@gobing-ai/spur 0.4.0 → 0.4.1

package/plugins/sp/skills/code-verification/references/verdict-schema.md

@@ -35,9 +35,43 @@ interface VerifyVerdict {
     status: 'pass' | 'fail' | 'warn';
     evidence: string;
   }>;
+  /** Verifier confidence (task 1068 R3). REQUIRED for PASS — the done gate denies
+   *  a confidence-less PASS. Accepted case-insensitively, normalized to uppercase. */
+  confidence?: 'HIGH' | 'MEDIUM' | 'LOW';
 }
 ```
 
+## Confidence level (task 1068 R3)
+
+A PASS verdict must state the verifier's confidence: `"confidence": "HIGH" | "MEDIUM" | "LOW"`.
+The value is case-insensitive on read (normalized to uppercase), but a present value outside the
+enum invalidates the artifact, and a PASS with the field absent is denied at the `* → done`
+transition with a remediation naming the field (`--force-done` remains the documented escape).
+The verify answer's `Confidence:` lint rule (producer side) already guarantees the field for
+pipeline-produced artifacts; this closes the hand-authored / pre-1068 artifact hole.
+
+### Coherence: the level must be earned (task 1133)
+
+Presence and vocabulary are not enough — the level has to match the rows in the same answer, so the
+lint rejects a level that contradicts its own evidence. Two rejection classes, both addressed to the
+`Confidence:` line and both capped by the shared `ANSWER_LINT_MAX_FINDINGS` budget:
+
+- `confidence-unwarranted` — `HIGH` while any requirement row normalizes to `PARTIAL`/`UNMET`, any
+  acceptance-criteria row does not normalize to `MET`, or any `MET` row's evidence is hedged.
+  A `HIGH` claim says the evidence needs no re-check; a non-MET or hedged row says the opposite.
+- `confidence-understated` — `LOW` while at least one requirement row exists and every requirement
+  and acceptance-criteria row normalizes to `MET`. The evidence already did the work, so `LOW`
+  misreports the state as unproven.
+
+`MEDIUM` carries no coherence rule in either direction: it is the level a verifier uses for a caveat
+with no row to point at, and closing it would force either an overclaimed `HIGH` or an unusable
+`LOW`. The level is normalized to uppercase before the decision, so `high` is judged as `HIGH`.
+
+Set the level from the rows, not the mood: all rows `MET` with fresh evidence is `HIGH`; a
+`PARTIAL`/`UNMET` row or a hedge means `MEDIUM`, not `HIGH`. An unwarranted level does not merely
+warn — the lint rejects the answer and no verdict artifact is written, so the level is worth
+choosing deliberately before the verdict line is finalized.
+
 ## Compatibility alias: `scenario` row key
 
 Task 0410 hardened the verdict reader. Producers SHOULD use the canonical `id` field for every
@@ -138,6 +172,23 @@ the run actually verified. Since 0804 R9 the checker ignores complete parsed cit
 scanning for subjects, so a citation's filename (including snake_case paths) can never become a
 false subject — a real absent symbol, nonexistent file, or invalid range still reports.
 
+## Basename-only anchors are unresolved anchors (task 1110 R1)
+
+`spur task verdict --from-answer` accepts the citation *shape*, but the `--as done` gate resolves
+every Testing/Solution anchor against the repo root. A basename citation — `decision-events.ts:83`,
+`task.test.ts:42` — reports `L4.anchor-unresolved` at **error** and blocks
+`spur task update <wbs> done`, because the gate cannot tell which file the row meant. Write the
+repo-root-relative form from the first pass:
+
+- Right: `packages/app/src/decision/decision-events.ts:83`, `apps/cli/tests/commands/task.test.ts:42`
+- Wrong: `decision-events.ts:83`, `../services/foo.ts:12`, `@gobing-ai/ts-x/src/persistence.ts:108`
+  (a scoped package is never repo-relative — use the external named-origin form below)
+
+The pipeline's implement stage also runs a scoped `spur task migrate-anchors --wbs <wbs>` pass
+before the proof capture (task 1109), but it qualifies **unique** basenames only: an ambiguous
+basename (two tracked files share it) is reported and left untouched, and line drift and
+`L4.anchor-subject-mismatch` are never repaired by that pass — those remain the author's rows.
+
 ## Source citations for external claims (task 1070)
 
 A Requirement/AC evidence cell that asserts an external API/library claim must carry a verifiable
@@ -152,6 +203,23 @@ citation in the SAME cell, or lint rejects the row with `evidence-citation` (blo
   satisfy it. Marker-free receipts (test counts, reviewed-log notes) need no citation. The check is
   presence-only — which citation proves which claim is not deterministically decidable.
 
+## Hedged evidence is rejected on MET rows
+
+A MET row asserts the requirement is satisfied; evidence that hedges ("the guard likely prevents
+the leak") contradicts the assertion the row is making. The lint rejects such rows with
+`evidence-hedged`, naming the detected phrase, with two remedies: state the deterministic fact
+with a concrete anchor, or downgrade the row to PARTIAL (which is what suspected-but-unproven
+behavior actually is).
+
+- Detected phrases (closed set, word-anchored, case-insensitive): `likely`, `unlikely`,
+  `probably`, `presumably`, `apparently`, `seems/seeming/seemingly to`, `appears to`. Modal verbs
+  (`might`/`may`/`could`/`should`) are deliberately out of set — they are constant in remediation
+  prose and would drown the signal.
+- Only MET rows are scanned. Hedging a gap in an UNMET row ("the stale path likely still loads
+  the old bundle") is honest reporting and stays clean.
+- Citation spans are stripped before scanning, so a filename or test name containing a hedge
+  word (`likely-match.test.ts`) cannot fire.
+
 ## Checks evidence
 
 Wave C verification can emit the following additive `checks[]` rows:

package/plugins/sp/skills/fleet-join/SKILL.md

@@ -11,7 +11,7 @@ description: >-
 A guest is a session that **pulls** work: it is neither supervised nor restarted, it is addressed
 by concrete id only, and it never receives a stage (`requiresCapabilities` stages can never route
 to it — a guest carries no attestation). Joining registers an occupant row plus a heartbeat lease;
-leaving (or an expired lease) releases it and returns any claimed messages to `pending`.
+leaving (or an expired lease) releases it and returns any claimed messages to `queued`.
 
 ## Join
 

package/plugins/sp/skills/session-review/SKILL.md

@@ -2,7 +2,7 @@
 name: session-review
 description: "Review the active coding-agent session: separate resolved from open issues with evidence, propose bounded improvements. With --fix auto (alias --triage), apply pure-doc / 1–2-line fixes inline and file the rest as tasks; with --fix all, fix every actionable finding inline and file none. Triggers: review this session, wrap-up, triage findings."
 license: Apache-2.0
-version: 1.2.0
+version: 1.3.0
 metadata:
   author: spur
   platforms: "claude-code,codex,openclaw,opencode,antigravity,pi"
