@gobing-ai/spur 0.4.10 → 0.4.11

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.4.10",
+            "version": "0.4.11",
             "source": "./plugins/sp"
         }
     ]

package/config/workflows/pr-review.yaml

@@ -3,13 +3,14 @@
 # (initialState / states[].id / onEnter / top-level transitions), same family as
 # basic.yaml / task-pipeline.yaml. Seeded into projects by `spur init` (scaffold manifest).
 #
-# Shape: preflight → hygiene → precheck → push → ensure-pr → request → wait → collect → done
+# Shape: check → precheck → open → review → done
 #        (soft probes everywhere: red gates route to `failed`/`pending` via transitions,
 #         never a raw lifecycle abort — same reliability contract as basic.yaml)
 #
-# This YAML is the SSOT for the review spine's state order and guards. Every state shells
-# out to `spur builder pr` (the tested deterministic core); no gh/git
-# logic lives in this file. All model-bearing work — finding triage, `fix` mode, `rules`
+# This YAML is the SSOT for the review spine's state order and guards. Every state shells out to
+# the four flat `spur builder pr-<verb>` verbs (task 1219); the op sequencing
+# (preflight→hygiene, push→ensure, request→wait→collect) lives in `runPrVerb`, not in this file's
+# shell, and no gh/git logic lives in this file. All model-bearing work — finding triage, `fix`
 # mode — stays in the sp:pr-reviewing skill and never enters this machine.
 #
 # Non-negotiable: the external review goes through the GitHub PR + an `@codex review`
@@ -21,7 +22,7 @@
 #                        submit: request and stop at `pending` (no wait)
 #                        rerun:  request with --force even when HEAD is already reviewed
 #   baseBranch       — base for a newly created PR (default: existing PR base, else repo default)
-#   focus            — extra review focus appended to the @codex request
+#   focus            — extra review focus appended to the @codex review request
 #   noWait           — "true" returns pending right after the request instead of polling
 #   waitTimeoutSec   — poll budget for Codex output (default 600)
 #   waitIntervalSec  — poll interval (default 30; do not poll aggressively)
@@ -34,9 +35,9 @@
 version: "1"
 name: pr-review
 kind: state-machine
-description: GitHub Codex PR-review spine — preflight → hygiene → precheck → push → ensure-pr → request → wait → collect
+description: GitHub Codex PR-review spine — check → precheck → open → review
 iterationBound: 16
-initialState: preflight
+initialState: check
 terminalStates:
   - done
   - pending
@@ -53,50 +54,27 @@ vars:
   spurBin: "spur"
   preReviewCmd: ""
   __runId: ""
-  # Runtime-set by file.read.into-var (0771): the request record's requestedAt|head,
-  # extracted once by `request` and read per state — no repeated JSON parsing in shell.
-  prSince: ""
-  prHead: ""
 
