@gobing-ai/spur 0.4.26 → 0.4.28

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.4.26",
+            "version": "0.4.28",
             "source": "./plugins/sp"
         }
     ]

package/config/rules/boundary/dao-boundary.yaml

@@ -88,6 +88,8 @@ rules:
     exclude:
       # the CLI migration journal — 43 DDL statements (verified load-bearing)
       - "packages/domain/src/migrations.ts"
+      # 0037's embedded mirror, generated verbatim from released drizzle SQL (task 1312)
+      - "packages/domain/src/migration-sql.generated.ts"
 
   - id: raw-sql-only-in-domain
     description: >

package/config/rules/structure/test-location.yaml

@@ -44,6 +44,8 @@ rules:
       - "**/schema/**"
       - "**/schema.ts"
       - "**/migrations.ts"
+      # generated migration SQL; scripts/commands/emit-migration-sql.test.ts pins it (task 1312)
+      - "packages/domain/src/migration-sql.generated.ts"
       - "**/db.ts"
       ## Entity declarations — contracts are transport DTOs tested by the single contract.test.ts
       - "packages/contracts/src/**"

package/config/workflows/task-pipeline.yaml

@@ -139,6 +139,15 @@ vars:
     # The gate observes, it does not mutate: `implement` already ran `$formatCmd` on its way out,
     # and a formatter inside the gate would rewrite the tree the receipt is keyed by.
     qualityGateCmd: "${spurBin:-spur} self exec check"
+    # 1319 R1: per-spawn bound for EVERY command the gate runs (full attempt, recheck probe, light
+    # sub-checks, changed-path read). `command.gate` exports workflow vars as env, so this var reaches
+    # `spur task gate` as `gateTimeoutMs` with no new flag. A hit is BLOCKED (exit 2), never a red
+    # gate, and writes no check receipt. 15 min: above a healthy full gate, far below a hang.
+    gateTimeoutMs: "900000"
+    # 1319 R2(c): outer backstop on the gate ACTION itself. Only a finite `timeoutMs` gives
+    # `ts-runtime` process-group ownership, which reaps grandchildren the gate's own `spawnSync`
+    # cannot reach. Must stay above lock wait (2 h, quality-gate.ts) + 5 x gateTimeoutMs + probe.
+    gateBackstopMs: "14400000"
     # Cheap red-detector run before the full gate on **recheck visits only**; empty ⇒ no probe.
     # A project overriding qualityGateCmd should override this too. TRUSTED CONFIG ONLY.
     gateProbeCmd: "${spurBin:-spur} self exec lint"
@@ -163,6 +172,9 @@ vars:
     # anchors directly in the /sp:dev-fixall input, so the fix agent starts AT the failing
     # file:line instead of re-deriving it from a fresh gate run (0482 R3).
     gateFindings: ""
+    # 1319 R5: lint findings from the previous review visit, echoed into the review prompt on the
+    # inline retry. Empty on the happy path, so the prompt pays nothing when nothing is wrong.
+    reviewLint: ""
     # The quality-gate mode this visit runs — `run` on the first gate visit of the run,
     # `recheck` after a remediation hop, `deferred` under the opt-in batch policy. Written by
     # the gate's own shell and projected into this var (args cannot branch) — D65 1239 R2.
@@ -332,9 +344,19 @@ states:
           # Best-effort: `; exit 0` (not `&&`) so a missing/failing formatter in a seeded
           # non-Bun project cannot abort a run mid-implement. `${vars.qualityGateCmd}` at
           # `gate` is the gate that actually decides.
-          - kind: shell
+          # 1319 R3: the formatter is a bounded `command.gate` instead of an unbounded `shell`.
+          # Best-effort semantics stay (`softFail: true`: a missing/failing/timed-out formatter
+          # never aborts the run — the quality gate is the real gate), but a formatter that hangs
+          # can no longer hold the step open forever. `shell` cannot carry a bound upstream
+          # (ts-runtime PipeProcessOptions has no timeout), so the step kind changes, not the intent.
+          - kind: command.gate
             options:
-                command: 'sh -c "$formatCmd" ; exit 0'
+                id: implement-format
+                executable: "sh"
+                args: ["-c", "${vars.formatCmd}"]
+                resultFile: .spur/run/${vars.__runId}-implement-format.status
+                softFail: true
+                timeoutMs: "${vars.stepTimeoutMs}"
           # 1109 R3: qualify this task's unique basename anchors to repo-relative paths.
           # Placement is load-bearing: it runs AFTER implement's mutations (and the format
           # above) and BEFORE the gate reads the tree, so the receipt is keyed to the final
@@ -518,6 +540,9 @@ states:
                 args: ["task", "gate", "${vars.wbs}", "${vars.gateMode}", "--no-logo"]
                 resultFile: .spur/run/${vars.__runId}-gate.status
                 softFail: true
+                # 1319 R2(c): group-owned backstop. The gate's own per-spawn bound (R1) bounds
+                # each command; this bounds the action and reaps any surviving descendant.
+                timeoutMs: "${vars.gateBackstopMs}"
           # (d) record what the PREVIOUS gate visit's failure-class answer turned out to be
           # (1263 R3a): a recheck visit means the last class was `fix` and the repair hop ran, so
           # this visit's gate status says whether it was right. First write wins, the step never
@@ -635,6 +660,18 @@ states:
           approval decision point. Cost at this decision point (1122): open P1-P3 review
           findings block `done`; only P4 rows and DEFER-ed P3 rows are wrap residuals.
       onEnter:
+          # 1319 R5(b)/Q9: surface the previous visit's verdict-lint findings for THIS visit's prompt.
+          # Empty on the first visit (and after a clean lint), capped so the prompt stays inside its
+          # composition budget, and it names the declared R/AC ids because the lint already does.
+          - kind: shell
+            options:
+                command: >-
+                    mkdir -p .spur/run; L=".spur/run/$wbs-verdict-lint.txt"; O=".spur/run/$__runId-review-lint.txt";
+                    if [ -s "$L" ]; then head -c 600 "$L" > "$O"; else : > "$O"; fi; exit 0
+          - kind: file.read.into-var
+            options:
+                path: .spur/run/${vars.__runId}-review-lint.txt
+                var: reviewLint
           - kind: agent.run
             options:
                 # 0710 R2: review always runs on a fresh session — no implementation-session
@@ -664,7 +701,7 @@ states:
                     Answer contract: super-reviewer Output Format. Emit the machine-linted artifact, not a prose summary.
                     `## Review`: deriveReviewConfidence. Captured answer (`spur task verdict`) has one `Confidence: HIGH|MEDIUM|LOW`
                     line (deriveVerifyConfidence), never the section's disposition level.
-                    End with one `Verdict: PASS|PARTIAL|FAIL` line (plain, final) after
+                    End with one `Verdict: PASS|PARTIAL|FAIL` line after
                     `| Req | Status | Evidence |` (one row per requirement; MET | PARTIAL | UNMET) and
                     `| AC | Status | Evidence Type | Evidence |` (one row per AC; MET | PARTIAL | UNMET | N/A).
                     Evidence types (`+` ok): test | command | static-ref | manual-review | llm-judge | n/a.
@@ -672,6 +709,7 @@ states:
                     a declared `AC-N` alias; a linked scenario covers its task; a task-local criterion needs no feature credit.
                     Open P1-P3 blocks completion.
                     Also write it to `.spur/run/${vars.__runId}-review-cert.md`.
+                    ${vars.reviewLint}
                 # The captured review answer is the run's certification input (and the
                 # `task verdict` input below): expectFile fails the step when no answer landed.
                 answerFile: .spur/run/${vars.__runId}-review-answer.txt
@@ -712,9 +750,12 @@ states:
             options:
                 id: review-verdict
                 executable: "${vars.spurBin}"
-                args: ["task", "verdict", "${vars.wbs}", "--from-answer", ".spur/run/${vars.__runId}-review-cert.md"]
+                args: ["task", "verdict", "${vars.wbs}", "--from-answer", ".spur/run/${vars.__runId}-review-cert.md", "--replay"]
                 resultFile: .spur/run/${vars.__runId}-review-verdict.status
                 softFail: true
+                # 1319 R4: the replay runs up to 5 cited suites at 120 s each; the action bound is
+                # the same headroom the review hop gets, so a slow cited suite cannot pin the visit.
+                timeoutMs: "900000"
           # (e) one fold, one token: PASS requires the typed verdict PASS, the artifact's own
           # PASS, and a clean review gate (open P1-P3 finding or an uncited claim blocks it).
           # Fail-closed: any missing/corrupt input leaves FAIL, so the transitions can route a
@@ -759,6 +800,14 @@ states:
             options:
                 command: >-
                     mkdir -p .spur/run; A=APPROVED; if [ "$profile" = auto ]; then [ "$__hitlAnswer" = no ] && A=DENIED; else [ "$__hitlAnswer" = yes ] || A=DENIED; fi; printf '%s\n' "$A" > ".spur/run/$wbs-approval.status"; exit 0
+          # 1319 R5(b): one inline re-review token, decided AFTER every fold above so deleting the
+          # stale cert/answer cannot make a fold read the previous visit's verdict. Run-scoped, so a
+          # stale file from an earlier run can never trigger a retry; `-retried` makes it once only.
+          # A second lint failure leaves the token NONE and routes to remediate exactly as today.
+          - kind: shell
+            options:
+                command: >-
+                    if [ -s ".spur/run/$wbs-verdict-lint.txt" ] && [ ! -f ".spur/run/$__runId-review-lint-retried" ]; then touch ".spur/run/$__runId-review-lint-retried"; printf 'RETRY\n' > ".spur/run/$__runId-review-lint-retry"; rm -f ".spur/run/$__runId-review-cert.md" ".spur/run/$__runId-review-answer.txt"; else printf 'NONE\n' > ".spur/run/$__runId-review-lint-retry"; fi; exit 0
 
     - id: done
       description: >
@@ -1050,6 +1099,16 @@ transitions:
           kind: shell
           options:
               command: 'test "$(cat ".spur/run/$wbs-approval.status" 2>/dev/null)" = DENIED'
+    # 1319 R5(c): one inline re-review when the answer LINT failed, before any remediate hop is
+    # spent. Declared after the denial route and before `retry-exhausted` because a lint retry is
+    # not a repair attempt (it does not consume the shared fix-attempt counter). First match wins.
+    - from: review
+      to: review
+      description: The verdict lint rejected the answer's shape — re-issue the review prompt once with the lint findings instead of buying a remediate hop.
+      guard:
+          kind: shell
+          options:
+              command: 'test "$(cat ".spur/run/$__runId-review-lint-retry" 2>/dev/null)" = RETRY'
     - from: review
       to: failed
       terminalReason: retry-exhausted

