@sporhq/spor 0.16.0 → 0.17.0

package/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "name": "spor",
   "displayName": "Spor Context Compiler",
   "description": "Maintains a typed, versioned knowledge graph and compiles compact briefings from it: session-start injection, per-prompt relevance digests, capture at discovery, end-of-session distillation, decision queue.",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "author": {
     "name": "losthammer"
   }

package/bin/spor.js

@@ -107,7 +107,7 @@ function ensureInitialCommit(home) {
   if (git(home, ["rev-parse", "--verify", "-q", "HEAD"]).status === 0) return;
   git(home, ["add", "nodes"]); // nodes/ always exists (ensureGraphHome made it)
   if (fs.existsSync(path.join(home, ".gitignore"))) git(home, ["add", ".gitignore"]);
-  git(home, ["commit", "-q", "--allow-empty", "-m", "spor: initialize graph"]);
+  git(home, [...u.NO_GPGSIGN, "commit", "-q", "--allow-empty", "-m", "spor: initialize graph"]);
 }
 
 // Idempotently create the local graph home (nodes/, git, .gitignore, a
@@ -630,10 +630,10 @@ async function fetchQueuePaged(cfg, baseQs, target) {
   return { ok: true, json: envelope };
 }
 
-async function cmdGet(cfg, { positionals }) {
+async function cmdGet(cfg, { positionals, values }) {
   const id = positionals[0];
   if (!id) {
-    err("usage: spor get <id>");
+    err("usage: spor get <id> [--json]");
     return 1;
   }
   if (cfg.mode() === "remote") {
@@ -650,18 +650,100 @@ async function cmdGet(cfg, { positionals }) {
       err(`error ${r.status}`);
       return 1;
     }
-    out(r.json && r.json.raw ? r.json.raw : r.text);
+    if (!values.json) {
+      out(r.json && r.json.raw ? r.json.raw : r.text);
+      return 0;
+    }
+    // --json: parse the raw with the SAME lib parser as local (parity), take the
+    // server's git-blob-sha revision, and gather inbound edges from the team graph
+    // (the documented graph-wide sweep via GET /v1/export — there is no inbound
+    // endpoint, the same path `spor query --to` walks).
+    const graphLib = require(path.join(ROOT, "lib", "graph.js"));
+    const raw = r.json && r.json.raw;
+    if (typeof raw !== "string") {
+      err(`error: server returned no node body for ${id}`);
+      return 1;
+    }
+    const node = graphLib.parseFrontmatter(raw, `${id}.md`);
+    const fetched = await fetchRemoteExportNodes(cfg, "get");
+    if (fetched.error) return 1; // already reported
+    let inbound;
+    try {
+      inbound = inboundEdges(graphLib.loadGraph(fetched.nodesDir), node.id);
+    } finally {
+      fetched.cleanup();
+    }
+    out(JSON.stringify(getNodeJson(node, inbound, r.json.revision), null, 2));
     return 0;
   }
   // local: read the node file
-  const f = path.join(cfg.nodesDir(), `${id}.md`);
+  const nodesDir = cfg.nodesDir();
