@opengsd/gsd-core 1.12.0 → 1.14.0

package/gsd-core/bin/lib/loop-resolver.cjs

@@ -40,7 +40,7 @@ const { resolveCapabilityRuntimeState } = capabilityStateModule;
 // ─── Capability-activation engine (single owner for config-key precedence) ────
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const capabilityActivationModule = require("./capability-activation.cjs");
-const { _getNestedConfigValue, _readRawConfigKey, _resolveActivationValue, resolveConfigKey } = capabilityActivationModule;
+const { _getNestedConfigValue, _readRawConfigKey, _resolveActivationValue, _resolvePointGate, resolveConfigKey } = capabilityActivationModule;
 // ─── Canonical points (derived from LOOP_HOST_CONTRACT — authoritative 12) ───
 // FIX 2: Derive the authoritative canonical set from LOOP_HOST_CONTRACT so it
 // cannot drift from the host contract. CANONICAL_POINTS_FALLBACK is kept as an
@@ -125,13 +125,15 @@ function resolveLoopHooks(input) {
     // Helper: check activation using single-key precedence resolver (FIX 1 + FIX 3)
     function isActive(hook) {
         const when = hook['when'];
-        // No `when` → unconditional hook, always active
-        if (when === undefined || when === null)
-            return true;
-        // FIX 3: `when` present but not a non-empty string → malformed registry data → INACTIVE
-        if (typeof when !== 'string' || when.length === 0)
-            return false;
-        return _resolveActivationValue(when, config, cwd, registry);
+        if (when !== undefined && when !== null) {
+            // FIX 3: `when` present but not a non-empty string → malformed registry data → INACTIVE
+            if (typeof when !== 'string' || when.length === 0)
+                return false;
+            if (!_resolveActivationValue(when, config, cwd, registry))
+                return false;
+        }
+        // #3661: optional point-selection gate — see capability-activation.cts.
+        return _resolvePointGate(hook['pointFrom'], point, config, cwd, registry);
     }
     function isCapabilityActive(capId) {
         if (!capabilityStatesById)
@@ -222,6 +224,9 @@ function resolveLoopHooks(input) {
             active.consumes = consumes;
         if (onError !== undefined)
             active.onError = onError;
+        // #4209 DISP-02: only a literal `true` projects; absent/false stay inert.
+        if (hook['supportsReviewerLanes'] === true)
+            active.supportsReviewerLanes = true;
         activeHooks.push(active);
     }
     // Process contributions
@@ -420,17 +425,20 @@ function sanitizeLoadFailReason(reason) {
         .slice(0, 300);
     return cleaned || '(no reason given)';
 }
-function cmdLoopRenderHooks(cwd, point, raw, options = {}) {
-    if (!point) {
-        coreError('loop render-hooks requires a <point> argument. Valid points: ' + CANONICAL_POINTS.join(', '));
-        return;
-    }
-    // --active-cap <capId> mode: emit 'true' or 'false' only (scanner-safe, no JSON envelope)
-    const activeCapId = typeof options['activeCap'] === 'string' ? options['activeCap'] : undefined;
-    if (activeCapId !== undefined && activeCapId === '') {
-        coreError('--active-cap requires a <capId> value (e.g. --active-cap tdd)');
-        return;
-    }
+/**
+ * The full config/registry/capability-state resolution `cmdLoopRenderHooks` performs, minus its
+ * CLI-only output formatting — extracted so an in-process caller (e.g. `review-lane dispatch-step`
+ * self-verifying a `supportsReviewerLanes` trait) can reach the SAME resolution `gsd_run loop
+ * render-hooks <point> --raw` would give it, without spawning a subprocess and re-parsing its
+ * stdout (which was subject to `io.cjs`'s `@file:` overflow protocol on the rendered-string
+ * envelope — a bug class this in-process call cannot hit, since it never touches that envelope
+ * or its rendering at all).
+ *
+ * Throws on an invalid `point` (mirrors `resolveLoopHooks`); callers convert to their own error
+ * channel. Emits the same loud stderr load-failure warnings `cmdLoopRenderHooks` always has,
+ * regardless of caller — a skipped gate must never be silently invisible.
+ */
+function resolveActiveHooksForPoint(cwd, point, options = {}) {
     const runtimeConfigDir = typeof options['configDir'] === 'string'
         ? options['configDir']
         : undefined;
@@ -466,15 +474,7 @@ function cmdLoopRenderHooks(cwd, point, raw, options = {}) {
     for (const cap of state.capabilities || []) {
         capabilityStatesById.set(cap.id, cap);
     }
-    let resolved;
-    try {
-        resolved = resolveLoopHooks({ point, registry, config, cwd, capabilityStatesById });
-    }
-    catch (err) {
-        const msg = (err instanceof Error) ? err.message : String(err);
-        coreError(msg);
-        return;
-    }
+    const resolved = resolveLoopHooks({ point, registry, config, cwd, capabilityStatesById });
     // ── ADR-1244 D2: load-failed capability gates FAIL OPEN with a loud warning ────
     // Decision (#2009): a capability that failed to LOAD must not block the loop.
