@gobing-ai/spur 0.4.31 → 0.4.34

package/config/workflows/task-pipeline.yaml

@@ -25,7 +25,7 @@
 # captures and compares, digest-bound receipt preconditions, `run.artifact` verdict
 # registration and the `verifiedOutcome` it fed — is gone; a PASS receipt is reused while
 # the tree hash holds and invalidated when the tree moves. `done` closes on the verb's own
-# target-aware `task check` plus the residual sweep, not on a re-asserted digest.
+# target-aware `task check`, not on a re-asserted digest.
 #
 # No operator pause lives in this file (D65 R10): the only pause is the host executor's
 # `agent.run` transform (1232). `escalate` asks its question through the responder and the
@@ -131,9 +131,9 @@ vars:
     # Project quality gate for the `gate` hop, overridable per project:
     # `--vars '{"qualityGateCmd":"bun run lint && bun run test"}'`.
     # INVARIANT (ADR-124, clarified 2026-10-07 by task 1111 R5): only the FULL tier writes PASS.
-    # Under the opt-in `deferQualityGate` policy the per-task token is DEFERRED (light tier) and
-    # the "review runs only after a green full gate" invariant moves to BATCH scope — nothing is
-    # reported PASS without the integrated full gate on the base ref.
+    # Under the default incremental policy (`deferQualityGate`) the per-task token is DEFERRED and
+    # the "green full gate" invariant lives at FEATURE/BATCH scope (`spur feature verify`, the
+    # batch integration gate) — nothing is reported PASS without the full gate.
     # TRUSTED CONFIG ONLY — `spur task gate` passes this to the project's gate command. Never
     # interpolate untrusted operator/LLM input into qualityGateCmd (task 0436 SECUA residual).
     # The gate observes, it does not mutate: `implement` already ran `$formatCmd` on its way out,
@@ -172,19 +172,15 @@ vars:
     # anchors directly in the /sp:dev-fixall input, so the fix agent starts AT the failing
     # file:line instead of re-deriving it from a fresh gate run (0482 R3).
     gateFindings: ""
-    # 1319 R5: lint findings from the previous review visit, echoed into the review prompt on the
-    # inline retry. Empty on the happy path, so the prompt pays nothing when nothing is wrong.
-    reviewLint: ""
     # The quality-gate mode this visit runs — `run` on the first gate visit of the run,
     # `recheck` after a remediation hop, `deferred` under the opt-in batch policy. Written by
     # the gate's own shell and projected into this var (args cannot branch) — D65 1239 R2.
     gateMode: ""
-    # Review depth resolved from the lane decision (0943 R1/R2): `functional` for the fast
+    # Review depth resolved from the diffstat lane (0943 R1/R2): `functional` for the fast
     # lane (requirement/AC traceability only — the reviewer's R → file:line table is what
     # certifies, so the fast lane never drops the evidence), `all` for every other lane.
     reviewFocus: ""
-    # Task spec path resolved at `gate` entry (also the decide evidence for the review-lane
-    # routing). `docs/tasks*` is a versioned input, not a run artifact.
+    # Task spec path resolved at `gate` entry. `docs/tasks*` is a versioned input, not a run artifact.
     taskSpecPath: ""
     # 0710 R4: task priority tier (P0..P4) extracted from the task frontmatter at `gate`
     # entry. P0/P1 make the review distinct-executor policy apply; unknown/empty priority
@@ -196,13 +192,14 @@ vars:
     # (default) = on; set to "off" to bypass:
     # `--vars '{"implementScopeGuard":"off"}'`.
     implementScopeGuard: ""
-    # 1111 R1: opt-in parallel-batch gate policy. When "true", `gate` runs the LIGHT tier for
-    # per-task early feedback and writes `DEFERRED` (light PASS) or `FAIL` to
-    # `.spur/run/<wbs>-test-gate.status` — never `PASS`, because that token means the full
-    # project gate ran green on this tree. The batch orchestrator owes ONE integrated full gate
-    # on the base ref over the merged slices (1111 R3). Default "false" = unchanged behavior,
-    # and a stray `DEFERRED` file fails the guards.
-    deferQualityGate: "false"
+    # Gate mode. "true" (default) = INCREMENTAL: `gate` runs lint, rules, typecheck of the touched
+    # workspaces and their dependents, the related tests, and the per-file coverage floor on the
+    # changed files, then writes `DEFERRED` or `FAIL` to `.spur/run/<wbs>-test-gate.status` —
+    # never `PASS`, because that token means the full project gate ran green on this tree. The
+    # full gate runs once per feature (`spur feature verify`) or batch (integration gate).
+    # "false" = FULL: every task pays the whole project gate; a stray `DEFERRED` fails the guards.
+    # `--vars '{"deferQualityGate":"false"}'`.
+    deferQualityGate: "true"
     # 0931 R5: parallel batches defer the per-task feature sync so a task branch never
     # touches feature files or docs/features/INDEX.md. When "true", the close's post-record
     # shell appends a deferral note and skips the sync; the parallel batch orchestrator runs
@@ -222,8 +219,7 @@ states:
       onEnter:
           # (e) git-status hygiene advisory; never fails the run (0487 R6 / 0511 R1). 1007 R3:
           # the F96 base-sha capture (0950) merged into this shell — original commands in order,
-          # then the one-time base commit capture; a resumed run keeps its original base so
-          # residual scans stay anchored to the same diff.
+          # then the one-time base commit capture; a resumed run keeps its original base.
           - kind: shell
             options:
                 command: >-
@@ -357,15 +353,6 @@ states:
                 resultFile: .spur/run/${vars.__runId}-implement-format.status
                 softFail: true
                 timeoutMs: "${vars.stepTimeoutMs}"
-          # 1109 R3: qualify this task's unique basename anchors to repo-relative paths.
-          # Placement is load-bearing: it runs AFTER implement's mutations (and the format
-          # above) and BEFORE the gate reads the tree, so the receipt is keyed to the final
-          # tree. `--wbs` scopes the pass to this task's resolved file.
-          # Non-fatal (`; exit 0`): the done gate still reports anything left. Scope
-          # contract: task 1109 R5.
