@gobing-ai/spur 0.3.64 → 0.3.65

package/config/rules/boundary/sp-runtime-path.yaml

@@ -1,41 +1,51 @@
 $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
-# Runtime-path boundary rule (task 0217, R6) — zero `config/(plugins|rules|tasks|templates|workflows)`
-# references in agent-facing instructions and runtime source code. `config/` is the build-time
-# bundled-asset source-of-truth (ADR-015); `.spur/` is the runtime configuration directory that
-# agents and runtime code MUST reference. A `config/...` literal in scope teaches the wrong
-# convention and propagates confusion into every project created via `/sp:spur-init`.
+# Runtime-path boundary rule (task 0217, R6) — zero
+# `config/(plugins|rules|tasks|templates|workflows)` references in agent-facing
+# instructions and runtime source code. `config/` is the build-time bundled-asset
+# source-of-truth (ADR-015); `.spur/` is the runtime configuration directory that
+# agents and runtime code MUST reference. A `config/...` literal in scope teaches
+# the wrong convention and propagates confusion into every project created via
+# `/sp:spur-init`.
 #
-# Blanket scope (all file types across apps/packages/plugins/sp) chosen deliberately:
-# even build-time JSDoc and test-fixture `config/` literals are caught, forcing rephrase rather
-# than false-positive triage. See task 0217 Design "Standing enforcement (R6)" for rationale.
+# Blanket scope (all file types across apps/packages/plugins/sp) chosen
+# deliberately: even build-time JSDoc and test-fixture `config/` literals are
+# caught, forcing rephrase rather than false-positive triage. See task 0217
+# Design "Standing enforcement (R6)" for rationale.
 #
-# This is a STANDING gate (not transitional like rg-migration.yaml) — it runs on every pre-check.
+# This is a STANDING gate (not transitional like rg-migration.yaml) — it runs on
+# every pre-check.
 include:
-  - "apps/**"
-  - "packages/**"
-  - "plugins/sp/**"
+    - "apps/**"
+    - "packages/**"
+    - "plugins/sp/**"
 exclude:
-  - "**/node_modules/**"
-  - "**/dist/**"
-  # `.pi-lens/cache/` holds autogenerated project snapshots (absolute paths that
-  # legitimately contain `config/...` substrings). Not source — exclude to avoid
-  # triaging snapshot noise every pre-check.
-  - "**/.pi-lens/**"
-  # Package build artifacts: `build:bundle` copies repo-root config/ → apps/cli/config/
-  # (and legacy spur-cli/config/). Those trees are the ADR-015 SSOT payload itself and
-  # legitimately contain `config/...` documentation / self-references — not runtime paths.
-  - "apps/cli/config/**"
-  - "apps/cli/spur-cli/**"
+    - "**/node_modules/**"
+    - "**/dist/**"
+    # `.pi-lens/cache/` holds autogenerated project snapshots (absolute paths that
+    # legitimately contain `config/...` substrings). Not source — exclude to avoid
+    # triaging snapshot noise every pre-check.
+    - "**/.pi-lens/**"
+    # `.spur/` runtime dirs hold run records, agent sessions, and captured test
+    # output (e.g. e2e failed-agent dumps embedding real source diffs). Not
+    # source — same class as the .pi-lens exclusion above.
+    - "**/.spur/**"
+    # Package build artifacts: `build:bundle` copies repo-root config/ →
+    # apps/cli/config/ (and legacy spur-cli/config/). Those trees are the ADR-015
+    # SSOT payload itself and legitimately contain `config/...` documentation /
+    # self-references — not runtime paths.
+    - "apps/cli/config/**"
+    - "apps/cli/spur-cli/**"
 rules:
-  - id: sp-runtime-path
-    description: >
-      Use `.spur/` paths for runtime configuration references, not `config/`. `config/` is the
-      build-time bundled-asset source-of-truth (ADR-015); `.spur/` is the runtime directory.
-      Agent-facing instructions (`plugins/sp/`) and runtime code (`apps/`, `packages/`) MUST NOT
-      contain literal `config/plugins`, `config/rules`, `config/tasks`, `config/templates`, or
-      `config/workflows` path references.
-    severity: error
-    evaluator:
-      type: rg
-      config:
-        pattern: "config/(plugins|rules|tasks|templates|workflows)"
+    - id: sp-runtime-path
+      description: >
+          Use `.spur/` paths for runtime configuration references, not `config/`.
+          `config/` is the build-time bundled-asset source-of-truth (ADR-015);
+          `.spur/` is the runtime directory. Agent-facing instructions
+          (`plugins/sp/`) and runtime code (`apps/`, `packages/`) MUST NOT contain
+          literal `config/plugins`, `config/rules`, `config/tasks`,
+          `config/templates`, or `config/workflows` path references.
+      severity: error
+      evaluator:
+          type: rg
+          config:
+              pattern: "config/(plugins|rules|tasks|templates|workflows)"

