@opengsd/gsd-core 1.2.0 → 1.3.0

package/scripts/lib/allowlist-ratchet.cjs

@@ -0,0 +1,136 @@
+'use strict';
+
+/**
+ * @file allowlist-ratchet.cjs
+ *
+ * Reusable "better than a count ratchet" primitives for CI guards.
+ *
+ * ## Motivation (issue #597)
+ *
+ * A count ratchet (`assert(offenders.length <= N)`) has a masking blind spot:
+ * fixing one offender and introducing a new one keeps the count constant, so a
+ * novel defect slips through green.  These helpers enforce on IDENTITY instead,
+ * making every individual offender visible and requiring monotonic progress
+ * toward zero.
+ *
+ * ## Design
+ *
+ * Both functions are pure (no I/O, no global state).  The `fail` callback is
+ * injected by the caller so the same logic can be used with `node:assert.fail`,
+ * a custom throw, or a message-collector in unit tests.
+ */
+
+/**
+ * Assert that `current` offenders are all within the known allowlist, and that
+ * every entry in the allowlist still offends (forcing the allowlist to shrink
+ * as defects are fixed).
+ *
+ * Fails when:
+ * - Any id in `current` is NOT in `known` → novel offender introduced.
+ * - Any id in `known` is NOT in `current` → stale allowlist entry must be
+ *   pruned so the guard ratchets toward zero (the ratchet-DOWN direction).
+ *
+ * ## Masking blind spot this prevents (issue #597)
+ *
+ * A count ratchet (`assert(count <= N)`) allows one offender to be silently
+ * replaced by another while the count stays at N.  By asserting on identity
+ * instead, every new offender is caught by name, and every fixed offender
+ * forces the allowlist to shrink.
+ *
+ * @param {object} opts
+ * @param {string}   opts.label      - Human-readable name for the guard (used
+ *                                     in failure messages).
+ * @param {Iterable<string>} opts.current - The offending ids found in the
+ *                                     current run.
+ * @param {Iterable<string>} opts.known   - The allowlisted ids (baseline).
+ * @param {function(string): void} opts.fail - Callback invoked with a
+ *                                     descriptive message on any violation.
+ *                                     Pass `require('node:assert').fail`, a
+ *                                     custom thrower, or a collector.  The
+ *                                     function is NOT imported here so callers
+ *                                     control the failure mode.
+ * @param {string}  [opts.pruneHint] - Optional hint appended to the stale-
+ *                                     entry failure message (e.g. the name of
+ *                                     the allowlist file to edit).
+ * @returns {{ novel: string[], stale: string[] }} Sorted arrays of novel ids
+ *   (in current but not known) and stale ids (in known but not current).
+ */
+function assertWithinAllowlist({ label, current, known, fail, pruneHint }) {
+  const currentSet = new Set(current);
+  const knownSet = new Set(known);
+
+  const novel = [...currentSet].filter((id) => !knownSet.has(id)).sort();
+  const stale = [...knownSet].filter((id) => !currentSet.has(id)).sort();
+
+  if (novel.length > 0) {
+    const list = novel.map((id) => `  - ${id}`).join('\n');
+    fail(
+      `[${label}] ${novel.length} NEW offender(s) introduced — fix at the source; do not just add to the allowlist.\n${list}`
+    );
+  }
+
+  if (stale.length > 0) {
+    const list = stale.map((id) => `  - ${id}`).join('\n');
+    const hint = pruneHint ? `\n(${pruneHint})` : '';
+    fail(
+      `[${label}] ${stale.length} allowlisted id(s) no longer offend and MUST be pruned so the guard ratchets toward zero.${hint}\n${list}`
+    );
+  }
+
+  return { novel, stale };
+}
+
+/**
+ * Assert that an artifact's measured maximum stays within a declared ceiling,
+ * and that the ceiling itself does not creep above the high-water mark (budgets
+ * may only decrease, not increase over time).
+ *
+ * Fails when:
+ * - `actualMax > ceiling`           → regression: artifact exceeds budget.
+ * - `ceiling - actualMax > grace`   → ceiling sits too far above the measured
+ *                                     value; tighten it toward `actualMax`.
+ *
+ * ## Masking blind spot this prevents (issue #597)
+ *
+ * A plain `assert(size <= ceiling)` with a ceiling set generously high allows
+ * the artifact to grow unchecked as long as it stays under the ceiling.  The
+ * `grace` band forces the ceiling to stay close to the high-water mark,
+ * ensuring that any upward creep is immediately visible.
+ *
+ * @param {object} opts
+ * @param {string}   opts.label     - Human-readable name for the guard (used
+ *                                    in failure messages).
+ * @param {number}   opts.actualMax - The measured value (e.g. bundle size in
+ *                                    bytes, line count).
+ * @param {number}   opts.ceiling   - The declared budget ceiling.
+ * @param {number}   opts.grace     - Maximum allowed slack (`ceiling -
+ *                                    actualMax`) before the ceiling is
+ *                                    considered too loose.
+ * @param {function(string): void} opts.fail - Callback invoked with a
+ *                                    descriptive message on any violation.
+ * @returns {{ ok: boolean, slack: number }} Whether both checks passed and the
+ *   current slack value.
+ */
+function assertTightCeiling({ label, actualMax, ceiling, grace, fail }) {
+  const slack = ceiling - actualMax;
+  let ok = true;
+
+  if (actualMax > ceiling) {
+    ok = false;
+    fail(
+      `[${label}] Regression: artifact value ${actualMax} exceeds budget ceiling ${ceiling}. ` +
+        `Raise the ceiling to at most ${actualMax} only if the increase is justified.`
+    );
+  } else if (slack > grace) {
+    ok = false;
+    fail(
+      `[${label}] Ceiling ${ceiling} sits too far above the high-water mark ${actualMax} ` +
+        `(slack ${slack} > grace ${grace}). Tighten the ceiling toward ${actualMax}. ` +
+        `Budgets may only decrease.`
+    );
+  }
+
+  return { ok, slack };
+}
+
+module.exports = { assertWithinAllowlist, assertTightCeiling };

