@opengsd/gsd-core 1.11.0 → 1.12.0

package/hooks/lib/git-probe.js

@@ -0,0 +1,84 @@
+'use strict';
+// hooks/lib/git-probe.js — classify a bounded spawnSync(git, ...) result,
+// distinguishing a GENUINE negative answer (git ran and said "no") from
+// "could not determine" (timeout / spawn failure / signal kill) — #3911.
+//
+// Proven defect: hooks/gsd-worktree-path-guard.js, hooks/gsd-workflow-guard.js,
+// and hooks/gsd-windsurf-pre-write.js each treat spawnSync(git, ..., {timeout})
+// returning a non-zero/empty result as "not applicable" and allow silently.
+// A macOS CI run showed three deny cases land at 2084ms/2112ms/2177ms — just
+// past the 2000ms budget — each returning exit 0 with EMPTY stdout AND EMPTY
+// stderr: a timeout is INDISTINGUISHABLE, at the call site, from git cleanly
+// answering "not a repo" / "not this worktree" unless the spawnSync() result
+// itself is inspected for `error`/`signal`, not just `status`/`stdout`.
+//
+// This module does not change any hook's decision or exit code — it only
+// answers "was this probe's answer real?" so a caller can emit a diagnostic
+// on the undetermined branch while keeping the existing fail-open behavior.
+//
+// Classification mirrors tests/helpers/process-seam.cjs's OUTCOME vocabulary
+// (EXITED vs TIMED_OUT/SPAWN_FAILED/KILLED) — same evidence-over-classification
+// ordering (a populated `status` outranks an attached `error`, since Node can
+// report `error.code === 'ETIMEDOUT'` on a result that also carried a real
+// exit that beat the timer) — so a probe here and a subprocess outcome in the
+// test suite never disagree on the same raw spawnSync() shape.
+
+/**
+ * @param {{error?: (Error & {code?: string})|null, status: number|null, signal: string|null}} result
+ *   the raw return value of `spawnSync('git', ...)`.
+ * @returns {{determined: true} | {determined: false, reason: string}}
+ */
+function classifyGitProbe(result) {
+  const error = result && result.error;
+  const status = result ? result.status : null;
+  const signal = result ? result.signal : null;
+
+  if (!error && signal === null) {
+    // A real exit — status 0 or non-zero is a genuine, trustworthy answer.
+    return { determined: true };
+  }
+  if (status !== null) {
+    // `status` is only ever populated by a real exit; it outranks an attached
+    // `error` even at the exact timeout boundary (process-seam.cjs's own
+    // "evidence over classification" rule).
+    return { determined: true };
+  }
+
+  const code = error ? (error.code ?? null) : null;
+  let reason;
+  if (code === 'ETIMEDOUT' || signal !== null) {
+    reason = signal ? `timed out (signal ${signal})` : 'timed out';
+  } else if (code) {
+    reason = `spawn failed (${code})`;
+  } else {
+    reason = 'could not run (unknown reason)';
+  }
+  return { determined: false, reason };
+}
+
+/**
+ * If `result` could not be determined (timeout / spawn failure / signal
+ * kill), write a stderr diagnostic naming the probe and why — never changes
+ * any exit code, never throws. A no-op when the probe genuinely ran and
+ * answered (status 0 or non-zero with no error/signal).
+ *
+ * @param {string} hookName - e.g. 'gsd-worktree-path-guard'
+ * @param {string} probeLabel - e.g. "git rev-parse --show-toplevel"
+ * @param {*} result - the raw spawnSync() return value
+ */
+function reportIfUndetermined(hookName, probeLabel, result) {
+  const classification = classifyGitProbe(result);
+  if (classification.determined) return;
+  try {
+    process.stderr.write(
+      `${hookName}: git probe '${probeLabel}' ${classification.reason} — ` +
+      `allowing this call because the probe's answer is unknown, not because ` +
+      `git answered "no" (#3911).\n`
+    );
+  } catch {
+    // A stderr write failing (EPIPE, closed fd) must never itself change the
+    // hook's fail-open outcome.
+  }
+}
+
+module.exports = { classifyGitProbe, reportIfUndetermined };

