@gobing-ai/spur 0.4.34 → 0.4.35

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.4.34",
+            "version": "0.4.35",
             "source": "./plugins/sp"
         }
     ]

package/config/pipeline-budgets.json

@@ -4,10 +4,10 @@
     "note": "Per-pipeline model-query + wall-clock cost budgets (task 0607 R3). modelQueries anchors the live workflow definitions' query lists — the SSOT, extracted by extractResolvedWorkflowFacts and guarded by composition-baseline.test.ts (0775 retired the snapshot this file previously anchored to). wallClockMs is a gross-regression ceiling anchored to measured real-run data (R5): the gate compares the median-of-sane terminal-run wall-clock against it. A null budget is unenforced until measured — never treated as 0. Raising a numeric budget requires a fresh recorded decision in the same commit (config/pipeline-budgets.json vs git HEAD); the `spur workflow cost --budget` gate fails a silent raise by name.",
     "budgets": {
         "task-pipeline": {
-            "modelQueries": 4,
+            "modelQueries": 3,
             "wallClockMs": 2300000,
             "tokenCostUsd": null,
-            "source": "Full-depth runs 2026-08-08..20: 1459s-2719s; authoritative 2053s/2023s/1985s (n=3, 2026-08-19/20, per ADR-076 retirement — 538s unusable). Budget = 2300s ≈ max+~12% headroom. Gate measures median-of-sane terminal runs; short precheck-failure/dry runs pull the median down, so this is a gross-regression ceiling. Live fixture re-measurement: bun scripts/spur-dev.ts eval-pipeline --runs 3 (operator command in 0607 Solution).",
+            "source": "Full-depth runs 2026-08-08..20: 1459s-2719s; authoritative 2053s/2023s/1985s (n=3, 2026-08-19/20, per ADR-076 retirement — 538s unusable). Budget = 2300s ≈ max+~12% headroom. Gate measures median-of-sane terminal runs; short precheck-failure/dry runs pull the median down, so this is a gross-regression ceiling. Live fixture re-measurement: bun scripts/spur-dev.ts eval-pipeline --runs 3 (operator command in 0607 Solution). 2026-11-14 recount: 4 -> 3 model queries (implement, remediate, review) after the slim-harness refactor; the wall-clock ceiling predates it and is reference only — no pipeline, gate or hook reads it; only a manual `spur workflow cost --budget` compares against it.",
             "decision": null
         },
         "idea-pipeline": {

package/config/workflows/task-pipeline.yaml

@@ -694,7 +694,7 @@ states:
                 args: ["task", "verdict", "${vars.wbs}", "--from-answer", ".spur/run/${vars.__runId}-review-cert.md"]
                 resultFile: .spur/run/${vars.__runId}-review-verdict.status
                 softFail: true
-                # Derivation only (no `--replay`: the gate already ran the tests for this tree).
+                # Derivation only: the gate already ran the tests for this tree.
                 timeoutMs: "120000"
           # (e) one fold, one token: PASS requires the typed verdict PASS and the artifact's own PASS.
           # Fail-closed: any missing/corrupt input leaves FAIL, so the transitions can route a

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.4.34",
+    "version": "0.4.35",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",

package/plugins/sp/README.md

@@ -55,6 +55,8 @@ Entry points that feed the main flow above, or run independently of it — see t
   from git history.
 - The **project bootstrapper** scaffolds a brand-new Spur project (config + docs), then tailors it
   to the target stack.
+- The **[downstream migration guide](skills/spur-dev/references/migration-guide.md)** upgrades an
+  existing project without replacing its `.spur/config.yaml`, feature tree, or task history.
 
 ### Batch and parallel paths
 
@@ -242,8 +244,8 @@ plugins/sp/
 │   │   └── references/  # ac-style-guide, cross-cutting, decision-brief, dev-operations,
 │   │                      done-housekeeping, execution-batch, execution-workflow,
 │   │                      feature-link-helper, flag-glossary, gate-checklists, glossary,
-│   │                      idea-evaluation, execution-workflow, planning-workflow,
-│   │                      product-planning, section-batching  (16 files)
+│   │                      idea-evaluation, migration-guide, execution-workflow, planning-workflow,
+│   │                      product-planning, section-batching  (17 files)
 │   ├── test-driven-development/                    # TDD workflow companion (SKILL.md only)
 │   ├── reverse-engineering/         # Codebase reverse engineering / HLD / audit
 │   │   ├── agents/openai.yaml

package/plugins/sp/plugin.json

@@ -1,5 +1,5 @@
 {
     "name": "sp",
-    "version": "0.4.34",
+    "version": "0.4.35",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics."
 }

package/plugins/sp/skills/code-verification/SKILL.md

@@ -144,13 +144,8 @@ assign a per-requirement status:
 Record the evidence string (repo-relative `file:line`, command, or test name) per requirement —
 this lands in `## Testing`.
 
