@gobing-ai/spur 0.4.8 → 0.4.10

package/config/workflows/idea-pipeline.yaml

@@ -88,12 +88,6 @@ states:
       handoff — no task execution. Soft agent doctor (status file) so doctor red
       routes to `failed` via transitions instead of a raw lifecycle abort.
     onEnter:
-      # 0960 R2: run-start script-resolution identity — record which tree this run
-      # resolved (source-repo vs installed) before any step executes. Never aborts.
-      - kind: shell
-        options:
-          command: >-
-            S=plugins/sp/scripts/script-root.ts; [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp script-root.mjs 2>/dev/null)"; RUNNER=bun; case "$S" in *.mjs) RUNNER=node ;; esac; [ -f "$S" ] && "$RUNNER" "$S" --run-id "$__runId" --spur-bin "$spurBin" || echo "script-root failed closed — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; exit 0
       - kind: note
         options:
           message: "Idea pipeline start for idea: ${vars.idea}"
@@ -606,21 +600,14 @@ states:
       A mapping or CLI error fails the run before terminal handoff; an unready
       task is a successful planning outcome recorded as a refineall recommendation.
     onEnter:
-      # (d) idea-handoff owns finalization (0824): the bundled finalizeIdeaHandoff
-      # capability runs from the monorepo checkout first; seeded projects (no
-      # packages/, no plugins/) resolve the registered idea-handoff.mjs twin under
-      # bare node; neither present fails closed (exit 1) instead of silently
-      # skipping finalization. The zip/deps/refresh/check/report contract itself is
-      # pinned by finalizeIdeaHandoff unit tests, not by this file.
+      # (d) `spur feature handoff` owns finalization (0824; script-absorption PR-5
+      # retired the idea-handoff plugin script and its bundle). A nonzero exit fails
+      # the run (fail closed) instead of silently skipping finalization. The
+      # zip/deps/refresh/check/report contract itself is pinned by
+      # finalizeIdeaHandoff unit tests, not by this file.
       - kind: shell
         options:
-          command: >-
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/idea-handoff.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/idea-handoff.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; if [ -f "$S" ]; then
-              "$RUNNER" "$S";
-            else
-              echo "idea handoff failed closed — idea-handoff script not found — run 'superskill install sp --marketplace gobing-ai/spur'" >&2;
-              exit 1;
-            fi
+          command: '$spurBin feature handoff "$featureId" --run-id "$__runId" --no-logo'
   - id: handoff
     description: >
       Terminal — idea pipeline complete. Ordering applied, roster refreshed, and

package/config/workflows/pr-review.yaml

@@ -8,7 +8,7 @@
 #         never a raw lifecycle abort — same reliability contract as basic.yaml)
 #
 # This YAML is the SSOT for the review spine's state order and guards. Every state shells
-# out to the staged pr-reviewing.ts entrypoint (the tested deterministic core); no gh/git
+# out to `spur builder pr` (the tested deterministic core); no gh/git
 # logic lives in this file. All model-bearing work — finding triage, `fix` mode, `rules`
 # mode — stays in the sp:pr-reviewing skill and never enters this machine.
 #
@@ -66,14 +66,7 @@ states:
       before any push can publish it).
       Writes PASS|FAIL to .spur/run/${vars.__runId}-pr-preflight.status; always exit 0.
     onEnter:
-      # 1007 R8: run-start script-resolution identity (same command as feature-verification
-      # verify's first action) — records which tree this run resolved (source-repo vs
-      # installed) into .spur/run/$__runId-script-root.json; later plugin-script actions
-      # resolve through it (1007 R4 snippet). Never aborts.
-      - kind: shell
-        options:
-          command: >-
-            S=plugins/sp/scripts/script-root.ts; [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp script-root.mjs 2>/dev/null)"; RUNNER=bun; case "$S" in *.mjs) RUNNER=node ;; esac; [ -f "$S" ] && "$RUNNER" "$S" --run-id "$__runId" --spur-bin "$spurBin" || echo "script-root failed closed — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; exit 0
+      # script-root retired for this workflow: actions call `$spurBin builder pr` directly (PR-7).
       - kind: shell
         options:
           # (e) 0825: 10 lines — detached-HEAD/dirty/gh-auth/base-refusal probes must record
@@ -82,7 +75,7 @@ states:
             