package/hooks/lib/hook-exit.js

@@ -0,0 +1,81 @@
+'use strict';
+// hooks/lib/hook-exit.js — hand-written, NOT generated. A tiny hook-facing
+// vocabulary layered over hooks/lib/cli-exit.js's terminateNow (ADR-3889 §3),
+// for the 19 enforcement hooks P7/#3911 is migrating off raw process.exit().
+//
+// WHY onCrash is a REQUIRED argument, with no default (this is the entire
+// point of this module): every hook audited for #3911 ended its outer
+// try/catch in ONE of two ways — some `process.exit(0)` (fail open: a hook
+// error must never block a legitimate tool call), others `process.exit(2)`
+// (fail closed: a hook whose whole job is a security/safety denial must not
+// let its own bug wave the denial through). Both are legitimate policies for
+// DIFFERENT hooks — but neither is the "obviously correct" one, and a shared
+// helper that silently defaulted to either would let a future hook inherit
+// the wrong policy by omission, which is exactly the "nothing fails with
+// success" defect ADR-3889 exists to close. Requiring the caller to name its
+// policy at every call site — not just once at module load — makes "I forgot
+// to decide" a load-time/call-time crash instead of a silent behavior. A
+// caller that truly wants "allow on crash" must still write ALLOW; there is
+// no path that reaches terminateNow without a declared choice.
+//
+// crash() itself is total: it does not throw on a bad `onCrash`, because
+// throwing would unwind into the CALLER's own outer catch — the exact
+// fail-open-by-accident hazard this module removes. Instead an unrecognized
+// policy terminates via terminateNow('INTERNAL', ...) with a diagnostic
+// payload naming the offending value, so a typo'd/misspelled policy is
+// debuggable on stderr rather than silently reinterpreted as ALLOW or DENY.
+const { terminateNow } = require('./cli-exit.js');
+
+/** Frozen enum of the two declarable crash policies. No third option. */
+const HOOK_ON_CRASH = Object.freeze({
+  ALLOW: 'allow',
+  DENY: 'deny',
+});
+
+/** Terminate with the hook-protocol PASS outcome (exit 0). */
+function allow(payload) {
+  terminateNow('PASS', payload);
+}
+
+/**
+ * Terminate with the hook-protocol deny outcome (exit 2, stdout+stderr).
+ *
+ * @param {*} payload - JSON-serializable value written to fd 1 (and, when
+ *   `stderrPayload` is omitted, fd 2 too).
+ * @param {*} [stderrPayload] - optional distinct value for fd 2, forwarded
+ *   verbatim to terminateNow's own `stderrPayload` param — a string is
+ *   written raw, anything else is JSON-stringified.
+ */
+function deny(payload, stderrPayload) {
+  terminateNow('HOOK_DENY', payload, stderrPayload);
+}
+
+/**
+ * Dispatch to allow()/deny() per a DECLARED crash policy. `onCrash` is
+ * required — see the module header for why there is no default.
+ *
+ * @param {'allow'|'deny'} onCrash - one of HOOK_ON_CRASH's two values.
+ * @param {*} payload - JSON-serializable value forwarded to terminateNow.
+ */
+function crash(onCrash, payload) {
+  if (onCrash === HOOK_ON_CRASH.ALLOW) {
+    allow(payload);
+    return;
+  }
+  if (onCrash === HOOK_ON_CRASH.DENY) {
+    deny(payload);
+    return;
+  }
+  // Never guess a policy and never throw (a throw would unwind into the
+  // caller's own outer catch — the fail-open-by-accident defect this module
+  // exists to remove). Terminate deterministically with INTERNAL, naming the
+  // offending value so a misspelled/omitted policy is diagnosable.
+  terminateNow('INTERNAL', {
+    error: 'hook-exit: crash() called with an unrecognized onCrash policy',
+    receivedOnCrash: onCrash,
+    expectedOneOf: [HOOK_ON_CRASH.ALLOW, HOOK_ON_CRASH.DENY],
+    originalPayload: payload,
+  });
+}
+
+module.exports = { HOOK_ON_CRASH, allow, deny, crash };

