@opengsd/gsd-core 1.14.0 → 1.16.0

package/gsd-core/bin/lib/milestone.cjs

@@ -38,7 +38,7 @@ const stateContract = require("./state-contract.cjs");
 const { publishStateContract } = stateContract;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const phaseIdMod = require("./phase-id.cjs");
-const { normalizePhaseName, matchPhaseDirs, PHASE_NUMBER_TOKEN_SOURCE, isSentinelPhaseId, isSentinelPhaseDir } = phaseIdMod;
+const { normalizePhaseName, matchPhaseDirs, isSentinelPhaseId, isSentinelPhaseDir, buildPhaseHeadingScanRegex, PHASE_HEADING_BASELINE } = phaseIdMod;
 const pattern_cjs_1 = require("./pattern.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const roadmapParserMod = require("./roadmap-parser.cjs");
@@ -63,7 +63,7 @@ const { extractFrontmatter } = frontmatterMod;
 // divergence signal). Routed through the single write-seam composition
 // (`syncAndPreserveStateMd`) instead, under `withStateLock` — see
 // `cmdMilestoneComplete`'s own STATE.md-update block for the full rationale.
-const { syncAndPreserveStateMd, withStateLock, readModifyWriteStateMd } = stateMod;
+const { syncAndPreserveStateMd, withStateLock, readModifyWriteStateMd, assertVerificationReportsReadable } = stateMod;
 // #2288 security: a milestone version label becomes a filesystem directory
 // component (`milestones/<label>-phases/`) into which phase directories are
 // MOVED. Any label used as a path segment must be a safe version token —
@@ -642,8 +642,21 @@ function cmdMilestoneComplete(cwd, version, options, raw) {
             // windows converge to the same value regardless of which version drove
             // the lookup.
             const scopedContent = sliceMilestoneWindow(roadmapContent, version) ?? extractCurrentMilestone(roadmapContent, cwd);
-            // #1729: `(?:\s*\([^)\n]{0,200}\))?` tolerates a pre-colon ( ) tag (literal mirror of OPTIONAL_PHASE_TAG_SOURCE).
-            const phasePattern = new RegExp(`#{2,4}\\s*Phase\\s+(${PHASE_NUMBER_TOKEN_SOURCE})(?:\\s*\\([^)\\n]{0,200}\\))?\\s*:\\s*([^\\n]+)`, 'gi');
+            // #1729: `(?:\s*\([^)\n]{0,200}\))?` tolerates a pre-colon ( ) tag, owned
+            // by buildPhaseHeadingScanRegex (phase-id.cts) so this guard also
+            // recognizes bracket-convention headings instead of hand-rolling a
+            // literal `Phase\s+`.
+            // #4984 fix: resolved ONCE and threaded into BOTH the heading scan and
+            // the disk-side matchPhaseDirs check below — the heading scan alone
+            // recognizing `[GSD.02] 01:` and extracting the bare phase-number token
+            // "01" is only half the fix. Without also passing this convention to
+            // matchPhaseDirs, its bracket-qualified match arm never fires, "01"
+            // matches no bracket directory name ("GSD.02-01-setup"), and every
+            // properly-scaffolded bracket phase reads as disk_status: 'no_directory'
+            // — turning a real bracket project's own phases into false "ROADMAP
+            // lists N unstarted phase(s)" failures on `milestone complete`.
+            const convention = resolvePhaseIdConvention(cwd);
+            const { regex: phasePattern, phaseNumGroup } = buildPhaseHeadingScanRegex(PHASE_HEADING_BASELINE.ANY_BRACKET, convention);
             const noDirectoryPhases = [];
             let pm;
             const phaseDirEntries = (() => {
@@ -658,7 +671,7 @@ function cmdMilestoneComplete(cwd, version, options, raw) {
                 }
             })();
             while ((pm = phasePattern.exec(scopedContent)) !== null) {
-                const phaseNum = pm[1];
+                const phaseNum = pm[phaseNumGroup];
                 // Phase 0 (pre-milestone) and Phase 999 (backlog) are sentinels, not
                 // real phases — they legitimately have no directory and must not block
                 // milestone completion. Mirrors the engine-wide sentinel convention
@@ -672,7 +685,7 @@ function cmdMilestoneComplete(cwd, version, options, raw) {
                 // with a matching token exists on disk. Use the same matchPhaseDirs
                 // owner that roadmap.analyze uses to avoid false positives on decimal
                 // (2.1) and letter-suffix (12A) phase IDs. (#2528)
-                const hasDirectory = matchPhaseDirs(phaseDirEntries, normalized).matches.length > 0;
+                const hasDirectory = matchPhaseDirs(phaseDirEntries, normalized, convention).matches.length > 0;
                 if (!hasDirectory) {
                     noDirectoryPhases.push(phaseNum);
                 }
@@ -856,6 +869,15 @@ function cmdMilestoneComplete(cwd, version, options, raw) {
         output(dryRunResult, raw);
         return;
     }
+    // #5118 (no write before the error): the STATE.md update further down
+    // rebuilds the frontmatter from every phase's report and throws on a
+    // `status` outside the closed set — AFTER the archive directory, the
+    // archived ROADMAP/REQUIREMENTS copies, MILESTONES.md and the moved audit
+    // and quick-task files. Validate first, so the refusal leaves the tree
+    // untouched.
