@gobing-ai/spur 0.4.2 → 0.4.4

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.4.2",
+            "version": "0.4.4",
             "source": "./plugins/sp"
         }
     ]

package/config/decisions/maker-liveness.yaml

@@ -0,0 +1,39 @@
+$schema: "@gobing-ai/spur/schemas/decision-catalog.schema.json"
+# Liveness probe catalog (feature P11, docs/design/decision-observability-and-adoption.md §3.4).
+#
+# `maker-liveness` is served by exactly one caller: `spur decision status --probe`,
+# which asks it once per distinct registered effective maker to prove the maker
+# answers *now* rather than inferring health from configuration. No workflow may
+# reference this id — a decision whose answer classifies nothing real has no place
+# in a run, and `spur decision status --reliability` would otherwise count probe
+# runs as adoption evidence.
+#
+# The probe writes no `decision_logs` row and emits no `decision.*` event, so these
+# runs never enter the recorded evidence the same report displays next to them.
+#
+# Resolution: this file ships in the shared layer (the installed package's
+# config/decisions/). A project can override it per basename through
+# .spur/decisions/ or decisions.paths (first layer wins, ADR-113 style). Replacing it
+# with a catalog that omits the id makes `--probe` fail loudly before any maker call.
+version: 1
+
+defaults:
+    # Deliberately not the 0.7 upstream / 0.8 catalog floor. minConfidence gates
+    # whether an *answer* is accepted; the probe asks whether the *maker* answered.
+    # Under a 0.8 floor a live maker reporting 0.6 would fall back and the probe would
+    # report "not working" for a backend that is working. A maker that never answered
+    # (no-backend, timeout, error) falls back regardless of this value.
+    minConfidence: 0
+
+decisions:
+    maker-liveness:
+        type: choice
+        # Rendered as the question when the caller passes no `instructions`: the probe
+        # always does pass one, so this description is the fallback wording, not the
+        # probe prompt.
+        description: >
+            Liveness probe. Answer `ok` if this maker can serve a decision right now.
+        criteria:
+            ok: The maker answered the question it was asked.
+            unclear: The maker could not answer.
+        fallback: unclear

package/config/plugin-scripts.json

@@ -22,10 +22,6 @@
             "contract": "standard",
             "twin": "daily-summary/daily-summary.mjs"
         },
-        {
-            "rel": "daily-summary/logger.ts",
-            "contract": "repo-only"
-        },
         {
             "rel": "dogfood-testing/detect-pipeline-driving.ts",
             "contract": "standard",

package/config/rules/README.md

@@ -17,6 +17,7 @@ install or to ts-libs.
 | `surface` | `surface/` | CLI surface consistency (registerXxxCommand wiring, --json serialization) |
 | `migration` | `migration/` | Transitional helpers for the regex → `rg` evaluator move (`rg-dialect`) |
 | `ui` | `ui/` | Web UI seam boundaries (import seam, daisyUI class leak) |
+| `docs` | `docs/` | Sourced API/library claims in markdown — citation anchor + HIGH/MEDIUM/LOW level. Advisory (`info`), and deliberately **not** in a preset: see the file header for its calibration audit and the one-line promotion step. |
 
