@gobing-ai/spur 0.4.4 → 0.4.6

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.4.4",
+            "version": "0.4.6",
             "source": "./plugins/sp"
         }
     ]

package/config/config.example.yaml

@@ -66,10 +66,9 @@ bootstrap:
 agent:
   # `default` is the role used for `--agent auto` when the caller declares
   # nothing (task 0542 R2 — the value domain moved from executor names to
-  # roles). A role id selects its tier's cheapest eligible executor; a
-  # configured executor name still resolves during the transition with a
-  # one-time warning (shim agent-default-executor); any other value fails
-  # naming both accepted sets.
+  # roles). A role id selects its tier's cheapest eligible executor; any
+  # other value fails. A configured executor name fails with a fix (use a
+  # role, and pin the executor with --agent <name>).
   default: coder
 
   # Role → tier map (SSOT: DEFAULT_AGENT_ROLES in packages/config, task 0572 /

package/config/config.global.yaml

@@ -35,10 +35,9 @@ version: "1.2"
 agent:
     # `default` is the role used for `--agent auto` when the caller declares
     # nothing (task 0542 R2 — the value domain moved from executor names to
-    # roles). A role id selects its tier's cheapest eligible executor; a
-    # configured executor name still resolves during the transition with a
-    # one-time warning (shim agent-default-executor); any other value fails
-    # naming both accepted sets.
+    # roles). A role id selects its tier's cheapest eligible executor; any
+    # other value fails. A configured executor name fails with a fix (use a
+    # role, and pin the executor with --agent <name>).
     default: coder
 
     # Role → tier map. Resolution: role → tier → cheapest USABLE executor whose

package/config/rules/docs/sourced-api-claims.yaml

@@ -32,8 +32,9 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 # backstop: the two `cited-*` rules cover the citation half, and
 # `cited-api-claims-confidence` covers the level half. All are severity `info`,
 # and the category is deliberately NOT in `recommended-pre-check` — it surfaces
-# findings for review without reddening gates. To promote it to a gate, add
-# `- docs` to that preset's `extends` once the residual list is triaged.
+# findings for review without reddening gates. The 2026-10-12 audit below settled
+# the promotion question: the residual findings stay a review-surface concern
+# (SECUA checklist), not a gate one — do not add `- docs` to that preset.
 include:
   - "docs/**/*.md"
   - "plugins/sp/skills/**/references/**/*.md"

package/config/rules/quality/coverage-gate.yaml

@@ -12,14 +12,16 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 # `bun run test:full`. Running this rule directly via `spur rule run` outside the
 # repository wrapper bypasses that certification wrapper and is outside this
 # repository's certification contract. This rule and its evaluator are unchanged.
+# Launcher children write isolated LCOV; canonical publication is exclusive and
+# accepts only that run's complete records. Noncanonical launcher runs cannot
+# overwrite the certified tracefile. Bare `bun test` still bypasses the launcher.
 #
 # Absorbed from ts-libs/.spur/rules/quality/coverage-gate.yaml, re-scoped to
 # Spur's monorepo layout:
 #   - lcovPath kept at .coverage/lcov.info (Spur's `bun run test:coverage`
-#     writes it via --coverage-dir=.coverage, and `bunfig.toml
-#     [test] coverage = true` means a plain `bun run test` writes the same
-#     artifact — so a TARGETED `bun test <file>` overwrites it with a partial
-#     tracefile, and this rule then judges that partial data)
+#     publishes it after a completed run; bare TARGETED `bun test <file>` can
+#     still overwrite it with partial data, which the repository provenance
+#     wrapper refuses before this rule runs)
 #   - include expanded to apps/** + packages/** (Spur tests cover both;
 #     ts-libs only covers packages/**)
 #   - threshold kept at 90 matching bunfig.toml coverageThreshold

