@gobing-ai/spur 0.4.1 → 0.4.3

package/plugins/sp/scripts/task-diffstat.mjs

@@ -11,12 +11,20 @@ function getEnvVars() {
   return process.env;
 }
 
-// plugins/sp/scripts/task-diffstat.ts
+// plugins/sp/lib/plan-projection.generated.mjs
+var NON_ABORTING_PREFLIGHT_CODES = new Set([
+  "L4.scenario-unverified",
+  "L4.verifying-incomplete-tasks"
+]);
+var OPERATOR_TOOLS = new Set(["AskUserQuestion", "ask_user_question"]);
+var SHELL_TOOLS = new Set(["bash", "shell", "exec", "exec_command", "run_command", "command"]);
+var SUBAGENT_TOOLS = new Set(["agent", "task", "invoke_subagent", "subagent", "dispatch_agent"]);
+var LOWERCASE_OPERATOR_TOOLS = new Set(["askuserquestion", "ask_user_question"]);
 var SENSITIVE_PREFIXES = ["drizzle/", "packages/config/", ".github/", "plugins/sp/hooks/"];
 var SENSITIVE_GLOBS = ["apps/server/src/**/auth*", "**/*secret*", "**/*.sql"];
 function globToRegex(glob) {
   const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replaceAll("**/", "\x00").replaceAll("**", "\x01").replaceAll("*", "[^/]*").replaceAll("\x00", "(?:.*/)?").replaceAll("\x01", ".*");
-  return new RegExp(`^${escaped}$`);
+  return new RegExp(`^${escaped}$`, "s");
 }
 var SENSITIVE_MATCHERS = [
   ...SENSITIVE_PREFIXES.map((prefix) => ({
@@ -32,6 +40,8 @@ function sensitiveReasonForPath(path) {
   const match = SENSITIVE_MATCHERS.find((entry) => entry.test(path));
   return match ? `matches sensitive pattern ${match.label}` : null;
 }
+
+// plugins/sp/scripts/task-diffstat.ts
 function defaultGitRunner(cwd) {
   return (args) => {
     const run = spawnSync("git", args, { cwd, encoding: "utf8" });
@@ -52,22 +62,12 @@ function countNewlines(path, cwd) {
       lines += 1;
   return lines;
 }
-function expandDiffPath(raw) {
-  const arrow = raw.indexOf(" => ");
-  if (arrow === -1)
-    return [raw];
-  const open = raw.indexOf("{");
-  const close = raw.lastIndexOf("}");
-  if (open !== -1 && close > open && open < arrow && arrow < close) {
-    const inner = raw.slice(open + 1, close);
-    const innerArrow = inner.indexOf(" => ");
-    if (innerArrow !== -1) {
-      const head = raw.slice(0, open);
-      const tail = raw.slice(close + 1);
-      return [head + inner.slice(0, innerArrow) + tail, head + inner.slice(innerArrow + 4) + tail];
-    }
-  }
-  return [raw.slice(0, arrow), raw.slice(arrow + 4)];
+function addCounts(add, del) {
+  for (const count of [add, del])
+    if (count !== "-" && !/^\d+$/.test(count))
+      return null;
+  const [a, d] = [add === "-" ? 0 : Number(add), del === "-" ? 0 : Number(del)];
+  return Number.isSafeInteger(a) && Number.isSafeInteger(d) ? [a, d] : null;
 }
 function runDiffstat(env, options = {}, git = defaultGitRunner(options.cwd)) {
   const cwd = options.cwd;
@@ -99,23 +99,37 @@ function runDiffstat(env, options = {}, git = defaultGitRunner(options.cwd)) {
   } catch {}
   if (!/^[0-9a-f]{7,40}$/i.test(base))
     return failSafe("run base .spur/run/<wbs>-base.sha missing or malformed");
-  const numstat = git(["diff", "--numstat", base]);
+  const numstat = git(["diff", "--numstat", "-z", base]);
   if (numstat.status !== 0)
     return failSafe(`git diff --numstat failed (status=${numstat.status})`);
+  if (numstat.stdout.length > 0 && !numstat.stdout.endsWith("\x00"))
+    return failSafe("git diff --numstat -z output is not NUL-terminated (malformed framing)");
   const paths = new Set;
   let insertions = 0;
   let deletions = 0;
-  for (const line of numstat.stdout.split(`
-`)) {
-    const row2 = /^(\d+|-)\t(\d+|-)\t(.+)$/.exec(line);
-    if (!row2)
+  const records = numstat.stdout.split("\x00").slice(0, -1);
+  for (let i = 0;i < records.length; i++) {
+    const header = records[i] ?? "";
+    const first = header.indexOf("\t");
+    const second = header.indexOf("\t", first + 1);
+    if (first < 1 || second < first + 2)
+      return failSafe("git diff --numstat -z record is missing counts or path");
+    const counts = addCounts(header.slice(0, first), header.slice(first + 1, second));
+    if (counts === null)
+      return failSafe("git diff --numstat -z record has a malformed count");
+    insertions += counts[0];
+    deletions += counts[1];
+    const path = header.slice(second + 1);
+    if (path !== "") {
+      paths.add(path);
       continue;
-    for (const p of expandDiffPath(row2[3] ?? ""))
-      paths.add(p);
-    if (row2[1] !== "-")
-      insertions += Number(row2[1]);
-    if (row2[2] !== "-")
-      deletions += Number(row2[2]);
+    }
+    const oldPath = records[++i];
+    const newPath = records[++i];
+    if (!oldPath || !newPath)
+      return failSafe("git diff --numstat -z rename record has incomplete paths");
+    paths.add(oldPath);
+    paths.add(newPath);
   }
   const others = git(["ls-files", "--others", "--exclude-standard", "-z"]);
   if (others.status !== 0)
@@ -161,7 +175,6 @@ export {
   sensitiveReasonForPath,
   runDiffstat,
   main,
-  expandDiffPath,
   TASK_DIFFSTAT_USAGE,
   SENSITIVE_PREFIXES,
   SENSITIVE_GLOBS