 ## Presets
 

package/config/rules/docs/sourced-api-claims.yaml

@@ -9,22 +9,43 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 # gate runs --fail-on warning, so this rule surfaces findings for review without
 # reddening gates — changed-file enforcement happens in SECUA review).
 #
+# Calibration audit (2026-10-12, `spur rule run --file … --json`, unsuppressed):
+# the category was pulled from `recommended-pre-check` on 2026-10-08 for "finding
+# noise" — 593 findings. The audit split them 580 `cited-version-strings` /
+# 13 `cited-api-claims`, and 579 of the 580 were false positives on two shapes
+# that are not external claims at all: a document's own version
+# (`docs/00_ADR.md:5` → `version: 1.69.0`), a section number in a heading
+# (`docs/04_DESIGN.md:116` → `### 1.0.1 Shared option registry`) and a
+# `§`-numbered cross-reference (`docs/00_ADR.md:1118` → `§1.2.1`). All three are
+# excluded by the pattern below — the first two on the line's shape, the third on
+# the token itself. The remaining source was a stale exclude list that stopped at
+# `docs/tasks4/` while the active corpus folder is `docs/tasks5/`, which alone
+# produced 226 findings; it is now one `docs/tasks*/**` glob. 593 → 330 after those
+# two fixes, then 277 once the `§` shape was excluded too — the residual are
+# version-pinned package claims that genuinely lack a same-line anchor, and they
+# stay visible rather than suppressed.
+#
 # The semantic contract — every external API/library claim carries a source
 # citation (URL or path:line) AND a confidence level (HIGH/MEDIUM/LOW) — is
 # owned by the sp-source-driven-development skill and verified in SECUA review
-# (code-verification secu-review checklist). Generic "supports/requires" prose
-# is deliberately out of scope here: in this corpus it is structural writing,
-# not external API assertion, and would drown the signal.
+# (code-verification secu-review checklist). These rules are its deterministic
+# backstop: the two `cited-*` rules cover the citation half, and
+# `cited-api-claims-confidence` covers the level half. All are severity `info`,
+# and the category is deliberately NOT in `recommended-pre-check` — it surfaces
+# findings for review without reddening gates. To promote it to a gate, add
+# `- docs` to that preset's `extends` once the residual list is triaged.
 include:
   - "docs/**/*.md"
   - "plugins/sp/skills/**/references/**/*.md"
 exclude:
   # Legacy task archives are historical records — retro-citing ~900 closed
-  # lines is make-work; the tripwire targets active authoring surfaces.
-  - "docs/tasks/"
-  - "docs/tasks2/"
-  - "docs/tasks3/"
-  - "docs/tasks4/"
+  # lines is make-work; the tripwire targets active authoring surfaces. One glob
+  # rather than the literal tasks/…tasks4/ list that let the active folder through.
+  # The trailing `/**` is load-bearing: `docs/tasks*/` ends as a pattern segment
+  # tested against `x.md`, so the anchored matcher binds nothing and the fragment
+  # fallback strips the `*` down to `docs/tasks/` — which is why that form
+  # silently excluded nothing (measured 2026-10-12).
+  - "docs/tasks*/**"
   - "drizzle/**"
   - "**/node_modules/**"
 rules:
@@ -41,10 +62,15 @@ rules:
       config:
         mode: forbid
         # Fire when the line has NO citation anchor (no URL, no path:line) AND
-        # contains a semver-ish token. Lookarounds exclude IPs (127.0.0.1) and
-        # longer dotted numerics; fenced-code lines are out of regex reach —
-        # that residual noise is why this is warning, not error.
-        pattern: "^(?!.*(?:https?://|(?:[\\w.-]+/)+[\\w.-]+:\\d+)).*(?<![\\d.])\\d+\\.\\d+\\.\\d+(?!\\.\\d)"
+        # contains a semver-ish token. Lookarounds exclude IPs (127.0.0.1),
+        # longer dotted numerics, a heading's section number (`### 1.0.1 Title`),
+        # a document-version metadata line (`version: 1.69.0`) and a `§`-numbered
+        # section reference (`§7.3.1`) — none of which is an external claim;
+        # fenced-code lines are out of regex reach — that residual noise is why
+        # this is info, not warning. The `§` guard sits on the token itself, not on
+        # the line, so a line carrying both a section reference and a real version
+        # still fires on the version.
+        pattern: "^(?!.*(?:https?://|(?:[\\w.-]+/)+[\\w.-]+:\\d+))(?!\\s*#{1,6}\\s+\\d+\\.\\d+\\.\\d+)(?!\\s*[\\w-]+:\\s*\\d+\\.\\d+\\.\\d+\\s*$).*(?<![\\d.§])\\d+\\.\\d+\\.\\d+(?!\\.\\d)"
   - id: cited-api-claims
     description: >
       A markdown line making a time- or version-anchored external API claim
@@ -58,3 +84,21 @@ rules:
       config:
         mode: forbid
         pattern: "^(?!.*(?:https?://|(?:[\\w.-]+/)+[\\w.-]+:\\d+)).*\\b(?:deprecated (?:since|in|as of)|introduced in|added in|available since|stable since)\\b"
+  - id: cited-api-claims-confidence
+    description: >
+      A markdown line making a time- or version-anchored external API claim
+      ("deprecated since 1.2", "introduced in v3", "available since 0.9") must
+      also state its confidence level — HIGH, MEDIUM or LOW — so a reader can
+      tell a checked fact from model memory; contract in
+      sp-source-driven-development. Pairs with `cited-api-claims`, which covers
+      the citation half: a line missing both halves reports once per rule,
+      deliberately, because each missing half is its own defect.
+    severity: info
+    evaluator:
+      type: regex
+      config:
+        mode: forbid
+        # Fires on a claim line carrying no uppercase level token. The verbs match
+        # `cited-api-claims` exactly, so the two rules never disagree about which
+        # lines are claims.
+        pattern: "^(?!.*\\b(?:HIGH|MEDIUM|LOW)\\b).*\\b(?:deprecated (?:since|in|as of)|introduced in|added in|available since|stable since)\\b"

