@opengsd/gsd-core 1.17.0 → 1.19.0

package/gsd-core/bin/lib/gate-decision-coverage-plan.cjs

@@ -145,10 +145,28 @@ function evaluateDecisionCoveragePlan(input) {
     if (decisions.length === 0) {
         return (0, gate_verdict_cjs_1.gateVerdict)('skip', false, { passed: true, skipped: true, reason: 'no trackable decisions', total: 0, covered: 0, uncovered: [], message: 'No trackable decisions in CONTEXT.md.' });
     }
+    // #4939: a phase-dir argument that was GIVEN but is not a directory is a caller
+    // error like #2770's empty context argument and #4794's non-file context path:
+    // no plan was scanned, so nothing was measured. Fail closed with total/covered
+    // null and `uncovered` omitted. An OMITTED phase dir is left to the scan below —
+    // the #4130 `--context <path>` alone tests pin that as a coverage gap.
+    const phaseDirIssue = phaseDir ? (0, decision_coverage_support_cjs_1.phaseDirProblem)(phaseDir) : null;
+    if (phaseDirIssue) {
+        const phaseDirResult = { passed: false, skipped: false, reason: phaseDirIssue.reason, total: null, covered: null, message: `Decision coverage gate: the phase directory "${positionals[0]}" ${phaseDirIssue.what}, so no plans were scanned. ${phaseDirIssue.hint}` };
+        return phaseDirIssue.unreadable ? (0, gate_verdict_cjs_1.gateUnreadable)(true, phaseDirResult) : (0, gate_verdict_cjs_1.gateVerdict)('block', true, phaseDirResult);
+    }
     const planContents = (0, decision_coverage_support_cjs_1.loadPlanContents)(phaseDir);
     if (planContents.kind === 'unreadable')
         return unreadableDecisionGate(`${planContents.span ?? phaseDir}: ${planContents.reason}`);
-    const sections = planContents.value.map(decision_coverage_support_cjs_1.extractPlanDesignatedSections);
+    // #4939: a phase directory that holds no PLAN file is the same caller error: zero plans
+    // loaded is not zero coverage.
+    if (phaseDir && planContents.value.length === 0) {
+        return (0, gate_verdict_cjs_1.gateVerdict)('block', true, { passed: false, skipped: false, reason: 'phase directory holds no plans', total: null, covered: null, message: `Decision coverage gate: the phase directory "${positionals[0]}" holds no PLAN files, so no plans were scanned. Pass the phase DIRECTORY that holds the plans (e.g. .planning/phases/01-slug), not the phase number.` });
+    }
+    const tracker = (0, decision_coverage_support_cjs_1.resolveTrackerBodies)(projectDir, planContents.value, input.deps);
+    if (tracker.kind === 'unreadable')
+        return unreadableDecisionGate(`${tracker.span}: ${tracker.reason}`);
+    const sections = planContents.value.map((c, i) => (0, decision_coverage_support_cjs_1.extractPlanDesignatedSections)(c) + (tracker.value.bodies[i] ? '\n' + tracker.value.bodies[i] : ''));
     const uncovered = [];
     let covered = 0;
     for (const decision of decisions) {
@@ -157,6 +175,8 @@ function evaluateDecisionCoveragePlan(input) {
         else
             uncovered.push({ id: decision.id, text: decision.text, category: decision.category });
     }
+    if (uncovered.length > 0 && tracker.value.missingResolver)
+        return unreadableDecisionGate(`${tracker.value.missingResolver.span}: ${tracker.value.missingResolver.reason}`);
     const passed = uncovered.length === 0;
     return (0, gate_verdict_cjs_1.gateVerdict)(passed ? 'pass' : 'block', !passed, {
         passed,

package/gsd-core/bin/lib/gate-decision-coverage-verify.cjs

@@ -90,19 +90,35 @@ function evaluateDecisionCoverageVerify(input) {
     if (decisions.length === 0) {
         return (0, gate_verdict_cjs_1.gateVerdict)('skip', false, { skipped: true, blocking: false, reason: 'no trackable decisions', total: 0, honored: 0, not_honored: [], message: 'No trackable decisions in CONTEXT.md.' });
     }
+    // #4939: mirror the plan gate. A phase-dir argument that names no directory
+    // means no plan or summary was scanned, so no decision can be reported
+    // not-honored. Warn (verify stays non-blocking) rather than list every decision.
