@gobing-ai/spur 0.4.7 → 0.4.9

package/plugins/sp/skills/spur-check/SKILL.md

@@ -23,7 +23,7 @@ see_also:
 
 # sp:spur-check — the two-tier check primitive (ADR-124)
 
-One check primitive with two tiers behind the shipped `quality-gate` script
+One check primitive with two tiers behind `spur task gate <wbs> <mode>`
 ([task 0939](../../../../docs/tasks5/0939_add-the-two-tier-spur-check-primitive-with-fingerprint-bound.md),
 [workflow catalogue refactor §4](../../../../docs/design/workflow-catalogue-refactor.md)): light
 checks accumulate during development, the full chain runs once at the quality boundary, and every
@@ -33,11 +33,13 @@ gate writes a fingerprint-bound receipt that downstream stages read instead of r
 
 | Tier | Mode | When | Scope |
 | --- | --- | --- | --- |
-| `light` | `quality-gate.ts light` | after each implement/fix edit | `bunx biome check` on the changed files (`git diff --name-only HEAD` + untracked), `bun run typecheck` per touched workspace, and related tests (`<ws>/src/**/x.ts` → `<ws>/tests/**/x.test.ts` filename mapping) run via `cd <ws> && bun test …` — never from the repo root, whose bunfig preload does not apply inside the workspace |
-| `full` | `quality-gate.ts run` | once at the task quality boundary (`test`) | today's chain: `bun run lint` + `bun run test-pre-check` + `bun run test` + `bun run test-post-check` (=`bun run spur-check`), with bounded findings, SQLite-busy retry, and the `recheck` probe |
+| `light` | `spur task gate <wbs> light` | after each implement/fix edit | `bunx biome check` on the changed files (`git diff --name-only HEAD` + untracked), `bun run typecheck` per touched workspace, and related tests (`<ws>/src/**/x.ts` → `<ws>/tests/**/x.test.ts` filename mapping) run via `cd <ws> && bun test …` — never from the repo root, whose bunfig preload does not apply inside the workspace |
+| `full` | `spur task gate <wbs> run` | once at the task quality boundary (`test`) | today's chain: `bun run lint` + `bun run test-pre-check` + `bun run test` + `bun run test-post-check` (=`bun run spur-check`), with bounded findings, SQLite-busy retry, and the `recheck` probe |
 
-Soft-fail contract: both tiers always exit 0; the verdict lives in files (`*-test-gate.status`,
-receipt `status`), never in the exit code.
+Exit contract: `run` and `recheck` return 0 on PASS and 1 on FAIL; `deferred` returns 0 on
+DEFERRED and 1 on FAIL. `light` and `status` return 0; invalid usage returns 2. The pipeline
+wraps selected calls with `; exit 0` and branches on `*-test-gate.status` or receipt `status`;
+that soft shell wrapper does not change the standalone CLI contract.
 
 ## Receipt
 
@@ -59,8 +61,8 @@ receipt `status`), never in the exit code.
 - `inputDigest` is the shared `ProofInputFingerprint` (task markdown + git tree of tracked
   sources). The plugin never computes it — the pipeline captures it with the `proof.fingerprint`
   action into `env.proofDigest` (ADR-124: no second fingerprint, no `@gobing-ai/*` import);
-  standalone callers use `inline-run-setup.ts --fingerprint`.
-- Only `run`/`full` writes a reusable receipt. Without a digest, `run` writes no receipt and says
+  standalone callers use `spur workflow inline fingerprint`.
+- `run` and `recheck` write full-tier receipts; only a PASS at the current digest is reusable. Without a digest, `run` writes no receipt and says
   so in the gate log. The gate executes `qualityGateCmd` as one unit, so the full receipt carries a
   single `test` row for the whole chain; `lint`, `typecheck`, `test-pre-check`,
   `test-post-check` name the chain steps the full tier covers.
@@ -70,12 +72,11 @@ receipt `status`), never in the exit code.
 
 ## Reuse rule
 
-Check `status` mode before re-running a gate. Resolve the shipped script through the superskill
-runtime (shipped surfaces never hard-code repo paths):
+Check `status` mode before re-running a gate. The gate ships inside the CLI (no plugin script to
+resolve):
 
 ```bash
-QG="$(superskill script path sp quality-gate.mjs)"
-bun "$QG" status   # env: wbs, proofDigest → prints {"reuse":…,"reason":…}
+spur task gate <wbs> status --proof-digest "$proofDigest" --no-logo   # final stdout line: {"reuse":…,"reason":…}
 ```
 
 `reuse: true` only when the receipt is `status: PASS`, `tier: full`, and `inputDigest` equals the
@@ -103,8 +104,8 @@ preserved by construction. `recheck` stays the no-progress probe path for fix lo
 
 ## Gotchas
 
-1. **Never value-import `@gobing-ai/*` into the script** — the plugin standalone contract fails
-   the install; the digest arrives via `env.proofDigest`.
+1. **Keep gate logic in the CLI/application owner** — plugin skills invoke `spur task gate`;
+   they do not restore a script or bundle. The digest arrives via `--proof-digest` or `env.proofDigest`.
 2. **Never run light tests from the repo root** — the workspace `bunfig.toml` preload (coverage,
    thresholds) only applies inside the workspace; `cd <ws> && bun test …` is the contract.
 3. **Light is a filter, not a boundary** — unmapped files (root-level scripts, non-src layouts)

package/plugins/sp/skills/spur-cli/SKILL.md

@@ -44,7 +44,7 @@ Pick the noun, read its reference. Each Tier A and Tier B reference owns that no
 | **Tier A** | **feature** | Feature tree: author with hierarchical IDs (DD-14), acceptance criteria (Gherkin), status lifecycle, move subtrees, `check --json` | [references/features.md](references/features.md) |
 | **Tier A** | **rule** | Constraint quality gate: run presets, author rules, fine-tune, validate rule files/presets, extend engine | [references/rules.md](references/rules.md) |
 | **Tier A** | **workflow** | Dual-mode workflow runtime: author state-machine / transition-flow workflows, validate, run, read traces | [references/workflows.md](references/workflows.md) |
-| **Tier A** | **builder** | Release plumbing: bump a package (or the `workspace:`-pinned set) with `bump-ver`, delete release tags with `drop-tags`, commit + tag + optional push | [references/builder.md](references/builder.md) |
+| **Tier A** | **builder** | Release/PR plumbing: `bump-ver` (including read-only `--check`), `drop-tags`, `publish`, and `pr` review operations | [references/builder.md](references/builder.md) |
 | **Tier B** | **agent** | Coding-agent execution surface: run prompts via detected/named agents, list agent specs (incl. `agent.fleet` members), start/stop supervised processes, fleet `report`/`join`/`leave`/`wait`/`trace`, readiness check | [references/agent.md](references/agent.md) |
 | **Tier B** | **message** | Durable inter-agent messaging: send, inbox, reply, watch | [references/message.md](references/message.md) |
 | **Tier B** | **self** | Self-management verbs: scaffold (`init`), database maintenance (`maintain`), schema migrations (`migrate`), local web server (`serve`), status overview (`status`); `self init` runs post-scaffold validation probes & layout classification | [references/self.md](references/self.md) |

