@gobing-ai/spur 0.4.7 → 0.4.9

package/plugins/sp/scripts/hooks/careful-guard.ts

@@ -0,0 +1,94 @@
+#!/usr/bin/env bun
+
+/**
+ * careful-guard — PreToolUse guard for destructive shell commands (task 0215, R3).
+ *
+ * Warn (permission `ask`) before a `Bash` tool call runs a destructive command — `rm -rf`
+ * (any flag spelling, including the POSIX uppercase `-R`), `DROP TABLE`/`DROP DATABASE`/
+ * `TRUNCATE`, `git push --force`/`-f`/`+refspec`, `git reset --hard`, `git checkout .`/
+ * `git restore .`, `kubectl delete`, `docker system prune`. The operator can confirm to
+ * proceed. Pure pattern-match + decision, no domain logic (mirrors `task-write-guard`).
+ *
+ * Git global options between the executable and the subcommand are recognized — any run of them,
+ * not a fixed list: value-less flags (`--no-pager`, `--bare`, `-p`, …), glued long values
+ * (`--git-dir=<path>`), and value-taking options in separated form (`-C <path>`,
+ * `-c <name>=<value>`, `--git-dir|--work-tree|--namespace|--config-env|--attr-source <value>`).
+ * So `git -C . push --force` and `git --no-pager push --force` classify exactly like
+ * `git push --force`; the lexical pass only removes that option span and never executes git or
+ * expands a substitution. The run cannot cross a command boundary (`;`, `&`, `|`, newline).
+ *
+ * **Safe exceptions:** `rm -rf` of well-known build/dependency caches (`node_modules`, `dist`,
+ * `.next`, `coverage`, `build`, `.turbo`, `.cache`) passes without a warning — deleting a rebuildable
+ * cache is routine, not dangerous.
+ *
+ * **Output contract** (superskill ADR-039 `hook run`): allow prints **nothing** (exit 0). Ask prints
+ * Claude-native PreToolUse JSON with the reason in `permissionDecisionReason` (the confirm prompt) and
+ * `systemMessage` (Claude Code's user-facing warning, which the host-neutral `{decision,reason}` form
+ * cannot carry). Hosts that cannot confirm (Codex, omp, generic) receive a deny with the reason:
+ * superskill fails an unconfirmable ask closed. Pi confirms through its native host adapter.
+ *
+ * **Fail-open contract:** every error path — unparseable payload, non-Bash tool, empty command —
+ * allows (prints nothing). A broken guard must never wedge an agent tool call.
+ *
+ * **Escape hatch:** `SPUR_CAREFUL=off` short-circuits to allow.
+ *
+ * Classification itself lives in `lib/destructive-policy.ts` — one policy, every platform
+ * adapter runs this hook through superskill). This file owns the hook payload/decision shape only.
+ * Registered in `hooks/hooks.json` as `PreToolUse` / matcher `Bash` (task 0215 R3).
+ */
+
+import { classifyCommand } from '../../lib/destructive-policy';
+import { getEnvVar } from '../../lib/env';
+
+interface ToolPayload {
+    tool_name?: string;
+    tool_input?: { command?: string };
+}
+
+/** Allow: print nothing and exit 0 (no objection; the host's own permission rules still apply). */
+function allow(): never {
+    process.exit(0);
+}
+
+/** Ask the operator to confirm, with the reason on the prompt and as a user-facing warning. */
+function ask(reason: string): never {
+    process.stdout.write(
+        JSON.stringify({
+            hookSpecificOutput: {
+                hookEventName: 'PreToolUse',
+                permissionDecision: 'ask',
+                permissionDecisionReason: reason,
+            },
+            systemMessage: reason,
+        }),
+    );
+    process.exit(0);
+}
+
+async function main(): Promise<void> {
+    if (getEnvVar('SPUR_CAREFUL') === 'off') allow();
+
+    const stdinText = await Bun.stdin.text();
+    let payload: ToolPayload;
+    try {
+        payload = JSON.parse(stdinText) as ToolPayload;
+    } catch {
+        allow(); // unparseable payload — fail open
+    }
+
+    if (payload.tool_name !== 'Bash') allow();
+
+    const command = payload.tool_input?.command ?? '';
+    if (command.trim() === '') allow();
+
+    const hit = classifyCommand(command);
+    if (hit !== null) {
+        ask(
+            `This command looks like ${hit} — a destructive operation. Confirm you intend to run it. ` +
+                'Set SPUR_CAREFUL=off to disable this guard.',
+        );
+    }
+    allow();
+}
+
+if (import.meta.main) void main();

package/plugins/sp/{hooks → scripts/hooks}/context-post-tool.ts

@@ -10,8 +10,8 @@
  */
 
 import { join } from 'node:path';
-import { recordToolUseEvent, type ToolPayload } from '../lib/context-post-tool';
-import { getEnvVar } from '../lib/env';
+import { recordToolUseEvent, type ToolPayload } from '../../lib/context-post-tool';
+import { getEnvVar } from '../../lib/env';
 
 if (import.meta.main) {
     void (async () => {

package/plugins/sp/{hooks → scripts/hooks}/context-session-start.ts

@@ -7,7 +7,7 @@
  * (legacy policy) and every error path exits 0 with no output.
  */
 
