@gobing-ai/spur 0.4.3 → 0.4.4

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.4.3",
+            "version": "0.4.4",
             "source": "./plugins/sp"
         }
     ]

package/config/rules/docs/verdict-confidence.yaml

@@ -0,0 +1,68 @@
+$schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
+# Verdict-confidence rules (report corpus) — a committed verification record that states
+# a machine `Verdict:` line must also state the verifier's confidence, so a reader can
+# tell a PASS the verifier stands behind from one it would not.
+#
+# Contract owners: `Confidence: HIGH|MEDIUM|LOW` is specified for verify answers by
+# plugins/sp/skills/code-verification/SKILL.md (one `Verdict: PASS|PARTIAL|FAIL` line, one
+# `Confidence:` line, then the traceability tables) and for review reports by
+# plugins/sp/agents/super-reviewer.md. Both are already enforced for pipeline answers —
+# packages/app/src/services/verify-answer-lint.ts (`confidence-missing`,
+# `confidence-value`, and the coherence pair `confidence-unwarranted` /
+# `confidence-understated`) plus the verify stamp in config/workflows/task-pipeline.yaml —
+# but no rule read the standalone report documents agents commit under `docs/`. This file
+# is that backstop: the same three-level vocabulary, checked at the document level.
+#
+# Shape: one file-spanning forbidden match (`multiline: true` hands the evaluator the whole
+# document and the negative lookahead spans the newline) instead of line counting. The
+# lookahead demands a valid level, so a hedge (`Confidence: mostly`) reads as missing too.
+# The verdict prefix requires the closed `PASS|PARTIAL|FAIL` value on its own line, which is
+# what separates a record from prose: docs/reports/i31/0912-workflow-baseline.md:84 and
+# i31/1107-runall-p1-pilot.md:9 both open a bolded *conclusion* sentence
+# ("**Verdict: `partial — INSUFFICIENT_EVIDENCE retained`.**") and are not this contract.
+#
+# Severity `info`, and deliberately not in a preset — the same calibration choice the `docs`
+# category makes for sourced claims: findings surface for review without reddening gates
+# (`recommended-pre-check` runs `--fail-on warning`). To promote it, add `- docs` to that
+# preset's `extends` once the residual is triaged.
+#
+# Calibration (2026-10-13, `spur rule run --file config/rules/docs/verdict-confidence.yaml
+# --json`, unsuppressed): 3 findings over the 91 documents the include globs matched at that
+# timestamp (29 under docs/reports/, 62 under docs/plans/), all three the hole this closes —
+# docs/reports/2026-09-12-i21-verifyall.md:3,
+# docs/reports/2026-10-01-E71-force-verification.md:3 and
+# docs/reports/g61-verifyall-2026-09-12.md:3 each open `Verdict: PASS` and state no
+# confidence level anywhere in the document. They stay visible rather than suppressed:
+# retro-fitting a level into a historical record would invent the verifier's own claim.
+# Both directions were controlled in the same run: a scratch report holding
+# `Verdict: PASS` + `Confidence: HIGH` is not flagged, and the same file with
+# `Confidence: mostly` is.
+#
+# Include is deliberately the report corpus. `docs/plans/*brainstorm*.md` states confidence
+# as prose with its rationale (`**Confidence: HIGH.** All primitives … are verified present`,
+# 61 such lines across 18 plans) — a different, human-facing contract that a
+# level-only vocabulary check would drown in false positives, and those plans carry no
+# machine verdict line to anchor on.
+include:
+  - "docs/reports/**/*.md"
+  - "docs/plans/**/*.md"
+exclude:
+  - "docs/tasks*/**"
+rules:
+  - id: verdict-line-confidence-missing
+    description: >
+      A committed verification record that asserts a machine verdict line
+      (`Verdict: PASS|PARTIAL|FAIL`) must follow it with the verifier's confidence level —
+      `Confidence: HIGH|MEDIUM|LOW` — so a reader can tell a verdict the verifier stands
+      behind from one it would not. Contract in sp-code-verification (verify answers) and
+      sp-super-reviewer (review reports); a missing level is a lint failure for pipeline
+      answers (`confidence-missing`), and this rule is the backstop for the reports those
+      surfaces do not read.
+    severity: info
+    evaluator:
+      type: regex
+      config:
+        mode: forbid
+        multiline: true
+        flags: "i"
+        pattern: "^[ \\t]*\\**Verdict\\**:\\**[ \\t]*(?:PASS|PARTIAL|FAIL)\\**[ \\t]*\\n(?:[ \\t]*\\n)*(?![ \\t]*\\**Confidence\\**:\\**[ \\t]*\\**(?:HIGH|MEDIUM|LOW)\\**[ \\t]*\\.?[ \\t]*$)"

