@opengsd/gsd-core 1.14.0 → 1.16.0

package/scripts/lint-state-write-path-drift.cjs

@@ -162,6 +162,12 @@ const REASON = Object.freeze({
   // Axis 2 (§8.6, retained): a raw `fs.writeFileSync(` call targeting the
   // state path — see `findRawStateWrites`.
   RAW_STATE_WRITE: 'raw_state_write',
+  // ADR-4629 §8.1 (epic #4629, C1): a residual `readModifyWriteStateMd(path,
+  // (content) => …)` call whose transform is an inline anonymous arrow/function
+  // — the opaque shape §8.1 replaces with a declared StateWriteIntent. Recognized
+  // by `findOpaqueStateTransforms`; a CAPABILITY in C1 (not wired into collect()),
+  // wired terminal in C2 as the residual callers migrate (ADR-3408 §6 phasing).
+  OPAQUE_STATE_TRANSFORM: 'opaque_state_transform',
   // Axis 4 (§8.3, Decision 4(d)): prompt-layer prose shelling out to a
   // write-side `gsd-tools` subcommand — see `findPromptSeamUses`.
   PROMPT_LAYER_STATE_WRITE: 'prompt_layer_state_write',
@@ -645,6 +651,91 @@ function findRawStateWrites(rel, text) {
   return out;
 }
 
+// ADR-4629 §8.1 (epic #4629, C1) — OPAQUE-TRANSFORM RECOGNITION.
+//
+// A residual `readModifyWriteStateMd(path, (content) => …)` call whose transform
+// (2nd) argument is an inline anonymous arrow / function expression is the opaque
+// shape §8.1 replaces with a declared StateWriteIntent: `readModifyWriteStateMd`
+// goes THROUGH the seam (it is NOT a raw-write bypass — Axis 2's concern), but its
+// opaque body transform is neither verified (§8.2) nor bounded (§8.3). This
+// function RECOGNIZES that shape.
+//
+// C1 ships recognition as a CAPABILITY: it is exported and unit-tested (positive
+// control on a seeded fixture) but is DELIBERATELY NOT wired into `collect()`'s
+// failing scan. §8.1's caller-side rule is *Required — Phase 2*; wiring it now
+// would turn the ~16 residual callers red at once, and ADR-3473 §8.6 retired the
+// ratchet that would otherwise be needed to absorb them. C2 wires this terminal as
+// the verifying executor lands and the callers migrate under ADR-3408 §6 phasing.
+//
+// String match, never an AST — same over-report-safe posture as every axis here.
+const OPAQUE_RMW_CALL_RE = /\breadModifyWriteStateMd\s*\(/g;
+// The transform arg is OPAQUE when it BEGINS an inline anonymous function: an
+// arrow (`(…) =>`, `ident =>`, optionally `async`) or a `function` expression. A
+// bare identifier / object (a declared StateWriteIntent, Phase 2+) is NOT opaque.
+const ANON_TRANSFORM_RE =
+  /^\s*(?:async\s+)?(?:\([^)]*\)|[A-Za-z_$][\w$]*)\s*=>|^\s*(?:async\s+)?function\b/;
+
+/**
+ * Capture the top-level, comma-separated argument list of a call, starting at
+ * `startIdx` (the index just AFTER the opening `(`) — across newlines and
+ * string-aware, tracking `()[]{}` depth. Returns the raw arg strings, or null if
+ * the parens never balance (a truncated arg list is never flagged). Generalizes
+ * `captureFirstArg`'s depth/inStr bookkeeping to every argument.
+ */
+function captureCallArgList(text, startIdx) {
+  let depth = 0;
+  let inStr = null;
+  const args = [];
+  let cur = '';
+  for (let i = startIdx; i < text.length; i++) {
+    const ch = text[i];
+    if (inStr) {
+      cur += ch;
+      if (ch === inStr && text[i - 1] !== '\\') inStr = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === '`') { inStr = ch; cur += ch; continue; }
+    if (ch === '(' || ch === '[' || ch === '{') { depth++; cur += ch; continue; }
+    if (ch === ')' || ch === ']' || ch === '}') {
+      if (ch === ')' && depth === 0) {
+        if (cur.trim() !== '' || args.length) args.push(cur);
+        return args;
+      }
+      depth--; cur += ch; continue;
+    }
+    if (ch === ',' && depth === 0) { args.push(cur); cur = ''; continue; }
+    cur += ch;
+  }
+  return null; // parens never balanced
+}
+
+/**
+ * Recognize residual opaque-transform STATE.md writes (ADR-4629 §8.1). Returns a
+ * finding per `readModifyWriteStateMd(` call whose 2nd argument is an inline
+ * anonymous transform. CAPABILITY only in C1 — not called by `collect()`.
+ */
+function findOpaqueStateTransforms(rel, text) {
+  const rawLines = text.split('\n');
+  const stripped = stripComments(text).join('\n');
+  const out = [];
+  let m;
+  OPAQUE_RMW_CALL_RE.lastIndex = 0;
+  while ((m = OPAQUE_RMW_CALL_RE.exec(stripped)) !== null) {
+    const args = captureCallArgList(stripped, m.index + m[0].length);
+    if (!args || args.length < 2) continue;
+    if (!ANON_TRANSFORM_RE.test(args[1])) continue;
+    const lineNo = stripped.slice(0, m.index).split('\n').length;
+    out.push({
+      reason: REASON.OPAQUE_STATE_TRANSFORM,
+      axis: 'opaque-transform',
+      file: sanitizeForReport(rel),
+      line: lineNo,
+      source: sanitizeForReport((rawLines[lineNo - 1] || '').trim()),
+    });
+  }
+  return out;
+}
+
 // The two write-seam STAGE functions, matched only as CALLS (`\(`
 // immediately after, modulo whitespace) — never as bare mentions of the
 // name. `writeStateMd(` is deliberately NOT included here (that arm is
@@ -941,6 +1032,8 @@ module.exports = {
   nearestPrecedingAssignment,
   findRawStateWrites,
   targetsStatePath,
+  findOpaqueStateTransforms,
+  captureCallArgList,
   findCompositionBypasses,
   findPromptSeamUses,
   isInsideCodeSpan,

