@gobing-ai/spur 0.4.18 → 0.4.19

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.4.18",
+            "version": "0.4.19",
             "source": "./plugins/sp"
         }
     ]

package/config/workflows/task-pipeline.yaml

@@ -701,10 +701,15 @@ states:
           # PASS, and a clean review gate (open P1-P3 finding or an uncited claim blocks it).
           # Fail-closed: any missing/corrupt input leaves FAIL, so the transitions can route a
           # non-PASS review into remediation instead of dead-ending the run.
+          # Idempotent re-entry: the answer file is consumed as a stage input, so a second visit to
+          # this state has no answer to re-judge. An ABSENT answer is not new evidence against a
+          # PASS — the durable `<wbs>-verdict.json` and the residual gate still have to pass — so the
+          # run-scoped verdict status is consulted only when an answer is actually present (without
+          # this, re-entry overwrote a PASS with FAIL and closed the task's run as `failed`).
           - kind: shell
             options:
                 command: >-
-                    mkdir -p .spur/run; S=FAIL; if [ "$(cat ".spur/run/$__runId-review-verdict.status" 2>/dev/null)" = PASS ] && [ "$(jq -r '.verdict // empty' ".spur/run/$wbs-verdict.json" 2>/dev/null)" = PASS ] && $spurBin task residual "$wbs" review-gate --no-logo >&2; then S=PASS; fi; printf '%s\n' "$S" > ".spur/run/$wbs-review.status"; exit 0
+                    mkdir -p .spur/run; S=FAIL; if [ ! -f ".spur/run/$__runId-review-answer.txt" -o "$(cat ".spur/run/$__runId-review-verdict.status" 2>/dev/null)" = PASS ]; then [ "$(jq -r '.verdict // empty' ".spur/run/$wbs-verdict.json" 2>/dev/null)" = PASS ] && $spurBin task residual "$wbs" review-gate --no-logo >&2 && S=PASS; fi; printf '%s\n' "$S" > ".spur/run/$wbs-review.status"; exit 0
           # (d) record the review severity as the lane decision's outcome (1263 R3b): the
           # question `task-semantic-risk` answered is "is this risky?", and the Review table's
           # worst finding is the answer as observed. Resolved rows count (a fixed P2 was still

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.4.18",
+    "version": "0.4.19",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",

package/plugins/sp/README.md

@@ -536,14 +536,18 @@ block/ask prints one JSON object that superskill renders per host:
 targets:
 
 - Codex, OpenCode, Antigravity and Hermes get only `scripts/`, staged as
-  `.agents/scripts/sp/`, with `lib/` beside it as `.agents/scripts/lib/`.
+  `.agents/scripts/sp/` — together with `lib/`, which lands **inside** the plugin root
+  (`.agents/scripts/sp/lib/`). Install drops the `scripts/` level, so it retargets an entry's
+  `../../lib/…` to `../lib/…` for the staged tree; older superskill builds stage the same `lib/`
+  at the shared `.agents/scripts/lib/` instead and leave the import depth alone. Both resolve.
 - Native targets (Claude Code, omp, Grok) get the whole plugin.
 
-So `scripts/hooks/<id>.ts`, importing `../../lib/…`, is the only path that resolves the same way on
-every target. `hooks/` keeps the registry only. `script-contract-check`
-rejects a hook entry there: on native installs it would shadow the staged one, and staged targets
-would never receive it. Hook logic stays in the plugin (Revision 2026-10-15); the files are entries
-and lib cores, not `spur` commands.
+So `scripts/hooks/<id>.ts`, importing `../../lib/…` relative to `plugins/sp/`, is the only path that
+resolves the same way on every target. Keep that import depth as written — it is correct for the
+plugin tree, and install fixes it up for the collapsed staged tree. `hooks/` keeps the registry
+only; `script-contract-check` rejects a hook entry there, because on native installs it would shadow
+the staged one and staged targets would never receive it. Hook logic stays in the plugin (Revision
+2026-10-15); the files are entries and lib cores, not `spur` commands.
 
