@gobing-ai/spur 0.4.2 → 0.4.3

package/plugins/sp/scripts/inline-run-setup.mjs

@@ -3,9 +3,7 @@
 
 // plugins/sp/scripts/inline-run-setup.ts
 import { spawnSync } from "child_process";
-import { existsSync as existsSync3 } from "fs";
-import { dirname, join as join3, resolve } from "path";
-import { fileURLToPath } from "url";
+import { fileURLToPath as fileURLToPath2 } from "url";
 
 // plugins/sp/lib/env.ts
 function getEnvVar(name, fallback) {
@@ -14,8 +12,30 @@ function getEnvVar(name, fallback) {
 }
 
 // plugins/sp/lib/inline-run-app.ts
-async function loadInlineApp(spurBin, resolveAppEntry, required) {
-  const { entry, portable } = resolveAppEntry(spurBin);
+import { existsSync } from "node:fs";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+function resolveAppEntry(spurBin) {
+  const fallback = fileURLToPath(new URL("../../../apps/cli/src/index.ts", import.meta.url));
+  const candidates = spurBin !== "" ? [spurBin] : [fallback];
+  for (const candidate of candidates) {
+    const tokens = candidate.split(/\s+/).filter(Boolean);
+    const mainModule = [...tokens].reverse().find((t) => t.endsWith(".ts"));
+    if (mainModule === undefined || !existsSync(mainModule))
+      continue;
+    const repoRoot = resolve(dirname(mainModule), "..", "..", "..");
+    const appEntry = join(repoRoot, "packages", "app", "src", "index.ts");
+    if (existsSync(appEntry))
+      return { entry: appEntry, portable: false };
+  }
+  const entry = fileURLToPath(new URL("../lib/inline-run.generated.mjs", import.meta.url));
+  if (!existsSync(entry)) {
+    throw new Error("inline application bundle is missing — rebuild/install the sp plugin before running inline");
+  }
+  return { entry, portable: true };
+}
+async function loadInlineApp(spurBin, resolveAppEntry2, required) {
+  const { entry, portable } = resolveAppEntry2(spurBin);
   const app = await import(entry);
   const missing = portable ? required.filter((name) => typeof app[name] !== "function") : [];
   if (missing.length > 0) {
@@ -30,16 +50,14 @@ function getEnvVars() {
 }
 
 // plugins/sp/lib/run-summary-core.ts
-import { existsSync as existsSync2, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { join as join2 } from "node:path";
+import { existsSync as existsSync3, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join as join3 } from "node:path";
 
