@opengsd/gsd-core 1.18.0 → 1.20.0

package/scripts/gen-pi-package-skills.cjs

@@ -0,0 +1,217 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * gen-pi-package-skills.cjs — generates pi/package-skills/gsd-<stem>/SKILL.md,
+ * the Pi skill templates the Pi package (`pi install npm:@opengsd/gsd-core`)
+ * renders at session start.
+ *
+ * Usage:
+ *   node scripts/gen-pi-package-skills.cjs            # print summary
+ *   node scripts/gen-pi-package-skills.cjs --write    # write pi/package-skills/
+ *   node scripts/gen-pi-package-skills.cjs --check    # exit 1 if committed templates are stale
+ *
+ * #5558 (Phase 1b of epic #5556). Pi skill bodies embed the absolute path of the
+ * engine tree they `@`-include, and a package's install location is unknown at
+ * build time. So the templates are produced by running the real installer
+ * (`bin/install.js --pi --global --config-dir <tmp>`), then replacing the temp
+ * config dir with PI_ENGINE_ROOT_TOKEN. Rendering a template with a root R
+ * (`renderSkillTemplate`, exported for the parity test; pi/gsd.cjs carries the
+ * same two-line substitution) is therefore byte-identical to what the installer
+ * writes for config dir R.
+ *
+ * Depends on a built lib (`npm run build:lib`); must run after it in the build chain.
+ */
+
+const fs = require('node:fs');
+const os = require('node:os');
+const crypto = require('node:crypto');
+const path = require('node:path');
+const { spawnSync } = require('node:child_process');
+const { ExitError, runMain } = require('./lib/cli-exit.cjs');
+
+const ROOT = path.resolve(__dirname, '..');
+const OUT_DIR = path.join(ROOT, 'pi', 'package-skills');
+// #5569: the converted Pi role files the package's gsd_dispatch reads (ADR-5559 amendment).
+const ROLES_DIR = path.join(ROOT, 'pi', 'package-agents');
+const ROLES_MANIFEST = 'manifest.json';
+const INSTALLER = path.join(ROOT, 'bin', 'install.js');
+const PI_ENGINE_ROOT_TOKEN = '__GSD_PI_ENGINE_ROOT__';
+const INSTALL_BOUND_MS = 30000;
+
+/** Forward-slash form of a path; the installer emits either form depending on platform. */
+function toSlash(p) {
+  return String(p).replace(/\\/g, '/');
+}
+
+/**
+ * Replace every occurrence of `root` (raw and forward-slash forms) with the token.
+ * @param {string} content
+ * @param {string} root
+ */
+function tokenizeSkill(content, root) {
+  // The installer may print either the path it was given or its symlink-resolved form (/private/var on macOS).
+  let real = root;
+  try { real = fs.realpathSync(root); } catch { /* removed already: only the given form */ }
+  const forms = [...new Set([root, toSlash(root), real, toSlash(real)])].sort((a, b) => b.length - a.length);
+  let out = content;
+  for (const form of forms) out = out.split(form).join(PI_ENGINE_ROOT_TOKEN);
+  return out;
+}
+
+/**
+ * Render a template for an engine root. The root is substituted in its
+ * forward-slash form, which is what the installer writes for the Pi skills.
+ * @param {string} template
+ * @param {string} engineRoot
+ */
+function renderSkillTemplate(template, engineRoot) {
+  return template.split(PI_ENGINE_ROOT_TOKEN).join(toSlash(engineRoot));
+}
+
+/**
+ * Run the installer for Pi into a fresh temp dir and return that dir. The run
+ * gets a separate throwaway HOME (removed straight after): the two must differ,
+ * because the installer writes a config dir that equals or sits under HOME as
+ * `~`/`$HOME`-relative paths.
+ */
+function installIntoTemp() {
+  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'gsd-pi-skills-'));
+  const home = fs.mkdtempSync(path.join(os.tmpdir(), 'gsd-pi-home-'));
+  const res = spawnSync(process.execPath, [INSTALLER, '--pi', '--global', '--config-dir', tmp], {
+    cwd: ROOT,
+    encoding: 'utf8',
+    timeout: INSTALL_BOUND_MS,
+    windowsHide: true,
+    // HOME is redirected too: the installer writes GSD's global defaults store under
+    // $HOME/.gsd, and a generator run must not touch the developer's real one.
+    // GSD_ARGS_NONCE_OFF keeps the templates canonical: they ship in the package, so a per-install
+    // nonce stamped here would be a build-time constant and would change on every generation.
+    env: { ...process.env, PI_CODING_AGENT_DIR: tmp, HOME: home, USERPROFILE: home, GSD_HOME: home, GSD_ARGS_NONCE_OFF: '1' },
+  });
+  fs.rmSync(home, { recursive: true, force: true });
+  if (res.status !== 0) {
+    fs.rmSync(tmp, { recursive: true, force: true });
+    throw new ExitError(
+      1,
+      `gen-pi-package-skills: installer failed (${res.error ? res.error.message : `exit ${res.status}`}).\n` +
+      `${(res.stderr || res.stdout || '').slice(-1500)}\nRun \`npm run build:lib\` first.`,
+    );
+  }
+  return tmp;
+}
+
+/**
+ * The role templates and their hash manifest, from an installed `agents/` dir. Roles `@`-reference
+ * files under the engine root, so like the skills they ship with PI_ENGINE_ROOT_TOKEN in place of the
