMINI_SCHEMA = passthroughSchema;
 var DSH_SCHEMA = passthroughSchema;
 
-// node_modules/.bun/@gobing-ai+ts-llm-jsonl-importer@0.5.21+f66f1d7f0d37c145/node_modules/@gobing-ai/ts-llm-jsonl-importer/dist/sources.js
+// node_modules/.bun/@gobing-ai+ts-llm-jsonl-importer@0.5.24+f66f1d7f0d37c145/node_modules/@gobing-ai/ts-llm-jsonl-importer/dist/sources.js
 var sourceRecordSchema = exports_external.object({
   source_record_id: exports_external.string().min(1),
   created_at: exports_external.string().min(1),
@@ -27596,10 +27586,10 @@ var SOURCE_DEFINITIONS = {
   openclaw: sourceDefinition("openclaw", "OpenClaw", [".openclaw"], ["*.jsonl"])
 };
 
-// node_modules/.bun/@gobing-ai+ts-llm-jsonl-importer@0.5.21+f66f1d7f0d37c145/node_modules/@gobing-ai/ts-llm-jsonl-importer/dist/jsonl-importer-dao.js
+// node_modules/.bun/@gobing-ai+ts-llm-jsonl-importer@0.5.24+f66f1d7f0d37c145/node_modules/@gobing-ai/ts-llm-jsonl-importer/dist/jsonl-importer-dao.js
 var TYPED_HISTORY_TABLES = ["history_message", "history_tool_call", "history_skill_call"];
 var TYPED_IGNORED_KEYS = new Set(["_meta", "split_index", "source_record_id", "_capabilityConflict"]);
-// node_modules/.bun/@gobing-ai+ts-llm-jsonl-importer@0.5.21+f66f1d7f0d37c145/node_modules/@gobing-ai/ts-llm-jsonl-importer/dist/tables.js
+// node_modules/.bun/@gobing-ai+ts-llm-jsonl-importer@0.5.24+f66f1d7f0d37c145/node_modules/@gobing-ai/ts-llm-jsonl-importer/dist/tables.js
 var BOOKKEEPING_HISTORY_TABLES = ["history_import_checkpoint", "history_import_ledger"];
 var IMPORTER_OWNED_TABLES = [
   ...TYPED_HISTORY_TABLES,
@@ -27676,6 +27666,9 @@ var artifactsTable = defineTable("artifacts", {
   ...standardColumns
 });
 var artifacts = artifactsTable.table;
+// packages/domain/src/dao/database-inspector.ts
+var encoder = new TextEncoder;
+var decoder = new TextDecoder;
 // packages/domain/src/schema/phase-runs.ts
 init_schema();
 var phaseRunsTable = defineTable("phase_runs", {
@@ -27713,7 +27706,7 @@ var workflowStatesTable = defineTable("workflow_states", {
   ...standardColumns
 });
 var workflowStates = workflowStatesTable.table;
-// node_modules/.bun/@gobing-ai+ts-dual-workflow-engine@0.5.21+df32fe902834add3/node_modules/@gobing-ai/ts-dual-workflow-engine/dist/schema-sql.js
+// node_modules/.bun/@gobing-ai+ts-dual-workflow-engine@0.5.24+df32fe902834add3/node_modules/@gobing-ai/ts-dual-workflow-engine/dist/schema-sql.js
 var WORKFLOW_ENGINE_SCHEMA_SQL = `
 CREATE TABLE IF NOT EXISTS runs (
     id TEXT PRIMARY KEY,
@@ -27812,7 +27805,7 @@ ALTER TABLE runs ADD COLUMN owner_pid INTEGER;
 ALTER TABLE runs ADD COLUMN interrupt_reason TEXT;
 ALTER TABLE runs ADD COLUMN terminal_reason TEXT;
 `.trim();
-// node_modules/.bun/@gobing-ai+ts-rule-engine@0.5.21+df32fe902834add3/node_modules/@gobing-ai/ts-rule-engine/dist/persistence/schema.js
+// node_modules/.bun/@gobing-ai+ts-rule-engine@0.5.24+df32fe902834add3/node_modules/@gobing-ai/ts-rule-engine/dist/persistence/schema.js
 var RULE_ENGINE_SCHEMA_SQL = `
 CREATE TABLE IF NOT EXISTS rule_runs (
     id TEXT PRIMARY KEY,
@@ -27922,6 +27915,9 @@ var INBOX_MESSAGES_REQUEST_KEY_SCHEMA_SQL = `