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.4.26",
+    "version": "0.4.28",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",
@@ -50,7 +50,7 @@
         "dev": "bun run src/index.ts",
         "build": "bun run ../../scripts/spur-dev.ts build-cli",
         "build:binaries": "bun run ../../scripts/spur-dev.ts build-binaries",
-        "build:bundle": "bun run ../../scripts/spur-dev.ts bundle-web && bun run ../../scripts/spur-dev.ts emit-board-types && bun build src/index.ts --target=bun --outfile spur.js --external @johnhenry/backend-webgpu && bun run ../../scripts/spur-dev.ts bundle-config config && bun run ../../scripts/spur-dev.ts bundle-laya-worker && bun run ../../scripts/spur-dev.ts bundle-plugins",
+        "build:bundle": "bun run ../../scripts/spur-dev.ts bundle-web && bun run ../../scripts/spur-dev.ts emit-board-types && bun run ../../scripts/spur-dev.ts emit-migration-sql && bun build src/index.ts --target=bun --outfile spur.js --external @johnhenry/backend-webgpu && bun run ../../scripts/spur-dev.ts bundle-config config && bun run ../../scripts/spur-dev.ts bundle-laya-worker && bun run ../../scripts/spur-dev.ts bundle-plugins",
         "test": "bun test tests --coverage --coverage-dir=../../.coverage --pass-with-no-tests",
         "typecheck": "tsc --noEmit",
         "prepack": "bun run build:bundle",

package/plugins/sp/commands/dev-runall.md

@@ -17,9 +17,9 @@ Wraps the **sp:spur-dev** skill.
 | `--tasks` `<selector>` | Task selector to run. | required |
 | `--feature` `<id>` | Restrict to a feature. | omitted |
 | `--mode` `<sequential\|parallel\|auto>` | Batch execution order. `auto` computes the frozen batch's dependency waves and runs parallel only when a wave holds ≥2 independent tasks (see below). | sequential |
-| `--keep-going` | Continue past per-task failures. | off |
-| `--auto` | Skip objective HITL gates. | off |
-| `--agent` `<inline\|auto\|name>` | Who runs each task's pipeline stages. Interactive sequential omit/`inline` uses the host-session driver with unified inline semantics (task 0687 — see below). `auto`, a name, parallel mode, and headless invocation use subprocesses. The opt-in `fleet` selector (0942) maps each task run to `executor: 'fleet'` so `agent.run` stages dispatch through the fleet control plane (ADR-126) instead of a subprocess. | omit |
+| `--keep-going` | Continue past per-task failures (implied by `--auto`). | off |
+| `--auto` | Skip objective HITL gates, and treat the batch as unattended: `--auto` implies `--keep-going` (a failed task is `failed`, its in-batch dependents `skipped`, independents keep running). | off |
+| `--agent` `<inline\|auto\|name>` | Who runs each task's pipeline stages. Interactive sequential omit/`inline` uses the host-session driver with unified inline semantics (task 0687 — see below). `auto`, a name, parallel mode, and headless invocation use subprocesses; `auto` is resolved **once per batch** — the first run's implement `result.executor` is pinned for every later task, and only a `failed-agent` ending re-resolves it, exactly once (1318 R2/R3). The opt-in `fleet` selector (0942) maps each task run to `executor: 'fleet'` so `agent.run` stages dispatch through the fleet control plane (ADR-126) instead of a subprocess. | omit |
 | `--json` | Emit structured JSON. | off |
 | `--wrap` | Run the wrap hop **once for the batch** over the `done` subset only (Step 6 of execution-batch.md): `vars.feature` is passed only when every frozen task is `done`/`cancelled`; an empty done subset skips the wrap with a reason. The `--agent` selector is preserved into the `/sp:dev-wrap` handoff when supplied; omission remains omission. | off |
 | `--next` | Chain-to-completion via the next-router. | off |
@@ -50,8 +50,9 @@ see `execution-parallel-isolation.md`; `auto` picks one per batch — see below)
 (parallel-mode worker bound — at most <n> task pipelines at once, default 2; a dependent task starts
 only after its in-set dependencies are **integrated** onto the base ref), `--keep-going`
 (batch failure policy — skip a failed task's in-batch dependents, continue independents; default
-halts on first failure), `--auto`
-(sets `profile=auto` on each per-task run, skipping the HITL approve gate), `--agent <inline|auto|name>`
+halts on first failure, and `--auto` implies `--keep-going`), `--auto`
+(sets `profile=auto` on each per-task run, skipping the HITL approve gate; makes the batch
+unattended, so it also implies `--keep-going`), `--agent <inline|auto|name>`
 (names who runs the pipeline's stages — interactive sequential omit/`inline` uses the host driver;
 `auto` or a name is merged into each per-task `vars.agent` and `vars.implementAgent`; `fleet` maps each task run to `executor: 'fleet'` instead (fleet dispatch, 0942); parallel mode
 retains isolated subprocesses, ADR-047), `--json` (emit the

package/plugins/sp/plugin.json

@@ -1,5 +1,5 @@
 {
     "name": "sp",
-    "version": "0.4.26",
+    "version": "0.4.28",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics."
 }