     // The prior behavior injected a BLOCKING synthetic gate (blocking:true,
@@ -523,24 +523,44 @@ function cmdLoopRenderHooks(cwd, point, raw, options = {}) {
     for (const w of loadFailWarnings) {
         process.stderr.write(`gsd: warning — ${w}\n`);
     }
-    // --active-cap mode: print exactly 'true' or 'false' with no envelope
+    // Surface capability-state warnings and the #2009 load-failure fail-open warnings together
+    // (in addition to the stderr emission above, which is the channel host workflows actually see).
+    const combinedWarnings = [...(state.warnings || []), ...loadFailWarnings];
+    return { point: resolved.point, activeHooks: resolved.activeHooks, warnings: combinedWarnings };
+}
+function cmdLoopRenderHooks(cwd, point, raw, options = {}) {
+    if (!point) {
+        coreError('loop render-hooks requires a <point> argument. Valid points: ' + CANONICAL_POINTS.join(', '));
+        return;
+    }
+    // --active-cap <capId> mode: emit 'true' or 'false' only (scanner-safe, no JSON envelope)
+    const activeCapId = typeof options['activeCap'] === 'string' ? options['activeCap'] : undefined;
+    if (activeCapId !== undefined && activeCapId === '') {
+        coreError('--active-cap requires a <capId> value (e.g. --active-cap tdd)');
+        return;
+    }
+    let result;
+    try {
+        result = resolveActiveHooksForPoint(cwd, point, options);
+    }
+    catch (err) {
+        const msg = (err instanceof Error) ? err.message : String(err);
+        coreError(msg);
+        return;
+    }
     if (activeCapId !== undefined) {
-        const isActive = resolved.activeHooks.some((h) => h.capId === activeCapId);
+        const isActive = result.activeHooks.some((h) => h.capId === activeCapId);
         process.stdout.write(isActive ? 'true\n' : 'false\n');
         return;
     }
-    const rendered = renderLoopHooks(resolved);
+    const rendered = renderLoopHooks({ point: result.point, activeHooks: result.activeHooks });
     const envelope = {
-        point: resolved.point,
-        activeHooks: resolved.activeHooks,
+        point: result.point,
+        activeHooks: result.activeHooks,
         rendered,
     };
-    // Surface capability-state warnings and the #2009 load-failure fail-open
-    // warnings together in the structured `warnings` channel (in addition to the
-    // stderr emission above, which is the channel host workflows actually see).
-    const combinedWarnings = [...(state.warnings || []), ...loadFailWarnings];
-    if (combinedWarnings.length > 0) {
-        envelope.warnings = combinedWarnings;
+    if (result.warnings.length > 0) {
+        envelope.warnings = result.warnings;
     }
     coreOutput(envelope, raw);
 }
@@ -548,6 +568,7 @@ module.exports = {
     resolveLoopHooks,
     renderLoopHooks,
     cmdLoopRenderHooks,
+    resolveActiveHooksForPoint,
     // Exported for tests
     _getNestedConfigValue,
     _resolveActivationValue,
@@ -555,6 +576,10 @@ module.exports = {
     // Re-exported for identity parity guard (FIX 2: resolveConfigValues in this module
     // calls resolveConfigKey; exporting it here makes the single-owner contract testable).
     resolveConfigKey,
+    // #3661: re-exported for the same identity parity guard — isActive calls
+    // _resolvePointGate; exporting it here makes the single-owner contract testable
+    // (see tests/capability-precedence-parity.test.cjs's identity guard describe block).
+    _resolvePointGate,
     CANONICAL_POINTS_FALLBACK,
     CANONICAL_POINTS,
 };

package/gsd-core/bin/lib/markdown-table.cjs

@@ -23,6 +23,7 @@ exports.findTableBySchema = findTableBySchema;
 exports.findTableWithColumns = findTableWithColumns;
 exports.escapeCell = escapeCell;
 exports.appendQuickTaskRow = appendQuickTaskRow;
+exports.migrateQuickTasksTable = migrateQuickTasksTable;
 exports.resetQuickTaskRows = resetQuickTaskRows;
 const markdown_sectionizer_cjs_1 = require("./markdown-sectionizer.cjs");
 // ─── Schema registry ──────────────────────────────────────────────────────────
@@ -776,6 +777,128 @@ function appendQuickTaskRow(stateContent, fields) {
     const content = (0, markdown_sectionizer_cjs_1.replaceSection)(stateContent, section, newBody);
     return { ok: true, value: { content, row, variant: match.label } };
 }
+// ─── migrateQuickTasksTable (#3730 option b) ───────────────────────────────
+/**
+ * Column-name → canonical-cell mapping for migrating a legacy Quick Tasks table
+ * (#3730). Name-based, case-insensitive; every column NOT in this map lands in
+ * the Description bucket (joined with ' · ' in original column order, unknown
+ * names kept as `name: value`) so no historical datum is dropped.
