@gobing-ai/spur 0.4.8 → 0.4.10

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.4.8",
+            "version": "0.4.10",
             "source": "./plugins/sp"
         }
     ]

package/config/pipeline-budgets.json

@@ -1,7 +1,7 @@
 {
     "schemaVersion": 1,
     "generatedAt": "2026-08-20T00:00:00.000Z",
-    "note": "Per-pipeline model-query + wall-clock cost budgets (task 0607 R3). modelQueries anchors the live workflow definitions' query lists — the SSOT, extracted by extractResolvedWorkflowFacts and guarded by composition-baseline.test.ts (0775 retired the snapshot this file previously anchored to). wallClockMs is a gross-regression ceiling anchored to measured real-run data (R5): the gate compares the median-of-sane terminal-run wall-clock against it. A null budget is unenforced until measured — never treated as 0. Raising a numeric budget requires a fresh recorded decision in the same commit (config/pipeline-budgets.json vs git HEAD); the check-pipeline-budgets gate fails a silent raise by name.",
+    "note": "Per-pipeline model-query + wall-clock cost budgets (task 0607 R3). modelQueries anchors the live workflow definitions' query lists — the SSOT, extracted by extractResolvedWorkflowFacts and guarded by composition-baseline.test.ts (0775 retired the snapshot this file previously anchored to). wallClockMs is a gross-regression ceiling anchored to measured real-run data (R5): the gate compares the median-of-sane terminal-run wall-clock against it. A null budget is unenforced until measured — never treated as 0. Raising a numeric budget requires a fresh recorded decision in the same commit (config/pipeline-budgets.json vs git HEAD); the `spur workflow cost --budget` gate fails a silent raise by name.",
     "budgets": {
         "task-pipeline": {
             "modelQueries": 4,
@@ -39,7 +39,7 @@
             "modelQueries": 3,
             "wallClockMs": null,
             "tokenCostUsd": null,
-            "source": "Coverage entry (0826 R2): the live definition's model-query count (extractResolvedWorkflowFacts, 2026-09-11). No real-run measurement yet: wall-clock and cost are unenforced until measured, never 0. 0920 recount 2026-09-23: 4 -> 3 — the resolve-scope model hop was removed; scope/window validation is deterministic in the history-anatomy-cache paths command.",
+            "source": "Coverage entry (0826 R2): the live definition's model-query count (extractResolvedWorkflowFacts, 2026-09-11). No real-run measurement yet: wall-clock and cost are unenforced until measured, never 0. 0920 recount 2026-09-23: 4 -> 3 — the resolve-scope model hop was removed; scope/window validation is deterministic in the `spur history anatomy paths` op (history-anatomy-cache before script-absorption PR-6).",
             "decision": null
         },
         "wayfinder-resolution": {

package/config/rules/README.md

@@ -17,7 +17,7 @@ install or to ts-libs.
 | `surface` | `surface/` | CLI surface consistency (registerXxxCommand wiring, --json serialization) |
 | `migration` | `migration/` | Transitional helpers for the regex → `rg` evaluator move (`rg-dialect`) |
 | `ui` | `ui/` | Web UI seam boundaries (import seam, daisyUI class leak) |
-| `docs` | `docs/` | Sourced API/library claims in markdown — citation anchor + HIGH/MEDIUM/LOW level. Advisory (`info`), and deliberately **not** in a preset: see the file header for its calibration audit and the one-line promotion step. |
+| `docs` | `docs/` | Sourced API/library claims in markdown — same-line citation anchor (no confidence level, ADR-138). Advisory (`info`), and deliberately **not** in a preset: see the file header for its calibration audit. |
 
 ## Presets
 

package/config/rules/boundary/config-loading-ownership.yaml

@@ -67,6 +67,7 @@ rules:
     exclude:
       - "packages/config/src/**"
       - "apps/cli/src/index.ts"
+      - "apps/cli/src/workflow-transport.ts" # boot-free composition root of `spur workflow inline|commit-guard` (PR-4)
       - "apps/server/src/serve.ts"
       - "apps/server/src/context.ts"
       - "**/tests/**"

package/config/rules/boundary/env-var-hygiene.yaml

@@ -13,7 +13,6 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 #   gateway — because `superskill install` bundles them on targets with no
 #   node_modules, where any `@gobing-ai/*` import fails ("Bundle failed", task
 #   0669). It mirrors the upstream semantics and is the one exempt file.
-#   The `superskill script convert` `.mjs` twins remain self-contained by inlining.
 # - `apps/web` uses `import.meta.env` (Vite browser plane) — not process env, never matches.
 # - Which variables exist and who consumes them is documented in `.env.example`.
 #   (The former per-var lease table moved there; the rule now enforces the funnel,

package/config/rules/boundary/sp-plugin-standalone.yaml

@@ -12,7 +12,7 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 # - plugins/sp/hooks/**, plugins/sp/scripts/**, plugins/sp/lib/** may value-import
 #   only `node:*` builtins and relative paths (vendored helpers live in plugins/sp/lib/).
 # - `import type` / `export type` from any package is fine — erased before bundling
-#   (e.g. inline-run-setup.ts's type-only import from @gobing-ai/app).
+#   (a type-only import from @gobing-ai/app is safe).
 # - This rule is the author-time tripwire over DIRECT imports; the transitive closure
 #   and the real `superskill install` path are checked by `bun run plugin-smoke`, and
 #   script-contract-check Rule 5 (manifest-aware) fails the spur-check gate.