package/config/rules/surface/check-cli-surface.yaml

@@ -1,7 +1,7 @@
 $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 # CLI surface consistency — structural checks that every command file follows
 # the registerXxxCommand convention and that --json claims are backed by real
-# output serialization (toJson or JSON.stringify).
+# output serialization (toEnvelopeJson, toJson, or JSON.stringify).
 #
 # Part of the recommended-pre-check preset. Run:
 #   spur rule run --preset recommended-pre-check
@@ -11,7 +11,8 @@ include:
 
 exclude:
   - "apps/cli/src/commands/stubs.ts"
-  - "apps/cli/src/commands/shared-options.ts" # option registry, not a command module (consistency.test.ts excludes it too)
+  - "apps/cli/src/commands/shared-options.ts" # option registry, not a command
+  # module (consistency.test.ts excludes it too)
 
 rules:
   - id: cli-register-pattern
@@ -27,11 +28,12 @@ rules:
 
   - id: cli-json-output
     description: >
-      Command files that register --json options must call toJson() or
-      JSON.stringify() to produce machine-readable output.
+      Command files that register --json options must call toEnvelopeJson()
+      (ADR-091 envelope seam), toJson(), or JSON.stringify() to produce
+      machine-readable output.
     severity: error
     evaluator:
       type: rg
       config:
-        pattern: "toJson\\b|JSON\\.stringify\\b"
+        pattern: "toEnvelopeJson\\b|toJson\\b|JSON\\.stringify\\b"
         mode: require

package/config/workflows/history-anatomy.yaml

@@ -14,7 +14,8 @@
 #   start -> resolve-scope -> resolve-paths -> analyze -> cache-probe
 #            (hit  -> refresh-provenance -> publish -> published)
 #            (miss -> render -> enrich -> structure-gate -> validate -> stamp -> publish)
-#            (validate FAIL -> correct (max 1) -> structure-gate ...; exhausted -> failed)
+#            (structure-gate FAIL -> correct (max 2 total) -> structure-gate; exhausted -> failed)
+#            (validate FAIL -> correct (max 2 total) -> structure-gate ...; exhausted -> failed)
 #            (any all-paths failure -> failed)
 #
 # `analyze` precedes `cache-probe` deliberately: ADR-079 makes cache validity a DERIVED fact, so
@@ -229,14 +230,37 @@ states:
 
   - id: correct
     description: >
-      One bounded correction pass. onEnter increments the counter; the retry edge guards on
-      correctionCount < 1, the second failure takes the -> failed edge.
+      A two-pass correction budget (0690). onEnter increments the counter; retry edges guard on
+      the run-scoped correction-count file < 2 (`vars.correctionCount` is the declared home; the
+      file is the live bound), and a failure after the second repair takes the -> failed edge. The
+      counter is shared by the structure-gate and validate FAIL edges, so a structure repair can
+      still be followed by one validation-driven repair. The
+      model half re-authors the candidate in place from the gate findings and validation notes —
+      re-anchoring evidence rows to a backticked .md/.ts/.json path or path:line, stripping
+      placeholders, restoring the canonical twelve-section order, and reconciling quantitative
+      claims against the current/baseline artifacts — before the deterministic gate re-runs.
     onEnter:
       - kind: shell
         options:
           command: >-
             n=$(cat .spur/run/$__runId-correction-count 2>/dev/null || echo 0) &&
             printf '%s\n' "$((n + 1))" > .spur/run/$__runId-correction-count
+      - kind: shell
+        options:
+          command: >-
+            git status --porcelain > .spur/run/$__runId-baseline-correct.txt || true
+      - kind: agent.run
+        options:
+          agent: ${vars.agent}
+          input: "Repair .spur/run/${vars.__runId}-candidate.md in place. Read its structure-gate findings, optional validation notes, references/report-contract.md, and the references/operations.md validate rubric; fix every violation. Use a backticked `.md`/`.ts`/`.json` path or a `path:line` anchor, never `current #/...`; remove placeholders and empty rows; restore the twelve-section order; ensure every problem and positive finding carries the full field set; verify every quantitative claim (counts, durations, percentages, distributions) and every current/baseline full-digest match against .spur/run/${vars.__runId}-history-anatomy-current.json and -baseline.json. Overwrite only the candidate; never launch a workflow."
+          # Declared Layer-1 role (0538 R2): repair reuses enrich-class judgment.
+          role: reviewer
+          expectFile: .spur/run/${vars.__runId}-candidate.md
+          timeoutMs: ${vars.stepTimeoutMs}
+      - kind: shell
+        options:
+          command: >-
+            node "$(superskill script path sp history-anatomy-cache.mjs)" assert-clean --baseline .spur/run/$__runId-baseline-correct.txt --expect .spur/run/$__runId-candidate.md
 