 **Escape hatch:** `SPUR_WRITE_GUARD=off` short-circuits the write guard before any subprocess.
 

package/plugins/sp/commands/dev-changelog.md

@@ -26,5 +26,5 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 ## Implementation
 
-Follow the inline procedure in [dev-operations.md](../skills/spur-dev/references/dev-operations.md#8-changelog) (changelog). This is a docs-only generator: run no quality gates (`spur self exec autofix|check|lint`, typecheck, tests, rules) — a generic "verify before finishing" rule does not apply here. The generator's own claim-verification pass is part of the procedure, not a gate, and carries one required check per claim bullet (dev-operations §8, step 7): a **source citation** — an anchor naming a URL or a repo `path:line` — held in the bullet's `<!-- src: … -->` comment and re-verified by step 8's self-check. No confidence level is recorded (ADR-138).
+Follow the inline procedure in [dev-operations.md](../skills/spur-dev/references/dev-operations.md#8-changelog) (changelog). This is a docs-only generator: run no quality gates (`spur self exec autofix|check|lint`, typecheck, tests, rules) — a generic "verify before finishing" rule does not apply here. The generator's own claim-verification pass is part of the procedure, not a gate, and carries one required check per claim bullet (dev-operations §8, step 7): a **source citation** — an anchor naming a URL or a repo `path:line` — held in the bullet's `<!-- src: … -->` comment and re-verified by step 8's self-check. The comment also carries `· confidence: <level>`, derived from the anchors — `HIGH` all `path:line` beyond line 1 and resolving, `MEDIUM` all resolving but not all line-precise, `LOW` otherwise — and cross-checked by `repo-wide-tests/changelog-confidence.test.ts` (ADR-144): it is a function of the anchors, not a self-assessment, and a level the anchors do not support is rejected.
 

package/plugins/sp/plugin.json

@@ -1,5 +1,5 @@
 {
     "name": "sp",
-    "version": "0.4.18",
+    "version": "0.4.19",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics."
 }

package/plugins/sp/skills/spur-cli/SKILL.md

@@ -46,7 +46,7 @@ Pick the noun, read its reference. Each Tier A and Tier B reference owns that no
 | **Tier A** | **workflow** | Dual-mode workflow runtime: author state-machine / transition-flow workflows, validate, run, read traces | [references/workflows.md](references/workflows.md) |
 | **Tier A** | **builder** | Release/PR plumbing: `bump-ver` (including read-only `--check`), `drop-tags`, `publish`, the four flat PR verbs (`pr-status`, `pr-check`, `pr-open`, `pr-review`), and the read-only `show-branches` topology report | [references/builder.md](references/builder.md) |
 | **Tier B** | **agent** | Coding-agent execution surface: run prompts via detected/named agents, list agent specs (incl. `agent.fleet` members), start/stop supervised processes, fleet `report`/`join`/`leave`/`wait`/`trace`, readiness check | [references/agent.md](references/agent.md) |
-| **Tier B** | **message** | Durable inter-agent messaging: send, inbox, reply, watch | [references/message.md](references/message.md) |
+| **Tier B** | **message** | Durable inter-agent messaging: send, inbox, show, read, reply, watch | [references/message.md](references/message.md) |
 | **Tier B** | **self** | Self-management verbs: scaffold (`init`), project SDLC actions (`exec`), database maintenance (`maintain`), schema migrations (`migrate`), local web server (`serve`), status overview (`status`); `self init` runs post-scaffold validation probes & layout classification | [references/self.md](references/self.md) |
 | **Tier B** | **history** | Import agent histories, aggregate forensic artifacts, render reports, and run the checkpoint-resumed daily pipeline | [references/history.md](references/history.md) |
 | **Tier B** | **projects** | Manage the local multi-project registry and start/stop project servers | [references/projects.md](references/projects.md) |
@@ -162,7 +162,7 @@ and spreading it; full contract in `docs/04_DESIGN.md` §1.0.1.
   `list --specs`, `start`/`stop`). Cross-references the
   [dispatch-surface rule](../parallel-execution/references/dispatch-surface.md).
 - **[references/message.md](references/message.md)** - durable inter-agent messaging (`send`,
-  `inbox`, `reply`, `watch`).
+  `inbox`, `show`, `read`, `reply`, `watch`).
 - **[references/decision.md](references/decision.md)** - decision catalog (`list`, `show`, `run`,
   `status`); with no reachable backend each decision serves its declared fallback. Authoring and
   tuning: [references/decision/lifecycle.md](references/decision/lifecycle.md).