package/hooks/managed-hooks-registry.cjs

@@ -29,6 +29,9 @@ const MANAGED_HOOKS = [
   'gsd-cursor-subagent-stop.js',
   'gsd-ensure-canonical-path.js',
   'gsd-graphify-update.sh',
+  // #3662: portable node resolver (helper staged in hooks/; managed JS hook
+  // commands route through it under --portable-hooks).
+  'gsd-node-runner.sh',
   'gsd-phase-boundary.sh',
   'gsd-prompt-guard.js',
   'gsd-read-guard.js',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/gsd-core",
-  "version": "1.11.0",
+  "version": "1.12.0",
   "description": "GSD Core is a meta-prompting, context engineering, and spec-driven development system for AI coding agents.",
   "main": ".opencode/plugins/gsd-core.js",
   "bin": {
@@ -66,6 +66,7 @@
   "devDependencies": {
     "@eslint/js": "^9.39.4",
     "@stryker-mutator/core": "^9.6.1",
+    "@stryker-mutator/tap-runner": "^9.6.1",
     "@types/node": "^22.19.19",
     "c8": "^11.0.0",
     "eslint": "^9.39.4",
@@ -75,6 +76,7 @@
     "fast-check": "^4.8.0",
     "globals": "^16.5.0",
     "js-yaml": "^4.3.1",
+    "mutation-testing-metrics": "^3.7.3",
     "re2js": "^2.8.6",
     "typescript": "^6.0.3",
     "typescript-eslint": "^8.60.0"
@@ -106,7 +108,7 @@
     "gen:registry": "node scripts/gen-registry.cjs --write",
     "gen:install-tree": "node scripts/gen-install-tree-fixtures.cjs",
     "gen:section-manifest": "node scripts/gen-section-manifest.cjs --write",
-    "regen:derived": "npm run build && npm run gen:registry && node scripts/gen-adr-index.cjs --write && node scripts/gen-capability-matrix.cjs --write && node scripts/gen-inventory-manifest.cjs --write && node scripts/gen-context-index.cjs --write && npm run gen:section-manifest && node scripts/sync-manifest-versions.cjs && npm run gen:install-tree",
+    "regen:derived": "npm run build && npm run gen:registry && node scripts/gen-adr-index.cjs --write && node scripts/gen-features.cjs --write && node scripts/gen-capability-matrix.cjs --write && node scripts/gen-inventory-manifest.cjs --write && node scripts/gen-context-index.cjs --write && node scripts/gen-state-md-docs.cjs --write && npm run gen:section-manifest && node scripts/sync-manifest-versions.cjs && npm run gen:install-tree && node scripts/gen-scripts-cli-exit.cjs --write && node scripts/gen-hooks-cli-exit.cjs --write && node scripts/gen-exit-code-registry.cjs --write && node scripts/gen-exit-code-docs.cjs --write",
     "validate:registry": "node scripts/validate-registry.cjs",
     "prepack": "npm run build:lib",
     "prepare": "npm run build:lib",
@@ -119,7 +121,7 @@
     "lint:table-schema-drift": "node scripts/lint-table-schema-drift.cjs",
     "lint:frontmatter-scalar-broad-grep": "node scripts/lint-frontmatter-scalar-broad-grep.cjs",
     "lint:removed-but-needed": "node scripts/lint-removed-but-needed.cjs",
-    "lint:ci": "npm run lint && npm run lint:skill-deps && npm run lint:generated-sync && node scripts/lint-test-file-count.cjs && node scripts/lint-command-contract.cjs && node scripts/lint-pr-check-project-dir.cjs && npm run lint:legacy-name && node scripts/lint-regression-test-names.cjs && node scripts/lint-allow-test-rule-refs.cjs && node scripts/lint-resolution-provenance.cjs && node scripts/lint-emitted-drift-ack.cjs && node scripts/lint-portable-timeout.cjs && node scripts/validate-registry.cjs && node scripts/lint-table-schema-drift.cjs && node scripts/lint-fix-has-regression-test.cjs && node scripts/lint-example-parser-parity.cjs && node