+ * install path; gsd_dispatch verifies the template bytes against this manifest, then renders the root.
+ * @returns {{ roles: { name: string, content: string }[], manifest: string }}
+ */
+function collectRoles(tmp) {
+  const dir = path.join(tmp, 'agents');
+  const roles = fs.readdirSync(dir, { withFileTypes: true })
+    .filter((e) => e.isFile() && e.name.endsWith('.md'))
+    .map((e) => e.name)
+    .sort()
+    .map((name) => ({ name, content: tokenizeSkill(fs.readFileSync(path.join(dir, name), 'utf8'), tmp) }));
+  const files = {};
+  for (const { name, content } of roles) files[name] = crypto.createHash('sha256').update(content).digest('hex');
+  return { roles, manifest: `${JSON.stringify({ files }, null, 2)}\n` };
+}
+
+/** @returns {{ templates: { skillName: string, content: string }[], roles: { name: string, content: string }[], manifest: string }} */
+function generateAll() {
+  const tmp = installIntoTemp();
+  try {
+    const skillsDir = path.join(tmp, 'skills');
+    const names = fs.readdirSync(skillsDir, { withFileTypes: true })
+      .filter((e) => e.isDirectory() && e.name.startsWith('gsd-'))
+      .map((e) => e.name)
+      .sort();
+    const templates = names.map((skillName) => ({
+      skillName,
+      content: tokenizeSkill(fs.readFileSync(path.join(skillsDir, skillName, 'SKILL.md'), 'utf8'), tmp),
+    }));
+    return { templates, ...collectRoles(tmp) };
+  } finally {
+    fs.rmSync(tmp, { recursive: true, force: true });
+  }
+}
+
+/** @returns {{ skillName: string, content: string }[]} sorted by skill name */
+function generateTemplates() {
+  return generateAll().templates;
+}
+
+function main() {
+  const args = new Set(process.argv.slice(2));
+  const { templates: results, roles, manifest } = generateAll();
+
+  if (args.has('--write')) {
+    fs.rmSync(ROLES_DIR, { recursive: true, force: true });
+    fs.mkdirSync(ROLES_DIR, { recursive: true });
+    for (const { name, content } of roles) fs.writeFileSync(path.join(ROLES_DIR, name), content);
+    fs.writeFileSync(path.join(ROLES_DIR, ROLES_MANIFEST), manifest);
+    fs.rmSync(OUT_DIR, { recursive: true, force: true });
+    for (const { skillName, content } of results) {
+      fs.mkdirSync(path.join(OUT_DIR, skillName), { recursive: true });
+      fs.writeFileSync(path.join(OUT_DIR, skillName, 'SKILL.md'), content);
+    }
+    process.stdout.write(`gen-pi-package-skills: wrote ${results.length} templates to ${path.relative(ROOT, OUT_DIR)}/ and ${roles.length} roles to ${path.relative(ROOT, ROLES_DIR)}/\n`);
+    return 0;
+  }
+
+  if (args.has('--check')) {
+    if (!fs.existsSync(OUT_DIR)) {
+      throw new ExitError(1, 'gen-pi-package-skills: pi/package-skills/ missing. Run: npm run gen:pi-package-skills');
+    }
+    let stale = 0;
+    const expected = new Set(results.map((r) => r.skillName));
+    for (const { skillName, content } of results) {
+      const file = path.join(OUT_DIR, skillName, 'SKILL.md');
+      if (!fs.existsSync(file)) {
+        process.stderr.write(`gen-pi-package-skills: missing ${path.relative(ROOT, file)}\n`);
+        stale++;
+      } else if (fs.readFileSync(file, 'utf8') !== content) {
+        process.stderr.write(`gen-pi-package-skills: stale ${path.relative(ROOT, file)}\n`);
+        stale++;
+      }
+    }
+    for (const e of fs.readdirSync(OUT_DIR, { withFileTypes: true })) {
+      if (e.isDirectory() && !expected.has(e.name)) {
+        process.stderr.write(`gen-pi-package-skills: stale (no source) ${path.relative(ROOT, path.join(OUT_DIR, e.name))}\n`);
+        stale++;
+      }
+    }
+    const wantRoles = new Map([...roles.map((r) => [r.name, r.content]), [ROLES_MANIFEST, manifest]]);
+    const haveRoles = fs.existsSync(ROLES_DIR) ? fs.readdirSync(ROLES_DIR) : [];
+    for (const [name, content] of wantRoles) {
+      const file = path.join(ROLES_DIR, name);
+      if (!fs.existsSync(file) || fs.readFileSync(file, 'utf8') !== content) {
+        process.stderr.write(`gen-pi-package-skills: stale ${path.relative(ROOT, file)}\n`);
+        stale++;
+      }
+    }
+    for (const name of haveRoles) {
+      if (!wantRoles.has(name)) {
+        process.stderr.write(`gen-pi-package-skills: stale (no source) ${path.relative(ROOT, path.join(ROLES_DIR, name))}\n`);
+        stale++;
+      }
+    }
+    if (stale > 0) {
+      throw new ExitError(1, `gen-pi-package-skills: ${stale} stale template(s). Run: npm run gen:pi-package-skills`);
+    }
+    process.stdout.write(`gen-pi-package-skills: ${results.length} templates up to date\n`);
+    return 0;
+  }
+
+  process.stdout.write(
+    `gen-pi-package-skills: would write ${results.length} templates to ${path.relative(ROOT, OUT_DIR)}/\n` +
+    '  (use --write to generate, --check to verify staleness)\n',
+  );
+  return 0;
+}
+
+module.exports = { PI_ENGINE_ROOT_TOKEN, tokenizeSkill, renderSkillTemplate, toSlash, generateTemplates, generateAll };
+
+if (require.main === module) runMain(main);

