@opengsd/gsd-core 1.20.0 → 1.20.1

package/gsd-core/bin/lib/state-transition.cjs

@@ -42,7 +42,7 @@ const roadmap_progress_cjs_1 = require("./roadmap-progress.cjs");
 const pattern_cjs_1 = require("./pattern.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- phase-id.cjs is an export= CommonJS module
 const phaseIdMod = require("./phase-id.cjs");
-const { comparePhaseNum } = phaseIdMod;
+const { comparePhaseNum, parsePhaseFromProse } = phaseIdMod;
 // #4129: the completion-ratio kernel for the resync-arm ratchet's percent
 // (planning-scope's SCOPE — state-document's own dependency, no cycle here:
 // state-document never imports this module).
@@ -1724,8 +1724,10 @@ function nextPhaseWording(disk) {
  * position; the caller combines this with "the phase is already complete in
  * ROADMAP.md" so a first-time out-of-order completion (#2028) still
  * transitions. An unparseable or absent current phase is "not past".
+ * #5676: under `milestone-prefixed` the id is the whole `M-NN` (`3-02`, not `3`); that read goes
+ * through `parsePhaseFromProse` (the #5626 grammar owner), so the two cannot drift.
  */
-function isStatePastPhase(content, phaseNum, sourcePath) {
+function isStatePastPhase(content, phaseNum, sourcePath, convention) {
     const fm = extractFrontmatter(content, sourcePath);
     const fromFm = fm['current_phase'];
     let raw = typeof fromFm === 'string' || typeof fromFm === 'number' ? String(fromFm) : null;
@@ -1734,10 +1736,15 @@ function isStatePastPhase(content, phaseNum, sourcePath) {
         raw = (0, state_document_cjs_1.stateExtractField)(body, 'Current Phase') || (0, state_document_cjs_1.stateExtractField)(body, 'Phase') || null;
     }
     // `Phase 4` / `phase 4 of 9` name phase 4 as surely as `4 of 9` does.
-    const m = raw === null ? null : /^\s*(?:phase\s+)?(\d+(?:\.\d+)*)/i.exec(raw);
-    if (!m)
+    let id = null;
+    if (raw !== null) {
+        id = convention === 'milestone-prefixed'
+            ? parsePhaseFromProse(raw, 'milestone-prefixed').phase
+            : (/^\s*(?:phase\s+)?(\d+(?:\.\d+)*)/i.exec(raw)?.[1] ?? null);
+    }
+    if (id === null)
         return false;
-    return comparePhaseNum(m[1], String(phaseNum)) > 0;
+    return comparePhaseNum(id, String(phaseNum)) > 0;
 }
 /**
  * Apply a `completePhase` transition to STATE.md content.

package/gsd-core/bin/lib/state.cjs

@@ -29,7 +29,7 @@ const configLoaderMod = require("./config-loader.cjs");
 const { loadConfig } = configLoaderMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const phaseIdMod = require("./phase-id.cjs");
-const { parsePhaseFromProse, PHASE_NUMBER_TOKEN_SOURCE, phaseKeyFromToken, phaseKeyFromDir, phaseHeadingPrefixSrcFor, PHASE_HEADING_BASELINE, isSentinelPhaseId, scopeToPhase, 
+const { parsePhaseFromProse, phaseNumberTokenSource, phaseKeyFromToken, phaseKeyFromDir, phaseHeadingPrefixSrcFor, PHASE_HEADING_BASELINE, isSentinelPhaseId, scopeToPhase, 
 // #2761 M3: owns the bracket milestone intro and canonical pad2 spelling.
 bracketMilestoneIntroSrcFor, } = phaseIdMod;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
@@ -6386,7 +6386,7 @@ function cmdStateSync(cwd, options, raw) {
         if (completion.value.complete)
             diskCompletedPhases++;
         // Track the highest phase with incomplete plans (or any plans)
-        const phaseMatch = dir.match(new RegExp(`^(${PHASE_NUMBER_TOKEN_SOURCE})`, 'i'));
+        const phaseMatch = dir.match(new RegExp(`^(${phaseNumberTokenSource(syncConvention)})`, 'i'));
         if (phaseMatch && plans > 0) {
             if (summaries < plans) {
                 // Incomplete phase — this is likely the current one