@@ -24,7 +24,9 @@ compact, evidence-backed report of outcomes, resolved issues, remaining risks, a
 
 Use this skill immediately after focused operations when the operator asks what happened, what was
 resolved, or how the session could improve. Use imported-history analysis for ended sessions,
-cross-agent windows, recurrence, trends, or quantitative performance forensics.
+cross-agent windows, recurrence, trends, or quantitative performance forensics: on pi, run
+`spur history analyze --source pi --session <file-stem>` where `<file-stem>` is the transcript
+basename without `.jsonl` (e.g. `2026-10-07T22-44-33-625Z_01a1188a-…`), not the bare uuid.
 
 ## Arguments
 
@@ -92,7 +94,16 @@ issues with its evidence. Notes stay report-only.
    operator prompt, read-only from the host transcript. Run it once without `--group` to list the
    segments, then map them to stages (`"1-3,4,5-6"`). It splits each segment into `work` and
    operator `wait` (idle before the next prompt plus AskUserQuestion answer time) and counts tokens
-   once per message id.
+   once per message id. On pi the transcript is `$PI_SESSION_FILE` (pass it as `--transcript` when
+   the run reports no host session id). **A measurement that returns `segments: []` with zero totals
+   while the session had operator prompts is an unreadable or stale adapter, not an empty session:**
+   compare the installed copy against this tree's `plugins/sp/scripts/session-timeline.mjs` and
+   refresh it with `superskill install sp` before reporting numbers; report `n/a` until then.
+   The transcript resolves from `--transcript`, else `CLAUDE_CODE_SESSION_ID`, else `PI_SESSION_FILE`
+   (the pi host sets it and no Claude session id); with none of them the measurement reports
+   `available:false` with a reason and the table renders `n/a` instead of guessing. A
+   skill-injected body (`<skill name="…">`) is counted as activity in `injectedPrompts`, never as a
+   segment — only the operator's own prompts segment the session.
 2. **Inventory outcomes.** List requested outcomes and classify each as completed, partial, blocked,
    or not attempted. Collapse repeated attempts into one outcome.
 3. **Classify issues.** For every material issue, distinguish resolved, open, or attempted. Record
@@ -140,10 +151,30 @@ step 4 excludes. Use `n/a` for any value not supported by the measurement.
 | --- | --- | --- | --- | --- |
 
 Evidence names the tool result, verification command, or concrete repository state visible in the
-session. Do not list ordinary implementation steps as issues. **Confidence** is `HIGH`, `MEDIUM`, or
-`LOW` for that row's claim, with its grounds in the cell (a level without grounds is not
-verification); any API/library statement in a row cites the installed source as `path:line` or a URL,
-and a claim the session could not ground is written `LOW` with the missing evidence named.
+session. Do not list ordinary implementation steps as issues.
+
+**Confidence** is `HIGH`, `MEDIUM`, or `LOW` for that row's claim. The level is **derived from the
+check that produced the claim, never assessed from how the row reads**, and the cell carries that
+verifier (e.g. `HIGH — gate exit 0, /tmp/g0.log re-run this session`). Add the row's **falsifier**
+when the level is not `HIGH`: what would have made it fail, or what moves it up. The same ladder
+grades this report's Open-issues table.
+
+| Level | Verifies when | Not this |
+| --- | --- | --- |
+| `HIGH` | An executed check in this session produced the result and its raw output is reachable (command + exit code, test counts, query row, gate log). Re-runnable now. | The code or change "looks correct"; a claim asserted only in prose. |
+| `MEDIUM` | The claim is inferred from observed facts, rests on prior-session or delegated evidence, or names state that moved after the check (stale by construction). Name which of the three. | Presenting an inference as an observation. |
+| `LOW` | No executable check was run. Name the missing evidence **and** the command that would ground it. | Dropping the row instead of marking it. |
+
+Two guards against level inflation:
+
+- Evidence that cannot be re-run, or that is only the agent's own summary, **caps the row at
+  `MEDIUM`** — a re-run is what promotes it.
+- An all-`HIGH` multi-finding review is a signal the ladder was not applied, not a clean session.
+  Where every row genuinely is `HIGH`, the cells show distinct check results rather than repeated
+  phrasing.
+
+Any API/library statement in a row cites the installed source as `path:line` or a URL, and a claim
+the session could not ground is written `LOW` with the missing evidence named.
 
 ### Open issues and risks
 

package/plugins/sp/skills/source-driven-development/SKILL.md

@@ -101,6 +101,11 @@ line: `Verification: HIGH|MEDIUM|LOW — <first failing check and deviation, or
 - **Honest confidence** — the stated HIGH/MEDIUM/LOW matches the evidence: HIGH requires a check against the pinned source this session; MEDIUM/LOW items are labeled, and LOW is never presented as fact.
 - **HIGH** — all three checks pass. **MEDIUM** — coverage intact but some citations are off-version (latest docs for a pinned dependency) or secondary-source only. **LOW** — an API/library claim lacks any citation, or a LOW-confidence claim was asserted as fact.
 
+Deterministic backstop: the `cited-version-strings` / `cited-api-claims` rules
+(`.spur/rules/docs/sourced-api-claims.yaml`, run in `recommended-pre-check`) flag markdown lines that
+assert version strings or time-anchored API claims with no citation anchor on the same line. They
+are an info-severity advisory backstop for this contract (they do not gate; the checks above and the SECUA checklist are the enforcement points).
+
 ## Common Rationalizations
 
 | Rationalization | Reality |

package/plugins/sp/skills/spec-decomposition/references/decomposition.md

@@ -562,9 +562,11 @@ schema before emitting.
 
 **Pass the deterministic task check.** Each `acceptance_criteria` bullet must be an exact feature
 scenario title (L4.uncovered-task-scenario); add task-local checks as prose after the bullets, not
-as extra bullets. No section body may use `HITL`, `approval`/`approved`, `merged`/`merge event`,
-`content-gate`, `GATED`, or `capstone` as standalone words (L4.gate-language) — say "operator
-answer" / "accepted" instead, and keep enum values out of that list too.
+as extra bullets. No section body may use `HITL`, `merge event`, `content-gate`, `GATED`, or
+`capstone` as standalone words (L4.gate-language); ambiguous words (`approval`, `approved`,
+`merged`) warn only with a gating cue (`until`, `after`, `once`, `before`, `pending`, `blocked`,
+`wait for`, `requires`) in the same sentence, so plain composition prose stays silent — say
+"operator answer" / "accepted" instead, and keep enum values out of that list too.
 
