@gobing-ai/spur 0.4.11 → 0.4.12

package/config/workflows/wayfinder-resolution.yaml

@@ -37,6 +37,8 @@ vars:
   agent: "auto"
   stepTimeoutMs: "1800000"
   approval: "required"
+  # Accepted/deferred status the approve gate's decision binding writes (1236 R2).
+  approvalStatus: ""
   resolutionMode: "research"
   evidencePolicy: "spur-cli-first"
   __hitlAnswer: ""
@@ -157,14 +159,29 @@ states:
           timeoutMs: ${vars.stepTimeoutMs}
 
   - id: approve
-    description: "Human review gate unless the caller explicitly selects auto approval."
-    pause: true
+    description: "Human review gate unless the caller explicitly selects auto approval (vars.approval=auto)."
     onEnter:
       - kind: hitl.confirm
         options:
           prompt: "Approve research resolution for task ${vars.wbs}?"
+          # Interactive always prompts the operator; profile=auto answers from the
+          # verifier's recorded evidence (1236 R1/R2). No `pause: true` — an evidence
+          # binding cannot live in a paused state (0911 D2).
           decision:
-            mode: never
+            mode: evidence
+            statusVar: approvalStatus
+            evidenceNodes:
+              - verify
+      # A deferred/absent answer is the denial today's headless responder gave.
+      - kind: shell
+        options:
+          command: >-
+            mkdir -p .spur/run; a="$__hitlAnswer"; [ -n "$a" ] || a=no;
+            printf '%s\n' "$a" > ".spur/run/$__runId-wayfinder-approve-answer.txt"
+      - kind: file.read.into-var
+        options:
+          path: .spur/run/${vars.__runId}-wayfinder-approve-answer.txt
+          var: __hitlAnswer
 
   - id: record
     description: >

package/config/workflows/wrapup-pipeline.yaml

@@ -98,7 +98,7 @@
 "$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
 kind: state-machine
 name: wrapup-pipeline
-version: "9"
+version: "11"
 description: "Post-execution wrap-up: doc-sync (doc drift + learning capture), metrics, feature-transition, branch-cleanup"
 iterationBound: 10
 initialState: start
@@ -123,14 +123,18 @@ vars:
   # TRUSTED CONFIG ONLY — this string is executed via `sh -c` (same surface as
   # task-pipeline's qualityGateCmd). Never interpolate untrusted input into it.
   featureGateCmd: '$spurBin feature check "$feature"'
-  # Repo-wide tripwire over the wrap diff (1037): runs `bun run test-repo-wide`
-  # only when package.json declares the script, so other projects no-op. Callers
+  # Repo-wide tripwire over the wrap diff (1037): runs `$spurBin self exec test-repo-wide`
+  # only when that action is bound (a project declares it as a custom action), so other
+  # projects no-op — loudly: the skip prints one stderr note naming the missing binding, so a
+  # silently-dead tripwire cannot masquerade as a green wrap (task 1229). Callers
   # can override it with --vars; an empty string disables the check (the hop
   # still writes PASS).
   # TRUSTED CONFIG ONLY — this string is executed via `sh -c` (same surface as
   # featureGateCmd). Never interpolate untrusted input into it.
-  docTripwireCmd: 'if jq -e ''.scripts["test-repo-wide"]'' package.json >/dev/null 2>&1; then bun run test-repo-wide; fi'
+  docTripwireCmd: 'if $spurBin self exec --list --json 2>/dev/null | jq -e ''.[] | select(.name == "test-repo-wide" and .source != "unbound")'' >/dev/null 2>&1; then $spurBin self exec test-repo-wide; else echo "wrapup: doc tripwire skipped — the test-repo-wide action is unbound; declare builder.actions.test-repo-wide to enable it" >&2; fi'
   __hitlAnswer: ""
+  # Accepted/deferred status the branch-cleanup gate's decision binding writes (1236 R2).
+  branchCleanupStatus: ""
 
 states:
   - id: start
@@ -265,6 +269,12 @@ states:
           role: coder
           answerFile: .spur/run/${vars.__runId}-wrapup-learnings.md
           expectFile: .spur/run/${vars.__runId}-wrapup-learnings.md
+          # The task-resolve state writes this list through `spur task wrapup resolve`,
+          # so the path never appears in a YAML shell and the static scan cannot see the
+          # production — declare it as the stage's input instead (1233 R2).
+          inputs:
+            - path: .spur/run/${vars.__runId}-wrapup-tasks.json
+              kind: artifact
           timeoutMs: ${vars.stepTimeoutMs}
       # (1147 R1) post-doc-sync write-scope guard: the script diffs the working listing
       # against the entry snapshot and writes PASS or `scope-violation: <paths>` — the
@@ -454,16 +464,19 @@ states:
       Irreversible-operation HITL gate, consent-only (0770). If vars.merge=true,
       branch cleanup (merge or delete) is a candidate — but this gate records
       the operator decision and performs NO git operation itself; an operator
-      or a separate approved surface executes any actual merge/delete. This
-      gate ALWAYS pauses — even under --auto — because branch operations are
-      irreversible (Auto-Decision Principle #6).
-    pause: true
+      or a separate approved surface executes any actual merge/delete. Interactive
+      runs always ask the operator; profile=auto answers from the doc-sync stage's
+      recorded evidence and still records the decision (1236 R1/R2). Nothing is
+      auto-executed: both answers route to `done` (Auto-Decision Principle #6).
     onEnter:
       - kind: hitl.confirm
         options:
           prompt: "Branch cleanup for the validated task list (.spur/run/${vars.__runId}-wrapup-tasks.json). This is IRREVERSIBLE (merge or delete). Confirm to proceed?"
           decision:
-            mode: never
+            mode: evidence
+            statusVar: branchCleanupStatus
+            evidenceNodes:
+              - doc-sync
 
