@gobing-ai/spur 0.4.9 → 0.4.10

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.4.9",
+            "version": "0.4.10",
             "source": "./plugins/sp"
         }
     ]

package/config/rules/README.md

@@ -17,7 +17,7 @@ install or to ts-libs.
 | `surface` | `surface/` | CLI surface consistency (registerXxxCommand wiring, --json serialization) |
 | `migration` | `migration/` | Transitional helpers for the regex → `rg` evaluator move (`rg-dialect`) |
 | `ui` | `ui/` | Web UI seam boundaries (import seam, daisyUI class leak) |
-| `docs` | `docs/` | Sourced API/library claims in markdown — citation anchor + HIGH/MEDIUM/LOW level. Advisory (`info`), and deliberately **not** in a preset: see the file header for its calibration audit and the one-line promotion step. |
+| `docs` | `docs/` | Sourced API/library claims in markdown — same-line citation anchor (no confidence level, ADR-138). Advisory (`info`), and deliberately **not** in a preset: see the file header for its calibration audit. |
 
 ## Presets
 

package/config/rules/boundary/env-var-hygiene.yaml

@@ -13,7 +13,6 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 #   gateway — because `superskill install` bundles them on targets with no
 #   node_modules, where any `@gobing-ai/*` import fails ("Bundle failed", task
 #   0669). It mirrors the upstream semantics and is the one exempt file.
-#   The `superskill script convert` `.mjs` twins remain self-contained by inlining.
 # - `apps/web` uses `import.meta.env` (Vite browser plane) — not process env, never matches.
 # - Which variables exist and who consumes them is documented in `.env.example`.
 #   (The former per-var lease table moved there; the rule now enforces the funnel,

package/config/rules/boundary/sp-script-placement.yaml

@@ -2,11 +2,11 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 # [boundary] ADR-130 script placement contract (task 1000). Runs the fast
 # --placement-only mode of the relocated script-contract-check on every
 # recommended-pre-check; SKIPs outside the Spur source repo (same pattern as
-# strict/rule-files-structural.yaml SKIP on missing yq). The full twin check
-# stays in spur-check-feature.
+# strict/rule-files-structural.yaml SKIP on missing yq). The full hook-only
+# layout check (`bun run script-contract-check`) stays in spur-check-feature.
 rules:
   - id: sp-script-placement
-    description: "Plugins/sp scripts must honor the ADR-130 placement contract (glue budget, no db imports, no corpus parsing, no noun clash, ADR-129 hook layout); any finding fails (task 1213 retired the baseline ledger)."
+    description: "plugins/sp and scripts/commands must honor the ADR-130 placement contract (hook entry budget, no DB driver or corpus parsing in plugin scripts/hooks/lib, no raw DB driver in scripts/commands, no noun clash, ADR-129 hook layout); any finding fails, no baseline."
     severity: error
     evaluator:
       type: exit-code