package/scripts/lint-command-contract.cjs

@@ -20,7 +20,7 @@ const path = require('path');
 
 const ROOT          = path.join(__dirname, '..');
 const COMMANDS_DIR  = path.join(ROOT, 'commands', 'gsd');
-const GSD_ROOT      = path.join(ROOT, 'get-shit-done');
+const GSD_ROOT      = path.join(ROOT, 'gsd-core');
 
 const {
   CANONICAL_TOOLS,

package/scripts/lint-legacy-dir-name.cjs

@@ -0,0 +1,156 @@
+#!/usr/bin/env node
+/**
+ * lint-legacy-dir-name.cjs
+ *
+ * Prevents accidental re-introduction of the bare legacy directory token
+ * `get-shit-done` now that the package has been renamed to `gsd-core` (#604).
+ *
+ * The forbidden token is constructed by splitting across the concat operator
+ * so this guard script cannot flag itself:
+ *   const FORBIDDEN = 'get-shit' + '-done';
+ *
+ * Regex: FORBIDDEN + '(?!-\\w)' — allows any hyphenated slug variant
+ *   (get-shit-done-OLD, get-shit-done-classic, get-shit-done-cli, etc.)
+ *   while forbidding the bare word boundary that would indicate a stale
+ *   directory reference. This is the exact pattern that would appear in a
+ *   path like `~/.claude/get-shit-done/` or `'get-shit-done'` in code.
+ *
+ * Allowlist:
+ *   - CHANGELOG.md (historical record; reviewed manually)
+ *   - .changeset/ (ephemeral release-note fragments; consumed into CHANGELOG on
+ *     release — like CHANGELOG, not swept by rename PRs)
+ *   - Translated READMEs: README.ja-JP.md, README.ko-KR.md, README.pt-BR.md, README.zh-CN.md
+ *   - Locale-specific docs dirs: docs/ja-JP/, docs/ko-KR/, docs/pt-BR/, docs/zh-CN/
+ *   - Lines containing the marker `gsd-allow-legacy-name` (intentional uses)
+ *   - Binary files (detected by NUL byte scan)
+ *   - This guard script itself (by path)
+ *
+ * Exit 0 if no violations; exit 1 if any are found (with stderr diagnostics).
+ */
+
+'use strict';
+
+const { execFileSync } = require('child_process');
+const fs = require('fs');
+const path = require('path');
+
+// Constructed with split to avoid self-match when this script is scanned.
+const FORBIDDEN = 'get-shit' + '-done';
+const FORBIDDEN_RE = new RegExp(FORBIDDEN + '(?!-\\w)', 'gi');
+
+const ALLOW_MARKER = 'gsd-allow-legacy-name';
+const SELF_PATH = path.resolve(__filename);
+// GSD_LINT_LEGACY_REPO_ROOT is used by tests to redirect the guard to a
+// temporary fixture git repo without touching the real working tree.
+const REPO_ROOT = process.env.GSD_LINT_LEGACY_REPO_ROOT
+  ? path.resolve(process.env.GSD_LINT_LEGACY_REPO_ROOT)
+  : path.resolve(__dirname, '..');
+
+const ALLOWLIST_FILES = new Set([
+  'CHANGELOG.md',
+  'README.ja-JP.md',
+  'README.ko-KR.md',
+  'README.pt-BR.md',
+  'README.zh-CN.md',
+]);
+
+const ALLOWLIST_DIR_PREFIXES = [
+  // Pending changeset fragments are ephemeral release-note stubs consumed into
+  // CHANGELOG on release — like CHANGELOG itself, they should not be swept by