package/plugins/sp/scripts/task-diffstat.ts

@@ -7,11 +7,11 @@
  * `precheck`, F96 R1) and the current working tree, then writes:
  *   `.spur/run/<wbs>-diffstat.json`  `{ files, insertions, deletions, paths[], sensitive }`
  *
- * Counts come from `git diff --numstat <base>` (tracked changes; binary rows count the
- * path but no lines) plus untracked files (`git ls-files --others --exclude-standard`,
- * newline-counted — # ponytail: untracked line counts are a newline scan, numstat-grade
- * binary detection is unnecessary for a lane heuristic; switch to `--numstat --no-index`
- * if a miscount ever flips a lane).
+ * Counts come from `git diff --numstat -z <base>` (tracked changes; binary rows count the path
+ * but no lines; NUL records carry RAW paths, so a non-ASCII or newline-bearing path reaches the
+ * sensitive matchers intact) plus untracked files (`git ls-files --others --exclude-standard -z`,
+ * newline-counted — # ponytail: untracked line counts are a newline scan, numstat-grade binary
+ * detection is unnecessary here; switch to `--numstat --no-index` if a miscount flips a lane).
  *
  * `sensitive` is true when ANY changed path matches the exported SENSITIVE list (0943 R2c);
  * the workflow's pre-decide guard maps sensitive (or >400 changed lines) to the safety lane
@@ -65,45 +65,14 @@ export interface DiffstatResult extends Diffstat {
     exitCode: number;
 }
 
-/**
- * Sensitive paths (0943 R2c): any changed path under one of these forces the safety lane
- * before the `task-triage` decide runs — sensitive work is never lane-negotiated with a
- * model. Frozen list: `drizzle/`, `packages/config/`, auth-prefixed basenames anywhere
- * under the server src tree, `*secret*` basenames, `.github/`, `plugins/sp/hooks/`, and
- * any `*.sql` — spelled out in SENSITIVE_PREFIXES / SENSITIVE_GLOBS below (kept as data,
- * not prose, so the `*` / `/` sequences survive the doc comment).
- */
-export const SENSITIVE_PREFIXES = ['drizzle/', 'packages/config/', '.github/', 'plugins/sp/hooks/'] as const;
-export const SENSITIVE_GLOBS = ['apps/server/src/**/auth*', '**/*secret*', '**/*.sql'] as const;
-
-// Glob → RegExp: `**` + `/` matches any-or-no directories, bare `**` any characters, `*` within one segment.
-function globToRegex(glob: string): RegExp {
-    const escaped = glob
-        .replace(/[.+^${}()|[\]\\]/g, '\\$&')
-        .replaceAll('**/', '\u0000')
-        .replaceAll('**', '\u0001')
-        .replaceAll('*', '[^/]*')
-        .replaceAll('\u0000', '(?:.*/)?')
-        .replaceAll('\u0001', '.*');
-    return new RegExp(`^${escaped}$`);
-}
+// Task 1176: the sensitive-path policy (0943 R2c) moved to the workflow/task owner —
+// `packages/app/src/workflow/task-triage.ts`, reached through the generated pure bundle. That policy
+// still forces the safety lane for any changed path under the frozen sensitive list before the
+// `task-triage` decide runs, so sensitive work is never lane-negotiated with a model; this entry
+// keeps git capture and the output artifact, and re-exports the policy for existing callers.
+import { SENSITIVE_GLOBS, SENSITIVE_PREFIXES, sensitiveReasonForPath } from '../lib/plan-projection.generated.mjs';
 
