@gobing-ai/spur 0.4.3 → 0.4.5

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.4.3",
+            "version": "0.4.5",
             "source": "./plugins/sp"
         }
     ]

package/config/rules/docs/sourced-api-claims.yaml

@@ -32,8 +32,9 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 # backstop: the two `cited-*` rules cover the citation half, and
 # `cited-api-claims-confidence` covers the level half. All are severity `info`,
 # and the category is deliberately NOT in `recommended-pre-check` — it surfaces
-# findings for review without reddening gates. To promote it to a gate, add
-# `- docs` to that preset's `extends` once the residual list is triaged.
+# findings for review without reddening gates. The 2026-10-12 audit below settled
+# the promotion question: the residual findings stay a review-surface concern
+# (SECUA checklist), not a gate one — do not add `- docs` to that preset.
 include:
   - "docs/**/*.md"
   - "plugins/sp/skills/**/references/**/*.md"

package/config/rules/quality/coverage-gate.yaml

@@ -1,5 +1,18 @@
 $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 # Coverage gate — per-file line coverage meets threshold from Bun's lcov output.
+#
+# PROVENANCE (task 1203): since task 1203 the repository post-check scripts
+# (`test-post-check`, `test-post-check:full`) validate canonical coverage
+# certification BEFORE this rule evaluates: only a completed successful canonical
+# full-suite run (`bun run test`, `test:coverage`, `test:full`) certifies
+# .coverage/lcov.info (marker: .coverage/coverage-certification.json, written by
+# scripts/commands/run-tests.ts --publish-coverage). Missing/pending/superseded/
+# stale-tree/byte-mismatched artifacts fail the post-check with a
+# `coverage-artifact:` diagnostic before per-file findings; recovery is rerunning
+# `bun run test:full`. Running this rule directly via `spur rule run` outside the
+# repository wrapper bypasses that certification wrapper and is outside this
+# repository's certification contract. This rule and its evaluator are unchanged.
+#
 # Absorbed from ts-libs/.spur/rules/quality/coverage-gate.yaml, re-scoped to
 # Spur's monorepo layout:
 #   - lcovPath kept at .coverage/lcov.info (Spur's `bun run test:coverage`

package/config/rules/recommended-pre-check.yaml

@@ -4,12 +4,17 @@ $schema: "@gobing-ai/spur/schemas/preset.schema.json"
 #
 # Runs BEFORE tests (test-pre-check). Extends categories: typescript,
 # structure, boundary, surface, ui, strict (ui since bc267cc8, strict since
-# 79186391), and docs (sourced-api-claims, 2026-10-07). TSDoc exports run in
-# post-check alongside coverage-gate.
+# 79186391), and docs (sourced-api-claims, 2026-10-07; pulled 2026-10-08 for
+# finding noise — a 2026-10-14 restore was reverted; keep it out for now, see
+# the marker line below). TSDoc exports run in post-check alongside
+# coverage-gate.
 #
-# TEMPORARY (2026-10-08): `docs` removed from extends to unblock the gate —
-# restore it (add `- docs` back) once sourced-api-claims finding noise is
-# triaged. Recapture the raw-json-baseline fixtures in the same change.
+# `docs/sourced-api-claims.yaml` (citation/level checks) stays OUT of this gate:
+# severity info would not redden it, but the findings belong to the SECUA review
+# surface — run that file ad hoc instead. Recapture the raw-json-baseline
+# fixtures when touching this preset. (F511: the category's other file,
+# `verdict-confidence.yaml`, was deleted with the asserted confidence machinery
+# it backstopped.)
 name: recommended-pre-check
 extends:
   - typescript
@@ -18,3 +23,4 @@ extends:
   - surface
   - ui
   - strict
+  # - docs  ## DO NOT ENABLE THIS LINE

