@gobing-ai/spur 0.4.27 → 0.4.28

package/spur.js

@@ -55606,6 +55606,38 @@ async function readWorkflowStateVisitRows(db, workflows, opts = {}) {
   }
   return rows;
 }
+async function readWorkflowHostPauseRows(db, workflows, opts = {}) {
+  const sql = `SELECT json_extract(r.metadata_json, '$.hostPauses') AS hostPausesJson
+               FROM runs r
+              WHERE r.workflow_name = ?
+                AND ${perStatePopulation(opts.sinceMs)}
+                AND json_extract(r.metadata_json, '$.hostPauses') IS NOT NULL`;
+  const rows = [];
+  for (const workflow of workflows) {
+    const found = await db.queryAll(sql, workflow, ...TERMINAL_RUN_STATUSES, ...opts.sinceMs !== undefined ? [opts.sinceMs] : []);
+    for (const r of found)
+      rows.push({ workflow, hostPausesJson: r.hostPausesJson });
+  }
+  return rows;
+}
+async function readWorkflowOpenPauseRows(db, workflows) {
+  const sql = `SELECT r.id AS runId, r.updated_at AS updatedAt,
+                    (SELECT a.result_json FROM action_runs a
+                      WHERE a.run_id = r.id AND (a.status = 'paused' OR a.result_json LIKE '%"pause":true%')
+                      ORDER BY a.created_at DESC, a.rowid DESC LIMIT 1) AS pausedResultJson
+               FROM runs r
+              WHERE r.workflow_name = ?
+                AND r.status IN ('paused', 'interrupted')
+                AND json_extract(r.metadata_json, '$.dryRun') IS NOT 1
+              ORDER BY r.id`;
+  const rows = [];
+  for (const workflow of workflows) {
+    const found = await db.queryAll(sql, workflow);
+    for (const r of found)
+      rows.push({ workflow, ...r });
+  }
+  return rows;
+}
 var TERMINAL_RUN_STATUSES;
 var init_workflow_measurements = __esm(() => {
   TERMINAL_RUN_STATUSES = ["done", "failed", "cancelled"];
@@ -58117,7 +58149,7 @@ var init_run_dao = __esm(() => {
       });
     }
     traceRows(filter) {
-      return this.adapter.queryAll(`SELECT id, workflow_name, mode, status, agent, started_at, completed_at, metadata_json
+      return this.adapter.queryAll(`SELECT id, workflow_name, mode, status, agent, started_at, completed_at, metadata_json, updated_at
              FROM runs
              WHERE (?1 IS NULL OR workflow_name = ?1)
                AND (?2 IS NULL OR status = ?2)
@@ -58131,7 +58163,7 @@ var init_run_dao = __esm(() => {
              LIMIT ?6`, filter.workflow ?? null, filter.status ?? null, filter.since ?? null, filter.before?.started_at ?? null, filter.before?.id ?? null, filter.limit);
     }
     traceRowById(runId) {
-      return this.adapter.queryFirst("SELECT id, workflow_name, mode, status, agent, started_at, completed_at, terminal_reason, metadata_json, pid FROM runs WHERE id = ?", runId);
+      return this.adapter.queryFirst("SELECT id, workflow_name, mode, status, agent, started_at, completed_at, updated_at, terminal_reason, metadata_json, pid FROM runs WHERE id = ?", runId);
     }
     mergeMetadata(runId, patch) {
       return this.adapter.run(`UPDATE runs
@@ -104895,7 +104927,16 @@ class AgentRunActionRunner {
         error: `agent.run: work item for '${context.stateOrNodeId}' could not be written: ${error.message}`
       };
     }
-    return { ok: true, pause: true, data: { surface: "host", workItem, reason: "host-work-item" } };
+    return {
+      ok: true,
+      pause: true,
+      data: {
+        surface: "host",
+        workItem,
+        reason: "host-work-item",
+        ...invocation.timeoutMs !== undefined ? { timeoutMs: invocation.timeoutMs } : {}
+      }
+    };
   }
   async execute(options, context, execution) {
     const startedAt = new Date().toISOString();
@@ -121379,6 +121420,102 @@ var init_process_inventory_service = __esm(() => {
   init_process_inspector();
 });
 
+// ../../packages/app/src/workflow/host-pause.ts
+function readHostPauses(metadata) {
+  if (metadata === null || typeof metadata !== "object")
+    return [];
+  const raw = metadata[HOST_PAUSES_KEY];
+  if (!Array.isArray(raw))
+    return [];
+  const out = [];
+  for (const entry of raw) {
+    if (entry === null || typeof entry !== "object")
+      continue;
+    const row = entry;
+    const { node, action, pausedAt, resumedAt, hostDurationMs } = row;
+    if (typeof node !== "string" || typeof pausedAt !== "string" || typeof resumedAt !== "string")
+      continue;
+    if (typeof hostDurationMs !== "number" || !Number.isFinite(hostDurationMs))
+      continue;
+    out.push({
+      node,
+      action: typeof action === "string" ? action : "agent.run",
+      pausedAt,
+      resumedAt,
+      hostDurationMs,
+      ...typeof row.executor === "string" ? { executor: row.executor } : {}
+    });
+  }
+  return out;
+}
+function appendHostPause(metadata, pause) {
+  return [...readHostPauses(metadata), pause];
+}
+function hostPauseMsByNode(pauses) {
+  const totals = new Map;
+  for (const pause of pauses)
+    totals.set(pause.node, (totals.get(pause.node) ?? 0) + pause.hostDurationMs);
+  return totals;
+}
+function hostDurationMs(pausedAt, resumedAt) {
+  const start = Date.parse(pausedAt);
+  const end = Date.parse(resumedAt);
+  if (!Number.isFinite(start) || !Number.isFinite(end) || end < start)
+    return null;
+  return end - start;
+}
+function isDegenerateReceiptInterval(startedAt, finishedAt) {
+  if (startedAt === undefined || finishedAt === undefined)
+    return true;
+  const start = Date.parse(startedAt);
+  const end = Date.parse(finishedAt);
+  if (!Number.isFinite(start) || !Number.isFinite(end))
+    return true;
+  return end <= start;
+}
+function resolveStallThresholdMs(nodeTimeoutMs, readEnvVar = getEnvVar) {
+  if (nodeTimeoutMs !== undefined && Number.isFinite(nodeTimeoutMs) && nodeTimeoutMs > 0)
+    return nodeTimeoutMs;
+  const raw = readEnvVar(STALL_THRESHOLD_MS_ENV);
+  if (raw !== undefined) {
+    const parsed = Number(raw);
+    if (Number.isFinite(parsed) && parsed > 0)
+      return Math.trunc(parsed);
+  }
+  return STALL_THRESHOLD_MS_DEFAULT;
+}
+function openPauseMs(pausedAt, nowMs) {
+  if (pausedAt === null || pausedAt === undefined)
+    return null;
+  const start = typeof pausedAt === "number" ? pausedAt : /^\d+$/.test(pausedAt) ? Number(pausedAt) : Date.parse(pausedAt);
+  if (!Number.isFinite(start))
+    return null;
+  return Math.max(0, nowMs - start);
+}
+function pausedNodeBudgetMs(rows) {
+  for (let i = rows.length - 1;i >= 0; i--) {
+    const row = rows[i];
+    if (row === undefined || row.result_json === null)
+      continue;
+    if (row.status !== "paused" && !/"pause"\s*:\s*true/.test(row.result_json))
+      continue;
+    try {
+      const budget = JSON.parse(row.result_json)?.data?.timeoutMs;
+      return typeof budget === "number" && Number.isFinite(budget) && budget > 0 ? budget : undefined;
+    } catch {
+      return;
+    }
+  }
+  return;
+}
+function stalledLabel(runId, pauseMs) {
+  return `stalled \u2014 paused ${Math.round(pauseMs / 1000)}s; resume: spur workflow continue ${runId}`;
+}
+var HOST_PAUSES_KEY = "hostPauses", STALL_THRESHOLD_MS_DEFAULT = 1800000, STALL_THRESHOLD_MS_ENV = "SPUR_WORKFLOW_STALL_MS";
+var init_host_pause = __esm(() => {
+  init_src();
+});
+
