@gobing-ai/spur 0.4.10 → 0.4.12

package/plugins/sp/skills/source-driven-development/SKILL.md

@@ -68,8 +68,11 @@ Do **not** use this skill for:
 | Recalled from a prior session; plausibly stale | Verify before relying on it |
 | Memory only, no source in hand | Stop — verify first; never present as fact |
 
-Do not grade the claim with a confidence label (ADR-138): a label is as easy to write as the claim.
-The citation is the evidence.
+Every claim carries its citation **and an earned confidence level** — `HIGH|MEDIUM|LOW`: `HIGH`
+cites (`path:line`, a URL, or a path with a code/doc extension), `MEDIUM`/`LOW` cite or name what is
+unverified. That grade is evidence, not self-assessment, so it can only be as strong as what is cited
+beside it. ADR-138 still forbids a confidence label on a verdict or verify answer, where the citation
+alone is the evidence.
 
 ### Step 2 — Go to the primary source, in priority order
 
@@ -89,20 +92,25 @@ State the **version** inline whenever behavior is version-specific.
 ### Step 4 — Cite, then generate
 
 Generate the code and **cite the source** (doc URL + date, or `pkg@version` + the file/symbol) at the
-point of use or in the task's notes. A claim about external behavior without a citation is
-unverified — flag it as such rather than presenting it as fact.
+point of use or in the task's notes, with the claim's earned `HIGH|MEDIUM|LOW` level beside it. A claim
+about external behavior without a citation is unverified — flag it as such rather than presenting it as
+fact.
 
 ### Step 5 — Check the citations before finishing
 
 - **Citation coverage** — every API/library claim in the output carries a source citation (doc URL + date, or `pkg@version` + file/symbol); no uncited claim is asserted as fact.
 - **Source authority** — each citation points at the pinned version's primary source (installed signature/source, or official docs for the lockfile version), not the latest docs or memory.
+- **Claim confidence** — every API/library claim carries an earned level inside `HIGH|MEDIUM|LOW`: `HIGH` cites evidence, `MEDIUM`/`LOW` cite or name what is unverified. A level outside the enum, or one nothing cited earns, is a defect.
 
-Report the first failing check and its deviation, if any. Do not append a confidence verdict.
+Report the first failing check and its deviation, if any. This grade lives on the claim: do not append
+a confidence verdict or a `Confidence:` line to the answer (ADR-138).
 
 Deterministic backstop: the `cited-version-strings` and `cited-api-claims` rules
 (`.spur/rules/docs/sourced-api-claims.yaml`) flag markdown lines that assert a version string or a
 time- or version-anchored API claim (`deprecated since`, `removed in 0.9`, `fixers (since 0.3.4)`)
-with no citation anchor on the same line. They are an info-severity advisory
+with no citation anchor on the same line. Where a project runs the claim-table companion
+(`structure/api-library-claim-citation`), the rows of an `API/library claim sources and confidence`
+block are checked the same way — citation present, level earned. They are an info-severity advisory
 backstop for this contract and are deliberately NOT wired into `recommended-pre-check` — run them ad
 hoc with `spur rule run --file .spur/rules/docs/sourced-api-claims.yaml`. Dated working records
 (`docs/report*`, `docs/dogfood`, `docs/plans`, `docs/analysis`) are excluded, as are the task

package/plugins/sp/skills/spec-decomposition/references/decomposition.md

@@ -53,10 +53,10 @@ Every batch item's hour estimate MUST also travel into the batch JSON as the ite
 frontmatter, and it can be corrected later with `spur task update <wbs> --estimate-hours <n>`. The
 estimate already exists at this point (the hour knobs were just applied above); writing it down
 costs nothing and makes the size decision visible to later stages instead of re-derived. Its
-primary consumer is the inline pipeline driver's dispatch floor
-([inline-pipeline-driver.md](../../spur-dev/references/inline-pipeline-driver.md)): a task at or
-below 1 hour executes its stages host-inline rather than paying a subagent dispatch. An estimate
-left unwritten forgoes that gate — the task dispatches like any large one.
+primary consumer is the host session's dispatch floor
+([execution-batch.md](../../spur-dev/references/execution-batch.md)): a task at or below 1 hour
+executes its stages in the host rather than paying a subagent dispatch. An estimate left unwritten
+forgoes that gate — the task dispatches like any large one.
 
 ### Worked example: H8's own first decomposition
 

package/plugins/sp/skills/spur-check/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: spur-check
-description: 'Two-tier check primitive for the sp pipeline: light (changed-scope biome, per-workspace typecheck, related tests) during development; full (bun run spur-check) once at the quality boundary. Reads/writes fingerprint-bound check receipts (.spur/run/<wbs>-check-receipt.json) and reuses a PASS full receipt only at the same proof digest.'
+description: 'Two-tier check primitive for the sp pipeline: light (changed-scope biome, per-workspace typecheck, related tests) during development; full (`spur self exec check`) once at the quality boundary. Reads/writes fingerprint-bound check receipts (.spur/run/<wbs>-check-receipt.json) and reuses a PASS full receipt only at the same proof digest.'
 license: Apache-2.0
 version: 1.0.0
 metadata:
@@ -34,7 +34,7 @@ gate writes a fingerprint-bound receipt that downstream stages read instead of r
 | Tier | Mode | When | Scope |
 | --- | --- | --- | --- |
 | `light` | `spur task gate <wbs> light` | after each implement/fix edit | `bunx biome check` on the changed files (`git diff --name-only HEAD` + untracked), `bun run typecheck` per touched workspace, and related tests (`<ws>/src/**/x.ts` → `<ws>/tests/**/x.test.ts` filename mapping) run via `cd <ws> && bun test …` — never from the repo root, whose bunfig preload does not apply inside the workspace |
-| `full` | `spur task gate <wbs> run` | once at the task quality boundary (`test`) | today's chain: `bun run lint` + `bun run test-pre-check` + `bun run test` + `bun run test-post-check` (=`bun run spur-check`), with bounded findings, SQLite-busy retry, and the `recheck` probe |
+| `full` | `spur task gate <wbs> run` | once at the task quality boundary (`test`) | today's chain: `spur self exec lint` + `spur self exec rules-pre` + `spur self exec test` + `spur self exec rules-post` (=`spur self exec check`), with bounded findings, SQLite-busy retry, and the `recheck` probe |
 
