@gobing-ai/spur 0.4.15 → 0.4.16

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.4.15",
+            "version": "0.4.16",
             "source": "./plugins/sp"
         }
     ]

package/config/config.global.yaml

@@ -155,15 +155,28 @@ workflows:
 # catalogs. `paths` registers extra catalog folders (absolute or
 # project-relative); the first layer wins per file basename (ADR-113 style).
 # `maker` selects the default DecisionMaker for every decision point, and
-# `makers` overrides it per decision id. Built-in makers: typesafe, fm-local,
-# laya-local (laya-local needs Apple Silicon) and clef (hosted Cloudflare
-# Workers AI, registered only when CLOUDFLARE_ACCOUNT_ID and
-# CLOUDFLARE_AUTH_TOKEN are both set). An unregistered name is a config error,
-# never a silent fallback. Inspect the effective choice with
-# `spur decision status`. `init` never overwrites this file — until you add the
-# keys, the shipped catalog's maker applies (see `status`).
+# `makers` overrides it per decision id. The value is any maker name the
+# registry currently registers — the list lives in the CLI, not here, so
+# `spur decision status` (registeredMakers) is the authority, together with each
+# maker's own prerequisites (a local maker needs its local stack; a hosted maker
+# registers only when its credentials are set). An unregistered name is a config
+# error, never a silent fallback. Inspect the effective choice per decision with
+# the same command. `init` never overwrites this file — until you add the keys,
+# the shipped catalog's maker applies (see `status`).
 decisions:
     paths: []
     maker: typesafe
     # makers:
-    #     task-triage: laya-local
+    #     task-semantic-risk: laya-local
+    # What "the decision was right" means (task 1263 R5): per decision id, the recorded outcomes
+    # that count as correct for each served value. `String(value)` keys, so a yes/no decision uses
+    # "true"/"false". The outcome verb records them (`spur decision outcome <invocation-id> ...`);
+    # `spur decision status --reliability` scores accuracy against this map and reports null for a
+    # decision with no entry, rather than guessing.
+    outcomeMap:
+        failure-class:
+            fix: [fixed]
+            stop: [not-fixed]
+        task-semantic-risk:
+            "false": [none, p4, p3]
+            "true": [p1, p2]

package/config/decisions/executor.yaml

@@ -0,0 +1,53 @@
+$schema: "@gobing-ai/spur/schemas/decision-catalog.schema.json"
+# Executor-failure rescue catalog (feature P1, task 1264).
+#
+# The executor loop escalates on `FAILURE_RULES` matches only (0407 precision bias). Anything the
+# rules miss — a reworded rate limit, "credits depleted", a proxy error body — ends the run as a
+# task defect. This decision classifies ONLY that residue, after the rules and the terminal checks
+# (timeout, permission denial, confirmed quota) have had their say, and only while
+# `workflows.executorFailureDecisionMaker` is on. It ships off by default: shipping off routes
+# nothing, and turning it on is an operator call backed by replay evidence in task 1264's Q&A.
+#
+# Resolution: shared layer, overridable per basename through `.spur/decisions/` or
+# `decisions.paths` (first layer wins, ADR-113 style).
+version: 1
+
+defaults:
+    # Higher than the catalog floor: a false `resource-exhaustion` costs a failover attempt, and a
+    # false `task-defect` equals today's behaviour — so the uncertainty must resolve downward.
+    minConfidence: 0.85
+
+decisions:
+    executor-failure-class:
+        type: choice
+        description: Is an unmatched agent-dispatch failure resource exhaustion, an auth failure, or a task defect?
+        instructions: |
+            You are classifying why one agent dispatch exited non-zero, after every deterministic
+            rule already declined to classify it.
+            Failure output: ${params.instructions}
+            Answer `resource-exhaustion` only when the output states a provider-side capacity or
+            billing limit: a quota/credit/billing message, a 429 or rate-limit body, a token or
+            request budget, or an "overloaded"/"capacity" error. Answer `auth` only when the
+            output states a credential or authorization fault: an invalid/expired key or token, a
+            401/403 body, or a missing credential for the provider. Answer `task-defect` for
+            everything else: a compile or test failure, a missing file, a malformed prompt, a
+            socket/proxy error, or output that does not name a provider limit at all.
+            Classify only what the output says. Do not infer a vendor, and do not guess.
+        parameters:
+            wbs:
+                type: string
+                description: Task WBS the failing dispatch belongs to, when known.
+                # Optional: the executor seam knows only the run id, and a required param would
+                # reject every rescue before it reached a maker.
+                default: ""
+        criteria:
+            resource-exhaustion: >
+                The output names a provider-side limit — quota, credits, billing period, rate
+                limit, 429, token budget, or capacity.
+            auth: >
+                The output names a credential or authorization fault — invalid or expired key or
+                token, 401/403, or a missing credential.
+            task-defect: >
+                The output names no provider limit or credential fault — a code/test/file error, a
+                prompt problem, or a transport error that is not a provider quota.
+        fallback: task-defect