package/gsd-core/bin/lib/workstream-inventory.cjs

@@ -25,7 +25,7 @@ const { readSubdirectories } = coreUtilsMod;
 const planScan = require("./plan-scan.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planningWorkspace = require("./planning-workspace.cjs");
-const { planningPaths, planningRoot, getActiveWorkstream } = planningWorkspace;
+const { planningPaths, planningRoot, getActiveWorkstream, resolvePhaseIdConvention } = planningWorkspace;
 const state_document_cjs_1 = require("./state-document.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports -- frontmatter.cjs is an export= CommonJS module
 const frontmatterMod = require("./frontmatter.cjs");
@@ -101,7 +101,7 @@ function countRoadmapPhases(roadmapPath, fallbackCount, cwd, ws, versionOverride
  * `phaseKeyFromDir` uses for directories, so a `| 01. … |` row and a `1-slug`
  * directory cannot land in different key spaces (the padding-asymmetry defect).
  */
-function parseRoadmapProgressRows(content, directoryContext) {
+function parseRoadmapProgressRows(content, directoryContext, convention) {
     // Milestone-ATTRIBUTING shape first. Both shapes carry `Plans Complete`, so
     // probing that column first would pick a flat table appearing earlier in the
     // document over a milestone-grouped one later — every row would come back
@@ -116,7 +116,7 @@ function parseRoadmapProgressRows(content, directoryContext) {
     });
     const rows = [];
     for (const row of tableRows) {
-        const key = phaseKeyFromProse(row['Phase'], directoryContext);
+        const key = phaseKeyFromProse(row['Phase'], directoryContext, convention);
         if (key === null)
             continue;
         const cell = (row['Milestone'] ?? '').trim();
@@ -439,7 +439,7 @@ function inspectWorkstream(cwd, name, options = {}) {
     // `phaseKeyFromProse`, both from the phase-id owner module) so the two sides
     // of the rollup cannot disagree.
     const currentVersion = readCurrentMilestoneVersion(p.state, p.roadmap);
-    const progressRows = parseRoadmapProgressRows(roadmap, directoryContext);
+    const progressRows = parseRoadmapProgressRows(roadmap, directoryContext, resolvePhaseIdConvention(cwd, name));
     // Phase keys the ROADMAP attributes to the current milestone. A row whose
     // Milestone cell is blank or malformed is INCLUDED rather than dropped: a
     // phase we cannot attribute must still be visible to the rollup. Dropping it

package/gsd-core/bin/lib/worktree-base-ref.cjs

@@ -24,8 +24,10 @@ exports.cmdWorktreeSetBaseRef = cmdWorktreeSetBaseRef;
 exports.classifyGitHead = classifyGitHead;
 exports.observeHarnessForkFromHead = observeHarnessForkFromHead;
 exports.evaluateWorktreeBaseDegrade = evaluateWorktreeBaseDegrade;
+const node_crypto_1 = __importDefault(require("node:crypto"));
 const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
+const gsd_tool_dir_cjs_1 = require("./gsd-tool-dir.cjs");
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
 const runtime_homes_cjs_1 = require("./runtime-homes.cjs");
 // ─── Internal helpers ─────────────────────────────────────────────────────────
@@ -572,13 +574,41 @@ function observeHarnessForkFromHead(deps) {
         }
     });
     const stateWrite = deps.stateWrite ?? ((file, content) => {
+        let tmpPath = null;
         try {
-            node_fs_1.default.mkdirSync(node_path_1.default.dirname(file), { recursive: true });
-            node_fs_1.default.writeFileSync(file, content, 'utf8');
+            // #5757: the shared owner refuses a symlinked/escaping .gsd and keeps the
+            // directory git-ignored; the write is an exclusive random tmp + rename so
+            // a planted cache-file symlink is replaced, never followed.
+            const dir = (0, gsd_tool_dir_cjs_1.ensureToolOwnedGsdDir)(cwd, {
+                marker: '# gsd-core harness fork probe',
+                rules: ['/harness-fork-probe.json', '/harness-fork-probe.json.tmp-*', '/.gitignore'],
+            });
+            const target = node_path_1.default.join(dir, node_path_1.default.basename(file));
+            // `tmpPath` is assigned only once the exclusive create succeeded, so an
+            // EEXIST never unlinks an entry this process did not create.
+            const candidateTmp = `${target}.tmp-${process.pid}-${node_crypto_1.default.randomBytes(6).toString('hex')}`;
+            const tmpFd = node_fs_1.default.openSync(candidateTmp, 'wx');
+            tmpPath = candidateTmp;
+            try {
+                node_fs_1.default.writeFileSync(tmpFd, content, 'utf8');
+            }
+            finally {
+                node_fs_1.default.closeSync(tmpFd);
+            }
+            (0, shell_command_projection_cjs_1.retryRenameSync)(tmpPath, target);
+            tmpPath = null;
         }
         catch {
             // A cache write must never break the check that produced the verdict.
         }
+        finally {
+            if (tmpPath) {
+                try {
+                    node_fs_1.default.unlinkSync(tmpPath);
+                }
+                catch { /* best-effort cleanup */ }
+            }
+        }
     });
     // 1. Cache — trusted only while the orchestrator HEAD is unchanged.
     try {