package/config/rules/recommended-pre-check.yaml

@@ -4,16 +4,17 @@ $schema: "@gobing-ai/spur/schemas/preset.schema.json"
 #
 # Runs BEFORE tests (test-pre-check). Extends categories: typescript,
 # structure, boundary, surface, ui, strict (ui since bc267cc8, strict since
-# 79186391), and docs (sourced-api-claims, 2026-10-07). TSDoc exports run in
-# post-check alongside coverage-gate.
+# 79186391), and docs (sourced-api-claims, 2026-10-07; pulled 2026-10-08 for
+# finding noise — a 2026-10-14 restore was reverted; keep it out for now, see
+# the marker line below). TSDoc exports run in post-check alongside
+# coverage-gate.
 #
-# TEMPORARY (2026-10-08): `docs` removed from extends to unblock the gate —
-# restore it (add `- docs` back) once sourcing-claim finding noise is triaged.
-# The category now holds two files and both residuals must be triaged first:
-# `docs/sourced-api-claims.yaml` (advisory citation/level checks on claim lines) and
-# `docs/verdict-confidence.yaml` (a machine `Verdict:` report must state its
-# HIGH/MEDIUM/LOW level; 3 historical reports under docs/reports/ predate the
-# contract). Recapture the raw-json-baseline fixtures in the same change.
+# `docs/sourced-api-claims.yaml` (citation/level checks) stays OUT of this gate:
+# severity info would not redden it, but the findings belong to the SECUA review
+# surface — run that file ad hoc instead. Recapture the raw-json-baseline
+# fixtures when touching this preset. (F511: the category's other file,
+# `verdict-confidence.yaml`, was deleted with the asserted confidence machinery
+# it backstopped.)
 name: recommended-pre-check
 extends:
   - typescript
@@ -22,3 +23,4 @@ extends:
   - surface
   - ui
   - strict
+  # - docs  ## DO NOT ENABLE THIS LINE

package/config/transition-shims.json

@@ -7,20 +7,6 @@
             "file": "packages/app/src/services/agent-service.ts",
             "keepsWorking": "a bare coding-agent binary name (codex, omp, claude with no matching agent.executors entry) remains a valid --agent value during the role transition, with a one-time warning emitted by warnBareBinaryOnce",
             "removalCondition": "no bare-binary --agent value remains in docs/, config/workflows/, or plugins/sp/ (scan for --agent <binary-name> usages against agent.executors names)"
-        },
-        {
-            "id": "spec-without-executor-field",
-            "wbs": "0537",
-            "file": "apps/cli/src/commands/agent.ts",
-            "keepsWorking": "a pre-existing agent spec carrying only type (no executor field) still drains: --agent <specId> falls back to the spec's coding-agent type instead of resolving a missing executor",
-            "removalCondition": "every spec under .spur/agents/ records an executor field (scan .spur/agents/*.yaml for the key; re-materialize the demo team first)"
-        },
-        {
-            "id": "agent-default-executor",
-            "wbs": "0542",
-            "file": "packages/app/src/services/agent-service.ts",
-            "keepsWorking": "a configured executor name in agent.default still resolves during the transition, warned once by warnAgentDefaultExecutorOnce; the value domain moved to roles (recommended default: coder)",
-            "removalCondition": "no agent.default value names an agent.executors entry (scan .spur/config.yaml and config/config.example.yaml against the agent.executors names)"
         }
     ]
 }

