@opengsd/gsd-core 1.13.0 → 1.15.0

package/scripts/lint-state-write-path-drift.cjs

@@ -162,6 +162,12 @@ const REASON = Object.freeze({
   // Axis 2 (§8.6, retained): a raw `fs.writeFileSync(` call targeting the
   // state path — see `findRawStateWrites`.
   RAW_STATE_WRITE: 'raw_state_write',
+  // ADR-4629 §8.1 (epic #4629, C1): a residual `readModifyWriteStateMd(path,
+  // (content) => …)` call whose transform is an inline anonymous arrow/function
+  // — the opaque shape §8.1 replaces with a declared StateWriteIntent. Recognized
+  // by `findOpaqueStateTransforms`; a CAPABILITY in C1 (not wired into collect()),
+  // wired terminal in C2 as the residual callers migrate (ADR-3408 §6 phasing).
+  OPAQUE_STATE_TRANSFORM: 'opaque_state_transform',
   // Axis 4 (§8.3, Decision 4(d)): prompt-layer prose shelling out to a
   // write-side `gsd-tools` subcommand — see `findPromptSeamUses`.
   PROMPT_LAYER_STATE_WRITE: 'prompt_layer_state_write',
@@ -645,6 +651,91 @@ function findRawStateWrites(rel, text) {
   return out;
 }
 
+// ADR-4629 §8.1 (epic #4629, C1) — OPAQUE-TRANSFORM RECOGNITION.
+//
+// A residual `readModifyWriteStateMd(path, (content) => …)` call whose transform
+// (2nd) argument is an inline anonymous arrow / function expression is the opaque
+// shape §8.1 replaces with a declared StateWriteIntent: `readModifyWriteStateMd`
+// goes THROUGH the seam (it is NOT a raw-write bypass — Axis 2's concern), but its
+// opaque body transform is neither verified (§8.2) nor bounded (§8.3). This
+// function RECOGNIZES that shape.
+//
+// C1 ships recognition as a CAPABILITY: it is exported and unit-tested (positive
+// control on a seeded fixture) but is DELIBERATELY NOT wired into `collect()`'s
+// failing scan. §8.1's caller-side rule is *Required — Phase 2*; wiring it now
+// would turn the ~16 residual callers red at once, and ADR-3473 §8.6 retired the
+// ratchet that would otherwise be needed to absorb them. C2 wires this terminal as
+// the verifying executor lands and the callers migrate under ADR-3408 §6 phasing.
+//
+// String match, never an AST — same over-report-safe posture as every axis here.
+const OPAQUE_RMW_CALL_RE = /\breadModifyWriteStateMd\s*\(/g;
+// The transform arg is OPAQUE when it BEGINS an inline anonymous function: an
+// arrow (`(…) =>`, `ident =>`, optionally `async`) or a `function` expression. A
+// bare identifier / object (a declared StateWriteIntent, Phase 2+) is NOT opaque.
+const ANON_TRANSFORM_RE =
+  /^\s*(?:async\s+)?(?:\([^)]*\)|[A-Za-z_$][\w$]*)\s*=>|^\s*(?:async\s+)?function\b/;
+
+/**
+ * Capture the top-level, comma-separated argument list of a call, starting at
+ * `startIdx` (the index just AFTER the opening `(`) — across newlines and
+ * string-aware, tracking `()[]{}` depth. Returns the raw arg strings, or null if
+ * the parens never balance (a truncated arg list is never flagged). Generalizes
+ * `captureFirstArg`'s depth/inStr bookkeeping to every argument.
+ */
+function captureCallArgList(text, startIdx) {
+  let depth = 0;
+  let inStr = null;
+  const args = [];
+  let cur = '';
+  for (let i = startIdx; i < text.length; i++) {
+    const ch = text[i];
+    if (inStr) {
+      cur += ch;
+      if (ch === inStr && text[i - 1] !== '\\') inStr = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === '`') { inStr = ch; cur += ch; continue; }
+    if (ch === '(' || ch === '[' || ch === '{') { depth++; cur += ch; continue; }
+    if (ch === ')' || ch === ']' || ch === '}') {
+      if (ch === ')' && depth === 0) {
+        if (cur.trim() !== '' || args.length) args.push(cur);
+        return args;
+      }
+      depth--; cur += ch; continue;
+    }
+    if (ch === ',' && depth === 0) { args.push(cur); cur = ''; continue; }
+    cur += ch;
+  }
+  return null; // parens never balanced
+}
+
+/**
+ * Recognize residual opaque-transform STATE.md writes (ADR-4629 §8.1). Returns a
+ * finding per `readModifyWriteStateMd(` call whose 2nd argument is an inline
+ * anonymous transform. CAPABILITY only in C1 — not called by `collect()`.
+ */
+function findOpaqueStateTransforms(rel, text) {
+  const rawLines = text.split('\n');
+  const stripped = stripComments(text).join('\n');
+  const out = [];
+  let m;
+  OPAQUE_RMW_CALL_RE.lastIndex = 0;
+  while ((m = OPAQUE_RMW_CALL_RE.exec(stripped)) !== null) {
+    const args = captureCallArgList(stripped, m.index + m[0].length);
+    if (!args || args.length < 2) continue;
+    if (!ANON_TRANSFORM_RE.test(args[1])) continue;
+    const lineNo = stripped.slice(0, m.index).split('\n').length;
+    out.push({
+      reason: REASON.OPAQUE_STATE_TRANSFORM,
+      axis: 'opaque-transform',
+      file: sanitizeForReport(rel),
+      line: lineNo,
+      source: sanitizeForReport((rawLines[lineNo - 1] || '').trim()),
+    });
+  }
+  return out;
+}
+
 // The two write-seam STAGE functions, matched only as CALLS (`\(`
 // immediately after, modulo whitespace) — never as bare mentions of the
 // name. `writeStateMd(` is deliberately NOT included here (that arm is
@@ -941,6 +1032,8 @@ module.exports = {
   nearestPrecedingAssignment,
   findRawStateWrites,
   targetsStatePath,
+  findOpaqueStateTransforms,
+  captureCallArgList,
   findCompositionBypasses,
   findPromptSeamUses,
   isInsideCodeSpan,