   - id: refresh-provenance
     description: >
@@ -352,7 +376,14 @@ transitions:
         command: 'grep -q "^PASS$" .spur/run/$__runId-structure-gate.txt 2>/dev/null'
   - from: structure-gate
     to: failed
-    description: Structure gate FAIL — never publish a malformed candidate.
+    description: Structure gate FAIL with the correction cap exhausted — never publish a malformed candidate.
+    guard:
+      kind: shell
+      options:
+        command: '! grep -q "^PASS$" .spur/run/$__runId-structure-gate.txt 2>/dev/null && test "$(cat .spur/run/$__runId-correction-count 2>/dev/null || echo 0)" -ge 2'
+  - from: structure-gate
+    to: correct
+    description: Structure gate FAIL under the shared two-pass correction cap (0690).
     guard:
       kind: always
 
@@ -365,11 +396,11 @@ transitions:
         command: 'grep -q "Verdict: PASS" .spur/run/$__runId-validation.txt 2>/dev/null'
   - from: validate
     to: correct
-    description: Validation FAIL under the correction cap — one bounded pass.
+    description: Validation FAIL under the shared two-pass correction cap.
     guard:
       kind: shell
       options:
-        command: '! grep -q "Verdict: PASS" .spur/run/$__runId-validation.txt 2>/dev/null && test "$(cat .spur/run/$__runId-correction-count 2>/dev/null || echo 0)" -lt 1'
+        command: '! grep -q "Verdict: PASS" .spur/run/$__runId-validation.txt 2>/dev/null && test "$(cat .spur/run/$__runId-correction-count 2>/dev/null || echo 0)" -lt 2'
   - from: validate
     to: failed
     description: Validation FAIL with the correction cap exhausted — terminate without publishing.

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.3.64",
+    "version": "0.3.65",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",
@@ -53,14 +53,14 @@
     },
     "devDependencies": {
         "@commander-js/extra-typings": "^14.0.0",
-        "@gobing-ai/ts-db": "^0.4.45",
-        "@gobing-ai/ts-ai-runner": "^0.4.45",
-        "@gobing-ai/ts-dual-workflow-engine": "^0.4.45",
-        "@gobing-ai/ts-infra": "^0.4.45",
-        "@gobing-ai/ts-llm-jsonl-importer": "^0.4.45",
-        "@gobing-ai/ts-rule-engine": "^0.4.45",
-        "@gobing-ai/ts-runtime": "^0.4.45",
-        "@gobing-ai/ts-utils": "^0.4.45",
+        "@gobing-ai/ts-db": "^0.4.46",
+        "@gobing-ai/ts-ai-runner": "^0.4.46",
+        "@gobing-ai/ts-dual-workflow-engine": "^0.4.46",
+        "@gobing-ai/ts-infra": "^0.4.46",
+        "@gobing-ai/ts-llm-jsonl-importer": "^0.4.46",
+        "@gobing-ai/ts-rule-engine": "^0.4.46",
+        "@gobing-ai/ts-runtime": "^0.4.46",
+        "@gobing-ai/ts-utils": "^0.4.46",
         "@types/bun": "1.3.14",
         "@types/figlet": "^1.7.0",
         "@types/node-notifier": "8.0.5",

package/plugins/sp/README.md

@@ -129,6 +129,7 @@ list this README is checked against.
 | `dev-daily`         | Generate a daily summary report from agent usage data, git history, and notes                                                                                                                     |
 | `dev-dogfood`       | Dogfood an agent skill/command/CLI — drive it end-to-end with bounded auto-fix, self-monitor, and emit a comprehensive report                                                                     |
 | `dev-find-issue`    | Generate the daily/ad-hoc history-anatomy diagnostic report over already-imported history — mode contract, closed finding taxonomy, twelve-section report contract, cache branch, atomic publication; forwards to sp:history-anatomy                               |
+| `dev-review-session` | Review the active coding-agent session inline — compact outcome, resolved/open issues with evidence, proposal-only improvements, and next actions; forwards to sp:session-review                                                                                  |
 | `dev-find-conflict` | Authority-aware semantic audit across source, task, feature, and project authority files — detect conflicts, resolve claim-specific authority, and route confirmed repairs through owner surfaces |
 | `dev-find-next`     | Prompt-first feature frontier prioritizer — ranks the open feature frontier by derived importance/urgency with per-candidate evidence; gates unactionable features; emits tree defects as proposals only     |
 | `dev-fixall`        | Fix all lint, type, and test errors systematically across the working tree                                                                                                                        |
@@ -173,7 +174,8 @@ and verification (`sp:code-verification`) — plus a CLI facade (`sp:spur-cli`,
 `spur` noun) and standalone technique skills (`sp:next-router`, `sp:test-driven-development`, `sp:brainstorm`,
 `sp:wayfinder`, `sp:sys-debugging`, `sp:code-review`, `sp:code-simplification`, `sp:code-improvement`,
 `sp:parallel-execution`, `sp:branch-workflow`, `sp:doc-evolve`, `sp:dogfood-testing`,
-`sp:daily-summary`, `sp:reverse-engineering`, `sp:issue-finding`, `sp:conflict-finding`, `sp:indexed-context`, `sp:redesign-web-ui`). See
+`sp:daily-summary`, `sp:reverse-engineering`, `sp:issue-finding`, `sp:conflict-finding`,
+`sp:indexed-context`, `sp:session-review`, `sp:redesign-web-ui`). See
 [skills/spur-dev/SKILL.md](skills/spur-dev/SKILL.md)'s Step routing table for which skill owns which
 pipeline step.
 