package/config/decisions/task-pipeline.yaml

@@ -1,11 +1,11 @@
 $schema: "@gobing-ai/spur/schemas/decision-catalog.schema.json"
-# Decision catalogs for the task pipeline (feature P / task 1092, ADR-134).
+# Decision catalogs for the task pipeline (feature P1, ADR-134).
 #
-# These entries mirror the inline decide actions that ship in
-# config/workflows/task-pipeline.yaml today — same questions, choices and
-# fallbacks — so their reliability can be measured with `spur decision run`
-# before feature P1 migrates the workflow actions onto them (design §3.5).
-# No workflow references this catalog yet.
+# The shipped `config/workflows/task-pipeline.yaml` decide actions reference these ids
+# (`failure-class`, and `task-semantic-risk` once its evidence bar is met). Each entry's
+# reliability is measured from recorded `decision.*` events — `spur decision status
+# --reliability` — and an adoption slice only keeps a decision point while that evidence
+# shows it adds information the deterministic guards do not.
 #
 # Resolution: this file ships in the shared layer (the installed package's
 # config/decisions/). A project can override it per basename through
@@ -17,39 +17,55 @@ defaults:
     minConfidence: 0.8
 
 decisions:
-    task-triage:
-        type: choice
-        description: Which verification lane does a green-gate diff deserve?
+    task-semantic-risk:
+        type: noul
+        description: >
+            Does this task's change set change behaviour a reviewer must reason about beyond what
+            the diffstat already shows? (false projects the fast lane, true or a fallback the
+            standard lane.)
+        instructions: |
+            You are classifying one Spur task's change set for review depth.
+            Change set: ${params.instructions}
+            Answer true when the change alters behaviour a reviewer must reason about: control
+            flow, a data shape, persistence, security, an external contract, or error handling.
+            Answer false only when the change is mechanical — docs, comments, formatting, renames,
+            test-only edits, or a dependency bump with no source edit.
+            Judge the change set only; do not score its quality or estimate its size.
         parameters:
             wbs:
                 type: string
-                description: Task WBS the diff belongs to.
+                description: Task WBS whose change set is being classified.
         criteria:
-            low: Small, contained diff — the fast lane is enough.
-            standard: Ordinary diff — the standard verification lane applies.
-            high: Broad or risky diff — verify with high caution.
-        fallback: standard
+            "true": >
+                The change set touches executable behaviour — a branch, a boundary, a stored
+                schema, a public signature, or a failure path — so a reviewer must read the diff,
+                not only its diffstat.
+            "false": >
+                The change set is mechanical — docs, comments, formatting, renames, test-only
+                edits, or a version bump with no executable change — so the diffstat is enough.
+        fallback: true
 
     failure-class:
         type: choice
         description: Is a failed quality gate fixable by the repair agent, or should the run stop?
+        instructions: |
+            You are classifying one failed quality-gate run for Spur's task pipeline.
+            Gate output: ${params.instructions}
+            Answer `fix` when the output names a concrete defect inside this repository that the
+            repair agent can act on: a failing test with an expected/actual diff, a type error
+            naming a file and symbol, a lint rule id with a file:line, or a missing export or
+            import. Answer `stop` when the failure is environmental or not repairable by editing
+            this tree: a missing tool or binary, a permission or disk error, a network or registry
+            failure, a gate timeout, or output that names no in-tree file.
         parameters:
             wbs:
                 type: string
                 description: Task WBS whose gate failed.
         criteria:
-            fix: The failure looks fixable — send it to the repair agent.
-            stop: The failure is not mechanically fixable — stop the run for the operator.
-        fallback: fix
-
-    review-failure-class:
-        type: choice
-        description: Is a non-PASS review fixable by the repair agent, or should the run stop?
-        parameters:
-            wbs:
-                type: string
-                description: Task WBS whose review did not certify PASS.
-        criteria:
-            fix: The findings look fixable — send them to the repair agent.
-            stop: The findings are not mechanically fixable — stop the run for the operator.
+            fix: >
+                The output names an in-tree defect — a failing test, a type error with a file and
+                symbol, a lint rule id with a file:line, or a missing import.
+            stop: >
+                The output names no in-tree defect — a missing tool, a permission or disk error,
+                a network or registry failure, or a timeout — so editing the tree cannot fix it.
         fallback: fix