package/plugins/sp/skills/spur-cli/references/agent.md

@@ -30,6 +30,7 @@ that before using `run` for fan-out dispatch.
 | `leave` | Leave the fleet: release the guest lease, retire the occupant, return claimed messages to `queued` | `[id]` `--session-id <sid>` `--json` |
 | `status` | Agent specs with live process status and member session (requires `spur self serve`) | `--server <url>` `--json` |
 | `doctor [agent]` | Check agent readiness | `--json` `--probe-health` `--force-refresh` |
+| `dogfood <gate\|validate-report>` | `sp:dogfood-testing` gates: pipeline-driving refusal (exit 2) and report-contract validation (exit 2) | `--testee` `--max-retry-present` `--steps` `--file` `--json` |
 | `usage` | Run-once provider usage capture (codexbar) → quota-owned availability refresh; scheduled externally | `--dry-run` `--source <name>` `--json` |
 | `start <spec-id>` | Start a supervised agent process (requires `spur self serve`) | `--server <url>` `--json` |
 | `stop <spec-id>` | Stop a supervised agent process (requires `spur self serve`) | `--server <url>` `--json` |
@@ -321,6 +322,17 @@ Posts to the supervisor API
 (`POST /api/agents/:id/stop`) and prints `stopped <id>`. Same server requirement and flags as
 `start`.
 
+## `dogfood` - dogfood-testing gates
+
+```bash
+spur agent dogfood gate --testee "/sp:dev-run 0123" --json        # exit 2 = refuse (pipeline-driving, no --max-retry)
+spur agent dogfood gate --testee "…" --steps "plan||implement"     # Phase 1 W8 re-check
+spur agent dogfood validate-report --file report.md --json         # exit 2 = contract errors
+```
+
+Absorbed from `plugins/sp/scripts/dogfood-testing/` (script-absorption PR-7). `--json` here prints
+the raw result object (no envelope).
+
 ## `usage` - run-once provider usage capture (quota-owned availability refresh)
 
 ```bash

package/plugins/sp/skills/spur-cli/references/builder.md

@@ -1,6 +1,6 @@
 ---
 name: spur-cli-builder
-description: "spur-cli noun reference: operate `spur builder` as the release plumbing surface - bump a workspace package (or the `workspace:`-pinned release set) with `bump-ver`, delete release tags with `drop-tags`, with commit + annotated tag + optional push. Promoted from spur-dev (task 0617, ADR-051); frozen at exactly these two verbs."
+description: "spur-cli noun reference: operate `spur builder` as the release plumbing surface - bump a workspace package (or the `workspace:`-pinned release set) with `bump-ver`, delete release tags with `drop-tags`, with commit + annotated tag + optional push; publish a package to npm with `publish` (and guard version drift with `bump-ver --check`); run the `/sp:dev-pr-review` spine ops with `pr`. Promoted from spur-dev (task 0617, ADR-051); frozen at exactly these four verbs."
 see_also:
   - spur-cli
 ---
@@ -8,22 +8,24 @@ see_also:
 # spur builder - release plumbing
 
 `spur builder` is the CLI for **version bumps and release tags**. It wraps the internal
-`release-ops` implementation behind a public two-verb surface. The repo-local forwarder
+`release-ops` implementation behind a public four-verb surface. The repo-local forwarder
 (`scripts/commands/release.ts`) and its `spur-dev` dispatcher cases were retired in task 1173; the
 root `bun run bump-ver` / `bun run drop-tags` names route to `spur builder` directly. Package ids are
 the unscoped short names (`@gobing-ai/spur` → `spur`); the released set and the aggregate tag are
 discovered from the repo's own workspace manifests, so the same code serves any git+semver
 monorepo.
 
-This noun is **frozen at exactly two verbs** by operator consent (`docs/design/harness-surface-governance.md`
+This noun is **frozen at exactly four verbs** (`bump-ver`, `drop-tags`, plus `pr` and `publish` from the 2026-10-15 script-absorption entries) by operator consent (`docs/design/harness-surface-governance.md`
 §3) — do not invent additional `builder` subcommands.
 
 ## Verb map
 
 | Verb | Purpose | Key flags |
 | ---- | ------- | --------- |
-| `bump-ver [package-id] <version>` | Bump one package (manifest + in-source `binaryVersion` + consumer `workspace:` pins), commit, tag, optionally push | `--all` `--push` `--json` |
+| `bump-ver [package-id] [version]` | Bump one package (manifest + in-source `binaryVersion` + consumer `workspace:` pins), commit, tag, optionally push; `--check [package-id]` only verifies marketplace/plugin versions (exit 1 on drift) | `--all` `--push` `--check` `--json` |
 | `drop-tags [package-id] <version>` | Delete a package's release tag (local only by default) | `--all` `--remote` `--json` |
+| `publish <dir>` | CI npm publish: resolve `workspace:`/`catalog:` ranges, `build:bundle`, `npm publish --access public`, restore the manifest | `--otp` |
+| `pr <op>` | PR-review spine ops for `/sp:dev-pr-review`: `preflight` `push` `ensure` `hygiene` `request` `wait` `collect` `status` | `--base` `--since` `--head` `--json` `--status-file` |
 
 A bare `bump-ver <version>` (single positional that parses as semver) or explicit `--all` bumps
 every package pinned via `workspace:` by another workspace package, then adds per-package trace
@@ -31,20 +33,39 @@ tags plus the aggregate `@<scope>/<root>-v<version>` publish tag. `drop-tags --a
 for deletion.
 
 **Exit codes:** `0` success, `1` error (invalid semver, unknown package id, dirty tree, detached
-HEAD, or an existing local/origin tag). **Errors abort before any write** — a re-run after fixing
-the cause is safe.
+HEAD, or an existing local/origin tag). Release preflight errors abort before mutation. `publish` temporarily rewrites dependency
+ranges for packaging and restores the original manifest in `finally`, including build/publish
+failures; npm publication itself is an external side effect.
 
 ## `bump-ver` - bump and tag a release
 
 ```bash
+spur builder bump-ver --check               # aggregate marketplace/plugin version drift, read-only
+spur builder bump-ver --check spur          # named package drift, read-only
 spur builder bump-ver spur 0.1.4            # one package: manifest, pins, commit, tag @gobing-ai/spur-v0.1.4
 spur builder bump-ver --all 0.1.4           # every workspace:-pinned package + aggregate tag
 spur builder bump-ver --all 0.1.4 --push    # also push branch + tags to origin
 ```
 
+`--check` accepts only an optional package id; it rejects a version argument and `--all`/`--push`.
+Normal bump mode requires a version. `publish <dir> [--otp <code>]` builds and publishes the
+package using native argv, then restores the original manifest on success or failure.
+
 ## `drop-tags` - delete release tags
 