package/plugins/sp/skills/code-implementation/SKILL.md

@@ -191,6 +191,12 @@ Neither step takes the full project gate. The full gate is named only for the pi
   creep into every plugin edit.
 - Run the applicable rows, then stop: the single full project check belongs to the pipeline's
   `gate` state (`task-pipeline.yaml` `${vars.qualityGateCmd}`).
+
+**Focused runs and file mutation (1319 R6/R9).** Focused verification is `spur task gate <wbs> light` —
+never a hand-rolled `bunfig.toml`, never the root-cwd `bun test`. Mutate with `Edit`/`Write`; a
+`python3 - <<PY`, `sed -i` or `perl -pi` file mutation is a **defect** (it carries scaffolding through
+the context instead of a diff, and a silent no-op replace is indistinguishable from success).
+Contract: `docs/design/gate-bounds-and-pause-attribution.md`.
 - **Mirrored surfaces: an edit lands on all of them.** When the change is one instance of a repeated
   pattern — the same wiring rule on two runbooks, a signature in both a generator and its generated
   `.d.mts`, a command chain in both `spur-check` and `spur-check:full` — grep for the siblings and

package/plugins/sp/skills/code-testing/SKILL.md

@@ -64,6 +64,13 @@ loop are the dominant verification cost on a long chain.
 Do not re-run the full suite per iteration, and do not run a full gate before the narrow target is
 green. Target: full `spur-check` runs ≤2 per task.
 
+## Temp dirs: never under `.spur/run` (task 1319 R9)
+
+A test that needs a scratch directory creates it under the OS temp dir (`mkdtempSync(join(tmpdir(),
+...))`), never under `.spur/run`. That path is the run's own evidence plane: test fixtures written
+there inflate the run directory (the credit-sentry tree reached 528 MB with 3656 entries in one
+task's directory), slow every glob over it, and re-trigger the pipeline's dirty-tree precheck.
+
 ## Composition with the discipline + implementation skills
 
 - **`sp:test-driven-development`** — they compose: TDD *designs* the tests (red-green-refactor, behavior naming,

package/plugins/sp/skills/spur-dev/references/cross-cutting.md

@@ -607,10 +607,10 @@ principles determine which gates route around HITL and which still pause.
    `--auto`. Irreversible is irreversible.
 
    **Exception — the worktree batch success path (`execution-batch.md` § WT-4).** The
-   `--worktree --auto` full-batch success sequence — `git merge --ff-only "$BRANCH"`, `git worktree
+   `--worktree --auto` full-batch success sequence — `git merge --ff-only --no-edit "$BRANCH"`, `git worktree
    remove`, `git branch -d "$BRANCH"` — does **not** pause, even though it performs a merge and a
    branch deletion. This is the single carve-out from Principle #6, and it is safe by construction:
-   `git merge --ff-only` refuses rather than rewriting history when the base ref has moved, and
+   `git merge --ff-only --no-edit` refuses rather than rewriting history when the base ref has moved, and
    `git branch -d` (lowercase) refuses to delete a branch that is not fully merged. Both fail closed,
    so no work can be lost — the property #6 exists to protect. When FF is impossible, WT-4 falls
    through to the WT-5 retention path, which leaves the worktree and branch intact. Every other

package/plugins/sp/skills/spur-dev/references/dev-operations.md

@@ -481,7 +481,7 @@ gate commands, pending questions and approval requirements.>
 ### 13. runall
 