-const SENSITIVE_MATCHERS: Array<{ label: string; test: (path: string) => boolean }> = [
-    ...SENSITIVE_PREFIXES.map((prefix) => ({
-        label: prefix,
-        test: (path: string): boolean => path.startsWith(prefix),
-    })),
-    ...SENSITIVE_GLOBS.map((glob) => {
-        const regex = globToRegex(glob);
-        return { label: glob, test: (path: string): boolean => regex.test(path) };
-    }),
-];
-
-/** Sensitive-pattern match for one path, or null — mirrors wrapup-drift-probe's driftReasonForPath. */
-export function sensitiveReasonForPath(path: string): string | null {
-    const match = SENSITIVE_MATCHERS.find((entry) => entry.test(path));
-    return match ? `matches sensitive pattern ${match.label}` : null;
-}
+export { SENSITIVE_GLOBS, SENSITIVE_PREFIXES, sensitiveReasonForPath };
 
 function defaultGitRunner(cwd?: string): GitRunner {
     return (args: string[]): GitRunResult => {
@@ -125,26 +94,10 @@ function countNewlines(path: string, cwd?: string): number {
     return lines;
 }
 
-/**
- * git renders renames in --numstat paths as `old => new` (full) or `head{old => new}tail`
- * (partial). The sensitive matchers anchor on single paths, so both rename halves must be
- * surfaced — otherwise a rename INTO a sensitive path (review 0943 P3#1) classified clean.
- */
-export function expandDiffPath(raw: string): string[] {
-    const arrow = raw.indexOf(' => ');
-    if (arrow === -1) return [raw];
-    const open = raw.indexOf('{');
-    const close = raw.lastIndexOf('}');
-    if (open !== -1 && close > open && open < arrow && arrow < close) {
-        const inner = raw.slice(open + 1, close);
-        const innerArrow = inner.indexOf(' => ');
-        if (innerArrow !== -1) {
-            const head = raw.slice(0, open);
-            const tail = raw.slice(close + 1);
-            return [head + inner.slice(0, innerArrow) + tail, head + inner.slice(innerArrow + 4) + tail];
-        }
-    }
-    return [raw.slice(0, arrow), raw.slice(arrow + 4)];
+function addCounts(add: string, del: string): [number, number] | null {
+    for (const count of [add, del]) if (count !== '-' && !/^\d+$/.test(count)) return null;
+    const [a, d] = [add === '-' ? 0 : Number(add), del === '-' ? 0 : Number(del)];
+    return Number.isSafeInteger(a) && Number.isSafeInteger(d) ? [a, d] : null;
 }
 
 /**
@@ -190,18 +143,34 @@ export function runDiffstat(
     }
     if (!/^[0-9a-f]{7,40}$/i.test(base)) return failSafe('run base .spur/run/<wbs>-base.sha missing or malformed');
 
-    const numstat = git(['diff', '--numstat', base]);
+    const numstat = git(['diff', '--numstat', '-z', base]);
     if (numstat.status !== 0) return failSafe(`git diff --numstat failed (status=${numstat.status})`);
+    if (numstat.stdout.length > 0 && !numstat.stdout.endsWith('\u0000'))
+        return failSafe('git diff --numstat -z output is not NUL-terminated (malformed framing)');
     const paths = new Set<string>();
     let insertions = 0;
     let deletions = 0;
-    for (const line of numstat.stdout.split('\n')) {
-        // Binary rows report `-` for both counts; the path still counts as changed.
-        const row = /^(\d+|-)\t(\d+|-)\t(.+)$/.exec(line);
-        if (!row) continue;
-        for (const p of expandDiffPath(row[3] ?? '')) paths.add(p);
-        if (row[1] !== '-') insertions += Number(row[1]);
-        if (row[2] !== '-') deletions += Number(row[2]);
+    const records = numstat.stdout.split('\u0000').slice(0, -1); // drop the terminating NUL tail
+    for (let i = 0; i < records.length; i++) {
+        const header = records[i] ?? '';
+        const first = header.indexOf('\t'); // first two tabs only
+        const second = header.indexOf('\t', first + 1); // a raw path may itself hold more tabs
+        if (first < 1 || second < first + 2) return failSafe('git diff --numstat -z record is missing counts or path');
+        const counts = addCounts(header.slice(0, first), header.slice(first + 1, second));
+        if (counts === null) return failSafe('git diff --numstat -z record has a malformed count');
+        insertions += counts[0];
+        deletions += counts[1]; // once per count header, never once per rename half
+        const path = header.slice(second + 1);
+        if (path !== '') {
+            paths.add(path);
+            continue;
+        }
+        // An empty path field is Git's rename/copy form: the next two records are old and new.
+        const oldPath = records[++i];
+        const newPath = records[++i];
+        if (!oldPath || !newPath) return failSafe('git diff --numstat -z rename record has incomplete paths');
+        paths.add(oldPath);
+        paths.add(newPath);
     }
     const others = git(['ls-files', '--others', '--exclude-standard', '-z']);
     if (others.status !== 0) return failSafe(`git ls-files failed (status=${others.status})`);

package/plugins/sp/skills/code-implementation/SKILL.md

@@ -82,6 +82,12 @@ not have and work you were not asked to do.
 - **Never implement a requirement belonging to another WBS**, even when it looks like a
   prerequisite. If the target genuinely cannot proceed without it, stop and say so — a blocked task
   is a cheap finding; a two-task diff costs the reverts.
+- **Flip the target's `## Plan` boxes as each step completes.** They are this pass's progress
+  ledger, and the record-time residual sweep treats an *unchecked* Plan box as blocking: it
+  downgrades the verdict to PARTIAL and closes the `done` gate
+  (`docs/design/task-residual-sweep.md`), which costs a remediation cycle and a manual re-record.
+  Leave every finished step ticked through `spur task update <wbs> --section Plan --from-file`, and
+  if you deliberately skipped one, say so in the Solution change map.
 
