@opengsd/gsd-core 1.12.0 → 1.13.0

package/gsd-core/bin/lib/capability-state.cjs

@@ -39,7 +39,7 @@ const ioMod = require("./io.cjs");
 const { output: coreOutput, error: coreError } = ioMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const activationMod = require("./capability-activation.cjs");
-const { _resolveActivationValue } = activationMod;
+const { _resolveActivationValue, _resolvePointGate } = activationMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const configLoaderMod = require("./config-loader.cjs");
 const { loadConfig } = configLoaderMod;
@@ -179,6 +179,12 @@ function resolveCapabilityState(input) {
                     // (mirrors loop-resolver.isActive: `typeof when !== 'string' || when.length === 0` → false)
                     configured = false;
                 }
+                // #3661: optional point-selection gate, ANDed in — mirrors loop-resolver.isActive
+                // EXACTLY (see capability-activation.cts's _resolvePointGate doc comment; this
+                // parity is load-bearing, see tests/capability-precedence-parity.test.cjs).
+                if (configured) {
+                    configured = _resolvePointGate(h['pointFrom'], point, config, cwd, registry);
+                }
                 // Hook active = capability-level active AND hook's own config gate.
                 // The capability's `active` constant (= enabled && configActivation) is
                 // used here so that a config-disabled capability (active=false) cannot

package/gsd-core/bin/lib/capability-validator.cjs

@@ -1643,6 +1643,28 @@ function validateRuntimeBody(cap) {
           ' (or "undocumented") (got: ' + JSON.stringify(d.isolation) + ')',
         );
       }
+
+      // maxConcurrency — ADR-1239 Phase 1 (#3673). A numeric dispatch
+      // sub-field (not a closed-vocabulary enum member — same numeric
+      // dispatch sub-field treatment as maxDepth above; unlike maxDepth,
+      // 0 and negative values are invalid — 1 is the fail-closed floor, not
+      // a legitimate "no concurrency" declaration).
+      // OPTIONAL, like isolation: added after existing descriptors, so an
+      // omitted maxConcurrency is legitimate — negotiateHostCapabilities
+      // degrades it to 1 (the safe floor) and warns, exactly as for any
+      // other undeclared dispatch sub-field. Only a PRESENT value is
+      // checked against the positive-safe-integer contract.
+      if (d.maxConcurrency === undefined) {
+        // absent — nothing to validate; negotiateHostCapabilities fails it closed.
+      } else if (
+        d.maxConcurrency !== 'undocumented' &&
+        (!Number.isSafeInteger(d.maxConcurrency) || d.maxConcurrency < 1)
+      ) {
+        errors.push(
+          'runtime.hostIntegration.dispatch.maxConcurrency must be a positive safe integer or "undocumented" ' +
+          '(got: ' + JSON.stringify(d.maxConcurrency) + ')',
+        );
+      }
     }
   }
 
@@ -1824,9 +1846,29 @@ const KNOWN_REVIEWER_FIELDS = new Set([
   // missed a configured model and silently disabled the pinned-model escape hatch
   // #2073 added. A convention one shipped lane already violates is not a contract.
   'modelConfigKey',
+  // `timeoutConfigKey` added by #3274, same optional/backward-compatible shape as
+  // `modelConfigKey` above: a manifest authored before this field existed must keep validating.
+  'timeoutConfigKey',
+  // `effortConfigKey` / `defaultEffort` added by #4255, same optional/backward-compatible shape
+  // as the two above. Lane effort used to be resolved by querying the `gsd-plan-checker` AGENT
+  // through a hardcoded id, so every prompt-fed lane ran at that verifier's frontmatter effort;
+  // it is a property of the review, so the lane declares it. A manifest authored before these
+  // fields existed must keep validating — absent is read as "this lane declares no review
+  // effort", which emits no effort argument at all.
+  'effortConfigKey',
+  'defaultEffort',
   'handler',
 ]);
 
