@gobing-ai/spur 0.4.11 → 0.4.13

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.4.11",
+            "version": "0.4.13",
             "source": "./plugins/sp"
         }
     ]

package/config/config.example.yaml

@@ -230,6 +230,28 @@ redaction:
 #     releaseCommitType: chore
 #     releaseCommitScope: release
 #     ghRunListLimit: 5
+#   # Stack preset for the SDLC action vocabulary (ADR-139): the commands Spur's gates run.
+#   #   bun  (default) — every reserved action resolves to the legacy bun scripts below, so a
+#   #                    bun project needs no binding at all.
+#   #   none           — only the stack-neutral `spur rule run` presets are bound; declare the
+#   #                    rest in `actions` (see below) or they stay unbound.
+#   preset: bun
+#   # action name -> one shell command, or a list of action names (composite, run in order,
+#   # fail-fast). A declared entry replaces the preset binding whole. Reserved names: build, dev,
+#   # clean, format, autofix, lint, typecheck, test, test-full, test-heavy, rules-pre, rules-post,
+#   # check, check-full, check-feature, lint-changed, typecheck-changed, test-changed. Any other
+#   # name is a custom action (exec-only). {files}/{paths}/{workspace} are allowed only in the
+#   # three *-changed actions; each substituted item is shell-quoted.
+#   actions:
+#     build: make build
+#     lint: ruff check .
+#     typecheck: mypy src
+#     test: pytest -q
+#     test-full: pytest --cov
+#     lint-changed: ruff check {files}
+#     test-changed: cd {workspace} && pytest {paths}
+#     check: [lint, test, rules-post]
+#     release: ./scripts/release.sh
 
 # ── Planning (design §2.1 / §9) ──
 tasks:

package/config/rules/boundary/config-loading-ownership.yaml

@@ -67,7 +67,7 @@ rules:
     exclude:
       - "packages/config/src/**"
       - "apps/cli/src/index.ts"
-      - "apps/cli/src/workflow-transport.ts" # boot-free composition root of `spur workflow inline|commit-guard` (PR-4)
+      - "apps/cli/src/workflow-transport.ts" # boot-free composition root of `spur workflow commit-guard|persist-*` (PR-4)
       - "apps/server/src/serve.ts"
       - "apps/server/src/context.ts"
       - "**/tests/**"

package/config/rules/quality/coverage-gate.yaml

@@ -1,8 +1,8 @@
 $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 # Coverage gate — per-file line coverage meets threshold from Bun's lcov output.
 #
-# PROVENANCE (task 1203): since task 1203 the repository post-check scripts
-# (`test-post-check`, `test-post-check:full`) validate canonical coverage
+# PROVENANCE (task 1203): since task 1203 the repository post-check script
+# (`test-post-check`) validates canonical coverage
 # certification BEFORE this rule evaluates: only a completed successful canonical
 # full-suite run (`bun run test`, `test:coverage`, `test:full`) certifies
 # .coverage/lcov.info (marker: .coverage/coverage-certification.json, written by

package/config/rules/strict/runtime-boundaries.yaml

@@ -101,8 +101,8 @@ rules:
             - "packages/app/src/services/history-anatomy.ts" # deterministic history-anatomy cache core (task 1005 R2): fsync'd tmp+rename atomic publish, readdir digest scans and sync report reads must stay byte-stable; bundled standalone for the bare-node plugin twin (mirrors agent-usage-producer.ts / history-service.ts exemptions)
             - "packages/app/src/observability/workflow-run-log-sink.ts" # sync FD append for mid-run tail-able all-in-one run log (task 0426 / feature D2); append() is sync from the observability bus
             - "packages/app/src/observability/agent-run-log.ts" # same primitive as the sink above for the per-run agent stream (task 1076 R1, ADR-132); append() is sync from the agent service's own onOutput hook, and the byte cap needs the FD position it tracks
-            # Inline-driver transports (script-absorption PR-4, `spur workflow inline|commit-guard`): moved
-            # verbatim from the plugin scripts with their golden output pinned; synchronous probes and
+            # Workflow transports (script-absorption PR-4, `spur workflow commit-guard`): moved
+            # verbatim from the plugin scripts; synchronous probes and
             # atomic tmp+rename snapshot writes inside one short-lived CLI process.
             - "packages/app/src/workflow/commit-guard.ts" # .spur/run/<run>-tree-start.json atomic snapshot + target conflict-marker reads
             - "packages/app/src/workflow/persist-check.ts" # recursive evidence-tree listing + byte comparison of both trees