package/scripts/lint-test-file-count.allowlist.json

@@ -1,6 +1,15 @@
 {
-  "_doc": "Baseline of modules currently exceeding the 2-test-file limit. Each entry locks in TODAY's exact test filenames as the allowlisted set (identity ratchet). Adding a NEW test file to a capped module fails (novel). Removing one requires pruning this list (stale, ratchet-down). When a cluster drops to \u2264 2, remove its entry entirely. New entries require justification in PR description.",
+  "_doc": "Baseline of modules currently exceeding the 2-test-file limit. Each entry locks in TODAY's exact test filenames as the allowlisted set (identity ratchet). Adding a NEW test file to a capped module fails (novel). Removing one requires pruning this list (stale, ratchet-down). When a cluster drops to ≤ 2, remove its entry entirely. New entries require justification in PR description.",
   "modules": {
+    "ui-consideration-probe": {
+      "files": [
+        "ui-consideration-probe-docs-fixtures.test.cjs",
+        "ui-consideration-probe-ui-phase-contract.test.cjs",
+        "ui-consideration-probe.test.cjs"
+      ],
+      "issue": "4657",
+      "justification": "The ui-consideration-probe cluster gains its workflow-prose contract file (tests/ui-consideration-probe-ui-phase-contract.test.cjs, #4657), mirroring the edge probe's split (edge-probe.test.cjs / edge-probe-docs-fixtures.test.cjs / edge-probe-spec-phase-contract.test.cjs). The contract file reads shipped gsd-core/workflows/ui-phase.md under the source-text-is-the-product exception, which the unit file deliberately does not carry (it asserts typed returns only)."
+    },
     "adr-parser": {
       "files": [
         "adr-parser.property.test.cjs",
@@ -40,7 +49,7 @@
         "frontmatter.unit.test.cjs"
       ],
       "issue": "3881",
-      "justification": "Grandfathered by #3227 for the original 4-file cluster (pre-existing over-cap, not new sprawl). #3881 (ADR-3473 \u00a78.1, the js-yaml parser migration) adds two more: frontmatter-golden-parity.test.cjs (D-series golden-corpus diff against the legacy parser, ~900 real documents \u2014 cannot be folded into an existing file without losing its independent-of-current-parser provenance) and frontmatter-roundtrip.property.test.cjs (fast-check property coverage the migration's bijective-contract rule requires). Both are migration-specific, not incidental sprawl."
+      "justification": "Grandfathered by #3227 for the original 4-file cluster (pre-existing over-cap, not new sprawl). #3881 (ADR-3473 §8.1, the js-yaml parser migration) adds two more: frontmatter-golden-parity.test.cjs (D-series golden-corpus diff against the legacy parser, ~900 real documents — cannot be folded into an existing file without losing its independent-of-current-parser provenance) and frontmatter-roundtrip.property.test.cjs (fast-check property coverage the migration's bijective-contract rule requires). Both are migration-specific, not incidental sprawl."
     },
     "graphify": {
       "files": [
@@ -133,14 +142,16 @@
       "files": [
         "verify-archive-dirs-live-path.test.cjs",
         "verify-health.test.cjs",
+        "verify-lifecycle-writes-e2e.test.cjs",
         "verify-mvp-uat.test.cjs",
         "verify-npm-publish.test.cjs",
         "verify-test-quality.test.cjs",
         "verify-work-auto-transition.test.cjs",
+        "verify-work-deferred-promotion.test.cjs",
         "verify.test.cjs"
       ],
-      "issue": "#3813 \u2014 the live-path #1883 suite drives buildPlanningSnapshot in-process with an fs fault; the verify module suites are CLI-driving and cannot host an fs monkeypatch",
-      "justification": "verify-command-grounding added by #2401/#3678; allowlist follow-up landed with #3606 (base was red on this lane)."
+      "issue": "#3813 — the live-path #1883 suite drives buildPlanningSnapshot in-process with an fs fault; the verify module suites are CLI-driving and cannot host an fs monkeypatch",
+      "justification": "verify-command-grounding added by #2401/#3678; allowlist follow-up landed with #3606 (base was red on this lane). #4546 adds verify-work-deferred-promotion (deferred-follow-up promotion writer contract + parity). #5105 adds verify-lifecycle-writes-e2e.test.cjs (Phase 3 of #5056: end-to-end fixture proving the fixed post-fingerprint verbs leave an unchanged re-run fresh, plus its own pre-fix CONTROL — a distinct end-to-end concern from the existing per-verb unit suites)."
     },
     "install": {
       "files": [
@@ -154,7 +165,7 @@
         "install-write-confinement.test.cjs",
         "install.test.cjs"
       ],
-      "issue": "#3798 \u2014 the profile-closure spawn test reads the real repo surface (commands+workflows+agents); consolidating it into install.test.cjs would put a whole-repo scan behind the suite's heaviest file"
+      "issue": "#3798 — the profile-closure spawn test reads the real repo surface (commands+workflows+agents); consolidating it into install.test.cjs would put a whole-repo scan behind the suite's heaviest file"