+    const phaseDirIssue = phaseDir ? (0, decision_coverage_support_cjs_1.phaseDirProblem)(phaseDir) : null;
+    if (phaseDirIssue) {
+        const phaseDirResult = { skipped: false, blocking: false, reason: phaseDirIssue.reason, total: null, honored: null, not_honored: [], message: `Decision coverage verify (warning): the phase directory "${args[0]}" ${phaseDirIssue.what}, so no plans or summaries were scanned. ${phaseDirIssue.hint}` };
+        return phaseDirIssue.unreadable ? (0, gate_verdict_cjs_1.gateUnreadable)(false, phaseDirResult) : (0, gate_verdict_cjs_1.gateVerdict)('advisory', false, phaseDirResult);
+    }
     // Every file the haystack is built from is typed evidence (#5170): one that exists but cannot be
     // read is `unreadable`, never an empty slice of the haystack that makes a decision look unhonored.
     const planContents = (0, decision_coverage_support_cjs_1.loadPlanContents)(phaseDir);
     if (planContents.kind === 'unreadable')
         return unreadableVerify(`${planContents.span ?? phaseDir}: ${planContents.reason}`);
+    const tracker = (0, decision_coverage_support_cjs_1.resolveTrackerBodies)(projectDir, planContents.value, input.deps);
+    if (tracker.kind === 'unreadable')
+        return unreadableVerify(`${tracker.span}: ${tracker.reason}`);
     const summaryParts = (0, decision_coverage_support_cjs_1.loadSummaryContents)(phaseDir);
     if (summaryParts.kind === 'unreadable')
         return unreadableVerify(`${summaryParts.span ?? phaseDir}: ${summaryParts.reason}`);
+    // #4939: mirror the plan gate. A phase directory with no PLAN and no SUMMARY file gave the
+    // verifier nothing to read, which is a caller error, not a phase whose decisions were all missed.
+    if (phaseDir && planContents.value.length === 0 && summaryParts.value.length === 0) {
+        return (0, gate_verdict_cjs_1.gateVerdict)('advisory', false, { skipped: false, blocking: false, reason: 'phase directory holds no plans', total: null, honored: null, not_honored: [], message: `Decision coverage verify (warning): the phase directory "${args[0]}" holds no PLAN or SUMMARY files, so nothing was scanned. Pass the phase DIRECTORY that holds the plans (e.g. .planning/phases/01-slug), not the phase number.` });
+    }
     const modifiedFiles = (0, decision_coverage_support_cjs_1.readModifiedFilesContent)(projectDir, summaryParts.value);
     if (modifiedFiles.kind === 'unreadable')
         return unreadableVerify(`${modifiedFiles.span ?? 'files_modified'}: ${modifiedFiles.reason}`);
     const haystack = [
-        planContents.value.join('\n\n'),
+        planContents.value.map((c, i) => c + (tracker.value.bodies[i] ? '\n' + tracker.value.bodies[i] : '')).join('\n\n'),
         summaryParts.value.join('\n\n'),
         modifiedFiles.value,
         (0, decision_coverage_support_cjs_1.phaseCommitMessages)(projectDir, phaseDir),
@@ -115,6 +131,8 @@ function evaluateDecisionCoverageVerify(input) {
         else
             notHonored.push({ id: decision.id, text: decision.text, category: decision.category });
     }
+    if (notHonored.length > 0 && tracker.value.missingResolver)
+        return unreadableVerify(`${tracker.value.missingResolver.span}: ${tracker.value.missingResolver.reason}`);
     return (0, gate_verdict_cjs_1.gateVerdict)(notHonored.length === 0 ? 'pass' : 'advisory', false, {
         skipped: false,
         blocking: false,

package/gsd-core/bin/lib/gate-evaluation-scope.cjs

@@ -35,9 +35,11 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.MAX_COMMITS_CEILING = exports.SCOPE_EXCLUSION_PATHSPECS = void 0;
 exports.extractTaskCommitRefs = extractTaskCommitRefs;
+exports.qualifiedPlanSubjectPattern = qualifiedPlanSubjectPattern;
 exports.planSubjectPattern = planSubjectPattern;
 exports.isSafeRefArgument = isSafeRefArgument;
 exports.isSafeDateArgument = isSafeDateArgument;
+exports.commitIsAncestor = commitIsAncestor;
 exports.resolveEvaluationScope = resolveEvaluationScope;
 exports.evaluateEvaluationScope = evaluateEvaluationScope;
 const node_fs_1 = __importDefault(require("node:fs"));
@@ -46,6 +48,9 @@ const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs")
 const gate_verdict_cjs_1 = require("./gate-verdict.cjs");
 const gate_phase_context_cjs_1 = require("./gate-phase-context.cjs");
 const pattern_cjs_1 = require("./pattern.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports
+const planningWorkspaceMod = require("./planning-workspace.cjs");
+const { readScopedConfigValue } = planningWorkspaceMod;
 const gate_evidence_cjs_1 = require("./gate-evidence.cjs");
 // ─── Constants ────────────────────────────────────────────────────────────────
 /** Paths that are never part of a code-review or UI scope (planning artifacts, lockfiles). */
@@ -107,25 +112,124 @@ function paddedPattern(value) {
     const intPart = (m[1] ?? '').replace(/^0+(?=\d)/, '');
     return `0*${(0, pattern_cjs_1.escapeEre)(intPart)}${(0, pattern_cjs_1.escapeEre)(m[2] ?? '')}`;
 }
+/**
+ * The `<phase>-<plan>` fragment of a plan subject pattern, or null when `id` is not that shape.