package/config/rules/docs/verdict-confidence.yaml

@@ -0,0 +1,68 @@
+$schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
+# Verdict-confidence rules (report corpus) — a committed verification record that states
+# a machine `Verdict:` line must also state the verifier's confidence, so a reader can
+# tell a PASS the verifier stands behind from one it would not.
+#
+# Contract owners: `Confidence: HIGH|MEDIUM|LOW` is specified for verify answers by
+# plugins/sp/skills/code-verification/SKILL.md (one `Verdict: PASS|PARTIAL|FAIL` line, one
+# `Confidence:` line, then the traceability tables) and for review reports by
+# plugins/sp/agents/super-reviewer.md. Both are already enforced for pipeline answers —
+# packages/app/src/services/verify-answer-lint.ts (`confidence-missing`,
+# `confidence-value`, and the coherence pair `confidence-unwarranted` /
+# `confidence-understated`) plus the verify stamp in config/workflows/task-pipeline.yaml —
+# but no rule read the standalone report documents agents commit under `docs/`. This file
+# is that backstop: the same three-level vocabulary, checked at the document level.
+#
+# Shape: one file-spanning forbidden match (`multiline: true` hands the evaluator the whole
+# document and the negative lookahead spans the newline) instead of line counting. The
+# lookahead demands a valid level, so a hedge (`Confidence: mostly`) reads as missing too.
+# The verdict prefix requires the closed `PASS|PARTIAL|FAIL` value on its own line, which is
+# what separates a record from prose: docs/reports/i31/0912-workflow-baseline.md:84 and
+# i31/1107-runall-p1-pilot.md:9 both open a bolded *conclusion* sentence
+# ("**Verdict: `partial — INSUFFICIENT_EVIDENCE retained`.**") and are not this contract.
+#
+# Severity `info`, and deliberately not in a preset — the same calibration choice the `docs`
+# category makes for sourced claims: findings surface for review without reddening gates
+# (`recommended-pre-check` runs `--fail-on warning`). To promote it, add `- docs` to that
+# preset's `extends` once the residual is triaged.
+#
+# Calibration (2026-10-13, `spur rule run --file config/rules/docs/verdict-confidence.yaml
+# --json`, unsuppressed): 3 findings over the 91 documents the include globs matched at that
+# timestamp (29 under docs/reports/, 62 under docs/plans/), all three the hole this closes —
+# docs/reports/2026-09-12-i21-verifyall.md:3,
+# docs/reports/2026-10-01-E71-force-verification.md:3 and
+# docs/reports/g61-verifyall-2026-09-12.md:3 each open `Verdict: PASS` and state no
+# confidence level anywhere in the document. They stay visible rather than suppressed:
+# retro-fitting a level into a historical record would invent the verifier's own claim.
+# Both directions were controlled in the same run: a scratch report holding
+# `Verdict: PASS` + `Confidence: HIGH` is not flagged, and the same file with
+# `Confidence: mostly` is.
+#
+# Include is deliberately the report corpus. `docs/plans/*brainstorm*.md` states confidence
+# as prose with its rationale (`**Confidence: HIGH.** All primitives … are verified present`,
+# 61 such lines across 18 plans) — a different, human-facing contract that a
+# level-only vocabulary check would drown in false positives, and those plans carry no
+# machine verdict line to anchor on.
+include:
+  - "docs/reports/**/*.md"
+  - "docs/plans/**/*.md"
+exclude:
+  - "docs/tasks*/**"
+rules:
+  - id: verdict-line-confidence-missing
+    description: >
+      A committed verification record that asserts a machine verdict line
+      (`Verdict: PASS|PARTIAL|FAIL`) must follow it with the verifier's confidence level —
+      `Confidence: HIGH|MEDIUM|LOW` — so a reader can tell a verdict the verifier stands
+      behind from one it would not. Contract in sp-code-verification (verify answers) and
+      sp-super-reviewer (review reports); a missing level is a lint failure for pipeline
+      answers (`confidence-missing`), and this rule is the backstop for the reports those
+      surfaces do not read.
+    severity: info
+    evaluator:
+      type: regex
+      config:
+        mode: forbid
+        multiline: true
+        flags: "i"
+        pattern: "^[ \\t]*\\**Verdict\\**:\\**[ \\t]*(?:PASS|PARTIAL|FAIL)\\**[ \\t]*\\n(?:[ \\t]*\\n)*(?![ \\t]*\\**Confidence\\**:\\**[ \\t]*\\**(?:HIGH|MEDIUM|LOW)\\**[ \\t]*\\.?[ \\t]*$)"