     },
     "edge-probe": {
       "files": [
@@ -252,8 +263,8 @@
         "docs-state-md-locale-parity.test.cjs",
         "docs-update.test.cjs"
       ],
-      "issue": "3873 | #3839 \u2014 the hook-event parity suite cross-checks the four docs hook tables against src/runtime-hooks-surface.cts registrations; a generated-docs concern distinct from content freshness and registry parity",
-      "justification": "ADR-3473 \u00a78.8 makes docs/reference/state-md.md and its four locale siblings generated-and-committed and adds the repo's first locale-parity check (verified: no locale-parity lint precedent exists here). That check is a distinct concern from docs-update (content freshness) and docs-parity-live-registry (registry parity); folding it into either would place an unrelated subject inside them purely to satisfy a count. The section it guards is absent from all four translations today and documents the status enum behind #3853."
+      "issue": "3873 | #3839 — the hook-event parity suite cross-checks the four docs hook tables against src/runtime-hooks-surface.cts registrations; a generated-docs concern distinct from content freshness and registry parity",
+      "justification": "ADR-3473 §8.8 makes docs/reference/state-md.md and its four locale siblings generated-and-committed and adds the repo's first locale-parity check (verified: no locale-parity lint precedent exists here). That check is a distinct concern from docs-update (content freshness) and docs-parity-live-registry (registry parity); folding it into either would place an unrelated subject inside them purely to satisfy a count. The section it guards is absent from all four translations today and documents the status enum behind #3853."
     },
     "audit": {
       "files": [
@@ -265,7 +276,7 @@
         "audit-uat-summary-segmentation.test.cjs",
         "audit-workstream-layouts.test.cjs"
       ],
-      "issue": "#3804/#3805 \u2014 audit-layout and acknowledged-marker suites drive the real audit-uat CLI against on-disk fixtures | #3817 \u2014 regression suite proving countReal counts the truncation remainder marker instead of treating it as one phantom item | #3783 \u2014 dedicated suite for the summary.current_milestone/archived segmentation, matching this module's one-file-per-feature-slice precedent (e.g. audit-uat-acknowledged.test.cjs) rather than growing the unrelated 6900+ line tests/uat.test.cjs (a different module, keyed off uat.cjs)"
+      "issue": "#3804/#3805 — audit-layout and acknowledged-marker suites drive the real audit-uat CLI against on-disk fixtures | #3817 — regression suite proving countReal counts the truncation remainder marker instead of treating it as one phantom item | #3783 — dedicated suite for the summary.current_milestone/archived segmentation, matching this module's one-file-per-feature-slice precedent (e.g. audit-uat-acknowledged.test.cjs) rather than growing the unrelated 6900+ line tests/uat.test.cjs (a different module, keyed off uat.cjs)"
     },
     "shell-command-projection": {
       "files": [
@@ -273,7 +284,25 @@
         "shell-command-projection-md-normalize.test.cjs",
         "shell-command-projection-path-sep.test.cjs"
       ],
-      "issue": "#3854 \u2014 the tight-list suite pins the markdown write-normalizer's blank-line policy through the exported normalizeContent/platformWriteSync seam; a distinct concern from dispatch routing and path separation"
+      "issue": "#3854 — the tight-list suite pins the markdown write-normalizer's blank-line policy through the exported normalizeContent/platformWriteSync seam; a distinct concern from dispatch routing and path separation"
+    },
+    "ui-consideration-probe": {
+      "files": [
+        "ui-consideration-probe-docs-fixtures.test.cjs",
+        "ui-consideration-probe-ui-phase-contract.test.cjs",
+        "ui-consideration-probe.test.cjs"
+      ],
+      "issue": "4657",
+      "justification": "The ui-consideration-probe cluster gains its workflow-prose contract file (tests/ui-consideration-probe-ui-phase-contract.test.cjs, #4657), mirroring the edge probe's split (edge-probe.test.cjs / edge-probe-docs-fixtures.test.cjs / edge-probe-spec-phase-contract.test.cjs). The contract file reads shipped gsd-core/workflows/ui-phase.md under the source-text-is-the-product exception, which the unit file deliberately does not carry (it asserts typed returns only)."
+    },
+    "verification": {
+      "files": [
+        "verification-append-audit.test.cjs",
+        "verification-overrides.test.cjs",
+        "verification-status.test.cjs"
+      ],
+      "issue": "5105",
+      "justification": "#5105 (Phase 3 of #5056) adds verification-append-audit.test.cjs for the new `verification.append-audit` verb (deny-by-default audit-block append/no-op, #4887) — a distinct concern from verification-status.test.cjs's status/fingerprint suite and verification-overrides.test.cjs's override handling."
     }
   }
 }