package/scripts/lib/drift-scan.cjs

@@ -294,12 +294,39 @@ function sanitizeForReport(text) {
     .replace(/[\u200B-\u200F\u2028\u2029\u202A-\u202E\u2066-\u2069]/g, (c) => '\\u' + c.charCodeAt(0).toString(16).padStart(4, '0'));
 }
 
+/**
+ * Read the quoted or backtick-delimited string literal starting at `line[start]`
+ * (which must be `'`, `"`, or a backtick). Returns `{ text, end }` (`text`
+ * includes both delimiters, `end` is the index one past the literal) or null when
+ * no close quote is found within MAX_REGEX_LITERAL_LEN characters. Same single
+ * left-to-right, no-backtracking, escape-aware pass as `readRegexLiteralAt` (a
+ * `\x` escape consumes both characters, so an escaped quote never ends the
+ * literal early). A literal cannot span lines in a per-line scan. The older drift
+ * guards each carry their own byte-identical copy; new guards import this one.
+ */
+function readStringLiteralAt(line, start) {
+  const quote = line[start];
+  if (quote !== "'" && quote !== '"' && quote !== '`') return null;
+  const limit = Math.min(line.length, start + MAX_REGEX_LITERAL_LEN);
+  for (let i = start + 1; i < limit; i++) {
+    const ch = line[i];
+    if (ch === '\\') {
+      i++;
+      continue;
+    }
+    if (ch === '\r' || ch === '\n') return null;
+    if (ch === quote) return { text: line.slice(start, i + 1), end: i + 1 };
+  }
+  return null;
+}
+
 module.exports = {
   SKIP_DIR_NAMES,
   isInsideRoot,
   isUnderSkippedDir,
   walk,
   readRegexLiteralAt,
+  readStringLiteralAt,
   MAX_REGEX_LITERAL_LEN,
   sanitizeForReport,
   scanTree,

