@gobing-ai/spur 0.4.18 → 0.4.20

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.4.18",
+            "version": "0.4.20",
             "source": "./plugins/sp"
         }
     ]

package/config/config.example.yaml

@@ -58,6 +58,10 @@ bootstrap:
         command: >-
           spur --no-logo history import --source all &&
           spur --no-logo workflow run config/workflows/history-anatomy.yaml --quiet
+        # Without this the chain inherits the 10-minute scheduler default and dies mid-validate.
+        # 1h45m: enrich (45-52 min on a slow executor) + validate, still below the server
+        # queue's 2h visibility timeout.
+        timeoutMs: 6300000
 
 # ── Spur app section (validated by spurConfigSchema in
 # @gobing-ai/spur-config) ──

package/config/workflows/task-pipeline.yaml

@@ -701,10 +701,15 @@ states:
           # PASS, and a clean review gate (open P1-P3 finding or an uncited claim blocks it).
           # Fail-closed: any missing/corrupt input leaves FAIL, so the transitions can route a
           # non-PASS review into remediation instead of dead-ending the run.
+          # Idempotent re-entry: the answer file is consumed as a stage input, so a second visit to
+          # this state has no answer to re-judge. An ABSENT answer is not new evidence against a
+          # PASS — the durable `<wbs>-verdict.json` and the residual gate still have to pass — so the
+          # run-scoped verdict status is consulted only when an answer is actually present (without
+          # this, re-entry overwrote a PASS with FAIL and closed the task's run as `failed`).
           - kind: shell
             options:
                 command: >-
-                    mkdir -p .spur/run; S=FAIL; if [ "$(cat ".spur/run/$__runId-review-verdict.status" 2>/dev/null)" = PASS ] && [ "$(jq -r '.verdict // empty' ".spur/run/$wbs-verdict.json" 2>/dev/null)" = PASS ] && $spurBin task residual "$wbs" review-gate --no-logo >&2; then S=PASS; fi; printf '%s\n' "$S" > ".spur/run/$wbs-review.status"; exit 0
+                    mkdir -p .spur/run; S=FAIL; if [ ! -f ".spur/run/$__runId-review-answer.txt" -o "$(cat ".spur/run/$__runId-review-verdict.status" 2>/dev/null)" = PASS ]; then [ "$(jq -r '.verdict // empty' ".spur/run/$wbs-verdict.json" 2>/dev/null)" = PASS ] && $spurBin task residual "$wbs" review-gate --no-logo >&2 && S=PASS; fi; printf '%s\n' "$S" > ".spur/run/$wbs-review.status"; exit 0
           # (d) record the review severity as the lane decision's outcome (1263 R3b): the
           # question `task-semantic-risk` answered is "is this risky?", and the Review table's
           # worst finding is the answer as observed. Resolved rows count (a fixed P2 was still

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.4.18",
+    "version": "0.4.20",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",
@@ -58,14 +58,14 @@
     },
     "devDependencies": {
         "@commander-js/extra-typings": "^14.0.0",
-        "@gobing-ai/ts-db": "^0.5.32",
-        "@gobing-ai/ts-ai-runner": "^0.5.32",
-        "@gobing-ai/ts-dual-workflow-engine": "^0.5.32",
-        "@gobing-ai/ts-infra": "^0.5.32",
-        "@gobing-ai/ts-llm-jsonl-importer": "^0.5.32",
-        "@gobing-ai/ts-rule-engine": "^0.5.32",
-        "@gobing-ai/ts-runtime": "^0.5.32",
-        "@gobing-ai/ts-utils": "^0.5.32",
+        "@gobing-ai/ts-db": "^0.5.33",
+        "@gobing-ai/ts-ai-runner": "^0.5.33",
+        "@gobing-ai/ts-dual-workflow-engine": "^0.5.33",
+        "@gobing-ai/ts-infra": "^0.5.33",
+        "@gobing-ai/ts-llm-jsonl-importer": "^0.5.33",
+        "@gobing-ai/ts-rule-engine": "^0.5.33",
+        "@gobing-ai/ts-runtime": "^0.5.33",
+        "@gobing-ai/ts-utils": "^0.5.33",
         "@types/bun": "1.4.3",
         "@types/figlet": "^1.7.0",
         "@types/node-notifier": "8.0.5",

package/plugins/sp/README.md

@@ -536,14 +536,18 @@ block/ask prints one JSON object that superskill renders per host:
 targets:
 