 // ../../packages/app/src/workflow/run-measurements.ts
 function median(values) {
   if (values.length === 0)
@@ -121479,6 +121616,18 @@ async function readStateMetrics(db, workflows, opts = {}) {
     row.visits += t.visitsInRun;
     row.retries += Math.max(0, t.visitsInRun - 1);
   }
+  for (const h of await readWorkflowHostPauseRows(db, workflows, opts)) {
+    let parsed;
+    try {
+      parsed = JSON.parse(h.hostPausesJson);
+    } catch {
+      continue;
+    }
+    for (const [node, ms] of hostPauseMsByNode(readHostPauses({ hostPauses: parsed }))) {
+      const row = rowFor(h.workflow, node);
+      row.hostMs = (row.hostMs ?? 0) + ms;
+    }
+  }
   const rows = [];
   for (const [workflow, states] of byWorkflow) {
     for (const [state, row] of states) {
@@ -121489,14 +121638,27 @@ async function readStateMetrics(db, workflows, opts = {}) {
         agentRunCount: row.agentRunCount,
         wallMsP50: nearestRankPercentile(row.wallSamples, 50),
         wallMsP90: nearestRankPercentile(row.wallSamples, 90),
-        retries: row.retries
+        retries: row.retries,
+        ...row.hostMs !== undefined ? { hostMs: row.hostMs } : {}
       });
     }
   }
   return rows.sort((a, b) => a.workflow === b.workflow ? a.state < b.state ? -1 : a.state > b.state ? 1 : 0 : a.workflow < b.workflow ? -1 : 1);
 }
+async function readStalledRuns(db, workflows, nowMs = Date.now()) {
+  const stalled = [];
+  for (const row of await readWorkflowOpenPauseRows(db, workflows)) {
+    const ageMs = openPauseMs(row.updatedAt, nowMs);
+    const budget = pausedNodeBudgetMs([{ status: "paused", result_json: row.pausedResultJson }]);
+    if (ageMs !== null && ageMs > resolveStallThresholdMs(budget)) {
+      stalled.push({ workflow: row.workflow, runId: row.runId, stalledMs: ageMs });
+    }
+  }
+  return stalled;
+}
 var init_run_measurements = __esm(() => {
   init_src2();
+  init_host_pause();
   init_terminal_reason();
 });
 
@@ -130963,6 +131125,174 @@ var init_token_ledger_watcher = __esm(() => {
   init_token_ledger_service();
 });
 
+// ../../packages/app/src/services/sdlc-actions.ts
+function isReservedAction(name) {
+  return RESERVED_ACTIONS.includes(name);
+}
+function resolveAction(builder, name) {
+  const reserved = isReservedAction(name);
+  const declared = builder?.actions?.[name];
+  if (declared !== undefined) {
+    return Array.isArray(declared) ? { name, reserved, source: "config", kind: "composite", steps: [...declared] } : { name, reserved, source: "config", kind: "command", command: declared };
+  }
+  if ((builder?.preset ?? "bun") === "bun") {
+    if (reserved)
+      return { name, reserved, source: "preset", kind: "command", command: BUN_PRESET[name] };
+  } else {
+    const command = reserved ? STACK_NEUTRAL_DEFAULTS[name] : undefined;
+    if (command !== undefined)
+      return { name, reserved, source: "default", kind: "command", command };
+  }
+  return { name, reserved, source: "unbound", kind: "unbound" };
+}
+function listActions(builder) {
+  const custom = Object.keys(builder?.actions ?? {}).filter((name) => !isReservedAction(name)).sort();
+  return [...RESERVED_ACTIONS, ...custom].map((name) => resolveAction(builder, name));
+}
+function renderScoped(command, values) {
+  let rendered = command;
+  for (const [placeholder, items] of [
+    ["{files}", values.files],
+    ["{paths}", values.paths]
+  ]) {
+    if (!rendered.includes(placeholder))
+      continue;
+    if (items === undefined)
+      throw new Error(`renderScoped: ${placeholder} has no value`);
+    if (items.length === 0)
+      throw new Error(`renderScoped: ${placeholder} has an empty list`);
+    rendered = rendered.replaceAll(placeholder, () => items.map(shQuote2).join(" "));
+  }
+  if (rendered.includes("{workspace}")) {
+    const workspace = values.workspace;
+    if (workspace === undefined)
+      throw new Error("renderScoped: {workspace} has no value");
+    if (workspace.length === 0)
+      throw new Error("renderScoped: {workspace} is empty");
+    rendered = rendered.replaceAll("{workspace}", () => shQuote2(workspace));
+  }
+  return rendered;
+}
+var RESERVED_ACTIONS, BUN_PRESET, STACK_NEUTRAL_DEFAULTS;
+var init_sdlc_actions = __esm(() => {
+  init_src();
+  RESERVED_ACTIONS = SDLC_ACTIONS;
+  BUN_PRESET = {
+    build: "bun run build",
+    dev: "bun run dev",
+    clean: "bun run clean",
+    format: "bun run format",
+    autofix: "bun run autofix",
+    lint: "bun run lint",
+    typecheck: "bun run typecheck",
+    test: "bun run test",
+    "test-full": "bun run test:full",
+    "test-heavy": "bun run test:heavy",
+    "rules-pre": "bun run test-pre-check",
+    "rules-post": "bun run test-post-check",
+    check: "bun run spur-check",
+    "check-full": "bun run spur-check:full",
+    "check-feature": "bun run spur-check-feature",
+    "lint-changed": "bunx biome check {files}",
+    "typecheck-changed": "cd {workspace} && bun run typecheck",
+    "test-changed": "cd {workspace} && bun test {paths}"
+  };
+  STACK_NEUTRAL_DEFAULTS = SDLC_STACK_NEUTRAL_ACTIONS;
+});
+
+// ../../packages/app/src/services/verdict-replay.ts
+function citedTestAnchors(rows, max) {
+  const seen = new Map;
+  for (const row of rows) {
+    for (const anchor of extractBacktickLineAnchors(row.evidence ?? "")) {
+      if (!TEST_FILE_PATTERN.test(anchor.path) || seen.has(anchor.path))
+        continue;
+      seen.set(anchor.path, anchor.raw);
+    }
+  }
+  return new Map([...seen].slice(0, max));
+}
+function replayWorkspace(file) {
+  const parts = file.split("/");
+  if (parts.length >= 3 && (parts[0] === "apps" || parts[0] === "packages"))
+    return `${parts[0]}/${parts[1]}`;
+  return ".";
+}
+async function replayCitedTests(rows, options = {}) {
+  const cwd = options.cwd ?? process.cwd();
+  const timeoutMs = options.timeoutMs ?? REPLAY_TIMEOUT_MS;
+  const anchors = citedTestAnchors(rows, options.maxFiles ?? REPLAY_MAX_FILES);
+  const files = [...anchors.keys()];
+  const executor = options.executor ?? new NodeProcessExecutor2;
+  const fileSystem = options.fs ?? createNodeFileSystem2();
+  const resolved = resolveAction(options.builder, "test-changed");
+  const template = resolved.kind === "command" ? resolved.command : resolved.kind === "composite" ? resolved.steps.join(" && ") : "";
+  const ran = [];
+  const skipped = [];
+  const findings = [];
+  const thresholdByWorkspace = new Map;
+  for (const file of files) {
+    const anchor = anchors.get(file) ?? file;
+    const exists = await fileSystem.exists(`${cwd}/${file}`);
+    if (!exists) {
+      findings.push({ anchor, file, missing: true });
+      continue;
+    }
+    if (template.length === 0)
+      continue;
+    const workspace = replayWorkspace(file);
+    let threshold = thresholdByWorkspace.get(workspace);
+    if (threshold === undefined) {
+      threshold = await declaresCoverageThreshold(fileSystem, `${cwd}/${workspace}/bunfig.toml`);
+      thresholdByWorkspace.set(workspace, threshold);
+    }
+    if (threshold) {
+      skipped.push({ file, reason: `coverageThreshold in ${workspace}/bunfig.toml` });
+      continue;
+    }
