@gobing-ai/spur 0.4.14 → 0.4.16

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.4.14",
+            "version": "0.4.16",
             "source": "./plugins/sp"
         }
     ]

package/config/config.global.yaml

@@ -155,15 +155,28 @@ workflows:
 # catalogs. `paths` registers extra catalog folders (absolute or
 # project-relative); the first layer wins per file basename (ADR-113 style).
 # `maker` selects the default DecisionMaker for every decision point, and
-# `makers` overrides it per decision id. Built-in makers: typesafe, fm-local,
-# laya-local (laya-local needs Apple Silicon) and clef (hosted Cloudflare
-# Workers AI, registered only when CLOUDFLARE_ACCOUNT_ID and
-# CLOUDFLARE_AUTH_TOKEN are both set). An unregistered name is a config error,
-# never a silent fallback. Inspect the effective choice with
-# `spur decision status`. `init` never overwrites this file — until you add the
-# keys, the shipped catalog's maker applies (see `status`).
+# `makers` overrides it per decision id. The value is any maker name the
+# registry currently registers — the list lives in the CLI, not here, so
+# `spur decision status` (registeredMakers) is the authority, together with each
+# maker's own prerequisites (a local maker needs its local stack; a hosted maker
+# registers only when its credentials are set). An unregistered name is a config
+# error, never a silent fallback. Inspect the effective choice per decision with
+# the same command. `init` never overwrites this file — until you add the keys,
+# the shipped catalog's maker applies (see `status`).
 decisions:
     paths: []
     maker: typesafe
     # makers:
-    #     task-triage: laya-local
+    #     task-semantic-risk: laya-local
+    # What "the decision was right" means (task 1263 R5): per decision id, the recorded outcomes
+    # that count as correct for each served value. `String(value)` keys, so a yes/no decision uses
+    # "true"/"false". The outcome verb records them (`spur decision outcome <invocation-id> ...`);
+    # `spur decision status --reliability` scores accuracy against this map and reports null for a
+    # decision with no entry, rather than guessing.
+    outcomeMap:
+        failure-class:
+            fix: [fixed]
+            stop: [not-fixed]
+        task-semantic-risk:
+            "false": [none, p4, p3]
+            "true": [p1, p2]

package/config/decisions/executor.yaml

@@ -0,0 +1,53 @@
+$schema: "@gobing-ai/spur/schemas/decision-catalog.schema.json"
+# Executor-failure rescue catalog (feature P1, task 1264).
+#
+# The executor loop escalates on `FAILURE_RULES` matches only (0407 precision bias). Anything the
+# rules miss — a reworded rate limit, "credits depleted", a proxy error body — ends the run as a
+# task defect. This decision classifies ONLY that residue, after the rules and the terminal checks
+# (timeout, permission denial, confirmed quota) have had their say, and only while
+# `workflows.executorFailureDecisionMaker` is on. It ships off by default: shipping off routes
+# nothing, and turning it on is an operator call backed by replay evidence in task 1264's Q&A.
+#
+# Resolution: shared layer, overridable per basename through `.spur/decisions/` or
+# `decisions.paths` (first layer wins, ADR-113 style).
+version: 1
+
+defaults:
+    # Higher than the catalog floor: a false `resource-exhaustion` costs a failover attempt, and a
+    # false `task-defect` equals today's behaviour — so the uncertainty must resolve downward.
+    minConfidence: 0.85
+
+decisions:
+    executor-failure-class:
+        type: choice
+        description: Is an unmatched agent-dispatch failure resource exhaustion, an auth failure, or a task defect?
+        instructions: |
+            You are classifying why one agent dispatch exited non-zero, after every deterministic
+            rule already declined to classify it.
+            Failure output: ${params.instructions}
+            Answer `resource-exhaustion` only when the output states a provider-side capacity or
+            billing limit: a quota/credit/billing message, a 429 or rate-limit body, a token or
+            request budget, or an "overloaded"/"capacity" error. Answer `auth` only when the
+            output states a credential or authorization fault: an invalid/expired key or token, a
+            401/403 body, or a missing credential for the provider. Answer `task-defect` for
+            everything else: a compile or test failure, a missing file, a malformed prompt, a
+            socket/proxy error, or output that does not name a provider limit at all.
+            Classify only what the output says. Do not infer a vendor, and do not guess.
+        parameters:
+            wbs:
+                type: string
+                description: Task WBS the failing dispatch belongs to, when known.
+                # Optional: the executor seam knows only the run id, and a required param would
+                # reject every rescue before it reached a maker.
+                default: ""
+        criteria:
+            resource-exhaustion: >
+                The output names a provider-side limit — quota, credits, billing period, rate
+                limit, 429, token budget, or capacity.
+            auth: >
+                The output names a credential or authorization fault — invalid or expired key or
+                token, 401/403, or a missing credential.
+            task-defect: >
+                The output names no provider limit or credential fault — a code/test/file error, a
+                prompt problem, or a transport error that is not a provider quota.
+        fallback: task-defect

