@gobing-ai/spur 0.4.0 → 0.4.2

package/config/workflows/task-pipeline.yaml

@@ -63,7 +63,14 @@ name: task-pipeline
 # UNREACHABLE: a non-PASS verify could only end the run failed. `test-fix` also gained the
 # review-lane evidence projection (see its onEnter) so the repair hop is not fed an empty findings
 # list when the failing hop was `review-fail-triage` rather than the quality gate.
-version: "5"
+# v6 (task 1134 run, 2026-10-09): the `confidence` check row now encodes the SAME policy as the two
+# completion guards instead of a stricter one of its own. It warned for every level below HIGH, so a
+# MEDIUM certification was admitted by both guards but recomputed as PARTIAL by the CLI done gate —
+# the artifact was self-inconsistent and `done` was refused with no named level to act on. The row
+# now warns only for an unacknowledged LOW (or absent) level, which is exactly what the guards
+# refuse; `packages/app/tests/workflow/task-pipeline-proof-chain.test.ts` pins the agreement for
+# HIGH/MEDIUM/LOW/absent × ack.
+version: "6"
 description: "Standard task pipeline: precheck → implement → quality-gate (test/fix/recheck) → review → approve → verify → record → done"
 # Task entity lifecycle (owned by task-lifecycle.yaml):
 #   normal: backlog → todo → wip → testing → done
@@ -116,11 +123,15 @@ vars:
     # run unbounded — if a hop still hits this wall, STOP and record it.
     stepTimeoutMs: "1800000"
     # Timeout for the `implement` step specifically (R2a). Implementation is the
-    # heaviest agent.run step (full read/write/test-probe loop) and has timed out
-    # at the 600s default in five consecutive dogfood runs (bugs 742/744/746/748),
-    # a 100% failure rate at that budget. 30 min gives real headroom; STOP and
-    # record honestly rather than raising it further without operator sign-off.
-    implementTimeoutMs: "1800000"
+    # heaviest agent.run step (full read/write/test-probe loop); the old 600s default
+    # failed five consecutive dogfood runs (bugs 742/744/746/748). Default is 45 min
+    # (task 1108): it governs subprocess surfaces (`spur workflow run`, parallel,
+    # headless); inline hosts receive it only when their dispatch tool accepts a
+    # timeout (inline-pipeline-driver.md § Timeout boundary). 45 min is a reasoned
+    # default, not a proven bound — in P1 one implement still hit 45 min and resumed
+    # (docs/reports/i31/1107-runall-p1-pilot.md § Timeout attribution).
+    # Override per run: `--vars '{"implementTimeoutMs":"3600000"}'`.
+    implementTimeoutMs: "2700000"
     # Answer captured by the approve gate's hitl.confirm (R1): "yes" | "no" | "cancel".
     # Empty by default; only meaningful once the approve state has been entered.
     __hitlAnswer: ""
@@ -128,13 +139,16 @@ vars:
     # default; set by `spur workflow continue --answer-text` after the pause and read
     # by the escalate→implement / escalate→failed guards. Non-empty = answered.
     __hitlInput: ""
-    # Proof-state bracket (task 0612, ADR-071; restructured by task 0703). `proofDigest` is the
-    # canonical capture taken at quality-gate ENTRY — immediately before the evidence-producing
-    # final chain (quality → review → verify) — and re-captured at `test-recheck` when bounded
-    # remediation mutated the tree, so every evidence stage names one fresh digest (R2/R4).
-    # `proofDigestNow` is the live re-capture compared against `proofDigest` at verify entry and
-    # immediately before `record`; a mismatch means a proof input changed after evidence was
-    # established, so the run routes to `failed` instead of crossing the completion boundary (R5).
+    # Proof-state bracket (task 0612, ADR-071; restructured by task 0703; review joins by task 1135).