package/config/rules/quality/coverage-gate.yaml

@@ -1,5 +1,18 @@
 $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 # Coverage gate — per-file line coverage meets threshold from Bun's lcov output.
+#
+# PROVENANCE (task 1203): since task 1203 the repository post-check scripts
+# (`test-post-check`, `test-post-check:full`) validate canonical coverage
+# certification BEFORE this rule evaluates: only a completed successful canonical
+# full-suite run (`bun run test`, `test:coverage`, `test:full`) certifies
+# .coverage/lcov.info (marker: .coverage/coverage-certification.json, written by
+# scripts/commands/run-tests.ts --publish-coverage). Missing/pending/superseded/
+# stale-tree/byte-mismatched artifacts fail the post-check with a
+# `coverage-artifact:` diagnostic before per-file findings; recovery is rerunning
+# `bun run test:full`. Running this rule directly via `spur rule run` outside the
+# repository wrapper bypasses that certification wrapper and is outside this
+# repository's certification contract. This rule and its evaluator are unchanged.
+#
 # Absorbed from ts-libs/.spur/rules/quality/coverage-gate.yaml, re-scoped to
 # Spur's monorepo layout:
 #   - lcovPath kept at .coverage/lcov.info (Spur's `bun run test:coverage`

package/config/rules/recommended-pre-check.yaml

@@ -8,8 +8,12 @@ $schema: "@gobing-ai/spur/schemas/preset.schema.json"
 # post-check alongside coverage-gate.
 #
 # TEMPORARY (2026-10-08): `docs` removed from extends to unblock the gate —
-# restore it (add `- docs` back) once sourced-api-claims finding noise is
-# triaged. Recapture the raw-json-baseline fixtures in the same change.
+# restore it (add `- docs` back) once sourcing-claim finding noise is triaged.
+# The category now holds two files and both residuals must be triaged first:
+# `docs/sourced-api-claims.yaml` (advisory citation/level checks on claim lines) and
+# `docs/verdict-confidence.yaml` (a machine `Verdict:` report must state its
+# HIGH/MEDIUM/LOW level; 3 historical reports under docs/reports/ predate the
+# contract). Recapture the raw-json-baseline fixtures in the same change.
 name: recommended-pre-check
 extends:
   - typescript

package/config/rules/strict/runtime-boundaries.yaml

@@ -70,6 +70,7 @@ rules:
             - "packages/app/src/services/token-ledger-service.ts" # FD byte-window log tailing
             - "packages/app/src/services/token-ledger-watcher.ts" # node:fs watch() live watcher
             - "packages/app/src/services/project-registry.ts" # atomic projects.json persistence
+            - "packages/app/src/services/project-process.ts" # port/pid probes moved verbatim out of project-registry.ts to break the registry↔stop import cycle (same exemption)
             - "packages/app/src/services/project-server-owner.ts" # atomic mkdir lifetime claim + unique-marker stale recovery; FileSystem has no exclusive mkdir primitive (1082)
             - "packages/app/src/services/slash-commands-service.ts" # synchronous ~/.config/spur/slash_commands.json persistence (mirrors project-registry.ts)
             - "packages/app/src/services/agent-usage-producer.ts" # atomic agent-usage snapshot write (tmp + rename, mirrors project-registry.ts; task 0892 R1)
@@ -82,6 +83,7 @@ rules:
             - "packages/app/src/services/quality-gate.ts" # gate artifacts (log/findings/receipt) written directly; merged-fd gate log and fsync-free atomic writes must stay byte-stable; bundled standalone for the bare-node plugin twin (task 1006 R1; mirrors history-anatomy.ts)
             - "packages/app/src/workflow/feature-verification-run.ts" # the pass opens the run's single merged log fd (`openSync(path,'a')`) and mkdirs the run dir beside the receipt writer, exactly as the plugin entry did before the move; the fd cannot be expressed through the FileSystem seam (task 1176 R2; same class as the quality-gate exemption above)
             - "packages/app/src/services/run-storage.ts" # durable-evidence migration core (task 1025 R4): atomic tmp+rename byte copies with digest reread and atomic manifest publish must stay byte-stable (mirrors agent-usage-producer.ts / project-registry.ts exemptions)
+            - "packages/app/src/services/durable-plane-ignore.ts" # .git/info/exclude append moved verbatim out of run-storage.ts to break an import cycle (same exemption)
 
