@gobing-ai/spur 0.4.9 → 0.4.11

package/.claude-plugin/marketplace.json

@@ -7,7 +7,7 @@
     "plugins": [
         {
             "name": "sp",
-            "version": "0.4.9",
+            "version": "0.4.11",
             "source": "./plugins/sp"
         }
     ]

package/config/rules/README.md

@@ -17,7 +17,7 @@ install or to ts-libs.
 | `surface` | `surface/` | CLI surface consistency (registerXxxCommand wiring, --json serialization) |
 | `migration` | `migration/` | Transitional helpers for the regex → `rg` evaluator move (`rg-dialect`) |
 | `ui` | `ui/` | Web UI seam boundaries (import seam, daisyUI class leak) |
-| `docs` | `docs/` | Sourced API/library claims in markdown — citation anchor + HIGH/MEDIUM/LOW level. Advisory (`info`), and deliberately **not** in a preset: see the file header for its calibration audit and the one-line promotion step. |
+| `docs` | `docs/` | Sourced API/library claims in markdown — same-line citation anchor (no confidence level, ADR-138). Advisory (`info`), and deliberately **not** in a preset: see the file header for its calibration audit. |
 
 ## Presets
 

package/config/rules/boundary/env-var-hygiene.yaml

@@ -13,7 +13,6 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 #   gateway — because `superskill install` bundles them on targets with no
 #   node_modules, where any `@gobing-ai/*` import fails ("Bundle failed", task
 #   0669). It mirrors the upstream semantics and is the one exempt file.
-#   The `superskill script convert` `.mjs` twins remain self-contained by inlining.
 # - `apps/web` uses `import.meta.env` (Vite browser plane) — not process env, never matches.
 # - Which variables exist and who consumes them is documented in `.env.example`.
 #   (The former per-var lease table moved there; the rule now enforces the funnel,

package/config/rules/boundary/sp-script-placement.yaml

@@ -2,11 +2,11 @@ $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
 # [boundary] ADR-130 script placement contract (task 1000). Runs the fast
 # --placement-only mode of the relocated script-contract-check on every
 # recommended-pre-check; SKIPs outside the Spur source repo (same pattern as
-# strict/rule-files-structural.yaml SKIP on missing yq). The full twin check
-# stays in spur-check-feature.
+# strict/rule-files-structural.yaml SKIP on missing yq). The full hook-only
+# layout check (`bun run script-contract-check`) stays in spur-check-feature.
 rules:
   - id: sp-script-placement
-    description: "Plugins/sp scripts must honor the ADR-130 placement contract (glue budget, no db imports, no corpus parsing, no noun clash, ADR-129 hook layout); any finding fails (task 1213 retired the baseline ledger)."
+    description: "plugins/sp and scripts/commands must honor the ADR-130 placement contract (hook entry budget, no DB driver or corpus parsing in plugin scripts/hooks/lib, no raw DB driver in scripts/commands, no noun clash, ADR-129 hook layout); any finding fails, no baseline."
     severity: error
     evaluator:
       type: exit-code