package/config/rules/quality/coverage-gate.yaml

@@ -1,5 +1,18 @@
 $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 # Coverage gate — per-file line coverage meets threshold from Bun's lcov output.
+#
+# PROVENANCE (task 1203): since task 1203 the repository post-check scripts
+# (`test-post-check`, `test-post-check:full`) validate canonical coverage
+# certification BEFORE this rule evaluates: only a completed successful canonical
+# full-suite run (`bun run test`, `test:coverage`, `test:full`) certifies
+# .coverage/lcov.info (marker: .coverage/coverage-certification.json, written by
+# scripts/commands/run-tests.ts --publish-coverage). Missing/pending/superseded/
+# stale-tree/byte-mismatched artifacts fail the post-check with a
+# `coverage-artifact:` diagnostic before per-file findings; recovery is rerunning
+# `bun run test:full`. Running this rule directly via `spur rule run` outside the
+# repository wrapper bypasses that certification wrapper and is outside this
+# repository's certification contract. This rule and its evaluator are unchanged.
+#
 # Absorbed from ts-libs/.spur/rules/quality/coverage-gate.yaml, re-scoped to
 # Spur's monorepo layout:
 #   - lcovPath kept at .coverage/lcov.info (Spur's `bun run test:coverage`

package/config/rules/recommended-pre-check.yaml

@@ -8,8 +8,12 @@ $schema: "@gobing-ai/spur/schemas/preset.schema.json"
 # post-check alongside coverage-gate.
 #
 # TEMPORARY (2026-10-08): `docs` removed from extends to unblock the gate —
-# restore it (add `- docs` back) once sourced-api-claims finding noise is
-# triaged. Recapture the raw-json-baseline fixtures in the same change.
+# restore it (add `- docs` back) once sourcing-claim finding noise is triaged.
+# The category now holds two files and both residuals must be triaged first:
+# `docs/sourced-api-claims.yaml` (advisory citation/level checks on claim lines) and
+# `docs/verdict-confidence.yaml` (a machine `Verdict:` report must state its
+# HIGH/MEDIUM/LOW level; 3 historical reports under docs/reports/ predate the
+# contract). Recapture the raw-json-baseline fixtures in the same change.
 name: recommended-pre-check
 extends:
   - typescript

package/config/rules/strict/runtime-boundaries.yaml

@@ -38,6 +38,12 @@ rules:
 
             # Low-level system primitives:
             - "packages/app/src/services/quality-gate.ts" # gate runs `sh -c` with stdout+stderr merged onto ONE fd; ProcessExecutor captures streams separately and cannot reproduce the stream-order contract (task 1006 R1; mirrors the history-anatomy bundling exemptions)
+            # The feature-verification pass runs one long command with stdout+stderr merged onto the
+            # run's single log fd and a 4 h ceiling (the frozen contract from task 0915: `safe argv
+            # spawn, timeout and status handling`). ProcessExecutor captures the two streams separately
+            # and exposes no timeout, so it cannot reproduce either half (task 1176 R2; same class as
+            # the quality-gate exemption above).
+            - "packages/app/src/workflow/feature-verification-run.ts"
 