package/config/workflows/task-pipeline.yaml

@@ -396,7 +396,7 @@ states:
     # (probe-then-full), `deferred` under the opt-in batch policy.
     #
     # The three former routing states are decision CALLS here and in `review` (D65 1239 R1):
-    # the lane decision (0943 R1/R2, catalog `task-triage`) picks the review depth, and the
+    # the lane decision (0943 R1/R2, catalog `task-semantic-risk`, 1262 R5) picks the review depth, and the
     # gate's own failure class (catalog `failure-class`) drives the red-gate transitions.
     # Both run unconditionally — the engine has no onEnter conditionals — and both degrade to
     # their catalog fallback with no model call while `workflows.decideDecisionMaker` is off.
@@ -407,7 +407,7 @@ states:
           title: Run quality gate
       description: >
           Typed quality gate: resolve the task path/priority, produce the diffstat lane
-          evidence, consult `task-triage` for the review depth (deterministic safety floor
+          evidence, consult `task-semantic-risk` for the review depth (deterministic safety floor
           first), run `${vars.qualityGateCmd}` through `spur task gate <wbs> <mode>` under the
           host-wide lock (tree-hash receipt reuse on the same tree), then classify a red gate
           through `failure-class`. Writes the typed outcome to
@@ -446,27 +446,30 @@ states:
             options:
                 command: >-
                     mkdir -p .spur/run; if [ -n "$mode" ]; then printf '%s\n' "$mode" > ".spur/run/$wbs-mode.txt"; exit 0; fi; DF=".spur/run/$wbs-diffstat.json"; if ! jq -e 'type == "object"' "$DF" >/dev/null 2>&1; then printf 'safety\n' > ".spur/run/$wbs-mode.txt"; exit 0; fi; jq -r 'if .sensitive == true or ((.insertions // 0) + (.deletions // 0)) > 400 then "safety" else empty end' "$DF" 2>/dev/null > ".spur/run/$wbs-mode.txt"; exit 0
-          # (d) lane decision — degrades to the standard default whenever
-          # workflows.decideDecisionMaker is off, so with the flag off the pipeline makes no
-          # model call (1114/1116: the bundled catalog owns question, choices and fallback).
+          # (d) lane decision (1262 R5) — one narrow question: does this change set alter
+          # behaviour beyond its diffstat? `false` projects the fast lane; `true` or the catalog
+          # fallback projects standard. Degrades to that fallback with no model call whenever
+          # workflows.decideDecisionMaker is off (the bundled catalog owns question, criteria and
+          # fallback), and `skipWhenEvidenceEmpty` keeps a missing diffstat from costing a call.
           - kind: decide
             options:
-                id: task-triage
-                decision: task-triage
+                id: task-semantic-risk
+                decision: task-semantic-risk
                 params:
                     wbs: ${vars.wbs}
                 evidence:
                     - .spur/run/${vars.wbs}-diffstat.json
                     - ${vars.taskSpecPath}
-                resultFile: .spur/run/${vars.wbs}-triage.decision
-          # (d) project the decision and append the triage route reason (1007 R3: the
-          # non-empty mode file is never overridden; the append keeps the failure signal of the
-          # original pair). low → fast lane; anything else (standard/high, degraded default,
-          # missing row) stays empty → the standard review path.
+                skipWhenEvidenceEmpty: true
+                resultFile: .spur/run/${vars.wbs}-semantic-risk.decision
+          # (d) project the decision and append the route reason (1007 R3: the non-empty mode
+          # file is never overridden; the append keeps the failure signal of the original pair).
+          # `no` (a noul row stores the label, not a boolean) → fast lane; anything else (`yes`,
+          # degraded default, missing row) stays empty → the standard review path.
           - kind: shell
             options:
                 command: >-
-                    MF=".spur/run/$wbs-mode.txt"; [ -s "$MF" ] || jq -r 'if .value == "low" then "fast" else empty end' ".spur/run/$wbs-triage.decision" 2>/dev/null > "$MF"; m="$(cat "$MF")"; RUN_ID="$__runId"; [ -n "$RUN_ID" ] || RUN_ID="pipeline-$wbs"; mkdir -p .spur/memory; printf '%s %s %s\n' "$RUN_ID" "$wbs" "$(jq -rn --arg m "$m" --arg c "$mode" 'if $c != "" then ($c + ":caller-set") else {"fast":"fast:triage low lane","safety":"safety:triage deterministic-high","":"safety:triage standard lane"}[$m] // "safety:triage unrecognized mode" end')" >> .spur/memory/task-pipeline-routes.log
+                    MF=".spur/run/$wbs-mode.txt"; [ -s "$MF" ] || jq -r 'if (.value == false or .value == "no") then "fast" else empty end' ".spur/run/$wbs-semantic-risk.decision" 2>/dev/null > "$MF"; m="$(cat "$MF")"; RUN_ID="$__runId"; [ -n "$RUN_ID" ] || RUN_ID="pipeline-$wbs"; mkdir -p .spur/memory; printf '%s %s %s\n' "$RUN_ID" "$wbs" "$(jq -rn --arg m "$m" --arg c "$mode" 'if $c != "" then ($c + ":caller-set") else {"fast":"fast:semantic-risk mechanical change","safety":"safety:deterministic-high","":"safety:standard lane"}[$m] // "safety:unrecognized mode" end')" >> .spur/memory/task-pipeline-routes.log
           # (d) review depth from the resolved lane (D65 1239 R2): the fast lane reviews the
           # requirement/AC traceability only — that table is the certification input, so the
           # cheap lane never drops the evidence, it drops the SECUA/architecture passes.
@@ -515,6 +518,14 @@ states:
                 args: ["task", "gate", "${vars.wbs}", "${vars.gateMode}", "--no-logo"]
                 resultFile: .spur/run/${vars.__runId}-gate.status
                 softFail: true
+          # (d) record what the PREVIOUS gate visit's failure-class answer turned out to be
+          # (1263 R3a): a recheck visit means the last class was `fix` and the repair hop ran, so
+          # this visit's gate status says whether it was right. First write wins, the step never
+          # changes routing, and a missing invocationId (degraded row) or a first visit is a no-op.
+          - kind: shell
+            options:
+                command: >-
+                    [ "$gateMode" = recheck ] || exit 0; ID="$(jq -r '.invocationId // empty' ".spur/run/$wbs-failure-class.decision" 2>/dev/null)"; [ -n "$ID" ] || exit 0; $spurBin decision outcome "$ID" --gate-status "$__runId" --source gate-recheck --no-logo >/dev/null 2>&1; exit 0
           # (d) failure class of the gate this visit produced (0943 R3): stop → failed
           # before the cap can mislabel it, fix → the bounded remediation hop. A missing or
           # corrupt row fails closed to failed-check. Runs unconditionally (no onEnter
@@ -528,6 +539,9 @@ states:
                     wbs: ${vars.wbs}
                 evidence:
                     - .spur/run/${vars.wbs}-test-gate.findings
+                # 1262 R4: a green gate writes a 0-byte findings file — there is nothing to read,
+                # so the row degrades to the catalog `fix` fallback with no maker call and no events.
+                skipWhenEvidenceEmpty: true
                 resultFile: .spur/run/${vars.wbs}-failure-class.decision
 
