@opengsd/gsd-core 1.14.0 → 1.15.0

package/scripts/lint-state-write-path-drift.cjs

@@ -162,6 +162,12 @@ const REASON = Object.freeze({
   // Axis 2 (§8.6, retained): a raw `fs.writeFileSync(` call targeting the
   // state path — see `findRawStateWrites`.
   RAW_STATE_WRITE: 'raw_state_write',
+  // ADR-4629 §8.1 (epic #4629, C1): a residual `readModifyWriteStateMd(path,
+  // (content) => …)` call whose transform is an inline anonymous arrow/function
+  // — the opaque shape §8.1 replaces with a declared StateWriteIntent. Recognized
+  // by `findOpaqueStateTransforms`; a CAPABILITY in C1 (not wired into collect()),
+  // wired terminal in C2 as the residual callers migrate (ADR-3408 §6 phasing).
+  OPAQUE_STATE_TRANSFORM: 'opaque_state_transform',
   // Axis 4 (§8.3, Decision 4(d)): prompt-layer prose shelling out to a
   // write-side `gsd-tools` subcommand — see `findPromptSeamUses`.
   PROMPT_LAYER_STATE_WRITE: 'prompt_layer_state_write',
@@ -645,6 +651,91 @@ function findRawStateWrites(rel, text) {
   return out;
 }
 
+// ADR-4629 §8.1 (epic #4629, C1) — OPAQUE-TRANSFORM RECOGNITION.
+//
+// A residual `readModifyWriteStateMd(path, (content) => …)` call whose transform
+// (2nd) argument is an inline anonymous arrow / function expression is the opaque
+// shape §8.1 replaces with a declared StateWriteIntent: `readModifyWriteStateMd`
+// goes THROUGH the seam (it is NOT a raw-write bypass — Axis 2's concern), but its
+// opaque body transform is neither verified (§8.2) nor bounded (§8.3). This
+// function RECOGNIZES that shape.
+//
+// C1 ships recognition as a CAPABILITY: it is exported and unit-tested (positive
+// control on a seeded fixture) but is DELIBERATELY NOT wired into `collect()`'s
+// failing scan. §8.1's caller-side rule is *Required — Phase 2*; wiring it now
+// would turn the ~16 residual callers red at once, and ADR-3473 §8.6 retired the
+// ratchet that would otherwise be needed to absorb them. C2 wires this terminal as
+// the verifying executor lands and the callers migrate under ADR-3408 §6 phasing.
+//
+// String match, never an AST — same over-report-safe posture as every axis here.
+const OPAQUE_RMW_CALL_RE = /\breadModifyWriteStateMd\s*\(/g;
+// The transform arg is OPAQUE when it BEGINS an inline anonymous function: an
+// arrow (`(…) =>`, `ident =>`, optionally `async`) or a `function` expression. A
+// bare identifier / object (a declared StateWriteIntent, Phase 2+) is NOT opaque.
+const ANON_TRANSFORM_RE =
+  /^\s*(?:async\s+)?(?:\([^)]*\)|[A-Za-z_$][\w$]*)\s*=>|^\s*(?:async\s+)?function\b/;
+
+/**
+ * Capture the top-level, comma-separated argument list of a call, starting at
+ * `startIdx` (the index just AFTER the opening `(`) — across newlines and
+ * string-aware, tracking `()[]{}` depth. Returns the raw arg strings, or null if
+ * the parens never balance (a truncated arg list is never flagged). Generalizes
+ * `captureFirstArg`'s depth/inStr bookkeeping to every argument.
+ */
+function captureCallArgList(text, startIdx) {
+  let depth = 0;
+  let inStr = null;
+  const args = [];
+  let cur = '';
+  for (let i = startIdx; i < text.length; i++) {
+    const ch = text[i];
+    if (inStr) {
+      cur += ch;
+      if (ch === inStr && text[i - 1] !== '\\') inStr = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === '`') { inStr = ch; cur += ch; continue; }
+    if (ch === '(' || ch === '[' || ch === '{') { depth++; cur += ch; continue; }
+    if (ch === ')' || ch === ']' || ch === '}') {
+      if (ch === ')' && depth === 0) {
+        if (cur.trim() !== '' || args.length) args.push(cur);
+        return args;
+      }
+      depth--; cur += ch; continue;
+    }
+    if (ch === ',' && depth === 0) { args.push(cur); cur = ''; continue; }
+    cur += ch;
+  }
+  return null; // parens never balanced
+}
+
+/**
+ * Recognize residual opaque-transform STATE.md writes (ADR-4629 §8.1). Returns a
+ * finding per `readModifyWriteStateMd(` call whose 2nd argument is an inline
+ * anonymous transform. CAPABILITY only in C1 — not called by `collect()`.
+ */
+function findOpaqueStateTransforms(rel, text) {
+  const rawLines = text.split('\n');
+  const stripped = stripComments(text).join('\n');
+  const out = [];
+  let m;
+  OPAQUE_RMW_CALL_RE.lastIndex = 0;
+  while ((m = OPAQUE_RMW_CALL_RE.exec(stripped)) !== null) {
+    const args = captureCallArgList(stripped, m.index + m[0].length);
+    if (!args || args.length < 2) continue;
+    if (!ANON_TRANSFORM_RE.test(args[1])) continue;
+    const lineNo = stripped.slice(0, m.index).split('\n').length;
+    out.push({
+      reason: REASON.OPAQUE_STATE_TRANSFORM,
+      axis: 'opaque-transform',
+      file: sanitizeForReport(rel),
+      line: lineNo,
+      source: sanitizeForReport((rawLines[lineNo - 1] || '').trim()),
+    });
+  }
+  return out;
+}
+
 // The two write-seam STAGE functions, matched only as CALLS (`\(`
 // immediately after, modulo whitespace) — never as bare mentions of the
 // name. `writeStateMd(` is deliberately NOT included here (that arm is
@@ -941,6 +1032,8 @@ module.exports = {
   nearestPrecedingAssignment,
   findRawStateWrites,
   targetsStatePath,
+  findOpaqueStateTransforms,
+  captureCallArgList,
   findCompositionBypasses,
   findPromptSeamUses,
   isInsideCodeSpan,