-// plugins/sp/lib/transcript.ts
-import { existsSync, readdirSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-var SESSION_ID = /^[A-Za-z0-9_-]+$/;
-var OPERATOR_TOOLS = new Set(["AskUserQuestion", "ask_user_question"]);
-var PI_ROLES = new Set(["user", "assistant", "toolResult"]);
+// plugins/sp/lib/plan-projection.generated.mjs
+var NON_ABORTING_PREFLIGHT_CODES = new Set([
+  "L4.scenario-unverified",
+  "L4.verifying-incomplete-tasks"
+]);
 var zeroTokens = () => ({ input: 0, cacheCreate: 0, cacheRead: 0, output: 0 });
 function formatDuration(ms) {
   const s = Math.round(ms / 1000);
@@ -59,6 +77,26 @@ function formatTokenSplit(t) {
   const nonCached = t.input + t.cacheCreate + t.output;
   return `${formatTokens(nonCached + t.cacheRead)} / ${formatTokens(nonCached)}`;
 }
+var OPERATOR_TOOLS = new Set(["AskUserQuestion", "ask_user_question"]);
+function isCompaction(row) {
+  return row.type === "compaction" || row.type === "system" && row.subtype === "compact_boundary";
+}
+function firstTextContent(row) {
+  const content = row.message?.content;
+  if (typeof content === "string")
+    return content;
+  if (!Array.isArray(content))
+    return;
+  return content.find((b) => b.type === "text")?.text;
+}
+function skillInvocationPrompt(text) {
+  const name = /^\s*<skill name="([^"]+)"/.exec(text)?.[1];
+  if (name === undefined)
+    return;
+  const close = text.lastIndexOf("</skill>");
+  const args = close < 0 ? "" : text.slice(close + "</skill>".length).trim();
+  return args === "" ? `/${name}` : `/${name} ${args}`;
+}
 function promptText(row) {
   if (row.type === "custom_message") {
     if (row.display === false)
@@ -83,22 +121,6 @@ function promptText(row) {
     return;
   return content.find((b) => b.type === "text")?.text;
 }
-function firstTextContent(row) {
-  const content = row.message?.content;
-  if (typeof content === "string")
-    return content;
-  if (!Array.isArray(content))
-    return;
-  return content.find((b) => b.type === "text")?.text;
-}
-function skillInvocationPrompt(text) {
-  const name = /^\s*<skill name="([^"]+)"/.exec(text)?.[1];
-  if (name === undefined)
-    return;
-  const close = text.lastIndexOf("</skill>");
-  const args = close < 0 ? "" : text.slice(close + "</skill>".length).trim();
-  return args === "" ? `/${name}` : `/${name} ${args}`;
-}
 function sumTokens(all) {
   const total = zeroTokens();
   for (const t of all)
@@ -170,72 +192,14 @@ function accumulate(acc, row, ts) {
     });
   }
 }
-function isCompaction(row) {
-  return row.type === "compaction" || row.type === "system" && row.subtype === "compact_boundary";
-}
-function sniffFormat(rows) {
-  for (const row of rows) {
-    if (row.type === "message" && PI_ROLES.has(row.message?.role ?? ""))
-      return "pi";
-    if (row.type === "user" || row.type === "assistant")
-      return "claude";
-  }
-  return "unknown";
-}
-function parseRows(lines) {
-  const rows = [];
-  let skippedLines = 0;
-  for (const line of lines) {
-    if (!line.trim())
-      continue;
-    let row;
-    try {
-      row = JSON.parse(line);
-    } catch {
-      skippedLines++;
-      continue;
-    }
-    const ts = row.timestamp ? Date.parse(row.timestamp) : Number.NaN;
-    if (!Number.isNaN(ts))
-      rows.push([row, ts]);
-  }
-  return { rows, skippedLines, format: sniffFormat(rows.map(([r]) => r)) };
-}
-function resolveTranscript(env, projectsRoot = join(homedir(), ".claude", "projects"), override) {
-  if (override)
-    return existsSync(override) ? { ok: true, path: override } : { ok: false, reason: "no transcript" };