package/config/rules/docs/sourced-api-claims.yaml

@@ -1,51 +1,18 @@
 $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
-# Sourced-claims rules (docs corpus) — API/library claims in markdown must be
-# verifiable. A bare version string or a time-anchored API claim ("deprecated
-# since", "added in 0.5.x") on a line with no citation anchor (http(s) URL or a
-# repo path:line reference) is an unverifyable claim: readers cannot tell
-# measured fact from model memory. The deterministic scan is line-level and
-# heuristic — code fences and command examples can legitimately carry bare
-# versions, so severity is info (advisory visibility; the recommended-pre-check
-# gate runs --fail-on warning, so this rule surfaces findings for review without
-# reddening gates — changed-file enforcement happens in SECUA review).
+# Sourced-claims rules (docs corpus) — an external API/library claim in markdown
+# (a bare x.y.z version, or "deprecated since / added in / removed in <v>") must carry
+# a same-line citation anchor: an http(s) URL or a repo path:line. Contract owned by
+# sp-source-driven-development; changed-file enforcement is SECUA review.
 #
-# Calibration audit (2026-10-12, `spur rule run --file … --json`, unsuppressed):
-# the category was pulled from `recommended-pre-check` on 2026-10-08 for "finding
-# noise" — 593 findings. The audit split them 580 `cited-version-strings` /
-# 13 `cited-api-claims`, and 579 of the 580 were false positives on two shapes
-# that are not external claims at all: a document's own version
-# (`docs/00_ADR.md:5` → `version: 1.69.0`), a section number in a heading
-# (`docs/04_DESIGN.md:116` → `### 1.0.1 Shared option registry`) and a
-# `§`-numbered cross-reference (`docs/00_ADR.md:1118` → `§1.2.1`). All three are
-# excluded by the pattern below — the first two on the line's shape, the third on
-# the token itself. The remaining source was a stale exclude list that stopped at
-# `docs/tasks4/` while the active corpus folder is `docs/tasks5/`, which alone
-# produced 226 findings; it is now one `docs/tasks*/**` glob. 593 → 330 after those
-# two fixes, then 277 once the `§` shape was excluded too — the residual are
-# version-pinned package claims that genuinely lack a same-line anchor, and they
-# stay visible rather than suppressed.
+# Severity is info and the category is deliberately NOT in any preset: the scan is
+# line-level, fires inside code fences, and its residual is a review surface, not a
+# gate (2026-10-12 audit: 593 → 277 findings after the shape/`§`/excludes fixes; the
+# 2026-10-16 widening admitted only verbs whose shape vouches for a version).
+# Re-measure with `spur rule run --file … --json` before widening the vocabulary.
 #
-# The semantic contract — every external API/library claim carries a source
-# citation (URL or path:line) AND a confidence level (HIGH/MEDIUM/LOW) — is
-# owned by the sp-source-driven-development skill and verified in SECUA review
-# (code-verification secu-review checklist). These rules are its deterministic
-# backstop: the three `cited-*` rules cover the citation half, and
-# `cited-api-claims-confidence` covers the level half.
-# `cited-high-confidence` covers the HONESTY half — the level is a claim like
-# any other, so the one level that asserts "verified this session" must show the
-# source it was verified against. MEDIUM (recalled, plausibly stale) and LOW
-# (memory only) require no anchor by contract and are deliberately not flagged.
-# All are severity `info`,
-# and the category is deliberately NOT in `recommended-pre-check` — it surfaces
-# findings for review without reddening gates. The 2026-10-12 audit below settled
-# the promotion question: the residual findings stay a review-surface concern
-# (SECUA checklist), not a gate one — do not add `- docs` to that preset.
-#
-# Fenced-code behavior (measured 2026-10-16, `spur rule run --file … --json` over a
-# probe doc): code fences are NOT skipped by the regex evaluator — every rule here
-# fires on a matching line inside a fence. The earlier note claiming fenced lines
-# were "out of regex reach" was wrong; fence noise is one more reason these stay
-# `info` and ad hoc rather than gated.
+# Citation only — no HIGH/MEDIUM/LOW level rule (ADR-138, task 1221): a model can
+# write HIGH as easily as a claim, so the level verified nothing. The anchor is the
+# evidence; do not reintroduce a level half.
 include:
   - "docs/**/*.md"
   - "plugins/sp/skills/**/references/**/*.md"
@@ -58,6 +25,11 @@ exclude:
   # fallback strips the `*` down to `docs/tasks/` — which is why that form
   # silently excluded nothing (measured 2026-10-12).
   - "docs/tasks*/**"
+  # Dated working records — see the "Historical-record excludes" note above.
+  - "docs/report*/**"
+  - "docs/dogfood/**"
+  - "docs/plans/**"
+  - "docs/analysis/**"
   - "drizzle/**"
   - "**/node_modules/**"
 rules:
@@ -66,8 +38,8 @@ rules:
       A markdown line asserting a version string (x.y.z) without a citation
       anchor on the same line — http(s) URL or repo path reference like
       packages/app/src/foo.ts:123 — is unverifyable. Add the anchor, or drop
-      the version if it is not load-bearing. Confidence level (HIGH/MEDIUM/LOW)
-      is part of the claim contract; see sp-source-driven-development.
+      the version if it is not load-bearing; contract in
+      sp-source-driven-development.
     severity: info
     evaluator:
       type: regex
@@ -87,57 +59,12 @@ rules:
   - id: cited-api-claims
     description: >
       A markdown line making a time- or version-anchored external API claim
-      ("deprecated since 1.2", "introduced in v3", "available since 0.9") must
-      carry a citation anchor on the same line — URL or repo path:line. Add the
-      source (URL or path:line) and the confidence level (HIGH/MEDIUM/LOW);
-      contract in sp-source-driven-development.
-    severity: info
-    evaluator:
-      type: regex
-      config:
-        mode: forbid
-        pattern: "^(?!.*(?:https?://|(?:[\\w.-]+/)+[\\w.-]+:\\d+)).*\\b(?:deprecated (?:since|in|as of)|introduced in|added in|available since|stable since)\\b"
-  - id: cited-api-claims-confidence
-    description: >
-      A markdown line making a time- or version-anchored external API claim
-      ("deprecated since 1.2", "introduced in v3", "available since 0.9") must
-      also state its confidence level — HIGH, MEDIUM or LOW — so a reader can
-      tell a checked fact from model memory; contract in
-      sp-source-driven-development. Pairs with `cited-api-claims`, which covers
-      the citation half: a line missing both halves reports once per rule,
-      deliberately, because each missing half is its own defect.
-    severity: info
-    evaluator:
-      type: regex
-      config:
-        mode: forbid
-        # Fires on a claim line carrying no uppercase level token. The verbs match
-        # `cited-api-claims` exactly, so the two rules never disagree about which
-        # lines are claims.
-        pattern: "^(?!.*\\b(?:HIGH|MEDIUM|LOW)\\b).*\\b(?:deprecated (?:since|in|as of)|introduced in|added in|available since|stable since)\\b"
-  - id: cited-high-confidence
-    description: >
-      A line stating HIGH confidence about an external API/library claim must
-      carry a source citation anchor on the same line — URL or repo path:line.
-      The claim contract (sp-source-driven-development) defines HIGH as
-      "verified against the pinned version's docs/source THIS SESSION", so an
-      uncited HIGH is the one level that cannot be honest: MEDIUM is recalled and
-      plausibly stale, LOW is memory only, and both are explicitly allowed
-      without a source (LOW must never be presented as fact — that stays a review
-      judgment, not a regex). Scoped to the same claim verbs as
-      `cited-api-claims`, so the two rules agree on which lines are claims: a
-      decision record's own `Confidence:` grade (the brainstorm family) is a
-      different contract and is deliberately out of scope. Pairs with
-      `cited-api-claims-confidence`, which catches a claim line carrying no level
-      at all.
+      ("deprecated since 1.2", "introduced in v3", "removed in 0.9") must carry
+      a citation anchor on the same line — URL or repo path:line; contract in
+      sp-source-driven-development.
     severity: info
     evaluator:
       type: regex
       config:
         mode: forbid
-        # Fires when a claim line names HIGH but carries no anchor. The anchor
-        # vocabulary is identical to its siblings (URL or `path:line`), so one
-        # line cannot read as cited for one rule and uncited for another. The level
-        # is asserted with a lookahead so either prose order matches — `(HIGH)` after
-        # the claim (the usual form) and `HIGH — <claim>` both count.
-        pattern: "^(?!.*(?:https?://|(?:[\\w.-]+/)+[\\w.-]+:\\d+))(?=.*\\bHIGH\\b).*\\b(?:deprecated (?:since|in|as of)|introduced in|added in|available since|stable since)\\b"
+        pattern: "^(?!.*(?:https?://|(?:[\\w.-]+/)+[\\w.-]+:\\d+)).*\\b(?:deprecated (?:since|in|as of)|introduced in|added in|available since|stable since|removed (?:in|since) [vV]?\\d|(?:since|as of) (?:[vV]\\d+\\.\\d+(?:\\.\\d+)?|\\d+\\.\\d+\\.\\d+))\\b"