package/config/rules/boundary/sp-script-placement.yaml

@@ -2,11 +2,11 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 # [boundary] ADR-130 script placement contract (task 1000). Runs the fast
 # --placement-only mode of the relocated script-contract-check on every
 # recommended-pre-check; SKIPs outside the Spur source repo (same pattern as
-# strict/rule-files-structural.yaml SKIP on missing yq). The full twin check
-# stays in spur-check-feature.
+# strict/rule-files-structural.yaml SKIP on missing yq). The full hook-only
+# layout check (`bun run script-contract-check`) stays in spur-check-feature.
 rules:
   - id: sp-script-placement
-    description: "Plugins/sp scripts must honor the ADR-130 placement contract (glue budget, no db imports, no corpus parsing, no noun clash); baseline config/script-placement-baseline.json can only shrink."
+    description: "plugins/sp and scripts/commands must honor the ADR-130 placement contract (hook entry budget, no DB driver or corpus parsing in plugin scripts/hooks/lib, no raw DB driver in scripts/commands, no noun clash, ADR-129 hook layout); any finding fails, no baseline."
     severity: error
     evaluator:
       type: exit-code

package/config/rules/docs/sourced-api-claims.yaml

@@ -1,40 +1,18 @@
 $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
-# Sourced-claims rules (docs corpus) — API/library claims in markdown must be
-# verifiable. A bare version string or a time-anchored API claim ("deprecated
-# since", "added in 0.5.x") on a line with no citation anchor (http(s) URL or a
-# repo path:line reference) is an unverifyable claim: readers cannot tell
-# measured fact from model memory. The deterministic scan is line-level and
-# heuristic — code fences and command examples can legitimately carry bare
-# versions, so severity is info (advisory visibility; the recommended-pre-check
-# gate runs --fail-on warning, so this rule surfaces findings for review without
-# reddening gates — changed-file enforcement happens in SECUA review).
+# Sourced-claims rules (docs corpus) — an external API/library claim in markdown
+# (a bare x.y.z version, or "deprecated since / added in / removed in <v>") must carry
+# a same-line citation anchor: an http(s) URL or a repo path:line. Contract owned by
+# sp-source-driven-development; changed-file enforcement is SECUA review.
 #
-# Calibration audit (2026-10-12, `spur rule run --file … --json`, unsuppressed):
-# the category was pulled from `recommended-pre-check` on 2026-10-08 for "finding
-# noise" — 593 findings. The audit split them 580 `cited-version-strings` /
-# 13 `cited-api-claims`, and 579 of the 580 were false positives on two shapes
-# that are not external claims at all: a document's own version
-# (`docs/00_ADR.md:5` → `version: 1.69.0`), a section number in a heading
-# (`docs/04_DESIGN.md:116` → `### 1.0.1 Shared option registry`) and a
-# `§`-numbered cross-reference (`docs/00_ADR.md:1118` → `§1.2.1`). All three are
-# excluded by the pattern below — the first two on the line's shape, the third on
-# the token itself. The remaining source was a stale exclude list that stopped at
-# `docs/tasks4/` while the active corpus folder is `docs/tasks5/`, which alone
-# produced 226 findings; it is now one `docs/tasks*/**` glob. 593 → 330 after those
-# two fixes, then 277 once the `§` shape was excluded too — the residual are
-# version-pinned package claims that genuinely lack a same-line anchor, and they
-# stay visible rather than suppressed.
+# Severity is info and the category is deliberately NOT in any preset: the scan is
+# line-level, fires inside code fences, and its residual is a review surface, not a
+# gate (2026-10-12 audit: 593 → 277 findings after the shape/`§`/excludes fixes; the
+# 2026-10-16 widening admitted only verbs whose shape vouches for a version).
+# Re-measure with `spur rule run --file … --json` before widening the vocabulary.
 #
-# The semantic contract — every external API/library claim carries a source
-# citation (URL or path:line) AND a confidence level (HIGH/MEDIUM/LOW) — is
-# owned by the sp-source-driven-development skill and verified in SECUA review
-# (code-verification secu-review checklist). These rules are its deterministic
-# backstop: the two `cited-*` rules cover the citation half, and
-# `cited-api-claims-confidence` covers the level half. All are severity `info`,
-# and the category is deliberately NOT in `recommended-pre-check` — it surfaces
-# findings for review without reddening gates. The 2026-10-12 audit below settled
-# the promotion question: the residual findings stay a review-surface concern
-# (SECUA checklist), not a gate one — do not add `- docs` to that preset.
+# Citation only — no HIGH/MEDIUM/LOW level rule (ADR-138, task 1221): a model can
+# write HIGH as easily as a claim, so the level verified nothing. The anchor is the
+# evidence; do not reintroduce a level half.
 include:
   - "docs/**/*.md"
   - "plugins/sp/skills/**/references/**/*.md"
@@ -47,6 +25,11 @@ exclude:
   # fallback strips the `*` down to `docs/tasks/` — which is why that form
   # silently excluded nothing (measured 2026-10-12).
   - "docs/tasks*/**"
+  # Dated working records — see the "Historical-record excludes" note above.
+  - "docs/report*/**"
+  - "docs/dogfood/**"
+  - "docs/plans/**"
+  - "docs/analysis/**"
   - "drizzle/**"
   - "**/node_modules/**"
 rules:
@@ -55,8 +38,8 @@ rules:
       A markdown line asserting a version string (x.y.z) without a citation
       anchor on the same line — http(s) URL or repo path reference like
       packages/app/src/foo.ts:123 — is unverifyable. Add the anchor, or drop
-      the version if it is not load-bearing. Confidence level (HIGH/MEDIUM/LOW)
-      is part of the claim contract; see sp-source-driven-development.
+      the version if it is not load-bearing; contract in
+      sp-source-driven-development.
     severity: info
     evaluator:
       type: regex
@@ -66,40 +49,22 @@ rules:
         # contains a semver-ish token. Lookarounds exclude IPs (127.0.0.1),
         # longer dotted numerics, a heading's section number (`### 1.0.1 Title`),
         # a document-version metadata line (`version: 1.69.0`) and a `§`-numbered
-        # section reference (`§7.3.1`) — none of which is an external claim;
-        # fenced-code lines are out of regex reach — that residual noise is why
-        # this is info, not warning. The `§` guard sits on the token itself, not on
-        # the line, so a line carrying both a section reference and a real version
-        # still fires on the version.
+        # section reference (`§7.3.1`) — none of which is an external claim.
+        # Fenced code and command examples can legitimately carry bare versions and
+        # are NOT skipped by the evaluator (measured 2026-10-16) — that residual
+        # noise, with the above, is why this is info, not warning. The `§` guard sits
+        # on the token itself, not on the line, so a line carrying both a section
+        # reference and a real version still fires on the version.
         pattern: "^(?!.*(?:https?://|(?:[\\w.-]+/)+[\\w.-]+:\\d+))(?!\\s*#{1,6}\\s+\\d+\\.\\d+\\.\\d+)(?!\\s*[\\w-]+:\\s*\\d+\\.\\d+\\.\\d+\\s*$).*(?<![\\d.§])\\d+\\.\\d+\\.\\d+(?!\\.\\d)"
   - id: cited-api-claims
     description: >
       A markdown line making a time- or version-anchored external API claim
-      ("deprecated since 1.2", "introduced in v3", "available since 0.9") must
-      carry a citation anchor on the same line — URL or repo path:line. Add the
-      source (URL or path:line) and the confidence level (HIGH/MEDIUM/LOW);
-      contract in sp-source-driven-development.
+      ("deprecated since 1.2", "introduced in v3", "removed in 0.9") must carry
+      a citation anchor on the same line — URL or repo path:line; contract in
+      sp-source-driven-development.
     severity: info
     evaluator:
       type: regex
       config:
         mode: forbid
-        pattern: "^(?!.*(?:https?://|(?:[\\w.-]+/)+[\\w.-]+:\\d+)).*\\b(?:deprecated (?:since|in|as of)|introduced in|added in|available since|stable since)\\b"
-  - id: cited-api-claims-confidence
-    description: >
-      A markdown line making a time- or version-anchored external API claim
-      ("deprecated since 1.2", "introduced in v3", "available since 0.9") must
-      also state its confidence level — HIGH, MEDIUM or LOW — so a reader can
-      tell a checked fact from model memory; contract in
-      sp-source-driven-development. Pairs with `cited-api-claims`, which covers
-      the citation half: a line missing both halves reports once per rule,
-      deliberately, because each missing half is its own defect.
-    severity: info
-    evaluator:
-      type: regex
-      config:
-        mode: forbid
-        # Fires on a claim line carrying no uppercase level token. The verbs match
-        # `cited-api-claims` exactly, so the two rules never disagree about which
-        # lines are claims.
-        pattern: "^(?!.*\\b(?:HIGH|MEDIUM|LOW)\\b).*\\b(?:deprecated (?:since|in|as of)|introduced in|added in|available since|stable since)\\b"
+        pattern: "^(?!.*(?:https?://|(?:[\\w.-]+/)+[\\w.-]+:\\d+)).*\\b(?:deprecated (?:since|in|as of)|introduced in|added in|available since|stable since|removed (?:in|since) [vV]?\\d|(?:since|as of) (?:[vV]\\d+\\.\\d+(?:\\.\\d+)?|\\d+\\.\\d+\\.\\d+))\\b"