+    if (node_fs_1.default.existsSync(statePath)) {
+        assertVerificationReportsReadable((0, shell_command_projection_cjs_1.platformReadSync)(statePath) || '', cwd);
+    }
     // Ensure archive directory exists. Deliberately placed AFTER the dry-run
     // early return and every refusal/guard above (missingExplicitVersion, the
     // scope refusal, the unstarted-phase guard) — #3184 review finding: this
@@ -1689,6 +1711,15 @@ function cmdQuickArchive(cwd, version, options, raw) {
         }, raw);
         return;
     }
+    // #5118 (no write before the error): the STATE.md reset below goes through
+    // `readModifyWriteStateMd`, whose frontmatter rebuild reads every phase's
+    // report and throws on a `status` outside the closed set — AFTER the quick
+    // task directories have been MOVED. Validate first, so the refusal leaves the
+    // tree untouched. Gated on there being anything to archive: a run that would
+    // move nothing never reaches that rebuild.
+    if (node_fs_1.default.existsSync(statePath) && listQuickTaskDirsForArchive(cwd).length > 0) {
+        assertVerificationReportsReadable(node_fs_1.default.readFileSync(statePath, 'utf-8'), cwd);
+    }
     const quickArchiveResult = archiveQuickTaskDirectories(cwd, version);
     const warnings = [];
     let stateUpdated = false;

package/gsd-core/bin/lib/model-resolver.cjs

@@ -55,24 +55,24 @@ const { planningDir } = planningWorkspaceMod;
 // <install>/gsd-core/bin/lib). Precedence for the gate: project config.runtime →
 // GSD_RUNTIME env (manual/CI override + test seam) → install marker → 'claude'.
 //
-// `claude` is currently the ONLY runtime with nativeModelAliases:true; a
-// registry-parity test guards this set so a future alias-capable runtime fails
-// loudly here instead of silently omitting.
-const RUNTIMES_WITH_NATIVE_ALIASES = new Set(['claude']);
+// Whether a runtime resolves tier aliases natively is a runtime-descriptor fact
+// (`hostBehaviors.nativeModelAliases`, #5169) — `claude` is currently the ONLY
+// runtime that declares it — not a hand-kept set in this module. A label that is
+// not a registered runtime (a future runtime named by env/config) has none.
+function hasNativeModelAliases(runtime) {
+    return (0, runtime_name_policy_cjs_1.hostBehaviorsFor)(runtime).nativeModelAliases === true;
+}
 // #3897 rung 2: the marker reader + its cache and test seams were promoted to
 // the canonical owner, `runtime-slash.cts` (imported above) — this module now
 // consumes that single implementation instead of holding its own copy. N5:
 // behaviour and the seam contract are unchanged by the move; the re-exports
 // below (`export =` at the bottom of this file) preserve every existing
 // caller's `require('./model-resolver.cjs')` surface byte-for-behaviour.
-// The runtime whose install is actually resolving, canonicalized so an alias or
-// case variant (e.g. "claude-code"/"Claude") cannot defeat the native-alias
-// check below (#2297 review). Precedence mirrors resolveRuntime()
-// (runtime-slash.cts): GSD_RUNTIME env → project config.runtime → per-install
-// .gsd-runtime marker → 'claude'.
-function resolveActiveRuntime(config) {
-    return (0, runtime_name_policy_cjs_1.resolveRuntimeNameFromCandidates)(process.env['GSD_RUNTIME'], config['runtime'], (0, runtime_slash_cjs_1.readInstallRuntimeMarker)()) || 'claude';
-}
+// The runtime whose install is actually resolving — one chain, owned by
+// runtime-slash.cts's `resolveActiveRuntime` (#5169): GSD_RUNTIME env → project
+// config.runtime → per-install .gsd-runtime marker → 'claude', canonicalized so
+// an alias or case variant (e.g. "claude-code"/"Claude") cannot defeat the
+// native-alias check below (#2297 review).
 // Did the PROJECT's own config (root `.planning/config.json` or the active
 // workstream/project override) explicitly set resolve_model_ids to "omit"?