package/config/workflows/feature-verification.yaml

@@ -52,14 +52,6 @@ vars:
   featureId: "X"
   spurBin: "spur"
   verificationCmd: "bun run spur-check-feature"
-  # Operator-declared confidence level; empty derives it from the pass (HIGH when the selected
-  # definition's own command exited 0 with an unchanged proof-input digest, MEDIUM under a caller
-  # `--cmd` override, LOW otherwise). The completion boundary refuses a PASS carrying no level or
-  # LOW unless the receipt records the acknowledgement below.
-  confidence: ""
-  # Operator acknowledgement of a LOW level. It rides the receipt, so the transition reads it from
-  # the evidence rather than from whatever flags a later command happens to pass.
-  ackLowConfidence: "false"
   __runId: ""
 
 states:
@@ -73,7 +65,7 @@ states:
       - kind: shell
         options:
           command: >-
-            mkdir -p .spur/run; ACK=""; [ "$ackLowConfidence" = "true" ] && ACK="--ack-low-confidence"; $spurBin feature verify "$featureId" --run-id "$__runId" --confidence "$confidence" $ACK --no-logo || printf 'FAIL feature-verification failed closed — spur feature verify exited nonzero\n' > ".spur/run/$__runId-feature-verification.status"; exit 0
+            mkdir -p .spur/run; $spurBin feature verify "$featureId" --run-id "$__runId" --no-logo || printf 'FAIL feature-verification failed closed — spur feature verify exited nonzero\n' > ".spur/run/$__runId-feature-verification.status"; exit 0
 
   - id: done
     description: Terminal — repo-wide checks passed and the receipt is bound.