             STATUS_FILE=".spur/run/$__runId-pr-preflight.status" &&
             set +e &&
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/pr-reviewing.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/pr-reviewing.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; "$RUNNER" "$S" preflight --base "$baseBranch" --json > ".spur/run/$__runId-pr-context.json";
+            $spurBin builder pr preflight --base "$baseBranch" --json > ".spur/run/$__runId-pr-context.json";
             rc=$?; set -e &&
             if [ "$rc" -eq 0 ]; then printf 'PASS\n' > "$STATUS_FILE"; else printf 'FAIL\n' > "$STATUS_FILE"; fi &&
             exit 0
@@ -100,7 +93,7 @@ states:
             
             STATUS_FILE=".spur/run/$__runId-pr-hygiene.status" &&
             set +e &&
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/pr-reviewing.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/pr-reviewing.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; "$RUNNER" "$S" hygiene --base "$baseBranch" --json
+            $spurBin builder pr hygiene --base "$baseBranch" --json
             --status-file "$STATUS_FILE" > ".spur/run/$__runId-pr-hygiene.json";
             rc=$?; set -e &&
             if [ ! -f "$STATUS_FILE" ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi &&
@@ -131,7 +124,7 @@ states:
             mkdir -p .spur/run &&
             STATUS_FILE=".spur/run/$__runId-pr-push.status" &&
             set +e &&
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/pr-reviewing.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/pr-reviewing.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; "$RUNNER" "$S" push --json --status-file "$STATUS_FILE"
+            $spurBin builder pr push --json --status-file "$STATUS_FILE"
             > ".spur/run/$__runId-pr-push.json";
             rc=$?; set -e &&
             if [ ! -f "$STATUS_FILE" ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi &&
@@ -148,7 +141,7 @@ states:
             mkdir -p .spur/run &&
             STATUS_FILE=".spur/run/$__runId-pr-ensure.status" &&
             set +e &&
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/pr-reviewing.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/pr-reviewing.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; "$RUNNER" "$S" ensure-pr --base "$baseBranch" --json
+            $spurBin builder pr ensure-pr --base "$baseBranch" --json
             --status-file "$STATUS_FILE" > ".spur/run/$__runId-pr.json";
             rc=$?; set -e &&
             if [ ! -f "$STATUS_FILE" ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi &&
@@ -164,7 +157,7 @@ states:
           # (e) 0825: 10 lines — the write-then-read split is the file-var transport feeding
           # wait/collect and must stay one action (same record, same run scope).
           command: >-
-            F="$([ "$mode" = rerun ] && echo --force)"; eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/pr-reviewing.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/pr-reviewing.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; "$RUNNER" "$S" request --focus "$focus" $F --json --status-file ".spur/run/$__runId-pr-request.status" > ".spur/run/$__runId-pr-request.json"; [ -f ".spur/run/$__runId-pr-request.status" ] || echo FAIL > ".spur/run/$__runId-pr-request.status"; jq -e . ".spur/run/$__runId-pr-request.json" >/dev/null 2>&1 && jq -r '.requestedAt // ""' ".spur/run/$__runId-pr-request.json" > ".spur/run/$__runId-pr-since.txt" && jq -r '.head // ""' ".spur/run/$__runId-pr-request.json" > ".spur/run/$__runId-pr-head.txt"; exit 0
+            F="$([ "$mode" = rerun ] && echo --force)"; $spurBin builder pr request --focus "$focus" $F --json --status-file ".spur/run/$__runId-pr-request.status" > ".spur/run/$__runId-pr-request.json"; [ -f ".spur/run/$__runId-pr-request.status" ] || echo FAIL > ".spur/run/$__runId-pr-request.status"; jq -e . ".spur/run/$__runId-pr-request.json" >/dev/null 2>&1 && jq -r '.requestedAt // ""' ".spur/run/$__runId-pr-request.json" > ".spur/run/$__runId-pr-since.txt" && jq -r '.head // ""' ".spur/run/$__runId-pr-request.json" > ".spur/run/$__runId-pr-head.txt"; exit 0
 