+    const path = workspace === "." ? file : file.slice(workspace.length + 1);
+    const command = renderScoped(template, { workspace, paths: [path] });
+    const result = await executor.run({
+      command: "sh",
+      args: ["-c", command],
+      cwd,
+      forceBuffered: true,
+      rejectOnError: false,
+      timeout: timeoutMs
+    });
+    const exitCode = result.exitCode ?? null;
+    ran.push({ file, exitCode });
+    if (result.outcome === "timeout")
+      findings.push({ anchor, file, timedOut: true, exitCode });
+    else if (exitCode !== 0)
+      findings.push({ anchor, file, exitCode });
+  }
+  return { files, ran, skipped, findings };
+}
+async function declaresCoverageThreshold(fileSystem, bunfigPath) {
+  try {
+    if (!await fileSystem.exists(bunfigPath))
+      return false;
+    return COVERAGE_THRESHOLD_PATTERN.test(await fileSystem.readFile(bunfigPath));
+  } catch {
+    return false;
+  }
+}
+function formatReplayReport(replay) {
+  return {
+    summary: `Replay: ${replay.files.length} cited test file(s), ${replay.findings.length} finding(s)${replay.skipped.length > 0 ? `, ${replay.skipped.length} skipped` : ""}`,
+    findings: replay.findings.map((finding) => `  ${finding.anchor}: ${finding.missing ? "missing" : finding.timedOut ? "timed out" : `exit ${finding.exitCode ?? "unknown"}`}`)
+  };
+}
+var REPLAY_MAX_FILES = 5, REPLAY_TIMEOUT_MS = 120000, TEST_FILE_PATTERN, COVERAGE_THRESHOLD_PATTERN;
+var init_verdict_replay = __esm(() => {
+  init_dist5();
+  init_sdlc_actions();
+  init_task_check();
+  TEST_FILE_PATTERN = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
+  COVERAGE_THRESHOLD_PATTERN = /^\s*coverageThreshold\s*=/m;
+});
+
 // ../../packages/app/src/workflow/checkpoint-contract.ts
 function parseCheckpointMetadata(raw) {
   if (!raw.startsWith("---"))
@@ -131429,6 +131759,16 @@ function commandGateOutcome(exitCode) {
     return "FAIL";
   return "BLOCKED";
 }
+function asOptionalTimeoutMs(value) {
+  if (value === undefined || value === null)
+    return { ok: true, ms: undefined };
+  if (typeof value === "string" && value.trim() === "")
+    return { ok: true, ms: undefined };
+  const parsed = typeof value === "number" ? value : Number(value);
+  if (!Number.isFinite(parsed) || parsed <= 0)
+    return { ok: false };
+  return { ok: true, ms: Math.trunc(parsed) };
+}
 function sleep4(ms) {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
@@ -131498,13 +131838,21 @@ class CommandGateActionRunner {
     const maxAttempts = Math.max(1, typeof retry.maxAttempts === "number" ? retry.maxAttempts : 1);
     const delayMs = Math.max(0, typeof retry.delayMs === "number" ? retry.delayMs : 1000);
     const retryOn = Array.isArray(retry.on) ? retry.on : [];
-    const timeoutMs = typeof options.timeoutMs === "number" ? options.timeoutMs : undefined;
+    const timeout = asOptionalTimeoutMs(options.timeoutMs);
+    if (!timeout.ok) {
+      return {
+        ok: false,
+        error: `command.gate: timeoutMs must be a positive number, got "${String(options.timeoutMs)}"`
+      };
+    }
+    const timeoutMs = timeout.ms;
     const env = childProcessEnv(context.vars);
     await this.fileSystem.ensureDir(normalize3(join59(normalized, "..")));
     let lastStdout = "";
     let lastStderr = "";
     let lastExitCode = -1;
     let attemptsRun = 0;
+    let timedOut = false;
     for (let attempt = 1;attempt <= maxAttempts; attempt++) {
       attemptsRun = attempt;
       const res = await this.processExecutor.run({
@@ -131519,6 +131867,7 @@ class CommandGateActionRunner {
       lastStdout = res.stdout;
       lastStderr = res.stderr;
       lastExitCode = res.exitCode ?? -1;
+      timedOut = res.outcome === "timeout";
       if (res.exitCode === 0) {
         await this.fileSystem.writeFile(normalized, `PASS
 `);
@@ -131553,7 +131902,8 @@ ${lastStderr}`;
       attempts: attemptsRun,
       stdout: lastStdout,
       stderr: lastStderr,
-      resultFile: normalized
+      resultFile: normalized,
+      ...timedOut ? { timedOut: true, timeoutMs } : {}
     };
     if (softFail) {
       return { ok: true, data: failureData };
@@ -135179,13 +135529,14 @@ async function outputArtifactForRun(cwd, runId) {
   }
   return;
 }
-function rowToTraceEntry(row, cwd) {
+function rowToTraceEntry(row, cwd, nowMs = Date.now(), nodeBudgetMs) {
   let isDryRun = false;
   let failureReason;
   let version;
   let definitionDigest;
   let startState;
   let continuedFrom;
+  let hostPauses;
   try {
     const meta = JSON.parse(row.metadata_json);
     isDryRun = meta.dryRun === true;
@@ -135206,6 +135557,9 @@ function rowToTraceEntry(row, cwd) {
     if (typeof meta.continuedFrom === "string" && meta.continuedFrom !== "") {
       continuedFrom = meta.continuedFrom;
     }
+    const pauses = readHostPauses(meta);
+    if (pauses.length > 0)
+      hostPauses = pauses;
   } catch {}
   const entry = {
     runId: row.id,
@@ -135223,8 +135577,14 @@ function rowToTraceEntry(row, cwd) {
     ...version !== undefined ? { version } : {},
     ...definitionDigest !== undefined ? { definitionDigest } : {},
     ...startState !== undefined ? { startState } : {},
-    ...continuedFrom !== undefined ? { continuedFrom } : {}
+    ...continuedFrom !== undefined ? { continuedFrom } : {},
+    ...hostPauses !== undefined ? { hostPauses } : {}
   };
+  const pauseAgeMs = row.status === "paused" || row.status === "interrupted" ? openPauseMs(row.updated_at ?? null, nowMs) : null;
+  if (pauseAgeMs !== null && pauseAgeMs > resolveStallThresholdMs(nodeBudgetMs)) {
+    entry.stalled = true;
+    entry.stalledMs = pauseAgeMs;
+  }
   const nextAction = traceNextAction(entry);
   if (nextAction !== undefined)
     entry.nextAction = nextAction;
@@ -135269,7 +135629,11 @@ function traceNextAction(run, outputArtifact) {
     return { label: "Follow run", kind: "command", value: `spur workflow trace ${run.runId} --follow` };
   }
   if (run.status === "paused" || run.status === "interrupted") {
-    return { label: "Continue run", kind: "command", value: `spur workflow continue ${run.runId}` };
+    return {
+      label: run.stalled === true ? "Resume stalled run" : "Continue run",
+      kind: "command",
+      value: `spur workflow continue ${run.runId}`
+    };
   }
   if (run.status === "failed" && outputArtifact !== undefined) {
     return { label: "Inspect run log", kind: "path", value: outputArtifact };
@@ -135380,6 +135744,7 @@ var TRACE_IDENTIFIER, TRACE_RESULT_FIELDS, TRACE_INVOCATION_FIELDS;
 var init_workflow_trace_projection = __esm(() => {
   init_dist5();
   init_agent_execution();
+  init_host_pause();
   init_run_storage();
   init_system_event_envelope();
   TRACE_IDENTIFIER = /^[A-Za-z0-9._:-]+$/;
@@ -135558,20 +135923,19 @@ class WorkflowInspectOps {
       since: filter.since,
       limit: filter.last ?? 20
     });
-    return {
-      entries: rows.map((row) => rowToTraceEntry(row, this.ctx.cwd)),
-      total: rows.length
-    };
+    const actionDao = new ActionRunDao(db);
+    const entries = await Promise.all(rows.map(async (row) => rowToTraceEntry(row, this.ctx.cwd, Date.now(), row.status === "paused" || row.status === "interrupted" ? pausedNodeBudgetMs(await actionDao.actionRowsByRunId(row.id)) : undefined)));