+    # `proofDigest` is the canonical capture taken at quality-gate ENTRY — immediately before the
+    # evidence-producing final chain (quality → review → verify) — and re-captured at `test-recheck`
+    # when bounded remediation mutated the tree, so every evidence stage names one fresh digest
+    # (R2/R4). `proofDigestNow` is the live re-capture compared against `proofDigest` at review,
+    # verify and record entry; a mismatch means a proof input changed after evidence was established,
+    # so the run routes to `failed` instead of spending a review dispatch or crossing the completion
+    # boundary (R5). Task 1135 adds the review-entry compare and the gate-entry tree snapshot
+    # (`.spur/run/<run-id>-gate-paths.txt`, same exclusions as the git-tree half) so a mismatch also
+    # names the drifted paths.
     # `taskSpecPath` carries the task file path because `docs/tasks*` is excluded from the digest's
     # git-tree half — spec content is folded in explicitly or a task-file edit would go undetected.
     # The fingerprint scopes task content to the proof-input sections only (Background, Requirements,
@@ -155,6 +169,11 @@ vars:
     # with the same package-manager surface (this monorepo is Bun-only):
     # `--vars '{"qualityGateCmd":"bun run lint && bun run test"}'`. Soft probe, hard recheck,
     # and the fixall slash input all use this same var so the command stays single-sourced.
+    # INVARIANT (ADR-124, clarified 2026-10-07 by task 1111 R5): only the FULL tier writes PASS.
+    # Under the opt-in `deferQualityGate` policy the per-task token is DEFERRED (light tier) and
+    # the "review runs only after a green full gate" invariant moves to BATCH scope — nothing is
+    # reported PASS without the integrated full gate on the base ref. Default "false" = per-task
+    # full gate, unchanged.
     # TRUSTED CONFIG ONLY — this string is executed via `sh -c` (see test/test-recheck). Never
     # interpolate untrusted operator/LLM input into qualityGateCmd (task 0436 SECUA residual).
     # NO `format` PREFIX: `implement` already ran `$formatCmd` on its way out, and `test`
@@ -204,6 +223,14 @@ vars:
     # (default) = on; set to "off" to bypass:
     # `--vars '{"implementScopeGuard":"off"}'`.
     implementScopeGuard: ""
+    # 1111 R1: opt-in parallel-batch gate policy. When "true", `test` / `test-recheck` run the
+    # LIGHT tier for per-task early feedback and write `DEFERRED` (light PASS) or `FAIL` to
+    # `.spur/run/<wbs>-test-gate.status` — never `PASS`, because that token means the full
+    # project gate ran green on this tree. The batch orchestrator owes ONE integrated full gate
+    # on the base ref over the merged slices (1111 R3). Default "false" = unchanged behavior,
+    # and a stray `DEFERRED` file fails the guards. Sequential/inline runs never set it:
+    # `--defer-gate` requires `--mode parallel`.
+    deferQualityGate: "false"
     # 0931 R5: parallel batches defer the per-task feature sync so a task branch never
     # touches feature files or docs/features/INDEX.md. When "true", the record step's
     # post-record shell appends a deferral note and skips the sync; the parallel batch
@@ -213,6 +240,10 @@ vars:
 
 states:
     - id: precheck
+      display:
+          phase: implement
+          phaseTitle: Implement
+          title: Check task readiness
       description: >
           Fast deterministic task readiness and size checks. Failures route to the
           `failed` terminal state (not a raw lifecycle abort mid-enter).
@@ -256,6 +287,10 @@ states:
                     reviewer: "${vars.agent}"
 
     - id: implement
+      display:
+          phase: implement
+          phaseTitle: Implement
+          title: Implement
       description: >
           Run agent-driven implementation via /sp:dev-run --mode implement, THEN move the
           task to `wip` via the normal verb. The lifecycle transition fires AFTER the
@@ -287,6 +322,10 @@ states:
             options:
                 agent: ${vars.implementAgent}
                 # Pure slash command only (ADR-043). Anti-recursion / implement discipline
+                # The worker's brief is OWNED BY the skill, not restated here (task 1110 R3):
+                # see `plugins/sp/skills/code-implementation/SKILL.md` (targeted-probe scope
+                # § Implement scope, dependency-aware § Changed-path targeted checks, Solution
+                # anchor form in § Red Flags). The YAML only names the entry command.