+ */
+const QUICK_TASKS_COLUMN_ALIASES = {
+    '#': '#', id: '#',
+    date: 'Date', when: 'Date',
+    commit: 'Commit', sha: 'Commit',
+    status: 'Status',
+    directory: 'Directory', artifacts: 'Directory', path: 'Directory', dir: 'Directory',
+    description: 'Description', task: 'Description', summary: 'Description',
+    slug: 'Description', scope: 'Description', title: 'Description',
+};
+/**
+ * Migrate STATE.md's "Quick Tasks Completed" table onto the canonical
+ * `with-status` schema (#3730, maintainer decision 2026-09-02: option b).
+ *
+ * The pre-registry prose template licensed arbitrary column shapes GSD itself
+ * emitted, and `appendQuickTaskRow` fails loud on every one of them — leaving a
+ * project permanently unappendable. This is the supported repair path: the
+ * `gsd-tools quick-tasks-migrate` subcommand, plus an automatic check on the
+ * first `quick`/`fast` run (the workflow calls this before appending), which is
+ * a silent no-op when the section is absent, the table is already canonical, or
+ * the user never runs quick at all.
+ *
+ * Same section-selection, parse, and fail-loud posture as `appendQuickTaskRow`
+ * (ADR-2143 §7 upheld — append still rejects; this REPAIRS). Returns
+ * `{ok:true, value:{content, migrated:false}}` for the no-op cases so callers
+ * can stay silent, and `{migrated:true, from, rows}` when a rewrite happened so
+ * the CLI can report exactly what moved.
+ */
+function migrateQuickTasksTable(stateContent) {
+    const section = selectQuickTasksSection(stateContent);
+    if (!section) {
+        return { ok: true, value: { content: stateContent, migrated: false } };
+    }
+    const parsed = parseMarkdownTable(section.body);
+    if (!parsed.ok) {
+        return { ok: false, reason: `quick-tasks table: ${parsed.reason}` };
+    }
+    const match = matchTableSchema(parsed.value.columns);
+    if (match && match.id === 'QuickTasks') {
+        return { ok: true, value: { content: stateContent, migrated: false } };
+    }
+    const canonical = exports.TABLE_SCHEMAS.QuickTasks.find((v) => v.label === 'with-status').columns;
+    // Map each legacy column to its canonical target; unmapped names keep their
+    // identity so the Description bucket can render them losslessly.
+    const targets = parsed.value.columns.map((c) => QUICK_TASKS_COLUMN_ALIASES[c.trim().toLowerCase()] ?? null);
+    const rows = parsed.value.rows.map((row, rowIdx) => {
+        const bucket = {
+            '#': '', Description: '', Date: '', Commit: '', Status: '', Directory: '',
+        };
+        const descriptionParts = [];
+        // parseMarkdownTable hands back name-keyed records (rows[i][columnName]).
+        parsed.value.columns.forEach((col, i) => {
+            const raw = (row[col] ?? '').trim();
+            const target = targets[i];
+            if (target === 'Description') {
+                if (raw)
+                    descriptionParts.push(raw);
+            }
+            else if (target) {
+                // Collision-safe (#3730 review): two legacy columns aliasing the same
+                // canonical target must not silently overwrite — the displaced value
+                // joins the Description bucket under its own name, same convention as
+                // an unknown column, so no historical datum is dropped.
+                if (raw && bucket[target]) {
+                    descriptionParts.push(`${col.trim()}: ${raw}`);
+                }
+                else if (raw) {
+                    bucket[target] = raw;
+                }
+            }
+            else if (raw) {
+                descriptionParts.push(`${col.trim()}: ${raw}`);
+            }
+        });
+        bucket['#'] = bucket['#'] || String(rowIdx + 1);
+        bucket.Description = descriptionParts.join(' · ');
+        bucket.Date = bucket.Date || '—';
+        bucket.Commit = bucket.Commit || '—';
+        bucket.Status = bucket.Status || '—';
+        bucket.Directory = bucket.Directory || '—';
+        return `| ${canonical.map((c) => escapeCell(bucket[c])).join(' | ')} |`;
+    });
+    const eol = /\r\n/.test(section.body) ? '\r\n' : '\n';
+    const lines = section.body.split(/\r?\n/);
+    // CONTIGUOUS-run bound (#3730 review), mirroring resetQuickTaskRows: the
+    // section body may carry a SECOND table (a `#### Notes` subsection or a
+    // trailing table after a blank line) that parseMarkdownTable never read —
+    // scanning for the last pipe line anywhere in the body would splice the
+    // rewrite across it and silently destroy it. Only the first CONTIGUOUS run
+    // of pipe lines — the table that was parsed — is replaced.