 - **Purpose:** Run a batch of tasks through their pipelines in dependency-correct order — resolve a set, topo-sort, run each via `task-pipeline.yaml`, inspect verdicts, apply the failure policy, emit a batch report.
-- **Inputs:** `--tasks <selector>` (required — explicit WBS list, status pseudo-list, `feature:<id>`, or `ready`). `--mode <sequential|parallel>` (default `sequential`; `parallel` fans out a proven-independent subset per `execution-batch.md` § Parallel Execution). `--keep-going` skips a failed task's in-batch dependents and continues independents (default halts on first failure). `--auto` sets `profile=auto` on each per-task run (skips the HITL approve gate). `--feature <id>` is sugar for `--tasks feature:<id>`; when the effective selector is feature-derived, the batch runs `spur feature check <id> --fix --json` then `spur feature check <id> --strict --json` **once** before task resolution — a non-zero strict check aborts with verdict `aborted`, zero attempted tasks, and the structured findings (task 0510 R2); scoped: `L4.scenario-unverified` and `L4.verifying-incomplete-tasks` (expected pre-run states of a not-yet-run or reopened feature) are reported verbatim but do not abort — the non-aborting set is `NON_ABORTING_PREFLIGHT_CODES` behind `spur task preflight --classify-feature` and `--fix` repairs are listed under `autoRepairs` — any other strict error aborts. Explicit WBS/status/`ready` selectors add no feature check. The orchestrator loop itself continues in this session; interactive sequential omit/`inline` uses the host driver — host-controlled with eligible `agent.run` stages dispatching once to a native subagent and host fallback (task 0508) — while `--agent auto`/a name, parallel mode, and headless invocation keep the isolated per-task workflow subprocess boundary. `--agent <inline|auto|name>` pins the executor for the per-task stages (see [SSOT](cross-cutting.md#inline-default-execution-surface)); the value crosses into per-task `vars.agent`, not the orchestrator. `--json` emits the report as JSON. `--wrap` triggers `wrapup-pipeline.yaml` **once for the batch** over the `done` subset only (execution-batch.md Step 6: `vars.feature` only when every frozen task is `done`/`cancelled`; empty done subset skips with a reason), `--next` chains each task to terminal status then runs the same batch-once wrap, `--continue` resumes from checkpoint. `--no-summary` skips the [execution summary](#execution-summary) printed after the batch report (one row per attempted run).
+- **Inputs:** `--tasks <selector>` (required — explicit WBS list, status pseudo-list, `feature:<id>`, or `ready`). `--mode <sequential|parallel>` (default `sequential`; `parallel` fans out a proven-independent subset per `execution-batch.md` § Parallel Execution). `--keep-going` skips a failed task's in-batch dependents and continues independents (default off; `--auto` implies `--keep-going`, so an unattended batch never stops for a human — 1318 R1). `--auto` sets `profile=auto` on each per-task run (skips the HITL approve gate). `--feature <id>` is sugar for `--tasks feature:<id>`; when the effective selector is feature-derived, the batch runs `spur feature check <id> --fix --json` then `spur feature check <id> --strict --json` **once** before task resolution — a non-zero strict check aborts with verdict `aborted`, zero attempted tasks, and the structured findings (task 0510 R2); scoped: `L4.scenario-unverified` and `L4.verifying-incomplete-tasks` (expected pre-run states of a not-yet-run or reopened feature) are reported verbatim but do not abort — the non-aborting set is `NON_ABORTING_PREFLIGHT_CODES` behind `spur task preflight --classify-feature` and `--fix` repairs are listed under `autoRepairs` — any other strict error aborts. Explicit WBS/status/`ready` selectors add no feature check. The orchestrator loop itself continues in this session; interactive sequential omit/`inline` uses the host driver — host-controlled with eligible `agent.run` stages dispatching once to a native subagent and host fallback (task 0508) — while `--agent auto`/a name, parallel mode, and headless invocation keep the isolated per-task workflow subprocess boundary. `--agent <inline|auto|name>` pins the executor for the per-task stages (see [SSOT](cross-cutting.md#inline-default-execution-surface)); the value crosses into per-task `vars.agent`, not the orchestrator. `--json` emits the report as JSON. `--wrap` triggers `wrapup-pipeline.yaml` **once for the batch** over the `done` subset only (execution-batch.md Step 6: `vars.feature` only when every frozen task is `done`/`cancelled`; empty done subset skips with a reason), `--next` chains each task to terminal status then runs the same batch-once wrap, `--continue` resumes from checkpoint. `--no-summary` skips the [execution summary](#execution-summary) printed after the batch report (one row per attempted run).
 - **Three orthogonal axes (do not confuse):** `--keep-going` = batch failure policy (halt vs skip dependents); `--continue` = resume from checkpoint against the batch's original frozen identity (execution-batch.md § Batch continuation, task 0919); `--next` = per-task lifecycle chaining (advance status on a verdict — `dev-verify`/`dev-verifyall` only). `routing-table.md` offers `--continue` and `--next` as competing options for the same situation only when the batch was interrupted mid-run; otherwise they address different problems.
 - **Backing:** `sp:spur-dev` skill, `runall` operation → delegates the driver loop to the **`sp:super-planner`** agent (the batch orchestrator).
 - **Behavior:** The orchestrator reads [execution-batch.md](execution-batch.md) and drives: resolve selector → freeze set → topo-sort by `dependencies[]` (Kahn, WBS-ascending tie-break; cycle aborts) → resolve out-of-set deps by status (done → allow, else → block subtree) → run each task via `spur workflow run task-pipeline.yaml --async` + `spur workflow trace` polling → inspect terminal state + `.spur/run/<wbs>-verdict.json` → stop-the-batch default or `--keep-going` subtree skip → emit batch report. Per-task pipeline is invoked **verbatim** — no new FSM, no step edits. `--auto`/`--agent` are the only flags that cross the orchestrator→pipeline boundary (both into per-task `--vars`).

package/plugins/sp/skills/spur-dev/references/execution-batch-report.md

@@ -20,21 +20,29 @@ results). A `paused` task is non-terminal — the report marks it `paused` (neve
 the resume command. Unless `--no-summary`, follow it with the measured
 [execution summary](dev-operations.md#execution-summary), one `--progress <wbs>=<file>` per attempted run.
 