package/config/rules/docs/sourced-api-claims.yaml

@@ -1,51 +1,18 @@
 $schema: "@gobing-ai/spur/schemas/rule-file.schema.json"
-# Sourced-claims rules (docs corpus) — API/library claims in markdown must be
-# verifiable. A bare version string or a time-anchored API claim ("deprecated
-# since", "added in 0.5.x") on a line with no citation anchor (http(s) URL or a
-# repo path:line reference) is an unverifyable claim: readers cannot tell
-# measured fact from model memory. The deterministic scan is line-level and
-# heuristic — code fences and command examples can legitimately carry bare
-# versions, so severity is info (advisory visibility; the recommended-pre-check
-# gate runs --fail-on warning, so this rule surfaces findings for review without
-# reddening gates — changed-file enforcement happens in SECUA review).
+# Sourced-claims rules (docs corpus) — an external API/library claim in markdown
+# (a bare x.y.z version, or "deprecated since / added in / removed in <v>") must carry
+# a same-line citation anchor: an http(s) URL or a repo path:line. Contract owned by
+# sp-source-driven-development; changed-file enforcement is SECUA review.
 #
-# Calibration audit (2026-10-12, `spur rule run --file … --json`, unsuppressed):
-# the category was pulled from `recommended-pre-check` on 2026-10-08 for "finding
-# noise" — 593 findings. The audit split them 580 `cited-version-strings` /
-# 13 `cited-api-claims`, and 579 of the 580 were false positives on two shapes
-# that are not external claims at all: a document's own version
-# (`docs/00_ADR.md:5` → `version: 1.69.0`), a section number in a heading
-# (`docs/04_DESIGN.md:116` → `### 1.0.1 Shared option registry`) and a
-# `§`-numbered cross-reference (`docs/00_ADR.md:1118` → `§1.2.1`). All three are
-# excluded by the pattern below — the first two on the line's shape, the third on
-# the token itself. The remaining source was a stale exclude list that stopped at
-# `docs/tasks4/` while the active corpus folder is `docs/tasks5/`, which alone
-# produced 226 findings; it is now one `docs/tasks*/**` glob. 593 → 330 after those
-# two fixes, then 277 once the `§` shape was excluded too — the residual are
-# version-pinned package claims that genuinely lack a same-line anchor, and they
-# stay visible rather than suppressed.
+# Severity is info and the category is deliberately NOT in any preset: the scan is
+# line-level, fires inside code fences, and its residual is a review surface, not a
+# gate (2026-10-12 audit: 593 → 277 findings after the shape/`§`/excludes fixes; the
+# 2026-10-16 widening admitted only verbs whose shape vouches for a version).
+# Re-measure with `spur rule run --file … --json` before widening the vocabulary.
 #
-# The semantic contract — every external API/library claim carries a source
-# citation (URL or path:line) AND a confidence level (HIGH/MEDIUM/LOW) — is
-# owned by the sp-source-driven-development skill and verified in SECUA review
-# (code-verification secu-review checklist). These rules are its deterministic
-# backstop: the three `cited-*` rules cover the citation half, and
-# `cited-api-claims-confidence` covers the level half.
-# `cited-high-confidence` covers the HONESTY half — the level is a claim like
-# any other, so the one level that asserts "verified this session" must show the
-# source it was verified against. MEDIUM (recalled, plausibly stale) and LOW
-# (memory only) require no anchor by contract and are deliberately not flagged.
-# All are severity `info`,
-# and the category is deliberately NOT in `recommended-pre-check` — it surfaces
-# findings for review without reddening gates. The 2026-10-12 audit below settled
-# the promotion question: the residual findings stay a review-surface concern
-# (SECUA checklist), not a gate one — do not add `- docs` to that preset.
-#
-# Fenced-code behavior (measured 2026-10-16, `spur rule run --file … --json` over a
-# probe doc): code fences are NOT skipped by the regex evaluator — every rule here
-# fires on a matching line inside a fence. The earlier note claiming fenced lines
-# were "out of regex reach" was wrong; fence noise is one more reason these stay
-# `info` and ad hoc rather than gated.
+# Citation only — no HIGH/MEDIUM/LOW level rule (ADR-138, task 1221): a model can
+# write HIGH as easily as a claim, so the level verified nothing. The anchor is the
+# evidence; do not reintroduce a level half.
 include:
   - "docs/**/*.md"
   - "plugins/sp/skills/**/references/**/*.md"
@@ -58,6 +25,11 @@ exclude:
   # fallback strips the `*` down to `docs/tasks/` — which is why that form
   # silently excluded nothing (measured 2026-10-12).
   - "docs/tasks*/**"