-import { recordSessionStartFromPayloadText } from '../lib/context-session-start';
+import { recordSessionStartFromPayloadText } from '../../lib/context-session-start';
 
 if (import.meta.main) {
     try {

package/plugins/sp/{hooks → scripts/hooks}/context-session-stop.ts

@@ -7,7 +7,7 @@
  * `agent.run`'s shutdown stays a no-op because the owner gate lives in the core, not here.
  */
 
-import { recordSessionEndFromPayloadText } from '../lib/context-session-stop';
+import { recordSessionEndFromPayloadText } from '../../lib/context-session-stop';
 
 if (import.meta.main) {
     try {

package/plugins/sp/{hooks → scripts/hooks}/fleet-guest-stop.ts

@@ -15,9 +15,11 @@
  * - **Bounded.** The pending check is `spur agent wait --inbox <id> --timeout 2000`, which also
  *   heartbeats the guest lease (R5), and the reason names at most the first few messages.
  *
- * Block contract (both hosts that support it): exit 0 with JSON on stdout —
- * `{"decision":"block","reason":"<non-empty>"}`. Claude Code uses the reason as the stop reason;
- * Codex turns it into the next user prompt. Hosts that drop the Stop event (`codex exec` on
+ * Block contract: exit 0 with the host-neutral superskill result on stdout (ADR-039) —
+ * `{"decision":"block","reason":"<non-empty>"}`. `superskill hook run` renders it per host: Claude
+ * Code and Codex receive that same Stop JSON (Claude uses the reason as the stop reason; Codex turns
+ * it into the next user prompt), omp/Pi get exit 2 + the reason on stderr. No pending work prints
+ * nothing. Hosts that drop the Stop event (`codex exec` on
  * 0.160.0 — see `docs/plans/2026-10-05-codex-guest-spike.md`) simply never call it.
  *
  * Self-contained by design: hooks are bundled standalone at install time, so this file imports
@@ -27,7 +29,7 @@
 import { spawnSync } from 'node:child_process';
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { getEnvVar } from '../lib/env';
+import { getEnvVar } from '../../lib/env';
 
 /** Budget for the pending-work probe; the hook must never noticeably slow a turn. */
 export const GUEST_STOP_PROBE_MS = 2000;

package/plugins/sp/{hooks → scripts/hooks}/task-write-guard.ts

@@ -7,21 +7,28 @@
  * hand. Pure delegation: ownership is decided by `spur task resolve --strict --json`'s exit code
  * alone (exit 0 → owned, non-zero → unowned).
  *
+ * **Output contract** (superskill ADR-039 `hook run`): allow prints **nothing** (exit 0) — a printed
+ * Claude `permissionDecision:"allow"` would auto-approve the call and bypass the user's permission
+ * rules. Deny prints Claude-native PreToolUse JSON carrying the reason twice: `permissionDecisionReason`
+ * (what Claude Code feeds back to the model, and what `hook run` turns into exit 2 + stderr on
+ * Codex/omp/generic hosts) and `systemMessage` (Claude Code's user-facing warning — the one field the
+ * host-neutral `{decision,reason}` form cannot carry, which is why this guard stays Claude-native).
+ *
  * **Fail-open contract** (inherited from the pre-N3 shim and from superskill's runner): every error
  * path — unparseable payload, non-Write/Edit tool, empty path, missing `spur` binary, spawn
- * failure, timeout, `spur task resolve` non-zero exit, non-JSON stdout — emits an `allow`
- * decision. A broken guard must never wedge an agent tool call.
+ * failure, timeout, `spur task resolve` non-zero exit, non-JSON stdout — allows (prints nothing).
+ * A broken guard must never wedge an agent tool call.
  *
  * **Escape hatch:** `SPUR_WRITE_GUARD=off` short-circuits to allow.
  *
- * Self-contained by design (Wave E, task 0181, R3). Installed hook configs still use the portable
- * `superskill hook run sp task-write-guard` entrypoint from task 0151, while this source script keeps
- * the real guard decisions versioned and covered by this repo's test gate.
+ * Self-contained by design (Wave E, task 0181, R3): `node:*` builtins and relative imports only.
+ * Installed hook configs invoke `superskill hook run sp task-write-guard`, which resolves this file
+ * as `scripts/hooks/task-write-guard.ts` under the native plugin root or the staged scripts root.
  */
 
 import { spawnSync } from 'node:child_process';
-import { getEnvVar } from '../lib/env';
-import { couldBeTaskFile } from '../lib/task-file-policy';
+import { getEnvVar } from '../../lib/env';
+import { couldBeTaskFile } from '../../lib/task-file-policy';
 
 interface ToolPayload {
     tool_name?: string;
@@ -30,12 +37,23 @@ interface ToolPayload {
 
 type TaskOwnership = 'owned' | 'unowned' | 'unknown';
 