package/scripts/lint-test-file-count.cjs

@@ -141,6 +141,38 @@ function buildTestMap(prodPrefixes, allTestFiles) {
   return map;
 }
 
+// #5074: a `<stem>.platform.test.cjs` alongside `<stem>.test.cjs` (or
+// `.test.ts`) in the SAME directory is the other half of that primary file —
+// the platform-sensitive slice extracted so the Windows CI selector runs
+// only the small sibling — not an additional test file. Exclude it from the
+// per-module count and from the allowlist identity comparison. A
+// `.platform.test.cjs` with no base file in the same directory counts
+// normally, so the rule cannot be used to smuggle in new standalone files.
+// An empty stem (bare `platform.test.cjs`) is never treated as a sibling.
+const PLATFORM_SIBLING_RE = /^(.+)\.platform\.test\.(cjs|ts)$/;
+
+function isSplitSibling(fileBasename, siblingBasenamesInDir) {
+  const m = fileBasename.match(PLATFORM_SIBLING_RE);
+  if (!m) return false;
+  const stem = m[1];
+  if (!stem) return false;
+  return siblingBasenamesInDir.includes(`${stem}.test.cjs`) ||
+         siblingBasenamesInDir.includes(`${stem}.test.ts`);
+}
+
+function excludeSplitSiblings(testFiles) {
+  const basenamesByDir = new Map();
+  for (const f of testFiles) {
+    const dir = path.dirname(f);
+    if (!basenamesByDir.has(dir)) basenamesByDir.set(dir, []);
+    basenamesByDir.get(dir).push(path.basename(f));
+  }
+  return testFiles.filter(f => {
+    const dir = path.dirname(f);
+    return !isSplitSibling(path.basename(f), basenamesByDir.get(dir));
+  });
+}
+
 function loadAllowlist() {
   try { return JSON.parse(fs.readFileSync(ALLOWLIST_PATH, 'utf-8')).modules || {}; }
   catch (_) { return {}; }
@@ -160,6 +192,7 @@ function loadAllowlist() {
  * Returns { verdict, prefix, count, knownFiles, novel, stale, files }
  */
 function evaluateLint({ prefix, testFiles, allowlist }) {
+  testFiles = excludeSplitSiblings(testFiles);
   const count = testFiles.length;
   const entry = allowlist[prefix];
   const currentNames = testFiles.map(f => path.basename(f));
@@ -258,7 +291,7 @@ function run() {
 }
 
 module.exports = {
-  Verdict, evaluateLint, testEffectivePrefix, prodPrefix,
+  Verdict, evaluateLint, testEffectivePrefix, prodPrefix, isSplitSibling,
   _collectProdPrefixes: collectProdPrefixes,
   _collectAllTestFiles: collectAllTestFiles,
   _buildTestMap: buildTestMap,

package/scripts/lint-vendored-deps.cjs

@@ -57,6 +57,7 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const { ExitError, runMain } = require('./lib/cli-exit.cjs');
+const { buildVendorBundle } = require('./lib/vendor-bundle.cjs');
 
 const ROOT = path.join(__dirname, '..');
 
@@ -89,16 +90,29 @@ function resolvePath(p) {
  *                                       or null when there is no bin-side type twin
  * @property {string|null} srcTwin      path under src/vendor/ to the source-side type twin tsc
  *                                       resolves for a relative import from src/**, or null
- * @property {'upstream-verbatim'|'hand-authored'} twinKind
+ * @property {boolean} [bundle]        Reproducibly bundle upstream and its locked dependencies.
+ * @property {'upstream-verbatim'|'upstream-reference'|'hand-authored'} twinKind
  *                                       'upstream-verbatim': srcTwin/vendoredDts are byte-compared
  *                                       against upstream and each other.
  *                                       'hand-authored': no upstream counterpart exists, so the
  *                                       twin is excluded from the byte-compare (checks 2 and 3
  *                                       above are skipped for this row).
+ *                                       'upstream-reference': srcTwin must be exactly
+ *                                       `export * from '<name>';` (bundled rows).
  */
 
 /** @type {VendoredPackage[]} */
 const VENDORED = [
+  ...['tap-parser', 'saxes'].map((name) => ({
+    name,
+    upstreamCjs: name === 'tap-parser' ? 'node_modules/tap-parser/dist/commonjs/index.js' : 'node_modules/saxes/saxes.js',
+    vendoredCjs: `gsd-core/bin/lib/vendor/${name}.cjs`,
+    upstreamDts: null,
+    vendoredDts: null,
+    srcTwin: `src/vendor/${name}.d.cts`,
+    twinKind: 'upstream-reference',
+    bundle: true,
+  })),
   {
     name: 're2js',
     upstreamCjs: 'node_modules/re2js/build/index.cjs',
@@ -127,6 +141,7 @@ const VENDORED = [
  * @returns {string}
  */
 function buildRefreshCommand(row) {
+  if (row.bundle) return 'npm run lint:vendored-deps -- --fix';
   const parts = [`cp ${row.upstreamCjs} ${row.vendoredCjs}`];
   if (row.twinKind === 'upstream-verbatim' && row.upstreamDts) {
     if (row.vendoredDts) parts.push(`cp ${row.upstreamDts} ${row.vendoredDts}`);
@@ -135,7 +150,8 @@ function buildRefreshCommand(row) {
   return parts.join(' && ');
 }
 