package/scripts/lib/macos-conformance-tier.generated.cjs

@@ -6,8 +6,11 @@
 
 module.exports = {
   MACOS_CONFORMANCE_TIER_FILES: [
+  "tests/5100-win32-bare-bash-sentinel.property.test.cjs",
   "tests/active-workstream-store.unit.test.cjs",
   "tests/adr-612-bracket-phase-counting.test.cjs",
+  "tests/adr-612-bracket-phase-remove.test.cjs",
+  "tests/adr-612-bracket-write-path.test.cjs",
   "tests/adr-index-gate.test.cjs",
   "tests/adr-parser.property.test.cjs",
   "tests/adr-parser.unit.test.cjs",
@@ -16,6 +19,7 @@ module.exports = {
   "tests/agent-skills.test.cjs",
   "tests/api-coverage-gate-e2e.test.cjs",
   "tests/api-coverage.test.cjs",
+  "tests/args-terminator-nonce.test.cjs",
   "tests/ask-user-questions-fallback.test.cjs",
   "tests/audit-command-cutover.test.cjs",
   "tests/broken-windows.test.cjs",
@@ -38,6 +42,7 @@ module.exports = {
   "tests/check-ui-safety-gate.test.cjs",
   "tests/check-update-config-dir.test.cjs",
   "tests/chunked-planning-parallel.test.cjs",
+  "tests/ci-conformance-pr-gating.test.cjs",
   "tests/ci-docs-guard-registry.test.cjs",
   "tests/ci-test-scope.test.cjs",
   "tests/cline-install.test.cjs",
@@ -60,6 +65,7 @@ module.exports = {
   "tests/contributor-standards.test.cjs",
   "tests/core-utils.test.cjs",
   "tests/cursor-subagent-isolation.test.cjs",
+  "tests/custom-phase-readers.test.cjs",
   "tests/debugger-semantic-recall.test.cjs",
   "tests/default-flip-documentation-lint.test.cjs",
   "tests/discuss-phase-power.test.cjs",
@@ -82,6 +88,7 @@ module.exports = {
   "tests/gap-checker.property.test.cjs",
   "tests/gate-api-coverage-verify-pre-escape.test.cjs",
   "tests/gate-codebase-drift.unit.test.cjs",
+  "tests/gate-evaluation-scope.test.cjs",
   "tests/gate-predicate.unit.test.cjs",
   "tests/gate-tdd-red-evidence-containment.test.cjs",
   "tests/gate-ui-plan.unit.test.cjs",
@@ -90,9 +97,11 @@ module.exports = {
   "tests/gen-context-index.test.cjs",
   "tests/gen-section-manifest.test.cjs",
   "tests/git-base-branch.test.cjs",
+  "tests/git-location-env-scrub.test.cjs",
   "tests/graphify-query.test.cjs",
   "tests/graphify-visualization.test.cjs",
   "tests/gsd-agent-isolation-guard.test.cjs",
+  "tests/gsd-path-export-hook.test.cjs",
   "tests/gsd-secret-read-guard.test.cjs",
   "tests/gsd-settings-advanced.test.cjs",
   "tests/gsd-statusline.test.cjs",
@@ -107,7 +116,6 @@ module.exports = {
   "tests/hooks-crash-policy.test.cjs",
   "tests/hooks-opt-in.test.cjs",
   "tests/host-integration.test.cjs",
-  "tests/in-tier-commit-hook-timing.test.cjs",
   "tests/init-manager.test.cjs",
   "tests/install-minimal-hooks.test.cjs",
   "tests/install-path-detection.test.cjs",
@@ -135,6 +143,7 @@ module.exports = {
   "tests/markdown-sectionizer.test.cjs",
   "tests/mcp-catalog.test.cjs",
   "tests/milestone-archive.test.cjs",
+  "tests/milestone-release-tags.test.cjs",
   "tests/milestone-window-single-owner.test.cjs",
   "tests/model-catalog.unit.test.cjs",
   "tests/model-resolver.test.cjs",
@@ -163,6 +172,8 @@ module.exports = {
   "tests/phase-status.test.cjs",
   "tests/phase.platform.test.cjs",
   "tests/phase.test.cjs",
+  "tests/pi-dispatch.test.cjs",
+  "tests/pi-package.test.cjs",
   "tests/plan-authoring-verification-gaps.test.cjs",
   "tests/plan-count-single-owner.test.cjs",
   "tests/plan-document.test.cjs",
@@ -195,11 +206,13 @@ module.exports = {
   "tests/retired-artifact-cleanup.test.cjs",
   "tests/review-build-prompt-optional-sections.test.cjs",
   "tests/review-lane-invocation.test.cjs",
+  "tests/review-lane-prompt-cap.test.cjs",
   "tests/review-lane-runner.test.cjs",
   "tests/review-lane-windows-spawn-resolution.test.cjs",
   "tests/review-parallel-lanes.test.cjs",
   "tests/review-plan-coverage-manifest.test.cjs",
   "tests/review-reviewer-selection.test.cjs",
+  "tests/reviewed-or-maintainer-policy.test.cjs",
   "tests/reviewer-manifest-body.test.cjs",
   "tests/reviewer-step-dispatch.test.cjs",
   "tests/roadmap-mode-field.test.cjs",
@@ -214,11 +227,14 @@ module.exports = {
   "tests/runtime-launcher-parity.test.cjs",
   "tests/runtime-name-policy.test.cjs",
   "tests/security.test.cjs",
+  "tests/self-test-report-policy.test.cjs",
   "tests/settings-jsonc.test.cjs",
   "tests/shared-hooks-dir-resolution.test.cjs",
   "tests/shell-command-projection-dispatch.test.cjs",
+  "tests/shell-command-projection-md-normalize.test.cjs",
   "tests/shipped-reference-cites.test.cjs",
   "tests/skill-manifest.test.cjs",
+  "tests/smart-entry.unit.test.cjs",
   "tests/spawn-liveness-banner.test.cjs",
   "tests/state-document.test.cjs",
   "tests/state-transition.test.cjs",