package/hooks/dist/gsd-agent-isolation-guard.js

@@ -422,7 +422,7 @@ function resolveIsolationState(cwd, { clock = Date, dispatchIds = null } = {}) {
     return { gsdProject: false, isolation: null, harnessFlag: null, error: null, sentinelDiscarded: null };
   }
 
-  const sentinel = readSentinel(cwd, { clock });
+  const sentinel = readSentinel(cwd, { clock, dispatchIds });
   // Hoisted so the "sentinel was present/fresh but did not apply" case below
   // (#4594 row 15 — Postel's-Law finding) can distinguish itself from
   // "absent"/"stale" without re-deriving applicability.

package/hooks/dist/gsd-cursor-subagent-start.js

@@ -512,7 +512,7 @@ function evaluateRootIsolation(root, subagentType, { clock = Date, dispatchIds =
   // Hoisted (readSentinel never throws) so the "present, fresh, but did not
   // apply" case (#4594 row 15) can be reported on every deny path below
   // instead of silently discarded.
-  const sentinel = readSentinel(root, { clock });
+  const sentinel = readSentinel(root, { clock, dispatchIds });
   const applies = sentinelAppliesToDispatch(sentinel, dispatchIds);
   const sentinelDiscarded = buildSentinelDiscard(sentinel, dispatchIds);
 

package/hooks/dist/lib/isolation-sentinel.js

@@ -29,6 +29,12 @@
 // of the same repo are separate directories on disk, so each gets its own
 // sentinel with no cross-worktree collision, no lock file needed.
 //
+// #5682: the single slot above is last-writer-wins, so two orchestrators sharing one checkout
+// overwrote each other's decision and the guard discarded the foreign record. The writer now ALSO
+// records each plan-scoped decision at `<cwd>/.gsd/dispatch-isolation/<phase>--<plan>.json`
+// (same payload, same cwd-derived location and forgery posture), and `readSentinel` consults the
+// record keyed by the dispatch's own phase/plan first, falling back to the single slot.
+//
 // #3045 SECURITY F3 (LOW, accepted risk — documented, not redesigned for):
 // the sentinel lives at a fixed, predictable, gitignored path inside the
 // PRIMARY checkout. An agent already running inside a legitimately isolated
@@ -64,6 +70,31 @@ const VALID_ISOLATION = new Set(['harness-worktree', 'orchestrator-worktree', 'n
 
 const SENTINEL_RELATIVE_PATH = path.join('.gsd', 'dispatch-isolation-sentinel.json');
 