-function preToolUseDecision(decision: 'allow' | 'deny', reason?: string): never {
-    const out: Record<string, unknown> = {
-        hookSpecificOutput: { hookEventName: 'PreToolUse', permissionDecision: decision },
-    };
-    if (reason !== undefined) out.systemMessage = reason;
-    process.stdout.write(JSON.stringify(out));
+/** Allow: print nothing and exit 0 (no objection; the host's own permission rules still apply). */
+function allow(): never {
+    process.exit(0);
+}
+
+/** Deny with a reason the model (`permissionDecisionReason`) and the user (`systemMessage`) both see. */
+function deny(reason: string): never {
+    process.stdout.write(
+        JSON.stringify({
+            hookSpecificOutput: {
+                hookEventName: 'PreToolUse',
+                permissionDecision: 'deny',
+                permissionDecisionReason: reason,
+            },
+            systemMessage: reason,
+        }),
+    );
     process.exit(0);
 }
 
@@ -55,35 +73,34 @@ function resolveSpurTaskOwnership(filePath: string, cwd: string): TaskOwnership
 }
 
 async function main(): Promise<void> {
-    if (getEnvVar('SPUR_WRITE_GUARD') === 'off') preToolUseDecision('allow');
+    if (getEnvVar('SPUR_WRITE_GUARD') === 'off') allow();
 
     const stdinText = await Bun.stdin.text();
     let payload: ToolPayload;
     try {
         payload = JSON.parse(stdinText) as ToolPayload;
     } catch {
-        preToolUseDecision('allow'); // unparseable payload — fail open
+        allow(); // unparseable payload — fail open
     }
 
     const toolName = payload.tool_name ?? '';
-    if (toolName !== 'Write' && toolName !== 'Edit') preToolUseDecision('allow');
+    if (toolName !== 'Write' && toolName !== 'Edit') allow();
 
     const filePath = payload.tool_input?.file_path ?? '';
-    if (filePath === '') preToolUseDecision('allow');
+    if (filePath === '') allow();
     // Skip the `spur task resolve` subprocess (~120ms) for paths whose basename
     // cannot name a task file — that is every ordinary source edit.
-    if (!couldBeTaskFile(filePath)) preToolUseDecision('allow');
+    if (!couldBeTaskFile(filePath)) allow();
 
     const ownership = resolveSpurTaskOwnership(filePath, getEnvVar('CLAUDE_PROJECT_DIR') ?? process.cwd());
     if (ownership === 'owned') {
-        preToolUseDecision(
-            'deny',
+        deny(
             `${filePath} is a task file owned by the spur corpus. Edit it through the spur CLI ` +
                 '(e.g. `spur task update <wbs> --section <name> --from-file <file>`), not a raw ' +
                 'Write/Edit. Set SPUR_WRITE_GUARD=off to bypass.',
         );
     }
-    preToolUseDecision('allow');
+    allow();
 }
 
 void main();

package/plugins/sp/skills/code-implementation/SKILL.md

@@ -169,7 +169,7 @@ that single full gate.
 
 **Worker iteration check order (task 1142 R3):**
 1. The **changed-path matrix** below (narrow behavior tests + affected consumers);
-2. the resolved `quality-gate` script in `light` mode (source-repo probe, else the installed twin) (biome on changed files, per-workspace typecheck, rule presets `rules:pre`/`rules:post`, related tests).
+2. `spur task gate <wbs> light` (biome on changed files, per-workspace typecheck, rule presets `rules:pre`/`rules:post`, related tests).
 
 Neither step takes the full project gate. The full gate is named only for the pipeline's `test` and `test-recheck` hops.
 

package/plugins/sp/skills/code-verification/SKILL.md

@@ -284,9 +284,8 @@ the deterministic Testing writer `spur task record` (section authorship never ha
 # write .spur/run/<wbs>-verdict.json (shape in references/verdict-schema.md), then:
 spur task record <wbs> --verdict-file .spur/run/<wbs>-verdict.json  # renders ## Testing, flips proven boxes
 # F96 residual sweep (observe-only): scan + fold AFTER record, under every --fix mode (0987).
-RESIDUAL=$(superskill script path sp residual-scan.mjs)
-node "$RESIDUAL" scan <wbs>
-node "$RESIDUAL" fold <wbs>
+spur task residual <wbs> scan
+spur task residual <wbs> fold
 # Downgrade only: re-record so Testing carries the final (folded) verdict.
 [ "$(jq -r .verdict .spur/run/<wbs>-verdict.json)" = PASS ] \
   || spur task record <wbs> --verdict-file .spur/run/<wbs>-verdict.json
@@ -297,10 +296,9 @@ node "$RESIDUAL" fold <wbs>
 > `residual-sweep` check in place (PASS → PARTIAL when a blocking residual exists), and the
 > downgrade-only re-record transcribes it — a manual verify cannot certify what the pipeline would
 > reject. The sweep runs after `record` (same order as the pipeline, 0983/0987): before it, a
-> verdict-proven box is still unticked and a clean PASS would fold to PARTIAL. Resolve the
-> script via `superskill script path sp residual-scan.mjs`; shipped surfaces never reference
-> `plugins/sp/scripts/` directly (script-contract-check rule 4). When the task reaches `done`
-> through `--next`, run `residual-scan settle` (links follow-up tasks; best-effort).
+> verdict-proven box is still unticked and a clean PASS would fold to PARTIAL. The sweep is the
+> `spur task residual` verb (no plugin script to resolve). When the task reaches `done` through
+> `--next`, run `spur task residual <wbs> settle` (files the follow-up task; best-effort).
 