-          - kind: shell
-            options:
-                command: "$spurBin task migrate-anchors --wbs $wbs --json ; exit 0"
 
     # ── escalate hop (operator-question pause, 0933) ──────────────────────────
     # The implement agent paused on an operator question: it wrote
@@ -417,11 +404,10 @@ states:
     # attempt counter and consults the tree-hash receipt), `recheck` after a remediation hop
     # (probe-then-full), `deferred` under the opt-in batch policy.
     #
-    # The three former routing states are decision CALLS here and in `review` (D65 1239 R1):
-    # the lane decision (0943 R1/R2, catalog `task-semantic-risk`, 1262 R5) picks the review depth, and the
-    # gate's own failure class (catalog `failure-class`) drives the red-gate transitions.
-    # Both run unconditionally — the engine has no onEnter conditionals — and both degrade to
-    # their catalog fallback with no model call while `workflows.decideDecisionMaker` is off.
+    # The review lane is resolved deterministically from the diffstat (no model call); the
+    # gate's own failure class (catalog `failure-class`) drives the red-gate transitions and
+    # degrades to its catalog fallback with no model call while
+    # `workflows.decideDecisionMaker` is off.
     - id: gate
       display:
           phase: test
@@ -429,15 +415,14 @@ states:
           title: Run quality gate
       description: >
           Typed quality gate: resolve the task path/priority, produce the diffstat lane
-          evidence, consult `task-semantic-risk` for the review depth (deterministic safety floor
-          first), run `${vars.qualityGateCmd}` through `spur task gate <wbs> <mode>` under the
+          evidence, resolve the review depth from it deterministically, run `${vars.qualityGateCmd}` through `spur task gate <wbs> <mode>` under the
           host-wide lock (tree-hash receipt reuse on the same tree), then classify a red gate
           through `failure-class`. Writes the typed outcome to
           `.spur/run/<runId>-gate.status` and the gate's own token to
           `.spur/run/<wbs>-test-gate.status`; always a recorded outcome, never a state failure.
       onEnter:
           # (e) task path + priority resolution; fail-closed on an unresolvable spec (0751 R2,
-          # 0710 R4). The path is the decide evidence for the review lane and the priority is
+          # 0710 R4). The path is the review's task spec and the priority is
           # the review/executor distinctness input (0710 R4) — both are consumed downstream, so
           # an unresolved path fails here instead of degrading the run silently.
           - kind: shell
@@ -459,39 +444,19 @@ states:
             options:
                 command: >-
                     $spurBin task diffstat "$wbs" --no-logo || { echo "task-diffstat failed closed — spur task diffstat exited $?" >&2; printf '{"files":0,"insertions":0,"deletions":0,"paths":[],"sensitive":true}\n' > ".spur/run/$wbs-diffstat.json"; }; exit 0
-          # (b)+(c) lane pre-guard BEFORE the decide: a caller-set mode is projected verbatim
-          # (R2b); a sensitive path or >400 changed lines pins safety (R2c) and the decide
-          # result is never consulted. A missing/malformed diffstat row pins safety HERE: an
-          # empty mode file would let the low decide row project the fast lane downstream, so
-          # the "never to fast" fail-safe is enforced at the guard, not by the projection.
+          # (b)+(c) deterministic lane: a caller-set mode is projected verbatim (R2b); a
+          # sensitive path or >400 changed lines pins safety (R2c); a change set touching only
+          # docs and tests takes the fast lane; everything else stays empty → standard review.
+          # A missing/malformed diffstat row pins safety — never fast. No model call.
           - kind: shell
             options:
                 command: >-
-                    mkdir -p .spur/run; if [ -n "$mode" ]; then printf '%s\n' "$mode" > ".spur/run/$wbs-mode.txt"; exit 0; fi; DF=".spur/run/$wbs-diffstat.json"; if ! jq -e 'type == "object"' "$DF" >/dev/null 2>&1; then printf 'safety\n' > ".spur/run/$wbs-mode.txt"; exit 0; fi; jq -r 'if .sensitive == true or ((.insertions // 0) + (.deletions // 0)) > 400 then "safety" else empty end' "$DF" 2>/dev/null > ".spur/run/$wbs-mode.txt"; exit 0
-          # (d) lane decision (1262 R5) — one narrow question: does this change set alter
-          # behaviour beyond its diffstat? `false` projects the fast lane; `true` or the catalog
-          # fallback projects standard. Degrades to that fallback with no model call whenever
-          # workflows.decideDecisionMaker is off (the bundled catalog owns question, criteria and
-          # fallback), and `skipWhenEvidenceEmpty` keeps a missing diffstat from costing a call.
-          - kind: decide
-            options:
-                id: task-semantic-risk
-                decision: task-semantic-risk
-                params:
-                    wbs: ${vars.wbs}
-                evidence:
-                    - .spur/run/${vars.wbs}-diffstat.json
-                    - ${vars.taskSpecPath}
-                skipWhenEvidenceEmpty: true
-                resultFile: .spur/run/${vars.wbs}-semantic-risk.decision
-          # (d) project the decision and append the route reason (1007 R3: the non-empty mode
-          # file is never overridden; the append keeps the failure signal of the original pair).
-          # `no` (a noul row stores the label, not a boolean) → fast lane; anything else (`yes`,
-          # degraded default, missing row) stays empty → the standard review path.
+                    mkdir -p .spur/run; if [ -n "$mode" ]; then printf '%s\n' "$mode" > ".spur/run/$wbs-mode.txt"; exit 0; fi; DF=".spur/run/$wbs-diffstat.json"; if ! jq -e 'type == "object"' "$DF" >/dev/null 2>&1; then printf 'safety\n' > ".spur/run/$wbs-mode.txt"; exit 0; fi; jq -r 'if .sensitive == true or ((.insertions // 0) + (.deletions // 0)) > 400 then "safety" elif ((.paths // []) | length) > 0 and ((.paths // []) | all(test("[.](md|mdx|txt)$|(^|/)tests?/|[.](test|spec)[.][cm]?[jt]sx?$"))) then "fast" else empty end' "$DF" 2>/dev/null > ".spur/run/$wbs-mode.txt"; exit 0
+          # (d) append the route reason for the resolved lane.