 states:
-  - id: preflight
+  - id: check
     description: >
-      Soft probe: git/gh/repo checks (detached HEAD, dirty tree, gh auth, GitHub remote,
-      base-branch refusal — preflight refuses when the current branch IS the resolved base,
-      before any push can publish it).
-      Writes PASS|FAIL to .spur/run/${vars.__runId}-pr-preflight.status; always exit 0.
+      Soft probe: preflight (git/gh/repo checks, detached HEAD, dirty tree, base-branch refusal —
+      refused before any push can publish it) followed by the hygiene scan of base...HEAD
+      (secrets/.env/conflict markers BLOCK; debug residue WARNs). A preflight failure stops before
+      hygiene. Writes PASS|WARN|BLOCK|FAIL to .spur/run/${vars.__runId}-pr-check.status; always
+      exit 0, so a red gate routes through the transitions below.
     onEnter:
-      # script-root retired for this workflow: actions call `$spurBin builder pr` directly (PR-7).
+      # script-root retired for this workflow: actions call `$spurBin builder pr-<verb>` directly.
       - kind: shell
         options:
-          # (e) 0825: 10 lines — detached-HEAD/dirty/gh-auth/base-refusal probes must record
-          # before any push can publish; split would let a half-probed run continue.
+          # (e) 0825: 7 lines — preflight+hygiene and their status fallback must land together
+          # (one verb now owns the whole probe; a split would half-probe the submission gate).
           command: >-
-            
-            STATUS_FILE=".spur/run/$__runId-pr-preflight.status" &&
-            set +e &&
-            $spurBin builder pr preflight --base "$baseBranch" --json > ".spur/run/$__runId-pr-context.json";
-            rc=$?; set -e &&
-            if [ "$rc" -eq 0 ]; then printf 'PASS\n' > "$STATUS_FILE"; else printf 'FAIL\n' > "$STATUS_FILE"; fi &&
-            exit 0
-
-  - id: hygiene
-    description: >
-      Submission sanity scan of base...HEAD: secrets/.env/conflict markers BLOCK the run;
-      debug residue only WARNs. Not a replacement for the independent Codex review.
-    onEnter:
-      - kind: shell
-        options:
-          # (e) 0825: 9 lines — hygiene verdict + json capture land together; the status-file
-          # fallback keeps a silent driver from passing the gate.
-          command: >-
-            
-            STATUS_FILE=".spur/run/$__runId-pr-hygiene.status" &&
-            set +e &&
-            $spurBin builder pr hygiene --base "$baseBranch" --json
-            --status-file "$STATUS_FILE" > ".spur/run/$__runId-pr-hygiene.json";
-            rc=$?; set -e &&
-            if [ ! -f "$STATUS_FILE" ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi &&
+            STATUS_FILE=".spur/run/$__runId-pr-check.status";
+            mkdir -p .spur/run;
+            $spurBin builder pr-check --base "$baseBranch" --json --status-file "$STATUS_FILE"
+            > ".spur/run/$__runId-pr-check.json";
+            if [ ! -f "$STATUS_FILE" ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi;
             exit 0
 
   - id: precheck
@@ -111,141 +89,78 @@ states:
           command: >-
             mkdir -p .spur/run; if [ -z "$preReviewCmd" ]; then R=SKIP; elif sh -c "$preReviewCmd"; then R=PASS; else R=FAIL; fi; printf '%s\n' "$R" > ".spur/run/$__runId-pr-precheck.status"
 
-  - id: push
+  - id: open
     description: >
-      Publish the branch (normal push only, never force; sets upstream when missing).
-      A PR reviews pushed commits only.
+      Publish the branch (normal push only, never force; sets upstream when missing) and reuse or
+      create its PR — a rejected push stops before any PR work. Writes FOUND|CREATED|FAIL to
+      .spur/run/${vars.__runId}-pr-open.status and the composed record (push + pr) to
+      .spur/run/${vars.__runId}-pr-open.json.
     onEnter:
       - kind: shell
         options:
-          # (e) 0825: 9 lines — push result and status fallback are atomic; a split could
-          # publish commits without recording the outcome.
+          # (e) 0825: 7 lines — publish + PR dedupe are one verb now; the status fallback keeps a
+          # silent driver from passing the gate.
           command: >-
-            mkdir -p .spur/run &&
-            STATUS_FILE=".spur/run/$__runId-pr-push.status" &&
-            set +e &&
-            $spurBin builder pr push --json --status-file "$STATUS_FILE"
-            > ".spur/run/$__runId-pr-push.json";
-            rc=$?; set -e &&
-            if [ ! -f "$STATUS_FILE" ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi &&
+            STATUS_FILE=".spur/run/$__runId-pr-open.status";
+            mkdir -p .spur/run;
+            $spurBin builder pr-open --base "$baseBranch" --json --status-file "$STATUS_FILE"
+            > ".spur/run/$__runId-pr-open.json";
+            if [ ! -f "$STATUS_FILE" ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi;
             exit 0
 