 > **Corrections: the answer file is the source of truth.** `spur task record` re-transcribes
 > `## Testing` from the verdict artifact — direct `--section Testing` writes are futile. Fix
@@ -447,11 +445,13 @@ gate is **active**, evaluate feature AC satisfaction via the existing CLI.
 
    ```bash
    SPUR_BIN="${SPUR_BIN:-$([ -f apps/cli/src/index.ts ] && echo 'bun apps/cli/src/index.ts' || echo spur)}"
-   $SPUR_BIN feature check <featureId> --json
+   $SPUR_BIN feature check <featureId> --as done --strict --json
    $SPUR_BIN task list --feature <featureId> --json
    ```
 
 3. Classify **Shippable: PASS** only if **all** of:
+   - Strict completion exits 0: PASS feature-verification receipts and required dogfood evidence.
+     Projection changes no status; active-state checks are insufficient.
    - No finding whose code/message indicates **linked but unverified** scenarios
      (`L4_SCENARIO_UNVERIFIED`).
    - No **orphan / uncovered** feature scenarios (`L4_ORPHAN_SCENARIOS`,

package/plugins/sp/skills/code-verification/references/secu-review.md

@@ -83,7 +83,7 @@ verdict artifact so quality failures are not lost behind a requirements-only PAS
 Before declaring a task `done`, run this lightweight checklist. It catches the most common oversights that survive the formal pipeline gates:
 
 - [ ] Check receipt `.spur/run/<wbs>-check-receipt.json` reports `reuse: true` for the current
-      digest via `quality-gate.ts status`; run `bun run spur-check` only when it reports stale or
+      digest via `spur task gate <wbs> status`; run `bun run spur-check` only when it reports stale or
       missing (0940).
 - [ ] No `TODO` or `FIXME` without a linked task WBS.
 - [ ] `git status` shows only intentional changes (no debug artifacts, no temp files).
@@ -91,8 +91,9 @@ Before declaring a task `done`, run this lightweight checklist. It catches the m
 - [ ] No `--no-verify`, `--force`, or new suppression comments added to bypass gates.
 - [ ] Solution section contains `file:line` citations for every changed file.
 - [ ] API/library claims in changed docs carry a source citation (URL or `path:line`) and an honest
-      confidence level (HIGH/MEDIUM/LOW) per source-driven-development; the deterministic advisory backstop is
-      the `cited-version-strings` / `cited-api-claims` / `cited-api-claims-confidence` rules
+      confidence level (HIGH/MEDIUM/LOW) per source-driven-development — a HIGH claim must show the
+      source it was verified against on the same line (MEDIUM/LOW need no anchor); the deterministic advisory backstop is
+      the `cited-version-strings` / `cited-api-claims` / `cited-api-claims-confidence` / `cited-high-confidence` rules
       (`.spur/rules/docs/sourced-api-claims.yaml`, run ad hoc — not wired into a preset).
 - [ ] Review section has P1–P4 findings table (even if all rows are empty — the table itself proves review happened).
 

package/plugins/sp/skills/code-verification/references/verdict-schema.md

@@ -170,6 +170,14 @@ before the proof capture (task 1109), but it qualifies **unique** basenames only
 basename (two tracked files share it) is reported and left untouched, and line drift and
 `L4.anchor-subject-mismatch` are never repaired by that pass — those remain the author's rows.
 