package/config/workflows/task-pipeline.yaml

@@ -19,14 +19,6 @@
 # done guard closed, and re-records Testing before the failed edge); done settles
 # deferrals; failed renders the recovery report. No new state, edge, or model query.
 #
-# Confidence gate (session finding after 1088, task 1068 follow-up): the verify answer has
-# carried a `Confidence: HIGH|MEDIUM|LOW` line since 1068, and nothing read it — a PASS at
-# LOW confidence certified exactly like HIGH. The verify stamp now records a `confidence`
-# check row, and BOTH completion guards (verify → record, record → done) refuse a LOW (or
-# absent) level unless the run was launched with `--vars '{"ackLowConfidence":"true"}'`.
-# The acknowledgement is an operator decision, not a model one: it is the only way to
-# certify a verdict the verifier itself would not stand behind.
-#
 # Review-failure routing (session finding after 1088): `review` had no outgoing edge for a
 # FAIL verdict, so a failing review could only be remediated by driving the graph by hand
 # (re-entering `test` and hand-emitting rows). The review stage now derives
@@ -51,9 +43,8 @@ kind: state-machine
 name: task-pipeline
 # 0772 R2: explicit identity tag. Set only after the proof failure-path tests
 # passed; the engine treats unversioned external definitions as supported.
-# v4 (session finding after 1088): the completion gate reads the verifier's confidence level and
-# the graph routes a non-PASS review into bounded remediation — both are contract changes, so the
-# identity moves with them.
+# v4 (session finding after 1088): the graph routes a non-PASS review into bounded remediation —
+# a contract change, so the identity moves with it (the confidence half of v4 was retired at v7).
 # v5 (task 1077's inline run, 2026-10-06): the verify verdict action is explicitly `onError:
 # continue`. `task verdict` exits non-zero on any non-PASS verdict BY DESIGN (1003 R2) — that is
 # data for the verify guards, not a state failure. Under the engine's default 'fail' policy
@@ -63,14 +54,13 @@ name: task-pipeline
 # UNREACHABLE: a non-PASS verify could only end the run failed. `test-fix` also gained the
 # review-lane evidence projection (see its onEnter) so the repair hop is not fed an empty findings
 # list when the failing hop was `review-fail-triage` rather than the quality gate.
-# v6 (task 1134 run, 2026-10-09): the `confidence` check row now encodes the SAME policy as the two
-# completion guards instead of a stricter one of its own. It warned for every level below HIGH, so a
-# MEDIUM certification was admitted by both guards but recomputed as PARTIAL by the CLI done gate —
-# the artifact was self-inconsistent and `done` was refused with no named level to act on. The row
-# now warns only for an unacknowledged LOW (or absent) level, which is exactly what the guards
-# refuse; `packages/app/tests/workflow/task-pipeline-proof-chain.test.ts` pins the agreement for
-# HIGH/MEDIUM/LOW/absent × ack.
-version: "6"
+# v7 (task 1207, F511): the asserted `Confidence: HIGH|MEDIUM|LOW` machinery is retired — the
+# verifier's and reviewer's self-graded levels (re-imported from the cc anti-hallucination skill
+# by task 1068) are no longer written, checked, or gated on; spur certifies on deterministic
+# evidence (rows MET, proof digests, findings dispositioned). The `confidence` check row, the
+# `ackLowConfidence` var, and the guards' LOW/absent clauses are gone; the derived
+# feature-receipt confidence (ADR-131/1196) is a different family and stays.
+version: "7"
 description: "Standard task pipeline: precheck → implement → quality-gate (test/fix/recheck) → review → approve → verify → record → done"
 # Task entity lifecycle (owned by task-lifecycle.yaml):
 #   normal: backlog → todo → wip → testing → done
@@ -195,14 +185,6 @@ vars:
     # Escalation counter: .spur/run/<wbs>-escalation-count. Default 2 = two answered
     # questions; a third pause routes to failed with a report note.
     maxEscalations: "2"
-    # Operator acknowledgement of a LOW-confidence certification (session finding after 1088).
-    # The verify answer's `Confidence:` line is captured into the verdict artifact; a LOW (or
-    # absent) level fails the completion guards unless this is "true", because a PASS the
-    # verifier would not stand behind is an operator risk decision, not a mechanical one.
-    # Set per run: `--vars '{"ackLowConfidence":"true"}'` (and export it on the inline path).
-    # Deliberately NOT settable from the task file or the verifier's own answer: the point is
-    # that a second party, not the producer, accepts the residual uncertainty.
-    ackLowConfidence: ""
     # Runtime-written, 0933: the escalate hop's file.read.into-var fills this from
     # .spur/run/<wbs>-question.md; the hitl.input prompt below references it. Declared
     # here (empty) so the static var-reference validator sees the template source.
@@ -897,20 +879,6 @@ states:
             onError: continue
             options:
                 command: "$spurBin task verdict $wbs --from-answer .spur/run/$wbs-verify-answer.txt"
-          # Session finding after 1088: the verifier's confidence level becomes a `confidence` check
-          # row and a gate-log line, so the level the completion guards enforce is visible in the