package/config/rules/strict/runtime-boundaries.yaml

@@ -70,6 +70,7 @@ rules:
             - "packages/app/src/services/token-ledger-service.ts" # FD byte-window log tailing
             - "packages/app/src/services/token-ledger-watcher.ts" # node:fs watch() live watcher
             - "packages/app/src/services/project-registry.ts" # atomic projects.json persistence
+            - "packages/app/src/services/project-process.ts" # port/pid probes moved verbatim out of project-registry.ts to break the registry↔stop import cycle (same exemption)
             - "packages/app/src/services/project-server-owner.ts" # atomic mkdir lifetime claim + unique-marker stale recovery; FileSystem has no exclusive mkdir primitive (1082)
             - "packages/app/src/services/slash-commands-service.ts" # synchronous ~/.config/spur/slash_commands.json persistence (mirrors project-registry.ts)
             - "packages/app/src/services/agent-usage-producer.ts" # atomic agent-usage snapshot write (tmp + rename, mirrors project-registry.ts; task 0892 R1)
@@ -82,6 +83,7 @@ rules:
             - "packages/app/src/services/quality-gate.ts" # gate artifacts (log/findings/receipt) written directly; merged-fd gate log and fsync-free atomic writes must stay byte-stable; bundled standalone for the bare-node plugin twin (task 1006 R1; mirrors history-anatomy.ts)
             - "packages/app/src/workflow/feature-verification-run.ts" # the pass opens the run's single merged log fd (`openSync(path,'a')`) and mkdirs the run dir beside the receipt writer, exactly as the plugin entry did before the move; the fd cannot be expressed through the FileSystem seam (task 1176 R2; same class as the quality-gate exemption above)
             - "packages/app/src/services/run-storage.ts" # durable-evidence migration core (task 1025 R4): atomic tmp+rename byte copies with digest reread and atomic manifest publish must stay byte-stable (mirrors agent-usage-producer.ts / project-registry.ts exemptions)
+            - "packages/app/src/services/durable-plane-ignore.ts" # .git/info/exclude append moved verbatim out of run-storage.ts to break an import cycle (same exemption)
 
             # Electron Node adapters cannot load Bun runtime implementations; keep the
             # synchronous existence/directory probes injected for unit testing (desktop contract).
@@ -91,6 +93,7 @@ rules:
             # Synchronous bootstrap & path resolution:
             - "packages/config/src/bundled-config.ts" # sync bundledConfigRoot() directory walk
             - "packages/config/src/loader.ts" # sync resolveConfigFile() / schema specifier lookup
+            - "packages/config/src/config-layers.ts" # sync resolveConfigLayers() existence probes moved verbatim out of loader.ts to break the loader↔executor-update cycle (same exemption)
             - "packages/config/src/executor-update.ts" # atomic single-entry config update (task 0797): O_EXCL lock, fsync'd tmp+rename commit, lstat symlink refusal, mode preservation — ts-runtime FileSystem seam has no lstat/fsync/chmod/O_EXCL
             - "packages/app/src/services/project-start.ts" # sync CLI binary path checks before daemon spawn
             - "apps/cli/src/commands/serve.ts" # sync resolveServeCwd() directory validation before server startup (task 0805 R2); mirrors task.ts sync-template exemption

package/config/rules/surface/check-cli-surface.yaml

@@ -10,9 +10,7 @@ include:
   - "apps/cli/src/commands/*.ts"
 
 exclude:
-  # Not command files: stubs.ts is an empty module shim (consistency.test.ts
-  # excludes it too); shared-options.ts is the option registry.
-  - "apps/cli/src/commands/stubs.ts"
+  # Not a command file: shared-options.ts is the option registry.
   - "apps/cli/src/commands/shared-options.ts"
 
 rules:

package/config/templates/AGENTS.md

@@ -147,6 +147,13 @@ _(Fill from package manifests / README — or during `sp:doc-evolve` customize.)
 **Done gate (minimum):** lint + tests clean; only intentional `git status` changes; no
 `--no-verify` / silent suppressions. Harness task done ⇒ real verify **PASS** when the pipeline ran.
 
+**Gate scope:** the gate verifies code changes. Scribe commands — `/sp:dev-gitmsg`,
+`/sp:dev-changelog`, `/sp:dev-handover`, `/sp:dev-job-dump` — produce text or a commit and run no
+gate (lint, typecheck, tests) unless asked: `gitmsg --check <cmd>`, or `/sp:dev-gtd --no-push` for
+gate → fix → commit. Commands that own a gate (`dev-run`, `dev-runall`, `dev-fixall`, `dev-gtd`,
+`dev-fixgha`, `dev-unit`, `--check` loops) run exactly what their contract names — no extra
+completion-gate pass on top.
+
 ---
 
 ## Spur CLI surface

package/config/workflows/feature-verification.yaml

@@ -51,6 +51,14 @@ vars:
   featureId: "X"
   spurBin: "spur"
   verificationCmd: "bun run spur-check-feature"
+  # Operator-declared confidence level; empty derives it from the pass (HIGH when the selected
+  # definition's own command exited 0 with an unchanged proof-input digest, MEDIUM under a caller
+  # `--cmd` override, LOW otherwise). The completion boundary refuses a PASS carrying no level or
+  # LOW unless the receipt records the acknowledgement below.
+  confidence: ""
+  # Operator acknowledgement of a LOW level. It rides the receipt, so the transition reads it from
+  # the evidence rather than from whatever flags a later command happens to pass.
+  ackLowConfidence: "false"
   __runId: ""
 