+  // rename PRs and may legitimately contain the legacy token in historical prose.
+  '.changeset/',
+  'docs/ja-JP/',
+  'docs/ko-KR/',
+  'docs/pt-BR/',
+  'docs/zh-CN/',
+];
+
+function isAllowlisted(relPath) {
+  if (ALLOWLIST_FILES.has(relPath)) return true;
+  for (const prefix of ALLOWLIST_DIR_PREFIXES) {
+    if (relPath.startsWith(prefix)) return true;
+  }
+  return false;
+}
+
+function isBinary(fullPath) {
+  // Read a small chunk and check for NUL bytes.
+  let fd;
+  try {
+    fd = fs.openSync(fullPath, 'r');
+    const buf = Buffer.allocUnsafe(512);
+    const bytesRead = fs.readSync(fd, buf, 0, 512, 0);
+    return buf.subarray(0, bytesRead).includes(0);
+  } catch {
+    return false;
+  } finally {
+    if (fd != null) {
+      try { fs.closeSync(fd); } catch { /* best-effort */ }
+    }
+  }
+}
+
+// Enumerate tracked files via git ls-files so only committed/staged source is checked.
+let trackedFiles;
+try {
+  trackedFiles = execFileSync('git', ['ls-files'], { cwd: REPO_ROOT, encoding: 'utf8' })
+    .split('\n')
+    .map((f) => f.trim())
+    .filter(Boolean);
+} catch (err) {
+  process.stderr.write('ERROR lint-legacy-dir-name: git ls-files failed: ' + err.message + '\n');
+  process.exit(1);
+}
+
+const violations = [];
+
+for (const relPath of trackedFiles) {
+  if (isAllowlisted(relPath)) continue;
+
+  const fullPath = path.join(REPO_ROOT, relPath);
+
+  // Skip this guard script itself.
+  if (path.resolve(fullPath) === SELF_PATH) continue;
+
+  if (isBinary(fullPath)) continue;
+
+  let content;
+  try {
+    content = fs.readFileSync(fullPath, 'utf8');
+  } catch {
+    // Unreadable files (permissions, etc.) — skip silently.
+    continue;
+  }
+
+  const lines = content.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    // Skip lines that carry the explicit allow marker.
+    if (line.includes(ALLOW_MARKER)) continue;
+
+    FORBIDDEN_RE.lastIndex = 0;
+    let match;
+    while ((match = FORBIDDEN_RE.exec(line)) !== null) {
+      violations.push({
+        file: relPath,
+        line: i + 1,
+        col: match.index + 1,
+        text: match[0],
+      });
+    }
+  }
+}
+
+if (violations.length === 0) {
+  process.stdout.write('ok lint-legacy-dir-name: ' + trackedFiles.length + ' tracked file(s) checked, 0 violations\n');
+  process.exit(0);
+}
+
+process.stderr.write('\nERROR lint-legacy-dir-name: ' + violations.length + ' violation(s) found\n\n');
+for (const v of violations) {
+  process.stderr.write('  ' + v.file + ':' + v.line + ':' + v.col + ' — ' + JSON.stringify(v.text) + '\n');
+}
+process.stderr.write('\n');
+process.stderr.write('Fix: rename to gsd-core, or add `gsd-allow-legacy-name` marker on the line if the\n');
+process.stderr.write('      use is intentional (migration modules, tests, guard, changeset).\n\n');
+process.exit(1);

