@opengsd/gsd-core 1.3.1 → 1.4.0-rc.1

package/gsd-core/bin/lib/verification.cjs

@@ -0,0 +1,193 @@
+"use strict";
+/**
+ * Verification Status — single queryable home for verification-status routing.
+ *
+ * Issue #651: consolidate the pass/gaps_found/human_needed routing that was
+ * previously scattered across ship.md and execute-phase.md into a single
+ * tested module. Both workflow files will later consume this module's routing
+ * table as the single source of truth.
+ *
+ * ADR-457 build-at-publish: source in src/verification.cts, compiled to
+ * gsd-core/bin/lib/verification.cjs (gitignored).
+ *
+ * DEFECT.FRONTMATTER-SCALAR-BROAD-GREP fix: status extraction is scoped to
+ * the leading YAML frontmatter block only. A `status:` line in the body (e.g.
+ * inside a fenced code block) is ignored — this is the exact failure mode that
+ * issue #586 / PR #650 identified. The shared extractFrontmatter parser anchors
+ * its regex at byte 0 of the document, which provides this guarantee.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+// eslint-disable-next-line @typescript-eslint/no-require-imports -- core.cjs is an export= CommonJS module
+const core = require("./core.cjs");
+// eslint-disable-next-line @typescript-eslint/no-require-imports -- frontmatter.cjs is an export= CommonJS module
+const frontmatterMod = require("./frontmatter.cjs");
+const { output, extractPhaseToken } = core;
+const { extractFrontmatter } = frontmatterMod;
+// ─── Constants ────────────────────────────────────────────────────────────────
+/** The set of status values that the gsd-verifier agent emits. */
+const VERIFIER_STATUSES = ['passed', 'gaps_found', 'human_needed'];
+/**
+ * Canonical routing table for verification statuses.
+ *
+ * This is the single source of truth — ship.md and execute-phase.md will
+ * later import from here instead of embedding their own message strings.
+ *
+ * INTERNAL SENTINELS: 'missing' and 'unknown' are operational states constructed
+ * internally — the verifier (gsd-verifier.md) never emits them. The verifier only
+ * emits values in VERIFIER_STATUSES (passed|gaps_found|human_needed). The guard in
+ * readVerificationStatus excludes 'missing' and 'unknown' from raw-status table
+ * lookup so they can only be reached via internal construction paths.
+ *
+ * For 'gaps_found', next_command is built at call time in readVerificationStatus
+ * by substituting the phase number — it is NOT stored as a function in the table.
+ */
+const VERIFICATION_ROUTING_TABLE = {
+    passed: {
+        status: 'passed',
+        next_action: 'Verification passed — continue.',
+        next_command: '',
+    },
+    gaps_found: {
+        status: 'gaps_found',
+        next_action: 'Gaps found. Plan the fixes, then re-run execute-phase before shipping.',
+        // next_command is computed at call time; this entry is never returned directly.
+        next_command: '',
+    },
+    human_needed: {
+        status: 'human_needed',
+        next_action: "Human verification required. Complete the manual tests in the phase's *-UAT.md, then re-run the verify step until status is passed.",
+        next_command: '',
+    },
+    // INTERNAL SENTINEL: constructed when no *-VERIFICATION.md file exists or when
+    // the file has no parseable frontmatter status. Never emitted by the verifier.
+    missing: {
+        status: 'missing',
+        next_action: 'No verification report found — the verify step never completed. Re-run execute-phase.',
+        next_command: '/gsd:execute-phase',
+    },
+    // INTERNAL SENTINEL: constructed when the file has a status value not in
+    // VERIFIER_STATUSES. Never emitted by the verifier.
+    unknown: {
+        status: 'unknown',
+        next_action: '', // filled in dynamically with the raw value
+        next_command: '/gsd:execute-phase',
+    },
+};
+/**
+ * Build a 'missing' result from the routing table.
+ * Used for two early-return paths: no *-VERIFICATION.md file found, and
+ * file present but no parseable frontmatter status.
+ */
+function missingResult() {
+    const route = VERIFICATION_ROUTING_TABLE['missing'];
+    return {
+        status: route.status,
+        next_action: route.next_action,
+        next_command: route.next_command,