 Why this is a rule and not a nicety: driving task 0486 lost several hours to exactly this. Task 0485
 was committed but still `todo` in the tree, and two different executors (omp run `ca130182`, claude
@@ -165,7 +171,7 @@ that single full gate.
 1. The **changed-path matrix** below (narrow behavior tests + affected consumers);
 2. the resolved `quality-gate` script in `light` mode (source-repo probe, else the installed twin) (biome on changed files, per-workspace typecheck, rule presets `rules:pre`/`rules:post`, related tests).
 
-Neither step takes the host-wide full-gate lock. The full gate is named only for the pipeline's `test` and `test-recheck` hops.
+Neither step takes the full project gate. The full gate is named only for the pipeline's `test` and `test-recheck` hops.
 
 | Changed surface | Required targeted tests | Required typechecks |
 | --- | --- | --- |

package/plugins/sp/skills/code-verification/references/secu-review.md

@@ -92,7 +92,8 @@ Before declaring a task `done`, run this lightweight checklist. It catches the m
 - [ ] Solution section contains `file:line` citations for every changed file.
 - [ ] API/library claims in changed docs carry a source citation (URL or `path:line`) and an honest
       confidence level (HIGH/MEDIUM/LOW) per source-driven-development; the deterministic advisory backstop is
-      the `cited-version-strings` / `cited-api-claims` rules (`.spur/rules/docs/sourced-api-claims.yaml`).
+      the `cited-version-strings` / `cited-api-claims` / `cited-api-claims-confidence` rules
+      (`.spur/rules/docs/sourced-api-claims.yaml`, run ad hoc — not wired into a preset).
 - [ ] Review section has P1–P4 findings table (even if all rows are empty — the table itself proves review happened).
 
 This checklist runs as part of the verify step when the task reaches `testing` status. It does not replace the formal gates — it augments them with between-pipeline hygiene checks.

package/plugins/sp/skills/code-verification/references/verdict-schema.md

@@ -202,6 +202,10 @@ citation in the SAME cell, or lint rejects the row with `evidence-citation` (blo
 - The rule is cell-local: a citation in another row or a "receipt above" cross-reference does not
   satisfy it. Marker-free receipts (test counts, reviewed-log notes) need no citation. The check is
   presence-only — which citation proves which claim is not deterministically decidable.
+- The same two predicates (`hasClaimMarker` / `hasCitationForm` in
+  `packages/app/src/services/verify-answer-lint.ts`) gate the review report's findings table through
+  `residual-scan review-gate` as the blocking `review-contract` category — one definition of
+  "external claim" and one set of accepted citation forms for both paths.
 
 ## Hedged evidence is rejected on MET rows
 

package/plugins/sp/skills/dogfood-testing/SKILL.md

@@ -82,11 +82,11 @@ The command forwards these via `$ARGUMENTS`:
 >   <!-- pipeline-tokens:end -->
 >   matched as a **distinct hyphen-word**
 >   (machine-checked by
->   [`detectPipelineDriving`](../../scripts/dogfood-testing/detect-pipeline-driving.ts);
+>   [`detectPipelineDriving`](../../lib/dogfood-pipeline.ts);
 >   see [§Pipeline-driving word-boundary contract](#pipeline-driving-word-boundary-contract))
 >   → `⚠ pipeline-driving testee detected; pass --max-retry 0 (observe-only) or --max-retry N (fix mode, tree mutation acknowledged)`.
 > - **Mutating `--fix` modes** — `--fix all` / `--fix blockers-first`, boundary-guarded via
->   [`hasMutatingFixMode`](../../scripts/dogfood-testing/detect-pipeline-driving.ts) (never matches
+>   [`hasMutatingFixMode`](../../lib/dogfood-pipeline.ts) (never matches
 >   `--fix none` / `--focus all` / `--prefix all`). No pipeline token required: a verify/review leg
 >   with `--fix all` mutates the tree on its own (0280 dogfood P2, task 0293). Honesty note:
 >   `--max-retry 0` here bounds **the driver only** — the testee still mutates the tree — so the

package/plugins/sp/skills/indexed-context/SKILL.md

@@ -144,14 +144,21 @@ an explicit allowlist entry.
 env dumps. Token estimates for Bash/Grep/Glob use response size **after a 4 KiB cap** and secret
 scrub; omit `tokens` when unknown (never `0`).
 