+    return { entries, total: rows.length };
   }
   async traceRun(db, runId, preloadedRow) {
     const runDao = new RunDao(db);
     const row = preloadedRow ?? await runDao.traceRowById(runId);
     if (!row)
       throw new Error(`Run not found: ${runId}`);
-    const run = rowToTraceEntry(row, this.ctx.cwd);
+    const actionRows = await new ActionRunDao(db).actionRowsByRunId(runId);
+    const run = rowToTraceEntry(row, this.ctx.cwd, Date.now(), pausedNodeBudgetMs(actionRows));
     const phaseRows = await new PhaseRunDao(db).phaseRowsByRunId(runId);
     const transitionRows = await new TransitionRunDao(db).transitionRowsByRunId(runId);
-    const actionRows = await new ActionRunDao(db).actionRowsByRunId(runId);
     const costByActionId = new Map;
     if (actionRows.some((a) => a.kind === "agent.run")) {
       for (const a of actionRows) {
@@ -135679,6 +136043,7 @@ var init_workflow_inspect_ops = __esm(() => {
   init_dist5();
   init_decision_service();
   init_composition_lint();
+  init_host_pause();
   init_plan_projection();
   init_run_record();
   init_workflow_resolver();
@@ -136198,8 +136563,9 @@ class WorkflowResumeOps {
     if (persistedDigest !== null && persistedDigest !== resolved.digest && "resumeDefinitionDigest" in rawMeta) {
       resumeVars.__definitionDigest = resolved.digest;
     }
-    if (hostPause.receipt !== undefined) {
-      await writeReceipt(createNodeFileSystem2(launchWorkdir), launchWorkdir, hostPause.receipt);
+    const stamped = await this.recordHostPause(runId, hostPause.receipt, opts?.now);
+    if (stamped !== undefined) {
+      await writeReceipt(createNodeFileSystem2(launchWorkdir), launchWorkdir, stamped);
     }
     const result = await withWorktreeRunLease(await this.ctx.getDb(), launchWorkdir, workflow.name, runId, async (signal) => svc.resumeRun(workflow, runId, {
       ...signal !== undefined ? { signal } : {},
@@ -136221,6 +136587,39 @@ class WorkflowResumeOps {
       runResult.warnings = warnings;
     return runResult;
   }
+  async recordHostPause(runId, receipt, now) {
+    const db = await this.ctx.getDb();
+    const rows = await new ActionRunDao(db).actionRowsByRunId(runId);
+    const paused = [...rows].reverse().find((row) => row.status === "paused" || row.result_json !== null && /"pause"\s*:\s*true/.test(row.result_json));
+    const pausedAt = paused?.started_at ?? null;
+    if (pausedAt === null)
+      return receipt;
+    const resumedAt = (now ?? new Date).toISOString();
+    const pauseMs = hostDurationMs(pausedAt, resumedAt);
+    if (pauseMs === null)
+      return receipt;
+    const run = await new RunDao(db).traceRowById(runId);
+    let metadata = {};
+    try {
+      metadata = JSON.parse(run?.metadata_json ?? "{}");
+    } catch {
+      metadata = {};
+    }
+    const pauses = appendHostPause(metadata, {
+      node: paused?.node ?? "unknown",
+      action: paused?.kind ?? "agent.run",
+      pausedAt,
+      resumedAt,
+      hostDurationMs: pauseMs,
+      executor: receipt?.executor ?? "host"
+    });
+    await new RunDao(db).mergeMetadata(runId, { [HOST_PAUSES_KEY]: pauses });
+    if (receipt === undefined)
+      return;
+    if (!isDegenerateReceiptInterval(receipt.startedAt, receipt.finishedAt ?? undefined))
+      return receipt;
+    return { ...receipt, startedAt: pausedAt, finishedAt: resumedAt };
+  }
   async resolveHostPauseReceipt(runId, workdir, opts, workflow) {
     const db = await this.ctx.getDb();
     if (!await hostExecutorPersisted(db, runId))
@@ -136452,6 +136851,7 @@ var init_workflow_resume_ops = __esm(() => {
   init_checkpoint_contract();
   init_composition_lint();
   init_host_executor();
+  init_host_pause();
   init_progress_projection();
   init_receipt();
   init_workflow_resolver();
@@ -138346,6 +138746,7 @@ var init_src4 = __esm(() => {
   init_task_verdict();
   init_token_ledger_service();
   init_token_ledger_watcher();
+  init_verdict_replay();
   init_verify_answer_lint();
   init_warm_turn_dispatch();
   init_workflow_clean_ops();
@@ -145574,81 +145975,6 @@ var init_task_diffstat = __esm(() => {
   init_task_triage();
 });
 
-// ../../packages/app/src/services/sdlc-actions.ts
-function isReservedAction(name) {
-  return RESERVED_ACTIONS.includes(name);
-}
-function resolveAction(builder, name) {
-  const reserved = isReservedAction(name);
-  const declared = builder?.actions?.[name];
-  if (declared !== undefined) {
-    return Array.isArray(declared) ? { name, reserved, source: "config", kind: "composite", steps: [...declared] } : { name, reserved, source: "config", kind: "command", command: declared };
-  }
-  if ((builder?.preset ?? "bun") === "bun") {
-    if (reserved)
-      return { name, reserved, source: "preset", kind: "command", command: BUN_PRESET[name] };
-  } else {
-    const command = reserved ? STACK_NEUTRAL_DEFAULTS[name] : undefined;
-    if (command !== undefined)
-      return { name, reserved, source: "default", kind: "command", command };
-  }
-  return { name, reserved, source: "unbound", kind: "unbound" };
-}
-function listActions(builder) {
-  const custom = Object.keys(builder?.actions ?? {}).filter((name) => !isReservedAction(name)).sort();
-  return [...RESERVED_ACTIONS, ...custom].map((name) => resolveAction(builder, name));
-}
-function renderScoped(command, values) {
-  let rendered = command;
-  for (const [placeholder, items] of [
-    ["{files}", values.files],
-    ["{paths}", values.paths]
-  ]) {
-    if (!rendered.includes(placeholder))
-      continue;
-    if (items === undefined)
-      throw new Error(`renderScoped: ${placeholder} has no value`);
-    if (items.length === 0)
-      throw new Error(`renderScoped: ${placeholder} has an empty list`);
-    rendered = rendered.replaceAll(placeholder, () => items.map(shQuote2).join(" "));
-  }
-  if (rendered.includes("{workspace}")) {
-    const workspace = values.workspace;
-    if (workspace === undefined)
-      throw new Error("renderScoped: {workspace} has no value");
-    if (workspace.length === 0)
-      throw new Error("renderScoped: {workspace} is empty");
-    rendered = rendered.replaceAll("{workspace}", () => shQuote2(workspace));
-  }
-  return rendered;
-}
-var RESERVED_ACTIONS, BUN_PRESET, STACK_NEUTRAL_DEFAULTS;
-var init_sdlc_actions = __esm(() => {
-  init_src();
-  RESERVED_ACTIONS = SDLC_ACTIONS;
-  BUN_PRESET = {
-    build: "bun run build",
-    dev: "bun run dev",
-    clean: "bun run clean",
-    format: "bun run format",
-    autofix: "bun run autofix",
-    lint: "bun run lint",
-    typecheck: "bun run typecheck",
-    test: "bun run test",
-    "test-full": "bun run test:full",
-    "test-heavy": "bun run test:heavy",
-    "rules-pre": "bun run test-pre-check",
-    "rules-post": "bun run test-post-check",
-    check: "bun run spur-check",
-    "check-full": "bun run spur-check:full",
-    "check-feature": "bun run spur-check-feature",
-    "lint-changed": "bunx biome check {files}",
-    "typecheck-changed": "cd {workspace} && bun run typecheck",
-    "test-changed": "cd {workspace} && bun test {paths}"
-  };