+  const f = path.join(nodesDir, `${id}.md`);
+  if (!values.json) {
+    try {
+      out(fs.readFileSync(f, "utf8"));
+      return 0;
+    } catch {
+      err(`no such node: ${id}`);
+      return 1;
+    }
+  }
+  // --json: parse the file, scan the loaded graph for inbound edges, and stamp the
+  // git blob SHA as `revision` — recomputed zero-dep (crypto builtin), byte-
+  // identical to the server's value for the same content (norm-spor-cli-mode-parity).
+  let raw;
   try {
-    out(fs.readFileSync(f, "utf8"));
-    return 0;
+    raw = fs.readFileSync(f);
   } catch {
     err(`no such node: ${id}`);
     return 1;
   }
+  const graphLib = require(path.join(ROOT, "lib", "graph.js"));
+  const node = graphLib.parseFrontmatter(raw.toString("utf8"), `${id}.md`);
+  const inbound = inboundEdges(graphLib.loadGraph(nodesDir), node.id);
+  out(JSON.stringify(getNodeJson(node, inbound, gitBlobSha(raw)), null, 2));
+  return 0;
+}
+
+// The `spor get --json` shape (issue-spor-cli-get-missing-json-flag): one
+// structured object so scripts stop scraping frontmatter. Built from a node
+// parsed by the SAME lib/graph parser in both modes (norm-spor-cli-mode-parity).
+// Frontmatter = lib/query.js's shared cleanNode projection (drop the load-time
+// `file` artifact + the parser's empty pin/exclude registers) minus what we
+// surface separately (edges, body); the synthesized `project` (from repo:) is
+// kept — every consumer keys on it and the server's frontmatter carries it too.
+function getNodeJson(node, inbound, revision) {
+  const { cleanNode } = require(path.join(ROOT, "lib", "query.js"));
+  const frontmatter = cleanNode(node);
+  delete frontmatter.edges;
+  delete frontmatter.body;
+  return {
+    id: node.id,
+    frontmatter,
+    body: node.body || "",
+    edges: { outbound: node.edges || [], inbound: inbound || [] },
+    revision: revision ?? null,
+  };
+}
+
+// Inbound edges to a node from a loaded graph — every other node's out-edge that
+// points here, as {from, type}. Reuses lib/query.js's --to walk (a node only
+// stores its own out-edges, so inbound is a whole-graph scan).
+function inboundEdges(graph, id) {
+  const { queryGraph } = require(path.join(ROOT, "lib", "query.js"));
+  return queryGraph(graph, { edges: true, to: id }).edges.map((e) => ({ from: e.from, type: e.type }));
+}
+
+// The git blob SHA of a node's bytes — the value the server stores as `revision`
+// (API.md §0) and an update sends back. Pure Node (crypto builtin, zero-dep):
+// sha1 of "blob <len>\0<bytes>", exactly `git hash-object`, so a local --json
+// revision is byte-identical to the server's for the same content (verified
+// against the live graph).
+function gitBlobSha(buf) {
+  const h = require("crypto").createHash("sha1");
+  h.update(`blob ${buf.length}\0`);
+  h.update(buf);
+  return h.digest("hex");
 }
 