-**Line-anchor verification (anti-stale-citation rule).** Every `file:line` evidence citation
-written into the Testing table MUST be re-read at the cited lines this run, and the re-read content
-MUST name the requirement's subject (the R-item's noun - not merely exist on disk) before a MET row
-is written. A citation whose anchor resolves to another ticket's content, a stale line range, or a
-heading/comment unrelated to the requirement fails the row to UNMET and surfaces the stale anchor as
-a finding (severity >= P2). This closes the gap where a verify run certified a task `done` citing
-`evidence:134` that was actually a sibling ticket's telemetry text (0299 R1, from the 0282 re-audit).
+**Cite what you actually read.** Evidence must be something you inspected this run and that
+supports the requirement; nothing parses or re-checks the cell, so its accuracy is yours.
 
 **External evidence (task 0584 / ADR-062) — legal citation form.** Evidence that lives OUTSIDE this
 repository has a frozen non-anchor form: a named origin plus a backticked path with the line number
@@ -199,9 +194,7 @@ The answer file must include a stable AC table:
 | Scenario: CLI emits JSON | MET | test | `apps/cli/tests/foo.test.ts:42` |
 ```
 
-**Line-anchor verification applies to AC evidence too.** Every `file:line` citation in the AC
-evidence column is subject to the Step 4 line-anchor rule - re-read at the cited lines this run and
-confirm the content names the AC's subject before marking the row MET.
+**AC evidence follows the same rule as Step 4:** cite what you inspected this run.
 
 ### Step 6 — Design conformance (Phase 7a; Wave C / 0179 R1–R3)
 

package/plugins/sp/skills/spur-cli/references/tasks/verbs.md

@@ -256,6 +256,9 @@ the active tasks folder (or `--folder`).
 | `--folder <path>` | Custom tasks folder. |
 | `--json` | Machine-readable report envelope. |
 
+For a complete downstream upgrade, use the [migration guide](../../../spur-dev/references/migration-guide.md):
+`task migrate` is only the A17 normalization step, not the whole migration.
+
 ## `resolve <file-path>`
 
 Map a file path to its **owning task** — returns the WBS + task file. Strategies, in order: direct

package/plugins/sp/skills/spur-dev/references/ac-style-guide.md

@@ -333,5 +333,5 @@ truly does not apply (do not silently default new tasks to it).
 | Legacy raw bullets | `- AC1 …` (no checkbox, no `Scenario:`) | n/a | unparsed: invisible to subset, binding, and box checks — preserve in place, never author new |
 
 `task-local` altitude skips only the feature-subset check. It does not waive the unchecked-box check,
-required sections, the proof-bound verdict, line anchors, or any other done check — AC syntax alone,
+required sections, the proof-bound verdict, or any other done check — AC syntax alone,
 at any altitude, never makes a task done.

package/plugins/sp/skills/spur-dev/references/migration-guide.md

@@ -0,0 +1,214 @@
+---
+name: downstream-migration
+description: "Migrate an existing Spur project to the current CLI and plugin contract while preserving local config and planning history."
+see_also:
+  - spur-dev
+  - spur-cli
+---
+
+# Downstream migration guide
+
+Use this guide to upgrade an existing project to **Spur 0.4.34** and its matching `sp` plugin.
+For a later release, use the same procedure and read that release's `CHANGELOG.md` entries for
+additional required changes. Do not treat every release as requiring a corpus rewrite.
+
+## 1. Preservation contract
+
+- `.spur/config.yaml`, `docs/features/`, and `docs/tasks*/` are project-owned inputs. Never replace
+  them with package examples or a fresh checkout.
+- Task and feature Markdown is the planning SSOT. The SQLite database is derived; database
+  migrations do not rewrite that Markdown. `docs/features/INDEX.md` and generated task rosters are
+  outputs and must only be regenerated through `spur feature`.
+- Do not run `spur self init --force`, bulk-copy the packaged default configuration or its
+  workflow definitions, or edit generated feature regions directly. Existing project overrides need
+  reconciliation, not replacement.
+- Keep history. Retired commands and old evidence prose can remain in completed task records;
+  they are not instructions to re-run. `spur task migrate-anchors` and `spur task residual` are
+  removed and must not be called.
+- Use CLI-gated writes. Feature acceptance criteria go through `spur feature update --section`;