 **The order sidecar.** Also emit the private task-order sidecar at
 `.spur/run/<runId>-idea-task-order.json`: a JSON array (one entry per batch item) of

package/plugins/sp/skills/spur-cli/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: spur-cli
-description: "Reference and operate the complete `spur` CLI surface: task, feature, rule, workflow, builder, agent, message, self, history, and projects. Use for verb or flag lookup, machine-readable output and exit contracts, or CLI-gated corpus writes. Triggers: \"spur task\", \"spur history\", \"spur projects\", \"create a task\", \"task check\", and any Spur CLI convention. Not for planning or execution lifecycle orchestration (`sp:spur-dev`)."
+description: "Reference and operate the complete `spur` CLI surface: task, feature, rule, workflow, builder, agent, message, decision, self, history, and projects. Use for verb or flag lookup, machine-readable output and exit contracts, or CLI-gated corpus writes. Triggers: \"spur task\", \"spur history\", \"spur projects\", \"spur decision\", \"spur agent join\", \"create a task\", \"task check\", and any Spur CLI convention. Not for planning or execution lifecycle orchestration (`sp:spur-dev`)."
 license: Apache-2.0
 metadata:
   author: spur
@@ -17,6 +17,7 @@ metadata:
     - builder
     - agent
     - message
+    - decision
     - self
     - history
     - projects
@@ -44,7 +45,7 @@ Pick the noun, read its reference. Each Tier A and Tier B reference owns that no
 | **Tier A** | **rule** | Constraint quality gate: run presets, author rules, fine-tune, validate rule files/presets, extend engine | [references/rules.md](references/rules.md) |
 | **Tier A** | **workflow** | Dual-mode workflow runtime: author state-machine / transition-flow workflows, validate, run, read traces | [references/workflows.md](references/workflows.md) |
 | **Tier A** | **builder** | Release plumbing: bump a package (or the `workspace:`-pinned set) with `bump-ver`, delete release tags with `drop-tags`, commit + tag + optional push | [references/builder.md](references/builder.md) |
-| **Tier B** | **agent** | Coding-agent execution surface: run prompts via detected/named agents, list agent specs, start/stop supervised processes, readiness check | [references/agent.md](references/agent.md) |
+| **Tier B** | **agent** | Coding-agent execution surface: run prompts via detected/named agents, list agent specs (incl. `agent.fleet` members), start/stop supervised processes, fleet `report`/`join`/`leave`/`wait`/`trace`, readiness check | [references/agent.md](references/agent.md) |
 | **Tier B** | **message** | Durable inter-agent messaging: send, inbox, reply, watch | [references/message.md](references/message.md) |
 | **Tier B** | **self** | Self-management verbs: scaffold (`init`), database maintenance (`maintain`), schema migrations (`migrate`), local web server (`serve`), status overview (`status`); `self init` runs post-scaffold validation probes & layout classification | [references/self.md](references/self.md) |
 | **Tier B** | **history** | Import agent histories, aggregate forensic artifacts, render reports, and run the checkpoint-resumed daily pipeline | [references/history.md](references/history.md) |
@@ -142,6 +143,8 @@ and spreading it; full contract in `docs/04_DESIGN.md` §1.0.1.
   [dispatch-surface rule](../parallel-execution/references/dispatch-surface.md).
 - **[references/message.md](references/message.md)** - durable inter-agent messaging (`send`,
   `inbox`, `reply`, `watch`).
+- **[references/decision.md](references/decision.md)** - decision catalog (`list`, `show`, `run`,
+  `status`); offline by default via the built-in `typesafe` maker.
 - **[references/self.md](references/self.md)** - `spur self init|maintain|migrate|serve|status` CLI verbs
   (the five legacy top-level nouns remain hidden aliases). `self init` runs post-scaffold init
   validation (Phase 1.5/1.6 probes).

package/plugins/sp/skills/spur-cli/references/agent.md

@@ -22,19 +22,19 @@ that before using `run` for fan-out dispatch.
 | Verb | Purpose | Key flags |
 | ---- | ------- | --------- |
 | `run <prompt>` | Execute a prompt or slash command via a coding agent | `--agent <name>` `--spec <id>` `--model <name>` `--mode <mode>` `--continue` `--cwd <path>` `--drain` `--json` |
-| `wait [<specId>]` | Identity-pinned wait for an occupant run to reach a lifecycle state (G4 wave 2; `--role` selector per 0685) | `--role <name>` `--run <runId>` `--until <state>...` `--timeout <ms>` `--json` |
+| `wait [<specId>]` | Identity-pinned wait for an occupant run to reach a lifecycle state (G4 wave 2; `--role` selector per 0685) | `--role <name>` `--run <runId>` `--until <state>...` `--timeout <ms>` `--inbox <id>` `--json` |
 | `trace <runId>` | Print one execution record's lineage — the run, its dispatch parents, agent session ids and streams (1076 R4, ADR-132) | `--follow` `--timeout <ms>` `--json` |
 | `list` | List detected coding agents, or agent specs with `--specs` (live run status + member session merged from `spur self serve`) | `--specs` `--server <url>` `--json` |
 | `report` | Report a fleet member lifecycle state (`working`/`idle`/`blocked`) from a host hook (G73 R1/R2, task 1080) | `--state <state>` `--seq <ns>` `--spec <id>` `--json` |
 | `join` | Join the fleet as a guest occupant — a live session that pulls its own work (G73 R2, task 1081) | `--role <name>` `--id <id>` `--session-id <sid>` `--pid <n>` `--executor <name>` `--json` |
-| `leave` | Leave the fleet: release the guest lease, retire the occupant, return claimed messages to pending | `[id]` `--session-id <sid>` `--json` |
+| `leave` | Leave the fleet: release the guest lease, retire the occupant, return claimed messages to `queued` | `[id]` `--session-id <sid>` `--json` |
 | `status` | Agent specs with live process status and member session (requires `spur self serve`) | `--server <url>` `--json` |
 | `doctor [agent]` | Check agent readiness | `--json` `--probe-health` `--force-refresh` |
 | `usage` | Run-once provider usage capture (codexbar) → quota-owned availability refresh; scheduled externally | `--dry-run` `--source <name>` `--json` |
 | `start <spec-id>` | Start a supervised agent process (requires `spur self serve`) | `--server <url>` `--json` |
 | `stop <spec-id>` | Stop a supervised agent process (requires `spur self serve`) | `--server <url>` `--json` |
 
-`list`, `status`, `doctor`, `run`, `wait`, `trace`, `start`, and `stop` accept `--json` plus `--json-envelope`. The hidden
+Every verb except `trace` accepts `--json` plus `--json-envelope`; `trace` is `--json` only. The hidden
 `loop` is a supervisor-internal process surface. **Exit codes:** `0` success, `1` failure, and `2`
 invalid usage; `run` can also propagate the invoked agent's non-zero result.
 
@@ -142,24 +142,27 @@ exits 2 naming the accepted vocabulary. Resolution collapses onto the same ident
 