 ```bash
 spur builder drop-tags spur 0.1.4           # delete the local tag @gobing-ai/spur-v0.1.4
 spur builder drop-tags --all 0.1.4 --remote # delete per-package + aggregate tags, locally and on origin
 ```
+
+## `pr` - PR-review spine ops
+
+```bash
+spur builder pr preflight --json            # repo/gh checks
+spur builder pr ensure --base main --json   # reuse or create the branch PR
+spur builder pr wait --since "$t" --head "$sha" --json   # exit 3 = still pending
+spur builder pr status --json               # read-only composite status
+```
+
+Absorbed from `plugins/sp/scripts/pr-reviewing.ts` (script-absorption PR-7); driven by
+the `pr-review` workflow. Exit codes: `0` ok, `1` usage, `2` hard failure, `3` wait timeout.

package/plugins/sp/skills/spur-cli/references/features.md

@@ -30,6 +30,8 @@ what* or *how to write a scenario*, this skill.
 | `refresh` | Rebuild INDEX + each feature `## Tasks` table from task edges (**docs only**; no status change) | `--feature <id>` `--all` `--folder` `--json` |
 | `check [id]` | Validate one feature / the tree; the 4-layer gate; `--fix` repairs structural findings in place | `--strict` `--fix` `--as <status>` `--folder` `--json` |
 | `sync [id]` | Align feature **lifecycle status** with linked task states (real transitions + guards) | `--all` `--dry-run` `--force` `--folder` `--json` |
+| `verify [id]` | The `feature-verification` pass: run the check set once and record the bound PASS/FAIL receipt — workflow-internal (`feature-lifecycle` runs it) | `--run-id <id>` `--cmd <command>` `--confidence <level>` `--ack-low-confidence` |
+| `handoff [id]` | The `idea-pipeline` finalization: task ordering, roster refresh, handoff report — workflow-internal | `--run-id <id>` `--spur-bin <cmd>` |
 
 **`refresh` vs `sync` (do not conflate):**
 
@@ -40,7 +42,10 @@ what* or *how to write a scenario*, this skill.
 
 `refresh` never runs lifecycle gates. `sync` never rewrites the Tasks table — run both when you need both.
 
-All verbs accept `--json` and `--folder <path>`.
+Corpus verbs advertise `--json` and `--folder <path>` in the table. The workflow-internal
+`verify` and `handoff` verbs accept neither: they write run artifacts and diagnostic stdout.
+`verify` exits 0 after a completed PASS or FAIL; inspect its bound receipt/status file.
+An execution/usage failure exits nonzero.
 
 ## Hierarchical IDs (DD-14)
 

package/plugins/sp/skills/spur-cli/references/history.md

@@ -23,6 +23,9 @@ live in `packages/app/src/services/history-service.ts` (`FanOutResult`, `DailyRe
 | `report [path]` | Purely render an existing artifact; default to `latest.json` | `--mode <name>` `--task <wbs>` `--top <n>` `--json` |
 | `daily` | Run import-all → analyze → artifact → 90-day report pruning once | `--since <iso>` `--until <iso>` `--root <path>` `--source-timeout <ms>` `--mode <name>` `--json` |
 | `reset` | Destructively wipe every `history_*` table for a clean re-import; refuses without `--yes` | `--yes` `--json` |
+| `anatomy <op>` | history-anatomy cache ops behind the `history-anatomy` workflow (`digest`, `check`, `paths`, `assert-clean`, `probe`, `stamp`, `refresh`, `publish`) | op argv (see `spur history anatomy --help`) |
+| `timeline` | Per-prompt work/wait time and tokens from the host transcript (JSON), for `sp:session-review` | `--transcript <path>` `--group <spec>` |
+| `summary` | Daily summary report for `sp:daily-summary` (tokens, git, history health, annotations) | `--date <d>` `--dry-run` `--output <path>` `--no-git` `--no-ccusage` |
 
 Every JSON-capable verb also advertises `--json-envelope`; use the facade's machine-output contract.
 

package/plugins/sp/skills/spur-cli/references/self.md

@@ -19,7 +19,7 @@ top-level forms are omitted from `spur --help`, leaving `self` as the visible su
 | ---- | ------- | --------- |
 | `init` | Scaffold a new Spur project in the current directory | `--name <name>` `--force` `--minimal` `--adopt-global-config` `--json` |
 | `maintain` | Run database maintenance: PRAGMA optimize, WAL truncation, optional VACUUM | `--vacuum` `--json` |
-| `migrate` | Apply CLI-owned schema migrations | `--json` |
+| `migrate` | Apply CLI-owned schema migrations (or `--check` the importer schema) | `--check` `--json` |
 | `serve` | Start the Spur web server (local fallback) | `--port <n>` `--host <addr>` `--no-open` `--cwd <path>` `--json` |
 | `status [path]` | Show project and git status for a Spur project | `--json` |
 
@@ -63,10 +63,12 @@ Executes SQLite database maintenance operations on `.spur/spur.db`:
 ```bash
 spur self migrate                     # apply pending migrations
 spur self migrate --json              # machine-readable { ok, applied }
+spur self migrate --check             # read-only importer-schema drift report (exit 1 on drift)
 ```
 
-Temporary helper: applies CLI-owned schema migrations and reports `{ ok, applied }`. Only flag is
-`--json`.
+Temporary helper: applies CLI-owned schema migrations and reports `{ ok, applied }`. Flags are
+`--json` and `--check`; with `--check` the command only reports importer schema drift, leaves an
+absent database absent, and never repairs.
 
 ## `self serve` - start the local web server
 

package/plugins/sp/skills/spur-cli/references/tasks/verbs.md

@@ -465,6 +465,9 @@ spur task resolve  <file-path> [--strict] [--folder] [--json]
 spur task path     <wbs> [--folder] [--json]
 spur task run-link <wbs> [--source <src>] [--run-id <id>] [--json]
 spur task scaffold-tests <wbs> [--file <path>] [--folder] [--json]
+spur task gate     <wbs> <run|recheck|light|deferred|status> [--cmd <c>] [--probe-cmd <c>] [--proof-digest <d>] [--run-id <id>]
+spur task residual <wbs> <scan|review-gate|fold|settle|report> [--root <dir>] [--tmp-dir <dir>] [--folder]
+spur task diffstat <wbs>
 ```
 