           - kind: shell
             options:
                 command: >-
-                    MF=".spur/run/$wbs-mode.txt"; [ -s "$MF" ] || jq -r 'if (.value == false or .value == "no") then "fast" else empty end' ".spur/run/$wbs-semantic-risk.decision" 2>/dev/null > "$MF"; m="$(cat "$MF")"; RUN_ID="$__runId"; [ -n "$RUN_ID" ] || RUN_ID="pipeline-$wbs"; mkdir -p .spur/memory; printf '%s %s %s\n' "$RUN_ID" "$wbs" "$(jq -rn --arg m "$m" --arg c "$mode" 'if $c != "" then ($c + ":caller-set") else {"fast":"fast:semantic-risk mechanical change","safety":"safety:deterministic-high","":"safety:standard lane"}[$m] // "safety:unrecognized mode" end')" >> .spur/memory/task-pipeline-routes.log
+                    m="$(cat ".spur/run/$wbs-mode.txt" 2>/dev/null)"; RUN_ID="$__runId"; [ -n "$RUN_ID" ] || RUN_ID="pipeline-$wbs"; mkdir -p .spur/memory; printf '%s %s %s\n' "$RUN_ID" "$wbs" "$(jq -rn --arg m "$m" --arg c "$mode" 'if $c != "" then ($c + ":caller-set") else {"fast":"fast:docs/tests-only change","safety":"safety:deterministic-high","":"safety:standard lane"}[$m] // "safety:unrecognized mode" end')" >> .spur/memory/task-pipeline-routes.log
           # (d) review depth from the resolved lane (D65 1239 R2): the fast lane reviews the
           # requirement/AC traceability only — that table is the certification input, so the
           # cheap lane never drops the evidence, it drops the SECUA/architecture passes.
@@ -593,14 +558,11 @@ states:
             options:
                 command: >-
                     TASK_POLICY=$($spurBin task show "$wbs" --json | jq -er '.frontmatter.mutationPolicy // ([.content | scan("(?m)^mutationPolicy:[ \t]*([^ \r\n]+)[ \t]*$") | .[0]] | if length == 0 then "code" elif length == 1 then .[0] else "ambiguous" end)') || exit 1; [ "$mutationPolicy:$TASK_POLICY" = "code:code" ] || { echo "remediate: mutation policy forbids automatic code repair (run=$mutationPolicy, task=$TASK_POLICY) — gate failure preserved, no agent dispatched" >&2; exit 1; }
-          # (e) attempt counter + residual artifact projection in one log append
-          # (1007 R3: the two appends merged — original commands in order, exit 0).
-          # (d) F96 R3 (0950): dev-fixall treats residual items as fix targets and may defer
-          # P3/markers to residual-deferrals.json; this carries the structured artifact too.
+          # (e) attempt counter.
           - kind: shell
             options:
                 command: >-
-                    printf '%s\n' "$(( $(cat ".spur/run/$wbs-test-fix-attempt" 2>/dev/null || echo 0) + 1 ))" > ".spur/run/$wbs-test-fix-attempt"; [ -f ".spur/run/$wbs-residuals.json" ] && echo '--- residual artifact (F96 fix targets; deferrals go to residual-deferrals.json, P3/markers only) ---' >> ".spur/run/$wbs-test-gate.log" && cat ".spur/run/$wbs-residuals.json" >> ".spur/run/$wbs-test-gate.log"; exit 0
+                    printf '%s\n' "$(( $(cat ".spur/run/$wbs-test-fix-attempt" 2>/dev/null || echo 0) + 1 ))" > ".spur/run/$wbs-test-fix-attempt"; exit 0
           # Review-lane input: a non-PASS review status routes into this same bounded repair hop
           # (1262 R6), but it stages no gate evidence — the fixer would receive a GREEN gate log
           # and an empty findings list. Project the reviewer's answer into the same log the other
@@ -645,11 +607,10 @@ states:
     # D65 1239 R2: `verify` merged into `review`. The reviewer's answer must carry the
     # requirement/AC traceability table (`| Req | Status | Evidence |`, evidence = `file:line`
     # or a named test/command) — sp:functional-review produces it and the answer contract owns
-    # the shape. `spur task verdict --from-answer` lints that answer, derives PASS/PARTIAL/FAIL
+    # the shape. `spur task verdict --from-answer` derives PASS/PARTIAL/FAIL
     # from the rows and writes the canonical `.spur/run/<wbs>-verdict.json` that `spur task
     # record` consumes for box flips and `## Testing`; a review whose rows do not resolve (an
-    # UNMET requirement, a missing row, a bad AC identity) cannot derive PASS. The review-gate
-    # residual check (1122) still blocks an open P1-P3 finding. Everything is folded into one
+    # UNMET requirement, a missing row, a bad AC identity) cannot derive PASS. Everything is folded into one
     # status token the transitions read, so a non-PASS review routes into the bounded repair
     # hop BEFORE `done` spends the close.
     - id: review
@@ -661,22 +622,8 @@ states:
           Three-dimensional code review via /sp:dev-review (functional requirements traceability
           + SECUA framework + architecture depth), findings written to `## Review`, then
           deterministic certification: `spur task verdict --from-answer` over the reviewer's
-          own traceability table, the review-gate residual check, and the operator/maker
-          approval decision point. Cost at this decision point (1122): open P1-P3 review
-          findings block `done`; only P4 rows and DEFER-ed P3 rows are wrap residuals.
+          own traceability table, and the operator/maker approval decision point.
       onEnter:
-          # 1319 R5(b)/Q9: surface the previous visit's verdict-lint findings for THIS visit's prompt.
-          # Empty on the first visit (and after a clean lint), capped so the prompt stays inside its
-          # composition budget, and it names the declared R/AC ids because the lint already does.