+  # Dated working records — see the "Historical-record excludes" note above.
+  - "docs/report*/**"
+  - "docs/dogfood/**"
+  - "docs/plans/**"
+  - "docs/analysis/**"
   - "drizzle/**"
   - "**/node_modules/**"
 rules:
@@ -66,8 +38,8 @@ rules:
       A markdown line asserting a version string (x.y.z) without a citation
       anchor on the same line — http(s) URL or repo path reference like
       packages/app/src/foo.ts:123 — is unverifyable. Add the anchor, or drop
-      the version if it is not load-bearing. Confidence level (HIGH/MEDIUM/LOW)
-      is part of the claim contract; see sp-source-driven-development.
+      the version if it is not load-bearing; contract in
+      sp-source-driven-development.
     severity: info
     evaluator:
       type: regex
@@ -87,57 +59,12 @@ rules:
   - id: cited-api-claims
     description: >
       A markdown line making a time- or version-anchored external API claim
-      ("deprecated since 1.2", "introduced in v3", "available since 0.9") must
-      carry a citation anchor on the same line — URL or repo path:line. Add the
-      source (URL or path:line) and the confidence level (HIGH/MEDIUM/LOW);
-      contract in sp-source-driven-development.
-    severity: info
-    evaluator:
-      type: regex
-      config:
-        mode: forbid
-        pattern: "^(?!.*(?:https?://|(?:[\\w.-]+/)+[\\w.-]+:\\d+)).*\\b(?:deprecated (?:since|in|as of)|introduced in|added in|available since|stable since)\\b"
-  - id: cited-api-claims-confidence
-    description: >
-      A markdown line making a time- or version-anchored external API claim
-      ("deprecated since 1.2", "introduced in v3", "available since 0.9") must
-      also state its confidence level — HIGH, MEDIUM or LOW — so a reader can
-      tell a checked fact from model memory; contract in
-      sp-source-driven-development. Pairs with `cited-api-claims`, which covers
-      the citation half: a line missing both halves reports once per rule,
-      deliberately, because each missing half is its own defect.
-    severity: info
-    evaluator:
-      type: regex
-      config:
-        mode: forbid
-        # Fires on a claim line carrying no uppercase level token. The verbs match
-        # `cited-api-claims` exactly, so the two rules never disagree about which
-        # lines are claims.
-        pattern: "^(?!.*\\b(?:HIGH|MEDIUM|LOW)\\b).*\\b(?:deprecated (?:since|in|as of)|introduced in|added in|available since|stable since)\\b"
-  - id: cited-high-confidence
-    description: >
-      A line stating HIGH confidence about an external API/library claim must
-      carry a source citation anchor on the same line — URL or repo path:line.
-      The claim contract (sp-source-driven-development) defines HIGH as
-      "verified against the pinned version's docs/source THIS SESSION", so an
-      uncited HIGH is the one level that cannot be honest: MEDIUM is recalled and
-      plausibly stale, LOW is memory only, and both are explicitly allowed
-      without a source (LOW must never be presented as fact — that stays a review
-      judgment, not a regex). Scoped to the same claim verbs as
-      `cited-api-claims`, so the two rules agree on which lines are claims: a
-      decision record's own `Confidence:` grade (the brainstorm family) is a
-      different contract and is deliberately out of scope. Pairs with
-      `cited-api-claims-confidence`, which catches a claim line carrying no level
-      at all.
+      ("deprecated since 1.2", "introduced in v3", "removed in 0.9") must carry
+      a citation anchor on the same line — URL or repo path:line; contract in
+      sp-source-driven-development.
     severity: info
     evaluator:
       type: regex
       config:
         mode: forbid
-        # Fires when a claim line names HIGH but carries no anchor. The anchor
-        # vocabulary is identical to its siblings (URL or `path:line`), so one
-        # line cannot read as cited for one rule and uncited for another. The level
-        # is asserted with a lookahead so either prose order matches — `(HIGH)` after
-        # the claim (the usual form) and `HIGH — <claim>` both count.
-        pattern: "^(?!.*(?:https?://|(?:[\\w.-]+/)+[\\w.-]+:\\d+))(?=.*\\bHIGH\\b).*\\b(?:deprecated (?:since|in|as of)|introduced in|added in|available since|stable since)\\b"
+        pattern: "^(?!.*(?:https?://|(?:[\\w.-]+/)+[\\w.-]+:\\d+)).*\\b(?:deprecated (?:since|in|as of)|introduced in|added in|available since|stable since|removed (?:in|since) [vV]?\\d|(?:since|as of) (?:[vV]\\d+\\.\\d+(?:\\.\\d+)?|\\d+\\.\\d+\\.\\d+))\\b"