-  - id: ensure-pr
-    description: Find or create the GitHub PR for the current branch — never a duplicate.
-    onEnter:
-      - kind: shell
-        options:
-          # (e) 0825: 9 lines — PR dedupe lookup captures its record for the downstream
-          # review link; ensure + capture must not race.
-          command: >-
-            mkdir -p .spur/run &&
-            STATUS_FILE=".spur/run/$__runId-pr-ensure.status" &&
-            set +e &&
-            $spurBin builder pr ensure-pr --base "$baseBranch" --json
-            --status-file "$STATUS_FILE" > ".spur/run/$__runId-pr.json";
-            rc=$?; set -e &&
-            if [ ! -f "$STATUS_FILE" ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi &&
-            exit 0
-
-  - id: request
-    description: >
-      Post the `@codex review` request (per-HEAD dedupe unless mode=rerun forces).
-      Records the request under .spur/run/${vars.__runId}-pr-request.json.
-    onEnter:
-      - kind: shell
-        options:
-          # (e) 0825: 10 lines — the write-then-read split is the file-var transport feeding
-          # wait/collect and must stay one action (same record, same run scope).
-          command: >-
-            F="$([ "$mode" = rerun ] && echo --force)"; $spurBin builder pr request --focus "$focus" $F --json --status-file ".spur/run/$__runId-pr-request.status" > ".spur/run/$__runId-pr-request.json"; [ -f ".spur/run/$__runId-pr-request.status" ] || echo FAIL > ".spur/run/$__runId-pr-request.status"; jq -e . ".spur/run/$__runId-pr-request.json" >/dev/null 2>&1 && jq -r '.requestedAt // ""' ".spur/run/$__runId-pr-request.json" > ".spur/run/$__runId-pr-since.txt" && jq -r '.head // ""' ".spur/run/$__runId-pr-request.json" > ".spur/run/$__runId-pr-head.txt"; exit 0
-
-  - id: wait
+  - id: review
     description: >
-      Bounded poll for Codex output on the current pushed HEAD. Timeout records TIMEOUT
-      and routes to `pending` — never a failure (collect later with /sp:dev-pr-review collect).
-      Reads the request record once at `request` (0771): requestedAt/head land in
-      run-scoped .txt files, projected into prSince/prHead vars via file.read.into-var.
+      Request, wait for and collect the `@codex review` result on the current pushed HEAD
+      (per-HEAD dedupe unless mode=rerun; mode=submit or noWait=true stop at PENDING). Writes
+      CLEAN|FINDINGS|PENDING|FAIL to .spur/run/${vars.__runId}-pr-review.status — a wait timeout
+      is PENDING, never a failure — plus the composed findings record and the composite status.
     onEnter:
-      - kind: file.read.into-var
-        options:
-          path: .spur/run/${vars.__runId}-pr-since.txt
-          var: prSince
-      - kind: file.read.into-var
-        options:
-          path: .spur/run/${vars.__runId}-pr-head.txt
-          var: prHead
       - kind: shell
         options:
-          # (e) 0825: 9 lines — bounded wait loop keeps rc bookkeeping so a crashed driver
-          # fails closed instead of polling forever.
+          # (e) 0825: 10 lines — request/wait/collect are one verb now, so their result lands
+          # atomically; the status fallback covers a crashed driver. `mode=submit` or `noWait=true`
+          # pass --no-wait and `mode=rerun` passes --force, each as its own space-separated word
+          # (two substitutions, never concatenated). `/bin/sh -c` carries no `-e`, so a failed
+          # substitution is ignored.
           command: >-
-            mkdir -p .spur/run &&
-            STATUS_FILE=".spur/run/$__runId-pr-wait.status" &&
-            set +e &&
-            $spurBin builder pr wait --since "$prSince" --head "$prHead" --timeout "$waitTimeoutSec" --interval "$waitIntervalSec"
-            --json --status-file "$STATUS_FILE" > ".spur/run/$__runId-pr-wait.json";
-            rc=$?; set -e &&
-            if [ ! -f "$STATUS_FILE" ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi &&
+            O="$([ "$mode" = submit ] || [ "$noWait" = "true" ] && echo --no-wait) $([ "$mode" = rerun ] && echo --force)";
+            STATUS_FILE=".spur/run/$__runId-pr-review.status";
+            mkdir -p .spur/run;
+            $spurBin builder pr-review --focus "$focus" $O --timeout "$waitTimeoutSec" --interval "$waitIntervalSec"
+            --json --status-file "$STATUS_FILE" > ".spur/run/$__runId-pr-findings.json";
+            if [ ! -f "$STATUS_FILE" ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi;
             exit 0
-
-  - id: collect
-    description: >-
-      Normalize the latest current-HEAD Codex result and record composite PR/CI status.
-      Request record read via file.read.into-var vars (0771, see wait).
-    onEnter:
-      - kind: file.read.into-var
-        options:
-          path: .spur/run/${vars.__runId}-pr-since.txt
-          var: prSince
-      - kind: file.read.into-var
-        options:
-          path: .spur/run/${vars.__runId}-pr-head.txt
-          var: prHead
       - kind: shell
         options:
-          # (e) 0825: 9 lines — collect + status must run against the same since/head pair
-          # before the composite status is decided (same 0771 record contract).
+          # The report reads the same composite PR/CI/Codex artifact as before (read-only, so a
+          # failed probe records its own error object instead of failing the collected run).
           command: >-
-            mkdir -p .spur/run; $spurBin builder pr collect --since "$prSince" --head "$prHead" --json --status-file ".spur/run/$__runId-pr-collect.status" > ".spur/run/$__runId-pr-findings.json"; c=$?; $spurBin builder pr status --since "$prSince" --head "$prHead" --json > ".spur/run/$__runId-pr-status.json" && [ "$c" -eq 0 ] && [ -f ".spur/run/$__runId-pr-collect.status" ] || printf 'FAIL\n' > ".spur/run/$__runId-pr-collect.status"; cat ".spur/run/$__runId-pr-findings.json" 2>/dev/null; exit 0
+            $spurBin builder pr-status --json > ".spur/run/$__runId-pr-status.json" || true
 