 Exit contract: `run` and `recheck` return 0 on PASS and 1 on FAIL; `deferred` returns 0 on
 DEFERRED and 1 on FAIL. `light` and `status` return 0; invalid usage returns 2. The pipeline
@@ -58,10 +58,10 @@ that soft shell wrapper does not change the standalone CLI contract.
 }
 ```
 
-- `inputDigest` is the shared `ProofInputFingerprint` (task markdown + git tree of tracked
-  sources). The plugin never computes it — the pipeline captures it with the `proof.fingerprint`
-  action into `env.proofDigest` (ADR-124: no second fingerprint, no `@gobing-ai/*` import);
-  standalone callers use `spur workflow inline fingerprint`.
+- `inputDigest` is the git tree the gate computes for itself (`captureGateGitTree`: `git read-tree
+  HEAD`, `git add -A` excluding `docs/tasks*` and `docs/features*`, `git write-tree` on a throwaway
+  index). The plugin never computes it and no caller supplies it — ADR-140 retired the
+  `proofDigest`/`--proof-digest` chain, so a corpus edit cannot invalidate a code PASS.
 - `run` and `recheck` write full-tier receipts; only a PASS at the current digest is reusable. Without a digest, `run` writes no receipt and says
   so in the gate log. The gate executes `qualityGateCmd` as one unit, so the full receipt carries a
   single `test` row for the whole chain; `lint`, `typecheck`, `test-pre-check`,
@@ -76,7 +76,7 @@ Check `status` mode before re-running a gate. The gate ships inside the CLI (no
 resolve):
 