package/config/rules/surface/check-cli-surface.yaml

@@ -65,6 +65,10 @@ rules:
       # commit-guard declares no --json: its {staged, foreign} / {foreign} lines are rendered by
       # @gobing-ai/spur-app/commit-guard (byte-identical to the retired script, PR-4 golden).
       - "apps/cli/src/commands/workflow/commit-guard.ts"
+      # WT-4 worktree-landing transports (D65 1242, flat since the inline group was deleted): they
+      # print the app operation's already-serialized payload (runPersistOut/persist-check), and
+      # declare no --json of their own.
+      - "apps/cli/src/commands/workflow/persist.ts"
       # Pipeline-internal task verbs (script-absorption PR-3) declare no --json: their contract is
       # the .spur/run artifact they write (gate status/receipt, residuals.json, diffstat.json) and
       # the exit code; the gate's own status line is serialized by the app service.

package/config/rules/typescript/output-boundaries.yaml

@@ -17,11 +17,6 @@ rules:
       type: rg
       config:
         pattern: "console\\.(log|error|warn|info|debug|dir|time|trace)"
-    # Task 1006 R3: the inline-run driver's fail-closed stderr lines moved here from the
-    # plugin script (byte-stable driver contract, emitted through the bundled lib under
-    # bare node); the output seam is a CLI-layer dependency the app service cannot take.
-    exclude:
-      - "packages/app/src/services/inline-run-setup.ts"
 
   - id: no-raw-stdout-stderr
     description: "Use the output seam (ts-utils echo/echoError) instead of process.stdout/stderr.write directly."
@@ -30,10 +25,9 @@ rules:
       type: rg
       config:
         pattern: "process\\.(stdout|stderr)\\.write"
-    # Tasks 1006 R1/R3: gate receipts (`check-receipt/v1`, one JSON line — the runner's parsed
-    # stdout contract) and the inline driver's stdout lines moved here from the plugin scripts.
-    # Both must stay byte-stable through the bundled libs under bare node; the seam would
-    # rewrite framing the CLI/tests parse. Mirrors the history-anatomy bundling exemptions.
+    # Task 1006 R1: gate receipts (`check-receipt/v1`, one JSON line — the runner's parsed
+    # stdout contract) moved here from the plugin script. It must stay byte-stable through the
+    # bundled lib under bare node; the seam would rewrite framing the CLI/tests parse. Mirrors
+    # the history-anatomy bundling exemptions.
     exclude:
       - "packages/app/src/services/quality-gate.ts"
-      - "packages/app/src/services/inline-run-setup.ts"

package/config/workflows/feature-verification.yaml

@@ -39,7 +39,7 @@
 "$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
 kind: state-machine
 name: feature-verification
-version: "1"
+version: "2"
 description: "Feature-scoped verification pass (ADR-119): runs the repo-wide check set once per feature and records a bound PASS/FAIL evidence receipt. Invoked by feature-lifecycle's verifying entry."
 iterationBound: 2
 initialState: verify
@@ -51,7 +51,7 @@ failureStates:
 vars:
   featureId: "X"
   spurBin: "spur"
-  verificationCmd: "bun run spur-check-feature"
+  verificationCmd: "spur self exec check-feature"
   __runId: ""
 
 states:
@@ -62,10 +62,19 @@ states:
       digest, run identity) and the coarse status file, always exit 0 so the
       transition guard routes missing/corrupt/FAIL to `failed`.
     onEnter:
-      - kind: shell
+      # D65 1238 R1: the pass runs as a typed gate builtin (1234), not a shell action — the same
+      # `spur feature verify` argv, whose configured `spur self exec check-feature` action is the
+      # verification command. `softFail` keeps a non-running pass a RECORDED outcome that the guards
+      # below route to `failed`, exactly as the always-exit-0 shell did. The pass still writes its
+      # own `.spur/run/<runId>-feature-verification.status` and evidence receipt; the gate's typed
+      # token lands beside them, so the pass's PASS/FAIL evidence is never overwritten.
+      - kind: command.gate
         options:
-          command: >-
-            mkdir -p .spur/run; $spurBin feature verify "$featureId" --run-id "$__runId" --no-logo || printf 'FAIL feature-verification failed closed — spur feature verify exited nonzero\n' > ".spur/run/$__runId-feature-verification.status"; exit 0
+          id: feature-verification
+          executable: "${vars.spurBin}"
+          args: ["feature", "verify", "${vars.featureId}", "--run-id", "${vars.__runId}", "--no-logo"]
+          resultFile: .spur/run/${vars.__runId}-feature-verification.gate.status
+          softFail: true
 
   - id: done
     description: Terminal — repo-wide checks passed and the receipt is bound.