package/scripts/lint-test-file-count.allowlist.json

@@ -1,6 +1,15 @@
 {
-  "_doc": "Baseline of modules currently exceeding the 2-test-file limit. Each entry locks in TODAY's exact test filenames as the allowlisted set (identity ratchet). Adding a NEW test file to a capped module fails (novel). Removing one requires pruning this list (stale, ratchet-down). When a cluster drops to \u2264 2, remove its entry entirely. New entries require justification in PR description.",
+  "_doc": "Baseline of modules currently exceeding the 2-test-file limit. Each entry locks in TODAY's exact test filenames as the allowlisted set (identity ratchet). Adding a NEW test file to a capped module fails (novel). Removing one requires pruning this list (stale, ratchet-down). When a cluster drops to ≤ 2, remove its entry entirely. New entries require justification in PR description.",
   "modules": {
+    "ui-consideration-probe": {
+      "files": [
+        "ui-consideration-probe-docs-fixtures.test.cjs",
+        "ui-consideration-probe-ui-phase-contract.test.cjs",
+        "ui-consideration-probe.test.cjs"
+      ],
+      "issue": "4657",
+      "justification": "The ui-consideration-probe cluster gains its workflow-prose contract file (tests/ui-consideration-probe-ui-phase-contract.test.cjs, #4657), mirroring the edge probe's split (edge-probe.test.cjs / edge-probe-docs-fixtures.test.cjs / edge-probe-spec-phase-contract.test.cjs). The contract file reads shipped gsd-core/workflows/ui-phase.md under the source-text-is-the-product exception, which the unit file deliberately does not carry (it asserts typed returns only)."
+    },
     "adr-parser": {
       "files": [
         "adr-parser.property.test.cjs",
@@ -40,7 +49,7 @@
         "frontmatter.unit.test.cjs"
       ],
       "issue": "3881",
-      "justification": "Grandfathered by #3227 for the original 4-file cluster (pre-existing over-cap, not new sprawl). #3881 (ADR-3473 \u00a78.1, the js-yaml parser migration) adds two more: frontmatter-golden-parity.test.cjs (D-series golden-corpus diff against the legacy parser, ~900 real documents \u2014 cannot be folded into an existing file without losing its independent-of-current-parser provenance) and frontmatter-roundtrip.property.test.cjs (fast-check property coverage the migration's bijective-contract rule requires). Both are migration-specific, not incidental sprawl."
+      "justification": "Grandfathered by #3227 for the original 4-file cluster (pre-existing over-cap, not new sprawl). #3881 (ADR-3473 §8.1, the js-yaml parser migration) adds two more: frontmatter-golden-parity.test.cjs (D-series golden-corpus diff against the legacy parser, ~900 real documents — cannot be folded into an existing file without losing its independent-of-current-parser provenance) and frontmatter-roundtrip.property.test.cjs (fast-check property coverage the migration's bijective-contract rule requires). Both are migration-specific, not incidental sprawl."
     },
     "graphify": {
       "files": [
@@ -123,6 +132,7 @@
         "state-prune.test.cjs",
         "state-rebuild-cli.test.cjs",
         "state-rebuild.test.cjs",
+        "state-todos-render.test.cjs",
         "state-write-path-drift-guard.test.cjs",
         "state.test.cjs"
       ],
@@ -136,10 +146,11 @@
         "verify-npm-publish.test.cjs",
         "verify-test-quality.test.cjs",
         "verify-work-auto-transition.test.cjs",
+        "verify-work-deferred-promotion.test.cjs",
         "verify.test.cjs"
       ],
-      "issue": "#3813 \u2014 the live-path #1883 suite drives buildPlanningSnapshot in-process with an fs fault; the verify module suites are CLI-driving and cannot host an fs monkeypatch",
-      "justification": "verify-command-grounding added by #2401/#3678; allowlist follow-up landed with #3606 (base was red on this lane)."
+      "issue": "#3813 — the live-path #1883 suite drives buildPlanningSnapshot in-process with an fs fault; the verify module suites are CLI-driving and cannot host an fs monkeypatch",
+      "justification": "verify-command-grounding added by #2401/#3678; allowlist follow-up landed with #3606 (base was red on this lane). #4546 adds verify-work-deferred-promotion (deferred-follow-up promotion writer contract + parity)."
     },
     "install": {
       "files": [
@@ -153,7 +164,7 @@
         "install-write-confinement.test.cjs",
         "install.test.cjs"
       ],
-      "issue": "#3798 \u2014 the profile-closure spawn test reads the real repo surface (commands+workflows+agents); consolidating it into install.test.cjs would put a whole-repo scan behind the suite's heaviest file"