   - id: done
     description: >

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.4.11",
+    "version": "0.4.12",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",

package/plugins/sp/README.md

@@ -242,7 +242,7 @@ plugins/sp/
 │   │   └── references/  # ac-style-guide, cross-cutting, decision-brief, dev-operations,
 │   │                      done-housekeeping, execution-batch, execution-workflow,
 │   │                      feature-link-helper, flag-glossary, gate-checklists, glossary,
-│   │                      idea-evaluation, inline-pipeline-driver, planning-workflow,
+│   │                      idea-evaluation, execution-workflow, planning-workflow,
 │   │                      product-planning, section-batching  (16 files)
 │   ├── test-driven-development/                    # TDD workflow companion (SKILL.md only)
 │   ├── reverse-engineering/         # Codebase reverse engineering / HLD / audit
@@ -354,7 +354,7 @@ surface or run one workflow. All skills target the same five core platforms: `cl
 | `session-review`            | 1.1   | Inline review of the active coding-agent session — compact outcomes, evidence-backed resolved/open issue classification, proposal-only improvements, and next actions; no workflow, import, delegation, or mutation                                                                                           |
 | `spur-composer`             | 1.0   | Cross-noun composition — workflow catalog selection, the ephemeral→project→shared ladder, ADR-115 budgets, trace-driven rule tuning; applies accepted `spur-doctor` proposals through `spur` verbs; never judges its own output and never runs a recurring loop                                              |
 | `spur-doctor`               | 1.0   | Cross-noun evaluation — read-only CLI evidence per noun (task/feature/rule/workflow/agent spec), reflection over `history-anatomy` findings through a closed action-class map, and a proposal table; writes nothing; diagnoses artifacts, not runtime environments (`spur agent doctor`'s job)                |
-| `spur-check`                | 1.0   | Two-tier check primitive (ADR-124) — light changed-scope checks during development, the full `bun run spur-check` chain at the quality boundary, and the fingerprint-bound `<wbs>-check-receipt.json` with the `status` reuse rule; composes with `/sp:dev-fixall --gate-log`                                  |
+| `spur-check`                | 1.0   | Two-tier check primitive (ADR-124) — light changed-scope checks during development, the full `spur self exec check` chain at the quality boundary, and the fingerprint-bound `<wbs>-check-receipt.json` with the `status` reuse rule; composes with `/sp:dev-fixall --gate-log`                                  |
 | `redesign-web-ui`           | 1.0   | Existing-UI visual upgrade — audit generic AI fingerprints, apply in-stack polish against `DESIGN.md` / live tokens, verify behavior and viewports; does not migrate frameworks                                                                                                                            |
 | `taste-refactoring-api`     | 1.0   | API design and refactoring for REST/HTTP, RPC/gRPC, GraphQL, event contracts, and CLI surfaces; compatibility, security, and migration review |
 | `taste-refactoring-ui`      | 1.0   | UI design and refactoring with visual hierarchy, typography, spacing, color, and interaction review |

package/plugins/sp/agents/super-planner.md

@@ -288,8 +288,8 @@ With `--json`, emit the same shape as a JSON object for machine consumption.
 
 The parent host owns the visible plan: apply the § 2.7 Visible batch plan updates in the parent
 session's native todo list (`execution-batch.md` § 2.7; the frozen status mapping lives in
-[inline-pipeline-driver.md](../skills/spur-dev/references/inline-pipeline-driver.md) § Host todo
-update styles). Subagents own code and evidence — subagents never render the visible list and todo
+[cross-cutting.md](../skills/spur-dev/references/cross-cutting.md#shared-startup-contract-task-0814-r1r3r4r6r7r8) § Publish the
+generated plan). Subagents own code and evidence — subagents never render the visible list and todo
 tools are not available to them; at each **stage boundary** (implement, test, review, verify) a
 subagent returns `{wbs, state, outcome}` (+ optional `next`), and the parent marks the matching rows
 with the reported outcome. Keep letters/digits from the projection identical across both layers so

package/plugins/sp/agents/super-reviewer.md

@@ -225,14 +225,23 @@ FAIL, PARTIAL, a missing line, a line split across two lines — routes the run
 `review-fail-triage` and its bounded repair hop. Keep it on one line, in that shape, in every
 review answer; never restate it as prose only.
 
-**No confidence line (F511, task 1207).** Review reports do not state, and no gate reads, an
-asserted `Confidence: HIGH | MEDIUM | LOW`. A model that can write a PASS can write `HIGH`, so the
-gate grades what is checkable instead: the recorded section's presence and vocabulary, and the
-findings disposition — an open P1–P3 row blocks the edge exactly as before. What a reviewer would
-formerly have compressed into a level belongs in the report body: name the evidence gaps and the
-assumptions explicitly, so a reader can re-check them. (The derived confidence family is
-untouched: feature-verification receipts under ADR-131, the decision subsystem threshold, and
-history-anatomy reading.)
+**State `Confidence: HIGH | MEDIUM | LOW` — the gate derives it from your dispositions (ADR-141).**
+The review report carries exactly one top-level `Confidence:` line, and it is **cross-checked**: a
+stated level that disagrees with the table is a blocking `review-contract` violation, so a PASS
+carrying citation-free or untested claims cannot launder itself as `HIGH`.
+
+| Derived | When the table says so |
+| --- | --- |
+| `LOW` | the verdict is not PASS, or an open (or undispositioned) P1–P3 row survives |
+| `HIGH` | PASS with every finding closed (`RESOLVED` / `FIXED` / `DONE`) and no carried residual |
+| `MEDIUM` | PASS with carried residuals only — `DEFER(...)`, `ACCEPTED`, or an open P4 |
+
+Derivation: `packages/app/src/services/answer-confidence.ts` (shared with the verify answer). This
+does not revive the retired self-grade: the level records **evidence composition** — what a reader
+would otherwise have to re-derive from the rows — and the gate recomputes it rather than trusting it.
+No verdict-artifact field, no receipt level, no per-finding grade, and no operator ack var exists
+(ADR-138 stands for every other carrier). Evidence gaps still belong in the report body: name them,
+then let the dispositions decide the level.
 