package/scripts/lint-test-file-count.allowlist.json

@@ -1,6 +1,15 @@
 {
-  "_doc": "Baseline of modules currently exceeding the 2-test-file limit. Each entry locks in TODAY's exact test filenames as the allowlisted set (identity ratchet). Adding a NEW test file to a capped module fails (novel). Removing one requires pruning this list (stale, ratchet-down). When a cluster drops to \u2264 2, remove its entry entirely. New entries require justification in PR description.",
+  "_doc": "Baseline of modules currently exceeding the 2-test-file limit. Each entry locks in TODAY's exact test filenames as the allowlisted set (identity ratchet). Adding a NEW test file to a capped module fails (novel). Removing one requires pruning this list (stale, ratchet-down). When a cluster drops to ≤ 2, remove its entry entirely. New entries require justification in PR description.",
   "modules": {
+    "ui-consideration-probe": {
+      "files": [
+        "ui-consideration-probe-docs-fixtures.test.cjs",
+        "ui-consideration-probe-ui-phase-contract.test.cjs",
+        "ui-consideration-probe.test.cjs"
+      ],
+      "issue": "4657",
+      "justification": "The ui-consideration-probe cluster gains its workflow-prose contract file (tests/ui-consideration-probe-ui-phase-contract.test.cjs, #4657), mirroring the edge probe's split (edge-probe.test.cjs / edge-probe-docs-fixtures.test.cjs / edge-probe-spec-phase-contract.test.cjs). The contract file reads shipped gsd-core/workflows/ui-phase.md under the source-text-is-the-product exception, which the unit file deliberately does not carry (it asserts typed returns only)."
+    },
     "adr-parser": {
       "files": [
         "adr-parser.property.test.cjs",
@@ -40,7 +49,7 @@
         "frontmatter.unit.test.cjs"
       ],
       "issue": "3881",
-      "justification": "Grandfathered by #3227 for the original 4-file cluster (pre-existing over-cap, not new sprawl). #3881 (ADR-3473 \u00a78.1, the js-yaml parser migration) adds two more: frontmatter-golden-parity.test.cjs (D-series golden-corpus diff against the legacy parser, ~900 real documents \u2014 cannot be folded into an existing file without losing its independent-of-current-parser provenance) and frontmatter-roundtrip.property.test.cjs (fast-check property coverage the migration's bijective-contract rule requires). Both are migration-specific, not incidental sprawl."
+      "justification": "Grandfathered by #3227 for the original 4-file cluster (pre-existing over-cap, not new sprawl). #3881 (ADR-3473 §8.1, the js-yaml parser migration) adds two more: frontmatter-golden-parity.test.cjs (D-series golden-corpus diff against the legacy parser, ~900 real documents — cannot be folded into an existing file without losing its independent-of-current-parser provenance) and frontmatter-roundtrip.property.test.cjs (fast-check property coverage the migration's bijective-contract rule requires). Both are migration-specific, not incidental sprawl."
     },
     "graphify": {
       "files": [
@@ -137,10 +146,11 @@
         "verify-npm-publish.test.cjs",
         "verify-test-quality.test.cjs",
         "verify-work-auto-transition.test.cjs",
+        "verify-work-deferred-promotion.test.cjs",
         "verify.test.cjs"
       ],
-      "issue": "#3813 \u2014 the live-path #1883 suite drives buildPlanningSnapshot in-process with an fs fault; the verify module suites are CLI-driving and cannot host an fs monkeypatch",
-      "justification": "verify-command-grounding added by #2401/#3678; allowlist follow-up landed with #3606 (base was red on this lane)."
+      "issue": "#3813 — the live-path #1883 suite drives buildPlanningSnapshot in-process with an fs fault; the verify module suites are CLI-driving and cannot host an fs monkeypatch",
+      "justification": "verify-command-grounding added by #2401/#3678; allowlist follow-up landed with #3606 (base was red on this lane). #4546 adds verify-work-deferred-promotion (deferred-follow-up promotion writer contract + parity)."
     },
     "install": {
       "files": [
@@ -154,7 +164,7 @@
         "install-write-confinement.test.cjs",
         "install.test.cjs"
       ],
-      "issue": "#3798 \u2014 the profile-closure spawn test reads the real repo surface (commands+workflows+agents); consolidating it into install.test.cjs would put a whole-repo scan behind the suite's heaviest file"
+      "issue": "#3798 — the profile-closure spawn test reads the real repo surface (commands+workflows+agents); consolidating it into install.test.cjs would put a whole-repo scan behind the suite's heaviest file"
     },
     "edge-probe": {
       "files": [
@@ -252,8 +262,8 @@
         "docs-state-md-locale-parity.test.cjs",
         "docs-update.test.cjs"
       ],
-      "issue": "3873 | #3839 \u2014 the hook-event parity suite cross-checks the four docs hook tables against src/runtime-hooks-surface.cts registrations; a generated-docs concern distinct from content freshness and registry parity",