+// #5682: per-dispatch records, one file per `<phase>--<plan>` under this directory.
+const KEYED_SENTINEL_DIR = path.join('.gsd', 'dispatch-isolation');
+const SAFE_SENTINEL_KEY_RE = /^[A-Za-z0-9._-]{1,100}$/;
+
+/** #5682: strict allow-list for a phase/plan string that becomes a path segment. */
+function isSafeSentinelKey(s) {
+  return typeof s === 'string' && SAFE_SENTINEL_KEY_RE.test(s) && s !== '.' && s !== '..';
+}
+
+/** #5682: keyed record path for a dispatch, or null unless BOTH phase and plan are safe keys. */
+function keyedSentinelPath(root, phase, plan) {
+  if (!isSafeSentinelKey(phase) || !isSafeSentinelKey(plan)) return null;
+  return path.join(root, KEYED_SENTINEL_DIR, `${phase}--${plan}.json`);
+}
+
+/**
+ * #5682: phase-level keyed record path (`<phase>.json`, written when a decision carries no plan),
+ * or null unless the phase is a safe key. Two orchestrators recording plan-less decisions for
+ * different phases each keep their own file.
+ */
+function phaseSentinelPath(root, phase) {
+  if (!isSafeSentinelKey(phase)) return null;
+  return path.join(root, KEYED_SENTINEL_DIR, `${phase}.json`);
+}
+
 // #3045 SECURITY F2 fix: how long a written sentinel is trusted as "this
 // dispatch's decision" before a reader falls back to the conservative
 // registry+config check.
@@ -174,11 +205,51 @@ function resolveSentinelRoot(cwd) {
  * per the repo's clock-seam convention, so staleness is testable without
  * asserting on wall-clock time.
  */
-function readSentinel(cwd, { clock = Date } = {}) {
+function readSentinel(cwd, { clock = Date, dispatchIds = null } = {}) {
   const root = resolveSentinelRoot(cwd);
+
+  // #5682: candidates are the record keyed by this dispatch's own phase/plan, the phase-level
+  // record for its phase, and the single legacy slot. A keyed candidate counts only when it is
+  // well-formed and its contents agree with its own filename key; the legacy slot only when it
+  // applies to this dispatch. Among FRESH candidates the latest `writtenAt` wins, so a newer
+  // phase-level decision is not shadowed by an older plan-scoped one (and vice versa).
+  const keyedCandidates = [];
+  if (dispatchIds) {
+    const planFile = keyedSentinelPath(root, dispatchIds.phase, dispatchIds.plan);
+    if (planFile) {
+      const c = parseSentinelFile(planFile, clock);
+      if (c.present && !c.malformed && c.phase === dispatchIds.phase && c.plan === dispatchIds.plan) keyedCandidates.push(c);
+    }
+    const phaseFile = phaseSentinelPath(root, dispatchIds.phase);
+    if (phaseFile) {
+      const c = parseSentinelFile(phaseFile, clock);
+      if (c.present && !c.malformed && c.phase === dispatchIds.phase && c.plan === null) keyedCandidates.push(c);
+    }
+  }
+
+  const legacy = parseSentinelFile(sentinelPath(root), clock);
+  const legacyApplies = legacy.present && !legacy.malformed && sentinelAppliesToDispatch(legacy, dispatchIds);
+
+  const fresh = keyedCandidates.filter((c) => !c.stale);
+  if (legacyApplies && !legacy.stale) fresh.push(legacy);
+  if (fresh.length > 0) return latestWritten(fresh);
+
+  // Nothing fresh: a stale keyed record still feeds the aged-none path; otherwise the legacy
+  // slot is returned exactly as before.
+  if (keyedCandidates.length > 0) return latestWritten(keyedCandidates);
+  return legacy;
+}
+
+/** The candidate with the greatest `writtenAt` (ties keep the earlier-listed, i.e. most specific). */
+function latestWritten(candidates) {
+  return candidates.reduce((best, c) => (c.writtenAt > best.writtenAt ? c : best));
+}
+
+/** Parse and validate one sentinel file. Never throws. Shape: see `readSentinel`. */
+function parseSentinelFile(file, clock) {
   let raw;
   try {
-    raw = fs.readFileSync(sentinelPath(root), 'utf-8');
+    raw = fs.readFileSync(file, 'utf-8');
   } catch {
     return { present: false };
   }
@@ -348,6 +419,10 @@ function buildSentinelDiscard(sentinel, dispatchIds) {
 module.exports = {
   VALID_ISOLATION,
   SENTINEL_RELATIVE_PATH,
+  KEYED_SENTINEL_DIR,
+  isSafeSentinelKey,
+  keyedSentinelPath,
+  phaseSentinelPath,
   SENTINEL_STALE_MS,
   AGED_NONE_MAX_MS,
   sentinelPath,

package/hooks/gsd-agent-isolation-guard.js

@@ -422,7 +422,7 @@ function resolveIsolationState(cwd, { clock = Date, dispatchIds = null } = {}) {
     return { gsdProject: false, isolation: null, harnessFlag: null, error: null, sentinelDiscarded: null };
   }
 