+A **workspace-relative** path fails the same way, and is the easier mistake to make because the
+command it came from is real. `(cd apps/cli && bun test tests/commands/builder/pr.test.ts)` is the
+right way to run the suite, but `tests/commands/builder/pr.test.ts` does not resolve from the repo
+root, so the AC-coverage guard reports `missing: <AC> — <path>` and refuses `done` (observed
+2026-10-16, task 1215 — the repair was a fresh verify pass over the whole answer). Cite both halves:
+the workspace-rooted command you ran, then the repo-root-relative anchor of the file it names
+(`apps/cli/tests/commands/builder/pr.test.ts`). One anchor per cited file per cell is enough.
+
 ## Source citations for external claims (task 1070)
 
 A Requirement/AC evidence cell that asserts an external API/library claim must carry a verifiable
@@ -185,7 +193,7 @@ citation in the SAME cell, or lint rejects the row with `evidence-citation` (blo
   presence-only — which citation proves which claim is not deterministically decidable.
 - The same two predicates (`hasClaimMarker` / `hasCitationForm` in
   `packages/app/src/services/verify-answer-lint.ts`) gate the review report's findings table through
-  `residual-scan review-gate` as the blocking `review-contract` category — one definition of
+  `spur task residual <wbs> review-gate` as the blocking `review-contract` category — one definition of
   "external claim" and one set of accepted citation forms for both paths.
 
 ## Hedged evidence is rejected on MET rows

package/plugins/sp/skills/daily-summary/SKILL.md

@@ -52,13 +52,13 @@ The daily-summary skill:
 
 ```bash
 # Generate summary for today
-node "$(superskill script path sp daily-summary/daily-summary.mjs)"
+spur history summary
 
 # Generate summary for a specific date
-node "$(superskill script path sp daily-summary/daily-summary.mjs)" --date 2026-04-17
+spur history summary --date 2026-04-17
 
 # Show summary without writing file
-node "$(superskill script path sp daily-summary/daily-summary.mjs)" --dry-run
+spur history summary --dry-run
 ```
 
 ## Workflows
@@ -165,7 +165,6 @@ Read the skill file and follow the workflow manually.
 
 ## Additional Resources
 
-- **Script source:** [scripts/daily-summary/daily-summary.ts](../../scripts/daily-summary/daily-summary.ts) — CLI implementation
-- **Tests:** [tests/daily-summary/daily-summary.test.ts](../../tests/daily-summary/daily-summary.test.ts) — unit coverage for parsing, date ranges, markdown output
+- **CLI:** `spur history summary [--date d] [--dry-run] [--output p] [--no-git] [--no-ccusage]` — see `sp:spur-cli` (history reference)
 - **Related skills:** `sp:dev-handover` (blocker handoff), `sp:dev-changelog` (commit-based changelog), `sp:spur-cli` (task management)
 - **Upstream CLI:** [ccusage](https://github.com/ryoppippi/ccusage) — AI agent token usage reporter

package/plugins/sp/skills/dogfood-testing/SKILL.md

@@ -82,11 +82,11 @@ The command forwards these via `$ARGUMENTS`:
 >   <!-- pipeline-tokens:end -->
 >   matched as a **distinct hyphen-word**
 >   (machine-checked by
->   [`detectPipelineDriving`](../../lib/dogfood-pipeline.ts);
+>   `detectPipelineDriving` (`spur agent dogfood gate`);
 >   see [§Pipeline-driving word-boundary contract](#pipeline-driving-word-boundary-contract))
 >   → `⚠ pipeline-driving testee detected; pass --max-retry 0 (observe-only) or --max-retry N (fix mode, tree mutation acknowledged)`.
 > - **Mutating `--fix` modes** — `--fix all` / `--fix blockers-first`, boundary-guarded via
->   [`hasMutatingFixMode`](../../lib/dogfood-pipeline.ts) (never matches
+>   `hasMutatingFixMode` (`spur agent dogfood gate`) (never matches
 >   `--fix none` / `--focus all` / `--prefix all`). No pipeline token required: a verify/review leg
 >   with `--fix all` mutates the tree on its own (0280 dogfood P2, task 0293). Honesty note:
 >   `--max-retry 0` here bounds **the driver only** — the testee still mutates the tree — so the
@@ -100,7 +100,7 @@ The command forwards these via `$ARGUMENTS`:
    in-agent):
 
    ```bash
-   node "$(superskill script path sp dogfood-testing/detect-pipeline-driving.mjs)" \
+   spur agent dogfood gate \
      --testee "<raw testee string>" \
      [--max-retry-present]
    ```
@@ -109,7 +109,7 @@ The command forwards these via `$ARGUMENTS`:
      of two independent mutation sources (task 0293); its two refuse lines are the ones quoted
      verbatim in the repo-mutation warning above.
    - Exit **0** → proceed. Do not auto-substitute `--max-retry 0`.
-   - The matcher contract is unit-checked by `tests/dogfood-testing/pipeline-detect.test.ts`.
+   - The matcher contract is unit-checked by `packages/app/tests/services/dogfood/pipeline-detect.test.ts`.
      See [§Pipeline-driving word-boundary contract](#pipeline-driving-word-boundary-contract) and
      [§Mutating `--fix` mode contract](#mutating---fix-mode-contract).
 1. **Resolve + classify** the testee: slash command (`/sp:...`), agent skill (`Skill(...)`), or shell
@@ -121,7 +121,7 @@ The command forwards these via `$ARGUMENTS`:
     re-run the gate with the derived step labels:
 
