@gobing-ai/spur 0.4.7 → 0.4.9

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.4.7",
+            "version": "0.4.9",
             "source": "./plugins/sp"
         }
     ]

package/config/pipeline-budgets.json

@@ -1,7 +1,7 @@
 {
     "schemaVersion": 1,
     "generatedAt": "2026-08-20T00:00:00.000Z",
-    "note": "Per-pipeline model-query + wall-clock cost budgets (task 0607 R3). modelQueries anchors the live workflow definitions' query lists — the SSOT, extracted by extractResolvedWorkflowFacts and guarded by composition-baseline.test.ts (0775 retired the snapshot this file previously anchored to). wallClockMs is a gross-regression ceiling anchored to measured real-run data (R5): the gate compares the median-of-sane terminal-run wall-clock against it. A null budget is unenforced until measured — never treated as 0. Raising a numeric budget requires a fresh recorded decision in the same commit (config/pipeline-budgets.json vs git HEAD); the check-pipeline-budgets gate fails a silent raise by name.",
+    "note": "Per-pipeline model-query + wall-clock cost budgets (task 0607 R3). modelQueries anchors the live workflow definitions' query lists — the SSOT, extracted by extractResolvedWorkflowFacts and guarded by composition-baseline.test.ts (0775 retired the snapshot this file previously anchored to). wallClockMs is a gross-regression ceiling anchored to measured real-run data (R5): the gate compares the median-of-sane terminal-run wall-clock against it. A null budget is unenforced until measured — never treated as 0. Raising a numeric budget requires a fresh recorded decision in the same commit (config/pipeline-budgets.json vs git HEAD); the `spur workflow cost --budget` gate fails a silent raise by name.",
     "budgets": {
         "task-pipeline": {
             "modelQueries": 4,
@@ -39,7 +39,7 @@
             "modelQueries": 3,
             "wallClockMs": null,
             "tokenCostUsd": null,
-            "source": "Coverage entry (0826 R2): the live definition's model-query count (extractResolvedWorkflowFacts, 2026-09-11). No real-run measurement yet: wall-clock and cost are unenforced until measured, never 0. 0920 recount 2026-09-23: 4 -> 3 — the resolve-scope model hop was removed; scope/window validation is deterministic in the history-anatomy-cache paths command.",
+            "source": "Coverage entry (0826 R2): the live definition's model-query count (extractResolvedWorkflowFacts, 2026-09-11). No real-run measurement yet: wall-clock and cost are unenforced until measured, never 0. 0920 recount 2026-09-23: 4 -> 3 — the resolve-scope model hop was removed; scope/window validation is deterministic in the `spur history anatomy paths` op (history-anatomy-cache before script-absorption PR-6).",
             "decision": null
         },
         "wayfinder-resolution": {

package/config/rules/boundary/config-loading-ownership.yaml

@@ -67,6 +67,7 @@ rules:
     exclude:
       - "packages/config/src/**"
       - "apps/cli/src/index.ts"
+      - "apps/cli/src/workflow-transport.ts" # boot-free composition root of `spur workflow inline|commit-guard` (PR-4)
       - "apps/server/src/serve.ts"
       - "apps/server/src/context.ts"
       - "**/tests/**"

package/config/rules/boundary/sp-plugin-standalone.yaml

@@ -12,7 +12,7 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 # - plugins/sp/hooks/**, plugins/sp/scripts/**, plugins/sp/lib/** may value-import
 #   only `node:*` builtins and relative paths (vendored helpers live in plugins/sp/lib/).
 # - `import type` / `export type` from any package is fine — erased before bundling
-#   (e.g. inline-run-setup.ts's type-only import from @gobing-ai/app).
+#   (a type-only import from @gobing-ai/app is safe).
 # - This rule is the author-time tripwire over DIRECT imports; the transitive closure
 #   and the real `superskill install` path are checked by `bun run plugin-smoke`, and
 #   script-contract-check Rule 5 (manifest-aware) fails the spur-check gate.

package/config/rules/boundary/sp-script-placement.yaml

@@ -6,7 +6,7 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 # stays in spur-check-feature.
 rules:
   - id: sp-script-placement
-    description: "Plugins/sp scripts must honor the ADR-130 placement contract (glue budget, no db imports, no corpus parsing, no noun clash); baseline config/script-placement-baseline.json can only shrink."
+    description: "Plugins/sp scripts must honor the ADR-130 placement contract (glue budget, no db imports, no corpus parsing, no noun clash, ADR-129 hook layout); any finding fails (task 1213 retired the baseline ledger)."
     severity: error
     evaluator:
       type: exit-code