-const REFRESH_COMMAND = VENDORED.map(buildRefreshCommand).join(' && ');
+// Bundled rows share one refresh command; list it once.
+const REFRESH_COMMAND = [...new Set(VENDORED.map(buildRefreshCommand))].join(' && ');
 
 /**
  * Compare two files byte-for-byte. Returns null when equal, or a short
@@ -263,8 +279,17 @@ function readPinState(row, pkgRoot = ROOT) {
 function checkRow(row, pkgRoot = ROOT) {
   const findings = [];
 
-  const cjsDrift = compareFiles(row.vendoredCjs, row.upstreamCjs);
-  if (cjsDrift) findings.push(cjsDrift);
+  if (row.bundle) {
+    const built = buildVendorBundle(pkgRoot, row.upstreamCjs);
+    for (const [file, expected] of [[row.vendoredCjs, built.code], [`${row.vendoredCjs}.LICENSE.txt`, built.notices]]) {
+      if (!fs.existsSync(resolvePath(file)) || !fs.readFileSync(resolvePath(file)).equals(expected)) {
+        findings.push(`${file} != reproducible upstream bundle (including license notices)`);
+      }
+    }
+  } else {
+    const cjsDrift = compareFiles(row.vendoredCjs, row.upstreamCjs);
+    if (cjsDrift) findings.push(cjsDrift);
+  }
 
   if (row.twinKind === 'upstream-verbatim') {
     if (row.upstreamDts && row.vendoredDts) {
@@ -277,6 +302,11 @@ function checkRow(row, pkgRoot = ROOT) {
     }
   } else if (row.twinKind === 'hand-authored') {
     findings.push(...checkHandAuthoredTwin(row));
+  } else if (row.twinKind === 'upstream-reference') {
+    const expected = `export * from '${row.name}';\n`;
+    if (!row.srcTwin || !fs.existsSync(resolvePath(row.srcTwin)) || fs.readFileSync(resolvePath(row.srcTwin), 'utf8') !== expected) {
+      findings.push(`${row.name}: type twin must forward the upstream declarations verbatim`);
+    }
   }
 
   const { pinnedSpec, installedVersion } = readPinState(row, pkgRoot);
@@ -318,7 +348,13 @@ function checkRow(row, pkgRoot = ROOT) {
  * @returns {string[]} findings remaining after the fix (empty when fully resolved)
  */
 function fixRow(row, pkgRoot = ROOT) {
-  fs.copyFileSync(resolvePath(row.upstreamCjs), resolvePath(row.vendoredCjs));
+  if (row.bundle) {
+    const built = buildVendorBundle(pkgRoot, row.upstreamCjs);
+    fs.writeFileSync(resolvePath(row.vendoredCjs), built.code);
+    fs.writeFileSync(resolvePath(`${row.vendoredCjs}.LICENSE.txt`), built.notices);
+  } else {
+    fs.copyFileSync(resolvePath(row.upstreamCjs), resolvePath(row.vendoredCjs));
+  }
 
   if (row.twinKind === 'upstream-verbatim' && row.upstreamDts) {
     if (row.vendoredDts) fs.copyFileSync(resolvePath(row.upstreamDts), resolvePath(row.vendoredDts));