-  const id = env.CLAUDE_CODE_SESSION_ID;
-  if (!id) {
-    const piFile = env.PI_SESSION_FILE;
-    if (piFile !== undefined && piFile !== "") {
-      return existsSync(piFile) ? { ok: true, path: piFile } : { ok: false, reason: `PI_SESSION_FILE ${piFile} does not exist` };
-    }
-    return {
-      ok: false,
-      reason: "no host session id; pass --transcript <path> (pi: ~/.pi/agent/sessions/<cwd-slug>/<file>.jsonl, " + "or set PI_SESSION_FILE)"
-    };
-  }
-  if (!SESSION_ID.test(id))
-    return { ok: false, reason: "refusing a session id with path characters" };
-  if (!existsSync(projectsRoot))
-    return { ok: false, reason: `no transcript root ${projectsRoot}` };
-  for (const dir of readdirSync(projectsRoot)) {
-    const path = join(projectsRoot, dir, `${id}.jsonl`);
-    if (existsSync(path))
-      return { ok: true, path };
-  }
-  return { ok: false, reason: `no transcript for session ${id}` };
-}
-
-// plugins/sp/lib/run-summary-core.ts
 var IDLE_GAP_MS = 300000;
 var SHELL_TOOLS = new Set(["bash", "shell", "exec", "exec_command", "run_command", "command"]);
 var SUBAGENT_TOOLS = new Set(["agent", "task", "invoke_subagent", "subagent", "dispatch_agent"]);
-var OPERATOR_TOOLS2 = new Set(["askuserquestion", "ask_user_question"]);
+var LOWERCASE_OPERATOR_TOOLS = new Set(["askuserquestion", "ask_user_question"]);
 var ACTOR_PRECEDENCE = ["operator", "subagent", "shell", "other"];
 function actorOf(tool) {
   const t = tool.toLowerCase().replace(/[^a-z_]/g, "");
-  if (OPERATOR_TOOLS2.has(t))
+  if (LOWERCASE_OPERATOR_TOOLS.has(t))
     return "operator";
   if (SUBAGENT_TOOLS.has(t))
     return "subagent";
@@ -385,7 +349,8 @@ function summaryRow(stage, status, span, measured) {
     token: formatTokenSplit(measured ? span.tokens : null)
   };
 }
-function buildRunSummary(lines, inputs, since, until) {
+function buildRunSummary(rows, inputs, opts = {}) {
+  const { since, until } = opts;
   const windows = [];
   for (const { label, progress } of inputs) {
     const states = (progress.states ?? []).flatMap((s) => {
@@ -411,7 +376,6 @@ function buildRunSummary(lines, inputs, since, until) {
     }
   }
   windows.sort((a, b) => a.start - b.start);
-  const { rows, skippedLines } = parseRows(lines);
   const measure = (start, end) => {
     const acc = newAcc(start);
     for (const [row, ts] of rows)
@@ -459,9 +423,87 @@ function buildRunSummary(lines, inputs, since, until) {
     total,
     actors: actorSplit(rows, totalStart, totalEnd),
     gate: { ms: null, reason: "no matching check receipt" },
-    skippedLines
+    skippedLines: opts.skippedLines ?? 0
   };
 }
+var SENSITIVE_PREFIXES = ["drizzle/", "packages/config/", ".github/", "plugins/sp/hooks/"];
+var SENSITIVE_GLOBS = ["apps/server/src/**/auth*", "**/*secret*", "**/*.sql"];
+function globToRegex(glob) {
+  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replaceAll("**/", "\x00").replaceAll("**", "\x01").replaceAll("*", "[^/]*").replaceAll("\x00", "(?:.*/)?").replaceAll("\x01", ".*");
+  return new RegExp(`^${escaped}$`, "s");
+}
+var SENSITIVE_MATCHERS = [
+  ...SENSITIVE_PREFIXES.map((prefix) => ({
+    label: prefix,
+    test: (path) => path.startsWith(prefix)
+  })),
+  ...SENSITIVE_GLOBS.map((glob) => {
+    const regex = globToRegex(glob);
+    return { label: glob, test: (path) => regex.test(path) };
+  })
+];
+
+// plugins/sp/lib/transcript.ts
+import { existsSync as existsSync2, readdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join as join2 } from "node:path";