 **No `delete` verb — and that is the surface's shape, not an oversight.** The corpus is

package/plugins/sp/skills/spur-cli/references/tasks.md

@@ -49,6 +49,9 @@ re-reading or re-tokenizing the task.
 | `migrate-anchors` | Qualify in-repo evidence anchors to repo-relative paths (0583 R1–R3); `--wbs` scopes to one task file (1109 R1); retargets scratch `done_reason` verdict pointers (1140) | `--wbs` `--dry-run` `--json` |
 | `refresh-roster <wbs>` | Regenerate a parent task's sub-task roster block in `## Plan` | `--folder` `--json` |
 | `batch-create` | Create many tasks from a validated JSON array | `--file <path>` `--skip-ready` `--agent <selector>` `--folder` `--json` |
+| `batch-plan <mode>` | Batch plan projection: `waves` / `order` / `task-children` (JSON on stdout; the batch driver's visible plan) | `--tasks <file>` `--concurrency <n>` `--letter <A-Z>` `--plan <file>` |
+| `preflight [wbs]` | Read-only batch admission: TABLE A STOP check, quick readiness (`--operation`), one-shot recovery hop; status/deps read from the corpus unless given | `--status <s>` `--deps <list>` `--dep-status <map>` `--operation <op>` `--filtered-count <n>` `--required-sections <list>` `--present-sections <list>` `--force` `--recovery` `--classify-feature <json>` `--folder` `--json` |
+| `wrapup <op>` | One deterministic `wrapup-pipeline` step (`resolve`, `route-reason`, `metrics`, `feature-transition`, `doc-sync-snapshot`, `doc-sync-scope`, `doc-supersession`, `drift-probe`) — workflow-internal | `--run-id <id>` `--tasks <json>` `--mode <m>` `--feature <id>` `--feature-gate-cmd <cmd>` `--spur-bin <cmd>` |
 | `record <wbs>` | Write `Testing` from a verify verdict (deterministic); bare-`## Review` fallback only; optional Solution + transition | `--verdict-file <path>` `--solution-from-diff` `--transition <status>` `--folder` `--json` |
 | `verdict <wbs>` | Derive PASS/PARTIAL/FAIL/UNKNOWN from verify answer text → verdict JSON; see [answer-file shape](tasks/verbs.md#answer-file-shape-what---from-answer-parses) | `--from-answer <path>` `--folder` `--json` |
 | `check [wbs]` | Four-layer validation; `--fix` repairs structure; `--corpus` is the explicit unsuppressed audit; `--precheck` adds the pipeline precheck gate (size + evidence channel, WBS required) | `--strict` `--as <status>` `--strict-core` `--precheck` `--fix` `--folder` `--corpus` `--since <ref>` `--json` |
@@ -57,9 +60,16 @@ re-reading or re-tokenizing the task.
 | `run-link <wbs>` | Record pipeline run provenance link for task | `--source <src>` `--run-id <id>` `--json` |
 | `verifyall-aggregate` | Aggregate per-task verify outcomes into a batch verdict (NOT-STARTED excluded) | `--from-file <path>` `--json` |
 | `scaffold-tests <wbs>` | Generate BDD test stubs from task Acceptance Criteria | `--file <path>` `--folder` `--json` |
-
-All verbs accept `--json` for machine consumption and `--folder <path>` to target a non-default
-tasks folder. **Exit codes:** `0` success, `1` error, `2` invalid usage.
+| `gate <wbs> <mode>` | Task-pipeline quality gate (`run`, `recheck`, `light`, `deferred`, `status`); mode-specific exits and fingerprint-bound receipts (see `sp:spur-check`) | `--cmd <c>` `--probe-cmd <c>` `--proof-digest <d>` `--run-id <id>` |
+| `residual <wbs> <step>` | F96 residual sweep step (`scan`, `review-gate`, `fold`, `settle`, `report`) | `--root <dir>` `--tmp-dir <dir>` `--folder` |
+| `diffstat <wbs>` | Write the triage diffstat artifact against the run base (fails safe to `sensitive: true`) | — |
+
+Use only the flags listed for the selected verb. `batch-plan` emits JSON without `--json`;
+`wrapup`, `gate`, `residual` and `diffstat` use their operation-specific stdout/artifact contracts.
+`run-link`, `verifyall-aggregate` and `migrate-anchors` accept `--json` but no `--folder`;
+`residual` accepts `--folder` but no `--json`. Do not append shared flags to every command.
+General exit codes are `0` success, `1` error, `2` invalid usage; consult the operation contract
+for soft gate modes and specialized refusal codes.
 
 ## Creating tasks
 

package/plugins/sp/skills/spur-cli/references/workflows.md

@@ -97,7 +97,7 @@ Use this skill to:
 
 The skill's logic divides by **whether the LLM adds value**:
 
-- **Direct CLI** (`validate`, `run`, `list`, `trace`, `progress`, `continue`, `cancel`, `clean`) — deterministic,
+- **Direct CLI** (`validate`, `run`, `list`, `trace`, `progress`, `summary`, `profile`, `cost`, `continue`, `cancel`, `clean`) — deterministic,
   single-verb commands. Run them straight. A slash-command wrapper would only forward flags and add
   drift; **there is no command for these — use the CLI**. The skill still drives them in natural
   language (interpreting a failed validate, reading a run trace).
@@ -116,6 +116,11 @@ The skill's logic divides by **whether the LLM adds value**:
 | `list` | `spur workflow list` (CLI) | — | Available workflow **YAML definition files** (not run records) |
 | `trace` | `spur workflow trace` (CLI) | `[run-id] [--workflow <n>] [--status <s>] [--since <iso>] [--last <n>] [--follow] [--poll <ms>] [--output] [--timeout <ms>]` | Run history list or per-run timeline |
 | `progress` | `spur workflow progress` (CLI) | `<run-id>` | The `projectWorkflowProgress` projection for that run — current state, per-action attempts, candidate next transitions, diagnostics. Read-only; the verb renders, `packages/app` derives. Unknown run id exits 1 with `Run <id> not found.` |
+| `summary` | `spur workflow summary` (CLI) | `--progress <[label=]file>`… \| `--rollup <[label=]file>`… `[--transcript] [--since] [--markdown]` | Measured execution summary (per-stage time, wait, tool calls, tokens, actor split) or the batch roll-up `/sp:dev-runall` prints. `n/a` exit 0 without a transcript; exit 2 on usage or unreadable input |
+| `profile` | `spur workflow profile` (CLI) | `<workflow> [--last n] [--window sec] [--spur-bin cmd] [--json]` | Read-only per-node step profile from `spur workflow trace` with the ADR-115 cache-window flags, for `sp:spur-doctor`. Exit 1 when a trace read fails |
+| `cost` | `spur workflow cost` (CLI) | `[--workflow <name>]… [--by-state] [--include-bookkeeping] [--since <date>] [--budget <file>] [--measured-file <json>] [--json]` | Real terminal non-dry run measurements, or a budget result; unknown measurements stay null. Budget failures exit 1 |
+| `inline` | `spur workflow inline <op>` (CLI) | `begin`, `fingerprint`, `node-enter`, `action`, `actions`, `close`, `decide`, `persist-out`, `persist-check`, `attribution`, `dispatch-failure` | The host-inline driver's run lifecycle transport ([inline-pipeline-driver.md](../../spur-dev/references/inline-pipeline-driver.md)); exit 0 ok / 1 fail closed / 2 usage |
+| `commit-guard` | `spur workflow commit-guard <op>` (CLI) | `start\|stage\|check --run <id> [--base <sha>] [-- <paths…>]` | Stages only paths this run wrote; exit 2 when a listed path is refused, 3 on unmerged/conflict-marked targets |
 | `add` | agent procedure | `"<nl-description>" [--kind <state-machine\|transition-flow>] [--file <path>]` | **Mode chosen (confirmed)** → first reconciled against existing workflows (extend an existing flow rather than duplicate) → YAML authored in real schema shape → **validated AND dry-run** (reaches the expected terminal state) → [add](workflows/operations.md#add) |
 | `refine` | agent procedure | `<workflow-file> [--intent "<goal>"] [--dry-run]` | Smallest change meeting the intent, re-validated and re-dry-run; `--dry-run` emits a diff only → [refine](workflows/operations.md#refine) |
 