 - Codex, OpenCode, Antigravity and Hermes get only `scripts/`, staged as
-  `.agents/scripts/sp/`, with `lib/` beside it as `.agents/scripts/lib/`.
+  `.agents/scripts/sp/` — together with `lib/`, which lands **inside** the plugin root
+  (`.agents/scripts/sp/lib/`). Install drops the `scripts/` level, so it retargets an entry's
+  `../../lib/…` to `../lib/…` for the staged tree; older superskill builds stage the same `lib/`
+  at the shared `.agents/scripts/lib/` instead and leave the import depth alone. Both resolve.
 - Native targets (Claude Code, omp, Grok) get the whole plugin.
 
-So `scripts/hooks/<id>.ts`, importing `../../lib/…`, is the only path that resolves the same way on
-every target. `hooks/` keeps the registry only. `script-contract-check`
-rejects a hook entry there: on native installs it would shadow the staged one, and staged targets
-would never receive it. Hook logic stays in the plugin (Revision 2026-10-15); the files are entries
-and lib cores, not `spur` commands.
+So `scripts/hooks/<id>.ts`, importing `../../lib/…` relative to `plugins/sp/`, is the only path that
+resolves the same way on every target. Keep that import depth as written — it is correct for the
+plugin tree, and install fixes it up for the collapsed staged tree. `hooks/` keeps the registry
+only; `script-contract-check` rejects a hook entry there, because on native installs it would shadow
+the staged one and staged targets would never receive it. Hook logic stays in the plugin (Revision
+2026-10-15); the files are entries and lib cores, not `spur` commands.
 
 **Escape hatch:** `SPUR_WRITE_GUARD=off` short-circuits the write guard before any subprocess.
 

package/plugins/sp/commands/dev-changelog.md

@@ -26,5 +26,5 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 ## Implementation
 
-Follow the inline procedure in [dev-operations.md](../skills/spur-dev/references/dev-operations.md#8-changelog) (changelog). This is a docs-only generator: run no quality gates (`spur self exec autofix|check|lint`, typecheck, tests, rules) — a generic "verify before finishing" rule does not apply here. The generator's own claim-verification pass is part of the procedure, not a gate, and carries one required check per claim bullet (dev-operations §8, step 7): a **source citation** — an anchor naming a URL or a repo `path:line` — held in the bullet's `<!-- src: … -->` comment and re-verified by step 8's self-check. No confidence level is recorded (ADR-138).
+Follow the inline procedure in [dev-operations.md](../skills/spur-dev/references/dev-operations.md#8-changelog) (changelog). This is a docs-only generator: run no quality gates (`spur self exec autofix|check|lint`, typecheck, tests, rules) — a generic "verify before finishing" rule does not apply here. The generator's own claim-verification pass is part of the procedure, not a gate, and carries one required check per claim bullet (dev-operations §8, step 7): a **source citation** — an anchor naming a URL or a repo `path:line` — held in the bullet's `<!-- src: … -->` comment and re-verified by step 8's self-check. The comment also carries `· confidence: <level>`, derived from the anchors — `HIGH` all `path:line` beyond line 1 and resolving, `MEDIUM` all resolving but not all line-precise, `LOW` otherwise — and cross-checked by `repo-wide-tests/changelog-confidence.test.ts` (ADR-144): it is a function of the anchors, not a self-assessment, and a level the anchors do not support is rejected.
 

package/plugins/sp/plugin.json

@@ -1,5 +1,5 @@
 {
     "name": "sp",
-    "version": "0.4.18",
+    "version": "0.4.20",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics."
 }

package/plugins/sp/scripts/hooks/fleet-guest-stop.ts

@@ -37,7 +37,7 @@ export const GUEST_STOP_PROBE_MS = 2000;
 /** How many pending messages the delivered reason names. */
 export const GUEST_STOP_MAX_MESSAGES = 5;
 
-/** Characters of each message body the reason carries. */
+/** Preview length for legacy queued snapshots; an owned handoff carries the full body. */
 export const GUEST_STOP_BODY_CHARS = 140;
 