+    };
+}
+/**
+ * Read the verification status from the first `*-VERIFICATION.md` file in
+ * phaseDir and return the routing result.
+ *
+ * Behavior:
+ * 1. Find the first file matching `*-VERIFICATION.md` (sorted, take first).
+ *    If none → status 'missing'.
+ * 2. Extract `status` from FRONTMATTER ONLY via the shared extractFrontmatter
+ *    parser (DEFECT.FRONTMATTER-SCALAR-BROAD-GREP fix — parser anchors at byte 0).
+ *    If no frontmatter block or no `status` key → status 'missing'.
+ * 3. Map to routing table. Unknown non-empty value → status 'unknown'.
+ *
+ * @param phaseDir - Absolute path to the phase directory.
+ * @param opts     - Options. `opts.fs` allows test injection (defaults to node:fs).
+ */
+function readVerificationStatus(phaseDir, opts = {}) {
+    const fsImpl = opts.fs ?? node_fs_1.default;
+    // Phase token for the gaps_found command
+    const baseName = node_path_1.default.basename(phaseDir);
+    const phaseToken = extractPhaseToken(baseName);
+    const phaseNumber = phaseToken.length > 0 ? phaseToken : baseName;
+    // 1. Find *-VERIFICATION.md
+    let verificationFile = null;
+    try {
+        const entries = fsImpl.readdirSync(phaseDir);
+        const candidates = entries.filter((f) => f.endsWith('-VERIFICATION.md')).sort();
+        verificationFile = candidates.length > 0 ? candidates[0] : null;
+    }
+    catch {
+        // Directory unreadable → treat as missing
+        verificationFile = null;
+    }
+    if (!verificationFile) {
+        return missingResult();
+    }
+    // 2. Read and parse frontmatter using the shared parser.
+    // extractFrontmatter anchors at byte 0, so body `status:` lines are ignored.
+    const filePath = node_path_1.default.join(phaseDir, verificationFile);
+    let rawStatus = null;
+    try {
+        const content = fsImpl.readFileSync(filePath, 'utf-8');
+        const fm = extractFrontmatter(content);
+        const statusVal = fm['status'];
+        // status is always a scalar string in a well-formed VERIFICATION.md frontmatter;
+        // only accept string values — arrays and objects are not valid status values.
+        if (typeof statusVal === 'string') {
+            const trimmed = statusVal.trim();
+            rawStatus = trimmed.length > 0 ? trimmed : null;
+        }
+    }
+    catch {
+        rawStatus = null;
+    }
+    if (!rawStatus) {
+        return missingResult();
+    }
+    // 3. Route — exclude internal sentinels from raw-file lookup (they are
+    // constructed internally above, never written by the verifier).
+    if (rawStatus in VERIFICATION_ROUTING_TABLE && rawStatus !== 'missing' && rawStatus !== 'unknown') {
+        const entry = VERIFICATION_ROUTING_TABLE[rawStatus];
+        // gaps_found: build the phase-specific command here rather than in the table.
+        const next_command = rawStatus === 'gaps_found'
+            ? `/gsd:plan-phase ${phaseNumber} --gaps`
+            : entry.next_command;
+        return {
+            status: entry.status,
+            next_action: entry.next_action,
+            next_command,
+        };
+    }
+    // Unknown value
+    const unknownRoute = VERIFICATION_ROUTING_TABLE['unknown'];
+    return {
+        status: unknownRoute.status,
+        next_action: `Unexpected verification status '${rawStatus}'. Re-run execute-phase verification.`,
+        next_command: unknownRoute.next_command,
+    };
+}
+/**
+ * CLI command handler: resolve phaseDir against cwd, call readVerificationStatus,
+ * emit via core.output().
+ *
+ * @param cwd         - Current working directory (used to resolve phaseDirArg).
+ * @param phaseDirArg - Phase directory path (absolute or relative to cwd).
+ * @param raw         - Whether to emit raw (non-JSON) output.
+ */
+function cmdVerificationStatus(cwd, phaseDirArg, raw) {
+    if (!phaseDirArg) {
+        core.error('phase directory required for verification.status');
+        return;
+    }
+    const phaseDir = node_path_1.default.resolve(cwd, phaseDirArg);
+    const result = readVerificationStatus(phaseDir);
+    output(result, raw);
+}
+module.exports = {
+    VERIFIER_STATUSES,
+    VERIFICATION_ROUTING_TABLE,
+    readVerificationStatus,
+    cmdVerificationStatus,
+};