   - id: no-direct-fs-io
     description: "Prefer ts-runtime's FileSystem seam for fs IO."
@@ -64,6 +70,7 @@ rules:
             - "packages/app/src/services/token-ledger-service.ts" # FD byte-window log tailing
             - "packages/app/src/services/token-ledger-watcher.ts" # node:fs watch() live watcher
             - "packages/app/src/services/project-registry.ts" # atomic projects.json persistence
+            - "packages/app/src/services/project-process.ts" # port/pid probes moved verbatim out of project-registry.ts to break the registry↔stop import cycle (same exemption)
             - "packages/app/src/services/project-server-owner.ts" # atomic mkdir lifetime claim + unique-marker stale recovery; FileSystem has no exclusive mkdir primitive (1082)
             - "packages/app/src/services/slash-commands-service.ts" # synchronous ~/.config/spur/slash_commands.json persistence (mirrors project-registry.ts)
             - "packages/app/src/services/agent-usage-producer.ts" # atomic agent-usage snapshot write (tmp + rename, mirrors project-registry.ts; task 0892 R1)
@@ -74,7 +81,9 @@ rules:
             - "apps/cli/src/commands/workflow.ts" # FD byte-window tail of the mid-run run log for `workflow trace --follow` streaming (task 0428 / feature D2); readSync at offset over the observability sink's FDs
             - "apps/web/src/modules/discover.ts" # Vite/Astro module scanner fallback under bun test
             - "packages/app/src/services/quality-gate.ts" # gate artifacts (log/findings/receipt) written directly; merged-fd gate log and fsync-free atomic writes must stay byte-stable; bundled standalone for the bare-node plugin twin (task 1006 R1; mirrors history-anatomy.ts)
+            - "packages/app/src/workflow/feature-verification-run.ts" # the pass opens the run's single merged log fd (`openSync(path,'a')`) and mkdirs the run dir beside the receipt writer, exactly as the plugin entry did before the move; the fd cannot be expressed through the FileSystem seam (task 1176 R2; same class as the quality-gate exemption above)
             - "packages/app/src/services/run-storage.ts" # durable-evidence migration core (task 1025 R4): atomic tmp+rename byte copies with digest reread and atomic manifest publish must stay byte-stable (mirrors agent-usage-producer.ts / project-registry.ts exemptions)
+            - "packages/app/src/services/durable-plane-ignore.ts" # .git/info/exclude append moved verbatim out of run-storage.ts to break an import cycle (same exemption)
 
             # Electron Node adapters cannot load Bun runtime implementations; keep the
             # synchronous existence/directory probes injected for unit testing (desktop contract).
@@ -84,6 +93,7 @@ rules:
             # Synchronous bootstrap & path resolution:
             - "packages/config/src/bundled-config.ts" # sync bundledConfigRoot() directory walk
             - "packages/config/src/loader.ts" # sync resolveConfigFile() / schema specifier lookup
+            - "packages/config/src/config-layers.ts" # sync resolveConfigLayers() existence probes moved verbatim out of loader.ts to break the loader↔executor-update cycle (same exemption)
             - "packages/config/src/executor-update.ts" # atomic single-entry config update (task 0797): O_EXCL lock, fsync'd tmp+rename commit, lstat symlink refusal, mode preservation — ts-runtime FileSystem seam has no lstat/fsync/chmod/O_EXCL
             - "packages/app/src/services/project-start.ts" # sync CLI binary path checks before daemon spawn
             - "apps/cli/src/commands/serve.ts" # sync resolveServeCwd() directory validation before server startup (task 0805 R2); mirrors task.ts sync-template exemption

package/config/rules/surface/check-cli-surface.yaml

@@ -10,9 +10,7 @@ include:
   - "apps/cli/src/commands/*.ts"
 
 exclude:
-  # Not command files: stubs.ts is an empty module shim (consistency.test.ts
-  # excludes it too); shared-options.ts is the option registry.
-  - "apps/cli/src/commands/stubs.ts"
+  # Not a command file: shared-options.ts is the option registry.
   - "apps/cli/src/commands/shared-options.ts"
 
 rules:

package/config/script-placement-baseline.json

@@ -16,32 +16,14 @@
             "reason": "Keep (budget exemption; reviewed W4) (plan \u00a72)",
             "exempt": true
         },
-        "plugins/sp/scripts/feature-verification-steps.ts": {
-            "kinds": ["budget"],
-            "reason": "Keep (ADR-119 receipt writer; budget exemption) (plan \u00a72)",
-            "exempt": true
-        },
         "plugins/sp/scripts/wrapup-drift-probe.ts": {
             "kinds": ["budget", "corpus-parse"],
             "reason": "Keep (glue over capture file; budget exemption) (plan \u00a72)",
             "exempt": true
         },
         "plugins/sp/scripts/daily-summary/daily-summary.ts": {
-            "kinds": ["budget", "db-import"],
-            "reason": "Keep (daily-summary/, plan \u00a72); read-only history-health query via dynamic bun:sqlite import (task 1018)"
-        },
-        "plugins/sp/scripts/dogfood-testing/detect-pipeline-driving.ts": {
             "kinds": ["budget"],
-            "reason": "Keep (dogfood-testing/, plan \u00a72)"
-        },
-        "plugins/sp/scripts/dogfood-testing/validate-report.ts": {
-            "kinds": ["budget"],
-            "reason": "Keep (dogfood-testing/, plan \u00a72)"
-        },
-        "plugins/sp/hooks/context-post-tool.ts": {
-            "kinds": ["budget"],
-            "reason": "Keep: ADR-129 core (budget exemption) (plan \u00a72)",
-            "exempt": true
+            "reason": "Keep (daily-summary/, plan \u00a72); read-only history-health reads via the app service (task 1178)"
         },
         "plugins/sp/hooks/pi/guard-extension.ts": {
             "kinds": ["budget"],

package/config/templates/AGENTS.md

@@ -147,6 +147,13 @@ _(Fill from package manifests / README — or during `sp:doc-evolve` customize.)
 **Done gate (minimum):** lint + tests clean; only intentional `git status` changes; no
 `--no-verify` / silent suppressions. Harness task done ⇒ real verify **PASS** when the pipeline ran.
 
