@gobing-ai/spur 0.4.2 → 0.4.3

package/plugins/sp/scripts/run-summary.mjs

@@ -13,13 +13,16 @@ function getEnvVars() {
 import { existsSync as existsSync2, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { join as join2 } from "node:path";
 
-// plugins/sp/lib/transcript.ts
-import { existsSync, readdirSync } from "node:fs";
-import { homedir } from "node:os";
-import { join } from "node:path";
-var SESSION_ID = /^[A-Za-z0-9_-]+$/;
-var OPERATOR_TOOLS = new Set(["AskUserQuestion", "ask_user_question"]);
-var PI_ROLES = new Set(["user", "assistant", "toolResult"]);
+// plugins/sp/lib/env.ts
+function getEnvVars2() {
+  return process.env;
+}
+
+// plugins/sp/lib/plan-projection.generated.mjs
+var NON_ABORTING_PREFLIGHT_CODES = new Set([
+  "L4.scenario-unverified",
+  "L4.verifying-incomplete-tasks"
+]);
 var zeroTokens = () => ({ input: 0, cacheCreate: 0, cacheRead: 0, output: 0 });
 function formatDuration(ms) {
   const s = Math.round(ms / 1000);
@@ -39,6 +42,26 @@ function formatTokenSplit(t) {
   const nonCached = t.input + t.cacheCreate + t.output;
   return `${formatTokens(nonCached + t.cacheRead)} / ${formatTokens(nonCached)}`;
 }
+var OPERATOR_TOOLS = new Set(["AskUserQuestion", "ask_user_question"]);
+function isCompaction(row) {
+  return row.type === "compaction" || row.type === "system" && row.subtype === "compact_boundary";
+}
+function firstTextContent(row) {
+  const content = row.message?.content;
+  if (typeof content === "string")
+    return content;
+  if (!Array.isArray(content))
+    return;
+  return content.find((b) => b.type === "text")?.text;
+}
+function skillInvocationPrompt(text) {
+  const name = /^\s*<skill name="([^"]+)"/.exec(text)?.[1];
+  if (name === undefined)
+    return;
+  const close = text.lastIndexOf("</skill>");
+  const args = close < 0 ? "" : text.slice(close + "</skill>".length).trim();
+  return args === "" ? `/${name}` : `/${name} ${args}`;
+}
 function promptText(row) {
   if (row.type === "custom_message") {
     if (row.display === false)
@@ -63,22 +86,6 @@ function promptText(row) {
     return;
   return content.find((b) => b.type === "text")?.text;
 }
-function firstTextContent(row) {
-  const content = row.message?.content;
-  if (typeof content === "string")
-    return content;
-  if (!Array.isArray(content))
-    return;
-  return content.find((b) => b.type === "text")?.text;
-}
-function skillInvocationPrompt(text) {
-  const name = /^\s*<skill name="([^"]+)"/.exec(text)?.[1];
-  if (name === undefined)
-    return;
-  const close = text.lastIndexOf("</skill>");
-  const args = close < 0 ? "" : text.slice(close + "</skill>".length).trim();
-  return args === "" ? `/${name}` : `/${name} ${args}`;
-}
 function sumTokens(all) {
   const total = zeroTokens();
   for (const t of all)
@@ -150,77 +157,14 @@ function accumulate(acc, row, ts) {
     });
   }
 }
-function isCompaction(row) {
-  return row.type === "compaction" || row.type === "system" && row.subtype === "compact_boundary";
-}
-function sniffFormat(rows) {
-  for (const row of rows) {
-    if (row.type === "message" && PI_ROLES.has(row.message?.role ?? ""))
-      return "pi";
-    if (row.type === "user" || row.type === "assistant")
-      return "claude";
-  }
-  return "unknown";
-}
-function parseRows(lines) {
-  const rows = [];
-  let skippedLines = 0;
-  for (const line of lines) {
-    if (!line.trim())
-      continue;
-    let row;
-    try {
-      row = JSON.parse(line);
-    } catch {
-      skippedLines++;
-      continue;
-    }
-    const ts = row.timestamp ? Date.parse(row.timestamp) : Number.NaN;
-    if (!Number.isNaN(ts))
-      rows.push([row, ts]);
-  }
-  return { rows, skippedLines, format: sniffFormat(rows.map(([r]) => r)) };
-}
-function resolveTranscript(env, projectsRoot = join(homedir(), ".claude", "projects"), override) {
-  if (override)
-    return existsSync(override) ? { ok: true, path: override } : { ok: false, reason: "no transcript" };
-  const id = env.CLAUDE_CODE_SESSION_ID;
-  if (!id) {
-    const piFile = env.PI_SESSION_FILE;
-    if (piFile !== undefined && piFile !== "") {
-      return existsSync(piFile) ? { ok: true, path: piFile } : { ok: false, reason: `PI_SESSION_FILE ${piFile} does not exist` };