             # Electron Node adapters cannot load Bun runtime implementations; keep the
             # synchronous existence/directory probes injected for unit testing (desktop contract).
@@ -91,6 +93,7 @@ rules:
             # Synchronous bootstrap & path resolution:
             - "packages/config/src/bundled-config.ts" # sync bundledConfigRoot() directory walk
             - "packages/config/src/loader.ts" # sync resolveConfigFile() / schema specifier lookup
+            - "packages/config/src/config-layers.ts" # sync resolveConfigLayers() existence probes moved verbatim out of loader.ts to break the loader↔executor-update cycle (same exemption)
             - "packages/config/src/executor-update.ts" # atomic single-entry config update (task 0797): O_EXCL lock, fsync'd tmp+rename commit, lstat symlink refusal, mode preservation — ts-runtime FileSystem seam has no lstat/fsync/chmod/O_EXCL
             - "packages/app/src/services/project-start.ts" # sync CLI binary path checks before daemon spawn
             - "apps/cli/src/commands/serve.ts" # sync resolveServeCwd() directory validation before server startup (task 0805 R2); mirrors task.ts sync-template exemption

package/config/rules/surface/check-cli-surface.yaml

@@ -10,9 +10,7 @@ include:
   - "apps/cli/src/commands/*.ts"
 
 exclude:
-  # Not command files: stubs.ts is an empty module shim (consistency.test.ts
-  # excludes it too); shared-options.ts is the option registry.
-  - "apps/cli/src/commands/stubs.ts"
+  # Not a command file: shared-options.ts is the option registry.
   - "apps/cli/src/commands/shared-options.ts"
 
 rules:

package/config/templates/AGENTS.md

@@ -147,6 +147,13 @@ _(Fill from package manifests / README — or during `sp:doc-evolve` customize.)
 **Done gate (minimum):** lint + tests clean; only intentional `git status` changes; no
 `--no-verify` / silent suppressions. Harness task done ⇒ real verify **PASS** when the pipeline ran.
 
+**Gate scope:** the gate verifies code changes. Scribe commands — `/sp:dev-gitmsg`,
+`/sp:dev-changelog`, `/sp:dev-handover`, `/sp:dev-job-dump` — produce text or a commit and run no
+gate (lint, typecheck, tests) unless asked: `gitmsg --check <cmd>`, or `/sp:dev-gtd --no-push` for
+gate → fix → commit. Commands that own a gate (`dev-run`, `dev-runall`, `dev-fixall`, `dev-gtd`,
+`dev-fixgha`, `dev-unit`, `--check` loops) run exactly what their contract names — no extra
+completion-gate pass on top.
+
 ---
 
 ## Spur CLI surface

package/config/workflows/feature-verification.yaml

@@ -51,6 +51,14 @@ vars:
   featureId: "X"
   spurBin: "spur"
   verificationCmd: "bun run spur-check-feature"
+  # Operator-declared confidence level; empty derives it from the pass (HIGH when the selected
+  # definition's own command exited 0 with an unchanged proof-input digest, MEDIUM under a caller
+  # `--cmd` override, LOW otherwise). The completion boundary refuses a PASS carrying no level or
+  # LOW unless the receipt records the acknowledgement below.
+  confidence: ""
+  # Operator acknowledgement of a LOW level. It rides the receipt, so the transition reads it from
+  # the evidence rather than from whatever flags a later command happens to pass.
+  ackLowConfidence: "false"
   __runId: ""
 