package/config/rules/strict/runtime-boundaries.yaml

@@ -37,6 +37,13 @@ rules:
             - "apps/desktop/src/server-process.ts"
 
             # Low-level system primitives:
+            # `spur builder pr` spine (script-absorption PR-7, moved from plugins/sp/scripts/pr-reviewing.ts):
+            # every git/gh call goes through ONE synchronous, test-injectable CommandRunner seam
+            # (`setCommandRunner`); the spine is synchronous end to end (wait polls with a sync sleep).
+            # The ts-runtime sync executors cannot stand in: NodeSyncProcessExecutor maps a spawn
+            # failure (gh/git missing) to a bare exit 1 and drops the reason the spine reports, and
+            # both strip the final newline. Output bytes are pinned by the PR-7 golden.
+            - "packages/app/src/services/pr-review/index.ts"
             - "packages/app/src/services/quality-gate.ts" # gate runs `sh -c` with stdout+stderr merged onto ONE fd; ProcessExecutor captures streams separately and cannot reproduce the stream-order contract (task 1006 R1; mirrors the history-anatomy bundling exemptions)
             # The feature-verification pass runs one long command with stdout+stderr merged onto the
             # run's single log fd and a 4 h ceiling (the frozen contract from task 0915: `safe argv
@@ -44,6 +51,13 @@ rules:
             # and exposes no timeout, so it cannot reproduce either half (task 1176 R2; same class as
             # the quality-gate exemption above).
             - "packages/app/src/workflow/feature-verification-run.ts"
+            # `spur task wrapup` steps (script-absorption PR-5, plan §3.4), pinned to the retired plugin
+            # scripts' golden output by apps/cli/tests/script-absorption-pr5-parity.test.ts. The feature gate
+            # (`sh -c`) and `task resolve` run with stdio/stderr INHERITED so their output streams into the
+            # workflow run log in order, and every step is synchronous; ProcessExecutor captures the streams
+            # separately and cannot inherit them (same class as the quality-gate exemption above).
+            - "packages/app/src/workflow/wrapup/steps.ts"
+            - "packages/app/src/workflow/wrapup/drift-probe.ts" # sync nested `spur task show` reads beside steps.ts (same exemption)
 
   - id: no-direct-fs-io
     description: "Prefer ts-runtime's FileSystem seam for fs IO."
@@ -66,6 +80,15 @@ rules:
 