-    }
-    return {
-      ok: false,
-      reason: "no host session id; pass --transcript <path> (pi: ~/.pi/agent/sessions/<cwd-slug>/<file>.jsonl, " + "or set PI_SESSION_FILE)"
-    };
-  }
-  if (!SESSION_ID.test(id))
-    return { ok: false, reason: "refusing a session id with path characters" };
-  if (!existsSync(projectsRoot))
-    return { ok: false, reason: `no transcript root ${projectsRoot}` };
-  for (const dir of readdirSync(projectsRoot)) {
-    const path = join(projectsRoot, dir, `${id}.jsonl`);
-    if (existsSync(path))
-      return { ok: true, path };
-  }
-  return { ok: false, reason: `no transcript for session ${id}` };
-}
-
-// plugins/sp/lib/env.ts
-function getEnvVars2() {
-  return process.env;
-}
-
-// plugins/sp/lib/run-summary-core.ts
 var IDLE_GAP_MS = 300000;
 var SHELL_TOOLS = new Set(["bash", "shell", "exec", "exec_command", "run_command", "command"]);
 var SUBAGENT_TOOLS = new Set(["agent", "task", "invoke_subagent", "subagent", "dispatch_agent"]);
-var OPERATOR_TOOLS2 = new Set(["askuserquestion", "ask_user_question"]);
+var LOWERCASE_OPERATOR_TOOLS = new Set(["askuserquestion", "ask_user_question"]);
 var ACTOR_PRECEDENCE = ["operator", "subagent", "shell", "other"];
 function actorOf(tool) {
   const t = tool.toLowerCase().replace(/[^a-z_]/g, "");
-  if (OPERATOR_TOOLS2.has(t))
+  if (LOWERCASE_OPERATOR_TOOLS.has(t))
     return "operator";
   if (SUBAGENT_TOOLS.has(t))
     return "subagent";
@@ -370,7 +314,8 @@ function summaryRow(stage, status, span, measured) {
     token: formatTokenSplit(measured ? span.tokens : null)
   };
 }
-function buildRunSummary(lines, inputs, since, until) {
+function buildRunSummary(rows, inputs, opts = {}) {
+  const { since, until } = opts;
   const windows = [];
   for (const { label, progress } of inputs) {
     const states = (progress.states ?? []).flatMap((s) => {
@@ -396,7 +341,6 @@ function buildRunSummary(lines, inputs, since, until) {
     }
   }
   windows.sort((a, b) => a.start - b.start);
-  const { rows, skippedLines } = parseRows(lines);
   const measure = (start, end) => {
     const acc = newAcc(start);
     for (const [row, ts] of rows)
@@ -444,9 +388,87 @@ function buildRunSummary(lines, inputs, since, until) {
     total,
     actors: actorSplit(rows, totalStart, totalEnd),
     gate: { ms: null, reason: "no matching check receipt" },
-    skippedLines
+    skippedLines: opts.skippedLines ?? 0
   };
 }
+var SENSITIVE_PREFIXES = ["drizzle/", "packages/config/", ".github/", "plugins/sp/hooks/"];
+var SENSITIVE_GLOBS = ["apps/server/src/**/auth*", "**/*secret*", "**/*.sql"];
+function globToRegex(glob) {
+  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replaceAll("**/", "\x00").replaceAll("**", "\x01").replaceAll("*", "[^/]*").replaceAll("\x00", "(?:.*/)?").replaceAll("\x01", ".*");
+  return new RegExp(`^${escaped}$`, "s");
+}
+var SENSITIVE_MATCHERS = [
+  ...SENSITIVE_PREFIXES.map((prefix) => ({
+    label: prefix,
+    test: (path) => path.startsWith(prefix)
+  })),
+  ...SENSITIVE_GLOBS.map((glob) => {
+    const regex = globToRegex(glob);
+    return { label: glob, test: (path) => regex.test(path) };
+  })
+];
+
+// plugins/sp/lib/transcript.ts
+import { existsSync, readdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+var SESSION_ID = /^[A-Za-z0-9_-]+$/;
+var PI_ROLES = new Set(["user", "assistant", "toolResult"]);
+function sniffFormat(rows) {
+  for (const row of rows) {
+    if (row.type === "message" && PI_ROLES.has(row.message?.role ?? ""))
+      return "pi";
+    if (row.type === "user" || row.type === "assistant")
+      return "claude";
+  }
+  return "unknown";
+}
+function parseRows(lines) {
+  const rows = [];
+  let skippedLines = 0;
+  for (const line of lines) {
+    if (!line.trim())
+      continue;
+    let row;
+    try {
+      row = JSON.parse(line);
+    } catch {
+      skippedLines++;
+      continue;
+    }
+    const ts = row.timestamp ? Date.parse(row.timestamp) : Number.NaN;
+    if (!Number.isNaN(ts))
+      rows.push([row, ts]);
+  }
+  return { rows, skippedLines, format: sniffFormat(rows.map(([r]) => r)) };
+}