 ALTER TABLE inbox_messages ADD COLUMN request_key TEXT;
 CREATE UNIQUE INDEX IF NOT EXISTS idx_inbox_messages_request_key ON inbox_messages (request_key) WHERE request_key IS NOT NULL;
 `;
+var INBOX_MESSAGES_READ_AT_SCHEMA_SQL = `
+ALTER TABLE inbox_messages ADD COLUMN read_at INTEGER;
+`;
 var QUEUE_JOBS_SCHEMA_SQL = `
 CREATE TABLE IF NOT EXISTS queue_jobs (
     id TEXT PRIMARY KEY,
@@ -28934,6 +28930,11 @@ var CLI_MIGRATIONS = [
   {
     id: "0052_spur_cli_decision_logs",
     sql: DECISION_LOGS_SCHEMA_SQL
+  },
+  {
+    id: "0053_spur_cli_inbox_messages_read_at",
+    sql: INBOX_MESSAGES_READ_AT_SCHEMA_SQL,
+    addColumnIfMissing: { table: "inbox_messages", column: "read_at" }
   }
 ];
 // packages/domain/src/envelope/schema.ts
@@ -29889,7 +29890,15 @@ function escapeYamlValue(value) {
 // packages/domain/src/planning/schema.ts
 init_zod();
 var TASK_STATUSES = ["backlog", "todo", "wip", "testing", "blocked", "done", "cancelled"];
-var FEATURE_STATUSES = ["backlog", "active", "verifying", "blocked", "done", "cancelled"];
+var FEATURE_STATUSES = [
+  "backlog",
+  "active",
+  "verifying",
+  "blocked",
+  "done",
+  "cancelled",
+  "deprecated"
+];
 var PRIORITIES = ["P0", "P1", "P2", "P3"];
 var PROFILES = [
   "simple",
@@ -30436,159 +30445,6 @@ function runShellCommand(cmd, cwd, extraEnv) {
     rmSync(dir, { recursive: true, force: true });
   }
 }
-var GATE_LOCK_DIR_ENV = "SPUR_GATE_LOCK_DIR";
-var GATE_LOCK_POLL_MS_ENV = "SPUR_GATE_LOCK_POLL_MS";
-var GATE_LOCK_OFF_ENV = "SPUR_GATE_LOCK";
-var GATE_LOCK_TOKEN_ENV = "SPUR_GATE_LOCK_TOKEN";
-var GATE_LOCK_POLL_MS_DEFAULT = 5000;
-var GATE_LOCK_MKDIR_HOLD_MS_ENV = "SPUR_GATE_LOCK_TEST_MKDIR_HOLD_MS";
-var GATE_LOCK_LOST_RACE_SLEEP_MS = 20;
-var GATE_LOCK_LOST_RACE_LOG_AT = 250;
-function gateLockDir() {
-  const raw = getEnvVar(GATE_LOCK_DIR_ENV);
-  return raw !== undefined && raw.length > 0 ? raw : join(homedir(), ".config", "spur", "run", "full-gate.lock");
-}
-function gateLockPollMs() {
-  const raw = Number.parseInt(getEnvVar(GATE_LOCK_POLL_MS_ENV) ?? "", 10);
-  return Number.isFinite(raw) && raw > 0 ? raw : GATE_LOCK_POLL_MS_DEFAULT;
-}
-function isProcessAlive(pid) {
-  try {
-    process.kill(pid, 0);
-    return true;
-  } catch (error51) {
-    return error51.code !== "ESRCH";
-  }
-}
-function readGateLockClaim(dir) {
-  let markers;
-  try {
-    markers = readdirSync(dir).sort();
-  } catch {
-    return null;
-  }
-  for (const marker of markers) {
-    try {
-      const claim = JSON.parse(readFileSync(join(dir, marker), "utf8"));
-      if (typeof claim.pid === "number")
-        return { claim, marker };
-    } catch {
-      const pid = Number.parseInt(/^(\d+)-/.exec(marker)?.[1] ?? "", 10);
-      if (pid > 0) {
-        return { claim: { pid, startedAt: Date.now(), wbs: "?", runId: "?", cwd: "?" }, marker };
-      }
-    }
-  }
-  return null;
-}
-function acquireGateLock(env2, logLine = () => {}) {
-  if ((getEnvVar(GATE_LOCK_OFF_ENV) ?? "") === "off") {
-    return { release() {}, queueWaitMs: 0, token: "" };
-  }
-  const dir = gateLockDir();
-  mkdirSync(dirname(dir), { recursive: true });