+      "issue": "#3798 — the profile-closure spawn test reads the real repo surface (commands+workflows+agents); consolidating it into install.test.cjs would put a whole-repo scan behind the suite's heaviest file"
     },
     "edge-probe": {
       "files": [
@@ -251,8 +262,8 @@
         "docs-state-md-locale-parity.test.cjs",
         "docs-update.test.cjs"
       ],
-      "issue": "3873 | #3839 \u2014 the hook-event parity suite cross-checks the four docs hook tables against src/runtime-hooks-surface.cts registrations; a generated-docs concern distinct from content freshness and registry parity",
-      "justification": "ADR-3473 \u00a78.8 makes docs/reference/state-md.md and its four locale siblings generated-and-committed and adds the repo's first locale-parity check (verified: no locale-parity lint precedent exists here). That check is a distinct concern from docs-update (content freshness) and docs-parity-live-registry (registry parity); folding it into either would place an unrelated subject inside them purely to satisfy a count. The section it guards is absent from all four translations today and documents the status enum behind #3853."
+      "issue": "3873 | #3839 — the hook-event parity suite cross-checks the four docs hook tables against src/runtime-hooks-surface.cts registrations; a generated-docs concern distinct from content freshness and registry parity",
+      "justification": "ADR-3473 §8.8 makes docs/reference/state-md.md and its four locale siblings generated-and-committed and adds the repo's first locale-parity check (verified: no locale-parity lint precedent exists here). That check is a distinct concern from docs-update (content freshness) and docs-parity-live-registry (registry parity); folding it into either would place an unrelated subject inside them purely to satisfy a count. The section it guards is absent from all four translations today and documents the status enum behind #3853."
     },
     "audit": {
       "files": [
@@ -264,7 +275,7 @@
         "audit-uat-summary-segmentation.test.cjs",
         "audit-workstream-layouts.test.cjs"
       ],
-      "issue": "#3804/#3805 \u2014 audit-layout and acknowledged-marker suites drive the real audit-uat CLI against on-disk fixtures | #3817 \u2014 regression suite proving countReal counts the truncation remainder marker instead of treating it as one phantom item | #3783 \u2014 dedicated suite for the summary.current_milestone/archived segmentation, matching this module's one-file-per-feature-slice precedent (e.g. audit-uat-acknowledged.test.cjs) rather than growing the unrelated 6900+ line tests/uat.test.cjs (a different module, keyed off uat.cjs)"
+      "issue": "#3804/#3805 — audit-layout and acknowledged-marker suites drive the real audit-uat CLI against on-disk fixtures | #3817 — regression suite proving countReal counts the truncation remainder marker instead of treating it as one phantom item | #3783 — dedicated suite for the summary.current_milestone/archived segmentation, matching this module's one-file-per-feature-slice precedent (e.g. audit-uat-acknowledged.test.cjs) rather than growing the unrelated 6900+ line tests/uat.test.cjs (a different module, keyed off uat.cjs)"
     },
     "shell-command-projection": {
       "files": [
@@ -272,7 +283,16 @@
         "shell-command-projection-md-normalize.test.cjs",
         "shell-command-projection-path-sep.test.cjs"
       ],
-      "issue": "#3854 \u2014 the tight-list suite pins the markdown write-normalizer's blank-line policy through the exported normalizeContent/platformWriteSync seam; a distinct concern from dispatch routing and path separation"
+      "issue": "#3854 — the tight-list suite pins the markdown write-normalizer's blank-line policy through the exported normalizeContent/platformWriteSync seam; a distinct concern from dispatch routing and path separation"
+    },
+    "ui-consideration-probe": {
+      "files": [
+        "ui-consideration-probe-docs-fixtures.test.cjs",
+        "ui-consideration-probe-ui-phase-contract.test.cjs",
+        "ui-consideration-probe.test.cjs"
+      ],
+      "issue": "4657",
+      "justification": "The ui-consideration-probe cluster gains its workflow-prose contract file (tests/ui-consideration-probe-ui-phase-contract.test.cjs, #4657), mirroring the edge probe's split (edge-probe.test.cjs / edge-probe-docs-fixtures.test.cjs / edge-probe-spec-phase-contract.test.cjs). The contract file reads shipped gsd-core/workflows/ui-phase.md under the source-text-is-the-product exception, which the unit file deliberately does not carry (it asserts typed returns only)."
     }
   }
 }