+function resolveTranscript(env, projectsRoot = join(homedir(), ".claude", "projects"), override) {
+  if (override)
+    return existsSync(override) ? { ok: true, path: override } : { ok: false, reason: "no transcript" };
+  const id = env.CLAUDE_CODE_SESSION_ID;
+  if (!id) {
+    const piFile = env.PI_SESSION_FILE;
+    if (piFile !== undefined && piFile !== "") {
+      return existsSync(piFile) ? { ok: true, path: piFile } : { ok: false, reason: `PI_SESSION_FILE ${piFile} does not exist` };
+    }
+    return {
+      ok: false,
+      reason: "no host session id; pass --transcript <path> (pi: ~/.pi/agent/sessions/<cwd-slug>/<file>.jsonl, " + "or set PI_SESSION_FILE)"
+    };
+  }
+  if (!SESSION_ID.test(id))
+    return { ok: false, reason: "refusing a session id with path characters" };
+  if (!existsSync(projectsRoot))
+    return { ok: false, reason: `no transcript root ${projectsRoot}` };
+  for (const dir of readdirSync(projectsRoot)) {
+    const path = join(projectsRoot, dir, `${id}.jsonl`);
+    if (existsSync(path))
+      return { ok: true, path };
+  }
+  return { ok: false, reason: `no transcript for session ${id}` };
+}
+
+// plugins/sp/lib/run-summary-core.ts
 function renderSummaryMarkdown(summary) {
   const line = (r, bold = false) => {
     const stage = bold ? `**${r.stage}**` : r.stage;
@@ -547,9 +569,13 @@ function writeCloseSummary(run, opts = {}) {
     const resolved = resolveTranscript(opts.env ?? getEnvVars2(), opts.projectsRoot);
     if (!resolved.ok)
       return na(resolved.reason);
-    const lines = readFileSync(resolved.path, "utf8").split(`
-`);
-    const summary = buildRunSummary(lines, [{ progress: run.progress }], run.startedAt, run.completedAt);
+    const { rows, skippedLines } = parseRows(readFileSync(resolved.path, "utf8").split(`
+`));
+    const summary = buildRunSummary(rows, [{ progress: run.progress }], {
+      since: run.startedAt,
+      until: run.completedAt,
+      skippedLines
+    });
     if (summary.rows.length === 0)
       return na("no timed attempts");
     mkdirSync(runDir, { recursive: true });
@@ -583,8 +609,35 @@ import { existsSync as existsSync3, readdirSync as readdirSync2 } from "node:fs"
 import { homedir as homedir2 } from "node:os";
 import { join as join3 } from "node:path";
 var SESSION_ID2 = /^[A-Za-z0-9_-]+$/;
-var OPERATOR_TOOLS3 = new Set(["AskUserQuestion", "ask_user_question"]);
 var PI_ROLES2 = new Set(["user", "assistant", "toolResult"]);
+function sniffFormat2(rows) {
+  for (const row of rows) {
+    if (row.type === "message" && PI_ROLES2.has(row.message?.role ?? ""))
+      return "pi";
+    if (row.type === "user" || row.type === "assistant")
+      return "claude";
+  }
+  return "unknown";
+}
+function parseRows2(lines) {
+  const rows = [];
+  let skippedLines = 0;
+  for (const line of lines) {
+    if (!line.trim())
+      continue;
+    let row;
+    try {
+      row = JSON.parse(line);
+    } catch {
+      skippedLines++;
+      continue;
+    }
+    const ts = row.timestamp ? Date.parse(row.timestamp) : Number.NaN;
+    if (!Number.isNaN(ts))
+      rows.push([row, ts]);
+  }
+  return { rows, skippedLines, format: sniffFormat2(rows.map(([r]) => r)) };
+}
 function resolveTranscript2(env, projectsRoot = join3(homedir2(), ".claude", "projects"), override) {
   if (override)
     return existsSync3(override) ? { ok: true, path: override } : { ok: false, reason: "no transcript" };
@@ -679,8 +732,9 @@ function main(argv, env = getEnvVars(), write = (s) => process.stdout.write(s),
       const [label, file] = eq > 0 ? [arg.slice(0, eq), arg.slice(eq + 1)] : [undefined, arg];
       return { label, progress: JSON.parse(readFileSync2(file, "utf8")) };
     });
-    const summary = buildRunSummary(readFileSync2(resolved.path, "utf8").split(`
-`), inputs, since);
+    const { rows, skippedLines } = parseRows2(readFileSync2(resolved.path, "utf8").split(`
+`));
+    const summary = buildRunSummary(rows, inputs, { since, skippedLines });
     summary.gate = gateFromReceipt(process.cwd(), inputs[0]?.progress.runId ?? "");
     write(`${markdown ? renderSummaryMarkdown(summary) : JSON.stringify({ ...summary, transcript: resolved.path })}
 `);