package/gsd-core/bin/lib/verify.cjs

@@ -550,13 +550,13 @@ function cmdValidateConsistency(cwd, raw) {
     const roadmapContentRaw = node_fs_1.default.readFileSync(roadmapPath, 'utf-8');
     const roadmapContent = extractCurrentMilestone(roadmapContentRaw, cwd);
     const roadmapPhases = new Set();
-    const phasePattern = /#{2,4}\s*(?:\[[^\]]+\]\s*)?Phase\s+([\w][\w.-]*(?:-[\w.-]+)*)\s*:/gi;
+    const phasePattern = /#{2,4}\s*(?:\[[^\]]+\]\s*)?Phase\s+([\w][\w.-]*)\s*:/gi;
     let m;
     while ((m = phasePattern.exec(roadmapContent)) !== null) {
         roadmapPhases.add(m[1]);
     }
     const fullRoadmapPhases = new Set();
-    const fullPhasePattern = /#{2,4}\s*(?:\[[^\]]+\]\s*)?Phase\s+([\w][\w.-]*(?:-[\w.-]+)*)\s*:/gi;
+    const fullPhasePattern = /#{2,4}\s*(?:\[[^\]]+\]\s*)?Phase\s+([\w][\w.-]*)\s*:/gi;
     let fm;
     while ((fm = fullPhasePattern.exec(roadmapContentRaw)) !== null) {
         fullRoadmapPhases.add(fm[1]);

package/gsd-core/bin/lib/workstream-inventory.cjs

@@ -20,7 +20,7 @@ const node_fs_1 = __importDefault(require("node:fs"));
 const node_path_1 = __importDefault(require("node:path"));
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const core = require("./core.cjs");
-const { toPosixPath, readSubdirectories } = core;
+const { readSubdirectories } = core;
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const planScan = require("./plan-scan.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports

package/gsd-core/bin/lib/worktree-base-ref.cjs

@@ -0,0 +1,325 @@
+"use strict";
+/**
+ * Worktree base-ref detection and degradation logic (issue #683).
+ *
+ * Determines whether a worktree's HEAD has drifted from the fork base that the
+ * Claude Code harness would use to create a 'fresh' parallel worktree. When
+ * drift is detected the caller should fall back to sequential execution on the
+ * main working tree to avoid a base mismatch.
+ *
+ * Pure/testable module: all I/O is injectable via the `deps` argument so unit
+ * tests can run without touching the real filesystem or spawning real git.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.shortSha = shortSha;
+exports.readBaseRefFromSettings = readBaseRefFromSettings;
+exports.applyWorktreeBaseRef = applyWorktreeBaseRef;
+exports.resolveEffectiveBaseRef = resolveEffectiveBaseRef;
+exports.cmdWorktreeBaseCheck = cmdWorktreeBaseCheck;
+exports.cmdWorktreeSetBaseRef = cmdWorktreeSetBaseRef;
+exports.evaluateWorktreeBaseDegrade = evaluateWorktreeBaseDegrade;
+const node_fs_1 = __importDefault(require("node:fs"));
+const node_path_1 = __importDefault(require("node:path"));
+const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
+// ─── Internal helpers ─────────────────────────────────────────────────────────
+/**
+ * Strip JSONC comments (line and block forms) from a string to produce valid JSON.
+ * Handles comments inside strings correctly (does not strip them).
+ * Mirrors the same logic in bin/install.js:stripJsonComments.
+ */
+function stripJsonComments(text) {
+    let result = '';
+    let i = 0;
+    let inString = false;
+    let stringChar = '';
+    while (i < text.length) {
+        // Handle string literals — don't strip comments inside strings
+        if (inString) {
+            if (text[i] === '\\') {
+                result += text[i] + (text[i + 1] || '');
+                i += 2;
+                continue;
+            }
+            if (text[i] === stringChar) {
+                inString = false;
+            }
+            result += text[i];
+            i++;
+            continue;
+        }
+        // Start of string
+        if (text[i] === '"' || text[i] === "'") {
+            inString = true;
+            stringChar = text[i];
+            result += text[i];
+            i++;
+            continue;
+        }
+        // Line comment
+        if (text[i] === '/' && text[i + 1] === '/') {
+            // Skip to end of line
+            while (i < text.length && text[i] !== '\n')
+                i++;
+            continue;
+        }
+        // Block comment
+        if (text[i] === '/' && text[i + 1] === '*') {
+            i += 2;
+            while (i < text.length && !(text[i] === '*' && text[i + 1] === '/'))
+                i++;
+            i += 2; // skip closing */
+            continue;
+        }
+        result += text[i];
+        i++;
+    }
+    // Remove trailing commas before } or ] (common in JSONC)
+    return result.replace(/,\s*([}\]])/g, '$1');
+}
+/**
+ * Parse a string as JSONC (JSON with comments). Returns the parsed value or
+ * throws a SyntaxError if the content is genuinely malformed.
+ */
+function parseJsonc(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return JSON.parse(stripJsonComments(text));
+    }
+}
+// ─── Message constants (verbatim — downstream docs/tests depend on these) ─────
+function buildMsgDiverged(headSha, forkRef, forkSha) {
+    return `⚠ Worktree base mismatch: HEAD (${shortSha(headSha)}) differs from ${forkRef} (${shortSha(forkSha)}). Running this phase sequentially on the main working tree. To keep parallel worktrees, set worktree.baseRef:"head" in .claude/settings.local.json (or run: gsd-tools worktree set-baseref). See #683.`;
+}
+const MSG_UNKNOWN = `⚠ Cannot determine the worktree fork base (origin/HEAD unresolved). Running this phase sequentially on the main working tree to avoid a base mismatch. To keep parallel worktrees, set worktree.baseRef:"head" in .claude/settings.local.json (or run: gsd-tools worktree set-baseref). See #683.`;
+// ─── Exports ──────────────────────────────────────────────────────────────────
+/**
+ * Returns the first 8 characters of a SHA, or '' if null/empty.
+ */
+function shortSha(sha) {
+    if (!sha)
+        return '';
+    return sha.slice(0, 8);
+}
+/**
+ * Extracts settings.worktree.baseRef if it is a string; otherwise null.
+ * Defensive: settings may be null/undefined, worktree may be missing or
+ * not an object.
+ */
+function readBaseRefFromSettings(settings) {
+    if (settings == null || typeof settings !== 'object')
+        return null;
+    const s = settings;