   - id: wait
     description: >
@@ -189,7 +182,7 @@ states:
             mkdir -p .spur/run &&
             STATUS_FILE=".spur/run/$__runId-pr-wait.status" &&
             set +e &&
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/pr-reviewing.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/pr-reviewing.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; "$RUNNER" "$S" wait --since "$prSince" --head "$prHead" --timeout "$waitTimeoutSec" --interval "$waitIntervalSec"
+            $spurBin builder pr wait --since "$prSince" --head "$prHead" --timeout "$waitTimeoutSec" --interval "$waitIntervalSec"
             --json --status-file "$STATUS_FILE" > ".spur/run/$__runId-pr-wait.json";
             rc=$?; set -e &&
             if [ ! -f "$STATUS_FILE" ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi &&
@@ -213,7 +206,7 @@ states:
           # (e) 0825: 9 lines — collect + status must run against the same since/head pair
           # before the composite status is decided (same 0771 record contract).
           command: >-
-            mkdir -p .spur/run; eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/pr-reviewing.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/pr-reviewing.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; "$RUNNER" "$S" collect --since "$prSince" --head "$prHead" --json --status-file ".spur/run/$__runId-pr-collect.status" > ".spur/run/$__runId-pr-findings.json"; c=$?; "$RUNNER" "$S" status --since "$prSince" --head "$prHead" --json > ".spur/run/$__runId-pr-status.json" && [ "$c" -eq 0 ] && [ -f ".spur/run/$__runId-pr-collect.status" ] || printf 'FAIL\n' > ".spur/run/$__runId-pr-collect.status"; cat ".spur/run/$__runId-pr-findings.json" 2>/dev/null; exit 0
+            mkdir -p .spur/run; $spurBin builder pr collect --since "$prSince" --head "$prHead" --json --status-file ".spur/run/$__runId-pr-collect.status" > ".spur/run/$__runId-pr-findings.json"; c=$?; $spurBin builder pr status --since "$prSince" --head "$prHead" --json > ".spur/run/$__runId-pr-status.json" && [ "$c" -eq 0 ] && [ -f ".spur/run/$__runId-pr-collect.status" ] || printf 'FAIL\n' > ".spur/run/$__runId-pr-collect.status"; cat ".spur/run/$__runId-pr-findings.json" 2>/dev/null; exit 0
 
   - id: done
     description: Terminal — review collected; findings artifact at .spur/run/${vars.__runId}-pr-findings.json

package/config/workflows/task-pipeline.yaml

@@ -58,8 +58,8 @@ name: task-pipeline
 # verifier's and reviewer's self-graded levels (re-imported from the cc anti-hallucination skill
 # by task 1068) are no longer written, checked, or gated on; spur certifies on deterministic
 # evidence (rows MET, proof digests, findings dispositioned). The `confidence` check row, the
-# `ackLowConfidence` var, and the guards' LOW/absent clauses are gone; the derived
-# feature-receipt confidence (ADR-131/1196) is a different family and stays.
+# `ackLowConfidence` var, and the guards' LOW/absent clauses are gone. The derived
+# feature-receipt confidence (1196) followed in task 1221 (ADR-138 amendment).
 version: "7"
 description: "Standard task pipeline: precheck → implement → quality-gate (test/fix/recheck) → review → approve → verify → record → done"
 # Task entity lifecycle (owned by task-lifecycle.yaml):
@@ -230,12 +230,6 @@ states:
           Fast deterministic task readiness and size checks. Failures route to the
           `failed` terminal state (not a raw lifecycle abort mid-enter).
       onEnter:
-          # 0960 R2: run-start script-resolution identity — record which tree this run
-          # resolved (source-repo vs installed) before any step executes. Never aborts.
-          - kind: shell
-            options:
-                command: >-
-                    S=plugins/sp/scripts/script-root.ts; [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp script-root.mjs 2>/dev/null)"; RUNNER=bun; case "$S" in *.mjs) RUNNER=node ;; esac; [ -f "$S" ] && "$RUNNER" "$S" --run-id "$__runId" --spur-bin "$spurBin" || echo "script-root failed closed — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; exit 0
           # (e) git-status hygiene advisory; never fails the run (0487 R6 / 0511 R1). 1007 R3:
           # the F96 base-sha capture (0950) merged into this shell — original commands in order,
           # then the one-time base commit capture; a resumed run keeps its original base so
@@ -492,11 +486,12 @@ states:
                 var: proofDigest
                 taskFile: ${vars.taskSpecPath}
                 featureFile: ${vars.featureSpecPath}
-          # (d) quality-gate.ts owns the gate; shell only resolves it and fails closed.
+          # (d) `spur task gate` owns the gate; shell only picks the mode and fails closed
+          # (a non-0/1 exit — spur missing, usage error, crash — writes FAIL).
           - kind: shell
             options:
                 command: >-
-                    eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/quality-gate.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/quality-gate.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; M=run; [ "$deferQualityGate" = "true" ] && M=deferred; if [ -f "$S" ]; then "$RUNNER" "$S" "$M"; else echo "quality gate failed closed — quality-gate script not found — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; printf 'FAIL\n' > ".spur/run/$wbs-test-gate.status"; fi; exit 0
+                    M=run; [ "$deferQualityGate" = "true" ] && M=deferred; $spurBin task gate "$wbs" "$M" --no-logo; rc=$?; if [ "$rc" -gt 1 ]; then echo "quality gate failed closed — spur task gate exited $rc" >&2; printf 'FAIL\n' > ".spur/run/$wbs-test-gate.status"; fi; exit 0
 