package/plugins/sp/scripts/run-summary.ts

@@ -4,9 +4,10 @@
  * (`--no-summary` skips it). Inputs: one or more `spur workflow progress <run-id> --json` files
  * (`--progress [<label>=]<file>`) and the host transcript (resolved like session-timeline, or
  * `--transcript`), OR the close-written per-run summary files (`--rollup [<label>=]<file>`, 1146 R3).
- * Measurement and rendering live in `../lib/run-summary-core` (ADR-130 glue budget); this script is
- * argv parsing and dispatch. Reporting only: no transcript or no timed attempts → an `n/a` result,
- * exit 0. Node builtins only.
+ * Measurement lives in `packages/app/src/workflow/run-summary.ts` (reached through the generated
+ * pure bundle entry); presentation and host IO live in `../lib/run-summary-core` (ADR-130 glue
+ * budget). This script is argv parsing and dispatch. Reporting only: no transcript or no timed
+ * attempts → an `n/a` result, exit 0. Node builtins only.
  */
 import { readFileSync } from 'node:fs';
 import { getEnvVars } from '../lib/env';
@@ -18,7 +19,7 @@ import {
     renderRollupMarkdown,
     renderSummaryMarkdown,
 } from '../lib/run-summary-core';
-import { resolveTranscript } from '../lib/transcript';
+import { parseRows, resolveTranscript } from '../lib/transcript';
 
 // Re-exported so the suite and any consumer keep one import path for the whole surface.
 export * from '../lib/run-summary-core';
@@ -90,7 +91,8 @@ export function main(
             const [label, file] = eq > 0 ? [arg.slice(0, eq), arg.slice(eq + 1)] : [undefined, arg];
             return { label, progress: JSON.parse(readFileSync(file, 'utf8')) as Progress };
         });
-        const summary = buildRunSummary(readFileSync(resolved.path, 'utf8').split('\n'), inputs, since);
+        const { rows, skippedLines } = parseRows(readFileSync(resolved.path, 'utf8').split('\n'));
+        const summary = buildRunSummary(rows, inputs, { since, skippedLines });
         summary.gate = gateFromReceipt(process.cwd(), inputs[0]?.progress.runId ?? '');
         write(
             `${markdown ? renderSummaryMarkdown(summary) : JSON.stringify({ ...summary, transcript: resolved.path })}\n`,