-          # artifact and the log — not only in the answer file. v6 (task 1134 run): the row warns for
-          # an unacknowledged LOW/absent level ONLY, matching the guards' ack rule; warning for
-          # MEDIUM too made an admitted certification aggregate to PARTIAL (self-inconsistent artifact,
-          # done refused). This is its own action because the proof-binding stamp below must stay the
-          # state's LAST action AND under the ADR-115 800-char shell cap.
-          - kind: shell
-            options:
-                command: >-
-                    V=".spur/run/$wbs-verdict.json"; [ -f "$V" ] || exit 0;
-                    jq --arg ack "$ackLowConfidence" '. + {checks: (((.checks // []) | map(select(.name != "confidence"))) + [{name: "confidence", status: (if ((.confidence // "LOW") != "LOW" or $ack == "true") then "pass" else "warn" end), evidence: ((.confidence // "LOW (absent from artifact)") + (if $ack == "true" then " (operator-acknowledged)" else "" end))}])}' "$V" > "$V.tmp" && mv "$V.tmp" "$V";
-                    printf 'confidence: %s (ack=%s)\n' "$(jq -r '.confidence // "LOW (absent)"' "$V")" "$ackLowConfidence" >> ".spur/run/$wbs-test-gate.log";
-                    exit 0
           # (e) one jq mutation binds the verdict to the proof digest (0703 R3; runId 0730 §B.2 /
           # 0757 R4; definitionDigest 0759 R5; honest review stamp 0785 R4; soft action + hard guard).
           - kind: shell
@@ -1312,16 +1280,15 @@ transitions:
     # re-enters quality → review → verify on a fresh digest. Before 1088 a FAIL review had no
     # outgoing edge at all; before 1122 a PASS-with-findings cost a full re-certification cycle per
     # attempt (knowledge-kit 0210/0213). The reviewer writes `Verdict: PASS|FAIL` in its answer;
-    # both plain and bold forms are accepted. Since 1204 a PASS must also be GRADED: the reviewer
-    # states `Confidence: HIGH|MEDIUM|LOW` (verify-chain semantics, 1068), HIGH/MEDIUM cross the
-    # PASS edges unadorned, and LOW or an absent line needs the operator's `ackLowConfidence` —
-    # otherwise the PASS falls to the catch-all like any other verdict the reviewer would not stand
-    # behind (same policy as the verify confidence gate). Review stays advisory: verify certifies.
+    # both plain and bold forms are accepted. (F511: the v4-era PASS confidence grading — the
+    # reviewer's self-stated HIGH/MEDIUM/LOW level and its `ackLowConfidence` escape hatch — was
+    # retired; a PASS with no open P1-P3 finding is what the gate reads.) Review stays advisory:
+    # verify certifies.
     # Under `profile=auto` the approve gate is skipped, so the PASS+auto edge is tried first and the
     # interactive PASS edge second.
     - from: review
       to: verify
-      description: profile=auto, the review certified a HIGH/MEDIUM-confidence PASS (LOW/absent needs ackLowConfidence) with no open P1-P3 finding — skip the human approval gate.
+      description: profile=auto, the review certified a PASS with no open P1-P3 finding — skip the human approval gate.
       guard:
           kind: shell
           options:
@@ -1329,23 +1296,22 @@ transitions:
                   test "$profile" = auto &&
                   grep -qiE '^[[:space:]]*\**Verdict:\** *PASS' ".spur/run/$__runId-review-answer.txt" &&
                   eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/residual-scan.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/residual-scan.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)" &&
-                  [ -f "$S" ] && "$RUNNER" "$S" review-gate "$wbs" --spur-bin "$spurBin" --review-answer ".spur/run/$__runId-review-answer.txt" >&2
+                  [ -f "$S" ] && "$RUNNER" "$S" review-gate "$wbs" --spur-bin "$spurBin" >&2
     - from: review
       to: approve
-      description: Review certified a HIGH/MEDIUM-confidence PASS (LOW/absent needs ackLowConfidence) with no open P1-P3 finding — gate on human approval before verification.
+      description: Review certified a PASS with no open P1-P3 finding — gate on human approval before verification.
       guard:
           kind: shell
           options:
               command: >-
                   grep -qiE '^[[:space:]]*\**Verdict:\** *PASS' ".spur/run/$__runId-review-answer.txt" &&
                   eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/residual-scan.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/residual-scan.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)" &&
-                  [ -f "$S" ] && "$RUNNER" "$S" review-gate "$wbs" --spur-bin "$spurBin" --review-answer ".spur/run/$__runId-review-answer.txt" >&2
+                  [ -f "$S" ] && "$RUNNER" "$S" review-gate "$wbs" --spur-bin "$spurBin" >&2
     - from: review
       to: review-fail-triage
       description: >-
-          No certified PASS without an open P1-P3 finding (FAIL, PARTIAL, missing, unparseable, a
-          PASS whose review-gate check found an open P1-P3 row, or a PASS the reviewer graded below
-          HIGH/MEDIUM — or left ungraded — without the operator's ackLowConfidence; fail closed) —
+          No certified PASS without an open P1-P3 finding (FAIL, PARTIAL, missing, unparseable, or