+var SESSION_ID = /^[A-Za-z0-9_-]+$/;
+var PI_ROLES = new Set(["user", "assistant", "toolResult"]);
+function sniffFormat(rows) {
+  for (const row of rows) {
+    if (row.type === "message" && PI_ROLES.has(row.message?.role ?? ""))
+      return "pi";
+    if (row.type === "user" || row.type === "assistant")
+      return "claude";
+  }
+  return "unknown";
+}
+function parseRows(lines) {
+  const rows = [];
+  let skippedLines = 0;
+  for (const line of lines) {
+    if (!line.trim())
+      continue;
+    let row;
+    try {
+      row = JSON.parse(line);
+    } catch {
+      skippedLines++;
+      continue;
+    }
+    const ts = row.timestamp ? Date.parse(row.timestamp) : Number.NaN;
+    if (!Number.isNaN(ts))
+      rows.push([row, ts]);
+  }
+  return { rows, skippedLines, format: sniffFormat(rows.map(([r]) => r)) };
+}
+function resolveTranscript(env, projectsRoot = join2(homedir(), ".claude", "projects"), override) {
+  if (override)
+    return existsSync2(override) ? { ok: true, path: override } : { ok: false, reason: "no transcript" };
+  const id = env.CLAUDE_CODE_SESSION_ID;
+  if (!id) {
+    const piFile = env.PI_SESSION_FILE;
+    if (piFile !== undefined && piFile !== "") {
+      return existsSync2(piFile) ? { ok: true, path: piFile } : { ok: false, reason: `PI_SESSION_FILE ${piFile} does not exist` };
+    }
+    return {
+      ok: false,
+      reason: "no host session id; pass --transcript <path> (pi: ~/.pi/agent/sessions/<cwd-slug>/<file>.jsonl, " + "or set PI_SESSION_FILE)"
+    };
+  }
+  if (!SESSION_ID.test(id))
+    return { ok: false, reason: "refusing a session id with path characters" };
+  if (!existsSync2(projectsRoot))
+    return { ok: false, reason: `no transcript root ${projectsRoot}` };
+  for (const dir of readdirSync(projectsRoot)) {
+    const path = join2(projectsRoot, dir, `${id}.jsonl`);
+    if (existsSync2(path))
+      return { ok: true, path };
+  }
+  return { ok: false, reason: `no transcript for session ${id}` };
+}
+
+// plugins/sp/lib/run-summary-core.ts
 function renderSummaryMarkdown(summary) {
   const line = (r, bold = false) => {
     const stage = bold ? `**${r.stage}**` : r.stage;
@@ -493,9 +535,9 @@ function renderSummaryMarkdown(summary) {
 }
 function writeCloseSummary(run, opts = {}) {
   const cwd = opts.cwd ?? process.cwd();
-  const runDir = join2(cwd, ".spur", "run");
-  const rel = join2(".spur", "run", `${run.runId}-summary.md`);
-  const abs = join2(cwd, rel);
+  const runDir = join3(cwd, ".spur", "run");
+  const rel = join3(".spur", "run", `${run.runId}-summary.md`);
+  const abs = join3(cwd, rel);
   const na = (reason) => {
     mkdirSync(runDir, { recursive: true });
     writeFileSync(abs, `Execution summary: n/a (${reason})
@@ -508,15 +550,19 @@ function writeCloseSummary(run, opts = {}) {
     const resolved = resolveTranscript(opts.env ?? getEnvVars(), opts.projectsRoot);
     if (!resolved.ok)
       return na(resolved.reason);
-    const lines = readFileSync(resolved.path, "utf8").split(`
-`);
-    const summary = buildRunSummary(lines, [{ progress: run.progress }], run.startedAt, run.completedAt);
+    const { rows, skippedLines } = parseRows(readFileSync(resolved.path, "utf8").split(`
+`));
+    const summary = buildRunSummary(rows, [{ progress: run.progress }], {
+      since: run.startedAt,
+      until: run.completedAt,
+      skippedLines
+    });
     if (summary.rows.length === 0)
       return na("no timed attempts");
     mkdirSync(runDir, { recursive: true });
     writeFileSync(abs, `${renderSummaryMarkdown(summary)}
 `);