+    const firstTableLineIdx = lines.findIndex((l) => l.trim().startsWith('|'));
+    let lastTableLineIdx = firstTableLineIdx;
+    while (lastTableLineIdx + 1 < lines.length && lines[lastTableLineIdx + 1].trim().startsWith('|')) {
+        lastTableLineIdx++;
+    }
+    const header = `| ${canonical.join(' | ')} |`;
+    // Widths match workflows/quick.md's canonical template byte-for-byte
+    // (#3730 review): its delimiter is max(3, len+2) per column.
+    const delimiter = `| ${canonical.map((c) => '-'.repeat(Math.max(3, c.length + 2))).join(' | ')} |`;
+    const newBody = [
+        ...lines.slice(0, firstTableLineIdx),
+        header,
+        delimiter,
+        ...rows,
+        ...lines.slice(lastTableLineIdx + 1),
+    ].join(eol);
+    return {
+        ok: true,
+        value: {
+            content: (0, markdown_sectionizer_cjs_1.replaceSection)(stateContent, section, newBody),
+            migrated: true,
+            from: parsed.value.columns,
+            rows: rows.length,
+        },
+    };
+}
 // ─── resetQuickTaskRows (#2142) ────────────────────────────────────────────
 /**
  * Clear every DATA row from STATE.md's "Quick Tasks Completed" table, leaving

package/gsd-core/bin/lib/mcp-catalog.cjs

@@ -402,8 +402,8 @@ function classifyUnindexedUri(uri) {
 }
 /** Second, independent gate (design "Hostile inputs" gate 2): re-validate an INDEXED entry's relPath against the catalog root, catching a symlink planted after the index was built. */
 function readIndexedResource(catalog, entry) {
-    const check = (0, security_cjs_1.validatePath)(entry.relPath, catalog.root);
-    if (!check.safe) {
+    const contained = (0, security_cjs_1.tryWithinRoot)(entry.relPath, catalog.root);
+    if (contained === null) {
         fail(exports.REASON.TRAVERSAL_REFUSED, `indexed resource escapes catalog root: ${entry.relPath}`);
     }
     let raw;

package/gsd-core/bin/lib/milestone.cjs

@@ -55,7 +55,7 @@ const { scanPhasePlans } = planScanMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- phase-locator.cjs is an export= CommonJS module
 const phaseLocatorMod = require("./phase-locator.cjs");
 const { listMilestonePhaseDirs } = phaseLocatorMod;
-const { planningPaths } = planningWorkspace;
+const { planningPaths, resolvePhaseIdConvention } = planningWorkspace;
 const { extractFrontmatter } = frontmatterMod;
 // ADR-3408 §8.3 / #3469: `writeStateMd` gets sync and NO preservation — the
 // same #3374-shaped exposure the milestone-complete write used to carry (a
@@ -702,6 +702,22 @@ function cmdMilestoneComplete(cwd, version, options, raw) {
     let totalPlans = 0;
     let totalTasks = 0;
     const accomplishments = [];
+    // #2761 (round-11 BLOCKER): resolved ONCE, ambiently (no explicit `ws` —
+    // this function has none of its own and already resolves everything else
+    // off `cwd` via planningPaths(cwd), matching the ambient-workstream
+    // contract `resolvePhaseIdConvention`/`planningDir` share), and threaded
+    // into the single `listMilestonePhaseDirs` call directly below. Left
+    // unthreaded, `phaseIdConvention` stays `undefined` and
+    // `getMilestonePhaseFilter` silently resolves it FROM CONFIG itself —
+    // which is exactly the behavior the changeset originally (and wrongly)
+    // claimed this PR does not reach: on a bracket-convention project that
+    // lazily-resolved convention changes `milestonePhaseDirs`/
+    // `milestonePhaseScope` below, and this function goes on to ARCHIVE
+    // (rename/move) whatever that set names. Resolving explicitly here removes
+    // the silent-inherit path without changing behavior for `null` /
+    // `milestone-prefixed` projects, whose resolved convention is the same
+    // value `undefined` would have lazily produced anyway.