+**Gate scope:** the gate verifies code changes. Scribe commands — `/sp:dev-gitmsg`,
+`/sp:dev-changelog`, `/sp:dev-handover`, `/sp:dev-job-dump` — produce text or a commit and run no
+gate (lint, typecheck, tests) unless asked: `gitmsg --check <cmd>`, or `/sp:dev-gtd --no-push` for
+gate → fix → commit. Commands that own a gate (`dev-run`, `dev-runall`, `dev-fixall`, `dev-gtd`,
+`dev-fixgha`, `dev-unit`, `--check` loops) run exactly what their contract names — no extra
+completion-gate pass on top.
+
 ---
 
 ## Spur CLI surface

package/config/workflows/feature-lifecycle.yaml

@@ -9,7 +9,7 @@
 "$schema": "@gobing-ai/spur/schemas/state-machine-workflow.schema.json"
 kind: state-machine
 name: feature-lifecycle
-version: "2"
+version: "3"
 description: >
   Feature lifecycle FSM (design §2.3, §5.1, DD-13). States are the canonical
   FeatureStatus vocabulary; transitions encode the §2.3 graph including the
@@ -64,6 +64,11 @@ states:
     description: Completed and verified.
   - id: cancelled
     description: Terminal — abandoned.
+  - id: deprecated
+    description: >
+      Retained and frozen (ADR-136). Non-terminal: the record stays readable and
+      countable, nothing may attach new work to it, and leaving it is explicit —
+      un-deprecate to active, or cancelled once the feature is removed.
 
 transitions:
   # Forward path: backlog → active → verifying → done
@@ -142,3 +147,43 @@ transitions:
     description: Cancel feature
     guard:
       kind: always
+
+  # Deprecate: any non-terminal-or-done state → deprecated (frozen, retained — ADR-136)
+  - from: backlog
+    to: deprecated
+    description: Deprecate feature (frozen, retained)
+    guard:
+      kind: always
+  - from: active
+    to: deprecated
+    description: Deprecate feature (frozen, retained)
+    guard:
+      kind: always
+  - from: verifying
+    to: deprecated
+    description: Deprecate feature (frozen, retained)
+    guard:
+      kind: always
+  - from: blocked
+    to: deprecated
+    description: Deprecate feature (frozen, retained)
+    guard:
+      kind: always
+  - from: done
+    to: deprecated
+    description: Deprecate feature (frozen, retained)
+    guard:
+      kind: always
+
+  # Exits out of deprecated: un-deprecate or remove only. Any other edge is
+  # undeclared and refused by the graph (ADR-135).
+  - from: deprecated
+    to: active
+    description: Un-deprecate (mandatory History entry)
+    guard:
+      kind: always
+  - from: deprecated
+    to: cancelled
+    description: Remove deprecated feature
+    guard:
+      kind: always

package/config/workflows/feature-verification.yaml

@@ -10,6 +10,17 @@
 #
 # Run: spur workflow run feature-verification.yaml --vars '{"featureId":"D63"}'
 #
+# No project-side override is required (task 1185, A33). Since the pass moved into the
+# application (1176 / efd78f058) the bundled definition owns it end to end, so a
+# project-layer copy of this file (plus a rooted port under `.spur/scripts/`) is a
+# leftover — the port was written against an entry export contract that has since
+# changed. Remove the override so this definition applies, or migrate the port to the
+# current app-owned operation `runFeatureVerification` (the generated inline bundle's
+# export). If a stale consumer is still reached, feature-lifecycle's `verifying` entry
+# names it: the override path, the consumer script, the export it requires that the
+# shipped entry no longer provides, and the entry path. Reinstalling or upgrading the
+# plugin cannot supply a retired export — only the two remedies above can.
+#
 # Shape: verify -> done | failed. The onEnter step runs the standard script
 # `feature-verification-steps.ts` (no public CLI verb, D63 task 0915): it
 # resolves this very definition for the verifier identity (name, source path,
@@ -40,6 +51,14 @@ vars:
   featureId: "X"
   spurBin: "spur"
   verificationCmd: "bun run spur-check-feature"
+  # Operator-declared confidence level; empty derives it from the pass (HIGH when the selected
+  # definition's own command exited 0 with an unchanged proof-input digest, MEDIUM under a caller
+  # `--cmd` override, LOW otherwise). The completion boundary refuses a PASS carrying no level or
+  # LOW unless the receipt records the acknowledgement below.
+  confidence: ""
+  # Operator acknowledgement of a LOW level. It rides the receipt, so the transition reads it from
+  # the evidence rather than from whatever flags a later command happens to pass.
+  ackLowConfidence: "false"
   __runId: ""
 