package/config/rules/docs/sourced-api-claims.yaml

@@ -29,12 +29,23 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 # citation (URL or path:line) AND a confidence level (HIGH/MEDIUM/LOW) — is
 # owned by the sp-source-driven-development skill and verified in SECUA review
 # (code-verification secu-review checklist). These rules are its deterministic
-# backstop: the two `cited-*` rules cover the citation half, and
-# `cited-api-claims-confidence` covers the level half. All are severity `info`,
+# backstop: the three `cited-*` rules cover the citation half, and
+# `cited-api-claims-confidence` covers the level half.
+# `cited-high-confidence` covers the HONESTY half — the level is a claim like
+# any other, so the one level that asserts "verified this session" must show the
+# source it was verified against. MEDIUM (recalled, plausibly stale) and LOW
+# (memory only) require no anchor by contract and are deliberately not flagged.
+# All are severity `info`,
 # and the category is deliberately NOT in `recommended-pre-check` — it surfaces
 # findings for review without reddening gates. The 2026-10-12 audit below settled
 # the promotion question: the residual findings stay a review-surface concern
 # (SECUA checklist), not a gate one — do not add `- docs` to that preset.
+#
+# Fenced-code behavior (measured 2026-10-16, `spur rule run --file … --json` over a
+# probe doc): code fences are NOT skipped by the regex evaluator — every rule here
+# fires on a matching line inside a fence. The earlier note claiming fenced lines
+# were "out of regex reach" was wrong; fence noise is one more reason these stay
+# `info` and ad hoc rather than gated.
 include:
   - "docs/**/*.md"
   - "plugins/sp/skills/**/references/**/*.md"
@@ -66,11 +77,12 @@ rules:
         # contains a semver-ish token. Lookarounds exclude IPs (127.0.0.1),
         # longer dotted numerics, a heading's section number (`### 1.0.1 Title`),
         # a document-version metadata line (`version: 1.69.0`) and a `§`-numbered
-        # section reference (`§7.3.1`) — none of which is an external claim;
-        # fenced-code lines are out of regex reach — that residual noise is why
-        # this is info, not warning. The `§` guard sits on the token itself, not on
-        # the line, so a line carrying both a section reference and a real version
-        # still fires on the version.
+        # section reference (`§7.3.1`) — none of which is an external claim.
+        # Fenced code and command examples can legitimately carry bare versions and
+        # are NOT skipped by the evaluator (measured 2026-10-16) — that residual
+        # noise, with the above, is why this is info, not warning. The `§` guard sits
+        # on the token itself, not on the line, so a line carrying both a section
+        # reference and a real version still fires on the version.
         pattern: "^(?!.*(?:https?://|(?:[\\w.-]+/)+[\\w.-]+:\\d+))(?!\\s*#{1,6}\\s+\\d+\\.\\d+\\.\\d+)(?!\\s*[\\w-]+:\\s*\\d+\\.\\d+\\.\\d+\\s*$).*(?<![\\d.§])\\d+\\.\\d+\\.\\d+(?!\\.\\d)"
   - id: cited-api-claims
     description: >
@@ -103,3 +115,29 @@ rules:
         # `cited-api-claims` exactly, so the two rules never disagree about which
         # lines are claims.
         pattern: "^(?!.*\\b(?:HIGH|MEDIUM|LOW)\\b).*\\b(?:deprecated (?:since|in|as of)|introduced in|added in|available since|stable since)\\b"
+  - id: cited-high-confidence
+    description: >
+      A line stating HIGH confidence about an external API/library claim must
+      carry a source citation anchor on the same line — URL or repo path:line.
+      The claim contract (sp-source-driven-development) defines HIGH as
+      "verified against the pinned version's docs/source THIS SESSION", so an
+      uncited HIGH is the one level that cannot be honest: MEDIUM is recalled and
+      plausibly stale, LOW is memory only, and both are explicitly allowed
+      without a source (LOW must never be presented as fact — that stays a review
+      judgment, not a regex). Scoped to the same claim verbs as
+      `cited-api-claims`, so the two rules agree on which lines are claims: a
+      decision record's own `Confidence:` grade (the brainstorm family) is a
+      different contract and is deliberately out of scope. Pairs with
+      `cited-api-claims-confidence`, which catches a claim line carrying no level
+      at all.
+    severity: info
+    evaluator:
+      type: regex
+      config:
+        mode: forbid
+        # Fires when a claim line names HIGH but carries no anchor. The anchor
+        # vocabulary is identical to its siblings (URL or `path:line`), so one
+        # line cannot read as cited for one rule and uncited for another. The level
+        # is asserted with a lookahead so either prose order matches — `(HIGH)` after
+        # the claim (the usual form) and `HIGH — <claim>` both count.
+        pattern: "^(?!.*(?:https?://|(?:[\\w.-]+/)+[\\w.-]+:\\d+))(?=.*\\bHIGH\\b).*\\b(?:deprecated (?:since|in|as of)|introduced in|added in|available since|stable since)\\b"

package/config/rules/strict/runtime-boundaries.yaml

@@ -37,6 +37,13 @@ rules:
             - "apps/desktop/src/server-process.ts"
 