             # Low-level system primitives (O_EXCL locks, FD byte-tailing, FS watcher, atomic registry, Vite glob fallback):
             - "packages/domain/src/planning/locks.ts" # POSIX atomic O_EXCL file locks
+            # Script-absorption PR-6: synchronous op modules whose file bytes are pinned by the
+            # PR-6 golden (apps/cli/tests/script-absorption-pr6). They keep the retired scripts'
+            # sync node:fs reads/writes (atomic publish rename, porcelain baselines, env/report
+            # writes, transcript and progress reads, the daily summary file + latest.json pointer);
+            # the async FileSystem seam would turn every op async and reorder their output.
+            - "packages/app/src/services/history-anatomy-cli.ts"
+            - "packages/app/src/services/session-timeline.ts"
+            - "packages/app/src/workflow/run-summary-cli.ts"
+            - "packages/app/src/services/daily-summary.ts"
             - "packages/domain/src/retention.ts" # recursive backup-dir reclamation + mtime stat (task 0622 R8); ts-runtime FileSystem seam has no recursive dir remove
             - "packages/app/src/services/token-ledger-service.ts" # FD byte-window log tailing
             - "packages/app/src/services/token-ledger-watcher.ts" # node:fs watch() live watcher
@@ -78,11 +101,27 @@ rules:
             - "packages/app/src/services/history-anatomy.ts" # deterministic history-anatomy cache core (task 1005 R2): fsync'd tmp+rename atomic publish, readdir digest scans and sync report reads must stay byte-stable; bundled standalone for the bare-node plugin twin (mirrors agent-usage-producer.ts / history-service.ts exemptions)
             - "packages/app/src/observability/workflow-run-log-sink.ts" # sync FD append for mid-run tail-able all-in-one run log (task 0426 / feature D2); append() is sync from the observability bus
             - "packages/app/src/observability/agent-run-log.ts" # same primitive as the sink above for the per-run agent stream (task 1076 R1, ADR-132); append() is sync from the agent service's own onOutput hook, and the byte cap needs the FD position it tracks
+            # Inline-driver transports (script-absorption PR-4, `spur workflow inline|commit-guard`): moved
+            # verbatim from the plugin scripts with their golden output pinned; synchronous probes and
+            # atomic tmp+rename snapshot writes inside one short-lived CLI process.
+            - "packages/app/src/workflow/commit-guard.ts" # .spur/run/<run>-tree-start.json atomic snapshot + target conflict-marker reads
+            - "packages/app/src/workflow/persist-check.ts" # recursive evidence-tree listing + byte comparison of both trees
+            - "packages/app/src/workflow/run-summary-render.ts" # close-step .spur/run/<run>-summary.{md,json} write (1146 R1)
+            - "packages/app/src/workflow/transcript.ts" # read-only host-transcript resolution (existsSync/readdirSync)
             # commands/workflow.ts was split per verb (commands/workflow/<verb>.ts); the FD tail lives in trace.ts.
             - "apps/cli/src/commands/workflow/trace.ts" # FD byte-window tail of the mid-run run log for `workflow trace --follow` streaming (task 0428 / feature D2); readSync at offset over the observability sink's FDs
             - "apps/web/src/modules/discover.ts" # Vite/Astro module scanner fallback under bun test
-            - "packages/app/src/services/quality-gate.ts" # gate artifacts (log/findings/receipt) written directly; merged-fd gate log and fsync-free atomic writes must stay byte-stable; bundled standalone for the bare-node plugin twin (task 1006 R1; mirrors history-anatomy.ts)
+            - "packages/app/src/services/quality-gate.ts" # gate artifacts (log/findings/receipt) written directly; merged-fd gate log and fsync-free atomic writes must stay byte-stable (task 1006 R1; `spur task gate` since script-absorption PR-3; mirrors history-anatomy.ts)
+            - "packages/app/src/workflow/wrapup/steps.ts" # `spur task wrapup` steps (script-absorption PR-5): sync status/metrics appends and run-artifact writes byte-pinned to the retired plugin scripts' golden output (apps/cli/tests/script-absorption-pr5-parity.test.ts); the FileSystem seam is async and has no append
+            - "packages/app/src/workflow/wrapup/drift-probe.ts" # drift-probe step beside steps.ts (same exemption)
+            # Script-absorption PR-3: the residual sweep and triage diffstat glue moved here from the retired
+            # plugin scripts (`spur task residual` / `spur task diffstat`). Same class as quality-gate.ts:
+            # synchronous `wx`/tmp+rename artifact writes, mtime-ordered verdict copies, and an fstat(1)
+            # dev/ino identity check (1067 R3) that the async FileSystem seam cannot express.
+            - "packages/app/src/services/residual-scan-run.ts"
+            - "packages/app/src/workflow/task-diffstat.ts"
             - "packages/app/src/workflow/feature-verification-run.ts" # the pass opens the run's single merged log fd (`openSync(path,'a')`) and mkdirs the run dir beside the receipt writer, exactly as the plugin entry did before the move; the fd cannot be expressed through the FileSystem seam (task 1176 R2; same class as the quality-gate exemption above)
+            - "packages/app/src/services/pr-review/index.ts" # `spur builder pr` (PR-7): sync --status-file verdict writes and the AGENTS.md review-rules probe inside the synchronous spine (same exemption as its process seam above)
             - "packages/app/src/services/run-storage.ts" # durable-evidence migration core (task 1025 R4): atomic tmp+rename byte copies with digest reread and atomic manifest publish must stay byte-stable (mirrors agent-usage-producer.ts / project-registry.ts exemptions)
             - "packages/app/src/services/durable-plane-ignore.ts" # .git/info/exclude append moved verbatim out of run-storage.ts to break an import cycle (same exemption)
 

package/config/rules/structure/protected-files.yaml

@@ -42,7 +42,7 @@ rules:
             - "apps/desktop/resources/"
             # `apps/cli/plugins/` is the same kind of gitignored build:bundle output — a staged
             # npm copy of `plugins/`, itself outside the include scope. Minified generated libs
-            # there trip the api-key shape (0976: HEAD's inline-run.generated.mjs fires too).
+            # there tripped the api-key shape (0976; the generated libs were retired by script-absorption PR-6).
             - "apps/cli/plugins/"
 