 **Source citations for external claims (one claim contract, 2026-10-12).** A Finding cell or a
 Functional Traceability `Evidence` cell that asserts an external API/library claim carries a

package/plugins/sp/bunfig.toml

@@ -4,8 +4,8 @@
 # tests off the operator's real ~/.config/spur/ config, projects registry and slash-command catalog).
 # Coverage stays gated by the root bunfig (bun run test).
 #
-# Historical: this comment once justified the preload by a host-wide `full-gate.lock` wait. That lock
-# was deleted in `refactor(gate): remove gate-lock mechanism and simplify quality-gate`; the preload
-# is still required, for the reasons above (task 1173 R5).
+# The preload also carries the host-wide `full-gate.lock` isolation (tests/setup.ts gives every test
+# process its own SPUR_GATE_LOCK_DIR), so an in-process gate never queues behind a real one. The
+# preload stays required for the reasons above even without it (task 1173 R5; lock restored by 1235).
 [test]
 preload = ["../../tests/setup.ts"]

package/plugins/sp/commands/dev-changelog.md

@@ -26,5 +26,5 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 ## Implementation
 
-Follow the inline procedure in [dev-operations.md](../skills/spur-dev/references/dev-operations.md#8-changelog) (changelog). This is a docs-only generator: run no quality gates (`bun run gate`, lint, typecheck, tests, `spur-check`, rules) — a generic "verify before finishing" rule does not apply here. The generator's own claim-verification pass is part of the procedure, not a gate, and carries one required check per claim bullet (dev-operations §8, step 7): a **source citation** — an anchor naming a URL or a repo `path:line` — held in the bullet's `<!-- src: … -->` comment and re-verified by step 8's self-check. No confidence level is recorded (ADR-138).
+Follow the inline procedure in [dev-operations.md](../skills/spur-dev/references/dev-operations.md#8-changelog) (changelog). This is a docs-only generator: run no quality gates (`spur self exec autofix|check|lint`, typecheck, tests, rules) — a generic "verify before finishing" rule does not apply here. The generator's own claim-verification pass is part of the procedure, not a gate, and carries one required check per claim bullet (dev-operations §8, step 7): a **source citation** — an anchor naming a URL or a repo `path:line` — held in the bullet's `<!-- src: … -->` comment and re-verified by step 8's self-check. No confidence level is recorded (ADR-138).
 

package/plugins/sp/commands/dev-gitmsg.md

@@ -17,7 +17,7 @@ Implements an inline procedure — see [dev-operations.md](../skills/spur-dev/re
 | `--squash` | Collapse every concern into one message and one commit; implies `--commit`. | off |
 | `--all` | Widen the change set past the index to every change in the tree — unstaged **and untracked**. | off |
 | `--scope` `<path>` | Path filter on the change set; always wins over change-set auto-discovery. | the whole change set |
-| `--check` `<cmd>` | Run `<cmd>` (e.g. `"bun run gate"`) once before committing; non-zero → commit nothing. | off |
+| `--check` `<cmd>` | Run `<cmd>` (e.g. `"spur self exec check"`) once before committing; non-zero → commit nothing. The example is `check`, not the `autofix` + `check` that `gate` maps to: a pre-commit check must not rewrite the tree. | off |
 
 For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag-glossary.md).
 
@@ -36,6 +36,6 @@ commit per concern, split automatically, so the operator is never asked to re-st
 `--squash` → one commit for everything. An empty index widens to the whole tree only on a
 message-only run, and says so; a committing run stops there and prints the exact `--all` re-run line
 instead of guessing.
-No quality gate (`bun run gate`, lint, typecheck, tests, `spur-check`) runs unless `--check <cmd>`
+No quality gate (`spur self exec autofix|check|lint`, typecheck, tests) runs unless `--check <cmd>`
 names one — then it runs once, before any commit, and a failure commits nothing. Gate → auto-fix →
 commit is `/sp:dev-gtd --no-push`.

package/plugins/sp/commands/dev-handover.md

@@ -24,5 +24,5 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 ## Implementation
 
 Follow the inline procedure in [dev-operations.md](../skills/spur-dev/references/dev-operations.md#11-handover) (handover).
-Run no quality gate (`bun run gate`, lint, typecheck, tests, `spur-check`); cite results already on record.
+Run no quality gate (`spur self exec autofix|check|lint`, typecheck, tests); cite results already on record.
 

package/plugins/sp/commands/dev-idea.md

@@ -17,7 +17,7 @@ contract below maps to that workflow's transitions.
 | `"<idea>"` | Vague idea to turn into a feature with AC and tasks. | required (or `--from-file`) |
 | `--from-file` `<path>` | Read the idea from a file instead of the positional argument. Mutually exclusive with `"<idea>"` — exactly one must be present. The file's contents become the verbatim idea text (trimmed of surrounding whitespace only). Useful for long or multiline asks that are awkward to quote. | off |
 | `--skip-design` | Omit system-design (and its approval gate) and per-task Design. | off |
-| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing ideation. Omission and `inline` drive `idea-pipeline.yaml` in this session with zero external agent/workflow processes; `auto` tier-resolves an executor and a name pins one, both through the async workflow worker. | inline |
+| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing ideation. Omission and `inline` run `idea-pipeline.yaml` on the engine with `executor=host`, so each stage pauses with a work item this session performs; `auto` tier-resolves an executor and a name pins one, both dispatched as child processes. | inline |
 | `--auto` | Accept the pipeline's recommendation at every operator gate (see below). | off |
 
 For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag-glossary.md).
@@ -36,9 +36,11 @@ There is **no** `--design` force flag. Design is default-on; only `--skip-design
 **Removed flags:** `--approve-taste`, `--idea-approved`, and `--design-approved` are folded into
 `--auto`. If passed, ignore them with a one-line notice; do not treat them as `--auto`.
 