-  const pollMs = gateLockPollMs();
-  const claim = {
-    pid: process.pid,
-    startedAt: Date.now(),
-    wbs: env2.wbs,
-    runId: receiptRunId(env2),
-    cwd: process.cwd()
-  };
-  const marker = `${process.pid}-${randomUUID()}`;
-  const startedWaitingAt = Date.now();
-  let holderLogged = false;
-  let graceLogged = false;
-  let lostRaces = 0;
-  let lostRaceLogged = false;
-  const mkdirHoldMs = Number.parseInt(getEnvVar(GATE_LOCK_MKDIR_HOLD_MS_ENV) ?? "", 10);
-  for (;; ) {
-    let dirIno = null;
-    try {
-      mkdirSync(dir);
-      dirIno = statSync(dir).ino;
-      if (Number.isFinite(mkdirHoldMs) && mkdirHoldMs > 0)
-        gateSleep(mkdirHoldMs);
-      writeFileSync(join(dir, marker), JSON.stringify(claim), { flag: "wx" });
-    } catch (error51) {
-      const code = error51.code;
-      if (code === "ENOENT" || code === "EINVAL") {
-        lostRaces += 1;
-        if (lostRaces === GATE_LOCK_LOST_RACE_LOG_AT && !lostRaceLogged) {
-          lostRaceLogged = true;
-          logLine(`quality gate lock: still losing the claim race after ${lostRaces} attempts (dir ${dir})
-`);
-        }
-        gateSleep(GATE_LOCK_LOST_RACE_SLEEP_MS);
-        continue;
-      }
-      if (code !== "EEXIST") {
-        throw error51;
-      }
-    }
-    if (dirIno !== null) {
-      let currentIno = null;
-      let entries = [];
-      try {
-        currentIno = statSync(dir).ino;
-        entries = readdirSync(dir);
-      } catch {}
-      if (currentIno !== dirIno || entries.length !== 1 || entries[0] !== marker) {
-        try {
-          unlinkSync(join(dir, marker));
-        } catch {}
-        lostRaces += 1;
-        gateSleep(GATE_LOCK_LOST_RACE_SLEEP_MS);
-        continue;
-      }
-      return {
-        release() {
-          try {
-            rmSync(join(dir, marker), { force: true });
-            rmdirSync(dir);
-          } catch {}
-        },
-        queueWaitMs: Date.now() - startedWaitingAt,
-        token: marker
-      };
-    }
-    const held = readGateLockClaim(dir);
-    if (held !== null && isProcessAlive(held.claim.pid)) {
-      if (getEnvVar(GATE_LOCK_TOKEN_ENV) === held.marker) {
-        return { release() {}, queueWaitMs: Date.now() - startedWaitingAt, token: held.marker };
-      }
-      if (!holderLogged) {
-        holderLogged = true;
-        logLine(`quality gate lock: waiting for holder (wbs ${held.claim.wbs}, run ${held.claim.runId}, pid ${held.claim.pid}, cwd ${held.claim.cwd}, held ${Date.now() - held.claim.startedAt}ms)
-`);
-      }
-    } else if (held !== null) {
-      logLine(`quality gate lock: reclaimed stale claim (pid ${held.claim.pid})
-`);
-      try {
-        unlinkSync(join(dir, held.marker));
-        rmdirSync(dir);
-      } catch {}
-    } else {
-      try {
-        rmdirSync(dir);
-        graceLogged = false;
-      } catch {
-        gateSleep(pollMs);
-        try {
-          rmdirSync(dir);
-          graceLogged = false;
-        } catch {
-          if (!graceLogged) {
-            graceLogged = true;
-            logLine(`quality gate lock: dir has no readable claim and is not empty — waiting