 states:
@@ -70,7 +78,7 @@ states:
       - kind: shell
         options:
           command: >-
-            mkdir -p .spur/run; eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/feature-verification-steps.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/feature-verification-steps.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; [ -f "$S" ] && "$RUNNER" "$S" verify --feature-id "$featureId" --run-id "$__runId" --spur-bin "$spurBin" || printf 'FAIL feature-verification failed closed — script not found — run superskill install sp --marketplace gobing-ai/spur\n' > ".spur/run/$__runId-feature-verification.status"; exit 0
+            mkdir -p .spur/run; eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/feature-verification-steps.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/feature-verification-steps.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; ACK=""; [ "$ackLowConfidence" = "true" ] && ACK="--ack-low-confidence"; [ -f "$S" ] && "$RUNNER" "$S" verify --feature-id "$featureId" --run-id "$__runId" --spur-bin "$spurBin" --confidence "$confidence" $ACK || printf 'FAIL feature-verification failed closed — script not found — run superskill install sp --marketplace gobing-ai/spur\n' > ".spur/run/$__runId-feature-verification.status"; exit 0
 
   - id: done
     description: Terminal — repo-wide checks passed and the receipt is bound.

package/config/workflows/task-lifecycle.yaml

@@ -64,6 +64,11 @@ states:
       Completed. Re-enterable (reopen with warning + mandatory History entry).
   - id: cancelled
     description: Terminal — abandoned.
+  - id: deprecated
+    description: >
+      Retained and frozen (ADR-137). Non-terminal: the record stays readable and
+      countable, nothing new may attach to it, and leaving it is explicit —
+      un-deprecate to todo, or cancelled once the task is removed.
 
 transitions:
   # Forward path: backlog → todo → wip → testing → done
@@ -157,3 +162,48 @@ transitions:
     description: Cancel task
     guard:
       kind: always
+
+  # Deprecate: any non-terminal-or-done state → deprecated (frozen, retained — ADR-137)
+  - from: backlog
+    to: deprecated
+    description: Deprecate task (frozen, retained)
+    guard:
+      kind: always
+  - from: todo
+    to: deprecated
+    description: Deprecate task (frozen, retained)
+    guard:
+      kind: always
+  - from: wip
+    to: deprecated
+    description: Deprecate task (frozen, retained)
+    guard:
+      kind: always
+  - from: testing
+    to: deprecated
+    description: Deprecate task (frozen, retained)
+    guard:
+      kind: always
+  - from: blocked
+    to: deprecated
+    description: Deprecate task (frozen, retained)
+    guard:
+      kind: always
+  - from: done
+    to: deprecated
+    description: Deprecate task (frozen, retained)
+    guard:
+      kind: always
+
+  # Exits out of deprecated: un-deprecate or remove only. Any other edge is
+  # undeclared and refused by the graph (ADR-135).
+  - from: deprecated
+    to: todo
+    description: Un-deprecate (mandatory History entry)
+    guard:
+      kind: always
+  - from: deprecated
+    to: cancelled
+    description: Remove deprecated task
+    guard:
+      kind: always