 states:
@@ -70,7 +78,7 @@ states:
       - kind: shell
         options:
           command: >-
-            mkdir -p .spur/run; eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/feature-verification-steps.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/feature-verification-steps.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; [ -f "$S" ] && "$RUNNER" "$S" verify --feature-id "$featureId" --run-id "$__runId" --spur-bin "$spurBin" || printf 'FAIL feature-verification failed closed — script not found — run superskill install sp --marketplace gobing-ai/spur\n' > ".spur/run/$__runId-feature-verification.status"; exit 0
+            mkdir -p .spur/run; eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/feature-verification-steps.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/feature-verification-steps.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; ACK=""; [ "$ackLowConfidence" = "true" ] && ACK="--ack-low-confidence"; [ -f "$S" ] && "$RUNNER" "$S" verify --feature-id "$featureId" --run-id "$__runId" --spur-bin "$spurBin" --confidence "$confidence" $ACK || printf 'FAIL feature-verification failed closed — script not found — run superskill install sp --marketplace gobing-ai/spur\n' > ".spur/run/$__runId-feature-verification.status"; exit 0
 
   - id: done
     description: Terminal — repo-wide checks passed and the receipt is bound.

package/config/workflows/task-lifecycle.yaml

@@ -64,6 +64,11 @@ states:
       Completed. Re-enterable (reopen with warning + mandatory History entry).
   - id: cancelled
     description: Terminal — abandoned.
+  - id: deprecated
+    description: >
+      Retained and frozen (ADR-137). Non-terminal: the record stays readable and
+      countable, nothing new may attach to it, and leaving it is explicit —
+      un-deprecate to todo, or cancelled once the task is removed.
 
 transitions:
   # Forward path: backlog → todo → wip → testing → done
@@ -157,3 +162,48 @@ transitions:
     description: Cancel task
     guard:
       kind: always
+
+  # Deprecate: any non-terminal-or-done state → deprecated (frozen, retained — ADR-137)
+  - from: backlog
+    to: deprecated
+    description: Deprecate task (frozen, retained)
+    guard:
+      kind: always
+  - from: todo
+    to: deprecated
+    description: Deprecate task (frozen, retained)
+    guard:
+      kind: always
+  - from: wip
+    to: deprecated
+    description: Deprecate task (frozen, retained)
+    guard:
+      kind: always
+  - from: testing
+    to: deprecated
+    description: Deprecate task (frozen, retained)
+    guard:
+      kind: always
+  - from: blocked
+    to: deprecated
+    description: Deprecate task (frozen, retained)
+    guard:
+      kind: always
+  - from: done
+    to: deprecated
+    description: Deprecate task (frozen, retained)
+    guard:
+      kind: always
+
+  # Exits out of deprecated: un-deprecate or remove only. Any other edge is
+  # undeclared and refused by the graph (ADR-135).
+  - from: deprecated
+    to: todo
+    description: Un-deprecate (mandatory History entry)
+    guard:
+      kind: always
+  - from: deprecated
+    to: cancelled
+    description: Remove deprecated task
+    guard:
+      kind: always