package/plugins/sp/scripts/session-timeline.mjs

@@ -13,9 +13,12 @@ function getEnvVars() {
 import { existsSync, readdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
-var SESSION_ID = /^[A-Za-z0-9_-]+$/;
-var OPERATOR_TOOLS = new Set(["AskUserQuestion", "ask_user_question"]);
-var PI_ROLES = new Set(["user", "assistant", "toolResult"]);
+
+// plugins/sp/lib/plan-projection.generated.mjs
+var NON_ABORTING_PREFLIGHT_CODES = new Set([
+  "L4.scenario-unverified",
+  "L4.verifying-incomplete-tasks"
+]);
 var zeroTokens = () => ({ input: 0, cacheCreate: 0, cacheRead: 0, output: 0 });
 function formatDuration(ms) {
   const s = Math.round(ms / 1000);
@@ -35,6 +38,23 @@ function formatTokenSplit(t) {
   const nonCached = t.input + t.cacheCreate + t.output;
   return `${formatTokens(nonCached + t.cacheRead)} / ${formatTokens(nonCached)}`;
 }
+var OPERATOR_TOOLS = new Set(["AskUserQuestion", "ask_user_question"]);
+function firstTextContent(row) {
+  const content = row.message?.content;
+  if (typeof content === "string")
+    return content;
+  if (!Array.isArray(content))
+    return;
+  return content.find((b) => b.type === "text")?.text;
+}
+function skillInvocationPrompt(text) {
+  const name = /^\s*<skill name="([^"]+)"/.exec(text)?.[1];
+  if (name === undefined)
+    return;
+  const close = text.lastIndexOf("</skill>");
+  const args = close < 0 ? "" : text.slice(close + "</skill>".length).trim();
+  return args === "" ? `/${name}` : `/${name} ${args}`;
+}
 function promptText(row) {
   if (row.type === "custom_message") {
     if (row.display === false)
@@ -59,22 +79,6 @@ function promptText(row) {
     return;
   return content.find((b) => b.type === "text")?.text;
 }
-function firstTextContent(row) {
-  const content = row.message?.content;
-  if (typeof content === "string")
-    return content;
-  if (!Array.isArray(content))
-    return;
-  return content.find((b) => b.type === "text")?.text;
-}
-function skillInvocationPrompt(text) {
-  const name = /^\s*<skill name="([^"]+)"/.exec(text)?.[1];
-  if (name === undefined)
-    return;
-  const close = text.lastIndexOf("</skill>");
-  const args = close < 0 ? "" : text.slice(close + "</skill>".length).trim();
-  return args === "" ? `/${name}` : `/${name} ${args}`;
-}
 function sumTokens(all) {
   const total = zeroTokens();
   for (const t of all)
@@ -146,6 +150,29 @@ function accumulate(acc, row, ts) {
     });
   }
 }
+var SHELL_TOOLS = new Set(["bash", "shell", "exec", "exec_command", "run_command", "command"]);
+var SUBAGENT_TOOLS = new Set(["agent", "task", "invoke_subagent", "subagent", "dispatch_agent"]);
+var LOWERCASE_OPERATOR_TOOLS = new Set(["askuserquestion", "ask_user_question"]);
+var SENSITIVE_PREFIXES = ["drizzle/", "packages/config/", ".github/", "plugins/sp/hooks/"];
+var SENSITIVE_GLOBS = ["apps/server/src/**/auth*", "**/*secret*", "**/*.sql"];
+function globToRegex(glob) {
+  const escaped = glob.replace(/[.+^${}()|[\]\\]/g, "\\$&").replaceAll("**/", "\x00").replaceAll("**", "\x01").replaceAll("*", "[^/]*").replaceAll("\x00", "(?:.*/)?").replaceAll("\x01", ".*");
+  return new RegExp(`^${escaped}$`, "s");
+}
+var SENSITIVE_MATCHERS = [
+  ...SENSITIVE_PREFIXES.map((prefix) => ({
+    label: prefix,
+    test: (path) => path.startsWith(prefix)
+  })),
+  ...SENSITIVE_GLOBS.map((glob) => {
+    const regex = globToRegex(glob);
+    return { label: glob, test: (path) => regex.test(path) };
+  })
+];
+
+// plugins/sp/lib/transcript.ts
+var SESSION_ID = /^[A-Za-z0-9_-]+$/;
+var PI_ROLES = new Set(["user", "assistant", "toolResult"]);
 function sniffFormat(rows) {
   for (const row of rows) {
     if (row.type === "message" && PI_ROLES.has(row.message?.role ?? ""))

package/plugins/sp/scripts/task-diffstat.mjs

@@ -11,7 +11,15 @@ function getEnvVars() {
   return process.env;
 }
 
-// plugins/sp/scripts/task-diffstat.ts
+// plugins/sp/lib/plan-projection.generated.mjs
+var NON_ABORTING_PREFLIGHT_CODES = new Set([
+  "L4.scenario-unverified",
+  "L4.verifying-incomplete-tasks"
+]);
+var OPERATOR_TOOLS = new Set(["AskUserQuestion", "ask_user_question"]);
+var SHELL_TOOLS = new Set(["bash", "shell", "exec", "exec_command", "run_command", "command"]);
+var SUBAGENT_TOOLS = new Set(["agent", "task", "invoke_subagent", "subagent", "dispatch_agent"]);
+var LOWERCASE_OPERATOR_TOOLS = new Set(["askuserquestion", "ask_user_question"]);
 var SENSITIVE_PREFIXES = ["drizzle/", "packages/config/", ".github/", "plugins/sp/hooks/"];
 var SENSITIVE_GLOBS = ["apps/server/src/**/auth*", "**/*secret*", "**/*.sql"];
 function globToRegex(glob) {
@@ -32,6 +40,8 @@ function sensitiveReasonForPath(path) {
   const match = SENSITIVE_MATCHERS.find((entry) => entry.test(path));
   return match ? `matches sensitive pattern ${match.label}` : null;
 }
+
+// plugins/sp/scripts/task-diffstat.ts
 function defaultGitRunner(cwd) {
   return (args) => {
     const run = spawnSync("git", args, { cwd, encoding: "utf8" });