 ```bash
-spur task gate <wbs> status --proof-digest "$proofDigest" --no-logo   # final stdout line: {"reuse":…,"reason":…}
+spur task gate <wbs> status --no-logo   # final stdout line: {"reuse":…,"reason":…}
 ```
 
 `reuse: true` only when the receipt is `status: PASS`, `tier: full`, and `inputDigest` equals the
@@ -105,7 +105,8 @@ preserved by construction. `recheck` stays the no-progress probe path for fix lo
 ## Gotchas
 
 1. **Keep gate logic in the CLI/application owner** — plugin skills invoke `spur task gate`;
-   they do not restore a script or bundle. The digest arrives via `--proof-digest` or `env.proofDigest`.
+   they do not restore a script or bundle. The gate computes its own tree identity; there is no
+   `--proof-digest` flag and no `env.proofDigest` input to supply.
 2. **Never run light tests from the repo root** — the workspace `bunfig.toml` preload (coverage,
    thresholds) only applies inside the workspace; `cd <ws> && bun test …` is the contract.
 3. **Light is a filter, not a boundary** — unmapped files (root-level scripts, non-src layouts)

package/plugins/sp/skills/spur-cli/SKILL.md

@@ -44,10 +44,10 @@ Pick the noun, read its reference. Each Tier A and Tier B reference owns that no
 | **Tier A** | **feature** | Feature tree: author with hierarchical IDs (DD-14), acceptance criteria (Gherkin), status lifecycle, move subtrees, `check --json` | [references/features.md](references/features.md) |
 | **Tier A** | **rule** | Constraint quality gate: run presets, author rules, fine-tune, validate rule files/presets, extend engine | [references/rules.md](references/rules.md) |
 | **Tier A** | **workflow** | Dual-mode workflow runtime: author state-machine / transition-flow workflows, validate, run, read traces | [references/workflows.md](references/workflows.md) |
-| **Tier A** | **builder** | Release/PR plumbing: `bump-ver` (including read-only `--check`), `drop-tags`, `publish`, and `pr` review operations | [references/builder.md](references/builder.md) |
+| **Tier A** | **builder** | Release/PR plumbing: `bump-ver` (including read-only `--check`), `drop-tags`, `publish`, the four flat PR verbs (`pr-status`, `pr-check`, `pr-open`, `pr-review`), and the read-only `show-branches` topology report | [references/builder.md](references/builder.md) |
 | **Tier B** | **agent** | Coding-agent execution surface: run prompts via detected/named agents, list agent specs (incl. `agent.fleet` members), start/stop supervised processes, fleet `report`/`join`/`leave`/`wait`/`trace`, readiness check | [references/agent.md](references/agent.md) |
 | **Tier B** | **message** | Durable inter-agent messaging: send, inbox, reply, watch | [references/message.md](references/message.md) |
-| **Tier B** | **self** | Self-management verbs: scaffold (`init`), database maintenance (`maintain`), schema migrations (`migrate`), local web server (`serve`), status overview (`status`); `self init` runs post-scaffold validation probes & layout classification | [references/self.md](references/self.md) |
+| **Tier B** | **self** | Self-management verbs: scaffold (`init`), project SDLC actions (`exec`), database maintenance (`maintain`), schema migrations (`migrate`), local web server (`serve`), status overview (`status`); `self init` runs post-scaffold validation probes & layout classification | [references/self.md](references/self.md) |
 | **Tier B** | **history** | Import agent histories, aggregate forensic artifacts, render reports, and run the checkpoint-resumed daily pipeline | [references/history.md](references/history.md) |
 | **Tier B** | **projects** | Manage the local multi-project registry and start/stop project servers | [references/projects.md](references/projects.md) |
 | **Tier B** | **decision** | Decision-catalog transport: list visible decisions, show a served contract, run a decision to a served outcome, audit catalog health | [references/decision.md](references/decision.md) |
@@ -145,7 +145,7 @@ and spreading it; full contract in `docs/04_DESIGN.md` §1.0.1.
   `inbox`, `reply`, `watch`).
 - **[references/decision.md](references/decision.md)** - decision catalog (`list`, `show`, `run`,
   `status`); offline by default via the built-in `typesafe` maker.
-- **[references/self.md](references/self.md)** - `spur self init|maintain|migrate|serve|status` CLI verbs
+- **[references/self.md](references/self.md)** - `spur self init|exec|maintain|migrate|serve|status` CLI verbs
   (the five legacy top-level nouns remain hidden aliases). `self init` runs post-scaffold init
   validation (Phase 1.5/1.6 probes).
 - **[references/history.md](references/history.md)** - history import, forensic artifact analysis,

package/plugins/sp/skills/spur-cli/references/builder.md

@@ -1,22 +1,27 @@
 ---
 name: spur-cli-builder
-description: "spur-cli noun reference: operate `spur builder` as the release plumbing surface - bump a workspace package (or the `workspace:`-pinned release set) with `bump-ver`, delete release tags with `drop-tags`, with commit + annotated tag + optional push; publish a package to npm with `publish` (and guard version drift with `bump-ver --check`); run the `/sp:dev-pr-review` spine ops with `pr`. Promoted from spur-dev (task 0617, ADR-051); frozen at exactly these four verbs."
+description: "spur-cli noun reference: operate `spur builder` as the release plumbing surface - bump a workspace package (or the `workspace:`-pinned release set) with `bump-ver`, delete release tags with `drop-tags`, with commit + annotated tag + optional push; publish a package to npm with `publish` (and guard version drift with `bump-ver --check`); run the `/sp:dev-pr-review` PR loop with the four flat verbs `pr-status` (read-only status), `pr-check` (submission gate), `pr-open` (push + ensure PR) and `pr-review` (Codex request + wait + collect); report base-relative branch topology with `show-branches`. Promoted from spur-dev (task 0617, ADR-051); frozen at exactly these eight verbs."
 see_also:
   - spur-cli
 ---
 
 # spur builder - release plumbing
 
-`spur builder` is the CLI for **version bumps and release tags**. It wraps the internal
-`release-ops` implementation behind a public four-verb surface. The repo-local forwarder
+`spur builder` is the CLI for **version bumps and release tags**, plus the PR-review loop and the
+read-only branch report. It wraps the internal
+`release-ops` implementation behind a public eight-verb surface. The repo-local forwarder
 (`scripts/commands/release.ts`) and its `spur-dev` dispatcher cases were retired in task 1173; the
 root `bun run bump-ver` / `bun run drop-tags` names route to `spur builder` directly. Package ids are
 the unscoped short names (`@gobing-ai/spur` → `spur`); the released set and the aggregate tag are
 discovered from the repo's own workspace manifests, so the same code serves any git+semver
 monorepo.
 
-This noun is **frozen at exactly four verbs** (`bump-ver`, `drop-tags`, plus `pr` and `publish` from the 2026-10-15 script-absorption entries) by operator consent (`docs/design/harness-surface-governance.md`
-§3) — do not invent additional `builder` subcommands.
+This noun is **frozen at exactly eight verbs** (`bump-ver`, `drop-tags`, `publish` from the 2026-10-15
+script-absorption entries; `show-branches` and the four flat PR verbs `pr-status`, `pr-check`,
+`pr-open`, `pr-review` from the 2026-10-16 feature-L1 entries) by operator consent
+(`docs/design/harness-surface-governance.md` §3) — do not invent additional `builder` subcommands.
+The former `pr <op>` pass-through stays registered as a **hidden, deprecated alias** for one release
+(it prints one stderr deprecation line naming the replacement verb), so it is not listed here.
 
 ## Verb map
 
@@ -25,7 +30,11 @@ This noun is **frozen at exactly four verbs** (`bump-ver`, `drop-tags`, plus `pr
 | `bump-ver [package-id] [version]` | Bump one package (manifest + in-source `binaryVersion` + consumer `workspace:` pins), commit, tag, optionally push; `--check [package-id]` only verifies marketplace/plugin versions (exit 1 on drift) | `--all` `--push` `--check` `--json` |
 | `drop-tags [package-id] <version>` | Delete a package's release tag (local only by default) | `--all` `--remote` `--json` |
 | `publish <dir>` | CI npm publish: resolve `workspace:`/`catalog:` ranges, `build:bundle`, `npm publish --access public`, restore the manifest | `--otp` |
-| `pr <op>` | PR-review spine ops for `/sp:dev-pr-review`: `preflight` `push` `ensure` `hygiene` `request` `wait` `collect` `status` | `--base` `--since` `--head` `--json` `--status-file` |
+| `pr-check [--base <branch>] [--scan-only]` | Submission gate for `/sp:dev-pr-review`: preflight then the `base...HEAD` hygiene scan; a preflight failure stops before hygiene (`PASS`/`WARN`/`BLOCK`/`FAIL`) | `--base` `--scan-only` `--json` `--status-file` |
+| `pr-open [--base <branch>]` | Publish the branch (never force) and reuse or create its PR (`FOUND`/`CREATED`/`FAIL`) | `--base` `--json` `--status-file` |
+| `pr-review [--force] [--focus <text>] [--no-wait]` | Post the `@codex review` request, wait, then collect (`CLEAN`/`FINDINGS`/`PENDING`/`FAIL`; exit 3 = pending) | `--force` `--focus` `--no-wait` `--timeout` `--interval` `--json` `--status-file` |
+| `pr-status [--since <iso>] [--head <sha>]` | Read-only PR/CI/Codex status with the current-HEAD review as `review` (no verdict) | `--since` `--head` `--json` `--status-file` |
+| `show-branches` | Read-only branch topology report against a base (default `markdown` with a condensed mermaid `gitGraph`) | `--format` `--json` `--base` `--local` `--remote` `--pr` `--limit` `--max-commits` `--hide-contained` `--theme` |
 
 A bare `bump-ver <version>` (single positional that parses as semver) or explicit `--all` bumps
 every package pinned via `workspace:` by another workspace package, then adds per-package trace
@@ -58,14 +67,78 @@ spur builder drop-tags spur 0.1.4           # delete the local tag @gobing-ai/sp
 spur builder drop-tags --all 0.1.4 --remote # delete per-package + aggregate tags, locally and on origin
 ```
 