-**Operator gates.** Every gate is asked as one `AskUserQuestion` [decision brief](../skills/spur-dev/references/decision-brief.md):
-the recommended option first, then options with their reasoning. The operator picks; they never
-type a yes/no. `--auto` takes the recommended option at each gate without asking.
+**Operator gates.** Every gate is a decision point: interactively the gate asks the operator one
+[decision brief](../skills/spur-dev/references/decision-brief.md) — the recommended option first, then
+options with their reasoning; the operator picks, they never type a yes/no. Under `--auto`
+(`profile=auto`) the recorded guard route or the gate's declared evidence binding decides, and the
+trace records the answering source. `--auto` takes the recommended option at each gate.
 
 | Gate | Pauses when | Recommendation comes from | `--auto` takes |
 | --- | --- | --- | --- |
@@ -56,17 +58,25 @@ Flag → vars: `--auto` sets `profile=auto`, `idea_approved=true`, `design_appro
   reading any reference — is `spur workflow show idea-pipeline.yaml --no-logo --format todo --json`
   (the CLI resolves the project→registered→shared layer); then publish every `.plan` row's `text`
   verbatim as the host todo list (the `steps[]` inventory when `.plan` is `null`) before the
-  pipeline's first stage — [inline pipeline driver](../skills/spur-dev/references/inline-pipeline-driver.md)
-  run setup step 5.
-- Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
-- Omitted/`inline`: drive `idea-pipeline.yaml` through the [inline pipeline driver](../skills/spur-dev/references/inline-pipeline-driver.md). Do not launch `spur workflow run`, `spur agent run`, or a native subagent unless the operator explicitly requests delegation.
-- `auto`/name: launch `spur workflow run idea-pipeline.yaml --async`, observe with one `workflow trace --follow`, and only report cancellation as stopped when `workflow cancel --json` returns `killed: true`.
+  pipeline's first stage.
+- **The loop is three moves** (D65 / ADR-140, design `workflow-execution-foundation` §3):
+  `spur workflow run` → perform the returned work item → `spur workflow continue`. The engine owns
+  every guard, transition and deterministic action; this session never re-executes them.
+- Omitted/`inline` — the run dispatches to this host session:
+  `spur workflow run idea-pipeline.yaml --vars '{"idea":"<idea>","executor":"host",...}' --json`.
+  A host stage returns `{status: "paused", pause: {workItem: {runId, state, skill, prompt, inputs,
+  expectFiles, ownedSections}}}`. Perform that work item natively (or through a native subagent), write
+  its receipt, and advance with `spur workflow continue <run-id> --answer-text <receipt> --json`;
+  repeating the same receipt is refused as not-paused, so the resume is idempotent. Repeat until the
+  run is terminal.
+- `auto`/name — same definition, no `executor` var: the subprocess executor runs each work item.
+  Launch `spur workflow run idea-pipeline.yaml --async`, observe with one `workflow trace --follow`,
+  and only report cancellation as stopped when `workflow cancel --json` returns `killed: true`.
 - `Skill(skill="sp:spur-dev", args="idea $ARGUMENTS")`
 - Pass the idea text through every hop **verbatim** — never paraphrase or shorten it in the nested
   `Skill` call or stage prompts; long ideas lose their trailing asks when summarized at the hop.
-- Before executing the pipeline's `start` state, persist the operator's idea argument (or the
-  `--from-file` contents) **unmodified** to `.spur/run/<run-id>-idea-input.md` (0887 R1); every
-  model-bearing stage prompt treats that file as the authoritative ask, and the precheck fails
-  the run when it is empty or missing.
+- The `start` state persists the operator's idea argument (or the `--from-file` contents)
+  **unmodified** to `.spur/run/<run-id>-idea-input.md` (0887 R1); every model-bearing stage prompt
+  treats that file as the authoritative ask, and the precheck fails the run when it is empty or missing.
 - Stage contract (discovery → idea-eval → feature-create → AC → feature-check → system-design →
   decompose → batch-create → ready-prepare → handoff): `plugins/sp/skills/spur-dev/references/dev-operations.md` § idea.

package/plugins/sp/commands/dev-job-dump.md

@@ -25,6 +25,6 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 Follow [job-dump](../skills/spur-dev/references/dev-operations.md#11a-job-dump), using the shared
 handoff template to capture the current job and its remaining work. Run no quality gate
-(`bun run gate`, lint, typecheck, tests, `spur-check`); copy existing gate results or write `not run`.
+(`spur self exec autofix|check|lint`, typecheck, tests); copy existing gate results or write `not run`.
 
 Skill(skill="sp:spur-dev", args="job-dump $ARGUMENTS")

package/plugins/sp/commands/dev-plan.md

@@ -16,7 +16,7 @@ Wraps the **sp:spur-dev** skill.
 | `"<description>"` | Feature description to plan. | required |
 | `--feature` `<id>` | Attach to an existing feature. | omitted |
 | `--parent` `<feature-id>` | Create under a parent feature. | omitted |
-| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing planning. Omission and `inline` drive `idea-pipeline.yaml` in this session with zero external agent/workflow processes; `auto` tier-resolves an executor and a name pins one, both through the async workflow worker. | inline |
+| `--agent` `<inline\|auto\|name>` | Who runs the model-bearing planning. Omission and `inline` run `idea-pipeline.yaml` on the engine with `executor=host`, so each stage pauses with a work item this session performs; `auto` tier-resolves an executor and a name pins one, both dispatched as child processes. | inline |
 | `--skip-design` | Omit the system-design hop. | off |
 | `--auto` | Accept the pipeline's recommendation at every operator gate (same gate table as `/sp:dev-idea`). | off |
 