@@ -266,8 +271,38 @@ spur workflow clean    [--older-than <minutes>] [--force] [--logs] [--dry-run] [
 spur workflow list     [--json]
 spur workflow trace    [run-id] [--workflow <name>] [--status <s>] [--since <iso>] [--last <n>] [--follow] [--poll <ms>] [--output] [--timeout <ms>] [--json]
 spur workflow progress <run-id> [--json]
+spur workflow summary  (--progress <[label=]file>... | --rollup <[label=]file>...) [--transcript <path>] [--since <iso>] [--markdown]
+spur workflow profile  <workflow> [--last <n>] [--window <sec>] [--spur-bin <cmd>] [--json]
+spur workflow cost     [--workflow <name>]... [--by-state] [--include-bookkeeping] [--since <YYYY-MM-DD>] [--budget <file>] [--measured-file <json>] [--json]
+spur workflow inline   <op> [options]
+spur workflow commit-guard <op> [options]
 ```
 
+### `cost` — real-run measurements and budgets
+
+`spur workflow cost` reads `.spur/spur.db`; its default cohort is the project definitions in
+`.spur/workflows/`, excluding bookkeeping. Use repeatable `--workflow <name>` filters to select
+workflows explicitly; bookkeeping names still require `--include-bookkeeping`. Report mode
+considers terminal, non-dry runs; `--since YYYY-MM-DD` filters
+creation time in UTC. Missing measurements remain unknown (`null`), never fabricated zeros.
+
+`--json` emits the stable workflow/state report; `--by-state` selects human state rows when JSON
+is not requested. `--budget <file>` instead emits the budget result (including `ok`, errors and
+exitCode with `--json`) and exits 1 for over-budget, missing-budget or silent-raise failures.
+`--measured-file <json>` is valid only with `--budget`. Budget mode uses its own cohort inputs;
+report-only `--since`, `--by-state` and `--include-bookkeeping` do not change the budget pass.
+Repository promotion policy keeps its selected-run domain query; aggregate cost JSON does not
+replace that distribution.
+
+### CLI launch strings
+
+Workflow `spurBin` defaults to the current absolute CLI invocation: a compiled executable, or
+`<runtime> <entry-module>` for source/JavaScript installs. Shell actions expand this multi-part
+string as `$spurBin`, not `"$spurBin"`; quoting the whole value makes it one executable name.
+The current string transport requires launch paths without spaces. Native `splitLaunchCommand`
+consumers also reject shell metacharacters and shell-quoted command strings; shell expansion itself
+does not validate those strings. Native callers with explicit launch argv preserve argument boundaries.
+
 ### `show` - project a definition
 
 `spur workflow show <file>` renders the declared graph as Mermaid. `--format todo` instead emits a

package/plugins/sp/skills/spur-dev/SKILL.md

@@ -66,7 +66,7 @@ lifecycle, the gates, and the section-write contract (`cross-cutting.md`).
 ```
 vague description
   → intake (clarify scope, constraints — prompt work)
-  → spur feature create … ; AC authored/generated (spur agent run, bdd templates)
+  → spur feature create … ; AC authored/generated (host-inline competency, BDD templates)
   → GATE: spur feature check   (BDD validator; loop until clean)
   → decomposition (prompt work) → task-batch JSON
   → GATE: task-batch.schema.json + spur task batch-create (atomic: all-or-nothing)

package/plugins/sp/skills/spur-dev/references/cross-cutting.md

@@ -258,7 +258,7 @@ procedure and do not fabricate a workflow YAML.
    inventory with `columnLabel` labels; the skill-only refine/verify batches keep the bootstrap rows
    below.
 2. **Quick deterministic readiness (R2) — plan row A1, before isolation.** Evaluate `quickReadiness`
-   (`plugins/sp/scripts/batch-preflight.ts`) with the operation, status, filtered-set size, and the
+   (`spur task preflight <wbs> --operation <op>`) with the operation, status, filtered-set size, and the
    selected matrix required/present sections + content-policy findings. This is an admission decision
    (runnable / needs-refinement / blocked / skipped / invalid), never an implementation certificate.
 3. **Isolation (R3) — plan row A2, only when `--worktree` is valid.** After quick readiness and the

package/plugins/sp/skills/spur-dev/references/dev-operations.md

@@ -60,7 +60,7 @@ each would be scope creep for one-liner procedures.
 > See `plugins/sp/skills/next-router/references/routing-table.md` for the routing SSOT.
 >
 > **Batch consumer (task 0279):** `sp:super-planner` / `/sp:dev-runall` **consumes** TABLE A STOP rows
-> for preflight + one-shot recovery (`plugins/sp/scripts/batch-preflight.ts`) but keeps
+> for preflight + one-shot recovery (`spur task preflight`) but keeps
 > `task-pipeline.yaml` as the happy path. Do **not** deep-merge batch orchestration into a loop of
 > `/sp:dev-next`. Single-task "what's next?" stays `/sp:dev-next`; multi-task execution stays
 > `/sp:dev-runall` → super-planner.
@@ -139,7 +139,7 @@ must not be changed without updating the backing skill.
 - **Inputs:** `<wbs>` (required). Verify executes inline (in-session) by default. `--agent <inline|auto|name>` selector accepted (see [SSOT](cross-cutting.md#inline-default-execution-surface)). `--fix`, `--focus`, `--bdd`, `--auto`, `--force` modulate the verify pass. `--next` (terminal chain link): on the **post-`--fix`** PASS verdict, transition `testing → done` through the FSM (target-aware `--as done` guard honored). On PARTIAL/FAIL or guard failure, stop as review-pending. **`--skip-shippable`** (alias `--skip-shipable`): disable the shippable gate that otherwise runs under `--fix all` when the task has a `feature_id`.
 - **Backing:** `sp:code-verification` skill, `verify` mode.
 - **Behavior:** Status guard → change-scope detection → requirements traceability → SECUA review → verdict aggregation → findings write-back → verdict-artifact emission → optional `--fix` pass → **shippable readiness** (when active). The per-task verdict gates the pipeline's `done` transition. With `--next`: the (post-`--fix`) PASS verdict → transition to `done` (FSM guard honored); PARTIAL/FAIL → stop and surface verdict. Shippable FAIL does not rewrite the task verdict line but must be printed; feature is not “ready.”
-- **Shippable readiness (default on with `--fix all`):** After the task verdict, if `--fix all` and the task has `feature_id` and not `--skip-shippable`, run `spur feature check <id> --json` + linked-task completeness. Emit `Shippable: PASS|FAIL|N/A`. FAIL when feature AC scenarios are orphaned/unverified or any linked task is not `done`/`cancelled`. SSOT procedure: `sp:code-verification` Step 13.
+- **Shippable readiness (default on with `--fix all`):** After the task verdict, if `--fix all` and the task has `feature_id` and not `--skip-shippable`, run `spur feature check <id> --as done --strict --json` + linked-task completeness. Failed/missing completion receipts or required dogfood evidence also block shipping. Emit `Shippable: PASS|FAIL|N/A`. FAIL when feature AC scenarios are orphaned/unverified or any linked task is not `done`/`cancelled`. SSOT procedure: `sp:code-verification` Step 13.
 - **Delegation:** `Skill(skill="sp:code-verification", args="verify $ARGUMENTS")`
 
 ### 3a. verifyall
@@ -165,16 +165,16 @@ must not be changed without updating the backing skill.
 
 #### Execution summary
 
-Produced by the run's own close (1146 R1), not by a trailing step: `inline-run-setup --close` writes
+Produced by the run's own close (1146 R1), not by a trailing step: `spur workflow inline close` writes
 `.spur/run/<runId>-summary.md` + `.json` and reports `summaryFile` in its stdout JSON. The driver's only
 job is to print that file's contents under an `### Execution summary` heading, and to pass `--no-summary`
-through to `--close`. `--no-summary` is a `--close` flag: anywhere else it is a usage error.
+through to `inline close`. `--no-summary` is an `inline close` flag: anywhere else it is a usage error.
 