                 # Declared Layer-1 role (0538 R2/0710 R7): routing reason; no executor pin — role routing feeds the distinctness gate.
                 role: coder
                 # B7 R3/R6 (0894): coder stages reuse the role session — the test-fix hop
@@ -350,6 +389,17 @@ states:
           - kind: shell
             options:
                 command: "$formatCmd ; exit 0"
+          # 1109 R3: qualify this task's unique basename anchors to repo-relative paths.
+          # Placement is load-bearing: it runs AFTER implement's mutations (and the format
+          # above) but BEFORE the `test` stage's `proof.fingerprint` capture, so a rewrite in
+          # a digest section cannot invalidate the proof. `--wbs` scopes the pass to this
+          # task's resolved file — the unscoped form rewrites ~119 unrelated task files.
+          # Non-fatal (`; exit 0`): the done gate still reports anything left, and this step
+          # deliberately does NOT address line drift or `L4.anchor-subject-mismatch`
+          # (those need the implementer to re-anchor). Scope contract: task 1109 R5.
+          - kind: shell
+            options:
+                command: "$spurBin task migrate-anchors --wbs $wbs --json ; exit 0"
 
     # ── escalate hop (operator-question pause, 0933) ──────────────────────────
     # The implement agent paused on an operator question: it wrote
@@ -363,6 +413,11 @@ states:
     # the escalate→implement guard so a stale question can never re-trigger the hop
     # after the answered attempt.
     - id: escalate
+      display:
+          phase: implement
+          phaseTitle: Implement
+          title: Ask operator
+          show: on-entry
       description: >-
           Operator-question pause (0933): the implement agent asked a question
           headlessly; surface it to the operator and resume implement with the answer.
@@ -396,6 +451,10 @@ states:
     #   test-fix     — increment attempt + pure slash /sp:dev-fixall (≤ max attempts)
     #   test-recheck — soft recheck → review | test-fix | failed (never silent lifecycle abort)
     - id: test
+      display:
+          phase: test
+          phaseTitle: Test
+          title: Run quality gate
       description: >
           Proof-chain entry + soft quality-gate probe (single logical gate on the green path; bounded retries only
           for SQLite lock contention). Capture of the canonical proof-input digest happens HERE — before any
@@ -440,6 +499,12 @@ states:
           # R2 (0703, ADR-071): THE canonical proof capture. Placement is load-bearing: immediately before
           # the final evidence chain, after every implement mutation (including the post-implement format).
           # Capture-only here; `record` compares. A remediation pass re-captures at `test-recheck` (R4).
+          # 1135 R5: snapshot the non-corpus tree state FIRST, so a later proof mismatch names the
+          # drifted paths (not only the D1/D2 pair). Same exclusions as the digest's git-tree half.
+          - kind: shell
+            options:
+                command: >-
+                    mkdir -p .spur/run; { git status --porcelain=v1 -uall -- . ':(exclude)docs/tasks*' ':(exclude)docs/features*'; git diff --name-only HEAD -- . ':(exclude)docs/tasks*' ':(exclude)docs/features*'; } > ".spur/run/$__runId-gate-paths.txt" 2>/dev/null; exit 0
           - kind: proof.fingerprint
             options:
                 var: proofDigest
@@ -449,9 +514,14 @@ states:
           - kind: shell
             options:
                 command: >-
-                    eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/quality-gate.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/quality-gate.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; if [ -f "$S" ]; then "$RUNNER" "$S" run; else echo "quality gate failed closed — quality-gate script not found — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; printf 'FAIL\n' > ".spur/run/$wbs-test-gate.status"; fi; exit 0
+                    eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/quality-gate.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/quality-gate.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; M=run; [ "$deferQualityGate" = "true" ] && M=deferred; if [ -f "$S" ]; then "$RUNNER" "$S" "$M"; else echo "quality gate failed closed — quality-gate script not found — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; printf 'FAIL\n' > ".spur/run/$wbs-test-gate.status"; fi; exit 0
 
     - id: test-fix
+      display:
+          phase: test
+          phaseTitle: Test
+          title: Fix failures
+          show: on-entry
       description: >
           Bounded auto-fix hop when the quality gate is red OR final verification returned a
           repairable non-PASS (task 0703 R4: remediation never happens inside verify — it loops
@@ -515,6 +585,11 @@ states:
                     processSpawn: available
 
     - id: test-recheck
+      display:
+          phase: test
+          phaseTitle: Test
+          title: Re-run quality gate
+          show: on-entry
       description: >
           Soft recheck after fixall with bounded SQLite-lock retry. Writes PASS|FAIL (always exit 0). Transitions
           branch to `triage` (PASS — the 0943 lane router), `test-fail-triage` (FAIL — the 0943
@@ -524,6 +599,12 @@ states:
           # R4 (0703, ADR-071): bounded remediation mutated the tree by design, so the fresh evidence
           # chain (recheck gate → review → verify) must start from a NEWLY captured digest. Capture-only;
           # the guards and `record` compare against this value.
+          # 1135 R5: re-snapshot the tree state after the remediation, so the refresh does not compare
+          # against a pre-remediation snapshot (a legitimate test-fix edit must not read as drift).
+          - kind: shell
+            options:
+                command: >-
+                    mkdir -p .spur/run; { git status --porcelain=v1 -uall -- . ':(exclude)docs/tasks*' ':(exclude)docs/features*'; git diff --name-only HEAD -- . ':(exclude)docs/tasks*' ':(exclude)docs/features*'; } > ".spur/run/$__runId-gate-paths.txt" 2>/dev/null; exit 0
           - kind: proof.fingerprint
             options:
                 var: proofDigest
@@ -539,9 +620,13 @@ states:
           - kind: shell
             options:
                 command: >-
-                    eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/quality-gate.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/quality-gate.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; if [ -f "$S" ]; then "$RUNNER" "$S" recheck; else echo "quality gate failed closed — quality-gate script not found — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; printf 'FAIL\n' > ".spur/run/$wbs-test-gate.status"; fi; exit 0
+                    eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/quality-gate.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/quality-gate.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; M=recheck; [ "$deferQualityGate" = "true" ] && M=deferred; if [ -f "$S" ]; then "$RUNNER" "$S" "$M"; else echo "quality gate failed closed — quality-gate script not found — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; printf 'FAIL\n' > ".spur/run/$wbs-test-gate.status"; fi; exit 0
 
     - id: triage
+      display:
+          phase: review
+          phaseTitle: Review
+          title: Choose review depth
       description: >-
           Deterministic lane router between a green gate and the review/verify fork (0943 R1).
           Writes the diffstat evidence file, honors a caller-set `mode` (never overridden), pins
@@ -570,17 +655,18 @@ states:
             options:
                 command: >-
                     mkdir -p .spur/run; if [ -n "$mode" ]; then printf '%s\n' "$mode" > ".spur/run/$wbs-mode.txt"; exit 0; fi; DF=".spur/run/$wbs-diffstat.json"; if ! jq -e 'type == "object"' "$DF" >/dev/null 2>&1; then printf 'safety\n' > ".spur/run/$wbs-mode.txt"; exit 0; fi; jq -r 'if .sensitive == true or ((.insertions // 0) + (.deletions // 0)) > 400 then "safety" else empty end' "$DF" 2>/dev/null > ".spur/run/$wbs-mode.txt"; exit 0
-          # (d) lane decision — degrades to the standard default whenever workflow.decideDecisionMaker
+          # (d) lane decision — degrades to the standard default whenever workflows.decideDecisionMaker
           # is off (R4), so with the flag off this state is pure shell: no model call is made.
+          # 1114: the inline decide moved to the bundled catalog (`config/decisions/task-pipeline.yaml`
+          # → `task-triage`), whose R0 samples measured this exact prompt before the migration.
+          # Routing contract is unchanged: same evidence, same resultFile, same guards, same
+          # `standard` fallback when the switch is off (field-identical to this form's default).