package/config/workflows/task-pipeline.yaml

@@ -58,8 +58,8 @@ name: task-pipeline
 # verifier's and reviewer's self-graded levels (re-imported from the cc anti-hallucination skill
 # by task 1068) are no longer written, checked, or gated on; spur certifies on deterministic
 # evidence (rows MET, proof digests, findings dispositioned). The `confidence` check row, the
-# `ackLowConfidence` var, and the guards' LOW/absent clauses are gone; the derived
-# feature-receipt confidence (ADR-131/1196) is a different family and stays.
+# `ackLowConfidence` var, and the guards' LOW/absent clauses are gone. The derived
+# feature-receipt confidence (1196) followed in task 1221 (ADR-138 amendment).
 version: "7"
 description: "Standard task pipeline: precheck → implement → quality-gate (test/fix/recheck) → review → approve → verify → record → done"
 # Task entity lifecycle (owned by task-lifecycle.yaml):

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@gobing-ai/spur",
-    "version": "0.4.9",
+    "version": "0.4.10",
     "description": "Spur CLI — local-first harness for mainstream coding agents: constraint checking, workflow orchestration, agent health, and history analytics. Bun-native; exposes the `spur` command.",
     "keywords": [
         "spur",

package/plugins/sp/agents/expert-spur.md

@@ -98,7 +98,6 @@ their runbook here.
 **Noun(s):** task | feature | rule | workflow | agent spec
 **Method:** corpus campaign | compose/tune (`sp:spur-composer`) | evaluate/reflect (`sp:spur-doctor`)
 **Scope:** <resolved ids/files>
-**Confidence:** HIGH | MEDIUM | LOW
 
 ### Changes
 | Target | Operation | Result |

package/plugins/sp/commands/dev-changelog.md

@@ -26,5 +26,5 @@ For shared semantics, see the [flag glossary](../skills/spur-dev/references/flag
 
 ## Implementation
 
-Follow the inline procedure in [dev-operations.md](../skills/spur-dev/references/dev-operations.md#8-changelog) (changelog). This is a docs-only generator: run no quality gates (`bun run gate`, lint, typecheck, tests, `spur-check`, rules) — a generic "verify before finishing" rule does not apply here. The generator's own claim-verification pass is part of the procedure, not a gate, and carries two required checks per claim bullet (dev-operations §8, step 7): a **source citation** — an anchor naming a URL or a repo `path:line` — and a **confidence level**, exactly one of `HIGH`, `MEDIUM`, `LOW`, both held in the bullet's `<!-- src: … · <level> -->` comment and re-verified by step 8's self-check.
+Follow the inline procedure in [dev-operations.md](../skills/spur-dev/references/dev-operations.md#8-changelog) (changelog). This is a docs-only generator: run no quality gates (`bun run gate`, lint, typecheck, tests, `spur-check`, rules) — a generic "verify before finishing" rule does not apply here. The generator's own claim-verification pass is part of the procedure, not a gate, and carries one required check per claim bullet (dev-operations §8, step 7): a **source citation** — an anchor naming a URL or a repo `path:line` — held in the bullet's `<!-- src: … -->` comment and re-verified by step 8's self-check. No confidence level is recorded (ADR-138).
 

package/plugins/sp/plugin.json

@@ -1,5 +1,5 @@
 {
     "name": "sp",
-    "version": "0.4.9",
+    "version": "0.4.10",
     "description": "Spur — a local-first harness engineering toolkit that wraps mainstream coding agents with constraint checking, workflow orchestration, and history analytics."
 }

package/plugins/sp/skills/brainstorm/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: brainstorm
-description: "Structured ideation: generate solution options with trade-offs and confidence scoring, then delegate to research/task-creation skills. Triggers: \"brainstorm ideas\", \"explore solutions\", \"consider options\", \"research approaches\", \"what are my options\", \"how should I approach X\"."
+description: "Structured ideation: generate solution options with trade-offs and source citations, then delegate to research/task-creation skills. Triggers: \"brainstorm ideas\", \"explore solutions\", \"consider options\", \"research approaches\", \"what are my options\", \"how should I approach X\"."
 license: Apache-2.0
 version: 1.0.0
 created_at: 2026-03-25
@@ -30,7 +30,7 @@ see_also:
 
 # sp:brainstorm — Structured Ideation Workflow
 
-Generate solution options with trade-offs, recommendations, and confidence scoring. Delegates research to specialized skills.
+Generate solution options with trade-offs, recommendations, and source citations. Delegates research to specialized skills.
 
 **Key distinction:**
 - **`sp:brainstorm`** = Ideation: generate approaches with trade-offs
@@ -40,7 +40,7 @@ Generate solution options with trade-offs, recommendations, and confidence scori
 
 ## Overview
 
-The `sp:brainstorm` skill generates multiple solution approaches with explicit trade-offs, confidence scoring, and source citations. It follows a structured 3-phase workflow: Input parsing, Ideation with research delegation, and structured Output. Unlike pure research or bare task creation, brainstorm focuses on ideation—generating and comparing options before committing to a solution path.
+The `sp:brainstorm` skill generates multiple solution approaches with explicit trade-offs and source citations. It follows a structured 3-phase workflow: Input parsing, Ideation with research delegation, and structured Output. Unlike pure research or bare task creation, brainstorm focuses on ideation—generating and comparing options before committing to a solution path.
 