+  task sections go through `spur task update --section`. No direct corpus edits.
+
+## 2. Preflight and backup
+
+Work from the downstream project root, with a clean Git tree and a named backup ref:
+
+```bash
+cd /path/to/project
+git status --short
+git switch -c chore/spur-0.4.34-migration
+spur --version
+spur self status --json
+spur self migrate --check --json
+spur self exec --list --json
+```
+
+`self migrate --check` is read-only: exit 1 means importer-schema drift and requires the apply
+step below; an absent database is allowed. Keep the current checkout or another backup ref so the
+migration can be reverted. If `.spur/spur.db` exists, stop the project server and copy it to a
+backup location before continuing. Do not back up or restore Markdown by deleting it first.
+
+## 3. Install matching CLI and plugin
+
+Install the CLI, then install the plugin from that same package rather than mixing versions:
+
+```bash
+bun add -g @gobing-ai/superskill @gobing-ai/spur@0.4.34
+superskill install sp --marketplace $(dirname $(bun pm bin -g))/install/global/node_modules/@gobing-ai/spur
+spur --version
+spur agent doctor --json
+```
+
+Confirm the reported CLI version is the intended release. `agent doctor` checks executor usability;
+it does not prove authentication or provider quota. The Electron shell is retired: use
+`spur self serve` for the Board.
+
+## 4. Migrate `.spur/config.yaml`
+
+Preserve project-specific values and make only the applicable edits:
+
+| Existing state | Required action |
+| --- | --- |
+| `.spur/config.json` still supplies project config | Move the project-owned values into `.spur/config.yaml`; do not keep a second config authority. |
+| `version` is absent or an integer | Use the YAML string `version: "1.1"`. |
+| `agent.team` or `.spur/fleet.json` declares a roster | Move it to **project-layer** `agent.fleet`. Keep executor profiles in the global layer, not in the fleet. A leftover old carrier fails loading by design. |
+| `workflow.hitlDecisionMaker` | Rename the section to `workflows.hitlDecisionMaker`. |
+| Bun project with no `builder` block | No change: `builder.preset: bun` supplies the existing commands. |
+| Non-Bun project, or custom commands required | Set `builder.preset: none` and bind `builder.actions` (`lint`, `test`, `check`, and any required `*-changed` actions) to the project's real commands. |
+| `tasks.folders` and `tasks.active` | Preserve folder names, labels, `baseCounter`, and the active folder. Archived folders remain readable history, not a bulk-migration target. |
+| `features.dir` | Preserve the existing feature tree and hierarchical IDs; do not renumber features or scenario titles. |
+
+Example non-Bun binding only (replace placeholders with real commands):
+
+```yaml
+builder:
+  preset: none
+  actions:
+    lint: <project-lint-command>
+    test: <project-test-command>
+    check: [lint, test]
+```
+
+Validate resolution without running the actions:
+
+```bash
+spur self exec --list --json
+spur self exec check --dry-run --json
+spur self status --json
+```
+
+Do not copy `config/config.example.yaml` over the project file. That example documents available
+keys; it is not a migration target.
+
+## 5. Reconcile project workflow overrides
+
+The bundled definitions are not drop-in replacements for project overrides. Compare with
+`spur workflow list --json` and validate every project-owned definition with
+`spur workflow validate <path>`.
+
+For 0.4.34 specifically:
+
+- Task execution is D65: `precheck → implement[⇄escalate] → gate[⇄remediate] → review → done`.
+  There are no separate `test`/`test-recheck`, `approve`, `verify`, or `record` states. Completion
+  evidence is a tree-hash gate receipt plus the reviewer verdict; the old proof-digest chain,
+  answer lint, answer-confidence fields, residual sweep, and verdict replay are gone.
+- `deferQualityGate: "true"` makes the incremental gate the per-task default. The full project
+  gate runs once per feature or batch; do not remove that integrated-tree check.
+- Feature verification is owned by `feature-lifecycle`: entering `verifying` runs
+  `spur feature verify`. The separate `feature-verification.yaml` workflow is removed, and
+  `wrapup-pipeline` no longer changes feature status.
+- Planning uses `idea-pipeline`. The legacy planning, docs, feature-development, duplicate task,
+  PR-review, and wayfinder workflow definitions are removed. Route former callers to `idea-pipeline`,