package/scripts/lib/platform-conformance-tier.generated.cjs

@@ -3,6 +3,10 @@
 
 module.exports = {
   CONFORMANCE_TIER_FILES: [
+  "tests/5100-win32-bare-bash-sentinel.property.test.cjs",
+  "tests/adr-612-bracket-new-project-config.test.cjs",
+  "tests/adr-612-bracket-phase-remove.test.cjs",
+  "tests/adr-612-bracket-write-path.test.cjs",
   "tests/adr-index-gate.test.cjs",
   "tests/adr857-core-without-capabilities.test.cjs",
   "tests/agent-install-check.test.cjs",
@@ -11,6 +15,7 @@ module.exports = {
   "tests/antigravity-upgrades.test.cjs",
   "tests/api-coverage-gate-e2e.test.cjs",
   "tests/api-coverage.test.cjs",
+  "tests/args-terminator-nonce.test.cjs",
   "tests/assumption-delta-checkpoint-e2e.test.cjs",
   "tests/assumption-delta.test.cjs",
   "tests/audit-command-cutover.test.cjs",
@@ -42,6 +47,7 @@ module.exports = {
   "tests/check-update-config-dir.test.cjs",
   "tests/check-update-fail-open.test.cjs",
   "tests/chunked-planning-parallel.test.cjs",
+  "tests/ci-conformance-pr-gating.test.cjs",
   "tests/ci-docs-guard-registry.test.cjs",
   "tests/ci-rebase-check.test.cjs",
   "tests/ci-test-scope.test.cjs",
@@ -49,7 +55,9 @@ module.exports = {
   "tests/claude-md.test.cjs",
   "tests/cline-install.test.cjs",
   "tests/close-phase-todos-padded-resolves.test.cjs",
+  "tests/code-review-cicd.test.cjs",
   "tests/code-review-fix-pipeline-regression.test.cjs",
+  "tests/code-review-necessity.test.cjs",
   "tests/code-review-pipeline-regression.test.cjs",
   "tests/code-review-tier3-files-override-scoping.test.cjs",
   "tests/code-review.test.cjs",
@@ -67,6 +75,7 @@ module.exports = {
   "tests/commit-files-pathspec.test.cjs",
   "tests/commonjs-marker.test.cjs",
   "tests/compact-content-4139.test.cjs",
+  "tests/complete-milestone-release-map-routing.test.cjs",
   "tests/completion-ratio-scope-withholding.test.cjs",
   "tests/config-defaults-runtime-exclusion.test.cjs",
   "tests/config-get-default.test.cjs",
@@ -82,6 +91,7 @@ module.exports = {
   "tests/cursor-hook-workspace-roots.test.cjs",
   "tests/cursor-hooks.test.cjs",
   "tests/cursor-subagent-isolation.test.cjs",
+  "tests/custom-phase-readers.test.cjs",
   "tests/debug-session-management.test.cjs",
   "tests/defaults-json-fallback.test.cjs",
   "tests/diagnose-windows-spawn-watcher.test.cjs",
@@ -121,6 +131,7 @@ module.exports = {
   "tests/gate-tdd-red-evidence-containment.test.cjs",
   "tests/gate-tdd-review-checkpoint-hardening.test.cjs",
   "tests/gate-tdd-review-checkpoint.unit.test.cjs",
+  "tests/gate-tdd-review-order-5275.test.cjs",
   "tests/gate-ui-plan.unit.test.cjs",
   "tests/gate-ui-safety.unit.test.cjs",
   "tests/gate-verify-command-paths.unit.test.cjs",
@@ -129,6 +140,8 @@ module.exports = {
   "tests/gen-health-docs.test.cjs",
   "tests/gen-section-manifest.test.cjs",
   "tests/git-base-branch.test.cjs",
+  "tests/git-location-env-scrub.test.cjs",
+  "tests/git-optional-locks-parity.test.cjs",
   "tests/golden-install-tree.test.cjs",
   "tests/graphify-graph-path.test.cjs",
   "tests/graphify-visualization.test.cjs",
@@ -137,6 +150,8 @@ module.exports = {
   "tests/gsd-check-update-worker-atomic-cache.test.cjs",
   "tests/gsd-check-update-worker-platform-gate.test.cjs",
   "tests/gsd-mcp-server-bin.test.cjs",
+  "tests/gsd-mcp-server.test.cjs",
+  "tests/gsd-path-export-hook.test.cjs",
   "tests/gsd-statusline.test.cjs",
   "tests/gsd-validate-commit-crash-policy.test.cjs",
   "tests/gsd-validate-commit-sigpipe.test.cjs",
@@ -162,6 +177,7 @@ module.exports = {
   "tests/install-runtime-artifacts.test.cjs",
   "tests/install-write-confinement.test.cjs",
   "tests/install.test.cjs",
+  "tests/installer-first-install-user-skill-5522.test.cjs",
   "tests/installer-migration-antigravity-retire-confighome-artifacts.test.cjs",
   "tests/installer-migration-config-root-marker.test.cjs",
   "tests/installer-migration-pi-retire-hooks-dir.test.cjs",
@@ -171,6 +187,7 @@ module.exports = {
   "tests/intel.test.cjs",
   "tests/inventory-nested-families.test.cjs",
   "tests/io.test.cjs",
+  "tests/isolation-aged-none-sentinel.test.cjs",
   "tests/isolation-sentinel.test.cjs",
   "tests/kilo-upgrades.test.cjs",