           - kind: decide
             options:
                 id: task-triage
-                method: choice
-                question: >-
-                    The quality gate is green. Which verification lane does this diff deserve —
-                    low (small, contained diff — fast lane), standard, or high caution?
-                choices: [low, standard, high]
-                default: standard
+                decision: task-triage
+                params:
+                    wbs: ${vars.wbs}
                 evidence:
                     - .spur/run/${vars.wbs}-diffstat.json
                     - ${vars.taskSpecPath}
@@ -601,6 +687,11 @@ states:
                 var: mode
 
     - id: test-fail-triage
+      display:
+          phase: test
+          phaseTitle: Test
+          title: Triage test failure
+          show: on-entry
       description: >-
           Deterministic failure-class router on a red gate (0943 R3). The engine has no onEnter
           conditionals, so the FAIL branch from `test`/`test-recheck` lands here as its own
@@ -611,22 +702,44 @@ states:
           missing/corrupt decision fails closed to failed-check. (0976 R2 collapsed the former
           `retryable` lane: the declared default made it unreachable on the inline path.)
       onEnter:
+          # 1115: catalog-reference decide (task 1094 form) — question/choices/fallback live in
+          # the bundled catalog (`config/decisions/task-pipeline.yaml` → `failure-class`), whose
+          # R0 samples measured this exact prompt before the migration. Routing contract is
+          # unchanged: same resultFile, same guards, same `fix` fallback when the switch is off.
           - kind: decide
             options:
                 id: failure-class
-                method: choice
-                question: >-
-                    The quality gate failed. Is the failure fixable by the repair agent, or should
-                    the run stop here?
-                choices: [fix, stop]
-                default: fix
+                decision: failure-class
+                params:
+                    wbs: ${vars.wbs}
                 evidence:
                     - .spur/run/${vars.wbs}-test-gate.findings
                 resultFile: .spur/run/${vars.wbs}-failure-class.decision
 
     - id: review
-      description: Three-dimensional code review via /sp:dev-review (functional requirements traceability + SECUA framework (Security, Efficiency, Correctness, Usability, Architecture) + architecture depth), findings written to `## Review`.
+      display:
+          phase: review
+          phaseTitle: Review
+          title: Review changes
+      description: >-
+          Three-dimensional code review via /sp:dev-review (functional requirements traceability +
+          SECUA framework (Security, Efficiency, Correctness, Usability, Architecture) +
+          architecture depth), findings written to `## Review`. Cost at this decision point (1122):
+          open P1-P3 review findings block `done` — the PASS edges below also run the review-gate
+          residual check, and a PASS carrying an open P1-P3 row routes to review-fail-triage
+          before verify. Fixing a finding invalidates the certified digest and re-runs
+          quality → review → verify on a fresh digest; only P4 rows and DEFER-ed P3 rows are wrap
+          residuals.
       onEnter:
+          # 1135 R4: review joins the proof bracket. A pre-review compare refuses to spend a review
+          # dispatch on a state that has drifted from the certified digest; the mismatch routes
+          # through the existing tripwire to `failed` (no new re-certify path).
+          - kind: proof.fingerprint
+            options:
+                var: proofDigestNow
+                taskFile: ${vars.taskSpecPath}
+                featureFile: ${vars.featureSpecPath}
+                expect: ${vars.proofDigest}
           - kind: agent.run
             options:
                 # 0710 R2: review always runs on a fresh session — no implementation-session
@@ -672,29 +785,42 @@ states:
     # (`.spur/run/<wbs>-test-fix-attempt` against `qualityGateMaxFixAttempts`), and the fix
     # re-enters quality → review → verify on a freshly captured digest. The `decide` action
     # itself always runs (the engine has no onEnter conditionals); with
-    # `workflow.decideDecisionMaker` off it degrades to its declared default.
+    # `workflows.decideDecisionMaker` off it degrades to its declared default.
     - id: review-fail-triage
+      display:
+          phase: review
+          phaseTitle: Review
+          title: Triage review findings
+          show: on-entry
       description: >-
           Deterministic router for a review that did NOT certify PASS (session finding after 1088).