 ## Quick Start
 
@@ -101,14 +101,15 @@ See the [inline-default contract](../spur-dev/references/cross-cutting.md#inline
 
 ### 3. Generate 2-3 Approaches
 
-Always generate multiple options, each with description, trade-offs, confidence, and sources — full
+Always generate multiple options, each with description, trade-offs, and sources — full
 per-approach template: [references/workflows.md](references/workflows.md#approach-generation).
 
-### 4. Confidence Scoring
+### 4. Source Citations
 
-Every approach and every external claim carries a HIGH/MEDIUM/LOW confidence score plus a dated
-source citation — table, thresholds, and citation format:
-[references/workflows.md](references/workflows.md#confidence-scoring).
+Every external claim carries a dated source citation — format:
+[references/workflows.md](references/workflows.md#source-citation-format). No HIGH/MEDIUM/LOW
+confidence score (ADR-138): a self-assigned score is as easy to write as the claim; the citation and
+the trade-offs are what the operator compares.
 
 ### 5. Task Delegation
 
@@ -224,13 +225,13 @@ still pauses unless the operator has encoded prior approval in the workflow vars
 | "I understand the request — skip clarifying." | Ideating on a misread wastes the whole session. Validate input clarity and the two input modes before generating options. |
 | "More options are always better." | Beyond ~3, options dilute focus and stall the decision. Cap at three and delegate deeper research instead. |
 | "I'll design the architecture while I brainstorm." | Brainstorm generates and scores approaches; it does not lock the design. Route a chosen approach through the Design Approval Gate. |
-| "Confidence scores are subjective — skip them." | An unscored option hides its risk. Cite sources and assign confidence so the operator compares on evidence, not vibes. |
+| "Sources are obvious — skip them." | An uncited option hides its risk. Cite sources and name the trade-offs so the operator compares on evidence, not vibes. |
 
 ## Red Flags
 
 - Presenting a single approach with no alternatives or trade-offs.
 - Starting ideation before the input is clarified.
-- More than three approaches, or approaches with no confidence score / source.
+- More than three approaches, or approaches with no source.
 - Skipping the task-delegation offer after the operator confirms a direction.
 - Treating a brainstorm output as an approved design (bypassing the approval gate).
 
@@ -293,7 +294,7 @@ codebase-first rule, stop conditions, depth question budgets, smart positional d
 The skill uses this tree to:
 1. **Constrain the option space** — each approach must be compatible with resolved decisions
 2. **Generate decision-trace annotations** — each approach lists which decisions it depends on
-3. **Calibrate confidence** — decisions resolved from codebase evidence get higher confidence
+3. **Cite the evidence** — decisions resolved from codebase evidence cite the `path:line` they rest on
 
 When `--skip-discovery` is used (no `--context`), the operation falls back to the standard
 3-phase workflow with its own lightweight clarification step.

package/plugins/sp/skills/brainstorm/agents/openai.yaml

@@ -1,6 +1,6 @@
 name: brainstorm
 description: "Structured ideation workflow for generating solution options with
-  trade-offs, confidence scoring, and delegation to research and task creation
+  trade-offs, source citations, and delegation to research and task creation
   skills. Triggers: brainstorm ideas, explore solutions, consider options,
   research approaches, multiple solution options with trade-offs."
 version: 1.0.0

package/plugins/sp/skills/brainstorm/examples/ideation-example.md

@@ -80,7 +80,6 @@ async function authMiddleware(c: Context, next: Next) {
 }
 ```
 
-**Confidence:** HIGH
 **Sources:**
 - [jose Library Docs](https://github.com/panva/jose) | Verified: 2026-03-25
 - [Hono Middleware Guide](https://hono.dev/docs/middleware/builtin/bearer-auth) | Verified: 2026-03-25
@@ -127,7 +126,6 @@ async function handleLogin(username: string, password: string) {
 }
 ```
 