+  `task-pipeline`, `feature-lifecycle`,
+  `spur builder pr-check|pr-open|pr-review|pr-status`, or the wayfinder skill as appropriate.
+- Project-layer `task-lifecycle.yaml` and `feature-lifecycle.yaml` overrides must be re-synced for
+  current guards and the non-terminal `deprecated` state. The status addition itself needs no
+  corpus migration.
+
+## 6. Migrate and validate the planning corpus
+
+Run only the operations that apply to the project's actual state:
+
+```bash
+# A17 normalization only, not a general schema migrator — preview first.
+spur task migrate --dry-run --json
+# If the preview shows wanted A17 changes and no conflicts:
+spur task migrate --json
+
+# Structural checks and optional mechanical repairs; review their diffs afterward.
+spur task check --fix --json
+spur feature check --fix --json
+
+# Required final validation (warnings are reported separately from errors).
+spur task check --corpus --json
+spur feature check --json
+```
+
+`task migrate` normalizes the active task folder (or an explicit `--folder`). It is not a
+feature-migration or a reason to rewrite archived folders. `task check --fix` and
+`feature check --fix` repair structure, not semantics or Gherkin conversion.
+
+Feature acceptance criteria must use valid BDD with a `Feature:` declaration and `Scenario:`
+blocks. Raw legacy bullets need a deliberate conversion through:
+
+```bash
+spur feature update <id> --section 'Acceptance Criteria' --from-file /tmp/<id>-ac.md
+```
+
+Preserve each scenario's R-number and meaning. Use `@deprecated` and a Notes entry for a scenario
+that is historical rather than a current requirement. If validation exposes an old hook or
+lifecycle claim, check the current ADR/design owner instead of editing it blindly.
+
+Preview lifecycle derivation before applying it, then regenerate derived projections only after
+the corpus checks are understood:
+
+```bash
+spur feature sync --all --dry-run --json
+spur feature sync --all --json
+spur feature refresh --all --json
+```
+
+A missing, stale, running, or failed feature-verification receipt is unfinished work, not something
+to hide by forcing a transition. Run `spur feature verify <id>` after the applicable full project
+gate passes. Ordinary warnings can remain visible; do not manufacture a clean report by editing
+history or suppressing findings.
+
+## 7. Final acceptance and rollback
+
+Run the project gate and inspect the migration diff:
+
+```bash
+spur self exec check
+spur self exec check-feature   # when closing a feature; full project gate
+spur workflow list --json
+spur task check --corpus --json
+spur feature check --json
+git diff --check
+git status --short
+```
+
+`check-feature` is the full project gate for feature closure, not a replacement for the default
+incremental task gate. If an action is unbound, fix `builder.actions` instead of substituting a
+command from another repository.
+
+Stop on the first material error. Restore from the backup ref rather than running init or
+bulk-deleting files:
+
+```bash
+git diff <backup-ref> -- .spur/config.yaml docs/features docs/tasks*
+git restore --source=<backup-ref> -- .spur/config.yaml docs/features docs/tasks*
+git status --short
+```
+
+Review new untracked files separately; `git restore` does not remove them. Reinstall the previous
+CLI/plugin version and restore the database backup only after stopping the server. Keep failure
+logs and durable evidence under `.spur/memory/`; `.spur/run/` is disposable scratch, not a rollback
+authority.
+
+## Agent handoff
+
+Give the downstream agent this boundary verbatim:
+
+> Follow `plugins/sp/skills/spur-dev/references/migration-guide.md`. Preserve `.spur/config.yaml`,
+> `docs/features/`, and `docs/tasks*/`. Use dry runs and CLI-gated writes. Do not run `init --force`,
+> replace project workflows wholesale, rewrite historical corpus, or hide verification findings.
+> Stop on the first material error and report it with its evidence.

package/spur.js

@@ -111389,29 +111389,6 @@ function isPlaceholderBody(body) {
   const stripped = body.replace(/<!--[\s\S]*?-->/g, "").replace(/^\s*>\s*TBD\s*$/gim, "").trim();
   return stripped.length === 0;
 }
-function extractBacktickLineAnchors(body) {
-  const out = [];
-  const re = /`([^`\n]+?:(\d+)(?:-(\d+))?)`/g;
-  let m = re.exec(body);
-  while (m !== null) {
-    const raw = m[1] ?? "";
-    const startStr = m[2];
-    const endStr = m[3];
-    if (startStr) {