+/**
+ * The effort levels a lane may declare as its review default (#4255, #3533 vocabulary).
+ *
+ * `inherit` is deliberately NOT a member. It is a legitimate CONFIGURED value — it selects "emit
+ * no argument, the CLI's own configuration decides" — but as a DECLARED default it would be a
+ * second spelling of `null` and split one behaviour across two shapes.
+ */
+const REVIEWER_EFFORT_LEVELS = new Set(['minimal', 'low', 'medium', 'high', 'xhigh', 'max']);
+
 /**
  * The closed `runtime.hostBehaviors` vocabulary (ADR-1016, closed via #2801).
  *
@@ -2371,6 +2413,50 @@ function validateReviewerBodyFields(cap) {
     );
   }
 
+  // OPTIONAL, mirroring modelConfigKey's D4 forward/backward-compat treatment (#3274): a manifest
+  // authored before this field existed must keep validating. Absent/null means "no override for
+  // this lane, use timeoutFloorMs". An empty string is neither absent nor a key, and is rejected.
+  if (r.timeoutConfigKey !== undefined && r.timeoutConfigKey !== null &&
+      (typeof r.timeoutConfigKey !== 'string' || r.timeoutConfigKey.length === 0)) {
+    errors.push(
+      ctx + ' reviewer.timeoutConfigKey must be a dotted config key or null ' +
+      '(got: ' + describeValue(r.timeoutConfigKey) + ')',
+    );
+  }
+
+  // OPTIONAL, mirroring the two keys above (#4255). Absent/null means "this lane declares no
+  // review effort", which is the shape that emits no effort argument at all — the correct state
+  // for the nine lanes with no effort channel to feed. An empty string is neither.
+  if (r.effortConfigKey !== undefined && r.effortConfigKey !== null &&
+      (typeof r.effortConfigKey !== 'string' || r.effortConfigKey.length === 0)) {
+    errors.push(
+      ctx + ' reviewer.effortConfigKey must be a dotted config key or null ' +
+      '(got: ' + describeValue(r.effortConfigKey) + ')',
+    );
+  }
+
+  // A declared default must be a level the effort axis knows, or the lane would render an
+  // argument the reviewer CLI rejects and kill itself on every run. Closed vocabulary, checked
+  // here rather than at resolution time so a malformed manifest fails at the trust boundary.
+  if (r.defaultEffort !== undefined && r.defaultEffort !== null
+      && !(typeof r.defaultEffort === 'string' && REVIEWER_EFFORT_LEVELS.has(r.defaultEffort))) {
+    errors.push(
+      ctx + ' reviewer.defaultEffort must be one of ' +
+      Array.from(REVIEWER_EFFORT_LEVELS).join('/') + ' or null ' +
+      '(got: ' + describeValue(r.defaultEffort) + ')',
+    );
+  }
+
+  // A default with nothing to configure it through is a value the operator cannot change — the
+  // shape #4255 exists to end. Declared together or not at all.
+  if ((r.defaultEffort !== undefined && r.defaultEffort !== null)
+      && (r.effortConfigKey === undefined || r.effortConfigKey === null)) {
+    errors.push(
+      ctx + ' reviewer.defaultEffort is declared without an effortConfigKey, so the level ' +
+      'could never be overridden',
+    );
+  }
+
   // `null` is the declared "no per-lane budget"; an empty string is not.
   if (r.promptBudgetKey !== null && (typeof r.promptBudgetKey !== 'string' || r.promptBudgetKey.length === 0)) {
     errors.push(
@@ -2858,6 +2944,10 @@ function validateStep(step, prefix, declaredSkills, declaredAgents) {
     errors.push(prefix + '.when must be a string if present');
   }
 
+  if (step.pointFrom !== undefined && typeof step.pointFrom !== 'string') {
+    errors.push(prefix + '.pointFrom must be a string if present');
+  }
+
   if (step.fragment !== undefined) {
     errors.push(...validateFragment(step.fragment, prefix + '.fragment'));
   }
@@ -2997,6 +3087,31 @@ function validateAgainstContract(cap, capId) {
     }
   }
 