package/config/decisions/task-pipeline.yaml

@@ -1,11 +1,11 @@
 $schema: "@gobing-ai/spur/schemas/decision-catalog.schema.json"
-# Decision catalogs for the task pipeline (feature P / task 1092, ADR-134).
+# Decision catalogs for the task pipeline (feature P1, ADR-134).
 #
-# These entries mirror the inline decide actions that ship in
-# config/workflows/task-pipeline.yaml today — same questions, choices and
-# fallbacks — so their reliability can be measured with `spur decision run`
-# before feature P1 migrates the workflow actions onto them (design §3.5).
-# No workflow references this catalog yet.
+# The shipped `config/workflows/task-pipeline.yaml` decide actions reference these ids
+# (`failure-class`, and `task-semantic-risk` once its evidence bar is met). Each entry's
+# reliability is measured from recorded `decision.*` events — `spur decision status
+# --reliability` — and an adoption slice only keeps a decision point while that evidence
+# shows it adds information the deterministic guards do not.
 #
 # Resolution: this file ships in the shared layer (the installed package's
 # config/decisions/). A project can override it per basename through
@@ -17,39 +17,55 @@ defaults:
     minConfidence: 0.8
 
 decisions:
-    task-triage:
-        type: choice
-        description: Which verification lane does a green-gate diff deserve?
+    task-semantic-risk:
+        type: noul
+        description: >
+            Does this task's change set change behaviour a reviewer must reason about beyond what
+            the diffstat already shows? (false projects the fast lane, true or a fallback the
+            standard lane.)
+        instructions: |
+            You are classifying one Spur task's change set for review depth.
+            Change set: ${params.instructions}
+            Answer true when the change alters behaviour a reviewer must reason about: control
+            flow, a data shape, persistence, security, an external contract, or error handling.
+            Answer false only when the change is mechanical — docs, comments, formatting, renames,
+            test-only edits, or a dependency bump with no source edit.
+            Judge the change set only; do not score its quality or estimate its size.
         parameters:
             wbs:
                 type: string
-                description: Task WBS the diff belongs to.
+                description: Task WBS whose change set is being classified.
         criteria:
-            low: Small, contained diff — the fast lane is enough.
-            standard: Ordinary diff — the standard verification lane applies.
-            high: Broad or risky diff — verify with high caution.
-        fallback: standard
+            "true": >
+                The change set touches executable behaviour — a branch, a boundary, a stored
+                schema, a public signature, or a failure path — so a reviewer must read the diff,
+                not only its diffstat.
+            "false": >
+                The change set is mechanical — docs, comments, formatting, renames, test-only
+                edits, or a version bump with no executable change — so the diffstat is enough.
+        fallback: true
 
     failure-class:
         type: choice
         description: Is a failed quality gate fixable by the repair agent, or should the run stop?
+        instructions: |
+            You are classifying one failed quality-gate run for Spur's task pipeline.
+            Gate output: ${params.instructions}
+            Answer `fix` when the output names a concrete defect inside this repository that the
+            repair agent can act on: a failing test with an expected/actual diff, a type error
+            naming a file and symbol, a lint rule id with a file:line, or a missing export or
+            import. Answer `stop` when the failure is environmental or not repairable by editing
+            this tree: a missing tool or binary, a permission or disk error, a network or registry
+            failure, a gate timeout, or output that names no in-tree file.
         parameters:
             wbs:
                 type: string
                 description: Task WBS whose gate failed.
         criteria:
-            fix: The failure looks fixable — send it to the repair agent.
-            stop: The failure is not mechanically fixable — stop the run for the operator.
-        fallback: fix
-
-    review-failure-class:
-        type: choice
-        description: Is a non-PASS review fixable by the repair agent, or should the run stop?
-        parameters:
-            wbs:
-                type: string
-                description: Task WBS whose review did not certify PASS.
-        criteria:
-            fix: The findings look fixable — send them to the repair agent.
-            stop: The findings are not mechanically fixable — stop the run for the operator.
+            fix: >
+                The output names an in-tree defect — a failing test, a type error with a file and
+                symbol, a lint rule id with a file:line, or a missing import.
+            stop: >
+                The output names no in-tree defect — a missing tool, a permission or disk error,
+                a network or registry failure, or a timeout — so editing the tree cannot fix it.
         fallback: fix