@@ -181,7 +183,7 @@ pipeline step.
 
 ```
 plugins/sp/
-├── skills/                          # Domain knowledge + workflow docs (31 skills)
+├── skills/                          # Domain knowledge + workflow docs (32 skills)
 │   ├── brainstorm/                  # Structured ideation workflow
 │   │   ├── agents/openai.yaml
 │   │   ├── examples/ideation-example.md
@@ -243,12 +245,13 @@ plugins/sp/
 │   │   └── references/{audit-checklist, upgrade-techniques}.md
 │   ├── history-anatomy/             # Diagnostic interpretation owner over already-imported history (backs /sp:dev-find-issue)
 │   │   └── references/{modes.md, report-contract.md, operations.md}
+│   ├── session-review/              # Inline, report-only review of the active coding-agent session
 │   ├── sys-architecture/            # Architecture / ADR judgment competency
 │   │   └── references/decision-method.md
 │   ├── sys-debugging/               # Structured debugging protocol
 │   │   └── references/debugging-protocol.md
 │   └── wayfinder/                   # Multi-session investigation maps (SKILL.md only)
-├── commands/                        # 37 slash-command wrappers — the SSOT (hand-editable thin wrappers; see Commands below)
+├── commands/                        # 39 slash-command wrappers — the SSOT (hand-editable thin wrappers; see Commands below)
 ├── agents/                          # 4 specialist subagents (expert-spur, super-coder, super-planner, super-reviewer)
 ├── hooks/                           # hooks.json + task-write-guard.{ts,test.ts} + context-{session-start,post-tool,session-stop}.ts
 │                                    # + careful-guard.{ts,test.ts} + context-hooks.test.ts + token-estimate.test.ts
@@ -286,8 +289,8 @@ Tier 3 — Execution Layer (spur CLI + Guard Scripts)
 The single source of truth for domain knowledge and workflow documentation. Each skill is a
 self-contained knowledge module that teaches the agent how to operate one slice of the Spur CLI
 surface or run one workflow. All skills target the same five core platforms: `claude-code`, `codex`,
-`antigravity`, `opencode`, `openclaw`; `conflict-finding`, `issue-finding`, `next-feature`, and
-`reverse-engineering` additionally declare `pi`.
+`antigravity`, `opencode`, `openclaw`; selected read-only and review skills additionally declare
+`pi`.
 
 | Skill                       | Ver   | Domain                                                                                                                                                                                                                                     |
 | --------------------------- | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
@@ -321,6 +324,7 @@ surface or run one workflow. All skills target the same five core platforms: `cl
 | `pr-reviewing`              | 1.0   | GitHub Codex PR review — PR prepare/reuse, `@codex review` request with per-HEAD dedupe, bounded polling, findings normalization, validated fix + re-review; spine SSOT `pr-review.yaml` + `scripts/pr-reviewing.ts`; backs `/sp:dev-pr-review`     |
 | `indexed-context`           | 1.0   | Cross-agent project context — anatomy/learnings/pitfalls/buglog/memory in `.spur/context/`; hook-tracked token-ledger; graceful degradation on agents without hooks                                                                        |
 | `history-anatomy`           | 1.0   | Diagnostic interpretation owner over already-imported history — daily/ad-hoc mode contract, closed finding taxonomy, twelve-section report contract, `enrich`/`validate` rubrics; no workflow launch, no JSONL fallback, no corpus mutation                                                                   |
+| `session-review`            | 1.0   | Inline review of the active coding-agent session — compact outcomes, evidence-backed resolved/open issue classification, proposal-only improvements, and next actions; no workflow, import, delegation, or mutation                                                                                           |
 | `redesign-web-ui`           | 1.0   | Existing-UI visual upgrade — audit generic AI fingerprints, apply in-stack polish against `DESIGN.md` / live tokens, verify behavior and viewports; does not migrate frameworks                                                                                                                            |
 