     - id: test-fix
       display:
@@ -597,12 +592,12 @@ states:
           # a green probe (or empty gateProbeCmd) falls through to the full-gate loop unchanged.
           # Only the full gate writes PASS, so the `test-recheck → review` guard (reads PASS)
           # still means a full green qualityGateCmd ran — invariant preserved by construction.
-          # (d) quality-gate.ts owns the recheck; shell only resolves it and fails closed
+          # (d) `spur task gate` owns the recheck; shell only picks the mode and fails closed
           # (0587 R3 probe-then-full: a red gateProbeCmd is the recheck verdict, the full gate is skipped).
           - kind: shell
             options:
                 command: >-
-                    eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/quality-gate.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/quality-gate.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; M=recheck; [ "$deferQualityGate" = "true" ] && M=deferred; if [ -f "$S" ]; then "$RUNNER" "$S" "$M"; else echo "quality gate failed closed — quality-gate script not found — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; printf 'FAIL\n' > ".spur/run/$wbs-test-gate.status"; fi; exit 0
+                    M=recheck; [ "$deferQualityGate" = "true" ] && M=deferred; $spurBin task gate "$wbs" "$M" --no-logo; rc=$?; if [ "$rc" -gt 1 ]; then echo "quality gate failed closed — spur task gate exited $rc" >&2; printf 'FAIL\n' > ".spur/run/$wbs-test-gate.status"; fi; exit 0
 