package/config/workflows/feature-verification.yaml

@@ -52,14 +52,6 @@ vars:
   featureId: "X"
   spurBin: "spur"
   verificationCmd: "bun run spur-check-feature"
-  # Operator-declared confidence level; empty derives it from the pass (HIGH when the selected
-  # definition's own command exited 0 with an unchanged proof-input digest, MEDIUM under a caller
-  # `--cmd` override, LOW otherwise). The completion boundary refuses a PASS carrying no level or
-  # LOW unless the receipt records the acknowledgement below.
-  confidence: ""
-  # Operator acknowledgement of a LOW level. It rides the receipt, so the transition reads it from
-  # the evidence rather than from whatever flags a later command happens to pass.
-  ackLowConfidence: "false"
   __runId: ""
 
 states:
@@ -73,7 +65,7 @@ states:
       - kind: shell
         options:
           command: >-
-            mkdir -p .spur/run; ACK=""; [ "$ackLowConfidence" = "true" ] && ACK="--ack-low-confidence"; $spurBin feature verify "$featureId" --run-id "$__runId" --confidence "$confidence" $ACK --no-logo || printf 'FAIL feature-verification failed closed — spur feature verify exited nonzero\n' > ".spur/run/$__runId-feature-verification.status"; exit 0
+            mkdir -p .spur/run; $spurBin feature verify "$featureId" --run-id "$__runId" --no-logo || printf 'FAIL feature-verification failed closed — spur feature verify exited nonzero\n' > ".spur/run/$__runId-feature-verification.status"; exit 0
 
   - id: done
     description: Terminal — repo-wide checks passed and the receipt is bound.

package/config/workflows/pr-review.yaml

@@ -3,13 +3,14 @@
 # (initialState / states[].id / onEnter / top-level transitions), same family as
 # basic.yaml / task-pipeline.yaml. Seeded into projects by `spur init` (scaffold manifest).
 #
-# Shape: preflight → hygiene → precheck → push → ensure-pr → request → wait → collect → done
+# Shape: check → precheck → open → review → done
 #        (soft probes everywhere: red gates route to `failed`/`pending` via transitions,
 #         never a raw lifecycle abort — same reliability contract as basic.yaml)
 #
-# This YAML is the SSOT for the review spine's state order and guards. Every state shells
-# out to `spur builder pr` (the tested deterministic core); no gh/git
-# logic lives in this file. All model-bearing work — finding triage, `fix` mode, `rules`
+# This YAML is the SSOT for the review spine's state order and guards. Every state shells out to
+# the four flat `spur builder pr-<verb>` verbs (task 1219); the op sequencing
+# (preflight→hygiene, push→ensure, request→wait→collect) lives in `runPrVerb`, not in this file's
+# shell, and no gh/git logic lives in this file. All model-bearing work — finding triage, `fix`
 # mode — stays in the sp:pr-reviewing skill and never enters this machine.
 #
 # Non-negotiable: the external review goes through the GitHub PR + an `@codex review`
@@ -21,7 +22,7 @@
 #                        submit: request and stop at `pending` (no wait)
 #                        rerun:  request with --force even when HEAD is already reviewed
 #   baseBranch       — base for a newly created PR (default: existing PR base, else repo default)
-#   focus            — extra review focus appended to the @codex request
+#   focus            — extra review focus appended to the @codex review request
 #   noWait           — "true" returns pending right after the request instead of polling
 #   waitTimeoutSec   — poll budget for Codex output (default 600)
 #   waitIntervalSec  — poll interval (default 30; do not poll aggressively)
@@ -34,9 +35,9 @@
 version: "1"
 name: pr-review
 kind: state-machine
-description: GitHub Codex PR-review spine — preflight → hygiene → precheck → push → ensure-pr → request → wait → collect
+description: GitHub Codex PR-review spine — check → precheck → open → review
 iterationBound: 16
-initialState: preflight
+initialState: check
 terminalStates:
   - done
   - pending
@@ -53,50 +54,27 @@ vars:
   spurBin: "spur"
   preReviewCmd: ""
   __runId: ""
-  # Runtime-set by file.read.into-var (0771): the request record's requestedAt|head,
-  # extracted once by `request` and read per state — no repeated JSON parsing in shell.
-  prSince: ""
-  prHead: ""
 