 #### Bounded coexistence and retirement gate — `sp:issue-finding` (HA-S1 0661)
@@ -354,11 +358,11 @@ Skills contain zero validation logic — the CLI is the gate.
 
 Thin slash-command wrappers that parse user arguments and delegate to the corresponding skill. Each
 command is a user-facing entry point that bridges natural language to skill invocation. There are
-**38 commands** (see the Command index above for the full list), organized by the surface they wrap:
+**39 commands** (see the Command index above for the full list), organized by the surface they wrap:
 
 | Prefix       | Count | Delegates to                                                                                                                                                                                                                                                                                                        | Purpose                                                                                |
 | ------------ | ----- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------- |
-| `dev-*`      | 32    | `sp:spur-dev`, `sp:code-implementation`, `sp:code-testing`, `sp:code-verification`, `sp:code-simplification`, `sp:next-router`, `sp:brainstorm`, `sp:dogfood-testing`, `sp:parallel-execution`, `sp:sys-debugging`, `sp:daily-summary`, `sp:history-anatomy`, `sp:conflict-finding`, `sp:reverse-engineering`, `sp:pr-reviewing`, inline | The dev-workflow surface — planning, execution, batch, wrap-up, review/verify, hygiene |
+| `dev-*`      | 33    | `sp:spur-dev`, `sp:code-implementation`, `sp:code-testing`, `sp:code-verification`, `sp:code-simplification`, `sp:next-router`, `sp:brainstorm`, `sp:dogfood-testing`, `sp:parallel-execution`, `sp:sys-debugging`, `sp:daily-summary`, `sp:history-anatomy`, `sp:session-review`, `sp:conflict-finding`, `sp:reverse-engineering`, `sp:pr-reviewing`, inline | The dev-workflow surface — planning, execution, batch, wrap-up, review/verify, hygiene |
 | `rule-*`     | 3     | `sp:spur-cli`                                                                                                                                                                                                                                                                                                       | The rule surface — `rule-add`, `rule-refine`, `rule-scan`                              |
 | `workflow-*` | 2     | `sp:spur-cli`                                                                                                                                                                                                                                                                                                       | The workflow surface — `workflow-add`, `workflow-refine`                               |
 | `spur-init`  | 1     | `sp:doc-evolve`                                                                                                                                                                                                                                                                                                     | Project bootstrap (`spur init`) with doc-evolve integration                            |
@@ -368,7 +372,7 @@ Each command file contains:
 - YAML frontmatter (`description`, `argument-hint`, `allowed-tools`).
 - A delegation block: `Skill(skill="sp:<skill-name>", args="<operation> $ARGUMENTS")`.
 
-**Commands as SSOT (ADR-032).** The 38 `.md` files in `commands/` are the authoritative,
+**Commands as SSOT (ADR-032).** The 39 `.md` files in `commands/` are the authoritative,
 hand-editable source for the operator command surface. Per-platform adapters are **install-time
 output** owned by `superskill` (`superskill install sp`) and never committed here. Plugin `sp` ships
 no per-platform artifacts — only the platform-independent thin wrappers.
@@ -497,7 +501,7 @@ the hard gate that the soft skill cannot enforce on its own.
 ```mermaid
 graph TB
     subgraph "User entry points"
-        CMD["Commands<br/>37 slash commands<br/>/sp:dev-plan, /sp:dev-runall, /sp:dev-refineall, /sp:rule-add, ..."]
+        CMD["Commands<br/>39 slash commands<br/>/sp:dev-plan, /sp:dev-runall, /sp:dev-review-session, /sp:rule-add, ..."]
         AGENT["Agents<br/>4 subagents<br/>expert-spur, super-coder, super-planner, super-reviewer"]
         HOOK["PreToolUse hook<br/>Write|Edit matcher"]
     end