     # ── remediate hop (bounded repair; former `test-fix`) ─────────────────────
@@ -557,15 +571,17 @@ states:
             options:
                 command: >-
                     printf '%s\n' "$(( $(cat ".spur/run/$wbs-test-fix-attempt" 2>/dev/null || echo 0) + 1 ))" > ".spur/run/$wbs-test-fix-attempt"; [ -f ".spur/run/$wbs-residuals.json" ] && echo '--- residual artifact (F96 fix targets; deferrals go to residual-deferrals.json, P3/markers only) ---' >> ".spur/run/$wbs-test-gate.log" && cat ".spur/run/$wbs-residuals.json" >> ".spur/run/$wbs-test-gate.log"; exit 0
-          # Review-lane input: the review failure class routes a non-PASS review into this same
-          # bounded repair hop, but it stages no gate evidence — the fixer would receive a GREEN
-          # gate log and an empty findings list. Project the reviewer's answer into the same log
-          # the other lane uses, and only on the review lane (the decision file exists only
-          # after a review FAIL). Own action, not an append to the one above (ADR-115 cap).
+          # Review-lane input: a non-PASS review status routes into this same bounded repair hop
+          # (1262 R6), but it stages no gate evidence — the fixer would receive a GREEN gate log
+          # and an empty findings list. Project the reviewer's answer into the same log the other
+          # lane uses, and only on the review lane: remediate after a GREEN gate this run means
+          # review sent it. The review status file is no lane marker — it outlives its review, so
+          # a red recheck after a review repair would re-feed that stale answer.
+          # Own action, not an append to the one above (ADR-115 cap).
           - kind: shell
             options:
                 command: >-
-                    [ -f ".spur/run/$wbs-review-failure-class.decision" ] && [ -f ".spur/run/$__runId-review-answer.txt" ] && echo '--- review verdict (remediation input, review lane) ---' >> ".spur/run/$wbs-test-gate.log" && cat ".spur/run/$__runId-review-answer.txt" >> ".spur/run/$wbs-test-gate.log"; exit 0
+                    [ "$(cat ".spur/run/$__runId-gate.status" 2>/dev/null)" = PASS ] && [ -f ".spur/run/$__runId-review-answer.txt" ] && echo '--- review verdict (remediation input, review lane) ---' >> ".spur/run/$wbs-test-gate.log" && cat ".spur/run/$__runId-review-answer.txt" >> ".spur/run/$wbs-test-gate.log"; exit 0
           # R3 (0482): project the extracted gate anchors into a var so the dispatch input
           # can NAME the failing file:line, not merely point at a log. A vars template cannot
           # run a shell, so the read is an action, not an inline `$(cat ...)` substitution.
@@ -630,21 +646,29 @@ states:
                 # spec than the implement stage recorded in __agentRouting_implement.
                 # 0943 R1/R2: `--focus` carries the resolved lane depth — `functional` for the
                 # fast lane (traceability, which is the certification input), `all` otherwise.
-                # D65 1240: this answer IS the certification input — `spur task verdict --from-answer`
+                # D65 1240 + 1254: this answer IS the certification input — `spur task verdict --from-answer`
                 # derives the run's verdict from its requirement rows, so the answer contract is part
                 # of the prompt. A report body ending with a `| WBS | Verdict | P1 | … |` summary and
                 # no per-requirement rows derives UNKNOWN and can never certify, which looped every
                 # run through review -> remediate.
+                # 1254: the review emits TWO artifacts with different consumers — the `## Review`
+                # section (finding dispositions, deriveReviewConfidence) and this captured answer
+                # (requirement/AC evidence, deriveVerifyConfidence). The prompt has to teach both
+                # lanes and the fact that a single `Confidence:` line may only carry the second one.
+                # 1254: the prompt stays inside the 1000-char composition cap — the full
+                # contract (tables, vocabularies, the two confidence lanes, AC identity vs
+                # feature credit) is owned by `plugins/sp/agents/super-reviewer.md` Output Format,
+                # which this pointer names.
                 input: >-
-                    /sp:dev-review --tasks ${vars.wbs} --auto --focus ${vars.reviewFocus}
-                    Answer contract (machine-read): end with exactly one plain `Verdict: PASS|FAIL`
-                    line, preceded by a `| Req | Status | Evidence |` table with one row per
-                    requirement (R1, R2, ...) and a `| AC | Status | Evidence Type | Evidence |` table
-                    with one row per acceptance criterion, and one `Confidence: HIGH|MEDIUM|LOW` line
-                    whose level YOUR finding dispositions derive (ADR-141: no open P1-P3 and no
-                    carried residual is HIGH; a carried residual is MEDIUM; an open P1-P3 or a
-                    non-PASS verdict is LOW) — the gate recomputes it and rejects a disagreement.
-                    Every row cites a repo-relative `path:line`; no row may be omitted or merged.
+                    /sp:dev-review --tasks ${vars.wbs} --auto --focus ${vars.reviewFocus} Answer contract (full: super-reviewer Output