package/plugins/sp/scripts/task-diffstat.ts

@@ -65,45 +65,14 @@ export interface DiffstatResult extends Diffstat {
     exitCode: number;
 }
 
-/**
- * Sensitive paths (0943 R2c): any changed path under one of these forces the safety lane
- * before the `task-triage` decide runs — sensitive work is never lane-negotiated with a
- * model. Frozen list: `drizzle/`, `packages/config/`, auth-prefixed basenames anywhere
- * under the server src tree, `*secret*` basenames, `.github/`, `plugins/sp/hooks/`, and
- * any `*.sql` — spelled out in SENSITIVE_PREFIXES / SENSITIVE_GLOBS below (kept as data,
- * not prose, so the `*` / `/` sequences survive the doc comment).
- */
-export const SENSITIVE_PREFIXES = ['drizzle/', 'packages/config/', '.github/', 'plugins/sp/hooks/'] as const;
-export const SENSITIVE_GLOBS = ['apps/server/src/**/auth*', '**/*secret*', '**/*.sql'] as const;
-
-// Glob → RegExp: `**` + `/` matches any-or-no directories, bare `**` any characters, `*` within one segment.
-function globToRegex(glob: string): RegExp {
-    const escaped = glob
-        .replace(/[.+^${}()|[\]\\]/g, '\\$&')
-        .replaceAll('**/', '\u0000')
-        .replaceAll('**', '\u0001')
-        .replaceAll('*', '[^/]*')
-        .replaceAll('\u0000', '(?:.*/)?')
-        .replaceAll('\u0001', '.*');
-    return new RegExp(`^${escaped}$`, 's');
-}
-
-const SENSITIVE_MATCHERS: Array<{ label: string; test: (path: string) => boolean }> = [
-    ...SENSITIVE_PREFIXES.map((prefix) => ({
-        label: prefix,
-        test: (path: string): boolean => path.startsWith(prefix),
-    })),
-    ...SENSITIVE_GLOBS.map((glob) => {
-        const regex = globToRegex(glob);
-        return { label: glob, test: (path: string): boolean => regex.test(path) };
-    }),
-];
-
-/** Sensitive-pattern match for one path, or null — mirrors wrapup-drift-probe's driftReasonForPath. */
-export function sensitiveReasonForPath(path: string): string | null {
-    const match = SENSITIVE_MATCHERS.find((entry) => entry.test(path));
-    return match ? `matches sensitive pattern ${match.label}` : null;
-}
+// Task 1176: the sensitive-path policy (0943 R2c) moved to the workflow/task owner —
+// `packages/app/src/workflow/task-triage.ts`, reached through the generated pure bundle. That policy
+// still forces the safety lane for any changed path under the frozen sensitive list before the
+// `task-triage` decide runs, so sensitive work is never lane-negotiated with a model; this entry
+// keeps git capture and the output artifact, and re-exports the policy for existing callers.
+import { SENSITIVE_GLOBS, SENSITIVE_PREFIXES, sensitiveReasonForPath } from '../lib/plan-projection.generated.mjs';
+
+export { SENSITIVE_GLOBS, SENSITIVE_PREFIXES, sensitiveReasonForPath };
 
 function defaultGitRunner(cwd?: string): GitRunner {
     return (args: string[]): GitRunResult => {

package/plugins/sp/skills/code-implementation/SKILL.md

@@ -82,6 +82,12 @@ not have and work you were not asked to do.
 - **Never implement a requirement belonging to another WBS**, even when it looks like a
   prerequisite. If the target genuinely cannot proceed without it, stop and say so — a blocked task
   is a cheap finding; a two-task diff costs the reverts.
+- **Flip the target's `## Plan` boxes as each step completes.** They are this pass's progress
+  ledger, and the record-time residual sweep treats an *unchecked* Plan box as blocking: it
+  downgrades the verdict to PARTIAL and closes the `done` gate
+  (`docs/design/task-residual-sweep.md`), which costs a remediation cycle and a manual re-record.
+  Leave every finished step ticked through `spur task update <wbs> --section Plan --from-file`, and
+  if you deliberately skipped one, say so in the Solution change map.
 