             # Low-level system primitives:
+            # `spur builder pr` spine (script-absorption PR-7, moved from plugins/sp/scripts/pr-reviewing.ts):
+            # every git/gh call goes through ONE synchronous, test-injectable CommandRunner seam
+            # (`setCommandRunner`); the spine is synchronous end to end (wait polls with a sync sleep).
+            # The ts-runtime sync executors cannot stand in: NodeSyncProcessExecutor maps a spawn
+            # failure (gh/git missing) to a bare exit 1 and drops the reason the spine reports, and
+            # both strip the final newline. Output bytes are pinned by the PR-7 golden.
+            - "packages/app/src/services/pr-review/index.ts"
             - "packages/app/src/services/quality-gate.ts" # gate runs `sh -c` with stdout+stderr merged onto ONE fd; ProcessExecutor captures streams separately and cannot reproduce the stream-order contract (task 1006 R1; mirrors the history-anatomy bundling exemptions)
             # The feature-verification pass runs one long command with stdout+stderr merged onto the
             # run's single log fd and a 4 h ceiling (the frozen contract from task 0915: `safe argv
@@ -44,6 +51,13 @@ rules:
             # and exposes no timeout, so it cannot reproduce either half (task 1176 R2; same class as
             # the quality-gate exemption above).
             - "packages/app/src/workflow/feature-verification-run.ts"
+            # `spur task wrapup` steps (script-absorption PR-5, plan §3.4), pinned to the retired plugin
+            # scripts' golden output by apps/cli/tests/script-absorption-pr5-parity.test.ts. The feature gate
+            # (`sh -c`) and `task resolve` run with stdio/stderr INHERITED so their output streams into the
+            # workflow run log in order, and every step is synchronous; ProcessExecutor captures the streams
+            # separately and cannot inherit them (same class as the quality-gate exemption above).
+            - "packages/app/src/workflow/wrapup/steps.ts"
+            - "packages/app/src/workflow/wrapup/drift-probe.ts" # sync nested `spur task show` reads beside steps.ts (same exemption)
 
   - id: no-direct-fs-io
     description: "Prefer ts-runtime's FileSystem seam for fs IO."
@@ -66,6 +80,15 @@ rules:
 
             # Low-level system primitives (O_EXCL locks, FD byte-tailing, FS watcher, atomic registry, Vite glob fallback):
             - "packages/domain/src/planning/locks.ts" # POSIX atomic O_EXCL file locks
+            # Script-absorption PR-6: synchronous op modules whose file bytes are pinned by the
+            # PR-6 golden (apps/cli/tests/script-absorption-pr6). They keep the retired scripts'
+            # sync node:fs reads/writes (atomic publish rename, porcelain baselines, env/report
+            # writes, transcript and progress reads, the daily summary file + latest.json pointer);
+            # the async FileSystem seam would turn every op async and reorder their output.
+            - "packages/app/src/services/history-anatomy-cli.ts"
+            - "packages/app/src/services/session-timeline.ts"
+            - "packages/app/src/workflow/run-summary-cli.ts"
+            - "packages/app/src/services/daily-summary.ts"
             - "packages/domain/src/retention.ts" # recursive backup-dir reclamation + mtime stat (task 0622 R8); ts-runtime FileSystem seam has no recursive dir remove
             - "packages/app/src/services/token-ledger-service.ts" # FD byte-window log tailing
             - "packages/app/src/services/token-ledger-watcher.ts" # node:fs watch() live watcher
@@ -78,11 +101,27 @@ rules:
             - "packages/app/src/services/history-anatomy.ts" # deterministic history-anatomy cache core (task 1005 R2): fsync'd tmp+rename atomic publish, readdir digest scans and sync report reads must stay byte-stable; bundled standalone for the bare-node plugin twin (mirrors agent-usage-producer.ts / history-service.ts exemptions)
             - "packages/app/src/observability/workflow-run-log-sink.ts" # sync FD append for mid-run tail-able all-in-one run log (task 0426 / feature D2); append() is sync from the observability bus
             - "packages/app/src/observability/agent-run-log.ts" # same primitive as the sink above for the per-run agent stream (task 1076 R1, ADR-132); append() is sync from the agent service's own onOutput hook, and the byte cap needs the FD position it tracks
+            # Inline-driver transports (script-absorption PR-4, `spur workflow inline|commit-guard`): moved
+            # verbatim from the plugin scripts with their golden output pinned; synchronous probes and
+            # atomic tmp+rename snapshot writes inside one short-lived CLI process.
+            - "packages/app/src/workflow/commit-guard.ts" # .spur/run/<run>-tree-start.json atomic snapshot + target conflict-marker reads
+            - "packages/app/src/workflow/persist-check.ts" # recursive evidence-tree listing + byte comparison of both trees
+            - "packages/app/src/workflow/run-summary-render.ts" # close-step .spur/run/<run>-summary.{md,json} write (1146 R1)
+            - "packages/app/src/workflow/transcript.ts" # read-only host-transcript resolution (existsSync/readdirSync)
             # commands/workflow.ts was split per verb (commands/workflow/<verb>.ts); the FD tail lives in trace.ts.
             - "apps/cli/src/commands/workflow/trace.ts" # FD byte-window tail of the mid-run run log for `workflow trace --follow` streaming (task 0428 / feature D2); readSync at offset over the observability sink's FDs
             - "apps/web/src/modules/discover.ts" # Vite/Astro module scanner fallback under bun test
-            - "packages/app/src/services/quality-gate.ts" # gate artifacts (log/findings/receipt) written directly; merged-fd gate log and fsync-free atomic writes must stay byte-stable; bundled standalone for the bare-node plugin twin (task 1006 R1; mirrors history-anatomy.ts)
+            - "packages/app/src/services/quality-gate.ts" # gate artifacts (log/findings/receipt) written directly; merged-fd gate log and fsync-free atomic writes must stay byte-stable (task 1006 R1; `spur task gate` since script-absorption PR-3; mirrors history-anatomy.ts)
+            - "packages/app/src/workflow/wrapup/steps.ts" # `spur task wrapup` steps (script-absorption PR-5): sync status/metrics appends and run-artifact writes byte-pinned to the retired plugin scripts' golden output (apps/cli/tests/script-absorption-pr5-parity.test.ts); the FileSystem seam is async and has no append
+            - "packages/app/src/workflow/wrapup/drift-probe.ts" # drift-probe step beside steps.ts (same exemption)
+            # Script-absorption PR-3: the residual sweep and triage diffstat glue moved here from the retired
+            # plugin scripts (`spur task residual` / `spur task diffstat`). Same class as quality-gate.ts:
+            # synchronous `wx`/tmp+rename artifact writes, mtime-ordered verdict copies, and an fstat(1)
+            # dev/ino identity check (1067 R3) that the async FileSystem seam cannot express.
+            - "packages/app/src/services/residual-scan-run.ts"
+            - "packages/app/src/workflow/task-diffstat.ts"
             - "packages/app/src/workflow/feature-verification-run.ts" # the pass opens the run's single merged log fd (`openSync(path,'a')`) and mkdirs the run dir beside the receipt writer, exactly as the plugin entry did before the move; the fd cannot be expressed through the FileSystem seam (task 1176 R2; same class as the quality-gate exemption above)
+            - "packages/app/src/services/pr-review/index.ts" # `spur builder pr` (PR-7): sync --status-file verdict writes and the AGENTS.md review-rules probe inside the synchronous spine (same exemption as its process seam above)
             - "packages/app/src/services/run-storage.ts" # durable-evidence migration core (task 1025 R4): atomic tmp+rename byte copies with digest reread and atomic manifest publish must stay byte-stable (mirrors agent-usage-producer.ts / project-registry.ts exemptions)
             - "packages/app/src/services/durable-plane-ignore.ts" # .git/info/exclude append moved verbatim out of run-storage.ts to break an import cycle (same exemption)
 