-      "justification": "ADR-3473 \u00a78.8 makes docs/reference/state-md.md and its four locale siblings generated-and-committed and adds the repo's first locale-parity check (verified: no locale-parity lint precedent exists here). That check is a distinct concern from docs-update (content freshness) and docs-parity-live-registry (registry parity); folding it into either would place an unrelated subject inside them purely to satisfy a count. The section it guards is absent from all four translations today and documents the status enum behind #3853."
+      "issue": "3873 | #3839 — the hook-event parity suite cross-checks the four docs hook tables against src/runtime-hooks-surface.cts registrations; a generated-docs concern distinct from content freshness and registry parity",
+      "justification": "ADR-3473 §8.8 makes docs/reference/state-md.md and its four locale siblings generated-and-committed and adds the repo's first locale-parity check (verified: no locale-parity lint precedent exists here). That check is a distinct concern from docs-update (content freshness) and docs-parity-live-registry (registry parity); folding it into either would place an unrelated subject inside them purely to satisfy a count. The section it guards is absent from all four translations today and documents the status enum behind #3853."
     },
     "audit": {
       "files": [
@@ -265,7 +275,7 @@
         "audit-uat-summary-segmentation.test.cjs",
         "audit-workstream-layouts.test.cjs"
       ],
-      "issue": "#3804/#3805 \u2014 audit-layout and acknowledged-marker suites drive the real audit-uat CLI against on-disk fixtures | #3817 \u2014 regression suite proving countReal counts the truncation remainder marker instead of treating it as one phantom item | #3783 \u2014 dedicated suite for the summary.current_milestone/archived segmentation, matching this module's one-file-per-feature-slice precedent (e.g. audit-uat-acknowledged.test.cjs) rather than growing the unrelated 6900+ line tests/uat.test.cjs (a different module, keyed off uat.cjs)"
+      "issue": "#3804/#3805 — audit-layout and acknowledged-marker suites drive the real audit-uat CLI against on-disk fixtures | #3817 — regression suite proving countReal counts the truncation remainder marker instead of treating it as one phantom item | #3783 — dedicated suite for the summary.current_milestone/archived segmentation, matching this module's one-file-per-feature-slice precedent (e.g. audit-uat-acknowledged.test.cjs) rather than growing the unrelated 6900+ line tests/uat.test.cjs (a different module, keyed off uat.cjs)"
     },
     "shell-command-projection": {
       "files": [
@@ -273,7 +283,16 @@
         "shell-command-projection-md-normalize.test.cjs",
         "shell-command-projection-path-sep.test.cjs"
       ],
-      "issue": "#3854 \u2014 the tight-list suite pins the markdown write-normalizer's blank-line policy through the exported normalizeContent/platformWriteSync seam; a distinct concern from dispatch routing and path separation"
+      "issue": "#3854 — the tight-list suite pins the markdown write-normalizer's blank-line policy through the exported normalizeContent/platformWriteSync seam; a distinct concern from dispatch routing and path separation"
+    },
+    "ui-consideration-probe": {
+      "files": [
+        "ui-consideration-probe-docs-fixtures.test.cjs",
+        "ui-consideration-probe-ui-phase-contract.test.cjs",
+        "ui-consideration-probe.test.cjs"
+      ],
+      "issue": "4657",
+      "justification": "The ui-consideration-probe cluster gains its workflow-prose contract file (tests/ui-consideration-probe-ui-phase-contract.test.cjs, #4657), mirroring the edge probe's split (edge-probe.test.cjs / edge-probe-docs-fixtures.test.cjs / edge-probe-spec-phase-contract.test.cjs). The contract file reads shipped gsd-core/workflows/ui-phase.md under the source-text-is-the-product exception, which the unit file deliberately does not carry (it asserts typed returns only)."
     }
   }
 }

package/scripts/lint-workflow-shellcheck-baseline.json

@@ -1108,5 +1108,20 @@
     "file": "gsd-core/workflows/verify-work/steps/mvp-uat-framing.md",
     "code": "2086",
     "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/execute-phase/steps/code-review-disposition.md",
+    "code": "2317",
+    "message": "Command appears to be unreachable. Check usage (or ignore if invoked indirectly)."
+  },
+  {
+    "file": "gsd-core/workflows/execute-phase/steps/code-review-disposition.md",
+    "code": "2317",
+    "message": "Command appears to be unreachable. Check usage (or ignore if invoked indirectly)."
+  },
+  {
+    "file": "gsd-core/workflows/execute-phase/steps/code-review-disposition.md",
+    "code": "2317",
+    "message": "Command appears to be unreachable. Check usage (or ignore if invoked indirectly)."
   }
 ]