 // --- spor blame / commits: commit-sha -> nodes reverse lookup ---------------
@@ -1812,6 +1894,25 @@ function today() {
   return new Date().toISOString().slice(0, 10);
 }
 
+// An id round-trips through the frontmatter edge parser only if it is all [\w-]:
+// lib/kernel/graph.js parseFrontmatter captures an edge `to:` as [\w-]+, so any
+// other character makes the whole "- {type: X, to: Y}" line fail to match and
+// silently vanish on read, breaking the reference without a trace. Edges we write
+// locally (spor add --during/--blocks, spor ask --mention) must reject such ids
+// rather than drop them — remote mode already rejects them server-side
+// (issue-spor-local-add-ask-project-normalization-edge-validation).
+const EDGE_ID_RE = /^[\w-]+$/;
+// First [flag, id] pair whose id won't round-trip, or null when all are clean.
+function firstBadEdgeId(pairs) {
+  for (const [flag, id] of pairs) {
+    if (id != null && !EDGE_ID_RE.test(id)) return { flag, id };
+  }
+  return null;
+}
+function edgeIdErr(bad) {
+  return `invalid ${bad.flag} id "${bad.id}" — node ids may contain only letters, digits, '-' and '_'; this edge would be silently dropped on read.`;
+}
+
 // Spool a failed remote capture body to the SHARED outbox
 // (graphHome/outbox/*.capture.json) — the exact queue session-start's
 // drain-outbox engine replays to /v1/capture. The body is written VERBATIM so the
@@ -1907,6 +2008,25 @@ async function cmdAdd(cfg, { values, positionals }) {
     err(`no graph at ${nodesDir} — run 'spor init' first`);
     return 1;
   }
+  // Reject an edge target id that wouldn't round-trip through the frontmatter
+  // parser before we write the node — otherwise the edge silently vanishes on
+  // the next read (issue-spor-local-add-ask-project-normalization-edge-validation).
+  const badEdge = firstBadEdgeId([["--during", during], ["--blocks", blocks]]);
+  if (badEdge) {
+    err(edgeIdErr(badEdge));
+    return 1;
+  }
+  // Normalize an explicit --project the same way an inferred slug already is
+  // (safeSlug -> projectSlug), so `--project My_Repo` files the node under
+  // `my-repo` instead of stamping the verbatim, non-canonical value the server
+  // would have rejected. safeSlug() is already normalized, so this only bites the
+  // explicit flag; a flag with no slug characters is a hard error, not a silent
+  // empty stamp (issue-spor-local-add-ask-project-normalization-edge-validation).
+  const localProject = values.project ? u.slugify(values.project) : project;
+  if (values.project && !localProject) {
+    err(`invalid --project "${values.project}" — it has no slug characters (expected ^[a-z0-9][a-z0-9-]*$).`);
+    return 1;
+  }
   const type = values.type || "task";
   const title = values.title || prose.split(/\s+/).slice(0, 10).join(" ");
   const summary = prose.length > 500 ? prose.slice(0, 497) + "..." : prose;
@@ -1935,7 +2055,7 @@ async function cmdAdd(cfg, { values, positionals }) {
   if (blocks) edgeLines.push(`  - {type: blocks, to: ${blocks}}`);
   const edgesBlock = edgeLines.length ? `edges:\n${edgeLines.join("\n")}\n` : "";
   const neededByLine = neededBy ? `needed_by: ${neededBy}\n` : "";
-  const md = `---\nid: ${id}\ntype: ${type}\nrepo: ${project}\ntitle: ${title.replace(/\n/g, " ")}\nsummary: ${summary.replace(/\n/g, " ")}\n${neededByLine}${edgesBlock}date: ${today()}\n---\n\n${prose}\n`;
+  const md = `---\nid: ${id}\ntype: ${type}\nrepo: ${localProject}\ntitle: ${title.replace(/\n/g, " ")}\nsummary: ${summary.replace(/\n/g, " ")}\n${neededByLine}${edgesBlock}date: ${today()}\n---\n\n${prose}\n`;
   // validate before writing (parse, then the same rules lib/validate enforces)
   let node;
   try {
@@ -2024,7 +2144,24 @@ async function cmdAsk(cfg, { values, positionals }) {
     err(`no graph at ${nodesDir} — run 'spor init' first`);
     return 1;
   }
-  const slug = project || safeSlug();
+  // Reject a --mention id that wouldn't round-trip through the frontmatter parser
+  // before writing, so the mentions edge can't silently vanish on read
+  // (issue-spor-local-add-ask-project-normalization-edge-validation).
+  const badMention = firstBadEdgeId(mentions.map((m) => ["--mention", m]));
+  if (badMention) {
+    err(edgeIdErr(badMention));
+    return 1;
+  }
+  // Normalize an explicit --project to the canonical slug the cwd fallback
+  // already is (safeSlug -> projectSlug), so `--project My_Repo` stamps `my-repo`
+  // instead of a verbatim, non-canonical value the server would have rejected; a
+  // flag with no slug characters is a hard error, not a silent empty stamp
+  // (issue-spor-local-add-ask-project-normalization-edge-validation).
+  if (project && !u.slugify(project)) {
+    err(`invalid --project "${project}" — it has no slug characters (expected ^[a-z0-9][a-z0-9-]*$).`);
+    return 1;
+  }
+  const slug = project ? u.slugify(project) : safeSlug();
   const titleText = title || text.split(/\s+/).slice(0, 10).join(" ");
   const summary = text.length > 500 ? text.slice(0, 497) + "..." : text;
 