package/scripts/lint-package-identity-drift.cjs

@@ -4,7 +4,7 @@
 /**
  * Drift-guard lint for the Package Identity seam (issue #498).
  *
- * The seam (`get-shit-done/bin/lib/package-identity.cjs`, derived from
+ * The seam (`get-shit-done/bin/lib/package-identity.cjs`, derived from // gsd-allow-legacy-name
  * package.json) is the single source of GSD's published coordinates. Many
  * runtime surfaces still carry a literal copy of those coordinates because
  * they cannot `require()` the seam at runtime: the bash launcher snippet (and
@@ -19,7 +19,7 @@
  * literal is reported until updated. That is what turns a repoint into a
  * one-line change with mechanical enforcement.
  *
- * Scope: the runtime/code surface (bin/, hooks/, scripts/, get-shit-done/).
+ * Scope: the runtime/code surface (bin/, hooks/, scripts/, get-shit-done/). // gsd-allow-legacy-name
  * Pure-prose docs and localized READMEs are intentionally out of scope.
  */
 
@@ -27,11 +27,11 @@ const fs = require('node:fs');
 const path = require('node:path');
 
 // A GSD package coordinate: a scoped npm name whose package part contains
-// "get-shit-done" (so @opengsd/gsd-sdk and unrelated scopes never match).
-const PACKAGE_RE = /@[A-Za-z0-9._-]+\/[A-Za-z0-9._-]*get-shit-done[A-Za-z0-9._-]*/g;
+// "get-shit-done" (so @opengsd/gsd-sdk and unrelated scopes never match). // gsd-allow-legacy-name
+const PACKAGE_RE = /@[A-Za-z0-9._-]+\/[A-Za-z0-9._-]*get-shit-done[A-Za-z0-9._-]*/g; // gsd-allow-legacy-name
 // A GSD repo slug, only inside a GitHub URL context so it never overlaps the
 // scoped package literal above. The `.git` suffix is trimmed before compare.
-const SLUG_RE = /(?:github\.com[/:]|raw\.githubusercontent\.com\/)([A-Za-z0-9._-]+\/[A-Za-z0-9._-]*get-shit-done[A-Za-z0-9._-]*)/g;
+const SLUG_RE = /(?:github\.com[/:]|raw\.githubusercontent\.com\/)([A-Za-z0-9._-]+\/[A-Za-z0-9._-]*get-shit-done[A-Za-z0-9._-]*)/g; // gsd-allow-legacy-name
 
 function lineOf(text, index) {
   let line = 1;
@@ -62,14 +62,14 @@ function findCoordinateDrift(text, { packageName, repoSlug }) {
 }
 
 // Directories scanned, relative to repo root.
-const SCAN_DIRS = ['bin', 'hooks', 'scripts', 'get-shit-done'];
+const SCAN_DIRS = ['bin', 'hooks', 'scripts', 'gsd-core'];
 const SCAN_EXT = new Set(['.js', '.cjs', '.sh', '.md']);
 // Files exempt because they ARE the source of truth / the tooling that defines
 // the coordinate patterns. The generated seam holds the correct value by
 // construction; the generator and this lint carry regex/templates, not stray
 // literals.
 const EXEMPT = new Set([
-  path.join('get-shit-done', 'bin', 'lib', 'package-identity.cjs'),
+  path.join('gsd-core', 'bin', 'lib', 'package-identity.cjs'),
   path.join('scripts', 'generate-package-identity.cjs'),
   path.join('scripts', 'lint-package-identity-drift.cjs'),
 ]);
@@ -98,7 +98,7 @@ function walk(dir, acc) {
  * annotated with the repo-relative file path.
  */
 function scanRepo(root) {
-  const seam = require(path.join(root, 'get-shit-done', 'bin', 'lib', 'package-identity.cjs'));
+  const seam = require(path.join(root, 'gsd-core', 'bin', 'lib', 'package-identity.cjs'));
   const expected = { packageName: seam.packageName, repoSlug: seam.repoSlug };
   const violations = [];
   for (const dir of SCAN_DIRS) {

package/scripts/lint-pr-check-project-dir.cjs

@@ -10,7 +10,6 @@ const DEFAULT_RELATIVE_FILES = [
   '.github/workflows/test.yml',
   '.github/workflows/pr-template-format.yml',
   '.github/workflows/changeset-required.yml',
-  'scripts/lint-no-source-grep.cjs',
   'scripts/lint-command-contract.cjs',
   'scripts/lint-skill-deps.cjs',
   'scripts/lint-descriptions.cjs',