+                    Format). Two artifacts: the `## Review` section (dispositions, deriveReviewConfidence) and your captured answer
+                    (certification input for `spur task verdict`). The answer has one `Confidence: HIGH|MEDIUM|LOW` line, EVIDENCE-derived
+                    (deriveVerifyConfidence), never the section's disposition level. End with one `Verdict: PASS|PARTIAL|FAIL` line
+                    preceded by `| Req | Status | Evidence |` (one row per requirement; MET | PARTIAL | UNMET) and `| AC | Status |
+                    Evidence Type | Evidence |` (one row per AC; MET | PARTIAL | UNMET | N/A). Evidence types (`+` compound allowed): test
+                    | command | static-ref | manual-review | llm-judge | n/a. Evidence cells cite `path:line` or a named check. AC rows
+                    key on the task's identities or a declared `AC-N` alias; a linked scenario covers its task and a task-local criterion
+                    needs no feature credit. Open P1-P3 blocks completion.
                 # The captured review answer is the run's certification input (and the
                 # `task verdict` input below): expectFile fails the step when no answer landed.
                 answerFile: .spur/run/${vars.__runId}-review-answer.txt
@@ -681,21 +705,14 @@ states:
             options:
                 command: >-
                     mkdir -p .spur/run; S=FAIL; if [ "$(cat ".spur/run/$__runId-review-verdict.status" 2>/dev/null)" = PASS ] && [ "$(jq -r '.verdict // empty' ".spur/run/$wbs-verdict.json" 2>/dev/null)" = PASS ] && $spurBin task residual "$wbs" review-gate --no-logo >&2; then S=PASS; fi; printf '%s\n' "$S" > ".spur/run/$wbs-review.status"; exit 0
-          # (d) review failure class (session finding after 1088): stop → failed before the cap
-          # can mislabel it, fix → the SAME bounded repair hop the red gate uses, so the
-          # iteration bound stays finite across both lanes. Degrades to the catalog `fix`
-          # fallback with no model call while the decision switch is off; a missing/corrupt row
-          # fails closed to failed-check.
-          - kind: decide
+          # (d) record the review severity as the lane decision's outcome (1263 R3b): the
+          # question `task-semantic-risk` answered is "is this risky?", and the Review table's
+          # worst finding is the answer as observed. Resolved rows count (a fixed P2 was still
+          # risky). First write wins, so a later review visit changes nothing.
+          - kind: shell
             options:
-                id: review-failure-class
-                decision: review-failure-class
-                params:
-                    wbs: ${vars.wbs}
-                evidence:
-                    - .spur/run/${vars.__runId}-review-answer.txt
-                    - ${vars.taskSpecPath}
-                resultFile: .spur/run/${vars.wbs}-review-failure-class.decision
+                command: >-
+                    [ -f ".spur/run/$wbs-semantic-risk.decision" ] || exit 0; ID="$(jq -r '.invocationId // empty' ".spur/run/$wbs-semantic-risk.decision" 2>/dev/null)"; [ -n "$ID" ] || exit 0; $spurBin decision outcome "$ID" --review-severity "$wbs" --source "task-pipeline review" --no-logo >/dev/null 2>&1; exit 0
           # (d) Operator approval as a DECISION POINT, not a state (D65 1239 R1/R5, ADR-140
           # item 5): interactively the operator responder answers; under `profile=auto` the
           # declared binding answers (evidence status var, catalog fallback when the maker
@@ -1010,15 +1027,6 @@ transitions:
           kind: shell
           options:
               command: 'test "$(cat ".spur/run/$wbs-approval.status" 2>/dev/null)" = DENIED'
-    - from: review
-      to: failed
-      terminalReason: failed-check
-      description: Review failure class stop — the run terminates at failed, never bypassed.
-      guard:
-          kind: shell
-          options:
-              command: >-
-                  jq -e '.value == "stop"' ".spur/run/$wbs-review-failure-class.decision" >/dev/null 2>&1
     - from: review
       to: failed
       terminalReason: retry-exhausted
@@ -1031,12 +1039,16 @@ transitions:
                   test "$fix_attempts" -ge "$qualityGateMaxFixAttempts"
     - from: review
       to: remediate
-      description: Review failure class fix and under the cap — the shared bounded repair hop, then gate → review on the remediated tree.
+      description: Review did not certify and the attempt cap still allows a repair — the shared bounded repair hop, then gate → review on the remediated tree.
       guard:
           kind: shell
           options:
+              # 1262 R6: no decision row and no model call. The review status file is the whole
+              # signal — it exists and is not PASS — and the cap guard above already bounds the
+              # loop, so a non-PASS review always has exactly one forward route.
               command: >-
-                  jq -e '.value == "fix"' ".spur/run/$wbs-review-failure-class.decision" >/dev/null 2>&1
+                  test -f ".spur/run/$wbs-review.status" &&
+                  test "$(cat ".spur/run/$wbs-review.status" 2>/dev/null)" != PASS
     # Defense: a review that did not certify and no clearer route — fail closed instead of
     # dead-ending the run (a FAIL, PARTIAL, missing or unparseable certification lands here).
     - from: review