     - id: triage
       display:
@@ -620,13 +615,13 @@ states:
           when neither a caller mode nor the deterministic guard resolved the lane. The resolved
           lane lands in the `mode` var for the triage → verify/review guards.
       onEnter:
-          # (a) diffstat producer: task-diffstat.ts owns git reading and sensitive-path
-          # classification; shell only resolves it and fails closed (writes sensitive:true,
+          # (a) diffstat producer: `spur task diffstat` owns git reading and sensitive-path
+          # classification; shell only fails closed on a non-zero exit (writes sensitive:true,
           # which the pre-guard below maps to the safety lane).
           - kind: shell
             options:
                 command: >-
-                    eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/task-diffstat.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/task-diffstat.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; if [ -f "$S" ]; then "$RUNNER" "$S" --spur-bin "$spurBin"; else echo "task-diffstat failed closed — task-diffstat script not found — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; printf '{"files":0,"insertions":0,"deletions":0,"paths":[],"sensitive":true}\n' > ".spur/run/$wbs-diffstat.json"; fi; exit 0
+                    $spurBin task diffstat "$wbs" --no-logo || { echo "task-diffstat failed closed — spur task diffstat exited $?" >&2; printf '{"files":0,"insertions":0,"deletions":0,"paths":[],"sensitive":true}\n' > ".spur/run/$wbs-diffstat.json"; }; exit 0
           # (b)+(c) lane pre-guard BEFORE decide: a caller-set mode is projected verbatim (R2b);
           # a sensitive path or >400 changed lines pins safety (R2c) and the decide result below
           # is never consulted. A missing/malformed diffstat row (producer crashed or never ran,
@@ -953,7 +948,7 @@ states:
             options:
                 command: >-
                     if [ "$deferFeatureSync" = "true" ]; then echo "feature sync deferred to batch integration" >> ".spur/run/$wbs-report.txt"; else FID="$($spurBin task show $wbs --json 2>/dev/null | jq -r '(.feature_id // .frontmatter.feature_id) // empty' 2>/dev/null)"; if [ -n "$FID" ]; then $spurBin feature sync "$FID" --json || echo "feature sync failed — re-run: $spurBin feature sync $FID" >> ".spur/run/$wbs-report.txt"; else echo "Orphan task $wbs — no feature_id linked — proposal: consider linking to a parent feature." >> ".spur/run/$wbs-report.txt"; fi; fi; exit 0
-          # (d) F96 (0983): residual-scan.ts owns the sweep; shell only resolves it. The
+          # (d) F96 (0983): `spur task residual` owns the sweep; shell only sequences it. The
           # scan moved here from verify: it must read the task file AFTER `task record`
           # flipped the verdict-proven Requirement/AC boxes (0692), or a proven-but-unticked
           # box folds every good run to PARTIAL and the done guard is unreachable (0967).
@@ -963,7 +958,7 @@ states:
           - kind: shell
             options:
                 command: >-
-                    eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/residual-scan.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/residual-scan.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; if [ ! -f "$S" ]; then echo "residual-scan failed closed — scanner not found in plugins/sp/scripts/ nor staged — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; exit 1; fi; "$RUNNER" "$S" scan "$wbs" --spur-bin "$spurBin" && "$RUNNER" "$S" fold "$wbs" --spur-bin "$spurBin"
+                    $spurBin task residual "$wbs" scan --no-logo && $spurBin task residual "$wbs" fold --no-logo
           # (e) F96 R5 (0983): a sweep downgrade must reach the task record — re-record from
           # the FINAL (post-fold) artifact so Testing carries the downgraded verdict; a failed
           # task must not retain a stale PASS Testing narrative. Soft (exit 0): the downgrade
@@ -983,13 +978,13 @@ states:
           guard runs `spur task check` before certifying; a genuinely non-compliant
           task routes to `failed` instead of a silent bad `done`.
       onEnter:
-          # (d) F96 R4 (0950): residual-scan.ts owns the settle; shell only resolves it.
+          # (d) F96 R4 (0950): `spur task residual` owns the settle.
           # Soft best-effort (exit 0) — runs after certification and must never change
           # the outcome; failure prints the re-run command.
           - kind: shell
             options:
                 command: >-
-                    eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/residual-scan.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/residual-scan.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; if [ -f "$S" ]; then "$RUNNER" "$S" settle "$wbs" --spur-bin "$spurBin" || echo "residual-settle failed — re-run: residual-scan settle $wbs" >&2; else echo "residual-scan not staged — settle skipped — re-run: residual-scan settle $wbs" >&2; fi; exit 0
+                    $spurBin task residual "$wbs" settle --no-logo || echo "residual-settle failed — re-run: spur task residual $wbs settle" >&2; exit 0
           # (c) command.gate owns the done transition with classified transient retry.
           - kind: command.gate
             options:
@@ -1029,13 +1024,13 @@ states:
                     printf '\n## Escalation bound reached\n\nThe implement step asked an operator question %s times (bound %s) and ended without a resumable answer. Unanswered question:\n\n' "$n" "$maxEscalations" >> .spur/run/$wbs-report.txt;
                     cat .spur/run/$wbs-question.md >> .spur/run/$wbs-report.txt;
                     exit 0
-          # (d) F96 R5 (0950): residual-scan.ts owns the report; shell only resolves it.
+          # (d) F96 R5 (0950): `spur task residual` owns the report.
           # Soft (exit 0): a run that exhausts its fix budget on residuals leaves the
           # report + recovery line while the task stays `wip`.
           - kind: shell
             options:
                 command: >-
-                    eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/residual-scan.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/residual-scan.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; if [ -f "$S" ]; then "$RUNNER" "$S" report "$wbs" --spur-bin "$spurBin" || echo "residual-report failed — re-run: residual-scan report $wbs" >&2; else echo "residual-scan not staged — report skipped — re-run: residual-scan report $wbs" >&2; fi; exit 0
+                    $spurBin task residual "$wbs" report --no-logo || echo "residual-report failed — re-run: spur task residual $wbs report" >&2; exit 0
 
     - id: cancelled
       description: Terminal — pipeline cancelled by operator at the approval gate (R1).
@@ -1295,8 +1290,7 @@ transitions:
               command: >-
                   test "$profile" = auto &&
                   grep -qiE '^[[:space:]]*\**Verdict:\** *PASS' ".spur/run/$__runId-review-answer.txt" &&
-                  eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/residual-scan.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/residual-scan.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)" &&
-                  [ -f "$S" ] && "$RUNNER" "$S" review-gate "$wbs" --spur-bin "$spurBin" >&2
+                  $spurBin task residual "$wbs" review-gate --no-logo >&2
     - from: review
       to: approve
       description: Review certified a PASS with no open P1-P3 finding — gate on human approval before verification.
@@ -1305,8 +1299,7 @@ transitions:
           options:
               command: >-
                   grep -qiE '^[[:space:]]*\**Verdict:\** *PASS' ".spur/run/$__runId-review-answer.txt" &&
-                  eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/residual-scan.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/residual-scan.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)" &&
-                  [ -f "$S" ] && "$RUNNER" "$S" review-gate "$wbs" --spur-bin "$spurBin" >&2
+                  $spurBin task residual "$wbs" review-gate --no-logo >&2
     - from: review
       to: review-fail-triage
       description: >-