-**Confidence:** MEDIUM
 **Sources:**
 - [Auth0 Node.js SDK v5](https://auth0.github.io/node-auth0/) | Verified: 2026-03-25
 - [Firebase Admin Setup](https://firebase.google.com/docs/admin/setup) | Verified: 2026-03-15
@@ -172,7 +170,6 @@ async function apiKeyMiddleware(c: Context, next: Next) {
 }
 ```
 
-**Confidence:** MEDIUM
 **Sources:**
 - [Hono Bearer Auth Middleware](https://hono.dev/docs/middleware/builtin/bearer-auth) | Verified: 2026-03-25
 
@@ -206,4 +203,3 @@ async function apiKeyMiddleware(c: Context, next: Next) {
 
 **Generated by:** sp:brainstorm
 **Research delegation:** sp:source-driven-development, spur agent run
-**Confidence:** HIGH (official jose/Hono documentation, 2026)

package/plugins/sp/skills/brainstorm/metadata.openclaw

@@ -1,6 +1,6 @@
 name: brainstorm
 description: "Structured ideation workflow for generating solution options with
-  trade-offs, confidence scoring, and delegation to research and task creation
+  trade-offs, source citations, and delegation to research and task creation
   skills. Triggers: brainstorm ideas, explore solutions, consider options,
   research approaches, multiple solution options with trade-offs."
 version: 1.0.0

package/plugins/sp/skills/brainstorm/references/workflows.md

@@ -85,7 +85,7 @@ DO NOT implement research directly. Delegate to specialized skills:
 
 2. Delegate research + synthesis inline by default
    - Run in the current session; escalate to `spur agent run` only on a subprocess trigger
-   - Request confidence scoring
+   - Request source citations
 ```
 
 ### Approach Generation
@@ -108,7 +108,6 @@ DO NOT implement research directly. Delegate to specialized skills:
 - Key technical considerations
 - Dependencies or prerequisites
 
-**Confidence:** HIGH/MEDIUM/LOW
 **Sources:** [Citations with dates]
 ```
 
@@ -120,14 +119,6 @@ DO NOT implement research directly. Delegate to specialized skills:
 - [Title](URL) | **Verified**: YYYY-MM-DD
 ```
 
-### Confidence Scoring
-
-| Level | Range | Criteria |
-|-------|-------|----------|
-| **HIGH** | >90% | Direct quote from official docs (2025+) |
-| **MEDIUM** | 70-90% | Synthesized from multiple sources |
-| **LOW** | <70% | Uncertain, flag for review |
-
 ---
 
 ## Phase 3: Structured Output
@@ -144,7 +135,7 @@ DO NOT implement research directly. Delegate to specialized skills:
 2. **Approaches** (200-300 words each)
    - 2-3 options with trade-offs
    - Implementation considerations
-   - Confidence levels
+   - Sources
 
 3. **Recommendations** (100-150 words)
    - Recommended approach with reasoning
@@ -197,7 +188,6 @@ run_id: <run id, omit when none>
 **Implementation Notes:**
 - [Technical considerations]
 
-**Confidence:** HIGH/MEDIUM/LOW
 **Sources:** [Citations]
 
 ### Approach 2: [Name]
@@ -255,7 +245,7 @@ Bash: spur task batch-create --file decomposition.json   # bare JSON array (see
 | File not found | Provide clear error with path |
 | Invalid YAML | Report parsing error |
 | Missing fields | List missing fields, ask if incomplete |
-| Research unavailable | Continue, note reduced confidence |
+| Research unavailable | Continue, mark the uncited claims |
 | Save fails | Display output, suggest manual save |
 
 ---
@@ -265,6 +255,6 @@ Bash: spur task batch-create --file decomposition.json   # bare JSON array (see
 When tools unavailable:
 
 1. **Continue** with available tools
-2. **Note** reduced confidence
+2. **Mark** claims left uncited
 3. **Suggest** manual fallback
 4. **Save** intermediate state

package/plugins/sp/skills/code-verification/references/secu-review.md

@@ -90,10 +90,9 @@ Before declaring a task `done`, run this lightweight checklist. It catches the m
 - [ ] No `console.log` / `console.error` in production code (use the project logger).
 - [ ] No `--no-verify`, `--force`, or new suppression comments added to bypass gates.
 - [ ] Solution section contains `file:line` citations for every changed file.
-- [ ] API/library claims in changed docs carry a source citation (URL or `path:line`) and an honest
-      confidence level (HIGH/MEDIUM/LOW) per source-driven-development — a HIGH claim must show the
-      source it was verified against on the same line (MEDIUM/LOW need no anchor); the deterministic advisory backstop is
-      the `cited-version-strings` / `cited-api-claims` / `cited-api-claims-confidence` / `cited-high-confidence` rules
+- [ ] API/library claims in changed docs carry a source citation (URL or `path:line`) per
+      source-driven-development; no confidence label is required (ADR-138). The deterministic
+      advisory backstop is the `cited-version-strings` / `cited-api-claims` rules
       (`.spur/rules/docs/sourced-api-claims.yaml`, run ad hoc — not wired into a preset).
 - [ ] Review section has P1–P4 findings table (even if all rows are empty — the table itself proves review happened).
 