   - id: no-unsafe-git-commands

package/config/rules/surface/check-cli-surface.yaml

@@ -28,6 +28,8 @@ rules:
     exclude:
       # Per-noun shared.ts holds helpers used by 2+ verbs; it registers nothing.
       - "apps/cli/src/commands/*/shared.ts"
+      # Byte-exact stdout/stderr writer for the absorbed pipeline steps (script-absorption PR-5); registers nothing.
+      - "apps/cli/src/commands/task/step-output.ts"
     evaluator:
       type: rg
       config:
@@ -51,6 +53,37 @@ rules:
       - "apps/cli/src/commands/agent/loop.ts"
       - "apps/cli/src/commands/agent/start.ts"
       - "apps/cli/src/commands/agent/stop.ts"
+      # Absorbed pipeline steps (script-absorption PR-5): the app operation renders the golden-pinned
+      # text/JSON (planning-preflight.ts JSON.stringify for `task preflight --json`, batch-plan.ts for
+      # `task batch-plan`); wrapup, feature verify/handoff declare no --json. step-output.ts writes bytes.
+      - "apps/cli/src/commands/task/batch-plan.ts"
+      - "apps/cli/src/commands/task/preflight.ts"
+      - "apps/cli/src/commands/task/step-output.ts"
+      - "apps/cli/src/commands/task/wrapup.ts"
+      - "apps/cli/src/commands/feature/handoff.ts"
+      - "apps/cli/src/commands/feature/verify.ts"
+      # commit-guard declares no --json: its {staged, foreign} / {foreign} lines are rendered by
+      # @gobing-ai/spur-app/commit-guard (byte-identical to the retired script, PR-4 golden).
+      - "apps/cli/src/commands/workflow/commit-guard.ts"
+      # Pipeline-internal task verbs (script-absorption PR-3) declare no --json: their contract is
+      # the .spur/run artifact they write (gate status/receipt, residuals.json, diffstat.json) and
+      # the exit code; the gate's own status line is serialized by the app service.
+      - "apps/cli/src/commands/task/gate.ts"
+      - "apps/cli/src/commands/task/residual.ts"
+      - "apps/cli/src/commands/task/diffstat.ts"
+      # Absorbed measurement/report verbs (script-absorption PR-6): the app module serializes the
+      # golden-pinned JSON (step-profile-cli for `workflow profile --json`, run-summary-cli for
+      # `workflow summary`, session-timeline for `history timeline`, history-anatomy-cli for the
+      # anatomy ops); `history summary` writes Markdown and declares no --json.
+      - "apps/cli/src/commands/workflow/profile.ts"
+      - "apps/cli/src/commands/workflow/summary.ts"
+      - "apps/cli/src/commands/history/anatomy.ts"
+      - "apps/cli/src/commands/history/timeline.ts"
+      - "apps/cli/src/commands/history/summary.ts"
+      # Absorbed dogfood / PR-review spines (script-absorption PR-7): --json is rendered by
+      # @gobing-ai/spur-app/dogfood and @gobing-ai/spur-app/pr-review (JSON.stringify), not the CLI envelope.
+      - "apps/cli/src/commands/agent/dogfood.ts"
+      - "apps/cli/src/commands/builder/pr.ts"
     evaluator:
       type: rg
       config:

package/config/rules/typescript/no-debugger.yaml

@@ -14,6 +14,9 @@ include:
   - "scripts/**/*.ts"
 exclude:
   - "**/tests/**"
+  # The PR-review hygiene scanner matches the word in diff text (a /\bdebugger\b/ WARN pattern);
+  # it holds no statement. Biome noDebugger still guards the file (script-absorption PR-7).
+  - "packages/app/src/services/pr-review/index.ts"
 rules:
   - id: no-debugger-statement
     description: >