package/scripts/lint-vendored-deps.cjs

@@ -161,8 +161,24 @@ function compareFiles(relA, relB) {
  * @param {string} spec
  * @returns {string}
  */
+const PIN_OPERATOR_RE = /^(\^|~|>=|<=|>|<|=)?/;
+
 function stripRangeOperator(spec) {
-  return String(spec || '').trim().replace(/^[\^~]|^>=|^<=|^>|^<|^=/, '').trim();
+  return String(spec || '').trim().replace(PIN_OPERATOR_RE, '').trim();
+}
+
+/**
+ * The leading range-operator token (if any) a package.json dependency spec
+ * was written with — the inverse half of stripRangeOperator, needed by
+ * `fixRow` to rebuild a pin (`<same operator>` + `<new version>`) that
+ * preserves the author's original range style instead of collapsing every
+ * pin to an exact version.
+ * @param {string} spec
+ * @returns {string} the operator (e.g. "^", "~", ">="), or "" for an exact pin
+ */
+function pinOperatorPrefix(spec) {
+  const m = String(spec || '').trim().match(PIN_OPERATOR_RE);
+  return (m && m[1]) || '';
 }
 
 /**
@@ -211,12 +227,40 @@ function checkHandAuthoredTwin(row) {
   return findings;
 }
 