+ *
+ * Zero-padding tolerant in both halves: `03-01` yields `0*3-0*1`, so `feat(03-01):`, `test(3-1):`
+ * and `fix(03-01)!:` match while `feat(03-010):` does not (#4003, #4619, #4748).
+ */
+function phasePlanPattern(id) {
+    const dash = id.indexOf('-');
+    const phasePart = dash > 0 ? id.slice(0, dash) : '';
+    const planPart = dash > 0 ? id.slice(dash + 1) : '';
+    if (/^[0-9A-Za-z.]+$/.test(phasePart) && /^[0-9A-Za-z.]+$/.test(planPart)) {
+        return `${paddedPattern(phasePart)}-${paddedPattern(planPart)}`;
+    }
+    return null;
+}
+/**
+ * The anchored subject pattern for a `<phase>-<plan>` ERE fragment, optionally behind one scope
+ * qualifier as the group `(<qualifier>-)?`.
+ *
+ * Every spelling of a plan id goes through this one builder: the bare id, the id carrying the
+ * configured project code (#5271), and the workstream-qualified id `<ws>-<phase>-<plan>` that #5177
+ * proposes. The qualifier is ERE-escaped, so a workstream name (a path segment, not a project-code
+ * token) is matched literally. The group is a real capture group, never `(?:…)`: the pattern goes
+ * to `git log --extended-regexp`, and POSIX ERE has no non-capturing group.
+ */
+function qualifiedPlanSubjectPattern(fragment, qualifier = null) {
+    const group = qualifier === null ? '' : `(${(0, pattern_cjs_1.escapeEre)(qualifier)}-)?`;
+    return `^[a-z]+\\(${group}${fragment}\\)!?:`;
+}
+/**
+ * The `<CODE>-` prefix of `planId` when it is EXACTLY the project's configured `project_code`
+ * followed by a dash — the separator included — else null.
+ *
+ * The match is CASE-SENSITIVE and anchored to the configured value. The phase-id module's
+ * `stripProjectCodePrefix` grammar (case-insensitive, any code before a digit) recognises ANY
+ * letter prefix, which is deliberately wider than the project: `AUTH-01-02` and `setup-1-2` are
+ * ids this project never assigned a code to, and stripping their prefixes made them resolve
+ * another plan's commits (#5271). Only the code the project actually configures may be
+ * stripped, so an id that merely LOOKS coded keeps its literal-match guarantee.
+ */
+function configuredCodePrefix(planId, projectCode) {
+    if (projectCode === null || !isUsableProjectCode(projectCode))
+        return null;
+    const prefix = `${projectCode}-`;
+    return planId.startsWith(prefix) ? prefix : null;
+}
 /**
  * The anchored subject pattern for a plan id, or null when `planId` is empty, over-long or carries a
  * control / whitespace character.
  *
  * A `<phase>-<plan>` id (`03-01`) is zero-padding tolerant: `feat(03-01):`, `test(3-1):` and
- * `fix(03-01)!:` match, `feat(03-010):` does not. Any other id (a plan FILE NAME that does not follow
- * the numbering) is matched LITERALLY — every ERE metacharacter escaped — so `x.*` or `a[b]` can only
- * match a commit that names that exact id, and never widens the pattern.
+ * `fix(03-01)!:` match, `feat(03-010):` does not. An id carrying the CONFIGURED project code
+ * (`PRJ-01-01` with `project_code: "PRJ"`, #5271) matches either spelling of the SAME plan —
+ * `feat(PRJ-01-01):` and `feat(01-01):` — because the two init verbs hand out different phase
+ * tokens for one plan. The code is stripped ONLY when it is the configured one: an id like
+ * `AUTH-01-02` or `setup-1-2`, which merely looks coded, is matched LITERALLY — every ERE
+ * metacharacter escaped — so it can only match a commit naming that exact id and never widens the
+ * pattern to another plan's commits. Any other id (a plan FILE NAME that does not follow the
+ * numbering) is matched literally for the same reason.