@@ -4426,12 +4563,12 @@ function cmdMigrate(cfg, { positionals }) {
   const dirty = (git(home, ["status", "--porcelain"]).stdout || "").trim();
   const hasCommit = git(home, ["rev-parse", "--verify", "-q", "HEAD"]).status === 0;
   if (dirty || !hasCommit) {
-    let c = git(home, ["commit", "-q", "-m", "spor: graph snapshot"]);
+    let c = git(home, [...u.NO_GPGSIGN, "commit", "-q", "-m", "spor: graph snapshot"]);
     // No git identity configured in this environment — fall back so the
     // housekeeping commit still lands. The user's own identity is preferred
     // whenever git has one; this only fires when it has none.
     if (c.status !== 0 && /identity|user\.(email|name)|empty ident/i.test(c.stderr || "")) {
-      c = git(home, ["-c", "user.email=spor@localhost", "-c", "user.name=spor", "commit", "-q", "-m", "spor: graph snapshot"]);
+      c = git(home, [...u.NO_GPGSIGN, "-c", "user.email=spor@localhost", "-c", "user.name=spor", "commit", "-q", "-m", "spor: graph snapshot"]);
     }
     if (c.status !== 0) {
       err(`could not commit the graph: ${(c.stderr || "").trim() || "nothing to commit"}`);
@@ -7513,10 +7650,20 @@ const COMMANDS = {
     run: (cfg, args) => cmdNext(cfg, args),
   },
   get: {
-    group: "Graph", parse: "strict", args: "<id>", options: {},
+    group: "Graph", parse: "strict", args: "<id> [--json]",
+    options: {
+      json: { type: "boolean", desc: "structured JSON: frontmatter, edges (inbound+outbound), body, revision" },
+    },
     summary: "a node by id (local: file; remote: /v1/nodes/<id>)",
-    help: "Print one node's raw markdown by id. Remote mode reads /v1/nodes/<id>; local\nmode reads the node file. A missing node exits 1.",
-    examples: ["spor get dec-cc-zero-dep-client"],
+    help:
+      "Print one node's raw markdown by id. Remote mode reads /v1/nodes/<id>; local\n" +
+      "mode reads the node file. A missing node exits 1.\n\n" +
+      "--json emits a structured object — {id, frontmatter, body, edges:{outbound,\n" +
+      "inbound}, revision} — so scripts and tooling stop scraping markdown\n" +
+      "frontmatter. `revision` is the git blob SHA an update sends; inbound edges are\n" +
+      "gathered by scanning the whole graph (remote fetches GET /v1/export), so --json\n" +
+      "is heavier than the plain read. Mode-symmetric (norm-spor-cli-mode-parity).",
+    examples: ["spor get dec-cc-zero-dep-client", "spor get dec-cc-zero-dep-client --json"],
     run: (cfg, p) => cmdGet(cfg, p),
   },
   blame: {
@@ -8339,7 +8486,7 @@ async function main() {
 // Expose the pure helpers for unit tests (the version-check logic has no I/O),
 // and only run the CLI when invoked directly — requiring this file must not
 // kick off main() and call process.exit under the test runner.
-module.exports = { nodeFloor, nodeRuntimeCheck, verCmp, sporConnectorBound, COMMANDS, resolveVerb };
+module.exports = { nodeFloor, nodeRuntimeCheck, verCmp, sporConnectorBound, COMMANDS, resolveVerb, getNodeJson, gitBlobSha };
 
 if (require.main === module) {
   main()

package/lib/config.js

@@ -118,6 +118,16 @@ function isPlainObject(v) {
   return v != null && typeof v === "object" && !Array.isArray(v);
 }
 
+// True iff `p` is a regular file (follows symlinks). Fail-open: any stat error
+// (absent, unreadable, EPERM) reads as "not a file" rather than throwing.
+function isFile(p) {
+  try {
+    return fs.statSync(p).isFile();
+  } catch {
+    return false;
+  }
+}
+
 // Deep-merge src onto dst (mutates dst). Objects merge recursively; arrays and
 // scalars replace wholesale (a higher layer's list overrides, never appends).
 function deepMerge(dst, src) {
@@ -201,14 +211,24 @@ function repoConfigFiles(cwd) {
 // (task-spor-plugin-opt-in-default) — it marks a repo that `spor enable`,
 // `spor link`, or `spor dispatch --backfill` has touched. Mirrors the
 // nearest-ancestor walks used for `.spor.json` config and the `.spor` graph
-// binding. Fail-open: existsSync never throws, so an unreadable level reads as
+// binding.
+//
+// A marker is only ever a regular FILE: the flat `.spor` identity marker is
+// `key: value` text (what repoMarkerGraph/repoMarkerOrg/projectSlug read) and
+// `.spor.json` is a JSON config file. The default LOCAL graph home is itself a
+// DIRECTORY named `.spor` (`~/.spor`), so a bare existsSync would treat the
+// graph home as a repo marker and falsely opt-in EVERY markerless repo nested
+// under it (issue-spor-home-dir-marker-opt-in-leak). Requiring a regular file
+// excludes the graph-home directory (and any other `.spor` directory, e.g. a
+// `graph:` binding target) while still matching every real opt-in marker.
+// Fail-open: isFile() swallows stat errors, so an unreadable level reads as
 // absent rather than erroring.
 function repoMarkerPresent(cwd) {
   const seen = new Set();
   for (let dir = cwd || ""; dir; dir = path.dirname(dir)) {
     if (seen.has(dir)) break;
     seen.add(dir);
-    if (fs.existsSync(path.join(dir, ".spor")) || fs.existsSync(path.join(dir, ".spor.json"))) return true;
+    if (isFile(path.join(dir, ".spor")) || isFile(path.join(dir, ".spor.json"))) return true;
     if (dir === path.dirname(dir)) break; // hit fs root
   }
   return false;