 Why this is a rule and not a nicety: driving task 0486 lost several hours to exactly this. Task 0485
 was committed but still `todo` in the tree, and two different executors (omp run `ca130182`, claude
@@ -165,7 +171,7 @@ that single full gate.
 1. The **changed-path matrix** below (narrow behavior tests + affected consumers);
 2. the resolved `quality-gate` script in `light` mode (source-repo probe, else the installed twin) (biome on changed files, per-workspace typecheck, rule presets `rules:pre`/`rules:post`, related tests).
 
-Neither step takes the host-wide full-gate lock. The full gate is named only for the pipeline's `test` and `test-recheck` hops.
+Neither step takes the full project gate. The full gate is named only for the pipeline's `test` and `test-recheck` hops.
 
 | Changed surface | Required targeted tests | Required typechecks |
 | --- | --- | --- |

package/plugins/sp/skills/code-verification/references/secu-review.md

@@ -92,7 +92,8 @@ Before declaring a task `done`, run this lightweight checklist. It catches the m
 - [ ] Solution section contains `file:line` citations for every changed file.
 - [ ] API/library claims in changed docs carry a source citation (URL or `path:line`) and an honest
       confidence level (HIGH/MEDIUM/LOW) per source-driven-development; the deterministic advisory backstop is
-      the `cited-version-strings` / `cited-api-claims` rules (`.spur/rules/docs/sourced-api-claims.yaml`).
+      the `cited-version-strings` / `cited-api-claims` / `cited-api-claims-confidence` rules
+      (`.spur/rules/docs/sourced-api-claims.yaml`, run ad hoc — not wired into a preset).
 - [ ] Review section has P1–P4 findings table (even if all rows are empty — the table itself proves review happened).
 
 This checklist runs as part of the verify step when the task reaches `testing` status. It does not replace the formal gates — it augments them with between-pipeline hygiene checks.

package/plugins/sp/skills/code-verification/references/verdict-schema.md

@@ -202,6 +202,10 @@ citation in the SAME cell, or lint rejects the row with `evidence-citation` (blo
 - The rule is cell-local: a citation in another row or a "receipt above" cross-reference does not
   satisfy it. Marker-free receipts (test counts, reviewed-log notes) need no citation. The check is
   presence-only — which citation proves which claim is not deterministically decidable.
+- The same two predicates (`hasClaimMarker` / `hasCitationForm` in
+  `packages/app/src/services/verify-answer-lint.ts`) gate the review report's findings table through
+  `residual-scan review-gate` as the blocking `review-contract` category — one definition of
+  "external claim" and one set of accepted citation forms for both paths.
 
 ## Hedged evidence is rejected on MET rows
 

package/plugins/sp/skills/dogfood-testing/SKILL.md

@@ -82,11 +82,11 @@ The command forwards these via `$ARGUMENTS`:
 >   <!-- pipeline-tokens:end -->
 >   matched as a **distinct hyphen-word**
 >   (machine-checked by
->   [`detectPipelineDriving`](../../scripts/dogfood-testing/detect-pipeline-driving.ts);
+>   [`detectPipelineDriving`](../../lib/dogfood-pipeline.ts);
 >   see [§Pipeline-driving word-boundary contract](#pipeline-driving-word-boundary-contract))
 >   → `⚠ pipeline-driving testee detected; pass --max-retry 0 (observe-only) or --max-retry N (fix mode, tree mutation acknowledged)`.
 > - **Mutating `--fix` modes** — `--fix all` / `--fix blockers-first`, boundary-guarded via
->   [`hasMutatingFixMode`](../../scripts/dogfood-testing/detect-pipeline-driving.ts) (never matches
+>   [`hasMutatingFixMode`](../../lib/dogfood-pipeline.ts) (never matches
 >   `--fix none` / `--focus all` / `--prefix all`). No pipeline token required: a verify/review leg
 >   with `--fix all` mutates the tree on its own (0280 dogfood P2, task 0293). Honesty note:
 >   `--max-retry 0` here bounds **the driver only** — the testee still mutates the tree — so the