+ *
+ * `projectCode` is the project's configured `project_code`; with none (no config, no `planningDir`),
+ * every id is matched literally, which is the pre-#5271 behaviour.
  */
-function planSubjectPattern(planId) {
+function planSubjectPattern(planId, projectCode = null) {
     if (planId.length === 0 || planId.length > 200 || /[\s\x00-\x1f\x7f]/.test(planId))
         return null;
-    const dash = planId.indexOf('-');
-    const phasePart = dash > 0 ? planId.slice(0, dash) : '';
-    const planPart = dash > 0 ? planId.slice(dash + 1) : '';
-    if (/^[0-9A-Za-z.]+$/.test(phasePart) && /^[0-9A-Za-z.]+$/.test(planPart)) {
-        return `^[a-z]+\\(${paddedPattern(phasePart)}-${paddedPattern(planPart)}\\)!?:`;
+    const direct = phasePlanPattern(planId);
+    if (direct)
+        return qualifiedPlanSubjectPattern(direct);
+    // #5271: `init.execute-phase` returns `phase_number: "PRJ-01"` where `init.plan-phase` returns
+    // `padded_phase: "01"`, and every gate builds its `--plan` from the former. Splitting `PRJ-01-01`
+    // at its FIRST dash leaves `01-01` as the plan half, which is not a plan number, so the id fell
+    // through to the literal pattern that no executor commit can ever carry — an empty scope at exit
+    // 0, which is the correct answer for a plan that has NOT started and the wrong one for one that
+    // has. Retry on the CONFIGURED project-code-stripped id, with the code OPTIONAL so the commit the
+    // executor actually wrote still matches.
+    //
+    // The `(PRJ-)?` group comes from `qualifiedPlanSubjectPattern`, and it rides ONLY on a remainder
+    // that could be a plan number, so an empty or non-numeric remainder keeps the whole id literal —
+    // never WIDER than the pre-#5271 pattern.
+    const prefix = configuredCodePrefix(planId, projectCode);
+    if (prefix !== null) {
+        const stripped = planId.slice(prefix.length);
+        const coded = phasePlanPattern(stripped);
+        // The only remainder `phasePlanPattern` cannot split is the N-segment milestone shape
+        // (`01-02-03`), so require that whole shape: a bare `1`, `01-` or a trailing dash would
+        // otherwise widen the optional group onto `feat(1):`.
+        const planShaped = coded !== null || /^\d[0-9A-Za-z.]*(-[0-9A-Za-z.]+){2,}$/.test(stripped);
+        if (!planShaped)
+            return qualifiedPlanSubjectPattern((0, pattern_cjs_1.escapeEre)(planId));
+        return qualifiedPlanSubjectPattern(coded ?? (0, pattern_cjs_1.escapeEre)(stripped), projectCode);
     }
-    return `^[a-z]+\\(${(0, pattern_cjs_1.escapeEre)(planId)}\\)!?:`;
+    return qualifiedPlanSubjectPattern((0, pattern_cjs_1.escapeEre)(planId));
+}
+/**
+ * Whether a configured `project_code` can safely be stripped from a plan id and put in a pattern.
+ *
+ * `config-set` stores `project_code` unvalidated and docs/CONFIGURATION.md calls it "any short
+ * string", so this is a SAFETY check, not the phase-id module's uppercase grammar: a letter first,
+ * then letters, digits, `_`, `.` or `-`, at most 32 characters. That admits `gsd` and `AUTH-X`
+ * (which the uppercase grammar left in the #5271 symptom) while excluding whitespace, control
+ * characters and anything long enough to be a sentence. The value is ERE-escaped by the pattern
+ * builder, so no metacharacter it admits can change the pattern.
+ */
+function isUsableProjectCode(code) {
+    return /^[A-Za-z][A-Za-z0-9_.-]{0,31}$/.test(code);
+}
+/**
+ * The project's configured `project_code`, or null when it is absent, non-string or unusable
+ * (`isUsableProjectCode`). An unusable value reads as ABSENT: the coded id keeps its LITERAL
+ * spelling, which is never WIDER than the pre-#5271 pattern, since a literal id can only match a
+ * subject naming that exact id.
+ */
+function configuredProjectCode(projectDir) {
+    const { present, value } = readScopedConfigValue(projectDir, ['project_code']);
+    if (!present || typeof value !== 'string')
+        return null;
+    return isUsableProjectCode(value) ? value : null;
 }
 // ─── Git plumbing ─────────────────────────────────────────────────────────────
 class ScopeUnreadable extends Error {
@@ -189,6 +293,23 @@ function isSafeDateArgument(candidate) {
 function isAncestor(git, sha, of) {
     return gitOrNo(git, ['merge-base', '--is-ancestor', sha, of]) !== null;
 }
+/**
+ * Whether commit `sha` is an ancestor of commit `of` (#5275): ancestry, never log position or commit
+ * date, so a history merged from worktree branches is judged by what it descends from. `null` means
+ * git could not answer (missing, hung, a bad object): the caller must not read that as "no".
