@opengsd/gsd-core 1.11.0 → 1.13.0

package/gsd-core/bin/lib/check-command-router.cjs

@@ -31,7 +31,7 @@ const ui_safety_gate_cjs_1 = require("./ui-safety-gate.cjs");
 const ui_frontend_evidence_cjs_1 = require("./ui-frontend-evidence.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const verifyModule = require("./verify.cjs");
-const { cmdVerifySchemaDrift, cmdVerifyCodebaseDrift } = verifyModule;
+const { cmdVerifySchemaDrift, cmdVerifyCodebaseDrift, cmdVerifyContextDrift } = verifyModule;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const roadmapModule = require("./roadmap.cjs");
 const { getRoadmapPhaseWithFallback } = roadmapModule;
@@ -39,6 +39,7 @@ const { getRoadmapPhaseWithFallback } = roadmapModule;
 const gapCheckerModule = require("./gap-checker.cjs");
 const { runGapAnalysis } = gapCheckerModule;
 const prohibition_enforcement_cjs_1 = require("./prohibition-enforcement.cjs");
+const tdd_red_evidence_cjs_1 = require("./tdd-red-evidence.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const gatePredicateEval = require("./gate-predicate-evaluator.cjs");
 const { evaluatePredicate } = gatePredicateEval;
@@ -52,6 +53,9 @@ const { scanPhasePlans } = planScanMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningScopeMod = require("./planning-scope.cjs");
 const { SCOPE } = planningScopeMod;
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const verifyCommandGroundingMod = require("./verify-command-grounding.cjs");
+const { probePhaseVerifyCommands, probePhaseFailingDirections } = verifyCommandGroundingMod;
 // ─── Helpers ──────────────────────────────────────────────────────────────────
 function normalizePhrase(text) {
     // eslint-disable-next-line @typescript-eslint/no-base-to-string
@@ -783,14 +787,11 @@ function cmdTddReviewCheckpoint(projectDir, args, raw) {
     }
     const violations = rows.filter(r => r.status === 'FAIL').length;
     // Build review table
-    const sep = '━'.repeat(53);
     const tableHeader = '| Plan | RED | GREEN | REFACTOR | Status |';
     const tableDivider = '|------|-----|-------|----------|--------|';
     const tableRows = rows.map(r => `| ${r.planId.padEnd(4)} | ${r.red ? ' ✓ ' : ' ✗ '} | ${r.green ? '  ✓  ' : '  ✗  '} | ${r.refactor ? '   ✓    ' : '   —    '} | ${r.status.padEnd(6)} |`);
     let table = [
-        sep,
-        ` TDD REVIEW — Phase ${phase}`,
-        sep,
+        `### TDD REVIEW — Phase ${phase}`,
         '',
         `TDD Plans: ${tddPlanFiles.length} | Gate violations: ${violations}`,
         '',
@@ -825,6 +826,179 @@ function cmdTddReviewCheckpoint(projectDir, args, raw) {
     // the host-loop dispatch's advisory branch can surface it.
     output(result, raw, undefined);
 }
+// ─── tdd-red-evidence (#3770) ──────────────────────────────────────────────────
+/**
+ * tdd-red-evidence: validates a persisted RED-phase test-run record for a
+ * `type: tdd` plan (#3770). Only an INTENTIONAL failure of the target test
+ * (verdict RED_EVIDENCE_OK) may authorize GREEN; zero-test discovery, fixture/
+ * load crashes, nonzero exits without a failing test, unrelated failures, and
+ * unexpected greens are INVALID_RED and block GREEN.
+ *
+ * The record is the JSON the executor persists after running the RED command:
+ *   { command, exitCode, output, targetTest, targetFile?, expected?, actual? }
+ * Fail-closed: a missing/unreadable/unparseable record is INVALID_RED
+ * (reason unreadable_record), never a pass.