package/config/workflows/idea-pipeline.yaml

@@ -76,6 +76,15 @@ vars:
   agent: "auto"
   planningAgent: ""
   stepTimeoutMs: "1800000"
+  # Executor for every agent.run stage (D65 R1): "host" pauses the run with a work item
+  # (`spur workflow run|continue --json`), "fleet" dispatches through ADR-126, and empty
+  # resolves the subprocess surface through the existing tier ladder.
+  executor: ""
+  # Accepted/deferred status each operator gate's decision binding writes (1236 R2).
+  ideaEvalStatus: ""
+  featureCheckStatus: ""
+  designApprovalStatus: ""
+  batchCreateStatus: ""
 
 states:
   - id: start
@@ -138,6 +147,11 @@ states:
           # explicitly so the definition is self-documenting.
           session: fresh
           expectFile: .spur/run/${vars.__runId}-idea-eval-report.md
+          # The signal is this stage's own output; the plural form declares it to the
+          # work item (host/fleet) while the singular expectFile stays the subprocess
+          # post-exit guard, so a missing signal still falls back to the catalog decision.
+          expectFiles:
+            - .spur/run/${vars.__runId}-idea-needs-design.json
           timeoutMs: ${vars.stepTimeoutMs}
       # Derive the eval recommendation ONCE (0769 pattern): the first non-blank line under
       # `## Recommendation` → proceed | reshape | drop | unknown. The --auto guards out of
@@ -183,14 +197,30 @@ states:
       pros/cons, and a recommendation. The operator reviews and approves or
       rejects. Routed around only when profile=auto AND vars.idea_approved=true
       (CLI --auto) AND the report's recommendation is proceed/reshape; a drop
-      recommendation cancels, a missing one still pauses here.
-    pause: true
+      recommendation cancels, a missing one asks the gate, whose evidence binding then
+      answers under profile=auto (1236/1241).
     onEnter:
       - kind: hitl.confirm
         options:
           prompt: "Review the idea evaluation report (.spur/run/${vars.__runId}-idea-eval-report.md). Approve to create a feature, or reject to cancel? (Reject creates no feature.)"
+          # Interactive always prompts the operator; profile=auto answers from the discovery
+          # stage's recorded evidence, deferring when it cannot decide (1236 R1/R2).
           decision:
-            mode: never
+            mode: evidence
+            statusVar: ideaEvalStatus
+            evidenceNodes:
+              - discovery
+      # A deferred/absent answer is the denial today's headless responder gave, so the
+      # guards keep routing on yes | no | cancel with no new edge.
+      - kind: shell
+        options:
+          command: >-
+            mkdir -p .spur/run; a="$__hitlAnswer"; [ -n "$a" ] || a=no;
+            printf '%s\n' "$a" > ".spur/run/$__runId-idea-eval-answer.txt"
+      - kind: file.read.into-var
+        options:
+          path: .spur/run/${vars.__runId}-idea-eval-answer.txt
+          var: __hitlAnswer
 