-  STACK_NEUTRAL_DEFAULTS = SDLC_STACK_NEUTRAL_ACTIONS;
-});
-
 // ../../packages/app/src/services/quality-gate.ts
 import { spawnSync as spawnSync6 } from "child_process";
 import { randomUUID as randomUUID12 } from "crypto";
@@ -145669,6 +145995,21 @@ import {
 } from "fs";
 import { homedir as homedir13, tmpdir as tmpdir5 } from "os";
 import { dirname as dirname38, join as join78 } from "path";
+function resolveGateTimeoutMs(env) {
+  const raw = env[GATE_TIMEOUT_MS_ENV];
+  if (raw === undefined || raw.trim() === "")
+    return { ok: true, ms: GATE_TIMEOUT_MS_DEFAULT };
+  const parsed = Number(raw);
+  if (!Number.isFinite(parsed) || parsed <= 0)
+    return { ok: false, error: `quality-gate: ${GATE_TIMEOUT_MS_ENV} must be a positive number, got "${raw}"` };
+  return { ok: true, ms: Math.trunc(parsed) };
+}
+function gateTimeoutMsFor(env, options) {
+  if (options.gateTimeoutMs !== undefined && options.gateTimeoutMs > 0)
+    return options.gateTimeoutMs;
+  const resolved = resolveGateTimeoutMs(env);
+  return resolved.ok ? resolved.ms : GATE_TIMEOUT_MS_DEFAULT;
+}
 function isTransientLock(attemptOutput) {
   return LOCKED_PATTERN.test(attemptOutput);
 }
@@ -145867,7 +146208,7 @@ function lightScope(changedFiles, exists = existsSync23) {
           tests.add(candidate);
           matched = true;
         }
-      } else if (rest.startsWith("tests/") && TEST_FILE_PATTERN.test(rest)) {
+      } else if (rest.startsWith("tests/") && TEST_FILE_PATTERN2.test(rest)) {
         tests.add(file);
         matched = true;
       }
@@ -145884,7 +146225,7 @@ function lightScope(changedFiles, exists = existsSync23) {
       const candidate = `${workspace}/tests/${rest.slice("src/".length).replace(/\.tsx?$/, (ext) => `.test${ext}`)}`;
       if (exists(candidate))
         tests.add(candidate);
-    } else if (rest.startsWith("tests/") && TEST_FILE_PATTERN.test(rest)) {
+    } else if (rest.startsWith("tests/") && TEST_FILE_PATTERN2.test(rest)) {
       tests.add(file);
     }
   }
@@ -145931,11 +146272,13 @@ function planLightChecks(scope, hasTypecheck = workspaceHasTypecheck, builder) {
   }
   return plans;
 }
-function gitChangedFiles(cwd) {
+function gitChangedFiles(cwd, timeoutMs) {
   const abs = (p) => cwd ? join78(cwd, p) : p;
   const changed = new Set;
   for (const cmd of ["git diff --name-only HEAD", "git ls-files --others --exclude-standard"]) {
-    const result = runShellCommand(cmd, cwd);
+    const result = runShellCommand(cmd, cwd, undefined, timeoutMs);
+    if (result.timedOut)
+      return null;
     for (const line of result.output.split(`
 `)) {
       const file = line.trim();
@@ -145974,13 +146317,29 @@ function runLightGate(env, options = {}) {
   const logFile = join78(runDir, `${env.wbs}-light-gate.log`);
   const receiptFile = join78(runDir, `${env.wbs}-check-receipt.json`);
   writeFileSync14(abs(logFile), "");
+  const timeoutMs = gateTimeoutMsFor(env, options);
+  const changed = gitChangedFiles(cwd, timeoutMs);
+  if (changed === null) {
+    const line = `--- light gate BLOCKED: changed-path git read timed out after ${timeoutMs}ms
+`;
+    appendFileSync7(abs(logFile), line);
+    process.stderr.write(line);
+    return {
+      status: "FAIL",
+      scope: { files: [], workspaces: [], tests: [] },
+      checks: [],
+      logFile,
+      receiptFile,
+      blocked: line.trim()
+    };
+  }
   const capture = (options.captureGitTree ?? captureGateGitTree)(cwd ?? process.cwd());
   const digest = capture.ok ? capture.tree : "";
   if (!capture.ok) {
     appendFileSync7(abs(logFile), `--- light receipt: no git tree identity \u2014 ${capture.error}
 `);
   }
-  const scope = lightScope(gitChangedFiles(cwd), (p) => existsSync23(abs(p)));
+  const scope = lightScope(changed, (p) => existsSync23(abs(p)));
   const plans = planLightChecks(scope, (workspace) => workspaceHasTypecheck(abs(workspace)), options.builder);
   const reusable = new Map;
   let preserveFullReceipt = false;
@@ -146021,11 +146380,13 @@ function runLightGate(env, options = {}) {
       continue;
     }
     const startedAtMs = Date.now();
-    const result = runShellCommand(plan.cmd, cwd);
+    const result = runShellCommand(plan.cmd, cwd, undefined, timeoutMs);
     const durationMs = Date.now() - startedAtMs;
-    const status = result.code === 0 ? "PASS" : "FAIL";
-    appendFileSync7(abs(logFile), `--- light ${plan.id}: ${status} (${durationMs}ms)
-${result.output}`);
+    const status = result.code === 0 && !result.timedOut ? "PASS" : "FAIL";
+    const header = result.timedOut ? `--- light ${plan.id}: ${status} (timeout after ${timeoutMs}ms, ${durationMs}ms elapsed)
+` : `--- light ${plan.id}: ${status} (${durationMs}ms)
+`;
+    appendFileSync7(abs(logFile), `${header}${result.output}`);
     checks.push({ id: plan.id, cmd: plan.cmd, status, durationMs, logPath: logFile });
   }
   const receipt = buildReceipt({
@@ -146063,7 +146424,7 @@ function gateSleep(ms) {
   }
   Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
 }
-function runShellCommand(cmd, cwd, extraEnv) {
+function runShellCommand(cmd, cwd, extraEnv, timeoutMs) {
   const dir = mkdtempSync(join78(tmpdir5(), "spur-quality-gate-"));
   const path = join78(dir, "output");
   const fd = openSync8(path, "w");
@@ -146071,13 +146432,15 @@ function runShellCommand(cmd, cwd, extraEnv) {
     const result = spawnSync6("sh", ["-c", cmd], {
       cwd,
       stdio: ["ignore", fd, fd],
-      env: extraEnv === undefined ? undefined : { ...getEnvVars(), ...extraEnv }
+      env: extraEnv === undefined ? undefined : { ...getEnvVars(), ...extraEnv },
+      ...timeoutMs !== undefined ? { timeout: timeoutMs, killSignal: "SIGKILL" } : {}
     });
-    if (result.error !== undefined) {
+    const timedOut = result.error?.code === "ETIMEDOUT" || result.signal === "SIGKILL";
+    if (result.error !== undefined && !timedOut) {
       return { output: `sh -c failed: ${result.error.message}
-`, code: 1 };
+`, code: 1, timedOut: false };
     }
-    return { output: readFileSync21(path, "utf8"), code: result.status ?? 1 };
+    return { output: readFileSync21(path, "utf8"), code: result.status ?? 1, timedOut };
   } finally {
     closeSync8(fd);
     rmSync5(dir, { recursive: true, force: true });
@@ -146291,6 +146654,8 @@ function runQualityGate(mode, env, options = {}) {
   const attemptFile = rel("-test-fix-attempt");
   const abs = (p) => cwd ? join78(cwd, p) : p;
   const priorLog = mode === "recheck" && existsSync23(abs(logFile)) ? readFileSync21(abs(logFile), "utf8") : "";
+  const timeoutMs = gateTimeoutMsFor(env, options);
+  let timedOut;
   writeFileSync14(abs(logFile), "");
   if (mode === "run")
     writeFileSync14(abs(attemptFile), `0
@@ -146345,15 +146710,17 @@ function runQualityGate(mode, env, options = {}) {
     gateRc = 1;
   }
   if (mode === "recheck" && gateRc === 0 && (env.gateProbeCmd ?? "").length > 0) {
-    const probe = runShellCommand(env.gateProbeCmd ?? "", cwd);
+    const probe = runShellCommand(env.gateProbeCmd ?? "", cwd, undefined, timeoutMs);
     writeFileSync14(abs(`${logFile}.probe`), probe.output);
     gateRc = probe.code;
+    if (probe.timedOut)