           `decide review-failure-class` reads the reviewer's answer and the task spec and routes:
           fix → the shared test-fix hop, stop → failed with terminalReason failed-check. A
-          missing/corrupt decision fails closed to failed-check.
+          missing/corrupt decision fails closed to failed-check. Cost either way (1122): open
+          P1-P3 review findings block `done`; the fix lane re-enters quality → review → verify on a
+          fresh digest; only P4 rows and DEFER-ed P3 rows are wrap residuals.
       onEnter:
+          # 1116: the inline decide moved to the bundled catalog (`config/decisions/task-pipeline.yaml`
+          # → `review-failure-class`), whose R0 samples measured this exact prompt before the
+          # migration. Routing contract is unchanged: same evidence, same resultFile, same guards,
+          # same `fix` fallback when the switch is off.
           - kind: decide
             options:
                 id: review-failure-class
-                method: choice
-                question: >-
-                    The review did not certify PASS (FAIL or PARTIAL). Is the finding fixable by the
-                    repair agent, or should the run stop here for the operator?
-                choices: [fix, stop]
-                default: fix
+                decision: review-failure-class
+                params:
+                    wbs: ${vars.wbs}
                 evidence:
                     - .spur/run/${vars.__runId}-review-answer.txt
                     - ${vars.taskSpecPath}
                 resultFile: .spur/run/${vars.wbs}-review-failure-class.decision
 
     - id: approve
+      display:
+          phase: review
+          phaseTitle: Review
+          title: Operator approval
+          show: on-entry
       description: >
           Human-in-the-loop approval gate. Under `profile=auto` this state is never entered
           (review routes around it straight to verify). In interactive mode this state pauses
@@ -710,9 +836,18 @@ states:
                     mode: never
 
     - id: verify
+      display:
+          phase: verify
+          phaseTitle: "Verify & record"
+          title: Verify requirements and AC
       description: >
           Observe-only functional verification (BDD + traceability) via /sp:dev-verify --fix none
           (task 0703 R1, ADR-071): the verifier certifies the state, it never repairs its own subject.
+          The answer-shape contract this stage enforces is OWNED BY the skill, not restated here
+          (task 1110 R3): see `plugins/sp/skills/code-verification/SKILL.md` § Answer-File Schema
+          Contract (`:340-375`), with the row-id/evidence vocabularies in
+          `plugins/sp/skills/code-verification/references/verdict-schema.md`. The YAML only names
+          the lint that consumes it (`task verdict --from-answer`).
           A live digest compare BEFORE the agent refuses to certify a state that drifted after the
           quality/review evidence was produced (R2). The agent's
           captured answer is written to `.spur/run/<wbs>-verify-answer.txt` and MUST follow
@@ -763,15 +898,17 @@ states:
             options:
                 command: "$spurBin task verdict $wbs --from-answer .spur/run/$wbs-verify-answer.txt"
           # Session finding after 1088: the verifier's confidence level becomes a `confidence` check
-          # row (warn unless HIGH) and a gate-log line, so the level the completion guards enforce is
-          # visible in the artifact and the log — not only in the answer file. This is its own action
-          # because the proof-binding stamp below must stay the state's LAST action AND under the
-          # ADR-115 800-char shell cap.
+          # row and a gate-log line, so the level the completion guards enforce is visible in the
+          # artifact and the log — not only in the answer file. v6 (task 1134 run): the row warns for
+          # an unacknowledged LOW/absent level ONLY, matching the guards' ack rule; warning for
+          # MEDIUM too made an admitted certification aggregate to PARTIAL (self-inconsistent artifact,
+          # done refused). This is its own action because the proof-binding stamp below must stay the
+          # state's LAST action AND under the ADR-115 800-char shell cap.