scripts/lint-docs-command-form.cjs && node scripts/lint-plan-count-drift.cjs && node scripts/lint-milestone-window-drift.cjs && node scripts/lint-phase-enumeration-drift.cjs && node scripts/lint-planning-prompt-drift.cjs && node scripts/lint-unreachable-guard-drift.cjs && node scripts/lint-completion-ratio-drift.cjs && node scripts/lint-state-field-drift.cjs && node scripts/lint-state-write-path-drift.cjs && node scripts/lint-completion-predicate-drift.cjs && node scripts/lint-planning-snapshot-bypass-drift.cjs && node scripts/lint-health-diagnostic-rule-table.cjs && node scripts/lint-planning-artifact-writer-drift.cjs && node scripts/lint-frontmatter-scalar-broad-grep.cjs && node scripts/lint-removed-but-needed.cjs && node scripts/lint-no-adhoc-regex-escape.cjs && node scripts/lint-vendored-deps.cjs && npm run lint:hooks-runtime-build-seam && node scripts/check-contract-drift.cjs",
+    "lint:ci": "npm run lint && npm run lint:skill-deps && npm run lint:generated-sync && node scripts/lint-test-file-count.cjs && node scripts/lint-command-contract.cjs && node scripts/lint-pr-check-project-dir.cjs && npm run lint:legacy-name && node scripts/lint-regression-test-names.cjs && node scripts/lint-allow-test-rule-refs.cjs && node scripts/lint-resolution-provenance.cjs && node scripts/lint-portable-timeout.cjs && node scripts/validate-registry.cjs && node scripts/lint-table-schema-drift.cjs && node scripts/lint-fix-has-regression-tests.cjs && node scripts/lint-example-parser-parity.cjs && node scripts/lint-docs-command-form.cjs && node scripts/lint-plan-count-drift.cjs && node scripts/lint-milestone-window-drift.cjs && node scripts/lint-phase-enumeration-drift.cjs && node scripts/lint-planning-prompt-drift.cjs && node scripts/lint-unreachable-guard-drift.cjs && node scripts/lint-completion-ratio-drift.cjs && node scripts/lint-slug-derivation-drift.cjs && node scripts/lint-state-field-drift.cjs && node scripts/lint-state-write-path-drift.cjs && node scripts/lint-completion-predicate-drift.cjs && node scripts/lint-planning-snapshot-bypass-drift.cjs && node scripts/lint-health-diagnostic-rule-table.cjs && node scripts/lint-planning-artifact-writer-drift.cjs && node scripts/lint-frontmatter-scalar-broad-grep.cjs && node scripts/lint-removed-but-needed.cjs && node scripts/lint-no-adhoc-regex-escape.cjs && node scripts/lint-vendored-deps.cjs && node scripts/lint-docs-guard-registration.cjs && node scripts/lint-source-test-name-collision.cjs && npm run lint:hooks-runtime-build-seam && node scripts/check-contract-drift.cjs && node scripts/lint-mutation-test-derivation-drift.cjs && node scripts/lint-seam-enforcement.cjs",
     "lint:allow-test-rule-refs": "node scripts/lint-allow-test-rule-refs.cjs",
     "lint:regression-names": "node scripts/lint-regression-test-names.cjs",
     "lint:descriptions": "node scripts/lint-descriptions.cjs",
@@ -127,10 +129,11 @@
     "lint:test-file-count": "node scripts/lint-test-file-count.cjs",
     "lint:pr-checks": "node scripts/lint-pr-check-project-dir.cjs",
     "lint:changeset": "node scripts/changeset/lint.cjs",
-    "lint:generated-sync": "node scripts/gen-capability-registry.cjs --check && node scripts/gen-loop-host-contract.cjs --check && node scripts/gen-capability-matrix.cjs --check && node scripts/sync-manifest-versions.cjs --check && node scripts/gen-inventory-manifest.cjs --check && node scripts/generate-package-identity.cjs --check && node scripts/gen-plugin-skills.cjs --check && node scripts/gen-registry.cjs --check && node scripts/gen-adr-index.cjs --check && node scripts/check-glossary-refs.cjs --check && node scripts/lint-compiled-artifact-sync.cjs --check && node scripts/gen-context-index.cjs --check && node scripts/gen-section-manifest.cjs --check && node scripts/gen-health-docs.cjs --check",