-    writeFileSync(join2(runDir, `${run.runId}-summary.json`), JSON.stringify({ ...summary, runId: run.runId, startedAt: run.startedAt, completedAt: run.completedAt }, null, 2));
+    writeFileSync(join3(runDir, `${run.runId}-summary.json`), JSON.stringify({ ...summary, runId: run.runId, startedAt: run.startedAt, completedAt: run.completedAt }, null, 2));
     return rel;
   } catch (error) {
     return na(error instanceof Error ? error.message : String(error));
@@ -552,29 +598,10 @@ function refuseUnsafeRunId(runId) {
   console.error("  The run id must be a single safe filename component (alphanumeric/._-, no leading dot, no path separators, interpolation or traversal; same class as the task-pipeline route-reason guard, task 0804 R8). Allocate a fresh run id (uuid or timestamp slug) and retry.");
   process.exit(1);
 }
-function resolveAppEntry(spurBin) {
-  const fallback = fileURLToPath(new URL("../../../apps/cli/src/index.ts", import.meta.url));
-  const candidates = spurBin !== "" ? [spurBin] : [fallback];
-  for (const candidate of candidates) {
-    const tokens = candidate.split(/\s+/).filter(Boolean);
-    const mainModule = [...tokens].reverse().find((t) => t.endsWith(".ts"));
-    if (mainModule === undefined || !existsSync3(mainModule))
-      continue;
-    const repoRoot = resolve(dirname(mainModule), "..", "..", "..");
-    const appEntry = join3(repoRoot, "packages", "app", "src", "index.ts");
-    if (existsSync3(appEntry))
-      return { entry: appEntry, portable: false };
-  }
-  const entry = fileURLToPath(new URL("../lib/inline-run.generated.mjs", import.meta.url));
-  if (!existsSync3(entry)) {
-    throw new Error("inline application bundle is missing \u2014 rebuild/install the sp plugin before running inline");
-  }
-  return { entry, portable: true };
-}
 var SETUP_EXPORTS = ["readInstalledInventory", "runInlineRunSetup", "writeInlineRunOutcome"];
 async function main() {
   if (!process.versions.bun) {
-    const child = spawnSync("bun", [fileURLToPath(import.meta.url), ...process.argv.slice(2)], {
+    const child = spawnSync("bun", [fileURLToPath2(import.meta.url), ...process.argv.slice(2)], {
       stdio: "inherit"
     });
     if (child.error)
@@ -643,7 +670,7 @@ async function main() {
       refuseUnsafeRunId(runId);
     try {
       const { app: app2, portable: portable2 } = await loadInlineApp(spurBin, resolveAppEntry, ["runInlineRunDecide"]);
-      const { app: lib } = await loadInlineApp(spurBin, () => ({ entry: fileURLToPath(new URL("../lib/inline-run.generated.mjs", import.meta.url)), portable: portable2 }), ["resolveDecideDecisionMakerEnabled", "loadSpurConfig"]);
+      const { app: lib } = await loadInlineApp(spurBin, () => ({ entry: fileURLToPath2(new URL("../lib/inline-run.generated.mjs", import.meta.url)), portable: portable2 }), ["resolveDecideDecisionMakerEnabled", "loadSpurConfig"]);
       const loadOpts = portable2 ? { embeddedSchemas: lib.EMBEDDED_SPUR_SCHEMAS } : undefined;
       const [enabled, spurConfig] = await Promise.all([
         lib.resolveDecideDecisionMakerEnabled(process.cwd(), loadOpts),
@@ -699,7 +726,7 @@ async function main() {
     inventory = await app.readInstalledInventory({
       file,
       spurBin,
-      localCli: fileURLToPath(new URL("../../../apps/cli/src/index.ts", import.meta.url))
+      localCli: fileURLToPath2(new URL("../../../apps/cli/src/index.ts", import.meta.url))
     });
   } catch (error) {
     const message = `could not resolve the workflow definition: ${error instanceof Error ? error.message : String(error)}`;