     ```bash
-    node "$(superskill script path sp dogfood-testing/detect-pipeline-driving.mjs)" \
+    spur agent dogfood gate \
       --testee "<raw testee string>" \
       --max-retry-present \
       --steps "step1 label||step2 label||..."
@@ -232,7 +232,7 @@ contract violation**.
    **before** claiming `status: complete`:
 
    ```bash
-   node "$(superskill script path sp dogfood-testing/validate-report.mjs)" --file <report-path>
+   spur agent dogfood validate-report --file <report-path>
    ```
 
    Exit **0** → proceed. Exit **2** → set `status: aborted`, list every error code under §5
@@ -338,7 +338,7 @@ Do **not** use this skill for:
 Pipeline-driving detection is **word-boundary**, not leading-space substring. The live gate is:
 
 ```bash
-node "$(superskill script path sp dogfood-testing/detect-pipeline-driving.mjs)" --testee "<testee>" [--max-retry-present] [--steps "…"] [--json]
+spur agent dogfood gate --testee "<testee>" [--max-retry-present] [--steps "…"] [--json]
 ```
 
 | Token shape | Examples | Matches | Rejects |
@@ -347,9 +347,9 @@ node "$(superskill script path sp dogfood-testing/detect-pipeline-driving.mjs)"
 | Bare noun | <!-- pipeline-tokens:start -->`run`, `runall`, `wrap`, `wrapall`, `idea`, `refineall`, `verifyall`<!-- pipeline-tokens:end --> | `task run 0042` | `runaway`, `wrapper`, `idealist` |
 
 `-` is a **word character** for boundaries: a token must be a distinct hyphen-word. Contract tests:
-`plugins/sp/tests/dogfood-testing/pipeline-detect.test.ts`. Helpers:
+`packages/app/tests/services/dogfood/pipeline-detect.test.ts`. Helpers:
 `detectPipelineDriving`, `isImplementHeavyStep`, `detectImplementHeavy`, `evaluateDogfoodGate` in
-[`detect-pipeline-driving.ts`](../../scripts/dogfood-testing/detect-pipeline-driving.ts).
+`spur agent dogfood gate` (absorbed into the CLI; was `plugins/sp/scripts/dogfood-testing/detect-pipeline-driving.ts`).
 
 ## Mutating `--fix` mode contract
 

package/plugins/sp/skills/dogfood-testing/references/report-template.md

@@ -336,7 +336,7 @@ Before the skill may stop (success, partial, fail, observe-only end, or abort),
    and mirror the footer block at the **end of the report file**. A report whose body lacks the
    footer cannot set `status: complete`.
 8. **Self-validate (task 0278 R6):** run
-   `node "$(superskill script path sp dogfood-testing/validate-report.mjs)" --file <report-path>` before
+   `spur agent dogfood validate-report --file <report-path>` before
    claiming `status: complete`. Exit 2 → `status: aborted` + list error codes under
    `#### Unresolved` (never force complete on a non-@1.2 shape).
 9. **Refusal rule (@1.2):** when any check above fails, set `status: aborted` and list every

package/plugins/sp/skills/history-anatomy/references/modes.md

@@ -2,8 +2,8 @@
 
 The skill resolves exactly two modes. Everything else fails loud. This matrix is the enforcement
 surface the workflow (0660) and the skill share; keep the vocabulary frozen. Execution note
-(0920): argument validation runs deterministically in the `history-anatomy-cache` helper `paths`
-command (logic core: `packages/app/src/services/history-anatomy.ts`, task 1005) before the
+(0920): argument validation runs deterministically in `spur history anatomy paths`
+(formerly the `history-anatomy-cache` helper) (logic core: `packages/app/src/services/history-anatomy.ts`, task 1005) before the
 workflow starts; the model hop no longer performs it.
 
 ## Mode vocabulary (frozen)

package/plugins/sp/skills/next-router/references/routing-table.md

@@ -15,7 +15,7 @@ dispatcher: resolve target → load corpus → apply primary table → optional
 
 `sp:super-planner` (via `/sp:dev-runall`) **reads** TABLE A STOP preconditions for:
 
-1. **Preflight** — skip pipeline launch when A2/A7/A8/A9 would stop `dev-next` (`batch-preflight.ts`).
+1. **Preflight** — skip pipeline launch when A2/A7/A8/A9 would stop `dev-next` (`spur task preflight`).
 2. **One-shot recovery** — after a failed pipeline, map status → primary hop (A1/A3/A5/A6/A7) at most once.
 
 It does **not** reimplement TABLES or replace `task-pipeline.yaml` with a `dev-next` loop. Keep this

package/plugins/sp/skills/parallel-execution/SKILL.md

@@ -104,7 +104,7 @@ was meant to avoid. Let the reviewer reach its own conclusion.
 