+Under `--auto` the report's mode field reads `Mode: --auto (keep-going)`, and `--auto` implies `--keep-going`:
+an unattended batch never stops for a human (1318 R1). For an `--agent auto` or
+`--agent <name>` batch, print the header `Executor pin: <name> (from <wbs>|--agent)` and fill the
+per-task `Executor` column with the pinned executor, or `A → B (failed-agent)` for a run that was
+re-dispatched once on a new executor (1318 R2–R4). Leave that line and column out for host-inline
+runs, which have no executor to pin.
+
 ```
 ## Batch Report — <selector>
 
 **Selector:** <value>
 **Plan:** <n> tasks (ordered: <wbs-list>) · <m> blocked · <p> not-attempted
-**Mode:** stop-the-batch | --keep-going | --auto
+**Mode:** stop-the-batch | --keep-going | --auto (keep-going)
+**Executor pin:** <name> (from <wbs>|--agent)   ← `--agent auto`/`--agent <name>` runs only
 **Verdict:** clean | halted | aborted
 
-| WBS | Status | Reason |
-|-----|--------|--------|
-| 0040 | done | — |
-| 0042 | failed | verify verdict PARTIAL (see .spur/run/0042-verdict.json) |
-| 0050 | not-attempted | batch halted after 0042 (stop-the-batch) |
-| 0051 | skipped | dependency 0040 failed (--keep-going) |
-| 0060 | blocked | unmet out-of-set dep: 0099 is wip |
+| WBS | Status | Executor | Reason |
+|-----|--------|----------|--------|
+| 0040 | done | claude | — |
+| 0042 | failed | codex-a → codex-b (failed-agent) | verify verdict PARTIAL (see .spur/run/0042-verdict.json) |
+| 0050 | not-attempted | — | batch halted after 0042 (stop-the-batch) |
+| 0051 | skipped | — | dependency 0040 failed (--keep-going) |
+| 0060 | blocked | — | unmet out-of-set dep: 0099 is wip |
 
 **Next:** <one-line action — pick up halted run / resolve 0099 / all green, feature H1 complete>
 

package/plugins/sp/skills/spur-dev/references/execution-batch.md

@@ -23,6 +23,9 @@ see_also:
   [execution-batch-continuation.md](execution-batch-continuation.md) for `--continue`.
 - **Never re-derive the plan** — the frozen plan is the persisted report; a new selector match is
   `not-admitted`, not a plan change.
+- **Fresh session per segment** — when host context nears its limit, stop after a task terminal and
+  resume in a new session with `--continue`; the persisted report and markers carry the state. A
+  near-full context slows every later turn and degrades judgment.
 
 ## What this file owns
 
@@ -146,6 +149,13 @@ recorded in the batch report, and independent tasks keep running. The batch does
 - **without `--auto`:** unchanged halt behavior — the batch stops on the failing task (`--keep-going`
 still skips only its in-batch dependents).
 
+**`--auto` implies `--keep-going` (1318 R1).** An unattended batch never stops for a human: under
+`--auto` every per-task failure follows §4.2 whether or not the flag is passed — a failed,
+cancelled, `stale-evidence` or worker-lost (1317) task is recorded `failed`, its in-batch
+dependents are `skipped` with `dependency <wbs> failed`, and independent tasks keep running. The
+refine pass above is only the extra step before that, not an exception. Without `--auto` the §4.1
+stop-the-batch default is unchanged. No new flag.
+
 `--tasks <value>` (or the effective value after normalization) resolves to a frozen set of task WBS numbers. Resolution happens **once, at
 kickoff** — the driver never re-queries `spur task list` to recompute membership mid-batch (R2.1).
 
@@ -408,6 +418,18 @@ The host session remains the orchestrator for interactive sequential omit/inline
 owns explicit-executor and parallel paths; there the flag pins the per-task step executor, not the
 orchestrator.
 
+**Executor pin (1318 R2/R3).** `--agent auto` is resolved **once per batch**, not once per task:
+after the first task run, read the resolved implement executor from that run's implement `agent.run`
+trace event — `spur workflow trace <run> --json` → `.events[] | select(.node=="implement" and
+.actionKind=="agent.run") | .result.executor` — and dispatch every later task with
+`--agent <that executor>`. The report's header records `Executor pin: <name> (from <wbs>)`; an
+explicit `--agent <name>` records `(from --agent)` and needs no resolution. A task whose run ends
+with `terminalReason == "failed-agent"` is re-dispatched **exactly once** with `--agent auto`; a
+different resolved executor then becomes the pin for the remaining tasks, and a second
+`failed-agent` records the task `failed` under the failure policy with the pin kept. No other terminal reason
+is ever retried on a new executor. `--agent inline` (host driver) has no executor
+to pin, so R2/R3 do not apply.
+
 ### 3.3 Terminal-state inspection
 
 Each pipeline run ends in one of two terminal states:
@@ -525,10 +547,11 @@ belongs to a subagent or the operator, not to the batch controller's report loop
 
 ## Step 4 — Failure policy (R3)
 
-### 4.1 Stop-the-batch (default) (R3.1)
+### 4.1 Stop-the-batch (default unless `--auto`) (R3.1)
 
-By default, the **first** pipeline failure halts the batch. Remaining tasks in the plan are reported
-as `not-attempted`. The report lists succeeded, failed, and not-attempted tasks.
+By default — i.e. without `--auto` (1318 R1) — the **first** pipeline failure halts the batch.
+Remaining tasks in the plan are reported as `not-attempted`. The report lists succeeded, failed,
+and not-attempted tasks.
 
 **Run-failed / task-done (observed 2026-10-19, feature P1).** A run can fail *after* the task is
 already finished: the `done` state's close commands run last, and a lint or anchor rule can refuse
@@ -540,9 +563,10 @@ contract, not to a run whose last recorded state was superseded. Surface it in t
 way (never silently continue), and never re-run the pipeline just to flip a run row from `failed` to
 `done` — a second run re-executes model stages for a task that is already closed.
 
-### 4.2 `--keep-going` (R3.2)
+### 4.2 `--keep-going` (R3.2), or implied by `--auto`
 
-With `--keep-going`, a failed task does **not** halt the batch. Instead:
+With `--keep-going` — passed explicitly, or implied by `--auto` (1318 R1) — a failed task does
+**not** halt the batch. Instead:
 
 - The failed task's **in-batch dependents** (tasks in the plan that transitively depend on it) are
   marked `skipped` with the failed dependency as the reason — they cannot run because their dep did

package/plugins/sp/skills/spur-dev/references/execution-parallel-isolation.md

@@ -62,7 +62,7 @@ task from the main tree; integrations are **serialized** (one at a time) in comp
 integrate(t):
   git -C "$WT" rebase "$BASE_REF"                # replay onto the CURRENT base tip (re-read per integration)
   ├─ rebase fails → git -C "$WT" rebase --abort → conflict path (R4) below
-  └─ rebase clean → git checkout "$BASE_REF" → zero-commit guard → git merge --ff-only "$BRANCH"
+  └─ rebase clean → git checkout "$BASE_REF" → zero-commit guard → git merge --ff-only --no-edit "$BRANCH"
                     → WT-4a verdict persist → WT-4b holders → WT-4c registry
                     → git worktree remove → existence-guarded git branch -D → marker merged
 ```
@@ -82,7 +82,7 @@ commands:
 
 ```
 resume:  cd <worktree-path> && git rebase <BASE_REF>   # the operator resolves, never the driver
-merge:   git checkout <BASE_REF> && git merge --ff-only <branch>
+merge:   git checkout <BASE_REF> && git merge --ff-only --no-edit <branch>
 discard: git worktree remove <worktree-path> && git branch -D <branch> && spur projects remove <worktree-path>
 ```
 