-      const pathPart = raw.replace(/:(\d+)(?:-(\d+))?$/, "");
-      const hasExt = /\.\w{1,8}$/.test(pathPart.split("/").pop() ?? "");
-      if (pathPart && !pathPart.includes("://") && hasExt) {
-        const startLine = Number(startStr);
-        const endLine = endStr !== undefined ? Number(endStr) : undefined;
-        if (Number.isFinite(startLine) && startLine >= 1) {
-          out.push({ raw, path: pathPart, startLine, endLine });
-        }
-      }
-    }
-    m = re.exec(body);
-  }
-  return out;
-}
 var TaskCheckService;
 var init_task_check = __esm(() => {
   init_src2();
@@ -128900,174 +128877,6 @@ var init_token_ledger_watcher = __esm(() => {
   init_token_ledger_service();
 });
 
-// ../../packages/app/src/services/sdlc-actions.ts
-function isReservedAction(name) {
-  return RESERVED_ACTIONS.includes(name);
-}
-function resolveAction(builder, name) {
-  const reserved = isReservedAction(name);
-  const declared = builder?.actions?.[name];
-  if (declared !== undefined) {
-    return Array.isArray(declared) ? { name, reserved, source: "config", kind: "composite", steps: [...declared] } : { name, reserved, source: "config", kind: "command", command: declared };
-  }
-  if ((builder?.preset ?? "bun") === "bun") {
-    if (reserved)
-      return { name, reserved, source: "preset", kind: "command", command: BUN_PRESET[name] };
-  } else {
-    const command = reserved ? STACK_NEUTRAL_DEFAULTS[name] : undefined;
-    if (command !== undefined)
-      return { name, reserved, source: "default", kind: "command", command };
-  }
-  return { name, reserved, source: "unbound", kind: "unbound" };
-}
-function listActions(builder) {
-  const custom = Object.keys(builder?.actions ?? {}).filter((name) => !isReservedAction(name)).sort();
-  return [...RESERVED_ACTIONS, ...custom].map((name) => resolveAction(builder, name));
-}
-function renderScoped(command, values) {
-  let rendered = command;
-  for (const [placeholder, items] of [
-    ["{files}", values.files],
-    ["{paths}", values.paths]
-  ]) {
-    if (!rendered.includes(placeholder))
-      continue;
-    if (items === undefined)
-      throw new Error(`renderScoped: ${placeholder} has no value`);
-    if (items.length === 0)
-      throw new Error(`renderScoped: ${placeholder} has an empty list`);
-    rendered = rendered.replaceAll(placeholder, () => items.map(shQuote2).join(" "));
-  }
-  if (rendered.includes("{workspace}")) {
-    const workspace = values.workspace;
-    if (workspace === undefined)
-      throw new Error("renderScoped: {workspace} has no value");
-    if (workspace.length === 0)
-      throw new Error("renderScoped: {workspace} is empty");
-    rendered = rendered.replaceAll("{workspace}", () => shQuote2(workspace));
-  }
-  return rendered;
-}
-var RESERVED_ACTIONS, BUN_PRESET, STACK_NEUTRAL_DEFAULTS;
-var init_sdlc_actions = __esm(() => {
-  init_src();
-  RESERVED_ACTIONS = SDLC_ACTIONS;
-  BUN_PRESET = {
-    build: "bun run build",
-    dev: "bun run dev",
-    clean: "bun run clean",
-    format: "bun run format",
-    autofix: "bun run autofix",
-    lint: "bun run lint",
-    typecheck: "bun run typecheck",
-    test: "bun run test",
-    "test-full": "bun run test:full",
-    "test-heavy": "bun run test:heavy",
-    "rules-pre": "bun run test-pre-check",
-    "rules-post": "bun run test-post-check",
-    check: "bun run spur-check",
-    "check-full": "bun run spur-check:full",
-    "check-feature": "bun run spur-check-feature",
-    "lint-changed": "bunx biome check {files}",
-    "typecheck-changed": "cd {workspace} && bun run typecheck",
-    "test-changed": "cd {workspace} && bun test --coverage --coverage-reporter=text {paths}"
-  };
-  STACK_NEUTRAL_DEFAULTS = SDLC_STACK_NEUTRAL_ACTIONS;
-});
-
-// ../../packages/app/src/services/verdict-replay.ts
-function citedTestAnchors(rows, max) {
-  const seen = new Map;
-  for (const row of rows) {
-    for (const anchor of extractBacktickLineAnchors(row.evidence ?? "")) {
-      if (!TEST_FILE_PATTERN.test(anchor.path) || seen.has(anchor.path))
-        continue;
-      seen.set(anchor.path, anchor.raw);
-    }
-  }
-  return new Map([...seen].slice(0, max));
-}
-function replayWorkspace(file) {
-  const parts = file.split("/");
-  if (parts.length >= 3 && (parts[0] === "apps" || parts[0] === "packages"))
-    return `${parts[0]}/${parts[1]}`;
-  return ".";
-}
-async function replayCitedTests(rows, options = {}) {
-  const cwd = options.cwd ?? process.cwd();