 - **`sp:spur-dev`** owns task selection and lifecycle. When a batch contains independent tasks, the spine consults this skill for the fan-out pattern.
 - **`sp:super-planner`** is the orchestrator that executes the fan-out. Its parallel mode (documented in its agent definition) applies the patterns from this skill.
-- **`/sp:dev-runall --mode parallel|auto`** is the task-batch entry point; its `batch-plan.mjs order` schedule applies this skill's dependency and file-overlap rows deterministically.
+- **`/sp:dev-runall --mode parallel|auto`** is the task-batch entry point; its `spur task batch-plan order` schedule applies this skill's dependency and file-overlap rows deterministically.
 
 ## When to use
 

package/plugins/sp/skills/pr-reviewing/SKILL.md

@@ -40,9 +40,9 @@ sp:pr-reviewing (this skill — mode routing, triage, fix, rules)
       │  deterministic spine, state order + guards:
       ▼
 pr-review.yaml ← workflow SSOT (seeded by spur init; project-tunable)
-      │  every state resolves with `superskill script path` and shells out to:
+      │  every deterministic action shells out to:
       ▼
-staged pr-reviewing.ts         ← Bun entrypoint for the tested git/gh core
+`spur builder pr`         ← Bun entrypoint for the tested git/gh core
 ```
 
 - **State order and guards** are defined once, in the workflow YAML. Do not re-derive them in
@@ -128,44 +128,43 @@ root causes rather than wording, prefer the smallest coherent patch, avoid drive
 ## Workflow-backed spine (`full`, `submit`, `rerun`)
 
 Run the workflow YAML's declared states in order. Every deterministic state invokes the
-staged entrypoint below, supports `--json`, and must be parsed. Stop at the first red gate and
+`spur builder pr` operation below, supports `--json`, and must be parsed. Stop at the first red gate and
 report its artifact. The canonical installed invocation is:
 