package/scripts/prompt-injection-scan.sh

@@ -171,6 +171,10 @@ ALLOWLIST=(
   # allowlist cannot reach it either, because the literal `child_process` is
   # not adjacent to `.exec`. See the note at the pattern itself.
   'tests/continuation-grammar-parity.test.cjs'
+  # #4906 Phase 5 — regex.exec('### Phase 03: ...') fixtures.
+  # Same DEFECT.PROMPT-INJECTION-SCAN-COLLISION class as above:
+  # RegExp.prototype.exec, not code execution.
+  'tests/phase-id.test.cjs'
   # #3676 row 11b — quick-batch's task-list parser must treat a
   # prompt-injection-shaped task description as inert data, never
   # interpreted. The fixture has to be a real "ignore all previous

package/scripts/release-tarball-smoke.cjs

@@ -37,6 +37,12 @@
  *     colon-namespace leaks (WORKFLOW_BODY_COLON_LEAK).
  *   This check populates result.details with counters but does NOT return a
  *   failure code by default; it is informational until enforcement is enabled.
+ *
+ * Configured-entrypoint checks (Cycle 4 — #4154):
+ *   For each runtime in entrypointRuntimes, runs the tarball-installed
+ *   installer into a throwaway HOME, then re-reads that runtime's own written
+ *   config files and asserts every GSD-managed script path they name resolves
+ *   to a file (ENTRYPOINT_UNRESOLVED). Requires fixtureDir.
  */
 
 'use strict';
@@ -47,6 +53,8 @@ const os = require('os');
 const path = require('path');
 const { PACKAGE_NAME } = require('../gsd-core/bin/lib/package-identity.cjs');
 const { ExitError, runMain } = require('./lib/cli-exit.cjs');
+const shellCmdProjection = require('../gsd-core/bin/lib/shell-command-projection.cjs');
+const { escapeRegex } = require('../gsd-core/bin/lib/pattern.cjs');
 // 120 s proved too tight for cold-cache `npm install -g` of a 1499-file tarball:
 // spawnSync fires SIGTERM at the deadline and returns { status: null, stdout: '',
 // stderr: '' } (Node docs: status is null when a subprocess is terminated by a
@@ -86,6 +94,8 @@ const SMOKE = Object.freeze({
   INIT_FAILED: 'init_failed',
   // Cycle 3 code
   WORKFLOW_BODY_COLON_LEAK: 'workflow_body_colon_leak',
+  // Cycle 4 code (#4154)
+  ENTRYPOINT_UNRESOLVED: 'entrypoint_unresolved',
 });
 
 // ---------------------------------------------------------------------------
@@ -274,6 +284,106 @@ function scanWorkflowColonLeak(filePath, cmdNames) {
   return null;
 }
 