package/plugins/sp/skills/spur-dev/references/execution-workflow.md

@@ -64,6 +64,17 @@ default. See the [inline-default execution-surface contract](cross-cutting.md#in
 
 > **Single-run & parse discipline (suite run cost control).** Run full quality/test suites (`bun run check` / `spur-check`) at most ONCE per task iteration (task 0436 R2). Parse failure details from the single retained command output rather than re-running full suites repeatedly to inspect errors. Re-run targeted/narrow test files (e.g. `bun test <file> --test-name-pattern <pattern>`) while iterating on fixes, and re-run the full suite only when all targeted fixes pass.
 
+## File mutation in a driven run (task 1319 R6/R9)
+
+The driver and every dispatched implement stage mutate files with `Edit`/`Write`. A `python3 - <<PY`
+heredoc, `sed -i` or `perl -pi` file mutation is a **defect**: it carries scaffolding through the
+context instead of a diff, and a silent no-op replace cannot be told apart from success. The
+credit-sentry run (2026-11-06→08) spent 291 such edits, 248 of them on source and tests, while the
+same work needed one edit call each.
+
+Focused verification inside implement is `spur task gate <wbs> light` — never a hand-rolled
+`bunfig.toml` and never the root-cwd `bun test`. The full gate belongs to the pipeline's `gate` state.
+
 ## Section ownership — one writer per evidence section (F92 0593 R1)
 
 | Section | Writer |

package/plugins/sp/skills/spur-dev/references/execution-worktree-landing.md

@@ -74,7 +74,9 @@ git merge-base --is-ancestor "$BASE_TIP" "$BATCH_TIP" || ANCESTRY_RC=$?
   git log --oneline "$BASE_TIP..$BATCH_TIP" >&2   # batch-side divergent commits
   git log --oneline "$BATCH_TIP..$BASE_TIP" >&2   # base-side divergent commits
   exit 1; }   # -> WT-5: tree + branch retained, marker stays "active"
-git merge --ff-only "$BRANCH"          # FF-only: never rebase, merge-commit, or resolve conflicts
+git merge --ff-only --no-edit "$BRANCH"   # FF-only: never rebase, merge-commit, or resolve conflicts
+# `--no-edit` is load-bearing in agent environments (task 1320): a host policy blocks a bare
+# `git merge` because it could open an editor, even for a fast-forward that writes no message.
 [ $? -eq 0 ] \
   || { echo "WT-4 halt: FF-merge failed - the concurrent-writer race survives every precheck; marker stays \"active\"" >&2; exit 1; }   # -> WT-5
 # Landed verification before anything else runs: the captured BATCH_TIP must be an ancestor of
@@ -231,14 +233,14 @@ socket, and `lsof` port discovery failing must not hide the PIDs.
 #### Reuse mode — merge, retain
 