 // Project config takes precedence over the shared ~/.gsd/defaults.json (#2297
@@ -123,7 +123,13 @@ function resolveTierEntry({ runtime, tier, overrides }) {
  */
 function _resolveRuntimeTier(config, tier) {
     return resolveTierEntry({
-        runtime: config['runtime'],
+        // #4505/#4495: TIER SELECTION follows the runtime that is actually
+        // resolving, not whatever the config file happens to say. `config.runtime`
+        // is frequently absent (the runtime is normally known from GSD_RUNTIME or
+        // the per-install marker), and reading it raw made
+        // `model_profile_overrides.<runtime>.<tier>` silently inert for every
+        // install that did not also write the key by hand.
+        runtime: (0, runtime_slash_cjs_1.resolveActiveRuntime)(config),
         tier,
         overrides: config['model_profile_overrides'],
     });
@@ -142,10 +148,19 @@ function _resolveRuntimeTier(config, tier) {
  *
  * This helper reads ONLY the user's override entry for the effective claude
  * runtime and tier — never the builtin claude tier map — so an install with no
- * override is byte-identical to before the fix. The runtime is resolved the
- * same way steps 1-3 resolve it (config['runtime'], defaulting to 'claude'),
- * NOT via resolveActiveRuntime (GSD_RUNTIME/marker): the value policy must
- * key off the config the operator wrote, matching mapClaudeOverrideForRuntime.
+ * override is byte-identical to before the fix.
+ *
+ * #4505 CHANGED how the runtime reaches here. #4192 originally passed
+ * `config['runtime']` and recorded that the value policy "must key off the
+ * config the operator wrote, NOT resolveActiveRuntime". That reading turned out
+ * to defeat #4192's own stated principle — that an explicit pin must not be
+ * silently UNPINNED. With `config.runtime` absent and GSD_RUNTIME=opencode, the
+ * config-keyed read treated the session as claude and collapsed an explicit
+ * `claude-opus-4-8` pin to the bare alias `opus`, which is a Claude-only token
+ * the actual runtime cannot spawn. The runtime is now the ACTIVE one, so the
+ * claude value policy applies exactly when claude is what is running. No test
+ * pinned the previous behaviour; the ones covering #4192's pins and the
+ * alias-native posture all still pass.
  *
  * Value policy mirrors the model_overrides path (#2041/#4192): an override
  * value that maps to a current tier alias collapses to that alias
@@ -155,10 +170,12 @@ function _resolveRuntimeTier(config, tier) {
  * Malformed entries (no usable `model` string) return null so the caller falls
  * through to normal alias resolution (ADR-443 D1: invalid values fall through).
  */
-function resolveClaudeTierOverrideModel(configRuntime, tier, overrides) {
+function resolveClaudeTierOverrideModel(
+// The ACTIVE runtime (#4505), not the raw config key — see docblock.
+activeRuntime, tier, overrides) {
     if (!tier || tier === 'inherit')
         return null;
-    const effectiveRuntime = configRuntime || 'claude';
+    const effectiveRuntime = activeRuntime || 'claude';
     if (effectiveRuntime !== 'claude')
         return null; // non-claude runtimes resolve at step 3
     const overridesMap = overrides;
@@ -264,13 +281,18 @@ function _resetModelOverrideWarningCacheForTests() {
  * `Object.hasOwn` lookup defeats `__proto__`/`constructor` lookups on the plain
  * object literal so those reserved keys cannot return a truthy non-string.
  */
-function mapClaudeOverrideForRuntime(override, configRuntime, agentType) {
+function mapClaudeOverrideForRuntime(override, 
+// The ACTIVE runtime (#4505). Previously the raw `config['runtime']`, which
+// made an explicit claude pin collapse to a bare alias whenever the runtime
+// was declared via GSD_RUNTIME or the install marker rather than the config —
+// handing a Claude-only token to a runtime that cannot spawn it.
+activeRuntime, agentType) {
     // Defensive: model_overrides is typed Record<string,string> but a malformed
     // config could surface a non-string; pass through verbatim (preserving the
     // pre-fix no-crash behaviour) and let the downstream Agent tool reject it.
     if (typeof override !== 'string')
         return override;
-    const onClaude = !configRuntime || configRuntime === 'claude';
+    const onClaude = !activeRuntime || activeRuntime === 'claude';
     if (!onClaude)
         return override;
     // Object.hasOwn guards against __proto__/constructor returning a truthy
@@ -480,7 +502,7 @@ function resolveModelInternal(cwd, agentType) {
         ? modelOverrides[agentType]
         : undefined;
     if (override) {
-        const mapped = mapClaudeOverrideForRuntime(override, config['runtime'], agentType);
+        const mapped = mapClaudeOverrideForRuntime(override, (0, runtime_slash_cjs_1.resolveActiveRuntime)(config), agentType);
         if (mapped !== null)
             return mapped;
         // Unmappable Claude ID — fall through to tier resolution (matches model_policy).