 /** Hard per-invocation timeout for a `spur` child the hook shells out to. */
@@ -108,20 +108,41 @@ export function stopDecisionFor(
     } catch {
         return null;
     }
-    const list = Array.isArray(rows) ? rows : undefined;
+    const payload = rows !== null && typeof rows === 'object' && 'data' in rows ? rows.data : rows;
+    const list = Array.isArray(payload)
+        ? payload
+        : payload !== null && typeof payload === 'object' && 'messages' in payload && Array.isArray(payload.messages)
+          ? payload.messages
+          : undefined;
     if (list === undefined) return null;
+    const handedOff = payload !== null && typeof payload === 'object' && 'pending' in payload;
     const pending = list
-        .map((row) => row as { from_id?: unknown; fromId?: unknown; body?: unknown; status?: unknown })
-        .filter((row) => row.body !== undefined && (row.status === undefined || row.status === 'queued'))
-        .slice(0, maxMessages);
+        .filter((row) => row !== null && typeof row === 'object')
+        .map((row) => row as { id?: unknown; from_id?: unknown; fromId?: unknown; body?: unknown; status?: unknown })
+        .filter(
+            (row) =>
+                typeof row.body === 'string' &&
+                (row.status === undefined ||
+                    (handedOff
+                        ? ['queued', 'claimed', 'delivered'].includes(String(row.status))
+                        : row.status === 'queued')),
+        )
+        .slice(0, handedOff ? undefined : maxMessages);
     if (pending.length === 0) return null;
     const lines = pending.map((row) => {
         const from =
             typeof row.from_id === 'string' ? row.from_id : typeof row.fromId === 'string' ? row.fromId : 'fleet';
-        const body = String(row.body ?? '')
-            .replace(/\s+/g, ' ')
-            .trim();
-        return `- ${from}: ${body.length > GUEST_STOP_BODY_CHARS ? `${body.slice(0, GUEST_STOP_BODY_CHARS)}…` : body}`;
+        const body = handedOff
+            ? String(row.body ?? '')
+            : String(row.body ?? '')
+                  .replace(/\s+/g, ' ')
+                  .trim();
+        const id = typeof row.id === 'string' ? ` [${row.id}]` : '';
+        const preview =
+            !handedOff && body.length > GUEST_STOP_BODY_CHARS
+                ? `${body.slice(0, GUEST_STOP_BODY_CHARS)}… (read the full message with spur message show ${String(row.id ?? '<msgId>')} --json)`
+                : body;
+        return `- ${from}${id}: ${preview}`;
     });
     const reason = `Pending fleet messages for ${guestId}:\n${lines.join('\n')}\n\nHandle them, then \`spur message reply <msgId> …\` and continue.`;
     return JSON.stringify({ decision: 'block', reason });
@@ -155,11 +176,10 @@ export function runFleetGuestStop(payload: GuestStopPayload, deps: GuestStopDeps
             guest.id,
             '--timeout',
             String(deps.probeMs ?? GUEST_STOP_PROBE_MS),
+            '--json',
         ]);
         if (probe.status !== 0) return null;
-        const inbox = cli(['message', 'inbox', '--agent', guest.id, '--json']);
-        if (inbox.status !== 0) return null;
-        return stopDecisionFor(guest.id, inbox.stdout, deps.maxMessages);
+        return stopDecisionFor(guest.id, probe.stdout, deps.maxMessages);
     } catch {
         return null;
     }

package/plugins/sp/skills/fleet-join/SKILL.md

@@ -28,13 +28,16 @@ find this session, though the `wait --inbox` loop still works.
 
 ## Pull loop
 
-`spur agent wait --inbox <id> --timeout 540000` returns **0** the moment queued work exists and
-**1** on timeout. Each call heartbeats the lease, so a looping session stays joined. The Bash tool's
+`spur agent wait --inbox <id> --timeout 540000 --json` returns **0** with up to five claimed messages
+in `{ id, pending, messages }`, settling their delivery after the output handoff. It returns **1**
+on timeout. An output failure releases the exact claims for retry; inbox listing itself never
+consumes messages. Each call heartbeats the lease, so a looping session stays joined. The Bash tool's
 own ~10-minute limit is why the timeout stays under it: one bounded call per turn, re-armed after
 the work is done.
 