-  const timeoutMs = options.timeoutMs ?? REPLAY_TIMEOUT_MS;
-  const anchors = citedTestAnchors(rows, options.maxFiles ?? REPLAY_MAX_FILES);
-  const files = [...anchors.keys()];
-  const executor = options.executor ?? new NodeProcessExecutor2;
-  const fileSystem = options.fs ?? createNodeFileSystem2();
-  const resolved = resolveAction(options.builder, "test-changed");
-  const template = resolved.kind === "command" ? resolved.command : resolved.kind === "composite" ? resolved.steps.join(" && ") : "";
-  const ran = [];
-  const skipped = [];
-  const findings = [];
-  const thresholdByWorkspace = new Map;
-  for (const file of files) {
-    const anchor = anchors.get(file) ?? file;
-    const exists = await fileSystem.exists(`${cwd}/${file}`);
-    if (!exists) {
-      findings.push({ anchor, file, missing: true });
-      continue;
-    }
-    if (template.length === 0)
-      continue;
-    const workspace = replayWorkspace(file);
-    let threshold = thresholdByWorkspace.get(workspace);
-    if (threshold === undefined) {
-      threshold = await declaresCoverageThreshold(fileSystem, `${cwd}/${workspace}/bunfig.toml`);
-      thresholdByWorkspace.set(workspace, threshold);
-    }
-    if (threshold) {
-      skipped.push({ file, reason: `coverageThreshold in ${workspace}/bunfig.toml` });
-      continue;
-    }
-    const path = workspace === "." ? file : file.slice(workspace.length + 1);
-    const command = renderScoped(template, { workspace, paths: [path] });
-    const result = await executor.run({
-      command: "sh",
-      args: ["-c", command],
-      cwd,
-      forceBuffered: true,
-      rejectOnError: false,
-      timeout: timeoutMs
-    });
-    const exitCode = result.exitCode ?? null;
-    ran.push({ file, exitCode });
-    if (result.outcome === "timeout")
-      findings.push({ anchor, file, timedOut: true, exitCode });
-    else if (exitCode !== 0)
-      findings.push({ anchor, file, exitCode });
-  }
-  return { files, ran, skipped, findings };
-}
-async function declaresCoverageThreshold(fileSystem, bunfigPath) {
-  try {
-    if (!await fileSystem.exists(bunfigPath))
-      return false;
-    return COVERAGE_THRESHOLD_PATTERN.test(await fileSystem.readFile(bunfigPath));
-  } catch {
-    return false;
-  }
-}
-function formatReplayReport(replay) {
-  return {
-    summary: `Replay: ${replay.files.length} cited test file(s), ${replay.findings.length} finding(s)${replay.skipped.length > 0 ? `, ${replay.skipped.length} skipped` : ""}`,
-    findings: replay.findings.map((finding) => `  ${finding.anchor}: ${finding.missing ? "missing" : finding.timedOut ? "timed out" : `exit ${finding.exitCode ?? "unknown"}`}`)
-  };
-}
-var REPLAY_MAX_FILES = 5, REPLAY_TIMEOUT_MS = 120000, TEST_FILE_PATTERN, COVERAGE_THRESHOLD_PATTERN;
-var init_verdict_replay = __esm(() => {
-  init_dist5();
-  init_sdlc_actions();
-  init_task_check();
-  TEST_FILE_PATTERN = /\.(?:test|spec)\.[cm]?[jt]sx?$/;
-  COVERAGE_THRESHOLD_PATTERN = /^\s*coverageThreshold\s*=/m;
-});
-
 // ../../packages/app/src/workflow/checkpoint-contract.ts
 function parseCheckpointMetadata(raw) {
   if (!raw.startsWith("---"))
@@ -136582,7 +136391,6 @@ var init_src4 = __esm(() => {
   init_task_verdict();
   init_token_ledger_service();
   init_token_ledger_watcher();
-  init_verdict_replay();
   init_warm_turn_dispatch();
   init_workflow_clean_ops();
   init_workflow_service();
@@ -143810,6 +143618,81 @@ var init_task_diffstat = __esm(() => {
   init_task_triage();
 });
 
+// ../../packages/app/src/services/sdlc-actions.ts
+function isReservedAction(name) {
+  return RESERVED_ACTIONS.includes(name);
+}
+function resolveAction(builder, name) {
+  const reserved = isReservedAction(name);
+  const declared = builder?.actions?.[name];
+  if (declared !== undefined) {
+    return Array.isArray(declared) ? { name, reserved, source: "config", kind: "composite", steps: [...declared] } : { name, reserved, source: "config", kind: "command", command: declared };
+  }
+  if ((builder?.preset ?? "bun") === "bun") {
+    if (reserved)
+      return { name, reserved, source: "preset", kind: "command", command: BUN_PRESET[name] };
+  } else {
+    const command = reserved ? STACK_NEUTRAL_DEFAULTS[name] : undefined;
+    if (command !== undefined)
+      return { name, reserved, source: "default", kind: "command", command };
+  }
+  return { name, reserved, source: "unbound", kind: "unbound" };
+}
+function listActions(builder) {