@@ -497,10 +519,19 @@ function resolveModelInternal(cwd, agentType) {
     const agentModels = Object.hasOwn(modelProfilesMapForModel, agentType) ? modelProfilesMapForModel[agentType] : undefined;
     const tier = computeProfileTier(config, agentType);
     // 2.5. model_policy preset (#49, #1133)
+    // `configRuntime` is retained ONLY as the EXPLICIT-OPT-IN signal for step 3's
+    // precedence over the omit gate (see the note there). Every actual runtime
+    // question — which tier map to read, which value policy applies — now uses
+    // the active runtime (#4505).
     const configRuntime = config['runtime'];
+    // #4505/#4495: GSD_RUNTIME -> config.runtime -> per-install marker -> 'claude'.
+    // Never undefined, so the "no runtime declared anywhere" case still resolves
+    // 'claude' and step 3's deliberate claude skip (#1156/#2297/#4192) is
+    // unchanged for every existing install.
+    const activeRuntime = (0, runtime_slash_cjs_1.resolveActiveRuntime)(config);
     if (tier && tier !== 'inherit') {
-        const onClaude = !configRuntime || configRuntime === 'claude';
-        const effectiveRuntime = configRuntime || 'claude';
+        const onClaude = activeRuntime === 'claude';
+        const effectiveRuntime = activeRuntime;
         const mergedPolicy = config['model_policy']
             ? { ...config['model_policy'], runtime: effectiveRuntime }
             : null;
@@ -525,8 +556,49 @@ function resolveModelInternal(cwd, agentType) {
             warnModelPolicyUnmappable(agentType, policyModel, tier);
         }
     }
-    // 3. Runtime-aware resolution (#2517)
-    if (configRuntime && configRuntime !== 'claude' && tier && tier !== 'inherit') {
+    // #4505: the omit DECISION is computed here, ahead of step 3, though the
+    // return still happens at step 4 below.
+    //
+    // Step 3 was previously unreachable unless the operator had written `runtime`
+    // into the config. Keying it off the ACTIVE runtime — the #4495 fix — makes it
+    // reachable for env- and marker-declared runtimes too, which newly exposes an
+    // ordering the corpus already decided, in two places that only coexisted
+    // because step 3 could not fire:
+    //
+    //   #2517  `runtime:"codex"` + resolve_model_ids:"omit"  -> the codex tier
+    //          model. "Explicit non-Claude opt-in wins" — the operator naming a
+    //          runtime in the project config outranks an omit.
+    //   #4717 (user-sanctioned decision a — supersedes #2297 acceptance #4):
+    //          a DETECTED runtime now constitutes that opt-in too. The identity
+    //          fill in config-loader materializes GSD_RUNTIME / the per-install
+    //          marker into `config.runtime` when it is empty, so a genuinely
+    //          installed non-Claude runtime resolves its own tier map instead of
+    //          the omit's "". The shared "omit" remains a Claude protection:
+    //          marker/env = claude still ignores it (native aliases), and
+    //          garbage runtime values still fail safe to "" (guard below).
+    //
+    // So the opt-in signal is the `runtime` KEY — written by the operator or
+    // materialized by the #4717 fill: step 3 reads the active runtime's tier
+    // map, but only outranks the omit gate when that key canonicalizes to a
+    // recognised non-Claude runtime.
+    const omitApplies = config['resolve_model_ids'] === 'omit'
+        && (projectExplicitlySetsOmit(cwd) || !hasNativeModelAliases(activeRuntime));
+    // CANONICALIZED, not the raw field. Comparing the raw value against the literal
+    // 'claude' made every spelling that is not exactly that string count as a
+    // non-Claude opt-in and outrank the omit gate: `runtime:"Claude"`,
+    // `runtime:"claude-code"` and even `runtime:5` each emitted a model id where
+    // origin/next returned "". That is the #2297 acceptance-#4 case this very
+    // block claims to preserve, failing OPEN. (Security review of #4505.)
+    //
+    // null covers both "not a string" and "not a runtime we recognise", and both
+    // must read as NOT an opt-in: an unrecognised value is not evidence the
+    // operator deliberately chose a non-Claude runtime, so it must not buy an
+    // escalation past an explicit omit.
+    const configRuntimeCanonical = (0, runtime_name_policy_cjs_1.canonicalizeRuntimeName)(configRuntime);
+    const explicitNonClaudeOptIn = configRuntimeCanonical !== null && configRuntimeCanonical !== 'claude';
+    // 3. Runtime-aware resolution (#2517), keyed off the ACTIVE runtime (#4505).