+    "lint:generated-sync": "node scripts/gen-capability-registry.cjs --check && node scripts/gen-loop-host-contract.cjs --check && node scripts/gen-capability-matrix.cjs --check && node scripts/sync-manifest-versions.cjs --check && node scripts/gen-inventory-manifest.cjs --check && node scripts/generate-package-identity.cjs --check && node scripts/gen-plugin-skills.cjs --check && node scripts/gen-registry.cjs --check && node scripts/gen-adr-index.cjs --check && node scripts/gen-features.cjs --check && node scripts/check-glossary-refs.cjs --check && node scripts/lint-compiled-artifact-sync.cjs --check && node scripts/gen-context-index.cjs --check && node scripts/gen-section-manifest.cjs --check && node scripts/gen-health-docs.cjs --check && node scripts/gen-state-md-docs.cjs --check && node scripts/gen-scripts-cli-exit.cjs --check && node scripts/gen-hooks-cli-exit.cjs --check && node scripts/gen-exit-code-registry.cjs --check && node scripts/gen-exit-code-docs.cjs --check",
     "lint:docs": "node scripts/lint-docs-required.cjs",
     "lint:qa-smells": "node scripts/qa-smell-ratchet.cjs",
     "lint:legacy-name": "node scripts/lint-legacy-dir-name.cjs",
+    "lint:seam-enforcement": "node scripts/lint-seam-enforcement.cjs",
     "lint:docs-command-form": "node scripts/lint-docs-command-form.cjs",
     "lint:hooks-runtime-build-seam": "node scripts/lint-hooks-runtime-build-seam.cjs",
     "ci:test-scope": "node scripts/ci-test-scope.cjs",
@@ -146,12 +149,14 @@
     "test:affected": "node scripts/run-affected-tests.cjs",
     "test:coverage": "c8 --check-coverage --lines 70 --branches 60 --reporter text --include 'gsd-core/bin/lib/**/*.cjs' --exclude 'tests/**' --all node scripts/run-tests.cjs",
     "test:coverage:scripts-floor": "c8 check-coverage --lines 55 --include 'scripts/**/*.cjs' --exclude 'tests/**' --all",
-    "test:coverage:unit": "c8 --reporter text --reporter json-summary --include 'gsd-core/bin/lib/**/*.cjs' --exclude 'tests/**' --all node scripts/run-tests.cjs --suite unit && node scripts/check-coverage-gate.cjs",
+    "test:coverage:unit": "c8 --reporter text --reporter json-summary --merge-async --include 'gsd-core/bin/lib/**/*.cjs' --exclude 'tests/**' --all node scripts/run-tests.cjs --suite unit && node scripts/check-coverage-gate.cjs",
     "test:coverage:unit:raw": "c8 --reporter none node scripts/run-tests.cjs --suite unit",
-    "test:coverage:report": "c8 report --reporter text --reporter json-summary --include 'gsd-core/bin/lib/**/*.cjs' --exclude 'tests/**' --all && node scripts/check-coverage-gate.cjs",
+    "test:coverage:report": "c8 report --reporter text --reporter json-summary --merge-async --include 'gsd-core/bin/lib/**/*.cjs' --exclude 'tests/**' --all && node scripts/check-coverage-gate.cjs",
     "test:coverage:all": "npm run test:coverage",
     "test:mutation": "stryker run",
-    "test:mutation:since": "stryker run --incremental --since origin/next"
+    "test:mutation:since": "stryker run --incremental --since origin/next",
+    "gen:features": "node scripts/gen-features.cjs",
+    "gen:state-md-docs": "node scripts/gen-state-md-docs.cjs"
   },
   "allowScripts": {
     "fallow@2.70.0": true