+**Session lifecycle:** `.spur/context/.session.json` is a private pointer to the in-flight session.
+It records the creating host's owner identity (`{host, sessionId}` — Claude's hook `session_id`, Pi's
+session-manager id) and only that owner's `SessionEnd` / `session_shutdown` may write the rollup and
+remove the pointer. A nested run reuses the parent's ledger for tool recording but cannot finalize
+or delete it; an ownerless (legacy) pointer is never finalized and expires under the existing
+idle-start window instead.
+
 ```jsonl
-{"ts":"2026-07-09T14:23:01Z","session":"session-2026-07-09-1423","type":"session_start"}
-{"ts":"2026-07-09T14:23:15Z","session":"session-2026-07-09-1423","type":"read","file":"src/dao.ts","tokens":648}
-{"ts":"2026-07-09T14:24:00Z","session":"session-2026-07-09-1423","type":"write","file":"src/dao.ts","tokens":222,"action":"edit"}
-{"ts":"2026-07-12T15:00:00Z","session":"session-2026-07-12-1500","type":"bash","summary":"ls -la","tokens":12}
-{"ts":"2026-07-12T15:00:01Z","session":"session-2026-07-12-1500","type":"grep","summary":"/TODO/ src"}
-{"ts":"2026-07-12T15:00:02Z","session":"session-2026-07-12-1500","type":"glob","summary":"**/*.test.ts"}
-{"ts":"2026-07-09T14:30:00Z","session":"session-2026-07-09-1423","type":"session_end","totals":{"reads":5,"writes":19,"tokens":2783}}
+{"ts":"2026-07-09T14:23:01Z","session":"session-2026-07-09-142318-a1b2c3d4","type":"session_start"}
+{"ts":"2026-07-09T14:23:15Z","session":"session-2026-07-09-142318-a1b2c3d4","type":"read","file":"src/dao.ts","tokens":648}
+{"ts":"2026-07-09T14:24:00Z","session":"session-2026-07-09-142318-a1b2c3d4","type":"write","file":"src/dao.ts","tokens":222,"action":"edit"}
+{"ts":"2026-07-12T15:00:00Z","session":"session-2026-07-12-150007-e5f6a7b8","type":"bash","summary":"ls -la","tokens":12}
+{"ts":"2026-07-12T15:00:01Z","session":"session-2026-07-12-150007-e5f6a7b8","type":"grep","summary":"/TODO/ src"}
+{"ts":"2026-07-12T15:00:02Z","session":"session-2026-07-12-150007-e5f6a7b8","type":"glob","summary":"**/*.test.ts"}
+{"ts":"2026-07-09T14:30:00Z","session":"session-2026-07-09-142318-a1b2c3d4","type":"session_end","totals":{"reads":5,"writes":19,"tokens":2783}}
 ```
 
 **Never edit `token-ledger.jsonl` by hand.** It feeds the Board **Observability → Tool Using** tab.

package/plugins/sp/skills/next-feature/SKILL.md

@@ -64,7 +64,7 @@ Run the steps in order. Each step's depth lives in its reference; this file is t
    change a frontier feature's status, the report **leads with the drift summary** ("sync first")
    and the ranking is computed over the *post-sync* status view. Details:
    [references/signal-derivation.md](references/signal-derivation.md) §0.
-1. **Assemble the candidate set.** `spur feature list --json`; drop `done`/`cancelled`, drop
+1. **Assemble the candidate set.** `spur feature list --json`; drop `done`/`cancelled`/`deprecated`, drop
    structural containers (has children, no own open tasks — defect D1), drop the map/feature that
    owns this investigation if present. The `group` tag is **not** a reliable container marker (D3).
 2. **Gate on actionability.** Read the frontier predicate **at runtime** from

package/plugins/sp/skills/parallel-execution/SKILL.md

@@ -104,7 +104,7 @@ was meant to avoid. Let the reviewer reach its own conclusion.
 
 - **`sp:spur-dev`** owns task selection and lifecycle. When a batch contains independent tasks, the spine consults this skill for the fan-out pattern.
 - **`sp:super-planner`** is the orchestrator that executes the fan-out. Its parallel mode (documented in its agent definition) applies the patterns from this skill.
-- **`/sp:dev-parallel`** is the thin slash-command entry point that delegates to this skill.
+- **`/sp:dev-runall --mode parallel|auto`** is the task-batch entry point; its `batch-plan.mjs order` schedule applies this skill's dependency and file-overlap rows deterministically.
 
 ## When to use
 
@@ -135,7 +135,7 @@ Do **not** use this skill for:
 
 - **`sp:spur-dev`** — the orchestration spine that consults this skill for fan-out decisions.
 - **`sp:super-planner`** — the batch orchestrator that executes fan-out patterns.
-- **`/sp:dev-parallel`** — the slash command entry point for parallel execution.
+- **`/sp:dev-runall --mode parallel|auto`** — the slash command entry point for parallel task batches.
 