+ */
+function commitIsAncestor(projectDir, sha, of, execGit) {
+    if (!isSafeRefArgument(sha) || !isSafeRefArgument(of))
+        return null;
+    try {
+        return isAncestor(makeGit(projectDir, execGit ?? shell_command_projection_cjs_1.execGit), sha, of);
+    }
+    catch (error) {
+        if (error instanceof ScopeUnreadable)
+            return null;
+        throw error;
+    }
+}
 // ─── The resolver ─────────────────────────────────────────────────────────────
 function emptyScope(unit) {
     return {
@@ -210,7 +331,7 @@ function resolveEvaluationScope(projectDir, unit, options = {}) {
         if (unit.kind === 'phase')
             resolvePhase(projectDir, unit, scope, git, ref, options, repoRoot);
         else
-            resolveBySubject(unit, scope, git, ref, options, repoRoot);
+            resolveBySubject(projectDir, unit, scope, git, ref, options, repoRoot);
         return scope;
     }
     catch (error) {
@@ -388,7 +509,7 @@ function resolvePhase(projectDir, unit, scope, git, ref, options, repoRoot) {
     scope.commits = parseLog(git(['log', `${scope.rangeBase}..${ref}`, logFormat(options.includeBody === true), '-n', String(max)]), options.includeBody === true);
     finalizeFiles(scope, repoRoot, rangeFiles(git, scope.rangeBase, ref));
 }
-function resolveBySubject(unit, scope, git, ref, options, repoRoot) {
+function resolveBySubject(projectDir, unit, scope, git, ref, options, repoRoot) {
     const withBody = options.includeBody === true;
     // Refuse rather than truncate: a silently dropped positive pathspec narrows the match.
     const pathspecs = options.pathspecs ?? [];
@@ -412,7 +533,7 @@ function resolveBySubject(unit, scope, git, ref, options, repoRoot) {
     const grepArgs = [];
     let anchored = null;
     if (unit.kind === 'plan') {
-        const pattern = planSubjectPattern(unit.planId);
+        const pattern = planSubjectPattern(unit.planId, configuredProjectCode(projectDir));
         if (pattern === null)
             throw new ScopeUnreadable('invalid-plan-id');
         grepArgs.push('--extended-regexp', `--grep=${pattern}`);

package/gsd-core/bin/lib/gate-predicate-evaluator.cjs

@@ -26,6 +26,10 @@
  * This is a leaf pure module: no fs, no child_process, no config — the subprocess
  * seam is injected so the evaluator is trivially testable without spawning.
  */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_path_1 = __importDefault(require("node:path"));
 // ─── Public constants ─────────────────────────────────────────────────────────
 /** Default command timeout for `command-exit-zero` (30s). Matches execTool default. */
 const COMMAND_EXIT_ZERO_DEFAULT_TIMEOUT_MS = 30_000;
@@ -116,15 +120,31 @@ function evaluateArtifactFrontmatterEquals(predicate, ctx, deps) {
         throw new Error('artifact-frontmatter-equals predicate requires an "equals" key');
     }
     const targetDir = isNonEmptyString(ctx.phaseDir) ? ctx.phaseDir : ctx.cwd;
-    const filePath = deps.findPhaseArtifact(targetDir, artifactSuffix);
-    if (!filePath) {
+    // Plain `.sort()` (no locale) so the outcome never depends on directory listing order (#5313).
+    // Set: finders return realpaths, so a symlink to the same file is one artifact, not two.
+    const found = deps.findPhaseArtifact(targetDir, artifactSuffix);
+    // A pre-#5313 dep returned `string | null`; a silent null -> "not found" block or per-character spread would mislead.
+    if (!Array.isArray(found)) {
+        throw new Error('predicate deps "findPhaseArtifact" must return an array of paths');
+    }
+    const candidates = [...new Set(found)].sort();
+    if (candidates.length === 0) {
         return {
             block: true,
             message: `Artifact matching ${artifactSuffix} not found in ${targetDir}`,
             details: { kind: 'artifact-frontmatter-equals', artifactNotFound: true },
         };
     }
-    const fm = deps.readFrontmatter(filePath);
+    // #5313: never pick one of several matches (listing order is OS-dependent); a throw would fail open via onError.