+    if (s.worktree == null || typeof s.worktree !== 'object' || Array.isArray(s.worktree))
+        return null;
+    const worktree = s.worktree;
+    if (typeof worktree.baseRef !== 'string')
+        return null;
+    return worktree.baseRef;
+}
+/**
+ * No-clobber application of worktree.baseRef = 'head'.
+ *
+ * - If baseRef is absent/null/undefined → set to 'head', return changed:true.
+ * - If already 'head' → skip, return skipped:'already-head'.
+ * - If any other string → skip without overwriting, return skipped:'explicit-other'.
+ *
+ * Mutates `settings` in place and also returns it.
+ */
+function applyWorktreeBaseRef(settings) {
+    // Defensive: caller must pass a plain object — reject null, arrays, and primitives.
+    if (settings === null || Array.isArray(settings) || typeof settings !== 'object') {
+        throw new TypeError(`applyWorktreeBaseRef: expected a plain object, got ${settings === null ? 'null' : Array.isArray(settings) ? 'array' : typeof settings}`);
+    }
+    // Ensure worktree object exists, preserving any existing keys
+    if (settings.worktree == null || typeof settings.worktree !== 'object' || Array.isArray(settings.worktree)) {
+        settings.worktree = {};
+    }
+    const worktree = settings.worktree;
+    const current = typeof worktree.baseRef === 'string' ? worktree.baseRef : null;
+    if (current === 'head') {
+        return { changed: false, settings, skipped: 'already-head', previous: 'head' };
+    }
+    if (current !== null) {
+        // Some other explicit string value — don't overwrite
+        return { changed: false, settings, skipped: 'explicit-other', previous: current };
+    }
+    // Absent/null/undefined → set to 'head'
+    worktree.baseRef = 'head';
+    return { changed: true, settings, skipped: null, previous: null };
+}
+/**
+ * Reads settings.local.json then settings.json under claudeDir, extracts
+ * worktree.baseRef from the first file that provides a non-null string value.
+ *
+ * deps.readFile(path) must return the file contents or null on any error.
+ */
+function resolveEffectiveBaseRef(claudeDir, deps) {
+    const readFile = deps?.readFile ?? ((p) => {
+        try {
+            return node_fs_1.default.readFileSync(p, 'utf8');
+        }
+        catch {
+            return null;
+        }
+    });
+    const localPath = node_path_1.default.join(claudeDir, 'settings.local.json');
+    const sharedPath = node_path_1.default.join(claudeDir, 'settings.json');
+    function parseBaseRef(filePath) {
+        const contents = readFile(filePath);
+        if (contents == null)
+            return null;
+        try {
+            const parsed = parseJsonc(contents);
+            return readBaseRefFromSettings(parsed);
+        }
+        catch {
+            return null;
+        }
+    }
+    const localRef = parseBaseRef(localPath);
+    if (localRef !== null)
+        return localRef;
+    return parseBaseRef(sharedPath);
+}
+/**
+ * CLI command: check current worktree base-ref degradation status.
+ *
+ * Reads effective baseRef from <cwd>/.claude settings, runs degradation
+ * evaluation, writes JSON result to stdout (or injected write), and returns
+ * the result object.
+ */
+function cmdWorktreeBaseCheck(cwd, _args, deps) {
+    const claudeDir = node_path_1.default.join(cwd, '.claude');
+    const effectiveBaseRef = resolveEffectiveBaseRef(claudeDir, deps?.readFile ? { readFile: deps.readFile } : undefined);
+    const result = evaluateWorktreeBaseDegrade({
+        cwd,
+        effectiveBaseRef,
+        execGit: deps?.execGit,
+    });
+    const write = deps?.write ?? ((s) => process.stdout.write(s));
+    write(JSON.stringify(result, null, 2) + '\n');
+    return result;
+}
+/**
+ * CLI command: write worktree.baseRef = 'head' into <cwd>/.claude/settings.local.json.
+ *
+ * No-clobber: if the file already has an explicit baseRef that is not 'head',
+ * the existing value is preserved and output reflects skipped:'explicit-other'.
+ * If the file contains malformed JSON, throws a clear error rather than
+ * silently clobbering the user's file.
+ */
+function cmdWorktreeSetBaseRef(cwd, _args, deps) {
+    const file = node_path_1.default.join(cwd, '.claude', 'settings.local.json');
+    const readFile = deps?.readFile ??
+        ((p) => { try {
+            return node_fs_1.default.readFileSync(p, 'utf8');
+        }
+        catch {
+            return null;
+        } });
+    const raw = readFile(file);
+    let settings = {};
+    if (raw != null) {
+        let parsed;
+        try {
+            parsed = parseJsonc(raw);
+        }
+        catch {
