@gobing-ai/spur 0.4.2 → 0.4.4

package/plugins/sp/skills/spur-dev/references/inline-pipeline-driver.md

@@ -441,9 +441,9 @@ Action semantics come from the YAML and the workflow action contract:
   recheck's `no-progress` guard honours it, so a cap-kill reads as a red gate the next time. Preserve
   the signal-induced receipt under a distinct name (`<wbs>-check-receipt.false-fail-<signal>.json`)
   and say so in the run log before re-running: never delete it silently, and never report a
-  cap-killed attempt as a genuine gate failure. Measured this session: one foreground gate call
-  (25.6 min host-wide lock wait + 7.4 min runtime) was SIGTERM-killed at the host cap and produced
-  exactly that false FAIL receipt.
+  cap-killed attempt as a genuine gate failure. Measured 2026-10-10 (before the gate-lock removal):
+  one foreground gate call (25.6 min host-wide lock wait + 7.4 min runtime) was SIGTERM-killed at the
+  host cap and produced exactly that false FAIL receipt.
 - `note` — append the expanded message to the inline run log.
 - `doctor.probe` — run the declared Spur doctor once, persist its status file, and apply any
   `setVars` result (including a resolved executor) before the next action or state.
@@ -766,7 +766,7 @@ host-owned gate sat between the stages, or when the platform cannot address comp
 **Implement and test-fix workers never run the full gate (task 1142 R3).** Workers use the light tier as their iteration check (task 1142 R3) in exact order:
 1. the **changed-path matrix** (`code-implementation/SKILL.md` § Changed-path targeted checks) over the paths they touched;
 2. the resolved `quality-gate` script in `light` mode (source-repo probe, else the installed twin) (biome, per-workspace typecheck, rule presets, related tests).
-Neither step takes the full-gate lock. The pipeline's `test` and `test-recheck` hops remain the only full gate. Carry
+Neither step takes the full gate. The pipeline's `test` and `test-recheck` hops remain the only full gate. Carry
 `--gate-log <path>` through to the child **verbatim**: never paraphrase it into "re-run the named
 gate command". That paraphrase is not cosmetic — it sent a worker into a full gate run instead of
 targeted iteration checks. The pipeline's next `test` (recheck)
@@ -835,6 +835,19 @@ The quality gate's `proofDigest` certifies a specific tree. Two rules protect it
    before a review dispatch is spent. The mismatch routes through the existing tripwire to `failed`;
    there is no new re-certify path.
 
+**A host-driven pass that skips the `test` hop has no digest-bound receipt.** `proofDigest` is
+captured by the `test` state's `proof.fingerprint` action, so hops driven out of band — an operator
+implementing/verifying/recording by hand, or an audit of a task whose gate the host ran directly —
+leave no `.spur/run/<wbs>-check-receipt.json`. The deciding artifacts are then
+`.spur/run/<wbs>-test-gate.status` plus its gate log. Two consequences, in order of preference:
+
+1. **Drive the pipeline** for anything that must be certified: only a digest-bound full receipt
+   satisfies a review/verify/record boundary (`sp-spur-check`), and the `test` hop owns the capture.
+2. **When a host-driven pass is unavoidable, say so in the verdict** — name the status file and gate
+   log as the evidence and grade confidence `MEDIUM`. A `HIGH` claim needs re-runnable evidence from a
+   checked path (the `sp-code-verification` ladder); claiming a receipt that was never written is the
+   failure mode this note exists to prevent (observed across four A91 tasks, 2026-10-12).
+
 **A mismatch names the drifted paths (R5).** At gate entry the pipeline snapshots the non-corpus tree
 state (`git status --porcelain=v1 -uall` plus `git diff --name-only HEAD`, excluding
 `docs/tasks*` / `docs/features*`) into `.spur/run/<run-id>-gate-paths.txt`. On a mismatch the
@@ -909,21 +922,45 @@ verdict artifact exists (tasks 0617, 0619 — the clobbering spiral).
 