   "tests/kimi-agent-converter.test.cjs",
@@ -188,6 +205,9 @@ module.exports = {
   "tests/mcp-catalog.property.test.cjs",
   "tests/mcp-catalog.test.cjs",
   "tests/milestone-archive.test.cjs",
+  "tests/milestone-lock.test.cjs",
+  "tests/milestone-release-map-archive.test.cjs",
+  "tests/milestone-release-tags.test.cjs",
   "tests/milestone-window-single-owner.test.cjs",
   "tests/milestone.test.cjs",
   "tests/model-resolver.test.cjs",
@@ -204,10 +224,12 @@ module.exports = {
   "tests/no-unbounded-spawn.test.cjs",
   "tests/no-unguarded-nonportable-exec.rule.test.cjs",
   "tests/node-compile-cache.test.cjs",
+  "tests/npm-audit-baseline-safe-directory-5659.test.cjs",
   "tests/npm-audit-baseline.test.cjs",
   "tests/npm-integrity-gate.test.cjs",
   "tests/nsegment-phase-grammar.test.cjs",
   "tests/onboard-command.test.cjs",
+  "tests/opencode-advisory-stderr.test.cjs",
   "tests/opencode-command-dir-plural.test.cjs",
   "tests/opencode-config-jsonc.test.cjs",
   "tests/opencode-generations.smoke.test.cjs",
@@ -228,6 +250,10 @@ module.exports = {
   "tests/phase.platform.test.cjs",
   "tests/phase6-capstone-conformance.test.cjs",
   "tests/pi-config-dir-env-override.test.cjs",
+  "tests/pi-dispatch-install.test.cjs",
+  "tests/pi-dispatch.test.cjs",
+  "tests/pi-hook-bridge.test.cjs",
+  "tests/pi-package.test.cjs",
   "tests/plan-count-single-owner.test.cjs",
   "tests/plan-phase-stall-detection.test.cjs",
   "tests/plan-pre-hook-e2e.test.cjs",
@@ -250,6 +276,7 @@ module.exports = {
   "tests/process-seam.test.cjs",
   "tests/profile-output.test.cjs",
   "tests/profile-pipeline.test.cjs",
+  "tests/progress-drift-guard.test.cjs",
   "tests/prohibition-enforcement.test.cjs",
   "tests/project-root.test.cjs",
   "tests/quick-batch-command-router.stdin.test.cjs",
@@ -269,7 +296,10 @@ module.exports = {
   "tests/retired-artifact-cleanup.test.cjs",
   "tests/review-build-prompt-optional-sections.test.cjs",
   "tests/review-default-reviewers-config.test.cjs",
+  "tests/review-lane-availability.test.cjs",
   "tests/review-lane-invocation.test.cjs",
+  "tests/review-lane-no-redirect-5433.test.cjs",
+  "tests/review-lane-prompt-cap.test.cjs",
   "tests/review-lane-runner.test.cjs",
   "tests/review-lane-windows-spawn-resolution.test.cjs",
   "tests/review-model-config.test.cjs",
@@ -280,6 +310,7 @@ module.exports = {
   "tests/revision-remediation-binding.test.cjs",
   "tests/roadmap-parser.test.cjs",
   "tests/roadmap-upgrade-bracket.test.cjs",
+  "tests/roadmap-upgrade.test.cjs",
   "tests/roadmap.test.cjs",
   "tests/run-tests-accounting.test.cjs",
   "tests/run-tests-harness.test.cjs",
@@ -293,16 +324,20 @@ module.exports = {
   "tests/runtime-identity.test.cjs",
   "tests/runtime-launcher-parity.test.cjs",
   "tests/schema-drift.test.cjs",
+  "tests/section-manifest-init-facts.test.cjs",
   "tests/security.test.cjs",
+  "tests/self-test-report-policy.test.cjs",
   "tests/settings-jsonc.test.cjs",
   "tests/sh-hook-paths.test.cjs",
   "tests/shared-hooks-dir-resolution.test.cjs",
   "tests/shell-command-projection-dispatch.test.cjs",
+  "tests/shell-command-projection-md-normalize.test.cjs",
   "tests/shell-command-projection-path-sep.test.cjs",
   "tests/ship-notes-wedged-pr.test.cjs",
   "tests/shipped-reference-cites.test.cjs",
   "tests/skill-manifest.test.cjs",
   "tests/slug-derivation-drift-guard.test.cjs",
+  "tests/smart-entry.unit.test.cjs",
   "tests/state-todos-render.test.cjs",
   "tests/state.platform.test.cjs",
   "tests/subject-first-line.platform.test.cjs",
@@ -321,6 +356,7 @@ module.exports = {
   "tests/unusable-input.test.cjs",
   "tests/update-custom-backup.test.cjs",
   "tests/user-artifact-staging.test.cjs",
+  "tests/user-home-isolation-5594.test.cjs",
   "tests/verification-append-audit.test.cjs",
   "tests/verification-status.test.cjs",
   "tests/verify-archive-dirs-live-path.test.cjs",
@@ -336,7 +372,7 @@ module.exports = {
   "tests/workstream.test.cjs",
   "tests/worktree-cleanup.test.cjs",
   "tests/worktree-safety.test.cjs",
+  "tests/worktree-subdir-effective-root-4885.test.cjs",
   "tests/worktree.test.cjs",
-  "tests/xtrace-phase-timing.platform.test.cjs",
   ],
 };