package/scripts/lint-shell-command-projection-drift.cjs

@@ -52,6 +52,6 @@ process.stderr.write(`ERROR shell-projection-drift: inline serialized shim build
 for (const match of matches) {
   process.stderr.write(`  - ${match.label}\n`);
 }
-process.stderr.write('Route shim/wrapper rendering through get-shit-done/bin/lib/shell-command-projection.cjs\n');
+process.stderr.write('Route shim/wrapper rendering through gsd-core/bin/lib/shell-command-projection.cjs\n');
 process.stderr.write('Safe subprocess execution via spawnSync/execFileSync is intentionally allowed.\n');
 process.exit(1);

package/scripts/lint-skill-deps.cjs

@@ -26,7 +26,7 @@
 const fs = require('fs');
 const path = require('path');
 
-const PROFILES_MODULE = path.join(__dirname, '..', 'get-shit-done', 'bin', 'lib', 'install-profiles.cjs');
+const PROFILES_MODULE = path.join(__dirname, '..', 'gsd-core', 'bin', 'lib', 'install-profiles.cjs');
 const { PROFILES, loadSkillsManifest, resolveProfile } = require(PROFILES_MODULE);
 
 // ---------------------------------------------------------------------------

package/scripts/lint-test-file-count.allowlist.json

@@ -1,36 +1,133 @@
 {
-  "_doc": "Baseline of modules currently exceeding the 2-test-file limit. Each entry locks in TODAY's count as the ceiling. Reductions are ratcheted automatically — when a cluster drops to ≤ 2, remove its entry. New entries require justification in PR description.",
+  "_doc": "Baseline of modules currently exceeding the 2-test-file limit. Each entry locks in TODAY's exact test filenames as the allowlisted set (identity ratchet). Adding a NEW test file to a capped module fails (novel). Removing one requires pruning this list (stale, ratchet-down). When a cluster drops to ≤ 2, remove its entry entirely. New entries require justification in PR description.",
   "modules": {
-    "phase":                  { "current": 5, "issue": "3788" },
-    "worktree":               { "current": 13, "issue": "TBD" },
-    "milestone":              { "current": 10, "issue": "TBD" },
-    "roadmap":                { "current": 9,  "issue": "TBD" },
-    "verify":                 { "current": 10, "issue": "3767" },
-    "install":                { "current": 9,  "issue": "TBD" },
-    "init":                   { "current": 8,  "issue": "TBD" },
-    "state":                  { "current": 11, "issue": "180" },
-    "config":                 { "current": 8,  "issue": "TBD" },
-    "graphify":               { "current": 7,  "issue": "TBD" },
-    "progress":               { "current": 6,  "issue": "14"  },
-    "cli":                    { "current": 5,  "issue": "TBD" },
-    "surface":                { "current": 5,  "issue": "TBD" },
-    "commit":                 { "current": 4,  "issue": "TBD" },
-    "frontmatter":            { "current": 4,  "issue": "TBD" },
-    "index":                  { "current": 5,  "issue": "180" },
-    "intel":                  { "current": 4,  "issue": "TBD" },
-    "mvp":                    { "current": 4,  "issue": "TBD" },
-    "install-profiles":       { "current": 4,  "issue": "TBD" },
-    "audit":                  { "current": 4,  "issue": "192" },
-    "audit-open":             { "current": 3,  "issue": "TBD" },
-    "config-schema":          { "current": 3,  "issue": "TBD" },
-    "profile":                { "current": 3,  "issue": "TBD" },
-    "prompt-budget":          { "current": 3,  "issue": "TBD" },
-    "uat":                    { "current": 3,  "issue": "TBD" },
-    "validate":               { "current": 3,  "issue": "TBD" },
-    "workstream":             { "current": 3,  "issue": "TBD" },
-    "gsd-tools":              { "current": 3,  "issue": "TBD" },
-    "runtime-artifact-layout":{ "current": 3,  "issue": "TBD" },
-    "security":               { "current": 3,  "issue": "TBD" },
-    "gsd-sdk":                { "current": 3,  "issue": "TBD" }
+    "audit": {
+      "files": [
+        "audit-fix-command.test.cjs",
+        "bug-2659-audit-open-crash.test.cjs",