-## `pr` - PR-review spine ops
+## `pr-status`, `pr-check`, `pr-open`, `pr-review` - the PR-review loop
 
 ```bash
-spur builder pr preflight --json            # repo/gh checks
-spur builder pr ensure --base main --json   # reuse or create the branch PR
-spur builder pr wait --since "$t" --head "$sha" --json   # exit 3 = still pending
-spur builder pr status --json               # read-only composite status
+spur builder pr-status --json                          # read-only composite status + .review
+spur builder pr-check --base main --json               # preflight + hygiene submission gate
+spur builder pr-check --scan-only --json               # hygiene alone (local review on a dirty tree)
+spur builder pr-open --base main --json                # push, then reuse or create the PR
+spur builder pr-review --focus "migration safety" --json   # request → wait → collect
+spur builder pr-review --no-wait --json                # post the request, return PENDING
+spur builder pr-review --force --json                  # force a fresh review of the current HEAD
 ```
 
-Absorbed from `plugins/sp/scripts/pr-reviewing.ts` (script-absorption PR-7); driven by
-the `pr-review` workflow. Exit codes: `0` ok, `1` usage, `2` hard failure, `3` wait timeout.
+Four flat verbs over the ops absorbed from `plugins/sp/scripts/pr-reviewing.ts` (script-absorption
+PR-7); driven by the `pr-review` workflow. Each composes existing ops and embeds their records in
+one JSON object per verb: `pr-status` → the status object plus `review` (collect, or `null` with no
+PR); `pr-check` → `{ ok, verdict, preflight, hygiene }`; `pr-open` → `{ ok, verdict, push, pr }`;
+`pr-review` → `{ ok, verdict, request, findings }`.
+
+- **`--status-file`** holds the verb's one-word verdict: `PASS`/`WARN`/`BLOCK`/`FAIL` (`pr-check`),
+  `FOUND`/`CREATED`/`FAIL` (`pr-open`), `CLEAN`/`FINDINGS`/`PENDING`/`FAIL` (`pr-review`).
+  `pr-status` is read-only and writes none.
+- **Exit codes:** `0` ok, `1` usage, `2` hard failure, `3` wait timeout — exit 3 is `PENDING`
+  (pending, never failure; collect later with `pr-status`).
+- **`--head`:** `pr-status` pins the reviewed commit; it defaults to the current local HEAD, and an
+  explicit pin that no longer matches the PR head fails loud instead of reporting a moved commit.
+- **Deduping:** `pr-review` collects without a new request when the exact HEAD is already reviewed,
+  and returns `PENDING` when a marked request is still in flight; `--force` requests a fresh review
+  (`mode=rerun`). Never force-pushes.
+
+```bash
+# deprecated alias, one release: maps the old op names to the verbs above
+spur builder pr preflight --json     # -> spur builder pr-check
+spur builder pr status --json        # -> spur builder pr-status
+```
+
+## `show-branches` - read-only branch topology report
+
+```bash
+spur builder show-branches                      # markdown: summary table + condensed mermaid gitGraph
+spur builder show-branches --base origin/main   # measure every branch against another base
+spur builder show-branches --format json        # raw { base, generatedAt, branches[], omitted, warnings[] }
+spur builder show-branches --pr --limit 50      # add open pull-request state, keep up to 50 rows
+```
+
+One row per branch — local, remote-only, or the detached HEAD by short sha — with the fork point,
+commits ahead/behind the base, the contained flag (`ahead == 0`, i.e. everything in it is already in
+the base), the last commit, and the worktree path that has it checked out. Base resolution is
+`--base <ref>`, else the `origin/HEAD` target, else `main`. `--local` / `--remote` filter the ref
+namespace (mutually exclusive), `--limit <n>` (default 30) caps rows by most recent commit and
+reports the omitted count, and `--pr` adds the open pull-request number/state/review decision from a
+single `gh pr list` call (a missing or unauthenticated `gh` degrades to null PR fields plus one
+warning, never a failure).
+
+| Flag | Description |
+| ---- | ----------- |
+| `--format <markdown\|json\|text>` | Output format; `markdown` is the default |
+| `--json` | Alias of `--format json` |
+| `--base <ref>` | Base ref (default: the `origin/HEAD` target, else `main`) |
+| `--local` / `--remote` | Restrict to local or remote branches |
+| `--pr` | Enrich rows with open pull-request state (one `gh pr list` call) |
+| `--limit <n>` | Maximum branch rows (default 30) |
+| `--max-commits <n>` | Maximum commit nodes per branch line in the graph (default 3) |
+| `--hide-contained` | Drop contained branches from the graph instead of drawing their join |
+| `--theme <name>` | Mermaid theme for the graph init directive |
+
+The graph draws the base line, one `branch` per open branch, a `+N earlier` summary node for the
+commits a cap hides, `HIGHLIGHT` tips, `REVERSE` reverts and the tag names of the commits it shows.
+Read-only: it never creates, moves or deletes a ref, config entry, index entry or worktree.
+
+The graph rules are `mermaid@11.15.0` HIGH, pinned at `apps/web/package.json:28` and asserted by
+`apps/web/tests/branch-topology-graph.heavy.test.ts:155`. The `--pr` vocabulary is `gh@2.102.0` HIGH at
+`https://cli.github.com/manual/gh_pr_list` (read 2026-10-16), measured against this repo's own PRs.
+
+**Exit codes:** `0` ok, `1` usage (unknown `--format`, non-positive `--limit`/`--max-commits`,
+unknown base ref, `--local` with `--remote`), `2` git failure (not a repository, `git` missing).