package/config/workflows/task-pipeline.yaml

@@ -19,14 +19,6 @@
 # done guard closed, and re-records Testing before the failed edge); done settles
 # deferrals; failed renders the recovery report. No new state, edge, or model query.
 #
-# Confidence gate (session finding after 1088, task 1068 follow-up): the verify answer has
-# carried a `Confidence: HIGH|MEDIUM|LOW` line since 1068, and nothing read it — a PASS at
-# LOW confidence certified exactly like HIGH. The verify stamp now records a `confidence`
-# check row, and BOTH completion guards (verify → record, record → done) refuse a LOW (or
-# absent) level unless the run was launched with `--vars '{"ackLowConfidence":"true"}'`.
-# The acknowledgement is an operator decision, not a model one: it is the only way to
-# certify a verdict the verifier itself would not stand behind.
-#
 # Review-failure routing (session finding after 1088): `review` had no outgoing edge for a
 # FAIL verdict, so a failing review could only be remediated by driving the graph by hand
 # (re-entering `test` and hand-emitting rows). The review stage now derives
@@ -51,9 +43,8 @@ kind: state-machine
 name: task-pipeline
 # 0772 R2: explicit identity tag. Set only after the proof failure-path tests
 # passed; the engine treats unversioned external definitions as supported.
-# v4 (session finding after 1088): the completion gate reads the verifier's confidence level and
-# the graph routes a non-PASS review into bounded remediation — both are contract changes, so the
-# identity moves with them.
+# v4 (session finding after 1088): the graph routes a non-PASS review into bounded remediation —
+# a contract change, so the identity moves with it (the confidence half of v4 was retired at v7).
 # v5 (task 1077's inline run, 2026-10-06): the verify verdict action is explicitly `onError:
 # continue`. `task verdict` exits non-zero on any non-PASS verdict BY DESIGN (1003 R2) — that is
 # data for the verify guards, not a state failure. Under the engine's default 'fail' policy
@@ -63,14 +54,13 @@ name: task-pipeline
 # UNREACHABLE: a non-PASS verify could only end the run failed. `test-fix` also gained the
 # review-lane evidence projection (see its onEnter) so the repair hop is not fed an empty findings
 # list when the failing hop was `review-fail-triage` rather than the quality gate.
-# v6 (task 1134 run, 2026-10-09): the `confidence` check row now encodes the SAME policy as the two
-# completion guards instead of a stricter one of its own. It warned for every level below HIGH, so a
-# MEDIUM certification was admitted by both guards but recomputed as PARTIAL by the CLI done gate —
-# the artifact was self-inconsistent and `done` was refused with no named level to act on. The row
-# now warns only for an unacknowledged LOW (or absent) level, which is exactly what the guards
-# refuse; `packages/app/tests/workflow/task-pipeline-proof-chain.test.ts` pins the agreement for
-# HIGH/MEDIUM/LOW/absent × ack.
-version: "6"
+# v7 (task 1207, F511): the asserted `Confidence: HIGH|MEDIUM|LOW` machinery is retired — the
+# verifier's and reviewer's self-graded levels (re-imported from the cc anti-hallucination skill
+# by task 1068) are no longer written, checked, or gated on; spur certifies on deterministic
+# evidence (rows MET, proof digests, findings dispositioned). The `confidence` check row, the
+# `ackLowConfidence` var, and the guards' LOW/absent clauses are gone; the derived
+# feature-receipt confidence (ADR-131/1196) is a different family and stays.
+version: "7"
 description: "Standard task pipeline: precheck → implement → quality-gate (test/fix/recheck) → review → approve → verify → record → done"
 # Task entity lifecycle (owned by task-lifecycle.yaml):
 #   normal: backlog → todo → wip → testing → done
@@ -195,14 +185,6 @@ vars:
     # Escalation counter: .spur/run/<wbs>-escalation-count. Default 2 = two answered
     # questions; a third pause routes to failed with a report note.
     maxEscalations: "2"
-    # Operator acknowledgement of a LOW-confidence certification (session finding after 1088).
-    # The verify answer's `Confidence:` line is captured into the verdict artifact; a LOW (or
-    # absent) level fails the completion guards unless this is "true", because a PASS the
-    # verifier would not stand behind is an operator risk decision, not a mechanical one.
-    # Set per run: `--vars '{"ackLowConfidence":"true"}'` (and export it on the inline path).
-    # Deliberately NOT settable from the task file or the verifier's own answer: the point is
-    # that a second party, not the producer, accepts the residual uncertainty.
-    ackLowConfidence: ""
     # Runtime-written, 0933: the escalate hop's file.read.into-var fills this from
     # .spur/run/<wbs>-question.md; the hitl.input prompt below references it. Declared
     # here (empty) so the static var-reference validator sees the template source.
@@ -897,20 +879,6 @@ states:
             onError: continue
             options:
                 command: "$spurBin task verdict $wbs --from-answer .spur/run/$wbs-verify-answer.txt"
-          # Session finding after 1088: the verifier's confidence level becomes a `confidence` check
-          # row and a gate-log line, so the level the completion guards enforce is visible in the
-          # artifact and the log — not only in the answer file. v6 (task 1134 run): the row warns for
-          # an unacknowledged LOW/absent level ONLY, matching the guards' ack rule; warning for
-          # MEDIUM too made an admitted certification aggregate to PARTIAL (self-inconsistent artifact,
-          # done refused). This is its own action because the proof-binding stamp below must stay the
-          # state's LAST action AND under the ADR-115 800-char shell cap.
-          - kind: shell
-            options:
-                command: >-
-                    V=".spur/run/$wbs-verdict.json"; [ -f "$V" ] || exit 0;
-                    jq --arg ack "$ackLowConfidence" '. + {checks: (((.checks // []) | map(select(.name != "confidence"))) + [{name: "confidence", status: (if ((.confidence // "LOW") != "LOW" or $ack == "true") then "pass" else "warn" end), evidence: ((.confidence // "LOW (absent from artifact)") + (if $ack == "true" then " (operator-acknowledged)" else "" end))}])}' "$V" > "$V.tmp" && mv "$V.tmp" "$V";
-                    printf 'confidence: %s (ack=%s)\n' "$(jq -r '.confidence // "LOW (absent)"' "$V")" "$ackLowConfidence" >> ".spur/run/$wbs-test-gate.log";
-                    exit 0
           # (e) one jq mutation binds the verdict to the proof digest (0703 R3; runId 0730 §B.2 /
           # 0757 R4; definitionDigest 0759 R5; honest review stamp 0785 R4; soft action + hard guard).
           - kind: shell
@@ -1312,11 +1280,15 @@ transitions:
     # re-enters quality → review → verify on a fresh digest. Before 1088 a FAIL review had no
     # outgoing edge at all; before 1122 a PASS-with-findings cost a full re-certification cycle per
     # attempt (knowledge-kit 0210/0213). The reviewer writes `Verdict: PASS|FAIL` in its answer;
-    # both plain and bold forms are accepted. Under `profile=auto` the approve gate is skipped, so
-    # the PASS+auto edge is tried first and the interactive PASS edge second.
+    # both plain and bold forms are accepted. (F511: the v4-era PASS confidence grading — the
+    # reviewer's self-stated HIGH/MEDIUM/LOW level and its `ackLowConfidence` escape hatch — was
+    # retired; a PASS with no open P1-P3 finding is what the gate reads.) Review stays advisory:
+    # verify certifies.
+    # Under `profile=auto` the approve gate is skipped, so the PASS+auto edge is tried first and the
+    # interactive PASS edge second.
     - from: review
       to: verify
-      description: profile=auto, the review certified PASS, and no open P1-P3 review finding — skip the human approval gate.
+      description: profile=auto, the review certified a PASS with no open P1-P3 finding — skip the human approval gate.
       guard:
           kind: shell
           options:
@@ -1327,7 +1299,7 @@ transitions:
                   [ -f "$S" ] && "$RUNNER" "$S" review-gate "$wbs" --spur-bin "$spurBin" >&2
     - from: review
       to: approve
-      description: Review certified PASS with no open P1-P3 review finding — gate on human approval before verification.
+      description: Review certified a PASS with no open P1-P3 finding — gate on human approval before verification.
       guard:
           kind: shell
           options:
@@ -1339,8 +1311,8 @@ transitions:
       to: review-fail-triage
       description: >-
           No certified PASS without an open P1-P3 finding (FAIL, PARTIAL, missing, unparseable, or
-          a PASS whose review-gate check found an open P1-P3 row — fail closed) — classify the
-          failure and route it into the bounded repair hop instead of dead-ending the run.
+          a PASS whose review-gate check found an open P1-P3 row; fail closed) —
+          classify the failure and route it into the bounded repair hop instead of dead-ending the run.
       guard:
           kind: always
 