+        "bug-2836-audit-open-summary-uat-drift.test.cjs",
+        "bug-2911-audit-open-output-shape.test.cjs"
+      ],
+      "issue": "192"
+    },
+    "config": {
+      "files": [
+        "bug-2943-config-get-context-window-default.test.cjs",
+        "bug-321-config-defaults-clone-strategy.test.cjs",
+        "bug-3227-config-set-model-overrides.test.cjs",
+        "bug-442-config-dir-equals-in-path.test.cjs",
+        "config-field-docs.test.cjs",
+        "config-get-default.test.cjs",
+        "config-schema.property.test.cjs",
+        "config.test.cjs"
+      ],
+      "issue": "TBD"
+    },
+    "graphify": {
+      "files": [
+        "bug-622-graphify-optional-graph-html.test.cjs",
+        "graphify-auto-update.test.cjs",
+        "graphify-query.test.cjs",
+        "graphify-visualization.test.cjs",
+        "graphify.test.cjs"
+      ],
+      "issue": "622"
+    },
+    "intel": {
+      "files": [
+        "bug-2351-intel-kilo-layout.test.cjs",
+        "bug-3290-intel-updater-layout-block.test.cjs",
+        "intel.test.cjs"
+      ],
+      "issue": "TBD"
+    },
+    "milestone": {
+      "files": [
+        "milestone-archive.test.cjs",
+        "milestone-helper.test.cjs",
+        "milestone-prefixed-convention.test.cjs",
+        "milestone-summary.test.cjs",
+        "milestone.test.cjs"
+      ],
+      "issue": "TBD"
+    },
+    "phase": {
+      "files": [
+        "bug-214-phase-researcher-write-truncation-contract.test.cjs",
+        "phase-dependency-levels.test.cjs",
+        "phase.test.cjs"
+      ],
+      "issue": "597"
+    },
+    "roadmap": {
+      "files": [
+        "bug-2661-roadmap-sync-parallel.test.cjs",
+        "bug-3128-roadmap-plan-count-slug-layout.test.cjs",
+        "bug-3599-roadmap-get-phase-project-code-prefix.test.cjs",
+        "enh-2447-roadmap-wave-deps.test.cjs",
+        "roadmap-mode-field.test.cjs",
+        "roadmap-phase-fallback.test.cjs",
+        "roadmap.test.cjs"
+      ],
+      "issue": "TBD"
+    },
+    "runtime-artifact-layout": {
+      "files": [
+        "runtime-artifact-layout-install-profiles.test.cjs",
+        "runtime-artifact-layout-surface.test.cjs",
+        "runtime-artifact-layout.test.cjs"
+      ],
+      "issue": "TBD"
+    },
+    "security": {
+      "files": [
+        "security-prompt-injection.test.cjs",
+        "security-scan.test.cjs",
+        "security.test.cjs"
+      ],
+      "issue": "TBD"
+    },
+    "state": {
+      "files": [
+        "bug-21-state-md-template-frontmatter.test.cjs",
+        "bug-2630-state-frontmatter-milestone-switch.test.cjs",
+        "bug-3127-state-begin-phase-idempotent.test.cjs",
+        "bug-3242-state-update-progress-trample.test.cjs",
+        "bug-3286-state-write-routing.test.cjs",
+        "bug-3454-state-dollar-backreference-growth.test.cjs",
+        "bug-397-state-preserve-executor-authored.test.cjs",
+        "state-acquirestatelock-non-eexist.test.cjs",
+        "state-prune.test.cjs",
+        "state.test.cjs"
+      ],
+      "issue": "180"
+    },
+    "verify": {
+      "files": [
+        "bug-2969-verify-reapply-patches.test.cjs",
+        "bug-2994-verify-reapply-patches-installed-path.test.cjs",
+        "bug-3381-verify-work-workstream.test.cjs",
+        "bug-3657-verify-reapply-patches-pristine-drift.test.cjs",
+        "verify-health.test.cjs",
+        "verify-mvp-uat.test.cjs",
+        "verify-npm-publish.test.cjs",
+        "verify-test-quality.test.cjs",
+        "verify-work-auto-transition.test.cjs",
+        "verify.test.cjs"
+      ],
+      "issue": "3767"
+    },
+    "install": {
+      "files": [
+        "bug-410-install-defaults-test-mode-guard.test.cjs",
+        "install-minimal-hooks.test.cjs",
+        "install-path-detection.test.cjs",
+        "install-regressions.test.cjs",
+        "install-runtime-artifacts.test.cjs",
+        "install-update-marker.test.cjs",
+        "install.test.cjs"
+      ],
+      "issue": "TBD"
+    }
   }
 }