+/**
+ * Read a row's pin state: the package.json devDependencies spec for
+ * `row.name` and, if `node_modules/<row.name>/package.json` exists, its
+ * installed version. Shared by checkRow (compares) and fixRow (rewrites) so
+ * the two can never silently diverge on how a pin is read.
+ * @param {VendoredPackage} row
+ * @param {string} [pkgRoot] Override for testing -- defaults to the real repo ROOT. Lets a
+ *   test point fixRow's pin-rewrite at an isolated temp package.json instead of writing the
+ *   real, shared one, which other concurrently-running node --test files read at module
+ *   top-level (the same race class already fixed for the vendored .cjs copy).
+ * @returns {{pinnedSpec: string | undefined, installedVersion: string | undefined}}
+ */
+function readPinState(row, pkgRoot = ROOT) {
+  const pkgPath = path.join(pkgRoot, 'package.json');
+  const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+  const pinnedSpec = pkg.devDependencies && pkg.devDependencies[row.name];
+  const installedPkgPath = path.join(pkgRoot, 'node_modules', row.name, 'package.json');
+  let installedVersion;
+  if (fs.existsSync(installedPkgPath)) {
+    installedVersion = JSON.parse(fs.readFileSync(installedPkgPath, 'utf8')).version;
+  }
+  return { pinnedSpec, installedVersion };
+}
+
 /**
  * Run all applicable freshness checks for one vendored package row.
  * @param {VendoredPackage} row
+ * @param {string} [pkgRoot] Override for testing -- defaults to the real repo ROOT. Lets a
+ *   test point fixRow's pin-rewrite at an isolated temp package.json instead of writing the
+ *   real, shared one, which other concurrently-running node --test files read at module
+ *   top-level (the same race class already fixed for the vendored .cjs copy).
  * @returns {string[]} findings (empty when the row is fresh)
  */
-function checkRow(row) {
+function checkRow(row, pkgRoot = ROOT) {
   const findings = [];
 
   const cjsDrift = compareFiles(row.vendoredCjs, row.upstreamCjs);
@@ -235,31 +279,96 @@ function checkRow(row) {
     findings.push(...checkHandAuthoredTwin(row));
   }
 
-  const pkgPath = path.join(ROOT, 'package.json');
-  const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
-  const pinnedSpec = pkg.devDependencies && pkg.devDependencies[row.name];
+  const { pinnedSpec, installedVersion } = readPinState(row, pkgRoot);
   if (!pinnedSpec) {
     findings.push(`package.json devDependencies.${row.name} is missing`);
+  } else if (installedVersion === undefined) {
+    findings.push(`node_modules/${row.name}/package.json does not exist (run npm install)`);
   } else {
-    const installedPkgPath = path.join(ROOT, 'node_modules', row.name, 'package.json');
-    if (!fs.existsSync(installedPkgPath)) {
-      findings.push(`node_modules/${row.name}/package.json does not exist (run npm install)`);
-    } else {
-      const installed = JSON.parse(fs.readFileSync(installedPkgPath, 'utf8'));
-      const pinned = stripRangeOperator(pinnedSpec);
-      if (pinned !== installed.version) {
-        findings.push(
-          `package.json devDependencies.${row.name} ("${pinnedSpec}" -> "${pinned}") != `
-            + `node_modules/${row.name}/package.json version ("${installed.version}")`,
-        );
-      }
+    const pinned = stripRangeOperator(pinnedSpec);
+    if (pinned !== installedVersion) {
+      findings.push(
+        `package.json devDependencies.${row.name} ("${pinnedSpec}" -> "${pinned}") != `
+          + `node_modules/${row.name}/package.json version ("${installedVersion}")`,
+      );
     }
   }
 