+    if (candidates.length > 1) {
+        const names = candidates.map((c) => node_path_1.default.relative(targetDir, c).split(node_path_1.default.sep).join('/')).join(', ');
+        return {
+            block: true,
+            message: `Multiple artifacts match ${artifactSuffix} in ${targetDir}: ${names}; remove or rename all but one`,
+            details: { kind: 'artifact-frontmatter-equals', ambiguous: true, candidates },
+        };
+    }
+    const fm = deps.readFrontmatter(candidates[0]);
     const actualValue = fm[field];
     // eslint-disable-next-line @typescript-eslint/no-base-to-string
     const expectedStr = typeof expectedValue === 'object' ? JSON.stringify(expectedValue) : String(expectedValue);

package/gsd-core/bin/lib/gate-predicate.cjs

@@ -80,31 +80,27 @@ function buildPredicateDeps() {
             if (phaseDirStat.kind === 'unreadable')
                 return unreadable(phaseDir, phaseDirStat.reason);
             if (phaseDirStat.kind === 'none')
-                return null;
+                return [];
             if (artifactSuffix === '.' ||
                 artifactSuffix === '..' ||
                 artifactSuffix.includes('\0') ||
                 node_path_1.default.basename(artifactSuffix) !== artifactSuffix ||
                 node_path_1.default.win32.basename(artifactSuffix) !== artifactSuffix) {
-                return null;
-            }
-            const directContained = (0, security_cjs_1.tryWithinRoot)(artifactSuffix, phaseDir);
-            if (directContained !== null) {
-                const direct = regularFileOrNull(directContained);
-                if (direct !== null)
-                    return direct;
+                return [];
             }
+            // #5313: collect EVERY distinct match; the evaluator fails closed on >1 instead of trusting listing order.
+            const found = [];
             const planningContained = (0, security_cjs_1.tryWithinRoot)(node_path_1.default.join('.planning', artifactSuffix), phaseDir);
             if (planningContained !== null) {
                 const planning = regularFileOrNull(planningContained);
                 if (planning !== null)
-                    return planning;
+                    found.push(planning);
             }
             const listing = (0, gate_evidence_cjs_1.readDirEvidence)(phaseDir);
             if (listing.kind === 'unreadable')
                 return unreadable(phaseDir, listing.reason);
             if (listing.kind === 'none')
-                return null;
+                return [];
             for (const f of listing.value) {
                 if (f.endsWith('-' + artifactSuffix) || f === artifactSuffix) {
                     const candidateContained = (0, security_cjs_1.tryWithinRoot)(f, phaseDir);
@@ -112,10 +108,10 @@ function buildPredicateDeps() {
                         continue;
                     const candidate = regularFileOrNull(candidateContained);
                     if (candidate !== null)
-                        return candidate;
+                        found.push(candidate);
                 }
             }
-            return null;
+            return found;
         },
         readFrontmatter(filePath) {
             const content = (0, shell_command_projection_cjs_1.platformReadSync)(filePath);

package/gsd-core/bin/lib/gate-tdd-review-checkpoint.cjs

@@ -17,12 +17,19 @@
  * tolerant. A plan id that is not `<phase>-<plan>` (a plan named `.*-PLAN.md`) matches nothing,
  * and a git failure is "no commits" exactly as before.
  *
+ * Cross-plan GREEN (#4867): a gap closure is planned as a RED-only probe plan plus the plan that
+ * `depends_on` it and carries the fix. A `type: tdd` plan with its own RED but no GREEN is credited
+ * with a `feat(...)` commit under any plan that lists it in `depends_on`, directly or through a
+ * chain; the row carries `greenFrom` and the report names the supplier. Its own RED is still
+ * required, and a plan nothing depends on is scored on its own commits alone.
+ *
  * Argv after the verb: `<phase>` (a number; an unresolvable phase reports zero plans).
  */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.TDD_ROW_REASON = void 0;
 exports.evaluateTddReviewCheckpoint = evaluateTddReviewCheckpoint;
 const node_path_1 = __importDefault(require("node:path"));
 const gate_verdict_cjs_1 = require("./gate-verdict.cjs");
@@ -31,7 +38,10 @@ const gate_evidence_cjs_1 = require("./gate-evidence.cjs");
 const gate_evaluation_scope_cjs_1 = require("./gate-evaluation-scope.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const frontmatterMod = require("./frontmatter.cjs");
-const { frontmatterKeyHasValue } = frontmatterMod;
+const { frontmatterKeyHasValue, extractFrontmatter } = frontmatterMod;
+exports.TDD_ROW_REASON = {
+    GREEN_BEFORE_RED: 'green_before_red',
+};
 /**
  * True when the plan's frontmatter declares `type: tdd` (CRLF included, #2449). The block is the
  * one fence owner's, read as RAW text — not through the YAML parser — so a block the parser refuses
@@ -42,20 +52,69 @@ const { frontmatterKeyHasValue } = frontmatterMod;
 function isTddPlan(content) {
     return frontmatterKeyHasValue(content, 'type', 'tdd');
 }
+/** A `depends_on` token as a plan id: `01.1-20`, `01.1-20-PLAN` and `01.1-20-PLAN.md` all name plan `01.1-20`. */
+function toPlanId(token) {
+    return token.trim().replace(/-PLAN(?:\.md)?$/i, '');
+}
 /**
- * The commit types (`test`, `feat`, `refactor`, …) among the plan's own commits — those that
- * touched at least one path (`pathspecs: ['.']`, as the old `git log -- .` lookup did). An
- * unresolvable scope (git unavailable, an id that is not `<phase>-<plan>`) is "no commits".