package/config/workflows/wrapup-pipeline.yaml

@@ -138,12 +138,6 @@ states:
       Pipeline start. Task statuses are NOT mutated by wrap-up — wrap-up consumes
       completed tasks and produces learning/metrics/doc artifacts only.
     onEnter:
-      # 0960 R2: run-start script-resolution identity — record which tree this run
-      # resolved (source-repo vs installed) before any step executes. Never aborts.
-      - kind: shell
-        options:
-          command: >-
-            S=plugins/sp/scripts/script-root.ts; [ -f config/plugin-scripts.json -a -f "$S" ] || S="$(superskill script path sp script-root.mjs 2>/dev/null)"; RUNNER=bun; case "$S" in *.mjs) RUNNER=node ;; esac; [ -f "$S" ] && "$RUNNER" "$S" --run-id "$__runId" --spur-bin "$spurBin" || echo "script-root failed closed — run 'superskill install sp --marketplace gobing-ai/spur'" >&2; exit 0
       - kind: note
         options:
           message: "Wrap-up pipeline start for tasks: ${vars.tasks}. Task statuses are NOT mutated."
@@ -173,25 +167,20 @@ states:
       - kind: note
         options:
           message: "Resolving task list: ${vars.tasks} (proportional mode: ${vars.mode})"
-      # (d) wrapup-steps.ts resolve owns task capture and status resolution (0824);
-      # the wrapper only locates it (monorepo first, registered twin under node) and
+      # (d) `spur task wrapup resolve` owns task capture and status resolution (0824;
+      # script-absorption PR-5 retired the wrapup-steps plugin script). A nonzero exit
       # fails closed, writing FAIL for the failed defense edge — never PASS.
       - kind: shell
         options:
           command: >-
             mkdir -p .spur/run &&
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/wrapup-steps.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/wrapup-steps.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; if [ -f "$S" ]; then
-              "$RUNNER" "$S" resolve;
-            else
-              echo "wrapup-steps failed closed — script not found — run 'superskill install sp --marketplace gobing-ai/spur'" >&2;
-              printf 'FAIL\n' > ".spur/run/$__runId-wrapup-resolve.status";
-            fi
+            $spurBin task wrapup resolve --no-logo || { rc=$?; echo "task wrapup resolve failed closed (rc=$rc)" >&2; printf 'FAIL\n' > ".spur/run/$__runId-wrapup-resolve.status"; }
       # (0944 R1-R3) deterministic drift probe — runs ONLY when the caller left mode
       # empty (a caller-set mode is projected verbatim and the probe never runs). It
       # writes <runId>-drift-probe.json {clean,reasons,paths} and projects the wrapup
       # mode by writing <runId>-mode.txt: caller mode verbatim, `fast` when the probe
-      # is clean, empty when dirty (the probe script fails safe on any lookup or parse
-      # problem; a missing script writes a dirty probe + empty mode here). The next
+      # is clean, empty when dirty (`spur task wrapup drift-probe` fails safe on any lookup
+      # or parse problem; a nonzero exit writes a dirty probe + empty mode here). The next
       # action reads the mode file into vars.mode via file.read.into-var.
       - kind: shell
         options:
@@ -199,13 +188,11 @@ states:
             if [ -n "$mode" ]; then
               printf '%s\n' "$mode" > ".spur/run/$__runId-mode.txt";
             else
-              eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/wrapup-drift-probe.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/wrapup-drift-probe.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)";
-              if [ -f "$S" ]; then
-                "$RUNNER" "$S";
-              else
-                printf '{"clean":false,"reasons":["probe script not found"],"paths":[]}' > ".spur/run/$__runId-drift-probe.json";
+              $spurBin task wrapup drift-probe --no-logo || {
+                rc=$?;
+                printf '{"clean":false,"reasons":["drift probe failed (rc=%s)"],"paths":[]}' "$rc" > ".spur/run/$__runId-drift-probe.json";
                 printf '\n' > ".spur/run/$__runId-mode.txt";
-              fi;
+              };
             fi
       - kind: file.read.into-var
         options:
@@ -213,7 +200,7 @@ states:
           var: mode
       # (e) route-reason writer: one table lookup over the projected mode var over
       # the validated capture and the drift probe verdict; workflow-local routing
-      # glue (0824, moved behind the wrapup-steps locator in 0944 to stay inside the
+      # glue (0824, moved behind `spur task wrapup` in 0944/PR-5 to stay inside the
       # ADR-115 shell caps). Runs AFTER the probe/projection so the reason reflects
       # the projected mode. Reads ONLY .spur/run/<runId>-wrapup-tasks.json and the
       # probe verdict — never raw vars.tasks (0783 R2/R5). A FAIL resolve exits
@@ -226,12 +213,7 @@ states:
         options:
           command: >-
             mkdir -p .spur/run .spur/memory &&
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/wrapup-steps.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/wrapup-steps.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; if [ -f "$S" ]; then
-              "$RUNNER" "$S" route-reason;
-            else
-              echo "wrapup-steps failed closed — script not found — run 'superskill install sp --marketplace gobing-ai/spur'" >&2;
-              printf 'FAIL\n' > ".spur/run/$__runId-wrapup-resolve.status";
-            fi
+            $spurBin task wrapup route-reason --no-logo || { rc=$?; echo "task wrapup route-reason failed closed (rc=$rc)" >&2; printf 'FAIL\n' > ".spur/run/$__runId-wrapup-resolve.status"; }
 