+            throw new Error(`Refusing to modify ${file}: existing JSON is malformed`);
+        }
+        if (parsed === null || Array.isArray(parsed) || typeof parsed !== 'object') {
+            throw new Error(`Refusing to modify ${file}: expected a JSON object at the top level`);
+        }
+        settings = parsed;
+    }
+    const apply = applyWorktreeBaseRef(settings);
+    if (apply.changed) {
+        const dir = node_path_1.default.dirname(file);
+        const existsSync = deps?.existsSync ?? node_fs_1.default.existsSync;
+        const mkdirFn = deps?.mkdir ??
+            ((p, opts) => { node_fs_1.default.mkdirSync(p, opts); });
+        if (!existsSync(dir)) {
+            mkdirFn(dir, { recursive: true });
+        }
+        const writeFile = deps?.writeFile ??
+            ((p, content) => { node_fs_1.default.writeFileSync(p, content, 'utf8'); });
+        writeFile(file, JSON.stringify(settings, null, 2) + '\n');
+    }
+    const output = {
+        changed: apply.changed,
+        skipped: apply.skipped,
+        previous: apply.previous,
+        baseRef: 'head',
+        file,
+    };
+    const write = deps?.write ?? ((s) => process.stdout.write(s));
+    write(JSON.stringify(output, null, 2) + '\n');
+    return output;
+}
+/**
+ * Evaluates whether the current worktree HEAD has diverged from the fork base
+ * (origin/HEAD) that the Claude Code harness would use when creating a 'fresh'
+ * parallel worktree.
+ *
+ * Returns a structured result with shouldDegrade, reason, and a user-visible
+ * message when degradation is warranted.
+ */
+function evaluateWorktreeBaseDegrade(deps) {
+    const execGit = deps?.execGit ?? shell_command_projection_cjs_1.execGit;
+    const cwd = deps?.cwd;
+    const cwdOpts = cwd ? { cwd } : {};
+    // a. If baseRef is explicitly 'head' the harness forks from HEAD — no mismatch possible.
+    // Claude Code's worktree.baseRef accepts only "fresh" (= origin/HEAD, the default) or "head".
+    // Therefore special-casing "head" here and otherwise comparing HEAD against origin/HEAD is
+    // complete: any non-"head" value (including "fresh" and absent/null) has fresh/origin-HEAD
+    // semantics and must be evaluated against origin/HEAD. (Reference: Claude Code worktrees docs, #683.)
+    if (deps?.effectiveBaseRef === 'head') {
+        return { shouldDegrade: false, reason: 'baseref-head', message: null, headSha: null, forkRef: null, forkSha: null };
+    }
+    // b. Resolve HEAD sha.
+    const headResult = execGit(['rev-parse', 'HEAD'], cwdOpts);
+    const headStdout = headResult.stdout ? headResult.stdout.trim() : '';
+    if (headResult.exitCode !== 0 || !headStdout) {
+        return { shouldDegrade: false, reason: 'no-head', message: null, headSha: null, forkRef: null, forkSha: null };
+    }
+    const headSha = headStdout;
+    // c. Resolve fork base (what the harness forks 'fresh' worktrees from = origin/HEAD).
+    let forkRef = null;
+    let forkSha = null;
+    // Try direct origin/HEAD rev-parse first.
+    const directResult = execGit(['rev-parse', '--verify', '--quiet', 'origin/HEAD'], cwdOpts);
+    const directStdout = directResult.stdout ? directResult.stdout.trim() : '';
+    if (directResult.exitCode === 0 && directStdout) {
+        forkRef = 'origin/HEAD';
+        forkSha = directStdout;
+    }
+    else {
+        // Fall back via symbolic-ref → refs/remotes/origin/HEAD
+        const symResult = execGit(['symbolic-ref', '--quiet', 'refs/remotes/origin/HEAD'], cwdOpts);
+        const symStdout = symResult.stdout ? symResult.stdout.trim() : '';
+        if (symResult.exitCode === 0 && symStdout) {
+            const ref = symStdout;
+            const symShaResult = execGit(['rev-parse', '--verify', '--quiet', ref], cwdOpts);
+            const symShaStdout = symShaResult.stdout ? symShaResult.stdout.trim() : '';
+            if (symShaResult.exitCode === 0 && symShaStdout) {
+                // Strip leading 'refs/remotes/' to get e.g. 'origin/next'
+                forkRef = ref.replace(/^refs\/remotes\//, '');
+                forkSha = symShaStdout;
+            }
+        }
+    }
+    // d. Evaluate.
+    if (forkSha === null) {
+        return { shouldDegrade: true, reason: 'fork-ref-unknown', message: MSG_UNKNOWN, headSha, forkRef: null, forkSha: null };
+    }
+    if (forkSha === headSha) {
+        return { shouldDegrade: false, reason: 'head-matches-fork', message: null, headSha, forkRef, forkSha };
+    }
+    const message = buildMsgDiverged(headSha, forkRef, forkSha);
+    return { shouldDegrade: true, reason: 'head-diverged-from-fork', message, headSha, forkRef, forkSha };
+}