 ```bash
 spur agent list              # detected coding agents on this machine
-spur agent list --specs      # agent specs under .spur/agents/
+spur agent list --specs      # agent specs: .spur/agents/*.yaml + agent.fleet members
 spur agent list --json       # machine-readable
 ```
 
 Without `--specs`, lists coding agents detected on the host (by binary on `PATH`). With `--specs`,
-lists agent specs (`.spur/agents/*.yaml`) **with live run status merged from the server's
+lists agent specs — hand-authored `.spur/agents/*.yaml` merged with the members declared under
+`agent.fleet.members` (derived in memory, never written to disk; the fleet declaration wins on an
+id clash; stale `fleet:generated` files are ignored) — **with live run status merged from the server's
 supervisor**: each row carries a trailing status column
 (`running` / `stopped` / `errored` / `unknown`), `pid=<n>` where a process exists, and the member
 session (0897): the session mode plus a shortened resume id (`resume id=3f9c2a1d`), or `-` when the
-member has no recorded session. When `spur self serve` is unreachable, the listing falls back to all
+member has no recorded session. `--json` rows carry `source: file` (plus `path`) or `source: fleet`
+(no backing file, so no `path`). When `spur self serve` is unreachable, the listing falls back to all
 `stopped` with a stderr warning. `--server <url>` targets the supervisor API; without it the URL is
 this project's serve — the port in the cwd's project-registry entry (`http://localhost:<port>/api`),
 falling back to `http://localhost:3000/api` only when the project has no live entry (1088 R1).
 