-`);
-          }
-        }
-      }
-    }
-  }
-}
 function recomputeGateProofFingerprint(cwd, env2) {
   const taskSpecPath = env2.taskSpecPath ?? env2.taskFile;
   if (!taskSpecPath || taskSpecPath.trim() === "") {
@@ -30712,44 +30568,27 @@ function runQualityGate(mode, env2, options = {}) {
     appendFileSync(abs(logFile), probe.output);
     rmSync(abs(`${logFile}.probe`), { force: true });
   }
-  let queueWaitMs = 0;
   let gateRuntimeMs = 0;
   if (gateRc === 0) {
     const delayMs = retryDelayMs(env2);
-    const lockLine = (line) => {
+    const gateRuntimeStartMs = Date.now();
+    for (gateAttempt = 1;gateAttempt <= MAX_GATE_ATTEMPTS; gateAttempt++) {
+      const attemptLogPath = `${logFile}.attempt-${gateAttempt}`;
+      const attempt = runShellCommand(env2.qualityGateCmd ?? "", cwd);
+      writeFileSync(abs(attemptLogPath), attempt.output);
+      const locked = isTransientLock(attempt.output);
+      appendFileSync(abs(logFile), attempt.output);
+      rmSync(abs(attemptLogPath), { force: true });
+      gateRc = attempt.code;
+      if (gateRc === 0 || !locked || gateAttempt >= MAX_GATE_ATTEMPTS)
+        break;
+      const line = retryMessage(gateAttempt);
       process.stdout.write(line);
       appendFileSync(abs(logFile), line);
-    };
-    const lock = acquireGateLock(env2, lockLine);
-    queueWaitMs = lock.queueWaitMs;
-    lockLine(`quality gate lock: queueWaitMs=${queueWaitMs}
-`);
-    const gateRuntimeStartMs = Date.now();
-    const previousToken = getEnvVar(GATE_LOCK_TOKEN_ENV);
-    if (lock.token.length > 0)
-      setEnvVar(GATE_LOCK_TOKEN_ENV, lock.token);
-    try {
-      for (gateAttempt = 1;gateAttempt <= MAX_GATE_ATTEMPTS; gateAttempt++) {
-        const attemptLogPath = `${logFile}.attempt-${gateAttempt}`;
-        const attempt = runShellCommand(env2.qualityGateCmd ?? "", cwd, lock.token.length > 0 ? { [GATE_LOCK_TOKEN_ENV]: lock.token } : undefined);
-        writeFileSync(abs(attemptLogPath), attempt.output);
-        const locked = isTransientLock(attempt.output);
-        appendFileSync(abs(logFile), attempt.output);
-        rmSync(abs(attemptLogPath), { force: true });
-        gateRc = attempt.code;
-        if (gateRc === 0 || !locked || gateAttempt >= MAX_GATE_ATTEMPTS)
-          break;
-        const line = retryMessage(gateAttempt);
-        process.stdout.write(line);
-        appendFileSync(abs(logFile), line);
-        gateSleep(delayMs);
-      }
-    } finally {
-      setEnvVar(GATE_LOCK_TOKEN_ENV, previousToken);
-      lock.release();
+      gateSleep(delayMs);
     }
     gateRuntimeMs = Date.now() - gateRuntimeStartMs;
-    appendFileSync(abs(logFile), `quality gate lock: queueWaitMs=${queueWaitMs} gateRuntimeMs=${gateRuntimeMs}
+    appendFileSync(abs(logFile), `gate runtime: ${gateRuntimeMs}ms
 `);
   }
   if (gateRc !== 0) {
@@ -30802,7 +30641,6 @@ function runQualityGate(mode, env2, options = {}) {
           }
         ],
         completedAt: new Date().toISOString(),
-        queueWaitMs,
         gateRuntimeMs
       });
       writeFileSync(abs(receiptFile), `${JSON.stringify(receipt, null, 2)}