package/plugins/sp/skills/spur-cli/references/self.md

@@ -1,22 +1,26 @@
 ---
 name: spur-cli-self
-description: "spur-cli noun reference for `spur self`: self-management verbs — scaffold (`init`), database maintenance (`maintain`), schema migrations (`migrate`), local web server (`serve`), and status overview (`status`). Each verb mounts the same command builder as its legacy top-level noun, which remains a hidden alias over the identical command."
+description: "spur-cli noun reference for `spur self`: self-management verbs — SDLC action runner (`exec`), scaffold (`init`), database maintenance (`maintain`), schema migrations (`migrate`), local web server (`serve`), and status overview (`status`). The five legacy verbs (`init`, `maintain`, `migrate`, `serve`, `status`) each mount the same command builder as their legacy top-level noun, which remains a hidden alias; `exec` has no top-level alias."
 see_also:
   - spur-cli
 ---
 
 # spur self - self-management verbs
 
-`spur self` hosts the self-management verbs. Each verb is the canonical path for a command
+`spur self` hosts the self-management verbs. Five of them are the canonical path for a command
 that also remains registered as a legacy top-level **hidden alias** (`spur init`, `spur maintain`, `spur migrate`,
 `spur serve`, `spur status`) so existing scripts, workflow YAML, and habits keep working unchanged.
 Both paths share the same command builder: identical flags, output, and exit codes. The legacy
 top-level forms are omitted from `spur --help`, leaving `self` as the visible surface.
 
+`exec` is the exception: it exists only as `spur self exec` — there is no `spur exec` top-level
+alias (`spur exec <action>` is an unknown command), so nothing depends on a legacy path.
+
 ## Verb map
 
 | Verb | Purpose | Key flags |
 | ---- | ------- | --------- |
+| `exec` | Run (or list) a project SDLC action bound in `builder.actions` / `builder.preset` | `--list` `--dry-run` `--json` |
 | `init` | Scaffold a new Spur project in the current directory | `--name <name>` `--force` `--minimal` `--adopt-global-config` `--json` |
 | `maintain` | Run database maintenance: PRAGMA optimize, WAL truncation, optional VACUUM | `--vacuum` `--json` |
 | `migrate` | Apply CLI-owned schema migrations (or `--check` the importer schema) | `--check` `--json` |
@@ -28,6 +32,37 @@ top-level forms are omitted from `spur --help`, leaving `self` as the visible su
 **[serve.md](serve.md)** owns the `serve` verb (server flags and dry-probe semantics). `migrate`
 has no reference of its own and is documented inline below.
 