+  const custom = Object.keys(builder?.actions ?? {}).filter((name) => !isReservedAction(name)).sort();
+  return [...RESERVED_ACTIONS, ...custom].map((name) => resolveAction(builder, name));
+}
+function renderScoped(command, values) {
+  let rendered = command;
+  for (const [placeholder, items] of [
+    ["{files}", values.files],
+    ["{paths}", values.paths]
+  ]) {
+    if (!rendered.includes(placeholder))
+      continue;
+    if (items === undefined)
+      throw new Error(`renderScoped: ${placeholder} has no value`);
+    if (items.length === 0)
+      throw new Error(`renderScoped: ${placeholder} has an empty list`);
+    rendered = rendered.replaceAll(placeholder, () => items.map(shQuote2).join(" "));
+  }
+  if (rendered.includes("{workspace}")) {
+    const workspace = values.workspace;
+    if (workspace === undefined)
+      throw new Error("renderScoped: {workspace} has no value");
+    if (workspace.length === 0)
+      throw new Error("renderScoped: {workspace} is empty");
+    rendered = rendered.replaceAll("{workspace}", () => shQuote2(workspace));
+  }
+  return rendered;
+}
+var RESERVED_ACTIONS, BUN_PRESET, STACK_NEUTRAL_DEFAULTS;
+var init_sdlc_actions = __esm(() => {
+  init_src();
+  RESERVED_ACTIONS = SDLC_ACTIONS;
+  BUN_PRESET = {
+    build: "bun run build",
+    dev: "bun run dev",
+    clean: "bun run clean",
+    format: "bun run format",
+    autofix: "bun run autofix",
+    lint: "bun run lint",
+    typecheck: "bun run typecheck",
+    test: "bun run test",
+    "test-full": "bun run test:full",
+    "test-heavy": "bun run test:heavy",
+    "rules-pre": "bun run test-pre-check",
+    "rules-post": "bun run test-post-check",
+    check: "bun run spur-check",
+    "check-full": "bun run spur-check:full",
+    "check-feature": "bun run spur-check-feature",
+    "lint-changed": "bunx biome check {files}",
+    "typecheck-changed": "cd {workspace} && bun run typecheck",
+    "test-changed": "cd {workspace} && bun test --coverage --coverage-reporter=text {paths}"
+  };
+  STACK_NEUTRAL_DEFAULTS = SDLC_STACK_NEUTRAL_ACTIONS;
+});
+
 // ../../packages/app/src/services/quality-gate.ts
 import { spawnSync as spawnSync6 } from "child_process";
 import { randomUUID as randomUUID12 } from "crypto";
@@ -144131,7 +144014,7 @@ function lightScope(changedFiles, exists = existsSync23, graph) {
           tests.add(candidate);
           matched = true;
         }
-      } else if (rest.startsWith("tests/") && TEST_FILE_PATTERN2.test(rest)) {
+      } else if (rest.startsWith("tests/") && TEST_FILE_PATTERN.test(rest)) {
         tests.add(file);
         matched = true;
       }
@@ -144148,7 +144031,7 @@ function lightScope(changedFiles, exists = existsSync23, graph) {
       const candidate = `${workspace}/tests/${rest.slice("src/".length).replace(/\.tsx?$/, (ext) => `.test${ext}`)}`;
       if (exists(candidate))
         tests.add(candidate);
-    } else if (rest.startsWith("tests/") && TEST_FILE_PATTERN2.test(rest)) {
+    } else if (rest.startsWith("tests/") && TEST_FILE_PATTERN.test(rest)) {
       tests.add(file);
     }
   }
@@ -144959,7 +144842,7 @@ function qualityGateMain(argv, rawEnv = getEnvVars(), options = {}) {
     return 2;
   }
 }
-var MAX_GATE_ATTEMPTS = 5, MAX_FINDINGS = 20, RETRY_DELAY_MS_DEFAULT = 1e4, RETRY_DELAY_MS_ENV = "SPUR_QUALITY_GATE_RETRY_DELAY_MS", GATE_TIMEOUT_MS_ENV = "gateTimeoutMs", GATE_TIMEOUT_MS_DEFAULT = 900000, LOCKED_PATTERN, FINDINGS_PATTERN, COVERAGE_ROW_PATTERN, RECEIPT_SCHEMA_VERSION = "check-receipt/v1", TEST_FILE_PATTERN2, GATE_LOCK_DIR_ENV = "SPUR_GATE_LOCK_DIR", GATE_LOCK_POLL_MS_ENV = "SPUR_GATE_LOCK_POLL_MS", GATE_LOCK_OFF_ENV = "SPUR_GATE_LOCK", GATE_LOCK_TOKEN_ENV = "SPUR_GATE_LOCK_TOKEN", GATE_LOCK_POLL_MS_DEFAULT = 5000, GATE_LOCK_TIMEOUT_MS_ENV = "SPUR_GATE_LOCK_TIMEOUT_MS", GATE_LOCK_TIMEOUT_MS_DEFAULT, GATE_LOCK_MKDIR_HOLD_MS_ENV = "SPUR_GATE_LOCK_TEST_MKDIR_HOLD_MS", GATE_LOCK_LOST_RACE_SLEEP_MS = 20, GATE_LOCK_LOST_RACE_LOG_AT = 250, GateLockTimeoutError, QUALITY_GATE_MODES, QUALITY_GATE_USAGE = "usage: spur task gate <wbs> <run|recheck|light|deferred|status>  (env: qualityGateCmd, gateProbeCmd, runId)";