@@ -45,10 +45,21 @@ contract as `/sp:dev-idea`). If passed, ignore them with a one-line notice.
   reading any reference — is `spur workflow show idea-pipeline.yaml --no-logo --format todo --json`
   (the CLI resolves the project→registered→shared layer); then publish every `.plan` row's `text`
   verbatim as the host todo list (the `steps[]` inventory when `.plan` is `null`) before the
-  pipeline's first stage — [inline pipeline driver](../skills/spur-dev/references/inline-pipeline-driver.md)
-  run setup step 5.
-- Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
-- Omitted/`inline`: drive `idea-pipeline.yaml` through the [inline pipeline driver](../skills/spur-dev/references/inline-pipeline-driver.md). Do not launch `spur workflow run`, `spur agent run`, or a native subagent unless the operator explicitly requests delegation.
-- `auto`/name: launch `spur workflow run idea-pipeline.yaml --async`, observe with one `workflow trace --follow`, and only report cancellation as stopped when `workflow cancel --json` returns `killed: true`.
+  pipeline's first stage.
+- **The loop is three moves** (D65 / ADR-140, design `workflow-execution-foundation` §3):
+  `spur workflow run` → perform the returned work item → `spur workflow continue`. The engine owns
+  every guard, transition and deterministic action; this session never re-executes them.
+- Omitted/`inline` — the run dispatches to this host session:
+  `spur workflow run idea-pipeline.yaml --vars '{"executor":"host",...}' --json` (plus `idea`, or
+  `--from-file`; `--feature`/`--parent` as the flag table says, `--skip-design` → `design=skip`,
+  `--auto` → `profile=auto` + `idea_approved=true` + `design_approved=true`).
+  A host stage returns `{status: "paused", pause: {workItem: {runId, state, skill, prompt, inputs,
+  expectFiles, ownedSections}}}`. Perform that work item natively (or through a native subagent), write
+  its receipt, and advance with `spur workflow continue <run-id> --answer-text <receipt> --json`;
+  repeating the same receipt is refused as not-paused, so the resume is idempotent. Repeat until the
+  run is terminal.
+- `auto`/name — same definition, no `executor` var: the subprocess executor runs each work item.
+  Launch `spur workflow run idea-pipeline.yaml --async`, observe with one `workflow trace --follow`,
+  and only report cancellation as stopped when `workflow cancel --json` returns `killed: true`.
 - `Skill(skill="sp:spur-dev", args="plan $ARGUMENTS")`
 - Full Design package + batch `design` field contract: `plugins/sp/skills/spur-dev/references/dev-operations.md` § plan and `planning-workflow.md` Step 5.5.

package/plugins/sp/commands/dev-review.md

@@ -43,7 +43,7 @@ Put the target first: a bare token after `--worktree` is read as the worktree na
 - **WBS mode (per task target):** `Skill(skill="sp:functional-review", args="<wbs> $FLAGS")` + `Skill(skill="sp:code-verification", args="review <wbs> $FLAGS")` + `Skill(skill="sp:code-improvement", args="<wbs> $FLAGS")` (functional traceability + SECUA framework + architectural depth — each skill receives its one resolved WBS exactly once plus `$FLAGS` = `$ARGUMENTS` minus the selector (`--tasks`/`--feature`/`--scope` or positional) and its value, never the raw selector, and returns a review fragment only — F92 0593 R1)
 - **Task fan-out (`--tasks` / `--feature`).** One WBS-mode review per task in the frozen set. Tasks in `backlog`/`todo`/`blocked` are reported NOT-STARTED and skipped (§ 3a outcome vocabulary); a per-task failure does not stop the remaining tasks. Each implemented task gets its own merged `## Review`; the run ends with a combined summary table (WBS, verdict, P1/P2 counts).
 - Coordinator = this session. No `sp:super-reviewer` subagent is dispatched: act as the review coordinator defined in [agents/super-reviewer.md](../agents/super-reviewer.md) — merge the fragments per its Output Format (native `P1`–`P4` priority cells, section-relative headings) and, for every task target (standalone or pipeline), write that task's combined `## Review` via `spur task update <wbs> --section Review --from-file`. Path mode emits advisory output only.
-- **Answer contract (pipeline dispatches).** The captured review answer (`.spur/run/<runId>-review-answer.txt`) must carry exactly one `Verdict: PASS|FAIL` line; the PASS edges grep it before the review gate runs. No confidence line exists and none is graded (F511, task 1207): model-asserted confidence is not verification — the gate's job is the findings disposition, and an open P1–P3 finding blocks the edge on its own.
+- **Answer contract (pipeline dispatches).** The captured review answer (`.spur/run/<runId>-review-answer.txt`) must carry exactly one `Verdict: PASS|FAIL` line **and** the requirement traceability table `| Req | Status | Evidence |` (D65 1239: `verify` merged into `review`, so this answer is the pipeline's only verification record). It also carries exactly one `Confidence: HIGH|MEDIUM|LOW` line whose level its own findings derive (ADR-141 — no open P1–P3 and no carried residual is HIGH, a carried residual is MEDIUM, an open P1–P3 or a non-PASS verdict is LOW); the gate recomputes the level and rejects a disagreement, so stating a level the dispositions do not support fails the review. `spur task verdict --from-answer` owns the parse — it lints the table and the level, writes the canonical `.spur/run/<wbs>-verdict.json` that `spur task record` reads for box flips and `## Testing`, and a non-zero exit fails the review stage; never re-implement the parse in shell. On a feature-linked task, key each AC row to its feature scenario (scenario title, `AC-N` alias, `(feature R<n>)` or `[R<n>]`) — a row keyed only by a task requirement id credits no scenario at the feature done gate.
 - **Path mode (per path target):** `Skill(skill="sp:code-verification", args="review <path> $FLAGS")` + `Skill(skill="sp:code-improvement", args="<path> $FLAGS")` (advisory SECUA quality + architectural depth — one normalized path forwarded once plus `$FLAGS`; performs no task mutation). Under `--scope <path>[,<path>]`: paths must exist (exit 2 otherwise), are normalized, duplicates dropped and nested paths collapse to the ancestor (`--scope apps,apps/cli` → `apps`); each surviving path gets a sub-review (Step 3p path scope), eligible for native-subagent dispatch per [dispatch-surface.md](../skills/parallel-execution/references/dispatch-surface.md); the coordinator merges the sub-reviews, runs **one** cross-path architecture pass (`sp:code-improvement` over the inter-path imports), and emits **one** advisory report. No task mutation.
 - **Positional alias (deprecated).** A positional `<wbs|path>` is accepted for one release: a `^\d{4}$` token with a resolvable task behaves as `--tasks <wbs>`; an existing path as `--scope <path>`; otherwise exit 2. Print a deprecation warning naming the replacement selector; removal is a follow-up.
 - `--triage`: after the review returns, run the triage protocol in [dev-operations.md § 2. review](../skills/spur-dev/references/dev-operations.md#2-review) **inline in this session** — the review skills and `sp:super-reviewer` stay report-only. With multiple targets, bucket the findings across all targets once (identical `file:line` findings deduped before bucketing). `Edit`/`Write` in `allowed-tools` exist only for these direct fixes.