-1. `spur agent wait --inbox <id> --timeout 540000 --json` → exit 0 means work is waiting.
-2. `spur message inbox --agent <id> --json` → read the messages.
+1. `spur agent wait --inbox <id> --timeout 540000 --json` → exit 0 hands this session `messages`.
+2. Read the returned messages, including their IDs. `spur message show <id> --json` can reread one;
+   `spur message inbox --agent <id> --json` is a non-consuming historical view.
 3. Do the work the message asks for.
 4. `spur message reply <msgId> "<result>"` → reply to each one.
 5. Re-arm: go back to step 1 while the operator wants this session in the fleet.

package/plugins/sp/skills/spur-cli/SKILL.md

@@ -46,7 +46,7 @@ Pick the noun, read its reference. Each Tier A and Tier B reference owns that no
 | **Tier A** | **workflow** | Dual-mode workflow runtime: author state-machine / transition-flow workflows, validate, run, read traces | [references/workflows.md](references/workflows.md) |
 | **Tier A** | **builder** | Release/PR plumbing: `bump-ver` (including read-only `--check`), `drop-tags`, `publish`, the four flat PR verbs (`pr-status`, `pr-check`, `pr-open`, `pr-review`), and the read-only `show-branches` topology report | [references/builder.md](references/builder.md) |
 | **Tier B** | **agent** | Coding-agent execution surface: run prompts via detected/named agents, list agent specs (incl. `agent.fleet` members), start/stop supervised processes, fleet `report`/`join`/`leave`/`wait`/`trace`, readiness check | [references/agent.md](references/agent.md) |
-| **Tier B** | **message** | Durable inter-agent messaging: send, inbox, reply, watch | [references/message.md](references/message.md) |
+| **Tier B** | **message** | Durable inter-agent messaging: send, inbox, show, read, reply, watch | [references/message.md](references/message.md) |
 | **Tier B** | **self** | Self-management verbs: scaffold (`init`), project SDLC actions (`exec`), database maintenance (`maintain`), schema migrations (`migrate`), local web server (`serve`), status overview (`status`); `self init` runs post-scaffold validation probes & layout classification | [references/self.md](references/self.md) |
 | **Tier B** | **history** | Import agent histories, aggregate forensic artifacts, render reports, and run the checkpoint-resumed daily pipeline | [references/history.md](references/history.md) |
 | **Tier B** | **projects** | Manage the local multi-project registry and start/stop project servers | [references/projects.md](references/projects.md) |
@@ -162,7 +162,7 @@ and spreading it; full contract in `docs/04_DESIGN.md` §1.0.1.
   `list --specs`, `start`/`stop`). Cross-references the
   [dispatch-surface rule](../parallel-execution/references/dispatch-surface.md).
 - **[references/message.md](references/message.md)** - durable inter-agent messaging (`send`,
-  `inbox`, `reply`, `watch`).
+  `inbox`, `show`, `read`, `reply`, `watch`).
 - **[references/decision.md](references/decision.md)** - decision catalog (`list`, `show`, `run`,
   `status`); with no reachable backend each decision serves its declared fallback. Authoring and
   tuning: [references/decision/lifecycle.md](references/decision/lifecycle.md).