 ```bash
 spur agent list --specs
-# planner	claude	reviewer	claude	plans the work	running pid=4132	resume id=3f9c2a1d
-# worker-1	pi	worker	pi	implements	stopped	one-shot
+# myapp-planner-1	claude	planner	claude	orchestrator	running pid=4132	resume id=3f9c2a1d
+# myapp-coder-1	pi	coder	pi	implements	stopped	one-shot
 ```
 
 ## `status` - live status + member session per spec
@@ -180,7 +183,7 @@ unreachable server reports every spec `stopped` with no session. `--server <url>
 
 ```bash
 spur agent report --state working --seq 1759665600000000000
-spur agent report --state blocked --seq 1759665600000000000 --spec proj-worker-1 --json
+spur agent report --state blocked --seq 1759665600000000000 --spec myapp-coder-1 --json
 ```
 
 | Flag | Description |
@@ -215,7 +218,7 @@ concrete id only (role/executor selectors count declared members, so a guest is
 claim table (same TTL/heartbeat semantics as the write slot — R5) and writes
 `.spur/run/guests/<id>.json` so a host Stop hook can recognize its own session without a CLI call.
 `leave`, or lease expiry in the reconciler pass, releases the lease, marks the occupant exited,
-returns its claimed messages to `pending` and removes the record.
+returns its claimed messages to `queued` and removes the record.
 
 | Flag | Description |
 | --- | --- |
@@ -296,8 +299,8 @@ buffer is only a live view.
 ## `start` - start a supervised process
 
 ```bash
-spur agent start worker-1
-spur agent start worker-1 --json
+spur agent start myapp-coder-1
+spur agent start myapp-coder-1 --json
 ```
 
 Posts to the `spur self serve` supervisor API
@@ -310,8 +313,8 @@ when the server is unreachable or the start fails.
 ## `stop` - stop a supervised process
 
 ```bash
-spur agent stop worker-1
-spur agent stop worker-1 --json
+spur agent stop myapp-coder-1
+spur agent stop myapp-coder-1 --json
 ```
 
 Posts to the supervisor API
@@ -388,7 +391,9 @@ one never re-sends settled work; only never-started deliveries release and redel
   **[dispatch-surface rule](../../parallel-execution/references/dispatch-surface.md)**, not this
   reference. This reference documents the verbs; that rule decides which surface carries a dispatch.
 - **Not the fleet orchestrator.** The `spur self serve` supervisor drives the lifecycle: `spur agent
-  start` / `stop` manage supervised processes and `agent list --specs` reports live state.
+  start` / `stop` manage supervised processes and `agent list --specs` reports live state. Dispatch
+  policy (`agent.fleet.strategy` `rest|gtd`, the `orchestrator` member, `--agent fleet` routing)
+  lives in project config and the workflow executor, not in these verbs.
 
 ## See also
 

package/plugins/sp/skills/spur-cli/references/decision.md

@@ -22,15 +22,15 @@ Decisions resolve first-wins across three layers:
 | Layer | Root | Notes |
 | ----- | ---- | ----- |
 | `project` | `<cwd>/.spur/decisions/*.yaml` | Highest precedence |
-| `registered` | programmatic catalog registrations | Agents register in-process |
+| `registered` | folders listed in config `decisions.paths` | Operator-added catalogs |
 | `shared` | `decisions/` under the bundled config root | Shipped catalogs (`config/decisions/` in-repo) |
 
 The bundled shared catalog ships `task-triage`, `failure-class`, and `review-failure-class` (all
 `choice` type, param `wbs`). Duplicate ids across layers keep the higher layer; duplicates inside
 one file are a load error.
 
-**Config keys** (under `decisions:` in `config.global.yaml` or project config):
-`paths` (extra catalog folders joined to the registered layer), `maker` (default DecisionMaker
+**Config keys** (under `decisions:` in the global `~/.config/spur/config.yaml` or project `.spur/config.yaml`):
+`paths` (extra catalog folders forming the `registered` layer), `maker` (default DecisionMaker
 for every decision point), `makers` (per-decision-id overrides). An unregistered maker name is a
 config error, never a silent fallback (design §3.6).
 
@@ -47,8 +47,9 @@ All verbs support `--json` (bare payload) and `--json-envelope` (`{ok, data|erro
 ADR-091). Failure output for `--json` commands uses the canonical error envelope only under
 `--json-envelope`; plain `--json` keeps the human message on stderr.
 
-**Exit codes:** `status` exits 1 on catalog load errors; `show` exits 1 on unknown id; `list` always
-exits 0 (design §3.4 — load errors surface via `status`).
+**Exit codes:** `status` exits 1 on any catalog load error or maker-config error; `show` exits 1 on unknown id; `list` exits 0
+(design §3.4 — load errors surface via `status`) except for an invalid `--layer` value (exit 1).
+Error envelopes use `NOT_FOUND` for an unknown id and `VALIDATION_FAILED` for every other caller mistake.
 
 **Exit contract for `run` (design §3.4):** any backend-observed outcome — low confidence, model
 error surfaced as fallback, declined — is still a **successful serve** (exit 0, envelope carries
@@ -86,7 +87,7 @@ spur decision show task-triage                      # inspect contract before se
 spur decision run task-triage --param wbs=1093 --json
 spur decision run failure-class --param wbs=1093 \
     --evidence .spur/run/<runId>-test-output.txt    # redacted evidence -> instructions
-spur decision status --json | jq '.data.errors'     # audit catalog health
+spur decision status --json | jq '.loadErrors'      # audit catalog health
 ```
 
 ## References

package/plugins/sp/skills/spur-cli/references/message.md

@@ -31,10 +31,10 @@ All verbs accept `--json` and `--json-envelope`. `watch` applies the envelope pe
 
 ```bash
 spur message send "Please review PR 42" --to reviewer
-spur message send "Task 0040 is blocked" --to worker-1 --from operator
+spur message send "Task 0040 is blocked" --to myapp-coder-1 --from operator
 spur message send "Done" --to planner --json
 spur message send "Review 0042" --to reviewer --wait --until invoke-exit --timeout 30000
-spur message send "Done" --to manager --request-key 0695-report-42      # retry-safe: same key replays the original receipt
+spur message send "Done" --to myapp-planner-1 --request-key 0695-report-42      # retry-safe: same key replays the original receipt
 spur message send "Start the pass" --role reviewer          # resolves to exactly one instance
 ```
 