   - id: done
     description: Terminal — review collected; findings artifact at .spur/run/${vars.__runId}-pr-findings.json
   - id: pending
-    description: Terminal — review requested (or timed out) but not yet collected; run /sp:dev-pr-review collect later
+    description: Terminal — review requested (or timed out) but not yet collected; run /sp:dev-pr-review status later
   - id: failed
     description: Terminal — a gate went red; the stage .status/.json artifacts under .spur/run name the blocker
 
 transitions:
-  - from: preflight
-    to: hygiene
-    description: Repo, gh auth, and clean tree verified
-    guard:
-      kind: shell
-      options:
-        command: 'test "$(cat .spur/run/$__runId-pr-preflight.status 2>/dev/null)" = PASS'
-  - from: preflight
-    to: failed
-    terminalReason: failed-check
-    description: Preflight red (detached HEAD, dirty tree, gh auth, no GitHub remote, or the current branch being the base branch) — stop before any publishing
-    guard:
-      kind: always
-
-  - from: hygiene
+  - from: check
     to: precheck
     description: Clean or warn-only — warnings ride along to the report
     guard:
       kind: shell
       options:
-        command: 'grep -qE "^(PASS|WARN)$" .spur/run/$__runId-pr-hygiene.status 2>/dev/null'
-  - from: hygiene
+        command: 'grep -qE "^(PASS|WARN)$" .spur/run/$__runId-pr-check.status 2>/dev/null'
+  - from: check
     to: failed
     terminalReason: failed-check
-    description: BLOCK (secrets/.env/conflict markers) or probe failure — never submit a tainted diff
+    description: BLOCK (secrets/.env/conflict markers), a preflight failure (detached HEAD, dirty tree, gh auth, no GitHub remote, or the current branch being the base branch), or a probe failure — stop before any publishing
     guard:
       kind: always
 