package/scripts/lint-docs-guard-registration.exempt-baseline.cjs

@@ -122,10 +122,10 @@ const DOCS_GUARD_EXEMPT_DOCS_PATHS = {
   // reads that (or any) docs/ file.
   'capability-validator-task-content-resolver.test.cjs': ['docs/adr/3646-per-task-content-resolution-seam.md'],
   'ci-docs-guard-registry.test.cjs': [
-    'docs/AGENTS.md', 'docs/COMMANDS.md', 'docs/INVENTORY.md', 'docs/a.md', 'docs/adr',
+    'docs/COMMANDS.md', 'docs/INVENTORY.md', 'docs/a.md', 'docs/adr',
     'docs/adr/0001-example.md', 'docs/adrenaline.md', 'docs/bar.md', 'docs/foo.md', 'docs/how-to/foo.md',
-    'docs/how-to/some-unrelated-guide.md', 'docs/how-to/x.md', 'docs/some-unrelated-file.md',
-    'docs/totally-unrelated.md',
+    'docs/how-to/some-unrelated-guide.md', 'docs/how-to/x.md', 'docs/reference/agents.md',
+    'docs/some-unrelated-file.md', 'docs/totally-unrelated.md',
   ],
   // #4641: cites docs/adr/4641-windows-selector-consolidation.md in an
   // explanatory comment describing why the retired `windows` scope must not