@@ -30834,19 +30672,12 @@ export {
   isTransientLock,
   extractFindings,
   buildReceipt,
-  acquireGateLock,
   RETRY_DELAY_MS_ENV,
   RETRY_DELAY_MS_DEFAULT,
   RECEIPT_SCHEMA_VERSION,
   MAX_GATE_ATTEMPTS,
   MAX_FINDINGS,
   LOCKED_PATTERN,
-  GATE_LOCK_TOKEN_ENV,
-  GATE_LOCK_POLL_MS_ENV,
-  GATE_LOCK_POLL_MS_DEFAULT,
-  GATE_LOCK_OFF_ENV,
-  GATE_LOCK_MKDIR_HOLD_MS_ENV,
-  GATE_LOCK_DIR_ENV,
   FINDINGS_PATTERN,
   COVERAGE_ROW_PATTERN
 };

package/plugins/sp/lib/residual-scan.generated.d.mts

@@ -2,7 +2,12 @@
  * GENERATED by scripts/commands/bundle-plugin-lib.ts — do not edit.
  * Source of truth: packages/app/src/services/residual-scan.ts (task 1003 R5).
  */
-export declare type ResidualCategory = 'review-finding' | 'diff-marker' | 'unchecked-box' | 'staging-residue';
+export declare type ResidualCategory =
+    | 'review-finding'
+    | 'diff-marker'
+    | 'unchecked-box'
+    | 'staging-residue'
+    | 'review-contract';
 export declare type ResidualClass = 'blocking' | 'deferrable' | 'advisory' | 'housekeeping';
 export declare interface ResidualItem {
     id: string;
@@ -62,6 +67,7 @@ export declare function classify(
 export declare function scanResiduals(inputs: ResidualScanInputs): ResidualArtifact;
 export declare function parseDeferralEntries(raw: unknown): Deferral[];
 export declare function blockingReviewFindings(taskContent: string, deferrals: Deferral[]): ResidualItem[];
+export declare function reviewContractViolations(taskContent: string): Array<{ location: string; text: string }>;
 export declare function buildReviewGateArtifact(
     wbs: string,
     taskContent: string,

package/plugins/sp/lib/residual-scan.generated.mjs

@@ -1,6 +1,36 @@
 // packages/app/src/services/residual-scan.ts
 import { join } from "node:path";
 import { createHash } from "node:crypto";
+
+// packages/app/src/services/verify-answer-lint.ts
+var CLAIM_MARKERS = [
+  /@[a-z0-9._-]+\/[a-z0-9._-]+/i,
+  /\bnode_modules\//,
+  /\b\d+\.\d+\.\d+\b/,
+  /`[A-Za-z_$][\w.$]*\s*\([^`]*\)`/
+];
+var CITATION_FORMS = [
+  /`[^`\s]+:\d+(?:-\d+)?`/,
+  /`[^`]+`\s+lines?\s+\d+/i,
+  /\b[\w./-]+\.[A-Za-z0-9]+:\d+(?:-\d+)?\b/,
+  /https?:\/\/\S+/i
+];
+function hasClaimMarker(evidence) {
+  return CLAIM_MARKERS.some((re) => re.test(evidence));
+}
+function hasCitationForm(evidence) {
+  return CITATION_FORMS.some((re) => re.test(evidence));
+}
+var CONFIDENCE_LEVELS = ["HIGH", "MEDIUM", "LOW"];
+function extractAnswerConfidence(text) {
+  const matches = [...text.matchAll(/^\s*Confidence:\s*(\S+)\s*$/gim)];
+  if (matches.length !== 1)
+    return;
+  const value = (matches[0]?.[1] ?? "").toUpperCase();
+  return CONFIDENCE_LEVELS.includes(value) ? value : undefined;
+}
+
+// packages/app/src/services/residual-scan.ts
 var MARKER_PATTERN = /TODO|FIXME|XXX|HACK/;
 var PRIORITY_PATTERN = /^P[1-4]/;
 var RANGE_PRIORITY = /^P[1-4]\s*[\u2013\u2014-]\s*P?[1-4]/;
@@ -27,11 +57,15 @@ function locationOf(locationCell, finding) {
   const backtick = finding.match(/`([^`]+)`/)?.[1];
   return backtick === undefined ? "" : normalizeAnchor(backtick);
 }