package/plugins/sp/skills/spur-cli/references/agent.md

@@ -239,10 +239,12 @@ is refused (R3), and `requiresCapabilities` stages therefore can never reach one
 spur agent wait --inbox reviewer-g1 --timeout 540000 --json
 ```
 
-Returns `0` as soon as queued inbox work exists for the guest and `1` on timeout or when the id is
-not a joined guest — never a silent hang. Every call heartbeats the guest's lease, so a session that
-keeps looping stays joined; the timeout stays under the Bash tool's ~10-minute limit. The
-`fleet-join` skill loops it (wait → `spur message inbox --agent <id>` → work → `spur message reply`),
+Returns `0` after handing off up to five queued messages, with `{ id, pending, messages }` in JSON;
+`pending` is the handed-off batch count. Exact claims settle as delivered after output succeeds and
+release for retry if output fails; further queued work stays for the next pull. Returns `1` on timeout
+or when the id is not a joined guest. Every call heartbeats the guest's lease, so a session that keeps
+looping stays joined; the timeout stays under the Bash tool's ~10-minute limit. The
+`fleet-join` skill loops it (wait → work from returned messages → `spur message reply`),
 and the `fleet-guest-stop` plugin hook delivers the same messages at a turn boundary on hosts that
 support a blocking Stop hook.
 

package/plugins/sp/skills/spur-cli/references/message.md

@@ -19,8 +19,10 @@ use it well*.
 
 | Verb | Purpose | Key flags |
 | ---- | ------- | --------- |
-| `send <body>` | Enqueue a message for an agent | `--to <id>` `--role <name>` `--from <id>` `--request-key <key>` `--wait` `--until <state>` `--timeout <ms>` `--json` |
-| `inbox` | List messages addressed to an agent | `--agent <id>` `--unresolved` `--json` |
+| `send <body>` | Send to a member inbox; `--to` defaults to the orchestrator | `--to <id>` `--role <name>` `--from <id>` `--request-key <key>` `--wait` `--until <state>` `--timeout <ms>` `--json` |
+| `inbox` | List messages addressed to an agent (writes nothing) | `--agent <id>` `--unresolved` `--json` |
+| `show <msg-id>` | Print one thread, root plus replies, oldest first, both directions | `--json` |
+| `read <msg-id>` | Mark a message read (`--reader`, default `operator`); idempotent | `--reader <id>` `--json` |
 | `reply <msg-id> <body>` | Thread a reply to a message | `--json` |
 | `watch` | Follow an agent inbox - surface new messages as they arrive | `--agent <id>` `--interval <ms>` `--json` |
 
@@ -49,14 +51,14 @@ wait; enqueue is **not** rolled back if the wait later fails.
 
 | Flag | Purpose |
 | ------ | --------- |
-| `--to <id>` | Recipient agent id. Mutually exclusive with `--role`; exactly one of the two is required. |
+| `--to <id>` | Recipient address. Mutually exclusive with `--role`. Omitted = the project's orchestrator member (`FleetService.resolveOrchestrator`); with none bound the verb exits 2 and writes no row. |
 | `--role <name>` | Address by Layer-1 role or executor name. Must resolve to exactly one materialized instance; zero (`count=0`, candidates `none`) or multi (`count=N` + candidates) matches are hard errors (exit 1); unknown name exits 2 naming the accepted vocabulary (`AGENT_ROLE_NAMES` ∪ executor names). Resolution yields the same spec-id path as `--to`; `--wait` snapshots that occupant pin. (0685 R6 / ADR-075 amendment) |
 | `--from <id>` | Sender id (default: `operator`). |
 | `--request-key <key>` | Caller-minted idempotency key. The same key with the same body + recipient replays the original receipt (`replayed: true`, no second row/delivery); the same key with a different payload fails with a request-key-conflict error (0832). |
 | `replayed` receipt field | Present on keyed sends: `true` when this submission was a replay of an earlier accepted send. |
 | `requestKey` receipt field | Present on keyed sends, including replays; echoes the accepted key. Blank keys are rejected. |
 | `--wait` | Block until the recipient reaches `--until` (snapshots occupant before send). |
-| `--until <state>` | Wait target: `injected` \| `invoke-exit` (repeatable OR). Default `invoke-exit`. |
+| `--until <state>` | Wait target: `injected` \| `invoke-exit` (repeatable OR). Default `invoke-exit`. `injected` is satisfied when THIS message leaves `queued` — claimed, delivered or failed — not when the recipient's inbox is empty. |
 | `--timeout <ms>` | Caller deadline in milliseconds. |
 | `--json` | Output machine-readable JSON (`{ msgId, toId, status, wait: { satisfied } }`). |
 
@@ -86,7 +88,7 @@ carry their persisted origin and run status; exhausted attempts keep the same re
 | `reason` | Meaning |
 | -------- | --------- |
 | `delivery-failed` | The drain marked the delivery failed (`injectError` carries why), or its run's receipt outcome is `errored`. |
-| `attempts-exhausted` | The message burned its bounded redelivery budget (`MAX_INJECT_ATTEMPTS`, 0831); the reconciler marks it `failed` — the reconciler's only write. |
+| `attempts-exhausted` | The message burned its bounded redelivery budget (`MAX_DELIVERY_ATTEMPTS`, 0831; renamed by G11); the claim sweeper marks it `failed`. |
 | `outcome-unknown` | The drain consumed it and no completion receipt ever arrived: the agent may have edited files. **Never requeued, never auto-released** — a human decides. |
 | `run-exit-only` | Its run exited (receipt outcome `run-exit-only`) with no workflow verification result. |
 

package/plugins/sp/skills/spur-dev/references/dev-operations.md

@@ -590,10 +590,11 @@ host instructions does not add one. An opt-in gate is explicit: `gitmsg --check