+ *
+ * Args: check tdd-red-evidence <record.json>
+ */
+function cmdTddRedEvidence(_projectDir, args, raw) {
+    const recordPath = typeof args[2] === 'string' ? args[2] : '';
+    if (!recordPath) {
+        error('tdd-red-evidence requires a record path: check tdd-red-evidence <record.json>', ERROR_REASON.SDK_MISSING_ARG);
+        return;
+    }
+    const resolved = node_path_1.default.resolve(recordPath);
+    const text = readIfExists(resolved);
+    const input = (() => {
+        if (!text)
+            return null;
+        try {
+            return (JSON.parse(text) ?? {});
+        }
+        catch {
+            return null;
+        }
+    })();
+    if (!input) {
+        output({
+            passed: false,
+            block: true,
+            verdict: 'INVALID_RED',
+            reason: 'unreadable_record',
+            record: resolved,
+            readError: text ? `record is not valid JSON: ${resolved}` : `record not found or unreadable: ${resolved}`,
+        }, raw, undefined);
+        return;
+    }
+    const evidenceInput = {
+        command: input['command'],
+        exitCode: input['exitCode'],
+        output: input['output'],
+        targetTest: input['targetTest'],
+        targetFile: input['targetFile'],
+        expected: input['expected'],
+        actual: input['actual'],
+    };
+    const result = (0, tdd_red_evidence_cjs_1.classifyRedEvidence)(evidenceInput);
+    const record = (0, tdd_red_evidence_cjs_1.buildRedEvidenceRecord)(evidenceInput, result);
+    output({
+        // Uniform gate contract: block = !passed. INVALID_RED blocks GREEN.
+        passed: result.verdict === 'RED_EVIDENCE_OK',
+        block: result.verdict !== 'RED_EVIDENCE_OK',
+        verdict: result.verdict,
+        reason: result.reason,
+        evidence: result.evidence,
+        record,
+        message: result.verdict === 'RED_EVIDENCE_OK'
+            ? `RED evidence verified: target test "${result.evidence.target_test}" failed as expected (exit ${result.evidence.exit_code}). GREEN authorized.`
+            : `INVALID_RED (${result.reason}): GREEN blocked. Fix the RED phase — only an intentional failure of target test "${result.evidence.target_test}" authorizes production edits.`,
+    }, raw, undefined);
+}
+/**
+ * Resolve a phase argument to an absolute phase directory, or '' when it
+ * cannot be resolved. Shared by every `check` arm that probes a phase's
+ * PLAN.md files, so the two never drift (DEFECT.GENERATIVE-FIX-DIVERGENCE).
+ * Never throws — the callers emit a degraded JSON payload instead, because
+ * a consumer must be able to tell "nothing to report" from "could not look".
+ */
+function resolvePhaseDirOrEmpty(projectDir, phase) {
+    try {
+        const result = findPhaseInternal(projectDir, phase);
+        if (result && typeof result === 'object') {
+            // findPhaseInternal returns { directory: '<relative-posix-path>', ... }
+            // directory is relative to cwd — resolve it to absolute.
+            const relDir = typeof result['directory'] === 'string' ? result['directory'] : '';
+            if (relDir) {
+                return node_path_1.default.resolve(projectDir, relDir);
+            }
+        }
+        else if (typeof result === 'string') {
+            return result;
+        }
+    }
+    catch { /* phase dir lookup failure → caller emits degraded payload */ }
+    return '';
+}
+// ─── verify-command-paths (#2401) ──────────────────────────────────────────────
+/**
+ * verify-command-paths: probes every `<automated>` verify command declared in a
+ * phase's `-PLAN.md` files against the filesystem WITHOUT executing anything —
+ * see verify-command-grounding.cjs for the recognizer contract.
+ *
+ * Args: check verify-command-paths <phase>
+ * Invocable as: gsd_run check verify-command-paths <phase>
+ *
+ * When the phase cannot be resolved to a directory, this emits a non-throwing
+ * degraded JSON payload (status/commands/counts all zeroed, `readError`
+ * populated) rather than calling `error()` — the plan-checker parses this
+ * result and must be able to distinguish "nothing to report" from "could not
+ * look", which a non-zero exit / thrown error would collapse.
+ */
+function cmdVerifyCommandPaths(projectDir, args, raw) {
+    // args[0] = 'check', args[1] = 'verify-command-paths', args[2] = phase
+    const phase = args[2] || '';
+    if (!phase) {
+        output({
+            status: 'unresolvable',
+            commands: [],
+            counts: { blocker: 0, warning: 0, total: 0 },
+            readError: 'verify-command-paths requires a phase argument: check verify-command-paths <phase>',
+        }, raw, undefined);
+        return;
+    }
+    const phaseDir = resolvePhaseDirOrEmpty(projectDir, phase);
+    if (!phaseDir) {
+        output({
+            status: 'unresolvable',
+            commands: [],
+            counts: { blocker: 0, warning: 0, total: 0 },
+            readError: `could not resolve phase directory for phase ${phase}`,
+        }, raw, undefined);
+        return;
+    }
+    const probed = probePhaseVerifyCommands({ phaseDir, projectRoot: projectDir });
+    output(probed, raw, undefined);
+}
+// ─── verify-failure-directions (#3172) ─────────────────────────────────────────
+/**
+ * verify-failure-directions: probes every `<automated>` verify command
+ * declared in a phase's `-PLAN.md` files for a stated `<fails_when>` failing
+ * direction — see verify-command-grounding.cjs for the recognizer contract.