+## `self exec` - run a project SDLC action
+
+```bash
+spur self exec build                   # run the resolved command in the project root
+spur self exec lint -- --fix           # extra args: shell-quoted and appended to a string action
+spur self exec --list                  # every reserved + declared action, its source and command
+spur self exec --list --json           # machine-readable action inventory
+spur self exec test --dry-run          # print the resolved command(s), run nothing
+spur self exec check -- --fail-on error  # trailing args reach the command (composites refuse them: exit 2)
+```
+
+Runs one action resolved from the project's `builder` config in `.spur/config.yaml`:
+`builder.actions.<action>` first, then the active `builder.preset` (`bun` or `none`), then the
+stack-neutral default. The command runs through `sh -c` **in the project root** with
+stdout/stderr inherited (stdin is not forwarded) and `SPUR_ACTION=<action>` exported to the child;
+spur exits with the child's exit code.
+A composite action runs its steps in order, echoes `▶ <step>` per step on stderr, and stops at the
+first non-zero exit.
+
+| Exit | When |
+| ---- | ---- |
+| child's code | the action (or the failing composite step) exited non-zero |
+| `2` | action unbound, composite given arguments, or no action and no `--list` |
+| `1` | unknown option (commander usage error, before the verb runs) |
+
+`--list --json` rows are `{ name, reserved, source: config|preset|default|unbound, command | steps }`; an
+`unbound` row carries neither `command` nor `steps`, so branch on `source`;
+`--dry-run --json` prints `[{ name, command }]`, one object per resolved step, and runs nothing.
+`--json` without `--list` or `--dry-run` prints a final `{ action, steps: [{ name, exitCode, durationMs }], exitCode }`
+after the streaming output. Full surface: `docs/design/sdlc-actions.md` §3.3.
+
 ## `self init` - scaffold a Spur project
 
 ```bash

package/plugins/sp/skills/spur-cli/references/tasks/l3-guard-cheatsheet.md

@@ -81,7 +81,7 @@ Prose-only reviews and rows containing only empty/placeholder cells do not pass.
     }
   ],
   "checks": [
-    { "name": "lint-clean", "status": "pass", "evidence": "bun run lint: exit 0" }
+    { "name": "lint-clean", "status": "pass", "evidence": "spur self exec lint: exit 0" }
   ],
   "source": "spur-task-verdict"
 }

package/plugins/sp/skills/spur-cli/references/tasks/verbs.md

@@ -79,7 +79,7 @@ frontmatter scalar.
 - **Frontmatter** (`--feature <id>`, `--priority <p>`): sets the scalar frontmatter field on an
   existing task — the only post-create path, allow-listed to `feature_id` / `parent_wbs` / `priority`.
 - **Estimate** (`--estimate-hours <n>`): sets the `estimate_hours` frontmatter field (positive number) —
-  the decomposition size estimate the inline pipeline driver reads.
+  the decomposition size estimate the host-session dispatch floor reads.
 - **`--provenance-bypass`** (pair with `--force-done` and `--reason`): records an audited
   provenance-bypass link when no pipeline run exists. Replaces the `SPUR_PROVENANCE_OVERRIDE` env var.
 - **AC controls** (`--ac-altitude <graduating|task-local>`, `--ac-numbering task-local`) — independent
@@ -356,7 +356,7 @@ column to distinguish AC rows from requirement rows:
 | AC | Status | Evidence Type | Evidence |
 |----|--------|---------------|----------|
 | AC-1 | MET | test    | `tests/foo.test.ts:12` |
-| AC-2 | MET | command | `bun run lint` exit 0 |
+| AC-2 | MET | command | `spur self exec lint` exit 0 |
 | AC-3 | N/A | n/a     | non-behavioral — doc-only |
 ```
 