+      timedOut = { cmd: env.gateProbeCmd ?? "" };
     appendFileSync7(abs(logFile), probe.output);
     rmSync5(abs(`${logFile}.probe`), { force: true });
   }
   let gateRuntimeMs = 0;
   let queueWaitMs = 0;
-  if (gateRc === 0) {
+  if (gateRc === 0 && timedOut === undefined) {
     const delayMs = retryDelayMs2(env);
     const lockLine = (line) => {
       process.stdout.write(line);
@@ -146367,12 +146734,16 @@ function runQualityGate(mode, env, options = {}) {
     try {
       for (gateAttempt = 1;gateAttempt <= MAX_GATE_ATTEMPTS; gateAttempt++) {
         const attemptLogPath = `${logFile}.attempt-${gateAttempt}`;
-        const attempt = runShellCommand(env.qualityGateCmd ?? "", cwd, lock.token.length > 0 ? { [GATE_LOCK_TOKEN_ENV]: lock.token } : undefined);
+        const attempt = runShellCommand(env.qualityGateCmd ?? "", cwd, lock.token.length > 0 ? { [GATE_LOCK_TOKEN_ENV]: lock.token } : undefined, timeoutMs);
         writeFileSync14(abs(attemptLogPath), attempt.output);
         const locked = isTransientLock(attempt.output);
         appendFileSync7(abs(logFile), attempt.output);
         rmSync5(abs(attemptLogPath), { force: true });
         gateRc = attempt.code;
+        if (attempt.timedOut) {
+          timedOut = { cmd: env.qualityGateCmd ?? "" };
+          break;
+        }
         if (gateRc === 0 || !locked || gateAttempt >= MAX_GATE_ATTEMPTS)
           break;
         const line = retryMessage(gateAttempt);
@@ -146408,6 +146779,26 @@ function runQualityGate(mode, env, options = {}) {
       }
     }
   }
+  if (timedOut !== undefined) {
+    const header = `gate timeout after ${timeoutMs}ms: ${timedOut.cmd}
+`;
+    const tail = tailLines(readFileSync21(abs(logFile), "utf8"), 40);
+    writeFileSync14(abs(findingsFile), `${header}${tail}`);
+    writeFileSync14(abs(statusFile), `BLOCKED
+`);
+    appendFileSync7(abs(logFile), `git-tree: ${tree.ok ? tree.tree : "unbound"}
+`);
+    process.stderr.write(`quality gate BLOCKED \u2014 ${header}`);
+    return {
+      status: "BLOCKED",
+      attempts: gateAttempt,
+      logFile,
+      findingsFile,
+      statusFile,
+      attemptFile,
+      receiptFile: undefined
+    };
+  }
   if (gateRc === 0) {
     const bytes = existsSync23(abs(logFile)) ? statSync15(abs(logFile)).size : 0;
     const attemptsLabel = gateAttempt > 0 ? String(gateAttempt) : "";
@@ -146468,12 +146859,19 @@ function qualityGateMain(argv, rawEnv = getEnvVars(), options = {}) {
     return 2;
   }
   const env = { ...rawEnv, wbs };
+  const timeout = resolveGateTimeoutMs(env);
+  if (!timeout.ok) {
+    process.stderr.write(`${timeout.error}
+`);
+    return 2;
+  }
+  const gateOptions = { ...options, gateTimeoutMs: timeout.ms };
   if (mode === "light") {
-    runLightGate(env, options);
-    return 0;
+    const light = runLightGate(env, gateOptions);
+    return light.blocked === undefined ? 0 : 2;
   }
   if (mode === "deferred") {
-    return runDeferredGate(env, options).status === "DEFERRED" ? 0 : 1;
+    return runDeferredGate(env, gateOptions).status === "DEFERRED" ? 0 : 1;
   }
   if (mode === "status") {
     const runDir = join78(options.cwd ?? ".", ".spur", "run");
@@ -146496,7 +146894,10 @@ function qualityGateMain(argv, rawEnv = getEnvVars(), options = {}) {
     return 0;
   }
   try {
-    return runQualityGate(mode, env, options).status === "PASS" ? 0 : 1;
+    const result = runQualityGate(mode, env, gateOptions);
+    if (result.status === "PASS")
+      return 0;
+    return result.status === "BLOCKED" ? 2 : 1;
   } catch (error) {
     if (!(error instanceof GateLockTimeoutError))
       throw error;
@@ -146504,7 +146905,7 @@ function qualityGateMain(argv, rawEnv = getEnvVars(), options = {}) {
     return 2;
   }
 }
-var MAX_GATE_ATTEMPTS = 5, MAX_FINDINGS = 20, RETRY_DELAY_MS_DEFAULT = 1e4, RETRY_DELAY_MS_ENV = "SPUR_QUALITY_GATE_RETRY_DELAY_MS", LOCKED_PATTERN, FINDINGS_PATTERN, COVERAGE_ROW_PATTERN, RECEIPT_SCHEMA_VERSION = "check-receipt/v1", TEST_FILE_PATTERN, GATE_LOCK_DIR_ENV = "SPUR_GATE_LOCK_DIR", GATE_LOCK_POLL_MS_ENV = "SPUR_GATE_LOCK_POLL_MS", GATE_LOCK_OFF_ENV = "SPUR_GATE_LOCK", GATE_LOCK_TOKEN_ENV = "SPUR_GATE_LOCK_TOKEN", GATE_LOCK_POLL_MS_DEFAULT = 5000, GATE_LOCK_TIMEOUT_MS_ENV = "SPUR_GATE_LOCK_TIMEOUT_MS", GATE_LOCK_TIMEOUT_MS_DEFAULT, GATE_LOCK_MKDIR_HOLD_MS_ENV = "SPUR_GATE_LOCK_TEST_MKDIR_HOLD_MS", GATE_LOCK_LOST_RACE_SLEEP_MS = 20, GATE_LOCK_LOST_RACE_LOG_AT = 250, GateLockTimeoutError, QUALITY_GATE_MODES, QUALITY_GATE_USAGE = "usage: spur task gate <wbs> <run|recheck|light|deferred|status>  (env: qualityGateCmd, gateProbeCmd, runId)";
+var MAX_GATE_ATTEMPTS = 5, MAX_FINDINGS = 20, RETRY_DELAY_MS_DEFAULT = 1e4, RETRY_DELAY_MS_ENV = "SPUR_QUALITY_GATE_RETRY_DELAY_MS", GATE_TIMEOUT_MS_ENV = "gateTimeoutMs", GATE_TIMEOUT_MS_DEFAULT = 900000, LOCKED_PATTERN, FINDINGS_PATTERN, COVERAGE_ROW_PATTERN, RECEIPT_SCHEMA_VERSION = "check-receipt/v1", TEST_FILE_PATTERN2, GATE_LOCK_DIR_ENV = "SPUR_GATE_LOCK_DIR", GATE_LOCK_POLL_MS_ENV = "SPUR_GATE_LOCK_POLL_MS", GATE_LOCK_OFF_ENV = "SPUR_GATE_LOCK", GATE_LOCK_TOKEN_ENV = "SPUR_GATE_LOCK_TOKEN", GATE_LOCK_POLL_MS_DEFAULT = 5000, GATE_LOCK_TIMEOUT_MS_ENV = "SPUR_GATE_LOCK_TIMEOUT_MS", GATE_LOCK_TIMEOUT_MS_DEFAULT, GATE_LOCK_MKDIR_HOLD_MS_ENV = "SPUR_GATE_LOCK_TEST_MKDIR_HOLD_MS", GATE_LOCK_LOST_RACE_SLEEP_MS = 20, GATE_LOCK_LOST_RACE_LOG_AT = 250, GateLockTimeoutError, QUALITY_GATE_MODES, QUALITY_GATE_USAGE = "usage: spur task gate <wbs> <run|recheck|light|deferred|status>  (env: qualityGateCmd, gateProbeCmd, runId)";
 var init_quality_gate = __esm(() => {
   init_dist();
   init_proof_input_fingerprint();
@@ -146512,7 +146913,7 @@ var init_quality_gate = __esm(() => {
   LOCKED_PATTERN = /SQLiteError: database is locked|SQLite database .*is busy|SQLITE_BUSY/;
   FINDINGS_PATTERN = /[A-Za-z0-9_./-]+\.[A-Za-z]+:[0-9]+/g;
   COVERAGE_ROW_PATTERN = /^\s*(\S+\.[A-Za-z]+)\s*\|\s*([\d.]+)\s*\|\s*([\d.]+)\s*\|\s*(\S*)/;
-  TEST_FILE_PATTERN = /\.test\.tsx?$/;
+  TEST_FILE_PATTERN2 = /\.test\.tsx?$/;
   GATE_LOCK_TIMEOUT_MS_DEFAULT = 2 * 60 * 60 * 1000;
   GateLockTimeoutError = class GateLockTimeoutError extends Error {
     constructor(message) {
@@ -148404,6 +148805,17 @@ var require_src10 = __commonJS(function(exports, module) {
 });
 
 // ../../packages/app/src/workflow/step-profile.ts
+function rowKey(node, actionKind) {
+  return `${node}\x00${actionKind}`;
+}
+function hostMsByRow(pauses) {
+  const totals = new Map;
+  for (const pause of pauses) {
+    const key = rowKey(pause.node, pause.action ?? "agent.run");
+    totals.set(key, (totals.get(key) ?? 0) + pause.hostDurationMs);
+  }
+  return totals;
+}
 function nearestRankP50(values) {
   if (values.length === 0)
     return null;
@@ -148527,11 +148939,27 @@ function buildRows(executions, windowSec) {
 }
 function buildStepProfile(input) {
   const executions = input.runs.flatMap((run) => extractExecutions(run.runId, run.events));
+  const hostTotals = new Map;
+  for (const run of input.runs) {
+    for (const [key, ms] of hostMsByRow(run.hostPauses ?? [])) {
+      hostTotals.set(key, (hostTotals.get(key) ?? 0) + ms);
+    }
+  }