   return findings;
 }
 
+/**
+ * Mechanically resolve a vendored package's byte/pin drift: copy the
+ * upstream .cjs (and, for `upstream-verbatim` rows, the .d.cts twins) over
+ * the vendored copy, and bump the package.json pin to the installed
+ * version, preserving the original range-operator prefix. Then re-runs
+ * `checkRow` and returns whatever findings remain.
+ *
+ * This NEVER hand-edits a `hand-authored` twin (e.g. js-yaml.d.cts) — that
+ * file encodes a human's deliberate judgment about which exports are safe
+ * to expose, and only a human can tell whether a declared-export-missing
+ * finding is mechanical drift or a real upstream API break. If one remains
+ * after this runs, that is by design: the caller must not treat it as
+ * fixed.
+ * @param {VendoredPackage} row
+ * @param {string} [pkgRoot] Override for testing -- defaults to the real repo ROOT. Lets a
+ *   test point fixRow's pin-rewrite at an isolated temp package.json instead of writing the
+ *   real, shared one, which other concurrently-running node --test files read at module
+ *   top-level (the same race class already fixed for the vendored .cjs copy).
+ * @returns {string[]} findings remaining after the fix (empty when fully resolved)
+ */
+function fixRow(row, pkgRoot = ROOT) {
+  fs.copyFileSync(resolvePath(row.upstreamCjs), resolvePath(row.vendoredCjs));
+
+  if (row.twinKind === 'upstream-verbatim' && row.upstreamDts) {
+    if (row.vendoredDts) fs.copyFileSync(resolvePath(row.upstreamDts), resolvePath(row.vendoredDts));
+    if (row.srcTwin) fs.copyFileSync(resolvePath(row.upstreamDts), resolvePath(row.srcTwin));
+  }
+
+  const { pinnedSpec, installedVersion } = readPinState(row, pkgRoot);
+  if (pinnedSpec && installedVersion !== undefined) {
+    const newPin = `${pinOperatorPrefix(pinnedSpec)}${installedVersion}`;
+    if (newPin !== pinnedSpec) {
+      const pkgPath = path.join(pkgRoot, 'package.json');
+      const pkg = JSON.parse(fs.readFileSync(pkgPath, 'utf8'));
+      pkg.devDependencies[row.name] = newPin;
+      fs.writeFileSync(pkgPath, `${JSON.stringify(pkg, null, 2)}\n`);
+    }
+  }
+
+  return checkRow(row, pkgRoot);
+}
+
 function main() {
+  if (process.argv.includes('--fix')) {
+    /** @type {Record<string, string[]>} */
+    const remaining = {};
+    for (const row of VENDORED) {
+      const findings = fixRow(row);
+      if (findings.length > 0) remaining[row.name] = findings;
+    }
+
+    const names = VENDORED.map((row) => row.name).join(', ');
+
+    if (Object.keys(remaining).length === 0) {
+      process.stdout.write(
+        `ok lint-vendored-deps --fix: gsd-core/bin/lib/vendor/{${names}} refreshed and now match node_modules and their pinned versions\n`,
+      );
+      return 0;
+    }
+
+    const detail = Object.entries(remaining)
+      .map(([name, findings]) => `  ${name}:\n${findings.map((f) => `    ${f}`).join('\n')}`)
+      .join('\n');
+    throw new ExitError(
+      1,
+      `lint-vendored-deps --fix: mechanical drift refreshed, but the following row(s)\n`
+        + 'still have findings that --fix cannot resolve automatically — these need a\n'
+        + 'human, not just a re-run of --fix:\n'
+        + detail,
+    );
+  }
+
   const findings = [];
   for (const row of VENDORED) {
     findings.push(...checkRow(row));
@@ -288,9 +397,11 @@ if (require.main === module) runMain(main);
 module.exports = {
   compareFiles,
   stripRangeOperator,
+  pinOperatorPrefix,
   VENDORED,
   buildRefreshCommand,
   checkRow,
+  fixRow,
   declaredValueExports,
   checkHandAuthoredTwin,
   resolvePath,