 states:
-  - id: preflight
+  - id: check
     description: >
-      Soft probe: git/gh/repo checks (detached HEAD, dirty tree, gh auth, GitHub remote,
-      base-branch refusal — preflight refuses when the current branch IS the resolved base,
-      before any push can publish it).
-      Writes PASS|FAIL to .spur/run/${vars.__runId}-pr-preflight.status; always exit 0.
+      Soft probe: preflight (git/gh/repo checks, detached HEAD, dirty tree, base-branch refusal —
+      refused before any push can publish it) followed by the hygiene scan of base...HEAD
+      (secrets/.env/conflict markers BLOCK; debug residue WARNs). A preflight failure stops before
+      hygiene. Writes PASS|WARN|BLOCK|FAIL to .spur/run/${vars.__runId}-pr-check.status; always
+      exit 0, so a red gate routes through the transitions below.
     onEnter:
-      # script-root retired for this workflow: actions call `$spurBin builder pr` directly (PR-7).
+      # script-root retired for this workflow: actions call `$spurBin builder pr-<verb>` directly.
       - kind: shell
         options:
-          # (e) 0825: 10 lines — detached-HEAD/dirty/gh-auth/base-refusal probes must record
-          # before any push can publish; split would let a half-probed run continue.
+          # (e) 0825: 7 lines — preflight+hygiene and their status fallback must land together
+          # (one verb now owns the whole probe; a split would half-probe the submission gate).
           command: >-
-            
-            STATUS_FILE=".spur/run/$__runId-pr-preflight.status" &&
-            set +e &&
-            $spurBin builder pr preflight --base "$baseBranch" --json > ".spur/run/$__runId-pr-context.json";
-            rc=$?; set -e &&
-            if [ "$rc" -eq 0 ]; then printf 'PASS\n' > "$STATUS_FILE"; else printf 'FAIL\n' > "$STATUS_FILE"; fi &&
-            exit 0
-
-  - id: hygiene
-    description: >
-      Submission sanity scan of base...HEAD: secrets/.env/conflict markers BLOCK the run;
-      debug residue only WARNs. Not a replacement for the independent Codex review.
-    onEnter:
-      - kind: shell
-        options:
-          # (e) 0825: 9 lines — hygiene verdict + json capture land together; the status-file
-          # fallback keeps a silent driver from passing the gate.
-          command: >-
-            
-            STATUS_FILE=".spur/run/$__runId-pr-hygiene.status" &&
-            set +e &&
-            $spurBin builder pr hygiene --base "$baseBranch" --json
-            --status-file "$STATUS_FILE" > ".spur/run/$__runId-pr-hygiene.json";
-            rc=$?; set -e &&
-            if [ ! -f "$STATUS_FILE" ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi &&
+            STATUS_FILE=".spur/run/$__runId-pr-check.status";
+            mkdir -p .spur/run;
+            $spurBin builder pr-check --base "$baseBranch" --json --status-file "$STATUS_FILE"
+            > ".spur/run/$__runId-pr-check.json";
+            if [ ! -f "$STATUS_FILE" ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi;
             exit 0
 
   - id: precheck
@@ -111,141 +89,78 @@ states:
           command: >-
             mkdir -p .spur/run; if [ -z "$preReviewCmd" ]; then R=SKIP; elif sh -c "$preReviewCmd"; then R=PASS; else R=FAIL; fi; printf '%s\n' "$R" > ".spur/run/$__runId-pr-precheck.status"
 
-  - id: push
+  - id: open
     description: >
-      Publish the branch (normal push only, never force; sets upstream when missing).
-      A PR reviews pushed commits only.
+      Publish the branch (normal push only, never force; sets upstream when missing) and reuse or
+      create its PR — a rejected push stops before any PR work. Writes FOUND|CREATED|FAIL to
+      .spur/run/${vars.__runId}-pr-open.status and the composed record (push + pr) to
+      .spur/run/${vars.__runId}-pr-open.json.
     onEnter:
       - kind: shell
         options:
-          # (e) 0825: 9 lines — push result and status fallback are atomic; a split could
-          # publish commits without recording the outcome.
+          # (e) 0825: 7 lines — publish + PR dedupe are one verb now; the status fallback keeps a
+          # silent driver from passing the gate.
           command: >-
-            mkdir -p .spur/run &&
-            STATUS_FILE=".spur/run/$__runId-pr-push.status" &&
-            set +e &&
-            $spurBin builder pr push --json --status-file "$STATUS_FILE"
-            > ".spur/run/$__runId-pr-push.json";
-            rc=$?; set -e &&
-            if [ ! -f "$STATUS_FILE" ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi &&
+            STATUS_FILE=".spur/run/$__runId-pr-open.status";
+            mkdir -p .spur/run;
+            $spurBin builder pr-open --base "$baseBranch" --json --status-file "$STATUS_FILE"
+            > ".spur/run/$__runId-pr-open.json";
+            if [ ! -f "$STATUS_FILE" ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi;
             exit 0
 