package/plugins/sp/skills/spur-cli/references/message.md

@@ -19,8 +19,10 @@ use it well*.
 
 | Verb | Purpose | Key flags |
 | ---- | ------- | --------- |
-| `send <body>` | Enqueue a message for an agent | `--to <id>` `--role <name>` `--from <id>` `--request-key <key>` `--wait` `--until <state>` `--timeout <ms>` `--json` |
-| `inbox` | List messages addressed to an agent | `--agent <id>` `--unresolved` `--json` |
+| `send <body>` | Send to a member inbox; `--to` defaults to the orchestrator | `--to <id>` `--role <name>` `--from <id>` `--request-key <key>` `--wait` `--until <state>` `--timeout <ms>` `--json` |
+| `inbox` | List messages addressed to an agent (writes nothing) | `--agent <id>` `--unresolved` `--json` |
+| `show <msg-id>` | Print one thread, root plus replies, oldest first, both directions | `--json` |
+| `read <msg-id>` | Mark a message read (`--reader`, default `operator`); idempotent | `--reader <id>` `--json` |
 | `reply <msg-id> <body>` | Thread a reply to a message | `--json` |
 | `watch` | Follow an agent inbox - surface new messages as they arrive | `--agent <id>` `--interval <ms>` `--json` |
 
@@ -49,14 +51,14 @@ wait; enqueue is **not** rolled back if the wait later fails.
 
 | Flag | Purpose |
 | ------ | --------- |
-| `--to <id>` | Recipient agent id. Mutually exclusive with `--role`; exactly one of the two is required. |
+| `--to <id>` | Recipient address. Mutually exclusive with `--role`. Omitted = the project's orchestrator member (`FleetService.resolveOrchestrator`); with none bound the verb exits 2 and writes no row. |
 | `--role <name>` | Address by Layer-1 role or executor name. Must resolve to exactly one materialized instance; zero (`count=0`, candidates `none`) or multi (`count=N` + candidates) matches are hard errors (exit 1); unknown name exits 2 naming the accepted vocabulary (`AGENT_ROLE_NAMES` ∪ executor names). Resolution yields the same spec-id path as `--to`; `--wait` snapshots that occupant pin. (0685 R6 / ADR-075 amendment) |
 | `--from <id>` | Sender id (default: `operator`). |
 | `--request-key <key>` | Caller-minted idempotency key. The same key with the same body + recipient replays the original receipt (`replayed: true`, no second row/delivery); the same key with a different payload fails with a request-key-conflict error (0832). |
 | `replayed` receipt field | Present on keyed sends: `true` when this submission was a replay of an earlier accepted send. |
 | `requestKey` receipt field | Present on keyed sends, including replays; echoes the accepted key. Blank keys are rejected. |
 | `--wait` | Block until the recipient reaches `--until` (snapshots occupant before send). |
-| `--until <state>` | Wait target: `injected` \| `invoke-exit` (repeatable OR). Default `invoke-exit`. |
+| `--until <state>` | Wait target: `injected` \| `invoke-exit` (repeatable OR). Default `invoke-exit`. `injected` is satisfied when THIS message leaves `queued` — claimed, delivered or failed — not when the recipient's inbox is empty. |
 | `--timeout <ms>` | Caller deadline in milliseconds. |
 | `--json` | Output machine-readable JSON (`{ msgId, toId, status, wait: { satisfied } }`). |
 
@@ -86,7 +88,7 @@ carry their persisted origin and run status; exhausted attempts keep the same re
 | `reason` | Meaning |
 | -------- | --------- |
 | `delivery-failed` | The drain marked the delivery failed (`injectError` carries why), or its run's receipt outcome is `errored`. |
-| `attempts-exhausted` | The message burned its bounded redelivery budget (`MAX_INJECT_ATTEMPTS`, 0831); the reconciler marks it `failed` — the reconciler's only write. |
+| `attempts-exhausted` | The message burned its bounded redelivery budget (`MAX_DELIVERY_ATTEMPTS`, 0831; renamed by G11); the claim sweeper marks it `failed`. |
 | `outcome-unknown` | The drain consumed it and no completion receipt ever arrived: the agent may have edited files. **Never requeued, never auto-released** — a human decides. |
 | `run-exit-only` | Its run exited (receipt outcome `run-exit-only`) with no workflow verification result. |
 