@@ -1377,23 +1349,21 @@ transitions:
     # The verify step emits .spur/run/<wbs>-verdict.json with a required proof block (task 0703 R3/R5).
     # Only `verdict: PASS` PLUS a proof block whose digest — top level and every named stage — equals
     # the captured `proofDigest` clears the gate to `record`; any non-PASS, a missing file, malformed
-    # JSON, or missing/mismatched proof evidence does not. The verifier's confidence level is part of
-    # that certification (session finding after 1088): a PASS the verifier itself marked LOW — or left
-    # unstated — clears the gate only when the operator accepted it with
-    # `--vars '{"ackLowConfidence":"true"}'`. Declaration order: PASS+proof guard FIRST,
-    # then the bounded remediation route (R4), then the always catch-all so a PASS verdict with a
-    # missing/malformed proof block still terminates at `failed` instead of hanging the state.
+    # JSON, or missing/mismatched proof evidence does not. (F511: the v4-era LOW/absent-confidence
+    # clause and its `ackLowConfidence` escape hatch were retired.) Declaration order: PASS+proof
+    # guard FIRST, then the bounded remediation route (R4), then the always catch-all so a PASS
+    # verdict with a missing/malformed proof block still terminates at `failed` instead of hanging
+    # the state.
     - from: verify
       to: record
-      description: Verification verdict is PASS, its proof block names the captured digest on every stage, and any LOW confidence was operator-acknowledged — record results and proceed to done.
+      description: Verification verdict is PASS and its proof block names the captured digest on every stage — record results and proceed to done.
       guard:
           # (one jq -e predicate) PASS verdict; proof, quality-gate, review and verification digests
-          # equal to proofDigest; review completed; matching run id and definition digest (0703 R5, 0785 R4);
-          # confidence HIGH/MEDIUM, or LOW/absent with the operator's ack (session finding after 1088).
+          # equal to proofDigest; review completed; matching run id and definition digest (0703 R5, 0785 R4).
           kind: shell
           options:
               command: >-
-                  jq -e --arg d "$proofDigest" --arg r "$__runId" --arg dd "$__definitionDigest" --arg ack "$ackLowConfidence" '
+                  jq -e --arg d "$proofDigest" --arg r "$__runId" --arg dd "$__definitionDigest" '
                   .verdict == "PASS"
                   and (.proof.digest // "") == $d
                   and (.proof.stages.qualityGate.digest // "") == $d
@@ -1402,7 +1372,6 @@ transitions:
                   and (.proof.stages.verification.digest // "") == $d
                   and (.proof.runId // "") == $r
                   and (.proof.definitionDigest // "") == $dd
-                  and ((.confidence // "LOW") != "LOW" or $ack == "true")
                   ' ".spur/run/$wbs-verdict.json" >/dev/null 2>&1
     - from: verify
       to: test-fix
@@ -1430,12 +1399,10 @@ transitions:
     # ── done gate: record → done/failed gated on `spur task check` (ADR-026 amendment 2026-06-23)
     # PLUS the proof-block re-assertion (task 0703 R5): the verdict artifact must still be PASS and
     # still name the captured digest — a forged or mutated completion artifact fails closed here.
-    # PLUS the confidence re-assertion (session finding after 1088): the same ack rule as verify →
-    # record, re-read from the artifact so a mutation between the two boundaries cannot slip through.
     # Declaration order: pass guard first.
     - from: record
       to: done
-      description: Task check passed, the verdict proof block still names the captured digest, and any LOW confidence was acknowledged — certify done.
+      description: Task check passed and the verdict proof block still names the captured digest — certify done.
       guard:
           kind: shell
           options:
@@ -1445,14 +1412,13 @@ transitions:
               # comments inside the folded scalar: `>-` joins same-indent lines into
               # one shell line.
               # Two logical commands, deliberately (ADR-115): the `task check` projection plus
-              # ONE jq predicate re-asserting the whole completion contract — PASS verdict, the
-              # captured proof digest, and the confidence rule (session finding after 1088).
+              # ONE jq predicate re-asserting the whole completion contract — PASS verdict and the
+              # captured proof digest.
               command: >-
                   $spurBin task check $wbs --as done &&
-                  jq -e --arg p "$proofDigest" --arg ack "$ackLowConfidence" '
+                  jq -e --arg p "$proofDigest" '
                   .verdict == "PASS"
                   and ((.proof.digest // "") == $p)
-                  and ((.confidence // "LOW") != "LOW" or $ack == "true")
                   ' ".spur/run/$wbs-verdict.json" >/dev/null 2>&1
     - from: record
       to: failed