package/lib/kernel/resolution.js

@@ -31,6 +31,11 @@
 const TERMINAL = new Set([
   "done", "resolved", "superseded", "rejected", "closed", "completed", "abandoned", "answered",
   "merged", // a triaged capture-pending: its content now lives in proper nodes
+  "dismissed", // a gardener finding deliberately dismissed: drops from the queue
+               // AND stays sticky — the server gardener's re-open branch only
+               // revives `resolved` findings, never a dismissal
+               // (issue-cc-dismissed-status-not-terminal,
+               // dec-spor-gardener-reopen-warranted-resolved-finding)
 ]);
 // Fallback resolving partition, used ONLY when a graph carries no registry
 // (hand-built test graphs). The live partition is read off graph.registry

package/lib/query.js

@@ -123,7 +123,22 @@ function lookupCommit(graph, sha, repo = null) {
   return out;
 }
 
-module.exports = { queryGraph, fieldMatches, lookupCommit };
+// Project a loaded node for JSON output: drop the parser's load-time `file`
+// artifact, and drop pin/exclude when empty — the regex parser initializes both
+// to [] on every node, so they are noise unless a briefing/correction actually
+// populated them (a non-empty list is kept). Deletes from a shallow copy so the
+// original key order is preserved. Shared by `spor query --json` (the CLI below)
+// and `spor get --json` (bin/spor.js getNodeJson) so the projection rule lives in
+// ONE place.
+function cleanNode(n) {
+  const out = { ...n };
+  delete out.file;
+  if (Array.isArray(out.pin) && !out.pin.length) delete out.pin;
+  if (Array.isArray(out.exclude) && !out.exclude.length) delete out.exclude;
+  return out;
+}
+
+module.exports = { queryGraph, fieldMatches, lookupCommit, cleanNode };
 
 // ---------- CLI (local mode / debugging) ----------
 
@@ -175,19 +190,6 @@ if (require.main === module) {
     to: has("to") ? opt("to", null) : null,
   });
 
-  // Project a loaded node for JSON output: drop the parser's load-time `file`
-  // artifact, and drop pin/exclude when empty — the regex parser initializes
-  // both to [] on every node, so they are noise unless a briefing/correction
-  // actually populated them (a non-empty list is kept). Deletes from a shallow
-  // copy so the original key order is preserved.
-  const cleanNode = (n) => {
-    const out = { ...n };
-    delete out.file;
-    if (Array.isArray(out.pin) && !out.pin.length) delete out.pin;
-    if (Array.isArray(out.exclude) && !out.exclude.length) delete out.exclude;
-    return out;
-  };
-
   if (has("json")) {
     if (r.edges) process.stdout.write(JSON.stringify(r.edges, null, 2) + "\n");
     else process.stdout.write(JSON.stringify(r.nodes.map(cleanNode), null, 2) + "\n");