   - id: doc-sync
     description: >
@@ -259,11 +241,7 @@ states:
         options:
           command: >-
             mkdir -p .spur/run &&
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/wrapup-steps.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/wrapup-steps.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; if [ -f "$S" ]; then
-              "$RUNNER" "$S" doc-sync-snapshot;
-            else
-              echo "wrapup-steps failed closed — script not found — run 'superskill install sp --marketplace gobing-ai/spur'" >&2;
-            fi
+            $spurBin task wrapup doc-sync-snapshot --no-logo || echo "task wrapup doc-sync-snapshot failed (rc=$?) — the scope check fails closed on the missing snapshot" >&2
       # (warn) free-form prompt: no /sp:doc-evolve command surface yet (ADR-043
       # residual, 0607 R2 one-query merge); capture is bounded by expectFile.
       - kind: agent.run
@@ -296,12 +274,7 @@ states:
         options:
           command: >-
             mkdir -p .spur/run &&
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/wrapup-steps.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/wrapup-steps.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; if [ -f "$S" ]; then
-              "$RUNNER" "$S" doc-sync-scope;
-            else
-              echo "wrapup-steps failed closed — script not found — run 'superskill install sp --marketplace gobing-ai/spur'" >&2;
-              printf 'scope-violation: wrapup-steps script not found\n' > ".spur/run/$__runId-wrapup-doc-sync-scope.status";
-            fi
+            $spurBin task wrapup doc-sync-scope --no-logo || { rc=$?; echo "task wrapup doc-sync-scope failed closed (rc=$rc)" >&2; printf 'scope-violation: task wrapup doc-sync-scope failed\n' > ".spur/run/$__runId-wrapup-doc-sync-scope.status"; }
       # (1147 R2) supersession pins re-run: a doc-sync that resurrects a deliberately
       # delinked index row (`repo-wide-tests/adr-supersession.test.ts`, g2) fails HERE,
       # named with the pin, instead of being attributed to the later doc-tripwire
@@ -310,12 +283,7 @@ states:
         options:
           command: >-
             mkdir -p .spur/run &&
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/wrapup-steps.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/wrapup-steps.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; if [ -f "$S" ]; then
-              "$RUNNER" "$S" doc-supersession;
-            else
-              echo "wrapup-steps failed closed — script not found — run 'superskill install sp --marketplace gobing-ai/spur'" >&2;
-              printf 'supersession-pin-failed: wrapup-steps script not found\n' > ".spur/run/$__runId-wrapup-doc-supersession.status";
-            fi
+            $spurBin task wrapup doc-supersession --no-logo || { rc=$?; echo "task wrapup doc-supersession failed closed (rc=$rc)" >&2; printf 'supersession-pin-failed: task wrapup doc-supersession failed\n' > ".spur/run/$__runId-wrapup-doc-supersession.status"; }
 