      - `keepachangelog` (default): `## [<version>] - <date>` header, then category headings per the keepachangelog convention — `### Added` / `### Fixed` / `### Changed` / `### Removed` / `### Other` — mapped from conventional-commit types.
      - `simple`: flat bulleted list grouped by type heading (`### feat`, `### fix`, …).
   6. Emit: with `<file>`, insert the section into that file above its newest `## [` release heading (or after its title when none exists) and touch nothing else in the file; without `<file>`, print it to stdout.
-  7. **Verify claims before emitting — one required check on every claim bullet.** Classify first: an *API/library claim* is a bullet asserting what code, an API, a library, a dependency or a version does — skip merge/bookkeeping bullets that assert no such fact (a status move, a filing, a doc relocation). Then run the check and append one HTML comment line directly under the bullet carrying its anchor: `<!-- src: <citation> -->`. No confidence level is recorded (ADR-138): the anchor is the evidence.
+  7. **Verify claims before emitting — one required check on every claim bullet.** Classify first: an *API/library claim* is a bullet asserting what code, an API, a library, a dependency or a version does — skip merge/bookkeeping bullets that assert no such fact (a status move, a filing, a doc relocation). Then run the check and append one HTML comment line directly under the bullet carrying its anchor and the level that anchor supports: `<!-- src: <citation> · confidence: <level> -->`.
      - **Source citation — the anchor.** Internal claims (what a commit or the code does): confirm against the commit diff (`git show --stat <hash>`, reading hunks when the summary asserts behavior) or the artifact's presence in the tree; cite `path[:line]` — bare path for whole-file claims, `path:line` for a specific behavior or symbol. External claims (framework/library/version behavior): confirm against official docs for the installed version; cite the URL. An anchor you cannot produce fails the check — reword the bullet or drop the claim; a citation is not a citation until it names something a reader can open.
+     - **Confidence — derived, not judged.** The level is a function of the anchors in the comment (ADR-144), and the repo-wide check recomputes it: `HIGH` when every anchor is a `path:line` beyond line 1 and each resolves (file exists, line within it), `MEDIUM` when every anchor resolves but the set is not all line-precise (an external URL, a bare path, or a `:1` anchor), `LOW` when an anchor does not resolve or the comment lists none. To record `MEDIUM` over in-tree evidence, cite a URL or a whole file rather than asserting it — a `HIGH` the anchors do not support is exactly what `repo-wide-tests/changelog-confidence.test.ts` rejects.
      - **Defect precision decides what must be fixed.** The check is precise once a bullet is classified as a claim: an annotation missing its anchor is unambiguously wrong and blocks emitting. A summary broader than its evidence is reworded to what the anchor shows. Which bullets *are* claims is the heuristic half — resolve it by this step's rule, and for a genuinely borderline bullet say so in the bullet's body rather than annotating or skipping it silently.
-  8. Self-check before emitting: every short hash in `<since>..<until>` appears exactly once, and every claim bullet carries exactly one `<!-- src: … -->` comment holding exactly one anchor — no unannotated claim bullets, no duplicate annotations. Fix any miss or duplicate; do not report a verdict.
+  8. Self-check before emitting: every short hash in `<since>..<until>` appears exactly once, and every claim bullet carries exactly one `<!-- src: … -->` comment holding exactly one anchor with its `· confidence: <level>` token matching what those anchors support (step 7's derivation: `HIGH` all `path:line` beyond line 1 and resolving, `MEDIUM` all resolving but not all line-precise, `LOW` otherwise) — no unannotated claim bullets, no duplicate annotations. Fix any miss or duplicate; do not report a verdict.
   9. Reply in at most three lines: the range, bullet counts per category plus the verified-claim count, and the output target.
 - **Invariants:** Bullets are derived from `git log` only; the claim-verification pass (step 7) adds evidence from commit diffs, the working tree, and official docs. No quality gates — no `spur self exec autofix|check|lint` and no typecheck, test or rule run, and no edits beyond the one inserted section (its verification comments included). The file is left uncommitted.
 

package/schemas/spur-config.schema.json

@@ -120,6 +120,11 @@
                                         "type": "string",
                                         "minLength": 1,
                                         "description": "Five-field cron expression (minute hour day-of-month month day-of-week) evaluated in local time. Mutually exclusive with `intervalMinutes`."
+                                    },
+                                    "timeoutMs": {
+                                        "type": ["integer", "null"],
+                                        "minimum": 1,
+                                        "description": "Total child budget for this job in milliseconds. At the deadline the runtime SIGTERMs the owned process group, then SIGKILLs after the scheduler grace. `null` is explicit unlimited; absent falls back to the global scheduler default (10 min). Keep a model-driven chain below the server queue's 2 h visibility timeout so it fails its own attempt instead of being re-delivered."
                                     }
                                 },
                                 "oneOf": [