@@ -66,9 +66,9 @@ wait; enqueue is **not** rolled back if the wait later fails.
 ## `inbox` - list addressed messages
 
 ```bash
-spur message inbox --agent worker-1
-spur message inbox --agent worker-1 --json
-spur message inbox --agent worker-1 --unresolved --json
+spur message inbox --agent myapp-coder-1
+spur message inbox --agent myapp-coder-1 --json
+spur message inbox --agent myapp-coder-1 --unresolved --json
 ```
 
 Lists messages addressed to `--agent <id>`, oldest first. The body is truncated in plain-text output;
@@ -107,8 +107,8 @@ Threads a reply to a specific message id. The reply is addressable to the origin
 ## `watch` - follow an inbox live
 
 ```bash
-spur message watch --agent worker-1
-spur message watch --agent worker-1 --interval 1000 --json
+spur message watch --agent myapp-coder-1
+spur message watch --agent myapp-coder-1 --interval 1000 --json
 ```
 
 Polls the inbox and surfaces each **new** message exactly once as it arrives. `Ctrl-C` to exit. With

package/plugins/sp/skills/spur-cli/references/tasks/verbs.md

@@ -258,14 +258,28 @@ the active tasks folder (or `--folder`).
 
 ## `migrate-anchors`
 
-Qualify ambiguous in-repo evidence anchors to repo-relative paths across the task corpus. Run
+Qualify in-repo evidence anchors to repo-relative paths across the task corpus. Run
 `--dry-run` first: unambiguous matches are reported in `qualified`, multiple matches in `ambiguous`
 without rewriting, and schema-incompatible files in `skipped`. The write path uses the planning
 service rather than raw file edits.
 
+**`done_reason` scratch pointers are retargeted** (task 1140, ADR-131): a `.spur/run/<wbs>-verdict.json`
+or `.spur/run/<wbs>/verdict.json` substring becomes `.spur/memory/evidence/<wbs>-verdict.json` when
+that copy exists, else `tracked Testing section (scratch verdict not retained)` when Testing is
+non-empty; otherwise the value is left unchanged and reported in `doneReasonUnresolved`. Each
+`doneReasons` row carries `kind` (`absolute-path` | `durable-evidence` | `tracked-testing`). This is
+the repair for the `no-scratch-verdict-pointer` rule.
+
+**`--wbs <wbs>` scopes the pass to one task file** (task 1109 R1) — the wbs is resolved through the
+task locator and exactly that file is scanned, so the pipeline's implement stage can auto-repair a
+task's unique basename anchors without the corpus-wide pass rewriting unrelated files (the unscoped
+apply rewrote 119 on 2026-10-07). An unknown wbs exits `1` with an actionable message and writes
+nothing. Ambiguous basenames are still reported and left untouched in scoped mode.
+
 ```bash
 spur task migrate-anchors --dry-run --json
 spur task migrate-anchors --json
+spur task migrate-anchors --wbs 1109 --json     # one task file only
 ```
 
 ## `resolve <file-path>`
@@ -358,7 +372,9 @@ and `prefixId` normalizes `AC<n>` so the box flips. A bare `AC-<i>` also does bo
 resolves it through the feature's scenario order to the AC line aliasing scenario *i*
 (`AC<k> — [R<n> — ]<scenario title>`) and flips that box — never the same-numbered `AC<i>`; with no
 aliasing line it flips nothing. A bare `AC<n>` credits no scenario; a title carrying the scenario's
-`R<n>` label matches neither.
+`R<n>` label matches neither. When the task's AC section is a Gherkin fence (`Scenario: AC1 — …`
+rows), there is no checklist label: cite each row by its exact scenario title — a bare `AC<i>`
+matches nothing and the verdict is rejected.
 
 **Evidence rule (behavior-bearing AC):** an AC row with `status: MET` on a behavior-bearing id
 (no `[advisory]`/`[non-core]`/`[non-behavior]`/`[docs-only]` marker) MUST carry `test` or
@@ -436,7 +452,7 @@ spur task sections <wbs> <init|add|list> [name] [--folder] [--json]
 spur task list     [--status <s>] [--phase <p>] [--parent <wbs>] [--feature <id>] [--folder] [--json]
 spur task refresh  [--folder] [--json]
 spur task migrate  [--dry-run] [--folder] [--json]
-spur task migrate-anchors [--dry-run] [--json]
+spur task migrate-anchors [--wbs <wbs>] [--dry-run] [--json]
 spur task refresh-roster <wbs> [--folder] [--json]
 spur task batch-create --file <path> [--skip-ready | --agent <selector>] [--folder] [--json]
 spur task record   <wbs> [--verdict-file <p>] [--solution-from-diff] [--transition <s>] [--folder] [--json]

package/plugins/sp/skills/spur-cli/references/tasks.md

@@ -23,7 +23,7 @@ does what*, this skill.
 Start from the WBS, not the corpus layout:
 
 ```bash
-spur task show <wbs> --json  # metadata + full content + filePath
+spur task show <wbs> --json  # {wbs, name, status, frontmatter, content, filePath}; priority etc. under .frontmatter
 spur task get  <wbs> --json  # alias of `show` — same output, no separate code path
 spur task path <wbs> --json  # absolute path only
 ```
@@ -38,15 +38,15 @@ re-reading or re-tokenizing the task.
 