+// ---------------------------------------------------------------------------
+// Cycle 4 helpers: configured-entrypoint resolution (#4154)
+// ---------------------------------------------------------------------------
+
+/**
+ * Top-level config files this scan reads. These are the surfaces that carry
+ * every GSD-managed launch path for the runtimes Cycle 4 actually installs
+ * (`entrypointRuntimes`, default claude + codex): claude registers into
+ * settings.json, codex into hooks.json and config.toml.
+ *
+ * This is NOT an exhaustive map of where GSD writes launch paths across all
+ * runtimes, and the scan is top-level only by design. Two known surfaces sit
+ * outside it: Cline registers its hook at `.clinerules/hooks/PreToolUse` (a
+ * subdirectory, and not one of these names — see writeClineArtifacts in
+ * src/runtime-hooks-surface.cts), and Kimi's native `[[hooks]]` config.toml
+ * lives under `resolveKimiHooksTomlDir()` (`~/.kimi`), a directory separate
+ * from Kimi's own GSD configDir. Adding either runtime to entrypointRuntimes
+ * requires teaching scanConfiguredEntrypoints about its surface first,
+ * otherwise the scan reports zero entrypoints and silently proves nothing.
+ */
+const RUNTIME_CONFIG_FILES = Object.freeze(['settings.json', 'hooks.json', 'config.toml']);
+
+/**
+ * Extract every script path `text` names underneath `configDir`.
+ *
+ * #4249 (antigravity review): anchored on the literal, already-known
+ * `configDir` prefix instead of a generic "any absolute path" character
+ * class. The prior version excluded whitespace from the match to avoid
+ * swallowing a shell command's trailing args, which also truncated any
+ * legitimate path containing a space (e.g. `/Users/John Doe/.claude`) —
+ * `scanConfiguredEntrypoints` would then silently report zero checked
+ * paths. Anchoring on `configDir` removes the ambiguity outright: a match
+ * can only start where the known prefix literally occurs in the text, so
+ * an interpreter path concatenated ahead of it (`"/usr/bin/node
+ * /configDir/hooks/foo.js"`) is never swallowed either, and interior
+ * whitespace inside `configDir` or the script's own path segments is safe
+ * to allow. This still scans raw, unparsed config text on purpose (see
+ * scanConfiguredEntrypoints's doc comment) — it catches a writer that
+ * embeds a launch path without registering it, which a structured
+ * JSON.parse of the expected schema would miss entirely.
+ *
+ * Windows configs store paths with backslashes, which JSON/TOML doubles on
+ * write; collapsing `\\` to `\` first makes the raw text scan work on both
+ * platforms without parsing each config format separately (POSIX text has no
+ * backslashes, so the collapse is a no-op there).
+ *
+ * Every writer bakes `configDir` through the same posixNormalize seam
+ * (src/runtime-hooks-surface.cts) before writing it into config text, on
+ * every platform — so the anchor must match that projection, not the
+ * OS-native `configDir` string this function receives.
+ */
+function configuredEntrypointsIn(text, configDir) {
+  const normalizedPrefix = shellCmdProjection.posixNormalize(configDir).replace(/\/+$/, '') + '/';
+  const scriptPathRe = new RegExp(`${escapeRegex(normalizedPrefix)}[^"']{0,400}?\\.(?:js|cjs|mjs|sh|cmd|ps1)`, 'g');
+  const found = new Set();
+  for (const match of text.replace(/\\\\/g, '\\').matchAll(scriptPathRe)) {
+    found.add(path.resolve(match[0]));
+  }
+  return [...found];
+}
+
+/**
+ * Throwaway HOME the Cycle 4 install for `runtime` runs against. Exported so a
+ * test can seed that runtime's config before the install rather than
+ * hard-coding the layout runSmoke picks.
+ */
+function entrypointFixtureHome(fixtureDir, runtime) {
+  return path.join(fixtureDir, `entrypoints-${runtime}`);
+}
+
+/**
+ * Re-derive the configured entrypoints a completed install wrote into a
+ * runtime's own config files and report the ones that do not resolve to a
+ * file. Internal to Cycle 4; the smoke's verdict is the exported contract.
+ *
+ * This deliberately does NOT consult the installer's own entrypoint list (the
+ * assertConfiguredEntrypoints gate in bin/install.js). That gate can only
+ * validate paths a config writer remembered to register; reading the written
+ * config back is what catches a writer that emits a launch path without
+ * registering it, and a stale registration an install left behind.
+ *
+ * @param {string} configDir - Absolute path to the runtime config dir.
+ * @returns {{ checked: string[], unresolved: { configPath: string, scriptPath: string }[] }}
+ */
+function scanConfiguredEntrypoints(configDir) {
+  const checked = [];
+  const unresolved = [];
+  for (const name of RUNTIME_CONFIG_FILES) {
+    const configPath = path.join(configDir, name);
+    if (!fs.existsSync(configPath) || !fs.statSync(configPath).isFile()) continue;
+    const text = fs.readFileSync(configPath, 'utf-8');
+    for (const scriptPath of configuredEntrypointsIn(text, configDir)) {
+      checked.push(scriptPath);
+      if (fs.existsSync(scriptPath) && fs.statSync(scriptPath).isFile()) continue;
+      unresolved.push({ configPath, scriptPath });
+    }
+  }
+  return { checked, unresolved };
+}
+
 // ---------------------------------------------------------------------------
 // Pure function: runSmoke
 // ---------------------------------------------------------------------------
@@ -285,6 +395,8 @@ function scanWorkflowColonLeak(filePath, cmdNames) {
  * @param {string}   opts.expectedVersion    - semver string to assert (e.g. "1.50.0")
  * @param {string}   [opts.fixtureDir]       - Temp dir to run `init` into (must NOT be HOME)
  * @param {string[]} [opts.lifecycleCommands] - Commands to file-check (default: see below)
+ * @param {string[]} [opts.entrypointRuntimes] - Runtime profiles whose configured entrypoints are
+ *   re-checked after a real install (default: see below). Requires fixtureDir; pass [] to skip.
  * @param {boolean}  [opts.dryRun=false]     - If true, skip actual npm install; validate input only
  * @param {object}   [opts.npmEnv]           - Optional env dict for the internal npm install
  *   spawnSync call. Pass an isolated HOME env (e.g. from isolatedNpmEnv() in tests/helpers.cjs)
@@ -298,6 +410,11 @@ function runSmoke({
   expectedVersion,
   fixtureDir,
   lifecycleCommands = ['init', 'discuss-phase', 'plan-phase', 'execute-phase'],
+  // claude and codex cover the two top-level config surfaces this scan knows
+  // how to read (settings.json, and hooks.json + config.toml). Most other
+  // runtimes reuse one of those two shapes; Cline and Kimi do not (see
+  // RUNTIME_CONFIG_FILES), so they are out of scope here rather than covered.
+  entrypointRuntimes = ['claude', 'codex'],
   dryRun = false,
   npmEnv = undefined,
 }) {
@@ -551,6 +668,75 @@ function runSmoke({
   // NOTE: colonLeakCount is informational here. Once the backlog is fixed,
   // a future enforcement mode can fail on non-zero counts.
 