+  // pointFrom (#3661): selects which of possibly several same-capability steps is
+  // active for its own `point`, based on an enum config key. Require it references
+  // an enum key in cap.config whose values include THIS step's own point — otherwise
+  // the step could never activate (a silently-dead step).
+  for (const step of cap.steps) {
+    if (step.pointFrom !== undefined) {
+      if (typeof step.pointFrom !== 'string') continue; // already reported above
+      const slice = typeof cap.config === 'object' && cap.config !== null ? cap.config[step.pointFrom] : undefined;
+      if (!slice || typeof slice !== 'object') {
+        errors.push(
+          prefix + ' step.pointFrom "' + step.pointFrom + '" is not defined in capability config keys',
+        );
+      } else if (slice.type !== 'enum') {
+        errors.push(
+          prefix + ' step.pointFrom "' + step.pointFrom + '" must reference an enum config key (got type: ' + slice.type + ')',
+        );
+      } else if (!Array.isArray(slice.values) || !slice.values.includes(step.point)) {
+        errors.push(
+          prefix + ' step.pointFrom "' + step.pointFrom + '" enum values do not include this step\'s own point "' +
+          step.point + '" — the step could never activate',
+        );
+      }
+    }
+  }
+
   for (const contrib of cap.contributions) {
     if (contrib.when !== undefined) {
       if (typeof contrib.when !== 'string') continue;
@@ -3605,11 +3720,12 @@ const HOOK_GROUP_KINDS = Object.freeze({
  * double-report.
  *
  * KNOWN LIMITATION (#3606): coverage is the UNION across all call sites for a
- * point in the five STEP_WORKFLOWS host files. Consumers outside that universe
- * (quick.md, autonomous.md, code-review*.md, audit-milestone.md,
+ * point in HOST_LOOP_FILES. Quick's plan:pre planner contribution seam has an
+ * additional generator-owned per-file check. Other consumers outside that
+ * universe (autonomous.md, code-review*.md, audit-milestone.md,
  * secure-phase.md, validate-phase.md) are not per-file checked — a narrowed
- * consumer there passes as long as one host file covers the point. Per-file
- * coverage maps are the tightening path.
+ * consumer there passes as long as one host file covers the point. More
+ * per-file coverage maps are the tightening path.
  *
  * @param {object}   cap       Validated capability object.
  * @param {Map<string, Set<string>>} wiredKinds  Per point, the hook kinds the

package/gsd-core/bin/lib/capability-writer.cjs

@@ -184,6 +184,7 @@ function setCapabilityState(cwd, runtimeConfigDir, desired, opts) {
         };
     }
     // ── Step 4: APPLY PASS ────────────────────────────────────────────────────
+    let pendingSurfaceForCommit;
     // ── Surface writes ────────────────────────────────────────────────────────
     if (needsSurface && (idsToDisable.length > 0 || idsToEnable.length > 0)) {
         const existing = readSurface(resolvedConfigDir);
@@ -242,13 +243,19 @@ function setCapabilityState(cwd, runtimeConfigDir, desired, opts) {
             }
         }
         if (surfaceChanged) {
-            writeSurface(resolvedConfigDir, pendingSurface);
+            pendingSurfaceForCommit = pendingSurface;
         }
     }
     // ── Config writes (once, batched) ─────────────────────────────────────────
     if (pendingGateWrites.length > 0) {
         setConfigValues(cwd, pendingGateWrites);
     }
+    // State-only callers preserve the existing direct-write behavior. A caller
+    // that requests materialization lets applySurface publish the candidate only
+    // after every artifact kind has staged and synchronized successfully.
+    if (pendingSurfaceForCommit && !opts?.materialize) {
+        writeSurface(resolvedConfigDir, pendingSurfaceForCommit);
+    }
     // ── Materialize (optional) ────────────────────────────────────────────────
     if (opts?.materialize) {
         const { runtime, scope } = opts.materialize;
@@ -274,9 +281,12 @@ function setCapabilityState(cwd, runtimeConfigDir, desired, opts) {
             // folded:issue-1575-agent-descriptor-parity describe block in
             // tests/golden-parity-single-source.test.cjs).
             // eslint-disable-next-line @typescript-eslint/no-unsafe-argument
-            applySurface(resolvedConfigDir, layout, manifest, undefined, registry, opts?.materialize?.resolveAttribution
-                ? { resolveAttribution: opts.materialize.resolveAttribution }
-                : undefined);
+            applySurface(resolvedConfigDir, layout, manifest, undefined, registry, {
+                ...(pendingSurfaceForCommit ? { surfaceState: pendingSurfaceForCommit } : {}),
+                ...(opts.materialize.resolveAttribution
+                    ? { resolveAttribution: opts.materialize.resolveAttribution }
+                    : {}),
+            });
         }
         catch (err) {
             const msg = err instanceof Error ? err.message : String(err);