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.4.15",
+    "version": "0.4.16",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",
@@ -32,6 +32,7 @@
     "files": [
         "spur.js",
         "config",
+        "worker",
         "schemas",
         "board",
         "web",
@@ -49,7 +50,7 @@
         "dev": "bun run src/index.ts",
         "build": "bun run ../../scripts/spur-dev.ts build-cli",
         "build:binaries": "bun run ../../scripts/spur-dev.ts build-binaries",
-        "build:bundle": "bun run ../../scripts/spur-dev.ts bundle-web && bun run ../../scripts/spur-dev.ts emit-board-types && bun build src/index.ts --target=bun --outfile spur.js --external @johnhenry/backend-webgpu && bun run ../../scripts/spur-dev.ts bundle-config config && bun run ../../scripts/spur-dev.ts bundle-plugins",
+        "build:bundle": "bun run ../../scripts/spur-dev.ts bundle-web && bun run ../../scripts/spur-dev.ts emit-board-types && bun build src/index.ts --target=bun --outfile spur.js --external @johnhenry/backend-webgpu && bun run ../../scripts/spur-dev.ts bundle-config config && bun run ../../scripts/spur-dev.ts bundle-laya-worker && bun run ../../scripts/spur-dev.ts bundle-plugins",
         "test": "bun test tests --coverage --coverage-dir=../../.coverage --pass-with-no-tests",
         "typecheck": "tsc --noEmit",
         "prepack": "bun run build:bundle",
@@ -57,14 +58,14 @@
     },
     "devDependencies": {
         "@commander-js/extra-typings": "^14.0.0",
-        "@gobing-ai/ts-db": "^0.5.30",
-        "@gobing-ai/ts-ai-runner": "^0.5.30",
-        "@gobing-ai/ts-dual-workflow-engine": "^0.5.30",
-        "@gobing-ai/ts-infra": "^0.5.30",
-        "@gobing-ai/ts-llm-jsonl-importer": "^0.5.30",
-        "@gobing-ai/ts-rule-engine": "^0.5.30",
-        "@gobing-ai/ts-runtime": "^0.5.30",
-        "@gobing-ai/ts-utils": "^0.5.30",
+        "@gobing-ai/ts-db": "^0.5.32",
+        "@gobing-ai/ts-ai-runner": "^0.5.32",
+        "@gobing-ai/ts-dual-workflow-engine": "^0.5.32",
+        "@gobing-ai/ts-infra": "^0.5.32",
+        "@gobing-ai/ts-llm-jsonl-importer": "^0.5.32",
+        "@gobing-ai/ts-rule-engine": "^0.5.32",
+        "@gobing-ai/ts-runtime": "^0.5.32",
+        "@gobing-ai/ts-utils": "^0.5.32",
         "@types/bun": "1.4.3",
         "@types/figlet": "^1.7.0",
         "@types/node-notifier": "8.0.5",