 `/sp:dev-runall` shows one summary per run — each produced by that run's own close, so each window is its own
 `runs.started_at` → close time and no block reuses a batch-wide window — plus one batch roll-up:
 
 ```
-node "$(superskill script path sp run-summary.mjs)" --rollup <runId>-summary.json --rollup <runId2>-summary.json
+spur workflow summary --rollup <runId>-summary.json --rollup <runId2>-summary.json
 ```
 
 which renders one row per run (that run's own Total) and a bold total of the sums; when run windows overlap it
@@ -193,7 +193,7 @@ check receipt (`receipt.runId === runId`), otherwise `n/a (<reason>)`. Any value
 
 - **Purpose:** Refine a task's requirements via structured Q&A — clarify scope, elicit missing details, tighten acceptance criteria before execution. Optional **implement-ready** depth freezes Design/Requirements/Plan so another agent can implement without inventing design, and is also the path for **evaluating and correcting an existing task** — a review-triage filing, a stale backlog capture, or any task whose claims and proposed fixes may no longer hold.
 - **Inputs:** `<wbs>` (required). `--focus <mode>` narrows the gap analysis (values below). `--description <text>` injects operator framing into the Q&A/synthesis. `--depth <standard|ready>` (default **`standard`**) sets the depth bar — see [flag-glossary.md](flag-glossary.md#flag-depth). Execution defaults to inline (in-session); `--agent <inline|auto|name>` selector accepted (see [SSOT](cross-cutting.md#inline-default-execution-surface)). `--auto` skips interactive Q&A (synthesis only) and propagates down the `--next` chain. `--next`: advance to the next step — transition `backlog → todo` through the FSM **idempotently** (only when `status == backlog`; a task already at `todo` or past it skips the transition and chains anyway — `status >= todo` ⇒ already advanced) and invoke `/sp:dev-run <wbs> --mode implement --auto --next`. On a guard/refine failure, stop as review-pending.
-- **Status scope:** refine targets `backlog`/`todo` tasks (the same rule `batch-preflight` applies to refineall). A task at `wip` or later has an implementation built on its current spec. Refine it only on an explicit operator request, never under `--auto` alone, and never move its status backwards.
+- **Status scope:** refine targets `backlog`/`todo` tasks (the same rule `spur task preflight` applies to refineall). A task at `wip` or later has an implementation built on its current spec. Refine it only on an explicit operator request, never under `--auto` alone, and never move its status backwards.
 - **`--focus` values** (hint bundles for the gap analysis/Q&A; default `all`):
 
   | Value | Domain hints | When |
@@ -481,7 +481,7 @@ gate commands, pending questions and approval requirements.>
 ### 13. runall
 
 - **Purpose:** Run a batch of tasks through their pipelines in dependency-correct order — resolve a set, topo-sort, run each via `task-pipeline.yaml`, inspect verdicts, apply the failure policy, emit a batch report.
-- **Inputs:** `--tasks <selector>` (required — explicit WBS list, status pseudo-list, `feature:<id>`, or `ready`). `--mode <sequential|parallel>` (default `sequential`; `parallel` fans out a proven-independent subset per `execution-batch.md` § Parallel Execution). `--keep-going` skips a failed task's in-batch dependents and continues independents (default halts on first failure). `--auto` sets `profile=auto` on each per-task run (skips the HITL approve gate). `--feature <id>` is sugar for `--tasks feature:<id>`; when the effective selector is feature-derived, the batch runs `spur feature check <id> --fix --json` then `spur feature check <id> --strict --json` **once** before task resolution — a non-zero strict check aborts with verdict `aborted`, zero attempted tasks, and the structured findings (task 0510 R2); scoped: `L4.scenario-unverified` and `L4.verifying-incomplete-tasks` (expected pre-run states of a not-yet-run or reopened feature) are reported verbatim but do not abort — the non-aborting set is `NON_ABORTING_PREFLIGHT_CODES` in `plugins/sp/scripts/batch-preflight.ts` and `--fix` repairs are listed under `autoRepairs` — any other strict error aborts. Explicit WBS/status/`ready` selectors add no feature check. The orchestrator loop itself continues in this session; interactive sequential omit/`inline` uses the host driver — host-controlled with eligible `agent.run` stages dispatching once to a native subagent and host fallback (task 0508) — while `--agent auto`/a name, parallel mode, and headless invocation keep the isolated per-task workflow subprocess boundary. `--agent <inline|auto|name>` pins the executor for the per-task stages (see [SSOT](cross-cutting.md#inline-default-execution-surface)); the value crosses into per-task `vars.agent`, not the orchestrator. `--json` emits the report as JSON. `--wrap` triggers `wrapup-pipeline.yaml` **once for the batch** over the `done` subset only (execution-batch.md Step 6: `vars.feature` only when every frozen task is `done`/`cancelled`; empty done subset skips with a reason), `--next` chains each task to terminal status then runs the same batch-once wrap, `--continue` resumes from checkpoint. `--no-summary` skips the [execution summary](#execution-summary) printed after the batch report (one row per attempted run).
+- **Inputs:** `--tasks <selector>` (required — explicit WBS list, status pseudo-list, `feature:<id>`, or `ready`). `--mode <sequential|parallel>` (default `sequential`; `parallel` fans out a proven-independent subset per `execution-batch.md` § Parallel Execution). `--keep-going` skips a failed task's in-batch dependents and continues independents (default halts on first failure). `--auto` sets `profile=auto` on each per-task run (skips the HITL approve gate). `--feature <id>` is sugar for `--tasks feature:<id>`; when the effective selector is feature-derived, the batch runs `spur feature check <id> --fix --json` then `spur feature check <id> --strict --json` **once** before task resolution — a non-zero strict check aborts with verdict `aborted`, zero attempted tasks, and the structured findings (task 0510 R2); scoped: `L4.scenario-unverified` and `L4.verifying-incomplete-tasks` (expected pre-run states of a not-yet-run or reopened feature) are reported verbatim but do not abort — the non-aborting set is `NON_ABORTING_PREFLIGHT_CODES` behind `spur task preflight --classify-feature` and `--fix` repairs are listed under `autoRepairs` — any other strict error aborts. Explicit WBS/status/`ready` selectors add no feature check. The orchestrator loop itself continues in this session; interactive sequential omit/`inline` uses the host driver — host-controlled with eligible `agent.run` stages dispatching once to a native subagent and host fallback (task 0508) — while `--agent auto`/a name, parallel mode, and headless invocation keep the isolated per-task workflow subprocess boundary. `--agent <inline|auto|name>` pins the executor for the per-task stages (see [SSOT](cross-cutting.md#inline-default-execution-surface)); the value crosses into per-task `vars.agent`, not the orchestrator. `--json` emits the report as JSON. `--wrap` triggers `wrapup-pipeline.yaml` **once for the batch** over the `done` subset only (execution-batch.md Step 6: `vars.feature` only when every frozen task is `done`/`cancelled`; empty done subset skips with a reason), `--next` chains each task to terminal status then runs the same batch-once wrap, `--continue` resumes from checkpoint. `--no-summary` skips the [execution summary](#execution-summary) printed after the batch report (one row per attempted run).
 - **Three orthogonal axes (do not confuse):** `--keep-going` = batch failure policy (halt vs skip dependents); `--continue` = resume from checkpoint against the batch's original frozen identity (execution-batch.md § Batch continuation, task 0919); `--next` = per-task lifecycle chaining (advance status on a verdict — `dev-verify`/`dev-verifyall` only). `routing-table.md` offers `--continue` and `--next` as competing options for the same situation only when the batch was interrupted mid-run; otherwise they address different problems.
 - **Backing:** `sp:spur-dev` skill, `runall` operation → delegates the driver loop to the **`sp:super-planner`** agent (the batch orchestrator).
 - **Behavior:** The orchestrator reads [execution-batch.md](execution-batch.md) and drives: resolve selector → freeze set → topo-sort by `dependencies[]` (Kahn, WBS-ascending tie-break; cycle aborts) → resolve out-of-set deps by status (done → allow, else → block subtree) → run each task via `spur workflow run task-pipeline.yaml --async` + `spur workflow trace` polling → inspect terminal state + `.spur/run/<wbs>-verdict.json` → stop-the-batch default or `--keep-going` subtree skip → emit batch report. Per-task pipeline is invoked **verbatim** — no new FSM, no step edits. `--auto`/`--agent` are the only flags that cross the orchestrator→pipeline boundary (both into per-task `--vars`).
@@ -590,11 +590,11 @@ host instructions does not add one. An opt-in gate is explicit: `gitmsg --check
      - `keepachangelog` (default): `## [<version>] - <date>` header, then category headings per the keepachangelog convention — `### Added` / `### Fixed` / `### Changed` / `### Removed` / `### Other` — mapped from conventional-commit types.
      - `simple`: flat bulleted list grouped by type heading (`### feat`, `### fix`, …).
   6. Emit: with `<file>`, insert the section into that file above its newest `## [` release heading (or after its title when none exists) and touch nothing else in the file; without `<file>`, print it to stdout.
-  7. **Verify claims before emitting:** scan the generated bullets for API/library claims — bullets asserting what code, APIs, libraries, dependencies, or versions do (skip merge/bookkeeping bullets that assert no such fact). Verify each affected bullet, then append an HTML comment line directly under it: `<!-- src: <citation> · <HIGH|MEDIUM|LOW> -->`.
-     - Internal claims (what a commit or the code does): confirm against the commit diff (`git show --stat <hash>`, reading hunks when the summary asserts behavior) or the artifact's presence in the tree; cite `path[:line]` — bare path for whole-file claims, `path:line` for a specific behavior or symbol.
-     - External claims (framework/library/version behavior): confirm against official docs for the installed version; cite the URL. Unverifiable → LOW plus the reason in one clause.
-     - Confidence: HIGH = the diff/artifact confirms the summary as written; MEDIUM = the evidence is real but narrower than the summary; LOW = cannot be confirmed from available sources.
-  8. Self-check before emitting: every short hash in `<since>..<until>` appears exactly once, and every verified bullet carries exactly one `<!-- src: … -->` comment whose level is `HIGH`, `MEDIUM`, or `LOW` — no off-rubric levels, no unannotated claim bullets. Fix any miss, duplicate, or bad level; do not report a verdict.
+  7. **Verify claims before emitting — two checks, both required, on every claim bullet.** Classify first: an *API/library claim* is a bullet asserting what code, an API, a library, a dependency or a version does — skip merge/bookkeeping bullets that assert no such fact (a status move, a filing, a doc relocation). Then run both checks and append one HTML comment line directly under the bullet carrying both results: `<!-- src: <citation> · <HIGH|MEDIUM|LOW> -->`.
+     - **(a) Source citation — the anchor.** Internal claims (what a commit or the code does): confirm against the commit diff (`git show --stat <hash>`, reading hunks when the summary asserts behavior) or the artifact's presence in the tree; cite `path[:line]` — bare path for whole-file claims, `path:line` for a specific behavior or symbol. External claims (framework/library/version behavior): confirm against official docs for the installed version; cite the URL. An anchor you cannot produce fails the check — reword the bullet or drop the claim; a citation is not a citation until it names something a reader can open.
+     - **(b) Confidence level — exactly one in-rubric token.** HIGH = the diff/artifact confirms the summary as written; MEDIUM = the evidence is real but narrower than the summary; LOW = cannot be confirmed from available sources (append the reason in one clause). A missing level, an off-rubric token, or two levels on one bullet fails the check.
+     - **Defect precision decides what must be fixed.** Both checks are precise once a bullet is classified as a claim: an annotation missing its anchor or its level is unambiguously wrong and blocks emitting. Which bullets *are* claims is the heuristic half — resolve it by this step's rule, and for a genuinely borderline bullet say so in the bullet's body rather than annotating or skipping it silently.
+  8. Self-check before emitting: every short hash in `<since>..<until>` appears exactly once, and every claim bullet carries exactly one `<!-- src: … -->` comment holding exactly one anchor and exactly one of `HIGH`, `MEDIUM`, `LOW` — no unannotated claim bullets, no duplicate annotations, no doubled or off-rubric levels. Fix any miss, duplicate, or bad level; do not report a verdict.
   9. Reply in at most three lines: the range, bullet counts per category plus verified-claim counts (`x HIGH / y MEDIUM / z LOW`), and the output target.
 - **Invariants:** Bullets are derived from `git log` only; the claim-verification pass (step 7) adds evidence from commit diffs, the working tree, and official docs. No quality gates — no `bun run gate`/lint/typecheck/test/`spur-check`/rule runs, and no edits beyond the one inserted section (its verification comments included). The file is left uncommitted.
 