 ## Platform Notes
 

package/plugins/sp/skills/parallel-execution/references/dispatch-surface.md

@@ -70,7 +70,7 @@ own axis.
 Surface choice and model choice stay separate axes, but the invocation surface is where the
 cheap-model hint is applied. On hosts whose native subagent invocation accepts a per-call model
 override (Claude Code: the Agent tool's `model` parameter), dispatch read-only fan-out workers —
-`dev-parallel --mode investigation` and competency-lens review's read-only lenses — with the host's
+N-way investigation and competency-lens review's read-only lenses — with the host's
 cheapest capable model. The rule is owned by
 [fan-out-patterns.md § Cheap-model hint for read-only fan-out](fan-out-patterns.md#cheap-model-hint-for-read-only-fan-out)
 and carries two prohibitions and one exemption: invocation-side only, **never** a subagent
@@ -167,7 +167,7 @@ rule at the source, so no per-path shim is needed:
 | `spur agent loop` | `AgentService.run` per drained iteration | Same resolution path as `spur agent run`; inherits its own `SPUR_ROLE` |
 | `spur serve` team supervisor → member | spawns `spur agent loop` | Member inherits the supervisor's `SPUR_ROLE` (recursive by construction) |
 | Native subagent fan-out (this skill's default) | in-session `Task()`/`Skill()` | In-session subagents share the host session; when they themselves dispatch, the host's role is already in the session env — the rule holds at the next `spur agent run` boundary |
-| `plugins/sp/evals/run-eval.ts` | `spawnSync('spur agent run', …)` per scenario | Out of scope: a top-level eval harness, not a fan-out — no dispatcher role exists to inherit; each scenario is an independent top-level run (documented, no shim) |
+| `scripts/commands/skill-eval.ts` | `spawnSync('spur agent run', …)` per scenario | Out of scope: a top-level eval harness, not a fan-out — no dispatcher role exists to inherit; each scenario is an independent top-level run (documented, no shim) |
 
 The inventory is recorded in `docs/04_DESIGN.md` § `spur agent run` envelope (`roleOrigin`).
 Paths that shell out to `spur agent run` without the rule would silently drop or double-attribute

package/plugins/sp/skills/parallel-execution/references/fan-out-patterns.md

@@ -134,13 +134,13 @@ blocker** — never a permission-probing subsystem:
    [Keep a durable progress ledger](../SKILL.md#keep-a-durable-progress-ledger)).
 
 Read-only investigation fan-out avoids the write-permission class by construction:
-`dev-parallel --mode investigation` and competency-lens review's read-only lenses dispatch
+N-way investigation and competency-lens review's read-only lenses dispatch
 **read-only worker shapes** — search/read tools only, with no write surface declared.
 
 ## Cheap-model hint for read-only fan-out
 
 On hosts whose native subagent invocation accepts a per-call model override (Claude Code: the Agent
-tool's `model` parameter), dispatch read-only fan-out workers — `dev-parallel --mode investigation`
+tool's `model` parameter), dispatch read-only fan-out workers — N-way investigation
 and competency-lens review's read-only lenses — with the host's cheapest capable model. The rule is
 invocation-side, with two prohibitions and one exemption:
 

package/plugins/sp/skills/pr-reviewing/SKILL.md

@@ -112,9 +112,13 @@ unrelated uncommitted changes make safe editing or committing ambiguous.
 **Current-HEAD invariant.** Treat the PR's pushed `headRefOid` as the review identity. After every
 preflight, push, commit, and request, record the returned HEAD and require `wait`, `collect`, and
 the report to match that exact HEAD. A result for an older commit is stale; a result absent for the
-current HEAD is pending, not clean. Reject uncorrelated issue/conversation comments rather than
-using them to manufacture a current-HEAD result. In `fix` mode, discard the old result after the
-fix commit and judge only the forced re-review for the new pushed HEAD.
+current HEAD is pending, not clean. `wait` re-asserts this at two points, not one: at the start of
+every poll, and again immediately before it emits FOUND/CLEAN/TIMEOUT — a head that moved while the
+review was being fetched, or between polls, fails the wait (exit 2) instead of accepting an old-head
+result. The pinned identity is the PR number AND the expected head, so a different PR appearing on
+the branch is also a failure, never a silent retarget. Reject uncorrelated issue/conversation
+comments rather than using them to manufacture a current-HEAD result. In `fix` mode, discard the old
+result after the fix commit and judge only the forced re-review for the new pushed HEAD.
 
 **Reviewer authority.** Codex is an independent reviewer, not an authority. For every finding that
 may lead to a code change: inspect the referenced code, verify reachability and intended behavior,

package/plugins/sp/skills/session-review/SKILL.md

@@ -101,9 +101,11 @@ issues with its evidence. Notes stay report-only.
    refresh it with `superskill install sp` before reporting numbers; report `n/a` until then.
    The transcript resolves from `--transcript`, else `CLAUDE_CODE_SESSION_ID`, else `PI_SESSION_FILE`
    (the pi host sets it and no Claude session id); with none of them the measurement reports
-   `available:false` with a reason and the table renders `n/a` instead of guessing. A
-   skill-injected body (`<skill name="…">`) is counted as activity in `injectedPrompts`, never as a
-   segment — only the operator's own prompts segment the session.
+   `available:false` with a reason and the table renders `n/a` instead of guessing. A pi
+   `<skill name="…">` wrapper row is the OPERATOR'S own `/skill` invocation, not an injected body:
+   it opens a segment rendered `/<name> <args>` (or `/<name>` when no arguments follow the closing
+   tag), and the wrapper body never appears in the prompt excerpt. Only the operator's prompts
+   segment the session.
 2. **Inventory outcomes.** List requested outcomes and classify each as completed, partial, blocked,
    or not attempted. Collapse repeated attempts into one outcome.
 3. **Classify issues.** For every material issue, distinguish resolved, open, or attempted. Record