+    if (activeRuntime !== 'claude' && tier && tier !== 'inherit'
+        && (explicitNonClaudeOptIn || !omitApplies)) {
         const entry = _resolveRuntimeTier(config, tier);
         if (entry?.model)
             return entry.model;
@@ -541,8 +613,7 @@ function resolveModelInternal(cwd, agentType) {
     // NOTE: a non-Claude runtime that HAS a populated runtime-tier map already
     // returned its own model id at step 3 above, before this gate — for those the
     // explicit-project-omit honoring here is moot (step 3 wins, by #2517 design).
-    if (config['resolve_model_ids'] === 'omit'
-        && (projectExplicitlySetsOmit(cwd) || !RUNTIMES_WITH_NATIVE_ALIASES.has(resolveActiveRuntime(config)))) {
+    if (omitApplies) {
         return '';
     }
     // 4.5. Claude-runtime tier override (#4192 Finding 1). Sits AFTER the omit
@@ -554,10 +625,30 @@ function resolveModelInternal(cwd, agentType) {
     // `model_profile_overrides.claude.<tier>` entry for this tier — see
     // resolveClaudeTierOverrideModel for why the builtin map stays out.
     if (tier && tier !== 'inherit') {
-        const claudeOverrideModel = resolveClaudeTierOverrideModel(configRuntime, tier, config['model_profile_overrides']);
+        const claudeOverrideModel = resolveClaudeTierOverrideModel(activeRuntime, tier, config['model_profile_overrides']);
         if (claudeOverrideModel !== null)
             return claudeOverrideModel;
     }
+    // 4.75 dynamic_routing.tier_models (#4505 / #3024).
+    //
+    // Position is the documented composition, not a convenience:
+    //   docs/features/dynamic-routing-with-failure-tier-escalation.md —
+    //   "model_overrides always wins; dynamic_routing.tier_models[<tier>] resolves
+    //    above models.<phase_type> and model_profile."
+    // So it sits BELOW model_overrides (step 1), the model_policy preset (2.5),
+    // the runtime tier map (3), the resolve_model_ids:"omit" gate (4) and the
+    // claude tier override (4.5) — and ABOVE the profile lookup (5).
+    //
+    // An earlier cut of this fix routed every call site through resolveModelForTier
+    // instead, which returns the tier model directly and therefore skipped steps 3,
+    // 4 and 4.5 entirely: with `resolve_model_ids:"omit"` and a non-Claude runtime
+    // it handed out a model id where the gate had returned "". Putting the step
+    // here keeps every higher-precedence layer reachable.
+    if (tier !== 'inherit') {
+        const routed = dynamicRoutingModel(config, agentType, 0);
+        if (routed !== null)
+            return routed;
+    }
     // 5. Profile lookup (Claude-native default).
     if (!agentModels) {
         return profile === 'quality' ? 'opus'
@@ -614,6 +705,50 @@ function assertValidGranularityOverride(override, fail) {
         fail(`invalid granularity '${override}' (valid: ${[...VALID_GRANULARITIES].join(', ')})`);
     }
 }
+/**
+ * #4505 — the ONE implementation of `dynamic_routing.tier_models` lookup.
+ *
+ * Returns the configured model for this agent's routing tier at `attempt`, or
+ * null when dynamic routing does not apply (disabled, absent, no tier table, an
+ * agent with no default routing tier, or no entry for the tier). Both entry
+ * points call it, so the first-spawn value and the escalated value can never
+ * drift apart — the "Generative Fix Divergence" this repo names by name.
+ *
+ * `attempt` 0 means "no escalation yet", which is the documented FIRST-SPAWN
+ * case, NOT "skip dynamic routing":
+ *   docs/features/dynamic-routing-with-failure-tier-escalation.md —
+ *   "enabled: true — the resolver picks tier_models[default_tier] for the first
+ *    spawn and escalates one tier up on orchestrator-detected soft failure."
+ */
+function dynamicRoutingModel(config, agentType, attempt) {
+    const dr = config['dynamic_routing'];
+    if (!dr || typeof dr !== 'object' || dr['enabled'] !== true)
+        return null;
+    const tierModels = dr['tier_models'];
+    if (!tierModels || typeof tierModels !== 'object')
+        return null;
+    const defaultTier = (AGENT_DEFAULT_TIERS)[agentType];
+    if (!defaultTier || !(VALID_AGENT_TIERS).has(defaultTier))
+        return null;
+    const maxEscalations = Number.isInteger(dr['max_escalations']) && dr['max_escalations'] >= 0
+        ? dr['max_escalations']
+        : 1;
+    const escalationEnabled = dr['escalate_on_failure'] !== false;
+    const effectiveAttempt = escalationEnabled ? Math.min(attempt, maxEscalations) : 0;
+    let tier = defaultTier;
+    for (let i = 0; i < effectiveAttempt; i += 1) {
+        const next = (nextTier)(tier);
+        if (!next || next === tier)
+            break;
+        tier = next;
+    }
+    // Own-property guard: `tier_models` is a config-supplied plain object, so a
+    // prototype-chain key must not resolve an inherited member.