package/config/rules/structure/protected-files.yaml

@@ -42,7 +42,7 @@ rules:
             - "apps/desktop/resources/"
             # `apps/cli/plugins/` is the same kind of gitignored build:bundle output — a staged
             # npm copy of `plugins/`, itself outside the include scope. Minified generated libs
-            # there trip the api-key shape (0976: HEAD's inline-run.generated.mjs fires too).
+            # there tripped the api-key shape (0976; the generated libs were retired by script-absorption PR-6).
             - "apps/cli/plugins/"
 
   - id: no-unsafe-git-commands

package/config/rules/surface/check-cli-surface.yaml

@@ -28,6 +28,8 @@ rules:
     exclude:
       # Per-noun shared.ts holds helpers used by 2+ verbs; it registers nothing.
       - "apps/cli/src/commands/*/shared.ts"
+      # Byte-exact stdout/stderr writer for the absorbed pipeline steps (script-absorption PR-5); registers nothing.
+      - "apps/cli/src/commands/task/step-output.ts"
     evaluator:
       type: rg
       config:
@@ -51,6 +53,37 @@ rules:
       - "apps/cli/src/commands/agent/loop.ts"
       - "apps/cli/src/commands/agent/start.ts"
       - "apps/cli/src/commands/agent/stop.ts"
+      # Absorbed pipeline steps (script-absorption PR-5): the app operation renders the golden-pinned
+      # text/JSON (planning-preflight.ts JSON.stringify for `task preflight --json`, batch-plan.ts for
+      # `task batch-plan`); wrapup, feature verify/handoff declare no --json. step-output.ts writes bytes.
+      - "apps/cli/src/commands/task/batch-plan.ts"
+      - "apps/cli/src/commands/task/preflight.ts"
+      - "apps/cli/src/commands/task/step-output.ts"
+      - "apps/cli/src/commands/task/wrapup.ts"
+      - "apps/cli/src/commands/feature/handoff.ts"
+      - "apps/cli/src/commands/feature/verify.ts"
+      # commit-guard declares no --json: its {staged, foreign} / {foreign} lines are rendered by
+      # @gobing-ai/spur-app/commit-guard (byte-identical to the retired script, PR-4 golden).
+      - "apps/cli/src/commands/workflow/commit-guard.ts"
+      # Pipeline-internal task verbs (script-absorption PR-3) declare no --json: their contract is
+      # the .spur/run artifact they write (gate status/receipt, residuals.json, diffstat.json) and
+      # the exit code; the gate's own status line is serialized by the app service.
+      - "apps/cli/src/commands/task/gate.ts"
+      - "apps/cli/src/commands/task/residual.ts"
+      - "apps/cli/src/commands/task/diffstat.ts"
+      # Absorbed measurement/report verbs (script-absorption PR-6): the app module serializes the
+      # golden-pinned JSON (step-profile-cli for `workflow profile --json`, run-summary-cli for
+      # `workflow summary`, session-timeline for `history timeline`, history-anatomy-cli for the
+      # anatomy ops); `history summary` writes Markdown and declares no --json.
+      - "apps/cli/src/commands/workflow/profile.ts"
+      - "apps/cli/src/commands/workflow/summary.ts"
+      - "apps/cli/src/commands/history/anatomy.ts"
+      - "apps/cli/src/commands/history/timeline.ts"
+      - "apps/cli/src/commands/history/summary.ts"
+      # Absorbed dogfood / PR-review spines (script-absorption PR-7): --json is rendered by
+      # @gobing-ai/spur-app/dogfood and @gobing-ai/spur-app/pr-review (JSON.stringify), not the CLI envelope.
+      - "apps/cli/src/commands/agent/dogfood.ts"
+      - "apps/cli/src/commands/builder/pr.ts"
     evaluator:
       type: rg
       config:

package/config/rules/typescript/no-debugger.yaml

@@ -14,6 +14,9 @@ include:
   - "scripts/**/*.ts"
 exclude:
   - "**/tests/**"
+  # The PR-review hygiene scanner matches the word in diff text (a /\bdebugger\b/ WARN pattern);
+  # it holds no statement. Biome noDebugger still guards the file (script-absorption PR-7).
+  - "packages/app/src/services/pr-review/index.ts"
 rules:
   - id: no-debugger-statement
     description: >

package/config/workflow-candidates.json

@@ -7,7 +7,7 @@
             "canonical": "task-pipeline",
             "deadline": "2026-11-24",
             "createdAt": "2026-09-25",
-            "rationale": "0943 (feature D64): task-pipeline work routes by triage lane and failure class instead of static graphs. Between a green gate and the review/verify fork a deterministic `triage` state writes the diffstat (plugins/sp/scripts/task-diffstat.ts, numstat + untracked scan against the precheck-anchored run base), honors a caller-set mode verbatim (never overridden), pins the safety lane on sensitive paths (drizzle/, packages/config/, server auth basenames, *secret*, .github/, plugins/sp/hooks/, *.sql) or >400 changed lines with NO model call, otherwise consults `decide task-triage` (low → fast lane skips review; standard/high → review), and appends the route reason to .spur/memory/task-pipeline-routes.log (R5). On a red gate, `decide failure-class` routes retryable → test-recheck (attempt counted, qualityGateMaxFixAttempts still bounds), fix → test-fix, stop → failed(failed-check); missing/corrupt decision fails closed. Projected basis: the 0938 baseline (docs/reports/2026-09-workflow-cost-baseline.md) measured task-pipeline wall median 7983s over 1 real terminal run with agent.run median 0; the fast lane saves the review agent.run + wall on triage-low diffs, and retryable classification saves fixall hops (and their gate re-runs) on transient failures. Measurement gap honestly named: with workflow.decideDecisionMaker off (R4) triage degrades to standard lanes (diffstat-guard-sensitive/large still forced safety — pure shell, no model), so benefit only materializes with the flag on; per-lane route counts are observable post-merge in .spur/memory/task-pipeline-routes.log. Measured-benefit status: projected from 0938, NOT shadow-run-confirmed — plan step 5 (recorded-input shadow runs) is DEFERRED out of the 0943 session and tracked by this candidate's deadline; `promotion evaluate` runs post-merge. If it does not beat the baseline, it is reverted (ADR-076).",
+            "rationale": "0943 (feature D64): task-pipeline work routes by triage lane and failure class instead of static graphs. Between a green gate and the review/verify fork a deterministic `triage` state writes the diffstat (`spur task diffstat`, formerly plugins/sp/scripts/task-diffstat.ts; numstat + untracked scan against the precheck-anchored run base), honors a caller-set mode verbatim (never overridden), pins the safety lane on sensitive paths (drizzle/, packages/config/, server auth basenames, *secret*, .github/, plugins/sp/hooks/, *.sql) or >400 changed lines with NO model call, otherwise consults `decide task-triage` (low → fast lane skips review; standard/high → review), and appends the route reason to .spur/memory/task-pipeline-routes.log (R5). On a red gate, `decide failure-class` routes retryable → test-recheck (attempt counted, qualityGateMaxFixAttempts still bounds), fix → test-fix, stop → failed(failed-check); missing/corrupt decision fails closed. Projected basis: the 0938 baseline (docs/reports/2026-09-workflow-cost-baseline.md) measured task-pipeline wall median 7983s over 1 real terminal run with agent.run median 0; the fast lane saves the review agent.run + wall on triage-low diffs, and retryable classification saves fixall hops (and their gate re-runs) on transient failures. Measurement gap honestly named: with workflow.decideDecisionMaker off (R4) triage degrades to standard lanes (diffstat-guard-sensitive/large still forced safety — pure shell, no model), so benefit only materializes with the flag on; per-lane route counts are observable post-merge in .spur/memory/task-pipeline-routes.log. Measured-benefit status: projected from 0938, NOT shadow-run-confirmed — plan step 5 (recorded-input shadow runs) is DEFERRED out of the 0943 session and tracked by this candidate's deadline; `promotion evaluate` runs post-merge. If it does not beat the baseline, it is reverted (ADR-076).",
             "measurement": {
                 "workflow": "task-pipeline"
             },
@@ -39,7 +39,7 @@
             "canonical": "wrapup-pipeline",
             "deadline": "2026-11-24",
             "createdAt": "2026-09-25",
-            "rationale": "0944 (feature D64): a deterministic probe (plugins/sp/scripts/wrapup-drift-probe.ts) runs only when the caller leaves wrapup mode empty and projects mode=fast when no changed path matches a doc-owned surface (AGENTS.md doc map + docs/99_PROJECT_CONSTITUTION.md ownership table) and every task's Solution change map parsed — clean wraps then skip doc-sync via the existing fast edge (fast:drift-probe-clean), any doubt stays on the safety path. Projected basis: doc-sync costs exactly 1 agent.run per wrapup (wrapup-pipeline declares one model query; 0938 baseline docs/reports/2026-09-workflow-cost-baseline.json has 0 recorded wrapup runs — agentRunCountMedian null — so the 1 is structural, never a measured median). Measurement gap honestly named: skipping doc-sync also skips learnings capture (0607 R2 merge), so clean wraps lose per-task learnings rows; measured post-promotion by comparing .spur/memory/wrapup-routes.log fast:drift-probe-clean counts against captured <runId>-wrapup-learnings.md files. For 0946 (measurement-only confirmation): the 0938 snapshot carries per-state rows in states[] but history-anatomy has zero of them (0 recorded runs — only task-pipeline/record exists), and cache hit/miss disposition lives in the history-anatomy provenance stamp (0659/0660, history-anatomy-cache.ts), not in real-run-cost.ts; terminalReasonMix exists per workflow but history-anatomy's is empty. Measured-benefit status: projected from structure + 0938, NOT shadow-run-confirmed; `promotion evaluate` runs post-merge. If it does not beat the baseline, it is reverted (ADR-076).",
+            "rationale": "0944 (feature D64): a deterministic probe (`spur task wrapup drift-probe`, packages/app/src/workflow/wrapup/drift-probe.ts since script-absorption PR-5) runs only when the caller leaves wrapup mode empty and projects mode=fast when no changed path matches a doc-owned surface (AGENTS.md doc map + docs/99_PROJECT_CONSTITUTION.md ownership table) and every task's Solution change map parsed — clean wraps then skip doc-sync via the existing fast edge (fast:drift-probe-clean), any doubt stays on the safety path. Projected basis: doc-sync costs exactly 1 agent.run per wrapup (wrapup-pipeline declares one model query; 0938 baseline docs/reports/2026-09-workflow-cost-baseline.json has 0 recorded wrapup runs — agentRunCountMedian null — so the 1 is structural, never a measured median). Measurement gap honestly named: skipping doc-sync also skips learnings capture (0607 R2 merge), so clean wraps lose per-task learnings rows; measured post-promotion by comparing .spur/memory/wrapup-routes.log fast:drift-probe-clean counts against captured <runId>-wrapup-learnings.md files. For 0946 (measurement-only confirmation): the 0938 snapshot carries per-state rows in states[] but history-anatomy has zero of them (0 recorded runs — only task-pipeline/record exists), and cache hit/miss disposition lives in the history-anatomy provenance stamp (0659/0660, `spur history anatomy`, formerly history-anatomy-cache.ts), not in real-run-cost.ts; terminalReasonMix exists per workflow but history-anatomy's is empty. Measured-benefit status: projected from structure + 0938, NOT shadow-run-confirmed; `promotion evaluate` runs post-merge. If it does not beat the baseline, it is reverted (ADR-076).",
             "measurement": {
                 "workflow": "wrapup-pipeline"
             },