 The fail-stop merge sequence runs identically — same guard, captured `BATCH_TIP`/`BASE_TIP`,
-ancestry check immediately before FF, `git merge --ff-only`, landed verification (per-call pinned
+ancestry check immediately before FF, `git merge --ff-only --no-edit`, landed verification (per-call pinned
 to the invoking tree, task 1058) — but no WT-4a/4b/4c and no removal: the worktree and branch are
 **retained**. Pre-merge halts leave the marker `active`; a persistence failure after the landed
 merge records `retained` + `mergeCommit`:
 
 ```bash
 # Same fail-stop sequence as create mode (zero-commit guard -> BATCH_TIP/BASE_TIP -> ancestry
-# rc check -> git merge --ff-only -> landed verify); local refs only — no fetch.
+# rc check -> git merge --ff-only --no-edit -> landed verify); local refs only — no fetch.
 MARKER=".spur/run/worktree-<marker-id>.json"
 git checkout "$BASE_REF" \
   || { echo "WT-4 halt: checkout $BASE_REF failed - nothing merged, marker stays \"active\"" >&2; exit 1; }   # -> WT-5
@@ -255,7 +257,9 @@ git merge-base --is-ancestor "$BASE_TIP" "$BATCH_TIP" || ANCESTRY_RC=$?
   git log --oneline "$BASE_TIP..$BATCH_TIP" >&2
   git log --oneline "$BATCH_TIP..$BASE_TIP" >&2
   exit 1; }   # -> WT-5: tree + branch retained, marker stays "active"
-git merge --ff-only "$BRANCH"          # FF-only: never rebase, merge-commit, or resolve conflicts
+git merge --ff-only --no-edit "$BRANCH"   # FF-only: never rebase, merge-commit, or resolve conflicts
+# `--no-edit` is load-bearing in agent environments (task 1320): a host policy blocks a bare
+# `git merge` because it could open an editor, even for a fast-forward that writes no message.
 [ $? -eq 0 ] \
   || { echo "WT-4 halt: FF-merge failed - the concurrent-writer race survives every precheck; marker stays \"active\"" >&2; exit 1; }
 LANDED_BASE_TIP="$(git rev-parse "$BASE_REF")" \
@@ -301,7 +305,7 @@ invoking tree there too — after the Step 5 persistence, before the success mar
 appends the same stale-links warning to the persisted batch report, and the success marker still
 records `merged`.
 
-**Fast-forward only.** `git merge --ff-only` is the sole mutation of the terminal sequence; every
+**Fast-forward only.** `git merge --ff-only --no-edit` is the sole mutation of the terminal sequence; every
 other step is a read, a check, a persistence write, or a cleanup, and every tip/ancestry read uses
 local refs — no fetch runs anywhere in this lifecycle. If the fresh `BASE_TIP` is not an ancestor of
 `BATCH_TIP`, the ancestry check halts before the merge: the report names both tips and both
@@ -412,7 +416,7 @@ landed-but-incomplete: the batch merge LANDED as <batch-tip-sha> on <base-ref>;
 Resume, merge, or discard:
 
   resume:  cd <worktree-path> && <command> --continue --worktree <worktree-path>
-  merge:   git checkout <base-ref> && git merge <branch>     # resolve conflicts manually
+  merge:   git checkout <base-ref> && git merge --no-edit <branch>   # resolve conflicts manually
   discard: git worktree remove <worktree-path> && git branch -D <branch> && spur projects remove <worktree-path>
 ```
 

package/plugins/sp/skills/spur-dev/references/execution-worktree-setup.md

@@ -187,6 +187,21 @@ generator runs. In this repo that is `apps/cli/config/` (from `bun run bundle:co
 directory (observed 2026-10-12, A91 batch). Run the generator once after a create-mode install, and
 again after a rebase or merge that touches the canonical workflow sources it is built from.
 
+**A fresh worktree cannot commit until its tool config is trusted (task 1320).** `proto` refuses to
+load a project's `.prototools` in a path it has not seen, so the repo's `cog` commit-msg hook cannot
+run and WT-3b's commit exits 1 with:
+
+    Unable to proceed, the plugin for cog is configured in <worktree>/.prototools, which has not been
+    trusted, so it was not loaded.
+
+Trust it once per created tree, best-effort and only when the project ships the file (a missing
+`.prototools` or a `proto` that does not prompt is not an error — the commit is what proves it):
+
+    cd "../<worktree-dir>" && [ ! -f .prototools ] || proto trust .prototools
+
+The trust decision is per absolute path, so a reuse-mode tree that was already trusted needs nothing
+and a re-cut tree always does.
+
 #### Reuse mode (`--worktree <name>`)
 
 Creation is **skipped entirely**. `$BRANCH` is the resolved worktree's already-checked-out branch; a

package/plugins/sp/skills/spur-dev/references/flag-glossary.md

@@ -138,6 +138,11 @@ Only declared where the command already has at least one HITL gate the flag can
 taste gates (idea-eval, design-approval) — every gate there is reversible corpus writes. A gate
 without an actionable recommendation (missing eval recommendation, FAIL design check) still pauses.
 
+**Batch policy** (`dev-runall`): `--auto` implies `--keep-going` — an unattended batch never stops
+for a human. With `--agent auto` the driver also pins ONE executor for the batch — `Executor pin:
+<name>`, read from the first run's implement `result.executor` — and only a `failed-agent` ending
+re-resolves it, exactly once (1318 R1–R3).
+
 ### `--keep-going` — batch failure policy: skip dependents, continue independents
 
 **Anchor:** `#flag-keep-going`.
@@ -146,6 +151,10 @@ Batch operation only (`dev-refineall`, `dev-runall`). When a task in the batch
 fails, skip its in-batch dependents and continue the independent ones, instead of the default
 halt-on-first-failure. Never silently retried; the failure is still reported.
 
+**Default:** off, except under `--auto` — `--auto` implies `--keep-going` (1318 R1), because an
+unattended batch that stops to wait for a human is the defect it was supposed to avoid. To stop at
+the first failure, run without `--auto`.
+
 ### `--defer-gate` — opt-in parallel-batch gate policy (task 1111 / H15)
 
 **Applies to:** `/sp-dev-runall --mode parallel`, and `--mode auto` when it resolves to parallel.