@@ -465,7 +465,7 @@ spur task resolve  <file-path> [--strict] [--folder] [--json]
 spur task path     <wbs> [--folder] [--json]
 spur task run-link <wbs> [--source <src>] [--run-id <id>] [--json]
 spur task scaffold-tests <wbs> [--file <path>] [--folder] [--json]
-spur task gate     <wbs> <run|recheck|light|deferred|status> [--cmd <c>] [--probe-cmd <c>] [--proof-digest <d>] [--run-id <id>]
+spur task gate     <wbs> <run|recheck|light|deferred|status> [--cmd <c>] [--probe-cmd <c>] [--run-id <id>]
 spur task residual <wbs> <scan|review-gate|fold|settle|report> [--root <dir>] [--tmp-dir <dir>] [--folder]
 spur task diffstat <wbs>
 ```

package/plugins/sp/skills/spur-cli/references/tasks.md

@@ -60,7 +60,7 @@ re-reading or re-tokenizing the task.
 | `run-link <wbs>` | Record pipeline run provenance link for task | `--source <src>` `--run-id <id>` `--json` |
 | `verifyall-aggregate` | Aggregate per-task verify outcomes into a batch verdict (NOT-STARTED excluded) | `--from-file <path>` `--json` |
 | `scaffold-tests <wbs>` | Generate BDD test stubs from task Acceptance Criteria | `--file <path>` `--folder` `--json` |
-| `gate <wbs> <mode>` | Task-pipeline quality gate (`run`, `recheck`, `light`, `deferred`, `status`); mode-specific exits and fingerprint-bound receipts (see `sp:spur-check`) | `--cmd <c>` `--probe-cmd <c>` `--proof-digest <d>` `--run-id <id>` |
+| `gate <wbs> <mode>` | Task-pipeline quality gate (`run`, `recheck`, `light`, `deferred`, `status`); mode-specific exits and git-tree-keyed receipts (see `sp:spur-check`) | `--cmd <c>` `--probe-cmd <c>` `--run-id <id>` |
 | `residual <wbs> <step>` | F96 residual sweep step (`scan`, `review-gate`, `fold`, `settle`, `report`) | `--root <dir>` `--tmp-dir <dir>` `--folder` |
 | `diffstat <wbs>` | Write the triage diffstat artifact against the run base (fails safe to `sensitive: true`) | — |
 

package/plugins/sp/skills/spur-cli/references/workflows.md

@@ -119,7 +119,8 @@ The skill's logic divides by **whether the LLM adds value**:
 | `summary` | `spur workflow summary` (CLI) | `--progress <[label=]file>`… \| `--rollup <[label=]file>`… `[--transcript] [--since] [--markdown]` | Measured execution summary (per-stage time, wait, tool calls, tokens, actor split) or the batch roll-up `/sp:dev-runall` prints. `n/a` exit 0 without a transcript; exit 2 on usage or unreadable input |
 | `profile` | `spur workflow profile` (CLI) | `<workflow> [--last n] [--window sec] [--spur-bin cmd] [--json]` | Read-only per-node step profile from `spur workflow trace` with the ADR-115 cache-window flags, for `sp:spur-doctor`. Exit 1 when a trace read fails |
 | `cost` | `spur workflow cost` (CLI) | `[--workflow <name>]… [--by-state] [--include-bookkeeping] [--since <date>] [--budget <file>] [--measured-file <json>] [--json]` | Real terminal non-dry run measurements, or a budget result; unknown measurements stay null. Budget failures exit 1 |
-| `inline` | `spur workflow inline <op>` (CLI) | `begin`, `fingerprint`, `node-enter`, `action`, `actions`, `close`, `decide`, `persist-out`, `persist-check`, `attribution`, `dispatch-failure` | The host-inline driver's run lifecycle transport ([inline-pipeline-driver.md](../../spur-dev/references/inline-pipeline-driver.md)); exit 0 ok / 1 fail closed / 2 usage |
+| `persist-out` | `spur workflow persist-out` (CLI) | `--from <worktree> [--task-file <path>]…` | WT-4 landing: copy a worktree's run rows, two-file records and cited/owned evidence into the invoking tree before teardown; exit 1 fail closed (retain the worktree) |
+| `persist-check` | `spur workflow persist-check` (CLI) | `--from <worktree> [--task-file <path>]… [--run-id <id>]… [--root <tree>] [--success-json <path>]` | WT-4 pre-removal assertion that the worktree owns no unpersisted durable evidence; exit 0 ok / 1 blocked or divergent / 2 usage |
 | `commit-guard` | `spur workflow commit-guard <op>` (CLI) | `start\|stage\|check --run <id> [--base <sha>] [-- <paths…>]` | Stages only paths this run wrote; exit 2 when a listed path is refused, 3 on unmerged/conflict-marked targets |
 | `add` | agent procedure | `"<nl-description>" [--kind <state-machine\|transition-flow>] [--file <path>]` | **Mode chosen (confirmed)** → first reconciled against existing workflows (extend an existing flow rather than duplicate) → YAML authored in real schema shape → **validated AND dry-run** (reaches the expected terminal state) → [add](workflows/operations.md#add) |
 | `refine` | agent procedure | `<workflow-file> [--intent "<goal>"] [--dry-run]` | Smallest change meeting the intent, re-validated and re-dry-run; `--dry-run` emits a diff only → [refine](workflows/operations.md#refine) |
@@ -255,7 +256,7 @@ suppression snapshot, so every finding is reported — none are suppressed.
 
 **Advisory-only posture (binding):** findings never justify blocking a run, failing a gate, or
 editing a pipeline that is currently executing. The advisory never changes `validate`'s exit status,
-never blocks `workflow run`, and is not part of `spur-check` / `spur-check-new`. Treat a finding as
+never blocks `workflow run`, and is not part of `spur-check`. Treat a finding as
 a to-be-enhanced note for the workflow's owner — surface it in your report, apply the fix only when
 the operator accepts it, and never hot-edit a running workflow's shell in place.
 
@@ -274,7 +275,8 @@ spur workflow progress <run-id> [--json]
 spur workflow summary  (--progress <[label=]file>... | --rollup <[label=]file>...) [--transcript <path>] [--since <iso>] [--markdown]
 spur workflow profile  <workflow> [--last <n>] [--window <sec>] [--spur-bin <cmd>] [--json]
 spur workflow cost     [--workflow <name>]... [--by-state] [--include-bookkeeping] [--since <YYYY-MM-DD>] [--budget <file>] [--measured-file <json>] [--json]
-spur workflow inline   <op> [options]
+spur workflow persist-out   --from <worktree> [--task-file <path>]...
+spur workflow persist-check --from <worktree> [--task-file <path>]... [--run-id <id>]... [--root <tree>]
 spur workflow commit-guard <op> [options]
 ```
 

package/plugins/sp/skills/spur-dev/SKILL.md

@@ -98,12 +98,12 @@ run. Resume with `spur workflow continue --answer-text <answer>` — the guard a
 `maxEscalations` (default 2) bounds the loop; exhausted or empty answer → `failed`. Implement only.
 
 Full procedure: **[references/execution-workflow.md](references/execution-workflow.md)**.
-Host-session procedure: **[references/inline-pipeline-driver.md](references/inline-pipeline-driver.md)**.
+Host executor: `spur workflow run` with `executor=host` → work item → `spur workflow continue`.
 