+    const phaseConvention = resolvePhaseIdConvention(cwd);
     // #3597 (ADR-3180 Decision 2): SINGLE resolution of "which phase
     // directories belong to the current milestone" AND the SCOPE discriminator
     // that resolution came from — shared verbatim by the read-only stats loop
@@ -715,7 +731,11 @@ function cmdMilestoneComplete(cwd, version, options, raw) {
     // disk, same as before #3597. Only the destructive archive pass (and its
     // --dry-run preview) refuses to act on a non-COMPLETE (non-answer) scope;
     // see the guard built from `milestonePhaseScope` further down.
-    const { value: milestonePhaseDirs, scope: milestonePhaseScope } = listMilestonePhaseDirs(phasesDir, { cwd, versionOverride: version });
+    const { value: milestonePhaseDirs, scope: milestonePhaseScope } = listMilestonePhaseDirs(phasesDir, {
+        cwd,
+        versionOverride: version,
+        phaseIdConvention: phaseConvention,
+    });
     try {
         for (const dir of milestonePhaseDirs) {
             phaseCount++;
@@ -806,7 +826,7 @@ function cmdMilestoneComplete(cwd, version, options, raw) {
         // never disagree with what a real run actually archives. Absent
         // --archive-quick this stays `[]` and nothing on disk is touched either
         // way (dry-run always returns before any mutation below).
-        const quickDirsToArchive = options.archiveQuick ? listQuickTaskDirsForArchive(cwd) : [];
+        const quickDirsToArchive = options.archiveQuick ? listQuickTaskDirsForArchive(cwd).map((d) => d.name) : [];
         const dryRunResult = {
             dry_run: true,
             version,
@@ -1462,6 +1482,16 @@ function writeQuickArchiveReadme(archiveQuickDir) {
  * written three times, and only the real-run copy applied `requireSafePath`,
  * so a dry-run preview could list a directory the real run would silently
  * skip).
+ *
+ * Returns the proven `ContainedPath` alongside each entry's bare `name`
+ * (`no-unconfined-path-join`'s `discardedContainmentResult` arm — a bare
+ * statement call to `requireSafePath` throws away the exact answer it just
+ * computed). The two dry-run previews only need `name` for display;
+ * `archiveQuickTaskDirectories` deliberately does NOT reuse `abs` for its
+ * rename — it re-derives and re-validates independently as TOCTOU
+ * defense-in-depth (see its own comment), so `abs` exists here only to make
+ * this function's own discard explicit, not to be trusted downstream as a
+ * stale-safe proof.
  */
 function listQuickTaskDirsForArchive(cwd) {
     const planningBase = planningPaths(cwd).planning;
@@ -1474,19 +1504,20 @@ function listQuickTaskDirsForArchive(cwd) {
         // .planning/quick absent or unreadable — nothing to select.
         return [];
     }
-    const names = [];
+    const results = [];
     for (const entry of sourceEntries) {
         if (!entry.isDirectory())
             continue; // excludes symlinks too — see MAJOR 3 note above
+        let abs;
         try {
-            (0, security_cjs_1.requireSafePath)(node_path_1.default.join(quickDir, entry.name), planningBase, 'quick task dir', { allowAbsolute: true });
+            abs = (0, security_cjs_1.requireSafePath)(node_path_1.default.join(quickDir, entry.name), planningBase, 'quick task dir', security_cjs_1.PathAcceptance.AbsoluteInsideRoot);
         }
         catch {
             continue; // symlink/escape attempt — never a candidate, in preview OR real run
         }
-        names.push(entry.name);
+        results.push({ name: entry.name, abs });
     }
-    return names.sort();
+    return results.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
 }
 /**
  * #2142: move each DIRECTORY entry under `.planning/quick/` into
@@ -1535,7 +1566,7 @@ function archiveQuickTaskDirectories(cwd, version) {
     // #2142 MAJOR 5 (review): dirNames is the SAME selection
     // `listQuickTaskDirsForArchive` hands to both dry-run previews — this is
     // the real run, so it cannot disagree with what a preview reported.
-    const dirNames = listQuickTaskDirsForArchive(cwd);
+    const dirNames = listQuickTaskDirsForArchive(cwd).map((d) => d.name);
     if (dirNames.length === 0) {
         // Boundary 0 (#2142): zero (safe) directory entries (empty dir, only
         // stray files, or every entry excluded by the selection rule) must not
@@ -1556,7 +1587,7 @@ function archiveQuickTaskDirectories(cwd, version) {
                 // rename are two separate filesystem observations, and an entry
                 // that was a safe real directory at selection time could in theory
                 // be swapped for a symlink before this loop reaches it.