 ```sh
-node "$(superskill script path sp pr-reviewing.mjs)" <subcommand> [flags]
+spur builder pr <subcommand> [flags]
 ```
 
-Installed targets resolve the staged `.mjs` twin and execute it with Node, matching the standard
-superskill script contract.
+The installed Spur CLI owns these operations; no staged script, Node twin or plugin resolver is used.
 
-1. **Preflight** — `<script> preflight --base "$base" --json`. Hard-fails on a
+1. **Preflight** — `spur builder pr preflight --base "$base" --json`. Hard-fails on a
    detached HEAD, missing `gh` auth, no GitHub remote, a dirty tree, or the current branch
    being the base branch (a PR reviews a feature branch against the base; nothing on the
    base branch is reviewable, and the guard runs before any push can publish it). On a
    dirty tree, triage with the user (commit/stash/exclude) before continuing — the
    workflow refuses to guess.
-2. **Hygiene** — `<script> hygiene --base "$base" --json`. `BLOCK` (secrets, `.env`, conflict markers,
+2. **Hygiene** — `spur builder pr hygiene --base "$base" --json`. `BLOCK` (secrets, `.env`, conflict markers,
    private keys) stops the run — never submit a tainted diff. `WARN` (debug residue) rides along
    into the report. This is a submission sanity check, not a second local review.
 3. **Precheck** — if the workflow YAML's `preReviewCmd` var is set, run it; a red check stops the
    run (do not spend a review request on code that fails its own gate). When unset, report that
    pre-review verification was not configured rather than inventing project commands.
-4. **Push** — `<script> push --json`. Normal push only; sets upstream when missing.
-5. **Ensure PR** — `<script> ensure-pr --base "$base" --json`. Reuses the branch's PR; creates with
+4. **Push** — `spur builder pr push --json`. Normal push only; sets upstream when missing.
+5. **Ensure PR** — `spur builder pr ensure-pr --base "$base" --json`. Reuses the branch's PR; creates with
    `gh pr create --fill` only when absent. Never a duplicate PR.
-6. **Request** — `<script> request --focus "<focus>" --json` (`--force` in `rerun` mode). Dedupes when
+6. **Request** — `spur builder pr request --focus "<focus>" --json` (`--force` in `rerun` mode). Dedupes when
    Codex already reviewed the exact pushed HEAD (`ALREADY_REVIEWED` → skip to collect) or a marked
    request by the current GitHub user is still in flight (`ALREADY_REQUESTED` → pending). The
    request body is concise when the repo has `## Code Review Rules`, else carries the default
    actionable-issues focus. Records PR, URL, HEAD, and request time.
 7. **Wait** (full/rerun unless `--no-wait`; submit stops before it) —
-   `<script> wait --since "$requestedAt" --head "$requestHead" --json`, using the request result so
+   `spur builder pr wait --since "$requestedAt" --head "$requestHead" --json`, using the request result so
    a fast response is not missed, `rerun` cannot reuse the prior review, and a moved HEAD fails loud.
    Polls every ~30s for up to
    ~10 minutes across the current HEAD's PR review and inline comments. Uncorrelated conversation
    comments are ignored. A current-HEAD clean review is a completed `CLEAN` outcome; findings are
    `FOUND`; timeout or no current-HEAD result is **pending, not failed** — collect later.
-8. **Collect** — `<script> collect --since "$requestedAt" --head "$requestHead" --json`. Normalize
+8. **Collect** — `spur builder pr collect --since "$requestedAt" --head "$requestHead" --json`. Normalize
    only the requested HEAD and request window; then invoke `status` with the same bounds for
    PR/base/CI/local state. Never turn an absent, stale, or moved-HEAD result into `clean`.
    `--head` is mandatory on wait/collect/status (0771): an empty or missing pin fails loud
@@ -288,7 +287,7 @@ or review requests.
 
 - **Workflow SSOT:** `pr-review.yaml` (seeded by `spur init`; tune per project —
   wait budget, `preReviewCmd`, dedupe policy)
-- **Script source:** [scripts/pr-reviewing.ts](../../scripts/pr-reviewing.ts) — subcommand CLI
-- **Tests:** [tests/pr-reviewing.test.ts](../../tests/pr-reviewing.test.ts) — stubbed git/gh suites
+- **Script source:** `spur builder pr` (absorbed; was `plugins/sp/scripts/pr-reviewing.ts`) — subcommand CLI
+- **Tests:** `packages/app/tests/services/pr-review/pr-review.test.ts` — stubbed git/gh suites
 - **Related skills:** `sp:code-verification` (local SECUA review), `sp:functional-review`
   (requirements traceability) — complements, never substitutes, the independent Codex review

package/plugins/sp/skills/session-review/SKILL.md

@@ -90,15 +90,15 @@ issues with its evidence. Notes stay report-only.
 
 1. **Resolve scope.** Review the active session from the operator's initiating request through the
    latest result. Use `[focus]` only to rank relevant material. Measure it with
-   `node "$(superskill script path sp session-timeline.mjs)" --group "<ranges>"`: one segment per
+   `spur history timeline --group "<ranges>"`: one segment per
    operator prompt, read-only from the host transcript. Run it once without `--group` to list the
    segments, then map them to stages (`"1-3,4,5-6"`). It splits each segment into `work` and
    operator `wait` (idle before the next prompt plus AskUserQuestion answer time) and counts tokens
    once per message id. On pi the transcript is `$PI_SESSION_FILE` (pass it as `--transcript` when
    the run reports no host session id). **A measurement that returns `segments: []` with zero totals
    while the session had operator prompts is an unreadable or stale adapter, not an empty session:**
-   compare the installed copy against this tree's `plugins/sp/scripts/session-timeline.mjs` and
-   refresh it with `superskill install sp` before reporting numbers; report `n/a` until then.
+   check `spur --version` against this tree's release and upgrade the CLI before reporting
+   numbers; report `n/a` until then.
    The transcript resolves from `--transcript`, else `CLAUDE_CODE_SESSION_ID`, else `PI_SESSION_FILE`
    (the pi host sets it and no Claude session id); with none of them the measurement reports
    `available:false` with a reason and the table renders `n/a` instead of guessing. A pi

package/plugins/sp/skills/source-driven-development/SKILL.md

@@ -101,10 +101,13 @@ line: `Verification: HIGH|MEDIUM|LOW — <first failing check and deviation, or
 - **Honest confidence** — the stated HIGH/MEDIUM/LOW matches the evidence: HIGH requires a check against the pinned source this session; MEDIUM/LOW items are labeled, and LOW is never presented as fact.
 - **HIGH** — all three checks pass. **MEDIUM** — coverage intact but some citations are off-version (latest docs for a pinned dependency) or secondary-source only. **LOW** — an API/library claim lacks any citation, or a LOW-confidence claim was asserted as fact.
 
-Deterministic backstop: the `cited-version-strings`, `cited-api-claims` and
-`cited-api-claims-confidence` rules (`.spur/rules/docs/sourced-api-claims.yaml`) flag markdown lines
-that assert a version string or a time-anchored API claim with no citation anchor on the same line,
-and claim lines that carry no HIGH/MEDIUM/LOW level. They are an info-severity advisory backstop for
+Deterministic backstop: the `cited-version-strings`, `cited-api-claims`,
+`cited-api-claims-confidence` and `cited-high-confidence` rules
+(`.spur/rules/docs/sourced-api-claims.yaml`) flag markdown lines that assert a version string or a
+time-anchored API claim with no citation anchor on the same line, claim lines that carry no
+HIGH/MEDIUM/LOW level, and claim lines that claim HIGH with no anchor — the one level that asserts
+"verified this session", so its source must be on the line; MEDIUM (recalled) and LOW (memory only)
+need no anchor by contract and are not flagged. They are an info-severity advisory backstop for
 this contract and are deliberately NOT wired into `recommended-pre-check` — run them ad hoc with
 `spur rule run --file .spur/rules/docs/sourced-api-claims.yaml`. The checks above and the SECUA
 checklist remain the enforcement points.