-  const sentinel = readSentinel(cwd, { clock });
+  const sentinel = readSentinel(cwd, { clock, dispatchIds });
   // Hoisted so the "sentinel was present/fresh but did not apply" case below
   // (#4594 row 15 — Postel's-Law finding) can distinguish itself from
   // "absent"/"stale" without re-deriving applicability.

package/hooks/gsd-cursor-subagent-start.js

@@ -512,7 +512,7 @@ function evaluateRootIsolation(root, subagentType, { clock = Date, dispatchIds =
   // Hoisted (readSentinel never throws) so the "present, fresh, but did not
   // apply" case (#4594 row 15) can be reported on every deny path below
   // instead of silently discarded.
-  const sentinel = readSentinel(root, { clock });
+  const sentinel = readSentinel(root, { clock, dispatchIds });
   const applies = sentinelAppliesToDispatch(sentinel, dispatchIds);
   const sentinelDiscarded = buildSentinelDiscard(sentinel, dispatchIds);
 

package/hooks/lib/isolation-sentinel.js

@@ -29,6 +29,12 @@
 // of the same repo are separate directories on disk, so each gets its own
 // sentinel with no cross-worktree collision, no lock file needed.
 //
+// #5682: the single slot above is last-writer-wins, so two orchestrators sharing one checkout
+// overwrote each other's decision and the guard discarded the foreign record. The writer now ALSO
+// records each plan-scoped decision at `<cwd>/.gsd/dispatch-isolation/<phase>--<plan>.json`
+// (same payload, same cwd-derived location and forgery posture), and `readSentinel` consults the
+// record keyed by the dispatch's own phase/plan first, falling back to the single slot.
+//
 // #3045 SECURITY F3 (LOW, accepted risk — documented, not redesigned for):
 // the sentinel lives at a fixed, predictable, gitignored path inside the
 // PRIMARY checkout. An agent already running inside a legitimately isolated
@@ -64,6 +70,31 @@ const VALID_ISOLATION = new Set(['harness-worktree', 'orchestrator-worktree', 'n
 
 const SENTINEL_RELATIVE_PATH = path.join('.gsd', 'dispatch-isolation-sentinel.json');
 