 | Verb | Purpose | Key flags |
 | ---- | ------- | --------- |
-| `create <title>` | Allocate a new task (race-safe WBS) | `--feature <id>` `--parent <wbs>` `--template <variant>` `--dedupe-within <s>` `--allow-duplicate-name` `--skip-ready` `--agent <selector>` `--folder` `--json` |
+| `create <title>` | Allocate a new task (race-safe WBS) | `--feature <id>` `--no-reopen` `--parent <wbs>` `--template <variant>` `--dedupe-within <s>` `--allow-duplicate-name` `--skip-ready` `--agent <selector>` `--folder` `--json` |
 | `show <wbs>` | Print one task's frontmatter + body | `--folder` `--json` |
-| `update <wbs> [status]` | Lifecycle transition, section replace, **or** frontmatter set | `--section <name> --from-file <path>` `--assignee <spec-id>` (exclusive with `--section`) `--feature <id>` `--priority <p>` `--ac-numbering task-local` `--ac-altitude <a>` `--estimate-hours <n>` `--no-lifecycle` `--force-done` `--reason <text>` `--provenance-bypass` `--verdict-dir <path>` `--folder` `--json` |
+| `update <wbs> [status]` | Lifecycle transition, section replace, **or** frontmatter set | `--section <name> --from-file <path>` `--assignee <spec-id>` (exclusive with `--section`) `--feature <id>` `--no-reopen` `--priority <p>` `--ac-numbering task-local` `--ac-altitude <a>` `--estimate-hours <n>` `--no-lifecycle` `--force-done` `--reason <text>` `--provenance-bypass` `--verdict-dir <path>` `--folder` `--json` |
 | `deps <wbs> <op> [values...]` | Mutate `dependencies[]` frontmatter array (ops: `set`, `add`, `remove`, `clear`) | `--folder` `--json` |
 | `sections <wbs> <op> [name]` | Initialize, add, or list canonical task sections (ops: `init`, `add`, `list`) | `--folder` `--json` |
 | `list` | List tasks, filtered | `--status <s>` `--phase <p>` `--parent <wbs>` `--feature <id>` `--folder` `--json` |
 | `refresh` | Re-scan the corpus and report counts (**`kanban.md` retired** — web Task Kanban is SSOT) | `--folder` `--json` |
 | `migrate` | One-time A17 corpus normalization pass | `--dry-run` `--folder` `--json` |
-| `migrate-anchors` | Qualify in-repo evidence anchors to repo-relative paths (0583 R1–R3) | `--dry-run` `--json` |
+| `migrate-anchors` | Qualify in-repo evidence anchors to repo-relative paths (0583 R1–R3); `--wbs` scopes to one task file (1109 R1); retargets scratch `done_reason` verdict pointers (1140) | `--wbs` `--dry-run` `--json` |
 | `refresh-roster <wbs>` | Regenerate a parent task's sub-task roster block in `## Plan` | `--folder` `--json` |
 | `batch-create` | Create many tasks from a validated JSON array | `--file <path>` `--skip-ready` `--agent <selector>` `--folder` `--json` |
 | `record <wbs>` | Write `Testing` from a verify verdict (deterministic); bare-`## Review` fallback only; optional Solution + transition | `--verdict-file <path>` `--solution-from-diff` `--transition <status>` `--folder` `--json` |
@@ -67,8 +67,11 @@ tasks folder. **Exit codes:** `0` success, `1` error, `2` invalid usage.
 spur task create "Add email validation" --feature H2 --parent 0040
 ```
 
-- **`--feature <id>`** wires traceability: it derives the task's `Background` from the feature's
-  `Goal` and records `feature_id` in frontmatter (L4 traceability reads this edge).
+- **`--feature <id>`** wires traceability: it derives the task's `Background` from the feature's `Goal`
+  and records `feature_id` in frontmatter (L4 traceability reads this edge). The parent feature's
+  status is checked before any write: `done`/`cancelled` is rejected with the status plus up to three
+  `active` sibling ids, and `verifying` is reopened to `active` through the guarded feature transition
+  (`featureReopened` in `--json`); `--no-reopen` suppresses only that reopen.
 - **`--parent <wbs>`** groups the new task under a parent WBS for sub-task decomposition.
 - **`--template <variant>`** selects the section-matrix variant that shapes the new file's sections:
   `standard·feature-impl·issue·review·meta·brainstorm`. The default is **`feature-impl` when
@@ -273,7 +276,7 @@ corpus, or with a WBS for one task:
 
 ```bash
 spur task check --json              # whole corpus
-spur task check 0040 --json         # one task
+spur task check 0040 --json         # one task; output is an array — read .[0].pass
 spur task check --strict --json     # elevate ALL warnings to failures
 spur task check 0040 --as done        # evaluate as the done row (lifecycle target, F92 R2)
 spur task check 0040 --strict-core    # compatibility alias; not the done gate (use --as done)

package/plugins/sp/skills/spur-cli/references/workflows/authoring-workflows.md

@@ -134,6 +134,13 @@ runner (see [validation-and-extension.md](validation-and-extension.md)).
 | Guard | `always` | Unconditional pass — the default edge condition / fallback transition |
 | Guard | `action-ok` | Pass iff the prior action on this state/node succeeded — useful for a single hard shell check |
 
+Spur's host additionally registers (`registerSpurBuiltins`, `packages/app/src/workflow/builtins.ts`):
+
+| Kind | Capability |
+| ---- | ---------- |
+| Action | `agent.run` (model call via `spur agent run`; `executor: 'fleet'` dispatches into the agent fleet), `decide` (inline `id`/`method`/`question`/`choices`/`default`/`evidence` → outcome written to `resultFile`; catalog-id references are pending task 1094 — use `spur decision run` for catalog decisions), `command.gate`, `rule.check`, `doctor.probe`, `response.validate`, `proof.fingerprint`, `run.artifact`, `file.exists`, `file.read`, `file.read.into-var`, `http.request`, `hitl.confirm`, `hitl.select`, `hitl.input`, `shell` (streaming) |
+| Guard | `shell` (env-aware), `contract-violation` |
+
 Order matters for both guards and conditions: **the first that passes wins.** Put the discriminating
 guard before the unconditional fallback (`always` / no-guard edge). For multi-condition gates (doctor
 + task check, quality gate + attempt cap), prefer a **soft probe** shell that writes PASS|FAIL and