package/gsd-core/bin/lib/check-command-router.cjs

@@ -31,7 +31,7 @@ const ui_safety_gate_cjs_1 = require("./ui-safety-gate.cjs");
 const ui_frontend_evidence_cjs_1 = require("./ui-frontend-evidence.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const verifyModule = require("./verify.cjs");
-const { cmdVerifySchemaDrift, cmdVerifyCodebaseDrift } = verifyModule;
+const { cmdVerifySchemaDrift, cmdVerifyCodebaseDrift, cmdVerifyContextDrift } = verifyModule;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const roadmapModule = require("./roadmap.cjs");
 const { getRoadmapPhaseWithFallback } = roadmapModule;
@@ -39,6 +39,7 @@ const { getRoadmapPhaseWithFallback } = roadmapModule;
 const gapCheckerModule = require("./gap-checker.cjs");
 const { runGapAnalysis } = gapCheckerModule;
 const prohibition_enforcement_cjs_1 = require("./prohibition-enforcement.cjs");
+const tdd_red_evidence_cjs_1 = require("./tdd-red-evidence.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const gatePredicateEval = require("./gate-predicate-evaluator.cjs");
 const { evaluatePredicate } = gatePredicateEval;
@@ -825,6 +826,74 @@ function cmdTddReviewCheckpoint(projectDir, args, raw) {
     // the host-loop dispatch's advisory branch can surface it.
     output(result, raw, undefined);
 }
+// ─── tdd-red-evidence (#3770) ──────────────────────────────────────────────────
+/**
+ * tdd-red-evidence: validates a persisted RED-phase test-run record for a
+ * `type: tdd` plan (#3770). Only an INTENTIONAL failure of the target test
+ * (verdict RED_EVIDENCE_OK) may authorize GREEN; zero-test discovery, fixture/
+ * load crashes, nonzero exits without a failing test, unrelated failures, and
+ * unexpected greens are INVALID_RED and block GREEN.
+ *
+ * The record is the JSON the executor persists after running the RED command:
+ *   { command, exitCode, output, targetTest, targetFile?, expected?, actual? }
+ * Fail-closed: a missing/unreadable/unparseable record is INVALID_RED
+ * (reason unreadable_record), never a pass.
+ *
+ * Args: check tdd-red-evidence <record.json>
+ */
+function cmdTddRedEvidence(_projectDir, args, raw) {
+    const recordPath = typeof args[2] === 'string' ? args[2] : '';
+    if (!recordPath) {
+        error('tdd-red-evidence requires a record path: check tdd-red-evidence <record.json>', ERROR_REASON.SDK_MISSING_ARG);
+        return;
+    }
+    const resolved = node_path_1.default.resolve(recordPath);
+    const text = readIfExists(resolved);
+    const input = (() => {
+        if (!text)
+            return null;
+        try {
+            return (JSON.parse(text) ?? {});
+        }
+        catch {
+            return null;
+        }
+    })();
+    if (!input) {
+        output({
+            passed: false,
+            block: true,
+            verdict: 'INVALID_RED',
+            reason: 'unreadable_record',
+            record: resolved,
+            readError: text ? `record is not valid JSON: ${resolved}` : `record not found or unreadable: ${resolved}`,
+        }, raw, undefined);
+        return;
+    }
+    const evidenceInput = {
+        command: input['command'],
+        exitCode: input['exitCode'],
+        output: input['output'],
+        targetTest: input['targetTest'],
+        targetFile: input['targetFile'],
+        expected: input['expected'],
+        actual: input['actual'],
+    };
+    const result = (0, tdd_red_evidence_cjs_1.classifyRedEvidence)(evidenceInput);