package/plugins/sp/skills/spur-dev/references/execution-batch-report.md

@@ -85,14 +85,14 @@ batch can never destroy its own evidence. Reuse mode retains its operator-owned
 persists the Step 5 report under the invoking tree; the reused tree's `.spur/run/` remains the live
 copy while that tree lives on. The per-run provenance — the worktree DB's run/action rows and the
 `.spur/memory/runs/<runId>.md` + `.state.json` records — is persisted mechanically by WT-4a's
-`inline-run-setup.ts --persist-out --from <worktree> [--task-file <merged-task>]...` call,
+`spur workflow inline persist-out --from <worktree> [--task-file <merged-task>]...` call,
 not by hand.
 
 **Stage records are worktree-local too (0948 R9, E7 Finding 5; persisted by 0975 R1).** Each task's
 own per-stage run record (`.spur/memory/runs/<runId>.md` + `.state.json`) and the worktree DB's run rows are
 written inside the worktree and **are removed with it** in create mode — the E7 batch lost exactly
 this evidence. Copying them out is no longer a manual audit-time duty: WT-4a (create-mode block
-below) runs `inline-run-setup.ts --persist-out --from "$WT_PATH"` **before** WT-4b holder cleanup,
+below) runs `spur workflow inline persist-out --from "$WT_PATH"` **before** WT-4b holder cleanup,
 which copies the run/action/phase/transition/workflow-state rows and both record files into the
 invoking tree.
 
@@ -106,7 +106,7 @@ obligation; neither do root-qualified paths (`knowledge-kit/.spur/run/…`, `/ab
 which cite another project's evidence — cite foreign run artifacts that way, never bare. A citation missing in BOTH trees, a divergent cited file (never overwritten — reconcile
 by hand), an unreadable task file, or more than 64 distinct cited files fails the pass → WT-5.
 