+ * The plan ids a plan lists in `depends_on` (#4867). A plan whose frontmatter does not parse, or has
+ * no `depends_on`, depends on nothing: the pairing below only ever ADDS credit, so an unreadable
+ * link can never turn a failing plan into a passing one.
  */
-function planCommitKinds(projectDir, planId) {
+function dependsOnOf(content) {
+    // `extractFrontmatter` does not throw: an unparseable block is an empty result, so `depends_on` is absent.
+    const value = extractFrontmatter(content)['depends_on'];
+    const tokens = Array.isArray(value) ? value.map(String) : typeof value === 'string' ? value.split(',') : [];
+    return tokens.map(toPlanId).filter((id) => id !== '');
+}
+/** Every plan that depends on `planId`, directly or through a chain (#4867); a cycle is walked once. */
+function transitiveDependents(planId, dependents) {
+    const seen = new Set();
+    const queue = [planId];
+    while (queue.length > 0) {
+        for (const next of dependents.get(queue.shift()) ?? []) {
+            if (next !== planId && !seen.has(next)) {
+                seen.add(next);
+                queue.push(next);
+            }
+        }
+    }
+    return [...seen].sort();
+}
+/**
+ * The plan's own commits (`test`, `feat`, `refactor`, …) — those that touched at least one path
+ * (`pathspecs: ['.']`, as the old `git log -- .` lookup did) — with the sha the ordering check needs.
+ * An unresolvable scope (git unavailable, an id that is not `<phase>-<plan>`) is "no commits".
+ */
+function planCommits(projectDir, planId) {
     const scope = (0, gate_evaluation_scope_cjs_1.resolveEvaluationScope)(projectDir, { kind: 'plan', planId }, { pathspecs: ['.'], commitsOnly: true });
-    const kinds = new Set();
+    const commits = [];
     for (const commit of scope.commits) {
         const kind = /^([a-z]+)\(/.exec(commit.subject)?.[1];
         if (kind)
-            kinds.add(kind);
+            commits.push({ sha: commit.sha, kind });
+    }
+    return commits;
+}
+const shasOfKind = (commits, kind) => commits.filter((c) => c.kind === kind).map((c) => c.sha);
+/**
+ * Whether some GREEN descends from some RED (#5275). Decided by ancestry only — never log position or
+ * commit date — so a history merged from worktree branches is judged by what each commit descends from.
+ * `true` as soon as one pair is in order; `null` when git could not answer for a pair and none was
+ * in order (an environment fault is not a violation, so the caller keeps the credit); else `false`.
+ */
+function greenFollowsRed(projectDir, reds, greens) {
+    let unanswered = false;
+    for (const red of reds) {
+        for (const green of greens) {
+            const redIsAncestor = (0, gate_evaluation_scope_cjs_1.commitIsAncestor)(projectDir, red, green);
+            if (redIsAncestor === true)
+                return true;
+            if (redIsAncestor === null)
+                unanswered = true;
+        }
     }
-    return kinds;
+    return unanswered ? null : false;
 }
 /**
  * The verdict when the review could not read a plan or the phase directory. Advisory policy is
@@ -91,6 +150,9 @@ function evaluateTddReviewCheckpoint(input) {
     const phaseDir = located.kind === 'found' ? located.value : '';
     // Find all PLAN.md files with type: tdd in frontmatter
     const tddPlanFiles = [];
+    // #4867: plan id -> the plans that list it in `depends_on`, over EVERY plan of the phase (a
+    // dependent GREEN plan is usually `type: execute`, not `tdd`).