   - id: learnings-validate
     description: >
@@ -421,18 +389,13 @@ states:
       is UNKNOWN telemetry, never proof of completion; previously written valid rows
       survive a failure.
     onEnter:
-      # (d) wrapup-steps.ts metrics owns the JSONL row append (0824); the wrapper
-      # only locates it and fails closed — FAIL, never a silent skip.
+      # (d) `spur task wrapup metrics` owns the JSONL row append (0824); a nonzero
+      # exit fails closed — FAIL, never a silent skip.
       - kind: shell
         options:
           command: >-
             mkdir -p .spur/run &&
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/wrapup-steps.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/wrapup-steps.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; if [ -f "$S" ]; then
-              "$RUNNER" "$S" metrics;
-            else
-              echo "wrapup-steps failed closed — script not found — run 'superskill install sp --marketplace gobing-ai/spur'" >&2;
-              printf 'FAIL\n' > ".spur/run/$__runId-wrapup-metrics.status";
-            fi
+            $spurBin task wrapup metrics --no-logo || { rc=$?; echo "task wrapup metrics failed closed (rc=$rc)" >&2; printf 'FAIL\n' > ".spur/run/$__runId-wrapup-metrics.status"; }
 
   - id: feature-transition
     description: >
@@ -450,9 +413,9 @@ states:
       (the engine only enters this state when vars.feature is set) and fails
       loud (dogfood 2026-08-15, feature I3).
     onEnter:
-      # (d) wrapup-steps.ts feature-transition owns the bounded sync, observation
-      # and the gate (0824); the wrapper only locates it and fails closed. The
-      # script terminates exit 0 on every path so artifacts that already landed
+      # (d) `spur task wrapup feature-transition` owns the bounded sync, observation
+      # and the gate (0824); a nonzero exit fails closed. The
+      # step terminates exit 0 on every path so artifacts that already landed
       # are never discarded; soft TERMINATION is not soft TRUTH — only a verified
       # sync writes PASS (0783 R4). A gate PASS can never convert a failed sync
       # into success, and a gate FAIL fails the step (0770 failure routing).
@@ -460,12 +423,7 @@ states:
         options:
           command: >-
             mkdir -p .spur/run &&
-            eval "$(jq -r 'if .mode=="source-repo" then "S="+@sh"\(.dir)/wrapup-steps.ts"+" RUNNER=bun" elif .mode=="installed" then "S="+@sh"\(.dir)/wrapup-steps.mjs"+" RUNNER=node" else empty end' ".spur/run/$__runId-script-root.json" 2>/dev/null)"; if [ -f "$S" ]; then
-              "$RUNNER" "$S" feature-transition;
-            else
-              echo "wrapup-steps failed closed — script not found — run 'superskill install sp --marketplace gobing-ai/spur'" >&2;
-              printf 'FAIL\n' > ".spur/run/$__runId-wrapup-sync.status";
-            fi
+            $spurBin task wrapup feature-transition --no-logo || { rc=$?; echo "task wrapup feature-transition failed closed (rc=$rc)" >&2; printf 'FAIL\n' > ".spur/run/$__runId-wrapup-sync.status"; }
 
   - id: feature-verify
     description: >

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.4.8",
+    "version": "0.4.10",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",
@@ -49,11 +49,11 @@
         "dev": "bun run src/index.ts",
         "build": "bun run ../../scripts/spur-dev.ts build-cli",
         "build:binaries": "bun run ../../scripts/spur-dev.ts build-binaries",
-        "build:bundle": "bun run ../../scripts/commands/bundle-plugin-lib.ts && bun run ../../scripts/spur-dev.ts bundle-web && bun run ../../scripts/spur-dev.ts emit-board-types && bun build src/index.ts --target=bun --outfile spur.js --external @johnhenry/backend-webgpu && bun run ../../scripts/spur-dev.ts bundle-config config && bun run ../../scripts/spur-dev.ts bundle-plugins",
+        "build:bundle": "bun run ../../scripts/spur-dev.ts bundle-web && bun run ../../scripts/spur-dev.ts emit-board-types && bun build src/index.ts --target=bun --outfile spur.js --external @johnhenry/backend-webgpu && bun run ../../scripts/spur-dev.ts bundle-config config && bun run ../../scripts/spur-dev.ts bundle-plugins",
         "test": "bun test tests --coverage --coverage-dir=../../.coverage --pass-with-no-tests",
         "typecheck": "tsc --noEmit",
         "prepack": "bun run build:bundle",
-        "prepublishOnly": "bun run ../../scripts/spur-dev.ts check-marketplace-version"
+        "prepublishOnly": "cd ../.. && bun run apps/cli/src/index.ts builder bump-ver --check spur --no-logo"
     },
     "devDependencies": {
         "@commander-js/extra-typings": "^14.0.0",