package/plugins/sp/commands/dev-find-issue.md

@@ -1,5 +1,5 @@
 ---
-description: "Generate the daily or ad-hoc history-anatomy diagnostic report over already-imported history: the twelve-section report contract, closed finding taxonomy, cache branch, bounded correction, and atomic publication. Triggers: find issues, post-mortem, performance analysis, session review, history-anatomy, run the daily report, ad-hoc diagnosis"
+description: "Generate the daily or ad-hoc history-anatomy diagnostic report over already-imported history: the twelve-section report contract, closed finding taxonomy, cache branch, bounded correction, and atomic publication. Triggers: find historical issues, post-mortem, performance analysis, history-anatomy, run the daily report, ad-hoc diagnosis"
 role: reviewer
 argument-hint: "[<focus>] [--mode <daily|ad-hoc>] [--date <YYYY-MM-DD>] [--since <RFC3339>] [--until <RFC3339>] [--recompute] [--agent <auto|name>] [--output <path>]"
 allowed-tools: ["Bash", "Read", "Skill"]
@@ -15,6 +15,9 @@ exposes the `enrich` and `validate` operations the `history-anatomy.yaml` workfl
 Publication is atomic and gated behind both the deterministic structure gate and independent
 evidence validation. This command never triggers an import.
 
+For an immediate review of the active conversation, route to `/sp:dev-review-session`; this command
+owns imported-history windows, recurrence, trends, and quantitative forensics only.
+
 ## Argument Flags
 
 | Flag                                   | Description                                                                                        | Default  |

package/plugins/sp/commands/dev-review-session.md

@@ -0,0 +1,36 @@
+---
+description: "Review the active coding-agent session immediately: summarize outcomes, distinguish resolved and open issues with evidence, and propose bounded improvements. Triggers: review this session, session wrap-up, immediate retrospective, what happened, what was resolved"
+role: reviewer
+argument-hint: "[<focus>]"
+allowed-tools: ["Bash", "Read", "Grep", "Glob", "Skill"]
+---
+
+# Dev Review Session
+
+Wraps the **sp:session-review** skill for a lightweight, report-only review of the active host
+session. It uses the current conversation plus read-only repository evidence, runs inline so the
+session context is preserved, and never launches a workflow, imports history, creates a task, or
+applies a remediation.
+
+## Argument Flags
+
+| Flag | Description | Default |
+| --- | --- | --- |
+| `[<focus>]` | Optional question or operation to emphasize without excluding material session outcomes. | full active session |
+
+For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag-glossary.md).
+
+## Usage
+
+```
+/sp:dev-review-session
+/sp:dev-review-session "why the verification loop repeated"
+```
+
+## Implementation
+
+Invoke the skill directly in the active host session; do not delegate to a subagent or subprocess.
+
+```
+Skill(skill="sp:session-review", args="$ARGUMENTS")
+```

package/plugins/sp/plugin.json

@@ -1,6 +1,6 @@
 {
     "name": "sp",
-    "version": "0.3.64",
+    "version": "0.3.65",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics.",
     "extensions": {
         "pi": ["./hooks/pi/guard-extension.ts"]

package/plugins/sp/references/environment-lens.md

@@ -9,7 +9,8 @@ shipped or invoked by anything in this plugin.)
 Neither report projection restates the table below; each links here as its category table
 (task 0686 / feature I9; accepted design `docs/design/environment-improvement-lens.md`,
 ADR-084/085). There is deliberately no `/sp:dev-retro` command, no CLI change, and no protocol
-bump behind this mapping.
+bump behind this mapping. `sp:session-review` consumes only the placement rule for supported
+live-session proposals; it adds no category projection or imported-history analysis owner (ADR-089).
 
 ## Canonical categories and projections
 
@@ -58,7 +59,8 @@ create` handoff, manual edit), which remain explicit human gates.
 ## Keep / drop boundary
 
 Kept here because both live reports consume it: the seven names above, their projections, and
-this placement rule. Dropped (each needs its own operator decision): installing or invoking the
+this placement rule. The active-session reviewer may apply the placement rule without copying the
+table. Dropped (each needs its own operator decision): installing or invoking the
 out-of-tree retro practice, a standalone retro command, `CODING_STANDARDS.md` as a file, runtime
 parsing of this markdown by validators, automatic remediation of environment findings, and
 folding the lens into wrap-up learnings or `.spur/context/` memory.

package/plugins/sp/references/roles.md

@@ -58,7 +58,7 @@ roles:
     stages: [implement, test, wrap]
   - id: reviewer
     tier: capable-1
-    commands: [dev-verify, dev-verifyall, dev-review, dev-pr-review, dev-dogfood, rule-scan, dev-find-conflict, dev-find-issue]
+    commands: [dev-verify, dev-verifyall, dev-review, dev-review-session, dev-pr-review, dev-dogfood, rule-scan, dev-find-conflict, dev-find-issue]
     stages: [verify, review, dogfood]
   - id: planner
     tier: capable-2
@@ -81,9 +81,11 @@ must not sit below the highest `min_tier` among its folded stages.
   simplification, fix-everything sweeps, reverse engineering, wrap-up, and the end-to-end
   delivery flow (`dev-gtd`). Folds `implement`, `test`, `wrap`.
 - **`reviewer` (capable-1).** Verification and analysis: per-task verify/review, batch verify,
-  dogfooding, anti-pattern scanning (`rule-scan`), and the two audit commands (`dev-find-conflict`,
-  `dev-find-issue`) — those analyse rather than transcribe, which is why they sit here and not
-  under `scribe`. `dev-find-issue` now routes through the `sp:history-anatomy` skill (mode contract + report contract). Folds `verify`, `review`, `dogfood`.
+  dogfooding, anti-pattern scanning (`rule-scan`), immediate session review, and the two audit
+  commands (`dev-find-conflict`, `dev-find-issue`) — those analyse rather than transcribe, which is
+  why they sit here and not under `scribe`. `dev-find-issue` routes through `sp:history-anatomy`;
+  `dev-review-session` routes through `sp:session-review` in the active host context. Folds
+  `verify`, `review`, `dogfood`.
 - **`planner` (capable-2).** The planning half: feature planning, requirement refinement (single
   and batch), brainstorm, idea intake, batch run/parallel orchestration, next-step routing,
   architecture survey, feature-frontier prioritization, and feature-tree restructure. Folds `plan`,
@@ -96,7 +98,8 @@ same stage logic: `dev-refineall` folds `refine` → planner; `dev-find-next` is
 frontier work → planner; `dev-feature-change` is planning-half corpus surgery on the feature tree →
 planner; `dev-gtd` is the execution/delivery flow → coder; `dev-find-conflict` and `dev-find-issue`
 are audits/analysis → reviewer (same reasoning as `rule-scan`). Later additions: `dev-pr-review` is review orchestration —
-driving the external PR review and triaging its findings folds the `review` stage → reviewer.
+driving the external PR review and triaging its findings folds the `review` stage → reviewer;
+`dev-review-session` performs evidence-backed review over the active conversation → reviewer.
 