 states:
@@ -59,7 +78,7 @@ states:
       - kind: shell
         options:
           command: >-
-            mkdir -p .spur/run; eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/feature-verification-steps.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/feature-verification-steps.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; [ -f "$S" ] && "$RUNNER" "$S" verify --feature-id "$featureId" --run-id "$__runId" --spur-bin "$spurBin" || printf 'FAIL feature-verification failed closed — script not found — run superskill install sp --marketplace gobing-ai/spur\n' > ".spur/run/$__runId-feature-verification.status"; exit 0
+            mkdir -p .spur/run; eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/feature-verification-steps.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/feature-verification-steps.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; ACK=""; [ "$ackLowConfidence" = "true" ] && ACK="--ack-low-confidence"; [ -f "$S" ] && "$RUNNER" "$S" verify --feature-id "$featureId" --run-id "$__runId" --spur-bin "$spurBin" --confidence "$confidence" $ACK || printf 'FAIL feature-verification failed closed — script not found — run superskill install sp --marketplace gobing-ai/spur\n' > ".spur/run/$__runId-feature-verification.status"; exit 0
 
   - id: done
     description: Terminal — repo-wide checks passed and the receipt is bound.

package/config/workflows/task-lifecycle.yaml

@@ -64,6 +64,11 @@ states:
       Completed. Re-enterable (reopen with warning + mandatory History entry).
   - id: cancelled
     description: Terminal — abandoned.
+  - id: deprecated
+    description: >
+      Retained and frozen (ADR-137). Non-terminal: the record stays readable and
+      countable, nothing new may attach to it, and leaving it is explicit —
+      un-deprecate to todo, or cancelled once the task is removed.
 
 transitions:
   # Forward path: backlog → todo → wip → testing → done
@@ -157,3 +162,48 @@ transitions:
     description: Cancel task
     guard:
       kind: always
+
+  # Deprecate: any non-terminal-or-done state → deprecated (frozen, retained — ADR-137)
+  - from: backlog
+    to: deprecated
+    description: Deprecate task (frozen, retained)
+    guard:
+      kind: always
+  - from: todo
+    to: deprecated
+    description: Deprecate task (frozen, retained)
+    guard:
+      kind: always
+  - from: wip
+    to: deprecated
+    description: Deprecate task (frozen, retained)
+    guard:
+      kind: always
+  - from: testing
+    to: deprecated
+    description: Deprecate task (frozen, retained)
+    guard:
+      kind: always
+  - from: blocked
+    to: deprecated
+    description: Deprecate task (frozen, retained)
+    guard:
+      kind: always
+  - from: done
+    to: deprecated
+    description: Deprecate task (frozen, retained)
+    guard:
+      kind: always
+
+  # Exits out of deprecated: un-deprecate or remove only. Any other edge is
+  # undeclared and refused by the graph (ADR-135).
+  - from: deprecated
+    to: todo
+    description: Un-deprecate (mandatory History entry)
+    guard:
+      kind: always
+  - from: deprecated
+    to: cancelled
+    description: Remove deprecated task
+    guard:
+      kind: always