-  - id: ensure-pr
-    description: Find or create the GitHub PR for the current branch — never a duplicate.
-    onEnter:
-      - kind: shell
-        options:
-          # (e) 0825: 9 lines — PR dedupe lookup captures its record for the downstream
-          # review link; ensure + capture must not race.
-          command: >-
-            mkdir -p .spur/run &&
-            STATUS_FILE=".spur/run/$__runId-pr-ensure.status" &&
-            set +e &&
-            $spurBin builder pr ensure-pr --base "$baseBranch" --json
-            --status-file "$STATUS_FILE" > ".spur/run/$__runId-pr.json";
-            rc=$?; set -e &&
-            if [ ! -f "$STATUS_FILE" ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi &&
-            exit 0
-
-  - id: request
-    description: >
-      Post the `@codex review` request (per-HEAD dedupe unless mode=rerun forces).
-      Records the request under .spur/run/${vars.__runId}-pr-request.json.
-    onEnter:
-      - kind: shell
-        options:
-          # (e) 0825: 10 lines — the write-then-read split is the file-var transport feeding
-          # wait/collect and must stay one action (same record, same run scope).
-          command: >-
-            F="$([ "$mode" = rerun ] && echo --force)"; $spurBin builder pr request --focus "$focus" $F --json --status-file ".spur/run/$__runId-pr-request.status" > ".spur/run/$__runId-pr-request.json"; [ -f ".spur/run/$__runId-pr-request.status" ] || echo FAIL > ".spur/run/$__runId-pr-request.status"; jq -e . ".spur/run/$__runId-pr-request.json" >/dev/null 2>&1 && jq -r '.requestedAt // ""' ".spur/run/$__runId-pr-request.json" > ".spur/run/$__runId-pr-since.txt" && jq -r '.head // ""' ".spur/run/$__runId-pr-request.json" > ".spur/run/$__runId-pr-head.txt"; exit 0
-
-  - id: wait
+  - id: review
     description: >
-      Bounded poll for Codex output on the current pushed HEAD. Timeout records TIMEOUT
-      and routes to `pending` — never a failure (collect later with /sp:dev-pr-review collect).
-      Reads the request record once at `request` (0771): requestedAt/head land in
-      run-scoped .txt files, projected into prSince/prHead vars via file.read.into-var.
+      Request, wait for and collect the `@codex review` result on the current pushed HEAD
+      (per-HEAD dedupe unless mode=rerun; mode=submit or noWait=true stop at PENDING). Writes
+      CLEAN|FINDINGS|PENDING|FAIL to .spur/run/${vars.__runId}-pr-review.status — a wait timeout
+      is PENDING, never a failure — plus the composed findings record and the composite status.
     onEnter:
-      - kind: file.read.into-var
-        options:
-          path: .spur/run/${vars.__runId}-pr-since.txt
-          var: prSince
-      - kind: file.read.into-var
-        options:
-          path: .spur/run/${vars.__runId}-pr-head.txt
-          var: prHead
       - kind: shell
         options:
-          # (e) 0825: 9 lines — bounded wait loop keeps rc bookkeeping so a crashed driver
-          # fails closed instead of polling forever.
+          # (e) 0825: 10 lines — request/wait/collect are one verb now, so their result lands
+          # atomically; the status fallback covers a crashed driver. `mode=submit` or `noWait=true`
+          # pass --no-wait and `mode=rerun` passes --force, each as its own space-separated word
+          # (two substitutions, never concatenated). `/bin/sh -c` carries no `-e`, so a failed
+          # substitution is ignored.
           command: >-
-            mkdir -p .spur/run &&
-            STATUS_FILE=".spur/run/$__runId-pr-wait.status" &&
-            set +e &&
-            $spurBin builder pr wait --since "$prSince" --head "$prHead" --timeout "$waitTimeoutSec" --interval "$waitIntervalSec"
-            --json --status-file "$STATUS_FILE" > ".spur/run/$__runId-pr-wait.json";
-            rc=$?; set -e &&
-            if [ ! -f "$STATUS_FILE" ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi &&
+            O="$([ "$mode" = submit ] || [ "$noWait" = "true" ] && echo --no-wait) $([ "$mode" = rerun ] && echo --force)";
+            STATUS_FILE=".spur/run/$__runId-pr-review.status";
+            mkdir -p .spur/run;
+            $spurBin builder pr-review --focus "$focus" $O --timeout "$waitTimeoutSec" --interval "$waitIntervalSec"
+            --json --status-file "$STATUS_FILE" > ".spur/run/$__runId-pr-findings.json";
+            if [ ! -f "$STATUS_FILE" ]; then printf 'FAIL\n' > "$STATUS_FILE"; fi;
             exit 0
-
-  - id: collect
-    description: >-
-      Normalize the latest current-HEAD Codex result and record composite PR/CI status.
-      Request record read via file.read.into-var vars (0771, see wait).
-    onEnter:
-      - kind: file.read.into-var
-        options:
-          path: .spur/run/${vars.__runId}-pr-since.txt
-          var: prSince
-      - kind: file.read.into-var
-        options:
-          path: .spur/run/${vars.__runId}-pr-head.txt
-          var: prHead
       - kind: shell
         options:
-          # (e) 0825: 9 lines — collect + status must run against the same since/head pair
-          # before the composite status is decided (same 0771 record contract).
+          # The report reads the same composite PR/CI/Codex artifact as before (read-only, so a
+          # failed probe records its own error object instead of failing the collected run).
           command: >-
-            mkdir -p .spur/run; $spurBin builder pr collect --since "$prSince" --head "$prHead" --json --status-file ".spur/run/$__runId-pr-collect.status" > ".spur/run/$__runId-pr-findings.json"; c=$?; $spurBin builder pr status --since "$prSince" --head "$prHead" --json > ".spur/run/$__runId-pr-status.json" && [ "$c" -eq 0 ] && [ -f ".spur/run/$__runId-pr-collect.status" ] || printf 'FAIL\n' > ".spur/run/$__runId-pr-collect.status"; cat ".spur/run/$__runId-pr-findings.json" 2>/dev/null; exit 0
+            $spurBin builder pr-status --json > ".spur/run/$__runId-pr-status.json" || true
 