+    const record = (0, tdd_red_evidence_cjs_1.buildRedEvidenceRecord)(evidenceInput, result);
+    output({
+        // Uniform gate contract: block = !passed. INVALID_RED blocks GREEN.
+        passed: result.verdict === 'RED_EVIDENCE_OK',
+        block: result.verdict !== 'RED_EVIDENCE_OK',
+        verdict: result.verdict,
+        reason: result.reason,
+        evidence: result.evidence,
+        record,
+        message: result.verdict === 'RED_EVIDENCE_OK'
+            ? `RED evidence verified: target test "${result.evidence.target_test}" failed as expected (exit ${result.evidence.exit_code}). GREEN authorized.`
+            : `INVALID_RED (${result.reason}): GREEN blocked. Fix the RED phase — only an intentional failure of target test "${result.evidence.target_test}" authorizes production edits.`,
+    }, raw, undefined);
+}
 /**
  * Resolve a phase argument to an absolute phase directory, or '' when it
  * cannot be resolved. Shared by every `check` arm that probes a phase's
@@ -1472,6 +1541,12 @@ function routeCheckCommand({ args, cwd, raw }) {
         cmdTddReviewCheckpoint(cwd, args, raw);
         return;
     }
+    if (subcommand === 'tdd-red-evidence') {
+        // #3770: intentional-RED evidence gate — only a target-test failure may
+        // authorize GREEN. Validates the persisted record; never executes anything.
+        cmdTddRedEvidence(cwd, args, raw);
+        return;
+    }
     if (subcommand === 'ui-safety-gate') {
         cmdUiSafetyGate(cwd, args, raw);
         return;
@@ -1491,6 +1566,13 @@ function routeCheckCommand({ args, cwd, raw }) {
         cmdVerifyCodebaseDrift(cwd, raw);
         return;
     }
+    if (subcommand === 'verify-context-drift') {
+        // Delegates to verify.context-drift — drift capability gate at plan:pre (non-blocking).
+        // Dot-to-hyphen normalization means query "verify.context-drift" routes here.
+        const phaseArg = typeof args[2] === 'string' ? args[2] : '';
+        cmdVerifyContextDrift(cwd, phaseArg, raw);
+        return;
+    }
     if (subcommand === 'predicate') {
         // Generic gate-predicate evaluator (#2008). The workflow gate-dispatch calls
         // this for any gate whose `check` carries a `predicate` (instead of a `query`),
@@ -1508,7 +1590,7 @@ function routeCheckCommand({ args, cwd, raw }) {
         (0, prohibition_enforcement_cjs_1.routeProhibitionEnforcement)(args, raw);
         return;
     }
-    error('Unknown check subcommand. Available: api-coverage-verify-pre, auto-mode, decision-coverage-plan, decision-coverage-verify, gap-analysis-plan-post, predicate, prohibition-enforcement, tdd-review-checkpoint, ui-plan-gate, ui-safety-gate, verify-command-paths, verify-failure-directions, verify-schema-drift, verify-codebase-drift', ERROR_REASON.SDK_UNKNOWN_COMMAND);
+    error('Unknown check subcommand. Available: api-coverage-verify-pre, auto-mode, decision-coverage-plan, decision-coverage-verify, gap-analysis-plan-post, predicate, prohibition-enforcement, tdd-red-evidence, tdd-review-checkpoint, ui-plan-gate, ui-safety-gate, verify-command-paths, verify-failure-directions, verify-schema-drift, verify-codebase-drift, verify-context-drift', ERROR_REASON.SDK_UNKNOWN_COMMAND);
 }
 module.exports = {
     routeCheckCommand,
@@ -1520,6 +1602,7 @@ module.exports = {
     cmdVerifyCommandPaths,
     cmdVerifyFailureDirections,
     cmdTddReviewCheckpoint,
+    cmdTddRedEvidence,
     cmdCheckPredicate,
     buildPredicateDeps,
     parsePredicateFlags,