package/scripts/base64-scan.sh

@@ -9,12 +9,29 @@
 #   scripts/base64-scan.sh --file path/to/file   # Scan a single file
 #   scripts/base64-scan.sh --dir agents/          # Scan all files in a directory
 #
-# Exit codes:
-#   0 = clean
-#   1 = findings detected
-#   2 = usage error
+# Exit codes (ADR-3889, #3908 — registered in gsd-core/bin/shared/exit-codes.json):
+#   0                = clean
+#   1                = findings detected
+#   $EXIT_USAGE       (64) = usage error (bad argv, missing --file/--dir target)
+#   $EXIT_NO_INPUT    (66) = ran; scope established; zero files in scope (genuinely empty)
+#   $EXIT_UNAVAILABLE (69) = could not establish scope (bad ref, not a repo, unreadable dir)
 set -euo pipefail
 
+# ─── Exit-code registry (ADR-3889, #3908) ────────────────────────────────────
+# Resolved relative to THIS script's location, not the caller's cwd. Loud,
+# non-zero failure if the fragment is missing — never fall back to a guessed
+# literal integer, and never let a missing registry silently degrade to
+# exit 0.
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+EXIT_CODES_SH="$SCRIPT_DIR/../gsd-core/bin/shared/exit-codes.sh"
+if [[ ! -f "$EXIT_CODES_SH" ]]; then
+  echo "base64-scan: FATAL: exit-code registry not found at $EXIT_CODES_SH" >&2
+  echo "  Regenerate with: node scripts/gen-exit-code-registry.cjs --write" >&2
+  exit 1
+fi
+# shellcheck disable=SC1090
+. "$EXIT_CODES_SH"
+
 # ── Locale hardening (#116) ───────────────────────────────────────────────────
 # BSD tr (macOS) treats input bytes as multi-byte characters under any UTF-8
 # locale.  When the input to `tr -cd '[:print:]'` contains bytes that are not
@@ -180,7 +197,31 @@ collect_files() {
   case "$mode" in
     --diff)
       local base="${1:-origin/main}"
-      git diff --name-only --diff-filter=ACMR "$base"...HEAD 2>/dev/null \
+      # Run git separately from the filter pipe so its OWN exit status (not
+      # grep's) decides whether the diff could be established. stdout and
+      # stderr are captured SEPARATELY (never merged with `2>&1`) so that a
+      # warning git writes to stderr on an otherwise successful diff can
+      # never be mistaken for a filename in the file list. On failure the
+      # captured stderr is emitted as the diagnostic; on success it is
+      # forwarded as a warning, never folded into the file list.
+      # `|| true` on the filter below is CORRECT (not gratuitous): `grep -v`
+      # exits 1 when every line is filtered out (e.g. an all-images diff),
+      # which is a legitimate empty result, not a failure to run.
+      local raw status err_file
+      err_file=$(mktemp)
+      raw=$(git diff --name-only --diff-filter=ACMR "$base"...HEAD 2>"$err_file")
+      status=$?
+      if (( status != 0 )); then
+        cat "$err_file" >&2
+        rm -f "$err_file"
+        exit "$EXIT_UNAVAILABLE"
+      fi
+      if [[ -s "$err_file" ]]; then
+        echo "Warning: git diff emitted stderr output:" >&2
+        cat "$err_file" >&2
+      fi
+      rm -f "$err_file"
+      printf '%s\n' "$raw" \
         | grep -vE '\.(png|jpg|jpeg|gif|ico|woff|woff2|ttf|eot|otf|zip|tar|gz|pdf)$' || true
       ;;
     --file)
@@ -188,24 +229,41 @@ collect_files() {
         echo "$1"
       else
         echo "Error: file not found: $1" >&2
-        exit 2
+        exit "$EXIT_USAGE"
       fi
       ;;
     --dir)
       local dir="$1"
       if [[ ! -d "$dir" ]]; then
         echo "Error: directory not found: $dir" >&2
-        exit 2
+        exit "$EXIT_USAGE"
+      fi
+      # Same treatment as --diff: a `find` that fails (e.g. permission
+      # denied) must not be reported as an empty directory, and stdout/stderr
+      # are captured separately so a stderr warning never enters the file list.
+      local raw status err_file
+      err_file=$(mktemp)
+      raw=$(find "$dir" -type f ! -path '*/node_modules/*' ! -path '*/.git/*' ! -path '*/dist/*' \
+        ! -name '*.png' ! -name '*.jpg' ! -name '*.gif' ! -name '*.woff*' 2>"$err_file")
+      status=$?
+      if (( status != 0 )); then
+        cat "$err_file" >&2
+        rm -f "$err_file"
+        exit "$EXIT_UNAVAILABLE"
+      fi
+      if [[ -s "$err_file" ]]; then
+        echo "Warning: find emitted stderr output:" >&2
+        cat "$err_file" >&2
       fi
-      find "$dir" -type f ! -path '*/node_modules/*' ! -path '*/.git/*' ! -path '*/dist/*' \
-        ! -name '*.png' ! -name '*.jpg' ! -name '*.gif' ! -name '*.woff*' 2>/dev/null || true
+      rm -f "$err_file"
+      printf '%s\n' "$raw"
       ;;
     --stdin)
       cat
       ;;
     *)
       echo "Usage: $0 --diff [base] | --file <path> | --dir <path> | --stdin" >&2
-      exit 2
+      exit "$EXIT_USAGE"
       ;;
   esac
 }
@@ -309,7 +367,7 @@ extract_and_check_blobs() {
 main() {
   if [[ $# -eq 0 ]]; then
     echo "Usage: $0 --diff [base] | --file <path> | --dir <path>" >&2
-    exit 2
+    exit "$EXIT_USAGE"
   fi
 