+ *
+ * Args: check verify-failure-directions <phase>
+ * Invocable as: gsd_run check verify-failure-directions <phase>
+ *
+ * When the phase cannot be resolved to a directory, this emits a non-throwing
+ * degraded JSON payload (status/commands/counts all zeroed, `readError`
+ * populated) rather than calling `error()` — the plan-checker parses this
+ * result and must be able to distinguish "nothing to report" from "could not
+ * look", which a non-zero exit / thrown error would collapse.
+ */
+function cmdVerifyFailureDirections(projectDir, args, raw) {
+    // args[0] = 'check', args[1] = 'verify-failure-directions', args[2] = phase
+    const phase = args[2] || '';
+    if (!phase) {
+        output({
+            status: 'unresolvable',
+            commands: [],
+            counts: { blocker: 0, warning: 0, total: 0 },
+            readError: 'verify-failure-directions requires a phase argument: check verify-failure-directions <phase>',
+        }, raw, undefined);
+        return;
+    }
+    const phaseDir = resolvePhaseDirOrEmpty(projectDir, phase);
+    if (!phaseDir) {
+        output({
+            status: 'unresolvable',
+            commands: [],
+            counts: { blocker: 0, warning: 0, total: 0 },
+            readError: `could not resolve phase directory for phase ${phase}`,
+        }, raw, undefined);
+        return;
+    }
+    const result = probePhaseFailingDirections({ phaseDir });
+    output(result, raw, undefined);
+}
 // ─── gap-analysis-plan-post ───────────────────────────────────────────────────
 /**
  * gap-analysis-plan-post: non-blocking advisory check that runs the post-planning
@@ -1203,6 +1377,27 @@ function cmdApiCoverageVerifyPre(projectDir, args, raw) {
         }, raw, undefined);
         return;
     }
+    // An EMPTY scope is not a negative verdict. This gate's neighbouring arms
+    // already fail closed (unresolvable phase → block; unreadable plan → block),
+    // but a phase with no plan body AND no roadmap section fell through to
+    // detection over zero bytes and CERTIFIED "no external-API integration" —
+    // clearing a blocking seal gate on a probe that examined nothing
+    // (ADR-3889 failure class (c), #3909). The discriminator is BYTES EXAMINED,
+    // never SIGNALS FOUND: a phase with real plans and no API vocabulary still
+    // reaches the pass below unchanged.
+    if (scope.text.trim() === '') {
+        output({
+            block: true,
+            passed: false,
+            coverage_present: false,
+            detected: false,
+            scope_unavailable: true,
+            message: 'api-coverage: the phase scope is empty — no plan body and no roadmap section were ' +
+                'found, so nothing was examined. Refusing to certify no external-API integration ' +
+                'from an unestablished scope. Add the phase plan, or add a COVERAGE.md declaration.',
+        }, raw, undefined);
+        return;
+    }
     const detection = detectApiIntegration(scope.text);
     if (detection.detected) {
         // Surface only verb/noun (typed, bounded) — NOT raw prose snippets — so the
@@ -1324,6 +1519,18 @@ function routeCheckCommand({ args, cwd, raw }) {
         cmdGapAnalysisPlanPost(cwd, args, raw);
         return;
     }
+    if (subcommand === 'verify-command-paths') {
+        // Deterministic filesystem probe for <automated> verify commands (#2401) —
+        // never executes anything; see verify-command-grounding.cjs.
+        cmdVerifyCommandPaths(cwd, args, raw);
+        return;
+    }
+    if (subcommand === 'verify-failure-directions') {
+        // Presence probe for a stated <fails_when> per <automated> command
+        // (#3172) — never executes anything; see verify-command-grounding.cjs.
+        cmdVerifyFailureDirections(cwd, args, raw);
+        return;
+    }
     if (subcommand === 'api-coverage-verify-pre') {
         // ai-integration capability blocking gate at verify:pre (#1562). Dot-to-
         // hyphen normalization means query "api-coverage.verify-pre" routes here.
@@ -1334,6 +1541,12 @@ function routeCheckCommand({ args, cwd, raw }) {
         cmdTddReviewCheckpoint(cwd, args, raw);
         return;
     }
+    if (subcommand === 'tdd-red-evidence') {
+        // #3770: intentional-RED evidence gate — only a target-test failure may
+        // authorize GREEN. Validates the persisted record; never executes anything.