package/plugins/sp/scripts/inline-run-setup.ts

@@ -3,13 +3,11 @@
  *  handshake, mode dispatch. Mode bodies live in the bundled app service (`runInlineRun*` exports); the `.mjs`
  *  twin re-enters Bun in `main()` (SQLite) and imports the bundle dynamically, so bare `node` never loads app code. */
 import { spawnSync } from 'node:child_process';
-import { existsSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 // Type-only namespace import (erased before bundling; the smoke scanner exempts `import type`).
 import type * as spurApp from '@gobing-ai/spur-app';
 import { getEnvVar } from '../lib/env';
-import { loadInlineApp } from '../lib/inline-run-app';
+import { loadInlineApp, resolveAppEntry } from '../lib/inline-run-app';
 import { writeCloseSummary } from './run-summary';
 
 // EMBEDDED_SPUR_SCHEMAS: declared by the bundle twin, never exported by the barrel — optional
@@ -47,24 +45,6 @@ function refuseUnsafeRunId(runId: string): never {
 }
 
 /** Resolve the app entry: --spur-bin/SPUR_BIN main module if it proves a repo checkout, else the adjacent bundle. */
-function resolveAppEntry(spurBin: string): { entry: string; portable: boolean } {
-    const fallback = fileURLToPath(new URL('../../../apps/cli/src/index.ts', import.meta.url));
-    const candidates = spurBin !== '' ? [spurBin] : [fallback];
-    for (const candidate of candidates) {
-        const tokens = candidate.split(/\s+/).filter(Boolean);
-        // Main module = last path-like token; only a .ts source entry proves a repo checkout.
-        const mainModule = [...tokens].reverse().find((t) => t.endsWith('.ts'));
-        if (mainModule === undefined || !existsSync(mainModule)) continue;
-        const repoRoot = resolve(dirname(mainModule), '..', '..', '..');
-        const appEntry = join(repoRoot, 'packages', 'app', 'src', 'index.ts');
-        if (existsSync(appEntry)) return { entry: appEntry, portable: false };
-    }
-    const entry = fileURLToPath(new URL('../lib/inline-run.generated.mjs', import.meta.url));
-    if (!existsSync(entry)) {
-        throw new Error('inline application bundle is missing — rebuild/install the sp plugin before running inline');
-    }
-    return { entry, portable: true };
-}
 
 const SETUP_EXPORTS = ['readInstalledInventory', 'runInlineRunSetup', 'writeInlineRunOutcome'] as const;
 

package/plugins/sp/scripts/quality-gate.mjs

@@ -24437,6 +24437,7 @@ function isRfc3339Timestamp(value) {
 var ALL_FINDING_CODES = [
   "L1.markdown-parse",
   "L1.schema-validation",
+  "L1.wbs-collision",
   "L2.missing-required-section",
   "L2.forbidden-section",
   "L2.disallowed-section",
@@ -24464,6 +24465,7 @@ var ALL_FINDING_CODES = [
   "L4.design-placeholder",
   "L4.feature-not-found",
   "L4.feature-terminal",
+  "L4.feature-deprecated",
   "L4.missing-feature-id",
   "L4.parent-not-found",
   "L4.dependency-not-found",
@@ -24901,7 +24903,7 @@ var POST_WATERMARK_TABLES = [
   "history_daily_stats",
   "history_board_source_daily"
 ];
-var HISTORY_IMPORT_SCHEMA_VERSION = "0.5.22";
+var HISTORY_IMPORT_SCHEMA_VERSION = "0.5.24";
 var HISTORY_IMPORT_SCHEMA_SQL = `
 CREATE TABLE IF NOT EXISTS history_import_checkpoint (
     source TEXT NOT NULL,
@@ -27620,6 +27622,8 @@ var artifactsTable = defineTable("artifacts", {
   ...standardColumns
 });
 var artifacts = artifactsTable.table;
+var encoder = new TextEncoder;
+var decoder = new TextDecoder;
 init_schema();
 var phaseRunsTable = defineTable("phase_runs", {
   id: text("id").primaryKey(),
@@ -29820,7 +29824,15 @@ function escapeYamlValue(value) {
 }
 init_zod();
 var TASK_STATUSES = ["backlog", "todo", "wip", "testing", "blocked", "done", "cancelled"];
-var FEATURE_STATUSES = ["backlog", "active", "verifying", "blocked", "done", "cancelled"];
+var FEATURE_STATUSES = [
+  "backlog",
+  "active",
+  "verifying",
+  "blocked",
+  "done",
+  "cancelled",
+  "deprecated"
+];
 var PRIORITIES = ["P0", "P1", "P2", "P3"];
 var PROFILES = [
   "simple",