+    const alias = Object.hasOwn(tierModels, tier) ? tierModels[tier] : undefined;
+    if (typeof alias !== 'string' || alias.length === 0)
+        return null;
+    return alias;
+}
 /**
  * #3024 — Resolve a model for a specific dynamic-routing attempt.
  */
@@ -629,45 +764,19 @@ function resolveModelForTier(cwd, agentType, attempt) {
         ? modelOverrides[agentType]
         : undefined;
     if (override) {
-        const mapped = mapClaudeOverrideForRuntime(override, config['runtime'], agentType);
+        const mapped = mapClaudeOverrideForRuntime(override, (0, runtime_slash_cjs_1.resolveActiveRuntime)(config), agentType);
         if (mapped !== null)
             return mapped;
         // Unmappable Claude ID — fall through to dynamic_routing / model_policy resolution.
     }
-    if (config['model_policy'] && config['runtime'] && config['runtime'] !== 'claude') {
-        return resolveModelInternal(cwd, agentType);
-    }
-    const dr = config['dynamic_routing'];
-    if (!dr || typeof dr !== 'object' || dr['enabled'] !== true) {
-        return resolveModelInternal(cwd, agentType);
-    }
-    const tierModels = dr['tier_models'];
-    if (!tierModels || typeof tierModels !== 'object') {
-        return resolveModelInternal(cwd, agentType);
-    }
-    const defaultTier = (AGENT_DEFAULT_TIERS)[agentType];
-    if (!defaultTier || !(VALID_AGENT_TIERS).has(defaultTier)) {
-        return resolveModelInternal(cwd, agentType);
-    }
-    const maxEscalations = Number.isInteger(dr['max_escalations']) && dr['max_escalations'] >= 0
-        ? dr['max_escalations']
-        : 1;
-    const escalationEnabled = dr['escalate_on_failure'] !== false;
-    const effectiveAttempt = escalationEnabled
-        ? Math.min(attemptN, maxEscalations)
-        : 0;
-    let tier = defaultTier;
-    for (let i = 0; i < effectiveAttempt; i += 1) {
-        const next = (nextTier)(tier);
-        if (!next || next === tier)
-            break;
-        tier = next;
-    }
-    const alias = tierModels[tier];
-    if (typeof alias !== 'string' || alias.length === 0) {
+    // #4505: same active-runtime rule as resolveModelInternal step 3.
+    if (config['model_policy'] && (0, runtime_slash_cjs_1.resolveActiveRuntime)(config) !== 'claude') {
         return resolveModelInternal(cwd, agentType);
     }
-    return alias;
+    const alias = dynamicRoutingModel(config, agentType, attemptN);
+    if (alias !== null)
+        return alias;
+    return resolveModelInternal(cwd, agentType);
 }
 /**
  * Keep only usable model ids: non-empty strings. A malformed config can put

package/gsd-core/bin/lib/observability/event.cjs

@@ -16,7 +16,7 @@
  *                                     (RFC 4122); invalid values are silently coerced to undefined.
  *   command:       string  — the dispatched verb
  *   args?:         unknown — only present when includeArgs === true
- *   result:        { kind: 'ok' | 'UnknownCommand' | 'InvalidArgs' | 'HandlerRefusal' | 'HandlerFailure', ...payload }
+ *   result:        { kind: 'ok' | 'UnknownCommand' | 'InvalidArgs' | 'HandlerRefusal' | 'HandlerFailure' | 'VerificationStatusInvalid', ...payload }
  *   timestamp:     string  — ISO 8601
  */
 Object.defineProperty(exports, "__esModule", { value: true });

package/gsd-core/bin/lib/observability/logger.cjs

@@ -16,6 +16,11 @@
  * No-op logger (createNoOpLogger):
  *   Silent on all events. Used as the Hub default when no logger is injected.
  *
+ * Live-seam gate (resolveDispatchLogger, #4975):
+ *   The one opt-in decision both live createHub() seams share. Resolves
+ *   `audit.enabled` for the seam's cwd and returns the default logger, or
+ *   undefined (inject nothing) when observability is off.
+ *
  * ADR-457 build-at-publish: the hand-written bin/lib/observability/logger.cjs
  * collapsed to a TypeScript source of truth. Behaviour is preserved
  * byte-for-behaviour from the prior hand-written .cjs; only types are added.