package/plugins/sp/skills/next-feature/SKILL.md

@@ -64,7 +64,7 @@ Run the steps in order. Each step's depth lives in its reference; this file is t
    change a frontier feature's status, the report **leads with the drift summary** ("sync first")
    and the ranking is computed over the *post-sync* status view. Details:
    [references/signal-derivation.md](references/signal-derivation.md) §0.
-1. **Assemble the candidate set.** `spur feature list --json`; drop `done`/`cancelled`, drop
+1. **Assemble the candidate set.** `spur feature list --json`; drop `done`/`cancelled`/`deprecated`, drop
    structural containers (has children, no own open tasks — defect D1), drop the map/feature that
    owns this investigation if present. The `group` tag is **not** a reliable container marker (D3).
 2. **Gate on actionability.** Read the frontier predicate **at runtime** from

package/plugins/sp/skills/parallel-execution/references/dispatch-surface.md

@@ -167,7 +167,7 @@ rule at the source, so no per-path shim is needed:
 | `spur agent loop` | `AgentService.run` per drained iteration | Same resolution path as `spur agent run`; inherits its own `SPUR_ROLE` |
 | `spur serve` team supervisor → member | spawns `spur agent loop` | Member inherits the supervisor's `SPUR_ROLE` (recursive by construction) |
 | Native subagent fan-out (this skill's default) | in-session `Task()`/`Skill()` | In-session subagents share the host session; when they themselves dispatch, the host's role is already in the session env — the rule holds at the next `spur agent run` boundary |
-| `plugins/sp/evals/run-eval.ts` | `spawnSync('spur agent run', …)` per scenario | Out of scope: a top-level eval harness, not a fan-out — no dispatcher role exists to inherit; each scenario is an independent top-level run (documented, no shim) |
+| `scripts/commands/skill-eval.ts` | `spawnSync('spur agent run', …)` per scenario | Out of scope: a top-level eval harness, not a fan-out — no dispatcher role exists to inherit; each scenario is an independent top-level run (documented, no shim) |
 
 The inventory is recorded in `docs/04_DESIGN.md` § `spur agent run` envelope (`roleOrigin`).
 Paths that shell out to `spur agent run` without the rule would silently drop or double-attribute

package/plugins/sp/skills/source-driven-development/SKILL.md

@@ -101,10 +101,13 @@ line: `Verification: HIGH|MEDIUM|LOW — <first failing check and deviation, or
 - **Honest confidence** — the stated HIGH/MEDIUM/LOW matches the evidence: HIGH requires a check against the pinned source this session; MEDIUM/LOW items are labeled, and LOW is never presented as fact.
 - **HIGH** — all three checks pass. **MEDIUM** — coverage intact but some citations are off-version (latest docs for a pinned dependency) or secondary-source only. **LOW** — an API/library claim lacks any citation, or a LOW-confidence claim was asserted as fact.
 
-Deterministic backstop: the `cited-version-strings` / `cited-api-claims` rules
-(`.spur/rules/docs/sourced-api-claims.yaml`, run in `recommended-pre-check`) flag markdown lines that
-assert version strings or time-anchored API claims with no citation anchor on the same line. They
-are an info-severity advisory backstop for this contract (they do not gate; the checks above and the SECUA checklist are the enforcement points).
+Deterministic backstop: the `cited-version-strings`, `cited-api-claims` and
+`cited-api-claims-confidence` rules (`.spur/rules/docs/sourced-api-claims.yaml`) flag markdown lines
+that assert a version string or a time-anchored API claim with no citation anchor on the same line,
+and claim lines that carry no HIGH/MEDIUM/LOW level. They are an info-severity advisory backstop for
+this contract and are deliberately NOT wired into `recommended-pre-check` — run them ad hoc with
+`spur rule run --file .spur/rules/docs/sourced-api-claims.yaml`. The checks above and the SECUA
+checklist remain the enforcement points.
 
 ## Common Rationalizations
 

package/plugins/sp/skills/spur-cli/references/builder.md

@@ -8,8 +8,9 @@ see_also:
 # spur builder - release plumbing
 
 `spur builder` is the CLI for **version bumps and release tags**. It wraps the internal
-`spur-dev release` flow behind a public two-verb surface, promoted verbatim from
-`scripts/commands/release.ts` (now a thin forwarder to the same implementation). Package ids are
+`release-ops` implementation behind a public two-verb surface. The repo-local forwarder
+(`scripts/commands/release.ts`) and its `spur-dev` dispatcher cases were retired in task 1173; the
+root `bun run bump-ver` / `bun run drop-tags` names route to `spur builder` directly. Package ids are
 the unscoped short names (`@gobing-ai/spur` → `spur`); the released set and the aggregate tag are
 discovered from the repo's own workspace manifests, so the same code serves any git+semver
 monorepo.