-                safeSrc = (0, security_cjs_1.requireSafePath)(src, planningBase, 'quick task dir', { allowAbsolute: true });
+                safeSrc = (0, security_cjs_1.requireSafePath)(src, planningBase, 'quick task dir', security_cjs_1.PathAcceptance.AbsoluteInsideRoot);
             }
             catch {
                 continue; // symlink/escape attempt — skip, not archived
@@ -1649,7 +1680,7 @@ function cmdQuickArchive(cwd, version, options, raw) {
     // `cmdMilestoneComplete`'s own dry-run preview and the real
     // `archiveQuickTaskDirectories` both use, so all three can never disagree.
     if (options.dryRun) {
-        const quickDirsToArchive = listQuickTaskDirsForArchive(cwd);
+        const quickDirsToArchive = listQuickTaskDirsForArchive(cwd).map((d) => d.name);
         output({
             dry_run: true,
             version,

package/gsd-core/bin/lib/model-resolver.cjs

@@ -128,6 +128,67 @@ function _resolveRuntimeTier(config, tier) {
         overrides: config['model_profile_overrides'],
     });
 }
+/**
+ * #4192 — Resolve the claude-runtime TIER OVERRIDE model for (config, tier).
+ *
+ * Step 3's runtime-aware resolution deliberately skips the claude runtime to
+ * preserve the alias-native posture (#1156/#2297): with no user override, the
+ * resolver must keep returning bare tier aliases, and the builtin claude tier
+ * map (`opus → claude-opus-4-8`, …) must never force full-ID emission on every
+ * default install. But `model_profile_overrides.<runtime>.<tier>` is a
+ * documented override point (docs/CONFIGURATION.md § Runtime-Aware Profiles)
+ * that `workflows/settings-advanced.md` actively writes for claude-runtime
+ * users — and #4192 Finding 1 measured the key inert on this runtime.
+ *
+ * This helper reads ONLY the user's override entry for the effective claude
+ * runtime and tier — never the builtin claude tier map — so an install with no
+ * override is byte-identical to before the fix. The runtime is resolved the
+ * same way steps 1-3 resolve it (config['runtime'], defaulting to 'claude'),
+ * NOT via resolveActiveRuntime (GSD_RUNTIME/marker): the value policy must
+ * key off the config the operator wrote, matching mapClaudeOverrideForRuntime.
+ *
+ * Value policy mirrors the model_overrides path (#2041/#4192): an override
+ * value that maps to a current tier alias collapses to that alias
+ * (byte-equivalent resolution, alias-form emission); anything else — a pinned
+ * older generation (`claude-opus-4-7`), a bare alias/tier repoint (`sonnet`),
+ * or a non-Claude vendor id (`openai/o3`) — is emitted verbatim as pinned.
+ * Malformed entries (no usable `model` string) return null so the caller falls
+ * through to normal alias resolution (ADR-443 D1: invalid values fall through).
+ */
+function resolveClaudeTierOverrideModel(configRuntime, tier, overrides) {
+    if (!tier || tier === 'inherit')
+        return null;
+    const effectiveRuntime = configRuntime || 'claude';
+    if (effectiveRuntime !== 'claude')
+        return null; // non-claude runtimes resolve at step 3
+    const overridesMap = overrides;
+    if (!overridesMap || typeof overridesMap !== 'object')
+        return null;
+    // Own-property guards throughout: both levels are config-supplied plain
+    // objects, so a prototype-chain key ("constructor", "toString") must not
+    // resolve an inherited member instead of falling through (same hardening as
+    // every other config-keyed lookup in this module).
+    const runtimeEntry = Object.hasOwn(overridesMap, effectiveRuntime)
+        ? overridesMap[effectiveRuntime]
+        : undefined;
+    if (!runtimeEntry || typeof runtimeEntry !== 'object')
+        return null;
+    const userRaw = Object.hasOwn(runtimeEntry, tier) ? runtimeEntry[tier] : undefined;
+    if (userRaw === undefined || userRaw === null)
+        return null;
+    const entry = typeof userRaw === 'string'
+        ? { model: userRaw }
+        : userRaw;
+    if (!entry || typeof entry !== 'object')
+        return null;
+    const model = entry['model'];
+    if (typeof model !== 'string' || model.length === 0)
+        return null;
+    if (Object.hasOwn(CLAUDE_POLICY_ID_TO_ALIAS, model)) {
+        return CLAUDE_POLICY_ID_TO_ALIAS[model];
+    }
+    return model;
+}
 // Reverse of the Claude tier-default IDs, plus the Fable alias which Claude
 // Code's Agent tool accepts but which is not a GSD model-profile tier (#1133).
 const CLAUDE_POLICY_ID_TO_ALIAS = {
@@ -154,7 +215,10 @@ function warnModelPolicyUnmappable(agentType, policyModel, tier) {
 function _resetModelPolicyWarningCacheForTests() {
     _modelPolicyUnmappableWarned.clear();
 }
-// Dedupe stderr warnings for unmappable model_overrides Claude IDs (#2041).