   - from: precheck
-    to: push
+    to: open
     description: Project fast check passed or was skipped
     guard:
       kind: shell
@@ -258,104 +173,37 @@ transitions:
     guard:
       kind: always
 
-  - from: push
-    to: ensure-pr
-    description: Branch published (or already up to date)
-    guard:
-      kind: shell
-      options:
-        command: 'grep -qE "^(PUSHED|UP_TO_DATE)$" .spur/run/$__runId-pr-push.status 2>/dev/null'
-  - from: push
-    to: failed
-    terminalReason: failed-check
-    description: Push rejected (e.g. non-fast-forward) — report; never force-push as a workaround
-    guard:
-      kind: always
-
-  - from: ensure-pr
-    to: request
-    description: PR found or created
-    guard:
-      kind: shell
-      options:
-        command: 'grep -qE "^(FOUND|CREATED)$" .spur/run/$__runId-pr-ensure.status 2>/dev/null'
-  - from: ensure-pr
-    to: failed
-    terminalReason: failed-check
-    description: No reviewable delta or PR creation failed — report the actual git/GitHub state
-    guard:
-      kind: always
-
-  # Declaration order matters: ALREADY_REVIEWED routes straight to collect (full mode dedupe);
-  # submit/noWait stop at pending; everything else waits.
-  - from: request
-    to: collect
-    description: Current HEAD already carries a Codex review — collect instead of duplicating
-    guard:
-      kind: shell
-      options:
-        command: 'test "$(cat .spur/run/$__runId-pr-request.status 2>/dev/null)" = ALREADY_REVIEWED'
-  - from: request
-    to: pending
-    description: Request already in flight, or mode=submit/--no-wait after posting — return pending
-    guard:
-      kind: shell
-      options:
-        # (e) 0825: 4-predicate guard — ALREADY_REQUESTED/REQUESTED pair state is the
-        # fallback route when the review driver stalls (mode/noWait honored).
-        command: 'test "$(cat .spur/run/$__runId-pr-request.status 2>/dev/null)" = ALREADY_REQUESTED || { test "$(cat .spur/run/$__runId-pr-request.status 2>/dev/null)" = REQUESTED && { test "$mode" = "submit" || test "$noWait" = "true"; }; }'
-  - from: request
-    to: wait
-    description: Request posted — poll for the result
-    guard:
-      kind: shell
-      options:
-        command: 'test "$(cat .spur/run/$__runId-pr-request.status 2>/dev/null)" = REQUESTED'
-  - from: request
-    to: failed
-    terminalReason: failed-check
-    description: Request failed (no PR, gh error) — report the preserved error
-    guard:
-      kind: always
-
-  - from: wait
-    to: collect
-    description: Codex findings or an explicit clean result on the current HEAD found
-    guard:
-      kind: shell
-      options:
-        command: 'grep -qE "^(FOUND|CLEAN)$" .spur/run/$__runId-pr-wait.status 2>/dev/null'
-  - from: wait
-    to: pending
-    description: Poll budget exhausted — pending, not failed
+  - from: open
+    to: review
+    description: Branch published and PR found or created
     guard:
       kind: shell
       options:
-        command: 'test "$(cat .spur/run/$__runId-pr-wait.status 2>/dev/null)" = TIMEOUT'
-  - from: wait
+        command: 'grep -qE "^(FOUND|CREATED)$" .spur/run/$__runId-pr-open.status 2>/dev/null'
+  - from: open
     to: failed
     terminalReason: failed-check
-    description: Poll probe itself failed
+    description: Push rejected (e.g. non-fast-forward — report; never force-push as a workaround) or no reviewable delta or PR creation failed
     guard:
       kind: always
 