package/scripts/lint-workflow-shellcheck-baseline.json

@@ -354,11 +354,6 @@
     "code": "2012",
     "message": "Use find instead of ls to better handle non-alphanumeric filenames."
   },
-  {
-    "file": "gsd-core/workflows/execute-phase.md",
-    "code": "2012",
-    "message": "Use find instead of ls to better handle non-alphanumeric filenames."
-  },
   {
     "file": "gsd-core/workflows/execute-phase.md",
     "code": "2016",
@@ -384,11 +379,6 @@
     "code": "2086",
     "message": "Double quote to prevent globbing and word splitting."
   },
-  {
-    "file": "gsd-core/workflows/execute-phase.md",
-    "code": "2086",
-    "message": "Double quote to prevent globbing and word splitting."
-  },
   {
     "file": "gsd-core/workflows/execute-phase/detail/elaboration.md",
     "code": "2086",
@@ -414,6 +404,16 @@
     "code": "2086",
     "message": "Double quote to prevent globbing and word splitting."
   },
+  {
+    "file": "gsd-core/workflows/execute-phase/steps/verify-phase-goal.md",
+    "code": "2012",
+    "message": "Use find instead of ls to better handle non-alphanumeric filenames."
+  },
+  {
+    "file": "gsd-core/workflows/execute-phase/steps/verify-phase-goal.md",
+    "code": "2086",
+    "message": "Double quote to prevent globbing and word splitting."
+  },
   {
     "file": "gsd-core/workflows/execute-phase/steps/wave-post-gate-hooks.md",
     "code": "2086",
@@ -1108,5 +1108,20 @@
     "file": "gsd-core/workflows/verify-work/steps/mvp-uat-framing.md",
     "code": "2086",
     "message": "Double quote to prevent globbing and word splitting."
+  },
+  {
+    "file": "gsd-core/workflows/execute-phase/steps/code-review-disposition.md",
+    "code": "2317",
+    "message": "Command appears to be unreachable. Check usage (or ignore if invoked indirectly)."
+  },
+  {
+    "file": "gsd-core/workflows/execute-phase/steps/code-review-disposition.md",
+    "code": "2317",
+    "message": "Command appears to be unreachable. Check usage (or ignore if invoked indirectly)."
+  },
+  {
+    "file": "gsd-core/workflows/execute-phase/steps/code-review-disposition.md",
+    "code": "2317",
+    "message": "Command appears to be unreachable. Check usage (or ignore if invoked indirectly)."
   }
 ]