package/plugins/sp/skills/history-anatomy/references/operations.md

@@ -31,10 +31,9 @@ Given the current and baseline artifacts, author the model half of the report. A
    calendar day; ad-hoc → immediately preceding equal-duration window. If baseline coverage is
    insufficient or materially different, emit `not comparable` and **no** trend/delta/percentage.
 3. **Findings** — each with the full per-finding field set (key, category, impact, trend,
-   observation, inference, confidence, contradictions, evidenceAnchor, severity, reproCommand,
+   observation, inference, contradictions, evidenceAnchor, severity, reproCommand,
    ownerSurface). Categories from the closed vocabulary; stable keys of the form
-   `<category>:<owner-surface>:<signal>`. Severity is the closed P1/P2/P3 vocabulary and is
-   orthogonal to confidence; reproCommand reproduces the observation verbatim; ownerSurface names
+   `<category>:<owner-surface>:<signal>`. Severity is the closed P1/P2/P3 vocabulary; reproCommand reproduces the observation verbatim; ownerSurface names
    the concrete owning surface (file/package/command), consistent with the key's middle segment.
 4. **Recurrence ledger** — classify every finding against the baseline on the **stable key**.
 5. **Telemetry gaps** — every dimension the artifact cannot support, rendered `not available`.
@@ -58,7 +57,7 @@ Given a candidate report and the artifacts, independently verify:
 - **Twelve-section completeness and order** — all twelve section names present in the frozen
   order; none renamed/omitted.
 - **Per-finding fields** — every finding (problem and positive) carries key, category, impact,
-  trend, observation, inference, confidence, contradictions, evidenceAnchor, severity (P1/P2/P3),
+  trend, observation, inference, contradictions, evidenceAnchor, severity (P1/P2/P3),
   reproCommand, ownerSurface; category in the closed vocabulary; stable-key grammar. A finding
   missing any triage field FAILs (the deterministic gate enforces the same set).
 - **Remediation handoff** — each accepted-proposal handoff carries a `spur task create`

package/plugins/sp/skills/history-anatomy/references/report-contract.md

@@ -62,10 +62,9 @@ Every finding — problem and positive alike — carries the full field set:
 | `trend` | `new` / `recurring` / `regressed` / `improved` / `resolved` / `not-comparable` (see recurrence). |
 | `observation` | What the artifacts show — evidence, not interpretation. |
 | `inference` | What the observation is reasoned to mean; names its supporting observations. |
-| `confidence` | Per-finding: `high` / `medium` / `low`. Never one blanket report-level score. |
 | `contradictions` | Any contradicting signal shown beside the finding, not silently reconciled. |
 | `evidenceAnchor` | At least one anchor to the forensics artifact or cited `file:line`. An entry with no anchor is invalid. |
-| `severity` | Closed vocabulary `P1` / `P2` / `P3` — how much the finding matters. Orthogonal to `confidence`: severity orders work, confidence says how sure we are (0680 R1). The structure gate fails a finding without one. |
+| `severity` | Closed vocabulary `P1` / `P2` / `P3` — how much the finding matters. Severity orders work (0680 R1); how well a finding is supported lives in its `observation`, `inference`, `contradictions` and `evidenceAnchor`, never a confidence label (ADR-138). The structure gate fails a finding without one. |
 | `reproCommand` | The invocation that reproduces the observation — one command a reader can run verbatim (0680 R2). Gate-enforced. |
 | `ownerSurface` | The concrete surface that owns the fix (a file path, package, or command), consistent with the key's `<owner-surface>` segment but named as a target rather than a slug (0680 R3). Gate-enforced. |
 
@@ -114,7 +113,7 @@ reclassify a recurring finding as new.
 ## Positive patterns
 
 Positive entries are held to the **same evidence standard as problems**: they carry observation,
-inference, confidence, and at least one evidence anchor. An entry without an anchor is invalid. The
+inference, and at least one evidence anchor. An entry without an anchor is invalid. The
 section renders successful workflows, resolved past issues that stay resolved, and healthy,
 repeating behavior worth keeping.
 

package/plugins/sp/skills/issue-finding/SKILL.md

@@ -411,7 +411,7 @@ Thin wrapper: `Skill(skill="sp:issue-finding", args="$ARGUMENTS")`.
 - Wholesale raw JSONL parsing when the source has a typed mapper.
 - Accepting `--use-history` or `--no-task` silently instead of naming their replacements.
 - GENERATE recipes inventing a title flag, dotted template forms, or quoted dotted section flags.
-- Claiming multi-agent forensics without stating source confidence (High/Medium/Low).
+- Claiming multi-agent forensics without citing the session source each finding came from.
 - Skipping batch section writes + single `spur task check` (when generating).
 - Emitting empty findings without inventorying sessions first.
 