+var MAX_GATE_ATTEMPTS = 5, MAX_FINDINGS = 20, RETRY_DELAY_MS_DEFAULT = 1e4, RETRY_DELAY_MS_ENV = "SPUR_QUALITY_GATE_RETRY_DELAY_MS", GATE_TIMEOUT_MS_ENV = "gateTimeoutMs", GATE_TIMEOUT_MS_DEFAULT = 900000, LOCKED_PATTERN, FINDINGS_PATTERN, COVERAGE_ROW_PATTERN, RECEIPT_SCHEMA_VERSION = "check-receipt/v1", TEST_FILE_PATTERN, GATE_LOCK_DIR_ENV = "SPUR_GATE_LOCK_DIR", GATE_LOCK_POLL_MS_ENV = "SPUR_GATE_LOCK_POLL_MS", GATE_LOCK_OFF_ENV = "SPUR_GATE_LOCK", GATE_LOCK_TOKEN_ENV = "SPUR_GATE_LOCK_TOKEN", GATE_LOCK_POLL_MS_DEFAULT = 5000, GATE_LOCK_TIMEOUT_MS_ENV = "SPUR_GATE_LOCK_TIMEOUT_MS", GATE_LOCK_TIMEOUT_MS_DEFAULT, GATE_LOCK_MKDIR_HOLD_MS_ENV = "SPUR_GATE_LOCK_TEST_MKDIR_HOLD_MS", GATE_LOCK_LOST_RACE_SLEEP_MS = 20, GATE_LOCK_LOST_RACE_LOG_AT = 250, GateLockTimeoutError, QUALITY_GATE_MODES, QUALITY_GATE_USAGE = "usage: spur task gate <wbs> <run|recheck|light|deferred|status>  (env: qualityGateCmd, gateProbeCmd, runId)";
 var init_quality_gate = __esm(() => {
   init_dist();
   init_proof_input_fingerprint();
@@ -144967,7 +144850,7 @@ var init_quality_gate = __esm(() => {
   LOCKED_PATTERN = /SQLiteError: database is locked|SQLite database .*is busy|SQLITE_BUSY/;
   FINDINGS_PATTERN = /[A-Za-z0-9_./-]+\.[A-Za-z]+:[0-9]+/g;
   COVERAGE_ROW_PATTERN = /^\s*(\S+\.[A-Za-z]+)\s*\|\s*([\d.]+)\s*\|\s*([\d.]+)\s*\|\s*(\S*)/;
-  TEST_FILE_PATTERN2 = /\.test\.tsx?$/;
+  TEST_FILE_PATTERN = /\.test\.tsx?$/;
   GATE_LOCK_TIMEOUT_MS_DEFAULT = 2 * 60 * 60 * 1000;
   GateLockTimeoutError = class GateLockTimeoutError extends Error {
     constructor(message) {
@@ -158122,7 +158005,7 @@ function registerTaskUpdateCommand(task, context) {
 // src/commands/task/verdict.ts
 init_src4();
 function registerTaskVerdictCommand(task, context) {
-  task.command("verdict").summary("Derive PASS/PARTIAL/FAIL/UNKNOWN verdict from verify answer text (replaces pipeline grep/shell).").argument("<wbs>", "Task WBS number").option("--from-answer <path>", "Path to verify answer text file").option("--replay", "Re-execute the test files the verdict rows cite; a failure downgrades PASS to PARTIAL").option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).option(...SHARED_OPTIONS.jsonEnvelope).action(async (wbs, options) => {
+  task.command("verdict").summary("Derive PASS/PARTIAL/FAIL/UNKNOWN verdict from verify answer text (replaces pipeline grep/shell).").argument("<wbs>", "Task WBS number").option("--from-answer <path>", "Path to verify answer text file").option(...SHARED_OPTIONS.folderTasks).option(...SHARED_OPTIONS.json).option(...SHARED_OPTIONS.jsonEnvelope).action(async (wbs, options) => {
     await Promise.resolve().then(() => init_src4());
     const answerPath = options.fromAnswer ?? `.spur/run/${wbs}-verify-answer.txt`;
     let answerText;
@@ -158143,17 +158026,9 @@ function registerTaskVerdictCommand(task, context) {
     const taskCheckPassed = true;
     const taskAc = await readTaskAcceptanceCriteria(wbs, corpusDeps);
     const result = deriveVerdict(answerText, taskCheckPassed, taskAc);
-    const replay = options.replay === true ? await replayCitedTests([...result.requirements, ...result.acceptanceCriteria ?? []], {
-      cwd: context.cwd,
-      builder: context.spurConfig?.builder
-    }) : undefined;
-    const downgraded = replay !== undefined && replay.findings.length > 0 && result.verdict === "PASS";
-    if (downgraded)
-      result.verdict = "PARTIAL";
     const jsonOut = JSON.stringify({
       wbs,
       ...result,
-      ...replay !== undefined ? { replay } : {},
       source: "spur-task-verdict"
     }, null, 2);
     await context.fs.ensureDir(".spur/run");
@@ -158163,12 +158038,6 @@ function registerTaskVerdictCommand(task, context) {
       context.output.write(jsonOut);
     } else {
       context.output.write(`Verdict: ${result.verdict} (${result.requirements.length} requirements, ${result.checks.length} checks)`);
-      if (replay !== undefined) {
-        const report = formatReplayReport(replay);
-        context.output.write(report.summary);
-        for (const line of report.findings)
-          context.output.error(line);
-      }
     }
     if (result.verdict !== "PASS") {
       context.setExitCode(1);
@@ -163067,7 +162936,7 @@ init_src2();
 var CLI_CONFIG = {
   binaryName: "spur",
   binaryLabel: "spur",
-  binaryVersion: "0.4.34",
+  binaryVersion: "0.4.35",
   configDir: ".spur",
   configFile: ".spur/config.yaml",
   databaseFile: ".spur/spur.db"
@@ -170806,7 +170675,7 @@ init_dist5();
 import { homedir as homedir17 } from "os";
 import { basename as basename21, join as join91, relative as relative18, resolve as resolve37 } from "path";
 // ../server/package.json
-var version4 = "0.4.34";
+var version4 = "0.4.35";
 
 // ../server/src/modules/health/index.ts
 var startedAt = Date.now();