package/scripts/mutation-matrix.cjs

@@ -402,11 +402,22 @@ const COVERED = {
     //     extraTests above) rather than deleted, so the mutants they kill stay killed.
     //     frontmatter.test.cjs itself is UNCHANGED and keeps running in the normal
     //     (non-mutation) suite — only the mutation shard drops it.
+    //   - frontmatter-splice.property.test.cjs (#5105): the writer's own property suite,
+    //     moved out of frontmatter.property.test.cjs when spliceFrontmatter moved to
+    //     frontmatter-splice.cts. It requires frontmatter.cjs only as the read-back oracle and
+    //     matches this module's "frontmatter-" prefix, so the derivation would pull it in here;
+    //     it runs in the frontmatter-splice shard instead. Keeping it out of this shard is the
+    //     point of the split: the frontmatter shard was cancelled at its 20-minute cap on PR
+    //     #5114 (1149/1749 mutants tested) with these splice-heavy properties re-run for every
+    //     parser mutant they happened to cover.
     excludeTests: [
       'frontmatter-cli.test.cjs',
+      'frontmatter-splice.property.test.cjs',
       'frontmatter.test.cjs',
     ],
-    minScore: 65,
+    // 87.72% in CI run 36590493522 on PR #5114 (#5105 added in-process command tests).
+    // Floor = floor(87.72) - 1 = 86.
+    minScore: 86,
     // MEASUREMENT, not a projection. Under the tap runner with coverageAnalysis: 'perTest'
     // (#3915), Stryker now re-runs only the test files that cover each mutated line instead
     // of all six files for every one of ~1900 mutants. Measured result: the frontmatter shard
@@ -428,6 +439,37 @@ const COVERED = {
     // The prior audit's 'none' vs 'process' comparison (recorded here before this change)
     // is moot: there is nothing left to opt in or out of.
   },
+  // frontmatter-splice: net-new module from #5105 — the frontmatter WRITER (spliceFrontmatter
+  // and its layout slicing, comment classification, parse budget, key quoting and read-back
+  // check), split out of frontmatter.cts by module ownership. Before the split the writer grew
+  // frontmatter.cjs from 1249 to 1749 mutants and the frontmatter shard was cancelled at its
+  // 20-minute cap (PR #5114, run 36577087588, job 109435636296: 1149/1749 tested at ~1.34
+  // s/covered mutant). Stryker's instrumenter counts 1267 mutants in frontmatter.cjs and 498 in
+  // frontmatter-splice.cjs after the split. Registered here so the writer is scored at all —
+  // mutation coverage does not migrate with relocated code (the context-composer precedent).
+  //
+  // Tests: frontmatter-splice.property.test.cjs is auto-derived (requires this module, matches
+  // the naming rule). extraTests are the other files that drive spliceFrontmatter directly —
+  // they are named after frontmatter, so the derivation cannot find them for this module:
+  //   - frontmatter.unit.test.cjs: the #1572/#1660/#3257/#3742/#4802 splice cases.
+  //   - frontmatter.property.test.cjs: the #644 prohibitions parse -> splice -> re-parse
+  //     bijection.
+  //   - frontmatter-fence.test.cjs: the writer's BOM / CRLF / empty-block fence cases.
+  //
+  // minScore 62: the module was first registered with a provisional floor of 50 (the minimum
+  // the ratchet test permits, tests/mutation-matrix-ratchet.test.cjs:107-116) because the shard