package/plugins/sp/README.md

@@ -29,7 +29,7 @@ One feature, start to finish — see the Command index below for exact command n
 ```
 idea/plan  vague description → feature + AC + decomposed task batch
      ↓
-run        <wbs>  → pipeline: precheck → implement → test → review → approve(HITL) → verify → record → done
+run        <wbs>  → pipeline: precheck → implement → gate ⇄ remediate → review → done  (decision points route repair, stop and approval)
      ↓
 verify     <wbs>  → traceability + AC verdict (PASS clears the gate; this also runs inside the run step)
      ↓

package/plugins/sp/agents/expert-spur.md

@@ -42,6 +42,9 @@ Use for:
   ladder, trace-driven rule tuning, and applying accepted doctor proposals.
 - Evaluation and reflection campaigns via `sp:spur-doctor`: read-only evidence, history-finding
   reflection, and a proposal table.
+- Decision campaigns: catalog health and reliability audits (`spur decision status --json`,
+  `--reliability`, `--probe`) through `sp:spur-doctor`'s decision flags, and new or tuned decision
+  points through the decision lifecycle and `sp:spur-composer` (shared ids need operator consent).
 
 One bounded campaign per dispatch. Do not use for one CLI invocation. Do not use for
 planning→implementation→verification lifecycle or batch task execution; `sp:spur-dev` owns that

package/plugins/sp/agents/super-planner.md

@@ -89,6 +89,9 @@ You own the spaces **between** task runs:
   timeout prints one checkpoint and exits 1; the run continues, never cancelled or relaunched) plus
   `.spur/run/<wbs>-verdict.json`, accepted only when the trace's `.run.runId` equals the dispatched
   run and the verdict's mtime ≥ the trace's `.run.startedAt` — otherwise `stale-evidence` (Step 3.3).
+  A `failed` run's cause is its decision row (`failure-class` / `review-failure-class` = `stop`, or
+  approval `DENIED`); report it per [reporting a run](../skills/spur-dev/references/decision-points.md#reporting-a-run)
+  and do not re-judge it before recovery.
 - **One-shot recovery (optional)** - on non-PASS / stuck status, consult next-router **once** for that
   WBS (`recoveryHint` / dry-run plan): print the child command, or dispatch once only when the batch
   was started with `--auto` and cardinality is 1. Never self-loop until done.
@@ -135,7 +138,8 @@ Your decision-autonomy is **at the batch level**, bounded by the global Decision
 | Continue/halt between task runs | Whether to auto-approve a HITL gate inside a task (only `--auto` does, via `vars.profile`) |
 
 Surface blockers/HITL **only at the batch boundary** (between task runs). A pipeline run that pauses
-on its internal HITL `approve` gate (under the default profile) is surfaced to the operator as a
+on its `review`-state approval decision point (interactive profiles only; under `profile=auto` the
+decision point answers itself, and a deferred answer is no objection) is surfaced to the operator as a
 batch-level event: "task 0042 is awaiting approval - `spur workflow continue <run-id> --yes` to
 approve, or provide feedback". You do not answer the gate from inside a step.
 

package/plugins/sp/agents/super-reviewer.md

@@ -70,8 +70,10 @@ Only when invoked under the pipeline do blocker/major findings block a gate.
 
 Invoked by `task-pipeline.yaml`'s `review` step. The pipeline hands you the task WBS and the
 `--focus` dimensions. You run the review, write findings to the task's `## Review` section, and
-return a PASS/PARTIAL/FAIL verdict to the pipeline's `approve(HITL)` gate. `blocker`/`major`
-findings block the gate; `minor`/`advisory` are recorded but do not block.
+return a PASS/PARTIAL/FAIL verdict. `spur task verdict` certifies the answer; a PASS then reaches the
+approval decision point before `done`, and a non-PASS feeds the `review-failure-class` decision
+(`fix` → `remediate`, `stop` → `failed`). `blocker`/`major` findings block certification;
+`minor`/`advisory` are recorded but do not block.
 
 ### Multi-target coordination (task 1023)
 
@@ -181,11 +183,11 @@ with the commit) drops the row from the sweep; `DEFER(<reason>)` reclassifies a
 the cell, not the sentence. `OPEN` states "still live", and `ACCEPTED` marks a non-blocking P4
 observation you are deliberately not acting on; both behave as an ordinary open row.
 
-**Pipeline cost of an open finding (1122).** The review PASS edges run this same classification
-before verify (`spur task residual <wbs> review-gate`): a PASS whose table still carries an open P1-P3 row
-routes into `review-fail-triage` → the bounded repair hop instead of verify. Open P1-P3 findings
-block `done`; fixing one invalidates the certified digest and re-runs quality → review → verify on
-a fresh digest. Only P4 rows and `DEFER`-ed P3 rows are wrap residuals — disposition the finding in
+**Pipeline cost of an open finding (1122).** The review certification runs this same classification
+(`spur task residual <wbs> review-gate`): a PASS whose table still carries an open P1-P3 row is a
+non-PASS review, so the `review-failure-class` decision routes it to `remediate` instead of `done`.
+Open P1-P3 findings block `done`; fixing one invalidates the certified digest and re-runs
+gate → review on a fresh digest. Only P4 rows and `DEFER`-ed P3 rows are wrap residuals — disposition the finding in
 its cell now, while you hold the context, instead of leaving the cost to be rediscovered after a
 full cycle.
 
@@ -220,9 +222,9 @@ shallower.
 ```
 