-          - kind: shell
-            options:
-                command: >-
-                    mkdir -p .spur/run; L=".spur/run/$wbs-verdict-lint.txt"; O=".spur/run/$__runId-review-lint.txt";
-                    if [ -s "$L" ]; then head -c 600 "$L" > "$O"; else : > "$O"; fi; exit 0
-          - kind: file.read.into-var
-            options:
-                path: .spur/run/${vars.__runId}-review-lint.txt
-                var: reviewLint
           - kind: agent.run
             options:
                 # 0710 R2: review always runs on a fresh session — no implementation-session
@@ -693,19 +640,12 @@ states:
                 # of the prompt. A report body ending with a `| WBS | Verdict | P1 | … |` summary and
                 # no per-requirement rows derives UNKNOWN and can never certify, which looped every
                 # run through review -> remediate.
-                # 1254: the review emits TWO artifacts with different consumers — the `## Review`
-                # section (finding dispositions, deriveReviewConfidence) and this captured answer
-                # (requirement/AC evidence, deriveVerifyConfidence). The prompt has to teach both
-                # lanes and the fact that a single `Confidence:` line may only carry the second one.
-                # 1254: the prompt stays inside the 1000-char composition cap — the full
-                # contract (tables, vocabularies, the two confidence lanes, AC identity vs
-                # feature credit) is owned by `plugins/sp/agents/super-reviewer.md` Output Format,
-                # which this pointer names.
+                # The prompt stays inside the 1000-char composition cap — the full contract
+                # (tables, vocabularies) is owned by `plugins/sp/agents/super-reviewer.md`
+                # Output Format, which this pointer names.
                 input: >-
                     /sp:dev-review --tasks ${vars.wbs} --auto --focus ${vars.reviewFocus}
-                    Answer contract: super-reviewer Output Format. Emit the machine-linted artifact, not a prose summary.
-                    `## Review`: deriveReviewConfidence. Captured answer (`spur task verdict`) has one `Confidence: HIGH|MEDIUM|LOW`
-                    line (deriveVerifyConfidence), never the section's disposition level.
+                    Answer contract: super-reviewer Output Format. Emit the verdict tables, not a prose summary.
                     End with one `Verdict: PASS|PARTIAL|FAIL` line after
                     `| Req | Status | Evidence |` (one row per requirement; MET | PARTIAL | UNMET) and
                     `| AC | Status | Evidence Type | Evidence |` (one row per AC; MET | PARTIAL | UNMET | N/A).
@@ -714,12 +654,11 @@ states:
                     a declared `AC-N` alias; a linked scenario covers its task; a task-local criterion needs no feature credit.
                     Open P1-P3 blocks completion.
                     Also write it to `.spur/run/${vars.__runId}-review-cert.md`.
-                    ${vars.reviewLint}
                 # The captured review answer is the run's certification input (and the
                 # `task verdict` input below): expectFile fails the step when no answer landed.
                 answerFile: .spur/run/${vars.__runId}-review-answer.txt
                 expectFile: .spur/run/${vars.__runId}-review-answer.txt
-                # The reviewer WRITES this one itself (see (c2)); declared so the composition lint can
+                # The reviewer WRITES this one itself (see (c2)); declared so the composition check can
                 # see the run path the prompt names (1233 R2).
                 inputs:
                     - path: .spur/run/${vars.__runId}-review-cert.md
@@ -737,51 +676,38 @@ states:
           # (c2) The reviewer is asked to WRITE its canonical artifact to `-review-cert.md`, because
           # the captured answer above is the agent's stdout: a reviewer that writes the artifact and
           # then narrates its summary has the artifact overwritten by the narration, and the verdict
-          # lint fails work that is actually complete (four such runs in the G74 batch, 2026-10-24).
+          # derivation fails work that is actually complete (four such runs in the G74 batch, 2026-10-24).
           # The agent-written cert wins; when it is absent or empty the captured answer is used, so
           # this is a strict widening of accepted inputs, never a new failure mode.
           - kind: shell
             options:
                 command: >-
                     A=".spur/run/$__runId-review-answer.txt"; C=".spur/run/$__runId-review-cert.md"; [ -s "$C" ] || cp "$A" "$C" 2>/dev/null; exit 0
-          # (d) `spur task verdict` owns the answer lint and the verdict derivation (task 1003
-          # R2): one complete requirement row per declared requirement, AC identities resolved,
-          # status/evidence vocabularies accepted, hedged or uncited evidence rejected. It
-          # writes `.spur/run/<wbs>-verdict.json` — the review verdict artifact `spur task
-          # record` consumes — and exits 1 on a non-PASS verdict BY DESIGN, which `softFail`
-          # records as the typed outcome the guards route. A lint failure (exit 1) is a failed
-          # certification, never a warning, and there is no grep fallback.
+          # (d) `spur task verdict` owns the verdict derivation (task 1003 R2). It writes
+          # `.spur/run/<wbs>-verdict.json` — the review verdict artifact `spur task record`
+          # consumes — and exits 1 on a non-PASS verdict BY DESIGN, which `softFail` records as
+          # the typed outcome the guards route.
           - kind: command.gate
             options:
                 id: review-verdict
                 executable: "${vars.spurBin}"
-                args: ["task", "verdict", "${vars.wbs}", "--from-answer", ".spur/run/${vars.__runId}-review-cert.md", "--replay"]
+                args: ["task", "verdict", "${vars.wbs}", "--from-answer", ".spur/run/${vars.__runId}-review-cert.md"]
                 resultFile: .spur/run/${vars.__runId}-review-verdict.status
                 softFail: true
-                # 1319 R4: the replay runs up to 5 cited suites at 120 s each; the action bound is
-                # the same headroom the review hop gets, so a slow cited suite cannot pin the visit.
-                timeoutMs: "900000"
-          # (e) one fold, one token: PASS requires the typed verdict PASS, the artifact's own
-          # PASS, and a clean review gate (open P1-P3 finding or an uncited claim blocks it).
+                # Derivation only (no `--replay`: the gate already ran the tests for this tree).
+                timeoutMs: "120000"
+          # (e) one fold, one token: PASS requires the typed verdict PASS and the artifact's own PASS.