package/lib/seed/schema-capture-pending.md

@@ -15,9 +15,9 @@ registry default (QUEUE.md §2). A `type: schema` node in the graph with
 `transitions()` (2026.06.13.1): a capture-pending node is born status-less
 (live, awaiting triage) and may close only as `merged` (its content now lives
 in proper node(s)) or `rejected` (no durable fact). Earlier triage drifted
-across `dismissed`/`resolved`/`closed`; `dismissed` in particular is not
-terminal to the queue kernel (lib/kernel/resolution.js), so those captures
-looked triaged yet kept ranking live
+across `dismissed`/`resolved`/`closed` — none of which is a capture verdict:
+`dismissed` is the gardener's sticky disposition for findings (kernel-terminal,
+lib/kernel/resolution.js), not a triage outcome for a raw capture
 (issue-cc-dismissed-status-not-terminal). The gate forbids the drift at write
 time rather than hardcoding a value set; chosen over a declarative status enum
 because the gate is write-time on the current→proposed transition, so it never
@@ -52,8 +52,9 @@ Backward-readable: write-time only, no node-shape change, no upgrade chain.
 //              duplicate/elaboration and leaves the queue.
 //   rejected — no durable fact worth keeping.
 // Any other status (the historical dismissed/resolved/closed drift) is denied:
-// dismissed was never terminal to the queue kernel (lib/kernel/resolution.js),
-// so it produced captures that looked triaged yet kept ranking live
+// none is a capture verdict — `dismissed` is the gardener's sticky disposition
+// for findings (kernel-terminal in lib/kernel/resolution.js), not a triage
+// outcome for a raw capture
 // (issue-cc-dismissed-status-not-terminal, dec-cc-status-enforcement-via-transitions).
 // Defining the allowed set ONCE is what makes the create path and the update
 // path AGREE (issue-spor-node-create-bypasses-status-vocabulary): the membership
@@ -63,8 +64,8 @@ function statusReason(next) {
   return "invalid capture-pending status '" + next + "': a capture closes only " +
     "as 'merged' (its content now lives in proper node(s) — write those nodes " +
     "first, then set merged) or 'rejected' (no durable fact worth keeping). " +
-    "Do not use dismissed/resolved/closed — they are not terminal to the queue " +
-    "and leave the capture ranking live (dec-cc-status-enforcement-via-transitions).";
+    "Do not use dismissed/resolved/closed — they are not capture verdicts " +
+    "(dec-cc-status-enforcement-via-transitions).";
 }
 
 // validate(node) — the door, runs on EVERY write (create AND update) in the

package/lib/seed/schema-issue.md

@@ -34,7 +34,7 @@ write-time only, no node-shape change, no upgrade chain.
 `transitions()` (2026.06.14.1): two write-time gates. (1) Status is
 constrained to the issue vocabulary (`open`/`active`/`resolved`, or none =
 live) so the queue-terminal value (`resolved`) is not shadowed by synonyms —
-the same class of drift that left captures ranking live under a non-terminal
+the same class of drift that left captures ranking live under a then-non-terminal
 `dismissed` (dec-cc-status-enforcement-via-transitions). (2) `resolved`
 additionally requires a durable outcome ON THE GRAPH: a live inbound `resolves`
 edge from a `decision` or `artifact` node, read off `view.resolvers`

package/lib/seed/schema-task.md

@@ -30,7 +30,7 @@ Backward-readable: write-time only, no stored-shape change, no upgrade chain.
 `transitions()` (2026.06.14.1): two write-time gates. (1) Status is
 constrained to the task vocabulary (`open`/`active`/`done`/`abandoned`, or
 none = live) so the queue-terminal value (`done`) is not shadowed by synonyms
-— the same class of drift that left captures ranking live under a non-terminal
+— the same class of drift that left captures ranking live under a then-non-terminal
 `dismissed` (dec-cc-status-enforcement-via-transitions). (2) Completion
 (`done`) additionally requires a durable outcome ON THE GRAPH: a live inbound
 `resolves` edge from a `decision` or `artifact` node, read off `view.resolvers`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sporhq/spor",
-  "version": "0.16.0",
+  "version": "0.17.0",
   "description": "Spor — a shared memory substrate for teams and agents. Decisions, their reasons, and the traces they leave. Knowledge-graph context compiler: session-start briefings, per-prompt digests, capture at discovery, end-of-session distillation, decision queue.",
   "license": "Apache-2.0",
   "author": "Anthony Allen",

package/scripts/engines/distill.js

@@ -415,7 +415,7 @@ async function distill(input) {
     } else {
       const add = u.git(graph, ["add", "nodes/"]);
       const commit =
-        add !== null ? u.git(graph, ["commit", "-qm", `distill: session ${session} (${slug})`]) : null;
+        add !== null ? u.git(graph, [...u.NO_GPGSIGN, "commit", "-qm", `distill: session ${session} (${slug})`]) : null;
       if (add === null || commit === null) log("graph commit failed");
     }
   }