+  // ─────────────────────────────────────────────────────────────────────────
+  // Cycle 4: configured-entrypoint resolution (#4154)
+  // ─────────────────────────────────────────────────────────────────────────
+
+  // The installer's own gate (assertConfiguredEntrypoints) runs in-process and
+  // only sees the paths a config writer registered with it. Installing the
+  // packed tarball for real and reading each runtime's written config back is
+  // what proves the launch paths a user's runtime will actually invoke exist
+  // in the shipped layout.
+  const entrypointProfiles = [];
+  if (fixtureDir && entrypointRuntimes.length > 0) {
+    for (const runtime of entrypointRuntimes) {
+      // Own HOME per runtime so a --global install cannot reach the real one.
+      const runtimeHome = entrypointFixtureHome(fixtureDir, runtime);
+      const configDir = path.join(runtimeHome, `.${runtime}`);
+      fs.mkdirSync(runtimeHome, { recursive: true });
+
+      const installResult = spawnSync(
+        process.execPath,
+        [path.join(pkg, 'bin', 'install.js'), `--${runtime}`, '--global', '--config-dir', configDir],
+        {
+          encoding: 'utf-8',
+          cwd: runtimeHome,
+          stdio: ['pipe', 'pipe', 'pipe'],
+          env: {
+            ...effectiveNpmEnv,
+            HOME: runtimeHome,
+            USERPROFILE: runtimeHome,
+            // Same reason as the init check above: install.js skips its main()
+            // block when GSD_TEST_MODE is set and would exit 0 writing nothing.
+            GSD_TEST_MODE: '',
+            NO_UPDATE_NOTIFIER: '1',
+          },
+          timeout: CHILD_TIMEOUT_MS,
+        },
+      );
+
+      if (installResult.status !== 0) {
+        // #4249 (antigravity review): this is the Cycle 4 per-runtime install,
+        // not Cycle 1's `gsd init` — SMOKE.INSTALL_FAILED is the code Cycle 2's
+        // identical spawnSync-failure check already uses for the same failure
+        // class; reusing SMOKE.INIT_FAILED here conflated the two lifecycle
+        // stages in the reported code.
+        return {
+          code: SMOKE.INSTALL_FAILED,
+          details: {
+            ...details,
+            runtime,
+            configDir,
+            stderr: installResult.stderr,
+            stdout: installResult.stdout,
+          },
+        };
+      }
+
+      const scan = scanConfiguredEntrypoints(configDir);
+      if (scan.unresolved.length > 0) {
+        return {
+          code: SMOKE.ENTRYPOINT_UNRESOLVED,
+          details: { ...details, runtime, configDir, unresolved: scan.unresolved },
+        };
+      }
+
+      entrypointProfiles.push({ runtime, configDir, entrypointsChecked: scan.checked.length });
+    }
+  }
+
+  details.entrypointProfiles = entrypointProfiles;
+
   return { code: SMOKE.OK, details };
 }
 
@@ -635,7 +821,14 @@ function cleanup(...dirs) {
 // Exports
 // ---------------------------------------------------------------------------
 
-module.exports = { SMOKE, runSmoke, binInvocation, CHILD_TIMEOUT_MS };
+module.exports = {
+  SMOKE,
+  runSmoke,
+  binInvocation,
+  entrypointFixtureHome,
+  CHILD_TIMEOUT_MS,
+  configuredEntrypointsIn,
+};
 
 if (require.main === module) {
   runMain(cliMain);

package/skills/gsd-autonomous/SKILL.md

@@ -36,10 +36,10 @@ Optional flags:
 - `--to N` — stop after phase N completes (halt instead of advancing to next phase).
 - `--only N` — execute only phase N (single-phase mode).
 - `--interactive` — run discuss inline with questions (not auto-answered), then dispatch plan→execute as background agents. Keeps the main context lean while preserving user input on decisions.
-- `--converge` — run each phase's planning step through `gsd-plan-review-convergence` instead of plain `gsd-plan-phase`. Requires `workflow.plan_review_convergence=true`.
+- `--converge` — run each phase's planning step through `gsd-plan-review-convergence` instead of plain `gsd-plan-phase`. Works even when `workflow.plan_review_convergence` is `false` — the explicit flag overrides the gate; the gate (`workflow.plan_review_convergence=true` enables it) governs the standalone `gsd-plan-review-convergence` command. Without the flag, planning runs `gsd-plan-phase`.
 - `--cross-ai` — compatibility alias for `--converge`.
 
-When `--converge` or `--cross-ai` is set, reviewer selector flags supported by `gsd-plan-review-convergence` may be passed through: `--codex`, `--gemini`, `--claude`, `--opencode`, `--ollama`, `--lm-studio`, `--llama-cpp`, `--all`, and `--max-cycles N`.
+When `--converge` or `--cross-ai` is set, reviewer selector flags supported by `gsd-plan-review-convergence` may be passed through: `--codex`, `--claude`, `--opencode`, `--ollama`, `--lm-studio`, `--llama-cpp`, `--all`, and `--max-cycles N`.
 