           # Fail-closed: any missing/corrupt input leaves FAIL, so the transitions can route a
           # non-PASS review into remediation instead of dead-ending the run.
           # Idempotent re-entry: the answer file is consumed as a stage input, so a second visit to
           # this state has no answer to re-judge. An ABSENT answer is not new evidence against a
-          # PASS — the durable `<wbs>-verdict.json` and the residual gate still have to pass — so the
+          # PASS — the durable `<wbs>-verdict.json` still has to pass — so the
           # run-scoped verdict status is consulted only when an answer is actually present (without
           # this, re-entry overwrote a PASS with FAIL and closed the task's run as `failed`).
           - kind: shell
             options:
                 command: >-
-                    mkdir -p .spur/run; S=FAIL; if [ ! -f ".spur/run/$__runId-review-answer.txt" -o "$(cat ".spur/run/$__runId-review-verdict.status" 2>/dev/null)" = PASS ]; then [ "$(jq -r '.verdict // empty' ".spur/run/$wbs-verdict.json" 2>/dev/null)" = PASS ] && $spurBin task residual "$wbs" review-gate --no-logo >&2 && S=PASS; fi; printf '%s\n' "$S" > ".spur/run/$wbs-review.status"; exit 0
-          # (d) record the review severity as the lane decision's outcome (1263 R3b): the
-          # question `task-semantic-risk` answered is "is this risky?", and the Review table's
-          # worst finding is the answer as observed. Resolved rows count (a fixed P2 was still
-          # risky). First write wins, so a later review visit changes nothing.
-          - kind: shell
-            options:
-                command: >-
-                    [ -f ".spur/run/$wbs-semantic-risk.decision" ] || exit 0; ID="$(jq -r '.invocationId // empty' ".spur/run/$wbs-semantic-risk.decision" 2>/dev/null)"; [ -n "$ID" ] || exit 0; $spurBin decision outcome "$ID" --review-severity "$wbs" --source "task-pipeline review" --no-logo >/dev/null 2>&1; exit 0
+                    mkdir -p .spur/run; S=FAIL; if [ ! -f ".spur/run/$__runId-review-answer.txt" -o "$(cat ".spur/run/$__runId-review-verdict.status" 2>/dev/null)" = PASS ]; then [ "$(jq -r '.verdict // empty' ".spur/run/$wbs-verdict.json" 2>/dev/null)" = PASS ] && S=PASS; fi; printf '%s\n' "$S" > ".spur/run/$wbs-review.status"; exit 0
           # (d) Operator approval as a DECISION POINT, not a state (D65 1239 R1/R5, ADR-140
           # item 5): interactively the operator responder answers; under `profile=auto` the
           # declared binding answers (evidence status var, catalog fallback when the maker
@@ -805,21 +731,12 @@ states:
             options:
                 command: >-
                     mkdir -p .spur/run; A=APPROVED; if [ "$profile" = auto ]; then [ "$__hitlAnswer" = no ] && A=DENIED; else [ "$__hitlAnswer" = yes ] || A=DENIED; fi; printf '%s\n' "$A" > ".spur/run/$wbs-approval.status"; exit 0
-          # 1319 R5(b): one inline re-review token, decided AFTER every fold above so deleting the
-          # stale cert/answer cannot make a fold read the previous visit's verdict. Run-scoped, so a
-          # stale file from an earlier run can never trigger a retry; `-retried` makes it once only.
-          # A second lint failure leaves the token NONE and routes to remediate exactly as today.
-          - kind: shell
-            options:
-                command: >-
-                    if [ -s ".spur/run/$wbs-verdict-lint.txt" ] && [ ! -f ".spur/run/$__runId-review-lint-retried" ]; then touch ".spur/run/$__runId-review-lint-retried"; printf 'RETRY\n' > ".spur/run/$__runId-review-lint-retry"; rm -f ".spur/run/$__runId-review-cert.md" ".spur/run/$__runId-review-answer.txt"; else printf 'NONE\n' > ".spur/run/$__runId-review-lint-retry"; fi; exit 0
 
     - id: done
       description: >
           Terminal — the task is closed deterministically. onEnter performs the close the
           former `record` state owned: `spur task record` writes Testing/Review from the review
-          verdict and flips the requirement/AC boxes it proves, the residual sweep folds any
-          leftover, and `spur task update <wbs> done --no-lifecycle` runs the verb's own
+          verdict and flips the requirement/AC boxes it proves, and `spur task update <wbs> done --no-lifecycle` runs the verb's own
           target-aware `task check` as the completion gate — a task whose boxes or evidence do
           not certify cannot reach the stored `done` status.
       onEnter:
@@ -847,38 +764,6 @@ states:
             options:
                 command: >-
                     if [ "$deferFeatureSync" = "true" ]; then echo "feature sync deferred to batch integration" >> ".spur/run/$wbs-report.txt"; else FID="$($spurBin task show $wbs --json 2>/dev/null | jq -r '(.feature_id // .frontmatter.feature_id) // empty' 2>/dev/null)"; if [ -n "$FID" ]; then $spurBin feature sync "$FID" --json || echo "feature sync failed — re-run: $spurBin feature sync $FID" >> ".spur/run/$wbs-report.txt"; else echo "Orphan task $wbs — no feature_id linked — proposal: consider linking to a parent feature." >> ".spur/run/$wbs-report.txt"; fi; fi; exit 0
-          # (d) F96 (0983): `spur task residual` owns the sweep; shell only sequences it. The
-          # scan runs AFTER `task record` flipped the verdict-proven boxes, or a proven-but-
-          # unticked box folds every good run to PARTIAL and the done gate is unreachable
-          # (0967). Any box still unchecked post-record stays blocking.
-          # ONE hard action (scan+fold): a scanner crash fails the close closed.
-          - kind: shell
-            options:
-                command: >-
-                    $spurBin task residual "$wbs" scan --no-logo && $spurBin task residual "$wbs" fold --no-logo
-          # (e) F96 R5 (0983): a sweep downgrade must reach the task record — re-record from
-          # the FINAL (post-fold) artifact so Testing carries the downgraded verdict; a failed
-          # task must not retain a stale PASS Testing narrative. Soft (exit 0): the downgrade
-          # itself fails the re-assert below.
-          # 0980: --no-lifecycle for the same orphan reason as the main record command.