package/config/workflows/task-pipeline.yaml

@@ -1312,11 +1312,16 @@ transitions:
     # re-enters quality → review → verify on a fresh digest. Before 1088 a FAIL review had no
     # outgoing edge at all; before 1122 a PASS-with-findings cost a full re-certification cycle per
     # attempt (knowledge-kit 0210/0213). The reviewer writes `Verdict: PASS|FAIL` in its answer;
-    # both plain and bold forms are accepted. Under `profile=auto` the approve gate is skipped, so
-    # the PASS+auto edge is tried first and the interactive PASS edge second.
+    # both plain and bold forms are accepted. Since 1204 a PASS must also be GRADED: the reviewer
+    # states `Confidence: HIGH|MEDIUM|LOW` (verify-chain semantics, 1068), HIGH/MEDIUM cross the
+    # PASS edges unadorned, and LOW or an absent line needs the operator's `ackLowConfidence` —
+    # otherwise the PASS falls to the catch-all like any other verdict the reviewer would not stand
+    # behind (same policy as the verify confidence gate). Review stays advisory: verify certifies.
+    # Under `profile=auto` the approve gate is skipped, so the PASS+auto edge is tried first and the
+    # interactive PASS edge second.
     - from: review
       to: verify
-      description: profile=auto, the review certified PASS, and no open P1-P3 review finding — skip the human approval gate.
+      description: profile=auto, the review certified a HIGH/MEDIUM-confidence PASS (LOW/absent needs ackLowConfidence) with no open P1-P3 finding — skip the human approval gate.
       guard:
           kind: shell
           options:
@@ -1324,23 +1329,24 @@ transitions:
                   test "$profile" = auto &&
                   grep -qiE '^[[:space:]]*\**Verdict:\** *PASS' ".spur/run/$__runId-review-answer.txt" &&
                   eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/residual-scan.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/residual-scan.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)" &&
-                  [ -f "$S" ] && "$RUNNER" "$S" review-gate "$wbs" --spur-bin "$spurBin" >&2
+                  [ -f "$S" ] && "$RUNNER" "$S" review-gate "$wbs" --spur-bin "$spurBin" --review-answer ".spur/run/$__runId-review-answer.txt" >&2
     - from: review
       to: approve
-      description: Review certified PASS with no open P1-P3 review finding — gate on human approval before verification.
+      description: Review certified a HIGH/MEDIUM-confidence PASS (LOW/absent needs ackLowConfidence) with no open P1-P3 finding — gate on human approval before verification.
       guard:
           kind: shell
           options:
               command: >-
                   grep -qiE '^[[:space:]]*\**Verdict:\** *PASS' ".spur/run/$__runId-review-answer.txt" &&
                   eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/residual-scan.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/residual-scan.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)" &&
-                  [ -f "$S" ] && "$RUNNER" "$S" review-gate "$wbs" --spur-bin "$spurBin" >&2
+                  [ -f "$S" ] && "$RUNNER" "$S" review-gate "$wbs" --spur-bin "$spurBin" --review-answer ".spur/run/$__runId-review-answer.txt" >&2
     - from: review
       to: review-fail-triage
       description: >-
-          No certified PASS without an open P1-P3 finding (FAIL, PARTIAL, missing, unparseable, or
-          a PASS whose review-gate check found an open P1-P3 row — fail closed) — classify the
-          failure and route it into the bounded repair hop instead of dead-ending the run.
+          No certified PASS without an open P1-P3 finding (FAIL, PARTIAL, missing, unparseable, a
+          PASS whose review-gate check found an open P1-P3 row, or a PASS the reviewer graded below
+          HIGH/MEDIUM — or left ungraded — without the operator's ackLowConfidence; fail closed) —
+          classify the failure and route it into the bounded repair hop instead of dead-ending the run.
       guard:
           kind: always
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.4.2",
+    "version": "0.4.4",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",
@@ -57,15 +57,15 @@
     },
     "devDependencies": {
         "@commander-js/extra-typings": "^14.0.0",
-        "@gobing-ai/ts-db": "^0.5.22",
-        "@gobing-ai/ts-ai-runner": "^0.5.22",
-        "@gobing-ai/ts-dual-workflow-engine": "^0.5.22",
-        "@gobing-ai/ts-infra": "^0.5.22",
-        "@gobing-ai/ts-llm-jsonl-importer": "^0.5.22",
-        "@gobing-ai/ts-rule-engine": "^0.5.22",
-        "@gobing-ai/ts-runtime": "^0.5.22",
-        "@gobing-ai/ts-utils": "^0.5.22",
-        "@types/bun": "1.3.14",
+        "@gobing-ai/ts-db": "^0.5.28",
+        "@gobing-ai/ts-ai-runner": "^0.5.28",
+        "@gobing-ai/ts-dual-workflow-engine": "^0.5.28",
+        "@gobing-ai/ts-infra": "^0.5.28",
+        "@gobing-ai/ts-llm-jsonl-importer": "^0.5.28",
+        "@gobing-ai/ts-rule-engine": "^0.5.28",
+        "@gobing-ai/ts-runtime": "^0.5.28",
+        "@gobing-ai/ts-utils": "^0.5.28",
+        "@types/bun": "1.4.3",
         "@types/figlet": "^1.7.0",
         "@types/node-notifier": "8.0.5",
         "commander": "^14.0.3",