package/gsd-core/bin/lib/worktree-safety.cjs

@@ -406,6 +406,12 @@ function defaultFindSummaryFiles(worktreePath) {
  *
  * For each *SUMMARY.md found under <worktreePath>/.planning/:
  *   - compute relative path from worktree root  → .planning/<id>-SUMMARY.md
+ *   - if the file is ALREADY COMMITTED on the worktree branch
+ *     (`git cat-file -e HEAD:<relPath>` returns exit 0), skip the copy entirely:
+ *     the merge will carry it naturally and copying it as an untracked file would
+ *     cause a "untracked working tree files would be overwritten by merge" collision.
+ *     On timeout or fatal exit (128) the rescue is also skipped (fail-closed).
+ *     (#706 — execute-phase committed-SUMMARY contract)
  *   - destination = <repoRoot>/<relPath>
  *   - copy when dest is absent or content differs
  *
@@ -419,6 +425,7 @@ function defaultFindSummaryFiles(worktreePath) {
  *     failure — it sets needsCopy=true and the copy is attempted normally.
  */
 function rescueSummaryArtifacts(worktreePath, repoRoot, deps) {
+    const execGit = deps.execGit || execGitDefault;
     const findSummaryFiles = deps.findSummaryFiles || defaultFindSummaryFiles;
     const existsSync = deps.existsSync || node_fs_1.default.existsSync;
     const readFileSync = deps.readFileSync || ((p) => node_fs_1.default.readFileSync(p, 'utf8'));
@@ -432,6 +439,30 @@ function rescueSummaryArtifacts(worktreePath, repoRoot, deps) {
         // Normalize to forward slashes so the Set comparison against `git status --porcelain`
         // output works on Windows too (git always emits forward slashes in porcelain output).
         const relPath = absPath.slice(worktreePath.length).replace(/^[/\\]/, '').replace(/\\/g, '/');
+        // #706: skip rescue when the SUMMARY is already committed on the branch.
+        // Use `git cat-file -e HEAD:<relPath>` (not `ls-files --error-unmatch`) so
+        // the check is against the committed tree, not the index.  ls-files also
+        // matches staged-but-uncommitted files, which would skip rescue when the
+        // file is staged but not yet committed — the merge wouldn't carry it, and
+        // the executor's content could be lost.  cat-file -e HEAD:<path> returns
+        // exit 0 only when the object exists in the committed HEAD tree.
+        //
+        // Fail-closed on timeout/fatal git errors: if we cannot determine whether
+        // the file is committed, do NOT rescue it (rescuing an actually-committed
+        // file would re-create the untracked collision; the merge will surface the
+        // issue).  The cleanup will be blocked by merge_failed in the worst case,
+        // which is the observable behaviour before this fix and is recoverable.
+        const catFileResult = execGit(['-C', worktreePath, 'cat-file', '-e', `HEAD:${relPath}`], { cwd: repoRoot });
+        if (catFileResult.exitCode !== 1) {
+            // Rescue only when cat-file definitively reports the object is absent (exit 1).
+            //   exit 0  → object exists (committed on HEAD) — merge will carry it, skip.
+            //   exit 128 → fatal git error (corrupt store, unborn HEAD, etc.) — uncertain,
+            //              fail-closed: do NOT rescue to avoid recreating the #706 collision.
+            //   timedOut / null / other → unreliable result — same fail-closed policy.
+            // In all non-1 cases the merge will either succeed naturally (0) or surface
+            // the problem safely (128/timeout), which is the recoverable pre-fix behaviour.
+            continue;
+        }
         const dest = node_path_1.default.join(repoRoot, relPath);
         let needsCopy = !existsSync(dest);
         if (!needsCopy) {