 Project context, phase list, and state are resolved inside the workflow using init commands (`gsd-tools query init.milestone-op`, `gsd-tools query roadmap.analyze`). No upfront context loading needed.
 </context>

package/skills/gsd-capture/SKILL.md

@@ -32,7 +32,7 @@ Mode routing:
 | (none) | Structured todo in .planning/todos/ | add-todo |
 | --note | Timestamped note file, list, or promote | note |
 | --backlog | ROADMAP.md backlog section (999.x) | add-backlog |
-| --seed | .planning/seeds/SEED-NNN-slug.md | plant-seed |
+| --seed | .planning/seeds/SEED-YYMMDD-xxx-slug.md | plant-seed |
 | --list | Interactive todo browser + action router | check-todos |
 | --list-seeds | Read-only seed list/audit (optional status filter) | list-seeds |
 

package/skills/gsd-mempalace-capture/SKILL.md

@@ -84,15 +84,19 @@ On any error or timeout, stop and let the phase continue -- capture is best-effo
    ROOM_DIR="$STAGE/<room>/<phase-id>"
    mkdir -p "$ROOM_DIR"
    cp "<artifact-path>" "$ROOM_DIR/<basename>"
-   # Mine with --wing only — no --room flag; detect_room() assigns from the folder path
-   mempalace mine "$STAGE" --wing <wing>
+   # Mine with --wing only — no --room flag; detect_room() assigns from the folder path.
+   # --daemon --background (#4700): MemPalace wraps every mine in a per-palace
+   # lock; a concurrent writer would make a foreground mine exit 1
+   # (MineAlreadyRunning) and this onError: skip step would silently drop the
+   # capture. The background queue defers the job until the lock frees.
+   mempalace mine "$STAGE" --wing <wing> --daemon --background
    ```
 3. **Mirror KG facts** unless `config.mempalace.mirror_kg === false` (registry default is true — an absent key means enabled): extract decision/delivery facts and `mempalace_kg_add` them with `valid_from` = the phase date (e.g. `(<project>, decided, <decision>)` from CONTEXT; `(<phase>, delivered, <capability>)` from SUMMARY). Under `augment` these are an *additive* mirror of GSD's native `.planning/graphs/`. Under `kg_backend`/`replace` the palace KG is the *authoritative* fact store — GSD still produces `.planning/graphs/` through its normal graphify, so an unreachable palace never loses a fact.
 4. Re-running a phase MUST NOT create duplicate drawers (deterministic ids + `check_duplicate`).
 
 ## Step 4 -- Report
 
-Print a one-line summary: `Filed <artifact> → <wing>/<room> (<n> KG facts)` or `MemPalace unavailable — capture skipped`.
+Print a one-line summary: `Filed <artifact> → <wing>/<room> (<n> KG facts)`, `Capture queued — palace busy; MemPalace will file it when the lock frees` (the background mine was deferred behind another writer), or `MemPalace capture skipped — <reason>` (#4700: a skipped capture is never silent).
 
 ## Anti-Patterns
 

package/skills/gsd-plan-review-convergence/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: gsd-plan-review-convergence
 description: "Cross-AI plan convergence - replan until review concerns are resolved."
-argument-hint: "<phase> [--gemini] [--claude] [--codex] [--coderabbit] [--opencode] [--qwen] [--cursor] [--antigravity] [--agy] [--ollama] [--lm-studio] [--llama-cpp] [--kimi-code] [--text] [--ws <name>] [--all] [--max-cycles N]"
+argument-hint: "<phase> [--claude] [--codex] [--coderabbit] [--opencode] [--qwen] [--cursor] [--antigravity] [--agy] [--ollama] [--lm-studio] [--llama-cpp] [--kimi-code] [--text] [--ws <name>] [--all] [--max-cycles N]"
 allowed-tools:
   - Read
   - Write
@@ -20,7 +20,7 @@ Repeatedly: review plans with external AI CLIs → if HIGH or actionable non-HIG
 
 **Flow:** Skill("gsd-plan-phase") → Agent→Skill("gsd-review") → check unresolved HIGH + actionable non-HIGH → Skill("gsd-plan-phase --reviews") → Agent→Skill("gsd-review") → ... → Converge or escalate
 
-Replaces gsd-plan-phase's internal gsd-plan-checker with external AI reviewers (codex, gemini, etc.). Plan-phase runs **inline** (bare Skill at depth 0) so it can spawn gsd-planner/gsd-plan-checker at depth 1. Review runs inside an isolated Agent (gsd-review is a Bash leaf — no sub-agents needed). Orchestrator only does loop control.
+Replaces gsd-plan-phase's internal gsd-plan-checker with external AI reviewers (codex, claude, etc.). Plan-phase runs **inline** (bare Skill at depth 0) so it can spawn gsd-planner/gsd-plan-checker at depth 1. Review runs inside an isolated Agent (gsd-review is a Bash leaf — no sub-agents needed). Orchestrator only does loop control.
 