@@ -26,6 +31,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 const redaction_cjs_1 = require("./redaction.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const planningWorkspace = require("../planning-workspace.cjs");
+const { readScopedConfigValue } = planningWorkspace;
 const AUDIT_FILE_NAME = '.gsd-trace.jsonl';
 const PLANNING_DIR = '.planning';
 // ─── helpers ─────────────────────────────────────────────────────────────────
@@ -47,6 +55,8 @@ function _safeStringify(value) {
  * inject nothing (the Hub stays byte-for-byte silent, preserving the default
  * dispatch output contract, incl. --json-errors); when on, the caller injects
  * createDefaultLogger and gets the stderr-on-error line + opt-in file audit.
+ * The live seams reach it through resolveDispatchLogger, which supplies the
+ * project config — called bare, only the env var is seen (#4975).
  */
 function _isAuditEnabled(config) {
     if (process.env['GSD_AUDIT'] === '1')
@@ -148,4 +158,39 @@ function createDefaultLogger({ cwd = process.cwd(), config } = {}) {
         },
     };
 }
-module.exports = { createDefaultLogger, createNoOpLogger, isAuditEnabled: _isAuditEnabled };
+/**
+ * Resolve `audit.enabled` for `cwd` as the value `config-get audit.enabled`
+ * reports, through planning-workspace's readScopedConfigValue — the one
+ * scope-aware ladder worktreesOptedOut (#3972) reads too, so the two gates
+ * can never resolve the same config differently. Strict `=== true`, never
+ * coerced.
+ *
+ * Direct file reads, deliberately NOT loadConfig: this runs on every live
+ * dispatch, and loadConfig can rewrite config.json, spawn git, scan the
+ * capability registry, and print warnings — none of which a dispatch that
+ * never opted in may do (the default dispatch output is a stable contract,
+ * ADR-2619). Never throws. An unreadable or unparseable config file sets
+ * nothing, so the ladder moves on: under GSD_WORKSTREAM a broken workstream
+ * config inherits the root's `audit.enabled` (where config-get fails with
+ * CONFIG_PARSE_FAILED); otherwise the GSD_AUDIT env var alone decides.
+ */
+function _readAuditConfig(cwd) {
+    const { present, value } = readScopedConfigValue(cwd, ['audit', 'enabled']);
+    return { audit: { enabled: present && value === true } };
+}
+/**
+ * The DispatchLogger a live createHub() seam injects (#4975). Either
+ * GSD_AUDIT=1 or `audit.enabled: true` in the project config turns the opt-in
+ * audit trail (and the structured stderr line on error) on; neither turns the
+ * other off. When observability is off this returns undefined so the Hub keeps
+ * its no-op fallback and the default dispatch output — including the
+ * --json-errors envelope — stays byte-for-byte unchanged (#2620).
+ *
+ * `cwd` defaults exactly as createDefaultLogger's does, so the config that
+ * decides and the directory that receives the trail are always the same.
+ */
+function resolveDispatchLogger(cwd = process.cwd()) {
+    const config = _readAuditConfig(cwd);
+    return _isAuditEnabled(config) ? createDefaultLogger({ cwd, config }) : undefined;
+}
+module.exports = { createDefaultLogger, createNoOpLogger, isAuditEnabled: _isAuditEnabled, resolveDispatchLogger };

package/gsd-core/bin/lib/pattern.cjs

@@ -44,6 +44,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MAX_USER_PATTERN_LEN = void 0;
 exports.escapeRegex = escapeRegex;
+exports.escapeEre = escapeEre;
 exports.literalPattern = literalPattern;
 exports.compileUserPattern = compileUserPattern;
 // re2js is vendored, not an npm dependency at runtime: gsd-core/bin/** is
@@ -66,6 +67,15 @@ const escapeMetachars = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
 function escapeRegex(value) {
     return (escapeBuiltin ?? escapeMetachars)(value);
 }
+/**
+ * Escape `value` for a POSIX extended regular expression (e.g. `git log --extended-regexp
+ * --grep=…`). Always the plain backslash-escape of every ERE metacharacter, never
+ * `RegExp.escape`: that built-in writes a leading digit as `\x31`, which ERE does not read as a
+ * digit. #5139 (a plan id interpolated into a git `--grep` pattern).
+ */
+function escapeEre(value) {
+    return escapeMetachars(value);
+}
 function literalPattern(value, flags) {
     return new RegExp(escapeRegex(value), flags);
 }

package/gsd-core/bin/lib/phase-command-router.cjs

@@ -22,10 +22,12 @@ const commandRoutingHub = require("./command-routing-hub.cjs");
 const { createHub, ERROR_KINDS, makeInvalidArgs } = commandRoutingHub;
 // #2620 (ADR-0174 §6): inject the reference DispatchLogger on the live phase
 // dispatch path, but only when observability is opt-in enabled; otherwise the
-// Hub stays byte-for-byte silent via its no-op fallback.