-          - kind: shell
-            options:
-                command: >-
-                    verdict="$(jq -r .verdict .spur/run/$wbs-verdict.json 2>/dev/null)"; if [ -n "$verdict" ] && [ "$verdict" != PASS ]; then $spurBin task record $wbs --solution-from-diff --transition testing --no-lifecycle || echo "post-downgrade re-record failed — re-run: $spurBin task record $wbs" >&2; fi; exit 0
-          # (e) The completion contract, re-asserted after the sweep: a post-record residual
-          # downgrade must block the close (hard action, no `; exit 0`). The verdict artifact is
-          # the review's own evidence, not a re-captured digest — the old proof re-assertion is
-          # gone, the fail-closed check on the verdict it certifies is not.
-          - kind: shell
-            options:
-                command: 'jq -e ".verdict == \"PASS\"" .spur/run/$wbs-verdict.json >/dev/null'
-          # (d) F96 R4 (0950): `spur task residual` owns the settle.
-          # Soft best-effort (exit 0) — runs after certification and must never change
-          # the outcome; failure prints the re-run command.
-          - kind: shell
-            options:
-                command: >-
-                    $spurBin task residual "$wbs" settle --no-logo || echo "residual-settle failed — re-run: spur task residual $wbs settle" >&2; exit 0
           # (c) command.gate owns the done transition with classified transient retry. The verb
           # runs its own target-aware `task check --as done` (the completion gate) before the
           # status write, so a task that does not certify a `done` target never stores `done`.
@@ -921,13 +806,6 @@ states:
                     printf '\n## Escalation bound reached\n\nThe implement step asked an operator question %s times (bound %s) and ended without a resumable answer. Unanswered question:\n\n' "$n" "$maxEscalations" >> .spur/run/$wbs-report.txt;
                     cat .spur/run/$wbs-question.md >> .spur/run/$wbs-report.txt;
                     exit 0
-          # (d) F96 R5 (0950): `spur task residual` owns the report.
-          # Soft (exit 0): a run that exhausts its fix budget on residuals leaves the
-          # report + recovery line while the task stays `wip`.
-          - kind: shell
-            options:
-                command: >-
-                    $spurBin task residual "$wbs" report --no-logo || echo "residual-report failed — re-run: spur task residual $wbs report" >&2; exit 0
 
 transitions:
     # ── precheck: task check --precheck (size + evidence + four-layer, 1002 R4) → implement; ──
@@ -1022,12 +900,12 @@ transitions:
                   test "$(cat ".spur/run/$wbs-test-gate.status" 2>/dev/null)" = PASS
     - from: gate
       to: review
-      description: Opt-in batch policy — the typed outcome is PASS and the gate wrote the DEFERRED (light-tier) token.
+      description: Incremental mode — the typed outcome is PASS and the gate wrote the DEFERRED (incremental) token.
       guard:
           kind: shell
           options:
-              # 1111 R2: `DEFERRED` is accepted ONLY when the opt-in var is "true" — with the
-              # default "false" a stray DEFERRED file fails the guard exactly like a corrupt one.
+              # `DEFERRED` is accepted ONLY in incremental mode — in full mode ("false") a stray
+              # DEFERRED file fails the guard exactly like a corrupt one.
               command: >-
                   test "$deferQualityGate" = "true" &&
                   test "$(cat ".spur/run/$__runId-gate.status" 2>/dev/null)" = PASS &&
@@ -1104,16 +982,6 @@ transitions:
           kind: shell
           options:
               command: 'test "$(cat ".spur/run/$wbs-approval.status" 2>/dev/null)" = DENIED'
-    # 1319 R5(c): one inline re-review when the answer LINT failed, before any remediate hop is
-    # spent. Declared after the denial route and before `retry-exhausted` because a lint retry is
-    # not a repair attempt (it does not consume the shared fix-attempt counter). First match wins.
-    - from: review
-      to: review
-      description: The verdict lint rejected the answer's shape — re-issue the review prompt once with the lint findings instead of buying a remediate hop.
-      guard:
-          kind: shell
-          options:
-              command: 'test "$(cat ".spur/run/$__runId-review-lint-retry" 2>/dev/null)" = RETRY'
     - from: review
       to: failed
       terminalReason: retry-exhausted

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.4.31",
+    "version": "0.4.34",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",

package/plugins/sp/agents/super-reviewer.md

@@ -174,23 +174,18 @@ fails it. One explicit mapping, no transcription step anywhere downstream:
 Severity words stay visible in the same cell — the mapping adds the machine-readable label, it does
 not replace the semantics.
 
-**Disposition column (1089, E71).** The findings table carries a `Disposition` cell. It is not
-cosmetic: the record stage's residual sweep reads these rows (`parseReviewFindings` in
-`packages/app/src/services/residual-scan.ts`), and a `P1`–`P3` row with no disposition classifies as
-**blocking**, which downgrades a PASS verdict to PARTIAL and closes the `done` gate. A finding you
-resolved inside the same task therefore says so in that cell — `RESOLVED`/`FIXED`/`DONE` (optionally
-with the commit) drops the row from the sweep; `DEFER(<reason>)` reclassifies a P3 as deferrable
-(never P1/P2). Prose such as "Closed." inside the *Finding* cell does not count — the sweep reads
-the cell, not the sentence. `OPEN` states "still live", and `ACCEPTED` marks a non-blocking P4
-observation you are deliberately not acting on; both behave as an ordinary open row.
-
-**Pipeline cost of an open finding (1122).** The review certification runs this same classification
-(`spur task residual <wbs> review-gate`): a PASS whose table still carries an open P1-P3 row is a
-non-PASS review, so the `review-failure-class` decision routes it to `remediate` instead of `done`.
-Open P1-P3 findings block `done`; fixing one invalidates the certified digest and re-runs
-gate → review on a fresh digest. Only P4 rows and `DEFER`-ed P3 rows are wrap residuals — disposition the finding in
-its cell now, while you hold the context, instead of leaving the cost to be rediscovered after a
-full cycle.
+**Disposition column (1089, E71).** The findings table carries a `Disposition` cell, and it is
+your statement of each finding's state: `RESOLVED`/`FIXED`/`DONE` (optionally with the commit) for a
+finding closed inside the same task, `DEFER(<reason>)` for a P3 you deliberately carry (never
+P1/P2), `ACCEPTED` for a P4 observation you are not acting on, `OPEN` for one still live. Nothing
+parses these rows — your `Verdict:` line is the only gate — so the two must agree: a table with an
+open P1-P3 row carries a non-PASS verdict.