-**Durable planes ride it too (E71).** Persist-out copies canonical task verdicts, feature run/latest receipts, nested run artifacts and owned sessions before teardown. Artifact and task-run-link rows are exported with run rows, and stored path references are redirected to the invoking tree. Conflicting or unreadable **owned** retained evidence refuses teardown. A divergent copy of evidence a forwarded task does **not** own (its WBS is not a forwarded task's and its receipt `runId` is not a worktree run row) is `foreign-divergent` (1139 R5): it is skipped, reported as `evidenceSkipped[{name, reason:'foreign-divergent', newer:'invoking'|'worktree'}]`, and the invoking-tree copy is never overwritten — another task's newer verdict can no longer block this batch's teardown. A divergent **owned** file still fails with `durable evidence conflicts`. `persist-out-check` accepts the same foreign-divergent set from the success JSON and does not recompute it.
+**Durable planes ride it too (E71).** Persist-out copies canonical task verdicts, feature run/latest receipts, nested run artifacts and owned sessions before teardown. Artifact and task-run-link rows are exported with run rows, and stored path references are redirected to the invoking tree. Conflicting or unreadable **owned** retained evidence refuses teardown. A divergent copy of evidence a forwarded task does **not** own (its WBS is not a forwarded task's and its receipt `runId` is not a worktree run row) is `foreign-divergent` (1139 R5): it is skipped, reported as `evidenceSkipped[{name, reason:'foreign-divergent', newer:'invoking'|'worktree'}]`, and the invoking-tree copy is never overwritten — another task's newer verdict can no longer block this batch's teardown. A divergent **owned** file still fails with `durable evidence conflicts`. `spur workflow inline persist-check` accepts the same foreign-divergent set from the success JSON and does not recompute it.
 
 **Owned evidence rides it too (1012).** With at least one `--task-file`, persist-out also treats as
 copy obligations the worktree's `.spur/run/` direct children named `<wbs>-…` (the WBS is each
@@ -124,7 +124,7 @@ pass before the invoking tree is written → WT-5. Without `--task-file` nothing
 The shapes are pinned (task 0975 R1; `record-missing`, citation behavior per 0984; `evidenceSkipped` per 1139 R5): idempotent on re-persist;
 success exits 0 printing
 `{"ok":true,"persisted":<n>,"skipped":[{"id":<run-id>,"reason":"id-exists"|"external-key-conflict"|"record-conflict:<file>"|"record-missing:<file>"|"cited-directory:<name>"|"cited-symlink:<name>"|"cited-non-file:<name>"}],"evidenceSkipped":[{"name":<file>,"reason":"foreign-divergent","newer":"invoking"|"worktree"}]}`
-(`evidenceSkipped` is omitted when empty; the same object is written to `<invoking-tree>/.spur/run/persist-out.json` for `persist-out-check` to read)
+(`evidenceSkipped` is omitted when empty; the same object is written to `<invoking-tree>/.spur/run/persist-out.json` for `spur workflow inline persist-check` to read)
 — an `external-key-conflict` skip leaves the target run unchanged **and fails the pass (1049)**: the delegate exits 1 printing `{"ok":false,"error":…}` naming the skipped source run ids, because that (workflow, external key) identity already belongs to a different receiving run — the batch was not persisted, so reconcile the source worktree by hand (it stays the provenance owner of record) before any teardown: auditable reconciliation names the original archived DB snapshot and the skipped source run identities, verifies the archive by file hash and by merged-commit ancestry of the source branch, and treats any residual deletion as explicit operator-authorized cleanup under the strict canonical evidence rules above. Task 1149 R1 grades a terminal duplicate lifecycle row (`task-lifecycle`/`feature-lifecycle`) as `external-key-conflict-bookkeeping` (non-fatal), so guarded transitions driven inside the worktree do not block teardown; the receiving lifecycle row is reconciled automatically during persist-out. An `id-exists` replay repairs missing owned artifacts and task links without duplicating them. A
 `record-conflict:<file>` never overwrites a divergent invoking-tree record and causes the delegate to exit 1, retaining the worktree. Before reconciling one by hand, check **what** the invoking record is: when the run closed `done` inside a linked worktree the owning tree holds that run's **WT-0 landing obligation** (`landing: required branch=… path=… base=…`, see [execution-worktree-landing.md § WT-0](execution-worktree-landing.md#wt-0--markerless-worktree-runs)) — a 3-line record that is *not* a stub of the worktree's stage narrative, so copying the worktree record over it destroys the very obligation a later merge must rewrite. The reconciliation is therefore: discharge the obligation in place (`landing: merged <sha>` or `landing: retained`), and preserve the worktree narrative beside it (e.g. `<runId>.worktree-provenance.md`) rather than in place of it. A
 `record-missing:<file>` skip is a known `task-lifecycle`/`feature-lifecycle` row with no record file
@@ -140,7 +140,7 @@ invoking tree shows the merged run `done` with its per-action rows.
 the batch roll-up built from the per-run files:
 
 ```bash
-node "$(superskill script path sp run-summary.mjs)" --rollup <runId>-summary.json --rollup <runId2>-summary.json
+spur workflow summary --rollup <runId>-summary.json --rollup <runId2>-summary.json
 ```
 
 One row per run carrying that run's own Total, a bold total of the sums, and — when run windows overlap —
@@ -155,7 +155,7 @@ The wrap receives only what it would accept:
 
 1. `vars.tasks` = the JSON-encoded array of batch WBS whose terminal status is `done`. A task that
    is `failed`/`blocked`/`skipped`/`not-attempted`/`recheck`/`not-admitted` is **excluded** —
-   `wrapup task-resolve` refuses non-done members (wrapup-steps.ts task-resolve), so the driver
+   `wrapup task-resolve` refuses non-done members (`spur task wrapup resolve`), so the driver
    simply stops handing the wrap tasks it would refuse.
 2. `vars.feature` = the batch feature **only when every task in the frozen batch is `done` or
    `cancelled`**. Otherwise omit it and print `feature lifecycle not advanced: <n> task(s)
@@ -173,7 +173,7 @@ an empty string disables the check while still recording PASS. A FAIL routes the
 with already-written learnings/docs preserved — fix the flagged working-diff violation and re-run
 the wrap.
 
-Filtering lives here, in the batch driver — no change to wrapup-pipeline.yaml or wrapup-steps.ts;
+Filtering lives here, in the batch driver — no change to wrapup-pipeline.yaml or `spur task wrapup`;
 the wrap's refusal of non-done tasks remains the hard invariant.
 
 **Close-out commit (1129 R2/R5).** In sequential mode the wrap's writes (learnings, metrics,
@@ -185,12 +185,11 @@ batch tip — the step that makes the close-out the report's own contradiction).
 is never a point on the base ref.
 Stage them through the guard — never a free-form `git add` — so a concurrent writer's file cannot
 ride into the close-out commit (incident `36f274590`). `$RUN_ID` is the id Step 3 fixed before
-`commit-guard start` (execution-batch.md § Step 3); an unset id makes the guard exit 1 — fail closed:
+`spur workflow commit-guard start` (execution-batch.md § Step 3); an unset id makes the guard exit 1 — fail closed:
 
 ```bash
-GUARD=plugins/sp/scripts/commit-guard.ts; [ -f config/plugin-scripts.json -a -f "$GUARD" ] || GUARD="$(superskill script path sp commit-guard.mjs 2>/dev/null)"
-bun "$GUARD" check --run "$RUN_ID"                    # 1129 R3: a non-empty foreign list goes in the batch report
-bun "$GUARD" stage --run "$RUN_ID" -- <files the wrap wrote> \
+spur workflow commit-guard check --run "$RUN_ID"      # 1129 R3: a non-empty foreign list goes in the batch report
+spur workflow commit-guard stage --run "$RUN_ID" -- <files the wrap wrote> \
   || { echo "close-out halt: commit-guard refused a path (foreign, unmerged or conflict-marked); nothing committed" >&2; exit 1; }
 git commit -m "chore(wrap): <command> <selector> close-out writes"
 ```