 The **Verdict line is machine-read** by the task pipeline (session finding after 1088): `review →
-verify|approve` requires a line matching `Verdict: PASS` (plain or bold), and ANYTHING ELSE —
-FAIL, PARTIAL, a missing line, a line split across two lines — routes the run into
-`review-fail-triage` and its bounded repair hop. Keep it on one line, in that shape, in every
+done` requires a line matching `Verdict: PASS` (plain or bold), and ANYTHING ELSE —
+FAIL, PARTIAL, a missing line, a line split across two lines — routes the run through the
+`review-failure-class` decision into the bounded `remediate` hop. Keep it on one line, in that shape, in every
 review answer; never restate it as prose only.
 
 **State `Confidence: HIGH | MEDIUM | LOW` — the gate derives it from your dispositions (ADR-141).**
@@ -243,6 +245,35 @@ No verdict-artifact field, no receipt level, no per-finding grade, and no operat
 (ADR-138 stands for every other carrier). Evidence gaps still belong in the report body: name them,
 then let the dispositions decide the level.
 
+**Two artifacts, one `Confidence:` line each (1254).** The body you write into `### Review` states
+the disposition-derived level above. When the pipeline also captures your final answer as the
+certification input for `spur task verdict`, that text is a *second* artifact with a *different*
+consumer, and it carries the **evidence-derived** level (`deriveVerifyConfidence`): PASS with every
+AC row MET on executable evidence (`test`/`command`) is HIGH; a citation-only (`static-ref`),
+`manual-review`, `llm-judge` or `N/A` AC is MEDIUM; a non-PASS verdict or any PARTIAL/UNMET row is
+LOW. It ends with exactly one plain `Verdict: PASS|PARTIAL|FAIL` line preceded by both tables, in
+this exact shape:
+
+| Req | Status | Evidence |
+| --- | --- | --- |
+| R1 | MET | `src/api/users.ts:42` |
+
+| AC | Status | Evidence Type | Evidence |
+| --- | --- | --- | --- |
+| AC1 — the guard rejects an unsafe input | MET | test | `packages/app/tests/guard.test.ts:12` |
+
+One row per declared requirement (`MET | PARTIAL | UNMET`, none omitted or merged) and one row per
+acceptance criterion (`MET | PARTIAL | UNMET | N/A`), with the evidence-type token alone in its own
+cell — `test | command | static-ref | manual-review | llm-judge | n/a`, or a `+` compound when more
+than one kind applies. Evidence cells cite a repo-relative `path:line` or a named test/command. AC
+identities stay the task's own (checklist label, title, bold head, `Scenario:` prefix, bracket tag or
+declared `AC-N` alias): a linked feature's scenario title covers the task that implements it, and a
+task-local criterion is legal as-is — it needs no feature credit.
+Never repeat the section's disposition-derived `Confidence:` line here: a second `Confidence:` line is
+a `confidence-duplicate` rejection of the whole answer, and so is a level the rows do not derive. A
+PASS with executable AC and one accepted P4 therefore certifies as `Confidence: HIGH` in the answer
+while the section keeps `Confidence: MEDIUM`.
+
 **Source citations for external claims (one claim contract, 2026-10-12).** A Finding cell or a
 Functional Traceability `Evidence` cell that asserts an external API/library claim carries a
 verifiable citation in the SAME cell — a repo `path:line(-end)`, the external named-origin form
@@ -258,8 +289,8 @@ as an explicit gap in the report body (above), so a reader can re-check it.
 
 **Machine-checked at the gate (findings table).** `spur task residual <wbs> review-gate` applies the same two
 predicates to every finding row: a Finding cell carrying one of the verify lint's claim markers with
-no citation form becomes a **blocking** `review-contract` item, so `review → verify` stops and the
-run enters `review-fail-triage`. The `Location` column is deliberately not consulted as a citation —
+no citation form becomes a **blocking** `review-contract` item, so `review → done` stops and the
+run enters the `review-failure-class` decision. The `Location` column is deliberately not consulted as a citation —
 that is the rule stated above, and a gate that accepted it would pass every row that has an anchor.
 Functional Traceability `Evidence` cells stay reviewer-enforced (SECUA review): they are free prose
 in a table the gate does not parse.