package/plugins/sp/commands/dev-run.md

@@ -38,14 +38,15 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
   `.plan` row's `text` verbatim as the host todo list (the `steps[]` inventory when `.plan` is
   `null`) before readiness, Git, or isolation work —
   [shared startup contract](../skills/spur-dev/references/cross-cutting.md#shared-startup-contract-task-0814-r1r3r4r6r7r8)
-  step 1 / [inline pipeline driver](../skills/spur-dev/references/inline-pipeline-driver.md) run
-  setup step 5.
+  step 1 / [engine run setup](../skills/spur-dev/references/cross-cutting.md#shared-startup-contract-task-0814-r1r3r4r6r7r8) step 5.
 - Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface).
 - Apply the [shared startup contract](../skills/spur-dev/references/cross-cutting.md#shared-startup-contract-task-0814-r1r3r4r6r7r8) — publish the generated plan first, quick readiness before isolation, digest binding, comprehensive checks at their owning boundaries (task 0814 R1/R3/R4/R7/R8; 1105 R1).
-- Full pipeline (default `--mode full`): interactive omit/`--agent inline` uses the
-  [inline pipeline driver](../skills/spur-dev/references/inline-pipeline-driver.md) via
-  `Skill(skill="sp:spur-dev", args="run-inline $ARGUMENTS")`; `--agent auto` or a named executor
-  uses `Skill(skill="sp:spur-dev", args="run $ARGUMENTS")` and the workflow subprocess path.
+- Full pipeline (default `--mode full`): interactive omit/`--agent inline` runs
+  [the engine loop](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface)
+  with `executor=host` — `spur workflow run` returns a work item, this session performs it, and
+  `spur workflow continue <run-id> --answer-text <receipt>` advances the run; `--agent auto` or a
+  named executor runs the same definition as a child process. Both go through
+  `Skill(skill="sp:spur-dev", args="run $ARGUMENTS")`.
 - Implement step only (`--mode implement`): `Skill(skill="sp:code-implementation", args="$ARGUMENTS")`
 - After a full-mode run settles (done, failed or paused), print the
   [execution summary](../skills/spur-dev/references/dev-operations.md#execution-summary) unless `--no-summary`.

package/plugins/sp/commands/dev-runall.md

@@ -105,7 +105,7 @@ full distinction.
   freeze/order and digit children from `spur task batch-plan task-children` at task start —
   [execution-batch.md](../skills/spur-dev/references/execution-batch.md#27-visible-batch-plan-1105-r3)
   § 2.7 Visible batch plan.
-- Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface). Interactive sequential omit/`inline` keeps the orchestrator in the host session through the [inline pipeline driver](../skills/spur-dev/references/inline-pipeline-driver.md); the resolved selector applies uniformly — eligible `agent.run` stages dispatch once to a native subagent with host fallback (0508). `--agent auto`, a name, or parallel mode retains the isolated per-task workflow boundary.
+- Apply the [inline-default execution-surface contract](../skills/spur-dev/references/cross-cutting.md#inline-default-execution-surface). Interactive sequential omit/`inline` keeps the orchestrator in the host session through the engine loop (`spur workflow run --vars '{"executor":"host"}'` → work item → `spur workflow continue`); the resolved selector applies uniformly — eligible `agent.run` stages dispatch once to a native subagent with host fallback (0508). `--agent auto`, a name, or parallel mode retains the isolated per-task workflow boundary.
 - Apply the [shared startup contract](../skills/spur-dev/references/cross-cutting.md#shared-startup-contract-task-0814-r1r3r4r6r7r8) — publish the generated plan first, quick readiness before isolation, digest binding, comprehensive checks at owning boundaries (task 0814 R1/R3/R4/R7/R8; 1105 R1).
 - Interactive sequential omit/inline, and `--mode auto` without an explicit executor: `Skill(skill="sp:spur-dev", args="runall-inline $ARGUMENTS")` — auto resolves in the host after freeze/order (§ 2.4a) and hands a parallel resolution to the `runall` path with the frozen explicit WBS list.
 - Explicit executor (any mode, including `auto`) or parallel mode: `Skill(skill="sp:spur-dev", args="runall $ARGUMENTS")` → `sp:super-planner` agent.

package/plugins/sp/plugin.json

@@ -1,5 +1,5 @@
 {
     "name": "sp",
-    "version": "0.4.11",
+    "version": "0.4.12",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics."
 }

package/plugins/sp/skills/code-implementation/SKILL.md

@@ -104,7 +104,7 @@ surfaces is what keeps that gate quiet.
 ## Implement scope: do not run the project quality gate
 
 During implement, the pipeline's `test` hop runs `${vars.qualityGateCmd}` (the full project gate:
-`bun run spur-check`) immediately after this step and is the gate that actually
+`spur self exec check`) immediately after this step and is the gate that actually
 decides pass/fail. Running it inside implement is pure redundancy — it cannot change the outcome and
 only burns wall clock and context budget.
 