 ## Bootstrap reads
 
 Read this `SKILL.md` plus your mode's files below before the first dispatch; everything else under
-`references/` is on demand, and the per-task delegate `inline-pipeline-driver.md` is read at dispatch
+`references/` is on demand; the per-task procedure lives in `execution-workflow.md`/`execution-batch.md`
 (budgets: `plugins/sp/tests/bootstrap-budget.test.ts`, task 1128).
 
 - sequential-inline: `references/execution-batch.md`
@@ -131,7 +131,7 @@ reference for the half you're operating; do not duplicate its content here.
 | Refine                     | planning  | `spur task update --section`                                                              | [planning-workflow.md](references/planning-workflow.md)                                                                                 |
 | Batch refine               | planning  | `sp:dev-refineall` → per-task `refine`                                                    | [dev-operations.md](references/dev-operations.md) § refineall · [planning-workflow.md](references/planning-workflow.md)                 |
 | Task selection             | execution | `spur task list`                                                                          | [execution-workflow.md](references/execution-workflow.md)                                                                               |
-| Pipeline run               | execution | inline YAML driver or `spur workflow run`                                                 | [execution-workflow.md](references/execution-workflow.md) · [inline-pipeline-driver.md](references/inline-pipeline-driver.md)           |
+| Pipeline run               | execution | `spur workflow run` / `spur workflow continue`                                            | [execution-workflow.md](references/execution-workflow.md)                                                                               |
 | Implement (dispatch)       | execution | `sp:code-implementation`                                                                  | competency skill — the spine dispatches, does not inline                                                                                |
 | Test (dispatch)            | execution | `sp:code-testing`                                                                         | competency skill — the spine dispatches, does not inline                                                                                |
 | Review / verify (dispatch) | execution | `sp:dev-review` → `sp:code-verification` + `sp:functional-review` + `sp:code-improvement` | competency skills — the spine dispatches, does not inline                                                                               |

package/plugins/sp/skills/spur-dev/references/cross-cutting.md

@@ -110,9 +110,10 @@ inside that subprocess boundary runs its backing skill in that process; it must
 
 **Pipeline wrappers (`dev-run`, `dev-runall`, `dev-idea`, `dev-plan`)** — the orchestrator is a loop; its *stages* do the
 model-bearing work. Interactive omit/`inline` therefore uses the
-[inline pipeline driver](inline-pipeline-driver.md): it reads the selected pipeline YAML, executes each
-`agent.run` input through the backing skill in the host session, and preserves every shell action
-and guard. `auto` or a named executor is merged into per-task `vars.agent` and
+engine loop: `spur workflow run <file> --vars '{"executor":"host",…}'` executes every guard and
+deterministic action on the engine and pauses with one work item per model stage, which this session
+performs through the backing skill before `spur workflow continue <run-id> --answer-text <receipt>`
+advances the run. `auto` or a named executor is merged into per-task `vars.agent` and
 `vars.implementAgent`, and the workflow's `agent.run` steps run under that subprocess executor (see
 `execution-batch.md` § 3.2). The loop itself continues in the current session.
 
@@ -139,8 +140,8 @@ native subagent with shared-worktree read/write/shell capability, and a task abo
 (`.spur/run/<wbs>-diffstat.json`, verify only) keeps that stage host-inline (2026-09-15
 subagent-dispatch evaluation; the floor and the
 resume-over-re-dispatch rule for worker-role continuation stages are owned by
-[inline-pipeline-driver.md](inline-pipeline-driver.md)) — dispatches **once** to that
-native subagent and joins before the driver continues; any pre-dispatch eligibility failure falls
+[cross-cutting.md](#inline-default-execution-surface)) — dispatches **once** to that
+native subagent and joins before the host reports the work-item receipt; any pre-dispatch eligibility failure falls
 back to one host execution, and a failure after dispatch follows the stage's error policy with no
 automatic host replay. Inline resolution (omitted or explicit, 0687 R1/R2) keeps the native-subagent
 leg for eligible stages. Operator
@@ -495,8 +496,8 @@ them; they live here because they cross every phase boundary.
    skill, no `/sp:prd-*` commands, no `sp:super-pm` agent — unless a later task proves a stable,
    distinct routing value (ADR-022).
 7. **NEVER claim completion without fresh verification evidence.** "Tests pass" must be backed by
-   the actual `bun run test` tail pasted into the record. "Lint clean" must be backed by
-   `bun run lint` output. Stale evidence from a prior run is not evidence — re-run the gate and
+   the actual `spur self exec test` tail pasted into the record. "Lint clean" must be backed by
+   `spur self exec lint` output. Stale evidence from a prior run is not evidence — re-run the gate and
    paste the current output.
 
 ## Verification Before Completion
@@ -594,7 +595,7 @@ principles determine which gates route around HITL and which still pause.
    pausing. The schema is the contract; schema-valid means structurally sound.
 2. **Gate-passed → auto-continue.** If `spur task check`, `spur feature check`, or
    `spur workflow validate` exits 0, the run continues to the next state without surfacing.
-3. **Tests-green → auto-continue.** If `bun run lint` and `bun run test` exit 0, the verify step
+3. **Tests-green → auto-continue.** If `spur self exec lint` and `spur self exec test` exit 0, the verify step
    continues. A red test suite is a hard stop, not an auto-retry.
 4. **Verdict-PASS → auto-continue.** If the verify step produces a PASS verdict, the run advances
    to `record` and `done`. PARTIAL or FAIL verdicts surface to the operator regardless of `--auto`.