+          a PASS whose review-gate check found an open P1-P3 row; fail closed) —
           classify the failure and route it into the bounded repair hop instead of dead-ending the run.
       guard:
           kind: always
@@ -1383,23 +1349,21 @@ transitions:
     # The verify step emits .spur/run/<wbs>-verdict.json with a required proof block (task 0703 R3/R5).
     # Only `verdict: PASS` PLUS a proof block whose digest — top level and every named stage — equals
     # the captured `proofDigest` clears the gate to `record`; any non-PASS, a missing file, malformed
-    # JSON, or missing/mismatched proof evidence does not. The verifier's confidence level is part of
-    # that certification (session finding after 1088): a PASS the verifier itself marked LOW — or left
-    # unstated — clears the gate only when the operator accepted it with
-    # `--vars '{"ackLowConfidence":"true"}'`. Declaration order: PASS+proof guard FIRST,
-    # then the bounded remediation route (R4), then the always catch-all so a PASS verdict with a
-    # missing/malformed proof block still terminates at `failed` instead of hanging the state.
+    # JSON, or missing/mismatched proof evidence does not. (F511: the v4-era LOW/absent-confidence
+    # clause and its `ackLowConfidence` escape hatch were retired.) Declaration order: PASS+proof
+    # guard FIRST, then the bounded remediation route (R4), then the always catch-all so a PASS
+    # verdict with a missing/malformed proof block still terminates at `failed` instead of hanging
+    # the state.
     - from: verify
       to: record
-      description: Verification verdict is PASS, its proof block names the captured digest on every stage, and any LOW confidence was operator-acknowledged — record results and proceed to done.
+      description: Verification verdict is PASS and its proof block names the captured digest on every stage — record results and proceed to done.
       guard:
           # (one jq -e predicate) PASS verdict; proof, quality-gate, review and verification digests
-          # equal to proofDigest; review completed; matching run id and definition digest (0703 R5, 0785 R4);
-          # confidence HIGH/MEDIUM, or LOW/absent with the operator's ack (session finding after 1088).
+          # equal to proofDigest; review completed; matching run id and definition digest (0703 R5, 0785 R4).
           kind: shell
           options:
               command: >-
-                  jq -e --arg d "$proofDigest" --arg r "$__runId" --arg dd "$__definitionDigest" --arg ack "$ackLowConfidence" '
+                  jq -e --arg d "$proofDigest" --arg r "$__runId" --arg dd "$__definitionDigest" '
                   .verdict == "PASS"
                   and (.proof.digest // "") == $d
                   and (.proof.stages.qualityGate.digest // "") == $d
@@ -1408,7 +1372,6 @@ transitions:
                   and (.proof.stages.verification.digest // "") == $d
                   and (.proof.runId // "") == $r
                   and (.proof.definitionDigest // "") == $dd
-                  and ((.confidence // "LOW") != "LOW" or $ack == "true")
                   ' ".spur/run/$wbs-verdict.json" >/dev/null 2>&1
     - from: verify
       to: test-fix
@@ -1436,12 +1399,10 @@ transitions:
     # ── done gate: record → done/failed gated on `spur task check` (ADR-026 amendment 2026-06-23)
     # PLUS the proof-block re-assertion (task 0703 R5): the verdict artifact must still be PASS and
     # still name the captured digest — a forged or mutated completion artifact fails closed here.
-    # PLUS the confidence re-assertion (session finding after 1088): the same ack rule as verify →
-    # record, re-read from the artifact so a mutation between the two boundaries cannot slip through.
     # Declaration order: pass guard first.
     - from: record
       to: done
-      description: Task check passed, the verdict proof block still names the captured digest, and any LOW confidence was acknowledged — certify done.
+      description: Task check passed and the verdict proof block still names the captured digest — certify done.
       guard:
           kind: shell
           options:
@@ -1451,14 +1412,13 @@ transitions:
               # comments inside the folded scalar: `>-` joins same-indent lines into
               # one shell line.
               # Two logical commands, deliberately (ADR-115): the `task check` projection plus
-              # ONE jq predicate re-asserting the whole completion contract — PASS verdict, the
-              # captured proof digest, and the confidence rule (session finding after 1088).
+              # ONE jq predicate re-asserting the whole completion contract — PASS verdict and the
+              # captured proof digest.
               command: >-
                   $spurBin task check $wbs --as done &&
-                  jq -e --arg p "$proofDigest" --arg ack "$ackLowConfidence" '
+                  jq -e --arg p "$proofDigest" '
                   .verdict == "PASS"
                   and ((.proof.digest // "") == $p)
-                  and ((.confidence // "LOW") != "LOW" or $ack == "true")
                   ' ".spur/run/$wbs-verdict.json" >/dev/null 2>&1
     - from: record
       to: failed