package/plugins/sp/skills/parallel-execution/SKILL.md

@@ -61,7 +61,7 @@ Parallel subagent outputs must be **synthesized**, not concatenated. The synthes
 
 1. **Dedup** — merge findings with the same `file:line` anchor; keep the highest-severity version.
 2. **Resolve conflicts** — when two subagents disagree on the same claim, surface the disagreement explicitly; don't silently pick one.
-3. **Rank by confidence** — sort synthesized results by confidence (HIGH → MEDIUM → LOW); unresolved conflicts go last.
+3. **Rank by evidence** — verified findings (executed check or cited source) first, unverified next, unresolved conflicts last; severity within each tier.
 4. **Unified format** — emit one coherent output, not N raw dumps.
 
 Full synthesis methodology: [result-synthesis.md](references/result-synthesis.md).

package/plugins/sp/skills/parallel-execution/references/result-synthesis.md

@@ -41,13 +41,12 @@ Synthesis:  ⚠ CONFLICT — Redis migration safety
 
 **Rule:** conflicts are findings, not failures. Surface them with both positions stated; let the operator resolve.
 
-### 3. Rank by confidence
+### 3. Rank by evidence
 
-Sort synthesized results:
-1. HIGH confidence (empirically verified, source-cited)
-2. MEDIUM confidence (reasoned, but not empirically verified)
-3. LOW confidence (heuristic, pattern-match, or uncertain)
-4. Unresolved conflicts (both sides stated)
+Sort synthesized results by what backs them, not a self-assigned confidence label (ADR-138):
+1. Verified (an executed check or a cited `path:line` / URL)
+2. Unverified (reasoned or pattern-matched; name the check that would ground it)
+3. Unresolved conflicts (both sides stated)
 
 Within each tier, sort by severity (P1 → P2 → P3 → P4).
 
@@ -58,11 +57,11 @@ Emit one coherent output. The unified report has:
 ```
 ## Synthesized Results
 
-### HIGH Confidence
-| # | Finding | Source | Severity | File:Line |
-|---|---------|--------|----------|-----------|
+### Verified
+| # | Finding | Source | Severity | File:Line | Evidence |
+|---|---------|--------|----------|-----------|----------|
 
-### MEDIUM Confidence
+### Unverified
 ...
 
 ### Conflicts (unresolved)

package/plugins/sp/skills/reverse-engineering/SKILL.md

@@ -201,7 +201,6 @@ Audit categories:
 | Analysis Date | YYYY-MM-DD |
 | Target | `path` |
 | Mode / Focus / Format | `briefing` / `[focus]` / `markdown` |
-| Confidence | High / Medium / Low |
 
 ## Purpose Hypothesis
 
@@ -209,8 +208,8 @@ Audit categories:
 
 ## Tech Stack
 
-| Layer | Technology | Evidence | Confidence |
-|---|---|---|---|
+| Layer | Technology | Evidence |
+|---|---|---|
 
 ## Entry Points
 
@@ -282,7 +281,6 @@ Use this shape for `--format json` or `--format both`. Omit fields only when the
   "analysisDate": "YYYY-MM-DD",
   "mode": "architecture",
   "focus": "all",
-  "confidence": "high|medium|low",
   "stack": [],
   "entryPoints": [],
   "components": [],
@@ -301,7 +299,7 @@ Use this shape for `--format json` or `--format both`. Omit fields only when the
 - Cite `file/path:line` for claims derived from source files.
 - Cite manifest paths for stack and package manager claims.
 - Cite multiple files for architectural boundary claims when possible.
-- Mark inferred claims with `Confidence: Medium` or `Confidence: Low`.
+- Mark inferred claims `Inferred:` and name the evidence that would confirm them; no confidence label (ADR-138).
 - Never invent services, databases, tables, endpoints, actors, diagrams, or business flows that are not supported by evidence.
 - If line numbers are unavailable from a tool, cite the file path and state that line numbers were not available.
 
@@ -339,7 +337,7 @@ The indexed-context layer is optional and opportunistic.
 |---|---|
 | Empty/minimal codebase | Return `briefing` with "insufficient evidence", list missing artifacts, suggest next files needed. |
 | Monorepo | Identify packages/apps; ask for scope unless `--auto` or requested mode can safely summarize all packages. |
-| No clear entry point | List candidates with confidence and evidence; do not choose one as definitive. |
+| No clear entry point | List candidates with their evidence; do not choose one as definitive. |
 | Binary-heavy repo | Focus on manifests, scripts, config, docs, and visible source. |
 | Generated/vendor-heavy repo | Exclude generated/vendor paths from architecture conclusions unless directly relevant. |
 | Framework convention over configuration | State inferred convention and cite framework-specific file patterns. |