package/scripts/lint-workflow-shellcheck-baseline.json

@@ -274,6 +274,26 @@
     "code": "2086",
     "message": "Double quote to prevent globbing and word splitting."
   },
+  {
+    "file": "gsd-core/workflows/complete-milestone/detail/elaboration.md",
+    "code": "2001",
+    "message": "See if you can use ${variable//search/replace} instead."
+  },
+  {
+    "file": "gsd-core/workflows/complete-milestone/detail/elaboration.md",
+    "code": "2001",
+    "message": "See if you can use ${variable//search/replace} instead."
+  },
+  {
+    "file": "gsd-core/workflows/complete-milestone/detail/elaboration.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/complete-milestone/detail/elaboration.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
   {
     "file": "gsd-core/workflows/debug.md",
     "code": "2010",
@@ -369,6 +389,11 @@
     "code": "2086",
     "message": "Double quote to prevent globbing and word splitting."
   },
+  {
+    "file": "gsd-core/workflows/execute-phase/detail/elaboration.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
   {
     "file": "gsd-core/workflows/execute-phase/steps/executor-isolation-dispatch.md",
     "code": "2016",
@@ -469,6 +494,56 @@
     "code": "2012",
     "message": "Use find instead of ls to better handle non-alphanumeric filenames."
   },
+  {
+    "file": "gsd-core/workflows/new-milestone.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/new-milestone.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/new-milestone.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/new-milestone.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/new-milestone.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/new-milestone.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/new-milestone.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/new-milestone.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/new-milestone.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/new-milestone.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
   {
     "file": "gsd-core/workflows/new-project.md",
     "code": "2012",
@@ -479,6 +554,16 @@
     "code": "2012",
     "message": "Use find instead of ls to better handle non-alphanumeric filenames."
   },
+  {
+    "file": "gsd-core/workflows/new-project/detail/elaboration.md",
+    "code": "2012",
+    "message": "Use find instead of ls to better handle non-alphanumeric filenames."
+  },
+  {
+    "file": "gsd-core/workflows/new-project/detail/elaboration.md",
+    "code": "2012",
+    "message": "Use find instead of ls to better handle non-alphanumeric filenames."
+  },
   {
     "file": "gsd-core/workflows/new-workspace.md",
     "code": "2164",
@@ -1023,5 +1108,20 @@
     "file": "gsd-core/workflows/verify-work/steps/mvp-uat-framing.md",
     "code": "2086",
     "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/execute-phase/steps/code-review-disposition.md",
+    "code": "2317",
+    "message": "Command appears to be unreachable. Check usage (or ignore if invoked indirectly)."
+  },
+  {
+    "file": "gsd-core/workflows/execute-phase/steps/code-review-disposition.md",
+    "code": "2317",
+    "message": "Command appears to be unreachable. Check usage (or ignore if invoked indirectly)."
+  },
+  {
+    "file": "gsd-core/workflows/execute-phase/steps/code-review-disposition.md",
+    "code": "2317",
+    "message": "Command appears to be unreachable. Check usage (or ignore if invoked indirectly)."
   }
 ]

package/scripts/prompt-injection-scan.sh

@@ -171,6 +171,10 @@ ALLOWLIST=(
   # allowlist cannot reach it either, because the literal `child_process` is
   # not adjacent to `.exec`. See the note at the pattern itself.
   'tests/continuation-grammar-parity.test.cjs'
+  # #4906 Phase 5 — regex.exec('### Phase 03: ...') fixtures.
+  # Same DEFECT.PROMPT-INJECTION-SCAN-COLLISION class as above:
+  # RegExp.prototype.exec, not code execution.
+  'tests/phase-id.test.cjs'
   # #3676 row 11b — quick-batch's task-list parser must treat a
   # prompt-injection-shaped task description as inert data, never
   # interpreted. The fixture has to be a real "ignore all previous
@@ -179,6 +183,20 @@ ALLOWLIST=(
   # rendering, never a command. Same DEFECT.PROMPT-INJECTION-SCAN-COLLISION
   # class as the input-validator fixtures above.
   'tests/quick-batch.test.cjs'
+  # #4209 — the regression test pinning gsd-code-reviewer.md's untrusted-evidence
+  # contract discusses the injection attack it defends against (embedded
+  # redirection, "act as an instruction") without performing it. gsd-code-reviewer.md
+  # ITSELF is deliberately NOT allowlisted — R2 (#4209 review): a production prompt
+  # that ingests untrusted third-party output should stay in-scope for this scanner,
+  # not be exempted wholesale; its defense-contract wording was reworded instead to
+  # avoid literally spelling out the trigger phrase (see git blame on that section).
+  # Same DEFECT.PROMPT-INJECTION-SCAN-COLLISION class as the entries above.
+  'tests/code-review-pipeline-regression.test.cjs'
+  # #4209 agy-F1 regression test — a crafted-filename fixture containing the literal
+  # phrase "Ignore all prior instructions." to prove validatePaths rejects it before
+  # it ever reaches an external-reviewer prompt. Discusses/detects the attack pattern
+  # as test data, never performs it. Same class as the entries above.
+  'tests/reviewer-step-dispatch.test.cjs'
 )
 
 is_allowlisted() {