-  - from: collect
+  - from: review
     to: done
     description: Current-HEAD review collected (CLEAN/FINDINGS)
     guard:
       kind: shell
       options:
-        command: 'grep -qE "^(FINDINGS|CLEAN)$" .spur/run/$__runId-pr-collect.status 2>/dev/null'
-  - from: collect
+        command: 'grep -qE "^(FINDINGS|CLEAN)$" .spur/run/$__runId-pr-review.status 2>/dev/null'
+  - from: review
     to: pending
-    description: No current-HEAD result yet — pending, never clean
+    description: Request in flight, mode=submit/noWait, or a wait timeout — pending, not failed (collect later)
     guard:
       kind: shell
       options:
-        command: 'test "$(cat .spur/run/$__runId-pr-collect.status 2>/dev/null)" = PENDING'
-  - from: collect
+        command: 'test "$(cat .spur/run/$__runId-pr-review.status 2>/dev/null)" = PENDING'
+  - from: review
     to: failed
     terminalReason: failed-check
-    description: Collect probe failed
+    description: Review probe itself failed (no PR, gh error, moved HEAD)
     guard:
       kind: always

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.4.10",
+    "version": "0.4.11",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",

package/plugins/sp/commands/dev-pr-review.md

@@ -1,39 +1,49 @@
 ---
-description: "Review GitHub PRs with Codex; collect and fix findings."
+description: "Local-first PR review — status, a local branch-diff review, and validated fixes; --codex opts into the GitHub Codex review spine."
 role: reviewer
-argument-hint: "[full|submit|collect|fix|rerun|status|rules] [--base <branch>] [--no-wait] [--agent <inline|auto|name>] [<focus>]"
+argument-hint: "[status|review|fix] [--codex] [--force] [--no-wait] [--base <branch>] [--agent <inline|auto|name>] [<focus>]"
 allowed-tools: ["Bash", "Read", "Skill"]
 ---
 
 # Dev PR Review
 
-Wraps the **sp:pr-reviewing** skill. The review itself runs on the GitHub PR through Codex
-(`@codex review`) — never through a local Codex review mechanism; the invoking agent orchestrates
-and (in `fix` mode) implements.
+Wraps the **sp:pr-reviewing** skill. The default `status` mode is a read-only snapshot of the
+branch, its base and the pull request; `review` runs a **local** review of the branch diff unless
+`--codex` opts into the GitHub `@codex review` spine; `fix` triages findings from either reviewer
+and commits the verified ones. The invoking agent orchestrates.
 
 ## Argument Flags
 
 | Flag | Description | Default |
 | --- | --- | --- |
-| `<mode>` | `full\|submit\|collect\|fix\|rerun\|status\|rules` — full: request (deduped) + wait + report; submit: request and stop at pending; collect: report the latest review; fix: validate findings, fix legitimate ones, re-review; rerun: force a fresh review of the pushed HEAD; status: read-only composite; rules: author the repo's `AGENTS.md` `## Code Review Rules`. | full |
-| `--base` `<branch>` | Base branch when a new PR must be created. | existing PR base, else repo default |
-| `--no-wait` | Return pending right after the review request instead of polling. | off |
-| `--agent` `<inline\|auto\|name>` | Who performs model-bearing triage/fix. Omit uses the current agent, `inline` forbids dispatch, `auto` resolves the declared role, and a name pins that executor. This does not change the deterministic workflow/direct route. | omit |
-| `<focus>` | Remaining free text — extra review focus appended to the Codex request (e.g. `security boundaries and transaction idempotency`). | none |
+| `<mode>` | `status\|review\|fix` — status: read-only branch + PR state; review: local branch-diff review (or the GitHub Codex spine with `--codex`); fix: validate, fix and commit findings from either reviewer. | status |
+| `--codex` | `review` only — route through the GitHub Codex spine (`pr-review.yaml`) instead of the local `/sp:dev-review`. | off |
+| `--force` | `review --codex` only — request a fresh review of the current HEAD even when it was already reviewed (`mode=rerun`). | off |
+| `--no-wait` | `review --codex` only — post the request and return `pending` without polling (`mode=submit`). | off |
+| `--base <branch>` | Base branch for the branch report, the `pr-check` diff and a newly created PR. | existing PR base, else repo default |
+| `--agent <inline\|auto\|name>` | Who performs the model-bearing triage/fix. Omit uses the current agent, `inline` forbids dispatch, `auto` resolves the declared role, and a name pins that executor. This does not change the deterministic route. | omit |
+| `<focus>` | Remaining free text — extra review focus for the local review or the Codex request (e.g. `security boundaries and transaction idempotency`). | none |
 
 For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag-glossary.md).
 