package/config/workflows/task-pipeline.yaml

@@ -1312,11 +1312,16 @@ transitions:
     # re-enters quality → review → verify on a fresh digest. Before 1088 a FAIL review had no
     # outgoing edge at all; before 1122 a PASS-with-findings cost a full re-certification cycle per
     # attempt (knowledge-kit 0210/0213). The reviewer writes `Verdict: PASS|FAIL` in its answer;
-    # both plain and bold forms are accepted. Under `profile=auto` the approve gate is skipped, so
-    # the PASS+auto edge is tried first and the interactive PASS edge second.
+    # both plain and bold forms are accepted. Since 1204 a PASS must also be GRADED: the reviewer
+    # states `Confidence: HIGH|MEDIUM|LOW` (verify-chain semantics, 1068), HIGH/MEDIUM cross the
+    # PASS edges unadorned, and LOW or an absent line needs the operator's `ackLowConfidence` —
+    # otherwise the PASS falls to the catch-all like any other verdict the reviewer would not stand
+    # behind (same policy as the verify confidence gate). Review stays advisory: verify certifies.
+    # Under `profile=auto` the approve gate is skipped, so the PASS+auto edge is tried first and the
+    # interactive PASS edge second.
     - from: review
       to: verify
-      description: profile=auto, the review certified PASS, and no open P1-P3 review finding — skip the human approval gate.
+      description: profile=auto, the review certified a HIGH/MEDIUM-confidence PASS (LOW/absent needs ackLowConfidence) with no open P1-P3 finding — skip the human approval gate.
       guard:
           kind: shell
           options:
@@ -1324,23 +1329,24 @@ transitions:
                   test "$profile" = auto &&
                   grep -qiE '^[[:space:]]*\**Verdict:\** *PASS' ".spur/run/$__runId-review-answer.txt" &&
                   eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/residual-scan.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/residual-scan.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)" &&
-                  [ -f "$S" ] && "$RUNNER" "$S" review-gate "$wbs" --spur-bin "$spurBin" >&2
+                  [ -f "$S" ] && "$RUNNER" "$S" review-gate "$wbs" --spur-bin "$spurBin" --review-answer ".spur/run/$__runId-review-answer.txt" >&2
     - from: review
       to: approve
-      description: Review certified PASS with no open P1-P3 review finding — gate on human approval before verification.
+      description: Review certified a HIGH/MEDIUM-confidence PASS (LOW/absent needs ackLowConfidence) with no open P1-P3 finding — gate on human approval before verification.
       guard:
           kind: shell
           options:
               command: >-
                   grep -qiE '^[[:space:]]*\**Verdict:\** *PASS' ".spur/run/$__runId-review-answer.txt" &&
                   eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/residual-scan.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/residual-scan.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)" &&
-                  [ -f "$S" ] && "$RUNNER" "$S" review-gate "$wbs" --spur-bin "$spurBin" >&2
+                  [ -f "$S" ] && "$RUNNER" "$S" review-gate "$wbs" --spur-bin "$spurBin" --review-answer ".spur/run/$__runId-review-answer.txt" >&2
     - from: review
       to: review-fail-triage
       description: >-
-          No certified PASS without an open P1-P3 finding (FAIL, PARTIAL, missing, unparseable, or
-          a PASS whose review-gate check found an open P1-P3 row — fail closed) — classify the
-          failure and route it into the bounded repair hop instead of dead-ending the run.
+          No certified PASS without an open P1-P3 finding (FAIL, PARTIAL, missing, unparseable, a
+          PASS whose review-gate check found an open P1-P3 row, or a PASS the reviewer graded below
+          HIGH/MEDIUM — or left ungraded — without the operator's ackLowConfidence; fail closed) —
+          classify the failure and route it into the bounded repair hop instead of dead-ending the run.
       guard:
           kind: always
 

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.4.3",
+    "version": "0.4.4",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",
@@ -57,15 +57,15 @@
     },
     "devDependencies": {
         "@commander-js/extra-typings": "^14.0.0",
-        "@gobing-ai/ts-db": "^0.5.24",
-        "@gobing-ai/ts-ai-runner": "^0.5.24",
-        "@gobing-ai/ts-dual-workflow-engine": "^0.5.24",
-        "@gobing-ai/ts-infra": "^0.5.24",
-        "@gobing-ai/ts-llm-jsonl-importer": "^0.5.24",
-        "@gobing-ai/ts-rule-engine": "^0.5.24",
-        "@gobing-ai/ts-runtime": "^0.5.24",
-        "@gobing-ai/ts-utils": "^0.5.24",
-        "@types/bun": "1.3.14",
+        "@gobing-ai/ts-db": "^0.5.28",
+        "@gobing-ai/ts-ai-runner": "^0.5.28",
+        "@gobing-ai/ts-dual-workflow-engine": "^0.5.28",
+        "@gobing-ai/ts-infra": "^0.5.28",
+        "@gobing-ai/ts-llm-jsonl-importer": "^0.5.28",
+        "@gobing-ai/ts-rule-engine": "^0.5.28",
+        "@gobing-ai/ts-runtime": "^0.5.28",
+        "@gobing-ai/ts-utils": "^0.5.28",
+        "@types/bun": "1.4.3",
         "@types/figlet": "^1.7.0",
         "@types/node-notifier": "8.0.5",
         "commander": "^14.0.3",