+// Dedupe stderr warnings for unmappable model_overrides Claude IDs (#2041 /
+// #4192). #2041 originally warned that such a value was being DROPPED to tier
+// resolution; #4192 keeps the warn-once breadcrumb but changes the behavior to
+// a verbatim pass-through, so the text now describes the pass-through.
 const _modelOverrideUnmappableWarned = new Set();
 function warnModelOverrideUnmappable(agentType, overrideValue) {
     const key = `${agentType}::${overrideValue}`;
@@ -165,8 +229,9 @@ function warnModelOverrideUnmappable(agentType, overrideValue) {
     // full to stderr/logs (#2041 security review). MUST go to stderr — resolve-
     // model's JSON result is parsed from stdout.
     const safe = overrideValue.length > 64 ? overrideValue.slice(0, 64) + '…' : overrideValue;
-    process.stderr.write(`gsd: warning — model_overrides value "${safe}" for ${agentType} ` +
-        `has no Claude agent alias; falling through to tier resolution.\n`);
+    process.stderr.write(`gsd: warning — model_overrides value "${safe}" for ${agentType} is a fully-qualified ` +
+        `Claude model ID with no tier alias; passing it through verbatim. Claude Code setups ` +
+        `whose Agent tool accepts only tier aliases will not honor it. (#4192)\n`);
 }
 // Test-only: reset the model_overrides warn-dedupe cache between cases (#2041).
 function _resetModelOverrideWarningCacheForTests() {
@@ -175,12 +240,24 @@ function _resetModelOverrideWarningCacheForTests() {
 /**
  * #2041 — Map a `model_overrides` value to its Claude Agent-tool alias on the
  * claude runtime, mirroring the `model_policy` path (#1144). Claude Code's
- * Agent tool `model` parameter documents only tier aliases (opus/sonnet/haiku/
- * fable); a full Claude model ID returned verbatim is silently dropped by the
- * spawner. Returns the value to return verbatim, or null to signal "fall
- * through to normal tier/dynamic-routing resolution" (used when a Claude full
- * ID has no alias — matches model_policy's warn-and-fall-through). Non-Claude
- * runtimes and non-Claude values always pass through verbatim.
+ * Agent tool `model` parameter documents tier aliases (opus/sonnet/haiku/
+ * fable) as the always-accepted form. Returns the value to emit verbatim, or
+ * null to signal "fall through to normal tier/dynamic-routing resolution".
+ * Non-Claude runtimes and non-Claude values always pass through verbatim.
+ *
+ * #4192 — an unmappable `claude-*` value (a pinned generation that is not the
+ * current catalog default, e.g. `claude-opus-4-7`) is now PASSED THROUGH
+ * VERBATIM with a warn-once stderr breadcrumb, instead of being dropped to
+ * tier resolution. #2041's drop was correct when the value was plausibly a
+ * mis-typed current default, but for an explicit pin it silently UNPINNED the
+ * operator's choice — the resolver would report a tier the config never asked
+ * for, the exact "profile can misrepresent what actually runs" defect #4192
+ * files. The documented contract ("any fully-qualified model ID",
+ * docs/CONFIGURATION.md § Per-Agent Overrides,
+ * gsd-core/references/model-profiles.md § Per-Agent Overrides) is restored:
+ * the pin is resolved as configured. Values that DO map to a current tier
+ * alias still collapse to that alias — byte-equivalent resolution, the #2041
+ * protection preserved — and a mappable pin never warns.
  *
  * Hardening (code+security review): a `typeof` guard preserves the pre-fix
  * no-crash behavior if a malformed config surfaces a non-string value, and an
@@ -204,8 +281,9 @@ function mapClaudeOverrideForRuntime(override, configRuntime, agentType) {
     if (model_catalog_cjs_1.CLAUDE_AGENT_ALIASES.has(override))
         return override;
     if (override.startsWith('claude-')) {
+        // #4192: explicit generation pin — resolve as configured (see docblock).
         warnModelOverrideUnmappable(agentType, override);
-        return null;
+        return override;
     }
     return override;
 }
@@ -467,6 +545,19 @@ function resolveModelInternal(cwd, agentType) {
         && (projectExplicitlySetsOmit(cwd) || !RUNTIMES_WITH_NATIVE_ALIASES.has(resolveActiveRuntime(config)))) {
         return '';
     }
+    // 4.5. Claude-runtime tier override (#4192 Finding 1). Sits AFTER the omit
+    // gate so an explicit project `resolve_model_ids:"omit"` still wins (#2297:
+    // explicit project omit is honored regardless of runtime), and BEFORE the
+    // alias return so a pinned generation is not re-collapsed to a tier alias or
+    // re-materialized to the LATEST catalog id by step 5's
+    // `resolve_model_ids:true` path. Fires ONLY when the user wrote a
+    // `model_profile_overrides.claude.<tier>` entry for this tier — see
+    // resolveClaudeTierOverrideModel for why the builtin map stays out.