+
+**Pipeline cost of an open finding (1122).** A non-PASS review routes through the
+`review-failure-class` decision to `remediate` instead of `done`. Open P1-P3 findings block `done`;
+fixing one invalidates the certified digest and re-runs gate → review on a fresh digest. Only P4 rows
+and `DEFER`-ed P3 rows are wrap residuals — disposition the finding in its cell now, while you hold
+the context, instead of leaving the cost to be rediscovered after a full cycle.
 
 **Section-relative headings.** In WBS mode (standalone or pipeline) the report body is written
 *into* the task's `### Review` section, so every heading inside it MUST be `####` or deeper. A
@@ -228,32 +223,10 @@ FAIL, PARTIAL, a missing line, a line split across two lines — routes the run
 `review-failure-class` decision into the bounded `remediate` hop. Keep it on one line, in that shape, in every
 review answer; never restate it as prose only.
 
-**State `Confidence: HIGH | MEDIUM | LOW` — the gate derives it from your dispositions (ADR-141).**
-The review report carries exactly one top-level `Confidence:` line, and it is **cross-checked**: a
-stated level that disagrees with the table is a blocking `review-contract` violation, so a PASS
-carrying citation-free or untested claims cannot launder itself as `HIGH`.
-
-| Derived | When the table says so |
-| --- | --- |
-| `LOW` | the verdict is not PASS, or an open (or undispositioned) P1–P3 row survives |
-| `HIGH` | PASS with every finding closed (`RESOLVED` / `FIXED` / `DONE`) and no carried residual |
-| `MEDIUM` | PASS with carried residuals only — `DEFER(...)`, `ACCEPTED`, or an open P4 |
-
-Derivation: `packages/app/src/services/answer-confidence.ts` (shared with the verify answer). This
-does not revive the retired self-grade: the level records **evidence composition** — what a reader
-would otherwise have to re-derive from the rows — and the gate recomputes it rather than trusting it.
-No verdict-artifact field, no receipt level, no per-finding grade, and no operator ack var exists
-(ADR-138 stands for every other carrier). Evidence gaps still belong in the report body: name them,
-then let the dispositions decide the level.
-
-**Two artifacts, one `Confidence:` line each (1254).** The body you write into `### Review` states
-the disposition-derived level above. When the pipeline also captures your final answer as the
-certification input for `spur task verdict`, that text is a *second* artifact with a *different*
-consumer, and it carries the **evidence-derived** level (`deriveVerifyConfidence`): PASS with every
-AC row MET on executable evidence (`test`/`command`) is HIGH; a citation-only (`static-ref`),
-`manual-review`, `llm-judge` or `N/A` AC is MEDIUM; a non-PASS verdict or any PARTIAL/UNMET row is
-LOW. It ends with exactly one plain `Verdict: PASS|PARTIAL|FAIL` line preceded by both tables, in
-this exact shape:
+**The certification answer.** No `Confidence:` line exists on any carrier — name evidence gaps in
+the report body instead. When the pipeline captures your final answer as the certification input
+for `spur task verdict`, it ends with exactly one plain `Verdict: PASS|PARTIAL|FAIL` line preceded
+by both tables, in this exact shape:
 
 | Req | Status | Evidence |
 | --- | --- | --- |
@@ -267,15 +240,10 @@ One row per declared requirement (`MET | PARTIAL | UNMET`, none omitted or merge
 acceptance criterion (`MET | PARTIAL | UNMET | N/A`), with the evidence-type token alone in its own
 cell — `test | command | static-ref | manual-review | llm-judge | n/a`, or a `+` compound when more
 than one kind applies. Evidence cells cite a repo-root-relative `path:line` or a named test/command.
-An absolute path outside the repo (`/tmp/<report>.md:12`) is an unresolved anchor that blocks the
-done projection (`L4.anchor-unresolved`); cite the owning source or a corpus artifact instead. AC
+Cite the owning source or a corpus artifact, never a scratch path. AC
 identities stay the task's own (checklist label, title, bold head, `Scenario:` prefix, bracket tag or
 declared `AC-N` alias): a linked feature's scenario title covers the task that implements it, and a
 task-local criterion is legal as-is — it needs no feature credit.
-Never repeat the section's disposition-derived `Confidence:` line here: a second `Confidence:` line is
-a `confidence-duplicate` rejection of the whole answer, and so is a level the rows do not derive. A
-PASS with executable AC and one accepted P4 therefore certifies as `Confidence: HIGH` in the answer
-while the section keeps `Confidence: MEDIUM`.
 
 **Source citations for external claims (one claim contract, 2026-10-12).** A Finding cell or a
 Functional Traceability `Evidence` cell that asserts an external API/library claim carries a
@@ -289,18 +257,8 @@ finding's subject, not the claim's source. Cell-free receipts (test counts, revi
 assert no external claim and need no citation. An uncited external claim is an assumption: name it
 as an explicit gap in the report body (above), so a reader can re-check it.
 
-
-**Machine-checked at the gate (findings table).** `spur task residual <wbs> review-gate` applies the same two
-predicates to every finding row: a Finding cell carrying one of the verify lint's claim markers with
-no citation form becomes a **blocking** `review-contract` item, so `review → done` stops and the
-run enters the `review-failure-class` decision. The `Location` column is deliberately not consulted as a citation —
-that is the rule stated above, and a gate that accepted it would pass every row that has an anchor.
-Functional Traceability `Evidence` cells stay reviewer-enforced (SECUA review): they are free prose
-in a table the gate does not parse.
-
 **No findings.** Never invent a defect to populate the table. Emit one substantive `P4 (advisory)`
-row that states what was reviewed and what was found — placeholder cells (empty, `—`, `n/a`) are
-rejected by the checker, and so they should be:
+row that states what was reviewed and what was found — placeholder cells (empty, `—`, `n/a`) tell a reader nothing:
 
 ```markdown
 | # | Priority | Dimension | Finding | Location | Disposition |

package/plugins/sp/commands/dev-fixall.md

@@ -30,13 +30,6 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 Follow the inline procedure in [dev-operations.md](../skills/spur-dev/references/dev-operations.md#10-fixall) (fixall). Pipeline signal: when `--gate-log` is set (the `remediate` hop), run no full gate — the `gate` state's recheck immediately after is the deciding run (R4, task 0483).