package/config/workflows/feature-verification.yaml

@@ -21,8 +21,9 @@
 # shipped entry no longer provides, and the entry path. Reinstalling or upgrading the
 # plugin cannot supply a retired export — only the two remedies above can.
 #
-# Shape: verify -> done | failed. The onEnter step runs the standard script
-# `feature-verification-steps.ts` (no public CLI verb, D63 task 0915): it
+# Shape: verify -> done | failed. The onEnter step runs `spur feature verify`
+# (D63 task 0915; script-absorption PR-5 retired the feature-verification-steps
+# plugin script): it
 # resolves this very definition for the verifier identity (name, source path,
 # layer, definition digest), records the RUNNING receipt (run-scoped +
 # feature-latest copies), registers the run-scoped receipt as a run artifact,
@@ -64,21 +65,15 @@ vars:
 states:
   - id: verify
     description: >
-      Run the repo-wide check set via the standard verification script, which
+      Run the repo-wide check set via `spur feature verify`, which
       records the bound evidence receipt (verifier identity, checked-input
       digest, run identity) and the coarse status file, always exit 0 so the
       transition guard routes missing/corrupt/FAIL to `failed`.
     onEnter:
-      # 0960 R2: run-start script-resolution identity — record which tree this run
-      # resolved (source-repo vs installed) before the verification step runs. Never aborts.
       - kind: shell
         options:
           command: >-
-            S=plugins/sp/scripts/script-root.ts; [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp script-root.mjs 2>/dev/null)"; RUNNER=bun; case "$S" in *.mjs) RUNNER=node ;; esac; [ -f "$S" ] && "$RUNNER" "$S" --run-id "$__runId" --spur-bin "$spurBin" || echo "script-root failed closed — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; exit 0
-      - kind: shell
-        options:
-          command: >-
-            mkdir -p .spur/run; eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/feature-verification-steps.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/feature-verification-steps.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; ACK=""; [ "$ackLowConfidence" = "true" ] && ACK="--ack-low-confidence"; [ -f "$S" ] && "$RUNNER" "$S" verify --feature-id "$featureId" --run-id "$__runId" --spur-bin "$spurBin" --confidence "$confidence" $ACK || printf 'FAIL feature-verification failed closed — script not found — run superskill install sp --marketplace gobing-ai/spur\n' > ".spur/run/$__runId-feature-verification.status"; exit 0
+            mkdir -p .spur/run; ACK=""; [ "$ackLowConfidence" = "true" ] && ACK="--ack-low-confidence"; $spurBin feature verify "$featureId" --run-id "$__runId" --confidence "$confidence" $ACK --no-logo || printf 'FAIL feature-verification failed closed — spur feature verify exited nonzero\n' > ".spur/run/$__runId-feature-verification.status"; exit 0
 