+  const rows = buildRows(executions, input.windowSec).map((row) => {
+    const hostMs = hostTotals.get(rowKey(row.node, row.actionKind));
+    return hostMs === undefined ? row : { ...row, hostMs };
+  });
+  const stalledRuns = nonDryRuns(input.paused ?? []).filter((entry) => entry.stalled === true).map((entry) => ({
+    runId: entry.runId,
+    stalledMs: entry.stalledMs ?? 0,
+    resume: `spur workflow continue ${entry.runId}`
+  }));
   return {
     workflow: input.workflow,
     windowSec: input.windowSec,
     sampledRuns: input.runs.length,
-    rows: buildRows(executions, input.windowSec)
+    rows,
+    ...stalledRuns.length > 0 ? { stalledRuns } : {}
   };
 }
 function nonDryRuns(entries) {
@@ -148555,16 +148983,22 @@ function formatStepProfileHuman(profile) {
       `p50=${seconds(row.durationMs.p50)}`.padEnd(12),
       `max=${seconds(row.durationMs.max)}`.padEnd(12),
       `idle=${seconds(row.idleGapMs.p50)}`.padEnd(12),
+      ...row.hostMs === undefined ? [] : [`host=${seconds(row.hostMs)}`.padEnd(12)],
       `session=${row.session ?? "?"}`.padEnd(15),
       `cacheHit=${ratio(row.cacheHit.p50)} (${row.cacheHit.known}/${row.cacheHit.of})`.padEnd(20),
       `flags=${row.flags.length === 0 ? "-" : row.flags.join(",")}`
     ].join(" "));
   }
+  for (const run of profile.stalledRuns ?? [])
+    lines.push(`${run.runId}: ${stalledLabel(run.runId, run.stalledMs)}`);
   return `${lines.join(`
 `)}
 `;
 }
 var DEFAULT_LAST = 20, DEFAULT_WINDOW_SEC = 300;
+var init_step_profile = __esm(() => {
+  init_host_pause();
+});
 
 // ../../packages/app/src/workflow/step-profile-cli.ts
 function positiveInt(raw, fallback) {
@@ -148611,6 +149045,12 @@ function runFailure(spurBin, result, what) {
 `).slice(-1)[0] ?? "";
   return failure2(`${what} failed (exit ${result.exitCode}${detail === "" ? "" : `: ${detail}`}) [${spurBin}]`);
 }
+function parseTraceEntries(stdout) {
+  const parsed = JSON.parse(stdout);
+  if (!Array.isArray(parsed.entries))
+    throw new Error('no "entries" array');
+  return parsed.entries;
+}
 function runStepProfileCli(argv, defaultSpurBin = "spur", defaultSpurArgv) {
   const spurArgv = argv.includes("--spur-bin") ? undefined : defaultSpurArgv;
   const args = parseStepProfileCliArgs(argv, defaultSpurBin);
@@ -148636,10 +149076,7 @@ ${STEP_PROFILE_USAGE}`);
     return runFailure(args.spurBin, list, `spur ${listArgs.join(" ")}`);
   let entries;
   try {
-    const parsed = JSON.parse(list.stdout);
-    if (!Array.isArray(parsed.entries))
-      throw new Error('no "entries" array');
-    entries = parsed.entries;
+    entries = parseTraceEntries(list.stdout);
   } catch (err) {
     return failure2(`spur workflow trace output did not parse as JSON: ${String(err)}`);
   }
@@ -148653,12 +149090,27 @@ ${STEP_PROFILE_USAGE}`);
       const parsed = JSON.parse(timeline.stdout);
       if (!Array.isArray(parsed.events))
         throw new Error('no "events" array');
-      runs.push({ runId: entry.runId, events: parsed.events });
+      runs.push({
+        runId: entry.runId,
+        events: parsed.events,
+        ...entry.hostPauses !== undefined ? { hostPauses: entry.hostPauses } : {}
+      });
     } catch (err) {
       return failure2(`spur workflow trace ${entry.runId} output did not parse as JSON: ${String(err)}`);
     }
   }
-  const profile = buildStepProfile({ workflow: args.workflow, windowSec: args.windowSec, runs });
+  const pausedArgs = [...listArgs];
+  pausedArgs[pausedArgs.indexOf("done")] = "paused";
+  const pausedList = runSpurJson(args.spurBin, pausedArgs, spurArgv);
+  if (!pausedList.ok)
+    return runFailure(args.spurBin, pausedList, `spur ${pausedArgs.join(" ")}`);
+  let paused;
+  try {
+    paused = parseTraceEntries(pausedList.stdout);
+  } catch (err) {
+    return failure2(`spur workflow trace output did not parse as JSON: ${String(err)}`);
+  }
+  const profile = buildStepProfile({ workflow: args.workflow, windowSec: args.windowSec, runs, paused });
   return {
     exitCode: 0,
     stdout: args.json ? `${JSON.stringify(profile, null, 2)}
@@ -148669,6 +149121,7 @@ ${STEP_PROFILE_USAGE}`);
 var STEP_PROFILE_USAGE;
 var init_step_profile_cli = __esm(() => {
   init_dist5();
+  init_step_profile();
   STEP_PROFILE_USAGE = `usage: spur workflow profile <workflow> [--last <N>] [--window <sec>] [--json] [--spur-bin <cmd>]
 
 Read-only step profile from \`spur workflow trace\`: per node and action kind it reports runs,
@@ -156573,7 +157026,7 @@ var SHARED_OPTIONS = {
     "pi|claude|codex|gemini|opencode|antigravity|openclaw|omp|grok|agy|all"
   ],
   statusDoneFailed: ["--status <status>", "Filter by status: done, failed"],
-  statusDoneFailedRunning: ["--status <status>", "Filter by status: done, failed, running"],
+  statusWorkflowRun: ["--status <status>", "Filter by status: done, failed, running, paused, interrupted"],
   untilAgent: ["--until <state>", "Lifecycle state to wait for (repeatable OR)"],
   untilMessage: ["--until <state>", "Wait target for --wait: injected|invoke-exit"],
   verboseWorkflow: ["--verbose", "Include transitions and correlation diagnostics in human progress"],
@@ -159764,7 +160217,7 @@ function registerTaskUpdateCommand(task, context) {
 // src/commands/task/verdict.ts
 init_src4();
 function registerTaskVerdictCommand(task, context) {
-  task.command("verdict").summary("Derive PASS/PARTIAL/FAIL/UNKNOWN verdict from verify answer text (replaces pipeline grep/shell).").argument("<wbs>", "Task WBS number").option("--from-answer <path>", "Path to verify answer text file").option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).option(...SHARED_OPTIONS.jsonEnvelope).action(async (wbs, options) => {
+  task.command("verdict").summary("Derive PASS/PARTIAL/FAIL/UNKNOWN verdict from verify answer text (replaces pipeline grep/shell).").argument("<wbs>", "Task WBS number").option("--from-answer <path>", "Path to verify answer text file").option("--replay", "Re-execute the test files the verdict rows cite; a failure downgrades PASS to PARTIAL").option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).option(...SHARED_OPTIONS.jsonEnvelope).action(async (wbs, options) => {
     await Promise.resolve().then(() => init_src4());
     const answerPath = options.fromAnswer ?? `.spur/run/${wbs}-verify-answer.txt`;
     let answerText;
@@ -159783,6 +160236,12 @@ function registerTaskVerdictCommand(task, context) {
       featuresDir: context.fs.resolve(featuresDir)
     };
     const lintFindings = await lintVerifyAnswerForTask(wbs, answerText, corpusDeps);
+    const lintPath = `.spur/run/${wbs}-verdict-lint.txt`;
+    const clearLintFile = async () => {
+      try {
+        await context.fs.deleteFile(lintPath);
+      } catch {}
+    };
     if (lintFindings.length > 0) {
       if (options.json) {
         context.output.write(JSON.stringify({ wbs, lintFindings }, null, 2));
@@ -159791,9 +160250,14 @@ function registerTaskVerdictCommand(task, context) {
         for (const f of lintFindings)
           context.output.error(`  line ${f.line}: ${f.message}`);
       }
+      await context.fs.ensureDir(".spur/run");
+      await context.fs.writeFile(lintPath, `${lintFindings.map((f) => `line ${f.line}: ${f.message}`).join(`