+  // cannot run locally (see HOW TO UPDATE above). The first CI measurement was 63.82% (CI run
+  // 36586350120, PR #5114), so the floor is set to floor(63.82) - 1 = 62, following this file's
+  // convention, together with its RATCHET_BASELINE entry.
+  'frontmatter-splice': {
+    cjs: 'gsd-core/bin/lib/frontmatter-splice.cjs',
+    extraTests: [
+      'frontmatter-fence.test.cjs',
+      'frontmatter.property.test.cjs',
+      'frontmatter.unit.test.cjs',
+    ],
+    minScore: 62,
+  },
   // adr-parser / config-schema / active-workstream-store / core-utils: derivation reproduces
   // their prior hand lists exactly (every constraining file's own name already matched the
   // "<module>*" rule) — no extraTests/excludeTests needed. Note config-schema in particular:
@@ -456,7 +498,10 @@ const COVERED = {
   },
   'core-utils': {
     cjs: 'gsd-core/bin/lib/core-utils.cjs',
-    minScore: 75,  // measured 77.52% (2026-06-14, issue #1187); floor = 77 - 2
+    // measured 77.52% (2026-06-14, issue #1187); floor = 77 - 2.
+    // CI job 109435636183 (PR #5114, #5105): measured 81.13%. Floor =
+    // floor(81.13) - 1 = 80.
+    minScore: 80,
   },
   // planning-inspect / plan-document / planning-command-router: net-new modules
   // added by #2790. Registered here so the Stryker gate stops SKIPPING them
@@ -484,7 +529,7 @@ const COVERED = {
   // PASSED — not a local run; mutation shards run `node --test`, hard-blocked
   // in this repo's local environment):
   //   planning-command-router 95.65% → floor 94  (already exceeds TARGET_MUTATION_SCORE (80))
-  //   plan-document            76.58% → floor 75
+  //   plan-document            76.58% → floor 75; then 81.16% → floor 80 (#5026 parity tests)
   //   planning-inspect         57.03% → floor 56  (well below TARGET (80) — ratchet
   //     candidate; comfortably clears its own floor but has real room to grow.
   //     Raise as its tests improve, never lower it.)
@@ -507,7 +552,7 @@ const COVERED = {
   'planning-inspect': {
     cjs: 'gsd-core/bin/lib/planning-inspect.cjs',
     excludeTests: ['planning-inspect.test.cjs'],
-    minScore: 56,
+    minScore: 72, // #5118: 73.70% in CI run 36676296090; floor(73.70) - 1
   },
   // plan-document / planning-command-router: their own names never appear in any test
   // filename (the shared dedicated unit file is named after planning-inspect, the module
@@ -516,7 +561,7 @@ const COVERED = {
   'plan-document': {
     cjs: 'gsd-core/bin/lib/plan-document.cjs',
     extraTests: ['planning-inspect.unit.test.cjs'],
-    minScore: 75,
+    minScore: 80,
   },
   'planning-command-router': {
     cjs: 'gsd-core/bin/lib/planning-command-router.cjs',

package/scripts/prompt-injection-scan.sh

@@ -171,6 +171,10 @@ ALLOWLIST=(
   # allowlist cannot reach it either, because the literal `child_process` is
   # not adjacent to `.exec`. See the note at the pattern itself.
   'tests/continuation-grammar-parity.test.cjs'
+  # #4906 Phase 5 — regex.exec('### Phase 03: ...') fixtures.
+  # Same DEFECT.PROMPT-INJECTION-SCAN-COLLISION class as above:
+  # RegExp.prototype.exec, not code execution.
+  'tests/phase-id.test.cjs'
   # #3676 row 11b — quick-batch's task-list parser must treat a
   # prompt-injection-shaped task description as inert data, never
   # interpreted. The fixture has to be a real "ignore all previous