+    if (tier && tier !== 'inherit') {
+        const claudeOverrideModel = resolveClaudeTierOverrideModel(configRuntime, tier, config['model_profile_overrides']);
+        if (claudeOverrideModel !== null)
+            return claudeOverrideModel;
+    }
     // 5. Profile lookup (Claude-native default).
     if (!agentModels) {
         return profile === 'quality' ? 'opus'

package/gsd-core/bin/lib/phase-command-router.cjs

@@ -6,7 +6,7 @@
  * Unsupported in this router:
  * - scaffold: routed through top-level scaffold command.
  *
- * CJS-only subcommands: mvp-mode (dispatched directly, before hub).
+ * CJS-only subcommands: mvp-mode, tdd-applicable (dispatched directly, before hub).
  *
  * #3788: dispatch is mediated by CommandRoutingHub. The public entry point
  * and observable CLI behaviour are unchanged.
@@ -57,6 +57,13 @@ function routePhaseCommand({ phase, args, cwd, raw, error }) {
         phase.cmdPhaseMvpMode(cwd, args.slice(2), raw);
         return;
     }
+    // `tdd-applicable` (#4273): same CJS-native dispatch shape as `mvp-mode`
+    // immediately above — a precedence cascade over plan/task/config sources
+    // with its own typed JSON result, not routed through the SDK query layer.
+    if (subcommand === 'tdd-applicable') {
+        phase.cmdPhaseTddApplicable(cwd, args.slice(2), raw);
+        return;
+    }
     // ── Build the CJS registry ──────────────────────────────────────────────────
     // Each handler receives a ctx object from the hub and must return a HubResult.
     const cjsRegistry = {
@@ -119,7 +126,13 @@ function routePhaseCommand({ phase, args, cwd, raw, error }) {
                 if (args.includes('--dry-run')) {
                     return makeInvalidArgs('--dry-run', 'phase insert does not support --dry-run');
                 }
-                phase.cmdPhaseInsert(cwd, args[2], args.slice(3).join(' '), raw);
+                // #4569: --sibling opts into joining afterPhase's parent decimal level
+                // instead of nesting one level deeper. Filtered out like other
+                // boolean flags (see `remove`'s --force handling above) so it never
+                // leaks into the free-text description.
+                const sibling = args.includes('--sibling');
+                const insertArgs = args.slice(2).filter(token => token !== '--sibling');
+                phase.cmdPhaseInsert(cwd, insertArgs[0], insertArgs.slice(1).join(' '), raw, sibling ? 'sibling' : 'nested');
                 return { ok: true, data: null };
             },
             remove: (_ctx) => {
@@ -224,14 +237,14 @@ function routePhaseCommand({ phase, args, cwd, raw, error }) {
     // ── Build manifest (available subcommands for UnknownCommand detection) ─────
     // `availableSubcommands` is what the error message shows. It excludes
     // unsupported commands (already handled above) but does NOT include 'mvp-mode'
-    // because it was absent from PHASE_SUBCOMMANDS in the original and was not
-    // shown in the "Available:" list there either.
+    // or 'tdd-applicable' (#4273) because both are absent from PHASE_SUBCOMMANDS
+    // and were not shown in the "Available:" list there either.
     //
     // `manifestSubcommands` is the full routing set for the hub — it includes
-    // 'mvp-mode' (which the original code routed via a handler even without a
-    // manifest entry) so the hub's UnknownCommand check passes for it.
+    // 'mvp-mode' and 'tdd-applicable' (both routed via a handler even without a
+    // manifest entry) so the hub's UnknownCommand check passes for them.
     const availableSubcommands = command_aliases_cjs_1.PHASE_SUBCOMMANDS.filter(s => !UNSUPPORTED[s]);
-    const manifestSubcommands = ['mvp-mode', ...availableSubcommands];
+    const manifestSubcommands = ['mvp-mode', 'tdd-applicable', ...availableSubcommands];
     const manifest = { phase: manifestSubcommands };
     // ── Construct hub ──────────────────────────────────────────────────────────
     // #175: Hub is CJS-only — no mode param, no sdkLoader.