   load_ignorelist
@@ -321,8 +379,12 @@ main() {
   files=$(collect_files "$mode" "$@")
 
   if [[ -z "$files" ]]; then
+    # collect_files already exited (UNAVAILABLE/USAGE) for anything that
+    # could not establish scope. Reaching here with an empty result means
+    # scope WAS established and is genuinely empty (e.g. an all-images
+    # diff) — that is NO_INPUT, not a silent clean pass.
     echo "base64-scan: no files to scan"
-    exit 0
+    exit "$EXIT_NO_INPUT"
   fi
 
   local total=0

package/scripts/build-hooks.js

@@ -71,6 +71,11 @@ const HOOKS_TO_COPY = [
   'gsd-session-state.sh',
   'gsd-validate-commit.sh',
   'gsd-phase-boundary.sh',
+  // Portable node resolver (#3662). Not a registered hook itself: managed JS
+  // hook commands under --portable-hooks route through it (bash <resolver>
+  // <baked-node> <script>) so node resolves at hook-fire time in every
+  // environment sharing the config root. Staged verbatim — no templating.
+  'gsd-node-runner.sh',
   // Graphify auto-update hook (#3347 / PR #3557 / #3579). Opt-in via
   // .planning/config.json graphify.auto_update; off by default.
   'gsd-graphify-update.sh'

package/scripts/check-glossary-refs.cjs

@@ -65,7 +65,7 @@ const TRACKED_PREFIXES = [
 const TRACKED_EXACT = new Set(['bin/install.js', 'package.json']);
 
 /**
- * Paths CONTEXT.md documents whose ABSENCE is the healthy steady state (#2778).
+ * Paths CONTEXT.md documents whose ABSENCE is the healthy steady state.
  *
  * `TRACKED_PREFIXES` skips claims this gate *cannot* check. This is the narrower
  * third case: a claim it must not check, because "does not exist" is the correct
@@ -78,14 +78,43 @@ const TRACKED_EXACT = new Set(['bin/install.js', 'package.json']);
  * shipping an empty stub. So the file is absent on a healthy `next` and present
  * only inside a PR that needs it, and asserting either way is wrong.
  *
- * Until #2778 this passed only by accident: CONTEXT.md's `RULESET.` entries are
- * themselves backtick-wrapped and contain backticks, so the sequential pairing in
- * `extractTrackedRefs` happened to leave this token outside a code span. Any edit
- * that shifted the parity — such as #2778's own — exposed it. A gate that passes
- * by luck is not passing; naming the exemption makes the intent explicit and
- * survives the next edit.
+ * The emitted-attribution family (`tests/fixtures/golden-install-parity`,
+ * `tests/golden-install-parity.test.cjs`, `scripts/gen-golden-install-parity-zcode.cjs`,
+ * `tests/agent-size-baseline.json`, `tests/workflow-size-baseline.json`,
+ * `scripts/git-merge-regen-driver.cjs`, `scripts/update-size-baseline.cjs`) was RETIRED
+ * by the #2724 cutover — the differential attribution check replaced the committed
+ * baselines and their generator/bridge tooling. CONTEXT.md's RULESET.EMITTED_ATTRIBUTION
+ * predicate documents that retirement ("Historically …"), so the mentions are history,
+ * not live claims, and their absence is exactly the healthy state the retirement
+ * produced. The whole documented family is listed, not just the members today's tick
+ * parity happens to hide — the two tooling paths were invisible only because of where
+ * line 585's inner backticks sat, which is the #2778 luck this gate must not rely on.
+ *
+ * `scripts/eslint-rules` appears only inside a CONTRASTIVE mention ("the local
+ * plugin lives at `eslint-rules/` (repo root, NOT `scripts/eslint-rules/`)") — the
+ * predicate asserts where the directory is NOT, so non-existence is the claim
+ * being made, not drift away from one.
+ *
+ * Until #2778 this set's first entry passed only by accident: CONTEXT.md's
+ * `RULESET.` entries are themselves backtick-wrapped and contain backticks, so the
+ * sequential pairing in `extractTrackedRefs` happened to leave this token outside a
+ * code span. Any edit that shifted the parity — such as #2778's own — exposed it.
+ * A gate that passes by luck is not passing; naming the exemption makes the intent
+ * explicit and survives the next edit. #3604 removed the luck itself (pairing is
+ * per line), which is what surfaced the entries above: each names a path whose
+ * absence is deliberate, so each is exempted by name for the same reason.
  */
-const INTENTIONALLY_ABSENT = new Set(['tests/emitted-drift-ack.json']);
+const INTENTIONALLY_ABSENT = new Set([
+  'tests/emitted-drift-ack.json',
+  'tests/fixtures/golden-install-parity',
+  'tests/golden-install-parity.test.cjs',
+  'scripts/gen-golden-install-parity-zcode.cjs',
+  'tests/agent-size-baseline.json',
+  'tests/workflow-size-baseline.json',
+  'scripts/git-merge-regen-driver.cjs',
+  'scripts/update-size-baseline.cjs',
+  'scripts/eslint-rules',
+]);
 