+// #5682: per-dispatch records, one file per `<phase>--<plan>` under this directory.
+const KEYED_SENTINEL_DIR = path.join('.gsd', 'dispatch-isolation');
+const SAFE_SENTINEL_KEY_RE = /^[A-Za-z0-9._-]{1,100}$/;
+
+/** #5682: strict allow-list for a phase/plan string that becomes a path segment. */
+function isSafeSentinelKey(s) {
+  return typeof s === 'string' && SAFE_SENTINEL_KEY_RE.test(s) && s !== '.' && s !== '..';
+}
+
+/** #5682: keyed record path for a dispatch, or null unless BOTH phase and plan are safe keys. */
+function keyedSentinelPath(root, phase, plan) {
+  if (!isSafeSentinelKey(phase) || !isSafeSentinelKey(plan)) return null;
+  return path.join(root, KEYED_SENTINEL_DIR, `${phase}--${plan}.json`);
+}
+
+/**
+ * #5682: phase-level keyed record path (`<phase>.json`, written when a decision carries no plan),
+ * or null unless the phase is a safe key. Two orchestrators recording plan-less decisions for
+ * different phases each keep their own file.
+ */
+function phaseSentinelPath(root, phase) {
+  if (!isSafeSentinelKey(phase)) return null;
+  return path.join(root, KEYED_SENTINEL_DIR, `${phase}.json`);
+}
+
 // #3045 SECURITY F2 fix: how long a written sentinel is trusted as "this
 // dispatch's decision" before a reader falls back to the conservative
 // registry+config check.
@@ -174,11 +205,51 @@ function resolveSentinelRoot(cwd) {
  * per the repo's clock-seam convention, so staleness is testable without
  * asserting on wall-clock time.
  */
-function readSentinel(cwd, { clock = Date } = {}) {
+function readSentinel(cwd, { clock = Date, dispatchIds = null } = {}) {
   const root = resolveSentinelRoot(cwd);
+
+  // #5682: candidates are the record keyed by this dispatch's own phase/plan, the phase-level
+  // record for its phase, and the single legacy slot. A keyed candidate counts only when it is
+  // well-formed and its contents agree with its own filename key; the legacy slot only when it
+  // applies to this dispatch. Among FRESH candidates the latest `writtenAt` wins, so a newer
+  // phase-level decision is not shadowed by an older plan-scoped one (and vice versa).
+  const keyedCandidates = [];
+  if (dispatchIds) {
+    const planFile = keyedSentinelPath(root, dispatchIds.phase, dispatchIds.plan);
+    if (planFile) {
+      const c = parseSentinelFile(planFile, clock);
+      if (c.present && !c.malformed && c.phase === dispatchIds.phase && c.plan === dispatchIds.plan) keyedCandidates.push(c);
+    }
+    const phaseFile = phaseSentinelPath(root, dispatchIds.phase);
+    if (phaseFile) {
+      const c = parseSentinelFile(phaseFile, clock);
+      if (c.present && !c.malformed && c.phase === dispatchIds.phase && c.plan === null) keyedCandidates.push(c);
+    }
+  }
+
+  const legacy = parseSentinelFile(sentinelPath(root), clock);
+  const legacyApplies = legacy.present && !legacy.malformed && sentinelAppliesToDispatch(legacy, dispatchIds);
+
+  const fresh = keyedCandidates.filter((c) => !c.stale);
+  if (legacyApplies && !legacy.stale) fresh.push(legacy);
+  if (fresh.length > 0) return latestWritten(fresh);
+
+  // Nothing fresh: a stale keyed record still feeds the aged-none path; otherwise the legacy
+  // slot is returned exactly as before.
+  if (keyedCandidates.length > 0) return latestWritten(keyedCandidates);
+  return legacy;
+}
+
+/** The candidate with the greatest `writtenAt` (ties keep the earlier-listed, i.e. most specific). */
+function latestWritten(candidates) {
+  return candidates.reduce((best, c) => (c.writtenAt > best.writtenAt ? c : best));
+}
+
+/** Parse and validate one sentinel file. Never throws. Shape: see `readSentinel`. */
+function parseSentinelFile(file, clock) {
   let raw;
   try {
-    raw = fs.readFileSync(sentinelPath(root), 'utf-8');
+    raw = fs.readFileSync(file, 'utf-8');
   } catch {
     return { present: false };
   }
@@ -348,6 +419,10 @@ function buildSentinelDiscard(sentinel, dispatchIds) {
 module.exports = {
   VALID_ISOLATION,
   SENTINEL_RELATIVE_PATH,
+  KEYED_SENTINEL_DIR,
+  isSafeSentinelKey,
+  keyedSentinelPath,
+  phaseSentinelPath,
   SENTINEL_STALE_MS,
   AGED_NONE_MAX_MS,
   sentinelPath,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengsd/gsd-core",
-  "version": "1.20.0",
+  "version": "1.20.1",
   "description": "GSD Core is a meta-prompting, context engineering, and spec-driven development system for AI coding agents.",
   "main": ".opencode/plugins/gsd-core.js",
   "bin": {

package/pi/package-skills/gsd-new-milestone/SKILL.md

@@ -26,7 +26,7 @@ Brownfield equivalent of new-project. Project exists, PROJECT.md has history. Ga
 - `.planning/ROADMAP.md` — phase structure (continues numbering)
 - `.planning/STATE.md` — reset for new milestone
 
-**After:** `/skill:gsd-plan-phase [N]` to start execution.
+**After:** Run `/skill:gsd-discuss-phase [N]` to clarify the approach (or `/skill:gsd-plan-phase [N]` to plan directly); then `/skill:gsd-execute-phase [N]` to execute.
 </objective>
 
 <execution_context>

package/pi/package-skills/gsd-new-project/SKILL.md

@@ -32,7 +32,7 @@ Initialize a new project through unified flow: questioning → research (optiona
 - `.planning/ROADMAP.md` — phase structure
 - `.planning/STATE.md` — project memory
 