@@ -117,7 +117,7 @@ only burns wall clock and context budget.
   against a different tree. Same rule for the working directory: each shell call starts fresh, so
   re-select the execution tree inside the call (`cd -- "$TREE"` plus the identity check) instead of
   relying on a `cd` a previous call left behind.
-- **NEVER run** `bun run test`, `bun run spur-check`, `bun run check`, or any other full-suite /
+- **NEVER run** `spur self exec test`, `spur self exec check`, `bun run check`, or any other full-suite /
   project-gate command from inside implement. These belong to the pipeline's `test` hop.
 - **Full-suite budget: at most 2 per task** (task 0436 R2) — counted across the whole task run
   (implement probes + the pipeline `test` hop + verify/recheck), not per step. When a check fails,
@@ -153,7 +153,7 @@ changed no public surface, report the single line
   `env-var-hygiene` rule, and its siblings);
 - `bun run script-contract-check` when a plugin script was touched (a stale generated `.mjs` twin);
 - the paired-script parity test when `package.json` changed (a half-updated `spur-check` /
-  `spur-check-new` chain).
+  `spur-check:full` chain).
 
 The single full project check stays the pipeline `test` hop's job (see the section above); these are
 changed-path checks, not that gate.
@@ -163,8 +163,8 @@ changed-path checks, not that gate.
 "Run the narrow test first" needs a second half: *which* narrow tests, when a change to a shared
 surface can break a downstream consumer. The matrix below is dependency-aware — domain → app →
 CLI — so a shared change verifies its consumers without recreating the full project check inside
-implement. **It augments narrow behavior tests; it never authorizes `bun run spur-check`,
-`bun run test`, or another full project check inside implement** — the pipeline's `test` hop owns
+implement. **It augments narrow behavior tests; it never authorizes `spur self exec check`,
+`spur self exec test`, or another full project check inside implement** — the pipeline's `test` hop owns
 that single full gate.
 
 **Worker iteration check order (task 1142 R3):**
@@ -192,10 +192,10 @@ Neither step takes the full project gate. The full gate is named only for the pi
   `test` hop (`task-pipeline.yaml` `${vars.qualityGateCmd}`).
 - **Mirrored surfaces: an edit lands on all of them.** When the change is one instance of a repeated
   pattern — the same wiring rule on two runbooks, a signature in both a generator and its generated
-  `.d.mts`, a command chain in both `spur-check` and `spur-check-new` — grep for the siblings and
+  `.d.mts`, a command chain in both `spur-check` and `spur-check:full` — grep for the siblings and
   update each in this pass. Two H1-batch cycles (2026-10-08) were spent re-finding exactly this:
   task 1129 fixed the guard wiring on one runbook and left its sibling, and task 1127 changed
-  `spur-check` while `spur-check-new`'s chain-parity assertion still expected the old chain.
+  `spur-check` while its own chain-parity assertion still expected the old chain.
 
 ## Behavior
 

package/plugins/sp/skills/code-refactoring/SKILL.md

@@ -42,7 +42,7 @@ contracts, §11 invariants).
 | `--scope <path>` | Path bound; no edit may land outside it. | working tree (recent changes) |
 | `--focus <api\|architect\|tests\|ui\|auto>` | Lens set; comma list allowed. | `auto` |
 | `--fix <none\|blockers-first\|all>` | Apply policy. | `none` |
-| `--check <cmd>` | Baseline and per-fix verification command. | project gate (`bun run spur-check` when present) |
+| `--check <cmd>` | Baseline and per-fix verification command. | project gate (`spur self exec check` when bound) |
 | `--auto` | Skips **objective** gates only. | off |
 | free-text description | Steering for the lenses (e.g. "pagination consistency"). | — |
 

package/plugins/sp/skills/code-verification/SKILL.md

@@ -357,7 +357,7 @@ Verdict: PASS
 ```
 
 The per-requirement traceability table MUST use `| Req | Status | Evidence |` (exactly this header, no `R#`/`R`/`Requirement` variant — `Status` in column 2 — and no extra columns between Req and Status). The Acceptance Criteria table MUST use `| AC | Status | Evidence Type | Evidence |`.
-The answer carries no `Confidence:` line (F511, task 1207): model-asserted confidence is not verification — a verifier that can write a PASS can write `HIGH`. What the old level compressed now lives in the evidence cells themselves: cite fresh executable evidence and name residual gaps explicitly. Legacy answers that still carry a confidence line parse (the value is ignored); no lint code reads it and the artifact and recorded `## Testing` section carry no confidence value.
+The answer MUST carry exactly one top-level `Confidence: HIGH|MEDIUM|LOW` line (ADR-141): the lint *derives* the level from your own rows and rejects a mismatch (`confidence-missing` / `-duplicate` / `-mismatch`), so state the level your evidence earns — `HIGH` needs every AC row MET on `test`/`command`, a citation-only row makes it `MEDIUM`. Full rule: [verdict-schema](references/verdict-schema.md).
 The answer MUST cite a source for external API/library claims in Requirement/AC evidence cells: a cell asserting a scoped-package (`@scope/name`), `node_modules/`, semver-version (`x.y.z`), or backticked function-call (`` `name(args)` ``) claim is rejected with `evidence-citation` unless the SAME cell carries a citation — a repo `path:line(-end)` (backticked or bare), the external named-origin form (@origin `path` line N), or a URL. Cross-cell references ("receipt above") do not count; marker-free receipts ("bun test 398 pass / 0 fail") need no citation.
 **MUST NOT:** place a `Severity` column between `Req` and `Status`. The parser tolerates variants
 as defense-in-depth; this contract is canonical.

package/plugins/sp/skills/code-verification/references/secu-review.md

@@ -83,7 +83,7 @@ verdict artifact so quality failures are not lost behind a requirements-only PAS
 Before declaring a task `done`, run this lightweight checklist. It catches the most common oversights that survive the formal pipeline gates:
 
 - [ ] Check receipt `.spur/run/<wbs>-check-receipt.json` reports `reuse: true` for the current
-      digest via `spur task gate <wbs> status`; run `bun run spur-check` only when it reports stale or
+      digest via `spur task gate <wbs> status`; run `spur self exec check` only when it reports stale or
       missing (0940).
 - [ ] No `TODO` or `FIXME` without a linked task WBS.
 - [ ] `git status` shows only intentional changes (no debug artifacts, no temp files).

package/plugins/sp/skills/code-verification/references/verdict-schema.md

@@ -40,16 +40,29 @@ interface VerifyVerdict {
 }
 ```
 