package/plugins/sp/agents/super-reviewer.md

@@ -245,8 +245,11 @@ before it were never asked for a level, so pre-adoption artifacts read as debt,
 `residual-scan review-gate` reads the recorded `### Review` body, and a missing, duplicated or
 out-of-enum level becomes a **blocking** `review-contract` item — `review → verify` stops and the run
 enters `review-fail-triage` with the bounded repair hop, exactly as an open P1–P3 row does. The gate
-checks presence and vocabulary only: whether a level is *earned* stays a judgement call (see the
-earning rule above), so the report must still argue it.
+checks the recorded section's presence and vocabulary; the same scanner grades the answer passed
+by both PASS edges and refuses a `LOW` (or ungraded) PASS unless the operator sets
+`ackLowConfidence` exactly to `true` (task 1204 — the same policy the verify
+chain enforces), so whether a level is *earned* stays a judgement call (see the earning rule above):
+the report must still argue it.
 
 **Source citations for external claims (one claim contract, 2026-10-12).** A Finding cell or a
 Functional Traceability `Evidence` cell that asserts an external API/library claim carries a

package/plugins/sp/commands/dev-changelog.md

@@ -26,5 +26,5 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 ## Implementation
 
-Follow the inline procedure in [dev-operations.md](../skills/spur-dev/references/dev-operations.md#8-changelog) (changelog). This is a docs-only generator: run no quality gates (lint, tests, `spur-check`, rules, citation checks).
+Follow the inline procedure in [dev-operations.md](../skills/spur-dev/references/dev-operations.md#8-changelog) (changelog). This is a docs-only generator: run no quality gates (`bun run gate`, lint, typecheck, tests, `spur-check`, rules, citation checks) — a generic "verify before finishing" rule does not apply here.
 

package/plugins/sp/commands/dev-gitmsg.md

@@ -1,7 +1,7 @@
 ---
 description: Generate conventional commit message(s) from the current change set via one bounded gather call, optionally commit
 role: scribe
-argument-hint: "[--commit] [--squash] [--all] [--scope <path>]"
+argument-hint: "[--commit] [--squash] [--all] [--scope <path>] [--check <cmd>]"
 allowed-tools: ["Bash", "Read"]
 ---
 
@@ -17,12 +17,13 @@ Implements an inline procedure — see [dev-operations.md](../skills/spur-dev/re
 | `--squash` | Collapse every concern into one message and one commit; implies `--commit`. | off |
 | `--all` | Widen the change set past the index to every change in the tree — unstaged **and untracked**. | off |
 | `--scope` `<path>` | Path filter on the change set; always wins over change-set auto-discovery. | the whole change set |
+| `--check` `<cmd>` | Run `<cmd>` (e.g. `"bun run gate"`) once before committing; non-zero → commit nothing. | off |
 
 For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag-glossary.md).
 
 ## Usage
 
-/sp:dev-gitmsg [--commit] [--squash] [--all] [--scope <path>]
+/sp:dev-gitmsg [--commit] [--squash] [--all] [--scope <path>] [--check <cmd>]
 
 ## Implementation
 
@@ -35,3 +36,6 @@ commit per concern, split automatically, so the operator is never asked to re-st
 `--squash` → one commit for everything. An empty index widens to the whole tree only on a
 message-only run, and says so; a committing run stops there and prints the exact `--all` re-run line
 instead of guessing.
+No quality gate (`bun run gate`, lint, typecheck, tests, `spur-check`) runs unless `--check <cmd>`
+names one — then it runs once, before any commit, and a failure commits nothing. Gate → auto-fix →
+commit is `/sp:dev-gtd --no-push`.

package/plugins/sp/commands/dev-handover.md

@@ -24,4 +24,5 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 ## Implementation
 
 Follow the inline procedure in [dev-operations.md](../skills/spur-dev/references/dev-operations.md#11-handover) (handover).
+Run no quality gate (`bun run gate`, lint, typecheck, tests, `spur-check`); cite results already on record.
 

package/plugins/sp/commands/dev-job-dump.md

@@ -24,6 +24,7 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 ## Implementation
 
 Follow [job-dump](../skills/spur-dev/references/dev-operations.md#11a-job-dump), using the shared
-handoff template to capture the current job and its remaining work.
+handoff template to capture the current job and its remaining work. Run no quality gate
+(`bun run gate`, lint, typecheck, tests, `spur-check`); copy existing gate results or write `not run`.
 