-**After this command:** Run `/skill:gsd-plan-phase 1` to start execution.
+**After this command:** Run `/skill:gsd-discuss-phase 1` to clarify the approach (or `/skill:gsd-plan-phase 1` to plan directly); then `/skill:gsd-execute-phase 1` to execute.
 </objective>
 
 <execution_context>

package/scripts/changeset/lint.cjs

@@ -20,6 +20,9 @@ const LINT_REASON = Object.freeze({
   OK_FRAGMENT_PRESENT: 'ok_fragment_present',
   OK_OPT_OUT_LABEL: 'ok_opt_out_label',
   OK_NO_USER_FACING_CHANGES: 'ok_no_user_facing_changes',
+  // #5903: the release pipeline's own PRs consume every fragment into
+  // CHANGELOG.md, so they carry none by design.
+  OK_RELEASE_PIPELINE: 'ok_release_pipeline',
   FAIL_MISSING_FRAGMENT: 'fail_missing_fragment',
   FAIL_INVALID_FRAGMENT: 'fail_invalid_fragment',
   FAIL_PR_FIELD_DRIFT: 'fail_pr_field_drift',
@@ -86,13 +89,18 @@ function findPrFieldDrift(prEntries, realPrNumber) {
   return drift;
 }
 
-function evaluateLint({ changedFiles, labels, fragmentFailures = [], prFieldDrift = [] }) {
+function evaluateLint({
+  changedFiles, labels, fragmentFailures = [], prFieldDrift = [], releasePipelineKind = null,
+}) {
   if (fragmentFailures.length > 0) {
     return { ok: false, reason: LINT_REASON.FAIL_INVALID_FRAGMENT, failures: fragmentFailures };
   }
   if (prFieldDrift.length > 0) {
     return { ok: false, reason: LINT_REASON.FAIL_PR_FIELD_DRIFT, drift: prFieldDrift };
   }
+  if (releasePipelineKind) {
+    return { ok: true, reason: LINT_REASON.OK_RELEASE_PIPELINE, releasePipelineKind };
+  }
   if (changedFiles.some(isFragment)) {
     return { ok: true, reason: LINT_REASON.OK_FRAGMENT_PRESENT };
   }
@@ -107,6 +115,7 @@ function evaluateLint({ changedFiles, labels, fragmentFailures = [], prFieldDrif
 
 const { ExitError, runMain } = require('../lib/cli-exit.cjs');
 const { parseFragment } = require('./parse.cjs');
+const { releasePipelinePrKind } = require('../release-pipeline-pr.cjs');
 
 function main() {
   const fs = require('node:fs');
@@ -119,6 +128,12 @@ function main() {
   // `pull_request` in the payload, or no payload at all) — the drift check
   // below is a no-op in that case, it never fails a push run.
   let realPrNumber = null;
+  // #5903: head/base refs and whether the head lives in this repository, for
+  // the release-pipeline exemption. sameRepo is false when anything is missing
+  // (a deleted fork has head.repo === null).
+  let headRef;
+  let baseRef;
+  let sameRepo = false;
   if (eventPath && fs.existsSync(eventPath)) {
     try {
       const event = JSON.parse(fs.readFileSync(eventPath, 'utf8'));
@@ -126,6 +141,12 @@ function main() {
       if (event.pull_request && Number.isInteger(event.pull_request.number)) {
         realPrNumber = event.pull_request.number;
       }
+      headRef = event.pull_request?.head?.ref;
+      baseRef = event.pull_request?.base?.ref;
+      const headRepo = event.pull_request?.head?.repo?.full_name;
+      const thisRepo = process.env.GITHUB_REPOSITORY;
+      sameRepo = typeof headRepo === 'string' && typeof thisRepo === 'string'
+        && headRepo !== '' && headRepo.toLowerCase() === thisRepo.toLowerCase();
     } catch { /* fall through */ }
   }
   // #2988: local fallback must match the repo's integration branch (`next`),
@@ -176,11 +197,15 @@ function main() {
   }
 