package/config/workflow-candidates.json

@@ -7,7 +7,7 @@
             "canonical": "task-pipeline",
             "deadline": "2026-11-24",
             "createdAt": "2026-09-25",
-            "rationale": "0943 (feature D64): task-pipeline work routes by triage lane and failure class instead of static graphs. Between a green gate and the review/verify fork a deterministic `triage` state writes the diffstat (plugins/sp/scripts/task-diffstat.ts, numstat + untracked scan against the precheck-anchored run base), honors a caller-set mode verbatim (never overridden), pins the safety lane on sensitive paths (drizzle/, packages/config/, server auth basenames, *secret*, .github/, plugins/sp/hooks/, *.sql) or >400 changed lines with NO model call, otherwise consults `decide task-triage` (low → fast lane skips review; standard/high → review), and appends the route reason to .spur/memory/task-pipeline-routes.log (R5). On a red gate, `decide failure-class` routes retryable → test-recheck (attempt counted, qualityGateMaxFixAttempts still bounds), fix → test-fix, stop → failed(failed-check); missing/corrupt decision fails closed. Projected basis: the 0938 baseline (docs/reports/2026-09-workflow-cost-baseline.md) measured task-pipeline wall median 7983s over 1 real terminal run with agent.run median 0; the fast lane saves the review agent.run + wall on triage-low diffs, and retryable classification saves fixall hops (and their gate re-runs) on transient failures. Measurement gap honestly named: with workflow.decideDecisionMaker off (R4) triage degrades to standard lanes (diffstat-guard-sensitive/large still forced safety — pure shell, no model), so benefit only materializes with the flag on; per-lane route counts are observable post-merge in .spur/memory/task-pipeline-routes.log. Measured-benefit status: projected from 0938, NOT shadow-run-confirmed — plan step 5 (recorded-input shadow runs) is DEFERRED out of the 0943 session and tracked by this candidate's deadline; `promotion evaluate` runs post-merge. If it does not beat the baseline, it is reverted (ADR-076).",
+            "rationale": "0943 (feature D64): task-pipeline work routes by triage lane and failure class instead of static graphs. Between a green gate and the review/verify fork a deterministic `triage` state writes the diffstat (`spur task diffstat`, formerly plugins/sp/scripts/task-diffstat.ts; numstat + untracked scan against the precheck-anchored run base), honors a caller-set mode verbatim (never overridden), pins the safety lane on sensitive paths (drizzle/, packages/config/, server auth basenames, *secret*, .github/, plugins/sp/hooks/, *.sql) or >400 changed lines with NO model call, otherwise consults `decide task-triage` (low → fast lane skips review; standard/high → review), and appends the route reason to .spur/memory/task-pipeline-routes.log (R5). On a red gate, `decide failure-class` routes retryable → test-recheck (attempt counted, qualityGateMaxFixAttempts still bounds), fix → test-fix, stop → failed(failed-check); missing/corrupt decision fails closed. Projected basis: the 0938 baseline (docs/reports/2026-09-workflow-cost-baseline.md) measured task-pipeline wall median 7983s over 1 real terminal run with agent.run median 0; the fast lane saves the review agent.run + wall on triage-low diffs, and retryable classification saves fixall hops (and their gate re-runs) on transient failures. Measurement gap honestly named: with workflow.decideDecisionMaker off (R4) triage degrades to standard lanes (diffstat-guard-sensitive/large still forced safety — pure shell, no model), so benefit only materializes with the flag on; per-lane route counts are observable post-merge in .spur/memory/task-pipeline-routes.log. Measured-benefit status: projected from 0938, NOT shadow-run-confirmed — plan step 5 (recorded-input shadow runs) is DEFERRED out of the 0943 session and tracked by this candidate's deadline; `promotion evaluate` runs post-merge. If it does not beat the baseline, it is reverted (ADR-076).",
             "measurement": {
                 "workflow": "task-pipeline"
             },
@@ -39,7 +39,7 @@
             "canonical": "wrapup-pipeline",
             "deadline": "2026-11-24",
             "createdAt": "2026-09-25",
-            "rationale": "0944 (feature D64): a deterministic probe (plugins/sp/scripts/wrapup-drift-probe.ts) runs only when the caller leaves wrapup mode empty and projects mode=fast when no changed path matches a doc-owned surface (AGENTS.md doc map + docs/99_PROJECT_CONSTITUTION.md ownership table) and every task's Solution change map parsed — clean wraps then skip doc-sync via the existing fast edge (fast:drift-probe-clean), any doubt stays on the safety path. Projected basis: doc-sync costs exactly 1 agent.run per wrapup (wrapup-pipeline declares one model query; 0938 baseline docs/reports/2026-09-workflow-cost-baseline.json has 0 recorded wrapup runs — agentRunCountMedian null — so the 1 is structural, never a measured median). Measurement gap honestly named: skipping doc-sync also skips learnings capture (0607 R2 merge), so clean wraps lose per-task learnings rows; measured post-promotion by comparing .spur/memory/wrapup-routes.log fast:drift-probe-clean counts against captured <runId>-wrapup-learnings.md files. For 0946 (measurement-only confirmation): the 0938 snapshot carries per-state rows in states[] but history-anatomy has zero of them (0 recorded runs — only task-pipeline/record exists), and cache hit/miss disposition lives in the history-anatomy provenance stamp (0659/0660, history-anatomy-cache.ts), not in real-run-cost.ts; terminalReasonMix exists per workflow but history-anatomy's is empty. Measured-benefit status: projected from structure + 0938, NOT shadow-run-confirmed; `promotion evaluate` runs post-merge. If it does not beat the baseline, it is reverted (ADR-076).",
+            "rationale": "0944 (feature D64): a deterministic probe (`spur task wrapup drift-probe`, packages/app/src/workflow/wrapup/drift-probe.ts since script-absorption PR-5) runs only when the caller leaves wrapup mode empty and projects mode=fast when no changed path matches a doc-owned surface (AGENTS.md doc map + docs/99_PROJECT_CONSTITUTION.md ownership table) and every task's Solution change map parsed — clean wraps then skip doc-sync via the existing fast edge (fast:drift-probe-clean), any doubt stays on the safety path. Projected basis: doc-sync costs exactly 1 agent.run per wrapup (wrapup-pipeline declares one model query; 0938 baseline docs/reports/2026-09-workflow-cost-baseline.json has 0 recorded wrapup runs — agentRunCountMedian null — so the 1 is structural, never a measured median). Measurement gap honestly named: skipping doc-sync also skips learnings capture (0607 R2 merge), so clean wraps lose per-task learnings rows; measured post-promotion by comparing .spur/memory/wrapup-routes.log fast:drift-probe-clean counts against captured <runId>-wrapup-learnings.md files. For 0946 (measurement-only confirmation): the 0938 snapshot carries per-state rows in states[] but history-anatomy has zero of them (0 recorded runs — only task-pipeline/record exists), and cache hit/miss disposition lives in the history-anatomy provenance stamp (0659/0660, `spur history anatomy`, formerly history-anatomy-cache.ts), not in real-run-cost.ts; terminalReasonMix exists per workflow but history-anatomy's is empty. Measured-benefit status: projected from structure + 0938, NOT shadow-run-confirmed; `promotion evaluate` runs post-merge. If it does not beat the baseline, it is reverted (ADR-076).",
             "measurement": {
                 "workflow": "wrapup-pipeline"
             },