 Skill(skill="sp:spur-dev", args="job-dump $ARGUMENTS")

package/plugins/sp/commands/dev-refine.md

@@ -18,6 +18,14 @@ Wraps the **sp:spur-dev** skill. Three jobs:
 `standard` checks only that target sections are structurally complete. It never re-checks what
 they say. Use `ready` whenever the existing content itself is in doubt.
 
+**Refine never writes `feature_id`.** It may *report* an orphan task in its result, but linking a
+task to a feature is an operator decision with a lifecycle blast radius: `spur task update <wbs>
+--feature <id>` reopens a `verifying` parent unless `--no-reopen` is passed. Route linking through
+the opt-in [feature-link helper](../skills/spur-dev/references/feature-link-helper.md) (never
+gate-time, never automatic, always confirmed) — observed 2026-10-13: the ready-preparation refine
+that `spur task create` dispatches by default linked a fresh task to `P1` on its own and demoted
+that feature `verifying → active`.
+
 ## Argument Flags
 
 | Flag | Description | Default |
@@ -47,9 +55,13 @@ implement without inventing design:
 1. Audit every existing claim against the current tree: facts, cited sources, fix soundness across
    all callers, test observability, environment, concurrent work, and scope.
 2. Correct what is wrong and record each change in a dated `**Refine corrections (<date>)**` block
-   in Background.
+   in Background. When the task bundles several issues, triage each one. An issue that is invalid,
+   already fixed or owned elsewhere is removed together with its R-items, Design/Solution notes,
+   Plan steps and ACs. If no issue stays valid, cancel the task (`spur task update <wbs> cancelled`)
+   and report `cancelled` instead of promoting it.
 3. Run `spur task check <wbs> --as todo --json`, fill unset priority/estimate, and promote
-   `backlog → todo`.
+   `backlog → todo`. If triage dropped issues, re-estimate and record old → new. Also record a
+   title that still names dropped scope; the CLI cannot rename a task.
 4. Report checklist rows `{id, pass, evidence}`.
 
 Refine targets `backlog`/`todo` tasks; a `wip`-or-later task needs explicit operator consent and is

package/plugins/sp/commands/dev-refineall.md

@@ -54,7 +54,13 @@ not a bug.
 **Depth:** default `standard` keeps the cheap L3 SKIP gate under `--auto`. Use
 `--depth ready` when handing a feature to another implementer (frozen Design/Requirements/Plan),
 or when the tasks' existing content is in doubt; thread `--depth` into each per-task refine. Ready
-report rows add corrections count, status before → after, and failed checklist ids.
+report rows add corrections count, dropped issues, status before → after, and failed checklist ids.
+Each task's issues are triaged one by one: invalid ones are dropped with their fixes, and a task
+with no valid issue left is `cancelled`. The ready report also proposes merges between overlapping
+tasks, ordering or a shared step for complementary ones, and owning features for tasks without a
+`feature_id`. It executes neither unless
+`--description` names the task and action, for example
+`--description "cancel 0273 and merge its issues into 0269; link 0260 and 0274 to G11"`.
 
 > **`--next` dropped** (feature H8, 2026-07-31). Batch-level chaining was a token bomb — each refine
 > hop is an LLM call, and a large feature means N refine chains fanned out at once. For batch