           - kind: shell
             options:
                 command: >-
                     V=".spur/run/$wbs-verdict.json"; [ -f "$V" ] || exit 0;
-                    jq --arg ack "$ackLowConfidence" '. + {checks: ((.checks // []) | map(select(.name != "confidence"))) + [{name: "confidence", status: (if (.confidence // "LOW") == "HIGH" then "pass" else "warn" end), evidence: ((.confidence // "LOW (absent from artifact)") + (if $ack == "true" then " (operator-acknowledged)" else "" end))}]}' "$V" > "$V.tmp" && mv "$V.tmp" "$V";
+                    jq --arg ack "$ackLowConfidence" '. + {checks: (((.checks // []) | map(select(.name != "confidence"))) + [{name: "confidence", status: (if ((.confidence // "LOW") != "LOW" or $ack == "true") then "pass" else "warn" end), evidence: ((.confidence // "LOW (absent from artifact)") + (if $ack == "true" then " (operator-acknowledged)" else "" end))}])}' "$V" > "$V.tmp" && mv "$V.tmp" "$V";
                     printf 'confidence: %s (ack=%s)\n' "$(jq -r '.confidence // "LOW (absent)"' "$V")" "$ackLowConfidence" >> ".spur/run/$wbs-test-gate.log";
                     exit 0
           # (e) one jq mutation binds the verdict to the proof digest (0703 R3; runId 0730 §B.2 /
@@ -782,6 +919,10 @@ states:
                     V=".spur/run/$wbs-verdict.json"; [ -f "$V" ] && [ -n "$proofDigest" ] || exit 0; jq --arg d "$proofDigest" --arg r "$__runId" --arg dd "$__definitionDigest" --arg rp "$(cat .spur/run/$__runId-review-proof.digest 2>/dev/null)" --arg g "$(cat .spur/run/$wbs-test-gate.status 2>/dev/null || echo UNKNOWN)" '. + {proof: {digest: $d, runId: $r, definitionDigest: $dd, capturePoint: "quality-gate-entry", stages: {qualityGate: {status: $g, digest: $d}, review: {status: (if $rp == $d then "completed" else "skipped" end), digest: $d}, verification: {status: .verdict, digest: $d}}}} | .checks += [{name: "proof-input-digest", status: "pass", evidence: $d}]' "$V" > "$V.tmp" && mv "$V.tmp" "$V"; exit 0
 
     - id: record
+      display:
+          phase: verify
+          phaseTitle: "Verify & record"
+          title: Record evidence
       description: >
           Record pipeline results into the task file via `spur task record` —
           Testing/Review from the verdict, Solution backfilled from git diff as a
@@ -941,7 +1082,11 @@ transitions:
       guard:
           kind: shell
           options:
-              command: '$spurBin task check $wbs --precheck'
+              # 1132 R4 (auto-fix-first): repair mechanically first, then judge fail-closed. The
+              # `--fix` output is captured to a run artifact so the batch report can carry the
+              # task-level repairs under `autoRepairs` (feature-level repairs come from the
+              # `feature check --fix` preflight); only `--precheck` decides this transition.
+              command: '$spurBin task check $wbs --fix --json > ".spur/run/$wbs-auto-repairs.json" 2>/dev/null ; $spurBin task check $wbs --precheck'
     - from: precheck
       to: failed
       terminalReason: failed-check
@@ -1009,9 +1154,11 @@ transitions:
       guard:
           kind: shell
           options:
+              # 1111 R2: `DEFERRED` is accepted ONLY when the opt-in var is "true" — with the
+              # default "false" a stray DEFERRED file fails the guard exactly like a corrupt one.
               command: >-
                   gate_status="$(cat .spur/run/$wbs-test-gate.status 2>/dev/null)";
-                  test "$gate_status" = PASS
+                  test "$gate_status" = PASS || { test "$gate_status" = DEFERRED && test "$deferQualityGate" = "true"; }
     - from: test
       to: test-fail-triage
       description: Quality gate red — classify the failure before the repair hop (0943 R3).
@@ -1042,9 +1189,10 @@ transitions:
       guard:
           kind: shell
           options:
+              # 1111 R2: same var-gated acceptance of the deferred token as `test → triage`.
               command: >-
                   gate_status="$(cat .spur/run/$wbs-test-gate.status 2>/dev/null)";
-                  test "$gate_status" = PASS
+                  test "$gate_status" = PASS || { test "$gate_status" = DEFERRED && test "$deferQualityGate" = "true"; }
     - from: test-recheck
       to: test-fail-triage
       description: Still red after fixall — classify the failure (0943 R3).