 
-When dispatched from the pipeline's `remediate` hop (F96, task 0950), the gate log carries a
-`residual artifact` block (`<wbs>-residuals.json`) and the findings file already
-contains the merged residual anchors: treat those items as fix targets, in order,
-alongside gate anchors. The fixer may write `.spur/run/<wbs>-residual-deferrals.json`
-— one `{id, reason}` entry per item — but only for P3 findings or diff markers it
-cannot fix inside the task; the done stage settles deferrals into follow-up tasks.
-
 The `remediate` hop is entered only after a `fix` decision (`failure-class` on a red gate,
 `review-failure-class` on a non-PASS review). A `stop` decision ends the run before this command
 runs, so do not invoke it by hand to overrule a `stop`

package/plugins/sp/commands/dev-review.md

@@ -44,7 +44,7 @@ Put the target first: a bare token after `--worktree` is read as the worktree na
 - **WBS mode (per task target):** `Skill(skill="sp:functional-review", args="<wbs> $FLAGS")` + `Skill(skill="sp:code-verification", args="review <wbs> $FLAGS")` + `Skill(skill="sp:code-improvement", args="<wbs> $FLAGS")` (functional traceability + SECUA framework + architectural depth — each skill receives its one resolved WBS exactly once plus `$FLAGS` = `$ARGUMENTS` minus the selector (`--tasks`/`--feature`/`--scope` or positional) and its value, never the raw selector, and returns a review fragment only — F92 0593 R1)
 - **Task fan-out (`--tasks` / `--feature`).** One WBS-mode review per task in the frozen set. Tasks in `backlog`/`todo`/`blocked` are reported NOT-STARTED and skipped (§ 3a outcome vocabulary); a per-task failure does not stop the remaining tasks. Each implemented task gets its own merged `## Review`; the run ends with a combined summary table (WBS, verdict, P1/P2 counts).
 - Coordinator = this session. No `sp:super-reviewer` subagent is dispatched: act as the review coordinator defined in [agents/super-reviewer.md](../agents/super-reviewer.md) — merge the fragments per its Output Format (native `P1`–`P4` priority cells, section-relative headings) and, for every task target (standalone or pipeline), write that task's combined `## Review` via `spur task update <wbs> --section Review --from-file`. Path mode emits advisory output only.
-- **Answer contract (pipeline dispatches).** The captured review answer (`.spur/run/<runId>-review-answer.txt`) must carry exactly one `Verdict: PASS|FAIL` line **and** the requirement traceability table `| Req | Status | Evidence |` (D65 1239: `verify` merged into `review`, so this answer is the pipeline's only verification record). It also carries exactly one `Confidence: HIGH|MEDIUM|LOW` line whose level its own findings derive (ADR-141 — no open P1–P3 and no carried residual is HIGH, a carried residual is MEDIUM, an open P1–P3 or a non-PASS verdict is LOW); the gate recomputes the level and rejects a disagreement, so stating a level the dispositions do not support fails the review. `spur task verdict --from-answer` owns the parse — it lints the table and the level, writes the canonical `.spur/run/<wbs>-verdict.json` that `spur task record` reads for box flips and `## Testing`, and a non-zero exit fails the review stage; never re-implement the parse in shell. On a feature-linked task, key each AC row to its feature scenario (scenario title, `AC-N` alias, `(feature R<n>)` or `[R<n>]`) — a row keyed only by a task requirement id credits no scenario at the feature done gate.
+- **Answer contract (pipeline dispatches).** The captured review answer (`.spur/run/<runId>-review-answer.txt`) must carry exactly one `Verdict: PASS|FAIL` line **and** the requirement traceability table `| Req | Status | Evidence |` (D65 1239: `verify` merged into `review`, so this answer is the pipeline's only verification record). No `Confidence:` line exists; with an open P1–P3 finding the verdict must be non-PASS. `spur task verdict --from-answer` owns the parse — it writes the canonical `.spur/run/<wbs>-verdict.json` that `spur task record` reads for box flips and `## Testing`, and a non-zero exit fails the review stage; never re-implement the parse in shell. On a feature-linked task, key each AC row to its feature scenario (scenario title, `AC-N` alias, `(feature R<n>)` or `[R<n>]`) so `record` can tick the aliased AC line.
 - **Path mode (per path target):** `Skill(skill="sp:code-verification", args="review <path> $FLAGS")` + `Skill(skill="sp:code-improvement", args="<path> $FLAGS")` (advisory SECUA quality + architectural depth — one normalized path forwarded once plus `$FLAGS`; performs no task mutation). Under `--scope <path>[,<path>]`: paths must exist (exit 2 otherwise), are normalized, duplicates dropped and nested paths collapse to the ancestor (`--scope apps,apps/cli` → `apps`); each surviving path gets a sub-review (Step 3p path scope), eligible for native-subagent dispatch per [dispatch-surface.md](../skills/parallel-execution/references/dispatch-surface.md); the coordinator merges the sub-reviews, runs **one** cross-path architecture pass (`sp:code-improvement` over the inter-path imports), and emits **one** advisory report. No task mutation.
 - **Positional alias (deprecated).** A positional `<wbs|path>` is accepted for one release: a `^\d{4}$` token with a resolvable task behaves as `--tasks <wbs>`; an existing path as `--scope <path>`; otherwise exit 2. Print a deprecation warning naming the replacement selector; removal is a follow-up.
 - `--triage`: after the review returns, run the triage protocol in [dev-operations.md § 2. review](../skills/spur-dev/references/dev-operations.md#2-review) **inline in this session** — the review skills and `sp:super-reviewer` stay report-only. With multiple targets, bucket the findings across all targets once (identical `file:line` findings deduped before bucketing). `Edit`/`Write` in `allowed-tools` exist only for these direct fixes.