+        cmdTddRedEvidence(cwd, args, raw);
+        return;
+    }
     if (subcommand === 'ui-safety-gate') {
         cmdUiSafetyGate(cwd, args, raw);
         return;
@@ -1353,6 +1566,13 @@ function routeCheckCommand({ args, cwd, raw }) {
         cmdVerifyCodebaseDrift(cwd, raw);
         return;
     }
+    if (subcommand === 'verify-context-drift') {
+        // Delegates to verify.context-drift — drift capability gate at plan:pre (non-blocking).
+        // Dot-to-hyphen normalization means query "verify.context-drift" routes here.
+        const phaseArg = typeof args[2] === 'string' ? args[2] : '';
+        cmdVerifyContextDrift(cwd, phaseArg, raw);
+        return;
+    }
     if (subcommand === 'predicate') {
         // Generic gate-predicate evaluator (#2008). The workflow gate-dispatch calls
         // this for any gate whose `check` carries a `predicate` (instead of a `query`),
@@ -1370,7 +1590,7 @@ function routeCheckCommand({ args, cwd, raw }) {
         (0, prohibition_enforcement_cjs_1.routeProhibitionEnforcement)(args, raw);
         return;
     }
-    error('Unknown check subcommand. Available: api-coverage-verify-pre, auto-mode, decision-coverage-plan, decision-coverage-verify, gap-analysis-plan-post, predicate, prohibition-enforcement, tdd-review-checkpoint, ui-plan-gate, ui-safety-gate, verify-schema-drift, verify-codebase-drift', ERROR_REASON.SDK_UNKNOWN_COMMAND);
+    error('Unknown check subcommand. Available: api-coverage-verify-pre, auto-mode, decision-coverage-plan, decision-coverage-verify, gap-analysis-plan-post, predicate, prohibition-enforcement, tdd-red-evidence, tdd-review-checkpoint, ui-plan-gate, ui-safety-gate, verify-command-paths, verify-failure-directions, verify-schema-drift, verify-codebase-drift, verify-context-drift', ERROR_REASON.SDK_UNKNOWN_COMMAND);
 }
 module.exports = {
     routeCheckCommand,
@@ -1379,7 +1599,10 @@ module.exports = {
     computeUiPlanGate,
     computeUiSafetyGate,
     cmdGapAnalysisPlanPost,
+    cmdVerifyCommandPaths,
+    cmdVerifyFailureDirections,
     cmdTddReviewCheckpoint,
+    cmdTddRedEvidence,
     cmdCheckPredicate,
     buildPredicateDeps,
     parsePredicateFlags,

package/gsd-core/bin/lib/claude-orchestration.cjs

@@ -43,6 +43,9 @@
  *
  * Zero external dependencies. Pure functions. Never throws on bad input.
  */
+// eslint-disable-next-line @typescript-eslint/no-require-imports -- file-overlap-partitioner.cjs is an export= CommonJS module
+const fileOverlapPartitionerMod = require("./file-overlap-partitioner.cjs");
+const { partitionByFileOverlap } = fileOverlapPartitionerMod;
 // ─── Constants ────────────────────────────────────────────────────────────────
 /**
  * The Agent SDK version that introduced the Workflow tool (#1143 prior art).
@@ -226,33 +229,15 @@ function detectWorkflowBackend(input) {
  *
  * This is the same overlap rule execute-phase applies inline — the only difference
  * is the execution vehicle (Workflow `parallel()` vs one-agent-per-message).
+ *
+ * #3674: the algorithm itself now lives in the generic, dependency-free
+ * `file-overlap-partitioner.cts` module (`partitionByFileOverlap`) — this is a
+ * thin adapter mapping this module's own `Plan[]` shape onto that module's
+ * generic `{ id, files }[]` input and back. Behavior-preserving extraction:
+ * same greedy first-fit algorithm, same output, only the implementation moved.
  */
 function partitionStages(plans) {
-    const stages = [];
-    for (const plan of plans) {
-        const fileSet = new Set(plan.files_modified);
-        let placed = false;
-        for (const stage of stages) {
-            let overlap = false;
-            for (const f of fileSet) {
-                if (stage.files.has(f)) {
-                    overlap = true;
-                    break;
-                }
-            }
-            if (!overlap) {
-                stage.plans.push(plan);
-                for (const f of fileSet)
-                    stage.files.add(f);
-                placed = true;
-                break;
-            }
-        }
-        if (!placed) {
-            stages.push({ plans: [plan], files: new Set(fileSet) });
-        }
-    }
-    return stages.map((s) => s.plans.map((p) => p.id));
+    return partitionByFileOverlap(plans.map((p) => ({ id: p.id, files: p.files_modified })));
 }
 /**
  * Quote a free-text value for safe embedding as a JavaScript/Workflow double-quoted