   const prFieldDrift = findPrFieldDrift(prEntries, realPrNumber);
-  const verdict = evaluateLint({ changedFiles, labels, fragmentFailures, prFieldDrift });
+  const releasePipelineKind = releasePipelinePrKind({ headRef, baseRef, sameRepo });
+  const verdict = evaluateLint({
+    changedFiles, labels, fragmentFailures, prFieldDrift, releasePipelineKind,
+  });
   if (process.argv.includes('--json')) {
     process.stdout.write(JSON.stringify({ ...verdict, changedFiles, labels }, null, 2) + '\n');
   } else if (verdict.ok) {
-    process.stdout.write(`ok changeset-lint: ${verdict.reason}\n`);
+    const kind = verdict.releasePipelineKind ? ` (${verdict.releasePipelineKind})` : '';
+    process.stdout.write(`ok changeset-lint: ${verdict.reason}${kind}\n`);
   } else if (verdict.reason === LINT_REASON.FAIL_INVALID_FRAGMENT) {
     process.stderr.write(`\nERROR changeset-lint: ${verdict.reason}\n`);
     process.stderr.write(`The following .changeset fragment(s) failed content validation:\n`);

package/scripts/lib/macos-conformance-tier.generated.cjs

@@ -34,6 +34,7 @@ module.exports = {
   "tests/capability-source.test.cjs",
   "tests/capability-state.test.cjs",
   "tests/capability-trust.test.cjs",
+  "tests/changeset-lint.test.cjs",
   "tests/changeset-parse.test.cjs",
   "tests/check-contract-drift.test.cjs",
   "tests/check-predicate.test.cjs",
@@ -105,6 +106,7 @@ module.exports = {
   "tests/gsd-secret-read-guard.test.cjs",
   "tests/gsd-settings-advanced.test.cjs",
   "tests/gsd-statusline.test.cjs",
+  "tests/gsd-tool-dir.platform.test.cjs",
   "tests/gsd-tools-path-refs.test.cjs",
   "tests/gsd-validate-commit-crash-policy.test.cjs",
   "tests/gsd-validate-commit-sigpipe.test.cjs",
@@ -142,6 +144,7 @@ module.exports = {
   "tests/markdown-sectionizer-xml-tags.property.test.cjs",
   "tests/markdown-sectionizer.test.cjs",
   "tests/mcp-catalog.test.cjs",
+  "tests/merge-commit-pr.test.cjs",
   "tests/milestone-archive.test.cjs",
   "tests/milestone-release-tags.test.cjs",
   "tests/milestone-window-single-owner.test.cjs",
@@ -201,6 +204,7 @@ module.exports = {
   "tests/quick-research.test.cjs",
   "tests/reapply-verify-hunks.test.cjs",
   "tests/refactor-1390-t3-characterization.test.cjs",
+  "tests/release-pipeline-pr.test.cjs",
   "tests/require-issue-link-policy.test.cjs",
   "tests/response-language-coverage.test.cjs",
   "tests/retired-artifact-cleanup.test.cjs",

package/scripts/lib/platform-conformance-tier.generated.cjs

@@ -102,6 +102,7 @@ module.exports = {
   "tests/effort-local-install.test.cjs",
   "tests/effort-surface-axis.test.cjs",
   "tests/effort-sync-installed-runtime.test.cjs",
+  "tests/effort-sync-manifest.test.cjs",
   "tests/emitted-ack-trailer.test.cjs",
   "tests/emitted-attribution.test.cjs",
   "tests/emitted-provenance.test.cjs",
@@ -153,6 +154,7 @@ module.exports = {
   "tests/gsd-mcp-server.test.cjs",
   "tests/gsd-path-export-hook.test.cjs",
   "tests/gsd-statusline.test.cjs",
+  "tests/gsd-tool-dir.platform.test.cjs",
   "tests/gsd-validate-commit-crash-policy.test.cjs",
   "tests/gsd-validate-commit-sigpipe.test.cjs",
   "tests/gsd-write-guard.test.cjs",
@@ -287,6 +289,8 @@ module.exports = {
   "tests/quick-review-scope-tip-bound.test.cjs",
   "tests/read-guard.test.cjs",
   "tests/reapply-verify-hunks.test.cjs",
+  "tests/release-ancestry.test.cjs",
+  "tests/release-backmerge-invariants.test.cjs",
   "tests/repo-layout.test.cjs",
   "tests/representative-corpus.test.cjs",
   "tests/require-fs-op-fallback.rule.test.cjs",