   - id: done
     description: Terminal — repo-wide checks passed and the receipt is bound.
@@ -89,7 +84,7 @@ states:
 transitions:
   - from: verify
     to: done
-    description: Repo-wide checks passed — the script completed the receipt with PASS.
+    description: Repo-wide checks passed — `spur feature verify` completed the receipt with PASS.
     guard:
       kind: shell
       options:

package/config/workflows/history-anatomy.yaml

@@ -4,7 +4,7 @@
 # Orchestration is configuration (ADR-022): a state machine over the existing dual-workflow
 # engine. The YAML owns ONLY the cache branch, deterministic stage ordering, executor dispatch,
 # bounded correction, and atomic publication sequencing. The deterministic cache/digest/
-# structure/publish work is 0659's dependency-free helper script; the judgment (mode validity,
+# structure/publish work is `spur history anatomy <op>` (0659's helper, absorbed by script-absorption PR-6); the judgment (mode validity,
 # what counts as evidence, the report contract, enrich/validate rubrics) is 0658's skill. Per
 # ADR-069 R1, cache-decide / digest / structure-check / publish must NOT be inline shell — every
 # shell action here is glue length (a single helper invocation), because each of those programs
@@ -100,16 +100,6 @@ states:
           # reclamation path (unlike the run-record pair and legacy `.log` files, which
           # `spur workflow clean --logs` owns). It is deliberately NOT a run record and is
           # exempt from the catalog record-name sweep (see run-record-catalog.test.ts).
-
-
-      # 1007 R8: run-start script-resolution identity (same command as feature-verification
-      # verify's first action), placed AFTER the id allocation above — the snippet reads
-      # .spur/run/$__runId-script-root.json, so it needs the allocated id. Later
-      # plugin-script actions resolve through it (1007 R4 snippet). Never aborts.
-      - kind: shell
-        options:
-          command: >-
-            S=plugins/sp/scripts/script-root.ts; [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp script-root.mjs 2>/dev/null)"; RUNNER=bun; case "$S" in *.mjs) RUNNER=node ;; esac; [ -f "$S" ] && "$RUNNER" "$S" --run-id "$__runId" --spur-bin "$spurBin" || echo "script-root failed closed — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; exit 0
   - id: resolve-paths
     description: >
       Resolve the helper, the skill/contract logic paths, and the publication target once, into a
@@ -118,11 +108,11 @@ states:
     onEnter:
       - kind: shell
         options:
-          # Path arithmetic lives in the helper (ADR-069 R1); the shell only locates it. Avoid
+          # Path arithmetic lives in `spur history anatomy paths` (ADR-069 R1; script-absorption
+          # PR-6 — HA_HELPER is the running spur, HA_SKILL the resolved skill dir). Avoid
           # `${...}` here — that syntax collides with the engine's own template interpolation.
           command: >-
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)";
-            "$RUNNER" "$S" paths --helper "$S" --report-dir "$reportDir" --date "$date"
+            $spurBin history anatomy paths --report-dir "$reportDir" --date "$date"
             --output "$output" --mode "$mode" --since "$since" --until "$until"
             --focus "$focus" --recompute "$recompute" --run-id "$__runId"
             --out .spur/run/$__runId-paths.txt
@@ -155,13 +145,12 @@ states:
       - kind: shell
         options:
           command: >-
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)";
             . .spur/run/$__runId-paths.txt;
-            "$RUNNER" "$S" probe --artifact .spur/run/$__runId-history-anatomy-current.json
+            $spurBin history anatomy probe --artifact .spur/run/$__runId-history-anatomy-current.json
             --baseline .spur/run/$__runId-history-anatomy-baseline.json --target "$HA_TARGET"
             --mode "$mode" --date "$HA_DATE" --recompute "$recompute" --executor "$agent"
             --skill-dir "$HA_SKILL" --contract "$HA_SKILL/references/report-contract.md"
-            --workflow "$workflowFile" --helper "$S" --contract-version "$contractVersion" --run-id "$__runId"
+            --workflow "$workflowFile" --helper "$HA_HELPER" --contract-version "$contractVersion" --run-id "$__runId"
             --out .spur/run/$__runId-provenance.json
             > .spur/run/$__runId-cache-disposition.txt
 
@@ -198,7 +187,7 @@ states:
       - kind: shell
         options:
           command: >-
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; "$RUNNER" "$S" assert-clean --baseline .spur/run/$__runId-baseline-enrich.txt --expect .spur/run/$__runId-candidate.md
+            $spurBin history anatomy assert-clean --baseline .spur/run/$__runId-baseline-enrich.txt --expect .spur/run/$__runId-candidate.md
 
   - id: structure-gate
     description: >
@@ -209,7 +198,7 @@ states:
       - kind: shell
         options:
           command: >-
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; "$RUNNER" "$S" check \
+            $spurBin history anatomy check \
               .spur/run/$__runId-candidate.md > .spur/run/$__runId-structure-gate.txt 2>&1 || true
 