 **Consistency is a test, not a convention.** `plugins/sp/tests/roles.test.ts` parses this YAML and
 asserts the tier-distinctness, command closure, stage-floor, and boundary invariants against the

package/plugins/sp/skills/dogfood-testing/SKILL.md

@@ -619,3 +619,11 @@ socket binding. Signals: `EPERM: operation not permitted`, `FS_PERMISSION_DENIED
 `sandbox.network.allowLocalBinding`. Caveat: `spur agent doctor` reports `usable: true` from
 configuration alone — it never probes a real dispatch, so `usable` means *configured*, not
 *proven runnable under this sandbox*.
+
+Related operator-local trap (spur task 0689): adding a `permissions.allow` `write_file(**)` entry
+to an executor's own settings (e.g. `~/.gemini/antigravity-cli/settings.json`) is an **operator-
+local unblock, not the shipped fix**. It is per-machine and untracked, and it **masks shim
+regressions in local end-to-end runs**: a broken headless dispatch looks green on the patched
+machine while failing on every other machine and in CI. The fix belongs in the executor shim
+(print-mode permission affordance); keep the allow entry, if at all, as a documented convenience
+and never as the reason a run passes.

package/plugins/sp/skills/session-review/SKILL.md

@@ -0,0 +1,106 @@
+---
+name: session-review
+description: "Review the active coding-agent session, distinguish resolved and open issues with evidence, and propose bounded improvements. Triggers: review this session, session wrap-up, immediate retrospective, what happened, what was resolved."
+license: Apache-2.0
+version: 1.0.0
+metadata:
+  author: spur
+  platforms: "claude-code,codex,openclaw,opencode,antigravity,pi"
+  category: analysis-core
+  interactions:
+    - reviewer
+see_also:
+  - sp:history-anatomy
+  - sp:indexed-context
+  - sp:code-verification
+---
+
+# sp:session-review — Active Session Review
+
+Review the active coding-agent session while its conversation context is still available. Produce a
+compact, evidence-backed report of outcomes, resolved issues, remaining risks, and improvements.
+
+## When to use
+
+Use this skill immediately after focused operations when the operator asks what happened, what was
+resolved, or how the session could improve. Use imported-history analysis for ended sessions,
+cross-agent windows, recurrence, trends, or quantitative performance forensics.
+
+## Arguments
+
+| Argument | Description | Default |
+| --- | --- | --- |
+| `[focus]` | Question or operation to emphasize. It changes ordering, not evidence collection. | full active session |
+
+## Evidence boundary
+
+- Treat the active conversation as the primary evidence plane.
+- Verify each material claim with source evidence from the conversation or a read-only repository
+  check, and cite the exact result or path in the report.
+- Use read-only repository checks only when they confirm a material claim; prefer existing tool
+  results already visible in the session over rerunning commands.
+- Mark an issue **resolved** only when the session shows the symptom, root cause, applied resolution,
+  and verification evidence. Otherwise classify it as open or attempted.
+- Separate observation from inference. Label an unsupported causal explanation as a hypothesis and
+  name the confirmation needed.
+- State `not available` when compaction or missing output removed evidence. Never reconstruct it from
+  memory or claim a verification that did not run.
+
+## Protocol
+
+1. **Resolve scope.** Review the active session from the operator's initiating request through the
+   latest result. Use `[focus]` only to rank relevant material.
+2. **Inventory outcomes.** List requested outcomes and classify each as completed, partial, blocked,
+   or not attempted. Collapse repeated attempts into one outcome.
+3. **Classify issues.** For every material issue, distinguish resolved, open, or attempted. Record
+   root cause only when the evidence boundary supports it.
+4. **Select improvements.** Keep at most three changes that would prevent meaningful recurrence.
+   Apply the placement rule in
+   [the environment-improvement mapping](../../references/environment-lens.md): automate with a
+   check when possible, place coding standards on the review path, and keep always-loaded steering
+   as navigation pointers.
+5. **Render the report.** Use the exact compact output contract below. Omit empty table rows, not
+   headings; write `None observed` when a section has no supported entry.
+
+## Output contract
+
+### Outcome
+
+State the overall result in one to three sentences, including partial or blocked scope.
+
+### Resolved issues
+
+| Issue | Root cause | Resolution | Evidence |
+| --- | --- | --- | --- |
+
+Evidence names the tool result, verification command, or concrete repository state visible in the
+session. Do not list ordinary implementation steps as issues.
+
+### Open issues and risks
+
+| Issue or risk | State | Evidence or confirmation needed |
+| --- | --- | --- |
+
+### Process and environment improvements
+
+For each supported proposal, name its owner surface, expected impact, verification method, and
+reversibility. Proposals remain report-only: apply no change and create no task.
+
+### Next actions
+
+List only actions needed to finish partial scope, confirm a hypothesis, or preserve a demonstrated
+improvement. Use `None` when the session is complete and no follow-up is justified.
+
+## Boundaries
+
+- Stay in the active host session. Do not delegate; a fresh context loses the evidence being reviewed.
+- Do not launch a workflow, import history, create or update corpus items, or edit files.
+- Do not append indexed-context memory.
+- Do not perform baseline comparison, recurrence classification, cache publication, or a twelve-section
+  forensic report; those belong to imported-history analysis.
+- Do not turn a single low-impact observation into a new policy. Report it as a candidate until it
+  recurs or demonstrates a high-impact contract violation.
+
+## Platform notes
+
+On platforms without slash commands, invoke this skill directly before ending the active session.