package/plugins/sp/skills/source-driven-development/SKILL.md

@@ -101,10 +101,13 @@ line: `Verification: HIGH|MEDIUM|LOW — <first failing check and deviation, or
 - **Honest confidence** — the stated HIGH/MEDIUM/LOW matches the evidence: HIGH requires a check against the pinned source this session; MEDIUM/LOW items are labeled, and LOW is never presented as fact.
 - **HIGH** — all three checks pass. **MEDIUM** — coverage intact but some citations are off-version (latest docs for a pinned dependency) or secondary-source only. **LOW** — an API/library claim lacks any citation, or a LOW-confidence claim was asserted as fact.
 
-Deterministic backstop: the `cited-version-strings` / `cited-api-claims` rules
-(`.spur/rules/docs/sourced-api-claims.yaml`, run in `recommended-pre-check`) flag markdown lines that
-assert version strings or time-anchored API claims with no citation anchor on the same line. They
-are an info-severity advisory backstop for this contract (they do not gate; the checks above and the SECUA checklist are the enforcement points).
+Deterministic backstop: the `cited-version-strings`, `cited-api-claims` and
+`cited-api-claims-confidence` rules (`.spur/rules/docs/sourced-api-claims.yaml`) flag markdown lines
+that assert a version string or a time-anchored API claim with no citation anchor on the same line,
+and claim lines that carry no HIGH/MEDIUM/LOW level. They are an info-severity advisory backstop for
+this contract and are deliberately NOT wired into `recommended-pre-check` — run them ad hoc with
+`spur rule run --file .spur/rules/docs/sourced-api-claims.yaml`. The checks above and the SECUA
+checklist remain the enforcement points.
 
 ## Common Rationalizations
 

package/plugins/sp/skills/spur-cli/references/builder.md

@@ -8,8 +8,9 @@ see_also:
 # spur builder - release plumbing
 
 `spur builder` is the CLI for **version bumps and release tags**. It wraps the internal
-`spur-dev release` flow behind a public two-verb surface, promoted verbatim from
-`scripts/commands/release.ts` (now a thin forwarder to the same implementation). Package ids are
+`release-ops` implementation behind a public two-verb surface. The repo-local forwarder
+(`scripts/commands/release.ts`) and its `spur-dev` dispatcher cases were retired in task 1173; the
+root `bun run bump-ver` / `bun run drop-tags` names route to `spur builder` directly. Package ids are
 the unscoped short names (`@gobing-ai/spur` → `spur`); the released set and the aggregate tag are
 discovered from the repo's own workspace manifests, so the same code serves any git+semver
 monorepo.

package/plugins/sp/skills/spur-cli/references/decision.md

@@ -1,6 +1,6 @@
 ---
 name: spur-cli-decision
-description: "spur-cli noun reference: operate `spur decision` as the read/serve surface over the decision catalog - list registered decisions, show one served contract (parameters, criteria vocabulary, effective maker), run a decision to a served outcome (never writes a workflow resultFile), and status the catalog layers. Backed by @gobing-ai/ts-ai-decision 0.5.16 hub; offline by default via the built-in `typesafe` maker. Introduced by task 1093."
+description: "spur-cli noun reference: operate `spur decision` as the read/serve surface over the decision catalog - list registered decisions, show one served contract (parameters, criteria vocabulary, effective maker), run a decision to a served outcome (never writes a workflow resultFile), and status the catalog layers with per-maker readiness marks (registered, configured, recorded, probed). Backed by @gobing-ai/ts-ai-decision 0.5.22 hub; offline by default via the built-in `typesafe` maker. Introduced by task 1093; readiness marks and `--probe` by feature P11."
 see_also:
   - spur-cli
 ---
@@ -25,9 +25,10 @@ Decisions resolve first-wins across three layers:
 | `registered` | folders listed in config `decisions.paths` | Operator-added catalogs |
 | `shared` | `decisions/` under the bundled config root | Shipped catalogs (`config/decisions/` in-repo) |
 
-The bundled shared catalog ships `task-triage`, `failure-class`, and `review-failure-class` (all
-`choice` type, param `wbs`). Duplicate ids across layers keep the higher layer; duplicates inside
-one file are a load error.
+The bundled shared catalog ships `task-triage`, `failure-class`, `review-failure-class`,
+`gate-evidence`, `idea-recommendation`, `needs-design`, `anatomy-validation-verdict` and
+`maker-liveness` (the last served only by `spur decision status --probe`; no workflow references
+it). Duplicate ids across layers keep the higher layer; duplicates inside one file are a load error.
 