 /**
  * Shape a backticked token must have to even be considered a path candidate:
@@ -119,18 +148,51 @@ function isWithinRoot(token) {
 /**
  * Every distinct, trackable file-path token referenced in `text`, with any
  * trailing `:<line>` suffix stripped.
+ *
+ * #3604: pairing is per LINE, not over the whole text. A single whole-text pass
+ * `[^`]+` crosses newlines, so one odd-backtick line (the `RULESET.*` predicate
+ * format is backtick-wrapped and its values sometimes contain backticks) shifted
+ * the pairing of every later line — a tracked token's visibility depended on
+ * where it sat, which is how a renamed test file stayed invisible for weeks.
+ *
+ * The fact-store predicate lines (one `CLASS.subkey=value` fact per line,
+ * backtick-wrapped as a whole) carry REAL paths in their values; the span itself
+ * is not path-shaped (spaces, `=`), so a second pass harvests path-shaped tracked
+ * tokens from inside any predicate-shaped span rather than letting the outer
+ * wrapper hide them.
+ *
+ * Fragment guards: a real path in this repo never ends in `-` or `.` — those are
+ * remnants of glob/template mentions (`scripts/gen-*.cjs`, `tests/foo.*.test.cjs`)
+ * split at the `*` — and `NNNN` is the ADR filename template token
+ * (CONTRIBUTING's "Do not compute a next number locally"), never a real path.
  */
 function extractTrackedRefs(text) {
   const tokens = new Set();
-  const re = /`([^`]+)`/g;
-  let m;
-  while ((m = re.exec(text)) !== null) {
-    const raw = m[1];
-    if (!PATH_TOKEN_RE.test(raw)) continue;
+  const add = (raw) => {
+    if (!PATH_TOKEN_RE.test(raw)) return;
     const token = raw.replace(/:\d+$/, '');
-    if (!isTracked(token)) continue;
-    if (!isWithinRoot(token)) continue;
+    // Fragment guard, on the EMITTED token (after the :line strip, so
+    // `src/foo-:12` is judged on `src/foo-`): glob/template remnants end in `-`
+    // or `.`, a real path in this repo never does.
+    if (!/[A-Za-z0-9_]$/.test(token)) return;
+    if (token.includes('NNNN')) return;
+    if (!isTracked(token)) return;
+    if (!isWithinRoot(token)) return;
     tokens.add(token);
+  };
+  const subTokenRe = /[\w.-]+(?:\/[\w.-]+)*/g;
+  for (const line of text.split(/\r?\n/)) {
+    const re = /`([^`]+)`/g;
+    let m;
+    while ((m = re.exec(line)) !== null) {
+      const span = m[1];
+      if (PATH_TOKEN_RE.test(span)) {
+        add(span);
+        continue;
+      }
+      if (!/^[A-Z][A-Za-z0-9_.-]*=/.test(span)) continue;
+      for (const sub of span.matchAll(subTokenRe)) add(sub[0]);
+    }
   }
   return tokens;
 }