+// Hub stays byte-for-byte silent via its no-op fallback. #4975: the opt-in is
+// GSD_AUDIT=1 or `audit.enabled` in the project config — resolveDispatchLogger
+// owns that whole decision for every live seam.
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const observabilityLogger = require("./observability/logger.cjs");
-const { createDefaultLogger, isAuditEnabled } = observabilityLogger;
+const { resolveDispatchLogger } = observabilityLogger;
 // ─── Implementation ───────────────────────────────────────────────────────────
 function routePhaseCommand({ phase, args, cwd, raw, error }) {
     // ── Unsupported subcommands ─────────────────────────────────────────────────
@@ -186,11 +188,16 @@ function routePhaseCommand({ phase, args, cwd, raw, error }) {
             },
             'uat-passed': (_ctx) => {
                 let requireVerification = false;
+                let uatOnly = false;
                 const positional = [];
                 for (const token of args.slice(2)) {
                     if (token === '--require-verification') {
                         requireVerification = true;
                     }
+                    else if (token === '--uat-only') {
+                        // #4663: evaluate UAT rows only (verification-status blockers skipped).
+                        uatOnly = true;
+                    }
                     else if (token === '--raw') {
                         // --raw is handled by the outer CLI layer; accepted here silently
                     }
@@ -201,7 +208,10 @@ function routePhaseCommand({ phase, args, cwd, raw, error }) {
                         positional.push(token);
                     }
                 }
-                phase.cmdPhaseUatPassed(cwd, positional[0], raw, { policy: { requireVerification } });
+                if (requireVerification && uatOnly) {
+                    return makeInvalidArgs('--uat-only', '--uat-only and --require-verification are mutually exclusive');
+                }
+                phase.cmdPhaseUatPassed(cwd, positional[0], raw, { policy: { requireVerification, uatOnly } });
                 return { ok: true, data: null };
             },
             // #1437 — list plan files for a phase
@@ -250,8 +260,8 @@ function routePhaseCommand({ phase, args, cwd, raw, error }) {
     // #175: Hub is CJS-only — no mode param, no sdkLoader.
     // #2620: wire the reference logger (ADR-0174 §6) only when observability is
     // opt-in enabled; otherwise leave it unset so the Hub stays byte-for-byte
-    // silent via its no-op fallback.
-    const hub = createHub({ cjsRegistry, manifest, logger: isAuditEnabled() ? createDefaultLogger({ cwd }) : undefined });
+    // silent via its no-op fallback. #4975: GSD_AUDIT=1 or `audit.enabled`.
+    const hub = createHub({ cjsRegistry, manifest, logger: resolveDispatchLogger(cwd) });
     // ── Dispatch ────────────────────────────────────────────────────────────────
     const result = hub.dispatch({
         family: 'phase',
@@ -274,6 +284,11 @@ function routePhaseCommand({ phase, args, cwd, raw, error }) {
             error(result.reason);
             return;
         }
+        if (result.kind === ERROR_KINDS.VerificationStatusInvalid) {
+            // #5118: typed reason survives to the CLI surface
+            error(result.message, result.reason);
+            return;
+        }
         // HandlerFailure: message field
         error(result.message);
         return;

package/gsd-core/bin/lib/phase-estimation.cjs

@@ -47,6 +47,7 @@ exports.parseCalibrationDocument = parseCalibrationDocument;
 exports.renderCalibrationDocument = renderCalibrationDocument;
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- prompt-budget.cjs is an export= CommonJS module
 const promptBudget = require("./prompt-budget.cjs");
+const frontmatter_fence_cjs_1 = require("./frontmatter-fence.cjs");
 const { estimateTokens } = promptBudget;
 /**
  * Assert that a bare number is an UNCORRECTED projection.
@@ -239,11 +240,11 @@ function applyCalibration(rawTokens, factor) {
 function extractFrontmatterBlock(text, key) {
     if (typeof text !== 'string')
         return null;
-    // Anchor at byte 0 — CRLF-tolerant.
-    const fm = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|\r?$)/.exec(text);
-    if (fm === null)
+    // The block is the one the one fence owner finds (`locateFrontmatterFence`).
+    const fence = (0, frontmatter_fence_cjs_1.locateFrontmatterFence)(text);
+    if (!fence?.closed)
         return null;
-    const lines = fm[1].split(/\r?\n/);
+    const lines = text.slice(fence.openEnd, fence.bodyEnd).split(/\r?\n/);
     const startIdx = lines.findIndex((l) => l === `${key}:` || l.startsWith(`${key}:`));
     if (startIdx === -1)
         return null;