 **Orchestrator role:** Parse arguments, validate phase, run plan-phase inline (Skill at depth 0), spawn an Agent for gsd-review, check unresolved HIGH and actionable non-HIGH counts, stall detection, escalation gate.
 </objective>
@@ -41,8 +41,7 @@ Phase number: extracted from $ARGUMENTS (required)
 
 **Flags:**
 - `--codex` — Use Codex CLI as reviewer (default if no reviewer flag given AND `review.default_reviewers` is unset; otherwise `review.default_reviewers` wins per ADR-0011 — #2315)
-- `--gemini` — Use Gemini CLI as reviewer
-- `--agy` / `--antigravity` — Use Antigravity CLI as reviewer (successor to the discontinued Gemini CLI)
+- `--agy` / `--antigravity` — Use Antigravity CLI as reviewer
 - `--claude` — Use Claude CLI as reviewer (separate session)
 - `--coderabbit` — Use CodeRabbit as reviewer (reviews the working-tree diff, not the source tree)
 - `--opencode` — Use OpenCode as reviewer
@@ -56,7 +55,8 @@ Phase number: extracted from $ARGUMENTS (required)
 - `--max-cycles N` — Maximum replan→review cycles (default: 3)
 
 **Feature gate:** This command requires `workflow.plan_review_convergence=true`. Enable with:
-`gsd config-set workflow.plan_review_convergence true`
+`gsd config-set workflow.plan_review_convergence true`. A dispatch carrying `--override-gate` —
+how `/gsd-autonomous --converge` invokes this workflow (#4600) — bypasses the gate for that run.
 </context>
 
 <process>

package/skills/gsd-progress/SKILL.md

@@ -24,7 +24,7 @@ Three modes:
 <flags>
 - **--next**: Detect current project state and automatically invoke the next logical GSD workflow step. Scans all prior phases for incomplete work before routing. `--next --force` bypasses safety gates.
 - **--next --auto**: Like `--next`, but after the determined step completes, automatically re-invokes `/gsd-progress --next --auto` to continue chaining steps until completion or a blocking decision. Enables hands-free plan→execute→verify→complete progression.
-- **--next --converge**: When the next action is planning (Route 3), route it through the plan-review **convergence** loop instead of the standard planner. Requires `workflow.plan_review_convergence=true` (enable with `gsd config-set workflow.plan_review_convergence true`). `--cross-ai` is an alias. Reviewer flags (`--codex`, `--gemini`, `--claude`, `--opencode`, `--ollama`, `--lm-studio`, `--llama-cpp`, `--all`) and `--max-cycles N` are forwarded to the convergence loop.
+- **--next --converge**: When the next action is planning (Route 3), route it through the plan-review **convergence** loop instead of the standard planner. Requires `workflow.plan_review_convergence=true` (enable with `gsd config-set workflow.plan_review_convergence true`). `--cross-ai` is an alias. Reviewer flags (`--codex`, `--claude`, `--opencode`, `--ollama`, `--lm-studio`, `--llama-cpp`, `--all`) and `--max-cycles N` are forwarded to the convergence loop.
 - **--do "..."**: Smart dispatcher — match freeform intent to the best GSD command using routing rules, confirm the match, then hand off.
 - **--forensic**: Run 6-check integrity audit after the standard progress report.
 - **(no flag)**: Standard progress check + intelligent routing (Routes A through F).

package/skills/gsd-quick-batch/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: gsd-quick-batch
-description: "Batch several /gsd:quick-shaped tasks together — planned, dispatched, and merged as one run"
+description: "Batch several `/gsd-quick`-shaped tasks together — planned, dispatched, and merged as one run"
 argument-hint: "[--file <path>] [--jobs auto|N] [--validate] [--research] [--resume <batch-id>] [task list]"
 allowed-tools:
   - Read

package/skills/gsd-review/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: gsd-review
 description: "Request cross-AI peer review of phase plans from external AI CLIs"
-argument-hint: "--phase N [--gemini] [--claude] [--codex] [--opencode] [--qwen] [--cursor] [--agy] [--all]"
+argument-hint: "--phase N [--claude] [--codex] [--opencode] [--qwen] [--cursor] [--agy] [--all]"
 allowed-tools:
   - Read
   - Write
@@ -12,7 +12,7 @@ allowed-tools:
 
 
 <objective>
-Invoke external AI CLIs (Gemini, Claude, Codex, OpenCode, Qwen Code, Cursor) to independently review phase plans.
+Invoke external AI CLIs (Claude, Codex, OpenCode, Qwen Code, Cursor, Antigravity) to independently review phase plans.
 Produces a structured REVIEWS.md with per-reviewer feedback that can be fed back into
 planning via /gsd-plan-phase --reviews.
 
@@ -27,7 +27,6 @@ planning via /gsd-plan-phase --reviews.
 Phase number: extracted from $ARGUMENTS (required)
 
 **Flags:**
-- `--gemini` — Include Gemini CLI review
 - `--claude` — Include Claude CLI review (uses separate session)
 - `--codex` — Include Codex CLI review
 - `--opencode` — Include OpenCode review (uses model from user's OpenCode config)

package/vscode/package.json

@@ -2,7 +2,7 @@
   "name": "gsd-core-vscode",
   "displayName": "GSD Core",
   "description": "GSD orchestration engine embedded in VS Code (ADR-1239 IDE profile).",
-  "version": "1.14.0",
+  "version": "1.15.0",
   "publisher": "opengsd",
   "engines": {
     "vscode": "^1.105.0"