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.4.3",
+    "version": "0.4.5",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",
@@ -57,15 +57,15 @@
     },
     "devDependencies": {
         "@commander-js/extra-typings": "^14.0.0",
-        "@gobing-ai/ts-db": "^0.5.24",
-        "@gobing-ai/ts-ai-runner": "^0.5.24",
-        "@gobing-ai/ts-dual-workflow-engine": "^0.5.24",
-        "@gobing-ai/ts-infra": "^0.5.24",
-        "@gobing-ai/ts-llm-jsonl-importer": "^0.5.24",
-        "@gobing-ai/ts-rule-engine": "^0.5.24",
-        "@gobing-ai/ts-runtime": "^0.5.24",
-        "@gobing-ai/ts-utils": "^0.5.24",
-        "@types/bun": "1.3.14",
+        "@gobing-ai/ts-db": "^0.5.28",
+        "@gobing-ai/ts-ai-runner": "^0.5.28",
+        "@gobing-ai/ts-dual-workflow-engine": "^0.5.28",
+        "@gobing-ai/ts-infra": "^0.5.28",
+        "@gobing-ai/ts-llm-jsonl-importer": "^0.5.28",
+        "@gobing-ai/ts-rule-engine": "^0.5.28",
+        "@gobing-ai/ts-runtime": "^0.5.28",
+        "@gobing-ai/ts-utils": "^0.5.28",
+        "@types/bun": "1.4.3",
         "@types/figlet": "^1.7.0",
         "@types/node-notifier": "8.0.5",
         "commander": "^14.0.3",

package/plugins/sp/agents/super-reviewer.md

@@ -200,7 +200,6 @@ shallower.
 **Scope:** <wbs diff | path glob>
 **Dimensions:** functional, security, efficiency, correctness, usability, architecture
 **Verdict:** PASS | PARTIAL | FAIL
-**Confidence:** HIGH | MEDIUM | LOW
 ##### Findings (ranked)
 
 | # | Priority | Dimension | Finding | Location | Disposition |
@@ -226,27 +225,14 @@ FAIL, PARTIAL, a missing line, a line split across two lines — routes the run
 `review-fail-triage` and its bounded repair hop. Keep it on one line, in that shape, in every
 review answer; never restate it as prose only.
 