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.4.4",
+    "version": "0.4.6",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",

package/plugins/sp/agents/super-reviewer.md

@@ -200,7 +200,6 @@ shallower.
 **Scope:** <wbs diff | path glob>
 **Dimensions:** functional, security, efficiency, correctness, usability, architecture
 **Verdict:** PASS | PARTIAL | FAIL
-**Confidence:** HIGH | MEDIUM | LOW
 ##### Findings (ranked)
 
 | # | Priority | Dimension | Finding | Location | Disposition |
@@ -226,30 +225,14 @@ FAIL, PARTIAL, a missing line, a line split across two lines — routes the run
 `review-fail-triage` and its bounded repair hop. Keep it on one line, in that shape, in every
 review answer; never restate it as prose only.
 
-**The Confidence line is machine-read too (one confidence contract, 2026-10-12).** Every review
-report carries exactly one `Confidence: HIGH | MEDIUM | LOW` line, stated at the level the review can
-actually defend — the same enum and the same earning rule the verify answer uses
-([verdict-schema.md](../skills/code-verification/references/verdict-schema.md) § Confidence level):
-
-- `HIGH` — every requirement row is `MET`, every finding carries a disposition, and the report cites
-  its evidence. `HIGH` says the evidence needs no re-check.
-- `MEDIUM` — the verdict holds but evidence gaps remain; name them.
-- `LOW` — the verdict rests on unverified assumptions that could plausibly flip it; name them.
-
-A missing line, a level outside the enum, or a `HIGH` the rows do not earn turns an otherwise usable
-PASS into a refused one: consumer repositories gate the review answer artifact and every level it
-claims, exactly as they gate the verify answer. This is a contract change — review answers written
-before it were never asked for a level, so pre-adoption artifacts read as debt, not defects.
-
-**Machine-checked at the gate.** The pipeline's own review PASS edges enforce the line before verify:
-`residual-scan review-gate` reads the recorded `### Review` body, and a missing, duplicated or
-out-of-enum level becomes a **blocking** `review-contract` item — `review → verify` stops and the run
-enters `review-fail-triage` with the bounded repair hop, exactly as an open P1–P3 row does. The gate
-checks the recorded section's presence and vocabulary; the same scanner grades the answer passed
-by both PASS edges and refuses a `LOW` (or ungraded) PASS unless the operator sets
-`ackLowConfidence` exactly to `true` (task 1204 — the same policy the verify
-chain enforces), so whether a level is *earned* stays a judgement call (see the earning rule above):
-the report must still argue it.
+**No confidence line (F511, task 1207).** Review reports do not state, and no gate reads, an
+asserted `Confidence: HIGH | MEDIUM | LOW`. A model that can write a PASS can write `HIGH`, so the
+gate grades what is checkable instead: the recorded section's presence and vocabulary, and the
+findings disposition — an open P1–P3 row blocks the edge exactly as before. What a reviewer would
+formerly have compressed into a level belongs in the report body: name the evidence gaps and the
+assumptions explicitly, so a reader can re-check them. (The derived confidence family is
+untouched: feature-verification receipts under ADR-131, the decision subsystem threshold, and
+history-anatomy reading.)
 
 **Source citations for external claims (one claim contract, 2026-10-12).** A Finding cell or a
 Functional Traceability `Evidence` cell that asserts an external API/library claim carries a
@@ -260,8 +243,9 @@ answer's rule verbatim, owned by
 for external claims — claim markers and accepted forms are defined once there and are not restated
 here. The findings table's `Location` column does not stand in for it: `Location` anchors the
 finding's subject, not the claim's source. Cell-free receipts (test counts, reviewed-log notes)
-assert no external claim and need no citation. An uncited external claim is an assumption, so it
-caps the level the report can defend (above).
+assert no external claim and need no citation. An uncited external claim is an assumption: name it
+as an explicit gap in the report body (above), so a reader can re-check it.
+
 