package/plugins/sp/skills/spur-dev/references/dev-operations.md

@@ -590,10 +590,11 @@ host instructions does not add one. An opt-in gate is explicit: `gitmsg --check
      - `keepachangelog` (default): `## [<version>] - <date>` header, then category headings per the keepachangelog convention — `### Added` / `### Fixed` / `### Changed` / `### Removed` / `### Other` — mapped from conventional-commit types.
      - `simple`: flat bulleted list grouped by type heading (`### feat`, `### fix`, …).
   6. Emit: with `<file>`, insert the section into that file above its newest `## [` release heading (or after its title when none exists) and touch nothing else in the file; without `<file>`, print it to stdout.
-  7. **Verify claims before emitting — one required check on every claim bullet.** Classify first: an *API/library claim* is a bullet asserting what code, an API, a library, a dependency or a version does — skip merge/bookkeeping bullets that assert no such fact (a status move, a filing, a doc relocation). Then run the check and append one HTML comment line directly under the bullet carrying its anchor: `<!-- src: <citation> -->`. No confidence level is recorded (ADR-138): the anchor is the evidence.
+  7. **Verify claims before emitting — one required check on every claim bullet.** Classify first: an *API/library claim* is a bullet asserting what code, an API, a library, a dependency or a version does — skip merge/bookkeeping bullets that assert no such fact (a status move, a filing, a doc relocation). Then run the check and append one HTML comment line directly under the bullet carrying its anchor and the level that anchor supports: `<!-- src: <citation> · confidence: <level> -->`.
      - **Source citation — the anchor.** Internal claims (what a commit or the code does): confirm against the commit diff (`git show --stat <hash>`, reading hunks when the summary asserts behavior) or the artifact's presence in the tree; cite `path[:line]` — bare path for whole-file claims, `path:line` for a specific behavior or symbol. External claims (framework/library/version behavior): confirm against official docs for the installed version; cite the URL. An anchor you cannot produce fails the check — reword the bullet or drop the claim; a citation is not a citation until it names something a reader can open.
+     - **Confidence — derived, not judged.** The level is a function of the anchors in the comment (ADR-144), and the repo-wide check recomputes it: `HIGH` when every anchor is a `path:line` beyond line 1 and each resolves (file exists, line within it), `MEDIUM` when every anchor resolves but the set is not all line-precise (an external URL, a bare path, or a `:1` anchor), `LOW` when an anchor does not resolve or the comment lists none. To record `MEDIUM` over in-tree evidence, cite a URL or a whole file rather than asserting it — a `HIGH` the anchors do not support is exactly what `repo-wide-tests/changelog-confidence.test.ts` rejects.
      - **Defect precision decides what must be fixed.** The check is precise once a bullet is classified as a claim: an annotation missing its anchor is unambiguously wrong and blocks emitting. A summary broader than its evidence is reworded to what the anchor shows. Which bullets *are* claims is the heuristic half — resolve it by this step's rule, and for a genuinely borderline bullet say so in the bullet's body rather than annotating or skipping it silently.
-  8. Self-check before emitting: every short hash in `<since>..<until>` appears exactly once, and every claim bullet carries exactly one `<!-- src: … -->` comment holding exactly one anchor — no unannotated claim bullets, no duplicate annotations. Fix any miss or duplicate; do not report a verdict.
+  8. Self-check before emitting: every short hash in `<since>..<until>` appears exactly once, and every claim bullet carries exactly one `<!-- src: … -->` comment holding exactly one anchor with its `· confidence: <level>` token matching what those anchors support (step 7's derivation: `HIGH` all `path:line` beyond line 1 and resolving, `MEDIUM` all resolving but not all line-precise, `LOW` otherwise) — no unannotated claim bullets, no duplicate annotations. Fix any miss or duplicate; do not report a verdict.
   9. Reply in at most three lines: the range, bullet counts per category plus the verified-claim count, and the output target.
 - **Invariants:** Bullets are derived from `git log` only; the claim-verification pass (step 7) adds evidence from commit diffs, the working tree, and official docs. No quality gates — no `spur self exec autofix|check|lint` and no typecheck, test or rule run, and no edits beyond the one inserted section (its verification comments included). The file is left uncommitted.