-**The Confidence line is machine-read too (one confidence contract, 2026-10-12).** Every review
-report carries exactly one `Confidence: HIGH | MEDIUM | LOW` line, stated at the level the review can
-actually defend — the same enum and the same earning rule the verify answer uses
-([verdict-schema.md](../skills/code-verification/references/verdict-schema.md) § Confidence level):
-
-- `HIGH` — every requirement row is `MET`, every finding carries a disposition, and the report cites
-  its evidence. `HIGH` says the evidence needs no re-check.
-- `MEDIUM` — the verdict holds but evidence gaps remain; name them.
-- `LOW` — the verdict rests on unverified assumptions that could plausibly flip it; name them.
-
-A missing line, a level outside the enum, or a `HIGH` the rows do not earn turns an otherwise usable
-PASS into a refused one: consumer repositories gate the review answer artifact and every level it
-claims, exactly as they gate the verify answer. This is a contract change — review answers written
-before it were never asked for a level, so pre-adoption artifacts read as debt, not defects.
-
-**Machine-checked at the gate.** The pipeline's own review PASS edges enforce the line before verify:
-`residual-scan review-gate` reads the recorded `### Review` body, and a missing, duplicated or
-out-of-enum level becomes a **blocking** `review-contract` item — `review → verify` stops and the run
-enters `review-fail-triage` with the bounded repair hop, exactly as an open P1–P3 row does. The gate
-checks presence and vocabulary only: whether a level is *earned* stays a judgement call (see the
-earning rule above), so the report must still argue it.
+**No confidence line (F511, task 1207).** Review reports do not state, and no gate reads, an
+asserted `Confidence: HIGH | MEDIUM | LOW`. A model that can write a PASS can write `HIGH`, so the
+gate grades what is checkable instead: the recorded section's presence and vocabulary, and the
+findings disposition — an open P1–P3 row blocks the edge exactly as before. What a reviewer would
+formerly have compressed into a level belongs in the report body: name the evidence gaps and the
+assumptions explicitly, so a reader can re-check them. (The derived confidence family is
+untouched: feature-verification receipts under ADR-131, the decision subsystem threshold, and
+history-anatomy reading.)
 
 **Source citations for external claims (one claim contract, 2026-10-12).** A Finding cell or a
 Functional Traceability `Evidence` cell that asserts an external API/library claim carries a
@@ -257,8 +243,9 @@ answer's rule verbatim, owned by
 for external claims — claim markers and accepted forms are defined once there and are not restated
 here. The findings table's `Location` column does not stand in for it: `Location` anchors the
 finding's subject, not the claim's source. Cell-free receipts (test counts, reviewed-log notes)
-assert no external claim and need no citation. An uncited external claim is an assumption, so it
-caps the level the report can defend (above).
+assert no external claim and need no citation. An uncited external claim is an assumption: name it
+as an explicit gap in the report body (above), so a reader can re-check it.
+
 
 **Machine-checked at the gate (findings table).** `residual-scan review-gate` applies the same two
 predicates to every finding row: a Finding cell carrying one of the verify lint's claim markers with

package/plugins/sp/commands/dev-changelog.md

@@ -26,5 +26,5 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 ## Implementation
 
-Follow the inline procedure in [dev-operations.md](../skills/spur-dev/references/dev-operations.md#8-changelog) (changelog). This is a docs-only generator: run no quality gates (lint, tests, `spur-check`, rules, citation checks).
+Follow the inline procedure in [dev-operations.md](../skills/spur-dev/references/dev-operations.md#8-changelog) (changelog). This is a docs-only generator: run no quality gates (`bun run gate`, lint, typecheck, tests, `spur-check`, rules, citation checks) — a generic "verify before finishing" rule does not apply here.
 

package/plugins/sp/commands/dev-gitmsg.md

@@ -1,7 +1,7 @@
 ---
 description: Generate conventional commit message(s) from the current change set via one bounded gather call, optionally commit
 role: scribe
-argument-hint: "[--commit] [--squash] [--all] [--scope <path>]"
+argument-hint: "[--commit] [--squash] [--all] [--scope <path>] [--check <cmd>]"
 allowed-tools: ["Bash", "Read"]
 ---
 
@@ -17,12 +17,13 @@ Implements an inline procedure — see [dev-operations.md](../skills/spur-dev/re
 | `--squash` | Collapse every concern into one message and one commit; implies `--commit`. | off |
 | `--all` | Widen the change set past the index to every change in the tree — unstaged **and untracked**. | off |
 | `--scope` `<path>` | Path filter on the change set; always wins over change-set auto-discovery. | the whole change set |
+| `--check` `<cmd>` | Run `<cmd>` (e.g. `"bun run gate"`) once before committing; non-zero → commit nothing. | off |
 
 For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag-glossary.md).
 