package/gsd-core/bin/lib/claude-orchestration.cjs

@@ -43,6 +43,9 @@
  *
  * Zero external dependencies. Pure functions. Never throws on bad input.
  */
+// eslint-disable-next-line @typescript-eslint/no-require-imports -- file-overlap-partitioner.cjs is an export= CommonJS module
+const fileOverlapPartitionerMod = require("./file-overlap-partitioner.cjs");
+const { partitionByFileOverlap } = fileOverlapPartitionerMod;
 // ─── Constants ────────────────────────────────────────────────────────────────
 /**
  * The Agent SDK version that introduced the Workflow tool (#1143 prior art).
@@ -226,33 +229,15 @@ function detectWorkflowBackend(input) {
  *
  * This is the same overlap rule execute-phase applies inline — the only difference
  * is the execution vehicle (Workflow `parallel()` vs one-agent-per-message).
+ *
+ * #3674: the algorithm itself now lives in the generic, dependency-free
+ * `file-overlap-partitioner.cts` module (`partitionByFileOverlap`) — this is a
+ * thin adapter mapping this module's own `Plan[]` shape onto that module's
+ * generic `{ id, files }[]` input and back. Behavior-preserving extraction:
+ * same greedy first-fit algorithm, same output, only the implementation moved.
  */
 function partitionStages(plans) {
-    const stages = [];
-    for (const plan of plans) {
-        const fileSet = new Set(plan.files_modified);
-        let placed = false;
-        for (const stage of stages) {
-            let overlap = false;
-            for (const f of fileSet) {
-                if (stage.files.has(f)) {
-                    overlap = true;
-                    break;
-                }
-            }
-            if (!overlap) {
-                stage.plans.push(plan);
-                for (const f of fileSet)
-                    stage.files.add(f);
-                placed = true;
-                break;
-            }
-        }
-        if (!placed) {
-            stages.push({ plans: [plan], files: new Set(fileSet) });
-        }
-    }
-    return stages.map((s) => s.plans.map((p) => p.id));
+    return partitionByFileOverlap(plans.map((p) => ({ id: p.id, files: p.files_modified })));
 }
 /**
  * Quote a free-text value for safe embedding as a JavaScript/Workflow double-quoted

package/gsd-core/bin/lib/clusters.cjs

@@ -95,6 +95,7 @@ exports.CLUSTERS = Object.freeze({
         'undo',
         'fast',
         'quick',
+        'quick-batch',
         'autonomous',
         'config',
         'progress',

package/gsd-core/bin/lib/command-aliases.cjs

@@ -248,6 +248,14 @@ exports.VERIFY_COMMAND_ALIASES = [
         ],
         "subcommand": "codebase-drift",
         "mutation": false
+    },
+    {
+        "canonical": "verify.context-drift",
+        "aliases": [
+            "verify context-drift"
+        ],
+        "subcommand": "context-drift",
+        "mutation": false
     }
 ];
 exports.INIT_COMMAND_ALIASES = [
@@ -299,6 +307,14 @@ exports.INIT_COMMAND_ALIASES = [
         "subcommand": "quick",
         "mutation": false
     },
+    {
+        "canonical": "init.quick-batch",
+        "aliases": [
+            "init quick-batch"
+        ],
+        "subcommand": "quick-batch",
+        "mutation": false
+    },
     {
         "canonical": "init.ingest-docs",
         "aliases": [