package/plugins/sp/skills/spur-cli/references/workflows.md

@@ -112,7 +112,7 @@ The skill's logic divides by **whether the LLM adds value**:
 | `run` | `spur workflow run` (CLI) | `<file> [--run-id <id>] [--vars <json>] [--dry-run] [--async] [--no-plan] [--quiet/--silent/--verbose] [--detail <level>] [--trace-file] [--no-log] [--steer]` | Terminal state reached (sync) or run started (async); trace readable |
 | `continue` | `spur workflow continue` (CLI) | `[run-id] [--yes] [--answer <yes\|no\|cancel>] [--answer-text <text>] [--async] [--no-log]` | Resume a paused or interrupted run (omit id -> most recent resumable); `--answer` injects a confirm/select gate answer and `--answer-text` answers an input gate with free text (H1 R27), both before guard re-evaluation; one of them is required headless (0901 R3) and each is validated against the pending gate kind; `--async` detaches the resume (0901 R4) |
 | `cancel` | `spur workflow cancel` (CLI) | `<run-id>` | Single non-terminal run marked failed (SIGTERM async worker when live) |
-| `clean` | `spur workflow clean` (CLI) | `[--older-than <min>] [--force] [--logs] [--dry-run]` | Bulk-finalize stale `running`/`pending` runs as failed **and** reclaim retained run logs older than `workflow.logRetentionDays` (30d default) |
+| `clean` | `spur workflow clean` (CLI) | `[--older-than <min>] [--force] [--logs] [--dry-run]` | Bulk-finalize stale `running`/`pending` runs as failed **and** reclaim retained run logs older than `workflows.logRetentionDays` (30d default) |
 | `list` | `spur workflow list` (CLI) | — | Available workflow **YAML definition files** (not run records) |
 | `trace` | `spur workflow trace` (CLI) | `[run-id] [--workflow <n>] [--status <s>] [--since <iso>] [--last <n>] [--follow] [--poll <ms>] [--output] [--timeout <ms>]` | Run history list or per-run timeline |
 | `progress` | `spur workflow progress` (CLI) | `<run-id>` | The `projectWorkflowProgress` projection for that run — current state, per-action attempts, candidate next transitions, diagnostics. Read-only; the verb renders, `packages/app` derives. Unknown run id exits 1 with `Run <id> not found.` |
@@ -273,6 +273,11 @@ spur workflow progress <run-id> [--json]
 `spur workflow show <file>` renders the declared graph as Mermaid. `--format todo` instead emits a
 declared-step checklist; `--json` serializes the selected projection. This verb intentionally does
 not advertise `--json-envelope` because its JSON projection is a kept-raw document surface.
+Task 1104: for annotated definitions the todo `--json` payload also carries `plan` — the two-layer
+A-Z/1-9 phased plan derived from each state's `display` (`phase`/`phaseTitle`/`title`/`show`);
+`null` when no state declares `display`. `workflow validate` enforces the phase table on annotated
+definitions (every non-terminal state phased, terminals bare, ≤25 phases, ≤9 states per phase,
+consistent `phaseTitle`).
 
 | Flag (on `run`) | Effect |
 | --------------- | ------ |
@@ -361,7 +366,7 @@ redirecting `agent.run` stages (ADR-047).
 - **Stale-run finalization** (existing): bulk-finalizes orphaned `running`/`pending` runs as `failed`.
   `--older-than <minutes>` (default 30) and `--force` (all non-terminal regardless of age) apply here only.
 - **Run-log reclamation** (0429): removes expired `.log` files from `.spur/memory/runs/`
-  and legacy `.spur/run/`, using `workflow.logRetentionDays` (default 30 days). Non-terminal
+  and legacy `.spur/run/`, using `workflows.logRetentionDays` (default 30 days). Non-terminal
   runs, including paused/interrupted runs, are protected; ownership lookup failures preserve logs.
   The two-file record (`.md` + `.state.json`) and partial handoffs are retained.
 - **Checkpoint reclamation**: removes expired terminal checkpoints only when confinement,

package/plugins/sp/skills/spur-composer/SKILL.md

@@ -49,7 +49,7 @@ its own output and never runs a recurring loop — evaluation is the doctor's jo
 | feature | Apply accepted rows through `spur feature update --section --from-file`; keep acceptance criteria in Gherkin | [../spur-cli/references/features.md](../spur-cli/references/features.md) |
 | rule | The trace-driven tuning loop (§ Rule tuning loop) | [../spur-cli/references/rules.md](../spur-cli/references/rules.md) · [fine-tuning](../spur-cli/references/rules/fine-tuning.md) |
 | workflow | Catalog selection, the composition ladder, and the ADR-115 budgets (§ below) | [../spur-cli/references/workflows.md](../spur-cli/references/workflows.md) · [operations](../spur-cli/references/workflows/operations.md) |
-| agent spec | Read through `spur agent list --specs`; specs are materialized from the fleet declaration at serve start | [../spur-cli/references/agent.md](../spur-cli/references/agent.md) |
+| agent spec | Read through `spur agent list --specs`; fleet member specs are derived in memory from `agent.fleet` (never written to `.spur/agents/`) | [../spur-cli/references/agent.md](../spur-cli/references/agent.md) |
 | board module | Declare under `bootstrap.modules`, gated by the serve preflight (§ Board module composition) | [../spur-cli/references/serve.md](../spur-cli/references/serve.md) |
 
 Do not drive the planning→execution lifecycle from here — that is `sp:spur-dev`.