package/scripts/engines/util.js

@@ -191,6 +191,21 @@ function inferenceRoot(cwd) {
   return top;
 }
 
+// Normalize a raw string to the canonical project slug (the server's SLUG_RE,
+// ^[a-z0-9][a-z0-9-]*$): lowercased, runs of non-alphanumerics collapsed to a
+// single '-', and leading/trailing '-' trimmed. This is the ONE normalization
+// projectSlug() applies to a basename, factored out so a hand-passed slug — an
+// explicit `spor add --project My_Repo` — gets the SAME treatment as an inferred
+// one instead of being stamped verbatim and mis-filing the node
+// (issue-spor-local-add-ask-project-normalization-edge-validation). Empty when
+// the input carries no alphanumerics (the caller decides how to handle that).
+function slugify(raw) {
+  return String(raw == null ? "" : raw)
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, "-")
+    .replace(/^-+|-+$/g, "");
+}
+
 // Project slug (see CLAUDE.md): basename of the git root, normalized to
 // kebab-case. Identity for names that are already kebab-case. A committed
 // `.spor` marker file (`project: <id>`) beats all inference — it survives
@@ -220,11 +235,7 @@ function projectSlug(cwd, fallback = "project") {
     const rootHit = readMarker(root);
     if (rootHit) return rootHit;
   }
-  const slug = path
-    .basename(root || cwd || "")
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, "-")
-    .replace(/^-+|-+$/g, "");
+  const slug = slugify(path.basename(root || cwd || ""));
   return slug || fallback;
 }
 
@@ -379,6 +390,15 @@ function journalLoadMs(graph, session, engine, loadMs, extra = {}) {
   }
 }
 
+// Global git flags that force commit signing OFF, spread in BEFORE the `commit`
+// subcommand at every automated-commit site (graph snapshots, the SessionEnd
+// distiller, `spor init`/`migrate`). A user with a global commit.gpgsign=true
+// but no usable signing key/agent would otherwise have these housekeeping
+// commits fail SILENTLY — the workflow reports success but nothing lands in git
+// history (issue-spor-local-commit-gpgsign-silent-failure). The graph home is
+// machine-local plumbing, so signing it buys nothing and only risks that failure.
+const NO_GPGSIGN = ["-c", "commit.gpgsign=false"];
+
 function git(cwd, args, opts = {}) {
   try {
     return execFileSync("git", ["-C", cwd, ...args], {
@@ -1054,11 +1074,13 @@ module.exports = {
   wordCount,
   stripTrailingNewlines,
   inferenceRoot,
+  slugify,
   projectSlug,
   projectGrouping,
   matchBriefs,
   repoFingerprints,
   git,
+  NO_GPGSIGN,
   graphInsideCodeRepo,
   ensureDir,
   spoolStats,

package/skills/next/SKILL.md

@@ -111,8 +111,8 @@ one plain sentence of "why this is first" is enough. Then:
    with `set_status`: `merged` when its content now lives in the node(s) you
    wrote, or `rejected` when there was no durable fact. Those are the only two
    terminal statuses the schema's `transitions()` gate accepts — `dismissed`/
-   `resolved`/`closed` are rejected at write time because they are not terminal
-   to the queue and leave the capture ranking live
+   `resolved`/`closed` are rejected at write time because they are not capture
+   verdicts (`dismissed` is the gardener's sticky disposition for findings)
    (dec-cc-status-enforcement-via-transitions).
 4. **Item with nothing actionable until a date** (waiting on a measurement
    window, a renewal, an external milestone) → set `wake: YYYY-MM-DD` on the

package/skills/triage/SKILL.md

@@ -75,8 +75,8 @@ applied (body_full): would push body over the 8192B limit"* — those are repeat
 re-captures that bounced because the target node is already at its size cap, so
 the fact is *already on the graph*. Read one, confirm the target node holds it,
 and `merged` the whole cluster. (`dismissed`/`resolved`/`closed` are rejected at
-write time — they leave the capture ranking live; only `merged`/`rejected` are
-terminal here.)
+write time — they are not capture verdicts; only `merged`/`rejected` are valid
+here.)
 
 ## 3. Duplicates → consolidate with a `supersedes` edge