 ## Running the full gate (task 0872 / 1127 R7)
 
-The full gate serializes behind a host-wide lock and legitimately runs 10-25 minutes. Two rules keep
-it from becoming a hazard (both violated once on 2026-10-10, blocking every other session for ~11
-minutes and aborting the run's own verification):
+The full gate legitimately runs minutes, not seconds — measured 1.8-3.1 min for `bun run spur-check`
+on an idle 10-core host (2026-10-13), and far longer when other agents' suites run concurrently.
+Five rules keep it from becoming a hazard (the first two
+were both violated once on 2026-10-10, aborting the run's own verification):
 
 - **Never wrap it in an external `timeout`, and never treat its runtime as a hang.** An outer bound
-  that fires mid-suite leaves the holder alive holding the lock while the caller believes it is gone.
-- **Run it detached and poll the log**, so losing the foreground call cannot lose the holder:
+  that fires mid-suite leaves a half-finished suite behind while the caller believes it is gone.
+- **Run it detached and poll the log**, so losing the foreground call cannot lose the run:
 
   ```bash
   nohup bash -c 'bun run spur-check > /tmp/gate.log 2>&1; echo "EXIT=$?" >> /tmp/gate.log' &
   ```
 
-- **Never kill a gate holder whose pid is alive.** The waiter line `waiting for holder (… held Nms)`
-  is printed only after `isProcessAlive(held.claim.pid)` succeeded, so a printed holder is a live one
-  by construction; only the lock's own dead-pid reclaim is authorised to clear a claim.
+- **Preserve a signal-induced receipt.** A cap-killed attempt leaves a red receipt that the next
+  recheck's `no-progress` guard honours, so it reads as a genuine failure unless the receipt is kept
+  under a distinct name and the run log says so.
+- **Clear the killed attempt's process tree before re-running.** A cap-signalled gate leaves its
+  `bun test --test-worker` children alive: the parent dies, the workers keep burning ~100% CPU, and
+  each retry is slower than the last until the cap kills that one too and mints another leak.
+  Observed 2026-10-13: five leaked workers (ages 23 min, 37 min, 50 min, 2 h 17 m, 4 h 18 m) drove
+  consecutive attempts from the measured 1.8-3.1 min up to 13-40 min, and the real defect of the
+  session only became visible once they were cleared. Find them by age and cwd, then clear the tree
+  before the next run; leave a tree alone whose cwd is another session's live run:
+
+  ```bash
+  ps -Ao pid=,ppid=,etime=,%cpu=,command= | grep -E "run-tests\.ts|bun test --test-worker" | grep -v grep
+  kill -TERM <pid> <ppid>; sleep 4; kill -KILL <pid> <ppid>    # escalate only if TERM is ignored
+  ```
+
+- **One gate per tree.** Nothing serializes gate runs since task 1173 deleted the lock, so confirm
+  no live gate is already running in your tree before starting one: two suites in one tree contend
+  for CPU and for the shared fixtures, and the second one's result is uninterpretable. Measured
+  2026-10-13: a duplicate gate launched into a tree already running another session's
+  `bun run spur-check` burned 40 min at the host cap and left an orphaned worker behind.
+
+> Historical (task 1127, removed in task 1173): these rules were once stated in terms of a host-wide
+> `full-gate.lock`. The lock mechanism was deleted (`refactor(gate): remove gate-lock mechanism and
+> simplify quality-gate`), so nothing serializes gate runs today — the guidance above stands on its
+> own without it.
 
 ## Runtime interface contracts (from run evidence)
 

package/schemas/section-matrix.schema.json

@@ -53,7 +53,7 @@
         "variant": {
             "type": "object",
             "additionalProperties": false,
-            "description": "A variant may declare any subset of the 7 canonical statuses (enumerated below); an unknown status key is rejected.",
+            "description": "A variant may declare any subset of the 8 canonical statuses (enumerated below); an unknown status key is rejected.",
             "properties": {
                 "backlog": { "$ref": "#/$defs/entry" },
                 "todo": { "$ref": "#/$defs/entry" },
@@ -61,7 +61,8 @@
                 "testing": { "$ref": "#/$defs/entry" },
                 "blocked": { "$ref": "#/$defs/entry" },
                 "done": { "$ref": "#/$defs/entry" },
-                "cancelled": { "$ref": "#/$defs/entry" }
+                "cancelled": { "$ref": "#/$defs/entry" },
+                "deprecated": { "$ref": "#/$defs/entry" }
             }
         }
     }