@@ -1155,33 +1303,44 @@ transitions:
           kind: always
     # ── review routing: FAIL → bounded remediation; PASS → approve or the auto-skip (R4) ──
     # Declaration order matters and is FAIL-CLOSED: the two PASS edges each demand the reviewer's
-    # own `Verdict: PASS` line, and the catch-all sends EVERYTHING ELSE (FAIL, a missing answer, an
-    # unparseable one) into `review-fail-triage`. Before this, a FAIL review had no outgoing edge at
-    # all — the graph could not see the verdict, so remediation meant driving states by hand
-    # (session finding after 1088). The reviewer writes `Verdict: PASS|FAIL` in its answer; both
-    # plain and bold forms are accepted. Under `profile=auto` the approve gate is skipped, so the
-    # PASS+auto edge is tried first and the interactive PASS edge second.
+    # own `Verdict: PASS` line AND a passing review-gate residual check (1122 R3) — the SAME
+    # parse/classify/deferrals the record sweep enforces, resolved through the same source-repo /
+    # installed scanner pair as the record step; a missing scanner fails closed into the catch-all.
+    # EVERYTHING ELSE — FAIL, a missing or unparseable answer, or a PASS carrying an open P1-P3
+    # review finding (record would terminally fail it after a full verify + record) — enters
+    # `review-fail-triage` and its bounded repair hop BEFORE verify spends the cycle, then
+    # re-enters quality → review → verify on a fresh digest. Before 1088 a FAIL review had no
+    # outgoing edge at all; before 1122 a PASS-with-findings cost a full re-certification cycle per
+    # attempt (knowledge-kit 0210/0213). The reviewer writes `Verdict: PASS|FAIL` in its answer;
+    # both plain and bold forms are accepted. Under `profile=auto` the approve gate is skipped, so
+    # the PASS+auto edge is tried first and the interactive PASS edge second.
     - from: review
       to: verify
-      description: profile=auto and the review certified PASS — skip the human approval gate.
+      description: profile=auto, the review certified PASS, and no open P1-P3 review finding — skip the human approval gate.
       guard:
           kind: shell
           options:
               command: >-
                   test "$profile" = auto &&
-                  grep -qiE '^[[:space:]]*\**Verdict:\** *PASS' ".spur/run/$__runId-review-answer.txt"
+                  grep -qiE '^[[:space:]]*\**Verdict:\** *PASS' ".spur/run/$__runId-review-answer.txt" &&
+                  eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/residual-scan.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/residual-scan.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)" &&
+                  [ -f "$S" ] && "$RUNNER" "$S" review-gate "$wbs" --spur-bin "$spurBin" >&2
     - from: review
       to: approve
-      description: Review certified PASS — gate on human approval before verification.
+      description: Review certified PASS with no open P1-P3 review finding — gate on human approval before verification.
       guard:
           kind: shell
           options:
-              command: grep -qiE '^[[:space:]]*\**Verdict:\** *PASS' ".spur/run/$__runId-review-answer.txt"
+              command: >-
+                  grep -qiE '^[[:space:]]*\**Verdict:\** *PASS' ".spur/run/$__runId-review-answer.txt" &&
+                  eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/residual-scan.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/residual-scan.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)" &&
+                  [ -f "$S" ] && "$RUNNER" "$S" review-gate "$wbs" --spur-bin "$spurBin" >&2
     - from: review
       to: review-fail-triage
       description: >-
-          No PASS in the reviewer's answer (FAIL, PARTIAL, missing, or unparseable — fail closed) —
-          classify the failure and route it into the bounded repair hop instead of dead-ending the run.
+          No certified PASS without an open P1-P3 finding (FAIL, PARTIAL, missing, unparseable, or
+          a PASS whose review-gate check found an open P1-P3 row — fail closed) — classify the
+          failure and route it into the bounded repair hop instead of dead-ending the run.
       guard:
           kind: always