package/plugins/sp/commands/dev-review.md

@@ -43,6 +43,7 @@ Put the target first: a bare token after `--worktree` is read as the worktree na
 - **WBS mode (per task target):** `Skill(skill="sp:functional-review", args="<wbs> $FLAGS")` + `Skill(skill="sp:code-verification", args="review <wbs> $FLAGS")` + `Skill(skill="sp:code-improvement", args="<wbs> $FLAGS")` (functional traceability + SECUA framework + architectural depth — each skill receives its one resolved WBS exactly once plus `$FLAGS` = `$ARGUMENTS` minus the selector (`--tasks`/`--feature`/`--scope` or positional) and its value, never the raw selector, and returns a review fragment only — F92 0593 R1)
 - **Task fan-out (`--tasks` / `--feature`).** One WBS-mode review per task in the frozen set. Tasks in `backlog`/`todo`/`blocked` are reported NOT-STARTED and skipped (§ 3a outcome vocabulary); a per-task failure does not stop the remaining tasks. Each implemented task gets its own merged `## Review`; the run ends with a combined summary table (WBS, verdict, P1/P2 counts).
 - Coordinator = this session. No `sp:super-reviewer` subagent is dispatched: act as the review coordinator defined in [agents/super-reviewer.md](../agents/super-reviewer.md) — merge the fragments per its Output Format (native `P1`–`P4` priority cells, section-relative headings) and, for every task target (standalone or pipeline), write that task's combined `## Review` via `spur task update <wbs> --section Review --from-file`. Path mode emits advisory output only.
+- **Answer contract (pipeline dispatches).** The captured review answer (`.spur/run/<runId>-review-answer.txt`) must carry exactly one `Verdict: PASS|FAIL` line and exactly one `Confidence: HIGH|MEDIUM|LOW` line stating how strongly the review stands behind its verdict — HIGH = the reviewer re-executed the checks behind the verdict, MEDIUM = partial reliance on prior/external evidence, LOW = key evidence not re-executed. The pipeline's PASS edges admit HIGH/MEDIUM unadorned; LOW or an absent line crosses only with the operator's `ackLowConfidence` (same policy as the verify confidence gate, task 1068).
 - **Path mode (per path target):** `Skill(skill="sp:code-verification", args="review <path> $FLAGS")` + `Skill(skill="sp:code-improvement", args="<path> $FLAGS")` (advisory SECUA quality + architectural depth — one normalized path forwarded once plus `$FLAGS`; performs no task mutation). Under `--scope <path>[,<path>]`: paths must exist (exit 2 otherwise), are normalized, duplicates dropped and nested paths collapse to the ancestor (`--scope apps,apps/cli` → `apps`); each surviving path gets a sub-review (Step 3p path scope), eligible for native-subagent dispatch per [dispatch-surface.md](../skills/parallel-execution/references/dispatch-surface.md); the coordinator merges the sub-reviews, runs **one** cross-path architecture pass (`sp:code-improvement` over the inter-path imports), and emits **one** advisory report. No task mutation.
 - **Positional alias (deprecated).** A positional `<wbs|path>` is accepted for one release: a `^\d{4}$` token with a resolvable task behaves as `--tasks <wbs>`; an existing path as `--scope <path>`; otherwise exit 2. Print a deprecation warning naming the replacement selector; removal is a follow-up.
 - `--triage`: after the review returns, run the triage protocol in [dev-operations.md § 2. review](../skills/spur-dev/references/dev-operations.md#2-review) **inline in this session** — the review skills and `sp:super-reviewer` stay report-only. With multiple targets, bucket the findings across all targets once (identical `file:line` findings deduped before bucketing). `Edit`/`Write` in `allowed-tools` exist only for these direct fixes.

package/plugins/sp/lib/history-anatomy.generated.mjs

@@ -669,23 +669,23 @@ function diffPorcelain(before, now, expects) {
   return [...porcelainPaths(now)].filter((p) => !beforePaths.has(p) && !expects.has(p)).sort();
 }
 export {
-  validateSelector,
-  stampReport,
-  semanticArtifactDigest,
-  resolvePaths,
-  renderProvenanceFrontmatter,
-  refreshReport,
-  publishAtomically,
-  probe,
-  porcelainPaths,
-  parseProvenance,
-  logicDigest,
-  importedSnapshotAsOf,
-  diffPorcelain,
-  decideCache,
-  checkReportStructure,
-  buildProvenance,
-  bannerLine,
+  FINDING_FIELDS,
   REPORT_SECTIONS,
-  FINDING_FIELDS
+  bannerLine,
+  buildProvenance,
+  checkReportStructure,
+  decideCache,
+  diffPorcelain,
+  importedSnapshotAsOf,
+  logicDigest,
+  parseProvenance,
+  porcelainPaths,
+  probe,
+  publishAtomically,
+  refreshReport,
+  renderProvenanceFrontmatter,
+  resolvePaths,
+  semanticArtifactDigest,
+  stampReport,
+  validateSelector
 };