+`)}
+`);
       context.setExitCode(1);
       return;
     }
+    await clearLintFile();
     const taskCheckPassed = true;
     const taskAc = await readTaskAcceptanceCriteria(wbs, corpusDeps);
     const result = deriveVerdict(answerText, taskCheckPassed, taskAc);
@@ -159803,7 +160267,19 @@ function registerTaskVerdictCommand(task, context) {
       context.setExitCode(1);
       return;
     }
-    const jsonOut = JSON.stringify({ wbs, ...result, source: "spur-task-verdict" }, null, 2);
+    const replay = options.replay === true ? await replayCitedTests([...result.requirements, ...result.acceptanceCriteria ?? []], {
+      cwd: context.cwd,
+      builder: context.spurConfig?.builder
+    }) : undefined;
+    const downgraded = replay !== undefined && replay.findings.length > 0 && result.verdict === "PASS";
+    if (downgraded)
+      result.verdict = "PARTIAL";
+    const jsonOut = JSON.stringify({
+      wbs,
+      ...result,
+      ...replay !== undefined ? { replay } : {},
+      source: "spur-task-verdict"
+    }, null, 2);
     await context.fs.ensureDir(".spur/run");
     await context.fs.writeFile(`.spur/run/${wbs}-verdict.json`, `${jsonOut}
 `);
@@ -159811,6 +160287,12 @@ function registerTaskVerdictCommand(task, context) {
       context.output.write(jsonOut);
     } else {
       context.output.write(`Verdict: ${result.verdict} (${result.requirements.length} requirements, ${result.checks.length} checks)`);
+      if (replay !== undefined) {
+        const report = formatReplayReport(replay);
+        context.output.write(report.summary);
+        for (const line of report.findings)
+          context.output.error(line);
+      }
     }
     if (result.verdict !== "PASS") {
       context.setExitCode(1);
@@ -164711,7 +165193,7 @@ init_src2();
 var CLI_CONFIG = {
   binaryName: "spur",
   binaryLabel: "spur",
-  binaryVersion: "0.4.27",
+  binaryVersion: "0.4.28",
   configDir: ".spur",
   configFile: ".spur/config.yaml",
   databaseFile: ".spur/spur.db"
@@ -172450,7 +172932,7 @@ init_dist5();
 import { homedir as homedir17 } from "os";
 import { basename as basename23, join as join95, relative as relative19, resolve as resolve37 } from "path";
 // ../server/package.json
-var version4 = "0.4.27";
+var version4 = "0.4.28";
 
 // ../server/src/modules/health/index.ts
 var startedAt = Date.now();
@@ -178008,6 +178490,7 @@ init_src2();
 init_dist5();
 init_dist2();
 init_composition_baseline();
+init_host_pause();
 init_run_measurements();
 init_terminal_reason();
 init_run_measurements();
@@ -178045,9 +178528,13 @@ async function buildReportJson(db, workflows, opts = {}) {
 function renderStateLines(rows) {
   return rows.map((s) => {
     const wall = s.wallMsP50 === null || s.wallMsP90 === null ? "n/a" : `p50=${s.wallMsP50}ms p90=${s.wallMsP90}ms`;
-    return `${s.workflow}/${s.state}: visits=${s.visits} agent.run=${s.agentRunCount} wall=${wall} retries=${s.retries}`;
+    const host = s.hostMs === undefined ? "" : ` host=${s.hostMs}ms`;
+    return `${s.workflow}/${s.state}: visits=${s.visits} agent.run=${s.agentRunCount} wall=${wall}${host} retries=${s.retries}`;
   });
 }
+function renderStalledLines(rows) {
+  return rows.map((r) => `${r.workflow}: ${stalledLabel(r.runId, r.stalledMs)}`);
+}
 function renderWorkflowLines(rows) {
   return rows.map((m) => {
     const excluded = m.dryRuns > 0 || m.nonTerminalRuns > 0 ? ` [excluded ${m.dryRuns} dry, ${m.nonTerminalRuns} non-terminal]` : "";
@@ -178263,6 +178750,11 @@ function registerWorkflowCostCommand(workflow, context, deps = {}) {
             context.output.write(line);
           }
         }
+        if (options.json !== true) {
+          for (const line of renderStalledLines(await readStalledRuns(db, targets))) {
+            context.output.write(line);
+          }
+        }
       } finally {
         db.close();
       }
@@ -179240,6 +179732,7 @@ init_src4();
 import { closeSync as closeSync10, fstatSync as fstatSync5, openSync as openSync10, readFileSync as readFileSync32, readSync as readSync3 } from "fs";
 import { join as join107 } from "path";
 import { setTimeout as sleep7 } from "timers/promises";
+var TRACE_STATUSES = ["done", "failed", "running", "paused", "interrupted"];
 function formatTraceList2(result) {
   if (result.entries.length === 0) {
     return "No workflow runs.";
@@ -179268,6 +179761,9 @@ function formatTraceTimeline(result) {
     `Outcome: ${run.outcome}   Events: ${events.length}`,
     ""
   ];
+  if (run.stalled === true && run.stalledMs !== undefined) {
+    lines.splice(4, 0, `Stalled: paused ${Math.round(run.stalledMs / 1000)}s \u2014 resume: spur workflow continue ${run.runId}`);
+  }
   if (run.nextAction !== undefined)
     lines.splice(4, 0, `Next: ${run.nextAction.label} \u2014 ${run.nextAction.value}`);
   if (result.outputArtifact !== undefined) {
@@ -179503,7 +179999,7 @@ function formatTokens2(n) {
   return String(n);
 }
 function registerWorkflowTraceCommand(workflow, context) {
-  workflow.command("trace").description("Show persisted workflow run history.").argument("[run-id]", "Run ID for per-run timeline detail").option("--workflow <name>", "Filter by workflow name").option(...SHARED_OPTIONS.statusDoneFailedRunning).option(...SHARED_OPTIONS.since).option(...SHARED_OPTIONS.last, "20").option("--follow", "Replay a run timeline and poll persisted state until it becomes terminal").option(...SHARED_OPTIONS.pollWorkflow, "1000").option("--output", "With --follow: stream .spur/memory/runs/<RUNID>.md instead of the DB timeline").option(...SHARED_OPTIONS.timeout).option(...SHARED_OPTIONS.jsonSupported).option(...SHARED_OPTIONS.jsonEnvelope).action(async (runId, options) => {
+  workflow.command("trace").description("Show persisted workflow run history.").argument("[run-id]", "Run ID for per-run timeline detail").option("--workflow <name>", "Filter by workflow name").option(...SHARED_OPTIONS.statusWorkflowRun).option(...SHARED_OPTIONS.since).option(...SHARED_OPTIONS.last, "20").option("--follow", "Replay a run timeline and poll persisted state until it becomes terminal").option(...SHARED_OPTIONS.pollWorkflow, "1000").option("--output", "With --follow: stream .spur/memory/runs/<RUNID>.md instead of the DB timeline").option(...SHARED_OPTIONS.timeout).option(...SHARED_OPTIONS.jsonSupported).option(...SHARED_OPTIONS.jsonEnvelope).action(async (runId, options) => {
     const svc = makeWorkflowService(context);
     const last = parseInt(options.last, 10);
     if (Number.isNaN(last) || last < 1) {
@@ -179548,8 +180044,8 @@ function registerWorkflowTraceCommand(workflow, context) {
       context.setExitCode(1);
       return;
     }
-    if (options.status !== undefined && !["done", "failed", "running"].includes(options.status)) {
-      writeJsonError(context.output, options, "--status must be one of: done, failed, running", "VALIDATION_FAILED");
+    if (options.status !== undefined && !TRACE_STATUSES.includes(options.status)) {
+      writeJsonError(context.output, options, `--status must be one of: ${TRACE_STATUSES.join(", ")}`, "VALIDATION_FAILED");
       context.setExitCode(1);
       return;
     }