 **Machine-checked at the gate (findings table).** `residual-scan review-gate` applies the same two
 predicates to every finding row: a Finding cell carrying one of the verify lint's claim markers with

package/plugins/sp/commands/dev-review.md

@@ -43,7 +43,7 @@ Put the target first: a bare token after `--worktree` is read as the worktree na
 - **WBS mode (per task target):** `Skill(skill="sp:functional-review", args="<wbs> $FLAGS")` + `Skill(skill="sp:code-verification", args="review <wbs> $FLAGS")` + `Skill(skill="sp:code-improvement", args="<wbs> $FLAGS")` (functional traceability + SECUA framework + architectural depth — each skill receives its one resolved WBS exactly once plus `$FLAGS` = `$ARGUMENTS` minus the selector (`--tasks`/`--feature`/`--scope` or positional) and its value, never the raw selector, and returns a review fragment only — F92 0593 R1)
 - **Task fan-out (`--tasks` / `--feature`).** One WBS-mode review per task in the frozen set. Tasks in `backlog`/`todo`/`blocked` are reported NOT-STARTED and skipped (§ 3a outcome vocabulary); a per-task failure does not stop the remaining tasks. Each implemented task gets its own merged `## Review`; the run ends with a combined summary table (WBS, verdict, P1/P2 counts).
 - Coordinator = this session. No `sp:super-reviewer` subagent is dispatched: act as the review coordinator defined in [agents/super-reviewer.md](../agents/super-reviewer.md) — merge the fragments per its Output Format (native `P1`–`P4` priority cells, section-relative headings) and, for every task target (standalone or pipeline), write that task's combined `## Review` via `spur task update <wbs> --section Review --from-file`. Path mode emits advisory output only.
-- **Answer contract (pipeline dispatches).** The captured review answer (`.spur/run/<runId>-review-answer.txt`) must carry exactly one `Verdict: PASS|FAIL` line and exactly one `Confidence: HIGH|MEDIUM|LOW` line stating how strongly the review stands behind its verdict — HIGH = the reviewer re-executed the checks behind the verdict, MEDIUM = partial reliance on prior/external evidence, LOW = key evidence not re-executed. The pipeline's PASS edges admit HIGH/MEDIUM unadorned; LOW or an absent line crosses only with the operator's `ackLowConfidence` (same policy as the verify confidence gate, task 1068).
+- **Answer contract (pipeline dispatches).** The captured review answer (`.spur/run/<runId>-review-answer.txt`) must carry exactly one `Verdict: PASS|FAIL` line; the PASS edges grep it before the review gate runs. No confidence line exists and none is graded (F511, task 1207): model-asserted confidence is not verification — the gate's job is the findings disposition, and an open P1–P3 finding blocks the edge on its own.
 - **Path mode (per path target):** `Skill(skill="sp:code-verification", args="review <path> $FLAGS")` + `Skill(skill="sp:code-improvement", args="<path> $FLAGS")` (advisory SECUA quality + architectural depth — one normalized path forwarded once plus `$FLAGS`; performs no task mutation). Under `--scope <path>[,<path>]`: paths must exist (exit 2 otherwise), are normalized, duplicates dropped and nested paths collapse to the ancestor (`--scope apps,apps/cli` → `apps`); each surviving path gets a sub-review (Step 3p path scope), eligible for native-subagent dispatch per [dispatch-surface.md](../skills/parallel-execution/references/dispatch-surface.md); the coordinator merges the sub-reviews, runs **one** cross-path architecture pass (`sp:code-improvement` over the inter-path imports), and emits **one** advisory report. No task mutation.
 - **Positional alias (deprecated).** A positional `<wbs|path>` is accepted for one release: a `^\d{4}$` token with a resolvable task behaves as `--tasks <wbs>`; an existing path as `--scope <path>`; otherwise exit 2. Print a deprecation warning naming the replacement selector; removal is a follow-up.
 - `--triage`: after the review returns, run the triage protocol in [dev-operations.md § 2. review](../skills/spur-dev/references/dev-operations.md#2-review) **inline in this session** — the review skills and `sp:super-reviewer` stay report-only. With multiple targets, bucket the findings across all targets once (identical `file:line` findings deduped before bucketing). `Edit`/`Write` in `allowed-tools` exist only for these direct fixes.