   - id: done
     description: Terminal — review collected; findings artifact at .spur/run/${vars.__runId}-pr-findings.json
   - id: pending
-    description: Terminal — review requested (or timed out) but not yet collected; run /sp:dev-pr-review collect later
+    description: Terminal — review requested (or timed out) but not yet collected; run /sp:dev-pr-review status later
   - id: failed
     description: Terminal — a gate went red; the stage .status/.json artifacts under .spur/run name the blocker
 
 transitions:
-  - from: preflight
-    to: hygiene
-    description: Repo, gh auth, and clean tree verified
-    guard:
-      kind: shell
-      options:
-        command: 'test "$(cat .spur/run/$__runId-pr-preflight.status 2>/dev/null)" = PASS'
-  - from: preflight
-    to: failed
-    terminalReason: failed-check
-    description: Preflight red (detached HEAD, dirty tree, gh auth, no GitHub remote, or the current branch being the base branch) — stop before any publishing
-    guard:
-      kind: always
-
-  - from: hygiene
+  - from: check
     to: precheck
     description: Clean or warn-only — warnings ride along to the report
     guard:
       kind: shell
       options:
-        command: 'grep -qE "^(PASS|WARN)$" .spur/run/$__runId-pr-hygiene.status 2>/dev/null'
-  - from: hygiene
+        command: 'grep -qE "^(PASS|WARN)$" .spur/run/$__runId-pr-check.status 2>/dev/null'
+  - from: check
     to: failed
     terminalReason: failed-check
-    description: BLOCK (secrets/.env/conflict markers) or probe failure — never submit a tainted diff
+    description: BLOCK (secrets/.env/conflict markers), a preflight failure (detached HEAD, dirty tree, gh auth, no GitHub remote, or the current branch being the base branch), or a probe failure — stop before any publishing
     guard:
       kind: always
 
   - from: precheck
-    to: push
+    to: open
     description: Project fast check passed or was skipped
     guard:
       kind: shell
@@ -258,104 +173,37 @@ transitions:
     guard:
       kind: always
 