 ## Usage
 
-/sp:dev-pr-review [full|submit|collect|fix|rerun|status|rules] [--base <branch>] [--no-wait] [--agent <inline|auto|name>] [review focus]
+```
+/sp:dev-pr-review [status|review|fix] [--codex] [--force] [--no-wait] [--base <branch>] [--agent <inline|auto|name>] [review focus]
+```
 
 ## Implementation
 
 - Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
 - Delegate everything: `Skill(skill="sp:pr-reviewing", args="$ARGUMENTS")`. The skill owns mode
-  routing, finding triage, fix, and rules authoring; `pr-review.yaml` is the SSOT
-  for the review spine's state order and guards; `spur builder pr` is the
-  deterministic git/gh core every spine step shells out to.
-- The external review goes through the GitHub PR and an `@codex review` comment only — never local
-  Codex review commands. Never force-push, rewrite history, merge the PR, or discard unrelated
-  changes; outside `fix` mode, ask before creating any commit.
+  routing, the local `/sp:dev-review` dispatch, the Codex spine and finding triage/fix. On the
+  Codex path `pr-review.yaml` is the SSOT for state order and guards, and the four flat
+  `spur builder pr-<verb>` verbs are the deterministic git/gh core every spine step shells out to.
+- Retired modes print one notice line and run their replacement: `full` → `review --codex`;
+  `submit` → `review --codex --no-wait`; `rerun` → `review --codex --force`; `collect` → `status`.
+  `rules` prints that `AGENTS.md` review-rule authoring belongs to `cc:cc-magents` (the `cc` plugin)
+  and exits without running a review.
+- Never force-push, rewrite history, close or integrate the PR, or discard unrelated changes.
+  `review` without `--codex` makes no GitHub writes. `fix` pre-authorizes one focused commit for the
+  verified findings — stop if unrelated uncommitted changes make safe separation or committing
+  ambiguous.

package/plugins/sp/plugin.json

@@ -1,5 +1,5 @@
 {
     "name": "sp",
-    "version": "0.4.10",
+    "version": "0.4.11",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics."
 }

package/plugins/sp/skills/code-verification/references/secu-review.md

@@ -90,9 +90,13 @@ Before declaring a task `done`, run this lightweight checklist. It catches the m
 - [ ] No `console.log` / `console.error` in production code (use the project logger).
 - [ ] No `--no-verify`, `--force`, or new suppression comments added to bypass gates.
 - [ ] Solution section contains `file:line` citations for every changed file.
-- [ ] API/library claims in changed docs carry a source citation (URL or `path:line`) per
-      source-driven-development; no confidence label is required (ADR-138). The deterministic
-      advisory backstop is the `cited-version-strings` / `cited-api-claims` rules
+- [ ] Every API/library claim in changed docs carries BOTH a source citation (URL or `path:line`) and
+      an EARNED level `HIGH|MEDIUM|LOW` — `HIGH` cites (a URL, `path:line`, or a path with a
+      code/doc extension), `MEDIUM`/`LOW` cite or name what is unverified. That is the
+      `| Claim | Source | Local verification | Confidence |` contract of
+      `.spur/rules/structure/api-library-claim-citation.yaml`; ADR-138 still forbids a confidence
+      label on the VERDICT or verify answer. The deterministic advisory backstop for the citation
+      half is the `cited-version-strings` / `cited-api-claims` rules
       (`.spur/rules/docs/sourced-api-claims.yaml`, run ad hoc — not wired into a preset).
 - [ ] Review section has P1–P4 findings table (even if all rows are empty — the table itself proves review happened).