-function parseReviewFindings(taskContent) {
+function reviewBody(taskContent) {
   const section = taskContent.split(/^### Review\b/m)[1];
-  if (section === undefined)
+  return section === undefined ? null : section.split(/^### /m)[0] ?? "";
+}
+function parseReviewFindings(taskContent) {
+  const section = reviewBody(taskContent);
+  if (section === null)
     return [];
-  const body = section.split(/^### /m)[0] ?? "";
+  const body = section;
   const out = [];
   const lines = body.split(`
 `);
@@ -144,7 +178,8 @@ function scanResiduals(inputs) {
       "review-finding": true,
       "diff-marker": base !== null,
       "unchecked-box": true,
-      "staging-residue": true
+      "staging-residue": true,
+      "review-contract": false
     },
     items,
     counts
@@ -165,8 +200,36 @@ function blockingReviewFindings(taskContent, deferrals) {
   }));
   return classify(items, [...tableDeferrals, ...deferrals]);
 }
+function reviewContractViolations(taskContent) {
+  const violations = [];
+  const body = reviewBody(taskContent);
+  if (body !== null && extractAnswerConfidence(body.replace(/\*\*/g, "")) === undefined) {
+    violations.push({
+      location: "task-file:Review",
+      text: "Review report carries no single valid `**Confidence:** HIGH | MEDIUM | LOW` line — " + "state the level the report can defend (HIGH: every requirement row MET, every finding " + "dispositioned, evidence cited; MEDIUM/LOW: name the gap)."
+    });
+  }
+  for (const row of parseReviewFindings(taskContent)) {
+    if (hasClaimMarker(row.text) && !hasCitationForm(row.text)) {
+      violations.push({
+        location: row.location.length > 0 ? row.location : "task-file:Review",
+        text: `${row.priority} finding asserts an external API/library/version claim without a ` + "same-cell citation (add a repo `path:line`, an external named-origin form, or a URL " + `to the Finding cell): ${row.text.slice(0, 80)}`
+      });
+    }
+  }
+  return violations;
+}
 function buildReviewGateArtifact(wbs, taskContent, deferrals) {
-  const items = blockingReviewFindings(taskContent, deferrals);
+  const items = [
+    ...blockingReviewFindings(taskContent, deferrals),
+    ...reviewContractViolations(taskContent).map((v) => ({
+      id: makeItemId("review-contract", v.location, v.text),
+      category: "review-contract",
+      class: "blocking",
+      location: v.location,
+      text: v.text
+    }))
+  ];
   const blocking = items.filter((i) => i.class === "blocking");
   const counts = { blocking: 0, deferrable: 0, advisory: 0, housekeeping: 0 };
   for (const item of items)
@@ -178,7 +241,8 @@ function buildReviewGateArtifact(wbs, taskContent, deferrals) {
       "review-finding": true,
       "diff-marker": false,
       "unchecked-box": false,
-      "staging-residue": false
+      "staging-residue": false,
+      "review-contract": true
     },
     items,
     counts
@@ -313,6 +377,7 @@ function parseScanArgs(argv, cwd, defaultTmpDir) {
 export {
   verdictDisagreementNote,
   scanResiduals,
+  reviewContractViolations,
   renderReport,
   recordedVerdictPath,
   parseScanArgs,