   - id: validate
@@ -267,7 +256,7 @@ states:
           command: >-
             f=.spur/run/$__runId-validation.txt;
             if [ -f "$f" ] && [ "$(grep -cx 'Verdict: FAIL' "$f")" = 0 ] && ! tail -n 1 "$f" | grep -qx 'Verdict: PASS'; then
-              d=$("$spurBin" decision run anatomy-validation-verdict --evidence "$f" --json || true);
+              d=$($spurBin decision run anatomy-validation-verdict --evidence "$f" --json || true);
               v=$(printf '%s' "$d" | jq -r 'if (.source // .data.source) == "model" and (.value // .data.value) == "PASS" then "PASS" else "FAIL" end' 2>/dev/null);
               [ "$v" = "PASS" ] || v="FAIL";
               printf 'Verdict: %s\n' "$v" >> "$f";
@@ -275,7 +264,7 @@ states:
       - kind: shell
         options:
           command: >-
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; "$RUNNER" "$S" assert-clean --baseline .spur/run/$__runId-baseline-validate.txt --expect .spur/run/$__runId-validation.txt
+            $spurBin history anatomy assert-clean --baseline .spur/run/$__runId-baseline-validate.txt --expect .spur/run/$__runId-validation.txt
 
   - id: correct
     description: >
@@ -312,7 +301,7 @@ states:
       - kind: shell
         options:
           command: >-
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; "$RUNNER" "$S" assert-clean --baseline .spur/run/$__runId-baseline-correct.txt --expect .spur/run/$__runId-candidate.md
+            $spurBin history anatomy assert-clean --baseline .spur/run/$__runId-baseline-correct.txt --expect .spur/run/$__runId-candidate.md
 
   - id: refresh-provenance
     description: >
@@ -324,9 +313,8 @@ states:
       - kind: shell
         options:
           command: >-
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)";
             . .spur/run/$__runId-paths.txt;
-            "$RUNNER" "$S" refresh --report "$HA_TARGET"
+            $spurBin history anatomy refresh --report "$HA_TARGET"
             --out .spur/run/$__runId-publishable.md --disposition hit
 
   - id: stamp
@@ -339,9 +327,8 @@ states:
       - kind: shell
         options:
           command: >-
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)";
             . .spur/run/$__runId-paths.txt;
-            "$RUNNER" "$S" stamp --candidate .spur/run/$__runId-candidate.md
+            $spurBin history anatomy stamp --candidate .spur/run/$__runId-candidate.md
             --provenance .spur/run/$__runId-provenance.json
             --out .spur/run/$__runId-publishable.md
 
@@ -354,10 +341,9 @@ states:
       - kind: shell
         options:
           command: >-
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)";
             . .spur/run/$__runId-paths.txt;
             mkdir -p "$(dirname "$HA_TARGET")";
-            "$RUNNER" "$S" publish .spur/run/$__runId-publishable.md "$HA_TARGET"
+            $spurBin history anatomy publish .spur/run/$__runId-publishable.md "$HA_TARGET"
 
   - id: published
     description: Terminal — report published atomically after a passing validation.

package/config/workflows/idea-pipeline.yaml

@@ -88,12 +88,6 @@ states:
       handoff — no task execution. Soft agent doctor (status file) so doctor red
       routes to `failed` via transitions instead of a raw lifecycle abort.
     onEnter:
-      # 0960 R2: run-start script-resolution identity — record which tree this run
-      # resolved (source-repo vs installed) before any step executes. Never aborts.
-      - kind: shell
-        options:
-          command: >-
-            S=plugins/sp/scripts/script-root.ts; [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp script-root.mjs 2>/dev/null)"; RUNNER=bun; case "$S" in *.mjs) RUNNER=node ;; esac; [ -f "$S" ] && "$RUNNER" "$S" --run-id "$__runId" --spur-bin "$spurBin" || echo "script-root failed closed — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; exit 0
       - kind: note
         options:
           message: "Idea pipeline start for idea: ${vars.idea}"
@@ -606,21 +600,14 @@ states:
       A mapping or CLI error fails the run before terminal handoff; an unready
       task is a successful planning outcome recorded as a refineall recommendation.
     onEnter:
-      # (d) idea-handoff owns finalization (0824): the bundled finalizeIdeaHandoff
-      # capability runs from the monorepo checkout first; seeded projects (no
-      # packages/, no plugins/) resolve the registered idea-handoff.mjs twin under
-      # bare node; neither present fails closed (exit 1) instead of silently
-      # skipping finalization. The zip/deps/refresh/check/report contract itself is
-      # pinned by finalizeIdeaHandoff unit tests, not by this file.
+      # (d) `spur feature handoff` owns finalization (0824; script-absorption PR-5
+      # retired the idea-handoff plugin script and its bundle). A nonzero exit fails
+      # the run (fail closed) instead of silently skipping finalization. The
+      # zip/deps/refresh/check/report contract itself is pinned by
+      # finalizeIdeaHandoff unit tests, not by this file.
       - kind: shell
         options:
-          command: >-
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/idea-handoff.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/idea-handoff.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; if [ -f "$S" ]; then
-              "$RUNNER" "$S";
-            else
-              echo "idea handoff failed closed — idea-handoff script not found — run 'superskill install sp --marketplace gobing-ai/spur'" >&2;
-              exit 1;
-            fi
+          command: '$spurBin feature handoff "$featureId" --run-id "$__runId" --no-logo'
   - id: handoff
     description: >
       Terminal — idea pipeline complete. Ordering applied, roster refreshed, and