package/scripts/lint-phase-enumeration-drift.cjs

@@ -191,6 +191,10 @@
  *     WHOLE ROADMAP (not milestone-scoped) for existing `2.N` ids — an id
  *     collision it must avoid can come from any milestone, so it needs the
  *     physical set, matching the CREATE-adjacent exemption category.
+ *   - `src/phase.cts` `collectPhaseDirNums` (#5528): the allocators' one on-disk scan,
+ *     run over the cwd's phases dir (cmdPhaseAdd/cmdPhaseAddBatch) and a sibling worktree's
+ *     (collectSiblingWorktreePhaseNums). It builds the set of USED phase numbers across
+ *     checkouts, not a milestone-scoped list, so listMilestonePhaseDirs cannot serve it.
  *   - `src/phase.cts` `cmdPhasePlanIndex`: resolves ONE caller-supplied
  *     `phase` id to its directory — a single-phase LOCATION lookup, not an
  *     enumeration of the current milestone's phase set.
@@ -316,10 +320,10 @@ const FUNCTION_SCOPED_EXEMPTIONS = new Map([
   [path.join('src', 'gate-phase-context.cts'), new Set(['resolvePhaseDirByToken'])],
   [path.join('src', 'init.cts'), new Set(['detectHasPriorPhases', 'detectUiPhaseActive'])],
   [path.join('src', 'milestone.cts'), new Set(['archivePhaseDirectories', 'cmdMilestoneComplete', 'cmdPhasesClear'])],
-  // #3849: collectSiblingWorktreePhaseNums reads a SIBLING worktree's phases dir —
-  // a different checkout listMilestonePhaseDirs (cwd-scoped) cannot serve; the
-  // allocators' own on-disk scans stay unexempted.
-  [path.join('src', 'phase.cts'), new Set(['cmdPhasesList', 'cmdPhaseNextDecimal', 'cmdPhasePlanIndex', 'cmdPhaseInsert', 'renameDecimalPhases', 'renameIntegerPhases', 'collectSiblingWorktreePhaseNums'])],
+  // #3849/#5528: collectPhaseDirNums is the allocators' one on-disk scan (the cwd's phases dir for
+  // cmdPhaseAdd/cmdPhaseAddBatch, a sibling worktree's for collectSiblingWorktreePhaseNums). It is a
+  // used-NUMBER roster across checkouts, not the milestone-scoped list listMilestonePhaseDirs serves.
+  [path.join('src', 'phase.cts'), new Set(['cmdPhasesList', 'cmdPhaseNextDecimal', 'cmdPhasePlanIndex', 'cmdPhaseInsert', 'renameDecimalPhases', 'renameIntegerPhases', 'collectPhaseDirNums'])],
   [path.join('src', 'audit.cts'), new Set(['listAuditPhaseTargets'])],
   [path.join('src', 'commands.cts'), new Set(['cmdHistoryDigest'])],
   [path.join('src', 'state.cts'), new Set(['cmdStateValidate', 'cmdStateSync', 'cmdStateRebuild', 'countRoadmapPhaseHeadings'])],

package/scripts/lint-retired-runtime-name.cjs

@@ -234,6 +234,11 @@ const ALLOWLIST_OCCURRENCES = new Map([
     { snippet: 'Google (Gemini)', reason: 'model-provider choice, not a GSD runtime' },
     { snippet: 'Committed to Gemini / Google Cloud / Vertex AI', reason: 'the same menu entry\'s description' },
   ]],
+  ['pi/package-agents/gsd-framework-selector.md', [
+    // Generated copy of agents/gsd-framework-selector.md for the Pi package (#5569).
+    { snippet: 'Google (Gemini)', reason: 'model-provider choice, not a GSD runtime' },
+    { snippet: 'Committed to Gemini / Google Cloud / Vertex AI', reason: 'the same menu entry\'s description' },
+  ]],
   ['agents/gsd-framework-selector.compact.md', [
     { snippet: 'Google (Gemini)', reason: 'model-provider choice, not a GSD runtime' },
   ]],