package/config/pipeline-budgets.json

@@ -28,26 +28,12 @@
             "source": "Post-merge count (0607 R2: doc-sync + learning-capture consolidated, 2 -> 1). Real-run reading (R5): median 253s, max-sane 2319s (n=44). Budget = 60 min ceiling.",
             "decision": null
         },
-        "pr-review": {
-            "modelQueries": 0,
-            "wallClockMs": null,
-            "tokenCostUsd": null,
-            "source": "Zero-query pipeline (the live definition declares no model queries); query budget trivially 0 — the gate handles an empty list (0607 R3). No real full run recorded; wall-clock unenforced.",
-            "decision": null
-        },
         "history-anatomy": {
             "modelQueries": 3,
             "wallClockMs": null,
             "tokenCostUsd": null,
             "source": "Coverage entry (0826 R2): the live definition's model-query count (extractResolvedWorkflowFacts, 2026-09-11). No real-run measurement yet: wall-clock and cost are unenforced until measured, never 0. 0920 recount 2026-09-23: 4 -> 3 — the resolve-scope model hop was removed; scope/window validation is deterministic in the `spur history anatomy paths` op (history-anatomy-cache before script-absorption PR-6).",
             "decision": null
-        },
-        "wayfinder-resolution": {
-            "modelQueries": 2,
-            "wallClockMs": null,
-            "tokenCostUsd": null,
-            "source": "Coverage entry (0826 R2): the live definition's model-query count (extractResolvedWorkflowFacts, 2026-09-11). No real-run measurement yet: wall-clock and cost are unenforced until measured, never 0.",
-            "decision": null
         }
     }
 }

package/config/workflow-candidates.json

@@ -68,6 +68,24 @@
         }
     ],
     "retirements": [
+        {
+            "name": "feature-verification",
+            "recordedBy": "1246/1252 (D66, ADR-142)",
+            "date": "2026-10-18",
+            "rationale": "The wrapper was retired by the D66 consolidation decision; feature-lifecycle's verifying entry calls spur feature verify directly. Existing run history is retained."
+        },
+        {
+            "name": "pr-review",
+            "recordedBy": "1251/1252 (D66, ADR-142)",
+            "date": "2026-10-18",
+            "rationale": "The sequencing workflow was retired by the D66 consolidation decision; the PR review skill calls the flat spur builder pr-* verbs directly. Existing run history is retained."
+        },
+        {
+            "name": "wayfinder-resolution",
+            "recordedBy": "1251/1252 (D66, ADR-142)",
+            "date": "2026-10-18",
+            "rationale": "The workflow was retired by the D66 consolidation decision; investigation remains a wayfinder skill procedure. Existing run history is retained."
+        },
         {
             "name": "planning-pipeline",
             "recordedBy": "0872 (ADR-072/075 composition-baseline pass 2dc86579a)",

package/config/workflows/feature-lifecycle.yaml

@@ -40,24 +40,17 @@ states:
     onEnter:
       # Caller wiring (task 0880, ADR-119): entering verification RUNS the
       # feature-scoped pass instead of only passively reading its status file.
-      # 0948 R1: pass BOTH vars the inner workflow needs. `--vars` was documented as
-      # replace-not-merge and a partial override silently blanked `spurBin`; the engine
-      # merges declared defaults today (0948 R2), but the caller stays explicit so the
-      # nested run is self-sufficient under either semantic.
+      # 1246 R1: the pass is the verb itself — no nested `spur workflow run`, no
+      # recursion-marker clearing. Without `--run-id` the verb opens and finalizes
+      # its own run row bound to this definition (1246 R2), so the done gate's
+      # receipt-integrity rule (recording run terminal `done`) holds.
+      # `env -u __runId`: the verb's `--run-id` falls back to the `__runId` env name, and a hop
+      # driven from inside another workflow run (a pipeline step, the quality gate) inherits that
+      # run's id. Without the unset the pass silently binds its receipt to the OUTER run instead of
+      # opening its own — which is still `running` at verifying→done, so the done gate fails closed.
       - kind: shell
         options:
-          # Pass featureId and spurBin together. A partial --vars map used to be
-          # applied as a replacement, so the inner run lost spurBin and loadModule
-          # fell into source mode (0948 R1). The nested JSON is shell-expanded:
-          # $spurBin inside the double quotes keeps a multi-word invocation intact.
-          # 1147 R4: clear the inherited nested-run marker for this ONE child. The
-          # bounded, definition-pinned feature-verification pass (no agent.run, no
-          # further nested run) is a legitimate child, but the outer run's
-          # SPUR_WORKFLOW_RUN_ACTIVE marker rides every child env — so the CLI's
-          # nested-run refusal (0610 R4) rejected it and the same pass that passes
-          # standalone failed here with a bare exit 1. The recursion guard stays
-          # binding for every other nested invocation.
-          command: 'env -u SPUR_WORKFLOW_RUN_ACTIVE $spurBin workflow run feature-verification.yaml --vars "{\"featureId\":\"$featureId\",\"spurBin\":\"$spurBin\"}"'
+          command: 'env -u __runId $spurBin feature verify $featureId --no-logo'
   - id: blocked
     description: Impediment; work suspended.
   - id: done