+    const dependents = new Map();
     const unreadable = [];
     if (phaseDir) {
         const entries = (0, gate_evidence_cjs_1.readDirEvidence)(phaseDir);
@@ -110,8 +172,13 @@ function evaluateTddReviewCheckpoint(input) {
                     const plan = (0, gate_evidence_cjs_1.readTextEvidence)(planPath);
                     if (plan.kind === 'unreadable')
                         unreadable.push({ source: planPath, reason: plan.reason });
-                    else if (plan.kind === 'found' && isTddPlan(plan.value))
-                        tddPlanFiles.push(planPath);
+                    else if (plan.kind === 'found') {
+                        if (isTddPlan(plan.value))
+                            tddPlanFiles.push(planPath);
+                        const planId = node_path_1.default.basename(planPath, '-PLAN.md');
+                        for (const dep of dependsOnOf(plan.value))
+                            dependents.set(dep, [...(dependents.get(dep) ?? []), planId]);
+                    }
                 }
             }
         }
@@ -134,17 +201,41 @@ function evaluateTddReviewCheckpoint(input) {
     const rows = [];
     for (const planPath of tddPlanFiles) {
         const planId = node_path_1.default.basename(planPath, '-PLAN.md');
-        const kinds = planCommitKinds(projectDir, planId);
-        const red = kinds.has('test');
-        const green = kinds.has('feat');
-        const refactor = kinds.has('refactor');
+        const commits = planCommits(projectDir, planId);
+        const reds = shasOfKind(commits, 'test');
+        const red = reds.length > 0;
+        const refactor = commits.some((c) => c.kind === 'refactor');
+        // #5275: with a RED present, a GREEN counts only when it descends from a RED. Without one there is
+        // nothing to order against and the plan is already missing RED, so a GREEN commit stays credited.
+        const inOrder = (greens) => greens.length > 0 && (!red || greenFollowsRed(projectDir, reds, greens) !== false);
+        const ownGreens = shasOfKind(commits, 'feat');
+        const ownOk = inOrder(ownGreens);
+        // #4867: a RED-only probe plan is satisfied by the GREEN of a plan that (transitively) declares
+        // `depends_on` it. Only a real `feat(...)` commit under such a plan counts, and it must follow the
+        // RED too (#5275); the plan's own RED is still required, and a plan nothing depends on is scored
+        // on its own commits alone.
+        const dependentGreens = ownOk
+            ? []
+            : transitiveDependents(planId, dependents).map((id) => ({ id, greens: shasOfKind(planCommits(projectDir, id), 'feat') }));
+        const greenFrom = dependentGreens.filter((d) => inOrder(d.greens)).map((d) => d.id);
+        const green = ownOk || greenFrom.length > 0;
+        const anyGreenCommit = ownGreens.length > 0 || dependentGreens.some((d) => d.greens.length > 0);
         const missing = [];
         if (!red)
             missing.push('RED');
-        if (!green)
+        if (!anyGreenCommit)
             missing.push('GREEN');
-        const status = missing.length === 0 ? 'Pass' : 'FAIL';
-        rows.push({ planId, red, green, refactor, status, missing });
+        const status = missing.length === 0 && green ? 'Pass' : 'FAIL';
+        // Both commit kinds exist but no GREEN follows a RED: its own reason. A row that fails for a
+        // missing commit keeps the exact shape it always had (`missing` already says why).
+        const reason = status === 'FAIL' && missing.length === 0
+            ? exports.TDD_ROW_REASON.GREEN_BEFORE_RED
+            : undefined;
+        rows.push({
+            planId, red, green, refactor, status, missing,
+            ...(reason ? { reason } : {}),
+            ...(greenFrom.length > 0 ? { greenFrom } : {}),
+        });
     }
     const violations = rows.filter(r => r.status === 'FAIL').length;
     // Build review table
@@ -160,10 +251,15 @@ function evaluateTddReviewCheckpoint(input) {
         tableDivider,
         ...tableRows,
     ].join('\n');
+    for (const r of rows.filter(row => row.greenFrom)) {
+        table += `\n\nPlan ${r.planId} GREEN is supplied by dependent plan ${(r.greenFrom ?? []).join(', ')}.`;
+    }
     if (violations > 0) {
         table += '\n\n⚠ Gate violations are advisory — review before advancing.';
         for (const r of rows.filter(row => row.status === 'FAIL')) {
-            table += `\n  Plan ${r.planId} missing: ${r.missing.join(', ')} gate commit(s).`;
+            table += r.reason === exports.TDD_ROW_REASON.GREEN_BEFORE_RED
+                ? `\n  Plan ${r.planId} GREEN precedes RED: no feat(...) commit descends from a test(...) commit.`
+                : `\n  Plan ${r.planId} missing: ${r.missing.join(', ')} gate commit(s).`;
             table += `\n  Expected commit pattern: test(${r.planId}): ... → feat(${r.planId}): ...`;
         }
     }