package/gsd-core/bin/shared/config-schema.manifest.json

@@ -106,7 +106,8 @@
     "model_policy.budget",
     "model_policy.high",
     "model_policy.medium",
-    "model_policy.low"
+    "model_policy.low",
+    "agent_skills_security.trusted_global_roots"
   ],
   "runtimeStateKeys": [
     "workflow._auto_chain_active"

package/gsd-core/bin/verify-reapply-patches.cjs

@@ -32,6 +32,7 @@
 const fs = require('node:fs');
 const path = require('node:path');
 const crypto = require('node:crypto');
+const { ExitError, runMain } = require('./lib/cli-exit.cjs');
 
 const SIGNIFICANT_MIN_CHARS = 12;
 const GSD_HOOK_VERSION_LINE_RE = /^(?:\/\/|#)\s*gsd-hook-version:\s*\S+\s*$/i;
@@ -48,10 +49,9 @@ function parseArgs(argv) {
       process.stdout.write(
         'usage: verify-reapply-patches.cjs --patches-dir <path> --config-dir <path> [--pristine-dir <path>] [--json]\n',
       );
-      process.exit(0);
+      throw new ExitError(0);
     } else {
-      process.stderr.write(`unknown argument: ${arg}\n`);
-      process.exit(2);
+      throw new ExitError(2, `unknown argument: ${arg}`);
     }
   }
   return opts;
@@ -281,16 +281,13 @@ function verifyFile({ relPath, patchesDir, configDir, pristineDir, pristineHashe
 function main() {
   const opts = parseArgs(process.argv.slice(2));
   if (!opts.patchesDir || !opts.configDir) {
-    process.stderr.write('--patches-dir and --config-dir are required\n');
-    process.exit(2);
+    throw new ExitError(2, '--patches-dir and --config-dir are required');
   }
   if (!fs.existsSync(opts.patchesDir)) {
-    process.stderr.write(`patches dir not found: ${opts.patchesDir}\n`);
-    process.exit(2);
+    throw new ExitError(2, `patches dir not found: ${opts.patchesDir}`);
   }
   if (!fs.existsSync(opts.configDir)) {
-    process.stderr.write(`config dir not found: ${opts.configDir}\n`);
-    process.exit(2);
+    throw new ExitError(2, `config dir not found: ${opts.configDir}`);
   }
 
   const files = walk(opts.patchesDir).filter((f) => !f.endsWith('backup-meta.json'));
@@ -342,11 +339,11 @@ function main() {
     }
   }
 
-  process.exit(failures.length > 0 ? 1 : 0);
+  return failures.length > 0 ? 1 : 0;
 }
 
 if (require.main === module) {
-  main();
+  runMain(main);
 }
 
 module.exports = { computeUserAddedLines, isSignificantLine, verifyFile, walk, REASON, readPristineHashes, sha256 };