package/plugins/sp/skills/spur-cli/references/workflows.md

@@ -255,7 +255,7 @@ the operator accepts it, and never hot-edit a running workflow's shell in place.
 
 ```
 spur workflow validate <file> [--no-schema] [--json]
-spur workflow show      <file>
+spur workflow show      <file> [--format <mermaid|todo>] [--json]
 spur workflow run      <file> [--run-id <id>] [--vars <json>] [--dry-run] [--async] [--no-plan] [--quiet/--silent/--verbose] [--detail <level>] [--trace-file] [--no-log] [--steer] [--json]
 spur workflow continue [run-id] [--yes] [--answer <yes|no|cancel>] [--json]
 spur workflow cancel   <run-id> [--json]

package/plugins/sp/skills/spur-dev/references/dev-operations.md

@@ -32,14 +32,17 @@ each would be scope creep for one-liner procedures.
 > backbone skill (which owns the 4-phase dogfood protocol, the live ledger, and the report template);
 > it does not map to a numbered dev-\* operation. See its command file and the backing skill for details.
 
-> **`dev-find-issue`** is not in this table. It is a thin `Skill()` wrapper over **`sp:issue-finding`**
->(session-log forensics report → optional CLI-gated fix task via `--create-task`). Hygiene /
->post-batch analysis — not a spine pipeline stage. Report-first (task 0556): the default run
->renders the `spur history report --mode forensics` data plane plus model-authored analysis and
->creates nothing; task creation is opt-in behind `--create-task` (`--use-history`/`--no-task` are
->removed). See `plugins/sp/commands/dev-find-issue.md` and
->`plugins/sp/skills/issue-finding/SKILL.md`. After a slow `/sp:dev-runall`, prefer
->`/sp:dev-find-issue [<topic>]` before re-running the batch.
+> **`dev-find-issue`** is not in this table. It is a thin `Skill()` wrapper over
+> **`sp:history-anatomy`** for daily/ad-hoc imported-history forensics: fixed twelve-section report,
+> baseline comparison, cache branch, independent validation, and atomic publication. It never
+> imports history or creates a task. See `plugins/sp/commands/dev-find-issue.md` and
+> `plugins/sp/skills/history-anatomy/SKILL.md`.
+
+> **`dev-review-session`** is not in this table. It is a thin `Skill()` wrapper over
+> **`sp:session-review`** for an immediate, inline, report-only review of the active conversation.
+> It launches no workflow or agent and performs no import, persistence, or mutation. Use it before
+> the active session ends; use history-anatomy for ended sessions, cross-agent windows, trends, or
+> quantitative forensics.
 
 > **`dev-find-conflict`** is not in this table. It is a thin `Skill()` wrapper over
 > **`sp:conflict-finding`** (authority-aware four-pillar semantic audit → optional confirmed,