 **Config keys** (under `decisions:` in the global `~/.config/spur/config.yaml` or project `.spur/config.yaml`):
 `paths` (extra catalog folders forming the `registered` layer), `maker` (default DecisionMaker
@@ -41,7 +42,7 @@ config error, never a silent fallback (design §3.6).
 | `list` | Every visible decision: id, type, layer, catalog file, description | `--layer <layer>`, `--json` |
 | `show <id>` | One served contract: type, parameters, criteria, fallback, minConfidence, effective maker + source | `--json` |
 | `run <id>` | Serve one outcome (closed vocabulary; **never writes a resultFile**) | `--param <pairs...>`, `--evidence <files...>`, `--maker <name>`, `--json` |
-| `status` | Layer counts, registered makers, per-decision maker resolution, load errors | `--json` |
+| `status` | Sectioned readiness report: one status line, errors, aligned `Makers` and `Decisions` tables (registration, configuration source, recorded evidence), `Catalog` block | `--probe`, `--reliability [--since <iso>]`, `--json` |
 
 All verbs support `--json` (bare payload) and `--json-envelope` (`{ok, data|error}` envelope,
 ADR-091). Failure output for `--json` commands uses the canonical error envelope only under
@@ -51,6 +52,25 @@ ADR-091). Failure output for `--json` commands uses the canonical error envelope
 (design §3.4 — load errors surface via `status`) except for an invalid `--layer` value (exit 1).
 Error envelopes use `NOT_FOUND` for an unknown id and `VALIDATION_FAILED` for every other caller mistake.
 
+## Readiness marks (`status`, feature P11)
+
+The default `status` output separates four marks per maker and per decision
+(`docs/design/decision-observability-and-adoption.md` §3.4.1):
+
+| Mark | Column | Source |
+| ---- | ------ | ------ |
+| registered | `ST` glyph on the maker row | the maker registry holds the name |
+| configured | `CONFIGURED BY` | `decisions.maker` / `decisions.makers.<id>` |
+| recorded | `RECORDED` / `ACCEPTED` / `LAST SEEN` | the recorded `decision.end` ledger, matched on `(decisionId, maker)` |
+| proven | `PROBE` (only with `--probe`) | one live liveness decision per maker |
+
+`RECORDED` with `ACCEPTED 0` is the state that reads as healthy everywhere else: the maker is
+registered and configured but has never once succeeded. `--probe` is the only path that calls a
+maker, is bounded per driver, writes no decision log row and emits no event (`--probe` with
+`--reliability` is refused). Parse the marks with `--json`: `makers[]`
+(`registered`, `configuredBy`, `serves`, `evidence`), `perDecision[].evidence`, and `probes[]`
+under `--probe`.
+
 **Exit contract for `run` (design §3.4):** any backend-observed outcome — low confidence, model
 error surfaced as fallback, declined — is still a **successful serve** (exit 0, envelope carries
 `source`/`confidence` so callers can see why). Exit 1 is reserved for caller mistakes caught
@@ -79,6 +99,13 @@ exist there). The final `catalog-default` maker is the hub built-in `typesafe`
 without a configured backend still produce deterministic closed-vocabulary outcomes, which is why
 `run` is usable in tests and scripts with no model access.
 
+**Available makers:** the three upstream built-ins (`typesafe`, `fm-local`, `laya-local`) plus
+Spur's hosted `clef` (Cloudflare Workers AI via `@gobing-ai/ts-decision-clef`). `clef` registers
+only when both `CLOUDFLARE_ACCOUNT_ID` and `CLOUDFLARE_AUTH_TOKEN` are set in the environment;
+without them it is absent from `registeredMakers`, so naming it in config or `--maker` is a config
+error, never a silent fallback. Its model defaults to `clef-flash` (a catalog `model` selects
+`clef`).
+
 ## Examples
 
 ```bash
@@ -88,11 +115,16 @@ spur decision run task-triage --param wbs=1093 --json
 spur decision run failure-class --param wbs=1093 \
     --evidence .spur/run/<runId>-test-output.txt    # redacted evidence -> instructions
 spur decision status --json | jq '.loadErrors'      # audit catalog health
+spur decision status                                 # readiness marks: registered / configured / recorded
+spur decision status --probe                          # prove each effective maker answers now
+spur decision status --json | jq '.makers[] | {name, registered, recorded: .evidence.recorded}'
 ```
 
 ## References
 
-- Design: `docs/design/decision-catalog.md` (§2 catalog authoring, §3.4 CLI surface)
-- Hub: `@gobing-ai/ts-ai-decision` 0.5.16 (`DecisionService`, catalog schema, maker registry)
-- App service: `packages/app/src/decision/decision-service.ts`
+- Design: `docs/design/decision-catalog.md` (§2 catalog authoring, §3.4 CLI surface),
+  `docs/design/decision-observability-and-adoption.md` (§3.4 reliability report, §3.4.1 readiness view)
+- Hub: `@gobing-ai/ts-ai-decision` 0.5.22 (`DecisionService`, catalog schema, maker registry)
+- App service: `packages/app/src/decision/decision-service.ts` (makers, `probeMaker`),
+  `packages/app/src/decision/decision-status-readiness.ts` (readiness marks, probe loop)
 - Shipped catalogs: `config/decisions/*.yaml`