package/plugins/sp/scripts/residual-scan.mjs

@@ -15,6 +15,32 @@ function getEnvVars() {
 // plugins/sp/lib/residual-scan.generated.mjs
 import { join } from "node:path";
 import { createHash } from "node:crypto";
+var CLAIM_MARKERS = [
+  /@[a-z0-9._-]+\/[a-z0-9._-]+/i,
+  /\bnode_modules\//,
+  /\b\d+\.\d+\.\d+\b/,
+  /`[A-Za-z_$][\w.$]*\s*\([^`]*\)`/
+];
+var CITATION_FORMS = [
+  /`[^`\s]+:\d+(?:-\d+)?`/,
+  /`[^`]+`\s+lines?\s+\d+/i,
+  /\b[\w./-]+\.[A-Za-z0-9]+:\d+(?:-\d+)?\b/,
+  /https?:\/\/\S+/i
+];
+function hasClaimMarker(evidence) {
+  return CLAIM_MARKERS.some((re) => re.test(evidence));
+}
+function hasCitationForm(evidence) {
+  return CITATION_FORMS.some((re) => re.test(evidence));
+}
+var CONFIDENCE_LEVELS = ["HIGH", "MEDIUM", "LOW"];
+function extractAnswerConfidence(text) {
+  const matches = [...text.matchAll(/^\s*Confidence:\s*(\S+)\s*$/gim)];
+  if (matches.length !== 1)
+    return;
+  const value = (matches[0]?.[1] ?? "").toUpperCase();
+  return CONFIDENCE_LEVELS.includes(value) ? value : undefined;
+}
 var MARKER_PATTERN = /TODO|FIXME|XXX|HACK/;
 var PRIORITY_PATTERN = /^P[1-4]/;
 var RANGE_PRIORITY = /^P[1-4]\s*[\u2013\u2014-]\s*P?[1-4]/;
@@ -41,11 +67,15 @@ function locationOf(locationCell, finding) {
   const backtick = finding.match(/`([^`]+)`/)?.[1];
   return backtick === undefined ? "" : normalizeAnchor(backtick);
 }
-function parseReviewFindings(taskContent) {
+function reviewBody(taskContent) {
   const section = taskContent.split(/^### Review\b/m)[1];
-  if (section === undefined)
+  return section === undefined ? null : section.split(/^### /m)[0] ?? "";
+}
+function parseReviewFindings(taskContent) {
+  const section = reviewBody(taskContent);
+  if (section === null)
     return [];
-  const body = section.split(/^### /m)[0] ?? "";
+  const body = section;
   const out = [];
   const lines = body.split(`
 `);
@@ -158,7 +188,8 @@ function scanResiduals(inputs) {
       "review-finding": true,
       "diff-marker": base !== null,
       "unchecked-box": true,
-      "staging-residue": true
+      "staging-residue": true,
+      "review-contract": false
     },
     items,
     counts
@@ -179,8 +210,36 @@ function blockingReviewFindings(taskContent, deferrals) {
   }));
   return classify(items, [...tableDeferrals, ...deferrals]);
 }
+function reviewContractViolations(taskContent) {
+  const violations = [];
+  const body = reviewBody(taskContent);
+  if (body !== null && extractAnswerConfidence(body.replace(/\*\*/g, "")) === undefined) {
+    violations.push({
+      location: "task-file:Review",
+      text: "Review report carries no single valid `**Confidence:** HIGH | MEDIUM | LOW` line — " + "state the level the report can defend (HIGH: every requirement row MET, every finding " + "dispositioned, evidence cited; MEDIUM/LOW: name the gap)."
+    });
+  }
+  for (const row of parseReviewFindings(taskContent)) {
+    if (hasClaimMarker(row.text) && !hasCitationForm(row.text)) {
+      violations.push({
+        location: row.location.length > 0 ? row.location : "task-file:Review",
+        text: `${row.priority} finding asserts an external API/library/version claim without a ` + "same-cell citation (add a repo `path:line`, an external named-origin form, or a URL " + `to the Finding cell): ${row.text.slice(0, 80)}`
+      });
+    }
+  }
+  return violations;
+}
 function buildReviewGateArtifact(wbs, taskContent, deferrals) {
-  const items = blockingReviewFindings(taskContent, deferrals);
+  const items = [
+    ...blockingReviewFindings(taskContent, deferrals),
+    ...reviewContractViolations(taskContent).map((v) => ({
+      id: makeItemId("review-contract", v.location, v.text),
+      category: "review-contract",
+      class: "blocking",
+      location: v.location,
+      text: v.text
+    }))
+  ];
   const blocking = items.filter((i) => i.class === "blocking");
   const counts = { blocking: 0, deferrable: 0, advisory: 0, housekeeping: 0 };
   for (const item of items)
@@ -192,7 +251,8 @@ function buildReviewGateArtifact(wbs, taskContent, deferrals) {
       "review-finding": true,
       "diff-marker": false,
       "unchecked-box": false,
-      "staging-residue": false
+      "staging-residue": false,
+      "review-contract": true
     },
     items,
     counts
@@ -518,6 +578,12 @@ function settleMode(opts, env, io) {
 }
 function reportMode(opts, env, io) {
   const runDir = join2(opts.root, ".spur", "run");
+  const verdictPath = recordedVerdictPath(runDir, opts.wbs, fs);
+  if (!fs.existsSync(verdictPath)) {
+    io.err(`residual-report: no verdict at ${verdictPath}; nothing to report for ${opts.wbs}
+`);
+    return 0;
+  }
   const sweep = loadVerdict(runDir, opts.wbs).checks.find((c) => c.name === "residual-sweep");
   if (sweep === undefined || sweep.status !== "fail")
     return 0;
@@ -558,6 +624,7 @@ process.exit(main(process.argv.slice(2)));
 export {
   verdictDisagreementNote,
   scanResiduals2 as scanResiduals,
+  reviewContractViolations,
   renderReport,
   recordedVerdictPath,
   parseScanArgs,