   - id: feature-create
     display:
@@ -218,6 +248,11 @@ states:
           # B7 R6 (0894): declared fresh policy (planner default).
           session: fresh
           expectFile: .spur/run/${vars.__runId}-idea-feature-id.txt
+          # Intent artifacts this stage writes; the shell below fails closed when either is
+          # missing, so declaring them adds the work-item contract, not a new precondition.
+          expectFiles:
+            - .spur/run/${vars.__runId}-idea-goal.md
+            - .spur/run/${vars.__runId}-idea-scope.md
           timeoutMs: ${vars.stepTimeoutMs}
       - kind: file.read.into-var
         options:
@@ -335,13 +370,29 @@ states:
       Requirement coverage (1004 R2) folds into the recorded `idea-ac-check` result via the
       gate's `--inventory` flag: a FAIL there can mean some inventory items have no covering
       scenario — answer no to route back to ac-generate for revision if needed.
-    pause: true
     onEnter:
       - kind: hitl.confirm
         options:
           prompt: "Feature check for ${vars.featureId}. Review the AC and confirm to proceed? Recorded check status: $(cat .spur/run/${vars.__runId}-idea-ac-check.status 2>/dev/null || echo unknown) (.spur/run/${vars.__runId}-idea-ac-check.status — includes inventory-coverage findings, 1004 R2). (Failures route back to ac-generate for revision, capped at 3 retries.)"
+          # Interactive always prompts the operator; profile=auto answers from the AC
+          # authoring stage's recorded evidence (1236 R1/R2). No `pause: true` — an
+          # evidence binding cannot live in a paused state (0911 D2), and the responder
+          # is what asks the operator now.
           decision:
-            mode: never
+            mode: evidence
+            statusVar: featureCheckStatus
+            evidenceNodes:
+              - ac-generate
+      # A deferred/absent answer is the denial today's headless responder gave.
+      - kind: shell
+        options:
+          command: >-
+            mkdir -p .spur/run; a="$__hitlAnswer"; [ -n "$a" ] || a=no;
+            printf '%s\n' "$a" > ".spur/run/$__runId-idea-feature-check-answer.txt"
+      - kind: file.read.into-var
+        options:
+          path: .spur/run/${vars.__runId}-idea-feature-check-answer.txt
+          var: __hitlAnswer
       # 1007 R2: the former post-confirm route-writer duplicate is deleted — ac-generate's
       # writer is the single writer (0945 R2 pin updated); its inputs (design var, needs-design
       # JSON, recorded ac-check status) cannot change across hitl.confirm.
@@ -420,7 +471,6 @@ states:
       records the concrete issue(s) in the run-scoped design-review artifact
       (.spur/run/${vars.__runId}-idea-design-review.md) under `## Operator feedback` —
       the revision pass reads it to reconcile invalidated AC before re-approval.
-    pause: true
     onEnter:
       - kind: shell
         options:
@@ -428,8 +478,23 @@ states:
       - kind: hitl.confirm
         options:
           prompt: "Review the system design for feature ${vars.featureId}. Approve to proceed to decomposition? To reject, first record your feedback in .spur/run/${vars.__runId}-idea-design-review.md under the `## Operator feedback` heading, then answer no."
+          # Interactive always prompts the operator; profile=auto answers from the
+          # system-design stage's recorded evidence (1236 R1/R2).
           decision:
-            mode: never
+            mode: evidence
+            statusVar: designApprovalStatus
+            evidenceNodes:
+              - system-design
+      # A deferred/absent answer is the denial today's headless responder gave.
+      - kind: shell
+        options:
+          command: >-
+            mkdir -p .spur/run; a="$__hitlAnswer"; [ -n "$a" ] || a=no;
+            printf '%s\n' "$a" > ".spur/run/$__runId-idea-design-approval-answer.txt"
+      - kind: file.read.into-var
+        options:
+          path: .spur/run/${vars.__runId}-idea-design-approval-answer.txt
+          var: __hitlAnswer
 
   - id: decompose
     display:
@@ -491,13 +556,27 @@ states:
       from decompose to the appropriate next state, so this state is only
       entered in interactive mode. On failure, the retry cap routes back to
       decompose (≤3 retries) or escalates to failed.
-    pause: true
     onEnter:
       - kind: hitl.confirm
         options:
           prompt: "Batch-create for feature ${vars.featureId}. Review the task batch and confirm to proceed? (Failures route back to decompose for revision, capped at 3 retries.)"
+          # Interactive always prompts the operator; profile=auto answers from the
+          # decompose stage's recorded evidence (1236 R1/R2).
           decision:
-            mode: never
+            mode: evidence
+            statusVar: batchCreateStatus
+            evidenceNodes:
+              - decompose
+      # A deferred/absent answer is the denial today's headless responder gave.
+      - kind: shell
+        options:
+          command: >-
+            mkdir -p .spur/run; a="$__hitlAnswer"; [ -n "$a" ] || a=no;
+            printf '%s\n' "$a" > ".spur/run/$__runId-idea-batch-create-answer.txt"
+      - kind: file.read.into-var
+        options:
+          path: .spur/run/${vars.__runId}-idea-batch-create-answer.txt
+          var: __hitlAnswer
 
   - id: batch-create-run
     display:
@@ -650,11 +729,12 @@ transitions:
 
   # ── discovery: auto-accept the eval recommendation (profile=auto + idea_approved) OR enter idea-eval ──
   # Declaration order: auto edges FIRST (same pattern as system-design → design-approval).
-  # Without them, discovery always enters idea-eval (pause: true), rendering the prompt
-  # and persisting an avoidable pause before the in-state auto-skip guard can fire (0366 R4/R5).
+  # Without them, discovery always enters the idea-eval gate, rendering the prompt and
+  # persisting an avoidable operator question before the gate's own auto answer can fire (0366 R4/R5).
   # --auto accepts the recommendation derived at the end of discovery (-idea-recommendation.txt):
   # drop → cancelled, proceed/reshape → feature-create; unknown/missing falls through to the
-  # idea-eval pause (fail-safe: never auto-create a feature without an explicit proceed).
+  # idea-eval gate, whose evidence binding then answers (fail-safe: never auto-create a feature
+  # without an explicit proceed).
   - from: discovery
     to: cancelled
     terminalReason: cancelled