package/config/workflows/feature-verification.yaml

@@ -21,8 +21,9 @@
 # shipped entry no longer provides, and the entry path. Reinstalling or upgrading the
 # plugin cannot supply a retired export — only the two remedies above can.
 #
-# Shape: verify -> done | failed. The onEnter step runs the standard script
-# `feature-verification-steps.ts` (no public CLI verb, D63 task 0915): it
+# Shape: verify -> done | failed. The onEnter step runs `spur feature verify`
+# (D63 task 0915; script-absorption PR-5 retired the feature-verification-steps
+# plugin script): it
 # resolves this very definition for the verifier identity (name, source path,
 # layer, definition digest), records the RUNNING receipt (run-scoped +
 # feature-latest copies), registers the run-scoped receipt as a run artifact,
@@ -51,34 +52,20 @@ vars:
   featureId: "X"
   spurBin: "spur"
   verificationCmd: "bun run spur-check-feature"
-  # Operator-declared confidence level; empty derives it from the pass (HIGH when the selected
-  # definition's own command exited 0 with an unchanged proof-input digest, MEDIUM under a caller
-  # `--cmd` override, LOW otherwise). The completion boundary refuses a PASS carrying no level or
-  # LOW unless the receipt records the acknowledgement below.
-  confidence: ""
-  # Operator acknowledgement of a LOW level. It rides the receipt, so the transition reads it from
-  # the evidence rather than from whatever flags a later command happens to pass.
-  ackLowConfidence: "false"
   __runId: ""
 
 states:
   - id: verify
     description: >
-      Run the repo-wide check set via the standard verification script, which
+      Run the repo-wide check set via `spur feature verify`, which
       records the bound evidence receipt (verifier identity, checked-input
       digest, run identity) and the coarse status file, always exit 0 so the
       transition guard routes missing/corrupt/FAIL to `failed`.
     onEnter:
-      # 0960 R2: run-start script-resolution identity — record which tree this run
-      # resolved (source-repo vs installed) before the verification step runs. Never aborts.
       - kind: shell
         options:
           command: >-
-            S=plugins/sp/scripts/script-root.ts; [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp script-root.mjs 2>/dev/null)"; RUNNER=bun; case "$S" in *.mjs) RUNNER=node ;; esac; [ -f "$S" ] && "$RUNNER" "$S" --run-id "$__runId" --spur-bin "$spurBin" || echo "script-root failed closed — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; exit 0
-      - kind: shell
-        options:
-          command: >-
-            mkdir -p .spur/run; eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/feature-verification-steps.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/feature-verification-steps.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; ACK=""; [ "$ackLowConfidence" = "true" ] && ACK="--ack-low-confidence"; [ -f "$S" ] && "$RUNNER" "$S" verify --feature-id "$featureId" --run-id "$__runId" --spur-bin "$spurBin" --confidence "$confidence" $ACK || printf 'FAIL feature-verification failed closed — script not found — run superskill install sp --marketplace gobing-ai/spur\n' > ".spur/run/$__runId-feature-verification.status"; exit 0
+            mkdir -p .spur/run; $spurBin feature verify "$featureId" --run-id "$__runId" --no-logo || printf 'FAIL feature-verification failed closed — spur feature verify exited nonzero\n' > ".spur/run/$__runId-feature-verification.status"; exit 0
 
   - id: done
     description: Terminal — repo-wide checks passed and the receipt is bound.
@@ -89,7 +76,7 @@ states:
 transitions:
   - from: verify
     to: done
-    description: Repo-wide checks passed — the script completed the receipt with PASS.
+    description: Repo-wide checks passed — `spur feature verify` completed the receipt with PASS.
     guard:
       kind: shell
       options:

package/config/workflows/history-anatomy.yaml

@@ -4,7 +4,7 @@
 # Orchestration is configuration (ADR-022): a state machine over the existing dual-workflow
 # engine. The YAML owns ONLY the cache branch, deterministic stage ordering, executor dispatch,
 # bounded correction, and atomic publication sequencing. The deterministic cache/digest/
-# structure/publish work is 0659's dependency-free helper script; the judgment (mode validity,
+# structure/publish work is `spur history anatomy <op>` (0659's helper, absorbed by script-absorption PR-6); the judgment (mode validity,
 # what counts as evidence, the report contract, enrich/validate rubrics) is 0658's skill. Per
 # ADR-069 R1, cache-decide / digest / structure-check / publish must NOT be inline shell — every
 # shell action here is glue length (a single helper invocation), because each of those programs
@@ -100,16 +100,6 @@ states:
           # reclamation path (unlike the run-record pair and legacy `.log` files, which
           # `spur workflow clean --logs` owns). It is deliberately NOT a run record and is
           # exempt from the catalog record-name sweep (see run-record-catalog.test.ts).
-
-
-      # 1007 R8: run-start script-resolution identity (same command as feature-verification
-      # verify's first action), placed AFTER the id allocation above — the snippet reads
-      # .spur/run/$__runId-script-root.json, so it needs the allocated id. Later
-      # plugin-script actions resolve through it (1007 R4 snippet). Never aborts.
-      - kind: shell
-        options:
-          command: >-
-            S=plugins/sp/scripts/script-root.ts; [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp script-root.mjs 2>/dev/null)"; RUNNER=bun; case "$S" in *.mjs) RUNNER=node ;; esac; [ -f "$S" ] && "$RUNNER" "$S" --run-id "$__runId" --spur-bin "$spurBin" || echo "script-root failed closed — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; exit 0
   - id: resolve-paths
     description: >
       Resolve the helper, the skill/contract logic paths, and the publication target once, into a
@@ -118,11 +108,11 @@ states:
     onEnter:
       - kind: shell
         options:
-          # Path arithmetic lives in the helper (ADR-069 R1); the shell only locates it. Avoid
+          # Path arithmetic lives in `spur history anatomy paths` (ADR-069 R1; script-absorption
+          # PR-6 — HA_HELPER is the running spur, HA_SKILL the resolved skill dir). Avoid
           # `${...}` here — that syntax collides with the engine's own template interpolation.
           command: >-
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)";
-            "$RUNNER" "$S" paths --helper "$S" --report-dir "$reportDir" --date "$date"
+            $spurBin history anatomy paths --report-dir "$reportDir" --date "$date"
             --output "$output" --mode "$mode" --since "$since" --until "$until"
             --focus "$focus" --recompute "$recompute" --run-id "$__runId"
             --out .spur/run/$__runId-paths.txt
@@ -155,13 +145,12 @@ states:
       - kind: shell
         options:
           command: >-
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)";
             . .spur/run/$__runId-paths.txt;
-            "$RUNNER" "$S" probe --artifact .spur/run/$__runId-history-anatomy-current.json
+            $spurBin history anatomy probe --artifact .spur/run/$__runId-history-anatomy-current.json
             --baseline .spur/run/$__runId-history-anatomy-baseline.json --target "$HA_TARGET"
             --mode "$mode" --date "$HA_DATE" --recompute "$recompute" --executor "$agent"
             --skill-dir "$HA_SKILL" --contract "$HA_SKILL/references/report-contract.md"
-            --workflow "$workflowFile" --helper "$S" --contract-version "$contractVersion" --run-id "$__runId"
+            --workflow "$workflowFile" --helper "$HA_HELPER" --contract-version "$contractVersion" --run-id "$__runId"
             --out .spur/run/$__runId-provenance.json
             > .spur/run/$__runId-cache-disposition.txt
 
@@ -198,7 +187,7 @@ states:
       - kind: shell
         options:
           command: >-
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; "$RUNNER" "$S" assert-clean --baseline .spur/run/$__runId-baseline-enrich.txt --expect .spur/run/$__runId-candidate.md
+            $spurBin history anatomy assert-clean --baseline .spur/run/$__runId-baseline-enrich.txt --expect .spur/run/$__runId-candidate.md
 
   - id: structure-gate
     description: >
@@ -209,7 +198,7 @@ states:
       - kind: shell
         options:
           command: >-
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; "$RUNNER" "$S" check \
+            $spurBin history anatomy check \
               .spur/run/$__runId-candidate.md > .spur/run/$__runId-structure-gate.txt 2>&1 || true
 
   - id: validate
@@ -267,7 +256,7 @@ states:
           command: >-
             f=.spur/run/$__runId-validation.txt;
             if [ -f "$f" ] && [ "$(grep -cx 'Verdict: FAIL' "$f")" = 0 ] && ! tail -n 1 "$f" | grep -qx 'Verdict: PASS'; then
-              d=$("$spurBin" decision run anatomy-validation-verdict --evidence "$f" --json || true);
+              d=$($spurBin decision run anatomy-validation-verdict --evidence "$f" --json || true);
               v=$(printf '%s' "$d" | jq -r 'if (.source // .data.source) == "model" and (.value // .data.value) == "PASS" then "PASS" else "FAIL" end' 2>/dev/null);
               [ "$v" = "PASS" ] || v="FAIL";
               printf 'Verdict: %s\n' "$v" >> "$f";
@@ -275,7 +264,7 @@ states:
       - kind: shell
         options:
           command: >-
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; "$RUNNER" "$S" assert-clean --baseline .spur/run/$__runId-baseline-validate.txt --expect .spur/run/$__runId-validation.txt
+            $spurBin history anatomy assert-clean --baseline .spur/run/$__runId-baseline-validate.txt --expect .spur/run/$__runId-validation.txt
 
   - id: correct
     description: >
@@ -312,7 +301,7 @@ states:
       - kind: shell
         options:
           command: >-
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; "$RUNNER" "$S" assert-clean --baseline .spur/run/$__runId-baseline-correct.txt --expect .spur/run/$__runId-candidate.md
+            $spurBin history anatomy assert-clean --baseline .spur/run/$__runId-baseline-correct.txt --expect .spur/run/$__runId-candidate.md
 
   - id: refresh-provenance
     description: >
@@ -324,9 +313,8 @@ states:
       - kind: shell
         options:
           command: >-
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)";
             . .spur/run/$__runId-paths.txt;
-            "$RUNNER" "$S" refresh --report "$HA_TARGET"
+            $spurBin history anatomy refresh --report "$HA_TARGET"
             --out .spur/run/$__runId-publishable.md --disposition hit
 
   - id: stamp
@@ -339,9 +327,8 @@ states:
       - kind: shell
         options:
           command: >-
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)";
             . .spur/run/$__runId-paths.txt;
-            "$RUNNER" "$S" stamp --candidate .spur/run/$__runId-candidate.md
+            $spurBin history anatomy stamp --candidate .spur/run/$__runId-candidate.md
             --provenance .spur/run/$__runId-provenance.json
             --out .spur/run/$__runId-publishable.md
 
@@ -354,10 +341,9 @@ states:
       - kind: shell
         options:
           command: >-
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/history-anatomy-cache.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/history-anatomy-cache.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)";
             . .spur/run/$__runId-paths.txt;
             mkdir -p "$(dirname "$HA_TARGET")";
-            "$RUNNER" "$S" publish .spur/run/$__runId-publishable.md "$HA_TARGET"
+            $spurBin history anatomy publish .spur/run/$__runId-publishable.md "$HA_TARGET"
 
   - id: published
     description: Terminal — report published atomically after a passing validation.