package/plugins/sp/scripts/residual-scan.ts

@@ -162,11 +162,8 @@ function settleMode(opts: ParsedArgs, env: ScanEnv, io: ScanIo): number {
     if (fs.existsSync(residualsPath)) prior = JSON.parse(fs.readFileSync(residualsPath, 'utf8'));
     const deferred = scan.items.filter((i) => i.class === 'deferrable');
     if (deferred.length > 0 && prior.followUp === undefined) {
-        // The follow-up is filed UNLINKED: carrying a feature edge to the feature whose run produced
-        // it made that feature's done-gate fail with `L4.verifying-incomplete-tasks` the moment a
-        // residual was deferred (2026-10-04 session, E72/1086→1087), so a deferral must not be able
-        // to block the completing feature. The source task and its feature stay named in the
-        // Background, which keeps the traceability without the lifecycle coupling.
+        // Filed UNLINKED: a feature edge failed that feature's done-gate (`L4.verifying-incomplete-tasks`,
+        // E72/1086→1087); the Background still names the source task and feature for traceability.
         const args = ['task', 'create', `Residuals from ${wbs}`, '--skip-ready', '--json'];
         const created = spur(env, opts.spurBin, args, opts.root);
         let wbsNew = '';
@@ -206,6 +203,12 @@ function settleMode(opts: ParsedArgs, env: ScanEnv, io: ScanIo): number {
 }
 function reportMode(opts: ParsedArgs, env: ScanEnv, io: ScanIo): number {
     const runDir = join(opts.root, '.spur', 'run');
+    // A fix-budget-exhausted run never reaches verify: no verdict is a no-op, not ENOENT (1178 run 1).
+    const verdictPath = core.recordedVerdictPath(runDir, opts.wbs, fs);
+    if (!fs.existsSync(verdictPath)) {
+        io.err(`residual-report: no verdict at ${verdictPath}; nothing to report for ${opts.wbs}\n`);
+        return 0;
+    }
     const sweep = loadVerdict(runDir, opts.wbs).checks.find((c) => c.name === 'residual-sweep');
     if (sweep === undefined || sweep.status !== 'fail') return 0;
     const { content } = loadTask(env, opts.spurBin, opts.wbs, opts.root);