-## No asserted confidence (F511, task 1207)
-
-Verdict artifacts carry no `confidence` field and verify answers no `Confidence:` line. The
-1068/1133 machinery that required, linted and coherence-checked a model-asserted
-`HIGH | MEDIUM | LOW` was retired: a verifier that can write a PASS can write `HIGH`, so the grade
-verifies nothing. What the level compressed belongs in the evidence cells — cite fresh executable
-evidence and name residual gaps explicitly. The done gate no longer denies a confidence-less PASS:
-it checks the proof digests, which are the part a hand-edited artifact cannot fake. The DERIVED
-confidence family is a different thing and stays: feature-verification receipts (ADR-131, 1196),
-the decision subsystem threshold, history-anatomy reading.
+## Answer confidence is derived and cross-checked (ADR-141, superseding F511 for answers)
+
+A verify answer carries exactly one top-level `Confidence: HIGH|MEDIUM|LOW` line — conventionally
+right after `Verdict:`, and legal anywhere at top level. The label is **not** a self-assessment: the
+lint recomputes it from the answer's own rows and rejects a disagreement.
+
+| Derived | When the answer's rows say so |
+| --- | --- |
+| `LOW` | the verdict is not PASS, or any requirement/AC row is PARTIAL/UNMET |
+| `HIGH` | PASS, and every AC row is MET on executable evidence (`test`/`command`; compounds allowed) |
+| `MEDIUM` | PASS with every AC MET, but at least one row rests on `static-ref`, `manual-review`, `llm-judge` or `N/A` |
+
+Rejections (`spur task verdict --from-answer`, exit 1, no artifact): `confidence-missing`,
+`confidence-duplicate`, `confidence-mismatch` — the last names both the stated and the derived level
+plus the clause the rows turn on. Derivation lives once, in
+`packages/app/src/services/answer-confidence.ts`; the review lane uses the same module for its own
+dispositions.
+
+Still retired and not revived by this: **verdict artifacts** carry no `confidence` field (the answer
+stays the record of truth, and a test pins the field's absence), feature-verification receipts keep
+no level (ADR-131, 1196), no operator `ackLowConfidence`-style var exists, and history-anatomy
+findings carry no per-finding grade. A verifier that can write a PASS can still write a wrong
+`HIGH` — which is exactly why the gate derives the level instead of trusting it.
 
 ## Compatibility alias: `scenario` row key
 

package/plugins/sp/skills/doc-evolve/SKILL.md

@@ -77,7 +77,7 @@ project's actual stack and scope. Invoked by `sp:spur-init` after scaffolding.
    routing Need keys — see `apps/cli/tests/fixtures/agents-md-portable-contract.ts`).
 
 **Done when:** no residual `{project-name}` / `{project-description}` in AGENTS.md; stack/build
-stubs filled or deliberately documented; `bun run lint` passes where applicable.
+stubs filled or deliberately documented; `spur self exec lint` passes where applicable.
 
 ## drift-audit (§7)
 

package/plugins/sp/skills/next-router/references/routing-table.md

@@ -115,7 +115,7 @@ token, deterministic).
 | Order | When evaluated | Probe | Signal | Redirect dispatch | Else |
 | --- | --- | --- | --- | --- | --- |
 | C1 | A1, A3, A5 (pre-implement / refine path) | `spur task check <wbs> --json` | Any **L3** finding on sections ∈ {Background, Requirements, Acceptance Criteria, Design, Plan} | Force `/sp:dev-refine <wbs> --auto` (**without** `--next` if already mid-refine; with `--next` only when status was backlog/todo and operator wants chain — default: keep `--next` for A1/A3) | continue |
-| C2 | A3, A5 after C1 clean | Cheap workspace health: `bun run lint` (or project lint) exit ≠ 0 **and** scope inferable from task Solution/Plan paths or default repo | lint/type failures | `/sp:dev-fixall` (optional `--scope` if single package known) | continue |
+| C2 | A3, A5 after C1 clean | Cheap workspace health: `spur self exec lint` exit ≠ 0 **and** scope inferable from task Solution/Plan paths or default repo | lint/type failures | `/sp:dev-fixall` (optional `--scope` if single package known) | continue |
 | C3 | A5/A6 when Testing empty/N/A **and** verify would fail for missing tests — only if prior implement claims code exists | Coverage/test signal: `bun test` fail attributed to task paths OR explicit "insufficient tests" in prior verify verdict artifact `.spur/run/<wbs>-verdict.json` | test fail / coverage gap | `/sp:dev-unit <wbs> --auto` | continue |
 | C4 | A3/A5/A6 when operator or task tags mention rules, OR `spur rule run` last report dirty in `.spur/` if present | `spur rule run` (default project preset) non-zero with findings | rule findings | **HITL STOP** — print rule summary; suggest `/sp:rule-scan` or `rule-add`/`rule-refine` (do not auto-author rules) | continue |
 | C5 | A6 only | Existing `.spur/run/<wbs>-verdict.json` with FAIL and findings pointing at coverage | verdict artifact | `/sp:dev-unit <wbs>` then re-verify on next invocation (`--once` friendly) | `/sp:dev-verify …` |