 ## Usage
 
-/sp:dev-gitmsg [--commit] [--squash] [--all] [--scope <path>]
+/sp:dev-gitmsg [--commit] [--squash] [--all] [--scope <path>] [--check <cmd>]
 
 ## Implementation
 
@@ -35,3 +36,6 @@ commit per concern, split automatically, so the operator is never asked to re-st
 `--squash` → one commit for everything. An empty index widens to the whole tree only on a
 message-only run, and says so; a committing run stops there and prints the exact `--all` re-run line
 instead of guessing.
+No quality gate (`bun run gate`, lint, typecheck, tests, `spur-check`) runs unless `--check <cmd>`
+names one — then it runs once, before any commit, and a failure commits nothing. Gate → auto-fix →
+commit is `/sp:dev-gtd --no-push`.

package/plugins/sp/commands/dev-handover.md

@@ -24,4 +24,5 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 ## Implementation
 
 Follow the inline procedure in [dev-operations.md](../skills/spur-dev/references/dev-operations.md#11-handover) (handover).
+Run no quality gate (`bun run gate`, lint, typecheck, tests, `spur-check`); cite results already on record.
 

package/plugins/sp/commands/dev-job-dump.md

@@ -24,6 +24,7 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 ## Implementation
 
 Follow [job-dump](../skills/spur-dev/references/dev-operations.md#11a-job-dump), using the shared
-handoff template to capture the current job and its remaining work.
+handoff template to capture the current job and its remaining work. Run no quality gate
+(`bun run gate`, lint, typecheck, tests, `spur-check`); copy existing gate results or write `not run`.
 
 Skill(skill="sp:spur-dev", args="job-dump $ARGUMENTS")

package/plugins/sp/commands/dev-refine.md

@@ -18,6 +18,14 @@ Wraps the **sp:spur-dev** skill. Three jobs:
 `standard` checks only that target sections are structurally complete. It never re-checks what
 they say. Use `ready` whenever the existing content itself is in doubt.
 
+**Refine never writes `feature_id`.** It may *report* an orphan task in its result, but linking a
+task to a feature is an operator decision with a lifecycle blast radius: `spur task update <wbs>
+--feature <id>` reopens a `verifying` parent unless `--no-reopen` is passed. Route linking through
+the opt-in [feature-link helper](../skills/spur-dev/references/feature-link-helper.md) (never
+gate-time, never automatic, always confirmed) — observed 2026-10-13: the ready-preparation refine
+that `spur task create` dispatches by default linked a fresh task to `P1` on its own and demoted
+that feature `verifying → active`.
+
 ## Argument Flags
 
 | Flag | Description | Default |
@@ -47,9 +55,13 @@ implement without inventing design:
 1. Audit every existing claim against the current tree: facts, cited sources, fix soundness across
    all callers, test observability, environment, concurrent work, and scope.
 2. Correct what is wrong and record each change in a dated `**Refine corrections (<date>)**` block
-   in Background.
+   in Background. When the task bundles several issues, triage each one. An issue that is invalid,
+   already fixed or owned elsewhere is removed together with its R-items, Design/Solution notes,
+   Plan steps and ACs. If no issue stays valid, cancel the task (`spur task update <wbs> cancelled`)
+   and report `cancelled` instead of promoting it.
 3. Run `spur task check <wbs> --as todo --json`, fill unset priority/estimate, and promote
-   `backlog → todo`.
+   `backlog → todo`. If triage dropped issues, re-estimate and record old → new. Also record a
+   title that still names dropped scope; the CLI cannot rename a task.
 4. Report checklist rows `{id, pass, evidence}`.
 
 Refine targets `backlog`/`todo` tasks; a `wip`-or-later task needs explicit operator consent and is

package/plugins/sp/commands/dev-refineall.md

@@ -54,7 +54,13 @@ not a bug.
 **Depth:** default `standard` keeps the cheap L3 SKIP gate under `--auto`. Use
 `--depth ready` when handing a feature to another implementer (frozen Design/Requirements/Plan),
 or when the tasks' existing content is in doubt; thread `--depth` into each per-task refine. Ready
-report rows add corrections count, status before → after, and failed checklist ids.
+report rows add corrections count, dropped issues, status before → after, and failed checklist ids.
+Each task's issues are triaged one by one: invalid ones are dropped with their fixes, and a task
+with no valid issue left is `cancelled`. The ready report also proposes merges between overlapping
+tasks, ordering or a shared step for complementary ones, and owning features for tasks without a
+`feature_id`. It executes neither unless
+`--description` names the task and action, for example
+`--description "cancel 0273 and merge its issues into 0269; link 0260 and 0274 to G11"`.
 
 > **`--next` dropped** (feature H8, 2026-07-31). Batch-level chaining was a token bomb — each refine
 > hop is an LLM call, and a large feature means N refine chains fanned out at once. For batch