-  - from: push
-    to: ensure-pr
-    description: Branch published (or already up to date)
-    guard:
-      kind: shell
-      options:
-        command: 'grep -qE "^(PUSHED|UP_TO_DATE)$" .spur/run/$__runId-pr-push.status 2>/dev/null'
-  - from: push
-    to: failed
-    terminalReason: failed-check
-    description: Push rejected (e.g. non-fast-forward) — report; never force-push as a workaround
-    guard:
-      kind: always
-
-  - from: ensure-pr
-    to: request
-    description: PR found or created
-    guard:
-      kind: shell
-      options:
-        command: 'grep -qE "^(FOUND|CREATED)$" .spur/run/$__runId-pr-ensure.status 2>/dev/null'
-  - from: ensure-pr
-    to: failed
-    terminalReason: failed-check
-    description: No reviewable delta or PR creation failed — report the actual git/GitHub state
-    guard:
-      kind: always
-
-  # Declaration order matters: ALREADY_REVIEWED routes straight to collect (full mode dedupe);
-  # submit/noWait stop at pending; everything else waits.
-  - from: request
-    to: collect
-    description: Current HEAD already carries a Codex review — collect instead of duplicating
-    guard:
-      kind: shell
-      options:
-        command: 'test "$(cat .spur/run/$__runId-pr-request.status 2>/dev/null)" = ALREADY_REVIEWED'
-  - from: request
-    to: pending
-    description: Request already in flight, or mode=submit/--no-wait after posting — return pending
-    guard:
-      kind: shell
-      options:
-        # (e) 0825: 4-predicate guard — ALREADY_REQUESTED/REQUESTED pair state is the
-        # fallback route when the review driver stalls (mode/noWait honored).
-        command: 'test "$(cat .spur/run/$__runId-pr-request.status 2>/dev/null)" = ALREADY_REQUESTED || { test "$(cat .spur/run/$__runId-pr-request.status 2>/dev/null)" = REQUESTED && { test "$mode" = "submit" || test "$noWait" = "true"; }; }'
-  - from: request
-    to: wait
-    description: Request posted — poll for the result
-    guard:
-      kind: shell
-      options:
-        command: 'test "$(cat .spur/run/$__runId-pr-request.status 2>/dev/null)" = REQUESTED'
-  - from: request
-    to: failed
-    terminalReason: failed-check
-    description: Request failed (no PR, gh error) — report the preserved error
-    guard:
-      kind: always
-
-  - from: wait
-    to: collect
-    description: Codex findings or an explicit clean result on the current HEAD found
-    guard:
-      kind: shell
-      options:
-        command: 'grep -qE "^(FOUND|CLEAN)$" .spur/run/$__runId-pr-wait.status 2>/dev/null'
-  - from: wait
-    to: pending
-    description: Poll budget exhausted — pending, not failed
+  - from: open
+    to: review
+    description: Branch published and PR found or created
     guard:
       kind: shell
       options:
-        command: 'test "$(cat .spur/run/$__runId-pr-wait.status 2>/dev/null)" = TIMEOUT'
-  - from: wait
+        command: 'grep -qE "^(FOUND|CREATED)$" .spur/run/$__runId-pr-open.status 2>/dev/null'
+  - from: open
     to: failed
     terminalReason: failed-check
-    description: Poll probe itself failed
+    description: Push rejected (e.g. non-fast-forward — report; never force-push as a workaround) or no reviewable delta or PR creation failed
     guard:
       kind: always
 
-  - from: collect
+  - from: review
     to: done
     description: Current-HEAD review collected (CLEAN/FINDINGS)
     guard:
       kind: shell
       options:
-        command: 'grep -qE "^(FINDINGS|CLEAN)$" .spur/run/$__runId-pr-collect.status 2>/dev/null'
-  - from: collect
+        command: 'grep -qE "^(FINDINGS|CLEAN)$" .spur/run/$__runId-pr-review.status 2>/dev/null'
+  - from: review
     to: pending
-    description: No current-HEAD result yet — pending, never clean
+    description: Request in flight, mode=submit/noWait, or a wait timeout — pending, not failed (collect later)
     guard:
       kind: shell
       options:
-        command: 'test "$(cat .spur/run/$__runId-pr-collect.status 2>/dev/null)" = PENDING'
-  - from: collect
+        command: 'test "$(cat .spur/run/$__runId-pr-review.status 2>/dev/null)" = PENDING'
+  - from: review
     to: failed
     terminalReason: failed-check
-    description: Collect probe failed
+    description: Review probe itself failed (no PR, gh error, moved HEAD)
     guard:
       kind: always